apcore-cli 0.12.0__tar.gz → 0.12.1__tar.gz

{apcore_cli-0.12.0 → apcore_cli-0.12.1}/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to apcore-cli (Python SDK) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.12.1] - 2026-09-24
+
+Patch release. Bumps the required `apcore` floor to `0.31.0` and `apcore-toolkit` to `[http-proxy]>=0.12.0`. All 1021 tests pass (6 xfailed).
+
+### Changed
+
+- **`load_cli_acl` no longer rebuilds the ACL to attach the §4.8 audit callback.** apcore 0.31.0 (decision D-66) makes `ACL.load(path, audit_logger=…)` accept the callback directly; the `ACL(src.rules, src.default_effect, audit_logger=…)` rebuild this SDK relied on — the only lossless way to attach one before this release — is gone. `reload()` is now available on the ACL `load_cli_acl` returns whether or not `acl.audit.enabled` is set; previously it raised `ACLRuleError` on the auditing path.
+
+### Security
+
+- **`apcli openapi scan|generate` inherits apcore-toolkit 0.12.0's `$ref` sibling-key fix.** `OpenAPIScanner` (imported, never reimplemented, by `openapi_cmd.py`/`openapi_source.py`) previously discarded a `$ref` node's sibling keys during schema resolution, dropping `x-sensitive` and letting a field an OpenAPI document marked sensitive reach apcore with nothing to redact on. Fixed upstream; no code change was needed here.
+
 ## [0.12.0] - 2026-09-05
 
 Two features: **FE-14 ACL Governance** and **FE-15a OpenAPI Import**. Bumps the required `apcore` floor to `0.30.0` and `apcore-toolkit` to `[http-proxy]>=0.11.1`. Full suite: 1004 passed, 5 xfailed (815 → 1004; 189 new tests). `APCLI_SUBCOMMAND_NAMES` grows from 13 to 15.

{apcore_cli-0.12.0 → apcore_cli-0.12.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: apcore-cli
-Version: 0.12.0
+Version: 0.12.1
 Summary: Terminal adapter for apcore — execute AI-Perceivable modules from the command line
 Project-URL: Homepage, https://aiperceivable.com
 Project-URL: Repository, https://github.com/aiperceivable/apcore-cli-python
@@ -21,8 +21,8 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.11
-Requires-Dist: apcore-toolkit[http-proxy]>=0.11.1
-Requires-Dist: apcore>=0.30.0
+Requires-Dist: apcore-toolkit[http-proxy]>=0.12.0
+Requires-Dist: apcore>=0.31.0
 Requires-Dist: click>=8.1
 Requires-Dist: cryptography>=41.0
 Requires-Dist: jsonschema>=4.20

{apcore_cli-0.12.0 → apcore_cli-0.12.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "apcore-cli"
-version = "0.12.0"
+version = "0.12.1"
 description = "Terminal adapter for apcore — execute AI-Perceivable modules from the command line"
 readme = "README.md"
 license = "Apache-2.0"
@@ -26,8 +26,8 @@ classifiers = [
     "Environment :: Console",
 ]
 dependencies = [
-    "apcore>=0.30.0",
-    "apcore-toolkit[http-proxy]>=0.11.1",
+    "apcore>=0.31.0",
+    "apcore-toolkit[http-proxy]>=0.12.0",
     "click>=8.1",
     "jsonschema>=4.20",
     "rich>=13.0",

{apcore_cli-0.12.0 → apcore_cli-0.12.1}/src/apcore_cli/acl_loader.py

@@ -210,32 +210,13 @@ def make_acl_audit_logger(*, include_denied: bool = True) -> Callable[[AuditEntr
 def load_cli_acl(root: str, *, audit_enabled: bool = True, include_denied: bool = True) -> ACL | None:
     """Load an :class:`~apcore.ACL` from *root*, or ``None`` for no enforcement.
 
-    When *audit_enabled* is true the ACL is **rebuilt** so it can carry the
-    §4.8 audit callback: ``ACL.load`` takes no ``audit_logger``, and the
-    callback is a constructor argument, so ::
-
-        src = ACL.load(resolved_path)
-        acl = ACL(src.rules, src.default_effect, audit_logger=…)
-
-    is the only lossless way to attach one. Two things about that sequence are
-    load-bearing:
-
-    1. ``default_effect`` is carried from ``src``, **never** a literal. A file
-       may legitimately declare ``default_effect: allow``, and passing the
-       constructor's own ``"deny"`` default would silently invert the governing
-       verdict for every call no rule matched — a rule set that grants by
-       default would start denying, with nothing in the output saying so.
-    2. The rebuilt ACL **loses** :meth:`~apcore.ACL.reload`, which needs the
-       ``_yaml_path`` only ``ACL.load`` sets. This is accepted rather than
-       worked around: no apcore-cli SDK calls ``reload()`` on any path, and
-       writing the private attribute to fake the provenance would make
-       ``reload()`` claim a file the object was not in fact loaded from. An
-       embedder that needs reloading passes its own ACL to
-       ``create_cli(acl=…)``, which §4.2 attaches unchanged.
-
-    With auditing disabled the ``ACL.load`` result is returned **directly** —
-    no rebuild, no callback — so the ``reload()`` caveat applies only to the
-    auditing path.
+    ``ACL.load`` takes ``audit_logger`` directly (apcore 0.31.0, D-66), so the
+    §4.8 callback is attached in the same call that parses the file — no
+    rebuild, and :meth:`~apcore.ACL.reload` stays available on the returned
+    object. (An earlier revision rebuilt the ACL via
+    ``ACL(src.rules, src.default_effect, audit_logger=…)`` to attach the
+    callback after the fact, which lost ``reload()`` in the process; that
+    workaround is gone now that apcore accepts the callback at load time.)
 
     Args:
         root: Resolved ACL root (file or directory).
@@ -259,20 +240,13 @@ def load_cli_acl(root: str, *, audit_enabled: bool = True, include_denied: bool
     if acl_file is None:
         logger.debug("No ACL at '%s' — enforcement stays off.", root)
         return None
-    src = _ACL.load(acl_file)
-    logger.info("ACL loaded from %s (%d rules).", acl_file, len(src.rules))
-    if not audit_enabled:
-        logger.debug("acl.audit.enabled is false — attaching the loaded ACL directly, no audit callback.")
-        return src
-    acl = _ACL(
-        src.rules,
-        src.default_effect,
-        audit_logger=make_acl_audit_logger(include_denied=include_denied),
-    )
-    logger.debug(
-        "ACL audit callback installed (include_denied=%s); reload() is unavailable on the rebuilt ACL.",
-        include_denied,
-    )
+    audit_logger = make_acl_audit_logger(include_denied=include_denied) if audit_enabled else None
+    acl = _ACL.load(acl_file, audit_logger=audit_logger)
+    logger.info("ACL loaded from %s (%d rules).", acl_file, len(acl.rules))
+    if audit_enabled:
+        logger.debug("ACL audit callback installed (include_denied=%s).", include_denied)
+    else:
+        logger.debug("acl.audit.enabled is false — no audit callback installed.")
     return acl
 
 

{apcore_cli-0.12.0 → apcore_cli-0.12.1}/tests/test_acl_loader.py

@@ -659,8 +659,8 @@ class TestAuditWiring:
         real_load = _ACL.load
         captured: dict[str, object] = {}
 
-        def _spy(path: str):
-            result = real_load(path)
+        def _spy(path: str, audit_logger=None):
+            result = real_load(path, audit_logger=audit_logger)
             captured["acl"] = result
             return result
 
@@ -678,14 +678,20 @@ class TestAuditWiring:
         assert acl.check_access("@external", "db.migrate", None).access == "allow"
         assert _audit_records(audit_path) == []
 
-    def test_auditing_path_rebuilds_and_documents_the_reload_cost(self, workdir):
-        """§4.8 requirement 2 — accepted, and pinned so it cannot be silent."""
-        from apcore.errors import ACLRuleError
+    def test_auditing_path_reload_works(self, workdir, audit_path):
+        """§4.8 requirement 2, updated for apcore 0.31.0 (D-66).
 
+        ``ACL.load`` now takes ``audit_logger`` directly, so the auditing path
+        no longer rebuilds the ACL — ``reload()`` stays available, and the
+        installed audit callback survives it (apcore's own §6.3.2
+        requirement 7).
+        """
         _write_acl_dir(workdir)
-        rebuilt = load_cli_acl(str(workdir / "acl"), audit_enabled=True)
-        with pytest.raises(ACLRuleError, match="was not loaded from a YAML file"):
-            rebuilt.reload()
+        acl = load_cli_acl(str(workdir / "acl"), audit_enabled=True)
+        acl.reload()
+
+        acl.check_access("@external", "system.control.disable", None)
+        assert [r["decision"] for r in _audit_records(audit_path)] == ["deny"]
 
     def test_allow_default_survives_the_rebuild(self, workdir, audit_path):
         """T-ACL-27b: `default_effect: allow` + auditing enabled.