v0.2.0

Changelog

Features

• 016c9c6: feat: Codex takes skills too (@masihmoloodian)
• a0f2c4d: feat: Cursor takes skills, and package installs are idempotent (@masihmoloodian)
• c67d075: feat: VS Code takes skills, via chat.agentSkillsLocations (@masihmoloodian)

Fixes

• 52d09d7: fix: a skills-only plugin created an empty config in every JSON client (@masihmoloodian)
• b209cb6: fix: an empty container outlived every plugin that used it (@masihmoloodian)
• 1db9546: fix: enforce the working directory on the two clients that ignore it (@masihmoloodian)
• d20af2c: fix: the installer pointed at an organisation that does not exist (@masihmoloodian)
• 23820de: fix: the npm package installed a command that hung on first use (@masihmoloodian)
• e644508: fix: the same empty container outlived both plugins in the second config file (@masihmoloodian)
• 4f904c1: fix: two adapters never wrote the working directory, and two clients ignore it (@masihmoloodian)

Documentation

• 4e17040: docs: Cursor takes skills (@masihmoloodian)
• b84a5b1: docs: VS Code confirmed; no client reports undocumented any more (@masihmoloodian)
• aeed458: docs: a publishing path for npm that does not need a token (@masihmoloodian)
• 741c6ae: docs: bring every document up to date, and enforce two of the claims (@masihmoloodian)
• 69f64a9: docs: end-to-end verified against five clients by their own CLIs (@masihmoloodian)
• 6748981: docs: four of six clients now carry skills; VS Code is the holdout (@masihmoloodian)
• 047d8b7: docs: how to turn on the Homebrew tap, and what the first release taught (@masihmoloodian)
• 511d8f1: docs: npm is published and verified (@masihmoloodian)
• a24e1fb: docs: npm no longer accepts TOTP, so the publish flow is not what this said (@masihmoloodian)
• 894957e: docs: record the client path findings against M10-2 (@masihmoloodian)
• 728da57: docs: record the cwd fixes in the end-to-end summary (@masihmoloodian)
• 2686ee8: docs: record what auditing the documentation by running it found (@masihmoloodian)
• 6a4b2c8: docs: run TESTING.md end to end, and fix what running it exposed (@masihmoloodian)
• 124783d: docs: the landing page now installs rather than builds (@masihmoloodian)
• c2685c7: docs: the local npm version is not what trusted publishing depends on (@masihmoloodian)
• a51de80: docs: the repository is public and v0.1.0 is released (@masihmoloodian)

Verifying this release

Every artifact is covered by a signed checksum file. Verification is not an
optional extra here — a tool that asks you to care about where your plugins
come from should make it trivial to check where it came from itself.

cosign verify-blob checksums.txt \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/agentbridgehq/agentbridge/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

sha256sum --check --ignore-missing checksums.txt

Build provenance is attested through GitHub and can be checked with:

gh attestation verify <artifact> --repo agentbridge/agentbridge