# sigmashake-ssg

Cargo distribution channel for [ssg](https://sigmashake.com) — the AI Agent Governance CLI that evaluates tool calls against rules and blocks dangerous operations across Claude Code, Cursor, Copilot, Gemini, and other MCP-compatible AI coding agents.

## Why the `sigmashake-` prefix?

The bare `ssg` name on crates.io belongs to an unrelated, abandoned project (last release 0.0.8 from 2019). Rather than try to reclaim it, the Cargo distribution channel ships under `sigmashake-ssg`. The installed binary is still called `ssg` and ends up on your `PATH` as `~/.cargo/bin/ssg` — only the crate name is namespaced.

## Install

**Preferred — `cargo binstall` (no compilation, ~5s):**

```bash
cargo binstall sigmashake-ssg
```

This downloads the prebuilt binary from [github.com/sigmashakeinc/ssg releases](https://github.com/sigmashakeinc/ssg/releases) and drops it at `~/.cargo/bin/ssg`. Same artifact distributed via `npm i -g @sigmashake/ssg` and `pip install sigmashake` — identical hash, same Authenticode/codesign signatures on Windows/macOS.

**Fallback — `cargo install` (compiles a small wrapper, ~30s):**

```bash
cargo install sigmashake-ssg
```

The compiled binary is a thin Rust wrapper. On first invocation it fetches the matching `ssg-<platform>` archive from the GitHub release, caches the extracted binary at `~/.cache/sigmashake-ssg/<version>/`, and execs into it. Subsequent runs hit the cache.

## Supported platforms

| Rust target | GitHub asset |
|---|---|
| `x86_64-unknown-linux-gnu`, `x86_64-unknown-linux-musl` | `ssg-linux-x64.tar.gz` |
| `aarch64-unknown-linux-gnu`, `aarch64-unknown-linux-musl` | `ssg-linux-arm64.tar.gz` |
| `x86_64-apple-darwin` | `ssg-darwin-x64.tar.gz` |
| `aarch64-apple-darwin` | `ssg-darwin-arm64.tar.gz` |
| `x86_64-pc-windows-msvc`, `x86_64-pc-windows-gnu` | `ssg-win32-x64.zip` |

## Verify the install

```bash
ssg --version
ssg init
```

Full CLI reference: <https://docs.sigmashake.com/cli>.

## Other distribution channels

| Channel | Install |
|---|---|
| npm | `npm i -g @sigmashake/ssg` |
| PyPI | `pip install sigmashake` |
| Homebrew | `brew install sigmashakeinc/tap/ssg` |
| winget | `winget install SigmaShake.SSG` |
| apt | `apt install sigmashake-ssg` (see apt.sigmashake.com) |
| Flatpak | `flatpak install sigmashake com.sigmashake.SSG` |
| Docker | `docker run ghcr.io/sigmashakeinc/ssg:latest` |
| Direct | `curl -fsSL sigmashake.com/cli/install.sh \| sh` |

## Note on the native engine deprecation

`sigmashake-ssg` is a **distribution channel** (installer / cargo-binstall wrapper)
for the prebuilt `ssg` binary. It is **not** the evaluation engine, and it is
**unaffected** by the native Rust/Zig engine deprecation.

The Zig/Rust eval engine (`native/src/engine.zig`, `native/rust-sidecar/`) has been
replaced by the pure-Go in-process engine (`go/internal/goengine`) in the ssg binary
itself. The binary you download via `cargo binstall sigmashake-ssg` or `cargo install
sigmashake-ssg` already embeds the Go engine by default. The crate's own Rust source
(the thin fetch-and-exec wrapper) is not the engine and does not need to change.

`SSG_EVAL_ENGINE=sidecar` opts back to the deprecated native chain for one transition
release; no env var change needed for normal users.

## License

Proprietary. See <https://docs.sigmashake.com/policies/license>.
