apm-cli 0.8.11__tar.gz → 0.9.0__tar.gz

{apm_cli-0.8.11 → apm_cli-0.9.0}/AUTHORS

@@ -3,6 +3,7 @@
 ## Project Maintainers
 
 * Daniel Meppiel (@danielmeppiel) - Creator and Lead Maintainer
+* Sergio Sisternes (@sergio-sisternes-epam) - Maintainer
 
 ## Contributors
 

{apm_cli-0.8.11/src/apm_cli.egg-info → apm_cli-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.8.11
+Version: 0.9.0
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -90,6 +90,10 @@ dependencies:
     - github/awesome-copilot/agents/api-architect.agent.md
     # A full APM package with instructions, skills, prompts, hooks...
     - microsoft/apm-sample-package#v1.0.0
+  mcp:
+    # MCP servers -- installed into every detected client
+    - name: io.github.github/github-mcp-server
+      transport: http   # MCP transport name, not URL scheme -- connects over HTTPS
 ```
 
 ```bash
@@ -99,7 +103,7 @@ apm install    # every agent is configured
 
 ## Highlights
 
-- **[One manifest for everything](https://microsoft.github.io/apm/reference/primitive-types/)** — instructions, skills, prompts, agents, hooks, plugins, MCP servers
+- **[One manifest for everything](https://microsoft.github.io/apm/reference/primitive-types/)** — instructions, skills, prompts, agents, hooks, plugins, and [MCP servers](https://microsoft.github.io/apm/guides/mcp-servers/) declared in `apm.yml` and deployed across every client on install
 - **[Install from anywhere](https://microsoft.github.io/apm/guides/dependencies/)** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, any git host
 - **[Transitive dependencies](https://microsoft.github.io/apm/guides/dependencies/)** — packages can depend on packages; APM resolves the full tree
 - **[Content security](https://microsoft.github.io/apm/enterprise/security/)** — `apm audit` scans for hidden Unicode; `apm install` blocks compromised packages before agents read them
@@ -161,6 +165,14 @@ apm marketplace add github/awesome-copilot
 apm install azure-cloud-development@awesome-copilot
 ```
 
+Or add an MCP server (wired into Copilot, Claude, Cursor, Codex, and OpenCode):
+
+```bash
+apm install --mcp io.github.github/github-mcp-server --transport http   # connects over HTTPS
+```
+
+> *Codex CLI currently does not support remote MCP servers; the install will skip Codex with a notice. Omit `--transport http` to use the local Docker variant on Codex (requires `GITHUB_PERSONAL_ACCESS_TOKEN`).*
+
 See the **[Getting Started guide](https://microsoft.github.io/apm/getting-started/quick-start/)** for the full walkthrough.
 
 ## Works with agentrc
@@ -171,7 +183,7 @@ Use agentrc to author high-quality instructions, then package them with APM to s
 
 ## Community
 
-Created and maintained by [@danielmeppiel](https://github.com/danielmeppiel).
+Created by [@danielmeppiel](https://github.com/danielmeppiel). Maintained by [@danielmeppiel](https://github.com/danielmeppiel) and [@sergio-sisternes-epam](https://github.com/sergio-sisternes-epam).
 
 - [Roadmap & Discussions](https://github.com/microsoft/apm/discussions/116)
 - [Contributing](CONTRIBUTING.md)

{apm_cli-0.8.11 → apm_cli-0.9.0}/README.md

@@ -28,6 +28,10 @@ dependencies:
     - github/awesome-copilot/agents/api-architect.agent.md
     # A full APM package with instructions, skills, prompts, hooks...
     - microsoft/apm-sample-package#v1.0.0
+  mcp:
+    # MCP servers -- installed into every detected client
+    - name: io.github.github/github-mcp-server
+      transport: http   # MCP transport name, not URL scheme -- connects over HTTPS
 ```
 
 ```bash
@@ -37,7 +41,7 @@ apm install    # every agent is configured
 
 ## Highlights
 
-- **[One manifest for everything](https://microsoft.github.io/apm/reference/primitive-types/)** — instructions, skills, prompts, agents, hooks, plugins, MCP servers
+- **[One manifest for everything](https://microsoft.github.io/apm/reference/primitive-types/)** — instructions, skills, prompts, agents, hooks, plugins, and [MCP servers](https://microsoft.github.io/apm/guides/mcp-servers/) declared in `apm.yml` and deployed across every client on install
 - **[Install from anywhere](https://microsoft.github.io/apm/guides/dependencies/)** — GitHub, GitLab, Bitbucket, Azure DevOps, GitHub Enterprise, any git host
 - **[Transitive dependencies](https://microsoft.github.io/apm/guides/dependencies/)** — packages can depend on packages; APM resolves the full tree
 - **[Content security](https://microsoft.github.io/apm/enterprise/security/)** — `apm audit` scans for hidden Unicode; `apm install` blocks compromised packages before agents read them
@@ -99,6 +103,14 @@ apm marketplace add github/awesome-copilot
 apm install azure-cloud-development@awesome-copilot
 ```
 
+Or add an MCP server (wired into Copilot, Claude, Cursor, Codex, and OpenCode):
+
+```bash
+apm install --mcp io.github.github/github-mcp-server --transport http   # connects over HTTPS
+```
+
+> *Codex CLI currently does not support remote MCP servers; the install will skip Codex with a notice. Omit `--transport http` to use the local Docker variant on Codex (requires `GITHUB_PERSONAL_ACCESS_TOKEN`).*
+
 See the **[Getting Started guide](https://microsoft.github.io/apm/getting-started/quick-start/)** for the full walkthrough.
 
 ## Works with agentrc
@@ -109,7 +121,7 @@ Use agentrc to author high-quality instructions, then package them with APM to s
 
 ## Community
 
-Created and maintained by [@danielmeppiel](https://github.com/danielmeppiel).
+Created by [@danielmeppiel](https://github.com/danielmeppiel). Maintained by [@danielmeppiel](https://github.com/danielmeppiel) and [@sergio-sisternes-epam](https://github.com/sergio-sisternes-epam).
 
 - [Roadmap & Discussions](https://github.com/microsoft/apm/discussions/116)
 - [Contributing](CONTRIBUTING.md)

{apm_cli-0.8.11 → apm_cli-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.8.11"
+version = "0.9.0"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/adapters/client/base.py

@@ -9,6 +9,12 @@ _INPUT_VAR_RE = re.compile(r"\$\{input:([^}]+)\}")
 class MCPClientAdapter(ABC):
     """Base adapter for MCP clients."""
 
+    # Whether this adapter's config path is user/global-scoped (e.g.
+    # ``~/.copilot/``) rather than workspace-scoped (e.g. ``.vscode/``).
+    # Adapters that target a global path should override this to ``True``
+    # so that ``apm install --global`` can install MCP servers to them.
+    supports_user_scope: bool = False
+
     @abstractmethod
     def get_config_path(self):
         """Get the path to the MCP configuration file."""

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/adapters/client/codex.py

@@ -20,7 +20,9 @@ class CodexClientAdapter(MCPClientAdapter):
     a global ~/.codex/config.toml file, following the TOML format for
     MCP server configuration.
     """
-    
+
+    supports_user_scope: bool = True
+
     def __init__(self, registry_url=None):
         """Initialize the Codex CLI client adapter.
         

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/adapters/client/copilot.py

@@ -23,7 +23,9 @@ class CopilotClientAdapter(MCPClientAdapter):
     a global ~/.copilot/mcp-config.json file, following the JSON format for
     MCP server configuration.
     """
-    
+
+    supports_user_scope: bool = True
+
     def __init__(self, registry_url=None):
         """Initialize the Copilot CLI client adapter.
         

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/adapters/client/cursor.py

@@ -25,6 +25,8 @@ class CursorClientAdapter(CopilotClientAdapter):
     of global ``~/.copilot/mcp-config.json``.
     """
 
+    supports_user_scope: bool = False
+
     # ------------------------------------------------------------------ #
     # Config path
     # ------------------------------------------------------------------ #

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/adapters/client/opencode.py

@@ -40,6 +40,8 @@ class OpenCodeClientAdapter(CopilotClientAdapter):
     and writes to ``opencode.json`` in the project root.
     """
 
+    supports_user_scope: bool = False
+
     def get_config_path(self):
         """Return the path to ``opencode.json`` in the repository root."""
         return str(Path(os.getcwd()) / "opencode.json")
@@ -149,9 +151,12 @@ class OpenCodeClientAdapter(CopilotClientAdapter):
         elif "url" in copilot_entry:
             entry["type"] = "remote"
             entry["url"] = copilot_entry["url"]
+            headers = copilot_entry.get("headers")
+            if headers:
+                entry["headers"] = dict(headers)
 
         env = copilot_entry.get("env") or {}
         if env:
-            entry["environment"] = env
+            entry["environment"] = dict(env)
 
         return entry

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/adapters/client/vscode.py

@@ -320,17 +320,25 @@ class VSCodeClientAdapter(MCPClientAdapter):
                 }
             # Check for remotes (similar to Copilot adapter)
             elif "remotes" in server_info and server_info["remotes"]:
-                remotes = server_info["remotes"]
-                remote = remotes[0]  # Take the first remote
-                transport = remote.get("transport_type", "")
-                if transport in ("sse", "http", "streamable-http"):
+                remote = self._select_remote_with_url(server_info["remotes"])
+                if remote:
+                    transport = (remote.get("transport_type") or "").strip()
+                    # Default to "http" when transport_type is missing/empty,
+                    # matching the Copilot adapter behavior (copilot.py:190-192).
+                    if not transport:
+                        transport = "http"
+                    elif transport not in ("sse", "http", "streamable-http"):
+                        raise ValueError(
+                            f"Unsupported remote transport '{transport}' for VS Code. "
+                            f"Server: {server_info.get('name', 'unknown')}. "
+                            f"Supported transports: http, sse, streamable-http.")
                     headers = remote.get("headers", {})
                     # Normalize header list format to dict
                     if isinstance(headers, list):
                         headers = {h["name"]: h["value"] for h in headers if "name" in h and "value" in h}
                     server_config = {
                         "type": transport,
-                        "url": remote.get("url", ""),
+                        "url": remote["url"].strip(),
                         "headers": headers,
                     }
                     input_vars.extend(
@@ -424,6 +432,19 @@ class VSCodeClientAdapter(MCPClientAdapter):
         
         return []
 
+    @staticmethod
+    def _select_remote_with_url(remotes):
+        """Return the first remote entry that has a non-empty URL.
+
+        Returns:
+            dict or None: The first usable remote, or None if none found.
+        """
+        for remote in remotes:
+            url = (remote.get("url") or "").strip()
+            if url:
+                return remote
+        return None
+
     def _select_best_package(self, packages):
         """Select the best package for VS Code installation from available packages.
         

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/bundle/lockfile_enrichment.py

@@ -1,7 +1,7 @@
 """Lockfile enrichment for pack-time metadata."""
 
 from datetime import datetime, timezone
-from typing import Dict, List, Tuple
+from typing import Dict, List, Tuple, Union
 
 from ..deps.lockfile import LockFile
 
@@ -55,7 +55,7 @@ _CROSS_TARGET_MAPS: Dict[str, Dict[str, str]] = {
 
 
 def _filter_files_by_target(
-    deployed_files: List[str], target: str
+    deployed_files: List[str], target: Union[str, List[str]]
 ) -> Tuple[List[str], Dict[str, str]]:
     """Filter deployed file paths by target prefix, with cross-target mapping.
 
@@ -64,16 +64,38 @@ def _filter_files_by_target(
     remapped to the equivalent target path.  Commands, instructions, and hooks
     are NOT remapped -- they are target-specific.
 
+    *target* may be a single string or a list of strings.  For a list, the
+    union of all relevant prefixes and cross-target maps is used.
+
     Returns:
         A tuple of ``(filtered_files, path_mappings)`` where *path_mappings*
         maps ``bundle_path -> disk_path`` for any file that was cross-target
         remapped.  Direct matches have no entry in the dict.
     """
-    prefixes = _TARGET_PREFIXES.get(target, _TARGET_PREFIXES["all"])
+    if isinstance(target, list):
+        # Union all prefixes for the targets in the list
+        prefixes: List[str] = []
+        seen_prefixes: set = set()
+        for t in target:
+            for p in _TARGET_PREFIXES.get(t, []):
+                if p not in seen_prefixes:
+                    seen_prefixes.add(p)
+                    prefixes.append(p)
+        # Union all cross-target maps
+        # NOTE: dict.update() means the last target's mapping wins when
+        # multiple targets map the same source prefix. In practice this
+        # is benign -- common multi-target combos (e.g. claude+copilot)
+        # match prefixes directly without needing cross-maps.
+        cross_map: Dict[str, str] = {}
+        for t in target:
+            cross_map.update(_CROSS_TARGET_MAPS.get(t, {}))
+    else:
+        prefixes = _TARGET_PREFIXES.get(target, _TARGET_PREFIXES["all"])
+        cross_map = _CROSS_TARGET_MAPS.get(target, {})
+
     direct = [f for f in deployed_files if any(f.startswith(p) for p in prefixes)]
 
     path_mappings: Dict[str, str] = {}
-    cross_map = _CROSS_TARGET_MAPS.get(target, {})
     if cross_map:
         direct_set = set(direct)
         for f in deployed_files:
@@ -94,7 +116,7 @@ def _filter_files_by_target(
 def enrich_lockfile_for_pack(
     lockfile: LockFile,
     fmt: str,
-    target: str,
+    target: Union[str, List[str]],
 ) -> str:
     """Create an enriched copy of the lockfile YAML with a ``pack:`` section.
 
@@ -109,7 +131,8 @@ def enrich_lockfile_for_pack(
         lockfile: The resolved lockfile to enrich.
         fmt: Bundle format (``"apm"`` or ``"plugin"``).
         target: Effective target used for packing (e.g. ``"copilot"``, ``"claude"``,
-            ``"all"``).  The internal alias ``"vscode"`` is also accepted.
+            ``"all"``).  May also be a list of target strings for multi-target
+            packing.  The internal alias ``"vscode"`` is also accepted.
 
     Returns:
         A YAML string with the ``pack:`` block followed by the original
@@ -132,9 +155,12 @@ def enrich_lockfile_for_pack(
 
     # Build the pack: metadata section (after filtering so we know if mapping
     # occurred).
+    # Serialize target as a comma-joined string for backward compatibility
+    # with consumers that expect a plain string in pack.target.
+    target_str = ",".join(target) if isinstance(target, list) else target
     pack_meta: Dict = {
         "format": fmt,
-        "target": target,
+        "target": target_str,
         "packed_at": datetime.now(timezone.utc).isoformat(),
     }
     if all_mappings:
@@ -142,7 +168,12 @@ def enrich_lockfile_for_pack(
         # bundle paths differ from the original lockfile.  Use the canonical
         # prefix keys from _CROSS_TARGET_MAPS rather than reverse-engineering
         # them from file paths.
-        cross_map = _CROSS_TARGET_MAPS.get(target, {})
+        if isinstance(target, list):
+            cross_map: Dict[str, str] = {}
+            for t in target:
+                cross_map.update(_CROSS_TARGET_MAPS.get(t, {}))
+        else:
+            cross_map = _CROSS_TARGET_MAPS.get(target, {})
         used_src_prefixes = set()
         for original in all_mappings.values():
             for src_prefix in cross_map:

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/bundle/packer.py

@@ -5,7 +5,7 @@ import shutil
 import tarfile
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Dict, List, Optional
+from typing import Dict, List, Optional, Union
 
 from ..deps.lockfile import LockFile, get_lockfile_path, migrate_lockfile_if_needed
 from ..models.apm_package import APMPackage
@@ -28,7 +28,7 @@ def pack_bundle(
     project_root: Path,
     output_dir: Path,
     fmt: str = "apm",
-    target: Optional[str] = None,
+    target: Optional[Union[str, List[str]]] = None,
     archive: bool = False,
     dry_run: bool = False,
     force: bool = False,
@@ -40,7 +40,8 @@ def pack_bundle(
         project_root: Root of the project containing ``apm.lock.yaml`` and ``apm.yml``.
         output_dir: Directory where the bundle will be created.
         fmt: Bundle format  -- ``"apm"`` (default) or ``"plugin"``.
-        target: Target filter  -- ``"copilot"``, ``"claude"``, ``"all"``, or *None*
+        target: Target filter  -- ``"copilot"``, ``"claude"``, ``"all"``, a list of
+            target strings (e.g. ``["claude", "vscode"]``), or *None*
             (auto-detect from apm.yml / project structure).
         archive: If *True*, produce a ``.tar.gz`` and remove the directory.
         dry_run: If *True*, resolve the file list but write nothing to disk.
@@ -102,14 +103,21 @@ def pack_bundle(
         config_target = None
 
     # 3. Resolve effective target
-    effective_target, _reason = detect_target(
-        project_root,
-        explicit_target=target,
-        config_target=config_target,
-    )
-    # For packing purposes, "minimal" means nothing to pack  -- treat as "all"
-    if effective_target == "minimal":
-        effective_target = "all"
+    if isinstance(target, list):
+        # List from CLI (e.g. --target claude,copilot) passes through directly
+        effective_target = target
+    elif isinstance(config_target, list) and target is None:
+        # List from apm.yml target: [claude, copilot]
+        effective_target = config_target
+    else:
+        effective_target, _reason = detect_target(
+            project_root,
+            explicit_target=target,
+            config_target=config_target if isinstance(config_target, str) else None,
+        )
+        # For packing purposes, "minimal" means nothing to pack  -- treat as "all"
+        if effective_target == "minimal":
+            effective_target = "all"
 
     # 4. Collect deployed_files from all dependencies, filtered by target
     all_deployed: List[str] = []

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/bundle/plugin_exporter.py

@@ -9,7 +9,7 @@ import json
 import os
 import shutil
 import tarfile
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from typing import Dict, List, Optional, Set, Tuple
 
 import yaml
@@ -63,6 +63,16 @@ def _rename_prompt(name: str) -> str:
     return name
 
 
+def _normalize_bare_skill_slug(slug: str) -> str:
+    """Normalize bare-skill slugs derived from dependency virtual paths."""
+    normalized = slug.replace("\\", "/").strip("/")
+    while normalized.startswith("skills/"):
+        normalized = normalized[len("skills/") :].lstrip("/")
+    if normalized == "skills":
+        return ""
+    return PurePosixPath(normalized).as_posix() if normalized else ""
+
+
 # ---------------------------------------------------------------------------
 # Component collectors
 # ---------------------------------------------------------------------------
@@ -130,7 +140,7 @@ def _collect_bare_skill(
         return
     # Derive a slug: prefer virtual_path (e.g. "frontend-design"), else last
     # segment of repo_url (e.g. "my-skill" from "owner/my-skill")
-    slug = (getattr(dep, "virtual_path", "") or "").strip("/")
+    slug = _normalize_bare_skill_slug(getattr(dep, "virtual_path", "") or "")
     if not slug:
         slug = dep.repo_url.rsplit("/", 1)[-1] if dep.repo_url else "skill"
     for f in sorted(install_path.iterdir()):
@@ -386,14 +396,7 @@ def _update_plugin_json_paths(plugin_json: dict, output_files: List[str]) -> dic
 
 def _dep_install_path(dep: LockedDependency, apm_modules_dir: Path) -> Path:
     """Compute the filesystem install path for a locked dependency."""
-    dep_ref = DependencyReference(
-        repo_url=dep.repo_url,
-        host=dep.host,
-        virtual_path=dep.virtual_path,
-        is_virtual=dep.is_virtual,
-        is_local=(dep.source == "local"),
-        local_path=dep.local_path,
-    )
+    dep_ref = dep.to_dependency_ref()
     return dep_ref.get_install_path(apm_modules_dir)
 
 

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/bundle/unpacker.py

@@ -56,7 +56,8 @@ def unpack_bundle(
     # 1. If archive, extract to temp dir
     cleanup_temp = False
     if bundle_path.is_file() and bundle_path.name.endswith(".tar.gz"):
-        temp_dir = Path(tempfile.mkdtemp(prefix="apm-unpack-"))
+        from ..config import get_apm_temp_dir
+        temp_dir = Path(tempfile.mkdtemp(prefix="apm-unpack-", dir=get_apm_temp_dir()))
         cleanup_temp = True
         try:
             with tarfile.open(bundle_path, "r:gz") as tar:

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/cli.py

@@ -20,11 +20,13 @@ from apm_cli.commands.audit import audit
 from apm_cli.commands.compile import compile as compile_cmd
 from apm_cli.commands.config import config
 from apm_cli.commands.deps import deps
+from apm_cli.commands.view import view as view_cmd
 from apm_cli.commands.init import init
 from apm_cli.commands.install import install
 from apm_cli.commands.list_cmd import list as list_cmd
 from apm_cli.commands.marketplace import marketplace, search as marketplace_search
 from apm_cli.commands.mcp import mcp
+from apm_cli.commands.outdated import outdated as outdated_cmd
 from apm_cli.commands.pack import pack_cmd, unpack_cmd
 from apm_cli.commands.prune import prune
 from apm_cli.commands.run import preview, run
@@ -57,6 +59,15 @@ def cli(ctx):
 # Register command groups
 cli.add_command(audit)
 cli.add_command(deps)
+cli.add_command(view_cmd)
+# Hidden backward-compatible alias: ``apm info`` → ``apm view``
+cli.add_command(click.Command(
+    name="info",
+    callback=view_cmd.callback,
+    params=list(view_cmd.params),
+    help=view_cmd.help,
+    hidden=True,
+))
 cli.add_command(pack_cmd, name="pack")
 cli.add_command(unpack_cmd, name="unpack")
 cli.add_command(init)
@@ -71,6 +82,7 @@ cli.add_command(list_cmd, name="list")
 cli.add_command(config)
 cli.add_command(runtime)
 cli.add_command(mcp)
+cli.add_command(outdated_cmd, name="outdated")
 cli.add_command(marketplace)
 cli.add_command(marketplace_search, name="search")
 

{apm_cli-0.8.11 → apm_cli-0.9.0}/src/apm_cli/commands/_helpers.py

@@ -21,6 +21,7 @@ from ..constants import (
     GITIGNORE_FILENAME,
 )
 from ..utils.console import _rich_echo, _rich_info, _rich_warning
+from ..update_policy import get_update_hint_message, is_self_update_enabled
 from ..version import get_build_sha, get_version
 from ..utils.version_checker import check_for_updates
 
@@ -121,8 +122,6 @@ def _build_expected_install_paths(declared_deps, lockfile, apm_modules_dir: Path
     (depth > 1 from ``apm.lock``), using ``get_install_path()`` for
     consistency with how packages are actually installed.
     """
-    from ..models.apm_package import DependencyReference
-
     expected = builtins.set()
     for dep in declared_deps:
         install_path = dep.get_install_path(apm_modules_dir)
@@ -135,12 +134,7 @@ def _build_expected_install_paths(declared_deps, lockfile, apm_modules_dir: Path
     if lockfile:
         for dep in lockfile.get_all_dependencies():
             if dep.depth is not None and dep.depth > 1:
-                dep_ref = DependencyReference(
-                    repo_url=dep.repo_url,
-                    host=dep.host,
-                    virtual_path=dep.virtual_path,
-                    is_virtual=dep.is_virtual,
-                )
+                dep_ref = dep.to_dependency_ref()
                 install_path = dep_ref.get_install_path(apm_modules_dir)
                 try:
                     relative_path = install_path.relative_to(apm_modules_dir)
@@ -240,6 +234,10 @@ def print_version(ctx, param, value):
 def _check_and_notify_updates():
     """Check for updates and notify user non-blockingly."""
     try:
+        # Skip notifications when self-update is disabled by distribution policy.
+        if not is_self_update_enabled():
+            return
+
         # Skip version check in E2E test mode to avoid interfering with tests
         if os.environ.get("APM_E2E_TESTS", "").lower() in ("1", "true", "yes"):
             return
@@ -260,7 +258,7 @@ def _check_and_notify_updates():
             )
 
             # Show update command using helper for consistency
-            _rich_echo("Run apm update to upgrade", color="yellow", bold=True)
+            _rich_echo(get_update_hint_message(), color="yellow", bold=True)
 
             # Add a blank line for visual separation
             click.echo()
@@ -414,6 +412,21 @@ def _validate_plugin_name(name):
     return bool(re.match(r"^[a-z][a-z0-9-]{0,63}$", name))
 
 
+def _validate_project_name(name):
+    """Validate that a project name is safe to use as a directory name.
+
+    Project names are used directly as directory names and must not contain
+    '/' or '\' so the name is not interpreted as a filesystem path,
+    and must not be '..' to prevent directory traversal.
+
+    Returns True if valid, False otherwise.
+    """
+    if "/" in name or "\\" in name:
+        return False
+    if name == "..":
+        return False
+    return True
+
 def _create_plugin_json(config):
     """Create plugin.json file with package metadata.