[BUG] MCP-only package uninstall deletes unmanaged Claude and Kiro skills

[mfroembgen]

Describe the bug

On APM 0.30.0, uninstalling a local MCP-only package deletes unrelated, manually created skill directories under .claude/skills/ and .kiro/skills/. These skills were never installed or owned by APM. Installation preserves them; uninstall reports success and “Cleaned up 2 integrated skills”. An equivalent unmanaged skill under .agents/skills/ survives.

To Reproduce

Run the following Python script with APM 0.30.0 on PATH. It creates an isolated temporary HOME and project, uses a non-routable example MCP endpoint, asserts the observed deletion, and cleans up its temporary directory. No real agent configuration is used.

import os, pathlib, subprocess, tempfile, shutil
with tempfile.TemporaryDirectory(prefix='apm-mcp-removal-') as tmp:
    root=pathlib.Path(tmp); home=root/'home'; project=root/'project'; package=root/'mcp-only'
    for p in (home,project,package): p.mkdir()
    (package/'apm.yml').write_text('name: mcp-only\nversion: 0.1.0\ndescription: Minimal MCP-only reproduction\ndependencies:\n  mcp:\n    - name: example\n      registry: false\n      transport: streamable-http\n      url: https://example.invalid/mcp\n')
    sentinels=[]
    for target in ('.claude','.kiro','.agents'):
        p=project/target/'skills'/'personal'/'SKILL.md'; p.parent.mkdir(parents=True)
        p.write_text('---\nname: personal\ndescription: Personal unmanaged skill.\n---\nPreserve this file.\n'); sentinels.append(p)
    env={'PATH':os.environ['PATH'],'HOME':str(home),'XDG_CONFIG_HOME':str(home/'.config'),'XDG_CACHE_HOME':str(home/'.cache'),'APM_HOME':str(home/'.apm'),'GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':os.devnull,'GIT_TERMINAL_PROMPT':'0','NO_COLOR':'1','TERM':'dumb'}
    def run(*args):
        p=subprocess.run([shutil.which('apm'),*args],cwd=project,env=env,text=True,stdout=subprocess.PIPE,stderr=subprocess.STDOUT)
        print(p.stdout.replace(tmp,'<temp>')); print('exit:',p.returncode); assert p.returncode==0
    run('--version'); run('install',str(package),'--target','claude,kiro,codex')
    print('after install:',{str(p.relative_to(project)):p.exists() for p in sentinels})
    print('lock:',(project/'apm.lock.yaml').read_text().replace(tmp,'<temp>'))
    assert all(p.exists() for p in sentinels)
    run('uninstall',str(package))
    print('after uninstall:',{str(p.relative_to(project)):p.exists() for p in sentinels})
    assert not sentinels[0].exists() and not sentinels[1].exists() and sentinels[2].exists()
    print('CONFIRMED: unmanaged Claude and Kiro skills deleted; agents skill preserved.')
print('Disposable environment removed.')

Expected behavior

Removing a package with no deployed skill files must preserve all unmanaged skills. Only the removed package's owned resources and MCP configuration should be removed.

Environment

• OS: macOS, Apple Silicon
• APM: Homebrew binary, Agent Package Manager (APM) CLI version 0.30.0 (08e85c4e42)
• Python: the reproduction harness uses Python 3; APM runs its packaged runtime
• Scope: project
• Targets: claude,kiro,codex
• VSCode: not involved

Logs

After install:
.claude/skills/personal/SKILL.md: present
.kiro/skills/personal/SKILL.md: present
.agents/skills/personal/SKILL.md: present

[+] Cleaned up 2 integrated skills
[*] Uninstall complete: Removed 1 package(s) from apm.yml, Removed 1 package(s) from apm_modules/
exit: 0

After uninstall:
.claude/skills/personal/SKILL.md: missing
.kiro/skills/personal/SKILL.md: missing
.agents/skills/personal/SKILL.md: present

Additional context

Reproduced again locally on 2026-09-11. The package's lock entry has no deployed_files, only MCP configuration/deployment records.

The apparent code path in v0.30.0 is _sync_integrations_after_uninstall() converting an empty all_deployed_files set to None (commands/uninstall/engine.py, sync_managed = all_deployed_files if all_deployed_files else None). Legacy clean_orphaned_skills() removes unrecognized directories; its lockfile ownership guard applies to .agents, but not .claude or .kiro.

Related: #2852 / #2858 cover surviving transitive instructions and were closed as addressed in 0.30.0. This reproduction instead concerns unmanaged skills removed by an MCP-only package uninstall on that released version. I found no existing issue for this exact case. This report does not claim reproduction on current main or other operating systems.

[github-actions]

Triage recommendation

accept

Recommendation only, not scope approval. A responsible human maintainer
must approve the scope and review contact before implementation. Labels,
automated advice, and silence are not approval or a release commitment.

Proposed classification

type/bug

Proposed scope brief

• Scope: Fix _sync_integrations_after_uninstall() in
  commands/uninstall/engine.py so an empty all_deployed_files set does
  not disable the lockfile-ownership guard that clean_orphaned_skills()
  uses for .claude/skills and .kiro/skills, matching the guard already
  applied to .agents.
• Done when: Uninstalling an MCP-only package (no deployed skill
  files) preserves unmanaged skills under .claude/skills/ and
  .kiro/skills/, matching current .agents/skills/ behavior, with a
  regression test covering this exact scenario.
• Exclusions: Legitimate orphan cleanup for APM-owned skill
  directories is unaffected.
• Review needs: Familiarity with the uninstall integration-sync path
  and lockfile ownership tracking across .claude, .kiro, .agents.

Suggested next action

A draft fix exists at #2947. A maintainer should confirm scope and review
the regression test coverage for .claude and .kiro targets.

Suggested issue comment

Thanks for the thorough, self-contained reproduction -- this is a real
data-loss bug (unmanaged skills deleted on an MCP-only uninstall), and a
draft fix is already up at #2947. A maintainer will confirm scope before
merge. This is automated triage advice, not approval.

Per-lens notes (collapsed)

DevX UX Expert -- User-Need Reviewer

Silent deletion of user-owned, never-installed files is a severe trust
violation -- "success" messaging actively hides the damage.

Supply Chain Security Expert -- Risk-Surface Reviewer

Unbounded/unguarded filesystem deletion on uninstall is a real risk
surface; the fix should ensure the ownership guard is consistently applied
across all supported skill targets, not just patched for this one case.

OSS Growth Hacker -- Contributor-Tone Reviewer

Not activated -- no first-time-contributor signal present.

Python Architect -- Architecture Reviewer

The root cause (falsy-empty-set-to-None coercion bypassing an ownership
guard) suggests checking for other integration targets with the same
if all_deployed_files else None pattern, to avoid whack-a-mole fixes.

Doc Writer -- Documentation Reviewer

Not activated -- no user-facing doc content implicated.

APM CEO -- Triage Arbiter

High-confidence, well-reproduced data-loss regression with a draft fix
already open. Recommend accept and prioritize given the destructive
nature of the bug.

{
  "schema_version": 2,
  "advisory_only": true,
  "recommendation": "accept",
  "recommendation_detail": "MCP-only uninstall with empty deployed-files set bypasses the ownership guard for .claude/.kiro skills; draft PR #2947 exists.",
  "classification": {
    "theme": null,
    "areas": [],
    "type": "type/bug"
  },
  "proposed_brief": {
    "scope": "Preserve unmanaged skills during uninstall when the deployed-files set is empty, consistently across .claude/.kiro/.agents.",
    "done_when": "MCP-only package uninstall no longer deletes unmanaged skill directories, with regression coverage.",
    "exclusions": "Legitimate orphan cleanup for APM-owned skills unaffected.",
    "review_needs": "Uninstall integration-sync and lockfile ownership familiarity."
  },
  "next_action": "Maintainer reviews #2947 for scope and regression coverage.",
  "comment_markdown": "Thanks for the thorough, self-contained reproduction -- this is a real data-loss bug (unmanaged skills deleted on an MCP-only uninstall), and a draft fix is already up at #2947. A maintainer will confirm scope before merge. This is automated triage advice, not approval."
}

Automated advice only. Labels and silence are not approval.
A responsible human maintainer decides scope, priority, invitations,
review capacity, and release targeting. Existing human edits remain.
To request fresh advice, use manual dispatch or triage/requested.

Generated by Triage Panel · copilot · auto · 180.7 AIC · ⌖ 27.1 AIC · ⊞ 11.7K · ◷