runspec-linux 0.13.2__tar.gz → 0.14.0__tar.gz

{runspec_linux-0.13.2 → runspec_linux-0.14.0}/CHANGELOG.md

@@ -1,5 +1,31 @@
 # runspec-linux Changelog
 
+## [0.14.0] — 2026-09-25
+
+### Added
+
+- **`share-venv-logs` — make an existing venv's `logs/` dir shared.** The repair
+  path for a venv that wasn't created with `create-venv --group` (hand-made or
+  legacy): sets `<venv>/logs` to `2775` (setgid + group-writable) and, with
+  `--group`, `chgrp`s the `logs/` dir, so the per-venv runs index
+  (`runspec_runs.db`, `runspec` 0.57.0) and the audit-log files are writable by
+  every console / service account in a shared group. Takes the same per-invocation
+  `--run-as` / `--become-method` escalation as the other venv runnables (empty =
+  the SSH login user), `autonomy = "confirm"`. Thin wrapper over the new
+  `runspec_linux_core.share_venv_logs`; core pin bumped to `>=0.7.0`.
+  (`create-venv --group` already sets this up at build time — this brings a
+  pre-existing venv up to the same state without recreating it.)
+
+## [0.13.3] — 2026-09-20
+
+### Changed
+
+- **Packaging metadata for the runspec-console Marketplace.** Add a README
+  (rendered in the Marketplace card's Details view) and publish `keywords`
+  and Documentation / Source / Changelog / Issues project URLs, so the
+  package's Marketplace card shows a description, tags and links. No
+  runnable, argument, or behaviour changes.
+
 ## [0.13.2] — 2026-09-17
 
 ### Fixed

runspec_linux-0.14.0/PKG-INFO

@@ -0,0 +1,108 @@
+Metadata-Version: 2.5
+Name: runspec-linux
+Version: 0.14.0
+Summary: Linux system admin runnables for runspec
+Project-URL: Documentation, https://runspec.app/
+Project-URL: Source, https://github.com/jasonfinestone/runspec/tree/main/packages/python/runspec-linux
+Project-URL: Changelog, https://github.com/jasonfinestone/runspec/blob/main/packages/python/runspec-linux/CHANGELOG.md
+Project-URL: Issues, https://github.com/jasonfinestone/runspec/issues
+Keywords: linux,ops,runnable,runspec,ssh,sysadmin,venv
+Requires-Python: >=3.10
+Requires-Dist: runspec-fs-core>=0.3.0
+Requires-Dist: runspec-linux-core>=0.7.0
+Requires-Dist: runspec-webops-core>=0.3.0
+Requires-Dist: runspec>=0.50.1
+Provides-Extra: dev
+Requires-Dist: mypy; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# runspec-linux
+
+Linux system-administration runnables (plus Python-venv management, crontab,
+filesystem, and the cross-platform web/TLS/API probes) for
+[runspec](https://pypi.org/project/runspec/). `pip install` it into a venv and
+the runnables are discoverable by `runspec local`, `runspec serve` (MCP), and
+runspec-console.
+
+All runnables emit JSON on stdout. Read-only runnables are `autonomy =
+"autonomous"`; state-changing ones are `autonomy = "confirm"`. The privileged
+runnables declare `run_as = "root"`, so runspec-console escalates them via
+`sudo` — run `enable-passwordless-sudo` once to install a `visudo`-validated
+`/etc/sudoers.d` drop-in so they run without a password prompt.
+
+## Install
+
+```
+pip install runspec-linux
+```
+
+## Runnables
+
+| Group | Runnables |
+|---|---|
+| System | `system-info`, `disk-usage`, `check-memory`, `cpu-info`, `pressure` |
+| Processes | `list-processes` |
+| Services | `list-services`, `check-service`, `restart-service`, `service-detail`, `failed-units` |
+| Logs | `tail-log`, `search-log`, `journalctl` |
+| Network | `ping-host`, `check-port`, `show-connections`, `trace-route`, `route-table`, `socket-stats`, `dns-config`, `open-ports` |
+| Kernel params | `get-sysctl`, `set-sysctl` |
+| Files | `find-large-files`, `backup-files`, `owning-package` |
+| Sessions | `last-logins`, `who` |
+| Containers | `list-containers`, `container-logs`, `restart-container` |
+| Packages | `list-packages`, `list-upgrades`, `upgrade-packages`, `install-package`, `remove-package` |
+| Power | `reboot-host` |
+| Sudo bootstrap | `enable-passwordless-sudo` |
+| Python venvs | `create-venv`, `install-into-venv`, `configure-pip` |
+| TCP | `nc-command` |
+| Commands | `which` |
+| Cron | `cron` (multi-verb: `list`/`add`/`remove`/`clear`) |
+| Filesystem | `filesystem` (multi-verb, backed by `runspec-fs-core`) |
+| Web / TLS / API | `cert-check`, `cert-chain`, `tls-info`, `http-check`, `http-headers`, `redirect-trace`, `dns-lookup`, `api-spec` |
+
+The package-management runnables auto-detect apt / dnf / yum / zypper / pacman.
+The web/TLS/API probes are pure HTTP (shared with `runspec-windows` via
+`runspec-webops-core`) and run anywhere.
+
+```
+system-info
+list-upgrades
+check-port --host db-01 --port 5432
+cert-check --url https://internal.example.com
+```
+
+### Python venvs
+
+`create-venv`, `install-into-venv` and `configure-pip` take a **per-invocation**
+`--run-as <user>` (+ `--become-method sudo|su`) rather than a declarative
+`run_as`, so the service account that owns a shared venv is chosen per call:
+
+```
+create-venv --python /usr/bin/python3.12 --dest /opt/venvs/ops --run-as svc-ops --group ops
+install-into-venv --venv /opt/venvs/ops --package "runspec-linux==0.13.2" --run-as svc-ops
+```
+
+## Public Python API
+
+The pure logic lives in **[`runspec-linux-core`](../runspec-linux-core)** — no
+`runspec` dependency, no `runspec.toml`, no entry points (so it surfaces no
+runnables). A corporate wrapper package that only wants a helper should depend
+on the core alone:
+
+```python
+from runspec_linux_core import nc_send, system_info, install_into_venv
+```
+
+The helpers are also re-exported from `runspec_linux` for back-compat. Core
+helpers return plain data and raise (`ToolNotFoundError` / `CommandError`) on
+failure; the runnable wrappers catch these to render the CLI/agent behaviour.
+
+## Development
+
+```
+python -m venv .venv && . .venv/bin/activate
+pip install -e ".[dev]"
+ruff check . && ruff format --check .
+pytest
+```

runspec_linux-0.14.0/README.md

@@ -0,0 +1,88 @@
+# runspec-linux
+
+Linux system-administration runnables (plus Python-venv management, crontab,
+filesystem, and the cross-platform web/TLS/API probes) for
+[runspec](https://pypi.org/project/runspec/). `pip install` it into a venv and
+the runnables are discoverable by `runspec local`, `runspec serve` (MCP), and
+runspec-console.
+
+All runnables emit JSON on stdout. Read-only runnables are `autonomy =
+"autonomous"`; state-changing ones are `autonomy = "confirm"`. The privileged
+runnables declare `run_as = "root"`, so runspec-console escalates them via
+`sudo` — run `enable-passwordless-sudo` once to install a `visudo`-validated
+`/etc/sudoers.d` drop-in so they run without a password prompt.
+
+## Install
+
+```
+pip install runspec-linux
+```
+
+## Runnables
+
+| Group | Runnables |
+|---|---|
+| System | `system-info`, `disk-usage`, `check-memory`, `cpu-info`, `pressure` |
+| Processes | `list-processes` |
+| Services | `list-services`, `check-service`, `restart-service`, `service-detail`, `failed-units` |
+| Logs | `tail-log`, `search-log`, `journalctl` |
+| Network | `ping-host`, `check-port`, `show-connections`, `trace-route`, `route-table`, `socket-stats`, `dns-config`, `open-ports` |
+| Kernel params | `get-sysctl`, `set-sysctl` |
+| Files | `find-large-files`, `backup-files`, `owning-package` |
+| Sessions | `last-logins`, `who` |
+| Containers | `list-containers`, `container-logs`, `restart-container` |
+| Packages | `list-packages`, `list-upgrades`, `upgrade-packages`, `install-package`, `remove-package` |
+| Power | `reboot-host` |
+| Sudo bootstrap | `enable-passwordless-sudo` |
+| Python venvs | `create-venv`, `install-into-venv`, `configure-pip` |
+| TCP | `nc-command` |
+| Commands | `which` |
+| Cron | `cron` (multi-verb: `list`/`add`/`remove`/`clear`) |
+| Filesystem | `filesystem` (multi-verb, backed by `runspec-fs-core`) |
+| Web / TLS / API | `cert-check`, `cert-chain`, `tls-info`, `http-check`, `http-headers`, `redirect-trace`, `dns-lookup`, `api-spec` |
+
+The package-management runnables auto-detect apt / dnf / yum / zypper / pacman.
+The web/TLS/API probes are pure HTTP (shared with `runspec-windows` via
+`runspec-webops-core`) and run anywhere.
+
+```
+system-info
+list-upgrades
+check-port --host db-01 --port 5432
+cert-check --url https://internal.example.com
+```
+
+### Python venvs
+
+`create-venv`, `install-into-venv` and `configure-pip` take a **per-invocation**
+`--run-as <user>` (+ `--become-method sudo|su`) rather than a declarative
+`run_as`, so the service account that owns a shared venv is chosen per call:
+
+```
+create-venv --python /usr/bin/python3.12 --dest /opt/venvs/ops --run-as svc-ops --group ops
+install-into-venv --venv /opt/venvs/ops --package "runspec-linux==0.13.2" --run-as svc-ops
+```
+
+## Public Python API
+
+The pure logic lives in **[`runspec-linux-core`](../runspec-linux-core)** — no
+`runspec` dependency, no `runspec.toml`, no entry points (so it surfaces no
+runnables). A corporate wrapper package that only wants a helper should depend
+on the core alone:
+
+```python
+from runspec_linux_core import nc_send, system_info, install_into_venv
+```
+
+The helpers are also re-exported from `runspec_linux` for back-compat. Core
+helpers return plain data and raise (`ToolNotFoundError` / `CommandError`) on
+failure; the runnable wrappers catch these to render the CLI/agent behaviour.
+
+## Development
+
+```
+python -m venv .venv && . .venv/bin/activate
+pip install -e ".[dev]"
+ruff check . && ruff format --check .
+pytest
+```

{runspec_linux-0.13.2 → runspec_linux-0.14.0}/pyproject.toml

@@ -4,16 +4,24 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux"
-version = "0.13.2"
+version = "0.14.0"
 requires-python = ">=3.10"
 description = "Linux system admin runnables for runspec"
+readme = "README.md"
+keywords = ["runspec", "runnable", "linux", "sysadmin", "ops", "ssh", "venv"]
 dependencies = [
     "runspec>=0.50.1",
-    "runspec-linux-core>=0.6.2",
+    "runspec-linux-core>=0.7.0",
     "runspec-webops-core>=0.3.0",
     "runspec-fs-core>=0.3.0",
 ]
 
+[project.urls]
+Documentation = "https://runspec.app/"
+Source        = "https://github.com/jasonfinestone/runspec/tree/main/packages/python/runspec-linux"
+Changelog     = "https://github.com/jasonfinestone/runspec/blob/main/packages/python/runspec-linux/CHANGELOG.md"
+Issues        = "https://github.com/jasonfinestone/runspec/issues"
+
 [project.scripts]
 system-info       = "runspec_linux.system_info:main_system_info"
 disk-usage        = "runspec_linux.system_info:main_disk_usage"
@@ -57,6 +65,7 @@ enable-passwordless-sudo = "runspec_linux.sudoers:main_enable_passwordless_sudo"
 create-venv       = "runspec_linux.venvs:main_create_venv"
 install-into-venv = "runspec_linux.venvs:main_install_into_venv"
 configure-pip     = "runspec_linux.venvs:main_configure_pip"
+share-venv-logs   = "runspec_linux.venvs:main_share_venv_logs"
 nc-command        = "runspec_linux.nc_command:main"
 which             = "runspec_linux.commands:main_which"
 # Cron / crontab management (backed by runspec-linux-core)

{runspec_linux-0.13.2 → runspec_linux-0.14.0}/runspec_linux/runspec.toml

@@ -805,6 +805,42 @@ options     = ["sudo", "su"]
 default     = "sudo"
 description = "How to escalate to run-as: sudo (passwordless, -n) or su"
 
+[share-venv-logs]
+serve       = ["local"]
+description = "Make an existing venv's logs/ dir shared (2775 + setgid, optional chgrp) so the per-venv runs DB and audit logs are writable across a console group — the repair for a venv not built with create-venv --group"
+autonomy    = "confirm"
+output      = "json"
+
+examples = [
+  {cmd = "share-venv-logs --venv /opt/venvs/app",                            description = "Make /opt/venvs/app/logs group-writable + setgid (keeps its current group)"},
+  {cmd = "share-venv-logs --venv /opt/venvs/app --group consoles",           description = "...and chgrp the logs dir to the shared 'consoles' group"},
+  {cmd = "share-venv-logs --venv /opt/venvs/app --group consoles --run-as svc", description = "Run as the service account that owns the venv (via sudo -n -u)"},
+]
+
+[share-venv-logs.args.venv]
+type        = "path"
+ui          = "directory"
+short       = "-v"
+description = "Path to the existing venv whose logs/ dir should be made shared"
+
+[share-venv-logs.args.group]
+type        = "str"
+short       = "-g"
+description = "Optional shared group to chgrp the logs/ dir to (e.g. consoles), so every connected console can read/write. Omit to keep the current group"
+required    = false
+
+[share-venv-logs.args.run-as]
+type        = "str"
+short       = "-u"
+description = "Service account that owns the venv (escalates via sudo/su); empty = the SSH login user"
+required    = false
+
+[share-venv-logs.args.become-method]
+type        = "choice"
+options     = ["sudo", "su"]
+default     = "sudo"
+description = "How to escalate to run-as: sudo (passwordless, -n) or su"
+
 # ── Web / TLS probes (runspec-webops-core; cross-platform, read-only) ──────────
 
 [cert-check]

{runspec_linux-0.13.2 → runspec_linux-0.14.0}/runspec_linux/venvs.py

@@ -2,7 +2,7 @@ import json
 import sys
 
 import runspec as rs
-from runspec_linux_core import configure_pip, create_venv, install_into_venv
+from runspec_linux_core import configure_pip, create_venv, install_into_venv, share_venv_logs
 from runspec_linux_core.errors import CommandError
 
 
@@ -54,6 +54,25 @@ def main_install_into_venv() -> None:
         sys.exit(1)
 
 
+def main_share_venv_logs() -> None:
+    spec = rs.parse("share-venv-logs")
+    try:
+        result = share_venv_logs(
+            str(spec.venv.value),
+            group=spec.group.value or None,
+            run_as=spec.run_as.value or None,
+            become_method=spec.become_method.value,
+        )
+        print(json.dumps(result))
+    except CommandError as e:
+        print(json.dumps({"venv": str(spec.venv.value), "shared": False, "error": str(e)}))
+        sys.exit(1)
+    except Exception as e:
+        # Includes ValueError (bad venv path / group name).
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
 def main_configure_pip() -> None:
     spec = rs.parse("configure-pip")
     try:

runspec_linux-0.13.2/PKG-INFO

@@ -1,13 +0,0 @@
-Metadata-Version: 2.5
-Name: runspec-linux
-Version: 0.13.2
-Summary: Linux system admin runnables for runspec
-Requires-Python: >=3.10
-Requires-Dist: runspec-fs-core>=0.3.0
-Requires-Dist: runspec-linux-core>=0.6.2
-Requires-Dist: runspec-webops-core>=0.3.0
-Requires-Dist: runspec>=0.50.1
-Provides-Extra: dev
-Requires-Dist: mypy; extra == 'dev'
-Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: ruff==0.15.20; extra == 'dev'