$ the-wire · showcase
Bridge agents stop killing samples, approvals see the real tool
By RepoJournal · Filed · About Safety Evals · Composed from the cited sources · methodology
2 people shipped this
inspect_ai fixed two behaviors operators of sandbox-bridged agents depend on: an agent hitting a limit now ends only that agent, and approval policies now evaluate a bridged tool call under the tool it actually runs, closing a name-shadowing path.
fix(bridge): approval policies now see a bridged tool call under the tool it runs, whatever name the agent declared UKGovernmentBEIS/inspect_ai
An execution grant already resolved a proposed call to the bridged host tool by its served description and ignored the declared name, while approval reviewed the call under the name the agent declared. Since served descriptions are readable from inside the sandbox, an agent could re-declare a bridged bash as note_summarizer with the same description and slip past a policy scoped to bash. Approv...
fix: an agent limit reached by a sandbox-bridged agent ends that agent, not the sample UKGovernmentBEIS/inspect_ai
Under run(claude_code(), limits=[token_limit(N)]), a sandbox-bridged agent reaching its token limit used to end the whole sample; it now ends with the limit error and run() returns it, matching how a native agent behaves under the same run(). Any scoring or retry logic that counted on a bridge limit aborting the sample will see the sample continue.
feat: a runtime can hold and rewrite a react() conversation at turn boundaries, and compaction handlers gain reset() UKGovernmentBEIS/inspect_ai
A runtime can now hold and rewrite a react() conversation at each turn boundary without the agent author wiring a hook in, and compaction handlers gain reset(). The rewrite also reaches the model with compaction on; previously the handler kept its own input and the changed conversation did not arrive.
build: remove the devcontainer, which no longer builds UKGovernmentBEIS/inspect_ai
The devcontainer never built on main, its dev stage faking version 0.0.1 below the inspect-scout and inspect-sentinel floors for inspect-ai, so it has been removed rather than maintained. If you develop against .devcontainer/, switch to your own environment setup; the Dependabot fix in the same batch (declaring dependencies in pyproject.toml) is contributor-facing housekeeping.
Action items
- → Replace any use of the inspect_ai .devcontainer with your own environment, and stop relying on a bridge limit error t... UKGovernmentBEIS/inspect_ai [plan]
