ceos/unsloth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Do not describe bypass code execution as sandboxed

Browse source 
In Bypass Permissions the tool loop skips the safety analysis, command
blocklist and rlimits, so the bypass code-execution nudge must not tell the
model it runs in a sandbox. Keep the accurate isolated-scratch workdir framing
and drop the sandbox claim; the default (sandboxed) nudge is unchanged.
This commit is contained in:
danielhanchen 2026-07-20 04:59:29 +00:00
commit 339dded90a
2 changed files with 15 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

19
studio/backend/routes/inference.py
View file

@ -2426,17 +2426,18 @@ _TOOL_CODE_TIP = (
"you need is not present, ask the user to provide it or give an exact path "
"rather than running commands against a guessed one."
)
# Bypass variant: drops the "internet access is limited" clause, keeps the workdir-default framing.
# Bypass variant: bypass disables the sandbox, so this drops both the "internet
# access is limited" clause and the "runs in a sandbox" framing; it keeps the
# accurate isolated-scratch workdir-default guidance.
_TOOL_CODE_TIP_BYPASS = (
"Use code execution for math, calculations, data processing, or to parse "
"and analyze information from tool results. It runs in a sandbox whose "
"working directory is an isolated scratch space that is the default "
"location for your work and may already hold files from earlier work; it "
"is not a copy of the user's computer, so do not assume a file, folder, or "
"repository the user mentions is already present. List the working "
"directory to see what is there; if what you need is not present, ask the "
"user to provide it or give an exact path rather than running commands "
"against a guessed one."
"and analyze information from tool results. Its working directory is an "
"isolated scratch space that is the default location for your work and may "
"already hold files from earlier work; it is not a copy of the user's "
"computer, so do not assume a file, folder, or repository the user mentions "
"is already present. List the working directory to see what is there; if "
"what you need is not present, ask the user to provide it or give an exact "
"path rather than running commands against a guessed one."
)
_TOOL_ARTIFACT_TIP = (
"For HTML, CSS, or JavaScript canvas requests, call render_html once when "

6
studio/backend/tests/test_sandbox_paths_note.py
View file

@ -161,10 +161,14 @@ def test_bypass_code_execution_nudge_drops_the_limited_internet_claim():
lowered = _TOOL_CODE_TIP_BYPASS.lower()
assert "internet access is limited" not in lowered
# Bypass disables the safety analysis, blocklist and rlimits, so the nudge must
# not describe execution as sandboxed (only the isolated workdir survives).
assert "in a sandbox" not in lowered
# Keeps the workdir-default framing and the exact-path guidance.
assert "default" in lowered and "location for your work" in lowered
assert "give an exact path" in lowered
# The default nudge still carries the restriction for sandboxed sessions.
# The default (sandboxed) nudge still runs in a sandbox and keeps the restriction.
assert "in a sandbox" in _TOOL_CODE_TIP.lower()
assert "internet access is limited" in _TOOL_CODE_TIP.lower()