$ the-wire · showcase
Claude Code edit tool escapes the workspace; OpenCode Desktop gets a plugin UI SDK
By RepoJournal · Filed · About Agentic Coding · Composed from the cited sources · methodology
19 people shipped this
copyberry
@copyberry
1 cited
Hona
@Hona
1 cited
neriousy
@neriousy
1 cited
jesussamuel-byte
@jesussamuel-byte
1 cited
lifeizhou-ap
@lifeizhou-ap
1 cited
Mohamed Hegazy
@mhegazy
GitHub Actions
@actions-user
goodman-oai
@goodman-oai
kitlangton
@kitlangton
rekram1-node
@rekram1-node
urielefrenvirtusa
@urielefrenvirtusa
duvanka-prasad
@duvanka-prasad
diegogodinezr
@diegogodinezr
VascoSch92
@VascoSch92
Dante
@Dante-dan
johnwschoi
@johnwschoi
jamadeo
@jamadeo
Cassian433
@Cassian433
TheSeydiCharyyev
@TheSeydiCharyyev
A TOCTOU race in Claude Code's edit tool lets writes land outside the workspace, while the rest of the day is about plugins and permissions: OpenCode opens a GUI extension surface, Codex reshapes its managed requirements file, and Gemini CLI stops burning retries on a spent budget.
TOCTOU Race in Edit Tool Allows File Writes Outside the Workspace anthropics/claude-code
A time-of-check/time-of-use race in the edit tool lets a path be swapped between validation and write, so an edit can land outside the workspace. If you run Claude Code against untrusted repositories or generated code, treat the sandbox boundary as advisory until this is fixed.
feat(plugin): add OpenCode Desktop GUI plugins anomalyco/opencode
A plugin package now ships a `./gui-experimental` export alongside its server and `./tui` entries, and Settings > Plugins lists both third-party and built-in plugins, which are themselves written against the same SDK. The companion API change hands GUI plugins toasts, dialogs, OS notifications, the app's own components, shell tabs, command execution, and read/write access to the composer, which...
Support `network_proxy` in managed requirements openai/codex
`requirements.toml` now accepts a `[network_proxy]` section, with `[experimental_network]` kept as a compatibility alias; specifying both in one layer is rejected, and the names are normalized before merging so precedence and source tracking survive. The new spelling is also honored during credential broker project discovery and shown in debug configuration, so if you manage Codex fleets centra...
fix(core): classify project spending cap errors as terminal quota errors google-gemini/gemini-cli
When a project hits its AI Studio spending cap, the API returns 429 or 400 with an empty `details` array, and `classifyGoogleError` was falling through to `RetryableQuotaError`. The CLI now treats the cap message as a terminal quota error instead of retrying and surfacing it as a transient rate limit.
Revert "fix(server): honor OPENCODE_SERVER_USERNAME for serve and --server" anomalyco/opencode
`serve` and `--server` stop honoring `OPENCODE_SERVER_USERNAME`, and `username` is removed from `ServerOptions`. The revert is explicitly not backwards compatible, so if you run OpenCode as a server with a custom username configured, authentication behavior changes on your next upgrade.
fix(deps): remove jsonwebtoken to avoid ignoring its cargo-deny advisories aaif-goose/goose
The long tail: goose dropped `jsonwebtoken` entirely, signing the service-account JWT in `gcpauth` with `ring` instead, which clears RUSTSEC-2026-0387 rather than adding a third ignored advisory.
Action items
- → Disable or restrict Claude Code's edit tool on untrusted repositories until the workspace escape race is patched anthropics/claude-code [immediate]
- → Replace OPENCODE_SERVER_USERNAME with a supported auth method before upgrading OpenCode serve deployments anomalyco/opencode [plan]
- → Migrate Codex requirements.toml to [network_proxy]; [experimental_network] is now only an alias openai/codex [plan]
