# v0.4.3

Supersedes v0.4.1 and v0.4.2. All Landlock fixes consolidated into one release.

## Fixes

- **Fix Landlock breaking bwrap startup** — Landlock was applied before building the bwrap command, so mount discovery couldn't read `$HOME` ("Permission denied"). Also `/proc` was read-only, but bwrap needs to write `/proc/self/uid_map` for user namespace setup.

- **Fix Landlock blocking bwrap mount namespace setup** — Landlock applied to the parent process prevented bwrap from setting up its mount namespace (`Failed to make / slave: Operation not permitted`). Root cause: Landlock restrictions are inherited by child processes, so bwrap couldn't perform mount system calls. Fix: Landlock is now applied **inside** the bwrap sandbox via an internal `--landlock-exec` wrapper. The ai-jail binary is bind-mounted into `/tmp` inside the sandbox, applies Landlock, then execs the real command. This ensures bwrap's mount namespace setup completes before Landlock restrictions take effect.

- **Fix Landlock making $HOME tmpfs read-only** — Inside the sandbox `$HOME` is a tmpfs. Landlock's `/` read-only rule was preventing tools (mise, gem, etc.) from creating directories. Added `$HOME` as read-write in Landlock normal mode. bwrap's ro-bind mounts for individual dotdirs still prevent writes to those.

- **Fix flaky tests from parallel env/cwd mutation** — Tests that call `set_current_dir()` or mutate `BWRAP_BIN` env var could race each other since both are process-global. Added static mutexes to serialize them.
