feat: gate code runs by user whitelist

src/hooks/usePageEditSubChat.ts

@@ -347,6 +347,7 @@ export function usePageEditSubChat({
           resolveAgentRunOptions(trimmed, {
             taskType: 'page_edit_code_task',
             forceCode: true,
+            userId: user?.id ?? null,
           }),
         );
         const finishedRun =

src/hooks/useTKMindChat.ts

@@ -1173,7 +1173,10 @@ export function useTKMindChat(
           activeSessionId,
           requestId,
           userMessage,
-          resolveAgentRunOptions(trimmed, { taskType: 'h5_chat_code_task' }),
+          resolveAgentRunOptions(trimmed, {
+            taskType: 'h5_chat_code_task',
+            userId: userRef.current?.id ?? null,
+          }),
         );
         const finishedRun =
           createdRun.status === 'succeeded' ? createdRun : await waitForAgentRun(createdRun.id);

src/utils/agentRunMode.ts

@@ -13,6 +13,23 @@ export const agentCodeRunsAutodetectEnabled = envFlag(
   import.meta.env.VITE_AGENT_CODE_RUNS_AUTODETECT,
 );
 
+function parseUserIdSet(value: unknown): Set<string> {
+  return new Set(
+    String(value ?? '')
+      .split(',')
+      .map((item) => item.trim())
+      .filter(Boolean),
+  );
+}
+
+const agentCodeRunUserIds = parseUserIdSet(import.meta.env.VITE_AGENT_CODE_RUNS_USER_IDS);
+
+export function agentCodeRunsEnabledForUser(userId?: string | null): boolean {
+  if (!agentCodeRunsEnabled) return false;
+  if (agentCodeRunUserIds.size === 0) return true;
+  return Boolean(userId && agentCodeRunUserIds.has(userId));
+}
+
 const CODE_TASK_PATTERNS = [
   /\b(repo|repository|branch|commit|pull request|pr|diff|patch)\b/i,
   /\b(aider|openhands|codex|codebase|workspace)\b/i,
@@ -27,13 +44,15 @@ export function resolveAgentRunOptions(
     taskType = 'code_task',
     forceCode = false,
     allowAutodetect = agentCodeRunsAutodetectEnabled,
+    userId = null,
   }: {
     taskType?: string;
     forceCode?: boolean;
     allowAutodetect?: boolean;
+    userId?: string | null;
   } = {},
 ): AgentRunCreateOptions {
-  if (!agentCodeRunsEnabled) return {};
+  if (!agentCodeRunsEnabledForUser(userId)) return {};
   const normalizedText = String(text ?? '').trim();
   const shouldUseCode = forceCode || (allowAutodetect && CODE_TASK_PATTERNS.some((pattern) => pattern.test(normalizedText)));
   if (!shouldUseCode) return {};

src/vite-env.d.ts

@@ -9,6 +9,7 @@ interface ImportMetaEnv {
   readonly VITE_MINDSPACE_BASE?: string;
   readonly VITE_AGENT_CODE_RUNS_ENABLED?: string;
   readonly VITE_AGENT_CODE_RUNS_AUTODETECT?: string;
+  readonly VITE_AGENT_CODE_RUNS_USER_IDS?: string;
 }
 
 interface ImportMeta {