diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index e6f877563..cf533f280 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.0.0"
+  ".": "4.0.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6f7d97b5a..72edbbf1c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## [4.0.1](https://github.com/lobu-ai/lobu/compare/lobu-v4.0.0...lobu-v4.0.1) (2026-04-21)
+
+
+### Bug Fixes
+
+* **ci:** correct jq precedence in codex-auto-approve lookup ([#300](https://github.com/lobu-ai/lobu/issues/300)) ([86063c6](https://github.com/lobu-ai/lobu/commit/86063c647af6f92c0cd8f32b46f0237ff3487c7d))
+* **gateway:** gate agent API handlers with ownership check to prevent cross-tenant access ([#285](https://github.com/lobu-ai/lobu/issues/285)) ([ec8ff6b](https://github.com/lobu-ai/lobu/commit/ec8ff6bb28389acc023a9b363bb8bbd7813518ad))
+
 ## [4.0.0](https://github.com/lobu-ai/lobu/compare/lobu-v3.7.0...lobu-v4.0.0) (2026-04-21)
 
 
diff --git a/charts/lobu/Chart.yaml b/charts/lobu/Chart.yaml
index 1793aeb52..9a785ebf6 100644
--- a/charts/lobu/Chart.yaml
+++ b/charts/lobu/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: lobu
 description: Lobu - Kubernetes deployment for thread-based AI conversations
 type: application
-version: 4.0.0
-appVersion: 4.0.0
+version: 4.0.1
+appVersion: 4.0.1
 keywords:
   - claude
   - slack
diff --git a/package.json b/package.json
index 0d916760e..e7d9759ac 100644
--- a/package.json
+++ b/package.json
@@ -1,13 +1,13 @@
 {
   "name": "lobu-monorepo",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Deploy autonomous AI agents with sandboxing, network isolation, and multi-platform access.",
   "license": "Apache-2.0",
   "workspaces": [
     "packages/*"
   ],
   "scripts": {
-    "build": "cd packages/core && bun run build && cd ../gateway && bun run build && cd ../worker && bun run build && cd ../..",
+    "build": "cd packages/core && bun run build && cd ../cli-core && bun run build && cd ../gateway && bun run build && cd ../worker && bun run build && cd ../..",
     "format": "biome format --config-path config/biome.config.json --write .",
     "format:check": "biome format --config-path config/biome.config.json .",
     "lint": "biome lint --config-path config/biome.config.json .",
@@ -21,12 +21,12 @@
     "jscpd": "bunx jscpd --pattern \"packages/**/*.ts\" --reporters \"console\" --ignore \"**/node_modules/**,**/dist/**,**/coverage/**,**/.bun/**,**/.turbo/**,workspaces/**,charts/**,integration-tests/**,bin/**,**/__tests__/**,**/__mocks__/**,**/*.d.ts\"",
     "depcruise": "bunx --bun depcruise --config config/dependency-cruiser.config.cjs packages",
     "dev": "docker compose -f docker/docker-compose.yml watch",
-    "build:packages": "cd packages/core && bun run build && cd ../gateway && bun run build && cd ../worker && bun run build && cd ../cli && bun run build",
+    "build:packages": "cd packages/core && bun run build && cd ../cli-core && bun run build && cd ../gateway && bun run build && cd ../worker && bun run build && cd ../cli && bun run build",
     "build:owletto": "cd packages/owletto-sdk && bun run build && cd ../owletto-embeddings && bun run build && cd ../owletto-cli && bun run build && cd ../..",
-    "watch:packages": "tsc -b --watch packages/core packages/gateway packages/worker",
+    "watch:packages": "tsc -b --watch packages/core packages/cli-core packages/gateway packages/worker",
     "test:packages": "cd packages/core && bun run test && cd ../gateway && bun run test && cd ../worker && bun run test",
     "test:owletto": "cd packages/owletto-cli && bun run runtime:prepare && cd ../..",
-    "typecheck:packages": "cd packages/core && bun run typecheck && cd ../gateway && bun run typecheck && cd ../worker && bun run typecheck",
+    "typecheck:packages": "cd packages/core && bun run typecheck && cd ../cli-core && bun run typecheck && cd ../gateway && bun run typecheck && cd ../worker && bun run typecheck",
     "typecheck:owletto": "cd packages/owletto-backend && bun run typecheck && cd ../owletto-cli && bun run typecheck && cd ../owletto-embeddings && bun run typecheck && cd ../owletto-sdk && bun run typecheck && cd ../..",
     "knip": "bunx knip --config config/knip.ts",
     "gitleaks": "docker run --rm -v $(pwd):/repo -w /repo zricethezav/gitleaks:latest detect --source=/repo --no-git --redact --config=/repo/config/gitleaks.toml",
diff --git a/packages/cli-core/package.json b/packages/cli-core/package.json
new file mode 100644
index 000000000..bd625ffbc
--- /dev/null
+++ b/packages/cli-core/package.json
@@ -0,0 +1,36 @@
+{
+  "name": "@lobu/cli-core",
+  "version": "4.0.1",
+  "license": "Apache-2.0",
+  "type": "module",
+  "description": "Shared CLI internals for @lobu/cli — local-config loader, credential store, context resolution",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "bun": "./src/index.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/lobu-ai/lobu.git",
+    "directory": "packages/cli-core"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  }
+}
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 22a9cc659..c0240e717 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lobu/cli",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "CLI for deploying and managing AI agents on Lobu",
   "type": "module",
   "main": "dist/index.js",
@@ -26,6 +26,7 @@
     "directory": "packages/cli"
   },
   "dependencies": {
+    "@lobu/cli-core": "workspace:*",
     "@lobu/core": "workspace:*",
     "chalk": "^5.3.0",
     "commander": "^12.0.0",
diff --git a/packages/core/package.json b/packages/core/package.json
index 71b9f7cae..1c28f282a 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lobu/core",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "license": "Apache-2.0",
   "description": "Core types and utilities for Lobu agent platform",
   "repository": {
diff --git a/packages/gateway/package.json b/packages/gateway/package.json
index b54e28c06..20d24044b 100644
--- a/packages/gateway/package.json
+++ b/packages/gateway/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lobu/gateway",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "license": "Apache-2.0",
   "description": "Lobu SDK — embed AI agents with platform adapters, worker orchestration, and MCP proxy",
   "repository": {
diff --git a/packages/owletto-cli/package.json b/packages/owletto-cli/package.json
index 4080b8b68..180f3bb03 100644
--- a/packages/owletto-cli/package.json
+++ b/packages/owletto-cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "owletto",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Unified CLI for Lobu memory — dev, deploy, and manage from one command",
   "type": "module",
   "bin": {
diff --git a/packages/owletto-openclaw/package.json b/packages/owletto-openclaw/package.json
index 70dd6e247..2c8763b2a 100644
--- a/packages/owletto-openclaw/package.json
+++ b/packages/owletto-openclaw/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lobu/owletto-openclaw",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Lobu memory plugin for OpenClaw",
   "type": "module",
   "main": "dist/index.js",
diff --git a/packages/owletto-sdk/package.json b/packages/owletto-sdk/package.json
index 6f5359ad8..09483ea39 100644
--- a/packages/owletto-sdk/package.json
+++ b/packages/owletto-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lobu/owletto-sdk",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Lobu memory SDK — build pluggable connectors for Lobu memory",
   "type": "module",
   "main": "dist/index.js",
diff --git a/packages/worker/package.json b/packages/worker/package.json
index baa265341..c7f951f94 100644
--- a/packages/worker/package.json
+++ b/packages/worker/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lobu/worker",
-  "version": "4.0.0",
+  "version": "4.0.1",
   "description": "Lobu worker runtime - run in your own Docker image or use our base image",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",