v3.1.0

ai-jail 3.1 replaces the first-run checklist with one persistent terminal UI
that keeps access choices, security explanations, editors, and final review in
the same session. It also brings the important host capabilities into one
auditable interface without changing their CLI equivalents.

Guided access UI

• The new Ratatui interface has responsive split/stacked layouts, keyboard
  navigation, concise details, explicit focus, monochrome-safe state labels,
  and Cancel-first dialogs for OPEN authority. It never asks TUI users to type
  OPEN or answer a separate y/n prompt.
• Fully closed, For developers, and Mostly open presets preview their
  effects live before they are applied. The developer preset enables filtered
  model/package access, harness state, and the visibly OPEN host GitHub token;
  unrestricted networking, SSH, loopback, and container-engine control stay
  closed.
• The searchable environment selector displays names but never values. The
  directory browser supports filtering, path completion, a separate selected
  pane, one-key read-only/read-write changes, and security validation before a
  path becomes a grant.
• Selected-key SSH, trusted wrapper requests, and the complete effective-access
  review now remain inside the same UI. Wrapper requests begin undecided and
  require an explicit approve or reject decision.
• An additional-capabilities screen covers uncommon host integrations,
  credential stores, devices, workspace options, and macOS compatibility.
  A tested CLI/TUI parity inventory prevents future options from silently
  disappearing from the onboarding design.

Container and network clarity

• Docker/Podman control is a first-page OPEN capability that no preset enables.
  ai-jail discovers reachable Unix sockets from DOCKER_HOST,
  CONTAINER_HOST, rootless runtime locations, Docker Desktop, Colima, and
  conventional rootful paths. TCP/SSH daemon endpoints are not mounted.
• Linux and macOS now pass the exact admitted socket through both
  DOCKER_HOST and CONTAINER_HOST, so Docker-compatible and native Podman
  clients use the same reviewed endpoint.
• The unrestricted-network choice now states plainly that closing it may still
  leave selected filtered destinations reachable, while Fully closed blocks
  all destinations.

Security and documentation

• Forge authority shown during onboarding is captured without loading a
  credential and compared with the runtime binding immediately before launch.
  If repository identity or authority appears, disappears, or changes after
  review, launch fails closed.
• OPEN/CLOSED language, final-review behavior, presets, migration boundaries,
  and capability parity are covered by provenance-linked tests and current
  user, security, wrapper, and TUI design documentation.
• The README now includes current screenshots of the main access review,
  environment selector, and directory browser.

See the onboarding guide for complete walkthroughs and
the CLI/TUI parity contract for the maintained
capability inventory.

Checksums (SHA256)

1e2bc630079f7db40ca33884ba83141e20ca640a8604b56cd13b3430b3995aee  ai-jail-linux-x86_64.tar.gz
301934d6730373b20510e93639bdfbb5c16982cb3512e4c7e5c4fe408e45504a  ai-jail-macos-aarch64.tar.gz
54063805ae61ce203622b5335c4cd049ddede556d656e2143e7b7dfeab99595c  ai-jail_3.1.0_amd64.deb

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail
# Debian/Ubuntu: download the .deb below, then
sudo apt install ./ai-jail_*_amd64.deb