← All posts
By The agentjail team
announcementrelease

v0.4.0: Session Proxy, Overlays, Runtime Grants

agentjail's sandbox is now a live, negotiable perimeter - scoped per session, per project, and per human approval.

v0.4.0 release: session-aware network proxy, project overlays, and runtime host grants

agentjail v0.4.0 is out. The theme this release: your coding agent’s sandbox stops being a static file you write once and forget. It’s now a live, negotiable perimeter - scoped per session, per project, and per human approval.

Per-session network isolation (foundation)

v0.4.0 ships the infrastructure for per-session network scoping. Instead of one global allowlist for all agents, each session registers its own allowlist via a control plane, gets a scoped token, and idle sessions are reaped automatically.

$ agentjail sessions list
SESSION     NAME              ACTIVE  START               END                 COUNT  AGENT   CWD
fdf6ea95    git-release-v-4           2026-07-05 18:36    2026-07-05 22:12    152    claude  ~/Repos/agentjail
a303efe0    fix-aj-ui                 2026-07-02 18:58    2026-07-05 22:11    1195   claude  ~/Repos/agentjail

Network enforcement is opt-in today (--netproxy) while we finish the transparent tunnel that will make it seamless. The session model, control plane, and lease reaper are all live - the next release wires them into the default path. Full design in ADR 0042.

Per-folder project policy overlays

Not every repo should inherit the same global rules verbatim. Think direnv, but for agent policy: drop a .agentjail/policy.yaml in a project, trust the folder once, and every session started from that directory automatically picks up the project’s overlay.

# .agentjail/policy.yaml
network:
  allow:
    - api.internal-tools.dev
files:
  write_allow:
    - ./generated/**
$ agentjail trust .
  trusted ./  (2 rules: 1 network, 1 file)

$ agentjail trust list
  PATH                          RULES   TRUSTED AT
  ~/code/proj-alpha              2       2026-07-04 18:22
  ~/code/proj-beta               1       2026-06-30 09:15

Overlays are additive-only by design. A project can grant more access than the global policy - it can never revoke a global rule. That means a compromised or careless .agentjail.yaml can widen what one project’s agent can reach, but it can’t be used to punch a hole in rules that apply everywhere. agentjail trust list shows exactly what’s trusted and where each rule came from, so there’s no ambiguity about why a session has the access it has. Full design in ADR 0043.

Runtime host grants

Static allowlists always miss something. v0.4.0 ships runtime host grants - the ability to approve a blocked host without restarting anything. An agent files a request, a human approves from a trusted terminal, and the host is persisted into the project’s overlay for future sessions automatically.

# Agent (sandboxed) files a request:
agentjail allow host db.staging.internal --reason "need staging API"

# Human (unsandboxed terminal) reviews and approves:
agentjail grants
agentjail grant approve <grant_id>    # persists for future sessions
agentjail grants --log                # view grant history

The grant server runs on the always-on daemon - no --netproxy flag needed. Grant requests arrive on daemon.sock (the same socket the hook uses), bound to the requesting session via peer-PID verification. Approvals go through daemon-ctl.sock, a separate socket the sandboxed agent cannot reach - so an agent can never approve its own grant, enforced at the OS level, not by convention.

Full design in ADR 0044 and ADR 0047.

Shared sandbox contract

The darwin and linux shields used to maintain separate lists of “paths the agent needs.” They drifted - same agent, different behavior on each OS. v0.4.0 fixes this with a single shared contract (ADR 0034):

  • One source of truth for paths, capabilities, and allowed hosts. Each backend (Landlock on Linux, sbpl on macOS) translates it - neither re-lists the data.
  • Essential hosts are non-removable. npm, GitHub, PyPI can’t be dropped by a bad overlay or a policy typo.
  • macOS keychain access for Claude Code, closing the gap that caused the original drift.

Under the hood

  • policyctl domain service replaces 12 copy-pasted audit ceremonies across the codebase.
  • Clean internal packages for credential broker, hookwatch, sandbox, envaudit, and policyeval - each with a defined interface at the seam.
  • macOS code signing - binaries are signed and notarized in CI. No more Gatekeeper warnings.

Upgrade

curl -fsSL https://agentjail.io/install.sh | sh
# or
brew upgrade LuD1161/tap/agentjail

Full changelog on the changelog page. Source on GitHub.