v1.21.0

Added

• --audio restores host audio inside the sandbox (Linux). Since
  v1.18.0 stopped bind-mounting the whole XDG_RUNTIME_DIR, the
  PipeWire/PulseAudio sockets disappeared from the sandbox and Chromium
  (or any other audio client) launched through ai-jail silently lost
  sound — there was no opt-in to get it back. --audio binds only the
  validated audio server sockets in the invoking user's runtime dir
  (pipewire-0, pipewire-0-manager, pulse/native — real sockets
  only, never symlinks out of the validated tree) plus /dev/snd for
  pure-ALSA clients, and passes XDG_RUNTIME_DIR through to the child.
  Example: ai-jail --browser=soft --network --display --audio chromium.

  --audio follows the same rules as the other trusted capabilities:
  off by default, Linux only, never implied by --display, disabled
  under --lockdown, grantable from the CLI or global config but never
  from an untrusted project .ai-jail, and matched by read-write
  Landlock grants so enforcement cannot silently break the feature.

Checksums (SHA256)

da10d772169019d7dd34f94368be3959c29764cb53b2f66a19f094d9dc6c4c8a  ai-jail-linux-x86_64.tar.gz
07ee9990b30c5c002db9122378acddadbbc4f4dbc6972e8018799c6c439396c5  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail