claude-mpm 5.4.22__py3-none-any.whl → 5.6.34__py3-none-any.whl

claude_mpm/init.py

@@ -163,6 +163,15 @@ class ProjectInitializer:
                         f"✓ Found {agent_count} project agent(s) in .claude-mpm/agents/"
                     )
 
+            # Verify and deploy PM skills (non-blocking)
+            self._verify_and_deploy_pm_skills(project_root, is_mcp_mode)
+
+            # Setup security hooks (auto-install pre-commit, detect-secrets)
+            self._setup_security_hooks(project_root, is_mcp_mode)
+
+            # Perform security checks (non-blocking)
+            self._check_security_risks(project_root, is_mcp_mode)
+
             return True
 
         except Exception as e:
@@ -170,6 +179,68 @@ class ProjectInitializer:
             print(f"✗ Failed to create .claude-mpm/ directory: {e}")
             return False
 
+    def _verify_and_deploy_pm_skills(
+        self, project_root: Path, is_mcp_mode: bool = False
+    ) -> None:
+        """Verify PM skills are deployed and auto-deploy if missing.
+
+        Non-blocking operation that gracefully handles errors.
+
+        Args:
+            project_root: Project root directory
+            is_mcp_mode: Whether running in MCP mode (suppress console output)
+        """
+        try:
+            from claude_mpm.services.pm_skills_deployer import PMSkillsDeployerService
+
+            deployer = PMSkillsDeployerService()
+            result = deployer.verify_pm_skills(project_root)
+
+            if not result.verified:
+                # Log warnings
+                for warning in result.warnings:
+                    self.logger.warning(warning)
+
+                # Auto-deploy PM skills
+                self.logger.info("Auto-deploying PM skills...")
+                deploy_result = deployer.deploy_pm_skills(project_root)
+
+                if deploy_result.success:
+                    self.logger.info(
+                        f"PM skills deployed: {len(deploy_result.deployed)} deployed, "
+                        f"{len(deploy_result.skipped)} skipped"
+                    )
+
+                    # Print to console if not in MCP mode
+                    if not is_mcp_mode:
+                        if deploy_result.deployed:
+                            print(
+                                f"✓ Deployed {len(deploy_result.deployed)} PM skill(s) "
+                                f"to .claude/skills/"
+                            )
+                else:
+                    self.logger.warning(
+                        f"PM skills deployment had errors: {len(deploy_result.errors)}"
+                    )
+                    if not is_mcp_mode and deploy_result.errors:
+                        print(
+                            f"⚠ PM skills deployment had {len(deploy_result.errors)} error(s)"
+                        )
+            else:
+                # Skills verified successfully
+                registry = deployer._load_registry(project_root)
+                skill_count = len(registry.get("skills", []))
+                self.logger.debug(f"PM skills verified: {skill_count} skills")
+
+                if not is_mcp_mode and skill_count > 0:
+                    print(f"✓ Verified {skill_count} PM skill(s)")
+
+        except ImportError:
+            self.logger.debug("PM skills deployer not available")
+        except Exception as e:
+            self.logger.warning(f"PM skills verification failed: {e}")
+            # Don't print to console - this is a non-critical failure
+
     def _migrate_project_agents(self):
         """Migrate agents from old subdirectory structure to direct agents directory.
 
@@ -319,6 +390,211 @@ class ProjectInitializer:
                 if not dst_file.exists():
                     shutil.copy2(template_file, dst_file)
 
+    def _setup_security_hooks(
+        self, project_root: Path, is_mcp_mode: bool = False
+    ) -> None:
+        """Automatically install pre-commit hooks for secret scanning.
+
+        This method:
+        1. Installs pre-commit and detect-secrets if missing
+        2. Copies .pre-commit-config.yaml to project root
+        3. Runs pre-commit install to set up git hooks
+        4. Creates .secrets.baseline for detect-secrets
+
+        Args:
+            project_root: Project root directory
+            is_mcp_mode: Whether running in MCP mode (suppress console output)
+        """
+        try:
+            import subprocess
+
+            # Only set up hooks if this is a git repository
+            if not (project_root / ".git").exists():
+                self.logger.debug("Not a git repository, skipping security hooks setup")
+                return
+
+            # Check/install pre-commit
+            try:
+                subprocess.run(
+                    ["pre-commit", "--version"],
+                    capture_output=True,
+                    text=True,
+                    timeout=2,
+                    check=True,
+                )
+            except (
+                subprocess.CalledProcessError,
+                subprocess.TimeoutExpired,
+                FileNotFoundError,
+            ):
+                self.logger.info("Installing pre-commit...")
+                try:
+                    subprocess.run(
+                        [sys.executable, "-m", "pip", "install", "pre-commit"],
+                        capture_output=True,
+                        text=True,
+                        timeout=60,
+                        check=True,
+                    )
+                    self.logger.info("pre-commit installed successfully")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to install pre-commit: {e}")
+                    return
+
+            # Check/install detect-secrets
+            try:
+                subprocess.run(
+                    ["detect-secrets", "--version"],
+                    capture_output=True,
+                    text=True,
+                    timeout=2,
+                    check=True,
+                )
+            except (
+                subprocess.CalledProcessError,
+                subprocess.TimeoutExpired,
+                FileNotFoundError,
+            ):
+                self.logger.info("Installing detect-secrets...")
+                try:
+                    subprocess.run(
+                        [sys.executable, "-m", "pip", "install", "detect-secrets"],
+                        capture_output=True,
+                        text=True,
+                        timeout=60,
+                        check=True,
+                    )
+                    self.logger.info("detect-secrets installed successfully")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to install detect-secrets: {e}")
+                    return
+
+            # Copy .pre-commit-config.yaml to project root if it doesn't exist
+            precommit_config = project_root / ".pre-commit-config.yaml"
+            if not precommit_config.exists():
+                template_dir = Path(__file__).parent / "templates"
+                template_config = template_dir / ".pre-commit-config.yaml"
+
+                if template_config.exists():
+                    shutil.copy2(template_config, precommit_config)
+                    self.logger.info("Copied .pre-commit-config.yaml to project root")
+                else:
+                    self.logger.warning("Template .pre-commit-config.yaml not found")
+                    return
+
+            # Create .secrets.baseline if it doesn't exist
+            secrets_baseline = project_root / ".secrets.baseline"
+            if not secrets_baseline.exists():
+                try:
+                    subprocess.run(
+                        ["detect-secrets", "scan", "--baseline", ".secrets.baseline"],
+                        cwd=str(project_root),
+                        capture_output=True,
+                        text=True,
+                        timeout=30,
+                        check=True,
+                    )
+                    self.logger.info("Created .secrets.baseline")
+                except subprocess.CalledProcessError as e:
+                    self.logger.warning(f"Failed to create .secrets.baseline: {e}")
+
+            # Install git hooks
+            try:
+                subprocess.run(
+                    ["pre-commit", "install"],
+                    cwd=str(project_root),
+                    capture_output=True,
+                    text=True,
+                    timeout=30,
+                    check=True,
+                )
+                self.logger.info("Pre-commit hooks installed in git repository")
+
+                if not is_mcp_mode:
+                    print("✓ Security hooks installed (pre-commit + detect-secrets)")
+
+            except subprocess.CalledProcessError as e:
+                self.logger.warning(f"Failed to install pre-commit hooks: {e}")
+
+        except Exception as e:
+            self.logger.debug(f"Security hooks setup failed: {e}")
+            # Don't print to console - this is a non-critical failure
+
+    def _check_security_risks(
+        self, project_root: Path, is_mcp_mode: bool = False
+    ) -> None:
+        """Check for potential security risks like exposed config files.
+
+        Non-blocking operation that warns about security issues.
+
+        Args:
+            project_root: Project root directory
+            is_mcp_mode: Whether running in MCP mode (suppress console output)
+        """
+        try:
+            import subprocess
+
+            security_issues = []
+
+            # Common secret file patterns to check
+            secret_patterns = [
+                ".mcp-vector-search/config.json",
+                ".mcp/config.json",
+                "openrouter.json",
+                "anthropic-config.json",
+                "credentials.json",
+                "secrets.json",
+                "api-keys.json",
+            ]
+
+            for pattern in secret_patterns:
+                file_path = project_root / pattern
+                if file_path.exists():
+                    # Check if file is tracked by git
+                    try:
+                        result = subprocess.run(
+                            ["git", "ls-files", str(file_path)],
+                            check=False,
+                            cwd=str(project_root),
+                            capture_output=True,
+                            text=True,
+                            timeout=2,
+                        )
+                        if result.stdout.strip():
+                            security_issues.append(
+                                f"⚠️  SECURITY: {pattern} is tracked by git (may contain secrets)"
+                            )
+                    except (subprocess.TimeoutExpired, FileNotFoundError):
+                        pass
+
+                    # Check if file is ignored by .gitignore
+                    try:
+                        result = subprocess.run(
+                            ["git", "check-ignore", str(file_path)],
+                            check=False,
+                            cwd=str(project_root),
+                            capture_output=True,
+                            text=True,
+                            timeout=2,
+                        )
+                        if result.returncode != 0:  # File NOT ignored
+                            security_issues.append(
+                                f"⚠️  WARNING: {pattern} exists but not in .gitignore"
+                            )
+                    except (subprocess.TimeoutExpired, FileNotFoundError):
+                        pass
+
+            # Print security warnings if not in MCP mode
+            if security_issues and not is_mcp_mode:
+                print("\n🔒 Security Check:")
+                for issue in security_issues:
+                    print(f"   {issue}")
+                print()
+
+        except Exception as e:
+            self.logger.debug(f"Security check failed: {e}")
+            # Don't print to console - this is a non-critical failure
+
     def validate_dependencies(self) -> Dict[str, bool]:
         """Validate that all required dependencies are available."""
         dependencies = {}

claude_mpm/models/git_repository.py

@@ -34,7 +34,7 @@ class GitRepository:
     def cache_path(self) -> Path:
         """Return cache directory path for this repository.
 
-        Cache structure: ~/.claude-mpm/cache/remote-agents/{owner}/{repo}/{subdirectory}/
+        Cache structure: ~/.claude-mpm/cache/agents/{owner}/{repo}/{subdirectory}/
 
         Returns:
             Absolute path to cache directory for this repository
@@ -45,10 +45,10 @@ class GitRepository:
             ...     subdirectory="agents"
             ... )
             >>> repo.cache_path
-            Path('/Users/user/.claude-mpm/cache/remote-agents/bobmatnyc/claude-mpm-agents/agents')
+            Path('/Users/user/.claude-mpm/cache/agents/bobmatnyc/claude-mpm-agents/agents')
         """
         home = Path.home()
-        base_cache = home / ".claude-mpm" / "cache" / "remote-agents"
+        base_cache = home / ".claude-mpm" / "cache" / "agents"
 
         # Extract owner and repo from URL
         owner, repo = self._parse_github_url(self.url)

claude_mpm/scripts/claude-hook-handler.sh

@@ -62,8 +62,13 @@ set -e
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 # Determine the claude-mpm root based on installation type
+# Check if we're in a UV tools installation
+if [[ "$SCRIPT_DIR" == *"/.local/share/uv/tools/"* ]]; then
+    # UV tools installation - script is at lib/python*/site-packages/claude_mpm/scripts/
+    # The tool root is what we need for Python detection
+    CLAUDE_MPM_ROOT="$(echo "$SCRIPT_DIR" | sed 's|/lib/python.*/site-packages.*||')"
 # Check if we're in a pipx installation
-if [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
+elif [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
     # pipx installation - script is at lib/python*/site-packages/claude_mpm/scripts/
     # The venv root is what we need for Python detection
     CLAUDE_MPM_ROOT="$(echo "$SCRIPT_DIR" | sed 's|/lib/python.*/site-packages/.*||')"
@@ -89,11 +94,12 @@ fi
 # STRATEGY:
 # This function implements a fallback chain to find Python with claude-mpm dependencies:
 # 1. UV-managed projects (uv.lock detected) - uses "uv run python"
-# 2. pipx installations - uses pipx venv Python
-# 3. Project-specific virtual environments (venv, .venv)
-# 4. Currently active virtual environment ($VIRTUAL_ENV)
-# 5. System python3 (may lack dependencies)
-# 6. System python (last resort)
+# 2. UV tools installations (~/.local/share/uv/tools/) - uses tool's venv Python
+# 3. pipx installations - uses pipx venv Python
+# 4. Project-specific virtual environments (venv, .venv)
+# 5. Currently active virtual environment ($VIRTUAL_ENV)
+# 6. System python3 (may lack dependencies)
+# 7. System python (last resort)
 #
 # WHY THIS APPROACH:
 # - Claude MPM requires specific packages (socketio, eventlet) not in system Python
@@ -119,12 +125,26 @@ find_python_command() {
     # 1. Check for UV project first (uv.lock or pyproject.toml with uv)
     if [ -f "$CLAUDE_MPM_ROOT/uv.lock" ]; then
         if command -v uv &> /dev/null; then
-            echo "uv run python"
+            echo "uv run --directory \"$CLAUDE_MPM_ROOT\" python"
             return
         fi
     fi
 
-    # 2. Check if we're in a pipx installation
+    # 2. Check if we're in a UV tools installation
+    if [[ "$SCRIPT_DIR" == *"/.local/share/uv/tools/"* ]]; then
+        # UV tools installation - extract the tool root directory
+        CLAUDE_MPM_ROOT="$(echo "$SCRIPT_DIR" | sed 's|/lib/python.*/site-packages.*||')"
+        local uv_python="$CLAUDE_MPM_ROOT/bin/python"
+        if [ -x "$uv_python" ]; then
+            if [ "${CLAUDE_MPM_HOOK_DEBUG}" = "true" ]; then
+                echo "[$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)] UV tools Python found: $uv_python" >> /tmp/claude-mpm-hook.log
+            fi
+            echo "$uv_python"
+            return
+        fi
+    fi
+
+    # 3. Check if we're in a pipx installation
     if [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
         # pipx installation - use the pipx venv's Python directly
         if [ -f "$CLAUDE_MPM_ROOT/bin/python" ]; then
@@ -133,7 +153,7 @@ find_python_command() {
         fi
     fi
 
-    # 3. Check for project-local virtual environment (common in development)
+    # 4. Check for project-local virtual environment (common in development)
     if [ -f "$CLAUDE_MPM_ROOT/venv/bin/activate" ]; then
         source "$CLAUDE_MPM_ROOT/venv/bin/activate"
         echo "$CLAUDE_MPM_ROOT/venv/bin/python"
@@ -154,7 +174,13 @@ find_python_command() {
 PYTHON_CMD=$(find_python_command)
 
 # Check installation type and set PYTHONPATH accordingly
-if [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
+if [[ "$SCRIPT_DIR" == *"/.local/share/uv/tools/"* ]]; then
+    # UV tools installation - claude_mpm is already in the tool's site-packages
+    # No need to modify PYTHONPATH
+    if [ "${CLAUDE_MPM_HOOK_DEBUG}" = "true" ]; then
+        echo "[$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)] UV tools installation detected" >> /tmp/claude-mpm-hook.log
+    fi
+elif [[ "$SCRIPT_DIR" == *"/.local/pipx/venvs/claude-mpm/"* ]]; then
     # pipx installation - claude_mpm is already in the venv's site-packages
     # No need to modify PYTHONPATH
     if [ "${CLAUDE_MPM_HOOK_DEBUG}" = "true" ]; then
@@ -193,16 +219,16 @@ log_debug() {
 
 # Test Python works and module exists
 # Handle UV's multi-word command specially
-if [[ "$PYTHON_CMD" == "uv run python" ]]; then
-    if ! uv run python -c "import claude_mpm" 2>/dev/null; then
+if [[ "$PYTHON_CMD" == "uv run"* ]]; then
+    if ! uv run --directory "$CLAUDE_MPM_ROOT" python -c "import claude_mpm" 2>/dev/null; then
         log_debug "claude_mpm module not available, continuing without hook"
-        echo '{"action": "continue"}'
+        echo '{"continue": true}'
         exit 0
     fi
 else
     if ! $PYTHON_CMD -c "import claude_mpm" 2>/dev/null; then
         log_debug "claude_mpm module not available, continuing without hook"
-        echo '{"action": "continue"}'
+        echo '{"continue": true}'
         exit 0
     fi
 fi
@@ -210,10 +236,11 @@ fi
 # Run the Python hook handler with all input
 # Use exec to replace the shell process with Python
 # Handle UV's multi-word command specially
-if [[ "$PYTHON_CMD" == "uv run python" ]]; then
-    exec uv run python -m claude_mpm.hooks.claude_hooks.hook_handler "$@" 2>/tmp/claude-mpm-hook-error.log
+# Suppress RuntimeWarning to prevent stderr output (which causes hook errors)
+if [[ "$PYTHON_CMD" == "uv run"* ]]; then
+    exec uv run --directory "$CLAUDE_MPM_ROOT" python -W ignore::RuntimeWarning -m claude_mpm.hooks.claude_hooks.hook_handler "$@" 2>/tmp/claude-mpm-hook-error.log
 else
-    exec "$PYTHON_CMD" -m claude_mpm.hooks.claude_hooks.hook_handler "$@" 2>/tmp/claude-mpm-hook-error.log
+    exec "$PYTHON_CMD" -W ignore::RuntimeWarning -m claude_mpm.hooks.claude_hooks.hook_handler "$@" 2>/tmp/claude-mpm-hook-error.log
 fi
 
 # Note: exec replaces the shell process, so code below only runs if exec fails
@@ -223,5 +250,5 @@ if [ "${CLAUDE_MPM_HOOK_DEBUG}" = "true" ]; then
     echo "[$(date -u +%Y-%m-%dT%H:%M:%S.%3NZ)] Error: $(cat /tmp/claude-mpm-hook-error.log 2>/dev/null | head -5)" >> /tmp/claude-mpm-hook.log
 fi
 # Return continue action to prevent blocking Claude Code
-echo '{"action": "continue"}'
-exit 0
+echo '{"continue": true}'
+exit 0

claude_mpm/services/agents/agent_builder.py

@@ -206,8 +206,8 @@ class AgentBuilderService:
         """
         errors = []
 
-        # Required fields
-        required_fields = ["id", "name", "prompt", "model"]
+        # Required fields (model is optional - defaults to sonnet if not specified)
+        required_fields = ["id", "name", "prompt"]
         for field in required_fields:
             if field not in config:
                 errors.append(f"Missing required field: {field}")
@@ -219,7 +219,7 @@ class AgentBuilderService:
             except AgentDeploymentError as e:
                 errors.append(str(e))
 
-        # Validate model
+        # Validate model (only if present)
         if "model" in config:
             try:
                 self._validate_model(config["model"])

claude_mpm/services/agents/agent_recommendation_service.py

@@ -30,16 +30,16 @@ class AgentRecommendationService:
     Can be used by CLI, API, or future auto-configuration features.
     """
 
-    # Core agents always included - matches ToolchainDetector.CORE_AGENTS
+    # Core agents always included - Standard 6 core agents for essential PM workflow
+    # These agents are auto-deployed when no configuration exists
     # Uses exact agent IDs from repository for consistency
     CORE_AGENTS = {
-        "engineer",
-        "qa-agent",
-        "memory-manager-agent",
-        "local-ops-agent",
-        "research-agent",
-        "documentation-agent",
-        "security-agent",
+        "engineer",  # General-purpose implementation
+        "research",  # Codebase exploration and analysis
+        "qa",  # Testing and quality assurance
+        "documentation",  # Documentation generation
+        "ops",  # Basic deployment operations
+        "ticketing",  # Ticket tracking (essential for PM workflow)
     }
 
     # Map detected languages to recommended engineer agents

claude_mpm/services/agents/agent_selection_service.py

@@ -39,10 +39,10 @@ import logging
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Set, Tuple
 
-from src.claude_mpm.services.agents.single_tier_deployment_service import (
+from claude_mpm.services.agents.single_tier_deployment_service import (
     SingleTierDeploymentService,
 )
-from src.claude_mpm.services.agents.toolchain_detector import ToolchainDetector
+from claude_mpm.services.agents.toolchain_detector import ToolchainDetector
 
 logger = logging.getLogger(__name__)
 

claude_mpm/services/agents/cache_git_manager.py

@@ -29,7 +29,7 @@ Error Handling:
 
 Example:
     >>> from pathlib import Path
-    >>> manager = CacheGitManager(Path.home() / ".claude-mpm/cache/remote-agents")
+    >>> manager = CacheGitManager(Path.home() / ".claude-mpm/cache/agents")
     >>> if manager.is_git_repo():
     ...     status = manager.get_status()
     ...     print(f"Branch: {status['branch']}, Uncommitted: {len(status['uncommitted'])}")
@@ -76,7 +76,7 @@ class CacheGitManager:
             timeout: Git command timeout in seconds (default: 30)
 
         Example:
-            >>> cache_dir = Path.home() / ".claude-mpm/cache/remote-agents"
+            >>> cache_dir = Path.home() / ".claude-mpm/cache/agents"
             >>> manager = CacheGitManager(cache_dir)
         """
         self.cache_path = Path(cache_path)
@@ -88,7 +88,7 @@ class CacheGitManager:
         if self.repo_path:
             logger.debug(f"Initialized CacheGitManager for repo: {self.repo_path}")
         else:
-            logger.warning(f"Cache path is not a git repository: {cache_path}")
+            logger.debug(f"Cache path is not a git repository: {cache_path}")
 
     def _find_git_root(self) -> Optional[Path]:
         """
@@ -105,12 +105,12 @@ class CacheGitManager:
 
         Example:
             >>> # Case 1: cache_path inside repo (searches upward)
-            >>> # cache_path: ~/.claude-mpm/cache/remote-agents/bobmatnyc/claude-mpm-agents/agents
-            >>> # Found at: ~/.claude-mpm/cache/remote-agents/bobmatnyc/claude-mpm-agents
+            >>> # cache_path: ~/.claude-mpm/cache/agents/bobmatnyc/claude-mpm-agents/agents
+            >>> # Found at: ~/.claude-mpm/cache/agents/bobmatnyc/claude-mpm-agents
 
             >>> # Case 2: repo nested in cache_path (searches downward)
-            >>> # cache_path: ~/.claude-mpm/cache/remote-agents
-            >>> # Found at: ~/.claude-mpm/cache/remote-agents/bobmatnyc/claude-mpm-agents
+            >>> # cache_path: ~/.claude-mpm/cache/agents
+            >>> # Found at: ~/.claude-mpm/cache/agents/bobmatnyc/claude-mpm-agents
         """
         # Strategy 1: Search upward (cache_path is inside repo)
         current = self.cache_path

claude_mpm/services/agents/deployment/agent_deployment.py

@@ -876,13 +876,13 @@ class AgentDeploymentService(ConfigServiceBase, AgentDeploymentInterface):
             user_agents_dir = potential_user_dir
             self.logger.info(f"Found user agents at: {user_agents_dir}")
 
-        # Check for remote agents (cached from GitHub)
-        remote_agents_dir = None
+        # Check for agents cache (from Git sources)
+        agents_cache_dir = None
         cache_dir = user_home / ".claude-mpm" / "cache"
-        potential_remote_dir = cache_dir / "remote-agents"
-        if potential_remote_dir.exists():
-            remote_agents_dir = potential_remote_dir
-            self.logger.info(f"Found remote agents cache at: {remote_agents_dir}")
+        potential_cache_dir = cache_dir / "agents"
+        if potential_cache_dir.exists():
+            agents_cache_dir = potential_cache_dir
+            self.logger.info(f"Found agents cache at: {agents_cache_dir}")
 
         # Get agents with version comparison and cleanup (4-tier discovery)
         agents_to_deploy, agent_sources, cleanup_results = (
@@ -890,7 +890,7 @@ class AgentDeploymentService(ConfigServiceBase, AgentDeploymentInterface):
                 system_templates_dir=system_templates_dir,
                 project_agents_dir=project_agents_dir,
                 user_agents_dir=user_agents_dir,
-                remote_agents_dir=remote_agents_dir,  # NEW: 4th tier
+                agents_cache_dir=agents_cache_dir,  # NEW: 4th tier
                 working_directory=self.working_directory,
                 excluded_agents=excluded_agents,
                 config=config,
@@ -898,6 +898,9 @@ class AgentDeploymentService(ConfigServiceBase, AgentDeploymentInterface):
             )
         )
 
+        # Keep track of all enabled agents before filtering (for cleanup)
+        all_enabled_agents = agents_to_deploy.copy()
+
         # Compare with deployed versions if agents directory exists
         if agents_dir.exists():
             comparison_results = self.multi_source_service.compare_deployed_versions(
@@ -954,6 +957,25 @@ class AgentDeploymentService(ConfigServiceBase, AgentDeploymentInterface):
                         f"All {len(comparison_results.get('up_to_date', []))} agents are up to date"
                     )
 
+        # Cleanup excluded agents (remove agents not in deployment list)
+        # CRITICAL: Use all_enabled_agents (before filtering for updates) to preserve up-to-date agents
+        # Bug fix (1M-XXX): Previously used filtered agents_to_deploy which could be empty,
+        # causing all agents to be removed when everything was up-to-date
+        exclusion_cleanup_results = self.multi_source_service.cleanup_excluded_agents(
+            deployed_agents_dir=agents_dir,
+            agents_to_deploy=all_enabled_agents,
+        )
+
+        # Add exclusion cleanup results to main cleanup results
+        if exclusion_cleanup_results.get("removed"):
+            cleanup_results.setdefault("excluded_removed", []).extend(
+                exclusion_cleanup_results["removed"]
+            )
+            self.logger.info(
+                f"Removed {len(exclusion_cleanup_results['removed'])} excluded agents: "
+                f"{', '.join(exclusion_cleanup_results['removed'])}"
+            )
+
         # Convert to list of Path objects
         template_files = list(agents_to_deploy.values())
 

claude_mpm/services/agents/deployment/agent_discovery_service.py

@@ -248,7 +248,9 @@ class AgentDiscoveryService:
             return agent_info
 
         except yaml.YAMLError as e:
-            self.logger.error(f"Invalid YAML frontmatter in {template_file.name}: {e}")
+            self.logger.warning(
+                f"Invalid YAML frontmatter in {template_file.name}: {e}"
+            )
             return None
         except Exception as e:
             self.logger.error(
@@ -431,7 +433,7 @@ class AgentDiscoveryService:
             return True
 
         except yaml.YAMLError:
-            self.logger.error(
+            self.logger.warning(
                 f"Invalid YAML frontmatter in template: {template_file.name}"
             )
             return False