$ the-wire · showcase
Recursive-delete enforcement returns to the CLI plugins
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
The agent-governance-toolkit restores the guard that was supposed to stop rm -rf in Claude Code and Copilot CLI, while sandbox-runtime fixes the mount collisions that kept bubblewrap 0.4 hosts from starting at all.
fix: restore recursive-delete enforcement in CLI plugins microsoft/agent-governance-toolkit
The bundled Bash regex was missing real rm -rf commands in Claude Code and Copilot CLI and both denying harmless text and letting deletions through, so the broken matcher is replaced with the OpenCode tokenizer across both packages and all five bundled Bash policies. If you rely on those plugins to block recursive deletes, your deny list was not holding; pull the fix and re-test the commands yo...
linux: one mount per destination, so bubblewrap 0.4 starts anthropics/sandbox-runtime
A trailing slash, a symlinked directory, or a denyRead entry that doubles as a credential mask each put a mask at the same bind destination, and before 0.5.0 bubblewrap accepts only a regular file there, so 0.4.0 and 0.4.1 (RHEL 8 and 9) failed to start with "Can't create file at <dest>: Permission denied". Each destination now gets a single mask: the credential mask when a read deny names the ...
feat(vscode): discover MCP servers registered by extensions in code snyk/agent-scan
An extension can register MCP servers in code via vscode.lm.registerMcpServerDefinitionProvider with no mcp.json on disk at all, leaving the server live in the editor but invisible to the existing extension walk. Pylance ships one this way; discovery is gated on contributes.mcpServerDefinitionProviders in the extension's package.json, so your scan can now see servers it previously missed.
fix(vscode): gate extension MCP provider scan per fork snyk/agent-scan
The provider scan had landed enabled family-wide, which covered its cost but not the fact that forks install the same extension artifacts as VS Code. It is now gated per fork, matching the four other VSCode/Copilot-specific flags.
linux: a wrap that starts over keeps what it has walked, and ends anthropics/sandbox-runtime
The sandbox-runtime Linux wrap walks read patterns in turns and restarts when updateConfig() replaces the configuration mid-walk; the restart used to begin from nothing, so every replacement cost a full walk, identical content included, with nothing bounding it. A host refreshing its configuration often could keep a command from starting; the wrap now keeps the directories it listed and each pa...
