agentsnitch 0.1.0__py3-none-any.whl

agentsnitch/__init__.py

@@ -0,0 +1,2 @@
+"""What did your AI coding agents actually do on your machine?"""
+__version__ = "0.1.0"

agentsnitch/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .cli import main
+
+sys.exit(main())

agentsnitch/agentlogs.py

@@ -0,0 +1,353 @@
+"""Read the session logs that AI coding agents keep on your machine, into one common shape.
+
+Supported (all read-only, nothing leaves your machine):
+- Claude Code:  ~/.claude/projects/<project>/<session>.jsonl (and subagent logs under it)
+- Codex CLI:    ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl
+- Gemini CLI:   ~/.gemini/tmp/<project>/chats/session-*.json(l), with ~/.gemini/projects.json for folders
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+from dataclasses import dataclass, field
+from datetime import datetime
+from pathlib import Path
+from typing import Iterator
+
+AGENTS = {"claude": "Claude Code", "codex": "Codex", "gemini": "Gemini CLI"}
+
+
+@dataclass
+class Event:
+    agent: str  # "claude" | "codex" | "gemini"
+    session: str
+    ts: float | None
+    cwd: str | None
+    kind: str  # "prompt" | "command" | "read" | "write" | "edit" | "fetch" | "tool"
+    tool: str = ""
+    command: str = ""  # shell command line
+    path: str = ""  # file read/written
+    added: list[str] = field(default_factory=list)  # lines the agent wrote
+    text: str = ""  # prompt text, URL, etc.
+    model: str = ""
+    tokens: int = 0  # tokens used by this turn, where the log says
+
+
+def parse_ts(s) -> float | None:
+    if not s:
+        return None
+    if isinstance(s, (int, float)):
+        return float(s) / (1000 if s > 1e11 else 1)
+    try:
+        return datetime.fromisoformat(str(s).replace("Z", "+00:00")).timestamp()
+    except ValueError:
+        return None
+
+
+def _lines(text: str) -> list[str]:
+    return text.splitlines() if isinstance(text, str) else []
+
+
+def _jsonl(path: Path) -> Iterator[dict]:
+    try:
+        with path.open(encoding="utf-8", errors="replace") as fh:
+            for line in fh:
+                line = line.strip()
+                if not line:
+                    continue
+                try:
+                    d = json.loads(line)
+                except ValueError:
+                    continue
+                if isinstance(d, dict):
+                    yield d
+    except OSError:
+        return
+
+
+# ---------------------------------------------------------------------------
+# Claude Code
+# ---------------------------------------------------------------------------
+def claude_root() -> Path:
+    return Path(os.environ.get("CLAUDE_CONFIG_DIR") or Path.home() / ".claude") / "projects"
+
+
+def _prompt_text(content) -> str:
+    if isinstance(content, str):
+        return content
+    if isinstance(content, list):
+        return "\n".join(b.get("text", "") for b in content if isinstance(b, dict) and b.get("type") == "text")
+    return ""
+
+
+def claude_events(path: Path) -> Iterator[Event]:
+    for d in _jsonl(path):
+        typ = d.get("type")
+        if typ not in ("user", "assistant"):
+            continue
+        ts, cwd, sid = parse_ts(d.get("timestamp")), d.get("cwd"), d.get("sessionId") or path.stem
+        msg = d.get("message") or {}
+        content = msg.get("content")
+        if typ == "user":
+            if d.get("isMeta") or d.get("isCompactSummary") or d.get("toolUseResult") is not None:
+                continue
+            text = _prompt_text(content)
+            if text and not text.startswith(("<command-", "<local-command", "Caveat:", "[Request interrupted")) \
+                    and not (isinstance(content, list) and any(b.get("type") == "tool_result" for b in content
+                                                               if isinstance(b, dict))):
+                yield Event("claude", sid, ts, cwd, "prompt", text=text)
+            continue
+        usage = msg.get("usage") or {}
+        tokens = sum(int(usage.get(k) or 0) for k in ("input_tokens", "output_tokens", "cache_creation_input_tokens"))
+        model = msg.get("model") or ""
+        first = True
+        for b in content if isinstance(content, list) else []:
+            if not isinstance(b, dict) or b.get("type") != "tool_use":
+                continue
+            name, inp = b.get("name") or "", b.get("input") or {}
+            ev = Event("claude", sid, ts, cwd, "tool", tool=name, model=model, tokens=tokens if first else 0)
+            first = False
+            if name == "Bash":
+                ev.kind, ev.command = "command", str(inp.get("command") or "")
+            elif name in ("Read", "NotebookRead"):
+                ev.kind, ev.path = "read", str(inp.get("file_path") or inp.get("notebook_path") or "")
+            elif name == "Write":
+                ev.kind, ev.path, ev.added = "write", str(inp.get("file_path") or ""), _lines(inp.get("content", ""))
+            elif name == "Edit":
+                ev.kind, ev.path, ev.added = "edit", str(inp.get("file_path") or ""), _lines(inp.get("new_string", ""))
+            elif name == "MultiEdit":
+                ev.kind, ev.path = "edit", str(inp.get("file_path") or "")
+                for e in inp.get("edits") or []:
+                    ev.added += _lines((e or {}).get("new_string", ""))
+            elif name == "NotebookEdit":
+                ev.kind, ev.path, ev.added = "edit", str(inp.get("notebook_path") or ""), _lines(inp.get("new_source", ""))
+            elif name in ("WebFetch", "WebSearch"):
+                ev.kind, ev.text = "fetch", str(inp.get("url") or inp.get("query") or "")
+            elif name in ("Grep", "Glob", "LS"):
+                ev.kind, ev.path = "read", str(inp.get("path") or "")
+            yield ev
+        if first and tokens:  # a turn with no tool calls still used tokens
+            yield Event("claude", sid, ts, cwd, "tool", tool="", model=model, tokens=tokens)
+
+
+# ---------------------------------------------------------------------------
+# Codex CLI
+# ---------------------------------------------------------------------------
+def codex_root() -> Path:
+    return Path(os.environ.get("CODEX_HOME") or Path.home() / ".codex") / "sessions"
+
+
+PATCH_FILE = re.compile(r"^\*\*\* (Add|Update|Delete) File: (.+)$")
+
+
+def parse_apply_patch(patch: str) -> list[tuple[str, list[str]]]:
+    """[(path, added lines)] from Codex's *** Begin Patch format."""
+    out: list[tuple[str, list[str]]] = []
+    for line in patch.splitlines():
+        m = PATCH_FILE.match(line)
+        if m:
+            out.append((m.group(2).strip(), []))
+        elif out and line.startswith("+") and not line.startswith("+++"):
+            out[-1][1].append(line[1:])
+    return out
+
+
+def _codex_command(name: str, args) -> str:
+    if isinstance(args, str):
+        try:
+            args = json.loads(args)
+        except ValueError:
+            return args if name in ("shell_command",) else ""
+    if not isinstance(args, dict):
+        return ""
+    cmd = args.get("cmd", args.get("command"))
+    if isinstance(cmd, list):
+        # ["bash", "-lc", "real command"] -> "real command"
+        if len(cmd) >= 3 and cmd[1] in ("-lc", "-c") and os.path.basename(str(cmd[0])) in ("bash", "sh", "zsh"):
+            return str(cmd[2])
+        return " ".join(str(c) for c in cmd)
+    return str(cmd or "")
+
+
+def codex_events(path: Path) -> Iterator[Event]:
+    sid, cwd, model = path.stem.replace("rollout-", ""), None, ""
+    last_total = 0
+    for d in _jsonl(path):
+        typ, p = d.get("type"), d.get("payload") or {}
+        ts = parse_ts(d.get("timestamp"))
+        if typ == "session_meta":
+            sid = str(p.get("id") or p.get("session_id") or sid)
+            cwd = p.get("cwd") or cwd
+            continue
+        if typ == "turn_context":
+            cwd = p.get("cwd") or cwd
+            model = p.get("model") or model
+            continue
+        if typ == "event_msg":
+            if p.get("type") == "user_message" and p.get("message"):
+                yield Event("codex", sid, ts, cwd, "prompt", text=str(p["message"]))
+            elif p.get("type") == "token_count" and isinstance(p.get("info"), dict):
+                total = (p["info"].get("total_token_usage") or {}).get("total_tokens") or 0
+                if total > last_total:
+                    yield Event("codex", sid, ts, cwd, "tool", model=model, tokens=int(total - last_total))
+                    last_total = total
+            continue
+        if typ != "response_item":
+            continue
+        ptype, name = p.get("type"), p.get("name") or ""
+        if ptype == "local_shell_call":
+            cmd = _codex_command("shell", (p.get("action") or {}))
+            yield Event("codex", sid, ts, cwd, "command", tool="local_shell", command=cmd, model=model)
+        elif ptype in ("function_call", "custom_tool_call"):
+            raw = p.get("arguments") if ptype == "function_call" else p.get("input")
+            if name == "apply_patch":
+                patch = raw
+                if ptype == "function_call":
+                    try:
+                        patch = json.loads(raw).get("input", "")
+                    except (ValueError, AttributeError):
+                        patch = ""
+                for fpath, added in parse_apply_patch(patch or ""):
+                    yield Event("codex", sid, ts, cwd, "edit", tool="apply_patch", path=fpath, added=added, model=model)
+            elif name in ("shell", "exec_command", "shell_command", "container.exec"):
+                cmd = _codex_command(name, raw)
+                if "apply_patch" in cmd and "*** Begin Patch" in cmd:  # older Codex sent patches through the shell
+                    for fpath, added in parse_apply_patch(cmd):
+                        yield Event("codex", sid, ts, cwd, "edit", tool="apply_patch", path=fpath, added=added,
+                                    model=model)
+                else:
+                    yield Event("codex", sid, ts, cwd, "command", tool=name, command=cmd, model=model)
+            elif name in ("web_search", "web_fetch"):
+                yield Event("codex", sid, ts, cwd, "fetch", tool=name, text=str(raw)[:300], model=model)
+            else:
+                yield Event("codex", sid, ts, cwd, "tool", tool=name, model=model)
+
+
+# ---------------------------------------------------------------------------
+# Gemini CLI
+# ---------------------------------------------------------------------------
+def gemini_home() -> Path:
+    return Path.home() / ".gemini"
+
+
+def gemini_projects() -> dict[str, str]:
+    """shortId -> project folder, from ~/.gemini/projects.json."""
+    for base in (gemini_home(), Path.home() / ".cache" / ".gemini"):
+        try:
+            data = json.loads((base / "projects.json").read_text())
+            return {v: k for k, v in (data.get("projects") or {}).items()}
+        except (OSError, ValueError, AttributeError):
+            continue
+    return {}
+
+
+def _gemini_records(path: Path) -> tuple[dict, list[dict]]:
+    """(metadata, messages) for both the old single-JSON and the newer JSONL session files."""
+    if path.suffix == ".json":
+        try:
+            data = json.loads(path.read_text(encoding="utf-8", errors="replace"))
+        except (OSError, ValueError):
+            return {}, []
+        return data, list(data.get("messages") or [])
+    meta: dict = {}
+    msgs: dict[str, dict] = {}
+    order: list[str] = []
+    for d in _jsonl(path):
+        if "sessionId" in d and "projectHash" in d and "type" not in d:
+            meta.update(d)
+        elif "$set" in d:
+            meta.update(d["$set"] if isinstance(d["$set"], dict) else {})
+        elif isinstance(d.get("id"), str):
+            if d["id"] in msgs:  # a later patch of the same message (e.g. tool results filled in)
+                cur = msgs[d["id"]]
+                for k, v in d.items():
+                    if k == "toolCalls" and isinstance(v, list):
+                        known = {t.get("id"): t for t in cur.get("toolCalls") or []}
+                        for t in v:
+                            known.setdefault(t.get("id"), {}).update(t)
+                        cur["toolCalls"] = list(known.values())
+                    elif k != "$patch":
+                        cur[k] = v
+            else:
+                msgs[d["id"]] = dict(d)
+                order.append(d["id"])
+    return meta, [msgs[i] for i in order]
+
+
+def gemini_events(path: Path, projects: dict[str, str] | None = None) -> Iterator[Event]:
+    meta, messages = _gemini_records(path)
+    sid = str(meta.get("sessionId") or path.stem)
+    short = path.parent.parent.name if path.parent.name == "chats" else ""
+    cwd = (projects or {}).get(short)
+    for m in messages:
+        ts = parse_ts(m.get("timestamp"))
+        if m.get("type") == "user":
+            text = m.get("content")
+            if isinstance(text, list):
+                text = "\n".join(p.get("text", "") for p in text if isinstance(p, dict))
+            if text:
+                yield Event("gemini", sid, ts, cwd, "prompt", text=str(text))
+            continue
+        if m.get("type") != "gemini":
+            continue
+        tok = m.get("tokens") or {}
+        tokens = int(tok.get("total") or 0) if isinstance(tok, dict) else 0
+        model = m.get("model") or ""
+        calls = m.get("toolCalls") or []
+        for i, tc in enumerate(calls):
+            name, args = tc.get("name") or "", tc.get("args") or {}
+            ev = Event("gemini", sid, parse_ts(tc.get("timestamp")) or ts, cwd, "tool", tool=name, model=model,
+                       tokens=tokens if i == 0 else 0)
+            if name in ("run_shell_command", "ShellTool"):
+                ev.kind, ev.command = "command", str(args.get("command") or "")
+                if args.get("dir_path") and not cwd:
+                    ev.cwd = str(args["dir_path"])
+            elif name == "write_file":
+                ev.kind, ev.path, ev.added = "write", str(args.get("file_path") or ""), _lines(args.get("content", ""))
+            elif name in ("replace", "edit"):
+                ev.kind, ev.path, ev.added = "edit", str(args.get("file_path") or ""), _lines(args.get("new_string", ""))
+            elif name in ("read_file", "read_many_files", "glob", "search_file_content", "grep_search", "list_directory"):
+                ev.kind = "read"
+                ev.path = str(args.get("file_path") or args.get("absolute_path") or args.get("path") or
+                              args.get("dir_path") or "")
+            elif name in ("web_fetch", "google_web_search"):
+                ev.kind, ev.text = "fetch", str(args.get("url") or args.get("prompt") or args.get("query") or "")[:300]
+            yield ev
+        if not calls and tokens:
+            yield Event("gemini", sid, ts, cwd, "tool", model=model, tokens=tokens)
+
+
+# ---------------------------------------------------------------------------
+# Everything
+# ---------------------------------------------------------------------------
+def session_files(roots: dict[str, Path] | None = None) -> list[tuple[str, Path]]:
+    roots = roots or {"claude": claude_root(), "codex": codex_root(), "gemini": gemini_home() / "tmp"}
+    out: list[tuple[str, Path]] = []
+    if roots.get("claude") and roots["claude"].is_dir():
+        out += [("claude", p) for p in sorted(roots["claude"].rglob("*.jsonl"))]
+    if roots.get("codex") and roots["codex"].is_dir():
+        out += [("codex", p) for p in sorted(roots["codex"].rglob("rollout-*.jsonl"))]
+    if roots.get("gemini") and roots["gemini"].is_dir():
+        out += [("gemini", p) for p in sorted(roots["gemini"].glob("*/chats/session-*.json*"))]
+    return out
+
+
+def all_events(roots: dict[str, Path] | None = None, since: float | None = None) -> Iterator[Event]:
+    projects = gemini_projects()
+    for agent, path in session_files(roots):
+        try:
+            if since and path.stat().st_mtime < since:
+                continue  # untouched since before the window: nothing in it can be newer
+        except OSError:
+            continue
+        if agent == "claude":
+            it = claude_events(path)
+        elif agent == "codex":
+            it = codex_events(path)
+        else:
+            it = gemini_events(path, projects)
+        for ev in it:
+            if since and ev.ts and ev.ts < since:
+                continue
+            yield ev

agentsnitch/audit.py

@@ -0,0 +1,158 @@
+"""Go through everything your agents did and pull out what deserves a second look."""
+from __future__ import annotations
+
+import os
+from collections import Counter, defaultdict
+from dataclasses import dataclass, field
+
+from .agentlogs import Event
+from .rules import HIGH, LOW, MEDIUM, classify_command, classify_path, outside
+
+ORDER = {HIGH: 0, MEDIUM: 1, LOW: 2}
+
+
+@dataclass
+class Finding:
+    key: str
+    title: str
+    severity: str
+    agent: str
+    project: str
+    ts: float | None
+    detail: str  # the matching part of the command, or the file path
+    session: str
+    command: str = ""  # the whole command
+
+
+@dataclass
+class Audit:
+    since: float | None
+    commands: int = 0
+    reads: int = 0
+    writes: int = 0
+    fetches: int = 0
+    prompts: int = 0
+    sessions: set = field(default_factory=set)
+    projects: Counter = field(default_factory=Counter)
+    agents: Counter = field(default_factory=Counter)  # agent -> actions
+    top_commands: Counter = field(default_factory=Counter)  # first word of each command
+    findings: list[Finding] = field(default_factory=list)
+    outside_writes: list[Finding] = field(default_factory=list)
+    outside_reads: list[Finding] = field(default_factory=list)
+
+    @property
+    def actions(self) -> int:
+        return self.commands + self.reads + self.writes + self.fetches
+
+    def by_rule(self) -> list[tuple[str, str, int, Finding]]:
+        """(title, severity, count, most recent example), most serious first."""
+        groups: dict[str, list[Finding]] = defaultdict(list)
+        for f in self.findings:
+            groups[f.key].append(f)
+        out = []
+        for key, fs in groups.items():
+            fs.sort(key=lambda f: f.ts or 0)
+            out.append((fs[-1].title, fs[-1].severity, len(fs), fs[-1]))
+        if self.outside_writes:
+            fs = sorted(self.outside_writes, key=lambda f: f.ts or 0)
+            out.append(("Wrote files outside the project", MEDIUM, len(fs), fs[-1]))
+        if self.outside_reads:
+            fs = sorted(self.outside_reads, key=lambda f: f.ts or 0)
+            out.append(("Read files outside the project", LOW, len(fs), fs[-1]))
+        return sorted(out, key=lambda x: (ORDER[x[1]], -x[2]))
+
+    def count(self, key: str) -> int:
+        return sum(1 for f in self.findings if f.key == key)
+
+    def highlights(self) -> list[str]:
+        """The few facts worth putting in a screenshot."""
+        h = []
+        for key, one, many in [("force-push", "force-push", "force-pushes"),
+                               ("pipe-to-shell", "curl | sh", "curl | sh runs"),
+                               ("rm-root", "rm -rf on your home folder", "rm -rf runs on your home folder"),
+                               ("ssh-keys", "SSH key access", "SSH key accesses"),
+                               ("cloud-creds", "cloud credential read", "cloud credential reads"),
+                               ("keychain", "password-store read", "password-store reads"),
+                               ("dotenv", ".env read", ".env reads"),
+                               ("publish", "package publish", "package publishes"),
+                               ("drop-db", "dropped database", "dropped databases"),
+                               ("sudo", "sudo", "sudos")]:
+            n = self.count(key)
+            if n:
+                h.append(f"{n} {one if n == 1 else many}")
+        if self.outside_writes:
+            n = len({f.detail for f in self.outside_writes})
+            h.append(f"{n} file{'s' * (n != 1)} written outside the project")
+        return h
+
+    def period(self) -> str:
+        import time
+        if not self.since:
+            return "so far"
+        days = round((time.time() - self.since) / 86400)
+        return "today" if days <= 1 else f"in the last {days} days"
+
+    def share(self) -> str:
+        bits = self.highlights()[:3]
+        s = f"My AI coding agents ran {self.commands:,} commands {self.period()}"
+        s += (": " + ", ".join(bits)) if bits else ", and nothing scary"
+        return s + ". What did yours do? uvx agentsnitch"
+
+
+SKIP = {"cd", "export", "set", "source", ".", "for", "do", "done", "if", "then", "fi", "else", "while", "echo",
+        "true", "false", "sleep", "time", "env", "exec", "(", "{", "}", "then", "local"}
+
+
+def programs(cmd: str) -> list[str]:
+    """The programs a command line runs: `cd x && npm test | tee log` -> ["npm", "tee"]."""
+    import re
+    from .rules import shell_only
+    out = []
+    for seg in re.split(r"&&|\|\||[;|\n]", shell_only(cmd)):
+        words = [w for w in seg.strip().split() if not re.match(r"^\w+=", w)]
+        if words and words[0] not in SKIP and re.match(r"^[\w./-]+$", words[0]):
+            out.append(os.path.basename(words[0]))
+    return out
+
+
+def project_of(ev: Event) -> str:
+    return ev.cwd or "?"
+
+
+def run(events, since: float | None = None) -> Audit:
+    a = Audit(since)
+    roots: dict[tuple[str, str], str] = {}  # each session's project = the folder the agent was started in
+    for ev in events:
+        a.agents[ev.agent] += ev.kind != "prompt"
+        a.sessions.add((ev.agent, ev.session))
+        if ev.cwd:
+            roots.setdefault((ev.agent, ev.session), ev.cwd)
+        proj = roots.get((ev.agent, ev.session)) or project_of(ev)
+        if ev.kind == "prompt":
+            a.prompts += 1
+            continue
+        if ev.kind not in ("command", "read", "write", "edit", "fetch"):
+            continue
+        a.projects[proj] += 1
+        if ev.kind == "command":
+            a.commands += 1
+            for prog in programs(ev.command):
+                a.top_commands[prog] += 1
+            for r, snippet in classify_command(ev.command):
+                a.findings.append(Finding(r.key, r.title, r.severity, ev.agent, proj, ev.ts, snippet, ev.session,
+                                          ev.command))
+        elif ev.kind == "fetch":
+            a.fetches += 1
+        else:
+            if ev.kind == "read":
+                a.reads += 1
+            else:
+                a.writes += 1
+            for key, title, sev in classify_path(ev.path, ev.kind):
+                a.findings.append(Finding(key, title, sev, ev.agent, proj, ev.ts, ev.path, ev.session))
+            path = ev.path if os.path.isabs(ev.path) or not ev.cwd else os.path.join(ev.cwd, ev.path)
+            if outside(path, proj if proj != "?" else None):
+                f = Finding("outside", "", MEDIUM if ev.kind != "read" else LOW, ev.agent, proj, ev.ts, ev.path,
+                            ev.session)
+                (a.outside_reads if ev.kind == "read" else a.outside_writes).append(f)
+    return a

agentsnitch/cli.py

@@ -0,0 +1,151 @@
+"""agentsnitch: what did your AI coding agents actually do on your machine?"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+import time
+from dataclasses import asdict
+from pathlib import Path
+
+from rich.console import Console, Group
+from rich.panel import Panel
+from rich.table import Table
+from rich.text import Text
+
+from . import __version__, agentlogs
+from .audit import Audit, run
+from .rules import HIGH, LOW, MEDIUM
+
+SEV_STYLE = {HIGH: "bold red", MEDIUM: "yellow", LOW: "dim"}
+SEV_LABEL = {HIGH: "high", MEDIUM: "medium", LOW: "low"}
+AGENT_NAME = {"claude": "Claude Code", "codex": "Codex", "gemini": "Gemini CLI"}
+
+
+def short_path(p: str) -> str:
+    home = str(Path.home())
+    return "~" + p[len(home):] if p.startswith(home) else p
+
+
+def when(ts: float | None) -> str:
+    if not ts:
+        return ""
+    d = time.time() - ts
+    if d < 3600:
+        return f"{max(1, int(d // 60))}m ago"
+    if d < 86400:
+        return f"{int(d // 3600)}h ago"
+    return time.strftime("%b %d", time.localtime(ts))
+
+
+def one_line(s: str, n: int = 70) -> str:
+    s = re.sub(r"\s+", " ", s).strip()
+    return s if len(s) <= n else s[: n - 1] + "…"
+
+
+def render(a: Audit, console: Console, show: int = 6, include_low: bool = False) -> None:
+    if not a.actions:
+        console.print(Text("No agent activity found. agentsnitch reads Claude Code, Codex and Gemini CLI logs from "
+                           "your home folder; if you use them, try --since all.", "yellow"))
+        return
+    head = Text.assemble("Your coding agents ran ", (f"{a.commands:,} commands", "bold"), f" {a.period()}",
+                         f", read {a.reads:,} files and wrote {a.writes:,}.")
+    n_s, n_p = len(a.sessions), len(a.projects)
+    sub = Text(f"{n_s} session{'s' * (n_s != 1)} · {n_p} project{'s' * (n_p != 1)} · " +
+               " · ".join(f"{AGENT_NAME.get(k, k)} {v:,}" for k, v in a.agents.most_common() if v), "dim")
+    parts: list = [head, sub, Text("")]
+    hl = a.highlights()
+    if hl:
+        parts += [Text("  ·  ".join(hl), "bold red"), Text("")]
+
+    rows = [r for r in a.by_rule() if include_low or r[1] != LOW]
+    if rows:
+        t = Table(box=None, header_style="dim", padding=(0, 2), expand=True)
+        t.add_column("", no_wrap=True)
+        t.add_column("What", no_wrap=True)
+        t.add_column("Times", justify="right")
+        t.add_column("Latest", ratio=1, no_wrap=True, overflow="ellipsis")
+        for title, sev, n, f in rows:
+            t.add_row(Text(SEV_LABEL[sev], SEV_STYLE[sev]), Text(title, "bold" if sev == HIGH else ""), str(n),
+                      Text.assemble((when(f.ts) + "  ", "dim"), one_line(short_path(f.detail), 80)))
+        parts += [t, Text("")]
+    else:
+        parts += [Text("Nothing risky: no force-pushes, no curl | sh, no secrets, nothing outside your projects.",
+                       "green"), Text("")]
+
+    serious = sorted([f for f in a.findings if f.severity == HIGH], key=lambda f: -(f.ts or 0))[:show]
+    if serious:
+        g = Table(title="Most recent high-risk actions", title_justify="left", title_style="bold", box=None,
+                  show_header=False, padding=(0, 2), expand=True)
+        g.add_column(no_wrap=True, style="dim")
+        g.add_column(no_wrap=True)
+        g.add_column(no_wrap=True, style="dim")
+        g.add_column(ratio=1, no_wrap=True, overflow="ellipsis")
+        for f in serious:
+            g.add_row(when(f.ts), AGENT_NAME.get(f.agent, f.agent), os.path.basename(f.project.rstrip("/\\")) or "?",
+                      Text(one_line(short_path(f.detail), 90), "red"))
+        parts += [g, Text("")]
+
+    if a.top_commands:
+        parts.append(Text("Most-run: " + ", ".join(f"{c} ({n})" for c, n in a.top_commands.most_common(8)), "dim"))
+    console.print(Panel(Group(*parts), title="[bold]What did your AI agents do?[/]",
+                        border_style="red" if any(f.severity == HIGH for f in a.findings) else "green", padding=(1, 2)))
+    console.print(Text("  Share: ", "dim") + Text(a.share(), "italic"))
+    console.print()
+
+
+def parse_since(s: str) -> float | None:
+    if s == "all":
+        return None
+    m = re.fullmatch(r"(\d+)\s*([hdwm])", s)
+    if m:
+        n, unit = int(m.group(1)), m.group(2)
+        return time.time() - n * {"h": 3600, "d": 86400, "w": 7 * 86400, "m": 30 * 86400}[unit]
+    from datetime import datetime
+    try:
+        return time.mktime(datetime.strptime(s, "%Y-%m-%d").timetuple())
+    except ValueError:
+        raise argparse.ArgumentTypeError("use e.g. 7d, 30d, 12h, 2026-10-01 or all")
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(prog="agentsnitch", description="See every command your AI coding agents ran and "
+                                 "every file they touched, with the risky ones flagged. Reads Claude Code, Codex and "
+                                 "Gemini CLI logs locally.")
+    ap.add_argument("--since", type=parse_since, default=parse_since("30d"), help="7d, 30d (default), 12h, a date, or all")
+    ap.add_argument("--project", help="only sessions whose folder contains this text")
+    ap.add_argument("--agent", choices=["claude", "codex", "gemini"], help="only one agent")
+    ap.add_argument("--low", action="store_true", help="also show low-severity findings")
+    ap.add_argument("--log", action="store_true", help="print every command and file action, oldest first")
+    ap.add_argument("--json", action="store_true", help="findings as JSON")
+    ap.add_argument("-V", "--version", action="version", version=f"agentsnitch {__version__}")
+    a = ap.parse_args(argv)
+    console = Console(stderr=a.json)
+
+    def keep(ev):
+        return (not a.agent or ev.agent == a.agent) and (not a.project or a.project.lower() in (ev.cwd or "").lower())
+
+    events = [ev for ev in agentlogs.all_events(since=a.since) if keep(ev)]
+    if a.log:
+        for ev in sorted(events, key=lambda e: e.ts or 0):
+            if ev.kind in ("command", "read", "write", "edit", "fetch"):
+                what = ev.command or ev.path or ev.text
+                console.print(Text.assemble((time.strftime("%Y-%m-%d %H:%M", time.localtime(ev.ts or 0)) + "  ", "dim"),
+                                            (f"{ev.agent:7} {ev.kind:7} ", "cyan"), one_line(short_path(what), 200)))
+        return 0
+    audit = run(events, a.since)
+    if a.json:
+        print(json.dumps({"since": a.since, "commands": audit.commands, "reads": audit.reads, "writes": audit.writes,
+                          "sessions": len(audit.sessions), "highlights": audit.highlights(),
+                          "findings": [asdict(f) for f in audit.findings],
+                          "outside_writes": [asdict(f) for f in audit.outside_writes],
+                          "outside_reads": [asdict(f) for f in audit.outside_reads]}, indent=2))
+    else:
+        render(audit, console, include_low=a.low)
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

agentsnitch/rules.py

@@ -0,0 +1,172 @@
+"""What counts as risky when an AI agent runs it on your machine."""
+from __future__ import annotations
+
+import os
+import re
+from dataclasses import dataclass
+
+HIGH, MEDIUM, LOW = "high", "medium", "low"
+
+
+@dataclass(frozen=True)
+class Rule:
+    key: str
+    title: str  # short, for tables
+    severity: str
+    pattern: re.Pattern
+    why: str
+
+
+def R(key, title, severity, pattern, why):
+    return Rule(key, title, severity, re.compile(pattern, re.I | re.M), why)
+
+
+# Patterns match anywhere in the command line, including inside `bash -c "..."` and pipelines.
+COMMAND_RULES = [
+    # --- remote code ---------------------------------------------------------------------------------
+    R("pipe-to-shell", "Piped a download into a shell", HIGH,
+      r"(curl|wget|iwr|invoke-webrequest|irm|invoke-restmethod)\b[^|;&]*\|\s*(sudo\s+)?(ba|z|da|k)?sh\b|"
+      r"\|\s*(sudo\s+)?python3?\b\s*(-\s*)?$|\b(iex|invoke-expression)\b",
+      "runs whatever that URL serves, unread"),
+    R("eval-remote", "eval'd a download", HIGH, r"\beval\s+[\"']?\$\((curl|wget)", "runs whatever that URL serves"),
+    # --- destruction ----------------------------------------------------------------------------------
+    R("rm-root", "rm -rf on home or root", HIGH,
+      r"\brm\s+(-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*|--recursive\s+--force|-r\s+-f|-f\s+-r)\s+"
+      r"(\"?(~|\$home|/|/\*|\.\.)\"?/?(\s|$))",
+      "one typo away from deleting everything"),
+    R("rm-rf", "rm -rf", LOW,
+      r"\brm\s+(-[a-z]*r[a-z]*f[a-z]*|-[a-z]*f[a-z]*r[a-z]*|--recursive\s+--force|-r\s+-f|-f\s+-r)\b",
+      "recursive force delete"),
+    R("force-push", "Force-pushed", HIGH, r"\bgit\b[^;&|]*\bpush\b[^;&|]*(\s--force\b|\s-f\b|\s--force-with-lease\b|\s\+\S)",
+      "rewrites shared history on the remote"),
+    R("reset-hard", "git reset --hard / clean", MEDIUM, r"\bgit\b[^;&|]*\b(reset\s+--hard|clean\s+-[a-z]*f|checkout\s+--\s+\.|"
+      r"restore\s+(--staged\s+)?\.(\s|$)|stash\s+(drop|clear))",
+      "throws away uncommitted work"),
+    R("drop-db", "Dropped or wiped a database", HIGH, r"\b(drop\s+(table|database|schema)|truncate\s+table|dropdb\b|"
+      r"flushall\b|flushdb\b|db\.dropDatabase)", "data loss"),
+    R("disk", "Low-level disk command", HIGH, r"\b(mkfs(\.\w+)?|dd\s+[^|;&]*\bof=/dev/|diskutil\s+(erase|partition)|"
+      r"fdisk|parted)\b", "can wipe a disk"),
+    R("infra-destroy", "Destroyed infrastructure", HIGH, r"\b(terraform\s+destroy|kubectl\s+delete|helm\s+uninstall|"
+      r"aws\s+\S+\s+(delete|terminate|rm)\S*|gcloud\s+.*\bdelete\b|docker\s+(system\s+prune|volume\s+rm|rm\s+-f))",
+      "deletes real resources"),
+    R("chmod-777", "chmod 777", MEDIUM, r"\bchmod\s+(-R\s+)?(0?777|a\+rwx)\b", "makes files writable by anyone"),
+    # --- secrets --------------------------------------------------------------------------------------
+    R("ssh-keys", "Touched SSH keys", HIGH, r"\.ssh/(id_[\w-]+|identity|[\w.-]*_(rsa|ed25519|ecdsa|dsa)|[\w.-]+\.pem)"
+      r"(?!\.pub)\b(?!\.pub)", "private keys"),
+    R("cloud-creds", "Read cloud credentials", HIGH, r"\.aws/credentials|\.config/gcloud/(credentials|application_default)|"
+      r"\.azure/|\.kube/config|\.docker/config\.json|\.netrc|\.npmrc|\.pypirc|\.git-credentials", "credentials"),
+    R("keychain", "Read the keychain / password store", HIGH, r"\bsecurity\s+(find|dump)-(generic|internet)-password|"
+      r"\bsecret-tool\s+lookup|\bpass\s+show\b|\bop\s+(read|item\s+get)\b|\bgh\s+auth\s+token\b|cmdkey\s+/list",
+      "pulls secrets out of your password store"),
+    R("dotenv", "Read a .env file", MEDIUM, r"(^|[\s/'\"])\.env(\.\w+)?\b(?!\.example|\.sample|\.template)",
+      "usually holds API keys"),
+    R("env-dump", "Dumped all environment variables", MEDIUM, r"(^|[;&|]\s*)(printenv|env|set|export\s+-p)\s*($|[|>;&])",
+      "prints every secret in your environment"),
+    # --- sending things out -------------------------------------------------------------------------
+    R("upload", "Sent data to a server", MEDIUM, r"\bcurl\b(?![^|;&]*\s(-G|--get)\b)[^|;&]*(\s-d\s|\s--data(-binary|-raw|-urlencode)?\b|\s-F\s|"
+      r"\s--form\b|\s-T\s|\s--upload-file\b|\s-X\s*(POST|PUT|PATCH)\b)|\bwget\b[^|;&]*--post-(data|file)|"
+      r"\b(nc|ncat|netcat|socat)\b\s+\S+\s+\d+", "data leaving your machine"),
+    R("remote-copy", "Copied files to another machine", MEDIUM, r"\b(scp|rsync|sftp)\b[^|;&]*\S+@?[\w.-]+:", "files leaving"),
+    R("ssh", "SSH'd somewhere", LOW, r"(^|[;&|]\s*)ssh\s+(-\S+\s+)*[\w.-]*@?[\w.-]+\.\w+", "remote access"),
+    # --- shipping / irreversible ---------------------------------------------------------------------
+    R("publish", "Published a package", HIGH, r"\b(npm|pnpm|yarn)\s+publish\b|\btwine\s+upload\b|\b(uv|poetry|flit|hatch)"
+      r"\s+publish\b|\bcargo\s+publish\b|\bgem\s+push\b|\bdocker\s+push\b|\bgh\s+release\s+create\b",
+      "ships to the world, can't unship"),
+    R("push", "git push", LOW, r"\bgit\b[^;&|]*\bpush\b", "changes the remote"),
+    R("merge-pr", "Merged a PR", MEDIUM, r"\bgh\s+pr\s+merge\b", "lands code on someone's main branch"),
+    R("deploy", "Deployed", MEDIUM, r"\b(vercel\s+(--prod|deploy)|netlify\s+deploy|fly\s+deploy|kubectl\s+apply|"
+      r"terraform\s+apply|serverless\s+deploy|firebase\s+deploy|wrangler\s+(deploy|publish))\b", "changes production"),
+    # --- your system --------------------------------------------------------------------------------
+    R("sudo", "Used sudo", MEDIUM, r"(^|[;&|]\s*|\s)sudo\s", "root on your machine"),
+    R("persistence", "Set up something that runs on its own", MEDIUM, r"\b(crontab\s+(-e|-|\S+\.txt)|launchctl\s+(load|"
+      r"bootstrap)|systemctl\s+(--user\s+)?enable|schtasks\s+/create)\b|Library/LaunchAgents", "keeps running later"),
+    R("shell-rc", "Edited your shell startup files", MEDIUM, r"(>>?|tee(\s+-a)?)\s*\S*(\.zshrc|\.bashrc|\.bash_profile|"
+      r"\.profile|\.zprofile|config\.fish)\b", "runs in every terminal you open"),
+    R("global-install", "Installed software", LOW, r"\b(npm|pnpm|yarn)\s+(i|install|add)\s+(-g|--global)\b|"
+      r"\bbrew\s+install\b|\bapt(-get)?\s+install\b|\bpip3?\s+install\b(?![^;&|]*(-r\s|--requirement|-e\s|\.))",
+      "new software outside the project"),
+    R("kill", "Killed processes broadly", LOW, r"\b(pkill|killall)\b|\bkill\s+-9\s+-1\b", "can take down other apps"),
+]
+
+SENSITIVE_PATHS = [
+    (re.compile(r"/\.ssh/(?!.*\.pub$)(?!known_hosts|config$|authorized_keys)"), "ssh-keys", "Touched SSH keys", HIGH),
+    (re.compile(r"/\.aws/|/\.config/gcloud/|/\.azure/|/\.kube/config|/\.docker/config\.json|/\.netrc$|/\.npmrc$|"
+                r"/\.pypirc$|/\.git-credentials$"), "cloud-creds", "Read cloud credentials", HIGH),
+    (re.compile(r"(^|/)\.env(\.[\w-]+)?$"), "dotenv", "Read a .env file", MEDIUM),
+    (re.compile(r"/(Library/Keychains|\.gnupg|\.password-store)/"), "keychain", "Read the keychain / password store", HIGH),
+    (re.compile(r"/(\.zshrc|\.bashrc|\.bash_profile|\.profile|\.zprofile)$"), "shell-rc",
+     "Edited your shell startup files", MEDIUM),
+]
+DOTENV_OK = re.compile(r"\.env\.(example|sample|template|dist)$")
+
+
+HEREDOC = re.compile(r"<<-?\s*(['\"]?)(\w+)\1[^\n]*\n.*?\n\s*\2\s*(\n|$)", re.S)
+INLINE_SCRIPT = re.compile(r"\b(python[\d.]*|node|ruby|perl|php|deno\s+eval)\s+(-[a-zA-Z]*\s+)*-[ce]\s+"
+                           r"(\"(\\.|[^\"\\])*\"|'[^']*')", re.S)
+
+
+def shell_only(cmd: str) -> str:
+    """Drop heredoc bodies and inline Python/Node scripts: their text isn't run by the shell, so a test file that
+    mentions `curl | sh` shouldn't count as running it. (bash -c "..." stays: that IS shell.)"""
+    cmd = HEREDOC.sub(lambda m: m.group(0).split("\n", 1)[0] + "\n", cmd)
+    return INLINE_SCRIPT.sub(lambda m: m.group(1) + " -c …", cmd)
+
+
+def classify_command(cmd: str) -> list[tuple[Rule, str]]:
+    """[(rule, the part of the command that matched)]"""
+    cmd = shell_only(cmd)
+    hits: list[tuple[Rule, str]] = []
+    keys = set()
+    for r in COMMAND_RULES:
+        m = r.pattern.search(cmd)
+        if m:
+            # a specific rule hides its generic cousin
+            if r.key == "rm-rf" and "rm-root" in keys or r.key == "push" and "force-push" in keys:
+                continue
+            a, b = max(0, m.start() - 25), min(len(cmd), m.end() + 35)
+            snippet = ("…" if a else "") + cmd[a:b].strip() + ("…" if b < len(cmd) else "")
+            hits.append((r, snippet))
+            keys.add(r.key)
+    return hits
+
+
+def classify_path(path: str, kind: str) -> list[tuple[str, str, str]]:
+    p = path.replace("\\", "/")
+    out = []
+    for rx, key, title, sev in SENSITIVE_PATHS:
+        if rx.search(p) and not (key == "dotenv" and DOTENV_OK.search(p)):
+            if key == "shell-rc" and kind not in ("write", "edit"):
+                continue
+            out.append((key, title, sev))
+    return out
+
+
+def _norm(path: str) -> str:
+    p = path.replace("\\", "/")
+    p = re.sub(r"/+", "/", p)
+    parts: list[str] = []
+    for seg in p.split("/"):
+        if seg == "..":
+            if parts and parts[-1] not in ("", ".."):
+                parts.pop()
+        elif seg != ".":
+            parts.append(seg)
+    out = "/".join(parts)
+    return out.lower() if re.match(r"^[a-z]:", out, re.I) else out
+
+
+TEMP = re.compile(r"^(/tmp|/private/tmp|/var/folders|/private/var/folders|/dev/null)(/|$)|/temp/|/appdata/local/temp/",
+                  re.I)
+
+
+def outside(path: str, project: str | None) -> bool:
+    """Did the agent touch a file outside the folder it was started in? (Temp folders don't count.)"""
+    if not project or not path:
+        return False
+    p = _norm(path)
+    if not (p.startswith("/") or re.match(r"^[a-z]:/", p)):
+        return False  # relative paths are inside the project
+    root = _norm(project).rstrip("/")
+    if p == root or p.startswith(root + "/"):
+        return False
+    return not TEMP.search(p)

agentsnitch-0.1.0.dist-info/METADATA

@@ -0,0 +1,88 @@
+Metadata-Version: 2.5
+Name: agentsnitch
+Version: 0.1.0
+Summary: What did your AI coding agents actually do? Every command Claude Code, Codex and Gemini CLI ran on your machine, with force-pushes, curl | sh, secret reads and files outside the project flagged.
+Project-URL: Homepage, https://github.com/ArkaKhorchidian/agentsnitch
+Project-URL: Issues, https://github.com/ArkaKhorchidian/agentsnitch/issues
+Author: Arka Khorchidian
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-agents,audit,claude-code,cli,codex,coding-agents,devsecops,gemini-cli,llm,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Requires-Dist: rich>=13
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == 'test'
+Description-Content-Type: text/markdown
+
+# agentsnitch
+
+**What did your AI coding agents actually do?** agentsnitch reads the session logs that Claude Code, Codex and Gemini CLI keep on your machine and shows every command they ran and every file they touched. The ones worth a second look are flagged: force-pushes, `curl | sh`, reads of your SSH keys and `.env` files, and writes outside the project.
+
+```bash
+uvx agentsnitch
+```
+
+<p align="center"><img src="https://raw.githubusercontent.com/ArkaKhorchidian/agentsnitch/main/docs/demo.gif" alt="agentsnitch demo" width="760"></p>
+
+<sub>Demo on a month of made-up agent logs generated by <a href="docs/demo.py">docs/demo.py</a>. Run it to see what your own agents did.</sub>
+
+You approve commands one at a time, or you turned on auto-approve weeks ago. Either way, nobody reads the transcript afterwards. agentsnitch does.
+
+## What it flags
+
+| | Examples |
+|---|---|
+| **Remote code** | `curl … \| sh`, `wget … \| bash`, `iwr … \| iex`, `eval $(curl …)` |
+| **Destruction** | `rm -rf ~/`, `git push --force`, `git reset --hard`, `DROP TABLE`, `terraform destroy`, `kubectl delete`, `aws s3 rm` |
+| **Secrets** | private SSH keys, `~/.aws/credentials` and other cloud credentials, `.env` files, the macOS keychain / `pass` / 1Password CLI, `gh auth token`, dumping the whole environment |
+| **Data leaving** | `curl -X POST -d @file`, `scp`/`rsync` to other machines, `nc` |
+| **Shipping** | `npm publish`, `twine upload`, `docker push`, `gh release create`, `gh pr merge`, deploys |
+| **Your system** | `sudo`, edits to `.zshrc`/`.bashrc`, cron jobs and launch agents, files written outside the project folder |
+
+Text that's only *inside* a script (a heredoc, `python -c "…"`) isn't counted as run. `bash -c "…"` is, because that is shell.
+
+## Where it reads
+
+| Agent | Logs |
+|---|---|
+| Claude Code | `~/.claude/projects/*/*.jsonl` (or `$CLAUDE_CONFIG_DIR`) |
+| Codex CLI | `~/.codex/sessions/**/rollout-*.jsonl` (or `$CODEX_HOME`) |
+| Gemini CLI | `~/.gemini/tmp/*/chats/session-*` |
+
+Cursor keeps its history in a SQLite database, which isn't supported yet.
+
+## Options
+
+```
+agentsnitch                     # last 30 days
+agentsnitch --since 7d          # or 12h, 2026-10-01, all
+agentsnitch --project storefront
+agentsnitch --agent codex
+agentsnitch --low               # also show low-severity things (git push, rm -rf in the project, installs)
+agentsnitch --log               # every command and file action, oldest first
+agentsnitch --json              # for scripts
+```
+
+## Privacy
+
+agentsnitch only reads files on your machine and sends nothing anywhere.
+
+## Install
+
+```bash
+uvx agentsnitch           # run without installing
+pipx install agentsnitch  # or install it
+```
+
+Requires Python 3.9+. The only dependency is `rich`.
+
+## License
+
+MIT

agentsnitch-0.1.0.dist-info/RECORD

@@ -0,0 +1,11 @@
+agentsnitch/__init__.py,sha256=VBLc7FIDkfph6iDU7qdUTWZluEgKSFt-qBr14tCgjp4,88
+agentsnitch/__main__.py,sha256=E6Gls0DNz8GQK2K-kOUIx8cYhgANW_CH54VKrfCfs14,52
+agentsnitch/agentlogs.py,sha256=KZ-w1mVwluDN0pBELaVm84H_kNJjp83UUwzOHbFRYig,15970
+agentsnitch/audit.py,sha256=qcvr3XaEDGQa0xo0fqct3fBsFsz6MQP_n9jljR0jO-A,6624
+agentsnitch/cli.py,sha256=cPv-lhtjnGcVoSlbRC1AkrK2jWQG9PqQXB8M2vqBMLc,6998
+agentsnitch/rules.py,sha256=ZdPCxbpzGjeUM5n0gdQjvBxgqYLrrK6o4IkvhaCIKFs,9876
+agentsnitch-0.1.0.dist-info/METADATA,sha256=RlPn1T9fjKa6Ljja4hr87ebvm5e5NaiG6hkExSA0tF4,3777
+agentsnitch-0.1.0.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+agentsnitch-0.1.0.dist-info/entry_points.txt,sha256=DmUjgrzJrxbTI4_7siQvpFu-mCS1oHtKgqpbnz7bN_Q,53
+agentsnitch-0.1.0.dist-info/licenses/LICENSE,sha256=mxFQpL6plnvuVMkJNW-M1_rxIlAzORcfDhnP1UETuKI,1073
+agentsnitch-0.1.0.dist-info/RECORD,,

agentsnitch-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

agentsnitch-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+agentsnitch = agentsnitch.cli:main

agentsnitch-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Arka Khorchidian
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.