runspec-linux-core 0.3.0__tar.gz → 0.3.1__tar.gz

{runspec_linux_core-0.3.0 → runspec_linux_core-0.3.1}/CHANGELOG.md

@@ -1,5 +1,18 @@
 # runspec-linux-core Changelog
 
+## [0.3.1] — 2026-06-20
+
+Fix `enable_passwordless_sudo` failing with "visudo not installed" (and the same
+latent bug in `reboot_host`'s `shutdown` lookup). The console runs runnables over
+a non-login, non-interactive SSH shell whose `PATH` usually omits `/usr/sbin` and
+`/sbin`, so `shutil.which()` couldn't find these sbin-resident admin tools even
+when installed.
+
+New `_paths.which()` searches `PATH` first, then the standard sbin/bin dirs
+(`/usr/local/sbin`, `/usr/sbin`, `/sbin`, `/usr/local/bin`, `/usr/bin`, `/bin`),
+and returns an absolute path. `sudoers.py` and `power.py` resolve and invoke
+`visudo` / `shutdown` / `systemctl` through it, so they work regardless of `PATH`.
+
 ## [0.3.0] — 2026-06-20
 
 Add `enable_passwordless_sudo()` (new `sudoers.py`) — the one-time bootstrap that

{runspec_linux_core-0.3.0 → runspec_linux_core-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: runspec-linux-core
-Version: 0.3.0
+Version: 0.3.1
 Summary: Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)
 Requires-Python: >=3.10
 Provides-Extra: dev

{runspec_linux_core-0.3.0 → runspec_linux_core-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux-core"
-version = "0.3.0"
+version = "0.3.1"
 requires-python = ">=3.10"
 description = "Pure-Python Linux system-admin helpers — the importable core behind runspec-linux (no runspec dependency, no runnables)"
 dependencies = []

runspec_linux_core-0.3.1/runspec_linux_core/_paths.py

@@ -0,0 +1,33 @@
+"""Resolve system tools that may live in sbin dirs not on a non-login PATH.
+
+The console runs runnables over a non-login, non-interactive SSH shell whose
+``PATH`` often omits ``/usr/sbin`` and ``/sbin`` — so ``shutil.which()`` can't
+find admin tools like ``visudo`` and ``shutdown`` even when they are installed.
+``which()`` searches ``PATH`` first, then the standard sbin/bin locations, and
+returns an absolute path so the caller can invoke the tool regardless of PATH.
+"""
+
+import os
+import shutil
+
+# Searched in order after PATH — the standard admin-tool locations.
+_FALLBACK_DIRS = (
+    "/usr/local/sbin",
+    "/usr/sbin",
+    "/sbin",
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin",
+)
+
+
+def which(name: str) -> str | None:
+    """Return the absolute path to ``name`` (PATH first, then sbin/bin), or None."""
+    found = shutil.which(name)
+    if found:
+        return found
+    for directory in _FALLBACK_DIRS:
+        candidate = os.path.join(directory, name)
+        if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
+            return candidate
+    return None

{runspec_linux_core-0.3.0 → runspec_linux_core-0.3.1}/runspec_linux_core/power.py

@@ -1,8 +1,8 @@
 """Host power helpers: reboot."""
 
-import shutil
 import subprocess
 
+from runspec_linux_core._paths import which
 from runspec_linux_core.errors import CommandError, ToolNotFoundError
 
 
@@ -14,22 +14,26 @@ def reboot_host(delay_minutes: int = 0) -> dict:
     ``shutdown``, falling back to ``systemctl reboot`` for an immediate reboot if
     ``shutdown`` is absent. Returns ``{scheduled: True, delay_minutes, command}``.
 
-    Raises ToolNotFoundError if no usable tool is present, or CommandError if the
+    ``shutdown`` lives in /usr/sbin, often absent from a non-login SSH PATH, so
+    it is resolved to an absolute path (see ``_paths.which``). Raises
+    ToolNotFoundError if no usable tool is present, or CommandError if the
     command exits non-zero (for example when run as an unprivileged user).
     """
-    if shutil.which("shutdown"):
+    shutdown = which("shutdown")
+    if shutdown:
         when = "now" if delay_minutes <= 0 else f"+{delay_minutes}"
-        cmd = ["shutdown", "-r", when]
+        cmd = [shutdown, "-r", when]
         result = subprocess.run(cmd, capture_output=True, text=True)
         if result.returncode != 0:
             raise CommandError(result.stderr.strip() or "shutdown failed")
         return {"scheduled": True, "delay_minutes": max(delay_minutes, 0), "command": " ".join(cmd)}
 
     # No `shutdown` (unusual). systemctl can only do an immediate reboot.
-    if shutil.which("systemctl") and delay_minutes <= 0:
-        result = subprocess.run(["systemctl", "reboot"], capture_output=True, text=True)
+    systemctl = which("systemctl")
+    if systemctl and delay_minutes <= 0:
+        result = subprocess.run([systemctl, "reboot"], capture_output=True, text=True)
         if result.returncode != 0:
             raise CommandError(result.stderr.strip() or "systemctl reboot failed")
-        return {"scheduled": True, "delay_minutes": 0, "command": "systemctl reboot"}
+        return {"scheduled": True, "delay_minutes": 0, "command": f"{systemctl} reboot"}
 
     raise ToolNotFoundError("shutdown not available (and systemctl cannot schedule a delayed reboot)")

{runspec_linux_core-0.3.0 → runspec_linux_core-0.3.1}/runspec_linux_core/sudoers.py

@@ -24,11 +24,11 @@ Two grant scopes:
 import getpass
 import os
 import re
-import shutil
 import subprocess
 import sys
 import tempfile
 
+from runspec_linux_core._paths import which
 from runspec_linux_core.errors import CommandError, ToolNotFoundError
 
 _DROP_IN = "/etc/sudoers.d/runspec"
@@ -56,10 +56,10 @@ def _sudoers_content(user: str, scope: str, bin_dir: str) -> str:
     return f"{_MANAGED_HEADER}{rule}\n"
 
 
-def _sudo(password: str, argv: list[str]) -> subprocess.CompletedProcess:
+def _sudo(sudo_path: str, password: str, argv: list[str]) -> subprocess.CompletedProcess:
     """Run ``sudo -S -p '' argv``, feeding ``password`` on stdin (never on argv)."""
     return subprocess.run(
-        ["sudo", "-S", "-p", "", *argv],
+        [sudo_path, "-S", "-p", "", *argv],
         input=password + "\n",
         capture_output=True,
         text=True,
@@ -90,9 +90,13 @@ def enable_passwordless_sudo(password: str, user: str | None = None, scope: str
     user = user or getpass.getuser()
     if not _USER_RE.match(user):
         raise ValueError(f"invalid user name: {user!r}")
-    if not shutil.which("sudo"):
+    # visudo lives in /usr/sbin, which is often absent from a non-login SSH PATH;
+    # resolve to absolute paths so the lookups (and invocations) work anyway.
+    sudo_path = which("sudo")
+    if not sudo_path:
         raise ToolNotFoundError("sudo is not installed")
-    if not shutil.which("visudo"):
+    visudo_path = which("visudo")
+    if not visudo_path:
         raise ToolNotFoundError("visudo is not installed (needed to validate the sudoers file)")
 
     content = _sudoers_content(user, scope, _runspec_bin_dir())
@@ -102,25 +106,25 @@ def enable_passwordless_sudo(password: str, user: str | None = None, scope: str
         tmp_path = tf.name
     try:
         # 1) Validate the generated syntax locally before touching the system.
-        check = subprocess.run(["visudo", "-cf", tmp_path], capture_output=True, text=True)
+        check = subprocess.run([visudo_path, "-cf", tmp_path], capture_output=True, text=True)
         if check.returncode != 0:
             detail = check.stdout.strip() or check.stderr.strip()
             raise CommandError(f"generated sudoers failed validation: {detail}")
 
         # 2) Idempotent: identical drop-in already present? (reading it needs root)
-        existing = _sudo(password, ["cat", _DROP_IN])
+        existing = _sudo(sudo_path, password, ["cat", _DROP_IN])
         if existing.returncode == 0 and existing.stdout == content:
             return {"user": user, "scope": scope, "path": _DROP_IN, "installed": True, "already_configured": True}
 
         # 3) Install atomically as root, 0440 root:root.
-        install = _sudo(password, ["install", "-m", "0440", "-o", "root", "-g", "root", tmp_path, _DROP_IN])
+        install = _sudo(sudo_path, password, ["install", "-m", "0440", "-o", "root", "-g", "root", tmp_path, _DROP_IN])
         if install.returncode != 0:
             raise CommandError(_auth_hint(install))
 
         # 4) Re-validate the whole sudoers tree; roll our drop-in back if broken.
-        verify = _sudo(password, ["visudo", "-c"])
+        verify = _sudo(sudo_path, password, [visudo_path, "-c"])
         if verify.returncode != 0:
-            _sudo(password, ["rm", "-f", _DROP_IN])
+            _sudo(sudo_path, password, ["rm", "-f", _DROP_IN])
             detail = verify.stdout.strip() or verify.stderr.strip()
             raise CommandError(f"sudoers validation failed after install — rolled back: {detail}")
 

runspec_linux_core-0.3.1/tests/test_paths.py

@@ -0,0 +1,24 @@
+"""which() falls back to sbin/bin dirs when a tool isn't on PATH."""
+
+import pytest
+
+from runspec_linux_core._paths import which
+
+
+def test_which_prefers_path(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr("runspec_linux_core._paths.shutil.which", lambda n: "/usr/bin/" + n)
+    assert which("sudo") == "/usr/bin/sudo"
+
+
+def test_which_falls_back_to_sbin(monkeypatch: pytest.MonkeyPatch) -> None:
+    # Not on PATH (the non-login SSH case), but present in /usr/sbin.
+    monkeypatch.setattr("runspec_linux_core._paths.shutil.which", lambda n: None)
+    monkeypatch.setattr("runspec_linux_core._paths.os.path.isfile", lambda p: p == "/usr/sbin/visudo")
+    monkeypatch.setattr("runspec_linux_core._paths.os.access", lambda p, mode: True)
+    assert which("visudo") == "/usr/sbin/visudo"
+
+
+def test_which_none_when_absent(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr("runspec_linux_core._paths.shutil.which", lambda n: None)
+    monkeypatch.setattr("runspec_linux_core._paths.os.path.isfile", lambda p: False)
+    assert which("nope") is None

{runspec_linux_core-0.3.0 → runspec_linux_core-0.3.1}/tests/test_power.py

@@ -14,7 +14,7 @@ def _completed(returncode: int = 0, stderr: str = "") -> subprocess.CompletedPro
 
 def test_reboot_now_uses_shutdown(monkeypatch: pytest.MonkeyPatch) -> None:
     seen: list[list[str]] = []
-    monkeypatch.setattr("runspec_linux_core.power.shutil.which", lambda name: name == "shutdown")
+    monkeypatch.setattr("runspec_linux_core.power.which", lambda name: name if name == "shutdown" else None)
     monkeypatch.setattr(
         "runspec_linux_core.power.subprocess.run",
         lambda cmd, **kw: seen.append(cmd) or _completed(),
@@ -26,7 +26,7 @@ def test_reboot_now_uses_shutdown(monkeypatch: pytest.MonkeyPatch) -> None:
 
 def test_reboot_with_delay_schedules(monkeypatch: pytest.MonkeyPatch) -> None:
     seen: list[list[str]] = []
-    monkeypatch.setattr("runspec_linux_core.power.shutil.which", lambda name: name == "shutdown")
+    monkeypatch.setattr("runspec_linux_core.power.which", lambda name: name if name == "shutdown" else None)
     monkeypatch.setattr(
         "runspec_linux_core.power.subprocess.run",
         lambda cmd, **kw: seen.append(cmd) or _completed(),
@@ -38,7 +38,7 @@ def test_reboot_with_delay_schedules(monkeypatch: pytest.MonkeyPatch) -> None:
 
 def test_reboot_falls_back_to_systemctl(monkeypatch: pytest.MonkeyPatch) -> None:
     seen: list[list[str]] = []
-    monkeypatch.setattr("runspec_linux_core.power.shutil.which", lambda name: name == "systemctl")
+    monkeypatch.setattr("runspec_linux_core.power.which", lambda name: name if name == "systemctl" else None)
     monkeypatch.setattr(
         "runspec_linux_core.power.subprocess.run",
         lambda cmd, **kw: seen.append(cmd) or _completed(),
@@ -49,7 +49,7 @@ def test_reboot_falls_back_to_systemctl(monkeypatch: pytest.MonkeyPatch) -> None
 
 
 def test_reboot_non_zero_raises(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr("runspec_linux_core.power.shutil.which", lambda name: name == "shutdown")
+    monkeypatch.setattr("runspec_linux_core.power.which", lambda name: name if name == "shutdown" else None)
     monkeypatch.setattr(
         "runspec_linux_core.power.subprocess.run",
         lambda cmd, **kw: _completed(returncode=1, stderr="Operation not permitted"),

{runspec_linux_core-0.3.0 → runspec_linux_core-0.3.1}/tests/test_preconditions.py

@@ -101,12 +101,12 @@ def test_remove_package_requires_a_manager(monkeypatch: pytest.MonkeyPatch) -> N
 
 
 def test_reboot_host_requires_a_tool(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr("runspec_linux_core.power.shutil.which", lambda _: None)
+    monkeypatch.setattr("runspec_linux_core.power.which", lambda _: None)
     with pytest.raises(ToolNotFoundError):
         core.reboot_host()
 
 
 def test_enable_passwordless_sudo_requires_sudo(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr("runspec_linux_core.sudoers.shutil.which", lambda _: None)
+    monkeypatch.setattr("runspec_linux_core.sudoers.which", lambda _: None)
     with pytest.raises(ToolNotFoundError):
         core.enable_passwordless_sudo("pw", "alice", "scoped")

{runspec_linux_core-0.3.0 → runspec_linux_core-0.3.1}/tests/test_sudoers.py

@@ -19,7 +19,8 @@ def _ok(stdout: str = "", returncode: int = 0, stderr: str = "") -> subprocess.C
 
 @pytest.fixture(autouse=True)
 def _tools_present(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr("runspec_linux_core.sudoers.shutil.which", lambda name: f"/usr/sbin/{name}")
+    # Resolver returns the bare name so the stubbed commands read cleanly.
+    monkeypatch.setattr("runspec_linux_core.sudoers.which", lambda name: name)
     monkeypatch.setattr("runspec_linux_core.sudoers._runspec_bin_dir", lambda: "/opt/rs/bin")
 
 
@@ -142,6 +143,6 @@ def test_post_validate_failure_rolls_back(monkeypatch: pytest.MonkeyPatch) -> No
 
 
 def test_requires_visudo(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr("runspec_linux_core.sudoers.shutil.which", lambda name: None if name == "visudo" else "/usr/bin/sudo")
+    monkeypatch.setattr("runspec_linux_core.sudoers.which", lambda name: None if name == "visudo" else "/usr/bin/sudo")
     with pytest.raises(ToolNotFoundError, match="visudo"):
         sudoers.enable_passwordless_sudo("pw", "alice", "scoped")