Merge branch 'main' into fix/603-init-next-steps

Author: sergio-sisternes-epam

CHANGELOG.md

@@ -11,11 +11,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - `apm install` now automatically discovers and deploys local `.apm/` primitives (skills, instructions, agents, prompts, hooks, commands) to target directories, with local content taking priority over dependencies on collision (#626, #644)
+- Add `temp-dir` configuration key (`apm config set temp-dir PATH`) to override the system temporary directory, resolving `[WinError 5] Access is denied` in corporate Windows environments (#629)
 
 ### Fixed
 
 - `apm init` now creates `start.prompt.md` so `apm run start` works out of the box; Next Steps panel no longer references `apm compile` (#649)
+- Fix `apm marketplace add` silently failing for private repos by using credentials when probing `marketplace.json` (#701)
+- Pin codex setup to `rust-v0.118.0` for security and reproducibility; update config to `wire_api = "responses"` (#663)
 - Propagate headers and environment variables through OpenCode MCP adapter with defensive copies to prevent mutation (#622)
+- Fix `apm install` hanging indefinitely when corporate firewalls silently drop SSH packets by setting `GIT_SSH_COMMAND` with `ConnectTimeout=30` (#652)
+- Fix `apm compile --target claude` silently skipping dependency instructions stored in `.github/instructions/` (#631)
+
 ### Changed
 
 - `apm marketplace browse/search/add/update` now route through the registry proxy when `PROXY_REGISTRY_URL` is set; `PROXY_REGISTRY_ONLY=1` blocks direct GitHub API calls (#506)
@@ -452,7 +458,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- **Install Script and `apm update`**: Repaired corrupted header in install.sh. Use awk instead of sed for shell subprocess compatibility. Directed shell output to terminal for password input during update process. 
+- **Install Script and `apm update`**: Repaired corrupted header in install.sh. Use awk instead of sed for shell subprocess compatibility. Directed shell output to terminal for password input during update process.
 
 ## [0.7.1] - 2025-01-22
 
@@ -494,7 +500,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **SKILL.md as first-class primitive**: meta-description of what an APM Package does for agents to read
 - **Claude Skills Installation**: Install Claude Skills directly as APM Packages
-- **Bidirectional Format Support**: 
+- **Bidirectional Format Support**:
   - APM packages → SKILL.md (for Claude target)
   - Claude Skills → .agent.md (for VSCode target)
 - **Skills Documentation**: New `docs/skills.md` guide
@@ -511,7 +517,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Target Auto-Detection**: Smart compilation based on project structure
   - `.github/` only → generates `AGENTS.md` + VSCode integration
-  - `.claude/` only → generates `CLAUDE.md` + Claude integration  
+  - `.claude/` only → generates `CLAUDE.md` + Claude integration
   - Both folders → generates all formats
   - Neither folder → generates `AGENTS.md` only (universal format)
 

docs/src/content/docs/getting-started/authentication.md

@@ -281,3 +281,9 @@ git config credential.helper              # check current helper
 git config --global credential.helper osxkeychain  # macOS
 gh auth login                              # GitHub CLI
 ```
+
+### SSH connection hangs on corporate/VPN networks
+
+When no token is available, APM tries SSH before falling back to plain HTTPS. Firewalls that silently drop SSH packets (port 22) can make `apm install` appear to hang. APM sets `GIT_SSH_COMMAND="ssh -o ConnectTimeout=30"` so SSH attempts fail within 30 seconds and the fallback proceeds to HTTPS with git credential helpers.
+
+If you already set `GIT_SSH_COMMAND` (e.g., for a custom key), APM appends `-o ConnectTimeout=30` unless `ConnectTimeout` is already present in your value.

docs/src/content/docs/integrations/runtime-compatibility.md

@@ -83,7 +83,7 @@ apm runtime setup codex
 ```
 
 This automatically:
-- Downloads the latest Codex binary for your platform
+- Downloads Codex binary `rust-v0.118.0` for your platform (override with `--version`)
 - Installs to `~/.apm/runtimes/codex`
 - Creates configuration for GitHub Models (`github/gpt-4o`)
 - Updates your PATH

docs/src/content/docs/reference/cli-commands.md

@@ -1345,6 +1345,7 @@ apm config
 - Global configuration
   - APM CLI version
   - `auto-integrate` setting
+  - `temp-dir` setting (when configured)
 
 **Examples:**
 ```bash
@@ -1363,6 +1364,7 @@ apm config get [KEY]
 **Arguments:**
 - `KEY` (optional) - Configuration key to retrieve. Supported keys:
   - `auto-integrate` - Whether to automatically integrate `.prompt.md` files into AGENTS.md
+  - `temp-dir` - Custom temporary directory for clone/download operations
 
 If `KEY` is omitted, displays all configuration values.
 
@@ -1386,6 +1388,7 @@ apm config set KEY VALUE
 **Arguments:**
 - `KEY` - Configuration key to set. Supported keys:
   - `auto-integrate` - Enable/disable automatic integration of `.prompt.md` files
+  - `temp-dir` - Set a custom temporary directory path
 - `VALUE` - Value to set. For boolean keys, use: `true`, `false`, `yes`, `no`, `1`, `0`
 
 **Configuration Keys:**
@@ -1411,6 +1414,30 @@ apm config set auto-integrate yes
 apm config set auto-integrate 1
 ```
 
+**`temp-dir`** - Override the system temporary directory
+- **Type:** String (directory path)
+- **Default:** System temp directory (not stored)
+- **Description:** Set a custom temporary directory for clone and download operations. Useful in corporate Windows environments where endpoint security software restricts access to `%TEMP%`, causing `[WinError 5] Access is denied`.
+- **Resolution order:** `APM_TEMP_DIR` environment variable > `temp_dir` in `~/.apm/config.json` > system default.
+- **Use Cases:**
+  - Set when the default system temp directory is restricted or unavailable
+  - Use the `APM_TEMP_DIR` environment variable for CI pipelines or per-session overrides
+
+**Examples:**
+```bash
+# Set a custom temp directory (Windows)
+apm config set temp-dir C:\apm-temp
+
+# Set a custom temp directory (macOS/Linux)
+apm config set temp-dir /tmp/apm-work
+
+# Check the current temp-dir setting
+apm config get temp-dir
+
+# Or use the environment variable instead
+export APM_TEMP_DIR=/tmp/apm-work
+```
+
 ## Runtime Management (Experimental)
 
 ### `apm runtime` (Experimental) - Manage AI runtimes

packages/apm-guide/.apm/skills/apm-usage/authentication.md

@@ -96,3 +96,15 @@ apm install --verbose your-org/package
 # Increase git credential timeout (default 30s, max 180s)
 export APM_GIT_CREDENTIAL_TIMEOUT=120
 ```
+
+### SSH connection hangs on corporate/VPN networks
+
+APM tries SSH as a fallback when HTTPS auth is not available. On networks
+that silently drop SSH traffic (port 22), this can appear to hang. APM sets
+`GIT_SSH_COMMAND="ssh -o ConnectTimeout=30"` so SSH attempts fail within
+30 seconds and the fallback chain continues to plain HTTPS with git
+credential helpers.
+
+To override the SSH command (e.g., custom key path), set `GIT_SSH_COMMAND`
+in your environment. APM appends `-o ConnectTimeout=30` unless it finds
+`ConnectTimeout` already present in your value.

packages/apm-guide/.apm/skills/apm-usage/commands.md

@@ -81,6 +81,6 @@
 | Command | Purpose | Key flags |
 |---------|---------|-----------|
 | `apm config` | Show current configuration | -- |
-| `apm config get [KEY]` | Get a config value | -- |
-| `apm config set KEY VALUE` | Set a config value | -- |
+| `apm config get [KEY]` | Get a config value (`auto-integrate`, `temp-dir`) | -- |
+| `apm config set KEY VALUE` | Set a config value (`auto-integrate`, `temp-dir`) | -- |
 | `apm update` | Update APM itself | `--check` only check |

scripts/runtime/setup-codex.ps1

@@ -1,9 +1,11 @@
 # Setup script for Codex runtime (Windows)
 # Downloads Codex binary from GitHub releases and configures with GitHub Models
 
+# Pin to a known stable release for security and reproducibility (#662).
+# Users can override with: apm runtime setup codex --version <version> (e.g. 'latest')
 param(
     [switch]$Vanilla,
-    [string]$Version = "latest"
+    [string]$Version = "rust-v0.118.0"
 )
 
 $ErrorActionPreference = "Stop"
@@ -161,10 +163,12 @@ model = "openai/gpt-4o"
 name = "GitHub Models"
 base_url = "https://models.github.ai/inference/"
 env_key = "$githubTokenVar"
-wire_api = "chat"
+wire_api = "responses"
 "@ | Set-Content -Path $codexConfig -Encoding UTF8
 
         Write-Success "Codex configuration created at $codexConfig"
+        Write-Info "Using Codex $Version."
+        Write-Info "Override with: apm runtime setup codex --version <version> (e.g. 'latest')"
     } else {
         Write-Info "Vanilla mode: Skipping APM configuration"
     }

scripts/runtime/setup-codex.sh

@@ -23,7 +23,9 @@ source "$SCRIPT_DIR/setup-common.sh"
 
 # Configuration
 CODEX_REPO="openai/codex"
-CODEX_VERSION="latest"  # Default version
+# Pin to a known stable release for security and reproducibility (#662).
+# Users can override with: apm runtime setup codex --version <version> (e.g. 'latest')
+CODEX_VERSION="rust-v0.118.0"
 VANILLA_MODE=false
 
 # Parse command line arguments
@@ -204,10 +206,12 @@ model = "openai/gpt-4o"
 name = "GitHub Models"
 base_url = "https://models.github.ai/inference/"
 env_key = "$github_token_var"
-wire_api = "chat"
+wire_api = "responses"
 EOF
 
         log_success "Codex configuration created at $codex_config"
+        log_info "Using Codex $CODEX_VERSION."
+        log_info "Override with: apm runtime setup codex --version <version> (e.g. 'latest')"
         log_info "APM configured Codex with GitHub Models as default provider"
         log_info "Use 'apm install' to configure MCP servers for your projects"
     else

src/apm_cli/bundle/unpacker.py

@@ -56,7 +56,8 @@ def unpack_bundle(
     # 1. If archive, extract to temp dir
     cleanup_temp = False
     if bundle_path.is_file() and bundle_path.name.endswith(".tar.gz"):
-        temp_dir = Path(tempfile.mkdtemp(prefix="apm-unpack-"))
+        from ..config import get_apm_temp_dir
+        temp_dir = Path(tempfile.mkdtemp(prefix="apm-unpack-", dir=get_apm_temp_dir()))
         cleanup_temp = True
         try:
             with tarfile.open(bundle_path, "r:gz") as tar:

src/apm_cli/commands/config.py

@@ -84,6 +84,12 @@ def config(ctx):
 
             config_table.add_row("Global", "APM CLI Version", get_version())
 
+            from ..config import get_temp_dir as _get_temp_dir
+
+            _temp_dir_val = _get_temp_dir()
+            if _temp_dir_val:
+                config_table.add_row("", "Temp Directory", _temp_dir_val)
+
             console.print(config_table)
 
         except (ImportError, NameError):
@@ -105,6 +111,12 @@ def config(ctx):
             click.echo(f"\n{HIGHLIGHT}Global:{RESET}")
             click.echo(f"  APM CLI Version: {get_version()}")
 
+            from ..config import get_temp_dir as _get_temp_dir_fb
+
+            _temp_dir_fb = _get_temp_dir_fb()
+            if _temp_dir_fb:
+                click.echo(f"  Temp Directory: {_temp_dir_fb}")
+
 
 @config.command(help="Set a configuration value")
 @click.argument("key")
@@ -116,7 +128,7 @@ def set(key, value):
         apm config set auto-integrate false
         apm config set auto-integrate true
     """
-    from ..config import set_auto_integrate
+    from ..config import set_auto_integrate, set_temp_dir
 
     logger = CommandLogger("config set")
     if key == "auto-integrate":
@@ -129,9 +141,17 @@ def set(key, value):
         else:
             logger.error(f"Invalid value '{value}'. Use 'true' or 'false'.")
             sys.exit(1)
+    elif key == "temp-dir":
+        try:
+            set_temp_dir(value)
+            from ..config import get_temp_dir
+            logger.success(f"Temporary directory set to: {get_temp_dir()}")
+        except ValueError as exc:
+            logger.error(str(exc))
+            sys.exit(1)
     else:
         logger.error(f"Unknown configuration key: '{key}'")
-        logger.progress("Valid keys: auto-integrate")
+        logger.progress("Valid keys: auto-integrate, temp-dir")
         logger.progress(
             "This error may indicate a bug in command routing. Please report this issue."
         )
@@ -147,27 +167,31 @@ def get(key):
         apm config get auto-integrate
         apm config get
     """
-    from ..config import get_config, get_auto_integrate
+    from ..config import get_auto_integrate, get_temp_dir
 
     logger = CommandLogger("config get")
     if key:
         if key == "auto-integrate":
             value = get_auto_integrate()
             click.echo(f"auto-integrate: {value}")
+        elif key == "temp-dir":
+            value = get_temp_dir()
+            if value is None:
+                click.echo("temp-dir: Not set (using system default)")
+            else:
+                click.echo(f"temp-dir: {value}")
         else:
             logger.error(f"Unknown configuration key: '{key}'")
-            logger.progress("Valid keys: auto-integrate")
+            logger.progress("Valid keys: auto-integrate, temp-dir")
             logger.progress(
                 "This error may indicate a bug in command routing. Please report this issue."
             )
             sys.exit(1)
     else:
-        # Show all config
-        config_data = get_config()
+        # Show all user-settable keys with their effective values (including
+        # defaults).  Iterating raw config keys would hide settings that
+        # have not been written yet (e.g. auto_integrate on a fresh install).
         logger.progress("APM Configuration:")
-        for k, v in config_data.items():
-            # Map internal keys to user-friendly names
-            if k == "auto_integrate":
-                click.echo(f"  auto-integrate: {v}")
-            else:
-                click.echo(f"  {k}: {v}")
+        click.echo(f"  auto-integrate: {get_auto_integrate()}")
+        temp_dir = get_temp_dir()
+        click.echo(f"  temp-dir: {temp_dir if temp_dir is not None else 'Not set (using system default)'}")