From 339dded90a878c65f3c182d07f45189b56e295c0 Mon Sep 17 00:00:00 2001 From: danielhanchen Date: Mon, 20 Jul 2026 04:59:29 +0000 Subject: [PATCH] Do not describe bypass code execution as sandboxed In Bypass Permissions the tool loop skips the safety analysis, command blocklist and rlimits, so the bypass code-execution nudge must not tell the model it runs in a sandbox. Keep the accurate isolated-scratch workdir framing and drop the sandbox claim; the default (sandboxed) nudge is unchanged. --- studio/backend/routes/inference.py | 19 ++++++++++--------- .../backend/tests/test_sandbox_paths_note.py | 6 +++++- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py index 217551c9a8..7963267128 100644 --- a/studio/backend/routes/inference.py +++ b/studio/backend/routes/inference.py @@ -2426,17 +2426,18 @@ _TOOL_CODE_TIP = ( "you need is not present, ask the user to provide it or give an exact path " "rather than running commands against a guessed one." ) -# Bypass variant: drops the "internet access is limited" clause, keeps the workdir-default framing. +# Bypass variant: bypass disables the sandbox, so this drops both the "internet +# access is limited" clause and the "runs in a sandbox" framing; it keeps the +# accurate isolated-scratch workdir-default guidance. _TOOL_CODE_TIP_BYPASS = ( "Use code execution for math, calculations, data processing, or to parse " - "and analyze information from tool results. It runs in a sandbox whose " - "working directory is an isolated scratch space that is the default " - "location for your work and may already hold files from earlier work; it " - "is not a copy of the user's computer, so do not assume a file, folder, or " - "repository the user mentions is already present. List the working " - "directory to see what is there; if what you need is not present, ask the " - "user to provide it or give an exact path rather than running commands " - "against a guessed one." + "and analyze information from tool results. Its working directory is an " + "isolated scratch space that is the default location for your work and may " + "already hold files from earlier work; it is not a copy of the user's " + "computer, so do not assume a file, folder, or repository the user mentions " + "is already present. List the working directory to see what is there; if " + "what you need is not present, ask the user to provide it or give an exact " + "path rather than running commands against a guessed one." ) _TOOL_ARTIFACT_TIP = ( "For HTML, CSS, or JavaScript canvas requests, call render_html once when " diff --git a/studio/backend/tests/test_sandbox_paths_note.py b/studio/backend/tests/test_sandbox_paths_note.py index 47567ed35a..42ee8b3184 100644 --- a/studio/backend/tests/test_sandbox_paths_note.py +++ b/studio/backend/tests/test_sandbox_paths_note.py @@ -161,10 +161,14 @@ def test_bypass_code_execution_nudge_drops_the_limited_internet_claim(): lowered = _TOOL_CODE_TIP_BYPASS.lower() assert "internet access is limited" not in lowered + # Bypass disables the safety analysis, blocklist and rlimits, so the nudge must + # not describe execution as sandboxed (only the isolated workdir survives). + assert "in a sandbox" not in lowered # Keeps the workdir-default framing and the exact-path guidance. assert "default" in lowered and "location for your work" in lowered assert "give an exact path" in lowered - # The default nudge still carries the restriction for sandboxed sessions. + # The default (sandboxed) nudge still runs in a sandbox and keeps the restriction. + assert "in a sandbox" in _TOOL_CODE_TIP.lower() assert "internet access is limited" in _TOOL_CODE_TIP.lower()