$ the-wire · showcase
Petri 3.1.1 closes filesystem and server-side tool escapes
By RepoJournal · Filed · About Safety Evals · Composed from the cited sources · methodology
Petri shipped a patch release that stops auditors from reading outside their sandbox and stops targets from invoking real provider tools, while inspect_ai gave evaluators a switch to render untrusted model output as literal text.
fix: enforce filesystem boundaries for resources and exports safety-research/petri
Resource searches could read files outside `allowed_paths`: `search_in_files` ran the auditor's free-form grep arguments and then filtered output lines by the filename prefix before the first colon, so flags like `-h . ../outside.txt` hid the filename and any content containing a colon was misread as one, letting outside file contents be staged into the target conversation. Skill supporting-fil...
fix: drop target tool options so providers cannot run tools server-side safety-research/petri
Petri promises target tools are synthetic, with the auditor intercepting every call, but `ToolInfo.options` passed straight through from seed tools let inspect's model providers run tools inside the API call. A seed setting `options: {anthropic: {...}}` on `web_search` handed the target Anthropic's live web search and web fetch.
chore(main): release 3.1.1 (#150) safety-research/petri
Version 3.1.1 collects the tool-options fix along with rejecting seed tool definitions that are unknown or mismatched, so operators running Petri from a released tag get both boundary fixes rather than tracking main.
Let tasks and the viewer mark log content untrusted so it shows as plain text UKGovernmentBEIS/inspect_ai
Tasks can now set `ViewerConfig(trust_content=False)`, which records in the eval log header that payloads should render as plain text. The viewer then reveals hidden and bidi characters and shows terminal escapes literally, and the flag applies to existing logs whose tasks never opted out of rich rendering.
feat(utils): accept predicate, extract_code_blocks and parser fixes for extract_code_block UKGovernmentBEIS/inspect_evals
The shared `extract_code_block` in `inspect_evals.utils.code` now handles fence shapes that migrating evals would otherwise drop, including a `python3` label, `cc` and `cxx` for `cpp`, truncated labelled fences that run to end of text, and labelled fences opening after prose on the same line. It also adds a predicate argument and an `extract_code_blocks` plural form.
fix: preserve deleted files in Git reference diffs UKGovernmentBEIS/control-arena
Deleting a tracked file in the agent workspace produced no deletion in `get_diff_from_git_ref()` because the agent archive was extracted over a populated reference clone, so a deletion-only submission returned an empty diff. Control Arena now copies the agent snapshot into an empty temporary worktree staged with the reference clone's Git metadata and index.
Action items
- → Upgrade petri to 3.1.1 to get the filesystem boundary and server-side tool fixes safety-research/petri [plan]
- → Set ViewerConfig(trust_content=False) on tasks whose logs you display, or view untrusted payloads as plain text UKGovernmentBEIS/inspect_ai [plan]
