apm-cli 0.7.7__tar.gz → 0.7.9__tar.gz

apm_cli-0.7.9/PKG-INFO

@@ -0,0 +1,170 @@
+Metadata-Version: 2.4
+Name: apm-cli
+Version: 0.7.9
+Summary: MCP configuration tool
+Author-email: Daniel Meppiel <user@example.com>
+License: MIT License
+        
+        Copyright (c) Microsoft Corporation.
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: AUTHORS
+Requires-Dist: click>=8.0.0
+Requires-Dist: colorama>=0.4.6
+Requires-Dist: pyyaml>=6.0.0
+Requires-Dist: requests>=2.28.0
+Requires-Dist: python-frontmatter>=1.0.0
+Requires-Dist: llm>=0.17.0
+Requires-Dist: llm-github-models>=0.1.0
+Requires-Dist: tomli>=1.2.0; python_version < "3.11"
+Requires-Dist: toml>=0.10.2
+Requires-Dist: rich>=13.0.0
+Requires-Dist: rich-click>=1.7.0
+Requires-Dist: watchdog>=3.0.0
+Requires-Dist: GitPython>=3.1.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.0.0; extra == "dev"
+Requires-Dist: black>=26.3.1; python_version >= "3.10" and extra == "dev"
+Requires-Dist: isort>=5.0.0; extra == "dev"
+Requires-Dist: mypy>=1.0.0; extra == "dev"
+Provides-Extra: build
+Requires-Dist: pyinstaller>=6.0.0; extra == "build"
+Dynamic: license-file
+
+# APM – Agent Package Manager
+
+**An open-source, community-driven dependency manager for AI agents.**
+
+Think `package.json`, `requirements.txt`, or `Cargo.toml` — but for AI agent configuration.
+
+GitHub Copilot · Claude Code
+
+**[Documentation](https://microsoft.github.io/apm/)** · **[Quick Start](https://microsoft.github.io/apm/getting-started/quick-start/)** · **[CLI Reference](https://microsoft.github.io/apm/reference/cli-commands/)**
+
+## Why APM
+
+AI coding agents need context to be useful — standards, prompts, skills, plugins — but today every developer sets this up manually. Nothing is portable nor reproducible. There's no manifest for it.
+
+**APM fixes this.** Declare your project's agentic dependencies once in `apm.yml`, and every developer who clones your repo gets a fully configured agent setup in seconds — with transitive dependency resolution, just like npm or pip.
+
+```yaml
+# apm.yml — ships with your project
+name: your-project
+version: 1.0.0
+dependencies:
+  apm:
+    # Skills from any repository
+    - anthropics/skills/skills/frontend-design
+    # Plugins
+    - github/awesome-copilot/plugins/context-engineering
+    # Specific agent primitives from any repository
+    - github/awesome-copilot/agents/api-architect.agent.md
+    # A full APM package with instructions, skills, prompts, hooks...
+    - microsoft/apm-sample-package
+```
+
+```bash
+git clone <org/repo> && cd <repo>
+apm install    # every agent is configured
+```
+
+## Highlights
+
+- **One manifest for everything** — instructions, skills, prompts, agents, hooks, plugins, MCP servers
+- **Install from anywhere** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, any git host
+- **Transitive dependencies** — packages can depend on packages; APM resolves the full tree
+- **Compile to standards** — `apm compile` produces `AGENTS.md` (GitHub Copilot) and `CLAUDE.md` (Claude Code)
+- **Create & share** — `apm pack` bundles your current configuration as a zipped package
+- **CI/CD ready** — [GitHub Action](https://github.com/microsoft/apm-action) for automated workflows
+
+## Get Started
+
+#### Linux / macOS
+
+```bash
+curl -sSL https://raw.githubusercontent.com/microsoft/apm/main/install.sh | sh
+```
+
+#### Windows
+
+```powershell
+irm https://raw.githubusercontent.com/microsoft/apm/main/install.ps1 | iex
+```
+
+Native release binaries are published for macOS, Linux, and Windows x86_64. `apm update` reuses the matching platform installer.
+
+<details>
+<summary>Other install methods</summary>
+
+#### Linux / macOS
+
+```bash
+# Homebrew
+brew install microsoft/apm/apm
+# pip
+pip install apm-cli
+```
+
+#### Windows
+
+```powershell
+# Scoop
+scoop bucket add apm https://github.com/microsoft/scoop-apm
+scoop install apm
+# pip
+pip install apm-cli
+```
+
+</details>
+
+Then start adding packages:
+
+```bash
+apm install microsoft/apm-sample-package
+```
+
+See the **[Getting Started guide](https://microsoft.github.io/apm/getting-started/quick-start/)** for the full walkthrough.
+
+## Community
+
+Created and maintained by [@danielmeppiel](https://github.com/danielmeppiel).
+
+- [Roadmap & Discussions](https://github.com/microsoft/apm/discussions/116)
+- [Contributing](CONTRIBUTING.md)
+- [AI Native Development guide](https://danielmeppiel.github.io/awesome-ai-native) — a practical learning path for AI-native development
+
+---
+
+**Built on open standards:** [AGENTS.md](https://agents.md) · [Agent Skills](https://agentskills.io) · [MCP](https://modelcontextprotocol.io)
+
+## Trademarks
+
+This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow [Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general). Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

apm_cli-0.7.9/README.md

@@ -0,0 +1,109 @@
+# APM – Agent Package Manager
+
+**An open-source, community-driven dependency manager for AI agents.**
+
+Think `package.json`, `requirements.txt`, or `Cargo.toml` — but for AI agent configuration.
+
+GitHub Copilot · Claude Code
+
+**[Documentation](https://microsoft.github.io/apm/)** · **[Quick Start](https://microsoft.github.io/apm/getting-started/quick-start/)** · **[CLI Reference](https://microsoft.github.io/apm/reference/cli-commands/)**
+
+## Why APM
+
+AI coding agents need context to be useful — standards, prompts, skills, plugins — but today every developer sets this up manually. Nothing is portable nor reproducible. There's no manifest for it.
+
+**APM fixes this.** Declare your project's agentic dependencies once in `apm.yml`, and every developer who clones your repo gets a fully configured agent setup in seconds — with transitive dependency resolution, just like npm or pip.
+
+```yaml
+# apm.yml — ships with your project
+name: your-project
+version: 1.0.0
+dependencies:
+  apm:
+    # Skills from any repository
+    - anthropics/skills/skills/frontend-design
+    # Plugins
+    - github/awesome-copilot/plugins/context-engineering
+    # Specific agent primitives from any repository
+    - github/awesome-copilot/agents/api-architect.agent.md
+    # A full APM package with instructions, skills, prompts, hooks...
+    - microsoft/apm-sample-package
+```
+
+```bash
+git clone <org/repo> && cd <repo>
+apm install    # every agent is configured
+```
+
+## Highlights
+
+- **One manifest for everything** — instructions, skills, prompts, agents, hooks, plugins, MCP servers
+- **Install from anywhere** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, any git host
+- **Transitive dependencies** — packages can depend on packages; APM resolves the full tree
+- **Compile to standards** — `apm compile` produces `AGENTS.md` (GitHub Copilot) and `CLAUDE.md` (Claude Code)
+- **Create & share** — `apm pack` bundles your current configuration as a zipped package
+- **CI/CD ready** — [GitHub Action](https://github.com/microsoft/apm-action) for automated workflows
+
+## Get Started
+
+#### Linux / macOS
+
+```bash
+curl -sSL https://raw.githubusercontent.com/microsoft/apm/main/install.sh | sh
+```
+
+#### Windows
+
+```powershell
+irm https://raw.githubusercontent.com/microsoft/apm/main/install.ps1 | iex
+```
+
+Native release binaries are published for macOS, Linux, and Windows x86_64. `apm update` reuses the matching platform installer.
+
+<details>
+<summary>Other install methods</summary>
+
+#### Linux / macOS
+
+```bash
+# Homebrew
+brew install microsoft/apm/apm
+# pip
+pip install apm-cli
+```
+
+#### Windows
+
+```powershell
+# Scoop
+scoop bucket add apm https://github.com/microsoft/scoop-apm
+scoop install apm
+# pip
+pip install apm-cli
+```
+
+</details>
+
+Then start adding packages:
+
+```bash
+apm install microsoft/apm-sample-package
+```
+
+See the **[Getting Started guide](https://microsoft.github.io/apm/getting-started/quick-start/)** for the full walkthrough.
+
+## Community
+
+Created and maintained by [@danielmeppiel](https://github.com/danielmeppiel).
+
+- [Roadmap & Discussions](https://github.com/microsoft/apm/discussions/116)
+- [Contributing](CONTRIBUTING.md)
+- [AI Native Development guide](https://danielmeppiel.github.io/awesome-ai-native) — a practical learning path for AI-native development
+
+---
+
+**Built on open standards:** [AGENTS.md](https://agents.md) · [Agent Skills](https://agentskills.io) · [MCP](https://modelcontextprotocol.io)
+
+## Trademarks
+
+This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow [Microsoft's Trademark & Brand Guidelines](https://www.microsoft.com/en-us/legal/intellectualproperty/trademarks/usage/general). Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

{apm_cli-0.7.7 → apm_cli-0.7.9}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.7.7"
+version = "0.7.9"
 description = "MCP configuration tool"
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = {file = "LICENSE"}
 authors = [
     {name = "Daniel Meppiel", email = "user@example.com"}
@@ -41,7 +41,7 @@ dependencies = [
 dev = [
     "pytest>=7.0.0",
     "pytest-cov>=4.0.0",
-    "black>=23.0.0",
+    "black>=26.3.1; python_version>='3.10'",
     "isort>=5.0.0",
     "mypy>=1.0.0",
 ]

{apm_cli-0.7.7 → apm_cli-0.7.9}/src/apm_cli/adapters/client/codex.py

@@ -122,7 +122,7 @@ class CodexClientAdapter(MCPClientAdapter):
             
             # If server has only remote endpoints and no packages, it's a remote-only server
             if remotes and not packages:
-                print(f"⚠️  Warning: MCP server '{server_url}' is a remote server (SSE type)")
+                print(f"[!]  Warning: MCP server '{server_url}' is a remote server (SSE type)")
                 print("   Codex CLI only supports local servers with command/args configuration")
                 print("   Remote servers are not supported by Codex CLI")
                 print("   Skipping installation for Codex CLI")
@@ -174,7 +174,7 @@ class CodexClientAdapter(MCPClientAdapter):
             "id": server_info.get("id", "")  # Add registry UUID for conflict detection
         }
 
-        # Self-defined stdio deps carry raw command/args — use directly
+        # Self-defined stdio deps carry raw command/args  -- use directly
         raw = server_info.get("_raw_stdio")
         if raw:
             config["command"] = raw["command"]
@@ -328,7 +328,7 @@ class CodexClientAdapter(MCPClientAdapter):
         # Check for CI/automated environment via APM_E2E_TESTS flag (more reliable than TTY detection)
         if os.getenv('APM_E2E_TESTS') == '1':
             skip_prompting = True
-            print(f"💡 APM_E2E_TESTS detected, will skip environment variable prompts")
+            print(f" APM_E2E_TESTS detected, will skip environment variable prompts")
         
         # Also skip prompting if we're in a non-interactive environment (fallback)
         is_interactive = sys.stdin.isatty() and sys.stdout.isatty()

{apm_cli-0.7.7 → apm_cli-0.7.9}/src/apm_cli/adapters/client/copilot.py

@@ -166,7 +166,7 @@ class CopilotClientAdapter(MCPClientAdapter):
             "id": server_info.get("id", "")  # Add registry UUID for conflict detection
         }
 
-        # Self-defined stdio deps carry raw command/args — use directly
+        # Self-defined stdio deps carry raw command/args  -- use directly
         raw = server_info.get("_raw_stdio")
         if raw:
             config["command"] = raw["command"]
@@ -331,7 +331,7 @@ class CopilotClientAdapter(MCPClientAdapter):
         # Check for CI/automated environment via APM_E2E_TESTS flag (more reliable than TTY detection)
         if os.getenv('APM_E2E_TESTS') == '1':
             skip_prompting = True
-            print(f"💡 APM_E2E_TESTS detected, will skip environment variable prompts")
+            print(f" APM_E2E_TESTS detected, will skip environment variable prompts")
         
         # Also skip prompting if we're in a non-interactive environment (fallback)
         is_interactive = sys.stdin.isatty() and sys.stdout.isatty()

{apm_cli-0.7.7 → apm_cli-0.7.9}/src/apm_cli/adapters/client/vscode.py

@@ -187,7 +187,7 @@ class VSCodeClientAdapter(MCPClientAdapter):
         server_config = {}
         input_vars = []
 
-        # Self-defined stdio deps carry raw command/args — use directly
+        # Self-defined stdio deps carry raw command/args  -- use directly
         raw = server_info.get("_raw_stdio")
         if raw:
             server_config = {

{apm_cli-0.7.7 → apm_cli-0.7.9}/src/apm_cli/bundle/lockfile_enrichment.py

@@ -12,7 +12,7 @@ def enrich_lockfile_for_pack(
 ) -> str:
     """Create an enriched copy of the lockfile YAML with a ``pack:`` section.
 
-    Does NOT mutate the original *lockfile* object — serialises a copy and
+    Does NOT mutate the original *lockfile* object  -- serialises a copy and
     prepends the pack metadata.
 
     Args:

{apm_cli-0.7.7 → apm_cli-0.7.9}/src/apm_cli/bundle/packer.py

@@ -1,4 +1,4 @@
-"""Bundle packer — creates self-contained APM bundles from the resolved dependency tree."""
+"""Bundle packer  -- creates self-contained APM bundles from the resolved dependency tree."""
 
 import shutil
 import tarfile
@@ -6,7 +6,7 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import List, Optional
 
-from ..deps.lockfile import LockFile
+from ..deps.lockfile import LockFile, get_lockfile_path, migrate_lockfile_if_needed
 from ..models.apm_package import APMPackage
 from ..core.target_detection import detect_target
 from .lockfile_enrichment import enrich_lockfile_for_pack
@@ -47,10 +47,10 @@ def pack_bundle(
     """Create a self-contained bundle from installed APM dependencies.
 
     Args:
-        project_root: Root of the project containing ``apm.lock`` and ``apm.yml``.
+        project_root: Root of the project containing ``apm.lock.yaml`` and ``apm.yml``.
         output_dir: Directory where the bundle will be created.
-        fmt: Bundle format — ``"apm"`` (default) or ``"plugin"``.
-        target: Target filter — ``"vscode"``, ``"claude"``, ``"all"``, or *None*
+        fmt: Bundle format  -- ``"apm"`` (default) or ``"plugin"``.
+        target: Target filter  -- ``"vscode"``, ``"claude"``, ``"all"``, or *None*
             (auto-detect from apm.yml / project structure).
         archive: If *True*, produce a ``.tar.gz`` and remove the directory.
         dry_run: If *True*, resolve the file list but write nothing to disk.
@@ -59,15 +59,16 @@ def pack_bundle(
         :class:`PackResult` describing what was (or would be) produced.
 
     Raises:
-        FileNotFoundError: If ``apm.lock`` is missing.
+        FileNotFoundError: If ``apm.lock.yaml`` is missing.
         ValueError: If deployed files referenced in the lockfile are missing on disk.
     """
-    # 1. Read lockfile
-    lockfile_path = project_root / "apm.lock"
+    # 1. Read lockfile (migrate legacy apm.lock → apm.lock.yaml if needed)
+    migrate_lockfile_if_needed(project_root)
+    lockfile_path = get_lockfile_path(project_root)
     lockfile = LockFile.read(lockfile_path)
     if lockfile is None:
         raise FileNotFoundError(
-            "apm.lock not found — run 'apm install' first to resolve dependencies."
+            "apm.lock.yaml not found  -- run 'apm install' first to resolve dependencies."
         )
 
     # 2. Read apm.yml for name / version / config target
@@ -77,7 +78,19 @@ def pack_bundle(
         pkg_name = package.name
         pkg_version = package.version or "0.0.0"
         config_target = package.target
-    except (FileNotFoundError, ValueError):
+
+        # Guard: reject local-path dependencies (non-portable)
+        for dep_ref in package.get_apm_dependencies():
+            if dep_ref.is_local:
+                raise ValueError(
+                    f"Cannot pack — apm.yml contains local path dependency: "
+                    f"{dep_ref.local_path}\n"
+                    f"Local dependencies are for development only. Replace them with "
+                    f"remote references (e.g., 'owner/repo') before packing."
+                )
+    except ValueError:
+        raise
+    except FileNotFoundError:
         pkg_name = project_root.resolve().name
         pkg_version = "0.0.0"
         config_target = None
@@ -88,7 +101,7 @@ def pack_bundle(
         explicit_target=target,
         config_target=config_target,
     )
-    # For packing purposes, "minimal" means nothing to pack — treat as "all"
+    # For packing purposes, "minimal" means nothing to pack  -- treat as "all"
     if effective_target == "minimal":
         effective_target = "all"
 
@@ -126,7 +139,7 @@ def pack_bundle(
             missing.append(rel_path)
     if missing:
         raise ValueError(
-            f"The following deployed files are missing on disk — "
+            f"The following deployed files are missing on disk  -- "
             f"run 'apm install' to restore them:\n"
             + "\n".join(f"  - {m}" for m in missing)
         )
@@ -156,7 +169,7 @@ def pack_bundle(
 
     # 8. Enrich lockfile copy and write to bundle
     enriched_yaml = enrich_lockfile_for_pack(lockfile, fmt, effective_target)
-    (bundle_dir / "apm.lock").write_text(enriched_yaml, encoding="utf-8")
+    (bundle_dir / "apm.lock.yaml").write_text(enriched_yaml, encoding="utf-8")
 
     result = PackResult(
         bundle_path=bundle_dir,

{apm_cli-0.7.7 → apm_cli-0.7.9}/src/apm_cli/bundle/unpacker.py

@@ -1,4 +1,4 @@
-"""Bundle unpacker — extracts and verifies APM bundles."""
+"""Bundle unpacker  -- extracts and verifies APM bundles."""
 
 import shutil
 import sys
@@ -6,9 +6,9 @@ import tarfile
 import tempfile
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import List
+from typing import Dict, List
 
-from ..deps.lockfile import LockFile
+from ..deps.lockfile import LockFile, LOCKFILE_NAME, LEGACY_LOCKFILE_NAME
 
 
 @dataclass
@@ -18,6 +18,8 @@ class UnpackResult:
     extracted_dir: Path
     files: List[str] = field(default_factory=list)
     verified: bool = False
+    dependency_files: Dict[str, List[str]] = field(default_factory=dict)
+    skipped_count: int = 0
 
 
 def unpack_bundle(
@@ -42,7 +44,7 @@ def unpack_bundle(
         :class:`UnpackResult` describing what was (or would be) extracted.
 
     Raises:
-        FileNotFoundError: If the bundle's ``apm.lock`` is missing.
+        FileNotFoundError: If the bundle's ``apm.lock.yaml`` is missing.
         ValueError: If verification finds files listed in the lockfile but
             absent from the bundle.
     """
@@ -63,7 +65,7 @@ def unpack_bundle(
                 if sys.version_info >= (3, 12):
                     tar.extractall(temp_dir, filter="data")
                 else:
-                    tar.extractall(temp_dir)  # noqa: S202 — manual checks above
+                    tar.extractall(temp_dir)  # noqa: S202  -- manual checks above
         except Exception:
             shutil.rmtree(temp_dir, ignore_errors=True)
             raise
@@ -81,30 +83,37 @@ def unpack_bundle(
         raise FileNotFoundError(f"Bundle not found or unsupported format: {bundle_path}")
 
     try:
-        # 2. Read apm.lock from bundle
-        lockfile_path = source_dir / "apm.lock"
+        # 2. Read apm.lock.yaml (or legacy apm.lock) from bundle
+        lockfile_path = source_dir / LOCKFILE_NAME
+        if not lockfile_path.exists():
+            # Backward compat: older bundles used "apm.lock"
+            legacy_lockfile_path = source_dir / LEGACY_LOCKFILE_NAME
+            if legacy_lockfile_path.exists():
+                lockfile_path = legacy_lockfile_path
         lockfile = LockFile.read(lockfile_path)
         if lockfile is None:
             if not lockfile_path.exists():
                 raise FileNotFoundError(
-                    "apm.lock not found in the bundle — the bundle may be incomplete."
+                    f"{lockfile_path.name} not found in the bundle  -- the bundle may be incomplete."
                 )
             raise FileNotFoundError(
-                "apm.lock in the bundle could not be parsed — the bundle may be corrupt."
+                f"{lockfile_path.name} in the bundle could not be parsed  -- the bundle may be corrupt."
             )
 
-        # Collect all deployed_files from lockfile
-        all_deployed: list[str] = []
-        for dep in lockfile.get_all_dependencies():
-            all_deployed.extend(dep.deployed_files)
-
-        # Deduplicate
+        # Collect deployed_files per dependency and deduplicated global list
+        dep_file_map: Dict[str, List[str]] = {}
         seen: set[str] = set()
         unique_files: list[str] = []
-        for f in all_deployed:
-            if f not in seen:
-                seen.add(f)
-                unique_files.append(f)
+        for dep in lockfile.get_all_dependencies():
+            dep_key = dep.get_unique_key()
+            dep_files: list[str] = []
+            for f in dep.deployed_files:
+                dep_files.append(f)
+                if f not in seen:
+                    seen.add(f)
+                    unique_files.append(f)
+            if dep_files:
+                dep_file_map[dep_key] = dep_files
 
         # 3. Verify completeness
         verified = True
@@ -114,7 +123,7 @@ def unpack_bundle(
             ]
             if missing:
                 raise ValueError(
-                    "Bundle verification failed — the following deployed files "
+                    "Bundle verification failed  -- the following deployed files "
                     "are missing from the bundle:\n"
                     + "\n".join(f"  - {m}" for m in missing)
                 )
@@ -128,15 +137,17 @@ def unpack_bundle(
                 extracted_dir=bundle_path,
                 files=unique_files,
                 verified=verified,
+                dependency_files=dep_file_map,
             )
 
         # 4. Copy target files to output_dir (additive, no deletes)
         output_dir = Path(output_dir)
         output_dir_resolved = output_dir.resolve()
+        skipped = 0
         for rel_path in unique_files:
             # Guard against absolute paths or path-traversal entries in deployed_files
             p = Path(rel_path)
-            if p.is_absolute() or ".." in p.parts:
+            if p.is_absolute() or rel_path.startswith("/") or ".." in p.parts:
                 raise ValueError(
                     f"Refusing to unpack unsafe path from bundle lockfile: {rel_path!r}"
                 )
@@ -147,6 +158,7 @@ def unpack_bundle(
                 )
             src = source_dir / rel_path
             if not src.exists():
+                skipped += 1
                 continue  # skip_verify may allow missing files
             if src.is_dir():
                 shutil.copytree(src, dest, dirs_exist_ok=True)
@@ -158,6 +170,8 @@ def unpack_bundle(
             extracted_dir=bundle_path,
             files=unique_files,
             verified=verified,
+            dependency_files=dep_file_map,
+            skipped_count=skipped,
         )
     finally:
         # Clean up temp dir if we created one