← All posts
By The agentjail team
announcementrelease

v0.7.0: A tighter shield, and the broker starts itself

The Linux shield no longer exposes ~/.ssh when you launch from $HOME, the credential broker auto-starts on demand, and every CLI flow is recorded on a clean VM.

A coding agent works your repo and pushes over SSH while agentjail keeps ~/.ssh keys, cloud creds, and .env secrets unreadable

agentjail v0.7.0 is out. This one is about removing friction without loosening the cage: the credential broker now starts itself, the Linux shield seals a home-directory edge case, and the whole CLI now has a recorded, replayable proof that policy enforcement holds on a clean machine.

TL;DR

  • The credential broker starts itself. agentjail secret set and shield grants no longer need a manual agentjail-secrets serve running in the background - the broker is brought up on first use and exits when idle.
  • The Linux shield seals $HOME. Launching an agent from your home directory instead of a project directory could expose ~/.ssh, ~/.aws, and ~/.gnupg. That edge case is closed, matching the macOS shield.
  • Every CLI flow is on tape. A clean-VM testbed records all 15 CLI scenarios with asciinema and asserts pass/fail on the installed binaries - green on Linux and macOS.

The credential broker starts itself

agentjail keeps your real secrets out of the agent’s reach by handing them to a small broker process, which releases scoped, time-boxed credentials only when policy allows. The catch, until now, was that the broker had to already be running - agentjail secret set or a shield grant would fail if you had not started agentjail-secrets serve yourself.

v0.7.0 makes the broker on-demand. It ships as a loaded-but-not-running service definition - a launchd agent on macOS, a systemd --user unit on Linux - that clients bring up automatically the first time they need it, then it self-exits when idle. The idle timeout is gated on there being zero active grants, so the broker never tears down a live credential out from under a running session.

We deliberately did not use socket activation for this, because the release binaries build with CGO_ENABLED=0 and socket activation needs cgo. Instead the client detects “connection refused,” kickstarts the service, and waits for the socket - a small, dependency-free path that behaves the same on both platforms. This closes a long-standing rough edge: setting a secret or granting a credential no longer requires a manual serve. The broker ships as agentjail’s sixth binary and is wired into the installer.

The Linux shield seals $HOME

The OS shield grants your agent read-write access to its working directory so it can actually do work. Separately, it grants a small, explicit allowlist inside your home - ~/.claude and a few config files - while deliberately withholding the directories where credentials live: ~/.ssh, ~/.aws, ~/.gnupg.

Those two rules collided in one case. If you launched the agent with your working directory set to $HOME itself, the wholesale grant on the working directory swallowed the entire home tree - including the exact directories the allowlist was withholding. Landlock, the Linux LSM the shield uses, is allowlist-only with no way to punch a deny back out of an already-granted directory, so once $HOME was granted, ~/.ssh came with it. macOS was never affected, because its sandbox can deny private-key reads by filename regardless of the working directory.

v0.7.0 fixes this. When the working directory encloses $HOME, the shield no longer grants it wholesale. Instead it grants the non-hidden entries in your home as a workspace and denies every dotfile and dotdir by default - because that is where credentials live. The safe dot-entries the agent legitimately needs are still granted through the existing allowlist. A normal project working directory is completely unaffected. The symlink case is handled too: a working directory that is a symlink into $HOME is resolved before the check, so it cannot sneak past.

The net effect: launch from a project or launch from $HOME, either way ~/.ssh, ~/.aws, and ~/.gnupg stay unreadable - the Linux shield now matches the macOS guarantee.

Every CLI flow, recorded on a clean VM

v0.6.0 introduced the make e2e-release gate - a clean VM that installs agentjail the real user way and asserts enforcement on the installed binaries. v0.7.0 builds the evidence layer on top of it.

The testbed now records the full CLI surface: 15 scenarios - install, run, shield, policy management, MCP allow/deny, secrets, trust, egress grants, observability, and the guided tour - each captured with asciinema (a few KB of JSON, not video) alongside a structured pass/fail result. The scenarios run under a session with no controlling terminal, so the anti-self-approval gates refuse exactly as they do in headless CI rather than hanging on a prompt. The output is a self-contained HTML report you can open in a browser and watch every scenario replay with green or red badges.

Recordings are auto-sanitized of host-identifying data before they are written, so a captured session never carries a real username or local paths into the repo. The gate is green on both Linux and macOS.

Also in this release

  • --help now works on flag-passthrough commands. Subcommands that forward flags to a wrapped tool were passing --help straight through instead of printing their own usage. They now intercept it and show help.

Upgrade

curl -fsSL https://agentjail.io/install.sh | sh
# or
brew upgrade LuD1161/tap/agentjail

Full changelog on the changelog page. Source on GitHub.