v3.0.1

ai-jail 3.0.1 adds a stable, fail-closed integration contract for trusted host
wrappers such as ai-memory. Wrappers can declare identity and requested access,
but ai-jail remains the only component that grants and saves authority.

Wrapper contract

• --harness NAME explicitly selects onboarding, saved-profile behavior,
  model API hosts, API-key names, and login-state mounts. It is repeatable for
  wrappers that switch among several harnesses in one jail. Unknown wrapper
  flags no longer hide the selected harness; known executable contradictions
  are refused.
• --request-file PATH accepts schema-v1 JSON from a guarded, user-owned file
  outside the checkout. Requests include a requester and reason and may ask for
  a public/private host, environment name, phantom secret, harness state, or
  read-only/read-write directory. Requests begin selected in the unified
  onboarding review but remain deniable. OPEN authority still requires typing
  OPEN.
• Saved approvals record the normalized request identity and requester, never
  an environment value. A new, changed, denied, or unapproved request stops a
  non-interactive launch before sandbox creation.
• ai-jail capabilities --json replaces help-text scraping. status --json
  is a read-only, non-prompting preflight that reports harness onboarding,
  restricted/allowed/open grants, approved/pending requests, and stable blocker
  codes.
• Exit 3 means a required request is not approved; exit 4 means saved authority
  is blocked by host drift; exit 5 means the sandbox backend is unavailable;
  onboarding cancellation remains 130.

Security and compatibility

• Phantom --secret substitution is now advertised for approved private
  plain-HTTP hosts. The real value remains supervisor-side and is absent from
  the sandbox, request file, saved profile, status JSON, and logs.
• --no-save-config now has an explicit boundary: it suppresses ordinary
  profile and constraint auto-save, but no longer suppresses the security
  migration of legacy .ai-jail files into the trusted external store.
• Request files inside the checkout, symlinks, hard links, foreign-owned files,
  and group/world-writable files are refused. Map requests still pass the
  existing credential-root and inode-identity checks.
• Existing flags and argv inference remain available for older wrappers.
• features.inside_marker is deliberately false. Linux and macOS cannot yet
  offer one equivalent, unspoofable mounted-file contract, so 3.0.1 does not
  overstate that boundary.

See the wrapper integration guide for the
complete JSON schema, examples, status fields, exit codes, and migration
instructions.

Checksums (SHA256)

53c8b653bc1a693c7022e91ec47d81d8441a1bf813fbb737a35da224207b0e11  ai-jail-linux-x86_64.tar.gz
009c2fdc6db6317e1619a193c7c8ae3c2cec4726b04b648117bd9a01ff1e62fe  ai-jail-macos-aarch64.tar.gz
dc292ec9f51653ddaaea3cbdb47df5685496329ca390c1c4ae97d6ae09bfc8c1  ai-jail_3.0.1_amd64.deb

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail
# Debian/Ubuntu: download the .deb below, then
sudo apt install ./ai-jail_*_amd64.deb