apm deps

Inspect, update, and clean dependencies that apm install placed under apm_modules/. apm deps is a command group; every action lives in a subcommand.

Synopsis

apm deps SUBCOMMAND [OPTIONS]

Description

apm deps is the read-and-maintenance counterpart to apm install. It reads apm.lock.yaml and the apm_modules/ tree to show what is installed, refresh git refs, or remove the tree entirely. It does not add new packages — use apm install <package> for that.

All subcommands operate on the project scope (./apm_modules/) by default. Pass -g / --global where supported to operate on the user scope (~/.apm/apm_modules/).

Subcommands

Subcommand	Purpose
list	List installed dependencies with per-primitive counts.
tree	Render the dependency graph as a tree.
info PACKAGE	Show detailed metadata for one installed package.
why PACKAGE	Explain why a transitive dependency is installed (analogue of npm why).
update [PACKAGES...]	Re-resolve git refs and reinstall.
clean	Remove the entire apm_modules/ directory.

apm deps list

List every installed dependency recorded by the manifest or lockfile and the primitive counts each one contributes. Manifests embedded anywhere inside an installed package’s source tree are parent-owned content, not separate dependencies. Real lockfile-resolved dependencies install at their own package roots and remain visible regardless of graph depth.

Local dependencies are shown as portable _local/<name> keys rather than machine-specific absolute paths. For a direct local declaration with matching apm.lock.yaml metadata, copy that key into apm uninstall (with -g for user scope). Without a lockfile, use the exact path from the manifest. Transitive local dependencies are removed through their declaring parent. If more than one declared local path has the same name, apm uninstall reports an ambiguity and changes nothing; use one exact path already declared in apm.yml.

apm deps list [OPTIONS]

Option	Description
-g, --global	List user-scope dependencies in ~/.apm/ instead of the project.
--all	Show both project and user-scope dependencies.
--insecure	Show only dependencies locked to http:// sources. Adds an Origin column distinguishing direct declarations from via <parent> transitive pulls.

apm deps tree

Render the complete dependency graph as a hierarchical tree, following resolved_by relationships at every lockfile depth. When no lockfile is present, the command falls back to a scan of apm_modules/ and ignores parent-owned manifests embedded inside an installed package. Circular relationships are marked (circular) at the repeated ancestor and do not prevent other branches from rendering.

apm deps tree [OPTIONS]

Option	Description
-g, --global	Show the user-scope tree in ~/.apm/.

apm deps info

Show detailed information about one installed package: manifest metadata, primitive inventory, and source. Equivalent to apm view PACKAGE for installed packages; prefer apm view in new scripts.

apm deps info PACKAGE

Argument	Description
PACKAGE	Name of an installed package under apm_modules/. Required.

apm deps why

Explain why a transitive dependency is installed, by walking the lockfile’s resolved_by chain from the queried package back to the user’s direct declaration in apm.yml. The APM analogue of npm why / yarn why / cargo tree -i.

apm deps why PACKAGE [OPTIONS]

Argument	Description
PACKAGE	The installed package to explain. Accepts the same identifier styles as apm deps info: unique key (owner_repo), repo URL (https://github.com/owner/repo), owner/repo, or bare basename when unambiguous.

Option	Description
-g, --global	Read the user-scope lockfile at ~/.apm/apm.lock.yaml instead of the project lockfile.
--json	Emit a machine-readable JSON document to stdout. All logs and error payloads are routed to stderr so apm deps why pkg --json | jq is safe.

Exit codes: 0 on success, 1 when the package is not installed or the query matches multiple packages, 2 when no lockfile exists.

apm deps update

Deprecated

apm deps update is deprecated in favor of apm update, which is now a strict superset: it supports -g/--global, [PACKAGES...], --force, and --parallel-downloads, plus an interactive plan, --dry-run, and --yes. apm deps update keeps working for one release and is removed in the next breaking release.

Re-resolve git references for installed dependencies (direct and transitive), download updated content, re-integrate primitives, and regenerate apm.lock.yaml.

apm deps update [PACKAGES...] [OPTIONS]

Argument	Description
PACKAGES...	Optional. One or more packages to update. Omit to update everything.

Option	Description
-v, --verbose	Show detailed update information.
--force	Overwrite locally-authored files on collision.
-t, --target	Force deployment to specific targets. Comma-separated. Values: copilot, claude, grok-build, cursor, opencode, codex, gemini, antigravity, windsurf, kiro, agent-skills, all. copilot-cowork, copilot-app, and grok-cloud (skills only) are also accepted when their experimental flags are enabled. Experimental targets are excluded from all.
--parallel-downloads N	Max concurrent downloads. Default 4. 0 disables parallelism.
-g, --global	Update user-scope dependencies in ~/.apm/.
--legacy-skill-paths	Deploy skill files to per-client paths (.cursor/skills/, etc.) instead of the shared .agents/skills/ directory.

apm deps update runs the install pipeline and is gated by org apm-policy.yml. There is no --no-policy flag; the only escape hatch is APM_POLICY_DISABLE=1 for the shell session.

apm deps clean

Remove the entire project apm_modules/ directory. Does not touch apm.yml or apm.lock.yaml.

apm deps clean [OPTIONS]

Option	Description
--dry-run	Show what would be removed without removing.
-y, --yes	Skip the confirmation prompt (for CI and scripts).

Examples

List project dependencies:

apm deps list

Sample output:

 Package             Version  Source  Prompts  Instructions  Agents  Skills  Hooks
 compliance-rules    1.0.0    github  2        1             -       1       -
 design-guidelines   1.0.0    github  -        1             1       -       -
 _local/review-kit   0.4.0    local   1        2             -       -       -

Show only insecure (HTTP-locked) dependencies and their origin:

apm deps list --insecure

Render the tree:

apm deps tree

my-project (local)
+-- compliance-rules@1.0.0
|   +-- 1 instruction, 1 skill
+-- design-guidelines@1.0.0
    +-- 1 instruction, 1 agent

Inspect one installed package:

apm deps info compliance-rules

Update everything:

apm deps update

Update specific packages with verbose output:

apm deps update org/pkg-a org/pkg-b --verbose

Preview a clean, then run it non-interactively:

apm deps clean --dry-run
apm deps clean --yes

Related

• apm install — add packages and run the install pipeline.
• apm uninstall — remove a single package and its deployed files.
• apm outdated — check remotes for newer versions without modifying anything.
• Lockfile spec — structure of apm.lock.yaml that apm deps reads.