Release-note fact check — anthropic-experimental/sandbox-runtime

The diff adds a `maskClaims` configuration field to CredentialFileConfigSchema in sandbox-config.ts with full documentation; implements claim-level masking in credential-mask-files.ts via a new conditional block that calls `maskJwtClaims()` and registers per-claim sentinels; and includes comprehensive unit and end-to-end tests in credential-mask-files.test.ts demonstrating the feature masks named claims inside JWT payloads while preserving other claims real.

The diff adds `decode: z.enum(['jwt']).optional()` to CredentialEnvVarConfigSchema in sandbox-config.ts. Implementation in sandbox-manager.ts (line 729+) checks `if (v.decode === 'jwt')`, verifies the value with `verifyJwt()`, and replaces it with a fake JWT via `mintFakeJwt()`. Comprehensive test coverage in credential-mask.test.ts validates the feature end-to-end, including verification, fake-JWT generation, proxy token substitution, and fail-open behavior for non-JWT values.

The diff shows two new test suites ('env maskClaims masking on Linux (bwrap)' and 'end-to-end env maskClaims via SandboxManager') with comprehensive tests for maskClaims on JWT environment variables, including sentinel replacement, registry mappings, and proxy substitution. Configuration validation code in sandbox-config.ts enforces maskClaims constraints for envVars (requires decode, rejects empty list). The tests explicitly verify that named claims are masked with sentinels while other claims

The diff adds a new `decode` configuration option for credentials: src/sandbox/credential-decode.ts introduces JWT verification and masking functions (verifyJwt, maskJwtClaims, mintFakeJwt), and src/sandbox/credential-mask-env.ts implements the logic checking `if (v.decode === 'jwt')` to apply JWT-specific masking. Comprehensive tests in credential-decode.test.ts verify the JWT implementation. This directly implements the claimed feature.

The diff shows `bwrapArgs.push('--unshare-user', '--cap-drop', 'ALL', '--proc', '/proc')` added to the secure branch (`if (!enableWeakerNestedSandbox)`), replacing the previous `--proc /proc` only. A test has been added that explicitly asserts both `--unshare-user` and `--cap-drop ALL` are present in secure-mode output.

The diff shows a complete implementation of masked-credential substitution in request bodies: new `body-substitution.ts` module handles streaming sentinel→real substitution; `tls-terminate-proxy.ts` integrates it via `prepareBodySubstitution()` call; `http-proxy.ts` adds `getBodySubstitutions` option for the TLS-terminated path; comprehensive test file (`credential-mask-body.test.ts`) validates substitution across JSON, form-urlencoded, and multipart body formats.

The diff shows GRPC_PROXY/grpc_proxy variables changed from `socks5h://${auth}localhost:${socksProxyPort}` (removed code) to `${connectProxyUrl}` where connectProxyUrl resolves to `http://${auth}localhost:${httpProxyPort}` when an HTTP proxy port exists. Tests confirm the new behavior advertises http:// URLs with fallback to socks5h only when no HTTP proxy is configured. Comments explain gRPC C-core compatibility requirements for HTTP CONNECT proxies.

The diff shows package.json version bumped from 0.0.65 to 0.0.66, and the linked commit explicitly states 'Merge pull request #410 from anthropic-experimental/release/v0.0.66 (by shawnm-anthropic)', directly confirming all three elements of the claim: the v0.0.66 release, authorship by shawnm-anthropic, and PR #410.