apm-cli 0.17.0__tar.gz → 0.18.0__tar.gz

{apm_cli-0.17.0/src/apm_cli.egg-info → apm_cli-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.17.0
+Version: 0.18.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License

{apm_cli-0.17.0 → apm_cli-0.18.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.17.0"
+version = "0.18.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"

{apm_cli-0.17.0 → apm_cli-0.18.0}/src/apm_cli/adapters/client/base.py

@@ -150,6 +150,21 @@ class MCPClientAdapter(ABC):
         self._last_env_placeholder_keys: set[str] = set()
         self._last_legacy_angle_vars: set[str] = set()
 
+    def _format_runtime_env_placeholder(self, name: str) -> str:
+        """Return the target runtime's env-var placeholder syntax for *name*."""
+        return "${" + name + "}"
+
+    def _translate_env_placeholder_for_runtime(self, value):
+        """Translate env-var placeholders to this adapter's runtime syntax."""
+        if not isinstance(value, str):
+            return value
+
+        def _to_runtime(match):
+            var_name = match.group(1) or match.group(2)
+            return self._format_runtime_env_placeholder(var_name)
+
+        return _ENV_PLACEHOLDER_RE.sub(_to_runtime, value)
+
     @property
     def project_root(self) -> Path:
         """Return the explicit project root or the current working directory."""
@@ -390,9 +405,7 @@ class MCPClientAdapter(ABC):
                     continue
                 if _has_env_placeholder(raw_value):
                     self._last_legacy_angle_vars.update(_extract_legacy_angle_vars(raw_value))
-                    translated[name] = _translate_env_placeholder(raw_value)
-                    # Record every ${VAR} in the translated value (handles
-                    # both ${env:VAR} -> ${VAR} and bare ${VAR} cases).
+                    translated[name] = self._translate_env_placeholder_for_runtime(raw_value)
                     placeholder_keys.extend(
                         m.group(1) for m in _ENV_VAR_RE.finditer(translated[name])
                     )
@@ -403,7 +416,7 @@ class MCPClientAdapter(ABC):
                 else:
                     # Literal value present in apm.yml -- replace with a
                     # runtime placeholder so the secret never touches disk.
-                    translated[name] = "${" + name + "}"
+                    translated[name] = self._format_runtime_env_placeholder(name)
                     placeholder_keys.append(name)
             self._last_env_placeholder_keys = set(placeholder_keys)
             return translated
@@ -421,7 +434,7 @@ class MCPClientAdapter(ABC):
                 if name in self._DEFAULT_GITHUB_ENV:
                     resolved[name] = self._DEFAULT_GITHUB_ENV[name]
                 else:
-                    resolved[name] = "${" + name + "}"
+                    resolved[name] = self._format_runtime_env_placeholder(name)
                     placeholder_keys.append(name)
             self._last_env_placeholder_keys = set(placeholder_keys)
             return resolved
@@ -510,7 +523,7 @@ class MCPClientAdapter(ABC):
             self._last_env_placeholder_keys.update(legacy_keys)
             for match in _ENV_VAR_RE.finditer(value):
                 self._last_env_placeholder_keys.add(match.group(1))
-            return _translate_env_placeholder(value)
+            return self._translate_env_placeholder_for_runtime(value)
 
         from rich.prompt import Prompt
 
@@ -560,7 +573,7 @@ class MCPClientAdapter(ABC):
 
         if self._supports_runtime_env_substitution:
             self._last_legacy_angle_vars.update(_extract_legacy_angle_vars(processed))
-            processed = _translate_env_placeholder(processed)
+            processed = self._translate_env_placeholder_for_runtime(processed)
         else:
             # Resolve only the legacy ``<VAR>`` form; newer syntaxes are
             # preserved verbatim for backward compatibility.

{apm_cli-0.17.0 → apm_cli-0.18.0}/src/apm_cli/adapters/client/copilot.py

@@ -26,7 +26,9 @@ from .base import (
     _extract_legacy_angle_vars,
     _has_env_placeholder,
     _stringify_env_literal,
-    _translate_env_placeholder,
+)
+from .base import (
+    _translate_env_placeholder as _translate_env_placeholder,
 )
 
 
@@ -678,9 +680,9 @@ class CopilotClientAdapter(MCPClientAdapter):
         # ({NAME: value-or-placeholder}); registry-sourced deps pass a list
         # of {name, description, required} dicts. Translate-mode handling
         # for the dict shape: each value is either already a placeholder
-        # (translate it to the canonical ${VAR} form) or a literal (record
-        # the key as a placeholder reference and emit ${NAME} so the
-        # value never lands on disk). See issue #1152.
+        # (translate it to the adapter's runtime form) or a literal
+        # (record the key as a placeholder reference and emit a runtime
+        # placeholder so the value never lands on disk). See issue #1152.
         if isinstance(env_vars, dict) and self._supports_runtime_env_substitution:
             translated = {}
             placeholder_keys = []
@@ -694,9 +696,7 @@ class CopilotClientAdapter(MCPClientAdapter):
                     continue
                 if _has_env_placeholder(raw_value):
                     self._last_legacy_angle_vars.update(_extract_legacy_angle_vars(raw_value))
-                    translated[name] = _translate_env_placeholder(raw_value)
-                    # Record every ${VAR} in the translated value (handles
-                    # both ${env:VAR} -> ${VAR} and bare ${VAR} cases).
+                    translated[name] = self._translate_env_placeholder_for_runtime(raw_value)
                     for match in _ENV_VAR_RE.finditer(translated[name]):
                         placeholder_keys.append(match.group(1))
                 elif name in default_github_env and raw_value == default_github_env[name]:
@@ -704,7 +704,7 @@ class CopilotClientAdapter(MCPClientAdapter):
                 else:
                     # Literal value present in apm.yml -- replace with a
                     # runtime placeholder so the secret never touches disk.
-                    translated[name] = "${" + name + "}"
+                    translated[name] = self._format_runtime_env_placeholder(name)
                     placeholder_keys.append(name)
             self._last_env_placeholder_keys = set(placeholder_keys)
             return translated
@@ -722,10 +722,9 @@ class CopilotClientAdapter(MCPClientAdapter):
                     # Non-secret literal default -- preserve as-is.
                     resolved[name] = default_github_env[name]
                 else:
-                    # Emit a runtime-substitution placeholder; Copilot CLI
-                    # resolves ``${NAME}`` from the host environment at
-                    # server-start. APM never reads or stores the value.
-                    resolved[name] = "${" + name + "}"
+                    # Emit a runtime-substitution placeholder; APM never reads
+                    # or stores the value.
+                    resolved[name] = self._format_runtime_env_placeholder(name)
                     placeholder_keys.append(name)
             # Record for the post-install summary line and the
             # security-improvement notice.
@@ -783,7 +782,7 @@ class CopilotClientAdapter(MCPClientAdapter):
             # them (the env-block path tracks via _resolve_environment_variables).
             for match in _ENV_VAR_RE.finditer(value):
                 self._last_env_placeholder_keys.add(match.group(1))
-            return _translate_env_placeholder(value)
+            return self._translate_env_placeholder_for_runtime(value)
 
         import sys
 

{apm_cli-0.17.0 → apm_cli-0.18.0}/src/apm_cli/adapters/client/intellij.py

@@ -67,9 +67,10 @@ class IntelliJClientAdapter(CopilotClientAdapter):
 
     JetBrains Copilot stores server definitions in a user-scope JSON file
     with a ``"servers"`` top-level key (not ``"mcpServers"``).  This adapter
-    inherits all registry-resolution, env-var handling, and config read/write
-    from :class:`CopilotClientAdapter` and overrides only the config path and
-    ``mcp_servers_key`` so the parent methods operate on the correct key.
+    inherits registry-resolution and config read/write from
+    :class:`CopilotClientAdapter` and overrides the config path,
+    ``mcp_servers_key``, and runtime env-var placeholder syntax so the parent
+    methods operate on the correct schema.
     """
 
     supports_user_scope: bool = True
@@ -77,9 +78,13 @@ class IntelliJClientAdapter(CopilotClientAdapter):
     target_name: str = "intellij"
     mcp_servers_key: str = "servers"
 
-    # JetBrains runtime-substitution support has not yet been audited.
-    # Pin to install-time resolution for safety; revisit in a follow-up.
-    _supports_runtime_env_substitution: bool = False
+    # JetBrains Copilot resolves ${env:VAR} placeholders in mcp.json at
+    # server-start, so APM must not bake matching host secrets to disk.
+    _supports_runtime_env_substitution: bool = True
+
+    def _format_runtime_env_placeholder(self, name: str) -> str:
+        """Return JetBrains Copilot's native env-var placeholder syntax."""
+        return "${env:" + name + "}"
 
     # ------------------------------------------------------------------ #
     # Config path

{apm_cli-0.17.0 → apm_cli-0.18.0}/src/apm_cli/commands/install.py

@@ -888,7 +888,7 @@ def _handle_mcp_install(
 @click.option(
     "--runtime",
     help=(
-        "Target specific runtime only (copilot, codex, vscode, cursor, opencode, gemini, claude, windsurf)"
+        "Target specific runtime only (copilot, codex, vscode, cursor, opencode, gemini, claude, windsurf, intellij)"
     ),
 )
 @click.option("--exclude", help="Exclude specific runtime from installation")
@@ -961,7 +961,7 @@ def _handle_mcp_install(
     "global_",
     is_flag=True,
     default=False,
-    help="Install to user scope (~/.apm/) instead of the current project. MCP servers target global-capable runtimes only (Copilot CLI, Codex CLI).",
+    help="Install to user scope (~/.apm/) instead of the current project. MCP servers target global-capable runtimes only (Copilot CLI, Codex CLI, JetBrains Copilot).",
 )
 @click.option(
     "--ssh",
@@ -1550,7 +1550,7 @@ def install(  # noqa: PLR0913
             skill_subset_from_cli=bool(skill_names),
         )
 
-        apm_count, mcp_count, apm_diagnostics = _install_apm_packages(
+        apm_count, mcp_count, lsp_count, apm_diagnostics = _install_apm_packages(
             install_ctx,
             outcome,
         )
@@ -1559,6 +1559,7 @@ def install(  # noqa: PLR0913
             logger=logger,
             apm_count=apm_count,
             mcp_count=mcp_count,
+            lsp_count=lsp_count,
             apm_diagnostics=apm_diagnostics,
             force=force,
             elapsed_seconds=time.perf_counter() - install_started_at,
@@ -1639,7 +1640,7 @@ def _install_apm_packages(ctx, outcome):
             ``None`` when no explicit packages were passed).
 
     Returns:
-        Tuple of ``(apm_count, mcp_count, apm_diagnostics)``.
+        Tuple of ``(apm_count, mcp_count, lsp_count, apm_diagnostics)``.
     """
     logger = ctx.logger
 
@@ -1677,6 +1678,7 @@ def _install_apm_packages(ctx, outcome):
     # Determine what to install based on install mode
     should_install_apm = ctx.install_mode != InstallMode.MCP
     should_install_mcp = ctx.install_mode != InstallMode.APM
+    should_install_lsp = should_install_mcp
 
     # Show what will be installed if dry run
     if ctx.dry_run:
@@ -1711,7 +1713,7 @@ def _install_apm_packages(ctx, outcome):
             only_packages=ctx.only_packages,
             apm_dir=ctx.apm_dir,
         )
-        return 0, 0, None  # render_and_exit exits; this line is defensive
+        return 0, 0, 0, None  # render_and_exit exits; this line is defensive
 
     # Install APM dependencies first (if requested)
     apm_count = 0
@@ -1945,17 +1947,35 @@ def _install_apm_packages(ctx, outcome):
         # mcp_servers.  Restore the previous set so it is not lost.
         MCPIntegrator.update_lockfile(old_mcp_servers, _lock_path, mcp_configs=old_mcp_configs)
 
+    # -------------------------------------------------------------------------
+    # LSP integration (extracted to install/lsp/integration.py)
+    # -------------------------------------------------------------------------
+    from apm_cli.install.lsp import run_lsp_integration
+
+    lsp_count = run_lsp_integration(
+        apm_package=apm_package,
+        apm_modules_path=apm_modules_path,
+        lock_path=_lock_path,
+        existing_lock=_existing_lock,
+        project_root=ctx.project_root,
+        user_scope=(ctx.scope is InstallScope.USER),
+        should_install=should_install_lsp,
+        logger=logger,
+        diagnostics=apm_diagnostics,
+        target_context=(mcp_apm_config, ctx.target, ctx.scope),
+    )
+
     # Local .apm/ content integration is now handled inside the
     # install pipeline (phases/integrate.py + phases/post_deps_local.py,
     # refactor F3).  The duplicate target resolution, integrator
     # initialization, and inline stale-cleanup block that lived here
     # have been removed.
 
-    return apm_count, mcp_count, apm_diagnostics
+    return apm_count, mcp_count, lsp_count, apm_diagnostics
 
 
 def _post_install_summary(
-    *, logger, apm_count, mcp_count, apm_diagnostics, force, elapsed_seconds=None
+    *, logger, apm_count, mcp_count, lsp_count=0, apm_diagnostics, force, elapsed_seconds=None
 ):
     """Thin shim forwarding to :func:`apm_cli.install.summary.render_post_install_summary`.
 
@@ -1969,6 +1989,7 @@ def _post_install_summary(
         logger=logger,
         apm_count=apm_count,
         mcp_count=mcp_count,
+        lsp_count=lsp_count,
         apm_diagnostics=apm_diagnostics,
         force=force,
         elapsed_seconds=elapsed_seconds,

{apm_cli-0.17.0 → apm_cli-0.18.0}/src/apm_cli/commands/marketplace/__init__.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import builtins
 import json
+import logging
 import re
 import sys
 import traceback
@@ -49,6 +50,8 @@ from ...marketplace.yml_schema import load_marketplace_yml
 from ...utils.path_security import PathTraversalError, validate_path_segments
 from .._helpers import _get_console, _is_interactive
 
+logger = logging.getLogger(__name__)
+
 # Restore builtins shadowed by subcommand names
 list = builtins.list
 
@@ -83,6 +86,8 @@ class MarketplaceGroup(click.Group):
         "init",
         "check",
         "outdated",
+        "audit",
+        "doctor",
         "publish",
         "package",
         "migrate",
@@ -112,6 +117,8 @@ class MarketplaceGroup(click.Group):
                 cmd = self.get_command(ctx, name)
                 if cmd is None:
                     continue
+                if getattr(cmd, "hidden", False):
+                    continue
                 help_text = cmd.get_short_help_str(limit=150)
                 commands.append((name, help_text))
             if commands:
@@ -1025,15 +1032,36 @@ def _load_current_versions():
 def _extract_tag_versions(refs, entry, yml, include_prerelease):
     """Extract (SemVer, tag_name) pairs from remote refs for a package entry."""
     from ...marketplace._shared import iter_semver_tags
-    from ...marketplace.tag_pattern import build_tag_regex
+    from ...marketplace.tag_pattern import (
+        build_tag_regex,
+        infer_tag_pattern_from_refs,
+    )
+
+    def _collect(pattern: str) -> list:
+        tag_rx = (
+            build_tag_regex(pattern, name=entry.name)
+            if "{name}" in pattern
+            else build_tag_regex(pattern)
+        )
+        collected = []
+        for sv, tag_name, _ in iter_semver_tags(refs, tag_rx):
+            if sv.is_prerelease and not (include_prerelease or entry.include_prerelease):
+                continue
+            collected.append((sv, tag_name))
+        return collected
 
     pattern = entry.tag_pattern or yml.build.tag_pattern
-    tag_rx = build_tag_regex(pattern)
-    results = []
-    for sv, tag_name, _ in iter_semver_tags(refs, tag_rx):
-        if sv.is_prerelease and not (include_prerelease or entry.include_prerelease):
-            continue
-        results.append((sv, tag_name))
+    results = _collect(pattern)
+    if not results:
+        inferred = infer_tag_pattern_from_refs(refs, entry.name)
+        if inferred and inferred != pattern:
+            logger.debug(
+                "Configured tag pattern %r matched no tags for %s; inferred %r",
+                pattern,
+                entry.name,
+                inferred,
+            )
+            results = _collect(inferred)
     return results
 
 
@@ -1506,6 +1534,7 @@ def search(expression, limit, verbose):
         sys.exit(1)
 
 
+from .audit import audit  # noqa: E402
 from .check import check  # noqa: E402
 from .doctor import doctor  # noqa: E402
 from .init import init  # noqa: E402
@@ -1546,6 +1575,7 @@ __all__ = [
     "SemVer",
     "TargetResult",
     "add",
+    "audit",
     "browse",
     "check",
     "detect_config_source",

apm_cli-0.18.0/src/apm_cli/commands/marketplace/audit.py

@@ -0,0 +1,122 @@
+"""``apm marketplace audit`` command."""
+
+from __future__ import annotations
+
+import sys
+import traceback
+
+import click
+
+from ...core.command_logger import CommandLogger
+from ...marketplace.audit import FetchStatus, run_audit
+from ...marketplace.client import fetch_marketplace
+from ...marketplace.registry import get_marketplace_by_name
+from . import marketplace
+
+
+@marketplace.command(help="Check that plugin dependencies resolve through the marketplace")
+@click.argument("name", required=True)
+@click.option(
+    "--strict",
+    is_flag=True,
+    help="Exit non-zero when any plugin has bypass dependencies or fetch errors",
+)
+@click.option("--verbose", "-v", is_flag=True, help="Show detailed output")
+def audit(name, strict, verbose):
+    """Audit a registered marketplace's supply-chain pinning.
+
+    For each plugin in ``NAME``'s manifest, fetch the plugin's own
+    ``apm.yml`` (at its pinned ref) and warn when ``dependencies.apm``
+    entries use direct repo paths, which bypass the marketplace's
+    version pinning and make transitive deps track HEAD.
+    """
+    logger = CommandLogger("marketplace-audit", verbose=verbose)
+    try:
+        source = get_marketplace_by_name(name)
+        logger.start(f"Auditing marketplace '{name}'...", symbol="running")
+
+        manifest = fetch_marketplace(source, force_refresh=True)
+        n = len(manifest.plugins)
+        logger.progress(f"Checking {n} plugin{'' if n == 1 else 's'}...", symbol="info")
+
+        reports = run_audit(manifest, source)
+
+        ok_count = 0
+        bypass_total = 0
+        fetch_error_count = 0
+        skipped_count = 0
+
+        # Suppress the per-plugin section header when there is nothing to
+        # report and the user did not opt into verbose: in the all-clean
+        # default run the header would otherwise hang above an empty body.
+        has_findings = any(rep.fetch_status != FetchStatus.OK or rep.issues for rep in reports)
+
+        click.echo()
+        if has_findings or verbose:
+            click.echo("Audit Results:")
+        for rep in reports:
+            if rep.fetch_status == FetchStatus.OK:
+                if not rep.issues:
+                    ok_count += 1
+                    if verbose:
+                        logger.success(
+                            f"  {rep.plugin_name}: deps are marketplace-resolved",
+                            symbol="check",
+                        )
+                    continue
+                bypass_total += len(rep.issues)
+                if len(rep.issues) == 1:
+                    verb_phrase = "1 dependency bypasses"
+                else:
+                    verb_phrase = f"{len(rep.issues)} dependencies bypass"
+                logger.warning(
+                    f"  {rep.plugin_name}: {verb_phrase} the marketplace",
+                    symbol="warning",
+                )
+                for issue in rep.issues:
+                    click.echo(f"      - '{issue.dep}'")
+                    click.echo(f"        hint: {issue.suggestion}")
+            elif rep.fetch_status in (
+                FetchStatus.NO_MANIFEST,
+                FetchStatus.UNSUPPORTED_SOURCE,
+            ):
+                skipped_count += 1
+                if verbose:
+                    logger.verbose_detail(
+                        f"  {rep.plugin_name}: skipped ({rep.fetch_status.value}"
+                        f"{' - ' + rep.detail if rep.detail else ''})"
+                    )
+            else:
+                fetch_error_count += 1
+                logger.warning(
+                    f"  {rep.plugin_name}: could not verify "
+                    f"({rep.fetch_status.value}: {rep.detail})",
+                    symbol="warning",
+                )
+
+        click.echo()
+        warn_noun = "warning" if bypass_total == 1 else "warnings"
+        err_noun = "error" if fetch_error_count == 1 else "errors"
+        logger.success(
+            f"Summary: {ok_count} clean, {bypass_total} bypass {warn_noun}, "
+            f"{skipped_count} skipped, "
+            f"{fetch_error_count} unverifiable {err_noun}",
+            symbol="check",
+        )
+        if bypass_total:
+            click.echo()
+            click.echo(
+                "Marketplace refs (name@marketplace) pin transitive deps "
+                "through the catalogue so consumers get the same versions "
+                "you tested.  See: "
+                "https://microsoft.github.io/apm/reference/cli/marketplace/#apm-marketplace-audit-name"
+            )
+
+        if strict and (bypass_total or fetch_error_count):
+            sys.exit(1)
+
+    except Exception as e:
+        logger.error(f"Failed to audit marketplace: {e}")
+        logger.info("Run with --verbose for details.")
+        logger.verbose_detail(traceback.format_exc())
+        sys.exit(1)

{apm_cli-0.17.0 → apm_cli-0.18.0}/src/apm_cli/commands/outdated.py

@@ -16,12 +16,15 @@ from ..deps.outdated_row import OutdatedRow
 
 logger = logging.getLogger(__name__)
 
+# Fallback heuristic for _resolve_tag_pattern when inference misses plain tags.
 TAG_RE = re.compile(r"^v?\d+\.\d+\.\d+")
 
 
-def _is_tag_ref(ref: str) -> bool:
-    """Return True when *ref* looks like a semver tag (v1.2.3 or 1.2.3)."""
-    return bool(TAG_RE.match(ref)) if ref else False
+def _is_tag_ref(ref: str, package_name: str | None = None) -> bool:
+    """Return True when *ref* names a version tag (plain or patterned)."""
+    from ..marketplace.tag_pattern import is_version_tag_ref
+
+    return is_version_tag_ref(ref, package_name)
 
 
 def _strip_v(ref: str) -> str:
@@ -29,6 +32,57 @@ def _strip_v(ref: str) -> str:
     return ref[1:] if ref and ref.startswith("v") else (ref or "")
 
 
+def _package_basename(dep) -> str:
+    """Return the display name used in ``{name}`` tag patterns."""
+    if dep.marketplace_plugin_name:
+        return dep.marketplace_plugin_name
+    repo = dep.repo_url or ""
+    if not repo:
+        return ""
+    return repo.rstrip("/").split("/")[-1]
+
+
+def _resolve_tag_pattern(current_ref: str, package_name: str) -> str | None:
+    """Return the tag pattern for *current_ref*, or ``None`` if not a version tag."""
+    from ..marketplace.tag_pattern import infer_tag_pattern
+
+    inferred = infer_tag_pattern(current_ref, package_name)
+    if inferred:
+        logger.debug(
+            "Resolved tag pattern %r for %s from ref %s",
+            inferred,
+            package_name,
+            current_ref,
+        )
+        return inferred
+    if TAG_RE.match(current_ref or ""):
+        return "v{version}" if (current_ref or "").startswith("v") else "{version}"
+    return None
+
+
+def _semver_tag_candidates(tag_refs, pattern: str, package_name: str = ""):
+    """Return ``(SemVer, tag_name)`` pairs matching *pattern*, highest first."""
+    from ..marketplace.semver import SemVer, parse_semver
+    from ..marketplace.tag_pattern import build_tag_regex
+
+    tag_rx = (
+        build_tag_regex(pattern, name=package_name)
+        if "{name}" in pattern and package_name
+        else build_tag_regex(pattern)
+    )
+    candidates: list[tuple[SemVer, str]] = []
+    for remote_ref in tag_refs:
+        match = tag_rx.match(remote_ref.name)
+        if not match:
+            continue
+        version = match.group("version")
+        parsed = parse_semver(version)
+        if parsed is not None:
+            candidates.append((parsed, remote_ref.name))
+    candidates.sort(key=lambda pair: pair[0], reverse=True)
+    return candidates
+
+
 def _find_remote_tip(ref_name, remote_refs):
     """Find the tip SHA for a branch ref from remote refs.
 
@@ -189,7 +243,9 @@ def _check_one_dep(dep, downloader, verbose, registry_ctx=None):
             package=package_name, current=current_ref or "(none)", latest="-", status="unknown"
         )
 
-    is_tag = _is_tag_ref(current_ref)
+    package_basename = _package_basename(dep)
+    tag_pattern = _resolve_tag_pattern(current_ref, package_basename)
+    is_tag = tag_pattern is not None
 
     if is_tag:
         tag_refs = [r for r in remote_refs if r.ref_type == GitReferenceType.TAG]
@@ -202,12 +258,28 @@ def _check_one_dep(dep, downloader, verbose, registry_ctx=None):
                 source="git tags",
             )
 
-        latest_tag = tag_refs[0].name
-        current_ver = _strip_v(current_ref)
-        latest_ver = _strip_v(latest_tag)
+        from ..marketplace.tag_pattern import parse_tag_version
+
+        candidates = _semver_tag_candidates(tag_refs, tag_pattern, package_basename)
+        if not candidates:
+            return OutdatedRow(
+                package=package_name,
+                current=current_ref,
+                latest="-",
+                status="unknown",
+                source="git tags",
+            )
+
+        _, latest_tag = candidates[0]
+        current_ver = parse_tag_version(
+            current_ref, tag_pattern, name=package_basename
+        ) or _strip_v(current_ref)
+        latest_ver = parse_tag_version(latest_tag, tag_pattern, name=package_basename) or _strip_v(
+            latest_tag
+        )
 
         if is_newer_version(current_ver, latest_ver):
-            extra = [r.name for r in tag_refs[:10]] if verbose else []
+            extra = [name for _, name in candidates[:10]] if verbose else []
             return OutdatedRow(
                 package=package_name,
                 current=current_ref,