apm-cli 0.7.9__tar.gz → 0.8.0__tar.gz

{apm_cli-0.7.9/src/apm_cli.egg-info → apm_cli-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.7.9
+Version: 0.8.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -65,7 +65,7 @@ Dynamic: license-file
 
 Think `package.json`, `requirements.txt`, or `Cargo.toml` — but for AI agent configuration.
 
-GitHub Copilot · Claude Code
+GitHub Copilot · Claude Code · Cursor · OpenCode
 
 **[Documentation](https://microsoft.github.io/apm/)** · **[Quick Start](https://microsoft.github.io/apm/getting-started/quick-start/)** · **[CLI Reference](https://microsoft.github.io/apm/reference/cli-commands/)**
 
@@ -101,7 +101,8 @@ apm install    # every agent is configured
 - **One manifest for everything** — instructions, skills, prompts, agents, hooks, plugins, MCP servers
 - **Install from anywhere** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, any git host
 - **Transitive dependencies** — packages can depend on packages; APM resolves the full tree
-- **Compile to standards** — `apm compile` produces `AGENTS.md` (GitHub Copilot) and `CLAUDE.md` (Claude Code)
+- **Compile to standards** — `apm compile` produces `AGENTS.md` (GitHub Copilot, OpenCode), `CLAUDE.md` (Claude Code), and `.cursor/rules/` (Cursor)
+- **Content security** — `apm audit` scans for hidden Unicode characters; `apm install` blocks compromised packages before agents can read them
 - **Create & share** — `apm pack` bundles your current configuration as a zipped package
 - **CI/CD ready** — [GitHub Action](https://github.com/microsoft/apm-action) for automated workflows
 

{apm_cli-0.7.9 → apm_cli-0.8.0}/README.md

@@ -4,7 +4,7 @@
 
 Think `package.json`, `requirements.txt`, or `Cargo.toml` — but for AI agent configuration.
 
-GitHub Copilot · Claude Code
+GitHub Copilot · Claude Code · Cursor · OpenCode
 
 **[Documentation](https://microsoft.github.io/apm/)** · **[Quick Start](https://microsoft.github.io/apm/getting-started/quick-start/)** · **[CLI Reference](https://microsoft.github.io/apm/reference/cli-commands/)**
 
@@ -40,7 +40,8 @@ apm install    # every agent is configured
 - **One manifest for everything** — instructions, skills, prompts, agents, hooks, plugins, MCP servers
 - **Install from anywhere** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, any git host
 - **Transitive dependencies** — packages can depend on packages; APM resolves the full tree
-- **Compile to standards** — `apm compile` produces `AGENTS.md` (GitHub Copilot) and `CLAUDE.md` (Claude Code)
+- **Compile to standards** — `apm compile` produces `AGENTS.md` (GitHub Copilot, OpenCode), `CLAUDE.md` (Claude Code), and `.cursor/rules/` (Cursor)
+- **Content security** — `apm audit` scans for hidden Unicode characters; `apm install` blocks compromised packages before agents can read them
 - **Create & share** — `apm pack` bundles your current configuration as a zipped package
 - **CI/CD ready** — [GitHub Action](https://github.com/microsoft/apm-action) for automated workflows
 

{apm_cli-0.7.9 → apm_cli-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.7.9"
+version = "0.8.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"

apm_cli-0.8.0/src/apm_cli/adapters/client/cursor.py

@@ -0,0 +1,138 @@
+"""Cursor IDE implementation of MCP client adapter.
+
+Cursor uses the standard ``mcpServers`` JSON format at ``.cursor/mcp.json``
+(repo-local).  The config schema is identical to GitHub Copilot CLI, so this
+adapter subclasses :class:`CopilotClientAdapter` and only overrides the
+config-path logic and the user-facing labels.
+
+APM only writes to ``.cursor/mcp.json`` when the ``.cursor/`` directory
+already exists — Cursor support is opt-in.
+"""
+
+import json
+import os
+from pathlib import Path
+
+from .copilot import CopilotClientAdapter
+
+
+class CursorClientAdapter(CopilotClientAdapter):
+    """Cursor IDE MCP client adapter.
+
+    Inherits all config formatting from :class:`CopilotClientAdapter`
+    (``mcpServers`` JSON with ``command``/``args``/``env``).  Only the
+    config-file location differs: repo-local ``.cursor/mcp.json`` instead
+    of global ``~/.copilot/mcp-config.json``.
+    """
+
+    # ------------------------------------------------------------------ #
+    # Config path
+    # ------------------------------------------------------------------ #
+
+    def get_config_path(self):
+        """Return the path to ``.cursor/mcp.json`` in the repository root.
+
+        Unlike the Copilot adapter this is a **repo-local** path.  The
+        ``.cursor/`` directory is *not* created automatically — APM only
+        writes here when the directory already exists.
+        """
+        cursor_dir = Path(os.getcwd()) / ".cursor"
+        return str(cursor_dir / "mcp.json")
+
+    # ------------------------------------------------------------------ #
+    # Config read / write — override to avoid auto-creating the directory
+    # ------------------------------------------------------------------ #
+
+    def update_config(self, config_updates):
+        """Merge *config_updates* into the ``mcpServers`` section.
+
+        The ``.cursor/`` directory must already exist; if it does not, this
+        method returns silently (opt-in behaviour).
+        """
+        config_path = Path(self.get_config_path())
+
+        # Opt-in: only write when .cursor/ already exists
+        if not config_path.parent.exists():
+            return
+
+        current_config = self.get_current_config()
+        if "mcpServers" not in current_config:
+            current_config["mcpServers"] = {}
+
+        current_config["mcpServers"].update(config_updates)
+
+        with open(config_path, "w", encoding="utf-8") as f:
+            json.dump(current_config, f, indent=2)
+
+    def get_current_config(self):
+        """Read the current ``.cursor/mcp.json`` contents."""
+        config_path = self.get_config_path()
+
+        if not os.path.exists(config_path):
+            return {}
+
+        try:
+            with open(config_path, "r", encoding="utf-8") as f:
+                return json.load(f)
+        except (json.JSONDecodeError, IOError):
+            return {}
+
+    # ------------------------------------------------------------------ #
+    # configure_mcp_server — thin override for the print label
+    # ------------------------------------------------------------------ #
+
+    def configure_mcp_server(
+        self,
+        server_url,
+        server_name=None,
+        enabled=True,
+        env_overrides=None,
+        server_info_cache=None,
+        runtime_vars=None,
+    ):
+        """Configure an MCP server in Cursor's ``.cursor/mcp.json``.
+
+        Delegates entirely to the parent implementation but prints a
+        Cursor-specific success message.
+        """
+        if not server_url:
+            print("Error: server_url cannot be empty")
+            return False
+
+        # Opt-in: skip silently when .cursor/ does not exist
+        cursor_dir = Path(os.getcwd()) / ".cursor"
+        if not cursor_dir.exists():
+            return True  # nothing to do, not an error
+
+        try:
+            # Use cached server info if available, otherwise fetch from registry
+            if server_info_cache and server_url in server_info_cache:
+                server_info = server_info_cache[server_url]
+            else:
+                server_info = self.registry_client.find_server_by_reference(server_url)
+
+            if not server_info:
+                print(f"Error: MCP server '{server_url}' not found in registry")
+                return False
+
+            # Determine config key
+            if server_name:
+                config_key = server_name
+            elif "/" in server_url:
+                config_key = server_url.split("/")[-1]
+            else:
+                config_key = server_url
+
+            server_config = self._format_server_config(
+                server_info, env_overrides, runtime_vars
+            )
+            self.update_config({config_key: server_config})
+
+            print(
+                f"Successfully configured MCP server '{config_key}' for Cursor"
+            )
+            return True
+
+        except Exception as e:
+            print(f"Error configuring MCP server: {e}")
+            return False

apm_cli-0.8.0/src/apm_cli/adapters/client/opencode.py

@@ -0,0 +1,157 @@
+"""OpenCode implementation of MCP client adapter.
+
+OpenCode uses ``opencode.json`` at the project root with an ``mcp`` key.
+The schema differs from VSCode/Cursor:
+
+.. code-block:: json
+
+   {
+     "mcp": {
+       "server-name": {
+         "type": "local",
+         "command": ["npx", "-y", "@modelcontextprotocol/server-foo"],
+         "environment": { "KEY": "value" },
+         "enabled": true
+       }
+     }
+   }
+
+Key differences from Copilot/Cursor:
+- Config file: ``opencode.json`` (not ``mcp.json``)
+- Wrapper key: ``mcp`` (not ``mcpServers``)
+- Command format: single array ``command`` (not ``command`` + ``args``)
+- Env key: ``environment`` (not ``env``)
+
+APM only writes to ``opencode.json`` when the ``.opencode/`` directory
+already exists — OpenCode support is opt-in.
+"""
+
+import json
+import os
+from pathlib import Path
+
+from .copilot import CopilotClientAdapter
+
+
+class OpenCodeClientAdapter(CopilotClientAdapter):
+    """OpenCode MCP client adapter.
+
+    Converts the standard Copilot config format into OpenCode's schema
+    and writes to ``opencode.json`` in the project root.
+    """
+
+    def get_config_path(self):
+        """Return the path to ``opencode.json`` in the repository root."""
+        return str(Path(os.getcwd()) / "opencode.json")
+
+    def update_config(self, config_updates, enabled=True):
+        """Merge *config_updates* into the ``mcp`` section of ``opencode.json``.
+
+        The ``.opencode/`` directory must already exist; if it does not, this
+        method returns silently (opt-in behaviour).
+
+        Translates Copilot-format entries (``command``/``args``/``env``) into
+        OpenCode format (``command`` array / ``environment``).
+        """
+        opencode_dir = Path(os.getcwd()) / ".opencode"
+        if not opencode_dir.is_dir():
+            return
+
+        config_path = Path(self.get_config_path())
+        current_config = self.get_current_config()
+        if "mcp" not in current_config:
+            current_config["mcp"] = {}
+
+        for name, copilot_entry in config_updates.items():
+            current_config["mcp"][name] = self._to_opencode_format(copilot_entry, enabled=enabled)
+
+        with open(config_path, "w", encoding="utf-8") as f:
+            json.dump(current_config, f, indent=2)
+
+    def get_current_config(self):
+        """Read the current ``opencode.json`` contents."""
+        config_path = self.get_config_path()
+        if not os.path.exists(config_path):
+            return {}
+        try:
+            with open(config_path, "r", encoding="utf-8") as f:
+                return json.load(f)
+        except (json.JSONDecodeError, IOError):
+            return {}
+
+    def configure_mcp_server(
+        self,
+        server_url,
+        server_name=None,
+        enabled=True,
+        env_overrides=None,
+        server_info_cache=None,
+        runtime_vars=None,
+    ):
+        """Configure an MCP server in ``opencode.json``.
+
+        Delegates to the parent for config formatting, then converts to
+        OpenCode schema before writing.
+        """
+        if not server_url:
+            print("Error: server_url cannot be empty")
+            return False
+
+        opencode_dir = Path(os.getcwd()) / ".opencode"
+        if not opencode_dir.is_dir():
+            return False
+
+        try:
+            if server_info_cache and server_url in server_info_cache:
+                server_info = server_info_cache[server_url]
+            else:
+                server_info = self.registry_client.find_server_by_reference(server_url)
+
+            if not server_info:
+                print(f"Error: MCP server '{server_url}' not found in registry")
+                return False
+
+            if server_name:
+                config_key = server_name
+            elif "/" in server_url:
+                config_key = server_url.split("/")[-1]
+            else:
+                config_key = server_url
+
+            server_config = self._format_server_config(
+                server_info, env_overrides, runtime_vars
+            )
+            self.update_config({config_key: server_config}, enabled=enabled)
+
+            print(
+                f"Successfully configured MCP server '{config_key}' for OpenCode"
+            )
+            return True
+
+        except Exception as e:
+            print(f"Error configuring MCP server: {e}")
+            return False
+
+    @staticmethod
+    def _to_opencode_format(copilot_entry: dict, enabled: bool = True) -> dict:
+        """Convert a Copilot-format server config to OpenCode format.
+
+        Copilot: ``{"command": "npx", "args": ["-y", "pkg"], "env": {...}}``
+        OpenCode: ``{"type": "local", "command": ["npx", "-y", "pkg"],
+                     "environment": {...}, "enabled": true}``
+        """
+        entry: dict = {"type": "local", "enabled": enabled}
+
+        cmd = copilot_entry.get("command", "")
+        args = copilot_entry.get("args", [])
+        if cmd:
+            entry["command"] = [cmd] + list(args)
+        elif "url" in copilot_entry:
+            entry["type"] = "remote"
+            entry["url"] = copilot_entry["url"]
+
+        env = copilot_entry.get("env") or {}
+        if env:
+            entry["environment"] = env
+
+        return entry

{apm_cli-0.7.9 → apm_cli-0.8.0}/src/apm_cli/bundle/packer.py

@@ -1,5 +1,6 @@
 """Bundle packer  -- creates self-contained APM bundles from the resolved dependency tree."""
 
+import os
 import shutil
 import tarfile
 from dataclasses import dataclass, field
@@ -17,7 +18,9 @@ _TARGET_PREFIXES = {
     "copilot": [".github/"],
     "vscode": [".github/"],
     "claude": [".claude/"],
-    "all": [".github/", ".claude/"],
+    "cursor": [".cursor/"],
+    "opencode": [".opencode/"],
+    "all": [".github/", ".claude/", ".cursor/", ".opencode/"],
 }
 
 
@@ -153,6 +156,34 @@ def pack_bundle(
             lockfile_enriched=True,
         )
 
+    # 5b. Scan files for hidden characters before bundling
+    from ..security.content_scanner import ContentScanner
+    from ..utils.console import _rich_warning
+
+    _scan_findings_total = 0
+    for rel_path in unique_files:
+        src = project_root / rel_path
+        if src.is_symlink():
+            continue
+        if src.is_file():
+            findings = ContentScanner.scan_file(src)
+            if findings:
+                _scan_findings_total += len(findings)
+        elif src.is_dir():
+            for dirpath, _dirnames, filenames in os.walk(src, followlinks=False):
+                for fname in filenames:
+                    fpath = Path(dirpath) / fname
+                    if fpath.is_symlink():
+                        continue
+                    findings = ContentScanner.scan_file(fpath)
+                    if findings:
+                        _scan_findings_total += len(findings)
+    if _scan_findings_total:
+        _rich_warning(
+            f"Bundle contains {_scan_findings_total} hidden character(s) across source files "
+            f"— run 'apm audit' to inspect before publishing"
+        )
+
     # 6. Build output directory
     bundle_dir = output_dir / f"{pkg_name}-{pkg_version}"
     bundle_dir.mkdir(parents=True, exist_ok=True)

{apm_cli-0.7.9 → apm_cli-0.8.0}/src/apm_cli/cli.py

@@ -15,6 +15,7 @@ from apm_cli.commands._helpers import (
     _check_and_notify_updates,
     print_version,
 )
+from apm_cli.commands.audit import audit
 from apm_cli.commands.compile import compile as compile_cmd
 from apm_cli.commands.config import config
 from apm_cli.commands.deps import deps
@@ -52,6 +53,7 @@ def cli(ctx):
 
 
 # Register command groups
+cli.add_command(audit)
 cli.add_command(deps)
 cli.add_command(pack_cmd, name="pack")
 cli.add_command(unpack_cmd, name="unpack")