cursorfleet 0.1.0__py3-none-any.whl

cursorfleet/tui/watch.py

@@ -0,0 +1,33 @@
+"""Optional ``watchfiles`` integration: refresh promptly when the spool changes.
+
+Polling is always on (the default 2 s interval); watching only makes the UI react sooner and
+is skipped when ``watchfiles`` is not installed (``pip install cursorfleet[watch]``).
+"""
+
+from __future__ import annotations
+
+import importlib
+import importlib.util
+from collections.abc import AsyncIterator, Callable
+from typing import Any, cast
+
+WatchFactory = Callable[[str], AsyncIterator[object]]
+
+
+def watchfiles_available() -> bool:
+    return importlib.util.find_spec("watchfiles") is not None
+
+
+def default_watch_factory() -> WatchFactory | None:
+    """A factory yielding one item per batch of changes under a directory, or ``None``."""
+    if not watchfiles_available():
+        return None
+    awatch: Any = importlib.import_module("watchfiles").awatch
+
+    def factory(path: str) -> AsyncIterator[object]:
+        return cast(
+            AsyncIterator[object],
+            awatch(path, debounce=300, step=100, yield_on_timeout=False, raise_interrupt=False),
+        )
+
+    return factory

cursorfleet/workflow/artifacts.py

@@ -0,0 +1,148 @@
+"""Validation of agent-declared Markdown artifacts under ``.cursorfleet/work/`` (ADR 0006).
+
+Artifacts are self-reported and untrusted: this module only checks *shape*. The
+body is never parsed or copied anywhere. PROVISIONAL (ADR 0006): the ``schema``
+value and field set may change once agents have been observed using them.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from datetime import datetime
+from pathlib import PurePosixPath
+
+from cursorfleet.events.ids import SAFE_ID_PATTERN
+from cursorfleet.events.pathcheck import check_relative_posix
+from cursorfleet.workflow.frontmatter import Document, FrontmatterError, parse_frontmatter
+
+ARTIFACT_SCHEMA_LEGACY = "cursorfleet.artifact/1"
+ARTIFACT_SCHEMA = "cursorfleet.artifact/0.1"
+ARTIFACT_SCHEMAS: frozenset[str] = frozenset({ARTIFACT_SCHEMA, ARTIFACT_SCHEMA_LEGACY})
+ARTIFACT_KINDS: frozenset[str] = frozenset(
+    {"plan.created", "handoff.created", "blocker.raised", "context.loaded"}
+)
+REQUIRED_KEYS_LEGACY: frozenset[str] = frozenset(
+    {"schema", "kind", "task", "author_role", "created"}
+)
+REQUIRED_KEYS: frozenset[str] = frozenset(
+    {"schema", "kind", "task", "artifact_id", "revision", "author_role", "created"}
+)
+OPTIONAL_KEYS: frozenset[str] = frozenset({"to_role", "issue_ref", "context_refs", "digest"})
+MAX_ARTIFACT_BYTES = 64 * 1024
+MAX_CONTEXT_REFS = 50
+MAX_ISSUE_REF_CHARS = 128
+
+TASK_SLUG = re.compile(r"^[a-z0-9][a-z0-9._-]{0,63}$")
+_SAFE_ID = re.compile(SAFE_ID_PATTERN)
+_URL_USERINFO = re.compile(r"://[^/\s]*@")
+
+
+@dataclass(frozen=True)
+class ArtifactProblem:
+    code: str
+    message: str
+
+
+def _check_created(value: object) -> str | None:
+    if not isinstance(value, str):
+        return "must be a string"
+    try:
+        datetime.fromisoformat(value)
+    except ValueError:
+        return "must be an ISO 8601 date or timestamp"
+    return None
+
+
+def validate_artifact_text(text: str, rel_path: str) -> list[ArtifactProblem]:  # noqa: PLR0912, PLR0915
+    """Validate one artifact. ``rel_path`` is relative to the work dir (``<task>/<file>.md``)."""
+    problems: list[ArtifactProblem] = []
+    if len(text.encode("utf-8")) > MAX_ARTIFACT_BYTES:
+        problems.append(ArtifactProblem("artifact.too_large", f"larger than {MAX_ARTIFACT_BYTES}"))
+        return problems
+    try:
+        doc: Document = parse_frontmatter(text)
+    except FrontmatterError as exc:
+        return [ArtifactProblem("artifact.frontmatter", str(exc))]
+    meta = doc.meta
+    schema = meta.get("schema") if isinstance(meta.get("schema"), str) else None
+    required = REQUIRED_KEYS if schema == ARTIFACT_SCHEMA else REQUIRED_KEYS_LEGACY
+    allowed_keys = required | OPTIONAL_KEYS
+
+    missing = sorted(required - meta.keys())
+    if missing:
+        problems.append(ArtifactProblem("artifact.missing_key", f"missing: {', '.join(missing)}"))
+    unknown = sorted(meta.keys() - allowed_keys)
+    if unknown:
+        problems.append(ArtifactProblem("artifact.unknown_key", f"unknown: {', '.join(unknown)}"))
+
+    if schema is not None and schema not in ARTIFACT_SCHEMAS:
+        problems.append(
+            ArtifactProblem("artifact.schema", f"schema must be one of {sorted(ARTIFACT_SCHEMAS)}")
+        )
+    if "kind" in meta and meta["kind"] not in ARTIFACT_KINDS:
+        allowed = ", ".join(sorted(ARTIFACT_KINDS))
+        problems.append(ArtifactProblem("artifact.kind", f"kind must be one of: {allowed}"))
+
+    parts = PurePosixPath(rel_path).parts
+    dir_task = parts[0] if len(parts) >= 2 else None
+    if dir_task is None:
+        problems.append(
+            ArtifactProblem("artifact.location", "must live in <work>/<task>/<file>.md")
+        )
+    task = meta.get("task")
+    if "task" in meta:
+        if not isinstance(task, str) or not TASK_SLUG.match(task):
+            problems.append(ArtifactProblem("artifact.task", "task must be a lowercase slug"))
+        elif dir_task is not None and task != dir_task:
+            problems.append(ArtifactProblem("artifact.task", "task must equal the directory name"))
+
+    for key in ("author_role", "to_role"):
+        if key in meta:
+            value = meta[key]
+            if not isinstance(value, str) or not _SAFE_ID.match(value):
+                problems.append(ArtifactProblem(f"artifact.{key}", f"{key} must be a safe id"))
+
+    if "created" in meta:
+        err = _check_created(meta["created"])
+        if err:
+            problems.append(ArtifactProblem("artifact.created", f"created {err}"))
+
+    if "issue_ref" in meta:
+        ref = meta["issue_ref"]
+        if (
+            not isinstance(ref, str)
+            or not ref
+            or len(ref) > MAX_ISSUE_REF_CHARS
+            or not ref.isprintable()
+            or _URL_USERINFO.search(ref)
+        ):
+            problems.append(
+                ArtifactProblem(
+                    "artifact.issue_ref",
+                    "issue_ref must be short printable text without URL credentials",
+                )
+            )
+
+    if "context_refs" in meta:
+        refs = meta["context_refs"]
+        if not isinstance(refs, list) or len(refs) > MAX_CONTEXT_REFS:
+            problems.append(
+                ArtifactProblem(
+                    "artifact.context_refs",
+                    f"context_refs must be a list of at most {MAX_CONTEXT_REFS} paths",
+                )
+            )
+        else:
+            for ref_item in refs:
+                try:
+                    if not isinstance(ref_item, str):
+                        msg = "not a string"
+                        raise ValueError(msg)
+                    check_relative_posix(ref_item)
+                except ValueError as exc:
+                    problems.append(
+                        ArtifactProblem("artifact.context_refs", f"bad context_ref: {exc}")
+                    )
+                    break
+    return problems

cursorfleet/workflow/frontmatter.py

@@ -0,0 +1,232 @@
+"""Strict frontmatter parser: a flat YAML subset, stdlib only (ADR 0006).
+
+Accepted: ``key: value`` lines where the value is a plain scalar, a
+double-quoted JSON-style string or a single-quoted string, ``true``/``false``,
+an integer, or a list of such scalars written as ``- item`` lines or an inline
+``[a, b]``. Rejected: nesting, anchors, tags, multi-line scalars, duplicate keys,
+comments after values, and anything over the size caps. No YAML library is used,
+so none of YAML's unsafe features exist here.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import tomllib
+from dataclasses import dataclass
+
+MAX_FRONTMATTER_BYTES = 16 * 1024
+MAX_FRONTMATTER_LINES = 200
+MAX_LIST_ITEMS = 100
+
+Scalar = str | int | bool
+Value = Scalar | list[Scalar]
+
+_KEY = re.compile(r"^[A-Za-z][A-Za-z0-9_]{0,63}$")
+_INT = re.compile(r"^-?[0-9]{1,15}$")
+_FENCE = "---"
+_TOML_FENCE = "+++"
+_PLAIN_FORBIDDEN_START = set("&*!|>%@`{}[]#,'\"")
+
+
+class FrontmatterError(ValueError):
+    """Frontmatter is missing, malformed or outside the accepted subset."""
+
+
+@dataclass(frozen=True)
+class Document:
+    meta: dict[str, Value]
+    body: str
+
+
+def _scalar(raw: str) -> Scalar:
+    raw = raw.strip()
+    if raw == "":
+        msg = "empty value"
+        raise FrontmatterError(msg)
+    if raw[0] == '"':
+        try:
+            value = json.loads(raw)
+        except json.JSONDecodeError as exc:
+            msg = f"invalid double-quoted string: {raw[:40]!r}"
+            raise FrontmatterError(msg) from exc
+        if not isinstance(value, str):
+            msg = "invalid double-quoted string"
+            raise FrontmatterError(msg)
+        return value
+    if raw[0] == "'":
+        if len(raw) < 2 or raw[-1] != "'" or "'" in raw[1:-1].replace("''", ""):
+            msg = f"invalid single-quoted string: {raw[:40]!r}"
+            raise FrontmatterError(msg)
+        return raw[1:-1].replace("''", "'")
+    if raw[0] in _PLAIN_FORBIDDEN_START:
+        msg = f"unsupported YAML construct starting with {raw[0]!r}"
+        raise FrontmatterError(msg)
+    if " #" in raw:
+        msg = "inline comments are not supported"
+        raise FrontmatterError(msg)
+    if raw == "true":
+        return True
+    if raw == "false":
+        return False
+    if _INT.match(raw):
+        return int(raw)
+    if raw.startswith(("- ", "? ")) or raw.endswith(":") or ": " in raw:
+        msg = f"ambiguous plain scalar {raw[:40]!r} (quote it)"
+        raise FrontmatterError(msg)
+    return raw
+
+
+def _inline_list(raw: str) -> list[Scalar]:
+    inner = raw.strip()[1:-1].strip()
+    if inner == "":
+        return []
+    # Split on commas outside double quotes.
+    items: list[str] = []
+    buf: list[str] = []
+    in_quote = False
+    escaped = False
+    for ch in inner:
+        if in_quote:
+            buf.append(ch)
+            if escaped:
+                escaped = False
+            elif ch == "\\":
+                escaped = True
+            elif ch == '"':
+                in_quote = False
+        elif ch == '"':
+            in_quote = True
+            buf.append(ch)
+        elif ch == ",":
+            items.append("".join(buf))
+            buf = []
+        else:
+            buf.append(ch)
+    items.append("".join(buf))
+    return [_scalar(item) for item in items]
+
+
+def parse_frontmatter(text: str) -> Document:
+    """Parse YAML ``---`` frontmatter (legacy artifacts and Cursor kit files)."""
+    if text.startswith(_TOML_FENCE):
+        return parse_toml_frontmatter(text)
+    return _parse_yaml_frontmatter(text)
+
+
+def parse_toml_frontmatter(text: str) -> Document:  # noqa: PLR0912
+    """Parse TOML ``+++`` frontmatter (cursorfleet.artifact/0.1)."""
+    if not text.startswith(_TOML_FENCE):
+        msg = "TOML frontmatter must start with +++"
+        raise FrontmatterError(msg)
+    if len(text.encode("utf-8")) > MAX_FRONTMATTER_BYTES + 64 * 1024:
+        msg = "artifact too large"
+        raise FrontmatterError(msg)
+    lines = text.replace("\r\n", "\n").replace("\r", "\n").split("\n")
+    close = None
+    for index, line in enumerate(lines[1:], start=1):
+        if line.strip() == _TOML_FENCE:
+            close = index
+            break
+    if close is None:
+        msg = "unclosed TOML frontmatter"
+        raise FrontmatterError(msg)
+    block = "\n".join(lines[1:close])
+    try:
+        meta_raw = tomllib.loads(block)
+    except tomllib.TOMLDecodeError as exc:
+        msg = f"invalid TOML frontmatter: {exc}"
+        raise FrontmatterError(msg) from exc
+    if not isinstance(meta_raw, dict):
+        msg = "TOML frontmatter must be a table"
+        raise FrontmatterError(msg)
+    meta: dict[str, Value] = {}
+    for key, value in meta_raw.items():
+        if not _KEY.match(key):
+            msg = f"invalid key {key!r}"
+            raise FrontmatterError(msg)
+        if isinstance(value, bool | int | str):
+            meta[key] = value
+        elif isinstance(value, list):
+            if len(value) > MAX_LIST_ITEMS:
+                msg = "too many list items"
+                raise FrontmatterError(msg)
+            meta[key] = [item for item in value if isinstance(item, bool | int | str)]
+        else:
+            msg = f"unsupported TOML value for {key!r}"
+            raise FrontmatterError(msg)
+    return Document(meta=meta, body="\n".join(lines[close + 1 :]))
+
+
+def _parse_yaml_frontmatter(text: str) -> Document:  # noqa: PLR0912, PLR0915
+    """Split ``text`` into frontmatter and body. Raises ``FrontmatterError``."""
+    text = text.replace("\r\n", "\n")
+    if text.startswith("\ufeff"):
+        text = text[1:]
+    lines = text.split("\n")
+    if not lines or lines[0].rstrip() != _FENCE:
+        msg = "file must start with a '---' frontmatter fence"
+        raise FrontmatterError(msg)
+    try:
+        close = next(i for i in range(1, len(lines)) if lines[i].rstrip() == _FENCE)
+    except StopIteration:
+        msg = "frontmatter is not closed with '---'"
+        raise FrontmatterError(msg) from None
+    raw_lines = lines[1:close]
+    if close > MAX_FRONTMATTER_LINES or sum(len(x) + 1 for x in raw_lines) > MAX_FRONTMATTER_BYTES:
+        msg = "frontmatter is too large"
+        raise FrontmatterError(msg)
+
+    meta: dict[str, Value] = {}
+    current_list: str | None = None
+    for number, line in enumerate(raw_lines, start=2):
+        if line.strip() == "":
+            current_list = None
+            continue
+        if line.lstrip().startswith("#"):
+            continue
+        if line.startswith(("  - ", "- ", "    - ")) or line.strip() == "-":
+            if current_list is None:
+                msg = f"line {number}: list item without a key"
+                raise FrontmatterError(msg)
+            target = meta[current_list]
+            if not isinstance(target, list):
+                msg = f"line {number}: unexpected list item"
+                raise FrontmatterError(msg)
+            if len(target) >= MAX_LIST_ITEMS:
+                msg = f"line {number}: too many list items"
+                raise FrontmatterError(msg)
+            target.append(_scalar(line.strip()[1:]))
+            continue
+        if line[0] in " \t":
+            msg = f"line {number}: nested or indented values are not supported"
+            raise FrontmatterError(msg)
+        key, sep, rest = line.partition(":")
+        if not sep or not _KEY.match(key):
+            msg = f"line {number}: expected 'key: value'"
+            raise FrontmatterError(msg)
+        if key in meta:
+            msg = f"line {number}: duplicate key {key!r}"
+            raise FrontmatterError(msg)
+        current_list = None
+        rest = rest.strip()
+        if rest == "":
+            meta[key] = []
+            current_list = key
+        elif rest.startswith("["):
+            if not rest.endswith("]"):
+                msg = f"line {number}: unterminated inline list"
+                raise FrontmatterError(msg)
+            meta[key] = _inline_list(rest)
+        else:
+            try:
+                meta[key] = _scalar(rest)
+            except FrontmatterError as exc:
+                msg = f"line {number}: {exc}"
+                raise FrontmatterError(msg) from exc
+    return Document(meta=meta, body="\n".join(lines[close + 1 :]))
+
+
+def yaml_string(value: str) -> str:
+    """Render ``value`` as a double-quoted scalar this parser (and YAML) can read back."""
+    return json.dumps(value, ensure_ascii=False)

cursorfleet-0.1.0.dist-info/METADATA

@@ -0,0 +1,161 @@
+Metadata-Version: 2.5
+Name: cursorfleet
+Version: 0.1.0
+Summary: Unofficial local TUI and workflow harness (observe-only) for Cursor agent teams.
+Project-URL: Homepage, https://github.com/M9nx/cursorfleet
+Project-URL: Documentation, https://github.com/M9nx/cursorfleet/tree/main/docs
+Project-URL: Source, https://github.com/M9nx/cursorfleet
+Project-URL: Issues, https://github.com/M9nx/cursorfleet/issues
+Project-URL: Changelog, https://github.com/M9nx/cursorfleet/blob/main/CHANGELOG.md
+Project-URL: Security, https://github.com/M9nx/cursorfleet/blob/main/SECURITY.md
+Author: M9nx
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agents,cursor,git-worktree,hooks,observability,tui,workflow
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development
+Classifier: Topic :: Software Development :: Version Control :: Git
+Classifier: Topic :: System :: Monitoring
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: pydantic>=2
+Requires-Dist: textual>=0.80
+Requires-Dist: typer>=0.12
+Provides-Extra: watch
+Requires-Dist: watchfiles>=0.21; extra == 'watch'
+Description-Content-Type: text/markdown
+
+<div align="center">
+
+<a href="https://m9nx.github.io/cursorfleet/">
+  <img
+    src="public-docs/assets/og-card.png"
+    alt="CursorFleet — local observe-only harness for Cursor agent teams"
+    width="640"
+  />
+</a>
+
+<p>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT" /></a>
+  <img src="https://img.shields.io/badge/status-pre--alpha-orange.svg" alt="Status: pre-alpha" />
+  <img src="https://img.shields.io/badge/python-3.11%2B-blue.svg" alt="Python 3.11+" />
+  <a href="https://m9nx.github.io/cursorfleet/"><img src="https://img.shields.io/badge/docs-GitHub_Pages-222?style=flat-square&logo=github" alt="Documentation site" /></a>
+</p>
+
+<p>
+  <a href="https://m9nx.github.io/cursorfleet/">Website</a>
+  ·
+  <a href="docs/quickstart.md">Quickstart</a>
+  ·
+  <a href="docs/demo.md">Demo</a>
+  ·
+  <a href="CONTRIBUTING.md">Contributing</a>
+</p>
+
+</div>
+
+A local TUI and workflow harness for Cursor agent teams: see which local agents and worktrees
+are doing what, from passive hooks and read-only git, without sending anything anywhere.
+
+> **Unofficial:** CursorFleet is not affiliated with or endorsed by Anysphere or Cursor. "Cursor" is a trademark of its respective owner.
+
+## Status
+
+**Pre-alpha, not released.** There is no PyPI package, tag or GitHub release yet.
+
+- v0.1 is **Observe**: no enforcement, no forced approvals, and no cloud-agent visibility
+  (local Cursor sessions only). It is not a security boundary: a malicious or prompt-injected
+  agent can bypass or forge what it shows ([threat model](docs/threat-model.md)).
+- **Live Cursor (product hooks):** maintainer smoke on **Linux Cursor IDE 3.22.7** confirmed hook
+  telemetry, subagent lifecycle, and artifact scanning; see
+  [live validation index](docs/evidence/live-validation-index.md). **Q1/Q2** (subagent identity
+  on tool hooks, custom `subagent_type` naming) remain **OPEN**; M0a formal matrix is not complete.
+- **M2.5 active:** task-centric observer work (Active Run) is in progress; see
+  [status](docs/status.md). The M0a capture kit ([spike](spike/README.md)) remains separate.
+- **Supported surface for claims today:** local Cursor IDE (desktop) on Linux for the exercised
+  smoke only; CLI, Agents Window, worktrees, and parallel subagents are not claimed until matrix PASS.
+  The Cursor CLI, the Agents Window, Cursor-managed and manual worktrees, parallel
+  subagents and cloud agents are not claimed.
+- The name "CursorFleet" is a working name; the final name is a release gate
+  ([ADR 0005](docs/adr/0005-naming-and-trademark.md)).
+- Linux is the tested platform; macOS and Windows are CI-tested only
+  ([platform support](docs/platform-support.md)).
+- Cursor is the only officially supported IDE; internals are adapter-ready but no other
+  adapter is planned for v0.1.
+- Local only: no network calls, no telemetry, no accounts (checked by a test). It never stores
+  prompts, model thinking, responses, file contents, command output, environment variables,
+  emails or transcript paths ([privacy](docs/privacy.md)).
+
+## Install
+
+Needs Python 3.11+ and git. Until it is published, install from a checkout:
+
+```bash
+git clone https://github.com/M9nx/cursorfleet && cd cursorfleet
+uv tool install .            # or: pipx install .
+cursorfleet --version
+```
+
+(Once released: `uv tool install cursorfleet` or `pipx install cursorfleet`; see the
+[release checklist](docs/release-checklist.md).)
+
+## Quickstart
+
+```bash
+# from the repository root (Git is required; no --allow-non-git)
+cursorfleet init --cursor --dry-run   # review the exact diff first
+cursorfleet init --cursor             # install the observe-only hooks and kit (once per repo)
+# ...work with Cursor agents as usual...
+cursorfleet doctor                    # check hooks, runtime dir and spool
+cursorfleet tui                       # open the dashboard (needs an interactive terminal)
+cursorfleet status --json             # stable machine-readable snapshot for scripts
+cursorfleet uninstall                 # remove exactly what init added
+```
+
+Full walkthrough: [docs/quickstart.md](docs/quickstart.md). No Cursor handy? Run the
+[synthetic demo](docs/demo.md): `scripts/demo.sh`.
+
+Dashboard keys: `o` overview, `l` timeline, `w` worktrees, `g` gates, `e` evidence, `v`
+violations (v0.2 placeholder), `/` filter, `p` pin, `t` tiles (160+ columns), `r` re-read,
+`?` help, `q` quit. The TUI only observes: silence shows as STALE / OFFLINE, never idle, and
+gate tiles are heuristic and non-authoritative, not proof that anything passed. Details:
+[docs/tui.md](docs/tui.md).
+
+## Documentation
+
+[Quickstart](docs/quickstart.md) · [governance model](docs/governance.md) ·
+[demo](docs/demo.md) · [kit reference](docs/kit.md) · [TUI](docs/tui.md) ·
+[`status --json`](docs/status-json.md) · [product contract](docs/product-contract.md) ·
+[architecture](docs/architecture.md) · [privacy](docs/privacy.md) ·
+[threat model](docs/threat-model.md) · [security review](docs/security-review-v0.1.md) ·
+[platform support](docs/platform-support.md) · [hook latency](docs/hook-latency.md) ·
+[release checklist](docs/release-checklist.md) · [project status](docs/status.md) ·
+[empirical test plan](docs/empirical-test-plan.md) · [follow-ups](docs/follow-ups.md) ·
+[docs-site plan](docs/docs-site-plan.md) · [ADRs](docs/adr/README.md) ·
+[changelog](CHANGELOG.md)
+
+## Development
+
+```bash
+uv sync --all-extras
+uv run cursorfleet --version
+uv run ruff check . && uv run ruff format --check . && uv run mypy src && uv run pytest
+```
+
+Regenerate schemas with `uv run python scripts/gen_schemas.py`. See
+[CONTRIBUTING.md](CONTRIBUTING.md), [AGENTS.md](AGENTS.md) and [SECURITY.md](SECURITY.md).
+
+## License
+
+MIT, see [LICENSE](LICENSE).