chore(main): release 4.0.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "3.1.0"
+  ".": "4.0.0"
 }

CHANGELOG.md

@@ -5,6 +5,58 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.0.0](https://github.com/GSA-TTS/agentic-coding-quickstart/compare/v3.1.0...v4.0.0) (2026-10-06)
+
+
+### ⚠ BREAKING CHANGES
+
+* **kits:** acq no longer installs podman/OCI tooling by default. Users who need docker, docker compose, or rootless podman when the base image doesn't provide it must opt into the oci-engine kit with `acq configure`, `--kit`, or `ACQ_EXTRA_KITS`.
+* **kits:** acq no longer performs native OpenCode npm fallback installation. OpenCode is supplied by the pinned opencode agent kit from agentic-coding-patterns v1.12.0, currently delivering OpenCode v2.0.22. If the kit is unavailable or invalid, acq fails closed instead of installing opencode-ai from npm.
+* **kits:** existing acq sandboxes with adapter-installed podman are not migrated in place. Recreate affected sandboxes or add the oci-engine kit before relying on OCI behavior after stop/start.
+
+### Features
+
+* **acq:** choose the host port per sandbox, and let --publish pin it ([#526](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/526)) ([410f332](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/410f332074c5df830e2a6bff215679314aa7739f))
+* **acq:** export ACQ_WORKSPACE and ACQ_CLONE into the guest on both backends ([#457](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/457)) ([e0b9a3b](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/e0b9a3b60d878080094264b407b03fb830c48c4e))
+* **acq:** interactive `acq configure` UI for extra kits + token-scoping defaults ([#500](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/500)) ([13d9d3a](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/13d9d3a6f556345b332aa4f6d8d6f9d6c516f919))
+* **network:** add workshop.cloud.gov to the balanced hosts ([#471](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/471)) ([a503287](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/a503287))
+* **kits:** adopt pinned agent and capability kits ([#474](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/474)) ([6a67063](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/6a6706321bae66d6e3f8993afbb64eaf01cf8561))
+* **secrets:** add Windows-native DPAPI secret backend ([#464](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/464)) ([907f404](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/907f4043d14d65e1b70fb62eef6b1d4d8dac4606))
+* **windows:** add acq preview install path ([#463](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/463)) ([d6d76f4](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/d6d76f4407b83bcba38c764f364b6c1b64f174aa))
+
+
+### Bug Fixes
+
+* **acq:** use sandbox workspace for github scoping ([#476](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/476)) ([1610835](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/16108359f2b446ae672131cbe66c8bd68d6935ba))
+* **ci:** bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS advisory ([#454](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/454)) ([3217b49](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/3217b498e8cf54a6eab08afceeffeec3e646d19b))
+* **ci:** bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory ([#459](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/459)) ([c2291bf](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/c2291bf42da28145b0d67a2db3e9675b9e644e75))
+* **ci:** centralize markdownlint coverage ([#548](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/548)) ([a27c31e](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/a27c31e3a98860a2ed329595e3da6d21d767d441))
+* **ci:** pin markdownlint-cli2 once, clear GHSA-253c, unify file selection ([#527](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/527)) ([e712685](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/e7126850bc216b19a17d4f01001ef43fb9b150c7))
+* **ci:** unblock unrelated PRs from the bash32 required-check deadlock ([#513](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/513)) ([187aa57](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/187aa57bd7294a3d04527805f3ee5a95017c0ed8))
+* **install:** keep curl | sh stdin intact and tap msb formula first ([#462](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/462)) ([c808d74](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/c808d740d5a3553b4e51d7d41069242d1ed914b8))
+* **install:** trust the microsandbox-acq dependency before brew install ([#534](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/534)) ([ffac0fa](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/ffac0fa21e5dacef6df3cb0543938da078840d81))
+* **msb:** correct copy-paste command in README ([#452](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/452)) ([83734f9](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/83734f9))
+* **kits:** land collapsed kit stack implementation ([#549](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/549)) ([bcd5b9c](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/bcd5b9cccc89ac56b327a1461c078f777e39e0f0))
+* **msb:** allow Playwright browser downloads ([#477](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/477)) ([0c399c5](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/0c399c565b7217f8242de62ff1304d436c091d53))
+* **msb:** block unsafe 0.7 migration versions ([#510](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/510)) ([3634046](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/3634046a415f8fe5961767070c16fbadadf169f0))
+* **msb:** carry every origin URL, keep the scratch private, fail closed on a copy miss ([#488](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/488)) ([babcd49](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/babcd49c14dd3080d0d2c04c3baa6c411262d1cc))
+* **msb:** carry the source checkout's git identity into the --clone scratch ([#443](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/443)) ([320d784](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/320d784a78b63864e6a647c797b06849e7d3b87d))
+* **msb:** follow the host resolvers and disable DNS rebind protection in the guest ([#444](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/444)) ([d2f4bdc](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/d2f4bdc7794d8b99319b37bd0a859e8aecfe6f4b))
+* **msb:** point the --clone scratch's origin at the source checkout's remote ([#455](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/455)) ([7f48b94](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/7f48b949fd12ca8da65cc5a26eab02723e398103))
+* **msb:** refresh ssh authorization for port publish ([#446](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/446)) ([72a6bd5](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/72a6bd5ca57877498b123bca24719ad99a8325d8))
+* **msb:** session parity for exec/attach/shell (cwd, terminal identity, login shell) ([#427](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/427)) ([6261eda](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/6261eda7f8b5b0f0a4402bb27ea584467bb4abcb))
+* **msb:** skip the recursive home chown when the image baked the agent user ([#432](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/432)) ([d8f66a4](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/d8f66a43d10a01ce8318194bb0c82518a69e1346))
+* **msb:** thread the merged kit env onto kit lifecycle commands ([#519](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/519)) ([2248a92](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/2248a92c14c8c190728b220a7d1024e379ebd27a))
+* **msb:** translate kit wildcard network rules ([#451](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/451)) ([e22bbc3](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/e22bbc37520dc4292a3290ab988e3ea2a34500b7))
+* **msb:** verify post-hoc port forward listener ([#530](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/530)) ([8ca50e1](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/8ca50e17667cbbcfd4260aa6789d1d37e124f570))
+* **msb:** warn on broadened kit wildcard rules ([#460](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/460)) ([6ded3ce](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/6ded3ce250f57a86c1bb46e898e2901a2af76bbb))
+* **msb:** warn when ssh-agent route is missing ([#448](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/448)) ([3a767a4](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/3a767a4bf7a3957cd0179d9dcb3c3d8943119e0b))
+* **sbx:** emit valid setup.install shape for the git-identity mixin ([#492](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/492)) ([8e6160c](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/8e6160c63acc35bd48d0a3844e133ea3ad52a464))
+* **sbx:** raise the version floor to 0.39.0, where sbx create --env first exists ([#491](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/491)) ([30f9ecf](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/30f9ecfde587f3394d853b0c4616c9562baef5b3))
+* **sbx:** wait for startup barrier before attach ([#512](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/512)) ([33c83c5](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/33c83c56eecd8705c1986233eb6e5aa5e23a6c0a))
+* **secret:** reject multiline test secret values ([#447](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/447)) ([f2da950](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/f2da950ef3da1e81f7a1aed548578b972550e06a))
+* **secrets:** propagate rotation across backends ([#509](https://github.com/GSA-TTS/agentic-coding-quickstart/issues/509)) ([9641958](https://github.com/GSA-TTS/agentic-coding-quickstart/commit/9641958f3fd4f0c2bd26bd453b29402d750da990))
+
 ## [3.1.0](https://github.com/GSA-TTS/agentic-coding-quickstart/compare/v3.0.0...v3.1.0) (2026-09-01)
 
 

README.md

@@ -86,7 +86,7 @@ Run the one-line installer for your shell.
 <!-- x-release-please-start-version -->
 
 ```bash
-curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v3.1.0/install.sh | sh
+curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.0/install.sh | sh
 ```
 
 <!-- x-release-please-end -->
@@ -96,7 +96,7 @@ curl -fsSL https://github.com/GSA-TTS/agentic-coding-quickstart/releases/downloa
 <!-- x-release-please-start-version -->
 
 ```powershell
-irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v3.1.0/install.ps1 | iex
+irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.0/install.ps1 | iex
 ```
 
 <!-- x-release-please-end -->
@@ -143,7 +143,7 @@ CLI (`gh`), you can also verify the release asset attestations before running
 anything:
 
 ```bash
-ACQ_VERSION=3.1.0 # x-release-please-version
+ACQ_VERSION=4.0.0 # x-release-please-version
 curl -fsSLO "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v${ACQ_VERSION}/install.sh"
 curl -fsSLO "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v${ACQ_VERSION}/SHA256SUMS"
 gh attestation verify install.sh --repo GSA-TTS/agentic-coding-quickstart
@@ -165,7 +165,7 @@ For Windows preview installs, download and inspect the PowerShell installer
 instead:
 
 ```powershell
-$AcqVersion = "3.1.0" # x-release-please-version
+$AcqVersion = "4.0.0" # x-release-please-version
 $BaseUrl = "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v$AcqVersion"
 Invoke-WebRequest "$BaseUrl/install.ps1" -OutFile install.ps1
 Get-Content .\install.ps1

docs/howto/acq.md

@@ -227,15 +227,15 @@ reboot the machine.
 <!-- x-release-please-start-version -->
 
 ```powershell
-irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v3.1.0/install.ps1 | iex
+irm https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v4.0.0/install.ps1 | iex
 ```
 
 <!-- x-release-please-end -->
 
 For an inspect-first install:
 
 ```powershell
-$AcqVersion = "3.1.0" # x-release-please-version
+$AcqVersion = "4.0.0" # x-release-please-version
 $BaseUrl = "https://github.com/GSA-TTS/agentic-coding-quickstart/releases/download/v$AcqVersion"
 Invoke-WebRequest "$BaseUrl/install.ps1" -OutFile install.ps1
 Get-Content .\install.ps1

install.ps1

@@ -6,7 +6,7 @@
 
 [CmdletBinding()]
 param(
-    [string]$Version = "3.1.0", # x-release-please-version
+    [string]$Version = "4.0.0", # x-release-please-version
     [string]$InstallDir = "",
     [string]$PackageUrl = "",
     [string]$Sha256 = "",

install.sh

@@ -35,7 +35,7 @@ REPO_URL="${ACQ_INSTALL_REPO_URL:-https://github.com/GSA-TTS/agentic-coding-quic
 # release-please updates this version in release PRs. Release automation also
 # publishes an install.sh asset with DEFAULT_RELEASE_SHA replaced by the exact
 # release commit so clone installs can verify they landed on that commit.
-DEFAULT_RELEASE_VERSION="3.1.0" # x-release-please-version
+DEFAULT_RELEASE_VERSION="4.0.0" # x-release-please-version
 DEFAULT_RELEASE_REF="v$DEFAULT_RELEASE_VERSION"
 DEFAULT_RELEASE_SHA=""
 REF="${ACQ_INSTALL_REF:-$DEFAULT_RELEASE_REF}"

package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gsa-tts/agentic-coding-quickstart",
   "//version": "Managed by release-please via extra-files in release-please-config.json; do not edit by hand.",
-  "version": "3.1.0",
+  "version": "4.0.0",
   "description": "acq — run AI coding agents inside a federally-configured sandbox (SBX or MSB) with USAi endpoints",
   "type": "module",
   "bin": {