v2.13.1

A maintenance release fixing command selection, environment precedence,
mount ordering, concurrent audit logging, and HTTP request framing.

Backward compatible: every pre-2.13.1 .ai-jail keeps working.

Fixed

• Preserved an explicit CLI command when a trusted project config also defines
  command, keeping the documented CLI → project → global precedence (#199).
• Made repeated environment overrides consistently use the last effective
  value, including phantom-secret resolution and absent host variables (#200).
• Preserved nested same-path maps when an alternate-source ancestor would
  otherwise replace their contents (#201).
• Resolved relative command paths, relative PATH entries, and empty PATH
  components against the project working directory (#202).
• Discovered command installation paths using the child's effective PATH,
  including --env and --env-from-file, without weakening lockdown (#203).
• Serialized audit-log tail refresh and append operations across concurrent
  processes so the hash chain and sequence numbers remain intact (#204).
• Limited phantom-credential HTTP framing inspection to the request headers,
  ignoring binary or header-like body bytes read in the same socket chunk
  (#205).

Internal

• Bumped rustls 0.23.45 → 0.23.46 (Dependabot, #198). Transitive dependency
  of the filtered-egress proxy's TLS stack; version + checksum only, no API or
  behavior change.

Checksums (SHA256)

bc9776c644cd9d08ada0cf2a407d27cefc6bf9a5c83ddfa3886d4e3cec74f813  ai-jail-linux-x86_64.tar.gz
10d74d4aa58a386a6e93ce2ff2448302fc1555644a00f91a7c081af3084dab1b  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail