Quickstart

Create fix.sub:

needs [
  read  [./src],
  write [./src],
  run   ["npm test", "git commit"],
]

let t = run("npm test")
if (t.failed) {
  let path = t.failing_file
  write(path, fix(read(path), t.output))
  run("git commit -am 'fix failing test'")
}

Then:

sub check fix.sub      # parse and check the permissions
sub explain fix.sub    # what can this script touch, in plain words
sub run fix.sub        # shows the needs block and asks before running

sub explain prints:

fix.sub can
  read   files under ./src
  write  files under ./src
  run    "npm test", "git commit"
fix.sub cannot
  use the network, read other folders, run other commands

What happens when a script goes too far

Add run("git push") and sub check stops with the line, the column and the fix:

fix.sub:9:3  error: this runs "git push" but needs only allows "git commit"
   9 |   run("git push")
     |   ^^^^^^^^^^^^^^^
fix: add "git push" to run [...] in needs, or remove the call

Next