apm-cli 0.23.1__tar.gz → 0.24.1__tar.gz

{apm_cli-0.23.1 → apm_cli-0.24.1}/NOTICE

@@ -703,6 +703,41 @@ THE SOFTWARE.
 
 ---
 
+## Component. tomlkit
+
+- Version requirement: `>=0.13`
+- Upstream: https://github.com/python-poetry/tomlkit
+- SPDX: `MIT`
+
+### Open Source License/Copyright Notice.
+
+_Copyright (c) 2018 Sébastien Eustace_
+
+```
+Copyright (c) 2018 Sébastien Eustace
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
+
+---
+
 ## Component. rich
 
 - Version requirement: `>=13.0.0`

{apm_cli-0.23.1/src/apm_cli.egg-info → apm_cli-0.24.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apm-cli
-Version: 0.23.1
+Version: 0.24.1
 Summary: MCP configuration tool
 Author-email: Daniel Meppiel <user@example.com>
 License: MIT License
@@ -46,6 +46,7 @@ Requires-Dist: llm>=0.28
 Requires-Dist: llm-github-models>=0.18.0
 Requires-Dist: tomli>=1.2.0; python_version < "3.11"
 Requires-Dist: toml>=0.10.2
+Requires-Dist: tomlkit>=0.13
 Requires-Dist: rich>=13.0.0
 Requires-Dist: rich-click>=1.7.0
 Requires-Dist: watchdog>=3.0.0

{apm_cli-0.23.1 → apm_cli-0.24.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "apm-cli"
-version = "0.23.1"
+version = "0.24.1"
 description = "MCP configuration tool"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -31,6 +31,7 @@ dependencies = [
     "llm-github-models>=0.18.0",
     "tomli>=1.2.0; python_version<'3.11'",
     "toml>=0.10.2",
+    "tomlkit>=0.13",
     "rich>=13.0.0",
     "rich-click>=1.7.0",
     "watchdog>=3.0.0",
@@ -170,4 +171,3 @@ markers = [
     "requires_inference: requires APM_RUN_INFERENCE_TESTS=1 + model API access",
     "req: binds a test to one or more OpenAPM req-XXX ids (spec-conformance suite)",
 ]
-

{apm_cli-0.23.1 → apm_cli-0.24.1}/src/apm_cli/adapters/client/claude.py

@@ -4,11 +4,11 @@ Project scope: ``.mcp.json`` at the project root with top-level ``mcpServers``
 (``--scope project`` in Claude Code). Writes are opt-in when ``.claude/`` exists,
 mirroring the Cursor/OpenCode directory-presence convention.
 
-User scope: top-level ``mcpServers`` in ``~/.claude.json`` (``--scope user``).
-Writes are atomic and create the file with ``0o600`` permissions on first
-write so the shared Claude Code config is not silently truncated by a
-concurrent writer and cannot leak any embedded OAuth state to other users
-on a multi-user host.
+User scope: top-level ``mcpServers`` in ``$CLAUDE_CONFIG_DIR/.claude.json``
+when configured, otherwise ``~/.claude.json`` (``--scope user``). Writes are
+atomic and create the file with ``0o600`` permissions on first write so the
+shared Claude Code config is not silently truncated by a concurrent writer
+and cannot leak any embedded OAuth state to other users on a multi-user host.
 
 Local scope (Claude Code's third scope -- the default for ``claude mcp add``,
 storing per-project private config under ``~/.claude.json -> projects.<abs_path>
@@ -20,12 +20,17 @@ See https://code.claude.com/docs/en/mcp
 """
 
 import json
+import logging
+import os
 from pathlib import Path
 
 from ...utils.atomic_io import atomic_write_text
 from ...utils.console import _rich_error, _rich_success, _rich_warning
+from ...utils.path_security import PathTraversalError
 from .copilot import CopilotClientAdapter
 
+_log = logging.getLogger(__name__)
+
 
 class ClaudeClientAdapter(CopilotClientAdapter):
     """MCP configuration for Claude Code (``mcpServers`` schema).
@@ -141,6 +146,15 @@ class ClaudeClientAdapter(CopilotClientAdapter):
         return self.project_root / ".mcp.json"
 
     def _user_claude_json_path(self) -> Path:
+        config_dir = os.environ.get("CLAUDE_CONFIG_DIR", "").strip()
+        if config_dir:
+            config_path = Path(config_dir).expanduser()
+            if not config_path.is_absolute():
+                raise PathTraversalError(
+                    "CLAUDE_CONFIG_DIR must be an absolute path for user-scope MCP "
+                    "config; set an absolute path or unset it to use ~/.claude.json."
+                )
+            return config_path.resolve(strict=False) / ".claude.json"
         return Path.home() / ".claude.json"
 
     def _should_write_project(self) -> bool:
@@ -206,6 +220,7 @@ class ClaudeClientAdapter(CopilotClientAdapter):
             payload = json.dumps(data, indent=2) + "\n"
             path.parent.mkdir(parents=True, exist_ok=True)
             atomic_write_text(path, payload, new_file_mode=0o600)
+            _log.debug("Claude user-scope MCP config written to %s", path)
             return True
         except OSError:
             return False

{apm_cli-0.23.1 → apm_cli-0.24.1}/src/apm_cli/adapters/client/codex.py

@@ -5,10 +5,12 @@ import os
 from pathlib import Path
 from urllib.parse import urlparse
 
-import toml
+import tomlkit
+from tomlkit.exceptions import TOMLKitError
 
 from ...registry.client import SimpleRegistryClient
 from ...registry.integration import RegistryIntegration
+from ...utils.atomic_io import atomic_write_text
 from ...utils.console import _rich_success, _rich_warning
 from ...utils.path_security import PathTraversalError
 from ._mcp_runtime_args import process_v01_value_hint_arg
@@ -94,9 +96,7 @@ class CodexClientAdapter(MCPClientAdapter):
         # Ensure directory exists
         config_path.parent.mkdir(parents=True, exist_ok=True)
 
-        with open(config_path, "w", encoding="utf-8") as f:
-            toml.dump(current_config, f)
-        os.chmod(config_path, 0o600)
+        atomic_write_text(config_path, tomlkit.dumps(current_config), new_file_mode=0o600)
         _log.debug("Codex config written to %s", config_path)
         return True
 
@@ -104,8 +104,9 @@ class CodexClientAdapter(MCPClientAdapter):
         """Get the current Codex CLI MCP configuration.
 
         Returns:
-            dict | None: Current configuration, empty dict if file doesn't
-                exist, or None when an existing config cannot be parsed safely.
+            MutableMapping | None: Round-trip-preserving mapping when the file
+                exists, empty mapping if it does not exist, or None when an
+                existing config cannot be parsed safely.
         """
         config_path = self.get_config_path()
 
@@ -113,12 +114,14 @@ class CodexClientAdapter(MCPClientAdapter):
             return {}
 
         try:
-            with open(config_path, encoding="utf-8") as f:
-                return toml.load(f)
-        except toml.TomlDecodeError as exc:
+            with open(config_path, encoding="utf-8") as config_file:
+                return tomlkit.load(config_file)
+        except (TOMLKitError, UnicodeDecodeError) as exc:
             _log.debug("Failed to parse Codex config at %s", config_path, exc_info=True)
             _rich_warning(
-                f"Could not parse {config_path}: {exc} -- skipping config write to avoid data loss",
+                f"Could not read or parse {config_path}: {exc} "
+                "-- skipping config write to avoid data loss; inspect the file "
+                "or delete it to reset Codex configuration",
                 symbol="warning",
             )
             return None

apm_cli-0.24.1/src/apm_cli/bundle/attest.py

@@ -0,0 +1,64 @@
+"""Shared per-file provenance verification for the pack pipelines (#2013).
+
+Both pack formats copy dependency files that ``apm install`` recorded in
+``apm.lock.yaml`` under ``deployed_files`` + ``deployed_file_hashes``:
+
+* ``--format plugin`` (:mod:`apm_cli.bundle.plugin_exporter`)
+* ``--format apm``    (:mod:`apm_cli.bundle.packer`)
+
+Before a byte enters a bundle its on-disk copy is verified against the
+attested SHA-256 recorded at install time. A file that was tampered or
+corrupted after ``apm install`` must never enter a bundle silently. Keeping
+the check in ONE place gives both pack paths identical semantics and avoids a
+copy-pasted block that would trip the pylint R0801 duplication gate.
+
+Tolerance rule (forward-compat): a file with *no* recorded hash -- either an
+older lockfile with an empty ``deployed_file_hashes`` or a specific path with
+no recorded entry -- is packed without verification. Absence of an attestation
+is tolerated; a *mismatched* attestation is a hard error. The unverified gap
+is surfaced as a debug diagnostic so ``apm audit``-minded users can see it.
+"""
+
+import logging
+from pathlib import Path
+
+from ..utils.content_hash import compute_file_hash
+
+_logger = logging.getLogger(__name__)
+
+
+def verify_attested_file(
+    source: Path,
+    expected_hash: str | None,
+    dep_label: str,
+    rel_display: str,
+) -> None:
+    """Fail loudly when *source* diverges from its attested SHA-256.
+
+    Args:
+        source: On-disk file being packed.
+        expected_hash: The ``"sha256:<hex>"`` recorded in
+            ``deployed_file_hashes``, or ``None`` when no hash was recorded.
+        dep_label: Dependency identifier (``repo_url``) for the error message.
+        rel_display: Human-readable path shown in diagnostics / errors.
+
+    Raises:
+        ValueError: When a recorded hash exists and the on-disk content does
+            not match it.
+    """
+    if not expected_hash:
+        _logger.debug(
+            "no attested hash for %r from %s; packed without integrity "
+            "verification (older lockfile)",
+            rel_display,
+            dep_label,
+        )
+        return
+    actual = compute_file_hash(source)
+    if actual != expected_hash:
+        raise ValueError(
+            f"Cannot pack dependency {dep_label}: installed file {rel_display!r} "
+            "does not match the hash recorded in apm.lock.yaml. The installed "
+            "copy may be stale or tampered. Run 'apm install' to restore "
+            "attested content, then pack again."
+        )

{apm_cli-0.23.1 → apm_cli-0.24.1}/src/apm_cli/bundle/packer.py

@@ -13,6 +13,7 @@ from ..utils.archive import (
     write_tar_archive,
     write_zip_archive,
 )
+from .attest import verify_attested_file
 from .lockfile_enrichment import _filter_files_by_target, enrich_lockfile_for_pack
 
 
@@ -158,10 +159,19 @@ def pack_bundle(
     #    not portable and is bundled separately via the project's own files
     #    (or rejected outright at L89-97 for manifest-declared local deps).
     all_deployed: list[str] = []
+    # Provenance map: deployed-path -> (attested SHA-256, dependency label).
+    # ``deployed_file_hashes`` is keyed by the on-disk deployed path recorded
+    # at install time (see install/phases/lockfile.compute_deployed_hashes), so
+    # verification below must look up the on-disk path, not the bundle path.
+    deployed_hashes: dict[str, str] = {}
+    hash_dep_labels: dict[str, str] = {}
     for dep in lockfile.get_all_dependencies():
         if dep.source == "local":
             continue
         all_deployed.extend(dep.deployed_files)
+        for _dpath, _dhash in dep.deployed_file_hashes.items():
+            deployed_hashes[_dpath] = _dhash
+            hash_dep_labels[_dpath] = dep.repo_url
 
     filtered_files, path_mappings = _filter_files_by_target(all_deployed, effective_target)
     # Deduplicate while preserving order
@@ -250,7 +260,12 @@ def pack_bundle(
     bundle_dir.mkdir(parents=True, exist_ok=True)
     bundle_dir_resolved = bundle_dir.resolve()
 
-    # 7. Copy files preserving directory structure
+    # 7. Copy files preserving directory structure.
+    #    Provenance gate (#2013): each dependency file recorded in the lockfile
+    #    is verified against its attested SHA-256 before it enters the bundle --
+    #    the same integrity guarantee the plugin format enforces, applied to the
+    #    default/most-used ``apm`` format. Files with no recorded hash (older
+    #    lockfiles) pack without verification; a mismatch fails loud.
     for rel_path in unique_files:
         # For cross-target mapped files, read from the original disk path
         disk_path = path_mappings.get(rel_path, rel_path)
@@ -264,8 +279,35 @@ def pack_bundle(
         if src.is_dir():
             from ..security.gate import ignore_non_content
 
+            # Verify each contained file's attested hash and re-assert
+            # containment per child. copytree already drops symlinks via
+            # ignore_non_content, but the walk guards against a directory
+            # symlink whose target escapes the project root regardless of the
+            # walker's version-specific symlink-following behaviour.
+            disk_base = disk_path.rstrip("/")
+            for child in sorted(src.rglob("*")):
+                if not child.is_file() or child.is_symlink():
+                    continue
+                if not child.resolve().is_relative_to(project_root_resolved):
+                    raise ValueError(
+                        f"Refusing to pack path that escapes project root: "
+                        f"{child.relative_to(project_root)!r}"
+                    )
+                child_key = f"{disk_base}/{child.relative_to(src).as_posix()}"
+                verify_attested_file(
+                    child,
+                    deployed_hashes.get(child_key),
+                    hash_dep_labels.get(child_key, "dependency"),
+                    child_key,
+                )
             shutil.copytree(src, dest, dirs_exist_ok=True, ignore=ignore_non_content)
         else:
+            verify_attested_file(
+                src,
+                deployed_hashes.get(disk_path),
+                hash_dep_labels.get(disk_path, "dependency"),
+                disk_path,
+            )
             dest.parent.mkdir(parents=True, exist_ok=True)
             shutil.copy2(src, dest, follow_symlinks=False)
 

{apm_cli-0.23.1 → apm_cli-0.24.1}/src/apm_cli/bundle/plugin_exporter.py

@@ -11,7 +11,7 @@ import hashlib
 import json
 import re
 import shutil
-from pathlib import Path, PurePosixPath
+from pathlib import Path, PurePosixPath, PureWindowsPath
 
 import yaml
 
@@ -30,6 +30,7 @@ from ..utils.archive import (
 )
 from ..utils.console import _rich_warning
 from ..utils.path_security import PathTraversalError, ensure_path_within, safe_rmtree
+from .attest import verify_attested_file
 from .packer import PackResult
 
 # ---------------------------------------------------------------------------
@@ -417,6 +418,217 @@ def _dep_install_path(dep: LockedDependency, apm_modules_dir: Path) -> Path:
     return dep_ref.get_install_path(apm_modules_dir)
 
 
+def _deployed_path_parts(rel_path: str) -> tuple[str, ...]:
+    """Return safe POSIX path parts for a lockfile deployed_files entry."""
+    rel = rel_path.replace("\\", "/")
+    pure = PurePosixPath(rel)
+    if pure.is_absolute() or PureWindowsPath(rel).is_absolute():
+        raise ValueError(f"Refusing to pack absolute deployed file path: {rel_path!r}")
+    parts = pure.parts
+    if any(part in ("", ".", "..") for part in parts):
+        raise ValueError(f"Refusing to pack unsafe deployed file path: {rel_path!r}")
+    return parts
+
+
+def _skill_name_from_deployed_parts(parts: tuple[str, ...]) -> str | None:
+    """Return the deployed skill name when *parts* point inside a skills dir."""
+    if len(parts) >= 3 and parts[0].startswith(".") and parts[1] == "skills":
+        return parts[2]
+    if len(parts) >= 2 and parts[0] == "skills":
+        return parts[1]
+    return None
+
+
+def _plugin_rel_for_deployed_path(
+    rel_path: str,
+    skill_subset: set[str] | None,
+) -> str | None:
+    """Map an installed deployed_files path back to plugin-native output layout."""
+    parts = _deployed_path_parts(rel_path)
+    if not parts:
+        return None
+
+    if parts[0] == "skills":
+        skill_name = _skill_name_from_deployed_parts(parts)
+        if skill_subset and (skill_name is None or skill_name not in skill_subset):
+            return None
+        plugin_parts = list(parts)
+    elif parts[0] in {"agents", "commands", "instructions", "extensions"}:
+        plugin_parts = list(parts)
+    elif len(parts) >= 3 and parts[0].startswith("."):
+        skill_name = _skill_name_from_deployed_parts(parts)
+        if skill_name is not None:
+            if skill_subset and skill_name not in skill_subset:
+                return None
+            plugin_parts = ["skills", *parts[2:]]
+        elif parts[1] == "agents":
+            plugin_parts = ["agents", *parts[2:]]
+        elif parts[1] in {"commands", "prompts"}:
+            plugin_parts = ["commands", *parts[2:]]
+        elif parts[1] in {"instructions", "rules", "steering"}:
+            plugin_parts = ["instructions", *parts[2:]]
+        elif parts[1] == "extensions":
+            plugin_parts = ["extensions", *parts[2:]]
+        elif parts[1] == "hooks":
+            plugin_parts = ["hooks", *parts[2:]]
+        else:
+            return None
+    elif len(parts) >= 2 and parts[0].startswith(".") and parts[1] == "hooks.json":
+        plugin_parts = ["hooks.json"]
+    else:
+        return None
+
+    if plugin_parts[0] == "commands" and plugin_parts[-1].endswith(".prompt.md"):
+        plugin_parts[-1] = _rename_prompt(plugin_parts[-1])
+    return PurePosixPath(*plugin_parts).as_posix()
+
+
+def _verify_attested_hash(
+    source: Path,
+    project_root: Path,
+    dep: LockedDependency,
+) -> None:
+    """Fail loudly when a packed deployed file diverges from its attested hash.
+
+    ``deployed_file_hashes`` records the SHA-256 (``"sha256:<hex>"``) of each
+    file at install time. Verifying the on-disk copy before packing closes the
+    integrity half of the provenance hole: a deployed file that was tampered
+    or corrupted after ``apm install`` must never enter the bundle silently.
+
+    Files with no recorded hash (older lockfiles predating
+    ``deployed_file_hashes``) are packed without verification -- absence of an
+    attestation is forward-compat tolerated, presence of a *mismatched* one is
+    a hard error. Delegates to the shared :func:`verify_attested_file` helper so
+    the plugin and archive pack paths share one implementation.
+    """
+    rel = source.relative_to(project_root).as_posix()
+    expected = dep.deployed_file_hashes.get(rel) if dep.deployed_file_hashes else None
+    verify_attested_file(source, expected, dep.repo_url, rel)
+
+
+def _append_deployed_component(
+    components: list[tuple[Path, str]],
+    source: Path,
+    output_rel: str,
+    seen_outputs: set[str],
+    project_root: Path,
+    dep: LockedDependency,
+) -> None:
+    """Append one deployed component unless it is unsafe or already mapped."""
+    if output_rel in seen_outputs or not _validate_output_rel(output_rel):
+        return
+    if source.is_file() and not source.is_symlink():
+        _verify_attested_hash(source, project_root, dep)
+        components.append((source, output_rel))
+        seen_outputs.add(output_rel)
+
+
+def _collect_deployed_components(
+    project_root: Path,
+    dep: LockedDependency,
+) -> list[tuple[Path, str]]:
+    """Collect dependency components from lockfile deployed_files entries."""
+    components: list[tuple[Path, str]] = []
+    missing: list[str] = []
+    seen_outputs: set[str] = set()
+    skill_subset = set(dep.skill_subset) if dep.skill_subset else None
+
+    for rel_path in dep.deployed_files:
+        try:
+            plugin_rel = _plugin_rel_for_deployed_path(rel_path, skill_subset)
+        except ValueError as exc:
+            raise ValueError(f"Cannot pack dependency {dep.repo_url}: {exc}") from exc
+        if plugin_rel is None:
+            continue
+        source = project_root / rel_path
+        try:
+            source = ensure_path_within(source, project_root)
+        except PathTraversalError as exc:
+            raise ValueError(
+                f"Cannot pack dependency {dep.repo_url}: deployed file path "
+                f"escapes the project root: {rel_path!r}"
+            ) from exc
+        if not source.exists():
+            missing.append(rel_path)
+            continue
+        if source.is_symlink():
+            continue
+        if source.is_dir():
+            for child in sorted(source.rglob("*")):
+                if not child.is_file() or child.is_symlink():
+                    continue
+                # Defense-in-depth: rglob's symlink-following behaviour is
+                # Python-version dependent, so re-assert containment on every
+                # expanded child rather than trusting the walk. A planted
+                # directory symlink whose target escapes ``project_root`` is
+                # rejected here even if an intermediate component was a symlink.
+                try:
+                    ensure_path_within(child, project_root)
+                except PathTraversalError:
+                    continue
+                child_rel = child.relative_to(source).as_posix()
+                child_output = (PurePosixPath(plugin_rel) / child_rel).as_posix()
+                _append_deployed_component(
+                    components, child, child_output, seen_outputs, project_root, dep
+                )
+        else:
+            _append_deployed_component(
+                components, source, plugin_rel, seen_outputs, project_root, dep
+            )
+
+    if missing:
+        shown_missing = missing[:10]
+        remaining = len(missing) - len(shown_missing)
+        suffix = f"\n  ... and {remaining} more" if remaining else ""
+        raise ValueError(
+            f"Cannot pack dependency {dep.repo_url}: installed files recorded "
+            "in apm.lock.yaml are missing on disk. Run 'apm install' to "
+            "restore them, then pack again:\n"
+            + "\n".join(f"  - {path}" for path in shown_missing)
+            + suffix
+        )
+    return components
+
+
+def _cache_would_contribute_primitives(install_path: Path, dep: LockedDependency) -> bool:
+    """Return True if the unattested apm_modules cache holds packable primitives.
+
+    Used ONLY to decide whether to fail loudly when a locked dependency records
+    no ``deployed_files``. This reads the cache to DETECT a provenance gap; it
+    never copies cache bytes into the bundle. A dependency that installed
+    real components but recorded none of them in the lockfile is a stale or
+    partial install -- packing its cache would leak unattested content, so we
+    refuse rather than silently pack it.
+    """
+    if not install_path.is_dir():
+        return False
+    probe = _collect_apm_components(install_path / ".apm")
+    probe.extend(_collect_root_plugin_components(install_path))
+    _collect_bare_skill(install_path, dep, probe)
+    return bool(probe)
+
+
+def _cache_would_contribute_hooks_or_mcp(install_path: Path) -> bool:
+    """Return True if the unattested cache holds hooks-config or MCP-config.
+
+    Hooks/MCP *configuration* (``.apm/hooks/*.json``, root ``hooks.json`` /
+    ``hooks/``, ``.mcp.json``) is merged into shared host settings by
+    ``apm install`` and is never recorded in the lockfile ``deployed_files``.
+    Because plugin pack now emits only lockfile-attested content, such config
+    is dropped from the bundle. This probe drives a transition warning that
+    names the dependency whose cached config will NOT be packed; it never
+    copies cache bytes. Hook *scripts* recorded in ``deployed_files`` are
+    unaffected and still pack.
+    """
+    if not install_path.is_dir():
+        return False
+    if _collect_mcp(install_path):
+        return True
+    if _collect_hooks_from_apm(install_path / ".apm"):
+        return True
+    return bool(_collect_hooks_from_root(install_path))
+
+
 # ---------------------------------------------------------------------------
 # Main exporter
 # ---------------------------------------------------------------------------
@@ -500,34 +712,59 @@ def export_plugin_bundle(
             ):
                 continue
 
-            install_path = _dep_install_path(dep, apm_modules_dir)
-            if not install_path.is_dir():
-                continue
-
             dep_name = dep.repo_url
 
-            # Collect from .apm/
-            dep_apm_dir = install_path / ".apm"
-            dep_components = _collect_apm_components(dep_apm_dir)
-
-            # Also collect root-level plugin-native dirs from the dep
-            dep_components.extend(_collect_root_plugin_components(install_path))
-
-            # Bare Claude skills: SKILL.md at dep root with no skills/ subdir
-            _collect_bare_skill(install_path, dep, dep_components)
+            # Provenance rule (issue #1999 follow-up): a dependency's content
+            # is packed EXCLUSIVELY from what the lockfile attests via
+            # ``deployed_files`` (+ per-file ``deployed_file_hashes``).
+            # ``apm_modules`` is an unattested cache -- it carries no integrity
+            # or provenance guarantee, so no bytes from it may reach the bundle.
+            install_path = _dep_install_path(dep, apm_modules_dir)
+            if dep.deployed_files:
+                dep_components = _collect_deployed_components(project_root, dep)
+                if dep.skill_subset and not dep_components:
+                    declared_skills = ", ".join(dep.skill_subset)
+                    raise ValueError(
+                        f"Cannot pack dependency {dep.repo_url}: the skills "
+                        f"recorded in apm.lock.yaml (skill_subset: {declared_skills}) "
+                        "were not found among its installed files. Run 'apm install' "
+                        "to re-deploy the expected skills, then pack again."
+                    )
+            elif _cache_would_contribute_primitives(install_path, dep):
+                # Unattested primitives sit in the cache but the lockfile
+                # recorded none of them: a stale or partial install. Refuse
+                # to pack the cache -- fail loudly with a fix.
+                raise ValueError(
+                    f"Cannot pack dependency {dep.repo_url}: the lockfile records "
+                    "no deployed files for it, but installed content that cannot "
+                    "be verified exists in the apm_modules cache (a stale or "
+                    "partial install). Run 'apm install' to record provenance in "
+                    "apm.lock.yaml, then pack again."
+                )
+            else:
+                # No attested content and nothing packable in the cache: the
+                # dependency contributes no plugin primitives (e.g. an
+                # MCP-only or hooks-config-only package). Skip it cleanly.
+                dep_components = []
+
+            # Transition warning (#2013): dependency hooks/MCP *config* lives in
+            # the unattested cache and is never packed. Name the dependency so
+            # an author who relied on it merging into shared settings is not
+            # surprised by the silent exclusion. Attested primitives are packed
+            # regardless of this warning.
+            if _cache_would_contribute_hooks_or_mcp(install_path):
+                _warn = (
+                    f"dependency {dep.repo_url} contributed hooks/MCP config that "
+                    "is not attested in apm.lock.yaml; it will NOT be packed. "
+                    "Attested primitives (skills/agents/etc.) are unaffected."
+                )
+                if logger:
+                    logger.warning(_warn)
+                else:
+                    _rich_warning(_warn, symbol="warning")
 
             _merge_file_map(file_map, dep_components, dep_name, force, collisions)
 
-            # Hooks -- deps merge (first wins among deps)
-            dep_hooks = _collect_hooks_from_apm(dep_apm_dir)
-            dep_hooks_root = _collect_hooks_from_root(install_path)
-            _deep_merge(dep_hooks, dep_hooks_root, overwrite=False)
-            _deep_merge(merged_hooks, dep_hooks, overwrite=False)
-
-            # MCP -- deps merge (first wins among deps)
-            dep_mcp = _collect_mcp(install_path)
-            _deep_merge(merged_mcp, dep_mcp, overwrite=False)
-
     # 6. Collect own components (.apm/ and root-level)
     own_apm_dir = project_root / ".apm"
     own_components = _collect_apm_components(own_apm_dir)