Skip to content

[BUG] hook virtual package can't be installed with apm v0.29.1 and v0.30.0 #2980

New issue
New issue
Closed
Closed
[BUG] hook virtual package can't be installed with apm v0.29.1 and v0.30.0#2980
Assignees
danielmeppiel
Labels
area/cliCLI command surface, flags, help text (cross-cutting).area/distributionInstallers (curl/PowerShell/Brew/Scoop), self-update, devcontainer, codespaces.status/acceptedHuman scope approval; verify the issue's approval record and review contact before work.triage/recommendedAutomated advice completed; not human scope approval.type/bugSomething does not work as documented.

Description

@ngicks
ngicks
opened on Sep 14, 2026

Describe the bug

Fresh installation with apm install fails to install hook virtual packages.

To Reproduce

I'll use podman to isolate the problem.

podman container run -it --rm docker.io/library/ubuntu:noble-20260905

Inside a container:

apt update && apt install curl git -y
curl -LsSf https://astral.sh/uv/install.sh | sh
source $HOME/.local/bin/env
cd $(mktemp -d)
cat <<EOF > apm.yml
name: crabswarm
version: 1.0.0
description: APM project for crabswarm
author: ngicks
targets:
  - claude
  - codex
dependencies:
  apm:
    - git: github.com/ngicks/agents-package
      path: hooks/markdown-mermaid-lint
  mcp: []
scripts: {}
EOF

It fails for 0.29.1 and 0.30.0

# uv tool install apm-cli@0.30.0
# apm --version
Agent Package Manager (APM) CLI version 0.30.0
# apm install
[>] Installing dependencies from apm.yml...
[>] Resolving agents-package-markdown-mermaid-lint...
[x] Failed to install APM dependencies: Downloaded dependency 'agents-package-markdown-mermaid-lint' is invalid: Downloaded
package has no apm.yml or SKILL.md:
/tmp/tmp.7r3AkSDPgP/apm_modules/.apm-resolution-staging/72dafc60a61340fa83b9bf4b3f0d8823/replacements/3042fe6e04725a55e65ca53e
15cd51a18e4181d83eaac8177f605b972636c8f1. The downloaded candidate was not activated; fix the cause and retry the install.
[i] Run with --verbose for detailed diagnostics
[x] Install failed after 1.4s.

Succeeds with 0.28.0 and 0.29.0

# uv tool install apm-cli@0.28.0
# apm install
[>] Installing dependencies from apm.yml...
[>] Resolving agents-package-markdown-mermaid-lint...
[i] Targets: claude, codex  (source: apm.yml)
  [+] github.com/ngicks/agents-package/hooks/markdown-mermaid-lint #default @48df58af
  |-- 2 hook(s) integrated -> .claude/settings.json, .codex/hooks.json
  |   PostToolUse: runs .Files}} (hook.json)
  |   PostToolUse: runs .Files}} (hook.json)
[i] Added apm_modules/ to .gitignore
  [!] 1 dependency unpinned: ngicks/agents-package -- add #tag or #sha to prevent drift
[*] Installed 1 APM dependency in 1.8s.

Expected behavior

Succeeds as the doc promises.

Environment (please complete the following information):

  • OS: linux
  • Python Version: 3.14.7
  • APM Version: 0.29.1, 0.30.0
  • VSCode Version (if relevant): irrelevant

Logs

Noted in the repro step.

Additional context

I believe I have nothing.

Activity

  1. ngicks
    added
    type/bugSomething does not work as documented.
    on Sep 14, 2026
  2. github-project-automation
    added this to APM Roadmapon Sep 14, 2026
  3. ngicks
    changed the title [-][BUG] hook virtual package can't be installed apm v0.29.1 and v0.30.0[/-] [+][BUG] hook virtual package can't be installed with apm v0.29.1 and v0.30.0[/+] on Sep 14, 2026

  4. sergio-sisternes-epam commented on Sep 15, 2026

    @sergio-sisternes-epam
    Sergio Sisternes (sergio-sisternes-epam)
    on Sep 15, 2026
    Collaborator

    Thanks for the isolated podman repro and the version matrix (fails on 0.29.1 and 0.30.0, works on 0.28.0 and 0.29.0).

    The advisory recommendation is accept: this matches the documented hook-package layout (hooks/*.json only, no apm.yml or SKILL.md) consumed via a git path: dependency. The error rejects a layout the docs already promise. Closed #2888 was a related skills: subset failure, not this hook path: case.

    This comment is not scope approval. A maintainer still needs to record bounded scope and a review contact before anyone implements a fix. Until then, staying on 0.29.0 is a reasonable workaround.

    Generated by autopilot-issue-triage-worker. This comment is AI-generated and may contain errors.

  5. Sergio Sisternes (sergio-sisternes-epam)
    added
    area/cliCLI command surface, flags, help text (cross-cutting).
    area/distributionInstallers (curl/PowerShell/Brew/Scoop), self-update, devcontainer, codespaces.
    triage/recommendedAutomated advice completed; not human scope approval.
    status/acceptedHuman scope approval; verify the issue's approval record and review contact before work.
    on Sep 15, 2026

  6. danielmeppiel commented on Oct 16, 2026

    @danielmeppiel
    Daniel Meppiel (danielmeppiel)
    on Oct 16, 2026
    Collaborator

    Accepted after maintainer confirmation: a bounded admission repair for the existing hook-only package format.

    Thanks ngicks for the isolated report and version comparison. APM's package-types reference explicitly supports hooks/*.json without apm.yml or SKILL.md. Authors should not need to add a fake skill or unnecessary manifest to get that supported package through installation.

    At inspected APM 6333b56a3c2e11e20d87f6f55070c4a06669d06d, the canonical validator recognizes a hook-only package and returns metadata in memory. The resolver's subsequent admission path omits that package type before falling back to requiring a manifest or root skill.

    An isolated execution using the actual validator and resolver loader reproduced the mismatch for both hooks/hook.json and .apm/hooks/hook.json: validation succeeded, then resolver admission raised the missing-manifest error before activation. A valid root-skill control passed; an empty-directory control remained rejected. Download/activation callbacks were inert stubs. No reporter hook, native client, installed CLI, lockfile write or deployment was executed; the historical release matrix was not independently rerun.

    The original hook directory was checked at upstream 48df58afd6bdbf72ac8338fe2c7ad92871611e51. It is absent from the inspected current upstream tree, so this is not a claim that today's unpinned URL is an unchanged reproduction.

    The accepted fix should align resolver admission with canonical validation while preserving validation-before-activation, invalid-package rejection, executable consent, target restrictions, integrity and ownership. It does not add recursive hook discovery or change native hook behavior.

    Completion requires real installed-CLI APMLifecycle coverage for fresh install, restore, update/removal and failed replacement preservation, plus correct supported hook registration/resources. A missing-type branch change and a function-level test alone are not the complete delivery bar.

    The separate strict record contains the scope and exclusions. Daniel Meppiel (@danielmeppiel) is the review contact. No implementer was assigned, automated delivery started, workflow authorized or release promised.

    Generated by apm-strategy. This comment is AI-generated and may contain errors.

  7. danielmeppiel commented on Oct 16, 2026

    @danielmeppiel
    Daniel Meppiel (danielmeppiel)
    on Oct 16, 2026
    Collaborator

    Decision: approve
    Area: project
    Scope: Repair resolver admission for valid, already-supported hook-only packages selected through Git path dependencies, so fresh and replacement installs use the canonical package interpretation consistently. Support the existing root hooks/.json and .apm/hooks/.json layouts without requiring authors to add a fake skill or source manifest. Preserve validation-before-activation and the existing hook installation contract.
    Done when: Real installed-CLI APMLifecycle regression coverage demonstrates fresh installation, lock-backed restore, update and removal for both supported hook-only layouts, with valid non-hook and invalid-package controls. Invalid replacements must leave the previous installation, lock and ownership state intact. Supported target hook registration and referenced resources must remain correct under existing executable consent, target restrictions, integrity checks and native semantics. Reuse the canonical package-type/validation authority rather than bypassing validation or inventing a second format classifier. Keep failures truthful and update directly related documentation and shipped usage guidance for the corrected behavior. Function-boundary reproduction alone is not complete delivery evidence.
    Out of scope: New package formats, recursive hook-declaration discovery, arbitrary-directory admission, blanket suppression of validation errors, automatic trust or permission grants, executing hooks during installation, broad resolver redesign, native-plugin program expansion, assignment, implementation dispatch, restarting blocked delivery, workflow execution, PR approval or merge, and release commitments.
    Review contact: Daniel Meppiel (@danielmeppiel)

  8. Daniel Meppiel (danielmeppiel)
    self-assigned this
    on Oct 19, 2026
  9. Daniel Meppiel (danielmeppiel)
    added a commit that references this issue on Oct 19, 2026

    fix(hooks): admit and stage hook-only Git-path packages (#3282)

    8974961

  10. danielmeppiel commented on Oct 20, 2026

    @danielmeppiel
    Daniel Meppiel (danielmeppiel)
    on Oct 20, 2026
    Collaborator

    Resolved by #3282

    PR #3282 merged in 897496177ba389c4708b110efa1ee5345ccefb79 and completes the accepted hook-only admission and lifecycle repair.

    The repair uses canonical validation for both supported hook-only layouts without requiring a fake skill or source manifest. Its installed-CLI lifecycle coverage includes fresh installation, lock-backed restore, update/removal and invalid-replacement preservation, while retaining registration/resource, consent, target and ownership protections.

    The issue remained open because the completed PR used only a non-closing reference. Closing it as completed now corrects that bookkeeping omission; it does not authorize hook execution during installation or any broader native-plugin expansion.

    Generated by autopilot-pr-merge-worker. This comment is AI-generated and may contain errors.

  11. Daniel Meppiel (danielmeppiel)
    closed this as completedon Oct 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area/cliCLI command surface, flags, help text (cross-cutting).area/distributionInstallers (curl/PowerShell/Brew/Scoop), self-update, devcontainer, codespaces.status/acceptedHuman scope approval; verify the issue's approval record and review contact before work.triage/recommendedAutomated advice completed; not human scope approval.type/bugSomething does not work as documented.

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions