$ the-wire · showcase
buffa breaks inferred collect() calls, sandbox-runtime fixes the proxy and Linux relays
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
buffa's FromIterator impls now take the bounds Extend does and break code that let collect infer its item type, while sandbox-runtime lands four fixes covering truncated upstream answers, HTTP/1.0 tunnel termination, write-deny bindings, and IPv6-less Linux hosts.
types: FromIterator for Struct and ListValue accepts the item types Extend does anthropics/buffa
Struct and ListValue FromIterator impls now take the same bounds as from_fields and from_values, matching the Extend impls added in #712 and FieldMask's behavior. This breaks existing code that left the item type for collect to infer: it now fails with E0283, which the PR calls out explicitly.
json: support a custom repeated_type on repeated enum fields anthropics/buffa
A repeated enum field with a custom repeated_type did not compile under generate_json(true): repeated_enum::deserialize and repeated_closed_enum::deserialize returned a concrete Vec, so a field typed CustomList<EnumValue<E>> or CustomList<E> failed with E0308 from both the derived and hand-generated Deserialize. Both now return any C: From<Vec<_>>, the shape proto_seq::deserialize has had since...
proxy: an answer that arrived whole is passed on anthropics/sandbox-runtime
An upstream that sends more bytes than the Content-Length it declared lost its whole answer in the proxy, which a server that counts characters for bytes does with any non-ASCII text; a client talking to that server directly just reads the declared bytes. The runtime's HTTP client was treating the surplus as the start of a next answer and reporting an error of the request after res.complete but...
In a terminated tunnel, an HTTP/1.0 client gets the whole answer anthropics/sandbox-runtime
In a TLS-terminated tunnel, an HTTP/1.0 client could lose the tail of a long response: with a Content-Length, curl reports transfer closed with N bytes remaining, and without one the file is silently short. The regression arrived with in-process termination (#666) and shows on Bun 1.4.3, while the Bun 1.4.2 that CI runs and Node are unaffected.
linux: a file above a write deny is kept there anthropics/sandbox-runtime
On Linux nothing can be created below a file, so a write deny beneath a file now binds that file read-only onto itself; several denies below one file lay a single bind, and the same applies to built-in denies such as denyWrite: ["f/x"] where f is a file. It also covers working directories that are worktrees or submodules.
linux: the relays in the sandbox name the family they listen on anthropics/sandbox-runtime
On a Linux host whose kernel lacks IPv6 with a socat that maps a plain TCP-LISTEN to IPv6 (1.8.0.0 per the issue), both sandbox relays exited at once and every proxied command was refused. Each relay now names its family: TCP6-LISTEN with ipv6only=0 to serve ::1 and 127.0.0.1 from one socket, or IPv4 alone with TCP4-LISTEN.
Enroll wolfSSL anthropics/oss-scanner
wolfSSL, submitted by core maintainer LinuxJedi, enrolled into the scanner. Also enrolling this window: webpack, from maintainer avivkeller, and jpadilla/pyjwt via a merge of the patch branch.
Action items
