What's Changed

🔧 Other Changes

• refactor(auth): debug-log all exception handlers in credential cascade (closes #935) by @danielmeppiel in #1664
• fix(install): keep format-transformed rules tracked + in sync (closes #1662) by @srid in #1665
• fix(deps): scope shorthand-alias guard to exclude @ in #ref fragment (closes #1696) by @danielmeppiel in #1698
• fix(install): unwrap lspServers envelope in plugin .lsp.json (closes #1683) by @sergio-sisternes-epam in #1686
• fix(compile): target-aware instruction dedup for Codex AGENTS.md (closes #1678) by @sergio-sisternes-epam in #1685
• fix(mcp): preserve scoped server names when materializing harness configs (closes #1693) by @danielmeppiel in #1699
• feat: add openclaw as experimental skills target by @sergio-sisternes-epam in #1677
• fix: external scanner UX improvements by @sergio-sisternes-epam in #1692
• fix(deps): preserve transitive dependencies in marketplace and remote subdir installs (closes #1666) by @sergio-sisternes-epam in #1687
• fix(install): support FQDN monorepo subpath on GHES hosts (closes #1673) by @sergio-sisternes-epam in #1684
• fix(deps): add AAD bearer fallback and HTML sign-in detection in download_ado_file (closes #1671) by @danielmeppiel in #1675
• feat: warn on unknown keys dropped in MCPDependency.from_dict() by @danielmeppiel in #1674
• Add Nadav Yogev (JFrog) to maintainers by @danielmeppiel in #1704
• feat(publish): switch publish command archive format from tar.gz to zip by @nadav-y in #1695
• fix(install): honor --skill subset on non-package skill-collection install (closes #1707) by @danielmeppiel in #1709
• fix(install): skip lockfile rewrite when local instructions content is unchanged (closes #1702) by @danielmeppiel in #1710
• fix(install): validate APM_LIB_DIR before rm -rf to prevent data loss (closes #1690) by @dohwi in #1694
• fix(install): dereference in-package symlinks on local install (#1668) by @danielmeppiel in #1676
• feat: surface installed hook actions during apm install (closes #316) by @danielmeppiel in #1700
• Fix Windows CRLF handling in install safety tests by @danielmeppiel in #1717
• fix(tests): skip install.sh safety tests when POSIX bash is unavailable by @danielmeppiel in #1719
• fix(install): cover skill bundles with per-file content-integrity + target-scoped union manifest (closes #1716) by @danielmeppiel in #1718
• fix(apm-review-panel): guarantee non-empty turn exit via synchronous fan-out by @danielmeppiel in #1714
• chore: release v0.19.0 by @danielmeppiel in #1715

New Contributors

• @dohwi made their first contribution in #1694