devstuff 2.0.0__tar.gz → 2.1.0__tar.gz

{devstuff-2.0.0 → devstuff-2.1.0}/CHANGELOG.md

@@ -1,3 +1,9 @@
+## v2.1.0 (2026-08-04)
+
+### Features
+
+- **functions**: add whats-on-port to find what is holding a port
+
 ## v2.0.0 (2026-08-04)
 
 ### BREAKING CHANGE

{devstuff-2.0.0 → devstuff-2.1.0}/CLAUDE.md

@@ -165,7 +165,14 @@ another CLI should guard on `command -v <tool>` and point at `devstuff install <
 error rather than let a raw "command not found" surface — see `validate-yaml`/`aws-saml-reauth`
 in `functions.yaml`. If that CLI is only reachable via nvm (like `pi`), source
 `"$HOME/.nvm/nvm.sh"` first (see `acc-check`) — `script`-type functions run via a non-login,
-non-interactive `bash <tmpfile>`, so `~/.bashrc`/nvm's shell init never runs on their own.
+non-interactive `bash <tmpfile>`, so `~/.bashrc`/nvm's shell init never runs on their own. When
+the CLI isn't a catalog tool at all, name the distro package instead (`whats-on-port` points at
+`apt-get install iproute2`) — pointing at `devstuff install ss` would be a lie.
+
+**`run_cmd` flattens every non-zero exit to 1**, so a `script` function cannot signal a *result*
+through its exit code — only whether it ran. A "found nothing" answer should therefore exit 0 and
+say so, or the user gets a red "command failed" banner under a correct result; keep non-zero for
+"could not perform the lookup" (see `whats-on-port`'s comment on this).
 
 Not yet built: an `add` wizard and `catalog import`/`export` for functions, analogous to the
 ones tools already have.

{devstuff-2.0.0 → devstuff-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devstuff
-Version: 2.0.0
+Version: 2.1.0
 Summary: Development environment setup CLI for Linux
 Project-URL: Repository, https://github.com/thesawdawg/dev-setup-py
 Author-email: Sawyer <sawyerksu@gmail.com>
@@ -1105,9 +1105,38 @@ ones tools already have — for now, custom functions are hand-edited YAML at
 | `ssh-agent-key` | auth | shell-eval (bashrc) | Start ssh-agent in the current shell and add a key to it | `key_path` |
 | `validate-docker-compose` | validation | script | Validate a docker-compose.yml file in the current directory | — |
 | `validate-yaml` | validation | script | Validate a YAML file's syntax using `yq` | `file` |
+| `whats-on-port` | network | script | Find which process is listening on a port | `port`, `protocol` (optional: `tcp`/`udp`/`all`) |
 | `acc-check` | web-dev | script | Run the pi coding agent's `/dogfood` skill against a web URL | `url`, `instruction` (optional) |
 | `aws-saml-reauth` | web-dev | script | Reauthorize the AWS CLI via `saml2aws login --force` | `profile` (optional) |
 
+#### `whats-on-port`
+
+```bash
+devstuff run whats-on-port 8080          # tcp and udp
+devstuff run whats-on-port 5432 tcp      # one protocol
+```
+
+Prints the matching sockets, then the PID, user, elapsed time and **untruncated** command
+line of every process holding them — plural because `SO_REUSEPORT` lets several processes
+share one port, and "which of these five node processes" is usually the actual question.
+
+It uses `ss` rather than `lsof` or `fuser` for one measured reason: **run unprivileged
+against another user's socket, `lsof` and `fuser` print nothing and exit as though the port
+were free.** `ss` still lists the socket, just without the `users:((...))` field — so the
+function can tell "nothing there" apart from "something there I'm not allowed to name", and
+says which. When the process is hidden it retries under `sudo -n`, and only if that needs no
+password; a diagnostic shouldn't stop to prompt for one. If sudo isn't available it says
+what to re-run.
+
+"Nothing is listening" is reported as a success, not a failure, along with the two reasons a
+bind can still fail afterwards: a container port published with `userland-proxy: false` is
+NAT-forwarded with no host socket to find at all, and sockets in another network namespace
+are invisible. If Docker is running, published container ports are matched and named too —
+`docker-proxy`'s own command line doesn't say which container it belongs to.
+
+`ss` comes from `iproute2`, which isn't a devstuff package and isn't on every minimal image,
+so a missing `ss` names the apt package instead of surfacing "command not found".
+
 ---
 
 ## Built-in packages

{devstuff-2.0.0 → devstuff-2.1.0}/README.md

@@ -1078,9 +1078,38 @@ ones tools already have — for now, custom functions are hand-edited YAML at
 | `ssh-agent-key` | auth | shell-eval (bashrc) | Start ssh-agent in the current shell and add a key to it | `key_path` |
 | `validate-docker-compose` | validation | script | Validate a docker-compose.yml file in the current directory | — |
 | `validate-yaml` | validation | script | Validate a YAML file's syntax using `yq` | `file` |
+| `whats-on-port` | network | script | Find which process is listening on a port | `port`, `protocol` (optional: `tcp`/`udp`/`all`) |
 | `acc-check` | web-dev | script | Run the pi coding agent's `/dogfood` skill against a web URL | `url`, `instruction` (optional) |
 | `aws-saml-reauth` | web-dev | script | Reauthorize the AWS CLI via `saml2aws login --force` | `profile` (optional) |
 
+#### `whats-on-port`
+
+```bash
+devstuff run whats-on-port 8080          # tcp and udp
+devstuff run whats-on-port 5432 tcp      # one protocol
+```
+
+Prints the matching sockets, then the PID, user, elapsed time and **untruncated** command
+line of every process holding them — plural because `SO_REUSEPORT` lets several processes
+share one port, and "which of these five node processes" is usually the actual question.
+
+It uses `ss` rather than `lsof` or `fuser` for one measured reason: **run unprivileged
+against another user's socket, `lsof` and `fuser` print nothing and exit as though the port
+were free.** `ss` still lists the socket, just without the `users:((...))` field — so the
+function can tell "nothing there" apart from "something there I'm not allowed to name", and
+says which. When the process is hidden it retries under `sudo -n`, and only if that needs no
+password; a diagnostic shouldn't stop to prompt for one. If sudo isn't available it says
+what to re-run.
+
+"Nothing is listening" is reported as a success, not a failure, along with the two reasons a
+bind can still fail afterwards: a container port published with `userland-proxy: false` is
+NAT-forwarded with no host socket to find at all, and sockets in another network namespace
+are invisible. If Docker is running, published container ports are matched and named too —
+`docker-proxy`'s own command line doesn't say which container it belongs to.
+
+`ss` comes from `iproute2`, which isn't a devstuff package and isn't on every minimal image,
+so a missing `ss` names the apt package instead of surfacing "command not found".
+
 ---
 
 ## Built-in packages

{devstuff-2.0.0 → devstuff-2.1.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devstuff"
-version = "2.0.0"
+version = "2.1.0"
 description = "Development environment setup CLI for Linux"
 readme = "README.md"
 requires-python = ">=3.11"

devstuff-2.1.0/src/dev_setup/functions.yaml

@@ -0,0 +1,240 @@
+# yaml-language-server: $schema=./functions.schema.json
+version: 1
+functions:
+  ssh-agent-key:
+    name: SSH Agent + Add Key
+    description: Start ssh-agent in the current shell and add a key to it
+    category: auth
+    type: shell-eval
+    register: bashrc
+    params:
+      - name: key_path
+        description: Path to the SSH private key
+        required: true
+    script: |
+      eval "$(ssh-agent -s)"
+      ssh-add "$key_path"
+    docs_url: https://www.ssh.com/academy/ssh/agent
+
+  validate-docker-compose:
+    name: Validate Docker Compose
+    description: Validate a docker-compose.yml file in the current directory
+    category: validation
+    type: script
+    script: |
+      set -euo pipefail
+      if ! command -v docker >/dev/null 2>&1; then
+        echo "docker is required. Install it first: devstuff install docker" >&2
+        exit 1
+      fi
+      file=""
+      for candidate in docker-compose.yml docker-compose.yaml compose.yml compose.yaml; do
+        if [ -f "$candidate" ]; then
+          file="$candidate"
+          break
+        fi
+      done
+      if [ -z "$file" ]; then
+        echo "No docker-compose.yml/docker-compose.yaml/compose.yml/compose.yaml found in $(pwd)" >&2
+        exit 1
+      fi
+      echo "Validating $file..."
+      docker compose -f "$file" config --quiet
+      echo "$file is valid"
+    docs_url: https://docs.docker.com/reference/cli/docker/compose/config/
+
+  validate-yaml:
+    name: Validate YAML
+    description: Validate a YAML file's syntax using yq
+    category: validation
+    type: script
+    params:
+      - name: file
+        description: Path to the YAML file to validate
+        required: true
+    script: |
+      set -euo pipefail
+      if ! command -v yq >/dev/null 2>&1; then
+        echo "yq is required. Install it first: devstuff install yq" >&2
+        exit 1
+      fi
+      if [ ! -f "$file" ]; then
+        echo "File not found: $file" >&2
+        exit 1
+      fi
+      yq eval '.' "$file" > /dev/null
+      echo "$file is valid YAML"
+    docs_url: https://mikefarah.gitbook.io/yq
+
+  acc-check:
+    name: Accessibility/QA Check
+    description: Run the pi coding agent's /dogfood skill against a web URL
+    category: web-dev
+    type: script
+    params:
+      - name: url
+        description: URL to review
+        required: true
+      - name: instruction
+        description: Additional scope or instruction for the review (optional)
+        required: false
+    script: |
+      set -euo pipefail
+      . "$HOME/.nvm/nvm.sh" 2>/dev/null || true
+      if ! command -v pi >/dev/null 2>&1; then
+        echo "pi is required. Install it first: devstuff install pi" >&2
+        exit 1
+      fi
+      pi -p "/dogfood $url $instruction"
+    docs_url: https://pi.dev/docs/latest
+
+  whats-on-port:
+    name: What's On This Port
+    description: Find which process is listening on a port (and whether you can see it)
+    category: network
+    type: script
+    params:
+      - name: port
+        description: Port number to look up (1-65535)
+        required: true
+      - name: protocol
+        description: tcp, udp, or all (default all)
+        required: false
+        default: all
+    script: |
+      # Deliberately no `set -e`: this script's whole job is to tell "in use" from
+      # "free" from "cannot tell", which is exit-code work that -e would abort.
+      set -uo pipefail
+
+      case "$port" in
+        ''|*[!0-9]*)
+          echo "Port must be a number between 1 and 65535, got: ${port:-<empty>}" >&2
+          exit 2
+          ;;
+      esac
+      if [ "$port" -lt 1 ] || [ "$port" -gt 65535 ]; then
+        echo "Port must be between 1 and 65535, got: $port" >&2
+        exit 2
+      fi
+
+      case "${protocol:-all}" in
+        tcp) flags="-tlpnH" ;;
+        udp) flags="-ulpnH" ;;
+        all|"") flags="-tulpnH"; protocol="all" ;;
+        *) echo "Protocol must be tcp, udp or all, got: $protocol" >&2; exit 2 ;;
+      esac
+
+      # ss ships in iproute2, which is not in the devstuff catalog and is not on every
+      # minimal image (this repo's own CI container has lsof but no ss), so say what to
+      # install rather than letting "command not found" surface.
+      if ! command -v ss >/dev/null 2>&1; then
+        echo "ss is required to look up sockets (it is part of iproute2)." >&2
+        echo "Install it with:  sudo apt-get install -y iproute2" >&2
+        exit 1
+      fi
+
+      # `ss` exits 0 whether or not the filter matched anything, so an empty result is
+      # the only signal that the port is free.
+      sockets="$(ss $flags "sport = :$port" 2>/dev/null || true)"
+
+      # Unprivileged `ss` still lists a socket owned by another user but silently drops
+      # the users:((...)) field, so the port reads as taken with nothing named. Retry
+      # under sudo only when it needs no password — a diagnostic should not stop to ask
+      # for one. (lsof and fuser are worse here: both report *nothing* and exit as if
+      # the port were free, which is why this uses ss.)
+      escalated=""
+      if [ -n "$sockets" ] && ! printf '%s' "$sockets" | grep -q 'pid='; then
+        if [ "$(id -u)" -ne 0 ] && command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null; then
+          sockets="$(sudo -n ss $flags "sport = :$port" 2>/dev/null || printf '%s' "$sockets")"
+          escalated="yes"
+        fi
+      fi
+
+      # "Nothing found" is an answer, not a failure: `devstuff run` flattens every
+      # non-zero code to 1, so exiting non-zero here would only buy a scary "command
+      # failed" banner under a correct result. Non-zero is kept for the cases where
+      # the lookup could not be performed at all (bad input, no ss).
+      if [ -z "$sockets" ]; then
+        echo "Nothing is listening on port $port ($protocol)."
+        echo
+        echo "A bind can still fail after this: a container port published without the"
+        echo "userland proxy is forwarded by NAT with no host socket to find, and sockets"
+        echo "in another network namespace are invisible from here."
+        if [ "$(id -u)" -ne 0 ]; then
+          echo "Sockets you have no permission to see are not listed either — to rule"
+          echo "that out:  sudo devstuff run whats-on-port $port"
+        fi
+        exit 0
+      fi
+
+      echo "Port $port ($protocol) is in use:"
+      echo
+      printf '%s\n' "$sockets" | sed 's/^/  /'
+
+      # One port can have several holders (SO_REUSEPORT), so this reports every PID
+      # rather than assuming a single answer.
+      pids="$(printf '%s\n' "$sockets" | grep -oE 'pid=[0-9]+' | cut -d= -f2 | sort -un)"
+      if [ -n "$pids" ]; then
+        echo
+        echo "Holding process(es):"
+        printf '  %-8s %-10s %-10s %s\n' PID USER ELAPSED COMMAND
+        for pid in $pids; do
+          # The full command line is never truncated: it is usually the thing that
+          # identifies which of five node processes this actually is.
+          ps -o pid=,user=,etime=,args= -p "$pid" 2>/dev/null \
+            | awk '{printf "  %-8s %-10s %-10s ", $1, $2, $3; $1=$2=$3=""; sub(/^ +/, ""); print}'
+        done
+        if [ -n "$escalated" ]; then
+          echo
+          echo "  (the process details above needed root — re-read via sudo)"
+        fi
+      else
+        echo
+        echo "The socket exists, but its owning process belongs to another user and is"
+        echo "not visible from here. Re-run as root to name it:"
+        echo "  sudo devstuff run whats-on-port $port"
+      fi
+
+      # Counted on the listener's side only: matching both sport and dport counts each
+      # connection twice, once per end of a loopback pair.
+      conns="$(ss -tnpH "sport = :$port" 2>/dev/null | grep -c ESTAB || true)"
+      if [ "${conns:-0}" -gt 0 ]; then
+        echo
+        echo "$conns established connection(s) to this port — list them with:"
+        echo "  ss -tnp 'sport = :$port'"
+      fi
+
+      # Best-effort: a published container port is held by docker-proxy, whose command
+      # line does not say which container it belongs to. Silent on any failure, so no
+      # daemon (or no docker at all) costs nothing.
+      if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
+        containers="$(docker ps --format '{{.Names}}\t{{.Ports}}' 2>/dev/null | grep -E ":$port->" || true)"
+        if [ -n "$containers" ]; then
+          echo
+          echo "Published by container(s):"
+          printf '%s\n' "$containers" | sed 's/^/  /'
+        fi
+      fi
+    docs_url: https://man7.org/linux/man-pages/man8/ss.8.html
+
+  aws-saml-reauth:
+    name: AWS SAML Reauth
+    description: Reauthorize the AWS CLI via saml2aws
+    category: web-dev
+    type: script
+    params:
+      - name: profile
+        description: AWS profile to reauthenticate (optional, uses saml2aws default if omitted)
+        required: false
+    script: |
+      set -euo pipefail
+      if ! command -v saml2aws >/dev/null 2>&1; then
+        echo "saml2aws is required. Install it first: devstuff install saml2aws" >&2
+        exit 1
+      fi
+      if [ -n "$profile" ]; then
+        saml2aws login --force --profile "$profile"
+      else
+        saml2aws login --force
+      fi
+    docs_url: https://github.com/Versent/saml2aws

{devstuff-2.0.0 → devstuff-2.1.0}/tests/test_functions.py

@@ -381,3 +381,128 @@ def test_captured_failure_carries_output_on_the_exception():
     with pytest.raises(subprocess.CalledProcessError) as exc:
         runner.run_script_function(fn, (), capture=True)
     assert "why it failed" in exc.value.stdout
+
+
+# -- whats-on-port ------------------------------------------------------------------
+
+
+def _bundled(key: str) -> FunctionDef:
+    return FunctionDef.from_dict(catalog.load_bundled_catalog()[key], key=key)
+
+
+def test_whats_on_port_is_declared_the_way_it_is_documented(isolated_catalog):
+    fns = catalog.load_bundled_catalog()
+    fn = fns["whats-on-port"]
+    assert fn["type"] == "script"
+    assert fn["category"] == "network"
+    port, protocol = fn["params"]
+    assert (port["name"], port["required"]) == ("port", True)
+    # Optional with a real default, so `devstuff run whats-on-port 8080` never prompts
+    # for a second argument.
+    assert (protocol["name"], protocol["required"], protocol["default"]) == (
+        "protocol", False, "all",
+    )
+
+
+@pytest.mark.parametrize("key", sorted(catalog.load_bundled_catalog()))
+def test_every_bundled_script_is_valid_bash(key):
+    """`bash -n` over the script exactly as the runner assembles it — prelude included,
+    since that is what defines the param variables the body reads under `set -u`."""
+    import subprocess
+
+    fn = _bundled(key)
+    prelude = runner._positional_prelude(fn.params)
+    content = f"{prelude}\n{fn.script}" if prelude else fn.script
+    result = subprocess.run(
+        ["bash", "-n"], input=content, capture_output=True, text=True, check=False
+    )
+    assert result.returncode == 0, f"{key}: {result.stderr}"
+
+
+# The behavioural tests below bind a real socket and shell out to `ss`. No sudo and no
+# network — but `ss` is not on every image (this repo's own CI container has lsof and
+# no ss), which is the same gap the function itself guards against.
+needs_ss = pytest.mark.skipif(
+    __import__("shutil").which("ss") is None, reason="ss (iproute2) is not installed"
+)
+
+
+@pytest.fixture()
+def listening_port():
+    """A real TCP listener owned by this process, and its port."""
+    import socket
+
+    sock = socket.socket()
+    sock.bind(("127.0.0.1", 0))
+    sock.listen(1)
+    try:
+        yield sock.getsockname()[1]
+    finally:
+        sock.close()
+
+
+@pytest.fixture()
+def free_port():
+    """A port nothing holds: bound to claim it from the ephemeral range, then released.
+
+    `listening_port + 1` would do almost always, which is exactly the kind of almost
+    that fails in CI once a month.
+    """
+    import socket
+
+    sock = socket.socket()
+    sock.bind(("127.0.0.1", 0))
+    port = sock.getsockname()[1]
+    sock.close()
+    return port
+
+
+def _run(port, protocol="") -> str:
+    args = (str(port), protocol) if protocol else (str(port),)
+    return runner.run_script_function(_bundled("whats-on-port"), args, capture=True)
+
+
+@needs_ss
+def test_it_names_the_process_holding_the_port(listening_port):
+    import os
+
+    output = _run(listening_port)
+    assert f"Port {listening_port} (all) is in use" in output
+    # The point of the whole function: the PID, not just "something is there".
+    assert str(os.getpid()) in output
+    assert "Holding process(es):" in output
+
+
+@needs_ss
+def test_a_free_port_is_a_successful_answer_not_a_failure(free_port):
+    """`run_cmd` flattens every non-zero exit to 1, so exiting non-zero for "found
+    nothing" would only paint a red banner under a correct result."""
+    output = _run(free_port)  # capture=True raises CalledProcessError on non-zero
+    assert f"Nothing is listening on port {free_port}" in output
+    # And it does not leave the user thinking a bind will now succeed.
+    assert "NAT" in output
+
+
+@needs_ss
+def test_the_protocol_filter_excludes_the_other_protocol(listening_port):
+    assert "is in use" in _run(listening_port, "tcp")
+    assert "Nothing is listening" in _run(listening_port, "udp")
+
+
+@pytest.mark.parametrize("port", ["abc", "0", "70000", "-1", "80.5"])
+def test_an_impossible_port_is_rejected_before_anything_runs(port):
+    import subprocess
+
+    with pytest.raises(subprocess.CalledProcessError) as exc:
+        _run(port)
+    assert exc.value.returncode == 2
+    assert "between 1 and 65535" in exc.value.stdout + exc.value.stderr
+
+
+def test_an_unknown_protocol_is_rejected():
+    import subprocess
+
+    with pytest.raises(subprocess.CalledProcessError) as exc:
+        _run(8080, "sctp")
+    assert exc.value.returncode == 2
+    assert "tcp, udp or all" in exc.value.stdout + exc.value.stderr

{devstuff-2.0.0 → devstuff-2.1.0}/uv.lock

@@ -167,7 +167,7 @@ wheels = [
 
 [[package]]
 name = "devstuff"
-version = "2.0.0"
+version = "2.1.0"
 source = { editable = "." }
 dependencies = [
     { name = "click" },

devstuff-2.0.0/src/dev_setup/functions.yaml

@@ -1,111 +0,0 @@
-# yaml-language-server: $schema=./functions.schema.json
-version: 1
-functions:
-  ssh-agent-key:
-    name: SSH Agent + Add Key
-    description: Start ssh-agent in the current shell and add a key to it
-    category: auth
-    type: shell-eval
-    register: bashrc
-    params:
-      - name: key_path
-        description: Path to the SSH private key
-        required: true
-    script: |
-      eval "$(ssh-agent -s)"
-      ssh-add "$key_path"
-    docs_url: https://www.ssh.com/academy/ssh/agent
-
-  validate-docker-compose:
-    name: Validate Docker Compose
-    description: Validate a docker-compose.yml file in the current directory
-    category: validation
-    type: script
-    script: |
-      set -euo pipefail
-      if ! command -v docker >/dev/null 2>&1; then
-        echo "docker is required. Install it first: devstuff install docker" >&2
-        exit 1
-      fi
-      file=""
-      for candidate in docker-compose.yml docker-compose.yaml compose.yml compose.yaml; do
-        if [ -f "$candidate" ]; then
-          file="$candidate"
-          break
-        fi
-      done
-      if [ -z "$file" ]; then
-        echo "No docker-compose.yml/docker-compose.yaml/compose.yml/compose.yaml found in $(pwd)" >&2
-        exit 1
-      fi
-      echo "Validating $file..."
-      docker compose -f "$file" config --quiet
-      echo "$file is valid"
-    docs_url: https://docs.docker.com/reference/cli/docker/compose/config/
-
-  validate-yaml:
-    name: Validate YAML
-    description: Validate a YAML file's syntax using yq
-    category: validation
-    type: script
-    params:
-      - name: file
-        description: Path to the YAML file to validate
-        required: true
-    script: |
-      set -euo pipefail
-      if ! command -v yq >/dev/null 2>&1; then
-        echo "yq is required. Install it first: devstuff install yq" >&2
-        exit 1
-      fi
-      if [ ! -f "$file" ]; then
-        echo "File not found: $file" >&2
-        exit 1
-      fi
-      yq eval '.' "$file" > /dev/null
-      echo "$file is valid YAML"
-    docs_url: https://mikefarah.gitbook.io/yq
-
-  acc-check:
-    name: Accessibility/QA Check
-    description: Run the pi coding agent's /dogfood skill against a web URL
-    category: web-dev
-    type: script
-    params:
-      - name: url
-        description: URL to review
-        required: true
-      - name: instruction
-        description: Additional scope or instruction for the review (optional)
-        required: false
-    script: |
-      set -euo pipefail
-      . "$HOME/.nvm/nvm.sh" 2>/dev/null || true
-      if ! command -v pi >/dev/null 2>&1; then
-        echo "pi is required. Install it first: devstuff install pi" >&2
-        exit 1
-      fi
-      pi -p "/dogfood $url $instruction"
-    docs_url: https://pi.dev/docs/latest
-
-  aws-saml-reauth:
-    name: AWS SAML Reauth
-    description: Reauthorize the AWS CLI via saml2aws
-    category: web-dev
-    type: script
-    params:
-      - name: profile
-        description: AWS profile to reauthenticate (optional, uses saml2aws default if omitted)
-        required: false
-    script: |
-      set -euo pipefail
-      if ! command -v saml2aws >/dev/null 2>&1; then
-        echo "saml2aws is required. Install it first: devstuff install saml2aws" >&2
-        exit 1
-      fi
-      if [ -n "$profile" ]; then
-        saml2aws login --force --profile "$profile"
-      else
-        saml2aws login --force
-      fi
-    docs_url: https://github.com/Versent/saml2aws