[BUG] apm pack does not produce bundle when dependencies: {}

[kkadete]

Describe the bug

When apm.yml contains dependencies: {} (the key is present but the dict is empty), apm pack --format plugin does not create a bundle directory. Exit code is 0 and no error or warning is emitted — the pack silently produces no bundle output.

The root cause is in src/apm_cli/core/build_orchestrator.py inside detect_outputs():

if data and data.get("dependencies"):
    out.add(OutputKind.BUNDLE)

Python's truthiness treats an empty dict {} as falsy, so OutputKind.BUNDLE is never added to outputs_needed and BundleProducer is never called.

To Reproduce

1. Create an apm.yml with a dependencies: {} block and root-level skills/:

name: my-plugin
version: 1.0.0
target: copilot

dependencies: {}

2. Add at least one skill file under skills/my-skill/SKILL.md.
3. Run apm pack --format plugin --verbose
4. Observe: no build/ directory is created, exit code 0, no error.

Expected behavior

The documentation states:

dependencies: block present → a bundle

dependencies: {} has the block present — the key exists in the YAML. A bundle containing the package's own skills should be produced. The truthiness check should be replaced with an explicit is not None check:

# Fix:
if data and data.get("dependencies") is not None:
    out.add(OutputKind.BUNDLE)

Workaround

Add any non-empty entry under dependencies: (e.g. a self-defined MCP server with registry: false). This makes the dict truthy and triggers BundleProducer.

Environment

• OS: Windows
• Python Version: n/a (using frozen binary)
• APM Version: 0.26.0
• VSCode Version: n/a

Logs

No error output — apm pack exits 0 silently when dependencies: {} is present. With --verbose, only the PluginManifestProducer output is shown (writing .github/plugin/plugin.json for target: copilot).

[github-actions]

Triage decision

accept

Proposed labels

area/cli
type/bug
status/accepted
priority/high
good first issue

Milestone

null (open milestones could not be determined; maintainer should assign to the current patch release)

Suggested next action

Replace the truthiness check in detect_outputs() in build_orchestrator.py with an explicit is not None check, and add a regression test for dependencies: {}.

Suggested issue comment

Thank you for the detailed bug report and for isolating the root cause! This is a clear defect: Python treats an empty dict as falsy, so dependencies: {} never triggers OutputKind.BUNDLE even though the dependencies: key is explicitly present.

The one-line fix you identified is correct:

# Before
if data and data.get("dependencies"):
# After
if data and data.get("dependencies") is not None:

The fix is in src/apm_cli/core/build_orchestrator.py inside detect_outputs(). A regression test covering dependencies: {} would be a great addition alongside the fix.

This is a well-scoped, beginner-friendly change if you would like to contribute a PR. The fix is a single line plus a test case.

Per-lens notes (collapsed)

DevX UX Expert -- User-Need Reviewer

Silent failure on apm pack with exit code 0 and no output is a high-severity UX defect -- the user has no signal that anything went wrong. The root cause is a classic Python truthiness trap on an empty dict. The documented behavior (dependencies: block present -> bundle produced) is clear; the implementation simply does not match it. The reproduction steps are exact and the workaround is documented. Priority: high.

Supply Chain Security Expert -- Risk-Surface Reviewer

Pure behavioral bug in pack output detection logic. No supply chain, governance, or security surface is implicated. The fix ensures a bundle is created when the dependencies: key exists regardless of whether its value is empty. No risk-surface implication.

OSS Growth Hacker -- Contributor-Tone Reviewer

Author association is NONE. The bug report is precise and well-formatted. The reply confirms the diagnosis immediately, quotes the exact fix, and explicitly marks this as a beginner-friendly PR opportunity. Giving the author a clear on-ramp (single file, single line, plus a test) makes this actionable for a first contribution.

Python Architect -- Architecture Reviewer

Not activated -- the fix is a single-line truthiness correction in one function with no cross-cutting design implications.

Doc Writer -- Documentation Reviewer

Not activated -- this is a bug fix that restores behavior already described in the documentation; no new doc pages are needed.

APM CEO -- Triage Arbiter

Silent failure with exit code 0 erodes user trust and is exactly the kind of defect APM should fix quickly. The root cause is trivially correct, the fix is one line, and the scope is narrow. Decision: accept with priority/high and good-first-issue designation. Tagging as good first issue because the fix is a single-line change plus a test case -- a concrete, low-risk entry point for new contributors.

{
  "decision": "accept",
  "decision_detail": "",
  "theme": null,
  "areas": ["area/cli"],
  "type": "type/bug",
  "status": "status/accepted",
  "priority": "priority/high",
  "preserved_labels": ["good first issue"],
  "milestone": null,
  "next_action": "Replace the truthiness check with is not None in detect_outputs() in build_orchestrator.py and add a regression test for dependencies: {}."
}

---

Triage status: agentic proposal pending human ratification.
Silence is approval. Maintainers can:

• Override any label or milestone above by editing it directly --
  human edits are authoritative and will not be reverted on
  subsequent runs.
• Re-trigger triage by applying the status/needs-triage label, or
  by removing status/triaged to enroll the issue in the next
  daily sweep.

Posted by the Triage Panel workflow. See .apm/skills/apm-triage-panel for the panel skill.

Generated by Triage Panel · 135.2 AIC · ⌖ 7.88 AIC · ⊞ 9.2K · ◷