Studio: clarify tool permission controls #7181
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| #!/usr/bin/env bash | ||
| # SPDX-License-Identifier: AGPL-3.0-only | ||
| # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| port="${1:?usage: $0 PORT BROWSER [CHANNEL]}" | ||
| browser="${2:?usage: $0 PORT BROWSER [CHANNEL]}" | ||
| channel="${3:-}" | ||
| slug="$browser${channel:+-$channel}" | ||
| artifact_dir="logs/playwright-permissions-$slug" | ||
| server_log="logs/studio-permissions-$slug.log" | ||
| studio_home="${UNSLOTH_STUDIO_HOME:-$HOME/.unsloth/studio}" | ||
| frontend_args=() | ||
| if [ -n "${STUDIO_PERMISSION_FRONTEND:-}" ]; then | ||
| frontend_args=(-f "$STUDIO_PERMISSION_FRONTEND") | ||
| fi | ||
|
|
||
| mkdir -p "$artifact_dir" | ||
| unsloth studio reset-password | ||
| UNSLOTH_API_ONLY=1 unsloth studio -H 127.0.0.1 -p "$port" "${frontend_args[@]}" \ | ||
| >"$server_log" 2>&1 & | ||
| studio_pid=$! | ||
|
|
||
| cleanup() { | ||
| kill "$studio_pid" 2>/dev/null || true | ||
| wait "$studio_pid" 2>/dev/null || true | ||
| } | ||
| trap cleanup EXIT | ||
|
|
||
| healthy=0 | ||
| for _ in $(seq 1 180); do | ||
| if curl -fs "http://127.0.0.1:$port/api/health" >/dev/null; then | ||
| healthy=1 | ||
| break | ||
| fi | ||
| if ! kill -0 "$studio_pid" 2>/dev/null; then | ||
| tail -100 "$server_log" || true | ||
| exit 1 | ||
| fi | ||
| sleep 1 | ||
| done | ||
| if [ "$healthy" -ne 1 ]; then | ||
| tail -100 "$server_log" || true | ||
| exit 1 | ||
| fi | ||
|
|
||
| old_password=$(cat "$studio_home/auth/.bootstrap_password") | ||
| new_password="CIPerm-$(python -c 'import secrets; print(secrets.token_urlsafe(16))')" | ||
| if [ "${GITHUB_ACTIONS:-}" = "true" ]; then | ||
| echo "::add-mask::$old_password" | ||
| echo "::add-mask::$new_password" | ||
| fi | ||
|
|
||
| export BASE_URL="http://127.0.0.1:$port" | ||
| export STUDIO_OLD_PW="$old_password" | ||
| export STUDIO_NEW_PW="$new_password" | ||
| export STUDIO_UI_STRICT=1 | ||
| export STUDIO_UI_PERMISSION_ONLY=1 | ||
| export STUDIO_UI_WALL_TIMEOUT_S=240 | ||
| export STUDIO_PLAYWRIGHT_BROWSER="$browser" | ||
| export PW_ART_DIR="$artifact_dir" | ||
| if [ -n "$channel" ]; then | ||
| export STUDIO_PLAYWRIGHT_CHANNEL="$channel" | ||
| else | ||
| unset STUDIO_PLAYWRIGHT_CHANNEL || true | ||
| fi | ||
|
|
||
| python tests/studio/playwright_chat_ui.py |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,16 +20,12 @@ import { | |
| DropdownMenuSubTrigger, | ||
| } from "@/components/ui/dropdown-menu"; | ||
| import { useChatRuntimeStore } from "@/features/chat/stores/chat-runtime-store"; | ||
| import { | ||
| FULL_ACCESS_WARNING, | ||
| PermissionModeMenuItems, | ||
| } from "./permission-mode-select"; | ||
|
|
||
| // Tool permissions entry for the composer "+" menu. | ||
| export function BypassPermissionsMenuItem() { | ||
| const permissionMode = useChatRuntimeStore((s) => s.permissionMode); | ||
| const setBypassConfirmOpen = useChatRuntimeStore( | ||
|
|
@@ -44,7 +40,7 @@ export function BypassPermissionsMenuItem() { | |
| } | ||
| > | ||
| <HugeiconsIcon icon={ShieldBanIcon} strokeWidth={2} /> | ||
| Tool permissions | ||
| </DropdownMenuSubTrigger> | ||
| <DropdownMenuSubContent className="unsloth-plus-menu w-[300px]"> | ||
| <PermissionModeMenuItems | ||
|
|
@@ -75,9 +71,7 @@ export function BypassPermissionsConfirmDialog() { | |
| <AlertDialogHeader> | ||
| <AlertDialogTitle>Enable Full access?</AlertDialogTitle> | ||
| <AlertDialogDescription> | ||
| {FULL_ACCESS_WARNING} | ||
| </AlertDialogDescription> | ||
| </AlertDialogHeader> | ||
| <AlertDialogFooter> | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2041,13 +2041,14 @@ function ConfirmToolCallsToggle() { | |
| <InfoHint> | ||
| When on, every local Unsloth tool call pauses for your approval | ||
| before it runs (the "Ask for approval" level). When off, tool calls | ||
| run without prompts inside the sandbox (the "Run automatically" | ||
| level). | ||
| Provider-hosted tools are not gated here. | ||
| </InfoHint> | ||
| </div> | ||
| {permissionMode === "full" ? ( | ||
| <span className="text-[11px] text-muted-foreground"> | ||
| Overridden by Full access | ||
| </span> | ||
| ) : null} | ||
| </div> | ||
|
|
@@ -2068,11 +2069,11 @@ function BypassPermissionsToggle() { | |
| <div className="flex flex-col gap-2"> | ||
| <div className="flex min-w-0 items-center gap-1.5"> | ||
| <span className="whitespace-nowrap text-[13px] font-medium leading-[1.25] tracking-nav text-nav-fg"> | ||
| Tool permissions | ||
| </span> | ||
| <InfoHint> | ||
| Choose how Unsloth approves tool calls before they run. Full access | ||
| disables confirmations and the code sandbox. | ||
| </InfoHint> | ||
| </div> | ||
| {/* Full width, styled like the panel selects/preset input. */} | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -7,7 +7,6 @@ import { | |
| CircleOff, | ||
| Hand, | ||
| ShieldCheck, | ||
| } from "lucide-react"; | ||
| import { useState } from "react"; | ||
|
|
||
|
|
@@ -39,9 +38,8 @@ import { | |
| } from "./stores/chat-runtime-store"; | ||
|
|
||
| /** | ||
| * Permission levels for tool calls. Full access stays last because it disables | ||
| * both approval prompts and the code sandbox. | ||
| */ | ||
| export const PERMISSION_MODE_OPTIONS: readonly { | ||
| value: PermissionMode; | ||
|
|
@@ -61,21 +59,24 @@ export const PERMISSION_MODE_OPTIONS: readonly { | |
| description: "Only ask for actions detected as potentially unsafe", | ||
| icon: ShieldCheck, | ||
| }, | ||
| { | ||
| value: "off", | ||
| label: "Run automatically", | ||
| description: "Run tool calls without approval prompts inside the sandbox", | ||
| icon: CircleOff, | ||
| }, | ||
| { | ||
| value: "full", | ||
| label: "Full access", | ||
| description: | ||
| "Unrestricted: no approval prompts and the code sandbox is disabled", | ||
| icon: CircleAlert, | ||
| }, | ||
| ] as const; | ||
|
|
||
| export const FULL_ACCESS_WARNING = | ||
| "Full access lets tool calls run without approval prompts or the code sandbox. They can modify or delete files, run commands, and make network requests. Enable it only when you trust the current task."; | ||
|
|
||
| export function permissionModeOption(mode: PermissionMode) { | ||
| return ( | ||
| PERMISSION_MODE_OPTIONS.find((option) => option.value === mode) ?? | ||
|
|
@@ -100,10 +101,10 @@ export function PermissionModeMenuItems({ | |
| <DropdownMenuItem | ||
| key={option.value} | ||
| onSelect={() => { | ||
| if (option.value === permissionMode) { | ||
| return; | ||
| } | ||
| if (option.value === "full") { | ||
| onRequestFullAccess(); | ||
| } else { | ||
| setPermissionMode(option.value); | ||
|
|
@@ -154,9 +155,7 @@ export function FullAccessConfirmDialog({ | |
| <AlertDialogHeader> | ||
| <AlertDialogTitle>Enable Full access?</AlertDialogTitle> | ||
| <AlertDialogDescription> | ||
| {FULL_ACCESS_WARNING} | ||
| </AlertDialogDescription> | ||
| </AlertDialogHeader> | ||
| <AlertDialogFooter> | ||
|
|
@@ -260,15 +259,10 @@ export function PermissionModeComposerPill({ | |
| const setBypassConfirmOpen = useChatRuntimeStore( | ||
| (s) => s.setBypassConfirmOpen, | ||
| ); | ||
| const active = permissionModeOption(permissionMode); | ||
| const ActiveIcon = active.icon; | ||
| const fullAccess = permissionMode === "full"; | ||
|
|
||
| return ( | ||
| <DropdownMenu> | ||
| <DropdownMenuTrigger asChild={true}> | ||
|
|
@@ -281,32 +275,8 @@ export function PermissionModeComposerPill({ | |
| aria-label="Permission level for tool calls" | ||
| title={`${active.label}: ${active.description}`} | ||
| > | ||
| <span className="composer-pill-glyph"> | ||
| <ActiveIcon className="size-[15px]" strokeWidth={2} /> | ||
| </span> | ||
| <span>{active.label}</span> | ||
| <HugeiconsIcon | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
In this macos-14 job, the install step pins Playwright to
>=1.55,<1.58, but this new run launches the runner's branded Chrome viachannel='chrome'. Playwright 1.57's release notes list Google Chrome 139 as the tested stable channel, while the current GitHub macos-14 runner image lists Chrome 149, so this check can fail or become flaky from a browser/protocol mismatch; use the bundled Chromium here or update/unpin Playwright before adding a Chrome-channel run.Useful? React with 👍 / 👎.