feat: gate code runs by user whitelist

src/utils/agentRunMode.ts

@@ -13,6 +13,23 @@ export const agentCodeRunsAutodetectEnabled = envFlag(
   import.meta.env.VITE_AGENT_CODE_RUNS_AUTODETECT,
 );
 
+function parseUserIdSet(value: unknown): Set<string> {
+  return new Set(
+    String(value ?? '')
+      .split(',')
+      .map((item) => item.trim())
+      .filter(Boolean),
+  );
+}
+
+const agentCodeRunUserIds = parseUserIdSet(import.meta.env.VITE_AGENT_CODE_RUNS_USER_IDS);
+
+export function agentCodeRunsEnabledForUser(userId?: string | null): boolean {
+  if (!agentCodeRunsEnabled) return false;
+  if (agentCodeRunUserIds.size === 0) return true;
+  return Boolean(userId && agentCodeRunUserIds.has(userId));
+}
+
 const CODE_TASK_PATTERNS = [
   /\b(repo|repository|branch|commit|pull request|pr|diff|patch)\b/i,
   /\b(aider|openhands|codex|codebase|workspace)\b/i,
@@ -27,13 +44,15 @@ export function resolveAgentRunOptions(
     taskType = 'code_task',
     forceCode = false,
     allowAutodetect = agentCodeRunsAutodetectEnabled,
+    userId = null,
   }: {
     taskType?: string;
     forceCode?: boolean;
     allowAutodetect?: boolean;
+    userId?: string | null;
   } = {},
 ): AgentRunCreateOptions {
-  if (!agentCodeRunsEnabled) return {};
+  if (!agentCodeRunsEnabledForUser(userId)) return {};
   const normalizedText = String(text ?? '').trim();
   const shouldUseCode = forceCode || (allowAutodetect && CODE_TASK_PATTERNS.some((pattern) => pattern.test(normalizedText)));
   if (!shouldUseCode) return {};