pkgwrap v0.2.0

pkgwrap v0.2.0

One command. Every package manager — now across 17 backends, with safer defaults and a source-only install.

Breaking: pkgwrap is no longer published on PyPI. The pkgwrap-lokesh package is unmaintained. Install from source with install.sh (see below).

---

⚠️ Safety fixes (please read if you used 0.1.x)

Non-interactive flags are no longer forced. Previously -y / --noconfirm were hardcoded into every install and remove command, which silenced the package manager's own confirmation. Combined with automatic root detection, a destructive command could run with no prompt at all. These flags are now added only when you pass -y.

Package managers that never prompt on their own (apk, brew, nix, MacPorts, winget, pkg_add) now get an explicit pkgwrap confirmation before removals, so you are never left without a safety net.

Package names are validated before they reach the package manager: anything that looks like a command-line flag, or contains characters outside a conservative allow-list, is rejected.

The detection cache is validated against the backend registry, so a corrupted or hand-edited cache file can no longer steer which package manager runs.

---

✨ New

• Multiple packages per command — pkgwrap install curl wget nmap
• --dry-run / -n — print the exact command without executing it
• Separate refresh and upgrade — refresh only updates repository metadata; upgrade upgrades packages. update no longer performs a full system upgrade by surprise.
• New commands: list, info, clean
• --backend NAME forces a backend; PKGWRAP_BACKEND does the same globally
• --no-cache and --clear-cache
• 5 new backends: yum, emerge (Gentoo), port (MacPorts), openbsd (pkg_add, also NetBSD), choco (Windows fallback) — bringing the total to 17
• Explicit macOS and Windows detection with actionable messages when no package manager is present
• XDG_CONFIG_HOME is respected for the cache location

🐛 Fixed

• Windows crash: Unicode status symbols raised UnicodeEncodeError on legacy code pages (cp1252/cp437). Symbols now fall back to ASCII automatically.
• Exit codes: a process killed by a signal reported a meaningless status (-9 surfaced as 247); it now reports 128 + N.
• pkgwrap --backend install nmap used to print the backend and silently skip the install. The ambiguous form is now rejected with a clear message.
• ANSI colour is no longer emitted when output is piped or redirected. NO_COLOR, PKGWRAP_NO_COLOR, FORCE_COLOR and TERM=dumb are honoured.
• print_warning genuinely exists now, instead of silently falling back to print_info.
• Confirmation prompts no longer hang when stdin is not a terminal.

📦 Installation changed

install.sh is now a source installer. It clones (or updates) the repository and installs from the checkout, handling PEP 668 externally-managed environments properly: pipx → pip --user → a dedicated venv with pkgwrap/pkw shims in ~/.local/bin.

curl -fsSL https://raw.githubusercontent.com/trmxvibs/pkgwrap/main/install.sh -o install.sh
less install.sh          # always read a script before running it
bash install.sh

New flags: --local, --update, --uninstall.

Upgrading from the PyPI package:

pip uninstall pkgwrap-lokesh    # or: pipx uninstall pkgwrap-lokesh
bash install.sh

🏗️ Project health

• GitHub Actions CI: pytest across Python 3.9–3.13 on Linux, macOS and Windows, plus ruff, shellcheck and a clean-clone install check
• Test suite grown from 32 to 315 tests, including full coverage of the privilege-escalation and confirmation logic, and contract tests every backend must satisfy
• CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, issue and PR templates
• py.typed marker and complete project metadata

---

🙏 Contributors

Thanks to @kaminimangal for the winget backend (#9) and package name mapping (#10), both of which are included here in extended form.

🧪 Help wanted

Five backends — yum, emerge, port, openbsd and choco — were written from documentation and have not yet been verified on real systems. If you run one of these, please try pkgwrap <command> --dry-run and open an issue with what you see. Contributions welcome.

Full changelog: CHANGELOG.md