v0.14.2

What's Changed

🔧 Other Changes

• test(coverage): enforce 75% unit gate and push integration to 60% by @sergio-sisternes-epam in #1414
• add(coverage): Phase 3 -- unit 88% / integration 71% by @sergio-sisternes-epam in #1417
• add(coverage): raise unit and integration gates to 90% with phase-3 + phase-4 tests by @sergio-sisternes-epam in #1425
• test: replace logic-replay tests for #763 with real-flow coverage by @mvanhorn in #1340
• fix: preflight via ssh on ssh based connections (closes #1293) by @Alpha200 in #1303
• fix: support Streamable HTTP MCP servers for Codex CLI (closes #1260) by @masaishi in #1262
• fix: resolve env-var placeholders in Codex/Gemini self-defined stdio MCP (closes #1266) by @edenfunf in #1277
• fix(hooks): stabilize root .apm hook source-ids across renames/worktrees (supersedes #1330, closes #1329) by @danielmeppiel in #1392
• fix(tests): make Windows unit-test job green by @danielmeppiel in #1427
• fix(ado): resolve az binary via shutil.which for Windows az.cmd (closes #1430) by @danielmeppiel in #1432
• feat(copilot-app): hybrid WS-IPC + SQLite project scoping for workflows by @danielmeppiel in #1431
• ci: shard PR tests + move binary build off critical path by @danielmeppiel in #1437
• perf(#1433): sparse-cone consumer materialization for subdir deps by @danielmeppiel in #1436
• fix(copilot-app): warn-not-fail on newer App schema + feat: batch-bug-shepherd primitive by @danielmeppiel in #1434
• fix(compile): discover local-bundle instructions in apm_modules/ by @danielmeppiel in #1388
• fix(cache): handle ValueError from parsed.port on Windows file:// URLs by @danielmeppiel in #1446
• fix(integration): respect comma-separated applyTo globs in Claude/Cursor/Windsurf by @danielmeppiel in #1387
• fix(build): restore optimize=2 + enforce explicit Click help= to clear Defender ML false positive (#1407) by @danielmeppiel in #1450
• fix(hooks): keep project-scope hook commands repo-relative (closes #1394) by @srid in #1396
• fix(detect): expand copilot harness markers to file-based signals (#1435) by @sergio-sisternes-epam in #1440
• fix(audit): pre-create target dirs in drift replay scratch (#1411) by @sergio-sisternes-epam in #1441
• fix(install): persist --skill filter to apm.yml (#1395) by @sergio-sisternes-epam in #1442
• fix(vscode): handle v0.1 runtimeArguments with variables for Docker MCP (#1391) by @sergio-sisternes-epam in #1444
• fix(plugin): prevent _map_plugin_artifacts from destroying pre-positioned .apm/ content by @abi-jey in #1416
• fix(applyTo): fold #1387 panel follow-ups (docs + DRY + YAML escape) by @danielmeppiel in #1449
• feat(batch-bug-shepherd): operator visibility + fold-in invariant by @danielmeppiel in #1451
• fix(mcp): honour per-dep registry URL during install (#1393) by @sergio-sisternes-epam in #1443
• chore: release v0.14.2 by @danielmeppiel in #1454
• fix(ci): repair Windows-only unit test failures after v0.14.2 by @danielmeppiel in #1455
• fix(cache): apply core.longpaths to post-clone git ops on Windows by @danielmeppiel in #1456
• test(integration): unstick 23 stale tests that drift from production code by @danielmeppiel in #1457

New Contributors

• @Alpha200 made their first contribution in #1303
• @masaishi made their first contribution in #1262

Full Changelog: v0.14.1...v0.14.2

v0.14.1

What's Changed

🔧 Other Changes

• docs(producer): add zava-agent-config as live golden-path reference by @danielmeppiel in #1384
• fix(deps): honor SSH user from dependency URL (closes #1383) by @danielmeppiel in #1385
• docs(changelog): add #1383 SSH user fix entry by @danielmeppiel in #1386
• fix(install): survive AppLocker/WDAC by staging release before binary test (#1389) by @danielmeppiel in #1390
• fix(ci): wire coverage observability into CI pipelines (Phase 1) by @sergio-sisternes-epam in #1404
• fix(install): detect Windows Defender AV block and emit specific guidance by @danielmeppiel in #1408
• feat(experimental): copilot-app target deploys scheduled prompts to App DB by @danielmeppiel in #1405
• chore(release): v0.14.1 by @danielmeppiel in #1410
• fix(uninstall): accept Windows absolute paths as local packages (re-tag v0.14.1) by @danielmeppiel in #1413

Full Changelog: v0.14.0...v0.14.1

v0.14.0

What's Changed

🔧 Other Changes

• docs: full rewrite -- persona-led ramps + 3-promise narrative by @danielmeppiel in #1252
• docs: fix all redirect destinations to include /apm base path by @danielmeppiel in #1284
• fix: marketplace install auth host on *.ghe.com (closes #1285) by @edenfunf in #1292
• fix(ci): use audit-only pattern to prevent install overwriting tamper (closes #1202) by @sergio-sisternes-epam in #1291
• fix(policy): layer dependencies.require through extends: org (closes #1201) by @sergio-sisternes-epam in #1290
• fix: warn when apm.yml is missing but APM artifacts exist (closes #1056) by @sergio-sisternes-epam in #1255
• fix(build): keep Click command docstrings in release binaries by @edenfunf in #1307
• fix(audit): drift check skip-with-info on cache miss (closes #1200) by @sergio-sisternes-epam in #1289
• feat(install): air-gapped / GHE env vars for install.ps1 by @abhinavgautam01 in #1246
• test(integration): regression trap for *.ghe.com marketplace auth routing (closes #1304) by @edenfunf in #1312
• feat(marketplace): support multi-profile marketplace outputs by @henrydennis in #1281
• fix: apm install no longer permanently blocked by policy after lockfile wipe (required-packages-deployed catch-22) by @danielmeppiel in #1313
• fix: preserve Claude stdio MCP env by @imk1t in #1224
• feat(marketplace): filter-driven CLI, map-based manifest, JSON output by @danielmeppiel in #1324
• fix(policy): inherit parent unmanaged_files when child omits block by @abhinavgautam01 in #1248
• refactor(integration): extract MCPIntegrator.install by @abhinavgautam01 in #1245
• fix: hint to host-qualify cross-repo on *.ghe.com (closes #1305) by @edenfunf in #1319
• fix(adapters): route Gemini config through project_root and user_scope by @edenfunf in #1306
• chore: add pylint R0801 duplicate code guardrail (Phase 0) by @sergio-sisternes-epam in #1320
• fix(registry): migrate SimpleRegistryClient to MCP Registry v0.1 spec (#1210) by @danielmeppiel in #1337
• fix: respect targets: whitelist for all runtimes during MCP install by @danielmeppiel in #1336
• feat(pack,doctor,init): vendor-neutral producer first-run UX by @danielmeppiel in #1362
• fix: stop writing _apm_source into Claude settings.json by @sergio-sisternes-epam in #1359
• fix: skip direct GitHub API validation when PROXY_REGISTRY_ONLY is set by @sergio-sisternes-epam in #1357
• fix: propagate target to intermediate CompilationConfig in single-file path by @sergio-sisternes-epam in #1355
• fix: resolve hook paths to absolute in settings.json for --target claude by @sergio-sisternes-epam in #1354
• refactor: eliminate duplicate code blocks (phases 1-3) by @sergio-sisternes-epam in #1360
• feat(pack): add --check-versions and --check-clean release gates by @danielmeppiel in #1365
• fix: add --target flag to apm update command by @sergio-sisternes-epam in #1358
• fix(compile): forward target to watch-mode recompile (closes #1345) by @danielmeppiel in #1349
• feat: support marketplace notation in apm uninstall by @sergio-sisternes-epam in #1325
• fix: prefer APM-managed runtimes over system PATH and warn on codex/GitHub Models incompatibility by @sergio-sisternes-epam in #1356
• feat(cli): introduce apm plugin init noun-verb surface by @danielmeppiel in #1370
• Fix shared/apm.md matrix secret-stripping; add empirical verify workflow by @danielmeppiel in #1373
• perf(resolver): tiered git ref resolver collapses redundant clones (#1369) by @danielmeppiel in #1376
• fix: allow tilde in repository path components for Bitbucket DC personal repos (#1375) by @danielmeppiel in #1377
• test(windows): make path assertions and chmod tests OS-aware by @danielmeppiel in #1378
• chore: cut 0.14.0 by @danielmeppiel in #1372

New Contributors

• @abhinavgautam01 made their first contribution in #1246
• @henrydennis made their first contribution in #1281
• @imk1t made their first contribution in #1224

Full Changelog: v0.13.0...v0.14.0

v0.13.0

What's Changed

📖 Documentation

• [docs] Update documentation for features from 2026-05-08 by @danielmeppiel in #1205
• [docs] Update documentation for features from 2026-05-09 by @danielmeppiel in #1219

🔧 Other Changes

• chore(aw): bump microsoft/apm-action v1.7.1 -> v1.7.2 by @danielmeppiel in #1183
• feat(shared/apm.md): expose target input for slim per-harness bundles by @danielmeppiel in #1184
• fix(shared/apm.md): drop || 'all' fallback so gh-aw substitutes target (#1185) by @danielmeppiel in #1186
• fix(install,test): exclude cowork from --target all + stabilize defer-start timer test by @danielmeppiel in #1191
• ci(panels): pin target=copilot for pr-review-panel and triage-panel by @danielmeppiel in #1192
• fix(triage-panel): paginate scheduled sweep oldest-first via MCP by @danielmeppiel in #1193
• fix(triage-panel): use search_issues with -label:status/triaged for sweep by @danielmeppiel in #1194
• fix(install): accept YAML list form under singular target: key (#1188) by @danielmeppiel in #1197
• [cli-consistency] Fix CLI/docs inconsistencies from 2026-05-06 consistency report by @Copilot in #1174
• [Test Improver] tests(deps): add unit tests for deps CLI helper functions by @danielmeppiel in #1155
• support virtual packages on generic git hosts (Gitea) by @ganesanviji in #587
• fix(install): wire ADO --update preflight through PAT->bearer fallback (#1212) by @danielmeppiel in #1214
• fix(cli): add missing help text to outdated command by @danielmeppiel in #1216
• fix(errors): hide agent-skills meta-target from unknown-target suggestions (#1208) by @danielmeppiel in #1215
• fix: target-agnostic local-bundle install (#1207) by @danielmeppiel in #1217
• Add gh auth token fallback before git credential fill by @awakecoding in #630
• refactor(deps): introduce HostBackend Protocol + extract stamp_plugin_version by @danielmeppiel in #1223
• fix(auth): per-URL credential disambiguation + gh-cli short-circuit regression trap by @danielmeppiel in #1226
• fix: pass scope-resolved lockfile path to MCPIntegrator.update_lockfile at --global scope by @sergio-sisternes-epam in #1236
• fix: align direct install HTTPS validation with manifest-driven credential handling by @sergio-sisternes-epam in #1242
• fix: normalise default-scheme ports (443/80/22) on DependencyReference / HostInfo by @sergio-sisternes-epam in #1237
• fix: hide experimental cowork config key and fix verbose target log by @sergio-sisternes-epam in #1241
• Reject unsupported flat-format dependencies with actionable error by @sergio-sisternes-epam in #1189
• feat(install): add GitLab marketplace host support by @slava-kudzinau in #1149
• refactor(tests): marker-driven integration discovery (PR1 of #1166) by @danielmeppiel in #1167
• refactor(tests): retire script enumeration; pytest discovers tests/integration/ by @danielmeppiel in #1247
• docs(tests): codify integration-test marker procedure as APM instructions primitive by @danielmeppiel in #1249
• ci(smoke): replace runtime-binary smoke with README-promise smoke by @danielmeppiel in #1251
• Add 'apm update' command and '--frozen' install flag (closes #1203) by @danielmeppiel in #1244
• fix(install,tests): repair 63 integration tests in merge queue by @danielmeppiel in #1257
• fix(tests): repair 2 integration tests that surfaced post-#1257 by @danielmeppiel in #1261
• fix: add threading.Lock to _fallback_port_warned dedup set by @sergio-sisternes-epam in #1238
• fix: harden _is_github_server host validation to require hostname match by @sergio-sisternes-epam in #1239
• fix: emit Cursor-native MCP schema (type: stdio) instead of Copilot schema by @sergio-sisternes-epam in #1240
• perf(ci): shard + parallelize integration tests for ~5x speedup by @danielmeppiel in #1263
• fix(deps): fetch missing SHA-pinned commits into shallow bare clones by @sergio-sisternes-epam in #1259
• fix: accept full ADO https:// URLs with sub-paths (closes #1128) by @sergio-sisternes-epam in #1254
• fix: policy inheritance preserves parent unmanaged_files when child omits block (closes #1198) by @sergio-sisternes-epam in #1253
• fix(tests): mock search_servers fallback in registry-client UUID-not-found test by @danielmeppiel in #1264
• fix: apm install no longer adopts files not produced by installed plugins (closes #1199) by @sergio-sisternes-epam in #1256
• chore(release): v0.13.0 by @danielmeppiel in #1269
• fix(tests): hermetic HOME for unit tests on Windows runner by @danielmeppiel in #1270
• fix(deps): use --git-dir for bare repos + pin fetched SHAs as refs (#1267) by @sergio-sisternes-epam in #1268
• fix(tests): set hermetic HOME at conftest import time for Windows xdist workers by @danielmeppiel in #1271
• fix(tests): override Path.home() in root conftest so Windows xdist gw2 cannot crash by @danielmeppiel in #1272
• test(integration): retry transient MCP registry outages in mcp show/search by @danielmeppiel in #1274
• fix(tests): wrap Path.expanduser() to never raise on Windows runner by @danielmeppiel in #1276

New Contributors

• @ganesanviji made their first contribution in #587
• @awakecoding made their first contribution in #630
• @slava-kudzinau made their first contribution in #1149

Full Changelog: v0.12.4...v0.13.0

v0.12.4

What's Changed

🔧 Other Changes

• chore: release v0.12.4 (apm-action v1.7.1 bump + audit-replay fix #1182) by @danielmeppiel in #1181

Full Changelog: v0.12.3...v0.12.4

v0.12.3

What's Changed

🔧 Other Changes

• fix(install): branch-ref drift no longer ships 3-way-inconsistent lockfile by @danielmeppiel in #1158
• fix(install): rewrite in-package relative links to apm_modules/ paths (#1147) by @danielmeppiel in #1160
• fix(policy): close audit --ci silent governance bypass + SCP/ADO URL parsing (#1159) by @danielmeppiel in #1164
• fix(targets): explicit, auditable target resolution (closes #1154) by @danielmeppiel in #1165
• fix: exclude .apm-pin from skill deploy copytree by @tillig in #1153
• fix(copilot): translate env-var placeholders instead of baking secrets to disk (#1152) by @danielmeppiel in #1169
• chore(release): v0.12.3 by @danielmeppiel in #1170
• test(integration): pass --target copilot to apm init --yes by @danielmeppiel in #1171
• fix(install): orphan cleanup runs when apm.yml is emptied + diff-aware test fixes by @danielmeppiel in #1173
• fix(install): restore static-target deploy path; tighten test fixtures for #1154 strict harness detection by @danielmeppiel in #1176
• test: fix v0.12.3 CI failures on Windows + macOS by @danielmeppiel in #1179
• test(release-validation): pass --target copilot to apm init on Windows by @danielmeppiel in #1180

Full Changelog: v0.12.2...v0.12.3

v0.12.2

What's Changed

🔧 Other Changes

• docs: clarify APM's role for skills, unify plugins-as-packages, add ADO sub-path examples, state stability by @danielmeppiel in #1127
• docs: fix first-package guide (includes: auto explained, correct skill paths) by @danielmeppiel in #1129
• fix(deps): subdir-agnostic bare cache fixes parallel sparse-checkout race (#1126) by @danielmeppiel in #1135
• feat(audit): default-on integration drift detection by @danielmeppiel in #1137
• chore(release): v0.12.2 by @danielmeppiel in #1141
• fix(install): exclude .apm-pin marker from package content hash (unblocks v0.12.2 release) by @danielmeppiel in #1142

Full Changelog: v0.12.1...v0.12.2

v0.12.1

What's Changed

🔧 Other Changes

• feat(cursor): add slash command support for Cursor 1.6+ by @stbenjam in #1046
• ci(gh-aw): bump apm-action v1.5.0 -> v1.6.0 for plugin-bundle defenses by @danielmeppiel in #1121
• fix: explicit UTF-8 encoding in test _make_package helper to unblock Windows CI by @Copilot in #1124
• perf+ux: comprehensive overhaul of apm install (cache, parallel BFS, UX) by @danielmeppiel in #1116
• fix(tests): make cache-lockfile-parity test resilient to leftover deploy artifacts and timestamp drift by @danielmeppiel in #1125

Full Changelog: v0.12.0...v0.12.1

v0.12.0

What's Changed

📖 Documentation

• [docs] Update documentation for features from 2026-04-29 by @danielmeppiel in #1037
• [docs] Update documentation for features from 2026-04-28 by @danielmeppiel in #1016
• [docs] Update documentation for features from 2026-03-26 by @danielmeppiel in #461

🔧 Other Changes

• fix(policy): fail closed on malformed manifest YAML by @sergio-sisternes-epam in #1053
• fix(install): map APM prompt 'input' to Claude 'arguments' front-matter by @stbenjam in #1039
• docs(contributing): teach authors to run apm-review-panel + pr-description-skill locally by @danielmeppiel in #1057
• fix(install): handle bare-string MCP entry in shell-metachar warning by @edenfunf in #951
• fix: correct Claude settings.json hook emission (#1007) by @sergio-sisternes-epam in #1054
• fix(compile): stabilize BUILD_ID in all compiled outputs by @edenfunf in #959
• refactor: split marketplace commands into package modules by @shreejaykurhade in #1024
• feat: add Ruff code quality guardrails (replaces black + isort) by @sergio-sisternes-epam in #999
• fix: respect CLAUDE_CONFIG_DIR for claude target user-scope deploy by @shuntaka9576 in #1055
• chore(compile): tighten link_resolver._resolve_path input guards by @mvanhorn in #991
• [fix] translate bare ${VAR} env-var refs in self-defined MCP server headers (#944) by @edenfunf in #947
• fix: address Copilot review findings on #1055 and #991 (consolidated) by @danielmeppiel in #1065
• feat(marketplace): harden apm pack output (#1061) by @danielmeppiel in #1063
• fix(install): allow local packages at --global scope; fix broken tests by @stbenjam in #937
• fix: extend explicit UTF-8 encoding to 5 remaining open() call sites by @danielmeppiel in #1068
• fix(compile): emit and clean up copilot root instructions (#792) by @danielmeppiel in #1067
• [Test Improver] test: add unit tests for install/mcp_warnings.py (0% -> ~100%) by @danielmeppiel in #828
• docs(notice): rename NOTICE.md -> NOTICE; add CLA third-party section by @danielmeppiel in #1073
• perf(compile): cache file walk and fix placement for narrow patterns by @Roozi489 in #871
• Don't flag parent dirs of subdirectory packages as orphaned by @tillig in #1052
• test(windows): fix CLAUDE_CONFIG_DIR scope tests on Windows by @danielmeppiel in #1086
• fix(marketplace): enhance repository input parsing for GitLab subgroups and HTTPS URLs by @Antonin-Rouxel-LaPoste-BGPN in #1034
• Stop rendering CLAUDE.md dependencies that don't exist by @tillig in #1048
• fix(install): align validation auth chain with install by @a1icja in #941
• docs(authors): show maintainer affiliations and link contributor graph by @danielmeppiel in #1090
• fix: remove Codex-only user-visible hint on opt-in miss (vendor-neutrality) by @Copilot in #1083
• fix(install): allow credential helpers in --update preflight for generic hosts by @tillig in #1084
• refactor(panel): rebuild apm-review-panel as advisory, scannable, and self-healing by @danielmeppiel in #1093
• feat(install): apm install + lockfile-embedded plugin packs (#1098) by @danielmeppiel in #1099
• fix(deps): support meta-packages and apm.yml inside collections/ subpaths by @edenfunf in #1097
• refactor(panel): add tier axis to test-coverage evidence by @danielmeppiel in #1102
• feat: add Claude Code as MCP install target (closes #643, supersedes #655) by @danielmeppiel in #1104
• fix(marketplace): resolve source.repo vs source.repository key mismatch (#1105) by @sergio-sisternes-epam in #1106
• feat(install): add --target agent-skills for cross-client .agents/skills/ deployment by @danielmeppiel in #1103
• fix(install): unmask exception handlers + Windows CRLF in local-bundle tests by @danielmeppiel in #1108
• fix(compile): include global instructions in AGENTS.md and CLAUDE.md by @edenfunf in #1088
• fix(tests): use urlparse for host assertions (CodeQL #88-#91) by @danielmeppiel in #1109
• chore(docs): upgrade Astro 5.18.1 -> 6.2.1 by @danielmeppiel in #1110
• Feature/windsurf target by @yoelabril in #1066
• fix(install): anchor transitive local_path deps on declaring package (#857) by @danielmeppiel in #1111
• chore(release): cut 0.12.0 by @danielmeppiel in #1112

New Contributors

• @shuntaka9576 made their first contribution in #1055
• @Antonin-Rouxel-LaPoste-BGPN made their first contribution in #1034
• @a1icja made their first contribution in #941
• @yoelabril made their first contribution in #1066

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

🐛 Bug Fixes

• fix(install): ADO Entra ID auth path + --update pre-flight abort (#1015) by @danielmeppiel in #1031

🔧 Other Changes

• fix(policy): unify --policy / --policy-source forms across CLI help and docs by @edenfunf in #1000
• fix: rename token variable to resolve CodeQL clear-text-storage alert by @Copilot in #1002
• fix: remove stray "specify" from generated file footer by @stbenjam in #996
• refactor: complexity audit -- eliminate god-method forks, O(n^2) loops, redundant I/O by @sergio-sisternes-epam in #918
• fix: use POSIX paths in auto-discovery CLI output for Windows compat by @sergio-sisternes-epam in #1018
• fix: marketplace build respects GITHUB_HOST for GHE repos by @sergio-sisternes-epam in #1009
• fix(targets): validate apm.yml target: at parse time, share normalization with CLI (closes #820) by @edenfunf in #987
• refactor(review-panel): true fan-out + binary verdict + label automation by @danielmeppiel in #1022
• feat(shared/apm): apps[] + matrix fan-out for multi-org App auth by @danielmeppiel in #982
• Devcontainer feature by @coakenfold in #861
• fix(shared/apm): drop stale STATUS banner; recompile lock files to v1.5.0 by @danielmeppiel in #1026
• fix(workflows): skip-don't-fail panel label gate; bump gh-aw v0.68.3 -> v0.71.1 by @danielmeppiel in #1030
• fix(marketplace): add honors manifest.name for Claude Code parity by @danielmeppiel in #1032
• fix(shared/apm): repair gh-aw [a b] import-input serialization that breaks apm-prep by @danielmeppiel in #1033
• feat(codex): add project-scoped MCP and user target support by @Nickolaus in #803
• feat(marketplace): fold marketplace.yml into apm.yml's 'marketplace:' block (closes #722, implements #1036) by @danielmeppiel in #1038
• Fix #1019: Improve compile target specification by @tillig in #1020
• chore: add NOTICE file for third-party components by @danielmeppiel in #1043
• chore(notices): automate NOTICE.md generation + CI drift gate by @danielmeppiel in #1045
• feat(pack): unify 'apm pack' to produce bundle and marketplace.json (closes #722) by @danielmeppiel in #1042
• fix(shared/apm): re-shape single-artifact download to expected layout by @danielmeppiel in #1051
• chore(release): cut 0.11.0 by @danielmeppiel in #1049

New Contributors

• @Nickolaus made their first contribution in #803

Full Changelog: v0.10.0...v0.11.0