v0.4.0

Features

• locksmith mcp run --url now resolves templated headers on JSON-RPC error or tool-level result.isError, not only on HTTP 401/403; one retry per session, structural-only detection (no keyword matching on result.content[].text)
• add 1Password vault plugin (backed by the op CLI; auto-detected when op is installed)
• add vaults.<name>.vault config field, delivered to plugins as opts["vault"]; used by the 1Password plugin to qualify non-op:// paths
• add locksmith restart command with --timeout / --no-start (see docs/restart.md)
• per-agent installer logic moved into internal/initflow/agents/<name>/ subpackages; Gemini CLI is now actually detected and dispatched (previously dead code)
• agent instruction templates are wrapped with <!-- LOCKSMITH_START --> / <!-- LOCKSMITH_END --> markers so the managed block can be located and updated reliably
• agent instruction templates are now agent-specific: per-agent session protocol (Claude via UserPromptSubmit hook; Codex / Gemini / OpenCode / generic via export LOCKSMITH_SESSION=$(locksmith session ensure --quiet)) and usage examples for gopass, keychain, 1password
• agent templates document an MCP-wrapper fallback: when a wrapped MCP server fails, the agent resolves --header / --env templates via locksmith get and runs the server directly
• agent templates document an external HTTP API auth-failure recovery prompt: on the first 401/403 for a hostname, the agent offers Skip / locksmith key or vault+path / paste-token; resolved tokens are cached per hostname for the session
• locksmith init adds Bash(locksmith:*) to permissions.allow in ~/.claude/settings.json so the agent can call locksmith directly (idempotent)
• locksmith init appends an idempotent PATH-augmentation block to ~/.zshrc / ~/.bashrc / ~/.config/fish/config.fish when the locksmith binary directory is not already on $PATH (never creates new rc files)
• locksmith init now auto-restarts the running daemon at the end of its run so plugin/config changes take effect immediately
• locksmith init installs a Codex SessionStart hook in ~/.codex/hooks.json when Codex is detected; the hook pre-warms the daemon so vault unlock fires before the agent's first secret request (best-effort; failures swallowed)
• Claude Code UserPromptSubmit hook switched to the native locksmith session ensure --hook invocation (JSON env block via encoding/json, no shell script); existing installs are auto-migrated on next locksmith init (legacy agent-hook.sh references rewritten in place, matching Bash(.../agent-hook.sh) permission rule dropped, on-disk script removed)