feat: new canister setting status_visibility

.gitignore

@@ -22,3 +22,6 @@ docs-site/.astro/
 docs-site/dist/
 docs-site/dist-test/
 docs-site/node_modules/
+
+# Python bytecode from the test assets
+__pycache__/

CHANGELOG.md

@@ -9,11 +9,14 @@ air-gapped signing
 # Unreleased
 
 * feat: a canister can now declare `upgrade_args` alongside `init_args`, in its own manifest and as a per-canister environment override. It is passed when `icp deploy` upgrades the canister, where `init_args` is passed when it installs or reinstalls it. It takes exactly the forms `init_args` does (inline Candid string, or `{ value | path, format }`), and paths resolve against the canister's own directory the same way. A canister that declares no `upgrade_args` is upgraded with its `init_args`, as before, and `--args` / `--args-file` still override whichever applies.
+* feat: a new `status_visibility` canister setting controls who may read a canister's status (its running state, cycles, memory usage, and settings) through the management canister. It takes the same forms as `log_visibility` — `controllers` (the default), `public`, or `{ allowed_viewers: [...] }` — and can be set in a manifest's `settings:` block or with `icp canister settings update --status-visibility / --add-status-viewer / --remove-status-viewer / --set-status-viewer`. `icp canister status` and `icp canister settings show` now report it. See the [canister settings reference](docs/reference/canister-settings.md#status_visibility).
+  * `icp canister status` and `icp canister settings show` now list principals one per line under their label rather than comma-separated on the label's line: `log viewer:` / `status viewer: <principal>` for the allowed viewers of a visibility setting, `controller: <principal>` for a canister's controllers. This applies to `log_visibility` and to the controller list as well, so scripts matching those lines need updating. Both lists are sorted, which the controller list previously was not.
+  * `icp canister settings update` no longer lets a relative viewer edit silently revoke public access. `--add-log-viewer` / `--remove-log-viewer` and their `--*-status-viewer` counterparts are now rejected while that setting is `public`, which carries no allowed-viewers list for them to be relative to — previously they started one from empty, so adding a viewer to a public canister took access away from everyone else. The error points at `--set-*-viewer`, which states the new list outright, and at `--*-visibility controllers`, which revokes public access on its own. Both remain allowed and now warn about what they cost: replacing a `public` policy with a list, and removing the last viewer. This is breaking for the pre-existing log flags.
+  * This raises the minimum replica version: reading a canister's status now requires one that reports `status_visibility`, and against an older replica `canister_status` fails to decode — which affects `icp deploy`, `icp canister status`, and `icp canister settings show`/`sync`, not just the new setting. Every mainnet subnet reports it. A `managed` network resolves the launcher to `latest` unless it pins `version:`, so only a pinned launcher older than `15.0.0-2026-08-13-03-55` is affected; raise the pin to that version or later.
 * feat: `script` build steps now receive `ICP_CLI_ENVIRONMENT`, the name of the environment the canisters are being built for, so a build can vary by environment the way a sync step already could.
 * feat: `icp completions <SHELL>` prints a shell completion script for `bash`, `zsh`, `fish`, `powershell`, or `elvish` to stdout. See the [installation guide](docs/guides/installation.md#shell-completions) for where to put it.
 * fix: canister settings from the manifest are no longer silently discarded when a canister is created through the legacy management-canister fallback (a CloudEngine subnet with no registered engine operator). That path went through `ic-utils`, which encodes `create_canister`'s argument as a bare `canister_settings` record rather than the `record { settings : opt canister_settings; ... }` the interface spec defines, so the replica read no settings at all and created the canister with defaults. `icp deploy` masked this by syncing settings afterwards; `icp canister create` does not, and left the canister unconfigured.
 * fix: `icp canister logs` output formats are corrected. `--json` now emits machine-readable JSON and the default emits the human-readable lines (the two were swapped), and `--follow --json` emits newline-delimited JSON, one record per line, streamed as each record arrives. This is breaking for scripts: parsing the default output as JSON now requires `--json`, and consumers of `--follow --json` must read one JSON object per line.
-* fix: `icp canister status` again falls back on the publicly readable state-tree information when the caller may not read the status. Replicas now reject those calls with `IC0542`, which the fallback did not recognise, so the command failed with `Error looking up canister <id>` instead of printing the controllers and module hash. `IC0541`, returned on subnets with administrators, is now recognised too, and the fallback no longer depends on whether the rejection arrives certified or uncertified.
 
 ## Experimental
 

Cargo.toml

@@ -56,7 +56,7 @@ httptest = "0.16.3"
 ic-agent = { version = "0.49.1" }
 ic-ed25519 = "0.6.0"
 ic-ledger-types = "0.16.0"
-ic-management-canister-types = { version = "0.8.0" }
+ic-management-canister-types = { version = "0.9.0" }
 ic-utils = { version = "0.49.1" }
 icp = { path = "crates/icp" }
 icp-canister-interfaces = { path = "crates/icp-canister-interfaces" }

crates/icp-cli/src/commands/canister/create.rs

@@ -163,7 +163,12 @@ impl CreateArgs {
                 .or(default.settings.reserved_cycles_limit.clone())
                 .map(|c| Nat::from(c.get())),
             // TODO This should be configurable from the CLI
-            log_visibility: default.settings.log_visibility.clone().map(Into::into),
+            log_visibility: default.settings.log_visibility.clone().map(|v| v.0.into()),
+            status_visibility: default
+                .settings
+                .status_visibility
+                .clone()
+                .map(|v| v.0.into()),
             memory_allocation: self
                 .settings
                 .memory_allocation
@@ -254,6 +259,7 @@ impl CreateArgs {
                 .map(|c| Nat::from(c.get())),
             // TODO This should be configurable from the CLI
             log_visibility: None,
+            status_visibility: None,
             memory_allocation: self
                 .settings
                 .memory_allocation