v2.11.0

A network-focused release: filtered egress can now reach a self-hosted service
on a private network, plus fixes for shadowed nested mounts and Antigravity
harness recognition.

Backward compatible: every pre-2.11.0 .ai-jail keeps working.

Added

• --allow-private-host HOST reaches a self-hosted service on a private
  network. Like --allow-host, but the named host (and its subdomains) may
  also resolve to RFC1918, ULA, or carrier-grade NAT addresses — a
  self-hosted GitLab, a internal registry, a LAN-only CI endpoint. Loopback,
  link-local, multicast, unspecified, and cloud-metadata addresses stay
  denied for everyone, and the grant is trusted-only: CLI and global config
  (allow_private_hosts = [...], including [commands.<name>] tables). An
  untrusted project .ai-jail cannot add entries, and auto-save and --init
  never write them. Entries count as filtered egress on their own, compose
  with --lockdown, and appear in the audit log like any allowed host.

Fixed

• Nested extra maps are no longer shadowed by their own ancestor (#183).
  bwrap gives the later mount precedence, and user maps were emitted in list
  order: a --rw-map ~/.cache/deno listed ahead of the auto-injected
  toolchain cache map for ~/.cache was silently mounted under it — never
  visible inside the sandbox, with Landlock then skipping its path as not
  found. Extra mounts are now ordered parents-first by destination depth, so
  a nested child always wins regardless of insertion order. Thanks @wtf9880.

• ai-memory run agy recognizes Antigravity (#182). The agy,
  antigravity, and antigravity-cli names now map to the existing
  antigravity agent entry, so ~/.gemini (its OAuth home) is mounted and
  the agy executable in ~/.local/bin is discovered under private home.
  Previously the effective harness fell back to ai-memory: re-login on
  every launch, and no executable discovery. Thanks @JrRenato.

• Filtered egress handles local and private-network services correctly.
  no_proxy now names loopback whenever the sandbox's loopback is isolated
  from the host's (or a --forward-port deliberately exposes it), so local
  clients that honor the variable stop sending loopback traffic into the
  proxy, where it was refused; on macOS, where the network stack is shared,
  an inherited exclusion must not route around the proxy, and loopback stays
  named only when a forward is active.

Documentation

• Linux masks and denies pin the file's inode (GHSA-2gq6-9rhj-xrg4):
  replacing a masked path on the host while the sandbox runs — mv of a temp
  file over it, which is what sed -i and many editors' saves do, or
  delete-and-recreate — drops the rule for the running sandbox. Writing in
  place keeps it, and the jailed process cannot trigger the replacement
  itself. Keep a secret you will edit inside a masked directory, or restart
  the sandbox after saving. macOS matches by path and is not affected.

• Test suites now share tests/common helpers (PR #178), and the docs
  received a repository-wide formatting pass.

Checksums (SHA256)

5676895c1eb921fafa22fcb9736ab3e8fbe1e9c0e4d321639a2a26e48b64a4fd  ai-jail-linux-x86_64.tar.gz
b093c17271f3826c6088ed438a1217811a2af3391b53435d3199df953119b135  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail