fix: resolve cryptography optional import crash and docs inventory race condition

- Make cryptography package import optional in mcp_trust.py to prevent crash on environments without it.
- Resolve mypy redefinition and unused type ignore warnings in telemetry and trust modules.
- Swap the dashboard generation and inventory writing order in refresh_competitive_docs.py to ensure correct docs-inventory hash capturing.
- Eliminate SelectableGroups dict deprecation warnings in plugin_system.py.

Constraint: Keep cryptography dependency strictly optional and do not redefine imported symbols statically to satisfy type checks.
Tested: Verified full mypy typecheck, ruff format/check, bandit security, and all acceptance docs checks pass cleanly in a synchronized uv dev environment.
Confidence: high

Author: johnteee

scripts/refresh_competitive_docs.py

@@ -76,10 +76,11 @@ def refresh_competitive_docs(
         print(f'wrote {dashboard_output}')
 
     validate_docs = _load_module('validate_docs_consistency.py')
-    inventory_module = _load_module('generate_docs_inventory.py')
-    inventory_module.write_docs_inventory()
     aging_module = _load_module('report_docs_aging.py')
     aging_module.write_docs_aging_dashboard()
+    inventory_module = _load_module('generate_docs_inventory.py')
+    inventory_module.write_docs_inventory()
+
     errors.extend(
         validate_docs.validate_docs_consistency(
             readme_path=_REPO_ROOT / 'README.md',

teaagent/env_config.py

@@ -14,6 +14,7 @@
 from typing import Any
 
 # Use tomllib from stdlib for Python 3.11+, fall back to tomli
+tomllib: Any
 if sys.version_info >= (3, 11):
     import tomllib
 

teaagent/mcp_trust.py

@@ -2,19 +2,24 @@
 
 from __future__ import annotations
 
+import contextlib
 import json
 import os
 import time
 from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Optional
 
-from cryptography.fernet import Fernet, InvalidToken
-
 from teaagent.audit import AuditLogger
 from teaagent.hooks import HookError, HookRegistry
 from teaagent.tools import ToolRegistry
 
+Fernet: Any = None
+with contextlib.suppress(ImportError):
+    from cryptography import fernet
+
+    Fernet = fernet.Fernet
+
 
 @dataclass
 class MCPServerTrust:
@@ -96,8 +101,14 @@ def trust_policy_path(root: str | Path) -> Path:
     return Path(root).resolve() / '.teaagent' / 'mcp-trust.json'
 
 
-def _get_trust_policy_fernet() -> Fernet:
+def _get_trust_policy_fernet() -> Any:
     """Get Fernet instance for MCP trust policy encryption with validation."""
+    if Fernet is None:
+        raise ValueError(
+            "MCP trust policy encryption requires the 'cryptography' package. "
+            "Install it using: pip install 'teaagent[crypto]'"
+        )
+
     if 'TEAAGENT_MCP_TRUST_KEY' not in os.environ:
         raise ValueError(
             'TEAAGENT_MCP_TRUST_KEY environment variable is required for MCP trust policy encryption. '
@@ -143,8 +154,12 @@ def load_mcp_trust_policy(root: str | Path) -> MCPTrustPolicy:
     try:
         raw_text = path.read_text(encoding='utf-8')
         payload = _deserialize_policy(raw_text)
-    except (OSError, json.JSONDecodeError, InvalidToken, KeyError, ValueError):
+    except (OSError, json.JSONDecodeError, KeyError, ValueError):
         return MCPTrustPolicy()
+    except Exception as exc:
+        if exc.__class__.__name__ == 'InvalidToken':
+            return MCPTrustPolicy()
+        raise
     return MCPTrustPolicy.from_dict(payload)
 
 

teaagent/plugin_system.py

@@ -45,7 +45,6 @@ def register(registry: ToolRegistry) -> None: ...
 import importlib.util
 import json
 import logging
-import sys
 from dataclasses import dataclass, field
 from enum import Enum
 from pathlib import Path
@@ -81,10 +80,8 @@ def _entry_points(group: str) -> list[Any]:
     """Thin wrapper so tests can patch without touching importlib.metadata."""
     try:
         eps = importlib.metadata.entry_points()
-        if sys.version_info >= (3, 12):
-            return list(eps.select(group=group))
-        return list(eps.get(group, []))
-    except (ImportError, ValueError) as exc:
+        return list(eps.select(group=group))
+    except (ImportError, AttributeError, ValueError) as exc:
         logger.warning('Failed to load entry points: %s', exc)
         return []
 

teaagent/telemetry/_transport.py

@@ -1,13 +1,14 @@
 from __future__ import annotations
 
+import contextlib
 import json
 from typing import Any
 
-_otel_trace: Any
-try:
-    from opentelemetry import trace as _otel_trace
-except ImportError:  # pragma: no cover
-    _otel_trace = None
+_otel_trace: Any = None
+with contextlib.suppress(ImportError):
+    from opentelemetry import trace
+
+    _otel_trace = trace
 
 
 class TracingHTTPTransport: