$ the-wire · showcase
Judge prompts stop leaking to hooks-server logs
By RepoJournal · Filed · About Agent Security · Composed from the cited sources · methodology
NeMo Guardrails fixed a default-on log leak of raw tool-call arguments and now requires Relay 0.11 to stop double-running guardrails at Claude Code and Codex permission prompts, while Snyk's agent-scan widened what it can actually find on disk.
fix(hooks): keep judged tool arguments out of hooks-server logs NVIDIA-NeMo/Guardrails
`nemoguardrails hooks-server` was writing judged tool arguments into its logs at the default level, because the command sets the root logger to INFO and `nemoguardrails.llm.call` logs every prompt and completion at that level, with the tool safety check's judge prompt rendering the call's arguments verbatim. If your Bash or file-writing tool calls pass through a judge today, expect raw argument...
fix(relay): prevent duplicate checks by requiring Relay 0.11 NVIDIA-NeMo/Guardrails
The `nvidia.nemo_guardrails` Relay plugin now builds against Relay 0.11 and requires 0.11.0 or later (a 0.11.0 release candidate qualifies). Through Relay 0.10, reaching Claude Code's or Codex's permission prompt ran the guardrail twice, once on `PreToolUse` and again at the prompt; upgrading the plugin without upgrading Relay leaves you on the old behavior or worse.
fix: discover Antigravity 2.0 skill paths snyk/agent-scan
Agent Scan previously missed Antigravity 2.0's canonical global and bundled skill directories and did not recognize standalone CLI-only installs, so scans reported only a subset of skills unless you added scanner-specific symlinks. Scans now cover `~/.gemini/config/skills` and `~/.gemini/antigravity-cli/builtin/skills`, recognize `~/.gemini/antigravity-cli` as an install, and preserve legacy pa...
fix(server): forward max_completion_tokens to the main LLM NVIDIA-NeMo/Guardrails
The server now accepts and forwards top-level `max_completion_tokens`, giving chat completion requests a completion-token budget that counts reasoning tokens where the backend supports it. Both token-limit fields are covered across engines and response modes.
chore(deps-dev): Bump @typescript-eslint/parser in /agent-governance-python/agent-os/extensions/copilot microsoft/agent-governance-toolkit
The quieter tail: the dev-only `@typescript-eslint` parser and eslint-plugin in the copilot extension moved to 8.72.1, and shipped NVIDIA examples replaced retired OpenAI model IDs (GPT-3.5 with `gpt-4o-mini`, GPT-4 and GPT-4 Turbo with `gpt-4o`) so copy-pasted samples no longer 404 on the first request.
Action items
- → Upgrade NeMo Relay to 0.11.0 or later alongside the nvidia.nemo_guardrails plugin NVIDIA-NeMo/Guardrails [immediate]
- → Audit hooks-server logs at default INFO level for judged tool-call arguments and rotate any credentials they exposed NVIDIA-NeMo/Guardrails [immediate]
