$ the-wire · showcase
sandbox-runtime ranks Windows denies and stops path brackets from breaking wraps
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
2 people shipped this
anthropics/sandbox-runtime shipped a batch of filesystem permission fixes that change how deny and allow entries are ranked on Windows, how write denies nest under allowed writes on Linux, and how ordinary folder names like [user-id] stop sandbox wraps from throwing entirely.
Read brackets that spell no set of characters as text, so no path entry keeps a sandbox from starting anthropics/sandbox-runtime
A path entry whose brackets hold a backwards range compiles to no regular expression, so a folder really named [user-id] or backup[2024-01-15] made every wrap throw and no command could be sandboxed at all; a relative pattern like **/.env also failed when the working directory sat inside such a folder, as web framework route folders are named. If your repo or working directory uses bracketed na...
windows: deny entries rank as on the other platforms anthropics/sandbox-runtime
Your filesystem lists and credentials.files now become ACEs for the sandbox account and rank against each other before srt-win is called, matching the behavior on the other platforms: an allowWrite at or beneath a denyWrite path is granted read and execute only, credentials.files beats both allow lists, and the trust bundle is the only exception. Windows operators who relied on an allowWrite wi...
linux: bind a write deny that holds an allowed write path anthropics/sandbox-runtime
denyWrite now takes precedence over allowWrite however the two are nested, including a deny path that holds an allowed write path; a deny that meets nothing mounts nothing, and read-deny mounts beneath the bind go back on top of it with masks last. One consequence to know: an absent deny path that only write paths beneath a deny directory hold gets no mount point, so nothing can create it there.
Linux: a matching link kept under its own spelling stays in the deny list anthropics/sandbox-runtime
A denyRead glob keeps a matching symlink under its own spelling when it cannot say where the link leads, so links kept as spelled take no part in the location collapse and are always in the result. A link that only its shorter name resolves, and to /, now denies the directory that holds it, as any link to that target would.
Ask the file system for the real path of a name that holds a backslash anthropics/sandbox-runtime
realPathOf (src/utils/real-path.ts) is now the single place the library asks for a real path: names without a backslash and every name on Windows go to realpathSync unchanged, while on other platforms a name containing a backslash is resolved component by component with lstat and readlink, since off Windows a backslash is just another filename character. Linux and macOS operators with backslash...
fix(agent-sre): compute burn rate against the allowed error ratio (#4287) microsoft/agent-governance-toolkit
ErrorBudget.burn_rate() divided the window's error ratio by a per-second rate, inflating the result by the budget window length (2,592,000 for the default 30 days): with a 99% target, five errors in 1000 events produced 1,296,000 instead of 0.5, so any error tripped both burn rate alerts. Also fixed in the same window: a cancelled HALF_OPEN probe used to leave the breaker open with no free slot...
