v0.9.1

What's Changed

🔧 Other Changes

• ci(docs): deploy site only on stable APM releases by @Copilot in #822
• chore: dogfood APM by migrating primitives from .github/ to .apm/ by @danielmeppiel in #823
• feat(workflows): automate apm-review-panel via github/gh-aw by @danielmeppiel in #824
• fix(workflows): allow fork PRs in pr-review-panel by @danielmeppiel in #826
• fix(panel-workflow): only fire on label, add dispatch path for fork PRs by @danielmeppiel in #836
• fix(panel-workflow): use pull_request_target so labelled fork PRs run by @danielmeppiel in #837
• feat(policy): enforce apm-policy.yml at install time by @danielmeppiel in #832
• chore: prepare v0.9.1 release by @danielmeppiel in #838

Full Changelog: v0.9.0...v0.9.1

v0.9.0

What's Changed

🚀 New Features

• feat(install): add --mcp flag for declaratively adding MCP servers to apm.yml by @danielmeppiel in #810
• feat(validation): reject shell-string command in MCP stdio entries by @danielmeppiel in #809

🔧 Other Changes

• docs(instrumentation): APM Review Panel - 7-agent expert review for non-trivial changes by @danielmeppiel in #777
• fix: preserve protocol (e.g. ssh:// or https://) and port in dependency URL by @edenfunf in #665
• feat(transport): TransportSelector + strict-by-default transport (#778) by @danielmeppiel in #779
• fix(install): MARKETPLACE_PLUGIN beats HOOK_PACKAGE in detection cascade (#780) by @danielmeppiel in #781
• feat: marketplace UX, security hardening, and lockfile provenance (#514) by @sergio-sisternes-epam in #677
• fix: detect port-like segment in SCP shorthand and suggest ssh:// form by @edenfunf in #787
• feat: allow multiple targets in apm.yml and --target CLI flag by @sergio-sisternes-epam in #628
• fix: VS Code adapter fails to configure HTTP/SSE remote MCP servers (#654) by @sergio-sisternes-epam in #656
• Fix apm install --global skipping MCP server installation by @sergio-sisternes-epam in #638
• fix(auth): thread dep_ref.port into credential resolution (#785) by @edenfunf in #788
• fix(install): warn when --allow-protocol-fallback reuses a custom port across schemes (#786) by @edenfunf in #789
• [Test Improver] test: add unit tests for MCPIntegrator (0% -> ~75%) by @danielmeppiel in #632
• [Test Improver] test: add unit tests for drift-detection helpers (0% -> ~100%) by @danielmeppiel in #727
• [Test Improver] test: expand coverage for update command (64% -> ~95%) by @danielmeppiel in #657
• [Test Improver] test: add unit tests for uninstall engine helpers by @danielmeppiel in #795
• [Test Improver] test: add unit tests for BaseIntegrator shared infrastructure (69 tests) by @danielmeppiel in #618
• feat: Add build-time policy to disable self-update in packaged builds by @melund in #675
• fix(init): remove triple confirm prompt on Windows CP950 terminals (#602) by @sergio-sisternes-epam in #647
• fix(init): reframe Next Steps panel around install workflows (#603) by @sergio-sisternes-epam in #649
• feat: support allow-insecure HTTP dependencies by @arika0093 in #700

New Contributors

• @melund made their first contribution in #675
• @arika0093 made their first contribution in #700

Full Changelog: v0.8.12...v0.9.0

v0.8.12

What's Changed

🚀 New Features

• ci: adopt GitHub Merge Queue with tiered CI (#770) by @danielmeppiel in #771

🔧 Other Changes

• chore: add @sergio-sisternes-epam as maintainer by @danielmeppiel in #623
• feat: add apm info, apm outdated, and list_remote_refs by @sergio-sisternes-epam in #613
• feat: proxy-aware marketplace indexes by @chkp-roniz in #617
• fix: propagate headers through OpenCode MCP adapter by @alopezsanchez in #622
• feat: support project-local .apm/ content during apm install by @sergio-sisternes-epam in #644
• fix(runtime): pin codex setup to rust-v0.118.0 for security by @sergio-sisternes-epam in #663
• fix: rewrite Windows backslash paths in hook commands by @danielmeppiel in #609
• [fix] include dependency instructions in claude compile (#631) by @edenfunf in #642
• Enable SSH timeout to fallback to HTTP. by @tillig in #653
• fix: add encoding="utf-8" to prompt file open() calls in script_runner (Windows CP950) by @edenfunf in #607
• Fix: apm marketplace add silently fails for private repos by @sergio-sisternes-epam in #701
• fix(hooks): make apm install idempotent for hook entries by @srid in #709
• [fix] suppress internal config keys from apm config get output (#564) by @edenfunf in #571
• fix: use yaml.safe_dump for virtual package apm.yml generation by @edenfunf in #707
• feat: add configurable temp directory to resolve Windows access denied errors by @sergio-sisternes-epam in #629
• fix: enhance git remote validation by trying SSH URLs for generic hosts by @zzoubian in #584
• fix(auth): provide ADO-specific authentication error message for dev.… by @coakenfold in #742
• fix: strip skills prefix from bare skill plugin export by @zeel2104 in #738
• fix: deploy root project .apm/ primitives without a sub-package stub by @edenfunf in #715
• [fix] support codeload github archive urls for artifactory (#710) by @edenfunf in #712
• Add 55 tests for deps/_utils.py and view.py coverage by @Copilot in #682
• fix(deps): align _count_package_files to use .apm/context/ (singular) dir by @edenfunf in #748
• test(marketplace): isolate test_auto_detect_through_proxy from real network by @danielmeppiel in #759
• harden(plugin): enforce plugin-root containment for manifest paths by @danielmeppiel in #760
• fix(install): clean up stale deployed files on rename/remove within a package (#666) by @Boubalou in #750
• fix(install): harden stale-file cleanup with per-file content-hash provenance (#666 follow-up) by @danielmeppiel in #762
• refactor(install): modularize install.py into engine package by @danielmeppiel in #764
• test(integration): close install/uninstall/update CLI coverage gaps surfaced by #764 review by @danielmeppiel in #767
• fix: create target dir for explicit --target claude; content hash fallback when .git absent by @Copilot in #763
• fix: validate project name to reject path separators in apm init by @edenfunf in #724
• fix: prevent duplicate Test Improver monthly activity issues by @sergio-sisternes-epam in #681
• Add .editorconfig to standardize formatting across contributions by @Copilot in #671
• fix: _parse_artifactory_base_url() ignores PROXY_REGISTRY_URL — lockfile reinstall fails (#614) by @chkp-roniz in #616
• fix: route --target codex/opencode through AGENTS.md compiler (#766) by @edenfunf in #769
• chore: prepare v0.8.12 release by @danielmeppiel in #774

New Contributors

• @tillig made their first contribution in #653
• @srid made their first contribution in #709
• @zzoubian made their first contribution in #584
• @coakenfold made their first contribution in #742
• @zeel2104 made their first contribution in #738
• @Boubalou made their first contribution in #750

Full Changelog: v0.8.11...v0.8.12

v0.8.11

What's Changed

🔧 Other Changes

• [fix] warn when two packages deploy a native skill with the same name by @edenfunf in #545
• [fix] detect remote default branch instead of hardcoding main (#573) by @edenfunf in #574
• refactor: unify integration dispatch, result types, and hook dedup by @danielmeppiel in #562
• feat: Artifactory archive entry download for virtual file packages by @chkp-roniz in #525
• Fix: compilation.exclude does not filter primitive discovery by @Copilot in #477
• fix: respect GITHUB_HOST in marketplace add command by @edenfunf in #589
• fix: use nested Join-Path for PowerShell 5.1 compatibility by @edenfunf in #593
• fix: subprocess encoding failures on Windows non-UTF-8 consoles (CP950/CP936) by @edenfunf in #591
• fix: use scope-resolved target dir for hook deployment by @sergio-sisternes-epam in #566
• fix: enforce symlink containment in file discovery and resolution by @danielmeppiel in #596
• [fix] script_runner: anchor runtime detection patterns to prevent false positives by @edenfunf in #563
• fix: warn when instruction is missing required fields during apm compile by @alopezsanchez in #449
• chore: prepare v0.8.11 release by @danielmeppiel in #598

New Contributors

• @edenfunf made their first contribution in #545
• @alopezsanchez made their first contribution in #449

Full Changelog: v0.8.10...v0.8.11

v0.8.10

What's Changed

🐛 Bug Fixes

• fix: process windows hook key for script copying and path rewriting by @Copilot in #521

🔧 Other Changes

• docs: add marketplace highlight and example to README by @danielmeppiel in #513
• Add agent-guide: teach AI agents how to use APM by @cabird in #516
• docs: add agentrc ecosystem section to README by @danielmeppiel in #509
• Deploy instructions to .claude/rules/ for Claude Code by @Copilot in #527
• [Test Improver] test: add unit tests for deps list, tree, and info subcommands by @danielmeppiel in #532
• [Test Improver] test: add unit tests for mcp command (0% -> ~85%) by @danielmeppiel in #480
• [Test Improver] test: expand unit tests for list command (42% -> 100%) by @danielmeppiel in #444
• fix: scope-resolved target profiles + Claude Code instructions by @danielmeppiel in #542
• fix: address post-merge review on #542 by @danielmeppiel in #547
• fix: respect update_refs in download_callback and skip logic (#548) by @sergio-sisternes-epam in #550
• fix: CLI consistency — missing targets, Unicode violations, undocumented flags by @Copilot in #543
• chore: consolidate CHANGELOG entries to 1 line per PR by @danielmeppiel in #555
• chore: bump version to 0.8.10 by @danielmeppiel in #560

New Contributors

• @cabird made their first contribution in #516

Full Changelog: v0.8.9...v0.8.10

v0.8.9

What's Changed

🔧 Other Changes

• fix: respect metadata.pluginRoot + prepare v0.8.9 hotfix by @danielmeppiel in #512

Full Changelog: v0.8.8...v0.8.9

v0.8.8

What's Changed

🚀 New Features

• feat: Marketplace integration -- read marketplace.json for plugin discovery + governance by @Copilot in #503
• feat: add --global / -g flag for scoped package installation by @Copilot in #452
• feat: Support Codex CLI as integration target by @Copilot in #504

🔧 Other Changes

• feat: lockfile-driven reproducible installs for registry proxies by @chkp-roniz in #401
• perf: apm deps update skip download when resolved SHA matches lockfile by @Copilot in #500
• docs: fix orphan pages and update stale rulesets content by @danielmeppiel in #505
• docs: add Marketplaces guide to sidebar navigation by @danielmeppiel in #507
• chore: prepare v0.8.8 release by @danielmeppiel in #508
• fix: CI test assertions for Rich line-wrapping and scope output by @danielmeppiel in #510

Full Changelog: v0.8.7...v0.8.8

v0.8.7

What's Changed

🔧 Other Changes

• fix: apm deps update was a no-op -- delegate to install engine by @danielmeppiel in #493
• fix: mitigate Windows Defender false positive on APM binary by @sergio-sisternes-epam in #490
• DX: Improve auth error messages, sparse checkout token consistency, and error deduplication by @Copilot in #478
• Data-driven integration dispatch: replace if-chain with target × primitive loop by @Copilot in #494
• chore: bump to v0.8.7 by @danielmeppiel in #497

Full Changelog: v0.8.6...v0.8.7

v0.8.6

What's Changed

🔧 Other Changes

• fix: batch bug fixes -- installer fallback, target registry, lockfile idempotency by @danielmeppiel in #456
• Fix Windows antivirus file-lock errors during apm install by @Copilot in #440
• fix: allow spaces in ADO repository names when parsing URLs by @PremKumarML in #437
• fix: gate .claude/commands/ deployment behind integrate_claude flag by @neop26 in #443
• fix: reject path traversal in SSH URL parsing by @thakoreh in #458
• fix: exclude bundled OpenSSL libs from Linux binary by @danielmeppiel in #466
• fix: sort instruction discovery order for deterministic Build IDs across platforms by @Coolomina in #468
• fix: share AuthResolver across install to prevent duplicate auth popups by @frblondin in #424
• chore: bump to v0.8.6 by @danielmeppiel in #474

New Contributors

• @PremKumarML made their first contribution in #437
• @neop26 made their first contribution in #443
• @thakoreh made their first contribution in #458
• @Coolomina made their first contribution in #468
• @frblondin made their first contribution in #424

Full Changelog: v0.8.5...v0.8.6

v0.8.5

What's Changed

📖 Documentation

• [docs] Update documentation for features from 2026-03-23 by @danielmeppiel in #416

🔧 Other Changes

• [Test Improver] test: add unit tests for AgentsCompiler (65%→82% coverage) by @danielmeppiel in #221
• [Test Improver] Add unit tests for commands/_helpers.py I/O and config helpers by @danielmeppiel in #333
• [Test Improver] test: add unit tests for utils/console.py (58% → 90%) by @danielmeppiel in #351
• [Test Improver] test: add unit tests for RuntimeManager and runtime CLI commands (20%→92%, 49%→90%) by @danielmeppiel in #380
• [Test Improver] test: replace gc.collect+sleep teardown with shutil.rmtree(ignore_errors=True) by @danielmeppiel in #395
• [Test Improver] test: add unit tests for constitution_block and ConstitutionInjector (53%→93%, 44%→95%) by @danielmeppiel in #402
• Add Copilot encoding instructions banning non-ASCII/emoji characters by @Copilot in #282
• [Test Improver] test: add unit tests for config command (22% → 100%) + fix missing functions by @danielmeppiel in #366
• perf(ci): comprehensive pipeline optimization by @Copilot in #407
• fix: CLI consistency improvements (target aliases, deps clean flags, verbose shorthand, help text) by @Copilot in #303
• fix: Windows test failures in config command and agents compiler by @danielmeppiel in #410
• fix: resolve both sides of relative_to() for Windows 8.3 path compat by @danielmeppiel in #411
• fix: show auth diagnostics in --verbose for virtual package validation by @danielmeppiel in #414
• fix: enforce ARTIFACTORY_ONLY for virtual package types by @chkp-roniz in #418
• fix: remove WIP folder from tracking and strengthen gitignore by @danielmeppiel in #420
• [Test Improver] test: add unit tests for prune command (14% -> 91%) by @danielmeppiel in #415
• fix: cross-target path mapping for skills/agents in apm pack by @Copilot in #426
• fix: Configure SSL certificates in PyInstaller binary via runtime hook by @Copilot in #429
• feat(policy): Phase 1 — org-level policy engine for apm audit --ci by @danielmeppiel in #365
• fix: centralize YAML I/O with UTF-8 encoding for cross-platform safety by @danielmeppiel in #433
• fix: Systematic Windows path compatibility hardening by @Copilot in #422
• fix: improve local path validation error messages by @danielmeppiel in #431
• fix: recognize Windows drive-letter absolute paths as local paths in DependencyReference by @Copilot in #435
• chore: bump to v0.8.5 by @danielmeppiel in #439

Full Changelog: v0.8.4...v0.8.5