$ the-wire · showcase
Windows push keys survive uninstall, and managed installs can skip absent agents
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
snyk/agent-scan shipped two operator-facing changes: a fix so guard uninstall actually revokes the push key on Windows, and an opt-in guard install --check-installed flag for managed (MDM) installs.
fix(guard): carry tenant id in PowerShell hook command so uninstall revokes push key (#522) snyk/agent-scan
guard uninstall recovers the tenant id from the installed hook command before revoking the push key, but only the POSIX form ever emitted TENANT_ID=; the PowerShell form never carried it, so _try_revoke_push_key bailed and the push key was silently left live on Windows. The fix renders -TenantId '<tenant>' into the PowerShell command and accepts an optional -TenantId parameter in snyk-agent-gua...
feat: [ADS-1434] Optionally skips non-installed agents on hooks installation in managed mode snyk/agent-scan
Managed installs gain an opt-in guard install --check-installed flag that skips agents not present on the machine; an agent counts as installed if any readable user home has it, and the run fails fast when no homes are enumerable. Default --managed behavior is unchanged, so existing MDM deployments need the flag added to benefit.
fix(agent-sandbox): give Docker checkpoints a valid repository for any agent id (#4370) microsoft/agent-governance-toolkit
create_session accepts agent ids with uppercase letters and leading, trailing or repeated separators, but checkpoints were committed to the repository agent-sandbox-<agent_id>, which docker commit rejects for those ids because repository names must be lowercase and each component must start and end alphanumeric. Those sessions' checkpoint commits failed; the checkpoint image name is now sanitiz...
fix(docs): Bump fern version to match org-wide pin (#2480) NVIDIA-NeMo/Guardrails
Guardrails' docs CI was failing because Nvidia moved to an org-wide Fern pin of 5.167.0 while the repo pinned 5.123.0 in fern/fern.config.json; the bump aligns the two. The failures did not reproduce locally: duplicate title and alt text in image inserts tripped 5.167.0's checks.
chore(deps-dev): Bump vite from 8.0.16 to 8.3.5 in /agent-governance-python/agentmesh-integrations/mastra-agentmesh microsoft/agent-governance-toolkit
Also in the tail: dev-dependency bumps only. vite moves from 8.0.16 to 8.3.5 and @vitest/mocker to 4.1.12 with vitest updated alongside it, both confined to the mastra-agentmesh integration's test and build tooling. No runtime or operator-visible change.
Action items
