$ the-wire · showcase
Guardrails adds tool-call rails, sandbox-runtime closes deny escapes
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
The Guardrails server can now guard tool calls over the same /v1/checks endpoint as text, while sandbox-runtime v0.0.79 fixes deny rules that silently matched nothing.
v0.0.79 anthropics/sandbox-runtime
v0.0.79 is the one to install: a filesystem.denyRead plus denyWrite pair on Windows used to leave the whole subtree readable, and a deny aimed at a folder whose name contains glob characters such as [wip] app or br[1] matched nothing on any platform. On Linux, .bashrc, .git/config and .vscode/ are now write-denied one level below the working directory regardless of what else the tree holds.
feat(server)!: Use structured tool-calling request and response NVIDIA-NeMo/Guardrails
The /v1/checks endpoint on the Guardrails server now accepts tool-call and tool-result types alongside text checks, completing a three-PR stack that also dropped the OpenAI-unspecified tool-call name requirement and reports a blocked reason for tool-rail checks. Marked breaking: the request and response shape changes, so any client posting to /v1/checks needs updating.
Per-command network allow lists, and deny reasons from the ask callback anthropics/sandbox-runtime
Your hooks can now scope network access per command via SandboxManager.registerCommandNetworkLists(commandId, { allowedDomains }) and unregisterCommandNetworkLists(commandId), with deniedDomains and strictAllowlist still evaluated first, and the ask callback can deny with a reason instead of a bare refusal.
srt-proxy: SRT's HTTP proxy with an external decider anthropics/sandbox-runtime
A new `srt proxy` subcommand runs SRT's HTTP proxy standalone with no sandboxed child, taking every allow, deny or header-edit verdict from a separate decider process over the length-prefixed JSON protocol documented in docs/srt-proxy.md. It fails closed: no verdict in time, a protocol violation or a dead decider all block the request.
windows: a path in both deny lists keeps the read deny anthropics/sandbox-runtime
A Windows bug fixed here left a path listed in both filesystem.denyRead and filesystem.denyWrite readable, because the read and write denies share a ledger kind and the later write entry overwrote the read mask. Also quiet: the supply-chain CI in microsoft/agent-governance-toolkit stopped hard-failing on unpublished path-dependency versions and raised the install-script audit cap to match its s...
Action items
- → Upgrade sandbox-runtime to v0.0.79 before relying on deny rules for paths in both deny lists anthropics/sandbox-runtime [immediate]
- → Update clients posting tool-call and tool-result checks to the new /v1/checks structured request and response NVIDIA-NeMo/Guardrails [plan]
