v0.12.4

What's Changed

🔧 Other Changes

• chore: release v0.12.4 (apm-action v1.7.1 bump + audit-replay fix #1182) by @danielmeppiel in #1181

Full Changelog: v0.12.3...v0.12.4

v0.12.3

What's Changed

🔧 Other Changes

• fix(install): branch-ref drift no longer ships 3-way-inconsistent lockfile by @danielmeppiel in #1158
• fix(install): rewrite in-package relative links to apm_modules/ paths (#1147) by @danielmeppiel in #1160
• fix(policy): close audit --ci silent governance bypass + SCP/ADO URL parsing (#1159) by @danielmeppiel in #1164
• fix(targets): explicit, auditable target resolution (closes #1154) by @danielmeppiel in #1165
• fix: exclude .apm-pin from skill deploy copytree by @tillig in #1153
• fix(copilot): translate env-var placeholders instead of baking secrets to disk (#1152) by @danielmeppiel in #1169
• chore(release): v0.12.3 by @danielmeppiel in #1170
• test(integration): pass --target copilot to apm init --yes by @danielmeppiel in #1171
• fix(install): orphan cleanup runs when apm.yml is emptied + diff-aware test fixes by @danielmeppiel in #1173
• fix(install): restore static-target deploy path; tighten test fixtures for #1154 strict harness detection by @danielmeppiel in #1176
• test: fix v0.12.3 CI failures on Windows + macOS by @danielmeppiel in #1179
• test(release-validation): pass --target copilot to apm init on Windows by @danielmeppiel in #1180

Full Changelog: v0.12.2...v0.12.3

v0.12.2

What's Changed

🔧 Other Changes

• docs: clarify APM's role for skills, unify plugins-as-packages, add ADO sub-path examples, state stability by @danielmeppiel in #1127
• docs: fix first-package guide (includes: auto explained, correct skill paths) by @danielmeppiel in #1129
• fix(deps): subdir-agnostic bare cache fixes parallel sparse-checkout race (#1126) by @danielmeppiel in #1135
• feat(audit): default-on integration drift detection by @danielmeppiel in #1137
• chore(release): v0.12.2 by @danielmeppiel in #1141
• fix(install): exclude .apm-pin marker from package content hash (unblocks v0.12.2 release) by @danielmeppiel in #1142

Full Changelog: v0.12.1...v0.12.2

v0.12.1

What's Changed

🔧 Other Changes

• feat(cursor): add slash command support for Cursor 1.6+ by @stbenjam in #1046
• ci(gh-aw): bump apm-action v1.5.0 -> v1.6.0 for plugin-bundle defenses by @danielmeppiel in #1121
• fix: explicit UTF-8 encoding in test _make_package helper to unblock Windows CI by @Copilot in #1124
• perf+ux: comprehensive overhaul of apm install (cache, parallel BFS, UX) by @danielmeppiel in #1116
• fix(tests): make cache-lockfile-parity test resilient to leftover deploy artifacts and timestamp drift by @danielmeppiel in #1125

Full Changelog: v0.12.0...v0.12.1

v0.12.0

What's Changed

📖 Documentation

• [docs] Update documentation for features from 2026-04-29 by @danielmeppiel in #1037
• [docs] Update documentation for features from 2026-04-28 by @danielmeppiel in #1016
• [docs] Update documentation for features from 2026-03-26 by @danielmeppiel in #461

🔧 Other Changes

• fix(policy): fail closed on malformed manifest YAML by @sergio-sisternes-epam in #1053
• fix(install): map APM prompt 'input' to Claude 'arguments' front-matter by @stbenjam in #1039
• docs(contributing): teach authors to run apm-review-panel + pr-description-skill locally by @danielmeppiel in #1057
• fix(install): handle bare-string MCP entry in shell-metachar warning by @edenfunf in #951
• fix: correct Claude settings.json hook emission (#1007) by @sergio-sisternes-epam in #1054
• fix(compile): stabilize BUILD_ID in all compiled outputs by @edenfunf in #959
• refactor: split marketplace commands into package modules by @shreejaykurhade in #1024
• feat: add Ruff code quality guardrails (replaces black + isort) by @sergio-sisternes-epam in #999
• fix: respect CLAUDE_CONFIG_DIR for claude target user-scope deploy by @shuntaka9576 in #1055
• chore(compile): tighten link_resolver._resolve_path input guards by @mvanhorn in #991
• [fix] translate bare ${VAR} env-var refs in self-defined MCP server headers (#944) by @edenfunf in #947
• fix: address Copilot review findings on #1055 and #991 (consolidated) by @danielmeppiel in #1065
• feat(marketplace): harden apm pack output (#1061) by @danielmeppiel in #1063
• fix(install): allow local packages at --global scope; fix broken tests by @stbenjam in #937
• fix: extend explicit UTF-8 encoding to 5 remaining open() call sites by @danielmeppiel in #1068
• fix(compile): emit and clean up copilot root instructions (#792) by @danielmeppiel in #1067
• [Test Improver] test: add unit tests for install/mcp_warnings.py (0% -> ~100%) by @danielmeppiel in #828
• docs(notice): rename NOTICE.md -> NOTICE; add CLA third-party section by @danielmeppiel in #1073
• perf(compile): cache file walk and fix placement for narrow patterns by @Roozi489 in #871
• Don't flag parent dirs of subdirectory packages as orphaned by @tillig in #1052
• test(windows): fix CLAUDE_CONFIG_DIR scope tests on Windows by @danielmeppiel in #1086
• fix(marketplace): enhance repository input parsing for GitLab subgroups and HTTPS URLs by @Antonin-Rouxel-LaPoste-BGPN in #1034
• Stop rendering CLAUDE.md dependencies that don't exist by @tillig in #1048
• fix(install): align validation auth chain with install by @a1icja in #941
• docs(authors): show maintainer affiliations and link contributor graph by @danielmeppiel in #1090
• fix: remove Codex-only user-visible hint on opt-in miss (vendor-neutrality) by @Copilot in #1083
• fix(install): allow credential helpers in --update preflight for generic hosts by @tillig in #1084
• refactor(panel): rebuild apm-review-panel as advisory, scannable, and self-healing by @danielmeppiel in #1093
• feat(install): apm install + lockfile-embedded plugin packs (#1098) by @danielmeppiel in #1099
• fix(deps): support meta-packages and apm.yml inside collections/ subpaths by @edenfunf in #1097
• refactor(panel): add tier axis to test-coverage evidence by @danielmeppiel in #1102
• feat: add Claude Code as MCP install target (closes #643, supersedes #655) by @danielmeppiel in #1104
• fix(marketplace): resolve source.repo vs source.repository key mismatch (#1105) by @sergio-sisternes-epam in #1106
• feat(install): add --target agent-skills for cross-client .agents/skills/ deployment by @danielmeppiel in #1103
• fix(install): unmask exception handlers + Windows CRLF in local-bundle tests by @danielmeppiel in #1108
• fix(compile): include global instructions in AGENTS.md and CLAUDE.md by @edenfunf in #1088
• fix(tests): use urlparse for host assertions (CodeQL #88-#91) by @danielmeppiel in #1109
• chore(docs): upgrade Astro 5.18.1 -> 6.2.1 by @danielmeppiel in #1110
• Feature/windsurf target by @yoelabril in #1066
• fix(install): anchor transitive local_path deps on declaring package (#857) by @danielmeppiel in #1111
• chore(release): cut 0.12.0 by @danielmeppiel in #1112

New Contributors

• @shuntaka9576 made their first contribution in #1055
• @Antonin-Rouxel-LaPoste-BGPN made their first contribution in #1034
• @a1icja made their first contribution in #941
• @yoelabril made their first contribution in #1066

Full Changelog: v0.11.0...v0.12.0

v0.11.0

What's Changed

🐛 Bug Fixes

• fix(install): ADO Entra ID auth path + --update pre-flight abort (#1015) by @danielmeppiel in #1031

🔧 Other Changes

• fix(policy): unify --policy / --policy-source forms across CLI help and docs by @edenfunf in #1000
• fix: rename token variable to resolve CodeQL clear-text-storage alert by @Copilot in #1002
• fix: remove stray "specify" from generated file footer by @stbenjam in #996
• refactor: complexity audit -- eliminate god-method forks, O(n^2) loops, redundant I/O by @sergio-sisternes-epam in #918
• fix: use POSIX paths in auto-discovery CLI output for Windows compat by @sergio-sisternes-epam in #1018
• fix: marketplace build respects GITHUB_HOST for GHE repos by @sergio-sisternes-epam in #1009
• fix(targets): validate apm.yml target: at parse time, share normalization with CLI (closes #820) by @edenfunf in #987
• refactor(review-panel): true fan-out + binary verdict + label automation by @danielmeppiel in #1022
• feat(shared/apm): apps[] + matrix fan-out for multi-org App auth by @danielmeppiel in #982
• Devcontainer feature by @coakenfold in #861
• fix(shared/apm): drop stale STATUS banner; recompile lock files to v1.5.0 by @danielmeppiel in #1026
• fix(workflows): skip-don't-fail panel label gate; bump gh-aw v0.68.3 -> v0.71.1 by @danielmeppiel in #1030
• fix(marketplace): add honors manifest.name for Claude Code parity by @danielmeppiel in #1032
• fix(shared/apm): repair gh-aw [a b] import-input serialization that breaks apm-prep by @danielmeppiel in #1033
• feat(codex): add project-scoped MCP and user target support by @Nickolaus in #803
• feat(marketplace): fold marketplace.yml into apm.yml's 'marketplace:' block (closes #722, implements #1036) by @danielmeppiel in #1038
• Fix #1019: Improve compile target specification by @tillig in #1020
• chore: add NOTICE file for third-party components by @danielmeppiel in #1043
• chore(notices): automate NOTICE.md generation + CI drift gate by @danielmeppiel in #1045
• feat(pack): unify 'apm pack' to produce bundle and marketplace.json (closes #722) by @danielmeppiel in #1042
• fix(shared/apm): re-shape single-artifact download to expected layout by @danielmeppiel in #1051
• chore(release): cut 0.11.0 by @danielmeppiel in #1049

New Contributors

• @Nickolaus made their first contribution in #803

Full Changelog: v0.10.0...v0.11.0

v0.10.0

What's Changed

🔧 Other Changes

• docs(readme): add 'Coming from npx skills add?' conversion block by @danielmeppiel in #980
• fix(docs): deploy on tag push, not on the unreachable workflow_call branch by @danielmeppiel in #981
• Add evals suite to pr-description-skill (genesis-driven) by @danielmeppiel in #985
• Harden pr-description-skill mermaid conventions (diagram-type-by-intent + GH-renderer gotchas) by @danielmeppiel in #984
• feat(cowork): experimental support for Microsoft 365 Copilot Cowork custom skills by @sergio-sisternes-epam in #926
• fix(test): patch sys.platform in cowork tests for Windows CI by @sergio-sisternes-epam in #989
• feat(marketplace): add experimental authoring CLI commands (#722) by @sergio-sisternes-epam in #790
• chore(release): cut 0.10.0 by @danielmeppiel in #986
• Fix: apm install https://... no longer falls back to SSH on generic Git hosts by @Copilot in #995
• fix(tests): make doctor tests deterministic across CI environments by @sergio-sisternes-epam in #997
• fix(tests): use os.path.normpath in cowork skills dir assertions for Windows CI by @sergio-sisternes-epam in #1006

Full Changelog: v0.9.4...v0.10.0

v0.9.4

What's Changed

🔧 Other Changes

• fix(ci): deploy docs after bot-cut releases via workflow_call by @danielmeppiel in #953
• feat(ci): automate apm-triage-panel on new and reopened issues by @danielmeppiel in #954
• fix(templates): use canonical taxonomy labels in issue templates by @danielmeppiel in #958
• fix(cli): CLI consistency report findings(#903) by @shreejaykurhade in #910
• fix(install): honour REQUESTS_CA_BUNDLE in package validator by @abi-jey in #911
• fix(triage-panel): dispatch project-sync per themed issue by @danielmeppiel in #971
• feat(install): SKILL_BUNDLE -- day-0 install parity with npx skills add by @danielmeppiel in #974
• docs(python-architect): document mermaid classDiagram :::cssClass GitHub-render trap by @danielmeppiel in #970
• feat: make install.sh configurable for air-gapped environments by @chkp-roniz in #660
• chore(release): cut 0.9.4 by @danielmeppiel in #978
• fix(tests): force UTF-8 in non-ASCII SKILL.md fixture (Windows CI hotfix) by @danielmeppiel in #979

New Contributors

• @shreejaykurhade made their first contribution in #910
• @abi-jey made their first contribution in #911

Full Changelog: v0.9.3...v0.9.4

v0.9.3

What's Changed

🚀 New Features

• feat(cli): apm experimental - feature-flag registry with list/enable/disable/reset by @sergio-sisternes-epam in #849

📖 Documentation

• [docs] Update runtime-compatibility docs for Gemini CLI (#917) by @danielmeppiel in #945

🔧 Other Changes

• chore(ci): remove deprecated PR-time stub workflow by @danielmeppiel in #875
• docs(ci): improve Branch Protection section per review feedback by @danielmeppiel in #874
• ci(build-release): gate smoke to tag/schedule/dispatch only by @danielmeppiel in #878
• ci: dogfood apm audit --ci and integration-drift gate (closes #883) by @danielmeppiel in #885
• harden(apm-review-panel): one-comment discipline + Hybrid E auth routing + apm-primitives-architect persona by @danielmeppiel in #882
• chore: bump shared/apm.md to microsoft/apm-action@v1.4.2 by @danielmeppiel in #904
• chore(panel-review): tighten one-comment contract; safety cap 1 -> 7 by @danielmeppiel in #905
• fix(panel-review): orchestrator self-arbitrates and emits in skill contract by @danielmeppiel in #907
• fix(apm-review-panel): restore in-context persona model (per agentskills.io) by @danielmeppiel in #908
• feat(audit): close audit-blindness gap for local .apm/ content (#887) by @danielmeppiel in #889
• feat(skills): add apm-triage-panel for issue triage by @danielmeppiel in #915
• fix(update): sanitise env before spawning installer by @edenfunf in #899
• fix(install): scope local content scan to ~/.apm/ at user scope (#830) by @guwenqing in #850
• fix(ci): add merge_group trigger to Merge Gate so it reports in queue by @danielmeppiel in #921
• fix(policy): handle OSError from is_file() on macOS PATH_MAX limit by @chaobo8484 in #860
• perf(discovery): prune excluded subtrees during traversal by @Roozi489 in #870
• add(skills): pr-description-skill -- anchored, self-sufficient PR bodies for microsoft/apm by @danielmeppiel in #884
• fix: Copilot adapter validates remote transport_type (#791) by @mvanhorn in #812
• fix(policy): resolve project_root before path-traversal check by @qorexdevs in #895
• feat(ci): PGS project board sync workflow + bootstrap script by @danielmeppiel in #919
• docs(changelog): resolve 0.9.2 merge conflict, dedupe sections, add missing post-0.9.2 entries by @danielmeppiel in #932
• feat(gemini): add Gemini CLI as supported target with integration tests by @stbenjam in #917
• fix(workflows): gate pr-review-panel on panel-review label at pre-activation by @danielmeppiel in #948
• fix(install): route HYBRID and CLAUDE_SKILL packages through skill-bundle path by @danielmeppiel in #946
• docs: clarify dev-only primitives and the .apm/ scanner boundary by @danielmeppiel in #949
• chore(release): 0.9.3 by @danielmeppiel in #950

New Contributors

• @guwenqing made their first contribution in #850
• @chaobo8484 made their first contribution in #860
• @Roozi489 made their first contribution in #870
• @mvanhorn made their first contribution in #812
• @qorexdevs made their first contribution in #895
• @stbenjam made their first contribution in #917

Full Changelog: v0.9.2...v0.9.3

v0.9.2

What's Changed

🔧 Other Changes

• fix(install): lowercase host in fallback-port-warned dedup key by @edenfunf in #815
• docs(governance): flagship Governance Guide + corpus rationalization by @danielmeppiel in #851
• docs(landing): align with three-pillar spine by @danielmeppiel in #855
• docs(enterprise): refactor section IA -- hub + merge teams + dedupe governance by @danielmeppiel in #858
• fix(install): surface custom port in generic host clone/ls-remote error by @edenfunf in #804
• feat(auth): Azure DevOps authentication via Entra ID (AAD) bearer tokens by @danielmeppiel in #856
• docs(gh-aw): replace deprecated dependencies: with shared/apm.md import by @danielmeppiel in #864
• ci: add merge-gate orchestrator to harden against dropped pull_request webhooks by @danielmeppiel in #865
• docs: rewrite first-package tutorial, fix anatomy hallucination by @danielmeppiel in #866
• ci: collapse 5 required PR-time checks into a single Merge Gate verdict by @danielmeppiel in #867
• chore: prepare v0.9.2 release by @danielmeppiel in #868

Full Changelog: v0.9.1...v0.9.2