You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by po...@apache.org on 2026/05/07 23:25:14 UTC
(airflow-steward) branch main updated: feat(security): implement M.29 sandbox-lint for `.claude/settings.json` (#93)
This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow-steward.git
The following commit(s) were added to refs/heads/main by this push:
new 88d3d2e feat(security): implement M.29 sandbox-lint for `.claude/settings.json` (#93)
88d3d2e is described below
commit 88d3d2ec22b18737445c8df96a975942ab1b5c5d
Author: André Ahlert <an...@aex.partners>
AuthorDate: Thu May 7 20:25:08 2026 -0300
feat(security): implement M.29 sandbox-lint for `.claude/settings.json` (#93)
* feat(security): implement M.29 sandbox-lint for `.claude/settings.json`
Mitigation M.29 in `docs/security/threat-model.md` (PR #91)
committed to lint the agent-host sandbox configuration in CI on
every PR that touches it. This is the implementation:
- `tools/sandbox-lint/` — new stdlib-only Python project. The CLI
compares `.claude/settings.json` against the canonical baseline
at `tools/sandbox-lint/expected.json` (set semantics on
`denyRead`, `allowRead`, `allowWrite`, `allowedDomains`, `deny`,
`ask`) and runs three layers of hard invariants — required
`denyRead` entries, forbidden `allowRead` and `allowWrite`
paths, required `permissions.deny` entries — against both the
live settings and the baseline itself. The same invariants
applied to the baseline catch the case where a future PR
weakens both files in lockstep.
- `.github/workflows/sandbox-lint.yml` — runs the linter on every
PR that touches `.claude/settings.json`, the baseline, or the
linter code. Path-scoped so the rest of the matrix is
unaffected.
- `.pre-commit-config.yaml` — adds `ruff check`, `ruff format
--check`, `mypy`, and `pytest` hooks for the new project; the
pytest hook also fires when `.claude/settings.json` changes
because the test suite loads both files.
- `.github/workflows/tests.yml` — adds the new project to the
per-project pytest matrix so the visible-signal lane reports
pass/fail in the CI checks list.
Threat-model cross-references are in
`tools/sandbox-lint/README.md`. The X3 residual (a maintainer
editing the file locally outside a PR) remains accepted; the lint
gates the shipped configuration, not local overrides during a
single agent run.
Generated-by: Claude Opus 4.7
* fix(sandbox-lint): satisfy lychee and CodeQL on the M.29 PR
Two CI failures on PR #93 against `apache/airflow-steward`:
- `lychee` fails because `tools/sandbox-lint/README.md` linked to
`docs/security/threat-model.md` paths and anchors — that file
lands in a companion PR and is not on `main` yet. Replace the
three direct links with prose references that note the
threat-model doc is a companion PR; the lint stands on its own.
- `CodeQL` (`py/incomplete-url-substring-sanitization`) fires on
the test sentinel `evil.example.com` because the rule keys on
hostname-shaped literals appearing in `in` substring checks.
This is test code asserting against a diff message, not URL
validation, but the rule is right that hostname-shaped sentinels
are a footgun. Rename to `sandbox-lint-test-extra-marker` so the
sentinel is unambiguously not a URL pattern.
Generated-by: Claude Opus 4.7
---
.github/workflows/sandbox-lint.yml | 62 +++++
.github/workflows/tests.yml | 2 +
.pre-commit-config.yaml | 32 +++
tools/sandbox-lint/README.md | 98 +++++++
tools/sandbox-lint/expected.json | 100 +++++++
tools/sandbox-lint/pyproject.toml | 88 +++++++
tools/sandbox-lint/src/sandbox_lint/__init__.py | 329 ++++++++++++++++++++++++
tools/sandbox-lint/tests/test_validator.py | 238 +++++++++++++++++
tools/sandbox-lint/uv.lock | 268 +++++++++++++++++++
9 files changed, 1217 insertions(+)
diff --git a/.github/workflows/sandbox-lint.yml b/.github/workflows/sandbox-lint.yml
new file mode 100644
index 0000000..6e1d4ff
--- /dev/null
+++ b/.github/workflows/sandbox-lint.yml
@@ -0,0 +1,62 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# Implements mitigation M.29 from
+# `docs/security/threat-model.md`: every change to the agent-host
+# sandbox configuration in `.claude/settings.json` must be paired with
+# a matching update to the canonical baseline at
+# `tools/sandbox-lint/expected.json`, and the resulting configuration
+# must satisfy the security invariants encoded in the linter.
+---
+name: sandbox-lint
+
+on: # yamllint disable-line rule:truthy
+ pull_request:
+ paths:
+ - ".claude/settings.json"
+ - "tools/sandbox-lint/**"
+ - ".github/workflows/sandbox-lint.yml"
+ push:
+ branches: [main]
+ paths:
+ - ".claude/settings.json"
+ - "tools/sandbox-lint/**"
+ - ".github/workflows/sandbox-lint.yml"
+
+permissions: {}
+
+jobs:
+ sandbox-lint:
+ name: lint .claude/settings.json against baseline
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ env:
+ FORCE_COLOR: "1"
+ steps:
+ - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ with:
+ persist-credentials: false
+ - uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b # v7.3.0
+ with:
+ enable-cache: true
+ # `--project` (not `--directory`) so the linter runs from the
+ # repository root; the default arguments resolve
+ # `.claude/settings.json` and `tools/sandbox-lint/expected.json`
+ # relative to cwd.
+ - name: Run sandbox-lint
+ run: uv run --project tools/sandbox-lint --group dev sandbox-lint
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2d17c0d..56d4e1a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -54,6 +54,8 @@ jobs:
path: tools/privacy-llm/redactor
- name: vulnogram-oauth-api
path: tools/vulnogram/oauth-api
+ - name: sandbox-lint
+ path: tools/sandbox-lint
# GitHub Actions log viewer renders ANSI colour escapes; without
# an attached TTY most tools default to monochrome. `FORCE_COLOR`
# is the de-facto signal honoured by uv, ruff, mypy, and pytest's
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index bc5b5fa..0888334 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -237,3 +237,35 @@ repos:
entry: uv run --directory tools/privacy-llm/checker pytest
files: ^tools/privacy-llm/checker/(src|tests|pyproject\.toml)
pass_filenames: false
+
+ # Project-local checks for the sandbox-lint Python project at
+ # `tools/sandbox-lint/`. Same shape as the other tool hooks.
+ # The pytest hook also covers the lint of `.claude/settings.json`
+ # against `tools/sandbox-lint/expected.json` because the project's
+ # tests load both files at module scope.
+ - repo: local
+ hooks:
+ - id: sandbox-lint-ruff-check
+ name: ruff check (sandbox-lint)
+ language: system
+ entry: uv run --directory tools/sandbox-lint ruff check
+ files: ^tools/sandbox-lint/(src|tests|pyproject\.toml)
+ pass_filenames: false
+ - id: sandbox-lint-ruff-format
+ name: ruff format (sandbox-lint)
+ language: system
+ entry: uv run --directory tools/sandbox-lint ruff format --check
+ files: ^tools/sandbox-lint/(src|tests|pyproject\.toml)
+ pass_filenames: false
+ - id: sandbox-lint-mypy
+ name: mypy (sandbox-lint)
+ language: system
+ entry: uv run --directory tools/sandbox-lint mypy
+ files: ^tools/sandbox-lint/(src|tests|pyproject\.toml)
+ pass_filenames: false
+ - id: sandbox-lint-pytest
+ name: pytest (sandbox-lint)
+ language: system
+ entry: uv run --directory tools/sandbox-lint pytest
+ files: ^(tools/sandbox-lint/(src|tests|pyproject\.toml|expected\.json)|\.claude/settings\.json)
+ pass_filenames: false
diff --git a/tools/sandbox-lint/README.md b/tools/sandbox-lint/README.md
new file mode 100644
index 0000000..456f95c
--- /dev/null
+++ b/tools/sandbox-lint/README.md
@@ -0,0 +1,98 @@
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+**Table of Contents** *generated with [DocToc](https://github.com/thlorenz/doctoc)*
+
+- [`sandbox-lint`](#sandbox-lint)
+ - [What it checks](#what-it-checks)
+ - [How to use](#how-to-use)
+ - [CI wiring](#ci-wiring)
+ - [Updating the baseline](#updating-the-baseline)
+ - [Residual risk](#residual-risk)
+
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
+<!-- SPDX-License-Identifier: Apache-2.0
+ https://www.apache.org/licenses/LICENSE-2.0 -->
+
+# `sandbox-lint`
+
+Lints `.claude/settings.json` against the shipped baseline at
+`tools/sandbox-lint/expected.json`, and against the security
+invariants documented in `docs/security/threat-model.md`
+(mitigation **M.29**). The threat-model document lands in a
+companion PR; the lint stands on its own and runs immediately on
+merge.
+
+## What it checks
+
+1. **Baseline parity.** Every key/value in the live settings file
+ must match the baseline. Lists tagged as set-typed (`denyRead`,
+ `allowRead`, `allowWrite`, `allowedDomains`, `deny`, `ask`) are
+ compared as sets so a re-order does not trip the lint, but every
+ addition or removal does. Any drift fails CI.
+2. **Hard invariants.** Independent of the baseline, the live
+ settings must satisfy the security boundaries the threat model
+ commits to:
+ - `sandbox.enabled` is `true`.
+ - `sandbox.filesystem.denyRead` contains `~/`.
+ - `sandbox.filesystem.allowRead` contains no credential or root
+ paths (`~/.aws`, `~/.ssh`, `~/.netrc`, `~/.docker`, `~/.kube`,
+ `~/.azure`, `~/.config/gcloud`, `/`, `~/`).
+ - `sandbox.filesystem.allowWrite` is a subset of `allowRead` and
+ contains no credential, config-root, or homedir-root path.
+ - `permissions.deny` contains the verbatim entries listed in
+ [`src/sandbox_lint/__init__.py`](src/sandbox_lint/__init__.py)
+ (`REQUIRED_PERMISSIONS_DENY`).
+3. **Baseline self-check.** The same invariants are applied to
+ `expected.json` itself, so a PR cannot weaken the baseline in
+ lockstep with the live settings without the lint catching the
+ underlying boundary violation.
+
+## How to use
+
+Run from the repository root:
+
+```sh
+uv run --directory tools/sandbox-lint --group dev sandbox-lint
+```
+
+Run with explicit paths (useful for tests):
+
+```sh
+uv run --directory tools/sandbox-lint --group dev sandbox-lint \
+ --settings .claude/settings.json \
+ --expected tools/sandbox-lint/expected.json
+```
+
+Exit code is `0` on a clean pass, `1` on any invariant violation or
+baseline drift.
+
+## CI wiring
+
+The lint runs in two places:
+
+- The
+ [`sandbox-lint`](../../.github/workflows/sandbox-lint.yml)
+ GitHub Actions workflow, on every PR that touches
+ `.claude/settings.json`, the baseline, or the lint code itself.
+- The repository's `prek` config
+ ([`.pre-commit-config.yaml`](../../.pre-commit-config.yaml)) runs
+ `pytest`, `ruff check`, `ruff format --check`, and `mypy` against
+ this project, so contributors hit the same checks locally.
+
+## Updating the baseline
+
+Any legitimate edit to `.claude/settings.json` must be paired with
+the same edit to `tools/sandbox-lint/expected.json` in the same PR.
+This is the explicit acknowledgement that mitigation M.29 requires:
+two files, two edits, one review surface. The lint refuses to pass
+if the two diverge.
+
+## Residual risk
+
+A maintainer running an agent locally can edit `.claude/settings.json`
+to weaken the sandbox without ever opening a PR. This lint catches
+the *shipped* configuration but not local overrides during a single
+agent run. The companion threat-model document records this under
+section *X3, Sandbox bypass via developer override* and *Residual
+risk #4*; consult that document once it lands on `main`.
diff --git a/tools/sandbox-lint/expected.json b/tools/sandbox-lint/expected.json
new file mode 100644
index 0000000..aa1e45b
--- /dev/null
+++ b/tools/sandbox-lint/expected.json
@@ -0,0 +1,100 @@
+{
+ "$schema": "https://json.schemastore.org/claude-code-settings.json",
+ "sandbox": {
+ "enabled": true,
+ "filesystem": {
+ "denyRead": ["~/"],
+ "allowRead": [
+ ".",
+ "~/.gitconfig",
+ "~/.config/git/",
+ "~/.config/gh/",
+ "~/.cache/",
+ "~/.local/share/uv/",
+ "~/.local/bin/",
+ "~/.config/apache-steward/",
+ "~/.gnupg/",
+ "/run/user/*/gnupg/"
+ ],
+ "allowWrite": [
+ "~/.cache/",
+ "~/.local/share/uv/"
+ ]
+ },
+ "network": {
+ "allowedDomains": [
+ "github.com",
+ "api.github.com",
+ "raw.githubusercontent.com",
+ "objects.githubusercontent.com",
+ "codeload.github.com",
+ "uploads.github.com",
+ "pypi.org",
+ "files.pythonhosted.org",
+ "lists.apache.org",
+ "cveprocess.apache.org",
+ "cve.org",
+ "www.cve.org",
+ "oauth2.googleapis.com",
+ "gmail.googleapis.com"
+ ]
+ }
+ },
+ "permissions": {
+ "deny": [
+ "Read(~/.aws/**)",
+ "Read(~/.ssh/**)",
+ "Read(~/.netrc)",
+ "Read(~/.docker/**)",
+ "Read(~/.kube/**)",
+ "Read(~/.config/gh/**)",
+ "Read(~/.config/apache-steward/**)",
+ "Read(~/.config/gcloud/**)",
+ "Read(~/.azure/**)",
+ "Read(//**/.env)",
+ "Read(//**/.env.local)",
+ "Read(//**/.env.*.local)",
+ "Bash(curl *)",
+ "Bash(wget *)",
+ "Bash(aws *)",
+ "Bash(gcloud *)",
+ "Bash(az *)",
+ "Bash(kubectl *)",
+ "Bash(docker login *)",
+ "Bash(npm publish *)",
+ "Bash(pip install --upgrade *)",
+ "Bash(uv self update *)",
+ "Bash(gh auth token*)",
+ "Bash(gh auth refresh*)"
+ ],
+ "ask": [
+ "Bash(git push *)",
+ "Bash(git push --force *)",
+ "Bash(git push --force-with-lease *)",
+ "Bash(gh pr create *)",
+ "Bash(gh pr edit *)",
+ "Bash(gh pr merge *)",
+ "Bash(gh issue create *)",
+ "Bash(gh issue edit *)",
+ "Bash(gh issue close *)",
+ "Bash(gh issue comment *)",
+ "Bash(gh release create *)",
+ "Bash(gh api * -X *)",
+ "Bash(gh api * -f *)",
+ "Bash(gh api * -F *)",
+ "Bash(gh gist *)",
+ "Bash(gh repo create *)",
+ "Bash(gh repo edit *)",
+ "Bash(gh repo delete *)",
+ "Bash(gh api * --method *)",
+ "Bash(gh api --method *)",
+ "Bash(gh api * --input *)",
+ "Bash(gh api --input *)",
+ "Bash(gh secret *)",
+ "Bash(gh ssh-key *)",
+ "Bash(gh release upload *)",
+ "Bash(gh release delete *)",
+ "Bash(gh workflow run *)"
+ ]
+ }
+}
diff --git a/tools/sandbox-lint/pyproject.toml b/tools/sandbox-lint/pyproject.toml
new file mode 100644
index 0000000..f1546c5
--- /dev/null
+++ b/tools/sandbox-lint/pyproject.toml
@@ -0,0 +1,88 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "sandbox-lint"
+version = "0.1.0"
+description = "Lint .claude/settings.json against the shipped baseline and the security invariants documented in docs/security/threat-model.md (mitigation M.29)."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "Apache-2.0" }
+# stdlib-only — JSON parsing and deep-diff are built into Python.
+dependencies = []
+
+[project.scripts]
+sandbox-lint = "sandbox_lint:main"
+
+[dependency-groups]
+dev = [
+ "mypy>=1.11",
+ "pytest>=8.0",
+ "ruff>=0.6",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/sandbox_lint"]
+
+[tool.ruff]
+line-length = 110
+target-version = "py311"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = [
+ "E",
+ "W",
+ "F",
+ "I",
+ "B",
+ "UP",
+ "SIM",
+ "C4",
+ "RUF",
+]
+ignore = [
+ "E501",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["B", "SIM"]
+
+[tool.mypy]
+python_version = "3.11"
+files = ["src", "tests"]
+warn_unused_ignores = true
+warn_redundant_casts = true
+warn_unreachable = true
+check_untyped_defs = true
+no_implicit_optional = true
+disallow_untyped_defs = true
+disallow_incomplete_defs = true
+
+[[tool.mypy.overrides]]
+module = "tests.*"
+disallow_untyped_defs = false
+disallow_incomplete_defs = false
+
+[tool.pytest.ini_options]
+minversion = "8.0"
+addopts = "-ra -q"
+testpaths = ["tests"]
diff --git a/tools/sandbox-lint/src/sandbox_lint/__init__.py b/tools/sandbox-lint/src/sandbox_lint/__init__.py
new file mode 100644
index 0000000..e613549
--- /dev/null
+++ b/tools/sandbox-lint/src/sandbox_lint/__init__.py
@@ -0,0 +1,329 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Lint the agent-host sandbox configuration.
+
+Implements mitigation M.29 from
+docs/security/threat-model.md: every change to .claude/settings.json
+must be acknowledged by an equivalent change to
+tools/sandbox-lint/expected.json (the shipped baseline), and the
+resulting configuration must satisfy the security invariants encoded
+below.
+
+The lint runs in CI on every PR that touches either file. Local edits
+made by a maintainer outside a PR cannot be prevented; that residual
+is documented in the threat model (residual #4, X3 - Sandbox bypass
+via developer override).
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+# ---------------------------------------------------------------------------
+# Defaults
+# ---------------------------------------------------------------------------
+
+DEFAULT_SETTINGS = Path(".claude/settings.json")
+DEFAULT_EXPECTED = Path("tools/sandbox-lint/expected.json")
+
+# ---------------------------------------------------------------------------
+# Security invariants
+# ---------------------------------------------------------------------------
+#
+# These are hard rules that must hold regardless of legitimate edits to
+# either file. They guard against the case where a future PR weakens
+# both the live settings AND the baseline simultaneously without a
+# threat-model review.
+
+# allowRead must not contain any path that resolves to a credential
+# store. Each entry is matched with normalised trailing-slash so that
+# "~/.aws" and "~/.aws/" both fail.
+FORBIDDEN_ALLOW_READ = {
+ "~/",
+ "/",
+ "~/.aws",
+ "~/.ssh",
+ "~/.netrc",
+ "~/.docker",
+ "~/.kube",
+ "~/.azure",
+ "~/.config/gcloud",
+}
+
+# allowWrite must be even more restrictive than allowRead. A path
+# escaping into any of these would let an agent overwrite credentials
+# or shell config.
+FORBIDDEN_ALLOW_WRITE = {
+ "~/",
+ "/",
+ "~/.config",
+ "~/.config/gh",
+ "~/.config/apache-steward",
+ "~/.gnupg",
+ "~/.ssh",
+ "~/.aws",
+ "~/.docker",
+ "~/.kube",
+}
+
+# permissions.deny must contain at least these entries verbatim. Each
+# corresponds to an exfiltration vector documented in the threat model.
+REQUIRED_PERMISSIONS_DENY = {
+ "Read(~/.aws/**)",
+ "Read(~/.ssh/**)",
+ "Read(~/.netrc)",
+ "Read(~/.docker/**)",
+ "Read(~/.kube/**)",
+ "Read(~/.config/gh/**)",
+ "Read(~/.config/apache-steward/**)",
+ "Read(~/.config/gcloud/**)",
+ "Read(~/.azure/**)",
+ "Read(//**/.env)",
+ "Read(//**/.env.local)",
+ "Read(//**/.env.*.local)",
+ "Bash(curl *)",
+ "Bash(wget *)",
+ "Bash(aws *)",
+ "Bash(gcloud *)",
+ "Bash(az *)",
+ "Bash(kubectl *)",
+}
+
+# denyRead must contain ~/ as a base deny. Without it, allowRead would
+# operate over the full filesystem instead of being an inclusion list
+# carved out of a denied home directory.
+REQUIRED_DENY_READ = {"~/"}
+
+
+# ---------------------------------------------------------------------------
+# Path normalisation
+# ---------------------------------------------------------------------------
+
+
+def _normalise(path: str) -> str:
+ """Strip a single trailing slash so '~/.aws' and '~/.aws/' compare equal.
+
+ The sandbox treats both forms as the same directory; the validator
+ must too, otherwise the forbidden-list could be bypassed by a
+ trailing-slash variant.
+ """
+ if path.endswith("/") and len(path) > 1:
+ return path[:-1]
+ return path
+
+
+def _normalised_set(paths: list[str]) -> set[str]:
+ return {_normalise(p) for p in paths}
+
+
+# ---------------------------------------------------------------------------
+# Deep diff — set semantics on known list-typed keys, equality elsewhere
+# ---------------------------------------------------------------------------
+
+# Keys whose values are lists treated as sets (order/duplicates do not
+# matter for security semantics).
+SET_LIST_KEYS = {
+ "denyRead",
+ "allowRead",
+ "allowWrite",
+ "allowedDomains",
+ "deny",
+ "ask",
+}
+
+
+def deep_diff(actual: Any, expected: Any, path: str = "$") -> list[str]:
+ """Return human-readable diff lines; empty list means the two trees match."""
+ diffs: list[str] = []
+ if type(actual) is not type(expected):
+ return [
+ f"{path}: type mismatch "
+ f"(settings has {type(actual).__name__}, expected has {type(expected).__name__})"
+ ]
+ if isinstance(actual, dict):
+ assert isinstance(expected, dict)
+ keys = sorted(set(actual) | set(expected))
+ for k in keys:
+ if k not in actual:
+ diffs.append(f"{path}.{k}: missing in settings (present in expected)")
+ elif k not in expected:
+ diffs.append(f"{path}.{k}: extra in settings (not in expected)")
+ else:
+ diffs.extend(deep_diff(actual[k], expected[k], f"{path}.{k}"))
+ elif isinstance(actual, list):
+ assert isinstance(expected, list)
+ leaf = path.rsplit(".", 1)[-1]
+ if leaf in SET_LIST_KEYS:
+ sa, se = set(actual), set(expected)
+ for x in sorted(sa - se):
+ diffs.append(f"{path}: extra entry in settings: {x!r}")
+ for x in sorted(se - sa):
+ diffs.append(f"{path}: missing entry in settings: {x!r}")
+ elif actual != expected:
+ diffs.append(f"{path}: list mismatch (settings={actual!r}, expected={expected!r})")
+ elif actual != expected:
+ diffs.append(f"{path}: settings={actual!r} expected={expected!r}")
+ return diffs
+
+
+# ---------------------------------------------------------------------------
+# Invariant checks
+# ---------------------------------------------------------------------------
+
+
+def check_invariants(settings: dict[str, Any]) -> list[str]:
+ """Return list of invariant violations; empty list means OK."""
+ errors: list[str] = []
+
+ sandbox = settings.get("sandbox")
+ if not isinstance(sandbox, dict):
+ return ["sandbox: missing or not an object"]
+
+ if sandbox.get("enabled") is not True:
+ errors.append("sandbox.enabled: must be true")
+
+ fs = sandbox.get("filesystem")
+ if not isinstance(fs, dict):
+ errors.append("sandbox.filesystem: missing or not an object")
+ else:
+ deny_read = _normalised_set(fs.get("denyRead", []) or [])
+ for required in REQUIRED_DENY_READ:
+ if _normalise(required) not in deny_read:
+ errors.append(
+ f"sandbox.filesystem.denyRead: must contain {required!r} "
+ "(otherwise allowRead expands across the full filesystem)"
+ )
+
+ allow_read = _normalised_set(fs.get("allowRead", []) or [])
+ for forbidden in FORBIDDEN_ALLOW_READ:
+ if _normalise(forbidden) in allow_read:
+ errors.append(
+ f"sandbox.filesystem.allowRead: must not contain {forbidden!r} (credential/root path)"
+ )
+
+ allow_write = _normalised_set(fs.get("allowWrite", []) or [])
+ for forbidden in FORBIDDEN_ALLOW_WRITE:
+ if _normalise(forbidden) in allow_write:
+ errors.append(
+ f"sandbox.filesystem.allowWrite: must not contain {forbidden!r} "
+ "(would permit credential overwrite)"
+ )
+ for entry in allow_write - allow_read:
+ errors.append(
+ f"sandbox.filesystem.allowWrite: contains {entry!r} which is not in allowRead "
+ "(allowWrite must be a subset of allowRead)"
+ )
+
+ perms = settings.get("permissions")
+ if not isinstance(perms, dict):
+ errors.append("permissions: missing or not an object")
+ else:
+ deny = set(perms.get("deny", []) or [])
+ for required in REQUIRED_PERMISSIONS_DENY:
+ if required not in deny:
+ errors.append(f"permissions.deny: must contain {required!r}")
+
+ return errors
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+
+
+def _load_json(p: Path) -> dict[str, Any]:
+ try:
+ with p.open(encoding="utf-8") as f:
+ data = json.load(f)
+ except FileNotFoundError:
+ raise SystemExit(f"sandbox-lint: file not found: {p}") from None
+ except json.JSONDecodeError as e:
+ raise SystemExit(f"sandbox-lint: invalid JSON in {p}: {e}") from None
+ if not isinstance(data, dict):
+ raise SystemExit(f"sandbox-lint: top-level value in {p} is not an object")
+ return data
+
+
+def main(argv: list[str] | None = None) -> int:
+ parser = argparse.ArgumentParser(
+ prog="sandbox-lint",
+ description=(
+ "Lint .claude/settings.json against the shipped baseline and the "
+ "security invariants from docs/security/threat-model.md (M.29)."
+ ),
+ )
+ parser.add_argument(
+ "--settings",
+ type=Path,
+ default=DEFAULT_SETTINGS,
+ help=f"Path to the live settings file (default: {DEFAULT_SETTINGS})",
+ )
+ parser.add_argument(
+ "--expected",
+ type=Path,
+ default=DEFAULT_EXPECTED,
+ help=f"Path to the canonical baseline (default: {DEFAULT_EXPECTED})",
+ )
+ args = parser.parse_args(argv)
+
+ settings = _load_json(args.settings)
+ expected = _load_json(args.expected)
+
+ invariant_errors = check_invariants(settings)
+ diff_errors = deep_diff(settings, expected)
+ # Run invariants on the baseline too: if a future PR weakens both
+ # files in lockstep, the baseline must still pass on its own.
+ baseline_invariant_errors = check_invariants(expected)
+
+ if not invariant_errors and not diff_errors and not baseline_invariant_errors:
+ print(f"sandbox-lint: OK ({args.settings} matches {args.expected})")
+ return 0
+
+ if invariant_errors:
+ print(f"sandbox-lint: invariant violations in {args.settings}:", file=sys.stderr)
+ for e in invariant_errors:
+ print(f" - {e}", file=sys.stderr)
+
+ if baseline_invariant_errors:
+ print(
+ f"sandbox-lint: invariant violations in {args.expected} "
+ "(the baseline itself is unsafe — fix the baseline before merging):",
+ file=sys.stderr,
+ )
+ for e in baseline_invariant_errors:
+ print(f" - {e}", file=sys.stderr)
+
+ if diff_errors:
+ print(
+ f"sandbox-lint: {args.settings} differs from {args.expected}. "
+ "Every change to the live sandbox must be mirrored in the baseline "
+ "(see docs/security/threat-model.md mitigation M.29):",
+ file=sys.stderr,
+ )
+ for e in diff_errors:
+ print(f" - {e}", file=sys.stderr)
+
+ return 1
+
+
+if __name__ == "__main__":
+ raise SystemExit(main())
diff --git a/tools/sandbox-lint/tests/test_validator.py b/tools/sandbox-lint/tests/test_validator.py
new file mode 100644
index 0000000..3c6d1d9
--- /dev/null
+++ b/tools/sandbox-lint/tests/test_validator.py
@@ -0,0 +1,238 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from __future__ import annotations
+
+import copy
+import json
+from pathlib import Path
+from typing import Any
+
+import pytest
+
+from sandbox_lint import (
+ check_invariants,
+ deep_diff,
+ main,
+)
+
+REPO_ROOT = Path(__file__).resolve().parents[3]
+LIVE_SETTINGS = REPO_ROOT / ".claude" / "settings.json"
+BASELINE = REPO_ROOT / "tools" / "sandbox-lint" / "expected.json"
+
+
+def _load(p: Path) -> dict[str, Any]:
+ return json.loads(p.read_text())
+
+
+@pytest.fixture
+def baseline() -> dict[str, Any]:
+ return _load(BASELINE)
+
+
+@pytest.fixture
+def live_settings() -> dict[str, Any]:
+ return _load(LIVE_SETTINGS)
+
+
+# ---------------------------------------------------------------------------
+# End-to-end: shipped baseline matches live settings and passes invariants
+# ---------------------------------------------------------------------------
+
+
+def test_baseline_file_matches_live_settings(baseline: dict[str, Any], live_settings: dict[str, Any]) -> None:
+ diffs = deep_diff(live_settings, baseline)
+ assert diffs == [], "live settings drifted from baseline:\n" + "\n".join(diffs)
+
+
+def test_baseline_satisfies_invariants(baseline: dict[str, Any]) -> None:
+ errors = check_invariants(baseline)
+ assert errors == [], "baseline violates invariants:\n" + "\n".join(errors)
+
+
+def test_live_settings_satisfy_invariants(live_settings: dict[str, Any]) -> None:
+ errors = check_invariants(live_settings)
+ assert errors == [], "live settings violate invariants:\n" + "\n".join(errors)
+
+
+def test_main_exits_zero_on_repo(monkeypatch: pytest.MonkeyPatch) -> None:
+ monkeypatch.chdir(REPO_ROOT)
+ assert main([]) == 0
+
+
+# ---------------------------------------------------------------------------
+# Diff: order/duplicates ignored on set-typed lists
+# ---------------------------------------------------------------------------
+
+
+def test_diff_set_lists_order_insensitive(baseline: dict[str, Any]) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["sandbox"]["network"]["allowedDomains"] = list(
+ reversed(settings["sandbox"]["network"]["allowedDomains"])
+ )
+ assert deep_diff(settings, baseline) == []
+
+
+def test_diff_detects_added_allowed_domain(baseline: dict[str, Any]) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["sandbox"]["network"]["allowedDomains"].append("sandbox-lint-test-extra-marker")
+ diffs = deep_diff(settings, baseline)
+ assert any("sandbox-lint-test-extra-marker" in d for d in diffs)
+
+
+def test_diff_detects_removed_deny_entry(baseline: dict[str, Any]) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["permissions"]["deny"].remove("Bash(curl *)")
+ diffs = deep_diff(settings, baseline)
+ assert any("Bash(curl *)" in d and "missing entry" in d for d in diffs)
+
+
+def test_diff_detects_scalar_change(baseline: dict[str, Any]) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["sandbox"]["enabled"] = False
+ diffs = deep_diff(settings, baseline)
+ assert any("sandbox.enabled" in d for d in diffs)
+
+
+# ---------------------------------------------------------------------------
+# Invariants: each forbidden / required check fires
+# ---------------------------------------------------------------------------
+
+
+def test_invariant_sandbox_disabled(baseline: dict[str, Any]) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["sandbox"]["enabled"] = False
+ errors = check_invariants(settings)
+ assert any("sandbox.enabled" in e for e in errors)
+
+
+def test_invariant_missing_deny_read_root(baseline: dict[str, Any]) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["sandbox"]["filesystem"]["denyRead"] = []
+ errors = check_invariants(settings)
+ assert any("denyRead" in e for e in errors)
+
+
+@pytest.mark.parametrize(
+ "forbidden",
+ [
+ "~/.aws",
+ "~/.aws/",
+ "~/.ssh",
+ "~/.netrc",
+ "~/.docker/",
+ "~/.kube",
+ "~/.azure",
+ "~/.config/gcloud",
+ "/",
+ "~/",
+ ],
+)
+def test_invariant_allow_read_rejects_credential_paths(baseline: dict[str, Any], forbidden: str) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["sandbox"]["filesystem"]["allowRead"].append(forbidden)
+ errors = check_invariants(settings)
+ assert any("allowRead" in e and forbidden.rstrip("/") in e for e in errors)
+
+
+@pytest.mark.parametrize(
+ "forbidden",
+ [
+ "~/",
+ "~/.config/",
+ "~/.config/gh",
+ "~/.gnupg",
+ "~/.ssh",
+ "~/.aws/",
+ ],
+)
+def test_invariant_allow_write_rejects_credential_paths(baseline: dict[str, Any], forbidden: str) -> None:
+ settings = copy.deepcopy(baseline)
+ fs = settings["sandbox"]["filesystem"]
+ if forbidden not in fs["allowRead"]:
+ fs["allowRead"].append(forbidden)
+ fs["allowWrite"].append(forbidden)
+ errors = check_invariants(settings)
+ assert any("allowWrite" in e and forbidden.rstrip("/") in e for e in errors)
+
+
+def test_invariant_allow_write_must_be_subset_of_allow_read(
+ baseline: dict[str, Any],
+) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["sandbox"]["filesystem"]["allowWrite"].append("~/.local/share/uv-extra/")
+ errors = check_invariants(settings)
+ assert any("subset" in e for e in errors)
+
+
+@pytest.mark.parametrize(
+ "required",
+ [
+ "Read(~/.aws/**)",
+ "Read(~/.ssh/**)",
+ "Read(~/.netrc)",
+ "Bash(curl *)",
+ "Bash(wget *)",
+ "Bash(aws *)",
+ ],
+)
+def test_invariant_required_deny_entries(baseline: dict[str, Any], required: str) -> None:
+ settings = copy.deepcopy(baseline)
+ settings["permissions"]["deny"].remove(required)
+ errors = check_invariants(settings)
+ assert any(required in e for e in errors)
+
+
+# ---------------------------------------------------------------------------
+# CLI: non-zero exit on drift; non-zero on invariant violation
+# ---------------------------------------------------------------------------
+
+
+def _write_json(p: Path, data: dict[str, Any]) -> None:
+ p.parent.mkdir(parents=True, exist_ok=True)
+ p.write_text(json.dumps(data, indent=2))
+
+
+def test_cli_fails_on_drift(tmp_path: Path, baseline: dict[str, Any]) -> None:
+ settings_path = tmp_path / "settings.json"
+ expected_path = tmp_path / "expected.json"
+ drifted = copy.deepcopy(baseline)
+ drifted["sandbox"]["network"]["allowedDomains"].append("sandbox-lint-test-extra-marker")
+ _write_json(settings_path, drifted)
+ _write_json(expected_path, baseline)
+ rc = main(["--settings", str(settings_path), "--expected", str(expected_path)])
+ assert rc == 1
+
+
+def test_cli_fails_on_invariant_violation(tmp_path: Path, baseline: dict[str, Any]) -> None:
+ settings_path = tmp_path / "settings.json"
+ expected_path = tmp_path / "expected.json"
+ bad = copy.deepcopy(baseline)
+ bad["sandbox"]["filesystem"]["allowRead"].append("~/.aws")
+ _write_json(settings_path, bad)
+ _write_json(expected_path, bad)
+ rc = main(["--settings", str(settings_path), "--expected", str(expected_path)])
+ assert rc == 1
+
+
+def test_cli_passes_on_match(tmp_path: Path, baseline: dict[str, Any]) -> None:
+ settings_path = tmp_path / "settings.json"
+ expected_path = tmp_path / "expected.json"
+ _write_json(settings_path, baseline)
+ _write_json(expected_path, baseline)
+ rc = main(["--settings", str(settings_path), "--expected", str(expected_path)])
+ assert rc == 0
diff --git a/tools/sandbox-lint/uv.lock b/tools/sandbox-lint/uv.lock
new file mode 100644
index 0000000..d799f16
--- /dev/null
+++ b/tools/sandbox-lint/uv.lock
@@ -0,0 +1,268 @@
+version = 1
+revision = 3
+requires-python = ">=3.11"
+resolution-markers = [
+ "python_full_version >= '3.15'",
+ "python_full_version < '3.15'",
+]
+
+[options]
+exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
+exclude-newer-span = "P7D"
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
+]
+
+[[package]]
+name = "librt"
+version = "0.9.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/eb/6b/3d5c13fb3e3c4f43206c8f9dfed13778c2ed4f000bacaa0b7ce3c402a265/librt-0.9.0.tar.gz", hash = "sha256:a0951822531e7aee6e0dfb556b30d5ee36bbe234faf60c20a16c01be3530869d", size = 184368, upload-time = "2026-04-09T16:06:26.173Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/e2/1e/2ec7afcebcf3efea593d13aee18bbcfdd3a243043d848ebf385055e9f636/librt-0.9.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:90904fac73c478f4b83f4ed96c99c8208b75e6f9a8a1910548f69a00f1eaa671", size = 67155, upload-time = "2026-04-09T16:04:42.933Z" },
+ { url = "https://files.pythonhosted.org/packages/18/77/72b85afd4435268338ad4ec6231b3da8c77363f212a0227c1ff3b45e4d35/librt-0.9.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:789fff71757facc0738e8d89e3b84e4f0251c1c975e85e81b152cdaca927cc2d", size = 69916, upload-time = "2026-04-09T16:04:44.042Z" },
+ { url = "https://files.pythonhosted.org/packages/27/fb/948ea0204fbe2e78add6d46b48330e58d39897e425560674aee302dca81c/librt-0.9.0-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:1bf465d1e5b0a27713862441f6467b5ab76385f4ecf8f1f3a44f8aa3c695b4b6", size = 199635, upload-time = "2026-04-09T16:04:45.5Z" },
+ { url = "https://files.pythonhosted.org/packages/ac/cd/894a29e251b296a27957856804cfd21e93c194aa131de8bb8032021be07e/librt-0.9.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f819e0c6413e259a17a7c0d49f97f405abadd3c2a316a3b46c6440b7dbbedbb1", size = 211051, upload-time = "2026-04-09T16:04:47.016Z" },
+ { url = "https://files.pythonhosted.org/packages/18/8f/dcaed0bc084a35f3721ff2d081158db569d2c57ea07d35623ddaca5cfc8e/librt-0.9.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e0785c2fb4a81e1aece366aa3e2e039f4a4d7d21aaaded5227d7f3c703427882", size = 224031, upload-time = "2026-04-09T16:04:48.207Z" },
+ { url = "https://files.pythonhosted.org/packages/03/44/88f6c1ed1132cd418601cc041fbd92fed28b3a09f39de81978e0822d13ff/librt-0.9.0-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:80b25c7b570a86c03b5da69e665809deb39265476e8e21d96a9328f9762f9990", size = 218069, upload-time = "2026-04-09T16:04:50.025Z" },
+ { url = "https://files.pythonhosted.org/packages/a3/90/7d02e981c2db12188d82b4410ff3e35bfdb844b26aecd02233626f46af2b/librt-0.9.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:d4d16b608a1c43d7e33142099a75cd93af482dadce0bf82421e91cad077157f4", size = 224857, upload-time = "2026-04-09T16:04:51.684Z" },
+ { url = "https://files.pythonhosted.org/packages/ef/c3/c77e706b7215ca32e928d47535cf13dbc3d25f096f84ddf8fbc06693e229/librt-0.9.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:194fc1a32e1e21fe809d38b5faea66cc65eaa00217c8901fbdb99866938adbdb", size = 219865, upload-time = "2026-04-09T16:04:52.949Z" },
+ { url = "https://files.pythonhosted.org/packages/52/d1/32b0c1a0eb8461c70c11656c46a29f760b7c7edf3c36d6f102470c17170f/librt-0.9.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:8c6bc1384d9738781cfd41d09ad7f6e8af13cfea2c75ece6bd6d2566cdea2076", size = 218451, upload-time = "2026-04-09T16:04:54.174Z" },
+ { url = "https://files.pythonhosted.org/packages/74/d1/adfd0f9c44761b1d49b1bec66173389834c33ee2bd3c7fd2e2367f1942d4/librt-0.9.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:15cb151e52a044f06e54ac7f7b47adbfc89b5c8e2b63e1175a9d587c43e8942a", size = 241300, upload-time = "2026-04-09T16:04:55.452Z" },
+ { url = "https://files.pythonhosted.org/packages/09/b0/9074b64407712f0003c27f5b1d7655d1438979155f049720e8a1abd9b1a1/librt-0.9.0-cp311-cp311-win32.whl", hash = "sha256:f100bfe2acf8a3689af9d0cc660d89f17286c9c795f9f18f7b62dd1a6b247ae6", size = 55668, upload-time = "2026-04-09T16:04:56.689Z" },
+ { url = "https://files.pythonhosted.org/packages/24/19/40b77b77ce80b9389fb03971431b09b6b913911c38d412059e0b3e2a9ef2/librt-0.9.0-cp311-cp311-win_amd64.whl", hash = "sha256:0b73e4266307e51c95e09c0750b7ec383c561d2e97d58e473f6f6a209952fbb8", size = 62976, upload-time = "2026-04-09T16:04:57.733Z" },
+ { url = "https://files.pythonhosted.org/packages/70/9d/9fa7a64041e29035cb8c575af5f0e3840be1b97b4c4d9061e0713f171849/librt-0.9.0-cp311-cp311-win_arm64.whl", hash = "sha256:bc5518873822d2faa8ebdd2c1a4d7c8ef47b01a058495ab7924cb65bdbf5fc9a", size = 53502, upload-time = "2026-04-09T16:04:58.806Z" },
+ { url = "https://files.pythonhosted.org/packages/bf/90/89ddba8e1c20b0922783cd93ed8e64f34dc05ab59c38a9c7e313632e20ff/librt-0.9.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:9b3e3bc363f71bda1639a4ee593cb78f7fbfeacc73411ec0d4c92f00730010a4", size = 68332, upload-time = "2026-04-09T16:05:00.09Z" },
+ { url = "https://files.pythonhosted.org/packages/a8/40/7aa4da1fb08bdeeb540cb07bfc8207cb32c5c41642f2594dbd0098a0662d/librt-0.9.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:0a09c2f5869649101738653a9b7ab70cf045a1105ac66cbb8f4055e61df78f2d", size = 70581, upload-time = "2026-04-09T16:05:01.213Z" },
+ { url = "https://files.pythonhosted.org/packages/48/ac/73a2187e1031041e93b7e3a25aae37aa6f13b838c550f7e0f06f66766212/librt-0.9.0-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:5ca8e133d799c948db2ab1afc081c333a825b5540475164726dcbf73537e5c2f", size = 203984, upload-time = "2026-04-09T16:05:02.542Z" },
+ { url = "https://files.pythonhosted.org/packages/5e/3d/23460d571e9cbddb405b017681df04c142fb1b04cbfce77c54b08e28b108/librt-0.9.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:603138ee838ee1583f1b960b62d5d0007845c5c423feb68e44648b1359014e27", size = 215762, upload-time = "2026-04-09T16:05:04.127Z" },
+ { url = "https://files.pythonhosted.org/packages/de/1e/42dc7f8ab63e65b20640d058e63e97fd3e482c1edbda3570d813b4d0b927/librt-0.9.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f4003f70c56a5addd6aa0897f200dd59afd3bf7bcd5b3cce46dd21f925743bc2", size = 230288, upload-time = "2026-04-09T16:05:05.883Z" },
+ { url = "https://files.pythonhosted.org/packages/dc/08/ca812b6d8259ad9ece703397f8ad5c03af5b5fedfce64279693d3ce4087c/librt-0.9.0-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:78042f6facfd98ecb25e9829c7e37cce23363d9d7c83bc5f72702c5059eb082b", size = 224103, upload-time = "2026-04-09T16:05:07.148Z" },
+ { url = "https://files.pythonhosted.org/packages/b6/3f/620490fb2fa66ffd44e7f900254bc110ebec8dac6c1b7514d64662570e6f/librt-0.9.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:a361c9434a64d70a7dbb771d1de302c0cc9f13c0bffe1cf7e642152814b35265", size = 232122, upload-time = "2026-04-09T16:05:08.386Z" },
+ { url = "https://files.pythonhosted.org/packages/e9/83/12864700a1b6a8be458cf5d05db209b0d8e94ae281e7ec261dbe616597b4/librt-0.9.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:dd2c7e082b0b92e1baa4da28163a808672485617bc855cc22a2fd06978fa9084", size = 225045, upload-time = "2026-04-09T16:05:09.707Z" },
+ { url = "https://files.pythonhosted.org/packages/fd/1b/845d339c29dc7dbc87a2e992a1ba8d28d25d0e0372f9a0a2ecebde298186/librt-0.9.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:7e6274fd33fc5b2a14d41c9119629d3ff395849d8bcbc80cf637d9e8d2034da8", size = 227372, upload-time = "2026-04-09T16:05:10.942Z" },
+ { url = "https://files.pythonhosted.org/packages/8d/fe/277985610269d926a64c606f761d58d3db67b956dbbf40024921e95e7fcb/librt-0.9.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5093043afb226ecfa1400120d1ebd4442b4f99977783e4f4f7248879009b227f", size = 248224, upload-time = "2026-04-09T16:05:12.254Z" },
+ { url = "https://files.pythonhosted.org/packages/92/1b/ee486d244b8de6b8b5dbaefabe6bfdd4a72e08f6353edf7d16d27114da8d/librt-0.9.0-cp312-cp312-win32.whl", hash = "sha256:9edcc35d1cae9fd5320171b1a838c7da8a5c968af31e82ecc3dff30b4be0957f", size = 55986, upload-time = "2026-04-09T16:05:13.529Z" },
+ { url = "https://files.pythonhosted.org/packages/89/7a/ba1737012308c17dc6d5516143b5dce9a2c7ba3474afd54e11f44a4d1ef3/librt-0.9.0-cp312-cp312-win_amd64.whl", hash = "sha256:3cc2917258e131ae5f958a4d872e07555b51cb7466a43433218061c74ef33745", size = 63260, upload-time = "2026-04-09T16:05:14.68Z" },
+ { url = "https://files.pythonhosted.org/packages/36/e4/01752c113da15127f18f7bf11142f5640038f062407a611c059d0036c6aa/librt-0.9.0-cp312-cp312-win_arm64.whl", hash = "sha256:90e6d5420fc8a300518d4d2288154ff45005e920425c22cbbfe8330f3f754bd9", size = 53694, upload-time = "2026-04-09T16:05:16.095Z" },
+ { url = "https://files.pythonhosted.org/packages/5f/d7/1b3e26fffde1452d82f5666164858a81c26ebe808e7ae8c9c88628981540/librt-0.9.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f29b68cd9714531672db62cc54f6e8ff981900f824d13fa0e00749189e13778e", size = 68367, upload-time = "2026-04-09T16:05:17.243Z" },
+ { url = "https://files.pythonhosted.org/packages/a5/5b/c61b043ad2e091fbe1f2d35d14795e545d0b56b03edaa390fa1dcee3d160/librt-0.9.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:7d5c8a5929ac325729f6119802070b561f4db793dffc45e9ac750992a4ed4d22", size = 70595, upload-time = "2026-04-09T16:05:18.471Z" },
+ { url = "https://files.pythonhosted.org/packages/a3/22/2448471196d8a73370aa2f23445455dc42712c21404081fcd7a03b9e0749/librt-0.9.0-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:756775d25ec8345b837ab52effee3ad2f3b2dfd6bbee3e3f029c517bd5d8f05a", size = 204354, upload-time = "2026-04-09T16:05:19.593Z" },
+ { url = "https://files.pythonhosted.org/packages/ac/5e/39fc4b153c78cfd2c8a2dcb32700f2d41d2312aa1050513183be4540930d/librt-0.9.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2b8f5d00b49818f4e2b1667db994488b045835e0ac16fe2f924f3871bd2b8ac5", size = 216238, upload-time = "2026-04-09T16:05:20.868Z" },
+ { url = "https://files.pythonhosted.org/packages/d7/42/bc2d02d0fa7badfa63aa8d6dcd8793a9f7ef5a94396801684a51ed8d8287/librt-0.9.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c81aef782380f0f13ead670aae01825eb653b44b046aa0e5ebbb79f76ed4aa11", size = 230589, upload-time = "2026-04-09T16:05:22.305Z" },
+ { url = "https://files.pythonhosted.org/packages/c8/7b/e2d95cc513866373692aa5edf98080d5602dd07cabfb9e5d2f70df2f25f7/librt-0.9.0-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:66b58fed90a545328e80d575467244de3741e088c1af928f0b489ebec3ef3858", size = 224610, upload-time = "2026-04-09T16:05:23.647Z" },
+ { url = "https://files.pythonhosted.org/packages/31/d5/6cec4607e998eaba57564d06a1295c21b0a0c8de76e4e74d699e627bd98c/librt-0.9.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:e78fb7419e07d98c2af4b8567b72b3eaf8cb05caad642e9963465569c8b2d87e", size = 232558, upload-time = "2026-04-09T16:05:25.025Z" },
+ { url = "https://files.pythonhosted.org/packages/95/8c/27f1d8d3aaf079d3eb26439bf0b32f1482340c3552e324f7db9dca858671/librt-0.9.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:2c3786f0f4490a5cd87f1ed6cefae833ad6b1060d52044ce0434a2e85893afd0", size = 225521, upload-time = "2026-04-09T16:05:26.311Z" },
+ { url = "https://files.pythonhosted.org/packages/6b/d8/1e0d43b1c329b416017619469b3c3801a25a6a4ef4a1c68332aeaa6f72ca/librt-0.9.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:8494cfc61e03542f2d381e71804990b3931175a29b9278fdb4a5459948778dc2", size = 227789, upload-time = "2026-04-09T16:05:27.624Z" },
+ { url = "https://files.pythonhosted.org/packages/2c/b4/d3d842e88610fcd4c8eec7067b0c23ef2d7d3bff31496eded6a83b0f99be/librt-0.9.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:07cf11f769831186eeac424376e6189f20ace4f7263e2134bdb9757340d84d4d", size = 248616, upload-time = "2026-04-09T16:05:29.181Z" },
+ { url = "https://files.pythonhosted.org/packages/ec/28/527df8ad0d1eb6c8bdfa82fc190f1f7c4cca5a1b6d7b36aeabf95b52d74d/librt-0.9.0-cp313-cp313-win32.whl", hash = "sha256:850d6d03177e52700af605fd60db7f37dcb89782049a149674d1a9649c2138fd", size = 56039, upload-time = "2026-04-09T16:05:30.709Z" },
+ { url = "https://files.pythonhosted.org/packages/f3/a7/413652ad0d92273ee5e30c000fc494b361171177c83e57c060ecd3c21538/librt-0.9.0-cp313-cp313-win_amd64.whl", hash = "sha256:a5af136bfba820d592f86c67affcef9b3ff4d4360ac3255e341e964489b48519", size = 63264, upload-time = "2026-04-09T16:05:31.881Z" },
+ { url = "https://files.pythonhosted.org/packages/a4/0a/92c244309b774e290ddb15e93363846ae7aa753d9586b8aad511c5e6145b/librt-0.9.0-cp313-cp313-win_arm64.whl", hash = "sha256:4c4d0440a3a8e31d962340c3e1cc3fc9ee7febd34c8d8f770d06adb947779ea5", size = 53728, upload-time = "2026-04-09T16:05:33.31Z" },
+ { url = "https://files.pythonhosted.org/packages/cd/c1/184e539543f06ea2912f4b92a5ffaede4f9b392689e3f00acbf8134bee92/librt-0.9.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:3f05d145df35dca5056a8bc3838e940efebd893a54b3e19b2dda39ceaa299bcb", size = 67830, upload-time = "2026-04-09T16:05:34.517Z" },
+ { url = "https://files.pythonhosted.org/packages/f3/ad/23399bdcb7afca819acacdef31b37ee59de261bd66b503a7995c03c4b0dc/librt-0.9.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:1c587494461ebd42229d0f1739f3aa34237dd9980623ecf1be8d3bcba79f4499", size = 70280, upload-time = "2026-04-09T16:05:35.649Z" },
+ { url = "https://files.pythonhosted.org/packages/9f/0b/4542dc5a2b8772dbf92cafb9194701230157e73c14b017b6961a23598b03/librt-0.9.0-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:b0a2040f801406b93657a70b72fa12311063a319fee72ce98e1524da7200171f", size = 201925, upload-time = "2026-04-09T16:05:36.739Z" },
+ { url = "https://files.pythonhosted.org/packages/31/d4/8ee7358b08fd0cfce051ef96695380f09b3c2c11b77c9bfbc367c921cce5/librt-0.9.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f38bc489037eca88d6ebefc9c4d41a4e07c8e8b4de5188a9e6d290273ad7ebb1", size = 212381, upload-time = "2026-04-09T16:05:38.043Z" },
+ { url = "https://files.pythonhosted.org/packages/f2/94/a2025fe442abedf8b038038dab3dba942009ad42b38ea064a1a9e6094241/librt-0.9.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f3fd278f5e6bf7c75ccd6d12344eb686cc020712683363b66f46ac79d37c799f", size = 227065, upload-time = "2026-04-09T16:05:39.394Z" },
+ { url = "https://files.pythonhosted.org/packages/7c/e9/b9fcf6afa909f957cfbbf918802f9dada1bd5d3c1da43d722fd6a310dc3f/librt-0.9.0-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fcbdf2a9ca24e87bbebb47f1fe34e531ef06f104f98c9ccfc953a3f3344c567a", size = 221333, upload-time = "2026-04-09T16:05:40.999Z" },
+ { url = "https://files.pythonhosted.org/packages/ac/7c/ba54cd6aa6a3c8cd12757a6870e0c79a64b1e6327f5248dcff98423f4d43/librt-0.9.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e306d956cfa027fe041585f02a1602c32bfa6bb8ebea4899d373383295a6c62f", size = 229051, upload-time = "2026-04-09T16:05:42.605Z" },
+ { url = "https://files.pythonhosted.org/packages/4b/4b/8cfdbad314c8677a0148bf0b70591d6d18587f9884d930276098a235461b/librt-0.9.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:465814ab157986acb9dfa5ccd7df944be5eefc0d08d31ec6e8d88bc71251d845", size = 222492, upload-time = "2026-04-09T16:05:43.842Z" },
+ { url = "https://files.pythonhosted.org/packages/1f/d1/2eda69563a1a88706808decdce035e4b32755dbfbb0d05e1a65db9547ed1/librt-0.9.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:703f4ae36d6240bfe24f542bac784c7e4194ec49c3ba5a994d02891649e2d85b", size = 223849, upload-time = "2026-04-09T16:05:45.054Z" },
+ { url = "https://files.pythonhosted.org/packages/04/44/b2ed37df6be5b3d42cfe36318e0598e80843d5c6308dd63d0bf4e0ce5028/librt-0.9.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:3be322a15ee5e70b93b7a59cfd074614f22cc8c9ff18bd27f474e79137ea8d3b", size = 245001, upload-time = "2026-04-09T16:05:46.34Z" },
+ { url = "https://files.pythonhosted.org/packages/47/e7/617e412426df89169dd2a9ed0cc8752d5763336252c65dbf945199915119/librt-0.9.0-cp314-cp314-win32.whl", hash = "sha256:b8da9f8035bb417770b1e1610526d87ad4fc58a2804dc4d79c53f6d2cf5a6eb9", size = 51799, upload-time = "2026-04-09T16:05:47.738Z" },
+ { url = "https://files.pythonhosted.org/packages/24/ed/c22ca4db0ca3cbc285e4d9206108746beda561a9792289c3c31281d7e9df/librt-0.9.0-cp314-cp314-win_amd64.whl", hash = "sha256:b8bd70d5d816566a580d193326912f4a76ec2d28a97dc4cd4cc831c0af8e330e", size = 59165, upload-time = "2026-04-09T16:05:49.198Z" },
+ { url = "https://files.pythonhosted.org/packages/24/56/875398fafa4cbc8f15b89366fc3287304ddd3314d861f182a4b87595ace0/librt-0.9.0-cp314-cp314-win_arm64.whl", hash = "sha256:fc5758e2b7a56532dc33e3c544d78cbaa9ecf0a0f2a2da2df882c1d6b99a317f", size = 49292, upload-time = "2026-04-09T16:05:50.362Z" },
+ { url = "https://files.pythonhosted.org/packages/4c/61/bc448ecbf9b2d69c5cff88fe41496b19ab2a1cbda0065e47d4d0d51c0867/librt-0.9.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:f24b90b0e0c8cc9491fb1693ae91fe17cb7963153a1946395acdbdd5818429a4", size = 70175, upload-time = "2026-04-09T16:05:51.564Z" },
+ { url = "https://files.pythonhosted.org/packages/60/f2/c47bb71069a73e2f04e70acbd196c1e5cc411578ac99039a224b98920fd4/librt-0.9.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:3fe56e80badb66fdcde06bef81bbaa5bfcf6fbd7aefb86222d9e369c38c6b228", size = 72951, upload-time = "2026-04-09T16:05:52.699Z" },
+ { url = "https://files.pythonhosted.org/packages/29/19/0549df59060631732df758e8886d92088da5fdbedb35b80e4643664e8412/librt-0.9.0-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:527b5b820b47a09e09829051452bb0d1dd2122261254e2a6f674d12f1d793d54", size = 225864, upload-time = "2026-04-09T16:05:53.895Z" },
+ { url = "https://files.pythonhosted.org/packages/9d/f8/3b144396d302ac08e50f89e64452c38db84bc7b23f6c60479c5d3abd303c/librt-0.9.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7d429bdd4ac0ab17c8e4a8af0ed2a7440b16eba474909ab357131018fe8c7e71", size = 241155, upload-time = "2026-04-09T16:05:55.191Z" },
+ { url = "https://files.pythonhosted.org/packages/7a/ce/ee67ec14581de4043e61d05786d2aed6c9b5338816b7859bcf07455c6a9f/librt-0.9.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7202bdcac47d3a708271c4304a474a8605a4a9a4a709e954bf2d3241140aa938", size = 252235, upload-time = "2026-04-09T16:05:56.549Z" },
+ { url = "https://files.pythonhosted.org/packages/8a/fa/0ead15daa2b293a54101550b08d4bafe387b7d4a9fc6d2b985602bae69b6/librt-0.9.0-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c0d620e74897f8c2613b3c4e2e9c1e422eb46d2ddd07df540784d44117836af3", size = 244963, upload-time = "2026-04-09T16:05:57.858Z" },
+ { url = "https://files.pythonhosted.org/packages/29/68/9fbf9a9aa704ba87689e40017e720aced8d9a4d2b46b82451d8142f91ec9/librt-0.9.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:d69fc39e627908f4c03297d5a88d9284b73f4d90b424461e32e8c2485e21c283", size = 257364, upload-time = "2026-04-09T16:05:59.686Z" },
+ { url = "https://files.pythonhosted.org/packages/1a/8d/9d60869f1b6716c762e45f66ed945b1e5dd649f7377684c3b176ae424648/librt-0.9.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:c2640e23d2b7c98796f123ffd95cf2022c7777aa8a4a3b98b36c570d37e85eee", size = 247661, upload-time = "2026-04-09T16:06:00.938Z" },
+ { url = "https://files.pythonhosted.org/packages/70/ff/a5c365093962310bfdb4f6af256f191085078ffb529b3f0cbebb5b33ebe2/librt-0.9.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:451daa98463b7695b0a30aa56bf637831ea559e7b8101ac2ef6382e8eb15e29c", size = 248238, upload-time = "2026-04-09T16:06:02.537Z" },
+ { url = "https://files.pythonhosted.org/packages/a0/3c/2d34365177f412c9e19c0a29f969d70f5343f27634b76b765a54d8b27705/librt-0.9.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:928bd06eca2c2bbf4349e5b817f837509b0604342e65a502de1d50a7570afd15", size = 269457, upload-time = "2026-04-09T16:06:03.833Z" },
+ { url = "https://files.pythonhosted.org/packages/bc/cd/de45b239ea3bdf626f982a00c14bfcf2e12d261c510ba7db62c5969a27cd/librt-0.9.0-cp314-cp314t-win32.whl", hash = "sha256:a9c63e04d003bc0fb6a03b348018b9a3002f98268200e22cc80f146beac5dc40", size = 52453, upload-time = "2026-04-09T16:06:05.229Z" },
+ { url = "https://files.pythonhosted.org/packages/7f/f9/bfb32ae428aa75c0c533915622176f0a17d6da7b72b5a3c6363685914f70/librt-0.9.0-cp314-cp314t-win_amd64.whl", hash = "sha256:f162af66a2ed3f7d1d161a82ca584efd15acd9c1cff190a373458c32f7d42118", size = 60044, upload-time = "2026-04-09T16:06:06.398Z" },
+ { url = "https://files.pythonhosted.org/packages/aa/47/7d70414bcdbb3bc1f458a8d10558f00bbfdb24e5a11740fc8197e12c3255/librt-0.9.0-cp314-cp314t-win_arm64.whl", hash = "sha256:a4b25c6c25cac5d0d9d6d6da855195b254e0021e513e0249f0e3b444dc6e0e61", size = 50009, upload-time = "2026-04-09T16:06:07.995Z" },
+]
+
+[[package]]
+name = "mypy"
+version = "1.20.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "librt", marker = "platform_python_implementation != 'PyPy'" },
+ { name = "mypy-extensions" },
+ { name = "pathspec" },
+ { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/04/af/e3d4b3e9ec91a0ff9aabfdb38692952acf49bbb899c2e4c29acb3a6da3ae/mypy-1.20.2.tar.gz", hash = "sha256:e8222c26daaafd9e8626dec58ae36029f82585890589576f769a650dd20fd665", size = 3817349, upload-time = "2026-04-21T17:12:28.473Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/1f/4d/9ebeae211caccbdaddde7ed5e31dfcf57faac66be9b11deb1dc6526c8078/mypy-1.20.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:4077797a273e56e8843d001e9dfe4ba10e33323d6ade647ff260e5cd97d9758c", size = 14371307, upload-time = "2026-04-21T17:08:56.442Z" },
+ { url = "https://files.pythonhosted.org/packages/95/d7/93473d34b61f04fac1aecc01368485c89c5c4af7a4b9a0cab5d77d04b63f/mypy-1.20.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:cdecf62abcc4292500d7858aeae87a1f8f1150f4c4dd08fb0b336ee79b2a6df3", size = 13258917, upload-time = "2026-04-21T17:05:50.978Z" },
+ { url = "https://files.pythonhosted.org/packages/e2/30/3dd903e8bafb7b5f7bf87fcd58f8382086dea2aa19f0a7b357f21f63071b/mypy-1.20.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c566c3a88b6ece59b3d70f65bedef17304f48eb52ff040a6a18214e1917b3254", size = 13700516, upload-time = "2026-04-21T17:11:33.161Z" },
+ { url = "https://files.pythonhosted.org/packages/07/05/c61a140aba4c729ac7bc99ae26fc627c78a6e08f5b9dd319244ea71a3d7e/mypy-1.20.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0deb80d062b2479f2c87ae568f89845afc71d11bc41b04179e58165fd9f31e98", size = 14562889, upload-time = "2026-04-21T17:05:27.674Z" },
+ { url = "https://files.pythonhosted.org/packages/fd/87/da78243742ffa8a36d98c3010f0d829f93d5da4e6786f1a1a6f2ad616502/mypy-1.20.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:bba9ad231e92a3e424b3e56b65aa17704993425bba97e302c832f9466bb85bac", size = 14803844, upload-time = "2026-04-21T17:10:06.2Z" },
+ { url = "https://files.pythonhosted.org/packages/37/52/10a1ddf91b40f843943a3c6db51e2df59c9e237f29d355e95eaab427461f/mypy-1.20.2-cp311-cp311-win_amd64.whl", hash = "sha256:baf593f2765fa3a6b1ef95807dbaa3d25b594f6a52adcc506a6b9cb115e1be67", size = 10846300, upload-time = "2026-04-21T17:12:23.886Z" },
+ { url = "https://files.pythonhosted.org/packages/20/02/f9a4415b664c53bd34d6709be59da303abcae986dc4ac847b402edb6fa1e/mypy-1.20.2-cp311-cp311-win_arm64.whl", hash = "sha256:20175a1c0f49863946ec20b7f63255768058ac4f07d2b9ded6a6b46cfb5a9100", size = 9779498, upload-time = "2026-04-21T17:09:23.695Z" },
+ { url = "https://files.pythonhosted.org/packages/71/4e/7560e4528db9e9b147e4c0f22660466bf30a0a1fe3d63d1b9d3b0fd354ee/mypy-1.20.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:4dbfcf869f6b0517f70cf0030ba6ea1d6645e132337a7d5204a18d8d5636c02b", size = 14539393, upload-time = "2026-04-21T17:07:12.52Z" },
+ { url = "https://files.pythonhosted.org/packages/32/d9/34a5efed8124f5a9234f55ac6a4ced4201e2c5b81e1109c49ad23190ec8c/mypy-1.20.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:4b6481b228d072315b053210b01ac320e1be243dc17f9e5887ef167f23f5fae4", size = 13361642, upload-time = "2026-04-21T17:06:53.742Z" },
+ { url = "https://files.pythonhosted.org/packages/d1/14/eb377acf78c03c92d566a1510cda8137348215b5335085ef662ab82ecd3a/mypy-1.20.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:34397cdced6b90b836e38182076049fdb41424322e0b0728c946b0939ebdf9f6", size = 13740347, upload-time = "2026-04-21T17:12:04.73Z" },
+ { url = "https://files.pythonhosted.org/packages/b9/94/7e4634a32b641aa1c112422eed1bbece61ee16205f674190e8b536f884de/mypy-1.20.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a5da6976f20cae27059ea8d0c86e7cef3de720e04c4bb9ee18e3690fdb792066", size = 14734042, upload-time = "2026-04-21T17:07:43.16Z" },
+ { url = "https://files.pythonhosted.org/packages/7a/f3/f7e62395cb7f434541b4491a01149a4439e28ace4c0c632bbf5431e92d1f/mypy-1.20.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:56908d7e08318d39f85b1f0c6cfd47b0cac1a130da677630dac0de3e0623e102", size = 14964958, upload-time = "2026-04-21T17:11:00.665Z" },
+ { url = "https://files.pythonhosted.org/packages/3e/0d/47e3c3a0ec2a876e35aeac365df3cac7776c36bbd4ed18cc521e1b9d255b/mypy-1.20.2-cp312-cp312-win_amd64.whl", hash = "sha256:d52ad8d78522da1d308789df651ee5379088e77c76cb1994858d40a426b343b9", size = 10911340, upload-time = "2026-04-21T17:10:49.179Z" },
+ { url = "https://files.pythonhosted.org/packages/d6/b2/6c852d72e0ea8b01f49da817fb52539993cde327e7d010e0103dc12d0dac/mypy-1.20.2-cp312-cp312-win_arm64.whl", hash = "sha256:785b08db19c9f214dc37d65f7c165d19a30fcecb48abfa30f31b01b5acaabb58", size = 9833947, upload-time = "2026-04-21T17:09:05.267Z" },
+ { url = "https://files.pythonhosted.org/packages/5b/c4/b93812d3a192c9bcf5df405bd2f30277cd0e48106a14d1023c7f6ed6e39b/mypy-1.20.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:edfbfca868cdd6bd8d974a60f8a3682f5565d3f5c99b327640cedd24c4264026", size = 14524670, upload-time = "2026-04-21T17:10:30.737Z" },
+ { url = "https://files.pythonhosted.org/packages/f3/47/42c122501bff18eaf1e8f457f5c017933452d8acdc52918a9f59f6812955/mypy-1.20.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e2877a02380adfcdbc69071a0f74d6e9dbbf593c0dc9d174e1f223ffd5281943", size = 13336218, upload-time = "2026-04-21T17:08:44.069Z" },
+ { url = "https://files.pythonhosted.org/packages/92/8f/75bbc92f41725fbd585fb17b440b1119b576105df1013622983e18640a93/mypy-1.20.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7488448de6007cd5177c6cea0517ac33b4c0f5ee9b5e9f2be51ce75511a85517", size = 13724906, upload-time = "2026-04-21T17:08:01.02Z" },
+ { url = "https://files.pythonhosted.org/packages/a1/32/4c49da27a606167391ff0c39aa955707a00edc500572e562f7c36c08a71f/mypy-1.20.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bb9c2fa06887e21d6a3a868762acb82aec34e2c6fd0174064f27c93ede68ad15", size = 14726046, upload-time = "2026-04-21T17:11:22.354Z" },
+ { url = "https://files.pythonhosted.org/packages/7f/fc/4e354a1bd70216359deb0c9c54847ee6b32ef78dfb09f5131ff99b494078/mypy-1.20.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:9d56a78b646f2e3daa865bc70cd5ec5a46c50045801ca8ff17a0c43abc97e3ee", size = 14955587, upload-time = "2026-04-21T17:12:16.033Z" },
+ { url = "https://files.pythonhosted.org/packages/62/b2/c0f2056e9eb8f08c62cafd9715e4584b89132bdc832fcf85d27d07b5f3e5/mypy-1.20.2-cp313-cp313-win_amd64.whl", hash = "sha256:2a4102b03bb7481d9a91a6da8d174740c9c8c4401024684b9ca3b7cc5e49852f", size = 10922681, upload-time = "2026-04-21T17:06:35.842Z" },
+ { url = "https://files.pythonhosted.org/packages/e5/14/065e333721f05de8ef683d0aa804c23026bcc287446b61cac657b902ccac/mypy-1.20.2-cp313-cp313-win_arm64.whl", hash = "sha256:a95a9248b0c6fd933a442c03c3b113c3b61320086b88e2c444676d3fd1ca3330", size = 9830560, upload-time = "2026-04-21T17:07:51.023Z" },
+ { url = "https://files.pythonhosted.org/packages/ae/d1/b4ec96b0ecc620a4443570c6e95c867903428cfcde4206518eafdd5880c3/mypy-1.20.2-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:419413398fe250aae057fd2fe50166b61077083c9b82754c341cf4fd73038f30", size = 14524561, upload-time = "2026-04-21T17:06:27.325Z" },
+ { url = "https://files.pythonhosted.org/packages/3a/63/d2c2ff4fa66bc49477d32dfa26e8a167ba803ea6a69c5efb416036909d30/mypy-1.20.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:e73c07f23009962885c197ccb9b41356a30cc0e5a1d0c2ea8fd8fb1362d7f924", size = 13363883, upload-time = "2026-04-21T17:11:11.239Z" },
+ { url = "https://files.pythonhosted.org/packages/2a/56/983916806bf4eddeaaa2c9230903c3669c6718552a921154e1c5182c701f/mypy-1.20.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0c64e5973df366b747646fc98da921f9d6eba9716d57d1db94a83c026a08e0fb", size = 13742945, upload-time = "2026-04-21T17:08:34.181Z" },
+ { url = "https://files.pythonhosted.org/packages/19/65/0cd9285ab010ee8214c83d67c6b49417c40d86ce46f1aa109457b5a9b8d7/mypy-1.20.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5a65aa591af023864fd08a97da9974e919452cfe19cb146c8a5dc692626445dc", size = 14706163, upload-time = "2026-04-21T17:05:15.51Z" },
+ { url = "https://files.pythonhosted.org/packages/94/97/48ff3b297cafcc94d185243a9190836fb1b01c1b0918fff64e941e973cc9/mypy-1.20.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:4fef51b01e638974a6e69885687e9bd40c8d1e09a6cd291cca0619625cf1f558", size = 14938677, upload-time = "2026-04-21T17:05:39.562Z" },
+ { url = "https://files.pythonhosted.org/packages/fd/a1/1b4233d255bdd0b38a1f284feeb1c143ca508c19184964e22f8d837ec851/mypy-1.20.2-cp314-cp314-win_amd64.whl", hash = "sha256:913485a03f1bcf5d279409a9d2b9ed565c151f61c09f29991e5faa14033da4c8", size = 11089322, upload-time = "2026-04-21T17:06:44.29Z" },
+ { url = "https://files.pythonhosted.org/packages/78/c2/ce7ee2ba36aeb954ba50f18fa25d9c1188578654b97d02a66a15b6f09531/mypy-1.20.2-cp314-cp314-win_arm64.whl", hash = "sha256:c3bae4f855d965b5453784300c12ffc63a548304ac7f99e55d4dc7c898673aa3", size = 10017775, upload-time = "2026-04-21T17:07:20.732Z" },
+ { url = "https://files.pythonhosted.org/packages/4e/a1/9d93a7d0b5859af0ead82b4888b46df6c8797e1bc5e1e262a08518c6d48e/mypy-1.20.2-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:2de3dcea53babc1c3237a19002bc3d228ce1833278f093b8d619e06e7cc79609", size = 15549002, upload-time = "2026-04-21T17:08:23.107Z" },
+ { url = "https://files.pythonhosted.org/packages/00/d2/09a6a10ee1bf0008f6c144d9676f2ca6a12512151b4e0ad0ff6c4fac5337/mypy-1.20.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:52b176444e2e5054dfcbcb8c75b0b719865c96247b37407184bbfca5c353f2c2", size = 14401942, upload-time = "2026-04-21T17:07:31.837Z" },
+ { url = "https://files.pythonhosted.org/packages/57/da/9594b75c3c019e805250bed3583bdf4443ff9e6ef08f97e39ae308cb06f2/mypy-1.20.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:688c3312e5dadb573a2c69c82af3a298d43ecf9e6d264e0f95df960b5f6ac19c", size = 15041649, upload-time = "2026-04-21T17:09:34.653Z" },
+ { url = "https://files.pythonhosted.org/packages/97/77/f75a65c278e6e8eba2071f7f5a90481891053ecc39878cc444634d892abe/mypy-1.20.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:29752dbbf8cc53f89f6ac096d363314333045c257c9c75cbd189ca2de0455744", size = 15864588, upload-time = "2026-04-21T17:11:44.936Z" },
+ { url = "https://files.pythonhosted.org/packages/d7/46/1a4e1c66e96c1a3246ddf5403d122ac9b0a8d2b7e65730b9d6533ba7a6d3/mypy-1.20.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:803203d2b6ea644982c644895c2f78b28d0e208bba7b27d9b921e0ec5eb207c6", size = 16093956, upload-time = "2026-04-21T17:10:17.683Z" },
+ { url = "https://files.pythonhosted.org/packages/5a/2c/78a8851264dec38cd736ca5b8bc9380674df0dd0be7792f538916157716c/mypy-1.20.2-cp314-cp314t-win_amd64.whl", hash = "sha256:9bcb8aa397ff0093c824182fd76a935a9ba7ad097fcbef80ae89bf6c1731d8ec", size = 12568661, upload-time = "2026-04-21T17:11:54.473Z" },
+ { url = "https://files.pythonhosted.org/packages/83/01/cd7318aa03493322ce275a0e14f4f52b8896335e4e79d4fb8153a7ad2b77/mypy-1.20.2-cp314-cp314t-win_arm64.whl", hash = "sha256:e061b58443f1736f8a37c48978d7ab581636d6ab03e3d4f99e3fa90463bb9382", size = 10389240, upload-time = "2026-04-21T17:09:42.719Z" },
+ { url = "https://files.pythonhosted.org/packages/28/9a/f23c163e25b11074188251b0b5a0342625fc1cdb6af604757174fa9acc9b/mypy-1.20.2-py3-none-any.whl", hash = "sha256:a94c5a76ab46c5e6257c7972b6c8cff0574201ca7dc05647e33e795d78680563", size = 2637314, upload-time = "2026-04-21T17:05:54.5Z" },
+]
+
+[[package]]
+name = "mypy-extensions"
+version = "1.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/a2/6e/371856a3fb9d31ca8dac321cda606860fa4548858c0cc45d9d1d4ca2628b/mypy_extensions-1.1.0.tar.gz", hash = "sha256:52e68efc3284861e772bbcd66823fde5ae21fd2fdb51c62a211403730b916558", size = 6343, upload-time = "2025-04-22T14:54:24.164Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/79/7b/2c79738432f5c924bef5071f933bcc9efd0473bac3b4aa584a6f7c1c8df8/mypy_extensions-1.1.0-py3-none-any.whl", hash = "sha256:1be4cccdb0f2482337c4743e60421de3a356cd97508abadd57d47403e94f5505", size = 4963, upload-time = "2025-04-22T14:54:22.983Z" },
+]
+
+[[package]]
+name = "packaging"
+version = "26.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d7/f1/e7a6dd94a8d4a5626c03e4e99c87f241ba9e350cd9e6d75123f992427270/packaging-26.2.tar.gz", hash = "sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661", size = 228134, upload-time = "2026-04-24T20:15:23.917Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
+]
+
+[[package]]
+name = "pathspec"
+version = "1.1.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/5a/82/42f767fc1c1143d6fd36efb827202a2d997a375e160a71eb2888a925aac1/pathspec-1.1.1.tar.gz", hash = "sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a", size = 135180, upload-time = "2026-04-27T01:46:08.907Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/f1/d9/7fb5aa316bc299258e68c73ba3bddbc499654a07f151cba08f6153988714/pathspec-1.1.1-py3-none-any.whl", hash = "sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189", size = 57328, upload-time = "2026-04-27T01:46:07.06Z" },
+]
+
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.20.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
+]
+
+[[package]]
+name = "pytest"
+version = "9.0.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+ { name = "colorama", marker = "sys_platform == 'win32'" },
+ { name = "iniconfig" },
+ { name = "packaging" },
+ { name = "pluggy" },
+ { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
+]
+
+[[package]]
+name = "ruff"
+version = "0.15.12"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/99/43/3291f1cc9106f4c63bdce7a8d0df5047fe8422a75b091c16b5e9355e0b11/ruff-0.15.12.tar.gz", hash = "sha256:ecea26adb26b4232c0c2ca19ccbc0083a68344180bba2a600605538ce51a40a6", size = 4643852, upload-time = "2026-04-24T18:17:14.305Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/c3/6e/e78ffb61d4686f3d96ba3df2c801161843746dcbcbb17a1e927d4829312b/ruff-0.15.12-py3-none-linux_armv6l.whl", hash = "sha256:f86f176e188e94d6bdbc09f09bfd9dc729059ad93d0e7390b5a73efe19f8861c", size = 10640713, upload-time = "2026-04-24T18:17:22.841Z" },
+ { url = "https://files.pythonhosted.org/packages/ae/08/a317bc231fb9e7b93e4ef3089501e51922ff88d6936ce5cf870c4fe55419/ruff-0.15.12-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:e3bcd123364c3770b8e1b7baaf343cc99a35f197c5c6e8af79015c666c423a6c", size = 11069267, upload-time = "2026-04-24T18:17:30.105Z" },
+ { url = "https://files.pythonhosted.org/packages/aa/a4/f828e9718d3dce1f5f11c39c4f65afd32783c8b2aebb2e3d259e492c47bd/ruff-0.15.12-py3-none-macosx_11_0_arm64.whl", hash = "sha256:fe87510d000220aa1ed530d4448a7c696a0cae1213e5ec30e5874287b66557b5", size = 10397182, upload-time = "2026-04-24T18:17:07.177Z" },
+ { url = "https://files.pythonhosted.org/packages/71/e0/3310fc6d1b5e1fdea22bf3b1b807c7e187b581021b0d7d4514cccdb5fb71/ruff-0.15.12-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:84a1630093121375a3e2a95b4a6dc7b59e2b4ee76216e32d81aae550a832d002", size = 10758012, upload-time = "2026-04-24T18:16:55.759Z" },
+ { url = "https://files.pythonhosted.org/packages/11/c1/a606911aee04c324ddaa883ae418f3569792fd3c4a10c50e0dd0a2311e1e/ruff-0.15.12-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:fb129f40f114f089ebe0ca56c0d251cf2061b17651d464bb6478dc01e69f11f5", size = 10447479, upload-time = "2026-04-24T18:16:51.677Z" },
+ { url = "https://files.pythonhosted.org/packages/9d/68/4201e8444f0894f21ab4aeeaee68aa4f10b51613514a20d80bd628d57e88/ruff-0.15.12-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b0c862b172d695db7598426b8af465e7e9ac00a3ea2a3630ee67eb82e366aaa6", size = 11234040, upload-time = "2026-04-24T18:17:16.529Z" },
+ { url = "https://files.pythonhosted.org/packages/34/ff/8a6d6cf4ccc23fd67060874e832c18919d1557a0611ebef03fdb01fff11e/ruff-0.15.12-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:2849ea9f3484c3aca43a82f484210370319e7170df4dfe4843395ddf6c57bc33", size = 12087377, upload-time = "2026-04-24T18:17:04.944Z" },
+ { url = "https://files.pythonhosted.org/packages/85/f6/c669cf73f5152f623d34e69866a46d5e6185816b19fcd5b6dd8a2d299922/ruff-0.15.12-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:9e77c7e51c07fe396826d5969a5b846d9cd4c402535835fb6e21ce8b28fef847", size = 11367784, upload-time = "2026-04-24T18:17:25.409Z" },
+ { url = "https://files.pythonhosted.org/packages/e8/39/c61d193b8a1daaa8977f7dea9e8d8ba866e02ea7b65d32f6861693aa4c12/ruff-0.15.12-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:83b2f4f2f3b1026b5fb449b467d9264bf22067b600f7b6f41fc5958909f449d0", size = 11344088, upload-time = "2026-04-24T18:17:12.258Z" },
+ { url = "https://files.pythonhosted.org/packages/c2/8d/49afab3645e31e12c590acb6d3b5b69d7aab5b81926dbaf7461f9441f37a/ruff-0.15.12-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:9ba3b8f1afd7e2e43d8943e55f249e13f9682fde09711644a6e7290eb4f3e339", size = 11271770, upload-time = "2026-04-24T18:17:02.457Z" },
+ { url = "https://files.pythonhosted.org/packages/46/06/33f41fe94403e2b755481cdfb9b7ef3e4e0ed031c4581124658d935d52b4/ruff-0.15.12-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:e852ba9fdc890655e1d78f2df1499efbe0e54126bd405362154a75e2bde159c5", size = 10719355, upload-time = "2026-04-24T18:17:27.648Z" },
+ { url = "https://files.pythonhosted.org/packages/0d/59/18aa4e014debbf559670e4048e39260a85c7fcee84acfd761ac01e7b8d35/ruff-0.15.12-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:dd8aed930da53780d22fc70bdf84452c843cf64f8cb4eb38984319c24c5cd5fd", size = 10462758, upload-time = "2026-04-24T18:17:32.347Z" },
+ { url = "https://files.pythonhosted.org/packages/25/e7/cc9f16fd0f3b5fddcbd7ec3d6ae30c8f3fde1047f32a4093a98d633c6570/ruff-0.15.12-py3-none-musllinux_1_2_i686.whl", hash = "sha256:01da3988d225628b709493d7dc67c3b9b12c0210016b08690ef9bd27970b262b", size = 10953498, upload-time = "2026-04-24T18:17:20.674Z" },
+ { url = "https://files.pythonhosted.org/packages/72/7a/a9ba7f98c7a575978698f4230c5e8cc54bbc761af34f560818f933dafa0c/ruff-0.15.12-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:9cae0f92bd5700d1213188b31cd3bdd2b315361296d10b96b8e2337d3d11f53e", size = 11447765, upload-time = "2026-04-24T18:17:09.755Z" },
+ { url = "https://files.pythonhosted.org/packages/ea/f9/0ae446942c846b8266059ad8a30702a35afae55f5cdc54c5adf8d7afdc27/ruff-0.15.12-py3-none-win32.whl", hash = "sha256:d0185894e038d7043ba8fd6aee7499ece6462dc0ea9f1e260c7451807c714c20", size = 10657277, upload-time = "2026-04-24T18:17:18.591Z" },
+ { url = "https://files.pythonhosted.org/packages/33/f1/9614e03e1cdcbf9437570b5400ced8a720b5db22b28d8e0f1bda429f660d/ruff-0.15.12-py3-none-win_amd64.whl", hash = "sha256:c87a162d61ab3adca47c03f7f717c68672edec7d1b5499e652331780fe74950d", size = 11837758, upload-time = "2026-04-24T18:17:00.113Z" },
+ { url = "https://files.pythonhosted.org/packages/c0/98/6beb4b351e472e5f4c4613f7c35a5290b8be2497e183825310c4c3a3984b/ruff-0.15.12-py3-none-win_arm64.whl", hash = "sha256:a538f7a82d061cee7be55542aca1d86d1393d55d81d4fcc314370f4340930d4f", size = 11120821, upload-time = "2026-04-24T18:16:57.979Z" },
+]
+
+[[package]]
+name = "sandbox-lint"
+version = "0.1.0"
+source = { editable = "." }
+
+[package.dev-dependencies]
+dev = [
+ { name = "mypy" },
+ { name = "pytest" },
+ { name = "ruff" },
+]
+
+[package.metadata]
+
+[package.metadata.requires-dev]
+dev = [
+ { name = "mypy", specifier = ">=1.11" },
+ { name = "pytest", specifier = ">=8.0" },
+ { name = "ruff", specifier = ">=0.6" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.15.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
+wheels = [
+ { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
+]