v9

Release Notes: apm-v8 -> current (v9)

TL;DR

• Massive CLI expansion in pm, including auth, mcp, update, brutetest, space, and richer profile controls.
• Vault format/security expanded with recovery metadata, DEK-based recovery flow, and decoy/session hardening fields.
• Cloud sync moved from Google Drive-only to multi-provider support (Google Drive + GitHub + Dropbox).
• New MCP server/token lifecycle for AI-agent integration.
• Major docs expansion to MkDocs-based documentation + generated site artifacts.
• Test surface significantly increased across src/* and tests/*.

New Features

• pm init all bootstraps vault + cloud setup in one flow.
• Account recovery flow via pm auth commands:
  • pm auth email [address]
  • pm auth alerts
  • pm auth level [1-3]
  • pm auth recover
  • pm auth reset
  • pm auth change
• MCP integration:
  • pm mcp config
  • pm mcp token
  • pm mcp list
  • pm mcp revoke [name_or_token]
  • pm mcp serve
• Self-update flow with pm update.
• Brute-force simulation command: pm brutetest [minutes].
• Cloud providers expanded:
  • Google Drive mode support now includes sync mode handling.
  • GitHub sync support.
  • Dropbox sync support.
  • The user can now setup cloud sync on their own cloud account (for Google Drive and Dropbox) using Oauth2.
• New vault content types in core model:
  • Audio files
  • Video files
  • Photo files
• Space-based segmentation (space) added for logical partitioning.
• Security profile system upgraded with richer interactive controls in pm profile.
• Plugin UX expanded with plugins search and plugins local [path].

Enhancements

• Vault path resolution now supports APM_VAULT_PATH.
• Recovery metadata now embedded in vault header paths used by decrypt/recover flows.
• Additional security fields in vault model:
  • SecurityLevel
  • Recovery* fields (email/hash/token/salt/slot)
  • DecoyMode, DecoySessionCount
• Audit subsystem expanded with local audit file logging (src/audit.go) and retrieval helpers.
• Team binary improvements include optional query in pm-team get [query] and new pm-team health.
• CI workflow updated (.github/workflows/test.yml) for current toolchain and broader test execution.
• Release tooling added via .goreleaser.yaml.
• Docs system introduced with MkDocs config and structured doc hierarchy.

Renames / Semantic Renames

• File rename:
  • LICENSE.md -> LICENSE
• GitHub Actions workflow rename:
  • .github/workflows/apm-test.yml -> .github/workflows/test.yml
• Command/meaning rename:
  • Old profile (namespaces) semantics moved to space.
  • Old sec_profile responsibilities moved into expanded profile command group.
• Data model semantic rename:
  • Widespread Namespace usage moved to Space in vault entities and filtering logic.

Removals

• Removed personal CLI commands:
  • adup
  • scan
  • sec_profile
  • vsettings
  • del [name] (delete now handled through newer interactive flows)
  • plugins push [name]
• Removed cloud command signatures (superseded by multi-provider signatures):
  • cloud init [gdrive]
  • cloud sync [gdrive]
  • cloud get [gdrive] [retrieval_key]
• Removed file:
  • team/cloud_test.go

CLI Surface Delta

Added personal command signatures:

• alerts
• all
• auth
• brutetest [minutes]
• change
• config
• current
• email [address]
• get [gdrive|github] [retrieval_key|repo]
• init [gdrive|github]
• level [1-3]
• local [path]
• mcp
• recover
• revoke [name_or_token]
• search
• serve
• space
• sync [gdrive|github]
• token
• update

Removed personal command signatures:

• adup
• del [name]
• get [gdrive] [retrieval_key]
• init [gdrive]
• push [name]
• scan
• sec_profile
• sync [gdrive]
• vsettings

Added team command signatures:

• get [query] (optional query variant)
• health

Added Files (non-generated, exhaustive)

• .github/workflows/test.yml
• .goreleaser.yaml
• docs/concepts/cloud-sync.md
• docs/concepts/encryption.md
• docs/concepts/index.md
• docs/concepts/mcp.md
• docs/concepts/plugins.md
• docs/concepts/policy-engine.md
• docs/concepts/recovery.md
• docs/concepts/secret-types.md
• docs/concepts/security-profiles.md
• docs/concepts/sessions.md
• docs/concepts/vault-format.md
• docs/getting-started/features.md
• docs/getting-started/first-steps.md
• docs/getting-started/help.md
• docs/getting-started/index.md
• docs/getting-started/installation.md
• docs/guides/cloud-sync.md
• docs/guides/import-export.md
• docs/guides/index.md
• docs/guides/mcp-integration.md
• docs/guides/plugins.md
• docs/guides/sessions.md
• docs/guides/team-edition.md
• docs/guides/totp.md
• docs/guides/vault-management.md
• docs/index.md
• docs/PLUGIN_API.md
• docs/reference/cli.md
• docs/reference/environment-variables.md
• docs/reference/index.md
• docs/reference/mcp-tools.md
• docs/reference/plugin-api.md
• docs/reference/policies.md
• docs/reference/storage.md
• docs/requirements.txt
• docs/team/approvals.md
• docs/team/departments.md
• docs/team/index.md
• docs/team/rbac.md
• examples/plugins/clip_auto_clear/plugin.json
• examples/plugins/cloud_sync_hook/plugin.json
• examples/plugins/quick_backup/plugin.json
• examples/plugins/safe_add/plugin.json
• examples/plugins/vault_cleaner/plugin.json
• LICENSE
• mcp.md
• mkdocs.yml
• scripts/harden_obf.go
• src/audit.go
• src/audit_test.go
• src/brute.go
• src/cloud_test.go
• src/mcp.go
• src/mcp_integration_test.go
• src/mcp_tools_test.go
• src/policy_test.go
• src/security_test.go
• src/session_test.go
• src/system_profile.go
• src/utils_test.go
• src/vault_test.go
• tests/brute_force_test.go

Added Generated/Binary Artifacts

• build/v9.2/canary/* (3 build artifacts)
• site/** (86 generated documentation files)
• pm.exe
• team/pm-team.exe

Removed Files (exhaustive)

• .github/workflows/apm-test.yml
• LICENSE.md
• team/cloud_test.go

Modified Files (non-generated, exhaustive)

• .gitignore
• examples/plugins/hello_vault/plugin.json
• go.mod
• go.sum
• main.go
• README.md
• src/anomaly.go
• src/cloud.go
• src/cloud_plugins.go
• src/health.go
• src/plugins/definitions.go
• src/plugins/engine.go
• src/plugins/manifest.go
• src/policy.go
• src/portability.go
• src/security.go
• src/session.go
• src/utils.go
• src/vault.go
• team/crypto.go
• team/go.mod
• team/go.sum
• team/main.go
• team/session.go
• team/team_vault.go
• tests/e2e_test.go

Compatibility Notes

• Scripts using sec_profile must migrate to profile.
• Scripts using namespace semantics in profile commands must migrate to space.
• Cloud command automation should migrate to multi-provider signatures ([gdrive|github|dropbox]).
• Integrations expecting LICENSE.md should reference LICENSE.

Existing generated outputs (build artifacts, binaries (releases)) are included above as generated/binary additions.