v2.10.0

A feature and security-hardening release: macOS gains selective host-port
access, browser profiles explain how to enable display forwarding, and the
Linux sandbox tightens its supervisor, worktree, proxy, and trust boundaries.

Backward compatible: every pre-2.10.0 .ai-jail keeps working.

Added

• --forward-port PORT now works on macOS (#171). Seatbelt profiles grant
  outbound access only to each named TCP port, matching the existing CLI and
  global-config interface without enabling unrestricted network access.
  Filtered egress also exempts loopback from proxy routing when a port is
  forwarded. Thanks @limarcoverde.

• Browser profiles now explain when display forwarding is disabled (#174).
  Launching a browser-capable profile without --display or --x11 prints a
  focused hint instead of leaving users to diagnose why no window appeared.
  Thanks @diogochaves.

Fixed

• Standalone Codex commands no longer create a conflicting private-home
  symlink (#170, closes #169). A command path already exposed by an earlier
  home bind is reused, so Codex can start normally in repositories whose path
  lies below the home directory. Thanks @felipe-NR.

• Rejected Bubblewrap installations are reported accurately (#172). A
  binary that exists but fails ai-jail's trust validation is now described as
  rejected instead of missing, preserving the distinction needed to repair the
  host installation. Thanks @diogochaves.

• Linux sandboxes set USER and LOGNAME explicitly (#173). Both values
  survive the filtered environment and consistently identify the sandbox user.
  Thanks @diogochaves.

Security

• The Bubblewrap supervisor now starts from an explicit environment. It
  clears inherited variables before adding the validated allowlist, and test
  failures no longer print generated environment arguments.

• Linux helper boundaries are narrower. The filtered-egress proxy listens
  only on its private Unix socket, namespace capability probes resolve the
  trusted Bubblewrap binary instead of using ambient PATH, and multi-user or
  unexpectedly owned Nix stores are rejected rather than mounted.

• Linked-worktree exposure is validated against existing mounts. Worktree
  metadata that overlaps a broader writable mount is refused instead of
  weakening the requested boundary.

Documentation

• Clarified that macOS port forwarding is enforced by Seatbelt rather than a
  relay, documented loopback behavior under filtered egress, and corrected the
  agent-state and network-composition descriptions.

Checksums (SHA256)

cd4b4b5dad69d6fb11a0cd9a17e6c2e1848cac4ba3d8da0a507a6eb535dc0714  ai-jail-linux-x86_64.tar.gz
de065b48d7df14fc3035b8d2ce4a284081b0e70a458b6a4ee0956a7cd93a892c  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail