panorama-super-cli 0.2.0__tar.gz → 0.2.2__tar.gz

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/.github/workflows/docs.yml

@@ -23,9 +23,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python
@@ -36,7 +36,7 @@ jobs:
         run: uv run mkdocs build --strict
       - name: Upload Pages artifact
         if: github.ref_type == 'tag'
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
@@ -49,4 +49,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/.github/workflows/lint.yml

@@ -9,9 +9,9 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python
@@ -28,9 +28,9 @@ jobs:
   agents-md-fresh:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
     # no-environment form.
     steps:
       - name: Checkout (full history for changelog notes)
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
@@ -40,7 +40,7 @@ jobs:
           echo "Tag $GITHUB_REF_NAME ($GITHUB_SHA) is on main."
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
 

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/.github/workflows/test.yml

@@ -14,9 +14,9 @@ jobs:
         os: [ubuntu-latest, macos-latest]
         python: ["3.12", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Install uv
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@v7
         with:
           enable-cache: true
       - name: Install Python

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/CHANGELOG.md

@@ -7,6 +7,36 @@ project will follow [Semantic Versioning](https://semver.org/). While on
 
 ## [Unreleased]
 
+## v0.2.2 — 2026-06-04
+
+### Fixed
+
+- **Repoint-before-delete no longer skipped silently.** A merge or rename whose
+  only safe repoint is a reference the appliers can't express as a flat member
+  rewrite — a NAT source/destination *translation* field, or a rule edit with no
+  rulebase — is now refused with a `blocker` (exit 6) on both the offline and
+  live paths, naming the object and the unmappable referrer. Previously the edit
+  was dropped while the delete/rename still ran, leaving a dangling reference.
+  Advisory unmappable edits with no accompanying teardown still pass with a
+  warning. (#28)
+- **`psc` with no arguments (and unknown commands) print help, not a traceback.**
+  Typer 0.16+ vendors its own Click, so the exceptions the entry point raised
+  were not the `click.*` the wrapper caught and escaped as a traceback ending in
+  `NoArgsIsHelpError`. The wrapper now handles both the vendored and the real
+  Click hierarchies, resolving the module defensively so psc still imports on
+  older Typer. No-args/`--help` exit 0; usage errors exit 2. (#31)
+
+## v0.2.1 — 2026-06-04
+
+### Added
+
+- **`find ip --exact` / `-e`.** Restrict `find ip` to objects whose value
+  equals the target exactly, dropping the broader (`contains`) and narrower
+  (`within`) matches that a host query normally also surfaces. Netmask and
+  bare-host forms still canonicalize equal, so `10.0.0.10` and `10.0.0.10/32`
+  remain exact matches of each other. Address-groups are reported only when
+  they carry an exact match. (#30)
+
 ## v0.2.0 — 2026-06-04
 
 ### Added

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: panorama-super-cli
-Version: 0.2.0
+Version: 0.2.2
 Summary: Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely.
 Project-URL: Homepage, https://github.com/thomaschristory/panorama-super-cli
 Project-URL: Documentation, https://thomaschristory.github.io/panorama-super-cli/
@@ -81,7 +81,7 @@ pip install panorama-super-cli
 
 | Area | Commands (v0.1) |
 | --- | --- |
-| **Find / resolve** | `psc find ip <ip>`, `find ip -f ips.txt`, `find object <name>` |
+| **Find / resolve** | `psc find ip <ip>`, `find ip -e <ip>` (exact only), `find ip -f ips.txt`, `find object <name>` |
 | **Duplicates** | `psc dedup addresses`, `dedup services`, `dedup merge` |
 | **Naming** | `psc name suggest`, `name lint`, `name apply` (opt-in templates) |
 | **References** | `psc refs <object>` (where-used), `refs unused` |

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/README.md

@@ -50,7 +50,7 @@ pip install panorama-super-cli
 
 | Area | Commands (v0.1) |
 | --- | --- |
-| **Find / resolve** | `psc find ip <ip>`, `find ip -f ips.txt`, `find object <name>` |
+| **Find / resolve** | `psc find ip <ip>`, `find ip -e <ip>` (exact only), `find ip -f ips.txt`, `find object <name>` |
 | **Duplicates** | `psc dedup addresses`, `dedup services`, `dedup merge` |
 | **Naming** | `psc name suggest`, `name lint`, `name apply` (opt-in templates) |
 | **References** | `psc refs <object>` (where-used), `refs unused` |

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/psc/_version.py

@@ -4,4 +4,4 @@
 Keep this in sync with `[project].version` in `pyproject.toml`.
 """
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/psc/cli/app.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+from types import ModuleType
 
 import click
 import typer
@@ -15,6 +16,28 @@ from psc.config.loader import load_config
 from psc.output.errors import PscError
 from psc.output.format import OutputFormat
 
+
+def _click_exception_module() -> ModuleType:
+    """The Click `exceptions` module whose flavour matches what `app(...)` raises.
+
+    Typer >=0.16 vendors its own Click under `typer._click`, so the exceptions
+    `app(standalone_mode=False)` raises are not subclasses of the real `click.*`
+    (issue #31). Older Typer has no `typer._click` at all — importing it at
+    module top level would crash psc on *import*, breaking every command, which
+    is strictly worse than the bug we're fixing. Resolve defensively: prefer the
+    vendored module, fall back to the real Click (which older Typer raises).
+    """
+    try:
+        from typer._click import exceptions as vendored  # noqa: PLC0415 — conditional
+    except ImportError:
+        from click import exceptions as real  # noqa: PLC0415 — fallback for older Typer
+
+        return real
+    return vendored
+
+
+_typer_click_exc = _click_exception_module()
+
 app = typer.Typer(
     add_completion=True,
     no_args_is_help=True,
@@ -125,18 +148,27 @@ def _emit_error(err: PscError) -> None:
 
 
 def main() -> None:
+    # Typer 0.26 vendors its own Click (`typer._click`), so the exceptions
+    # `app(standalone_mode=False)` raises are NOT subclasses of the real
+    # `click.*`. Catch both flavours, or a no-args/`--help`/bad-command run
+    # escapes uncaught and prints a traceback instead of help (#31).
     try:
         app(standalone_mode=False)
     except PscError as err:
         _emit_error(err)
         raise SystemExit(err.exit_code) from None
-    except click.UsageError as err:
-        err.show()
-        raise SystemExit(2) from None
-    except (click.exceptions.Abort, KeyboardInterrupt):
+    except (KeyboardInterrupt, click.exceptions.Abort, _typer_click_exc.Abort):
         Console(stderr=True).print("aborted")
         raise SystemExit(130) from None
-    except click.exceptions.Exit as err:
+    except (click.exceptions.Exit, _typer_click_exc.Exit) as err:
+        raise SystemExit(err.exit_code) from None
+    except (click.ClickException, _typer_click_exc.ClickException) as err:
+        # `no_args_is_help` (and `--help`) already printed the help text; the
+        # raise is just a stop signal, so exit 0 rather than rendering it as an
+        # error. Genuine usage errors still print and exit non-zero.
+        if err.__class__.__name__ == "NoArgsIsHelpError":
+            raise SystemExit(0) from None
+        err.show()
         raise SystemExit(err.exit_code) from None
 
 

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/psc/cli/find_cmds.py

@@ -21,11 +21,16 @@ def ip(
     file: Path | None = typer.Option(
         None, "--file", "-f", help="Read targets from a file (one per line; # comments)."
     ),
+    exact: bool = typer.Option(
+        False, "--exact", "-e", help="Only exact matches (drop contains/within)."
+    ),
 ) -> None:
     """Find which address objects/groups match an IP (or a whole list).
 
     Reports exact matches, broader objects that *contain* the target, and
     narrower objects *within* it, plus the address-groups that carry them.
+    With --exact, only objects equal to the target are reported (netmask and
+    bare-host forms still count as equal, e.g. 10.0.0.10 == 10.0.0.10/32).
     """
     rt: Runtime = ctx.obj
     snap = rt.snapshot()
@@ -43,7 +48,7 @@ def ip(
             "provide one or more IP/CIDR/range/FQDN targets, or --file", ErrorType.VALIDATION
         )
 
-    results = find_ips(snap, items, rt.scope())
+    results = find_ips(snap, items, rt.scope(), exact=exact)
     rows: list[dict[str, object]] = []
     for res in results:
         if not res.matches:

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/psc/core/changeset.py

@@ -125,3 +125,56 @@ class ChangeSet(BaseModel):
         out += [r.summary for r in self.renames]
         out += [d.summary for d in self.deletes]
         return out
+
+
+def reference_edit_is_mappable(edit: ReferenceEdit) -> bool:
+    """Whether both appliers can express `edit` as a flat member-field rewrite.
+
+    The single source of truth behind `apply_xml._referrer_field_element` and
+    `apply_live._referrer_field_xpath`: a member field they know how to address
+    (a group's `static`/`members`, a security-rule field, a NAT src/dst list).
+    A NAT *translation* field is nested with no flat list, and a rule edit with
+    no `rulebase` can't be located — both are unmappable, and an applier silently
+    skips them. The planner uses this to refuse such a skip when the same plan
+    tears the target down, instead of leaving a dangling reference (#28).
+    """
+    kind = edit.referrer_kind
+    if kind in ("address-group", "service-group"):
+        return True
+    if kind == "security-rule":
+        return edit.rulebase is not None
+    if kind == "nat-rule":
+        return edit.rulebase is not None and edit.field in ("source", "destination")
+    return False
+
+
+def gate_unmappable_reference_edits(cs: ChangeSet) -> None:
+    """Promote unsafe unmappable reference edits to blockers, in place.
+
+    An unmappable edit (see `reference_edit_is_mappable`) is silently skipped at
+    apply time. If the plan also deletes or renames an object, that skip drops
+    the repoint that kept the teardown safe — a dangling reference, the exact
+    failure repoint-before-delete exists to prevent. Make it a hard blocker. With
+    no teardown the edit is advisory only, so it stays a warning.
+
+    Clearing the ops is the planner's job (a blocked plan carries zero ops); this
+    only classifies.
+    """
+    unmappable = [e for e in cs.reference_edits if not reference_edit_is_mappable(e)]
+    if not unmappable:
+        return
+    torn_down = [d.name for d in cs.deletes] + [r.old_name for r in cs.renames]
+    for e in unmappable:
+        referrer = f"{e.referrer_kind} '{e.referrer_name}'@{e.referrer_location} {e.field}"
+        if torn_down:
+            targets = ", ".join(f"'{t}'" for t in torn_down)
+            cs.blockers.append(
+                f"cannot repoint {referrer} automatically (no flat member list to rewrite); "
+                f"removing/renaming {targets} would leave a dangling reference — edit that "
+                "field manually, then re-run"
+            )
+        else:
+            cs.warnings.append(
+                f"{referrer} can't be repointed automatically (no flat member list); "
+                "review and edit it by hand"
+            )

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/psc/core/dedup.py

@@ -14,7 +14,13 @@ from __future__ import annotations
 
 from pydantic import BaseModel, Field
 
-from psc.core.changeset import ChangeSet, ObjectDelete, ObjectKind, ReferenceEdit
+from psc.core.changeset import (
+    ChangeSet,
+    ObjectDelete,
+    ObjectKind,
+    ReferenceEdit,
+    gate_unmappable_reference_edits,
+)
 from psc.core.models import Location, Snapshot
 from psc.core.normalize import normalize_address, service_key
 from psc.core.refs import Reference, ReferenceGraph
@@ -155,23 +161,18 @@ def plan_merge(
             cs.warnings.append(
                 f"{ref.referrer_kind} '{ref.referrer_name}' {ref.field} would be emptied"
             )
-        if ref.field in ("source-translation", "destination-translation"):
-            # psc cannot safely rewrite NAT translation fields offline (the XML
-            # path is nested and renderer-flagged), so deleting `drop` would
-            # leave a dangling translation reference. Refuse rather than warn.
-            cs.blockers.append(
-                f"NAT rule '{ref.referrer_name}' references '{drop.name}' in "
-                f"{ref.field}; psc can't safely rewrite NAT translation offline — "
-                "edit that field manually, then re-run the merge"
-            )
+
+    cs.deletes.append(ObjectDelete(kind=ObjectKind.ADDRESS, name=drop.name, location=drop.location))
+    # Refuse any repoint the appliers would silently skip (e.g. a NAT translation
+    # field) now that the delete is in the plan — a skipped repoint + delete is a
+    # dangling reference. Mirrors `plan_rename`; offline and live share the gate.
+    gate_unmappable_reference_edits(cs)
 
     if cs.blockers:
         # Invariant: a blocked plan carries zero ops, so no consumer can execute
         # a partial rewrite by iterating ops without checking `is_blocked`.
         cs.reference_edits.clear()
-        return cs
-
-    cs.deletes.append(ObjectDelete(kind=ObjectKind.ADDRESS, name=drop.name, location=drop.location))
+        cs.deletes.clear()
     return cs
 
 

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/psc/core/naming.py

@@ -15,7 +15,13 @@ import re
 
 from pydantic import BaseModel
 
-from psc.core.changeset import ChangeSet, ObjectKind, ObjectRename, ReferenceEdit
+from psc.core.changeset import (
+    ChangeSet,
+    ObjectKind,
+    ObjectRename,
+    ReferenceEdit,
+    gate_unmappable_reference_edits,
+)
 from psc.core.dedup import field_members
 from psc.core.models import Address, AddressType, Location, Service, Snapshot
 from psc.core.refs import ReferenceGraph
@@ -182,4 +188,12 @@ def plan_rename(
     cs.renames.append(
         ObjectRename(kind=kind, location=location_name, old_name=old_name, new_name=new_name)
     )
+    # Refuse any repoint the appliers would silently skip (e.g. a NAT translation
+    # field): skipping it while renaming the object away leaves a dangling
+    # reference. Shared gate keeps offline and live identical (#28).
+    gate_unmappable_reference_edits(cs)
+    if cs.blockers:
+        # Invariant: a blocked plan carries zero ops (see `plan_merge`).
+        cs.reference_edits.clear()
+        cs.renames.clear()
     return cs

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/psc/core/resolve.py

@@ -58,9 +58,17 @@ def _visible_names(snapshot: Snapshot, scope: Location | None) -> set[str] | Non
     return {loc.name for loc in snapshot.ancestors(scope)}
 
 
-def find_ip(snapshot: Snapshot, raw: str, scope: Location | None = None) -> FindResult:
+def find_ip(
+    snapshot: Snapshot, raw: str, scope: Location | None = None, *, exact: bool = False
+) -> FindResult:
     """Find every address object/group matching `raw` within `scope` (which
-    includes the scoped device-group's ancestors and `shared`)."""
+    includes the scoped device-group's ancestors and `shared`).
+
+    With `exact=True`, only objects whose value equals the query exactly are
+    kept — broader (`CONTAINS`) and narrower (`WITHIN`) matches are dropped.
+    Netmask and bare-host forms still canonicalize equal (`10.0.0.10` ==
+    `10.0.0.10/32`), so those remain exact.
+    """
     query = parse_query(raw)
     visible = _visible_names(snapshot, scope)
     matched: list[tuple[Address, MatchKind]] = []
@@ -71,8 +79,9 @@ def find_ip(snapshot: Snapshot, raw: str, scope: Location | None = None) -> Find
         if nv is None:
             continue
         mk = match(query, nv)
-        if mk is not None:
-            matched.append((addr, mk))
+        if mk is None or (exact and mk is not MatchKind.EXACT):
+            continue
+        matched.append((addr, mk))
 
     matches = [
         AddressMatch(
@@ -124,9 +133,9 @@ def find_ip(snapshot: Snapshot, raw: str, scope: Location | None = None) -> Find
 
 
 def find_ips(
-    snapshot: Snapshot, raws: list[str], scope: Location | None = None
+    snapshot: Snapshot, raws: list[str], scope: Location | None = None, *, exact: bool = False
 ) -> list[FindResult]:
-    return [find_ip(snapshot, r, scope) for r in raws]
+    return [find_ip(snapshot, r, scope, exact=exact) for r in raws]
 
 
 class ObjectHit(BaseModel):

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "panorama-super-cli"
-version = "0.2.0"
+version = "0.2.2"
 description = "Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely."
 readme = "README.md"
 requires-python = ">=3.12"

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/skills/panorama-super-cli/SKILL.md

@@ -50,6 +50,7 @@ psc -c panorama.xml dedup merge --keep h-web1 --remove web-primary --apply --out
 
 ```bash
 psc -c cfg.xml -o json find ip 10.0.0.10          # exact/contains/within + groups
+psc -c cfg.xml -o json find ip -e 10.0.0.10       # exact only (10.0.0.10 == /32)
 psc -c cfg.xml -o json find ip 10.0.0.0/24        # everything inside the /24
 psc -c cfg.xml -o json find ip -f ips.txt         # a whole list (array result)
 psc -c cfg.xml -o json find object grp-web        # locate by exact name
@@ -57,6 +58,8 @@ psc -c cfg.xml -o json find object grp-web        # locate by exact name
 
 `exists: true` means there's an exact-match object. `matches[].match` is one of
 `exact` (equal), `contains` (object is broader), `within` (object is narrower).
+Pass `--exact`/`-e` to keep only `exact` matches — handy when a broad object
+like `10.0.0.0/8` would otherwise drown out the host you asked for.
 
 ### dedup — duplicates and merging
 

panorama_super_cli-0.2.2/tests/test_changeset.py

@@ -0,0 +1,172 @@
+"""Tests for the shared unmappable-reference gate (issue #28).
+
+The gate is the single source of truth for "can both appliers express this
+reference edit as a flat member rewrite?" When the answer is no *and* the same
+plan tears the target down (delete/rename), the silently-skipped repoint would
+leave a dangling reference — so it must become a hard blocker, not a warning.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from psc.core.apply_live import plan_xapi_ops
+from psc.core.apply_xml import apply_changeset
+from psc.core.changeset import (
+    ChangeSet,
+    ObjectDelete,
+    ObjectKind,
+    ObjectRename,
+    ReferenceEdit,
+    gate_unmappable_reference_edits,
+    reference_edit_is_mappable,
+)
+from psc.core.models import Snapshot
+from psc.core.naming import plan_rename
+from psc.core.refs import ReferenceGraph
+from psc.output.errors import ErrorType, PscError
+
+
+def _edit(**kw: object) -> ReferenceEdit:
+    base: dict[str, object] = {
+        "referrer_kind": "address-group",
+        "referrer_name": "g",
+        "referrer_location": "shared",
+        "field": "static",
+    }
+    base.update(kw)
+    return ReferenceEdit(**base)  # type: ignore[arg-type]
+
+
+def test_flat_member_fields_are_mappable() -> None:
+    assert reference_edit_is_mappable(_edit(referrer_kind="address-group", field="static"))
+    assert reference_edit_is_mappable(_edit(referrer_kind="service-group", field="members"))
+
+
+def test_rule_field_is_mappable_only_with_rulebase() -> None:
+    assert reference_edit_is_mappable(
+        _edit(referrer_kind="security-rule", field="destination", rulebase="pre")
+    )
+    assert reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="source", rulebase="pre")
+    )
+    # trigger 2: a rule edit with no rulebase can't be addressed by either applier
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="security-rule", field="destination", rulebase=None)
+    )
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="source", rulebase=None)
+    )
+
+
+def test_nat_translation_and_nonmember_fields_are_unmappable() -> None:
+    # trigger 1: NAT translation fields are nested, not flat member lists
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="source-translation", rulebase="pre")
+    )
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="destination-translation", rulebase="pre")
+    )
+    # a nat-rule `service` is a scalar, not a member list either
+    assert not reference_edit_is_mappable(
+        _edit(referrer_kind="nat-rule", field="service", rulebase="pre")
+    )
+
+
+def test_gate_blocks_unmappable_edit_when_plan_deletes_target() -> None:
+    cs = ChangeSet(
+        title="merge",
+        reference_edits=[
+            _edit(
+                referrer_kind="nat-rule",
+                referrer_name="nat-web",
+                referrer_location="shared",
+                field="source-translation",
+                rulebase="pre",
+            )
+        ],
+        deletes=[ObjectDelete(kind=ObjectKind.ADDRESS, name="net-10", location="shared")],
+    )
+    gate_unmappable_reference_edits(cs)
+    assert cs.is_blocked
+    blocker = " ".join(cs.blockers)
+    assert "net-10" in blocker  # names the torn-down object
+    assert "nat-web" in blocker  # names the unmappable referrer
+    assert "source-translation" in blocker
+
+
+def test_gate_blocks_unmappable_edit_when_plan_renames_target() -> None:
+    cs = ChangeSet(
+        title="rename",
+        reference_edits=[
+            _edit(
+                referrer_kind="security-rule",
+                referrer_name="r1",
+                referrer_location="shared",
+                field="destination",
+                rulebase=None,
+            )
+        ],
+        renames=[
+            ObjectRename(
+                kind=ObjectKind.ADDRESS, location="shared", old_name="net-10", new_name="N-10"
+            )
+        ],
+    )
+    gate_unmappable_reference_edits(cs)
+    assert cs.is_blocked
+    assert any("net-10" in b and "r1" in b for b in cs.blockers)
+
+
+def test_gate_warns_but_passes_when_no_teardown() -> None:
+    cs = ChangeSet(
+        title="advisory",
+        reference_edits=[
+            _edit(
+                referrer_kind="nat-rule",
+                referrer_name="nat-web",
+                referrer_location="shared",
+                field="source-translation",
+                rulebase="pre",
+            )
+        ],
+    )
+    gate_unmappable_reference_edits(cs)
+    assert not cs.is_blocked
+    assert any("nat-web" in w for w in cs.warnings)
+
+
+def test_gate_noop_when_all_edits_mappable() -> None:
+    cs = ChangeSet(
+        title="clean",
+        reference_edits=[_edit(referrer_kind="address-group", field="static")],
+        deletes=[ObjectDelete(kind=ObjectKind.ADDRESS, name="a", location="shared")],
+    )
+    gate_unmappable_reference_edits(cs)
+    assert not cs.is_blocked
+    assert not cs.warnings
+
+
+def test_engine_blocked_plan_refused_on_both_paths(snapshot: Snapshot, fixture_path: Path) -> None:
+    """The gate-produced blocker is honored identically offline and live: both
+    appliers refuse with CONFLICT (exit 6) before mutating anything (#28)."""
+    graph = ReferenceGraph.build(snapshot)
+    cs = plan_rename(
+        snapshot,
+        graph,
+        kind=ObjectKind.ADDRESS,
+        location_name="shared",
+        old_name="net-10",
+        new_name="N-10.0.0.0_24",
+    )
+    assert cs.is_blocked
+
+    with pytest.raises(PscError) as offline:
+        apply_changeset(fixture_path.read_text(), cs)
+    assert offline.value.error_type is ErrorType.CONFLICT
+
+    with pytest.raises(PscError) as live:
+        plan_xapi_ops(cs)
+    assert live.value.error_type is ErrorType.CONFLICT

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/tests/test_cli.py

@@ -1,11 +1,17 @@
 from __future__ import annotations
 
+import builtins
 import json
 import os
 import subprocess
 import sys
 from pathlib import Path
 
+import click
+import pytest
+
+from psc.cli import app
+
 FIXTURE = Path(__file__).parent / "fixtures" / "panorama-config.xml"
 
 
@@ -34,6 +40,24 @@ def test_find_ip_json_contract() -> None:
     assert {m["name"] for m in data["matches"]} >= {"h-web1", "web-primary"}
 
 
+def test_find_ip_exact_flag_json() -> None:
+    cp = run("-c", str(FIXTURE), "-o", "json", "find", "ip", "--exact", "10.0.0.10")
+    assert cp.returncode == 0
+    data = json.loads(cp.stdout)
+    assert data["exists"] is True
+    matches = data["matches"]
+    assert all(m["match"] == "exact" for m in matches)
+    names = {m["name"] for m in matches}
+    assert {"h-web1", "web-primary"} <= names
+    assert "net-10" not in names  # the /24 is CONTAINS, dropped under --exact
+
+
+def test_find_ip_exact_short_flag() -> None:
+    cp = run("-c", str(FIXTURE), "-o", "json", "find", "ip", "-e", "10.0.0.10")
+    assert cp.returncode == 0
+    assert all(m["match"] == "exact" for m in json.loads(cp.stdout)["matches"])
+
+
 def test_strict_not_found_exit_5() -> None:
     cp = run("-c", str(FIXTURE), "--strict", "-o", "json", "find", "ip", "203.0.113.9")
     assert cp.returncode == 5
@@ -102,3 +126,47 @@ def test_no_source_errors_config() -> None:
     cp = run("-o", "json", "find", "ip", "10.0.0.10")
     assert cp.returncode == 9
     assert json.loads(cp.stdout)["type"] == "config"
+
+
+def test_no_args_prints_help_without_traceback() -> None:
+    # Typer's no_args_is_help raises a *vendored* click NoArgsIsHelpError that
+    # the main() wrapper (standalone_mode=False) must swallow cleanly (#31).
+    cp = run()
+    combined = cp.stdout + cp.stderr
+    assert cp.returncode == 0
+    assert "Usage:" in combined
+    assert "Traceback" not in combined
+    assert "NoArgsIsHelpError" not in combined
+
+
+def test_unknown_command_usage_error_exit_2() -> None:
+    cp = run("no-such-command")
+    combined = cp.stdout + cp.stderr
+    assert cp.returncode == 2
+    assert "Traceback" not in combined
+    assert "No such command" in combined
+
+
+def test_click_exception_module_resolves_with_required_attrs() -> None:
+    # main() reads ClickException/Exit/Abort off the resolved module, so it must
+    # expose them whichever Typer flavour is installed.
+    mod = app._click_exception_module()
+    for attr in ("ClickException", "Exit", "Abort"):
+        assert hasattr(mod, attr)
+
+
+def test_click_exception_module_falls_back_when_typer_unvendored(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # Older Typer (<0.16) has no `typer._click`; a top-level import of it would
+    # crash psc at import time — worse than #31. Resolution must degrade to the
+    # real Click instead of raising.
+    real_import = builtins.__import__
+
+    def fake_import(name: str, *args: object, **kwargs: object) -> object:
+        if name.startswith("typer._click"):
+            raise ImportError("simulated Typer without vendored Click")
+        return real_import(name, *args, **kwargs)  # type: ignore[arg-type]
+
+    monkeypatch.setattr(builtins, "__import__", fake_import)
+    assert app._click_exception_module() is click.exceptions

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/tests/test_dedup.py

@@ -72,3 +72,22 @@ def test_merge_missing_object_blocks(snapshot: Snapshot) -> None:
         drop=ObjectRef(name="web-primary", location="shared"),
     )
     assert cs.is_blocked
+
+
+def test_merge_blocks_when_repoint_hits_nat_translation(snapshot: Snapshot) -> None:
+    """net-10 is referenced by nat-web's source-translation, which has no flat
+    member list — repointing it away can't be expressed offline or live, so a
+    merge that would delete net-10 must be blocked, not silently skipped (#28).
+    """
+    graph = ReferenceGraph.build(snapshot)
+    cs = plan_merge(
+        snapshot,
+        graph,
+        keep=ObjectRef(name="h-web1", location="shared"),
+        drop=ObjectRef(name="net-10", location="shared"),
+        allow_value_change=True,
+    )
+    assert cs.is_blocked
+    assert any("net-10" in b and "nat-web" in b for b in cs.blockers)
+    # a blocked plan carries zero executable ops
+    assert cs.op_count == 0

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/tests/test_naming.py

@@ -64,6 +64,25 @@ def test_rename_blocks_on_existing_name(snapshot: Snapshot) -> None:
     assert cs.is_blocked
 
 
+def test_rename_blocks_when_repoint_hits_nat_translation(snapshot: Snapshot) -> None:
+    """net-10 is referenced by nat-web's source-translation (a nested field with
+    no flat member list). The rename can repoint the security-rule destination
+    but not the translation field — so applying it would delete the old name out
+    from under a dangling reference. Block it (#28)."""
+    graph = ReferenceGraph.build(snapshot)
+    cs = plan_rename(
+        snapshot,
+        graph,
+        kind=ObjectKind.ADDRESS,
+        location_name="shared",
+        old_name="net-10",
+        new_name="N-10.0.0.0_24",
+    )
+    assert cs.is_blocked
+    assert any("net-10" in b and "nat-web" in b for b in cs.blockers)
+    assert cs.op_count == 0
+
+
 def test_rename_blocks_shared_dg_shadow() -> None:
     # Renaming a shared object to a name a DG already defines is refused.
     snap = Snapshot(

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/tests/test_resolve.py

@@ -22,6 +22,36 @@ def test_find_ip_reports_groups(snapshot: Snapshot) -> None:
     assert set(grp["grp-web"].via) == {"h-web1", "web-primary"}
 
 
+def test_find_ip_exact_flag_drops_contains_and_within(snapshot: Snapshot) -> None:
+    # Without --exact, the host matches its own objects (EXACT) and the
+    # enclosing /24 (CONTAINS). With exact=True only the EXACT ones survive.
+    res = find_ip(snapshot, "10.0.0.10", exact=True)
+    assert res.exists is True
+    kinds = {m.match for m in res.matches}
+    assert kinds == {MatchKind.EXACT}
+    names = {m.name for m in res.matches}
+    # /32 and bare-host forms normalize equal, so all three are EXACT...
+    assert {"h-web1", "web-primary", "h-web1-slash"} <= names
+    # ...and the broader /24 (CONTAINS) is excluded.
+    assert "net-10" not in names
+
+
+def test_find_ip_exact_flag_slash32_equals_bare(snapshot: Snapshot) -> None:
+    # 10.0.0.10/32 and 10.0.0.10 are the same host; both query forms must hit
+    # both object forms under --exact.
+    for q in ("10.0.0.10", "10.0.0.10/32"):
+        names = {m.name for m in find_ip(snapshot, q, exact=True).matches}
+        assert {"h-web1", "h-web1-slash"} <= names, q
+
+
+def test_find_ip_exact_flag_excludes_groups_with_only_broader(snapshot: Snapshot) -> None:
+    # A CIDR query that exactly matches no object yields nothing under --exact.
+    res = find_ip(snapshot, "10.0.0.0/8", exact=True)
+    assert res.exists is False
+    assert res.matches == []
+    assert res.groups == []
+
+
 def test_find_ip_no_match(snapshot: Snapshot) -> None:
     res = find_ip(snapshot, "203.0.113.1")
     assert res.exists is False

{panorama_super_cli-0.2.0 → panorama_super_cli-0.2.2}/uv.lock

@@ -694,7 +694,7 @@ wheels = [
 
 [[package]]
 name = "panorama-super-cli"
-version = "0.2.0"
+version = "0.2.2"
 source = { editable = "." }
 dependencies = [
     { name = "click" },