sql-write-gate 0.16.0__tar.gz → 0.16.1__tar.gz

{sql_write_gate-0.16.0/src/sql_write_gate.egg-info → sql_write_gate-0.16.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-write-gate
-Version: 0.16.0
+Version: 0.16.1
 Summary: Policy firewall for AI agents writing to databases (sql-write-gate)
 License: MIT
 Requires-Python: >=3.11
@@ -322,6 +322,10 @@ Tagged **v0.11.0** with [CHANGELOG.md](CHANGELOG.md) and a GitHub Release. No Py
 
 README badges (CI / Release / Python / License). Tagged **v0.13.0** with a GitHub Release. No PyPI. No product behavior change.
 
+## v0.16.1 — installed-path defaults
+
+After `pip install sql-write-gate` and `sql-write-gate init`, bare `sql-write-gate check "DELETE FROM orders"` uses `./policy.yaml` + `./catalog.json` (no `FileNotFoundError` on a fake `seed/catalog.json`).
+
 ## v0.16 — PyPI package name `sql-write-gate`
 
 Version **0.16.0**. Distribution name on PyPI is **`sql-write-gate`** (was `write-gate` in earlier pyproject drafts). Import package stays `write_gate`; CLI entry stays `sql-write-gate`.

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/README.md

@@ -301,6 +301,10 @@ Tagged **v0.11.0** with [CHANGELOG.md](CHANGELOG.md) and a GitHub Release. No Py
 
 README badges (CI / Release / Python / License). Tagged **v0.13.0** with a GitHub Release. No PyPI. No product behavior change.
 
+## v0.16.1 — installed-path defaults
+
+After `pip install sql-write-gate` and `sql-write-gate init`, bare `sql-write-gate check "DELETE FROM orders"` uses `./policy.yaml` + `./catalog.json` (no `FileNotFoundError` on a fake `seed/catalog.json`).
+
 ## v0.16 — PyPI package name `sql-write-gate`
 
 Version **0.16.0**. Distribution name on PyPI is **`sql-write-gate`** (was `write-gate` in earlier pyproject drafts). Import package stays `write_gate`; CLI entry stays `sql-write-gate`.

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sql-write-gate"
-version = "0.16.0"
+version = "0.16.1"
 description = "Policy firewall for AI agents writing to databases (sql-write-gate)"
 readme = "README.md"
 license = { text = "MIT" }

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1/src/sql_write_gate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sql-write-gate
-Version: 0.16.0
+Version: 0.16.1
 Summary: Policy firewall for AI agents writing to databases (sql-write-gate)
 License: MIT
 Requires-Python: >=3.11
@@ -322,6 +322,10 @@ Tagged **v0.11.0** with [CHANGELOG.md](CHANGELOG.md) and a GitHub Release. No Py
 
 README badges (CI / Release / Python / License). Tagged **v0.13.0** with a GitHub Release. No PyPI. No product behavior change.
 
+## v0.16.1 — installed-path defaults
+
+After `pip install sql-write-gate` and `sql-write-gate init`, bare `sql-write-gate check "DELETE FROM orders"` uses `./policy.yaml` + `./catalog.json` (no `FileNotFoundError` on a fake `seed/catalog.json`).
+
 ## v0.16 — PyPI package name `sql-write-gate`
 
 Version **0.16.0**. Distribution name on PyPI is **`sql-write-gate`** (was `write-gate` in earlier pyproject drafts). Import package stays `write_gate`; CLI entry stays `sql-write-gate`.

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/sql_write_gate.egg-info/SOURCES.txt

@@ -52,10 +52,12 @@ tests/test_destructive.py
 tests/test_environment.py
 tests/test_hooks.py
 tests/test_init.py
+tests/test_installed_init_check.py
 tests/test_mcp.py
 tests/test_mcp_execute.py
 tests/test_mysql.py
 tests/test_mysql_live.py
+tests/test_paths_defaults.py
 tests/test_policy.py
 tests/test_postgres_live.py
 tests/test_proxy.py

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/__init__.py

@@ -4,4 +4,4 @@ from write_gate.decision import Decision, Evidence
 from write_gate.wrapper import WriteGate
 
 __all__ = ["WriteGate", "Evidence", "Decision"]
-__version__ = "0.16.0"
+__version__ = "0.16.1"

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/adapters/base.py

@@ -6,7 +6,7 @@ import os
 from pathlib import Path
 from typing import Mapping
 
-from write_gate.paths import DB_PATH
+from write_gate.paths import default_db_path
 
 BACKEND_DUCKDB = "duckdb"
 BACKEND_POSTGRES = "postgres"
@@ -98,4 +98,4 @@ def resolve_target(
     env_url = env.get("DATABASE_URL")
     if env_url:
         return detect_backend(env_url), env_url
-    return BACKEND_DUCKDB, str(DB_PATH)
+    return BACKEND_DUCKDB, str(default_db_path())

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/adapters/duckdb.py

@@ -7,7 +7,7 @@ from pathlib import Path
 import duckdb
 
 from write_gate.adapters.base import BACKEND_DUCKDB, count_sql as _count_sql
-from write_gate.paths import DB_PATH
+from write_gate.paths import default_db_path
 
 DIALECT = "duckdb"
 BACKEND = BACKEND_DUCKDB
@@ -31,7 +31,7 @@ def count_sql(table: str, predicate: str | None) -> str:
 
 
 def connect(db_path: Path | None = None, *, read_only: bool = False) -> duckdb.DuckDBPyConnection:
-    path = Path(db_path) if db_path else DB_PATH
+    path = Path(db_path) if db_path else default_db_path()
     path.parent.mkdir(parents=True, exist_ok=True)
     return duckdb.connect(str(path), read_only=read_only)
 

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/approvals.py

@@ -10,7 +10,7 @@ from pathlib import Path
 from typing import Any
 
 from write_gate.decision import Decision
-from write_gate.paths import APPROVALS_PATH, LOG_DIR
+from write_gate.paths import default_approvals_path, default_log_dir
 
 STATUS_PENDING = "pending"
 STATUS_APPROVED = "approved"
@@ -81,7 +81,7 @@ def _new_id() -> str:
 
 
 def _path(path: Path | str | None = None) -> Path:
-    return Path(path) if path else APPROVALS_PATH
+    return Path(path) if path else default_approvals_path()
 
 
 def _load(path: Path) -> dict[str, dict[str, Any]]:
@@ -202,4 +202,4 @@ def mark_rejected(approval_id: str, path: Path | str | None = None) -> ApprovalR
 
 
 def ensure_log_dir() -> None:
-    LOG_DIR.mkdir(parents=True, exist_ok=True)
+    default_log_dir().mkdir(parents=True, exist_ok=True)

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/audit.py

@@ -9,7 +9,7 @@ from typing import Any, Iterable
 from zoneinfo import ZoneInfo
 
 from write_gate.decision import ACTION_APPROVAL, Decision
-from write_gate.paths import AUDIT_PATH, LOG_DIR
+from write_gate.paths import default_audit_path, default_log_dir
 
 # Glanceable table times: UTC ISO on disk, Asia/Shanghai in `sql-write-gate audit`.
 AUDIT_DISPLAY_TZ = ZoneInfo("Asia/Shanghai")
@@ -38,14 +38,14 @@ def append_audit(
         "decision": decision.action,
         "rule_id": decision.rule_id,
     }
-    dest = Path(path) if path else AUDIT_PATH
+    dest = Path(path) if path else default_audit_path()
     dest.parent.mkdir(parents=True, exist_ok=True)
     with dest.open("a", encoding="utf-8") as fh:
         fh.write(json.dumps(record, ensure_ascii=False) + "\n")
 
 
 def read_audit(path: Path | None = None, limit: int = 20) -> list[dict[str, Any]]:
-    dest = Path(path) if path else AUDIT_PATH
+    dest = Path(path) if path else default_audit_path()
     if not dest.exists():
         return []
     lines = dest.read_text(encoding="utf-8").splitlines()
@@ -114,7 +114,8 @@ def format_audit_table(rows: Iterable[dict[str, Any]]) -> str:
 
 
 def ensure_log_dir() -> None:
-    LOG_DIR.mkdir(parents=True, exist_ok=True)
-    gitkeep = LOG_DIR / ".gitkeep"
+    log_dir = default_log_dir()
+    log_dir.mkdir(parents=True, exist_ok=True)
+    gitkeep = log_dir / ".gitkeep"
     if not gitkeep.exists():
         gitkeep.write_text("", encoding="utf-8")

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/catalog.py

@@ -8,7 +8,7 @@ from datetime import date, timedelta
 from pathlib import Path
 from typing import Any
 
-from write_gate.paths import CATALOG_PATH
+from write_gate.paths import default_catalog_path
 
 
 @dataclass(frozen=True)
@@ -65,7 +65,7 @@ def _table_spec(name: str, raw: dict[str, Any]) -> TableSpec:
 
 
 def load_catalog(path: Path | None = None) -> Catalog:
-    catalog_path = Path(path) if path else CATALOG_PATH
+    catalog_path = Path(path) if path else default_catalog_path()
     with catalog_path.open(encoding="utf-8") as fh:
         raw = json.load(fh)
     tables = {

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/cli.py

@@ -15,7 +15,7 @@ from write_gate.approvals import (
 )
 from write_gate.audit import format_audit_table, read_audit
 from write_gate.decision import ACTION_ALLOW, ACTION_APPROVAL, ACTION_BLOCK, Decision
-from write_gate.paths import APPROVALS_PATH, AUDIT_PATH
+from write_gate.paths import default_approvals_path, default_audit_path
 from write_gate.wrapper import WriteGate
 
 
@@ -51,7 +51,7 @@ def _safe(value: object) -> str:
 
 def _approvals_path(args: argparse.Namespace) -> Path:
     raw = getattr(args, "approvals", None)
-    return Path(raw) if raw else APPROVALS_PATH
+    return Path(raw) if raw else default_approvals_path()
 
 
 def _gate_from_args(args: argparse.Namespace) -> WriteGate:
@@ -358,7 +358,7 @@ def main(argv: list[str] | None = None) -> int:
     args = parser.parse_args(argv)
 
     if args.command == "audit":
-        path = Path(args.audit_path) if args.audit_path else AUDIT_PATH
+        path = Path(args.audit_path) if args.audit_path else default_audit_path()
         rows = read_audit(path, limit=args.limit)
         sys.stdout.write(format_audit_table(rows) + "\n")
         return 0

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/config.py

@@ -8,7 +8,7 @@ from typing import Any
 
 import yaml
 
-from write_gate.paths import POLICY_PATH
+from write_gate.paths import default_policy_path
 
 VALID_RULES = {"allow", "block", "approval"}
 VALID_OPS = ("select", "insert", "update", "delete", "ddl")
@@ -99,7 +99,7 @@ def policy_from_dict(raw: dict[str, Any] | None = None) -> Policy:
 
 
 def load_policy(path: Path | str | None = None) -> Policy:
-    policy_path = Path(path) if path else POLICY_PATH
+    policy_path = Path(path) if path else default_policy_path()
     if not policy_path.exists():
         return policy_from_dict(PRODUCTION_DEFAULTS)
     with policy_path.open(encoding="utf-8") as fh:

sql_write_gate-0.16.1/src/write_gate/paths.py

@@ -0,0 +1,99 @@
+"""Project paths.
+
+Prefer cwd files written by ``sql-write-gate init`` (``./policy.yaml``,
+``./catalog.json``). Only treat ``PACKAGE_DIR.parents[1]`` as a checkout root
+when it looks like the repo (``pyproject.toml`` + ``seed/``). An installed
+wheel must never invent a fake ``seed/`` under ``site-packages``.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+PACKAGE_DIR = Path(__file__).resolve().parent
+
+
+def _find_checkout_root() -> Path | None:
+    # src layout: <root>/src/write_gate/paths.py → parents[1] == <root>
+    candidate = PACKAGE_DIR.parents[1]
+    if (candidate / "pyproject.toml").is_file() and (candidate / "seed").is_dir():
+        return candidate
+    return None
+
+
+CHECKOUT_ROOT = _find_checkout_root()
+# Back-compat: many call sites expect PROJECT_ROOT. When installed, use cwd.
+PROJECT_ROOT = CHECKOUT_ROOT if CHECKOUT_ROOT is not None else Path.cwd()
+
+
+def default_policy_path() -> Path:
+    cwd_path = Path.cwd() / "policy.yaml"
+    if cwd_path.is_file():
+        return cwd_path
+    if CHECKOUT_ROOT is not None:
+        root_path = CHECKOUT_ROOT / "policy.yaml"
+        if root_path.is_file():
+            return root_path
+    return cwd_path
+
+
+def default_catalog_path() -> Path:
+    cwd_path = Path.cwd() / "catalog.json"
+    if cwd_path.is_file():
+        return cwd_path
+    if CHECKOUT_ROOT is not None:
+        seed_cat = CHECKOUT_ROOT / "seed" / "catalog.json"
+        if seed_cat.is_file():
+            return seed_cat
+    return cwd_path
+
+
+def default_db_path() -> Path:
+    if CHECKOUT_ROOT is not None:
+        seed_db = CHECKOUT_ROOT / "seed" / "warehouse.duckdb"
+        if seed_db.is_file():
+            return seed_db
+    return Path.cwd() / "warehouse.duckdb"
+
+
+def default_log_dir() -> Path:
+    if CHECKOUT_ROOT is not None:
+        return CHECKOUT_ROOT / ".logs"
+    return Path.cwd() / ".logs"
+
+
+def default_audit_path() -> Path:
+    return default_log_dir() / "audit.jsonl"
+
+
+def default_approvals_path() -> Path:
+    return default_log_dir() / "approvals.jsonl"
+
+
+# Checkout / demo helpers (tests and make demo run from a clone).
+SEED_DIR = (CHECKOUT_ROOT / "seed") if CHECKOUT_ROOT is not None else (Path.cwd() / "seed")
+EXAMPLES_DIR = (
+    (CHECKOUT_ROOT / "examples") if CHECKOUT_ROOT is not None else (Path.cwd() / "examples")
+)
+EXAMPLES_POLICY_PATH = EXAMPLES_DIR / "policy.yaml"
+DEMO_POLICY_PATH = EXAMPLES_DIR / "policy.demo.yaml"
+EXAMPLES_CATALOG_PATH = EXAMPLES_DIR / "catalog.json"
+ORDERS_CSV = SEED_DIR / "orders.csv"
+
+
+def __getattr__(name: str):
+    """Lazy aliases so ``from write_gate.paths import CATALOG_PATH`` still works.
+
+    Prefer calling ``default_*_path()`` at use time when cwd may change.
+    """
+    mapping = {
+        "POLICY_PATH": default_policy_path,
+        "CATALOG_PATH": default_catalog_path,
+        "DB_PATH": default_db_path,
+        "LOG_DIR": default_log_dir,
+        "AUDIT_PATH": default_audit_path,
+        "APPROVALS_PATH": default_approvals_path,
+    }
+    if name in mapping:
+        return mapping[name]()
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

{sql_write_gate-0.16.0 → sql_write_gate-0.16.1}/src/write_gate/wrapper.py

@@ -24,7 +24,13 @@ from write_gate.catalog import Catalog, load_catalog
 from write_gate.config import Policy, load_policy
 from write_gate.decision import ACTION_ALLOW, ACTION_APPROVAL, Decision, Evidence
 from write_gate.engine import evaluate
-from write_gate.paths import APPROVALS_PATH, AUDIT_PATH, CATALOG_PATH, DB_PATH, POLICY_PATH
+from write_gate.paths import (
+    default_approvals_path,
+    default_audit_path,
+    default_catalog_path,
+    default_db_path,
+    default_policy_path,
+)
 
 __all__ = ["WriteGate", "Evidence", "Decision"]
 
@@ -53,13 +59,15 @@ class WriteGate:
         )
         self.backend = backend
         self.database = target
-        self.db_path = Path(target) if backend == BACKEND_DUCKDB else DB_PATH
-        self.catalog_path = Path(catalog_path) if catalog_path else CATALOG_PATH
+        self.db_path = Path(target) if backend == BACKEND_DUCKDB else default_db_path()
+        self.catalog_path = Path(catalog_path) if catalog_path else default_catalog_path()
         self.catalog = catalog or load_catalog(self.catalog_path)
-        self.policy_path = Path(policy_path) if policy_path else POLICY_PATH
+        self.policy_path = Path(policy_path) if policy_path else default_policy_path()
         self.policy = policy or load_policy(self.policy_path)
-        self.audit_path = Path(audit_path) if audit_path else AUDIT_PATH
-        self.approvals_path = Path(approvals_path) if approvals_path else APPROVALS_PATH
+        self.audit_path = Path(audit_path) if audit_path else default_audit_path()
+        self.approvals_path = (
+            Path(approvals_path) if approvals_path else default_approvals_path()
+        )
         self.agent = agent
         self._conn = conn
         self._owns_conn = conn is None

sql_write_gate-0.16.1/tests/test_installed_init_check.py

@@ -0,0 +1,46 @@
+"""Regression: pip-installed wheel + init + bare check must BLOCK, not FileNotFoundError."""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_wheel_install_init_bare_check(tmp_path):
+    """Build current tree into a wheel, install into a temp venv, init + bare check."""
+    outdir = tmp_path / "dist"
+    outdir.mkdir()
+    subprocess.check_call(
+        [sys.executable, "-m", "pip", "install", "-q", "build"],
+        cwd=str(ROOT),
+    )
+    subprocess.check_call(
+        [sys.executable, "-m", "build", "--wheel", "--outdir", str(outdir)],
+        cwd=str(ROOT),
+    )
+    wheels = sorted(outdir.glob("sql_write_gate-*.whl"))
+    assert wheels, "expected a wheel under temp dist/"
+    wheel = wheels[-1]
+
+    venv = tmp_path / "venv"
+    subprocess.check_call([sys.executable, "-m", "venv", str(venv)])
+    pip = venv / "bin" / "pip"
+    swg = venv / "bin" / "sql-write-gate"
+    subprocess.check_call([str(pip), "install", "-q", str(wheel)])
+
+    proj = tmp_path / "proj"
+    proj.mkdir()
+    subprocess.check_call([str(swg), "init", "--dir", str(proj)], cwd=str(proj))
+    proc = subprocess.run(
+        [str(swg), "check", "DELETE FROM orders"],
+        cwd=str(proj),
+        capture_output=True,
+        text=True,
+    )
+    out = proc.stdout + proc.stderr
+    assert proc.returncode == 2, out
+    assert "delete_without_where" in out
+    assert "FileNotFoundError" not in out

sql_write_gate-0.16.1/tests/test_paths_defaults.py

@@ -0,0 +1,64 @@
+"""Default policy/catalog prefer cwd init files; installed layout has no fake seed/."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import write_gate.paths as paths
+from write_gate.paths import (
+    CHECKOUT_ROOT,
+    default_approvals_path,
+    default_audit_path,
+    default_catalog_path,
+    default_db_path,
+    default_log_dir,
+    default_policy_path,
+)
+
+
+def test_checkout_root_detected_in_dev_tree():
+    assert CHECKOUT_ROOT is not None
+    assert (CHECKOUT_ROOT / "seed" / "catalog.json").is_file()
+    assert (CHECKOUT_ROOT / "pyproject.toml").is_file()
+
+
+def test_find_checkout_root_rejects_site_packages_layout(tmp_path, monkeypatch):
+    fake_pkg = tmp_path / "lib" / "python3.13" / "site-packages" / "write_gate"
+    fake_pkg.mkdir(parents=True)
+    monkeypatch.setattr(paths, "PACKAGE_DIR", fake_pkg)
+    assert paths._find_checkout_root() is None
+
+
+def test_cwd_init_files_win_over_seed(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    (tmp_path / "policy.yaml").write_text("environment: production\nrules: {}\nlimits: {}\n")
+    (tmp_path / "catalog.json").write_text(
+        '{"as_of_date":"2026-09-02","freshness_days":7,"tables":{}}'
+    )
+    assert default_policy_path() == tmp_path / "policy.yaml"
+    assert default_catalog_path() == tmp_path / "catalog.json"
+
+
+def test_installed_layout_defaults_to_cwd(tmp_path, monkeypatch):
+    """Simulate wheel install: package dir without repo seed/ above it."""
+    fake_pkg = tmp_path / "site-packages" / "write_gate"
+    fake_pkg.mkdir(parents=True)
+    monkeypatch.setattr(paths, "PACKAGE_DIR", fake_pkg)
+    monkeypatch.setattr(paths, "CHECKOUT_ROOT", None)
+    work = tmp_path / "proj"
+    work.mkdir()
+    monkeypatch.chdir(work)
+    (work / "policy.yaml").write_text("environment: production\nrules: {}\nlimits: {}\n")
+    (work / "catalog.json").write_text(
+        '{"as_of_date":"2026-09-02","freshness_days":7,"tables":{"orders":{"columns":{},'
+        '"allowed_write_columns":[],"pii_columns":[],"restricted_columns":[]}}}'
+    )
+    assert default_policy_path() == work / "policy.yaml"
+    assert default_catalog_path() == work / "catalog.json"
+    assert default_db_path() == work / "warehouse.duckdb"
+    assert default_log_dir() == work / ".logs"
+    assert default_audit_path() == work / ".logs" / "audit.jsonl"
+    assert default_approvals_path() == work / ".logs" / "approvals.jsonl"
+    # Must not point into site-packages parents
+    assert "site-packages" not in str(default_catalog_path())
+    assert "site-packages" not in str(default_policy_path())

sql_write_gate-0.16.0/src/write_gate/paths.py

@@ -1,20 +0,0 @@
-"""Project paths. Warehouse and catalog live under seed/."""
-
-from pathlib import Path
-
-PACKAGE_DIR = Path(__file__).resolve().parent
-PROJECT_ROOT = PACKAGE_DIR.parents[1]
-SEED_DIR = PROJECT_ROOT / "seed"
-EXAMPLES_DIR = PROJECT_ROOT / "examples"
-LOG_DIR = PROJECT_ROOT / ".logs"
-
-DB_PATH = SEED_DIR / "warehouse.duckdb"
-CATALOG_PATH = SEED_DIR / "catalog.json"
-ORDERS_CSV = SEED_DIR / "orders.csv"
-
-POLICY_PATH = PROJECT_ROOT / "policy.yaml"
-EXAMPLES_POLICY_PATH = EXAMPLES_DIR / "policy.yaml"
-DEMO_POLICY_PATH = EXAMPLES_DIR / "policy.demo.yaml"
-EXAMPLES_CATALOG_PATH = EXAMPLES_DIR / "catalog.json"
-AUDIT_PATH = LOG_DIR / "audit.jsonl"
-APPROVALS_PATH = LOG_DIR / "approvals.jsonl"