feat: gate code tools by task mode

2026-07-02 07:12:18 +08:00
parent c9b7252832
commit e17dcaf4a8
11 changed files with 338 additions and 19 deletions
@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import mysql from 'mysql2/promise';
+
+function loadEnvFile(filePath) {
+  if (!fs.existsSync(filePath)) return;
+  for (const line of fs.readFileSync(filePath, 'utf8').split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const idx = trimmed.indexOf('=');
+    if (idx < 0) continue;
+    const key = trimmed.slice(0, idx).trim();
+    const value = trimmed.slice(idx + 1).trim();
+    if (!process.env[key]) process.env[key] = value;
+  }
+}
+
+function parseMysqlConfig() {
+  if (process.env.DATABASE_URL) {
+    const url = new URL(process.env.DATABASE_URL);
+    if (url.protocol !== 'mysql:') {
+      throw new Error(`Unsupported DATABASE_URL scheme for tool runtime check: ${url.protocol}`);
+    }
+    return {
+      host: url.hostname,
+      port: Number(url.port || 3306),
+      user: decodeURIComponent(url.username),
+      password: decodeURIComponent(url.password),
+      database: url.pathname.replace(/^\/+/, ''),
+      charset: 'utf8mb4',
+    };
+  }
+  return {
+    host: process.env.MYSQL_HOST,
+    port: Number(process.env.MYSQL_PORT || 3306),
+    user: process.env.MYSQL_USER,
+    password: process.env.MYSQL_PASSWORD,
+    database: process.env.MYSQL_DATABASE,
+    charset: 'utf8mb4',
+  };
+}
+
+loadEnvFile(process.env.MEMIND_ENV_FILE || path.join(process.cwd(), '.env'));
+
+const conn = await mysql.createConnection(parseMysqlConfig());
+try {
+  const [roleRows] = await conn.query(
+    `SELECT capability_key, allowed
+     FROM h5_capability_grants
+     WHERE subject_type = 'role'
+       AND subject_id = 'user'
+       AND capability_key IN ('aider', 'openhands')
+     ORDER BY capability_key`,
+  );
+  const roleDefaults = Object.fromEntries(
+    roleRows.map((row) => [row.capability_key, Boolean(row.allowed)]),
+  );
+
+  const [userRows] = await conn.query(
+    `SELECT subject_id, capability_key, allowed
+     FROM h5_capability_grants
+     WHERE subject_type = 'user'
+       AND capability_key IN ('aider', 'openhands')
+       AND allowed = 1
+     ORDER BY subject_id, capability_key`,
+  );
+
+  const grantsByUser = new Map();
+  for (const row of userRows) {
+    if (!grantsByUser.has(row.subject_id)) grantsByUser.set(row.subject_id, []);
+    grantsByUser.get(row.subject_id).push(row.capability_key);
+  }
+  const sampledUsers = [...grantsByUser.entries()].slice(0, 10).map(([userId, grantedTools]) => ({
+    userId,
+    grantedTools: grantedTools.sort(),
+    chatHasCodeTools: false,
+    codeHasCodeTools: grantedTools.includes('aider') || grantedTools.includes('openhands'),
+  }));
+
+  const ok = Boolean(
+    roleDefaults.aider === false &&
+    roleDefaults.openhands === false &&
+    sampledUsers.every((user) => user.chatHasCodeTools === false) &&
+    sampledUsers.every((user) => user.codeHasCodeTools === true),
+  );
+
+  console.log(JSON.stringify({
+    ok,
+    checkedAt: new Date().toISOString(),
+    roleDefaults,
+    whitelistUserCount: grantsByUser.size,
+    sampledUsers,
+    runtimePolicy: {
+      defaultMode: 'chat',
+      codeToolMode: 'code',
+      chatInjectsCodeTools: false,
+      aiderTimeoutMs: Number(process.env.MEMIND_AIDER_TIMEOUT_MS ?? 600_000),
+      openhandsTimeoutMs: Number(process.env.MEMIND_OPENHANDS_TIMEOUT_MS ?? 900_000),
+    },
+  }, null, 2));
+  process.exit(ok ? 0 : 1);
+} finally {
+  await conn.end();
+}