sase-github 0.2.12__tar.gz → 0.2.14__tar.gz

sase_github-0.2.14/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.2.14"
+}

{sase_github-0.2.12 → sase_github-0.2.14}/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.2.14](https://github.com/sase-org/sase-github/compare/v0.2.13...v0.2.14) (2026-09-22)
+
+
+### Features
+
+* **projects:** allocate canonical names case-insensitively ([fd5b7bd](https://github.com/sase-org/sase-github/commit/fd5b7bde2ac2e0785640df172e7e321275df406b))
+
+## [0.2.13](https://github.com/sase-org/sase-github/compare/v0.2.12...v0.2.13) (2026-09-22)
+
+
+### Features
+
+* **tool:** add check catalog and recipe guard ([e807f82](https://github.com/sase-org/sase-github/commit/e807f823f6ee137c72503d8367d0a80543196b97))
+
 ## [0.2.12](https://github.com/sase-org/sase-github/compare/v0.2.11...v0.2.12) (2026-09-15)
 
 

{sase_github-0.2.12 → sase_github-0.2.14}/CLAUDE.md

@@ -23,3 +23,9 @@ just check      # lint + test
 - Absolute imports: `from sase_github.plugin import GitHubPlugin`
 - Target Python 3.12+
 - Follow ruff rules matching sase core
+
+## sase tool runs
+
+Agents run `sase tool run check` here, not bare `just check`: `check` is
+guarded and a raw agent invocation is refused with the wrapped and bypass
+forms. To run raw on purpose: `SASE_TOOL_BYPASS='<why>' just check`.

{sase_github-0.2.12 → sase_github-0.2.14}/Justfile

@@ -65,7 +65,13 @@ fmt: _setup
 test *args: _setup
     {{ venv_bin }}/pytest {{ args }}
 
-check: lint test
+# Agents must run guarded tools through `sase tool run` (sase docs/tool.md).
+# The guard is the first dependency, ahead of `_setup`, so a refusal costs
+# milliseconds rather than a dependency sync.
+_require-tool-run name:
+    @tools/require_tool_run {{ name }}
+
+check: (_require-tool-run "check") lint test
 
 clean:
     rm -rf build/ dist/ *.egg-info src/*.egg-info .mypy_cache/ .ruff_cache/ .pytest_cache/

{sase_github-0.2.12 → sase_github-0.2.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sase-github
-Version: 0.2.12
+Version: 0.2.14
 Summary: GitHub VCS plugin for sase
 License-Expression: MIT
 License-File: LICENSE

{sase_github-0.2.12 → sase_github-0.2.14}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sase-github"
-version = "0.2.12"
+version = "0.2.14"
 description = "GitHub VCS plugin for sase"
 requires-python = ">=3.12"
 license = "MIT"

sase_github-0.2.14/sase/sase.yml

@@ -0,0 +1,22 @@
+# Project-owned named tools (see sase docs/tool.md, "Guarded recipes").
+# Complete entries: other config layers cannot alter this catalog.
+tools:
+  check:
+    argv: [just, check]
+    description: Run the repository scoped check.
+    stages: none
+    inputs:
+      - Justfile
+      - pyproject.toml
+      - uv.lock
+    args: deny
+    fingerprint:
+      toolchain:
+        python: [.venv/bin/python, --version]
+        just: [just, --version]
+        sase-github:
+          [
+            .venv/bin/python,
+            -c,
+            "from importlib.metadata import version; print(version('sase-github'))",
+          ]

{sase_github-0.2.12 → sase_github-0.2.14}/src/sase_github/workspace_plugin.py

@@ -1505,12 +1505,17 @@ def _canonical_project_name_base(user: str, project: str) -> str:
 
 
 def _project_refs(records: Sequence[ProjectRecordWire]) -> set[str]:
+    """Return folded project refs occupying the canonical-name namespace.
+
+    Refs compare case-insensitively, so a canonical name is never allocated
+    as a case-variant duplicate of an existing key, name, or alias.
+    """
     occupied: set[str] = set()
     for record in records:
-        occupied.add(record.project_name)
+        occupied.add(record.project_name.casefold())
         if display_name := getattr(record, "display_name", None):
-            occupied.add(display_name)
-        occupied.update(record.aliases)
+            occupied.add(display_name.casefold())
+        occupied.update(alias.casefold() for alias in record.aliases)
     return occupied
 
 
@@ -1524,7 +1529,7 @@ def _allocate_canonical_project_name(
 
     candidate = base
     suffix = 2
-    while candidate in occupied:
+    while candidate.casefold() in occupied:
         candidate = f"{base}-{suffix}"
         suffix += 1
     return candidate

{sase_github-0.2.12 → sase_github-0.2.14}/tests/test_workspace_plugin.py

@@ -1830,6 +1830,26 @@ class TestResolveGhRef:
                 encoding="utf-8"
             )
 
+    @patch(
+        "sase_github.workspace_plugin.get_default_branch", return_value="origin/main"
+    )
+    def test_repo_path_suffixes_case_variant_canonical_project_name(
+        self, mock_branch: MagicMock
+    ) -> None:
+        with tempfile.TemporaryDirectory() as d:
+            home = Path(d)
+            _github_workspace(home, "alice", "foo")
+            _write_project(
+                home,
+                "GH_ALICE__FOO",
+                "WORKSPACE_DIR: /some/other/path/\nNAME: other\n",
+            )
+            path_patch, env_patch = _home_patches(home)
+            with path_patch, env_patch:
+                result = resolve_gh_ref("alice/foo")
+
+            assert result.project_name == "gh_alice__foo-2"
+
     @patch(
         "sase_github.workspace_plugin.get_default_branch", return_value="origin/main"
     )

sase_github-0.2.14/tools/require_tool_run

@@ -0,0 +1,60 @@
+#!/bin/sh
+# Guard a Just recipe so SASE agents only run it through `sase tool run`.
+#
+# Usage: tools/require_tool_run <tool-name>
+#
+# Wired as the first dependency of each guarded recipe (see `check` and
+# `check-full` in the Justfile), ahead of `_setup`, so a refusal costs
+# milliseconds rather than a dependency sync. Contract: docs/tool.md
+# ("Guarded recipes" table). Deliberately dependency-free POSIX `sh`: this
+# must never start `sase`, because the override exists precisely for when
+# `sase` is broken, and because every human and CI `just check` would
+# otherwise pay a startup cost for logic that needs three variables.
+#
+# An agent may run a guarded recipe only from inside `sase tool run <that
+# tool>` for that project root, or with an explicit bypass. This is a
+# guardrail against habit, not a security boundary: `env -u SASE_AGENT`
+# defeats it, and the bypass is deliberately easier and more visible.
+set -u
+
+tool=${1:-}
+if [ -z "$tool" ]; then
+    printf 'sase: usage: tools/require_tool_run <tool-name>\n' >&2
+    exit 2
+fi
+
+# Humans, CI, finalizers, monitors, and procs run raw: only an agent's own
+# shell carries SASE_AGENT.
+if [ -z "${SASE_AGENT:-}" ]; then
+    exit 0
+fi
+
+# Inside `sase tool run <this tool>` for this project root. SASE_TOOL_NAME
+# is exported whether or not recording succeeded, so the child of a
+# fail-open run is still allowed. Ad-hoc runs export SASE_TOOL_NAME=ad-hoc
+# with an empty root and can never match a guarded recipe's name.
+if [ "${SASE_TOOL_NAME:-}" = "$tool" ] && [ "${SASE_TOOL_PROJECT_ROOT:-}" = "$(pwd -P)" ]; then
+    exit 0
+fi
+
+# Explicit bypass: any non-empty value runs raw on purpose, and the value
+# is the reason. Keep the notice to one line even if the reason is not.
+if [ -n "${SASE_TOOL_BYPASS:-}" ]; then
+    nl='
+'
+    reason=${SASE_TOOL_BYPASS%%"$nl"*}
+    printf 'sase: bypassing the tool-run guard (SASE_TOOL_BYPASS=%s).\n' "$reason" >&2
+    exit 0
+fi
+
+# Fail open without `sase`: when the wrapper is unavailable there is no
+# wrapped form to print, so allow the raw run and say why.
+if ! command -v sase >/dev/null 2>&1; then
+    printf 'sase: allowing raw `just %s`: `sase` is not on PATH.\n' "$tool" >&2
+    exit 0
+fi
+
+printf 'sase: refusing raw `just %s` in an agent shell (SASE_AGENT is set and SASE_TOOL_NAME names a different tool or root).\n' "$tool" >&2
+printf 'sase: run `sase tool run %s` instead.\n' "$tool" >&2
+printf 'sase: or run `SASE_TOOL_BYPASS='"'"'<reason>'"'"' just %s` to bypass with a named reason.\n' "$tool" >&2
+exit 2

sase_github-0.2.12/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.2.12"
-}