Skip to content

Releases: shunnag/llm-apt-autoupgrade

Release list

aptai 0.1.0

aptai 0.1.0 Latest
Latest

Choose a tag to compare

View all tags
@shunnag shunnag released this 20 Aug 08:39
v0.1.0
e257ca0

First release.

apt update → apt full-upgrade → apt autoremove, unattended. When a stage fails, aptai sends the captured output and a redacted host diagnosis to the Claude API (claude-opus-5), gets back a plan built from a closed vocabulary of typed actions — never a shell command — filters it through a local policy, has apt itself simulate every destructive step, executes what survives, and retries. Three rounds, then a page on Slack or Mattermost with the full history.

Targets Ubuntu 24.04 / 26.04 LTS and Debian 13 (trixie). Python standard library only — no pip, no SDK, nothing that has to come through the package manager this tool exists to repair.

Safety

  • The model cannot write a command: its answer is constrained to a JSON schema whose action field is an enum of implemented actions. Every subprocess is a list with shell=False.
  • Package names must match Debian's grammar and resolve to a real package here — because apt's own argument grammar is the trap: apt-get install ufw- removes ufw, and apt-get remove linux-image. expands as a POSIX regex over every kernel.
  • Essential packages, Priority: required packages, the running kernel and a configured protected list can never be removed, purged or auto-marked. If dpkg-query cannot be read at all, every removal is refused.
  • apt is asked before apt is trusted: every destructive operation is simulated with -s first and the plan inspected. An install that resolves into a removal escalates.
  • Machine output is fenced as untrusted data; import_repo_key only accepts a key apt itself reported missing, and disable_apt_source only a host apt itself errored on.

See SECURITY.md for the full model, including what the two default-off options give up.

Install

git clone https://github.com/shunnag/llm-apt-autoupgrade.git
cd llm-apt-autoupgrade
sudo ./scripts/install.sh --enable-timer

Then put ANTHROPIC_API_KEY in /etc/aptai/env and run sudo aptai check.

Start in a VM, with mode = "suggest". This tool executes package operations as root.

238 unit tests, most of them hostile-plan tests for the policy validator. CI covers Python 3.11/3.12/3.13 and installs end to end in ubuntu:24.04 and debian:trixie.

Assets 2
Loading