panorama-super-cli 0.4.2__tar.gz → 0.4.3__tar.gz

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/CHANGELOG.md

@@ -7,6 +7,30 @@ project will follow [Semantic Versioning](https://semver.org/). While on
 
 ## [Unreleased]
 
+## v0.4.3 — 2026-06-08
+
+### Fixed
+
+- **`refs unused` / `refs used` now resolve dynamic address-group (DAG)
+  membership from config tags** (#60) — a new pure evaluator
+  (`psc/core/dagfilter.py`) parses a DAG's tag filter (`and`/`or`/`not`,
+  parentheses, single-quoted tags) and matches it against the static tags psc
+  already parses. An address whose only use is being tag-matched into a
+  rule-referenced DAG is no longer reported `unused` (deleting it would have
+  silently dropped a host from that rule), and `refs used <addr>` now surfaces
+  the DAG → rule path (as a `dynamic` referrer). A DAG matches only addresses
+  visible from its own scope (its device-group, ancestors, and `shared`). An
+  unparseable filter is matched-nothing and warned about on stderr (naming the
+  DAG) rather than crashing the audit or being guessed at.
+
+### Known limitation
+
+- DAG membership from **externally registered IPs** (XML-API / User-ID /
+  VM-info) is runtime state absent from the config export and is still not
+  covered; resolving it requires a live op-command query and is tracked as a
+  follow-up. The `refs unused` stderr caveat and the *Coverage and blind spots*
+  guide reflect this.
+
 ## v0.4.2 — 2026-06-08
 
 ### Added

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: panorama-super-cli
-Version: 0.4.2
+Version: 0.4.3
 Summary: Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely.
 Project-URL: Homepage, https://github.com/thomaschristory/panorama-super-cli
 Project-URL: Documentation, https://thomaschristory.github.io/panorama-super-cli/

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/docs/guides/coverage-and-limitations.md

@@ -37,6 +37,7 @@ Within those rulebases it models exactly this **reference surface**:
 | NAT `source-translation` / `destination-translation` | address | ✅ where-used; **review-gated** for repoint |
 | PBF forwarding `nexthop` (`fqdn` variant) | address | ✅ where-used; **review-gated** for repoint |
 | static address-group / service-group members | address / service | ✅ |
+| dynamic address-group (DAG) membership | address | ✅ from **config tags**; registered IPs not covered (see below) |
 
 "Review-gated" means psc *sees* the reference and will **block** a
 merge/rename/delete that would strand it (it cannot rewrite a nested,
@@ -64,13 +65,25 @@ saw the reference. **This is the most dangerous gap.** Treat every `unused`
 result on a **shared** object as "unused by policy," and verify in Panorama
 before deleting.
 
-### 2. Dynamic address groups (DAGs) have no computed membership
+### 2. Dynamic address groups (DAGs): only config-tag membership is resolved
 
-A DAG includes addresses by a **tag expression**, not a static member list, so
-psc cannot walk "which addresses this DAG contains." An address whose only use
-is being matched into a DAG (via its tags) that a rule then consumes can be
-reported `unused`. (DAG *filters* are parsed for the unused-**tag** check, but
-DAG **membership** is not resolved for the unused-**address** check.)
+A DAG includes addresses by a **tag expression** (e.g. `'prod' and 'web'`), not
+a static member list. Since v0.4.3 psc **evaluates that filter against the
+static tags it already parses**, so an address whose only use is being matched
+into a rule-referenced DAG is treated as reachable — it is no longer reported
+`unused`, and `refs used <addr>` shows the DAG (as a `dynamic` referrer) on the
+path to the rule. DAG filters are also still parsed for the unused-**tag** check.
+
+The residual gap is **runtime, not config**: an address pulled into a DAG by an
+**externally registered IP** (XML-API / User-ID / VM-info / cloud plugin) carries
+no config tag, so the export psc reads cannot show that membership. Such an
+address can still be reported `unused`. Only a **live** membership query
+(`show object dynamic-address-group all`) sees registered IPs; resolving them is
+tracked as a follow-up enhancement on the live path.
+
+If a DAG's filter is **malformed/unparseable**, psc does not guess its
+membership (it matches nothing) and prints a `warning` on stderr naming that DAG,
+so you know its coverage is unverified.
 
 ### 3. Whole object categories psc does not model
 
@@ -119,8 +132,8 @@ config.
    block.
 2. `refs unused` is a **candidate list, not a kill list**, especially for
    `shared` objects. Before deleting, ask: could this live in a template, in
-   network/VPN/management config, on a NAT-rule tag, in a DAG, or on a firewall's
-   local config? If plausibly yes, confirm in Panorama first.
+   network/VPN/management config, in a DAG via an externally registered IP, or
+   on a firewall's local config? If plausibly yes, confirm in Panorama first.
 3. The safe operations are the ones psc can fully model and *block* when it
    can't (merge, rename). The risky operation is **deletion driven by
    `unused`**, because that is exactly where an unseen reference turns into an
@@ -130,6 +143,7 @@ config.
 
 `refs unused` prints a one-line caveat to **stderr** restating these blind spots
 at the point of use (stdout stays pure machine output). The remaining gaps —
-DAG-membership reachability, parsing template/network references, modelling more
-object kinds — are tracked in the issue tracker. See
+DAG membership from externally registered IPs (the live-path enhancement),
+parsing template/network references, modelling more object kinds — are tracked in
+the issue tracker. See
 [github.com/thomaschristory/panorama-super-cli/issues](https://github.com/thomaschristory/panorama-super-cli/issues).

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/docs/guides/references-and-audit.md

@@ -40,8 +40,10 @@ are its members if nothing else reaches them.
 !!! danger "`unused` means *unused by policy* — not *safe to delete*"
     psc only scans device-group objects and policy rulebases. Objects referenced
     from **templates / network / device config** (IKE gateways, GlobalProtect,
-    service routes, log servers…) or matched into a **dynamic address group**
-    are reported `unused` even though they are in use.
+    service routes, log servers…) — or matched into a **dynamic address group**
+    by an *externally registered* IP rather than a config tag — are reported
+    `unused` even though they are in use. (Config-tag DAG membership *is* now
+    resolved, so an address tagged into a rule-referenced DAG is kept.)
     Treat this list as **candidates**, verify `shared` objects in Panorama, and
     read **[Coverage and blind spots](coverage-and-limitations.md)** before
     deleting. (Unlike delete, `merge`/`rename` are protected — they block when a

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/psc/_version.py

@@ -4,4 +4,4 @@
 Keep this in sync with `[project].version` in `pyproject.toml`.
 """
 
-__version__ = "0.4.2"
+__version__ = "0.4.3"

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/psc/cli/refs_cmds.py

@@ -16,6 +16,14 @@ app = typer.Typer(no_args_is_help=True)
 _KINDS = ("address", "address-group", "service", "service-group", "tag")
 
 
+def _emit_graph_warnings(rt: Runtime, graph: ReferenceGraph) -> None:
+    """Surface non-fatal coverage gaps (e.g. an unparseable DAG filter whose
+    membership could not be resolved) on stderr, so stdout stays pure machine
+    output."""
+    for w in graph.warnings:
+        rt.stderr.print(f"[yellow]warning[/yellow]: {w}", soft_wrap=True, highlight=False)
+
+
 @app.command("used")
 def used(
     ctx: typer.Context,
@@ -43,6 +51,7 @@ def used(
 
     loc = location_from_name(location)
     refs = graph.where_used(kind, name, loc)
+    _emit_graph_warnings(rt, graph)
     rows = [
         {
             "referrer_kind": r.referrer_kind,
@@ -71,16 +80,20 @@ def unused(
     if rt.strict and not targets:
         raise PscError(f"no unused {kind}", ErrorType.NOT_FOUND)
     render(rt.stdout, rt.output, model=rows, rows=rows, table_title=f"unused {kind}")
+    _emit_graph_warnings(rt, graph)
     if targets:
         # `unused` only sees device-group objects + policy rulebases. Objects
-        # referenced from templates/network config, NAT-rule tags, or matched
-        # into a dynamic address group are NOT scanned and look unused here. Warn
-        # on stderr so stdout stays pure machine output (#56).
+        # referenced from templates/network config are NOT scanned and look
+        # unused here. DAG membership is now resolved from config tags, but an
+        # address pulled into a DAG by an *externally registered* IP (XML-API /
+        # User-ID / VM-info) is runtime state absent from the config and is still
+        # not covered. Warn on stderr so stdout stays pure machine output (#56).
         rt.stderr.print(
             "[yellow]caveat[/yellow]: candidates only — these are unreferenced by the "
             "scanned objects/policy rulebases. NOT scanned: templates & network/device "
-            "config, dynamic-address-group membership. Verify before deleting (esp. "
-            "shared). See docs: Coverage and blind spots.",
+            "config, and DAG membership from externally registered IPs (config-tag DAG "
+            "membership is scanned). Verify before deleting (esp. shared). See docs: "
+            "Coverage and blind spots.",
             soft_wrap=True,
             highlight=False,
         )
@@ -92,6 +105,7 @@ def dangling(ctx: typer.Context) -> None:
     rt: Runtime = ctx.obj
     graph = ReferenceGraph.build(rt.snapshot())
     refs = graph.dangling()
+    _emit_graph_warnings(rt, graph)
     rows = [
         {
             "referrer_kind": r.referrer_kind,

panorama_super_cli-0.4.3/psc/core/dagfilter.py

@@ -0,0 +1,198 @@
+"""Evaluate PAN-OS dynamic address-group (DAG) match filters.
+
+A DAG selects addresses by a boolean *tag* expression instead of a static
+member list, e.g. ``'prod' and ('web' or 'app')``. This module parses that
+expression once and answers the two questions the reference graph needs:
+
+- which tag names it references (:func:`filter_tags`) — for the unused-*tag*
+  check and decommission's DAG-selection blocker, and
+- whether a given set of tags satisfies it (:meth:`Filter.matches`) — for
+  resolving which addresses a DAG reaches, so an address used *only* via a
+  rule-referenced DAG is not reported unused (#60).
+
+Grammar (PAN-OS match-criteria, plus a defensive ``not``)::
+
+    expr     := or_expr
+    or_expr  := and_expr ('or' and_expr)*
+    and_expr := unary ('and' unary)*
+    unary    := 'not' unary | atom
+    atom     := TAG | '(' expr ')'
+    TAG      := "'" <chars> "'"
+
+PAN-OS keeps tags single-quoted and operators lowercase, and `and`/`or` bind in
+the usual way (`not` tightest, then `and`, then `or`). The GUI offers no
+negation, but a hand-authored or CLI config can carry one, so we accept and
+evaluate `not` rather than crash on a config the device accepted (#60 Q1).
+"""
+
+from __future__ import annotations
+
+import re
+from abc import ABC, abstractmethod
+from collections.abc import Set
+from dataclasses import dataclass
+
+# A quoted tag, or one of the structural tokens. Anything the tokenizer cannot
+# classify makes the whole filter unparseable (see `tokenize`).
+_TOKEN_RE = re.compile(r"\s*(?:'([^']*)'|(\(|\)|\band\b|\bor\b|\bnot\b))", re.IGNORECASE)
+
+
+class FilterParseError(ValueError):
+    """Raised when a DAG filter does not parse as a tag expression."""
+
+
+class _Node(ABC):
+    @abstractmethod
+    def evaluate(self, tags: Set[str]) -> bool: ...
+
+
+@dataclass(frozen=True)
+class _Tag(_Node):
+    name: str
+
+    def evaluate(self, tags: Set[str]) -> bool:
+        return self.name in tags
+
+
+@dataclass(frozen=True)
+class _Not(_Node):
+    child: _Node
+
+    def evaluate(self, tags: Set[str]) -> bool:
+        return not self.child.evaluate(tags)
+
+
+@dataclass(frozen=True)
+class _And(_Node):
+    left: _Node
+    right: _Node
+
+    def evaluate(self, tags: Set[str]) -> bool:
+        return self.left.evaluate(tags) and self.right.evaluate(tags)
+
+
+@dataclass(frozen=True)
+class _Or(_Node):
+    left: _Node
+    right: _Node
+
+    def evaluate(self, tags: Set[str]) -> bool:
+        return self.left.evaluate(tags) or self.right.evaluate(tags)
+
+
+@dataclass(frozen=True)
+class Filter:
+    """A parsed DAG match expression. Immutable; evaluate with :meth:`matches`."""
+
+    _root: _Node
+
+    def matches(self, tags: Set[str]) -> bool:
+        """True if `tags` (an address's static tag set) satisfies this filter."""
+        return self._root.evaluate(tags)
+
+
+@dataclass(frozen=True)
+class _Token:
+    kind: str  # "tag" | "and" | "or" | "not" | "(" | ")"
+    value: str  # the tag name for "tag", else the keyword/paren
+
+
+def _tokenize(expr: str) -> list[_Token]:
+    tokens: list[_Token] = []
+    pos = 0
+    for m in _TOKEN_RE.finditer(expr):
+        if m.start() != pos:
+            # A gap between matches means an unrecognized token (e.g. an
+            # unquoted word, or stray punctuation).
+            raise FilterParseError(f"unexpected token at {pos}: {expr[pos:]!r}")
+        pos = m.end()
+        tag, struct = m.group(1), m.group(2)
+        if tag is not None:
+            tokens.append(_Token("tag", tag))
+        else:
+            tokens.append(_Token(struct.lower(), struct.lower()))
+    if pos != len(expr) and expr[pos:].strip():
+        raise FilterParseError(f"unexpected trailing input: {expr[pos:]!r}")
+    return tokens
+
+
+class _Parser:
+    """Recursive-descent parser for the grammar in the module docstring."""
+
+    def __init__(self, tokens: list[_Token]) -> None:
+        self._tokens = tokens
+        self._i = 0
+
+    def _peek(self) -> _Token | None:
+        return self._tokens[self._i] if self._i < len(self._tokens) else None
+
+    def _advance(self) -> _Token:
+        tok = self._tokens[self._i]
+        self._i += 1
+        return tok
+
+    def parse(self) -> _Node:
+        node = self._or()
+        if self._peek() is not None:
+            raise FilterParseError(f"unexpected token: {self._peek()!r}")
+        return node
+
+    def _or(self) -> _Node:
+        node = self._and()
+        while (tok := self._peek()) is not None and tok.kind == "or":
+            self._advance()
+            node = _Or(node, self._and())
+        return node
+
+    def _and(self) -> _Node:
+        node = self._unary()
+        while (tok := self._peek()) is not None and tok.kind == "and":
+            self._advance()
+            node = _And(node, self._unary())
+        return node
+
+    def _unary(self) -> _Node:
+        tok = self._peek()
+        if tok is not None and tok.kind == "not":
+            self._advance()
+            return _Not(self._unary())
+        return self._atom()
+
+    def _atom(self) -> _Node:
+        tok = self._peek()
+        if tok is None:
+            raise FilterParseError("unexpected end of filter")
+        if tok.kind == "tag":
+            self._advance()
+            return _Tag(tok.value)
+        if tok.kind == "(":
+            self._advance()
+            node = self._or()
+            close = self._peek()
+            if close is None or close.kind != ")":
+                raise FilterParseError("unbalanced parenthesis")
+            self._advance()
+            return node
+        raise FilterParseError(f"expected a tag or '(', got {tok.kind!r}")
+
+
+def parse_filter(expr: str) -> Filter:
+    """Parse a DAG match expression into a :class:`Filter`.
+
+    Raises :class:`FilterParseError` on an empty or malformed expression.
+    """
+    tokens = _tokenize(expr)
+    if not tokens:
+        raise FilterParseError("empty filter")
+    return Filter(_Parser(tokens).parse())
+
+
+def filter_tags(expr: str) -> set[str]:
+    """The set of tag names a DAG filter references.
+
+    Best-effort and never raises: this is a name scan (used by the unused-tag
+    check and decommission blockers), so it tolerates a malformed expression by
+    returning whatever quoted tokens it can find. Exact-token, not substring —
+    a filter naming ``'web'`` does not reference ``'webserver'``.
+    """
+    return set(re.findall(r"'([^']*)'", expr))

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/psc/core/refs.py

@@ -22,11 +22,11 @@ shadowing is exactly why renames are dangerous, so it lives here, in one place
 
 from __future__ import annotations
 
-import re
 from collections import defaultdict
 from collections.abc import Sequence
 from dataclasses import dataclass, field
 
+from psc.core.dagfilter import FilterParseError, filter_tags, parse_filter
 from psc.core.models import Location, Rulebase, Snapshot, _Named
 from psc.core.rulebases import rule_container
 
@@ -45,13 +45,11 @@ PREDEFINED = frozenset(
 def dag_filter_tags(filter_str: str) -> set[str]:
     """The tag names a dynamic address-group filter references.
 
-    A DAG filter references tags as quoted tokens, e.g. "'prod' and 'web'".
-    Extract the quoted names and match exactly — a bare substring test would
-    count tag `web` as used by a `webserver` filter (or as selected by it). The
-    one place this parse lives, shared by unused-tag analysis and decommission's
-    DAG-selection blocker.
+    Thin alias for :func:`psc.core.dagfilter.filter_tags`, kept here as the
+    historical import site for the unused-tag analysis, decommission's
+    DAG-selection blocker, and relocate's dependency walk.
     """
-    return set(re.findall(r"'([^']+)'", filter_str))
+    return filter_tags(filter_str)
 
 
 @dataclass(frozen=True)
@@ -110,16 +108,22 @@ class _NamespaceIndex:
 class ReferenceGraph:
     snapshot: Snapshot
     references: list[Reference] = field(default_factory=list)
+    warnings: list[str] = field(default_factory=list)
+    """Non-fatal coverage gaps found while building (e.g. an unparseable DAG
+    filter whose membership could not be resolved). The CLI surfaces these on
+    stderr so the operator knows which findings are unverified."""
     _addr_idx: _NamespaceIndex = field(default_factory=_NamespaceIndex)
     _svc_idx: _NamespaceIndex = field(default_factory=_NamespaceIndex)
     _tag_idx: _NamespaceIndex = field(default_factory=_NamespaceIndex)
     _by_target: dict[Target, list[Reference]] = field(default_factory=lambda: defaultdict(list))
+    _dag_members: dict[Target, list[Target]] = field(default_factory=lambda: defaultdict(list))
 
     @classmethod
     def build(cls, snapshot: Snapshot) -> ReferenceGraph:
         g = cls(snapshot=snapshot)
         g._index()
         g._walk()
+        g._resolve_dags()
         return g
 
     # -- indexing --------------------------------------------------------
@@ -346,6 +350,63 @@ class ReferenceGraph:
                     rulebase=p.rulebase,
                 )
 
+    def _resolve_dags(self) -> None:
+        """Resolve each dynamic address-group's membership from static tags.
+
+        A DAG selects addresses by a tag expression, not a static member list, so
+        it is invisible to `_members_of` unless we evaluate the filter. Here we
+        match each DAG's filter against the *config* tags psc already parses and
+        record the matched addresses, so an address used only via a
+        rule-referenced DAG counts as reachable (and shows the DAG→address edge
+        in where-used) instead of looking unused (#60).
+
+        Scope: a DAG matches only addresses visible from its own location (the
+        device-group, its ancestors, and shared) — the same chain `_members_of`
+        uses for static members. An unparseable filter is recorded as a warning
+        and contributes no members (match-nothing): psc never guesses membership,
+        but the operator is told that DAG's coverage is unverified (#60 Q2).
+
+        Caveat: this resolves only *config-tagged* membership. Addresses brought
+        into a DAG by externally registered IPs (XML-API / User-ID / VM-info) are
+        runtime state absent from the config and are still not covered — that is
+        the residual gap a live membership query would close.
+        """
+        addrs_by_loc = self.snapshot.addresses_by_location()
+        for ag in self.snapshot.address_groups:
+            if not ag.is_dynamic or ag.dynamic_filter is None:
+                continue
+            dag = Target("address-group", ag.name, ag.location)
+            try:
+                flt = parse_filter(ag.dynamic_filter)
+            except FilterParseError as exc:
+                self.warnings.append(
+                    f"dynamic address-group '{ag.name}'@{ag.location.name}: "
+                    f"unparseable filter ({exc}); membership not resolved — "
+                    "addresses matched only by it may be reported unused"
+                )
+                continue
+            scope = {loc.name for loc in self.snapshot.ancestors(ag.location)}
+            for loc_name in scope:
+                for a in addrs_by_loc.get(loc_name, []):
+                    if not flt.matches(set(a.tags)):
+                        continue
+                    member = Target("address", a.name, a.location)
+                    self._dag_members[dag].append(member)
+                    # Surface the DAG as an indirect referrer of the matched
+                    # address (resolved straight to the concrete object, not by
+                    # name — a shadowed same-name address must not steal it).
+                    ref = Reference(
+                        target_name=a.name,
+                        namespace="address",
+                        referrer_kind="address-group",
+                        referrer_name=ag.name,
+                        referrer_location=ag.location,
+                        field="dynamic",
+                        resolved=member,
+                    )
+                    self.references.append(ref)
+                    self._by_target[member].append(ref)
+
     # -- queries ---------------------------------------------------------
 
     def resolve(self, namespace: str, name: str, ref_location: Location) -> Target | None:
@@ -382,10 +443,16 @@ class ReferenceGraph:
         return seeds
 
     def _members_of(self, target: Target) -> list[Target]:
-        """Resolved members of a group target (empty for leaf objects)."""
+        """Resolved members of a group target (empty for leaf objects).
+
+        For a *dynamic* address-group the members are the tag-matched addresses
+        computed in `_resolve_dags`; for a static one they are the resolved
+        named members.
+        """
         out: list[Target] = []
         chain = self.snapshot.ancestors(target.location)
         if target.kind == "address-group":
+            out.extend(self._dag_members.get(target, []))
             for ag in self.snapshot.address_groups:
                 if ag.name == target.name and ag.location == target.location:
                     for m in ag.static_members or []:

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "panorama-super-cli"
-version = "0.4.2"
+version = "0.4.3"
 description = "Agent-friendly CLI for Palo Alto Panorama object management: find, dedup/merge, rename, and audit address/service objects safely."
 readme = "README.md"
 requires-python = ">=3.12"

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/skills/panorama-super-cli/SKILL.md

@@ -122,7 +122,8 @@ only a non-security rule reaches. A `referrer_kind` like `qos-rule` or
 > **⚠️ `unused` = unused *by policy*, NOT *safe to delete*.** psc parses only
 > device-group objects + policy rulebases. It does **not** see: templates &
 > network/device config (IKE/IPSec, GlobalProtect, service routes, log servers,
-> static routes), dynamic-address-group membership, or
+> static routes), dynamic-address-group membership from **externally registered
+> IPs** (config-tag DAG membership *is* resolved), or
 > profiles/schedules/EDLs/regions/applications. Any object referenced only
 > there is falsely reported `unused`. **Never auto-delete on an `unused` result
 > — surface it as a candidate and have a human verify in Panorama**, especially

{panorama_super_cli-0.4.2 → panorama_super_cli-0.4.3}/tests/test_cli.py

@@ -44,6 +44,28 @@ def test_unused_prints_scope_caveat_to_stderr() -> None:
     assert "template" in low  # names the most dangerous blind spot
 
 
+def test_unparseable_dag_filter_warns_on_stderr(tmp_path: Path) -> None:
+    # An unparseable DAG filter must not crash the audit; psc warns on stderr
+    # (naming the DAG) that its membership is unverified, and stdout stays clean.
+    cfg = tmp_path / "bad-dag.xml"
+    cfg.write_text(
+        """<config><shared>
+          <address><entry name="h"><ip-netmask>10.0.0.1/32</ip-netmask>
+            <tag><member>prod</member></tag></entry></address>
+          <address-group><entry name="dag-bad">
+            <dynamic><filter>'prod' and</filter></dynamic></entry></address-group>
+          <pre-rulebase><security><rules><entry name="r">
+            <source><member>any</member></source>
+            <destination><member>dag-bad</member></destination></entry>
+          </rules></security></pre-rulebase>
+        </shared></config>"""
+    )
+    cp = run("-c", str(cfg), "-o", "json", "refs", "unused", "--kind", "address")
+    assert cp.returncode == 0
+    json.loads(cp.stdout)  # stdout stays pure machine output
+    assert "dag-bad" in cp.stderr
+
+
 def test_find_ip_json_contract() -> None:
     cp = run("-c", str(FIXTURE), "-o", "json", "find", "ip", "10.0.0.10")
     assert cp.returncode == 0

panorama_super_cli-0.4.3/tests/test_dagfilter.py

@@ -0,0 +1,93 @@
+"""Tests for the pure DAG tag-filter evaluator (#60)."""
+
+from __future__ import annotations
+
+import pytest
+
+from psc.core.dagfilter import FilterParseError, filter_tags, parse_filter
+
+
+def matches(expr: str, tags: set[str]) -> bool:
+    return parse_filter(expr).matches(tags)
+
+
+def test_single_tag() -> None:
+    assert matches("'prod'", {"prod"})
+    assert not matches("'prod'", {"web"})
+    assert not matches("'prod'", set())
+
+
+def test_and() -> None:
+    assert matches("'prod' and 'web'", {"prod", "web"})
+    assert not matches("'prod' and 'web'", {"prod"})
+    assert not matches("'prod' and 'web'", {"web"})
+
+
+def test_or() -> None:
+    assert matches("'prod' or 'web'", {"prod"})
+    assert matches("'prod' or 'web'", {"web"})
+    assert not matches("'prod' or 'web'", {"db"})
+
+
+def test_not() -> None:
+    # PAN-OS GUI offers no negation, but a hand-authored/CLI config can; the
+    # evaluator must accept it rather than crash (#60 Q1).
+    assert matches("not 'prod'", {"web"})
+    assert not matches("not 'prod'", {"prod"})
+
+
+def test_precedence_not_binds_tighter_than_and() -> None:
+    # not 'a' and 'b'  ==  (not 'a') and 'b'
+    assert matches("not 'a' and 'b'", {"b"})
+    assert not matches("not 'a' and 'b'", {"a", "b"})
+
+
+def test_precedence_and_binds_tighter_than_or() -> None:
+    # 'a' or 'b' and 'c'  ==  'a' or ('b' and 'c')
+    assert matches("'a' or 'b' and 'c'", {"a"})
+    assert matches("'a' or 'b' and 'c'", {"b", "c"})
+    assert not matches("'a' or 'b' and 'c'", {"b"})
+
+
+def test_parentheses_override_precedence() -> None:
+    # ('a' or 'b') and 'c'
+    assert matches("('a' or 'b') and 'c'", {"a", "c"})
+    assert not matches("('a' or 'b') and 'c'", {"a"})
+
+
+def test_tags_with_spaces_dots_and_dashes() -> None:
+    # PAN-OS tags routinely contain spaces, dots, dashes (e.g. cloud tags).
+    expr = "'aws-tag.env.prod' and 'instanceState.running'"
+    assert matches(expr, {"aws-tag.env.prod", "instanceState.running"})
+    assert not matches(expr, {"aws-tag.env.prod"})
+
+
+def test_filter_tags_extracts_referenced_names() -> None:
+    assert filter_tags("'prod' and ('web' or 'app')") == {"prod", "web", "app"}
+    # Exact-token, not substring: a filter naming 'web' does not reference 'webserver'.
+    assert filter_tags("'web'") == {"web"}
+
+
+def test_filter_tags_is_robust_to_malformed() -> None:
+    # filter_tags never raises — it is a best-effort name scan used for the
+    # unused-tag check and decommission blockers.
+    assert filter_tags("'prod' and") == {"prod"}
+    assert filter_tags("") == set()
+
+
+def test_malformed_filter_raises() -> None:
+    with pytest.raises(FilterParseError):
+        parse_filter("'prod' and")
+    with pytest.raises(FilterParseError):
+        parse_filter("'prod' 'web'")  # missing operator
+    with pytest.raises(FilterParseError):
+        parse_filter("('prod'")  # unbalanced
+    with pytest.raises(FilterParseError):
+        parse_filter("and 'prod'")  # leading operator
+
+
+def test_empty_filter_raises() -> None:
+    with pytest.raises(FilterParseError):
+        parse_filter("")
+    with pytest.raises(FilterParseError):
+        parse_filter("   ")