$ the-wire · showcase
Sandbox path literals land, compliance scores stop lying
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
2 people shipped this
Two operator-visible fixes shipped in the last 24 hours: sandbox-runtime now lets you pin filesystem paths as literals instead of patterns, and agent-governance-toolkit no longer reports unassessed SOC 2 controls as met.
Let a caller mark a path entry literal: `{ path, literal: true }` anthropics/sandbox-runtime
denyRead, allowRead, allowWrite and denyWrite now accept { "path": "...", "literal": true } alongside a plain string, meaning the value is treated as a path and never as a pattern, whether or not it exists on disk. If your policy entries point at directories whose names contain glob characters, this is the knob that makes them mean what you wrote.
Read a path entry as the path it spells, where that exists anthropics/sandbox-runtime
Entries are now also read as the path they spell when the portion holding characters like *, ?, [ or ] actually exists, with the pattern reading retained. Before this, a denyWrite on a file under a writable /w/[WIP] project left that file writable, so audit any policy where a bracketed folder name sat in a deny target.
fix(agent-mesh): don't count unassessed compliance controls as met microsoft/agent-governance-toolkit
ComplianceEngine.generate_report() counted controls_met as total_controls minus violated, so a control that check_compliance() never evaluated was indistinguishable from one that was checked and passed. The engine now records which controls it assessed per agent, which kills the false pass that reported SOC 2 as controls_met=2, compliance_score=100.0 with no checks run at all.
Glob walk: an `anchor` option, a directory taken as the name it is anthropics/sandbox-runtime
walkGlobPattern and expandGlobPattern take an anchor, a leading run of the path treated as a name on disk, with only what follows it compiled as a pattern. This is what makes a target like /w/[WIP] project/**/.env resolvable, since the dialect has no escape for those characters.
