docs: rewrite README in plain active voice, drop em dashes repo-wide

Author: Ar9av

README.md

@@ -17,4 +17,4 @@ freeze --execute "$PB plugins" -o "$OUT/plugins.png" "${FREEZE_OPTS[@]}"
 freeze .github/workflows/patchbot-fix-example.yml -o "$OUT/workflow.png" "${FREEZE_OPTS[@]}"
 
 echo "Wrote screenshots to $OUT/"
-echo "code-scanning.png and fix-pr.png are captured manually from GitHub — see README."
+echo "code-scanning.png and fix-pr.png are captured manually from GitHub: see README."

docs/screenshots.sh

@@ -1,4 +1,4 @@
-"""Anthropic API agent: no CLI, no npm/node — just `pip install patchbot[api]`.
+"""Anthropic API agent: no CLI, no npm/node: just `pip install patchbot[api]`.
 
 Runs a small tool loop (bash + write_file, scoped to cwd) via the Python
 SDK's tool runner. Good default for CI: nothing to install but a Python

patchbot/agents/api.py

@@ -1,15 +1,15 @@
 """Claude Managed Agents backend: the fix runs in Anthropic's sandbox, not
-on the CI runner. The GitHub token never enters the sandbox — repo
+on the CI runner. The GitHub token never enters the sandbox: repo
 clone/push goes through Anthropic's git proxy (`authorization_token`) and
 PR creation goes through a vaulted GitHub MCP credential.
 
 Requires `patchbot managed init` to have been run once (see
 patchbot/managed_setup.py) and its three IDs supplied via `config`:
-`agent_id`, `environment_id`, `vault_id` — normally read from
+`agent_id`, `environment_id`, `vault_id`: normally read from
 PATCHBOT_MANAGED_AGENT_ID / _ENVIRONMENT_ID / _VAULT_ID.
 
 The caller (fix.py) is responsible for host-side verification after this
-returns — a session's own claim of success is never the fix gate.
+returns: a session's own claim of success is never the fix gate.
 """
 from __future__ import annotations
 
@@ -44,7 +44,7 @@ def run(prompt: str, cwd: str, model: Optional[str] = None, timeout: int = 600,
     if not (agent_id and environment_id and vault_id):
         raise RuntimeError(
             "agent 'managed' requires agent_id/environment_id/vault_id "
-            "(run `patchbot managed init` first) — see README"
+            "(run `patchbot managed init` first): see README"
         )
     if not github_token:
         raise RuntimeError("agent 'managed' requires GITHUB_TOKEN in the environment")
@@ -71,7 +71,7 @@ def run(prompt: str, cwd: str, model: Optional[str] = None, timeout: int = 600,
         session_kwargs["agent"] = {"type": "agent_with_overrides", "id": agent_id, "model": model}
 
     session = client.beta.sessions.create(**session_kwargs)
-    print(f"[managed] session {session.id} — https://platform.claude.com/sessions/{session.id}")
+    print(f"[managed] session {session.id}: https://platform.claude.com/sessions/{session.id}")
 
     saw_error = False
     stop_reason_type = None
@@ -89,5 +89,5 @@ def run(prompt: str, cwd: str, model: Optional[str] = None, timeout: int = 600,
             break
 
     # The rescan/test verification that actually gates the PR happens
-    # host-side in fix.py — this is only "did the session run cleanly".
+    # host-side in fix.py: this is only "did the session run cleanly".
     return 1 if saw_error or stop_reason_type == "retries_exhausted" else 0

patchbot/agents/managed.py

@@ -1,6 +1,6 @@
 """Tier 0 of the fix loop: a deterministic version bump, no agent involved.
 
-Most vulnerable-package fixes are exactly this — rewrite the pin, regenerate
+Most vulnerable-package fixes are exactly this: rewrite the pin, regenerate
 the lockfile, done. The agent tiers in fix.py only run when this fails
 (major bump breaks the build, tests fail, or the package isn't a direct
 dependency this module knows how to edit).
@@ -27,7 +27,7 @@ def _bump_npm(cwd: Path, name: str, version: str) -> bool:
     pattern = re.compile(rf'("{escaped}"\s*:\s*")[^"]*(")')
     new_text, count = pattern.subn(rf"\g<1>^{version}\g<2>", text)
     if count == 0:
-        return False  # not a direct dependency — let the agent tier handle it
+        return False  # not a direct dependency: let the agent tier handle it
     _write(manifest, new_text)
 
     if shutil.which("npm") and (cwd / "package-lock.json").exists():
@@ -39,7 +39,7 @@ def _bump_npm(cwd: Path, name: str, version: str) -> bool:
     if shutil.which("yarn") and (cwd / "yarn.lock").exists():
         result = subprocess.run(["yarn", "install", "--mode", "update-lockfile"], cwd=cwd, capture_output=True)
         return result.returncode == 0
-    return False  # no lockfile tool available to regenerate — don't leave it stale
+    return False  # no lockfile tool available to regenerate: don't leave it stale
 
 
 def _bump_pip(cwd: Path, name: str, version: str) -> bool:
@@ -93,7 +93,7 @@ def _bump_cargo(cwd: Path, name: str, version: str) -> bool:
             ["cargo", "update", "-p", name, "--precise", version], cwd=cwd, capture_output=True,
         )
         return result.returncode == 0
-    return True  # no lockfile yet — the manifest edit alone is the fix
+    return True  # no lockfile yet: the manifest edit alone is the fix
 
 
 _BUMPERS = {
@@ -107,7 +107,7 @@ def _bump_cargo(cwd: Path, name: str, version: str) -> bool:
 def try_bump(cwd: str, ecosystem: str, name: str, target_version: str) -> bool:
     """Attempt the deterministic fix. Returns True if the manifest (and
     lockfile, where applicable) were rewritten successfully. False means
-    "give up cleanly" — the caller escalates to the agent tier."""
+    "give up cleanly": the caller escalates to the agent tier."""
     bumper = _BUMPERS.get(ecosystem)
     if bumper is None:
         return False

patchbot/bump.py

@@ -2,7 +2,7 @@
 
 Accepts either a bare list of OSV vuln records or `{"vulns": [...]}`
 (OSV's own bulk export shape), so a user's private feed needs no custom
-parser — just OSV-format JSON.
+parser: just OSV-format JSON.
 """
 from __future__ import annotations
 

patchbot/feeds/file.py

@@ -1,4 +1,4 @@
-"""OSV.dev feed — the default, always-on threat feed.
+"""OSV.dev feed: the default, always-on threat feed.
 
 Batch-query adapted from prismor's supplychain/scoring/osv_lookup.py:
 querybatch returns id+modified only, so full details (severity, summary,

patchbot/feeds/osv.py

@@ -1,12 +1,12 @@
 """Tiered fix loop: one branch + one PR per vulnerable package.
 
 Tier 0 (patchbot.bump) tries a deterministic version bump + lockfile
-regen first — no agent involved, mirrors what Dependabot already does well.
+regen first: no agent involved, mirrors what Dependabot already does well.
 Only when that fails to clear the advisory (or fails a configured
 test_cmd) does the configured agent get a turn, with the failure itself as
 its brief rather than the original vague "go fix this" task.
 
-Sequential by design (`--max` caps how many packages get a PR per run) —
+Sequential by design (`--max` caps how many packages get a PR per run) -
 concurrent agents editing the same working tree would race on git state.
 """
 from __future__ import annotations
@@ -21,7 +21,7 @@
 from patchbot.versions import version_gte
 
 # Files an agent is allowed to have touched. Anything outside this stays
-# clean — a CI-hosted agent has a shell, and a diff that reaches outside
+# clean: a CI-hosted agent has a shell, and a diff that reaches outside
 # the dependency surface (CI config, dotfiles, .git internals) is rejected
 # rather than shipped in a PR.
 _DISALLOWED_PREFIXES = (".github/", ".git/", ".gitlab-ci", ".circleci/")
@@ -109,7 +109,7 @@ def _diff_allowed(cwd: str) -> bool:
 
 def _verify(cwd: str, ecosystem: str, name: str, target_version: Optional[str],
             original_version: str, test_cmd: Optional[str]) -> tuple:
-    """Returns (ok, detail) — detail is empty on success, or a failure
+    """Returns (ok, detail): detail is empty on success, or a failure
     summary suitable for handing to the next tier as its prompt."""
     new_version = _rescan_version(cwd, ecosystem, name)
     if target_version:
@@ -176,7 +176,7 @@ def run(
                 if bumped else bump_prompt
             )
             if agent_name == "managed":
-                # The session edits a remote clone, not `cwd` — push what we
+                # The session edits a remote clone, not `cwd`: push what we
                 # have so far so it exists to check out, then pull its result
                 # back before verifying locally.
                 _git(["add", "-A"], cwd)

patchbot/fix.py

@@ -1,6 +1,6 @@
 """Manifest and lockfile parsers.
 
-Ported from prismor's prismor/runtime/deps.py — trimmed to pure functions
+Ported from prismor's prismor/runtime/deps.py: trimmed to pure functions
 that return Package objects instead of dicts, since patchbot has no
 policy-feed correlation step of its own.
 """
@@ -209,7 +209,7 @@ def collect(workspace: Path) -> List[Package]:
     JS ecosystems resolve through lockfiles (npm/pnpm/yarn all merge into
     one flat name->version map, unioned since they're all the "npm" OSV
     ecosystem). Other ecosystems are read straight off the manifest since
-    patchbot doesn't parse poetry.lock/Cargo.lock/go.sum — see README for
+    patchbot doesn't parse poetry.lock/Cargo.lock/go.sum: see README for
     the CycloneDX SBOM path if you need transitive deps there.
     """
     packages: List[Package] = []

patchbot/inventory/lockfiles.py

@@ -1,5 +1,5 @@
 """One-time setup and scheduling for the `managed` (Claude Managed Agents)
-fix backend. Not part of the per-fix hot path — `patchbot managed init`
+fix backend. Not part of the per-fix hot path: `patchbot managed init`
 creates the Agent/Environment/Vault once; `patchbot managed deploy` sets up
 a cron-scheduled session that scans + fixes without any CI at all.
 """