APM – Agent Package Manager: baixar versions anteriors

What's Changed

🔧 Other Changes
- fix(hooks): render nested hook metadata as plain JSON by Abhishek Acharya (@abhishekacharya200) in #3211
- test(hooks): align cursor smoke expectations with native flat handlers by Mohammed Alkindi (@MohammedAlkindi) in #3198
- fix: install versioned marketplace package directories by sama Pyb (@Pybsama) in #3156
- fix: keep Codex MCP identity outside native settings by sama Pyb (@Pybsama) in #3157
- fix(cli): report only verified APM build revisions by Daniel Meppiel (@danielmeppiel) in #3280
- fix(hooks): admit and stage hook-only Git-path packages by Daniel Meppiel (@danielmeppiel) in #3282
- fix(hooks): type untyped flat command handlers for Claude by parth (@Parth-Vasave) in #3153
- Fix native Agent Plugin audit replay for Copilot targets by bodapatisaikrishna in #3257
- test(audit): preserve OpenCode local-bundle lifecycle coverage by Daniel Meppiel (@danielmeppiel) in #3292
- fix(auth): recover private files after API throttling by Daniel Meppiel (@danielmeppiel) in #3278
- fix(audit): preserve Grok Cloud target identity and historical checks by Daniel Meppiel (@danielmeppiel) in #3289
- fix(codex): preserve complete compatibility bundles through native user installs by Daniel Meppiel (@danielmeppiel) in #3294
- fix(lockfile): diagnose merge conflicts without automatic recovery by Lachlan Heywood (@lachieh) in #3028
- fix(policy): resolve marketplace object-form deps in ref-consistency check (#3220) by Abhinav Maurya (@Fire162) in #3221
- fix(install): verify local content in frozen mode by Wu Shuwen (@dajiaohuang) in #3236
- fix(pack): preserve and relocate plugin hook resources by Daniel Meppiel (@danielmeppiel) in #3301
- fix(install): include required indirect dependencies in dry-run previews by Daniel Meppiel (@danielmeppiel) in #3302
- fix(install): restore cold frozen plugins with verified MCP declarations by Daniel Meppiel (@danielmeppiel) in #3305
- fix(install): preserve frozen lock bytes and recorded native-service ownership by Daniel Meppiel (@danielmeppiel) in #3307
- fix(audit): preserve project scope across native Windows path spellings by Daniel Meppiel (@danielmeppiel) in #3316
- fix(schema): propose corrected manifest 0.1.48 contract by Daniel Meppiel (@danielmeppiel) in #3308
- fix(triage): prefetch and bound scheduled sweep candidates by Daniel Meppiel (@danielmeppiel) in #3277
- fix(install): capture acquired manifest versions on first install by Daniel Meppiel (@danielmeppiel) in #3311
- fix(deps): support local single-file dependencies by Daniel Meppiel (@danielmeppiel) in #3310
- fix(skills): preserve shared assets and deployment ownership by Daniel Meppiel (@danielmeppiel) in #3313
- fix(opencode): render native MCP environment references by Lenin Mookiah (@leninworld) in #3303
- fix(mcp): preserve conflicting native connections and verify managed updates by Daniel Meppiel (@danielmeppiel) in #3317
- Fix [BUG] Missing kiro prompts primitive entry by DBVamsi (@DBVamsi) in #3263
- fix(audit): respect intentional dependency MCP omissions by Daniel Meppiel (@danielmeppiel) in #3304
- fix(install): preflight selected skill plans before native deployment by Daniel Meppiel (@danielmeppiel) in #3314
- docs: make README manifest example installable by venkatayedidavs in #3086
- add(deps): support consumer-root source replacements by Daniel Meppiel (@danielmeppiel) in #3309
- fix: preserve Windows staging failures and recovery data by Daniel Meppiel (@danielmeppiel) in #3318
- fix(install): retire obsolete absent dependency claims after complete reintegration by Daniel Meppiel (@danielmeppiel) in #3315
- fix(install): persist replacement intent after the last dependency is removed by Daniel Meppiel (@danielmeppiel) in #3328
- fix(audit): fail closed when an explicit --policy cannot be loaded by Daniel Meppiel (@danielmeppiel) in #3230
- fix(ci): restore deterministic fixtures and marketplace replay by Daniel Meppiel (@danielmeppiel) in #3325
- fix(mcp): preserve verified

What's Changed

🔧 Other Changes
- fix(audit): validate skill subsets against prepared lock-pinned replay by Daniel Meppiel (@danielmeppiel) in #3147
- fix(git): preserve symlink capability config precedence by Daniel Meppiel (@danielmeppiel) in #3145
- fix(codex): preserve native agent model settings by Daniel Meppiel (@danielmeppiel) in #3150
- fix(hooks): render native Cursor hooks with import coexistence checks by Daniel Meppiel (@danielmeppiel) in #3149
- feat(install): add grok-bot install target for agent-data/workflows by Sergio Sisternes (@sergio-sisternes-epam) in #3106
- fix(install): stop --frozen rewriting the lockfile it freezes by Sebastian Alpers (@salpers) in #2384
- docs: explain package source vs installed copies by Aryan Singh K. (@aryansk) in #2599
- fix(auth): fall back to git credentials for ADO by mheeaxa in #2610
- feat(audit): allow SkillSpector --baseline through external args by Mohammed Alkindi (@MohammedAlkindi) in #2936
- perf(registry): parallelize independent MCP server-info fetches by Sergio Sisternes (@sergio-sisternes-epam) in #2983
- feat: add user-invocable agent frontmatter field (#3132) by richard-fowles-epam in #3133
- fix: clarify stale cleanup message by Hilary Asogwa (@Dansatch) in #3120
- docs(guide): correct ASCII framing, apm run stability, LSP discoverability by Mohammed Alkindi (@MohammedAlkindi) in #2647
- docs: fix stale README links by Shaurya Saria (@icecold009) in #3016
- fix(install): configure Cursor and OpenCode MCP servers at user scope by Alexei Vedernikov (@alvedder) in #3100
- fix(manifest): preserve x-* extension keys and warn on unknown apm.yml keys by Sergio Sisternes (@sergio-sisternes-epam) in #3222
- docs: explain linked context lifetime after install by Wu Shuwen (@dajiaohuang) in #3237
- fix(audit): replay the project's own content the way install deploys it by Aditya Nikam (@adityaanikam) in #3209
- fix(prune): preserve case-equivalent GitHub dependencies (supersedes #3158) by Daniel Meppiel (@danielmeppiel) in #3241
- fix(pack): certify manifestless marketplace skills by Yannick Foelsing (@yfoel) in #3064
- feat: add GitHub Copilot marketplace output by Aryan Singh K. (@aryansk) in #2600
- fix(install): preserve skills on unmatched selection by Wu Shuwen (@dajiaohuang) in #3235
- fix(install): pre-flight SSH github.com marketplace plugins over SSH by Mohammed Alkindi (@MohammedAlkindi) in #3200
- fix(mcp): honor CLAUDE_CONFIG_DIR in Claude user-scope stale cleanup by bodapatisaikrishna in #3148
- fix(install): reconcile local skills under shared .agents roots by Travis Illig (@tillig) in #3190
- fix(marketplace): record the commit an annotated tag points to by Rodion Kazennov (@nefayran) in #3161
- docs: clarify apm_modules is derived by Aryan Singh K. (@aryansk) in #2601
- feat(tls): add corporate CA bundles for package HTTPS by Josh Bazar (@TameTheGame) in #2741
- fix: avoid duplicate Copilot global instructions by Wu Shuwen (@dajiaohuang) in #3113
- fix(audit): ignore hook sidecar object-key order by sama Pyb (@Pybsama) in #3155
- fix(ci): repair release-gate integration suite and runtime setup under frozen binary by Daniel Meppiel (@danielmeppiel) in #3251
- fix(runtime): surface pip bootstrap errors in llm runtime setup by Daniel Meppiel (@danielmeppiel) in #3253
- fix(runtime): keep APM truststore bootstrap out of ensurepip on llm re-setup by Daniel Meppiel (@danielmeppiel) in #3262
- chore: release v0.34.0 by Daniel Meppiel (@danielmeppiel) in #3250
- test: pin cwd for deep-coverage CLI fixtures by Daniel Meppiel (@danielmeppiel) in #3274

New Contributors
- mheeaxa made their first contribution in #2610
- richard-fowles-epam made their first contribution in #3133
- Hilary Asogwa (@Dansatch) made their first contribution in #3120
- Shaurya Saria (@icecold009) made their first contribution in #3016
- Alexei Vedernikov (@alvedder) made their first contribution in #3100
- Aditya Nikam (@adityaanikam) made their first contribution in #3209
- bodapatisaik

What's Changed

🔧 Other Changes
- fix(install): explain skipped symlinked agent sources (refs #2913) by Daniel Meppiel (@danielmeppiel) in #2932
- fix(compile): resolve context links when folding instructions into CL… by Pavel Vodrážka (@pavelvodrazka-etnetera) in #2918
- fix(hooks): render Codex hooks in native shape by Ugaitz Urien (@uurien) in #3060
- fix(cursor): comma-joined bare globs/description in .mdc frontmatter by Yannick Guyomar (@YGuyomar) in #3011
- fix(runtime): reject HTTP errors and bound Codex download retries by Daniel Meppiel (@danielmeppiel) in #3111
- fix(mcp): drop previous-transport keys on Claude server redeclaration by Eden (@edenfunf) in #3041
- fix(mcp): write env-sourced MCP headers into Codex's runtime fields by Eden (@edenfunf) in #3042
- fix(windows): resolve git.exe via shutil.which path= (PATHEXT) by Ray Winkelman (@rwinkelman) in #3092
- fix(compile): discover Claude dependency memory at arbitrary installed depth by VyrnSynx (@vyrnsynx) in #2952
- fix(opencode): preserve explicit MCP enabled values by Wu Shuwen (@dajiaohuang) in #3102
- fix(marketplace): resolve version tags from package remote by Chandan Kumar (@modelpath-dev) in #3044
- fix(auth): preserve GitHub MCP runtime references by Wu Shuwen (@dajiaohuang) in #3103
- fix(install): deploy skills through home directory aliases by Daniel Meppiel (@danielmeppiel) in #2876
- fix(compile): deduplicate global Claude instructions safely by Daniel Meppiel (@danielmeppiel) in #3119
- fix(cursor): preserve native MCP references and authored static values by Daniel Meppiel (@danielmeppiel) in #3116
- fix(audit): bound the deploy-tree hidden-Unicode walk to primitive directories by lkshrk (@lkshrk) in #2962
- docs(security): clarify insecure transport policy by Ching Wei Kang (@WilliamK112) in #2910
- docs(install): correct --global local .apm/ deployment claim by Travis Illig (@tillig) in #2769
- fix(copilot): keep Copilot modular instructions split at user-scope since supported - reverts #1619 by kilianpaquier in #2317
- feat(cli): add apm auth for git host credentials (#2788) by Sergio Sisternes (@sergio-sisternes-epam) in #3134
- fix(ci): restore green main CI across unit, integration and mutation lanes by Daniel Meppiel (@danielmeppiel) in #3142
- docs: clarify context availability after cloning by Daniel Meppiel (@danielmeppiel) in #3144
- chore: release v0.33.0 by Daniel Meppiel (@danielmeppiel) in #3152

New Contributors
- Pavel Vodrážka (@pavelvodrazka-etnetera) made their first contribution in #2918
- Ugaitz Urien (@uurien) made their first contribution in #3060
- Yannick Guyomar (@YGuyomar) made their first contribution in #3011
- Ray Winkelman (@rwinkelman) made their first contribution in #3092
- VyrnSynx (@vyrnsynx) made their first contribution in #2952
- Chandan Kumar (@modelpath-dev) made their first contribution in #3044
- kilianpaquier made their first contribution in #2317

What's Changed

🔧 Other Changes
- feat(autopilot): origin-aware skills with CODEOWNERS-safe review by Sergio Sisternes (@sergio-sisternes-epam) in #3003
- perf(cli): lazy-load heavyweight command modules by Sergio Sisternes (@sergio-sisternes-epam) in #3001
- fix(alias): reject path-traversing dependency aliases — fixes #2900 by Daniel (@Danvs60) in #2901
- fix(ci): repair advisory locks and platform regressions by Daniel Meppiel (@danielmeppiel) in #3021
- fix(update): preserve marketplace uninstall aliases by Marco Frömbgen (@mfroembgen) in #2949
- Bump setuptools to 83.0.0 to remediate Unicode MANIFEST exclusion bypass by Sergio Sisternes (@sergio-sisternes-epam) with @Copilot in #2893
- feat(autopilot): maintainer canvas, panel-mode, and comment writer by Sergio Sisternes (@sergio-sisternes-epam) in #3024
- fix(install): shorten staging path segments to clear Windows MAX_PATH by Mohammed Alkindi (@MohammedAlkindi) in #2941
- fix(installer): correct prebuilt Linux glibc minimum to 2.38 by Daniel Meppiel (@danielmeppiel) in #2931
- fix(update): preserve deployment targets during partial updates by Wanming08 in #2924
- fix(hooks): map prompt-submit to Copilot's userPromptSubmitted by Sheila Shahpari (@sheilagithub) in #3030
- fix(marketplace): authenticate default-host checks by Yannick Foelsing (@yfoel) in #2917
- fix(deps): reject incompatible immutable requirements by Daniel Meppiel (@danielmeppiel) in #3061
- fix(prune): detect orphan skills and preserve retained bundles by fangkang (@fangkangmi) in #3057
- chore: release v0.32.0 by Daniel Meppiel (@danielmeppiel) in #3080
- fix(tests): repair v0.32.0 release validation contracts by Daniel Meppiel (@danielmeppiel) in #3081

New Contributors
- Daniel (@Danvs60) made their first contribution in #2901
- Wanming08 made their first contribution in #2924
- Sheila Shahpari (@sheilagithub) made their first contribution in #3030
- Yannick Foelsing (@yfoel) made their first contribution in #2917

What's Changed

🔧 Other Changes
- fix(outdated): report published registry versions beyond pins by Daniel Meppiel (@danielmeppiel) in #2874
- harden(gh-aw): require target (breaking), add token-source, fix GitHub policy casing by Daniel Meppiel (@danielmeppiel) in #2706
- fix(ci): recover native Windows workflow contract tests by Daniel Meppiel (@danielmeppiel) in #2880
- fix(codeql): remediate eleven sensitive-data alerts by Daniel Meppiel (@danielmeppiel) with @Copilot in #2742
- Fix skills subset installs for manifestless Git collections by Daniel Meppiel (@danielmeppiel) with @Copilot in #2891
- test: restore complete architecture guard mutation coverage by Daniel Meppiel (@danielmeppiel) with @Copilot in #2892
- fix(registry): exact version selectors must match published build metadata by Nadav Yogev (@nadav-y) in #2894
- fix(install): fail loudly when a package deploys to no target (closes #2796) by Daniel Meppiel (@danielmeppiel) in #2806
- docs: Add WinGet method installation by Gijs Reijn (@Gijsreyn) in #2520
- fix(deps): preserve GitLab sparse-fetch transport by Daniel Meppiel (@danielmeppiel) in #2939
- feat(init): onboard existing local packages without rewriting source by Daniel Meppiel (@danielmeppiel) in #2937
- docs: establish issue-first contribution and governance policy by Daniel Meppiel (@danielmeppiel) in #2954
- fix(triage): make automated recommendations advisory by Daniel Meppiel (@danielmeppiel) in #2956
- docs: define issue-backed roadmap and release planning by Daniel Meppiel (@danielmeppiel) in #2959
- fix(governance): require human scope and add neutral eligibility evidence by Daniel Meppiel (@danielmeppiel) in #2964
- fix(git-env): skip the HTTP header probe for non-HTTP effective URLs by Arnaud (@arnaudoisel) in #2906
- docs: publish the active issue-backed roadmap by Daniel Meppiel (@danielmeppiel) in #2988
- fix(uninstall): preserve unmanaged skills with an empty inventory by Marco Frömbgen (@mfroembgen) in #2947
- fix(ci): repair stale daily release smoke fixtures by Daniel Meppiel (@danielmeppiel) in #2987
- fix(cache): pin core.autocrlf=false on GitCache checkouts by Sergio Sisternes (@sergio-sisternes-epam) in #2982
- chore: release v0.31.0 by Daniel Meppiel (@danielmeppiel) in #2989

New Contributors
- Gijs Reijn (@Gijsreyn) made their first contribution in #2520
- Arnaud (@arnaudoisel) made their first contribution in #2906
- Marco Frömbgen (@mfroembgen) made their first contribution in #2947

What's Changed

🔧 Other Changes
- docs: reconcile published v0.29.1 changelog by Daniel Meppiel (@danielmeppiel) in #2847
- perf: reuse resolved context optimizer base path by Aryan Singh K. (@aryansk) in #2587
- perf: reuse dependency names across policy checks by Aryan Singh K. (@aryansk) in #2588
- test(lifecycle): guard shared diamond instruction survival (#2852) by Daniel Meppiel (@danielmeppiel) in #2858
- fix(cache): report incomplete cache cleaning (closes #2853) by Daniel Meppiel (@danielmeppiel) in #2864
- fix(cache): refresh HTTP cache recency on successful hits by Daniel Meppiel (@danielmeppiel) in #2859
- feat(onboarding): make Homebrew core the primary macOS install path by Daniel Meppiel (@danielmeppiel) in #2846
- fix(uninstall): retain ownership when package deletion fails by Daniel Meppiel (@danielmeppiel) in #2860
- fix(cache): retain recently reused Git checkouts during pruning by Daniel Meppiel (@danielmeppiel) in #2861
- fix(cache): reject negative prune ages (closes #2856) by Daniel Meppiel (@danielmeppiel) in #2862
- fix(prune): return failure when orphan deletion fails by Daniel Meppiel (@danielmeppiel) in #2863
- fix(installer): keep Unix installation unprivileged and owner-aware by Daniel Meppiel (@danielmeppiel) in #2844
- fix(cache): report incomplete prune outcomes by Daniel Meppiel (@danielmeppiel) in #2865
- fix(installer): verify Unix archive checksums before extraction by Daniel Meppiel (@danielmeppiel) in #2842
- fix(bootstrap): recover public release lookup after rejected credentials by Daniel Meppiel (@danielmeppiel) in #2843
- fix(tests): restore Windows cache recency CI coverage by Daniel Meppiel (@danielmeppiel) in #2869
- fix(ci): run CodeQL on merge-queue commits by Daniel Meppiel (@danielmeppiel) in #2870
- chore: release v0.30.0 by Daniel Meppiel (@danielmeppiel) in #2868
- fix(hashing): use explicit SHA-2 policy digests and synthetic fixture IDs by Daniel Meppiel (@danielmeppiel) in #2872
- fix(tests): prove global uninstall recovery after partial removal by Daniel Meppiel (@danielmeppiel) in #2873

What's Changed

🔧 Other Changes
- fix: load_frontmatter decodes utf-8-sig so a BOM does not hide the fence by Tech Guy (@lukiod) in #2685
- fix: support catalog-only marketplace plugins by lkshrk (@lkshrk) in #2709
- fix: report malformed executable trust config (closes #2715) by Daniel Meppiel (@danielmeppiel) in #2719
- fix: clean abandoned resolution staging (closes #2716) by Daniel Meppiel (@danielmeppiel) in #2720
- fix: keep plugin hooks live during reinstall (closes #2717) by Daniel Meppiel (@danielmeppiel) in #2723
- fix: authenticate private subdirectory cache (closes #2714) by Daniel Meppiel (@danielmeppiel) in #2722
- fix(deps): repair dangling symlinks in sparse-cone subdir installs by Mohammed Alkindi (@MohammedAlkindi) in #2710
- fix(compile): scope managed-section footer wording by Daniel Meppiel (@danielmeppiel) in #2731
- fix: allow manifestless hook packages in audit (closes #2725) by Daniel Meppiel (@danielmeppiel) in #2732
- fix: resolve the admin policy dir's ProgramData from the environment by Tech Guy (@lukiod) in #2686
- fix: isolate compile from nested Git repositories (#2560, #2713) by Aryan Singh K. (@aryansk) in #2578
- Refactor architecture guards into a sharded Python linter by Daniel Meppiel (@danielmeppiel) in #2739
- fix: make pack check-clean read-only (closes #2727) by Daniel Meppiel (@danielmeppiel) in #2730
- fix(pack): preserve remote metadata outcomes (supersedes #2661) by Daniel Meppiel (@danielmeppiel) in #2693
- fix(update): retain revision pins without release tags by Daniel Meppiel (@danielmeppiel) in #2667
- fix(install): preview positional packages in dry runs by Daniel Meppiel (@danielmeppiel) in #2664
- fix(lockfile): omit generated_at from new lockfiles by Lachlan Heywood (@lachieh) in #2616
- fix(install): accept manifestless repo-root claude_skill under --frozen by cffnpwr (@cffnpwr) in #2446
- fix(yaml_io): validate line-1 delimiter before parsing Markdown frontmatter (#2663) by Manideep Malyala (@manideep-malyala) in #2666
- fix(plugins): accept Copilot-dialect LSP field aliases on plugin intake by normandev92 in #2513
- fix: preserve OpenCode MCP passthrough fields by Aryan Singh K. (@aryansk) in #2593
- fix: avoid subpath false positives for .git repository URLs by Aryan Singh K. (@aryansk) in #2581
- fix: preserve credential helpers for generic marketplace git by Aryan Singh K. (@aryansk) in #2594
- fix: add commit archive fallback for frozen Artifactory installs by Aryan Singh K. (@aryansk) in #2582
- fix(marketplace): support fully qualified SSH URLs by Daniel Meppiel (@danielmeppiel) in #2760
- fix: preserve deployments when integration is skipped (closes #2744) by Daniel Meppiel (@danielmeppiel) in #2758
- fix(ci): repair main and release test regressions by Daniel Meppiel (@danielmeppiel) in #2762
- fix: preserve hand-authored root context files (closes #2767) by Daniel Meppiel (@danielmeppiel) in #2779
- fix: scope MCP uninstall cleanup to managed targets by Aryan Singh K. (@aryansk) in #2591
- fix: allow global direct MCP installs (closes #2548) by Daniel Meppiel (@danielmeppiel) in #2734
- fix(compile): honor targets: in ~/.apm/apm.yml for --global by Travis Illig (@tillig) in #2772
- fix: recompile triage panel lock (closes #2761) by Daniel Meppiel (@danielmeppiel) in #2777
- fix(utils): write project YAML with deterministic LF so apm.yml stops flip-flopping line endings on Windows (closes #2624) by McNultyyy in #2675
- fix: pin the copilot target so contributor installs are deterministic by Travis Illig (@tillig) in #2771
- fix: classify dot-prefixed marketplace paths as local by mikemikimike in #2766
- docs(changelog): collapse duplicate 0.29.0 blocks and restore released history by Daniel Meppiel (@danielmeppiel) in #2786
- fix: make Claude project LSPs discoverable (closes #2547) by Daniel Meppiel (@danielmeppiel) in #2733
- fix(mcp): resolve dependencies.mcp against the configured registry (closes #2740) by Eden (@edenfunf) in #2745
- fix: prefer APM manife

What's Changed

🔧 Other Changes
- fix(compile): reuse placement analysis across targets (closes #2482) by Daniel Meppiel (@danielmeppiel) in #2486
- Fix SSH passphrase hang: add BatchMode=yes to GIT_SSH_COMMAND by Sergio Sisternes (@sergio-sisternes-epam) in #2360
- feat(install): add --trust-bin / --no-trust-bin for plugin bin/ consent (supersedes #2045, closes #1620) by Daniel Meppiel (@danielmeppiel) in #2508
- fix(yaml): skip alias-expansion budget for anchor-free documents (supersedes #2493, closes #2389) by Daniel Meppiel (@danielmeppiel) in #2518
- Fix Windows Defender false positive via Authenticode signing (#2435) by Sergio Sisternes (@sergio-sisternes-epam) in #2497
- Fix deployed-files-present false positive on gitignored deploy paths (#2452) by Sergio Sisternes (@sergio-sisternes-epam) in #2496
- fix(cli): align help texts with target catalog (#2451) by Sergio Sisternes (@sergio-sisternes-epam) in #2499
- fix: report malformed marketplace structure (supersedes #2459) by Daniel Meppiel (@danielmeppiel) in #2474
- feat(agent-plugins): add a portable v1 foundation by Daniel Meppiel (@danielmeppiel) in #2654
- fix: make plugin.json dry-run match non-force pack behavior by Aryan Singh K. (@aryansk) in #2583
- docs: align monorepo release layout by Daniel Meppiel (@danielmeppiel) in #2670
- fix(uninstall): clean removed-only target files by Daniel Meppiel (@danielmeppiel) in #2658
- fix(compile): honour source_attribution on the AGENTS.md path by Mohammed Alkindi (@MohammedAlkindi) in #2646
- fix(auth): normalize git message locale so auth failures stay classifiable by Naofel El Alouani (@Naofel-eal) in #2534
- fix(mcp): route Copilot and VS Code configs separately by Daniel Meppiel (@danielmeppiel) in #2669
- fix(audit): allow local Claude-skill deps to omit apm.yml by Tech Guy (@lukiod) in #2643
- docs: add Windows lifecycle admin path by Ching Wei Kang (@WilliamK112) in #2640
- remove(roadmap): make milestones the single roadmap authority by Daniel Meppiel (@danielmeppiel) in #2672
- fix(hooks): resolve quoted plugin-root refs and warn on the ones that survive by Mohammed Alkindi (@MohammedAlkindi) in #2645
- fix(policy): use valid ADO project coordinate by Daniel Meppiel (@danielmeppiel) in #2450
- Allow plain-http MCP URLs for loopback hosts in the Codex adapter by normandev92 in #2468
- fix(deps): write synthetic package manifests with LF so content hashes match across OSes (closes #2619) by McNultyyy in #2620
- fix(bundle): write generated text with deterministic LF by Ching Wei Kang (@WilliamK112) in #2638
- fix(lock): validate ISO 8601 format for --timestamp flag (#2659) by Manideep Malyala (@manideep-malyala) in #2660
- fix: skip literal preflight for git semver ranges by Aryan Singh K. (@aryansk) in #2590
- fix(plugins): let the resolved declaration decide which skills deploy (closes #2537) by Eden (@edenfunf) in #2540
- fix(install): frozen install no longer fails on cold cache with git apm_package deps by Sergio Sisternes (@sergio-sisternes-epam) in #2502
- fix: allow percent-encoded sourceBase path segments by Aryan Singh K. (@aryansk) in #2584
- perf: scope compile walks to applyTo roots by Aryan Singh K. (@aryansk) in #2595
- fix: deploy OpenCode user-scope skills and instructions by Aryan Singh K. (@aryansk) in #2596
- fix(plugins): stop root-declared components copying the plugin into itself (closes #2556) by Yorai Levi (@YoraiLevi) in #2557
- fix: scope install security scan to deployable content by Aryan Singh K. (@aryansk) in #2598
- fix(audit): preserve user hooks during drift checks by Daniel Meppiel (@danielmeppiel) in #2682
- fix: harden GitLab policy discovery (supersedes #2605, closes #2566) by Daniel Meppiel (@danielmeppiel) in #2662
- Pin GitHub Actions to full-length commit SHAs by Dan Fiedler (@danfiedler-msft) in #2632
- fix(agent-plugins): preserve cross-platform asset inventory by Daniel Meppiel (@danielmeppiel) in #2694
- chore: release v0.29.0 by Daniel Meppiel (@danielmeppiel) in #26

What's Changed

🔧 Other Changes
- feat(kiro): deploy agents primitive to .kiro/agents/ (#2089) by Daniel Meppiel (@danielmeppiel) in #2440
- fix(marketplace): accept plugin collection versions by Daniel Meppiel (@danielmeppiel) in #2454
- fix(compilation): preserve applyTo lists for hidden tool placement by Daniel Meppiel (@danielmeppiel) in #2441
- fix(marketplace): allow nested HTTPS source paths by Daniel Meppiel (@danielmeppiel) in #2439
- fix(hooks): anchor Claude project commands to project root by Daniel Meppiel (@danielmeppiel) in #2442
- fix: audit contained local plugin sources (supersedes #2444, closes #2428) by Daniel Meppiel (@danielmeppiel) in #2460
- fix(pack): route empty dependencies bundle (supersedes #2447, closes #2431) by Daniel Meppiel (@danielmeppiel) in #2458
- fix(marketplace): effective output path (supersedes #2448, closes #2427) by Daniel Meppiel (@danielmeppiel) in #2461
- fix(mcp): resolve runtime variables consistently by Daniel Meppiel (@danielmeppiel) in #2455
- Add experimental Grok Cloud target support by Sergio Sisternes (@sergio-sisternes-epam) with @Copilot in #2420
- refactor(performance): eliminate repeated I/O and lockfile scans by Daniel Meppiel (@danielmeppiel) in #2472
- feat(registry): align object-form registry deps with git skills: by Nadav Yogev (@nadav-y) in #2166
- fix(init): reject empty/whitespace project names by Nadav Yogev (@nadav-y) in #2200
- fix(compile): preserve nested worktree files (supersedes #2453) by Daniel Meppiel (@danielmeppiel) in #2473
- chore: release v0.28.0 by Daniel Meppiel (@danielmeppiel) in #2477
- fix(tests): make local marketplace canonical assertions platform-native by Daniel Meppiel (@danielmeppiel) in #2480
- fix(install): re-download aliased deps after a manifest ref bump by Daniel Meppiel (@danielmeppiel) in #2484
- fix(outdated): degrade gracefully when Rich progress rendering fails by Daniel Meppiel (@danielmeppiel) in #2507

What's Changed

🔧 Other Changes
- fix(dashboard): enforce POST body size limits by @fallintoplace in #2029
- fix(install): exclude self-entry from dry-run orphan preview by @mia106dev in #2069
- fix(deps): preserve inherited git config when injecting auth headers by @edenfunf in #2382
- Defer disk deletion in apm lock to avoid removing dropped deployed files by @atulya-singh in #2312
- [BUG] fix(audit): self-hydrate cold-cache ci audit from lock pins by @hugoguitton-lucca in #2329
- fix(dashboard): harden static path traversal checks by @fallintoplace in #2027
- fix(auth): try public GitHub anonymously before resolving credentials by @danielmeppiel in #2406
- fix(integration): make MCP targets deterministic (supersedes #2302, closes #2298) by @danielmeppiel in #2307
- fix(self-update): pin installer ref to latest version by @fallintoplace in #2026
- fix: skip package.json sidecar for Copilot/VSCode hook deployment (#2322) by @sergio-sisternes-epam in #2363
- fix(audit): report deployed files that no lockfile entry claims by @salpers in #2380
- fix(mcp): create the lockfile for MCP-only projects by @edenfunf in #2390
- fix(install): preserve MCP target mappings (supersedes #2301, closes #2297) by @danielmeppiel in #2306
- fix(audit): scan the deploy trees for hidden Unicode, not just recorded files by @salpers in #2381
- Fix dep devDependencies.mcp leaking into consumer MCP config (#2340) by @sergio-sisternes-epam in #2361
- fix(deps): exclude stale bare-repo cache from resolver stack during apm update by @sergio-sisternes-epam in #2364
- fix(mcp): render a docker launcher for v0.1 oci container packages by @edenfunf in #2385
- fix(vscode): build container run args from v0.1 registry arguments by @edenfunf in #2387
- fix(hooks): enforce restriction-only package targets by @sergio-sisternes-epam in #2362
- fix(uninstall): accept portable local dependency keys by @danielmeppiel in #2412
- fix(hooks): normalize Copilot lifecycle event aliases by @danielmeppiel in #2405
- fix(auth): on-prem ADO Server hosts misclassified as GHES when GITHUB_HOST is set by @sergio-sisternes-epam in #2365
- fix: write IntelliJ MCP config to plugin-read path by @danielmeppiel in #2410
- fix(install): honor saved targets across MCP and LSP by @danielmeppiel in #2414
- fix(marketplace): honour producer tag_pattern in consumer semver range resolution by @sergio-sisternes-epam in #2366
- fix(deps): preserve mixed-case materialization paths by @danielmeppiel in #2409
- fix(mcp): preserve non-container registry arguments by @danielmeppiel in #2407
- chore: release v0.27.0 by @danielmeppiel in #2416
- fix(release): repair v0.27 integration contracts by @danielmeppiel in #2417
- fix(release): preserve Git isolation across auth fallback by @danielmeppiel in #2422
- fix(release): bound macOS Intel integration coverage by @danielmeppiel in #2423
- fix(release): decouple live ADO acceptance by @danielmeppiel in #2426

New Contributors
- @salpers made their first contribution in #2380

What's Changed

🔧 Other Changes
- feat(tls): verify against the OS trust store by default (closes #2004) by @fangkangmi in #2005
- fix(update): re-check transitive dependencies' own semver ranges during apm update by @nadav-y in #2053
- feat(shepherd): enforce canonical owner gate by @danielmeppiel in #2180
- fix(deps): git-semver update idempotency in build_update_plan by @srobroek in #2165
- fix(audit): preserve dependency link paths during replay by @danielmeppiel in #2179
- docs: add deny and doctor CLI references by @danielmeppiel in #2178
- fix(installer): expose stable Windows executable by @danielmeppiel in #2094
- fix(audit): honor locked skill subsets during replay by @danielmeppiel in #2177
- fix(docs): correct relative link depths across docs site by @JasonTame in #2170
- fix(pack): pack subdirectory-prefixed skills by @danielmeppiel in #2176
- fix(policy): preserve strict policy across warm cache reads by @danielmeppiel in #2193
- test(foundation): add hermetic lifecycle integration utilities by @danielmeppiel in #2209
- harden(contracts): add platform and rendered documentation evidence by @danielmeppiel in #2199
- test: add finite taxonomy and quality ratchets by @danielmeppiel in #2198
- test(consume): add real lifecycle contracts by @danielmeppiel in #2212
- test(produce): prove real pack-to-install artifact parity by @danielmeppiel in #2215
- test(consume): expand source/ref/cache matrix by @danielmeppiel in #2219
- test(produce): expand genuine materialization matrix by @danielmeppiel in #2218
- fix(deps): canonicalize virtual package manifest bytes by @danielmeppiel in #2223
- test(govern): prove strict policy lifecycle parity by @danielmeppiel in #2221
- fix(lockfile): converge claude_skill virtual dep name/version across resolution paths (closes #2206) by @danielmeppiel in #2217
- test(quality): synchronize the finite critical-suite count by @danielmeppiel in #2230
- fix(deps): preserve custom port in HTTP git URL persisted to apm.yml by @atulya-singh in #2210
- fix(audit): exempt is_virtual packages from config-consistency manifest check by @hugoguitton-lucca in #2214
- fix(marketplace): close packed source contracts by @danielmeppiel in #2228
- fix(pack): emit category in Claude marketplace output by @mbeacom in #2189
- fix(cache): preserve nested GitLab repository identity by @lidorcg in #2192
- fix(cli): warn when Codex agent tool scope is dropped by @jstar0 in #2186
- fix(deps): accept custom port in shorthand so apm.yml entries re-parse by @atulya-singh in #2211
- harden(shepherd): require exact-head functional owner evidence by @danielmeppiel in #2234
- fix(policy): honor Govern cache TTL with bounded property coverage by @danielmeppiel in #2235
- fix(deps): honor SSH for semver ref resolution by @danielmeppiel in #2229
- fix(ado): preserve lock coordinates for outdated and update by @danielmeppiel in #2226
- fix(deps): bound best-effort ref lookup retries by @danielmeppiel in #2238
- fix(virtual-packages): restore hermetic lifecycle convergence by @danielmeppiel in #2240
- test(architecture): add bounded mutation pilot by @danielmeppiel in #2241
- test(deps): add field-complete lockfile round-trip and reconstruction properties by @danielmeppiel in #2246
- fix: Windows CI CRLF baseline and WebSocket shutdown thread-join (closes #2233) by @danielmeppiel in #2237
- fix(prune): reconcile merged hook ownership after package removal by @danielmeppiel in #2249
- fix(hooks): scope merged-hook wipe to resolved targets, not all KNOWN_TARGETS by @danielmeppiel in #2252
- harden(ci): require hermetic lifecycle smoke subset on pull-request CI by @danielmeppiel in #2247
- feat(mutation): add lockfile-normalization owner to bounded mutmut pilot by @danielmeppiel in #2251
- fix(ci): restore Windows unit reliability by @danielmeppiel in #2262
- fix(deps): add SSH key-auth clone failure guidance by @danielmeppiel in #2244
- test(hooks): promote target-scope uninstall smoke by @danielmeppiel in #2257
- fix(release)

What's Changed

🔧 Other Changes
- Fix --target intellij validation (#1957) by @sergio-sisternes-epam in #2041
- fix(install): drop inactive-target ghost entries from lockfile deployed_files (#2059) by @edenfunf in #2114
- ci(release): remove obsolete Homebrew dispatch credential by @danielmeppiel in #2088
- fix(marketplace): preserve ADO URL and bearer auth by @danielmeppiel in #2121
- refactor(core): consolidate red-team lifecycle fixes behind canonical owners by @danielmeppiel in #2155
- fix(pack): select plugin sources by .apm presence by @danielmeppiel in #2122
- fix(deps): preserve nested package manifests during prune by @danielmeppiel in #2092
- Add .github-private as preferred policy repo candidate by @sergio-sisternes-epam in #2058
- perf: fix algorithmic regressions and expand performance-expert agent by @sergio-sisternes-epam in #2124
- feat(dashboard): add Triage tab, Comments thread, bulk PR actions, and session navigation by @sergio-sisternes-epam in #2043
- chore: release v0.25.0 by @danielmeppiel in #2164
- fix(deps): render logical local dep keys in deps list/tree; refresh stale v0.25.0 release tests by @danielmeppiel in #2173
- fix(deps): preserve local identity display boundaries by @danielmeppiel in #2174

What's Changed

🔧 Other Changes
- fix(install): actionable hint when self-hosted GitLab host swallows subpath by @rrazvd in #2074
- fix(update): reconcile MCP/LSP servers after apm update by @cffnpwr in #2085
- fix(deps): match local transitive dependencies by install path by @danielmeppiel in #2099
- fix: retain dev dependencies (supersedes #2042, closes #2033) by @danielmeppiel in #2102
- fix(claude): honor CLAUDE_CONFIG_DIR for user MCP config by @danielmeppiel in #2096
- fix(deps): stop virtual dependency tree recursion by @danielmeppiel in #2093
- fix(deps): normalize case-insensitive package identity by @danielmeppiel in #2098
- fix(marketplace): preserve registered SSH transport by @danielmeppiel in #2091
- fix(audit): exempt transitive MCP servers from config-consistency orphan check by @edenfunf in #2084
- fix(codex): preserve literal Windows TOML path keys by @danielmeppiel in #2100
- fix(install): preserve LSP state before lockfile compare by @paul-ww in #2079
- docs(spec): fold spec-guardian recommendations on req-tg-005 (antigravity) by @danielmeppiel in #2087
- fix(skills): key ownership tracking on owner/repo, not the leaf directory name by @nadav-y in #2052
- fix(gh-aw): set min-integrity to unapproved for panel review by @sergio-sisternes-epam in #2040
- chore: release v0.24.1 by @danielmeppiel in #2113
- test(install): align shared-file ownership expectation by @danielmeppiel in #2120

New Contributors
- @rrazvd made their first contribution in #2074
- @cffnpwr made their first contribution in #2085
- @paul-ww made their first contribution in #2079

What's Changed

🔧 Other Changes
- fix(hooks): rename Copilot hook events to camelCase during merge (closes #1977) by @danielmeppiel in #1979
- fix(audit): stable _apm_source marker in audit replay (closes #1978) by @danielmeppiel in #1980
- fix(mcp): resolve self-defined stdio env ${VAR} placeholders at install time (closes #1963) by @danielmeppiel in #1966
- perf(compile): fast-path universal applyTo matching by @WilliamK112 in #1993
- Fix targets:/skills:/alias: ignored on path: dependency entries by @sergio-sisternes-epam in #1987
- fix: Sanitise marketplace name to kebab-case in output mappers by @sergio-sisternes-epam in #2008
- fix(yaml): preserve apm.yml comments on manifest update (closes #2000) by @danielmeppiel in #2012
- docs: clarify lockfile transitive-graph determinism (refs #2007) by @danielmeppiel in #2010
- fix(utils): keep .git suffix on anonymous HTTPS clone URLs (closes #1995) by @mia106dev in #1997
- fix(install): frozen check matches host-qualified private git deps (closes #1996) by @danielmeppiel in #2011
- fix(pack): pack emits only lockfile-attested dependency content in every format (closes #1999) by @danielmeppiel in #2013
- fix(config): add config list alias by @WilliamK112 in #1991
- fix(mcp): clarify install help forwarded options by @WilliamK112 in #2018
- fix(audit): clarify help summary by @WilliamK112 in #2017
- perf(cache): apply promisor config on the clone, collapsing 3 config spawns to 1 by @srobroek in #1974
- perf(resolve): share one RefResolver per repo so ls-remote runs once per repo by @srobroek in #1975
- perf(resolve): honour locked commits without re-resolving refs over the network by @srobroek in #1973
- Harden plugin bin/ deploy to user-only 0o700 permissions by @danielmeppiel in #2024
- fix(plugin-bin): harden deploy permissions and deny matching by @WilliamK112 in #1971
- Verify runtime archive checksums before extraction by @fallintoplace in #1949
- Harden Artifactory zip extraction by @fallintoplace in #1948
- feat(antigravity): support trigger: glob frontmatter and compile-time dedup by @okamiconcept in #1984
- fix(hooks): route combined hook manifests to every named target (closes #2020) by @garyj in #2021
- fix(hooks): deploy self-contained hook scripts with siblings and package module type (closes #2023) by @danielmeppiel in #2025
- Fix duplicate H1 in generated CLAUDE.md by @WilliamK112 in #2016
- chore: release v0.24.0 by @danielmeppiel in #2032
- fix(install): treat throttled GitHub probe as indeterminate, not inaccessible by @danielmeppiel in #2037
- test(install): make github probe unit tests hermetic (mock requests.get) by @danielmeppiel in #2038

New Contributors
- @mia106dev made their first contribution in #1997
- @srobroek made their first contribution in #1974
- @fallintoplace made their first contribution in #1949
- @okamiconcept made their first contribution in #1984
- @garyj made their first contribution in #2021

What's Changed

🔧 Other Changes
- docs(enterprise): consolidate governance into a 5-phase ramp + surface lifecycle scripts by @danielmeppiel in #1951
- Fix: make --skill deployment additive, not just persistence (#1786 follow-up) by @danielmeppiel in #1955
- fix(audit): make per-deployed-file content hash line-ending invariant (#1952) by @danielmeppiel in #1959
- chore: release v0.23.1 by @danielmeppiel in #1960

What's Changed

🔧 Other Changes
- fix(update): treat cached transitive registry deps as unchanged in update plan by @nadav-y in #1921
- fix: honor per-dep targets and plural targets: in audit drift replay by @sergio-sisternes-epam in #1930
- fix(install): prune lockfile when all dependencies are removed from manifest by @nadav-y in #1926
- fix(update): report changed-dependency count, not re-materialized tree size by @nadav-y in #1927
- fix(cli): skip update check for unknown subcommands to fail fast by @maro114510 in #1541
- fix(outdated): use virtual-path basename for monorepo tag pattern matching by @kevinbeier-enbw in #1893
- fix(preview): unpack all three values returned by _auto_compile_prompts by @fmferrari in #1721
- fix(security): clear 4 Dependabot alerts (#62 llm, #68/#69 vite, #65 esbuild) by @danielmeppiel in #1936
- feat: add general-purpose lifecycle hooks framework (#1529) by @sergio-sisternes-epam in #1798
- chore(compile): remove legacy .chatmode.md primitive type by @sergio-sisternes-epam in #1931
- fix(cli): address CLI consistency report findings (#1928) by @sergio-sisternes-epam in #1929
- fix: respect package targets during user-scope (global) MCP install by @sergio-sisternes-epam in #1941
- fix(cli): point version-check hint to apm self-update by @syf2211 in #1943
- docs: reground the whole docs corpus against v0.22.0 source by @danielmeppiel in #1946
- docs(outdated): clarify monorepo tag pattern matching for virtual subdirectory deps by @kevinbeier-enbw in #1895
- feat(view): route 'view versions' to the registry when a default is configured by @nadav-y in #1938
- fix(docs): enable GFM table rendering in Starlight docs by @syf2211 in #1944
- fix(lifecycle): make script executor + lifecycle tests pass on Windows by @danielmeppiel in #1947
- chore: release v0.23.0 by @danielmeppiel in #1950

New Contributors
- @maro114510 made their first contribution in #1541
- @fmferrari made their first contribution in #1721
- @syf2211 made their first contribution in #1943

What's Changed

🔧 Other Changes
- Fix marketplace install ignoring GitLab host for url-type sources (#1848) by @sergio-sisternes-epam in #1853
- fix: honor CODEX_HOME for user-scope codex config (closes #1861) by @danielmeppiel in #1863
- Fix apm pack omitting version for INTERNAL/private github.com repos by @sergio-sisternes-epam in #1854
- Fix no-orphaned-packages false positive for local-path sub-package deps by @sergio-sisternes-epam in #1855
- Fix cross-package file protection in stale cleanup (#1831) by @sergio-sisternes-epam in #1856
- Add cascading policy repo discovery with ADO support by @sergio-sisternes-epam in #1830
- Remove daily test improver workflow by @danielmeppiel in #1870
- docs(changelog): reconcile [Unreleased] with PRs merged since v0.21.0 by @danielmeppiel in #1871
- feat(targets): converge windsurf skills onto .agents/skills/ by @danielmeppiel in #1802
- Expose apm-version as an import input on shared/apm.md by @danielmeppiel with @Copilot in #1842
- harden(executables): expand allowExecutables gate to mcp and canvas; store approvals user-local by @sergio-sisternes-epam in #1865
- Add configurable default install target (apm config target) with install-time fallback precedence by @danielmeppiel with @Copilot in #1881
- test(ci): empirical proof that the apm-version import-default pins non-opting consumers by @danielmeppiel in #1891
- ci(runtime): make live-inference smoke honestly non-blocking by @danielmeppiel in #1900
- feat(governance): Executable Trust Governance v1 - deny-wins resolver, vocab unification, audit fix by @danielmeppiel in #1875
- chore(gh-aw): upgrade compiler v0.76.1 -> v0.80.9 and recompile all locks by @danielmeppiel in #1903
- fix(install): make Windows pip fallback resilient to stderr under ErrorActionPreference=Stop (closes #1874) by @danielmeppiel in #1876
- feat(compile): explicit apm compile -g + install-time hint for global root context by @danielmeppiel in #1632
- ci: bump apm-action pin to v1.10.0 + pack-format drift trap by @danielmeppiel in #1907
- fix(install): persist --target into auto-bootstrapped apm.yml (#1743) by @danielmeppiel in #1901
- test(ci): repair merge-queue Integration Tests regressions by @danielmeppiel in #1909
- fix(self-update): improve update UX on macOS by @nadav-y in #1872
- fix(registry): registry deps as first-class citizens in display/UX surfaces by @nadav-y in #1908
- fix(tests): make Windows CI-failing tests platform-portable by @danielmeppiel in #1910
- fix(hooks): per-target hook manifest selection (closes #1892) by @danielmeppiel in #1902
- fix(install): write deployed files with LF on every platform by @danielmeppiel in #1913
- feat(lockfile): record installed package name + version per entry (#1888) by @danielmeppiel in #1904
- perf: ADO REST metadata fetcher to avoid clone-based fetch by @Aaryan-Dadu in #1852
- refactor(cowork): DRY internal hot-path cleanup (closes #922) by @danielmeppiel in #1914
- refactor(lockfile): sweep cross-target skill maps onto .agents/skills/ (closes #1805) by @danielmeppiel in #1912
- feat(config): persist non-secret installer prefs for self-update (closes #667) by @danielmeppiel in #1915
- fix(marketplace): propagate marketplace --ref to string sources; fix GitLab slash-ref proxy filenames by @chkp-roniz in #1880
- fix(install): adopt CRLF-source files against LF-deployed targets on Windows by @danielmeppiel in #1916
- docs(compile): document targets: to pin the committed generated set (#1342) by @danielmeppiel in #1583
- chore: release v0.22.0 by @danielmeppiel in #1920
- fix(tests): stub package name/version in MCP lockfile integration mocks by @danielmeppiel in #1922

What's Changed

🔧 Other Changes
- Add OpenClaw integration documentation page by @sergio-sisternes-epam in #1769
- Delete skill folders for removed packages by @sergio-sisternes-epam in #1767
- Remove apm marketplace publish and marketplace doctor alias (#1134) by @sergio-sisternes-epam in #1766
- Add allowExecutables approval gate for dependency executables by @sergio-sisternes-epam in #1723
- feat(install): experimental Copilot canvas extensions by @sergio-sisternes-epam in #1689
- Fix managed_section ignored in distributed and single-agents compile paths by @sergio-sisternes-epam in #1768
- fix: restore devDependencies.mcp on apm install (closes #1780) by @danielmeppiel in #1787
- Add integration tests for executables approval gate by @sergio-sisternes-epam in #1785
- test: raise integration coverage to 75% by @sergio-sisternes-epam in #1788
- fix(policy): carry all ApmPolicy fields through inheritance merge by @danielmeppiel in #1791
- test(integration): fix merge-queue failures from removed publish/doctor modules by @danielmeppiel in #1797
- docs(policy): clarify what apm-policy.yml governs by @danielmeppiel in #1792
- docs(governance): surface install-vs-runtime plane boundary on travelled paths by @danielmeppiel in #1796
- feat(policy): declarable integrity keys (require_hashes, fail_on_drift) by @danielmeppiel in #1794
- fix(ci): spec-conformance Mode B gate fails closed on unresolvable merge-base by @danielmeppiel in #1801
- fix(marketplace): resolve marketplace check against each entry's host + token by @leocamello in #1763
- feat: add Google Antigravity CLI (agy) as first-class APM target by @sergio-sisternes-epam in #1770
- test(marketplace): pin ADO sourceBase authoring->consume e2e + docs (#1010) by @danielmeppiel in #1810
- feat(audit): surface unmanaged artifacts with reason, type, and deny-conflict by @danielmeppiel in #1793
- feat(export): SBOM export + declared-license recorder (U5 + U6) by @danielmeppiel in #1820
- test(integration): fix 3 semantic-merge test breakages in merge queue by @danielmeppiel in #1834
- fix(outdated): degrade per-dep check failures instead of crashing; stabilize e2e teardown by @danielmeppiel in #1836
- docs(cli): list kiro in update target help by @WilliamK112 in #1821
- fix: emit required "version": 1 in .cursor/hooks.json by @sergio-sisternes-epam in #1840
- Fix {name} placeholder ignored in apm pack marketplace version resolution (#1822) by @sergio-sisternes-epam in #1841
- docs: restore "What to commit" guidance (fix #1837) by @sergio-sisternes-epam in #1839
- Fix marketplace --ref not propagated to relative plugin sources (#1811) by @sergio-sisternes-epam in #1824
- feat(install): route CLI shorthands to default registry when configured by @nadav-y in #1816
- Add extra passthrough for harness-specific MCP keys (#1670) by @sergio-sisternes-epam in #1765
- fix: correct stale tar.gz and --tarball references after zip default by @nadav-y in #1779
- Fix --skill to merge additively with existing skills in apm.yml by @sergio-sisternes-epam in #1786
- feat: add APM Contributor Dashboard canvas package by @sergio-sisternes-epam in #1825
- chore: release v0.21.0 by @danielmeppiel in #1851

New Contributors
- @leocamello made their first contribution in #1763
- @WilliamK112 made their first contribution in #1821

What's Changed

🔧 Other Changes
- Add experimental Hermes agent target by @altaranenco in #1726
- fix(deps): allow same-repo remote path deps by @danielmeppiel in #1732
- feat(distribution): add enterprise bootstrap mirrors by @danielmeppiel in #1733
- feat(marketplace): add source parity for marketplace add by @danielmeppiel in #1739
- fix(deps): support multi-host dependency identity by @danielmeppiel in #1735
- feat(bootstrap): fold panel follow-ups for enterprise mirror mode (post-#1733) by @danielmeppiel in #1745
- fix(mcp): honor optional registry inputs by @danielmeppiel in #1734
- feat(marketplace): add sourceBase for package sources by @danielmeppiel in #1736
- feat(deps): update revision pins by @danielmeppiel in #1738
- feat(deps): fetch path-scoped files over git transport instead of host API by @danielmeppiel in #1740
- feat(targets): add Kiro IDE support by @danielmeppiel in #1741
- fix(tests): fix Windows path comparison in TestHermesConfigPath by @sergio-sisternes-epam in #1737
- test: fix Windows-only CI failures across 8 unit tests by @danielmeppiel in #1752
- fix(docs): restore reachability of alternative installation methods page (closes #1748) by @danielmeppiel in #1751
- fix(compile): suppress empty AGENTS.md shells for copilot when instructions already in .github/instructions/ by @tillig in #1742
- fix(install): keep copilot in multi-target --target lists by @Addono in #1749
- fix(compile): remove stale APM-generated CLAUDE.md on --clean when .claude/rules/ is populated by @tillig in #1747
- feat(pack): switch --archive to .zip and add --archive-format zip|tar.gz by @nadav-y in #1720
- fix(marketplace): inherit description/version from local-path apm.yml by @danielmeppiel in #1755
- chore: release v0.20.0 by @danielmeppiel in #1756
- test(integration): refresh stale integration tests after v0.20.0 changes by @danielmeppiel in #1757
- test(release): refresh release-validation harness for v0.20.0 behavior changes by @danielmeppiel in #1758

New Contributors
- @altaranenco made their first contribution in #1726
- @Addono made their first contribution in #1749

What's Changed

🔧 Other Changes
- refactor(auth): debug-log all exception handlers in credential cascade (closes #935) by @danielmeppiel in #1664
- fix(install): keep format-transformed rules tracked + in sync (closes #1662) by @srid in #1665
- fix(deps): scope shorthand-alias guard to exclude @ in #ref fragment (closes #1696) by @danielmeppiel in #1698
- fix(install): unwrap lspServers envelope in plugin .lsp.json (closes #1683) by @sergio-sisternes-epam in #1686
- fix(compile): target-aware instruction dedup for Codex AGENTS.md (closes #1678) by @sergio-sisternes-epam in #1685
- fix(mcp): preserve scoped server names when materializing harness configs (closes #1693) by @danielmeppiel in #1699
- feat: add openclaw as experimental skills target by @sergio-sisternes-epam in #1677
- fix: external scanner UX improvements by @sergio-sisternes-epam in #1692
- fix(deps): preserve transitive dependencies in marketplace and remote subdir installs (closes #1666) by @sergio-sisternes-epam in #1687
- fix(install): support FQDN monorepo subpath on GHES hosts (closes #1673) by @sergio-sisternes-epam in #1684
- fix(deps): add AAD bearer fallback and HTML sign-in detection in download_ado_file (closes #1671) by @danielmeppiel in #1675
- feat: warn on unknown keys dropped in MCPDependency.from_dict() by @danielmeppiel in #1674
- Add Nadav Yogev (JFrog) to maintainers by @danielmeppiel in #1704
- feat(publish): switch publish command archive format from tar.gz to zip by @nadav-y in #1695
- fix(install): honor --skill subset on non-package skill-collection install (closes #1707) by @danielmeppiel in #1709
- fix(install): skip lockfile rewrite when local instructions content is unchanged (closes #1702) by @danielmeppiel in #1710
- fix(install): validate APM_LIB_DIR before rm -rf to prevent data loss (closes #1690) by @dohwi in #1694
- fix(install): dereference in-package symlinks on local install (#1668) by @danielmeppiel in #1676
- feat: surface installed hook actions during apm install (closes #316) by @danielmeppiel in #1700
- Fix Windows CRLF handling in install safety tests by @danielmeppiel in #1717
- fix(tests): skip install.sh safety tests when POSIX bash is unavailable by @danielmeppiel in #1719
- fix(install): cover skill bundles with per-file content-integrity + target-scoped union manifest (closes #1716) by @danielmeppiel in #1718
- fix(apm-review-panel): guarantee non-empty turn exit via synchronous fan-out by @danielmeppiel in #1714
- chore: release v0.19.0 by @danielmeppiel in #1715

New Contributors
- @dohwi made their first contribution in #1694

What's Changed

🔧 Other Changes
- feat(marketplace): add audit command to flag deps that bypass marketplace pinning by @edenfunf in #881
- fix(deps): reject shorthand alias syntax (supersedes #1301) by @danielmeppiel in #1655
- feat(outdated): support monorepo tag nameing convention by @kevinbeier-enbw in #1504
- fix(compile): match applyTo globs without following symlinks into node_modules by @srid in #1576
- feat(deps): support marketplace dependencies in plugin.json by @stbenjam in #1422
- feat(lsp): add first-class LSP server support to install pipeline by @stbenjam in #1424
- fix(intellij): preserve env-var placeholders in mcp.json (closes #1656) by @danielmeppiel in #1659
- fix(deps): resolve semver ranges against per-package subpath tags (closes #1633) by @danielmeppiel in #1658
- fix(install): rewrite outbound relative links from skill bundles (closes #1625) by @danielmeppiel in #1657
- chore: release v0.18.0 by @danielmeppiel in #1661

New Contributors
- @kevinbeier-enbw made their first contribution in #1504

What's Changed

🔧 Other Changes
- fix(publish): clarify --package is required and update docs by @nadav-y in #1562
- refactor(pack)!: remove deprecated --marketplace-output flag (#1318) by @danielmeppiel in #1585
- feat(compile): make source-attribution comments opt-in to cut token overhead by @danielmeppiel in #1584
- Extract shepherd-driver engine, rewire skill packages, and harden local-dep drift replay by @danielmeppiel in #1578
- feat(autopilot): author PR bodies via pr-description-skill + post panel outcome per shepherd run by @danielmeppiel in #1598
- fix: dedup parity for Copilot AGENTS.md vs .github/instructions/ by @danielmeppiel in #1590
- feat: managed-section mode for AGENTS.md updates by @danielmeppiel in #1589
- fix: send auth header for GitHub release lookup in installer and self-update by @danielmeppiel in #1588
- fix: skip .gitignore update for global scope installs by @danielmeppiel in #1587
- feat: apm install -g deploys copilot instructions to ~/.copilot/copilot-instructions.md by @danielmeppiel in #1619
- feat: make apm self-update and version-checker respect air-gapped env vars (GITHUB_URL, APM_REPO, VERSION) by @danielmeppiel in #1615
- refactor(models): separate package-format detection into composition model by @danielmeppiel in #1618
- refactor: files_adopted follow-ups from PR #1313 review panel by @danielmeppiel in #1617
- refactor: extract skip_download and locked_ref helpers into _skip_logic.py (#552) by @danielmeppiel in #1614
- fix: polish managed-section error messages by @danielmeppiel in #1609
- fix(auth): expand port hint with git credential fill command and docs URL by @danielmeppiel in #1608
- chore: enable RUF002/RUF003 (ambiguous unicode) and fix 249 violations by @danielmeppiel in #1607
- test(integration): add wiring-invariants guard to close #1166 by @danielmeppiel in #1613
- test: add edge-case coverage for empty and identical managed-section markers by @danielmeppiel in #1602
- docs: add compilation.agents_md sub-object to manifest-schema reference by @danielmeppiel in #1601
- fix: correct broken epilog help reference in apm mcp install by @danielmeppiel in #1604
- docs: clarify install-time discovery rules for marketplace plugins (.apm// vs root convention dirs) by @danielmeppiel in #1603
- docs: remove flake8/black from hello-world python template by @danielmeppiel in #1600
- fix(pack): emit amend+force-with-lease recovery recipe on --check-clean drift by @danielmeppiel in #1610
- feat(compile): add --no-dedup / --force-instructions flag for claude target by @danielmeppiel in #1616
- feat(init): suggest agentrc in Next Steps when no instructions exist by @danielmeppiel in #1611
- perf: skip re-download when callback SHA matches remote in --update mode (#551) by @danielmeppiel in #1612
- feat: deploy bin/ executables for marketplace_plugin packages to ~/.claude/skills//bin/ by @danielmeppiel in #1591
- feat(audit): vendor-agnostic external SARIF scanner ingestion (experimental) by @sergio-sisternes-epam in #1579
- feat(pack): generate plugin.json for Claude and Copilot ecosystems by @sergio-sisternes-epam in #1623
- feat(install, compile): --root DIR to redirect writes while sources resolve from $PWD by @danielmeppiel in #1628
- harden(plugin-bin): restrict deployed bin/ executables to user-only execute (Item 3 from #1620) by @danielmeppiel in #1626
- feat(apm.yml): support homepage, repository, keywords, and structured author fields by @danielmeppiel in #1624
- fix: surface file-missing error before marker search in managed_section mode by @danielmeppiel in #1606
- feat: make apm update a superset of apm deps update by @Aaryan-Dadu in #1574
- test(integration): add hermetic e2e for Artifactory VCS proxy install (closes #1228) by @danielmeppiel in #1630
- chore: audit F401 noqa suppressions -- remove dead imports, document re-exports by @danielmeppiel in #1643
- feat(config): add apm config set/get/unset mcp-registry-url by @danielmeppiel in #1637
- feat: target-aware hook event 

What's Changed

🔧 Other Changes
- docs: corpus-wide factual regrounding + reference sidebar IA fix by @danielmeppiel in #1531
- feat(cli): promote 'marketplace doctor' to top-level 'apm doctor' (+ workflow discoverability) by @danielmeppiel in #1539
- perf(install): memoize discovery, drop per-file resolve, expand skip dirs (#1533) by @danielmeppiel in #1538
- fix(panels): unbreak panel workflows -- gh-aw v0.76+ harvests expression tokens from bash comments by @danielmeppiel in #1545
- fix(install): honor targets: (plural) without singular target: present (closes #1503) by @danielmeppiel in #1560
- fix: honor explicit global install refs (closes #1555) by @danielmeppiel in #1559
- perf(integrate): narrow project-scope local discovery to .apm/ to avoid full-tree walks (closes #1507) by @danielmeppiel in #1554
- fix(git-env): strip LD_LIBRARY_PATH from git subprocess env to prevent shared lib conflicts by @pngdeity in #1536
- docs: surface compilation.strategy=distributed default in concepts and compile reference (closes #1447) by @danielmeppiel in #1551
- fix(uninstall): scan devDependencies.apm so --dev installs can be removed (closes #1549) by @danielmeppiel in #1552
- fix(install): skip cache for unpinned virtual deps when on-disk hash matches lockfile (closes #1548) by @danielmeppiel in #1553
- fix: preserve executable permission bits on install (closes #1563) by @danielmeppiel in #1566
- fix: dedup deployed_files and scope --update to named packages (closes #1558) by @danielmeppiel in #1567
- fix: deterministic lockfile for unchanged MCP deps (closes #1532) by @danielmeppiel in #1568
- fix: install summary reflects actual changes on no-op runs (closes #1557) by @danielmeppiel in #1569
- fix: deploy prompts for user-scope copilot installs (closes #1482) by @danielmeppiel in #1570
- feat(skills): add cut-release skill by @danielmeppiel in #1527
- chore: release v0.16.1 by @danielmeppiel in #1572
- ci: fix macOS release integration-test 20min timeout by @danielmeppiel in #1575

New Contributors
- @pngdeity made their first contribution in #1536

What's Changed

🔧 Other Changes
- feat(policy): require_pinned_constraint to ban unbounded dep ranges by @danielmeppiel in #1494
- test(policy): e2e integration tests for require_pinned_constraint (follow-up to #1494) by @danielmeppiel in #1505
- feat(deps): add 'apm deps why ' to explain transitive dependencies by @danielmeppiel in #1495
- fix(policy): classify '=1.2.3' explicit-equality as pinned constraint by @danielmeppiel in #1506
- feat(deps): resolve semver ranges on git-source dependencies by @danielmeppiel in #1496
- chore: remove stale plan.md from repo root by @danielmeppiel in #1510
- fix(artifactory): deterministic boundary probe for nested GitLab paths by @chkp-roniz in #1472
- fix(install): repair -g hook integration across claude/cursor/copilot (closes #1499) by @danielmeppiel in #1516
- fix(install): honor SSH scheme for GitLab refs in validation (closes #1501) by @danielmeppiel in #1515
- fix(compile): honor compilation.strategy=single-file for CLAUDE.md (closes #1445) by @danielmeppiel in #1514
- fix(opencode): validate-and-warn on incompatible agent frontmatter at install (Phase 1 of #581) by @danielmeppiel in #1513
- fix(install): use %LOCALAPPDATA% literal in Windows shim (closes #1509) by @danielmeppiel in #1512
- docs: backfill apm-usage and consolidate registry guides (v0.14->v0.15 drift sweep) by @danielmeppiel in #1511
- Fix/windsurf uninstall skills cleanup by @yoelabril in #1486
- docs(skills): correct outdated windsurf-convergence status, link #1520 by @danielmeppiel in #1521
- feat(batch-bug-shepherd): recommendation-fold loop + Copilot+CI gates + mergeability table by @danielmeppiel in #1518
- fix(install): write apm.cmd shim as ASCII (cmd.exe cannot parse UTF-16LE) by @danielmeppiel in #1522
- fix(install): strip non-ASCII bytes from install.ps1 (unblocks self-update on cp1252 consoles) by @danielmeppiel in #1523
- spec: introduce OpenAPM v0.1 (closes #1502) by @danielmeppiel in #1517
- chore: release v0.16.0 by @danielmeppiel in #1526

What's Changed

🔧 Other Changes
- fix: handle MCP v0.1 runtimeArguments.variables in copilot and codex adapters by @sergio-sisternes-epam in #1461
- perf(scaling-guards): add variant-key and cache-lookup guards, wire to CI integration gate by @sergio-sisternes-epam in #1439
- fix(triage-panel): add DIFC read-integrity exemption for external issues by @sergio-sisternes-epam in #1462
- fix: resolve 3 flaky integration tests blocking merge queue by @sergio-sisternes-epam in #1477
- fix(install): honour spec drift in BFS resolve callback by @sergio-sisternes-epam in #1473
- fix(mcp): rewrite skill-shipped MCP command paths for the Claude target by @srid in #1465
- feat(marketplace): support local paths, file:// URIs, and generic git hosts by @sergio-sisternes-epam in #1476
- fix: add support for custom github endpoints (host.tld/owner/repo) as apm.yml entrypoint for command apm pack (marketplace) by @abi-jey in #1288
- feat(registry): [FEATURE] Add package registry support for dependency… by @nadav-y in #1471
- fix(marketplace): handle Windows file:// URI shapes in _local_path_from_source by @danielmeppiel in #1484
- fix(install): block bare cross-repo on enterprise marketplaces (#1326) by @edenfunf in #1459
- fix(compile): live-reload apm.yml and warn on --clean --watch by @edenfunf in #1403
- feat: persist transport flags via apm config by @Aaryan-Dadu in #1308
- fix(compile): deduplicate Claude Code instructions (#1138) by @tillig in #1146
- refactor(cli): clean up compilation config and registry cursor by @altf4-games in #1367
- fix(triage-panel): replace invalid difc: block with tools.github.min-integrity by @danielmeppiel in #1487
- test(codeql): fix 30 py/incomplete-url-substring-sanitization alerts by @danielmeppiel in #1492
- chore: cut 0.15.0 by @danielmeppiel in #1493

New Contributors
- @nadav-y made their first contribution in #1471
- @Aaryan-Dadu made their first contribution in #1308
- @altf4-games made their first contribution in #1367

What's Changed

🔧 Other Changes
- test(coverage): enforce 75% unit gate and push integration to 60% by @sergio-sisternes-epam in #1414
- add(coverage): Phase 3 -- unit 88% / integration 71% by @sergio-sisternes-epam in #1417
- add(coverage): raise unit and integration gates to 90% with phase-3 + phase-4 tests by @sergio-sisternes-epam in #1425
- test: replace logic-replay tests for #763 with real-flow coverage by @mvanhorn in #1340
- fix: preflight via ssh on ssh based connections (closes #1293) by @Alpha200 in #1303
- fix: support Streamable HTTP MCP servers for Codex CLI (closes #1260) by @masaishi in #1262
- fix: resolve env-var placeholders in Codex/Gemini self-defined stdio MCP (closes #1266) by @edenfunf in #1277
- fix(hooks): stabilize root .apm hook source-ids across renames/worktrees (supersedes #1330, closes #1329) by @danielmeppiel in #1392
- fix(tests): make Windows unit-test job green by @danielmeppiel in #1427
- fix(ado): resolve az binary via shutil.which for Windows az.cmd (closes #1430) by @danielmeppiel in #1432
- feat(copilot-app): hybrid WS-IPC + SQLite project scoping for workflows by @danielmeppiel in #1431
- ci: shard PR tests + move binary build off critical path by @danielmeppiel in #1437
- perf(#1433): sparse-cone consumer materialization for subdir deps by @danielmeppiel in #1436
- fix(copilot-app): warn-not-fail on newer App schema + feat: batch-bug-shepherd primitive by @danielmeppiel in #1434
- fix(compile): discover local-bundle instructions in apm_modules/ by @danielmeppiel in #1388
- fix(cache): handle ValueError from parsed.port on Windows file:// URLs by @danielmeppiel in #1446
- fix(integration): respect comma-separated applyTo globs in Claude/Cursor/Windsurf by @danielmeppiel in #1387
- fix(build): restore optimize=2 + enforce explicit Click help= to clear Defender ML false positive (#1407) by @danielmeppiel in #1450
- fix(hooks): keep project-scope hook commands repo-relative (closes #1394) by @srid in #1396
- fix(detect): expand copilot harness markers to file-based signals (#1435) by @sergio-sisternes-epam in #1440
- fix(audit): pre-create target dirs in drift replay scratch (#1411) by @sergio-sisternes-epam in #1441
- fix(install): persist --skill filter to apm.yml (#1395) by @sergio-sisternes-epam in #1442
- fix(vscode): handle v0.1 runtimeArguments with variables for Docker MCP (#1391) by @sergio-sisternes-epam in #1444
- fix(plugin): prevent _map_plugin_artifacts from destroying pre-positioned .apm/ content by @abi-jey in #1416
- fix(applyTo): fold #1387 panel follow-ups (docs + DRY + YAML escape) by @danielmeppiel in #1449
- feat(batch-bug-shepherd): operator visibility + fold-in invariant by @danielmeppiel in #1451
- fix(mcp): honour per-dep registry URL during install (#1393) by @sergio-sisternes-epam in #1443
- chore: release v0.14.2 by @danielmeppiel in #1454
- fix(ci): repair Windows-only unit test failures after v0.14.2 by @danielmeppiel in #1455
- fix(cache): apply core.longpaths to post-clone git ops on Windows by @danielmeppiel in #1456
- test(integration): unstick 23 stale tests that drift from production code by @danielmeppiel in #1457

New Contributors
- @Alpha200 made their first contribution in #1303
- @masaishi made their first contribution in #1262

What's Changed
🔧 Other Changes
- docs(producer): add zava-agent-config as live golden-path reference by @danielmeppiel in #1384
- fix(deps): honor SSH user from dependency URL (closes #1383) by @danielmeppiel in #1385
- docs(changelog): add #1383 SSH user fix entry by @danielmeppiel in #1386
- fix(install): survive AppLocker/WDAC by staging release before binary test (#1389) by @danielmeppiel in #1390
- fix(ci): wire coverage observability into CI pipelines (Phase 1) by @sergio-sisternes-epam in #1404
- fix(install): detect Windows Defender AV block and emit specific guidance by @danielmeppiel in #1408
- feat(experimental): copilot-app target deploys scheduled prompts to App DB by @danielmeppiel in #1405
- chore(release): v0.14.1 by @danielmeppiel in #1410
- fix(uninstall): accept Windows absolute paths as local packages (re-tag v0.14.1) by @danielmeppiel in #1413
Full Changelog: v0.14.0...v0.14.1

What's Changed
🔧 Other Changes
- docs: full rewrite -- persona-led ramps + 3-promise narrative by @danielmeppiel in #1252
- docs: fix all redirect destinations to include /apm base path by @danielmeppiel in #1284
- fix: marketplace install auth host on *.ghe.com (closes #1285) by @edenfunf in #1292
- fix(ci): use audit-only pattern to prevent install overwriting tamper (closes #1202) by @sergio-sisternes-epam in #1291
- fix(policy): layer dependencies.require through extends: org (closes #1201) by @sergio-sisternes-epam in #1290
- fix: warn when apm.yml is missing but APM artifacts exist (closes #1056) by @sergio-sisternes-epam in #1255
- fix(build): keep Click command docstrings in release binaries by @edenfunf in #1307
- fix(audit): drift check skip-with-info on cache miss (closes #1200) by @sergio-sisternes-epam in #1289
- feat(install): air-gapped / GHE env vars for install.ps1 by @abhinavgautam01 in #1246
- test(integration): regression trap for *.ghe.com marketplace auth routing (closes #1304) by @edenfunf in #1312
- feat(marketplace): support multi-profile marketplace outputs by @henrydennis in #1281
- fix: apm install no longer permanently blocked by policy after lockfile wipe (required-packages-deployed catch-22) by @danielmeppiel in #1313
- fix: preserve Claude stdio MCP env by @imk1t in #1224
- feat(marketplace): filter-driven CLI, map-based manifest, JSON output by @danielmeppiel in #1324
- fix(policy): inherit parent unmanaged_files when child omits block by @abhinavgautam01 in #1248
- refactor(integration): extract MCPIntegrator.install by @abhinavgautam01 in #1245
- fix: hint to host-qualify cross-repo on *.ghe.com (closes #1305) by @edenfunf in #1319
- fix(adapters): route Gemini config through project_root and user_scope by @edenfunf in #1306
- chore: add pylint R0801 duplicate code guardrail (Phase 0) by @sergio-sisternes-epam in #1320
- fix(registry): migrate SimpleRegistryClient to MCP Registry v0.1 spec (#1210) by @danielmeppiel in #1337
- fix: respect targets: whitelist for all runtimes during MCP install by @danielmeppiel in #1336
- feat(pack,doctor,init): vendor-neutral producer first-run UX by @danielmeppiel in #1362
- fix: stop writing _apm_source into Claude settings.json by @sergio-sisternes-epam in #1359
- fix: skip direct GitHub API validation when PROXY_REGISTRY_ONLY is set by @sergio-sisternes-epam in #1357
- fix: propagate target to intermediate CompilationConfig in single-file path by @sergio-sisternes-epam in #1355
- fix: resolve hook paths to absolute in settings.json for --target claude by @sergio-sisternes-epam in #1354
- refactor: eliminate duplicate code blocks (phases 1-3) by @sergio-sisternes-epam in #1360
- feat(pack): add --check-versions and --check-clean release gates by @danielmeppiel in #1365
- fix: add --target flag to apm update command by @sergio-sisternes-epam in #1358
- fix(compile): forward target to watch-mode recompile (closes #1345) by @danielmeppiel in #1349
- feat: support marketplace notation in apm uninstall by @sergio-sisternes-epam in #1325
- fix: prefer APM-managed runtimes over system PATH and warn on codex/GitHub Models incompatibility by @sergio-sisternes-epam in #1356
- feat(cli): introduce apm plugin init noun-verb surface by @danielmeppiel in #1370
- Fix shared/apm.md matrix secret-stripping; add empirical verify workflow by @danielmeppiel in #1373
- perf(resolver): tiered git ref resolver collapses redundant clones (#1369) by @danielmeppiel in #1376
- fix: allow tilde in repository path components for Bitbucket DC personal repos (#1375) by @danielmeppiel in #1377
- test(windows): make path assertions and chmod tests OS-aware by @danielmeppiel in #1378
- chore: cut 0.14.0 by @danielmeppiel in #1372
New Contributors
- @abhinavgautam01 made their first contribution in #1246
- @henrydennis made their first contribution in #1281
- @imk1t made their first contribution in #1224
Full Changelog: v0.13.0...v0.14.0

What's Changed
📖 Documentation
- [docs] Update documentation for features from 2026-05-08 by @danielmeppiel in #1205
- [docs] Update documentation for features from 2026-05-09 by @danielmeppiel in #1219
🔧 Other Changes
- chore(aw): bump microsoft/apm-action v1.7.1 -> v1.7.2 by @danielmeppiel in #1183
- feat(shared/apm.md): expose target input for slim per-harness bundles by @danielmeppiel in #1184
- fix(shared/apm.md): drop || 'all' fallback so gh-aw substitutes target (#1185) by @danielmeppiel in #1186
- fix(install,test): exclude cowork from --target all + stabilize defer-start timer test by @danielmeppiel in #1191
- ci(panels): pin target=copilot for pr-review-panel and triage-panel by @danielmeppiel in #1192
- fix(triage-panel): paginate scheduled sweep oldest-first via MCP by @danielmeppiel in #1193
- fix(triage-panel): use search_issues with -label:status/triaged for sweep by @danielmeppiel in #1194
- fix(install): accept YAML list form under singular target: key (#1188) by @danielmeppiel in #1197
- [cli-consistency] Fix CLI/docs inconsistencies from 2026-05-06 consistency report by @Copilot in #1174
- [Test Improver] tests(deps): add unit tests for deps CLI helper functions by @danielmeppiel in #1155
- support virtual packages on generic git hosts (Gitea) by @ganesanviji in #587
- fix(install): wire ADO --update preflight through PAT->bearer fallback (#1212) by @danielmeppiel in #1214
- fix(cli): add missing help text to outdated command by @danielmeppiel in #1216
- fix(errors): hide agent-skills meta-target from unknown-target suggestions (#1208) by @danielmeppiel in #1215
- fix: target-agnostic local-bundle install (#1207) by @danielmeppiel in #1217
- Add gh auth token fallback before git credential fill by @awakecoding in #630
- refactor(deps): introduce HostBackend Protocol + extract stamp_plugin_version by @danielmeppiel in #1223
- fix(auth): per-URL credential disambiguation + gh-cli short-circuit regression trap by @danielmeppiel in #1226
- fix: pass scope-resolved lockfile path to MCPIntegrator.update_lockfile at --global scope by @sergio-sisternes-epam in #1236
- fix: align direct install HTTPS validation with manifest-driven credential handling by @sergio-sisternes-epam in #1242
- fix: normalise default-scheme ports (443/80/22) on DependencyReference / HostInfo by @sergio-sisternes-epam in #1237
- fix: hide experimental cowork config key and fix verbose target log by @sergio-sisternes-epam in #1241
- Reject unsupported flat-format dependencies with actionable error by @sergio-sisternes-epam in #1189
- feat(install): add GitLab marketplace host support by @slava-kudzinau in #1149
- refactor(tests): marker-driven integration discovery (PR1 of #1166) by @danielmeppiel in #1167
- refactor(tests): retire script enumeration; pytest discovers tests/integration/ by @danielmeppiel in #1247
- docs(tests): codify integration-test marker procedure as APM instructions primitive by @danielmeppiel in #1249
- ci(smoke): replace runtime-binary smoke with README-promise smoke by @danielmeppiel in #1251
- Add 'apm update' command and '--frozen' install flag (closes #1203) by @danielmeppiel in #1244
- fix(install,tests): repair 63 integration tests in merge queue by @danielmeppiel in #1257
- fix(tests): repair 2 integration tests that surfaced post-#1257 by @danielmeppiel in #1261
- fix: add threading.Lock to _fallback_port_warned dedup set by @sergio-sisternes-epam in #1238
- fix: harden _is_github_server host validation to require hostname match by @sergio-sisternes-epam in #1239
- fix: emit Cursor-native MCP schema (type: stdio) instead of Copilot schema by @sergio-sisternes-epam in #1240
- perf(ci): shard + parallelize integration tests for ~5x speedup by @danielmeppiel in #1263
- fix(deps): fetch missing SHA-pinned commits into shallow bare clones by @sergio-sisternes-epam in #1259
- fix: accept full ADO https:// URLs with sub-paths (closes #1128) by @sergio-sisternes-epam in #1254
- fix: policy inheritance preserves paren

What's Changed
🔧 Other Changes
- chore: release v0.12.4 (apm-action v1.7.1 bump + audit-replay fix #1182) by @danielmeppiel in #1181
Full Changelog: v0.12.3...v0.12.4

What's Changed
🔧 Other Changes
- fix(install): branch-ref drift no longer ships 3-way-inconsistent lockfile by @danielmeppiel in #1158
- fix(install): rewrite in-package relative links to apm_modules/ paths (#1147) by @danielmeppiel in #1160
- fix(policy): close audit --ci silent governance bypass + SCP/ADO URL parsing (#1159) by @danielmeppiel in #1164
- fix(targets): explicit, auditable target resolution (closes #1154) by @danielmeppiel in #1165
- fix: exclude .apm-pin from skill deploy copytree by @tillig in #1153
- fix(copilot): translate env-var placeholders instead of baking secrets to disk (#1152) by @danielmeppiel in #1169
- chore(release): v0.12.3 by @danielmeppiel in #1170
- test(integration): pass --target copilot to apm init --yes by @danielmeppiel in #1171
- fix(install): orphan cleanup runs when apm.yml is emptied + diff-aware test fixes by @danielmeppiel in #1173
- fix(install): restore static-target deploy path; tighten test fixtures for #1154 strict harness detection by @danielmeppiel in #1176
- test: fix v0.12.3 CI failures on Windows + macOS by @danielmeppiel in #1179
- test(release-validation): pass --target copilot to apm init on Windows by @danielmeppiel in #1180
Full Changelog: v0.12.2...v0.12.3

What's Changed
🔧 Other Changes
- docs: clarify APM's role for skills, unify plugins-as-packages, add ADO sub-path examples, state stability by @danielmeppiel in #1127
- docs: fix first-package guide (includes: auto explained, correct skill paths) by @danielmeppiel in #1129
- fix(deps): subdir-agnostic bare cache fixes parallel sparse-checkout race (#1126) by @danielmeppiel in #1135
- feat(audit): default-on integration drift detection by @danielmeppiel in #1137
- chore(release): v0.12.2 by @danielmeppiel in #1141
- fix(install): exclude .apm-pin marker from package content hash (unblocks v0.12.2 release) by @danielmeppiel in #1142
Full Changelog: v0.12.1...v0.12.2

What's Changed
🔧 Other Changes
- feat(cursor): add slash command support for Cursor 1.6+ by @stbenjam in #1046
- ci(gh-aw): bump apm-action v1.5.0 -> v1.6.0 for plugin-bundle defenses by @danielmeppiel in #1121
- fix: explicit UTF-8 encoding in test _make_package helper to unblock Windows CI by @Copilot in #1124
- perf+ux: comprehensive overhaul of apm install (cache, parallel BFS, UX) by @danielmeppiel in #1116
- fix(tests): make cache-lockfile-parity test resilient to leftover deploy artifacts and timestamp drift by @danielmeppiel in #1125
Full Changelog: v0.12.0...v0.12.1

What's Changed
📖 Documentation
- [docs] Update documentation for features from 2026-04-29 by @danielmeppiel in #1037
- [docs] Update documentation for features from 2026-04-28 by @danielmeppiel in #1016
- [docs] Update documentation for features from 2026-03-26 by @danielmeppiel in #461
🔧 Other Changes
- fix(policy): fail closed on malformed manifest YAML by @sergio-sisternes-epam in #1053
- fix(install): map APM prompt 'input' to Claude 'arguments' front-matter by @stbenjam in #1039
- docs(contributing): teach authors to run apm-review-panel + pr-description-skill locally by @danielmeppiel in #1057
- fix(install): handle bare-string MCP entry in shell-metachar warning by @edenfunf in #951
- fix: correct Claude settings.json hook emission (#1007) by @sergio-sisternes-epam in #1054
- fix(compile): stabilize BUILD_ID in all compiled outputs by @edenfunf in #959
- refactor: split marketplace commands into package modules by @shreejaykurhade in #1024
- feat: add Ruff code quality guardrails (replaces black + isort) by @sergio-sisternes-epam in #999
- fix: respect CLAUDE_CONFIG_DIR for claude target user-scope deploy by @shuntaka9576 in #1055
- chore(compile): tighten link_resolver._resolve_path input guards by @mvanhorn in #991
- [fix] translate bare ${VAR} env-var refs in self-defined MCP server headers (#944) by @edenfunf in #947
- fix: address Copilot review findings on #1055 and #991 (consolidated) by @danielmeppiel in #1065
- feat(marketplace): harden apm pack output (#1061) by @danielmeppiel in #1063
- fix(install): allow local packages at --global scope; fix broken tests by @stbenjam in #937
- fix: extend explicit UTF-8 encoding to 5 remaining open() call sites by @danielmeppiel in #1068
- fix(compile): emit and clean up copilot root instructions (#792) by @danielmeppiel in #1067
- [Test Improver] test: add unit tests for install/mcp_warnings.py (0% -> ~100%) by @danielmeppiel in #828
- docs(notice): rename NOTICE.md -> NOTICE; add CLA third-party section by @danielmeppiel in #1073
- perf(compile): cache file walk and fix placement for narrow patterns by @Roozi489 in #871
- Don't flag parent dirs of subdirectory packages as orphaned by @tillig in #1052
- test(windows): fix CLAUDE_CONFIG_DIR scope tests on Windows by @danielmeppiel in #1086
- fix(marketplace): enhance repository input parsing for GitLab subgroups and HTTPS URLs by @Antonin-Rouxel-LaPoste-BGPN in #1034
- Stop rendering CLAUDE.md dependencies that don't exist by @tillig in #1048
- fix(install): align validation auth chain with install by @a1icja in #941
- docs(authors): show maintainer affiliations and link contributor graph by @danielmeppiel in #1090
- fix: remove Codex-only user-visible hint on opt-in miss (vendor-neutrality) by @Copilot in #1083
- fix(install): allow credential helpers in --update preflight for generic hosts by @tillig in #1084
- refactor(panel): rebuild apm-review-panel as advisory, scannable, and self-healing by @danielmeppiel in #1093
- feat(install): apm install + lockfile-embedded plugin packs (#1098) by @danielmeppiel in #1099
- fix(deps): support meta-packages and apm.yml inside collections/ subpaths by @edenfunf in #1097
- refactor(panel): add tier axis to test-coverage evidence by @danielmeppiel in #1102
- feat: add Claude Code as MCP install target (closes #643, supersedes #655) by @danielmeppiel in #1104
- fix(marketplace): resolve source.repo vs source.repository key mismatch (#1105) by @sergio-sisternes-epam in #1106
- feat(install): add --target agent-skills for cross-client .agents/skills/ deployment by @danielmeppiel in #1103
- fix(install): unmask exception handlers + Windows CRLF in local-bundle tests by @danielmeppiel in #1108
- fix(compile): include global instructions in AGENTS.md and CLAUDE.md by @edenfunf in #1088
- fix(tests): use urlparse for host assertions (CodeQL #88-#91) by @danielmeppiel in #1109
- chore(docs): upgrade Astro 5.18.1 -> 6.2.1 by @danielmeppiel in #1110
- Feature/windsurf target by @yoelabril in

What's Changed
🐛 Bug Fixes
- fix(install): ADO Entra ID auth path + --update pre-flight abort (#1015) by @danielmeppiel in #1031
🔧 Other Changes
- fix(policy): unify --policy / --policy-source forms across CLI help and docs by @edenfunf in #1000
- fix: rename token variable to resolve CodeQL clear-text-storage alert by @Copilot in #1002
- fix: remove stray "specify" from generated file footer by @stbenjam in #996
- refactor: complexity audit -- eliminate god-method forks, O(n^2) loops, redundant I/O by @sergio-sisternes-epam in #918
- fix: use POSIX paths in auto-discovery CLI output for Windows compat by @sergio-sisternes-epam in #1018
- fix: marketplace build respects GITHUB_HOST for GHE repos by @sergio-sisternes-epam in #1009
- fix(targets): validate apm.yml target: at parse time, share normalization with CLI (closes #820) by @edenfunf in #987
- refactor(review-panel): true fan-out + binary verdict + label automation by @danielmeppiel in #1022
- feat(shared/apm): apps[] + matrix fan-out for multi-org App auth by @danielmeppiel in #982
- Devcontainer feature by @coakenfold in #861
- fix(shared/apm): drop stale STATUS banner; recompile lock files to v1.5.0 by @danielmeppiel in #1026
- fix(workflows): skip-don't-fail panel label gate; bump gh-aw v0.68.3 -> v0.71.1 by @danielmeppiel in #1030
- fix(marketplace): add honors manifest.name for Claude Code parity by @danielmeppiel in #1032
- fix(shared/apm): repair gh-aw [a b] import-input serialization that breaks apm-prep by @danielmeppiel in #1033
- feat(codex): add project-scoped MCP and user target support by @Nickolaus in #803
- feat(marketplace): fold marketplace.yml into apm.yml's 'marketplace:' block (closes #722, implements #1036) by @danielmeppiel in #1038
- Fix #1019: Improve compile target specification by @tillig in #1020
- chore: add NOTICE file for third-party components by @danielmeppiel in #1043
- chore(notices): automate NOTICE.md generation + CI drift gate by @danielmeppiel in #1045
- feat(pack): unify 'apm pack' to produce bundle and marketplace.json (closes #722) by @danielmeppiel in #1042
- fix(shared/apm): re-shape single-artifact download to expected layout by @danielmeppiel in #1051
- chore(release): cut 0.11.0 by @danielmeppiel in #1049
New Contributors
- @Nickolaus made their first contribution in #803
Full Changelog: v0.10.0...v0.11.0

What's Changed
🔧 Other Changes
- docs(readme): add 'Coming from npx skills add?' conversion block by @danielmeppiel in #980
- fix(docs): deploy on tag push, not on the unreachable workflow_call branch by @danielmeppiel in #981
- Add evals suite to pr-description-skill (genesis-driven) by @danielmeppiel in #985
- Harden pr-description-skill mermaid conventions (diagram-type-by-intent + GH-renderer gotchas) by @danielmeppiel in #984
- feat(cowork): experimental support for Microsoft 365 Copilot Cowork custom skills by @sergio-sisternes-epam in #926
- fix(test): patch sys.platform in cowork tests for Windows CI by @sergio-sisternes-epam in #989
- feat(marketplace): add experimental authoring CLI commands (#722) by @sergio-sisternes-epam in #790
- chore(release): cut 0.10.0 by @danielmeppiel in #986
- Fix: apm install https://... no longer falls back to SSH on generic Git hosts by @Copilot in #995
- fix(tests): make doctor tests deterministic across CI environments by @sergio-sisternes-epam in #997
- fix(tests): use os.path.normpath in cowork skills dir assertions for Windows CI by @sergio-sisternes-epam in #1006
Full Changelog: v0.9.4...v0.10.0

What's Changed
🔧 Other Changes
- fix(ci): deploy docs after bot-cut releases via workflow_call by @danielmeppiel in #953
- feat(ci): automate apm-triage-panel on new and reopened issues by @danielmeppiel in #954
- fix(templates): use canonical taxonomy labels in issue templates by @danielmeppiel in #958
- fix(cli): CLI consistency report findings(#903) by @shreejaykurhade in #910
- fix(install): honour REQUESTS_CA_BUNDLE in package validator by @abi-jey in #911
- fix(triage-panel): dispatch project-sync per themed issue by @danielmeppiel in #971
- feat(install): SKILL_BUNDLE -- day-0 install parity with npx skills add by @danielmeppiel in #974
- docs(python-architect): document mermaid classDiagram :::cssClass GitHub-render trap by @danielmeppiel in #970
- feat: make install.sh configurable for air-gapped environments by @chkp-roniz in #660
- chore(release): cut 0.9.4 by @danielmeppiel in #978
- fix(tests): force UTF-8 in non-ASCII SKILL.md fixture (Windows CI hotfix) by @danielmeppiel in #979
New Contributors
- @shreejaykurhade made their first contribution in #910
- @abi-jey made their first contribution in #911
Full Changelog: v0.9.3...v0.9.4

What's Changed
🚀 New Features
- feat(cli): apm experimental - feature-flag registry with list/enable/disable/reset by @sergio-sisternes-epam in #849
📖 Documentation
- [docs] Update runtime-compatibility docs for Gemini CLI (#917) by @danielmeppiel in #945
🔧 Other Changes
- chore(ci): remove deprecated PR-time stub workflow by @danielmeppiel in #875
- docs(ci): improve Branch Protection section per review feedback by @danielmeppiel in #874
- ci(build-release): gate smoke to tag/schedule/dispatch only by @danielmeppiel in #878
- ci: dogfood apm audit --ci and integration-drift gate (closes #883) by @danielmeppiel in #885
- harden(apm-review-panel): one-comment discipline + Hybrid E auth routing + apm-primitives-architect persona by @danielmeppiel in #882
- chore: bump shared/apm.md to microsoft/apm-action@v1.4.2 by @danielmeppiel in #904
- chore(panel-review): tighten one-comment contract; safety cap 1 -> 7 by @danielmeppiel in #905
- fix(panel-review): orchestrator self-arbitrates and emits in skill contract by @danielmeppiel in #907
- fix(apm-review-panel): restore in-context persona model (per agentskills.io) by @danielmeppiel in #908
- feat(audit): close audit-blindness gap for local .apm/ content (#887) by @danielmeppiel in #889
- feat(skills): add apm-triage-panel for issue triage by @danielmeppiel in #915
- fix(update): sanitise env before spawning installer by @edenfunf in #899
- fix(install): scope local content scan to ~/.apm/ at user scope (#830) by @guwenqing in #850
- fix(ci): add merge_group trigger to Merge Gate so it reports in queue by @danielmeppiel in #921
- fix(policy): handle OSError from is_file() on macOS PATH_MAX limit by @chaobo8484 in #860
- perf(discovery): prune excluded subtrees during traversal by @Roozi489 in #870
- add(skills): pr-description-skill -- anchored, self-sufficient PR bodies for microsoft/apm by @danielmeppiel in #884
- fix: Copilot adapter validates remote transport_type (#791) by @mvanhorn in #812
- fix(policy): resolve project_root before path-traversal check by @qorexdevs in #895
- feat(ci): PGS project board sync workflow + bootstrap script by @danielmeppiel in #919
- docs(changelog): resolve 0.9.2 merge conflict, dedupe sections, add missing post-0.9.2 entries by @danielmeppiel in #932
- feat(gemini): add Gemini CLI as supported target with integration tests by @stbenjam in #917
- fix(workflows): gate pr-review-panel on panel-review label at pre-activation by @danielmeppiel in #948
- fix(install): route HYBRID and CLAUDE_SKILL packages through skill-bundle path by @danielmeppiel in #946
- docs: clarify dev-only primitives and the .apm/ scanner boundary by @danielmeppiel in #949
- chore(release): 0.9.3 by @danielmeppiel in #950
New Contributors
- @guwenqing made their first contribution in #850
- @chaobo8484 made their first contribution in #860
- @Roozi489 made their first contribution in #870
- @mvanhorn made their first contribution in #812
- @qorexdevs made their first contribution in #895
- @stbenjam made their first contribution in #917
Full Changelog: v0.9.2...v0.9.3

What's Changed
🔧 Other Changes
- fix(install): lowercase host in fallback-port-warned dedup key by @edenfunf in #815
- docs(governance): flagship Governance Guide + corpus rationalization by @danielmeppiel in #851
- docs(landing): align with three-pillar spine by @danielmeppiel in #855
- docs(enterprise): refactor section IA -- hub + merge teams + dedupe governance by @danielmeppiel in #858
- fix(install): surface custom port in generic host clone/ls-remote error by @edenfunf in #804
- feat(auth): Azure DevOps authentication via Entra ID (AAD) bearer tokens by @danielmeppiel in #856
- docs(gh-aw): replace deprecated dependencies: with shared/apm.md import by @danielmeppiel in #864
- ci: add merge-gate orchestrator to harden against dropped pull_request webhooks by @danielmeppiel in #865
- docs: rewrite first-package tutorial, fix anatomy hallucination by @danielmeppiel in #866
- ci: collapse 5 required PR-time checks into a single Merge Gate verdict by @danielmeppiel in #867
- chore: prepare v0.9.2 release by @danielmeppiel in #868
Full Changelog: v0.9.1...v0.9.2

What's Changed
🔧 Other Changes
- ci(docs): deploy site only on stable APM releases by @Copilot in #822
- chore: dogfood APM by migrating primitives from .github/ to .apm/ by @danielmeppiel in #823
- feat(workflows): automate apm-review-panel via github/gh-aw by @danielmeppiel in #824
- fix(workflows): allow fork PRs in pr-review-panel by @danielmeppiel in #826
- fix(panel-workflow): only fire on label, add dispatch path for fork PRs by @danielmeppiel in #836
- fix(panel-workflow): use pull_request_target so labelled fork PRs run by @danielmeppiel in #837
- feat(policy): enforce apm-policy.yml at install time by @danielmeppiel in #832
- chore: prepare v0.9.1 release by @danielmeppiel in #838
Full Changelog: v0.9.0...v0.9.1

What's Changed
🚀 New Features
- feat(install): add --mcp flag for declaratively adding MCP servers to apm.yml by @danielmeppiel in #810
- feat(validation): reject shell-string command in MCP stdio entries by @danielmeppiel in #809
🔧 Other Changes
- docs(instrumentation): APM Review Panel - 7-agent expert review for non-trivial changes by @danielmeppiel in #777
- fix: preserve protocol (e.g. ssh:// or https://) and port in dependency URL by @edenfunf in #665
- feat(transport): TransportSelector + strict-by-default transport (#778) by @danielmeppiel in #779
- fix(install): MARKETPLACE_PLUGIN beats HOOK_PACKAGE in detection cascade (#780) by @danielmeppiel in #781
- feat: marketplace UX, security hardening, and lockfile provenance (#514) by @sergio-sisternes-epam in #677
- fix: detect port-like segment in SCP shorthand and suggest ssh:// form by @edenfunf in #787
- feat: allow multiple targets in apm.yml and --target CLI flag by @sergio-sisternes-epam in #628
- fix: VS Code adapter fails to configure HTTP/SSE remote MCP servers (#654) by @sergio-sisternes-epam in #656
- Fix apm install --global skipping MCP server installation by @sergio-sisternes-epam in #638
- fix(auth): thread dep_ref.port into credential resolution (#785) by @edenfunf in #788
- fix(install): warn when --allow-protocol-fallback reuses a custom port across schemes (#786) by @edenfunf in #789
- [Test Improver] test: add unit tests for MCPIntegrator (0% -> ~75%) by @danielmeppiel in #632
- [Test Improver] test: add unit tests for drift-detection helpers (0% -> ~100%) by @danielmeppiel in #727
- [Test Improver] test: expand coverage for update command (64% -> ~95%) by @danielmeppiel in #657
- [Test Improver] test: add unit tests for uninstall engine helpers by @danielmeppiel in #795
- [Test Improver] test: add unit tests for BaseIntegrator shared infrastructure (69 tests) by @danielmeppiel in #618
- feat: Add build-time policy to disable self-update in packaged builds by @melund in #675
- fix(init): remove triple confirm prompt on Windows CP950 terminals (#602) by @sergio-sisternes-epam in #647
- fix(init): reframe Next Steps panel around install workflows (#603) by @sergio-sisternes-epam in #649
- feat: support allow-insecure HTTP dependencies by @arika0093 in #700
New Contributors
- @melund made their first contribution in #675
- @arika0093 made their first contribution in #700
Full Changelog: v0.8.12...v0.9.0

What's Changed
🚀 New Features
- ci: adopt GitHub Merge Queue with tiered CI (#770) by @danielmeppiel in #771
🔧 Other Changes
- chore: add @sergio-sisternes-epam as maintainer by @danielmeppiel in #623
- feat: add apm info, apm outdated, and list_remote_refs by @sergio-sisternes-epam in #613
- feat: proxy-aware marketplace indexes by @chkp-roniz in #617
- fix: propagate headers through OpenCode MCP adapter by @alopezsanchez in #622
- feat: support project-local .apm/ content during apm install by @sergio-sisternes-epam in #644
- fix(runtime): pin codex setup to rust-v0.118.0 for security by @sergio-sisternes-epam in #663
- fix: rewrite Windows backslash paths in hook commands by @danielmeppiel in #609
- [fix] include dependency instructions in claude compile (#631) by @edenfunf in #642
- Enable SSH timeout to fallback to HTTP. by @tillig in #653
- fix: add encoding="utf-8" to prompt file open() calls in script_runner (Windows CP950) by @edenfunf in #607
- Fix: apm marketplace add silently fails for private repos by @sergio-sisternes-epam in #701
- fix(hooks): make apm install idempotent for hook entries by @srid in #709
- [fix] suppress internal config keys from apm config get output (#564) by @edenfunf in #571
- fix: use yaml.safe_dump for virtual package apm.yml generation by @edenfunf in #707
- feat: add configurable temp directory to resolve Windows access denied errors by @sergio-sisternes-epam in #629
- fix: enhance git remote validation by trying SSH URLs for generic hosts by @zzoubian in #584
- fix(auth): provide ADO-specific authentication error message for dev.… by @coakenfold in #742
- fix: strip skills prefix from bare skill plugin export by @zeel2104 in #738
- fix: deploy root project .apm/ primitives without a sub-package stub by @edenfunf in #715
- [fix] support codeload github archive urls for artifactory (#710) by @edenfunf in #712
- Add 55 tests for deps/_utils.py and view.py coverage by @Copilot in #682
- fix(deps): align _count_package_files to use .apm/context/ (singular) dir by @edenfunf in #748
- test(marketplace): isolate test_auto_detect_through_proxy from real network by @danielmeppiel in #759
- harden(plugin): enforce plugin-root containment for manifest paths by @danielmeppiel in #760
- fix(install): clean up stale deployed files on rename/remove within a package (#666) by @Boubalou in #750
- fix(install): harden stale-file cleanup with per-file content-hash provenance (#666 follow-up) by @danielmeppiel in #762
- refactor(install): modularize install.py into engine package by @danielmeppiel in #764
- test(integration): close install/uninstall/update CLI coverage gaps surfaced by #764 review by @danielmeppiel in #767
- fix: create target dir for explicit --target claude; content hash fallback when .git absent by @Copilot in #763
- fix: validate project name to reject path separators in apm init by @edenfunf in #724
- fix: prevent duplicate Test Improver monthly activity issues by @sergio-sisternes-epam in #681
- Add .editorconfig to standardize formatting across contributions by @Copilot in #671
- fix: _parse_artifactory_base_url() ignores PROXY_REGISTRY_URL — lockfile reinstall fails (#614) by @chkp-roniz in #616
- fix: route --target codex/opencode through AGENTS.md compiler (#766) by @edenfunf in #769
- chore: prepare v0.8.12 release by @danielmeppiel in #774
New Contributors
- @tillig made their first contribution in #653
- @srid made their first contribution in #709
- @zzoubian made their first contribution in #584
- @coakenfold made their first contribution in #742
- @zeel2104 made their first contribution in #738
- @Boubalou made their first contribution in #750
Full Changelog: v0.8.11...v0.8.12

What's Changed
🔧 Other Changes
- [fix] warn when two packages deploy a native skill with the same name by @edenfunf in #545
- [fix] detect remote default branch instead of hardcoding main (#573) by @edenfunf in #574
- refactor: unify integration dispatch, result types, and hook dedup by @danielmeppiel in #562
- feat: Artifactory archive entry download for virtual file packages by @chkp-roniz in #525
- Fix: compilation.exclude does not filter primitive discovery by @Copilot in #477
- fix: respect GITHUB_HOST in marketplace add command by @edenfunf in #589
- fix: use nested Join-Path for PowerShell 5.1 compatibility by @edenfunf in #593
- fix: subprocess encoding failures on Windows non-UTF-8 consoles (CP950/CP936) by @edenfunf in #591
- fix: use scope-resolved target dir for hook deployment by @sergio-sisternes-epam in #566
- fix: enforce symlink containment in file discovery and resolution by @danielmeppiel in #596
- [fix] script_runner: anchor runtime detection patterns to prevent false positives by @edenfunf in #563
- fix: warn when instruction is missing required fields during apm compile by @alopezsanchez in #449
- chore: prepare v0.8.11 release by @danielmeppiel in #598
New Contributors
- @edenfunf made their first contribution in #545
- @alopezsanchez made their first contribution in #449
Full Changelog: v0.8.10...v0.8.11

What's Changed
🐛 Bug Fixes
- fix: process windows hook key for script copying and path rewriting by @Copilot in #521
🔧 Other Changes
- docs: add marketplace highlight and example to README by @danielmeppiel in #513
- Add agent-guide: teach AI agents how to use APM by @cabird in #516
- docs: add agentrc ecosystem section to README by @danielmeppiel in #509
- Deploy instructions to .claude/rules/ for Claude Code by @Copilot in #527
- [Test Improver] test: add unit tests for deps list, tree, and info subcommands by @danielmeppiel in #532
- [Test Improver] test: add unit tests for mcp command (0% -> ~85%) by @danielmeppiel in #480
- [Test Improver] test: expand unit tests for list command (42% -> 100%) by @danielmeppiel in #444
- fix: scope-resolved target profiles + Claude Code instructions by @danielmeppiel in #542
- fix: address post-merge review on #542 by @danielmeppiel in #547
- fix: respect update_refs in download_callback and skip logic (#548) by @sergio-sisternes-epam in #550
- fix: CLI consistency — missing targets, Unicode violations, undocumented flags by @Copilot in #543
- chore: consolidate CHANGELOG entries to 1 line per PR by @danielmeppiel in #555
- chore: bump version to 0.8.10 by @danielmeppiel in #560
New Contributors
- @cabird made their first contribution in #516
Full Changelog: v0.8.9...v0.8.10

What's Changed
🔧 Other Changes
- fix: respect metadata.pluginRoot + prepare v0.8.9 hotfix by @danielmeppiel in #512
Full Changelog: https://github.com/microsoft/apm/compare/v0.8.8...v0.8.9

What's Changed
🔧 Other Changes
- fix: batch bug fixes -- installer fallback, target registry, lockfile idempotency by @danielmeppiel in #456
- Fix Windows antivirus file-lock errors during apm install by @Copilot in #440
- fix: allow spaces in ADO repository names when parsing URLs by @PremKumarML in #437
- fix: gate .claude/commands/ deployment behind integrate_claude flag by @neop26 in #443
- fix: reject path traversal in SSH URL parsing by @thakoreh in #458
- fix: exclude bundled OpenSSL libs from Linux binary by @danielmeppiel in #466
- fix: sort instruction discovery order for deterministic Build IDs across platforms by @Coolomina in #468
- fix: share AuthResolver across install to prevent duplicate auth popups by @frblondin in #424
- chore: bump to v0.8.6 by @danielmeppiel in #474
New Contributors
- @PremKumarML made their first contribution in #437
- @neop26 made their first contribution in #443
- @thakoreh made their first contribution in #458
- @Coolomina made their first contribution in #468
- @frblondin made their first contribution in #424
Full Changelog: v0.8.5...v0.8.6

What's Changed
📖 Documentation
- [docs] Update documentation for features from 2026-03-23 by @danielmeppiel in #416
🔧 Other Changes
- [Test Improver] test: add unit tests for AgentsCompiler (65%→82% coverage) by @danielmeppiel in #221
- [Test Improver] Add unit tests for commands/_helpers.py I/O and config helpers by @danielmeppiel in #333
- [Test Improver] test: add unit tests for utils/console.py (58% → 90%) by @danielmeppiel in #351
- [Test Improver] test: add unit tests for RuntimeManager and runtime CLI commands (20%→92%, 49%→90%) by @danielmeppiel in #380
- [Test Improver] test: replace gc.collect+sleep teardown with shutil.rmtree(ignore_errors=True) by @danielmeppiel in #395
- [Test Improver] test: add unit tests for constitution_block and ConstitutionInjector (53%→93%, 44%→95%) by @danielmeppiel in #402
- Add Copilot encoding instructions banning non-ASCII/emoji characters by @Copilot in #282
- [Test Improver] test: add unit tests for config command (22% → 100%) + fix missing functions by @danielmeppiel in #366
- perf(ci): comprehensive pipeline optimization by @Copilot in #407
- fix: CLI consistency improvements (target aliases, deps clean flags, verbose shorthand, help text) by @Copilot in #303
- fix: Windows test failures in config command and agents compiler by @danielmeppiel in #410
- fix: resolve both sides of relative_to() for Windows 8.3 path compat by @danielmeppiel in #411
- fix: show auth diagnostics in --verbose for virtual package validation by @danielmeppiel in #414
- fix: enforce ARTIFACTORY_ONLY for virtual package types by @chkp-roniz in #418
- fix: remove WIP folder from tracking and strengthen gitignore by @danielmeppiel in #420
- [Test Improver] test: add unit tests for prune command (14% -> 91%) by @danielmeppiel in #415
- fix: cross-target path mapping for skills/agents in apm pack by @Copilot in #426
- fix: Configure SSL certificates in PyInstaller binary via runtime hook by @Copilot in #429
- feat(policy): Phase 1 — org-level policy engine for apm audit --ci by @danielmeppiel in #365
- fix: centralize YAML I/O with UTF-8 encoding for cross-platform safety by @danielmeppiel in #433
- fix: Systematic Windows path compatibility hardening by @Copilot in #422
- fix: improve local path validation error messages by @danielmeppiel in #431
- fix: recognize Windows drive-letter absolute paths as local paths in DependencyReference by @Copilot in #435
- chore: bump to v0.8.5 by @danielmeppiel in #439
Full Changelog: v0.8.4...v0.8.5

What's Changed
🚀 New Features
- feat: Auth + Logging Architecture Overhaul (#393) by @danielmeppiel in #394
🔧 Other Changes
- Remove unused files: copilot-banner.png, copilot-cli-screenshot.png, dummy by @Copilot in #391
- docs: document ${input:...} variable support in MCP server headers and env by @Copilot in #349
- chore: bump to v0.8.4 by @danielmeppiel in #404
- fix(ci): replace curl-based uv install with astral-sh/setup-uv action by @danielmeppiel in #405
Full Changelog: v0.8.3...v0.8.4

What's Changed
🐛 Bug Fixes
- fix: harden dependency path validation by @danielmeppiel in #364
🔧 Other Changes
- fix: credential fill returns garbage token in tokenless CI (gh-aw regression) by @danielmeppiel in #356
- chore: prepare v0.8.2 release by @danielmeppiel in #357
- fix: gh-aw compat test uses correct apm install syntax by @danielmeppiel in #360
- fix: add required name field to ghaw compat test apm.yml by @danielmeppiel in #362
- fix: ghaw compat test apm.yml uses correct manifest format by @danielmeppiel in #363
- Add JFrog Artifactory VCS repository support by @chkp-roniz in #354
- perf(ci): consolidate macOS into single-request jobs, gate ARM to releases only by @danielmeppiel in #368
New Contributors
- @chkp-roniz made their first contribution in #354
Full Changelog: v0.8.1...v0.8.2