feat: gate code tools by task mode

user-auth.mjs

@@ -1802,7 +1802,7 @@ export function createUserAuth(pool, options = {}) {
     };
   };
 
-  const getAgentSessionPolicy = async (userId) => {
+  const getAgentSessionPolicy = async (userId, { toolMode = 'chat' } = {}) => {
     const user = await getUserById(userId);
     if (!user) throw new Error('用户不存在');
     const capabilityState = await resolveUserCapabilities(user);
@@ -1810,9 +1810,10 @@ export function createUserAuth(pool, options = {}) {
     await syncUserSkillsForUser(user);
     if (capabilityState.unrestricted) {
       return {
-        ...buildAgentExtensionPolicy(capabilityState.capabilities, { unrestricted: true }),
+        ...buildAgentExtensionPolicy(capabilityState.capabilities, { unrestricted: true, toolMode }),
         policies: {},
         unrestricted: true,
+        toolMode,
       };
     }
     const effectiveCapabilities = applyPoliciesToCapabilities(
@@ -1846,13 +1847,18 @@ export function createUserAuth(pool, options = {}) {
         unrestricted: false,
         policies: policyState.policies,
         sandboxMcp,
+        toolMode,
       }),
       capabilities: effectiveCapabilities,
       policies: policyState.policies,
       unrestricted: false,
+      toolMode,
     };
   };
 
+  const getCodeAgentSessionPolicy = async (userId) =>
+    getAgentSessionPolicy(userId, { toolMode: 'code' });
+
   const getRoleCapabilities = async (role = 'user') => {
     const roleDefaults = await listCapabilityGrants('role', role);
     const capabilities = {};
@@ -2870,6 +2876,7 @@ export function createUserAuth(pool, options = {}) {
     seedRoleCapabilityDefaults,
     resolveUserCapabilities,
     getAgentSessionPolicy,
+    getCodeAgentSessionPolicy,
     getRoleCapabilities,
     setRoleCapabilities,
     getUserCapabilities,