$ the-wire · showcase
security-guidance findings reach stderr, and sandbox ignoreViolations types match the CLI
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
The security-guidance plugin's findings were being displaced by unrelated warnings and its gateway reviews were failing outright, while the Python agent SDK shipped a type fix that corrects how sandbox violation allowlists are actually read.
security-guidance: deliver commit and push findings on stderr (#6379) anthropics/claude-plugins-official
Commit and push findings used to go only into hookSpecificOutput.additionalContext, which Claude Code's asyncRewake path never reads; when the inner reviewer's CLI wrote a warning to stderr, that warning reached Claude instead of the findings. They now go to stderr for every event, matching the Stop path, which closes the silent-miss class reported in claude-code issues 99839 and 92987.
security-guidance: send ANTHROPIC_CUSTOM_HEADERS on the plugin's own API calls anthropics/claude-plugins-official
The plugin's own /v1/models lookup and the review call never sent ANTHROPIC_CUSTOM_HEADERS, so any gateway that authenticates on a custom header, such as LiteLLM with x-litellm-api-key, answered 401 and the review never ran. The headers are now parsed the way Claude Code parses them.
fix(types): type sandbox ignoreViolations as a command-pattern map anthropics/claude-agent-sdk-python
SandboxSettings.ignoreViolations was typed as a {"file": [...], "network": [...]} TypedDict, but the CLI reads it as a map from a command substring ("*" for every command) to substrings of the violation text, so a "file" list only applied to commands whose text contained "file". SandboxIgnoreViolations becomes dict[str, list[str]]; if you were relying on the old keys, your suppressions were nev...
Merge pull request #6375 from anthropics/mhegazy/sg-review-failures anthropics/claude-plugins-official
A review that failed for any reason used to be reported as clean. Failures are now surfaced as failures, so a green result means the review ran.
feat(managed_agents): move plan-big-execute-small to multiagent_20261001 anthropics/claude-cookbooks
The plan-big-execute-small recipe now uses the multiagent_20261001 type instead of the older coordinator type, listing the small-model worker under subagents.predefined_agents with subagents.inline_agents and workflows set to disabled. Elsewhere, oss-scanner added a workflow_dispatch trigger taking a pull request number so maintainers can triage the 76 open enrolments opened on 8 and 9 October ...
Action items
- → Replace ignoreViolations file/network keys with a command-substring map in claude-agent-sdk-python sandbox settings anthropics/claude-agent-sdk-python [plan]
