v0.8.3

Added

• dotagents mcp starts the stdio MCP gateway and can forward tools from
  overlay-declared stdio and Streamable HTTP servers. Forwarded names default
  to <skill-or-server-name>.<tool>; --prefix accepts a {name} template.
  dotagents.mcp.refresh reloads active overlay declarations and reconnects
  servers without restarting dotagents.
  Overlays declare servers and skill mappings in overlay.toml under [mcp];
  Streamable HTTP requires the mcp-http extra, and credentials are read from
  named environment variables.

Changed

• Requires duho 0.7.9 (its ToolProvider serves the forwarded tools), also in
  the scope venvs and the .pyz.

Full Changelog: v0.8.2...v0.8.3

v0.8.2

Fixed

• findings (and init / overlays) run from inside a project's .agents, such as
  <project>/.agents/findings, target that project. They used to write a second
  .agents inside the store. Deeper than a top-level directory of the user store,
  where no project can be named, they refuse instead of writing there.

• findings keeps a hand-written INDEX.md: before the first regeneration it is
  copied to INDEX.md.handwritten, with a warning.

• The routing note above overlay paths no longer suggests dotagents env for
  reading an overlay root (it prints the whole environment, secrets included); it
  says to read just the variable.

• The sh wrapper init writes into <store>/bin/dotagents works from another
  system that shares the store, such as WSL reading a Windows store. It ran the
  interpreter recorded by init, a Windows path there; where that interpreter
  does not run it now takes the store's agents' venv for that OS and machine
  (.pyvenv/<version>-<os>-<arch>), else python3, and converts a recorded
  C:/... pyz path with wslpath.

What's Changed

• build(deps): bump actions/upload-artifact from 6 to 7 by @dependabot[bot] in #10
• build(deps): bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #9

Full Changelog: v0.8.1...v0.8.2

v0.8.1

Added

• Overlay commands get a launcher on PATH: each top-level bin/<name>.py, and
  each [scripts] entry in overlay.toml (name = "path" adds or replaces one,
  name = false opts a bin/<name>.py out). The launchers live in the agents'
  venv, in <venv>/overlays/: <name>.exe on Windows, made with distlib's
  ScriptMaker so no command interpreter parses the arguments, and a /bin/sh
  script elsewhere. They run the script through $<NAME>_OVERLAY_ROOT when they
  run, so only a new interpreter needs them made again. init and overlays add /
  sync / remove keep them current and delete those no overlay has; two
  overlays with one script name is an error naming both.
• dotagents env puts the launcher directory of the venv AGENTS_PYTHON names
  first on PATH, ahead of the levels' bin dirs, and takes any other venv's
  off it.
• A project gets its own venv when one of its overlays has scripts.
• New dependency: distlib>=0.4.0,<0.5, vendored in the .pyz.

Full Changelog: v0.8.0...v0.8.1

v0.8.0

Added

• overlays add takes globs: overlays add '*' -g installs every overlay the repos
  offer, which for a store with a registry (<store>/dotagents.toml) is everything
  it names. A glob matching nothing is an error.

• tools/cloud-setup.sh installs every overlay the store's registry names
  (overlays add '*') before falling back to installing private-sync alone.

• Each store has a Python venv, <store>/.pyvenv/<X.Y.Z>-<os>-<arch>/, made from
  the Python that runs dotagents, where skills run. init and overlays add /
  sync / remove keep it current: the user venv always has duho, and every
  overlay's requirements.txt is installed (in one pip run, only when a file
  changed, before the overlay's setup.py). A project gets its own venv when one of
  its overlays ships requirements or a lib/. --no-venv skips it for a run;
  AGENTS_NO_PYVENV=1 turns it off. .pyvenv/ holds the agents' venvs only: a
  venv there that no sync completed is never used, and a project's own code keeps
  its venvs in the project tree.

• The venvs layer project > user > system through a .pth file in each: the store's
  own overlay libs, then each lower store's venv packages and libs, then dotagents
  itself. A project venv imports the project's packages first, then the user's.

• env points AGENTS_PYTHON at the active venv and names it in AGENTS_PYVENV;
  overlay setup.py scripts run under it. context prints it ("Python for
  skills"), and its JSON form carries it as python. The managed block tells
  agents to run skill scripts with $AGENTS_PYTHON.

• pip without ensurepip: a venv where the interpreter has no ensurepip is created
  without pip, and pip runs from its wheel (25.3, the last for Python 3.9, checked
  against a pinned sha256). The wheel is found in the store's cache, in a .pyz
  built with the new build-pyz --with-pip, in AGENTS_PIP_SOURCE (a directory of
  wheels, or any URI pathapi-uri reads) or pip's find-links, or on your index
  (PIP_INDEX_URL, or the mirror in pip.ini / pip.conf). AGENTS_PIP_SOURCE
  is also passed to pip as --find-links for the requirements.

Changed

• overlays add no longer stops at the first overlay that fails. Each failure is
  logged, the overlays that require the failed one are skipped, every other overlay
  is installed, and the command exits 1 naming each failure. A failed overlay this
  run was installing for the first time is removed again, as before; the ones that
  installed stay.
• With a scope venv, env no longer puts the overlay libs it layers on
  PYTHONPATH: the venv's interpreter imports them, and no other Python in the
  session should. Without a venv, PYTHONPATH carries them as before.
  AGENTS_PYTHONPATH still lists every lib.
• The base block's "Startup: annotate that you read …" line names a store under
  the home directory from there (~/.agents/AGENTS.md), and any other store by its
  absolute path as before. A store kept in git and used on machines whose home
  directories differ no longer shows AGENTS.md modified on all but one of them.

Fixed

• env --cache on Windows with Python before 3.13 could miss a cache it had just
  written: time.time() there lags the file's own timestamp by up to one clock
  tick, and a cache file dated after "now" was treated as stale. A cache file
  dated up to 2 s in the future now counts as fresh.

What's Changed

• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #8
• build(deps): bump actions/upload-artifact from 4 to 6 by @dependabot[bot] in #7
• build(deps): bump actions/download-artifact from 4 to 7 by @dependabot[bot] in #6

Full Changelog: v0.7.6...v0.8.0

v0.7.6

Added

• A repo extra (repopath[uri]) for overlay sources at github:, gitlab: and
  repo: URIs, which the uri extra no longer brings.

Changed

• dotagents depends on pathapi (>=0.1.0,<0.2), the new name of pathlib_next,
  instead of pathlib_next. The .pyz vendors it; build-pyz --pathapi-version
  names its pin, and --pathlib-next-version still works. On Python 3.9 nothing
  else has to be installed for it.
• The extras install pathapi's own distributions: uri and http install
  pathapi-uri (the URI layer, imported as uripath, with file:, http(s):,
  dav:, ftp:, zip: and tar: on the standard library); sftp adds
  sftppath[paramiko] and s3 adds objpath[s3]. Overlay sources are read as
  before. A git: URI is not a scheme any more; a repository tree is a repo: URI.
• build-pyz --extras vendors what the named extras install, each distribution at
  its floor, and refuses an extra it does not know.
• about lists pathapi, pathapi-uri, netimps and the plugin distributions in
  place of pathlib_next, uritools and requests.

Removed

• The .pyz no longer extracts the built-in command modules' sources to temporary
  files at startup: duho reads a command's flags and help through the zip importer
  when the module has no file on disk.

Full Changelog: v0.7.5...v0.7.6

v0.7.5

Changed

• main() runs through duho.run(..., exit=False): it always returns the status
  instead of raising SystemExit for a message, --help or a usage error (the
  console script, python -m dotagents and install.py exit with it as before, with
  the same statuses and the same text on standard error). Ctrl-C now ends with
  status 130 and no traceback, and a closed pipe on standard output ends with
  status 1, quietly.
• The duho floor moves to >=0.7.5,<0.8 (from >=0.6.0,<0.7); the vendored
  .pyz pin (build-pyz --duho-version) moves with it. No flag, exit status or
  output changes.
• Command modules are loaded with duho's own discover_commands(on_error=...)
  instead of a copy of its loop built on a private duho name. A module that fails
  to import is still named in a warning and skipped, and the listing order is
  unchanged. A command module may now import a sibling helper file by its bare
  name.
• kebab_name delegates to duho.text.kebabcase; its results are unchanged.
• Discovered commands are listed in discovery order with discover_commands(sort=False)
  instead of being re-sorted here, and a command that cannot build its parser is
  found out with duho.runtime.build_command_parser instead of a private duho
  helper. Output, exit statuses and which commands are skipped are unchanged.

Full Changelog: v0.7.4...v0.7.5

v0.7.4

Added

• findings index --requote quotes, in the findings already on disk, the frontmatter
  values YAML cannot read as they stand. Only those lines change: bodies, the other
  lines and line endings are kept.

Changed

• The private-sync guide describes the default ignore rules the overlay's
  sync-project now writes, once, into the .gitignore of a store kept in git:
  scratch/, tmp/, __pycache__/, hidden files and the machine-local overrides
  stay out of the private repository.

Fixed

• findings writes frontmatter any YAML parser reads. A description that opens with
  [ or a backtick, or holds : , was written bare, and a markdown viewer or any
  other tool reading the frontmatter rejected the file. Such a value is now a
  double-quoted string; a plain one is still written bare, and a finding written
  before reads as it did.

What's Changed

• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #2
• build(deps): bump softprops/action-gh-release from 2.6.2 to 3.0.3 by @dependabot[bot] in #1
• build(deps): bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #3
• build(deps): bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in #4
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #5

New Contributors

• @dependabot[bot] made their first contribution in #2

Full Changelog: v0.7.3...v0.7.4

v0.7.3

Changed

• The command guide and the shipped API header now say that every command except
  env, built-in or discovered, is served as an MCP tool when dotagents starts with
  DOTAGENTS_MCP=stdio, and that AGENT_HELP=1 turns --help into a JSON document.
  The authoring guide asks overlays to ship command modules rather than loose
  scripts, and skills to name the tools they use.

Full Changelog: v0.7.2...v0.7.3

v0.7.2

Added

• git_ssl_revoke in <store>/dotagents/config.toml sets how the git clones and
  fetches of overlay repos check certificate revocation: best-effort (the default)
  skips a revocation list that is missing or unreachable, false skips the check, as
  git on Linux does, true enforces it. It is passed to every git call, so a stricter
  git configuration elsewhere no longer fails an https clone on Windows, and a clone
  that still fails on revocation says which setting to change. A git too old to know
  best-effort (it rejects the value) runs the call again without the setting.

Full Changelog: v0.7.1...v0.7.2

v0.7.1

Added

• Your own additions to an installed overlay's file live at the same path under the
  store root (~/.agents/kb/RUST.md for the rust overlay's kb/RUST.md, or
  <project>/.agents/kb/RUST.md), where overlays sync never touches them. The
  base AGENTS.md tells agents to read them alongside the overlay's file, and
  dotagents context lists the ones it finds (JSON: local_additions).

Full Changelog: v0.7.0...v0.7.1