feat: list allowed viewers one per line

`Allowed viewers: <a>, <b>` put two 63-character principals on the label's
line, which wraps in any normal terminal. The policy now stays on the
label and each viewer gets its own line, nested two spaces past the label
the way the other lists in those reports are:

      Status visibility: Allowed viewers
        viewer: 7tjgl-udln4-...
        viewer: cgbip-rubo2-...

The label sits at a different indent in `canister status` than in
`canister settings show`, so `format_visibility` takes the label's indent
and nests relative to it. `log_visibility` is rendered by the same
function, so it changes with it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QooMLZ15EWRrknWtXfFZNp

Author: raymondk

CHANGELOG.md

@@ -10,6 +10,7 @@ air-gapped signing
 
 * feat: a canister can now declare `upgrade_args` alongside `init_args`, in its own manifest and as a per-canister environment override. It is passed when `icp deploy` upgrades the canister, where `init_args` is passed when it installs or reinstalls it. It takes exactly the forms `init_args` does (inline Candid string, or `{ value | path, format }`), and paths resolve against the canister's own directory the same way. A canister that declares no `upgrade_args` is upgraded with its `init_args`, as before, and `--args` / `--args-file` still override whichever applies.
 * feat: a new `status_visibility` canister setting controls who may read a canister's status (its running state, cycles, memory usage, and settings) through the management canister. It takes the same forms as `log_visibility` — `controllers` (the default), `public`, or `{ allowed_viewers: [...] }` — and can be set in a manifest's `settings:` block or with `icp canister settings update --status-visibility / --add-status-viewer / --remove-status-viewer / --set-status-viewer`. `icp canister status` and `icp canister settings show` now report it. See the [canister settings reference](docs/reference/canister-settings.md#status_visibility).
+  * `icp canister status` and `icp canister settings show` now list allowed viewers one per line under the setting (`viewer: <principal>`) rather than comma-separated on the label's line. This applies to `log_visibility` as well, so scripts matching that line need updating.
   * This raises the minimum replica version: reading a canister's status now requires one that reports `status_visibility`, and against an older replica `canister_status` fails to decode — which affects `icp deploy`, `icp canister status`, and `icp canister settings show`/`sync`, not just the new setting. Every mainnet subnet reports it. A `managed` network resolves the launcher to `latest` unless it pins `version:`, so only a pinned launcher older than `15.0.0-2026-08-13-03-55` is affected; raise the pin to that version or later.
 * feat: `script` build steps now receive `ICP_CLI_ENVIRONMENT`, the name of the environment the canisters are being built for, so a build can vary by environment the way a sync step already could.
 * feat: `icp completions <SHELL>` prints a shell completion script for `bash`, `zsh`, `fish`, `powershell`, or `elvish` to stdout. See the [installation guide](docs/guides/installation.md#shell-completions) for where to put it.

crates/icp-cli/src/commands/canister/mod.rs

@@ -18,8 +18,12 @@ pub(crate) mod stop;
 pub(crate) mod top_up;
 
 /// Renders a visibility setting for `canister status` and `canister settings show`.
-/// Viewers are sorted so repeated calls print the same order.
-pub(crate) fn format_visibility(visibility: &Visibility) -> String {
+///
+/// The policy goes on the label's own line; allowed viewers are listed one per
+/// line below it, indented two spaces past `indent` — the indent of the label
+/// itself — so they nest the way the other lists in those reports do. Viewers
+/// are sorted so repeated calls print the same order.
+pub(crate) fn format_visibility(visibility: &Visibility, indent: &str) -> String {
     match visibility {
         Visibility::Controllers => "Controllers".to_string(),
         Visibility::Public => "Public".to_string(),
@@ -29,7 +33,11 @@ pub(crate) fn format_visibility(visibility: &Visibility) -> String {
         Visibility::AllowedViewers(viewers) => {
             let mut viewers: Vec<String> = viewers.iter().map(|p| p.to_string()).collect();
             viewers.sort();
-            format!("Allowed viewers: {}", viewers.join(", "))
+            let mut out = "Allowed viewers".to_string();
+            for viewer in viewers {
+                out.push_str(&format!("\n{indent}  viewer: {viewer}"));
+            }
+            out
         }
     }
 }
@@ -56,3 +64,54 @@ pub(crate) enum Command {
     Stop(stop::StopArgs),
     TopUp(top_up::TopUpArgs),
 }
+
+#[cfg(test)]
+mod tests {
+    use candid::Principal;
+
+    use super::*;
+
+    fn principal(text: &str) -> Principal {
+        Principal::from_text(text).unwrap()
+    }
+
+    /// Allowed viewers are listed one per line, sorted, and nested two spaces
+    /// past the label — which sits at a different indent in `canister status`
+    /// than in `canister settings show`.
+    #[test]
+    fn allowed_viewers_are_listed_one_per_line() {
+        let viewers = Visibility::AllowedViewers(vec![
+            principal("ryjl3-tyaaa-aaaaa-aaaba-cai"),
+            principal("aaaaa-aa"),
+        ]);
+
+        // `settings show`, where the label is not indented.
+        assert_eq!(
+            format!("Status visibility: {}", format_visibility(&viewers, "")),
+            "Status visibility: Allowed viewers\n  \
+             viewer: aaaaa-aa\n  \
+             viewer: ryjl3-tyaaa-aaaaa-aaaba-cai"
+        );
+        // `canister status`, where it sits two spaces in.
+        assert_eq!(
+            format!("  Status visibility: {}", format_visibility(&viewers, "  ")),
+            "  Status visibility: Allowed viewers\n    \
+             viewer: aaaaa-aa\n    \
+             viewer: ryjl3-tyaaa-aaaaa-aaaba-cai"
+        );
+    }
+
+    /// The other policies stay on the label's line.
+    #[test]
+    fn fixed_policies_are_rendered_inline() {
+        assert_eq!(
+            format_visibility(&Visibility::Controllers, "  "),
+            "Controllers"
+        );
+        assert_eq!(format_visibility(&Visibility::Public, "  "), "Public");
+        assert_eq!(
+            format_visibility(&Visibility::AllowedViewers(vec![]), "  "),
+            "Allowed viewers list is empty"
+        );
+    }
+}

crates/icp-cli/src/commands/canister/settings/show.rs

@@ -96,13 +96,13 @@ fn build_output(s: &DefiniteCanisterSettings) -> String {
     writeln!(
         &mut buf,
         "Log visibility: {}",
-        format_visibility(&s.log_visibility.clone().into())
+        format_visibility(&s.log_visibility.clone().into(), "")
     )
     .unwrap();
     writeln!(
         &mut buf,
         "Status visibility: {}",
-        format_visibility(&s.status_visibility.clone().into())
+        format_visibility(&s.status_visibility.clone().into(), "")
     )
     .unwrap();
 

crates/icp-cli/src/commands/canister/status.rs

@@ -537,12 +537,12 @@ fn build_output(result: &SerializableCanisterStatusResult) -> Result<String, any
     writeln!(
         &mut buf,
         "  Log visibility: {}",
-        format_visibility(&settings.log_visibility.0)
+        format_visibility(&settings.log_visibility.0, "  ")
     )?;
     writeln!(
         &mut buf,
         "  Status visibility: {}",
-        format_visibility(&settings.status_visibility.0)
+        format_visibility(&settings.status_visibility.0, "  ")
     )?;
 
     // Display environment variables configured for this canister

crates/icp-cli/tests/canister_settings_tests.rs

@@ -503,7 +503,7 @@ async fn canister_settings_update_log_visibility() {
         .assert()
         .success()
         .stdout(
-            contains("Log visibility: Allowed viewers:").and(contains(principal_alice.as_str())),
+            contains("Log visibility: Allowed viewers").and(contains(principal_alice.as_str())),
         );
 
     // Add and remove log viewer.
@@ -538,7 +538,7 @@ async fn canister_settings_update_log_visibility() {
         .assert()
         .success()
         .stdout(
-            contains("Log visibility: Allowed viewers:")
+            contains("Log visibility: Allowed viewers")
                 .and(contains(principal_alice.as_str()).not())
                 .and(contains(principal_bob.as_str())),
         );
@@ -606,7 +606,7 @@ async fn canister_settings_update_log_visibility() {
         .assert()
         .success()
         .stdout(
-            contains("Log visibility: Allowed viewers:")
+            contains("Log visibility: Allowed viewers")
                 .and(contains(principal_alice.as_str()))
                 .and(contains(principal_bob.as_str())),
         );
@@ -676,7 +676,7 @@ async fn canister_settings_update_log_visibility() {
         .assert()
         .success()
         .stdout(
-            contains("Log visibility: Allowed viewers:")
+            contains("Log visibility: Allowed viewers")
                 .and(contains(principal_alice.as_str()))
                 .and(contains(principal_bob.as_str())),
         );
@@ -1394,7 +1394,11 @@ async fn canister_settings_sync_log_visibility() {
     write_string(&project_dir.join("icp.yaml"), &pm_with_allowed_viewers)
         .expect("failed to write project manifest");
     sync(&ctx, &project_dir);
-    confirm_log_visibility(&ctx, &project_dir, "Allowed viewers: 2vxsx-fae, aaaaa-aa");
+    confirm_log_visibility(
+        &ctx,
+        &project_dir,
+        "Allowed viewers\n  viewer: 2vxsx-fae\n  viewer: aaaaa-aa",
+    );
 
     // status_visibility takes the same manifest forms, and a single sync has to
     // apply both settings: either change alone would satisfy the "settings
@@ -1434,7 +1438,7 @@ async fn canister_settings_sync_log_visibility() {
         .assert()
         .success()
         .stdout(contains(
-            "Status visibility: Allowed viewers: 2vxsx-fae, aaaaa-aa",
+            "Status visibility: Allowed viewers\n  viewer: 2vxsx-fae\n  viewer: aaaaa-aa",
         ));
 }
 
@@ -1547,7 +1551,7 @@ async fn canister_settings_update_status_visibility() {
         &["--add-status-viewer", principal_alice.as_str()],
     );
     status_as_alice(&ctx, &project_dir)
-        .stdout(contains("Status: Running").and(contains("Status visibility: Allowed viewers:")));
+        .stdout(contains("Status: Running").and(contains("Status visibility: Allowed viewers")));
 
     // Add and remove in one call, again relative to the current list. Alice
     // loses access, so the fallback comes back.
@@ -1562,7 +1566,7 @@ async fn canister_settings_update_status_visibility() {
         ],
     );
     confirm(&ctx, &project_dir).stdout(
-        contains("Status visibility: Allowed viewers:")
+        contains("Status visibility: Allowed viewers")
             .and(contains(principal_bob.as_str()))
             .and(contains(principal_alice.as_str()).not()),
     );
@@ -1575,7 +1579,7 @@ async fn canister_settings_update_status_visibility() {
         &["--set-status-viewer", principal_alice.as_str()],
     );
     confirm(&ctx, &project_dir).stdout(
-        contains("Status visibility: Allowed viewers:")
+        contains("Status visibility: Allowed viewers")
             .and(contains(principal_alice.as_str()))
             .and(contains(principal_bob.as_str()).not()),
     );
@@ -1600,7 +1604,7 @@ async fn canister_settings_update_status_visibility() {
     update(&ctx, &project_dir, &["--freezing-threshold", "7d"]);
     confirm(&ctx, &project_dir).stdout(
         contains("Status visibility: Controllers")
-            .and(contains("Log visibility: Allowed viewers:"))
+            .and(contains("Log visibility: Allowed viewers"))
             .and(contains(principal_alice.as_str())),
     );
 }