apm-cli 0.24.0__tar.gz → 0.24.1__tar.gz

{apm_cli-0.24.0 → apm_cli-0.24.1}/NOTICE

@@ -703,6 +703,41 @@ THE SOFTWARE.
 
 ---
 
+## Component. tomlkit
+
+- Version requirement: `>=0.13`
+- Upstream: https://github.com/python-poetry/tomlkit
+- SPDX: `MIT`
+
+### Open Source License/Copyright Notice.
+
+_Copyright (c) 2018 Sébastien Eustace_
+
+```
+Copyright (c) 2018 Sébastien Eustace
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+---
+
 ## Component. rich
 
 - Version requirement: `>=13.0.0`

{apm_cli-0.24.0/src/apm_cli.egg-info → apm_cli-0.24.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.24.0
+Version: 0.24.1
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -46,6 +46,7 @@ Requires-Dist: llm>=0.28
 Requires-Dist: llm-github-models>=0.18.0
 Requires-Dist: tomli>=1.2.0; python_version < "3.11"
 Requires-Dist: toml>=0.10.2
+Requires-Dist: tomlkit>=0.13
 Requires-Dist: rich>=13.0.0
 Requires-Dist: rich-click>=1.7.0
 Requires-Dist: watchdog>=3.0.0

{apm_cli-0.24.0 → apm_cli-0.24.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.24.0"
+version = "0.24.1"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -31,6 +31,7 @@ dependencies = [
     "llm-github-models>=0.18.0",
     "tomli>=1.2.0; python_version<'3.11'",
     "toml>=0.10.2",
+    "tomlkit>=0.13",
     "rich>=13.0.0",
     "rich-click>=1.7.0",
     "watchdog>=3.0.0",
@@ -170,4 +171,3 @@ markers = [
     "requires_inference: requires APM_RUN_INFERENCE_TESTS=1 + model API access",
     "req: binds a test to one or more OpenAPM req-XXX ids (spec-conformance suite)",
 ]
-

{apm_cli-0.24.0 → apm_cli-0.24.1}/src/apm_cli/adapters/client/claude.py

@@ -4,11 +4,11 @@ Project scope: ``.mcp.json`` at the project root with top-level ``mcpServers``
 (``--scope project`` in Claude Code). Writes are opt-in when ``.claude/`` exists,
 mirroring the Cursor/OpenCode directory-presence convention.
 
-User scope: top-level ``mcpServers`` in ``~/.claude.json`` (``--scope user``).
-Writes are atomic and create the file with ``0o600`` permissions on first
-write so the shared Claude Code config is not silently truncated by a
-concurrent writer and cannot leak any embedded OAuth state to other users
-on a multi-user host.
+User scope: top-level ``mcpServers`` in ``$CLAUDE_CONFIG_DIR/.claude.json``
+when configured, otherwise ``~/.claude.json`` (``--scope user``). Writes are
+atomic and create the file with ``0o600`` permissions on first write so the
+shared Claude Code config is not silently truncated by a concurrent writer
+and cannot leak any embedded OAuth state to other users on a multi-user host.
 
 Local scope (Claude Code's third scope -- the default for ``claude mcp add``,
 storing per-project private config under ``~/.claude.json -> projects.<abs_path>
@@ -20,12 +20,17 @@ See https://code.claude.com/docs/en/mcp
 """
 
 import json
+import logging
+import os
 from pathlib import Path
 
 from ...utils.atomic_io import atomic_write_text
 from ...utils.console import _rich_error, _rich_success, _rich_warning
+from ...utils.path_security import PathTraversalError
 from .copilot import CopilotClientAdapter
 
+_log = logging.getLogger(__name__)
+
 
 class ClaudeClientAdapter(CopilotClientAdapter):
     """MCP configuration for Claude Code (``mcpServers`` schema).
@@ -141,6 +146,15 @@ class ClaudeClientAdapter(CopilotClientAdapter):
         return self.project_root / ".mcp.json"
 
     def _user_claude_json_path(self) -> Path:
+        config_dir = os.environ.get("CLAUDE_CONFIG_DIR", "").strip()
+        if config_dir:
+            config_path = Path(config_dir).expanduser()
+            if not config_path.is_absolute():
+                raise PathTraversalError(
+                    "CLAUDE_CONFIG_DIR must be an absolute path for user-scope MCP "
+                    "config; set an absolute path or unset it to use ~/.claude.json."
+                )
+            return config_path.resolve(strict=False) / ".claude.json"
         return Path.home() / ".claude.json"
 
     def _should_write_project(self) -> bool:
@@ -206,6 +220,7 @@ class ClaudeClientAdapter(CopilotClientAdapter):
             payload = json.dumps(data, indent=2) + "\n"
             path.parent.mkdir(parents=True, exist_ok=True)
             atomic_write_text(path, payload, new_file_mode=0o600)
+            _log.debug("Claude user-scope MCP config written to %s", path)
             return True
         except OSError:
             return False

{apm_cli-0.24.0 → apm_cli-0.24.1}/src/apm_cli/adapters/client/codex.py

@@ -5,10 +5,12 @@ import os
 from pathlib import Path
 from urllib.parse import urlparse
 
-import toml
+import tomlkit
+from tomlkit.exceptions import TOMLKitError
 
 from ...registry.client import SimpleRegistryClient
 from ...registry.integration import RegistryIntegration
+from ...utils.atomic_io import atomic_write_text
 from ...utils.console import _rich_success, _rich_warning
 from ...utils.path_security import PathTraversalError
 from ._mcp_runtime_args import process_v01_value_hint_arg
@@ -94,9 +96,7 @@ class CodexClientAdapter(MCPClientAdapter):
         # Ensure directory exists
         config_path.parent.mkdir(parents=True, exist_ok=True)
 
-        with open(config_path, "w", encoding="utf-8") as f:
-            toml.dump(current_config, f)
-        os.chmod(config_path, 0o600)
+        atomic_write_text(config_path, tomlkit.dumps(current_config), new_file_mode=0o600)
         _log.debug("Codex config written to %s", config_path)
         return True
 
@@ -104,8 +104,9 @@ class CodexClientAdapter(MCPClientAdapter):
         """Get the current Codex CLI MCP configuration.
 
         Returns:
-            dict | None: Current configuration, empty dict if file doesn't
-                exist, or None when an existing config cannot be parsed safely.
+            MutableMapping | None: Round-trip-preserving mapping when the file
+                exists, empty mapping if it does not exist, or None when an
+                existing config cannot be parsed safely.
         """
         config_path = self.get_config_path()
 
@@ -113,12 +114,14 @@ class CodexClientAdapter(MCPClientAdapter):
             return {}
 
         try:
-            with open(config_path, encoding="utf-8") as f:
-                return toml.load(f)
-        except toml.TomlDecodeError as exc:
+            with open(config_path, encoding="utf-8") as config_file:
+                return tomlkit.load(config_file)
+        except (TOMLKitError, UnicodeDecodeError) as exc:
             _log.debug("Failed to parse Codex config at %s", config_path, exc_info=True)
             _rich_warning(
-                f"Could not parse {config_path}: {exc} -- skipping config write to avoid data loss",
+                f"Could not read or parse {config_path}: {exc} "
+                "-- skipping config write to avoid data loss; inspect the file "
+                "or delete it to reset Codex configuration",
                 symbol="warning",
             )
             return None

{apm_cli-0.24.0 → apm_cli-0.24.1}/src/apm_cli/commands/_helpers.py

@@ -308,7 +308,7 @@ def _check_orphaned_packages():
             from ..models.apm_package import APMPackage
 
             apm_package = APMPackage.from_apm_yml(Path(APM_YML_FILENAME))
-            declared_deps = apm_package.get_apm_dependencies()
+            declared_deps = apm_package.get_all_apm_dependencies()
             lockfile = LockFile.read(get_lockfile_path(Path.cwd()))
             expected = _build_expected_install_paths(declared_deps, lockfile, apm_modules_dir)
         except Exception:

{apm_cli-0.24.0 → apm_cli-0.24.1}/src/apm_cli/commands/deps/cli.py

@@ -70,14 +70,42 @@ def _dep_display_name(dep) -> str:
     return f"{key}@{version}"
 
 
-def _add_tree_children(parent_branch, parent_repo_url, children_map, has_rich, depth=0):
+def _add_tree_children(parent_branch, parent_key, children_map, has_rich, depth=0):
     """Recursively add transitive deps as nested children of a tree node."""
-    kids = children_map.get(parent_repo_url, [])
+    kids = children_map.get(parent_key, [])
     for child_dep in kids:
         child_name = _dep_display_name(child_dep)
         child_branch = parent_branch.add(f"[dim]{child_name}[/dim]") if has_rich else child_name
         if depth < 5:  # Prevent infinite recursion
-            _add_tree_children(child_branch, child_dep.repo_url, children_map, has_rich, depth + 1)
+            _add_tree_children(
+                child_branch,
+                child_dep.get_unique_key(),
+                children_map,
+                has_rich,
+                depth + 1,
+            )
+
+
+def _echo_tree_children(
+    parent_key: str,
+    children_map: dict[str, list],
+    prefix: str = "",
+    depth: int = 0,
+) -> None:
+    """Render transitive dependencies recursively without Rich."""
+    kids = children_map.get(parent_key, [])
+    for index, child_dep in enumerate(kids):
+        is_last = index == len(kids) - 1
+        child_prefix = "+-- " if is_last else "|-- "
+        click.echo(f"{prefix}{child_prefix}{_dep_display_name(child_dep)}")
+        if depth < 5:
+            continuation = "    " if is_last else "|   "
+            _echo_tree_children(
+                child_dep.get_unique_key(),
+                children_map,
+                prefix + continuation,
+                depth + 1,
+            )
 
 
 # ---------------------------------------------------------------------------
@@ -156,13 +184,14 @@ def _resolve_scope_deps(apm_dir, logger, insecure_only=False):
         if lockfile_path.exists():
             lockfile = LockFile.read(lockfile_path)
             for dep in lockfile.dependencies.values():
-                # Orphan / source matching is host-blind: it compares against
-                # the apm.yml-derived keys above and the host-blind apm_modules/
-                # filesystem layout. get_unique_key() is the host-qualified
-                # lockfile dedup key (#773) and must NOT be used here, or a
-                # non-default-host dep never matches its installed directory
-                # (it would be wrongly flagged orphaned and lose its Source).
-                dep_key = dep.get_canonical_dependency_string()
+                # Match the host-blind apm_modules/ layout. Local dependency
+                # identity retains its source-relative path, so derive its key
+                # from the canonical install path instead.
+                if dep.source == "local":
+                    install_path = dep.to_dependency_ref().get_install_path(apm_modules_path)
+                    dep_key = install_path.relative_to(apm_modules_path).as_posix()
+                else:
+                    dep_key = dep.get_canonical_dependency_string()
                 if dep_key and dep_key not in declared_sources:
                     declared_sources[dep_key] = _deps_list_source_label(
                         dep.host,
@@ -490,7 +519,8 @@ def _build_dep_tree(apm_dir):
             'apm_modules_path': Path,
             'source': 'lockfile' | 'directory',
             'direct': [dep, ...],           # lockfile mode only
-            'children_map': {url: [dep]},   # lockfile mode only
+            'children_map': {unique_key: [dep]},  # lockfile mode only
+            'unresolved': [dep, ...],       # lockfile mode only
             'scanned_packages': [{...}],    # directory fallback only
             'has_modules': bool,
         }
@@ -513,6 +543,7 @@ def _build_dep_tree(apm_dir):
         "source": "directory",
         "direct": [],
         "children_map": {},
+        "unresolved": [],
         "scanned_packages": [],
         "has_modules": apm_modules_path.exists(),
     }
@@ -531,12 +562,36 @@ def _build_dep_tree(apm_dir):
                     result["direct"] = [d for d in lockfile_deps if d.depth <= 1]
                     transitive = [d for d in lockfile_deps if d.depth > 1]
                     children_map: dict[str, list] = {}
+                    unresolved = []
+                    parents_by_unique_key: dict[tuple[int, str], list] = {}
+                    parents_by_repo_url: dict[tuple[int, str], list] = {}
+                    for candidate in lockfile_deps:
+                        parents_by_unique_key.setdefault(
+                            (candidate.depth, candidate.get_unique_key()), []
+                        ).append(candidate)
+                        parents_by_repo_url.setdefault(
+                            (candidate.depth, candidate.repo_url), []
+                        ).append(candidate)
                     for dep in transitive:
                         parent_key = dep.resolved_by or ""
+                        parent_depth = dep.depth - 1
+                        parent_candidates = parents_by_unique_key.get(
+                            (parent_depth, parent_key), []
+                        )
+                        if not parent_candidates:
+                            parent_candidates = parents_by_repo_url.get(
+                                (parent_depth, parent_key), []
+                            )
+                        if len(parent_candidates) == 1:
+                            parent_key = parent_candidates[0].get_unique_key()
+                        else:
+                            unresolved.append(dep)
+                            continue
                         if parent_key not in children_map:
                             children_map[parent_key] = []
                         children_map[parent_key].append(dep)
                     result["children_map"] = children_map
+                    result["unresolved"] = unresolved
                     return result
     except Exception:
         pass
@@ -609,6 +664,7 @@ def tree(global_):
         if tree_data["source"] == "lockfile":
             direct = tree_data["direct"]
             children_map = tree_data["children_map"]
+            unresolved = tree_data.get("unresolved", [])
 
             if has_rich:
                 root_tree = Tree(f"[bold cyan]{project_name}[/bold cyan] (local)")
@@ -624,7 +680,13 @@ def tree(global_):
                             prim_summary = _format_primitive_counts(_count_primitives(install_path))
                             if prim_summary:
                                 branch.add(f"[dim]{prim_summary}[/dim]")
-                        _add_tree_children(branch, dep.repo_url, children_map, has_rich)
+                        _add_tree_children(branch, dep.get_unique_key(), children_map, has_rich)
+                    for dep in unresolved:
+                        display = _dep_display_name(dep)
+                        branch = root_tree.add(
+                            f"[yellow]{display} (could not determine parent)[/yellow]"
+                        )
+                        _add_tree_children(branch, dep.get_unique_key(), children_map, has_rich)
                 console.print(root_tree)
             else:
                 click.echo(f"{project_name} (local)")
@@ -632,17 +694,18 @@ def tree(global_):
                     click.echo("+-- No dependencies installed")
                 else:
                     for i, dep in enumerate(direct):
-                        is_last = i == len(direct) - 1
+                        is_last = i == len(direct) - 1 and not unresolved
                         prefix = "+-- " if is_last else "|-- "
                         display = _dep_display_name(dep)
                         click.echo(f"{prefix}{display}")
-                        # Show transitive deps
-                        kids = children_map.get(dep.repo_url, [])
                         sub_prefix = "    " if is_last else "|   "
-                        for j, child in enumerate(kids):
-                            child_is_last = j == len(kids) - 1
-                            child_prefix = "+-- " if child_is_last else "|-- "
-                            click.echo(f"{sub_prefix}{child_prefix}{_dep_display_name(child)}")
+                        _echo_tree_children(dep.get_unique_key(), children_map, sub_prefix)
+                    for i, dep in enumerate(unresolved):
+                        is_last = i == len(unresolved) - 1
+                        prefix = "+-- " if is_last else "|-- "
+                        click.echo(f"{prefix}{_dep_display_name(dep)} (could not determine parent)")
+                        sub_prefix = "    " if is_last else "|   "
+                        _echo_tree_children(dep.get_unique_key(), children_map, sub_prefix)
         # Fallback: scan apm_modules directory (no lockfile)
         elif has_rich:
             root_tree = Tree(f"[bold cyan]{project_name}[/bold cyan] (local)")

{apm_cli-0.24.0 → apm_cli-0.24.1}/src/apm_cli/commands/install.py

@@ -80,10 +80,10 @@ from apm_cli.install.services import (
 
 # Re-export validation leaf helpers so that existing test patches like
 # @patch("apm_cli.commands.install._validate_package_exists") keep working.
-# _validate_and_add_packages_to_apm_yml stays here (not moved) because it
-# calls _validate_package_exists and _local_path_failure_reason via module-
-# level name lookup -- keeping it co-located means @patch on this module
-# intercepts those calls without test changes.
+# _validate_and_add_packages_to_apm_yml stays co-located (module lookup keeps @patch working).
+from apm_cli.install.validation import (
+    _generic_host_ambiguous_subpath_hint as _ambiguous_subpath_hint,
+)
 from apm_cli.install.validation import (
     _local_path_failure_reason,
     _local_path_no_markers_hint,  # noqa: F401 -- re-exported; test_architecture_invariants checks importability
@@ -268,7 +268,9 @@ _APM_IMPORT_ERROR = None
 try:
     from ..deps.apm_resolver import APMDependencyResolver
     from ..deps.lockfile import LockFile, get_lockfile_path, migrate_lockfile_if_needed
-    from ..integration.mcp_integrator import MCPIntegrator
+    from ..integration.mcp_integrator import (
+        MCPIntegrator,  # noqa: F401 -- re-exported; tests patch commands.install.MCPIntegrator
+    )
     from ..models.apm_package import APMPackage, DependencyReference
 
     class _ScopedInstallDependencyResolver(APMDependencyResolver):
@@ -543,7 +545,7 @@ def _resolve_package_references(
             if marketplace_provenance:
                 _marketplace_provenance[identity] = marketplace_provenance
         else:
-            reason = _local_path_failure_reason(dep_ref)
+            reason = _local_path_failure_reason(dep_ref) or _ambiguous_subpath_hint(dep_ref)
             if not reason:
                 # Round-4 panel fix (devx-ux): name the four-step probe
                 # chain explicitly when the validator exhausted it
@@ -1739,11 +1741,13 @@ def _install_apm_packages(ctx, outcome):
     # field after the lockfile is regenerated by the APM install step.
     old_mcp_servers: builtins.set = builtins.set()
     old_mcp_configs: builtins.dict = {}
+    old_mcp_provenance: builtins.dict = {}
     _lock_path = get_lockfile_path(ctx.apm_dir)
     _existing_lock = LockFile.read(_lock_path)
     if _existing_lock:
         old_mcp_servers = builtins.set(_existing_lock.mcp_servers)
         old_mcp_configs = builtins.dict(_existing_lock.mcp_configs)
+        old_mcp_provenance = builtins.dict(_existing_lock.mcp_config_provenance)
 
     # Enter the APM install path when there are deps, local .apm/ primitives
     # (#714), OR orphan deps in the lockfile to clean up (manifest emptied).
@@ -1845,122 +1849,45 @@ def _install_apm_packages(ctx, outcome):
 
         clear_apm_yml_cache()
 
-    # Collect transitive MCP dependencies from resolved APM packages
-    transitive_mcp = []
+    # -------------------------------------------------------------------------
+    # MCP integration (extracted to install/mcp/integration.py)
+    # -------------------------------------------------------------------------
+    from apm_cli.install.mcp import run_mcp_integration
+    from apm_cli.policy.install_preflight import PolicyBlockError
+
     from ..core.scope import get_modules_dir
 
     apm_modules_path = get_modules_dir(ctx.scope)
-    if should_install_mcp and apm_modules_path.exists():
-        lock_path = get_lockfile_path(ctx.apm_dir)
-        transitive_mcp = MCPIntegrator.collect_transitive(
-            apm_modules_path,
-            lock_path,
-            ctx.trust_transitive_mcp,
-            diagnostics=apm_diagnostics,
-        )
-        if transitive_mcp:
-            logger.verbose_detail(f"Collected {len(transitive_mcp)} transitive MCP dependency(ies)")
-            mcp_deps = MCPIntegrator.deduplicate(mcp_deps + transitive_mcp)
-
-    # allowExecutables MCP gate.
-    from ..security.executables import filter_mcp_by_allow_executables as _fmcp
-
-    mcp_deps = _fmcp(mcp_deps, getattr(apm_package, "allow_executables", None), logger)
-
-    # The pipeline gate phase (policy_gate.py) checks direct APM deps
-    # and direct MCP deps from apm.yml.  However, transitive MCP
-    # servers (discovered via collect_transitive above) are only known
-    # after APM packages are installed.  Run a second preflight
-    # against the *merged* MCP set (direct + transitive) BEFORE
-    # MCPIntegrator writes runtime configs.  On PolicyBlockError we
-    # abort the MCP write but leave already-installed APM packages
-    # in place (they were approved by the gate phase).
-    if should_install_mcp and mcp_deps:
-        from apm_cli.policy.install_preflight import (
-            PolicyBlockError as _TransitivePBE,
-        )
-        from apm_cli.policy.install_preflight import (
-            run_policy_preflight as _transitive_preflight,
-        )
-
-        try:
-            _transitive_preflight(
-                project_root=ctx.project_root,
-                mcp_deps=mcp_deps,
-                no_policy=ctx.no_policy,
-                logger=logger,
-                dry_run=False,
-            )
-        except _TransitivePBE:
-            logger.error(
-                "MCP server(s) blocked by org policy. "
-                "APM packages remain installed; MCP configs were NOT written."
-            )
-            logger.render_summary()
-            sys.exit(1)
 
-    mcp_count = 0
-    new_mcp_servers: builtins.set = builtins.set()
-    # Forward only the targets-key the user actually declared so parse_targets_field
-    # in the gate sees the same dict shape it sees from raw apm.yml. Including a
-    # `targets: None` placeholder when the user wrote `target:` (singular) would
-    # falsely trip the conflict-mutex check (see core.apm_yml.parse_targets_field).
-    # This restores parity with `apm install` for users on the modern `targets:`
-    # plural form -- without this, `targets:` was silently dropped at the call
-    # site and the gate fell back to permissive directory detection (#1335).
-    mcp_apm_config: dict = {"scripts": apm_package.scripts or {}}
-    if apm_package.targets is not None:
-        mcp_apm_config["targets"] = apm_package.targets
-    elif apm_package.target is not None:
-        mcp_apm_config["target"] = apm_package.target
-    if should_install_mcp and mcp_deps:
-        mcp_count = MCPIntegrator.install(
-            mcp_deps,
-            ctx.runtime,
-            ctx.exclude,
-            ctx.verbose,
-            stored_mcp_configs=old_mcp_configs,
-            apm_config=mcp_apm_config,
+    try:
+        mcp_count, mcp_apm_config = run_mcp_integration(
+            apm_package=apm_package,
+            mcp_deps=mcp_deps,
+            apm_modules_path=apm_modules_path,
+            lock_path=_lock_path,
+            old_mcp_servers=old_mcp_servers,
+            old_mcp_configs=old_mcp_configs,
+            old_mcp_provenance=old_mcp_provenance,
             project_root=ctx.project_root,
             user_scope=(ctx.scope is InstallScope.USER),
-            explicit_target=ctx.target,
+            should_install=should_install_mcp,
+            logger=logger,
             diagnostics=apm_diagnostics,
+            runtime=ctx.runtime,
+            exclude=ctx.exclude,
+            trust_transitive_mcp=ctx.trust_transitive_mcp,
+            no_policy=ctx.no_policy,
+            verbose=ctx.verbose,
+            explicit_target=ctx.target,
             scope=ctx.scope,
         )
-        new_mcp_servers = MCPIntegrator.get_server_names(mcp_deps)
-        new_mcp_configs = MCPIntegrator.get_server_configs(mcp_deps)
-
-        # Remove stale MCP servers that are no longer needed
-        stale_servers = old_mcp_servers - new_mcp_servers
-        if stale_servers:
-            MCPIntegrator.remove_stale(
-                stale_servers,
-                ctx.runtime,
-                ctx.exclude,
-                project_root=ctx.project_root,
-                user_scope=(ctx.scope is InstallScope.USER),
-                scope=ctx.scope,
-            )
-
-        # Persist the new MCP server set and configs in the lockfile
-        MCPIntegrator.update_lockfile(new_mcp_servers, _lock_path, mcp_configs=new_mcp_configs)
-    elif should_install_mcp and not mcp_deps:
-        # No MCP deps at all -- remove any old APM-managed servers
-        if old_mcp_servers:
-            MCPIntegrator.remove_stale(
-                old_mcp_servers,
-                ctx.runtime,
-                ctx.exclude,
-                project_root=ctx.project_root,
-                user_scope=(ctx.scope is InstallScope.USER),
-                scope=ctx.scope,
-            )
-            MCPIntegrator.update_lockfile(builtins.set(), _lock_path, mcp_configs={})
-        logger.verbose_detail("No MCP dependencies found in apm.yml")
-    elif not should_install_mcp and old_mcp_servers:
-        # --only=apm: APM install regenerated the lockfile and dropped
-        # mcp_servers.  Restore the previous set so it is not lost.
-        MCPIntegrator.update_lockfile(old_mcp_servers, _lock_path, mcp_configs=old_mcp_configs)
+    except PolicyBlockError:
+        logger.error(
+            "MCP server(s) blocked by org policy. "
+            "APM packages remain installed; MCP configs were NOT written."
+        )
+        logger.render_summary()
+        sys.exit(1)
 
     # -------------------------------------------------------------------------
     # LSP integration (extracted to install/lsp/integration.py)

{apm_cli-0.24.0 → apm_cli-0.24.1}/src/apm_cli/commands/prune.py

@@ -52,7 +52,7 @@ def prune(ctx, dry_run):
         # Build expected vs installed using shared helpers
         try:
             apm_package = APMPackage.from_apm_yml(Path(APM_YML_FILENAME))
-            declared_deps = apm_package.get_apm_dependencies()
+            declared_deps = apm_package.get_all_apm_dependencies()
             lockfile = LockFile.read(get_lockfile_path(Path.cwd()))
             expected_installed = _build_expected_install_paths(
                 declared_deps, lockfile, apm_modules_dir

{apm_cli-0.24.0 → apm_cli-0.24.1}/src/apm_cli/commands/publish.py

@@ -17,6 +17,7 @@ import click
 
 from ..core.command_logger import CommandLogger
 from ..deps.registry.feature_gate import require_package_registry_enabled
+from ..models.dependency.identity import normalize_package_repo_url
 from ..utils.paths import portable_relpath
 
 _PUBLISH_HELP = """\
@@ -161,7 +162,12 @@ def _resolve_package_id(package_id: str) -> tuple[str, str]:
     raw = re.sub(r"^https?://[^/]+/", "", package_id).strip("/")
     parts = [p for p in raw.split("/") if p]
     if len(parts) >= 2:
-        return parts[-2], parts[-1]
+        canonical = normalize_package_repo_url(
+            "/".join(parts[-2:]),
+            source="registry",
+        )
+        owner, repo = canonical.split("/", 1)
+        return owner, repo
     raise click.UsageError(
         f"--package must be in owner/repo form (got {package_id!r}).\n"
         "Example: --package acme/my-skill"