apm-cli 0.21.0__tar.gz → 0.22.0__tar.gz

{apm_cli-0.21.0/src/apm_cli.egg-info → apm_cli-0.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.21.0
+Version: 0.22.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License

{apm_cli-0.21.0 → apm_cli-0.22.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.21.0"
+version = "0.22.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"

{apm_cli-0.21.0 → apm_cli-0.22.0}/src/apm_cli/adapters/client/codex.py

@@ -10,6 +10,7 @@ import toml
 from ...registry.client import SimpleRegistryClient
 from ...registry.integration import RegistryIntegration
 from ...utils.console import _rich_success, _rich_warning
+from ...utils.path_security import PathTraversalError
 from ._mcp_runtime_args import process_v01_value_hint_arg
 from .base import MCPClientAdapter
 
@@ -49,13 +50,22 @@ class CodexClientAdapter(MCPClientAdapter):
         self.registry_client = SimpleRegistryClient(registry_url)
         self.registry_integration = RegistryIntegration(registry_url)
 
-    def _get_codex_dir(self):
+    def _get_codex_dir(self) -> Path:
         """Return the root directory used for Codex config in the current scope."""
         if self.user_scope:
+            codex_home = os.environ.get("CODEX_HOME", "")
+            if codex_home.strip():
+                codex_home_path = Path(codex_home).expanduser()
+                if not codex_home_path.is_absolute():
+                    raise PathTraversalError(
+                        "CODEX_HOME is set to a non-absolute path; cannot locate the "
+                        "Codex CLI configuration directory."
+                    )
+                return codex_home_path
             return Path.home() / ".codex"
         return self.project_root / ".codex"
 
-    def get_config_path(self):
+    def get_config_path(self) -> str:
         """Get the path to the Codex CLI MCP configuration file.
 
         Returns:
@@ -322,7 +332,7 @@ class CodexClientAdapter(MCPClientAdapter):
                     all_args = processed_runtime_args + processed_package_args
                     if all_args:
                         # If runtime_arguments already include the package (bare or
-                        # versioned), use them as-is — they are authoritative from
+                        # versioned), use them as-is -- they are authoritative from
                         # the registry and may carry a version pin.
                         has_pkg = any(
                             a == package_name or a.startswith(f"{package_name}@") for a in all_args

{apm_cli-0.21.0 → apm_cli-0.22.0}/src/apm_cli/bundle/lockfile_enrichment.py

@@ -13,12 +13,10 @@ from ..integration.targets import KNOWN_TARGETS
 # .github/ is the canonical interop prefix -- install always creates it, so
 # all non-github targets map FROM .github/.  The copilot target additionally
 # maps FROM .claude/ for the common case of Claude-first projects packing
-# for Copilot.  Cursor/opencode sources are niche; if someone publishes
-# skills exclusively under .cursor/, they must pack with --target cursor.
-#
-# Windsurf converts agents -> skills (lossy: AGENTS.md format is collapsed
-# into the windsurf skill envelope), so .github/agents/ maps to
-# .windsurf/skills/.
+# for Copilot.  Cursor, opencode, and windsurf skills converge on the
+# shared .agents/skills/ convention rather than bespoke per-target paths.
+# Windsurf agents still collapse into .windsurf/skills/ because the target
+# has no distinct agent envelope.
 _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
     "claude": {
         ".github/skills/": ".claude/skills/",
@@ -33,11 +31,11 @@ _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
         ".claude/agents/": ".github/agents/",
     },
     "cursor": {
-        ".github/skills/": ".cursor/skills/",
+        ".github/skills/": ".agents/skills/",
         ".github/agents/": ".cursor/agents/",
     },
     "opencode": {
-        ".github/skills/": ".opencode/skills/",
+        ".github/skills/": ".agents/skills/",
         ".github/agents/": ".opencode/agents/",
     },
     "codex": {
@@ -45,7 +43,7 @@ _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
         ".github/agents/": ".codex/agents/",
     },
     "windsurf": {
-        ".github/skills/": ".windsurf/skills/",
+        ".github/skills/": ".agents/skills/",
         ".github/agents/": ".windsurf/skills/",
     },
     "agent-skills": {

{apm_cli-0.21.0 → apm_cli-0.22.0}/src/apm_cli/bundle/plugin_exporter.py

@@ -111,7 +111,7 @@ def _collect_apm_components(apm_dir: Path) -> list[tuple[Path, str]]:
     # extensions/ -> extensions/ (canvas extensions, experimental Copilot-only).
     # Preserved verbatim so an offline bundle can carry a canvas; the files are
     # inert until the consumer enables the ``canvas`` experimental flag AND
-    # passes ``--trust-canvas-extensions`` at install time.
+    # approves the package via allowExecutables / ``apm approve`` at install time.
     _collect_recursive(apm_dir / "extensions", "extensions", components)
 
     return components

{apm_cli-0.21.0 → apm_cli-0.22.0}/src/apm_cli/bundle/unpacker.py

@@ -40,7 +40,6 @@ def unpack_bundle(
     skip_verify: bool = False,
     dry_run: bool = False,
     force: bool = False,
-    trust_canvas: bool = False,
 ) -> UnpackResult:
     """Extract and apply an APM bundle to a project directory.
 
@@ -54,10 +53,6 @@ def unpack_bundle(
         skip_verify: If *True*, skip completeness verification against the lockfile.
         dry_run: If *True*, resolve the file list but write nothing to disk.
         force: If *True*, deploy even when critical hidden characters are found.
-        trust_canvas: If *True*, allow executable canvas extension files
-            (``.github/extensions/<name>/extension.mjs``) to be unpacked.
-            Defaults to *False* (fail closed) so a vendored bundle cannot
-            smuggle executable canvas code past the trust gate.
 
     Returns:
         :class:`UnpackResult` describing what was (or would be) extracted.
@@ -170,18 +165,17 @@ def unpack_bundle(
                 dep_file_map[dep_key] = dep_files
 
         # Security + feature gate: canvas extensions are executable Node
-        # bundles (``extension.mjs``).  ``apm unpack`` copies deployed files
-        # verbatim WITHOUT routing through ``CanvasIntegrator``, so neither
-        # the experimental feature flag nor its trust gate would otherwise
-        # apply.  Require BOTH gates -- the ``canvas`` experimental flag ON
-        # (feature availability) AND ``trust_canvas`` (executable-code trust)
-        # -- before unpacking canvas paths.  Fail closed: drop them when
-        # either gate is missing.
+        # bundles (``extension.mjs``).  ``apm unpack`` (deprecated) copies
+        # deployed files verbatim WITHOUT routing through ``CanvasIntegrator``.
+        # When the canvas feature flag is OFF, drop paths silently.
+        # When ON, canvas files are allowed (apm unpack has no project context
+        # so no allowExecutables enforcement is available; the user is assumed
+        # to understand what they are unpacking for this deprecated command).
         canvas_blocked = 0
         from ..core.experimental import is_enabled
         from ..integration.canvas_integrator import is_canvas_bundle_path
 
-        if not (is_enabled("canvas") and trust_canvas):
+        if not is_enabled("canvas"):
             _blocked = {f for f in unique_files if is_canvas_bundle_path(f)}
             if _blocked:
                 canvas_blocked = len(_blocked)

{apm_cli-0.21.0 → apm_cli-0.22.0}/src/apm_cli/commands/_apm_yml_writer.py

@@ -1,8 +1,7 @@
-"""Write-back helper for persisting skill subset selection in apm.yml.
+"""Write-back helpers for persisting dependency subset selection in apm.yml.
 
-Single helper ``set_skill_subset_for_entry`` is the one source of truth
-for promoting entries to dict form and setting/clearing the ``skills:``
-field.  Keeps write-back logic isolated and unit-testable.
+The helpers promote entries to dict form and set/clear the ``skills:`` or
+``targets:`` fields.  Keeping write-back logic isolated makes it unit-testable.
 """
 
 from pathlib import Path
@@ -23,6 +22,31 @@ def set_skill_subset_for_entry(
 
     Returns True if file was modified.
     """
+    return _set_subset_for_entry(manifest_path, repo_url, "skills", subset)
+
+
+def set_target_subset_for_entry(
+    manifest_path: Path,
+    repo_url: str,
+    subset: list[str] | None,
+) -> bool:
+    """Promote entry to dict form and set/clear targets: field.
+
+    subset=None or empty list -> remove targets: from entry (reset to all).
+    subset=[...] -> set targets: to sorted+deduped lowercase list.
+
+    Returns True if file was modified.
+    """
+    return _set_subset_for_entry(manifest_path, repo_url, "targets", subset)
+
+
+def _set_subset_for_entry(
+    manifest_path: Path,
+    repo_url: str,
+    field: str,
+    subset: list[str] | None,
+) -> bool:
+    """Promote a matching entry to dict form and set/clear one subset field."""
     data = load_yaml(manifest_path) or {}
     deps_section = data.get("dependencies")
     if deps_section is None:
@@ -45,7 +69,7 @@ def set_skill_subset_for_entry(
 
     for entry in apm_deps:
         if _entry_matches(entry, repo_url):
-            entry = _apply_subset(entry, subset)
+            entry = _apply_subset(entry, field, subset)
             modified = True
         new_deps.append(entry)
 
@@ -72,8 +96,13 @@ def _entry_matches(entry, repo_url: str) -> bool:
         return False
 
 
-def _apply_subset(entry, subset: list[str] | None):
-    """Apply skill subset to an entry, promoting to dict form if needed."""
+def _apply_subset(entry, field: str | list[str] | None, subset: list[str] | None = None):
+    """Apply a dependency subset field, promoting to dict form if needed."""
+    # Compatibility for older direct tests that called _apply_subset(entry, subset).
+    if not isinstance(field, str):
+        subset = field
+        field = "skills"
+
     # Parse current entry to get canonical info
     if isinstance(entry, str):
         ref = DependencyReference.parse(entry)
@@ -83,9 +112,11 @@ def _apply_subset(entry, subset: list[str] | None):
         return entry
 
     # Determine if we should set or clear
-    if subset:
-        ref.skill_subset = sorted(set(subset))
+    if field == "skills":
+        ref.skill_subset = sorted(set(subset)) if subset else None
+    elif field == "targets":
+        ref.target_subset = sorted({name.strip().lower() for name in subset}) if subset else None
     else:
-        ref.skill_subset = None
+        raise ValueError(f"Unsupported dependency subset field: {field}")
 
     return ref.to_apm_yml_entry()