Skip to content

v0.8.56 — unified airlock CLI dispatcher + AgentDojo defense numbers

Choose a tag to compare

View all tags
@sattyamjjain sattyamjjain released this 27 Jul 14:00
v0.8.56
a3d3aa5

v0.8.56 — the unified airlock CLI + AgentDojo defense numbers

Two things ship together in 0.8.56.

1. One CLI: airlock <command>

A single airlock console script now fronts every agent_airlock.cli subcommand in the space-form the docs have advertised for releases — airlock scan-tools, airlock doctor, airlock corpus-bench, airlock explain, and 15 more. Before this, a fresh install only exposed three hyphenated scripts and everything else was python -m agent_airlock.cli.<name>.

pip install "agent-airlock==0.8.56"
airlock                                   # lists every subcommand + a one-line description
airlock scan-tools ./tools/ --policy strict
airlock explain --unused-scopes --policy p.toml --trace t.jsonl
  • Each subcommand delegates to the target module's own main(argv) — the dispatcher never re-declares flags, so airlock <cmd> ... and python -m agent_airlock.cli.<name> ... accept identical options. That equivalence is pinned per-subcommand in tests/test_cli_dispatcher.py.
  • airlock with no args lists the commands (exit 0); airlock <unknown> exits non-zero. Subcommand modules are imported lazily, so an optional-extra command (console) can't break the top-level listing.
  • The three older scripts (airlock-explain, airlock-conformance, airlock-scan-tools) are kept as aliases — nothing documented breaks.
  • doctor / verify / egress-bench gained a real --help (argparse) while keeping their exact flags and exit codes.

2. Release-hygiene guard

0.8.56 was declared on main on 2026-07-24 and then sat untagged for two days while it held the AgentDojo benchmark — declared but un-installable. New scripts/check_version_tagged.py + a version-tag-guard CI job turn that state red: a declared version with no matching vX.Y.Z tag more than one commit past the bump fails CI.

Also in 0.8.56 — AgentDojo defense numbers (all 4 suites)

The commit this release finally publishes. airlock as an AgentDojo defense blocks 86.0% (524/609) of tool_knowledge injection→task target tool-calls across all 4 suites (deterministic upper bound on ASR reduction, not the model-in-the-loop ASR), with the honest misses reported and the model-in-the-loop path fixed against agentdojo 0.1.35. See benchmarks/agentdojo/RESULTS.md.

The airlock core stays Pydantic-only, zero-dependency.

Full changelog: https://github.com/sattyamjjain/agent-airlock/blob/v0.8.56/CHANGELOG.md

Assets 2
Loading