Description

Sweepy (sweepies)

opened on Nov 9, 2026

Issue body actions

Describe the bug
When a local package installed at user scope drops an APM dependency from its apm.yml, apm install --global <path> never removes it: the dependency's deployed skill stays in ~/.claude/skills/, it stays in ~/.apm/apm.lock.yaml and ~/.apm/apm_modules/, and repeated installs don't change that. apm prune (run from ~/.apm, as it has no --global) reports "No orphaned packages found". Skills removed from the local package's own skills/ directory are cleaned up as expected; only dropped dependencies are left behind.

The only workaround we found is apm uninstall --global <path> followed by a fresh install.

To Reproduce

mkdir -p pkg/skills/hello
printf -- '---\nname: hello\ndescription: Test skill\n---\nHello\n' > pkg/skills/hello/SKILL.md
printf 'name: pkg\nversion: 1.0.0\ndependencies:\n  apm: []\n' > pkg/apm.yml
apm install --global "$PWD/pkg" --target claude      # 1

printf 'name: pkg\nversion: 1.0.0\ndependencies:\n  apm:\n    - caldoai/skills/skills/untangle-codebase#f3cf47774975a7d9fca45730babf4ff7ad765ada\n' > pkg/apm.yml
apm install --global "$PWD/pkg" --target claude      # 2
apm install --global "$PWD/pkg" --target claude      # 3

printf 'name: pkg\nversion: 1.0.0\ndependencies:\n  apm: []\n' > pkg/apm.yml
apm install --global "$PWD/pkg" --target claude      # 4
apm install --global "$PWD/pkg" --target claude      # 5

Output (trimmed to the resolve and summary lines, plus ls ~/.claude/skills after each step):

# 1. install
[>] Resolving /tmp/tmp.CwmQeN2R8y/pkg...
[*] Installed 1 APM dependency in 0.2s.
  ~/.claude/skills: hello
# 2. add dep, install
[*] Installed 1 APM dependency in 0.2s.
  ~/.claude/skills: hello
# 3. install again
[>] Resolving skills-untangle-codebase...
[*] Installed 2 APM dependencies in 0.7s.
  ~/.claude/skills: hello untangle-codebase
# 4. drop dep, install
[*] Installed 1 APM dependency in 0.2s.
  ~/.claude/skills: hello untangle-codebase
# 5. install again
[*] Installed 1 APM dependency in 0.2s.
  ~/.claude/skills: hello untangle-codebase

The bug is steps 4 and 5: untangle-codebase is still deployed (and still in the lockfile) after the package no longer declares it. (Step 2 shows a separate bug, #3501.)

Expected behavior
Step 4 removes the dropped dependency's deployed files, lockfile entry and apm_modules/ copy, the same way it cleans up skills removed from the package itself. Failing that, apm prune should find it, and support --global.

Environment

• OS: Linux (Debian, kernel 6.8)
• APM Version: 0.35.0 (17a2fc4), standalone release binary installed through mise

Activity

1. github-project-automation

   added this to APM Roadmapon Nov 9, 2026
2. danielmeppiel commented on Nov 10, 2026

   

   Daniel Meppiel (danielmeppiel)

   on Nov 10, 2026

   Collaborator

   More actions

   Decision: approve
   Area: project
   Scope: Make a targeted apm install PKG (project and -g) reconcile the named package's own transitive subtree so dependencies it no longer declares, and that no other retained package needs, are removed from apm.lock.yaml, apm_modules and deployed files, while partial installs keep preserving unrelated packages' lock entries, restoring the documented rule that lock entries and installed packages follow what retained packages still need.
   Done when: A real-CLI regression at user and project scope shows that after a local package drops a dependency one apm install -g PATH (and apm install PATH) removes the dropped dependency's lock entry, apm_modules copy and deployed skills, apm deps tree no longer lists it, a dependency still reached through another declared package is kept, and unrelated packages' lock entries stay byte-identical.
   Out of scope: The one-run stale manifest read (#3401); adding --global to apm prune; prune algorithm changes; lockfile schema changes.
   Review contact: Daniel Meppiel (@danielmeppiel)
3. danielmeppiel commented on Nov 10, 2026

   

   Daniel Meppiel (danielmeppiel)

   on Nov 10, 2026

   Collaborator

   More actions

   The apm-scope:v1 record above was approved by Daniel Meppiel (@danielmeppiel) at Gate B on 2026-11-10 in the coordinator session of the issue-reduction program. It is the scope a fix for this issue will be reviewed against.

   Review contact: Daniel Meppiel (@danielmeppiel).

   ---

   Generated by autopilot-issue-triage-worker. This comment is AI-generated and may contain errors.
4. Daniel Meppiel (danielmeppiel)

   self-assigned this

   on Nov 10, 2026
5. Daniel Meppiel (danielmeppiel)

   added

   status/acceptedHuman scope approval; verify the issue's approval record and review contact before work.Human scope approval; verify the issue's approval record and review contact before work.

   on Nov 10, 2026
6. Daniel Meppiel (danielmeppiel)

   added 8 commits that reference this issue on Nov 10, 2026

   chore: record spec waiver for targeted install reconciliation

   3f7268c

   fix(install): reconcile a targeted package's dropped transitive depen…

   44be2c2

   chore: record spec waiver for targeted install reconciliation

   f87a1f2

   fix(install): harden targeted subtree reconciliation edge cases

   988154d

   fix(install): reconcile a targeted package's dropped transitive depen…

   9a36dec

   chore: record spec waiver for targeted install reconciliation

   09e3ed8

   fix(install): harden targeted subtree reconciliation edge cases

   4db082d

   fix(install): reconcile a targeted package's dropped transitive depen…

   fc58e31

Issue actions