[BUG] apm install ignores dependencies.mcp[].registry

[fassmus]

Summary

APM appears to ignore the per-server registry: field in dependencies.mcp during a normal apm install run.

If an MCP dependency is declared in apm.yml with a custom registry URL, installation succeeds only when the same URL is also provided through MCP_REGISTRY_URL in the environment. Based on the manifest schema and CLI docs, the manifest entry itself should be sufficient.

Environment

• APM: 0.14.0 (9d1161b)
• VS Code: 1.120.0
• macOS: 14.7.3 (23H417)

Reproduction

Use an apm.yml like this:

name: apm-test
version: 1.0.0
dependencies:
  mcp:
    - name: com.example/playwright-mcp
      registry: https://registry.example.com

Then run:

apm install

Actual result

APM does not resolve the MCP servers from https://registry.example.com unless this is also set in the shell:

export MCP_REGISTRY_URL='https://registry.example.com'

With the environment variable set, install proceeds.

Expected result

apm install should honor the registry: value stored on each dependencies.mcp[] entry in apm.yml, without requiring MCP_REGISTRY_URL to be set externally.

Why this looks like a bug

The docs and schema imply that a custom registry URL is part of the persisted manifest state:

• apm install --mcp ... --registry URL says the URL is persisted to apm.yml
• the manifest schema documents dependencies.mcp[].registry as either:
  • false for self-defined servers, or
  • a string custom registry URL

But the code path appears asymmetric:

• apm install --mcp ... --registry URL uses registry_env_override(...) to export the registry URL for that immediate install flow
• the normal apm install path does not appear to apply the per-dependency registry value before MCP resolution
• registry_env_override usage seems limited to the dedicated --mcp command path

That would explain why the same registry works only when duplicated into MCP_REGISTRY_URL.

Impact

This makes apm.yml non-self-contained for MCP dependencies hosted in non-default registries. Teams cannot rely on the committed manifest alone; they must also distribute an environment variable out of band.

Suggested fix

During normal apm install, apply the registry value from each registry-resolved MCPDependency when resolving that server.

Possible approaches:

1. Thread dep.registry through the MCP resolution/install pipeline instead of relying on process-global env state
2. If environment-based plumbing is kept temporarily, apply it per dependency when resolving/installing servers from apm.yml
3. Add a regression test covering a manifest-declared MCP dependency with registry: https://registry.example.com and no MCP_REGISTRY_URL env var