sase-github 0.1.5__tar.gz → 0.2.0__tar.gz

{sase_github-0.1.5 → sase_github-0.2.0}/.github/workflows/ci.yml

@@ -10,8 +10,10 @@ permissions:
   contents: read
 
 env:
-  SASE_CORE_REF: master
-  SASE_CORE_PATH: .ci/sase
+  SASE_PYTHON_REF: master
+  SASE_PYTHON_PATH: .ci/sase
+  SASE_RUST_CORE_REF: master
+  SASE_RUST_CORE_PATH: .ci/sase-core
 
 jobs:
   lint:
@@ -22,15 +24,24 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: sase-org/sase
-          ref: ${{ env.SASE_CORE_REF }}
-          path: ${{ env.SASE_CORE_PATH }}
+          ref: ${{ env.SASE_PYTHON_REF }}
+          path: ${{ env.SASE_PYTHON_PATH }}
+      - name: Check out SASE Rust core
+        uses: actions/checkout@v4
+        with:
+          repository: sase-org/sase-core
+          ref: ${{ env.SASE_RUST_CORE_REF }}
+          path: ${{ env.SASE_RUST_CORE_PATH }}
       - uses: astral-sh/setup-uv@v4
         with:
           enable-cache: true
           cache-dependency-glob: "**/pyproject.toml"
       - uses: extractions/setup-just@v2
+      - uses: dtolnay/rust-toolchain@stable
       - name: Set up Python
-        run: uv python install 3.12
+        run: |
+          uv python install 3.12
+          uv venv --python 3.12 .venv
       - name: Install dependencies
         run: just install
       - name: Lint
@@ -47,15 +58,24 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: sase-org/sase
-          ref: ${{ env.SASE_CORE_REF }}
-          path: ${{ env.SASE_CORE_PATH }}
+          ref: ${{ env.SASE_PYTHON_REF }}
+          path: ${{ env.SASE_PYTHON_PATH }}
+      - name: Check out SASE Rust core
+        uses: actions/checkout@v4
+        with:
+          repository: sase-org/sase-core
+          ref: ${{ env.SASE_RUST_CORE_REF }}
+          path: ${{ env.SASE_RUST_CORE_PATH }}
       - uses: astral-sh/setup-uv@v4
         with:
           enable-cache: true
           cache-dependency-glob: "**/pyproject.toml"
       - uses: extractions/setup-just@v2
+      - uses: dtolnay/rust-toolchain@stable
       - name: Set up Python ${{ matrix.python-version }}
-        run: uv python install ${{ matrix.python-version }}
+        run: |
+          uv python install ${{ matrix.python-version }}
+          uv venv --python ${{ matrix.python-version }} .venv
       - name: Install dependencies
         run: just install
       - name: Run tests

{sase_github-0.1.5 → sase_github-0.2.0}/.github/workflows/publish.yml

@@ -12,8 +12,10 @@ on:
         default: false
 
 env:
-  SASE_CORE_REF: master
-  SASE_CORE_PATH: .ci/sase
+  SASE_PYTHON_REF: master
+  SASE_PYTHON_PATH: .ci/sase
+  SASE_RUST_CORE_REF: master
+  SASE_RUST_CORE_PATH: .ci/sase-core
 
 jobs:
   release:
@@ -60,6 +62,7 @@ jobs:
     permissions:
       contents: read
     steps:
+      - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
         with:
           name: dist
@@ -68,16 +71,25 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: sase-org/sase
-          ref: ${{ env.SASE_CORE_REF }}
-          path: ${{ env.SASE_CORE_PATH }}
+          ref: ${{ env.SASE_PYTHON_REF }}
+          path: ${{ env.SASE_PYTHON_PATH }}
+      - name: Check out SASE Rust core
+        uses: actions/checkout@v4
+        with:
+          repository: sase-org/sase-core
+          ref: ${{ env.SASE_RUST_CORE_REF }}
+          path: ${{ env.SASE_RUST_CORE_PATH }}
       - uses: astral-sh/setup-uv@v4
+      - uses: extractions/setup-just@v2
+      - uses: dtolnay/rust-toolchain@stable
       - name: Set up Python
         run: uv python install 3.12
       - name: Install built sase-github wheel into a fresh venv
         run: |
           uv venv --python 3.12 /tmp/smoke-venv
-          uv pip install --python /tmp/smoke-venv/bin/python "${SASE_CORE_PATH}"
-          uv pip install --python /tmp/smoke-venv/bin/python dist/*.whl
+          printf -- '-e %s\n' "$(realpath "${SASE_PYTHON_PATH}")" > /tmp/sase-overrides.txt
+          uv pip install --python /tmp/smoke-venv/bin/python --overrides /tmp/sase-overrides.txt dist/*.whl
+          just install-source-sase /tmp/smoke-venv/bin/python
       - name: Smoke check
         run: |
           /tmp/smoke-venv/bin/python - <<'PY'

sase_github-0.2.0/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.2.0"
+}

{sase_github-0.1.5 → sase_github-0.2.0}/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+## [0.2.0](https://github.com/sase-org/sase-github/compare/v0.1.7...v0.2.0) (2026-07-16)
+
+
+### ⚠ BREAKING CHANGES
+
+* **sdd:** GitHub workspace-provider integrations must use ws_preflight_sdd_sidecar and the sdd_sidecar_suffix/sidecar_suffix options.
+* **sdd:** GitHub workspaces no longer fall back to local SDD storage; companion repository materialization must succeed before workspace claim.
+* GitHub SDD discovery no longer falls back to <owner>/sdd by default. Set sdd.repo.name to sdd or owner/sdd to keep using an org-level companion repository.
+
+### Features
+
+* add GitHub issue provider operations (sase-69.4) ([2b7bb90](https://github.com/sase-org/sase-github/commit/2b7bb90e1a0d6c70d835e4082a83fab6651ae146))
+* add GitHub ref namespace completion (sase-5i.2) ([f318dbf](https://github.com/sase-org/sase-github/commit/f318dbfc7a04c7e8ed4411265c09481f2219aa35))
+* add GitHub repo completion provider (sase-5h.2) ([bf28a38](https://github.com/sase-org/sase-github/commit/bf28a381db470b7d293f4ef4d046d0fac9f54238))
+* add GitHub SDD companion repo creation (sase-5j.4) ([bd4c37a](https://github.com/sase-org/sase-github/commit/bd4c37a0755f0db7f6ec84913f322ab688138326))
+* clone external GitHub repositories (sase-5y.2) ([b2e3a1a](https://github.com/sase-org/sase-github/commit/b2e3a1aae685c46aaf90b8b21bf6b1a712f775a2))
+* create project-specific SDD companion repos ([1dff94c](https://github.com/sase-org/sase-github/commit/1dff94cad5142e6b4d62cc72fea805fbd7fecad3))
+* create public SDD companions with labels ([975fbd3](https://github.com/sase-org/sase-github/commit/975fbd3176171de30ab44bc74bee7daa0ee66ed0))
+* drop org-level SDD fallback discovery ([c76814d](https://github.com/sase-org/sase-github/commit/c76814d595bad186a484bbc0124fac8967491b1a))
+* materialize GitHub SDD companion repos (sase-5j.3) ([4245691](https://github.com/sase-org/sase-github/commit/4245691e7551e75c0fbf09c29cfc7ae6f1506622))
+* prefer owner sdd companion repos ([b5d31b1](https://github.com/sase-org/sase-github/commit/b5d31b1ef0eab4526783b71e242661bbe8ca222f))
+* **sdd:** adopt sidecar terminology for SDD repositories (sase-5w.2) ([35fa968](https://github.com/sase-org/sase-github/commit/35fa968d585c0dd476aead6bb71b1276be85597d))
+* **sdd:** enforce companion creation authorization ([69551b7](https://github.com/sase-org/sase-github/commit/69551b799fab83090d6680e653448efe190ec549))
+* **sdd:** require companion repository storage ([5a2eb57](https://github.com/sase-org/sase-github/commit/5a2eb57bc044dd9945d54d52c7fa6eb0cf7e5dd9))
+* support split SDD companion repositories (sase-5q.4) ([eb68a32](https://github.com/sase-org/sase-github/commit/eb68a327ad6dbeaade32855807c3582f0320e4b2))
+
+
+### Bug Fixes
+
+* make GitHub ref lookup credential-free ([8821154](https://github.com/sase-org/sase-github/commit/88211548c56df3ae539a175bbb49df8a5cdf26be))
+* **projects:** align GitHub discovery with enabled lifecycle (sase-5w.1) ([ff08b5d](https://github.com/sase-org/sase-github/commit/ff08b5d9bd9dddb3934877bc16a5b2c8c7e163a5))
+* refuse archived SDD repositories ([f5f5246](https://github.com/sase-org/sase-github/commit/f5f5246ade2152ae1c7c62c4baa765c248a7a234))
+* reject mismatched sidecar repository remotes ([f333836](https://github.com/sase-org/sase-github/commit/f3338367c3d35d97ee3ea2828d08214197bb6385))
+* require authorization for SDD repository creation ([f416ff3](https://github.com/sase-org/sase-github/commit/f416ff37ad8f72fe063dc98cf30faeca978c63ef))
+* **sdd:** keep companion init alive when label creation is denied ([f9bd0b1](https://github.com/sase-org/sase-github/commit/f9bd0b16caf4a5d69ec5156af6cfd742371f0a75))
+
+## [0.1.7](https://github.com/sase-org/sase-github/compare/v0.1.6...v0.1.7) (2026-07-07)
+
+
+### Features
+
+* use PR terminology for GitHub review hooks ([45cb817](https://github.com/sase-org/sase-github/commit/45cb817503216b4def7f4bd8ef752a285a781323))
+
+
+### Bug Fixes
+
+* preserve canonical refs in GitHub resolution ([73e3c4b](https://github.com/sase-org/sase-github/commit/73e3c4b8e66e79911c305b6aad5677d658862830))
+
+## [0.1.6](https://github.com/sase-org/sase-github/compare/v0.1.5...v0.1.6) (2026-07-02)
+
+
+### Bug Fixes
+
+* report closed GitHub PRs in submitted checks ([5ad2168](https://github.com/sase-org/sase-github/commit/5ad2168c1e36cca4b39e4435fff3076f3492dfb5))
+
+
+### Documentation
+
+* drop `--python 3.12` pin from install commands ([4ecc344](https://github.com/sase-org/sase-github/commit/4ecc344987dd7609996d8ee9040a31e4adb7bb96))
+
 ## [0.1.5](https://github.com/sase-org/sase-github/compare/v0.1.4...v0.1.5) (2026-07-01)
 
 

sase_github-0.2.0/Justfile

@@ -0,0 +1,74 @@
+# sase-github task runner
+
+venv_dir := ".venv"
+venv_bin := venv_dir / "bin"
+
+default:
+    @just --list
+
+_setup:
+    @[ -x {{ venv_bin }}/python ] || (uv venv {{ venv_dir }} && just install)
+
+install-source-sase python:
+    @set -eu; \
+    sase_python_path="${SASE_PYTHON_PATH:-}"; \
+    sase_rust_core_path="${SASE_RUST_CORE_PATH:-}"; \
+    if [ -z "$sase_python_path" ] || [ -z "$sase_rust_core_path" ]; then \
+        printf '%s\n' \
+            'SASE_PYTHON_PATH and SASE_RUST_CORE_PATH must be set together' >&2; \
+        exit 2; \
+    fi; \
+    sase_python_path="$(realpath "$sase_python_path")"; \
+    sase_rust_core_path="$(realpath "$sase_rust_core_path")"; \
+    python_dir="$(cd "$(dirname "{{ python }}")" && pwd)"; \
+    python_path="$python_dir/$(basename "{{ python }}")"; \
+    venv_path="$(dirname "$python_dir")"; \
+    uv pip install --python "$python_path" -e "$sase_python_path"; \
+    uv pip install --python "$python_path" maturin; \
+    ( \
+        cd "$sase_rust_core_path/crates/sase_core_py"; \
+        VIRTUAL_ENV="$venv_path" \
+            PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1 \
+            "$venv_path/bin/maturin" develop --release; \
+    ); \
+    uv pip install --python "$python_path" --no-deps -e "$sase_python_path"
+
+install:
+    @[ -x {{ venv_bin }}/python ] || uv venv {{ venv_dir }}
+    @set -eu; \
+    sase_python_path="${SASE_PYTHON_PATH:-}"; \
+    sase_rust_core_path="${SASE_RUST_CORE_PATH:-}"; \
+    if [ -z "$sase_python_path" ] && [ -z "$sase_rust_core_path" ]; then \
+        rm -f {{ venv_dir }}/sase-overrides.txt; \
+        uv pip install --python {{ venv_bin }}/python -e ".[dev]"; \
+    elif [ -z "$sase_python_path" ] || [ -z "$sase_rust_core_path" ]; then \
+        printf '%s\n' \
+            'SASE_PYTHON_PATH and SASE_RUST_CORE_PATH must be set together' >&2; \
+        exit 2; \
+    else \
+        sase_python_path="$(realpath "$sase_python_path")"; \
+        venv_path="$(realpath {{ venv_dir }})"; \
+        printf -- '-e %s\n' "$sase_python_path" > "$venv_path/sase-overrides.txt"; \
+        uv pip install --python "$venv_path/bin/python" \
+            --overrides "$venv_path/sase-overrides.txt" -e ".[dev]"; \
+        just install-source-sase "$venv_path/bin/python"; \
+    fi
+
+lint: _setup
+    {{ venv_bin }}/ruff check src/ tests/
+    {{ venv_bin }}/mypy
+
+fmt: _setup
+    {{ venv_bin }}/ruff format src/ tests/
+    {{ venv_bin }}/ruff check --fix src/ tests/
+
+test *args: _setup
+    {{ venv_bin }}/pytest {{ args }}
+
+check: lint test
+
+clean:
+    rm -rf build/ dist/ *.egg-info src/*.egg-info .mypy_cache/ .ruff_cache/ .pytest_cache/
+
+build: _setup
+    {{ venv_bin }}/python -m build

{sase_github-0.1.5 → sase_github-0.2.0}/PKG-INFO

@@ -1,11 +1,11 @@
 Metadata-Version: 2.4
 Name: sase-github
-Version: 0.1.5
+Version: 0.2.0
 Summary: GitHub VCS plugin for sase
 License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.12
-Requires-Dist: sase>=0.6.0
+Requires-Dist: sase>=0.11.0
 Provides-Extra: dev
 Requires-Dist: mypy; extra == 'dev'
 Requires-Dist: pytest; extra == 'dev'

{sase_github-0.1.5 → sase_github-0.2.0}/README.md

@@ -24,13 +24,14 @@ to the **Updates** tab (`5`, or `[` / `]`). Highlight `sase-github` in the plugi
 press `i` to install, and confirm the preview modal. The preview shows the exact `uv` command and resolved package set;
 the install runs as a tracked background task and is discovered on the next `sase` run.
 
-See the core SASE docs for the [Updates tab](https://github.com/sase-org/sase/blob/master/docs/configuration.md#updates-tab)
-and [`sase plugin` commands](https://github.com/sase-org/sase/blob/master/docs/plugins.md).
+See the core SASE docs for the
+[Updates tab](https://github.com/sase-org/sase/blob/master/docs/configuration.md#updates-tab) and
+[`sase plugin` commands](https://github.com/sase-org/sase/blob/master/docs/plugins.md).
 
 ### Alternative: install SASE and the plugin together
 
 ```bash
-uv tool install sase --python 3.12 --with sase-github
+uv tool install sase --with sase-github
 ```
 
 Repeat `--with` for additional plugins, for example `--with sase-github --with sase-telegram`. Add `--force` to replace
@@ -45,7 +46,7 @@ sase plugin install github
 `pip install sase-github` is only an escape hatch for non-managed or library-style environments. It is not the normal
 path for a `uv tool`-managed SASE command.
 
-Requires `sase>=0.1.3` as a dependency. For GitHub Enterprise Server or self-hosted GitHub, follow the
+Requires `sase>=0.11.0` as a dependency. For GitHub Enterprise Server or self-hosted GitHub, follow the
 [GitHub Enterprise setup walkthrough](docs/configuration.md#github-enterprise-setup).
 
 ## What's Included
@@ -59,14 +60,21 @@ Requires `sase>=0.1.3` as a dependency. For GitHub Enterprise Server or self-hos
 
 - **GitHubWorkspacePlugin** — Workspace provider that handles GitHub-specific workflow orchestration: reference
   resolution (repo paths, project names, changespec names), PR submission via `gh pr merge`, branch management, and
-  commit description formatting
+  commit description formatting. It also owns GitHub SDD policy: every GitHub project requires a labeled sidecar
+  repository, materialized before `#gh` work starts.
+- **Repo completion for `#gh:<owner>/` refs** — Supplies repository candidates to SASE prompt completion by calling
+  `gh repo list <owner>`. Authenticated `gh` sessions include private repositories the user can access, and configured
+  GitHub Enterprise hosts are respected through `GH_HOST`.
+- **Owner completion for `#gh:` refs** — Supplies local namespace candidates from active canonical GitHub project
+  records (`gh_<owner>__<repo>`) plus configured `github_orgs`, so accepting an owner can chain into repo completion
+  without a network call.
 
 ### Configuration
 
 - **`get_github_hosts()` / `get_default_github_host()`** — Read `github_hosts` from sase config to recognize GitHub
   Enterprise hosts and choose the default host for `#gh(owner/repo)` clone refs
 - **`get_github_orgs()`** — Reads `github_orgs` from sase config to determine SSH vs HTTPS clone URLs for
-  organizations/users with push access
+  organizations/users with push access, and to seed local `#gh:` owner completion
 
 ### XPrompts
 
@@ -86,15 +94,24 @@ itself with sase core:
 - **`sase_xprompts`** — Makes GitHub xprompts discoverable via plugin discovery
 
 When sase detects a repository whose remote origin host is in the configured GitHub host set, it automatically loads
-`GitHubPlugin` and `GitHubWorkspacePlugin` to handle VCS operations like PR creation, branch management, commit
-workflows, and PR submission.
+`GitHubPlugin` and `GitHubWorkspacePlugin` to handle VCS operations and provider-owned SDD storage. The first `#gh` or
+For managed projects, `sase sdd init` finds or creates the public `<owner>/<repo>--plans` and `<owner>/<repo>--research`
+sidecars and returns their provider metadata to SASE core. The same hooks retain `<owner>/<repo>--sdd` discovery for
+legacy stores. Authentication, permission, network, repository creation, labeling, clone, or initial-push failures stop
+setup; there is no GitHub-local SDD fallback.
+
+The explicit `sase sdd init` flow first uses a read-only `gh repo view` preflight for each sidecar. Existing
+sidecars connect without a creation prompt. Each missing sidecar requires a fresh, default-no interactive `y`/`yes`
+response naming the full `--plans` or `--research` repository. Non-interactive stdin, EOF, interruption, and bare
+`sase init --yes` cannot authorize creation.
 
 ## Requirements
 
 - Python 3.12+
-- [sase](https://github.com/sase-org/sase) >= 0.1.3
-- [gh](https://cli.github.com/) CLI (for GitHub API operations). For GitHub Enterprise, run
-  `gh auth login --hostname <host>` for each configured Enterprise host.
+- [sase](https://github.com/sase-org/sase) >= 0.11.0
+- [gh](https://cli.github.com/) CLI (for GitHub API operations, mandatory sidecar repository setup, and `#gh:<owner>/`
+  repository completion). Run `gh auth login`; the account must be able to create the sidecar when it is missing and
+  manage its labels. For GitHub Enterprise, run `gh auth login --hostname <host>` for each configured Enterprise host.
 
 See [Configuration](docs/configuration.md) for `github_hosts`, `github_orgs`, workspace layout, and the ordered GitHub
 Enterprise setup flow.
@@ -111,8 +128,11 @@ just build      # Build distribution packages
 just clean      # Remove build artifacts
 ```
 
-Set `SASE_CORE_PATH=/path/to/sase` when you need development installs to use an editable SASE checkout before installing
-`sase-github`.
+Set both `SASE_PYTHON_PATH=/path/to/sase` and `SASE_RUST_CORE_PATH=/path/to/sase-core` when development installs need to
+use coordinated source checkouts. The Rust binding is built into the plugin virtual environment before the editable
+SASE checkout is overlaid without dependencies. Leave both variables unset to use the ordinary published dependencies.
+The same variables can be used with `just install-source-sase /path/to/venv/bin/python` to prepare another existing
+virtual environment, such as an install-smoke environment.
 
 ## Project Structure
 

{sase_github-0.1.5 → sase_github-0.2.0}/docs/architecture.md

@@ -25,7 +25,7 @@ Extends `GitCommon` from sase core. Handles low-level VCS operations by wrapping
 | --------------------------- | ------------------------------------------------------------------------------------- |
 | `vcs_classify_repo()`       | Claims repos whose origin host is in the configured GitHub host set                   |
 | `vcs_get_change_url()`      | Returns PR URL via `gh pr view --json url`                                            |
-| `vcs_get_cl_number()`       | Returns PR number via `gh pr view --json number`                                      |
+| `vcs_get_pr_number()`       | Returns PR number via `gh pr view --json number`                                      |
 | `vcs_mail()`                | Pushes branch (`git push -u origin`) and creates PR if needed (`gh pr create --fill`) |
 | `vcs_create_pull_request()` | Creates a PR with an AI-generated title and body                                      |
 
@@ -41,14 +41,29 @@ Handles higher-level workflow orchestration. Implements workspace hooks for GitH
 | `ws_detect_workflow_type()`            | Returns `"gh"` for repos with a remote origin URL (non-local)                     |
 | `ws_get_change_label()`                | Returns `"PR"` for GitHub projects                                                |
 | `ws_resolve_ref()`                     | Resolves `#gh` references (see [Reference Resolution](#reference-resolution))     |
+| `ws_list_ref_namespaces()`             | Lists local `#gh:` owner candidates from active canonical projects and config     |
 | `ws_extract_change_identifier()`       | Extracts PR number from GitHub PR URLs                                            |
 | `ws_generate_submitted_check_script()` | Generates a bash script that checks if a PR is merged via `gh pr view`            |
 | `ws_supports_reviewer_comments()`      | Returns `False` for GitHub URLs (critique comments not supported)                 |
 | `ws_get_workspace_directory()`         | Ensures git clone exists via `ensure_git_clone()`                                 |
+| `ws_preflight_sdd_sidecar()`         | Read-only suffix-aware sidecar discovery for guarded explicit initialization    |
+| `ws_materialize_sdd_store()`           | Finds or creates, labels, and stages a selected GitHub SDD sidecar              |
+| `ws_create_sdd_remote()`               | Verifies or creates `--sdd`, `--plans`, or `--research` and returns its metadata  |
 | `ws_prepare_mail()`                    | Displays branch/description and prompts user before pushing                       |
 | `ws_format_commit_description()`       | Prepends `[project]` prefix to commit messages                                    |
 | `ws_submit()`                          | Submits a ChangeSpec by merging its PR via `gh pr merge --merge --delete-branch`  |
 
+The provider declares `separate_repo` SDD policy. Core supplies a unique staging path; the plugin finds or creates the
+selected sidecar, ensures its `sase--sdd` label, and clones with the normal SSH/HTTPS fallback. It returns only a
+positive materialized record. SASE core owns legacy-artifact conflict checks, import, initial commit/push, atomic
+adoption, and the durable primary-workspace record.
+
+The explicit initializer calls `ws_preflight_sdd_sidecar()` before materialization. This hook may run `gh repo view`
+but never creates or labels a repository, clones, or writes local state. Core then includes a per-invocation creation
+authorization in materialization options: `False` after a found result and `True` only after the user answers `y` or
+`yes` for a missing public sidecar. The provider checks this option immediately before both repository-creation
+branches. Other materialization callers omit the option and retain provider-owned behavior.
+
 ## Reference Resolution
 
 The `resolve_gh_ref()` function supports three dispatch modes for `#gh` references:
@@ -91,6 +106,17 @@ When the ref matches an existing ChangeSpec:
 - Reads `WORKSPACE_DIR` from the changespec's project file
 - Checks out `origin/<name>` (the ChangeSpec's branch)
 
+## Ref Namespace Completion
+
+For root ref completion after `#gh:`, `GitHubWorkspacePlugin` implements `ws_list_ref_namespaces()`. It returns GitHub
+owner/org candidates from two local sources only:
+
+- Active SASE project records whose directory keys use the canonical GitHub shape `gh_<owner>__<repo>`
+- The configured `github_orgs` list
+
+Record-derived owners show their active project count. Config-only owners show `from github_orgs`. Duplicate owners are
+deduplicated case-insensitively, with record-derived spellings preferred when both sources include the same owner.
+
 ## Submission Flow
 
 When submitting a GitHub ChangeSpec (`ws_submit`):

{sase_github-0.1.5 → sase_github-0.2.0}/docs/configuration.md

@@ -4,19 +4,20 @@
 
 Use this checklist for GitHub Enterprise Server or another self-hosted GitHub host:
 
-1. **Install SASE and `sase-github`.** Use the
-   [README installation routes](../README.md#installation): the SASE Admin Center Updates tab is the recommended path
-   for an existing managed install, while `uv tool install sase --python 3.12 --with sase-github` installs SASE and the
-   plugin together. The core SASE [plugin docs](https://github.com/sase-org/sase/blob/master/docs/plugins.md) also cover
-   `sase plugin install github` for existing installs.
+1. **Install SASE and `sase-github`.** Use the [README installation routes](../README.md#installation): the SASE Admin
+   Center Updates tab is the recommended path for an existing managed install, while
+   `uv tool install sase --with sase-github` installs SASE and the plugin together. The core SASE
+   [plugin docs](https://github.com/sase-org/sase/blob/master/docs/plugins.md) also cover `sase plugin install github`
+   for existing installs.
 2. **Authenticate `gh` to the Enterprise host.**
 
    ```bash
    gh auth login --hostname github.mycompany.com
    ```
 
-   Repo-scoped `gh` commands auto-detect the host from the git remote, so this host-specific login is enough for PR
-   operations once the repo is cloned.
+   Repo-scoped `gh` commands auto-detect the host from the git remote. The authenticated account must also be able to
+   create the mandatory SDD sidecar when missing and manage its `sase--sdd` label.
+
 3. **Set `github_hosts` in `~/.config/sase/sase.yml`.** **Put your Enterprise host first** if you want bare
    `#gh(owner/repo)` refs to clone from Enterprise. `github.com` is always included implicitly, but the first configured
    host is the default for bare refs; listing `github.com` first means bare refs default there instead. See
@@ -33,6 +34,10 @@ Use this checklist for GitHub Enterprise Server or another self-hosted GitHub ho
    Then resolve a repo with `#gh(owner/repo)`. Enterprise workspaces are namespaced by host under
    `~/projects/github/<host>/<user>/<project>/`; see [Workspace Layout](#workspace-layout).
 
+   Prompt completion for `#gh:<owner>/` uses the same default host through `GH_HOST`, so Enterprise repository lists
+   come from the first configured `github_hosts` entry. Authenticate the GitHub CLI to that host before relying on
+   completion for private repositories.
+
 ## `github_hosts`
 
 The `github_hosts` setting controls which GitHub hosts sase-github recognizes. Add it to your sase config file
@@ -47,8 +52,8 @@ github_hosts:
 **Effect:** sase-github claims repositories whose remote origin host matches one of these hosts. `github.com` is always
 included implicitly, so public GitHub keeps working even if you only configure an Enterprise host.
 
-The first configured host is the default for bare `#gh(owner/repo)` refs. With the example above,
-`#gh(my-org/my-repo)` clones from `github.mycompany.com`. If `github_hosts` is unset, the default host is `github.com`.
+The first configured host is the default for bare `#gh(owner/repo)` refs. With the example above, `#gh(my-org/my-repo)`
+clones from `github.mycompany.com`. If `github_hosts` is unset, the default host is `github.com`.
 
 Host entries are normalized, so pasted values such as `https://github.mycompany.com/` are accepted.
 
@@ -64,12 +69,15 @@ github_orgs:
 ```
 
 **Effect:** When cloning a repo whose owner is in this list, sase-github uses SSH
-(`git@<github-host>:user/project.git`). For all other repos, it uses HTTPS
-(`https://<github-host>/user/project.git`).
+(`git@<github-host>:user/project.git`). For all other repos, it uses HTTPS (`https://<github-host>/user/project.git`).
 
 This matters because SSH URLs require an SSH key configured with GitHub, while HTTPS URLs work for public repos without
 authentication (but require a token for push access).
 
+The same list also seeds local owner completion for `#gh:` prompts. SASE combines `github_orgs` with owners discovered
+from active canonical GitHub project records named `gh_<owner>__<repo>`. This completion source is local-only; it does
+not run `gh` or contact GitHub until you accept an owner and ask for repository completion with `#gh:<owner>/`.
+
 ## Default Config
 
 sase-github contributes a `default_config.yml` via the `sase_config` entry point. This is merged into the sase config
@@ -81,17 +89,31 @@ Currently the default config defines:
 
 ## Requirements
 
-- **`gh` CLI** — Required for all PR operations. Install from https://cli.github.com/ and authenticate with
-  `gh auth login`. For GitHub Enterprise, authenticate to the configured host with
-  `gh auth login --hostname github.mycompany.com`.
+- **`gh` CLI** — Required for PR operations and mandatory SDD sidecar discovery, creation, and labeling. Install from
+  https://cli.github.com/ and authenticate with `gh auth login`; ensure the account can create the sidecar when
+  missing and manage its labels. It is also used for `#gh:<owner>/` repository completion via `gh repo list <owner>`,
+  including private repositories visible to the authenticated account. For GitHub Enterprise, authenticate to the
+  configured host with `gh auth login --hostname github.mycompany.com`.
 - **Git** — Standard git CLI for repository operations.
 
+## SDD sidecar repository
+
+Managed projects use public `<owner>/<repo>--plans` and `<owner>/<repo>--research` sidecars. The legacy
+`<owner>/<repo>--sdd` candidate and the `sdd.repo.name` override remain supported for unmigrated stores. `sase sdd init`
+fails closed if discovery, creation, labeling, cloning, or the initial push fails. Fix `gh auth status`, repository
+permissions, or network access and retry; SASE does not switch GitHub projects to a local store.
+
+For explicit `sase sdd init`, authoritative read-only discovery precedes materialization. Each missing split sidecar
+requires its own `y` or `yes` response at a default-no prompt naming visibility, full name, and host. Non-interactive
+stdin and bare `sase init --yes` cannot grant it. A sidecar found during preflight receives no creation authorization,
+so if it disappears before materialization the provider stops instead of silently recreating it.
+
 ## Workspace Layout
 
 Primary GitHub workspaces are stored under `~/projects/github/<user>/<project>/` when first resolved from a
 `#gh(user/project)` reference and the default host is `github.com`. For other default hosts, workspaces are namespaced
-by host at `~/projects/github/<host>/<user>/<project>/` to avoid collisions between same-named repos on different
-GitHub installations.
+by host at `~/projects/github/<host>/<user>/<project>/` to avoid collisions between same-named repos on different GitHub
+installations.
 
 Numbered parallel-work checkouts follow SASE's shared `workspace.root` policy: by default they live under the platform
 state-root namespace, while explicit `workspace.root: adjacent` keeps the legacy

{sase_github-0.1.5 → sase_github-0.2.0}/docs/xprompts.md

@@ -21,7 +21,8 @@ the target branch, and captures diffs.
 
 ### Steps
 
-1. **setup** — Resolves the `gh_ref` to a project file, workspace directory, and checkout target. Claims the workspace.
+1. **setup** — Resolves the `gh_ref`, ensures the checkout, materializes the mandatory GitHub SDD sidecar, and only
+   then claims the workspace. Sidecar setup failures stop the workflow before the claim or agent launch.
 2. **prepare** — Stashes uncommitted changes (including untracked files) and fetches from origin.
 3. **checkout** — Checks out the target branch/commit. Falls back to `master`/`main` for project refs. Pulls with
    rebase to sync with remote.

{sase_github-0.1.5 → sase_github-0.2.0}/pyproject.toml

@@ -1,14 +1,15 @@
 [build-system]
-requires = ["hatchling"]
+requires = ["hatchling>=1.27"]
 build-backend = "hatchling.build"
 
 [project]
 name = "sase-github"
-version = "0.1.5"
+version = "0.2.0"
 description = "GitHub VCS plugin for sase"
 requires-python = ">=3.12"
 license = "MIT"
-dependencies = ["sase>=0.6.0"]
+license-files = ["LICENSE"]
+dependencies = ["sase>=0.11.0"]
 
 [project.optional-dependencies]
 dev = [

sase_github-0.2.0/src/sase_github/__init__.py

@@ -0,0 +1,17 @@
+"""sase-github: GitHub VCS plugin for sase."""
+
+from sase_github.errors import (
+    GitHubAuthenticationError,
+    GitHubIssueError,
+    GitHubRateLimitError,
+)
+from sase_github.plugin import GitHubPlugin
+from sase_github.workspace_plugin import GitHubWorkspacePlugin
+
+__all__ = [
+    "GitHubAuthenticationError",
+    "GitHubIssueError",
+    "GitHubPlugin",
+    "GitHubRateLimitError",
+    "GitHubWorkspacePlugin",
+]