# v0.5.2

## Security hardening

- **Landlock failures are now fatal in lockdown mode.** Previously, if Landlock was only partially enforced, not enforced, or failed to apply, ai-jail would warn and continue with bwrap-only sandboxing. In `--lockdown` mode, these are now hard errors — the sandbox refuses to start. Disabling Landlock in lockdown (`--lockdown --no-landlock`) is also rejected.
- **`--new-session` is now always enabled.** Previously, `--new-session` was only used in lockdown mode or non-interactive sessions. It is now unconditional, closing the `TIOCSTI` keystroke injection attack vector on all runs.
- **Inner Landlock wrapper receives full policy via CLI args.** The `--landlock-exec` inner process no longer reads the `.ai-jail` config file inside the sandbox. Instead, all relevant flags (`--gpu/--no-gpu`, `--docker/--no-docker`, `--display/--no-display`, `--rw-map`, `--map`) are explicitly forwarded from the outer process. This ensures correct policy even when the config file is absent or read-only inside the sandbox.

## Status bar improvements

- **Status bar is now enabled by default.** Use `--no-status-bar` to disable. The preference is stored in `$HOME/.ai-jail` and persists across sessions.
- **Terminal resize stability.** The status bar now tracks the previous terminal height and clears the old status row when the height changes, preventing stale styled lines from lingering after resize.
- **Wrap-pending artifact fix.** The last terminal column is now left blank, avoiding the cursor wrap-pending state that caused visual glitches during resize on some terminals.
- **Jail icon.** The right section now shows `ai-jail ⚿ 0.5.2` with a squared key icon.

## Fixes

- **Relax `rm -r` in Claude bootstrap template.** `Bash(rm -rf *)` and `Bash(rm -r *)` are no longer in the deny list — they are covered by `Bash(rm *)` in the ask list, so the user can still approve them interactively.
- **Fix DNS resolution on systemd-resolved systems ([#5](https://github.com/akitaonrails/ai-jail/issues/5)).** On systems using systemd-resolved, `/etc/resolv.conf` points to the stub resolver at `127.0.0.53`, which some runtimes (e.g. Go's pure-Go resolver used by Crush) fail to use reliably inside the sandbox. ai-jail now detects the stub address and replaces it with real upstream nameservers from `/run/systemd/resolve/resolv.conf`. Also fixes path normalization for symlinks with relative `..` segments (e.g. Ubuntu's `../run/systemd/resolve/stub-resolv.conf`) by using `canonicalize` instead of `read_link`.

## Backward compatibility

- Old `.ai-jail` configs without `no_status_bar` will now get the status bar enabled (previously disabled). Run `ai-jail --no-status-bar` once to disable and persist the preference.
- `--new-session` is now unconditional. This should be transparent for AI coding agents but could affect edge-case interactive programs that require a controlling terminal via the direct-spawn (non-PTY) path.
- All existing CLI flags and config fields are unchanged.
