chore(main): release 0.4.0

[github-actions]

🤖 I have created a release beep boop

0.4.0 (2026-07-17)

Features

• aimlapi: AI/ML API provider with guided onboarding (top-up + key issuance) (#655) (6b9c2f0)
• cli: show ZERO wordmark on --version (#673) (9acb411)
• cli: wire MCP serve WorkspaceRoot and --add-dir scope (#694) (75a78e7)
• npm: ship the native binary as platform optionalDependencies (#626) (5e1405d)
• perf: emit prompt-prefix hash fingerprint per turn (#704) (1c5c6e7)
• providers: add AI/ML API preset (rebased onto main) (#621) (d66a9dd)
• providers: refresh MiniMax model coverage (#665) (fa3052a)
• skills: discover shared ~/.agents/skills with multi-root skill loading (#696) (7d57999)
• tui: Ctrl+X leader chords and emacs menu navigation (#699) (7f669f4)
• tui: press up to edit queued messages (#656) (4c986d3)

Bug Fixes

• acp: make truncateHint rune-safe (#614) (ddc4927)
• agent,tui: resolve git branch detection when starting Zero in subdirectories (#613) (0184581)
• agent: raise default and deep-mode turn budgets (#650) (635c93a)
• cli: prevent consuming positional arguments as flag values (#619) (5b4f48d)
• config: enforce MCP trust boundary so project config cannot override user disable (#609) (4d8c31c), closes #512
• config: surface unknown/typo'd config fields instead of silently dropping them (#645) (893b7b4)
• cron: prevent cron job Mutate from clobbering concurrent updates (#630) (e4bd703)
• daemon: handle os.ErrPermission as collision during O_EXCL lock creation (#616) (8ea5384)
• exec: stop false INCOMPLETE downgrades on conversational final messages (#608) (b6117af)
• harden MCP credential boundaries (#597) (fdddb05)
• hooks: fail closed on launch failures for beforeTool hooks (#629) (dc06fe7)
• hooks: run sessionEnd hooks after Esc/Ctrl+C interrupts (#606) (824ecdb)
• keyring: pass generic password via stdin on macOS (#574) (91ea6de)
• lock: prevent POSIX lock file overwrite and leak on Windows/Unix (#628) (da41c3a)
• openai: omit prompt_cache_key for openai-compatible providers (#636) (1af5882), closes #624
• plugins: resolve relative executable paths against plugin root (#627) (2efe6d5)
• sandbox: remove windowsWriteRestricted flag to fix DenyRead bypass (#612) (3d96ac7)
• sandbox: scrub dynamic credential env vars (#682) (9043bae)
• sandbox: scrub sensitive credentials from sandbox environment (#660) (6fc1220)
• sandbox: unblock git fetch/commit/add under the write-restricted sandbox (#654) (5c4815a)
• sandbox: use WRITE_RESTRICTED token when no DenyRead paths are configured (#658) (a5d2e32)
• securefile,credstore: call Sync on temp file before close and rename (#631) (212734a)
• securefile: reclaim stale lock files to prevent permanent DOS (#615) (8536cc8)
• swarm: wait for job.Runs directly in scheduler skip test (#667) (1bb6b57)
• tools: classify silent wrapped Windows command failures as sandbox denials (#659) (8bd9742)
• tools: preserve SysProcAttr during PTY fallback (#618) (f78b36c)
• tui: resolve pending askUser callbacks to prevent runner hangs (#620) (aa73a76)
• tui: stop the composer cursor blinking while typing or unfocused (#672) (2b42cd5)
• windows: resolve absolute path for taskkill to prevent hijacking (#617) (2db00ee)

Performance Improvements

• tools: add explicit effect metadata for safe concurrency (#705) (8ef8576)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Zero automated PR review

Verdict: No blockers found

Blockers

• None found.

Validation

• [pass] Diff hygiene: git diff --check
• [pass] Tests: go test ./...
• [pass] Build: go run ./cmd/zero-release build
• [pass] Smoke build: go run ./cmd/zero-release smoke

Scope

Head: 167ff9b12d71
Changed files (4): .release-please-manifest.json, CHANGELOG.md, package-lock.json, package.json

This deterministic review checks validation status and basic diff hygiene. A human reviewer still owns product judgment and design quality.

[github-actions]

🤖 Created releases:

• v0.4.0

🌻