@erclx/canon 5.41.0 → 5.43.0

package/src/sync/check.ts

@@ -38,6 +38,7 @@ import {
   resolveChain,
 } from '@/tooling/manifest'
 import { scan } from '@/tooling/scan'
+import { isAddOn } from '@/tooling/stamp'
 import { readSkew, type SkewReport } from '@/version/skew'
 
 /**
@@ -302,6 +303,20 @@ export function buildToolingReport(
 function resolveRecorded(
   toolkitRoot: string,
   recorded: readonly string[],
+): Manifest[] {
+  const addOns = recorded
+    .map((name) => loadManifest(toolkitRoot, name))
+    .filter((manifest) => manifest !== undefined)
+    .filter(isAddOn)
+  const addOnNames = new Set(addOns.map((manifest) => manifest.name))
+  const core = recorded.filter((name) => !addOnNames.has(name))
+
+  return [...resolveCore(toolkitRoot, core), ...addOns]
+}
+
+function resolveCore(
+  toolkitRoot: string,
+  recorded: readonly string[],
 ): Manifest[] {
   const loaded = recorded
     .map((name) => loadManifest(toolkitRoot, name))

package/src/tooling/stamp.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { writeChainStamp } from '@/sync/stamp'
-import { isWholeStack, type Manifest } from '@/tooling/manifest'
+import { readStamp, stampedChain, writeChainStamp } from '@/sync/stamp'
+import { isWholeStack, loadManifest, type Manifest } from '@/tooling/manifest'
 import { readPackage } from '@/tooling/package'
 
 /**
@@ -17,7 +17,9 @@ export function isWorkspaceRoot(target: string): boolean {
 }
 
 /**
- * Records the chain an install resolved, and returns whether it wrote one. A
+ * Records the chain an install resolved, and returns the names it wrote, or
+ * nothing when it wrote none. The names are the merged list, which can carry
+ * stacks an earlier sync recorded. A
  * workspace root is the single refusal: one chain recorded there would be a
  * guess at what its packages hold, and the report reading tooling as unmeasured
  * is the true answer rather than a clean one.
@@ -27,16 +29,58 @@ export async function recordToolingChain(
   target: string,
   chain: readonly Manifest[],
   now: Date,
-): Promise<boolean> {
-  if (isWorkspaceRoot(target)) return false
-
-  await writeChainStamp(
-    target,
-    { domain: 'tooling', toolkitRoot },
-    recordedStacks(chain),
-    now,
+): Promise<string[] | undefined> {
+  if (isWorkspaceRoot(target)) return undefined
+
+  const merged = mergeAddOns(
+    toolkitRoot,
+    stampedChain(readStamp(target), 'tooling'),
+    chain,
   )
-  return true
+  await writeChainStamp(target, { domain: 'tooling', toolkitRoot }, merged, now)
+  return merged
+}
+
+/**
+ * An add-on stands alone beside a core chain, so syncing one must not displace
+ * the chain it layers onto. Base extends nothing and still heads a core chain.
+ */
+export function isAddOn(manifest: Manifest | undefined): boolean {
+  return (
+    manifest !== undefined &&
+    manifest.parent === undefined &&
+    manifest.name !== 'base'
+  )
+}
+
+/**
+ * Merges what this sync resolved into what an earlier one recorded. The core
+ * chain is the one just synced, or the recorded one when only add-ons synced.
+ * Add-ons accumulate after it, so a later stackless report measures them all.
+ */
+function mergeAddOns(
+  toolkitRoot: string,
+  recorded: readonly string[],
+  chain: readonly Manifest[],
+): string[] {
+  const synced = chain.filter(isWholeStack)
+  const syncedCore = synced.filter((m) => !isAddOn(m)).map((m) => m.name)
+  const syncedAddOns = synced.filter(isAddOn).map((m) => m.name)
+
+  const recordedManifests = recorded.map((name) => ({
+    name,
+    manifest: loadManifest(toolkitRoot, name),
+  }))
+  const recordedCore = recordedManifests
+    .filter(({ manifest }) => !isAddOn(manifest))
+    .map(({ name }) => name)
+  const recordedAddOns = recordedManifests
+    .filter(({ manifest }) => isAddOn(manifest))
+    .map(({ name }) => name)
+
+  const core = syncedCore.length > 0 ? syncedCore : recordedCore
+  const addOns = [...new Set([...recordedAddOns, ...syncedAddOns])]
+  return [...core, ...addOns]
 }
 
 /**

package/src/worktrees/stop.ts

@@ -0,0 +1,92 @@
+import { realpath } from 'node:fs/promises'
+import { belongsTo } from '@/listeners/belongs'
+import type { ListenerReader } from '@/listeners/machine'
+
+/** What a stop took, or would take on a dry run, from one worktree. */
+export interface StoppedServer {
+  readonly path: string
+  readonly pids: readonly number[]
+  readonly ports: readonly number[]
+}
+
+/**
+ * `unread` is a machine with no way to list sockets, which a reader must tell
+ * apart from `read` with nothing stopped, since the first says nothing about
+ * what is still listening.
+ */
+export type StopReport =
+  | { readonly kind: 'read'; readonly stopped: readonly StoppedServer[] }
+  | { readonly kind: 'unread' }
+
+export interface StopOptions {
+  readonly reader: ListenerReader
+  /** Sends SIGTERM and says whether it landed, so a pid that already exited is not counted. */
+  readonly kill?: (pid: number) => boolean
+  readonly dryRun: boolean
+}
+
+function sigterm(pid: number): boolean {
+  try {
+    process.kill(pid, 'SIGTERM')
+    return true
+  } catch {
+    return false
+  }
+}
+
+/** A process cwd reads back resolved, so a path held through a symlink has to be too. */
+async function resolved(path: string): Promise<string> {
+  return realpath(path).catch(() => path)
+}
+
+/**
+ * Stops every server listening from inside one of the worktrees about to be
+ * removed, so none outlives the directory it serves. Each path is tested by the
+ * nesting rule `canon pr local` uses, so a listener in the main checkout or in
+ * a sibling under `.claude/worktrees/` is never signaled. The cwd is read
+ * against the given paths and never against `process.cwd()`, which a run from
+ * inside another worktree would otherwise make the only match.
+ */
+export async function stopListeners(
+  paths: readonly string[],
+  opts: StopOptions,
+): Promise<StopReport> {
+  const listeners = await opts.reader.listListeners()
+  if (listeners === undefined) return { kind: 'unread' }
+
+  const kill = opts.kill ?? sigterm
+  const roots = await Promise.all(paths.map(resolved))
+  const cwdByPid = new Map<number, string | undefined>()
+  const stopped: StoppedServer[] = []
+
+  for (const [index, root] of roots.entries()) {
+    const pids = new Set<number>()
+    const ports = new Set<number>()
+    for (const { pid, port } of listeners) {
+      if (!cwdByPid.has(pid)) cwdByPid.set(pid, await opts.reader.cwdOf(pid))
+      const cwd = cwdByPid.get(pid)
+      if (cwd === undefined || !belongsTo(cwd, root)) continue
+      pids.add(pid)
+      ports.add(port)
+    }
+
+    const landed = [...pids]
+      .sort((a, b) => a - b)
+      .filter((pid) => opts.dryRun || kill(pid))
+    if (landed.length === 0) continue
+    const landedSet = new Set(landed)
+    stopped.push({
+      path: paths[index] ?? root,
+      pids: landed,
+      ports: [
+        ...new Set(
+          listeners
+            .filter(({ pid, port }) => landedSet.has(pid) && ports.has(port))
+            .map(({ port }) => port),
+        ),
+      ].sort((a, b) => a - b),
+    })
+  }
+
+  return { kind: 'read', stopped }
+}

package/tooling/base/configs/.github/workflows/phase-label-gate.yml

@@ -11,14 +11,18 @@ on:
     types: [submitted, edited]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   phase-label-gate:
     name: 🏷️ Phase Label Gate
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.base.ref == 'main'
+    # Dependabot bodies carry upstream release notes that read as phase labels
+    if: github.event.pull_request.user.login != 'dependabot[bot]' && (github.event_name == 'workflow_dispatch' || github.event.pull_request.base.ref == 'main')
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

package/tooling/base/configs/commitlint.config.js

@@ -22,38 +22,18 @@ const subjectFirstWordCase = (parsed) => {
   ]
 }
 
-const CO_AUTHOR_TRAILER = /^co-authored-by:/i
-const CLAUDE_OR_ANTHROPIC = /\b(claude|anthropic)\b/i
-
-// Reads raw rather than footer, since the parser files a lone trailer under
-// body and leaves footer null.
-const noClaudeCoAuthor = (parsed) => {
-  const offending = (parsed.raw ?? '')
-    .split('\n')
-    .find(
-      (line) => CO_AUTHOR_TRAILER.test(line) && CLAUDE_OR_ANTHROPIC.test(line),
-    )
-
-  return [
-    offending === undefined,
-    `remove the co-author trailer crediting Claude or Anthropic: ${offending}`,
-  ]
-}
-
 const config = {
   extends: ['@commitlint/config-conventional'],
   plugins: [
     {
       rules: {
         'subject-first-word-case': subjectFirstWordCase,
-        'no-claude-co-author': noClaudeCoAuthor,
       },
     },
   ],
   rules: {
     'subject-case': [0],
     'subject-first-word-case': [2, 'always'],
-    'no-claude-co-author': [2, 'always'],
     'header-max-length': [2, 'always', 72],
     'scope-case': [2, 'always', 'lower-case'],
     'subject-full-stop': [2, 'never', '.'],

package/tooling/base/reference.md

@@ -17,7 +17,7 @@ Two configs fix how output looks and how commits read.
 - `.oxfmtrc.json` sets `semi: false`, `singleQuote: true`, `printWidth: 80`, and `sortPackageJson: false`, keeping the output Prettier wrote.
 - The `astro` stack repeats those options in its own copy, so copy a change here into it.
 - `commitlint.config.js` is an ESM default export extending `@commitlint/config-conventional`. It sets `header-max-length: 72`, `scope-case: lower-case`, and `subject-full-stop: never`.
-- Its `subject-case` rule is off, and a local `no-claude-co-author` rule refuses a `Co-authored-by` trailer that names Claude or Anthropic.
+- Its `subject-case` rule is off.
 - `.husky/` holds `pre-commit`, `commit-msg`, `pre-push`, `post-merge`, and `post-rewrite`.
 
 ### Verify runner

package/tooling/base/seeds/.github/workflows/verify.yml

@@ -6,13 +6,16 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   static-checks:
     name: 🛡️ Static Checks
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2

package/tooling/claude/reference.md

@@ -57,11 +57,11 @@ The `# Claude` group holds three entries, being `.canon/`, `.claude/worktrees/`,
 
 ## CLI
 
-| Command              | What it does                                                                                                                    |
-| -------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
-| `canon claude init`  | Seeds `.claude/` workflow docs, updates `.gitignore`                                                                            |
-| `canon claude sync`  | Reconciles `.gitignore` against the manifest. Reports seeded file status.                                                       |
-| `canon claude setup` | Installs user-level config to `~/.claude/` once per machine: statusline, attribution, and the permissions allow and deny lists. |
+| Command              | What it does                                                                                                                                                                     |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `canon claude init`  | Seeds `.claude/` workflow docs, updates `.gitignore`                                                                                                                             |
+| `canon claude sync`  | Reconciles `.gitignore` against the manifest. Reports seeded file status.                                                                                                        |
+| `canon claude setup` | Installs user-level config to `~/.claude/` once per machine: statusline and the permissions allow and deny lists, and removes the empty attribution pair an earlier setup wrote. |
 
 ## CLAUDE.md
 
@@ -85,11 +85,17 @@ The seed at `tooling/claude/seeds/.claude/settings.json` ships hooks that pair w
 - A PostToolUse hook pairs with `standards-audit.sh`.
 - Project settings layer over user settings, so a project file carries only what is project-specific.
 
+### Session defaults
+
+The seed also sets two defaults every session in the target runs under.
+
+- `permissions.deny` holds `Agent` and `Task`, so no session spawns a subagent. Parallel work runs as separate background sessions instead.
+- `autoMemoryEnabled` is `false`. A person turns it back on for themselves in `settings.local.json`.
+- `canon migrate session-defaults` adds both to a target seeded before them, since sync never rewrites an existing settings file.
+
 ### User template
 
 The template at `tooling/claude/user/settings.template.json` is installed once per machine by `canon claude setup`.
 
-- It sets `attribution.commit` and `attribution.pr` to empty strings to suppress co-author tags.
 - It allows `Bash(bun run *)` under `permissions.allow`.
 - Its `permissions.deny` holds `Read(**/.env)` and `Read(**/.env.*)`, blocking accidental secret exposure across any project.
-- The deprecated `includeCoAuthoredBy` key is not used.

package/tooling/claude/seeds/.claude/settings.json

@@ -1,4 +1,8 @@
 {
+  "autoMemoryEnabled": false,
+  "permissions": {
+    "deny": ["Agent", "Task"]
+  },
   "hooks": {
     "PreToolUse": [
       {

package/tooling/claude/user/settings.template.json

@@ -1,8 +1,4 @@
 {
-  "attribution": {
-    "commit": "",
-    "pr": ""
-  },
   "permissions": {
     "allow": ["Bash(bun run *)"],
     "deny": ["Read(**/.env)", "Read(**/.env.*)"]

package/tooling/cloudflare/configs/.github/workflows/deploy.yml

@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -50,7 +50,7 @@ jobs:
         run: bun run build
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: dist
           path: dist
@@ -84,7 +84,7 @@ jobs:
       # as dead weight breaks the deploy on every push.
       - name: Checkout
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Bun
         if: steps.secrets-check.outputs.skip == 'false'
@@ -94,7 +94,7 @@ jobs:
 
       - name: Download artifact
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: dist
           path: dist
@@ -104,7 +104,7 @@ jobs:
       - name: Publish
         id: publish
         if: steps.secrets-check.outputs.skip == 'false'
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@v4
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}

package/tooling/public/configs/.github/dependabot.yml

@@ -0,0 +1,12 @@
+# canon-no-seed: an add-on stack's config with no root counterpart by design.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+    groups:
+      actions:
+        update-types: [minor, patch]

package/tooling/public/configs/.github/workflows/release-please.yml

@@ -0,0 +1,30 @@
+name: Release
+# canon-no-seed: an add-on stack's workflow with no root counterpart by design, since the toolkit cuts its own releases through its own workflow.
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  release-please:
+    name: 🏷️ Release Please
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+    # Queues rather than cancels, since a cancel can land after the release exists and before its outputs do
+    concurrency:
+      group: release-please
+      cancel-in-progress: false
+    steps:
+      - name: Release Please
+        uses: googleapis/release-please-action@v5
+        with:
+          # A personal token lets CI run on the release pull request, which the default token's bot author does not
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

package/tooling/public/manifest.toml

@@ -0,0 +1,8 @@
+[stack]
+name = "public"
+extends = ""
+runtime = "bun"
+scaffold = ""
+
+[sync]
+source = "configs"

package/tooling/public/reference.md

@@ -0,0 +1,53 @@
+# Tooling public reference
+
+## Overview
+
+The public stack is an add-on that ships the open-source files a public repository carries. It extends nothing and syncs beside any other stack at the same root with `canon tooling sync public . --write`.
+
+## Seeds
+
+A seed is copied only when its path is absent, so a project's filled `LICENSE`, `SECURITY.md`, or `CONTRIBUTING.md` is never overwritten. Fill each `<placeholder>` after the first sync.
+
+### Policy files
+
+These three name the project's owner and terms.
+
+- Use MIT for `LICENSE`, which needs a year and a holder. Swap the text by hand for a different license.
+- Point `SECURITY.md` and the issue chooser at GitHub private vulnerability reporting only, with no email.
+- Switch private reporting on under the repository's Settings, Code security.
+- Ship no `CODE_OF_CONDUCT.md`. Add one when outside contributors arrive.
+
+### Issue forms
+
+`bug.yml`, `feature.yml`, and `config.yml` turn blank issues off.
+
+- Add fields specific to the project, such as its CLI's version command, by hand.
+
+### Release files
+
+These two start release-please at version zero.
+
+- Start `release-please-config.json` on the `simple` release type, with `initial-version` `0.0.1` and `bump-minor-pre-major` on.
+- Switch the type and add `extra-files` for a package that carries its version in a manifest.
+- Start `.release-please-manifest.json` at `0.0.0`.
+
+## Release workflow
+
+`release-please.yml` is a config, so each sync overwrites it and a fix reaches every public repository.
+
+- Run it on every push to `main`. It keeps one release pull request open and tags the release when that pull request merges.
+- Publish nothing. A project that publishes a package adds its own workflow keyed on the release, and never edits this one.
+- Open the release pull request with `RELEASE_PLEASE_TOKEN` when the secret exists, and fall back to the default token otherwise.
+- Set the secret to a personal token so CI runs on the release pull request, since the default token's author does not start it.
+- Keep the token read-only at the top, with `contents: write` and `pull-requests: write` on the one job.
+
+## Dependabot
+
+`dependabot.yml` is how an existing repository keeps its seeded workflows' action majors current, since a seed never updates after install.
+
+- Update `github-actions` weekly with an `ci` commit prefix.
+- Group minor and patch updates into one pull request per run, and leave majors ungrouped so each arrives alone.
+
+## Beside another stack
+
+Run `canon tooling sync public . --write` on a repository that already carries a stack. The install stamp keeps the core chain and lists the add-on after it.

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,48 @@
+name: Bug report
+description: Something does not work as expected
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What you did, what you expected, and what happened instead.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Run `<command>`
+        2. ...
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: The smallest input that shows the problem. Paste it, or link a repository or gist.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: The release or commit you ran.
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime and version
+      placeholder: Node 22.12.0, or Bun 1.3.0
+    validations:
+      required: true
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      placeholder: macOS 26.1, Windows 11, Ubuntu 24.04
+    validations:
+      required: true

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/<owner>/<repo>/security/advisories/new
+    about: Report it privately rather than in a public issue.

package/tooling/public/seeds/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,16 @@
+name: Feature request
+description: Suggest something this project should do
+labels: [enhancement]
+body:
+  - type: textarea
+    id: job
+    attributes:
+      label: The job
+      description: What you were trying to get done when the project fell short, and how you work around it today.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like
+      description: The behavior you have in mind, if you have one.

package/tooling/public/seeds/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.0.0"
+}

package/tooling/public/seeds/CONTRIBUTING.md

@@ -0,0 +1,50 @@
+# Contributing to <project>
+
+This page covers getting a working checkout, how to test a change, and the commit and pull request rules the hooks enforce.
+
+## Setup
+
+<Prerequisites, such as the runtime and its minimum version.>
+
+```bash
+git clone https://github.com/<owner>/<repo>.git
+cd <repo>
+<install command>
+<check command>
+```
+
+<What the install step activates, such as git hooks, and what the check command runs.>
+
+## Layout
+
+| Path     | What it holds |
+| -------- | ------------- |
+| `<path>` | <role>        |
+
+## Tests
+
+<The commands that run the tests and what each one covers.>
+
+## Commit messages
+
+Commits follow [Conventional Commits](https://www.conventionalcommits.org), and release-please reads them to cut each release.
+
+- The header reads `<type>(<scope>): <subject>`, such as `fix(server): close the socket on shutdown`
+- The header is at most 72 characters
+- The first word of the subject is lowercase, and the subject ends with no period
+
+The types are `feat`, `fix`, `refactor`, `docs`, `chore`, `perf`, `test`, `style`, `build`, `ci`, and `revert`.
+
+## Pull requests
+
+Branch from `main` and open the pull request against it. Say what the change does and why, which files it touches, and how you tested it.
+
+CI runs on every pull request, and a pull request merges once it passes. Keep each one to a single concern. A refactor that a feature needs reads better as its own pull request ahead of the feature.
+
+## Releases
+
+release-please cuts every release from the conventional commits on `main`. Each push to `main` keeps one release pull request open, holding the next version and its `CHANGELOG.md` entry. Merging that pull request tags the release.
+
+## AI-assisted contributions
+
+Contributions written with a coding agent are welcome. You are the author of what you submit, so read every line before you open the pull request and be ready to explain it.

package/tooling/public/seeds/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) <year> <holder>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.