runspec-linux 0.19.0__tar.gz → 0.20.0__tar.gz

{runspec_linux-0.19.0 → runspec_linux-0.20.0}/CHANGELOG.md

@@ -1,5 +1,25 @@
 # runspec-linux Changelog
 
+## [0.20.0] — 2026-10-02
+
+**Venv management moved to runspec-console.** Setting up a venv is a console
+job now: runspec-console 0.312.0 provisions a runspec venv on a host from
+**Settings → Jump Hosts → Provision new venv…** (interpreter, location,
+run-as account, packages, logs inbox), and its **Marketplace** tab installs
+into existing venvs. On the command line, plain `python -m venv`,
+`pip install` and `runspec logs share --inbox` do the same job.
+
+### Removed
+
+- `create-venv`, `install-into-venv`, `configure-pip` and `share-venv-logs`.
+- The `runspec_linux` re-exports of `create_venv`, `install_into_venv` and
+  `configure_pip`. Their helpers are also gone from `runspec-linux-core`
+  0.14.0.
+
+Upgrade `runspec-linux` and `runspec-linux-core` together: runspec-linux
+0.19.0 still imports the removed helpers, so it breaks against
+runspec-linux-core 0.14.0.
+
 ## [0.19.0] — 2026-09-30
 
 **No root in runspec-linux.** Everything here now runs as an unprivileged

{runspec_linux-0.19.0 → runspec_linux-0.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: runspec-linux
-Version: 0.19.0
+Version: 0.20.0
 Summary: Linux system admin runnables for runspec
 Project-URL: Documentation, https://runspec.app/
 Project-URL: Source, https://github.com/jasonfinestone/runspec/tree/main/packages/python/runspec-linux
@@ -20,7 +20,7 @@ Description-Content-Type: text/markdown
 
 # runspec-linux
 
-Linux system-administration runnables (plus Python-venv management, crontab,
+Linux system-administration runnables (plus crontab,
 filesystem, and the cross-platform web/TLS/API probes) for
 [runspec](https://pypi.org/project/runspec/). `pip install` it into a venv and
 the runnables are discoverable by `runspec local`, `runspec serve` (MCP), and
@@ -57,7 +57,6 @@ pip install runspec-linux
 | Sessions | `last-logins`, `who` |
 | Containers | `list-containers`, `container-logs`, `restart-container` |
 | Packages (read-only) | `list-packages`, `list-autoremovable` |
-| Python venvs | `create-venv`, `install-into-venv`, `configure-pip` |
 | TCP | `nc-command` |
 | Commands | `which` |
 | Cron | `cron` (multi-verb: `list`/`add`/`remove`/`clear`) |
@@ -77,14 +76,11 @@ cert-check --url https://internal.example.com
 
 ### Python venvs
 
-`create-venv`, `install-into-venv` and `configure-pip` take a **per-invocation**
-`--run-as <user>` (+ `--become-method sudo|su`) rather than a declarative
-`run_as`, so the service account that owns a shared venv is chosen per call:
-
-```
-create-venv --python /usr/bin/python3.12 --dest /opt/venvs/ops --run-as svc-ops --group ops
-install-into-venv --venv /opt/venvs/ops --package "runspec-linux==0.13.2" --run-as svc-ops
-```
+The venv runnables (`create-venv`, `install-into-venv`, `configure-pip`,
+`share-venv-logs`) were removed in 0.20.0. Provision a venv on a host from
+runspec-console (**Settings → Jump Hosts → Provision new venv…**), install
+packages from its **Marketplace** tab, or on the command line use
+`python -m venv`, `pip install` and `runspec logs share --inbox`.
 
 ## Public Python API
 
@@ -94,7 +90,7 @@ runnables). A corporate wrapper package that only wants a helper should depend
 on the core alone:
 
 ```python
-from runspec_linux_core import nc_send, system_info, install_into_venv
+from runspec_linux_core import nc_send, system_info, which
 ```
 
 The helpers are also re-exported from `runspec_linux` for back-compat. Core

{runspec_linux-0.19.0 → runspec_linux-0.20.0}/README.md

@@ -1,6 +1,6 @@
 # runspec-linux
 
-Linux system-administration runnables (plus Python-venv management, crontab,
+Linux system-administration runnables (plus crontab,
 filesystem, and the cross-platform web/TLS/API probes) for
 [runspec](https://pypi.org/project/runspec/). `pip install` it into a venv and
 the runnables are discoverable by `runspec local`, `runspec serve` (MCP), and
@@ -37,7 +37,6 @@ pip install runspec-linux
 | Sessions | `last-logins`, `who` |
 | Containers | `list-containers`, `container-logs`, `restart-container` |
 | Packages (read-only) | `list-packages`, `list-autoremovable` |
-| Python venvs | `create-venv`, `install-into-venv`, `configure-pip` |
 | TCP | `nc-command` |
 | Commands | `which` |
 | Cron | `cron` (multi-verb: `list`/`add`/`remove`/`clear`) |
@@ -57,14 +56,11 @@ cert-check --url https://internal.example.com
 
 ### Python venvs
 
-`create-venv`, `install-into-venv` and `configure-pip` take a **per-invocation**
-`--run-as <user>` (+ `--become-method sudo|su`) rather than a declarative
-`run_as`, so the service account that owns a shared venv is chosen per call:
-
-```
-create-venv --python /usr/bin/python3.12 --dest /opt/venvs/ops --run-as svc-ops --group ops
-install-into-venv --venv /opt/venvs/ops --package "runspec-linux==0.13.2" --run-as svc-ops
-```
+The venv runnables (`create-venv`, `install-into-venv`, `configure-pip`,
+`share-venv-logs`) were removed in 0.20.0. Provision a venv on a host from
+runspec-console (**Settings → Jump Hosts → Provision new venv…**), install
+packages from its **Marketplace** tab, or on the command line use
+`python -m venv`, `pip install` and `runspec logs share --inbox`.
 
 ## Public Python API
 
@@ -74,7 +70,7 @@ runnables). A corporate wrapper package that only wants a helper should depend
 on the core alone:
 
 ```python
-from runspec_linux_core import nc_send, system_info, install_into_venv
+from runspec_linux_core import nc_send, system_info, which
 ```
 
 The helpers are also re-exported from `runspec_linux` for back-compat. Core

{runspec_linux-0.19.0 → runspec_linux-0.20.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux"
-version = "0.19.0"
+version = "0.20.0"
 requires-python = ">=3.10"
 description = "Linux system admin runnables for runspec"
 readme = "README.md"
@@ -58,10 +58,6 @@ container-logs    = "runspec_linux.containers:main_container_logs"
 restart-container = "runspec_linux.containers:main_restart_container"
 list-packages     = "runspec_linux.packages:main_list_packages"
 list-autoremovable  = "runspec_linux.packages:main_list_autoremovable"
-create-venv       = "runspec_linux.venvs:main_create_venv"
-install-into-venv = "runspec_linux.venvs:main_install_into_venv"
-configure-pip     = "runspec_linux.venvs:main_configure_pip"
-share-venv-logs   = "runspec_linux.venvs:main_share_venv_logs"
 nc-command        = "runspec_linux.nc_command:main"
 which             = "runspec_linux.commands:main_which"
 # Cron / crontab management (backed by runspec-linux-core)

{runspec_linux-0.19.0 → runspec_linux-0.20.0}/runspec_linux/__init__.py

@@ -15,13 +15,10 @@ from runspec_linux_core import (
     check_port,
     check_service,
     clear_cron,
-    configure_pip,
     container_logs,
-    create_venv,
     detect_manager,
     disk_usage,
     find_large_files,
-    install_into_venv,
     journalctl,
     last_logins,
     list_containers,
@@ -49,13 +46,10 @@ __all__ = [
     "check_port",
     "check_service",
     "clear_cron",
-    "configure_pip",
     "container_logs",
-    "create_venv",
     "detect_manager",
     "disk_usage",
     "find_large_files",
-    "install_into_venv",
     "journalctl",
     "last_logins",
     "list_containers",

{runspec_linux-0.19.0 → runspec_linux-0.20.0}/runspec_linux/cron.py

@@ -7,7 +7,7 @@ merged ``[cron]`` tables in the pack's ``runspec.toml``); we unpack each
 helper, which does the crontab read-modify-write.
 
 **Per-invocation ``--run-as``** (a global arg inherited by every verb, like the
-venv runnables): the operator/agent picks whose crontab to manage per call. The
+container runnables): the operator/agent picks whose crontab to manage per call. The
 ``crontab`` command is escalated via ``sudo -n -u <user>`` / ``su`` inside the
 core helper, so "run as user *bob*" means "manage *bob*'s crontab". With no
 ``--run-as`` the caller's own crontab is used.

{runspec_linux-0.19.0 → runspec_linux-0.20.0}/runspec_linux/runspec.toml

@@ -500,242 +500,6 @@ type        = "str"
 description = "Override the search PATH to use (defaults to the host's $PATH)"
 required    = false
 
-# ── Python venvs ──────────────────────────────────────────────────────────────
-
-# These deliberately declare NO `run_as` key. The service account that owns a
-# shared venv is chosen per invocation, so each runnable takes a `run-as`
-# argument and escalates internally (`sudo -n -u <user>`, or `su` via
-# `become-method`). An empty `run-as` runs as the SSH login user (personal venv).
-
-[create-venv]
-serve       = ["local"]
-description = "Create a Python virtualenv (always --symlinks) from a specific interpreter, optionally as a service account, with a logs inbox so every account's runs reach its history"
-autonomy    = "confirm"
-output      = "json"
-
-[create-venv.args.python]
-type        = "path"
-description = "Path to the Python interpreter to build the venv from (browse to a real binary — not the system default)"
-
-[create-venv.args.dest]
-type        = "path"
-short       = "-d"
-description = "Full path of the venv to create (name and location are free)"
-
-[create-venv.args.run-as]
-type        = "str"
-short       = "-u"
-description = "Service account to create the venv as (escalates via sudo/su); empty = the SSH login user"
-required    = false
-
-[create-venv.args.become-method]
-type        = "choice"
-options     = ["sudo", "su"]
-default     = "sudo"
-description = "How to escalate to run-as: sudo (passwordless, -n) or su"
-
-[create-venv.args.group]
-type        = "str"
-short       = "-g"
-description = "Optional shared group to chgrp the venv to (e.g. consoles), so every connected console can read/write"
-required    = false
-
-[create-venv.args.no-inbox]
-type        = "flag"
-description = "Don't set up the logs inbox (logs/inbox, 01777) — keep the pre-inbox layout (logs/ 2775) and write a logs/.no-inbox opt-out marker. Default: the inbox is created, so operators' and root's runs reach this venv's history with no group admin (runspec >= 0.66)"
-default     = false
-
-[create-venv.args.system-site-packages]
-type        = "flag"
-description = "Give the venv access to the system site-packages"
-default     = false
-
-[create-venv.args.upgrade-deps]
-type        = "flag"
-description = "Upgrade pip/setuptools to the latest in the new venv (--upgrade-deps)"
-default     = false
-
-[create-venv.args.clear]
-type        = "flag"
-description = "Delete the contents of the venv directory if it already exists (--clear)"
-default     = false
-
-[create-venv.args.prompt]
-type        = "str"
-short       = "-p"
-description = "Prompt prefix shown when the venv is activated (--prompt)"
-required    = false
-
-[install-into-venv]
-serve       = ["local"]
-description = "pip install named packages and/or a local project (pyproject dir or wheel/sdist) into an existing venv"
-autonomy    = "confirm"
-output      = "json"
-
-[install-into-venv.args.venv]
-type        = "path"
-ui          = "directory"
-short       = "-v"
-description = "Path to the venv to install into (its bundled python runs pip)"
-
-[install-into-venv.args.package]
-type        = "str"
-short       = "-p"
-description = "Package spec(s) to install (space-separated for several)"
-required    = false
-
-[install-into-venv.args.project]
-type        = "path"
-description = "Path to a local project to install — a directory with pyproject.toml, or a wheel/sdist"
-required    = false
-
-[install-into-venv.args.editable]
-type        = "flag"
-short       = "-e"
-description = "Install the project in editable mode (pip install -e); requires --project"
-default     = false
-
-[install-into-venv.args.upgrade]
-type        = "flag"
-short       = "-U"
-description = "Upgrade packages to the newest available version (pip install -U)"
-default     = false
-
-[install-into-venv.args.no-cache-dir]
-type        = "flag"
-description = "Disable the pip cache for this install (--no-cache-dir)"
-default     = false
-
-[install-into-venv.args.force-reinstall]
-type        = "flag"
-description = "Reinstall packages even if already up to date (--force-reinstall)"
-default     = false
-
-[install-into-venv.args.run-as]
-type        = "str"
-short       = "-u"
-description = "Service account that owns the venv (escalates via sudo/su); empty = the SSH login user"
-required    = false
-
-[install-into-venv.args.become-method]
-type        = "choice"
-options     = ["sudo", "su"]
-default     = "sudo"
-description = "How to escalate to run-as: sudo (passwordless, -n) or su"
-
-[configure-pip]
-serve       = ["local"]
-description = "Write a pip.conf (index-url and friends) at user or venv scope for private-PyPI access"
-autonomy    = "confirm"
-output      = "json"
-
-[configure-pip.args.index-url]
-type        = "str"
-short       = "-i"
-description = "Primary package index URL (index-url)"
-
-[configure-pip.args.extra-index-url]
-type        = "str"
-description = "Additional package index URL (extra-index-url)"
-required    = false
-
-[configure-pip.args.trusted-host]
-type        = "str"
-description = "Host to trust without TLS verification (trusted-host)"
-required    = false
-
-[configure-pip.args.cert]
-type        = "str"
-description = "Path to a CA bundle to verify the index's TLS certificate (cert)"
-required    = false
-
-[configure-pip.args.timeout]
-type        = "int"
-description = "Socket timeout in seconds (timeout)"
-required    = false
-
-[configure-pip.args.retries]
-type        = "int"
-description = "Number of retries for a failed connection (retries)"
-required    = false
-
-[configure-pip.args.proxy]
-type        = "str"
-description = "Proxy URL in [user:passwd@]proxy.server:port form (proxy)"
-required    = false
-
-[configure-pip.args.require-virtualenv]
-type        = "flag"
-description = "Refuse to install outside a virtualenv and silence the pip-version check (require-virtualenv + disable-pip-version-check)"
-default     = false
-
-[configure-pip.args.scope]
-type        = "choice"
-options     = ["user", "venv"]
-default     = "user"
-short       = "-s"
-description = "Where to write pip.conf: user (~/.config/pip/pip.conf) or venv (<venv>/pip.conf)"
-
-[configure-pip.args.venv]
-type        = "path"
-ui          = "directory"
-description = "Venv path for --scope venv (the file is written to <venv>/pip.conf)"
-required    = false
-
-[configure-pip.args.run-as]
-type        = "str"
-short       = "-u"
-description = "User who owns the target file (escalates via sudo/su); empty = the SSH login user"
-required    = false
-
-[configure-pip.args.become-method]
-type        = "choice"
-options     = ["sudo", "su"]
-default     = "sudo"
-description = "How to escalate to run-as: sudo (passwordless, -n) or su"
-
-[share-venv-logs]
-serve       = ["local"]
-description = "Make an existing venv's logs shared: set up the logs inbox (logs/inbox, 01777) so every account's runs reach its history — plus, with --group, the 2775 setgid group share. Run as the venv owner (--run-as)"
-autonomy    = "confirm"
-output      = "json"
-
-examples = [
-  {cmd = "share-venv-logs --venv /opt/venvs/app --run-as svc",               description = "Set up the logs inbox as the venv's owner — the recommended setup"},
-  {cmd = "share-venv-logs --venv /opt/venvs/app --no-inbox",                 description = "The pre-inbox group share only: logs/ group-writable + setgid"},
-  {cmd = "share-venv-logs --venv /opt/venvs/app --group consoles",           description = "...and chgrp the logs dir to the shared 'consoles' group"},
-  {cmd = "share-venv-logs --venv /opt/venvs/app --group consoles --run-as svc", description = "Run as the service account that owns the venv (via sudo -n -u)"},
-]
-
-[share-venv-logs.args.venv]
-type        = "path"
-ui          = "directory"
-short       = "-v"
-description = "Path to the existing venv whose logs/ dir should be made shared"
-
-[share-venv-logs.args.group]
-type        = "str"
-short       = "-g"
-description = "Optional shared group to chgrp the logs/ dir to (e.g. consoles), so every connected console can read/write. Omit to keep the current group"
-required    = false
-
-[share-venv-logs.args.no-inbox]
-type        = "flag"
-description = "Skip the logs inbox — only the group share (logs/ 2775 setgid, optional chgrp)"
-default     = false
-
-[share-venv-logs.args.run-as]
-type        = "str"
-short       = "-u"
-description = "Service account that owns the venv (escalates via sudo/su); empty = the SSH login user"
-required    = false
-
-[share-venv-logs.args.become-method]
-type        = "choice"
-options     = ["sudo", "su"]
-default     = "sudo"
-description = "How to escalate to run-as: sudo (passwordless, -n) or su"
-
 # ── Web / TLS probes (runspec-webops-core; cross-platform, read-only) ──────────
 
 [cert-check]

runspec_linux-0.19.0/runspec_linux/venvs.py

@@ -1,108 +0,0 @@
-import json
-import sys
-
-import runspec as rs
-from runspec_linux_core import configure_pip, create_venv, install_into_venv, share_venv_logs
-from runspec_linux_core.errors import CommandError
-
-from runspec_linux._escalation import refuse_root
-
-
-def main_create_venv() -> None:
-    spec = rs.parse("create-venv")
-    refuse_root(spec.run_as.value or None)
-    try:
-        result = create_venv(
-            str(spec.python.value),
-            str(spec.dest.value),
-            run_as=spec.run_as.value or None,
-            become_method=spec.become_method.value,
-            group=spec.group.value or None,
-            system_site_packages=spec.system_site_packages.value,
-            upgrade_deps=spec.upgrade_deps.value,
-            clear=spec.clear.value,
-            prompt=spec.prompt.value or None,
-            inbox=not spec.no_inbox.value,
-        )
-        print(json.dumps(result))
-    except CommandError as e:
-        print(json.dumps({"dest": str(spec.dest.value), "created": False, "error": str(e)}))
-        sys.exit(1)
-    except Exception as e:
-        # Includes ValueError (non-executable interpreter / bad name).
-        print(json.dumps({"error": str(e)}))
-        sys.exit(1)
-
-
-def main_install_into_venv() -> None:
-    spec = rs.parse("install-into-venv")
-    refuse_root(spec.run_as.value or None)
-    try:
-        result = install_into_venv(
-            str(spec.venv.value),
-            spec.package.value or "",
-            project=str(spec.project.value) if spec.project.value else None,
-            editable=spec.editable.value,
-            upgrade=spec.upgrade.value,
-            no_cache_dir=spec.no_cache_dir.value,
-            force_reinstall=spec.force_reinstall.value,
-            run_as=spec.run_as.value or None,
-            become_method=spec.become_method.value,
-        )
-        print(json.dumps(result))
-    except CommandError as e:
-        print(json.dumps({"venv": str(spec.venv.value), "installed": False, "error": str(e)}))
-        sys.exit(1)
-    except Exception as e:
-        # Includes ValueError (bad package name / missing venv / nothing to install).
-        print(json.dumps({"error": str(e)}))
-        sys.exit(1)
-
-
-def main_share_venv_logs() -> None:
-    spec = rs.parse("share-venv-logs")
-    refuse_root(spec.run_as.value or None)
-    try:
-        result = share_venv_logs(
-            str(spec.venv.value),
-            group=spec.group.value or None,
-            run_as=spec.run_as.value or None,
-            become_method=spec.become_method.value,
-            inbox=not spec.no_inbox.value,
-        )
-        print(json.dumps(result))
-    except CommandError as e:
-        print(json.dumps({"venv": str(spec.venv.value), "shared": False, "error": str(e)}))
-        sys.exit(1)
-    except Exception as e:
-        # Includes ValueError (bad venv path / group name).
-        print(json.dumps({"error": str(e)}))
-        sys.exit(1)
-
-
-def main_configure_pip() -> None:
-    spec = rs.parse("configure-pip")
-    refuse_root(spec.run_as.value or None)
-    try:
-        result = configure_pip(
-            spec.index_url.value,
-            extra_index_url=spec.extra_index_url.value or None,
-            trusted_host=spec.trusted_host.value or None,
-            cert=spec.cert.value or None,
-            timeout=spec.timeout.value,
-            retries=spec.retries.value,
-            proxy=spec.proxy.value or None,
-            require_virtualenv=spec.require_virtualenv.value,
-            scope=spec.scope.value,
-            venv=str(spec.venv.value) if spec.venv.value else None,
-            run_as=spec.run_as.value or None,
-            become_method=spec.become_method.value,
-        )
-        print(json.dumps(result))
-    except CommandError as e:
-        print(json.dumps({"configured": False, "error": str(e)}))
-        sys.exit(1)
-    except Exception as e:
-        # Includes ValueError (bad scope / missing venv path).
-        print(json.dumps({"error": str(e)}))
-        sys.exit(1)