fix: enforce role tool whitelist

hub/src/agent/runner.ts

@@ -30,6 +30,7 @@
 import { homedir } from "node:os";
 import { query, type McpServerConfig, type SDKMessage, type SDKAssistantMessage, type SDKUserMessage, type SDKResultMessage, type SDKPartialAssistantMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { PrismaClient } from "@prisma/client";
+import { claudeSdkToolConfigForRole } from "./roleTools.js";
 
 export interface ProjectContext {
   readonly projectId: string;
@@ -54,6 +55,13 @@ export interface RunRequest {
   readonly systemPrompt: string | undefined;
   readonly providerEnv?: Record<string, string | undefined> | undefined;
   readonly resumeSessionId?: string | undefined;
+  /**
+   * RoleEntry.tools from admin/runtime settings. Values are Hub role tool ids
+   * (for example read_file/cph_check/send_file), mapped to Claude SDK tool
+   * names at run setup. `undefined` means the full supported tool surface; []
+   * means no tools.
+   */
+  readonly tools?: readonly string[] | undefined;
   readonly mcpServers?: Record<string, McpServerConfig> | undefined;
   readonly maxTurns?: number;
   readonly runId: string;
@@ -131,10 +139,12 @@ export async function runAgent(req: RunRequest): Promise<RunResult> {
   let error: string | undefined;
   try {
     await persistAgentMessage(req, "user", req.prompt);
+    const toolConfig = claudeSdkToolConfigForRole(req.tools);
 
     const options: Parameters<typeof query>[0]["options"] = {
       cwd: req.project.workspaceDir,
-      allowedTools: ["Read", "Write", "Bash", "Glob", "Grep"],
+      tools: [...toolConfig.tools],
+      allowedTools: [...toolConfig.allowedTools],
       maxTurns: cap,
       includePartialMessages: true,
       // ADR-0018: bypass interactive prompts (headless server); the sandbox