$ the-wire · showcase
Configurable secret patterns, and a sandbox that can start anywhere
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
Operators got the two things they ask for most: a scanner they can teach their own credential formats, and a sandbox runtime whose path handling no longer collapses on ordinary folder names.
feat(opencode): make secret patterns configurable and add common token formats (#4280) microsoft/agent-governance-toolkit
The tool output scanner no longer hardcodes its credential formats: you can set a secretPatterns policy key with { id, source, flags? }, the same shape poisoningPatterns already uses, instead of forking lib/policy.mjs to catch your organization's tokens. Common token formats were added alongside it, and SECRET_PATTERNS stops being a module-level constant read directly by the scan and redact pas...
Read brackets that spell no set of characters as text, so no path entry keeps a sandbox from starting anthropics/sandbox-runtime
A path entry whose brackets spell no set of characters, a folder literally named [user-id] or backup[2024-01-15], compiled to no regular expression, and every wrap then threw, so no command could be sandboxed: Linux failed at the wrap and in getFsReadConfig(), macOS in the profile builder. An ordinary relative pattern like **/.env triggered the same failure whenever the working directory sat in...
linux: bind a write deny that holds an allowed write path anthropics/sandbox-runtime
denyWrite now takes precedence over allowWrite however the two are nested, including a deny path that holds an allowed write path, matching the precedence the other platforms already enforce. On Linux this also closes the case where an absent deny path held only by write paths beneath a deny directory got no mount point.
Response header bytes past ASCII reach the client unchanged under Bun anthropics/sandbox-runtime
Under Bun, header bytes from 0x80 up reached the client doubled, so a latin1 byte like e9 arrived as c3 a9, because Bun's http.Server writes the response head as a string with no encoding on a connection handed over via emit('connection'). In practice a Location redirect pointed elsewhere, a Content-Disposition named another file, and a Set-Cookie came back changed; this applies to TLS-terminat...
fix(agent-sre): free the HALF_OPEN probe slot when the probe is cancelled microsoft/agent-governance-toolkit
A probe cancelled with a BaseException never returned its HALF_OPEN slot, because CircuitBreaker.call's handlers catch only Exception and only record_success and record_failure reset the counter.
