jai-jail: init at 0.3 (#504873)

maintainers/maintainer-list.nix

@@ -813,6 +813,13 @@
     githubId = 19290901;
     name = "Andrew Brooks";
   };
+  agentelement = {
+    email = "agentelement@agentelement.net";
+    github = "agentelement";
+    githubId = 38045210;
+    name = "AgentElement";
+    keys = [ { fingerprint = "D37E 581D AD71 2378 A622  5BC0 CD13 9E3B 4354 34F1"; } ];
+  };
   agilesteel = {
     email = "agilesteel@gmail.com";
     github = "agilesteel";

nixos/modules/module-list.nix

@@ -245,6 +245,7 @@
   ./programs/iio-hyprland.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
+  ./programs/jai-jail.nix
   ./programs/java.nix
   ./programs/joycond-cemuhook.nix
   ./programs/k3b.nix

nixos/modules/programs/jai-jail.nix

@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.jai-jail;
+
+in
+{
+  options.programs.jai-jail = {
+    enable = lib.mkEnableOption "jai, a sandbox for AI agents";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.jai-jail;
+      defaultText = lib.literalExpression "pkgs.jai-jail";
+      description = "The jai package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.jai = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package}/bin/jai";
+    };
+
+    users.users.jai = {
+      isSystemUser = true;
+      group = "jai";
+      home = "/";
+      description = "JAI sandbox untrusted user";
+    };
+
+    users.groups.jai = { };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ agentelement ];
+}

pkgs/by-name/ja/jai-jail/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  gcc15Stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  pandoc,
+  systemd,
+  util-linux,
+  acl,
+}:
+
+gcc15Stdenv.mkDerivation (finalAttrs: {
+  pname = "jai-jail";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "stanford-scs";
+    repo = "jai";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AByC7Xh1FYbQ/4Au396m2zYUxsLqcF1PEbpdz7x6LaQ=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    pandoc
+    systemd
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  buildInputs = [
+    util-linux # libmount
+    acl
+  ];
+
+  configureFlags = [ "--with-untrusted-user=jai" ];
+
+  meta = {
+    description = "Lightweight jail for AI CLIs";
+    mainProgram = "jai";
+    homepage = "https://jai.scs.stanford.edu";
+    changelog = "https://github.com/stanford-scs/jai/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ agentelement ];
+    platforms = lib.platforms.linux;
+  };
+})