v0.24.0

What's Changed

🔧 Other Changes

• fix(hooks): rename Copilot hook events to camelCase during merge (closes #1977) by @danielmeppiel in #1979
• fix(audit): stable _apm_source marker in audit replay (closes #1978) by @danielmeppiel in #1980
• fix(mcp): resolve self-defined stdio env ${VAR} placeholders at install time (closes #1963) by @danielmeppiel in #1966
• perf(compile): fast-path universal applyTo matching by @WilliamK112 in #1993
• Fix targets:/skills:/alias: ignored on path: dependency entries by @sergio-sisternes-epam in #1987
• fix: Sanitise marketplace name to kebab-case in output mappers by @sergio-sisternes-epam in #2008
• fix(yaml): preserve apm.yml comments on manifest update (closes #2000) by @danielmeppiel in #2012
• docs: clarify lockfile transitive-graph determinism (refs #2007) by @danielmeppiel in #2010
• fix(utils): keep .git suffix on anonymous HTTPS clone URLs (closes #1995) by @mia106dev in #1997
• fix(install): frozen check matches host-qualified private git deps (closes #1996) by @danielmeppiel in #2011
• fix(pack): pack emits only lockfile-attested dependency content in every format (closes #1999) by @danielmeppiel in #2013
• fix(config): add config list alias by @WilliamK112 in #1991
• fix(mcp): clarify install help forwarded options by @WilliamK112 in #2018
• fix(audit): clarify help summary by @WilliamK112 in #2017
• perf(cache): apply promisor config on the clone, collapsing 3 config spawns to 1 by @srobroek in #1974
• perf(resolve): share one RefResolver per repo so ls-remote runs once per repo by @srobroek in #1975
• perf(resolve): honour locked commits without re-resolving refs over the network by @srobroek in #1973
• Harden plugin bin/ deploy to user-only 0o700 permissions by @danielmeppiel in #2024
• fix(plugin-bin): harden deploy permissions and deny matching by @WilliamK112 in #1971
• Verify runtime archive checksums before extraction by @fallintoplace in #1949
• Harden Artifactory zip extraction by @fallintoplace in #1948
• feat(antigravity): support trigger: glob frontmatter and compile-time dedup by @okamiconcept in #1984
• fix(hooks): route combined hook manifests to every named target (closes #2020) by @garyj in #2021
• fix(hooks): deploy self-contained hook scripts with siblings and package module type (closes #2023) by @danielmeppiel in #2025
• Fix duplicate H1 in generated CLAUDE.md by @WilliamK112 in #2016
• chore: release v0.24.0 by @danielmeppiel in #2032
• fix(install): treat throttled GitHub probe as indeterminate, not inaccessible by @danielmeppiel in #2037
• test(install): make github probe unit tests hermetic (mock requests.get) by @danielmeppiel in #2038

New Contributors

• @mia106dev made their first contribution in #1997
• @srobroek made their first contribution in #1974
• @fallintoplace made their first contribution in #1949
• @okamiconcept made their first contribution in #1984
• @garyj made their first contribution in #2021

Full Changelog: v0.23.1...v0.24.0