Issues

• [BUG] Linux: a tool cannot reach a granted file through a symbolic link, so #!/bin/sh scripts fail with ENOENT

  Area - Agent ContainmentArea - Tool Containment (Binaries/Local MCP)buglinux
  Bug

  strands-agents/box#453 · Filter by author pgrayy opened on Nov 13, 2026

• [BUG] Linux: a box refuses chown to the file's own owner, so pnpm cannot write its lockfile

  Area - Agent Containmentbuglinux
  Bug

  strands-agents/box#450 · Filter by author pgrayy opened on Nov 13, 2026

• Shell: three stdin behaviours differ from bash

  Area - Shell/Montybug
  Bug

  strands-agents/box#440 · Filter by author abhisheksp opened on Nov 13, 2026

• [FEATURE] Return actionable network failure details to agents and distinguish them from policy denials

  Area - Egress/CredsArea - policy-engineArea - Shell/MontyArea - Telemetryenhancement
  Feature

  strands-agents/box#428 · Filter by author morganwilliscloud opened on Nov 12, 2026
  2

• [FEATURE] macOS: support native file watching without exposing denied paths

  Area - Agent ContainmentArea - Tool Containment (Binaries/Local MCP)enhancement
  Feature

  strands-agents/box#419 · Filter by author pgrayy opened on Nov 12, 2026
  2

  

• Tool grammars: expressiveness gaps found modeling 13 real CLIs

  Area - Tool Containment (Binaries/Local MCP)design
  Design

  strands-agents/box#408 · Filter by author ferdingler opened on Nov 11, 2026

• [BUG] A rule on an MCP tool's own ::response loads but never matches

  Area - policy-engineArea - Tool Containment (Binaries/Local MCP)bug
  Bug

  strands-agents/box#396 · Filter by author akujane opened on Nov 11, 2026

• [BUG] macOS: a program in a box cannot open /dev/stdin, so dtrace -h fails and crates that use usdt (cargo-nextest) do not build

  Area - Agent Containmentbug
  Bug

  strands-agents/box#380 · Filter by author hanaduy opened on Nov 9, 2026

• [BUG] macOS: torch aborts at start in a box: OpenMP can't open its shared memory, and four hw.* sysctls are refused

  Area - Agent ContainmentArea - Tool Containment (Binaries/Local MCP)bug
  Bug

  strands-agents/box#379 · Filter by author hanaduy opened on Nov 9, 2026
  1

• [BUG] macOS: a box refuses lstat("/tmp"), though it allows /etc and /var

  Area - Agent Containmentbug
  Bug

  strands-agents/box#378 · Filter by author hanaduy opened on Nov 9, 2026

• Publish a Linux x86_64 (amd64) release archive

  Area - Releaseenhancement
  Feature

  strands-agents/box#376 · Filter by author csantanapr opened on Nov 8, 2026

• [FEATURE] Set YARN_HTTPS_PROXY and YARN_HTTP_PROXY to the gateway URL

  Area - Egress/Credsenhancement
  Feature

  strands-agents/box#374 · Filter by author abhisheksp opened on Nov 8, 2026

• [FEATURE] Let a lookup of a missing file above the project fail as missing, not refused (macOS)

  Area - Agent Containmentenhancement
  Feature

  strands-agents/box#372 · Filter by author abhisheksp opened on Nov 8, 2026
  1

• A profile cannot give the workload the host CPython as python3

  Area - Shell/MontyArea - Tool Containment (Binaries/Local MCP)bug
  Bug

  strands-agents/box#371 · Filter by author abhisheksp opened on Nov 8, 2026
  3

  

• Egress gateway reports a transient upstream DNS failure as a policy deny

  Area - Egress/Credsbug
  Bug

  strands-agents/box#370 · Filter by author abhisheksp opened on Nov 8, 2026

• [BUG] Intercepted TLS refuses absolute-form request targets, which Yarn 4 sends inside the tunnel

  Area - Egress/Credsbug
  Bug

  strands-agents/box#366 · Filter by author prescod opened on Nov 7, 2026

• [BUG] strands-box-egress-gateway built on its own has no TLS 1.2: rustls's tls12 feature is off

  Area - Egress/Credsbug
  Bug

  strands-agents/box#365 · Filter by author prescod opened on Nov 7, 2026

• [BUG] Egress gateway gives no reason when an admitted request fails

  Area - Egress/Credsbug
  Bug

  strands-agents/box#364 · Filter by author prescod opened on Nov 7, 2026

• Linux: seccomp refuses pselect6, so cargo fetches and Python sleeps fail in a box

  Area - Agent Containmentbug
  Bug

  strands-agents/box#363 · Filter by author abhisheksp opened on Nov 7, 2026

• MCP datetime and duration arguments: normalize, and type them in the temporal event

  Area - policy-enginebug
  Bug

  strands-agents/box#362 · Filter by author abhisheksp opened on Nov 7, 2026

• [BUG] The box shell's touch takes no options and does not update an existing file's times

  Area - Shell/Montybug
  Bug

  strands-agents/box#361 · Filter by author zastrowm opened on Nov 7, 2026

• [FEATURE] Add deployment integration tests for Lambda MicroVM, EKS, and AgentCore Runtime

  Area - Releaseenhancementlinux
  Feature

  strands-agents/box#355 · Filter by author kevin-orellana opened on Nov 6, 2026
  

• [BUG] macOS: Go-based CLI tools (gh) fail TLS certificate verification (x509: OSStatus -26276) inside [tool.*] sandboxes

  Area - Egress/CredsArea - Tool Containment (Binaries/Local MCP)bug
  Bug

  strands-agents/box#344 · Filter by author prescod opened on Nov 6, 2026
  1

• [TRACKING] Profile and reduce local test and validation runtime

  Area - Releaseenhancement
  Feature

  strands-agents/box#336 · Filter by author pgrayy opened on Nov 5, 2026
  2

• [BUG] A file redirected into a Shell command reaches the program empty, and silently

  Area - Shell/Montybug
  Bug

  strands-agents/box#319 · Filter by author hanaduy opened on Nov 5, 2026
  1