feat: Replace terminal dangerous-command block with HITL approval and add Safe Mode in Settings by spider-yamet · Pull Request #1310 · eigent-ai/eigent

spider-yamet · 2026-02-19T04:53:44Z

Related issue

Summary

Replaces the Terminal Toolkit’s hard block of “dangerous” commands with a Human-in-the-Loop (HITL) approval flow and adds a Safe Mode setting so users can opt in.

Changes

HITL for dangerous commands

When a dangerous command is detected and Safe Mode is on, the user is offered three choices:
- Yes – approve this command once
- All Yes in this task – approve all subsequent dangerous commands in the current task
- No – reject the command
Frontend shows the prompt and calls /chat/{id}/terminal-approval with the chosen option; backend enforces approval before running the command and supports “approve all in task” per task.

Safe Mode in Settings

Settings → Permissions: new Safe Mode toggle with hint:
“With Safe Mode active, Eigent will pause and seek explicit approval whenever high-risk system operations are detected.”
Default: off. When on, the HITL flow above is used for the configured dangerous-command list.

Backend

Dangerous command list (triggers HITL when Safe Mode is on): system (e.g. sudo, su, reboot, shutdown), file (e.g. rm, chown, mount), disk (e.g. dd, mkfs, fdisk), process (e.g. service, systemctl), network (e.g. iptables, ifconfig), cron (e.g. crontab, at), user/kernel (e.g. useradd, modprobe), and related commands as specified.
Non-Docker mode: cd is validated so the agent cannot leave the designated working_directory.
Task lock includes approved_all_dangerous_commands and a queue for terminal approval; reset on new task.

Frontend

Permissions tab and Safe Mode UI; preference stored in localStorage and sent as safe_mode in the start-task request.

Other

Pre-commit: skip backend checks when uv is not installed so commits succeed without uv (message suggests installing uv for backend checks).

Testing

Verified Safe Mode off: dangerous commands run without approval.
Verified Safe Mode on: dangerous commands trigger the three-option prompt; Yes / All Yes in task / No behave as described.
Verified Permissions UI: toggle and hint render; state persists and is sent to backend.
Verified cd outside working_directory in non-Docker mode is rejected.

spider-yamet · 2026-02-19T09:27:36Z

@bytecii @Wendong-Fan Could you please review my PR?

bytecii

IMO we can move this to camel to make a special safe mode such as strict. cc @Wendong-Fan

Wendong-Fan · 2026-02-21T15:35:28Z

IMO we can move this to camel to make a special safe mode such as strict. cc @Wendong-Fan

thanks @bytecii , the idea behind this issue is to implement a human-in-the-loop mechanism for safer code execution, which would involve the HumanToolkit. Since CAMEL serves more as a modular framework, it might be more appropriate to implement this feature in Eigent as an application layer. What do you think?

spider-yamet · 2026-02-22T23:34:05Z

@Wendong-Fan @bytecii could you please review this pr?
I see this PR remains opening for several days.

Regards

- Move HitlOptions and ApprovalRequest models from chat.py to app/hitl/__init__.py - Remove unnecessary hasattr guard on auto_approve (always initialized) - Remove issue reference comment and docstring comments - Update all imports across controllers, services, and tests

- Move _request_user_approval from AbstractToolkit to TerminalToolkit (only terminal uses approval today) - Remove debug print statements from shell_exec - Move import time to top-level in terminal_toolkit - Fix approval endpoint docstring - Remove module docstring from terminal_command.py - Add comment for effective executable check - Update test to subclass TerminalToolkit directly

bytecii · 2026-02-24T02:15:47Z

backend/app/agent/factory/browser.py

        options.project_id,
        Agents.browser_agent,
        working_directory=working_directory,
-        safe_mode=True,


remove this as this is not configured. And by default if the HITL not specified, we still use the safe_mode=True for the terminaltoolkit

bytecii · 2026-02-24T02:17:28Z

backend/app/agent/toolkit/terminal_toolkit.py

+            return None
+        return "Operation rejected by user. The task is being stopped."
+
+    async def shell_exec(


changed to async

- Remove unused logger from abstract_toolkit - Move _thread_local from AbstractToolkit to TerminalToolkit - Add missing threading.local() definition - Add Args/Returns to terminal_command.py functions - Use ApprovalAction.reject enum instead of raw string - Fix ApprovalAction and ActionCommandApprovalData docstrings - Add comment for auto_approve reset at task start

bytecii · 2026-02-24T02:27:23Z

backend/app/utils/listen/toolkit_listen.py

+            # the HITL approval flow (Camel's upstream shell_exec is
+            # sync-only with no async variant available).
+            if wrap is not func:
+                async_wrapper.__wrapped__ = func


Need someone helps to take a look at this

_get_terminal_approval() now reads from task_lock every call instead of caching in __init__, so toggling the setting between tasks takes effect immediately. SupplementChat carries hitl_options to the improve endpoint, and the localStorage key is extracted to a shared constant.

bytecii · 2026-02-24T03:32:52Z

Update the PR including backend and ui redesign
In general, making the HITL as an option in the settings and make it extensible for future possible approval

Added a _request_user_approval() method on AbstractToolkit that any toolkit can call to pause execution and wait for user approval via SSE.
Now only support the TerminalToolkit uses it to gate dangerous commands (rm, sudo, kill, etc.) behind a frontend toggle in the new HITL settings page, with per-agent approval queues so multi-agent tasks don't block each other.
The auto approval is defined for each task per agent and each task will fetch the terminal toolkit hitl settings to check whether need to let user input the approval for potential dangerous terminal command

tested with and without terminal approval in the HITL + approval / auto approval / reject with & without dark mode
cc @Wendong-Fan @fengju0213

…L approvals - Replace approval_input Queue with pending_approvals dict of asyncio.Future - Each _request_user_approval call gets a unique approval_id (agent_hex), so concurrent commands from the same agent no longer compete for one slot - Fix str,Enum f-string bug: use concatenation so Agents.developer_agent produces "developer_agent_..." not "Agents.developer_agent_..." - Frontend: replace activeApproval single slot with approvalQueue[] array; pushApproval/shiftApproval/clearAllApprovals manage the queue - Controller routes approve_once by approval_id, auto_approve/reject by agent - Add design comments to resolve_approval and resolve_all_approvals_for_agent - Update all tests; add concurrent same-agent and Enum regression tests

…cstrings and comments

bytecii · 2026-02-24T05:08:34Z

backend/app/agent/toolkit/terminal_toolkit.py

+    async def _request_user_approval(self, action_data) -> str | None:
+        """Send a command approval request to the frontend and wait.
+
+        Flow::


here is the flow

spider-yamet added 5 commits February 18, 2026 20:26

Implement Replace strict command prohibition

178687c

Revert unnecessary test implementations

ea58d8f

Revert unnecessary vite dev server configuration

feedb69

Restore index.ts file from electron/main

aaf4432

Fix for pre-commit check

ae50b21

bytecii reviewed Feb 19, 2026

View reviewed changes

Merge branch 'main' into feat/replace-strict-command-prohibition

d92015d

Wendong-Fan requested review from 4pmtong and fengju0213 and removed request for 4pmtong February 21, 2026 15:37

Wendong-Fan assigned spider-yamet Feb 21, 2026

Wendong-Fan added this to the Sprint 16 milestone Feb 21, 2026

Wendong-Fan added the Review Required label Feb 21, 2026

spider-yamet added 3 commits February 22, 2026 07:46

Merge branch 'main' into feat/replace-strict-command-prohibition

7a4809d

Merge branch 'main' into feat/replace-strict-command-prohibition

b53d046

Merge branch 'main' into feat/replace-strict-command-prohibition

8fc5e33

bytecii and others added 8 commits February 23, 2026 00:09

redesign

7708dca

Merge branch 'main' into feat/replace-strict-command-prohibition

e0eca63

redesign & fix

778bea2

Merge branch 'main' into feat/replace-strict-command-prohibition

f05eb7f

Merge branch 'main' into feat/replace-strict-command-prohibition

81cc43d

refactor: move HITL models to app/hitl/config.py

6518d87

bytecii reviewed Feb 24, 2026

View reviewed changes

bytecii and others added 2 commits February 23, 2026 19:26

Merge branch 'main' into feat/replace-strict-command-prohibition

f980daa

spider-yamet and others added 4 commits February 24, 2026 13:08

Merge branch 'main' into feat/replace-strict-command-prohibition

4239088

Merge branch 'main' into feat/replace-strict-command-prohibition

1a21afe

docs: replace 'dangerous' with neutral wording in approval-related do…

395e769

…cstrings and comments

bytecii reviewed Feb 24, 2026

View reviewed changes

bytecii added 2 commits February 23, 2026 21:20

i18n: add missing approval-pending key to all locales

d90a4fa

fix: remove duplicate terminal-approval keys in en-us setting.json

355bbb7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Comments

feat: Replace terminal dangerous-command block with HITL approval and add Safe Mode in Settings#1310

feat: Replace terminal dangerous-command block with HITL approval and add Safe Mode in Settings#1310
spider-yamet wants to merge 26 commits intoeigent-ai:mainfrom
spider-yamet:feat/replace-strict-command-prohibition

spider-yamet commented Feb 19, 2026

Uh oh!

spider-yamet commented Feb 19, 2026

Uh oh!

bytecii left a comment

Uh oh!

Wendong-Fan commented Feb 21, 2026

Uh oh!

spider-yamet commented Feb 22, 2026 •

edited

Loading

Uh oh!

bytecii Feb 24, 2026

Uh oh!

bytecii Feb 24, 2026

Uh oh!

bytecii Feb 24, 2026

Uh oh!

bytecii commented Feb 24, 2026

Uh oh!

bytecii Feb 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

spider-yamet commented Feb 19, 2026

Related issue

Summary

Changes

HITL for dangerous commands

Safe Mode in Settings

Backend

Frontend

Other

Testing

Uh oh!

spider-yamet commented Feb 19, 2026

Uh oh!

bytecii left a comment

Choose a reason for hiding this comment

Uh oh!

Wendong-Fan commented Feb 21, 2026

Uh oh!

spider-yamet commented Feb 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bytecii Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

bytecii Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

bytecii Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

bytecii commented Feb 24, 2026

Uh oh!

bytecii Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

spider-yamet commented Feb 22, 2026 •

edited

Loading