How akitaonrails/ai-jail works
ai-jail is a CLI supervisor that runs coding agents inside OS-enforced sandboxes. The main workflow is invocation and configuration, policy and mount preparation, platform sandbox construction, then supervised command execution with optional terminal handling and filtered egress. Major supporting capabilities include browser profiles, credential-state mounting, phantom-secret substitution, bootstrap policy generation, and opt-in audit logging. The graph reflects README capabilities as well as sampled source; unsampled implementation details are represented only where the tree or README supports them.
Main entry points: main.rs Supervisor · proxy.rs Filtered Egress · mod.rs Sandbox Preparation · bwrap.rs Linux Bubblewrap
Components 20
Invocation
- Supervisor
src/main.rs - CLI Parser
src/cli.rs - Configuration
src/config.rs
Policy Setup
- Command Resolution
src/command.rs - Sandbox Preparation
src/sandbox/mod.rs - Agent Bootstrap
src/bootstrap.rs
Sandbox Runtime
- Linux Bubblewrap
src/sandbox/bwrap.rs - macOS Seatbelt
src/sandbox/seatbelt.rs - Landlock Limits
src/sandbox/landlock.rs - Seccomp Filter
src/sandbox/seccomp.rs - Filtered Egress
src/proxy.rs - Secret Substitution
src/secret.rs
Supervision
- PTY Filtering
src/pty.rs - Status Bar
src/statusbar.rs - Audit Log
src/audit.rs
Other components
- User
- Agent Command
- Host OS
- Allowed Hosts
- GitHub
Connections 22
- User → Supervisor: invokes
- Supervisor → CLI Parser: parses
- Supervisor → Configuration: loads
- Configuration → Supervisor: returns settings
- Supervisor → Command Resolution: resolves command
- Supervisor → Sandbox Preparation: prepares policy
- Sandbox Preparation → Linux Bubblewrap: builds Linux sandbox
- Sandbox Preparation → macOS Seatbelt: builds macOS sandbox
- Linux Bubblewrap → Landlock Limits: applies limits
- Linux Bubblewrap → Seccomp Filter: applies filter
- Supervisor → Agent Bootstrap: generates setup
- Supervisor → Filtered Egress: starts proxy
- Filtered Egress → Allowed Hosts: dials allowed hosts
- Filtered Egress → Secret Substitution: substitutes credentials
- Supervisor → Agent Command: launches sandboxed
- Agent Command → Host OS: runs under restrictions
- Supervisor → PTY Filtering: interposes terminal
- Supervisor → Status Bar: sets up status
- Status Bar → GitHub: checks version
- Supervisor → Audit Log: records launch
- Filtered Egress → Audit Log: records verdicts
- User → Audit Log: verifies log