# v0.1.0

Initial release.

## Features

- **Sandbox isolation for AI coding agents** — wraps bubblewrap (Linux) and sandbox-exec (macOS) to restrict filesystem, network, and device access for tools like Claude Code, GPT Codex, OpenCode, and Crush.
- **Cross-platform support** — Linux via `bwrap` namespaces, macOS via seatbelt SBPL profiles.
- **Persistent config** — `.ai-jail` TOML file per project directory. Commit it to your repo so sandbox settings follow the project.
- **Smart home directory handling** — mounts `$HOME` as tmpfs, selectively layers dotfiles on top. Sensitive directories (`.gnupg`, `.aws`, `.ssh`) are never mounted. AI tool directories (`.claude`, `.codex`, `.cargo`) are mounted read-write.
- **Lockdown mode** (`--lockdown`) — strict read-only project mount, no GPU/Docker/display, network isolation on Linux, cleared environment variables.
- **Bootstrap command** (`--bootstrap`) — generates permission configs for AI tools (Claude `settings.json`, Codex `instructions.md`, OpenCode `config.toml`).
- **GPU passthrough** — auto-detects NVIDIA and DRI devices.
- **Docker socket passthrough** — auto-enables when `/var/run/docker.sock` exists.
- **X11/Wayland display passthrough** — for GUI tools and Chromium-based editors.
- **mise integration** — auto-activates project-specific language versions inside the sandbox.
- **Extra mounts** — `--rw-map` and `--map` for user-specified read-write and read-only paths.
- **Dry-run mode** (`--dry-run`) — prints the sandbox command without executing.
- **Signal forwarding** — proper signal handling and child process reaping.
- **RAII temp file cleanup** — no leftover files on exit.
- **Symlink-safe file operations** — bootstrap and config writes reject symlink targets to prevent path traversal.
- **Minimal binary** — ~880K stripped, no async runtime, four dependencies.

## Install

```bash
# Homebrew (macOS / Linux)
brew tap akitaonrails/tap && brew install ai-jail

# cargo install
cargo install ai-jail

# mise
mise use -g ubi:akitaonrails/ai-jail

# From source
cargo build --release
cp target/release/ai-jail ~/.local/bin/
```

## Supported agents

| Command | Agent |
|---------|-------|
| `ai-jail claude` | Claude Code |
| `ai-jail codex` | GPT Codex |
| `ai-jail opencode` | OpenCode |
| `ai-jail crush` | Crush |
| `ai-jail bash` | Debug shell |
