From 6af97b9265a481357637ab3bb509681650dbe83d Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Tue, 6 Oct 2026 00:32:59 +0000 Subject: [PATCH 1/2] chore(main): release 4.0.0 --- .release-please-manifest.json | 2 +- CHANGELOG.md | 48 +++++++++++++++++++++++++++++++++++ README.md | 8 +++--- docs/howto/acq.md | 4 +-- install.ps1 | 2 +- install.sh | 2 +- package.json | 2 +- 7 files changed, 58 insertions(+), 10 deletions(-) diff --git a/.release-please-manifest.json b/.release-please-manifest.json index ada7355e..e6f87756 100644 --- a/.release-please-manifest.json +++ b/.release-please-manifest.json @@ -1,3 +1,3 @@ { - ".": "3.1.0" + ".": "4.0.0" } diff --git a/CHANGELOG.md b/CHANGELOG.md index d0b56fdf..585e916e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,54 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [4.0.0](https://github.com/GSA-TTS/agentic-coding-quickstart/compare/v3.1.0...v4.0.0) (2026-10-06) + + +### ⚠ BREAKING CHANGES + +* **kits:** acq no longer installs podman/OCI tooling by default. Users who need docker, docker compose, or rootless podman when the base image doesn't provide it must opt into the oci-engine kit with `acq configure`, `--kit`, or `ACQ_EXTRA_KITS`. + +### Features + +* **acq:** choose the host port per sandbox, and let --publish pin it ([#526](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/526)) ([410f332](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/410f332074c5df830e2a6bff215679314aa7739f)) +* **acq:** export ACQ_WORKSPACE and ACQ_CLONE into the guest on both backends ([#457](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/457)) ([e0b9a3b](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/e0b9a3b60d878080094264b407b03fb830c48c4e)) +* **acq:** interactive `acq configure` UI for extra kits + token-scoping defaults ([#500](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/500)) ([13d9d3a](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/13d9d3a6f556345b332aa4f6d8d6f9d6c516f919)) +* **kits:** adopt pinned agent and capability kits ([#474](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/474)) ([6a67063](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/6a6706321bae66d6e3f8993afbb64eaf01cf8561)) +* **secrets:** add Windows-native DPAPI secret backend ([#464](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/464)) ([907f404](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/907f4043d14d65e1b70fb62eef6b1d4d8dac4606)) +* **windows:** add acq preview install path ([#463](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/463)) ([d6d76f4](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/d6d76f4407b83bcba38c764f364b6c1b64f174aa)) + + +### Bug Fixes + +* **acq:** use sandbox workspace for github scoping ([#476](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/476)) ([1610835](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/16108359f2b446ae672131cbe66c8bd68d6935ba)) +* **ci:** bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS advisory ([#454](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/454)) ([3217b49](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/3217b498e8cf54a6eab08afceeffeec3e646d19b)) +* **ci:** bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory ([#459](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/459)) ([c2291bf](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/c2291bf42da28145b0d67a2db3e9675b9e644e75)) +* **ci:** centralize markdownlint coverage ([#548](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/548)) ([a27c31e](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/a27c31e3a98860a2ed329595e3da6d21d767d441)) +* **ci:** pin markdownlint-cli2 once, clear GHSA-253c, unify file selection ([#527](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/527)) ([e712685](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/e7126850bc216b19a17d4f01001ef43fb9b150c7)) +* **ci:** unblock unrelated PRs from the bash32 required-check deadlock ([#513](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/513)) ([187aa57](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/187aa57bd7294a3d04527805f3ee5a95017c0ed8)) +* **install:** keep curl | sh stdin intact and tap msb formula first ([#462](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/462)) ([c808d74](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/c808d740d5a3553b4e51d7d41069242d1ed914b8)) +* **install:** trust the microsandbox-acq dependency before brew install ([#534](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/534)) ([ffac0fa](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/ffac0fa21e5dacef6df3cb0543938da078840d81)) +* **kits:** land collapsed kit stack implementation ([#549](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/549)) ([bcd5b9c](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/bcd5b9cccc89ac56b327a1461c078f777e39e0f0)) +* **msb:** allow Playwright browser downloads ([#477](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/477)) ([0c399c5](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/0c399c565b7217f8242de62ff1304d436c091d53)) +* **msb:** block unsafe 0.7 migration versions ([#510](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/510)) ([3634046](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/3634046a415f8fe5961767070c16fbadadf169f0)) +* **msb:** carry every origin URL, keep the scratch private, fail closed on a copy miss ([#488](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/488)) ([babcd49](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/babcd49c14dd3080d0d2c04c3baa6c411262d1cc)) +* **msb:** carry the source checkout's git identity into the --clone scratch ([#443](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/443)) ([320d784](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/320d784a78b63864e6a647c797b06849e7d3b87d)) +* **msb:** follow the host resolvers and disable DNS rebind protection in the guest ([#444](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/444)) ([d2f4bdc](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/d2f4bdc7794d8b99319b37bd0a859e8aecfe6f4b)) +* **msb:** point the --clone scratch's origin at the source checkout's remote ([#455](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/455)) ([7f48b94](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/7f48b949fd12ca8da65cc5a26eab02723e398103)) +* **msb:** refresh ssh authorization for port publish ([#446](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/446)) ([72a6bd5](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/72a6bd5ca57877498b123bca24719ad99a8325d8)) +* **msb:** session parity for exec/attach/shell (cwd, terminal identity, login shell) ([#427](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/427)) ([6261eda](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/6261eda7f8b5b0f0a4402bb27ea584467bb4abcb)) +* **msb:** skip the recursive home chown when the image baked the agent user ([#432](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/432)) ([d8f66a4](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/d8f66a43d10a01ce8318194bb0c82518a69e1346)) +* **msb:** thread the merged kit env onto kit lifecycle commands ([#519](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/519)) ([2248a92](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/2248a92c14c8c190728b220a7d1024e379ebd27a)) +* **msb:** translate kit wildcard network rules ([#451](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/451)) ([e22bbc3](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/e22bbc37520dc4292a3290ab988e3ea2a34500b7)) +* **msb:** verify post-hoc port forward listener ([#530](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/530)) ([8ca50e1](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/8ca50e17667cbbcfd4260aa6789d1d37e124f570)) +* **msb:** warn on broadened kit wildcard rules ([#460](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/460)) ([6ded3ce](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/6ded3ce250f57a86c1bb46e898e2901a2af76bbb)) +* **msb:** warn when ssh-agent route is missing ([#448](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/448)) ([3a767a4](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/3a767a4bf7a3957cd0179d9dcb3c3d8943119e0b)) +* **sbx:** emit valid setup.install shape for the git-identity mixin ([#492](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/492)) ([8e6160c](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/8e6160c63acc35bd48d0a3844e133ea3ad52a464)) +* **sbx:** raise the version floor to 0.39.0, where sbx create --env first exists ([#491](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/491)) ([30f9ecf](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/30f9ecfde587f3394d853b0c4616c9562baef5b3)) +* **sbx:** wait for startup barrier before attach ([#512](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/512)) ([33c83c5](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/33c83c56eecd8705c1986233eb6e5aa5e23a6c0a)) +* **secret:** reject multiline test secret values ([#447](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/447)) ([f2da950](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/f2da950ef3da1e81f7a1aed548578b972550e06a)) +* **secrets:** propagate rotation across backends ([#509](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/509)) ([9641958](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/9641958f3fd4f0c2bd26bd453b29402d750da990)) + ## [3.1.0](https://github.com/GSA-TTS/agentic-coding-quickstart/compare/v3.0.0...v3.1.0) (2026-09-01) diff --git a/README.md b/README.md index b838da87..df1ed446 100644 --- a/README.md +++ b/README.md @@ -86,7 +86,7 @@ Run the one-line installer for your shell. ```bash -curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v3.1.0/install.sh | sh +curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.0/install.sh | sh ``` @@ -96,7 +96,7 @@ curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/downloa ```powershell -irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v3.1.0/install.ps1 | iex +irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.0/install.ps1 | iex ``` @@ -143,7 +143,7 @@ CLI (`gh`), you can also verify the release asset attestations before running anything: ```bash -ACQ_VERSION=3.1.0 # x-release-please-version +ACQ_VERSION=4.0.0 # x-release-please-version curl -fsSLO "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v${ACQ_VERSION}/install.sh" curl -fsSLO "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v${ACQ_VERSION}/SHA256SUMS" gh attestation verify install.sh --repo GSA-TTS/agentic-coding-quickstart @@ -165,7 +165,7 @@ For Windows preview installs, download and inspect the PowerShell installer instead: ```powershell -$AcqVersion = "3.1.0" # x-release-please-version +$AcqVersion = "4.0.0" # x-release-please-version $BaseUrl = "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v$AcqVersion" Invoke-WebRequest "$BaseUrl/install.ps1" -OutFile install.ps1 Get-Content .\install.ps1 diff --git a/docs/howto/acq.md b/docs/howto/acq.md index db22b640..d992a698 100644 --- a/docs/howto/acq.md +++ b/docs/howto/acq.md @@ -227,7 +227,7 @@ reboot the machine. ```powershell -irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v3.1.0/install.ps1 | iex +irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.0/install.ps1 | iex ``` @@ -235,7 +235,7 @@ irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v3.1. For an inspect-first install: ```powershell -$AcqVersion = "3.1.0" # x-release-please-version +$AcqVersion = "4.0.0" # x-release-please-version $BaseUrl = "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v$AcqVersion" Invoke-WebRequest "$BaseUrl/install.ps1" -OutFile install.ps1 Get-Content .\install.ps1 diff --git a/install.ps1 b/install.ps1 index e7e8e26d..f81895a2 100644 --- a/install.ps1 +++ b/install.ps1 @@ -6,7 +6,7 @@ [CmdletBinding()] param( - [string]$Version = "3.1.0", # x-release-please-version + [string]$Version = "4.0.0", # x-release-please-version [string]$InstallDir = "", [string]$PackageUrl = "", [string]$Sha256 = "", diff --git a/install.sh b/install.sh index 9caad0f9..a01ac258 100644 --- a/install.sh +++ b/install.sh @@ -35,7 +35,7 @@ REPO_URL="${ACQ_INSTALL_REPO_URL:-https://github.com/GSA-TTS/agentic-coding-quic # release-please updates this version in release PRs. Release automation also # publishes an install.sh asset with DEFAULT_RELEASE_SHA replaced by the exact # release commit so clone installs can verify they landed on that commit. -DEFAULT_RELEASE_VERSION="3.1.0" # x-release-please-version +DEFAULT_RELEASE_VERSION="4.0.0" # x-release-please-version DEFAULT_RELEASE_REF="v$DEFAULT_RELEASE_VERSION" DEFAULT_RELEASE_SHA="" REF="${ACQ_INSTALL_REF:-$DEFAULT_RELEASE_REF}" diff --git a/package.json b/package.json index 876d9d53..5ab2ba80 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "@gsa-tts/agentic-coding-quickstart", "//version": "Managed by release-please via extra-files in release-please-config.json; do not edit by hand.", - "version": "3.1.0", + "version": "4.0.0", "description": "acq — run AI coding agents inside a federally-configured sandbox (SBX or MSB) with USAi endpoints", "type": "module", "bin": { From f6d81bd64338c41a49b8993db9db52ef20c3564d Mon Sep 17 00:00:00 2001 From: Bret Mogilefsky Date: Tue, 6 Oct 2026 00:40:11 +0000 Subject: [PATCH 2/2] docs(changelog): restore omitted 4.0.0 entries Add the two OpenCode/OCI breaking-change notes announced in #474's merge commit but dropped by the generated changelog, plus the #471 network feature and #452 README fix whose non-conventional squash subjects hid them from release-please. --- CHANGELOG.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 585e916e..27682208 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,13 +10,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### ⚠ BREAKING CHANGES -* **kits:** acq no longer installs podman/OCI tooling by default. Users who need docker, docker compose, or rootless podman when the base image doesn't provide it must opt into the oci-engine kit with `acq configure`, `--kit`, or `ACQ_EXTRA_KITS`. +* **kits:** acq no longer installs podman/OCI tooling by default. Users who need docker, docker compose, or rootless podman when the base image doesn't provide it must opt into the oci-engine kit with `acq configure`, `--kit`, or `ACQ_EXTRA_KITS`. +* **kits:** acq no longer performs native OpenCode npm fallback installation. OpenCode is supplied by the pinned opencode agent kit from agentic-coding-patterns v1.12.0, currently delivering OpenCode v2.0.22. If the kit is unavailable or invalid, acq fails closed instead of installing opencode-ai from npm. +* **kits:** existing acq sandboxes with adapter-installed podman are not migrated in place. Recreate affected sandboxes or add the oci-engine kit before relying on OCI behavior after stop/start. ### Features * **acq:** choose the host port per sandbox, and let --publish pin it ([#526](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/526)) ([410f332](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/410f332074c5df830e2a6bff215679314aa7739f)) * **acq:** export ACQ_WORKSPACE and ACQ_CLONE into the guest on both backends ([#457](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/457)) ([e0b9a3b](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/e0b9a3b60d878080094264b407b03fb830c48c4e)) * **acq:** interactive `acq configure` UI for extra kits + token-scoping defaults ([#500](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/500)) ([13d9d3a](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/13d9d3a6f556345b332aa4f6d8d6f9d6c516f919)) +* **network:** add workshop.cloud.gov to the balanced hosts ([#471](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/471)) ([a503287](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/a503287)) * **kits:** adopt pinned agent and capability kits ([#474](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/474)) ([6a67063](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/6a6706321bae66d6e3f8993afbb64eaf01cf8561)) * **secrets:** add Windows-native DPAPI secret backend ([#464](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/464)) ([907f404](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/907f4043d14d65e1b70fb62eef6b1d4d8dac4606)) * **windows:** add acq preview install path ([#463](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/463)) ([d6d76f4](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/d6d76f4407b83bcba38c764f364b6c1b64f174aa)) @@ -32,6 +35,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 * **ci:** unblock unrelated PRs from the bash32 required-check deadlock ([#513](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/513)) ([187aa57](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/187aa57bd7294a3d04527805f3ee5a95017c0ed8)) * **install:** keep curl | sh stdin intact and tap msb formula first ([#462](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/462)) ([c808d74](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/c808d740d5a3553b4e51d7d41069242d1ed914b8)) * **install:** trust the microsandbox-acq dependency before brew install ([#534](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/534)) ([ffac0fa](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/ffac0fa21e5dacef6df3cb0543938da078840d81)) +* **msb:** correct copy-paste command in README ([#452](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/452)) ([83734f9](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/83734f9)) * **kits:** land collapsed kit stack implementation ([#549](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/549)) ([bcd5b9c](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/bcd5b9cccc89ac56b327a1461c078f777e39e0f0)) * **msb:** allow Playwright browser downloads ([#477](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/477)) ([0c399c5](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/0c399c565b7217f8242de62ff1304d436c091d53)) * **msb:** block unsafe 0.7 migration versions ([#510](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/510)) ([3634046](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/3634046a415f8fe5961767070c16fbadadf169f0))