feat: add fail-closed Aider development skill

agent-run-routes.mjs

@@ -1,4 +1,5 @@
 import { normalizeAgentRunToolMode } from './agent-run-gateway.mjs';
+import { AIDER_DEVELOPMENT_SKILL_NAME } from './chat-skills.mjs';
 import { createSessionAccess } from './session-broker.mjs';
 import {
   extractRunFromStreamEvent,
@@ -51,6 +52,41 @@ function hasExpectedFileValidation(userMessage) {
   });
 }
 
+function selectedChatSkill(userMessage) {
+  const metadata = userMessage?.metadata;
+  const runMetadata = metadata?.memindRun ?? metadata?.agentRun ?? {};
+  return String(runMetadata.selectedChatSkill ?? '').trim();
+}
+
+export function enforceSelectedSkillRuntime(userMessage, {
+  rawToolMode = 'chat',
+  taskType = null,
+} = {}) {
+  if (selectedChatSkill(userMessage) !== AIDER_DEVELOPMENT_SKILL_NAME) {
+    return { userMessage, rawToolMode, taskType, requiredExecutor: null };
+  }
+  const message = userMessage && typeof userMessage === 'object' && !Array.isArray(userMessage)
+    ? { ...userMessage }
+    : { value: userMessage };
+  const metadata = message.metadata && typeof message.metadata === 'object' && !Array.isArray(message.metadata)
+    ? { ...message.metadata }
+    : {};
+  const runMetadata = metadata.memindRun && typeof metadata.memindRun === 'object' && !Array.isArray(metadata.memindRun)
+    ? { ...metadata.memindRun }
+    : {};
+  metadata.memindRun = {
+    ...runMetadata,
+    selectedChatSkill: AIDER_DEVELOPMENT_SKILL_NAME,
+    executor: 'aider',
+  };
+  return {
+    userMessage: { ...message, metadata },
+    rawToolMode: 'code',
+    taskType: 'h5_chat_code_task',
+    requiredExecutor: 'aider',
+  };
+}
+
 export function createPostAgentRunsHandler({
   userAuth,
   sessionAccess = null,
@@ -86,9 +122,9 @@ export function createPostAgentRunsHandler({
     try {
       const sessionId = String(request.body?.session_id ?? '').trim() || null;
       const requestId = String(request.body?.request_id ?? '').trim();
-      const userMessage = request.body?.user_message ?? null;
-      const rawToolMode = request.body?.tool_mode ?? request.body?.toolMode ?? 'chat';
-      const taskType = String(request.body?.task_type ?? request.body?.taskType ?? '').trim() || null;
+      let userMessage = request.body?.user_message ?? null;
+      let rawToolMode = request.body?.tool_mode ?? request.body?.toolMode ?? 'chat';
+      let taskType = String(request.body?.task_type ?? request.body?.taskType ?? '').trim() || null;
       const forceDeepReasoning = request.body?.force_deep_reasoning === true || request.body?.forceDeepReasoning === true;
       if (!requestId) {
         response.status(400).json({ message: '缺少 request_id' });
@@ -98,6 +134,23 @@ export function createPostAgentRunsHandler({
         response.status(400).json({ message: '缺少 user_message' });
         return;
       }
+      const selectedSkillRuntime = enforceSelectedSkillRuntime(userMessage, {
+        rawToolMode,
+        taskType,
+      });
+      userMessage = selectedSkillRuntime.userMessage;
+      rawToolMode = selectedSkillRuntime.rawToolMode;
+      taskType = selectedSkillRuntime.taskType;
+      if (
+        selectedSkillRuntime.requiredExecutor &&
+        userAuth?.getUserSkills
+      ) {
+        const skillState = await userAuth.getUserSkills(request.currentUser.id);
+        if (!skillState?.skills?.[AIDER_DEVELOPMENT_SKILL_NAME]) {
+          response.status(403).json({ message: '当前用户未授权 Aider 开发技能' });
+          return;
+        }
+      }
       let toolMode = 'chat';
       try {
         toolMode = normalizeAgentRunToolMode(rawToolMode);