$ the-wire · showcase
Sandbox proxy crash fix, Guardrails tool-rail reasons, multidict patched
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
A single malformed upstream response head could kill the entire sandbox-runtime proxy process and cut every sandboxed command's network access in 0.0.78, while NVIDIA's Guardrails server moves toward telling you why a tool call was blocked and Snyk patches a medium-severity transitive dependency.
Answer 502 when an upstream sends an invalid status code anthropics/sandbox-runtime
An upstream response head that Node's res.writeHead rejects, such as "HTTP/1.1 099 x", made the proxy's response callback throw an uncaught RangeError [ERR_HTTP_INVALID_STATUS_CODE] and exit the process; every connection through it dropped and the sandboxed command lost network access. The fix relays the response head through one guarded helper, relayResponseHead, at all four relay sites (direc...
feat(checks): Report /v1/checks block reason on HTTP response (IORails only) NVIDIA-NeMo/Guardrails
The /v1/checks endpoint now surfaces the reason a tool rail blocked a request on the HTTP response, as the second of three stacked PRs adding tool-call and tool-result rails to the Guardrails server. If you call /v1/checks, you can log the real block reason instead of a bare failure. It applies to IORails only.
fix(iorails): Accept tool results without name if call_id matches NVIDIA-NeMo/Guardrails
The tool-result check no longer requires a tool-call name field, since the OpenAI spec does not guarantee one; the tool_call_id still has to match. If you were emitting tool results without names, those calls stop failing validation, and the server-side type support for tool-call and tool-result lands separately.
fix: bump transitive multidict to >=6.9.1 for Snyk vulnerability snyk/agent-scan
A daily Snyk open-source scan with --reachability and --severity-threshold=low flagged SNYK-PYTHON-MULTIDICT-20510280 (Medium, missing release of memory after effective lifetime) in multidict 6.7.1. The fix pins "multidict>=6.9.1" in [tool.uv].override-dependencies in pyproject.toml and re-locks, which resolved to 7.0.0; the same bump landed for the vendored dependency in microsoft/agent-govern...
test(claude-code, opencode): isolate tests from the developer's user policy microsoft/agent-governance-toolkit
The long tail is dev tooling and test isolation: the claude-code and OpenCode plugin tests stop falling back to $AGT_CLAUDE_POLICY_PATH, $AGT_OPENCODE_POLICY_PATH and ~/.claude/agt/policy.json, and the TypeScript ESLint packages in the Copilot extension move 8.70.x to 8.71.0. Nothing here changes how the tools behave.
Action items
- → Upgrade sandbox-runtime past 0.0.78 before relying on it in production anthropics/sandbox-runtime [immediate]
- → Bump multidict to >=6.9.1 in agent-scan deployments snyk/agent-scan [plan]
