Bromure Agentic Coding 5.4.0

Highlights

• OpenShell sandbox policies. A workspace can now run under an NVIDIA OpenShell policy (YAML, schema v1) instead of Bromure's firewall rules. The policy is enforced at the network switch, the TLS SNI, the proxy and per request: REST, WebSocket, MCP, JSON-RPC and GraphQL inspection, audit or enforce. Bromure's evaluator matches OpenShell's own (0 mismatches over 125,000 differential cases). Inside the VM, the policy's filesystem, Landlock and process sections are enforced by a guest sandbox, and binaries rules are checked against the program the VM's attestor saw.
• Kernel sentry. A tamper-resistant kernel module watches the workspace from inside the guest: what it executes, what it connects to, and what the sandbox refuses. Modules are built daily for every Ubuntu kernel, signed, and fetched on demand, so a workspace that upgrades its kernel gets a matching module at its next boot (about 6 s for a kernel the VM hasn't seen yet).
• Network lineage. Every connection out of a workspace can be traced end to end: the prompt, the model's reasoning and the tool call's stated intent → the tool call → the process chain → the connection → the host's decision. Double-click a Network row in the Security Timeline.
• Sandbox drawer. A shield button in the workspace toolbar (⌃⌘N, with a badge for new blocks) lists blocked connections and files. Allow one on the spot (with a time limit under the Bromure Firewall), review the policy advisor's proposals, or manage temporary rules.
• The agent is told when policy blocks it. When the firewall or sandbox refuses something, the agent gets a short note: what it tried, that policy forbids it, the rule's reason, and to ask you instead of working around it. It is on by default for OpenShell workspaces.
• Squelch (rtk in Bromure). The proxy trims the noise out of command output before the model reads it: passing tests, download and build progress, transfer counters, repeated log lines and progress bars. Errors, failures, warnings and summaries are kept, and file reads, diffs and pipelines the agent shaped itself are never touched. It works for every agent with nothing installed in the VM. Each session header shows what it saved. It's off by default, per workspace.
• Package installs without root. Under the OpenShell engine, pip installs into the home folder, and apt-get install becomes a request in the Sandbox drawer. Once you approve it, Bromure installs exactly those packages as root.
• Security window, reworked. Filter by workspace and time range, keep history from 7 days to forever, and click from the Overview straight to what you want in the Timeline (details below).

GitHub issues fixed

• #54: Override a supply-chain block per package. An OSV or socket.dev block no longer fails silently (a bare 451). The download is held and you're asked: allow for this session, always allow in this workspace, don't allow, or not now. Settings › Supply Chain has a Trusted packages list, and a blocked row in the Security window offers Allow…. A malware verdict is never offered.

• #53: Security window. The Timeline filters by workspace and time range (last hour, 24 h, 7 d, 30 d, all). History is kept for 7, 30, 90 or 180 days, 1 year or forever (it used to be a fixed 90 days). In the Overview, a workspace name opens the Timeline on it, a Latest block opens every instance of it, and repeated blocks fold into one row with a count.

• #52: with scroll bars set to "Always" (or a mouse attached), the chat composer no longer flips between two heights on every layout.

• #51: switching windows keeps a scrolled-back terminal where it was, instead of dropping it a screen. Scrolling the wheel no longer collapses a copy-mode selection onto the top line.

• #43, reopened: a uv sync no longer raises a pile of "unverified package" panels counting down together and stuck at "0 s". Questions come one at a time per workspace, with choices that fit a package:

  • allow this version;
  • allow all unverified packages for 15 minutes;
  • don't allow unverified packages for the rest of the session;
  • don't allow this version.

  The prompt and the Supply Chain log say why socket.dev gave no verdict: no answer, key refused, rate-limited, not analysed yet, or unknown version.

New

• Settings › Sandbox Policy (formerly Firewall):
  • One Sandbox engine menu: Bromure Firewall (the rule table) or OpenShell + Sentry (the policy, the guest sandbox and the kernel sentry).
  • Settings are laid out in cards, one line per setting, with the full explanation behind an ⓘ.
  • Protections that apply to either engine move to Guardrails: telling the agent, the watchdog, strict credentials, transparent interception and the insecure bypass.
• OpenShell extras:
  • a policy advisor at http://policy.local that drafts and approves rules;
  • import of OpenShell provider profiles (credentials bound to a host and path), in the Credentials pane;
  • strict credential mode (block credentials Bromure didn't inject);
  • an organization boundary with managed policy sync;
  • an agent watchdog that quarantines a workspace whose behaviour drifts;
  • policy revision history;
  • OCSF 1.8 JSONL export of security events.
• Security Timeline:
  • what the guest sandbox refused: program, operation, path or syscall, with identical denials folded and a probing alarm;
  • sentry tampering shown in red;
  • raw packet sockets shown as "raw frames on ";
  • for OpenShell workspaces, a Sandbox column and a Guest sandbox tile.
• Coding tasks: a task's question opens in a sheet with the whole question rendered as markdown and a multi-line answer field. ⌘↩ sends, and Esc keeps the draft.
• iPhone/iPad: New session, Coding Tasks and Automations sit at the top, as on the Mac. Workspaces are split into Virtual Machines and Native Machines (Sidecar Macs).
• Sidecar: when a Start is refused, the remote client shows the Sidecar's reason instead of doing nothing.

Security

• Event redaction: command lines (process arguments, tool commands, tool-input summaries) lose their secrets before they're recorded in the Security Timeline or uploaded to the organization's event stream. Known token formats become their fingerprint label. Passwords, Authorization / API-key / cookie values, --password / --token arguments, KEY=value secrets and URL credentials become ***. This includes curl's clustered and glued -u, -b and -E forms and its passphrase options. rsync -u, git checkout -b and directory variables are left alone.
• Delegation inbox: on the Sidecar, Claude no longer reads or edits ~/.bromure/inbox without a prompt. In VMs, Read stays but Edit now prompts.
• Automations:
  • A process in the VM can no longer fail another run, or mark a run the VM refused as finished (which moved the review mark and fired chained automations).
  • Two fires in the same minute no longer share an identity.
  • Refusals of runs started together are each recorded.
• Review fetch: a repository's uploadpack or a file:// rewrite can no longer run a program during the review's base fetch.
• Sandbox apt requests: an approved name installs only that exact package. A name apt would read as a pattern or a removal is refused.
• Organization boundary: every workspace save is checked, including an Allow from the Sandbox drawer.
• Policy notes: notes to the agent come only from the host's read-only share. Values the VM chose are quoted as data, never instructions.
• Network lineage: a VM can't relabel another connection by claiming its client port.
• Kernel sentry:
  • Module catalogs and every module are signed and verified.
  • Under a hard sentry, the workload is held until the sentry is up.
  • A "Don't intercept container traffic" option developed during this cycle was withdrawn before release: no in-band mark can prove a packet came from a container when the VM has root. Container traffic is always intercepted.
• socket.dev: a malformed Go module path from the VM can no longer crash the host proxy.

Fixes

• Crash in 5.2.3: a browser_evaluate that returned a bare number, boolean or null raised an exception inside a background task. That corrupted the app's main-thread state and crashed it later, at an unrelated point. The value is now encoded correctly. Should an exception escape a background task again, it is logged with its stack. A remote-client window then quits at once with the exception named, while a Mac running its own VMs keeps them up.
• Kubernetes:
  • A kubeconfig added to a running workspace gets its cluster CA and client certificate at once; it used to need a restart.
  • Closing one workspace no longer stops every other workspace's exec-token refresh.
  • A live refresh no longer briefly sends an empty exec token or a raw op:// reference.
• Chat: a new session in a reused window no longer opens on the previous session's transcript or unsent draft.
• Coding tasks:
  • An answer stays in the sheet until the board has taken it. A refusal keeps the text and says why, and an answer drafted for one question never goes to the next.
  • On the remote client, an empty reply is no longer taken as accepted.
• Automations:
  • A review whose base couldn't be fetched is a failed run, not a green finished one.
  • Reviews of git@ / ssh:// origins fetch their base through the host's SSH agent; they used to start from local HEAD.
• Sidecar: an agent scan cut short by a slow login shell no longer marks every agent missing or leaves Manage Agents spinning. A folder named like an agent no longer counts as one.
• Compromise wipe: a confirmed wipe refused because the disk was already open now says so, instead of looking like Cancel.
• Guest:
  • Login shells never prompt for a sudo password.
  • Grok and omp stay readable under a filesystem policy that doesn't list /opt.
  • Under an OpenShell policy, the workspace's git calls wait for the sandbox instead of running unconfined.
• Boots under a hard kernel sentry wait for the module to load instead of failing unattended starts at 180 s.

Full changelog: agentic-coding-v5.2.3...agentic-coding-v5.4.0