v2.9.0

A feature release: one narrow way to reach a host loopback service without
--network, Devin launching pre-authenticated with its installation
protected, Codex starting under macOS Seatbelt again, and two correctness
fixes.

Backward compatible: every pre-2.9.0 .ai-jail keeps working.

Added

• --forward-port PORT relays one host loopback port into the sandbox
  (#164, closes #158). Without --network the sandbox has its own
  loopback, so a local MCP server, an editor's IDE socket, or a dev database
  on the host's 127.0.0.1 was unreachable, and --network — the whole
  host network back on — was the only way out. --forward-port (repeatable;
  forward_ports in the global config) relays exactly that port through a
  per-launch Unix socket onto the sandbox's own loopback: the private
  network namespace stays up and every other host port stays unreachable.
  It composes with filtered egress and --lockdown, is refused with
  --network, for ports below 1024, and outside Linux; the agent starts
  only once every forward bridge is listening, and a bridge that cannot
  bind fails the launch. At most 256 relays run per forward. A forwarded
  port is trusted in full — no allowlist, inspection, or audit record — and
  only the CLI and global config can open one: a project .ai-jail cannot,
  and auto-save and --init never write one. The host side dials
  127.0.0.1 first and falls back to [::1] for IPv6-only services.
  Thanks @lucascouts.

• Devin launches pre-authenticated with its managed installation protected
  (#163). ai-jail devin now shares the existing devin state roots
  under $XDG_DATA_HOME and $XDG_CONFIG_HOME (defaults ~/.local/share
  and ~/.config) read-write — login, settings, and session history — while
  the self-managed CLI installation under devin/cli stays pinned: cli is
  a mountpoint so it cannot be renamed, and cli/_versions is read-only on
  both backends, with the mutable current selector write-denied by node on
  macOS. A present-but-invalid installation falls back conservatively
  (read-only data); an absent cli (an external install) shares state
  without installation rules. XDG overrides are resolved physically —
  symlinked bases and .. never collapse lexically — and Devin's API host
  server.codeium.com joins the default filtered-egress table, unioned with
  explicit --allow-host as for the other agents. Thanks @lhzapata.

• chatgpt.com joins Codex's default filtered egress (#168). Workspace-
  backed Codex needs it alongside api.openai.com for ChatGPT OAuth
  routing; API-key traffic alone needed only the API host.

Fixed

• Codex starts again under macOS Seatbelt (#168). Codex 0.162.1 calls
  the setuid /bin/ps to validate its managed app-server, which Seatbelt
  refuses to exec. Non-lockdown Codex launches now get a private,
  unprivileged ps shim (this binary, symlinked into the session temp dir)
  that answers only that one PID/start-time query, reading no command lines
  or other host process data. The shim also reaches the canonical executable
  through symlinked launch paths, and Codex's app-server gets the macOS
  services it needs (CFPreferences shared memory, cfprefsd/trustd lookups)
  scoped to Codex with --no-agent-state opting out. Thanks @andrelramos.

• --x11 alone passes X11 through, as documented (#167). All X11
  handling lived behind --display, so --x11 without it gave the sandbox
  no DISPLAY and no /tmp/.X11-unix — silently, not even under
  --verbose — although every doc describes X11 as its own opt-in. Each
  flag now gates its own protocol; --lockdown still turns both off.
  Thanks @diogochaves.

• Auto-save no longer writes opt-ins an untrusted project file would
  refuse (#166). One ai-jail --pictures --no-network true was enough to
  get project .ai-jail pictures ignored because it weakens the baseline sandbox on every later run: auto-save wrote CLI capability opt-ins into
  the project file that the untrusted merge then rejects. Auto-save now
  writes exactly what the project layer's own load accepts (tightening
  values kept; trusted projects unchanged), so a saved file never warns on
  reload, and files polluted by earlier versions clean themselves up.
  Thanks @diogochaves.

Documentation

• Host-side git and masks noted as residual risks (#165). The writable
  project includes .git/, which host-side git trusts: a program named in
  .git/config (for example core.fsmonitor) or dropped into .git/hooks/
  runs outside the sandbox on the next matching host git operation. The note
  says what closes it today (--lockdown, --map .git) and that
  --mask/--deny-path change only what the sandbox sees — host-side
  helpers acting for the agent still read the real files.

Checksums (SHA256)

9a6120a67c0e8d14dd57b06c4b003c28b0e565dd1c8632bf998b3c7f878872a9  ai-jail-linux-x86_64.tar.gz
62b3ece819a899760ef41fa04ab026729703cc388fde486e54b177a7eb253f37  ai-jail-macos-aarch64.tar.gz

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail