LocalSetup 4.57.0

LocalSetup 4.57.0

LocalSetup 4.57.0 makes managed sudo credentials explicit, keeps uncertain operations safe to reconcile, preserves adapter content during package renames, and improves container installation diagnostics.

Highlights

• Use one explicit sudo credential: managed sudo resolves GENERIC_SUDO_KEY from the controller environment, then EnvMan only when the variable is absent. An explicit empty or invalid environment value remains authoritative, and workload processes do not inherit sudo credential variables.
• Reconcile long operations safely: sudo authentication has a separate bounded timeout. Workload observation timeouts leave the operation running; a durable status_handle retrieves its receipt later. Only a result that proves the workload did not start permits the documented manual fallback; unknown outcomes allow read-only status checks and no replay.
• Preserve adapter content during renames: recorded package selections resolve to current package names. An older alias directory is retired only when its marker, recorded owner, path, and content provenance match and no other owner uses it; edited, custom, malformed, or unrecorded content stays in place and is reported for review.
• Diagnose container installs in their selected context: Doctor identifies unwritable LocalSetup state paths, and the container workflow preserves the configured Docker or Podman engine and privilege mode while checking rootless requirements and persistent state.

Compatibility

Managed sudo no longer selects host- or repository-named credential variables. Configure GENERIC_SUDO_KEY in the controller environment or EnvMan; a present environment value takes precedence even when empty or invalid. Credential values remain private, and authentication does not authorize a command.

Use the returned operation ID and status_handle to check a running workload. Its observation timeout does not cancel the workload. Use a manual fallback only when the result includes sudo.manual_fallback and proves that the workload did not start; timeout, owner loss, policy denial, or unknown requires read-only reconciliation without replay.

Existing skill and workflow selectors remain accepted as aliases. Recorded refresh resolves renamed selections to current package locations. Automatic removal of a legacy adapter directory requires matching ownership and content proof; unrecorded or customized content remains in place and can block refresh for review.

Container diagnosis preserves the selected engine, endpoint, and privilege mode. Rootless Docker and rootless Podman are separate modes that require their own validation; a rootful run does not qualify a rootless setup. Detached app-server live-pane qualification remains unavailable, and fixture results do not qualify that integration or every live client.

Update

Use the supported LocalSetup installer or recorded package-refresh workflow to receive the updated commands and package aliases. Review any legacy_package_alias_shadow diagnosis before changing custom or unrecorded adapter content.

For managed sudo, configure GENERIC_SUDO_KEY in the controller environment or EnvMan. Follow the run receipt's exact manual-fallback instruction only when it explicitly confirms that the workload did not start; otherwise continue with status reconciliation.

For container installations, keep the selected LocalSetup state writable and persistent where needed. Use the existing Docker or Podman engine and privilege mode, and follow the container diagnostics for the specific engine and endpoint.

Verification

The exact source commit passed the full suite: 4,558 passed and 2 skipped. Actual container install and recreation checks passed with rootful Docker, rootless Docker, and rootless Podman in symlink and portable modes, including repeated updates, ownership checks, filesystem verification, and doctor.

Fixture tests cover managed-pane ownership, credential handling, timeouts, durable status, unknown outcomes, and alias preservation. Detached app-server live-pane qualification remains unavailable; these results do not establish support for that live integration.

Before release publication, download localsetup-v4.57.0.tar.gz, localsetup-v4.57.0.tar.gz.sha256, and localsetup-v4.57.0.tar.gz.cdx.json together. Run uv run --locked python ls/tools/localsetup.py --source-root . verify-release /path/to/localsetup-v4.57.0.tar.gz, then verify the exact signed source and tag, provenance, licenses, and an isolated installation.

Download the archive with its .sha256 checksum and .cdx.json SBOM sidecars, then follow the release guide.