Studio: add Bypass Permissions (skip confirmation, disable tool sandbox)

Adds an opt-in Bypass Permissions toggle next to Confirm tool calls. When on,
no tool call shows a confirmation prompt and the python/terminal sandbox is
disabled: safety checks, command blocklist, and resource limits are skipped.
Secret env vars are still stripped and HOME stays repointed at the session
workdir. Default off keeps current behavior, and it takes precedence over
Confirm tool calls. Enabling it requires accepting a warning each time.

Author: danielhanchen

studio/backend/core/inference/llama_cpp.py

@@ -4453,6 +4453,7 @@ def generate_chat_completion_with_tools(
         tool_call_timeout: int = 300,
         session_id: Optional[str] = None,
         confirm_tool_calls: bool = False,
+        bypass_permissions: bool = False,
     ) -> Generator[dict, None, None]:
         """
         Agentic loop: let the model call tools, execute them, and continue.
@@ -5159,6 +5160,7 @@ def _strip_tool_markup(text: str, *, final: bool = False) -> str:
                                 cancel_event = cancel_event,
                                 timeout = _effective_timeout,
                                 session_id = session_id,
+                                disable_sandbox = bypass_permissions,
                             )
 
                     yield {

studio/backend/core/inference/orchestrator.py

@@ -840,6 +840,7 @@ def generate_chat_completion_with_tools(
         session_id: Optional[str] = None,
         use_adapter: Optional[Union[bool, str]] = None,
         confirm_tool_calls: bool = False,
+        bypass_permissions: bool = False,
         **_unused,
     ):
         """Run the safetensors agentic tool loop in this (parent)
@@ -897,6 +898,7 @@ def _single_turn(conv: list):
             tool_call_timeout = tool_call_timeout,
             session_id = session_id,
             confirm_tool_calls = confirm_tool_calls,
+            bypass_permissions = bypass_permissions,
         )
 
     def generate_with_adapter_control(

studio/backend/core/inference/safetensors_agentic.py

@@ -113,6 +113,7 @@ def run_safetensors_tool_loop(
     tool_call_timeout: int = 300,
     session_id: Optional[str] = None,
     confirm_tool_calls: bool = False,
+    bypass_permissions: bool = False,
 ) -> Generator[dict, None, None]:
     """Drive an agentic tool loop on top of a cumulative-text generator.
 
@@ -376,6 +377,7 @@ def run_safetensors_tool_loop(
                             cancel_event = cancel_event,
                             timeout = eff_timeout,
                             session_id = session_id,
+                            disable_sandbox = bypass_permissions,
                         )
                     except Exception as exc:
                         logger.exception("Tool %s raised: %s", tool_name, exc)

studio/backend/core/inference/tools.py

@@ -329,6 +329,65 @@ def _build_safe_env(workdir: str) -> dict[str, str]:
     return env
 
 
+# Credential env vars dropped even in bypass mode so tool code cannot read the
+# operator's keys. Over-strips on purpose (a benign var is harmless to lose).
+_BYPASS_ENV_SECRET_NAMES = frozenset(
+    {
+        "HF_TOKEN",
+        "HF_HUB_TOKEN",
+        "HUGGING_FACE_HUB_TOKEN",
+        "HUGGINGFACE_TOKEN",
+        "HUGGINGFACEHUB_API_TOKEN",
+        "WANDB_API_KEY",
+        "GH_TOKEN",
+        "GITHUB_TOKEN",
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "GROQ_API_KEY",
+        "OPENROUTER_API_KEY",
+        "REPLICATE_API_TOKEN",
+        "COHERE_API_KEY",
+        "MISTRAL_API_KEY",
+        "NGC_API_KEY",
+        "KAGGLE_KEY",
+        "LD_PRELOAD",
+    }
+)
+_BYPASS_ENV_SECRET_PREFIXES = ("AWS_", "AZURE_", "GOOGLE_", "GCP_", "GCLOUD_", "DYLD_")
+_BYPASS_ENV_SECRET_MARKERS = (
+    "TOKEN",
+    "API_KEY",
+    "APIKEY",
+    "SECRET",
+    "PASSWORD",
+    "PASSWD",
+    "CREDENTIAL",
+    "PRIVATE_KEY",
+)
+
+
+def _is_secret_env_name(name: str) -> bool:
+    """True if an env var name looks like it carries a credential."""
+    upper = name.upper()
+    if upper in _BYPASS_ENV_SECRET_NAMES:
+        return True
+    if any(upper.startswith(p) for p in _BYPASS_ENV_SECRET_PREFIXES):
+        return True
+    return any(marker in upper for marker in _BYPASS_ENV_SECRET_MARKERS)
+
+
+def _build_bypass_env(workdir: str) -> dict[str, str]:
+    """Env for bypass exec: full host env (unrestricted) minus credential vars,
+    with HOME/TMPDIR repointed at the workdir so SDKs cannot read cached creds.
+    """
+    env = {k: v for k, v in os.environ.items() if not _is_secret_env_name(k)}
+    env["HOME"] = workdir
+    env["TMPDIR"] = workdir
+    return env
+
+
 def _sandbox_preexec():
     """Best-effort sandbox setup for sandboxed subprocesses.
 
@@ -403,6 +462,18 @@ def _sandbox_preexec():
             pass
 
 
+def _bypass_preexec():
+    """Minimal pre-exec for bypass exec: os.setsid() only.
+
+    Required, not a restriction: _kill_process_tree does killpg(getpgid(child)),
+    so without a new session a timeout/cancel would kill the Studio server too.
+    """
+    try:
+        os.setsid()
+    except OSError:
+        pass
+
+
 def _get_shell_cmd(command: str) -> list[str]:
     """Return the platform-appropriate shell invocation for a command string."""
     if sys.platform == "win32":
@@ -609,12 +680,16 @@ def execute_tool(
     cancel_event = None,
     timeout: int | None = _TIMEOUT_UNSET,
     session_id: str | None = None,
+    disable_sandbox: bool = False,
 ) -> str:
     """Execute a tool by name with the given arguments. Returns result as a string.
 
     ``timeout``: int sets per-call limit in seconds, ``None`` means no limit,
     unset (default) uses ``_EXEC_TIMEOUT`` (300 s).
     ``session_id``: optional thread/session ID for per-conversation sandbox isolation.
+    ``disable_sandbox``: Bypass Permissions; run python/terminal without the
+    safety checks, blocklist, or resource caps (secrets still stripped). Only
+    affects local code tools; web_search / MCP are unchanged.
     """
     logger.info(
         f"execute_tool: name={name}, session_id={session_id}, timeout={timeout}"
@@ -647,11 +722,19 @@ def execute_tool(
         )
     if name == "python":
         return _python_exec(
-            arguments.get("code", ""), cancel_event, effective_timeout, session_id
+            arguments.get("code", ""),
+            cancel_event,
+            effective_timeout,
+            session_id,
+            disable_sandbox = disable_sandbox,
         )
     if name == "terminal":
         return _bash_exec(
-            arguments.get("command", ""), cancel_event, effective_timeout, session_id
+            arguments.get("command", ""),
+            cancel_event,
+            effective_timeout,
+            session_id,
+            disable_sandbox = disable_sandbox,
         )
     return f"Unknown tool: {name}"
 
@@ -1987,15 +2070,21 @@ def _python_exec(
     cancel_event = None,
     timeout: int = _EXEC_TIMEOUT,
     session_id: str | None = None,
+    disable_sandbox: bool = False,
 ) -> str:
-    """Execute Python code in a subprocess sandbox."""
+    """Execute Python code in a subprocess sandbox.
+
+    disable_sandbox (Bypass Permissions): skip the safety analysis and rlimit
+    pre-exec, and use the host env minus secrets.
+    """
     if not code or not code.strip():
         return "No code provided."
 
-    # Validate imports and code safety
-    error = _check_code_safety(code)
-    if error:
-        return error
+    # Validate imports and code safety (skipped when the sandbox is disabled)
+    if not disable_sandbox:
+        error = _check_code_safety(code)
+        if error:
+            return error
 
     tmp_path = None
     workdir = _get_workdir(session_id)
@@ -2017,7 +2106,9 @@ def _python_exec(
         with os.fdopen(fd, "w") as f:
             f.write(code)
 
-        safe_env = _build_safe_env(workdir)
+        safe_env = (
+            _build_bypass_env(workdir) if disable_sandbox else _build_safe_env(workdir)
+        )
         popen_kwargs = dict(
             stdout = subprocess.PIPE,
             stderr = subprocess.STDOUT,
@@ -2026,7 +2117,9 @@ def _python_exec(
             env = safe_env,
         )
         if sys.platform != "win32":
-            popen_kwargs["preexec_fn"] = _sandbox_preexec
+            popen_kwargs["preexec_fn"] = (
+                _bypass_preexec if disable_sandbox else _sandbox_preexec
+            )
         else:
             popen_kwargs["creationflags"] = subprocess.CREATE_NO_WINDOW
 
@@ -2094,19 +2187,27 @@ def _bash_exec(
     cancel_event = None,
     timeout: int = _EXEC_TIMEOUT,
     session_id: str | None = None,
+    disable_sandbox: bool = False,
 ) -> str:
-    """Execute a bash command in a subprocess sandbox."""
+    """Execute a bash command in a subprocess sandbox.
+
+    disable_sandbox (Bypass Permissions): skip the command blocklist and rlimit
+    pre-exec, and use the host env minus secrets.
+    """
     if not command or not command.strip():
         return "No command provided."
 
-    # Block dangerous commands (shlex + regex based)
-    blocked = _find_blocked_commands(command)
-    if blocked:
-        return f"Blocked command(s) for safety: {', '.join(sorted(blocked))}"
+    # Block dangerous commands (skipped when the sandbox is disabled)
+    if not disable_sandbox:
+        blocked = _find_blocked_commands(command)
+        if blocked:
+            return f"Blocked command(s) for safety: {', '.join(sorted(blocked))}"
 
     try:
         workdir = _get_workdir(session_id)
-        safe_env = _build_safe_env(workdir)
+        safe_env = (
+            _build_bypass_env(workdir) if disable_sandbox else _build_safe_env(workdir)
+        )
         popen_kwargs = dict(
             stdout = subprocess.PIPE,
             stderr = subprocess.STDOUT,
@@ -2115,7 +2216,9 @@ def _bash_exec(
             env = safe_env,
         )
         if sys.platform != "win32":
-            popen_kwargs["preexec_fn"] = _sandbox_preexec
+            popen_kwargs["preexec_fn"] = (
+                _bypass_preexec if disable_sandbox else _sandbox_preexec
+            )
         else:
             popen_kwargs["creationflags"] = subprocess.CREATE_NO_WINDOW
 

studio/backend/models/inference.py

@@ -724,6 +724,10 @@ class ChatCompletionRequest(BaseModel):
         None,
         description = "[x-unsloth] When true, pause before each tool call and wait for the user to allow/deny it via POST /api/inference/tool-confirm.",
     )
+    bypass_permissions: Optional[bool] = Field(
+        False,
+        description = "[x-unsloth] Bypass Permissions: when true, skip the tool-call confirmation gate AND disable the python/terminal execution sandbox (safety checks, command blocklist, resource limits). Secret env vars are still stripped. Takes precedence over confirm_tool_calls.",
+    )
     auto_heal_tool_calls: Optional[bool] = Field(
         True,
         description = "[x-unsloth] Auto-detect and fix malformed tool calls from model output.",

studio/backend/routes/inference.py

@@ -2811,7 +2811,11 @@ def gguf_generate_with_tools():
                     if payload.tool_call_timeout is not None
                     else 300,
                     session_id = payload.session_id,
-                    confirm_tool_calls = bool(payload.confirm_tool_calls),
+                    # Bypass Permissions takes precedence over the confirm gate:
+                    # never prompt while bypassing.
+                    confirm_tool_calls = bool(payload.confirm_tool_calls)
+                    and not bool(payload.bypass_permissions),
+                    bypass_permissions = bool(payload.bypass_permissions),
                 )
 
             _tool_sentinel = object()
@@ -3332,7 +3336,11 @@ def sf_generate_with_tools():
                 else 300,
                 session_id = payload.session_id,
                 use_adapter = payload.use_adapter,
-                confirm_tool_calls = bool(payload.confirm_tool_calls),
+                # Bypass Permissions takes precedence over the confirm gate:
+                # never prompt while bypassing.
+                confirm_tool_calls = bool(payload.confirm_tool_calls)
+                and not bool(payload.bypass_permissions),
+                bypass_permissions = bool(payload.bypass_permissions),
             )
 
         _sf_tool_sentinel = object()
@@ -5013,6 +5021,7 @@ def _run_tool_gen():
                 auto_heal_tool_calls = True,
                 tool_call_timeout = 300,
                 session_id = payload.session_id,
+                bypass_permissions = bool(payload.bypass_permissions),
             )
 
         if payload.stream: