AgentPack 1.2.0

Cross-agent package manager for MCP servers and plugins — Claude Code, Codex and OpenCode.

Download: AgentPack-1.2.0-win-x64.exe (Windows x64, portable, unsigned). Requires Node.js 22.17+ with npm on PATH; the app bundles Electron but launches MCP servers with the machine's Node.

Run AgentPack-1.2.0-win-x64.exe --demo for a sandboxed demo with three sample agent configs and a nested Next.js + Supabase project. Without --demo it reads and writes your real agent configuration.

What changed since 1.1.0

Safer writes. Every state and config write is atomic (temp file plus rename). Rollback is now ownership-aware: it compares before, after and current state entry by entry, so unrelated later edits survive, and an edit to an entry AgentPack installed produces a reported conflict instead of a silent overwrite. Installation stops writing to a config another process touched mid-run.

Process handling. Windows no longer routes npm/npx through a shell — node runs npm's own entry point directly. Server probes paginate tools/list, validate tool shape, bound their output, and clean up child process trees.

Desktop hardening. Renderer sandbox enabled, navigation and new windows blocked, IPC restricted to the owning window's main frame, and desktop mutations serialized behind a lock.

Detection. Bounded globbing with symlink and generated-directory exclusions. Nested next.config.* and supabase/config.toml inside monorepo apps now count, and real .env* files contribute variable names. DATABASE_URL alone no longer implies PostgreSQL.

Capability Load Manager. An unmeasured machine showed "0 / 0", which read as an empty machine rather than an unmeasured one. That state now shows em dashes and an explicit Measure context cost button.

Docs. docs/DEMO.md is a full demo workflow — preparation, a five-minute script with exact clicks, judge questions and a failure playbook.

Verification for this build

Check	Result
TypeScript	clean
Focused regressions	24 / 24
Self-check suite	all passed
Engine acceptance	14 / 14, configs restored byte-identically
Renderer UI (real preload + IPC)	8 / 8; 39 tools measured across three MCP servers
Packaged portable launch	exit 0

Known limits

Authenticated GitHub and Supabase operations have not been exercised with real accounts, and no coding-agent session has been started to watch it load the generated config — so plugin status reads Configured, never Verified. Context figures are tool-schema estimates (characters divided by four), not billed tokens, and apply to an agent's next session. The artifact is unsigned. Full assessment: docs/READINESS.md.

SHA-256: A6491BD3981A30FC6AB0077365DC7F990AD298DD9C58038A9752F9782AC76CCE