bashboy 0.1.0__py3-none-any.whl

bashboy/rules.py

@@ -0,0 +1,225 @@
+"""Structural allowlist and hard denylist fast paths.
+
+Both functions are pure: no I/O, no environment reads, no imports beyond the
+standard library's ``re`` and ``dataclasses``. They run before any model call,
+so the hook path stays fast and offline.
+
+The allowlist is deliberately structural. A command is only allowlisted when it
+contains no shell operators, substitutions, redirections, or chaining -- a
+command that merely *looks* like ``ls`` but smuggles a second command is never
+allowlisted. False negatives (falling through to the model) are safe; false
+positives are not.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+# Shell metacharacters that make a command structurally unsuitable for the
+# allowlist. This deliberately excludes glob characters (``*``, ``?``, ``~``,
+# ``[``), which cannot start a new command or substitute one, and is required to
+# keep read-only forms such as ``find . -name '*.py'`` and ``git diff HEAD~1``
+# allowlistable.
+SHELL_METACHARS = frozenset(";|&$`<>(){}\\\n\r\x00")
+
+_SIMPLE_HEADS = frozenset(
+    {"ls", "pwd", "cat", "head", "tail", "wc", "grep", "rg", "find", "echo", "which", "whoami", "date"}
+)
+_GIT_SUBCOMMANDS = frozenset({"status", "diff", "log", "show", "branch"})
+_VERSION_HEADS = frozenset({"uv", "python", "node"})
+# ``find`` is read-only until it is asked to execute or delete something.
+_FIND_EXEC_FLAGS = frozenset({"-exec", "-execdir", "-ok", "-okdir", "-delete"})
+
+_SPLIT_SEGMENTS = re.compile(r";|&&|\|\||\||\r?\n")
+_MAX_SEGMENT_DEPTH = 5
+
+
+@dataclass(frozen=True)
+class DenyHit:
+    """A denylist match: what rule fired and why."""
+
+    reason: str
+    pattern: str
+
+
+def _command_substitutions(command: str) -> list[str]:
+    """Return the bodies of ``$( ... )`` and backtick substitutions."""
+    bodies: list[str] = []
+    i = 0
+    length = len(command)
+    while i < length:
+        ch = command[i]
+        if ch == "`":
+            end = command.find("`", i + 1)
+            if end == -1:
+                break
+            bodies.append(command[i + 1 : end])
+            i = end + 1
+            continue
+        if ch == "$" and i + 1 < length and command[i + 1] == "(":
+            depth = 0
+            j = i + 1
+            while j < length:
+                if command[j] == "(":
+                    depth += 1
+                elif command[j] == ")":
+                    depth -= 1
+                    if depth == 0:
+                        break
+                j += 1
+            if j < length:
+                bodies.append(command[i + 2 : j])
+                i = j + 1
+                continue
+        i += 1
+    return bodies
+
+
+def segments(command: str) -> list[str]:
+    """Split a command into the raw string plus every executable fragment.
+
+    Fragments are split on ``;``, ``&&``, ``||``, ``|`` and newlines, and the
+    bodies of command substitutions are added (recursively, capped at 5 levels).
+    """
+    return _segments(command, 0)
+
+
+def _segments(command: str, depth: int) -> list[str]:
+    out = [command]
+    if depth >= _MAX_SEGMENT_DEPTH:
+        return out
+    for piece in _SPLIT_SEGMENTS.split(command):
+        if piece.strip():
+            out.append(piece)
+    for body in _command_substitutions(command):
+        out.extend(_segments(body, depth + 1))
+    return out
+
+
+# --- denylist -------------------------------------------------------------
+
+_RM_PREFIX = r"(?<![-\w])rm\s+(?:(?:-[A-Za-z]+|--[\w-]+)\s+)+"
+
+# Protected targets: filesystem root, root glob, system directories, home.
+_RM_PROTECTED_TARGET = (
+    r"(?:"
+    r"/(?=\s|$)"
+    r"|/\*"
+    r"|/(?:usr|etc|var|bin|sbin|boot|lib|lib64|opt|root|home|srv|sys|dev|proc)\b\S*"
+    r"|~(?=\s|$)"
+    r"|~/(?=\s|$)"
+    r"|~/\*"
+    r"|\$(?:HOME|\{HOME\})(?=\s|$|/)"
+    r")"
+)
+
+_RM_PROTECTED = re.compile(_RM_PREFIX + _RM_PROTECTED_TARGET, re.IGNORECASE)
+_RM_WILDCARD = re.compile(_RM_PREFIX + r"(?:\./)?\*(?=\s|$)", re.IGNORECASE)
+
+DENY_RULES: list[tuple[re.Pattern[str], str]] = [
+    (_RM_PROTECTED, "recursive delete of a protected path"),
+    (_RM_WILDCARD, "recursive delete of a wildcard target at the filesystem root"),
+    (re.compile(r"\bmkfs(?:\.[a-z0-9]+)?\b", re.IGNORECASE), "filesystem creation on a device"),
+    (re.compile(r"\b(?:fdisk|parted|diskpart)\b", re.IGNORECASE), "disk partitioning"),
+    (re.compile(r"\bformat\s+[a-z]:", re.IGNORECASE), "drive format"),
+    (re.compile(r"\bdd\b[^\n]*\bof=/dev/", re.IGNORECASE), "raw write to a block device"),
+    (re.compile(r">\s*/dev/(?:sd|hd|nvme|disk|vd)", re.IGNORECASE), "raw write to a block device"),
+    (re.compile(r"\bshred\b[^\n]*/dev/", re.IGNORECASE), "shred of a block device"),
+    (
+        re.compile(r":\s*\(\s*\)\s*\{[^}]*:\s*\|\s*:[^}]*&\s*\}\s*;\s*:", re.IGNORECASE),
+        "fork bomb",
+    ),
+    (re.compile(r"\bchmod\s+(?:-[a-zA-Z]+\s+)*777\s+/(?=\s|$)", re.IGNORECASE), "world-writable root"),
+    (re.compile(r"\bchown\s+(?:-[a-zA-Z]+\s+)*\S+\s+/(?=\s|$)", re.IGNORECASE), "ownership change on root"),
+    (re.compile(r"\b(?:shutdown|reboot|halt|poweroff)\b", re.IGNORECASE), "host power control"),
+    (
+        re.compile(
+            r"remove-item\b[^\n]*-recurse[^\n]*(?:[a-z]:[\\/]?\s*$|\s/[\"']?\s*$)",
+            re.IGNORECASE,
+        ),
+        "recursive delete of a drive root",
+    ),
+    (
+        re.compile(
+            r"\bgit\s+clean\s+-[a-zA-Z]*[fdx][a-zA-Z]*[^\n]*(?:\s/(?=\s|$)|\s--\s+/)",
+            re.IGNORECASE,
+        ),
+        "git clean at the filesystem root",
+    ),
+]
+
+# ``rm -rf *`` only denies when it would run at a filesystem root, where the
+# glob expands to the whole disk. Elsewhere the model decides.
+_CWD_GATED = frozenset({_RM_WILDCARD.pattern})
+
+_DRIVE_ROOT = re.compile(r"^[A-Za-z]:[\\/]?$")
+
+
+def _at_filesystem_root(cwd: str | None) -> bool:
+    if cwd is None:
+        return True
+    stripped = cwd.strip()
+    if stripped in {"/", "\\", ""}:
+        return True
+    return bool(_DRIVE_ROOT.match(stripped))
+
+
+def check_denylist(command: str, cwd: str | None = None) -> DenyHit | None:
+    """Return the first denylist hit, or ``None``.
+
+    The raw command, every operator-split segment, and every command-substitution
+    body are scanned, so payloads hidden in compound commands are caught.
+    """
+    if not isinstance(command, str) or not command.strip():
+        return None
+    pieces = segments(command)
+    for piece in pieces:
+        for pattern, reason in DENY_RULES:
+            if pattern.search(piece) is None:
+                continue
+            if pattern.pattern in _CWD_GATED and not _at_filesystem_root(cwd):
+                continue
+            return DenyHit(reason=reason, pattern=pattern.pattern)
+    return None
+
+
+# --- allowlist ------------------------------------------------------------
+
+
+def check_allowlist(command: str) -> str | None:
+    """Return a stable label when the command is a single allowlisted program."""
+    if not isinstance(command, str):
+        return None
+    cmd = command.strip()
+    if not cmd:
+        return None
+    if any(ch in SHELL_METACHARS for ch in cmd):
+        return None
+
+    tokens = cmd.split()
+    if not tokens:
+        return None
+    head = tokens[0]
+
+    if head == "cd":
+        # ``cd`` with at most one plain argument.
+        return "cd" if len(tokens) <= 2 else None
+
+    if head in _SIMPLE_HEADS:
+        if head == "find" and any(tok.lower() in _FIND_EXEC_FLAGS for tok in tokens[1:]):
+            return None
+        return head
+
+    if head in _VERSION_HEADS:
+        if len(tokens) == 2 and tokens[1] == "--version":
+            return f"{head} --version"
+        return None
+
+    if head == "git":
+        sub = next((tok for tok in tokens[1:] if not tok.startswith("-")), None)
+        if sub in _GIT_SUBCOMMANDS:
+            return f"git {sub}"
+        return None
+
+    return None

bashboy-0.1.0.dist-info/METADATA

@@ -0,0 +1,298 @@
+Metadata-Version: 2.5
+Name: bashboy
+Version: 0.1.0
+Summary: Classify shell commands as allow or deny before an agent runs them.
+Project-URL: Homepage, https://github.com/Mann10/bashboy
+Project-URL: Issues, https://github.com/Mann10/bashboy/issues
+Project-URL: Source, https://github.com/Mann10/bashboy
+Author-email: Mann10 <82712171+Mann10@users.noreply.github.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agents,claude-code,guardrails,opencode,security,shell
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# BashBoy
+
+BashBoy is a small, dependency-free Python CLI that classifies a shell command as
+`allow` or `deny` **before** a coding agent runs it. It sits in front of Claude Code
+(`PreToolUse` hook) and OpenCode (plugin) and answers one question: is this command
+safe to run unattended?
+
+> **BashBoy only narrows; `allow` means *no objection*.** It never approves a tool
+> call. When BashBoy says `allow` it prints nothing (Claude) or returns normally
+> (OpenCode), and the host's normal permission flow still applies. There is no
+> `ask` verdict, no auto-approve path, and no way for BashBoy to widen permissions.
+
+Three layers, in order:
+
+1. **Local fast paths** (no network): a structural allowlist for single read-only
+   commands, and a hard denylist for destructive ones.
+2. **Model classification** against the Clocked (`clocked/fill`) endpoint for everything
+   else.
+3. **Host adapters** that express denial only.
+
+Anything the fast paths do not recognise goes to the model. Anything the model path
+cannot answer clearly becomes `deny`.
+
+## Install
+
+Requires Python 3.10+ and [uv](https://docs.astral.sh/uv/).
+
+```bash
+uv tool install bashboy     # install once
+uvx bashboy --help          # or run without installing
+```
+
+From a local checkout (uvx resolves the project from the path):
+
+```bash
+uvx --from /path/to/BashBoy bashboy check --command "git status"
+uvx --from /path/to/BashBoy bashboy install --claude
+```
+
+The package has **zero runtime dependencies** — everything is the Python standard
+library. `pytest` is a development-only dependency.
+
+The API key is read from the environment (default `CLOCKED_API_KEY`). It is never
+written to disk:
+
+```bash
+export CLOCKED_API_KEY=...        # bash
+$env:CLOCKED_API_KEY = "..."      # PowerShell
+```
+
+## Quick start
+
+```bash
+bashboy check --command "rm -rf /"
+# deny (denylist): recursive delete of a protected path
+
+bashboy check --command "git status"
+# allow (allowlist): matches allowlist: git status
+
+bashboy check --command "docker run --rm alpine sh" --json
+# {"decision": "deny", "source": "fallback", "reason": "classifier unavailable: no API key ...", ...}
+```
+
+Exit codes:
+
+| Code | Meaning |
+|------|---------|
+| `0`  | `allow` |
+| `1`  | `deny` |
+| `2`  | configuration or usage error (never a silent allow) |
+
+`--json` prints exactly one object, in this key order:
+
+```json
+{"decision":"deny","source":"denylist","reason":"recursive delete of a protected path","risk":null,"latency_ms":0}
+```
+
+`source` is one of `denylist`, `allowlist`, `model`, `fallback`, `disabled`.
+`--cwd DIR` supplies the working directory used for context (default: current
+directory).
+
+## Configuration
+
+Optional file at `~/.bashboy/config.toml` (override with `BASHBOY_CONFIG`).
+Create it with `bashboy config init`; inspect with `bashboy config show`.
+A missing file means these defaults:
+
+```toml
+[provider]
+endpoint = "https://clocked.rezolve.ai/clocked/fill"
+api_key_env = "CLOCKED_API_KEY"
+timeout_ms = 4000
+
+[policy]
+fail_mode = "closed"   # closed | open
+denylist = true
+allowlist = true
+
+[integrations.claude]
+timeout_s = 15
+
+[integrations.opencode]
+timeout_ms = 15000
+```
+
+Malformed TOML is a hard error (exit 2) from `check` — the gate never silently
+loosens because a file failed to parse.
+
+| Variable | Effect |
+|----------|--------|
+| `BASHBOY_CONFIG` | Path to the config file (default `~/.bashboy/config.toml`) |
+| `BASHBOY_ENDPOINT` | Overrides `[provider].endpoint` |
+| `BASHBOY_API_KEY_ENV` | Name of the environment variable holding the key |
+| `BASHBOY_FAIL_MODE` | `closed` (default) or `open`; anything else is an error |
+| `BASHBOY_DISABLE` | `1`/`true`/`yes` disables **all** checks (see below) |
+| `BASHBOY_DEBUG` | `1`/`true`/`yes` writes diagnostics to stderr only |
+
+## Claude Code setup
+
+```bash
+bashboy install --claude
+```
+
+This merges a `PreToolUse` hook into `~/.claude/settings.json` (override with
+`--settings PATH`). Unrelated keys and unrelated hook events are preserved; an
+existing BashBoy handler is updated in place, so re-running never duplicates it.
+The previous file is copied to `settings.json.bak` and the new file is written
+atomically.
+
+The exact entry it writes:
+
+```json
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash|PowerShell",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "uvx",
+            "args": ["bashboy", "check", "--claude-hook"],
+            "timeout": 15,
+            "statusMessage": "BashBoy: checking command"
+          }
+        ]
+      }
+    ]
+  }
+}
+```
+
+Options:
+
+```bash
+bashboy install --claude --dry-run     # print the resulting JSON, write nothing
+bashboy install --claude --settings ./settings.json
+bashboy install --claude --from /path/to/BashBoy
+```
+
+`--from SPEC` rewrites the argv to
+`["--from", SPEC, "bashboy", "check", "--claude-hook"]`, so `uvx` runs the given
+local checkout. The path is written verbatim as a single argv element — never
+interpolated into a shell string.
+
+The hook reads one JSON object on stdin. On `deny` it prints the
+`hookSpecificOutput` envelope with `permissionDecision: "deny"`; on `allow`, blank
+input, or malformed input it prints nothing and exits `0` so the host's normal
+permission flow continues.
+
+## OpenCode setup
+
+```bash
+bashboy install --opencode
+```
+
+This writes two files under `~/.config/opencode` (override with `--config-dir DIR`):
+
+- `plugins/bashboy.ts` — the generated plugin;
+- `opencode.json` — registers the plugin's absolute path.
+
+`opencode.json` is created with `{"$schema": "https://opencode.ai/config.json"}` if
+absent. Existing keys and existing plugin entries are preserved, the BashBoy path
+is appended only once, and the previous config is backed up before an atomic write.
+OpenCode V2 documents the key as `plugins`; V1 used `plugin`. BashBoy reads
+whichever key already exists, preserves it, defaults to `plugins` when neither is
+present, and never writes both.
+
+The plugin hooks both API generations with one shared helper:
+
+- **V2:** `Plugin.define({ id: "bashboy", setup })` registering
+  `ctx.tool.hook("execute.before", ...)`, reading `event.input.command`.
+- **V1 fallback:** `server()` returning `"tool.execute.before"`, reading
+  `output.args.command`.
+
+It acts only for the `bash`/`shell` tools and runs
+`uvx bashboy check --json --command <cmd> --cwd <dir>` via
+`execFile(..., { shell: false, timeout: 15000, windowsHide: true })`. The command is
+a single argv element; it is never passed through a shell and never concatenated
+into a command line. On `deny` it throws
+`Error("BashBoy blocked this command: <reason>")`. If `uvx` is missing, the exit is
+non-zero without parseable JSON, the JSON is invalid, the call times out, or the
+verdict is unexpected, it throws
+`Error("BashBoy could not verify this command: <detail>")` — fail closed.
+
+`bashboy install --opencode --dry-run` prints one JSON object with
+`plugin_path`, `plugin_source`, and the would-be `config`, and writes nothing.
+
+## Escape hatch
+
+> **`BASHBOY_DISABLE=1` disables all checks.** Commands are allowed with
+> `source: "disabled"` and no denylist, allowlist, or model evaluation runs.
+> For emergencies and CI debugging only. Never set it in an agent's environment
+> or in a shell that an agent controls.
+
+```bash
+BASHBOY_DISABLE=1 bashboy check --command "rm -rf /"   # allow (disabled)
+```
+
+## Privacy
+
+For model classification, the **command text and the working directory** are sent
+to the configured Clocked endpoint over HTTPS (`text: "cwd: <cwd>\ncommand: <cmd>"`).
+Nothing else is transmitted; no files are uploaded.
+
+Fast-path verdicts (`denylist`, `allowlist`, `disabled`) never leave the machine.
+There is no analytics, no audit log, no cache, and no telemetry. The API key is
+read from the environment at call time, sent only as the `Authorization` header,
+and never logged, persisted, or included in `config show`.
+
+## Known limitation: unverified Clocked envelope
+
+The response shape of the Clocked (`clocked/fill`) endpoint is **unverified**. Parsing
+is deliberately tolerant (`extract_field` walks nested objects and arrays
+breadth-first, and unwraps `value`/`text`/`answer`/`label`/`result`/`content`
+containers). If the response cannot be resolved to a clear `allow` or `deny`, the
+verdict is `deny` with `source: "fallback"`. Report envelope mismatches with the
+raw (redacted) response so the parser can be extended.
+
+## Limitations
+
+- The structural allowlist is conservative by design: any operator, substitution,
+  redirection, or chaining disqualifies a command. False negatives simply go to the
+  model.
+- The denylist is a fast path, not a complete policy. It catches literal destructive
+  patterns and payloads hidden behind `;`, `&&`, `||`, `|`, newlines, `$(...)`, and
+  backticks — but it does not decode base64, `r''m`-style quoting, or other
+  obfuscation. Such commands are not allowlisted and therefore reach the model,
+  which fails closed.
+- PowerShell/bash parity is best-effort. The allowlist covers a small bash-oriented
+  set; PowerShell users should expect more commands to reach the model.
+- `git reset --hard` is intentionally **not** denied: it is recoverable via the
+  reflog. `git clean -fdx /` at a filesystem root is denied.
+- `--from SPEC` is trusted input: a user who runs `install --from <path>` is
+  explicitly pointing BashBoy at that checkout.
+- v1 has no audit log; the host's own transcript remains the record.
+
+## Development
+
+```bash
+uv run pytest          # offline; no network access required
+uv run bashboy selftest
+```
+
+Layout:
+
+```
+src/bashboy/
+  cli.py            check / install / config / selftest / version
+  config.py         TOML defaults, env overrides, API key lookup
+  rules.py          structural allowlist + hard denylist (pure)
+  provider.py       Clocked client, tolerant envelope parser
+  classify.py       verdict pipeline (fast paths -> model -> fail closed)
+  hooks/claude.py   Claude Code PreToolUse adapter
+  installers/       Claude settings.json and OpenCode plugin installers
+tests/              offline test suite
+```
+
+There are **no runtime dependencies beyond the standard library**. The provider is
+imported lazily inside the model branch so the hook path stays fast, and the
+installers are imported lazily by `install` only.

bashboy-0.1.0.dist-info/RECORD

@@ -0,0 +1,17 @@
+bashboy/__init__.py,sha256=8z_YiSXRaLrGKo9gNkSwUH5WmACShwAKKqtqDyr8bPk,115
+bashboy/__main__.py,sha256=ECpvuTVRfK-8nSCmYrYwys-NU-BwGsjPrex7WJeVAg8,85
+bashboy/classify.py,sha256=jFpmZBKsp8dDl3Ozh52oqHfxrfNreYWmhInNKsuA3gU,4254
+bashboy/cli.py,sha256=Tr8o4KuN2W019-1rKY1IUAbIaylfld8GsePzDjXag_M,9158
+bashboy/config.py,sha256=COhAqiv6NY-oe9bNIrUlRAITJe17i9P086xGmjKYgXk,6590
+bashboy/provider.py,sha256=PCJhwOLk587Sj8VfwwR88j2qe57EFUgFuikCZDYrxuU,7825
+bashboy/rules.py,sha256=McpVKzb-TPApPhRKFpCeeAlYcb4e2f0DNL_gXWC209k,7816
+bashboy/hooks/__init__.py,sha256=lONS1cqooFlAC4Y7rZ1H8aa6P5leoBjQE8Ty059vB24,74
+bashboy/hooks/claude.py,sha256=FcbgET1_7YUZTl3T54sDSjYADJasvhXnHogFmEcB1c0,2850
+bashboy/installers/__init__.py,sha256=IVEA3E3DG3SZcvPSemfCdQzB7NnZZiCyy76r9M8LcTA,974
+bashboy/installers/claude.py,sha256=OZPMDZ2vlDLbR16DgQ0VnvezrUHv6zFNhjL2MxaQVr8,4094
+bashboy/installers/opencode.py,sha256=wA21uf8dG6YQ8vBT10AvNIXJFVbEVxGSpgAniALgEgY,6464
+bashboy-0.1.0.dist-info/METADATA,sha256=6kRLx7Zo4yo_MNnqvzIvZ_QJNw8UTmQOGbEk81tOcHo,10930
+bashboy-0.1.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+bashboy-0.1.0.dist-info/entry_points.txt,sha256=mNMO2puTzhoLdYQhZm6qVHqsMFrX__QIKwhazLVz4Y0,45
+bashboy-0.1.0.dist-info/licenses/LICENSE,sha256=zjV-RsxGo72MGnQNyku9dy9zFR2dcBDs8oFoKgwuu68,1063
+bashboy-0.1.0.dist-info/RECORD,,

bashboy-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

bashboy-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+bashboy = bashboy.cli:main

bashboy-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mann10
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.