[ronleizrowice-ant]

Version fields only: package.json and package-lock.json say 0.0.80. To be merged last, right before the release is published on tag v0.0.80: the release workflow refuses a tag that does not match package.json.

What 0.0.80 carries over 0.0.79

• Per-command network allow lists, and deny reasons from the ask callback #591: only true from the ask callback allows a connection; a deny can carry a reason; per-command network allow lists.
• windows: a path in both deny lists keeps the read deny #656 (Windows): a path in both deny lists keeps the read deny.

For whoever upgrades

• A callback that answers with anything but true to allow (1, a string, an object) now denies.
• ISandboxManager has three new members: registerCommandNetworkLists, unregisterCommandNetworkLists, askCallbackDenyReason.

Checked

Built from this branch, srt --version prints 0.0.80, from a compiled binary too; a sandboxed command runs and a ** read deny holds; through the real proxy only true lets a connection through, and a per-command list works with its id only; npm pack --dry-run names the tarball anthropic-ai-sandbox-runtime-0.0.80.tgz. Against main, no source file changes.

[ronleizrowice-ant]

/approve 10acfa2

[antdres]

No blockers in the diff at 10acfa2: the version fields in package.json and package-lock.json go from 0.0.79 to 0.0.80 and nothing else. It merges clean into today's main.

Two things to settle before the tag, neither in this diff:

• The tip of main (0ded0c8, the #698 merge) is red on Tests (macos / arm64): git-over-ssh.test.ts:1051 got sandbox proxy: 127.0.0.1:49711: no answer. macOS x86-64 passed on the same commit and arm64 passed on the commit before, so it may be a one-off, but it is the git-over-SSH path people are waiting on. Worth a re-run before publishing.
• The description is from Oct 7 and lists #591 and #656. 0.0.80 now carries 36 PRs over 0.0.79. The ones an upgrader will notice: #588 (a sandboxed command can no longer create user namespaces by default, so Chromium/Electron's own sandbox, rootless podman and a nested bubblewrap need allowNestedUserNamespaces: true), #684 (an allowWrite beneath a denyWrite directory is read-only on Linux) and, once #718 lands, the bracket readings noted there.

This PR's own checks last ran on Oct 7, on a much older main; that is fine for a version-only change as long as main is green when the tag is made.

---

Generated by Claude Code