runspec-linux-root 0.1.0__tar.gz → 0.1.1__tar.gz

{runspec_linux_root-0.1.0 → runspec_linux_root-0.1.1}/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to `runspec-linux-root` are documented here.
 
+## [0.1.1] — 2026-10-01
+
+- `enable-passwordless-sudo --scope scoped`: the help text and README now say
+  the scoped grant also covers runspec-console and MCP-gateway runs, from
+  runspec 0.70.0 (their env prelude runs on the venv's `bin/python`).
+  `--scope all` is no longer needed for those. No code change.
+
 ## [0.1.0] — 2026-09-30
 
 First release. The Linux tools that need root, split out of `runspec-linux`

{runspec_linux_root-0.1.0 → runspec_linux_root-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runspec-linux-root
-Version: 0.1.0
+Version: 0.1.1
 Summary: Linux admin runnables that need root (packages, reboot, sysctl) for runspec
 Project-URL: Documentation, https://runspec.app/
 Project-URL: Source, https://github.com/jasonfinestone/runspec/tree/main/packages/python/runspec-linux-root
@@ -62,9 +62,11 @@ otherwise, naming the account to `sudo -u` to.
 which never prompts for a password, so the admin needs a passwordless sudo rule.
 `enable-passwordless-sudo` installs one:
 
-- `--scope scoped` allows only this venv's tools, run directly
-  (`sudo /opt/venvs/admin/bin/<tool>` from a shell or cron). It does **not**
-  cover the console or the gateway, which pass variables to the tool through a
-  `sh` prelude so that secrets never go on a command line; sudo then sees `sh`,
-  not the tool.
-- `--scope all` grants `NOPASSWD: ALL`, which the console and the gateway need.
+- `--scope scoped` allows only the programs in this venv's `bin/`. That covers
+  direct runs (`sudo /opt/venvs/admin/bin/<tool>` from a shell or cron) and,
+  with runspec-console / runspec-mcp built on runspec ≥ 0.70.0, console and
+  gateway runs too. Those pass variables to the tool on stdin through a small
+  prelude that runs on the venv's own `bin/python`, which the scoped rule covers.
+  (Before runspec 0.70.0 the prelude ran on `sh`, which the scoped rule doesn't
+  cover, so console runs that carried variables needed `--scope all`.)
+- `--scope all` grants `NOPASSWD: ALL`.

{runspec_linux_root-0.1.0 → runspec_linux_root-0.1.1}/README.md

@@ -44,9 +44,11 @@ otherwise, naming the account to `sudo -u` to.
 which never prompts for a password, so the admin needs a passwordless sudo rule.
 `enable-passwordless-sudo` installs one:
 
-- `--scope scoped` allows only this venv's tools, run directly
-  (`sudo /opt/venvs/admin/bin/<tool>` from a shell or cron). It does **not**
-  cover the console or the gateway, which pass variables to the tool through a
-  `sh` prelude so that secrets never go on a command line; sudo then sees `sh`,
-  not the tool.
-- `--scope all` grants `NOPASSWD: ALL`, which the console and the gateway need.
+- `--scope scoped` allows only the programs in this venv's `bin/`. That covers
+  direct runs (`sudo /opt/venvs/admin/bin/<tool>` from a shell or cron) and,
+  with runspec-console / runspec-mcp built on runspec ≥ 0.70.0, console and
+  gateway runs too. Those pass variables to the tool on stdin through a small
+  prelude that runs on the venv's own `bin/python`, which the scoped rule covers.
+  (Before runspec 0.70.0 the prelude ran on `sh`, which the scoped rule doesn't
+  cover, so console runs that carried variables needed `--scope all`.)
+- `--scope all` grants `NOPASSWD: ALL`.

{runspec_linux_root-0.1.0 → runspec_linux_root-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux-root"
-version = "0.1.0"
+version = "0.1.1"
 requires-python = ">=3.10"
 description = "Linux admin runnables that need root (packages, reboot, sysctl) for runspec"
 readme = "README.md"

{runspec_linux_root-0.1.0 → runspec_linux_root-0.1.1}/runspec_linux_root/runspec.toml

@@ -142,4 +142,4 @@ required    = false
 type        = "choice"
 options     = ["scoped", "all"]
 default     = "scoped"
-description = "scoped = NOPASSWD only for this venv's tools, run directly (sudo <venv>/bin/<tool> from a shell or cron); all = NOPASSWD: ALL (also needed for runs from runspec-console or the MCP gateway)"
+description = "scoped = NOPASSWD only for the programs in this venv's bin/ (direct runs, and runspec-console / MCP gateway runs built on runspec >= 0.70.0); all = NOPASSWD: ALL"