吸收数字员工技能调用审计

qimingclaw/crates/agent-electron-client/src/main/services/packages/mcp.ts

@@ -38,6 +38,7 @@ import { resolveNpmPackageEntry } from "../utils/spawnNoWindow";
 import { APP_DATA_DIR_NAME } from "../constants";
 import { isWindows } from "../system/shellEnv";
 import { persistentMcpBridge } from "./persistentMcpBridge";
+import { applyDigitalEmployeeMcpExecutionPolicy } from "../digitalEmployee/skillExecutionPolicy";
 
 type PerfValue = string | number | boolean | null | undefined;
 
@@ -920,7 +921,8 @@ class McpProxyManager {
     string,
     { command: string; args: string[]; env?: Record<string, string> }
   > | null {
-    const servers = this.config.mcpServers;
+    const policyConfig = applyDigitalEmployeeMcpExecutionPolicy(this.config) as McpServersConfig;
+    const servers = policyConfig.mcpServers;
     if (!servers || Object.keys(servers).length === 0) {
       return null;
     }
@@ -947,8 +949,8 @@ class McpProxyManager {
     // 2. stdio server：
     //    - persistent server（如 chrome-devtools）→ 优先使用 bridge URL（已在 PersistentMcpBridge 中运行）
     //    - 动态 MCP server → bridge 中没有注册，降级到 stdio 配置（由 mcp-proxy 按需 spawn）
-    const globalAllowTools = this.config.allowTools;
-    const globalDenyTools = this.config.denyTools;
+    const globalAllowTools = policyConfig.allowTools;
+    const globalDenyTools = policyConfig.denyTools;
 
     for (const [name, entry] of Object.entries(servers)) {
       const effectiveAllowTools =