v0.10.0

Infisical/agent-vaultv0.10.0Apr 23, 2026by github-actions[bot]

AI Summary

This release introduces container sandbox mode for vault run, adds OpenCode as a supported coding agent, and adds a shorthand command alias. It also includes important bug fixes for the sandbox including exit codes, reserved destinations, root-uid, and egress tests.

Key Highlights

Added --sandbox=container mode to vault run for enhanced isolation
OpenCode added as a supported coding agent
Added agent-vault run shorthand for agent-vault vault run
Bug fixes for sandbox: exit codes, reserved destinations, root-uid, egress tests

New Features

Container sandbox mode (--sandbox=container)
OpenCode coding agent support
Command shorthand alias (agent-vault run)

Full Release Notes

## Changelog
* 668b241aae980cabd1feddf356c27f9092bc743f feat: add --sandbox=container mode to vault run (#99)
* 5f3e36fbda457b931b634f8d50085c99518f2a73 feat: add OpenCode as a supported coding agent (#101)
* c8b6461d5f0d31f3dbb52ec3730074fe66fe9401 feat: add `agent-vault run` shorthand for `agent-vault vault run` (#102)
* 2b8e020270fdb6499c81ab8c0fef0a94caeb5aa1 fix(sandbox): post-merge audit — exit codes, reserved dsts, root-uid, egress tests (#103)

## Verify

```bash
# Verify checksum
sha256sum --check checksums.txt

# Verify signature (requires cosign)
cosign verify-blob \
  --bundle checksums.txt.bundle \
  --certificate-identity-regexp "github.com/Infisical/agent-vault" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  checksums.txt
```