devstuff 2.3.0__tar.gz → 2.5.0__tar.gz

devstuff-2.5.0/.github/workflows/bump.yml

@@ -0,0 +1,180 @@
+name: Bump version
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - master
+
+# Serialize bump runs against master regardless of which PR triggered them.
+concurrency:
+  group: bump-master
+  cancel-in-progress: false
+
+jobs:
+  bump:
+    name: cz bump
+    runs-on: ubuntu-latest
+    # Only run for PRs that were actually merged, not closed unmerged.
+    # A raw `git push` — which is how this job publishes its own commit —
+    # never fires pull_request events, so there's no infinite-loop risk
+    # from this job triggering itself (unlike the old push-to-master
+    # trigger, which needed an explicit "bump:" message guard for that).
+    if: github.event.pull_request.merged == true
+    permissions:
+      contents: write
+    env:
+      # secrets can't be referenced directly in step `if:` conditions, so
+      # surface presence via an env var instead.
+      HAS_GH_PAT: ${{ secrets.GH_PAT != '' }}
+
+    steps:
+      - name: Require GH_PAT
+        # GH_PAT (a Personal Access Token with repo write scope) is required
+        # so that the tag push re-triggers publish.yml — GitHub Actions does
+        # not re-process events from pushes made with GITHUB_TOKEN. Fail loudly
+        # instead of silently pushing a tag that will never publish.
+        if: env.HAS_GH_PAT != 'true'
+        run: |
+          echo "::error::GH_PAT secret is not set. It is required so the tag push triggers publish.yml (GITHUB_TOKEN pushes are not re-processed by Actions)."
+          exit 1
+
+      - uses: actions/checkout@v4
+        with:
+          ref: master  # the merge already happened server-side by the time this runs
+          fetch-depth: 0  # commitizen needs full history to determine bump type
+          token: ${{ secrets.GH_PAT }}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Configure git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Run cz bump
+        id: bump
+        run: |
+          if uv run --group dev cz bump --yes; then
+            echo "bumped=true" >> "$GITHUB_OUTPUT"
+          else
+            EXIT=$?
+            if [ "$EXIT" -eq 21 ]; then
+              echo "No conventional commits found since last tag — nothing to bump."
+              echo "bumped=false" >> "$GITHUB_OUTPUT"
+            else
+              exit "$EXIT"
+            fi
+          fi
+
+      # Build-only PRs: `cz bump` exits 21 because `build` is deliberately not
+      # in bump_map (we don't want it consuming a PATCH slot from the main
+      # release line). Instead, ship a PEP 440 post-release — vX.Y.Z.postN —
+      # which is publishable to PyPI, sorts after vX.Y.Z but before the next
+      # vX.(Y+1).0, and is still recognised by `cz bump` as the current
+      # version tag (tag_format is `v$version` and `X.Y.Z.postN` is valid
+      # PEP 440), so the next regular bump stays coherent. A PR mixing `build`
+      # with feat/fix/etc. is handled by the `cz bump` path above — the build
+      # commits just fold into that release's changelog — so this step only
+      # fires when there was nothing else to release.
+      - name: Build-patch post-release
+        id: buildpatch
+        if: steps.bump.outputs.bumped == 'false'
+        run: |
+          set -euo pipefail
+
+          last_tag="$(git describe --tags --abbrev=0)"
+          commits="$(git log "${last_tag}..HEAD" --pretty=format:%s)"
+
+          # No build commits -> genuinely nothing to release.
+          if ! printf '%s\n' "$commits" | grep -qE '^build(\(.+\))?!?:'; then
+            echo "No build commits since ${last_tag} — nothing to release."
+            echo "buildpatch=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Safety net: if a higher-precedence release type slipped through,
+          # bail rather than ship a competing post-release. (cz bump exiting 21
+          # already implies this, but guard against future bump_map changes.)
+          if printf '%s\n' "$commits" | grep -qE '^(feat|fix|refactor|perf|deps)(\(.+\))?!?:'; then
+            echo "Higher-precedence release commits present alongside build — deferring to the main release track."
+            echo "buildpatch=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Current version -> release segment (strip any existing post/dev).
+          current_version="$(grep -E '^version = ' pyproject.toml | head -1 | sed -E 's/^version = "(.*)"$/\1/')"
+          base="$(printf '%s' "$current_version" | sed -E 's/(\.post[0-9]+|\.dev[0-9]+).*$//')"
+
+          # Next post number for this base (vX.Y.Z.post1, .post2, ...).
+          prev_n="$(git tag --list "v${base}.post*" | sed -E 's/^v.*\.post([0-9]+)$/\1/' | sort -n | tail -1 || true)"
+          next_n=$(( ${prev_n:-0} + 1 ))
+          new_version="${base}.post${next_n}"
+          new_tag="v${new_version}"
+
+          echo "Bumping build patch: ${current_version} -> ${new_version} (${new_tag})"
+
+          # Bump version in pyproject.toml.
+          sed -i -E "s/^version = \".*\"/version = \"${new_version}\"/" pyproject.toml
+
+          # Prepend a Build section to the changelog (matches cz's heading style).
+          date="$(date +%Y-%m-%d)"
+          build_entries="$(
+            printf '%s\n' "$commits" | grep -E '^build(\(.+\))?!?:' | while IFS= read -r subject; do
+              msg="$(printf '%s' "$subject" | sed -E 's/^build(\([^)]+\))?(!)?: //')"
+              scope="$(printf '%s' "$subject" | sed -nE 's/^build\(([^)]+)\).*/\1/p')"
+              if [ -n "$scope" ]; then
+                printf -- '- **%s**: %s\n' "$scope" "$msg"
+              else
+                printf -- '- %s\n' "$msg"
+              fi
+            done
+          )"
+          {
+            printf '## %s (%s)\n\n### Build\n\n%s\n' "$new_tag" "$date" "$build_entries"
+            cat CHANGELOG.md
+          } > CHANGELOG.md.new
+          mv CHANGELOG.md.new CHANGELOG.md
+
+          # Sync the lockfile against the new version before committing so the
+          # tag points at a single self-contained commit (no amend/retag needed).
+          uv lock
+          git add pyproject.toml CHANGELOG.md uv.lock
+          git commit -m "bump: version ${current_version} → ${new_version} (build patch)"
+          git tag -a "$new_tag" -m "$new_tag" HEAD
+
+          git push --follow-tags
+          if ! git ls-remote --exit-code --tags origin "refs/tags/${new_tag}" >/dev/null; then
+            echo "::error::${new_tag} was not found on origin after push --follow-tags (publish.yml build_patch job will not trigger)."
+            exit 1
+          fi
+
+          echo "buildpatch=true" >> "$GITHUB_OUTPUT"
+          echo "new_tag=${new_tag}" >> "$GITHUB_OUTPUT"
+
+      - name: Sync lockfile
+        if: steps.bump.outputs.bumped == 'true'
+        run: |
+          uv lock
+          git add uv.lock
+          if ! git diff --staged --quiet; then
+            # cz bump already tagged the pre-lock commit; amending moves HEAD
+            # to a new SHA, so the tag must be recreated to point at it.
+            # Must stay annotated (-a) — `git push --follow-tags` only
+            # pushes annotated tags, so a lightweight retag here would
+            # silently never reach the remote.
+            tag="$(git describe --tags --exact-match HEAD)"
+            git commit --amend --no-edit
+            git tag -f -a "$tag" -m "$tag" HEAD
+          fi
+
+      - name: Push commit and tag
+        if: steps.bump.outputs.bumped == 'true'
+        run: |
+          git push --follow-tags
+          tag="$(git describe --tags --exact-match HEAD)"
+          if ! git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null; then
+            echo "::error::${tag} was not found on origin after push --follow-tags (publish.yml will not trigger)."
+            exit 1
+          fi

devstuff-2.5.0/.github/workflows/publish.yml

@@ -0,0 +1,96 @@
+name: Publish to PyPI
+
+# A `v*` tag push triggers this workflow. Two release tracks share that
+# prefix, so they're routed by job-level `if` conditions on the tag name
+# rather than by disjoint trigger globs (GitHub Actions globs can't negate,
+# so `v*` would match both and a glob-only split would double-publish):
+#
+#   - Regular releases    vX.Y.Z          -> build / publish
+#   - Build-patch post    vX.Y.Z.postN    -> build_patch / publish_build_patch
+#
+# The post-release track exists so a PR that contains only `build`-type
+# commits still ships a publishable, PEP 440-distinct version. bump.yml
+# decides which tag to create; this file only reacts to whichever one lands.
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  build:
+    name: Build distribution
+    if: ${{ !contains(github.ref, '.post') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Build wheel and source distribution
+        run: uv build
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    name: Publish to PyPI
+    if: ${{ !contains(github.ref, '.post') }}
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/devstuff
+    permissions:
+      id-token: write  # required for OIDC trusted publishing
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+
+  build_patch:
+    name: Build build-patch distribution
+    if: ${{ contains(github.ref, '.post') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+
+      - name: Build wheel and source distribution
+        run: uv build
+
+      - name: Upload dist artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist-build-patch
+          path: dist/
+
+  publish_build_patch:
+    name: Publish build-patch to PyPI
+    if: ${{ contains(github.ref, '.post') }}
+    needs: build_patch
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/devstuff
+    permissions:
+      id-token: write  # required for OIDC trusted publishing
+    steps:
+      - name: Download dist artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: dist-build-patch
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

{devstuff-2.3.0 → devstuff-2.5.0}/.github/workflows/test-installs.yml

@@ -74,6 +74,7 @@ jobs:
           - pre-commit  # uvx tool, requires uv
           - python      # uv-managed CPython, requires uv
           - ruby        # compiles from source — this job takes ~15 minutes
+          - reptyr
           - saml2aws
           - starship
           - uv

{devstuff-2.3.0 → devstuff-2.5.0}/CHANGELOG.md

@@ -1,3 +1,15 @@
+## v2.5.0 (2026-09-09)
+
+### Features
+
+- **reptyr**: add tool and ptrace permission wizard
+
+## v2.4.0 (2026-08-20)
+
+### Features
+
+- **ci**: publish build-patch updates as PEP 440 post-releases
+
 ## v2.3.0 (2026-08-13)
 
 ### Features

{devstuff-2.3.0 → devstuff-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: devstuff
-Version: 2.3.0
+Version: 2.5.0
 Summary: Development environment setup CLI for Linux
 Project-URL: Repository, https://github.com/thesawdawg/dev-setup-py
 Author-email: Sawyer <sawyerksu@gmail.com>
@@ -324,6 +324,7 @@ devstuff configure starship --output /tmp/try.toml   # write elsewhere, leave th
 
 | Tool | What it configures |
 |------|-------------------|
+| `reptyr` | Temporary or persistent Linux ptrace permissions; command-line usage guidance |
 | `ansible` | `ansible.cfg` — inventory paths, forks, pipelining, become and vault |
 | `bat` | Theme, decorations, paging, and the man-page/`cat` shell integration |
 | `commitizen` | Commit types, what each one bumps, git tags, and changelog sections |
@@ -332,7 +333,8 @@ devstuff configure starship --output /tmp/try.toml   # write elsewhere, leave th
 | `pre-commit` | Which git hooks run, when they run, and what they're allowed to rewrite |
 | `starship` | Prompt style, colour palette, which sections appear, and layout |
 
-Each wizard checks its result against the real tool before saving. What that check can prove
+The reptyr wizard verifies the live kernel setting after applying it. Other wizards check
+their result against the real tool before saving. What that check can prove
 varies a lot, and the wizards say so rather than implying more than they know:
 
 | Tool | What the tool itself checks | What the wizard has to check instead |
@@ -739,6 +741,43 @@ characters, and a quoted boolean is read as `False`. A retired section in an exi
 *preserved and reported*, never silently migrated — the wizard can't know whether an older
 ansible elsewhere is still reading it.
 
+#### reptyr wizard
+
+```bash
+devstuff install reptyr                  # apt package; offers setup after installation
+devstuff configure reptyr                # also works for an already-installed package
+devstuff configure reptyr --path         # /etc/sysctl.d/99-devstuff-reptyr.conf
+devstuff configure reptyr --output /tmp/reptyr.conf  # export only, no live changes
+```
+
+The wizard shows the current `kernel.yama.ptrace_scope` and offers keeping it unchanged,
+enabling same-user attach (`0`), restricted attach (`1`), or admin-only attach (`2`).
+Choose a change for this boot only, or save and apply a persistent sysctl drop-in. The
+preview and confirmation come before any write or sudo command. Persistent changes use
+`sudo install --backup=numbered` to preserve an existing drop-in, then load only that file
+with `sudo sysctl --load`. The wizard reads the live value back to verify success.
+
+Setting `0` relaxes protection **system-wide**, allowing same-user processes to inspect
+and control other dumpable processes. It does not grant cross-user access or bypass
+container/security policies. Mode `3` cannot be changed until reboot, so the wizard
+refuses live changes in that state. If Yama is unavailable or unreadable, it offers only
+guidance; offline `--output` export still works. Other sysctl files may override the saved
+value at boot. Temporary changes leave all boot configuration untouched.
+
+To return to restricted attach, select `1` and the persistent option. This sets a known
+policy rather than claiming to restore an unknown original value. Removing the reptyr
+package does not remove this system policy; rerun the wizard before uninstalling if needed.
+For unattended installs, run `devstuff configure reptyr` later in a terminal.
+
+reptyr has no rc file: its remaining options are per invocation, and the wizard explains
+them rather than inventing persistent defaults. Use `reptyr PID` inside the destination
+terminal; `-T` steals the whole TTY (SSH children require root); `-s` redirects standard
+streams even when they weren't attached to a terminal; `-l` creates a PTY, optionally
+running a command with `REPTYR_PTY` set; `-L` also attaches that command's streams and
+session; `-V` enables debug output, `-v` prints the version, and `-h` shows help.
+See the [upstream manual](https://github.com/nelhage/reptyr/blob/master/reptyr.1) and
+[Linux Yama documentation](https://docs.kernel.org/admin-guide/LSM/Yama.html).
+
 #### lazygit wizard
 
 lazygit refuses to start on a value of the wrong **type**, and silently ignores an unknown
@@ -1230,6 +1269,7 @@ Optional utilities you may want on some machines.
 | `homebrew` | Homebrew | Package manager for Linux (and macOS) | `brew --help` |
 | `ipython` | IPython | Enhanced interactive Python shell with rich tab completion and magic commands | `ipython --help` |
 | `lazygit` | lazygit | TUI git client for fast, keyboard-driven git workflows (`devstuff configure lazygit`) | `lazygit --help` |
+| `reptyr` | reptyr | Move a running process to another terminal (`devstuff configure reptyr` for permissions) | `reptyr -h` |
 | `llm-checker` | llm-checker | Check LLM compatibility with your hardware | `llm-checker --help` |
 | `lmstudio` | LM Studio | Run large language models locally with a GUI | `lms --help` |
 | `mkcert` | mkcert | Zero-config local HTTPS certificates | `mkcert --help` |

{devstuff-2.3.0 → devstuff-2.5.0}/README.md

@@ -297,6 +297,7 @@ devstuff configure starship --output /tmp/try.toml   # write elsewhere, leave th
 
 | Tool | What it configures |
 |------|-------------------|
+| `reptyr` | Temporary or persistent Linux ptrace permissions; command-line usage guidance |
 | `ansible` | `ansible.cfg` — inventory paths, forks, pipelining, become and vault |
 | `bat` | Theme, decorations, paging, and the man-page/`cat` shell integration |
 | `commitizen` | Commit types, what each one bumps, git tags, and changelog sections |
@@ -305,7 +306,8 @@ devstuff configure starship --output /tmp/try.toml   # write elsewhere, leave th
 | `pre-commit` | Which git hooks run, when they run, and what they're allowed to rewrite |
 | `starship` | Prompt style, colour palette, which sections appear, and layout |
 
-Each wizard checks its result against the real tool before saving. What that check can prove
+The reptyr wizard verifies the live kernel setting after applying it. Other wizards check
+their result against the real tool before saving. What that check can prove
 varies a lot, and the wizards say so rather than implying more than they know:
 
 | Tool | What the tool itself checks | What the wizard has to check instead |
@@ -712,6 +714,43 @@ characters, and a quoted boolean is read as `False`. A retired section in an exi
 *preserved and reported*, never silently migrated — the wizard can't know whether an older
 ansible elsewhere is still reading it.
 
+#### reptyr wizard
+
+```bash
+devstuff install reptyr                  # apt package; offers setup after installation
+devstuff configure reptyr                # also works for an already-installed package
+devstuff configure reptyr --path         # /etc/sysctl.d/99-devstuff-reptyr.conf
+devstuff configure reptyr --output /tmp/reptyr.conf  # export only, no live changes
+```
+
+The wizard shows the current `kernel.yama.ptrace_scope` and offers keeping it unchanged,
+enabling same-user attach (`0`), restricted attach (`1`), or admin-only attach (`2`).
+Choose a change for this boot only, or save and apply a persistent sysctl drop-in. The
+preview and confirmation come before any write or sudo command. Persistent changes use
+`sudo install --backup=numbered` to preserve an existing drop-in, then load only that file
+with `sudo sysctl --load`. The wizard reads the live value back to verify success.
+
+Setting `0` relaxes protection **system-wide**, allowing same-user processes to inspect
+and control other dumpable processes. It does not grant cross-user access or bypass
+container/security policies. Mode `3` cannot be changed until reboot, so the wizard
+refuses live changes in that state. If Yama is unavailable or unreadable, it offers only
+guidance; offline `--output` export still works. Other sysctl files may override the saved
+value at boot. Temporary changes leave all boot configuration untouched.
+
+To return to restricted attach, select `1` and the persistent option. This sets a known
+policy rather than claiming to restore an unknown original value. Removing the reptyr
+package does not remove this system policy; rerun the wizard before uninstalling if needed.
+For unattended installs, run `devstuff configure reptyr` later in a terminal.
+
+reptyr has no rc file: its remaining options are per invocation, and the wizard explains
+them rather than inventing persistent defaults. Use `reptyr PID` inside the destination
+terminal; `-T` steals the whole TTY (SSH children require root); `-s` redirects standard
+streams even when they weren't attached to a terminal; `-l` creates a PTY, optionally
+running a command with `REPTYR_PTY` set; `-L` also attaches that command's streams and
+session; `-V` enables debug output, `-v` prints the version, and `-h` shows help.
+See the [upstream manual](https://github.com/nelhage/reptyr/blob/master/reptyr.1) and
+[Linux Yama documentation](https://docs.kernel.org/admin-guide/LSM/Yama.html).
+
 #### lazygit wizard
 
 lazygit refuses to start on a value of the wrong **type**, and silently ignores an unknown
@@ -1203,6 +1242,7 @@ Optional utilities you may want on some machines.
 | `homebrew` | Homebrew | Package manager for Linux (and macOS) | `brew --help` |
 | `ipython` | IPython | Enhanced interactive Python shell with rich tab completion and magic commands | `ipython --help` |
 | `lazygit` | lazygit | TUI git client for fast, keyboard-driven git workflows (`devstuff configure lazygit`) | `lazygit --help` |
+| `reptyr` | reptyr | Move a running process to another terminal (`devstuff configure reptyr` for permissions) | `reptyr -h` |
 | `llm-checker` | llm-checker | Check LLM compatibility with your hardware | `llm-checker --help` |
 | `lmstudio` | LM Studio | Run large language models locally with a GUI | `lms --help` |
 | `mkcert` | mkcert | Zero-config local HTTPS certificates | `mkcert --help` |

{devstuff-2.3.0 → devstuff-2.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devstuff"
-version = "2.3.0"
+version = "2.5.0"
 description = "Development environment setup CLI for Linux"
 readme = "README.md"
 requires-python = ">=3.11"

{devstuff-2.3.0 → devstuff-2.5.0}/src/dev_setup/configure/__init__.py

@@ -39,6 +39,12 @@ class Configurator:
 
 
 CONFIGURATORS: dict[str, Configurator] = {
+    "reptyr": Configurator(
+        key="reptyr",
+        label="reptyr",
+        description="Temporary or persistent ptrace permissions and command-line usage",
+        module="dev_setup.configure.reptyr.wizard",
+    ),
     "ansible": Configurator(
         key="ansible",
         label="Ansible",

devstuff-2.5.0/src/dev_setup/configure/reptyr/__init__.py

@@ -0,0 +1 @@
+"""reptyr permission setup; reptyr itself has no configuration file."""

devstuff-2.5.0/src/dev_setup/configure/reptyr/wizard.py

@@ -0,0 +1,136 @@
+"""Configure Linux Yama permissions without inventing a reptyr rc file.
+
+References: upstream reptyr.1 and docs.kernel.org/admin-guide/LSM/Yama.html.
+Only sysctl modes 0-2 are offered: mode 3 cannot be changed until reboot.
+"""
+
+from __future__ import annotations
+
+import tempfile
+from pathlib import Path
+
+import questionary
+
+from dev_setup import ui
+from dev_setup.generic import _run
+
+SCOPE_PATH = Path("/proc/sys/kernel/yama/ptrace_scope")
+SYSTEM_PATH = Path("/etc/sysctl.d/99-devstuff-reptyr.conf")
+SETTING = "kernel.yama.ptrace_scope"
+MODES = {
+    0: "Enable same-user attach (0) — permits ordinary reptyr PID",
+    1: "Restrict attach (1) — descendants or explicitly permitted processes",
+    2: "Admin-only attach (2) — requires CAP_SYS_PTRACE",
+}
+
+
+def config_path() -> Path:
+    return SYSTEM_PATH
+
+
+def read_scope() -> int | None:
+    try:
+        value = int(SCOPE_PATH.read_text().strip())
+    except (OSError, ValueError):
+        return None
+    return value if value in (0, 1, 2, 3) else None
+
+
+def render(scope: int) -> str:
+    if scope not in MODES:
+        raise ValueError("Only ptrace_scope values 0, 1 and 2 are supported")
+    return (
+        "# Managed by devstuff configure reptyr; affects all processes on this host.\n"
+        "# 0: same-user attach; 1: restricted attach; 2: admin-only attach.\n"
+        f"{SETTING} = {scope}\n"
+    )
+
+
+def _usage() -> None:
+    ui.info("reptyr has no rc file or persistent command-line defaults.")
+    for line in (
+        "reptyr PID      Move a process into this terminal (for example, inside tmux).",
+        "reptyr -T PID   Steal the whole TTY without ptracing the target; SSH children need root.",
+        "reptyr -s PID   Redirect stdin/out/err even when they were not attached to a terminal.",
+        "reptyr -l       Create a PTY; optional COMMAND receives REPTYR_PTY in its environment.",
+        "reptyr -L COMMAND   Also attach the command's standard streams and session to the PTY.",
+        "reptyr -V PID   Debug logging; -v prints the version; -h shows installed-version help.",
+    ):
+        ui.dim(line)
+
+
+def run(*, target: Path | None = None) -> int | None:
+    ui.section("reptyr permissions")
+    _usage()
+    current = read_scope()
+    ui.info(f"Current {SETTING}: {current if current is not None else 'unavailable'}")
+    # --output is always an offline export, even on a host without Yama.
+    if target is None and current is None:
+        ui.warn("Yama is absent or unreadable; no permission change can be applied here.")
+        ui.dim("Other ptrace restrictions may still apply. Use --output to export a sysctl config.")
+        return None
+    if target is None and current == 3:
+        ui.warn("ptrace_scope=3 is locked until reboot, even for root. No changes made.")
+        return None
+
+    choices = [questionary.Choice("Keep current permissions / cancel", value="keep")]
+    choices.extend(questionary.Choice(label, value=str(value)) for value, label in MODES.items())
+    selected = ui.select("Permission policy:", choices)
+    if not selected or selected == "keep":
+        return None
+    scope = int(selected)
+    content = render(scope)
+    if scope == 0:
+        ui.warn("This relaxes ptrace protection system-wide: same-user processes can inspect or control")
+        ui.warn("other dumpable processes. Other users' permissions and container policies still apply.")
+
+    lifetime = "persistent"
+    if target is None:
+        lifetime = ui.select("Apply for:", [
+            questionary.Choice("This boot only (no files changed)", value="temporary"),
+            questionary.Choice("Now and at boot (save a sysctl drop-in)", value="persistent"),
+            questionary.Choice("Cancel", value="cancel"),
+        ])
+        if lifetime not in ("temporary", "persistent"):
+            return None
+
+    if target is not None:
+        ui.info(f"Export only: {target}; existing content will be replaced. No sudo or live changes.")
+    elif lifetime == "temporary":
+        ui.info(f"Will run: sudo sysctl -w {SETTING}={scope}")
+        ui.dim("Existing boot configuration stays in place and may restore a different value.")
+    else:
+        ui.info(f"Will save {SYSTEM_PATH} with sudo install (numbered backup if it exists).")
+        ui.info(f"Then run: sudo sysctl --load {SYSTEM_PATH}")
+        ui.dim("Other sysctl files can override this at boot; only this drop-in is loaded now.")
+    ui.console.print(content, markup=False)
+    if not ui.confirm("Apply this configuration?", default=False):
+        return None
+
+    if target is not None:
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(content, encoding="utf-8")
+        ui.success(f"Exported to {target}; live permissions unchanged.")
+        return scope
+
+    saved = False
+    try:
+        if lifetime == "persistent":
+            with tempfile.TemporaryDirectory(prefix="devstuff-reptyr-") as directory:
+                source = Path(directory) / "reptyr.conf"
+                source.write_text(content, encoding="utf-8")
+                _run(["sudo", "install", "--backup=numbered", "-m", "0644", str(source), str(SYSTEM_PATH)])
+            saved = True
+            _run(["sudo", "sysctl", "--load", str(SYSTEM_PATH)])
+        else:
+            _run(["sudo", "sysctl", "-w", f"{SETTING}={scope}"])
+    except (RuntimeError, OSError) as exc:
+        ui.error(f"Could not apply reptyr permissions: {exc}")
+        if saved:
+            ui.warn(f"{SYSTEM_PATH} was saved, but the live change failed; review it before reboot.")
+        return None
+    if read_scope() != scope:
+        ui.error("The live ptrace_scope does not match the requested value; permissions are not verified.")
+        return None
+    ui.success(f"Verified {SETTING}={scope}.")
+    return scope

{devstuff-2.3.0 → devstuff-2.5.0}/src/dev_setup/tools.yaml

@@ -1,5 +1,15 @@
 version: 1
 tools:
+  reptyr:
+    name: reptyr
+    description: Move a running process to another terminal (permission wizard available)
+    category: tools
+    type: apt
+    apt_packages: reptyr
+    check_cmd: reptyr
+    help_cmd: reptyr -h
+    docs_url: https://github.com/nelhage/reptyr
+
   ansible:
     name: Ansible
     description: Automation engine for configuration management and app deployment