(magpie) 01/01: fix(tools): spell the OSV and CVE.org recipes with the framework runner prefix

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch fix/vetted-ops-recipe-invocation-form
in repository https://gitbox.apache.org/repos/asf/magpie.git

commit 1aae89e5259a159f8ccfe846c797fef1d4b3c5ff
Author: Jarek Potiuk <po...@apache.org>
AuthorDate: Tue Sep 22 23:31:46 2026 +0200

    fix(tools): spell the OSV and CVE.org recipes with the framework runner prefix
    
    The recipes added in #1326 invoke the dispatcher as a bare
    `vetted-op-read …`, but every permission rule and sandbox exclusion in
    the repository spells it with the runner prefix, and
    `tools/vetted-ops/README.md` writes it as `… vetted-op-read` with an
    explicit ellipsis for the variable part. An agent following these
    recipes literally therefore hits a permission prompt or a sandboxed
    run — the same recipe-versus-baseline mismatch #1320 set out to close,
    in a new spelling.
    
    The framework already has a settled convention for addressing its own
    `tools/<name>/` subtrees: `uv run --project <framework>/tools/<name>`,
    used by `privacy-llm`, `reproducible-archive` and others, with
    `<framework>` resolved per the placeholder table in AGENTS.md. These
    nine recipes were the outlier rather than a new question, so they now
    match it.
    
    Generated-by: Claude Opus 5
---
 plugins/magpie-security/skills/issue-sync/gather.md |  2 +-
 tools/cve-org/tool.md                               |  4 ++--
 tools/osv/tool.md                                   | 12 ++++++------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/plugins/magpie-security/skills/issue-sync/gather.md b/plugins/magpie-security/skills/issue-sync/gather.md
index 94ba3e6e..320dd955 100644
--- a/plugins/magpie-security/skills/issue-sync/gather.md
+++ b/plugins/magpie-security/skills/issue-sync/gather.md
@@ -767,7 +767,7 @@ Concretely, for each closed-`announced` tracker in this run:
    already read).
 2. Call the API:
    ```bash
-   vetted-op-read --caller security-issue-sync cve-check-published <CVE-ID> \
+   uv run --project <framework>/tools/vetted-ops vetted-op-read --caller security-issue-sync cve-check-published <CVE-ID> \
      | jq -r '{state: .cveMetadata.state, datePublished: .cveMetadata.datePublished}'
    ```
 3. Interpret:
diff --git a/tools/cve-org/tool.md b/tools/cve-org/tool.md
index 361dea31..9af4dbf8 100644
--- a/tools/cve-org/tool.md
+++ b/tools/cve-org/tool.md
@@ -66,7 +66,7 @@ Recipe:
 
 ```bash
 # Read-only, no auth required. Returns JSON.
-vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
   | jq -r '.cveMetadata.state'
 ```
 
@@ -90,7 +90,7 @@ Extract the `datePublished` alongside the state when you need to
 print *"published on YYYY-MM-DD"* in the reporter email:
 
 ```bash
-vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> cve-check-published <CVE-ID> \
   | jq -r '{state: .cveMetadata.state, datePublished: .cveMetadata.datePublished}'
 ```
 
diff --git a/tools/osv/tool.md b/tools/osv/tool.md
index 4cfe7716..e983da0f 100644
--- a/tools/osv/tool.md
+++ b/tools/osv/tool.md
@@ -66,13 +66,13 @@ Fetch the OSV JSON record by its primary ID (or alias):
 
 ```bash
 # Read-only, unauthenticated. Returns complete OSV schema JSON.
-vetted-op-read --caller <caller> osv-get-vuln <ID>
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln <ID>
 ```
 
 Extracting alias identifiers (e.g., resolving a GHSA ID to corresponding CVE IDs):
 
 ```bash
-vetted-op-read --caller <caller> osv-get-vuln GHSA-7rjr-3q55-vv33 \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln GHSA-7rjr-3q55-vv33 \
   | jq -r '{id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -90,7 +90,7 @@ Example JSON response:
 Extracting affected version ranges and fixed versions:
 
 ```bash
-vetted-op-read --caller <caller> osv-get-vuln <ID> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-get-vuln <ID> \
   | jq -r '.affected[] | {package: .package.name, ecosystem: .package.ecosystem, fixed: [.ranges[].events[] | select(.fixed != null) | .fixed]}'
 ```
 
@@ -99,7 +99,7 @@ vetted-op-read --caller <caller> osv-get-vuln <ID> \
 Check if a given package release is subject to any known advisories:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-package jinja2 PyPI 2.11.2 \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-package jinja2 PyPI 2.11.2 \
   | jq -r '.vulns[]? | {id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -110,7 +110,7 @@ Common ecosystems: `PyPI`, `Maven`, `npm`, `crates.io`, `Go`, `Packagist`, `NuGe
 Check if a public upstream commit SHA is indexed in OSV as a fix or vulnerability reference:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
   | jq -r '.vulns[]? | {id: .id, aliases: .aliases, summary: .summary}'
 ```
 
@@ -119,7 +119,7 @@ vetted-op-read --caller <caller> osv-query-commit <COMMIT_HASH> \
 Evaluate multiple dependencies in a single round-trip:
 
 ```bash
-vetted-op-read --caller <caller> osv-query-batch /tmp/agent-scratch/batch.json \
+uv run --project <framework>/tools/vetted-ops vetted-op-read --caller <caller> osv-query-batch /tmp/agent-scratch/batch.json \
   | jq -r '.results | to_entries[] | {query: .key, vuln_count: ((.value.vulns // []) | length)}'
 ```