feat(btw): constrain computer use by loop runtime

[YUZHEthefool]

Preflight

• Existing Issues and PRs were searched.
• This follows the current-branch, no-legacy, Python 3.14+ policy.
• Exactly one Agent note is provided by the actual author.

Problem

Each loop needs a clear Computer Use boundary that also survives handoff and respects the current authorization model.

Proposal

Keep Computer Use unavailable to conversation and let work inherit or explicitly select none/local/sandbox. Apply restrictions through current request/tool assembly and the existing authorization service.

Design: PR #28 and its English proposal. Parent: P / #122. PR #28 is documentation only; this issue tracks follow-up implementation or evaluation.

Associated PR: PR #142 (non-draft; base split/btw-loop-models).

Acceptance criteria

• When BTW is enabled, conversation does not mount Computer Use; work consistently applies inherit/none/local/sandbox configuration.
• Main-agent and handoff execution use equivalent restrictions, including missing/invalid loop metadata and runtime selections.
• When BTW is disabled, current master behavior is retained. Loop selection never grants permissions or substitutes for authorization.
• Current configuration-scoped IM roles, WebChat checks, and control-plane authorization remain intact. Do not copy obsolete prototype-wide IM denial or BTW-specific elevation markers.
• Settings, bilingual documentation, and tests cover the runtime matrix and denied execution paths.

Dependencies and delivery

Blocked by: B1 / #123

B8 / #130-B10 / #132 use this runtime boundary; implementation must integrate with the current tool catalog rather than restore dispersed tool injection.

Implementation anchors

Historical prototype 33ee103a62937db3e930c89ba47a648b75cc7772 provides provenance, not code to copy unchanged:

• astrbot/core/pipeline/process_stage/method/agent_sub_stages/internal.py: loop-specific build configuration.
• astrbot/core/astr_agent_tool_exec.py: handoff toolset preparation.
• astrbot/core/config/default.py: Computer Use runtime choices.

Integrate with the current tool catalog, Skill snapshot assembly, and authorization service, rechecking current master when implementation begins.

Validation

Commands below are required for the implementation PR, not results claimed by this issue.

Existing current-master regression baseline:

uv run pytest tests/unit/test_agent_internal_process.py tests/unit/test_astr_agent_tool_exec.py tests/unit/test_authorization_service.py tests/unit/test_skill_tool_assembly.py

For changed documentation, run pnpm run docs:build from docs/ and make check-md from the repository root. Update OpenAPI and generated outputs together only if the HTTP contract changes.

Out of scope

Authorization redesign, automatic elevation, new sandbox backends, and legacy configuration support are outside scope.

Repository requirements

Follow AGENTS.md, GOVERNANCE.md, and AI_POLICY.md. This issue uses the feature_request template. Keep Python 3.14+, current configuration shapes, existing authorization boundaries, and bilingual feature documentation. A follow-up PR requires human maintainer review and a separate AI-assisted review. Use the feat PR template for the corresponding work.

Author

Agent

Agent note

Codex prepared this development issue at the user's request from PR #28, its discussion, the referenced source, existing tests, and current-master integration points. AI assisted the research and English drafting. Filing this issue changes no runtime behavior and does not claim feature tests or model trials have passed. Remaining decisions concern implementation details and experimental evidence within the stated scope.