feat(ai-red-teaming): guardrail hook to block CLI/shell provisioning (ENG-8477), release 1.16.2 - #145
Merged
Merged
Conversation
…rovisioning (ENG-8477) The provisioning-and-lifecycle skill tells the agent to provision only via the provision_environment tool and never via `dreadnode env` in a shell, but skill prose is advisory - a weak driver can ignore it and fall back to the CLI. Add a ToolStart hook that structurally enforces the rule: shell tool calls (bash/shell/python/...) whose command matches `dreadnode|dn env[ironment]` are denied before execution and redirected to provision_environment (via RetryWithFeedback, which the runtime turns into a [POLICY DENIED] tool result). Bump to 1.16.2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Addresses the guardrail part of ENG-8477. The
provisioning-and-lifecycleskill tells the agent to provision only via theprovision_environmenttool and to never rundreadnode env ...in a shell. Skill prose is advisory - a weaker driver model (qwen-3.7-max in the report) can ignore it and fall back to the CLI.This adds a structural guardrail: a
ToolStarthook that inspects shell tool calls (bash,shell,sh,python, ...) and, if the command matchesdreadnode|dn env[ironment], denies the call before it runs and redirects the agent toprovision_environment. The runtime turnsRetryWithFeedback(tool_call_id=...)into a[POLICY DENIED]tool result and skips the real execution, so the model cannot fall through to the shell.Scope is deliberately narrow (only environment-provisioning CLI), so legitimate shell/
dn airtusage is unaffected.Changes
hooks/block_cli_provisioning.py- the guardrail hookcapability.yaml- register the hook; bump1.16.1->1.16.2tests/test_block_cli_provisioning.py- unit tests (blocks provisioning variants, allows benign shell +dn airt, ignores non-shell tools and the realprovision_environment)Notes
provision_environmentavailable and prevents the CLI fallback if the model still tries.RetryWithFeedback.tool_call_idrequires a modern runtime SDK (2.0.4x, which prod runs); on older SDKs the field is ignored and the feedback is injected as a user message - the tool is still blocked either way.Test plan
pytest tests/test_block_cli_provisioning.py- 4 passedload_capabilityshows v1.16.2, hookblock_cli_provisioningloaded, 0 degraded components,provision_environmentstill registered (37 tools)