v0.18.0

What's new

Added

• Pipeline agents may now use gh and glab to fix the PR/MR title or description and to run and read CI; ymcp still pushes and opens the change, and the agent merges or closes it only when a person asks.
• strategy.squash and strategy.deleteBranch open GitLab merge requests with squash and delete-branch ticked, for projects that require them.
• The runner watches the CI of every push on GitHub and GitLab and gives failures to the agent with the failed jobs and the end of their logs; after ci.fixes failed attempts in a row (3 by default) the run goes to needs input, and ci.watch: false turns this off.

Changed

• Pipeline agents are told never to credit themselves or any other agent, model or tool in commits or changes.

Changelog

Features

• 237f20e: feat(pipeline): let the agent use gh and glab, and never credit agents (#29) (@xlsft)
• 95542dd: feat(pipeline): open GitLab merge requests with squash and delete-branch ticked (#30) (@xlsft)
• 08c15e2: feat(pipeline): watch the CI of every push and give failures to the agent (#32) (@xlsft)

Install

macOS / Linux:

curl -fsSL https://raw.githubusercontent.com/xlsft/ymcp/main/install.sh | sh

Windows (PowerShell):

irm https://raw.githubusercontent.com/xlsft/ymcp/main/install.ps1 | iex

Homebrew: brew install xlsft/tap/ymcp · Scoop: scoop bucket add xlsft https://github.com/xlsft/scoop-bucket; scoop install ymcp · winget: winget install xlsft.ymcp (once Microsoft merges the package).

Already installed: ymcp update. Docker: docker pull xlsoftware/ymcp:0.18.0.

Verify

checksums.txt is signed with Sigstore by this repository's release workflow:

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/xlsft/ymcp/\.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum --ignore-missing -c checksums.txt

Each archive has an SPDX SBOM next to it (*.sbom.json).