v0.12.1

What's Changed

🔧 Other Changes

• feat(cursor): add slash command support for Cursor 1.6+ by @stbenjam in #1046
• ci(gh-aw): bump apm-action v1.5.0 -> v1.6.0 for plugin-bundle defenses by @danielmeppiel in #1121
• fix: explicit UTF-8 encoding in test _make_package helper to unblock Windows CI by @Copilot in #1124
• perf+ux: comprehensive overhaul of apm install (cache, parallel BFS, UX) by @danielmeppiel in #1116
• fix(tests): make cache-lockfile-parity test resilient to leftover deploy artifacts and timestamp drift by @danielmeppiel in #1125

Full Changelog: v0.12.0...v0.12.1

v0.12.0

What's Changed

📖 Documentation

• [docs] Update documentation for features from 2026-04-29 by @danielmeppiel in #1037
• [docs] Update documentation for features from 2026-04-28 by @danielmeppiel in #1016
• [docs] Update documentation for features from 2026-03-26 by @danielmeppiel in #461

🔧 Other Changes

• fix(policy): fail closed on malformed manifest YAML by @sergio-sisternes-epam in #1053
• fix(install): map APM prompt 'input' to Claude 'arguments' front-matter by @stbenjam in #1039
• docs(contributing): teach authors to run apm-review-panel + pr-description-skill locally by @danielmeppiel in #1057
• fix(install): handle bare-string MCP entry in shell-metachar warning by @edenfunf in #951
• fix: correct Claude settings.json hook emission (#1007) by @sergio-sisternes-epam in #1054
• fix(compile): stabilize BUILD_ID in all compiled outputs by @edenfunf in #959
• refactor: split marketplace commands into package modules by @shreejaykurhade in #1024
• feat: add Ruff code quality guardrails (replaces black + isort) by @sergio-sisternes-epam in #999
• fix: respect CLAUDE_CONFIG_DIR for claude target user-scope deploy by @shuntaka9576 in #1055
• chore(compile): tighten link_resolver._resolve_path input guards by @mvanhorn in #991
• [fix] translate bare ${VAR} env-var refs in self-defined MCP server headers (#944) by @edenfunf in #947
• fix: address Copilot review findings on #1055 and #991 (consolidated) by @danielmeppiel in #1065
• feat(marketplace): harden apm pack output (#1061) by @danielmeppiel in #1063
• fix(install): allow local packages at --global scope; fix broken tests by @stbenjam in #937
• fix: extend explicit UTF-8 encoding to 5 remaining open() call sites by @danielmeppiel in #1068
• fix(compile): emit and clean up copilot root instructions (#792) by @danielmeppiel in #1067
• [Test Improver] test: add unit tests for install/mcp_warnings.py (0% -> ~100%) by @danielmeppiel in #828
• docs(notice): rename NOTICE.md -> NOTICE; add CLA third-party section by @danielmeppiel in #1073
• perf(compile): cache file walk and fix placement for narrow patterns by @Roozi489 in #871
• Don't flag parent dirs of subdirectory packages as orphaned by @tillig in #1052
• test(windows): fix CLAUDE_CONFIG_DIR scope tests on Windows by @danielmeppiel in #1086
• fix(marketplace): enhance repository input parsing for GitLab subgroups and HTTPS URLs by @Antonin-Rouxel-LaPoste-BGPN in #1034
• Stop rendering CLAUDE.md dependencies that don't exist by @tillig in #1048
• fix(install): align validation auth chain with install by @a1icja in #941
• docs(authors): show maintainer affiliations and link contributor graph by @danielmeppiel in #1090
• fix: remove Codex-only user-visible hint on opt-in miss (vendor-neutrality) by @Copilot in #1083
• fix(install): allow credential helpers in --update preflight for generic hosts by @tillig in #1084
• refactor(panel): rebuild apm-review-panel as advisory, scannable, and self-healing by @danielmeppiel in #1093
• feat(install): apm install + lockfile-embedded plugin packs (#1098) by @danielmeppiel in #1099
• fix(deps): support meta-packages and apm.yml inside collections/ subpaths by @edenfunf in #1097
• refactor(panel): add tier axis to test-coverage evidence by @danielmeppiel in #1102
• feat: add Claude Code as MCP install target (closes #643, supersedes #655) by @danielmeppiel in #1104
• fix(marketplace): resolve source.repo vs source.repository key mismatch (#1105) by @sergio-sisternes-epam in #1106
• feat(install): add --target agent-skills for cross-client .agents/skills/ deployment by @danielmeppiel in #1103
• fix(install): unmask exception handlers + Windows CRLF in local-bundle tests by @danielmeppiel in #1108
• fix(compile): include global instructions in AGENTS.md and CLAUDE.md by @edenfunf in #1088
• fix(tests): use urlparse for host assertions (CodeQL #88-#91) by @danielmeppiel in #1109
• chore(docs): upgrade Astro 5.18.1 -> 6.2.1 by @danielmeppiel in #1110
• Feature/windsurf target by @yoelabril in #1066
• fix(install): anchor transitive local_path deps on declaring package (#857) by @danielmeppiel in #1111
• chore(release): cut 0.12.0 by @danielmeppiel in #1112

New Contributors

• @shuntaka9576 made their first contribution in #1055
• @Antonin-Rouxel-LaPoste-BGPN made their first contribution in #1034
• @a1icja made their first contribution in #941
• @yoelabril made their first contribution in #1066

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

🐛 Bug Fixes

• fix(install): ADO Entra ID auth path + --update pre-flight abort (#1015) by @danielmeppiel in #1031

🔧 Other Changes

• fix(policy): unify --policy / --policy-source forms across CLI help and docs by @edenfunf in #1000
• fix: rename token variable to resolve CodeQL clear-text-storage alert by @Copilot in #1002
• fix: remove stray "specify" from generated file footer by @stbenjam in #996
• refactor: complexity audit -- eliminate god-method forks, O(n^2) loops, redundant I/O by @sergio-sisternes-epam in #918
• fix: use POSIX paths in auto-discovery CLI output for Windows compat by @sergio-sisternes-epam in #1018
• fix: marketplace build respects GITHUB_HOST for GHE repos by @sergio-sisternes-epam in #1009
• fix(targets): validate apm.yml target: at parse time, share normalization with CLI (closes #820) by @edenfunf in #987
• refactor(review-panel): true fan-out + binary verdict + label automation by @danielmeppiel in #1022
• feat(shared/apm): apps[] + matrix fan-out for multi-org App auth by @danielmeppiel in #982
• Devcontainer feature by @coakenfold in #861
• fix(shared/apm): drop stale STATUS banner; recompile lock files to v1.5.0 by @danielmeppiel in #1026
• fix(workflows): skip-don't-fail panel label gate; bump gh-aw v0.68.3 -> v0.71.1 by @danielmeppiel in #1030
• fix(marketplace): add honors manifest.name for Claude Code parity by @danielmeppiel in #1032
• fix(shared/apm): repair gh-aw [a b] import-input serialization that breaks apm-prep by @danielmeppiel in #1033
• feat(codex): add project-scoped MCP and user target support by @Nickolaus in #803
• feat(marketplace): fold marketplace.yml into apm.yml's 'marketplace:' block (closes #722, implements #1036) by @danielmeppiel in #1038
• Fix #1019: Improve compile target specification by @tillig in #1020
• chore: add NOTICE file for third-party components by @danielmeppiel in #1043
• chore(notices): automate NOTICE.md generation + CI drift gate by @danielmeppiel in #1045
• feat(pack): unify 'apm pack' to produce bundle and marketplace.json (closes #722) by @danielmeppiel in #1042
• fix(shared/apm): re-shape single-artifact download to expected layout by @danielmeppiel in #1051
• chore(release): cut 0.11.0 by @danielmeppiel in #1049

New Contributors

• @Nickolaus made their first contribution in #803

Full Changelog: v0.10.0...v0.11.0

v0.10.0

What's Changed

🔧 Other Changes

• docs(readme): add 'Coming from npx skills add?' conversion block by @danielmeppiel in #980
• fix(docs): deploy on tag push, not on the unreachable workflow_call branch by @danielmeppiel in #981
• Add evals suite to pr-description-skill (genesis-driven) by @danielmeppiel in #985
• Harden pr-description-skill mermaid conventions (diagram-type-by-intent + GH-renderer gotchas) by @danielmeppiel in #984
• feat(cowork): experimental support for Microsoft 365 Copilot Cowork custom skills by @sergio-sisternes-epam in #926
• fix(test): patch sys.platform in cowork tests for Windows CI by @sergio-sisternes-epam in #989
• feat(marketplace): add experimental authoring CLI commands (#722) by @sergio-sisternes-epam in #790
• chore(release): cut 0.10.0 by @danielmeppiel in #986
• Fix: apm install https://... no longer falls back to SSH on generic Git hosts by @Copilot in #995
• fix(tests): make doctor tests deterministic across CI environments by @sergio-sisternes-epam in #997
• fix(tests): use os.path.normpath in cowork skills dir assertions for Windows CI by @sergio-sisternes-epam in #1006

Full Changelog: v0.9.4...v0.10.0

v0.9.4

What's Changed

🔧 Other Changes

• fix(ci): deploy docs after bot-cut releases via workflow_call by @danielmeppiel in #953
• feat(ci): automate apm-triage-panel on new and reopened issues by @danielmeppiel in #954
• fix(templates): use canonical taxonomy labels in issue templates by @danielmeppiel in #958
• fix(cli): CLI consistency report findings(#903) by @shreejaykurhade in #910
• fix(install): honour REQUESTS_CA_BUNDLE in package validator by @abi-jey in #911
• fix(triage-panel): dispatch project-sync per themed issue by @danielmeppiel in #971
• feat(install): SKILL_BUNDLE -- day-0 install parity with npx skills add by @danielmeppiel in #974
• docs(python-architect): document mermaid classDiagram :::cssClass GitHub-render trap by @danielmeppiel in #970
• feat: make install.sh configurable for air-gapped environments by @chkp-roniz in #660
• chore(release): cut 0.9.4 by @danielmeppiel in #978
• fix(tests): force UTF-8 in non-ASCII SKILL.md fixture (Windows CI hotfix) by @danielmeppiel in #979

New Contributors

• @shreejaykurhade made their first contribution in #910
• @abi-jey made their first contribution in #911

Full Changelog: v0.9.3...v0.9.4

v0.9.3

What's Changed

🚀 New Features

• feat(cli): apm experimental - feature-flag registry with list/enable/disable/reset by @sergio-sisternes-epam in #849

📖 Documentation

• [docs] Update runtime-compatibility docs for Gemini CLI (#917) by @danielmeppiel in #945

🔧 Other Changes

• chore(ci): remove deprecated PR-time stub workflow by @danielmeppiel in #875
• docs(ci): improve Branch Protection section per review feedback by @danielmeppiel in #874
• ci(build-release): gate smoke to tag/schedule/dispatch only by @danielmeppiel in #878
• ci: dogfood apm audit --ci and integration-drift gate (closes #883) by @danielmeppiel in #885
• harden(apm-review-panel): one-comment discipline + Hybrid E auth routing + apm-primitives-architect persona by @danielmeppiel in #882
• chore: bump shared/apm.md to microsoft/apm-action@v1.4.2 by @danielmeppiel in #904
• chore(panel-review): tighten one-comment contract; safety cap 1 -> 7 by @danielmeppiel in #905
• fix(panel-review): orchestrator self-arbitrates and emits in skill contract by @danielmeppiel in #907
• fix(apm-review-panel): restore in-context persona model (per agentskills.io) by @danielmeppiel in #908
• feat(audit): close audit-blindness gap for local .apm/ content (#887) by @danielmeppiel in #889
• feat(skills): add apm-triage-panel for issue triage by @danielmeppiel in #915
• fix(update): sanitise env before spawning installer by @edenfunf in #899
• fix(install): scope local content scan to ~/.apm/ at user scope (#830) by @guwenqing in #850
• fix(ci): add merge_group trigger to Merge Gate so it reports in queue by @danielmeppiel in #921
• fix(policy): handle OSError from is_file() on macOS PATH_MAX limit by @chaobo8484 in #860
• perf(discovery): prune excluded subtrees during traversal by @Roozi489 in #870
• add(skills): pr-description-skill -- anchored, self-sufficient PR bodies for microsoft/apm by @danielmeppiel in #884
• fix: Copilot adapter validates remote transport_type (#791) by @mvanhorn in #812
• fix(policy): resolve project_root before path-traversal check by @qorexdevs in #895
• feat(ci): PGS project board sync workflow + bootstrap script by @danielmeppiel in #919
• docs(changelog): resolve 0.9.2 merge conflict, dedupe sections, add missing post-0.9.2 entries by @danielmeppiel in #932
• feat(gemini): add Gemini CLI as supported target with integration tests by @stbenjam in #917
• fix(workflows): gate pr-review-panel on panel-review label at pre-activation by @danielmeppiel in #948
• fix(install): route HYBRID and CLAUDE_SKILL packages through skill-bundle path by @danielmeppiel in #946
• docs: clarify dev-only primitives and the .apm/ scanner boundary by @danielmeppiel in #949
• chore(release): 0.9.3 by @danielmeppiel in #950

New Contributors

• @guwenqing made their first contribution in #850
• @chaobo8484 made their first contribution in #860
• @Roozi489 made their first contribution in #870
• @mvanhorn made their first contribution in #812
• @qorexdevs made their first contribution in #895
• @stbenjam made their first contribution in #917

Full Changelog: v0.9.2...v0.9.3

v0.9.2

What's Changed

🔧 Other Changes

• fix(install): lowercase host in fallback-port-warned dedup key by @edenfunf in #815
• docs(governance): flagship Governance Guide + corpus rationalization by @danielmeppiel in #851
• docs(landing): align with three-pillar spine by @danielmeppiel in #855
• docs(enterprise): refactor section IA -- hub + merge teams + dedupe governance by @danielmeppiel in #858
• fix(install): surface custom port in generic host clone/ls-remote error by @edenfunf in #804
• feat(auth): Azure DevOps authentication via Entra ID (AAD) bearer tokens by @danielmeppiel in #856
• docs(gh-aw): replace deprecated dependencies: with shared/apm.md import by @danielmeppiel in #864
• ci: add merge-gate orchestrator to harden against dropped pull_request webhooks by @danielmeppiel in #865
• docs: rewrite first-package tutorial, fix anatomy hallucination by @danielmeppiel in #866
• ci: collapse 5 required PR-time checks into a single Merge Gate verdict by @danielmeppiel in #867
• chore: prepare v0.9.2 release by @danielmeppiel in #868

Full Changelog: v0.9.1...v0.9.2

v0.9.1

What's Changed

🔧 Other Changes

• ci(docs): deploy site only on stable APM releases by @Copilot in #822
• chore: dogfood APM by migrating primitives from .github/ to .apm/ by @danielmeppiel in #823
• feat(workflows): automate apm-review-panel via github/gh-aw by @danielmeppiel in #824
• fix(workflows): allow fork PRs in pr-review-panel by @danielmeppiel in #826
• fix(panel-workflow): only fire on label, add dispatch path for fork PRs by @danielmeppiel in #836
• fix(panel-workflow): use pull_request_target so labelled fork PRs run by @danielmeppiel in #837
• feat(policy): enforce apm-policy.yml at install time by @danielmeppiel in #832
• chore: prepare v0.9.1 release by @danielmeppiel in #838

Full Changelog: v0.9.0...v0.9.1

v0.9.0

What's Changed

🚀 New Features

• feat(install): add --mcp flag for declaratively adding MCP servers to apm.yml by @danielmeppiel in #810
• feat(validation): reject shell-string command in MCP stdio entries by @danielmeppiel in #809

🔧 Other Changes

• docs(instrumentation): APM Review Panel - 7-agent expert review for non-trivial changes by @danielmeppiel in #777
• fix: preserve protocol (e.g. ssh:// or https://) and port in dependency URL by @edenfunf in #665
• feat(transport): TransportSelector + strict-by-default transport (#778) by @danielmeppiel in #779
• fix(install): MARKETPLACE_PLUGIN beats HOOK_PACKAGE in detection cascade (#780) by @danielmeppiel in #781
• feat: marketplace UX, security hardening, and lockfile provenance (#514) by @sergio-sisternes-epam in #677
• fix: detect port-like segment in SCP shorthand and suggest ssh:// form by @edenfunf in #787
• feat: allow multiple targets in apm.yml and --target CLI flag by @sergio-sisternes-epam in #628
• fix: VS Code adapter fails to configure HTTP/SSE remote MCP servers (#654) by @sergio-sisternes-epam in #656
• Fix apm install --global skipping MCP server installation by @sergio-sisternes-epam in #638
• fix(auth): thread dep_ref.port into credential resolution (#785) by @edenfunf in #788
• fix(install): warn when --allow-protocol-fallback reuses a custom port across schemes (#786) by @edenfunf in #789
• [Test Improver] test: add unit tests for MCPIntegrator (0% -> ~75%) by @danielmeppiel in #632
• [Test Improver] test: add unit tests for drift-detection helpers (0% -> ~100%) by @danielmeppiel in #727
• [Test Improver] test: expand coverage for update command (64% -> ~95%) by @danielmeppiel in #657
• [Test Improver] test: add unit tests for uninstall engine helpers by @danielmeppiel in #795
• [Test Improver] test: add unit tests for BaseIntegrator shared infrastructure (69 tests) by @danielmeppiel in #618
• feat: Add build-time policy to disable self-update in packaged builds by @melund in #675
• fix(init): remove triple confirm prompt on Windows CP950 terminals (#602) by @sergio-sisternes-epam in #647
• fix(init): reframe Next Steps panel around install workflows (#603) by @sergio-sisternes-epam in #649
• feat: support allow-insecure HTTP dependencies by @arika0093 in #700

New Contributors

• @melund made their first contribution in #675
• @arika0093 made their first contribution in #700

Full Changelog: v0.8.12...v0.9.0

v0.8.12

What's Changed

🚀 New Features

• ci: adopt GitHub Merge Queue with tiered CI (#770) by @danielmeppiel in #771

🔧 Other Changes

• chore: add @sergio-sisternes-epam as maintainer by @danielmeppiel in #623
• feat: add apm info, apm outdated, and list_remote_refs by @sergio-sisternes-epam in #613
• feat: proxy-aware marketplace indexes by @chkp-roniz in #617
• fix: propagate headers through OpenCode MCP adapter by @alopezsanchez in #622
• feat: support project-local .apm/ content during apm install by @sergio-sisternes-epam in #644
• fix(runtime): pin codex setup to rust-v0.118.0 for security by @sergio-sisternes-epam in #663
• fix: rewrite Windows backslash paths in hook commands by @danielmeppiel in #609
• [fix] include dependency instructions in claude compile (#631) by @edenfunf in #642
• Enable SSH timeout to fallback to HTTP. by @tillig in #653
• fix: add encoding="utf-8" to prompt file open() calls in script_runner (Windows CP950) by @edenfunf in #607
• Fix: apm marketplace add silently fails for private repos by @sergio-sisternes-epam in #701
• fix(hooks): make apm install idempotent for hook entries by @srid in #709
• [fix] suppress internal config keys from apm config get output (#564) by @edenfunf in #571
• fix: use yaml.safe_dump for virtual package apm.yml generation by @edenfunf in #707
• feat: add configurable temp directory to resolve Windows access denied errors by @sergio-sisternes-epam in #629
• fix: enhance git remote validation by trying SSH URLs for generic hosts by @zzoubian in #584
• fix(auth): provide ADO-specific authentication error message for dev.… by @coakenfold in #742
• fix: strip skills prefix from bare skill plugin export by @zeel2104 in #738
• fix: deploy root project .apm/ primitives without a sub-package stub by @edenfunf in #715
• [fix] support codeload github archive urls for artifactory (#710) by @edenfunf in #712
• Add 55 tests for deps/_utils.py and view.py coverage by @Copilot in #682
• fix(deps): align _count_package_files to use .apm/context/ (singular) dir by @edenfunf in #748
• test(marketplace): isolate test_auto_detect_through_proxy from real network by @danielmeppiel in #759
• harden(plugin): enforce plugin-root containment for manifest paths by @danielmeppiel in #760
• fix(install): clean up stale deployed files on rename/remove within a package (#666) by @Boubalou in #750
• fix(install): harden stale-file cleanup with per-file content-hash provenance (#666 follow-up) by @danielmeppiel in #762
• refactor(install): modularize install.py into engine package by @danielmeppiel in #764
• test(integration): close install/uninstall/update CLI coverage gaps surfaced by #764 review by @danielmeppiel in #767
• fix: create target dir for explicit --target claude; content hash fallback when .git absent by @Copilot in #763
• fix: validate project name to reject path separators in apm init by @edenfunf in #724
• fix: prevent duplicate Test Improver monthly activity issues by @sergio-sisternes-epam in #681
• Add .editorconfig to standardize formatting across contributions by @Copilot in #671
• fix: _parse_artifactory_base_url() ignores PROXY_REGISTRY_URL — lockfile reinstall fails (#614) by @chkp-roniz in #616
• fix: route --target codex/opencode through AGENTS.md compiler (#766) by @edenfunf in #769
• chore: prepare v0.8.12 release by @danielmeppiel in #774

New Contributors

• @tillig made their first contribution in #653
• @srid made their first contribution in #709
• @zzoubian made their first contribution in #584
• @coakenfold made their first contribution in #742
• @zeel2104 made their first contribution in #738
• @Boubalou made their first contribution in #750

Full Changelog: v0.8.11...v0.8.12