v1.22.0

Added

• Launch-time warnings when a known agent is missing a capability it
  needs (issue #131). Since v1.18.0 made capabilities opt-in, an
  older ~/.ai-jail could fail four different ways — none of which
  mentioned the config. ai-jail now warns at launch when a known API
  client (claude, codex, gemini, opencode, crush, grok,
  jcode, pi, aider, soulforge, omp, kimi*) runs with
  network or agent_state off, pointing at the exact config key or
  flag and at ai-jail status. Warning only — the launch is never
  blocked, unknown commands stay silent, and the network warning is
  suppressed under --lockdown (which blocks network by design).

Fixed

• macOS: fork-pool test runners can stop their own workers (PR #132,
  thanks @zanlucathiago). The default seatbelt profile had no
  signal rule at all, so kill(2) inside the sandbox returned EPERM
  and vitest/jest/pytest-xdist hung at teardown. The default profile
  now allows (allow signal (target same-sandbox)) — the same split
  Apple ships and this file already used for process-info*: children
  can signal each other, nothing outside the sandbox is reachable. The
  broad (allow signal) stays behind --macos-host-ipc.

• macOS: /bin/sh shell selection works again (issue #131). Since
  Catalina, /bin/sh reads /var/select/sh to pick bash vs zsh; the
  default profile allowed no such read, so every hook the agent ran
  died with a non-blocking EPERM before it started. The profile now
  grants file-read-metadata on /private/var/select and file-read*
  on /private/var/select/sh.

• macOS: Claude Code's /tmp cwd marker is granted (issue #131).
  Claude Code writes /tmp/claude-<random-hex>-cwd loose in /tmp on
  every Bash call (anthropics/claude-code#8856); the existing
  /private/tmp/claude-<uid> grants could never match it, so every
  command ended with "operation not permitted" and heredocs broke. The
  claude-specific block now covers it with a hex-scoped regex. The
  write half lives only in the write section, so --lockdown keeps its
  no-host-file-write invariant.

Chore

• Reformatted markdown tables in README.md and docs/SECURITY.md to
  satisfy the prettier pre-commit check that had left the nix CI job
  red, and updated the macOS default-profile description in
  docs/SECURITY.md for the changes above.

Checksums (SHA256)

776d8182ea07740392767b1889d2760c11887a3c7f6ecafbe0b7c093aa542149  ai-jail-linux-x86_64.tar.gz
dff0dc232070ec0daa1044a83d3665f165e00a2a224424f2486bc47c327d0407  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail