Description

Setting interpreter.auto_run to a callable function (for selective per-command auto-approval) silently breaks the confirmation flow. Commands that the callable rejects simply disappear — no confirmation prompt, no execution, no feedback.

This affects two files:

1. core.py — confirmation chunk never yielded

In _respond_and_store(), the confirmation chunk is only yielded when self.auto_run == False:

if chunk["type"] == "confirmation":
    ...
    if self.auto_run == False:
        yield chunk

A callable is truthy (not == False), so the chunk is never yielded. The terminal interface never sees it, so it can never prompt the user.

2. terminal_interface.py — callable never called

The confirmation handler uses if not interpreter.auto_run: which treats a callable as truthy, skipping the prompt entirely:

if chunk["type"] == "confirmation":
    if not interpreter.auto_run:
        # show confirmation prompt...

With a callable, not callable_func is False, so every command auto-runs — the exact opposite of the intended behavior.

Steps to reproduce

def selective_auto_run(code):
    """Only auto-run read-only commands."""
    return code.startswith(("cat ", "ls", "head "))

interpreter.auto_run = selective_auto_run
# Now ALL commands auto-run (callable is truthy)
# Commands like "rm -rf /" would execute without any prompt

Suggested fix

core.py:

- if self.auto_run == False:
+ if self.auto_run == False or callable(self.auto_run):
      yield chunk

terminal_interface.py:

  if chunk["type"] == "confirmation":
+     _code_content = chunk["content"]["content"]
+     _should_auto_run = (
+         interpreter.auto_run(_code_content)
+         if callable(interpreter.auto_run)
+         else interpreter.auto_run
+     )
-     if not interpreter.auto_run:
+     if not _should_auto_run:
          # show confirmation prompt...

This enables a powerful pattern: users can define a function in their profile that auto-approves safe commands (cat, ls, grep) while requiring confirmation for destructive ones (rm, sudo, pip). The existing True/False behavior is completely unchanged.

Related: #1657

Environment

• open-interpreter 0.4.3
• Python 3.10, Linux