Skip to content

feat(agent): allow variable tool permission modes - #7538

Draft
j15z wants to merge 1 commit into
codex/fix-api-tool-canonical-remappingfrom
codex/agent-tool-permission-mode
Draft

feat(agent): allow variable tool permission modes#7538
j15z wants to merge 1 commit into
codex/fix-api-tool-canonical-remappingfrom
codex/agent-tool-permission-mode

Conversation

@j15z

@j15z j15z commented Sep 5, 2026

Copy link
Copy Markdown
Collaborator

Summary

Let an agent tool’s Permission Mode use a fixed selector or a variable such as <start.toolMode>. Resolve the active expression before tool filtering and reject invalid values before provider calls. Preserve the fixed choice, expression, and active mode through API/Copilot edits, search, export/import, and execution. Add the shared canonical toggle in the expanded tool controls, without a feature flag.

Stack 7/7. Merge after #7772. Companion: simstudioai/mothership#488.

Review order:

  1. fix(cli): report interrupted HTTP responses
  2. fix(workflows): surface workflow import failures
  3. fix(realtime): ignore object key order in search replacements
  4. fix(realtime): preserve debounced subblock save order
  5. fix(workflows): persist tool order and canonical modes atomically
  6. fix(workflows): preserve tool canonical modes in API edits
  7. feat(agent): allow variable tool permission modes

Type of Change

  • Bug fix
  • New feature
  • Breaking change
  • Documentation
  • Other: ___________

Testing

438 focused application tests pass, covering fixed/variable resolution, invalid values, secret tracking, API edits, import round trips, and search. App, realtime, and CLI type checks; lint and lint:check; all 46 audits; block-registry and docs-manifest checks pass on the assembled stack. Committed artifacts are in sync.

Earlier Chrome/CLI testing covered permission choices, dynamic inputs, reload, collaboration, deployed/draft isolation, and injected network failures. This split was validated automatically; Chrome was not rerun. Undo/redo, additional collaborative interleavings, viewer-account behavior, live provider outages, global cron ticks, and queue transport remain unverified.

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

No screenshots attached.

@vercel

vercel Bot commented Sep 5, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs Ready Ready Preview Sep 11, 2026 5:53pm UTC

Request Review

@j15z

j15z commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@j15z

j15z commented Sep 6, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

@greptile-apps

greptile-apps Bot commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

RetriggerConfidence Score: 5/5

The PR appears safe to merge; the previously reported per-subblock ordering race is fixed and no new actionable failures remain.

Summary

  • Resolves variable permission expressions before tool filtering and rejects invalid resolved modes.
  • Preserves tool permission settings and canonical mode indexes across array edits and workflow transformations.
  • Excludes disabled tools from discovery and execution.
  • Makes reordered tool arrays and their canonical modes a single collaborative persistence operation.
  • Improves realtime save ordering, import error reporting, and interrupted CLI response guidance.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Editor[Workflow editor] --> Stored[Stored tool configuration]
  Stored --> Fixed{Permission mode}
  Fixed -->|Basic| Selector[Fixed auto / force / none]
  Fixed -->|Advanced| Resolver[Resolve variable expression]
  Resolver --> Validate[Validate resolved mode]
  Selector --> Filter[Filter disabled tools]
  Validate --> Filter
  Filter --> Provider[Provider tool request]
  Editor --> Realtime[Realtime collaboration]
  Realtime --> Queue[Per-subblock serialized flush]
  Queue --> DB[(Workflow persistence)]
Loading

Reviews (9) · Last reviewed commit: "fix(realtime): keep debounced subblock s..."

Comment thread apps/sim/lib/workflows/tool-input/usage-control.server.ts Outdated
@j15z
j15z force-pushed the codex/agent-tool-permission-mode branch from 11c3d58 to 818dca4 Compare September 6, 2026 00:21
@j15z
j15z changed the base branch from codex/canonical-tool-mode-base to staging September 6, 2026 00:22
@j15z
j15z force-pushed the codex/agent-tool-permission-mode branch from 818dca4 to 41af1d3 Compare September 7, 2026 19:00
@j15z
j15z force-pushed the codex/agent-tool-permission-mode branch from 41af1d3 to 661f655 Compare September 9, 2026 20:30
@github-actions github-actions Bot added the requires-mothership-merge Has a companion PR on the mothership/copilot side — merge in lockstep label Sep 9, 2026
@github-actions

github-actions Bot commented Sep 9, 2026

Copy link
Copy Markdown

⚠️ Cross-repo companion check

One or more companion PRs aren't merged into staging yet. Merging this without them will leave copilot and sim out of sync — merge them in lockstep.

  • simstudioai/mothership#488OPEN, not merged (targets staging) — feat(workflow): document variable agent tool permissions

@j15z

j15z commented Sep 9, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@j15z

j15z commented Sep 9, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

Comment thread apps/realtime/src/database/operations.ts Outdated
Comment thread apps/realtime/src/database/workflow-authoring.ts Outdated
@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

@j15z
j15z force-pushed the codex/agent-tool-permission-mode branch from d433d88 to 68451c9 Compare September 10, 2026 00:04
@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

Comment thread apps/realtime/src/handlers/subblocks.ts Outdated
@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@greptile

@j15z

j15z commented Sep 10, 2026

Copy link
Copy Markdown
Collaborator Author

@cubic-dev-ai review this PR

@cubic-dev-ai

cubic-dev-ai Bot commented Sep 10, 2026

Copy link
Copy Markdown
Contributor

@cubic-dev-ai review this PR

@j15z I have started the AI code review. It will take a few minutes to complete.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires-mothership-merge Has a companion PR on the mothership/copilot side — merge in lockstep

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant