v0.16.0

What's Changed

🔧 Other Changes

• feat(policy): require_pinned_constraint to ban unbounded dep ranges by @danielmeppiel in #1494
• test(policy): e2e integration tests for require_pinned_constraint (follow-up to #1494) by @danielmeppiel in #1505
• feat(deps): add 'apm deps why ' to explain transitive dependencies by @danielmeppiel in #1495
• fix(policy): classify '=1.2.3' explicit-equality as pinned constraint by @danielmeppiel in #1506
• feat(deps): resolve semver ranges on git-source dependencies by @danielmeppiel in #1496
• chore: remove stale plan.md from repo root by @danielmeppiel in #1510
• fix(artifactory): deterministic boundary probe for nested GitLab paths by @chkp-roniz in #1472
• fix(install): repair -g hook integration across claude/cursor/copilot (closes #1499) by @danielmeppiel in #1516
• fix(install): honor SSH scheme for GitLab refs in validation (closes #1501) by @danielmeppiel in #1515
• fix(compile): honor compilation.strategy=single-file for CLAUDE.md (closes #1445) by @danielmeppiel in #1514
• fix(opencode): validate-and-warn on incompatible agent frontmatter at install (Phase 1 of #581) by @danielmeppiel in #1513
• fix(install): use %LOCALAPPDATA% literal in Windows shim (closes #1509) by @danielmeppiel in #1512
• docs: backfill apm-usage and consolidate registry guides (v0.14->v0.15 drift sweep) by @danielmeppiel in #1511
• Fix/windsurf uninstall skills cleanup by @yoelabril in #1486
• docs(skills): correct outdated windsurf-convergence status, link #1520 by @danielmeppiel in #1521
• feat(batch-bug-shepherd): recommendation-fold loop + Copilot+CI gates + mergeability table by @danielmeppiel in #1518
• fix(install): write apm.cmd shim as ASCII (cmd.exe cannot parse UTF-16LE) by @danielmeppiel in #1522
• fix(install): strip non-ASCII bytes from install.ps1 (unblocks self-update on cp1252 consoles) by @danielmeppiel in #1523
• spec: introduce OpenAPM v0.1 (closes #1502) by @danielmeppiel in #1517
• chore: release v0.16.0 by @danielmeppiel in #1526

Full Changelog: v0.15.0...v0.16.0

v0.15.0

What's Changed

🔧 Other Changes

• fix: handle MCP v0.1 runtimeArguments.variables in copilot and codex adapters by @sergio-sisternes-epam in #1461
• perf(scaling-guards): add variant-key and cache-lookup guards, wire to CI integration gate by @sergio-sisternes-epam in #1439
• fix(triage-panel): add DIFC read-integrity exemption for external issues by @sergio-sisternes-epam in #1462
• fix: resolve 3 flaky integration tests blocking merge queue by @sergio-sisternes-epam in #1477
• fix(install): honour spec drift in BFS resolve callback by @sergio-sisternes-epam in #1473
• fix(mcp): rewrite skill-shipped MCP command paths for the Claude target by @srid in #1465
• feat(marketplace): support local paths, file:// URIs, and generic git hosts by @sergio-sisternes-epam in #1476
• fix: add support for custom github endpoints (host.tld/owner/repo) as apm.yml entrypoint for command apm pack (marketplace) by @abi-jey in #1288
• feat(registry): [FEATURE] Add package registry support for dependency… by @nadav-y in #1471
• fix(marketplace): handle Windows file:// URI shapes in _local_path_from_source by @danielmeppiel in #1484
• fix(install): block bare cross-repo on enterprise marketplaces (#1326) by @edenfunf in #1459
• fix(compile): live-reload apm.yml and warn on --clean --watch by @edenfunf in #1403
• feat: persist transport flags via apm config by @Aaryan-Dadu in #1308
• fix(compile): deduplicate Claude Code instructions (#1138) by @tillig in #1146
• refactor(cli): clean up compilation config and registry cursor by @altf4-games in #1367
• fix(triage-panel): replace invalid difc: block with tools.github.min-integrity by @danielmeppiel in #1487
• test(codeql): fix 30 py/incomplete-url-substring-sanitization alerts by @danielmeppiel in #1492
• chore: cut 0.15.0 by @danielmeppiel in #1493

New Contributors

• @nadav-y made their first contribution in #1471
• @Aaryan-Dadu made their first contribution in #1308
• @altf4-games made their first contribution in #1367

Full Changelog: v0.14.2...v0.15.0

v0.14.2

What's Changed

🔧 Other Changes

• test(coverage): enforce 75% unit gate and push integration to 60% by @sergio-sisternes-epam in #1414
• add(coverage): Phase 3 -- unit 88% / integration 71% by @sergio-sisternes-epam in #1417
• add(coverage): raise unit and integration gates to 90% with phase-3 + phase-4 tests by @sergio-sisternes-epam in #1425
• test: replace logic-replay tests for #763 with real-flow coverage by @mvanhorn in #1340
• fix: preflight via ssh on ssh based connections (closes #1293) by @Alpha200 in #1303
• fix: support Streamable HTTP MCP servers for Codex CLI (closes #1260) by @masaishi in #1262
• fix: resolve env-var placeholders in Codex/Gemini self-defined stdio MCP (closes #1266) by @edenfunf in #1277
• fix(hooks): stabilize root .apm hook source-ids across renames/worktrees (supersedes #1330, closes #1329) by @danielmeppiel in #1392
• fix(tests): make Windows unit-test job green by @danielmeppiel in #1427
• fix(ado): resolve az binary via shutil.which for Windows az.cmd (closes #1430) by @danielmeppiel in #1432
• feat(copilot-app): hybrid WS-IPC + SQLite project scoping for workflows by @danielmeppiel in #1431
• ci: shard PR tests + move binary build off critical path by @danielmeppiel in #1437
• perf(#1433): sparse-cone consumer materialization for subdir deps by @danielmeppiel in #1436
• fix(copilot-app): warn-not-fail on newer App schema + feat: batch-bug-shepherd primitive by @danielmeppiel in #1434
• fix(compile): discover local-bundle instructions in apm_modules/ by @danielmeppiel in #1388
• fix(cache): handle ValueError from parsed.port on Windows file:// URLs by @danielmeppiel in #1446
• fix(integration): respect comma-separated applyTo globs in Claude/Cursor/Windsurf by @danielmeppiel in #1387
• fix(build): restore optimize=2 + enforce explicit Click help= to clear Defender ML false positive (#1407) by @danielmeppiel in #1450
• fix(hooks): keep project-scope hook commands repo-relative (closes #1394) by @srid in #1396
• fix(detect): expand copilot harness markers to file-based signals (#1435) by @sergio-sisternes-epam in #1440
• fix(audit): pre-create target dirs in drift replay scratch (#1411) by @sergio-sisternes-epam in #1441
• fix(install): persist --skill filter to apm.yml (#1395) by @sergio-sisternes-epam in #1442
• fix(vscode): handle v0.1 runtimeArguments with variables for Docker MCP (#1391) by @sergio-sisternes-epam in #1444
• fix(plugin): prevent _map_plugin_artifacts from destroying pre-positioned .apm/ content by @abi-jey in #1416
• fix(applyTo): fold #1387 panel follow-ups (docs + DRY + YAML escape) by @danielmeppiel in #1449
• feat(batch-bug-shepherd): operator visibility + fold-in invariant by @danielmeppiel in #1451
• fix(mcp): honour per-dep registry URL during install (#1393) by @sergio-sisternes-epam in #1443
• chore: release v0.14.2 by @danielmeppiel in #1454
• fix(ci): repair Windows-only unit test failures after v0.14.2 by @danielmeppiel in #1455
• fix(cache): apply core.longpaths to post-clone git ops on Windows by @danielmeppiel in #1456
• test(integration): unstick 23 stale tests that drift from production code by @danielmeppiel in #1457

New Contributors

• @Alpha200 made their first contribution in #1303
• @masaishi made their first contribution in #1262

Full Changelog: v0.14.1...v0.14.2

v0.14.1

What's Changed

🔧 Other Changes

• docs(producer): add zava-agent-config as live golden-path reference by @danielmeppiel in #1384
• fix(deps): honor SSH user from dependency URL (closes #1383) by @danielmeppiel in #1385
• docs(changelog): add #1383 SSH user fix entry by @danielmeppiel in #1386
• fix(install): survive AppLocker/WDAC by staging release before binary test (#1389) by @danielmeppiel in #1390
• fix(ci): wire coverage observability into CI pipelines (Phase 1) by @sergio-sisternes-epam in #1404
• fix(install): detect Windows Defender AV block and emit specific guidance by @danielmeppiel in #1408
• feat(experimental): copilot-app target deploys scheduled prompts to App DB by @danielmeppiel in #1405
• chore(release): v0.14.1 by @danielmeppiel in #1410
• fix(uninstall): accept Windows absolute paths as local packages (re-tag v0.14.1) by @danielmeppiel in #1413

Full Changelog: v0.14.0...v0.14.1

v0.14.0

What's Changed

🔧 Other Changes

• docs: full rewrite -- persona-led ramps + 3-promise narrative by @danielmeppiel in #1252
• docs: fix all redirect destinations to include /apm base path by @danielmeppiel in #1284
• fix: marketplace install auth host on *.ghe.com (closes #1285) by @edenfunf in #1292
• fix(ci): use audit-only pattern to prevent install overwriting tamper (closes #1202) by @sergio-sisternes-epam in #1291
• fix(policy): layer dependencies.require through extends: org (closes #1201) by @sergio-sisternes-epam in #1290
• fix: warn when apm.yml is missing but APM artifacts exist (closes #1056) by @sergio-sisternes-epam in #1255
• fix(build): keep Click command docstrings in release binaries by @edenfunf in #1307
• fix(audit): drift check skip-with-info on cache miss (closes #1200) by @sergio-sisternes-epam in #1289
• feat(install): air-gapped / GHE env vars for install.ps1 by @abhinavgautam01 in #1246
• test(integration): regression trap for *.ghe.com marketplace auth routing (closes #1304) by @edenfunf in #1312
• feat(marketplace): support multi-profile marketplace outputs by @henrydennis in #1281
• fix: apm install no longer permanently blocked by policy after lockfile wipe (required-packages-deployed catch-22) by @danielmeppiel in #1313
• fix: preserve Claude stdio MCP env by @imk1t in #1224
• feat(marketplace): filter-driven CLI, map-based manifest, JSON output by @danielmeppiel in #1324
• fix(policy): inherit parent unmanaged_files when child omits block by @abhinavgautam01 in #1248
• refactor(integration): extract MCPIntegrator.install by @abhinavgautam01 in #1245
• fix: hint to host-qualify cross-repo on *.ghe.com (closes #1305) by @edenfunf in #1319
• fix(adapters): route Gemini config through project_root and user_scope by @edenfunf in #1306
• chore: add pylint R0801 duplicate code guardrail (Phase 0) by @sergio-sisternes-epam in #1320
• fix(registry): migrate SimpleRegistryClient to MCP Registry v0.1 spec (#1210) by @danielmeppiel in #1337
• fix: respect targets: whitelist for all runtimes during MCP install by @danielmeppiel in #1336
• feat(pack,doctor,init): vendor-neutral producer first-run UX by @danielmeppiel in #1362
• fix: stop writing _apm_source into Claude settings.json by @sergio-sisternes-epam in #1359
• fix: skip direct GitHub API validation when PROXY_REGISTRY_ONLY is set by @sergio-sisternes-epam in #1357
• fix: propagate target to intermediate CompilationConfig in single-file path by @sergio-sisternes-epam in #1355
• fix: resolve hook paths to absolute in settings.json for --target claude by @sergio-sisternes-epam in #1354
• refactor: eliminate duplicate code blocks (phases 1-3) by @sergio-sisternes-epam in #1360
• feat(pack): add --check-versions and --check-clean release gates by @danielmeppiel in #1365
• fix: add --target flag to apm update command by @sergio-sisternes-epam in #1358
• fix(compile): forward target to watch-mode recompile (closes #1345) by @danielmeppiel in #1349
• feat: support marketplace notation in apm uninstall by @sergio-sisternes-epam in #1325
• fix: prefer APM-managed runtimes over system PATH and warn on codex/GitHub Models incompatibility by @sergio-sisternes-epam in #1356
• feat(cli): introduce apm plugin init noun-verb surface by @danielmeppiel in #1370
• Fix shared/apm.md matrix secret-stripping; add empirical verify workflow by @danielmeppiel in #1373
• perf(resolver): tiered git ref resolver collapses redundant clones (#1369) by @danielmeppiel in #1376
• fix: allow tilde in repository path components for Bitbucket DC personal repos (#1375) by @danielmeppiel in #1377
• test(windows): make path assertions and chmod tests OS-aware by @danielmeppiel in #1378
• chore: cut 0.14.0 by @danielmeppiel in #1372

New Contributors

• @abhinavgautam01 made their first contribution in #1246
• @henrydennis made their first contribution in #1281
• @imk1t made their first contribution in #1224

Full Changelog: v0.13.0...v0.14.0

v0.13.0

What's Changed

📖 Documentation

• [docs] Update documentation for features from 2026-05-08 by @danielmeppiel in #1205
• [docs] Update documentation for features from 2026-05-09 by @danielmeppiel in #1219

🔧 Other Changes

• chore(aw): bump microsoft/apm-action v1.7.1 -> v1.7.2 by @danielmeppiel in #1183
• feat(shared/apm.md): expose target input for slim per-harness bundles by @danielmeppiel in #1184
• fix(shared/apm.md): drop || 'all' fallback so gh-aw substitutes target (#1185) by @danielmeppiel in #1186
• fix(install,test): exclude cowork from --target all + stabilize defer-start timer test by @danielmeppiel in #1191
• ci(panels): pin target=copilot for pr-review-panel and triage-panel by @danielmeppiel in #1192
• fix(triage-panel): paginate scheduled sweep oldest-first via MCP by @danielmeppiel in #1193
• fix(triage-panel): use search_issues with -label:status/triaged for sweep by @danielmeppiel in #1194
• fix(install): accept YAML list form under singular target: key (#1188) by @danielmeppiel in #1197
• [cli-consistency] Fix CLI/docs inconsistencies from 2026-05-06 consistency report by @Copilot in #1174
• [Test Improver] tests(deps): add unit tests for deps CLI helper functions by @danielmeppiel in #1155
• support virtual packages on generic git hosts (Gitea) by @ganesanviji in #587
• fix(install): wire ADO --update preflight through PAT->bearer fallback (#1212) by @danielmeppiel in #1214
• fix(cli): add missing help text to outdated command by @danielmeppiel in #1216
• fix(errors): hide agent-skills meta-target from unknown-target suggestions (#1208) by @danielmeppiel in #1215
• fix: target-agnostic local-bundle install (#1207) by @danielmeppiel in #1217
• Add gh auth token fallback before git credential fill by @awakecoding in #630
• refactor(deps): introduce HostBackend Protocol + extract stamp_plugin_version by @danielmeppiel in #1223
• fix(auth): per-URL credential disambiguation + gh-cli short-circuit regression trap by @danielmeppiel in #1226
• fix: pass scope-resolved lockfile path to MCPIntegrator.update_lockfile at --global scope by @sergio-sisternes-epam in #1236
• fix: align direct install HTTPS validation with manifest-driven credential handling by @sergio-sisternes-epam in #1242
• fix: normalise default-scheme ports (443/80/22) on DependencyReference / HostInfo by @sergio-sisternes-epam in #1237
• fix: hide experimental cowork config key and fix verbose target log by @sergio-sisternes-epam in #1241
• Reject unsupported flat-format dependencies with actionable error by @sergio-sisternes-epam in #1189
• feat(install): add GitLab marketplace host support by @slava-kudzinau in #1149
• refactor(tests): marker-driven integration discovery (PR1 of #1166) by @danielmeppiel in #1167
• refactor(tests): retire script enumeration; pytest discovers tests/integration/ by @danielmeppiel in #1247
• docs(tests): codify integration-test marker procedure as APM instructions primitive by @danielmeppiel in #1249
• ci(smoke): replace runtime-binary smoke with README-promise smoke by @danielmeppiel in #1251
• Add 'apm update' command and '--frozen' install flag (closes #1203) by @danielmeppiel in #1244
• fix(install,tests): repair 63 integration tests in merge queue by @danielmeppiel in #1257
• fix(tests): repair 2 integration tests that surfaced post-#1257 by @danielmeppiel in #1261
• fix: add threading.Lock to _fallback_port_warned dedup set by @sergio-sisternes-epam in #1238
• fix: harden _is_github_server host validation to require hostname match by @sergio-sisternes-epam in #1239
• fix: emit Cursor-native MCP schema (type: stdio) instead of Copilot schema by @sergio-sisternes-epam in #1240
• perf(ci): shard + parallelize integration tests for ~5x speedup by @danielmeppiel in #1263
• fix(deps): fetch missing SHA-pinned commits into shallow bare clones by @sergio-sisternes-epam in #1259
• fix: accept full ADO https:// URLs with sub-paths (closes #1128) by @sergio-sisternes-epam in #1254
• fix: policy inheritance preserves parent unmanaged_files when child omits block (closes #1198) by @sergio-sisternes-epam in #1253
• fix(tests): mock search_servers fallback in registry-client UUID-not-found test by @danielmeppiel in #1264
• fix: apm install no longer adopts files not produced by installed plugins (closes #1199) by @sergio-sisternes-epam in #1256
• chore(release): v0.13.0 by @danielmeppiel in #1269
• fix(tests): hermetic HOME for unit tests on Windows runner by @danielmeppiel in #1270
• fix(deps): use --git-dir for bare repos + pin fetched SHAs as refs (#1267) by @sergio-sisternes-epam in #1268
• fix(tests): set hermetic HOME at conftest import time for Windows xdist workers by @danielmeppiel in #1271
• fix(tests): override Path.home() in root conftest so Windows xdist gw2 cannot crash by @danielmeppiel in #1272
• test(integration): retry transient MCP registry outages in mcp show/search by @danielmeppiel in #1274
• fix(tests): wrap Path.expanduser() to never raise on Windows runner by @danielmeppiel in #1276

New Contributors

• @ganesanviji made their first contribution in #587
• @awakecoding made their first contribution in #630
• @slava-kudzinau made their first contribution in #1149

Full Changelog: v0.12.4...v0.13.0

v0.12.4

What's Changed

🔧 Other Changes

• chore: release v0.12.4 (apm-action v1.7.1 bump + audit-replay fix #1182) by @danielmeppiel in #1181

Full Changelog: v0.12.3...v0.12.4

v0.12.3

What's Changed

🔧 Other Changes

• fix(install): branch-ref drift no longer ships 3-way-inconsistent lockfile by @danielmeppiel in #1158
• fix(install): rewrite in-package relative links to apm_modules/ paths (#1147) by @danielmeppiel in #1160
• fix(policy): close audit --ci silent governance bypass + SCP/ADO URL parsing (#1159) by @danielmeppiel in #1164
• fix(targets): explicit, auditable target resolution (closes #1154) by @danielmeppiel in #1165
• fix: exclude .apm-pin from skill deploy copytree by @tillig in #1153
• fix(copilot): translate env-var placeholders instead of baking secrets to disk (#1152) by @danielmeppiel in #1169
• chore(release): v0.12.3 by @danielmeppiel in #1170
• test(integration): pass --target copilot to apm init --yes by @danielmeppiel in #1171
• fix(install): orphan cleanup runs when apm.yml is emptied + diff-aware test fixes by @danielmeppiel in #1173
• fix(install): restore static-target deploy path; tighten test fixtures for #1154 strict harness detection by @danielmeppiel in #1176
• test: fix v0.12.3 CI failures on Windows + macOS by @danielmeppiel in #1179
• test(release-validation): pass --target copilot to apm init on Windows by @danielmeppiel in #1180

Full Changelog: v0.12.2...v0.12.3

v0.12.2

What's Changed

🔧 Other Changes

• docs: clarify APM's role for skills, unify plugins-as-packages, add ADO sub-path examples, state stability by @danielmeppiel in #1127
• docs: fix first-package guide (includes: auto explained, correct skill paths) by @danielmeppiel in #1129
• fix(deps): subdir-agnostic bare cache fixes parallel sparse-checkout race (#1126) by @danielmeppiel in #1135
• feat(audit): default-on integration drift detection by @danielmeppiel in #1137
• chore(release): v0.12.2 by @danielmeppiel in #1141
• fix(install): exclude .apm-pin marker from package content hash (unblocks v0.12.2 release) by @danielmeppiel in #1142

Full Changelog: v0.12.1...v0.12.2

v0.12.1

What's Changed

🔧 Other Changes

• feat(cursor): add slash command support for Cursor 1.6+ by @stbenjam in #1046
• ci(gh-aw): bump apm-action v1.5.0 -> v1.6.0 for plugin-bundle defenses by @danielmeppiel in #1121
• fix: explicit UTF-8 encoding in test _make_package helper to unblock Windows CI by @Copilot in #1124
• perf+ux: comprehensive overhaul of apm install (cache, parallel BFS, UX) by @danielmeppiel in #1116
• fix(tests): make cache-lockfile-parity test resilient to leftover deploy artifacts and timestamp drift by @danielmeppiel in #1125

Full Changelog: v0.12.0...v0.12.1