v3.0.0

ai-jail 3 moves project approvals out of the checkout and adds guided setup
for filesystem, environment, SSH, and forge access. This is a major release
because repository-local configuration is no longer an authority source after
migration, and a fresh known-harness profile no longer silently adopts optional
host access.

Breaking changes and migration

• Trusted policy now lives under $XDG_CONFIG_HOME/ai-jail (normally
  ~/.config/ai-jail). Global settings use config.toml; project documents
  live under projects/ and are bound to a canonical project path. The store
  is owner-only and hidden from the jail.
• A writable launch automatically migrates ~/.ai-jail after verifying the
  external copy. A repository .ai-jail is treated as untrusted: ai-jail
  imports monotonic restrictions, but drops its command and access requests.
  SSH, GitHub, network, outside maps, and other grants require fresh approval.
  The legacy source is removed only after the destination is durably written
  and parsed. Exit notices show the new location and list anything that needs
  reapproval. If the repository file was tracked, its deletion remains visible
  in git status.
• The first interactive run of a known harness opens an access checklist. A
  first run without a terminal uses restricted defaults once and saves no
  profile. ai-jail configure HARNESS requires a terminal and makes no changes
  without one. Automation should pass every intended grant or restriction
  explicitly.
• A positional COMMAND [ARGS...] always wins over command in an applied
  [commands.<name>] table. ai-jail emits a sanitized warning when it ignores
  the table's command and never prints command arguments in that warning
  (#216, reported by @duducp).

Read-only operations such as status and --dry-run retain the legacy read
path until a writable launch can migrate it. Existing CLI flags remain
accepted. In particular, --ssh and --github still provide the old broad
behavior, but both are labeled OPEN.

Guided project access

• ai-jail configure HARNESS presents the same checklist used on first run.
  Every optional choice begins unchecked, and the final review separates
  RESTRICTED, ALLOWED, and OPEN authority. Broad grants require typing the
  exact word OPEN.
• Read-only and read/write directory choices support terminal path completion.
  Saved grants record the resolved path and filesystem identity; a moved,
  replaced, or missing directory makes the launch refuse access. It does not
  follow the new target. Credential roots and the policy store cannot be added through the
  generic directory picker.
• The environment picker shows variable names without showing values. Saved
  approvals contain names only and read the current value at each launch.
  Every non-baseline name is OPEN. A missing approved variable fails closed
  until the variable is restored or its approval is removed.
• The complete prompt simulations and their security consequences are in the
  onboarding guide. The checked-in transcripts are
  compared with production output by the test suite.

Selected-key SSH

• The checklist can create a fresh SSH agent containing only selected
  file-backed identities. Private keys and the ambient agent are not mounted.
  Keys have a bounded lifetime and at least one destination is required.
• ai-jail accepts a destination limit only when the system OpenSSH tools support
  ssh-add -h/-H and a matching host key can be verified. Missing support,
  missing host keys, key identity drift, and unconstrained policies refuse the
  launch. Git uses the generated strict SSH configuration. Direct SSH on Linux
  and macOS must use
  "$AI_JAIL_SSH" -F "$AI_JAIL_SSH_CONFIG" host.
• Native SSH cannot use the filtered HTTP CONNECT proxy, so selected-key SSH
  also requires a separately confirmed unrestricted-network OPEN grant. This
  opens reachability, not additional key authority. The temporary agent is
  reaped on normal exit and handled termination; key expiry is the remaining
  boundary after an uncatchable supervisor failure.

Repository-scoped forge access

• ai-jail forge setup, status, and remove manage credentials outside the
  checkout. Bindings use the forge's numeric repository ID and an exact HTTPS
  host/path credential helper. Host CLI configuration is not mounted.
• GitHub App setup guides the user through creating and installing an App for
  selected repositories. Each launch mints a repository-selected installation
  token. ai-jail attempts revocation on normal exit; token expiry is the
  reliable boundary after a crash. The App private key stays outside the jail.
• GitLab project tokens and repository-selected Codeberg/Forgejo or supported
  Gitea tokens can be imported. Where the provider cannot prove that a
  presented token has no broader authority, setup and every later summary label
  it OPEN · USER-ASSERTED · PERSISTENT. Local removal stops future injection;
  immediate server-side invalidation requires revocation in the provider UI.
• Account requirements, provider steps, tested prompts, persistence, rotation,
  and removal are documented in the
  forge guide, with links to the provider documentation.

macOS and compatibility fixes

• Added --allow-loopback-connect for macOS tools that allocate unpredictable
  localhost ports. It grants outbound access to every service on host loopback,
  so it is labeled OPEN, requires trusted policy or CLI authority, and is
  disabled by --lockdown. Prefer the narrower --forward-port PORT. The
  option is accepted on Linux for portable policy but has no effect there
  (#215, reported by @EnricoSignori).
• Preserved BWRAP_BIN in isolated test environments so NixOS builds can use
  the validated Nix-store bubblewrap path (#217, reported by @douglascdev;
  fix contributed in #214 by @PedrobyJoao).

Security and compatibility notes

• The new policy location prevents a jailed process from editing its own saved
  grants for the next launch. It does not change ai-jail's threat model: this
  remains an accident guard for trusted-but-fallible tools, not a boundary for
  hostile code.
• --allow-loopback-connect, unrestricted network, full SSH sharing, full host
  GitHub credentials, arbitrary environment variables, and persistent forge
  tokens whose negative authority cannot be verified are reported as OPEN.
• Old config fields and CLI flags still parse. Repository restrictions survive
  migration, while grants intentionally require a new user decision.

Checksums (SHA256)

0971844914533afa0b04460694490404eb666b8659691ad97f98c97e462a81a1  ai-jail-linux-x86_64.tar.gz
86d7b16e961da64dda8f4759c6a55cbbb4e1fbfd6a0fb01408e29fd82a521e3e  ai-jail-macos-aarch64.tar.gz
f090c1aca534028a1d6bffe7de8599550b82e53a9b477231fdd8b1fb2c14d4b3  ai-jail_3.0.0_amd64.deb

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail
# Debian/Ubuntu: download the .deb below, then
sudo apt install ./ai-jail_*_amd64.deb