saferun-cli 0.0.2__py3-none-any.whl

saferun/ui.py

@@ -0,0 +1,133 @@
+"""Terminal presentation only: colours, icons, a spinner and a progress bar. No logic that affects results lives here.
+
+Everything is opt-in by terminal capability: colours need a TTY (or --color always) and respect NO_COLOR / FORCE_COLOR / TERM=dumb;
+the spinner needs a TTY on the stream it writes to (stderr, so stdout and JSON stay clean); unicode icons fall back to ASCII on
+non-UTF-8 terminals. When none of that applies the plain text output is byte-for-byte what it always was.
+"""
+from __future__ import annotations
+
+import itertools
+import os
+import shutil
+import sys
+import threading
+import time
+
+RESET = "\033[0m"
+CODES = {"bold": "1", "dim": "2", "red": "31", "green": "32", "yellow": "33", "blue": "34", "magenta": "35", "cyan": "36", "white": "97",
+         "bg_green": "42", "bg_yellow": "43", "bg_red": "41", "bg_magenta": "45", "black": "30"}
+ICONS_UNICODE = {"ok": "✓", "bad": "✗", "warn": "!", "skip": "–", "dot": "•", "arrow": "→", "bar_full": "█", "bar_empty": "░"}
+ICONS_ASCII = {"ok": "+", "bad": "x", "warn": "!", "skip": "-", "dot": "*", "arrow": "->", "bar_full": "#", "bar_empty": "."}
+SPIN_UNICODE = "⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏"
+SPIN_ASCII = "|/-\\"
+# verdict banner / severity tag styles
+VERDICT_STYLE = {"PASS": ("black", "bold", "bg_green"), "WARNING": ("black", "bold", "bg_yellow"), "FAIL": ("white", "bold", "bg_red")}
+SEVERITY_STYLE = {"critical": ("bold", "magenta"), "high": ("bold", "red"), "medium": ("yellow",), "unknown": ("yellow",), "low": ("cyan",), "info": ("dim",)}
+
+
+BANNER = (
+    r" ____         __      ____              ",
+    r"/ ___|  __ _ / _| ___|  _ \ _   _ _ __  ",
+    r"\___ \ / _` | |_ / _ \ |_) | | | | '_ \ ",
+    r" ___) | (_| |  _|  __/  _ <| |_| | | | |",
+    r"|____/ \__,_|_|  \___|_| \_\\__,_|_| |_|",
+)
+BANNER_TAGLINE = "Check AI-generated code before you run or trust it"
+
+
+class Theme:
+    def __init__(self, color: bool = False, unicode_ok: bool = True):
+        self.on = color
+        self.icons = ICONS_UNICODE if unicode_ok else ICONS_ASCII
+        self.spin = SPIN_UNICODE if unicode_ok else SPIN_ASCII
+
+    def paint(self, text: str, *styles: str) -> str:
+        if not self.on or not styles:
+            return text
+        return "\033[" + ";".join(CODES[s] for s in styles) + "m" + text + RESET
+
+    def icon(self, name: str, *styles: str) -> str:
+        return self.paint(self.icons[name], *styles)
+
+
+PLAIN = Theme(False, True)
+
+
+def _truthy(value: str | None) -> bool:
+    return bool(value) and value != "0"
+
+
+def theme_for(stream, mode: str = "auto") -> Theme:
+    """Colour policy: `never` -> off; `always` -> on; `auto` -> on only for a real terminal, unless NO_COLOR (any value) or TERM=dumb,
+    and on when FORCE_COLOR is set."""
+    enc = (getattr(stream, "encoding", "") or "").lower()
+    uni = enc.startswith("utf") and not _truthy(os.environ.get("SAFERUN_ASCII"))
+    if mode == "never":
+        return Theme(False, uni)
+    if mode == "always":
+        return Theme(True, uni)
+    if os.environ.get("NO_COLOR"):
+        return Theme(False, uni)
+    if _truthy(os.environ.get("FORCE_COLOR")):
+        return Theme(True, uni)
+    tty = bool(getattr(stream, "isatty", lambda: False)()) and os.environ.get("TERM", "") != "dumb"
+    return Theme(tty, uni)
+
+
+def is_tty(stream) -> bool:
+    try:
+        return bool(stream.isatty()) and os.environ.get("TERM", "") != "dumb"
+    except (AttributeError, ValueError):
+        return False
+
+
+class Spinner:
+    """`with Spinner(sys.stderr, "Scanning…"):` animates a line while the body runs. Does nothing unless the stream is a terminal.
+    Hides the cursor while spinning and always restores it and clears the line, also on Ctrl-C or an exception."""
+
+    def __init__(self, stream, message: str, theme: Theme | None = None, interval: float = 0.1):
+        self.stream, self.message, self.theme, self.interval = stream, message, theme or PLAIN, interval
+        self.enabled = is_tty(stream)
+        self._stop = threading.Event()
+        self._thread: threading.Thread | None = None
+        self._t0 = 0.0
+
+    def _run(self) -> None:
+        for frame in itertools.cycle(self.theme.spin):
+            if self._stop.is_set():
+                return
+            secs = int(time.monotonic() - self._t0)
+            room = max(10, shutil.get_terminal_size((100, 24)).columns - 10)      # one physical line, or \r would leave debris
+            msg = self.message if len(self.message) <= room else self.message[: room - 1] + "…"
+            line = f"{self.theme.paint(frame, 'cyan', 'bold')} {msg} {self.theme.paint(f'{secs}s', 'dim')}"
+            self.stream.write("\r\033[K" + line)
+            self.stream.flush()
+            self._stop.wait(self.interval)
+
+    def __enter__(self):
+        if self.enabled:
+            self._t0 = time.monotonic()
+            self.stream.write("\033[?25l")           # hide the cursor
+            self.stream.flush()
+            self._thread = threading.Thread(target=self._run, daemon=True)
+            self._thread.start()
+        return self
+
+    def __exit__(self, *exc) -> bool:
+        if self.enabled:
+            self._stop.set()
+            if self._thread:
+                self._thread.join(timeout=2)
+            self.stream.write("\r\033[K\033[?25h")    # clear the line, show the cursor again
+            self.stream.flush()
+        return False
+
+
+def bar(done: float, total: float | None, theme: Theme, width: int = 24) -> str:
+    """`[██████░░░░░░] 50%` (or `[####......] 50%`); an unknown total shows only the amount done by the caller."""
+    if not total or total <= 0:
+        return ""
+    frac = max(0.0, min(1.0, done / total))
+    n = int(round(frac * width))
+    body = theme.paint(theme.icons["bar_full"] * n, "cyan") + theme.paint(theme.icons["bar_empty"] * (width - n), "dim")
+    return f"[{body}] {int(frac * 100):3d}%"

saferun_cli-0.0.2.dist-info/METADATA

@@ -0,0 +1,136 @@
+Metadata-Version: 2.4
+Name: saferun-cli
+Version: 0.0.2
+Summary: Secure verification of AI-generated code
+Author: Vinay Repalle
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/vinay-repalle/saferun
+Project-URL: Repository, https://github.com/vinay-repalle/saferun
+Project-URL: Documentation, https://github.com/vinay-repalle/saferun/tree/main/docs
+Project-URL: Issues, https://github.com/vinay-repalle/saferun/issues
+Keywords: security,sandbox,docker,ai-generated-code,static-analysis,semgrep,osv,cosign,supply-chain
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: MacOS
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: ruamel.yaml>=0.18; extra == "dev"
+Requires-Dist: build>=1.2; extra == "dev"
+Requires-Dist: twine>=5; extra == "dev"
+Dynamic: license-file
+
+# SafeRun
+
+Checks AI-generated code before you run or trust it. Executing untrusted code in a sandbox **limits the impact** of that
+code; it does **not** prove the code is safe, and a passing scan does not guarantee security.
+Status: alpha (not independently certified). The signed analyzer image `analyzer-v1.0.1` is published from this repository and recorded in `ANALYZER_RELEASE`, so `saferun init` installs it after verifying its cosign signature; see [docs/release-images.md](https://github.com/vinay-repalle/saferun/blob/main/docs/release-images.md). Not yet done: a detection-quality benchmark, broader JavaScript rules, and verification of the Docker sandbox through Docker Desktop on Windows and macOS (see [docs/platforms.md](https://github.com/vinay-repalle/saferun/blob/main/docs/platforms.md)). **The CLI is the product**; `web/` is a static informational website.
+
+## Install in four commands
+```bash
+pip install saferun-cli     # the PyPI package is saferun-cli; the command it installs is `saferun`
+saferun init                # one-time setup: checks Docker, fetches a verified cosign, installs the signed analyzer image, downloads the OSV data
+saferun doctor              # read-only diagnosis: PASS / WARNING / FAIL per check, with the fix for each problem
+saferun run my_script.py    # scan the script; run it only inside the hardened sandbox if the scan allows it
+```
+You do **not** install cosign or download the OSV database yourself. **Docker is the only prerequisite you install separately.**
+`pipx install saferun-cli`, `uv tool install saferun-cli` and `poetry add saferun-cli` work as well. Requirements: Python 3.12 or newer, and for Poetry **version 2.0 or newer** (Poetry 1.x, including the 1.8 that Ubuntu 24.04 packages, cannot read this package's wheel metadata; use `pipx install poetry` or `pip install -U poetry`).
+
+## License
+SafeRun is released under the [MIT License](https://github.com/vinay-repalle/saferun/blob/main/LICENSE) (Copyright (c) 2026 Vinay Repalle). The analyzer image also redistributes third-party software under its own licenses (Semgrep, OSV-Scanner and others); their notices are in [docker/analyzer/THIRD_PARTY_NOTICES.md](https://github.com/vinay-repalle/saferun/blob/main/docker/analyzer/THIRD_PARTY_NOTICES.md) and inside the image.
+
+## Key features
+- **Restricted Docker sandbox** (Phase 1): read-only sanitized project copy, no network, non-root, no capabilities, resource limits, verified at run time.
+- **Validation engine** (Phase 2): Python syntax check and `node --check` in the sandbox; Semgrep (Python) and an **offline** OSV-Scanner dependency scan, both run **only inside a verified, locked-down analyzer container** (Phase 5B, no host-side fallback); one normalized report and a PASS / WARNING / FAIL verdict.
+- **CLI** (Phase 3): `saferun scan PATH`, text or JSON output, deterministic exit codes. Incomplete scans never report PASS.
+
+## Prerequisites
+**Docker, running Linux containers and reachable by your user.** Remote Docker endpoints are refused (the project is bind-mounted by host path). The daemon must provide cgroup limits (memory, swap, pids, CPU) and seccomp.
+
+| Platform | Install Docker | Notes |
+|---|---|---|
+| Linux | [Docker Engine](https://docs.docker.com/engine/install/); then `sudo usermod -aG docker $USER` and log in again | Fully tested platform. |
+| macOS | [Docker Desktop](https://docs.docker.com/desktop/setup/install/mac-install/) (or Colima / OrbStack); start it once | Host code tested in CI; Docker Desktop integration not verified. |
+| Windows 10/11 | [Docker Desktop](https://docs.docker.com/desktop/setup/install/windows-install/) with the WSL 2 backend, **Linux containers** mode | Native Windows host code, no WSL needed for SafeRun itself; Docker Desktop integration not verified. |
+
+`saferun init` and `saferun doctor` tell you exactly which of these is wrong (Docker missing, daemon not running, permission denied, remote endpoint) and what to do. Details: [docs/platforms.md](https://github.com/vinay-repalle/saferun/blob/main/docs/platforms.md).
+
+## Install and set up
+```bash
+pip install saferun-cli
+saferun init            # interactive: shows what is installed, offers the rest. For scripts/CI: saferun init --all   (also --only, --skip, --yes, --repair)
+saferun doctor          # PASS / WARNING / FAIL, exit 1 if anything FAILED. --online also re-verifies the release signature; --format json for tools
+saferun status          # which components are installed and verified (exit 0 only if everything is ready)
+```
+What `saferun init` does, in order, and what it never does:
+1. **Checks the host and Docker** (OS, installed, daemon running, permissions, local endpoint) and prints platform-specific guidance if something is missing. If Docker is unusable nothing is installed.
+2. **Pulls the sandbox images by pinned digest** (python, node) and re-checks the digest afterwards.
+3. **Installs the analyzer image** (Semgrep, OSV-Scanner, rules): it first obtains **cosign** by itself if you have none (a pinned release, downloaded over HTTPS into SafeRun's own data directory and accepted only if its SHA-256 equals the value written in SafeRun's source; it is re-hashed on every use), then verifies the image's **signature and identity** (this repository's release workflow on an `analyzer-v*` tag) **before anything is pulled**, pulls it by digest, checks digest, labels, tool versions and rules hash, and locks it. There is no unsigned install; `--build-local` is the explicit alternative and needs a source checkout.
+4. **Downloads and caches the OSV vulnerability data** (about 260 MB, public data from `osv-vulnerabilities.storage.googleapis.com`, nothing about your projects is sent) into your user data directory with integrity hashes. Only what is missing, invalid or older than 30 days is downloaded; a current database is left alone. Failed downloads are retried and never replace good data. If the data cannot be refreshed, `init` says how old the existing data is and scans report the dependency check as INCOMPLETE; **stale data is never treated as current**. Refresh later with `saferun osv-db update` (`--if-stale` to skip when it is current).
+5. **Verifies everything again** and prints a result per component.
+
+`saferun init` skips what is already valid, so it is safe to re-run (for example after an analyzer release). Developers working from a checkout: `pip install -e '.[dev]'`, then `pytest -q` (Docker tests skip loudly without Docker; `SAFERUN_REQUIRE_DOCKER=1` makes them fail instead).
+
+**Clean-environment install and validation, and what the CI runs:** [docs/install-and-test.md](https://github.com/vinay-repalle/saferun/blob/main/docs/install-and-test.md).
+
+## Quick start
+```bash
+saferun scan ./my-project                 # human-readable report; nothing is executed
+saferun scan ./my-project --format json   # machine-readable report (schema_version 1)
+saferun run my_script.py -- arg1 arg2     # scan first, then run inside the sandbox only if allowed
+```
+Exit codes of `scan`: **0** PASS · **1** FAIL · **2** WARNING (including any incomplete scan) · **64** invalid usage/path · **70** fatal · **130** interrupted.
+
+### `saferun run`: what it does and what it guarantees
+`saferun run SCRIPT [-- ARGS...]` scans the Python script with the normal checks and then runs it **only inside the same hardened Docker sandbox** used for checks: pinned `python:3.12-slim` image, **no network**, read-only root and project, non-root user, no capabilities, memory/CPU/pids/time limits, output cap, secrets redacted from output. It never runs anything on the host.
+- Only the script itself is copied and scanned (`--project-dir DIR` scans and mounts a whole directory that contains it). Options go **before** the script name (`--timeout SECONDS`, default 30).
+- **PASS** → it runs. **FAIL** → refused (exit 1). **WARNING** → refused (exit 2) by default. `--allow-warnings` accepts a WARNING only from a **complete** scan with no high/critical finding; an incomplete, errored, timed-out, skipped or unavailable check is never overridden, and neither is a FAIL.
+- If the scan cannot be carried out (analyzer or Docker unusable, internal error) the script is **not** run (exit 70).
+- A PASS means the checks found nothing they know about; it is **not** proof that the script is safe. The sandbox limits the impact of the code, it does not make it harmless. Scripts that need the network or third-party packages will fail inside it.
+- Exit codes: **0** the script ran and exited 0 · **1** refused: FAIL · **2** refused: WARNING · **3** the script ran but exited non-zero, timed out or was killed · **64** usage · **70** could not scan or sandbox · **130** interrupted.
+
+> **Privacy / network:** scans never use the network. Semgrep and OSV-Scanner run in a container without network access, and OSV-Scanner reads a local copy of the OSV data (`saferun osv-db update`, an explicit download of public data that contains nothing about your project). Without that data the dependency check reports `error` (verdict at best WARNING). Per-scan *online* OSV queries were removed in Phase 5B, see [PROJECT.md](https://github.com/vinay-repalle/saferun/blob/main/PROJECT.md).
+>
+> **Limits of the OSV data checks:** the download is checked against the server's MD5 header (refused if absent) and a SHA-256 is recorded locally and re-checked before every scan. That detects corruption and later modification of the files. It does **not** authenticate the download (the hash comes from the same server, or from your own disk), and someone who can write the data directory can rewrite the manifest too. Data older than 30 days makes the dependency check `incomplete`.
+
+## Website (static)
+`web/` is a static informational site (what SafeRun is, features, security, CLI usage, GitHub link). It has no backend and does not scan anything.
+```bash
+cd web && npm ci --ignore-scripts && npm test && npm run build   # output: web/dist
+```
+**Hosting:** Netlify. **Live site:** https://safe-run.netlify.app · **Repository:** https://github.com/vinay-repalle/saferun
+
+| Netlify setting | Value |
+|---|---|
+| Deployment branch | `main` |
+| Base directory | `web` |
+| Build command | `npm ci --ignore-scripts && npm run build` |
+| Publish directory | `dist` |
+| Node.js | 22 |
+
+Pages are switched by the URL hash, so no redirect rules are needed.
+
+> **Scope:** the website is a static informational site only. SafeRun's CLI, sandbox and security analysis stay in this repository (`saferun/`, `docker/`) and run on your own machine; none of that is hosted by Netlify, and the site scans nothing.
+
+## Supported runtimes
+| Runtime | Image | Status |
+|---|---|---|
+| Python | `python:3.12-slim` | sandbox, syntax check and Semgrep implemented |
+| JavaScript / Node.js | `node:22-slim` | sandbox, `node --check` and npm lockfile scan implemented; **dependency installation, test runners and JS Semgrep rules are not implemented** |
+
+## Documentation
+- [docs/cli.md](https://github.com/vinay-repalle/saferun/blob/main/docs/cli.md) — CLI options, exit codes, output examples
+- [docs/engine.md](https://github.com/vinay-repalle/saferun/blob/main/docs/engine.md) — validation engine: checks, dependency coverage, statuses, verdict rules
+- [docs/sandbox.md](https://github.com/vinay-repalle/saferun/blob/main/docs/sandbox.md) — sandbox library usage and guarantees
+- [PROJECT.md](https://github.com/vinay-repalle/saferun/blob/main/PROJECT.md) — goals, architecture, threat model, known exposures (**read before relying on the sandbox**), phases
+- [IMPLEMENTATION.md](https://github.com/vinay-repalle/saferun/blob/main/IMPLEMENTATION.md) — status, test evidence, limitations, technical notes

saferun_cli-0.0.2.dist-info/RECORD

@@ -0,0 +1,51 @@
+saferun/__init__.py,sha256=wxF3WJE-ftCiijf5W4ke1HS856cuE-rKBDKggQXRU0s,80
+saferun/__main__.py,sha256=E6Gls0DNz8GQK2K-kOUIx8cYhgANW_CH54VKrfCfs14,52
+saferun/cli.py,sha256=8j8DNmxrN-OZ0nH1AJkoT8n268eBiq7hxlFER96YsJ8,31659
+saferun/dockerdiag.py,sha256=4YtgARF1ICghGgFFOmVq2SNjLG3RtBPAz8-fxftnG-M,3333
+saferun/doctor.py,sha256=RKBbTPd54UaHuL3lYomu760ganf_ows-dQPMgzYXHTs,6922
+saferun/runcmd.py,sha256=7vuXDtVFjPGKlL7bC5UCm0yfoWTiRqw8e8fIQG0342I,7236
+saferun/setup.py,sha256=I4wlItAuoZmDIFkizmbPcJfqWIXDsEIA_SVm9YtO0-0,30186
+saferun/ui.py,sha256=sbreyS-W5mjle6GJC00KGPMVi3CeXZNvsdQaaXJpv0w,5872
+saferun/engine/__init__.py,sha256=jjzWrIFZZU30E3R9dRW5FJYg7sRmvMrh_rPzhZhWw98,459
+saferun/engine/analyzer.py,sha256=W2IW1NEK1V12yGdYQc54Zul9Hem7uwNAPS4pu-v_MQI,2095
+saferun/engine/context.py,sha256=bRI3A21Esi1qDpUZSkmWXpibHgOh6UDue2XqpAYYbes,1254
+saferun/engine/engine.py,sha256=g3y-Mvd7RGpmJDaUE4z8uNTudej2NFVFTNYrOc9W8EM,5362
+saferun/engine/model.py,sha256=SK1exaIxy1eXdJkSdrc1HpDq156XxVDW8Fpm1VUVg5A,6015
+saferun/engine/node.py,sha256=yYvBUuR1aeb2mhy4bdOsibMKLWr8GriDwPtOgru9kJs,6821
+saferun/engine/osv.py,sha256=42j1QwRYo56ilF27sr-K5qnNSwASjOhw_pBuDfDaiFU,16262
+saferun/engine/osvdb.py,sha256=zeCLPk-TtG5490uAvCi4xvMUdh3ccPUAsz0e6nGD7Dw,18662
+saferun/engine/paths.py,sha256=KXpgGNAGFqNNSpA2_S1QJie3KJ8WmVrfRt8J9J4POoA,1539
+saferun/engine/pysyntax.py,sha256=gGcx94ldEt72kkNV5RjxyvVxxzhDM8XTEJgSbOeAFvU,6057
+saferun/engine/semgrep.py,sha256=vbD4Qm89JhqhwlZLWHLfg1EVJie5VC5xqWVQf7vPk2A,9160
+saferun/engine/tools.py,sha256=MN6CtPd9uqG49xgFb7KWbzG1Z-GO9J_VgSZ5NgNqjWA,6749
+saferun/engine/verdict.py,sha256=LqkYtBOYujaMuuONIaZe18MTM5oNu2DIZ47ta5UHuE0,2466
+saferun/engine/rules/python.yml,sha256=SkLAIrry8bnesyvjD6UOX-4c0XOK1YRrKaKH8kWW_bw,4120
+saferun/hostos/__init__.py,sha256=gtVF6AwAAbjUU1lyL1mv6V2m41iml4p48LCSItKTVDw,8667
+saferun/hostos/_win.py,sha256=z8eZgQpToXu0-fqkBcaoyZGeLL5-k7fnTEWK34r_caE,13623
+saferun/hostos/acl.py,sha256=wqeNAN4q7X7Q6x4wAeP1JUAMpln8kmC9ZO8560-FRcM,7721
+saferun/hostos/fsops.py,sha256=hwu-c06SHDlJxzLbCPAAPOWtAY4MzAjj6esn5OQ-SrA,2106
+saferun/hostos/process.py,sha256=eo9Q0ZWzjKaVJkr5IFNmcjGbvE8taFYOoTv_Mb4pk9s,2443
+saferun/hostos/winfs.py,sha256=G5XFdMFypRxL54kjo37HE0yQxa9BrzPVqz3RIaxuQUQ,7608
+saferun/sandbox/__init__.py,sha256=X6AehI4IctBLVSNDqaHJqPUrMIH0oqD6bg9YLMWN7dE,565
+saferun/sandbox/analyzer.py,sha256=IesgkeBMerH45ln1eaQrQ_VPrwabzxcXIRhW1wUzn9k,9044
+saferun/sandbox/attestation.py,sha256=eDQq7VMoC7lOGzprXKa2ZqRcjFhpssMUyt6aqEI-PI4,5648
+saferun/sandbox/config.py,sha256=HvUUjrkmmObCrLvFV1FVSBf19o1cHihmaV8HUAoUn1Q,4678
+saferun/sandbox/controls.py,sha256=esoXLE34Mtj87Xty889fkKeewbS8UxHQwo8wdPLTr_k,6812
+saferun/sandbox/copy.py,sha256=Rk40W8wo28v0LZJxygxZe_2td0CQZrokvWR6NydeWAM,15502
+saferun/sandbox/copy_windows.py,sha256=CGscorkMZl1GsX89KX9pmYGJk8mpfe8yL5mprYcz3Z8,12634
+saferun/sandbox/cosign_tool.py,sha256=sDCOGYj6F9pox062GDXvrMoZXCyVeZoEohk21n_CU5k,6137
+saferun/sandbox/docker.py,sha256=JgQRe8IOhbarzzcQEpEY5icJGUG6ynjJx8FFdozwpU0,7276
+saferun/sandbox/images.py,sha256=ujX0FEs5jFUyJfC0mFR4unFzmbRrvQYXe89TVwS964c,5788
+saferun/sandbox/profiles.py,sha256=abDN6rqs2i8B37oUEXrBm4SVDugzwCEWKm9hQIoMY0M,1624
+saferun/sandbox/reaper.py,sha256=9ZjQuKCmYLJK6ha6libtI4lGCuHsUJH8JUuc67xNmB0,5228
+saferun/sandbox/runner.py,sha256=FkThjkRX9FPruPKczxkD7V5beD8YHhT8wB94tzaSzZc,11474
+saferun/sandbox/secrets.py,sha256=LEPfJspTCH9WDtv5Yy5JjIJir4MSgsGvTek-qWWvRYw,4084
+saferun/sandbox/signature.py,sha256=_dAUJagrvdpObIJzI6eZR7Hgc9YTRaElD8qIKWFZfX8,6463
+saferun/sandbox/verify.py,sha256=kQmH_-LPBlktZoWVxfz-DAxBvGOU9b6ItJF2iPMOFio,3114
+saferun/sandbox/workspace.py,sha256=go821YzpMKG7j7mGmFysFLnTTc_BKuNot-HC_D0xVqc,4017
+saferun_cli-0.0.2.dist-info/licenses/LICENSE,sha256=neTkyPXACcHdbLtoAPCS09Bs9-ZatgCHEGoXJ5jwFkY,1070
+saferun_cli-0.0.2.dist-info/METADATA,sha256=Hj4-GOpWvkwzB4zd9kPnJo_e3D1NRp8se803QpeoSF4,13066
+saferun_cli-0.0.2.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+saferun_cli-0.0.2.dist-info/entry_points.txt,sha256=5K4q9kfsefC_LHrq3fq81VvSRpZ8p4fTI9nzhZQhUYg,45
+saferun_cli-0.0.2.dist-info/top_level.txt,sha256=KWrtvCkcWH0OJMA7xjjgqkxmxEImXlWPxqv0c9dJltg,8
+saferun_cli-0.0.2.dist-info/RECORD,,

saferun_cli-0.0.2.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.1)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

saferun_cli-0.0.2.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+saferun = saferun.cli:main

saferun_cli-0.0.2.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vinay Repalle
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

saferun_cli-0.0.2.dist-info/top_level.txt

@@ -0,0 +1 @@
+saferun