You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Date: 2026-04-07 APM Version: 0.8.11 (81082e2) Commands Inspected: 39 (all top-level commands + every subcommand via --help)
Summary
Severity
Count
High
2
Medium
4
Low
2
High Severity
Box-drawing characters in CLI output strings
Command: apm install (and any command that triggers collision/security errors)
Problem: Three output strings in src/apm_cli/commands/install.py use box-drawing characters └─ (U+2514 U+2500), which fall outside printable ASCII (U+0020–U+007E). These will raise a UnicodeEncodeError: 'charmap' codec can't encode character on Windows cp1252 terminals, which is precisely the failure mode the project's ASCII encoding rule was written to prevent.
Evidence:
# src/apm_cli/commands/install.py:944-945
logger.progress(f" └─ Inspect source: {install_path}")
logger.progress(" └─ Use --force to deploy anyway")
# src/apm_cli/commands/install.py:1289
_rich_error(f" └─ {fail_msg}")
Suggested Fix: Replace └─ with an ASCII equivalent. Per the project's STATUS_SYMBOLS convention, use [>] or indent with > for continuation lines:
logger.progress(f" [>] Inspect source: {install_path}")
logger.progress(" [>] Use --force to deploy anyway")
_rich_error(f" [>] {fail_msg}")
```
Problem: Multiple user-facing output strings in Python source files use the em dash character — (U+2014), which is outside printable ASCII and will fail on Windows cp1252 terminals.
Evidence:
# src/apm_cli/integration/base_integrator.py:97
f"Skipping {rel_path} — local file exists (not managed by APM). "
# src/apm_cli/bundle/packer.py:92
f"Cannot pack — apm.yml contains local path dependency: "
# src/apm_cli/bundle/packer.py:193
f"— run 'apm audit' to inspect before publishing"
# src/apm_cli/bundle/plugin_exporter.py:445
f"Cannot pack — apm.yml contains local path dependency: "
# src/apm_cli/bundle/plugin_exporter.py:566
f"source files — run 'apm audit' to inspect before publishing"
# src/apm_cli/bundle/plugin_exporter.py:653
f"{output_rel} — collision between '{existing_owner}' and "
# src/apm_cli/security/gate.py:149
f"{verdict.critical_count} critical finding(s) — "
# src/apm_cli/security/gate.py:157
"Blocked — critical hidden characters in source. "
# src/apm_cli/security/gate.py:172, 182
f"{verdict.warning_count} warning(s) — "
Suggested Fix: Replace every — in user-visible string literals with - (space-hyphen-space):
f"Skipping {rel_path} - local file exists (not managed by APM). "f"Cannot pack - apm.yml contains local path dependency: "f"{verdict.critical_count} critical finding(s) - "# etc.```
Problem: The CLI reference docs list the --target enum as [copilot|claude|cursor|codex|opencode|all] but the actual CLI accepts [copilot|claude|cursor|opencode|codex|vscode|agents|all]. The deprecated aliases vscode and agents are present in the CLI but absent from the docs.
Add a note: `vscode` and `agents` are deprecated aliases for `copilot`.
apm compile --target docs missing copilot and cursor
Command: apm compile
Problem: The docs list --target as [vscode|agents|claude|codex|opencode|all], but the actual CLI accepts [copilot|claude|cursor|opencode|codex|vscode|agents|all]. Crucially, copilot (the new canonical target) and cursor are completely absent from the documented enum.
-t, --target [copilot|claude|cursor|opencode|codex|vscode|agents|all]
Target platform: copilot (AGENTS.md), claude (CLAUDE.md),
cursor, opencode, or all.
'vscode' and 'agents' are deprecated aliases for 'copilot'.
Suggested Fix: Update docs to reflect the full enum and deprecation notice:
Also update the auto-detection table (lines 1108-1113) and target format table (lines 1125-1131) to use copilot as the primary target name (replacing vscode), and add a row for cursor. Add a deprecation note for vscode and agents.
Deprecated compile target aliases still primary in docs auto-detection table
Command: apm compile
Problem: The compile auto-detection table and examples in the docs still use vscode as the canonical target name, but the CLI has demoted vscode to a deprecated alias. The docs do not mention that vscode is deprecated or that copilot is the new canonical name.
Evidence:
CLI (apm compile --help): 'vscode' and 'agents' are deprecated aliases for 'copilot'. Auto-detects if not specified.
Suggested Fix: Update the auto-detection table and examples to use copilot as the primary target. Add a deprecation callout:
> **Note**: `--target vscode` and `--target agents` are deprecated aliases for `--target copilot`. They continue to work but will be removed in a future release.
apm install --verbose missing -v short form in docs
Command: apm install
Problem: The CLI reference docs list the verbose flag as --verbose without the -v short form, but the CLI implements both -v and --verbose.
--verbose - Show individual file paths and full error details...
```
CLI (apm install --help):
-v, --verbose Show detailed installation information
Suggested Fix: Update the docs to include the short form: -v, --verbose
Low Severity
apm runtime remove missing -y short form for --yes
Command: apm runtime remove
Problem: apm runtime remove uses --yes without a -y short form. Every other confirmation-skip flag in the CLI uses -y, --yes. This is a minor inconsistency that makes the flag pattern harder to remember.
apm runtime remove --help: --yes Confirm the action without prompting (no -y)
Suggested Fix: Add -y as a short alias for --yes in apm runtime remove, consistent with the rest of the CLI.
apm deps update docs show --verbose, -v (reversed notation)
Command: apm deps update
Problem: The docs list the verbose flag as --verbose, -v (long form first), but the CLI and every other command in the docs use the Click convention of short form first: -v, --verbose.
Error handling: All commands tested produce sensible error messages (not stack traces) for missing/invalid arguments.
apm mcp install / apm config list: These subcommands do not exist in the CLI — this is correct and expected. The task spec listed them to verify the CLI handles missing commands gracefully (it does: Error: No such command 'install').
CLI Consistency Report
Date: 2026-04-07
APM Version:
0.8.11 (81082e2)Commands Inspected: 39 (all top-level commands + every subcommand via
--help)Summary
High Severity
Box-drawing characters in CLI output strings
apm install(and any command that triggers collision/security errors)src/apm_cli/commands/install.pyuse box-drawing characters└─(U+2514 U+2500), which fall outside printable ASCII (U+0020–U+007E). These will raise aUnicodeEncodeError: 'charmap' codec can't encode characteron Windowscp1252terminals, which is precisely the failure mode the project's ASCII encoding rule was written to prevent.└─with an ASCII equivalent. Per the project'sSTATUS_SYMBOLSconvention, use[>]or indent with>for continuation lines:Em dashes in CLI output strings
apm install,apm pack,apm audit(and related)—(U+2014), which is outside printable ASCII and will fail on Windowscp1252terminals.—in user-visible string literals with-(space-hyphen-space):Medium Severity
apm install --targetdocs missing deprecated aliasesapm install--targetenum as[copilot|claude|cursor|codex|opencode|all]but the actual CLI accepts[copilot|claude|cursor|opencode|codex|vscode|agents|all]. The deprecated aliasesvscodeandagentsare present in the CLI but absent from the docs.docs/src/content/docs/reference/cli-commands.md:90):apm install --help):vscodeandagentsin the enum list, noting they are deprecated aliases forcopilot:`vscode` and `agents` are deprecated aliases for `copilot`.apm compile --targetdocs missingcopilotandcursorapm compile--targetas[vscode|agents|claude|codex|opencode|all], but the actual CLI accepts[copilot|claude|cursor|opencode|codex|vscode|agents|all]. Crucially,copilot(the new canonical target) andcursorare completely absent from the documented enum.docs/src/content/docs/reference/cli-commands.md:1092):apm compile --help):copilotas the primary target name (replacingvscode), and add a row forcursor. Add a deprecation note forvscodeandagents.Deprecated compile target aliases still primary in docs auto-detection table
apm compilevscodeas the canonical target name, but the CLI has demotedvscodeto a deprecated alias. The docs do not mention thatvscodeis deprecated or thatcopilotis the new canonical name.apm compile --help):'vscode' and 'agents' are deprecated aliases for 'copilot'. Auto-detects if not specified.docs/src/content/docs/reference/cli-commands.md:1110):apm compile --target vscode # AGENTS.md + .github/ onlycopilotas the primary target. Add a deprecation callout:apm install --verbosemissing-vshort form in docsapm install--verbosewithout the-vshort form, but the CLI implements both-vand--verbose.docs/src/content/docs/reference/cli-commands.md:95):apm install --help):-v, --verboseLow Severity
apm runtime removemissing-yshort form for--yesapm runtime removeapm runtime removeuses--yeswithout a-yshort form. Every other confirmation-skip flag in the CLI uses-y, --yes. This is a minor inconsistency that makes the flag pattern harder to remember.apm deps clean --help:-y, --yes Skip confirmation promptapm marketplace remove --help:-y, --yes Skip confirmationapm runtime remove --help:--yes Confirm the action without prompting(no-y)-yas a short alias for--yesinapm runtime remove, consistent with the rest of the CLI.apm deps updatedocs show--verbose, -v(reversed notation)apm deps update--verbose, -v(long form first), but the CLI and every other command in the docs use the Click convention of short form first:-v, --verbose.docs/src/content/docs/reference/cli-commands.md:754):-v, --verbose-v, --verbosefor consistency.Clean Areas
The following commands and areas passed all checks with no issues found:
apm init: Help text clear, flags consistent, no issues.apm uninstall: Help text clear,--dry-run,-v,-gall consistent.apm update: Simple and correct.apm run: Consistent withapm preview.apm preview: Mirrorsapm runinterface exactly.apm list: Minimal, correct.apm deps list/deps tree/deps info/deps clean: All consistent.apm mcp list/mcp search/mcp show: All consistent with documented behavior.apm config get/config set: Correct and consistent.apm marketplace add/browse/list/remove/update: All consistent;-y, --yespattern correct.apm runtime setup/runtime list/runtime status: Correct.apm pack/unpack/prune/audit/search: All consistent.apm mcp install/apm config list: These subcommands do not exist in the CLI — this is correct and expected. The task spec listed them to verify the CLI handles missing commands gracefully (it does:Error: No such command 'install').