Release-note fact check — anthropic-experimental/sandbox-runtime

The diff introduces a complete passive seccomp USER_NOTIF observer for Linux: (1) new `linux-violation-monitor.ts` creates a filesystem unix-socket listener that processes observed write-intent syscalls as JSON lines; (2) `linux-sandbox-utils.ts` integrates the monitor by binding its socket into the sandbox and setting SRT_OBSERVE_SOCK env var; (3) `apply-seccomp.c` implements the core observer with explicit SECCOMP_RET_USER_NOTIF filter (build_observe_bpf, send_fd/recv_fd, worker-side installat

The diff shows import of Node's native `crypto.sign` (line `import { sign as cryptoSign } from 'node:crypto'`) and two new functions—`signCertificateNative()` and `rsaSha256SignNative()`—that explicitly replace node-forge's pure-JS RSA signing with native crypto. The `generateEmptyCrl()` change replaces `key.sign(digest)` with `rsaSha256SignNative(...)`, and a test verifies byte-for-byte equivalence between the native and forge paths, confirming the claim's implementation.

The diff adds new `credential-extract.ts` implementing regex-based extraction via `extractAndSubstitute()` (lines 87-154), and `credential-mask-env.ts` integrating it into env-var masking with structured capture support (lines 99-113), plus comprehensive tests verifying the feature works for DATABASE_URL password masking and other scenarios.

New function resolveSymlinkedDenyPath() (src/sandbox/linux-sandbox-utils.ts:129–200) explicitly canonicalizes deny paths through symlinks before computing masks. Integration in generateFilesystemArgs() applies this resolved path to all bwrap bind operations (line 1007: const normalizedPath = resolveSymlinkedDenyPath(rawPath)), with comments stating 'resolve-before-mask' intention. Comprehensive test suite in symlinked-deny-paths.test.ts validates symlink resolution across relative/absolute/dangl

Code explicitly deletes both `generated.NO_PROXY` and `generated.no_proxy` from the Windows sandbox environment overlay (windows-sandbox-utils.ts lines 1263–1264), with a detailed comment explaining the Windows WFP fence behavior. The test suite verifies both variables are absent from the --env overlay (winsrt.test.ts lines 319–320), confirming the fix works as claimed.

All three elements of the claim are directly supported by the diff: (1) `--quiet` flag parsing for exec is tested and implemented (cli.rs test `exec_quiet_flag_parses()` and winsrt.test.ts integration test); (2) broker share-locks current_exe via new `share_lock_current_exe()` function in self_protect.rs, integrated into cli.rs exec path with `--quiet` gating warnings; (3) kill-chain regression test `H-kill-chain: taskkill /F on the broker reaps the sandboxed child` comprehensively validates Job

The diff shows WindowsBinShell changed from a discriminated union (kind: 'cmd'|'powershell'|'pwsh'|'bash'+path) to a simple two-field object {exe: string, args: readonly string[]}. This is reflected in the type definition (lines 145–149), parseWindowsBinShell refactored to return the new shape (lines 160–234), wrapCommandWithSandboxWindows simplified from a switch on sh.kind to argv.push(sh.exe, ...sh.args, p.command) (lines 1359–1360), and all tests updated to expect {exe, args} structure. The