add better EUID loading, ENV handling, provider subpackage resolution…

[pirate]

…, abxpkg version command, and more

---

---

Summary by cubic

Improves binary metadata (EUID/mtime), execution ENV building, and provider resolution (incl. subpackages); adds abxpkg version and abxpkg list. Also merges same‑name script dependency options into the run binary to prevent conflicts.

• New Features

  • Capture and show binary.euid/binary.mtime (README/CLI).
  • New CLI: abxpkg version, abxpkg list.
  • OS‑aware defaults via DEFAULT_PROVIDER_NAMES; ABXPKG_BINPROVIDERS respected for dependency and installer resolution. Subpackage‑aware provider resolution with version/abspath overrides. Per‑root derived.env caching for installer binaries and combined ENV with provenance.
  • Merge same‑name script dependency options into the run binary.

• Refactors & Fixes

  • Consistent exec ENV: providers implement setup_PATH()/ENV; build_exec_env() calls setup_PATH() and merges runtime + installer PATHs. Richer logging (provider emojis, clearer command/exception formatting, trace‑depth logs).
  • Normalize Python to <install_root>/venv/bin for pip/uv; tighten pip/pnpm ENV/cache; improve PATH/bin_dir across npm/yarn/bun/deno/gem/cargo/brew/nix/docker and drivers.
  • Respect explicit provider selection in dependency resolution; if installer resolution is restricted to itself, fall back to env. Fix installer cache writes/provenance, ENV PATH proxies, ambient dependency provider resolution, ENV relinking, and Nix profile cache path.
  • Resolve nullable security defaults (postinstall_scripts, min_release_age) before action handlers run. Limit Homebrew postinstall‑disable to install only and remove the stale update path.
  • Docs/tests updated; version bumped to 1.10.3.

^{Written for commit 80e4787. Summary will update on new commits.}

[cubic-dev-ai]

You're iterating quickly on this pull request. To help protect your rate limits, cubic has paused automatic reviews on new pushes for now—when you're ready for another review, comment @cubic-dev-ai review.

[devin-ai-integration]

Devin Review found 2 new potential issues.

View 25 additional findings in Devin Review.

[devin-ai-integration]

🟡 --version in _ABXPKG_GROUP_OPTS_WITH_VALUES causes abx entrypoint to consume binary name as option value

Adding "--version" to _ABXPKG_GROUP_OPTS_WITH_VALUES (cli.py:1835) causes _split_abx_argv to treat --version as a value-consuming option. Since the cli group already has --version as a boolean flag (via click.version_option), this creates a collision. When a user runs abx --version yt-dlp, _split_abx_argv now consumes yt-dlp as the value of --version (setting skip_next=True), leaving rest=[]. After _expand_bare_bool_flags converts --version to --version=True, the not rest fallback path checks "--version" in ["--version=True", "yt-dlp"] which is False, so the command falls through to the usage error and exits with code 2. Before this PR, yt-dlp would correctly become the binary name in rest. The other three additions (--abspath, --install-args, --packages) are fine since they don't collide with existing group-level flags.

Suggested change

	) | frozenset({"--abspath", "--version", "--install-args", "--packages"})
	) | frozenset({"--abspath", "--install-args", "--packages"})

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 NpmProvider _resolve_security_constraints silently drops min_release_age safety default from 7 days to 0

The old code at binprovider_npm.py:182 used effective_min_release_age = 7.0 if min_release_age is None else min_release_age, providing a 7-day safety net when min_release_age was unresolved. The new code uses min_release_age or 0, which maps both None and 0.0 to 0 (no protection). While the normal call path through BinProvider.install() resolves min_release_age to a non-None value before the handler runs, _resolve_security_constraints is also called from default_uninstall_handler where the resolution flow is less strict. If any code path reaches this method with min_release_age=None, supply-chain protection silently drops from 7 days to zero.

Suggested change

	effective_min_release_age = min_release_age or 0
	effective_min_release_age = min_release_age if min_release_age is not None else 0

---

Was this helpful? React with 👍 or 👎 to provide feedback.