apm-cli 0.17.0__tar.gz → 0.19.0__tar.gz

{apm_cli-0.17.0 → apm_cli-0.19.0}/AUTHORS

@@ -4,6 +4,7 @@
 
 * Daniel Meppiel (@danielmeppiel) — Microsoft
 * Sergio Sisternes (@sergio-sisternes-epam) — EPAM Systems
+* Nadav Yogev (@nadav-y) — JFrog
 
 Maintainers' work on APM is supported by their employers. Project
 decisions are made in the interest of APM and its users, independent

{apm_cli-0.17.0/src/apm_cli.egg-info → apm_cli-0.19.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.17.0
+Version: 0.19.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License

{apm_cli-0.17.0 → apm_cli-0.19.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.17.0"
+version = "0.19.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/base.py

@@ -150,6 +150,21 @@ class MCPClientAdapter(ABC):
         self._last_env_placeholder_keys: set[str] = set()
         self._last_legacy_angle_vars: set[str] = set()
 
+    def _format_runtime_env_placeholder(self, name: str) -> str:
+        """Return the target runtime's env-var placeholder syntax for *name*."""
+        return "${" + name + "}"
+
+    def _translate_env_placeholder_for_runtime(self, value):
+        """Translate env-var placeholders to this adapter's runtime syntax."""
+        if not isinstance(value, str):
+            return value
+
+        def _to_runtime(match):
+            var_name = match.group(1) or match.group(2)
+            return self._format_runtime_env_placeholder(var_name)
+
+        return _ENV_PLACEHOLDER_RE.sub(_to_runtime, value)
+
     @property
     def project_root(self) -> Path:
         """Return the explicit project root or the current working directory."""
@@ -390,9 +405,7 @@ class MCPClientAdapter(ABC):
                     continue
                 if _has_env_placeholder(raw_value):
                     self._last_legacy_angle_vars.update(_extract_legacy_angle_vars(raw_value))
-                    translated[name] = _translate_env_placeholder(raw_value)
-                    # Record every ${VAR} in the translated value (handles
-                    # both ${env:VAR} -> ${VAR} and bare ${VAR} cases).
+                    translated[name] = self._translate_env_placeholder_for_runtime(raw_value)
                     placeholder_keys.extend(
                         m.group(1) for m in _ENV_VAR_RE.finditer(translated[name])
                     )
@@ -403,7 +416,7 @@ class MCPClientAdapter(ABC):
                 else:
                     # Literal value present in apm.yml -- replace with a
                     # runtime placeholder so the secret never touches disk.
-                    translated[name] = "${" + name + "}"
+                    translated[name] = self._format_runtime_env_placeholder(name)
                     placeholder_keys.append(name)
             self._last_env_placeholder_keys = set(placeholder_keys)
             return translated
@@ -421,7 +434,7 @@ class MCPClientAdapter(ABC):
                 if name in self._DEFAULT_GITHUB_ENV:
                     resolved[name] = self._DEFAULT_GITHUB_ENV[name]
                 else:
-                    resolved[name] = "${" + name + "}"
+                    resolved[name] = self._format_runtime_env_placeholder(name)
                     placeholder_keys.append(name)
             self._last_env_placeholder_keys = set(placeholder_keys)
             return resolved
@@ -510,7 +523,7 @@ class MCPClientAdapter(ABC):
             self._last_env_placeholder_keys.update(legacy_keys)
             for match in _ENV_VAR_RE.finditer(value):
                 self._last_env_placeholder_keys.add(match.group(1))
-            return _translate_env_placeholder(value)
+            return self._translate_env_placeholder_for_runtime(value)
 
         from rich.prompt import Prompt
 
@@ -560,7 +573,7 @@ class MCPClientAdapter(ABC):
 
         if self._supports_runtime_env_substitution:
             self._last_legacy_angle_vars.update(_extract_legacy_angle_vars(processed))
-            processed = _translate_env_placeholder(processed)
+            processed = self._translate_env_placeholder_for_runtime(processed)
         else:
             # Resolve only the legacy ``<VAR>`` form; newer syntaxes are
             # preserved verbatim for backward compatibility.
@@ -620,22 +633,25 @@ class MCPClientAdapter(ABC):
         return server_info
 
     @staticmethod
-    def _determine_config_key(server_url: str, server_name: str) -> str:
+    def _determine_config_key(server_url: str, server_name: str | None) -> str:
         """Return the configuration key to use for *server_url*/*server_name*.
 
-        The caller-supplied *server_name* takes precedence; if empty the last
-        path segment of *server_url* is used as a fallback, which mirrors the
-        convention ``owner/repo -> repo``.
+        The caller-supplied *server_name* takes precedence. If it is absent,
+        preserve npm-style scoped names such as ``@scope/name`` (one slash by
+        npm convention) while keeping the historical ``owner/repo -> repo``
+        fallback for registry paths.
 
         Args:
             server_url: Registry reference used as fallback source.
-            server_name: Explicit caller-supplied name (may be empty string).
+            server_name: Explicit caller-supplied name, if any.
 
         Returns:
             Non-empty configuration key string.
         """
         if server_name:
             return server_name
+        if server_url.startswith("@") and server_url.count("/") == 1:
+            return server_url
         if "/" in server_url:
             return server_url.split("/")[-1]
         return server_url

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/claude.py

@@ -239,12 +239,7 @@ class ClaudeClientAdapter(CopilotClientAdapter):
                 _rich_error(f"MCP server '{server_url}' not found in registry")
                 return False
 
-            if server_name:
-                config_key = server_name
-            elif "/" in server_url:
-                config_key = server_url.split("/")[-1]
-            else:
-                config_key = server_url
+            config_key = self._determine_config_key(server_url, server_name)
 
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)
             ok = self.update_config({config_key: server_config})

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/codex.py

@@ -150,19 +150,7 @@ class CodexClientAdapter(MCPClientAdapter):
             if server_info is None:
                 return False
 
-            # Determine the server name for configuration key
-            if server_name:
-                # Use explicitly provided server name
-                config_key = server_name
-            else:  # noqa: PLR5501
-                # Extract name from server_url (part after last slash)
-                # For URLs like "microsoft/azure-devops-mcp" -> "azure-devops-mcp"
-                # For URLs like "github/github-mcp-server" -> "github-mcp-server"
-                if "/" in server_url:  # noqa: SIM108
-                    config_key = server_url.split("/")[-1]
-                else:
-                    # Fallback to full server_url if no slash
-                    config_key = server_url
+            config_key = self._determine_config_key(server_url, server_name)
 
             # Generate server configuration with environment variable resolution
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/copilot.py

@@ -26,7 +26,9 @@ from .base import (
     _extract_legacy_angle_vars,
     _has_env_placeholder,
     _stringify_env_literal,
-    _translate_env_placeholder,
+)
+from .base import (
+    _translate_env_placeholder as _translate_env_placeholder,
 )
 
 
@@ -204,19 +206,7 @@ class CopilotClientAdapter(MCPClientAdapter):
             # Generate server configuration with environment and runtime variable resolution
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)
 
-            # Determine the server name for configuration key
-            if server_name:
-                # Use explicitly provided server name
-                config_key = server_name
-            else:  # noqa: PLR5501
-                # Extract name from server_url (part after last slash)
-                # For URLs like "microsoft/azure-devops-mcp" -> "azure-devops-mcp"
-                # For URLs like "github/github-mcp-server" -> "github-mcp-server"
-                if "/" in server_url:  # noqa: SIM108
-                    config_key = server_url.split("/")[-1]
-                else:
-                    # Fallback to full server_url if no slash
-                    config_key = server_url
+            config_key = self._determine_config_key(server_url, server_name)
 
             # Update configuration using the chosen key
             self.update_config({config_key: server_config})
@@ -678,9 +668,9 @@ class CopilotClientAdapter(MCPClientAdapter):
         # ({NAME: value-or-placeholder}); registry-sourced deps pass a list
         # of {name, description, required} dicts. Translate-mode handling
         # for the dict shape: each value is either already a placeholder
-        # (translate it to the canonical ${VAR} form) or a literal (record
-        # the key as a placeholder reference and emit ${NAME} so the
-        # value never lands on disk). See issue #1152.
+        # (translate it to the adapter's runtime form) or a literal
+        # (record the key as a placeholder reference and emit a runtime
+        # placeholder so the value never lands on disk). See issue #1152.
         if isinstance(env_vars, dict) and self._supports_runtime_env_substitution:
             translated = {}
             placeholder_keys = []
@@ -694,9 +684,7 @@ class CopilotClientAdapter(MCPClientAdapter):
                     continue
                 if _has_env_placeholder(raw_value):
                     self._last_legacy_angle_vars.update(_extract_legacy_angle_vars(raw_value))
-                    translated[name] = _translate_env_placeholder(raw_value)
-                    # Record every ${VAR} in the translated value (handles
-                    # both ${env:VAR} -> ${VAR} and bare ${VAR} cases).
+                    translated[name] = self._translate_env_placeholder_for_runtime(raw_value)
                     for match in _ENV_VAR_RE.finditer(translated[name]):
                         placeholder_keys.append(match.group(1))
                 elif name in default_github_env and raw_value == default_github_env[name]:
@@ -704,7 +692,7 @@ class CopilotClientAdapter(MCPClientAdapter):
                 else:
                     # Literal value present in apm.yml -- replace with a
                     # runtime placeholder so the secret never touches disk.
-                    translated[name] = "${" + name + "}"
+                    translated[name] = self._format_runtime_env_placeholder(name)
                     placeholder_keys.append(name)
             self._last_env_placeholder_keys = set(placeholder_keys)
             return translated
@@ -722,10 +710,9 @@ class CopilotClientAdapter(MCPClientAdapter):
                     # Non-secret literal default -- preserve as-is.
                     resolved[name] = default_github_env[name]
                 else:
-                    # Emit a runtime-substitution placeholder; Copilot CLI
-                    # resolves ``${NAME}`` from the host environment at
-                    # server-start. APM never reads or stores the value.
-                    resolved[name] = "${" + name + "}"
+                    # Emit a runtime-substitution placeholder; APM never reads
+                    # or stores the value.
+                    resolved[name] = self._format_runtime_env_placeholder(name)
                     placeholder_keys.append(name)
             # Record for the post-install summary line and the
             # security-improvement notice.
@@ -783,7 +770,7 @@ class CopilotClientAdapter(MCPClientAdapter):
             # them (the env-block path tracks via _resolve_environment_variables).
             for match in _ENV_VAR_RE.finditer(value):
                 self._last_env_placeholder_keys.add(match.group(1))
-            return _translate_env_placeholder(value)
+            return self._translate_env_placeholder_for_runtime(value)
 
         import sys
 

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/adapters/client/intellij.py

@@ -67,9 +67,10 @@ class IntelliJClientAdapter(CopilotClientAdapter):
 
     JetBrains Copilot stores server definitions in a user-scope JSON file
     with a ``"servers"`` top-level key (not ``"mcpServers"``).  This adapter
-    inherits all registry-resolution, env-var handling, and config read/write
-    from :class:`CopilotClientAdapter` and overrides only the config path and
-    ``mcp_servers_key`` so the parent methods operate on the correct key.
+    inherits registry-resolution and config read/write from
+    :class:`CopilotClientAdapter` and overrides the config path,
+    ``mcp_servers_key``, and runtime env-var placeholder syntax so the parent
+    methods operate on the correct schema.
     """
 
     supports_user_scope: bool = True
@@ -77,9 +78,13 @@ class IntelliJClientAdapter(CopilotClientAdapter):
     target_name: str = "intellij"
     mcp_servers_key: str = "servers"
 
-    # JetBrains runtime-substitution support has not yet been audited.
-    # Pin to install-time resolution for safety; revisit in a follow-up.
-    _supports_runtime_env_substitution: bool = False
+    # JetBrains Copilot resolves ${env:VAR} placeholders in mcp.json at
+    # server-start, so APM must not bake matching host secrets to disk.
+    _supports_runtime_env_substitution: bool = True
+
+    def _format_runtime_env_placeholder(self, name: str) -> str:
+        """Return JetBrains Copilot's native env-var placeholder syntax."""
+        return "${env:" + name + "}"
 
     # ------------------------------------------------------------------ #
     # Config path

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/bundle/lockfile_enrichment.py

@@ -51,6 +51,9 @@ _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
     "agent-skills": {
         ".github/skills/": ".agents/skills/",
     },
+    "openclaw": {
+        ".github/skills/": ".agents/skills/",
+    },
 }
 
 

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/cli.py

@@ -4,6 +4,7 @@ Thin wiring layer  -- all command logic lives in ``apm_cli.commands.*`` modules.
 """
 
 import ctypes
+import logging
 import os
 import sys
 import warnings
@@ -61,6 +62,48 @@ _CLI_EPILOG = (
 )
 
 
+def _configure_logging(verbose: bool = False) -> None:
+    """Configure stdlib logging for the ``apm_cli`` package.
+
+    Two mechanisms activate debug-level output (either is sufficient):
+
+    * ``--verbose`` / ``-v`` flag on the ``apm`` command.
+    * ``APM_LOG_LEVEL=DEBUG`` environment variable (accepts any stdlib
+      level name: DEBUG, INFO, WARNING, ERROR, CRITICAL).
+
+    When neither is set the ``apm_cli`` logger defaults to WARNING so
+    routine runs stay silent.  A :class:`~apm_cli.core.auth.SecretRedactionFilter`
+    is always installed on the ``apm_cli`` logger to strip token-bearing
+    exception strings from debug records regardless of which mechanism
+    activated debug mode.
+    """
+    env_level_str = os.environ.get("APM_LOG_LEVEL", "").strip().upper()
+    env_level: int | None = (
+        getattr(logging, env_level_str, None) if env_level_str.isalpha() else None
+    )
+
+    if verbose:
+        level = logging.DEBUG
+    elif env_level is not None:
+        level = env_level
+    else:
+        level = logging.WARNING
+
+    logging.basicConfig(
+        level=level,
+        format="%(levelname)s %(name)s %(message)s",
+        stream=sys.stderr,
+    )
+    apm_logger = logging.getLogger("apm_cli")
+    apm_logger.setLevel(level)
+
+    # Install secret-redaction filter (idempotent: skip if already present).
+    from apm_cli.core.auth import SecretRedactionFilter
+
+    if not any(isinstance(f, SecretRedactionFilter) for f in apm_logger.filters):
+        apm_logger.addFilter(SecretRedactionFilter())
+
+
 @click.group(
     help="Agent Package Manager (APM): The package manager for AI-Native Development",
     epilog=_CLI_EPILOG,
@@ -73,10 +116,22 @@ _CLI_EPILOG = (
     is_eager=True,
     help="Show version and exit.",
 )
+@click.option(
+    "--verbose",
+    "-v",
+    is_flag=True,
+    default=False,
+    help="Enable debug-level logging (equivalent to APM_LOG_LEVEL=DEBUG).",
+)
 @click.pass_context
-def cli(ctx):
+def cli(ctx, verbose: bool) -> None:
     """Main entry point for the APM CLI."""
     ctx.ensure_object(dict)
+    ctx.obj["verbose"] = verbose
+
+    if verbose:
+        # Upgrade to DEBUG when the flag is set; env-var path runs in main().
+        _configure_logging(verbose=True)
 
     # Suppress only the agents-target deprecation warning so CLI users see
     # the formatted logger.warning() in the install phase, not a double print.
@@ -267,6 +322,7 @@ def _configure_encoding() -> None:
 
 def main():
     """Main entry point for the CLI."""
+    _configure_logging()  # honours APM_LOG_LEVEL env var; --verbose upgrades in cli()
     _configure_encoding()
     try:
         cli(obj={})

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/commands/audit.py

@@ -103,6 +103,39 @@ def _has_actionable_findings(
     )
 
 
+def _finding_source(finding: ScanFinding) -> str:
+    """Derive the scanner source from a finding's category prefix."""
+    if "/" in finding.category:
+        prefix = finding.category.split("/", 1)[0]
+        if prefix != "apm":
+            return prefix
+    return "apm"
+
+
+def _has_external_findings(rows: list[ScanFinding]) -> bool:
+    """Return True if any finding originates from an external scanner."""
+    return any(_finding_source(f) != "apm" for f in rows)
+
+
+def _source_counts(rows: list[ScanFinding]) -> dict[str, int]:
+    """Count findings by source for the table title."""
+    counts: dict[str, int] = {}
+    for f in rows:
+        src = _finding_source(f)
+        counts[src] = counts.get(src, 0) + 1
+    return counts
+
+
+def _findings_title(rows: list[ScanFinding], has_external: bool) -> str:
+    """Build the findings table title, with per-source counts when mixed."""
+    base = f"{STATUS_SYMBOLS['search']} Audit Findings"
+    if not has_external:
+        return f"{STATUS_SYMBOLS['search']} Content Scan Findings"
+    counts = _source_counts(rows)
+    parts = [f"{src}: {n}" for src, n in sorted(counts.items())]
+    return f"{base}  ({', '.join(parts)})"
+
+
 def _render_findings_table(
     findings_by_file: dict[str, list[ScanFinding]],
     verbose: bool = False,
@@ -124,6 +157,9 @@ def _render_findings_table(
     if not rows:
         return
 
+    has_external = _has_external_findings(rows)
+    title = _findings_title(rows, has_external)
+
     if console:
         try:
             from rich.table import Table
@@ -131,14 +167,19 @@ def _render_findings_table(
             from ..security.audit_report import relative_path_for_report
 
             table = Table(
-                title=f"{STATUS_SYMBOLS['search']} Content Scan Findings",
+                title=title,
                 show_header=True,
                 header_style="bold cyan",
             )
             table.add_column("Severity", style="bold", width=10)
+            if has_external:
+                table.add_column("Source", style="cyan", width=14)
             table.add_column("File", style="white")
             table.add_column("Location", style="dim", width=10)
-            table.add_column("Codepoint", style="bold white", width=10)
+            if has_external:
+                table.add_column("Category", style="bold white")
+            else:
+                table.add_column("Codepoint", style="bold white", width=10)
             table.add_column("Description", style="white")
 
             sev_styles = {
@@ -147,12 +188,26 @@ def _render_findings_table(
                 "info": "dim",
             }
             for f in rows:
+                category_or_codepoint = (
+                    f.category.split("/", 1)[1]
+                    if has_external and "/" in f.category
+                    else f.category
+                    if has_external
+                    else f.codepoint
+                )
+                row_cells = [f.severity.upper()]
+                if has_external:
+                    row_cells.append(_finding_source(f))
+                row_cells.extend(
+                    [
+                        relative_path_for_report(f.file),
+                        f"{f.line}:{f.column}",
+                        category_or_codepoint,
+                        f.description,
+                    ]
+                )
                 table.add_row(
-                    f.severity.upper(),
-                    relative_path_for_report(f.file),
-                    f"{f.line}:{f.column}",
-                    f.codepoint,
-                    f.description,
+                    *row_cells,
                     style=sev_styles.get(f.severity, "white"),
                 )
             console.print()
@@ -163,18 +218,17 @@ def _render_findings_table(
 
     # Fallback: plain text
     _rich_echo("")
-    _rich_echo(
-        f"{STATUS_SYMBOLS['search']} Content Scan Findings",
-        color="cyan",
-        bold=True,
-    )
+    _rich_echo(title, color="cyan", bold=True)
     for f in rows:
         sev_label = f.severity.upper()
         color = (
             "red" if f.severity == "critical" else ("yellow" if f.severity == "warning" else "dim")
         )
+        source_part = f" [{_finding_source(f)}]" if has_external else ""
+        detail = f.category if has_external else f.codepoint
         _rich_echo(
-            f"  {sev_label:<10} {f.file} {f.line}:{f.column}  {f.codepoint}  {f.description}",
+            f"  {sev_label:<10}{source_part} {f.file} {f.line}:{f.column}  {detail}  "
+            f"{f.description}",
             color=color,
         )
 
@@ -669,7 +723,7 @@ def _run_external_scanners(
         require_external_scanners_enabled("Ingesting external scanners with --external")
     except ExternalScannersFeatureDisabledError as exc:
         logger.error(str(exc))
-        sys.exit(2)
+        sys.exit(3)
 
     try:
         return run_external_scanners(
@@ -681,7 +735,7 @@ def _run_external_scanners(
         )
     except ExternalScanError as exc:
         logger.error(str(exc))
-        sys.exit(2)
+        sys.exit(3)
 
 
 def _audit_content_scan(
@@ -713,8 +767,9 @@ def _audit_content_scan(
 
     # --format json/sarif/markdown is incompatible with --strip / --dry-run
     if effective_format != "text" and (strip or dry_run):
-        logger.error(f"--format {effective_format} cannot be combined with --strip or --dry-run")
-        sys.exit(1)
+        raise click.UsageError(
+            f"--format {effective_format} cannot be combined with --strip or --dry-run"
+        )
 
     if file_path:
         # -- File mode: scan a single arbitrary file --
@@ -997,6 +1052,7 @@ def _audit_content_scan(
     help=(
         "Ingest findings from an external SARIF-native scanner "
         "(repeatable). Names: skillspector, sarif. "
+        "Not supported with --ci. "
         "Requires 'apm experimental enable external-scanners'. [experimental]"
     ),
 )
@@ -1070,6 +1126,8 @@ def audit(  # noqa: PLR0913 -- Click handler
            (including drift in --ci mode)
         2  Warning-only findings (suspicious but not critical), or
            usage error (mutually exclusive flags)
+        3  Configuration or infrastructure error (experimental feature
+           disabled, external scanner not installed or unavailable)
 
     \b
     Examples:
@@ -1084,6 +1142,8 @@ def audit(  # noqa: PLR0913 -- Click handler
         apm audit --ci -f json         # JSON CI report
         apm audit --ci -f sarif        # SARIF for GitHub Code Scanning
         apm audit -o report.sarif      # Write SARIF to file
+        apm audit --external skillspector                    # SkillSpector
+        apm audit --external sarif --external-sarif r.sarif  # Any SARIF
     """
     project_root = Path.cwd()
     logger = CommandLogger("audit", verbose=verbose)
@@ -1110,17 +1170,17 @@ def audit(  # noqa: PLR0913 -- Click handler
         if verbose:
             logger.warning("--verbose has no effect in --ci mode (output is structured)")
         if strip or dry_run or file_path or package:
-            logger.error("--ci cannot be combined with --strip, --dry-run, --file, or PACKAGE")
-            sys.exit(1)
+            raise click.UsageError(
+                "--ci cannot be combined with --strip, --dry-run, --file, or PACKAGE"
+            )
         if output_format == "markdown":
             logger.error("--ci does not support --format markdown. Use json or sarif.")
             sys.exit(1)
         if external:
-            logger.error(
+            raise click.UsageError(
                 "--ci does not support --external scanners yet. "
                 "Run external scanners in bare 'apm audit' mode."
             )
-            sys.exit(1)
 
         _audit_ci_gate(cfg, policy_source, no_cache, no_policy, no_fail_fast, no_drift)
         return  # _audit_ci_gate calls sys.exit; return guards against fall-through
@@ -1129,8 +1189,7 @@ def audit(  # noqa: PLR0913 -- Click handler
     # They cannot be combined with --strip/--dry-run (APM only knows how to
     # strip the Unicode characters its own scanner detects).
     if external and (strip or dry_run):
-        logger.error("--external cannot be combined with --strip or --dry-run")
-        sys.exit(1)
+        raise click.UsageError("--external cannot be combined with --strip or --dry-run")
     if external_sarif and not external:
         raise click.UsageError("--external-sarif requires '--external sarif'")
     # Orphan-flag guards: scanner-config flags are meaningless without a

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/commands/compile/cli.py

@@ -234,10 +234,21 @@ def _resolve_compile_target(target):
                 families.add("agents")
 
         if len(families) >= 2:
-            # Single-target copilot collapses {"vscode","agents"} to bare
-            # "vscode" for routing parity with single-string -t copilot.
+            # Collapse {"vscode","agents"} to bare "vscode" ONLY when the
+            # original target list contains no non-Copilot agents-family
+            # targets (e.g. codex, opencode, windsurf).  When mixed targets
+            # like [copilot, codex] are requested, keep the frozenset so
+            # downstream dedup logic knows non-Copilot targets also consume
+            # AGENTS.md (issue #1678).
             if families == {"vscode", "agents"}:
-                return "vscode"
+                _vscode_names = {"copilot", "vscode", "agents"}
+                has_non_vscode_agents = any(
+                    name in target_set
+                    for name, profile in KNOWN_TARGETS.items()
+                    if profile.compile_family == "agents" and name not in _vscode_names
+                )
+                if not has_non_vscode_agents:
+                    return "vscode"
             return frozenset(families)
         if "claude" in families:
             return "claude"

{apm_cli-0.17.0 → apm_cli-0.19.0}/src/apm_cli/commands/experimental.py

@@ -244,7 +244,7 @@ def enable_flag(ctx, name: str, verbose: bool):
     from ..core.experimental import is_enabled
 
     if is_enabled(normalised):
-        logger.warning(f"{display_name(normalised)} is already enabled.")
+        logger.progress(f"{display_name(normalised)} is already enabled.")
         return
 
     flag = _enable_flag(normalised)
@@ -274,7 +274,7 @@ def disable_flag(ctx, name: str, verbose: bool):
     from ..core.experimental import is_enabled
 
     if not is_enabled(normalised):
-        logger.warning(f"{display_name(normalised)} is already disabled.")
+        logger.progress(f"{display_name(normalised)} is already disabled.")
         return
 
     _disable_flag(normalised)