fix(uninstall): scan devDependencies.apm so --dev installs can be removed (closes #1549) (#1552)

* fix(uninstall): scan devDependencies.apm so --dev installs can be removed

apm install --dev <pkg> writes the entry under devDependencies.apm in
apm.yml, but apm uninstall <pkg> only read dependencies.apm. The result
was an unconditional 'not found in apm.yml' warning and the dev entry
leaking forever. Uninstall now scans both sections and writes back to
whichever section the package lived in.

Closes #1549

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(changelog): backfill PR number for #1549 fix

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(uninstall): fold dev dependency followups

Update uninstall documentation and changelog wording for the devDependencies.apm fix, make verbose removal logs name the manifest section, and add coverage that prod-only manifests do not synthesize devDependencies. Addresses panel follow-ups for PR #1552.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: danielmeppiel <danielmeppiel@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: danielmeppiel

docs/src/content/docs/reference/cli/uninstall.md

@@ -75,7 +75,7 @@ apm uninstall https://github.com/acme/my-package.git
 
 What gets removed, in order:
 
-1. The package entry in `apm.yml` under `dependencies.apm`.
+1. The package entry in `apm.yml` under `dependencies.apm` or `devDependencies.apm`.
 2. The package folder under `apm_modules/owner/repo/`.
 3. Transitive dependencies that no remaining package depends on (npm-style pruning, computed from `apm.lock.yaml`).
 4. Every file in the lockfile's `deployed_files` for the removed packages and pruned orphans, across all harness folders (`.github/`, `.claude/`, `.cursor/`, `.opencode/`, `.gemini/`, `.codex/`, `.windsurf/`).

src/apm_cli/commands/uninstall/cli.py

@@ -98,8 +98,20 @@ def uninstall(ctx, packages, dry_run, verbose, global_):
             data["dependencies"] = {}
         if "apm" not in data["dependencies"]:
             data["dependencies"]["apm"] = []
-
-        current_deps = data["dependencies"]["apm"] or []
+        # Track whether devDependencies was synthesised so we don't leave
+        # an empty section behind for projects that never used --dev.
+        had_dev_section = "devDependencies" in data
+        if not had_dev_section:
+            data["devDependencies"] = {}
+        if "apm" not in data["devDependencies"]:
+            data["devDependencies"]["apm"] = []
+
+        prod_deps = data["dependencies"]["apm"] or []
+        dev_deps = data["devDependencies"]["apm"] or []
+        # `apm install --dev <pkg>` writes under devDependencies.apm. Uninstall
+        # must scan both sections so dev-installed packages are removable
+        # (regression trap for #1549).
+        current_deps = list(prod_deps) + list(dev_deps)
 
         # Load lockfile early: used for marketplace ref resolution in Step 1
         # and reused for MCP state capture and transitive orphan cleanup below.
@@ -128,9 +140,21 @@ def uninstall(ctx, packages, dry_run, verbose, global_):
 
         # Step 3: Remove from apm.yml
         for package in packages_to_remove:
-            current_deps.remove(package)
-            logger.progress(f"Removed {package} from apm.yml")
-        data["dependencies"]["apm"] = current_deps
+            if package in dev_deps:
+                dev_deps.remove(package)
+                section = "devDependencies.apm"
+            elif package in prod_deps:
+                prod_deps.remove(package)
+                section = "dependencies.apm"
+            logger.progress(f"Removed {package} from {section} in apm.yml")
+        data["dependencies"]["apm"] = prod_deps
+        data["devDependencies"]["apm"] = dev_deps
+        # Drop empty devDependencies wrappers so the manifest stays clean
+        # for projects that never used --dev.
+        if not data["devDependencies"]["apm"]:
+            del data["devDependencies"]["apm"]
+            if not data["devDependencies"] and not had_dev_section:
+                del data["devDependencies"]
         try:
             dump_yaml(data, apm_yml_path)
             logger.success(f"Updated {apm_yml_path} (removed {len(packages_to_remove)} package(s))")

tests/unit/test_uninstall_dev_dependencies.py

@@ -0,0 +1,107 @@
+"""Tests for `apm uninstall` covering the devDependencies.apm section.
+
+Regression trap for #1549: packages installed via `apm install --dev <pkg>`
+were stored under `devDependencies.apm` in apm.yml, but `apm uninstall <pkg>`
+only scanned `dependencies.apm`. The result was an unconditional
+"not found in apm.yml" warning and the dev entry leaking forever.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import yaml
+from click.testing import CliRunner
+
+
+def _write_apm_yml(root: Path, *, deps: list | None = None, dev_deps: list | None = None) -> None:
+    """Write an apm.yml with the requested dependency sections."""
+    data: dict = {"name": "test-project", "version": "1.0.0", "target": "copilot"}
+    if deps is not None:
+        data["dependencies"] = {"apm": deps}
+    if dev_deps is not None:
+        data["devDependencies"] = {"apm": dev_deps}
+    (root / "apm.yml").write_text(yaml.dump(data), encoding="utf-8")
+
+
+def _read_apm_yml(root: Path) -> dict:
+    return yaml.safe_load((root / "apm.yml").read_text(encoding="utf-8"))
+
+
+class TestUninstallDevDependencies:
+    """Regression trap for #1549."""
+
+    def test_uninstall_removes_package_from_dev_dependencies(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        """A package recorded under devDependencies.apm must be removable."""
+        monkeypatch.chdir(tmp_path)
+        _write_apm_yml(tmp_path, deps=[], dev_deps=["microsoft/apm-sample-package"])
+
+        from apm_cli.cli import cli
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["uninstall", "microsoft/apm-sample-package"])
+
+        assert result.exit_code == 0, result.output
+        # "not found in apm.yml" is the bug-mode failure message.
+        assert "not found in apm.yml" not in result.output
+
+        data = _read_apm_yml(tmp_path)
+        dev_apm = (data.get("devDependencies") or {}).get("apm") or []
+        assert "microsoft/apm-sample-package" not in dev_apm, (
+            "package should have been removed from devDependencies.apm"
+        )
+
+    def test_uninstall_dry_run_finds_dev_dependency(self, tmp_path: Path, monkeypatch) -> None:
+        """`--dry-run` must locate dev-only packages too."""
+        monkeypatch.chdir(tmp_path)
+        _write_apm_yml(tmp_path, deps=[], dev_deps=["microsoft/apm-sample-package"])
+
+        from apm_cli.cli import cli
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["uninstall", "microsoft/apm-sample-package", "--dry-run"])
+
+        assert result.exit_code == 0, result.output
+        assert "not found in apm.yml" not in result.output
+        # apm.yml must be unchanged in dry-run mode.
+        data = _read_apm_yml(tmp_path)
+        assert data["devDependencies"]["apm"] == ["microsoft/apm-sample-package"]
+
+    def test_uninstall_preserves_unrelated_dev_dependency(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        """Removing one dev dep must not touch other dev or prod deps."""
+        monkeypatch.chdir(tmp_path)
+        _write_apm_yml(
+            tmp_path,
+            deps=["acme/keep-prod"],
+            dev_deps=["microsoft/apm-sample-package", "acme/keep-dev"],
+        )
+
+        from apm_cli.cli import cli
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["uninstall", "microsoft/apm-sample-package"])
+
+        assert result.exit_code == 0, result.output
+        data = _read_apm_yml(tmp_path)
+        assert data["dependencies"]["apm"] == ["acme/keep-prod"]
+        assert data["devDependencies"]["apm"] == ["acme/keep-dev"]
+
+    def test_uninstall_prod_dependency_does_not_synthesize_dev_section(
+        self, tmp_path: Path, monkeypatch
+    ) -> None:
+        """Removing a prod dep must not add devDependencies to prod-only manifests."""
+        monkeypatch.chdir(tmp_path)
+        _write_apm_yml(tmp_path, deps=["microsoft/apm-sample-package"])
+
+        from apm_cli.cli import cli
+
+        runner = CliRunner()
+        result = runner.invoke(cli, ["uninstall", "microsoft/apm-sample-package"])
+
+        assert result.exit_code == 0, result.output
+        data = _read_apm_yml(tmp_path)
+        assert "devDependencies" not in data