fix: enforce role tool whitelist

hub/src/feishu/fileDeliveryTool.ts

@@ -1,9 +1,10 @@
-import { createSdkMcpServer, tool, type McpSdkServerConfigWithInstance } from "@anthropic-ai/claude-agent-sdk";
+import { createSdkMcpServer, tool, type McpSdkServerConfigWithInstance, type SdkMcpToolDefinition } from "@anthropic-ai/claude-agent-sdk";
 import { z } from "zod";
 import { sendApprovalCard, sendFile, type FeishuRuntime, type SendMessageOptions } from "./client.js";
 import { resolveDeliverableFile } from "./fileDelivery.js";
 import { readFeishuContext } from "./read.js";
 import type { ApprovalManager } from "./approval.js";
+import { CPH_HUB_MCP_TOOL_IDS, type CphHubMcpToolId } from "../agent/roleTools.js";
 
 export interface FileDeliveryToolOptions {
   readonly rt: FeishuRuntime;
@@ -14,20 +15,15 @@ export interface FileDeliveryToolOptions {
   readonly sendOptions?: SendMessageOptions | undefined;
   readonly approvalManager: ApprovalManager;
   readonly onDelivered?: (path: string) => void;
+  readonly tools?: readonly CphHubMcpToolId[] | undefined;
 }
 
 export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): McpSdkServerConfigWithInstance {
-  return createSdkMcpServer({
-    name: "cph_hub",
-    version: "0.0.0",
-    alwaysLoad: true,
-    instructions:
-      "Use send_file when the user asks to receive, resend, download, or attach a file. " +
-      "Do not claim a file was sent unless send_file returns success. " +
-      "If a generated file path is uncertain, list or inspect the workspace first, then call send_file with the actual path. " +
-      "Use feishu_read_context when the trigger context contains a reply, thread, or message anchor and more Feishu context is needed. " +
-      "Use request_approval when explicit human approval or confirmation is required before continuing.",
-    tools: [
+  const enabledTools = new Set(options.tools ?? CPH_HUB_MCP_TOOL_IDS);
+  const tools: Array<SdkMcpToolDefinition<any>> = [];
+
+  if (enabledTools.has("send_file")) {
+    tools.push(
       tool(
         "send_file",
         "Upload an existing project/repository file to the current Feishu chat. The path must point to a concrete file, for example build/student.pdf or README.md.",
@@ -59,6 +55,11 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
         },
         { alwaysLoad: true },
       ),
+    );
+  }
+
+  if (enabledTools.has("feishu_read_context")) {
+    tools.push(
       tool(
         "feishu_read_context",
         "Read Feishu context for the current project's bound chat. Use anchor ids from the trigger context; this tool never reads arbitrary chats.",
@@ -81,6 +82,11 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
         },
         { alwaysLoad: true },
       ),
+    );
+  }
+
+  if (enabledTools.has("request_approval")) {
+    tools.push(
       tool(
         "request_approval",
         "Send an interactive Feishu approval/confirmation card to the current chat and wait for a button click.",
@@ -128,6 +134,33 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
         },
         { alwaysLoad: true },
       ),
-    ],
+    );
+  }
+
+  const instructions = mcpInstructions(enabledTools);
+  return createSdkMcpServer({
+    name: "cph_hub",
+    version: "0.0.0",
+    alwaysLoad: true,
+    ...(instructions === "" ? {} : { instructions }),
+    tools,
   });
 }
+
+function mcpInstructions(enabledTools: ReadonlySet<CphHubMcpToolId>): string {
+  const instructions: string[] = [];
+  if (enabledTools.has("send_file")) {
+    instructions.push(
+      "Use send_file when the user asks to receive, resend, download, or attach a file.",
+      "Do not claim a file was sent unless send_file returns success.",
+      "If a generated file path is uncertain, list or inspect the workspace first, then call send_file with the actual path.",
+    );
+  }
+  if (enabledTools.has("feishu_read_context")) {
+    instructions.push("Use feishu_read_context when the trigger context contains a reply, thread, or message anchor and more Feishu context is needed.");
+  }
+  if (enabledTools.has("request_approval")) {
+    instructions.push("Use request_approval when explicit human approval or confirmation is required before continuing.");
+  }
+  return instructions.join(" ");
+}

hub/src/feishu/trigger.ts

@@ -41,6 +41,7 @@ import { ApprovalManager } from "./approval.js";
 import { SenderNameCache } from "./senderCache.js";
 import { TriggerQueue, triggerQueue as defaultTriggerQueue, type QueuedTrigger } from "./triggerQueue.js";
 import { createSlashCommandRegistry, formatSlashHelpTarget, parseSlashHelpSubcommand, parseSlashInvocation } from "./slashCommands.js";
+import { cphHubMcpToolsForRole, roleToolsAllow } from "../agent/roleTools.js";
 
 export { ApprovalManager } from "./approval.js";
 export type { ApprovalResult, PendingApproval } from "./approval.js";
@@ -183,7 +184,8 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     // Per-role bundle (ADR-0017): systemPrompt seeds persona; tools whitelist
     // is enforced inside runAgent when it builds the SDK tools record. `tools:
     // undefined` means the full registered set (unrestricted role).
-    const systemPrompt = withFileDeliveryInstructions(role?.systemPrompt);
+    const roleTools = role?.tools;
+    const systemPrompt = withFileDeliveryInstructions(role?.systemPrompt, roleTools);
     const feishuTriggerContext = await buildFeishuTriggerContext({
       msg,
       chatId,
@@ -299,6 +301,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       workspaceDir: project.workspaceDir,
       sendOptions,
       approvalManager,
+      tools: cphHubMcpToolsForRole(roleTools),
       onDelivered: (path) => {
         deliveredFiles.push(path);
       },
@@ -315,6 +318,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       systemPrompt,
       providerEnv: provider.sdkEnv,
       resumeSessionId: sessionMetadata.claudeSessionId,
+      tools: roleTools,
       mcpServers: { cph_hub: fileDeliveryMcpServer },
       maxTurns: runPolicy.maxTurns,
       runId: run.id,
@@ -963,7 +967,8 @@ async function senderAuditMetadata(rt: FeishuRuntime, openId: string): Promise<P
   return sender as Prisma.InputJsonObject;
 }
 
-function withFileDeliveryInstructions(systemPrompt: string | undefined): string {
+function withFileDeliveryInstructions(systemPrompt: string | undefined, roleTools: readonly string[] | undefined): string | undefined {
+  if (!roleToolsAllow(roleTools, "send_file")) return systemPrompt;
   const fileDeliveryPrompt =
     "When the user asks you to send, resend, attach, or provide a file, call the cph_hub send_file tool with the actual existing file path. " +
     "Do not say a file is attached or sent unless that tool returns success.";