[BUG] transitive packages

[foutoucour]

Describe the bug
I don't have the same result if I use transitive dependencies or direct dependencies of the same packages.

dependencies

• package team-cot-agent-instructions

name: team-cot-agent-instructions
version: 0.0.1


dependencies:
  apm:
    - git.corporate.com/rieraj/division-ime-agent-instructions

• package division-ime-agent-instructions

name: division-ime-agent-instructions
version: 0.0.1


dependencies:
  apm:
    - git.corporate.com/rieraj/corporate-agent-instructions

• package corporate-agent-instructions

name: corporate-agent-instructions
version: 0.0.1

apm.yml files

• direct dependencies

name: drect
version: 1.0.0
description: direct
author: Jordi Riera
dependencies:
  apm:
  - git.corporate.com/rieraj/team-cot-agent-instructions
  - git.corporate.com/rieraj/division-ime-agent-instructions
  - git.corporate.com/rieraj/corporate-agent-instructions
  mcp: []
scripts: {}

• transitive dependencies

name: transitives
version: 1.0.0
description: APM project for transitives
author: Jordi Riera
dependencies:
  apm:
  - git.corporate.com/rieraj/team-cot-agent-instructions
  mcp: []
scripts: {}

To Reproduce
Steps to reproduce the behaviour:

1. Run command 'apm install' in both cases
2. With parameters 'None'
3. See error

Expected behaviour

In the case of direct dependencies

❯ apm install
Installing dependencies from apm.yml...
Installing APM dependencies (3)...
  └─ Resolved transitive: rieraj/team-cot-agent-instructions
  └─ Resolved transitive: rieraj/division-ime-agent-instructions
  └─ Resolved transitive: rieraj/corporate-agent-instructions
Created .github/ as standard skills root (.github/skills/) and to enable
VSCode/Copilot integration
✓ rieraj/corporate-agent-instructions
✓ rieraj/division-ime-agent-instructions
✓ rieraj/team-cot-agent-instructions
  └─ 1 agents integrated → .github/agents/

Generated apm.lock with 3 dependencies
Installed 3 APM dependencies
No MCP dependencies found in apm.yml


╭─────────────────────────── ✨ Installation complete ───────────────────────────╮
│                                                                                │
│  Next steps:                                                                   │
│    apm compile              # Generate AGENTS.md guardrails                    │
│    apm list                 # Show all prompts                                 │
│                                                                                │
╰────────────────────────────────────────────────────────────────────────────────╯
❯ apm compile
⚙️ Starting context compilation...
Compiling for AGENTS.md (VSCode/Copilot) - detected .github/ folder
Analyzing project structure...
├─ 4 directories scanned (max depth: 3)
├─ 9 files analyzed across 3 file types (lock, md, yml)
└─ 3 instruction patterns detected

Optimizing placements...

  Pattern              Source          Co…   Placement             Metrics
 ────────────────────────────────────────────────────────────────────────────────
  **                   IME-ruler.in…   4/4   ./AGENTS.md           rel: 100%
  **                   design-stand…   4/4   ./AGENTS.md           rel: 100%
  **                   corporate-sta…   4/4   ./AGENTS.md           rel: 100%



Generated 1 AGENTS.md file
┌─ Context efficiency:    100.0%
└─ Generation time:       4ms

Placement Distribution
└─ .                              3 instructions from 2 sources
✅ Compilation completed successfully!

In the case of transitive dependencies

❯ apm install
Installing dependencies from apm.yml...
Installing APM dependencies (1)...
  └─ Resolved transitive: rieraj/team-cot-agent-instructions
  └─ Resolved transitive: rieraj/division-ime-agent-instructions
  └─ Resolved transitive: rieraj/corporate-agent-instructions
Created .github/ as standard skills root (.github/skills/) and to enable
VSCode/Copilot integration
✓ rieraj/team-cot-agent-instructions
  └─ 1 agents integrated → .github/agents/
✓ rieraj/division-ime-agent-instructions
✓ rieraj/corporate-agent-instructions

Added apm_modules/ to .gitignore
Generated apm.lock with 3 dependencies
Updated .gitignore for integrated agents (*-apm.agent.md, *-apm.chatmode.md)
Installed 3 APM dependencies
No MCP dependencies found in apm.yml


╭─────────────────────────── ✨ Installation complete ───────────────────────────╮
│                                                                                │
│  Next steps:                                                                   │
│    apm compile              # Generate AGENTS.md guardrails                    │
│    apm list                 # Show all prompts                                 │
│                                                                                │
╰────────────────────────────────────────────────────────────────────────────────╯
❯ apm compile
⚙️ Starting context compilation...
Compiling for AGENTS.md (VSCode/Copilot) - detected .github/ folder
✅ Compilation completed successfully!

⚠️ Found 2 orphaned package(s) that were included in compilation:
  • rieraj/corporate-agent-instructions
  • rieraj/division-ime-agent-instructions
💡 Run 'apm prune' to remove orphaned packages

Environment (please complete the following information):

• OS: macOS
• Python Version: Python 3.12.12
• APM Version: Agent Package Manager (APM) CLI version 0.7.3

Logs
If applicable, add any error logs or screenshots.

Additional context
Add any other context about the problem here.

[danielmeppiel]

Welcome to APM, @foutoucour! 👋 Thanks for filing your first issue — and what a thorough bug report. The clear reproduction steps, expected vs. actual output, and environment details made this very easy to triage.

You're right — this is a bug. I've confirmed the root cause:

1. Compile only scans direct dependencies. The primitive discovery during apm compile reads dependency order from apm.yml, which only lists your direct dependencies. Transitive deps (installed automatically via dependency chains) are never passed to the compiler, so their instructions are silently skipped.

2. Orphan detection doesn't account for transitive deps. The orphan check compares installed packages in apm_modules/ against apm.yml declarations — but transitive deps aren't declared there, so they're incorrectly flagged as orphaned.

The fix will involve reading from apm.lock (which already tracks transitive dependencies with a depth field) instead of only apm.yml — both for primitive discovery and orphan detection. This will ship in v0.7.4.

In the meantime, declaring all dependencies directly in apm.yml works as a workaround.

Thanks again for helping improve APM! 🙏