$ the-wire · showcase
Sandbox-runtime fixes Node proxy bypass and Windows fence gaps
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
sandbox-runtime closed a path where sandboxed Node programs reached neither the network nor allowed hosts, plus three Windows sandbox defects, as Rails, tox, platformdirs, pipdeptree, and ureq maintaineders moved to enrol their projects in OSS Scanner.
Node's built-in HTTP clients use the sandbox's proxy anthropics/sandbox-runtime
Node's built-in fetch and http/https clients ignore HTTP_PROXY/HTTPS_PROXY unless NODE_USE_ENV_PROXY=1 is set, so a sandboxed Node program tried a direct connection, which the sandbox blocked, and failed even for allowed hosts. The library now sets that variable whenever it sets an HTTP proxy for the sandboxed command on every platform, and [::1] is added to NO_PROXY because Node does not match...
windows: network fence fix, a fuller fence check, and a loopback switch anthropics/sandbox-runtime
The BLOCK filter matched only tokens passing an access check on the sandbox account's SID, so an AppContainer token of that account did not match and a sandboxed process could start an AppContainer child that connected directly. The consolidated PR folds in #745, #746 and #747, including the match descriptor change and a loopback switch.
Enrol Ruby on Rails anthropics/oss-scanner
Rails joins the OSS Scanner project list alongside three Python projects enrolled by gaborbernat (tox, pipdeptree, platformdirs) and algesten's ureq, the Rust HTTP/1.1 client that handles TLS, redirects, credentials, cookies and connection pooling. ureq's enrolment frames the case plainly: "Vulnerabilities in these boundaries can affect applications using the library."
windows: write-restricted token, kept grants, profile read grant anthropics/sandbox-runtime
At session end the Windows sandbox restored deny entries even when the grant revoke had failed, so a deny could come off while an allow was still on disk; the restore now runs only when every grant is gone or still legitimately held, and the broker enforces that rule itself. This PR folds in five earlier ones (#708, #712, #729, #730, #733) covering the write-restricted token and profile read gr...
v2.1.304 anthropics/claude-code
v2.1.304 adds `decider: "person"` to a mod's tool.check answer, so only the permission dialog or a host callback can approve the ask and it is refused with the mod's reason where nobody can be asked, plus `e.isReadOnly` on the tool.check event and a new /auto-mode-setup command. The claude-code-action CI job moved to Claude Code 2.1.304 and Agent SDK 0.3.304 the same day.
Action items
- → Upgrade claude-plugins-official to pick up security-guidance changes: nested repositories in the work tree are no lon... anthropics/claude-plugins-official [plan]
- → Upgrade sandbox-runtime so sandboxed Node commands get NODE_USE_ENV_PROXY=1 and stop failing on allowed hosts anthropics/sandbox-runtime [plan]
