$ the-wire · showcase
A proxy that corrupts the next request, and a clearer bwrap refusal
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
sandbox-runtime's Bun proxy can hand your request filter and upstream a request stitched together with the previous one's target and trailers, while its Linux wrapper now tells you which arguments you cannot actually reduce.
Keep a request's trailers out of the next request on its connection (Bun) anthropics/sandbox-runtime
Under Bun, a request that follows a chunked request with trailers on the same connection is read with the earlier request's target prefixed to its own and the earlier request's trailers ahead of its headers, so "GET /second" after "POST /first" with a trailer arrives as "GET /first/second". The request filter and the upstream both see that same wrong request, and it affects every connection the...
linux: a deny set's mounts do not depend on the order it was written in anthropics/sandbox-runtime
On Linux, a write-deny list that named one path both directly and through a symlink, with a directory above it also denied, got that path's own read-only bind depending on which spelling came first. The set of mounts is now decided on the destination rather than the entry in hand, so your denies produce the same mounts in the same order-independent way every run. Nothing was left writable eithe...
linux: the refusal at 9000 bwrap arguments says whose they are anthropics/sandbox-runtime
bubblewrap caps arguments at 9,000 and the wrapper refuses a profile past that with too_many_arguments, but the message told you to reduce what the configuration expands to even when the arguments came from mandatory denies that follow from the working directory and appear in no configuration list. Since #629 each git repository one level below the working directory costs four read-only binds, ...
feat(server): integrate OpenAI Chat buffered proxy NVIDIA-NeMo/Guardrails
Guardrails adds a guarded POST /v1/chat/completions endpoint through the buffered provider-native proxy path, preserving original provider data while binding exact guarded targets, checker execution, native errors, and route ownership. If you route OpenAI Chat traffic through Guardrails, that endpoint and its API-version reservation are what you point at; the underlying projections landed separ...
srt-proxy: add --version anthropics/sandbox-runtime
srt-proxy --version prints one line, srt-proxy <version>, to stdout and exits 0, handled before any other option is parsed with no descriptor opened and nothing read or bound. Long form only, and it wins wherever it appears on the command line, which makes it safe to call from a health check or build script.
