feat: add memindadm runtime policy for agent code runs (Phase 1.5)

Persist code-run gates in admin DB and expose them via /auth/status so H5 can honor runtime policy without VITE rebuilds.

Co-authored-by: Cursor <cursoragent@cursor.com>

admin-routes.mjs

@@ -32,6 +32,7 @@ function plazaRouteError(res, req, error) {
  * @param {object|null} deps.llmProviderService
  * @param {object|null} deps.memoryV2ConfigService
  * @param {object|null} deps.skillRuntimeConfigService
+ * @param {object|null} deps.agentCodeRunPolicyService
  * @param {object|null} deps.adminSystemTestService
  * @param {object|null} deps.plazaPosts
  * @param {object|null} deps.plazaOps
@@ -48,6 +49,7 @@ export function createAdminApi({
   memoryV2ConfigService,
   mindSearchConfigService,
   skillRuntimeConfigService,
+  agentCodeRunPolicyService,
   adminSystemTestService,
   plazaPosts,
   plazaOps,
@@ -248,6 +250,40 @@ export function createAdminApi({
     return res.json(await skillRuntimeConfigService.getPublicRuntimeConfig());
   });
 
+  adminApi.get('/agent-code-run/config', requireAdmin, async (_req, res) => {
+    if (!agentCodeRunPolicyService?.getAdminConfig) {
+      return res.status(503).json({ message: 'Agent Code Run 配置服务未启用' });
+    }
+    return res.json(await agentCodeRunPolicyService.getAdminConfig());
+  });
+
+  const updateAgentCodeRunConfig = async (req, res) => {
+    if (!agentCodeRunPolicyService?.updateAdminConfig) {
+      return res.status(503).json({ message: 'Agent Code Run 配置服务未启用' });
+    }
+    try {
+      const result = await agentCodeRunPolicyService.updateAdminConfig(req.body?.config ?? req.body ?? {}, {
+        updatedBy: req.currentUser.id,
+      });
+      return res.json(result);
+    } catch (err) {
+      if (err?.code === 'CODE_RUN_POLICY_ENV_LOCKED') {
+        return res.status(409).json({ message: err.message });
+      }
+      throw err;
+    }
+  };
+
+  adminApi.put('/agent-code-run/config', requireAdmin, updateAgentCodeRunConfig);
+  adminApi.patch('/agent-code-run/config', requireAdmin, updateAgentCodeRunConfig);
+
+  adminApi.get('/agent-code-run/runtime', requireAdmin, async (_req, res) => {
+    if (!agentCodeRunPolicyService?.getRuntimeState) {
+      return res.status(503).json({ message: 'Agent Code Run 配置服务未启用' });
+    }
+    return res.json(await agentCodeRunPolicyService.getRuntimeState());
+  });
+
   adminApi.post('/system-tests/skill-validation', requireAdmin, async (req, res) => {
     if (!adminSystemTestService?.runSkillValidation) {
       return res.status(503).json({ message: '系统测试服务未启用' });