v0.29.1

What's Changed

🔧 Other Changes

• fix: load_frontmatter decodes utf-8-sig so a BOM does not hide the fence by Tech Guy (@lukiod) in #2685
• fix: support catalog-only marketplace plugins by lkshrk (@lkshrk) in #2709
• fix: report malformed executable trust config (closes #2715) by Daniel Meppiel (@danielmeppiel) in #2719
• fix: clean abandoned resolution staging (closes #2716) by Daniel Meppiel (@danielmeppiel) in #2720
• fix: keep plugin hooks live during reinstall (closes #2717) by Daniel Meppiel (@danielmeppiel) in #2723
• fix: authenticate private subdirectory cache (closes #2714) by Daniel Meppiel (@danielmeppiel) in #2722
• fix(deps): repair dangling symlinks in sparse-cone subdir installs by Mohammed Alkindi (@MohammedAlkindi) in #2710
• fix(compile): scope managed-section footer wording by Daniel Meppiel (@danielmeppiel) in #2731
• fix: allow manifestless hook packages in audit (closes #2725) by Daniel Meppiel (@danielmeppiel) in #2732
• fix: resolve the admin policy dir's ProgramData from the environment by Tech Guy (@lukiod) in #2686
• fix: isolate compile from nested Git repositories (#2560, #2713) by Aryan Singh K. (@aryansk) in #2578
• Refactor architecture guards into a sharded Python linter by Daniel Meppiel (@danielmeppiel) in #2739
• fix: make pack check-clean read-only (closes #2727) by Daniel Meppiel (@danielmeppiel) in #2730
• fix(pack): preserve remote metadata outcomes (supersedes #2661) by Daniel Meppiel (@danielmeppiel) in #2693
• fix(update): retain revision pins without release tags by Daniel Meppiel (@danielmeppiel) in #2667
• fix(install): preview positional packages in dry runs by Daniel Meppiel (@danielmeppiel) in #2664
• fix(lockfile): omit generated_at from new lockfiles by Lachlan Heywood (@lachieh) in #2616
• fix(install): accept manifestless repo-root claude_skill under --frozen by cffnpwr (@cffnpwr) in #2446
• fix(yaml_io): validate line-1 delimiter before parsing Markdown frontmatter (#2663) by Manideep Malyala (@manideep-malyala) in #2666
• fix(plugins): accept Copilot-dialect LSP field aliases on plugin intake by normandev92 in #2513
• fix: preserve OpenCode MCP passthrough fields by Aryan Singh K. (@aryansk) in #2593
• fix: avoid subpath false positives for .git repository URLs by Aryan Singh K. (@aryansk) in #2581
• fix: preserve credential helpers for generic marketplace git by Aryan Singh K. (@aryansk) in #2594
• fix: add commit archive fallback for frozen Artifactory installs by Aryan Singh K. (@aryansk) in #2582
• fix(marketplace): support fully qualified SSH URLs by Daniel Meppiel (@danielmeppiel) in #2760
• fix: preserve deployments when integration is skipped (closes #2744) by Daniel Meppiel (@danielmeppiel) in #2758
• fix(ci): repair main and release test regressions by Daniel Meppiel (@danielmeppiel) in #2762
• fix: preserve hand-authored root context files (closes #2767) by Daniel Meppiel (@danielmeppiel) in #2779
• fix: scope MCP uninstall cleanup to managed targets by Aryan Singh K. (@aryansk) in #2591
• fix: allow global direct MCP installs (closes #2548) by Daniel Meppiel (@danielmeppiel) in #2734
• fix(compile): honor targets: in ~/.apm/apm.yml for --global by Travis Illig (@tillig) in #2772
• fix: recompile triage panel lock (closes #2761) by Daniel Meppiel (@danielmeppiel) in #2777
• fix(utils): write project YAML with deterministic LF so apm.yml stops flip-flopping line endings on Windows (closes #2624) by McNultyyy in #2675
• fix: pin the copilot target so contributor installs are deterministic by Travis Illig (@tillig) in #2771
• fix: classify dot-prefixed marketplace paths as local by mikemikimike in #2766
• docs(changelog): collapse duplicate 0.29.0 blocks and restore released history by Daniel Meppiel (@danielmeppiel) in #2786
• fix: make Claude project LSPs discoverable (closes #2547) by Daniel Meppiel (@danielmeppiel) in #2733
• fix(mcp): resolve dependencies.mcp against the configured registry (closes #2740) by Eden (@edenfunf) in #2745
• fix: prefer APM manifests over plugins (closes #2735) by Daniel Meppiel (@danielmeppiel) in #2776
• fix: include LSP dependencies in install dry-run by Aryan Singh K. (@aryansk) in #2580
• fix(integration): route user-scope Copilot hooks to the hooks bucket by Aryan Singh K. (@aryansk) in #2559
• fix: avoid attributing shared .agents paths (closes #2743) by Daniel Meppiel (@danielmeppiel) in #2774
• Fix root context data loss and harden ownership invariant by Daniel Meppiel (@danielmeppiel) in #2790
• fix: retarget packed prompts for Copilot (closes #2763) by Daniel Meppiel (@danielmeppiel) in #2778
• fix: harden global lifecycle state handling by lkshrk (@lkshrk) in #2655
• fix: keep global install dry-run out of user state by Aryan Singh K. (@aryansk) in #2592
• fix(lockfile): gate inactive experimental target resolvers by Daniel Meppiel (@danielmeppiel) in #2791
• fix(install): centralize declaration-first primitive classification by Daniel Meppiel (@danielmeppiel) in #2797
• fix: keep install command outcomes truthful by Daniel Meppiel (@danielmeppiel) in #2799
• fix: isolate dependency git state (closes #2754) by Daniel Meppiel (@danielmeppiel) in #2759
• fix(install): upgrade 0.28 plugin skill metadata by Daniel Meppiel (@danielmeppiel) in #2787
• fix(ci): make daily release smoke actionable by Daniel Meppiel (@danielmeppiel) in #2805
• Fix RED main Windows post-merge regressions by Daniel Meppiel (@danielmeppiel) in #2804
• fix(install): fail loudly on unknown package hosts by Daniel Meppiel (@danielmeppiel) in #2800
• fix(ci): restore red main build-release checks by Daniel Meppiel (@danielmeppiel) in #2807
• chore(release): prepare v0.29.1 changelog by Daniel Meppiel (@danielmeppiel) with @Copilot in #2808
• Harden package and workflow trust boundaries by Daniel Meppiel (@danielmeppiel) with @Copilot in #2810
• Harden APMLifecycle with open-world and generated coverage by Daniel Meppiel (@danielmeppiel) with @Copilot in #2809
• chore: release v0.29.1 by Daniel Meppiel (@danielmeppiel) in #2811
• Investigating and fixing CI workflow test failures by Daniel Meppiel (@danielmeppiel) with @Copilot in #2812
• fix: repair release integration contract regressions by Daniel Meppiel (@danielmeppiel) in #2814
• fix(install): release abandoned transaction lock acquisitions by Daniel Meppiel (@danielmeppiel) in #2817
• ci: diagnose bounded Windows unit test hangs by Daniel Meppiel (@danielmeppiel) in #2819
• fix(tests): repair Windows auth failures and credential-helper stalls by Daniel Meppiel (@danielmeppiel) in #2822
• fix(tests): tolerate Rich wrapping in lifecycle assertions by Daniel Meppiel (@danielmeppiel) in #2828
• chore: finalize v0.29.1 changelog by Daniel Meppiel (@danielmeppiel) in #2838
• fix: recover transient Git connections and synchronize timeout smoke setup by Daniel Meppiel (@danielmeppiel) in #2839
• fix(tests): preserve agent-skills fixture bytes on Windows by Wu Shuwen (@dajiaohuang) in #2830
• fix(tests): repair release inventory and teardown diagnostic race by Daniel Meppiel (@danielmeppiel) in #2840
• fix(install): record published package paths, never resolution-staging paths by lkshrk (@lkshrk) in #2827
• test: complete clone retry owner mutation coverage by Daniel Meppiel (@danielmeppiel) in #2841
• fix(tests): preserve literal plugin-root suffixes on Windows by Daniel Meppiel (@danielmeppiel) in #2845

New Contributors

• lkshrk (@lkshrk) made their first contribution in #2709
• Lachlan Heywood (@lachieh) made their first contribution in #2616
• mikemikimike made their first contribution in #2766
• Wu Shuwen (@dajiaohuang) made their first contribution in #2830

Full Changelog: v0.29.0...v0.29.1