devstuff 2.4.0__tar.gz → 2.5.0__tar.gz

{devstuff-2.4.0 → devstuff-2.5.0}/.github/workflows/test-installs.yml

@@ -74,6 +74,7 @@ jobs:
           - pre-commit  # uvx tool, requires uv
           - python      # uv-managed CPython, requires uv
           - ruby        # compiles from source — this job takes ~15 minutes
+          - reptyr
           - saml2aws
           - starship
           - uv

{devstuff-2.4.0 → devstuff-2.5.0}/CHANGELOG.md

@@ -1,3 +1,9 @@
+## v2.5.0 (2026-09-09)
+
+### Features
+
+- **reptyr**: add tool and ptrace permission wizard
+
 ## v2.4.0 (2026-08-20)
 
 ### Features

{devstuff-2.4.0 → devstuff-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: devstuff
-Version: 2.4.0
+Version: 2.5.0
 Summary: Development environment setup CLI for Linux
 Project-URL: Repository, https://github.com/thesawdawg/dev-setup-py
 Author-email: Sawyer <sawyerksu@gmail.com>
@@ -324,6 +324,7 @@ devstuff configure starship --output /tmp/try.toml   # write elsewhere, leave th
 
 | Tool | What it configures |
 |------|-------------------|
+| `reptyr` | Temporary or persistent Linux ptrace permissions; command-line usage guidance |
 | `ansible` | `ansible.cfg` — inventory paths, forks, pipelining, become and vault |
 | `bat` | Theme, decorations, paging, and the man-page/`cat` shell integration |
 | `commitizen` | Commit types, what each one bumps, git tags, and changelog sections |
@@ -332,7 +333,8 @@ devstuff configure starship --output /tmp/try.toml   # write elsewhere, leave th
 | `pre-commit` | Which git hooks run, when they run, and what they're allowed to rewrite |
 | `starship` | Prompt style, colour palette, which sections appear, and layout |
 
-Each wizard checks its result against the real tool before saving. What that check can prove
+The reptyr wizard verifies the live kernel setting after applying it. Other wizards check
+their result against the real tool before saving. What that check can prove
 varies a lot, and the wizards say so rather than implying more than they know:
 
 | Tool | What the tool itself checks | What the wizard has to check instead |
@@ -739,6 +741,43 @@ characters, and a quoted boolean is read as `False`. A retired section in an exi
 *preserved and reported*, never silently migrated — the wizard can't know whether an older
 ansible elsewhere is still reading it.
 
+#### reptyr wizard
+
+```bash
+devstuff install reptyr                  # apt package; offers setup after installation
+devstuff configure reptyr                # also works for an already-installed package
+devstuff configure reptyr --path         # /etc/sysctl.d/99-devstuff-reptyr.conf
+devstuff configure reptyr --output /tmp/reptyr.conf  # export only, no live changes
+```
+
+The wizard shows the current `kernel.yama.ptrace_scope` and offers keeping it unchanged,
+enabling same-user attach (`0`), restricted attach (`1`), or admin-only attach (`2`).
+Choose a change for this boot only, or save and apply a persistent sysctl drop-in. The
+preview and confirmation come before any write or sudo command. Persistent changes use
+`sudo install --backup=numbered` to preserve an existing drop-in, then load only that file
+with `sudo sysctl --load`. The wizard reads the live value back to verify success.
+
+Setting `0` relaxes protection **system-wide**, allowing same-user processes to inspect
+and control other dumpable processes. It does not grant cross-user access or bypass
+container/security policies. Mode `3` cannot be changed until reboot, so the wizard
+refuses live changes in that state. If Yama is unavailable or unreadable, it offers only
+guidance; offline `--output` export still works. Other sysctl files may override the saved
+value at boot. Temporary changes leave all boot configuration untouched.
+
+To return to restricted attach, select `1` and the persistent option. This sets a known
+policy rather than claiming to restore an unknown original value. Removing the reptyr
+package does not remove this system policy; rerun the wizard before uninstalling if needed.
+For unattended installs, run `devstuff configure reptyr` later in a terminal.
+
+reptyr has no rc file: its remaining options are per invocation, and the wizard explains
+them rather than inventing persistent defaults. Use `reptyr PID` inside the destination
+terminal; `-T` steals the whole TTY (SSH children require root); `-s` redirects standard
+streams even when they weren't attached to a terminal; `-l` creates a PTY, optionally
+running a command with `REPTYR_PTY` set; `-L` also attaches that command's streams and
+session; `-V` enables debug output, `-v` prints the version, and `-h` shows help.
+See the [upstream manual](https://github.com/nelhage/reptyr/blob/master/reptyr.1) and
+[Linux Yama documentation](https://docs.kernel.org/admin-guide/LSM/Yama.html).
+
 #### lazygit wizard
 
 lazygit refuses to start on a value of the wrong **type**, and silently ignores an unknown
@@ -1230,6 +1269,7 @@ Optional utilities you may want on some machines.
 | `homebrew` | Homebrew | Package manager for Linux (and macOS) | `brew --help` |
 | `ipython` | IPython | Enhanced interactive Python shell with rich tab completion and magic commands | `ipython --help` |
 | `lazygit` | lazygit | TUI git client for fast, keyboard-driven git workflows (`devstuff configure lazygit`) | `lazygit --help` |
+| `reptyr` | reptyr | Move a running process to another terminal (`devstuff configure reptyr` for permissions) | `reptyr -h` |
 | `llm-checker` | llm-checker | Check LLM compatibility with your hardware | `llm-checker --help` |
 | `lmstudio` | LM Studio | Run large language models locally with a GUI | `lms --help` |
 | `mkcert` | mkcert | Zero-config local HTTPS certificates | `mkcert --help` |

{devstuff-2.4.0 → devstuff-2.5.0}/README.md

@@ -297,6 +297,7 @@ devstuff configure starship --output /tmp/try.toml   # write elsewhere, leave th
 
 | Tool | What it configures |
 |------|-------------------|
+| `reptyr` | Temporary or persistent Linux ptrace permissions; command-line usage guidance |
 | `ansible` | `ansible.cfg` — inventory paths, forks, pipelining, become and vault |
 | `bat` | Theme, decorations, paging, and the man-page/`cat` shell integration |
 | `commitizen` | Commit types, what each one bumps, git tags, and changelog sections |
@@ -305,7 +306,8 @@ devstuff configure starship --output /tmp/try.toml   # write elsewhere, leave th
 | `pre-commit` | Which git hooks run, when they run, and what they're allowed to rewrite |
 | `starship` | Prompt style, colour palette, which sections appear, and layout |
 
-Each wizard checks its result against the real tool before saving. What that check can prove
+The reptyr wizard verifies the live kernel setting after applying it. Other wizards check
+their result against the real tool before saving. What that check can prove
 varies a lot, and the wizards say so rather than implying more than they know:
 
 | Tool | What the tool itself checks | What the wizard has to check instead |
@@ -712,6 +714,43 @@ characters, and a quoted boolean is read as `False`. A retired section in an exi
 *preserved and reported*, never silently migrated — the wizard can't know whether an older
 ansible elsewhere is still reading it.
 
+#### reptyr wizard
+
+```bash
+devstuff install reptyr                  # apt package; offers setup after installation
+devstuff configure reptyr                # also works for an already-installed package
+devstuff configure reptyr --path         # /etc/sysctl.d/99-devstuff-reptyr.conf
+devstuff configure reptyr --output /tmp/reptyr.conf  # export only, no live changes
+```
+
+The wizard shows the current `kernel.yama.ptrace_scope` and offers keeping it unchanged,
+enabling same-user attach (`0`), restricted attach (`1`), or admin-only attach (`2`).
+Choose a change for this boot only, or save and apply a persistent sysctl drop-in. The
+preview and confirmation come before any write or sudo command. Persistent changes use
+`sudo install --backup=numbered` to preserve an existing drop-in, then load only that file
+with `sudo sysctl --load`. The wizard reads the live value back to verify success.
+
+Setting `0` relaxes protection **system-wide**, allowing same-user processes to inspect
+and control other dumpable processes. It does not grant cross-user access or bypass
+container/security policies. Mode `3` cannot be changed until reboot, so the wizard
+refuses live changes in that state. If Yama is unavailable or unreadable, it offers only
+guidance; offline `--output` export still works. Other sysctl files may override the saved
+value at boot. Temporary changes leave all boot configuration untouched.
+
+To return to restricted attach, select `1` and the persistent option. This sets a known
+policy rather than claiming to restore an unknown original value. Removing the reptyr
+package does not remove this system policy; rerun the wizard before uninstalling if needed.
+For unattended installs, run `devstuff configure reptyr` later in a terminal.
+
+reptyr has no rc file: its remaining options are per invocation, and the wizard explains
+them rather than inventing persistent defaults. Use `reptyr PID` inside the destination
+terminal; `-T` steals the whole TTY (SSH children require root); `-s` redirects standard
+streams even when they weren't attached to a terminal; `-l` creates a PTY, optionally
+running a command with `REPTYR_PTY` set; `-L` also attaches that command's streams and
+session; `-V` enables debug output, `-v` prints the version, and `-h` shows help.
+See the [upstream manual](https://github.com/nelhage/reptyr/blob/master/reptyr.1) and
+[Linux Yama documentation](https://docs.kernel.org/admin-guide/LSM/Yama.html).
+
 #### lazygit wizard
 
 lazygit refuses to start on a value of the wrong **type**, and silently ignores an unknown
@@ -1203,6 +1242,7 @@ Optional utilities you may want on some machines.
 | `homebrew` | Homebrew | Package manager for Linux (and macOS) | `brew --help` |
 | `ipython` | IPython | Enhanced interactive Python shell with rich tab completion and magic commands | `ipython --help` |
 | `lazygit` | lazygit | TUI git client for fast, keyboard-driven git workflows (`devstuff configure lazygit`) | `lazygit --help` |
+| `reptyr` | reptyr | Move a running process to another terminal (`devstuff configure reptyr` for permissions) | `reptyr -h` |
 | `llm-checker` | llm-checker | Check LLM compatibility with your hardware | `llm-checker --help` |
 | `lmstudio` | LM Studio | Run large language models locally with a GUI | `lms --help` |
 | `mkcert` | mkcert | Zero-config local HTTPS certificates | `mkcert --help` |

{devstuff-2.4.0 → devstuff-2.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "devstuff"
-version = "2.4.0"
+version = "2.5.0"
 description = "Development environment setup CLI for Linux"
 readme = "README.md"
 requires-python = ">=3.11"

{devstuff-2.4.0 → devstuff-2.5.0}/src/dev_setup/configure/__init__.py

@@ -39,6 +39,12 @@ class Configurator:
 
 
 CONFIGURATORS: dict[str, Configurator] = {
+    "reptyr": Configurator(
+        key="reptyr",
+        label="reptyr",
+        description="Temporary or persistent ptrace permissions and command-line usage",
+        module="dev_setup.configure.reptyr.wizard",
+    ),
     "ansible": Configurator(
         key="ansible",
         label="Ansible",

devstuff-2.5.0/src/dev_setup/configure/reptyr/__init__.py

@@ -0,0 +1 @@
+"""reptyr permission setup; reptyr itself has no configuration file."""

devstuff-2.5.0/src/dev_setup/configure/reptyr/wizard.py

@@ -0,0 +1,136 @@
+"""Configure Linux Yama permissions without inventing a reptyr rc file.
+
+References: upstream reptyr.1 and docs.kernel.org/admin-guide/LSM/Yama.html.
+Only sysctl modes 0-2 are offered: mode 3 cannot be changed until reboot.
+"""
+
+from __future__ import annotations
+
+import tempfile
+from pathlib import Path
+
+import questionary
+
+from dev_setup import ui
+from dev_setup.generic import _run
+
+SCOPE_PATH = Path("/proc/sys/kernel/yama/ptrace_scope")
+SYSTEM_PATH = Path("/etc/sysctl.d/99-devstuff-reptyr.conf")
+SETTING = "kernel.yama.ptrace_scope"
+MODES = {
+    0: "Enable same-user attach (0) — permits ordinary reptyr PID",
+    1: "Restrict attach (1) — descendants or explicitly permitted processes",
+    2: "Admin-only attach (2) — requires CAP_SYS_PTRACE",
+}
+
+
+def config_path() -> Path:
+    return SYSTEM_PATH
+
+
+def read_scope() -> int | None:
+    try:
+        value = int(SCOPE_PATH.read_text().strip())
+    except (OSError, ValueError):
+        return None
+    return value if value in (0, 1, 2, 3) else None
+
+
+def render(scope: int) -> str:
+    if scope not in MODES:
+        raise ValueError("Only ptrace_scope values 0, 1 and 2 are supported")
+    return (
+        "# Managed by devstuff configure reptyr; affects all processes on this host.\n"
+        "# 0: same-user attach; 1: restricted attach; 2: admin-only attach.\n"
+        f"{SETTING} = {scope}\n"
+    )
+
+
+def _usage() -> None:
+    ui.info("reptyr has no rc file or persistent command-line defaults.")
+    for line in (
+        "reptyr PID      Move a process into this terminal (for example, inside tmux).",
+        "reptyr -T PID   Steal the whole TTY without ptracing the target; SSH children need root.",
+        "reptyr -s PID   Redirect stdin/out/err even when they were not attached to a terminal.",
+        "reptyr -l       Create a PTY; optional COMMAND receives REPTYR_PTY in its environment.",
+        "reptyr -L COMMAND   Also attach the command's standard streams and session to the PTY.",
+        "reptyr -V PID   Debug logging; -v prints the version; -h shows installed-version help.",
+    ):
+        ui.dim(line)
+
+
+def run(*, target: Path | None = None) -> int | None:
+    ui.section("reptyr permissions")
+    _usage()
+    current = read_scope()
+    ui.info(f"Current {SETTING}: {current if current is not None else 'unavailable'}")
+    # --output is always an offline export, even on a host without Yama.
+    if target is None and current is None:
+        ui.warn("Yama is absent or unreadable; no permission change can be applied here.")
+        ui.dim("Other ptrace restrictions may still apply. Use --output to export a sysctl config.")
+        return None
+    if target is None and current == 3:
+        ui.warn("ptrace_scope=3 is locked until reboot, even for root. No changes made.")
+        return None
+
+    choices = [questionary.Choice("Keep current permissions / cancel", value="keep")]
+    choices.extend(questionary.Choice(label, value=str(value)) for value, label in MODES.items())
+    selected = ui.select("Permission policy:", choices)
+    if not selected or selected == "keep":
+        return None
+    scope = int(selected)
+    content = render(scope)
+    if scope == 0:
+        ui.warn("This relaxes ptrace protection system-wide: same-user processes can inspect or control")
+        ui.warn("other dumpable processes. Other users' permissions and container policies still apply.")
+
+    lifetime = "persistent"
+    if target is None:
+        lifetime = ui.select("Apply for:", [
+            questionary.Choice("This boot only (no files changed)", value="temporary"),
+            questionary.Choice("Now and at boot (save a sysctl drop-in)", value="persistent"),
+            questionary.Choice("Cancel", value="cancel"),
+        ])
+        if lifetime not in ("temporary", "persistent"):
+            return None
+
+    if target is not None:
+        ui.info(f"Export only: {target}; existing content will be replaced. No sudo or live changes.")
+    elif lifetime == "temporary":
+        ui.info(f"Will run: sudo sysctl -w {SETTING}={scope}")
+        ui.dim("Existing boot configuration stays in place and may restore a different value.")
+    else:
+        ui.info(f"Will save {SYSTEM_PATH} with sudo install (numbered backup if it exists).")
+        ui.info(f"Then run: sudo sysctl --load {SYSTEM_PATH}")
+        ui.dim("Other sysctl files can override this at boot; only this drop-in is loaded now.")
+    ui.console.print(content, markup=False)
+    if not ui.confirm("Apply this configuration?", default=False):
+        return None
+
+    if target is not None:
+        target.parent.mkdir(parents=True, exist_ok=True)
+        target.write_text(content, encoding="utf-8")
+        ui.success(f"Exported to {target}; live permissions unchanged.")
+        return scope
+
+    saved = False
+    try:
+        if lifetime == "persistent":
+            with tempfile.TemporaryDirectory(prefix="devstuff-reptyr-") as directory:
+                source = Path(directory) / "reptyr.conf"
+                source.write_text(content, encoding="utf-8")
+                _run(["sudo", "install", "--backup=numbered", "-m", "0644", str(source), str(SYSTEM_PATH)])
+            saved = True
+            _run(["sudo", "sysctl", "--load", str(SYSTEM_PATH)])
+        else:
+            _run(["sudo", "sysctl", "-w", f"{SETTING}={scope}"])
+    except (RuntimeError, OSError) as exc:
+        ui.error(f"Could not apply reptyr permissions: {exc}")
+        if saved:
+            ui.warn(f"{SYSTEM_PATH} was saved, but the live change failed; review it before reboot.")
+        return None
+    if read_scope() != scope:
+        ui.error("The live ptrace_scope does not match the requested value; permissions are not verified.")
+        return None
+    ui.success(f"Verified {SETTING}={scope}.")
+    return scope

{devstuff-2.4.0 → devstuff-2.5.0}/src/dev_setup/tools.yaml

@@ -1,5 +1,15 @@
 version: 1
 tools:
+  reptyr:
+    name: reptyr
+    description: Move a running process to another terminal (permission wizard available)
+    category: tools
+    type: apt
+    apt_packages: reptyr
+    check_cmd: reptyr
+    help_cmd: reptyr -h
+    docs_url: https://github.com/nelhage/reptyr
+
   ansible:
     name: Ansible
     description: Automation engine for configuration management and app deployment

devstuff-2.5.0/tests/test_configure_reptyr.py

@@ -0,0 +1,150 @@
+from unittest.mock import Mock
+
+import pytest
+from click.testing import CliRunner
+
+from dev_setup import configure
+from dev_setup.commands.configure_cmd import configure_cmd, offer_after_install
+from dev_setup.configure.reptyr import wizard
+
+
+@pytest.fixture
+def flow(monkeypatch, tmp_path):
+    scope = tmp_path / "ptrace_scope"
+    scope.write_text("1\n")
+    monkeypatch.setattr(wizard, "SCOPE_PATH", scope)
+    monkeypatch.setattr(wizard, "SYSTEM_PATH", tmp_path / "99-devstuff-reptyr.conf")
+    runner = Mock()
+    monkeypatch.setattr(wizard, "_run", runner)
+    monkeypatch.setattr(wizard.ui, "confirm", lambda *a, **kw: True)
+    return scope, runner
+
+
+def answers(monkeypatch, *values):
+    iterator = iter(values)
+    monkeypatch.setattr(wizard.ui, "select", lambda *a, **kw: next(iterator))
+
+
+def test_registered_and_path(flow):
+    assert configure.get("reptyr").load() is wizard
+    result = CliRunner().invoke(configure_cmd, ["reptyr", "--path"])
+    assert result.exit_code == 0
+    assert str(wizard.SYSTEM_PATH) in result.output
+
+
+@pytest.mark.parametrize("value", ["0", "1", "2", "3", "broken", "4"])
+def test_detection(flow, value):
+    path, _ = flow
+    path.write_text(value)
+    assert wizard.read_scope() == (int(value) if value in "0123" else None)
+
+
+@pytest.mark.parametrize("state", ["missing", "3"])
+def test_unavailable_or_locked_cannot_mutate(flow, monkeypatch, state):
+    path, runner = flow
+    if state == "missing":
+        path.unlink()
+    else:
+        path.write_text(state)
+    answers(monkeypatch)  # no prompts should be needed
+    assert wizard.run() is None
+    runner.assert_not_called()
+
+
+@pytest.mark.parametrize("selection", [None, "keep"])
+def test_cancel_policy(flow, monkeypatch, selection):
+    answers(monkeypatch, selection)
+    assert wizard.run() is None
+    flow[1].assert_not_called()
+
+
+def test_declined_confirmation_writes_nothing(flow, monkeypatch, tmp_path):
+    answers(monkeypatch, "0")
+    monkeypatch.setattr(wizard.ui, "confirm", lambda *a, **kw: False)
+    target = tmp_path / "export.conf"
+    assert wizard.run(target=target) is None
+    assert not target.exists()
+    flow[1].assert_not_called()
+
+
+@pytest.mark.parametrize("value", [0, 1, 2])
+def test_offline_export_never_uses_sudo(flow, monkeypatch, tmp_path, value):
+    flow[0].unlink()
+    answers(monkeypatch, str(value))
+    target = tmp_path / "export.conf"
+    assert wizard.run(target=target) == value
+    assert f"kernel.yama.ptrace_scope = {value}\n" in target.read_text()
+    flow[1].assert_not_called()
+
+
+def test_temporary_change_verified_without_file(flow, monkeypatch):
+    path, runner = flow
+    runner.side_effect = lambda cmd: path.write_text("0")
+    answers(monkeypatch, "0", "temporary")
+    assert wizard.run() == 0
+    runner.assert_called_once_with(["sudo", "sysctl", "-w", "kernel.yama.ptrace_scope=0"])
+    assert not wizard.SYSTEM_PATH.exists()
+
+
+def test_persistent_backup_and_load_only_own_file(flow, monkeypatch):
+    path, runner = flow
+
+    def execute(cmd):
+        if cmd[1] == "install":
+            from pathlib import Path
+            assert "--backup=numbered" in cmd
+            assert "kernel.yama.ptrace_scope = 0" in Path(cmd[-2]).read_text()
+        else:
+            assert cmd == ["sudo", "sysctl", "--load", str(wizard.SYSTEM_PATH)]
+            path.write_text("0")
+
+    runner.side_effect = execute
+    answers(monkeypatch, "0", "persistent")
+    assert wizard.run() == 0
+    assert runner.call_count == 2
+
+
+@pytest.mark.parametrize("failure", [RuntimeError("denied"), FileNotFoundError("sudo")])
+def test_failed_apply_never_reports_success(flow, monkeypatch, failure):
+    flow[1].side_effect = failure
+    success = Mock()
+    monkeypatch.setattr(wizard.ui, "success", success)
+    answers(monkeypatch, "0", "temporary")
+    assert wizard.run() is None
+    success.assert_not_called()
+
+
+def test_saved_but_not_applied_is_reported(flow, monkeypatch):
+    flow[1].side_effect = [None, RuntimeError("read-only sysctl")]
+    warning = Mock()
+    monkeypatch.setattr(wizard.ui, "warn", warning)
+    answers(monkeypatch, "0", "persistent")
+    assert wizard.run() is None
+    assert "was saved, but the live change failed" in warning.call_args.args[0]
+
+
+def test_readback_mismatch_is_failure(flow, monkeypatch):
+    answers(monkeypatch, "0", "temporary")
+    assert wizard.run() is None
+
+
+def test_mode_three_cannot_be_generated():
+    with pytest.raises(ValueError):
+        wizard.render(3)
+
+
+def test_post_install_offer_runs_wizard(monkeypatch):
+    monkeypatch.setattr("sys.stdin.isatty", lambda: True)
+    monkeypatch.setattr(wizard.ui, "confirm", lambda *a, **kw: True)
+    run = Mock()
+    monkeypatch.setattr(wizard, "run", run)
+    offer_after_install("reptyr")
+    run.assert_called_once_with()
+
+
+def test_noninteractive_install_does_not_change_permissions(monkeypatch):
+    monkeypatch.setattr("sys.stdin.isatty", lambda: False)
+    run = Mock()
+    monkeypatch.setattr(wizard, "run", run)
+    offer_after_install("reptyr")
+    run.assert_not_called()

{devstuff-2.4.0 → devstuff-2.5.0}/uv.lock

@@ -167,7 +167,7 @@ wheels = [
 
 [[package]]
 name = "devstuff"
-version = "2.4.0"
+version = "2.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "click" },