Studio: permission levels for chat tool calls (Ask, Approve for me, Off, Full access) (#7079)
* Studio: permission levels for chat tool calls (Ask, Approve for me, Off, Full access) Replace the Bypass permissions on/off toggle with a four level permission selector, available in Settings > General (new Permissions section above Notifications), the chat settings panel, the composer plus menu, and a new always visible composer pill. Levels: - Ask for approval: every local tool call pauses for allow/deny. - Approve for me: only calls detected as potentially unsafe pause; the python/terminal sandbox stays on. - Off: never pauses; sandbox stays on (previous default behavior). - Full access: never pauses and the sandbox is disabled. Still requires the danger confirmation and is never restored across reloads. Backend adds permission_mode to the OpenAI compatible and Anthropic passthrough payloads and threads it through both tool loops. Auto mode uses a fail closed classifier in tools.py: terminal commands must be on a read only allowlist with no redirection or substitution, python code is AST scanned for writes, exec, process and network use, MCP tools auto run only with read only style names. Unknown tools always ask. Legacy bypass_permissions and confirm_tool_calls keep their exact behavior for existing API callers. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio permissions: Off is a plain toggle below Full access Off moves to the bottom of the level menu with a short description and acts as the feature-off state: the composer pill is hidden entirely while Off, and reselecting the active level toggles back to Off. * Studio permissions: higher contrast composer pill text The permission pill uses a foreground based grey instead of the shared muted pill color, so it reads darker in light mode and lighter in dark mode. Full access keeps the danger yellow. * Studio permissions: panel dropdown layout and shorter tooltip Chat settings panel: the Bypass permissions label sits on one line with a full width dropdown underneath, styled like the other panel selects. Tooltip shortened and wording uses Unsloth instead of Studio. * Studio permissions: harden auto-mode unsafe detection Extend the Approve for me classifier to catch write and exec paths that slipped through: - terminal: sort -o, tree -o, xxd -r, find -exec/-execdir/-ok/-delete and find -fprint/-fprintf/-fls now ask; plain read-only forms still auto-run. awk is no longer allowlisted since its program can write and call system(). - python: from-imports of mutating names (from os import remove [as rm]) and star imports now ask. Found by a fuzz and edge-case simulation matrix; pinned in test_permission_mode.py. * Studio permissions: split multi-line terminal commands in auto detection A shell runs each line as its own command, but shlex reads newlines as whitespace, so "ls\nrm -rf x" demoted rm to argument position and auto-ran. Normalize newlines and CR to separators, and treat any all separator token as a command boundary so runs of blank lines still split. Found by the simulation matrix; pinned in tests. * Studio permissions: address review feedback on auto-mode detection Auto-mode (Approve for me) safety classifier hardening: - Python: flag any reference to a mutating attribute, not only direct calls, so indirect refs (f = os.remove; f(x)) and aliases ask. Detect Path.open(mode) write modes and wrap the AST walk to fail closed. - Terminal: match attached short output flags (sort -o/tmp/out) and keep find context across grouping parens so find ( -delete ) asks. - Both: ask before reads that escape the sandbox workdir via parent traversal or hit credential paths (.ssh, .aws, id_rsa, .pem, etc.). permission_mode plumbing: - Fold permission_mode=full into bypass_permissions at the request model so route-level confirm-gate guards see it as bypass. - Reject ask/auto on the Anthropic Messages server-tools path, which has no confirmation channel (mirrors the confirm_tool_calls rejection). - Keep forced RAG autoinject in auto mode: the safe search_knowledge_base retrieval never gates, so derive the skip from the real confirm need. - Reset all local preferences now also clears the legacy confirm key so a reset restores the fresh default instead of the old level. Regression tests added for each case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio permissions: close auto-mode classifier gaps from review round 2 Auto mode ("Approve for me") let a few mutating calls through as safe: - os.open(...) always creates/writes a descriptor, so treat it as unsafe even though builtin open in read mode stays safe. - fd -x/--exec/-X/--exec-batch runs a command per match; scan for these alongside find's -exec/-delete. - tempfile writes artefacts and hands back writable handles, so importing it now asks. - Calling the result of a call (getattr(os, "remove")("x"), partials) is a dynamic target the AST can't vet, so fail closed. - An MCP tool whose name pairs a read verb with a mutating one (get_or_create_issue, read_and_delete_file) no longer auto-runs on the read prefix alone. Also fold permission_mode="off" into confirm_tool_calls=False on both request models so the non-stream route guard sees the disabled gate, and drive the Confirm tool calls toggle off permission_mode="ask" so auto no longer shows it on. * Harden auto-mode classifier and normalize bypass to full for PR #7079 Approve for me now asks for a few cases it previously auto-ran: - os.open via an os alias (import os as o; o.open(path, O_CREAT)) - pathlib symlink_to / hardlink_to / link_to - importlib.import_module dynamic imports - os.mkfifo / os.mknod / os.utime Also fold bypass_permissions into full when a stale ask/auto permission_mode is sent alongside it, so the Anthropic route guard no longer 400s those legacy callers. Adds classifier and request-model regression tests. * Close more auto-mode classifier gaps for PR #7079 Approve for me now asks for cases the review surfaced: - builtin open aliased to a name (f = open; from builtins import open as w) or looked up dynamically (globals()['open']) - pickle / marshal / shelve / dill deserialization - io.FileIO write handles - sort --compress-program (runs an external program) - MCP names carrying save/archive/submit/commit/push/sync/register verbs Also refine the attribute open() write check so an explicit read mode (ZipFile.open(name, "r")) stays auto while os.open flags still ask. Adds test coverage for each case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close three more auto-mode gaps for PR #7079 - rg runs an arbitrary program per file via --pre / --hostname-bin, so "Approve for me" now asks for those flags (rg is on the read-only allowlist). - A path-qualified command token (./ls, /tmp/cat) is an arbitrary executable, not the trusted utility its basename matches, so it asks before running. - A direct /chat/completions caller that sets permission_mode ask/auto but omits the legacy confirm_tool_calls flag now self-enables the confirmation gate, so tools can no longer run ungated on that path. Adds classifier and request-model tests for each case. * Close auto-mode classifier gaps from review round 3 for PR #7079 Approve for me now asks for cases the latest pass surfaced: - short-option clusters bundling a write flag (sort -uo out => -u -o) - procfs reads that leak a process env/args/memory (cat /proc/self/environ, /proc/PID/cmdline, maps) - env-assignment prefixes that change command lookup/loading (LD_PRELOAD=x ls, PATH=. ls, IFS=x ls); benign FOO=1 cmd stays auto - os.open imported as a bare callable (from os import open as o) Also drops ps from the safe terminal allowlist: its BSD environment flags (ps auxe, ps eww) dump a parent process's unscrubbed env and cannot be flag-parsed reliably, so ps always asks now. Adds classifier tests for each case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 4 for PR #7079 Terminal (Approve for me now asks for these): - cd dropped from the safe allowlist: cd /; cat etc/passwd moves the shell out of the session workdir so a later relative read escapes it - env -C/--chdir (workdir escape) and -S/--split-string (builds a fresh command line); wrapper flags are now checked - /etc//passwd and /etc/./passwd normalize to /etc/passwd before the sensitive-path scan - a sensitive path split across an assignment and an argument (p=/etc; cat $p/passwd) via best-effort NAME=value expansion Python: - builtins.exec / builtins.eval attribute calls (dynamic code execution) - destructured open aliases (f, _ = (open, print); f('out', 'w')) - a sensitive path composed from literals (os.path.join('/etc','passwd'), '/etc' + '/passwd') - ZipFile/TarFile write modes (ZipFile(name, 'w')); the reader stays auto Adds classifier tests for each case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 5 for PR #7079 Terminal (Approve for me now asks for these): - procfs reads hidden by shell quotes (cat /proc/$PPID/enviro''n) or quoted/nested-variable assignments (p="/proc/$PPID"; cat $p/environ): quotes are stripped and NAME=value prefixes expanded before the scan - LESSOPEN/LESSCLOSE, which make less run an input preprocessor command Python: - os.chdir / os.fchdir, which move the cwd so a later relative read escapes the sandbox workdir - sensitive paths composed via a pathlib / chain (Path('/etc') / 'passwd') or an f-string of literals (f'/proc/{pid}/environ') - runpy (import) and runpy.run_path / run_module, which run arbitrary code Adds classifier tests for each case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 6 for PR #7079 Approve for me now asks for these: - a mutating callable reached through a getattr alias (rm = getattr(os, "remove"); rm("f")): calls through a getattr-bound name fail closed - compound MCP tool names carrying clone/checkout/comment/fork/tag/ invite/share, which start with a read verb but still mutate - a sensitive path hidden behind a glob (cat /e??/passwd, cat /e[t]c/passwd): a ? / * / [..] token is matched against the sensitive-file set and bracket classes are de-obfuscated; benign globs (ls *.py) stay auto Also run first-pass RAG retrieval in off mode: like auto, off never prompts, so a direct caller passing a stale confirm flag should not lose document retrieval (both tool loops). Adds classifier tests for each case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 7 for PR #7079 Approve for me now asks for these: - __builtins__.exec / __builtins__.eval (dynamic code via the dunder) - terminal reads that hide a credential path behind a backslash escape (cat /et\c/passwd) - read-named MCP filesystem calls pointed at a credential path (mcp__fs__read_file {"path": "/etc/passwd"}) - compound MCP names carrying append / prepend - open aliased through a subscript or builtins attribute (f = globals()["open"]; f = builtins.open) then called to write - open(..., **{"mode": "w"}) where a kwargs splat hides the write mode - a sensitive path with a dynamic segment (open(f"/etc/{name}"), os.path.join("/etc", name)); /tmp/{name} stays auto - urllib3 networking Also stop folding permission_mode ask/auto into confirm_tool_calls for external-provider requests: that branch rejects confirm_tool_calls with tools, and the mode only governs local tool calls. Local requests still self-gate. Adds tests for each case. * Close auto-mode classifier gaps from review round 8 for PR #7079 Approve for me now asks for these: - dbm on the unsafe-module list: dbm.open(file, "c"/"n") creates files, and importing the family signals a persistence writer - reads of ~/.azure and ~/.config/gh credential stores (Azure/GitHub tokens), in terminal, MCP arguments, and Python literals - compound MCP names carrying upsert / assign Adds classifier tests for each case. * Gate secret mounts and fix the composer pill count for PR #7079 - Add Docker/Kubernetes secret mount dirs (/run/secrets, /var/run/secrets) to the sensitive-path checks, so Approve for me asks before reading injected credentials (terminal, MCP args, Python). - Count the always-visible permission pill in the composer's compact threshold so labels collapse at the intended width instead of overflowing by one pill. Adds classifier tests for the secret mount paths. * Close auto-mode classifier gaps from review round 10 for PR #7079 Approve for me now asks for these: - qualified pathlib constructors (pathlib.Path('/etc') / name), folded the same as bare Path(...), so a dynamic sensitive path is detected - open aliased through an annotated assignment (f: object = open; f('out', 'w')), tracked like a plain assignment - recursive searches rooted at an absolute path (grep -R TOKEN /home, rg TOKEN /, fd pattern /etc), which read host files outside the sandbox tree; sandbox-relative searches stay auto Adds classifier tests for each case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 11 for PR #7079 Approve for me now asks for these terminal reads, which bash would expand into a sensitive path only after the classifier had approved: - a glob that resolves into a secret mount or credential dir (cat /r?n/secrets/hf_token, cat /root/.s??/id_rsa) - a recursive search rooted at a tilde home (grep -R TOKEN ~root, grep -R TOKEN ~/logs) - a brace expansion that builds a credential path (cat /etc/pass{w,}d) - a default/alternate parameter expansion that builds one (cat /etc/pass${x:-wd}) - an input redirection that hides a glob (cat </e??/passwd) And these python calls: - a str.format-built sensitive path (open('/etc/{}'.format('passwd'))) - writer methods that persist to disk without open() (numpy.save, Image.save, plt.savefig, DataFrame.to_csv, json.dump) Segment-wise directory matching keeps benign globs (ls /home/*/projects) auto. Adds regression tests for each case and its safe counterpart. * Close auto-mode classifier gaps from review round 12 for PR #7079 Approve for me now asks for these too: - a terminal read whose parent traversal hides behind a redirection with no following space (cat <../../notes) - a python read whose path is built with str.join (open(''.join(['/etc', '/passwd']))), told apart from os.path.join - a dynamic-code builtin reached through an alias (from builtins import eval as e; e(...); x = builtins.exec; x(...)) Adds regression tests for each case and its safe counterpart. * Close auto-mode classifier gaps from review round 13 for PR #7079 Approve for me now asks for these too: - a recursive search whose root is hidden behind an assignment (p=/; grep -R TOKEN $p): the recursive-root test now runs on the assignment-expanded tokens as well - a python read whose sensitive path is split through a literal variable (base = '/etc'; open(base + '/passwd')), including via an f-string - numpy ndarray.tofile, which persists without open() - a sequence brace read (cat /etc/pass{w..w}d), expanded alongside the comma brace form before the sensitive-path scan Adds regression tests for each case and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 14 for PR #7079 Approve for me now asks for these python reads that assemble a sensitive path in a form the fold did not yet recognize: - a pathlib object reused through a name (p = Path('/etc'); p / 'passwd') - old-style percent formatting ('%s/%s' % ('/etc', 'passwd')) - Path.joinpath ('/etc'.joinpath('passwd')) - a bytes path literal (open(b'/etc/passwd')) And these terminal reads, which bash expands into a sensitive path only after the classifier had approved: - a substring parameter expansion off an assignment (p=passwd; cat /etc/${p:0:6}) - an ANSI-C quoted path (cat $'/etc/pass\x77d') - a glob into an Azure or GitHub CLI config dir (cat /home/*/.az?re/..., cat /home/*/.config/g?/...) Adds regression tests for each case and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 15 for PR #7079 Approve for me now asks for these terminal reads, which bash expands into a sensitive path only after the classifier had approved: - a per-thread procfs env alias (cat /proc/$PPID/task/$PPID/environ) - a recursive root behind a default parameter (grep -R TOKEN ${root:-/home}) - a path built by pattern replacement (p=passXd; cat /etc/${p/X/w}) And these python reads: - a pathlib .parent/.parents chain that escapes the session workdir ((Path.cwd().parent / 'other' / 'notes').read_text()) - a sensitive path resolved through glob (glob.glob('/e??/passwd')[0]) Adds regression tests for each case and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 16 for PR #7079 Approve for me now asks for these terminal reads, which bash expands into a sensitive path only after the classifier had approved: - a case-modifying parameter expansion (p=PASSWD; cat /etc/${p,,}) - a mutating find action hidden behind an assignment (f=-delete; find . $f) - a glob assembled through an assignment (g=e??; cat /$g/passwd) - a POSIX bracket class glob (cat /etc/pass[[:lower:]]d) And these python reads/writes: - a glob pattern folded from a literal variable (base='/e??'; glob.glob(base + '/passwd')) - a directly imported os.path.join (from os.path import join; join('/etc', 'passwd')) - a directly imported writer (from numpy import save; save(...)) - an aliased pathlib constructor (from pathlib import Path as P; P('/etc') / 'passwd') The find/fd and glob scans now run on the assignment/parameter-expanded command, and pathlib/join/writer import aliases are tracked. Adds regression tests for each case and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode gaps from review round 17 for PR #7079 Two fixes: - Gate sqlite3 in auto mode. sqlite3.connect(path) creates or mutates a database file (and runs DDL/DML) with no open()/writer attribute for the AST checks to catch, so treat the module like dbm and ask. - Only self-enable confirm_tool_calls for Studio's own tool loop. The ask/auto fold previously set confirm on every non-provider request, including a plain client-tool passthrough (client-supplied tools that Studio does not execute), which then tripped the local-tool streaming-confirm route guard and rejected the passthrough. Restrict the fold to requests that actually ask Studio to run tools (enable_tools / enabled_tools / mcp_enabled). Adds regression tests for the sqlite3 write and for the passthrough vs tool-loop confirm behavior. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode gaps from review round 18 for PR #7079 Classifier (auto mode asks for these): - os.open through a module alias (import os as o; o.open(...)); os/posix aliases are tracked like the literal module name. - less/more pagers, whose escapes (+cmd, !shell, -o/--log-file, LESSOPEN) can run a command or write a file the command-name allowlist cannot see, so they are no longer auto-approved. - a read-named MCP tool carrying a mutating query (query_database {"query": "DELETE FROM runs"}); DML/DDL statements are matched as whole statements so a natural-language query that merely contains "delete" stays safe. - ML persistence helpers (save_pretrained / save_file / save_model / save_weights / save_lora / save_checkpoint) that export weights to disk. Route: - Honor CLI-forced tools when deriving the confirm gate. When a process policy (unsloth run --enable-tools) opens the local tool loop without a request-level tool signal, a permission_mode ask/auto request now derives confirm at the route (GGUF and safetensors paths) so the mode still gates the call, and a non-streaming ask/auto request is rejected rather than running unprompted. A plain client-tool passthrough (no local loop) is unaffected. Adds regression tests for each case and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 19 for PR #7079 Approve for me now asks for these too: - a terminal read whose path is built by indirect parameter expansion (x=passwd; p=x; cat /etc/${!p}) - a bash /dev/tcp or /dev/udp redirection, which opens a network socket (cat </dev/tcp/host/port) - a python read via pathlib's receiver-plus-pattern glob (Path('/etc').glob('passw?')) - a python read whose sensitive root passes through a normalizer (os.path.abspath('/etc'), Path('/etc').resolve()) - a pickle-backed loader that can execute code on load (torch.load, joblib.load, pandas.read_pickle), tracked through module import aliases - compiled code wrapped into a callable (compile(...) + types.FunctionType) Adds regression tests for each case and its safe counterpart. * Honor unset permission_mode as ask across the local tool loop for PR #7079 Three gaps where an omitted permission_mode did not behave as the documented default ("ask"): - The frontend only sent permission_mode / confirm_tool_calls / bypass_permissions when a tool pill was on. A process policy (unsloth run --enable-tools) can open the tool loop with no pill, so the backend never saw the selected gate. Send the three permission fields at the top level of every local chat payload instead. - The backend read payload.confirm_tool_calls directly at the pre-switch guard and both late per-backend derivations, so an unset mode fell through as no-gate even for an explicit ask/auto. Add _permission_mode_confirm(payload): explicit confirm_tool_calls wins, explicit ask/auto engage the gate, off/full never prompt, and an unset mode defaults to ask only where realizable (streaming), keeping the legacy no-gate run for non-streaming unset requests. - A forced ask/auto tool loop (CLI --enable-tools) with no stream now 400s at the pre-switch guard before evicting the resident model, matching the existing confirm-without-stream rejection. Adds test_permission_mode_confirm_derivation covering the derivation truth table. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Declare permission_mode and bypass_permissions on the local chat request type The previous change moved permission_mode, confirm_tool_calls and bypass_permissions to the top level of the local chat payload. They had lived inside a conditional spread, which is not subject to excess property checking, so the fields were never declared on OpenAIChatCompletionsRequest. At the top level tsc flagged permission_mode as unknown (TS2322), failing the frontend build and every job whose Studio install builds the frontend. Add permission_mode and bypass_permissions to the request interface (confirm_tool_calls was already present). * Close auto-mode classifier gaps from review round 21 for PR #7079 Auto mode ("Approve for me") now asks for these too: - a pathlib read built from a concrete constructor (PosixPath, WindowsPath and their Pure* forms), which the folder previously ignored so PosixPath('/etc') / 'passwd' lost its /etc root and ran unprompted - a terminal or python read of the ssh host keys under /etc/ssh, which the sensitive-path regex only covered for passwd/shadow/sudoers - a read whose path variable is reassigned: the whole-tree pre-scan kept the last binding, so base = '/etc'; open(base + '/passwd'); base = 'data' folded to data/passwd and ran even though execution reads /etc/passwd; any multiply-bound name now folds to the escape sentinel and asks Also stop the pre-switch guard from rejecting a plain client-tool passthrough. permission_mode only implies the confirm gate for Studio's own local tool loop (enable_tools / enabled_tools / mcp_enabled); a non-streaming client-tool passthrough that carries permission_mode ask/auto (confirm_tool_calls left unset by the validator) must forward to the provider branch. Only an explicit confirm_tool_calls=True still forces the local-confirm rejection there. Adds regression tests for each case and its safe counterpart. * Fix permission-pill compaction count and Full-access confirm sync for PR #7079 Two frontend consistency issues in the permission-level UI: - The composer collapses tool pills to icons above four, but the count left out the permission pill, which renders in every mode except off. With one optional pill also shown the row reached five pills without collapsing and could overflow. Count the pill when it is visible (permission_mode != off). - Entering Full access via setPermissionMode('full') or setBypassPermissions(true) left confirmToolCalls at its previous value, so a Full-access run (which sends confirm_tool_calls=false) could still report confirmations as enabled in response metadata. Set confirmToolCalls false at both entry points. * Close auto-mode classifier gaps from review round 23 for PR #7079 Auto mode ("Approve for me") now asks for these too: - a command using an abbreviated GNU long option that reaches a write/exec action (sort --out= for --output, env --ch= for --chdir, fd --base-dir= for --base-directory); a prefix of an unsafe long flag now fails closed - printf -v NAME, which assigns to a shell variable, so printf -v PATH %s .; ls can rewrite PATH and run ./ls unprompted - fd --base-directory / --search-path, which move the search root outside the session workdir without any positional slash token - an MCP tool whose compound read name carries a copy-style mutator (read_and_copy_file, get_and_snapshot_volume): copy, duplicate, import, export, download, backup, restore, snapshot, mirror Also treat an omitted permission_mode as its documented default ("ask") on the Anthropic Messages server-tool path. That branch has no confirmation channel and already rejects explicit ask/auto, so an omitted mode now falls into the same rejection instead of silently running server tools unprompted, unless the caller opted out with confirm_tool_calls=false (the legacy equivalent of "off"). off/full and that opt-out still run; the two routing tests that relied on the old implicit run now set permission_mode="off". Adds regression tests for each case and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Refine permission gating from review round 24 for PR #7079 Four fixes from the latest review: - Anthropic Messages server tools: an omitted permission_mode no longer rejects a request that only runs safe server tools (web_search), so existing Anthropic callers keep working. It still rejects an omitted mode when a local tool (terminal/python) is selected, and an explicit ask/auto is still rejected outright. off/full and a confirm_tool_calls=false opt-out always run. - Pre-switch confirm-without-stream guard: use _explicit_studio_tool_loop_requested (the same predicate the passthrough router uses) instead of the policy-inclusive _effective_enable_tools, so a process --enable-tools policy no longer turns a client-tool passthrough into a local-loop rejection. - Auto mode now asks for `uniq INPUT OUTPUT`: uniq writes its second file positional, so a second positional (numeric flag values skipped) is treated like `sort -o`. A lone `uniq file` or piped `... | uniq` stays safe. - MCP mutation check now strips SQL comments before matching, so DELETE/**/FROM and UPDATE/**/users (comment-as-whitespace) no longer slip past the DML/DDL denylist. Adds regression tests for each case and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode gaps from review round 25 for PR #7079 Auto mode ("Approve for me") now asks for these Python cases too: - a bare archive constructor with a write mode (from zipfile import ZipFile; ZipFile('out.zip', 'w')), tracked through import aliases like the zipfile.ZipFile attribute call already was - a dynamic lookup aliased through getattr (g = getattr; rm = g(os, 'remove'); rm('file')), not just direct getattr(...) calls - a callable that wraps open or a writer via functools.partial (w = partial(open, mode='w'); w('out.txt')), which hides the write mode Also: - Always-safe tools (render_html) stream their early provisional canvas card in auto mode again. The provisional-card guard mirrored the raw confirm flag, which suppressed the early card under Approve-for-me; it now reuses the auto-mode safety decision (is_always_safe_tool). - The assistant-ui composer no longer counts the permission pill toward its collapse threshold when the level is Off (the pill renders null there), matching the other composer. Adds regression tests for each case and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Align permission-mode confirm guards with the router (review round 26) Three pre-switch confirm-gate checks disagreed with how the tool loop actually enters, so a valid request could 400 (or an invalid one could evict the resident model) at the wrong point: - The /chat/completions pre-switch guard only looked at explicit request fields, so a process --enable-tools policy that forces the loop on (request omits enable_tools, no client tools) slipped past it and only 400ed after _maybe_auto_switch_model had swapped the model. It now mirrors the router's own loop-entry gate (_effective_enable_tools or mcp, tool_choice="none" disabling it unless explicitly asked) while still deferring to client-tool passthrough, so the policy-forced case is caught before the switch. - The ChatCompletionRequest full/off fold treated enabled_tools by itself as a local-loop request and set confirm_tool_calls=True. The router never starts the loop on enabled_tools alone (it only filters which tools run), so a non-streaming passthrough carrying client tools plus enabled_tools 400ed instead of routing verbatim. The fold now keys off the same enable_tools / mcp_enabled signals. - The Anthropic /v1/messages unsupported-mode rejection (ask/auto, or an omitted mode selecting terminal/python) ran inside the post-switch server-tools block, so an invalid request evicted the resident model before the 400. It now runs before the auto-switch, determined from the requested server tools, like the neighboring malformed- and mixed-tool guards. Adds regressions for each: a policy-forced non-streaming ask/auto guard rejection that never reaches the switch, an enabled_tools-only passthrough that keeps confirm unset, and an Anthropic rejection that precedes _maybe_auto_switch_model. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close auto-mode classifier gaps from review round 27 for PR #7079 Auto mode ("Approve for me") now asks for these host-mutating or host-reading cases it previously ran unprompted (the sandbox does not jail filesystem reads, and terminal commands can change host state): - Destructured string literals fold into the scanned path now, so base, leaf = ('/etc', 'passwd'); open(base + '/' + leaf).read() resolves to /etc/passwd and asks, like the single-assignment form already did. The tuple/list unpacking branch tracked only aliases to open; it now also binds literal and folded-path elements. - pathlib name rewrites fold to the rewritten path: Path('/etc/x').with_name('passwd').read_text() (and with_stem / with_suffix) spell no literal /etc/passwd but resolve to it, so they are folded and caught. Benign in-sandbox rewrites stay safe. - hostname NAME (or -F/--file, -b/--boot) sets the hostname, so a positional or a set flag asks; bare hostname and the display flags (-f/-i/-I/...) stay read-only. - date -s/--set STRING and the bare MMDDhhmm... positional set the system clock and now ask; the display forms stay read-only (+FORMAT, -u/-R, and -d/-r/-f whose following value is skipped so date -d tomorrow is not mistaken for a clock-setting positional). Adds regression rows for each gap and its safe counterpart. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close more auto-mode classifier gaps from review round 28 for PR #7079 Auto mode ("Approve for me") now asks for these cases too: - Mapping-style %-formatted paths. '/etc/%(f)s' % {'f': 'passwd'} folds to /etc/passwd and asks; a dynamic value or a non-literal mapping leaves the NUL marker so /etc/<dynamic> still fails closed. The path folder previously handled only tuple/scalar % right-hand sides and returned None for a dict, hiding the sensitive segment. - A read-named MCP database tool carrying PostgreSQL COPY. COPY ... FROM bulk-loads a table and COPY ... TO writes a server-side file, so both are matched as mutating queries like DELETE/UPDATE already were. A 'copy' substring in a column name stays safe (word boundary). - logging file handlers. logging.FileHandler('out.log', mode='w') (and the default append mode, RotatingFileHandler/TimedRotatingFileHandler/ WatchedFileHandler, and the bare from-import form) create or truncate a file like open(..., 'w'), so they are classified as writer calls. StreamHandler / NullHandler and logging reads stay safe. Adds regression rows for each gap and its safe counterpart. * Fix writer aliases, GraphQL mutations, and auto server tools (review round 29) - Auto-mode Python: an aliased writer or archive constructor is tracked like the existing open alias, so from numpy import save; s = save; s('out.npy', arr) (and z = ZipFile; z('a.zip', 'w'), incl. the destructured forms) ask instead of running the write unprompted. A benign builtin alias (x = len) stays safe. - Auto-mode MCP: a read-named tool carrying a GraphQL mutation now asks. query_graphql {"query": "mutation { deleteIssue(id: 1) }"} matches a leading mutation keyword (GraphQL uses # comments, so it scans the raw payload); GraphQL read queries stay safe. - Anthropic /v1/messages: permission_mode "auto" no longer 400s a safe-only server-tool selection. auto only needs a confirmation channel for an unsafe call, so like the omitted default it runs for web_search / RAG / render and rejects only when a gate-needing local terminal/python tool is selected. ask still always rejects (it asks per call, which this passthrough cannot honor). The rejection stays ahead of the model auto-switch. Adds regression rows/cases for each. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Gate asyncio spawn, net clients, default-captured open; allow safe-only auto (round 30) Auto-mode Python now asks for more process/network/write vectors: - asyncio process spawners (asyncio.create_subprocess_exec/shell and a loop's subprocess_exec/shell) run an arbitrary program without the terminal blocklist, so they gate like os.system/subprocess. - stdlib network clients imaplib / poplib / nntplib / xmlrpc(.client) / webbrowser open outbound connections the sandbox does not namespace off, so their import asks like the other network modules. - a callable captured as a function or lambda parameter default (def f(o=open): o('out', 'w')) now binds that parameter into the same alias set, so the later write through it is gated. A benign default (o=len) stays safe. Also, permission_mode "auto" no longer 400s a non-streaming local tool request whose selection is always-safe-only (web_search / RAG / render). auto only prompts for a classifier-flagged call, so a safe-only auto request needs no stream, while ask, an explicit confirm_tool_calls=true, MCP, and an unrestricted or unsafe selection still require it. Applied via a shared _confirm_gate_needs_stream helper at the pre-switch, GGUF, and safetensors confirm-stream guards; the loop's per-call confirm flag is unchanged. Adds regression rows/cases for each. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Catch brace-glob paths and attribute writer aliases; unfold auto (round 31) - Terminal auto mode now runs the glob-sensitive scan over every expansion candidate, so a brace-expanded glob (cat /e{t,}c/pass?d, which bash expands to /etc/pass?d and then globs to /etc/passwd) asks. Brace expansion alone spells no literal /etc/passwd and the glob only resolves once the brace group is expanded, so scanning both together is required. A benign brace + glob stays safe. - Python auto mode now tracks a mutating attribute captured as a plain name: s = np.save; s('out.npy', arr) binds a writer alias, a captured .open bound method (p = Path('out').open; p('w')) fails closed on any call since its mode position varies, and z = zipfile.ZipFile is gated like the bare import. A benign attribute alias (x = np.mean) stays safe. - permission_mode "auto" is no longer folded to confirm_tool_calls=true on the request model. Folding it defeated the safe-only-selection exception in _confirm_gate_needs_stream (an explicit confirm forces stream=true), so a non-streaming safe-only auto request was rejected. Leaving it unset lets the route apply the exception; the mode still drives the loop's per-call gate. "ask" still folds (it gates every call). Adds regression rows/cases for each. * Harden SQL/GraphQL/writer classification and passthrough guards (round 32) MCP argument mutation detection (read-named query tools): - CREATE DDL now matches modifiers and the broader object set, so CREATE OR REPLACE VIEW, CREATE UNIQUE INDEX, CREATE TEMP TABLE, CREATE MATERIALIZED VIEW and CREATE FUNCTION ask. - Stored-procedure invocation (CALL proc(...), EXEC/EXECUTE) and VACUUM ask; a natural-language "call me back" stays safe via the trailing "(" / ";" / end lookahead. - GraphQL # comments are stripped before the mutation match, so mutation # note\n { deleteIssue(id: 1) } no longer hides the mutation. Python auto-mode classification: - numpy.memmap / open_memmap and pandas ExcelWriter / HDFStore create or truncate a file on construction, so they gate like open(..., "w"). - asyncio networking (asyncio.open_connection, loop.create_connection / create_server and unix variants) opens outbound connections/listeners the sandbox does not isolate, so it gates like socket.connect. Terminal auto-mode: file -C / --compile writes a compiled magic database. Routing: - A JSON-schema response_format is guided-decoding passthrough, not a local tool loop, so a --enable-tools policy no longer 400s a non-streaming ask/auto structured-output request at the confirm guard. - An explicit confirm_tool_calls=False opts out of the Anthropic Messages server-tool gate entirely (it wins over the mode, mirroring _permission_mode_confirm and the GGUF path), so it runs even under ask. Adds regression rows/cases for each. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Track path-ctor aliases, exempt empty selection and safe safetensors card (round 33) - Python auto mode now propagates path constructor / join aliases, so assigning Path or os.path.join to another local name is still folded: P = Path; (P('/etc') / 'passwd').read_text() and j = os.path.join; open(j('/etc', 'passwd')) ask, while a benign /tmp alias stays safe. - _confirm_gate_needs_stream now distinguishes an omitted enabled_tools (None, all tools) from an explicit empty list ([], no tools). An empty selection runs no built-in tool and cannot prompt, so a non-streaming auto request with enable_tools=true, enabled_tools=[] is no longer 400ed under a --enable-tools policy. - The safetensors provisional render_html card now uses permission_mode: render_html is always safe and never prompts, so its early canvas card streams under auto (which ships confirm_tool_calls=true) instead of being suppressed, matching the GGUF path's is_always_safe_tool exemption. Adds regression rows/cases for each. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Extend auto-mode classifier: SQLite mutations, more net/xattr/compressed writers Additional fail-closed gaps found by a fresh adversarial pass, each with a reproduction and a benign control: - MCP read-named tools now ask on SQLite-flavored writes the base DML/DDL regex missed: ATTACH / DETACH DATABASE, a write-form PRAGMA (PRAGMA journal_mode=WAL / user_version=42 / foreign_keys(0), while the read-form PRAGMA journal_mode stays safe), and load_extension() which loads and runs an arbitrary shared library. - Python auto mode now gates the remaining asyncio network entry points (start_server, open_unix_connection, loop.create_datagram_endpoint, sock_connect), os.setxattr / os.removexattr metadata writes, the gzip / bz2 / lzma single-stream writers (GzipFile / BZ2File / LZMAFile, mode-gated like ZipFile so a read stays safe), pandas to_xml, and the websockets client. Benign controls (SELECT 1, read-form PRAGMA, asyncio.sleep, gzip read, numpy read, natural-language "attach"/"analyze") stay safe. Regression rows added to test_permission_mode.py. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Close follow-up auto-mode gaps: SQLite/GraphQL variants, more writers and net A fresh adversarial pass on the previous round found consistent extensions of the same fail-closed rules, each reproduced with a benign control: - MCP read-named tools: DROP / ALTER now cover the same broad object set as CREATE (DROP FUNCTION, ALTER INDEX, DROP MATERIALIZED VIEW); ATTACH is caught without the optional DATABASE keyword via its quoted-path form; a schema-qualified write PRAGMA (PRAGMA main.user_version=1) is matched; and a GraphQL mutation carrying directives (mutation M @audit { ... }) is treated as a mutation. - Python auto mode: os.startfile (Windows program launch), asyncio start_unix_server, and the socketserver framework now ask; a gzip/bz2/lzma open imported under an alias (from gzip import open as gopen) is gated like builtin open; and a dynamic path prefix that can form a sensitive absolute root (open(chr(47) + "etc/passwd"), open(os.sep + "etc/passwd")) is treated as sensitive, while a dynamic prefix with a benign suffix stays safe. Benign controls (read-form PRAGMA, natural-language "attach ... as", "drop the idea", SELECT dropped_at, query @cached, gzip read alias, dynamic prefix + data/file suffix) stay safe. Regression rows added to test_permission_mode.py. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Gate GNU time -o, basicConfig/methodcaller/fileinput, and more SQL mutations Another adversarial pass surfaced further consistent fail-closed gaps, each reproduced with a benign control: - Terminal: GNU time -o/--output/-a/--append truncate or append to a file with timing output; time is a wrapper, so the flag is checked before the wrapped command like env -C. - Python auto mode: logging.basicConfig(filename=...) opens a log file for write; operator.methodcaller("write_text"/...) hides a writer method behind a string and is now treated as dynamic dispatch (like getattr/partial); fileinput.input(..., inplace=True) rewrites a file in place (the default read form stays safe). - MCP read-named tools: UPDATE now matches quoted, bracketed, and schema-qualified targets (UPDATE "users" / public.users / ONLY public.users / [users] / `users` SET); SELECT ... INTO OUTFILE/DUMPFILE writes a server file; and state-changing SQL functions inside a SELECT (pg_terminate_backend, setval, pg_write_file, lo_export, ...) ask. Benign controls (time ls / time -p, basicConfig(level=), methodcaller("upper"), fileinput read, NL "update ... set", setval_col column, PL/pgSQL SELECT INTO var) stay safe. Regression rows added to test_permission_mode.py. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Tighten auto-mode classifier comments Collapse the multi-line rationale blocks in the permission classifier to one or two lines each without dropping the exploit each branch closes. Comments and whitespace only (no code change); the classifier tests are unchanged and pass. * Retry transient SSE stalls in the tool-calling smoke probes The tool-calling job flaked with a bare "TimeoutError: timed out": the server-side python/bash probes stream over post_sse(), which (unlike post()) had no transport-level retry, so a single stalled stream on a shared CI runner hard-failed the whole step even though function calling had already passed. post_sse() now mirrors post(): a transport-level stall (stream open or a mid-stream read timing out) is retried once with a fresh request capped at 300s, while HTTP status errors still surface immediately. The Linux _run_tool_probe caps each attempt at 360s and treats a stall that outlives the retry as a failed attempt (rotate to the next seed) instead of raising, and the web_search probe uses the same 360s cap. A genuine server wedge still fails (the retry also times out), so real regressions are not masked. Applied to the Linux, macOS, and Windows inference-smoke workflows, which share the probe. * Close five more auto-mode classifier gaps from review Each reproduces with a benign control: - Path constructor aliased through an attribute (P = pathlib.Path) now folds like the bare-name alias, so (P('/etc') / 'passwd').read_text() asks while a /tmp alias stays safe. - Callable defaults that are not plain names now bind the parameter: an attribute writer (def f(s=np.save)), an archive constructor, a captured .open, and partial(open, mode='w') fold like the equivalent assignment; a benign default (np.mean) does not. - A dynamic piece inside a sensitive name (open('/et' + chr(99) + '/passwd'), which folds to '/et\x00/passwd') now asks: the literals around each dynamic segment are matched against a credential target with the segment as any run of non-separator chars, so an all-dynamic ('1 + 1') or segment-spanning (a + '/' + b) path stays safe. - MCP read-named tools now ask on REFRESH MATERIALIZED VIEW and REINDEX; a 'refresh' column or natural-language 'refresh' stays safe. - A writer/open alias handed to a higher-order invoker (map(open, names, modes), starmap(np.save, ...)) is gated even without a direct call site; a benign map(len, ...) is unaffected. Regression rows added to test_permission_mode.py. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Default tool pills off on model load so tool execution is opt-in resolveToolsEnabledOnLoad turned the web-search and code pills on for any tool-capable model when the user had expressed no preference. Default them off instead, so tool execution is enabled only when the person clicks the pill to turn it on; a saved preference (on or off) is still honoured, so a user who already enabled tools keeps them on. * Gate mark/subscribe MCP verbs and qualified higher-order writer invokers - A read-prefixed MCP tool name carrying mark / subscribe / unsubscribe (get_and_mark_read, get_and_subscribe) now asks; a 'mark' substring inside one token (list_bookmarks) stays safe. - The higher-order writer check now also fires for a qualified invoker (itertools.starmap(open, ...), functools.reduce(open, ...)), matching the bare-name map/filter form; the writer-check on the first arg keeps a benign itertools.starmap(len, ...) or itertools.chain(...) safe. Regression rows added to test_permission_mode.py. * Close more auto-mode gaps and align the ask confirm fold across paths Each classifier change reproduces with a benign control: - MCP read-named tools now ask on reply / notify verbs (get_and_reply_email, list_and_notify_users), on catalog writes COMMENT ON / SECURITY LABEL / LOCK TABLE and CREATE|DROP|ALTER POLICY, and on state-changing PostgreSQL functions inside a read-shaped SELECT (nextval, set_config, pg_notify, the advisory-lock family). A 'comment' column, a 'locks' table, and a 'nextval' column prefix stay safe; the natural-language NOTIFY/SET ROLE statement forms are left out because SET/NOTIFY overlap ordinary prose. - Python auto mode now gates loader.exec_module (runs a module's code), archive extractall (zip-slip file writes), the ensurepip / venv modules (install pip / build an environment), and pydoc.writedoc. The Hugging Face login token (~/.cache/huggingface/token and stored_tokens) is now a sensitive path, while the rest of that cache (model data) stays readable. - ChatCompletionRequest no longer overwrites an explicit confirm_tool_calls=false when permission_mode='ask': the fold only self-enables the gate when the flag is unset, so an explicit opt-out wins on the chat path exactly as it already does via _permission_mode_confirm and the Anthropic pre-switch guard. Regression rows added to test_permission_mode.py. * Gate sort -T, xxd outfile positional, and the legacy HF token path - sort -T / --temporary-directory writes spill files to a caller-chosen dir, so it joins -o / --output in sort's unsafe-flag set. - xxd [infile [outfile]] writes its second positional, like uniq; xxd now uses the same second-positional-write handling (xxd in.bin out.hex asks, xxd in.bin and xxd -c 16 in.bin stay read-only). - The sensitive-path regex now also covers the legacy ~/.huggingface/token location (optional leading dot), not just ~/.cache/huggingface/token; an unrelated dir like myhuggingface/token stays safe. Regression rows added to test_permission_mode.py. * Catch multi-char SQL mutation targets, globbed credential names, digit outfiles Three fail-open gaps in the auto-mode classifier, each with a benign control: - SQL: the trailing word boundary on the MCP mutation regex meant a bare \w stopped at the first character, so TRUNCATE users, GRANT SELECT ON t, and REVOKE ALL ON t (multi-character names) slipped through while single-letter targets matched. Match the whole identifier instead, and accept an explicit AS alias on UPDATE (UPDATE users AS u SET). The implicit-alias form is left out because it is indistinguishable from the prose "update <noun> <noun> set". A truncate_log column and a grants table stay safe. - A glob that resolves to a credential basename anywhere (cat ~/.huggingface/tok?n -> token, cat proj/.netr? -> .netrc, cat repo/.aws/cred*) now asks; the fixed target list only covered a handful of home paths. notes/dra?t.txt and token_counts.tx? stay safe. - uniq / xxd counted file positionals but skipped every numeric token to ignore a flag value, so a file literally named with digits (uniq 123 out) hid the output positional. Track each command's value-taking flags and consume only the value, so uniq -f 2 in stays safe while uniq 123 out asks. Regression rows added to test_permission_mode.py. * Isolate the permission-mode loop tests from process-global state The loop-driving tests (auto/off/full/bypass) drove run_safetensors_tool_loop against a process-global approval registry (state.tool_approvals._pending) keyed by a single shared session id, and read os.environ. Other backend test modules mutate both, some at import time, so in the full-suite ordering a stale pending approval or a leaked env var could make the loop deny or skip a call these tests expect to run. It passed when the file ran alone but failed only in the complete tests/ run on CI. Add an autouse fixture that snapshots and restores os.environ and the approval registry around each test, and give every _drive call a unique session id so a leaked approval can never collide. Attach a compact event-stream dump to the loop assertions so any residual full-suite-only failure reports what the loop actually did instead of a bare diff. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: harden auto-mode classifier for recursive listers, sort file lists, aliased invokers, single-member extract Close four fail-open gaps in is_potentially_unsafe_tool_call: - terminal: tree/du (always recursive) and ls -R rooted at an absolute or tilde path now ask, matching the existing grep/rg/find recursive-read gate; relative walks stay safe. - terminal: sort --files0-from=F reads the file list named in F, so it can read arbitrary host files indirectly; added to sort's unsafe flags. - python: track aliases of the higher-order invokers (m = map; from itertools import starmap as sm) so an aliased invoker handed open/a writer is still gated; a benign callable (map(len, ...)) stays safe. - python: single-member archive extract (ZipFile/TarFile.extract) writes to disk like extractall and is vulnerable to a crafted member path, so gate it. Also update the stale _FakeExecuteTool in test_permission_mode.py to accept the thread_id keyword that run_safetensors_tool_loop now forwards to execute_tool after the main merge, which had broken the five tool-loop tests. Adds regression rows covering each gap plus benign controls. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: normalize unknown permission_mode to 'ask' instead of a 422 The request models validated permission_mode with Literal[ask, auto, off, full], so an unrecognized value from a newer UI/client was rejected with a 422 before the tool loops could apply their unknown -> ask fallback (safetensors_agentic.py:464, llama_cpp.py:9001). That made the intended forward-compat degradation unreachable at the API boundary for both Chat Completions and the analogous Anthropic field. Accept a plain string on both ChatCompletionRequest and AnthropicMessagesRequest and normalize in a before-validator: None stays unset, the four known modes pass through, and any other value degrades to the safest gate ('ask'), matching the loops. Adds a regression test covering unknown/None/known across both models. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: close five more auto-mode classifier gaps - terminal: xargs is no longer a safe wrapper. It appends arguments read from stdin that the scan never sees, so `echo -o out /etc/passwd | xargs sort` forwards to `sort -o out /etc/passwd` (a write + sensitive read) while only the allow-listed literals are visible. Any xargs command now asks. - terminal: ionice -p/-P/-u change the I/O priority of an already running process / group / user instead of forwarding to a wrapped read-only command, so `ionice -c 3 -p <pid>` now asks. ionice -c 3 <cmd> stays safe. - MCP: gate ALTER SYSTEM, which persists PostgreSQL server configuration and was not one of the DDL objects the mutation detector matched. - MCP: a credential noun in a read-named tool (read_secret, list_tokens, get_credentials, fetch_api_key) is a sensitive disclosure, so it asks even without a mutating verb or a path/SQL argument. Scoped *_key nouns keep a primary_key / keyboard lookup safe. - render_html: no longer unconditionally safe. A static canvas still auto-runs, but one whose HTML/JS reaches the network (fetch/WebSocket/remote script) asks, since it can egress under the canvas CSP when artifact network access is on. Its early provisional card is suppressed under the auto confirm gate, and the confirm-without-stream guard now requires a stream when render_html is selectable. Adds regression rows and benign controls for each, and updates the render_html provisional-card and confirm-gate tests to the new behavior. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: extend auto-mode gates for indirect file lists, dynamic lookups, HTML network loads, and Anthropic render_html Follow-ups on the previous classifier round: - terminal: wc/du/find --files0-from (and find's -files0-from primary) read a NUL-separated list of input paths from a file, the same indirect mechanism as sort --files0-from, so a crafted list reads arbitrary host files past the literal path/root checks. Gate them like sort. - python: a namespace lookup through a dict-style call (f = __builtins__.__dict__.get('open'), globals().get('open'), vars(x).get(...)) can return open/eval/a mutator, so poison the bound name like getattr/subscript lookups already are. An ordinary dict .get or os.environ.get stays safe. - render_html: broaden the network detector so a canvas that loads a resource via CSS url()/@import, srcset, or a root-relative (/path) or protocol-relative (//host) src/href is treated as networked, not just fetch/WebSocket/remote script. Relative ./x and url(#id)/data: refs stay static/safe. - Anthropic /v1/messages: drop render_html from the unprompted-safe server-tool set. Since it can prompt (networked canvas) and this channel invokes the loop without confirm, selecting it under ask/auto/omitted now rejects like terminal/python; off/full (or an explicit confirm opt-out) run it. Adds regression rows and benign controls for each, plus an Anthropic route test. * Studio: close six more auto-mode classifier gaps - terminal: a glob that expands to a project .env (cat .e?v) now asks; .env joins the sensitive glob-basename set, matching the literal-path gate. - python: an open bound onto an attribute (box.f = open; box.f('out','w')) is tracked by attribute name, and open invoked via .__call__ (open.__call__('out','w'), unwrapped to the underlying callable) is gated, so neither slips past the name-based open-alias checks. Benign attribute callables and .__call__ on non-writers stay safe. - python: a namespace lookup via .get/.pop/.setdefault already covered the builtins case; unchanged here. - MCP: a mutating HTTP verb in a method/verb argument (get_url {"method": "DELETE"|"POST"|"PUT"|"PATCH"}) now asks, so a generic HTTP tool cannot mutate an external service unprompted; GET/HEAD stay safe. - MCP: a credential/secret environment-variable value (get_env {"name": "OPENAI_API_KEY"}) is treated as a sensitive read via the same credential-noun match used for tool names; PATH/HOME stay safe. - render_html: self-navigation sinks (location.assign/replace, window.open, assigning a URL to (window.)location(.href)) join the network detector, so a canvas that navigates itself to an external URL asks; location.reload() / history.back() stay static. Adds regression rows and benign controls for each. * Studio: gate obfuscated canvas egress, sensitive-dir iteration, and MCP metadata-host reads - render_html: strip block comments before the network scan so fetch/*x*/(...) cannot hide egress, and match bracket-access forms (window['fetch'](...), self['open'](...)). Line // comments are left alone so the // in an https URL is not eaten. A comment-only canvas stays static. - python: enumerating a directory outside the sandbox (Path('/etc').iterdir(), os.scandir('/etc'), os.listdir('/home'), os.walk('/')) reads host filenames the direct /etc/passwd checks would prompt for, so gate it when the target dir folds to an absolute/tilde/sensitive path; a relative dir stays safe and an unresolved dynamic dir is left to other checks. - MCP: a read-named HTTP tool pointed at a cloud-metadata / link-local host (fetch_url {"url": "http://169.254.169.254/..."}, metadata.google.internal) reads instance credentials, so classify those URL arguments as sensitive, mirroring the sandbox SSRF blocklist; ordinary and localhost URLs stay safe. Adds regression rows and benign controls for each. * Studio: gate meta-refresh navigation, pandas HTML/markdown exporters, absolute glob roots, and checksum verify mode * Studio: gate starred open writes, builtins.__import__, computed render_html sinks, and procfs fd reads in auto mode * Studio: gate remote worker canvases, huggingface_hub downloads, and write callables passed to user helpers in auto mode * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Unsloth <michaelhan@Michaels-MacBook-Pro.local> Co-authored-by: Daniel Han <danielhanchen@gmail.com>
This commit is contained in:
Michael Han
GitHub
parent
1bf3509fea
commit
e1e38419df
23 changed files with 5131 additions and 219 deletions
|
|
@ -8969,16 +8969,37 @@ class LlamaCppBackend:
|
|||
disable_parallel_tool_use: bool = False,
|
||||
confirm_tool_calls: bool = False,
|
||||
bypass_permissions: bool = False,
|
||||
permission_mode: Optional[str] = None,
|
||||
) -> Generator[dict, None, None]:
|
||||
"""
|
||||
Agentic loop: let the model call tools, execute them, and continue.
|
||||
|
||||
permission_mode: "ask" confirms every call (with confirm_tool_calls),
|
||||
"auto" only pauses calls detected as potentially unsafe, "off" never
|
||||
pauses (sandbox stays on), "full" is the same as bypass_permissions.
|
||||
Unset/unknown behaves as "ask".
|
||||
|
||||
Yields dicts:
|
||||
{"type": "status", "text": "Searching: ..."/"Reading: ..."} -- tool status updates
|
||||
{"type": "content", "text": "token"} -- streamed content tokens (cumulative)
|
||||
{"type": "reasoning", "text": "token"} -- streamed reasoning tokens (cumulative)
|
||||
"""
|
||||
from core.inference.tools import build_rag_autoinject, execute_tool
|
||||
from core.inference.tools import (
|
||||
build_rag_autoinject,
|
||||
execute_tool,
|
||||
is_always_safe_tool,
|
||||
is_potentially_unsafe_tool_call,
|
||||
)
|
||||
|
||||
# Normalize the mode: "full" and bypass_permissions are the same
|
||||
# switch, whichever arrives first wins toward the permissive side.
|
||||
# "off" keeps the sandbox but never prompts.
|
||||
if permission_mode == "full":
|
||||
bypass_permissions = True
|
||||
elif bypass_permissions:
|
||||
permission_mode = "full"
|
||||
elif permission_mode not in ("ask", "auto", "off"):
|
||||
permission_mode = "ask"
|
||||
|
||||
if not self.is_loaded:
|
||||
raise RuntimeError("llama-server is not loaded")
|
||||
|
|
@ -8986,8 +9007,14 @@ class LlamaCppBackend:
|
|||
conversation = list(messages)
|
||||
|
||||
# Forced first-pass RAG so a doc question doesn't lose to web_search. Emits
|
||||
# the same tool card + citations a real call would.
|
||||
_auto = None if confirm_tool_calls else build_rag_autoinject(conversation, rag_scope)
|
||||
# the same tool card + citations a real call would. Skip it only when a
|
||||
# retrieval call would actually prompt (ask mode); auto never gates the
|
||||
# safe search_knowledge_base tool, so retrieval must still run there.
|
||||
# off never prompts either, so it also keeps first-pass retrieval.
|
||||
_skip_autoinject = (
|
||||
confirm_tool_calls and not bypass_permissions and permission_mode not in ("auto", "off")
|
||||
)
|
||||
_auto = None if _skip_autoinject else build_rag_autoinject(conversation, rag_scope)
|
||||
if _auto:
|
||||
for _ev in _auto["events"]:
|
||||
yield _ev
|
||||
|
|
@ -9357,8 +9384,16 @@ class LlamaCppBackend:
|
|||
in provisional_started_tool_calls.values()
|
||||
)
|
||||
# Later parallel cards only reconcile when parallel use is enabled.
|
||||
# In auto mode an always-safe tool (render_html) never
|
||||
# prompts, so it must stream its early card too; mirror
|
||||
# that here instead of gating on the raw confirm flag.
|
||||
_confirm_gated = (
|
||||
confirm_tool_calls and not bypass_permissions
|
||||
confirm_tool_calls
|
||||
and not bypass_permissions
|
||||
and not (
|
||||
permission_mode == "auto"
|
||||
and is_always_safe_tool(current_name)
|
||||
)
|
||||
)
|
||||
# Keep small-argument tools on the normal path.
|
||||
_args_len = len(
|
||||
|
|
@ -9925,7 +9960,18 @@ class LlamaCppBackend:
|
|||
|
||||
# Bypass wins over the confirm gate at the loop level too,
|
||||
# so a direct internal caller with both flags never prompts.
|
||||
needs_confirm = bool(confirm_tool_calls) and not bypass_permissions
|
||||
# In "auto" mode only calls detected as potentially unsafe
|
||||
# pause; read-only calls run straight through. "off" never
|
||||
# prompts (sandbox stays on).
|
||||
needs_confirm = (
|
||||
bool(confirm_tool_calls)
|
||||
and not bypass_permissions
|
||||
and permission_mode != "off"
|
||||
)
|
||||
if needs_confirm and permission_mode == "auto":
|
||||
needs_confirm = is_potentially_unsafe_tool_call(
|
||||
decision.tool_name, decision.arguments
|
||||
)
|
||||
approval_id = new_approval_id() if needs_confirm else ""
|
||||
decision_slot = (
|
||||
begin_tool_decision(session_id, approval_id) if needs_confirm else None
|
||||
|
|
|
|||
|
|
@ -1372,6 +1372,7 @@ class InferenceOrchestrator:
|
|||
rag_scope: Optional[dict] = None,
|
||||
confirm_tool_calls: bool = False,
|
||||
bypass_permissions: bool = False,
|
||||
permission_mode: Optional[str] = None,
|
||||
use_adapter: Optional[Union[bool, str]] = None,
|
||||
stats_holder: Optional[dict] = None,
|
||||
presence_penalty: float = 0.0,
|
||||
|
|
@ -1439,6 +1440,7 @@ class InferenceOrchestrator:
|
|||
rag_scope = rag_scope,
|
||||
confirm_tool_calls = confirm_tool_calls,
|
||||
bypass_permissions = bypass_permissions,
|
||||
permission_mode = permission_mode,
|
||||
)
|
||||
|
||||
def generate_with_adapter_control(
|
||||
|
|
|
|||
|
|
@ -428,6 +428,7 @@ def run_safetensors_tool_loop(
|
|||
rag_scope: Optional[dict] = None,
|
||||
confirm_tool_calls: bool = False,
|
||||
bypass_permissions: bool = False,
|
||||
permission_mode: Optional[str] = None,
|
||||
) -> Generator[dict, None, None]:
|
||||
"""Drive an agentic tool loop on top of a cumulative-text generator.
|
||||
|
||||
|
|
@ -453,10 +454,27 @@ def run_safetensors_tool_loop(
|
|||
"""
|
||||
conversation = list(messages)
|
||||
|
||||
# Forced first-pass RAG (mirrors the GGUF loop) so doc Qs don't lose to web_search.
|
||||
# Normalize the mode (mirrors the GGUF loop): "full" and
|
||||
# bypass_permissions are the same switch; unset/unknown behaves as "ask".
|
||||
# "off" keeps the sandbox but never prompts.
|
||||
if permission_mode == "full":
|
||||
bypass_permissions = True
|
||||
elif bypass_permissions:
|
||||
permission_mode = "full"
|
||||
elif permission_mode not in ("ask", "auto", "off"):
|
||||
permission_mode = "ask"
|
||||
|
||||
# Forced first-pass RAG (mirrors the GGUF loop) so doc Qs don't lose to
|
||||
# web_search. Skip only when a retrieval call would actually prompt (ask
|
||||
# mode); auto never gates the safe search_knowledge_base tool.
|
||||
from core.inference.tools import build_rag_autoinject
|
||||
|
||||
_auto = None if confirm_tool_calls else build_rag_autoinject(conversation, rag_scope)
|
||||
# off never prompts, so (like auto) it must not lose first-pass retrieval
|
||||
# even if a direct caller passes a stale confirm_tool_calls flag.
|
||||
_skip_autoinject = (
|
||||
confirm_tool_calls and not bypass_permissions and permission_mode not in ("auto", "off")
|
||||
)
|
||||
_auto = None if _skip_autoinject else build_rag_autoinject(conversation, rag_scope)
|
||||
if _auto:
|
||||
for _ev in _auto["events"]:
|
||||
yield _ev
|
||||
|
|
@ -539,7 +557,16 @@ def run_safetensors_tool_loop(
|
|||
# provisional card (keyed by tool_call_id, no approval) would show the
|
||||
# tool as "running" before the user has approved it. Suppress the early
|
||||
# card in that case and let the gated tool_start be the first signal.
|
||||
_provisional_confirm_gated = bool(confirm_tool_calls) and not bypass_permissions
|
||||
# In auto mode render_html is always safe and never prompts, so keep its
|
||||
# early canvas card (the frontend sends confirm_tool_calls=true alongside
|
||||
# auto); mirrors the GGUF path's _confirm_gated exemption.
|
||||
from core.inference.tools import is_always_safe_tool
|
||||
|
||||
_provisional_confirm_gated = (
|
||||
bool(confirm_tool_calls)
|
||||
and not bypass_permissions
|
||||
and not (permission_mode == "auto" and is_always_safe_tool("render_html"))
|
||||
)
|
||||
|
||||
gen = _call_single_turn(single_turn, conversation, active_tools)
|
||||
prev_cumulative = ""
|
||||
|
|
@ -1056,8 +1083,17 @@ def run_safetensors_tool_loop(
|
|||
assistant_msg.setdefault("tool_calls", []).append(decision.as_assistant_tool_call())
|
||||
|
||||
# Bypass wins over the confirm gate at the loop level too, so a
|
||||
# direct internal caller passing both flags never prompts.
|
||||
needs_confirm = bool(confirm_tool_calls) and not bypass_permissions
|
||||
# direct internal caller passing both flags never prompts. In
|
||||
# "auto" mode only calls detected as potentially unsafe pause.
|
||||
# "off" never prompts (sandbox stays on).
|
||||
needs_confirm = (
|
||||
bool(confirm_tool_calls) and not bypass_permissions and permission_mode != "off"
|
||||
)
|
||||
if needs_confirm and permission_mode == "auto":
|
||||
from core.inference.tools import is_potentially_unsafe_tool_call
|
||||
needs_confirm = is_potentially_unsafe_tool_call(
|
||||
decision.tool_name, decision.arguments
|
||||
)
|
||||
approval_id = new_approval_id() if needs_confirm else ""
|
||||
decision_slot = begin_tool_decision(session_id, approval_id) if needs_confirm else None
|
||||
start_event = decision.tool_start_event()
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
|
|
@ -695,6 +695,23 @@ class ThinkingConfig(BaseModel):
|
|||
type: Literal["disabled", "enabled"] = "disabled"
|
||||
|
||||
|
||||
# Recognized permission_mode values. The field accepts a plain string rather than
|
||||
# a Literal so an unrecognized value from a newer UI/client degrades to the
|
||||
# safest gate ("ask") instead of a 422; the tool loops apply the same unknown ->
|
||||
# ask fallback, so normalizing here keeps that forward-compat path reachable at
|
||||
# the API boundary. None stays unset ("behaves as 'ask'" without self-enabling
|
||||
# the confirm gate).
|
||||
_KNOWN_PERMISSION_MODES = ("ask", "auto", "off", "full")
|
||||
|
||||
|
||||
def _normalize_permission_mode(value: Any) -> Any:
|
||||
if value is None:
|
||||
return None
|
||||
if value not in _KNOWN_PERMISSION_MODES:
|
||||
return "ask"
|
||||
return value
|
||||
|
||||
|
||||
class ChatCompletionRequest(BaseModel):
|
||||
"""OpenAI-compatible chat completion request.
|
||||
|
||||
|
|
@ -840,6 +857,19 @@ class ChatCompletionRequest(BaseModel):
|
|||
False,
|
||||
description = "[x-unsloth] Bypass Permissions: when true, skip the tool-call confirmation gate AND disable the python/terminal execution sandbox (safety checks, command blocklist, resource limits). Secret env vars are still stripped. Takes precedence over confirm_tool_calls.",
|
||||
)
|
||||
permission_mode: Optional[str] = Field(
|
||||
None,
|
||||
description = (
|
||||
"[x-unsloth] Permission level for local tool calls. 'ask' pauses every "
|
||||
"call for approval; 'ask'/'auto' enable the confirmation gate on their "
|
||||
"own (needs a streaming request to deliver prompts). 'auto' ('Approve for "
|
||||
"me') only pauses calls detected as potentially unsafe (state-mutating "
|
||||
"terminal/python/MCP calls); read-only calls run immediately, and the "
|
||||
"sandbox stays on. 'full' is equivalent to bypass_permissions=true (no "
|
||||
"confirmation, no sandbox). Unset behaves as 'ask'. An unrecognized value "
|
||||
"(e.g. from a newer client) is treated as 'ask'."
|
||||
),
|
||||
)
|
||||
auto_heal_tool_calls: Optional[bool] = Field(
|
||||
True,
|
||||
description = "[x-unsloth] Auto-detect and fix malformed tool calls from model output.",
|
||||
|
|
@ -1103,6 +1133,52 @@ class ChatCompletionRequest(BaseModel):
|
|||
self.enable_thinking = self.thinking.type == "enabled"
|
||||
return self
|
||||
|
||||
@field_validator("permission_mode", mode = "before")
|
||||
@classmethod
|
||||
def _coerce_permission_mode(cls, value: Any) -> Any:
|
||||
# Accept any string so an unknown mode degrades to 'ask' instead of a
|
||||
# 422; mirrors the tool loops' unknown -> ask fallback.
|
||||
return _normalize_permission_mode(value)
|
||||
|
||||
@model_validator(mode = "after")
|
||||
def _fold_full_permission_into_bypass(self) -> "ChatCompletionRequest":
|
||||
"""permission_mode='full' is the documented equivalent of
|
||||
bypass_permissions=true, so fold it in before any route guard reads
|
||||
the flag (else a full request would trip the confirm-gate rejections)."""
|
||||
if self.permission_mode == "full":
|
||||
self.bypass_permissions = True
|
||||
elif self.bypass_permissions:
|
||||
# Legacy bypass callers map onto Full access (mirrors the tool loop).
|
||||
self.permission_mode = "full"
|
||||
elif self.permission_mode == "off":
|
||||
# "Off" never prompts, so route guards must see confirm disabled.
|
||||
self.confirm_tool_calls = False
|
||||
elif (
|
||||
self.permission_mode == "ask"
|
||||
and self.confirm_tool_calls is None
|
||||
and not (self.provider_id or self.provider_type)
|
||||
and (self.enable_tools is True or bool(self.mcp_enabled))
|
||||
):
|
||||
# "Ask" gates every call, so a direct API caller that omits the legacy
|
||||
# confirm flag must still hit the confirmation gate for Studio's own
|
||||
# tool loop. An explicit confirm_tool_calls=False wins over the mode
|
||||
# (mirrors _permission_mode_confirm and the Anthropic pre-switch guard),
|
||||
# so only self-enable when the flag is unset. Only self-enable when that
|
||||
# loop is actually requested
|
||||
# (enable_tools / mcp_enabled) -- the router enters the loop on those
|
||||
# signals, not on enabled_tools alone (which merely filters which tools
|
||||
# run). A plain client-tool passthrough (client-supplied `tools` that
|
||||
# Studio does not execute) must route verbatim, and external-provider
|
||||
# routing rejects confirm_tool_calls with tools, so skip the fold there.
|
||||
#
|
||||
# "auto" is deliberately NOT folded: it only prompts for a call the
|
||||
# classifier flags, so leaving confirm_tool_calls unset lets the route's
|
||||
# _confirm_gate_needs_stream apply the safe-only exception (a safe-only
|
||||
# auto selection needs no stream) instead of an explicit-confirm forcing
|
||||
# stream=true. The mode still drives the loop's per-call gate.
|
||||
self.confirm_tool_calls = True
|
||||
return self
|
||||
|
||||
|
||||
class ToolConfirmRequest(BaseModel):
|
||||
session_id: Optional[str] = None
|
||||
|
|
@ -1758,6 +1834,10 @@ class AnthropicMessagesRequest(BaseModel):
|
|||
False,
|
||||
description = "[x-unsloth] Bypass Permissions: when true, disable the python/terminal execution sandbox (safety checks, command blocklist, resource limits) for server-side tool calls. Secret env vars are still stripped. Declared explicitly (not relied on via extra='allow') so omitted requests default to False instead of raising AttributeError.",
|
||||
)
|
||||
permission_mode: Optional[str] = Field(
|
||||
None,
|
||||
description = "[x-unsloth] Permission level for local tool calls: 'ask' pauses every call, 'auto' only pauses calls detected as potentially unsafe, 'off' never pauses (sandbox stays on), 'full' equals bypass_permissions=true. Unset behaves as 'ask'; an unrecognized value (e.g. from a newer client) is treated as 'ask'. Declared explicitly so omitted requests default to None instead of raising AttributeError.",
|
||||
)
|
||||
auto_heal_tool_calls: Optional[bool] = Field(
|
||||
True,
|
||||
description = "[x-unsloth] Auto-detect and fix malformed tool calls from model output (mirrors the Chat Completions field; applies to the client-tool passthrough).",
|
||||
|
|
@ -1799,6 +1879,27 @@ class AnthropicMessagesRequest(BaseModel):
|
|||
normalized["system"] = _merge_anthropic_system(normalized.get("system"), system_additions)
|
||||
return normalized
|
||||
|
||||
@field_validator("permission_mode", mode = "before")
|
||||
@classmethod
|
||||
def _coerce_permission_mode(cls, value: Any) -> Any:
|
||||
# Accept any string so an unknown mode degrades to 'ask' instead of a
|
||||
# 422; mirrors the tool loops' unknown -> ask fallback.
|
||||
return _normalize_permission_mode(value)
|
||||
|
||||
@model_validator(mode = "after")
|
||||
def _fold_full_permission_into_bypass(self) -> "AnthropicMessagesRequest":
|
||||
"""permission_mode='full' equals bypass_permissions=true (mirrors the
|
||||
Chat Completions request)."""
|
||||
if self.permission_mode == "full":
|
||||
self.bypass_permissions = True
|
||||
elif self.bypass_permissions:
|
||||
# Legacy bypass callers map onto Full access (mirrors the tool loop).
|
||||
self.permission_mode = "full"
|
||||
elif self.permission_mode == "off":
|
||||
# "Off" never prompts, so route guards must see confirm disabled.
|
||||
self.confirm_tool_calls = False
|
||||
return self
|
||||
|
||||
|
||||
# ── Response models ────────────────────────────────────────────
|
||||
|
||||
|
|
|
|||
|
|
@ -2064,6 +2064,59 @@ def _explicit_studio_tool_loop_requested(payload) -> bool:
|
|||
return policy is not False and (payload.enable_tools is True or bool(payload.mcp_enabled))
|
||||
|
||||
|
||||
def _permission_mode_confirm(payload) -> bool:
|
||||
"""Effective confirm-gate intent for Studio's own local tool loop.
|
||||
|
||||
Honors the documented default that an unset permission_mode behaves as
|
||||
"ask". An explicit confirm_tool_calls (True or False) wins; explicit
|
||||
ask/auto always engage the gate (a non-streaming one is then rejected, since
|
||||
it cannot prompt); off/full never prompt. An unset mode defaults to ask, but
|
||||
that is only realizable on a streaming request, so a non-streaming unset
|
||||
request keeps the legacy run-without-gate behavior instead of 400ing. Used
|
||||
at the pre-switch guard and the per-backend tool paths so a forced tool loop
|
||||
(CLI --enable-tools) with the default mode still gates streaming requests.
|
||||
"""
|
||||
if payload.confirm_tool_calls is not None:
|
||||
return bool(payload.confirm_tool_calls)
|
||||
mode = getattr(payload, "permission_mode", None)
|
||||
if mode in ("ask", "auto"):
|
||||
return True
|
||||
if mode in ("off", "full"):
|
||||
return False
|
||||
return bool(getattr(payload, "stream", False))
|
||||
|
||||
|
||||
def _confirm_gate_needs_stream(payload) -> bool:
|
||||
"""Whether Studio's local tool-loop confirm gate still requires stream=true.
|
||||
|
||||
The gate can only prompt while streaming, so a non-streaming request that will
|
||||
prompt must 400 up front. auto ("Approve for me") only prompts for a call the
|
||||
classifier flags, so an auto request whose confirm is derived from the mode
|
||||
(not an explicit confirm_tool_calls=true) and whose selectable tools are all
|
||||
always-safe (web_search / RAG) never prompts and needs no stream. ask,
|
||||
an explicit confirm flag, MCP tools, and an unrestricted or unsafe selection
|
||||
still require streaming.
|
||||
"""
|
||||
if not _permission_mode_confirm(payload):
|
||||
return False
|
||||
if getattr(payload, "permission_mode", None) != "auto":
|
||||
return True
|
||||
if payload.confirm_tool_calls is True:
|
||||
return True
|
||||
if getattr(payload, "mcp_enabled", False):
|
||||
return True
|
||||
enabled = getattr(payload, "enabled_tools", None)
|
||||
if enabled is None:
|
||||
return True # omitted enabled_tools resolves to ALL tools (incl. terminal/python)
|
||||
if not enabled:
|
||||
# An explicit empty selection runs no built-in tool (_select_request_tools
|
||||
# skips the loop), so there is nothing to prompt and no stream is needed.
|
||||
return False
|
||||
from core.inference.tools import is_always_safe_tool
|
||||
|
||||
return not all(is_always_safe_tool(t) for t in enabled)
|
||||
|
||||
|
||||
# Cancel registry. Proxies (e.g. Colab) can swallow client fetch aborts so
|
||||
# is_disconnected() never fires. POST /inference/cancel looks up in-flight
|
||||
# cancel_events here by cancel_id (per-run) or session_id / completion_id
|
||||
|
|
@ -6611,25 +6664,52 @@ async def openai_chat_completions(
|
|||
)
|
||||
# Reject confirm-without-stream local tool requests before the switch: the
|
||||
# local tool path requires stream=true for the confirm gate, so this shape
|
||||
# is invalid and must not evict the resident model first. Mirror that path's
|
||||
# enablement exactly (_effective_enable_tools honors a CLI --enable-tools
|
||||
# policy hard-override; mcp_enabled opens the tool loop on its own but still
|
||||
# defers to a CLI --disable-tools policy), or an mcp_enabled/policy-forced
|
||||
# request would slip past this guard and only 400 after the swap.
|
||||
from state.tool_policy import get_tool_policy as _get_confirm_tool_policy
|
||||
# is invalid and must not evict the resident model first.
|
||||
#
|
||||
# Enter the local-loop arm exactly when the passthrough router below would
|
||||
# run Studio's own tool loop. That gate is `_tools_on or _mcp_allowed`
|
||||
# (see the use_tools block): _effective_enable_tools (which lets a
|
||||
# process-wide --enable-tools policy force the loop on) plus mcp_enabled
|
||||
# honoring --disable-tools, and tool_choice="none" disabling it unless the
|
||||
# request explicitly asked. enabled_tools never enters loop entry (it only
|
||||
# filters which tools run), so it is not a signal here.
|
||||
#
|
||||
# But a policy-forced loop must not steal client-tool passthrough: when the
|
||||
# request did not explicitly ask for the loop (enable_tools/mcp) and carries
|
||||
# client tools, the router forwards to the provider branch, so only treat it
|
||||
# as the local loop when the request explicitly asked OR there is no client
|
||||
# passthrough to defer to.
|
||||
from state.tool_policy import get_tool_policy as _get_tool_policy_pre
|
||||
|
||||
_confirm_cli_policy = _get_confirm_tool_policy()
|
||||
_cli_policy_pre = _get_tool_policy_pre()
|
||||
_use_tools_intent = _effective_enable_tools(payload) or (
|
||||
bool(payload.mcp_enabled) and _cli_policy_pre is not False
|
||||
)
|
||||
if payload.tool_choice == "none" and not _explicit_studio_tool_loop_requested(payload):
|
||||
_use_tools_intent = False
|
||||
_client_tool_passthrough = (
|
||||
bool(payload.tools)
|
||||
or bool(payload.openai_code_exec_container_id)
|
||||
or bool(payload.anthropic_code_exec_container_id)
|
||||
# A JSON-schema response_format is guided-decoding structured output the
|
||||
# router forwards to the llama-server passthrough, not Studio's tool
|
||||
# loop, so a --enable-tools policy must not 400 it as a local-confirm
|
||||
# request under ask/auto.
|
||||
or bool(_extract_response_format(payload))
|
||||
)
|
||||
# permission_mode only implies the confirm gate for that local loop.
|
||||
# Client-tool passthrough forwards to the provider branch and the validator
|
||||
# intentionally leaves confirm_tool_calls unset there, so only an explicit
|
||||
# confirm_tool_calls=True should force the local-confirm rejection for it.
|
||||
_studio_local_tool_loop = bool(_use_tools_intent) and (
|
||||
_explicit_studio_tool_loop_requested(payload) or not _client_tool_passthrough
|
||||
)
|
||||
if (
|
||||
payload.confirm_tool_calls
|
||||
and not payload.bypass_permissions
|
||||
not payload.bypass_permissions
|
||||
and not payload.stream
|
||||
and (
|
||||
_effective_enable_tools(payload)
|
||||
or (bool(payload.mcp_enabled) and _confirm_cli_policy is not False)
|
||||
or bool(payload.enabled_tools)
|
||||
or bool(payload.tools)
|
||||
or bool(payload.openai_code_exec_container_id)
|
||||
or bool(payload.anthropic_code_exec_container_id)
|
||||
(_confirm_gate_needs_stream(payload) and _studio_local_tool_loop)
|
||||
or (payload.confirm_tool_calls is True and _client_tool_passthrough)
|
||||
)
|
||||
):
|
||||
raise HTTPException(
|
||||
|
|
@ -7144,9 +7224,23 @@ async def openai_chat_completions(
|
|||
use_tools = False
|
||||
|
||||
if use_tools:
|
||||
# permission_mode ask/auto require the confirm gate for Studio's own
|
||||
# tool loop. The request validator self-enables confirm only for
|
||||
# request-level tool signals (enable_tools/enabled_tools/mcp_enabled);
|
||||
# when a CLI policy (--enable-tools) forces the loop on without those,
|
||||
# derive confirm here so the mode still gates the call (and a
|
||||
# non-stream ask/auto request is rejected below rather than running
|
||||
# unprompted). off/full never prompt, so they are excluded.
|
||||
_effective_confirm = _permission_mode_confirm(payload)
|
||||
# Bypass Permissions suppresses confirm, so the stream requirement
|
||||
# (the gate needs streaming to prompt) no longer applies.
|
||||
if payload.confirm_tool_calls and not payload.bypass_permissions and not payload.stream:
|
||||
# (the gate needs streaming to prompt) no longer applies. auto with an
|
||||
# always-safe-only selection never prompts, so it needs no stream even
|
||||
# though _effective_confirm stays true for the loop's per-call gate.
|
||||
if (
|
||||
_confirm_gate_needs_stream(payload)
|
||||
and not payload.bypass_permissions
|
||||
and not payload.stream
|
||||
):
|
||||
raise _reject(
|
||||
400,
|
||||
openai_error_body(
|
||||
|
|
@ -7223,9 +7317,9 @@ async def openai_chat_completions(
|
|||
disable_parallel_tool_use = payload.parallel_tool_calls is False,
|
||||
# Bypass Permissions takes precedence over the confirm gate:
|
||||
# never prompt while bypassing.
|
||||
confirm_tool_calls = bool(payload.confirm_tool_calls)
|
||||
and not bool(payload.bypass_permissions),
|
||||
confirm_tool_calls = _effective_confirm and not bool(payload.bypass_permissions),
|
||||
bypass_permissions = bool(payload.bypass_permissions),
|
||||
permission_mode = payload.permission_mode,
|
||||
)
|
||||
|
||||
_tool_admission_mode = "chat_tool_stream" if payload.stream else "chat_tool_nonstream"
|
||||
|
|
@ -8439,9 +8533,20 @@ async def openai_chat_completions(
|
|||
_sf_use_tools = False
|
||||
|
||||
if _sf_use_tools:
|
||||
# permission_mode ask/auto require the confirm gate for Studio's own tool
|
||||
# loop; when a CLI policy (--enable-tools) forces the loop on without a
|
||||
# request-level tool signal, derive confirm here so the mode still gates
|
||||
# the call (matching the GGUF path). off/full never prompt.
|
||||
_sf_effective_confirm = _permission_mode_confirm(payload)
|
||||
# Bypass Permissions suppresses confirm, so the stream requirement
|
||||
# (the gate needs streaming to prompt) no longer applies.
|
||||
if payload.confirm_tool_calls and not payload.bypass_permissions and not payload.stream:
|
||||
# (the gate needs streaming to prompt) no longer applies. auto with an
|
||||
# always-safe-only selection never prompts, so it needs no stream even
|
||||
# though _sf_effective_confirm stays true for the loop's per-call gate.
|
||||
if (
|
||||
_confirm_gate_needs_stream(payload)
|
||||
and not payload.bypass_permissions
|
||||
and not payload.stream
|
||||
):
|
||||
raise _reject(
|
||||
400,
|
||||
openai_error_body(
|
||||
|
|
@ -8519,9 +8624,9 @@ async def openai_chat_completions(
|
|||
rag_scope = payload.rag_scope,
|
||||
# Bypass Permissions takes precedence over the confirm gate:
|
||||
# never prompt while bypassing.
|
||||
confirm_tool_calls = bool(payload.confirm_tool_calls)
|
||||
and not bool(payload.bypass_permissions),
|
||||
confirm_tool_calls = _sf_effective_confirm and not bool(payload.bypass_permissions),
|
||||
bypass_permissions = bool(payload.bypass_permissions),
|
||||
permission_mode = payload.permission_mode,
|
||||
use_adapter = payload.use_adapter,
|
||||
stats_holder = _sf_stats_holder,
|
||||
)
|
||||
|
|
@ -11537,6 +11642,13 @@ _STUDIO_ANTHROPIC_TOOL_ALIASES = {
|
|||
"python": "python",
|
||||
"terminal": "terminal",
|
||||
}
|
||||
# Server tools that never need a confirmation prompt (read-only / non code-
|
||||
# executing; mirrors the unconditional-safe names in is_potentially_unsafe_tool_call).
|
||||
# Any other selected tool (terminal, python, render_html) can require the gate
|
||||
# this channel has no way to present, so an omitted permission_mode ("ask") only
|
||||
# asks then. render_html is excluded because a networked canvas prompts in auto,
|
||||
# and this channel invokes the loop without confirm; auto/ask reject, off/full run.
|
||||
_ANTHROPIC_UNPROMPTED_SAFE_TOOLS = frozenset({"web_search", "search_knowledge_base"})
|
||||
|
||||
|
||||
def _anthropic_requested_studio_tools(tools: Optional[list]) -> set[str]:
|
||||
|
|
@ -11797,6 +11909,53 @@ async def anthropic_messages(
|
|||
),
|
||||
)
|
||||
|
||||
# Reject an unsupported confirm-gated permission mode for Studio's own
|
||||
# ("server") Anthropic tools before the switch, mirroring the malformed- and
|
||||
# mixed-tool checks above. ask always wants a per-call pause this passthrough
|
||||
# cannot offer, so it 400s whenever server tools are selected. auto only needs
|
||||
# the gate for an unsafe call, so (like the omitted default) it runs for a
|
||||
# safe-only selection (web_search/RAG) and 400s when a gate-needing tool is
|
||||
# selected (local terminal/python, or render_html whose networked canvas
|
||||
# prompts and cannot be gated on this channel). Rejecting must happen before the
|
||||
# switch so an invalid request never evicts the resident model; it is
|
||||
# determined from the requested tools alone (backend tool support is only known
|
||||
# post-switch); an image request can never take the server-tool path, so it is
|
||||
# excluded as in the server_tools gate below. off/full and an explicit
|
||||
# confirm_tool_calls=False opt-out always pass.
|
||||
_enable_pre = _effective_enable_tools(payload)
|
||||
_server_tools_requested_pre = (
|
||||
_enable_pre or (_enable_pre is None and bool(requested_studio_tools))
|
||||
) and not _anthropic_request_has_image(payload)
|
||||
if _server_tools_requested_pre:
|
||||
from core.inference.tools import ALL_TOOLS as _ALL_TOOLS_PRE
|
||||
|
||||
_selected_pre = _select_anthropic_server_tools(
|
||||
_ALL_TOOLS_PRE, requested_studio_tools, payload.enabled_tools
|
||||
)
|
||||
_perm_mode_pre = getattr(payload, "permission_mode", None)
|
||||
_confirm_opt_out_pre = getattr(payload, "confirm_tool_calls", None) is False
|
||||
_gated_tool_selected_pre = any(
|
||||
tool["function"]["name"] not in _ANTHROPIC_UNPROMPTED_SAFE_TOOLS
|
||||
for tool in _selected_pre
|
||||
)
|
||||
# An explicit confirm_tool_calls=False opts out of the gate entirely (it
|
||||
# wins over the mode, mirroring _permission_mode_confirm and the GGUF path),
|
||||
# so it never rejects -- not even under ask.
|
||||
if not _confirm_opt_out_pre and (
|
||||
_perm_mode_pre == "ask"
|
||||
or (_perm_mode_pre in ("auto", None) and _gated_tool_selected_pre)
|
||||
):
|
||||
raise HTTPException(
|
||||
status_code = 400,
|
||||
detail = anthropic_error_body(
|
||||
"permission_mode 'ask' has no confirmation channel for Anthropic "
|
||||
"Messages server tools, and 'auto' (or the omitted default) cannot "
|
||||
"gate a local 'terminal'/'python' tool here; set 'off' or 'full'.",
|
||||
status = 400,
|
||||
err_type = "invalid_request_error",
|
||||
),
|
||||
)
|
||||
|
||||
# require_vision rejects a swap to a text-only target before it runs, so an
|
||||
# image request can't evict the resident vision model only to hit the vision
|
||||
# guard (_normalize_anthropic_openai_images) below after the load.
|
||||
|
|
@ -11996,6 +12155,10 @@ async def anthropic_messages(
|
|||
)
|
||||
from core.inference.tools import ALL_TOOLS
|
||||
|
||||
# ask/auto (and an omitted mode selecting a gate-needing terminal/python
|
||||
# tool) were already rejected before the auto-switch above, so an invalid
|
||||
# confirm-gated request never evicts the resident model; the selection
|
||||
# here just picks the tools for the actual server-tool loop.
|
||||
openai_tools = _select_anthropic_server_tools(
|
||||
ALL_TOOLS,
|
||||
requested_studio_tools,
|
||||
|
|
@ -12051,6 +12214,7 @@ async def anthropic_messages(
|
|||
rag_scope = getattr(payload, "rag_scope", None),
|
||||
disable_parallel_tool_use = _disable_parallel,
|
||||
bypass_permissions = bool(payload.bypass_permissions),
|
||||
permission_mode = getattr(payload, "permission_mode", None),
|
||||
)
|
||||
|
||||
if payload.stream:
|
||||
|
|
|
|||
|
|
@ -1739,7 +1739,9 @@ class TestAnthropicMessagesToolRouting:
|
|||
assert backend.calls[0][0] == "plain"
|
||||
|
||||
def test_server_tool_alias_enters_tool_path_when_policy_unset(self, monkeypatch):
|
||||
# Mirror of the previous test for the default (None) policy.
|
||||
# Mirror of the previous test for the default (None) policy. An omitted
|
||||
# permission_mode still runs here because web_search is a safe server tool
|
||||
# (only a selected terminal/python would require the missing gate).
|
||||
backend = _mock_backend(monkeypatch)
|
||||
payload = _basic_payload(
|
||||
tools = [{"type": "web_search_20250305", "name": "web_search"}],
|
||||
|
|
@ -1761,6 +1763,126 @@ class TestAnthropicMessagesToolRouting:
|
|||
assert "confirm_tool_calls is not supported" in exc.value.detail["error"]["message"]
|
||||
assert backend.calls == []
|
||||
|
||||
def test_permission_mode_gating_for_server_tools(self, monkeypatch):
|
||||
# ask is a request for a per-call pause this channel cannot honor, so it is
|
||||
# always rejected, even for a safe-only server tool (web_search).
|
||||
safe_tools = [{"type": "web_search_20250305", "name": "web_search"}]
|
||||
backend = _mock_backend(monkeypatch)
|
||||
payload = _basic_payload(tools = safe_tools, permission_mode = "ask")
|
||||
with pytest.raises(HTTPException) as exc:
|
||||
_drive(anthropic_messages(payload, request = None, current_subject = "t"))
|
||||
assert exc.value.status_code == 400
|
||||
assert "no confirmation channel" in exc.value.detail["error"]["message"]
|
||||
assert backend.calls == []
|
||||
|
||||
# auto only gates unsafe calls, so a safe-only selection runs (nothing to
|
||||
# gate), like the omitted default. Both keep existing callers working.
|
||||
for extra in ({"permission_mode": "auto"}, {}):
|
||||
backend = _mock_backend(monkeypatch)
|
||||
payload = _basic_payload(tools = safe_tools, **extra)
|
||||
_drive(anthropic_messages(payload, request = None, current_subject = "t"))
|
||||
assert backend.calls[0][0] == "tools"
|
||||
|
||||
# But auto or an omitted mode that would run a local tool (terminal/python,
|
||||
# via a bare Anthropic tool type or enabled_tools) is rejected, since that
|
||||
# tool could need the gate this channel lacks.
|
||||
for local_payload in (
|
||||
_basic_payload(tools = [{"type": "terminal", "name": "terminal"}]),
|
||||
_basic_payload(
|
||||
tools = [{"type": "terminal", "name": "terminal"}], permission_mode = "auto"
|
||||
),
|
||||
_basic_payload(tools = safe_tools, enable_tools = True, enabled_tools = ["python"]),
|
||||
):
|
||||
backend = _mock_backend(monkeypatch)
|
||||
with pytest.raises(HTTPException) as exc:
|
||||
_drive(anthropic_messages(local_payload, request = None, current_subject = "t"))
|
||||
assert exc.value.status_code == 400
|
||||
assert "terminal" in exc.value.detail["error"]["message"]
|
||||
assert backend.calls == []
|
||||
|
||||
# off, full, and a legacy confirm_tool_calls=False opt-out all run, even
|
||||
# with a local tool selected. The explicit opt-out wins over the mode
|
||||
# (mirrors _permission_mode_confirm and the GGUF path), so it runs even
|
||||
# under ask, which otherwise always rejects.
|
||||
for extra in (
|
||||
{"tools": safe_tools, "permission_mode": "off"},
|
||||
{"tools": safe_tools, "permission_mode": "full"},
|
||||
{"tools": safe_tools, "enabled_tools": ["python"], "confirm_tool_calls": False},
|
||||
{"tools": safe_tools, "permission_mode": "ask", "confirm_tool_calls": False},
|
||||
{
|
||||
"tools": [{"type": "terminal", "name": "terminal"}],
|
||||
"permission_mode": "ask",
|
||||
"confirm_tool_calls": False,
|
||||
},
|
||||
):
|
||||
backend = _mock_backend(monkeypatch)
|
||||
payload = _basic_payload(**extra)
|
||||
_drive(anthropic_messages(payload, request = None, current_subject = "t"))
|
||||
assert backend.calls[0][0] == "tools"
|
||||
|
||||
def test_render_html_gated_for_server_tools(self, monkeypatch):
|
||||
# render_html is no longer unconditionally safe: a networked canvas prompts
|
||||
# in auto and this channel cannot present that gate, so selecting it under
|
||||
# ask/auto/omitted rejects like terminal/python; off/full (and an explicit
|
||||
# confirm opt-out) run it.
|
||||
rh = {"enable_tools": True, "enabled_tools": ["render_html"]}
|
||||
for mode in ("ask", "auto", None):
|
||||
backend = _mock_backend(monkeypatch)
|
||||
fields = dict(rh)
|
||||
if mode is not None:
|
||||
fields["permission_mode"] = mode
|
||||
payload = _basic_payload(**fields)
|
||||
with pytest.raises(HTTPException) as exc:
|
||||
_drive(anthropic_messages(payload, request = None, current_subject = "t"))
|
||||
assert exc.value.status_code == 400
|
||||
assert "no confirmation channel" in exc.value.detail["error"]["message"]
|
||||
assert backend.calls == []
|
||||
for extra in (
|
||||
{"permission_mode": "off"},
|
||||
{"permission_mode": "full"},
|
||||
{"confirm_tool_calls": False},
|
||||
):
|
||||
backend = _mock_backend(monkeypatch)
|
||||
payload = _basic_payload(**{**rh, **extra})
|
||||
_drive(anthropic_messages(payload, request = None, current_subject = "t"))
|
||||
assert backend.calls[0][0] == "tools"
|
||||
|
||||
def test_permission_mode_rejected_before_auto_switch(self, monkeypatch):
|
||||
# The unsupported-mode rejection must run before _maybe_auto_switch_model,
|
||||
# so an invalid confirm-gated request never evicts the resident model
|
||||
# (mirrors the pre-switch malformed- and mixed-tool guards).
|
||||
import routes.inference as inf_mod
|
||||
|
||||
switch_calls = []
|
||||
|
||||
async def _rec_switch(*_args, **_kwargs):
|
||||
switch_calls.append(1)
|
||||
|
||||
monkeypatch.setattr(inf_mod, "_maybe_auto_switch_model", _rec_switch)
|
||||
safe_tools = [{"type": "web_search_20250305", "name": "web_search"}]
|
||||
local_tools = [{"type": "terminal", "name": "terminal"}]
|
||||
|
||||
# ask (any server tool), auto with a local tool, and an omitted mode
|
||||
# selecting a local tool are all rejected up front, before the switch runs.
|
||||
for payload in (
|
||||
_basic_payload(tools = safe_tools, permission_mode = "ask"),
|
||||
_basic_payload(tools = local_tools, permission_mode = "auto"),
|
||||
_basic_payload(tools = local_tools),
|
||||
):
|
||||
switch_calls.clear()
|
||||
_mock_backend(monkeypatch)
|
||||
with pytest.raises(HTTPException) as exc:
|
||||
_drive(anthropic_messages(payload, request = None, current_subject = "t"))
|
||||
assert exc.value.status_code == 400
|
||||
assert switch_calls == [], "rejection must precede the auto-switch"
|
||||
|
||||
# A supported request (off) still reaches the switch and runs the loop.
|
||||
switch_calls.clear()
|
||||
_mock_backend(monkeypatch)
|
||||
payload = _basic_payload(tools = safe_tools, permission_mode = "off")
|
||||
_drive(anthropic_messages(payload, request = None, current_subject = "t"))
|
||||
assert switch_calls == [1]
|
||||
|
||||
def test_per_request_enable_tools_false_blocks_server_tool_alias(self, monkeypatch):
|
||||
backend = _mock_backend(monkeypatch)
|
||||
payload = _basic_payload(
|
||||
|
|
|
|||
|
|
@ -1826,6 +1826,39 @@ def test_large_python_tool_call_emits_early_provisional_start(monkeypatch):
|
|||
assert any(e.get("type") == "tool_end" and e.get("tool_name") == "python" for e in events)
|
||||
|
||||
|
||||
def test_auto_mode_render_html_suppresses_provisional_card_under_confirm(monkeypatch):
|
||||
"""render_html is no longer unconditionally safe (a networked canvas asks), so
|
||||
with confirm_tool_calls set under permission_mode="auto" its early provisional
|
||||
card is suppressed; the real full-argument tool_start still fires and a static
|
||||
canvas runs without a prompt."""
|
||||
args = {"code": "<html>" + "x" * 80 + "</html>"}
|
||||
first_stream = _streamed_structured_tool_call("render_html", args, "call_rh")
|
||||
final_stream = [_sse({"content": "Done."}), _done()]
|
||||
payloads: list[dict] = []
|
||||
backend = _make_backend(monkeypatch, [first_stream, final_stream], payloads)
|
||||
|
||||
monkeypatch.setattr("core.inference.tools.execute_tool", lambda name, arguments, **_k: "OK")
|
||||
|
||||
events = list(
|
||||
backend.generate_chat_completion_with_tools(
|
||||
messages = [{"role": "user", "content": "make a card"}],
|
||||
tools = [{"type": "function", "function": {"name": "render_html"}}],
|
||||
confirm_tool_calls = True,
|
||||
permission_mode = "auto",
|
||||
max_tool_iterations = 1,
|
||||
)
|
||||
)
|
||||
|
||||
tool_starts = [e for e in events if e.get("type") == "tool_start"]
|
||||
provisional = [e for e in tool_starts if not e.get("arguments")]
|
||||
# The confirm gate now suppresses the early provisional card for render_html.
|
||||
assert provisional == [], tool_starts
|
||||
real = [e for e in tool_starts if e.get("arguments")]
|
||||
assert real and real[0]["tool_name"] == "render_html"
|
||||
# A static canvas is classified safe, so it still runs without an approval gate.
|
||||
assert real[0].get("awaiting_confirmation") in (False, None)
|
||||
|
||||
|
||||
def test_small_python_tool_call_has_no_provisional_start(monkeypatch):
|
||||
"""A small tool-call argument finishes streaming instantly, so it keeps the
|
||||
existing behavior of a single (real) tool_start with no provisional card."""
|
||||
|
|
|
|||
|
|
@ -706,6 +706,160 @@ class TestChatCompletionRequestToolFields:
|
|||
assert entry["status"] == "completed"
|
||||
assert monitor.active_count() == 0
|
||||
|
||||
def test_permission_mode_does_not_reject_client_tool_passthrough(self, monkeypatch):
|
||||
# A non-streaming client-tool passthrough (client tools, no Studio tool
|
||||
# loop) that also carries permission_mode "ask"/"auto" must reach the
|
||||
# provider passthrough, not the confirm-without-stream guard: the
|
||||
# validator leaves confirm_tool_calls unset for passthrough, and a bare
|
||||
# permission_mode only gates Studio's own local tool loop. An explicit
|
||||
# confirm_tool_calls=True still forces the local-confirm rejection.
|
||||
# The pre-switch guard only runs when an automatic load may run, so force
|
||||
# that predicate on to exercise it against a resident passthrough backend.
|
||||
import routes.inference as inference_route
|
||||
|
||||
class _GGUFBackend:
|
||||
is_loaded = True
|
||||
model_identifier = "test-gguf"
|
||||
supports_tools = False
|
||||
supports_tool_passthrough = True
|
||||
is_vision = False
|
||||
_is_audio = False
|
||||
context_length = 4096
|
||||
base_url = "http://llama.permission-passthrough.test"
|
||||
_request_reasoning_kwargs = lambda *_args, **_kwargs: None
|
||||
|
||||
def generate_chat_completion(self, **_kwargs):
|
||||
raise AssertionError("client tools must use passthrough")
|
||||
|
||||
def generate_chat_completion_with_tools(self, **_kwargs):
|
||||
raise AssertionError("Studio tool loop must stay disabled")
|
||||
|
||||
async def fake_passthrough(llama_backend, payload, model_name, **kwargs):
|
||||
inference_route.api_monitor.finish(kwargs.get("monitor_id"))
|
||||
return inference_route.JSONResponse({"ok": True, "model": model_name})
|
||||
|
||||
client_tools = [
|
||||
{
|
||||
"type": "function",
|
||||
"function": {"name": "lookup", "parameters": {"type": "object"}},
|
||||
}
|
||||
]
|
||||
|
||||
def _setup(policy = None):
|
||||
reset_tool_policy()
|
||||
if policy is not None:
|
||||
set_tool_policy(policy)
|
||||
monkeypatch.setattr(inference_route, "_automatic_model_load_may_run", lambda: True)
|
||||
monkeypatch.setattr(inference_route, "api_monitor", ApiMonitor(max_entries = 3))
|
||||
monkeypatch.setattr(
|
||||
inference_route, "_openai_passthrough_non_streaming", fake_passthrough
|
||||
)
|
||||
return self._v1_client(monkeypatch, _GGUFBackend())
|
||||
|
||||
# A process --enable-tools policy must not turn a client-tool passthrough
|
||||
# into a Studio local loop, so a policy of None or True both keep the
|
||||
# passthrough (the guard mirrors _explicit_studio_tool_loop_requested).
|
||||
for policy in (None, True):
|
||||
for mode in ("ask", "auto"):
|
||||
client = _setup(policy)
|
||||
resp = client.post(
|
||||
"/v1/chat/completions",
|
||||
json = {
|
||||
"messages": [{"role": "user", "content": "use client tool"}],
|
||||
"tools": client_tools,
|
||||
"permission_mode": mode,
|
||||
"stream": False,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 200, resp.text
|
||||
assert resp.json()["ok"] is True
|
||||
|
||||
# A JSON-schema response_format is guided-decoding passthrough, not a local
|
||||
# tool loop, so a --enable-tools policy must not 400 a non-streaming ask/auto
|
||||
# structured-output request under the confirm guard.
|
||||
for mode in ("ask", "auto"):
|
||||
client = _setup(True)
|
||||
resp = client.post(
|
||||
"/v1/chat/completions",
|
||||
json = {
|
||||
"messages": [{"role": "user", "content": "give me json"}],
|
||||
"response_format": {
|
||||
"type": "json_schema",
|
||||
"json_schema": {"name": "s", "schema": {"type": "object"}},
|
||||
},
|
||||
"permission_mode": mode,
|
||||
"stream": False,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 200, resp.text
|
||||
assert resp.json()["ok"] is True
|
||||
|
||||
# An explicit confirm_tool_calls=True with client tools and no stream is
|
||||
# still a confirm-without-stream request and must be rejected up front.
|
||||
client = _setup()
|
||||
resp = client.post(
|
||||
"/v1/chat/completions",
|
||||
json = {
|
||||
"messages": [{"role": "user", "content": "use client tool"}],
|
||||
"tools": client_tools,
|
||||
"confirm_tool_calls": True,
|
||||
"stream": False,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 400
|
||||
assert "requires stream=true" in resp.json()["error"]["message"]
|
||||
|
||||
def test_permission_mode_policy_forced_local_loop_rejected_before_switch(self, monkeypatch):
|
||||
# A process --enable-tools policy forces Studio's own tool loop on even
|
||||
# when the request omits enable_tools and carries no client tools. A
|
||||
# non-streaming ask/auto request is then confirm-gated with no stream to
|
||||
# prompt on, so it must 400 at the pre-switch guard -- before
|
||||
# _maybe_auto_switch_model runs -- rather than evicting the resident model
|
||||
# and 400ing only at the per-backend check.
|
||||
import routes.inference as inference_route
|
||||
|
||||
class _GGUFBackend:
|
||||
is_loaded = True
|
||||
model_identifier = "test-gguf"
|
||||
supports_tools = True
|
||||
supports_tool_passthrough = True
|
||||
is_vision = False
|
||||
_is_audio = False
|
||||
context_length = 4096
|
||||
base_url = "http://llama.policy-forced.test"
|
||||
_request_reasoning_kwargs = lambda *_args, **_kwargs: None
|
||||
|
||||
switch_calls = []
|
||||
|
||||
async def _no_switch(*_args, **_kwargs):
|
||||
switch_calls.append(1)
|
||||
|
||||
def _setup():
|
||||
reset_tool_policy()
|
||||
set_tool_policy(True)
|
||||
monkeypatch.setattr(inference_route, "_automatic_model_load_may_run", lambda: True)
|
||||
monkeypatch.setattr(inference_route, "api_monitor", ApiMonitor(max_entries = 3))
|
||||
monkeypatch.setattr(inference_route, "_maybe_auto_switch_model", _no_switch)
|
||||
return self._v1_client(monkeypatch, _GGUFBackend())
|
||||
|
||||
try:
|
||||
for mode in ("ask", "auto"):
|
||||
switch_calls.clear()
|
||||
client = _setup()
|
||||
resp = client.post(
|
||||
"/v1/chat/completions",
|
||||
json = {
|
||||
"messages": [{"role": "user", "content": "hi"}],
|
||||
"permission_mode": mode,
|
||||
"stream": False,
|
||||
},
|
||||
)
|
||||
assert resp.status_code == 400, resp.text
|
||||
assert "requires stream=true" in resp.json()["error"]["message"]
|
||||
assert switch_calls == [], "guard must reject before the auto-switch"
|
||||
finally:
|
||||
reset_tool_policy()
|
||||
|
||||
def test_enable_tools_on_non_tool_backend_keeps_client_tools_on_passthrough(self, monkeypatch):
|
||||
# DiffusionGemma forces supports_tools off while passthrough stays
|
||||
# available (#6851): enable_tools=True must not steal client tools
|
||||
|
|
|
|||
1594
studio/backend/tests/test_permission_mode.py
Normal file
1594
studio/backend/tests/test_permission_mode.py
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -2592,6 +2592,50 @@ class TestLoopBasic:
|
|||
assert tool_starts[0]["arguments"] == {}
|
||||
assert "<!doctype html>" in tool_starts[1]["arguments"]["code"]
|
||||
|
||||
def test_render_html_auto_mode_static_runs_without_prompt(self):
|
||||
"""permission_mode="auto" ships confirm_tool_calls=true. render_html is no
|
||||
longer unconditionally safe (a networked canvas must ask), so its early
|
||||
provisional card is suppressed under the confirm gate; a static canvas is
|
||||
still classified safe and runs without an approval prompt."""
|
||||
exec_fn = FakeExecuteTool(["Rendered HTML canvas."])
|
||||
turn_iter = iter(
|
||||
[
|
||||
[
|
||||
"<function=render_html>",
|
||||
"<parameter=code><!doctype html><html>",
|
||||
"<body>Hi</body></html></parameter></function>",
|
||||
],
|
||||
["Done."],
|
||||
]
|
||||
)
|
||||
|
||||
def _gen(_messages):
|
||||
chunks = next(turn_iter)
|
||||
acc = ""
|
||||
for chunk in chunks:
|
||||
acc += chunk
|
||||
yield acc
|
||||
|
||||
loop = run_safetensors_tool_loop(
|
||||
single_turn = _gen,
|
||||
messages = [{"role": "user", "content": "make html"}],
|
||||
tools = [{"type": "function", "function": {"name": "render_html"}}],
|
||||
execute_tool = exec_fn,
|
||||
confirm_tool_calls = True,
|
||||
permission_mode = "auto",
|
||||
session_id = "sess",
|
||||
max_tool_iterations = 3,
|
||||
)
|
||||
events = _collect_events(loop)
|
||||
tool_starts = [e for e in events if e["type"] == "tool_start"]
|
||||
|
||||
# No early provisional card under the auto confirm gate; just the real call.
|
||||
assert len(tool_starts) == 1
|
||||
assert tool_starts[0]["tool_name"] == "render_html"
|
||||
assert "<!doctype html>" in tool_starts[0]["arguments"]["code"]
|
||||
# A static canvas is classified safe, so it runs without an approval gate.
|
||||
assert tool_starts[0].get("awaiting_confirmation") in (False, None)
|
||||
|
||||
def test_render_html_provisional_card_closed_on_generator_exception(self):
|
||||
"""If the model generator raises mid-stream after a provisional render_html
|
||||
card was surfaced, the loop must close that card as errored before the
|
||||
|
|
@ -3674,6 +3718,26 @@ class TestGuardrails:
|
|||
assert any(e.get("type") == "content" and e.get("text") == "plain answer" for e in events)
|
||||
assert exec_fn.calls == []
|
||||
|
||||
def test_auto_mode_still_runs_rag_autoinject(self, monkeypatch):
|
||||
# "auto" sends confirm_tool_calls=true so unsafe calls gate, but the
|
||||
# safe search_knowledge_base retrieval never gates, so autoinject must
|
||||
# still run (unlike ask mode above).
|
||||
ran = {"called": False}
|
||||
|
||||
def fake_autoinject(*_args, **_kwargs):
|
||||
ran["called"] = True
|
||||
return None
|
||||
|
||||
monkeypatch.setattr("core.inference.tools.build_rag_autoinject", fake_autoinject)
|
||||
loop, _exec_fn = _make_loop(
|
||||
turns = [["plain answer"]],
|
||||
confirm_tool_calls = True,
|
||||
permission_mode = "auto",
|
||||
rag_scope = {"thread_id": "t1"},
|
||||
)
|
||||
_collect_events(loop)
|
||||
assert ran["called"] is True
|
||||
|
||||
def test_auto_heal_disabled_preserves_xml_on_final_no_tools_pass(self):
|
||||
turns = iter(
|
||||
[
|
||||
|
|
|
|||
|
|
@ -79,6 +79,7 @@ import { McpComposerButton } from "@/features/chat/mcp-composer-button";
|
|||
import { getExternalReasoningCapabilities } from "@/features/chat/provider-capabilities";
|
||||
import { useRagToolDisabled } from "@/features/chat/hooks/use-rag-tool-disabled";
|
||||
import { BypassPermissionsMenuItem } from "@/features/chat/bypass-permissions-menu-item";
|
||||
import { PermissionModeComposerPill } from "@/features/chat/permission-mode-select";
|
||||
import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
|
||||
import { useExternalProvidersStore } from "@/features/chat/stores/external-providers-store";
|
||||
import { PROMPT_QUEUE_STOP_EVENT } from "@/features/chat/utils/prompt-queue-boundary";
|
||||
|
|
@ -131,7 +132,6 @@ import {
|
|||
Image03Icon,
|
||||
McpServerIcon,
|
||||
PencilRulerIcon,
|
||||
ShieldBanIcon,
|
||||
} from "@hugeicons/core-free-icons";
|
||||
import { HugeiconsIcon } from "@hugeicons/react";
|
||||
import { useNavigate } from "@tanstack/react-router";
|
||||
|
|
@ -1428,11 +1428,14 @@ const Composer: FC<{
|
|||
const artifactsEnabled = useChatRuntimeStore((s) => s.artifactsEnabled);
|
||||
const mcpEnabledForChat = useChatRuntimeStore((s) => s.mcpEnabledForChat);
|
||||
const ragEnabled = useChatRuntimeStore((s) => s.ragEnabled);
|
||||
const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
|
||||
const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
|
||||
// More than 4 pills: collapse to icons only. Search and Code always show;
|
||||
// More than 4 pills: collapse to icons only. Search and Code always show; the
|
||||
// permission pill shows in every mode except "off" (it renders null there);
|
||||
// Images, RAG, Canvas and MCP are conditional.
|
||||
const pillsCompact =
|
||||
2 +
|
||||
(permissionMode !== "off" ? 1 : 0) +
|
||||
(ragEnabled ? 1 : 0) +
|
||||
(supportsBuiltinImageGeneration ? 1 : 0) +
|
||||
(artifactsEnabled ? 1 : 0) +
|
||||
|
|
@ -1856,9 +1859,9 @@ const Composer: FC<{
|
|||
data-pill-compact={pillsCompact ? "true" : undefined}
|
||||
>
|
||||
<ComposerToolsMenu side={effectiveMenuSide} />
|
||||
{/* Active-mode badge: always visible when bypass is on, even while
|
||||
the pill row is collapsed (returns null when off). */}
|
||||
<BypassPermissionsToggle />
|
||||
{/* Permission-level pill: always visible, even while the pill row
|
||||
is collapsed; opens the permission level dropdown. */}
|
||||
<PermissionModeComposerPill side={effectiveMenuSide} />
|
||||
{composerExpanded ? (
|
||||
<>
|
||||
<WebSearchToggle />
|
||||
|
|
@ -2620,36 +2623,6 @@ const ArtifactsToggle: FC = () => {
|
|||
);
|
||||
};
|
||||
|
||||
// Claude gold pill shown while Bypass permissions is on; click to turn it off.
|
||||
// Mirror of shared-composer's badge so both composers surface the state.
|
||||
const BypassPermissionsToggle: FC = () => {
|
||||
const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
|
||||
const setBypassPermissions = useChatRuntimeStore(
|
||||
(s) => s.setBypassPermissions,
|
||||
);
|
||||
if (!bypassPermissions) return null;
|
||||
return (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setBypassPermissions(false)}
|
||||
className="composer-pill-btn"
|
||||
data-active="true"
|
||||
data-variant="danger"
|
||||
aria-label="Disable Bypass permissions"
|
||||
title="Bypass permissions is on (no confirmation, no sandbox). Click to turn off."
|
||||
>
|
||||
<PillGlyph>
|
||||
<HugeiconsIcon
|
||||
icon={ShieldBanIcon}
|
||||
strokeWidth={2}
|
||||
className="size-[15px]"
|
||||
/>
|
||||
</PillGlyph>
|
||||
<span>Bypass permissions</span>
|
||||
</button>
|
||||
);
|
||||
};
|
||||
|
||||
const ToolStatusDisplay: FC = () => {
|
||||
const toolStatus = useChatRuntimeStore((s) => s.toolStatus);
|
||||
const isThreadRunning = useAuiState(({ thread }) => thread.isRunning);
|
||||
|
|
|
|||
|
|
@ -173,6 +173,7 @@ interface ResponseDetailsMetadata {
|
|||
artifacts: boolean;
|
||||
confirmToolCalls: boolean;
|
||||
bypassPermissions: boolean;
|
||||
permissionMode?: string;
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -1951,6 +1952,7 @@ export function createOpenAIStreamAdapter(
|
|||
mcpEnabledForChat,
|
||||
confirmToolCalls,
|
||||
bypassPermissions,
|
||||
permissionMode,
|
||||
webFetchToolsEnabled,
|
||||
ragEnabled,
|
||||
ragSource,
|
||||
|
|
@ -2642,6 +2644,7 @@ export function createOpenAIStreamAdapter(
|
|||
artifacts: renderHtmlToolEnabledForThisTurn,
|
||||
confirmToolCalls,
|
||||
bypassPermissions,
|
||||
permissionMode,
|
||||
},
|
||||
});
|
||||
const externalCapabilities = getProviderCapabilities(
|
||||
|
|
@ -2953,6 +2956,16 @@ export function createOpenAIStreamAdapter(
|
|||
...(supportsPreserveThinking
|
||||
? { preserve_thinking: preserveThinking }
|
||||
: {}),
|
||||
// Permission level for local tool calls is sent for every local
|
||||
// chat, not only when a tool pill is on: a process policy
|
||||
// (unsloth run --enable-tools) can open the tool loop with no pill,
|
||||
// and the backend must still see the selected gate. ask/auto request
|
||||
// the confirm gate ("auto" only pauses calls flagged unsafe); off
|
||||
// and full never prompt, full also drops the sandbox.
|
||||
permission_mode: permissionMode,
|
||||
confirm_tool_calls:
|
||||
permissionMode === "ask" || permissionMode === "auto",
|
||||
bypass_permissions: bypassPermissions,
|
||||
...(supportsTools &&
|
||||
(toolsEnabled ||
|
||||
codeToolsEnabled ||
|
||||
|
|
@ -2974,10 +2987,6 @@ export function createOpenAIStreamAdapter(
|
|||
: []),
|
||||
],
|
||||
mcp_enabled: mcpEnabledForChat,
|
||||
// Bypass Permissions wins: never request the confirm gate
|
||||
// while bypassing, and tell the backend to drop the sandbox.
|
||||
confirm_tool_calls: confirmToolCalls && !bypassPermissions,
|
||||
bypass_permissions: bypassPermissions,
|
||||
// Scope: thread_id = this thread's docs, kb_id = a KB,
|
||||
// project_id = the thread's project sources (auto-on whenever
|
||||
// the project has indexed sources, no Docs pill needed).
|
||||
|
|
|
|||
|
|
@ -14,45 +14,49 @@ import {
|
|||
AlertDialogHeader,
|
||||
AlertDialogTitle,
|
||||
} from "@/components/ui/alert-dialog";
|
||||
import { DropdownMenuItem } from "@/components/ui/dropdown-menu";
|
||||
import {
|
||||
DropdownMenuSub,
|
||||
DropdownMenuSubContent,
|
||||
DropdownMenuSubTrigger,
|
||||
} from "@/components/ui/dropdown-menu";
|
||||
import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store";
|
||||
import { Tick02Icon } from "@/lib/tick-icon";
|
||||
import { PermissionModeMenuItems } from "./permission-mode-select";
|
||||
|
||||
// "Bypass permissions" entry for the composer "+" -> More menu. Mirrors the
|
||||
// settings toggle: enabling demands the danger warning, disabling is immediate.
|
||||
// The menu closes normally on select (no preventDefault) -- the warning dialog
|
||||
// lives outside the menu (BypassPermissionsConfirmDialog, mounted once at the
|
||||
// chat-page root and driven by the store), so it survives the menu unmounting
|
||||
// and the "+"/More popovers don't stay frozen.
|
||||
// "Bypass permissions" entry for the composer "+" -> More menu. Like the MCP
|
||||
// pill, it opens a submenu where the user picks the permission level (Ask for
|
||||
// approval / Approve for me / Full access). Picking Full access demands the
|
||||
// danger warning; the other levels apply immediately. The menu closes normally
|
||||
// on select (no preventDefault) -- the warning dialog lives outside the menu
|
||||
// (BypassPermissionsConfirmDialog, mounted once at the chat-page root and
|
||||
// driven by the store), so it survives the menu unmounting and the "+"/More
|
||||
// popovers don't stay frozen.
|
||||
export function BypassPermissionsMenuItem() {
|
||||
const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
|
||||
const setBypassPermissions = useChatRuntimeStore(
|
||||
(s) => s.setBypassPermissions,
|
||||
);
|
||||
const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
|
||||
const setBypassConfirmOpen = useChatRuntimeStore(
|
||||
(s) => s.setBypassConfirmOpen,
|
||||
);
|
||||
|
||||
return (
|
||||
<DropdownMenuItem
|
||||
className={bypassPermissions ? "text-bypass font-medium" : undefined}
|
||||
onSelect={() => {
|
||||
if (bypassPermissions) {
|
||||
setBypassPermissions(false);
|
||||
} else {
|
||||
// Defer past Radix's menu-close focus restoration: opening the dialog
|
||||
// synchronously here lets the dropdown grab focus back and breaks the
|
||||
// dialog's focus trap.
|
||||
setTimeout(() => setBypassConfirmOpen(true), 0);
|
||||
<DropdownMenuSub>
|
||||
<DropdownMenuSubTrigger
|
||||
className={
|
||||
permissionMode === "full" ? "text-bypass font-medium" : undefined
|
||||
}
|
||||
}}
|
||||
>
|
||||
<HugeiconsIcon icon={ShieldBanIcon} strokeWidth={2} />
|
||||
Bypass permissions
|
||||
{bypassPermissions ? (
|
||||
<HugeiconsIcon icon={Tick02Icon} strokeWidth={2} className="ml-auto" />
|
||||
) : null}
|
||||
</DropdownMenuItem>
|
||||
>
|
||||
<HugeiconsIcon icon={ShieldBanIcon} strokeWidth={2} />
|
||||
Bypass permissions
|
||||
</DropdownMenuSubTrigger>
|
||||
<DropdownMenuSubContent className="unsloth-plus-menu w-[300px]">
|
||||
<PermissionModeMenuItems
|
||||
// Defer past Radix's menu-close focus restoration: opening the
|
||||
// dialog synchronously here lets the dropdown grab focus back and
|
||||
// breaks the dialog's focus trap.
|
||||
onRequestFullAccess={() =>
|
||||
setTimeout(() => setBypassConfirmOpen(true), 0)
|
||||
}
|
||||
/>
|
||||
</DropdownMenuSubContent>
|
||||
</DropdownMenuSub>
|
||||
);
|
||||
}
|
||||
|
||||
|
|
@ -63,19 +67,17 @@ export function BypassPermissionsMenuItem() {
|
|||
export function BypassPermissionsConfirmDialog() {
|
||||
const open = useChatRuntimeStore((s) => s.bypassConfirmOpen);
|
||||
const setOpen = useChatRuntimeStore((s) => s.setBypassConfirmOpen);
|
||||
const setBypassPermissions = useChatRuntimeStore(
|
||||
(s) => s.setBypassPermissions,
|
||||
);
|
||||
const setPermissionMode = useChatRuntimeStore((s) => s.setPermissionMode);
|
||||
|
||||
return (
|
||||
<AlertDialog open={open} onOpenChange={setOpen}>
|
||||
<AlertDialogContent size="sm">
|
||||
<AlertDialogHeader>
|
||||
<AlertDialogTitle>Enable Bypass permissions?</AlertDialogTitle>
|
||||
<AlertDialogTitle>Enable Full access?</AlertDialogTitle>
|
||||
<AlertDialogDescription>
|
||||
Bypass permissions is dangerous since the AI model might delete,
|
||||
corrupt your machine, and or cause real world damage to you or the
|
||||
world - only accept if you are certain
|
||||
Full access (Bypass permissions) is dangerous since the AI model
|
||||
might delete, corrupt your machine, and or cause real world damage
|
||||
to you or the world - only accept if you are certain
|
||||
</AlertDialogDescription>
|
||||
</AlertDialogHeader>
|
||||
<AlertDialogFooter>
|
||||
|
|
@ -84,7 +86,7 @@ export function BypassPermissionsConfirmDialog() {
|
|||
variant="destructive"
|
||||
className="!bg-destructive !text-destructive-foreground hover:!bg-destructive/90"
|
||||
onClick={() => {
|
||||
setBypassPermissions(true);
|
||||
setPermissionMode("full");
|
||||
setOpen(false);
|
||||
}}
|
||||
>
|
||||
|
|
|
|||
|
|
@ -6,16 +6,6 @@ import {
|
|||
AlertDescription,
|
||||
AlertTitle,
|
||||
} from "@/components/ui/alert";
|
||||
import {
|
||||
AlertDialog,
|
||||
AlertDialogAction,
|
||||
AlertDialogCancel,
|
||||
AlertDialogContent,
|
||||
AlertDialogDescription,
|
||||
AlertDialogFooter,
|
||||
AlertDialogHeader,
|
||||
AlertDialogTitle,
|
||||
} from "@/components/ui/alert-dialog";
|
||||
import { Button } from "@/components/ui/button";
|
||||
import { Checkbox } from "@/components/ui/checkbox";
|
||||
import {
|
||||
|
|
@ -81,6 +71,7 @@ import { Fragment, type ReactNode } from "react";
|
|||
import { useCallback, useEffect, useMemo, useRef, useState } from "react";
|
||||
import { toast } from "@/lib/toast";
|
||||
import { OpenAICodeExecSection } from "./components/openai-code-exec-section";
|
||||
import { PermissionModeDropdown } from "./permission-mode-select";
|
||||
import { resyncInferenceStatusAfterServerModelChange } from "./hooks/use-chat-model-runtime";
|
||||
import {
|
||||
type ExternalProviderConfig,
|
||||
|
|
@ -2037,9 +2028,8 @@ function NudgeToolCallsToggle() {
|
|||
}
|
||||
|
||||
function ConfirmToolCallsToggle() {
|
||||
const confirmToolCalls = useChatRuntimeStore((s) => s.confirmToolCalls);
|
||||
const setConfirmToolCalls = useChatRuntimeStore((s) => s.setConfirmToolCalls);
|
||||
const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
|
||||
const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
|
||||
|
||||
return (
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
|
|
@ -2049,85 +2039,49 @@ function ConfirmToolCallsToggle() {
|
|||
Confirm tool calls
|
||||
</span>
|
||||
<InfoHint>
|
||||
When on, local Studio tool calls pause for your approval before they
|
||||
run. Provider-hosted tools are not gated here.
|
||||
When on, every local Unsloth tool call pauses for your approval
|
||||
before it runs (the "Ask for approval" level). When off, tool calls
|
||||
run without prompts inside the sandbox (the "Off" level).
|
||||
Provider-hosted tools are not gated here.
|
||||
</InfoHint>
|
||||
</div>
|
||||
{bypassPermissions ? (
|
||||
{permissionMode === "full" ? (
|
||||
<span className="text-[11px] text-muted-foreground">
|
||||
Overridden by Bypass permissions
|
||||
Overridden by Full access (Bypass permissions)
|
||||
</span>
|
||||
) : null}
|
||||
</div>
|
||||
<Switch
|
||||
className="panel-switch"
|
||||
checked={confirmToolCalls && !bypassPermissions}
|
||||
checked={permissionMode === "ask"}
|
||||
onCheckedChange={setConfirmToolCalls}
|
||||
disabled={bypassPermissions}
|
||||
disabled={permissionMode === "full"}
|
||||
/>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
function BypassPermissionsToggle() {
|
||||
const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
|
||||
const setBypassPermissions = useChatRuntimeStore(
|
||||
(s) => s.setBypassPermissions,
|
||||
);
|
||||
const [dialogOpen, setDialogOpen] = useState(false);
|
||||
const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
|
||||
|
||||
return (
|
||||
<div className="flex flex-col gap-1.5">
|
||||
<div className="flex items-center justify-between gap-3">
|
||||
<div className="flex min-w-0 items-center gap-1.5">
|
||||
<span className="min-w-0 text-[13px] font-medium leading-[1.25] tracking-nav text-nav-fg">
|
||||
Bypass permissions
|
||||
</span>
|
||||
<InfoHint>
|
||||
Dangerous. Runs every tool call with no confirmation and disables
|
||||
the python/terminal sandbox. Environment secrets are stripped, but
|
||||
code can still read files and credentials on your machine.
|
||||
</InfoHint>
|
||||
</div>
|
||||
<Switch
|
||||
className="panel-switch"
|
||||
checked={bypassPermissions}
|
||||
onCheckedChange={(next) => {
|
||||
if (next) setDialogOpen(true);
|
||||
else setBypassPermissions(false);
|
||||
}}
|
||||
/>
|
||||
<div className="flex flex-col gap-2">
|
||||
<div className="flex min-w-0 items-center gap-1.5">
|
||||
<span className="whitespace-nowrap text-[13px] font-medium leading-[1.25] tracking-nav text-nav-fg">
|
||||
Bypass permissions
|
||||
</span>
|
||||
<InfoHint>
|
||||
How Unsloth approves tool calls before they run. Full access is
|
||||
dangerous: it disables confirmations and the code sandbox.
|
||||
</InfoHint>
|
||||
</div>
|
||||
{bypassPermissions ? (
|
||||
{/* Full width, styled like the panel selects/preset input. */}
|
||||
<PermissionModeDropdown triggerClassName="h-9 w-full justify-between rounded-full border-0 bg-[var(--panel-input-surface)] px-3.5 text-[13px] font-medium text-nav-fg shadow-none hover:bg-[var(--panel-input-surface)]" />
|
||||
{permissionMode === "full" ? (
|
||||
<span className="text-[11px] text-bypass">
|
||||
Tool calls run with no confirmation and no sandbox.
|
||||
</span>
|
||||
) : null}
|
||||
<AlertDialog open={dialogOpen} onOpenChange={setDialogOpen}>
|
||||
<AlertDialogContent size="sm">
|
||||
<AlertDialogHeader>
|
||||
<AlertDialogTitle>Enable Bypass permissions?</AlertDialogTitle>
|
||||
<AlertDialogDescription>
|
||||
Bypass permissions is dangerous since the AI model might delete,
|
||||
corrupt your machine, and or cause real world damage to you or the
|
||||
world - only accept if you are certain
|
||||
</AlertDialogDescription>
|
||||
</AlertDialogHeader>
|
||||
<AlertDialogFooter>
|
||||
<AlertDialogCancel>Cancel</AlertDialogCancel>
|
||||
<AlertDialogAction
|
||||
variant="destructive"
|
||||
className="!bg-destructive !text-destructive-foreground hover:!bg-destructive/90"
|
||||
onClick={() => {
|
||||
setBypassPermissions(true);
|
||||
setDialogOpen(false);
|
||||
}}
|
||||
>
|
||||
I understand
|
||||
</AlertDialogAction>
|
||||
</AlertDialogFooter>
|
||||
</AlertDialogContent>
|
||||
</AlertDialog>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -17,6 +17,7 @@ export {
|
|||
type Preset,
|
||||
} from "./chat-settings-sheet";
|
||||
export { useChatRuntimeStore } from "./stores/chat-runtime-store";
|
||||
export { PermissionModeDropdown } from "./permission-mode-select";
|
||||
export { useChatSearchStore } from "./stores/chat-search-store";
|
||||
export { usePinnedChatsStore } from "./stores/pinned-chats-store";
|
||||
export { useChatPreferencesStore } from "./stores/chat-preferences-store";
|
||||
|
|
|
|||
338
studio/frontend/src/features/chat/permission-mode-select.tsx
Normal file
338
studio/frontend/src/features/chat/permission-mode-select.tsx
Normal file
|
|
@ -0,0 +1,338 @@
|
|||
// SPDX-License-Identifier: AGPL-3.0-only
|
||||
// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0
|
||||
|
||||
import {
|
||||
ChevronDown,
|
||||
CircleAlert,
|
||||
CircleOff,
|
||||
Hand,
|
||||
ShieldCheck,
|
||||
XIcon,
|
||||
} from "lucide-react";
|
||||
import { useState } from "react";
|
||||
|
||||
import {
|
||||
AlertDialog,
|
||||
AlertDialogAction,
|
||||
AlertDialogCancel,
|
||||
AlertDialogContent,
|
||||
AlertDialogDescription,
|
||||
AlertDialogFooter,
|
||||
AlertDialogHeader,
|
||||
AlertDialogTitle,
|
||||
} from "@/components/ui/alert-dialog";
|
||||
import { Button } from "@/components/ui/button";
|
||||
import {
|
||||
DropdownMenu,
|
||||
DropdownMenuContent,
|
||||
DropdownMenuItem,
|
||||
DropdownMenuLabel,
|
||||
DropdownMenuTrigger,
|
||||
} from "@/components/ui/dropdown-menu";
|
||||
import { ChevronDownStandardIcon } from "@/lib/chevron-icons";
|
||||
import { Tick02Icon } from "@/lib/tick-icon";
|
||||
import { cn } from "@/lib/utils";
|
||||
import { HugeiconsIcon } from "@hugeicons/react";
|
||||
import {
|
||||
type PermissionMode,
|
||||
useChatRuntimeStore,
|
||||
} from "./stores/chat-runtime-store";
|
||||
|
||||
/**
|
||||
* Permission levels for the Bypass permissions dropdowns (General settings,
|
||||
* chat settings sheet, composer "+" menu). Off sits last as the toggle that
|
||||
* turns the feature off entirely.
|
||||
*/
|
||||
export const PERMISSION_MODE_OPTIONS: readonly {
|
||||
value: PermissionMode;
|
||||
label: string;
|
||||
description: string;
|
||||
icon: typeof Hand;
|
||||
}[] = [
|
||||
{
|
||||
value: "ask",
|
||||
label: "Ask for approval",
|
||||
description: "Always ask before tool calls edit files or use the internet",
|
||||
icon: Hand,
|
||||
},
|
||||
{
|
||||
value: "auto",
|
||||
label: "Approve for me",
|
||||
description: "Only ask for actions detected as potentially unsafe",
|
||||
icon: ShieldCheck,
|
||||
},
|
||||
{
|
||||
value: "full",
|
||||
label: "Full access",
|
||||
description:
|
||||
"Unrestricted: no approval prompts and the code sandbox is disabled",
|
||||
icon: CircleAlert,
|
||||
},
|
||||
{
|
||||
value: "off",
|
||||
label: "Off",
|
||||
description: "Turn off bypass permissions",
|
||||
icon: CircleOff,
|
||||
},
|
||||
] as const;
|
||||
|
||||
export function permissionModeOption(mode: PermissionMode) {
|
||||
return (
|
||||
PERMISSION_MODE_OPTIONS.find((option) => option.value === mode) ??
|
||||
PERMISSION_MODE_OPTIONS[0]
|
||||
);
|
||||
}
|
||||
|
||||
/** The option rows shared by every permission dropdown/submenu. Non-full
|
||||
* levels apply directly; picking Full access must go through the caller's
|
||||
* danger confirmation, so it's a separate callback. */
|
||||
export function PermissionModeMenuItems({
|
||||
onRequestFullAccess,
|
||||
}: {
|
||||
onRequestFullAccess: () => void;
|
||||
}) {
|
||||
const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
|
||||
const setPermissionMode = useChatRuntimeStore((s) => s.setPermissionMode);
|
||||
|
||||
return (
|
||||
<>
|
||||
{PERMISSION_MODE_OPTIONS.map((option) => (
|
||||
<DropdownMenuItem
|
||||
key={option.value}
|
||||
onSelect={() => {
|
||||
// Reselecting the active level toggles the feature off.
|
||||
if (option.value === permissionMode) {
|
||||
setPermissionMode("off");
|
||||
} else if (option.value === "full") {
|
||||
onRequestFullAccess();
|
||||
} else {
|
||||
setPermissionMode(option.value);
|
||||
}
|
||||
}}
|
||||
className={cn(
|
||||
"items-start gap-2 py-2",
|
||||
permissionMode === option.value && "font-medium",
|
||||
option.value === "full" &&
|
||||
permissionMode === "full" &&
|
||||
"text-bypass",
|
||||
)}
|
||||
>
|
||||
<option.icon className="mt-0.5 size-4 shrink-0" strokeWidth={2} />
|
||||
<span className="flex min-w-0 flex-1 flex-col gap-0.5">
|
||||
<span className="text-[13px] leading-tight">{option.label}</span>
|
||||
<span className="text-xs font-normal leading-snug text-muted-foreground">
|
||||
{option.description}
|
||||
</span>
|
||||
</span>
|
||||
{permissionMode === option.value ? (
|
||||
<HugeiconsIcon
|
||||
icon={Tick02Icon}
|
||||
strokeWidth={2}
|
||||
className="ml-auto mt-0.5 size-4 shrink-0"
|
||||
/>
|
||||
) : null}
|
||||
</DropdownMenuItem>
|
||||
))}
|
||||
</>
|
||||
);
|
||||
}
|
||||
|
||||
/** Danger confirmation shown before Full access turns on. Self-contained so
|
||||
* the dropdown works outside the chat page (e.g. the Settings dialog). */
|
||||
export function FullAccessConfirmDialog({
|
||||
open,
|
||||
onOpenChange,
|
||||
}: {
|
||||
open: boolean;
|
||||
onOpenChange: (open: boolean) => void;
|
||||
}) {
|
||||
const setPermissionMode = useChatRuntimeStore((s) => s.setPermissionMode);
|
||||
|
||||
return (
|
||||
<AlertDialog open={open} onOpenChange={onOpenChange}>
|
||||
<AlertDialogContent size="sm">
|
||||
<AlertDialogHeader>
|
||||
<AlertDialogTitle>Enable Full access?</AlertDialogTitle>
|
||||
<AlertDialogDescription>
|
||||
Full access (Bypass permissions) is dangerous since the AI model
|
||||
might delete, corrupt your machine, and or cause real world damage
|
||||
to you or the world - only accept if you are certain
|
||||
</AlertDialogDescription>
|
||||
</AlertDialogHeader>
|
||||
<AlertDialogFooter>
|
||||
<AlertDialogCancel>Cancel</AlertDialogCancel>
|
||||
<AlertDialogAction
|
||||
variant="destructive"
|
||||
className="!bg-destructive !text-destructive-foreground hover:!bg-destructive/90"
|
||||
onClick={() => {
|
||||
setPermissionMode("full");
|
||||
onOpenChange(false);
|
||||
}}
|
||||
>
|
||||
I understand
|
||||
</AlertDialogAction>
|
||||
</AlertDialogFooter>
|
||||
</AlertDialogContent>
|
||||
</AlertDialog>
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Select-style dropdown (like the MCP composer menu) for picking the
|
||||
* permission level. Used in General settings and the chat settings sheet.
|
||||
*/
|
||||
export function PermissionModeDropdown({
|
||||
side = "bottom",
|
||||
align = "end",
|
||||
triggerClassName,
|
||||
}: {
|
||||
side?: "top" | "bottom";
|
||||
align?: "start" | "end";
|
||||
triggerClassName?: string;
|
||||
} = {}) {
|
||||
const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
|
||||
const [confirmOpen, setConfirmOpen] = useState(false);
|
||||
const active = permissionModeOption(permissionMode);
|
||||
const ActiveIcon = active.icon;
|
||||
|
||||
return (
|
||||
<>
|
||||
<DropdownMenu>
|
||||
<DropdownMenuTrigger asChild={true}>
|
||||
<Button
|
||||
variant="outline"
|
||||
size="sm"
|
||||
className={cn(
|
||||
"gap-1.5",
|
||||
triggerClassName,
|
||||
// Last so a text color in triggerClassName cannot override it.
|
||||
permissionMode === "full" &&
|
||||
"text-bypass hover:text-bypass border-bypass/50",
|
||||
)}
|
||||
aria-label="Permission level for tool calls"
|
||||
>
|
||||
<ActiveIcon className="size-3.5 shrink-0" strokeWidth={2} />
|
||||
<span className="min-w-0 flex-1 truncate text-left">
|
||||
{active.label}
|
||||
</span>
|
||||
<ChevronDown className="size-3.5 shrink-0 opacity-60" />
|
||||
</Button>
|
||||
</DropdownMenuTrigger>
|
||||
<DropdownMenuContent
|
||||
side={side}
|
||||
align={align}
|
||||
className="w-[300px]"
|
||||
avoidCollisions={true}
|
||||
>
|
||||
<DropdownMenuLabel>
|
||||
How should tool calls be approved?
|
||||
</DropdownMenuLabel>
|
||||
<PermissionModeMenuItems
|
||||
// Defer past the menu-close focus restoration so the dialog's
|
||||
// focus trap isn't broken by the dropdown grabbing focus back.
|
||||
onRequestFullAccess={() =>
|
||||
setTimeout(() => setConfirmOpen(true), 0)
|
||||
}
|
||||
/>
|
||||
</DropdownMenuContent>
|
||||
</DropdownMenu>
|
||||
<FullAccessConfirmDialog
|
||||
open={confirmOpen}
|
||||
onOpenChange={setConfirmOpen}
|
||||
/>
|
||||
</>
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Composer pill (mirrors the MCP pill) showing the current permission level
|
||||
* in the chat box; clicking opens the level dropdown. Danger-styled while
|
||||
* Full access is on. The Full access pick routes through the store-driven
|
||||
* BypassPermissionsConfirmDialog mounted at the chat-page root, so the
|
||||
* warning survives this menu unmounting.
|
||||
*/
|
||||
export function PermissionModeComposerPill({
|
||||
side = "bottom",
|
||||
}: {
|
||||
side?: "top" | "bottom";
|
||||
} = {}) {
|
||||
const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
|
||||
const setBypassConfirmOpen = useChatRuntimeStore(
|
||||
(s) => s.setBypassConfirmOpen,
|
||||
);
|
||||
const setPermissionMode = useChatRuntimeStore((s) => s.setPermissionMode);
|
||||
const active = permissionModeOption(permissionMode);
|
||||
const ActiveIcon = active.icon;
|
||||
const fullAccess = permissionMode === "full";
|
||||
|
||||
// Off means the feature is off: no pill (re-enable via the "+" menu or
|
||||
// settings, like the pre-levels bypass badge).
|
||||
if (permissionMode === "off") return null;
|
||||
|
||||
return (
|
||||
<DropdownMenu>
|
||||
<DropdownMenuTrigger asChild={true}>
|
||||
<button
|
||||
type="button"
|
||||
className="composer-pill-btn composer-pill-permissions"
|
||||
data-pill-label={active.label}
|
||||
data-active={fullAccess ? "true" : "false"}
|
||||
data-variant={fullAccess ? "danger" : undefined}
|
||||
aria-label="Permission level for tool calls"
|
||||
title={`${active.label}: ${active.description}`}
|
||||
>
|
||||
{/* The icon doubles as an off switch (mirrors the MCP pill): hover
|
||||
swaps it to an X; clicking it turns bypass permissions Off (no
|
||||
prompts, sandbox on) without opening the menu. In compact
|
||||
icon-only mode the glyph is the whole button, so clicks fall
|
||||
through and open the menu instead. */}
|
||||
<span
|
||||
role="button"
|
||||
aria-label="Turn off bypass permissions"
|
||||
tabIndex={-1}
|
||||
onPointerDown={(e) => {
|
||||
if (e.currentTarget.closest('[data-pill-compact="true"]')) {
|
||||
return;
|
||||
}
|
||||
e.stopPropagation();
|
||||
}}
|
||||
onClick={(e) => {
|
||||
if (e.currentTarget.closest('[data-pill-compact="true"]')) {
|
||||
return;
|
||||
}
|
||||
e.stopPropagation();
|
||||
setPermissionMode("off");
|
||||
}}
|
||||
className="composer-pill-glyph cursor-pointer"
|
||||
>
|
||||
<ActiveIcon className="size-[15px]" strokeWidth={2} />
|
||||
<XIcon className="composer-pill-x" />
|
||||
</span>
|
||||
<span>{active.label}</span>
|
||||
<HugeiconsIcon
|
||||
icon={ChevronDownStandardIcon}
|
||||
strokeWidth={1.5}
|
||||
className="composer-pill-caret size-[15px]"
|
||||
/>
|
||||
</button>
|
||||
</DropdownMenuTrigger>
|
||||
<DropdownMenuContent
|
||||
side={side}
|
||||
align="start"
|
||||
sideOffset={0}
|
||||
avoidCollisions={true}
|
||||
className="unsloth-plus-menu w-[300px]"
|
||||
>
|
||||
<DropdownMenuLabel>
|
||||
How should tool calls be approved?
|
||||
</DropdownMenuLabel>
|
||||
<PermissionModeMenuItems
|
||||
// Defer past the menu-close focus restoration (see PermissionModeDropdown).
|
||||
onRequestFullAccess={() =>
|
||||
setTimeout(() => setBypassConfirmOpen(true), 0)
|
||||
}
|
||||
/>
|
||||
</DropdownMenuContent>
|
||||
</DropdownMenu>
|
||||
);
|
||||
}
|
||||
|
|
@ -48,7 +48,6 @@ import {
|
|||
Image03Icon,
|
||||
McpServerIcon,
|
||||
PencilRulerIcon,
|
||||
ShieldBanIcon,
|
||||
} from "@hugeicons/core-free-icons";
|
||||
import { useNavigate } from "@tanstack/react-router";
|
||||
import { HugeiconsIcon } from "@hugeicons/react";
|
||||
|
|
@ -62,6 +61,7 @@ import {
|
|||
import { listPromptEntries, type PromptEntry } from "./api/prompts-api";
|
||||
import { McpComposerButton } from "./mcp-composer-button";
|
||||
import { BypassPermissionsMenuItem } from "./bypass-permissions-menu-item";
|
||||
import { PermissionModeComposerPill } from "./permission-mode-select";
|
||||
import { reasoningCapsFromLoad } from "./lib/apply-inference-status-to-store";
|
||||
import { KnowledgeBaseComposerButton } from "@/features/rag/components/knowledge-base-composer-button";
|
||||
import { NewProjectDialog } from "./components/new-project-dialog";
|
||||
|
|
@ -510,6 +510,7 @@ export function SharedComposer({
|
|||
);
|
||||
const artifactsEnabled = useChatRuntimeStore((s) => s.artifactsEnabled);
|
||||
const setArtifactsEnabled = useChatRuntimeStore((s) => s.setArtifactsEnabled);
|
||||
const permissionMode = useChatRuntimeStore((s) => s.permissionMode);
|
||||
const mcpEnabledForChat = useChatRuntimeStore((s) => s.mcpEnabledForChat);
|
||||
const setMcpEnabledForChat = useChatRuntimeStore(
|
||||
(s) => s.setMcpEnabledForChat,
|
||||
|
|
@ -529,10 +530,6 @@ export function SharedComposer({
|
|||
const setWebFetchToolsEnabled = useChatRuntimeStore(
|
||||
(s) => s.setWebFetchToolsEnabled,
|
||||
);
|
||||
const bypassPermissions = useChatRuntimeStore((s) => s.bypassPermissions);
|
||||
const setBypassPermissions = useChatRuntimeStore(
|
||||
(s) => s.setBypassPermissions,
|
||||
);
|
||||
const ragEnabled = useChatRuntimeStore((s) => s.ragEnabled);
|
||||
const setRagEnabled = useChatRuntimeStore((s) => s.setRagEnabled);
|
||||
const activeThreadId = useChatRuntimeStore((s) => s.activeThreadId);
|
||||
|
|
@ -685,9 +682,12 @@ export function SharedComposer({
|
|||
const ragDisabled = modelLoaded && (isExternalModel || !supportsTools);
|
||||
const showRagPill = !isExternalModel;
|
||||
// Above 4 pills, collapse to icons only to cut clutter. Compare, Search and
|
||||
// Code always show; the rest are conditional.
|
||||
// Code always show; the permission pill shows in every mode except "off"
|
||||
// (it renders null there); the rest are conditional.
|
||||
const permissionPillVisible = permissionMode !== "off";
|
||||
const pillsCompact =
|
||||
3 +
|
||||
(permissionPillVisible ? 1 : 0) +
|
||||
(showImagePill ? 1 : 0) +
|
||||
(showRagPill && ragEnabled && !ragDisabled ? 1 : 0) +
|
||||
(showWebFetchPill ? 1 : 0) +
|
||||
|
|
@ -1656,29 +1656,10 @@ export function SharedComposer({
|
|||
</PillGlyph>
|
||||
<span>Compare</span>
|
||||
</button>
|
||||
{/* Bypass sits immediately after Compare and ahead of every other
|
||||
tool pill (Search, Code, ...) so the active danger state reads
|
||||
first; only Compare outranks it. */}
|
||||
{bypassPermissions && (
|
||||
<button
|
||||
type="button"
|
||||
onClick={() => setBypassPermissions(false)}
|
||||
className="composer-pill-btn"
|
||||
data-active="true"
|
||||
data-variant="danger"
|
||||
aria-label="Disable Bypass permissions"
|
||||
title="Bypass permissions is on (no confirmation, no sandbox). Click to turn off."
|
||||
>
|
||||
<PillGlyph>
|
||||
<HugeiconsIcon
|
||||
icon={ShieldBanIcon}
|
||||
strokeWidth={2}
|
||||
className="size-[15px]"
|
||||
/>
|
||||
</PillGlyph>
|
||||
<span>Bypass permissions</span>
|
||||
</button>
|
||||
)}
|
||||
{/* Permission-level pill sits immediately after Compare and ahead
|
||||
of every other tool pill (Search, Code, ...) so the Full access
|
||||
danger state reads first; only Compare outranks it. */}
|
||||
<PermissionModeComposerPill side="top" />
|
||||
<button
|
||||
type="button"
|
||||
disabled={searchDisabled}
|
||||
|
|
|
|||
|
|
@ -45,6 +45,19 @@ export const CHAT_SHOW_ALL_QUANTIZATIONS_KEY =
|
|||
export const MODELS_FIT_ON_DEVICE_ONLY_KEY =
|
||||
"unsloth_models_fit_on_device_only";
|
||||
export const CHAT_BYPASS_PERMISSIONS_KEY = "unsloth_chat_bypass_permissions";
|
||||
export const CHAT_PERMISSION_MODE_KEY = "unsloth_chat_permission_mode";
|
||||
|
||||
/**
|
||||
* Permission level for local tool calls:
|
||||
* - "ask": always ask before every tool call runs.
|
||||
* - "auto" ("Approve for me"): only ask for calls the backend detects as
|
||||
* potentially unsafe; read-only calls run immediately. Sandbox stays on.
|
||||
* - "off": never ask; tool calls run automatically inside the sandbox
|
||||
* (the original default before permission levels existed).
|
||||
* - "full" ("Full access"): no confirmations and the python/terminal sandbox
|
||||
* is disabled. Session-only; never restored from storage.
|
||||
*/
|
||||
export type PermissionMode = "ask" | "auto" | "off" | "full";
|
||||
export const CHAT_WEB_FETCH_TOOLS_ENABLED_KEY =
|
||||
"unsloth_chat_web_fetch_tools_enabled";
|
||||
export const CHAT_RAG_SOURCE_KEY = "unsloth_chat_rag_source";
|
||||
|
|
@ -319,8 +332,10 @@ export function loadOptionalBool(key: string): boolean | null {
|
|||
/**
|
||||
* Resolve the web-search / code-execution pill state to apply when a model
|
||||
* loads. Honors the user's persisted preference so a tool-capable model never
|
||||
* re-enables a pill the user turned off; falls back to the model's capability
|
||||
* only when no preference has been expressed.
|
||||
* re-enables a pill the user turned off, and never re-disables one they turned
|
||||
* on. When no preference has been expressed the pills stay off: tool execution
|
||||
* is opt-in, so the person enables it with a click rather than a tool-capable
|
||||
* model turning it on for them.
|
||||
*/
|
||||
export function resolveToolsEnabledOnLoad(supportsTools: boolean): {
|
||||
toolsEnabled: boolean;
|
||||
|
|
@ -328,8 +343,8 @@ export function resolveToolsEnabledOnLoad(supportsTools: boolean): {
|
|||
} {
|
||||
if (!supportsTools) return { toolsEnabled: false, codeToolsEnabled: false };
|
||||
return {
|
||||
toolsEnabled: loadOptionalBool(CHAT_TOOLS_ENABLED_KEY) ?? true,
|
||||
codeToolsEnabled: loadOptionalBool(CHAT_CODE_TOOLS_ENABLED_KEY) ?? true,
|
||||
toolsEnabled: loadOptionalBool(CHAT_TOOLS_ENABLED_KEY) ?? false,
|
||||
codeToolsEnabled: loadOptionalBool(CHAT_CODE_TOOLS_ENABLED_KEY) ?? false,
|
||||
};
|
||||
}
|
||||
|
||||
|
|
@ -342,6 +357,37 @@ function saveBool(key: string, value: boolean): void {
|
|||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* "full" is intentionally not restorable: it disables the sandbox and every
|
||||
* confirmation gate, so it must be re-enabled (through the warning dialog)
|
||||
* each session. First run falls back to the legacy "Confirm tool calls"
|
||||
* toggle so existing users keep their behavior (on -> ask, explicitly
|
||||
* off -> "off", i.e. no prompts); fresh installs default to "auto".
|
||||
*/
|
||||
function loadPermissionMode(): PermissionMode {
|
||||
if (!canUseStorage()) return "auto";
|
||||
try {
|
||||
const raw = localStorage.getItem(CHAT_PERMISSION_MODE_KEY);
|
||||
if (raw === "ask" || raw === "auto" || raw === "off") return raw;
|
||||
} catch {
|
||||
// ignore
|
||||
}
|
||||
const legacyConfirm = loadOptionalBool(CHAT_CONFIRM_TOOL_CALLS_KEY);
|
||||
if (legacyConfirm === null) return "auto";
|
||||
return legacyConfirm ? "ask" : "off";
|
||||
}
|
||||
|
||||
function savePermissionMode(mode: PermissionMode): void {
|
||||
if (!canUseStorage() || mode === "full") return;
|
||||
try {
|
||||
localStorage.setItem(CHAT_PERMISSION_MODE_KEY, mode);
|
||||
} catch {
|
||||
// ignore
|
||||
}
|
||||
}
|
||||
|
||||
const INITIAL_PERMISSION_MODE: PermissionMode = loadPermissionMode();
|
||||
|
||||
function loadString(key: string, fallback: string): string {
|
||||
if (!canUseStorage()) return fallback;
|
||||
try {
|
||||
|
|
@ -514,7 +560,11 @@ export function isPendingGguf(pending: PendingModelSelection | null): boolean {
|
|||
* wrong file. */
|
||||
export function pendingSelectionMatches(
|
||||
pending: PendingModelSelection | null,
|
||||
pick: { id: string; ggufVariant?: string | null; nativePathToken?: string | null },
|
||||
pick: {
|
||||
id: string;
|
||||
ggufVariant?: string | null;
|
||||
nativePathToken?: string | null;
|
||||
},
|
||||
): boolean {
|
||||
return (
|
||||
pending != null &&
|
||||
|
|
@ -615,8 +665,15 @@ type ChatRuntimeStore = {
|
|||
* Bypass Permissions: when on, tool calls run with no confirmation gate
|
||||
* AND the python/terminal execution sandbox is disabled on the backend
|
||||
* (secrets are still stripped). Takes precedence over confirmToolCalls.
|
||||
* Kept in sync with permissionMode ("full" <=> true).
|
||||
*/
|
||||
bypassPermissions: boolean;
|
||||
/**
|
||||
* Permission level. Single source of truth for the bypass dropdowns;
|
||||
* bypassPermissions and confirmToolCalls mirror it so legacy call sites
|
||||
* keep working. "full" is session-only (never persisted).
|
||||
*/
|
||||
permissionMode: PermissionMode;
|
||||
/** Whether the "Enable Bypass Permissions?" warning dialog is open. Lifted out
|
||||
* of the composer menu so confirming/cancelling it doesn't leave the menu frozen. */
|
||||
bypassConfirmOpen: boolean;
|
||||
|
|
@ -759,6 +816,7 @@ type ChatRuntimeStore = {
|
|||
setMcpEnabledForChat: (enabled: boolean) => void;
|
||||
setConfirmToolCalls: (enabled: boolean) => void;
|
||||
setBypassPermissions: (enabled: boolean) => void;
|
||||
setPermissionMode: (mode: PermissionMode) => void;
|
||||
setBypassConfirmOpen: (open: boolean) => void;
|
||||
allowToolAlways: (sessionId: string, toolName: string) => void;
|
||||
setToolConfirmation: (
|
||||
|
|
@ -1081,11 +1139,15 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
|
|||
false,
|
||||
),
|
||||
mcpEnabledForChat: loadBool(CHAT_MCP_ENABLED_KEY, false),
|
||||
confirmToolCalls: loadBool(CHAT_CONFIRM_TOOL_CALLS_KEY, false),
|
||||
// Mirrors permissionMode (gate requested for ask/auto) so both controls
|
||||
// agree on load.
|
||||
confirmToolCalls:
|
||||
INITIAL_PERMISSION_MODE === "ask" || INITIAL_PERMISSION_MODE === "auto",
|
||||
// Never restore Bypass Permissions from storage: it disables the sandbox and
|
||||
// the confirmation gate, so it must be re-enabled (through the warning
|
||||
// dialog) each session rather than silently reactivating on reload.
|
||||
bypassPermissions: false,
|
||||
permissionMode: INITIAL_PERMISSION_MODE,
|
||||
bypassConfirmOpen: false,
|
||||
alwaysAllowToolsBySession: new Map<string, Set<string>>(),
|
||||
toolConfirmations: {},
|
||||
|
|
@ -1453,14 +1515,53 @@ export const useChatRuntimeStore = create<ChatRuntimeStore>((set, get) => ({
|
|||
return { mcpEnabledForChat };
|
||||
}),
|
||||
setConfirmToolCalls: (confirmToolCalls) =>
|
||||
set(() => {
|
||||
set((state) => {
|
||||
saveBool(CHAT_CONFIRM_TOOL_CALLS_KEY, confirmToolCalls);
|
||||
return { confirmToolCalls };
|
||||
// The legacy toggle is a view over the permission level: on -> "ask",
|
||||
// off -> "off" (no prompts). While "full" is active the level is left
|
||||
// alone (the toggle is disabled in the UI anyway).
|
||||
if (state.permissionMode === "full") return { confirmToolCalls };
|
||||
const permissionMode: PermissionMode = confirmToolCalls ? "ask" : "off";
|
||||
savePermissionMode(permissionMode);
|
||||
return { confirmToolCalls, permissionMode };
|
||||
}),
|
||||
setPermissionMode: (permissionMode) =>
|
||||
set(() => {
|
||||
// "full" is session-only (never persisted, see init); ask/auto/off
|
||||
// persist and keep the legacy confirm toggle in sync (the gate is
|
||||
// requested for both ask and auto).
|
||||
savePermissionMode(permissionMode);
|
||||
if (permissionMode === "full") {
|
||||
// Full access sends confirm_tool_calls=false; keep the store flag in
|
||||
// sync so response metadata does not report confirmations as enabled.
|
||||
return { permissionMode, bypassPermissions: true, confirmToolCalls: false };
|
||||
}
|
||||
const confirmToolCalls =
|
||||
permissionMode === "ask" || permissionMode === "auto";
|
||||
saveBool(CHAT_CONFIRM_TOOL_CALLS_KEY, confirmToolCalls);
|
||||
return { permissionMode, bypassPermissions: false, confirmToolCalls };
|
||||
}),
|
||||
setBypassPermissions: (bypassPermissions) =>
|
||||
// Deliberately not persisted (see init): a reload must not silently keep
|
||||
// the sandbox/confirmation bypass active without re-accepting the warning.
|
||||
set(() => ({ bypassPermissions })),
|
||||
// Turning bypass off returns to the last persisted ask/auto level.
|
||||
set(() => {
|
||||
if (bypassPermissions) {
|
||||
// Full access never prompts; mirror confirm_tool_calls=false in the
|
||||
// store so metadata does not report confirmations as enabled.
|
||||
return {
|
||||
bypassPermissions,
|
||||
permissionMode: "full" as PermissionMode,
|
||||
confirmToolCalls: false,
|
||||
};
|
||||
}
|
||||
const permissionMode = loadPermissionMode();
|
||||
return {
|
||||
bypassPermissions,
|
||||
permissionMode,
|
||||
confirmToolCalls: permissionMode === "ask" || permissionMode === "auto",
|
||||
};
|
||||
}),
|
||||
setBypassConfirmOpen: (bypassConfirmOpen) =>
|
||||
set(() => ({ bypassConfirmOpen })),
|
||||
allowToolAlways: (sessionId, toolName) =>
|
||||
|
|
|
|||
|
|
@ -349,6 +349,15 @@ export interface OpenAIChatCompletionsRequest {
|
|||
mcp_enabled?: boolean;
|
||||
/** Local models + enable_tools only. */
|
||||
confirm_tool_calls?: boolean;
|
||||
/**
|
||||
* Local models + enable_tools only. Gate level for local tool calls: "ask"
|
||||
* prompts on every call, "auto" prompts only on calls flagged unsafe, "off"
|
||||
* never prompts, "full" never prompts and drops the sandbox. Unset behaves
|
||||
* as "ask".
|
||||
*/
|
||||
permission_mode?: "ask" | "auto" | "off" | "full";
|
||||
/** Local models + enable_tools only. Full-access escape hatch. */
|
||||
bypass_permissions?: boolean;
|
||||
/** `kb_id` is exclusive; otherwise project and thread scopes may combine. */
|
||||
rag_scope?: {
|
||||
kb_id?: string;
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ import { Input } from "@/components/ui/input";
|
|||
import { Switch } from "@/components/ui/switch";
|
||||
import { usePlatformStore } from "@/config/env";
|
||||
import { resetOnboardingDone } from "@/features/auth";
|
||||
import { useChatRuntimeStore } from "@/features/chat";
|
||||
import { PermissionModeDropdown, useChatRuntimeStore } from "@/features/chat";
|
||||
import { openModelsDir } from "@/features/native-intents";
|
||||
import { emitTrainingRunsChanged } from "@/features/training";
|
||||
import {
|
||||
|
|
@ -80,6 +80,10 @@ const PREFS_KEYS: string[] = [
|
|||
"unsloth_settings_active_tab",
|
||||
// Chat runtime prefs
|
||||
"unsloth_chat_auto_title",
|
||||
"unsloth_chat_permission_mode",
|
||||
// Legacy confirm key: loadPermissionMode falls back to it, so clear both or
|
||||
// a reset would restore the old level instead of the fresh default.
|
||||
"unsloth_chat_confirm_tool_calls",
|
||||
"unsloth_hf_token",
|
||||
"unsloth_auto_heal_tool_calls",
|
||||
"unsloth_nudge_tool_calls",
|
||||
|
|
@ -583,6 +587,15 @@ export function GeneralTab() {
|
|||
</SettingsRow>
|
||||
</SettingsSection>
|
||||
|
||||
<SettingsSection title={t("settings.general.permissions.sectionTitle")}>
|
||||
<SettingsRow
|
||||
label={t("settings.general.permissions.bypassLabel")}
|
||||
description={t("settings.general.permissions.bypassDescription")}
|
||||
>
|
||||
<PermissionModeDropdown />
|
||||
</SettingsRow>
|
||||
</SettingsSection>
|
||||
|
||||
<SettingsSection title={t("settings.general.notifications.sectionTitle")}>
|
||||
<SettingsRow
|
||||
label={t("settings.general.notifications.showLlamaUpdates")}
|
||||
|
|
|
|||
|
|
@ -181,6 +181,12 @@ export const en = {
|
|||
revoked: "All preview links revoked",
|
||||
revokeError: "Couldn't revoke preview links",
|
||||
},
|
||||
permissions: {
|
||||
sectionTitle: "Permissions",
|
||||
bypassLabel: "Bypass permissions",
|
||||
bypassDescription:
|
||||
"How Unsloth approves chat tool calls (terminal, python, web, MCP) before they run. Full access disables approvals and the code sandbox.",
|
||||
},
|
||||
notifications: {
|
||||
sectionTitle: "Notifications",
|
||||
showLlamaUpdates: "llama.cpp update notifications",
|
||||
|
|
|
|||
|
|
@ -1483,6 +1483,15 @@ html[data-chat-font] .aui-root {
|
|||
.composer-pill-btn[data-active="true"] {
|
||||
color: var(--primary);
|
||||
}
|
||||
/* Permission-level pill: higher-contrast grey than the resting pills so
|
||||
the active level stays legible (darker in light mode, lighter in dark).
|
||||
Full access keeps the danger yellow below. */
|
||||
.composer-pill-btn.composer-pill-permissions:not([data-variant="danger"]) {
|
||||
color: color-mix(in oklab, var(--foreground) 60%, transparent);
|
||||
}
|
||||
.dark .composer-pill-btn.composer-pill-permissions:not([data-variant="danger"]) {
|
||||
color: color-mix(in oklab, var(--foreground) 72%, transparent);
|
||||
}
|
||||
/* Bypass permissions badge: bright yellow text, no resting fill; the
|
||||
rounded hover pill picks up the yellow accent like other toggles. */
|
||||
.composer-pill-btn[data-variant="danger"] {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue