apm-cli 0.22.0__tar.gz → 0.23.1__tar.gz

{apm_cli-0.22.0 → apm_cli-0.23.1}/NOTICE

@@ -372,7 +372,7 @@ THE SOFTWARE.
 
 ## Component. llm
 
-- Version requirement: `>=0.17.0`
+- Version requirement: `>=0.28`
 - Upstream: https://github.com/simonw/llm
 - SPDX: `Apache-2.0`
 - Notes: No NOTICE or AUTHORS file present upstream; nothing additional to forward.
@@ -589,7 +589,7 @@ _Copyright Simon Willison (per PyPI author metadata; LICENSE file is the unmodif
 
 ## Component. llm-github-models
 
-- Version requirement: `>=0.1.0`
+- Version requirement: `>=0.18.0`
 - Upstream: https://github.com/tonybaloney/llm-github-models
 - SPDX: `Apache-2.0`
 - Notes: Upstream LICENSE file declares MIT license text but PyPI metadata + classifiers say Apache-2.0. See Open Issues.

{apm_cli-0.22.0/src/apm_cli.egg-info → apm_cli-0.23.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.22.0
+Version: 0.23.1
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -42,8 +42,8 @@ Requires-Dist: colorama>=0.4.6
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: requests>=2.31.0
 Requires-Dist: python-frontmatter>=1.0.0
-Requires-Dist: llm>=0.17.0
-Requires-Dist: llm-github-models>=0.1.0
+Requires-Dist: llm>=0.28
+Requires-Dist: llm-github-models>=0.18.0
 Requires-Dist: tomli>=1.2.0; python_version < "3.11"
 Requires-Dist: toml>=0.10.2
 Requires-Dist: rich>=13.0.0
@@ -178,7 +178,7 @@ curl -sSL https://aka.ms/apm-unix | sh
 irm https://aka.ms/apm-windows | iex
 ```
 
-Native release binaries are published for macOS, Linux, and Windows x86_64. `apm update` reuses the matching platform installer.
+Native release binaries are published for macOS, Linux, and Windows x86_64. `apm self-update` reuses the matching platform installer.
 
 <details>
 <summary>Other install methods</summary>

{apm_cli-0.22.0 → apm_cli-0.23.1}/README.md

@@ -110,7 +110,7 @@ curl -sSL https://aka.ms/apm-unix | sh
 irm https://aka.ms/apm-windows | iex
 ```
 
-Native release binaries are published for macOS, Linux, and Windows x86_64. `apm update` reuses the matching platform installer.
+Native release binaries are published for macOS, Linux, and Windows x86_64. `apm self-update` reuses the matching platform installer.
 
 <details>
 <summary>Other install methods</summary>

{apm_cli-0.22.0 → apm_cli-0.23.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.22.0"
+version = "0.23.1"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -27,8 +27,8 @@ dependencies = [
     "pyyaml>=6.0.0",
     "requests>=2.31.0",
     "python-frontmatter>=1.0.0",
-    "llm>=0.17.0",
-    "llm-github-models>=0.1.0",
+    "llm>=0.28",
+    "llm-github-models>=0.18.0",
     "tomli>=1.2.0; python_version<'3.11'",
     "toml>=0.10.2",
     "rich>=13.0.0",

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/bundle/local_bundle.py

@@ -47,6 +47,7 @@ from ..utils.path_security import (
     ensure_path_within,
     validate_path_segments,
 )
+from ..utils.yaml_io import load_yaml_str
 
 _MAX_ZIP_ENTRIES = MAX_ZIP_ENTRIES
 _MAX_ZIP_UNCOMPRESSED = MAX_ZIP_UNCOMPRESSED
@@ -93,7 +94,12 @@ def read_bundle_plugin_json(bundle_dir: Path) -> dict[str, Any]:
         return {}
     try:
         data = json.loads(pj_path.read_text(encoding="utf-8"))
-    except (json.JSONDecodeError, OSError):
+    except (OSError, ValueError, RecursionError):
+        # json.JSONDecodeError is a ValueError subclass; the wider set also
+        # fails closed on a deeply-nested JSON (RecursionError) or an
+        # oversized-integer literal (bare ValueError from int_max_str_digits)
+        # in an untrusted bundle's plugin.json -- the same fail-closed posture
+        # parse_script_file / _load_trust_store take.
         return {}
     return data if isinstance(data, dict) else {}
 
@@ -104,7 +110,7 @@ def _read_bundle_lockfile(bundle_dir: Path) -> dict[str, Any] | None:
     if not lf_path.is_file():
         return None
     try:
-        data = yaml.safe_load(lf_path.read_text(encoding="utf-8"))
+        data = load_yaml_str(lf_path.read_text(encoding="utf-8"))
     except (yaml.YAMLError, OSError):
         return None
     return data if isinstance(data, dict) else None

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/bundle/packer.py

@@ -104,10 +104,10 @@ def pack_bundle(
         # at pack time -- this is the publish gate for the AUTHOR.
         if is_hybrid_root and not package.description and logger:
             try:
-                import frontmatter as _frontmatter
+                from apm_cli.utils.yaml_io import load_frontmatter
 
                 with open(skill_md_path, encoding="utf-8") as _f:
-                    _skill_post = _frontmatter.load(_f)
+                    _skill_post = load_frontmatter(_f)
                 _skill_desc = _skill_post.metadata.get("description")
             except Exception:
                 _skill_desc = None

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/bundle/plugin_exporter.py

@@ -246,7 +246,9 @@ def _collect_hooks_from_apm(apm_dir: Path) -> dict:
                 data = json.loads(f.read_text(encoding="utf-8"))
                 if isinstance(data, dict):
                     _deep_merge(hooks, data, overwrite=False)
-            except (json.JSONDecodeError, OSError):
+            except (OSError, ValueError, RecursionError):
+                # Untrusted .apm/hooks/*.json: oversized-int -> bare ValueError,
+                # deep nest -> RecursionError. Fail closed (skip this file).
                 pass
     return hooks
 
@@ -261,7 +263,9 @@ def _collect_hooks_from_root(package_root: Path) -> dict:
             data = json.loads(hooks_file.read_text(encoding="utf-8"))
             if isinstance(data, dict):
                 _deep_merge(hooks, data, overwrite=False)
-        except (json.JSONDecodeError, OSError):
+        except (OSError, ValueError, RecursionError):
+            # Untrusted root hooks.json: fail closed (oversized-int ValueError /
+            # deep-nest RecursionError are not JSONDecodeError).
             pass
     # Directory
     hooks_dir = package_root / "hooks"
@@ -272,7 +276,8 @@ def _collect_hooks_from_root(package_root: Path) -> dict:
                     data = json.loads(f.read_text(encoding="utf-8"))
                     if isinstance(data, dict):
                         _deep_merge(hooks, data, overwrite=False)
-                except (json.JSONDecodeError, OSError):
+                except (OSError, ValueError, RecursionError):
+                    # Untrusted .../hooks/*.json: fail closed (skip this file).
                     pass
     return hooks
 
@@ -356,7 +361,11 @@ def _has_marketplace_block(apm_yml_path: Path) -> bool:
     try:
         import yaml
 
-        data = yaml.safe_load(apm_yml_path.read_text(encoding="utf-8")) or {}
+        # Bounded loader so a hostile apm.yml cannot wedge the export with a
+        # merge/alias expansion bomb (fails closed as yaml.YAMLError).
+        from apm_cli.utils.yaml_io import load_yaml
+
+        data = load_yaml(apm_yml_path) or {}
     except (OSError, yaml.YAMLError):
         return False
     return bool(data.get("marketplace"))

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/bundle/unpacker.py

@@ -130,9 +130,12 @@ def unpack_bundle(
         # Extract pack: metadata (written by apm pack) before structured parse
         pack_meta: dict = {}
         try:
-            import yaml
+            from ..utils.yaml_io import load_yaml
 
-            raw = yaml.safe_load(lockfile_path.read_text(encoding="utf-8"))
+            # Bounded loader: an untrusted bundle lockfile cannot hang the
+            # unpacker with a merge-key bomb (the except below cannot catch a
+            # non-terminating safe_load loop).
+            raw = load_yaml(lockfile_path)
             if isinstance(raw, dict):
                 val = raw.get("pack", {})
                 pack_meta = val if isinstance(val, dict) else {}

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/cli.py

@@ -29,6 +29,7 @@ from apm_cli.commands.experimental import experimental
 from apm_cli.commands.find import find as find_cmd
 from apm_cli.commands.init import init
 from apm_cli.commands.install import install
+from apm_cli.commands.lifecycle import lifecycle
 from apm_cli.commands.list_cmd import list as list_cmd
 from apm_cli.commands.lock import lock
 from apm_cli.commands.marketplace import marketplace
@@ -142,8 +143,12 @@ def cli(ctx, verbose: bool) -> None:
 
     warnings.filterwarnings("ignore", category=AgentsTargetDeprecationWarning)
 
-    # Check for updates non-blockingly (only if not already showing version)
-    if not ctx.resilient_parsing:
+    # Check for updates only for known commands; skip on invalid input to fail fast.
+    if (
+        not ctx.resilient_parsing
+        and ctx.invoked_subcommand is not None
+        and ctx.command.get_command(ctx, ctx.invoked_subcommand) is not None
+    ):
         _check_and_notify_updates()
 
 
@@ -187,6 +192,7 @@ cli.add_command(mcp)
 cli.add_command(policy)
 cli.add_command(outdated_cmd, name="outdated")
 cli.add_command(doctor)
+cli.add_command(lifecycle)
 cli.add_command(marketplace)
 cli.add_command(find_cmd)
 cli.add_command(marketplace_search, name="search")

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/commands/compile/cli.py

@@ -69,8 +69,8 @@ def _display_single_file_summary(stats, c_status, c_hash, output_path, dry_run):
             "[+] All validated",
         )
         table.add_row(
-            "Chatmodes",
-            str(stats.get("chatmodes", 0)),
+            "Agents",
+            str(stats.get("agents", 0)),
             "[+] All validated",
         )
 
@@ -448,7 +448,7 @@ def _validate_project(logger: CommandLogger, dry_run: bool, source_root: Path) -
     # Check if .apm directory has actual content
     apm_dir = source_root / APM_DIR
     local_apm_has_content = apm_dir.exists() and (
-        any(apm_dir.rglob("*.instructions.md")) or any(apm_dir.rglob("*.chatmode.md"))
+        any(apm_dir.rglob("*.instructions.md")) or any(apm_dir.rglob("*.agent.md"))
     )
 
     # If no primitive sources exist, check deeper to provide better feedback
@@ -457,20 +457,20 @@ def _validate_project(logger: CommandLogger, dry_run: bool, source_root: Path) -
         has_empty_apm = (
             apm_dir.exists()
             and not any(apm_dir.rglob("*.instructions.md"))
-            and not any(apm_dir.rglob("*.chatmode.md"))
+            and not any(apm_dir.rglob("*.agent.md"))
         )
 
         if has_empty_apm:
             logger.error("No instruction files found in .apm/ directory")
             logger.progress(" To add instructions, create files like:")
             logger.progress("   .apm/instructions/coding-standards.instructions.md")
-            logger.progress("   .apm/chatmodes/backend-engineer.chatmode.md")
+            logger.progress("   .apm/agents/backend-engineer.agent.md")
         else:
             logger.error("No APM content found to compile")
             logger.progress(" To get started:")
             logger.progress("   1. Install APM dependencies: apm install <owner>/<repo>")
             logger.progress("   2. Or create local instructions: mkdir -p .apm/instructions")
-            logger.progress("   3. Then create .instructions.md or .chatmode.md files")
+            logger.progress("   3. Then create .instructions.md or .agent.md files")
 
         if not dry_run:  # Don't exit on dry-run to allow testing
             sys.exit(1)
@@ -951,23 +951,23 @@ def _run_compilation(
     help="Compile for all canonical targets. Equivalent to --target all.",
 )
 @click.option(
-    "--no-dedup/--no-force-instructions",
+    "--force-instructions/--no-force-instructions",
     "no_dedup",
-    is_flag=True,
     default=False,
     help=(
         "Include the instructions section in CLAUDE.md even when .claude/rules/ is "
+        "already populated, and in AGENTS.md even when .github/instructions/ is "
         "already populated. Overrides the default deduplication that normally omits "
-        "the section to avoid duplicate context in Claude Code. Affects the Claude "
-        "target only. Alias: --force-instructions."
+        "these sections to avoid duplicate context. Affects both the Claude and "
+        "Copilot (AGENTS.md) deduplication paths. Alias: --no-dedup."
     ),
 )
 @click.option(
-    "--force-instructions",
+    "--no-dedup",
     "no_dedup",
     is_flag=True,
     default=False,
-    help="Alias for --no-dedup.",
+    help="Alias for --force-instructions.",
     hidden=True,
 )
 @click.option(
@@ -1073,7 +1073,7 @@ def compile(  # noqa: PLR0913 -- Click handler
             "compile_all": "--all",
             "legacy_skill_paths": "--legacy-skill-paths",
             "local_only": "--local-only",
-            "no_dedup": "--no-dedup/--force-instructions",
+            "no_dedup": "--force-instructions/--no-force-instructions",
             "no_links": "--no-links",
             "output": "--output",
             "root": "--root",

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/commands/compile/watcher.py

@@ -234,10 +234,6 @@ def _watch_mode(
             observer.schedule(event_handler, ".github/agents", recursive=True)
             watch_paths.append(".github/agents/")
 
-        if Path(".github/chatmodes").exists():
-            observer.schedule(event_handler, ".github/chatmodes", recursive=True)
-            watch_paths.append(".github/chatmodes/")
-
         if Path(APM_YML_FILENAME).exists():
             observer.schedule(event_handler, ".", recursive=False)
             watch_paths.append(APM_YML_FILENAME)

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/commands/deps/_utils.py

@@ -105,7 +105,7 @@ def _count_package_files(package_path: Path) -> tuple[int, int]:
         return 0, workflow_count
 
     context_count = 0
-    context_dirs = ["instructions", "chatmodes", "context"]
+    context_dirs = ["instructions", "agents", "context"]
 
     for context_dir in context_dirs:
         context_path = apm_dir / context_dir
@@ -134,12 +134,12 @@ def _get_detailed_context_counts(package_path: Path) -> dict[str, int]:
     """Get detailed context file counts by type."""
     apm_dir = package_path / APM_DIR
     if not apm_dir.exists():
-        return {"instructions": 0, "chatmodes": 0, "contexts": 0}
+        return {"instructions": 0, "agents": 0, "contexts": 0}
 
     counts = {}
     context_directories = {
         "instructions": "instructions",
-        "chatmodes": "chatmodes",
+        "agents": "agents",
         "contexts": "context",  # Note: directory is 'context', not 'contexts'
     }
 
@@ -235,7 +235,7 @@ def _get_detailed_package_info(package_path: Path) -> dict[str, Any]:
             "author": "Unknown",
             "source": "unknown",
             "install_path": str(package_path.resolve()),
-            "context_files": {"instructions": 0, "chatmodes": 0, "contexts": 0},
+            "context_files": {"instructions": 0, "agents": 0, "contexts": 0},
             "workflows": 0,
             "hooks": 0,
         }

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/commands/deps/cli.py

@@ -718,7 +718,9 @@ def clean(dry_run: bool, yes: bool):
         sys.exit(1)
 
 
-@deps.command(help="Update APM dependencies to latest refs")
+@deps.command(
+    help="DEPRECATED: use 'apm update' instead (strict superset). Update APM dependencies to latest refs"
+)
 @click.argument("packages", nargs=-1)
 @click.option("--verbose", "-v", is_flag=True, help="Show detailed update information")
 @click.option(
@@ -914,7 +916,9 @@ def update(packages, verbose, force, target, parallel_downloads, global_, legacy
         logger.success("All packages already at latest refs.")
 
 
-@deps.command(help="Show detailed package information")
+@deps.command(
+    help="Show detailed package information (alias for 'apm view PACKAGE' for installed packages; prefer 'apm view' in new scripts)"
+)
 @click.argument("package", required=True)
 def info(package: str):
     """Show detailed information about a specific package including context files and workflows."""

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/commands/init.py

@@ -537,13 +537,15 @@ def _read_existing_targets(project_root: Path) -> list[str]:
     legacy singular ``target:`` CSV/scalar form for backwards compatibility
     with apm.yml files written before plural became canonical.
     """
-    import yaml
-
     apm_yml_path = project_root / APM_YML_FILENAME
     if not apm_yml_path.exists():
         return []
     try:
-        data = yaml.safe_load(apm_yml_path.read_text(encoding="utf-8"))
+        # Bounded loader so a hostile apm.yml cannot wedge target parsing with a
+        # merge/alias expansion bomb (fails closed -> empty target list).
+        from apm_cli.utils.yaml_io import load_yaml
+
+        data = load_yaml(apm_yml_path)
         if not isinstance(data, dict):
             return []
         # Canonical plural form

{apm_cli-0.22.0 → apm_cli-0.23.1}/src/apm_cli/commands/install.py

@@ -47,8 +47,9 @@ from apm_cli.install.mcp.entry import _build_mcp_entry  # noqa: F401
 from apm_cli.install.mcp.writer import _add_mcp_to_apm_yml  # noqa: F401
 from apm_cli.install.package_resolution import (
     GIT_PARENT_USER_SCOPE_ERROR,
+    apply_cli_skill_pin,
+    cli_skill_subset,
     dependency_reference_to_yaml_entry,
-    normalize_and_merge_skill_subset,
     persist_dependency_list_if_changed,
     resolve_parsed_dependency_reference,
     update_existing_dependency_entry_if_needed,
@@ -329,6 +330,7 @@ def _resolve_package_references(
     scope=None,
     allow_insecure=False,
     skill_subset=None,
+    skill_subset_from_cli=False,
     default_registry=None,
 ):
     """Validate, canonicalize, and resolve package references.
@@ -453,16 +455,15 @@ def _resolve_package_references(
             )
             canonical = dep_ref.to_canonical()
             identity = dep_ref.get_identity()
-            # Attach --skill filter so to_apm_yml_entry() emits the dict form.
-            # Merges with existing skills: list so repeated --skill
-            # invocations are additive (issue #1771).
-            if skill_subset:
-                dep_ref.skill_subset = normalize_and_merge_skill_subset(
-                    skill_subset,
-                    current_deps,
-                    identity,
-                    dependency_reference_cls=DependencyReference,
-                )
+            apply_cli_skill_pin(
+                dep_ref,
+                skill_subset,
+                skill_subset_from_cli,
+                current_deps,
+                _apm_yml_entries,
+                dependency_reference_cls=DependencyReference,
+                logger=logger,
+            )
             if marketplace_dep_ref is not None or direct_virtual_resolved:
                 _apm_yml_entries[canonical] = dependency_reference_to_yaml_entry(dep_ref)
         except ValueError as e:
@@ -633,6 +634,7 @@ def _validate_and_add_packages_to_apm_yml(
     scope=None,
     allow_insecure=False,
     skill_subset=None,
+    skill_subset_from_cli=False,
 ):
     """Validate packages exist and can be accessed, then add to apm.yml dependencies section.
 
@@ -701,6 +703,7 @@ def _validate_and_add_packages_to_apm_yml(
         scope=scope,
         allow_insecure=allow_insecure,
         skill_subset=skill_subset,
+        skill_subset_from_cli=skill_subset_from_cli,
         default_registry=_default_registry_for_cli,
     )
 
@@ -888,7 +891,8 @@ def _handle_mcp_install(
 @click.option(
     "--runtime",
     help=(
-        "Target specific runtime only (copilot, claude, codex, cursor, gemini, antigravity, intellij, kiro, opencode, vscode, windsurf)"
+        "Target specific runtime only (copilot, claude, codex, cursor, gemini, antigravity, intellij, kiro, opencode, windsurf) "
+        "(legacy alias for --target, single value only; prefer --target)"
     ),
 )
 @click.option("--exclude", help="Exclude specific runtime from installation")
@@ -1047,7 +1051,7 @@ def _handle_mcp_install(
     "skill_names",
     multiple=True,
     metavar="NAME",
-    help="Install only named skill(s) from a SKILL_BUNDLE. Repeatable. Persisted in apm.yml and apm.lock so bare 'apm install' is deterministic. Use --skill '*' to reset to all skills.",
+    help="Install only named skill(s) from a SKILL_BUNDLE. Repeatable. Persisted in apm.yml and apm.lock so bare 'apm install' is deterministic. Additive across installs: a later --skill X adds X to the existing pin (union) rather than replacing it. Use --skill '*' (quote the asterisk in your shell) to reset to all skills; to drop a single skill, edit the skills: list in apm.yml then re-run apm install.",
 )
 @click.option(
     "--no-policy",
@@ -1383,12 +1387,9 @@ def install(  # noqa: PLR0913
         )
 
         # Normalize --skill: '*' means all (same as absent). Reject with --mcp.
-        _skill_subset = None
-        if skill_names:
-            if mcp_name is not None:
-                raise click.UsageError("--skill cannot be combined with --mcp.")
-            if not any(s == "*" for s in skill_names):
-                _skill_subset = builtins.tuple(skill_names)
+        if skill_names and mcp_name is not None:
+            raise click.UsageError("--skill cannot be combined with --mcp.")
+        _skill_subset = cli_skill_subset(skill_names)
 
         if mcp_name is not None:
             _handle_mcp_install(
@@ -1516,6 +1517,7 @@ def install(  # noqa: PLR0913
                 scope=scope,
                 allow_insecure=allow_insecure,
                 skill_subset=_skill_subset,
+                skill_subset_from_cli=bool(skill_names),
             )
             # Short-circuit: all packages failed validation -- nothing to install
             if outcome.all_failed: