# v0.10.0

## Browser profiles and Gemini support

This release adds browser-focused isolation profiles for running Chromium,
Chrome, Brave, Firefox, and LibreWolf inside ai-jail without touching the
user's real browser profiles.

```bash
ai-jail chromium              # auto-detects hard browser profile
ai-jail --browser chromium    # explicit hard profile
ai-jail --browser=soft firefox
ai-jail --no-browser chromium # opt out of browser auto-detection
```

### Hard and soft browser isolation

- **Hard profile** (`--browser` / `--browser=hard`): browser config, cache,
  history, cookies, extension state, and sessions live under sandbox tmpfs
  paths and disappear when the browser exits.
- **Soft profile** (`--browser=soft`): browser state persists only under
  `~/.local/share/ai-jail/browsers/<browser>`, so re-logins are not required
  across ai-jail browser sessions while host profiles such as
  `~/.config/chromium` and `~/.mozilla` stay untouched.

Both profiles use a private `$HOME`, mount the project read-only, disable
mise/config auto-save/status bar integration, ignore extra maps, and keep SSH,
Pictures, Docker, linked worktree metadata, and normal host dotdirs out of the
browser sandbox. Display and network remain enabled so the browser can open and
navigate sites.

### Chromium behavior

Chromium-family browsers run with Chromium's internal sandbox disabled because
the Chromium zygote/setuid sandbox does not work reliably inside ai-jail's
bwrap/user namespace layout. The containment boundary is ai-jail's bwrap
mount/process namespace plus Landlock/seccomp, not Chromium's own sandbox.

Chromium GPU acceleration is disabled by default in browser profiles to avoid
probing unmapped DRM devices and crashing the GPU process. Pass `--gpu` to
expose GPU devices and leave Chromium GPU acceleration enabled.

Some Chromium terminal output is expected in browser mode: D-Bus, systemd,
UPower, Google Cloud Messaging, and EGL/WebGPU warnings can appear because the
profile intentionally does not expose the full host desktop session. These
messages are usually harmless if the browser window works.

### Documentation and tests

The README now documents browser profile usage, persistence behavior, safety
boundaries, Chromium-specific tradeoffs, and expected terminal noise. Unit
tests cover CLI parsing, config merging, auto-detection, launch arguments,
hard/soft state paths, bwrap mount isolation, Landlock rules, and the GPU
override path.

### Backward compatibility

The new `browser_profile` config field uses `#[serde(default)]`, so existing
`.ai-jail` files continue to parse unchanged. Browser isolation is only applied
for detected browser commands or explicit `--browser`; existing AI-agent
workflows keep their previous defaults.

## Gemini CLI support

Gemini CLI is now a built-in AI tool preset:

- `ai-jail gemini` is listed in the command help and README.
- `~/.gemini` is mounted read-write alongside the other AI tool state
  directories.
- `ai-jail --bootstrap` writes a Gemini policy file to
  `~/.gemini/policies/ai-jail.toml`.

The generated Gemini policy mirrors ai-jail's existing bootstrap philosophy:
read/search/edit tools are allowed, risky shell commands are denied or ask, and
common safe shell command prefixes are allowed. Claude-style wildcard patterns
that cannot be represented as Gemini `commandPrefix` rules are skipped instead
of being emitted as dead glob-looking prefixes.
