$ the-wire · showcase
sandbox-runtime cleans up mounts, warns on writable installs
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
sandbox-runtime closed three silent failure modes in its filesystem layer while oss-scanner added cryptsetup, openssl, sccache and nx to its roster and claude-plugins-official renamed a Google plugin.
Glob walk: ask for the type of an entry that was listed without one anthropics/sandbox-runtime
When a filesystem lists directory entries without types (some NFS and FUSE mounts, XFS with ftype=0), every is...() check on those entries returned false, so the glob walk skipped them entirely and deny patterns like denyRead: <data>/**/.env silently missed <data>/x/.env and <data>/x/deep/.env, which main read and this branch refuses.
Warn when the library is installed where a sandboxed command can write it anthropics/sandbox-runtime
Installed as a dependency, the package sits in <project>/node_modules/, usually inside allowWrite, so a sandboxed command could rewrite it and the next srt run in that project would execute the result unsandboxed; earlier write-deny commits were reverted because they broke every sandboxed npm install on Linux and missed pnpm layouts, leaving only a warning.
linux: remove mount points when the last sandbox is done (#671) anthropics/sandbox-runtime
Mount points are now removed once the last sandbox is done, in the same cleanup pass that removes the library's temp objects at exit and after an initialize() that fails, so a repeated init/teardown cycle no longer leaves mounts or temp state behind.
Enrol cryptsetup anthropics/oss-scanner
cryptsetup joins projects/ with an Ubuntu 26.04 LTS image on OpenSSL 3.5: a reference meson build and a clang ASan+UBSan build carrying the libFuzzer targets, both using the OpenSSL crypto backend for Argon2 instead of a bundled one, plus the non-privileged smoke tests.
data-agent-kit: rename, repoint to GoogleCloudPlatform, bump to 1.0.0 anthropics/claude-plugins-official
Google's plugin repository moved from gemini-cli-extensions/data-agent-kit-starter-pack to GoogleCloudPlatform/data-agent-kit-plugin and released 1.0.0; the entry is renamed to data-agent-kit, a renames entry maps the old name so existing installs follow it, and the source is pinned to the 1.0.0 release commit. (The same rename was also merged.)
