v3.4.0

A new opt-in makes theme-aware programs work in the interactive ai-jail PTY,
and a migrated legacy config with maps that only exist on some hosts no longer
fails its access review.

Backward compatible: terminal appearance is off by default, and a launch that
does not enable it filters the same terminal queries as before.

Added

• --terminal-appearance lets interactive programs discover the terminal
  theme (#234). Off by default, PTY only, and separate from raw terminal
  passthrough. When enabled, a program inside the jail can ask the host
  terminal for its background colour (OSC 11, including the tmux-wrapped
  refresh form), complete a DA1 terminal-identity probe (including Kitty's
  trailing-semicolon reply), probe Mode 2031 support (DECRQM), enable or
  disable that mode, and receive light/dark theme-change notifications. Only
  those exact forms pass in each direction, on both the primary and alternate
  screens, with split reads handled; clipboard access, unrelated colour
  queries, and arbitrary terminal replies stay blocked. The grant is seeded
  from the CLI, trusted global config, or the Additional capabilities screen,
  and a reviewed disabled choice persists as a project constraint, so a
  project file can only close it. status, --dry-run, the effective-access
  review, and the onboarding docs name the permission. Thanks @Rijul-A.

Fixed

• A map whose source does not exist no longer fails the access review
  (#233). A legacy config migrated to 3.3.1 could list read-only or
  read-write map sources that exist on only some hosts, such as a service
  socket directory. The sandbox already warned and skipped those paths, but
  the access review canonicalized the source and aborted the whole review with
  Cannot establish directory grant identity <path>: No such file or directory. A missing source now counts as granting nothing, while any
  other resolution error still fails closed and existing credential paths
  remain protected. README documents that ro_maps/rw_maps skip missing
  sources and that overlay_maps still refuse them.

Notes

• New coverage: terminal-appearance filtering and reply admission across both
  screens, split reads, tmux-wrapped queries, and DA1/Mode 2031 probe ordering;
  CLI/config/onboarding/store precedence and constraint round-trips; and the
  missing-grant identity path next to the existing credential-path checks.
• CI's treefmt/prettier hook now passes on the new README and docs/SECURITY.md
  rows.

See the security model for what the appearance grant
does and does not expose.

Checksums (SHA256)

f2884d084db3a8baeb50f11371584af2b9d461e54cc57ba0acd8f4baef6258cb  ai-jail-linux-x86_64.tar.gz
953ea0658ae469fd9c2baf3070aa9570b960b31671fcf5f1565ff954aaafd1f3  ai-jail-macos-aarch64.tar.gz
9fa9ab787eae34a208d3855df0601baab79a258d3853d70aeb68085a5a74c69c  ai-jail_3.4.0_amd64.deb

Install

brew tap akitaonrails/tap && brew install ai-jail
yay -S ai-jail-bin
cargo install --locked ai-jail
# Debian/Ubuntu: download the .deb below, then
sudo apt install ./ai-jail_*_amd64.deb