v1.8.6: unknown field warning, tighter warning messages, appliesTo pattern

- Warn when -f includes a field not returned by the API; correct
  singular/plural (unknown field / unknown fields)
- Suppress follow-on warnings when all fields are invalid and output()
  already reported an error
- Reword size limit warning to "results truncated by size limit"
- Reword unknown total warning to "total unknown, results may be truncated"
- Add appliesTo filter and active/inactive check patterns to elm-notes.yaml

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: rdmarsh

CHANGELOG.md

@@ -6,6 +6,15 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.8.6] - 2026-05-21
+
+### Added
+- Unknown field warning: when `-f` includes a field not returned by the API, a
+  warning is printed listing the missing field(s) with correct singular/plural
+  (`Warning: unknown field: foo` / `Warning: unknown fields: foo, bar`).
+- Both follow-on warnings suppressed when all requested fields are invalid and
+  `output()` has already reported `Error: no valid fields selected`.
+
 ### Changed
 - `ai.md`: added principle #10 — prefer simple, readable code over clever solutions; added matching bullet to "Working with code" behaviour rules.
 - `ai.md`: verification section now explicitly names hallucinated library APIs as the failure mode that "run the code" is defending against.
@@ -14,6 +23,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - `ai.md`: principle 6 (isolated sessions) now names the mechanism — context window degradation — not just the symptoms.
 - `ai.md`: "Working with code" now includes a note on copyright/IP — avoid reproducing verbatim patterns from known licensed sources.
 - `ai.md`: "Scope of authorisation" now instructs the AI to explain suggested shell commands before the user runs them and flag anything destructive.
+- Size limit warning reworded to `Warning: results truncated by size limit`.
+- Unknown total warning reworded to `Warning: total unknown, results may be truncated`.
+- `elm-notes.yaml`: added `appliesTo` filter and active/inactive check patterns to
+  `DatasourceList`; noted that `/* */` comments are common disable mechanism and
+  Python is more reliable than jq for stripping them.
 
 ## [1.8.5] - 2026-05-18
 

SECURITY.md

@@ -7,9 +7,9 @@ hit a bug or vulnerability, pull the latest source and recompile.
 
 | Version | Supported          |
 | ------- | ------------------ |
+| 1.8.6   | :white_check_mark: |
 | 1.8.5   | :white_check_mark: |
-| 1.8.4   | :white_check_mark: |
-| < 1.8.4 | :x:                |
+| < 1.8.5 | :x:                |
 
 ## Security History
 

_jnja/engine.py.j2

@@ -206,7 +206,7 @@ def engine(elm, **kwargs):
         logging.debug('total is a flag, showing total instead')
         if obj['total'] < 0:
             # LM returns -(n_returned + 1) when it cannot compute an exact total
-            click.secho('Warning: total records unknown, there is data you are not seeing.',
+            click.secho('Warning: total unknown, results may be truncated',
                         fg='yellow', err=True)
             click.echo('>{}'.format(abs(obj['total']) - 1))
         else:
@@ -217,11 +217,22 @@ def engine(elm, **kwargs):
     else:
         output(obj['items'], elm.command, elm.filename, elm.format, elm.noheader, elm.index, elm.head, elm.foot)
 
-        #give a warning if there are more records not shown
-        if 'size' in flags and (obj['total'] > flags['size'] or obj['total'] < 0):
-            click.secho('Warning: size limit is less than total records,'
-                        ' there is data you are not seeing.',
-                        fg='yellow', err=True)
+        #if output() found no valid fields it already reported an error — suppress follow-on warnings
+        returned = set(obj['items'][0].keys()) if obj['items'] else set()
+
+        if returned:
+            #give a warning if there are more records not shown
+            if 'size' in flags and (obj['total'] > flags['size'] or obj['total'] < 0):
+                click.secho('Warning: results truncated by size limit',
+                            fg='yellow', err=True)
+
+            #warn if any requested fields were not returned by the API
+            if 'fields' in flags:
+                missing = {f.strip() for f in flags['fields'].split(',')} - returned
+                if missing:
+                    label = 'field' if len(missing) == 1 else 'fields'
+                    click.secho('Warning: unknown {}: {}'.format(label, ', '.join(sorted(missing))),
+                                fg='yellow', err=True)
 
 def output(items, command, filename='-', format='json', noheader=False, index=False, head='', foot=''):
     import pandas as pd

_version.py

@@ -1,2 +1,2 @@
 # _version.py
-__version__ = '1.8.5'
+__version__ = '1.8.6'

elm-notes.yaml

@@ -312,6 +312,33 @@ DatasourceList:
   filter_patterns:
     - "name:NTPv4  # exact name match — use : not ~ when you know the exact name;
       avoids retrieving all 1000+ datasources"
+  patterns:
+    appliesTo_filter: |
+      # Find all datasources referencing a property in their AppliesTo expression
+      elm DatasourceList -F 'appliesTo~purestorage.apitoken.pass' -s0 -f name,displayName,appliesTo
+    appliesTo_active_check: |
+      # Distinguish active from disabled AppliesTo expressions.
+      #
+      # Two common disable patterns in LM:
+      #   1. /* purestorage.apitoken.pass */  — C-style comment wrapping
+      #   2. false() && purestorage.apitoken.pass — short-circuit AND
+      #
+      # jq can strip /* */ comments with gsub but cannot reliably detect all
+      # false() && (...) patterns. /* */ is widely used in this portal, so use
+      # Python for reliable active-vs-inactive checking:
+      elm DatasourceList -F 'appliesTo~purestorage.apitoken.pass' -s0 -f name,displayName,appliesTo | \
+        python3 -c "
+      import sys, re, json
+      data = json.load(sys.stdin)
+      for ds in data['DatasourceList']:
+          expr = ds.get('appliesTo', '')
+          stripped = re.sub(r'/\*.*?\*/', '', expr, flags=re.DOTALL)
+          if re.search(r'purestorage\.apitoken\.pass', stripped):
+              print(f\"{ds['name']}\t{ds['displayName']}\t{expr}\")
+      " | column -t -s$'\t'
+      #
+      # Replace 'purestorage.apitoken.pass' with any property or expression fragment.
+      # Note: false() && (...) still slips through — eyeball those rows.
 
 AssociatedDeviceListByDataSourceId:
   path: /setting/datasources/{id}/devices