akitaonrails/ai-jail v1.18.0

on GitHub

Security-default migration

• Network, GPU, display, X11, host shared memory, terminal passthrough,
  macOS host IPC, and linked-worktree metadata are now explicit opt-ins.
• Private home is now the default. Agent state is mounted only for the invoked
  command; use --no-private-home only when deliberately granting broad host
  home access.
• Project .ai-jail files are untrusted monotonic policy: they may tighten a
  sandbox but cannot enable capabilities. Put capability opt-ins in global
  config or on the CLI.
• --allow-tcp-port remains accepted for compatibility but now fails closed:
  UDP cannot be constrained safely. Use --network only when unrestricted
  network access is explicitly acceptable.
• Agent credential state is opt-in. Private home no longer mounts state like
  Claude's ~/.claude automatically; pass --agent-state (or set
  agent_state = true in the command's global [commands.<name>] table) to
  expose it. This applies on Linux and macOS.
• The environment is a minimal allowlist by default. Pass named variables with
  repeatable --env NAME[=VALUE], or the full parent environment with
  --inherit-env only when you accept exporting every secret in your shell.
• The update check is off by default; enable it explicitly with
  --update-check. Launches otherwise make no outbound requests.
• Browsers do not imply connectivity: --browser still requires explicit
  --network and, on Linux, --display (or --x11) to reach the network or
  open a window. On macOS the display is system-level, so only --network
  applies there.
• Terminal output from the agent is filtered through a VT parser by default;
  --terminal-passthrough restores raw terminal forwarding.

See SECURITY.md for the capability matrix and residual

Checksums (SHA256)

1badaced9d8347db9a97141eefaa125974b1b7f384fe4e6fddad0c6377f7de20  ai-jail-linux-x86_64.tar.gz
b539fb63f1d6aff12dbeaa41f5bc6e34b5bbdde37e202e10035ed090289dcc9c  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail