From c2903da6a5df35d288af8cbebbd5055f6fb1d753 Mon Sep 17 00:00:00 2001 From: danielhanchen Date: Sun, 19 Jul 2026 11:39:02 +0000 Subject: [PATCH] Studio: clarify that shell network commands are blocked, not allowlisted The reworded note said the tools can reach an allowlist of public sites, but that egress is only for code execution; the terminal tool's network commands are blocked. Distinguish the two so the note is accurate for both tools. --- studio/backend/core/inference/tools.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/studio/backend/core/inference/tools.py b/studio/backend/core/inference/tools.py index 57da12cc13..cfb2fd1a6c 100644 --- a/studio/backend/core/inference/tools.py +++ b/studio/backend/core/inference/tools.py @@ -2956,10 +2956,11 @@ _SANDBOX_PATHS_NOTE = ( " The working directory is an isolated scratch space that may already hold " "files from earlier work in this conversation or project, plus anything you " "create here or that is uploaded; it persists across this conversation and, " - "for a project, across the project's threads. It can reach only a fixed " - "allowlist of public sites (such as github.com, huggingface.co, and " - "pypi.org), not the user's own machines, private hosts, or arbitrary " - "addresses. A repository, folder, or file the user refers to is not present " + "for a project, across the project's threads. Code execution can fetch from a " + "fixed allowlist of public sites (such as github.com, huggingface.co, and " + "pypi.org); shell network commands are blocked, and neither can reach the " + "user's own machines, private hosts, or arbitrary addresses. A repository, " + "folder, or file the user refers to is not present " "here unless it was uploaded, created here, or already part of this project, " "so list the working directory to see what is available rather than assuming " "a mentioned path exists or guessing where it lives. Read and write files "