feat: list controllers one per line, and name the viewer per setting

Applies the per-line rendering to the controller list too, so the two
reports list principals the same way throughout:

      Controllers:
        controller: 2vxsx-fae
      ...
      Log visibility: Allowed viewers
        log viewer: aaaaa-aa
      Status visibility: Allowed viewers
        status viewer: 2vxsx-fae

`format_principal_list` holds the shared shape — sorted, one entry per
line, nested two spaces past the label, with a note where the entries
would have gone when the list is empty. Controllers were not sorted
before; they are now, since the replica does not promise an order.

Each entry names what it grants rather than a bare `viewer:`, because a
report carries a line for both visibility settings and the entries under
them would otherwise not say which they belong to.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QooMLZ15EWRrknWtXfFZNp

Author: raymondk

CHANGELOG.md

@@ -10,7 +10,7 @@ air-gapped signing
 
 * feat: a canister can now declare `upgrade_args` alongside `init_args`, in its own manifest and as a per-canister environment override. It is passed when `icp deploy` upgrades the canister, where `init_args` is passed when it installs or reinstalls it. It takes exactly the forms `init_args` does (inline Candid string, or `{ value | path, format }`), and paths resolve against the canister's own directory the same way. A canister that declares no `upgrade_args` is upgraded with its `init_args`, as before, and `--args` / `--args-file` still override whichever applies.
 * feat: a new `status_visibility` canister setting controls who may read a canister's status (its running state, cycles, memory usage, and settings) through the management canister. It takes the same forms as `log_visibility` — `controllers` (the default), `public`, or `{ allowed_viewers: [...] }` — and can be set in a manifest's `settings:` block or with `icp canister settings update --status-visibility / --add-status-viewer / --remove-status-viewer / --set-status-viewer`. `icp canister status` and `icp canister settings show` now report it. See the [canister settings reference](docs/reference/canister-settings.md#status_visibility).
-  * `icp canister status` and `icp canister settings show` now list allowed viewers one per line under the setting (`viewer: <principal>`) rather than comma-separated on the label's line. This applies to `log_visibility` as well, so scripts matching that line need updating.
+  * `icp canister status` and `icp canister settings show` now list principals one per line under their label rather than comma-separated on the label's line: `log viewer:` / `status viewer: <principal>` for the allowed viewers of a visibility setting, `controller: <principal>` for a canister's controllers. This applies to `log_visibility` and to the controller list as well, so scripts matching those lines need updating. Both lists are sorted, which the controller list previously was not.
   * This raises the minimum replica version: reading a canister's status now requires one that reports `status_visibility`, and against an older replica `canister_status` fails to decode — which affects `icp deploy`, `icp canister status`, and `icp canister settings show`/`sync`, not just the new setting. Every mainnet subnet reports it. A `managed` network resolves the launcher to `latest` unless it pins `version:`, so only a pinned launcher older than `15.0.0-2026-08-13-03-55` is affected; raise the pin to that version or later.
 * feat: `script` build steps now receive `ICP_CLI_ENVIRONMENT`, the name of the environment the canisters are being built for, so a build can vary by environment the way a sync step already could.
 * feat: `icp completions <SHELL>` prints a shell completion script for `bash`, `zsh`, `fish`, `powershell`, or `elvish` to stdout. See the [installation guide](docs/guides/installation.md#shell-completions) for where to put it.

crates/icp-cli/src/commands/canister/mod.rs

@@ -17,31 +17,59 @@ pub(crate) mod status;
 pub(crate) mod stop;
 pub(crate) mod top_up;
 
+/// Lists principals one per line below a label, indented two spaces past
+/// `indent` — the indent of the label itself — so they nest the way the other
+/// lists in `canister status` and `canister settings show` do. `noun` names what
+/// each line holds, and stands in for the list when it is empty. Principals are
+/// sorted so repeated calls print the same order.
+fn format_principal_list(
+    principals: impl IntoIterator<Item = String>,
+    noun: &str,
+    indent: &str,
+) -> String {
+    let mut principals: Vec<String> = principals.into_iter().collect();
+    principals.sort();
+
+    if principals.is_empty() {
+        return format!("\n{indent}  {noun} list is empty");
+    }
+
+    principals
+        .iter()
+        .map(|principal| format!("\n{indent}  {noun}: {principal}"))
+        .collect()
+}
+
 /// Renders a visibility setting for `canister status` and `canister settings show`.
 ///
-/// The policy goes on the label's own line; allowed viewers are listed one per
-/// line below it, indented two spaces past `indent` — the indent of the label
-/// itself — so they nest the way the other lists in those reports do. Viewers
-/// are sorted so repeated calls print the same order.
-pub(crate) fn format_visibility(visibility: &Visibility, indent: &str) -> String {
+/// The policy goes on the label's own line, with any allowed viewers listed
+/// below it. `viewer` names what the setting grants — "log viewer", "status
+/// viewer" — since a report carries one line per setting and the entries would
+/// otherwise not say which they belong to.
+pub(crate) fn format_visibility(visibility: &Visibility, viewer: &str, indent: &str) -> String {
     match visibility {
         Visibility::Controllers => "Controllers".to_string(),
         Visibility::Public => "Public".to_string(),
-        Visibility::AllowedViewers(viewers) if viewers.is_empty() => {
-            "Allowed viewers list is empty".to_string()
-        }
-        Visibility::AllowedViewers(viewers) => {
-            let mut viewers: Vec<String> = viewers.iter().map(|p| p.to_string()).collect();
-            viewers.sort();
-            let mut out = "Allowed viewers".to_string();
-            for viewer in viewers {
-                out.push_str(&format!("\n{indent}  viewer: {viewer}"));
-            }
-            out
-        }
+        Visibility::AllowedViewers(viewers) => format!(
+            "Allowed viewers{}",
+            format_principal_list(viewers.iter().map(|p| p.to_string()), viewer, indent)
+        ),
     }
 }
 
+/// Renders a canister's controllers for the same two reports. Unlike a
+/// visibility setting, the list stands alone rather than qualifying a policy, so
+/// the label is part of what this returns.
+pub(crate) fn format_controllers(
+    controllers: impl IntoIterator<Item = String>,
+    indent: &str,
+) -> String {
+    format!(
+        "{indent}Controllers:{}",
+        format_principal_list(controllers, "controller", indent)
+    )
+}
+
 /// Perform canister operations against a network
 #[derive(Debug, Subcommand)]
 #[allow(clippy::large_enum_variant)]
@@ -87,31 +115,64 @@ mod tests {
 
         // `settings show`, where the label is not indented.
         assert_eq!(
-            format!("Status visibility: {}", format_visibility(&viewers, "")),
+            format!(
+                "Status visibility: {}",
+                format_visibility(&viewers, "status viewer", "")
+            ),
             "Status visibility: Allowed viewers\n  \
-             viewer: aaaaa-aa\n  \
-             viewer: ryjl3-tyaaa-aaaaa-aaaba-cai"
+             status viewer: aaaaa-aa\n  \
+             status viewer: ryjl3-tyaaa-aaaaa-aaaba-cai"
         );
         // `canister status`, where it sits two spaces in.
         assert_eq!(
-            format!("  Status visibility: {}", format_visibility(&viewers, "  ")),
-            "  Status visibility: Allowed viewers\n    \
-             viewer: aaaaa-aa\n    \
-             viewer: ryjl3-tyaaa-aaaaa-aaaba-cai"
+            format!(
+                "  Log visibility: {}",
+                format_visibility(&viewers, "log viewer", "  ")
+            ),
+            "  Log visibility: Allowed viewers\n    \
+             log viewer: aaaaa-aa\n    \
+             log viewer: ryjl3-tyaaa-aaaaa-aaaba-cai"
         );
     }
 
-    /// The other policies stay on the label's line.
+    /// The fixed policies stay on the label's line, and an empty list says so
+    /// where its entries would have gone.
     #[test]
     fn fixed_policies_are_rendered_inline() {
         assert_eq!(
-            format_visibility(&Visibility::Controllers, "  "),
+            format_visibility(&Visibility::Controllers, "log viewer", "  "),
             "Controllers"
         );
-        assert_eq!(format_visibility(&Visibility::Public, "  "), "Public");
         assert_eq!(
-            format_visibility(&Visibility::AllowedViewers(vec![]), "  "),
-            "Allowed viewers list is empty"
+            format_visibility(&Visibility::Public, "log viewer", "  "),
+            "Public"
+        );
+        assert_eq!(
+            format_visibility(&Visibility::AllowedViewers(vec![]), "log viewer", "  "),
+            "Allowed viewers\n    log viewer list is empty"
+        );
+    }
+
+    /// Controllers are listed the same way, but carry their own label.
+    #[test]
+    fn controllers_are_listed_one_per_line() {
+        let controllers = ["ryjl3-tyaaa-aaaaa-aaaba-cai", "aaaaa-aa"].map(str::to_string);
+
+        assert_eq!(
+            format_controllers(controllers.clone(), "  "),
+            "  Controllers:\n    \
+             controller: aaaaa-aa\n    \
+             controller: ryjl3-tyaaa-aaaaa-aaaba-cai"
+        );
+        assert_eq!(
+            format_controllers(controllers, ""),
+            "Controllers:\n  \
+             controller: aaaaa-aa\n  \
+             controller: ryjl3-tyaaa-aaaaa-aaaba-cai"
+        );
+        assert_eq!(
+            format_controllers([], "  "),
+            "  Controllers:\n    controller list is empty"
         );
     }
 }

crates/icp-cli/src/commands/canister/settings/show.rs

@@ -6,7 +6,10 @@ use std::fmt::Write;
 
 use icp::operations::proxy_management;
 
-use crate::commands::{args::CanisterCommandArgs, canister::format_visibility};
+use crate::commands::{
+    args::CanisterCommandArgs,
+    canister::{format_controllers, format_visibility},
+};
 
 /// Show the settings of a canister.
 ///
@@ -67,12 +70,8 @@ fn build_output(s: &DefiniteCanisterSettings) -> String {
     let mut buf = String::new();
     writeln!(
         &mut buf,
-        "Controllers: {}",
-        s.controllers
-            .iter()
-            .map(|p| p.to_string())
-            .collect::<Vec<_>>()
-            .join(", ")
+        "{}",
+        format_controllers(s.controllers.iter().map(|p| p.to_string()), "")
     )
     .unwrap();
     writeln!(&mut buf, "Compute allocation: {}", s.compute_allocation).unwrap();
@@ -96,13 +95,13 @@ fn build_output(s: &DefiniteCanisterSettings) -> String {
     writeln!(
         &mut buf,
         "Log visibility: {}",
-        format_visibility(&s.log_visibility.clone().into(), "")
+        format_visibility(&s.log_visibility.clone().into(), "log viewer", "")
     )
     .unwrap();
     writeln!(
         &mut buf,
         "Status visibility: {}",
-        format_visibility(&s.status_visibility.clone().into(), "")
+        format_visibility(&s.status_visibility.clone().into(), "status viewer", "")
     )
     .unwrap();
 

crates/icp-cli/src/commands/canister/status.rs

@@ -15,7 +15,10 @@ use tracing::debug;
 use icp::operations::{proxy::UpdateOrProxyError, proxy_management};
 
 use crate::{
-    commands::{args, canister::format_visibility},
+    commands::{
+        args,
+        canister::{format_controllers, format_visibility},
+    },
     options,
 };
 
@@ -471,7 +474,11 @@ fn build_public_output(result: &PublicCanisterStatusResult) -> Result<String, an
     }
     writeln!(&mut buf, "Canister Status Report:")?;
 
-    writeln!(&mut buf, "  Controllers: {}", result.controllers.join(", "))?;
+    writeln!(
+        &mut buf,
+        "{}",
+        format_controllers(result.controllers.iter().cloned(), "  ")
+    )?;
     writeln!(
         &mut buf,
         "  Module hash: {}",
@@ -494,8 +501,8 @@ fn build_output(result: &SerializableCanisterStatusResult) -> Result<String, any
     let settings = &result.settings;
     writeln!(
         &mut buf,
-        "  Controllers: {}",
-        settings.controllers.join(", ")
+        "{}",
+        format_controllers(settings.controllers.iter().cloned(), "  ")
     )?;
     writeln!(
         &mut buf,
@@ -537,12 +544,12 @@ fn build_output(result: &SerializableCanisterStatusResult) -> Result<String, any
     writeln!(
         &mut buf,
         "  Log visibility: {}",
-        format_visibility(&settings.log_visibility.0, "  ")
+        format_visibility(&settings.log_visibility.0, "log viewer", "  ")
     )?;
     writeln!(
         &mut buf,
         "  Status visibility: {}",
-        format_visibility(&settings.status_visibility.0, "  ")
+        format_visibility(&settings.status_visibility.0, "status viewer", "  ")
     )?;
 
     // Display environment variables configured for this canister

crates/icp-cli/tests/canister_create_tests.rs

@@ -973,7 +973,7 @@ async fn canister_create_with_unresolved_canister_controller_warns_and_syncs() {
         ])
         .assert()
         .success()
-        .stdout(contains("Controllers: 2vxsx-fae"));
+        .stdout(contains("controller: 2vxsx-fae"));
 
     // Creating "b" triggers sync_controller_dependents, which updates "a"'s controller list.
     ctx.icp()

crates/icp-cli/tests/canister_info_tests.rs

@@ -61,7 +61,7 @@ async fn canister_status() {
         ])
         .assert()
         .success()
-        .stdout(contains("Controllers: 2vxsx-fae").and(contains(
+        .stdout(contains("controller: 2vxsx-fae").and(contains(
             "Module hash: 0x17a05e36278cd04c7ae6d3d3226c136267b9df7525a0657521405e22ec96be7a",
         )));
 }

crates/icp-cli/tests/canister_settings_tests.rs

@@ -75,7 +75,7 @@ async fn canister_settings_update_controllers() {
         ])
         .assert()
         .success()
-        .stdout(contains("Controllers: 2vxsx-fae").and(contains(principal_alice.as_str()).not()));
+        .stdout(contains("controller: 2vxsx-fae").and(contains(principal_alice.as_str()).not()));
 
     // Add controller
     ctx.icp()
@@ -106,7 +106,7 @@ async fn canister_settings_update_controllers() {
         ])
         .assert()
         .success()
-        .stdout(contains("Controllers: 2vxsx-fae").and(contains(principal_alice.as_str())));
+        .stdout(contains("controller: 2vxsx-fae").and(contains(principal_alice.as_str())));
 
     // Add and remove controller.
     ctx.icp()
@@ -140,7 +140,7 @@ async fn canister_settings_update_controllers() {
         .assert()
         .success()
         .stdout(
-            contains("Controllers: 2vxsx-fae")
+            contains("controller: 2vxsx-fae")
                 .and(contains(principal_alice.as_str()).not())
                 .and(contains(principal_bob.as_str())),
         );
@@ -174,7 +174,7 @@ async fn canister_settings_update_controllers() {
         ])
         .assert()
         .success()
-        .stdout(contains("Controllers: 2vxsx-fae").and(contains(principal_bob.as_str()).not()));
+        .stdout(contains("controller: 2vxsx-fae").and(contains(principal_bob.as_str()).not()));
 
     // Add multiple controllers
     ctx.icp()
@@ -208,7 +208,7 @@ async fn canister_settings_update_controllers() {
         .assert()
         .success()
         .stdout(
-            contains("Controllers: 2vxsx-fae")
+            contains("controller: 2vxsx-fae")
                 .and(contains(principal_alice.as_str()))
                 .and(contains(principal_bob.as_str())),
         );
@@ -245,7 +245,7 @@ async fn canister_settings_update_controllers() {
         .assert()
         .success()
         .stdout(
-            contains("Controllers: 2vxsx-fae")
+            contains("controller: 2vxsx-fae")
                 .and(contains(principal_alice.as_str()).not())
                 .and(contains(principal_bob.as_str()).not()),
         );
@@ -572,7 +572,9 @@ async fn canister_settings_update_log_visibility() {
         ])
         .assert()
         .success()
-        .stdout(contains("Log visibility: Allowed viewers list is empty"));
+        .stdout(contains(
+            "Log visibility: Allowed viewers\n  log viewer list is empty",
+        ));
 
     // Add multiple log viewers.
     ctx.icp()
@@ -642,7 +644,9 @@ async fn canister_settings_update_log_visibility() {
         ])
         .assert()
         .success()
-        .stdout(contains("Log visibility: Allowed viewers list is empty"));
+        .stdout(contains(
+            "Log visibility: Allowed viewers\n  log viewer list is empty",
+        ));
 
     // Set multiple log viewers.
     ctx.icp()
@@ -954,7 +958,7 @@ async fn canister_settings_update_environment_variables() {
         .assert()
         .success()
         .stdout(
-            contains("Controllers: 2vxsx-fae")
+            contains("controller: 2vxsx-fae")
                 .and(contains("Environment variables:"))
                 .and(contains("PUBLIC_CANISTER_ID:my-canister")),
         );
@@ -1397,7 +1401,7 @@ async fn canister_settings_sync_log_visibility() {
     confirm_log_visibility(
         &ctx,
         &project_dir,
-        "Allowed viewers\n  viewer: 2vxsx-fae\n  viewer: aaaaa-aa",
+        "Allowed viewers\n  log viewer: 2vxsx-fae\n  log viewer: aaaaa-aa",
     );
 
     // status_visibility takes the same manifest forms, and a single sync has to
@@ -1438,7 +1442,7 @@ async fn canister_settings_sync_log_visibility() {
         .assert()
         .success()
         .stdout(contains(
-            "Status visibility: Allowed viewers\n  viewer: 2vxsx-fae\n  viewer: aaaaa-aa",
+            "Status visibility: Allowed viewers\n  status viewer: 2vxsx-fae\n  status viewer: aaaaa-aa",
         ));
 }
 

crates/icp-cli/tests/canister_start_tests.rs

@@ -80,7 +80,7 @@ async fn canister_start() {
         .stdout(
             starts_with("Canister Id:")
                 .and(contains("Status: Stopped"))
-                .and(contains("Controllers: 2vxsx-fae")),
+                .and(contains("controller: 2vxsx-fae")),
         );
 
     // Start canister
@@ -111,7 +111,7 @@ async fn canister_start() {
         .stdout(
             starts_with("Canister Id:")
                 .and(contains("Status: Running"))
-                .and(contains("Controllers: 2vxsx-fae")),
+                .and(contains("controller: 2vxsx-fae")),
         );
 }