fix: make public agents (is_public=1) accessible to all users

Three changes to fix the CS agent (3490efa8) and other public agents not being
accessible to regular users:

- agents.py: include is_public=1 agents in listing query for non-admin users
- agent_chat.py: add is_public check in chat/stream permission guards
- permission_service.py: grant read+execute to all users for public agents

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/api/agent_chat.py

@@ -425,7 +425,7 @@ async def chat_with_agent(
     agent = db.query(Agent).filter(Agent.id == agent_id).first()
     if not agent:
         raise HTTPException(status_code=404, detail="Agent 不存在")
-    if agent.user_id and agent.user_id != current_user.id and current_user.role != "admin":
+    if agent.user_id and agent.user_id != current_user.id and current_user.role != "admin" and not agent.is_public:
         raise HTTPException(status_code=403, detail="无权访问该 Agent")
 
     # 从 Agent 配置构建 Runtime
@@ -525,7 +525,7 @@ async def chat_with_agent_stream(
     agent = db.query(Agent).filter(Agent.id == agent_id).first()
     if not agent:
         raise HTTPException(status_code=404, detail="Agent 不存在")
-    if agent.user_id and agent.user_id != current_user.id and current_user.role != "admin":
+    if agent.user_id and agent.user_id != current_user.id and current_user.role != "admin" and not agent.is_public:
         raise HTTPException(status_code=403, detail="无权访问该 Agent")
 
     wc = agent.workflow_config or {}

backend/app/api/agents.py

@@ -148,7 +148,8 @@ async def get_agents(
         query = db.query(Agent).filter(
             or_(
                 Agent.id.in_(db.query(owned_agents.c.id)),
-                Agent.id.in_(db.query(user_permissions.c.agent_id))
+                Agent.id.in_(db.query(user_permissions.c.agent_id)),
+                Agent.is_public == 1
             )
         )
 

backend/app/services/permission_service.py

@@ -85,7 +85,11 @@ def check_agent_permission(
     # Agent所有者拥有所有权限
     if agent.user_id == user.id:
         return True
-    
+
+    # 公开Agent允许所有用户read和execute
+    if agent.is_public and permission_type in ("read", "execute"):
+        return True
+
     # 检查用户直接权限
     user_permission = db.query(AgentPermission).filter(
         AgentPermission.agent_id == agent.id,