apm-cli 0.24.1__tar.gz → 0.26.0__tar.gz

{apm_cli-0.24.1 → apm_cli-0.26.0}/NOTICE

@@ -334,6 +334,43 @@ Copyright 2019 Kenneth Reitz
 
 ---
 
+## Component. truststore
+
+- Version requirement: `>=0.10.0`
+- Upstream: https://github.com/sethmlarson/truststore
+- SPDX: `MIT`
+- Notes: Verifies HTTPS against the operating-system trust store by default so `apm` works behind a corporate CA / TLS-inspecting proxy.
+
+### Open Source License/Copyright Notice.
+
+_Copyright (c) 2022 Seth Michael Larson_
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2022 Seth Michael Larson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```
+
+---
+
 ## Component. python-frontmatter
 
 - Version requirement: `>=1.0.0`

{apm_cli-0.24.1/src/apm_cli.egg-info → apm_cli-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.24.1
+Version: 0.26.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -41,6 +41,7 @@ Requires-Dist: click>=8.0.0
 Requires-Dist: colorama>=0.4.6
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: requests>=2.31.0
+Requires-Dist: truststore>=0.10.0
 Requires-Dist: python-frontmatter>=1.0.0
 Requires-Dist: llm>=0.28
 Requires-Dist: llm-github-models>=0.18.0
@@ -63,6 +64,8 @@ Requires-Dist: ruff>=0.11.0; extra == "dev"
 Requires-Dist: mypy>=1.0.0; extra == "dev"
 Requires-Dist: jsonschema>=4.0.0; extra == "dev"
 Requires-Dist: pylint>=3.0.0; extra == "dev"
+Requires-Dist: hypothesis>=6.0.0; extra == "dev"
+Requires-Dist: mutmut==3.6.0; extra == "dev"
 Provides-Extra: build
 Requires-Dist: pyinstaller>=6.0.0; extra == "build"
 Dynamic: license-file

{apm_cli-0.24.1 → apm_cli-0.26.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.24.1"
+version = "0.26.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -26,6 +26,7 @@ dependencies = [
     "colorama>=0.4.6",
     "pyyaml>=6.0.0",
     "requests>=2.31.0",
+    "truststore>=0.10.0",
     "python-frontmatter>=1.0.0",
     "llm>=0.28",
     "llm-github-models>=0.18.0",
@@ -51,6 +52,8 @@ dev = [
     "mypy>=1.0.0",
     "jsonschema>=4.0.0",
     "pylint>=3.0.0",
+    "hypothesis>=6.0.0",
+    "mutmut==3.6.0",
 ]
 build = [
     "pyinstaller>=6.0.0",
@@ -63,6 +66,12 @@ apm = "apm_cli.cli:main"
 where = ["src"]
 include = ["apm_cli*"]
 
+[tool.setuptools.package-data]
+# Belt-and-suspenders: ship the child-TLS .pth alongside the bootstrap module.
+# Delivery no longer depends on this (ensure_child_tls_bootstrap generates the
+# .pth inline), but packaging it keeps the source tree and wheel in sync.
+"apm_cli.core._child_tls" = ["*.pth"]
+
 [tool.ruff]
 line-length = 100
 target-version = "py310"
@@ -152,22 +161,62 @@ exclude_lines = [
     "@overload",
 ]
 
+[tool.mutmut]
+source_paths = ["src/"]
+only_mutate = [
+    "src/apm_cli/models/dependency/subsets.py",
+    "src/apm_cli/install/plan.py",
+    "src/apm_cli/policy/discovery.py",
+    "src/apm_cli/compilation/link_resolver.py",
+    "src/apm_cli/deps/lockfile.py",
+]
+pytest_add_cli_args = [
+    "-n0",
+    "-p",
+    "no:cacheprovider",
+    "-o",
+    "addopts=",
+]
+pytest_add_cli_args_test_selection = [
+    "tests/unit/test_skill_subset_persistence.py",
+    "tests/unit/test_dep_targets_persistence.py",
+    "tests/unit/install/test_plan.py",
+    "tests/unit/policy/test_cache_merged_effective.py::test_policy_serializer_covers_every_dataclass_leaf",
+    "tests/unit/policy/test_cache_merged_effective.py::test_policy_serializer_preserves_sparse_bin_deploy_shapes",
+    "tests/unit/policy/test_cache_merged_effective.py::TestPolicyRoundTrip::test_all_effective_policy_fields_survive_cache_round_trip",
+    "tests/unit/compilation/test_link_resolver.py",
+    "tests/unit/compilation/test_link_resolver_phase3.py",
+    "tests/unit/compilation/test_link_resolver_resolution.py",
+    "tests/unit/deps/test_lockfile_field_properties.py",
+]
+timeout_constant = 1.0
+timeout_multiplier = 5.0
+use_setproctitle = false
+
 [tool.pytest.ini_options]
-addopts = "-m 'not benchmark and not live'"
+addopts = "-m 'not benchmark and not live' --strict-markers"
+testpaths = ["tests"]
 markers = [
+    "unit: pure logic with no filesystem and no CLI",
+    "component: in-process behavior that touches a filesystem or one command boundary",
+    "e2e: a real installed CLI crossing at least one command boundary",
     "integration: marks tests as integration tests that may require network access",
     "live: marks tests that hit real GitHub repos (requires network + optional GITHUB_TOKEN)",
     "slow: marks tests as slow running tests",
     "benchmark: marks performance benchmark tests (deselected by default, run with -m benchmark)",
+    "windows_compat: load-bearing cross-platform regression contract family (CRLF-safe atomic writes, portable path formatting, git-executable resolution, socket/thread shutdown); runs on every OS and is additionally selected by the PR-time Windows Compatibility Gate -- NOT a requires_windows skip-gate, do not use requires_windows for this",
     "requires_e2e_mode: requires APM_E2E_TESTS=1",
     "requires_github_token: requires GITHUB_APM_PAT or GITHUB_TOKEN",
     "requires_ado_pat: requires ADO_APM_PAT",
     "requires_ado_bearer: requires az CLI logged in + APM_TEST_ADO_BEARER=1",
     "requires_network_integration: requires APM_RUN_INTEGRATION_TESTS=1",
+    "requires_windows: requires a Windows host",
     "requires_apm_binary: requires built apm binary on PATH (or APM_BINARY_PATH)",
     "requires_runtime_codex: requires codex runtime installed",
     "requires_runtime_copilot: requires GitHub Copilot CLI runtime installed",
     "requires_runtime_llm: requires llm runtime installed",
     "requires_inference: requires APM_RUN_INFERENCE_TESTS=1 + model API access",
     "req: binds a test to one or more OpenAPM req-XXX ids (spec-conformance suite)",
+    "lifecycle_smoke: promoted to the required PR-time Lifecycle Smoke (Linux) job -- see ci.yml's lifecycle-smoke job and docs/src/content/docs/contributing/integration-testing.md",
+    "lifecycle_merge_group: unique lifecycle contracts retained in the full merge-group integration suite",
 ]

{apm_cli-0.24.1 → apm_cli-0.26.0}/src/apm_cli/adapters/client/base.py

@@ -210,6 +210,19 @@ class MCPClientAdapter(ABC):
             return self._project_root
         return Path(os.getcwd())
 
+    def render_server_config(self, server_info: dict) -> dict:
+        """Render one native server entry for exact baseline comparisons."""
+        rendered = self._format_server_config(
+            server_info,
+            env_overrides={},
+            runtime_vars={},
+        )
+        if isinstance(rendered, tuple):
+            rendered = rendered[0]
+        if not isinstance(rendered, dict):
+            raise ValueError("Adapter did not produce a native MCP server mapping")
+        return rendered
+
     @abstractmethod
     def get_config_path(self):
         """Get the path to the MCP configuration file."""

{apm_cli-0.24.1 → apm_cli-0.26.0}/src/apm_cli/bundle/packer.py

@@ -93,7 +93,9 @@ def pack_bundle(
         package = APMPackage.from_apm_yml(apm_yml_path)
         pkg_name = package.name
         pkg_version = package.version or "0.0.0"
-        config_target = package.target
+        from apm_cli.models.apm_package import package_target_selection
+
+        config_target = package_target_selection(package)
 
         # HYBRID author guard: apm.yml.description and SKILL.md
         # description serve different consumers (human-facing CLI/search
@@ -141,7 +143,7 @@ def pack_bundle(
         # List from CLI (e.g. --target claude,copilot) passes through directly
         effective_target = target
     elif isinstance(config_target, list) and target is None:
-        # List from apm.yml target: [claude, copilot]
+        # Canonical list from either apm.yml target spelling.
         effective_target = config_target
     else:
         effective_target, _reason = detect_target(

{apm_cli-0.24.1 → apm_cli-0.26.0}/src/apm_cli/bundle/plugin_exporter.py

@@ -22,6 +22,7 @@ from ..deps.lockfile import (
     migrate_lockfile_if_needed,
 )
 from ..models.apm_package import APMPackage, DependencyReference
+from ..models.dependency.subsets import skill_subset_filter_tokens
 from ..utils.archive import (
     projected_archive_path,
     validate_archive_format,
@@ -30,8 +31,10 @@ from ..utils.archive import (
 )
 from ..utils.console import _rich_warning
 from ..utils.path_security import PathTraversalError, ensure_path_within, safe_rmtree
+from ..utils.paths import portable_relpath
 from .attest import verify_attested_file
 from .packer import PackResult
+from .plugin_layout import PLUGIN_ROOT_DIRS, find_plugin_root_sources
 
 # ---------------------------------------------------------------------------
 # Path helpers
@@ -125,11 +128,49 @@ def _collect_root_plugin_components(project_root: Path) -> list[tuple[Path, str]
     ``skills/``, etc. at the repo root) have their files picked up here.
     """
     components: list[tuple[Path, str]] = []
-    for dir_name in ("agents", "skills", "commands", "instructions", "extensions"):
+    for dir_name in PLUGIN_ROOT_DIRS:
+        if dir_name == "hooks":
+            continue
         _collect_recursive(project_root / dir_name, dir_name, components)
     return components
 
 
+def _emit_pack_warning(message: str, logger=None) -> None:
+    """Send a pack warning through the command logger when available."""
+    if logger:
+        logger.warning(message)
+    else:
+        _rich_warning(message, symbol="warning")
+
+
+def _warn_skipped_root_components(project_root: Path, logger=None) -> None:
+    """Explain why plugin-native root sources are not packed."""
+    for source in find_plugin_root_sources(project_root):
+        if source == "hooks.json":
+            message = (
+                "Skipping root-level hooks.json because .apm/ is present. "
+                "Move publishable hook configuration to .apm/hooks/ or remove "
+                "hooks.json to silence this warning."
+            )
+        else:
+            message = (
+                f"Skipping root-level {source}/ because .apm/ is present. "
+                f"Move publishable files to .apm/{source}/ or remove {source}/ "
+                "to silence this warning."
+            )
+        _emit_pack_warning(message, logger)
+
+
+def _warn_no_local_primitives(logger=None) -> None:
+    """Explain how to recover from an empty APM-native source layout."""
+    _emit_pack_warning(
+        "No local primitives found. Expected content under .apm/. "
+        "Move plugin-native content into .apm/, or remove .apm/ to restore "
+        "root convention discovery.",
+        logger,
+    )
+
+
 def _collect_bare_skill(
     install_path: Path,
     dep: "LockedDependency",
@@ -178,7 +219,7 @@ def _collect_flat(
     rename=None,
 ) -> None:
     """Add every regular non-symlink file directly inside *src_dir*."""
-    if not src_dir.is_dir():
+    if src_dir.is_symlink() or not src_dir.is_dir():
         return
     for f in sorted(src_dir.iterdir()):
         if f.is_file() and not f.is_symlink():
@@ -194,7 +235,7 @@ def _collect_recursive(
     rename=None,
 ) -> None:
     """Add every regular non-symlink file under *src_dir*, preserving hierarchy."""
-    if not src_dir.is_dir():
+    if src_dir.is_symlink() or not src_dir.is_dir():
         return
     for f in sorted(src_dir.rglob("*")):
         if not f.is_file() or f.is_symlink():
@@ -483,6 +524,76 @@ def _plugin_rel_for_deployed_path(
     return PurePosixPath(*plugin_parts).as_posix()
 
 
+def _collect_explicit_local_components(
+    project_root: Path,
+    includes: list[str],
+) -> tuple[list[tuple[Path, str]], dict]:
+    """Collect only explicitly listed local paths and validate each path."""
+    components: list[tuple[Path, str]] = []
+    hooks: dict = {}
+    for declared_path in includes:
+        parts = _deployed_path_parts(declared_path)
+        candidate = project_root.joinpath(*parts)
+        if candidate.is_symlink():
+            raise ValueError(
+                f"includes path {declared_path!r} is a symlink. "
+                "Replace it with a regular file or directory."
+            )
+        try:
+            source = ensure_path_within(candidate, project_root)
+        except PathTraversalError as exc:
+            raise ValueError(
+                f"includes path {declared_path!r} escapes the project root. "
+                "Fix the path in apm.yml."
+            ) from exc
+        if not source.exists():
+            raise ValueError(
+                f"includes path {declared_path!r} does not exist. "
+                "Fix the path in apm.yml or create it."
+            )
+        entries = [source] if source.is_file() else sorted(source.rglob("*"))
+        for entry in entries:
+            if entry.is_symlink():
+                raise ValueError(
+                    f"Symlink found inside includes path {declared_path!r}: "
+                    f"{entry.name}. Remove the symlink or list a regular path."
+                )
+        for file_path in (entry for entry in entries if entry.is_file()):
+            try:
+                file_path = ensure_path_within(file_path, project_root)
+            except PathTraversalError as exc:
+                raise ValueError(
+                    f"A file inside includes path {declared_path!r} escapes the "
+                    "project root. Remove the symlink or fix the path in apm.yml."
+                ) from exc
+            repo_relative = portable_relpath(file_path, project_root)
+            is_hook = (
+                repo_relative == "hooks.json"
+                or repo_relative.startswith("hooks/")
+                or repo_relative.startswith(".apm/hooks/")
+            )
+            if is_hook:
+                try:
+                    hook_data = json.loads(file_path.read_text(encoding="utf-8"))
+                except (OSError, ValueError, RecursionError) as exc:
+                    raise ValueError(
+                        f"Explicit hook include is not valid JSON: {repo_relative}"
+                    ) from exc
+                if not isinstance(hook_data, dict):
+                    raise ValueError(
+                        f"Explicit hook include must contain a JSON object: {repo_relative}"
+                    )
+                _deep_merge(hooks, hook_data, overwrite=False)
+                continue
+            plugin_relative = _plugin_rel_for_deployed_path(repo_relative, None)
+            if plugin_relative is None:
+                raise ValueError(
+                    f"Explicit include path is not a packable primitive: {repo_relative}"
+                )
+            components.append((file_path, plugin_relative))
+    return components, hooks
+
+
 def _verify_attested_hash(
     source: Path,
     project_root: Path,
@@ -531,7 +642,7 @@ def _collect_deployed_components(
     components: list[tuple[Path, str]] = []
     missing: list[str] = []
     seen_outputs: set[str] = set()
-    skill_subset = set(dep.skill_subset) if dep.skill_subset else None
+    skill_subset = skill_subset_filter_tokens(dep.skill_subset)
 
     for rel_path in dep.deployed_files:
         try:
@@ -765,16 +876,34 @@ def export_plugin_bundle(
 
             _merge_file_map(file_map, dep_components, dep_name, force, collisions)
 
-    # 6. Collect own components (.apm/ and root-level)
+    # 6. Collect own components according to the local source authority.
     own_apm_dir = project_root / ".apm"
-    own_components = _collect_apm_components(own_apm_dir)
-    own_components.extend(_collect_root_plugin_components(project_root))
+    if isinstance(package.includes, list):
+        own_components, root_hooks = _collect_explicit_local_components(
+            project_root,
+            package.includes,
+        )
+    else:
+        own_components = _collect_apm_components(own_apm_dir)
+        root_hooks = _collect_hooks_from_apm(own_apm_dir)
+        if own_apm_dir.is_dir():
+            _warn_skipped_root_components(project_root, logger)
+        else:
+            own_components.extend(_collect_root_plugin_components(project_root))
+            root_hooks_top = _collect_hooks_from_root(project_root)
+            _deep_merge(root_hooks, root_hooks_top, overwrite=False)
+
+    if (
+        not isinstance(package.includes, list)
+        and own_apm_dir.is_dir()
+        and not own_components
+        and not root_hooks
+    ):
+        _warn_no_local_primitives(logger)
+
     _merge_file_map(file_map, own_components, pkg_name, force, collisions)
 
     # Hooks -- root package wins on key collision
-    root_hooks = _collect_hooks_from_apm(own_apm_dir)
-    root_hooks_top = _collect_hooks_from_root(project_root)
-    _deep_merge(root_hooks, root_hooks_top, overwrite=False)
     _deep_merge(merged_hooks, root_hooks, overwrite=True)
 
     # MCP -- root package wins on server-name collision

apm_cli-0.26.0/src/apm_cli/bundle/plugin_layout.py

@@ -0,0 +1,24 @@
+"""Plugin-native source-layout conventions."""
+
+from pathlib import Path
+
+PLUGIN_ROOT_DIRS = (
+    "agents",
+    "skills",
+    "commands",
+    "instructions",
+    "extensions",
+    "hooks",
+)
+
+
+def find_plugin_root_sources(project_root: Path) -> list[str]:
+    """Return plugin-native root sources that exist."""
+    sources = [
+        name
+        for name in PLUGIN_ROOT_DIRS
+        if (project_root / name).is_dir() and not (project_root / name).is_symlink()
+    ]
+    if (project_root / "hooks.json").is_file():
+        sources.append("hooks.json")
+    return sources

{apm_cli-0.24.1 → apm_cli-0.26.0}/src/apm_cli/cache/http_cache.py

@@ -70,6 +70,7 @@ class HttpCache:
         self._cache_dir.mkdir(parents=True, exist_ok=True)
         os.chmod(str(self._cache_dir), 0o700)
         cleanup_incomplete(self._cache_dir)
+        self._tracked_size: int | None = None
 
     def get(self, url: str, headers: dict[str, str] | None = None) -> CacheEntry | None:
         """Look up a cached response for *url*.
@@ -233,6 +234,13 @@ class HttpCache:
         with contextlib.suppress(OSError):
             os.utime(str(entry_path), None)
 
+        # Update tracked size with an upper-bound estimate. Over-counting is
+        # intentional: it triggers a real scan sooner, correcting the estimate,
+        # rather than delaying eviction. The scan in _enforce_size_cap resets
+        # _tracked_size to the real total once it runs.
+        if self._tracked_size is not None:
+            self._tracked_size += len(body) + 512  # body + metadata upper-bound estimate
+
         # Enforce size cap
         self._enforce_size_cap()
 
@@ -321,10 +329,20 @@ class HttpCache:
         return 300.0
 
     def _enforce_size_cap(self) -> None:
-        """Evict LRU entries if total cache size exceeds the cap."""
+        """Evict LRU entries if total cache size exceeds the cap.
+
+        Uses a tracked size estimate to skip the full directory scan
+        when we are clearly under the cap (fast path). Falls back to a
+        full scan when the tracked size exceeds the limit or has not
+        been computed yet.
+        """
         if not self._cache_dir.is_dir():
             return
 
+        # Fast path: if we have a tracked size and it is under cap, skip scan
+        if self._tracked_size is not None and self._tracked_size <= MAX_HTTP_CACHE_BYTES:
+            return
+
         entries: list[tuple[float, str, int]] = []
         total_size = 0
 
@@ -343,6 +361,8 @@ class HttpCache:
             except OSError:
                 continue
 
+        self._tracked_size = total_size
+
         if total_size <= MAX_HTTP_CACHE_BYTES:
             return
 
@@ -356,3 +376,5 @@ class HttpCache:
                 break
             robust_rmtree(Path(path), ignore_errors=True)
             total_size -= size
+
+        self._tracked_size = total_size

{apm_cli-0.24.1 → apm_cli-0.26.0}/src/apm_cli/cache/url_normalize.py

@@ -108,8 +108,8 @@ def normalize_repo_url(url: str) -> str:
         if port:
             authority = f"{authority}:{port}"
 
-    # Step 1: Strip trailing .git from path
-    path = parsed.path or ""
+    # Step 1: Strip trailing slash and one trailing .git suffix from path.
+    path = (parsed.path or "").rstrip("/")
     if path.endswith(".git"):
         path = path[:-4]
 
@@ -122,9 +122,6 @@ def normalize_repo_url(url: str) -> str:
     if hostname in _CASE_INSENSITIVE_HOSTS:
         path = path.lower()
 
-    # Strip trailing slash from path
-    path = path.rstrip("/")
-
     # Reconstruct normalized URL
     return f"{scheme}://{authority}{path}"
 

{apm_cli-0.24.1 → apm_cli-0.26.0}/src/apm_cli/cli.py

@@ -3,6 +3,8 @@
 Thin wiring layer  -- all command logic lives in ``apm_cli.commands.*`` modules.
 """
 
+# ruff: noqa: E402
+
 import ctypes
 import logging
 import os
@@ -11,6 +13,10 @@ import warnings
 
 import click
 
+from apm_cli.core.tls_trust import configure_process_tls_trust, log_tls_trust_status
+
+configure_process_tls_trust()
+
 from apm_cli.commands._helpers import (
     ERROR,
     RESET,
@@ -64,6 +70,14 @@ _CLI_EPILOG = (
 )
 
 
+class _OutputModeGroup(click.Group):
+    """Capture full argv so root output mode precedes subcommand callbacks."""
+
+    def parse_args(self, ctx: click.Context, args: list[str]) -> list[str]:
+        ctx.meta["apm_raw_args"] = tuple(args)
+        return super().parse_args(ctx, args)
+
+
 def _configure_logging(verbose: bool = False) -> None:
     """Configure stdlib logging for the ``apm_cli`` package.
 
@@ -102,11 +116,17 @@ def _configure_logging(verbose: bool = False) -> None:
     # Install secret-redaction filter (idempotent: skip if already present).
     from apm_cli.core.auth import SecretRedactionFilter
 
-    if not any(isinstance(f, SecretRedactionFilter) for f in apm_logger.filters):
-        apm_logger.addFilter(SecretRedactionFilter())
+    handlers = {
+        *logging.getLogger().handlers,
+        *apm_logger.handlers,
+    }
+    for handler in handlers:
+        if not any(isinstance(f, SecretRedactionFilter) for f in handler.filters):
+            handler.addFilter(SecretRedactionFilter())
 
 
 @click.group(
+    cls=_OutputModeGroup,
     help="Agent Package Manager (APM): The package manager for AI-Native Development",
     epilog=_CLI_EPILOG,
 )
@@ -130,10 +150,16 @@ def cli(ctx, verbose: bool) -> None:
     """Main entry point for the APM CLI."""
     ctx.ensure_object(dict)
     ctx.obj["verbose"] = verbose
+    from apm_cli.core.output_mode import configure_output_mode, detect_output_mode
+
+    output_mode = detect_output_mode(ctx.meta.get("apm_raw_args", sys.argv[1:]))
+    configure_output_mode(output_mode)
+    ctx.obj["output_mode"] = output_mode
 
     if verbose:
         # Upgrade to DEBUG when the flag is set; env-var path runs in main().
         _configure_logging(verbose=True)
+    log_tls_trust_status()
 
     # Suppress only the agents-target deprecation warning so CLI users see
     # the formatted logger.warning() in the install phase, not a double print.
@@ -333,6 +359,7 @@ def main():
     """Main entry point for the CLI."""
     _configure_logging()  # honours APM_LOG_LEVEL env var; --verbose upgrades in cli()
     _configure_encoding()
+    configure_process_tls_trust()
     try:
         cli(obj={})
     except Exception as e:

{apm_cli-0.24.1 → apm_cli-0.26.0}/src/apm_cli/commands/_helpers.py

@@ -474,7 +474,7 @@ def _check_and_notify_updates():
             _rich_echo(get_update_hint_message(), color="yellow", bold=True)
 
             # Add a blank line for visual separation
-            click.echo()
+            _rich_echo("")
     except Exception:
         # Silently fail - version checking should never block CLI usage
         pass
@@ -706,12 +706,14 @@ def _create_minimal_apm_yml(config, plugin=False, target_path=None):
     content = out_file.read_text(encoding="utf-8")
 
     if "targets" in apm_yml_data:
+        from apm_cli.core.target_catalog import manifest_target_names
+
         # Insert comment before the targets: line
+        accepted_targets = ", ".join(sorted(manifest_target_names()))
         targets_comment = (
             "# Which agent platforms to deploy to.\n"
             "# Resolution order: --target flag > this field > auto-detect from filesystem.\n"
-            "# Accepted values: vscode, agents, copilot, claude, cursor, opencode, codex,\n"
-            "# gemini, antigravity, windsurf, kiro, agent-skills, all\n"
+            f"# Accepted values: {accepted_targets}\n"
         )
         content = content.replace("targets:", targets_comment + "targets:", 1)
     else: