feat: add system disclosure policy gate

tkmind-proxy.mjs

@@ -1103,6 +1103,7 @@ export function createTkmindProxy({
   sessionSnapshotService,
   conversationMemoryService,
   memoryV2,
+  systemDisclosurePolicyService = null,
 }) {
   const sessionStore =
     sessionAccess ?? createSessionAccess({ userAuth, enabled: isSessionBrokerEnabled() });
@@ -1645,6 +1646,33 @@ export function createTkmindProxy({
     } = {},
   ) {
     if (!userId || !sessionId) throw new Error('缺少会话信息');
+    let disclosureDecision = null;
+    try {
+      disclosureDecision = systemDisclosurePolicyService?.evaluate?.({
+        userMessage,
+        channel: 'goose_proxy',
+        userId,
+        sessionId,
+      }) ?? null;
+    } catch (err) {
+      console.warn(
+        '[TKMindProxy] system disclosure policy evaluation failed open:',
+        err instanceof Error ? err.message : err,
+      );
+    }
+    if (disclosureDecision?.enforced) {
+      const error = new Error(disclosureDecision.responseText || '不提供本系统内部技术信息');
+      error.code = 'SYSTEM_TECHNICAL_DISCLOSURE';
+      error.status = 403;
+      error.retryable = false;
+      error.policyDecision = {
+        policyId: disclosureDecision.policyId,
+        policyVersion: disclosureDecision.policyVersion,
+        reasonCode: disclosureDecision.reasonCode,
+        categories: disclosureDecision.categories,
+      };
+      throw error;
+    }
     const owns = await sessionStore.validateOwnership(userId, sessionId);
     if (!owns) throw new Error('无权访问该会话');
     const gate = await userAuth.canUseChat(userId);