feat: add admin permission checks config item for computer use feature

[Soulter]

Modifications / 改动点

• This is NOT a breaking change. / 这不是一个破坏性变更。

Screenshots or Test Results / 运行截图或测试结果

---

Checklist / 检查清单

• 😊 如果 PR 中有新加入的功能，已经通过 Issue / 邮件等方式和作者讨论过。/ If there are new features added in the PR, I have discussed it with the authors through issues/emails, etc.
• 👀 我的更改经过了良好的测试，并已在上方提供了“验证步骤”和“运行截图”。/ My changes have been well-tested, and "Verification Steps" and "Screenshots" have been provided above.
• 🤓 我确保没有引入新依赖库，或者引入了新依赖库的同时将其添加到了 requirements.txt 和 pyproject.toml 文件相应位置。/ I have ensured that no new dependencies are introduced, OR if new dependencies are introduced, they have been added to the appropriate locations in requirements.txt and pyproject.toml.
• 😮 我的更改没有引入恶意代码。/ My changes do not introduce malicious code.

Summary by Sourcery

将 Python 和 shell 的 computer-use 工具置于可配置的仅管理员权限之下，并在提供方配置元数据中暴露该设置。

新功能：

• 引入一个可配置的提供方设置 computer_use_require_admin，用于控制 Python 和 shell 的 computer-use 工具是否需要 AstrBot 管理员权限。
• 添加配置元数据和 i18n 条目，使得可以通过 Web UI 管理计算机使用所需的管理员权限。

增强：

• 将 Python 和 shell 执行工具的管理员权限检查进行集中化处理，以复用通用逻辑并提升权限处理的一致性。

Original summary in English

Summary by Sourcery

Gate Python and shell computer-use tools behind configurable admin-only permissions and expose the setting in provider configuration metadata.

New Features:

• Introduce a configurable provider setting computer_use_require_admin to control whether Python and shell computer-use tools require AstrBot admin privileges.
• Add configuration metadata and i18n entries so the admin permission requirement for computer use can be managed via the Web UI.

Enhancements:

• Centralize admin-permission checks for Python and shell execution tools to reuse common logic and improve consistency of permission handling.

[dosubot]

Related Documentation

Checked 1 published document(s) in 1 knowledge base(s). No updates required.

^{How did I do? Any feedback?}  

[sourcery-ai]

Hey - 我发现了 1 个问题，并留下了一些整体性的反馈：

• _check_admin_permission 辅助函数在 python.py 和 shell.py 中都有重复实现；建议把它移动到一个共享模块或工具函数中，这样可以让权限逻辑集中管理，更便于维护。
• _check_admin_permission 返回的错误信息现在不再区分本地和非本地执行（例如之前是“Local shell execution”，现在是“Shell execution”）；如果这种区分对用户很重要，建议根据被调用的具体工具对消息进行参数化。

给 AI 代理的提示词

Please address the comments from this code review:

## Overall Comments
- `_check_admin_permission` 辅助函数在 `python.py` 和 `shell.py` 中都有重复实现；建议把它移动到一个共享模块或工具函数中，这样可以让权限逻辑集中管理，更便于维护。
- `_check_admin_permission` 返回的错误信息现在不再区分本地和非本地执行（例如之前是“Local shell execution”，现在是“Shell execution”）；如果这种区分对用户很重要，建议根据被调用的具体工具对消息进行参数化。

## Individual Comments

### Comment 1
<location> `astrbot/core/computer/tools/python.py:81-84` </location>
<code_context>
     async def call(
         self, context: ContextWrapper[AstrAgentContext], code: str, silent: bool = False
     ) -> ToolExecResult:
+        if permission_error := _check_admin_permission(context):
+            return permission_error
         sb = await get_booter(
</code_context>

<issue_to_address>
**issue (bug_risk):** `call` 方法被标注为返回 `ToolExecResult`，但在权限检查失败时现在可能会返回一个普通字符串。

由于 `_check_admin_permission` 的返回类型是 `str | None`，这些 `call` 方法现在在某些情况下会返回一个裸的 `str`，而不是声明的 `ToolExecResult`。除非 `ToolExecResult` 明确允许 `str`，否则这会破坏函数的契约，并且可能会让期望获得结构化结果的调用方感到困惑。请将该错误包装成一个符合 `ToolExecResult` 结构的值，或者扩展 `ToolExecResult` 以包含这种情况，并相应地更新调用方。
</issue_to_address>

---

Sourcery 对开源项目是免费的——如果你觉得我们的代码审查有帮助，欢迎分享 ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{帮我变得更有用！请对每条评论点 👍 或 👎，我会根据这些反馈改进之后的评审。}

Original comment in English

Hey - I've found 1 issue, and left some high level feedback:

• The _check_admin_permission helper is duplicated in both python.py and shell.py; consider moving it to a shared module or utility to keep the permission logic centralized and easier to maintain.
• The error message returned from _check_admin_permission no longer distinguishes between local and non-local execution (e.g., previously "Local shell execution" vs now "Shell execution"); if that distinction is important to users, consider parameterizing the message based on the specific tool being called.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `_check_admin_permission` helper is duplicated in both `python.py` and `shell.py`; consider moving it to a shared module or utility to keep the permission logic centralized and easier to maintain.
- The error message returned from `_check_admin_permission` no longer distinguishes between local and non-local execution (e.g., previously "Local shell execution" vs now "Shell execution"); if that distinction is important to users, consider parameterizing the message based on the specific tool being called.

## Individual Comments

### Comment 1
<location> `astrbot/core/computer/tools/python.py:81-84` </location>
<code_context>
     async def call(
         self, context: ContextWrapper[AstrAgentContext], code: str, silent: bool = False
     ) -> ToolExecResult:
+        if permission_error := _check_admin_permission(context):
+            return permission_error
         sb = await get_booter(
</code_context>

<issue_to_address>
**issue (bug_risk):** The `call` method is annotated to return `ToolExecResult` but can now return a plain string on permission failure.

Because `_check_admin_permission` returns `str | None`, these `call` methods now sometimes return a bare `str` instead of the annotated `ToolExecResult`. Unless `ToolExecResult` explicitly permits `str`, this breaks the function’s contract and may confuse callers expecting a structured result. Please either wrap the error in a `ToolExecResult`-shaped value or extend `ToolExecResult` to include this case and update callers accordingly.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

issue (bug_risk): call 方法被标注为返回 ToolExecResult，但在权限检查失败时现在可能会返回一个普通字符串。

由于 _check_admin_permission 的返回类型是 str | None，这些 call 方法现在在某些情况下会返回一个裸的 str，而不是声明的 ToolExecResult。除非 ToolExecResult 明确允许 str，否则这会破坏函数的契约，并且可能会让期望获得结构化结果的调用方感到困惑。请将该错误包装成一个符合 ToolExecResult 结构的值，或者扩展 ToolExecResult 以包含这种情况，并相应地更新调用方。

Original comment in English

issue (bug_risk): The call method is annotated to return ToolExecResult but can now return a plain string on permission failure.

Because _check_admin_permission returns str | None, these call methods now sometimes return a bare str instead of the annotated ToolExecResult. Unless ToolExecResult explicitly permits str, this breaks the function’s contract and may confuse callers expecting a structured result. Please either wrap the error in a ToolExecResult-shaped value or extend ToolExecResult to include this case and update callers accordingly.