feat: gate code agent runs server side

.runtime/portal/scripts/check-agent-code-run-entry.mjs

@@ -140,6 +140,8 @@ const toolGrants = await queryToolGrants().catch((err) => ({
 }));
 
 const buildFlags = {
+  serverCodeRunsEnabledEnv: process.env.MEMIND_AGENT_CODE_RUNS_ENABLED ?? null,
+  serverCodeRunsEnabledTruthy: truthy(process.env.MEMIND_AGENT_CODE_RUNS_ENABLED),
   enabledEnv: process.env.VITE_AGENT_CODE_RUNS_ENABLED ?? null,
   autodetectEnv: process.env.VITE_AGENT_CODE_RUNS_AUTODETECT ?? null,
   enabledTruthy: truthy(process.env.VITE_AGENT_CODE_RUNS_ENABLED),
@@ -157,6 +159,7 @@ const ok = Boolean(
   runtimePolicy.defaultMode === 'chat' &&
   runtimePolicy.codeToolMode === 'code' &&
   runtimePolicy.chatInjectsCodeTools === false &&
+  runtimePolicy.codeRunsEnabled === buildFlags.serverCodeRunsEnabledTruthy &&
   roleDefaults.aider === false &&
   roleDefaults.openhands === false &&
   (toolGrants.sampledUsers ?? []).every((user) => user.chatHasCodeTools === false) &&

.runtime/portal/server.mjs

@@ -6744,7 +6744,14 @@ function createAgentRunGateway({
 }
 
 // agent-run-routes.mjs
-function createPostAgentRunsHandler({ userAuth: userAuth2, agentRunGateway: agentRunGateway2 }) {
+function envFlag(value) {
+  return ["1", "true", "yes", "on"].includes(String(value ?? "").trim().toLowerCase());
+}
+function createPostAgentRunsHandler({
+  userAuth: userAuth2,
+  agentRunGateway: agentRunGateway2,
+  codeRunsEnabled = envFlag(process.env.MEMIND_AGENT_CODE_RUNS_ENABLED)
+}) {
   return async function postAgentRuns(request, response) {
     try {
       const sessionId = String(request.body?.session_id ?? "").trim() || null;
@@ -6769,6 +6776,10 @@ function createPostAgentRunsHandler({ userAuth: userAuth2, agentRunGateway: agen
         });
         return;
       }
+      if (toolMode === "code" && !codeRunsEnabled) {
+        response.status(403).json({ message: "\u4EE3\u7801\u4EFB\u52A1\u7070\u5EA6\u672A\u5F00\u542F" });
+        return;
+      }
       if (sessionId) {
         const owns = await userAuth2.ownsSession(request.currentUser.id, sessionId);
         if (!owns) {
@@ -9338,6 +9349,9 @@ function createTkmindProxy({
         defaultMode: "chat",
         codeToolMode: "code",
         chatInjectsCodeTools: false,
+        codeRunsEnabled: ["1", "true", "yes", "on"].includes(
+          String(process.env.MEMIND_AGENT_CODE_RUNS_ENABLED ?? "").trim().toLowerCase()
+        ),
         aiderTimeoutMs: Number(process.env.MEMIND_AIDER_TIMEOUT_MS ?? 6e5),
         openhandsTimeoutMs: Number(process.env.MEMIND_OPENHANDS_TIMEOUT_MS ?? 9e5)
       },