v2.14.0

Added

• Added opt-in interactive approval for filtered egress on Linux with
  --prompt-hosts, or prompt_hosts = true in trusted global config. When a
  sandboxed command requests an unlisted host, ai-jail presents an Allow/Deny
  desktop notification and keeps the decision in memory for that launch only.
  DNS answers are pinned between approval and connection; forbidden address
  classes are rejected without prompting, while private, unique-local, and
  carrier-grade NAT answers are clearly identified before approval. Missing,
  dismissed, timed-out, or failed prompts deny the connection. Project config
  cannot enable the capability, and lockdown disables it (#206).

Fixed

• Restored the (jail) marker after mise activation so mise-managed launchers
  continue to detect that they are running inside ai-jail (#207).

Security

• Sanitized command labels shown in host-approval notifications so untrusted
  project command names cannot inject markup or control characters into the
  authorization UI (#206).

Backward compatible: every pre-2.14.0 .ai-jail keeps working. Interactive
host approval is off by default.

Checksums (SHA256)

307fc486b8cad0138b8d8835dad5a522403dd7085d09665d0f619b34c42cafb3  ai-jail-linux-x86_64.tar.gz
a01ab8e1e9686f511f19e5c8da24b711caace2a219e4603fe2ec5b106ddf9671  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail