akitaonrails/ai-jail v1.19.0

on GitHub

Added

• trust_project_config lets teams ship policy per repository again. List
  directories in the trusted global config and any project at or beneath one is
  merged with the same semantics as a global [commands.<name>] table, so its
  .ai-jail may enable capabilities rather than only tighten:

  # ~/.ai-jail
  trust_project_config = ["~/work/repos"]

  The default is unchanged — an empty list, nothing trusted. Trust is only ever
  conferred by the global config: a project .ai-jail that sets this field is
  ignored and reported. Matching is directory containment with both sides
  resolved first, so .. segments and symlinks cannot get an unlisted project
  past the check. Everything under a listed directory is trusted, including
  repositories cloned there later, so keep the list narrow. Thanks to
  @accictavandongen for the case (#104).

Fixed

• --systemd-user could never launch. Since v1.18.0 the runtime-directory
  masking covered the user bus socket that --systemd-user then binds, so the
  tmpfs made that path a directory and the bind failed with
  bwrap: Can't create file at /run/user/<uid>/bus: Is a directory. Masks now
  skip any destination being granted, while a mask on a parent is kept, so
  systemd/ still hides everything except the single socket bound inside it.
  Thanks to @zinga666 (#106).
• A symlinked global ~/.ai-jail is usable again, so dotfile managers such
  as GNU stow work. The project .ai-jail remains untrusted and is still never
  followed through a symlink; the global config is followed when the resolved
  target is a regular file you own, has no group or other write bits, and lies
  outside the project directory — a target inside the project could be
  rewritten by the very agent the policy constrains. Thanks to @zinga666 (#102).
• No more settings-free .ai-jail. A first run in a clean directory left a
  file containing nothing but the header comment. Auto-save now writes nothing
  when the config holds no settings; --init still writes a file to edit.
  --help also documents that --save-config is the default. Thanks to
  @zinga666 (#103).
• Nix: bwrap resolves from immutable store paths and from PATH, and the
  store protection check understands a user namespace reporting an unmapped
  owner as the overflow uid. Thanks to @pqitr (#105, #99).

Security

• The /nix/store exception for BWRAP_BIN is now decided by the kernel
  rather than by owner and mode bits alone: ai-jail asks whether it can
  actually write the store. That resolves unmapped owners, supplementary
  groups and ACLs correctly, and treats a read-only store mount as the
  protection it is. A root-owned but world-writable store is also rejected,
  which the previous check accepted.

Internal

• CI's package-install step is bounded and retried, and the jobs that run it
  have timeouts. It had been hanging for up to two hours instead of failing,
  blocking merges and releases.

Checksums (SHA256)

72cc75e322439234281a2911e2afc6b5d6f790b1edf5fd5de275a5be5b33f7c8  ai-jail-linux-x86_64.tar.gz
73f0149f0a0cec2d1782e56b8998990e61f461f5e98604152932cf233f6ff499  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail