Sandbox directories are now three access tiers, the base image ships Node.js 22
LTS, and seatbelt honours :ro.
Every sandbox directory splits into host/ (never shared into any guest), ro/
(the guest reads it and cannot write it) and rw/. A file's guest-access class is
now decided by which directory it sits in rather than by a list somewhere that
can drift out of step, which is what closes DF136 and DF148 on every backend —
an agent can no longer reach, let alone forge, its own environment.json. The
guest still sees one flat root, so nothing inside a sandbox changes.
Upgrading migrates the on-disk layout (schema 5 to 6). yoloai system migrate
does it by duplication rather than in place: it rebuilds the whole sandboxes
tree in scratch, verifies the copy, promotes it in one step, and leaves the
displaced original in trash/. That needs free space equal to twice your
sandboxes tree, and a failure leaves the original untouched.
Also in this release: the base image moves from Node.js 20, which had reached
end of life and was silently capping Claude Code at 2.1.197; --dir <path>:ro
on seatbelt is genuinely read-only; files put --overwrite <dir> replaces a
directory instead of nesting inside it; and on macOS a backend that cannot be
reached is now an error rather than a sandbox reported as removed.
Eight breaking changes — see docs/BREAKING-CHANGES.md.
Install: download the archive for your platform below and extract the yoloai binary,
brew install kstenerud/tap/yoloai, or go install github.com/kstenerud/yoloai/cmd/yoloai@latest.
Verify with checksums.txt (+ the cosign signature / build provenance).