← All posts
By The agentjail team
announcementreleasenetwork visibilitydeveloper experience

v1.5.0: Network visibility, without startup noise

agentjail v1.5.0 tunnels opted-in agent commands by default, trims startup output, keeps private diagnostics, and opens the local UI on macOS.

A quiet three-line terminal connected through an AgentJail shield and tunnel to a local dashboard, with private logs locked below.

The safest launch path should also be the one you type without thinking.

If you opted into AgentJail’s PATH wrappers, commands such as claude, codex, and Cursor’s agent already entered the OS sandbox. In v1.5.0, those same commands also enter the transparent tunnel. You get network visibility without adding --tunnel to every launch.

The terminal gets quieter at the same time. Routine startup now takes one to three useful lines. The details have not disappeared. They live in private, per-session diagnostics and can come back to stderr when you ask for them.

TL;DR

  • Opted-in agent commands now use the tunnel. The PATH wrappers for Claude Code, Codex, and Cursor route through agentjail run --tunnel -- <agent> and preserve the arguments you pass to the agent.
  • Startup is compact, not silent. Routine setup moves out of the terminal, while policy failures, sandbox downgrades, required consent, and SSH scope warnings stay visible.
  • Each shielded session gets a private diagnostic log. AgentJail retains the newest 10 files under ~/.agentjail/logs/, with directory mode 0700 and file mode 0600.
  • macOS brings the local UI with it. A shielded session starts the loopback dashboard on demand and adds a clickable UI link to the persistent status line when the dashboard is reachable.
  • Linux config-file grants work as intended. A regular file directly under ~/.config now receives file-scoped Landlock rights instead of an invalid directory-only grant.

The command you already use gets network visibility

The PATH shim remains opt-in:

agentjail install --with-path-shim

Once enabled, its wrappers now take this route:

claude, codex, or agent
    -> agentjail run --tunnel -- <agent>
    -> OS sandbox + policy hooks + transparent tunnel

That means a plain agent command gets per-host network policy and traffic visibility across the session, not only capture of the model-provider call. Child arguments still pass through unchanged:

claude -p "review this patch"
codex --full-auto

This changes the wrappers you explicitly asked AgentJail to put on your PATH. A direct agentjail run -- <agent> launch still leaves the full tunnel explicit. Add --tunnel when you want it there.

One to three lines, unless something needs you

Shield startup has a lot to do. It loads policy, prepares the OS sandbox, starts network capture, checks SSH delegation, and wires the session into the daemon. Printing every successful step made the guarded path feel noisier than the agent it launched.

v1.5.0 moves routine detail out of the interactive terminal. It does not hide the messages that change your security posture. You still see:

  • malformed-policy failures
  • a sandbox downgrade or enforcement failure
  • consent that needs a human answer
  • the scope of delegated SSH access
  • the broad SSH-signing warning when it applies

SSH bootstrap is shorter too. The selected identity, session-only OpenSSH scope, and passphrase privacy statement now share one consent prompt. Codex hook reassertion also stops repeating guidance that belongs at install time.

The detail moved to a private log

Every shield launch writes structured session diagnostics under:

~/.agentjail/logs/

AgentJail keeps the newest 10 files. The directory is forced to mode 0700, and each log file to 0600. Retention and file-open outcomes enter the audit trail without copying the diagnostic path into the audit record.

When you are troubleshooting, mirror the same details to stderr:

agentjail run --verbose -- codex

Quiet output is now the everyday interface. The private JSON record is the debugging interface.

The local UI is ready on macOS

On macOS, a shielded session now starts the loopback-only UI on demand. When it is reachable, the persistent status line includes a clickable 📊 UI link.

The dashboard still stays local. v1.5.0 also removes a small source of drift by giving UI startup and the status line one typed loopback-address contract. The link and the server no longer build the endpoint separately.

You can still start it yourself on either supported platform:

agentjail ui

A Landlock fix for real config files

Linux Landlock distinguishes rights for directories from rights for regular files. AgentJail previously tried to apply directory-only rights to a granted file directly under ~/.config. Landlock rejected that with EINVAL, the grant was skipped, and legitimate reads could fail.

v1.5.0 detects that case and applies file-scoped rights. The broader credential boundary does not move. Sensitive config subdirectories remain protected, and the fix grants only the regular file AgentJail intended to allow.

Upgrade

Upgrade through the same channel you installed from:

brew upgrade agentjail
# or
agentjail update

If you use the PATH shim, open a new shell after upgrading and launch your agent normally. To inspect the setup:

agentjail doctor
agentjail run --verbose -- codex

The first checks the guard. The second shows the startup detail that v1.5.0 no longer puts in your way every time.