leangate 0.1.0__tar.gz

leangate-0.1.0/.claude-plugin/marketplace.json

@@ -0,0 +1,13 @@
+{
+  "name": "leangate",
+  "owner": { "name": "lambdabypi", "url": "https://leangates.com" },
+  "description": "LeanGate for Claude Code: MCP tools and hooks that keep agent-written code from reimplementing your helpers, skipping error handling, or shipping security holes.",
+  "plugins": [
+    {
+      "name": "leangate",
+      "source": "./plugins/leangate",
+      "description": "MCP server plus SessionStart, UserPromptSubmit, per-edit and Stop hooks. Needs uv (uvx) on PATH.",
+      "category": "code-quality"
+    }
+  ]
+}

leangate-0.1.0/.dockerignore

@@ -0,0 +1,17 @@
+.venv
+.git
+.github
+**/__pycache__
+*.pyc
+*.egg-info
+.pytest_cache
+.env
+.env.*
+.leangate
+tests
+demo
+docs
+scripts
+editors
+*.vsix
+leangate.env

leangate-0.1.0/.github/scripts/action_report.py

@@ -0,0 +1,77 @@
+"""Turn a `leangate verify --json` report into a job summary and PR annotations.
+
+Used by the composite Action (action.yml). Stdlib only: it runs on the runner's Python.
+
+    python action_report.py report.json [--summary $GITHUB_STEP_SUMMARY] [--annotate]
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+from pathlib import Path
+
+
+def _cell(text: str | None) -> str:
+    """Make text safe inside one markdown table cell."""
+    return (text or "").replace("|", "\\|").replace("\r", " ").replace("\n", " ").strip()
+
+
+def _escape(text: str, prop: bool = False) -> str:
+    """Escape a workflow-command value (https://github.com/actions/toolkit/blob/main/packages/core/src/command.ts)."""
+    text = text.replace("%", "%25").replace("\r", "%0D").replace("\n", "%0A")
+    return text.replace(":", "%3A").replace(",", "%2C") if prop else text
+
+
+def summary(report: dict) -> str:
+    findings = report.get("findings", [])
+    blocked = report.get("gate") == "block"
+    head = "### LeanGate: :no_entry: blocked" if blocked else "### LeanGate: :white_check_mark: passed"
+    lines = [head, ""]
+    if not findings:
+        lines.append("No bloat found in this change.")
+    else:
+        lines += [f"{len(findings)} finding(s).", "",
+                  "| Kind | Location | Severity | Decision | Finding | Suggestion |",
+                  "|---|---|---|---|---|---|"]
+        for f in findings:
+            d = f.get("decision") or {}
+            decision = f"{d.get('choice', '')} ({d.get('action', '')}, {d.get('source', '')})" if d else ""
+            lines.append(f"| `{f['kind']}` | `{f['path']}:{f['line']}` | {f.get('severity', 0):.2f} | {_cell(decision)} "
+                         f"| {_cell(f.get('message'))} | {_cell(f.get('suggestion'))} |")
+    if report.get("suppressed"):
+        lines += ["", f"{report['suppressed']} previously rejected finding(s) suppressed."]
+    return "\n".join(lines) + "\n"
+
+
+def annotations(report: dict, block_severity: float) -> list[str]:
+    """Findings that caused a block are errors; the rest are warnings."""
+    blocked = report.get("gate") == "block"
+    out = []
+    for f in report.get("findings", []):
+        level = "error" if blocked and f.get("severity", 0) >= block_severity else "warning"
+        message = f.get("message", "") + (f" -> {f['suggestion']}" if f.get("suggestion") else "")
+        out.append(f"::{level} file={_escape(f['path'], True)},line={f['line']},"
+                   f"title={_escape('LeanGate ' + f['kind'], True)}::{_escape(message)}")
+    return out
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("report")
+    parser.add_argument("--summary", help="file to append the markdown summary to")
+    parser.add_argument("--annotate", action="store_true", help="print ::error/::warning workflow commands")
+    parser.add_argument("--block-severity", type=float,
+                        default=float(os.getenv("LEANGATE_BLOCK_SEVERITY") or 0.6))
+    args = parser.parse_args(argv)
+    report = json.loads(Path(args.report).read_text(encoding="utf-8"))
+    if args.summary:
+        with open(args.summary, "a", encoding="utf-8") as fh:
+            fh.write(summary(report))
+    if args.annotate and report.get("findings"):
+        print("\n".join(annotations(report, args.block_severity)))
+
+
+if __name__ == "__main__":
+    main()

leangate-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: pytest (${{ matrix.os }}, py${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.11", "3.12"]
+    env:
+      # Offline: no provider keys in CI, every provider uses its fallback.
+      LEANGATE_MOCK: "1"
+      PYTHONUTF8: "1"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+          cache-dependency-path: pyproject.toml
+
+      - name: Install
+        run: python -m pip install -e ".[service,editor,dev]"  # editor: pygls, which tests/test_lsp.py needs
+
+      # The test fixtures build throwaway git repos and commit into them.
+      - name: Configure git
+        run: |
+          git config --global user.email "ci@leangate.invalid"
+          git config --global user.name "LeanGate CI"
+          git config --global init.defaultBranch main
+
+      - name: Test
+        run: python -m pytest -q

leangate-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,43 @@
+name: Publish to PyPI
+
+# Runs when a version tag is pushed (git tag v0.1.0 && git push origin v0.1.0). Uses PyPI trusted publishing:
+# no token is stored; PyPI trusts this workflow in this repo, set up once as a "pending publisher" on pypi.org.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Tag matches the package version
+        run: |
+          version=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          test "v$version" = "$GITHUB_REF_NAME" || { echo "tag $GITHUB_REF_NAME != pyproject version $version"; exit 1; }
+      - run: python -m pip install build twine
+      - run: python -m build
+      - run: python -m twine check --strict dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

leangate-0.1.0/.gitignore

@@ -0,0 +1,19 @@
+.venv/
+__pycache__/
+*.egg-info/
+.pytest_cache/
+.env
+dist/
+build/
+
+# Local-only project notes
+docs/
+
+# `leangate --json verify` output: findings quote code from whatever repo was checked
+report*.json
+
+# VS Code extension build output
+editors/vscode/node_modules/
+editors/vscode/out/
+*.vsix
+leangate.env

leangate-0.1.0/.pre-commit-hooks.yaml

@@ -0,0 +1,12 @@
+# Backstop for agents that skip the MCP tools: check the staged change before it is committed.
+# Fast path (static analysis + Jev, no Nemotron or web grounding). Exit 1 blocks the commit.
+- id: leangate-verify
+  name: LeanGate verify (fast)
+  description: Block commits that add duplicates, dead code, missing error handling, security holes, or unneeded or unknown dependencies.
+  entry: leangate verify --fast --staged
+  language: python
+  pass_filenames: false
+  files: '(\.py|(^|/)pyproject\.toml|(^|/)requirements[^/]*\.txt)$'
+  stages: [pre-commit]
+  require_serial: true
+  minimum_pre_commit_version: "3.2.0"

leangate-0.1.0/DEPLOY.md

@@ -0,0 +1,195 @@
+# Deploying the LeanGate service on Nebius
+
+The service (`leangate-service`, [Dockerfile](Dockerfile)) is one container. It serves the web UI at `/`, the
+playground API at `/api/*`, the engine routes the local MCP server calls through `LEANGATE_REMOTE_URL`, and
+the sandbox that runs untrusted test code. It needs no GPU, because Nemotron runs on Token Factory, not in this container.
+
+Two ways to host it:
+- **A. Serverless AI endpoint (recommended):** Nebius runs the container and gives you a managed `https://` URL.
+- **B. Compute VM:** you run Docker on an Ubuntu VM yourself. Use it if the endpoint route is blocked.
+
+**Status:** nothing here has been run yet. The commands below are copied from Nebius's official docs (links per
+step, read 2026-10-05). Steps marked **UNVERIFIED** are ones those docs don't cover; confirm them on first deploy.
+No command was guessed. The Docker image has not been built yet either (Docker Desktop wasn't running).
+
+## 0. Build and test the image locally
+
+```bash
+docker build -t leangate-service .
+docker run --rm -p 8000:8000 -e LEANGATE_MOCK=1 leangate-service
+curl http://127.0.0.1:8000/health          # {"status":"ok", ... "mock": true}
+# then open http://127.0.0.1:8000/ and run the bundled example
+```
+
+## Configuration (environment variables)
+
+| Variable | Purpose |
+|---|---|
+| `NEBIUS_API_KEY` | Token Factory key for Nemotron. Unset = fallback mode |
+| `OPENROUTER_API_KEY` (or `TYPESAFE_API_KEY`), `TAVILY_API_KEY`, `MEM0_API_KEY` | Jev (via OpenRouter, or TypeSafe directly), Tavily, and Mem0. Each one is optional |
+| `NEMOTRON_SUPER_MODEL` etc. | Model IDs; check them with `python scripts/list_models.py` |
+| `LEANGATE_SERVICE_TOKEN` | Bearer token the **engine routes** require (`/ground`, `/minimize`, `/prove_equivalent`, `/check_dependency`). Set the same value locally so the MCP server's `RemoteBackend` can call them. Unset = those routes answer 503 (they fail closed) |
+| `LEANGATE_PLAYGROUND_TOKEN_REQUIRED` | `1` puts `/api/*` behind the same token. Default off: judges open the demo URL with no token |
+| `LEANGATE_RATE_PER_MINUTE` | Per-client-IP limit on `/api/*` (default 30; `0` = off). IPv6 clients are counted per /64 |
+| `LEANGATE_MINIMIZE_PER_MINUTE` | Extra, lower per-IP limit on `/api/minimize`, the playground route that runs code (default 6; `0` = off) |
+| `LEANGATE_PLAYGROUND_SANDBOX` | `0` = `/api/minimize` never runs submitted code: static edits are still offered, model rewrites aren't accepted. Default `1` |
+| `LEANGATE_TRUST_PROXY` | `1` = read the client IP from the rightmost `X-Forwarded-For` entry (the one your proxy appended). See the note under step A4 |
+| `LEANGATE_MAX_BODY_BYTES` / `LEANGATE_MAX_FILES` / `LEANGATE_MAX_FILE_BYTES` | Request caps (1 MB / 40 / 200 KB) |
+| `LEANGATE_SANDBOX_TIMEOUT`, `LEANGATE_SANDBOX_MEMORY_MB`, `LEANGATE_SANDBOX_CONCURRENCY` | Sandbox wall/CPU seconds (60), address-space cap (1024 MB), concurrent runs (2) |
+| `LEANGATE_SANDBOX_QUEUE_SECONDS` | How long a run waits for a free sandbox slot before the request gets a 503 with `Retry-After` (10) |
+
+## A. Serverless AI endpoint
+
+Source: [Serverless endpoints quickstart](https://docs.nebius.com/serverless/quickstart/endpoints),
+[`nebius ai endpoint create` reference](https://docs.nebius.com/cli/reference/ai/endpoint/create),
+[Container Registry quickstart](https://docs.nebius.com/container-registry/quickstart).
+
+### A1. Install and configure the CLI
+From [CLI install](https://docs.nebius.com/cli/install) and [CLI quickstart](https://docs.nebius.com/cli/quickstart)
+(Linux/macOS shell; on Windows, run these in WSL. **UNVERIFIED:** whether the CLI has a native Windows installer):
+```bash
+curl -sSL https://artifacts.nebius.cloud/cli/install.sh | bash
+exec -l $SHELL
+nebius version
+nebius profile create        # keep the defaults: api.nebius.cloud, federation auth, auth.nebius.com
+```
+
+### A2. Push the image to Container Registry
+```bash
+nebius registry create --name leangate --format json | jq -r ".metadata.id" | cut -d- -f 2
+# save the printed value as REGISTRY_PATH; REGION_ID is your project's region, e.g. eu-north1
+nebius registry configure-helper          # run docker as your user, not root (the helper is per user)
+docker tag leangate-service cr.$REGION_ID.nebius.cloud/$REGISTRY_PATH/leangate-service:v1
+docker push cr.$REGION_ID.nebius.cloud/$REGISTRY_PATH/leangate-service:v1
+```
+**UNVERIFIED:** whether an endpoint can pull from a private Nebius registry in the same project without
+`--registry-username/--registry-password` or `--registry-secret` (a MysteryBox secret with `REGISTRY_USERNAME`
+and `REGISTRY_PASSWORD` keys). If the endpoint fails to pull, add one of those.
+
+### A3. Keep the provider keys in MysteryBox, not on the command line
+`--env-secret KEY=SECRET_SELECTOR` reads an env var from MysteryBox (selector = secret name, ID, version ID, or
+`SECRET_ID@VERSION_ID`). **UNVERIFIED:** the exact command to create a MysteryBox secret and which payload key
+gets used for each env var; see the MysteryBox docs. If you're short on time, plain `--env KEY=VALUE` works,
+but the value ends up in your shell history and in the endpoint spec.
+
+### A4. Create the endpoint
+**Use endpoint auth `none`.** With `--auth token`, Nebius rejects every request that lacks the token before it
+reaches the container, so judges could not open the UI. The engine routes are still protected by
+`LEANGATE_SERVICE_TOKEN` inside the app.
+```bash
+export LEANGATE_SERVICE_TOKEN=$(openssl rand -hex 32)   # also put it in your local .env
+nebius ai endpoint create \
+  --name leangate \
+  --image cr.$REGION_ID.nebius.cloud/$REGISTRY_PATH/leangate-service:v1 \
+  --platform cpu-d3 \
+  --preset 4vcpu-16gb \
+  --container-port 8000 \
+  --auth none \
+  --env LEANGATE_SERVICE_TOKEN=$LEANGATE_SERVICE_TOKEN \
+  --env-secret NEBIUS_API_KEY=<secret> \
+  --env-secret TAVILY_API_KEY=<secret> \
+  --env-secret OPENROUTER_API_KEY=<secret>
+```
+- `--platform cpu-d3 --preset 4vcpu-16gb` come from the nginx quickstart. Without `--platform` the default is
+  a **GPU** platform (`gpu-h100-sxm` in eu-north1), which this service doesn't need. Always pass it.
+- `--disk-size` defaults to 250Gi. The image is small, so a smaller value is fine. **UNVERIFIED:** the minimum.
+- `--public` only assigns a public IP. The managed `https://` URL is provided either way.
+- **UNVERIFIED:** whether the endpoint proxy sets `X-Forwarded-For`. Until you confirm it (log `request.client`
+  from one real request), the rate limit may see every visitor as the proxy's IP and throttle them all together.
+  If that happens, set `LEANGATE_TRUST_PROXY=1` once you know the proxy sets the header, or raise `LEANGATE_RATE_PER_MINUTE`.
+
+### A5. Get the URL and smoke-test
+```bash
+export ENDPOINT_ID=$(nebius ai endpoint get-by-name --name leangate --format jsonpath='{.metadata.id}')
+export ENDPOINT_URL=$(nebius ai endpoint get "$ENDPOINT_ID" --format json \
+  | jq -r '.status.public_endpoints[] | select(startswith("https://"))' | head -1)
+curl "$ENDPOINT_URL/health"                                    # providers should show live: true
+curl -X POST "$ENDPOINT_URL/check_dependency" -H 'content-type: application/json' -d '{"name":"httpx"}'   # 401
+curl -X POST "$ENDPOINT_URL/check_dependency" -H "Authorization: Bearer $LEANGATE_SERVICE_TOKEN" \
+     -H 'content-type: application/json' -d '{"name":"httpx"}'                                          # 200
+nebius ai endpoint logs $ENDPOINT_ID
+```
+Then open `$ENDPOINT_URL/` in a browser, which is the demo URL. Locally, set `LEANGATE_REMOTE_URL=$ENDPOINT_URL`
+and `LEANGATE_SERVICE_TOKEN` in `.env` so the MCP server uses the remote backend.
+
+### A6. After judging: lock down or tear down
+`/api/minimize` is open by default and runs submitted code. The bounds are 2 concurrent runs, a 10 s queue, the
+two rate limits and the rlimits. If you'd rather not run strangers' code at all, deploy with
+`--env LEANGATE_PLAYGROUND_SANDBOX=0` (static rewrites only). Once judging is over, either redeploy with
+`--env LEANGATE_PLAYGROUND_TOKEN_REQUIRED=1` or delete the endpoint:
+```bash
+nebius ai endpoint delete $ENDPOINT_ID     # billing stops once the endpoint is deleted
+```
+
+## B. Compute VM (fallback)
+
+Source: [Create a VM](https://docs.nebius.com/compute/virtual-machines/manage),
+[VM networking](https://docs.nebius.com/compute/virtual-machines/network).
+
+```bash
+nebius vpc subnet list                       # note the subnet ID
+nebius compute instance create \
+  --name leangate-vm \
+  --resources-platform cpu-d3 \
+  --resources-preset cpu-d3-c2-m8 \
+  --boot-disk-managed-disk-name leangate-boot \
+  --boot-disk-managed-disk-type network_ssd \
+  --boot-disk-managed-disk-size-gibibytes 20 \
+  --boot-disk-managed-disk-source-image-family-image-family ubuntu24.04-driverless \
+  --boot-disk-attach-mode READ_WRITE \
+  --network-interfaces '[{"name": "eth0", "ip_address": {}, "public_ip_address": {}, "subnet_id": "<subnet_ID>"}]' \
+  --cloud-init-user-data "#cloud-config
+users:
+  - name: ubuntu
+    sudo: ALL=(ALL) NOPASSWD:ALL
+    shell: /bin/bash
+    ssh_authorized_keys:
+      - $(cat ~/.ssh/id_ed25519.pub)"
+nebius compute instance get leangate-vm --format json | grep public_ip_address
+```
+**UNVERIFIED**, because the docs above don't cover these steps:
+- installing Docker on the VM (use Docker's own Ubuntu instructions),
+- pulling from the Nebius registry on the VM (`nebius registry configure-helper` needs the CLI on the VM),
+- opening port 8000 (or 80/443) in the VPC security rules,
+- TLS. The VM serves plain HTTP unless you put a reverse proxy with a certificate in front of it.
+
+Then run it on the VM:
+```bash
+docker run -d --restart unless-stopped -p 80:8000 --env-file leangate.env \
+  cr.$REGION_ID.nebius.cloud/$REGISTRY_PATH/leangate-service:v1
+```
+
+## What the sandbox does and doesn't protect
+
+Untrusted test code from `/api/minimize` and `/prove_equivalent` runs as a pytest subprocess in a temp dir, as the
+image's non-root `app` user, with:
+- **Linux rlimits** (checked under WSL Ubuntu): CPU seconds = timeout (a busy loop is killed at 3 s with a 3 s
+  timeout), address space 1 GB (a 2 GB allocation raises `MemoryError`), file size 16 MB (`EFBIG`), 256 open
+  files, no core dumps, and at most 64 more processes/threads than the `app` user already runs (`RLIMIT_NPROC`;
+  checked under WSL with a large memory cap: a 500-thread bomb stops at 35, and at 500 without the limit).
+- **Wall timeout** that kills the whole process group, including children the test spawned (checked: no orphans left).
+- **Network:** a pytest plugin refuses socket connects and DNS, and proxy env vars point at a dead port. On Linux
+  it also tries an unprivileged user+network namespace. Under WSL that worked: even a raw `_socket` connect that
+  gets past the Python-level guard failed with `Network is unreachable`. **Docker's default seccomp profile usually
+  blocks `unshare`, so in the container expect only the Python-level block, which ctypes or a subprocess can bypass.**
+- **Environment:** only PATH and the temp vars are passed; API keys never reach test code. Output is capped at 4 KB.
+- **The server's own keys:** test code runs as the same `app` user as the server, so it could read
+  `/proc/<server pid>/environ`, which holds the provider keys. At startup the service sets `PR_SET_DUMPABLE=0`
+  (`sandbox.runner.protect_server_process`), which makes its `/proc` entries root-owned. Checked under WSL with the
+  namespace step disabled: before the call the read succeeded, after it the read fails with `Permission denied`.
+- **At most 2 concurrent runs** (`LEANGATE_SANDBOX_CONCURRENCY`). Further runs wait up to 10 s, then get a 503.
+
+Not protected: the container can still reach the network, because the service itself needs Token Factory, Tavily
+and PyPI. Test code that escapes the Python-level block can make outbound requests, though it holds no keys.
+It can also read files the `app` user can read, which includes the installed source but no secrets, since keys are
+env vars of the server process only. Because it is the same user, it can also write the server's state dir
+(`/home/app/.leangate`: the grounding cache) and send the server process a signal, so a hostile submission can
+restart the service. `LEANGATE_PLAYGROUND_SANDBOX=0` removes that from the public playground; the token-protected
+`/minimize` and `/prove_equivalent` still run code. For real isolation, run the sandbox in a separate network-less container or a
+gVisor/Firecracker runtime. That's out of scope for the hackathon.
+
+## Operational notes
+- State: per-request playground state is created under a temp dir and deleted after each request. The engine's
+  grounding cache (`$LEANGATE_STATE_DIR/_shared/grounding.json`) is shared and **grows without bound**. It holds only
+  public doc verdicts, but on a long-lived deployment you should restart or clear it now and then.
+- The rate limiter is in memory, per process. It resets on restart and is not shared across replicas.

leangate-0.1.0/Dockerfile

@@ -0,0 +1,19 @@
+# LeanGate verification service, for Nebius Serverless Endpoints or an AI Cloud VM.
+# The sandbox runs untrusted code inside this container as a non-root user.
+FROM python:3.12-slim
+
+# git: the playground (/api/verify) builds a throwaway repo per request.
+RUN apt-get update && apt-get install -y --no-install-recommends git \
+    && rm -rf /var/lib/apt/lists/*
+RUN useradd --create-home app
+WORKDIR /app
+COPY pyproject.toml README.md LICENSE ./
+COPY src ./src
+RUN pip install --no-cache-dir ".[service,providers]"
+
+USER app
+ENV PORT=8000 LEANGATE_STATE_DIR=/home/app/.leangate PYTHONDONTWRITEBYTECODE=1 PYTHONUNBUFFERED=1
+EXPOSE 8000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=20s \
+    CMD python -c "import os, urllib.request; urllib.request.urlopen(f'http://127.0.0.1:{os.environ[\"PORT\"]}/health', timeout=4)"
+CMD ["leangate-service"]

leangate-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LeanGate contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.