Protected catalogue installation without manual token injection. AgentBundle now picks credentials automatically from a priority-ordered set: bearer token, JFrog CLI 2.105.0+ profile, exact-machine .netrc record, and anonymous. Public catalogues need no setup. A broken configured provider stops resolution; no fallback across types. Set AGENTBUNDLE_CA_BUNDLE for the direct path; use SSL_CERT_FILE or SSL_CERT_DIR to reach jf api on Linux.