apm-cli 0.20.0__tar.gz → 0.22.0__tar.gz

{apm_cli-0.20.0/src/apm_cli.egg-info → apm_cli-0.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.20.0
+Version: 0.22.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -149,6 +149,7 @@ Agent context is executable in effect — a prompt is a program for an LLM. APM
 
 - **[Content security](https://microsoft.github.io/apm/enterprise/security/)** — `apm install` blocks compromised packages before agents read them; `apm audit` runs the same checks on demand
 - **[Lockfile integrity](https://microsoft.github.io/apm/enterprise/governance/)** — `apm.lock` records resolved sources and content hashes for full provenance
+- **[SBOM export](https://microsoft.github.io/apm/reference/cli/lock/)** — `apm lock export --format cyclonedx|spdx` emits a standard inventory of what reached disk, straight from the lockfile — provenance for procurement, not a compliance attestation
 - **[Drift detection](https://microsoft.github.io/apm/guides/drift-detection/)** — `apm audit` rebuilds your agent context in scratch and diffs it against your working tree to catch hand-edits before they ship
 - **[MCP trust boundaries](https://microsoft.github.io/apm/guides/mcp-servers/)** — transitive MCP servers require explicit consent
 
@@ -156,6 +157,8 @@ Agent context is executable in effect — a prompt is a program for an LLM. APM
 
 `apm-policy.yml` lets a security team say *"these are the only sources, scopes, and primitives this org will allow"* and have every `apm install` enforce it — with tighten-only inheritance from enterprise to org to repo, a published bypass contract, and audit-mode CI gates.
 
+apm-policy.yml governs what gets installed; your agent harness governs what runs. The two planes do not overlap.
+
 - **[Governance Guide](https://microsoft.github.io/apm/enterprise/governance-guide/)** — the canonical enterprise reference: enforcement points, bypass contract, air-gapped story, failure semantics, rollout playbook
 - **[Policy reference](https://microsoft.github.io/apm/enterprise/policy-reference/)** — every check, every field, every default
 - **[Adoption playbook](https://microsoft.github.io/apm/enterprise/adoption-playbook/)** — staged rollout from warn to block across hundreds of repos

{apm_cli-0.20.0 → apm_cli-0.22.0}/README.md

@@ -81,6 +81,7 @@ Agent context is executable in effect — a prompt is a program for an LLM. APM
 
 - **[Content security](https://microsoft.github.io/apm/enterprise/security/)** — `apm install` blocks compromised packages before agents read them; `apm audit` runs the same checks on demand
 - **[Lockfile integrity](https://microsoft.github.io/apm/enterprise/governance/)** — `apm.lock` records resolved sources and content hashes for full provenance
+- **[SBOM export](https://microsoft.github.io/apm/reference/cli/lock/)** — `apm lock export --format cyclonedx|spdx` emits a standard inventory of what reached disk, straight from the lockfile — provenance for procurement, not a compliance attestation
 - **[Drift detection](https://microsoft.github.io/apm/guides/drift-detection/)** — `apm audit` rebuilds your agent context in scratch and diffs it against your working tree to catch hand-edits before they ship
 - **[MCP trust boundaries](https://microsoft.github.io/apm/guides/mcp-servers/)** — transitive MCP servers require explicit consent
 
@@ -88,6 +89,8 @@ Agent context is executable in effect — a prompt is a program for an LLM. APM
 
 `apm-policy.yml` lets a security team say *"these are the only sources, scopes, and primitives this org will allow"* and have every `apm install` enforce it — with tighten-only inheritance from enterprise to org to repo, a published bypass contract, and audit-mode CI gates.
 
+apm-policy.yml governs what gets installed; your agent harness governs what runs. The two planes do not overlap.
+
 - **[Governance Guide](https://microsoft.github.io/apm/enterprise/governance-guide/)** — the canonical enterprise reference: enforcement points, bypass contract, air-gapped story, failure semantics, rollout playbook
 - **[Policy reference](https://microsoft.github.io/apm/enterprise/policy-reference/)** — every check, every field, every default
 - **[Adoption playbook](https://microsoft.github.io/apm/enterprise/adoption-playbook/)** — staged rollout from warn to block across hundreds of repos

{apm_cli-0.20.0 → apm_cli-0.22.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.20.0"
+version = "0.22.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -105,6 +105,9 @@ max-returns = 12       # Stage 1 (was 18)
 # Stage 1 (was 100). Stage 2 target: <=20 (McCabe industry standard).
 max-complexity = 50
 
+[tool.ruff.lint.isort]
+known-first-party = ["apm_cli"]
+
 [tool.ruff.lint.per-file-ignores]
 # Subprocess calls are intentional in a CLI tool
 "src/apm_cli/**" = ["S603", "S607"]

apm_cli-0.22.0/src/apm_cli/adapters/client/antigravity.py

@@ -0,0 +1,54 @@
+"""Antigravity CLI (agy) implementation of MCP client adapter.
+
+Antigravity CLI is Google's Gemini-derived agentic CLI.  Unlike Gemini
+CLI (which stores MCP servers in ``settings.json``), Antigravity reads a
+dedicated ``mcp_config.json`` with an ``mcpServers`` key -- the same JSON
+schema, a different file:
+
+.. code-block:: json
+
+   {
+     "mcpServers": {
+       "server-name": {
+         "command": "npx",
+         "args": ["-y", "@modelcontextprotocol/server-foo"],
+         "env": { "KEY": "value" }
+       }
+     }
+   }
+
+Scope resolution: project scope writes to
+``<project_root>/.agents/mcp_config.json`` (opt-in -- the directory must
+already exist).  User scope writes to ``~/.gemini/config/mcp_config.json``
+unconditionally, creating the directory if needed.
+
+Ref: https://antigravity.google/docs/mcp
+"""
+
+from pathlib import Path
+
+from .gemini import GeminiClientAdapter
+
+
+class AntigravityClientAdapter(GeminiClientAdapter):
+    """Antigravity CLI MCP client adapter.
+
+    Reuses GeminiClientAdapter's ``_format_server_config`` and
+    ``configure_mcp_server`` (identical ``mcpServers`` JSON schema) and
+    overrides only the config directory, the config filename, and the
+    display name.  Antigravity writes MCP servers to a dedicated
+    ``mcp_config.json`` rather than ``settings.json``.
+    """
+
+    supports_user_scope: bool = True
+    target_name: str = "antigravity"
+
+    def _get_config_dir(self) -> Path:
+        """Return the ``.agents`` or ``~/.gemini/config`` directory."""
+        if self.user_scope:
+            return Path.home() / ".gemini" / "config"
+        return self.project_root / ".agents"
+
+    def get_config_path(self):
+        """Return the path to ``mcp_config.json`` for the active scope."""
+        return str(self._get_config_dir() / "mcp_config.json")

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/adapters/client/base.py

@@ -6,6 +6,7 @@ from abc import ABC, abstractmethod
 from pathlib import Path
 from typing import Any, ClassVar
 
+from ...models.dependency.mcp import _RESERVED_EXTRA_KEYS
 from ...utils.console import _rich_error, _rich_warning
 
 _INPUT_VAR_RE = re.compile(r"\$\{input:([^}]+)\}")
@@ -28,6 +29,15 @@ _ENV_PLACEHOLDER_RE = re.compile(r"<([A-Z_][A-Z0-9_]*)>|" + _ENV_VAR_RE.pattern)
 # deprecation warnings across all servers in a single install run.
 _LEGACY_ANGLE_VAR_RE = re.compile(r"<([A-Z_][A-Z0-9_]*)>")
 
+# Config keys that ``_extra`` passthrough must NEVER set on a rendered harness
+# config. Covers the modeled MCP fields (imported single-source from the model)
+# plus harness-specific aliases that mirror a modeled field under a different
+# name -- e.g. Codex emits ``http_headers`` for remote auth headers, which must
+# not be injectable via passthrough. Enforced unconditionally per adapter path
+# (NOT guarded by "key absent from config"), so it also closes paths that do not
+# pre-set the key. Security boundary for PR #1765 / issue #1670.
+_EXTRA_DENYLIST = _RESERVED_EXTRA_KEYS | frozenset({"http_headers"})
+
 
 def registry_field_is_required(field: dict[str, Any]) -> bool:
     """Return True unless registry metadata explicitly marks a field optional."""
@@ -118,6 +128,29 @@ class MCPClientAdapter(ABC):
     # (e.g. ``VSCodeClientAdapter``) that have no ``KNOWN_TARGETS`` entry.
     mcp_servers_key: str = ""
 
+    @staticmethod
+    def _merge_extra(config: dict, server_info: dict) -> dict:
+        """Merge harness-specific ``_extra`` keys from server_info into config.
+
+        Two guards apply:
+
+        * Denylist (unconditional): a key naming a modeled MCP field -- or a
+          harness alias of one (see ``_EXTRA_DENYLIST``) -- is dropped on EVERY
+          path, even when the config does not already carry it. This stops a
+          passthrough value from shadowing/redirecting a modeled field on
+          adapter paths that start empty or set only a subset of keys.
+        * Shadow guard: a non-reserved key is appended only when absent, so it
+          never overwrites a value the adapter set itself.
+        """
+        extra = server_info.get("_extra")
+        if extra and isinstance(extra, dict):
+            for k, v in extra.items():
+                if k in _EXTRA_DENYLIST:
+                    continue
+                if k not in config:
+                    config[k] = v
+        return config
+
     # Whether this adapter's config path is user/global-scoped (e.g.
     # ``~/.copilot/``) rather than workspace-scoped (e.g. ``.vscode/``).
     # Adapters that target a global path should override this to ``True``

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/adapters/client/codex.py

@@ -10,6 +10,7 @@ import toml
 from ...registry.client import SimpleRegistryClient
 from ...registry.integration import RegistryIntegration
 from ...utils.console import _rich_success, _rich_warning
+from ...utils.path_security import PathTraversalError
 from ._mcp_runtime_args import process_v01_value_hint_arg
 from .base import MCPClientAdapter
 
@@ -49,13 +50,22 @@ class CodexClientAdapter(MCPClientAdapter):
         self.registry_client = SimpleRegistryClient(registry_url)
         self.registry_integration = RegistryIntegration(registry_url)
 
-    def _get_codex_dir(self):
+    def _get_codex_dir(self) -> Path:
         """Return the root directory used for Codex config in the current scope."""
         if self.user_scope:
+            codex_home = os.environ.get("CODEX_HOME", "")
+            if codex_home.strip():
+                codex_home_path = Path(codex_home).expanduser()
+                if not codex_home_path.is_absolute():
+                    raise PathTraversalError(
+                        "CODEX_HOME is set to a non-absolute path; cannot locate the "
+                        "Codex CLI configuration directory."
+                    )
+                return codex_home_path
             return Path.home() / ".codex"
         return self.project_root / ".codex"
 
-    def get_config_path(self):
+    def get_config_path(self) -> str:
         """Get the path to the Codex CLI MCP configuration file.
 
         Returns:
@@ -219,6 +229,7 @@ class CodexClientAdapter(MCPClientAdapter):
                 return self.normalize_project_arg(arg)
 
             config["args"] = [_process_stdio_arg(arg) for arg in raw.get("args") or []]
+            self._merge_extra(config, server_info)
             return config
 
         # Remote MCP handling.
@@ -273,6 +284,7 @@ class CodexClientAdapter(MCPClientAdapter):
             if http_headers:
                 remote_config["http_headers"] = http_headers
                 self._warn_input_variables(http_headers, server_name, "Codex CLI")
+            self._merge_extra(remote_config, server_info)
             return remote_config
 
         if not packages:
@@ -320,7 +332,7 @@ class CodexClientAdapter(MCPClientAdapter):
                     all_args = processed_runtime_args + processed_package_args
                     if all_args:
                         # If runtime_arguments already include the package (bare or
-                        # versioned), use them as-is — they are authoritative from
+                        # versioned), use them as-is -- they are authoritative from
                         # the registry and may carry a version pin.
                         has_pkg = any(
                             a == package_name or a.startswith(f"{package_name}@") for a in all_args
@@ -361,6 +373,7 @@ class CodexClientAdapter(MCPClientAdapter):
                         resolved_env,
                     )
 
+        self._merge_extra(config, server_info)
         return config
 
     def _process_arguments(  # pylint: disable=duplicate-code  # structural similarity with copilot adapter is intentional

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/adapters/client/copilot.py

@@ -442,6 +442,7 @@ class CopilotClientAdapter(MCPClientAdapter):
             tools_override = server_info.get("_apm_tools_override")
             if tools_override:
                 config["tools"] = tools_override
+            self._merge_extra(config, server_info)
             return config
 
         # Check for remote endpoints first (registry-defined priority)
@@ -484,6 +485,7 @@ class CopilotClientAdapter(MCPClientAdapter):
             if tools_override:
                 config["tools"] = tools_override
 
+            self._merge_extra(config, server_info)
             return config
 
         # Get packages from server info
@@ -507,6 +509,7 @@ class CopilotClientAdapter(MCPClientAdapter):
         if tools_override:
             config["tools"] = tools_override
 
+        self._merge_extra(config, server_info)
         return config
 
     def _apply_auth_and_headers(

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/adapters/client/cursor.py

@@ -148,6 +148,7 @@ class CursorClientAdapter(CopilotClientAdapter):
                 else arg
                 for arg in args
             ]
+            self._merge_extra(config, server_info)
             return config
 
         # --- remote endpoints ---
@@ -169,6 +170,7 @@ class CursorClientAdapter(CopilotClientAdapter):
             config["url"] = (remote.get("url") or "").strip()
 
             self._apply_auth_and_headers(config, remote, server_info, env_overrides, "Cursor")
+            self._merge_extra(config, server_info)
             return config
 
         # --- local packages ---
@@ -194,6 +196,7 @@ class CursorClientAdapter(CopilotClientAdapter):
                     f"{[p.get('registry_name', 'unknown') for p in packages]}."
                 )
 
+        self._merge_extra(config, server_info)
         return config
 
     # ------------------------------------------------------------------ #

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/adapters/client/gemini.py

@@ -61,7 +61,7 @@ class GeminiClientAdapter(CopilotClientAdapter):
     # revisit in a follow-up.
     _supports_runtime_env_substitution: bool = False
 
-    def _get_gemini_dir(self) -> Path:
+    def _get_config_dir(self) -> Path:
         """Return the ``.gemini`` directory for the active scope."""
         if self.user_scope:
             return Path.home() / ".gemini"
@@ -69,22 +69,24 @@ class GeminiClientAdapter(CopilotClientAdapter):
 
     def get_config_path(self):
         """Return the path to ``settings.json`` for the active scope."""
-        return str(self._get_gemini_dir() / "settings.json")
+        return str(self._get_config_dir() / "settings.json")
 
     def update_config(self, config_updates):
         """Merge *config_updates* into the ``mcpServers`` section of settings.json.
 
-        Project scope is opt-in: if ``<project_root>/.gemini/`` does not
+        Project scope is opt-in: if the target config directory does not
         exist, this method returns silently. User scope always writes,
-        creating ``~/.gemini/`` if needed.
+        creating the directory if needed.
 
         Preserves all other top-level keys in settings.json (theme, tools,
         hooks, etc.).
         """
-        gemini_dir = self._get_gemini_dir()
-        if not self.user_scope and not gemini_dir.is_dir():
+        config_dir = self._get_config_dir()
+        if not self.user_scope and not config_dir.is_dir():
             logger.debug(
-                "Skipping Gemini project-scope write -- %s does not exist (opt-in)", gemini_dir
+                "Skipping %s project-scope write -- %s does not exist (opt-in)",
+                self.target_name,
+                config_dir,
             )
             return
 
@@ -97,7 +99,9 @@ class GeminiClientAdapter(CopilotClientAdapter):
             current_config["mcpServers"][name] = entry
 
         if not config_path.parent.is_dir():
-            logger.debug("Creating %s for Gemini CLI user configuration", config_path.parent)
+            logger.debug(
+                "Creating %s for %s user configuration", config_path.parent, self.target_name
+            )
         config_path.parent.mkdir(parents=True, exist_ok=True)
         with open(config_path, "w", encoding="utf-8") as f:
             json.dump(current_config, f, indent=2)
@@ -151,13 +155,16 @@ class GeminiClientAdapter(CopilotClientAdapter):
                     raw["env"], env_overrides=env_overrides
                 )
                 config["env"] = resolved_env_for_args
-                self._warn_input_variables(raw["env"], server_info.get("name", ""), "Gemini CLI")
+                self._warn_input_variables(
+                    raw["env"], server_info.get("name", ""), self.target_name
+                )
             config["args"] = [
                 self._resolve_variable_placeholders(arg, resolved_env_for_args, runtime_vars)
                 if isinstance(arg, str)
                 else arg
                 for arg in raw.get("args") or []
             ]
+            self._merge_extra(config, server_info)
             return config
 
         # --- remote endpoints ---
@@ -170,7 +177,7 @@ class GeminiClientAdapter(CopilotClientAdapter):
                 transport = "http"
             elif transport not in ("sse", "http", "streamable-http"):
                 raise ValueError(
-                    f"Unsupported remote transport '{transport}' for Gemini. "
+                    f"Unsupported remote transport '{transport}' for {self.target_name}. "
                     f"Server: {server_info.get('name', 'unknown')}. "
                     f"Supported transports: http, sse, streamable-http."
                 )
@@ -192,9 +199,10 @@ class GeminiClientAdapter(CopilotClientAdapter):
 
             if config.get("headers"):
                 self._warn_input_variables(
-                    config["headers"], server_info.get("name", ""), "Gemini CLI"
+                    config["headers"], server_info.get("name", ""), self.target_name
                 )
 
+            self._merge_extra(config, server_info)
             return config
 
         # --- local packages ---
@@ -208,6 +216,7 @@ class GeminiClientAdapter(CopilotClientAdapter):
 
         package = self._select_best_package(packages)
         if not package:
+            self._merge_extra(config, server_info)
             return config
 
         registry_name = self._infer_registry_name(package)
@@ -245,6 +254,7 @@ class GeminiClientAdapter(CopilotClientAdapter):
         if resolved_env:
             config["env"] = resolved_env
 
+        self._merge_extra(config, server_info)
         return config
 
     def configure_mcp_server(
@@ -256,19 +266,20 @@ class GeminiClientAdapter(CopilotClientAdapter):
         server_info_cache=None,
         runtime_vars=None,
     ):
-        """Configure an MCP server in ``.gemini/settings.json``.
+        """Configure an MCP server in the target's ``settings.json``.
 
         Delegates to the parent for config formatting, then writes to
-        the Gemini CLI settings file.
+        the target CLI settings file.
         """
         if not server_url:
             _rich_error("server_url cannot be empty", symbol="error")
             return False
 
-        if not self.user_scope and not self._get_gemini_dir().is_dir():
+        if not self.user_scope and not self._get_config_dir().is_dir():
             logger.debug(
-                "Gemini opt-in gate: %s absent, skipping configure_mcp_server",
-                self._get_gemini_dir(),
+                "%s opt-in gate: %s absent, skipping configure_mcp_server",
+                self.target_name,
+                self._get_config_dir(),
             )
             return True
 
@@ -292,10 +303,16 @@ class GeminiClientAdapter(CopilotClientAdapter):
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)
             self.update_config({config_key: server_config})
 
-            _rich_success(f"Configured MCP server '{config_key}' for Gemini CLI", symbol="success")
+            _rich_success(
+                f"Configured MCP server '{config_key}' for {self.target_name}",
+                symbol="success",
+            )
             return True
 
         except Exception as e:
-            logger.debug("Gemini MCP configuration failed: %s", e)
-            _rich_error("Failed to configure MCP server for Gemini CLI", symbol="error")
+            logger.debug("%s MCP configuration failed: %s", self.target_name, e)
+            _rich_error(
+                f"Failed to configure MCP server for {self.target_name}",
+                symbol="error",
+            )
             return False

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/adapters/client/kiro.py

@@ -130,6 +130,7 @@ class KiroClientAdapter(CopilotClientAdapter):
                 for arg in raw.get("args") or []
             ]
             self._copy_kiro_extensions(config, server_info)
+            self._merge_extra(config, server_info)
             return config
 
         remotes = server_info.get("remotes", [])
@@ -157,6 +158,7 @@ class KiroClientAdapter(CopilotClientAdapter):
                 config["headers"] = headers
                 self._warn_input_variables(headers, server_info.get("name", ""), "Kiro")
             self._copy_kiro_extensions(config, server_info)
+            self._merge_extra(config, server_info)
             return config
 
         packages = server_info.get("packages", [])
@@ -180,6 +182,7 @@ class KiroClientAdapter(CopilotClientAdapter):
                 f"Server: {server_info.get('name', 'unknown')}."
             )
         self._copy_kiro_extensions(config, server_info)
+        self._merge_extra(config, server_info)
         return config
 
     def configure_mcp_server(

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/adapters/client/vscode.py

@@ -281,6 +281,7 @@ class VSCodeClientAdapter(MCPClientAdapter):
                 input_vars.extend(
                     self._extract_input_variables(env_translated, server_info.get("name", ""))
                 )
+            self._merge_extra(server_config, server_info)
             return server_config, input_vars
 
         # Check for packages information
@@ -448,6 +449,7 @@ class VSCodeClientAdapter(MCPClientAdapter):
                     f"Server: {server_info.get('name', 'unknown')}"
                 )
 
+        self._merge_extra(server_config, server_info)
         return server_config, input_vars
 
     @staticmethod

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/bundle/lockfile_enrichment.py

@@ -13,12 +13,10 @@ from ..integration.targets import KNOWN_TARGETS
 # .github/ is the canonical interop prefix -- install always creates it, so
 # all non-github targets map FROM .github/.  The copilot target additionally
 # maps FROM .claude/ for the common case of Claude-first projects packing
-# for Copilot.  Cursor/opencode sources are niche; if someone publishes
-# skills exclusively under .cursor/, they must pack with --target cursor.
-#
-# Windsurf converts agents -> skills (lossy: AGENTS.md format is collapsed
-# into the windsurf skill envelope), so .github/agents/ maps to
-# .windsurf/skills/.
+# for Copilot.  Cursor, opencode, and windsurf skills converge on the
+# shared .agents/skills/ convention rather than bespoke per-target paths.
+# Windsurf agents still collapse into .windsurf/skills/ because the target
+# has no distinct agent envelope.
 _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
     "claude": {
         ".github/skills/": ".claude/skills/",
@@ -33,11 +31,11 @@ _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
         ".claude/agents/": ".github/agents/",
     },
     "cursor": {
-        ".github/skills/": ".cursor/skills/",
+        ".github/skills/": ".agents/skills/",
         ".github/agents/": ".cursor/agents/",
     },
     "opencode": {
-        ".github/skills/": ".opencode/skills/",
+        ".github/skills/": ".agents/skills/",
         ".github/agents/": ".opencode/agents/",
     },
     "codex": {
@@ -45,7 +43,7 @@ _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
         ".github/agents/": ".codex/agents/",
     },
     "windsurf": {
-        ".github/skills/": ".windsurf/skills/",
+        ".github/skills/": ".agents/skills/",
         ".github/agents/": ".windsurf/skills/",
     },
     "agent-skills": {

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/bundle/plugin_exporter.py

@@ -108,6 +108,12 @@ def _collect_apm_components(apm_dir: Path) -> list[tuple[Path, str]]:
     # commands/ -> commands/
     _collect_recursive(apm_dir / "commands", "commands", components)
 
+    # extensions/ -> extensions/ (canvas extensions, experimental Copilot-only).
+    # Preserved verbatim so an offline bundle can carry a canvas; the files are
+    # inert until the consumer enables the ``canvas`` experimental flag AND
+    # approves the package via allowExecutables / ``apm approve`` at install time.
+    _collect_recursive(apm_dir / "extensions", "extensions", components)
+
     return components
 
 
@@ -118,7 +124,7 @@ def _collect_root_plugin_components(project_root: Path) -> list[tuple[Path, str]
     ``skills/``, etc. at the repo root) have their files picked up here.
     """
     components: list[tuple[Path, str]] = []
-    for dir_name in ("agents", "skills", "commands", "instructions"):
+    for dir_name in ("agents", "skills", "commands", "instructions", "extensions"):
         _collect_recursive(project_root / dir_name, dir_name, components)
     return components
 

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/bundle/unpacker.py

@@ -30,6 +30,7 @@ class UnpackResult:
     skipped_count: int = 0
     security_warnings: int = 0
     security_critical: int = 0
+    canvas_blocked: int = 0
     pack_meta: dict = field(default_factory=dict)
 
 
@@ -163,6 +164,27 @@ def unpack_bundle(
             if dep_files:
                 dep_file_map[dep_key] = dep_files
 
+        # Security + feature gate: canvas extensions are executable Node
+        # bundles (``extension.mjs``).  ``apm unpack`` (deprecated) copies
+        # deployed files verbatim WITHOUT routing through ``CanvasIntegrator``.
+        # When the canvas feature flag is OFF, drop paths silently.
+        # When ON, canvas files are allowed (apm unpack has no project context
+        # so no allowExecutables enforcement is available; the user is assumed
+        # to understand what they are unpacking for this deprecated command).
+        canvas_blocked = 0
+        from ..core.experimental import is_enabled
+        from ..integration.canvas_integrator import is_canvas_bundle_path
+
+        if not is_enabled("canvas"):
+            _blocked = {f for f in unique_files if is_canvas_bundle_path(f)}
+            if _blocked:
+                canvas_blocked = len(_blocked)
+                unique_files = [f for f in unique_files if f not in _blocked]
+                for _k in list(dep_file_map):
+                    dep_file_map[_k] = [f for f in dep_file_map[_k] if f not in _blocked]
+                    if not dep_file_map[_k]:
+                        del dep_file_map[_k]
+
         # 3. Verify completeness
         verified = True
         if not skip_verify:
@@ -211,6 +233,7 @@ def unpack_bundle(
                 dependency_files=dep_file_map,
                 security_warnings=security_warnings,
                 security_critical=security_critical,
+                canvas_blocked=canvas_blocked,
                 pack_meta=pack_meta,
             )
 
@@ -254,6 +277,7 @@ def unpack_bundle(
             skipped_count=skipped,
             security_warnings=security_warnings,
             security_critical=security_critical,
+            canvas_blocked=canvas_blocked,
             pack_meta=pack_meta,
         )
     finally:

{apm_cli-0.20.0 → apm_cli-0.22.0}/src/apm_cli/cli.py

@@ -18,6 +18,7 @@ from apm_cli.commands._helpers import (
     _check_and_notify_updates,
     print_version,
 )
+from apm_cli.commands.approve import approve_cmd, deny_cmd
 from apm_cli.commands.audit import audit
 from apm_cli.commands.cache import cache
 from apm_cli.commands.compile import compile as compile_cmd
@@ -147,8 +148,10 @@ def cli(ctx, verbose: bool) -> None:
 
 
 # Register command groups
+cli.add_command(approve_cmd, name="approve")
 cli.add_command(audit)
 cli.add_command(cache)
+cli.add_command(deny_cmd, name="deny")
 cli.add_command(deps)
 cli.add_command(view_cmd)
 # Hidden backward-compatible alias: ``apm info`` → ``apm view``