v3.2.0

The onboarding UI now saves straight from the access overview. The separate
final review page is gone: the screen that makes every choice is the screen you
confirm, so nothing is shown twice and nothing can differ between the review
and what gets written.

Backward compatible: existing profiles, config files, and CLI flags are
unchanged.

Guided access UI

• One decision surface. Save configuration persists exactly the choices
  visible in the overview, including the effective-access details beside them.
  First-run onboarding then launches the harness; ai-jail configure HARNESS
  saves and exits without launching. The plain-terminal fallback keeps its
  Save and launch [s], launch once [o], cancel [q] choice, and that unsaved
  one-off launch remains a fallback-only path.
• Confirmations stay at the boundary, not at the exit. Grants that hand
  over real authority still ask in a Cancel-first dialog before anything is
  written: a first save with the host GitHub token names its complete
  repository and organization authority, and each arbitrary environment
  variable is approved individually with its value never displayed or stored.
• The first-run developer preset is visible about what it selects. It
  preselects agent credential state and dependency toolchains (the raw
  CLI/config defaults remain off), with the GitHub token still gated by the
  OPEN confirmation above. An untrusted repository policy can only tighten
  these; it cannot enable any of them.

Reliability and documentation

• Forge authority confirmed in the overview is still compared with the runtime
  binding immediately before launch, and a mismatch fails closed. The
  diagnostic for that case now says "confirmation" rather than referring to a
  review screen that no longer exists.
• Terminal tests now assert against the rendered screen instead of raw bytes,
  because the save dialog is drawn incrementally and its labels never appear as
  one contiguous write. Two test-isolation defects surfaced by the larger
  suite were fixed alongside it: a spawned git helper inherited a working
  directory that another test was deleting, and the two tests that change the
  process working directory now hold the crate-wide env lock.
• docs/TUI_DESIGN.md records why a one-off unsaved launch is fallback-only,
  and the security model, user guide, and CLI/TUI parity inventory match the
  new flow. The README screenshots were regenerated from the current UI, so
  the overview, environment selector, and directory browser show what a first
  run actually draws.

See the onboarding guide for complete walkthroughs and
the CLI/TUI parity contract for the maintained
capability inventory.

Checksums (SHA256)

fd93fb499d087fc0c83412af9619c4e038a2e3aedbe1bc3caf0ff1cd306e778a  ai-jail-linux-x86_64.tar.gz
6d1176173c44c142a3f625d4b67da49054fa91c4b4b597f6fb0d051584b125bc  ai-jail-macos-aarch64.tar.gz
bea0df5b143de69d550e50fa6929968d7a63dbbfb6790f8f676d424370c09199  ai-jail_3.2.0_amd64.deb

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail
# Debian/Ubuntu: download the .deb below, then
sudo apt install ./ai-jail_*_amd64.deb