selfguard 0.1.0 → 0.2.0

package/README.md

@@ -1,155 +1,136 @@
 # selfguard
 
-A local-first guard for the dependencies of **every** JavaScript repo you work on.
-
-- **Hands-off**: `cd` into a project and selfguard registers it and scans it in the background.
-  Run `npm install` and it notices that the lockfile changed and re-scans.
-- **Reverse alerts**: `selfguard sync` (or the scheduled job) re-checks all your projects against
-  new advisories. You get a macOS notification when a repo you haven't opened in months becomes vulnerable.
-- **Malicious packages first**: OSV includes the OpenSSF malicious-packages feed (`MAL-*`), so
-  compromised releases (Shai-Hulud style) are flagged above any CVE.
-- **Incident response**: `selfguard where <pkg>` answers "do I use this anywhere?" in one command.
+[![npm](https://img.shields.io/npm/v/selfguard)](https://www.npmjs.com/package/selfguard)
+[![CI](https://github.com/josseed/selfguard/actions/workflows/ci.yml/badge.svg)](https://github.com/josseed/selfguard/actions/workflows/ci.yml)
+[![provenance](https://img.shields.io/badge/npm-provenance-blue)](https://www.npmjs.com/package/selfguard#provenance)
+[![license](https://img.shields.io/npm/l/selfguard)](LICENSE)
+
+**A local-first guard for the dependencies of every JavaScript repo on your machine.**
+
+Most dependency scanners only check a project when you remember to run them, or only for repos
+hosted on a platform. selfguard tracks every project on your machine and checks their lockfiles
+against [OSV.dev](https://osv.dev). It tells you when one of them is affected by a new
+vulnerability or a malicious package, including repos you haven't opened in months.
+
+```text
+$ selfguard status
+CRITICAL acme/storefront  31 vulnerable pkg(s) on main · 82 on feat/checkout  3 checkouts
+   ├ main  31 vulnerable  ~/code/storefront
+   ├ fix/query-perf worktree  30 vulnerable  ~/code/storefront-query-perf
+   └ feat/checkout worktree  82 vulnerable  ~/code/storefront-feat-checkout
+HIGH     acme/payments-api  3 vulnerable pkg(s)  ~/code/payments-api
+✓        acme/docs-site  clean  ~/code/docs-site
+```
 
-## Install
+## Features
+
+- **It tells you on its own.** A background watcher re-checks a repo seconds after its lockfile
+  changes (`git pull`, installs, merges), a scheduled sync catches newly published advisories,
+  and a daily reminder lists what is still open and serious. When you fix something, you get a
+  "✓ fixed" notification too.
+- **A dashboard, not just a terminal.** `selfguard ui` opens a local page with every repo, what
+  needs attention, how to fix it, and a feed of what changed.
+- **Signal over noise.** Only checkouts with recent git activity alert you. Old clones and
+  abandoned worktrees stay listed but quiet (except for malicious packages), and a new worktree
+  of a known repo isn't reported as news.
+- **Hands-off.** `cd` into a project and it is registered and scanned in the background. New
+  clones in your code folders are picked up automatically.
+- **Malicious packages first.** OSV includes the OpenSSF malicious-packages feed (`MAL-*`).
+  Compromised releases, like the Shai-Hulud npm worm, outrank any CVE and open a dialog that
+  stays on screen until you dismiss it.
+- **Actionable output.** One upgrade target per vulnerable package ("upgrade lodash to 4.18.0"),
+  not a wall of advisories.
+- **Every package manager.** npm, pnpm, yarn (classic and berry) and bun lockfiles.
+- **Repo-aware.** Git worktrees and clones of the same repo are grouped, each with its branch.
+- **Incident response.** `selfguard where <package>` answers "do I use this anywhere?" in one
+  command.
+- **AI-ready.** A built-in MCP server, `--json` output on every command, and a guide for agents.
+- **Safe by design.** It never executes code from your projects, has zero runtime dependencies,
+  and only sends package names and versions over the network.
+
+## Quick start
+
+Requires **Node.js 20.10+**. Works on **macOS** and **Linux**. Native notifications and
+scheduling are macOS-only for now.
 
 ```sh
 npm install -g selfguard
 selfguard setup
 ```
 
-`setup` is a small terminal UI: pick the folders where you keep your repos (it suggests
-`~/repository`, `~/code`, `~/dev`… and shows how many projects each has), then it scans them and
-offers to install the shell hook and the background sync.
+`setup` is a small terminal UI. Pick the folders where you keep your code, and selfguard scans
+them. It then offers to install the shell hook and background watching with notifications.
+Then open the dashboard:
 
+```sh
+selfguard ui
 ```
+
+```text
 Where do you keep your code?
 selfguard only looks inside the folders you pick, nothing else on your disk.
 
-  [x] ~/repository                     205 projects   depth 3
-› [x] ~/code                             12 projects   depth 2
+  [x] ~/code                          42 projects    depth 5
+› [ ] ~/work                          17 projects    depth 5
   + add another folder…
 
 ↑/↓ move · space select · ←/→ depth · a add folder · enter continue · q quit
 ```
 
-## How projects are found
-
-selfguard **never crawls your whole disk**. A project gets tracked in one of three ways:
-
-1. **Your folders** (`setup` / `roots add`): a recursive search of every subfolder (depth-limited,
-   default 5) that only skips dependency/generated folders: `node_modules`, `bower_components`,
-   `vendor`, `Pods`, `venv`, `target`, `__pycache__`, hidden folders (`.git`, `.next`, `.cache`…),
-   and symlinks. It also looks inside projects, so monorepos with several lockfiles are covered.
-   `sync` re-runs it, so a fresh `git clone` gets watched even if you never open it.
-2. **The shell hook**: `cd` anywhere and the enclosing project is registered.
-3. **By hand**: `selfguard scan <dir>`.
-
-Worktrees and separate clones of the same repo are **grouped** (by remote URL, or by the main
-repo a worktree points to), and each subfolder project of a monorepo stays its own group:
-
-```
-CRITICAL acme/datahub  31 vulnerable pkg(s) on main · 82 on feat/calculadora  3 checkouts
-   ├ main  31 vulnerable  ~/code/datahub
-   ├ fix/query-perf worktree  30 vulnerable  ~/code/datahub-query-perf
-   └ feat/calculadora worktree  82 vulnerable  ~/code/datahub-feat-calculadora
-```
-
-Notifications about the same advisory in several checkouts of one repo arrive once. `sync` stops
-tracking folders that no longer exist (e.g. removed worktrees). `status --flat` lists every checkout.
-
-Test fixtures, examples or archived repos you don't care about: `selfguard forget <dir>` stops
-tracking them and excludes them from discovery (undo with `selfguard unexclude <dir>`).
+Or scan a single project without setting anything up:
 
-## Use it with AI (MCP)
+```text
+$ selfguard scan
+~/code/payments-api  412 packages
+  3 vulnerable package(s), 9 advisories: 1 critical, 4 high, 4 moderate
 
-selfguard ships an MCP server, so assistants like Claude Code or Cursor can triage and manage it:
+  CRITICAL minimist@1.2.5 (transitive)
+    → upgrade to 1.2.6 or later
+    • GHSA-xvch-5gv4-984h critical Prototype Pollution in minimist
 
-```sh
-claude mcp add selfguard -- selfguard mcp
+  HIGH axios@0.21.0 (direct)
+    → upgrade to 0.33.0 or later
+    • GHSA-cph5-m8f7-6c5x high axios Inefficient Regular Expression Complexity vulnerability
+    …
 ```
 
-Then ask things like *"which of my projects have critical vulnerabilities and how do I fix them?"*,
-*"is `@ctrl/tinycolor` used anywhere?"* or *"stop tracking the test fixtures in ~/code/shop"*.
+## Documentation
 
-| Tool | Purpose |
+| | |
 |---|---|
-| `selfguard_status` | All projects with risk summary |
-| `selfguard_project_report` | Vulnerable packages of a project, with `upgradeTo` |
-| `selfguard_scan` / `selfguard_sync` | Re-check one project / everything |
-| `selfguard_where` | Which projects use a package |
-| `selfguard_vulnerability` | Advisory details + which of your projects it affects |
-| `selfguard_roots_*`, `selfguard_discover` | Manage watched folders |
-| `selfguard_forget` / `selfguard_unexclude` | Stop tracking / re-include |
-
-The MCP tools never run package managers or project code. Fixes are proposed for the user to apply.
-Advisory text is marked as third-party data so the model treats it as data, not instructions.
-
-Without MCP, every command accepts `--json` (one JSON document on stdout, errors as
-`{"error":{"code","message"}}`, exit codes 0/1/2), and `selfguard guide` prints a guide written
-for agents.
+| [Getting started](docs/getting-started.md) | Install, setup, dashboard, alerts, uninstall |
+| [CLI reference](docs/cli.md) | Every command and flag, exit codes, environment variables |
+| [How it works](docs/how-it-works.md) | Discovery, lockfile parsing, repo grouping, OSV, caching, alerts |
+| [AI and automation](docs/ai-and-automation.md) | MCP server setup, tools, JSON output, scripting and CI |
+| [Security model](docs/security-model.md) | What selfguard trusts, what it sends, how it is released |
+| [Troubleshooting](docs/troubleshooting.md) | Notifications, hook, scheduling, unsupported lockfiles |
 
-## Commands
+## How it compares
 
-Run `selfguard --help` for everything. The main ones:
+| | selfguard | `npm audit` | osv-scanner | Dependabot |
+|---|---|---|---|---|
+| Watches every project on your machine | ✅ | ❌ one project, on demand | ❌ on demand | ❌ hosted repos only |
+| Alerts when a new advisory hits an old project | ✅ | ❌ | ❌ | ✅ |
+| Local-only (no repo hosting required) | ✅ | ✅ | ✅ | ❌ |
+| npm, pnpm, yarn, bun | ✅ | npm only | ✅ | ✅ |
+| Malicious package feed | ✅ via OSV | ❌ | ✅ via OSV | partial |
+| Opens PRs with fixes | ❌ | ❌ (`npm audit fix` locally) | guided remediation | ✅ |
+| Ecosystems | JavaScript | JavaScript | many | many |
 
-| Command | What it does |
-|---|---|
-| `selfguard setup` | Interactive: choose your code folders, scan, install hook + sync |
-| `selfguard status [--vulnerable] [--flat]` | Tracked repos, riskiest first (worktrees/clones grouped) |
-| `selfguard scan [dir] [-v]` | Scan a project now (exit code 1 if anything is found) |
-| `selfguard report [dir] [-v]` | Last results for a project, no network |
-| `selfguard sync` | Find new repos in your folders, re-check everything, notify about news |
-| `selfguard where <pkg>` | Which projects use a package, and which versions |
-| `selfguard vuln <id>` | Advisory details and which of your projects it affects |
-| `selfguard roots [add <dir> [--depth N] \| remove <dir>]` | Manage your code folders |
-| `selfguard discover [--dry-run]` | Register new projects found in your folders |
-| `selfguard forget [dir]` / `unexclude <dir>` | Stop tracking + exclude / re-include |
-| `selfguard schedule on\|off\|status` | Periodic sync via launchd (macOS) |
-| `selfguard mcp` / `selfguard guide` | MCP server / guide for AI agents |
-
-## Security model
-
-selfguard is a security tool, so it holds itself to a stricter standard:
-
-- **Never executes anything from your projects.** Lockfiles are parsed as data. No `npm ls`, no
-  lifecycle scripts, no `.npmrc`. Entering a hostile repo is safe.
-- **Zero runtime dependencies.** Only Node built-ins. CI fails if a runtime dependency is added.
-- **Minimal data leaves your machine**: only `name` + `version` pairs go to
-  [OSV.dev](https://osv.dev). No paths, repo names, or file contents.
-- **Untrusted text is sanitized** before it reaches your terminal or a notification: no terminal
-  escape injection and no bidi spoofing. Notification text goes to AppleScript as arguments, never as code.
-- **Local state is private**: `~/.selfguard` is created `0700` and its files `0600`.
-- **Releases use npm Trusted Publishing with provenance and staged publishing**: no long-lived
-  publish token exists, CI can only stage a version, and a maintainer must approve it with 2FA
-  before anyone can install it. `npm view selfguard --json` shows the provenance attestation.
-
-## How it works
+selfguard complements these tools rather than replacing them. Keep Dependabot or Renovate for
+automated fix PRs, and use selfguard to know what is vulnerable on your machine right now.
 
-```
-cd ──► zsh hook (pure shell: walk up for package.json, stat lockfile on each prompt)
-         │ only when the project or lockfile changes
-         ▼
-   selfguard hook-enter ──► cached summary on stderr
-         │ lockfile changed / never scanned / >24h
-         ▼
-   detached background scan ──► parse lockfile ──► OSV querybatch ──► ~/.selfguard
-                                                                    └─► macOS notification on new findings
-```
+## Privacy
 
-Supported lockfiles: `package-lock.json` / `npm-shrinkwrap.json` (v1–v3), `pnpm-lock.yaml`
-(v5, v6, v9), `yarn.lock` (classic v1 and berry v2+) and `bun.lock`. The binary `bun.lockb` is
-not supported (`bun install --save-text-lockfile` converts it). All of them are parsed as data,
-with a dependency-free parser; the test suite checks that real lockfiles from every manager
-produce identical results for the same project.
+selfguard sends only `name` and `version` pairs of your locked dependencies to the OSV.dev API.
+No file paths, repo names or source code ever leave your machine. All state lives in
+`~/.selfguard`, readable only by your user. See the [security model](docs/security-model.md).
 
-## Development
+## Contributing
 
-```sh
-npm ci --ignore-scripts
-npm test          # node:test runs the TypeScript sources directly (Node >= 22.18)
-npm run build     # emits dist/
-```
+Bug reports, ideas and pull requests are welcome. See [CONTRIBUTING.md](CONTRIBUTING.md).
+Please report security issues privately as described in [SECURITY.md](SECURITY.md).
 
 ## License
 
-MIT
+[MIT](LICENSE)

package/dist/activity.js

@@ -0,0 +1,12 @@
+const DAY_MS = 24 * 60 * 60 * 1000;
+export function activityOf(repo, activeDays, now = Date.now()) {
+    // Not a git checkout: we can't tell, so it counts (you added it on purpose).
+    if (!repo)
+        return { active: true, lastActivity: null };
+    if (repo.orphaned)
+        return { active: false, lastActivity: null };
+    if (!repo.lastActivity)
+        return { active: true, lastActivity: null };
+    const age = now - Date.parse(repo.lastActivity);
+    return { active: age <= activeDays * DAY_MS, lastActivity: repo.lastActivity };
+}

package/dist/alerts.js

@@ -43,7 +43,8 @@ function byRepo(news) {
     return [...groups.values()].map(({ seen: _s, ...g }) => g);
 }
 export function buildAlert(news) {
-    const affected = byRepo(news);
+    const relevant = news.map((n) => n.active === false ? { ...n, newFindings: n.newFindings.filter((f) => f.severity === "malicious") } : n);
+    const affected = byRepo(relevant);
     if (affected.length === 0)
         return { kind: "none" };
     const all = affected.flatMap((n) => n.newFindings);
@@ -87,6 +88,98 @@ export function buildAlert(news) {
         body: `${names.slice(0, 3).join(", ")}${names.length > 3 ? ` +${names.length - 3} more` : ""}. Run: selfguard status`,
     };
 }
+const pkgKey = (f) => `${f.name}@${f.version}`;
+/** "datahub ✓ 17 vulnerable packages fixed": only for active checkouts, grouped by repo. */
+export function buildResolvedAlert(news) {
+    const groups = new Map();
+    for (const n of news) {
+        if (n.active === false || !n.resolvedFindings?.length)
+            continue;
+        const still = new Set((n.findings ?? []).map(pkgKey));
+        const fixed = n.resolvedFindings.map(pkgKey).filter((k) => !still.has(k));
+        if (fixed.length === 0)
+            continue;
+        const key = n.repo?.key ?? `path:${n.path}`;
+        let g = groups.get(key);
+        if (!g) {
+            g = { label: n.repo?.label ?? name(n.path), fixed: new Set(), left: new Map() };
+            groups.set(key, g);
+        }
+        for (const k of fixed)
+            g.fixed.add(k);
+        for (const f of n.findings ?? [])
+            g.left.set(`${f.id}|${pkgKey(f)}`, f);
+    }
+    if (groups.size === 0)
+        return { kind: "none" };
+    const list = [...groups.values()];
+    const total = list.reduce((sum, g) => sum + g.fixed.size, 0);
+    if (list.length === 1) {
+        const g = list[0];
+        const left = [...g.left.values()];
+        const leftPkgs = groupByPackage(left).length;
+        return {
+            kind: "banner",
+            title: `selfguard: ${g.label} ✓`,
+            subtitle: `${plural(g.fixed.size, "vulnerable package")} fixed`,
+            body: leftPkgs
+                ? `${leftPkgs} still vulnerable · worst: ${LABEL[worstSeverity(left) ?? "unknown"]}`
+                : "No known vulnerabilities left.",
+        };
+    }
+    const names = list.map((g) => g.label);
+    return {
+        kind: "banner",
+        title: `selfguard: fixes in ${list.length} repos`,
+        subtitle: `${plural(total, "vulnerable package")} fixed`,
+        body: `${names.slice(0, 3).join(", ")}${names.length > 3 ? ` +${names.length - 3} more` : ""}`,
+    };
+}
+/**
+ * What a reminder nags about: any malicious package; critical vulnerabilities outside dev
+ * dependencies; high ones in direct (non-dev) dependencies. The rest stays in the dashboard,
+ * so the reminder remains rare enough to be read.
+ */
+export const needsAttention = (f) => f.severity === "malicious" || (!f.dev && (f.severity === "critical" || (f.severity === "high" && f.direct)));
+function severityCounts(findings) {
+    const counts = new Map();
+    for (const g of groupByPackage(findings))
+        counts.set(g.worst, (counts.get(g.worst) ?? 0) + 1);
+    return ["malicious", "critical", "high"]
+        .filter((s) => counts.get(s))
+        .map((s) => `${counts.get(s)} ${s}`)
+        .join(", ");
+}
+/** Periodic reminder of unresolved serious findings in the repos you work on. */
+export function buildReminder(repos) {
+    const rank = (s) => ["malicious", "critical", "high"].indexOf(s ?? "");
+    const serious = repos
+        .map((r) => ({ label: r.label, findings: r.findings.filter(needsAttention) }))
+        .filter((r) => r.findings.length > 0)
+        .sort((a, b) => rank(worstSeverity(a.findings)) - rank(worstSeverity(b.findings)) ||
+        groupByPackage(b.findings).length - groupByPackage(a.findings).length);
+    if (serious.length === 0)
+        return { kind: "none" };
+    const all = serious.flatMap((r) => r.findings);
+    if (serious.length === 1) {
+        const r = serious[0];
+        return {
+            kind: "banner",
+            title: `selfguard: ${r.label} needs attention`,
+            subtitle: `${severityCounts(r.findings)} · open: selfguard ui`,
+            body: listFixes(r.findings),
+        };
+    }
+    const parts = serious.slice(0, 3).map((r) => `${r.label} (${severityCounts(r.findings)})`);
+    if (serious.length > 3)
+        parts.push(`+${serious.length - 3} more`);
+    return {
+        kind: "banner",
+        title: `selfguard: ${serious.length} repos need attention`,
+        subtitle: `worst: ${LABEL[worstSeverity(all) ?? "unknown"]} · open: selfguard ui`,
+        body: parts.join(", "),
+    };
+}
 export async function deliver(alert) {
     if (alert.kind === "none")
         return;

package/dist/announce.js

@@ -0,0 +1,136 @@
+/**
+ * Side effects after a scan: record what changed in the activity log and tell the user
+ * (new advisories, fixes, periodic reminders). Decisions live in alerts.ts.
+ */
+import { activityOf } from "./activity.js";
+import { buildAlert, buildReminder, buildResolvedAlert, deliver, needsAttention } from "./alerts.js";
+import { loadConfig } from "./config.js";
+import { appendEvents, eventPackages } from "./events.js";
+import { repoIdentity } from "./repoid.js";
+import { loadState, updateState } from "./state.js";
+import { findingKey, listRepos } from "./store.js";
+const HOUR_MS = 60 * 60 * 1000;
+/**
+ * Findings already known in other checkouts of the same repo (current or recently seen).
+ * A new worktree or clone of a repo isn't news: only what no checkout had before is.
+ */
+function knownElsewhere(outcomes) {
+    const scanned = new Set(outcomes.map((o) => o.record.path));
+    let byRepo = null;
+    return (key, path) => {
+        if (!byRepo) {
+            byRepo = new Map();
+            for (const rec of listRepos()) {
+                const k = repoIdentity(rec.path)?.key ?? `path:${rec.path}`;
+                const keys = new Set([...Object.keys(rec.seen ?? {}), ...rec.findings.map(findingKey)]);
+                const list = byRepo.get(k) ?? [];
+                list.push({ path: rec.path, keys });
+                byRepo.set(k, list);
+            }
+        }
+        const out = new Set();
+        for (const other of byRepo.get(key) ?? []) {
+            // Other checkouts scanned in this same run don't count: they're news too.
+            if (other.path === path || scanned.has(other.path))
+                continue;
+            for (const k of other.keys)
+                out.add(k);
+        }
+        return out;
+    };
+}
+function toNews(outcomes, activeDays) {
+    const known = knownElsewhere(outcomes);
+    return outcomes.map((o) => {
+        const repo = repoIdentity(o.record.path);
+        const key = repo?.key ?? `path:${o.record.path}`;
+        const elsewhere = o.newFindings.length ? known(key, o.record.path) : new Set();
+        return {
+            path: o.record.path,
+            newFindings: o.newFindings.filter((f) => !elsewhere.has(findingKey(f))),
+            resolvedFindings: o.resolvedFindings,
+            findings: o.record.findings,
+            repo,
+            active: activityOf(repo, activeDays).active,
+            branch: repo?.branch ?? null,
+            firstScan: o.firstScan,
+        };
+    });
+}
+/** Log and notify what changed. Returns true if something was notified. */
+export async function announce(outcomes, opts = {}) {
+    const news = toNews(outcomes, loadConfig().activeDays);
+    const at = new Date().toISOString();
+    const events = [];
+    for (const n of news) {
+        const base = {
+            at,
+            repo: n.repo?.label ?? n.path.split("/").pop() ?? n.path,
+            repoKey: n.repo?.key ?? `path:${n.path}`,
+            path: n.path,
+            branch: n.branch,
+            active: n.active !== false,
+        };
+        if (n.newFindings.length)
+            events.push({ ...base, kind: "new", ...(n.firstScan ? { firstScan: true } : {}), ...eventPackages(n.newFindings) });
+        const still = new Set((n.findings ?? []).map((f) => `${f.name}@${f.version}`));
+        const fixed = (n.resolvedFindings ?? []).filter((f) => !still.has(`${f.name}@${f.version}`));
+        if (fixed.length)
+            events.push({ ...base, kind: "resolved", ...eventPackages(fixed) });
+    }
+    try {
+        appendEvents(events);
+    }
+    catch {
+        /* the log is a convenience; never fail a scan because of it */
+    }
+    if (opts.notify === false)
+        return false;
+    const alerts = [buildAlert(news), buildResolvedAlert(news)].filter((a) => a.kind !== "none");
+    for (const a of alerts)
+        await deliver(a);
+    return alerts.length > 0;
+}
+/** Is a reminder due? Daytime only (9:00–21:00 local), at most once per period. */
+export function reminderDue(every, last, now = new Date()) {
+    if (every === "off")
+        return false;
+    const hour = now.getHours();
+    if (hour < 9 || hour >= 21)
+        return false;
+    if (!last)
+        return true;
+    const gap = every === "daily" ? 20 * HOUR_MS : 6.5 * 24 * HOUR_MS;
+    return now.getTime() - Date.parse(last) >= gap;
+}
+/**
+ * Send the periodic reminder if it is due (or `force`). The input comes from api.getAttention().
+ * Returns whether a notification was sent.
+ */
+export async function maybeRemind(source, opts = {}) {
+    const cfg = loadConfig();
+    if (!opts.force && !reminderDue(cfg.remind, loadState().lastReminder))
+        return false;
+    // Computed only when due: the watcher calls this often.
+    const repos = typeof source === "function" ? source() : source;
+    const alert = buildReminder(repos);
+    // Mark the period as handled even when everything is fine, so a later finding waits its turn.
+    updateState({ lastReminder: new Date().toISOString() });
+    if (alert.kind === "none")
+        return false;
+    await deliver(alert);
+    appendEvents([
+        {
+            at: new Date().toISOString(),
+            kind: "reminder",
+            repo: alert.title.replace(/^selfguard: /, ""),
+            repoKey: "reminder",
+            path: null,
+            branch: null,
+            active: true,
+            total: repos.filter((r) => r.findings.some(needsAttention)).length,
+            packages: [],
+        },
+    ]);
+    return true;
+}