Adds an opt-in request field, confirm_code_execution, that routes local
code-execution tool calls (python, terminal) through the existing
confirmation gate while other tools (web_search, render_html, MCP, ...)
continue to run without a prompt.
This lets a caller require approval for code execution specifically,
without the friction of confirm_tool_calls prompting on every tool. It is
independent of confirm_tool_calls, defaults off (no change to existing
behavior), requires stream=true when a code-execution tool is enabled
(same as confirm_tool_calls), and bypass_permissions still takes
precedence.
The tool-call parser and tool detection are unchanged, so no tool-calling
behavior is affected when the flag is off.
- models: new confirm_code_execution field on ChatCompletionRequest
- tools: CODE_EXECUTION_TOOL_NAMES = {python, terminal}
- safetensors and gguf loops: needs_confirm also fires for code-execution
tools when confirm_code_execution is set (bypass still wins)
- routes: thread the flag to both local loops; require streaming when a
code-execution tool is enabled
- tests: loop-level gate behavior, the scoping predicate, and the route
streaming requirement for both backends
3f883a3e5f