apm-cli 0.33.0__tar.gz → 0.34.0__tar.gz

{apm_cli-0.33.0/src/apm_cli.egg-info → apm_cli-0.34.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.33.0
+Version: 0.34.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -78,7 +78,7 @@ Think `package.json`, `requirements.txt`, or `Cargo.toml` — but for AI agent c
 
 GitHub Copilot | Claude Code | Grok Build | Cursor | OpenCode | Codex | Gemini | Windsurf | Kiro
 
-**[Documentation](https://microsoft.github.io/apm/)** · **[Quick Start](https://microsoft.github.io/apm/getting-started/quick-start/)** · **[CLI Reference](https://microsoft.github.io/apm/reference/cli-commands/)** · **[Roadmap](https://github.com/orgs/microsoft/projects/2304/views/5)**
+**[Documentation](https://microsoft.github.io/apm/)** · **[Quick Start](https://microsoft.github.io/apm/quickstart/)** · **[CLI Reference](https://microsoft.github.io/apm/reference/)** · **[Roadmap](https://github.com/orgs/microsoft/projects/2304/views/5)**
 
 ---
 
@@ -140,11 +140,11 @@ One command, no configuration -- VS Code and GitHub Copilot read the file automa
 One `apm.yml` describes every primitive your agents need — instructions, skills, prompts, agents, hooks, plugins, MCP servers — and `apm install` reproduces the exact same setup across every client on every machine. `apm.lock.yaml` pins the resolved tree the way `package-lock.json` does for npm.
 
 - **[One manifest for everything](https://microsoft.github.io/apm/reference/primitive-types/)** -- declared once, deployed across Copilot, Claude, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, Kiro
-- **[Install from anywhere](https://microsoft.github.io/apm/guides/dependencies/)** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, any git host
-- **[Transitive dependencies](https://microsoft.github.io/apm/guides/dependencies/)** — packages can depend on packages; APM resolves the full tree
-- **[Author plugins](https://microsoft.github.io/apm/guides/plugins/)** — build Copilot, Claude, and Cursor plugins with dependency management, then export standard `plugin.json`
-- **[Marketplaces](https://microsoft.github.io/apm/guides/marketplaces/)** — install plugins from curated registries in one command, deployed across all targets and locked
-- **[Pack & distribute](https://microsoft.github.io/apm/guides/pack-distribute/)** — `apm pack` bundles your configuration as a zipped package or a standalone plugin
+- **[Install from anywhere](https://microsoft.github.io/apm/consumer/install-packages/)** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, any git host
+- **[Transitive dependencies](https://microsoft.github.io/apm/consumer/install-packages/#transitive-dependencies-and-the-lockfile)** — packages can depend on packages; APM resolves the full tree
+- **[Author plugins](https://microsoft.github.io/apm/producer/)** — build Copilot, Claude, and Cursor plugins with dependency management, then export standard `plugin.json`
+- **[Marketplaces](https://microsoft.github.io/apm/consumer/installing-from-marketplaces/)** — install plugins from curated registries in one command, deployed across all targets and locked
+- **[Pack & distribute](https://microsoft.github.io/apm/producer/pack-a-bundle/)** — `apm pack` bundles your configuration as a zipped package or a standalone plugin
 - **[CI/CD ready](https://github.com/microsoft/apm-action)** — GitHub Action for automated workflows
 
 ### 2. Secure by default
@@ -152,10 +152,10 @@ One `apm.yml` describes every primitive your agents need — instructions, skill
 Agent context is executable in effect — a prompt is a program for an LLM. APM treats it that way. Every install scans for hidden Unicode that can hijack agent behavior; the lockfile pins integrity hashes; transitive MCP servers are gated by trust prompts.
 
 - **[Content security](https://microsoft.github.io/apm/enterprise/security/)** — `apm install` blocks compromised packages before agents read them; `apm audit` runs the same checks on demand
-- **[Lockfile integrity](https://microsoft.github.io/apm/enterprise/governance/)** — `apm.lock` records resolved sources and content hashes for full provenance
+- **[Lockfile integrity](https://microsoft.github.io/apm/reference/lockfile-spec/)** — `apm.lock` records resolved sources and content hashes for full provenance
 - **[SBOM export](https://microsoft.github.io/apm/reference/cli/lock/)** — `apm lock export --format cyclonedx|spdx` emits a standard inventory of what reached disk, straight from the lockfile — provenance for procurement, not a compliance attestation
-- **[Drift detection](https://microsoft.github.io/apm/guides/drift-detection/)** — `apm audit` rebuilds your agent context in scratch and diffs it against your working tree to catch hand-edits before they ship
-- **[MCP trust boundaries](https://microsoft.github.io/apm/guides/mcp-servers/)** — transitive MCP servers require explicit consent
+- **[Drift detection](https://microsoft.github.io/apm/enterprise/drift-detection/)** — `apm audit` rebuilds your agent context in scratch and diffs it against your working tree to catch hand-edits before they ship
+- **[MCP trust boundaries](https://microsoft.github.io/apm/consumer/install-mcp-servers/)** — transitive MCP servers require explicit consent
 
 ### 3. Governed by policy
 
@@ -244,7 +244,7 @@ Or add an MCP server (wired into Copilot, Claude, Cursor, Codex, OpenCode, Gemin
 apm install --mcp io.github.github/github-mcp-server --transport http   # connects over HTTPS
 ```
 
-See the **[Getting Started guide](https://microsoft.github.io/apm/getting-started/quick-start/)** for the full walkthrough.
+See the **[Getting Started guide](https://microsoft.github.io/apm/quickstart/)** for the full walkthrough.
 
 ## Works with agentrc
 

{apm_cli-0.33.0 → apm_cli-0.34.0}/README.md

@@ -6,7 +6,7 @@ Think `package.json`, `requirements.txt`, or `Cargo.toml` — but for AI agent c
 
 GitHub Copilot | Claude Code | Grok Build | Cursor | OpenCode | Codex | Gemini | Windsurf | Kiro
 
-**[Documentation](https://microsoft.github.io/apm/)** · **[Quick Start](https://microsoft.github.io/apm/getting-started/quick-start/)** · **[CLI Reference](https://microsoft.github.io/apm/reference/cli-commands/)** · **[Roadmap](https://github.com/orgs/microsoft/projects/2304/views/5)**
+**[Documentation](https://microsoft.github.io/apm/)** · **[Quick Start](https://microsoft.github.io/apm/quickstart/)** · **[CLI Reference](https://microsoft.github.io/apm/reference/)** · **[Roadmap](https://github.com/orgs/microsoft/projects/2304/views/5)**
 
 ---
 
@@ -68,11 +68,11 @@ One command, no configuration -- VS Code and GitHub Copilot read the file automa
 One `apm.yml` describes every primitive your agents need — instructions, skills, prompts, agents, hooks, plugins, MCP servers — and `apm install` reproduces the exact same setup across every client on every machine. `apm.lock.yaml` pins the resolved tree the way `package-lock.json` does for npm.
 
 - **[One manifest for everything](https://microsoft.github.io/apm/reference/primitive-types/)** -- declared once, deployed across Copilot, Claude, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, Kiro
-- **[Install from anywhere](https://microsoft.github.io/apm/guides/dependencies/)** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, any git host
-- **[Transitive dependencies](https://microsoft.github.io/apm/guides/dependencies/)** — packages can depend on packages; APM resolves the full tree
-- **[Author plugins](https://microsoft.github.io/apm/guides/plugins/)** — build Copilot, Claude, and Cursor plugins with dependency management, then export standard `plugin.json`
-- **[Marketplaces](https://microsoft.github.io/apm/guides/marketplaces/)** — install plugins from curated registries in one command, deployed across all targets and locked
-- **[Pack & distribute](https://microsoft.github.io/apm/guides/pack-distribute/)** — `apm pack` bundles your configuration as a zipped package or a standalone plugin
+- **[Install from anywhere](https://microsoft.github.io/apm/consumer/install-packages/)** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, Gitea, Gogs, any git host
+- **[Transitive dependencies](https://microsoft.github.io/apm/consumer/install-packages/#transitive-dependencies-and-the-lockfile)** — packages can depend on packages; APM resolves the full tree
+- **[Author plugins](https://microsoft.github.io/apm/producer/)** — build Copilot, Claude, and Cursor plugins with dependency management, then export standard `plugin.json`
+- **[Marketplaces](https://microsoft.github.io/apm/consumer/installing-from-marketplaces/)** — install plugins from curated registries in one command, deployed across all targets and locked
+- **[Pack & distribute](https://microsoft.github.io/apm/producer/pack-a-bundle/)** — `apm pack` bundles your configuration as a zipped package or a standalone plugin
 - **[CI/CD ready](https://github.com/microsoft/apm-action)** — GitHub Action for automated workflows
 
 ### 2. Secure by default
@@ -80,10 +80,10 @@ One `apm.yml` describes every primitive your agents need — instructions, skill
 Agent context is executable in effect — a prompt is a program for an LLM. APM treats it that way. Every install scans for hidden Unicode that can hijack agent behavior; the lockfile pins integrity hashes; transitive MCP servers are gated by trust prompts.
 
 - **[Content security](https://microsoft.github.io/apm/enterprise/security/)** — `apm install` blocks compromised packages before agents read them; `apm audit` runs the same checks on demand
-- **[Lockfile integrity](https://microsoft.github.io/apm/enterprise/governance/)** — `apm.lock` records resolved sources and content hashes for full provenance
+- **[Lockfile integrity](https://microsoft.github.io/apm/reference/lockfile-spec/)** — `apm.lock` records resolved sources and content hashes for full provenance
 - **[SBOM export](https://microsoft.github.io/apm/reference/cli/lock/)** — `apm lock export --format cyclonedx|spdx` emits a standard inventory of what reached disk, straight from the lockfile — provenance for procurement, not a compliance attestation
-- **[Drift detection](https://microsoft.github.io/apm/guides/drift-detection/)** — `apm audit` rebuilds your agent context in scratch and diffs it against your working tree to catch hand-edits before they ship
-- **[MCP trust boundaries](https://microsoft.github.io/apm/guides/mcp-servers/)** — transitive MCP servers require explicit consent
+- **[Drift detection](https://microsoft.github.io/apm/enterprise/drift-detection/)** — `apm audit` rebuilds your agent context in scratch and diffs it against your working tree to catch hand-edits before they ship
+- **[MCP trust boundaries](https://microsoft.github.io/apm/consumer/install-mcp-servers/)** — transitive MCP servers require explicit consent
 
 ### 3. Governed by policy
 
@@ -172,7 +172,7 @@ Or add an MCP server (wired into Copilot, Claude, Cursor, Codex, OpenCode, Gemin
 apm install --mcp io.github.github/github-mcp-server --transport http   # connects over HTTPS
 ```
 
-See the **[Getting Started guide](https://microsoft.github.io/apm/getting-started/quick-start/)** for the full walkthrough.
+See the **[Getting Started guide](https://microsoft.github.io/apm/quickstart/)** for the full walkthrough.
 
 ## Works with agentrc
 

{apm_cli-0.33.0 → apm_cli-0.34.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.33.0"
+version = "0.34.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -212,6 +212,7 @@ markers = [
     "requires_ado_bearer: requires az CLI logged in + APM_TEST_ADO_BEARER=1",
     "requires_network_integration: requires APM_RUN_INTEGRATION_TESTS=1",
     "requires_windows: requires a Windows host",
+    "requires_windows_native_standard_user: requires the disposable Windows runner's verified non-admin token and symlink denial",
     "requires_apm_binary: requires built apm binary on PATH (or APM_BINARY_PATH)",
     "requires_runtime_codex: requires codex runtime installed",
     "requires_runtime_copilot: requires GitHub Copilot CLI runtime installed",

{apm_cli-0.33.0 → apm_cli-0.34.0}/src/apm_cli/adapters/client/base.py

@@ -1,5 +1,6 @@
 """Base adapter interface for MCP clients."""
 
+import json
 import os
 import re
 from abc import ABC, abstractmethod
@@ -8,7 +9,9 @@ from pathlib import Path
 from typing import Any, ClassVar
 
 from ...models.dependency.mcp import _EXTRA_DENYLIST, TrustedEnvLiteral
+from ...utils.atomic_io import atomic_write_text
 from ...utils.console import _rich_error, _rich_warning
+from ...utils.path_security import has_symlink_component
 
 _INPUT_VAR_RE = re.compile(r"\$\{input:([^}]+)\}")
 
@@ -396,6 +399,71 @@ class MCPClientAdapter(ABC):
         """Get the current MCP configuration."""
         pass
 
+    def validate_config_for_install(self) -> bool:
+        """Allow adapters to refuse unsafe configs before existing-server shortcuts."""
+        return True
+
+    def _read_json_config_for_update(self, config_path: Path) -> dict | None:
+        """Return the JSON object at *config_path* before a merge-and-write.
+
+        A missing or blank file yields ``{}``.  Returns ``None`` after a
+        warning when rewriting the file could lose data, so the caller skips
+        the write: the existing content is not a JSON object (for example
+        JSONC comments), or a user-scope path runs through a symlink, which
+        stale cleanup refuses to rewrite later.
+        """
+        if self.user_scope and has_symlink_component(Path.home(), config_path):
+            _rich_warning(
+                f"Skipped {config_path}: APM does not write MCP config through "
+                "symlinks. Replace the symlink or configure this server manually.",
+                symbol="warning",
+            )
+            return None
+        try:
+            raw = config_path.read_text(encoding="utf-8")
+        except FileNotFoundError:
+            return {}
+        except (OSError, UnicodeError) as exc:
+            _rich_warning(
+                f"Could not read {config_path}: {exc} -- skipping config write; "
+                "fix the file's permissions or encoding, or add this server manually",
+                symbol="warning",
+            )
+            return None
+        if not raw.strip():
+            return {}
+        try:
+            config = json.loads(raw)
+        except json.JSONDecodeError:
+            config = None
+        if not isinstance(config, dict):
+            _rich_warning(
+                f"Could not parse {config_path} as a JSON object -- skipping config "
+                "write to avoid data loss (comments and trailing commas are not "
+                "preserved); fix the file or add this server manually",
+                symbol="warning",
+            )
+            return None
+        if self.mcp_servers_key in config and not isinstance(config[self.mcp_servers_key], dict):
+            _rich_warning(
+                f"Could not parse {config_path}: {self.mcp_servers_key} must be "
+                "a JSON object -- skipping config write to avoid data loss; "
+                "fix the file or add this server manually",
+                symbol="warning",
+            )
+            return None
+        return config
+
+    @staticmethod
+    def _write_json_config(config_path: Path, config: dict) -> None:
+        """Atomically write *config* as JSON and keep the file owner-only.
+
+        Entries can carry env values resolved at install time.
+        """
+        config_path.parent.mkdir(parents=True, exist_ok=True)
+        atomic_write_text(config_path, json.dumps(config, indent=2), new_file_mode=0o600)
+        os.chmod(config_path, 0o600)
+
     @abstractmethod
     def configure_mcp_server(
         self,

{apm_cli-0.33.0 → apm_cli-0.34.0}/src/apm_cli/adapters/client/claude.py

@@ -184,7 +184,12 @@ class ClaudeClientAdapter(CopilotClientAdapter):
     def _project_mcp_path(self) -> Path:
         return self.project_root / ".mcp.json"
 
-    def _user_claude_json_path(self) -> Path:
+    @classmethod
+    def resolve_user_claude_unresolved_path(cls) -> Path:
+        """Return the un-normalized path for user-scope Claude Code config.
+
+        Used for symlink pre-checks before canonical resolution.
+        """
         config_dir = os.environ.get("CLAUDE_CONFIG_DIR", "").strip()
         if config_dir:
             config_path = Path(config_dir).expanduser()
@@ -193,9 +198,22 @@ class ClaudeClientAdapter(CopilotClientAdapter):
                     "CLAUDE_CONFIG_DIR must be an absolute path for user-scope MCP "
                     "config; set an absolute path or unset it to use ~/.claude.json."
                 )
-            return config_path.resolve(strict=False) / ".claude.json"
+            return config_path / ".claude.json"
         return Path.home() / ".claude.json"
 
+    @classmethod
+    def resolve_user_claude_json_path(cls, unresolved_path: Path | None = None) -> Path:
+        """Resolve the selected destination, optionally reusing a checked path."""
+        path = (
+            unresolved_path
+            if unresolved_path is not None
+            else cls.resolve_user_claude_unresolved_path()
+        )
+        return path.parent.resolve(strict=False) / path.name
+
+    def _user_claude_json_path(self) -> Path:
+        return self.resolve_user_claude_json_path()
+
     def _should_write_project(self) -> bool:
         return (self.project_root / ".claude").is_dir()
 

{apm_cli-0.33.0 → apm_cli-0.34.0}/src/apm_cli/adapters/client/cursor.py

@@ -1,12 +1,11 @@
 """Cursor IDE implementation of MCP client adapter.
 
 Cursor uses the standard ``mcpServers`` JSON format at ``.cursor/mcp.json``
-(repo-local).  Unlike the Copilot adapter, this adapter emits Cursor-native
-transport discriminators (``type: stdio`` / ``type: http``) and omits
-Copilot-only fields (``tools``, ``id``).
+(repo-local) or ``~/.cursor/mcp.json`` (user scope). Unlike the Copilot
+adapter, this adapter emits Cursor-native transport discriminators
+(``type: stdio`` / ``type: http``) and omits Copilot-only fields (``tools``, ``id``).
 
-APM only writes to ``.cursor/mcp.json`` when the ``.cursor/`` directory
-already exists -- Cursor support is opt-in.
+At project scope APM only writes to ``.cursor/mcp.json`` when the ``.cursor/`` directory already exists -- Cursor support is opt-in.
 """
 
 import json
@@ -27,7 +26,7 @@ class CursorClientAdapter(CopilotClientAdapter):
     emit Cursor-native transport discriminators instead of Copilot-only fields.
     """
 
-    supports_user_scope: bool = False
+    supports_user_scope: bool = True
     target_name: str = "cursor"
     mcp_servers_key: str = "mcpServers"
 
@@ -93,44 +92,62 @@ class CursorClientAdapter(CopilotClientAdapter):
             GitHubTokenManager,
         )
 
+    @staticmethod
+    def config_path_for(project_root: Path, user_scope: bool) -> Path:
+        """Return the Cursor MCP config path for a scope.
+
+        ``~/.cursor/mcp.json`` at user scope, else ``.cursor/mcp.json`` under
+        *project_root*.  Static so stale cleanup can locate the file without
+        constructing an adapter.
+        """
+        root = Path.home() if user_scope else Path(project_root)
+        return root / ".cursor" / "mcp.json"
+
     def get_config_path(self):
-        """Return the path to ``.cursor/mcp.json`` in the repository root.
+        """Return the project or user-scope Cursor MCP config path.
 
-        Unlike the Copilot adapter this is a **repo-local** path.  The
-        ``.cursor/`` directory is *not* created automatically -- APM only
-        writes here when the directory already exists.
+        The project ``.cursor/`` directory is *not* created automatically.
+        User-scope installs write to ``~/.cursor/mcp.json`` from any cwd.
         """
-        cursor_dir = self.project_root / ".cursor"
-        return str(cursor_dir / "mcp.json")
+        return str(self.config_path_for(self.project_root, self.user_scope))
 
     # ------------------------------------------------------------------ #
-    # Config read / write -- override to avoid auto-creating the directory
+    # Config read / write -- project scope never creates ``.cursor/``
     # ------------------------------------------------------------------ #
 
+    def validate_config_for_install(self) -> bool:
+        """Refuse unsafe user configs even when no server write would be needed."""
+        return (
+            not self.user_scope
+            or self._read_json_config_for_update(Path(self.get_config_path())) is not None
+        )
+
     def update_config(self, config_updates):
         """Merge *config_updates* into the ``mcpServers`` section.
 
-        The ``.cursor/`` directory must already exist; if it does not, this
-        method returns silently (opt-in behaviour).
+        The project ``.cursor/`` directory must already exist. User-scope
+        installs create ``~/.cursor/`` when needed.  Returns ``False`` without
+        writing when the existing file cannot be rewritten safely.
         """
         config_path = Path(self.get_config_path())
 
-        # Opt-in: only write when .cursor/ already exists
-        if not config_path.parent.exists():
-            return
+        # Project scope is opt-in; the user-scope directory can be created.
+        if not self.user_scope and not config_path.parent.is_dir():
+            return None
 
-        current_config = self.get_current_config()
+        current_config = self._read_json_config_for_update(config_path)
+        if current_config is None:
+            return False
         if "mcpServers" not in current_config:
             current_config["mcpServers"] = {}
 
         current_config["mcpServers"].update(config_updates)
 
-        with open(config_path, "w", encoding="utf-8") as f:
-            json.dump(current_config, f, indent=2)
-        os.chmod(config_path, 0o600)
+        self._write_json_config(config_path, current_config)
+        return True
 
     def get_current_config(self):
-        """Read the current ``.cursor/mcp.json`` contents."""
+        """Read the current Cursor MCP config contents."""
         config_path = self.get_config_path()
 
         if not os.path.exists(config_path):
@@ -255,7 +272,7 @@ class CursorClientAdapter(CopilotClientAdapter):
         server_info_cache=None,
         runtime_vars=None,
     ):
-        """Configure an MCP server in Cursor's ``.cursor/mcp.json``.
+        """Configure an MCP server in Cursor's project or user-scope ``mcp.json``.
 
         Delegates entirely to the parent implementation but prints a
         Cursor-specific success message.
@@ -264,9 +281,9 @@ class CursorClientAdapter(CopilotClientAdapter):
             print("Error: server_url cannot be empty")
             return False
 
-        # Opt-in: skip silently when .cursor/ does not exist
+        # Project scope is opt-in; global installs work from any directory.
         cursor_dir = self.project_root / ".cursor"
-        if not cursor_dir.exists():
+        if not self.user_scope and not cursor_dir.is_dir():
             return True  # nothing to do, not an error
 
         try:
@@ -277,7 +294,8 @@ class CursorClientAdapter(CopilotClientAdapter):
             config_key = self._determine_config_key(server_url, server_name)
 
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)
-            self.update_config({config_key: server_config})
+            if self.update_config({config_key: server_config}) is False:
+                return False
 
             print(f"Successfully configured MCP server '{config_key}' for Cursor")
             return True

{apm_cli-0.33.0 → apm_cli-0.34.0}/src/apm_cli/adapters/client/opencode.py

@@ -1,6 +1,7 @@
 """OpenCode implementation of MCP client adapter.
 
-OpenCode uses ``opencode.json`` at the project root with an ``mcp`` key.
+OpenCode uses ``opencode.json`` at the project root or
+``~/.config/opencode/opencode.json`` at user scope, with an ``mcp`` key.
 The schema differs from VSCode/Cursor:
 
 .. code-block:: json
@@ -22,8 +23,8 @@ Key differences from Copilot/Cursor:
 - Command format: single array ``command`` (not ``command`` + ``args``)
 - Env key: ``environment`` (not ``env``)
 
-APM only writes to ``opencode.json`` when the ``.opencode/`` directory
-already exists — OpenCode support is opt-in.
+At project scope APM only writes to ``opencode.json`` when the
+``.opencode/`` directory already exists -- OpenCode support is opt-in.
 """
 
 import json
@@ -39,12 +40,12 @@ class OpenCodeClientAdapter(CopilotClientAdapter):
     """OpenCode MCP client adapter.
 
     Converts the standard Copilot config format into OpenCode's schema
-    and writes to ``opencode.json`` in the project root.
+    and writes to the project or user-scope ``opencode.json``.
     """
 
-    supports_user_scope: bool = False
+    supports_user_scope: bool = True
     target_name: str = "opencode"
-    mcp_servers_key: str = "mcpServers"
+    mcp_servers_key: str = "mcp"
 
     # OpenCode's config runtime-substitution support has not yet been
     # individually audited (see #1152). Pin to legacy install-time
@@ -52,33 +53,56 @@ class OpenCodeClientAdapter(CopilotClientAdapter):
     # revisit in a follow-up.
     _supports_runtime_env_substitution: bool = False
 
+    @staticmethod
+    def config_path_for(project_root: Path, user_scope: bool) -> Path:
+        """Return the OpenCode config path for a scope.
+
+        ``~/.config/opencode/opencode.json`` at user scope, else
+        ``opencode.json`` under *project_root*.  Static so stale cleanup can
+        locate the file without constructing an adapter.
+        """
+        if user_scope:
+            return Path.home() / ".config" / "opencode" / "opencode.json"
+        return Path(project_root) / "opencode.json"
+
     def get_config_path(self):
-        """Return the path to ``opencode.json`` in the repository root."""
-        return str(self.project_root / "opencode.json")
+        """Return the project or user-scope OpenCode config path."""
+        return str(self.config_path_for(self.project_root, self.user_scope))
 
     def update_config(self, config_updates, enabled: Any = True):
         """Merge *config_updates* into the ``mcp`` section of ``opencode.json``.
 
-        The ``.opencode/`` directory must already exist; if it does not, this
-        method returns silently (opt-in behaviour).
+        The project ``.opencode/`` directory must already exist. User-scope
+        installs create ``~/.config/opencode/`` when needed.  Returns
+        ``False`` without writing when the existing file cannot be rewritten
+        safely.
 
         Translates Copilot-format entries (``command``/``args``/``env``) into
         OpenCode format (``command`` array / ``environment``).
         """
         opencode_dir = self.project_root / ".opencode"
-        if not opencode_dir.is_dir():
-            return
+        if not self.user_scope and not opencode_dir.is_dir():
+            return None
 
         config_path = Path(self.get_config_path())
-        current_config = self.get_current_config()
+        current_config = self._read_json_config_for_update(config_path)
+        if current_config is None:
+            return False
         if "mcp" not in current_config:
             current_config["mcp"] = {}
 
         for name, copilot_entry in config_updates.items():
             current_config["mcp"][name] = self._to_opencode_format(copilot_entry, enabled=enabled)
 
-        with open(config_path, "w", encoding="utf-8") as f:
-            json.dump(current_config, f, indent=2)
+        self._write_json_config(config_path, current_config)
+        return True
+
+    def validate_config_for_install(self) -> bool:
+        """Refuse unsafe user configs even when no server write would be needed."""
+        return (
+            not self.user_scope
+            or self._read_json_config_for_update(Path(self.get_config_path())) is not None
+        )
 
     def get_current_config(self):
         """Read the current ``opencode.json`` contents."""
@@ -91,6 +115,13 @@ class OpenCodeClientAdapter(CopilotClientAdapter):
         except (OSError, json.JSONDecodeError):
             return {}
 
+    def render_server_config(self, server_info: dict) -> dict:
+        """Render the ``mcp`` entry APM writes, for exact baseline comparisons."""
+        return self._to_opencode_format(
+            super().render_server_config(server_info),
+            enabled=opencode_enabled_value(server_info),
+        )
+
     def configure_mcp_server(
         self,
         server_url,
@@ -110,7 +141,7 @@ class OpenCodeClientAdapter(CopilotClientAdapter):
             return False
 
         opencode_dir = self.project_root / ".opencode"
-        if not opencode_dir.is_dir():
+        if not self.user_scope and not opencode_dir.is_dir():
             return False
 
         try:
@@ -121,10 +152,12 @@ class OpenCodeClientAdapter(CopilotClientAdapter):
             config_key = self._determine_config_key(server_url, server_name)
 
             server_config = self._format_server_config(server_info, env_overrides, runtime_vars)
-            self.update_config(
+            written = self.update_config(
                 {config_key: server_config},
                 enabled=opencode_enabled_value(server_info, enabled),
             )
+            if written is False:
+                return False
 
             print(f"Successfully configured MCP server '{config_key}' for OpenCode")
             return True

{apm_cli-0.33.0 → apm_cli-0.34.0}/src/apm_cli/bundle/lockfile_enrichment.py

@@ -19,13 +19,16 @@ from .formats import BundleFormat, coerce_bundle_format
 # Windsurf agents still collapse into .windsurf/skills/ because the target
 # has no distinct agent envelope.
 _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
+    "agent-skills": {
+        ".github/skills/": ".agents/skills/",
+    },
     "claude": {
         ".github/skills/": ".claude/skills/",
         ".github/agents/": ".claude/agents/",
     },
-    "vscode": {
-        ".claude/skills/": ".github/skills/",
-        ".claude/agents/": ".github/agents/",
+    "codex": {
+        ".github/skills/": ".agents/skills/",
+        ".github/agents/": ".codex/agents/",
     },
     "copilot": {
         ".claude/skills/": ".github/skills/",
@@ -35,33 +38,33 @@ _CROSS_TARGET_MAPS: dict[str, dict[str, str]] = {
         ".github/skills/": ".agents/skills/",
         ".github/agents/": ".cursor/agents/",
     },
-    "opencode": {
-        ".github/skills/": ".agents/skills/",
-        ".github/agents/": ".opencode/agents/",
-    },
-    "codex": {
-        ".github/skills/": ".agents/skills/",
-        ".github/agents/": ".codex/agents/",
-    },
-    "windsurf": {
-        ".github/skills/": ".agents/skills/",
-        ".github/agents/": ".windsurf/skills/",
-    },
-    "grok-cloud": {
-        ".github/skills/": ".grok/skills/",
+    "grok-bot": {
+        ".github/skills/": "agent-data/workflows/",
     },
     "grok-build": {
         ".github/skills/": ".grok/skills/",
         ".github/agents/": ".grok/agents/",
     },
-    "agent-skills": {
+    "grok-cloud": {
+        ".github/skills/": ".grok/skills/",
+    },
+    "hermes": {
         ".github/skills/": ".agents/skills/",
     },
     "openclaw": {
         ".github/skills/": ".agents/skills/",
     },
-    "hermes": {
+    "opencode": {
         ".github/skills/": ".agents/skills/",
+        ".github/agents/": ".opencode/agents/",
+    },
+    "vscode": {
+        ".claude/skills/": ".github/skills/",
+        ".claude/agents/": ".github/agents/",
+    },
+    "windsurf": {
+        ".github/skills/": ".agents/skills/",
+        ".github/agents/": ".windsurf/skills/",
     },
 }
 

{apm_cli-0.33.0 → apm_cli-0.34.0}/src/apm_cli/cli.py

@@ -14,9 +14,20 @@ import warnings
 
 import click
 
-from apm_cli.core.tls_trust import configure_process_tls_trust, log_tls_trust_status
+from apm_cli.core.tls_trust import (
+    TLSConfigurationError,
+    configure_process_tls_trust,
+    log_tls_trust_status,
+)
 
-configure_process_tls_trust()
+_TLS_BOOTSTRAP_ERROR: TLSConfigurationError | None = None
+try:
+    configure_process_tls_trust()
+except TLSConfigurationError as exc:
+    # Command modules may create Sessions at import time but do not perform
+    # network I/O. Preserve early TLS ordering, then surface a concise Click
+    # error before any command callback can make a request.
+    _TLS_BOOTSTRAP_ERROR = exc
 
 from apm_cli.commands._helpers import (
     ERROR,
@@ -261,6 +272,12 @@ def _configure_logging(verbose: bool = False) -> None:
 @click.pass_context
 def cli(ctx, verbose: bool) -> None:
     """Main entry point for the APM CLI."""
+    if _TLS_BOOTSTRAP_ERROR is not None:
+        raise click.ClickException(
+            f"{_TLS_BOOTSTRAP_ERROR}. "
+            "Check the APM_EXTRA_CA_BUNDLE setting, or unset it and retry. "
+            "See https://microsoft.github.io/apm/troubleshooting/ssl-issues/"
+        )
     ctx.ensure_object(dict)
     ctx.obj["verbose"] = verbose
     from apm_cli.core.output_mode import configure_output_mode, detect_output_mode
@@ -476,7 +493,6 @@ def main():
     """Main entry point for the CLI."""
     _configure_logging()  # honours APM_LOG_LEVEL env var; --verbose upgrades in cli()
     _configure_encoding()
-    configure_process_tls_trust()
     try:
         cli(obj={})
     except Exception as e: