iructl Updates & Release Notes

A maintenance release that replaces raw stack traces and generic failures with clear, actionable error messages.

Bug fixes

• Connection failures now report Could not connect to <tenant>... instead of a traceback.
• Connectivity checks now time out instead of hanging on an unresponsive host.
• Blueprint assignment failures report the underlying API error detail instead of a generic exception name.
• Unexpected errors print a concise message and exit non-zero instead of dumping a stack trace.
• Running in a non-git directory now points you to git init or --no-git instead of erroring out.
• The unmigrated-kst migration prompt no longer truncates the rename command at narrow widths.
• Dropped a spurious "repository not found" log emitted while locating the repository root.

This release marks the rebrand of kst to iructl (Iru Control) and adds first-class management of Mac Custom Apps, experimental Blueprint assignments, and a new layered configuration system.

New name: kst is now iructl

The tool, its commands, and its packaging have moved from kst to iructl. The command you run is now iructl, and it manages Custom Profiles, Scripts, and Apps via the Iru enterprise API.

If you have an existing kst repository, see Upgrading below for the simple migration path.

Highlights

Manage Mac Custom Apps from the command line

A new iructl app command group brings Mac Custom Apps to parity with Custom Profiles and Mac Custom Scripts:

• Create, pull, push, sync, and show Custom Apps
• Download and upload installer binaries directly (--download, set-file, download)
• Fast, reliable transfers: parallel uploads/downloads, live progress, integrity checks, and automatic retries on transient failures

Get started with iructl app pull --all --download.

Declaratively assign resources to Blueprints (experimental preview)

You can now assign Custom Profiles, Scripts, and Apps to Blueprints directly from your repository using an ensure_blueprints field, reconciled automatically on push and sync. This is an experimental preview — enable it with the --preview flag. Push and sync reports show assignment outcomes.

Layered configuration

Settings now resolve predictably from highest to lowest precedence: command line flags, environment variables, a per-repo .iructl config file, and a user-level config. New and updated options include:

• --repo promoted to the top level (works across all commands)
• --info-format to choose YAML, plist, or JSON metadata
• --reformat to rewrite local metadata into the chosen format on pull/sync
• --payload-dir to control where resources are written
• --debug for verbose logging
• --no-git to run without any git interaction

Improvements

• Clearer authentication errors: 401 responses now show a plain, actionable message
• API validation errors are surfaced directly in push and pull output instead of failing silently
• More resilient sync: invalid or malformed remote items are skipped rather than aborting the whole run, and a single bad item no longer fails the batch
• Python 3.14 support

Upgrading

Install with one of:

brew tap kandji-inc/iructl https://github.com/kandji-inc/iructl.git
brew install iructl
# or
uv tool install iructl
# or
pipx install iructl

Migrating an existing kst repository:

• Rename the repo marker file: mv .kst .iructl (iructl prints this command automatically if you run it in an unmigrated repo)
• Update environment variables: KST_TENANT -> IRUCTL_TENANT, KST_TOKEN -> IRUCTL_TOKEN

Full documentation lives in the iructl wiki.