apm-cli 0.25.0__tar.gz → 0.26.0__tar.gz

{apm_cli-0.25.0 → apm_cli-0.26.0}/NOTICE

@@ -334,6 +334,43 @@ Copyright 2019 Kenneth Reitz
 
 ---
 
+## Component. truststore
+
+- Version requirement: `>=0.10.0`
+- Upstream: https://github.com/sethmlarson/truststore
+- SPDX: `MIT`
+- Notes: Verifies HTTPS against the operating-system trust store by default so `apm` works behind a corporate CA / TLS-inspecting proxy.
+
+### Open Source License/Copyright Notice.
+
+_Copyright (c) 2022 Seth Michael Larson_
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2022 Seth Michael Larson
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```
+
+---
+
 ## Component. python-frontmatter
 
 - Version requirement: `>=1.0.0`

{apm_cli-0.25.0/src/apm_cli.egg-info → apm_cli-0.26.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.25.0
+Version: 0.26.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -41,6 +41,7 @@ Requires-Dist: click>=8.0.0
 Requires-Dist: colorama>=0.4.6
 Requires-Dist: pyyaml>=6.0.0
 Requires-Dist: requests>=2.31.0
+Requires-Dist: truststore>=0.10.0
 Requires-Dist: python-frontmatter>=1.0.0
 Requires-Dist: llm>=0.28
 Requires-Dist: llm-github-models>=0.18.0
@@ -63,6 +64,8 @@ Requires-Dist: ruff>=0.11.0; extra == "dev"
 Requires-Dist: mypy>=1.0.0; extra == "dev"
 Requires-Dist: jsonschema>=4.0.0; extra == "dev"
 Requires-Dist: pylint>=3.0.0; extra == "dev"
+Requires-Dist: hypothesis>=6.0.0; extra == "dev"
+Requires-Dist: mutmut==3.6.0; extra == "dev"
 Provides-Extra: build
 Requires-Dist: pyinstaller>=6.0.0; extra == "build"
 Dynamic: license-file

{apm_cli-0.25.0 → apm_cli-0.26.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.25.0"
+version = "0.26.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -26,6 +26,7 @@ dependencies = [
     "colorama>=0.4.6",
     "pyyaml>=6.0.0",
     "requests>=2.31.0",
+    "truststore>=0.10.0",
     "python-frontmatter>=1.0.0",
     "llm>=0.28",
     "llm-github-models>=0.18.0",
@@ -51,6 +52,8 @@ dev = [
     "mypy>=1.0.0",
     "jsonschema>=4.0.0",
     "pylint>=3.0.0",
+    "hypothesis>=6.0.0",
+    "mutmut==3.6.0",
 ]
 build = [
     "pyinstaller>=6.0.0",
@@ -63,6 +66,12 @@ apm = "apm_cli.cli:main"
 where = ["src"]
 include = ["apm_cli*"]
 
+[tool.setuptools.package-data]
+# Belt-and-suspenders: ship the child-TLS .pth alongside the bootstrap module.
+# Delivery no longer depends on this (ensure_child_tls_bootstrap generates the
+# .pth inline), but packaging it keeps the source tree and wheel in sync.
+"apm_cli.core._child_tls" = ["*.pth"]
+
 [tool.ruff]
 line-length = 100
 target-version = "py310"
@@ -152,22 +161,62 @@ exclude_lines = [
     "@overload",
 ]
 
+[tool.mutmut]
+source_paths = ["src/"]
+only_mutate = [
+    "src/apm_cli/models/dependency/subsets.py",
+    "src/apm_cli/install/plan.py",
+    "src/apm_cli/policy/discovery.py",
+    "src/apm_cli/compilation/link_resolver.py",
+    "src/apm_cli/deps/lockfile.py",
+]
+pytest_add_cli_args = [
+    "-n0",
+    "-p",
+    "no:cacheprovider",
+    "-o",
+    "addopts=",
+]
+pytest_add_cli_args_test_selection = [
+    "tests/unit/test_skill_subset_persistence.py",
+    "tests/unit/test_dep_targets_persistence.py",
+    "tests/unit/install/test_plan.py",
+    "tests/unit/policy/test_cache_merged_effective.py::test_policy_serializer_covers_every_dataclass_leaf",
+    "tests/unit/policy/test_cache_merged_effective.py::test_policy_serializer_preserves_sparse_bin_deploy_shapes",
+    "tests/unit/policy/test_cache_merged_effective.py::TestPolicyRoundTrip::test_all_effective_policy_fields_survive_cache_round_trip",
+    "tests/unit/compilation/test_link_resolver.py",
+    "tests/unit/compilation/test_link_resolver_phase3.py",
+    "tests/unit/compilation/test_link_resolver_resolution.py",
+    "tests/unit/deps/test_lockfile_field_properties.py",
+]
+timeout_constant = 1.0
+timeout_multiplier = 5.0
+use_setproctitle = false
+
 [tool.pytest.ini_options]
-addopts = "-m 'not benchmark and not live'"
+addopts = "-m 'not benchmark and not live' --strict-markers"
+testpaths = ["tests"]
 markers = [
+    "unit: pure logic with no filesystem and no CLI",
+    "component: in-process behavior that touches a filesystem or one command boundary",
+    "e2e: a real installed CLI crossing at least one command boundary",
     "integration: marks tests as integration tests that may require network access",
     "live: marks tests that hit real GitHub repos (requires network + optional GITHUB_TOKEN)",
     "slow: marks tests as slow running tests",
     "benchmark: marks performance benchmark tests (deselected by default, run with -m benchmark)",
+    "windows_compat: load-bearing cross-platform regression contract family (CRLF-safe atomic writes, portable path formatting, git-executable resolution, socket/thread shutdown); runs on every OS and is additionally selected by the PR-time Windows Compatibility Gate -- NOT a requires_windows skip-gate, do not use requires_windows for this",
     "requires_e2e_mode: requires APM_E2E_TESTS=1",
     "requires_github_token: requires GITHUB_APM_PAT or GITHUB_TOKEN",
     "requires_ado_pat: requires ADO_APM_PAT",
     "requires_ado_bearer: requires az CLI logged in + APM_TEST_ADO_BEARER=1",
     "requires_network_integration: requires APM_RUN_INTEGRATION_TESTS=1",
+    "requires_windows: requires a Windows host",
     "requires_apm_binary: requires built apm binary on PATH (or APM_BINARY_PATH)",
     "requires_runtime_codex: requires codex runtime installed",
     "requires_runtime_copilot: requires GitHub Copilot CLI runtime installed",
     "requires_runtime_llm: requires llm runtime installed",
     "requires_inference: requires APM_RUN_INFERENCE_TESTS=1 + model API access",
     "req: binds a test to one or more OpenAPM req-XXX ids (spec-conformance suite)",
+    "lifecycle_smoke: promoted to the required PR-time Lifecycle Smoke (Linux) job -- see ci.yml's lifecycle-smoke job and docs/src/content/docs/contributing/integration-testing.md",
+    "lifecycle_merge_group: unique lifecycle contracts retained in the full merge-group integration suite",
 ]

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/bundle/plugin_exporter.py

@@ -22,6 +22,7 @@ from ..deps.lockfile import (
     migrate_lockfile_if_needed,
 )
 from ..models.apm_package import APMPackage, DependencyReference
+from ..models.dependency.subsets import skill_subset_filter_tokens
 from ..utils.archive import (
     projected_archive_path,
     validate_archive_format,
@@ -641,7 +642,7 @@ def _collect_deployed_components(
     components: list[tuple[Path, str]] = []
     missing: list[str] = []
     seen_outputs: set[str] = set()
-    skill_subset = set(dep.skill_subset) if dep.skill_subset else None
+    skill_subset = skill_subset_filter_tokens(dep.skill_subset)
 
     for rel_path in dep.deployed_files:
         try:

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/cache/url_normalize.py

@@ -108,8 +108,8 @@ def normalize_repo_url(url: str) -> str:
         if port:
             authority = f"{authority}:{port}"
 
-    # Step 1: Strip trailing .git from path
-    path = parsed.path or ""
+    # Step 1: Strip trailing slash and one trailing .git suffix from path.
+    path = (parsed.path or "").rstrip("/")
     if path.endswith(".git"):
         path = path[:-4]
 
@@ -122,9 +122,6 @@ def normalize_repo_url(url: str) -> str:
     if hostname in _CASE_INSENSITIVE_HOSTS:
         path = path.lower()
 
-    # Strip trailing slash from path
-    path = path.rstrip("/")
-
     # Reconstruct normalized URL
     return f"{scheme}://{authority}{path}"
 

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/cli.py

@@ -3,6 +3,8 @@
 Thin wiring layer  -- all command logic lives in ``apm_cli.commands.*`` modules.
 """
 
+# ruff: noqa: E402
+
 import ctypes
 import logging
 import os
@@ -11,6 +13,10 @@ import warnings
 
 import click
 
+from apm_cli.core.tls_trust import configure_process_tls_trust, log_tls_trust_status
+
+configure_process_tls_trust()
+
 from apm_cli.commands._helpers import (
     ERROR,
     RESET,
@@ -153,6 +159,7 @@ def cli(ctx, verbose: bool) -> None:
     if verbose:
         # Upgrade to DEBUG when the flag is set; env-var path runs in main().
         _configure_logging(verbose=True)
+    log_tls_trust_status()
 
     # Suppress only the agents-target deprecation warning so CLI users see
     # the formatted logger.warning() in the install phase, not a double print.
@@ -352,6 +359,7 @@ def main():
     """Main entry point for the CLI."""
     _configure_logging()  # honours APM_LOG_LEVEL env var; --verbose upgrades in cli()
     _configure_encoding()
+    configure_process_tls_trust()
     try:
         cli(obj={})
     except Exception as e:

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/commands/approve.py

@@ -23,8 +23,22 @@ from pathlib import Path
 
 import click
 
+from ..core.command_logger import CommandLogger
+from ..policy import outcome_routing as policy_outcomes
+from ..policy.outcome_routing import POLICY_RESOLUTION_FAILURE_OUTCOMES
+from ..policy.schema import ApmPolicy
 from ..utils.console import _rich_echo, _rich_error, _rich_info, _rich_success, _rich_warning
 
+_POLICY_RESOLUTION_WARNING = (
+    "Org policy could not be resolved; approval is proceeding without org "
+    "restrictions. Run 'apm policy status --no-cache' to diagnose."
+)
+_POLICY_HASH_MISMATCH_WARNING = (
+    "Policy hash verification failed; this may indicate policy tampering. "
+    "Approval is proceeding without org restrictions. "
+    "Run 'apm policy status --no-cache' to verify the policy source."
+)
+
 
 def _find_manifest() -> Path:
     """Return the project's ``apm.yml`` path or exit."""
@@ -70,24 +84,29 @@ def _store_label(user_scope: bool) -> str:
     return "~/.apm/config.json" if user_scope else "apm.yml executables block"
 
 
-def _load_org_policy(project_root: Path):
+def _load_org_policy(project_root: Path, logger: CommandLogger | None = None) -> ApmPolicy:
     """Best-effort load of the merged org policy. Returns a default on failure."""
-    from ..policy.schema import ApmPolicy
-
+    warning: str | None = None
     try:
-        from ..policy.discovery import discover_policy
+        from ..policy.discovery import discover_policy_with_chain
 
-        result = discover_policy(project_root)
+        result = discover_policy_with_chain(project_root)
         if getattr(result, "policy", None) is not None:
             return result.policy
+        if result.outcome == policy_outcomes.POLICY_HASH_MISMATCH_OUTCOME:
+            warning = _POLICY_HASH_MISMATCH_WARNING
+        elif result.outcome in POLICY_RESOLUTION_FAILURE_OUTCOMES:
+            warning = _POLICY_RESOLUTION_WARNING
     except Exception:
-        pass
+        warning = _POLICY_RESOLUTION_WARNING
+    if warning is not None and logger is not None:
+        logger.warning(warning)
     return ApmPolicy()
 
 
-def load_org_policy(project_root: Path):
+def load_org_policy(project_root: Path, logger: CommandLogger | None = None) -> ApmPolicy:
     """Public wrapper for best-effort merged org policy loading."""
-    return _load_org_policy(project_root)
+    return _load_org_policy(project_root, logger=logger)
 
 
 @click.command("approve")
@@ -136,31 +155,35 @@ def approve_cmd(
 
         apm approve --user owner/repo
     """
-    manifest = _find_manifest()
+    logger = CommandLogger("approve")
+    try:
+        manifest = _find_manifest()
 
-    if list_decisions:
-        _list_decisions(manifest)
-        return
+        if list_decisions:
+            _list_decisions(manifest, logger=logger)
+            return
 
-    allow, deny = _load_store(manifest, user_scope)
+        allow, deny = _load_store(manifest, user_scope)
 
-    if pending:
-        _show_pending(manifest, allow)
-        return
+        if pending:
+            _show_pending(manifest, allow)
+            return
 
-    if recommended:
-        _approve_recommended(manifest, user_scope, allow, deny)
-        return
+        if recommended:
+            _approve_recommended(manifest, user_scope, allow, deny, logger=logger)
+            return
 
-    if approve_all:
-        _approve_all_pending(manifest, user_scope, allow, deny)
-        return
+        if approve_all:
+            _approve_all_pending(manifest, user_scope, allow, deny)
+            return
 
-    if not packages:
-        _rich_error("Specify at least one package, or use --pending / --all / --recommended.")
-        sys.exit(1)
+        if not packages:
+            _rich_error("Specify at least one package, or use --pending / --all / --recommended.")
+            sys.exit(1)
 
-    _approve_packages(manifest, user_scope, allow, deny, packages)
+        _approve_packages(manifest, user_scope, allow, deny, packages)
+    finally:
+        logger.render_summary()
 
 
 @click.command("deny")
@@ -213,7 +236,7 @@ def deny_cmd(packages: tuple[str, ...], user_scope: bool) -> None:
         _rich_info(f"Updated {_store_label(user_scope)} ({changed} denied).", symbol="info")
 
 
-def explain_decision(package: str) -> None:
+def explain_decision(package: str, *, logger: CommandLogger) -> None:
     """Explain the effective executable-trust decision for a package.
 
     Shows, per executable type the package declares, whether it is allowed,
@@ -232,7 +255,7 @@ def explain_decision(package: str) -> None:
 
     data = load_yaml(manifest)
     project_data = data if isinstance(data, dict) else {}
-    policy = _load_org_policy(manifest.parent)
+    policy = _load_org_policy(manifest.parent, logger=logger)
     ctx = build_exec_trust_context(policy=policy, project_data=project_data)
 
     declarations = _scan_installed_packages(manifest)
@@ -275,14 +298,14 @@ def explain_decision(package: str) -> None:
         )
 
 
-def _list_decisions(manifest: Path) -> None:
+def _list_decisions(manifest: Path, *, logger: CommandLogger) -> None:
     """Print the effective trust decision + deciding layer per installed package."""
     from ..security.executables import build_exec_trust_context, resolve_exec_decision
     from ..utils.yaml_io import load_yaml
 
     data = load_yaml(manifest)
     project_data = data if isinstance(data, dict) else {}
-    policy = _load_org_policy(manifest.parent)
+    policy = _load_org_policy(manifest.parent, logger=logger)
     ctx = build_exec_trust_context(policy=policy, project_data=project_data)
 
     declarations = [d for d in _scan_installed_packages(manifest) if d.has_executables]
@@ -364,9 +387,11 @@ def _approve_recommended(
     user_scope: bool,
     allow: dict[str, dict[str, bool]],
     deny: dict[str, dict[str, bool]],
+    *,
+    logger: CommandLogger,
 ) -> None:
     """Bulk-approve the org ``executables.recommend`` set."""
-    policy = _load_org_policy(manifest.parent)
+    policy = _load_org_policy(manifest.parent, logger=logger)
     recommend = set(getattr(getattr(policy, "executables", None), "recommend", ()) or ())
     if not recommend:
         _rich_info("No org-recommended executables to approve.", symbol="info")

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/commands/audit.py

@@ -17,6 +17,11 @@ from pathlib import Path
 import click
 
 from ..core.command_logger import CommandLogger
+from ..core.deployment_ledger import (
+    DEPLOYMENT_OWNER_REMEDIATION,
+    DeploymentLedgerCodec,
+    DeploymentOwnerViolation,
+)
 from ..deps.lockfile import LockFile, get_lockfile_path
 from ..policy._help_text import POLICY_SOURCE_FORMS_HELP
 from ..security.content_scanner import ContentScanner, ScanFinding
@@ -313,6 +318,25 @@ def _render_summary(
         logger.progress(f"  Plus {info} info-level finding(s) (use --verbose to see)")
 
 
+def _render_owner_violations(
+    violations: tuple[DeploymentOwnerViolation, ...],
+    logger: CommandLogger,
+) -> None:
+    """Render invalid canonical owner references with one remediation."""
+    if not violations:
+        return
+    logger.error(f"{len(violations)} invalid deployment ownership record(s) in apm.lock.yaml")
+    for violation in violations:
+        invalid = ", ".join(violation.invalid_owners)
+        active = (
+            f"; active owner={violation.invalid_active_owner}"
+            if violation.invalid_active_owner is not None
+            else ""
+        )
+        logger.error_detail(f"  {violation.locator.key}: invalid owner(s)={invalid}{active}")
+    logger.error_detail(DEPLOYMENT_OWNER_REMEDIATION)
+
+
 def _apply_strip(
     findings_by_file: dict[str, list[ScanFinding]],
     project_root: Path,
@@ -618,6 +642,7 @@ def _audit_ci_gate(
             pass  # Policy checks disabled
         else:
             from ..policy.models import CheckResult
+            from ..policy.policy_checks import FAIL_CLOSED_POLICY_CHECKS
 
             policy_result = run_policy_checks(cfg.project_root, policy_obj, fail_fast=fail_fast)
             if policy_obj.enforcement == "block":
@@ -625,6 +650,9 @@ def _audit_ci_gate(
             else:
                 # enforcement == "warn": include results but don't fail
                 for check in policy_result.checks:
+                    if check.name in FAIL_CLOSED_POLICY_CHECKS and not check.passed:
+                        ci_result.checks.append(check)
+                        continue
                     ci_result.checks.append(
                         CheckResult(
                             name=check.name,
@@ -840,6 +868,7 @@ def _audit_content_scan(
         # -- File mode: scan a single arbitrary file --
         findings_by_file, files_scanned = _scan_single_file(Path(file_path), logger)
         scan_paths = [Path(file_path)]
+        owner_violations: tuple[DeploymentOwnerViolation, ...] = ()
     else:
         scan_paths = [project_root]
         # -- Package mode: scan from lockfile --
@@ -854,23 +883,31 @@ def _audit_content_scan(
             # empty native result set so their findings still surface.
             findings_by_file, files_scanned = {}, 0
         else:
-            if package:
-                logger.progress(f"Scanning package: {package}")
-            else:
-                logger.start("Scanning all installed packages...")
+            if effective_format == "text":
+                if package:
+                    logger.progress(f"Scanning package: {package}")
+                else:
+                    logger.start("Scanning all installed packages...")
 
             from apm_cli.deps.lockfile import LockfileFormatError
 
             try:
+                lockfile = LockFile.read(lockfile_path)
+                owner_violations = (
+                    DeploymentLedgerCodec.owner_reference_violations(lockfile)
+                    if lockfile is not None
+                    else ()
+                )
                 findings_by_file, files_scanned = scan_lockfile_packages(
                     project_root,
                     package_filter=package,
+                    lockfile=lockfile,
                 )
             except LockfileFormatError as exc:
                 logger.error(f"Cannot audit invalid apm.lock.yaml: {exc}")
                 sys.exit(1)
 
-            if files_scanned == 0 and not external:
+            if files_scanned == 0 and not external and not owner_violations:
                 if package:
                     logger.warning(
                         f"Package '{package}' not found in apm.lock.yaml or has no deployed files"
@@ -878,6 +915,8 @@ def _audit_content_scan(
                 else:
                     logger.progress("No deployed files found in apm.lock.yaml")
                 sys.exit(0)
+        if not lockfile_path.exists():
+            owner_violations = ()
 
     # -- External scanners (opt-in, additive) -----------------------
     if external:
@@ -895,6 +934,10 @@ def _audit_content_scan(
 
     # -- Strip mode --
     if strip:
+        if owner_violations:
+            _render_owner_violations(owner_violations, logger)
+            logger.error_detail("Content was not modified while lockfile ownership is invalid.")
+            sys.exit(1)
         if not findings_by_file:
             logger.progress("Nothing to clean -- no hidden characters found")
             sys.exit(0)
@@ -971,6 +1014,8 @@ def _audit_content_scan(
     else:
         all_findings = [f for ff in findings_by_file.values() for f in ff]
         exit_code = 1 if ContentScanner.has_critical(all_findings) else 2
+    if owner_violations:
+        exit_code = 1
 
     # Bare `apm audit` is advisory for drift by default: drift findings are
     # rendered (text/json/sarif) but DO NOT escalate the exit code. When
@@ -993,7 +1038,10 @@ def _audit_content_scan(
             sys.exit(1)
         if findings_by_file:
             _render_findings_table(findings_by_file, verbose=cfg.verbose)
-        _render_summary(findings_by_file, files_scanned, logger)
+            _render_summary(findings_by_file, files_scanned, logger)
+        elif not owner_violations:
+            _render_summary(findings_by_file, files_scanned, logger)
+        _render_owner_violations(owner_violations, logger)
         if not file_path:
             _render_canvas_note(cfg.project_root, package, logger)
         if drift_findings:
@@ -1004,7 +1052,11 @@ def _audit_content_scan(
     elif effective_format == "markdown":
         from ..security.audit_report import findings_to_markdown
 
-        md_report = findings_to_markdown(findings_by_file, files_scanned=files_scanned)
+        md_report = findings_to_markdown(
+            findings_by_file,
+            files_scanned=files_scanned,
+            owner_violations=owner_violations,
+        )
         if cfg.output_path:
             Path(cfg.output_path).parent.mkdir(parents=True, exist_ok=True)
             Path(cfg.output_path).write_text(md_report, encoding="utf-8")
@@ -1020,12 +1072,17 @@ def _audit_content_scan(
         )
 
         if effective_format == "sarif":
-            report = findings_to_sarif(findings_by_file, files_scanned=files_scanned)
+            report = findings_to_sarif(
+                findings_by_file,
+                files_scanned=files_scanned,
+                owner_violations=owner_violations,
+            )
         else:
             report = findings_to_json(
                 findings_by_file,
                 files_scanned=files_scanned,
                 exit_code=exit_code,
+                owner_violations=owner_violations,
             )
 
         if cfg.output_path:

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/commands/doctor.py

@@ -17,8 +17,8 @@ from .marketplace.doctor import run_doctor
 
 @click.command(
     help=(
-        "Run environment diagnostics (git, network, auth, gh CLI, "
-        "marketplace config). Reports a pass/fail table and exits non-zero "
+        "Run environment diagnostics (git, network, auth, marketplace "
+        "config). Reports a pass/fail table and exits non-zero "
         "if a critical check fails."
     )
 )

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/commands/install.py

@@ -1226,6 +1226,7 @@ def install(  # noqa: PLR0913
                     force=force,
                     dry_run=dry_run,
                     verbose=verbose,
+                    no_policy=no_policy,
                     alias=alias,
                     logger=logger,
                     legacy_skill_paths=legacy_skill_paths,
@@ -1246,7 +1247,6 @@ def install(  # noqa: PLR0913
                         "--parallel-downloads": parallel_downloads != 4,
                         "--allow-insecure": allow_insecure,
                         "--allow-insecure-host": bool(allow_insecure_hosts),
-                        "--no-policy": no_policy,
                     },
                 )
                 # Local bundle install renders its own summary; mark

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/commands/marketplace/doctor.py

@@ -21,7 +21,9 @@ from . import (
 )
 
 
-def _executable_trust_drift_check(project_root: Path) -> _DoctorCheck | None:
+def _executable_trust_drift_check(
+    project_root: Path, logger: CommandLogger | None = None
+) -> _DoctorCheck | None:
     """Fleet-level executable-trust drift probe for ``apm doctor``.
 
     Flags packages whose project/user *allow* is overridden by the org
@@ -48,7 +50,8 @@ def _executable_trust_drift_check(project_root: Path) -> _DoctorCheck | None:
         data = load_yaml(apm_path)
         project_data = data if isinstance(data, dict) else {}
         ctx = build_exec_trust_context(
-            policy=load_org_policy(project_root), project_data=project_data
+            policy=load_org_policy(project_root, logger=logger),
+            project_data=project_data,
         )
     except Exception:
         return None
@@ -313,7 +316,7 @@ def run_doctor(verbose: bool, *, logger_name: str = "doctor") -> int:
             )
         )
 
-    drift_check = _executable_trust_drift_check(Path.cwd())
+    drift_check = _executable_trust_drift_check(Path.cwd(), logger=logger)
     if drift_check is not None:
         checks.append(drift_check)
 

{apm_cli-0.25.0 → apm_cli-0.26.0}/src/apm_cli/commands/policy.py

@@ -25,7 +25,6 @@ from ..policy.discovery import (
     MAX_STALE_TTL,
     PolicyFetchResult,
     _read_cache_entry,
-    discover_policy,
     discover_policy_with_chain,
 )
 from ..policy.schema import ApmPolicy
@@ -329,18 +328,11 @@ def status(policy_source, no_cache, as_json, output_format, check):
     project_root = Path.cwd()
 
     try:
-        if policy_source is not None:
-            result = discover_policy(
-                project_root,
-                policy_override=policy_source,
-                no_cache=no_cache,
-            )
-        elif no_cache:
-            # discover_policy_with_chain has no `no_cache` knob, so go
-            # through the lower-level entry point when the user opts out.
-            result = discover_policy(project_root, no_cache=True)
-        else:
-            result = discover_policy_with_chain(project_root)
+        result = discover_policy_with_chain(
+            project_root,
+            policy_override=policy_source,
+            no_cache=no_cache,
+        )
     except Exception as e:
         # Diagnostic must never exit non-zero; surface the failure as a
         # synthetic ``cache_miss_fetch_fail`` report and continue.
@@ -393,4 +385,6 @@ def explain(package):
     """
     from .approve import explain_decision
 
-    explain_decision(package)
+    logger = CommandLogger("policy explain")
+    explain_decision(package, logger=logger)
+    logger.render_summary()