sase-github 0.2.12__tar.gz → 0.2.13__tar.gz

sase_github-0.2.13/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.2.13"
+}

{sase_github-0.2.12 → sase_github-0.2.13}/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.2.13](https://github.com/sase-org/sase-github/compare/v0.2.12...v0.2.13) (2026-09-22)
+
+
+### Features
+
+* **tool:** add check catalog and recipe guard ([e807f82](https://github.com/sase-org/sase-github/commit/e807f823f6ee137c72503d8367d0a80543196b97))
+
 ## [0.2.12](https://github.com/sase-org/sase-github/compare/v0.2.11...v0.2.12) (2026-09-15)
 
 

{sase_github-0.2.12 → sase_github-0.2.13}/CLAUDE.md

@@ -23,3 +23,9 @@ just check      # lint + test
 - Absolute imports: `from sase_github.plugin import GitHubPlugin`
 - Target Python 3.12+
 - Follow ruff rules matching sase core
+
+## sase tool runs
+
+Agents run `sase tool run check` here, not bare `just check`: `check` is
+guarded and a raw agent invocation is refused with the wrapped and bypass
+forms. To run raw on purpose: `SASE_TOOL_BYPASS='<why>' just check`.

{sase_github-0.2.12 → sase_github-0.2.13}/Justfile

@@ -65,7 +65,13 @@ fmt: _setup
 test *args: _setup
     {{ venv_bin }}/pytest {{ args }}
 
-check: lint test
+# Agents must run guarded tools through `sase tool run` (sase docs/tool.md).
+# The guard is the first dependency, ahead of `_setup`, so a refusal costs
+# milliseconds rather than a dependency sync.
+_require-tool-run name:
+    @tools/require_tool_run {{ name }}
+
+check: (_require-tool-run "check") lint test
 
 clean:
     rm -rf build/ dist/ *.egg-info src/*.egg-info .mypy_cache/ .ruff_cache/ .pytest_cache/

{sase_github-0.2.12 → sase_github-0.2.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sase-github
-Version: 0.2.12
+Version: 0.2.13
 Summary: GitHub VCS plugin for sase
 License-Expression: MIT
 License-File: LICENSE

{sase_github-0.2.12 → sase_github-0.2.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sase-github"
-version = "0.2.12"
+version = "0.2.13"
 description = "GitHub VCS plugin for sase"
 requires-python = ">=3.12"
 license = "MIT"

sase_github-0.2.13/sase/sase.yml

@@ -0,0 +1,22 @@
+# Project-owned named tools (see sase docs/tool.md, "Guarded recipes").
+# Complete entries: other config layers cannot alter this catalog.
+tools:
+  check:
+    argv: [just, check]
+    description: Run the repository scoped check.
+    stages: none
+    inputs:
+      - Justfile
+      - pyproject.toml
+      - uv.lock
+    args: deny
+    fingerprint:
+      toolchain:
+        python: [.venv/bin/python, --version]
+        just: [just, --version]
+        sase-github:
+          [
+            .venv/bin/python,
+            -c,
+            "from importlib.metadata import version; print(version('sase-github'))",
+          ]

sase_github-0.2.13/tools/require_tool_run

@@ -0,0 +1,60 @@
+#!/bin/sh
+# Guard a Just recipe so SASE agents only run it through `sase tool run`.
+#
+# Usage: tools/require_tool_run <tool-name>
+#
+# Wired as the first dependency of each guarded recipe (see `check` and
+# `check-full` in the Justfile), ahead of `_setup`, so a refusal costs
+# milliseconds rather than a dependency sync. Contract: docs/tool.md
+# ("Guarded recipes" table). Deliberately dependency-free POSIX `sh`: this
+# must never start `sase`, because the override exists precisely for when
+# `sase` is broken, and because every human and CI `just check` would
+# otherwise pay a startup cost for logic that needs three variables.
+#
+# An agent may run a guarded recipe only from inside `sase tool run <that
+# tool>` for that project root, or with an explicit bypass. This is a
+# guardrail against habit, not a security boundary: `env -u SASE_AGENT`
+# defeats it, and the bypass is deliberately easier and more visible.
+set -u
+
+tool=${1:-}
+if [ -z "$tool" ]; then
+    printf 'sase: usage: tools/require_tool_run <tool-name>\n' >&2
+    exit 2
+fi
+
+# Humans, CI, finalizers, monitors, and procs run raw: only an agent's own
+# shell carries SASE_AGENT.
+if [ -z "${SASE_AGENT:-}" ]; then
+    exit 0
+fi
+
+# Inside `sase tool run <this tool>` for this project root. SASE_TOOL_NAME
+# is exported whether or not recording succeeded, so the child of a
+# fail-open run is still allowed. Ad-hoc runs export SASE_TOOL_NAME=ad-hoc
+# with an empty root and can never match a guarded recipe's name.
+if [ "${SASE_TOOL_NAME:-}" = "$tool" ] && [ "${SASE_TOOL_PROJECT_ROOT:-}" = "$(pwd -P)" ]; then
+    exit 0
+fi
+
+# Explicit bypass: any non-empty value runs raw on purpose, and the value
+# is the reason. Keep the notice to one line even if the reason is not.
+if [ -n "${SASE_TOOL_BYPASS:-}" ]; then
+    nl='
+'
+    reason=${SASE_TOOL_BYPASS%%"$nl"*}
+    printf 'sase: bypassing the tool-run guard (SASE_TOOL_BYPASS=%s).\n' "$reason" >&2
+    exit 0
+fi
+
+# Fail open without `sase`: when the wrapper is unavailable there is no
+# wrapped form to print, so allow the raw run and say why.
+if ! command -v sase >/dev/null 2>&1; then
+    printf 'sase: allowing raw `just %s`: `sase` is not on PATH.\n' "$tool" >&2
+    exit 0
+fi
+
+printf 'sase: refusing raw `just %s` in an agent shell (SASE_AGENT is set and SASE_TOOL_NAME names a different tool or root).\n' "$tool" >&2
+printf 'sase: run `sase tool run %s` instead.\n' "$tool" >&2
+printf 'sase: or run `SASE_TOOL_BYPASS='"'"'<reason>'"'"' just %s` to bypass with a named reason.\n' "$tool" >&2
+exit 2

sase_github-0.2.12/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.2.12"
-}