You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by po...@apache.org on 2026/09/22 21:36:24 UTC
(magpie) branch fix/vetted-ops-recipe-invocation-form created (now 1aae89e5)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a change to branch fix/vetted-ops-recipe-invocation-form
in repository https://gitbox.apache.org/repos/asf/magpie.git
at 1aae89e5 fix(tools): spell the OSV and CVE.org recipes with the framework runner prefix
This branch includes the following new commits:
new 1aae89e5 fix(tools): spell the OSV and CVE.org recipes with the framework runner prefix
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(magpie) 01/01: fix(tools): spell the OSV and CVE.org recipes with the framework runner prefix
Posted by po...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch fix/vetted-ops-recipe-invocation-form
in repository https://gitbox.apache.org/repos/asf/magpie.git
commit 1aae89e5259a159f8ccfe846c797fef1d4b3c5ff
Author: Jarek Potiuk <po...@apache.org>
AuthorDate: Tue Sep 22 23:31:46 2026 +0200
fix(tools): spell the OSV and CVE.org recipes with the framework runner prefix
The recipes added in #1326 invoke the dispatcher as a bare
`vetted-op-read …`, but every permission rule and sandbox exclusion in
the repository spells it with the runner prefix, and
`tools/vetted-ops/README.md` writes it as `… vetted-op-read` with an
explicit ellipsis for the variable part. An agent following these
recipes literally therefore hits a permission prompt or a sandboxed
run — the same recipe-versus-baseline mismatch #1320 set out to close,
in a new spelling.
The framework already has a settled convention for addressing its own
`tools/<name>/` subtrees: `uv run --project <framework>/tools/<name>`,
used by `privacy-llm`, `reproducible-archive` and others, with
`<framework>` resolved per the placeholder table in AGENTS.md. These
nine recipes were the outlier rather than a new question, so they now
match it.
Generated-by: Claude Opus 5
---
plugins/magpie-security/skills/issue-sync/gather.md | 2 +-
tools/cve-org/tool.md | 4 ++--
tools/osv/tool.md | 12 ++++++------
3 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/plugins/magpie-security/skills/issue-sync/gather.md b/plugins/magpie-security/skills/issue-sync/gather.md
index 94ba3e6e..320dd955 100644
--- a/plugins/magpie-security/skills/issue-sync/gather.md
+++ b/plugins/magpie-security/skills/issue-sync/gather.md
@@ -767,7 +767,7 @@ Concretely, for each closed-`announced` tracker in this run:
already read).
2. Call the API:
```bash
- vetted-op-read --caller security-issue-sync cve-check-published <CVE-ID> \
+ uv run --project <framework>/tools/vetted-ops vetted-op-read --caller security-issue-sync cve-check-published <CVE-ID> \
| jq -r '{state: .cveMetadata.state, datePublished: .cveMetadata.datePublished}'
```
3. Interpret:
diff --git a/tools/cve-org/tool.md b/tools/cve-org/tool.md
index 361dea31..9af4dbf8 100644
--- a/tools/cve-org/tool.md
+++ b/tools/cve-org/tool.md
@@ -66,7 +66,7 @@ Recipe:
```bash
# Read-only, no auth required. Returns JSON.
-vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
| jq -r '.cveMetadata.state'
```
@@ -90,7 +90,7 @@ Extract the `datePublished` alongside the state when you need to
print *"published on YYYY-MM-DD"* in the reporter email:
```bash
-vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
| jq -r '{state: .cveMetadata.state, datePublished: .cveMetadata.datePublished}'
```
diff --git a/tools/osv/tool.md b/tools/osv/tool.md
index 4cfe7716..e983da0f 100644
--- a/tools/osv/tool.md
+++ b/tools/osv/tool.md
@@ -66,13 +66,13 @@ Fetch the OSV JSON record by its primary ID (or alias):
```bash
# Read-only, unauthenticated. Returns complete OSV schema JSON.
-vetted-op-read --caller <caller> osv-get-vuln <ID>
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln <ID>
```
Extracting alias identifiers (e.g., resolving a GHSA ID to corresponding CVE IDs):
```bash
-vetted-op-read --caller <caller> osv-get-vuln GHSA-7rjr-3q55-vv33 \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln GHSA-7rjr-3q55-vv33 \
| jq -r '{id: .id, aliases: .aliases, summary: .summary}'
```
@@ -90,7 +90,7 @@ Example JSON response:
Extracting affected version ranges and fixed versions:
```bash
-vetted-op-read --caller <caller> osv-get-vuln <ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln <ID> \
| jq -r '.affected[] | {package: .package.name, ecosystem: .package.ecosystem, fixed: [.ranges[].events[] | select(.fixed != null) | .fixed]}'
```
@@ -99,7 +99,7 @@ vetted-op-read --caller <caller> osv-get-vuln <ID> \
Check if a given package release is subject to any known advisories:
```bash
-vetted-op-read --caller <caller> osv-query-package jinja2 PyPI 2.11.2 \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-package jinja2 PyPI 2.11.2 \
| jq -r '.vulns[]? | {id: .id, aliases: .aliases, summary: .summary}'
```
@@ -110,7 +110,7 @@ Common ecosystems: `PyPI`, `Maven`, `npm`, `crates.io`, `Go`, `Packagist`, `NuGe
Check if a public upstream commit SHA is indexed in OSV as a fix or vulnerability reference:
```bash
-vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
| jq -r '.vulns[]? | {id: .id, aliases: .aliases, summary: .summary}'
```
@@ -119,7 +119,7 @@ vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
Evaluate multiple dependencies in a single round-trip:
```bash
-vetted-op-read --caller <caller> osv-query-batch /tmp/agent-scratch/batch.json \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-batch /tmp/agent-scratch/batch.json \
| jq -r '.results | to_entries[] | {query: .key, vuln_count: ((.value.vulns // []) | length)}'
```