devin-devkit-workspace 0.0.0__py3-none-any.whl

devin_devkit_workspace-0.0.0.dist-info/METADATA

@@ -0,0 +1,7 @@
+Metadata-Version: 2.4
+Name: devin-devkit-workspace
+Version: 0.0.0
+Summary: Monorepo workspace for the devin-devkit product: devkit, skill-catalog.
+Requires-Python: >=3.10
+License-File: LICENSE
+Dynamic: license-file

devin_devkit_workspace-0.0.0.dist-info/RECORD

@@ -0,0 +1,13 @@
+devin_devkit_workspace-0.0.0.dist-info/licenses/LICENSE,sha256=dxS8nFGmsVpbMH3Qz4fmf0j6irSSpO4k5H5F6ZealWg,1066
+packages/devkit/src/devin_devkit/__init__.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
+packages/devkit/src/devin_devkit/cli.py,sha256=d47vn96QAuW-inihysQ6PZnC_YoWjP1WVKGnMaBMuJE,6348
+packages/devkit/src/devin_devkit/installer.py,sha256=4sD6jF4mhiXCRiHKHfR8MnS9igPMSow5ltRcpMGtvuc,9369
+packages/devkit/src/devin_devkit/updater.py,sha256=Ula6hTPJul1LPd0pqcOzmd4iAKem3LMXHrrK_tC23TU,8916
+packages/devkit/tests/test_cli.py,sha256=uu0A-BQ0FT-UN8rD3kVdDvF8u-JAUp6k16siHXxlCxk,2886
+packages/devkit/tests/test_installer.py,sha256=Rth95irzttYwlT_KDoEC_ZEni9CIOmy9WTsyFG5Lj14,11081
+packages/devkit/tests/test_smoke.py,sha256=6jAwEWLs6iLIvq-PfrfR-ILSmRob29MxrAA-l6pPcAg,80
+packages/devkit/tests/test_updater.py,sha256=HXJRqdy_woNs6v0QrZnTi3CV96BVoW-Sj-VJ9yhmqNg,9030
+devin_devkit_workspace-0.0.0.dist-info/METADATA,sha256=tt31MduRpnuj2koIXLbh0Dl2QfYusfJGK8mXMfQrLug,215
+devin_devkit_workspace-0.0.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+devin_devkit_workspace-0.0.0.dist-info/top_level.txt,sha256=KlHxfoENEXdJ6vF3m8uvAis67kLBNoPQkFKHOFVIVlM,9
+devin_devkit_workspace-0.0.0.dist-info/RECORD,,

devin_devkit_workspace-0.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

devin_devkit_workspace-0.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Icaro0310
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

devin_devkit_workspace-0.0.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+packages

packages/devkit/src/devin_devkit/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

packages/devkit/src/devin_devkit/cli.py

@@ -0,0 +1,128 @@
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+from devin_devkit.installer import DevKitError, apply_plan, build_plan, load_manifest
+from devin_devkit.updater import (
+    apply_update_plan,
+    build_update_plan,
+    fetch_remote_manifest,
+    freshness_hint,
+)
+
+
+def _print_plan(plan: dict[str, Any], as_json: bool) -> None:
+    if as_json:
+        print(json.dumps(plan, ensure_ascii=False, indent=2))
+        return
+    print(f"Profile: {plan['profile']} ({plan['platform']}; environment={plan['environment']}; runtime={plan['runtime']})")
+    for item in plan["actions"]:
+        command = " ".join(item.get("command", []))
+        detail = item.get("detail", "")
+        suffix = f" — {detail}" if detail else ""
+        print(f"- {item['tool']}: {item['action']}{suffix}{': ' + command if command else ''}")
+    for error in plan["errors"]:
+        print(f"BLOCKED: {error}", file=sys.stderr)
+    if not plan["errors"] and any(item["action"] == "install" for item in plan["actions"]):
+        print("Dry run only. Re-run with --apply to install.")
+
+
+def _build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="devin-devkit", description="Install curated Devin tool profiles with isolated uv/npm environments.")
+    parser.add_argument("--manifest", type=Path, help=argparse.SUPPRESS)
+    sub = parser.add_subparsers(dest="action", required=True)
+    sub.add_parser("profiles", help="list available installation profiles")
+    sub.add_parser("list", help="list the tools in the manifest")
+    install = sub.add_parser("install", help="preview a profile; pass --apply to install")
+    install.add_argument("profile")
+    install.add_argument("--apply", action="store_true", help="install the selected profile")
+    install.add_argument("--json", action="store_true", help="print the plan as JSON")
+    install.add_argument(
+        "--environment",
+        choices=["linux", "personal-windows", "corporate-windows"],
+        help="execution environment; defaults to linux on Linux and personal-windows on Windows",
+    )
+    outdated = sub.add_parser("outdated", help="list installed tools with a newer version in the remote registry")
+    outdated.add_argument("--json", action="store_true", help="print the check as JSON")
+    update = sub.add_parser("update", help="preview tool updates; pass --apply to install them")
+    update.add_argument("--apply", action="store_true", help="reinstall outdated tools")
+    update.add_argument("--force", action="store_true", help="reinstall every installed tool")
+    update.add_argument("--json", action="store_true", help="print the plan as JSON")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = _build_parser()
+    args = parser.parse_args(argv)
+    try:
+        manifest = load_manifest(args.manifest)
+        if args.action in {"outdated", "update"}:
+            remote = fetch_remote_manifest()
+            plan = build_update_plan(remote, force=args.action == "update" and args.force)
+            if args.json:
+                print(json.dumps(plan, ensure_ascii=False, indent=2))
+            else:
+                print(f"Remote registry v{plan['registry_version']} (generated {plan['generated']})")
+                for item in plan["actions"]:
+                    if item["action"] == "update":
+                        print(f"- {item['tool']}: {item['from']} -> {item['to']}")
+                    elif item["action"] == "current":
+                        print(f"- {item['tool']}: up to date ({item['version']})")
+                    elif item["action"] == "blocked":
+                        print(f"- {item['tool']}: BLOCKED — {item['detail']}")
+            if args.action == "outdated":
+                return 0
+            pending = [a for a in plan["actions"] if a["action"] == "update"]
+            if not args.apply:
+                if pending:
+                    print("Dry run only. Re-run with --apply to update.")
+                return 0
+            result = apply_update_plan(plan)
+            print(f"Updated: {', '.join(result['updated']) or 'nothing'}")
+            for name in result["failed"]:
+                print(f"FAILED: {name}", file=sys.stderr)
+            return 1 if result["failed"] else 0
+        if args.action == "profiles":
+            for name, profile in manifest["profiles"].items():
+                alias = f" (alias of {profile['alias_of']})" if profile.get("alias_of") else ""
+                print(f"{name}: {profile['label']}{alias} — {profile['description']}")
+            return 0
+        if args.action == "list":
+            cat = manifest["catalog"]
+            pl = lambda n: "" if n == 1 else "s"  # noqa: E731
+            print(f"{cat['tool_count']} first-party Devin tools; {cat['distribution_count']} distribution layer{pl(cat['distribution_count'])}; {cat['hub_count']} maintainer hub{pl(cat['hub_count'])}; {cat['related_count']} related project{pl(cat['related_count'])}")
+            for tool in manifest["tools"]:
+                print(f"{tool['id']}: {tool['package']} {tool['version']} [{tool['manager']}/{tool['source']}/{tool['status']}]")
+            hint = freshness_hint(manifest)
+            if hint:
+                print(hint, file=sys.stderr)
+            return 0
+
+        plan = build_plan(manifest, args.profile, environment=args.environment)
+        if not args.apply:
+            _print_plan(plan, args.json)
+            hint = freshness_hint(manifest)
+            if hint:
+                print(hint, file=sys.stderr)
+            return 2 if plan["errors"] else 0
+        if plan["errors"]:
+            _print_plan(plan, args.json)
+            return 2
+        result = apply_plan(plan)
+        print(json.dumps(result, ensure_ascii=False, indent=2) if args.json else f"Installed: {', '.join(result['installed']) or 'nothing new'}")
+        for item in result["actions"]:
+            if item["action"] in {"preexisting", "manual", "unsupported"}:
+                detail = item.get("detail", ", ".join(item.get("commands", [])))
+                print(f"- {item['tool']}: {item['action']} — {detail}")
+        return 0
+    except DevKitError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

packages/devkit/src/devin_devkit/installer.py

@@ -0,0 +1,213 @@
+from __future__ import annotations
+
+import json
+import platform as platform_module
+import re
+import shutil
+import subprocess
+from importlib.resources import files
+from pathlib import Path
+from typing import Any, Callable
+
+
+class DevKitError(RuntimeError):
+    pass
+
+
+def load_manifest(path: Path | None = None) -> dict[str, Any]:
+    source = path if path is not None else files("devin_devkit").joinpath("manifest.json")
+    try:
+        text = Path(source).read_text(encoding="utf-8") if path else source.read_text(encoding="utf-8")
+        return json.loads(text)
+    except (OSError, json.JSONDecodeError) as exc:
+        raise DevKitError(f"cannot load manifest {source}: {exc}") from exc
+
+
+def platform_name(system: str | None = None) -> str:
+    value = (system or platform_module.system()).lower()
+    if value in {"nt", "windows"}:
+        return "windows"
+    if value in {"posix", "linux"}:
+        return "linux"
+    if value in {"darwin", "macos"}:
+        return "macos"
+    return value
+
+
+_ENVIRONMENT_ALIASES = {
+    "linux": "linux",
+    "personal-windows": "personal_windows",
+    "personal_windows": "personal_windows",
+    "windows": "personal_windows",
+    "corporate-windows": "corporate_windows",
+    "corporate_windows": "corporate_windows",
+    "corporate": "corporate_windows",
+}
+
+
+def normalize_environment(environment: str | None, host: str) -> str:
+    if environment is None:
+        return "personal_windows" if host == "windows" else host
+    normalized = _ENVIRONMENT_ALIASES.get(environment.lower())
+    if normalized is None:
+        raise ValueError(f"unsupported environment: {environment}")
+    expected_host = "windows" if normalized.endswith("_windows") else normalized
+    if host != expected_host:
+        raise ValueError(f"environment {normalized} cannot run on host platform {host}")
+    return normalized
+
+
+def resolve_profile(manifest: dict[str, Any], name: str) -> tuple[str, dict[str, Any]]:
+    profiles = manifest.get("profiles", {})
+    if name not in profiles:
+        raise DevKitError(f"unknown profile {name!r}; choose from: {', '.join(sorted(profiles))}")
+    current = name
+    seen: set[str] = set()
+    while profiles[current].get("alias_of"):
+        if current in seen:
+            raise DevKitError(f"profile alias cycle at {current!r}")
+        seen.add(current)
+        current = profiles[current]["alias_of"]
+        if current not in profiles:
+            raise DevKitError(f"profile {name!r} points to missing alias target {current!r}")
+    return current, profiles[current]
+
+
+def _node_major(runner: Callable[..., Any], which: Callable[[str], str | None]) -> int | None:
+    if which("node") is None:
+        return None
+    try:
+        result = runner(["node", "--version"], capture_output=True, text=True, check=False)
+    except OSError:
+        return None
+    match = re.search(r"v?(\d+)", result.stdout or "")
+    return int(match.group(1)) if match else None
+
+
+def build_plan(
+    manifest: dict[str, Any],
+    profile_name: str,
+    *,
+    system: str | None = None,
+    environment: str | None = None,
+    which: Callable[[str], str | None] = shutil.which,
+    runner: Callable[..., Any] = subprocess.run,
+) -> dict[str, Any]:
+    resolved_name, profile = resolve_profile(manifest, profile_name)
+    host = platform_name(system)
+    if host not in manifest.get("supported_platforms", []):
+        planned = ", ".join(manifest.get("planned_platforms", [])) or "none"
+        raise DevKitError(f"platform {host!r} is not supported; planned platforms: {planned}")
+    try:
+        selected_environment = normalize_environment(environment, host)
+    except ValueError as exc:
+        raise DevKitError(str(exc)) from exc
+    if selected_environment not in manifest.get("environments", {}):
+        raise DevKitError(f"manifest does not define environment {selected_environment!r}")
+
+    tool_map = {tool["id"]: tool for tool in manifest.get("tools", [])}
+    actions: list[dict[str, Any]] = []
+    errors: list[str] = []
+    node_major = None
+
+    for tool_id in profile.get("tools", []):
+        tool = tool_map.get(tool_id)
+        if tool is None:
+            errors.append(f"profile {resolved_name!r} references unknown tool {tool_id!r}")
+            continue
+        environment_meta = tool.get("environments", {}).get(selected_environment)
+        if environment_meta is None:
+            errors.append(f"{tool_id} has no {selected_environment} environment metadata")
+            actions.append({"tool": tool_id, "action": "unsupported", "detail": f"no metadata for {selected_environment}"})
+            continue
+        if not environment_meta.get("supported"):
+            reason = environment_meta.get("reason", f"not listed for {selected_environment}")
+            errors.append(f"{tool_id} is unsupported in {selected_environment}: {reason}")
+            actions.append({"tool": tool_id, "action": "unsupported", "detail": reason})
+            continue
+        if selected_environment == "corporate_windows" and (
+            environment_meta.get("external_dependencies") or environment_meta.get("delegation") in {"optional", "supported", "required"}
+        ):
+            reason = "external runtime or delegation is disabled in corporate Windows"
+            errors.append(f"{tool_id} violates the corporate Windows local-only guarantee")
+            actions.append({"tool": tool_id, "action": "blocked", "detail": reason})
+            continue
+        if host not in tool.get("platforms", []):
+            actions.append({"tool": tool_id, "action": "unsupported", "detail": f"not listed for {host}"})
+            continue
+        if tool.get("status") == "manual" or tool.get("manager") == "manual":
+            actions.append({"tool": tool_id, "action": "manual", "detail": tool.get("manual_note", "manual setup required")})
+            continue
+
+        manager = tool["manager"]
+        commands = tool.get("commands", [])
+        present = [command for command in commands if which(command) is not None]
+        if present:
+            if len(present) == len(commands):
+                actions.append({"tool": tool_id, "action": "preexisting", "detail": "commands are on PATH; versions are not verified", "commands": present})
+            else:
+                missing = [command for command in commands if command not in present]
+                errors.append(f"{tool_id} has a partial PATH collision; present={present}, missing={missing}")
+                actions.append({"tool": tool_id, "action": "blocked", "detail": "partial command collision"})
+            continue
+
+        manager_binary = "uv" if manager == "uv" else "npm"
+        if which(manager_binary) is None:
+            errors.append(f"{tool_id} requires {manager_binary} on PATH")
+            actions.append({"tool": tool_id, "action": "blocked", "detail": f"missing {manager_binary}"})
+            continue
+        if tool.get("requires_git") and which("git") is None:
+            errors.append(f"{tool_id} has a Git dependency and requires git on PATH")
+            actions.append({"tool": tool_id, "action": "blocked", "detail": "missing git"})
+            continue
+        if manager == "npm":
+            if node_major is None:
+                node_major = _node_major(runner, which)
+            if node_major is None or node_major < 20:
+                errors.append(f"{tool_id} requires Node.js >=20")
+                actions.append({"tool": tool_id, "action": "blocked", "detail": "Node.js >=20 is required"})
+                continue
+
+        spec = tool.get("install_spec")
+        if not spec:
+            errors.append(f"{tool_id} has no install specification")
+            actions.append({"tool": tool_id, "action": "blocked", "detail": "missing install specification"})
+            continue
+        command = ["uv", "tool", "install", spec] if manager == "uv" else ["npm", "install", "--global", spec]
+        actions.append({"tool": tool_id, "action": "install", "command": command})
+
+    manual = [
+        {"tool": name, "action": "manual", "detail": tool_map.get(name, {}).get("manual_note", "manual setup required")}
+        for name in profile.get("manual", [])
+    ]
+    actions.extend(manual)
+    return {
+        "profile": profile_name,
+        "resolved_profile": resolved_name,
+        "platform": host,
+        "environment": selected_environment,
+        "runtime": manifest["environments"][selected_environment].get("runtime"),
+        "dry_run": True,
+        "actions": actions,
+        "errors": errors,
+    }
+
+
+def apply_plan(plan: dict[str, Any], runner: Callable[..., Any] = subprocess.run) -> dict[str, Any]:
+    if plan["errors"]:
+        raise DevKitError("preflight failed: " + "; ".join(plan["errors"]))
+    completed: list[str] = []
+    for action in plan["actions"]:
+        if action["action"] != "install":
+            continue
+        try:
+            result = runner(action["command"], check=False)
+        except OSError as exc:
+            raise DevKitError(f"failed to start {action['tool']}: {exc}") from exc
+        if result.returncode:
+            raise DevKitError(
+                f"install failed for {action['tool']} (exit {result.returncode}); "
+                f"completed before failure: {completed}"
+            )
+        completed.append(action["tool"])
+    return {"profile": plan["profile"], "installed": completed, "actions": plan["actions"]}

packages/devkit/src/devin_devkit/updater.py

@@ -0,0 +1,262 @@
+"""Update installed tools against the remote devkit manifest.
+
+The bundled ``manifest.json`` is a snapshot: every install spec is pinned to a
+PyPI version or a GitHub tarball SHA at export time, so installs never move by
+themselves. This module fetches the manifest published in the devin-devkit
+repository (always the newest registry export) and computes a plan to bring
+installed tools up to date.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+import shutil
+import subprocess
+import urllib.error
+import urllib.request
+from pathlib import Path
+from typing import Any, Callable
+
+from devin_devkit.installer import DevKitError
+
+REMOTE_MANIFEST_URL = (
+    "https://raw.githubusercontent.com/Icaro0310/devin-devkit/main/"
+    "packages/devkit/src/devin_devkit/manifest.json"
+)
+FETCH_TIMEOUT = 15
+
+
+def fetch_remote_manifest(
+    url: str = REMOTE_MANIFEST_URL,
+    *,
+    opener: Callable[..., Any] | None = None,
+) -> dict[str, Any]:
+    """Download and parse the published manifest; raise DevKitError on failure."""
+    open_fn = opener or urllib.request.urlopen
+    try:
+        with open_fn(url, timeout=FETCH_TIMEOUT) as response:
+            data = json.loads(response.read().decode("utf-8"))
+    except (OSError, urllib.error.URLError, json.JSONDecodeError) as exc:
+        raise DevKitError(f"cannot fetch remote manifest: {exc}") from exc
+    if data.get("schema") != "devin-devkit-manifest/0.1":
+        raise DevKitError("remote manifest has an unexpected schema")
+    return data
+
+
+def installed_uv_tools(
+    runner: Callable[..., Any] = subprocess.run,
+) -> dict[str, str]:
+    """Return {package: version} from ``uv tool list``."""
+    try:
+        result = runner(
+            ["uv", "tool", "list"], capture_output=True, text=True, check=False
+        )
+    except OSError:
+        return {}
+    if result.returncode != 0:
+        return {}
+    installed: dict[str, str] = {}
+    for line in (result.stdout or "").splitlines():
+        if not line.strip() or line.startswith("-"):
+            continue
+        name, _, version = line.strip().partition(" ")
+        if name:
+            installed[name] = version.lstrip("v")
+    return installed
+
+
+try:
+    import tomllib
+except ImportError:  # Python 3.10 — declared as a conditional dependency
+    import tomli as tomllib
+
+
+def _uv_tools_dir() -> Path:
+    override = os.environ.get("UV_TOOL_DIR")
+    return (
+        Path(override)
+        if override
+        else Path.home() / ".local" / "share" / "uv" / "tools"
+    )
+
+
+def installed_uv_specs(
+    tools_dir: str | Path | None = None,
+) -> dict[str, str]:
+    """Return {package: installed requirement} parsed from uv receipts.
+
+    ``uv tool list`` reports only name and version; the per-tool
+    ``uv-receipt.toml`` also records the requirement, including the
+    source URL for non-PyPI installs. That lets the updater detect a
+    channel migration (git archive -> PyPI) even when the version number
+    did not change.
+    """
+    root = Path(tools_dir) if tools_dir else _uv_tools_dir()
+    specs: dict[str, str] = {}
+    if not root.is_dir():
+        return specs
+    for receipt in root.glob("*/uv-receipt.toml"):
+        try:
+            data = tomllib.loads(receipt.read_text(encoding="utf-8"))
+        except (OSError, tomllib.TOMLDecodeError):
+            continue
+        for req in data.get("tool", {}).get("requirements", []):
+            if not isinstance(req, dict):
+                continue
+            name = req.get("name")
+            if not name:
+                continue
+            specs[name] = req.get("url") or f"{name}{req.get('specifier', '')}"
+    return specs
+
+
+def _spec_channel(spec: str) -> str:
+    """Compare-key for install specs: PyPI installs collapse to 'pypi',
+    URL installs compare by exact URL."""
+    if re.match(r"(https?://|git\+)", spec):
+        return f"url:{spec}"
+    return "pypi"
+
+
+def installed_npm_tools(
+    runner: Callable[..., Any] = subprocess.run,
+) -> dict[str, str]:
+    """Return {package: version} from ``npm ls -g --depth=0 --json``."""
+    try:
+        result = runner(
+            ["npm", "ls", "--global", "--depth=0", "--json"],
+            capture_output=True, text=True, check=False,
+        )
+    except OSError:
+        return {}
+    try:
+        data = json.loads(result.stdout or "{}")
+    except json.JSONDecodeError:
+        return {}
+    return {
+        name: meta.get("version", "")
+        for name, meta in data.get("dependencies", {}).items()
+        if isinstance(meta, dict)
+    }
+
+
+def build_update_plan(
+    remote: dict[str, Any],
+    *,
+    installed: dict[str, str] | None = None,
+    installed_specs: dict[str, str] | None = None,
+    which: Callable[[str], str | None] = shutil.which,
+    runner: Callable[..., Any] = subprocess.run,
+    force: bool = False,
+) -> dict[str, Any]:
+    """Diff installed tools against the remote manifest.
+
+    ``installed`` maps package name to installed version; when None it is
+    discovered via ``uv tool list`` and ``npm ls -g``.
+    ``installed_specs`` maps package name to the requirement it was
+    installed from (uv receipts); when None it is discovered via
+    ``installed_uv_specs``. A same-version channel change (git archive
+    -> PyPI pin) plans a reinstall rather than reporting ``current``.
+    """
+    if installed is None:
+        installed = installed_uv_tools(runner)
+        installed.update(installed_npm_tools(runner))
+    if installed_specs is None:
+        installed_specs = installed_uv_specs()
+
+    actions: list[dict[str, Any]] = []
+    for tool in remote.get("tools", []):
+        tool_id = tool["id"]
+        manager = tool.get("manager")
+        if manager == "manual" or tool.get("status") == "manual":
+            continue
+        commands = tool.get("commands", [])
+        on_path = any(which(command) is not None for command in commands)
+        if tool["package"] not in installed and not on_path:
+            actions.append({"tool": tool_id, "action": "not-installed"})
+            continue
+        spec = tool.get("install_spec")
+        if not spec:
+            actions.append({"tool": tool_id, "action": "blocked", "detail": "missing install specification"})
+            continue
+        local_version = installed.get(tool["package"], "?")
+        remote_version = tool.get("version", "?")
+        if not force and local_version == remote_version:
+            installed_spec = installed_specs.get(tool["package"])
+            if (
+                manager == "uv"
+                and installed_spec is not None
+                and _spec_channel(installed_spec) != _spec_channel(spec)
+            ):
+                actions.append({
+                    "tool": tool_id,
+                    "action": "update",
+                    "from": local_version,
+                    "to": remote_version,
+                    "reason": "install source changed",
+                    "command": ["uv", "tool", "install", "--force", spec],
+                })
+            else:
+                actions.append({"tool": tool_id, "action": "current", "version": local_version})
+            continue
+        command = (
+            ["uv", "tool", "install", "--force", spec]
+            if manager == "uv"
+            else ["npm", "install", "--global", spec]
+        )
+        actions.append({
+            "tool": tool_id,
+            "action": "update",
+            "from": local_version,
+            "to": remote_version,
+            "command": command,
+        })
+    return {
+        "registry_version": remote.get("registry_version"),
+        "generated": remote.get("generated"),
+        "actions": actions,
+    }
+
+
+def apply_update_plan(
+    plan: dict[str, Any],
+    runner: Callable[..., Any] = subprocess.run,
+) -> dict[str, Any]:
+    updated: list[str] = []
+    failed: list[str] = []
+    for action in plan["actions"]:
+        if action["action"] != "update":
+            continue
+        try:
+            result = runner(action["command"], check=False)
+        except OSError:
+            result = None
+        if result is None or result.returncode:
+            failed.append(action["tool"])
+        else:
+            updated.append(action["tool"])
+    return {"updated": updated, "failed": failed}
+
+
+def freshness_hint(
+    manifest: dict[str, Any],
+    *,
+    opener: Callable[..., Any] | None = None,
+) -> str | None:
+    """One-line hint when the remote registry is newer than the bundled manifest.
+
+    Never raises: network or parse problems simply return None.
+    """
+    try:
+        remote = fetch_remote_manifest(opener=opener)
+    except DevKitError:
+        return None
+    local_version = manifest.get("registry_version", 0)
+    remote_version = remote.get("registry_version", 0)
+    if remote_version > local_version:
+        return (
+            f"registry v{remote_version} is available "
+            f"(bundled: v{local_version}); run 'devin-devkit update'"
+        )
+    return None

packages/devkit/tests/test_cli.py

@@ -0,0 +1,79 @@
+from __future__ import annotations
+
+import json
+from types import SimpleNamespace
+
+import devin_devkit.cli as cli
+
+
+def test_profiles_and_list_use_bundled_registry(capsys):
+    assert cli.main(["profiles"]) == 0
+    profiles = capsys.readouterr().out
+    assert "qa: QA" in profiles
+    assert "full: Full" in profiles
+
+    assert cli.main(["list"]) == 0
+    catalog = capsys.readouterr().out
+    assert "19 first-party Devin tools" in catalog
+    assert "devin-office" in catalog
+
+
+def test_install_defaults_to_dry_run(monkeypatch, capsys):
+    plan = {
+        "profile": "qa",
+        "resolved_profile": "qa",
+        "platform": "linux",
+        "environment": "linux",
+        "runtime": "extended",
+        "dry_run": True,
+        "actions": [{
+            "tool": "devin-doctor",
+            "action": "install",
+            "command": ["uv", "tool", "install", "devin-doctor==0.1.0"],
+        }],
+        "errors": [],
+    }
+    monkeypatch.setattr(cli, "build_plan", lambda *args, **kwargs: plan)
+    monkeypatch.setattr(cli, "apply_plan", lambda *args, **kwargs: (_ for _ in ()).throw(AssertionError("must not apply")))
+
+    assert cli.main(["install", "qa"]) == 0
+    output = capsys.readouterr().out
+    assert "Dry run only" in output
+    assert "uv tool install devin-doctor==0.1.0" in output
+
+
+def test_apply_requires_explicit_flag_and_executes_plan(monkeypatch, capsys):
+    plan = {
+        "profile": "qa",
+        "resolved_profile": "qa",
+        "platform": "linux",
+        "environment": "linux",
+        "runtime": "extended",
+        "dry_run": True,
+        "actions": [{"tool": "devin-doctor", "action": "install", "command": ["uv", "tool", "install", "devin-doctor==0.1.0"]}],
+        "errors": [],
+    }
+    monkeypatch.setattr(cli, "build_plan", lambda *args, **kwargs: plan)
+    monkeypatch.setattr(cli, "apply_plan", lambda value: {"profile": value["profile"], "installed": ["devin-doctor"], "actions": value["actions"]})
+
+    assert cli.main(["install", "qa", "--apply", "--json"]) == 0
+    output = json.loads(capsys.readouterr().out)
+    assert output["installed"] == ["devin-doctor"]
+
+
+def test_apply_preflight_error_returns_without_installs(monkeypatch, capsys):
+    plan = {
+        "profile": "full",
+        "resolved_profile": "full",
+        "platform": "windows",
+        "environment": "corporate_windows",
+        "runtime": "local-only",
+        "dry_run": True,
+        "actions": [{"tool": "devin-bridge", "action": "blocked", "detail": "missing node"}],
+        "errors": ["devin-bridge requires Node.js >=20"],
+    }
+    monkeypatch.setattr(cli, "build_plan", lambda *args, **kwargs: plan)
+    monkeypatch.setattr(cli, "apply_plan", lambda *args, **kwargs: (_ for _ in ()).throw(AssertionError("must not apply")))
+
+    assert cli.main(["install", "full", "--apply"]) == 2
+    assert "requires Node.js >=20" in capsys.readouterr().err

packages/devkit/tests/test_installer.py

@@ -0,0 +1,226 @@
+from __future__ import annotations
+
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from devin_devkit import installer
+
+
+def supported_environments():
+    return {
+        "linux": {"supported": True, "runtime": "extended", "delegation": "optional", "external_dependencies": False},
+        "personal_windows": {"supported": True, "runtime": "extended", "delegation": "optional", "external_dependencies": False},
+        "corporate_windows": {"supported": True, "runtime": "local-only", "delegation": "forbidden", "external_dependencies": False},
+    }
+
+
+def sample_manifest():
+    return {
+        "schema": "devin-devkit-manifest/0.1",
+        "supported_platforms": ["windows", "linux"],
+        "planned_platforms": ["macos"],
+        "environments": {
+            "linux": {"label": "Linux", "runtime": "extended", "delegation": "optional", "local_only": False, "external_compute": True, "devkit": "linux"},
+            "personal_windows": {"label": "Personal Windows", "runtime": "extended", "delegation": "optional", "local_only": False, "external_compute": True, "devkit": "personal-windows"},
+            "corporate_windows": {"label": "Corporate Windows", "runtime": "local-only", "delegation": "forbidden", "local_only": True, "external_compute": False, "devkit": "corporate-windows"},
+        },
+        "git_required_tools": ["devin-history"],
+        "catalog": {"tool_count": 2, "hub_count": 1, "related_count": 0, "entry_count": 3},
+        "profiles": {
+            "qa": {"label": "QA", "description": "test", "tools": ["devin-doctor"]},
+            "all": {"label": "All", "description": "all", "tools": ["devin-doctor"], "alias_of": "qa"},
+            "full": {"label": "Full", "description": "full", "tools": ["devin-doctor", "devin-bridge", "devin-history"], "manual": ["devin-office"]},
+        },
+        "tools": [
+            {
+                "id": "devin-doctor", "manager": "uv", "source": "pypi",
+                "package": "devin-doctor", "version": "0.1.0",
+                "commands": ["devin-doctor"], "runtime": "python>=3.10",
+                "platforms": ["windows", "linux"], "status": "published",
+                "environments": supported_environments(),
+                "install_spec": "devin-doctor==0.1.0", "manual_note": None,
+            },
+            {
+                "id": "devin-bridge", "manager": "npm", "source": "github",
+                "package": "@icaro0310/devin-bridge", "version": "0.1.0",
+                "commands": ["devin-bridge"], "runtime": "node>=20",
+                "platforms": ["windows", "linux"], "status": "source",
+                "environments": supported_environments(),
+                "install_spec": "https://github.com/Icaro0310/devin-bridge/archive/abc.tar.gz", "requires_git": False, "manual_note": None,
+            },
+            {
+                "id": "devin-history", "manager": "uv", "source": "github",
+                "package": "devin-history", "version": "0.1.0",
+                "commands": ["devin-history"], "runtime": "python>=3.10",
+                "platforms": ["windows", "linux"], "status": "source",
+                "environments": supported_environments(),
+                "install_spec": "https://github.com/Icaro0310/devin-history/archive/def.tar.gz", "requires_git": True,
+            },
+            {
+                "id": "devin-office", "manager": "manual", "source": "manual",
+                "package": "devin-office", "version": "0.1.0",
+                "commands": ["python daemon.py"], "runtime": "python>=3.10",
+                "platforms": ["windows", "linux"], "status": "manual",
+                "environments": supported_environments(),
+                "install_spec": None, "manual_note": "source-only service",
+            },
+        ],
+    }
+
+
+def test_platform_detection_is_os_aware():
+    assert installer.platform_name("Windows") == "windows"
+    assert installer.platform_name("Linux") == "linux"
+    assert installer.platform_name("Darwin") == "macos"
+
+
+def test_alias_resolves_and_plan_has_no_side_effects():
+    calls = []
+    which = lambda name: f"/tools/{name}" if name in {"uv", "git"} else None
+    runner = lambda *args, **kwargs: calls.append(args[0]) or SimpleNamespace(stdout="", returncode=0)
+
+    plan = installer.build_plan(sample_manifest(), "all", system="linux", which=which, runner=runner)
+
+    assert plan["resolved_profile"] == "qa"
+    assert plan["actions"][0]["command"] == ["uv", "tool", "install", "devin-doctor==0.1.0"]
+    assert calls == []
+
+
+def test_manual_service_is_reported_not_silently_installed():
+    which = lambda name: f"/tools/{name}" if name == "uv" else None
+    plan = installer.build_plan(sample_manifest(), "full", system="linux", which=which)
+
+    office = next(a for a in plan["actions"] if a["tool"] == "devin-office")
+    assert office["action"] == "manual"
+    assert office["detail"] == "source-only service"
+
+
+def test_git_sources_block_before_any_installs_when_git_is_missing():
+    which = lambda name: f"/tools/{name}" if name in {"uv", "npm", "node"} else None
+    runner = lambda *args, **kwargs: SimpleNamespace(stdout="v22.0.0", returncode=0)
+    plan = installer.build_plan(sample_manifest(), "full", system="linux", which=which, runner=runner)
+
+    assert plan["errors"] == ["devin-history has a Git dependency and requires git on PATH"]
+    with pytest.raises(installer.DevKitError, match="preflight failed"):
+        installer.apply_plan(plan, runner=lambda *args, **kwargs: pytest.fail("must not run"))
+
+
+def test_github_archive_source_does_not_require_git():
+    which = lambda name: f"/tools/{name}" if name in {"uv", "npm", "node"} else None
+    runner = lambda *args, **kwargs: SimpleNamespace(stdout="v22.0.0", returncode=0)
+    manifest = sample_manifest()
+    manifest["profiles"]["qa"]["tools"] = ["devin-bridge"]
+    plan = installer.build_plan(manifest, "qa", system="linux", which=which, runner=runner)
+
+    assert plan["errors"] == []
+    bridge = plan["actions"][0]
+    assert bridge["action"] == "install"
+    assert bridge["command"][-1].startswith("https://github.com/")
+
+
+def test_node_runtime_is_checked_before_npm_install():
+    which = lambda name: f"/tools/{name}" if name in {"uv", "npm", "git", "node"} else None
+    runner = lambda *args, **kwargs: SimpleNamespace(stdout="v18.20.0", returncode=0)
+    plan = installer.build_plan(sample_manifest(), "full", system="windows", which=which, runner=runner)
+
+    assert "devin-bridge requires Node.js >=20" in plan["errors"]
+
+
+def test_existing_commands_are_not_overwritten():
+    which = lambda name: f"/tools/{name}" if name in {"uv", "devin-doctor"} else None
+    plan = installer.build_plan(sample_manifest(), "qa", system="windows", which=which)
+
+    assert plan["actions"] == [{"tool": "devin-doctor", "action": "preexisting", "detail": "commands are on PATH; versions are not verified", "commands": ["devin-doctor"]}]
+
+
+def test_partial_path_collision_blocks_install():
+    which = lambda name: f"/tools/{name}" if name in {"uv", "devin-memory"} else None
+    manifest = sample_manifest()
+    manifest["tools"][0]["commands"] = ["devin-memory", "devin-learning"]
+    plan = installer.build_plan(manifest, "qa", system="linux", which=which)
+
+    assert plan["errors"] and "partial PATH collision" in plan["errors"][0]
+
+
+def test_unsupported_macos_is_explicitly_rejected():
+    with pytest.raises(installer.DevKitError, match="not supported"):
+        installer.build_plan(sample_manifest(), "qa", system="Darwin")
+
+
+def test_apply_runs_only_install_actions():
+    calls = []
+    plan = {"profile": "qa", "errors": [], "actions": [
+        {"tool": "devin-doctor", "action": "install", "command": ["uv", "tool", "install", "devin-doctor==0.1.0"]},
+        {"tool": "devin-office", "action": "manual", "detail": "source-only service"},
+    ]}
+    runner = lambda cmd, **kwargs: calls.append(cmd) or SimpleNamespace(returncode=0)
+
+    result = installer.apply_plan(plan, runner=runner)
+
+    assert calls == [["uv", "tool", "install", "devin-doctor==0.1.0"]]
+    assert result["installed"] == ["devin-doctor"]
+
+
+def test_apply_fails_closed_on_preflight_errors():
+    plan = {"profile": "full", "errors": ["missing uv"], "actions": []}
+    with pytest.raises(installer.DevKitError, match="preflight failed"):
+        installer.apply_plan(plan, runner=lambda *args, **kwargs: pytest.fail("must not run"))
+
+
+def test_load_manifest_from_file(tmp_path: Path):
+    manifest = sample_manifest()
+    path = tmp_path / "manifest.json"
+    path.write_text(__import__("json").dumps(manifest), encoding="utf-8")
+    assert installer.load_manifest(path)["schema"] == "devin-devkit-manifest/0.1"
+
+
+def test_explicit_linux_environment_is_extended():
+    plan = installer.build_plan(sample_manifest(), "all", system="Linux", environment="linux", which=lambda c: "/bin/uv" if c == "uv" else None)
+    assert plan["environment"] == "linux"
+    assert plan["runtime"] == "extended"
+
+
+def test_windows_defaults_to_personal_windows_environment():
+    plan = installer.build_plan(sample_manifest(), "qa", system="Windows", which=lambda c: "C:/uv.exe" if c == "uv" else None)
+    assert plan["environment"] == "personal_windows"
+    assert plan["runtime"] == "extended"
+
+
+def test_corporate_windows_is_explicit_and_local_only():
+    plan = installer.build_plan(sample_manifest(), "qa", system="Windows", environment="corporate-windows", which=lambda c: "C:/uv.exe" if c == "uv" else None)
+    assert plan["environment"] == "corporate_windows"
+    assert plan["runtime"] == "local-only"
+
+
+def test_environment_must_match_host_platform():
+    with pytest.raises(installer.DevKitError, match="cannot run on host platform"):
+        installer.build_plan(sample_manifest(), "qa", system="Linux", environment="corporate-windows")
+
+
+def test_corporate_windows_rejects_external_dependencies():
+    manifest = sample_manifest()
+    manifest["tools"][0]["environments"]["corporate_windows"] = {
+        "supported": True,
+        "runtime": "local-only",
+        "delegation": "optional",
+        "external_dependencies": True,
+    }
+    plan = installer.build_plan(manifest, "all", system="Windows", environment="corporate-windows", which=lambda c: "C:/uv.exe" if c == "uv" else None)
+    assert plan["errors"] == ["devin-doctor violates the corporate Windows local-only guarantee"]
+    assert plan["actions"][0]["action"] == "blocked"
+
+
+def test_unsupported_environment_uses_registry_reason():
+    manifest = sample_manifest()
+    manifest["tools"][0]["environments"]["corporate_windows"] = {
+        "supported": False,
+        "runtime": "unavailable",
+        "delegation": "forbidden",
+        "external_dependencies": True,
+        "reason": "requires an external runtime",
+    }
+    plan = installer.build_plan(manifest, "all", system="Windows", environment="corporate-windows", which=lambda c: "C:/uv.exe" if c == "uv" else None)
+    assert plan["errors"] == ["devin-doctor is unsupported in corporate_windows: requires an external runtime"]
+    assert plan["actions"][0]["detail"] == "requires an external runtime"

packages/devkit/tests/test_smoke.py

@@ -0,0 +1,4 @@
+def test_import():
+    import devin_devkit
+
+    assert devin_devkit.__version__

packages/devkit/tests/test_updater.py

@@ -0,0 +1,233 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+
+from devin_devkit import updater
+from devin_devkit.installer import DevKitError
+
+
+def remote_manifest():
+    return {
+        "schema": "devin-devkit-manifest/0.1",
+        "registry_version": 11,
+        "generated": "2026-10-09",
+        "tools": [
+            {
+                "id": "devin-doctor", "manager": "uv", "source": "pypi",
+                "package": "devin-doctor", "version": "0.2.0",
+                "commands": ["devin-doctor"], "status": "published",
+                "install_spec": "devin-doctor==0.2.0",
+            },
+            {
+                "id": "devin-history", "manager": "uv", "source": "github",
+                "package": "devin-history", "version": "0.1.0",
+                "commands": ["devin-history"], "status": "source",
+                "install_spec": "https://example.com/history.tar.gz",
+            },
+            {
+                "id": "devin-bridge", "manager": "npm", "source": "github",
+                "package": "@icaro0310/devin-bridge", "version": "0.2.0",
+                "commands": ["devin-bridge"], "status": "source",
+                "install_spec": "https://example.com/bridge.tar.gz",
+            },
+            {
+                "id": "devin-office", "manager": "manual", "source": "manual",
+                "package": "devin-office", "version": "0.1.0",
+                "commands": ["devin-office"], "status": "manual",
+                "install_spec": None,
+            },
+        ],
+    }
+
+
+def which_all(command):
+    return f"/usr/bin/{command}"
+
+
+def which_none(command):
+    return None
+
+
+def test_plan_updates_only_installed_outdated_tools():
+    installed = {
+        "devin-doctor": "0.1.0",      # older than remote 0.2.0 -> update
+        "devin-history": "0.1.0",     # same version -> current
+        "@icaro0310/devin-bridge": "0.1.0",  # npm, older -> update
+    }
+    plan = updater.build_update_plan(remote_manifest(), installed=installed, installed_specs={}, which=which_none)
+    actions = {a["tool"]: a for a in plan["actions"]}
+
+    assert actions["devin-doctor"]["action"] == "update"
+    assert actions["devin-doctor"]["command"] == ["uv", "tool", "install", "--force", "devin-doctor==0.2.0"]
+    assert actions["devin-history"]["action"] == "current"
+    assert actions["devin-bridge"]["action"] == "update"
+    assert actions["devin-bridge"]["command"][0] == "npm"
+    assert "devin-office" not in actions  # manual tools are never touched
+
+
+def test_plan_detects_tools_on_path_not_in_uv_list():
+    plan = updater.build_update_plan(remote_manifest(), installed={}, installed_specs={}, which=which_all)
+    actions = {a["tool"]: a["action"] for a in plan["actions"]}
+    assert actions["devin-doctor"] == "update"  # on PATH but version unknown "?"
+    assert actions["devin-history"] == "update"
+
+
+def test_plan_skips_absent_tools():
+    plan = updater.build_update_plan(remote_manifest(), installed={}, installed_specs={}, which=which_none)
+    assert all(a["action"] == "not-installed" for a in plan["actions"])
+
+
+def test_force_reinstalls_current_tools():
+    installed = {"devin-history": "0.1.0"}
+    plan = updater.build_update_plan(remote_manifest(), installed=installed, installed_specs={}, which=which_none, force=True)
+    history = next(a for a in plan["actions"] if a["tool"] == "devin-history")
+    assert history["action"] == "update"
+
+
+def test_apply_reports_failures():
+    def runner(command, **kwargs):
+        if "history" in " ".join(command):
+            return SimpleNamespace(returncode=1)
+        return SimpleNamespace(returncode=0)
+
+    plan = updater.build_update_plan(
+        remote_manifest(),
+        installed={"devin-doctor": "0.1.0", "devin-history": "0.0.9"},
+        installed_specs={},
+        which=which_none,
+    )
+    result = updater.apply_update_plan(plan, runner=runner)
+    assert result["updated"] == ["devin-doctor"]
+    assert result["failed"] == ["devin-history"]
+
+
+def test_uv_tool_list_parsing():
+    def runner(command, **kwargs):
+        return SimpleNamespace(returncode=0, stdout="devin-doctor v0.1.0\n- devin-doctor\n")
+
+    assert updater.installed_uv_tools(runner) == {"devin-doctor": "0.1.0"}
+
+
+def test_freshness_hint_compares_registry_versions():
+    local = {"registry_version": 10}
+    remote = remote_manifest()  # registry_version 11
+
+    class FakeResponse:
+        def read(self):
+            import json
+            return json.dumps(remote).encode()
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+    hint = updater.freshness_hint(local, opener=lambda url, timeout: FakeResponse())
+    assert "registry v11" in hint
+    assert "update" in hint
+
+
+def test_freshness_hint_is_silent_when_current_or_offline():
+    local = {"registry_version": 99}
+    assert updater.freshness_hint(local, opener=lambda *a, **k: (_ for _ in ()).throw(OSError())) is None
+
+
+def test_same_version_channel_change_plans_reinstall():
+    """GitHub-archive install at the same version must be migrated to
+    the PyPI pin — version equality alone is not 'current'."""
+    manifest = remote_manifest()
+    manifest["tools"][0] = {
+        "id": "devin-evals", "manager": "uv", "source": "pypi",
+        "package": "devin-evals", "version": "0.2.0",
+        "commands": ["devin-evals"], "status": "published",
+        "install_spec": "devin-evals==0.2.0",
+    }
+    specs = {"devin-evals": "https://github.com/Icaro0310/devin-evals/archive/abc123.tar.gz"}
+    plan = updater.build_update_plan(
+        manifest,
+        installed={"devin-evals": "0.2.0"},
+        installed_specs=specs,
+        which=which_none,
+    )
+    action = next(a for a in plan["actions"] if a["tool"] == "devin-evals")
+    assert action["action"] == "update"
+    assert action["reason"] == "install source changed"
+    assert action["command"] == ["uv", "tool", "install", "--force", "devin-evals==0.2.0"]
+
+
+def test_same_version_same_source_stays_current():
+    manifest = remote_manifest()
+    specs = {"devin-history": "https://example.com/history.tar.gz"}
+    plan = updater.build_update_plan(
+        manifest,
+        installed={"devin-history": "0.1.0"},
+        installed_specs=specs,
+        which=which_none,
+    )
+    action = next(a for a in plan["actions"] if a["tool"] == "devin-history")
+    assert action["action"] == "current"
+
+
+def test_missing_receipt_falls_back_to_version_compare():
+    plan = updater.build_update_plan(
+        remote_manifest(),
+        installed={"devin-history": "0.1.0"},
+        installed_specs={},
+        which=which_none,
+    )
+    action = next(a for a in plan["actions"] if a["tool"] == "devin-history")
+    assert action["action"] == "current"
+
+
+def test_installed_uv_specs_parses_receipts(tmp_path):
+    (tmp_path / "devin-evals").mkdir()
+    (tmp_path / "devin-evals" / "uv-receipt.toml").write_text(
+        '[tool]\nrequirements = [{ name = "devin-evals", url = '
+        '"https://example.com/evals.tar.gz" }]\n'
+    )
+    (tmp_path / "devin-doctor").mkdir()
+    (tmp_path / "devin-doctor" / "uv-receipt.toml").write_text(
+        '[tool]\nrequirements = [{ name = "devin-doctor", specifier = "==0.2.0" }]\n'
+    )
+    specs = updater.installed_uv_specs(tmp_path)
+    assert specs["devin-evals"] == "https://example.com/evals.tar.gz"
+    assert specs["devin-doctor"] == "devin-doctor==0.2.0"
+
+
+def test_installed_uv_specs_handles_field_order_and_extras(tmp_path):
+    """Receipt fields may appear in any order with extra keys; the url
+    must still be found so archive installs aren't mislabeled PyPI."""
+    receipt = (
+        '[tool]\nrequirements = [\n'
+        '  { name = "devin-evals", extras = [], '
+        'url = "https://example.com/evals.tar.gz" },\n'
+        ']\nentrypoints = [\n'
+        '  { name = "devin-evals", install-path = "/x/devin-evals", '
+        'from = "devin-evals" },\n]\n'
+    )
+    (tmp_path / "devin-evals").mkdir()
+    (tmp_path / "devin-evals" / "uv-receipt.toml").write_text(receipt)
+    specs = updater.installed_uv_specs(tmp_path)
+    assert specs["devin-evals"] == "https://example.com/evals.tar.gz"
+
+
+def test_installed_uv_specs_nested_table_and_index_url(tmp_path):
+    """A requirement with an inline metadata table or an index-url field
+    must not hide the real install source."""
+    (tmp_path / "devin-evals").mkdir()
+    (tmp_path / "devin-evals" / "uv-receipt.toml").write_text(
+        '[tool]\nrequirements = [{ name = "devin-evals", '
+        'metadata = { note = "x" }, '
+        'url = "https://example.com/evals.tar.gz" }]\n'
+    )
+    (tmp_path / "devin-doctor").mkdir()
+    (tmp_path / "devin-doctor" / "uv-receipt.toml").write_text(
+        '[tool]\nrequirements = [{ name = "devin-doctor", '
+        'specifier = "==0.2.0", index-url = "https://pypi.example/simple" }]\n'
+    )
+    specs = updater.installed_uv_specs(tmp_path)
+    assert specs["devin-evals"] == "https://example.com/evals.tar.gz"
+    assert specs["devin-doctor"] == "devin-doctor==0.2.0"