[BUG] Marketplace uninstall aliases are lost after apm update

[mfroembgen]

Bug

After installing a plugin using plugin@marketplace, running apm update can lose the metadata needed to uninstall it by that original alias. This affects both project and global scope.

Installation stores canonical Git coordinates in apm.yml and records the marketplace alias in the lockfile. When update rebuilds the dependency's lock entry without rediscovering the marketplace, it drops discovered_via and marketplace_plugin_name. The dependency updates successfully, but uninstall can no longer resolve the alias offline and may abort at the existing registry/lock ownership guard.

Reproduction

1. Register a marketplace and install a plugin using plugin@marketplace.
2. Advance the plugin's tracked Git branch.
3. Run apm update --yes in the same scope.
4. Inspect the lockfile: the revision advances, but the marketplace alias metadata is missing.
5. Unregister the marketplace and try to uninstall using the original alias.

The automated project/global reproduction uses a local Git remote and does not manually edit the consumer manifest or lockfile.

Expected behavior

Updating the same dependency preserves its marketplace alias metadata while refreshing its revision and content hashes. Uninstalling by the original alias should continue to work without the marketplace being available.

Environment

Originally reproduced with APM 0.30.0 and main at e38261c5, on macOS with Python 3.12.13 and the source-installed CLI.

[sergio-sisternes-epam]

Triage recommendation

accept

Recommendation only, not scope approval. A responsible human maintainer
must approve the scope and review contact before implementation. Labels,
automated advice, and silence are not approval or a release commitment.

Proposed classification

type/bug, area/marketplace, area/lockfile, theme/portability

No existing classification on the issue; nothing to preserve or conflict with.

Proposed scope brief

• Scope: Keep marketplace alias provenance on the same host-qualified lock entry when apm update refreshes revision and content hashes, so plugin@marketplace uninstall still resolves offline from the lockfile.
• Done when: After plugin@marketplace install and apm update --yes (project and global), the lock entry advances commit/hashes but retains discovered_via and marketplace_plugin_name; uninstall by the original alias still works after the marketplace is unregistered; unmanaged user files are not removed. A lifecycle regression test covers this without hand-editing the consumer manifest or lockfile.
• Exclusions: Manifest object-form persistence ([FEATURE] Persist marketplace object-form deps; accept SHA catalog pins #2903). MCP-only uninstall behavior ([BUG] MCP-only package uninstall deletes unmanaged Claude and Kiro skills #2946). Reconstructing provenance that was already dropped. New manifest grammar, trust policy, or uninstall ownership rules.
• Review needs: Marketplace lockfile provenance and uninstall alias lookup. Project-wide remit (core maintainers). Review capacity is not confirmed. Open PR fix(update): preserve marketplace uninstall aliases #2949 already claims this issue; do not invite a second implementation.

Suggested next action

A maintainer should check the brief against the cited reproduction and existing PR #2949. This recommendation does not authorize merge, assignment, or a second patch.

Suggested issue comment

Thanks for the concrete reproduction. `apm update` dropping lockfile marketplace alias fields (`discovered_via`, `marketplace_plugin_name`) breaks the install-by-alias / uninstall-by-alias contract from #1323 once the marketplace is unregistered. That contradicts the lockfile-as-canonical model in the README and the lockfile spec provenance fields.

Advisory recommendation only: accept a bounded restore of those existing fields across update for the same host-qualified dependency. This is not scope approval, a reviewer assignment, or a release target.

Related and out of scope here: #2903 (persist marketplace object-form in the manifest) and #2946 (MCP-only uninstall). Open PR #2949 already points at this issue; a maintainer still needs to record scope and review contact before that work is treated as approved.

Per-lens notes (collapsed)

DevX UX Expert -- User-Need Reviewer

User task: install with plugin@marketplace, later apm update, then uninstall with the same alias (including after unregistering the marketplace). That is the README marketplace path (apm marketplace add / apm install name@marketplace) plus the lockfile-as-canonical mental model. npm/pip/cargo keep identity metadata across updates; dropping the alias so uninstall fails is a surprise and breaks #1323's alias-removal contract. Failure currently aborts at the ownership guard rather than offering a copy-paste recovery that uses the canonical Git id. No new CLI verb is requested.

Supply Chain Security Expert -- Risk-Surface Reviewer

P/G/S: lockfile provenance and marketplace identity, not signing or auth. Update rebuilds a lock entry without rediscovery and drops discovered_via / marketplace_plugin_name, so offline alias uninstall can no longer prove which locked package the alias named. Aborting at the existing registry/lock ownership guard is fail-closed and should stay. Copying discovery fields must be keyed to the same host-qualified dependency (host/port/repo/subpath); fresh marketplace discovery must replace the whole tuple, including clearing stale catalog URL/digest. Do not reconstruct already-lost provenance (that would invent identity). Integrity hashes and resolved commits should still come from the update, not from the old entry. Review expertise: lockfile + marketplace uninstall resolution. No MCP-trust or token-scope change.

OSS Growth Hacker -- Contributor-Tone Reviewer

Not activated -- author mfroembgen is a CONTRIBUTOR with multiple microsoft/apm issues and PRs (including merged #2947 and open #2949), so newcomer tone-tuning would not change the reply.

Python Architect -- Architecture Reviewer

Not activated -- the ask is to retain existing lockfile discovery fields during update rebuild, not a new interface, schema, module, or primitive. Manifest persistence remains #2903.

Doc Writer -- Documentation Reviewer

Not activated -- lockfile spec already documents discovered_via and marketplace_plugin_name; this issue restores that contract rather than proposing new pages or README changes.

APM CEO -- Triage Arbiter

Specialists agree this is a bounded regression of shipped marketplace alias uninstall, aligned with README marketplaces and lockfile provenance, not a new product direction. Distinct from #1323 (already shipped) and #2903 (manifest grammar). Rubric outcome: accept, with a proposed brief for a human to approve. Open PR #2949 is evidence the reporter already has a patch; advice must not be read as merge authority or an invitation to duplicate the work. Human approval, review contact, and release targeting remain unset. This persona cannot ratify scope.

{
  "schema_version": 2,
  "advisory_only": true,
  "recommendation": "accept",
  "recommendation_detail": "Bounded restore of existing lockfile marketplace alias fields across apm update; distinct from #2903 and #1323; PR #2949 already targets #2997.",
  "classification": {
    "theme": "theme/portability",
    "areas": ["area/marketplace", "area/lockfile"],
    "type": "type/bug"
  },
  "proposed_brief": {
    "scope": "Preserve marketplace alias provenance on the same host-qualified lock entry when apm update refreshes revision and hashes.",
    "done_when": "After plugin@marketplace install and apm update --yes in project and global scope, alias fields remain; uninstall by original alias works with the marketplace unregistered; unmanaged files survive; lifecycle regression test passes.",
    "exclusions": "Manifest object-form persistence (#2903); MCP-only uninstall (#2946); reconstructing dropped provenance; new grammar or trust policy.",
    "review_needs": "Marketplace lockfile provenance and uninstall alias lookup; project-wide core maintainer remit; capacity unconfirmed; prefer reviewing #2949 over a second patch."
  },
  "next_action": "Maintainer confirms the brief against the reproduction and reviews existing PR #2949; this is not merge or implementation authority.",
  "comment_markdown": "Thanks for the concrete reproduction. `apm update` dropping lockfile marketplace alias fields (`discovered_via`, `marketplace_plugin_name`) breaks the install-by-alias / uninstall-by-alias contract from #1323 once the marketplace is unregistered. That contradicts the lockfile-as-canonical model in the README and the lockfile spec provenance fields.\n\nAdvisory recommendation only: accept a bounded restore of those existing fields across update for the same host-qualified dependency. This is not scope approval, a reviewer assignment, or a release target.\n\nRelated and out of scope here: #2903 (persist marketplace object-form in the manifest) and #2946 (MCP-only uninstall). Open PR #2949 already points at this issue; a maintainer still needs to record scope and review contact before that work is treated as approved."
}