13c012a7b3
The Anthropic /v1/messages server-tool path maps a Studio tool alias such as
{"type":"python"} to the local tool loop and runs python/terminal on the
host. That path does not wire the confirmation prompt into its SSE translation
(which is why confirm_tool_calls is already rejected there), so treating
confirm_code_execution as ignored let local code run without the prompt the
flag promises.
Reject confirm_code_execution on this path when a local code-execution tool is
actually selected, mirroring the confirm_tool_calls rejection. The check sits
inside the server-tool branch and is gated on the resolved tool list, so a
non-code request (e.g. web_search) is unaffected and a disabled request
(enable_tools=false / --disable-tools) never reaches it. bypass_permissions
still suppresses the gate.
Update the field docs and split the Anthropic test into a code-tool rejection
case and a non-code ignored case.
|
||
|---|---|---|
| .. | ||
| .gitkeep | ||
| __init__.py | ||
| auth.py | ||
| data_recipe.py | ||
| datasets.py | ||
| export.py | ||
| inference.py | ||
| mcp_servers.py | ||
| models.py | ||
| providers.py | ||
| responses.py | ||
| training.py | ||
| users.py | ||