panorama-super-cli 0.2.3__tar.gz → 0.2.4__tar.gz

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/CHANGELOG.md

@@ -7,6 +7,19 @@ project will follow [Semantic Versioning](https://semver.org/). While on
 
 ## [Unreleased]
 
+## v0.2.4 — 2026-06-04
+
+### Changed
+
+- **`psc dedup addresses` is now strict by default** (#38). Addresses are
+  grouped only when their values are byte-identical, so a host accidentally
+  written with a subnet mask (`10.1.1.50/24`) is no longer reported as a
+  duplicate of the network `10.1.1.0/24` — merging those would have silently
+  changed rule matching. Genuinely identical forms (`10.0.0.10` and
+  `10.0.0.10/32`) still group. Pass `--not-strict` for the previous
+  host-bit-masking behaviour. The `dedup merge` safety gate now compares exact
+  values too, so such a merge is blocked unless `--allow-value-change` is given.
+
 ## v0.2.3 — 2026-06-04
 
 ### Added

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: panorama-super-cli
-Version: 0.2.3
+Version: 0.2.4
 Summary: Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely.
 Project-URL: Homepage, https://github.com/thomaschristory/panorama-super-cli
 Project-URL: Documentation, https://thomaschristory.github.io/panorama-super-cli/

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/docs/guides/duplicates-and-merging.md

@@ -12,6 +12,27 @@ Objects are grouped by **value**, not name. `h-web1`, `web-primary`, and
 `svc-https` (both TCP/443) in another. Each row tells you the value and every
 object name + location that defines it.
 
+### Strict by default
+
+Address matching is **strict**: only byte-identical values are duplicates. A
+host accidentally written with a subnet mask — `web-server = 10.1.1.50/24` —
+is **not** reported as a duplicate of the network `internal = 10.1.1.0/24`,
+even though both mask down to the same `/24`. (`10.0.0.10` and `10.0.0.10/32`
+*are* still the same host, so they group.)
+
+Pass `--not-strict` for the looser, fringe behaviour that masks host bits and
+collapses a host-with-mask onto its network:
+
+```console
+psc -c panorama.xml dedup addresses --not-strict
+```
+
+`--not-strict` only widens what's *listed* — it grants no merge power. A pair it
+surfaces (e.g. a host and its network) has different exact values, so
+[`dedup merge`](#the-safety-gate) still refuses it unless you pass
+`--allow-value-change`. Treat `--not-strict` as a discovery aid, then decide
+case by case whether the masked-equal objects really should be merged.
+
 ## Merge two objects
 
 `dedup merge` collapses one object (`--remove`) into another (`--keep`),

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/docs/reference/cli.md

@@ -40,7 +40,7 @@ object by exact name. See [Finding objects](../guides/finding-objects.md).
 ### dedup
 
 ```
-psc dedup addresses
+psc dedup addresses [--not-strict]
 psc dedup services
 psc dedup merge --keep NAME --remove NAME [--location LOC]
                [--keep-location LOC] [--remove-location LOC]

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/psc/_version.py

@@ -4,4 +4,4 @@
 Keep this in sync with `[project].version` in `pyproject.toml`.
 """
 
-__version__ = "0.2.3"
+__version__ = "0.2.4"

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/psc/cli/dedup_cmds.py

@@ -30,10 +30,23 @@ def _dup_rows(groups: list[DuplicateGroup]) -> list[dict[str, object]]:
 
 
 @app.command("addresses")
-def addresses(ctx: typer.Context) -> None:
-    """List address objects that share an identical value under different names."""
+def addresses(
+    ctx: typer.Context,
+    not_strict: bool = typer.Option(
+        False,
+        "--not-strict",
+        help="Also group host objects onto their network (mask host bits). "
+        "Default: only byte-identical values are duplicates.",
+    ),
+) -> None:
+    """List address objects that share an identical value under different names.
+
+    By default this is *strict*: a host written with a subnet mask
+    (`10.1.1.50/24`) is not treated as a duplicate of the network `10.1.1.0/24`.
+    Pass `--not-strict` for the looser, host-bit-masking behaviour.
+    """
     rt: Runtime = ctx.obj
-    groups = find_duplicate_addresses(rt.snapshot())
+    groups = find_duplicate_addresses(rt.snapshot(), strict=not not_strict)
     if rt.strict and not groups:
         raise PscError("no duplicate addresses", ErrorType.NOT_FOUND)
     render(

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/psc/core/dedup.py

@@ -45,21 +45,30 @@ class DuplicateGroup(BaseModel):
         return len(self.members)
 
 
-def find_duplicate_addresses(snapshot: Snapshot) -> list[DuplicateGroup]:
-    """Address objects sharing an identical normalized value, 2+ per bucket."""
+def find_duplicate_addresses(snapshot: Snapshot, *, strict: bool = True) -> list[DuplicateGroup]:
+    """Address objects sharing the same value, 2+ per bucket.
+
+    `strict` (default) groups only byte-identical values, so a host written with
+    a subnet mask (`10.1.1.50/24`) is *not* a duplicate of its network
+    (`10.1.1.0/24`). `strict=False` groups by masked network — the looser,
+    fringe behaviour that collapses host-with-mask onto the network.
+    """
     buckets: dict[str, list[ObjectRef]] = {}
     display: dict[str, str] = {}
     for a in snapshot.addresses:
         nv = normalize_address(a)
         if nv is None:
             continue
-        key = nv.overlaps_key()
+        key = nv.exact_key() if strict else nv.overlaps_key()
         buckets.setdefault(key, []).append(ObjectRef(name=a.name, location=a.location.name))
-        display.setdefault(key, f"{a.type.value} {nv.key}")
+        label = (nv.exact or nv.key) if strict else nv.key
+        display.setdefault(key, f"{a.type.value} {label}")
     return _to_groups("address", buckets, display)
 
 
 def find_duplicate_services(snapshot: Snapshot) -> list[DuplicateGroup]:
+    # Service dedup is already exact (protocol + normalized port lists); there
+    # is no host-bit-masking analogue, so no strict/loose distinction applies.
     buckets: dict[str, list[ObjectRef]] = {}
     display: dict[str, str] = {}
     for s in snapshot.services:
@@ -93,10 +102,13 @@ def _rewrite_members(before: list[str], drop: str, keep: str) -> list[str]:
 
 
 def _addr_value_key(snapshot: Snapshot, ref: ObjectRef) -> str | None:
+    # Exact (host-bit-preserving) key: the merge gate must treat a /24-masked
+    # host and the /24 network as *different* values, so it blocks the merge
+    # unless --allow-value-change is passed.
     for a in snapshot.addresses:
         if a.name == ref.name and a.location == ref.loc:
             nv = normalize_address(a)
-            return nv.overlaps_key() if nv else None
+            return nv.exact_key() if nv else None
     return None
 
 

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/psc/core/normalize.py

@@ -41,11 +41,20 @@ class AddrValue:
     range: tuple[int, int] | None = None
     family: int | None = None
     fqdn: str | None = None
+    exact: str | None = None
+    """Host-bit-preserving canonical string for ip-netmask (e.g. `10.1.1.50/24`
+    stays distinct from `10.1.1.0/24`); `None` means `key` is already exact."""
 
     def overlaps_key(self) -> str:
-        """Kind-qualified key for grouping exact duplicates."""
+        """Kind-qualified key grouping by *masked network* — loose: a host
+        written with a subnet mask collapses onto its network."""
         return f"{self.kind.value}:{self.key}"
 
+    def exact_key(self) -> str:
+        """Kind-qualified key grouping only *byte-identical* values — strict:
+        host bits are preserved, so `10.1.1.50/24` != `10.1.1.0/24`."""
+        return f"{self.kind.value}:{self.exact or self.key}"
+
 
 def _as_network(value: str) -> IPNetwork | None:
     try:
@@ -54,6 +63,16 @@ def _as_network(value: str) -> IPNetwork | None:
         return None
 
 
+def _as_interface(value: str) -> ipaddress.IPv4Interface | ipaddress.IPv6Interface | None:
+    """Parse host-preserving: `10.1.1.50/24` keeps its host bits, `10.0.0.10`
+    becomes `10.0.0.10/32`. `.network` is the masked form (equals
+    `_as_network`), `str(...)` is the exact form. `None` if unparseable."""
+    try:
+        return ipaddress.ip_interface(value.strip())
+    except ValueError:
+        return None
+
+
 def _range_bounds(value: str) -> tuple[int, int, int] | None:
     """`a-b` -> (start_int, end_int, family); None if unparseable."""
     if "-" not in value:
@@ -75,10 +94,19 @@ def normalize_address(addr: Address) -> AddrValue | None:
     """
     v = addr.value.strip()
     if addr.type is AddressType.IP_NETMASK:
-        net = _as_network(v)
-        if net is None:
+        # One parse yields both keys: `.network` is the masked grouping key
+        # (loose), `str(iface)` preserves host bits for the exact key (strict).
+        iface = _as_interface(v)
+        if iface is None:
             return None
-        return AddrValue(kind=addr.type, key=str(net), network=net, family=net.version)
+        net = iface.network
+        return AddrValue(
+            kind=addr.type,
+            key=str(net),
+            network=net,
+            family=net.version,
+            exact=str(iface),
+        )
     if addr.type is AddressType.IP_RANGE:
         bounds = _range_bounds(v)
         if bounds is None:

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "panorama-super-cli"
-version = "0.2.3"
+version = "0.2.4"
 description = "Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely."
 readme = "README.md"
 requires-python = ">=3.12"

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/skills/panorama-super-cli/SKILL.md

@@ -78,7 +78,8 @@ like `10.0.0.0/8` would otherwise drown out the host you asked for.
 ### dedup — duplicates and merging
 
 ```bash
-psc -c cfg.xml -o json dedup addresses            # same value, different names
+psc -c cfg.xml -o json dedup addresses            # strict: byte-identical values only
+psc -c cfg.xml -o json dedup addresses --not-strict  # also mask host bits (10.1.1.50/24 ~ 10.1.1.0/24)
 psc -c cfg.xml -o json dedup services
 psc -c cfg.xml -o json dedup merge --keep h-web1 --remove web-primary   # dry-run plan
 psc -c cfg.xml dedup merge --keep h-web1 --remove web-primary --apply --out fixed.xml

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/tests/test_cli.py

@@ -64,6 +64,36 @@ def test_strict_not_found_exit_5() -> None:
     assert json.loads(cp.stdout)["type"] == "not_found"
 
 
+_HOST_AND_NET_CONFIG = """<?xml version="1.0"?>
+<config version="11.0.0">
+  <shared>
+    <address>
+      <entry name="host-with-mask"><ip-netmask>10.1.1.50/24</ip-netmask></entry>
+      <entry name="real-network"><ip-netmask>10.1.1.0/24</ip-netmask></entry>
+    </address>
+  </shared>
+</config>
+"""
+
+
+def test_dedup_addresses_strict_default_finds_no_duplicates(tmp_path: Path) -> None:
+    cfg = tmp_path / "cfg.xml"
+    cfg.write_text(_HOST_AND_NET_CONFIG)
+    cp = run("-c", str(cfg), "-o", "json", "dedup", "addresses")
+    assert cp.returncode == 0
+    assert json.loads(cp.stdout) == []
+
+
+def test_dedup_addresses_not_strict_groups_host_with_network(tmp_path: Path) -> None:
+    cfg = tmp_path / "cfg.xml"
+    cfg.write_text(_HOST_AND_NET_CONFIG)
+    cp = run("-c", str(cfg), "-o", "json", "dedup", "addresses", "--not-strict")
+    assert cp.returncode == 0
+    groups = json.loads(cp.stdout)
+    assert len(groups) == 1
+    assert {m["name"] for m in groups[0]["members"]} == {"host-with-mask", "real-network"}
+
+
 def test_merge_dry_run_exit_0_writes_nothing(tmp_path: Path) -> None:
     out = tmp_path / "x.xml"
     cp = run(

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/tests/test_dedup.py

@@ -6,16 +6,45 @@ from psc.core.dedup import (
     find_duplicate_services,
     plan_merge,
 )
-from psc.core.models import Snapshot
+from psc.core.models import Address, AddressType, Snapshot
 from psc.core.refs import ReferenceGraph
 
 
+def _host_and_network() -> Snapshot:
+    """A host written with a subnet mask and a real network object: identical
+    only after host-bit masking, so a strict dedup must keep them apart."""
+    return Snapshot(
+        addresses=[
+            Address(name="host", type=AddressType.IP_NETMASK, value="10.1.1.50/24"),
+            Address(name="net", type=AddressType.IP_NETMASK, value="10.1.1.0/24"),
+        ]
+    )
+
+
 def test_duplicate_addresses_grouped_by_value(snapshot: Snapshot) -> None:
     groups = {g.value: {m.name for m in g.members} for g in find_duplicate_addresses(snapshot)}
     assert groups["ip-netmask 10.0.0.10/32"] == {"h-web1", "web-primary", "h-web1-slash"}
     assert groups["ip-netmask 192.168.1.1/32"] == {"edge-dup", "local-only"}
 
 
+def test_dedup_strict_default_excludes_host_with_mask() -> None:
+    # Strict (default): a /24-masked host is NOT a duplicate of the /24 network.
+    assert find_duplicate_addresses(_host_and_network()) == []
+
+
+def test_dedup_not_strict_groups_host_with_mask() -> None:
+    # --not-strict restores the host-bit-masking behaviour for the fringe case.
+    groups = find_duplicate_addresses(_host_and_network(), strict=False)
+    assert len(groups) == 1
+    assert {m.name for m in groups[0].members} == {"host", "net"}
+
+
+def test_dedup_strict_still_groups_genuine_duplicates(snapshot: Snapshot) -> None:
+    # Strict must keep collapsing 10.0.0.10 and 10.0.0.10/32 — genuinely identical.
+    groups = {g.value: {m.name for m in g.members} for g in find_duplicate_addresses(snapshot)}
+    assert groups["ip-netmask 10.0.0.10/32"] == {"h-web1", "web-primary", "h-web1-slash"}
+
+
 def test_duplicate_services(snapshot: Snapshot) -> None:
     groups = find_duplicate_services(snapshot)
     members = {m.name for g in groups for m in g.members}
@@ -51,6 +80,21 @@ def test_merge_blocks_value_mismatch(snapshot: Snapshot) -> None:
     assert any("value mismatch" in b for b in cs.blockers)
 
 
+def test_merge_blocks_host_vs_network_value_mismatch() -> None:
+    # The merge gate compares exact values: a /24-masked host and the /24
+    # network mean different things, so the merge is blocked without --force.
+    snap = _host_and_network()
+    graph = ReferenceGraph.build(snap)
+    cs = plan_merge(
+        snap,
+        graph,
+        keep=ObjectRef(name="net", location="shared"),
+        drop=ObjectRef(name="host", location="shared"),
+    )
+    assert cs.is_blocked
+    assert any("value mismatch" in b for b in cs.blockers)
+
+
 def test_merge_allows_value_change_when_forced(snapshot: Snapshot) -> None:
     graph = ReferenceGraph.build(snapshot)
     cs = plan_merge(

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/tests/test_normalize.py

@@ -15,6 +15,33 @@ def test_host_and_slash32_normalize_equal() -> None:
     assert a.overlaps_key() == b.overlaps_key()
 
 
+def test_exact_key_preserves_host_bits() -> None:
+    # Same masked network, different host bits: the loose key collapses them,
+    # the strict (exact) key keeps them apart.
+    host = normalize_address(_addr("10.1.1.50/24"))
+    net = normalize_address(_addr("10.1.1.0/24"))
+    assert host is not None and net is not None
+    assert host.overlaps_key() == net.overlaps_key()
+    assert host.exact_key() != net.exact_key()
+
+
+def test_exact_key_unifies_host_and_slash32() -> None:
+    # A bare host and its /32 are genuinely identical under the strict key too.
+    a = normalize_address(_addr("10.0.0.10"))
+    b = normalize_address(_addr("10.0.0.10/32"))
+    assert a is not None and b is not None
+    assert a.exact_key() == b.exact_key()
+
+
+def test_exact_key_canonicalizes_ipv6_forms() -> None:
+    # Strict must still group genuinely identical objects written differently:
+    # `0:0:0:0:0:0:0:1` and `::1` are the same host.
+    a = normalize_address(_addr("0:0:0:0:0:0:0:1"))
+    b = normalize_address(_addr("::1"))
+    assert a is not None and b is not None
+    assert a.exact_key() == b.exact_key()
+
+
 def test_exact_contains_within() -> None:
     host = normalize_address(_addr("10.0.0.10/32"))
     net = normalize_address(_addr("10.0.0.0/24"))

{panorama_super_cli-0.2.3 → panorama_super_cli-0.2.4}/uv.lock

@@ -694,7 +694,7 @@ wheels = [
 
 [[package]]
 name = "panorama-super-cli"
-version = "0.2.3"
+version = "0.2.4"
 source = { editable = "." }
 dependencies = [
     { name = "click" },