[BUG] `apm pack` fails to find sub-directory-prefixed skills (`--skill productivity/grill-me`) — `apm.lock.yaml` `skill_subset` paths don't match flattened `.apm/skills` layout

[desaiuditd]

Describe the bug

When a git dependency declares skills inside category subdirectories (e.g. mattpocock/skills organizes skills under skills/productivity/ and skills/engineering/), installing with the subdirectory-prefixed skill name succeeds, but the subsequent apm pack fails. It errors that the skills recorded in apm.lock.yaml (skill_subset: productivity/grill-me, productivity/grilling) were not found among the package's installed files.

This happens because apm_modules/<pkg>/.apm/skills/ stores the installed skill files in a flattened layout that drops the subdirectory prefix, so it no longer matches the skill_subset path recorded in the lockfile. Installing the same skills without the subdirectory prefix works as expected.

To Reproduce

Steps to reproduce the behavior:

1. Add a git dependency whose skills live under category subfolders, using the subdir-prefixed names:

   apm install mattpocock/skills#bc4cf90 --skill productivity/grill-me --skill productivity/grilling

2. This generates an apm.yml with:

   dependencies:
     apm:
       - git: mattpocock/skills
         ref: bc4cf90
         skills:
           - productivity/grill-me
           - productivity/grilling

3. Run:

   apm pack

4. See error:

   Error: Cannot pack dependency mattpocock/skills: the skills recorded in apm.lock.yaml (skill_subset: productivity/grill-me, productivity/grilling) were not found among its installed files.
   Run 'apm install' to re-deploy the expected skills, then pack again.
   

Expected behavior

apm pack should succeed when skills are declared and installed with subdirectory prefixes, correctly matching them against the installed files under apm_modules/<pkg>/.apm/skills/. Alternatively, if subdirectory prefixes aren't meant to be supported, apm install should reject or normalize them at install time rather than allowing a lockfile state that later breaks apm pack.

Environment (please complete the following information):

• OS: MacOS
• Python Version: 3.14.6
• APM Version: 0.24.0

Additional context

If I don't add the sub-dir prefix while installing the skills, i.e.,

apm install mattpocock/skills#bc4cf90 --skill grill-me --skill grilling

all works as expected.

I'm not sure where the root cause and bug lies:

• apm may need to support skill installation with subdir prefixes end-to-end.
• The mattpocock/skills repo's subdirectory layout may not be a supported/expected structure. In that case, I can report this in that repo.
• Even when a skill author uses subdirectories, apm may always expect the subdir prefix to be omitted at install time — meaning this could be user/documentation error rather than a bug, needing clarification.

One possible reason I can think of, and what I observed is that,
after running apm install, apm_modules directory is populated with the package files.
APM adds internal .apm directory for it in apm_modules/mattpocock/skills.
But skills kept in apm_modules/mattpocock/skills/.apm/skills path don't follow the subdir structure from the original source.

Click to expand and see the screenshot.

Maybe due to this mismatch, apm pack is not able to recognize the subdir prefix? 🤔 🤷🏻‍♂️
This is just a guess at the moment.

[github-actions]

Triage Panel Verdict

Issue: [BUG] apm pack fails when skills are declared with subdirectory prefixes

Panel Analysis

DevX UX Expert: This is a breaking inconsistency: apm install accepts productivity/grill-me as a skill name and records it in apm.lock.yaml, but the install step flattens the path to just grill-me in the apm_modules layout, so apm pack later cannot find what the lockfile says was installed. The user cannot tell from the install output that the install produced an inconsistent lockfile state -- the failure only surfaces at pack time. Either the install should normalize the path and store the flat name, or pack should resolve the flat-to-prefixed mapping. Either way, the current split produces an invalid intermediate state.

Supply Chain Security Expert: No direct security surface. The flattening behavior could in theory cause unexpected skill substitution if two skills from different subdirectories share a flat name, but this is a secondary concern.

APM CEO: Clear bug with a clear fix surface (normalize subdirectory prefixes at install time, or reconcile the lookup in apm pack). The reporter also proposes a reasonable alternative: reject prefixed names at install time with a clear error, rather than silently producing a broken lockfile state. Either approach is acceptable; normalizing at install time (strip the subdirectory prefix for lockfile storage) is probably more user-friendly since the install already succeeds. Medium-high priority -- pack is a core publish workflow.

Decision

Dimension	Value
Type	type/bug (existing)
Theme	theme/portability
Area	area/package-authoring
Priority	priority/high -- apm pack fails; core publish workflow blocked
Status	status/accepted -- root cause clear (path normalization mismatch between install and pack)
Milestone	None assigned at this time

Suggested next action: Fix skill path normalization: when apm install records a skill_subset entry, strip any subdirectory prefix from the skill name so the lockfile stores the flat name that matches the installed layout. Alternatively, if subdirectory prefixes are intentionally supported, fix apm pack's lookup to accept the prefixed name and locate the corresponding flat-named file. Add a regression test covering the install+pack round-trip with prefixed skill names.

---

Triage status: agentic proposal pending human ratification.
Silence is approval. Maintainers can:

• Override any label or milestone above by editing it directly --
  human edits are authoritative and will not be reverted on
  subsequent runs.
• Re-trigger triage by applying the status/needs-triage label, or
  by removing status/triaged to enroll the issue in the next
  daily sweep.

Posted by the Triage Panel workflow. See .apm/skills/apm-triage-panel for the panel skill.

Generated by Triage Panel · 98.3 AIC · ⌖ 8.66 AIC · ⊞ 9.2K · ◷