akitaonrails/ai-jail v1.18.2

on GitHub

Fixes

• Linked git worktrees are usable again. A worktree keeps its object
  database, refs and packed-refs in the shared common dir, which v1.18.0 began
  mounting read-only, so every git add and git commit inside a worktree
  failed with error: unable to create temporary file: Read-only file system.
  Both the per-worktree git dir and the common dir are writable again outside
  lockdown; --lockdown still keeps both read-only. Thanks to @zinga666 for
  the report (#101).
• Claude Code works on macOS again. The seatbelt profile denied ioctl on
  the child's own terminal, so the agent could not put its stdin into raw mode,
  and it had no write access to the /tmp/claude-<uid> directory Claude Code
  creates unconditionally at startup. Thanks to @dwbessa (#100).
• Nix support. bwrap is now resolved from immutable Nix store paths and
  from PATH, base mounts that do not exist on a host (/usr, /opt) are
  skipped instead of aborting the launch, and the sandbox-escape tests build
  hermetically. Thanks to @pqitr (#99).

Security

• The macOS terminal ioctl grant is scoped by path to the single PTY ai-jail
  allocated for the run. A pattern covering every /dev/ttys* would also reach
  the user's other terminals, and since SBPL cannot filter by ioctl request
  number that would permit TIOCSTI keystroke injection into another shell.
  When ai-jail is not proxying a PTY, no terminal ioctl is granted at all.
• The non-root /nix/store exception for BWRAP_BIN now also requires a store
  the invoking user cannot write. A single-user store owned by that user does
  not qualify, because anything running as them could otherwise supply a fake
  bwrap and silently disable the sandbox.
• Sandbox-escape assertions stay strict: the skip path is limited to the two
  probes that can legitimately have no read-only system directory, instead of
  applying to every escape test.
• A missing literal mask or deny_paths entry is reported through the
  security warning channel, so a dropped rule stays visible under --exec.
• CI keyring detection no longer fails open. It used ls <file>.asc *.gpg,
  whose unmatched glob made ls exit non-zero even with a key present, so tag
  signatures were never actually verified. v1.18.2 is the first release whose
  tag signature CI verifies against the pinned key.

Documentation

• Herdr integration: what it detects, why the working directory already
  matches, and why its control socket must not be mounted into the sandbox.
• Corrected the linked-worktree, BWRAP_BIN, macOS temp, and macOS display
  descriptions, and restored the install and troubleshooting content dropped in
  the v1.18.0 README rewrite.

Checksums (SHA256)

2bef06396e039e4ef99f5f1e9d3be9794e22214ff8535bc59ac926ad88f2f386  ai-jail-linux-x86_64.tar.gz
9c1f5028d1ac8dd2c6595b54ce25dd5a20f166cea073ec2a4dfb565b52722b09  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail