agentbundle 0.20.1__tar.gz → 0.22.0__tar.gz

{agentbundle-0.20.1 → agentbundle-0.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentbundle
-Version: 0.20.1
+Version: 0.22.0
 Summary: npm for your coding agent. Install packs of skills, subagents, and hooks into any repo, for every major agent.
 Author-email: eugenelim <eugenelim@users.noreply.github.com>
 License: Apache-2.0 OR MIT
@@ -175,6 +175,11 @@ Developers installing from your fork get the internal channel without a manual
 A malformed `enabled = true` config fails closed — no silent fallback to the public
 source.
 
+**Offline and air-gapped hosts:** set `AGENTBUNDLE_NO_REMOTE=1` to skip the org
+Artifactory bootstrap and editable-install detection entirely. `agentbundle` falls
+straight through to the packaged default, so hosts without network access to Artifactory
+still resolve a source without errors.
+
 See the full enterprise adoption guide at
 `docs/guides/_shared/how-to/use-an-artifactory-catalogue.md` for all six flows
 (org bootstrap, repo-scope CI upgrade, user-scope MDM, source-conflict remediation,
@@ -242,6 +247,38 @@ agentbundle pack evals run --pack <pack-name> --catalogue-root .
 
 See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/how-to/author-a-skill.md).
 
+## Catalogue defaults and pack config API
+
+**Catalogue defaults** let operators ship sensible starting values for every pack they distribute. Add a `[pack-defaults.<pack-name>]` table to `catalogue.toml` and the defaults are baked in at publish time. They slot into the three-layer cascade: pack-source defaults → operator defaults → user config. A custom install root is also supported via `[catalogue] user-dir = "~/custom/path"`.
+
+**Pack scripts** can resolve their user-scope directory and read the merged config at runtime using the `agentbundle.config` API:
+
+```python
+from agentbundle.config import pack_dir, load_pack_config
+
+directory = pack_dir("my-pack")                 # ~/.agentbundle/my-pack/
+config = load_pack_config("my-pack")            # merged dict: pack defaults + operator + user
+```
+
+**Operation log** — scripts can append structured JSONL records to `<pack_dir>/ops.jsonl` for lightweight audit trails:
+
+```python
+from agentbundle.oplog import write_entry
+
+write_entry("my-pack", "install", src="git+https://example.com/my-pack")
+```
+
+**CLI commands** to read, write, and inspect pack config and operation logs:
+
+```bash
+agentbundle pack-config show my-pack            # all config values for a pack
+agentbundle pack-config get  my-pack api-key    # single value
+agentbundle pack-config set  my-pack api-key v  # write to user config.toml
+
+agentbundle oplog show  my-pack                 # JSONL operation history
+agentbundle oplog clear my-pack                 # wipe history (asks first)
+```
+
 ## Credentials
 
 `agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.

agentbundle-0.22.0/README-pypi.md

@@ -0,0 +1,266 @@
+# agentbundle
+
+[![PyPI](https://img.shields.io/pypi/v/agentbundle)](https://pypi.org/project/agentbundle/)
+[![Python](https://img.shields.io/pypi/pyversions/agentbundle)](https://pypi.org/project/agentbundle/)
+[![License](https://img.shields.io/badge/license-MIT%2FApache--2.0-blue)](https://github.com/eugenelim/agent-ready-repo#license)
+
+**The installer for [agent-ready-repo](https://github.com/eugenelim/agent-ready-repo).** Think npm, but for the skills, subagents, and hooks your coding agent runs on. One pack, one command, every major agent — Claude Code, Codex, Cursor, Copilot, Gemini, and Kiro (both the CLI and the IDE).
+
+## Quick start
+
+```bash
+pip install agentbundle
+```
+
+Requires Python 3.11+. Runs on macOS, Linux, and Windows.
+
+**Install into a repo** — so everyone who clones it gets the pack. `core` is the flagship pack, the loop itself:
+
+```bash
+agentbundle install --pack core
+```
+
+No catalogue argument needed: it defaults to the agent-ready-repo catalogue. It lands in the repo's agent config — subagents and skills included — and you commit it like any other project file. This is the default scope: the pack belongs to the project and the whole team.
+
+**Install for yourself, everywhere** — so a pack follows you across every project, with no per-repo setup:
+
+```bash
+agentbundle install --pack desk-research --scope user
+```
+
+User-scope packs land in your home directory, not the repo — they're yours, not the team's, and they're there in every project you open.
+
+The install auto-detects your agent (`--adapter` overrides). Multi-IDE? Install the same pack for each agent at the same scope — they coexist, and the agents that read `.agents/skills/` (codex, cursor, gemini, copilot) share one skill copy instead of fighting over it. To install from a **different** catalogue, pass it as a trailing argument — a git URL or a local path (`agentbundle install --pack core <catalogue>`); a `config set source <catalogue>` makes that the default, and an editable clone (`pip install -e`) defaults to itself.
+
+## More commands
+
+```bash
+# See what the catalogue offers (bare uses the default; or name one explicitly)
+agentbundle list-packs
+agentbundle list-profiles
+
+# See what a single pack contains — skills and agents, derived live from its tree
+agentbundle show core
+agentbundle show core --format json          # stable object for scripts/agents
+
+# See what YOU have installed — pack, adapter, scope, version, and whether
+# an upgrade is available (both scopes by default)
+agentbundle list-installed
+agentbundle list-installed --no-check       # skip the catalogue check (offline, fast)
+agentbundle list-installed --check-drift    # also count locally edited files
+agentbundle list-installed --format json    # machine-readable JSON (schema_version 1)
+agentbundle list-installed --updates-only   # show only rows needing attention
+
+# Install a whole curated profile — a single-scope set of packs — in one command
+agentbundle install --profile inception
+
+# Preview any install without writing a file
+agentbundle install --pack core --dry-run
+
+# Upgrade to the version the catalogue ships — shows installed → target, asks first
+agentbundle upgrade --pack core
+agentbundle upgrade --pack core --yes  # skip the prompt (CI)
+
+# Uninstall — previews remove (Tier-1) vs keep (your edits), asks first
+agentbundle uninstall --pack core --dry-run
+agentbundle uninstall --pack core --yes
+```
+
+**`list-installed`** reads your state files (not the catalogue) and reports every installed `(pack, adapter)` at each scope with its version and a four-value status — `up-to-date`, `upgrade-available`, `ahead` (installed version is newer than catalogue), or `unknown`; it degrades to `unknown` (never an error) when the catalogue can't be resolved, and `--no-check` skips the check entirely. `--format json` emits a stable JSON contract (`schema_version: 1`) to stdout — useful for CI automation of upgrade decisions. `--updates-only` hides `up-to-date` rows.
+
+**`show <pack>`** answers "what skills and agents does this pack contain?" by walking the pack's source tree live on each call — so the answer can't drift, and nothing is persisted. `--format json` emits a stable object (`name`, `version`, `description`, `skills`, `agents`, `source`) for scripts and agents. When the catalogue can't be resolved, an *installed* pack still reports its inventory from your state files (marked `source: installed-state`); a not-installed pack errors.
+
+A **profile** is a catalogue-curated, single-scope set of packs you install in one command — it declares its own scope, so `--scope` doesn't apply. **Upgrade takes no version** — the target is whatever the catalogue you point at declares; to pin a past version, point the catalogue at that git ref. Install a pack that's **already there** and `agentbundle` offers to `upgrade` it instead (`--yes` runs it straight away).
+
+**Mutating commands ask first.** `uninstall`, the `--force` cleanup, and the upgrade offer all preview what they'll do and confirm before touching anything; `--dry-run` previews without writing, and `--yes` skips the prompt for non-interactive / CI use (where, without it, they refuse rather than hang).
+
+## Enterprise distribution
+
+For organizations running an internal Artifactory mirror or any static HTTPS server,
+agentbundle's enterprise distribution capabilities handle the full adoption loop —
+from org-wide channel configuration to CI-driven bulk upgrades.
+
+**Install from an internal Artifactory channel:**
+
+```bash
+# Point agentbundle at your org's channel descriptor (one-time per machine,
+# or pre-configured in your org fork — see Org bootstrap below)
+agentbundle config set source catalogue+https://artifactory.example.test/agentbundle/catalogues/core/channels/stable.json
+
+agentbundle install --pack core
+```
+
+The channel descriptor points to an immutable versioned archive; agentbundle
+fetches, verifies its SHA-256 digest, and installs. Pass a bearer token via
+`AGENTBUNDLE_HTTP_BEARER_TOKEN` — it is never stored in state, never printed, and
+never forwarded to a different host.
+
+**JSON output for CI pipelines:**
+
+```bash
+# See what's installed and what needs upgrading — machine-readable
+agentbundle list-installed --format json
+agentbundle list-installed --format json --updates-only
+```
+
+Returns a stable JSON contract (`schema_version` 1) with per-row status
+(`up-to-date` / `upgrade-available` / `ahead` / `unknown`) and machine-readable
+reason codes for unknown rows. Pipe into `jq` or your CI annotation step.
+
+**Bulk upgrade in one scoped command:**
+
+```bash
+# Upgrade all installed packs in a scope — preflights before any write
+agentbundle upgrade --all --scope repo --yes
+agentbundle upgrade --all --scope user --format json --yes
+```
+
+Preflights all rows before writing anything; a blocked row stops the run before the
+filesystem is touched. Partial failure is reported honestly — not described as a
+rollback. Never silently downgrades an `ahead` row.
+
+**Package your catalogue for Artifactory:**
+
+```bash
+agentbundle package-catalogue \
+  --root /path/to/catalogue \
+  --bundle my-packs \
+  --release 1.0.0 \
+  --channel stable \
+  --output dist/
+```
+
+Produces a deterministic, reproducible gzip archive (versioned) and a mutable channel
+descriptor JSON (`stable.json`), ready to upload to Artifactory. Identical inputs
+produce byte-identical archives (honors `SOURCE_DATE_EPOCH`).
+
+**Org bootstrap — ship the default channel in your fork:**
+
+Add an `[organization.artifactory]` block to
+`agentbundle/_data/install-defaults.toml` in your org's agentbundle fork:
+
+```toml
+[organization.artifactory]
+enabled = true
+base-url = "https://artifactory.example.test"
+repository = "agentbundle"
+bundle = "core"
+channel = "stable"
+```
+
+Developers installing from your fork get the internal channel without a manual
+`config set source` step. The block ships `enabled = false` in the public package.
+A malformed `enabled = true` config fails closed — no silent fallback to the public
+source.
+
+**Offline and air-gapped hosts:** set `AGENTBUNDLE_NO_REMOTE=1` to skip the org
+Artifactory bootstrap and editable-install detection entirely. `agentbundle` falls
+straight through to the packaged default, so hosts without network access to Artifactory
+still resolve a source without errors.
+
+See the full enterprise adoption guide at
+`docs/guides/_shared/how-to/use-an-artifactory-catalogue.md` for all six flows
+(org bootstrap, repo-scope CI upgrade, user-scope MDM, source-conflict remediation,
+disconnected hosts, and security controls).
+
+## Build your own catalogue
+
+`agentbundle` isn't tied to the agent-ready-repo catalogue. Any repo that lays its packs out the same way can use it. A pack is a directory:
+
+```text
+my-pack/
+  pack.toml                  # name, version, adapter-contract, install scope,
+                             # plus rich metadata (license, maintainers, links,
+                             # categories, keywords) and a README pointer
+  .claude-plugin/
+    plugin.json              # Claude Code plugin manifest (hand-authored)
+  README.md                  # the pack's portable doc — projected with the pack
+  .apm/                      # primitives — projected by the build pipeline
+    skills/<name>/
+      SKILL.md               # the skill body; one folder per skill
+      references/            # progressive-disclosure docs, loaded on demand
+      assets/                # templates the skill copies into the repo
+    agents/<name>.md         # subagents
+    hooks/<name>.py          # lifecycle hooks
+  seeds/                     # files scaffolded into the adopter repo
+```
+
+`pack.toml` is the **single source of truth** for a pack's metadata. Declare
+`license`, `[[pack.maintainers]]`, `[pack.links]`, `categories`, and
+`keywords` once; the build projects the cleanly-mappable subset — plus the
+pack's `README.md` — into each distribution route's manifest (the `plugin.json`
+/ `marketplace.json` entry), so the catalogue describes each pack richly rather
+than with a single sentence. Extra fields stay in `pack.toml`; the projection
+is deliberately lossy per tool.
+
+Point a catalogue URI (a git URL or a local path) at the repo that holds your packs. Then `validate` a pack against the adapter contract, `render` it to preview the projection, and `install` it into a target repo. `scaffold` drops a pack's seeds into a fresh directory to start from. The build pipeline (`agentbundle.build`) is the same engine `make build` runs.
+
+**Org adapter default:** If your org ships a private `agentbundle` wheel (or a fork pinned to your internal catalogue), you can set a default adapter for all developers without requiring them to run `agentbundle config set` or pass `--adapter` on every install. Add an `[organization]` table to `_data/install-defaults.toml` in your fork:
+
+```toml
+[organization]
+preferred_adapter = "cursor"
+```
+
+The org hint fires after the user-config but before the on-disk IDE probe — so `--adapter`, user-config, and upgrade state-hints all take priority. An invalid value exits 1 before writing anything. See the [`agentbundle` reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/reference/agentbundle.md#org-adapter-default) for the full cascade.
+
+**Lint your catalogue** — shallow structural checks run without extra dependencies:
+
+```bash
+agentbundle catalogue lint --root .
+```
+
+For full [agentskills.io spec](https://agentskills.io/specification) compliance (frontmatter key set, description policy, encoding, evals schema), install the `lint` extra and run with `--deep`:
+
+```bash
+pip install 'agentbundle[lint]'
+agentbundle catalogue lint --root . --deep
+```
+
+**Run Tier-A activation evals** to measure whether each covered skill fires on the prompts it should:
+
+```bash
+agentbundle pack evals run --pack <pack-name> --catalogue-root .
+```
+
+See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/how-to/author-a-skill.md).
+
+## Catalogue defaults and pack config API
+
+**Catalogue defaults** let operators ship sensible starting values for every pack they distribute. Add a `[pack-defaults.<pack-name>]` table to `catalogue.toml` and the defaults are baked in at publish time. They slot into the three-layer cascade: pack-source defaults → operator defaults → user config. A custom install root is also supported via `[catalogue] user-dir = "~/custom/path"`.
+
+**Pack scripts** can resolve their user-scope directory and read the merged config at runtime using the `agentbundle.config` API:
+
+```python
+from agentbundle.config import pack_dir, load_pack_config
+
+directory = pack_dir("my-pack")                 # ~/.agentbundle/my-pack/
+config = load_pack_config("my-pack")            # merged dict: pack defaults + operator + user
+```
+
+**Operation log** — scripts can append structured JSONL records to `<pack_dir>/ops.jsonl` for lightweight audit trails:
+
+```python
+from agentbundle.oplog import write_entry
+
+write_entry("my-pack", "install", src="git+https://example.com/my-pack")
+```
+
+**CLI commands** to read, write, and inspect pack config and operation logs:
+
+```bash
+agentbundle pack-config show my-pack            # all config values for a pack
+agentbundle pack-config get  my-pack api-key    # single value
+agentbundle pack-config set  my-pack api-key v  # write to user config.toml
+
+agentbundle oplog show  my-pack                 # JSONL operation history
+agentbundle oplog clear my-pack                 # wipe history (asks first)
+```
+
+## Credentials
+
+`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.
+
+## Learn more
+
+The full story — the loop, the reviewers, the pack catalogue — is in the [agent-ready-repo README](https://github.com/eugenelim/agent-ready-repo#readme).

{agentbundle-0.20.1 → agentbundle-0.22.0}/README.md

@@ -1,15 +1,11 @@
 # agentbundle
 
-[![PyPI](https://img.shields.io/pypi/v/agentbundle)](https://pypi.org/project/agentbundle/)
-[![Python](https://img.shields.io/pypi/pyversions/agentbundle)](https://pypi.org/project/agentbundle/)
-[![License](https://img.shields.io/badge/license-MIT%2FApache--2.0-blue)](https://github.com/eugenelim/agent-ready-repo#license)
-
 **The installer for [agent-ready-repo](https://github.com/eugenelim/agent-ready-repo).** Think npm, but for the skills, subagents, and hooks your coding agent runs on. One pack, one command, every major agent — Claude Code, Codex, Cursor, Copilot, Gemini, and Kiro (both the CLI and the IDE).
 
 ## Quick start
 
 ```bash
-pip install agentbundle
+pip install -e packages/agentbundle
 ```
 
 Requires Python 3.11+. Runs on macOS, Linux, and Windows.
@@ -208,7 +204,7 @@ agentbundle catalogue lint --root .
 For full [agentskills.io spec](https://agentskills.io/specification) compliance (frontmatter key set, description policy, encoding, evals schema), install the `lint` extra and run with `--deep`:
 
 ```bash
-pip install 'agentbundle[lint]'
+pip install -e 'packages/agentbundle[lint]'
 agentbundle catalogue lint --root . --deep
 ```
 
@@ -220,9 +216,41 @@ agentbundle pack evals run --pack <pack-name> --catalogue-root .
 
 See the [pack layout reference](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/architecture/pack-layout.md) and [authoring a skill](https://github.com/eugenelim/agent-ready-repo/blob/main/docs/guides/_shared/how-to/author-a-skill.md).
 
+## Catalogue defaults and pack config API
+
+**Catalogue defaults** let operators ship sensible starting values for every pack they distribute. Add a `[pack-defaults.<pack-name>]` table to `catalogue.toml` and the defaults are baked in at publish time. They slot into the three-layer cascade: pack-source defaults → operator defaults → user config. A custom install root is also supported via `[catalogue] user-dir = "~/custom/path"`.
+
+**Pack scripts** can resolve their user-scope directory and read the merged config at runtime using the `agentbundle.config` API:
+
+```python
+from agentbundle.config import pack_dir, load_pack_config
+
+directory = pack_dir("my-pack")                 # ~/.agentbundle/my-pack/
+config = load_pack_config("my-pack")            # merged dict: pack defaults + operator + user
+```
+
+**Operation log** — scripts can append structured JSONL records to `<pack_dir>/ops.jsonl` for lightweight audit trails:
+
+```python
+from agentbundle.oplog import write_entry
+
+write_entry("my-pack", "install", src="git+https://example.com/my-pack")
+```
+
+**CLI commands** to read, write, and inspect pack config and operation logs:
+
+```bash
+agentbundle pack-config show my-pack            # all config values for a pack
+agentbundle pack-config get  my-pack api-key    # single value
+agentbundle pack-config set  my-pack api-key v  # write to user config.toml
+
+agentbundle oplog show  my-pack                 # JSONL operation history
+agentbundle oplog clear my-pack                 # wipe history (asks first)
+```
+
 ## Credentials
 
-`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](https://pypi.org/project/credbroker/), a standalone resolver that keeps cleartext out of the model's reach.
+`agentbundle` doesn't resolve secrets. Credentialed skills use [`credbroker`](../credbroker/README.md), a standalone resolver that keeps cleartext out of the model's reach.
 
 ## Learn more
 

{agentbundle-0.20.1 → agentbundle-0.22.0}/agentbundle/_data/catalogue.schema.json

@@ -12,6 +12,14 @@
       "description": "Schema version — must be 1.",
       "enum": [1]
     },
+    "pack-defaults": {
+      "type": "object",
+      "description": "Per-pack configuration defaults baked into install-defaults.toml at build time.",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": { "type": "string" }
+      }
+    },
     "catalogue": {
       "type": "object",
       "additionalProperties": false,
@@ -25,6 +33,10 @@
         "package"
       ],
       "properties": {
+        "user-dir": {
+          "type": "string",
+          "description": "User-scope pack directory root (must start with ~/). Defaults to ~/.agentbundle when absent."
+        },
         "name": {
           "type": "string",
           "description": "Safe identifier — [A-Za-z0-9][A-Za-z0-9_-]*.",
@@ -159,6 +171,10 @@
                 "bundle": {
                   "type": "string",
                   "description": "Catalogue bundle name (required when enabled)."
+                },
+                "channel": {
+                  "type": "string",
+                  "description": "Artifactory channel name (required when enabled = true)."
                 }
               }
             }

{agentbundle-0.20.1 → agentbundle-0.22.0}/agentbundle/_data/install-marker.py

@@ -48,16 +48,12 @@ Exit codes:
 """
 
 import argparse
+import contextlib
 import datetime
 import hashlib
 import json
 import os
 import pathlib
-import sys
-import tempfile
-import tomllib
-from datetime import timezone
-
 
 # ---------------------------------------------------------------------------
 # Vendored pack-name / pack-version shape rules — copied from
@@ -69,6 +65,9 @@ from datetime import timezone
 # pack.toml would pass unchecked and land phantom TOML lines in the marker.
 # ---------------------------------------------------------------------------
 import re as _re
+import sys
+import tempfile
+import tomllib
 
 _PACK_NAME_RE = _re.compile(r"^[a-z0-9][a-z0-9-]*$")
 _PACK_VERSION_RE = _re.compile(
@@ -164,11 +163,11 @@ def _assert_under(target: pathlib.Path, jail: pathlib.Path) -> None:
     # jail is already resolved; do not call os.path.realpath on it again.
     try:
         resolved_target.relative_to(jail)
-    except ValueError:
+    except ValueError as exc:
         raise ValueError(
             f"install-marker: marker path {resolved_target} escapes the per-scope jail "
             f"{jail}; refusing write"
-        )
+        ) from exc
 
 
 def _assert_portable_name(component: str) -> None:
@@ -196,7 +195,7 @@ def _assert_portable_name(component: str) -> None:
                 f"install-marker: refusing path component with control character "
                 f"U+{ord(ch):04X}: {component!r}"
             )
-    if component.endswith(".") or component.endswith(" "):
+    if component.endswith((".", " ")):
         raise ValueError(
             f"install-marker: refusing path component with trailing dot or space: "
             f"{component!r}"
@@ -294,7 +293,7 @@ def _marker_scope(origin: str) -> str:
 def _pack_toml(plugin_root: pathlib.Path) -> dict:
     """Load and return the pack manifest dict from ``pack.toml``."""
     toml_path = plugin_root / "pack.toml"
-    with open(toml_path, "rb") as fh:
+    with toml_path.open("rb") as fh:
         return tomllib.load(fh)
 
 
@@ -343,12 +342,11 @@ def _marker_path(
         agentbundle.mkdir(mode=0o700, parents=True, exist_ok=True)
         resolved_jail = pathlib.Path(os.path.realpath(agentbundle))
         return agentbundle / ".adapt-install-marker.toml", resolved_jail
-    else:
-        # repo scope — project_dir must be set; callers ensure this.
-        if project_dir is None:
-            raise ValueError("project_dir required for repo-scope marker")
-        resolved_jail = pathlib.Path(os.path.realpath(project_dir))
-        return project_dir / ".adapt-install-marker.toml", resolved_jail
+    # repo scope — project_dir must be set; callers ensure this.
+    if project_dir is None:
+        raise ValueError("project_dir required for repo-scope marker")
+    resolved_jail = pathlib.Path(os.path.realpath(project_dir))
+    return project_dir / ".adapt-install-marker.toml", resolved_jail
 
 
 def _should_fire(
@@ -606,18 +604,14 @@ def _write_marker(
         os.write(tmp_fd, content_bytes)
         os.close(tmp_fd)
         tmp_fd = -1
-        os.replace(tmp_name, marker_path)
+        pathlib.Path(tmp_name).replace(marker_path)
     except Exception:
         # Clean up tempfile on error (best effort).
         if tmp_fd >= 0:
-            try:
+            with contextlib.suppress(OSError):
                 os.close(tmp_fd)
-            except OSError:
-                pass
-        try:
-            os.unlink(tmp_name)
-        except OSError:
-            pass
+        with contextlib.suppress(OSError):
+            pathlib.Path(tmp_name).unlink()
         raise
 
 
@@ -640,17 +634,13 @@ def _write_hash(plugin_data: pathlib.Path, current_hash: str) -> None:
         os.write(tmp_fd, content_bytes)
         os.close(tmp_fd)
         tmp_fd = -1
-        os.replace(tmp_name, hash_path)
+        pathlib.Path(tmp_name).replace(hash_path)
     except Exception:
         if tmp_fd >= 0:
-            try:
+            with contextlib.suppress(OSError):
                 os.close(tmp_fd)
-            except OSError:
-                pass
-        try:
-            os.unlink(tmp_name)
-        except OSError:
-            pass
+        with contextlib.suppress(OSError):
+            pathlib.Path(tmp_name).unlink()
         raise
 
 
@@ -892,7 +882,7 @@ def _main_claude_plugins(args: argparse.Namespace) -> int:
     new_entry: dict = {
         "name": pack_name,
         "version": pack_version,
-        "installed-at": datetime.datetime.now(timezone.utc),
+        "installed-at": datetime.datetime.now(datetime.UTC),
         "install-route": args.install_route,
     }
 
@@ -912,7 +902,10 @@ def _main_claude_plugins(args: argparse.Namespace) -> int:
     except Exception as exc:
         # Hash write failure is non-fatal for the adopter (the marker was written),
         # but log it so the next session retries detection rather than silently skipping.
-        print(f"install-marker: hash write failed (next session will retry): {exc}", file=sys.stderr)
+        print(
+            f"install-marker: hash write failed (next session will retry): {exc}",
+            file=sys.stderr,
+        )
 
     return 0
 
@@ -935,7 +928,7 @@ def _main_apm(args: argparse.Namespace) -> int:
     home = pathlib.Path(home_str)
 
     # --- Resolve data directory per AC3 precedence ---
-    plugin_data = _resolve_data_dir(env)
+    plugin_data = _resolve_data_dir(env)  # type: ignore[arg-type]
     if plugin_data is None:
         # No-match fall-through (no APM data-directory token set); exit 0
         # without writing marker or hash file (the no-partial-state rail).
@@ -1072,7 +1065,7 @@ def _main_apm(args: argparse.Namespace) -> int:
     new_entry: dict = {
         "name": pack_name,
         "version": pack_version,
-        "installed-at": datetime.datetime.now(timezone.utc),
+        "installed-at": datetime.datetime.now(datetime.UTC),
         "install-route": args.install_route,
     }
 

{agentbundle-0.20.1 → agentbundle-0.22.0}/agentbundle/build/self_host.py

@@ -1482,7 +1482,7 @@ def run_build_check_drift_gates(
                     except _PARITY_EXPECTED_EXC as exc:
                         source_out = f"<{type(exc).__name__}: {exc}>"
                     try:
-                        template_out: object = template_emit(test_input)
+                        template_out: object = template_emit(test_input)  # type: ignore[operator]
                     except _PARITY_EXPECTED_EXC as exc:
                         template_out = f"<{type(exc).__name__}: {exc}>"
                     if source_out != template_out:

{agentbundle-0.20.1 → agentbundle-0.22.0}/agentbundle/build/tests/test_contract.py

@@ -602,10 +602,10 @@ class TestCodexSkillDirectDirectory(unittest.TestCase):
         self.assertNotIn("managed-block-delimiter-end", entry)
 
     def test_contract_files_byte_identical(self) -> None:
-        self.assertEqual(
-            CONTRACT_PATH.read_bytes(),
-            DATA_CONTRACT_PATH.read_bytes(),
-        )
+        def _norm(p: Path) -> bytes:
+            return p.read_bytes().replace(b"\r\n", b"\n")
+
+        self.assertEqual(_norm(CONTRACT_PATH), _norm(DATA_CONTRACT_PATH))
 
     def test_seed_agents_md_has_no_legacy_delimiters(self) -> None:
         text = SEED_AGENTS_MD_PATH.read_text(encoding="utf-8")

{agentbundle-0.20.1 → agentbundle-0.22.0}/agentbundle/build/tests/test_lint_agents_md_diataxis_block.py

@@ -47,12 +47,14 @@ def _make_quadrants(base: Path) -> None:
 
 
 def _run_linter(cwd: Path) -> subprocess.CompletedProcess[str]:
+    env = {**os.environ, "PYTHONIOENCODING": "utf-8", "PYTHONUTF8": "1"}
     return subprocess.run(
         [sys.executable, str(LINTER)],
         cwd=cwd,
-        env=dict(os.environ),
+        env=env,
         capture_output=True,
         text=True,
+        encoding="utf-8",
         check=False,
     )
 

{agentbundle-0.20.1 → agentbundle-0.22.0}/agentbundle/build/tests/test_lint_agents_md_legacy_block.py

@@ -63,13 +63,14 @@ def _seed_tree(
 
 
 def _run_linter(cwd: Path) -> subprocess.CompletedProcess[str]:
-    env = dict(os.environ)
+    env = {**os.environ, "PYTHONIOENCODING": "utf-8", "PYTHONUTF8": "1"}
     return subprocess.run(
         [sys.executable, str(LINTER)],
         cwd=cwd,
         env=env,
         capture_output=True,
         text=True,
+        encoding="utf-8",
         check=False,
     )
 

{agentbundle-0.20.1 → agentbundle-0.22.0}/agentbundle/build/tests/test_lint_agents_md_risk_block.py

@@ -52,12 +52,14 @@ def _seed(root: Path, canonical_block: str, agents_block: str) -> None:
 
 
 def _run_linter(cwd: Path) -> subprocess.CompletedProcess[str]:
+    env = {**os.environ, "PYTHONIOENCODING": "utf-8", "PYTHONUTF8": "1"}
     return subprocess.run(
         [sys.executable, str(LINTER)],
         cwd=cwd,
-        env=dict(os.environ),
+        env=env,
         capture_output=True,
         text=True,
+        encoding="utf-8",
         check=False,
     )