runspec-linux 0.16.0__tar.gz → 0.18.0__tar.gz

{runspec_linux-0.16.0 → runspec_linux-0.18.0}/CHANGELOG.md

@@ -1,5 +1,39 @@
 # runspec-linux Changelog
 
+## [0.18.0] — 2026-09-29
+
+### Added
+
+- **`create-venv` sets up the logs inbox** (`logs/inbox`, `01777`, owned by the
+  venv's owner). Operators' and root's runs of the venv's runnables then reach
+  its history with no group admin (runspec >= 0.66). `logs/` is owner-only
+  (`0755`) unless `--group` is given. `--no-inbox` keeps the pre-inbox `2775`
+  layout and writes a `.no-inbox` opt-out marker.
+- **`share-venv-logs` sets up the logs inbox** on an existing venv (run it with
+  `--run-as <owner>`). `--group` still adds the `2775` setgid group share, and
+  `--no-inbox` does only the group share, as before.
+
+### Changed
+
+- **`install-into-venv` keeps `logs/`'s mode** instead of forcing `2775`.
+- Requires `runspec-linux-core >= 0.12.0`.
+
+## [0.17.0] — 2026-09-26
+
+### Added
+
+- **`list-autoremovable`** (autonomous, no root) previews what
+  `autoremove-packages` would remove, so an agent can check the list without an
+  approval prompt. `--purge` previews a purge. Not supported on yum.
+- **`list-packages --reason`** says whether each package was installed by name
+  (`manual`) or as a dependency (`auto`). Autoremove only removes `auto`
+  packages, so this answers "why isn't this old kernel an autoremove
+  candidate?" instead of leaving it to a guess.
+
+### Changed
+
+- Requires `runspec-linux-core >= 0.11.0`.
+
 ## [0.16.0] — 2026-09-26
 
 ### Added

{runspec_linux-0.16.0 → runspec_linux-0.18.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runspec-linux
-Version: 0.16.0
+Version: 0.18.0
 Summary: Linux system admin runnables for runspec
 Project-URL: Documentation, https://runspec.app/
 Project-URL: Source, https://github.com/jasonfinestone/runspec/tree/main/packages/python/runspec-linux
@@ -9,7 +9,7 @@ Project-URL: Issues, https://github.com/jasonfinestone/runspec/issues
 Keywords: linux,ops,runnable,runspec,ssh,sysadmin,venv
 Requires-Python: >=3.10
 Requires-Dist: runspec-fs-core>=0.5.0
-Requires-Dist: runspec-linux-core>=0.10.0
+Requires-Dist: runspec-linux-core>=0.12.0
 Requires-Dist: runspec-webops-core>=0.3.0
 Requires-Dist: runspec>=0.50.1
 Provides-Extra: dev
@@ -51,7 +51,7 @@ pip install runspec-linux
 | Files | `find-large-files`, `backup-files`, `owning-package` |
 | Sessions | `last-logins`, `who` |
 | Containers | `list-containers`, `container-logs`, `restart-container` |
-| Packages | `list-packages`, `list-upgrades`, `upgrade-packages`, `install-package`, `remove-package`, `autoremove-packages` |
+| Packages | `list-packages`, `list-upgrades`, `upgrade-packages`, `install-package`, `remove-package`, `autoremove-packages`, `list-autoremovable` |
 | Power | `reboot-host` |
 | Sudo bootstrap | `enable-passwordless-sudo` |
 | Python venvs | `create-venv`, `install-into-venv`, `configure-pip` |

{runspec_linux-0.16.0 → runspec_linux-0.18.0}/README.md

@@ -31,7 +31,7 @@ pip install runspec-linux
 | Files | `find-large-files`, `backup-files`, `owning-package` |
 | Sessions | `last-logins`, `who` |
 | Containers | `list-containers`, `container-logs`, `restart-container` |
-| Packages | `list-packages`, `list-upgrades`, `upgrade-packages`, `install-package`, `remove-package`, `autoremove-packages` |
+| Packages | `list-packages`, `list-upgrades`, `upgrade-packages`, `install-package`, `remove-package`, `autoremove-packages`, `list-autoremovable` |
 | Power | `reboot-host` |
 | Sudo bootstrap | `enable-passwordless-sudo` |
 | Python venvs | `create-venv`, `install-into-venv`, `configure-pip` |

{runspec_linux-0.16.0 → runspec_linux-0.18.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux"
-version = "0.16.0"
+version = "0.18.0"
 requires-python = ">=3.10"
 description = "Linux system admin runnables for runspec"
 readme = "README.md"
 keywords = ["runspec", "runnable", "linux", "sysadmin", "ops", "ssh", "venv"]
 dependencies = [
     "runspec>=0.50.1",
-    "runspec-linux-core>=0.10.0",
+    "runspec-linux-core>=0.12.0",
     "runspec-webops-core>=0.3.0",
     "runspec-fs-core>=0.5.0",
 ]
@@ -63,6 +63,7 @@ upgrade-packages  = "runspec_linux.packages:main_upgrade_packages"
 install-package   = "runspec_linux.packages:main_install_package"
 remove-package    = "runspec_linux.packages:main_remove_package"
 autoremove-packages = "runspec_linux.packages:main_autoremove_packages"
+list-autoremovable  = "runspec_linux.packages:main_list_autoremovable"
 reboot-host       = "runspec_linux.power:main_reboot_host"
 enable-passwordless-sudo = "runspec_linux.sudoers:main_enable_passwordless_sudo"
 create-venv       = "runspec_linux.venvs:main_create_venv"

{runspec_linux-0.16.0 → runspec_linux-0.18.0}/runspec_linux/packages.py

@@ -5,6 +5,7 @@ import runspec as rs
 from runspec_linux_core import (
     autoremove_packages,
     install_package,
+    list_autoremovable,
     list_packages,
     list_upgrades,
     remove_package,
@@ -18,7 +19,7 @@ def main_list_packages() -> None:
     name_filter = spec.filter.value
     limit = spec.limit.value
     try:
-        print(json.dumps(list_packages(name_filter, limit)))
+        print(json.dumps(list_packages(name_filter, limit, reason=spec.reason.value)))
     except Exception as e:
         # Includes ToolNotFoundError (no package manager) and CommandError.
         print(json.dumps({"error": str(e)}))
@@ -75,6 +76,16 @@ def main_remove_package() -> None:
         sys.exit(1)
 
 
+def main_list_autoremovable() -> None:
+    spec = rs.parse("list-autoremovable")
+    try:
+        print(json.dumps(list_autoremovable(purge=spec.purge.value)))
+    except Exception as e:
+        # Includes CommandError (yum, failed listing) and ToolNotFoundError.
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
 def main_autoremove_packages() -> None:
     spec = rs.parse("autoremove-packages")
     try:

{runspec_linux-0.16.0 → runspec_linux-0.18.0}/runspec_linux/runspec.toml

@@ -483,6 +483,11 @@ short       = "-n"
 description = "Maximum number of packages to return (sorted by name)"
 default     = 100
 
+[list-packages.args.reason]
+type        = "flag"
+description = "Also say whether each package was installed by name (manual) or as a dependency (auto) — autoremove only ever removes auto packages"
+default     = false
+
 [list-upgrades]
 serve       = ["local"]
 description = "List packages with an available upgrade (refreshes the package index first)"
@@ -531,6 +536,17 @@ type        = "flag"
 description = "Also delete the packages' configuration files (apt purge / pacman -Rn; a plain remove on dnf/yum/zypper)"
 default     = false
 
+[list-autoremovable]
+serve       = ["local"]
+description = "List the packages autoremove-packages would remove (read-only preview; not supported on yum)"
+autonomy    = "autonomous"
+output      = "json"
+
+[list-autoremovable.args.purge]
+type        = "flag"
+description = "Preview a purge (apt shows config files would go too)"
+default     = false
+
 [autoremove-packages]
 serve       = ["local"]
 description = "Remove packages nothing depends on any more, e.g. old kernels (apt autoremove and equivalents; needs root)"
@@ -545,7 +561,7 @@ default     = false
 
 [autoremove-packages.args.dry-run]
 type        = "flag"
-description = "Only list what would be removed; remove nothing (not supported on yum)"
+description = "Only list what would be removed; remove nothing (not supported on yum). list-autoremovable does the same without needing approval"
 default     = false
 
 # ── Power ─────────────────────────────────────────────────────────────────────
@@ -664,7 +680,7 @@ required    = false
 
 [create-venv]
 serve       = ["local"]
-description = "Create a Python virtualenv (always --symlinks) from a specific interpreter, optionally as a service account, with a shared 2775 logs/ dir"
+description = "Create a Python virtualenv (always --symlinks) from a specific interpreter, optionally as a service account, with a logs inbox so every account's runs reach its history"
 autonomy    = "confirm"
 output      = "json"
 
@@ -695,6 +711,11 @@ short       = "-g"
 description = "Optional shared group to chgrp the venv to (e.g. consoles), so every connected console can read/write"
 required    = false
 
+[create-venv.args.no-inbox]
+type        = "flag"
+description = "Don't set up the logs inbox (logs/inbox, 01777) — keep the pre-inbox layout (logs/ 2775) and write a logs/.no-inbox opt-out marker. Default: the inbox is created, so operators' and root's runs reach this venv's history with no group admin (runspec >= 0.66)"
+default     = false
+
 [create-venv.args.system-site-packages]
 type        = "flag"
 description = "Give the venv access to the system site-packages"
@@ -846,12 +867,13 @@ description = "How to escalate to run-as: sudo (passwordless, -n) or su"
 
 [share-venv-logs]
 serve       = ["local"]
-description = "Make an existing venv's logs/ dir shared (2775 + setgid, optional chgrp) so the per-venv runs DB and audit logs are writable across a console group — the repair for a venv not built with create-venv --group"
+description = "Make an existing venv's logs shared: set up the logs inbox (logs/inbox, 01777) so every account's runs reach its history — plus, with --group, the 2775 setgid group share. Run as the venv owner (--run-as)"
 autonomy    = "confirm"
 output      = "json"
 
 examples = [
-  {cmd = "share-venv-logs --venv /opt/venvs/app",                            description = "Make /opt/venvs/app/logs group-writable + setgid (keeps its current group)"},
+  {cmd = "share-venv-logs --venv /opt/venvs/app --run-as svc",               description = "Set up the logs inbox as the venv's owner — the recommended setup"},
+  {cmd = "share-venv-logs --venv /opt/venvs/app --no-inbox",                 description = "The pre-inbox group share only: logs/ group-writable + setgid"},
   {cmd = "share-venv-logs --venv /opt/venvs/app --group consoles",           description = "...and chgrp the logs dir to the shared 'consoles' group"},
   {cmd = "share-venv-logs --venv /opt/venvs/app --group consoles --run-as svc", description = "Run as the service account that owns the venv (via sudo -n -u)"},
 ]
@@ -868,6 +890,11 @@ short       = "-g"
 description = "Optional shared group to chgrp the logs/ dir to (e.g. consoles), so every connected console can read/write. Omit to keep the current group"
 required    = false
 
+[share-venv-logs.args.no-inbox]
+type        = "flag"
+description = "Skip the logs inbox — only the group share (logs/ 2775 setgid, optional chgrp)"
+default     = false
+
 [share-venv-logs.args.run-as]
 type        = "str"
 short       = "-u"

{runspec_linux-0.16.0 → runspec_linux-0.18.0}/runspec_linux/venvs.py

@@ -19,6 +19,7 @@ def main_create_venv() -> None:
             upgrade_deps=spec.upgrade_deps.value,
             clear=spec.clear.value,
             prompt=spec.prompt.value or None,
+            inbox=not spec.no_inbox.value,
         )
         print(json.dumps(result))
     except CommandError as e:
@@ -62,6 +63,7 @@ def main_share_venv_logs() -> None:
             group=spec.group.value or None,
             run_as=spec.run_as.value or None,
             become_method=spec.become_method.value,
+            inbox=not spec.no_inbox.value,
         )
         print(json.dumps(result))
     except CommandError as e: