v2.2.0

Two security upgrades to the v2 filtered-egress stack, both opt-in and
backward-compatible: phantom credentials and a tamper-evident audit log.
Thanks to zerobox and nono for the ideas — the comparison that motivated
them is in the works for the website.

Added

• Phantom credentials: --secret KEY=host / secret_hosts. The
  sandboxed process never sees the real credential: its environment gets an
  AIJAIL-PHANTOM-* placeholder, and the egress proxy substitutes the real
  value only when terminating a plain-HTTP request for the bound,
  allowlisted host, re-originating TLS upstream (rustls/ring, Mozilla root
  store, same DNS pinning and SSRF guard as CONNECT). Substitution is
  host-scoped per binding — a credential bound to api.anthropic.com can
  never be injected into a request to any other host. The key must already
  be in the sandbox env via --env/--env-from-file; secret_hosts is
  global config only, is never serialized, and a project .ai-jail cannot
  set it. Honest caveat, as documented: CONNECT tunnels stay opaque, so
  this covers clients that can speak plain HTTP to the proxy for that host
  (e.g. an http:// base URL); CONNECT-only HTTPS clients are unaffected
  and work exactly as before.

• Hash-chained audit log + ai-jail --audit-verify. Every --audit-log
  record — launches, CONNECT verdicts, and secret injections — now carries
  its sequence number and the SHA-256 of the previous raw line.
  --audit-verify walks the chain and reports the first broken link (exit
  0 intact, 1 broken, 2 no log). Existing v2.x logs chain in with no
  migration; a leading run of unchained records is reported as legacy, not
  an error. Scope honesty: this makes quiet retroactive edits loud; it does
  not stop wholesale file replacement (no signing, no remote attestation).

Fixed

• Filtered egress under --lockdown now delivers phantom-secret
  placeholders to the child: lockdown never applies env_pass, so the
  bound KEY=placeholder entries are force-injected alongside the proxy
  env (placeholders are not credentials — safe to force).

Internal

• New dependencies for the above: sha2, rustls (pinned to the ring
  provider), webpki-roots — the project's first crypto dependencies.
  CI adjusted accordingly: the aarch64-apple-darwin clippy moved to the
  macOS job (native target; ring's C/assembly does not cross-compile from
  the Linux runner) and the musl check installs musl-tools.

Checksums (SHA256)

f68f5b3cfb337e7cdcbbc6ac4a197c8ebcbf8cbb5e1bd16734e1b51e556761e7  ai-jail-linux-x86_64.tar.gz
81de62c4c33b0f3671ad81d82ea09ed95d9ed9f37ebdfb3a0a4735ab773e073b  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail