← All posts
By Aseem Shrey
announcementreleaseapprovalscost analytics

v1.8.0: Clearer approvals, faster cost reports

AgentJail v1.8.0 makes agents explain host access before approval and keeps local cost reports fast with an incremental usage index.

An AgentJail approval shows why a host command is needed beside a local cost report backed by an incremental index.

A command tells me what an agent wants to run. It doesn’t always tell me why I should approve it.

That difference matters when the command leaves the sandbox. git status and a release upload can both look like one more terminal line, but they don’t carry the same risk. I should not have to reconstruct the agent’s intent from the last 20 messages before clicking Allow.

AgentJail v1.8.0 makes that context part of the approval. It also fixes a rather different annoyance: agentjail cost looking stuck while it rereads a few gigabytes of local agent history.

Why before approval. Cost reports without the wait.

TL;DR

  • Host access now needs a reason. Agents use agentjail proxy --reason "..." -- <command>, and Codex shows that reason in its native approval.
  • Cost reports query a local index. They no longer rescan every retained Claude Code and Codex transcript each time you open the CLI or dashboard.
  • The index keeps itself current. The daemon refreshes it after startup and at local midnight, then catches up after sleep or downtime.
  • The privacy boundary stays boring. AgentJail stores usage facts for the report, not prompts, responses, commands, or tool output.

The command says what. The reason says why.

A protected agent can request one bounded host-side command through AgentJail:

agentjail proxy \
  --reason "Submit the signed v1.8 app for Apple notarization" \
  -- xcrun notarytool submit dist/AgentJail.zip --wait

The reason is required, single-line, and bounded. AgentJail puts it in the native Codex approval and binds it to the same one-use challenge as the exact command, session, arguments, and working directory.

If the reason is missing, changed, multiline, or too long, the host command does not run. If the approval is replayed, it does not run either.

This does not magically prove the agent is honest. It does make the claim visible at the point where a person has to decide. That is much better than an opaque token and a prayer :p

Cost reports without transcript archaeology

The old agentjail cost path reread every eligible Claude Code and Codex JSONL file before it printed a report. On one development machine, 974 Codex transcripts occupied 5.8 GB. The default report took 45 to 60 seconds.

It was not deadlocked. It just looked exactly like it was deadlocked, which is a fairly unhelpful distinction when you are staring at a quiet terminal.

v1.8.0 builds a typed cost index in AgentJail’s existing SQLite store. The first upgrade performs a resumable background backfill. After that, each refresh reads only complete records appended since the last durable checkpoint.

agentjail cost --period 30d

The CLI and Cost dashboard query the small projection. They do not fall back to a synchronous multi-gigabyte transcript scan. If the first backfill is still building, or a refresh failed and the index is stale, the report says so.

Daily, but not a fragile cron job

The daemon refreshes cost data once after it is ready and then at each local midnight. If the laptop sleeps through midnight, the job catches up when the daemon runs again.

I originally thought of this as a cron job. A separate cron entry would have duplicated install and lifecycle logic, and sleeping laptops are not famous for executing missed timers. So the small scheduler lives inside the supervised daemon. It only decides when a daily job may run. The cost index owns the actual checkpoint and catch-up rules.

That split also means the scheduler can host other daily maintenance later without becoming a miniature cron framework. No need to build Kubernetes for a calendar callback :p

What the index stores

The index keeps the facts needed to rebuild a report:

  • source and session identity
  • model and project attribution
  • timestamps and token categories
  • request-level pricing dimensions
  • Codex fork lineage
  • provider-recorded cost where it exists

It does not keep conversation text or tool results. OpenCode remains a typed read from its own local SQLite database and is folded into the projection during refresh.

Pricing can still change. AgentJail retains enough typed usage detail to rebuild derived dollar totals with a newer bundled catalog, without rereading provider transcripts.

Upgrade

Upgrade through the same channel you installed from:

brew upgrade agentjail
# or
agentjail update

Then check both parts of the release:

agentjail proxy --help
agentjail cost --period 30d
agentjail doctor

The first shows agents how to explain host access. The second should finally feel like a report, not an archaeological expedition.

Thanks for reading :)