vulguard 1.0.0__py3-none-any.whl

vulguard/__init__.py

@@ -0,0 +1,22 @@
+"""
+vulguard - A lightweight security tool that automatically scans source code
+for vulnerabilities, highlights risky patterns, and guides developers toward
+safer implementations to strengthen their applications' overall security posture.
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+from env_dir_bootstrap import EnvDirBootstrap
+
+__version__ = "1.0.0"
+
+_bootstrapper = EnvDirBootstrap(
+    env_var="VULGUARD_CONFIG_DIR",
+    resources=["logging.ini", "config.ini"],
+    package="vulguard",
+)
+
+_bootstrapper.setup()
+
+CONF_DIR = str(_bootstrapper.get_dir())

vulguard/cli.py

@@ -0,0 +1,297 @@
+"""
+vulguard.cli - Command-line interface for the vulguard security inspection tool.
+
+Defines the Click command group and the ``inspect`` sub-command. Handles
+recursive file collection, orchestrates per-file Copilot inspections (results
+persisted to SQLite via ``vulguard.db``), and delegates report generation to
+``vulguard.report``.
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+import asyncio
+import uuid
+from pathlib import Path
+
+import click
+from logenrich import setup_logger
+from rich.console import Console
+from rich.panel import Panel
+from rich.text import Text
+
+from . import __version__, CONF_DIR
+from .config import Config
+from .db import (
+    delete_results_by_session,
+    get_db_path,
+    get_results_by_session,
+    init_db,
+    insert_result,
+)
+from .inspector import inspect_file, load_system_prompt
+from .report import build_report, write_html, write_json
+
+_console = Console()
+_logger = setup_logger(__name__, conf_dir=CONF_DIR)
+
+
+def _should_include(path: str | Path, extensions: list[str]) -> bool:
+    """Determines whether a file should be included based on its extension.
+
+    :param path: The file path to evaluate.
+    :param extensions: List of allowed extensions without dots. Empty means all files.
+    :return: True if the file should be included.
+    """
+    if not extensions:
+        return True
+    return Path(path).suffix.lstrip(".").lower() in extensions
+
+
+def _collect_files(paths: tuple[str, ...], extensions: list[str]) -> list[str]:
+    """Collects files from the given paths, recursively walking directories.
+
+    :param paths: Tuple of file or directory paths supplied by the user.
+    :param extensions: List of allowed extensions. Empty list means all files.
+    :return: Sorted list of unique absolute file paths.
+    """
+    collected: set[str] = set()
+    for raw_path in paths:
+        path = Path(raw_path)
+        if path.is_file():
+            if _should_include(path, extensions):
+                collected.add(str(path.resolve()))
+        elif path.is_dir():
+            for file_path in path.rglob("*"):
+                if file_path.is_file() and _should_include(file_path, extensions):
+                    collected.add(str(file_path.resolve()))
+    return sorted(collected)
+
+
+async def _inspect_and_persist(  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    file_path: str,
+    system_prompt: str,
+    config: Config,
+    db_path: str,
+    session_id: str,
+) -> None:
+    """Inspects a single file and persists the result to the database.
+
+    :param file_path: Absolute path to the file to inspect.
+    :param system_prompt: The security inspection system prompt text.
+    :param config: The vulguard configuration instance.
+    :param db_path: Absolute path to the vulguard SQLite database file.
+    :param session_id: UUID string identifying the current inspection run.
+    """
+    _logger.debug("Inspecting file: %s", file_path)
+    severity = "NONE"
+    details = "The code is safe."
+    try:
+        result = await inspect_file(file_path, system_prompt, config)
+        severity = result.get("severity", "NONE")
+        details = result.get("details", "The code is safe.")
+        _logger.debug(
+            "Inspection complete for %s — severity: %s",
+            file_path,
+            severity,
+        )
+    except Exception as exc:  # pylint: disable=broad-exception-caught
+        severity = "ERROR"
+        details = f"Inspection failed: {exc}"
+        _logger.error("Failed to inspect %s: %s", file_path, exc)
+        _console.print(f"[red]Failed to inspect {file_path}: {exc}[/red]")
+    loop = asyncio.get_running_loop()
+    await loop.run_in_executor(
+        None, insert_result, db_path, session_id, file_path, severity, details
+    )
+
+
+async def _inspect_all(  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    files: list[str],
+    system_prompt: str,
+    config: Config,
+    db_path: str,
+    session_id: str,
+) -> None:
+    """Runs inspection for each file concurrently and persists each result to the database.
+
+    :param files: Sorted list of absolute file paths to inspect.
+    :param system_prompt: The security inspection system prompt text.
+    :param config: The vulguard configuration instance.
+    :param db_path: Absolute path to the vulguard SQLite database file.
+    :param session_id: UUID string identifying the current inspection run.
+    """
+    with _console.status(f"Inspecting {len(files)} file(s)…", spinner="dots"):
+        tasks = [
+            _inspect_and_persist(fp, system_prompt, config, db_path, session_id)
+            for fp in files
+        ]
+        await asyncio.gather(*tasks)
+
+
+def _setup_db_session(db_dir: str | None) -> tuple[str, str]:
+    """Initialises the SQLite database and creates a new inspection session.
+
+    :param db_dir: Optional directory override for the database location.
+    :return: Tuple of ``(db_path, session_id)``.
+    """
+    db_path = get_db_path(db_dir)
+    init_db(db_path)
+    session_id = str(uuid.uuid4())
+    _logger.debug("Inspection session: %s  db: %s", session_id, db_path)
+    return db_path, session_id
+
+
+def _write_reports(
+    report: dict[str, object],
+    output_dir: str,
+    report_base: str,
+    fmt: str,
+) -> None:
+    """Writes the JSON report and, optionally, the HTML report to disk.
+
+    :param report: The report dict produced by :func:`.report.build_report`.
+    :param output_dir: Directory where report files are written.
+    :param report_base: Base filename (no extension).
+    :param fmt: ``'json'`` or ``'html'``; ``'html'`` also produces a JSON file.
+    """
+    output_path = Path(output_dir)
+    json_path = output_path / f"{report_base}.json"
+    write_json(report, json_path)
+    _logger.info("JSON report written: %s", json_path)
+    _console.print(f"[green]JSON report:[/green] {json_path}")
+
+    if fmt == "html":
+        html_path = output_path / f"{report_base}.html"
+        write_html(report, html_path)
+        _logger.info("HTML report written: %s", html_path)
+        _console.print(f"[green]HTML report:[/green] {html_path}")
+
+
+async def _run_inspection(  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    paths: tuple[str, ...],
+    extensions: list[str],
+    output_dir: str,
+    report_base: str,
+    fmt: str,
+    db_dir: str | None = None,
+) -> None:
+    """Orchestrates file collection, Copilot inspection, and report writing.
+
+    Inspection results are persisted to SQLite (``vulguard.db``) during the
+    run.  After the report is written the session records are deleted.
+
+    :param paths: Tuple of file or directory paths to inspect.
+    :param extensions: File extension filter list (empty = all files).
+    :param output_dir: Directory where reports are written.
+    :param report_base: Base filename for the report (no suffix appended).
+    :param fmt: Report format — ``'json'`` or ``'html'``.
+    :param db_dir: Optional directory that overrides the default database
+                   location (``~/.vulguard``).
+    """
+    _logger.info("Starting vulguard inspection — paths: %s, fmt: %s", paths, fmt)
+    system_prompt = load_system_prompt()
+    config = Config()
+    files = _collect_files(paths, extensions)
+
+    if not files:
+        _logger.warning("No files found matching the specified criteria.")
+        _console.print(
+            "[yellow]No files found matching the specified criteria.[/yellow]"
+        )
+        return
+
+    db_path, session_id = _setup_db_session(db_dir)
+    _logger.info("Collected %d file(s) for inspection.", len(files))
+    Path(output_dir).mkdir(parents=True, exist_ok=True)
+    await _inspect_all(files, system_prompt, config, db_path, session_id)
+
+    results = get_results_by_session(db_path, session_id)
+    report = build_report(results, __version__)
+    vuln_count = sum(1 for r in results if r.get("severity") != "NONE")
+
+    _write_reports(report, output_dir, report_base, fmt)
+
+    delete_results_by_session(db_path, session_id)
+    _logger.debug("Session %s removed from database.", session_id)
+
+    _logger.info("Inspection complete. %d vulnerability(ies) found.", vuln_count)
+    _console.print(
+        f"\n[bold]Inspection complete.[/bold] {vuln_count} vulnerability(ies) found."
+    )
+
+
+@click.command("inspect")
+@click.argument("paths", nargs=-1, required=True, type=click.Path(exists=True))
+@click.option(
+    "--ext",
+    default=None,
+    help=(
+        "Comma-separated file extensions to inspect (e.g. py,js,ts). "
+        "Inspects all files if omitted."
+    ),
+)
+@click.option(
+    "--output-dir",
+    default=None,
+    type=click.Path(),
+    help="Output directory for reports. Defaults to <cwd>/reports.",
+)
+@click.option(
+    "--report",
+    default="vulguard-report",
+    show_default=True,
+    help="Base filename for the report (no suffix appended).",
+)
+@click.option(
+    "--format",
+    "fmt",
+    default="json",
+    show_default=True,
+    type=click.Choice(["json", "html"]),
+    help="Report format. Choosing 'html' also produces a JSON file.",
+)
+@click.option(
+    "--db-dir",
+    default=None,
+    type=click.Path(),
+    help="Directory for the vulguard SQLite database. Defaults to ~/.vulguard.",
+)
+def inspect_command(  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    paths: tuple[str, ...],
+    ext: str | None,
+    output_dir: str | None,
+    report: str,
+    fmt: str,
+    db_dir: str | None,
+) -> None:
+    """Inspect source files or directories for security vulnerabilities.
+
+    PATHS are one or more file or directory paths to inspect.
+    Directories are walked recursively. Each file is inspected in an
+    isolated GitHub Copilot session.
+    """
+    extensions: list[str] = [e.strip().lower() for e in ext.split(",")] if ext else []
+    effective_output_dir = output_dir or str(Path.cwd() / "reports")
+    asyncio.run(
+        _run_inspection(paths, extensions, effective_output_dir, report, fmt, db_dir)
+    )
+
+
+@click.group()
+@click.version_option(
+    __version__, "--version", "-V", prog_name="vulguard", message="%(prog)s %(version)s"
+)
+def main() -> None:
+    """vulguard - AI-powered source code security inspector."""
+    banner = Text.assemble(
+        ("vulguard", "bold cyan"),
+        (" v", "dim"),
+        (__version__, "bold white"),
+        " - ",
+        ("AI-powered source code security inspector", "dim"),
+    )
+    _console.print(Panel(banner, expand=False, border_style="cyan"))
+
+
+main.add_command(inspect_command)

vulguard/config.ini

@@ -0,0 +1,8 @@
+[model]
+model = claude-sonnet-4.6
+timeout = 300
+
+[retry]
+max-attempts = 5
+base-delay = 0.5
+max-delay = 10.0

vulguard/config.py

@@ -0,0 +1,92 @@
+"""
+vulguard.config - Configuration management module for vulguard.
+
+Reads settings from the bootstrapped config.ini file and provides
+typed accessors with sensible defaults.
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+import configparser
+from pathlib import Path
+
+from . import CONF_DIR
+
+_DEFAULT_MODEL = "claude-sonnet-4.6"
+_DEFAULT_TIMEOUT = 300
+_DEFAULT_MAX_ATTEMPTS = 5
+_DEFAULT_BASE_DELAY = 0.5
+_DEFAULT_MAX_DELAY = 10.0
+
+
+class Config:
+    """
+    Manages the vulguard configuration from config.ini.
+
+    Reads from the bootstrapped configuration directory (``CONF_DIR``) and
+    provides typed accessors for configuration values with sensible defaults
+    so that the application continues to function even when the file is absent.
+
+    :author: Ron Webb
+    :since: 1.0.0
+    """
+
+    def __init__(self, conf_dir: str | None = None) -> None:
+        """Initialises the configuration by reading config.ini from CONF_DIR.
+
+        :param conf_dir: Optional directory override for the config file location.
+                         Falls back to the bootstrapped ``CONF_DIR`` when omitted.
+        """
+        self._config = configparser.ConfigParser()
+        config_path = Path(conf_dir or CONF_DIR) / "config.ini"
+        self._config.read(config_path)
+
+    def get_model(self) -> str:
+        """Returns the configured Copilot model name.
+
+        Falls back to ``claude-sonnet-4.6`` if the key is absent.
+
+        :return: The model identifier string.
+        """
+        return self._config.get("model", "model", fallback=_DEFAULT_MODEL)
+
+    def get_timeout(self) -> int:
+        """Returns the configured inspection timeout in seconds.
+
+        Falls back to 300 seconds if the key is absent.
+
+        :return: Timeout as a positive integer number of seconds.
+        """
+        return self._config.getint("model", "timeout", fallback=_DEFAULT_TIMEOUT)
+
+    def get_max_attempts(self) -> int:
+        """Returns the maximum number of retry attempts.
+
+        Falls back to 5 if the key is absent.
+
+        :return: Maximum retry attempt count as a positive integer.
+        """
+        return self._config.getint(
+            "retry", "max-attempts", fallback=_DEFAULT_MAX_ATTEMPTS
+        )
+
+    def get_base_delay(self) -> float:
+        """Returns the base delay in seconds for exponential back-off.
+
+        Falls back to 0.5 seconds if the key is absent.
+
+        :return: Base delay as a float number of seconds.
+        """
+        return self._config.getfloat(
+            "retry", "base-delay", fallback=_DEFAULT_BASE_DELAY
+        )
+
+    def get_max_delay(self) -> float:
+        """Returns the maximum delay cap in seconds for exponential back-off.
+
+        Falls back to 10.0 seconds if the key is absent.
+
+        :return: Maximum delay as a float number of seconds.
+        """
+        return self._config.getfloat("retry", "max-delay", fallback=_DEFAULT_MAX_DELAY)

vulguard/db.py

@@ -0,0 +1,130 @@
+"""
+vulguard.db - SQLite persistence layer for vulguard inspection sessions.
+
+Provides functions to initialise the database, insert per-file inspection
+records, query results by session, and delete records after report generation.
+
+The default database location is ``~/.vulguard/vulguard.db``.  A custom
+directory can be supplied to override the default.
+
+:author: Ron Webb
+:since: 1.1.0
+"""
+
+import sqlite3
+import uuid
+from collections.abc import Generator
+from contextlib import contextmanager
+from pathlib import Path
+
+_DB_NAME = "vulguard.db"
+_DEFAULT_DIR = Path.home() / ".vulguard"
+
+
+def get_db_path(db_dir: str | None = None) -> str:
+    """Returns the absolute path to the vulguard SQLite database file.
+
+    Uses *db_dir* when provided, otherwise falls back to ``~/.vulguard``.
+
+    :param db_dir: Optional directory that overrides the default location.
+    :return: Absolute path to the ``vulguard.db`` file.
+    """
+    directory = Path(db_dir) if db_dir else _DEFAULT_DIR
+    return str(directory.resolve() / _DB_NAME)
+
+
+@contextmanager
+def _connect(db_path: str) -> Generator[sqlite3.Connection, None, None]:
+    """Context manager that opens and closes a SQLite connection.
+
+    :param db_path: Absolute path to the database file.
+    :yields: An open :class:`sqlite3.Connection`.
+    """
+    conn = sqlite3.connect(db_path)
+    try:
+        yield conn
+    finally:
+        conn.close()
+
+
+def init_db(db_path: str) -> None:
+    """Creates the parent directory and the ``inspections`` table if absent.
+
+    :param db_path: Absolute path to the database file.
+    """
+    Path(db_path).parent.mkdir(parents=True, exist_ok=True)
+    with _connect(db_path) as conn:
+        conn.execute("""
+            CREATE TABLE IF NOT EXISTS inspections (
+                id          TEXT PRIMARY KEY,
+                session_id  TEXT NOT NULL,
+                file_path   TEXT NOT NULL,
+                severity    TEXT NOT NULL,
+                details     TEXT NOT NULL
+            )
+            """)
+        conn.commit()
+
+
+def insert_result(
+    db_path: str,
+    session_id: str,
+    file_path: str,
+    severity: str,
+    details: str,
+) -> None:
+    """Inserts a single file inspection result into the database.
+
+    A new UUID is generated automatically and used as the record's primary key.
+
+    :param db_path: Absolute path to the database file.
+    :param session_id: UUID string identifying the current inspection run.
+    :param file_path: Absolute path to the inspected file.
+    :param severity: Severity level (``CRITICAL``, ``MAJOR``, ``MINOR``, or ``NONE``).
+    :param details: Human-readable description of the finding.
+    """
+    record_id = str(uuid.uuid4())
+    with _connect(db_path) as conn:
+        conn.execute(
+            "INSERT INTO inspections (id, session_id, file_path, severity, details) "
+            "VALUES (?, ?, ?, ?, ?)",
+            (record_id, session_id, file_path, severity, details),
+        )
+        conn.commit()
+
+
+def get_results_by_session(
+    db_path: str,
+    session_id: str,
+) -> list[dict[str, str]]:
+    """Returns all inspection records for a given session as a list of dicts.
+
+    :param db_path: Absolute path to the database file.
+    :param session_id: UUID string identifying the inspection run.
+    :return: List of dicts with ``file``, ``severity``, and ``details`` keys,
+             ordered by file path.
+    """
+    with _connect(db_path) as conn:
+        cursor = conn.execute(
+            "SELECT file_path, severity, details FROM inspections "
+            "WHERE session_id = ? ORDER BY file_path",
+            (session_id,),
+        )
+        return [
+            {"file": row[0], "severity": row[1], "details": row[2]}
+            for row in cursor.fetchall()
+        ]
+
+
+def delete_results_by_session(db_path: str, session_id: str) -> None:
+    """Deletes all inspection records associated with a session UUID.
+
+    :param db_path: Absolute path to the database file.
+    :param session_id: UUID string identifying the inspection run to remove.
+    """
+    with _connect(db_path) as conn:
+        conn.execute(
+            "DELETE FROM inspections WHERE session_id = ?",
+            (session_id,),
+        )
+        conn.commit()

vulguard/inspector.py

@@ -0,0 +1,107 @@
+"""
+vulguard.inspector - GitHub Copilot SDK integration for security file inspection.
+
+Loads the system prompt, sends each file to an isolated Copilot session,
+and parses the model response into a structured vulnerability dict.
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+import json
+from importlib import resources
+from pathlib import Path
+
+from copilot import CopilotClient  # pylint: disable=import-error
+from copilot.session import PermissionHandler  # pylint: disable=import-error
+from copilot.session_events import AssistantMessageData  # pylint: disable=import-error
+
+from .config import Config
+from .retry import retry_async
+
+
+def load_system_prompt() -> str:
+    """Loads the security inspection system prompt from the package resources.
+
+    :return: The full system prompt text.
+    """
+    prompt_ref = resources.files("vulguard").joinpath("prompts/system-prompt.md")
+    return prompt_ref.read_text(encoding="utf-8")
+
+
+def _parse_sdk_response(content: str, file_path: str) -> dict[str, str]:
+    """Parses the JSON response returned by the Copilot model.
+
+    Strips markdown code fences if present and falls back to a safe ``NONE``
+    entry on any parse failure.
+
+    :param content: Raw text response from the model.
+    :param file_path: The inspected file path used as the ``file`` field value.
+    :return: Dict with ``file``, ``severity``, and ``details`` keys.
+    """
+    cleaned = content.strip()
+    if cleaned.startswith("```"):
+        lines = cleaned.splitlines()
+        cleaned = "\n".join(lines[1:-1]).strip()
+    try:
+        data = json.loads(cleaned)
+        return {
+            "file": file_path,
+            "severity": str(data.get("severity", "NONE")).upper(),
+            "details": str(data.get("details", "The code is safe.")),
+        }
+    except json.JSONDecodeError, ValueError:
+        return {
+            "file": file_path,
+            "severity": "NONE",
+            "details": "The code is safe.",
+        }
+
+
+async def inspect_file(
+    file_path: str,
+    system_prompt: str,
+    config: Config,
+) -> dict[str, str]:
+    """Inspects a single file using an isolated GitHub Copilot session.
+
+    A new ``CopilotClient`` and session are created for each file to ensure
+    full context isolation between inspections.  The ``send_and_wait`` call is
+    wrapped with :func:`.retry.retry_async` to transparently retry transient
+    failures using exponential back-off with full jitter.
+
+    :param file_path: Absolute path to the file to inspect.
+    :param system_prompt: The security inspection system prompt text.
+    :param config: The vulguard configuration instance.
+    :return: Dict with ``file``, ``severity``, and ``details`` keys.
+    """
+    async with CopilotClient() as client:
+        async with await client.create_session(
+            on_permission_request=PermissionHandler.approve_all,
+            model=config.get_model(),
+            system_message={"mode": "replace", "content": system_prompt},
+        ) as session:
+            response = await retry_async(
+                session.send_and_wait,
+                f"Check for security vulnerability the {file_path}",
+                attachments=[
+                    {
+                        "type": "file",
+                        "path": file_path,
+                        "displayName": Path(file_path).name,
+                    }
+                ],
+                timeout=float(config.get_timeout()),
+                max_attempts=config.get_max_attempts(),
+                base_delay=config.get_base_delay(),
+                max_delay=config.get_max_delay(),
+            )
+
+    if response is None:
+        return {"file": file_path, "severity": "NONE", "details": "The code is safe."}
+
+    content = ""
+    if isinstance(response.data, AssistantMessageData):
+        content = response.data.content or ""
+
+    return _parse_sdk_response(content, file_path)

vulguard/logging.ini

@@ -0,0 +1,35 @@
+[loggers]
+keys=root,copilotClient
+
+[handlers]
+keys=consoleHandler,fileHandler
+
+[formatters]
+keys=logFormatter,consoleFormatter
+
+[logger_root]
+level=INFO
+handlers=consoleHandler,fileHandler
+
+[logger_copilotClient]
+level=WARN
+handlers=consoleHandler,fileHandler
+qualname=copilot.client
+propagate=0
+
+[handler_consoleHandler]
+class=StreamHandler
+level=WARN
+formatter=consoleFormatter
+args=(sys.stderr,)
+
+[handler_fileHandler]
+class=FileHandler
+formatter=logFormatter
+args=('vulguard.log', 'a')
+
+[formatter_logFormatter]
+format=%(asctime)s [%(levelname)s] %(name)s - %(message)s
+
+[formatter_consoleFormatter]
+format=%(asctime)s - %(name)s - %(levelname)s - %(message)s

vulguard/prompts/system-prompt.md

@@ -0,0 +1,40 @@
+# Security Vulnerability Inspector
+
+You are an expert security code analyst. Your sole task is to inspect the provided source code for security vulnerabilities.
+
+## Response Format
+
+You MUST respond with ONLY a single valid JSON object — no prose, no markdown, no code fences, no explanation before or after the JSON.
+
+The JSON object must follow this exact schema:
+
+{"file": "<fully-qualified filename>", "severity": "<CRITICAL|MAJOR|MINOR|NONE>", "details": "<description>"}
+
+## Severity Levels
+
+- **CRITICAL**: Immediate exploitation risk (e.g., SQL injection, command injection, hardcoded secrets/passwords/tokens, authentication bypass, remote code execution).
+- **MAJOR**: High-risk issues that can lead to data exposure or unauthorized access (e.g., logging entire request payloads or sensitive user data, logging full exception objects or stack traces, insecure deserialization, path traversal, cross-site scripting without output encoding, CSRF on state-changing endpoints).
+- **MINOR**: Lower-risk issues that could become vulnerabilities under certain conditions (e.g., overly verbose error messages, weak cryptography such as MD5 or SHA1 for security purposes, missing input validation, use of deprecated security APIs, storing sensitive data in cookies without Secure/HttpOnly flags).
+- **NONE**: No security vulnerabilities detected. Set `details` to `"The code is safe."`.
+
+## Vulnerability Categories to Check
+
+1. **Payload and Exception Logging** — Code that logs entire HTTP request bodies, responses, user-submitted data, passwords, tokens, or full exception tracebacks to any logging output. This exposes sensitive data in log files.
+2. **Hardcoded Secrets** — API keys, database passwords, private keys, tokens, or credentials embedded as string literals in source code.
+3. **SQL Injection** — Dynamic SQL queries constructed with string concatenation, `%` formatting, or f-strings without parameterized queries or prepared statements.
+4. **Command Injection** — Calls to `os.system`, `subprocess` with `shell=True`, or `eval`/`exec` on user-controlled input without sanitization.
+5. **Path Traversal** — File system operations where the path is derived from user input without stripping `..` components or canonicalizing the path.
+6. **Cross-Site Scripting (XSS)** — Rendering user-controlled input as raw HTML without output escaping (e.g., using `Markup(user_input)` in Flask/Jinja without `| e`).
+7. **Insecure Deserialization** — Use of `pickle.loads`, `yaml.load` without a safe Loader, `marshal`, or `eval`/`exec` to deserialize untrusted data.
+8. **Weak Cryptography** — Use of MD5, SHA1, DES, or RC4 for security-critical operations; use of `random` instead of `secrets` for generating tokens; hardcoded IVs or salts.
+9. **Sensitive Data Exposure** — Passwords, secrets, or PII returned in API responses or written to error messages accessible to end users.
+10. **Missing Authentication or Authorization Checks** — Endpoints or functions that perform privileged operations without verifying the caller's identity or permissions.
+11. **XML External Entity (XXE)** — XML parsing with external entity expansion enabled (e.g., `lxml` without `resolve_entities=False`).
+12. **CSRF** — State-changing web endpoints (POST, PUT, DELETE) without CSRF token validation.
+
+## Rules
+
+1. Identify the **single most severe** vulnerability present in the file.
+2. If multiple vulnerabilities exist, report only the most critical one and briefly mention the others in the `details` field.
+3. Set `file` to the fully-qualified path of the file as provided in the user message.
+4. Your **entire response** must be exactly one valid JSON object and nothing else — no leading text, no trailing text.

vulguard/report.py

@@ -0,0 +1,192 @@
+"""
+vulguard.report - JSON and HTML report generation for vulguard security scan results.
+
+Provides functions to build the report data structure from raw inspection results
+and to serialise it to JSON and self-contained HTML output files.
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+import html
+import json
+import re
+from datetime import datetime, timezone
+from pathlib import Path
+
+_APPLICATION_NAME = "vulguard"
+
+_HTML_TEMPLATE = """<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Vulguard Security Report</title>
+    <style>
+        * { box-sizing: border-box; margin: 0; padding: 0; }
+        body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+               background: #f4f6f8; color: #333; padding: 32px; }
+        h1 { font-size: 24px; margin-bottom: 4px; }
+        .header { background: #1a1a2e; color: #fff; padding: 28px 32px;
+                  border-radius: 10px; margin-bottom: 24px; }
+        .header .sub { font-size: 13px; opacity: 0.65; margin-top: 6px; }
+        .summary { display: flex; gap: 16px; margin-bottom: 28px; }
+        .card { background: #fff; border-radius: 10px; padding: 20px; flex: 1;
+                text-align: center; box-shadow: 0 1px 3px rgba(0,0,0,.08); }
+        .card .num { font-size: 34px; font-weight: 700; }
+        .card .lbl { font-size: 12px; color: #777; margin-top: 4px;
+                     text-transform: uppercase; letter-spacing: .5px; }
+        .card { cursor: pointer; transition: box-shadow .15s, transform .1s; }
+        .card:hover { box-shadow: 0 4px 12px rgba(0,0,0,.13); transform: translateY(-2px); }
+        .card.active { outline: 2px solid #1a1a2e; }
+        .c-red { color: #c0392b; } .c-orange { color: #e67e22; } .c-yellow { color: #d4ac0d; } .c-grey { color: #7f8c8d; }
+        .vuln { background: #fff; border-radius: 10px; margin-bottom: 16px;
+                overflow: hidden; box-shadow: 0 1px 3px rgba(0,0,0,.08); display: flex; }
+        .bar { width: 6px; flex-shrink: 0; }
+        .bar.CRITICAL { background: #c0392b; }
+        .bar.MAJOR    { background: #e67e22; }
+        .bar.MINOR    { background: #d4ac0d; }
+        .bar.ERROR    { background: #7f8c8d; }
+        .body { padding: 18px 20px; flex: 1; }
+        .badge { display: inline-block; padding: 2px 10px; border-radius: 12px;
+                 font-size: 11px; font-weight: 700; text-transform: uppercase; margin-right: 10px; }
+        .badge.CRITICAL { background: #fdecea; color: #c0392b; }
+        .badge.MAJOR    { background: #fef0e6; color: #e67e22; }
+        .badge.MINOR    { background: #fef9e7; color: #d4ac0d; }
+        .badge.ERROR    { background: #eaecee; color: #7f8c8d; }
+        .file { font-size: 12px; font-family: monospace; color: #555; }
+        .details { margin-top: 8px; font-size: 14px; color: #555; line-height: 1.55; }
+        .no-vulns { text-align: center; padding: 48px; color: #888; font-size: 16px;
+                    background: #fff; border-radius: 10px; box-shadow: 0 1px 3px rgba(0,0,0,.08); }
+    </style>
+</head>
+<body>
+    <div class="header">
+        <h1>Vulguard Security Report</h1>
+        <div class="sub">%%APPLICATION%% &bull; v%%VERSION%% &bull; %%TIMESTAMP%%</div>
+    </div>
+    <div class="summary">
+        <div class="card active" data-filter="ALL" onclick="filterCards(this)"><div class="num">%%TOTAL%%</div><div class="lbl">Vulnerabilities</div></div>
+        <div class="card" data-filter="CRITICAL" onclick="filterCards(this)"><div class="num c-red">%%CRITICAL%%</div><div class="lbl">Critical</div></div>
+        <div class="card" data-filter="MAJOR" onclick="filterCards(this)"><div class="num c-orange">%%MAJOR%%</div><div class="lbl">Major</div></div>
+        <div class="card" data-filter="MINOR" onclick="filterCards(this)"><div class="num c-yellow">%%MINOR%%</div><div class="lbl">Minor</div></div>
+        <div class="card" data-filter="ERROR" onclick="filterCards(this)"><div class="num c-grey">%%ERROR%%</div><div class="lbl">Error</div></div>
+    </div>
+    %%ROWS%%%%NO_VULNS%%
+    <script>
+        function filterCards(el) {
+            document.querySelectorAll('.card').forEach(c => c.classList.remove('active'));
+            el.classList.add('active');
+            var filter = el.getAttribute('data-filter');
+            document.querySelectorAll('.vuln').forEach(function(row) {
+                row.style.display = (filter === 'ALL' || row.getAttribute('data-severity') === filter) ? 'flex' : 'none';
+            });
+        }
+    </script>
+</body>
+</html>
+"""
+
+_HTML_ROW_TEMPLATE = (
+    '<div class="vuln" data-severity="%%SEVERITY%%">'
+    '<div class="bar %%SEVERITY%%"></div>'
+    '<div class="body">'
+    '<span class="badge %%SEVERITY%%">%%SEVERITY%%</span>'
+    '<span class="file">%%FILE%%</span>'
+    '<div class="details">%%DETAILS%%</div>'
+    "</div>"
+    "</div>\n"
+)
+
+
+def build_report(results: list[dict[str, str]], version: str) -> dict[str, object]:
+    """Builds the final report dict, filtering out ``NONE``-severity entries.
+
+    :param results: List of per-file inspection result dicts.
+    :param version: The application version string.
+    :return: Structured report dict ready for JSON serialisation.
+    """
+    vulnerabilities: list[dict[str, str]] = [
+        r for r in results if r.get("severity") != "NONE"
+    ]
+    return {
+        "application": _APPLICATION_NAME,
+        "version": version,
+        "timestamp": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+        "vulnerabilities": vulnerabilities,
+    }
+
+
+def _render_html_vuln_row(vuln: dict[str, str]) -> str:
+    """Renders a single vulnerability as an HTML card row.
+
+    :param vuln: Vulnerability dict with ``file``, ``severity``, and ``details``.
+    :return: HTML string for the vulnerability card.
+    """
+    substitutions = {
+        "SEVERITY": str(vuln.get("severity", "MINOR")),
+        "FILE": html.escape(str(vuln.get("file", ""))),
+        "DETAILS": html.escape(str(vuln.get("details", ""))),
+    }
+    return re.sub(
+        r"%%(\w+)%%",
+        lambda m: substitutions.get(m.group(1), m.group(0)),
+        _HTML_ROW_TEMPLATE,
+    )
+
+
+def _render_html_report(report: dict[str, object], vulns: list[dict[str, str]]) -> str:
+    """Renders the complete HTML report as a string.
+
+    :param report: The full report dict.
+    :param vulns: The list of vulnerability dicts to render.
+    :return: Rendered HTML string.
+    """
+    rows = "".join(_render_html_vuln_row(v) for v in vulns)
+    no_vulns = (
+        ""
+        if vulns
+        else '<p class="no-vulns">No vulnerabilities found. Your code looks safe!</p>'
+    )
+    substitutions = {
+        "APPLICATION": html.escape(str(report.get("application", _APPLICATION_NAME))),
+        "VERSION": html.escape(str(report.get("version", ""))),
+        "TIMESTAMP": html.escape(str(report.get("timestamp", ""))),
+        "TOTAL": str(len(vulns)),
+        "CRITICAL": str(sum(1 for v in vulns if v.get("severity") == "CRITICAL")),
+        "MAJOR": str(sum(1 for v in vulns if v.get("severity") == "MAJOR")),
+        "MINOR": str(sum(1 for v in vulns if v.get("severity") == "MINOR")),
+        "ERROR": str(sum(1 for v in vulns if v.get("severity") == "ERROR")),
+        "ROWS": rows,
+        "NO_VULNS": no_vulns,
+    }
+    return re.sub(
+        r"%%(\w+)%%",
+        lambda m: substitutions.get(m.group(1), m.group(0)),
+        _HTML_TEMPLATE,
+    )
+
+
+def write_json(report: dict[str, object], path: Path) -> None:
+    """Writes the report as a JSON file.
+
+    :param report: The report dict to serialise.
+    :param path: Destination file path.
+    """
+    with open(path, "w", encoding="utf-8") as file_out:
+        json.dump(report, file_out, indent=2)
+
+
+def write_html(report: dict[str, object], path: Path) -> None:
+    """Writes the report as a self-contained HTML file.
+
+    :param report: The report dict containing the ``vulnerabilities`` list.
+    :param path: Destination file path.
+    """
+    raw_vulns = report.get("vulnerabilities", [])
+    vulns: list[dict[str, str]] = []
+    if isinstance(raw_vulns, list):
+        vulns = [v for v in raw_vulns if isinstance(v, dict)]
+    html_content = _render_html_report(report, vulns)
+    with open(path, "w", encoding="utf-8") as file_out:
+        file_out.write(html_content)

vulguard/retry.py

@@ -0,0 +1,88 @@
+"""
+vulguard.retry - Retry utilities with exponential back-off and full jitter.
+
+Provides a generic async retry decorator and a helper that computes the
+next sleep interval using the "Full Jitter" algorithm described in the
+AWS Architecture Blog (exponential back-off + full random jitter).
+
+:author: Ron Webb
+:since: 1.0.0
+"""
+
+import asyncio
+import random
+from collections.abc import Callable, Coroutine
+from typing import Any
+
+from logenrich import setup_logger
+
+from . import CONF_DIR
+
+_logger = setup_logger(__name__, conf_dir=CONF_DIR)
+
+
+def _compute_delay(attempt: int, base_delay: float, max_delay: float) -> float:
+    """Computes the next sleep interval using full-jitter exponential back-off.
+
+    The formula is: ``random.uniform(0, min(max_delay, base_delay * 2 ** attempt))``.
+
+    :param attempt: Zero-based attempt index (0 = first retry).
+    :param base_delay: Initial delay in seconds before jitter is applied.
+    :param max_delay: Upper cap in seconds for the computed sleep interval.
+    :return: A non-negative float representing the number of seconds to sleep.
+    """
+    ceiling = min(max_delay, base_delay * (2**attempt))
+    return random.uniform(0, ceiling)
+
+
+async def retry_async[T](  # pylint: disable=invalid-name
+    func: Callable[..., Coroutine[Any, Any, T]],
+    *args: Any,
+    max_attempts: int,
+    base_delay: float,
+    max_delay: float,
+    **kwargs: Any,
+) -> T:
+    """Calls an async coroutine function with retry and exponential-jitter back-off.
+
+    Retries on any :class:`Exception` up to *max_attempts* times.  After each
+    failure the caller sleeps for a jittered duration before the next attempt.
+    If all attempts are exhausted the last exception is re-raised.
+
+    :param func: Async callable to invoke.
+    :param args: Positional arguments forwarded to *func*.
+    :param max_attempts: Total number of attempts (must be >= 1).
+    :param base_delay: Base delay in seconds used for back-off calculation.
+    :param max_delay: Maximum sleep duration cap in seconds.
+    :param kwargs: Keyword arguments forwarded to *func*.
+    :return: The return value of a successful *func* invocation.
+    :raises ValueError: If *max_attempts* is less than 1.
+    :raises Exception: Re-raises the last exception when all attempts fail.
+    """
+    if max_attempts < 1:
+        raise ValueError(f"max_attempts must be >= 1, got {max_attempts}")
+    last_exc: Exception | None = None
+    for attempt in range(max_attempts):
+        try:
+            return await func(*args, **kwargs)
+        except Exception as exc:  # pylint: disable=broad-exception-caught
+            last_exc = exc
+            if attempt < max_attempts - 1:
+                delay = _compute_delay(attempt, base_delay, max_delay)
+                _logger.warning(
+                    "Attempt %d/%d failed (%s). Retrying in %.2fs.",
+                    attempt + 1,
+                    max_attempts,
+                    exc,
+                    delay,
+                )
+                await asyncio.sleep(delay)
+            else:
+                _logger.error(
+                    "Attempt %d/%d failed (%s). No more retries.",
+                    attempt + 1,
+                    max_attempts,
+                    exc,
+                )
+    assert last_exc is not None  # guaranteed when max_attempts >= 1
+    raise last_exc

vulguard-1.0.0.dist-info/METADATA

@@ -0,0 +1,202 @@
+Metadata-Version: 2.4
+Name: vulguard
+Version: 1.0.0
+Summary: A lightweight security tool that automatically scans source code for vulnerabilities, highlights risky patterns, and guides developers toward safer implementations to strengthen their applications' overall security posture.
+License: MIT License
+         
+         Copyright (c) 2026 Ron Webb
+         
+         Permission is hereby granted, free of charge, to any person obtaining a copy
+         of this software and associated documentation files (the "Software"), to deal
+         in the Software without restriction, including without limitation the rights
+         to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+         copies of the Software, and to permit persons to whom the Software is
+         furnished to do so, subject to the following conditions:
+         
+         The above copyright notice and this permission notice shall be included in all
+         copies or substantial portions of the Software.
+         
+         THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+         IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+         FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+         AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+         LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+         SOFTWARE.
+License-File: LICENSE
+Author: Ron Webb
+Author-email: ron@ronella.xyz
+Requires-Python: >=3.14
+Classifier: License :: Other/Proprietary License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: click (>=8.0.0,<9.0.0)
+Requires-Dist: env-dir-bootstrap (>=1.0.0,<2.0.0)
+Requires-Dist: github-copilot-sdk (>=1.0.1,<2.0.0)
+Requires-Dist: logenrich (>=1.0.1,<2.0.0)
+Requires-Dist: rich (>=15.0.0,<16.0.0)
+Project-URL: Repository, https://github.com/rcw3bb/vulguard
+Description-Content-Type: text/markdown
+
+# vulguard 1.0.0
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![Version](https://img.shields.io/badge/version-1.0.0-blue.svg)](CHANGELOG.md)
+
+> A lightweight CLI security tool that automatically scans source code for vulnerabilities, highlights risky patterns, and guides developers toward safer implementations to strengthen their applications' overall security posture.
+
+## Prerequisites
+
+- Python `>=3.14`
+- An active [GitHub Copilot](https://github.com/features/copilot) subscription (used for AI-powered inspection)
+
+## Installation
+
+```bash
+pip install vulguard
+```
+
+## Usage
+
+```bash
+vulguard [OPTIONS] COMMAND [ARGS]...
+```
+
+### `inspect` — Scan files or directories
+
+```bash
+vulguard inspect [OPTIONS] PATHS...
+```
+
+| Option | Default | Description |
+|---|---|---|
+| `PATHS` | *(required)* | One or more files or directories to scan (recursive). |
+| `--ext TEXT` | *(all files)* | Comma-separated extensions to inspect, e.g. `py,js,ts`. |
+| `--output-dir PATH` | `<cwd>/reports` | Directory where reports are written. |
+| `--report TEXT` | `vulguard-report` | Base filename for the report (no extension appended). |
+| `--format [json\|html]` | `json` | Report format. Selecting `html` also produces a JSON file. |
+| `--db-dir PATH` | `~/.vulguard` | Directory for the SQLite session database. |
+
+#### Examples
+
+```bash
+# Scan all Python files in src/ and write a JSON report to ./reports
+vulguard inspect src/ --ext py
+
+# Scan multiple paths and produce an HTML report
+vulguard inspect src/ tests/ --ext py,js --format html --output-dir reports
+
+# Use a custom report name and database directory
+vulguard inspect src/ --report my-scan --db-dir /tmp/vg-db
+```
+
+## Configuration
+
+On first run, vulguard bootstraps a configuration directory and copies its default `config.ini` and `logging.ini` there. You can override the location with the `VULGUARD_CONFIG_DIR` environment variable:
+
+```bash
+# Windows (PowerShell)
+$env:VULGUARD_CONFIG_DIR = "C:\Users\you\.vulguard"
+
+# macOS / Linux
+export VULGUARD_CONFIG_DIR="$HOME/.vulguard"
+```
+
+### `config.ini` settings
+
+| Section | Key | Default | Description |
+|---|---|---|---|
+| `model` | `model` | `claude-sonnet-4.6` | GitHub Copilot model used for inspection. |
+| `model` | `timeout` | `300` | Per-file inspection timeout in seconds. |
+| `retry` | `max-attempts` | `5` | Maximum number of retry attempts on transient errors. |
+| `retry` | `base-delay` | `0.5` | Initial back-off delay in seconds. |
+| `retry` | `max-delay` | `10.0` | Maximum back-off delay in seconds. |
+
+## Development
+
+### Prerequisites
+
+- Poetry `2.2+`
+
+### Architecture
+
+```mermaid
+graph TD
+    CLI["cli.py\n(Click entry point)"]
+    Inspector["inspector.py\n(GitHub Copilot SDK)"]
+    DB["db.py\n(SQLite persistence)"]
+    Report["report.py\n(JSON / HTML output)"]
+    Config["config.py\n(config.ini reader)"]
+    Prompt["prompts/system-prompt.md\n(security prompt)"]
+
+    CLI -->|"collects files\norchestrates"| Inspector
+    CLI --> Config
+    Inspector --> Prompt
+    CLI -->|"persists results"| DB
+    CLI -->|"reads session"| DB
+    CLI -->|"builds & writes"| Report
+```
+
+### Setup
+
+```bash
+poetry install
+```
+
+### Format and Lint
+
+```bash
+poetry run black vulguard; poetry run pylint vulguard
+```
+
+Pylint must score **10.00/10** before committing.
+
+### Run Tests
+
+```bash
+poetry run pytest --cov=vulguard tests --cov-report html
+```
+
+Maintain **≥80 %** coverage.
+
+### Fixture-based integration smoke test
+
+```bash
+poetry run vulguard inspect tests/fixtures --ext py --format html
+```
+
+## Publishing to PyPI
+
+### Prerequisites
+
+- A [PyPI](https://pypi.org/) account with an API token.
+
+### Configure the token
+
+```bash
+poetry config pypi-token.pypi <your-token>
+```
+
+### Build and publish
+
+```bash
+poetry publish --build
+```
+
+This builds the source distribution and wheel, then uploads them to PyPI in one step.
+
+> **Note:** PyPI releases are immutable. Once a version is published, it cannot be overwritten.  
+> To fix a mistake, yank the release via the PyPI web UI and publish a new version.
+
+## [Changelog](CHANGELOG.md)
+
+See [CHANGELOG.md](CHANGELOG.md) for the full release history.
+
+## License
+
+This project is licensed under the [MIT License](LICENSE).
+
+## Author
+
+Ron Webb
+

vulguard-1.0.0.dist-info/RECORD

@@ -0,0 +1,15 @@
+vulguard/__init__.py,sha256=_bdGgRjrgyhAoKfI6kdXopUu9l5WsJDIQxdoJeo2o-Y,550
+vulguard/cli.py,sha256=2CHVp5-idh1yKs7rwFPe-3mIgry7whwIXlRO4vWa1zI,10422
+vulguard/config.ini,sha256=C6fBsMwGP_wty6uShpbdMdeTqQT6XkGEpfoGrkpsChM,116
+vulguard/config.py,sha256=h-Omy5DdxUTOWqscZO3cZWHJUqHGkUMO6B11pU5a_kg,2889
+vulguard/db.py,sha256=MX788skP-F1WlIrYP5_UQv_ecpAIspZbxp7L1ChIgss,4206
+vulguard/inspector.py,sha256=qFVxcpXOqlUmvGRENyK65riXz5YNWImE94-xKUHK65Q,3876
+vulguard/logging.ini,sha256=5bWfmimR3CwjFNSMeEMQ2lqKoA0t2EMame1nJgEnTvo,699
+vulguard/prompts/system-prompt.md,sha256=6bzJBzPiE9t65pvLWtHdeGxuRxvc2c40D5GyN1YNWSU,3777
+vulguard/report.py,sha256=hxXDTnwTP4hazn2xsSM9ezOvclNHF49gEJ29XIX4AWU,8361
+vulguard/retry.py,sha256=UI3fs9lP3f-Hj4o9U2bHfNmoETVNV_6n2xyM-IO86p4,3338
+vulguard-1.0.0.dist-info/entry_points.txt,sha256=Yi7QisXgzoOywf0mBAt-oUrcWY-2ittSPsAYRgDihS4,46
+vulguard-1.0.0.dist-info/licenses/LICENSE,sha256=2cmui6TBSfJF5E2Qr0xNS8x4ZY0grz8qLEBEW1CgpjA,1086
+vulguard-1.0.0.dist-info/METADATA,sha256=5reCi3bXX5AgoKck198t0l2mWgxb8m2qZOIn6nlS66k,6357
+vulguard-1.0.0.dist-info/WHEEL,sha256=Vz2fHgx6HFtSwhs8KvkHLqH5Ea4w1_rner5uNVGCeIE,88
+vulguard-1.0.0.dist-info/RECORD,,

vulguard-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.3.2
+Root-Is-Purelib: true
+Tag: py3-none-any

vulguard-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+vulguard=vulguard.cli:main
+

vulguard-1.0.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ron Webb
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.