$ the-wire · showcase
Sandbox-runtime closes silent data loss, Agent Guard gets release 0.6.9
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
Anthropic's sandbox-runtime shipped fixes for two failure modes that quietly corrupted or truncated responses, while snyk/agent-scan cut 0.6.9 with a bounded, fail-open forwarder request.
Never rewrite a request target silently anthropics/sandbox-runtime
A request target that the proxy had to rewrite is no longer silently substituted: the sandbox now refuses to pass on an altered target rather than let the client act on a destination it never asked for. This closes a class of mismatch where the request that left your sandbox was not the one you wrote.
chore: prepare release 0.6.9 (#513) snyk/agent-scan
Version 0.6.9 of snyk/agent-scan is cut and carries the forwarder change from #512. Its practical effect: a hook request that hangs instead of failing now has a timeout, and transport errors fail open instead of stalling your agent.
fix: bound the Agent Guard forwarder request and fail open on transport errors snyk/agent-scan
The Agent Guard forwarder scripts had no timeout at all, so a request that hung on a proxy or middlebox blocked the hook until something else killed it. The script half now bounds the request and fails open on transport errors; note that until the companion agent-side timeout lands, Copilot's 30 s default and Claude Code's UserPromptSubmit still kill the hook first and you do not get the warning.
linux: the relays in the sandbox name the family they listen on anthropics/sandbox-runtime
On Linux hosts whose kernel has no IPv6 and a socat that treats a plain TCP-LISTEN as IPv6, both sandbox relays exited immediately and every proxied command was refused with nothing on 3128 or 1080. Each relay now names its family explicitly, IPv6 with IPv4 mapped in or IPv4 alone.
linux: a file above a write deny is kept there anthropics/sandbox-runtime
A file sitting above a write-denied path used to be a hole in the deny: Linux will not create anything below a file, so the file is now bound read-only onto itself, the same treatment an existing denied path gets. Write denies below a file, including built-in ones, are enforced as configured.
Action items
- → Upgrade snyk/agent-scan to 0.6.9 to pick up the bounded forwarder request snyk/agent-scan [plan]
