From 1c123e016223d2a9e67c1427a08fd884c1e581bc Mon Sep 17 00:00:00 2001 From: Cytown Date: Wed, 11 Mar 2026 16:33:01 +0800 Subject: [PATCH 001/202] refactor Config to add Version and migratable --- README.fr.md | 2 +- README.ja.md | 2 +- README.md | 3 +- README.pt-br.md | 2 +- README.vi.md | 2 +- README.zh.md | 3 +- assets/wechat.png | Bin 356550 -> 352888 bytes cmd/picoclaw-launcher-tui/internal/ui/app.go | 6 +- .../internal/ui/model.go | 12 +- cmd/picoclaw/internal/auth/helpers.go | 23 -- cmd/picoclaw/internal/helpers.go | 7 +- cmd/picoclaw/internal/helpers_test.go | 6 +- cmd/picoclaw/internal/status/helpers.go | 42 -- config/config.example.json | 12 + docs/channels/matrix/README.md | 7 +- docs/config-versioning.md | 230 +++++++++++ go.mod | 3 +- go.sum | 2 + pkg/agent/context.go | 5 +- pkg/agent/instance_test.go | 8 +- pkg/agent/loop.go | 193 ++++----- pkg/agent/loop_mcp.go | 184 +++++++++ pkg/agent/loop_test.go | 78 +++- pkg/agent/registry_test.go | 2 +- pkg/auth/store.go | 5 +- pkg/bus/types.go | 7 +- pkg/channels/base.go | 17 +- pkg/channels/dingtalk/dingtalk.go | 4 + pkg/channels/discord/discord.go | 29 +- pkg/channels/manager.go | 54 +++ pkg/channels/manager_test.go | 301 +++++++++++++- pkg/channels/matrix/matrix.go | 28 +- pkg/channels/matrix/matrix_test.go | 50 +++ pkg/channels/qq/qq.go | 1 + pkg/channels/slack/slack.go | 6 +- pkg/channels/telegram/telegram.go | 16 +- pkg/channels/wecom/app_test.go | 6 +- pkg/channels/wecom/bot_test.go | 7 +- pkg/channels/wecom/common.go | 2 +- pkg/config/config.go | 219 +++++----- pkg/config/config_old.go | 108 +++++ pkg/config/config_test.go | 197 +++++---- pkg/config/defaults.go | 25 +- pkg/config/migration.go | 87 +++- pkg/config/migration_test.go | 133 +++--- pkg/config/model_config_test.go | 99 +---- pkg/env.go | 13 + pkg/logger/logger.go | 190 +++++---- pkg/logger/logger_3rd_party.go | 95 +++++ pkg/memory/migration.go | 6 + pkg/memory/migration_test.go | 52 +++ pkg/migrate/internal/common.go | 6 +- pkg/migrate/sources/openclaw/common.go | 1 - .../sources/openclaw/openclaw_config.go | 1 + .../sources/openclaw/openclaw_config_test.go | 14 + pkg/providers/claude_cli_provider_test.go | 8 +- pkg/providers/factory.go | 377 ------------------ pkg/providers/factory_provider.go | 4 +- pkg/providers/factory_provider_test.go | 24 ++ pkg/providers/factory_test.go | 227 +---------- pkg/providers/legacy_provider.go | 17 - pkg/providers/openai_compat/provider.go | 62 ++- pkg/providers/openai_compat/provider_test.go | 154 +++++++ pkg/routing/route_test.go | 2 +- pkg/session/manager.go | 4 +- pkg/skills/loader.go | 169 ++++++-- pkg/skills/loader_test.go | 75 ++++ pkg/state/state.go | 4 +- pkg/state/state_test.go | 16 +- pkg/tools/cron.go | 22 +- pkg/tools/cron_test.go | 116 ++++++ pkg/tools/shell.go | 37 ++ pkg/tools/shell_test.go | 79 ++++ pkg/tools/web.go | 147 ++++++- pkg/tools/web_test.go | 210 ++++++++++ pkg/voice/transcriber.go | 6 +- pkg/voice/transcriber_test.go | 12 - web/backend/api/config.go | 45 +-- web/backend/api/config_test.go | 88 ++++ web/backend/api/gateway.go | 71 ++-- web/backend/api/gateway_host.go | 66 +++ web/backend/api/gateway_host_test.go | 59 +++ web/backend/api/gateway_test.go | 276 ++++++++++++- web/backend/api/launcher_config_test.go | 2 +- web/backend/api/log.go | 8 +- web/backend/api/model_status.go | 324 +++++++++++++++ web/backend/api/models.go | 19 +- web/backend/api/models_test.go | 313 +++++++++++++++ web/backend/api/oauth.go | 11 - web/backend/api/oauth_test.go | 4 - web/backend/api/pico.go | 24 +- web/backend/api/router.go | 22 +- web/backend/api/session.go | 348 +++++++++++++--- web/backend/api/session_test.go | 322 +++++++++++++++ web/backend/api/skills.go | 331 +++++++++++++++ web/backend/api/skills_test.go | 336 ++++++++++++++++ web/backend/api/tools.go | 323 +++++++++++++++ web/backend/api/tools_test.go | 198 +++++++++ web/backend/dist/.gitkeep | 1 + web/backend/main.go | 15 +- web/backend/{utils.go => utils/banner.go} | 50 +-- web/backend/utils/onboard.go | 42 ++ web/backend/utils/onboard_test.go | 101 +++++ web/backend/utils/runtime.go | 80 ++++ web/frontend/package.json | 2 +- web/frontend/pnpm-lock.yaml | 65 +-- web/frontend/src/api/gateway.ts | 8 + web/frontend/src/api/sessions.ts | 1 + web/frontend/src/api/skills.ts | 79 ++++ web/frontend/src/api/tools.ts | 56 +++ web/frontend/src/components/app-sidebar.tsx | 23 ++ .../src/components/chat/chat-page.tsx | 19 +- .../components/chat/session-history-menu.tsx | 15 +- .../src/components/config/config-page.tsx | 5 + .../src/components/config/config-sections.tsx | 7 + .../src/components/config/form-model.ts | 8 + .../src/components/skills/skills-page.tsx | 314 +++++++++++++++ .../src/components/tools/tools-page.tsx | 190 +++++++++ web/frontend/src/hooks/use-pico-chat.ts | 56 ++- web/frontend/src/hooks/use-session-history.ts | 26 +- .../src/hooks/use-sidebar-channels.ts | 2 +- web/frontend/src/i18n/locales/en.json | 105 ++++- web/frontend/src/i18n/locales/zh.json | 105 ++++- web/frontend/src/routeTree.gen.ts | 71 ++++ web/frontend/src/routes/agent.tsx | 22 + web/frontend/src/routes/agent/skills.tsx | 11 + web/frontend/src/routes/agent/tools.tsx | 11 + web/frontend/src/routes/logs.tsx | 65 ++- 128 files changed, 7357 insertions(+), 1773 deletions(-) create mode 100644 docs/config-versioning.md create mode 100644 pkg/agent/loop_mcp.go create mode 100644 pkg/config/config_old.go create mode 100644 pkg/env.go create mode 100644 pkg/logger/logger_3rd_party.go create mode 100644 pkg/tools/cron_test.go create mode 100644 web/backend/api/config_test.go create mode 100644 web/backend/api/gateway_host.go create mode 100644 web/backend/api/gateway_host_test.go create mode 100644 web/backend/api/model_status.go create mode 100644 web/backend/api/models_test.go create mode 100644 web/backend/api/session_test.go create mode 100644 web/backend/api/skills.go create mode 100644 web/backend/api/skills_test.go create mode 100644 web/backend/api/tools.go create mode 100644 web/backend/api/tools_test.go rename web/backend/{utils.go => utils/banner.go} (54%) create mode 100644 web/backend/utils/onboard.go create mode 100644 web/backend/utils/onboard_test.go create mode 100644 web/backend/utils/runtime.go create mode 100644 web/frontend/src/api/skills.ts create mode 100644 web/frontend/src/api/tools.ts create mode 100644 web/frontend/src/components/skills/skills-page.tsx create mode 100644 web/frontend/src/components/tools/tools-page.tsx create mode 100644 web/frontend/src/routes/agent.tsx create mode 100644 web/frontend/src/routes/agent/skills.tsx create mode 100644 web/frontend/src/routes/agent/tools.tsx diff --git a/README.fr.md b/README.fr.md index 08a1926b6..574402a3e 100644 --- a/README.fr.md +++ b/README.fr.md @@ -649,7 +649,6 @@ PicoClaw stocke les données dans votre workspace configuré (par défaut : `~/. ├── HEARTBEAT.md # Invites de tâches périodiques (vérifiées toutes les 30 min) ├── IDENTITY.md # Identité de l'Agent ├── SOUL.md # Âme de l'Agent -├── TOOLS.md # Description des outils └── USER.md # Préférences utilisateur ``` @@ -980,6 +979,7 @@ Cette conception permet également le **support multi-agent** avec une sélectio | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [Obtenir Clé](https://cerebras.ai) | | **Volcengine** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [Obtenir Clé](https://console.volcengine.com) | | **ShengsuanYun** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [Obtenir une clé](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | Custom | OAuth uniquement | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | diff --git a/README.ja.md b/README.ja.md index c4c5b27a0..1eb47cfdc 100644 --- a/README.ja.md +++ b/README.ja.md @@ -610,7 +610,6 @@ PicoClaw は設定されたワークスペース（デフォルト: `~/.picoclaw ├── HEARTBEAT.md # 定期タスクプロンプト（30分ごとに確認） ├── IDENTITY.md # エージェントのアイデンティティ ├── SOUL.md # エージェントのソウル -├── TOOLS.md # ツールの説明 └── USER.md # ユーザー設定 ``` @@ -921,6 +920,7 @@ HEARTBEAT_OK 応答 ユーザーが直接結果を受け取る | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [キーを取得](https://cerebras.ai) | | **Volcengine** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [キーを取得](https://console.volcengine.com) | | **ShengsuanYun** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [キーを取得](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | カスタム | OAuthのみ | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | diff --git a/README.md b/README.md index bae3fa681..55e9fb187 100644 --- a/README.md +++ b/README.md @@ -787,7 +787,6 @@ PicoClaw stores data in your configured workspace (default: `~/.picoclaw/workspa ├── HEARTBEAT.md # Periodic task prompts (checked every 30 min) ├── IDENTITY.md # Agent identity ├── SOUL.md # Agent soul -├── TOOLS.md # Tool descriptions └── USER.md # User preferences ``` @@ -1034,6 +1033,7 @@ This design also enables **multi-agent support** with flexible provider selectio | **火山引擎** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [Get Key](https://console.volcengine.com) | | **神算云** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | | **Vivgrid** | `vivgrid/` | `https://api.vivgrid.com/v1` | OpenAI | [Get Key](https://vivgrid.com) | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [Get Key](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | Custom | OAuth only | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | @@ -1504,3 +1504,4 @@ This happens when another instance of the bot is running. Make sure only one `pi | **SearXNG** | Unlimited (self-hosted) | Privacy-focused metasearch (70+ engines) | | **Groq** | Free tier available | Fast inference (Llama, Mixtral) | | **Cerebras** | Free tier available | Fast inference (Llama, Qwen, etc.) | +| **LongCat** | Up to 5M tokens/day | Fast inference (free tier) | diff --git a/README.pt-br.md b/README.pt-br.md index 5f37ba457..066d71d6a 100644 --- a/README.pt-br.md +++ b/README.pt-br.md @@ -645,7 +645,6 @@ O PicoClaw armazena dados no workspace configurado (padrão: `~/.picoclaw/worksp ├── HEARTBEAT.md # Prompts de tarefas periodicas (verificado a cada 30 min) ├── IDENTITY.md # Identidade do Agente ├── SOUL.md # Alma do Agente -├── TOOLS.md # Descrição das ferramentas └── USER.md # Preferencias do usuario ``` @@ -976,6 +975,7 @@ Este design também possibilita o **suporte multi-agent** com seleção flexíve | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [Obter Chave](https://cerebras.ai) | | **Volcengine** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [Obter Chave](https://console.volcengine.com) | | **ShengsuanYun** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [Obter Chave](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | Custom | Apenas OAuth | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | diff --git a/README.vi.md b/README.vi.md index 92c6ecbae..66573a1c5 100644 --- a/README.vi.md +++ b/README.vi.md @@ -617,7 +617,6 @@ PicoClaw lưu trữ dữ liệu trong workspace đã cấu hình (mặc định: ├── HEARTBEAT.md # Prompt tác vụ định kỳ (kiểm tra mỗi 30 phút) ├── IDENTITY.md # Danh tính Agent ├── SOUL.md # Tâm hồn/Tính cách Agent -├── TOOLS.md # Mô tả công cụ └── USER.md # Tùy chọn người dùng ``` @@ -945,6 +944,7 @@ Thiết kế này cũng cho phép **hỗ trợ đa tác nhân** với lựa ch | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [Lấy Khóa](https://cerebras.ai) | | **Volcengine** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [Lấy Khóa](https://console.volcengine.com) | | **ShengsuanYun** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [Lấy Key](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | Tùy chỉnh | Chỉ OAuth | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | diff --git a/README.zh.md b/README.zh.md index c744e0d20..a3a4c7f5f 100644 --- a/README.zh.md +++ b/README.zh.md @@ -365,7 +365,6 @@ PicoClaw 将数据存储在您配置的工作区中（默认：`~/.picoclaw/work ├── HEARTBEAT.md # 周期性任务提示词 (每 30 分钟检查一次) ├── IDENTITY.md # Agent 身份设定 ├── SOUL.md # Agent 灵魂/性格 -├── TOOLS.md # 工具描述 └── USER.md # 用户偏好 ``` @@ -517,6 +516,7 @@ Agent 读取 HEARTBEAT.md | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [获取密钥](https://cerebras.ai) | | **火山引擎** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [获取密钥](https://console.volcengine.com) | | **神算云** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [获取密钥](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | 自定义 | 仅 OAuth | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | @@ -879,3 +879,4 @@ Discord: [https://discord.gg/V4sAZ9XWpN](https://discord.gg/V4sAZ9XWpN) | **Brave Search** | 2000 次查询/月 | 网络搜索功能 | | **Tavily** | 1000 次查询/月 | AI Agent 搜索优化 | | **Groq** | 提供免费层级 | 极速推理 (Llama, Mixtral) | +| **LongCat** | 最多 5M tokens/天 | 推理速度快 (免费额度) | diff --git a/assets/wechat.png b/assets/wechat.png index 4442ef2c7153ceb05250bc0a7ec3e83ca0aa54b7..4cfcbbb1a8a24f35dfceb8554aee56f2fb1c8ec9 100644 GIT binary patch literal 352888 zcmeGEbz56e*DVfXEm8rB7AY<6Ry24^pjhxga47EX)>4XEI6$$D{NQe)DPyXjfWnMC$3nqCB||nwHbK5cQOW=BxfCiR z3i`k6$om9YpkVw@8xZpN`1c9xfA3H%o;R@!7 zK_0N}KS7*OP@WMyzEM#Ul1Ncd#8G4!M;s;KQTPu)4Z?+zvvMe9gG_{=MxvFl}6D-TTmOim$1P7L{jpW5C1qzdCpv7Uuu{)_;ffADjKxTL1Adga7*0zi|0)B>oRf z{TCqq3lRTJKFDDBZ>s(ekNE#PgAjiA7=d5T-zo7Xt_mL)na@^eywBgg36wwgZh}g| z3d)`(BaZuL6?H0o?_8(*%y=~tas4KR2NeyL!Y&<;eKk4<^{Di>5<_^rNII*pCfd0; z-uNxt@7#@>*QNN)l{79tBryrweWE0J?1w~tDX}q8@2H6k^az2zZ&5QxskE z3tq~qL2b8Qmh!CObWqf8Qzy}}rCQIJip|&IS2}a5U`xAGibu<$`!6PkkeJGwB<%O=0X3%H!F$#pzaLC z|CtI=vgf_FPxCx2{keB58t-lY?j;wvmw{w!(9V9Hn%rgTIo#7^DU2&)lLWycv>xbj zA2T|zsHMB*O-7+lS?xZ**>iTPTuy_AGyzAn|45!5y>2)g8ubwZD=ii;7g+Xp7W~!a zd^qNpR(*<9)gk|mzTocbXNV+)u5DQdM?pd+j`4V6-kURFpPfVp*!%e&Xv5$fI3U%} z+eLM=(bsF!W8}_*%6sA1E}{-l3P_DFb6}fv@i2MT`fD<7d0y0x9>D(C`5+DQmkM(~ zemEMzej5YE;kDztm=^ex%`~ZpoomAL%J2P7XBb%;HjdvC6E4&s(NIV6R3Hab1% zictj;6|xeBl1g?6v>ms*V$m@O9TU^eQGi?Bs25vv{$TGT{ws zlnb3<<7P1cISAyC-lEEklVGWS4DrYE)<+9gs}T5E#`-a@wDE>EJ^V%US>Kld;Q0GR z#5>IXtBB;GvJa{P8SXjerKa35hn^mg-xWm8fL`l2HNNq$J4q0+8XocMeea!9HU9uK zVqr7tn`I)4hVo;~_%PEl*2%jk*52!-e7lD%kv;hDL8pnQ0!>S~+Cq&(s-1%zXJf}y zH&(h}ST`q&vn6bN#~C2`gmZUOB!S8kJDKD0Q7%R|5%>-I4i0YdJVMo#Hdb2B(SEUV zWZo9f1^K!w-&)v+_M%`b0~_eGN6k;{iM0UDti22-1!^@&`CW0(GYks57!RpW(A{gW zdQu#grtYr1iC(dsMyEzkl-p^-@m0}ul`shx@87<3A+y4lMXuIrr)BFkucO}gQ*qb` zO=jo>LtDidl#cd3!&4g1N7xI$0Fk+K2^(37DJ~6hAjeqbkJ91{--=LMciensL$~cK z$@PuAXYLO!lax8|;(ERZrxPA^9TjLl(H1Sta@xZhoVWlsdv!`N1DW>kj6~V&)DSYg zJ2j?r#Y?(^hNt!bH5dmdRTp$Ay)A!@TP%upMUn&_=xBfRw{cE1_AKbf*LM#i)mfhOAxL277L%`3~gLgUxeA^SRSL~c+0PL(t8IjmuLDnFGSQ^Vc* zs91aB0wdD$^MFYy6mRye?QC_oF$?2jpM-|j(F`oFZDPyXuC)OB3M*Bbywgja3dbe! z?X^H#&5+;BdU@~sGj8e(Q^`)V?t3VvjvA|R_-pf?i+^g8tIv7*4{gIRXw^AJh8|H- zj-hxYw~h=|(vu+Xxr~|Gye!FUSkzsX+2E?h{^ed-!>##e!$QYQ@OloIiiu_7T4vvI zC=!?;Sx7JiiewdiIF(NIzKfermV3BL^s70U2$xGt4CGQT`8ddPsG3&}kb`@AQYYz+ zXPUombdAS@YSV^m_2)&sLT4>13rq>YLFrg6Nqv)fjS#dj99(`nZT9n|ECYu!}a zCl;GVJ(?A++j$$S=A#_3?r}QofV3ljJhG}!ygPF_q&~{SPE&%M>95~rdK(6BwM4K?8)mR(mx6N*fjNbIk740Xhcvl9wyCZp zhGZHVrSdT$un>uYXyVxDn1+-EhbuD)BjH}Xxa zwNl%+d{|eIqCqCLx^Co%7uTRgUL;>MBvGoruPnR7fCg9^3p1H9!`-c(3+qkm#cS!# z*Wv4IlG6c|!)UiNGVxR3ys7eszUS+AN5iITHZHYg(wBY@5BFx3vo*)dL0*S-B2~^N z=fmTD(`KD@eB3`N4{TjpcHkg|Z_Fx0Z@^#xaDDl$wkv*o@#NPiw3zUHt+6u-&JWis zW*i4%ynEN$gSTC$KU4jVa+AmN2gO``1w-AE?KX~i`Q3eIR0Fm&{+avTqq(u9UQiFCNYxt`^H!tLxml69yFcM>z97a&)|d=W*I2 zq@XI1Jy|O;HtUeD!gM0Nzat7*_eO_G#coIS@2_gbo*G(R-ke_)AA&Y~2~Ga=bm(4C z%<>cIDVVpEjWdfV>UX&wZwqs!?W+vO$m(vSeI#vyn6rLAW&Vb)LG+9w(z2qn<}L*P zEDS3c`E=eQ(TxKu^E*Bgau+aCV80qJu{d@lX`XOgrN}>@{PpCZ$w|r5A$CMIZ0GV& zr<$11gD(+O&{9$=tk7|J=yM$;ws2)JPGv1Q57;Uf`bj|YgzH5YpsX&{%p!KFms*8p zFhc-F)QO4vrpjgfxW$tDK+UA$kHSkTu*u8<#Zq=umWI)Tdl5v~$XUjHk~M{;CL${O!P)k*Mk00% zNHJ!}QVvzG7XVzH3^ux1HjeMc7W(Z{iIVCyDw{n~&L(XK#(Ym1eF*@kn4WqF>;6;( zNp(v1u0{)k?rK2L5+U+U2Rw zP93oS2;+1_pFIpxh6)wugH;Chj66K;A9e?=CKI#c7cE}6alk{~*e5d&?z6h=HZjLu zHr%ZYY^JhFWmt1nhR%gYU%N-iL)W=WEbWp^I%VG2K3}-m9;Bpz489LnQ_i86pU5s! zkIr{-NDw=@?@?bzO&JXEv6yfon?XKa_t%fU{8T-h3F*tv(O4pDJbgN5i!Sgit>`p4 zJmbdJ%(_!v$9hP#G0HvE+tz}#eV59;2g9&%#YJjdwE*$jo?s5=f~HIAM)FrAc+mrP zB!cYLQ!h_eGdRQ$XAjqn_k%@Z*RS1a(u5{PD4| zc9hCAI-u4sxVm$HU#>v!aNyx`IN;Xp(C7R-Ls86vI{$l83R{`8sqwR)BXMgWx{UHnNvX93uwSGXS@wpt}%vX6wg zyLp0NYKU6DZ#Bpus(o9ml7lR6%w9lkaB5?-TVT>QUw`o4)QsZ;*7d^ zSFXcnK$;%I%`3EW3?`zBjhEBg%`!`YiHV8iP(K4&eY z{_Iom25KvXF%ggQ$}G##_e>@M_+WM&qh{1I@@;!KA~%$PkTy93t-_UMrvf&@768Dx z>#|b~%`2WyJ$PZk4=<4l@OHX65aOq*xa&5TWR6MhbP>MX$se_`bFRSs z`7(?;?5^u2pkyC9Y781@zbPBRs@^w&Q+b^-rXVz(( zDnZfAFu8o5m`?e!a50Uu>9{q(IOPU3y)RjiGmpJ;x3(~p>t=Trtg5hL5v!g;IX6Q| zA21=3_-8zzI_A(?H@!wYiQOvzwC`+@n?QiQ1h4A>)cJ@N!2CtkuW|}a=z(Dvo%Am+ z=ByFJZ}tfm*x8x!>r!^FvPHi{PAJkr5$2;~fk)iW(d>krfb!jbkVK2YRM1q#yqQ=Yx|0ChLDva(-Vzh4ZX1 z>9cuD3+8)U!9n(DgHDl+9^_WB;)qdjtg-uRioTVbGVjI1 zs#KDDSAwcrcQw`KFa-1-|Kv&+fedaWFa;tlE7zPSfgB|Au|H)lNMpB!4Jg6Y`G5yj zuToeC>21fEDHm~dLoYtZ(OZ1Gm8HsUqKh4K&0~(gd1J{Aog``;+3R^fpFLL|+MA?; z_VRCGp%7=XikzxHvo-K4n`f80IISlcqJtr^JF_sJGwIN3K$H{;=8HDuM0@!rY%)w$ zH^?V<+{GOyApooHF^w+%!Yr62L`KMW@eI{eS?w0$c4nYkjb;#iWjD^q49HRqx^MED z9wxVES=tp>0zvImVPmUwJSIJU4db?(Xp4lsQJDaS#7d^|J+)f;{qotS;b2%kGcFg{ z%B%bnwj;bQO=#*sZ{}3nX7*ej@lcwsHDQ@S+rG+m4BF_%kTH ze!A9CWNJ#*r?Gt70qCSYQ>ubk3|5;PKhH;pm#S5-W|vNQit6{vB8!dl$I|^qSZ+S# zQ4OFynkp3L2TwzC)!(CVPuvNBhis$~2WQR0d&`LWaPZ(h?u@Tn)$-GOqxj+x{n#f6 zrCg3cg>uMw4oa8gz=^Q;qq|uZBR1ka%Wv+_Sr|r>|l4hjYK%wXoTU3*1XZQ*906I4zCE>!rzP zf!A3R1*s1`iwiXUd9HUrt(&P5scbM0){$`MXHjr1k@)kslWD&=|)$IC+Y&WRna=<$GN% zL;^YY?e^r z%gWvwKzzU7L#@~fbOMYA=Uec4Fst`9J8oY-SO6=lm-RW$Cg%v{Sf|pX6Pm#1mR|h* zhgW!CsAR=e&Vyc!UO!3z3}42zZXp8MAvnchGv|N+xkmrj&a8uY@Brs4jT0Vb_M;5d;=quA{9yE8O z1(>G%=X^5Q_&d)SQWSnm#n|@7yMu^PY1~nhx?mV0cmBW^z_8}bQ{yIZu`@Stx==h- zyI^%*SvPdQ<<=-9pgVWdE#`f-?040AD0Y3a5J^>a+Rmt;2*AYD_L|jLytRPMzK)2? z9?XLv_&fenh2nj&dt^L(1eA}wvLE};ncr$6pNGWU?&rV3YQW4_*|O_QIEu$oda)n~ z;yOc7^m-3A-P{_kCsuS6hLm*_|P2mz(ZQm8tY`obAJZA zO};M{n(Je^9bT3xq5>BD@`h!sN@uip7j-uN6+%%)DF_v24h1`~**y9tQU`pr&T~e< zBjxcV5QxqWH&_Qb;rDL{<5U<|i@*F6GMHxsM!Xkd_wGHUpmZN3k78qK6E*m{?TdeU&27}A4M?$}!Ju@#nZIk~`ITzd%`WUg;NR!x6pe6zl z*?^c_sHG=Iyp}RX(Rbfs9rkAnr%CCo*0u6wD_6^{^Yin`wjBBM*4&D*+X1bkRXO{~ z%iBDs$#26}^$|BD#tpkNA0gI{Ga|%puQp80@V+Z6#o5kS zXir|;#Ox|Y@42rSWUnONuf$R5`0U~s!pOZ6>-C_G!#_uvcWkB#{k-k>gk1S?(wiXc zJ@*|Gv;4Lg1ryEY+={ln!VYZTmq-ELw?cIm?G!Zst*cmqKWh6kVn*|ilG`P< zKQ|8>$|tDfJetO6UR_se+%y6)D^#!>S6QTAUGv_BB?+{G!91HWFxFprBQbR{JA5nl zu)VIWQ5r>->jEW$_$ojq?l&eD#*>5e7ZtNdK}&G-MF&5Xv4P^r)Q;`#<6&+ZoVQlj zdMYXXzkaY^D8cyp%j6g0hV%ceQ(01=M~;VH%xAt9tL`rbICh7b&?T^G45LXEE*q*j ztVi@$W{GL~L2nC~+;!3dt|hmf)PqO`cbgK`74y}FyROf;;u&Ro)))8fAG>>B?%syE zzX1+UY;0T{e7DN#9c`jpNn>n%o4}B(J6qQqtManfnz!W->9lF8M^d+H?%2~{J!H0B za7N~TyBmJ-OQce35Ash}rbCPQ#yl(aa|5`3y`0sn;n~VI8fp%xjkrXK&BzLxQ%=QxMPgb=om z%ja5J3ZPJIDSh5D0y?FTF>-cm>M zj()ndM$E-IvmzmqFZ{7hz+_K+w1nZ)D{U@bHk6zqEyz!DJO@wj2R(|2o0MAo?-B-2 z7T*4tb1l-oEhP8+dHBu|8$;Ygs=&6AzuY=$x~A(SuT9!UP!FO_YXLu;ZxGU^jiEZw zsUNAWbKBk!QXflUADKCgmoo7f>*5w-)G!@V8>xBRQa_qXDDFZzkruoD^5;R*f<8*he$> zuU*wA#-!kL+uc|9$+r*d5BGx_?E9{FL$a_z(HnPf=N0X9_%6S8{qnp}C8kCpmm_3a z1~RUv8Na2Op%zxtW^^8`$rd*AV&M2r3A{-)_VZEoy3_qvu={!^)IFwF+Ty5|sdP{{ zxV%256{4|!|JFHq1UR}Ov9SA6{?&LRVw;2Y>`=G*ZlXZjkcGK-XH-$F(d+VlU|^u* zqGNg45H>C-Dl9kaAc6E zTCSC~;GwZg8dmbC9N8kN?ESnbKtTuN{vKO+kPetF;^gIv$lk0k)0%piF!+;ds=Yqr zcN!W2;RRcLHsr%EP%F;MH;Ff^7(YQ=7>quvV{~3^KXb+x^S0k?9$sGFX2LIwbLH^6 zzuv60TXeBL?15Wp6wTc&K^w2`IH;)R7Z=5M?!AZ3wfyc!Q)9zus~;FitrzazW)z6? z8*qw&PE18#>g6%zS*|hrCEOSO2aR4lqT_czROee{P%h$WT1d{aGoC6c`RAf2y`owg zs$dQwF;SLGQNNW~21xiFEd)_X)q`T`ZiAqyJ{QxqmA3o)`-l^g#+xOQhoOTrM#`bk znR(FSd5LWTlAoez;#-jRgMHEln}=@WaOqg!S#QMLs#W?BB2%dTWOE_E?kG3Mwy zsC7$qYg|NhGYp!`uQT9o^Z%RBio`-b=1)s55M-=UMf-EH^`D13U01=Fm`nP$owbNP zlnFc5GxM3k)wbyaliIBMdo3tOEq9D-u3Gg)YupYOX6^KSYDcq({0SsGp{v8z_j*uX z#prUzGM?L$f%$^wUju3u>Vw@AH~|620=d25nUqW>)I4CV&o#rL>+HSyvr^1QT(HmR*n|JUY z#fb48ezQaqzvsY7IMZ1K$b~KHMpqUU<8K^E_LQYXj4#Y(xBil!-DY6(wEZk|_Mopb z16-8Kx^a1Nx%ei6Q!?(9^xf^O*xdn%*zL8HUDf5pxjVpZb~yZU;g}+>34HT}B3uzO z;!XLb>xash2=+;MK~E*yA`P@ht?*`f;v`ULxbUB7&5k5n`f&`ow~rHr%@`?QnBkgG z786MQb?#10tXa&bar&P;1-11cJ<~Af6z!~4%+`Yb{Q^|KAlv7+8tjKE)_FOy99SSJ zXkzP&1YP*-{w4BpUAfCYXKBZ{NBG_0Ub7ndG>&fnc5$iu;}Kx!WBlrW^ID(}LV`UBLV zE<4O{8ev=-WVD!mo}(J$?3O-Du*1m^*{x<#8j$Y%4BS-0RggK5n{^1`6O^gbE(Q$L zh){xZHbkHi70nyp7sj= zePc<8@t11NSO7w7a(&9pzmd190bZ(7PTBm?endapb7yEwi~cHAmM7QFNxJ&;dSNx7 zBPVVwP-cbSt=|u$G2v>|)KvmFIYHgt=;E^&jwUKYVXf<7k$`yy=T=4`%~Ox%sOI|V zBxC~lZWsoE&(71z2()x<0$*VfqHtkO=hq3(a@7sC*bBB`eIw#Ltz-3{vW#3+S0HgR zauV#q-eAg)s>16gO0MbCJ)wG9eC=-7xAC1O*W?M?D?Y61eV3~r@%yLwwxUJ zUK5rE(7Gnv`FtL5q$D7*N_6YrPN`;Yd`I#AtlY+!|GDL&OQh`)?A z2^Y`oCmK>JH@)9DAphH-^1BWo6?Xc1z-+ZIiVN1_Uyw%oAox#*P z>NHF8H+UeZG(20X?j}W_fJQ6UwSN(mxsWjmj+dh6UHs!tPk_U5@*`I+wn1iTI^kF$~F0;Hi* zRqwvk`}aI-jgGhX*OPuR*TXN7;w4|+eQh`9D9b`C*u!^HDcD<;mm|4)MHcdtx6dq` zDNK}KUFUVMXnq^|TMkNoR#{pOvyD#{Ia2(S5c8yx<`^xT$gBYK*pwf6Cew*H^ zOk(5sEYvD)ZS+WkO%^qqincUU3ND`Qq3U%A#Y(6*sVNyW6k)|oqw zJ?o9!;VJ9tA^oB`%^+(j4Tx5jUrm3gjkuX!k3nuudo3wq; zsqcKAbIV@zU0Ii+?V|Y_8e1X(Wv}r@mK&k93--_T&P5*7om~`#6qaF`1y)F7@?Z=>NK;*72F#)}qK$Z9(MC0W z46&4#x4_EPQk3M+6rQY_pWl-O6uE}cu4~Ye_D;Esy8kXIzAb)(07%9XfjgM%R7n&< zn4+4>=6+b|#q_)0 zJ1{2`YKROOlW*6TbWHFdhnQP;Nimc6@2pfN(B0C1_+5-9lwVLx+cfs=IcaB1C0n-S zA9S-a6Dc%qX6htE{QNH2uS5bZ4z@5N&%;Ky(|}96DfUA`z1hXZ#fSaI`^j}9E-HnU zb?z_%(W?2`4~MVxXF~z?ww2Oz=9N_6moE@V z^-0O2O+id%fQDTSK{8(BK+(%NoJey*V}jI>bFH8b#e$GkR+<*{yz-t{mlU6y@y+Pt zV{g~B*s@rWL#2O+kDpYo%*a{?c%=8OTO9wUqaxP7opjh?f%}LPPHr1^p5+5Irr;`&Wvc)zTsAB zOnvX0Co}xk@S!w^q!Ht=CiKsvPm!*xqy}33nce#&t7=LDDk-*kbz5>N3P>c^|2HE6TCZp0x>0VzClv5n0igf%+Pm(LqG`7< zyXshmV5G^h5oG-J3~S08@OE1djdP~z3sQd*@A6H1CkAV~w`exCW`Z`41M7) zy%o%^mJ?@*pZqQ3IRwoe8@wk&s5!6-LJw3ykZQ@l=|1>S-fA7-fqmczMq0W-cYOLx z)5XHUz(j{NUoO>x97%~oV43sl=-UVjIo}use1E+nUJBcTgM$i$ec7l`@WtjRms^#v zURrt>pr6%E4-mHfHHj;8EudAJb;8ctREkaK$BK#%khBt64nEgmVOR7yV+r!n*WU5;tUK@B)rf7aGqXQFLy@ExV-!fl zQz}y$uyO$y2`*sMRDSjViGLv8nQljOontq9D;OUUnP=N`Ch(zv5rcmdxIeIQaNeuI z;l{uaR$eD|o$xM~@s~<>UfUO!Dsq*h629TM+BkOo`f~nR%FC9c;Z}sOLhIKBjNk2! z+TTzx-c8t1aG0Jx35|U_)*5u%+1bf@c^QPhf?mf-ssN$^eAaE~qrNxhp7lEmHVkKU z(KRxVDfv)A-4IS@$K9TjJ}${bitb*bN&VFWbM`#^rentxsWwi0LppMTFqXnc3_U-z zE(u9Xf*6^|+d0_CkfWA~irTZ03oGvLmMn5njwypH#|69mVt3nKhmAgPEszwZ^q29M zbN8Ky*)?Gw-v@JU!2aR>4C)Ixg3ho~0fjh*u3|tU!z$u>c%L>!RleuN`>#(&n2$q$ z*W81Gg$w6vo*x;WW~ryy&lYyuhEnzx<$e_39-m>dfxf+i+vl{-z*%Ob@xx?yi0z{G z37_Z@e&057^>qI=7}3o`Ez~->?8#g}xF_q>ex=BWX>D!hq(=g&8` zk*(DkK)gb$j8KY6G$g(ne*k7@`NTc*&g%`!gN*pesN?X(S3~GLPD{969BnRAtJSS{ zoS!K;@b!S|fXT^ce@|(3l=+$^LXO0umr|EUI=W8W$ryTne1ny%i4QT87cz4_^;Q_JV$^Vz z7kv%lQ%3J#o%jbR|9j3gMWIQJ+$1a6+q1MkvC*&iJvnT=ZpE69dTVCg>ahOyUfXVd z?;>E1g^O2c85~pHSX~MahApiY-5*_RI5edFQCILb(aho!-P!N%o(CiYj!R;as6Dx` z0-8AR|77no=k?{cCDOUy$*ra*>=x3J6v2q@XM)vLd2!tEgC+|{$+XMUUJ=QFQ>flj zmnh^40PDX1H91->m1(*12H6?ykYdCGgMCc866(8DdIfBzVCD`M`o%DN{~QHQmRtmV zoF#YaOhkUWwSxd)xkI5CrP~Nk;MO7!6sb6o)8yM20Sb3>^}QLr{56-{#dtTo{7n?C zs^25}&!D52DXhTt+YOK0 z9oO}Jb_>dJsYa3BzTH`fx=H7sA`G@~`S+=btESJhLqDyn%Z@J%Jtjy;Wc}PgQAqZv z!US*n1xBGsRjb$6)(5rW|wt=~j|282y9kojwCzjYbntNK~ zcQe0>Mxqi1czxKKbv%)Zuprl2Hi6iQ!6vol_Q`Sqm}~0=`pQejk4<~QqD=ud+5(GtWe%>xuNYiVuH#hs{KujMuV*^QgVq#aAK1}yef=p6&C+e zl(O}^gk9I!`bxXHaMSv7H*7fAZiF4>#J_Ee?p%-6^>gX)$2D&nSj7i+ zvgb67nvABp(?(3mCnu=ScJ6r8?_?k+O!tx;syO4RDM|O&imBm>pbOk0Y0AT`wX@~= z)>?fLV?hyf7kURiLn1G)t=fVb3Jwyvk<8F`8BI1!!(k`YqLf6ik{}USDEs#J#|)Oz zUyOB@&g3S=oMh8~B60`EH1j%k+9_yTlaC-6DUjKYTgkSaarCdvI zlG?9POpK1IPjc!d=KTgIPM1#l7K=pwH#|+(0o=*Yz{N|NqWP1rJOjaj;c>62E4qdv z)?#Cng-VIzOT5DM_(!=^EpA#oD~5yheXiGIdTTX`_FQUpd03c~=0#C46B{N0q5@ws z<1%IVo>4~!0PUG8O;v^%Etj4qyT-{Gud*I7vh9-l{jSZ_WJNsviWe8RTaq5pk;S@e zS_AyGy8@E`!HTV}lhEcDJvMIpo?bD>Gw0t|@^ zux-nSjo;+4J+BkcRqO7Gr#joIrXr#w!%}ma)cQ@td!TB!luaufPbS}>td)5a2htnb z>u&2KQ}(z>&HWO3bdo5+#3i*4UwX!a+ErO}z7GjjNi#85@>2OY1wJ%WQVA z=$G88EGGuLC!%4e_}E6lYO2>%fzmB8qi+n{Dr$f8+W(Y-iPqqnO!Ps$Gx4?!8D z6$O$xl70yFulK#zBt{U5&RcJgMiE>=|h^ zc^~8D{U#=LLtieL)a)~ERfJGwVUn;MoJqZqe*(UNbK~w5k}=uQOT6`GYVUb7Gu+~; zaQb`u2mLA{Kss11uTO7!cK4j0uhO-tZ7Ri!K`*m+yN=z8T3>-RaMv11`xin%`?yc% z-1RasF)KOA(9xyY9 zplSB!%ZF)ZsA_193xA}!fd8wnT&jS zfpm5{>2_4*v8%wxcfJ*1vB|NZ)Tt07!eM>=x1u+$R#q&*Euf+xikB_^DqshSL}K*c zHs)VFuj4wHYvMkj$e(EYUWexC{aYu|j)z>}$3?*#ibN6IcSFXTN+>;~d0lU!10+Yi zGMPIJx2s-r4^p#_ah$e01A4L}Dk^3*3NOOWhE5rU)~`ihU+Ps7NV3xbH*3B4SAlj> z@)4y|+ZA>V2m+P3D2U!0cH(S1rqVx2K2FNt4EJAs2#xlnSGx|NbIYh=R8_AwF?3*fU6Ce~`ZC0k+#mZ=^+O4F8_ z^It0Wfbe^<`wf2gN_i>s3n58ZS4u@C6tDUAq+T1~~ClD=0Ima&RL0(bEFboX#6MNe`L)3r6I^G z4(ZIdzt7?A8L5-0gwim>)2X4!#%hfW!MuZtxZB@vPRWz&^)@n5KlHl1`W?M1o!=f* zLGrtn?Ze0Y{SkKPH1%aN*l%}uIR8+{%?vt*vi1Ddp})t2_`6LU4yc`)C79(C%p0PV z!aUf$v2ya;r6nJTnK+Yfxbmy*@HUn_HiZhGh`fBJpm<=^wNc||B|Yxpo?p1G)x;IH zudcBLr4&#vS=h6=xW_qldjMaB$YDGHthB@&~O2D!(?=e0j?KF2u^r>phMF9vb3_(lRY*y5VEqgyMo< zrO=*;_Z6PD2R9k;O?YdpzV`)owC`cP8^>^S@8xinJB*$cEjKLR3`4b~nHh#w!ZM!s z5cjyb;BnT1Bcecx7&#GON9&LB0j=~#!H*$yGdiVVnmX8J<{3k#{Iu&=6_+{U<}}gX z?O=vg`Bz7l$0cLT0nEEq6MSFUPe{HY*F;sOlQF$0WcJ1L6G*uG!)rGOCTN{$%css# z7^Oc6$5Q4U&f5}9Qs>@FL{WfBl~uH`6J@&ck5aY(z4Y&{-GIoYXQs@}+1d9*{mP1r za6iw|L^_GeL*-oN=bubkH0i4T_9V#azB`#=%~uWcmvJB>>5N6u`T(w{Zw?dUmPjK^ zOppJ~#N9q3jIAgc=NQkI@P}BHbxR{`oweOJOKfLgV#3_bO=cDSRi}M6xk-pbFUn^t zVMVhfDN>XW@N6=rY@dpkOSSw3l}MAeu8Hbjx8WYvvr|Z+BH6_9eTHvit(Ql{E;p*T zu9i8fR^q>T6j`M8ilQnC>Co)hznBhB8BdFOedOS?<86*u>o8;QzBI4xNgq<1EUR&y zE*OsJZR`sXUuD?t zw(?CVb3SUpQ^(p&G{3SN#W3}Q$PBxsS&n( z9hxa8(XC*#xDJ`|a$~l~hb;-MH5m(8gww#ndM`P7`4|p;G`PJ%E^CY4#-#)xak2OAyrvOI<7C`5{op^Kc! zLxRr+nat#e?|7e#e#c!GlC+b`KwRR@Spv8g=j0_Zd`4}yuGy5 z_uZUGqgpQmhV;DP(%oL(89MzfuGVoGjBZn!SA~YH4j~&=pP+Be!&c*sESoc>QBh6@ z#wv8Y&$J|W;lxkz%fuvvcbpyzr*K$YhT{L&mo>NCdV1;}*%!q$YXmBOqCyn+ z$HaFB{jFtg5+LE{rqhmpKXKT#eNA`MWT8I88~-2)ZH^Bwk+X3btI-(&9|ztI=Xq#t zJh{~TkC$>kdg*gGJ1x>nQ8N@A*f~%HX6;mh-QDQ)1{chx6GXnMjMhK)^}UumRTOIlheb5AhdoM}KuD6Hlr?=+{lEV*% zvbs>-Vbj}w@rBS|#Qp-me@`t1v9LRP>jv5In4pz=XRn+%?}{lyCa8<1CoRoz*-+zm zI1te8Zi~aDdGY%dY!q8iMS>-VOD}}$t$UM0oJmJ92GsX>eKX>x{4h))EcYlvIm|S< zpPpfrfEoR5sq&1sF<&ad7xKSF3X4xqo#nmJ2iUc4zk*EMVvJlamd=9y;Q+=XilXLy zN3PCxNA8Orte!Dkw1$bvKk+Yf%V7#Me*YyaoK^Stv@i#&8+z?%e%or{NFVmG`HCQZ zatDizu=2a63 zU3*hcI=e~CZNH}-^f4zBJYH~?EWS+Dc#}5co2g;L8 z2V25f2HB#G_!16p_2w3~;zUh8Ih^C=V#EU6|7Kx7;ha}ty8YHhBSrMOZ$-2R`(f<2 zz6;`=PkN1w5brybKLK0XG|b^%H*5LfOjg8m(+T|Yjzpe3v;y$ibXV|)w=6)!HFB4? zaMMR!&jQ<7+}u`6Sr8Xr%moC#IK9vSuf05;)Ta`g5%WDeI+?Akq6buKvabwpUo|K5 z?CH+VOp`vBfl|B17LSCMY7hYu%YEMutoG-qub3!@_m}#Hd4b}N@9&%Ei!K-#q7k!~ zikFJH52-3PyxmNn{TaxfG;^~JB@1e_=?^IUYTf}4Czt?7V%pD3`+g^#%EtBwTo!*b^~35{bTv z*e|nfNHCnEWSjx>i#8;P{g*P}>X@qh^TcvQc3u6)0era|dgYJ=jgBB*IxU+Y>ggzX zWS2wfjLeQrxH)4e8{oSVl3CL;)_h(h>v^-7z#`B4OkA!)|DizjQo%1@59<5{1q~&6rx1i{2 zCroGSbtwM)@6{d)%fM1odei@pthWk_t81D-(FB(eTm!+~-7UDz;O_30;2LBg1b4T= zWpD}Z5M&4vAh;7;1DxT1zjJfW<-Xkg^y;pvRo&|Xlr)CbL#Gg`Y3ZQdEG;v@1ho?^ zLzh(E(-m{j*Qo#2qiko0AMtEzp{u{+C};uqu~h5F$VY3=OpO`>_!f|hV+>WYOiN8X z%?+!R6*nGPh^iIV_CL~ycCIW;{>z^X>_e6R&4;GEHXm9iBPFCYDuk~TG|!nUIAcgecy?O;u69yOs5yo3awTEhdmTvFEYaI*WV zW|i#{y+L~Q9}H}pNCy~nOiYo-z$aJ$(?~q zohrY}@Z_W_4OWDI|IRjhl}=&&ZY(}8=||pd8uOpj{l*wzaXXV}Y3Nv96CM2^W5)9p zc6o(#7WS}Q2U_ddYX#3A4xiUW8IILa$QhkEW zrsDGum9pRi%b0)bYs*4$YQ!6NXCo|E9$i+UQcmw}zMc)?TDJvWCm=O;t1YA&IJvlJ z37b-=5ssR7XKQ3b?|K1NF<7RPeUtvdFUp#P_dpr!A8Fvq#U|}Kv?2y+ty;RW|Hf@2 zUbFXuqY-Qr=EwF~yG=5ekrryoll8 zea=5fmt_FEIVjA!fDsmb;~B>30_SbT8p?jh@c2!+eJ{+9!E59?BsjO%KyL0UG#r8% zA7?^4Iy!u?6V!%_=K6~=0D;dl!#?6qj^6&tiqBVPi56S)-Ud%jV6&OvSS}q~X*}0h zeO~@BSDp-ImibHl6v6vP`nSWYbxNQRc6t+y^Q);GVW46Ouu;>bh1&YNB_nr%0LuoB ze_R1hN9pGfEu-b7_9h=Yp*#^0-}Ie&R7cl?DYQ`{_&n+j(2LU*=Zl72N?#>Cy}V^~ z{q%L4XsPw@^I_6G?&rhnbI$+Gg5|=buUH!}E=(@yP721YwB=~%(<7n5JFwrz z$th$I1Q7iDju+G>N%^IHsnK+OHa4jJ>+^tjArnlKIPY^|3v5UlWO~KfhKt zzRbPb?E}c!VIG{A*X$vbN2Vs%=sUv_pY}<`g5#apm_oVv=a%pK;i23yDLib3%0&Sn z7kmB6&!5^-5Xzh7Ir5XnKc)lkQ8-0A$JhtIEfa}`|}3e4#E=&k{b{iI86(M9$9 z_lhtP==tBCxN1T?Uq?()wFHE#=yH(34WILH|c*2JY47yV;eQPL~F;HAG7=Ow!LPk;6#WrpY7f-PfKN3imFt8v0f>y(RGdC7xEPyGtfn={|G^o=yl&9QA?E5Y7U4RT%Q;i?N7 zjtaD&f6USD#_2vU)Qn!zpTDeieaQuya*{h)tQ{+a??k_VeX|Cv$H3Y4{jF19W-a$lAY7JsBf*M`Z~fePCj9Z_vVLS z_*-8xrxrf`s4U@?@XA6U;b=p_<-k_5egHyL;OjUJ>T3-}(8hcn^VUHn`in&?had`` zl!+yAfJAd#D@O+of0(2{`<*lK@gvr71p5?eHayl3N!M^nv zU$JeUxqCFjp{G7yJkiKKzsMR+&7`M?cKcEC+DK{CyDcf_gA?1o^5I4Qh%7H*BdABE ztp``6X?f-02fZo5x3_-Rf$-5)%6-;XjM-^#Y;6ZS@P5OR$HbB{hsyYfN%fK#A47!c zU)p}B$Zq3W}jT* zpfS<$@o77dBX5eo1t!B@FIc-I?N*rP0|AlxR?-)j3YTVET%;%CIM!b4Qk7hO32T+z zTgYN@hlQ$2myAq)8J!%|R*iHw^IjZU(H5VM?Yj-BN;TT6flaz>h2C?g$;e<>+*0w178+V*B>hgq`zoeJUB-v>q{ZV2h+f9q${{iZih-2M#KBK}~9bhxze z{x6q3BqZu{F`~VYf%1LI&a-5PxR6l5)t^7%ab-m``dXrkK>`_SupJML7{t?FS>H9S zcPPUa;^t6*Yg{@Z@#E|F@zIEMp}qgMJFWQExZ~^ZN5%kyprI;R+D13@{2|?)XkNUz z|ICR(uhlaiQUl}fEbuhJadX3YbVegIEbo5Jjq1A5L3_?R1uD22vD7##1lUsrOQdpe zKBVYxOXHsy|6%(KOj)+aZV|$(p|9@a1Z}Fj>SPt^0khvZgwe+Y zAw}P0pZX??n$s-L9Yw@Mj3yd8c^A8%8?l9jf0?)JU_>n)Fml2*imcS6S8t?DcpZ z87-?1ULw&vT&ne?lf~;j1zr6)v*d~-6(1MDR9^;p%bQ;66$jzrIePN*D{ZhRxa#kh zC2OlFo5B^et8W#k>-VOERdFKxihz3u2-j=&E%n;+MOs4S99(0(j!{Dc&V2E8=gL_E zar`%x)ugW#_29J%2$>tb`eqdnCe1r4n5^!#l`m{j4mDz85b{Upl18@G{YDvM7O^>q zFT;`^?`>Z+$CuWK?}~*pAl6$Wnw)4UvS-0=77Fatt2vXOM4kn>UkZQFq@lWaeX;Nr zF(@XAW^}kH=TYUDs>U^-bNu0WOiB(i6kXvUQLx)I0=Gw2Q}I+@?u!k43_zK^u;lR$ zU0Are*`3Oj{yRso^iTS4U6QbuVR9@B&AVXTpK-RKbY5|5nyqysmf6!2A6E@Dh?+Wa z)VK%1PR+w<&d&o>&DpB89W5=tqHW!lv1)(rK?0r*L17&UICFN{8&9fxjeecVjCU>o znRN4acqC>>CDHy?!!irA|4ez^i`bTAzw#Z}U^3SHUL5νECe-OA-i>O%}aIb@Sb zU0Z2(1yk%`9>;hXV5+pJW`6#UBY=ZNOAn*CQ2N&1F(I@i;jOBsXMdeX((kt_c*+FZFd*c z<;#;n5kHiDOcO)O{?ikOYBF!^86&Km8yV?mgf|^-T8~jntn1PDxupbF;d(6~`3eRV%o!y(S9BU?)hV8?lJqKhh7#SpHgZ|qT#y*ZS?-kpQ&)CneC9uUU)2oWcg z6;+L(l#dW4muory4#!QmHJbM=;>!pjPWqs6%kl8C)KN<{o^;Ii&+Dnns=czq=JUkq z)TwRGGjsLFa2%MeG4uzr6w(y_kib%G{1}O+r94F?a?F#A1c6pyJ0mBsr9PRM%9_lbGxro zws|m!7a_Hrsp#^6IsHI}3ilHd1w4WRfD(RWNrw6xN);~3DLzY;vZZ~qQ0X5F?b2&q zc&}hj=eW$uq8-~cGixK&s7Ll&VEmUsWt*aU&KM;uy@xpaXYa+4hNB z?9XEeF>XUh3_-Z#bmP_?tIMm0;sHAsu~}ilEzVPE=z)b8txirCGK>4Xe9PnJi79r9 zoya<2eC9nKA#(k!R3BAR@d_>?Ml#h>$XN;A`b5qpwrZ$}ozHu8Rntd~FIX0>kQwTG z^OsGYdP0TBCfh(<2w72(Ot#1`^6WkS=sjy)-T|E4&um1@q)tiV{kB|2QwEX%3o5a6 zrl-p3>T=}9M0`zp;DnT}#d+Ad?-vhr`j@_hr;)wDeGh(@^>kE}6_=vhucgp-I1Q-) zWW8(3Tf}U={rMloxLf~z+6^azxt7HHw2?Jz{6OEELygsE<-&rhF{MFVmU#n3v`j7k z#g_Orw#4&G>af@%A+VI*SbY~RrCSK}Lzfkq)%enUh~dI=o7vc}Q6`!mk8SPK(>X_s zO(MM2W#D7olDEW2_G<#n@s~4{3)B4=0SQs!CMIV-`)11ei|ZspfpQUN zt%)Ph5JE}^#q8fK)X<>Xoup~ArC5&qh9*{**{lRb*;-| z4?<|Hr@E^acvX>e!km7(@l_*fW>!jjckZ%bl?c;jvU$`+`%lUsr$+B`ZF84B|m(ESwMA6e@{m0eB|NT6#ch>)}#wzyLD%{uz{tQ^p>2zcU^1 zd|A8d+a+B084A?iSsSO0b#{kC(G6`TAc-lDgf!^``WM@0vIiBBcUY+UJ4x`sj=ui& zbu~h(sVUmEhHZrlQ&U(bfWh|+oW{~gzu$$xBI|33@(~bVscs`3EkTXbTjCf|J!G#) zL?VPg?<#h}GL&XeIeB9{v*_Yerb4q<-49X%ofv-+?0$S;P8ugI8V6NduUj&RB(W|~ z1;x2FzJG`Fn`if8SmepHK62e+Sz8IQ%X{l^r@E}>7)E6pG7N<~bl${8uwGT3X`?qa z98-5}WRjSj=|s-bb8~}%cuKZvYS|67yg;&=a)kNB?G?R(% zo((43K~vr?4nMiH9HH@?9)Y#YWS&huL8g98DlYmChohtFzv(9$ta4LT!#TaiD$EGZ z!8`-Y`WTh%A3_~#SI8;J3uj`}a^&jJ zyy~io^WMs! zfH0nzX{V2kXRD80V~|sw$I0wzbq25bJ^t4WrkkTsQSU(oI5TK@d>ROY^i2i&Pf1FP z?hJ*8)tXNLle-N{zZ1x>ht=Mllhv*+L^|jhPdasHA?1K+0LH`073#NouFz$8Y&w#K zU26d$^+h2AH15*nKF(lhOKh4qn@M-4$HDh+O_xuiWuL$g+hVXH`z}O2K|&KMpWxS= zjw0fX@<;jBkr%N;s4{xLgL}pswxG0t)5NcMH>YdXoT5OYG<%WdMYrCAnV49Tfv*5S}H$xpD!rdxuUCDW3qJMgKP2LqbWVk zH`*O%@z8v+vHtYfafY!EjMmfc^F>I6>`GsU&17x)c)d&dQr9{b0O_?9M*S6H9tJuv z;zR^<^e;N3PWtk>@b}k5$Hfv|7r~;)9(W$h4s-L*{mNUSIM$Vk-M|~~{BrADUrmtY zj`~FTPZ*;Tqo!BgVmea4GzU5H_A&pPwnwu7IJ0;tmJq+@xdNrKJ=0>qE2Gdok&gR+ z6_xh2qS7ue0jbZ@sd4_zU_832gNP4%lgu%-adYFseCVPspA7hi`-QbGwQYRzeW8**am2cT!pQ?4OQZ95^m(jm(C7W$ED&ZR=c}`_PkpIhZ;1|JDY?}lp~8q zK{_S^o&Bl@l+?bSk66M-DU*{Y3x@=KqDIcf?OeD;DXU&W_+STLQ`aCCE}cr^bJTBr zUz=h|nysVW$}e=x4$o}N0DUe^gI>P$9Ce7l+)rayWh?+*N~My_-!DF5ef(V2(t>`OSGuRW-%e>@GcYH|1gMadP)iTiog@x@8x z{?GnTLpB27c8UXh`B5Kc!huTmswym((WR&=4w2#WCg~6oND(A~e^=>}ilFApcI-ZU z23ghJddIQN8#jZyrcpVK>!+lpHa{Kzd;tyNoO6@7d^IqgQ`H6Zlh5@jf%JyM11Grt zacKO>H~DH!L`%4}5E`ypyRvd{-CioH;+I$>C*S|e#2-@Mxq2c#XvxsZoOKjh8=Qii znzS3aBNt^Bx2+cYlU1m{AE!efL@IB6q=t3c9hv2Aa9QiWB=TY!2#)O8V<9jebT)Z0 zubd-v$t(E2f9fmXZr{+=Snr2=o~t|KDW#7c8z&1H=;ktZQC{n$oB2l%q)tD`ZX~mR ze41SH?K^>x<|0pa_}rNE_+`O+IdI&a4U7L%S-+apVgGwd`FqeXRy2d4k8r=o3)A{H z+;&T*lV{s!0(I!Opc3$)ItkF=b03qnc8ZEQN7iba$J^82fNJodee57tZ4BF&zqAuu z|G@>W*W~8RUPudJrY2( z#oc?NvvqJ>-jl9EvLFDO@h#?-yO$LONFhXED%mq5#K`>&++E?iS$(&{W?4VtT+yQNWP+4g znN%+Y#j5NxT~U_STIC2OH)r2O9&h9_Bb5N4svrV{=JpfHuWaBGY2YL8vCZqb$@Y_@ z?Z~~OzGB`milx`;b2<)UtX;>_u}?c@msFB)PMa+dcc{n9)%7fb-G5`;4`YArbd6eMp07^CqC-JGT#y)(Fs*COJvc3A<=9R>NC`q=keh*X>y0|9b<7oV^3^teU$l+$hF%t zxxd&qSjIgbd!>ReO26IAVt#$>lucaK?bV(ORgA7`$5BG(-K`)InPuT%r5-QI+5omM z;>5;4Jr_>hkukH5X9CX--(f9Om4f74#DwBZ8xXL0-aJr`RNy0!aCf(9!Iydh&VF$@ zPg_nXwtv2ckeb|WrrlsC|S7IR?qu0)WLfa53Hil&>9j8ylV{r-mk1` zK&8c-WI?g6n?qM?-0~sEr9+;F!omh`E^K!tCsY*EzInN_@LuYQezTP86g!XTXEu@~ z&`oc67oUh`Rt`BEBD2c1{^T=3SXH8rYE${|T~pF9%$~WW5A=w~jZRd?*&(GFcUL7% zOY)>$Q*>|QHjqECYE%iV-EaVyr8b5+5g8e*r1rSM|Sg-~9K#$Z25jn-qA+TZW%S8;znPz;6``FZA&2hOeorlW$S#K-X zcA(a^9*k0V+*t1TMiVvz(8*T*hjQbMfJ)P*Rlni0z`dI*)A_}0pDZ7`%I<4znnP{E ziX19ONeSV_kAZq3XkSI%FQj;nLoG*Tc?)BN@USYv8>JdlxMcKK@bL%eG^7IG(A`)R zR#i=O%I5sZaI7?~k{Co`{uEbeRb=3auUQImyV)7lr`A*$-J|}Y0o4Yp1wG77i{6rbsV)cn z{urY+h&qLT@|zw3MitJ^aAAn-jB|?MUC1y6eARo|>W{ocho}bR@v?X)&KTZVCzCtW zo1vSEnDtk}Qos+Dl1MwmG1!W~R!^^6GFP7LUY46YXyvL|We0O0U0?M8V?%$0FZ3ND z5nu`suj6}iS|=5ulgYAN2P0=5HlsbovB!qheU+>(1(wQXdtH8qZa3FG)yjI`i_x3} z%)FiVI2c}n`Ygi)!Jtw3-m^Y{gaGplhWQ#k3Ax2_y*49L)VIRAsb&kk5Os!h6ZMVn za&BQ04Z{tOhq_-GN_9VeALO3M5EeEtSXo{27a?P7Pi3?HnuPzs0_uKKVUxGi?LVqb zpIf!zDwG4^f1D0HE>a8Fmj0FZxv-_{x*#F2c*YL$xLU20=JLB6P+^a8l;uPxr1K4m z!h!Q?W3=2pBP0SmD-)uqD+o6q{Q|qUn-+VlLaygg`Bb-Ro(wu{gYg4cSj%x>VJ-hQ z<^9SXkV5)WHvf#BdLbTnq}8Nf<7pjZ4zQO2-$FzfJ*d7D6rGaRPtlv(W6imG{~+}= z;CQMQ3oTKu^{pp?uZ>TqRxyiL>1pjfQPxfPIs?i zGypDcsdcf(;qVSy~V? zF>!MuYb}aOfe&*9L8R5W_}avBD`8I?#r+!E(1jrw=b19avqN{NaSLRk@va9ZXWR|{ zRe)ATCp*trb7-C#_)Pq$gjmz|f zCWo>2R`%Up6}bmL#ym<21?K*$VsJ;QAQ6ctY$}lj>|Dler zXj84q)0S#BylGO{dfi~%uC13*Wogi2(7gVZL92)3b{6Kx&H24r9Ijui(u>qchC&7glmP9EAc7ISa7<6jU>``0&0e>hr-It(m_IkZJp z(V)OUT2vX?pLr-#Qnoq%=B?<`d*=ILbE{vO*ShT=RS)V?O;l~Gnh3Gr&~z$N!lJ1B zTaGJi(7VECq|9tWiIE_HZocHl|G!vAMuS7f(n|JdIC09qBPz9@l|9Ak0geBr8aa60 zN%VmA20t86QdWP9YV$!SQ@fnxv7Du;V)R|CWP!De&MuJ>Fe7`N#8f|%Df|0xsSks< zl;k8D!^-rrwCIK9${4k&_^bmO=d<1u3eQ3Ine(94Z<)AEU0{$q#P!iIB`CY@Yd& z;0Rfv10%#UE^59ZYoE{d!N&r4P1%ZB1q?0amy$3?kFMU9N=2M&Acd;h@KBJN@h`Fl zYiB9ZV_J*_&c{VR7D#?#F8UKuMp3q&AK=FKfZv()Mx#x=-+sNR%qba_ixu~!Z;uL1 zkN^?vtx;Ay-)zT8r$3YG%%$+dSTK$&;*A4Vh?%YR1*TxhsBV2F4?$>j4R_DJ(YP=n ziA>TALYyMN{E0VK#Tf-eja4*G&PF^XcS$<*H2BDLUD)+AzX|{Ge<;iL6=m7}Ed2w^ z0s%>?a`g@F^IsBz<3{P{RmzZ_pre%0J7>ZSCQr;VCOH+knJudPuhfbp;q^FGf8-;| zz7uQnV$GEO0Vv|Tz^e=vAaHUrzSCer`(u6Xv$UT+Gq0Oo(c|codlDH{WqvUuNg(r2 z`Dci$j%>spGy41Y=k}>YFCRvB9U(}+`oYF_*gE-cugGsn5}gL zLPVjNoCYi~Q}ef}dhhz;o7Q|lsLwmld;VKr68I2KdLU;3u0J{IjdT83CJlXivuSxPl;-2jhTY7T zaxXo30F!KKb!06-r71G&)I5>};1ASfaAzs1>+6Us5yhl~F}o$f@lO}Y3wngM=gA|~K4VDcrCJ46js$sA9$+*O zr1pA;_pr~`%OFf1B@cCd5h- zeyERlZW{@4AkgBYsAJkBu(5IG!WqMXjgKr6(6G)inaejP=Rq%hmKZ&kArvtGVYkhOk21Z?Ug?20qNCu5Uc~r(m(anO#-{VdZG6P z$81bj!w+#&e|6C<7MA)c=cR62j-Qgcjl|751E@Y8RH81uQ!8uS@D(A!+qXnt(-UTcKi>I&g>nrKMy1#B9Q7Ds{BMmH0h&qlukoAWvE9s3jFL+@ ziC~sHIp&_0^}M$Q32ycKA3Z;(g=Enho!Bx%p@bGTIMsG;HSfdF>M@!v#pcd|j(M}J zN8q8W7Yi-sAq9$3qRMQ(I>?~ASPVq(Tnd`TjD?t*)WD;SN`hasy-h@B;`SST4M@ z=*n^BT5jrXmDknOMMHgD{bT^6&nOpvW}As>iVi+*@+6-WOWWFOxCLZK|JO-)UbP0E zLPmC2fTkqiDq{@!y6QG$c>>P2_Xt8WCx*Gr;4-T@pPM)q*PG1y&CNcMK11qA z=D{=0*XbyP+*kHR>s{gEtb|DimWzhbf)TmMM$Dk79Q@1U>vmjx2#ktj#M*3t%-NlI z$~GSjXiRx2`3R`t&qQo}CM=h2vCOH+9C!fCiw3y9)V$BBx$gxn7g&ibS#@s=rIgwP zPPC7e1P5wzecn%Wk$pYazq7$54NrH%yIxqj@#Pwt`yy&ul`hEs*O8UZVi_VFFr<+P zVM;J6EVj~H?DhgbWNrR($2Tn${k^_7NwxiJA`=4YMusDa)kWlEsWn4~*e}=%k$TKq zwdBMN0iBWmIGV98$ptm`w0C_z*h$lWnu-#;F=W9eb?_f#GHm8YaVYq0r^}kg@AC?J z)n7rcx~WRR>qjmw3W=vk5;-zgGN?7vG2D&SRRQnjZ5Rb%h;!xANqRN=)!~#cU&a)D z;~>xRH%>>FVX?31um>enm`n!h;~`8}=b{e2L4(xy;Vr3iGn)zyw`oC9f&#RoH*|r6 z>466*3zVGj2pJ=iPxp=XSS`HX;uHxP8ueNkMKdUd4A%9VOz%iDO;WGWoCNidlrSru z(ygDEa5O$VP>V@*I3+Sw0upf`W3yF%)lXRdWWmLpk+rcq zGn`;;4-NV%t&qMUg1J$59{qG=sGUo5oNa9%)5>7+XD6+FdK41z&;{_^@tH7hXu|p= zVG)s2tr+5P__fpBR=t$Vsk~XC%M_Em4S~0HPLFD~#yzI#kYxsX;2T~xRod9$<8tY^xV9V`OVwb@@ONzxp$l`oQ6tbCM?FK* zDRxF!1U{e8KplE=;xt}~K=h17^MAboc9ALgn$d#WOQx{e*cl>WCT^&7v~H?~QN$Ti z{*KX(PMmMx+*gQXYG|t{qu}u-AI}+%8=c|0<3zH@BIenbhf-Df+orxLF~E>zR{^<$ zsZU{!jq=4E%(Tz7bafj7ldf*zje#mKuzL%Vn8-q7YLZGc zcmIqbHhfi<8Lb8-z@dZfq|X@9a&#(Ip`w4Uq+Q0*5kJGK6?JE_X@UEWmx!Y57alVD zUlBpyy`V5i*A5U}20Ii@e#2rl_K0-l&tbFe+QGb z3~MR(CMGMsOltCEuigPOu_*X=_Ws50k7Db1($SZs+)wtP;IWiCxh)#vzP_E{23q2+i+sa3(90z-76;%fm9jdr)nU1v7NE( zjyR-Xv*&_o3o1%6%HzO@-qwleyIB(E##TBY*QR>Y>Q?w;D5j^FE~CSt<$GjhPmA!< zH%hEuvr*+kN&|FVEoke~qX++y)cp7#|FwOU6>QI^7GBxOdjw90ZlqKuH%Yhg#q8lE z`@&wMwnTGZCgPW@$KSAN-U@|AH|?i(Y^vD;vfM{c!pTxXzP`%fVqP9RX%h_JzJ56AqyW0e*G4S;?Q6iyz=}7DUAlJNE68(|$ zo;b(aFm6Ykvn+968+10F9cOcyVVXBtsZ;ChbgK^78?42SB&6O;am42%o3Cktc%%B3 z>CbKFya!Z`h<6+dzjs%&O4cT{R8%hQRTPA)BJC3Z{X`6R;~_)DnK(dE=<>E|SwC@f zbgm|Ni?hMjTMc39*ddf0SVrq-Ib!i(&YhMRcQpt_wJl#R;EkfZ1V9Nm@J;wXCq(+C z|DSl)F9$1b{c-|3Fx>|ZNxk^GXKepity6P`?uxNf+X6TE9UN4>DY?LfxEjFnX4%n; z56N7gMZSJu7VPEAAtE5~@iPa}Z*q$3=FfdPj3CpDuMydTeL(!LUbQhN&B~Qb)+;DW zAJ^=^DOIuZRH!1#juO#ge~zJvp*W+PJIJh0iDAaQd3*}2px|u4!cI_^!`s7Lxov?F zpm!0$V*Q-bE+b~(WC0ImRtf{-N{PYGMrJ023&~tH;yKg1a~VY1B0zouJQW5x=#sCW zr$F16M=0fUBJ7E!6Z_gNBCJoXV zq`hn!ovwpj>GvnSEbA@%$sxkktITOE?{VJi5rw?t7>~%e`o~NfTx^-MR59^Nq-Fj* z(ZFtfpDfbfy?#hi2Zt2Ie`S4Uz;BGgp*Hk@@(?)r2XU=Xs@ar->)_He5*_j4F@m;= z5D@=prYGCU5#VvG?|)Pj-}_~*!BUVJ(+-J%>_UD#oE^*9dOPNT5Olfd#@;Z39JpM& zpC683S5upF(;^-q3Y8C+!e&dL3S&|SO;XrHi(>oeI@Xwl_o z$AV=Me9!k$x&rS@p0AI764-CTNQKEOsW3US+Ijt0N2$Y#G*i9P zE_9`Od-H*B5ih2ht7%eI$bsE@a?Ms`S)A;Il5BNJ7zYUsU}YrRr|iAHbj%voK4|Ne zZVRB}KCY0}Ptlu`H2Av`3hj0{qRJf$n$MkrtsZ?E)9H4<+?_1i_=bj%gEo>dRTzME zlG0fVZ5e|@lh=ThlTsyPevmV;sL`9NdRaIvQPS~Y^>6Pye^A1^fm&dPpybA=G@Y0x>(`;6h_K@{EwR6hS(*_1ED_Y!-Hc9!FOW7!9mm+!!sA*jn6t>mny@9tF zkBa?7{Fm$HQ!O>ow#G(jr{l(%LyUxYtlO|KDNDW#5LN=#&EJO*Q#`}`o;KdaHkqWQ z-y}Nn?XmtAU2osMJ+1)s*J0)@uSuPVr2Jpu`2V1y{ADc%a+XijH|P8;1zkREg*9v0xIvg|iy0=IaV5Ys5z@rtfPbilDje)n zBj_OLQJMqEt>9H#JY=lLt@xo(I+tb=NUS!fchIks0+sxg%^KvXZ^$VwTxN!`fkQHpM|r z>@sohA#4(4rBor;VS`^8*55DebLvX8OPK!zEDLD=OD`0;*DsXwKk^{(3bh1^8988? zv__6l6=tU8#BrWNtcsQCM3JmCqs?jvu)dr~BlV}9f%)+4s)j9HgRDM@`r3q>Z1xIK zsAL+1Ie)Rzd~ZFd1vwaa;sGnWi;qWsmRsWYvQ(M3?-Qf5nY6xR$o>3y;{;T$O17cz zKb$1x$4ZD#H_8!h?U09F`W|L2`(F0;F_ljY&7@n7GQAu+D&+ynLI29R31bJUFBQ{T7hM1!omC+J%GbC1uzR4Gi|fy*7ThUS*Bf z4>nv5mA!#hzf2T!aV(m*04E<=11=j>ai`{X$4Wz1`CTx&3G{?V7*`#Y*UB>|oN%wO z1!F6(;`|t#jRck&H2~tJ?cdgdx3JJc;5)6ijY|t9e(?mUK>Azqm-u|yDG9BhR(d

E!BtsbA)M4DS3exufDt_$*1#cZv{`V(nz z$<^xND_`H$FPe#6OQu(zLW%4W@=j_)cQ{z|q~g}FPUN*~LzK z)?Mk8dku3{;;^9@4ld(LK0aAVnJgm5X`X_7Fbboz*`mHuC!8w0B(Oi9WUjLB-`C>^ z@!sew*HBpiGe3k~);wtW%XP7ejlo)8fPfH(A6ptheuF!7^{L}GM*B&6Vq}6Gzr|^{pUx-Yu}N_N z(t^ZCj7kLDCK9@Hc7ECGzgIJ}fs}=p834eNNy|SHA~dd__S5~y0-M?=f7c;k1W43Y zQM3eLv&Eg*n6(4BocH~^_BJtp#9HP5?mqtD`1<^veEZ8;Q4tn_VHEgqIU;rR&x(sg zXig~B%x|9g!__f+=1Uo6aNz;2^fXhw9Ha#KhkW{?r)6Ee?xC`ngs^MTxigcj0c52u z`*(AHR&rEZR`+@KFt@9qe>bcM5YvksapkDuf;O;zTL5F&8EYdE>5| zV)HMLQT)!Gaf9v{9P?}G@}GjT=$Ptj_~H50qqgPyar2m2y20}Hf+sh^TZqan{Zgcr zTJ;5J%pE=JE+%$9nJl%d-YqspdX7B56%T|#I~53e8&5Vk1}q(EExPJkX>f4XbGS>C z4?npZ6AAdvo|m*+0aI@j*<4Q7$<^dx?_0Duuj{LO2s-!}pfD3I{^Y2du5Z=F#TSR8 z{)ylc`#;%J;I%aiw3g1pTC)IUh^fd34YjVhB7URcL_AuleKLs>v-H~RJ_$jL^kiu$ zi<_}g_|i9NIP{{5XCSWEB3Ac2*OAE+Z4gi^@#my&KI(nd5EQ}&IY^Qol#0Tuv@iE` zXZlp+x#}U#O0!k)v3V@c9(I{uolFaDeZf;RN{#^RPG;45=nOjG z0zX1#e=_O)MQOsnbmL();tnf{bkk))3ee9F!_CNpfxM;7dmJ+?GNc|$BRQKdPpZ=A z=^^+@)%#PPhj3_dvk_@ozr;OMNhZ~jYwk2q^nc=M$I zh(o@abBZ>`TevHS_!RsbIzBwKR+&DMSiDLT+%7r;W=RC#TAH6#&{SOTe|(GKwd^v?Of|y}-20F*FVE+6P!305W`ZCwF7^UZG7DeWJm(u{w$D}d zmV+M)jxAgR#iZ*nZfT4pyF=>=i}}!{oRoD)Iit}+@G=xDq@aBa#0WFhI0jW9$?!Ic zaKQJ`pW>4ZtcB(?-b+%YAoaOrP6a{-FJiR4P}L8YOv=T<;5-%52NhezoP=I zy#_^!H|l`%Jj+b>$xAxEOlTvR!B{epcVIQ*TWn`zEI>UJVT@>hFWkN~=@iPS!o|5; z=ko@Fjg8{H;mV2m#a_9+fdEjn1Yge9vSb*$kxGcD#eExA^1@G7Ro3iW2F1(4PwubF z%H*XLf`VYJ@aFc(T>>Cj(aum1$v1|Kx~bHrWnc*Tg7K?t%9`sxi1%tbyiG7ue03nU z$mf4=oZH#fUIUI$TSp*AoX^rxKCu9jIaL_`ePX?zcUG%c2Ff7gsK}_8(hdr(5&!`- zS{aDpz>L6;ViKRY!krQv2WM|0f5uLJpOYX0f;tUs@|zD(xWxn+92*WD6WkigHZx&H zo;1!G8`xt74&A#B82jjoRs$waWqE-MOr@cKg5a-J{x(j(5wWmu$;|`3q|y2fx)G{M=QeKC}(6n<3m+7_}!b3=OX813JCPfGUb!zpRwKV^FlnGvt*U)?K`X&vKd zlCW@-eSANp(f=zn434EQ6jP?Lx}BR1K0C+{rrafQin^Vj`}Xzb3yHjUCi%rkrYT9J z+Wfx^`t+JXpEjn3U>QUVk5T1p7KPqO-99RykLrK~kS$FWVB#Yb0idW;WSp3~;7T$s zl08HlG@GaANkVy89Dt)HAL?_wJsKR92X%6kS(fJQZvC)`dg5^%arG?};QE%RGtAt0 z=>QrAu>e4O>rf553P-0oW7RUr6FnO3pcb(_u~yHGLk|I_tb#)w)75E7nz5PapkSo} zeg(idGx56xoJ+{h=A{8cm3FQkv|FegZRzr$@Q$slYEwW1Zu#8e$IKP$k6vi~mTZt4 z0E{E4ghr@#Bt_b(S<88~=a|+%W1EwFmE{Vhhl8-DN>~*A+9U|BNh?8KUfuN<*?Ae~ z6BZ#`YYm76L*-zLG8mcr`s!=#Vf)=1|7HDWKY2Cz6-f!LC?HW-Acb12wjd`m6>XR` zqF*r3`16n>LC`3b(BXNMxA}!Yf%UD;D@K-6rMekh)2NLT1^P9ub!`0lTRZL|nekt? zCXH)XkE${oL3E_dswDo}$r_H;OSW0X?~il_-vK$Vj9Sj#GDMCPI;or8$Hnr+B?W<@ zxw(G3#FfQpXW?ZOYA^f_f%U!{5tNU;l>a2>&Nx+#!Qjrj%~+F%*))M>w0{G93L9Dc zF5f2r64#0VE4jR^$=(~RJRRd|tfNx9XbEY{@IiZ#49FF-LEJtnX}Gctjf`IT(#`0% z&c5A@LF1CTpzaxN^vZ^jhp5j8oD4#w7YHUT>eaOP%D?p~KviA#lcBnjRF35vavFiW zG8;J1nK}C$wl9K`vCS^a);n-ulYhRc8*%~@6DK-`WOHC4~KTrYKf{JzaJzo zC1Vw|{?Qm@sPu6cyKS3h4E}z>PrJVKXY1s~V>$>Vo$;yqdrGwstu9!4(6)YG|Lq69 z`NXZ`wZO0+=?)9bcx8pRWT>9>Uzr#*RIsYRD^iYb<)+H4&$aDC3nb;LrSFHwbWkeg z$_xC>4kSa+6BDj0gXO-W<8F=tm0RfF-t+$__eH*f!#7T7sz?+rNK6M6MA^k*Ph@x> z@aA<$yNr>H-WiM8npu2^ww$g;$K^VHrPAKn9X~!^>xb1kpr3Q=;x**S(uhG_H)A_^Qwg;8@ zX4Uz_&k(oY1baU*!yeiFcbE&y-Bq9V<;7!Y%t0x+LjU%Ma~pp$pNL&%)RqzLMv18o zHHP(z1}rbz|3B=#RaB%;5U>K;v$WySuwXV6);Kio?(XgdTl{AJ zJ2U6(>+aJ&)q$#$Uw$c(5jSt#@c!HE3FBbKi6(+#Rk?F{fmbw1wRSv~O*HYKU0&P^8z{n@F5g+?A5W{Yu;En{k;!ZG543%O3dFnICafQ)yZ_y2SJ(-)k|M`nl z!rKGUSxTs{kFZ2jJ;?W0`Lr$gY2B!SEK44ay3Fr_=S}kXfp`l_gSO84zJl=LQE}x( zUe|+TlT;ofs!}4S((f7X8}CiiZg1(0iE#5khxfT0N@C8DMUm~T^~5#~iH1Rg@r1y5 znXm=S;)e-3$JD~;%h&Uynh#!TJiXZ6`L~J6Re;Xva#ZouPSd+pMG7#GoUO5S3`|5} zfU$f-MqITB9;XlKTi$r5s2Gf_{}b;wy=#z*U8bdM6bUyVwe_J_`fvL_{Au5Zi6+0G z_zfZZ{kl+=(1#R&H#Ww0_o-{}qL${cr&S665RZxUXuC?#kNswx4VzmcWD0m zk7`p2M?mhE@9?!H<`xzfhoke93ZZs8zOI>yrg#^oa^amBw$v2ZRJ(J`nv)6B&!U+$ z`=~2a+2oCCBj5PSs-hH205~DCi|=eWzo^BdiopQXzVFZv)uK>2gPH)^tX6%!tcl0| zhiurdm24!|AEQPnGhfP&O@r+QcXSLx&=NxEB5pk0YJ6O82ea-=9v+9FMHnDJnhu1h z6S83$&nsxE1oC&I_>g8#4dXrH#=8H3d3m%xxfNQTita#|HzQ17pG#2jRpqV2a$W(3 zLEY+`YVToD{JtMywlHWG@fv?VX}!^ysV;;f>T6fDBsFJ*Z=S1Z`}Y*(v7DG^h0uKE z^4JdJb`LX?#k}%i>Z*aRVYLXXCgLm*>0+ZyC^6+zXPLiGs40|6eR`>t-R&0UJ~W|a zvB;J&i3R4oG97;?cN2u)et?=FsXUu=R`jWxT z%Flu_#u3{aM}-)=K0r#h{!A0P{}xn{G12&Nn{0ps>wciG+N!{xn((CHkhAn<%KK;! zq}j3!&xx>q$0Gut@rZyxQOdvK5h;s>!^IF}6^%LuiU5=9RgvykQbS3Im+hZ49sS{0 z+vQVIeNVWmAt*x7zY@Y6?XlFxqkhu|wHz`a<^muGhE&FfgdD^}cJ~*=T&9?hsRp|v z^wEU(tJRCJSSu-gV}qt^E&ojTTMY)AAp1Kqm1?N;K(#vM8+6X(7;RJaG({K$TRTyU zp!`MC2PuZti6BK+w36pEmNH~_Eb^(8Ukxj=I8mD@~PD=zXFFc-o z65%Yf)tlyy>6s(0D=FhP9XB&aranAeEzW?E%<}e3!Ogn*osV+v%n1ZB6=KXy*ZT(; zU3WX5kD6|*`u3DyRtn5>PklOUYMN6UJp=BA>Nn29xz3d@wX!6qX1+|BKo)-!C4^Ht*k&*$&~#`XN3W8fzXcA2~O4+{#1^oMg?SSYYEO@H5f%kbVWSQ6=iLw!1c> zOf{1%*_5rqbwEJ7`(zC?Vy#B&*uz(=w+sxS=J_)xja8vKy2uCmCmGnw4Q)E&rnC7G z+fyLpfPL$mCkGDv5U@6B9{`Y_Q%2uuu&}5II3IAuMXBirPoI=*`f6FdNqI^Y=-l&w zlIwc)g)@2!Y&xC2X}G?V^EPTW^%E@++4A~?+`WWTz&`(2CzLNu$41sKf;})h@j(=H zR#H(4xF38+h=DJfW#m`tdpx&}jF}uafi^H~N}R#f2ms%SxPf(;3{=d7{kFEUjBA;C zvmtCt>o7{Ap~dqxxycz@ll+*()j?%GWu#w@u&Jg_AsC0c3VVo1`OAG|ns^1p$_jVF zu@*1wZAwYv1-G(;;Q|=aUXCSMwyzPx+03;931Z2&LUZbSODheoVb^j-Y`7njo9oMH z2OlMFhGpo?=D#>ktBgC1F*`=~9<>!CX zcI7{_v)=?ms99^&Lhpw}7sz~N#F4U{NHO{GH#d$5*Ym9Ge%3Udne(NNPg!3@!pA`PXI?Yx zN0={H|CKW+s3%)!8@UC|=H)Q-Uf^|g$A+(@>>0xYTP)hiDHfnWLN#q!xM(OV zzFmZ5`u&e<9`NaA1_&|jf6~O$5lbwM$A6KI>D47l-g)xDO-*{NDXn%2R(DUQq>j*y z%{uZJJ#b@3jmr^4ixD$zC!iN#IF@c&xUfyHRBb=?fy=(GW-gmR=KVLP!vJBHX>R^m$? z8BSy0jfP;Ud?r??+;~sN)ZG$ORQTLqJh$72XqpZPl11D&BiK}7vxAS86{n@VOCnl* zP`m{F$H7s4HBO?jgMn7a)R_Mms-IU#sUC40l(m9f=+yLpVz*g1))MhwSZ@!JDbu2d zn%jf|lg}$dM{&A?VubX!w!nBpq6V@0f)%Gtr=`qf9IC8nVRTd6p78G!al}tA6ET*O z{L{-s2BrCKs$bi)&0a#}ZWzZyU790ZNj^I7gnXT5EeH9P6(O{^)Xw~N0qX~3HnASt z<`FHsYc-n-SG@W!)0cTezZk3@@jS%olq^=wFnq%IPWj@+>@M;_{x6a8`r6n+y$#Zd zd1u!(T_p7pW3%>D{>-8f(^6gj&7~feFCEnZN^SI)mCVtc+D3WB5h@cHbC(HjXfA;< zZc6zi7l=hU$NhI(dN!>o*q5q!BWJZzui4ZBUt6{8-{u{d3j@VMTfQEY(Xv@@wv0To zl+dB#boP;Wmy2T)PoN!#o1Y@57@{w1+A4uS2!LX2_l=32I)?Kz#%|aKs@=|k@clar z@qgWJ5EZ4=yb-zKY+*ZI%}nd!^?DxU3vAG%pyNwI6BV~KYisQd9-fnPf(rut$dEsh z&x+XgxOsU6&R8(r?DTttG6V zt{JYNlCxcUb2`HSE>^U+34p{%BNlMQXvddGhV znU}~wpXU;}h9(PWs4vk#9bp)$s)~yQ!u+r;hn_yhz;YcjSjDnOfJHjbqnt6Z(v1NO zPVi0S{&MH+kH)hp)AS`X!OCDXLvw>IY#yC_;tPZhj92`4@G)u-%L-p_;q-+oRgB!x zuy*r>$G5dR=roBd^2+p=;flw0;TiFho=WG!6N{xF%BQ{(X(n^hxxWpivYT`OkhUK& zpv9+9oGU6aa-Hr+QFi1~BiYQ(@YZ>69C9G?;Kb*o+moyL0SV_}-?JE=$10ex;fL}u zbX@(E?;p-rk*ozx%j;w?R#xC$e0T5L42}pCD_>td5;^}Bc|d(e9#E)?VxI&PGO$0A z5zlac_1lMB4Zf!r{sVtX^^)$%et6|O4m+0KR zTTp5+PXx`Xt>C@tgEE42i)cB{ITMspo6jCwzb^(hk^{W~_{Phd!hoy^A4dx3}wmIjRyeOmKA_}7K&20PFKZ?XqcekyisFoLD%I;kpyqxGR!z|WBABkB@* zqomuCfRAB*_ecBl4k>nSqrHKZ->UKzlOW1Kpl#WVtu2W+5sRf|c?s8=kwOP6Dg{pa$s8{Aq;^MX*sv2}P6!|c*2w^Hn%Nr}yRa{G-qve=8kIn%@eL+gr{O-($i$W_q zC3cT>i^VKN{Kn?`f!N5ch(t7N^p_2+hNdR=Y97W6*)M>1OGaK?xhg!km}ukO5r2}N z>1ibClMw#5?c(g#i@YVmU{8{vC4k~BR!I2!0uZOU(T_ye&m1cnjkTg?{Pimdt?Gh5 zzG@?H(Txf?Lcp8I0D=2acYfqL>wos8O@IKIjs@G`DzY3?0zZP>-=#TvLrP3dAiW~I z{=No_d|?z=#bF=HQ`bN?HwiifFUgH5L&2g#-dQYYYEm6orHp)m3SEj;@tt**^@89* zDH^o0MCYET^4loI2f&87HH#ABFv+KFmlaRHBfQv@o5$U(2nUJIT*~RxnwEV9sbX}k zObs{5w=r??XCR||{@DPS9zo+<1tHiDcm+0|L;jVtABLmDdOJwvR{s4-yoLj6kAYQk zb_e)9a8Tr%HmK)enKK#sZD-*=7dPLTkdy#CvJhgGf&S*ULIJZ16B5o8t&`(nCq%wyY zL8Iw_ZNc!W2o5Slms5G;>7lZ@laiAzc}M9rAE4K>HyRKG6xTBnlqr`wShbxfb6k11FgPy#P^ASQ%!ZnEyxNruOqOs8D64x2*a zOX?G|mD^MvkL0(*htS1UdKzOTa8ZW!a*NYL0~BaOwXRvV7R;`+Q_3;x(8pOr%^LJ( z6y&EvIS{SCu%Vs4v*=fzi2iwOO_WqH8K$7tp7+$Kgdv;}go7bT#`)7IHMKa(l4-ym zT_05Q1&tQ`dgx(}m~0KZKS4YAlKw{H$^6(I_lf?hR88{8)mLGmsEi8)RL)3l-^sU3 zOxjKqZ0)8wY1HeV)rNrN=Lq5&x>a=aNhyMXxZcwYC5>H_!dg7w6|yCNMIlC0>3t=Q;26lm#62%iqwJm2a9!o9AB&@!vF$?HC3_~r z+ncAU)@Zq~n04~e&A%keXK@r8@VHr|twKS<-v03u%HKU}V*ywDz^qB*FGCA58Nc&D zexoB|E`Jh=i5w4sQYpI88mjPs;riQ zhJ^Wkg+&<`K1@A!x;aGxU}U=!wQ^Ln%zWFuMHWTV;S2^VLVKjtlYOv#5t4Kv1i5if z@_Dv!!{dd=?9{pZh&{X(B3u48&P`_4jVZ9{d!SurkLjdR^klgw^1_-nF*a?v1E=!W zm+PPD3XBW72CN`#2d~*${%IWbVgF{#5fK6VL~w$py`wYqDwm3G+18hrs@Y$d*>{GTEl;bITvU?{>4H0pX5tE zh$Y1U+)PnlDt3)USBo;oA_ynyeGQoHdG%SO9m*q(*iP)z1_|4TjnpEW^$W_8ONua` zY<24&$`O2tydgJQa&lV2!usE3VM{GIzpvG*aB+GWQ`=;!``{@3IJ3x8$(8((G2v-p z=EnAqo&6dFTs2>V3`Zq_s|H3`Z@lngny^$Ea*u^CY=oCx694liEvsTD za6^2W=YM|;A^3TSx8w6e)D3+`_R28=8qnP*^!m>K`jrEsMEMD4kD>EFyXqgW;dAaq zKQWWMYJsNg&uI8FL+qaqTX>)WnFJ-T2hPQRJ%tV%=#pW0LDm8O`@hJ3z{bnm;Tcjt zp{oCCWE#p)Yd)e2Z26P-`k!xlIH3xZ?{W2*xc|HVB3pStWWs$~m2g$=KW_zm4#!vE zLk~gXm;cl9XKNUrG6esRjgu<#eoYzsWJUj{mo2714@u_^ZTR7T-)KS*828>2mrp2gYU@Me|r5ny%C@6TTxv<%YU)H|Ie3OxWE_60+%uV-$t}P zQ&H$&pbcODceD;aH~jxUzPyuc_i0U^Xp*$ZeJ@TdV7B!uI+gdTjW zeW}_S?bYps+DqTQYyA85g9SVF-S>0jf_wYnE8cgAoj%~dY+AC-YpZsAyeds*(bdzv zwUFT>L-jA5+x6YrU0ebXR$j$-_xRj*?YhJdR?%C!-*`C@_G~K$4QgFA{cfMNQrmo1 zdl4Ez8VSnYP_v+TC_Y093R1-haA7?FSS5k43q>>f1L)NVO9t(BJrQrJjD&5Ix2SQw zdLq4@t!++^dpYt+mrCie6X-Y2(>|w>vRuz^=jJ~(8`sN(XJ3;kW$~&ev(TR?W-+RI^3N=r?&l)}UdvVQ=iY|M!0zW;z5S$?PQK~^u+&`ED39B! zzv&KDR?;57*kQwd>9XyDt5hjpxcT;bX?^`1DD7{(h|zF>(q&z8kbzEZ;-xmZQr#F= zGJgLGa9&1TFs)v^HL`EARt{BcYUHypi{TIqaf+B>(IUu_&7gDU`l$R{ZIP*Z)=+|= z6`NjY6sp9b__aezZ z(i{car#hMp{u{vmaroi6`RGMZ_L2%z<@o-wm;F}su;H1L`-;}`-J}xsnNO&1TmJOv z8pt+Q?k;^ya8UzR$-FO#IjXU~adgjo&O#|Jtem}k;C{){^!Y$rW!Z4@5p!AJc zQ>?@95*BhcUauY;W94We0bJJ;y!|0yF~0`t-~3U0pxwNo#Sf8M-vDPqbAW9`Ht?v4 z&;MC$KKtlfM9cXpq=f*OLIA1J zZTeM!G#~YBNnJ<}f=Zvq%lGx{XJ((^vCX%1pWFFzRW$kLuDZ)j)mjV4g-VIFdd7u~ z7Q0=C?ANsqK=()TnC^YK_k5vra*DH-tAo z{wttVP8srAvz5DcPLmG8{l&XVMw!t`*U7>6>zKFUn73V@x0uF@M&U!XW_lY!8w!W@aDS%TaYIl=@H#?x zYMcyJ*pFVmOB2~G%o7A+I*aMGe%IA!j3$2aX~ND zFH%|Vf;^&l_sTt$^4}NFs9?PSNf5e!{n!093Q4IPLM}B6N zG`_u!e$(!*Q$LBE@gmtzEaLKY-8P|8;W zOG^_pG*r!Vi&R?yi*@G|5GlS=E9M=v12XKThZB-Y)q;NVL7Y)fSTyjPYI|?J2nbXY z9rJx$h491ThFF8|V*a!Dlp3RZJuWsRXKm}T5Evb0p>WQ#pHO^uUhYr3Ph9|X!em*0 zUUp~Ee#(G)kjY6q|Fl)Sgm|HNAou{zOJn!LqWSu)OWTrWLF0wh75n?(<`ms?*4@iq zoJuyvkCufjQ}&nzGyyIo#b=;EV?n(J^jl%~U9$JaWoR}g#K3)aB7Cmt4eICn z8oPEVd-%$J4wMK=nqUbDNpGBGOk{#GhT#U%p@!FByz%8uik#EgtF8h^ZYcw*JP zW$oT?eoJC^_ZFn=S&&nLY-Oq}`;J+z@B$R|oClkVC-Kra)fja8{S7FwN3N^SX<=4e zu4TExtK!2cpI>AVbGEK(v0h-|W3iay_d=*|&1po%QFf%)No#cC(aF3hm3y91ZOyjm?Ybcl`1rFwuKC}GVCXxp_TuH-AMo0k<#cymEh-%n?gE~x-{-qe z^4cr#;np3em8;LDDy!DpC@WmL&yoR5kBJz+FY@OQw;~H*T1v(7<;X8v00q>wMIwcN#&XD1=jU>rQ_oK&p=)n-wS3= zS(n0x?s5ho>+(74;{|9fsH;1AJFaJaUgRFnl~QmUPZs}%d|j-tj3d9lJ(Kqa^uH)j z<#bH*?z((3+T@jsHrrh;^9uT3I2cRoF8OZ9n7QtvHv9iBJT|~ zzxveM{+xqaBDbI^4IX3x$MP8Yx_Nsq_dddZ?TTITv~da0>E2(1z3+0j;4Gd*mY^wu za*#`v-pv#!D(@Q#zAWwSY0j)_lzpW=`Q7iR+~M`wlwBRHtCjEMcZ;l?V|{wg|$D2h~xrr+uIrkFxu+$QB=8DOz}NGt!@&!r!|JD) zvtpzaW9r5kA7)C(Hd|4|#}&alxW{*PU)^hJZ^+Wzq1lWGNh zCof%}5&CDcqSG=kXXja)w?UhNxaN*vnYgJuCjP_2H{ATxGcs2OrV}UnSr!ul+2W2D zuL8-UCOK3u^Wp-p-unr$RhaGy<*)1Fr?uvrN+P&We1j|y z@ACfiVzdq6e%_b9ww(H>g)8^Vc~DNAc&v-@E2 z4g1;Kiptk=UKdqtHS?adS9iqybfGwseAJ^Ms(1G{zF6cl!F!+2Q69BkzT|nDH2Jo| zN(aRWY_U84>Z{jI-l@{QGip!D{%)phX$e=V*v}4Vp51UaofCwW(Zx)IS-|4Qi*CEa zno!xSE~wWb`JX4~a8?>7$(%}Sg&91F7IMda${((kSQce-n8a;a2p8PL44-?TW9NQZbCtbsXe6cU zu~C)w3*pD-BDsWnXZ9YPWRMOxO<}LTL}6#rC8Rglg!LHkOv*3-XNDM=8c5jT{$qZ0 z8&=FT68kp3`8G~dnMSf%T;*+vdt>?fd8BV5psVNAL~TC4dS}!7Y4{vozGYrMMPFXs z--pGOGNdYr8gyJBagfd*WjU8ChcS)elg7tfGG#x3rN)d^l>bB<`5?69vv)uI8xnDf zN@ga?`&^}KrOTt$1-DYs5jH>n8!sEGwagqzct_m0=C@nS< z#1RBWyuLe4c{Niv?eUqU{No>;?xq^7(}oktO}HOvIT}tg@8~;XC?jAAZSC^;G1r=m z`W1)|0uNwjzs=NMX=sw7cm&jcfbl|=Ru)npRYRhi-Mt2uu5Vc9)yyo@}S%krZQYtJHF+OiZ z-xtUS3%YU7O)U#5Du=gXTKCK0Kp9DsOpBJE$))mq1cgE|t7fWe8}N*tPs6NhxmI>a+r*t#|b4?WqA1OC)hG zKj!mg?CHJwuKDbJjt~GuMR;iYi`BoIc~UoayRi7mH=g+HH`dwmpoq{1?x-H;@6Jg_ zadfd*RH?g68py8L0Y#gET^x7YBBq{SaA(AwHosXtkG}8dzD3O6r|N@?#gzq-yg1w8 zc=?*ml6WmDW}r>L>w_t$-c>_`sYpIEh@-yoJpJ-Hivg973>v*pR29>1c|JMie!d6y zwA1!1PdcUDv;W7f!i3S5&z$#4-k6_OPXy0&)=buBDhBbV%eglPyaV?@_q}HKyj6Y- zmu8{zDe8paux2A*-d47oimY^Y z`+15UC!RC+plrpw{pR0s$g7&fAK??7>5r34z};js+eEl@Q6V$&^7E`u{3+nC@+Erw z7A;>q!skQ|P>K!eE8ygndh#gXM7A%YO7A`kGb(@<$)@#V$m<8(nj(%0^byQ{E(8P= zg)fAJ@ATpAXPi*ESN-bLJ)ugl0{se67j)ZRlIObxUXh>3rR5lNX|+?i?p93S09!b@iOw`4+ps(lK>Deo~GNg0y{=Y>EF z!z2n9$Vc^CV)sr``Sn4hMhhLPN|r4el97o~8v^T|d0R`GqA#`%YB*8a18S0PWAEXd z)A`!S$x3^I1ujKS0Tt<#IEF-gDM$hjxphj~)XOHI-A7e~hs*V9ok8HrTV4nBm*53@ z+`1|c@ks#rki0h@{Y*oY0h3@z!3*oY4%t_1)F}h6TloN~878ucHFK=uwVvTB0*%pC zU-AuF#Jfcz%gKtYRG?c30SuK1Vqt!pLxAZ3HVz~Tl3QHb=tHVQRoM=yOgc~DycuEV zE|Z#TmcP;HAd4+5!FG&yI(TJ!f+ReiS8U=idC_`SB_v#ZDX`Xy}`5fvbqYT?@-?J3&8}A`V!MLJtl4uWGKpUwih0zllS! zF*GrHY?=0uIUiEkfFEG}@K!cD=Jq;eg^Z>n$r&74XES-|^V;XU2^jhTj}oHyO;%}a zh7<&g-+_7fx~AtuhI6mI9i&`}R`@GfIiJA7sLc~x_n-Bkx9fMudDmoxN#3GJ?&b0x zqe{>p`%lOB9^R9e`e4N%eit(ID2u@21SM4JT?Y*oJ%R5mbMk0G@}s!{CYw|Iy~Qvh ztymrT4bu9ZVsh)>;Q?y*xV4Gy^ny7%Io-$-L_dSo&9S8lkfh1d$q~gnb6`0&iqjv% zzDL7={?yTB;&st;G*#?@`9YvOO%n2GBU>t(Q=Ax2?Z;JBBLR8gj5mE36R>*!9&Iua z!wd}e-Z|QHbl2Cf4;r77-lq9q#5?o7q&v(zckIZ&(W?*;efdHVXAU;4d8wX_{_9k0 zfdMufwECd!QLHNch7Wvgc*)Y!%yQ$kz%Ag_p0H&Pap(LpV!u64)cmRH3H#Z##2RYy za8`nV6-sp-LrC9a6Vr*c%pGu5QXbAEWiG^MK0F7ViduCtFD)wcqvA15-rMU*4<(@# z>{#G@g=^nx#`{}JQ*~s$V@YP^faguBK5VbO%P+)$5BgX*W77g09*Xf$HL}|W<^ce z7M6D`A>2$=MQ1jJHBO`DeOo(L1LiQg;!fK=GfG(n{dg+m2Ad*vT35H)xC^HieKUpC zB#pC=C})|kzX6;5iPPg2$Np4T_>5iVJ??dY2refDH;i(o0^Uud%V4!zhDUUNUowK` zJoO`)A4?2AX=d3z>j`IFa%l>k{Dykmv-*2N_KhOxokRq3!S9?%i<6x=J&=CWZzd`Y zV*~a{!QNACp@Ftd2S&1l-{x|<35Xg=HW2PhKPG^13qPRvqroH_EQj!q3hT3j&&A|C z9Ytxt{jy8hL>0++I~09EjI5xrkS>tyWLE+beUw$I+J7z*x*FH8($?8jqXWqE{T?BZ zB^rFzdHVi&_H9I+nE$?Ep)Bh(D@H3;QXTY&%uN4A*f`O#zn$c%bxPINX#xnzzfmw2eh{y$m(E1lxm?j@J3+v#7SNou-Uycu%v z5O0@-H`OVogET67p(GcBRBWQg+|1iq3g*+d-uUGrL5wYVI2g)E`-G2u1+NUF3zzbT5mh|AGMkmQyHMRi@=B!m+tU8Gg z6Xhy&I#ILMF2ue$J$sDK2^%a1?N=ZG?b35vx3R_{8h8E0u?*U=oLgp`Gqb$13+WWz zWO4}PtI0zEl>+40iWhriI;b5>{xFY3b8PPsi4BUqJo`EkaKWTxLpLhY1s?QJY|>MZ zE^%~8Z@HV*63eS+sshFLz*<=(Cs@cAham^Tv?RLdM0?$J?&Y!CftczGSqH)llG_`cxnvx8)=I|YJ>ry2f`D7Swxko-%UZH?@$i-laud((z; zDE-LGCtF%&d)~{7e8YhBv_)w9(Ec8fuWNpjLb#<}TD(!o_bn0iMb9-pZGKO)*FD7R z<)&8HwUT<5S$^{d+T+LToZB>s44>@%l*bwjUa|otqkDOk98`MXFo>+1g@ts)jn}V^ z>q6y((w`=c7kz{N!xD-(^IFO`cW6JK?zRDDE2BJ}-Q8ncAuKPZ67Y&r04l{WKF6vP zPM(;&%KeUVk@-rM)^2WW$cc~14X>}7E{XTxACwOp?Y}l4`olY$+3BfDC`5!HkjV>t zBZ;V_7`doq#CCllrRA}N;{0+FKtn(+iM}EI;RAzqwp<#}5q$Ex0FYC2A7*%LtX}eR zZr%@dSybOw6nkbjF5aFsJ}xJVaOEHgdh!1W&?_zTvxk)9HzJA+VFSCf2b%zE|J6$* zb)9nHer*>yb;iKyzV5%h)p$yROkx{8gJfjvzkQ

-N2B#AUJ4(fC(0#c;Uk_(&L z1M4drK$Q98`%5|wru*9Ep$prRD;6kI)NGz8<9;az_c3z(Y^LB1Rqu$8de@M#QK9$8k-9tgydGog~|H)ZO56$y6olbT8vwk5&@w z`dV5K4`YQgXu^cT=S!mOme=2hg9yQszP2OXkCeT|#nieBhJXxTGc~WskwK{}Nu8bH z-C$tL*JKu^EcGVHOQ|_f!34qveyuscG@{U>O4Ar*0tIz7+I}*9?4_iY}i6J%rvkb%m6xUm>cHe&zU)EaI0p2Y5Gk3n{f0G@XoYnq!;!vCAd3hJWZ%Q{qE5+?@@~?0XNnsx8$Y6_Rw$?Rq}F~&gZfvcVRz$d zQUIPj(GOBYeA0**x3OP=C_jgaO4lKY1Yxf@*^bOWmGmTI9aIUw<&a_;HQay@$LU@BhvyAY zu&o%nZ^P(Pti!Gl*Ot&kyN@UbIqrn!fY@P{4e9PwsTzB|FCb)*!Ug}LUlLC?=xU zenertN2JIc2ScW|Uok>z;z9BMFV zc4SNWMEJfcK%;zj>Qf)kCTsU4Y)qtg&lILQTc16OL`W2{BKs}4vQ`*Il)})zLB%BY zJ1bQTD`g3*b3aKF5!2dQ;t6(7ggZyUfsZxg0KePybr|C!miJgvE>1B{T9~IV>Xk<2 zi8&TNl`R?sA##Ozeww=Amk|eun>b!D_Q*_$|B_mQELviVT>GqFt~0yevo7h_Hf55# zFNp0ObmG;vJn>OJX8VY}k4kIJNiEbFo?lU!$50LK!&gw4!p0>q^Yt;EP>S-OR}FxQUyf8C@`!aj3{15 z;{S`bjYtZPLN3hq>q>3YWF<3CF7;Ali8#&-qb<f@&-us)1r$^X359N$ z<~LJX=BI3gA9SHmk_dGYVJk<;s5@U6>*l~o5*xOTQ+N{1Dw1R+skgzEC8D>HT_kIU zcA8w39U;v(*>3JsvJ8VgtWWvi$XVnxO5-TEU3i#~v%Llo3F`#dJ(}9`JwqMtxQSrH z@&jZfydy_ipoO~kLOIKqO`(|l*DQw>&5lkO7%e?@Jg*1p6q@oITvBjA9gHcJKi;dD*7lT*xiLx{(1Xy_vA>Qi0u}RM#3_(w1QG4j<0QKCnHXh= zE_<_h+-8PACpdOtJ?~}$dxPsyo8nw0(>Vn)9-*fY1@$2+b}Qdp*0Z)&>Ezm%9R3eOSm$;=Wrs(xQyvB8IN;<*ep{XC>A*hH-@QBNT~q ztjK;e4jv41(ah=>I9AM>*D|iRf=QQkLPb;P>aLdTWr+2}o_-`s zOL4{Tn-AlHfHPKa;stNQeZ_JfKlYQ40S4azjlNvk7yS}FFA4wJl#0JSDFJ9zi&AgfE@6>9AbzYE6${koZ! z%eoV6$Cf|LUQp~E?e~E!Y6^+mbTAgKRR>laBeTdt1p4?0&ajiv`!=JQoe%e^Y_OGI zQQbwjPg77~5rk1bEO7(^jpxXkmI^r=%17S3P-bk)Q+jyBji}f^dEE zydI-`SkoBe;l8bFTtu!CELc;+P@rEHU4jm>Em0480e+XX=dmOr%Yjv7f_|o=(=Y7+ z(zbouNf5dAxFSDxTg%_knlKn7#}p1;f?4oQwSa2+g%P{;a)~Z1Ct%GssR}Q08I^E; z-ecjU?ckP|HQA?2`CtxK-kjeub6?6@|4b*0c+pVm6`+L>4}N8@n0rn>=ovB0&q@VX z9)7(`N!{uirbZ8(5%dpLBXby`2)>H0rD5H))H@{$5-#kvuF8nB=D>z1;%XR=jlG7- z$soSM4q#7iU>=`Nyr^0d5}DUpH>D_AENv6=5$~spmh#jeHeFlFdj_;aw+sOP2ZSdnMz$ zHBksY`w={W(yADqR_jw_h6fo0+Zu2_@Zu5lBk9pBB<+fj)WV_s>9a-3ggXC{*DM+$ zBbtw#^^~8iT}o;QjU%Kza}=99$9m#Yr+;C{Z5YN2i^P2PuK=Ijo25dcfoTi_|` z+wpeu7lj6CxXRLQgokH&$d6F&7VxGn7L=$*e*rA-9ZOO`nb+{>`aXABjR#tAVU>n9)(@5cITqE}Hz;#GjYxG%;r7+Kx^N786v z2G`1RUH1UpGLeCM+9Cf_06#E|8!LuKOyM+Bsgz2X6vep9c_c$gvYOqlQBPDEVs7db z{s%b(%DILB5sBS=icl&Wtm^NiV=x%(roREHGCmc?6)EhT&Vq8=gw41*^9-EV`lS$a z_{DD22t|o7;T*y}5z4;%tkA=UggulT5(kdUun!ItBdK)l9aTR@uiz_(?X|!5*}OK{ z#LK%+O`>amiQ6wUBu*J2_I#SQgau7Ql{xYaBO=FV1!~})-+fPpda?keQ5pL~JCetu zA!bdL_G@W|p!Rvv8TL2l4EkAx3WacZ;ot}8^$v~ymamM|C-&?29NDPJ%k1rADG;i@NyA&smD0Sns0L`8F~K(n8uB(5*4 zReKiBZYo0AiLU+|(~m)qM1-aR_b)4r$So1u5gJBu6N;yJT}H3{i?6>z6nR zoSXvmRd3lS(MW{RhEwEt5t2@B?4G^n@t05ht)Vj`3~+1&-h zJL@tUygmv2uCc-LSVH76s2OPod0*;;vpAX;$gs0f+u*;sg>yt8qEA!0Hoe7ucZ*e9 zo_%oa62v3+C#lt&f+i@@$Y4pf9tHF3R*dmH5Mjb5fDi3zHy28vWvj7 zWr&n!Y4duNYz&A<61?A3sJD06su>C=#|W5^#EtUL$L+cttvFG?1O z71Z$kIiEtxHx2(*RquTTXU!j~!^3`iyw247ja_|ccUP*m5BfjlV5dD1XPk4ErsTMagt06LBM<(p^#;04)A%oJAPj?A%EM|4B) zIAT2vC{xv+1&Yq=|BJo1{%Z3J-bIT;kYd3p?j9_-yN2NIUfc?_NO27iTnYqt*W&K( zQoLvj6ey)Fy?oBS_pI|jobRuDt^MZByJpYqnR(`Uy2&ew*Tm(s^WHE??ng;kPwTPP z?4$&0uIRxa%+8ic>mCM;t%F@-+(FmIJ_;c^^Sm2|UV50mxkqs@6YuC>_=4B+_-Dk9 zY{*JU($EzKe;Hs03KDkp{Tjfns9oE5Ba)n8gxl#LLQvN|yv5w5PS0?J-t8Fp>6*}n zN{&Ilay?qk{-zZ_-Zrk)T!uMAUi`VE653C|f!*^@p0?QWCL#GWMFOTAM+T!C1!yX! zlt!LpxyX~8Y)Pd?@}D(%{J|Q5`F2GY0?nOSDJ;F0U*aLhOylese7i1H;`ADJW!`8B!YDI+c5YQ^+{NSx5V|kx4$`QVF+L`c!f*2a6?g z>RjXS=`SMlD=|dQ0G5W_D&$R>jEDtO-)T=rz~6?Z!J5!&A!e{ua^~4O>sAcF|&J!FQ6Cxx)d5UMFaPVjl?mR1YpaO zswQSo^ne2vGOQ!eVfY`hRgFDPD2Uea(I@p0>(`H?I00jc{xKZE;RDDURji z%6uXVWOWAAA%O?6ay5!11W9tGF}YIKS>y#S^AcFn;LW4PfTjgk-S+QEuN!+nwliG`R3P^-QZ_Tw$;`&o)UqYs`W&QjJrXda29_R^%tmxV8z2lQ8-qIFe(j>7y#ABKQ#S{=5-ZHrHTFdx(8N=b z4^>hJcSt64{4K5Ld6F0LZhNv@F0VdHglf}^zE0pRP%G}LXT*iqfHf*vSEZ^-Sx+!- z>6S1SP42EK(nq~RD-ui(<5~!QM~X)mQ}xlxKC%vXM#wh}NjqQ~0F@RK_INcjWS(7uC8i9ji%=41CLWvdyg zDYUm&%jVuQf(^)pD{`uD3#nbO8naPG-Jeg~+n8MOruKB>qmsRWTV^pZDG(nG|Mjc(8^IXaZ>S=2`kxVtdjK@b^wDM?=0%#{rY4wOKt zb}GZN9*%`RDBYpzdHH1=3<1PNVShc7%>%@;5o@>DD2EN}QlY*|k?Zg!4oXl}W)K}P zXZ!)Bqucgy)>cHz9;YVQl3KJaAk$(meXn~m@vw+YqY_$(<`IP*P($=19DSD1DDoGd zMpnoX1C5iMn!$tXU71S}MV{kV9AR58>?CFN8CG{`beolJ}I$d zvXzV~KEjMB48odx^7gcPGk>v=cQacX@FZrv^vgUs+^yq7AxERl*y&$1ZK9OY3gsh~ zY@HHx)@BuH@xNwOR_D)xG<*E+TZSyoEyt!<+j8gH2$^UKd6%{|_gpz^aT>eXwlIai zhpG}CGc6LUADvRMzs6Rb*o;Mo+s=+Y_+1uLo}kL42U00f@!AF4LfWakK)+z_t}01( zLk|sqpC|NAywbdGKrj`?9hc#xZ49DVM2`xf0gtA4k96xnXgRxIRFng~ctRmXv^z$Q z=XfwW(8;06HI=g%rG}w{v21TJA}S^kWLArnMXT)qpHPhGlsWKWZrBunhF?;AZpc4#_Q-TAE610kBLgS$CD_sO~Dj)AvRhVkha~zygl8=w^P)5Pb;y*Ye% z5Dz5idvJz_rHv{+Egu>ttzC>Zdy{N`Z;JfarYY_p8CAQqG}mZnwepzzVbq&KuuED( z47o;rFI?TVDd@0D!ksnc8a@|9+aTqFtWJ~aEpE|A28kh}+go5A>3f3p$z$e|(~)`G z{tbLH-9c?8sy3YuVpmzi_)5N!Sm*~d1jarpDooysZYBl9{4?A8<0TsIzR;LW9Ek2w zr6mT)ds^;YIUS)k)+b!q?Fudh?=VYljMVq4RCbK#%x&-On(}l|0nfj_ZdKt(^h-?ke~HE;bNmTeJk*S$RmXuBzZ0Sl zIWVH=`r1;UwA#IC=*>&9jHpVjJ*w%vWjhleRzr?!n$3oFa}y z^rHb&b51F$%FV}EEER3r1;(K;^~NllLeO{kDalhdgIkd>jXL2X-JD16{O*D8M4^M& z2(j~NI$v|X(+L*pGzSlnH@B_wr~NNW^d1qI0(ug%*BpT)VVsCn=u};WJ&KBa`yI9o zh|HZMuqjq?zG*ccNk2r5UG-O5hn?AK>f^rSPP@57_aLinVC=G67ztTk98nj(n6&~4 zGH@fy@H9l;=)jIpC{A2JcR@{f5$LSU^GBD}{k;<@sR9GvD>-`Qyw>ZEf-zRdbs=nP zfl?_s;!s`ya~u5Vr5GB(_zIcG=loKkGyT0+4b19zf=8zRE6<&=^4gRUyXlK)sjmBH z_0nlTj}FyY5;vDMdy%5ZK`2-hzlfAb35!Ec8B0byDRtH}&x96%?_T;xb87-*W;BL+ zpT!mgy9s#1<<9@M0+kOnY_|US7$7YaQew2}$vc1?-lCIg3pQ!`!KGK)fOSS8Ge?CQ z2cUV^M(YWG2cFb5j2_i5=1k-AYkj*k80MA*=H{C>yw+h@o1I8w8Bn0XDuqmxoT;?D zRg=O_OG}|IIzsLXI^_9tJH_rAt2huVk&lrcdS@tVyX{hBtClc{$}xo$s68yOKK z+dbumE%SACL7>6kr2`tpfqt?nV9-j5sfeJ;PyH4{*Seoeg-6aYlW z#d3a}6qsOt@?^>hjDw651Is-csx@Gu!xf2i`fgd&`KcB8gGutxA*xw6X5$u0!nXZ- zNmW!4>U5tX+upAIKit*!#BLuRF%5&dHobxKiSlsq5h|Xo03omY6$9w&#IqxWP1f9X zGW?}70HJ%i=2XDyx5emSXo39O+imaZiFdrFxcqo(4rQA#JTyn>kQ5yS)@7+k6n}jc z@GBS`mUYk8G?eAJUYBjacbRzNP!tuU;+SgRH&&L3E%GRy68*-SXTx+V8mBk-qWUh) zi|=3i_y8*rTaVKcvTPvS8uqdQmivQl$v*MIemzVC6Dlj0iK`V2+v;ORoL@!;AFx&| zxGYD46M45M`@V*d)6qBSK{Eij;ua> zGBW1T19#>I?%1YIEB;uT=KYrRlc_BP7KN8m{-BChD-u&TYl$}(X+WKgrbj<*O#?Gn1=F zhXR*$x={^;aFDXrN$<3?Oar+a-LgKSdu|VK_kAwnMF_Ar5{&z8*eMJ{bVd&;@dR4j z9lorMxQxLIK)Rg-di>hhZMW{~9#OGSUnP=CR!6uxSsOnph+CyS(k+{H0uU+bm`5)J zsinM;v@RdcW`Qqf#U|>QxeM%Lt79gvB*iImrP^2sSrS+OJ%!W>dY$%yV#nCK@# zJ@1_CXr9Ol?9Bc!U~-sIjEHlYBR9(^NEBgaUt(aGS!b16AiC%P_vmwfYZIhF$Sb?Q zhVa|kE~Jrk9@rmQg2Ur614flJ)1(>s=h3ow+hTbs?6G8@})(gJSdF@V7D1 zN_kbU1+#3b#w~BdSaNJ<*R$ZEAS6d23O0u9v<00l4}peavM0m0q-ojqaGzE6jHE1k zowxoPF)BCPB*MTvV4EDAJfstOc}k@1?ZOzV%SJ z@zBYUWJ+GeQ+|GHro)5Y5qHKmb3gR&bEz}!od^FH*uE3;JbP1%r6xTEaA_zng0W5h zMP=!4~jpTuBSJSv%l$Asf}=+BdKk}T9oWy)r>KZVrB2Dc_gv$TsVV% zdRiVvr&1>H!nym1(wC_4eHju@Psi*0aq2|a)Z3X;Fkz*19rk0S6k4u%{PW}kj8Sr9 z2xdM7#D^&dK4c37Qg9SoW`#~JIti$@Of9UVzIkF8#lSNj#YZW(`3bU89tPZ|Qeweg zMdd2jq)-GJ)hb93>g6r6*d{HIJ61Yo^MJTCiSdr{=~+GJ(V0~xD`NzB0b1T$zhT>X67h%VRZczPY-Z`uw7s(URA7nadIlXFq-j`0zdG3uVY} z6|WRWP5cp@fi#LNv7IbH?wm(7?PTFsYOZrI3@A5Wo++8CE7h98DVrrCB(FhsM&aog zQ^rW}0qr|d*T#XsQA&#lGu!Z&?Y6Y@Xwbrv2Rh+oaJ!x) zg>&=v$}n14#og>b4QUjjlLpP$l^B+k!tB%;nXihg^u~VnK z8^<28nQCkWX8Y0b-Ui@h1BDvLK(%i0^fl-BqJWR)GKEYW9ndSrIHq%>%t&dQ5nwiq zb6~L6;BzM5)P95P351ryY4s(#&xu}evTv}ahCe#Vt_Fr-IKboR9&@kim94 zNiN@iGxmd)IXQ3{vAw07se$sO{VEXx_taIgsVOGK0J_G)(BJ)AjH>92UR(*oV$Gwt z$o}v!%3H#y8q3*oe4t}%OUUMHwh5s?#t&{g>}F%C6|#S@e?v6Gho%2Hs+Q%sC9;G# zJ2&eU6LWxsbOC#xZAy=dC|QLhaX&5}ym+f69-=8B#P_b>C1&4sSZFOWEKnmA}}U)K74n#d@WI(ogFf2c%k==Z<#=T zNZpKU9CH%c`WstTbnZlQ!lq_QDM4db7_?Q(gvPR}!;qKHY=&ui20wS+_<*Mdq_V9> zYu|K6;7MF4g-o%y-y*B_60dMyGNfp9U$lI5q#K3{M1p+Pxm;?7*LUL$*49E32?dv5 z@+8pesu=4XQZgT-V6MsH%=fFjjob+0Xj}eb-(pf^_)>T*SB5-ke0PKGKFQ;;jwGEE zseS?bH$WY|1RCqvuY3(ok?1vyQalPK#UlV#N9o8SjrZlVGwDPg^TN%yurL!VnRh3c zbeOt^GA7&Wsft{x=O%m`3PEIeZS07>GRXkV3&c$e(C-&o!YL+(@T(?avG~hyE*iFJ zI5LP_Rkr5(lf^E6v|_h}NV4@iqh4#(h*u^kxJsk3rZ4(WmIi_oNCc_Pu3G1^qZUH{ zT)Dj(8+EAKY23ny^B?u)MX@Rx1G?C=nw`HYzP0CNk~n|X(1$- zWc-EAchR!m^O3OT@+{|*0N+n_vmDx~ykrU!YQ%0!W`Q(+Uf3piodVMb)JV}0U2xGAnqC(w~|7=O;@q`H6yaHq+K^1%oD8>BCk#^AYMG>;bm0~i=PWF zdRGEw55vB}72e*XkIa3|KPD6E%i{VQI@0u!<&_4?BKhFxKpw@T^edX`hquJ(NQt>@>=Dng(8qZS?XXr4!>$8c7(R^ZMm4qL!zzNDH%;_%M}>q0 z$$x6Tho>!vId)qg#L)p%T~&yy#dTY2(n=M&7=8{;uGarVPFt|%X2f)gqjQX)Kc4`K zpKJjL;0LHiF$=s%A?VHqW3XX(E%>rdB9EHildDbvB*=C6Ch-^p3Y7N@5ib#B0(T?qH&}(p-j_Ey$b8dW$xU6VrzeY96|wg7-+Kk1OrL zI0Rs8$6`W<$wt<+G}Ga(mT}z@iw9^AS6mS{*R2`7-&c7AYg({we&aF<9yOT)(o=W- zwPME~L(uM6m*d4m)wMnRVZWTD#H3(Yk~Ekojr-xrO*u zS}vIzW>X}Z2^0M(4UZbfuW@P+Gldi7>`Ncnmq;&T?suoBf>vnM_f*q)QW%6LWIaGA}CEr&inLisERVR=V%&0!g;s7 zVkGeeYf^dk6t*9jwMtW2a9m5UOtu@sNRJ6|?%RmNb*PVJjMz zuN>7|NtFWF#0ONIKO^kb;sl%d0A9%x`fX-QY_8iXO83u@hT-#<3`UyPxX>q#ZiG>f zP|)@vOunh43bS~0n$IRS!*xRWE{?vqo+@%;dZB4$om~I7S64E@6vC<<*W*>|Po~er zbd9g@BsxKzNnI?ry(-*0DckGsB))(Cu}!A^Qc4Wk8xYnl;-X2Hc)S7S9b)fYH|5RQ zXMJf^w!6L?;mf)}wm-ok2yfickh1Zju@1bhan#^wvaLQLixQ`N)oG5dSiB}7!K_~% z+O;vllMNf%iExL;!u@YfA$v8D*mP-pQ4Cwb@q&tr7_K;E{`DV z-l?_c#3=}|ErlA5^GW0!P$k05hsI1$MigPzXPQj8b9yF*&b*64^C+D*OkK~7ogzpF z<(@{=`sL)Zlu_j^lo%lB-}Ssm57PB>tJm;8Hs?^N+oJ`>EUaX7t)<9`JlfeMb(J50lF zt{g8_j$VL>1R7%qxB8>b4~x zazQUrD><_U0;gNk*Nt(8;p=YIF~uXy8CUc<%C+M3@`VMy7I*hU*hR*{si$B?(SnxZ z@*3soG=#Pyt635Wcl)sA)bFh`Ol+qifmKAE?b0CoQBJFF*n&h)t;7K z?&`yjw<>k=?32$I)p%N0SZX86rMVY>52P(y*zb|IU$c#F#e_39{g{*bGUxNC@N`_s z)Hh|R4opK;HFeEgX6-IH_mXk^IO|gk^k;>R2%8NTa;`&wUfgAQ(TAS z4t1jOvOb6*5@GitAcwyRNos^2cf6D`N}YCjIW<{zxHU_b;@H{E@_OPodRd&4D-;Hi zUUgiG$GgSK+B+enUGo5LdLe=6b;&gAC<_=5PJLAxY{{D1L-#5cY8dkOITz`n!%zl| za78di;uX~mPBuWJVUmrhRKASE<0XPojk(k@lLgj7Q?Mq|{|?86oK4$4vZmSx1&n9) z3owaSs>ThT7w*e`)FJeN1!fiG>If)qyiKnHEk%B0`3ZTIYO;Z5G9oPy2Z%MY<;7YC zQ@VW{SS^w8J%lGAFxHR=MsrK_=*X-<~ihkNcI}US|!Ni!Ld}yUfrNZD}ZzV!IOH z6QgD*yBZLH)lvPt^{C1|q_;+48eUvw7)dMG@dOwRb9GpM^amWrPkiD$&G-PZID)RR zIsnmY24iWkUS(Cp&{M3Sp#&83q4snsB6L#HpEjb4>5H-BkhT2!KHRc|=nSWC#9#~p z-J)U;2VsAuIy3Kg*m>F}+-{QP1+23ej8x$Si4ke2{AT=UGzul81d&9(ZDOhEbewv{ z{nP6`dCZ{1M*+n4b6Z(JdiGdC=`pY7_p zTF{$zp9&N7!KC>?L&1nhuHd}rtt0`!JZ8gtMB82wi4xWo!1z1@W!S#nr^P(9cXPby z4w&qiOIhFON;AFfMbH_lXdV7M$`|L*>N+ise{&s*LCcE(MQ#&V$-YZAeLJGE8BF-; zS-p8=B)!Rlt=^xW2}9@{q-AKupAIa`J4&Vf#hv~r>YX0bky}-VZMdNgCvFvpghcwpA$Sl{z#0WYMd(gDgOH?8BH!mv)5+P+qP$9_Vvb5@g)w;Aq-Bmp{rnqhY zpuPRDHY?+Xjhozttucg~W-1waAU3W&Q4<=Q!AXmRp;aF_em$*ddxBE{I=ras#w#@s z22Dozn0?j7c1Uy)Y9pH>>Dsp`POWxZR8)}#!c#6fh9e^VoCG4~8N1Ef`2H&MA#4|! z6Ye%~KgLqCWkA<*>iQi?HvH}t6OZvY)L*rx7q*dx4Jo|@yL}t;SQC0nav)00y%5h> zmpehbn<_>rGfCi;b(@}Hcg;c*ce;!veD7@!35pLL!{}!1R3*0!5f&kO1W|cxBx@`Q znCtk!?vCG?bAufWwstFoAg8bYx^$5G{cbMkjgf51H76Pt635{1NnTguav=^|($pc$ zd^jM^mXj&zqz0iCaIRrTlMHcU71I2vMlvk#s1i$h|A@ytpSC_R{Zfb9%a)$f`Ox^@ zQFuzLw$z8uq8|15qVM@a4`+>ad-6j`s!n1F0edR{e#Y~|k2g0lO5@Q1xbJZ$AUwJv zn;ah>gFv~LB1>}uL)mzM2wWv~2^ngd*r^v0yi@%++F;)0c%9-2Y2yW%bLQ4TqfuJl zG@{%dkjRi-z((lwFh3urUglzUP;WK+Pf%nFeqv{FxRjwTA zdvU-cGpf@8P_$fumVGIe*J*jAvd+!ssxE_|_s`5wS!1jOX`aol^9UF$%qxX|1A4c4 z18PgwQte4I+c~%Ml%4rfW|8G@hi#>cAeP6g;Zxw8f&`sV^mmB8nv^SUfpFT11);Ul zsy$x^WNGiwyHJ!)#}jNapg7%}1(n9zA--sn;1q}>SoYf#0P9oroTyDq%eooHbLU48 zY(kosgae_y=zSW>#S*SL!g{X_nyD0x6vo{#tUo=`70aCA==;nBjij|T{cf=qKJFs) zM^j+tN*!8&c`kCEzTGTK{|#?`Cv)v@^SFHC@xi7EDjv~)30th6UH%&+mzGGe1;|L1 z^L>k7wPE}*#zWom$m=V5?!b{84&#^u$C{~(ARt0_9u~I(tA*@%_Cl7)ZBq)MF2a(= zCHlt7EnG)T#ynpkdYRjseJR9l_w*SUG4(A#I{cV-Sd9Dj0qjdQm}CloC~HH;MIwxH z#UhzKA5jl~UsdZMilJZAvvQ0xOU?U}c5CA+i)bXLJ#?74bsp^yPp{>(it|WH2!j^>q;r zH9n;>&2(v~m)I}slg_`&Pq0D%Fp5%cXMWtxTXx@?!lJ_E?iq1lV;Eq;3!3$DJks7< zH#L)zSGF{nN+yqGd^a8@xQM?DFXv??PV#2>ni452ApW;qaF*4Tnkn4vbxAEMId<9$ zhYZCA883Y#VG8MDfTepEbFnUL#*DOD1VHLI zq1G_Y2v8;B7q4yrlH(!|$E_HdVe6w4S{1SudyePS(+({WXnCUbT+1=>gqa0hwH6$y zYG9^1i+}S>ZvGNwLJ|nvpM>zStK$%(l&#LF5wAp0oo$MI%{v_6D-s|*!A-c0;{3`x z=WT`UCNKtQc#$Kn!%06$U1q#ETclJb^)g&%wflL@>WM?5{q)ER~ z#6Z61^POJ16(~YQKLn&8Pns504QBcE-33GB@6W8}IU?l{VTK9V;0IT#NCleOy`{3YL z*#ZiP#%0PA$B92{^jh~pv}w_t!L$rOO8D?wX>SLQyCe{%P-{RnDP=ICpi$FIj9U&> z_n29``)@-f7EL*=!l*|iwvg_Z&)@c>$&KI98CE$%SAUBqHJNjtAU6*(SCeDPE$tE) zzfpU)Vc*tJ-0(RvQGz!xE_V8J34LjKbBMJv81ri5%yM*cdVnRQZ-Xybl z#~ixgTe;ExgqWjc0lbOZcoPxt(k4(UoY108Wdtzbbm-Ql3x>d}Rs5w~5N5dgrgxrK zZv6|YW5dz`996~yS1vjd=QHZ{K_cPV4VW0dO3dWzSKyY|QSUO}#_tN_+i(QkWjm~7 z(0jCCa>g$yRU4I(hSluo+cplzxn4}UWruQ|pL$K7yRWo;W0)7r_yFW+CF!wFA9s%7 zMc13^;356@?y?>J1(k8HgNx{ z#{@neW&+c!$1BC5_3+rGSIYFr6vdfJ>|M5W6inRAILN!h_(apO;}HW!r23jp@gU=k z!c?SF!R-huOAlJS>^V~DQTrm5!E&&&e+lQ~P=sSAsQc80)2J&zKFB9&6P3>tS=E6m z?;ruxLnmZfl-tP?CU+>%hMFi%V1lzzMN8&E&PvUwdoXU^kal4|#B_$PGcuE&alKp( zOAYS>PvMqoCfQpL9kjfM%_exV==qP= zT75w#4Un%lP9Iai?)p`u`yQ-KnOasYiag1IX`jU@A~>mo*qfko)-E6(JFB3jnZ5R; z)S|bslH~{m3%>0qw9K9sP%qXoyi#tgyjzX$?|ngF`+lM08j_&1tQC+{0wPTaCEV|< zrtDck+Ln#W2x0)|t59q=dC?gim*dv53t5KH4IwDOKbRfFZyI(*g~mVCb-ZiL)7U(} z6?g5IIb!B~Fi}62Lmcnewa-RPN8AHW368uqdXf_&GLE89$5&W)Nn@*tvB8eSWqINJ zwZqwPvg4(Tr%)Bz8dTCH>7hqPI-tHO?M?aKLG$QPtO3w>5#%_3|o1 zm0wSnJyiZ51mTD5e%TrY2bm$fX-?u1{-<>-dq_n=WV2T7QQ1eZ~ zB16`zqNBhz?lk^m9<2%1Ja}FjlmQ)$Xc%16GAMp&;^GXD9eguK-BT*nA@{@HN}zt( zrwny68{Fx1LJxdx9eW~uORAwvg9?q7=`AMv6SW0bTh)%zom(%1u+KA5R42?_*2NQp zP&NEA#k&RNI&$k5!!;`B` zxm5I@g{~W-CDf}X?YKonLsPT?9quWL7~W0SSbL+JD1LL6@sMwhm@k;aW&&?6@EBFF z2ciL5hxI0C(x!1S#Hll2g9Gaw3O5Z(0c^$mS6So=281fiE7Ow}kAX@gPCqW!5~ogxGyf z*&0Yuluw-2MEc$E?j1!jpAwt`B_1)V9@`%t3!s?xRhZ;8jkgX^_W**^>&J^`Dqv@N zCw$p$FIO~gZHl^hy4`?AEcU(@mUHqz;#v8bSvS|^H)Jo6^z=nCwm;RfpNe8h_5xmp z3r~dHrK`eGKvExM_jIgv6_3}<%wg%0IX$$A6uKZ)I@ujNOx&hx8I*sg{i0RQ1M?oX znlg!o*l!8QO0hX?*g~b-GM9L>MRYhH@V@VbmWMStlajhUxRpN2$OVB*K$;HgNzmz) zeR8(b8&6$y4R)v?86oNEVu`F;Txk+Dq_EMgKNBXr;gcLCtf~mA zwlOIut%N$SMq|8bq9zYT?goZtvM^I%8EU zuTlP$I~)I_JfJ_qcaBTxi6_^i`WV4Nq3_Pxl07S`!K4%{`#Hb5-)!gq=K?^Glf89v zq{X`vfYBPHDLRk;8C>$AS950uQrw-zrD_6uR7<>B2^>=?>|L`u0?eQRigk2+(0Yv1 zI!?J!Ux!{Nf0G!gS|9SHHwhvu@yUuf*@f70!>l$8phV--7e=|nq)wb@rG`|#tuHHr zFI4LKs&zbGHv>x*+r0Bj{or_c_&z`T4_61{(?YbbOmf#+v5-pzsiCiasfj9e-(om{ zc^KYY2+5(Ma)mt)e8;LlFxX&n7N0C0acpiTPrUM?o%5m6M30Xeu5at&nM4pZEzLC% zZE^Tu1PgoH+KqK+th?&*y3&?!Xh9h%zshkTH+2`x zckV=fa%7G3Ra-QNE6Y*-(}loYmu+cX$2^qHmOLhv_!mv*IfZu*17)zz>z+oytRiIV zA{RV&8ru)Uw}nHek!JnE^UB_zC>J+6rD`KxK7iahhqr6^u-jY{z^H*~~E-=hD=&=H@SS{so9A?7y;88ZA4k(Lzwifa!X zR`jPy4HBaOtOGlezeVS#)NzR!*^}d*?Zw-1KX5+1EjUo5k3{%AWP?b27D9I8BBvc_ zapkeuF#Zi+=4oE#H{}F+aBQ`5FrciL4XXK=ECP*^O5_i8hqA-ymcZ=%sQl%0l=ECv zf^YMX1q~DTZMYSX#=@rI6J%hh73p*5m#puDRwYGC=5pwu%}mU}5W2Jq2^-@RmM9xy z5Ma84w(T|Qyw(L&+GnD#~Pj-2UGO{;zd?jF&{a`moyB_<#S<|2*=4 zzU6-w@;^rOKd0x#`TURD_`lX)e#<8a*xK6l`x<3d@b}BVzhAhOzP(-F`ttnH!?!+j z`kuH;L%-W^X-|s1oA1$M>=LpffoEZTkwA*4IZsIKw*!2ed@j19dKF2=?YbQ&w-w(n z`hwu{rT+Z6G;!?h{;tjf%0rtiHR1DNg>(@Tc{2J`e+YCQrjOumTf`ND8#mv+sT z9k?@=&O5OQFoYR5XD!N8zzsR<4Go^E4L_e`aY%)}ndyrVhpi~=wfP47;#Qpe4i8m$ z*Cok(;xsYIy*wjd`JNy!I7>O9EzW98X`;t5b^3e$?peOyq^-U6rO%`OosHt(@Bf~^ zi}n2w)B3urFZa;+Uiphs0mfL|_r2z8HIzGVWAzVp3#(F z)ee2?aTK$?8cYsK2~r<@{u%PG9SDwZz;f3BGso#A+Wc3Rv^j_w(zlVn2>IO}67nrh5Y&S?-xzA1M<;=+h=N40rh6d-m#$1W3fam zl2=QTSJV7+e=3rnDmdXN#rf>8VFQXAi+}eP-+xGcPos@6A;i|k&J&wqZ>y9OAE5{8 z5c_H-sAeU^D3f17KGvrsat|z?y`l?ltL#r2XC-HoYl#DCOy%iV{&p?TsN!(7#lvI3 zvJ6`6zG{}BQcbe_jl&FG$i4oYPZy_BjU5%m%bUoqxk8?lEP6+kk0&W(lUEl0qs2Og zyn2{=2<_jWxqpA2Up^x1QUTrahc*BAYs(mEI7M&%ARc5pmmnBs7=wh=p=H9(xpc1O zouC$Lg+RINhp=hdEi*K&CQP(4H1f2*r|Q0^|F~_}dLLRter1M;fJAJ&4@0Jvva9!Y zvOL^_ay#z`Xl@8TJ;r_tST%BZKgbd+YufMM<>f@>ZBn%>^BfcyEs{qO33 z2J%?_etESyi^oCI-N1|5|A@M*9&d_dk>*i*>nid{qG@KH}1?Z7xjY1kn?|1yCqkOjypJY|6XXyRew}c z6xT1Ur}|pJec9QH&}UwHUV)Lg0?4*^%UKV9b;v@VP%|{LzPw-sMe$X=flaVVrIw6} zF74=SSGGUY*_Vzrvew4P3$l_*>*Hv=<&;#Z>;v*lZq#)pMT!j_0q>$Q2*`5(Fh3ol zRPR0fXRG_!P|Q<$>rtJnxKXMZ8Us`|D2QwnZGJTgOJ*q6r*OKTgr>)le(h~;<4`WN z4a10B+#5BT?aCl0xk6|chYssCUbkU0oUVxXy53ON{OW% zFzTy1A@ALWufh}kF!SC9@xO-GzjIBR?@&uk{7Rh;D)SS2U?$gLFA>kqC#b z`YR%aa8?wI6Gu;ZX)V+mgsnP1BO=R2H;Z@vk9?>Oq7iYqiOLE|mE_jRlUNRXTKe?i zWzHkF0?>vZ?{J3S*`49*iqVw+(xRc92?-oTrC5!|ka`?Q4j5**Y;ax%`cs+6Rjnia zHwY3MYDV5xAGlK8`$D{HQJ`wWH*LUM*`5Kc`Bj_T+uUle{T@d z%8DI9u;0dZ^fl!9Ysit(hvDaz4tmO=rCavK{)fxvxet#+G|$() z;hUe}7$gf?twr%UtFjUA#s9Pu5}ul+e)F$(9uC5;5}G8uzjb~!57>{Sxuv5)CJ{;n z^ZyywlEFnC$l^)m`um^9v3c`@OiNrG+g>wxm=*XAXe0I0TPjloNB;UhQ|0+^6E8uS z65}$gp;H>X>hPXqtM7oLSC*P0isJ`V^hzWgxs*#{=`g)M_&9g>u57y(S)*GIS!)AD zScdS1^2_6>lEgV=eEVV%Hyc}3jQY*rQ>BpOmkED|kOv2`V^t-yAB(Nu-6!nS$N?Xh zQ?vsIk-*$UiBPKEA1?FBYxujv^mel$-ZaRh(0?23oo#ibPJx-;dv3JRC=hqB! zv@X!(i`Y;H^-NPQ75ZpQTarm&o+x`ZTpwdfDYdhE7gD3qVOR5B2_mJBZOjuefGvM2 z|946AwG~++V){E}-wh>7Wr8r6Rwm)j}>7;na&~!tcL;;`jRMC1*<9lOh zrP*4J(b7-7PqH0$U*?o<3(nS;R&U@j5g#|=>4ubYexq4jqwxf7Ohxn?`WU+@DOdtF ztmw^7SX^FOX2ZO6CmztesfE5wU& zgojpmw-)ku&A|L!=@~_Vsa#j8-9X9Hs{7y7|E@@5^N9mQpB{%l_fs5Dv5`yko#pmo z*}-UtXmhCUQn)w)1@-S{T)z4D{qDpd}9XXPK^9Q$1r(^Y)U(dflFG!th2x3>+`m<>*FG#bdqZnX40P^pb$i2J_g zXKEXxuvk7NVVP@A5)Mk#<6+*b!xfI-wu7md?LTRS5e0X~;tX!`t=ZRhQVBkF?Iz4m zI)qF+tl11qh%31_x3K>djzlpfO7RHu`$4!}0_4XpSBxLl6nYM>+vm$sjUowLY1x*b zX3Qa~R(w^T#rWDRDyyIqlzyA0ZOu595PZI{XB&DxZL?X%=As75+4^5O^$X$ZGBn6s zabcS7U1w$csvEfwe(yP_+vU9<|Jl)ph49?{BydFY(j(?);V;4b1&9 z_xQBvJKjfsi|1j4KjH_@2(ESLVT14THjjz5-!Q*Il9-f%ardxK<77SPU$uGR2l7wi zgD;Iuay!UfUjH`#*+t4mpj0edocaXTI25J&#qk3dBy~e1W_FwxMCd7iOL_z_J?n z(#AmG)0&0aGEACr60eBi*(r7t;nK%WkkUb^9#tU1#Okz^;5G%cT!1GpIZfR*j+F>M zK@}r!8Ia-v`M;4F;_?gQ^u8yy#>D>NrHU5KC!X%v1^m$>7In2ZEjT&P)$=i+jF4#} zCxbi(MIsUTkjzN4JUwqzdQ2t{psHNOFXH;Bq6)S7^#-_23Y(zwcu~7hp6GHEmj#O2shjafCp| zRb}T)+Uc$gEqk9i_pg*0Iq*5@2igqlS-!}KOnhCDH0ENlXRo^Nl%eJ)()VC4;;c1Z zE-0F{Zc?By^TmmLBG;x8yOVBU`H;VHW>xAz-TKy*TQUQm@eGasWbn$_*q<<*;F{5D zH^_f~S*gwWQgbJ1Qwi1dA> z7>R{l?|TblLJQI+3gb#`OXoAp9tarKkx>-e=&HxF>Z@)VKs-pyI!)mj;8i8Rh z&LPwuvD9AJ7B__x8PnK$ks|w{0G!V+%W0YHO}MmZtBc33FPgCMsD5rtE`-xHx}ZCw zDGr5>f0?9K9E+;Fwg!moAN(btcDk++|GF#PeWpTLug9&_nrrtgyaW35QSrlYx&+{M znwa_e208S!Rmp8>KQ?kH<9&@yL8xc|-Y4{IRO8MmkL`+xMW?}!ho=+Z7FVd2D({V*|@$eKgG`j%dZXv5MDXrI@HVi zHsgh+ZVXKjS#mV5BhsEtJ)xyNv6Dsdt!wh9xxCq>??KqHl>BFY`G{XIkOVGyypAW8 z?ZiD@3KBfdm!M8GEK94e=H$XCUJp^6&`Qmq4i0p8$~vE4ahsx^V%7a06~wpOFBt)7*!BcBb3p7x#{PJ82oC zqWU<-_7O}vt{h2vo2NQP)gEb!u@KPxjj~fP{^UL(dniw)o{-8X5n%1h^(S@IbG!8x zLYoKu@*MG{b$*2c^N2I+jW_klkr5aC+wK2D(^t4P)jodHB}gOP14egur*wCRNP{$^ zySqk?RvJm^?tB1|Zly;`{O0$1-#=ly&N=t}>2-eHp2;rX+|Vqz-_~t9qo3d=QR)=T zIpJgCn##6Q`$XNiO~i0NW?KMf4(!>(?WkDtpEiB^eEdn(p7)Col(KcX;q3?{{fhlj zXlX0@|EKORlu=_zayPVWpFO2xjmz~kSHS5@pW=5pl-z%{tMD9WtTQ>Qsmf>6YT^4DU! z3oqx>F1-aw+KkItC(&h|f_rvb4pPcx0|)%VtrC=?vW0SwWTMcnNB^67Cyf(@$Ucte z0gi`=_TO7tE+rZGs<0#Fu04J^sjtSeL!m$}5J@qEuA%x!$MrNiu$&%?q6}1~jmtzP z!JME>m-lsndISZ7%BuUm=ifZe)6qhr|bG|qH`W@WXEF*#5P%6aY`VmGi{IE@= zQOm#$R!o>9*EA}0{Grxiy@VRrhidV<{@;%*#}onb^vjav%HY$=Cjp}$E0k^#Hs(?H z;@{$2>u7n9Sl%!PLWr*;ACq5Jlb5B(OOE(&h1f^{5W#=g9fNBE6!xCFssEyAQFI#~ z`?43{?O3T>uC2PJjPEA(Qxtkb@aE3epiSv1I^OvQRxR=4!K%WM7uAhY8IN~0sq;VU zFtVoV4Jpp3+9}?o#>LQZ$}2sLlpG;+3=WQ`QB&8zJ+hvnQQG&Vq8SFV##zBIGUaZW@H*x&sW~M1dd_g5pVTQHPDx-{i>E|4^ zjM2_;$f=*f<@K7dA$p8z3F(J?dk3#Z&NFI~^Li8+|AFPZ5+>A}zKuu0DozU-!1Cj? z_Q$Enk3Erdn7wr*dB=jF197$FjGx8eu@|uys?xjfts2JEZDWzuM0{=()!eC>A^I8# zjw3-}$vX-)3naj_Zr_C6$ge6i8PeY7+K>u-e(B<_q7|{pS;T<|*VgSr8_WzS>KK?; z9L(GFS$Fk_pjrPVEPRS7TTICF5P23JuHw?MQqjpwf85Id4&y%_cG2@JhkqQ$(hNOQ zRg6l!UcE-AX!nbRYKs`!7q~|y|BSyM5>gY#Fg_NNtER-1GYpNs&N^w~nCIN4OCb+D z$que2rXG$(8@%e@&{i3bev_bwI%RAH{u`bnq7kB<(@yis}Bp#c%hC98Q-JQ z(Hc3T-$RC1m1_b(vP`R4{*YEAPDlr>G6nc z`SR(ai6(mzy@R3Rox9X|Rc?ty-U>rTm`H_0?`c)UzLEQmrc> z7IpgeZ9K|a94t7QAH-}PWkZ_poZ|+teKyv=xARvjF~j7A^+}zeF(GQfQn1`*l9#B+ zm)_OHlpLzS!~<5QoxNinj%=Z6Nd-ibnTR?aLAqu)C9l9n^L~@~oleXlshX$pqUZ6Y zm0gtE*ZW=x=eK?J*9e3$RT^H=f&G7Q*jXSht1|#dY5@YHED7C)PyzP-7iEUiueA1ZRH-x#bL4{Hr34@J6ElISYnm6P#bAnJnRz? zbOD>kT+OwR^p9lsR=MLccNij!iZQcFRvmkrQEHoDcmG87LK7n`bJ-Rf>Bmi&SXu#M zw4JXtC_~mnp4Jftq|WQ%x}Vt95%37A13#=F>&(!azK@eB*sXH;tpd1M6&g0Yvsi@w zLp^T1^XPXu*>k4`6WHnZKWz`wTk>!U`sWHf}m zhv@yU|H}>>&(8TSC|jGj)?AJ5KV;R7A?9fH*F08yFQ&skYP&9hy)EG>a9E-&J8fNR zh-MH-UXr0y#wNK9n(?V0mbwn*7PKbTKXkB@P7uHYo%Jqd4b$bv4 zT6SN|qB)KQil$t#c@(&5?j~MQVnW+bAv*$@0<;JQJk_*9b@S{2*e@4 z+@FYC9E9yMG9(w56`jwRwF145(@B2vb!lg_-FDjqJsH_-VDUXA*+1MHXK_d@ew-hM zPBw;O$6`1&M5YZtix2sjK2HYupTwGpNZH}4@Z1+9aa-uD;d*H%fL%PcB@?IciMVnP zNg?3aYb^V+y#*CUHtcLP}9c5c~~cil$;0J|=+1_w|bEtx=!?;krMT{V4Naq))l)LNen! zDTB^C%q(on)pUm0?jdZIDYTELM9RP0`-;h9nE&=?M4@{yXARFj7R*{^>#vwSPUxSb z{uQ}W6uf_1DSG*1AMmK^HKnI5U7Q2!i(;EiXH<_XMmS>ozOhRc^0&xxtVt_er+*aX z4n~Pke@ET%W8^X}YPf=M1OeNU$RjwVGGsmj{Rn5{!)cM!1`vDjnglbT{o?Mn1(crw zhktZXshh`;Qp_57NpeDFANCm~3_%$=rvus_iV3z?sRPGkC=qD!{lL6G(tgVM!#hWKA)TWG29fL4? z^a*A}E<`iN!vRjP2~ME@J*DPCYFdKF{R3>?be_lG$Wq$)46pjDUA&ofrQ9T*;>n(Q zYtOM92aH-YJJ2N}Qd%MiBld>HUbZfR@BdzNyj|M_zp9PE#&sPy;Kr=Ty9ow# zMetrZ_SzUlM#{kYDc+usB+O%ma|sgN!ZR2D>pAx}az5AU&fFCAyRZ-4+o!elGb{t`=!3`Z8uu8$62a~2fs=Ea=fN+gcGO=R5|epJ z0dFF(1Y65R6q!p3Kn3ZFW`LDjHj?layD}8d_C6)*cwhoavf(9cR&OY{+#5zg!bq#P z76JIVZPfx2cHA#cDyu3Z!Q23A>uYWBH9?9NaleJ4dR!1peZkJK*}V2Poy?B+9lZ`a zQvaL<=Rke3r?vds-X_o{M3W!JdWvh;oUTiuAW7?n=?3E;qJUnb_GUT!KM)~m?~nTW zt0^8jSqNeyFC6Rp_YdK0WKnl$tb8LwxAFzMz>hW++fp}wYK!KdLn>}S#}?=tND=C; z)|?ci%o8VUVMg0%3~yp4)t^O_lLVo^vCf@xi?XPsvDL;};2`|AUdPrc3bOp@H_V(n zRtawP2+4l1VZ7T3hRI8Y^3nxgNn?O@4HzO5iTh&w<4n}mgbwL!=n-)GrDQ1wNE{)L zlVZWccP)O*Gu$*~vhHs{k>b?J{3RUhmQ~NRf|rfi7Zd)Qv2~r#bd%^W?&8uMwqKM- zv~tKOKPcYHgE0UPh|GSN*rx|l>NmD*AH9b;7*xAsv59ZjRWpq`AW~K-~eiV4DJapv=iU7m<5;n-{x;mt1hhm&x9BnWK>!ZP9sJ%~))NB@i}iSKiVdqhyAtfh*0*YuqR-ewINH zN1lG8X?$F|`GWNy$8v}<#Jh61yl|uo9rd&koZIuFvjtb2wkMsNsoVNct!7(0UBd)zmFJ^lL zWfDDnQf)do*7>j%x$qh8gTs()*~U_;a$f@K?IB6e*ntmUd@hNST$CZ&k6 ze-h>FI5LmNZT!<_v`4Jo!^;6=rj)uGI&sE6dcB0)oj;GmqGr#pH$mVFs%>?h9Z(TY zqpTc>>=2WU1t#+iy)1$zE`h8&+=PduTOTtpqBI6H6@fEAfB-LzM;)b^5>~1qgBKP` z^~?y?zt4BZzW3SsQFQ*ZsCxF*@?Q8;ea}eHz0sGg#iRWm5dzl-cf^Blng&mI+BS$xxt$3Ss*K!xF6fU{}p*x98X~TCC z-EpAcE9kwaVg)6_Epmzn=Y5J2O z=b`umcgC~f2^?qKs);WR_4}4SSH}~jftM( ztrSxo{_u!s$TF`LVBMQooM9LpYAXYuVPYBiU?kGbTQQpGZ)p_JABC|(EiTA8w4+KC z#Tov&%rs1hC&b8_CZF4m@5@?MzZ*(YF>0IM^M)PvpPz_6xp#&A@bb;k>=%5HTq!@d zVzs%X1RnPY%7Po;o* z{V*c`{lmxmI+@g#=_NaTeqmAEPac#%zeOlO7Wn(1Ch)H6t|1(jyvTouIe-%gz!f6b zPR~LS0^6}w6Ds^-5sks>4{0c zpyR7YT@fP4%aEW@so`L`JBkZT>@Zk~OUD|Q4iogCfHcXfeF@4Qh89y|dAT54@{!=0 zm}svC1YD_FgpCE#pxqRT@*TTK`Y`XungIgi35}d$Om}rQEAz%Qv?A_~NpxE|2^nGs zht{Y>T9-~Bh+s@&Lk>rLZ4)N}2jr=rJzuHXuRQqcNzgi8$%#{q5S+U-r#Sy$lN0+B zEPuvug|tnQi8?mX7hwb;OBH`m&E4BbGo$!j(wAow9{lf>-=h8 zp3+!}*g|1{hOMNhgkVetnQD;`&o2aU-K%SQrSC%le?R~JKBW)umXwgQ4kNwgK4a9& zlT^!T>A)-A<#r^24K(`-ea`pk!VqjxK z+QG?iI-Hj2OV#k*>RLF|*jh(w@xsM^#pej2TQ7@i5RL2mqUE^=*|$w?UI7(eD&X+HQz2~G2Wtyk-opv97&=k5zQr) zb+@cNOJazDl+rX4x4(a}E<-*-IE`Lcb)1sT{3XrI>gf$Of@gn}n`aSY+r9>UIV34(0?1Z=zf`|pgtmqioO#CfR zG*fPn7&&+#thGXK9KEdSS>bQNt~36{WgXA2@aT^ z23iO|LYv5L^R6eo|5y!>%!=LKH!*a_o!*nbmHh; znC4+XPYd!(_P5Q($EiyPgsFJi=^}q{KQXi~)U9Twm5+aqHGhme{2Q-;fEgb76FEt# z&d|^t!Eck|mm&=a=J$Zia07i&T@@OaC45P-0%FevG2Q?6sx%mcqpUO?4|>|2M6MQ& zffTByw(dE(>S z<@KY<|I53pCVL}~$p;di01IE(e;o}AR7g^$==_Pg1LkKeQlCt-SAVx0FaCUB5pWPX z6!>P-G^Xn__E|RMZF{^UZJX*kCA#6ocb2KEq)RUgVePv)d3=T0e5rAObDv{ zaFsA(xj6m zDU=Q(+N@$^C1w|cu|Sj$eW?DFm5~!a<%LEk2ngPdYro(U)GJ6l%_k{JT*azCVBl7i zM*q%;rF|$y6&quv41i5MfVS5^)f0|p0iyE4g?H{qRWDKq^fLanj;nRRT4nlk%1ZWq zp5M$v|F)X{ZT)B9L2H2_G~@}sWL!BScwIhi@@jv`3XJ4)ebSJ(mJZ!Cf7lg0d{X|O zik@*l!(5s^z)t+>pX&Xe-%;VwFVy`SZS&h2{g;14hk~A=bIeT#7z~?;62F}Bf9Cp5 z4et@pmQ3nU-;)rp7LnAS3o1i6d40Rzia=LwVmN6D1CmyuzI7~;HYgloh?3dp|Xo$EX=(B*^A1`^wrt&67hT0w{DAZnL|R_jv47D z@nsfeaZuRb7l*Ijt(EjI336A#m6l3RMkuD(jajW3x@D`M^Si92SlBbq*&a zKK&?Y@7hum^yJjf%dU%_>!2hub%zytUl&-m$vt7c$=z2Am5my)?`Msyt67hpgwSBL zU}h0YhEwKt)SZ(Ry5{e5FV;Ofx1tp|?2h1|Anc-;eO_;x!w2EwDm?sSmBQ_7t|dxL zT7bI7oxWB~K18v5cg?fnKfmyd?chs}oHKn%kmtE?M$Hm~U4bUWg`{)tVj8vKP@L6I znu1R=qDQ}!eEzApe+Hjz~Q6iy{v}WhqRT5jSJaPPn za{G4>M+}*>gp{wD=o`(2Go(CBxX$7CA>Yk81Du{*$c!HYl z3?EN=L4t=HW&y{3H8mnw`P0JNS2B$Fn_|!~i`fo8-jha}RmN7aNmx#`J>QIf=#82T ztuM@7cplJoOt(!g4KET$1eHhqPBRUo z1v`ratM#w53A#tDLvk~jKQaVC^XUspo4es}&T`Dm8ad}Rm;hB9q1-c*UT#^&iPsz^ zuj~?H9^L#0&zP2+A~(&IYjmi39Cq9R#QOFwP{hm11(eg9(3Bm2R_!}gdD$`{W9%kP zP)B9&ce^P*mbRhD5_T?+mv#KM2f{AldvfS+I0H=(0sO?x3V*bxV;Ii14EfikxtPB*G6KDJZe4>O zi@3k}pr$R9UUu- zqESp=;oYF+;fYU*1LYkmVGU}Zp;MOCfKZweS^c-2!}h$#8uDf)Ycwit#nE(9i!!8N zK0iMby!%KrtmySRLF@aT9u2?uWN{(`_kA`g?k`o<^cs64U!q7UQMhLz<-uI=>J#-) zw4N7ryd0^E@2eAq{18R_he_-uanvi&`HMZmH-EnG*?#?G{@3V)t#v(z{|8BGd~+a9i21I> zU1Rd2QcGa-pVUN_2I{a!06+Te9@SgBK=~xTm-fMG-Ptey+|}8qV0~{LJO96b5sD%w z9hTs!9>)}(|4Z7EnLIaCD^>lY;M5!4`5CuyDR@y$py%!7qWAGIzj2o;DUG2zT5I{b z`$$Y(>Y}NygrqO**d2&(9(22W{&ff+zh8}o$nqFfuQ&X!rm=EX?;Ff0I`i)Q#ZJx3 zW4!chkwcgJTo5T;02Xc~X&)mHINkLEjW>VZZ7*8I`Ob5;+Grj8&PSp#a7yyd?&Q_E zzvNc?*T~?*gWn6xsR=oLC*{IOTVM0Hu<$R5l%;(s_Ai*3nWjiQQ+vX|Bd=Ic)WGp?cm%b?treVQ@I6iPgi}f*I6X1%LVdDI4W^zJc*{ zta?vUv73xzK_chXgyx=CJGm6Ub(&k`4NHi;?8e{h<~6*gV52|$==Z`m%&m=lEW=R7 zV$BgTMcP$)FU1AqZ)m%-h<`jzx>6)X2))M8Y8k*&g4xU6`%2v?6);{ygbYSA&o!Lir4xSa&5 zFx>S1%v=g^*_g7)kbQXiuXoe1wXV4?N3~k-l7~vl;ol`?e50II10yAz3Q$(mT>A~j zg1t4TT~f41hZd$fx%#Mvc?e}p2rAyDC@T_rtl4G@?RqqEAK=s}4)n9-pGI*8PN zBU$8V7fxW@QqAh$bHvz1dQSfv7){bAn-F?u^V{4b$*l^uvXG^dGSLc~Q%xh?wiS0$ zD}BjM)(zF#5b-iECMf0zI#E%U1nd7b%7qoqbkN#`PC>S02m&WWhMDwW@VM2XY4k1yAo7`DJnbtpFar8|5Paw)6T|-S?TNvaoPwdfbe04ju z-#VQXl=)h)34Z=Un{4^gy+@It1>m@$H!Z1$vz>=kpkDq9C?IsIqR4c1E>e6yvldxU zO+5<`_jmPQ%!i7w`w|K%JPzF|rXaE>S3|umKE>W+6!~jxm)a7a&P3L#@?b#}WUT*HEvlpjnzPaTWXh zAPcsL8Ny9R(ci)j<*e({McXfxN-7pec}5-h)ENW&Erj)6!VY)KV+OvJEtQc%W>UUk$z~W$o+*~S*v3$i5;s!Pa66*~CJ>Y6Mol#}`XK1*)Xf7>h{FQRWI5=)gIzfb28@=;jU@bqdF-Tw!S+3r1W5tdC z0Crf4e?}Zx!+swX^O4CS{-RCg<>?BRAIWxjj)a3>^qm@_AX7=rmGk#@3RInf*sWm% zj&sGSTP|OWopGj^j3VI~!pck$IP=qvwM7lq%-q`G1mV-#kxEFSTs5F6B8Uq8h&R=z znlaZj>#O|b*^KM?&hcl4-?5-L^uLji?%8A#!SdMZsiJmnm z^sYkOv-DON9PjvWsU+Y%>v%yqJ;dwK1C?H$iQ@@mQO(lSvHqqqLx-pvEGgyFoE#S& z`F_jU{m`@-0-3sXVp0!rVs(b}D&;=q*mPNB7GSu+E5H7yEKTi^<7z}ssWKrBN5j7Kf|KA0W_^U`L2Pf5wynzsk(M62MRT^smm@ZYV9lr=cXENlLZ<>r21=2Wf7AYZ8J3W_kpDRj}oB(IH3rulC^aor9V zexzt-DQ3Zh*fVzzl=TRWDCeQiD{*_qg`*D2Lj)g_(ue;PmsmjtSYjPan0 z*_+ZA9LCsWkF-F{5sSwK*nX0@h%-bogR^8h2IWkWvNNdVAQd>*PrNj#4AnIs`H&U~ zB$4EoV+Lq=X(Let7I8U|5*^wY8YjqknQ)7FakaWN?jXa3^zuPZXxw?!o~A^4oHnY| z+H{ptdIn{(hj^YFb>wU%ha>$%S@;**wxZtQ zZ)}<4shi_}FhBWY9rm!+->x7HSL=n59~+yzcl94KNcx z9a5HDo@yy$Uj|P6VuUb(mtRg&7Q9YAgt!{$&} zQ?Ua-81Ycb38)dq_J4gd5`#ved@ou_tD7i*R}% z^FU|HqpQfr6T1=8qFgmn^2`@=GofriRm<<-@5ci>!&OgiR#u{y z`2Rduq4cx&BTyf^1Y)AEMz?!cjKPmFX&C7?R3xO8vUTYw!=ta_lplH=t1jD0rCA{{ z&37%O0V1=5RlR6!ztJLci^m*H+MOT{AqzY>Oh82@DDt)!bD260^Q1fVNJoh9P{j@% z=JMYmN@B{G{I)z!8OoZ#@xp_TOZ_-5%Al3;p<+Wt-52R{5V1m%cCt!S);$;ACzlplqo>r;pKH zhCG}XPP(N|oR?4rS9G(H-01}KwxxuSE66JzNWfy8qHazUj+m`>7I%G)r|^%(5rMEk}TwOd3LfX=#bgoB03^o^`ysXqRY*7+Htr^eB5G zw=sLyVxPNFRDw6ere_3$h|hM5!D5oo4{<6$c2ok4j;w!*tKiVEiwUl^gjz>hgb^|v zGOwE;)JgKf4Ox&gk3}7a?c%|=DK#Q!%Ru3OCano;3^i*dWT0WTigv=jK)WfH2=W$0 z^G3X73I%ML`Ap4#6M0SP(|*!lZX;MIlJ?KhHJt3xjmLwS?v1AlPeZ6&qq~CzC&xM5 zpkN^qvw<~@ofwo_si}f~EXi~(Uc_cpJM6l>&<-8bQ5Bx)KcU`Y)B%})DIkI~sW@O5u^V!O(3-zdfzl8iuDEF@_3f$6Y(65 z6?uXOUqTjxtSec|Z9d{4mx2sH8oo{vq~u@fjy|J>4=ZC4_e*FjFK?j9F2^afVi-6! zJ@xCu-+1Q8<_LiHcVOq0P>==DF4DQhic=%Y(|{r4>#55L1!9~57V7_`6fk=px*axo zG^$SGrs+AZkXA7!Tc{G`8nOf#H=uMyr>k`OeaZKqCrM$BKfi|RR2sFd0;s#{KF9s- zmujhMLT{L^X(`(!<1hRN8e1!2hu=0DZ~Es_4V2@CnHoWooqs+G-1$3Iz!rxxbPAi- ztEkMb(YaneoU|$W`g@g%^?nadC0Mk57FJP|NT(8 z!${H0$Vonu9A@MRSE4t{s6KjZ%8E9`QVS5LnXdua6dxRQ7|B4Fm^L=(YbaZ@rkWDO z^gl5-)*Eo$$6DZ$%^Me`7z}@Q672qu*CLEj`8kMpw_zh7R-TaUNL$`|-Gxd^G<9cO zc(N>6UNjmZP*J^zTNQ&A++A*-C2kE9sVEJ0{yn8T1%3{9eeMC1cgj6S1BB<6H z5iBKctA)=%+eV@K)w)f?zpHE}jzqZ50$Y<}8MgO5ZqAmorV$pp1?*GXjf0VjIq zsD2|Kdl7gf^72U{Gob=prr}z9z0M=OoNdN+K(KXlc{^`0b`uk6j9Vekdr;Rr0~<1- zJTSveer+{Uq({Sg2|BQNA8>oNPzi20Xt6<~pUFZ>v zXCAVZj++_~eUZH>L2(Z9{dwV^4M0mQ7i^ni(!uR9dx4IoII6mqgwLY?j za~N*RKPc4Q%$IAaEU#Vyf~Ej%557|CuxvByCu}?t74z$~Y=VQ;)5XP~HG!O(q6n=p#!M z1R>N5&J@4j@I;;Fw#f1^0WNAb#woPYY%$`ZO4Nh_qcR6Y9}Q@JV=5UF2@jWF5_oD^ zOuR#qc`zwMB*vSf1y4Z&zk#$xu>kW8`dsBSp5wI5eaN+G$eRRpZ4+5%qnrTSOG7wP zHg?^|RsZP|gtY+xKJ#Iq#5|GwD8TsGdYNX#lh63O8z)vHo(7pJ3iXO(d{pD^dHxh} zAp(=B7T)#;l-~++Re}4bC)^ELmzG@th{q=aL8t}dvMk~XV+{bKgBrC+_CDS5lo$#* zj)adKavJ4sW)wi}stL%H{@16@h25g22?JuE`NbzokN(26>B~Q%Yp^B{*q!{ps|8h< z3TKL4m!7f&zfeM6!QjRYP@ha?NTaD0%1PA*s1PnNna{OXYS0Qynh2@0NIgmEQN)Iy z;GKcv@RrlUyeBueKix1KJO!F`4ZS`N0|aEk#+Sw8YLtaklq z(PZMSpl|%SuSiF0oJ-+^4vD>RzgkFCjM810ZZ0CWmV$&?8zvne(PH&ktFlxG{`H}e zHyOGVL$q;uHC*viz_cAO#{8OP%biF5L4BQ_C)diL@^#M`CeduV)iWdW9=g^~U%ZT_ zHESJIdk>&@PZz!ST656DoL~IP=V)s9F^72B%Nvb$N2BP^?WxLvOdo>IMTMesT9~F-iXcrDakq3_QK-vzx0`>C;JH{A2lepM>Pbf zpFXF0FFipkC0>5q_srJL9!TR0k!-R){tOCuKMu?0Ml&(pvvN0(=C*5Ds7LDJxdz|l zzl0=u}tUkE2lUn-@@z#5%A(VDq6IUcxmQ(Lc+3N;sMO9b}$M-m3E# z^pU&hm=Wu0KK8G(Wx_Sl1~Ku?_gLVKgE-0uk778$8H1KQDUEaw{0x<>0bb47KhIw_Il4MT;S> zd5`F6nynos)!}Lp`qLw!E+wy|+aE^$q4&JOS)+BNIA1;9&bzrLBscu^VQshsw!PZh zY(-7s+hZ44Qm%S`5gGhbFr6#rrtBx#^v``;Z}GG`Dt^dW;mkIuTcZ6d$^6tgCgtH<)^&5Y4wS27%d8#DJ z)GSb!;=szR`h}`}aQ3deh?Llc_w9lDuV9~N*p@s}P~k<22>bT`o>VyOzzcI0JM({^ zNHgdOP&aR9a({Kd$>=^5Z>@EUya4oNMuG))}P>k;_@K+lKk0 z!5_-w?=0jNg&ari1V-`TfO2*W9ND?Niet2JbZOY%&bD5$+;#IDmK=fxVGCB27vpK2UXxs;(%+k{WA z(RJ;Yo+UzNSlF51N4|ICVfTx@__ixtQg!iN-qNTIx=RXsoZ>mrPKQ&0cYW1|p^rMZ zI`Lz5vzk|+jJokaX5!m)XuT-2%w$-cMCDgzqe{NuwIc!;xnk8!n}vMf%NIH?<3SD} zB+6ODFHV)~R1RZE<3-3`rvbX*w2==(1l>4vf#cDt#m!EGIREJef-DnAwd@;ke>f=# zs!D;->0L-B1HIA9g;l$^3+HP#-R3?l5~r2!s7DKu4^^cLW}_?Fqy6+7i3R51Z)3PqZAZIo387b_y3ubG$i5@j&dW*XH z(NH?N5<*(IgAW}oY2~_&U`QO4cVA5Tn(U=@B%giMj2|Xv|O{+Xn86a z6Qv!16W)5muSkiBY`q0p>Tz8qSxj(%{Y%PXU7MH?H#kYB3Wq@;=DSN$G`;pVWd$f zAXVR>yd`vPl3d;q86idaGG=;$(cd->C?DHrj!X`3gyk=E3uf3RJSi6Q; z8HxIFUOQ!R;7fBF?A~++ujDfI>!Y8s5O%Rq<}b3e$Bk>I8#(Hb>;X+ZM4CC}=$D_$ zz0&-`4^%jc%BnFwN|1fLU$%!D7oaA7ak1zJ(v*N@1I`-A(nm|ZxuQkr$4Mw>1@w1s zY>V`T2k|j?xiBHCjh*Er4{2Xr5}B!duHzWot>wph@L>l#SvX18=lhi!v@yx-?g?1r zdQ|It+0zv~_1zCn{x>~gC{a3ax_Xc0wDFtVK&N;!?F`$J9iMSj8woeNJ?vEe6S{W` zbC*!okJ>%0A(CB!Y#16da{$)W9|?5}Z5;N!-|FaQOISU#uMZRzby;mXwoE~rI3rwAtep8d_-sx+?4^=83~cmx1rc zcl?RVIN4v+zt3^jC}-EYdpfcQAWv>o*!(aQGbPLo;R%yPA8DXvFweC@3vpK!dvQ67 z$aMIVcPcr4a)6*3Ld*asx+Xby6RU!u9yBl#1OM!}(!dn*9y8f;Z27Ct5ASM#usJfv zefZHej=1(d#sqMUfIUVVGe^^_SrqyQ&#E8@E?To-j$7uBX49`_jG4wqo6w`c|6Na< z{-J-Tx2dvbRQ?NiB^@FtLq5#5LH4Cp`XDTB6tYo)rm^eW(7TyZndSch@@zlWTdug- zWUc+I(yCAqFy));v3E-wr1-W&^=b*q)9uVGNl$C*`B}~LOGml`#yYFt_~(LuCw)I8 zR;@7=oLD>*J8OEA#z*s=x+ScTX#8b>dcsx=CY>B--Sugci9?`>7;Kgn8vRU+DdF=c z#~=C6TlAd8w>;ds*WQWW0zF-0tXeJ4JOnZlqVh%T`q>WQ!E|uLQSW7HDTK7aQB(UE z?>O>qW<+MCDKN_VH4rZ|8F${cv0sY~(YnpxAt&t9YDD*?`;C8pT?Cs|3$I*S2=bQf z&++VYV+Hc^l5<)JDEq%J8uf%m2ACjd7||1)hhmq`3j0dg6L{jSza;|ukxeBII0yeR zP=5vy-~Q4Ki!;n>|AYFg(Wn#l%$gj{SF+5>82ZFYp-l`f@`PdwcQ6?kE#*yglM3Q> zo~gne3mDHd$tNVu&uS?!>e=BXmSQ+s7z2 zCEne*M=(tFx>z!iXCg3sgIIn_A9kWaOo^yLmIzh>)-^e28P#;GLHKX)IA-)6HV@dp zShj!A3xf49-F2(m2vGr|B<`#w4*B4xMm27@nP;w~QO!J})^CPWs{1YpCQ!wWrD}{% zbHAyvR6*@$P)F3MQc_ zS(SX4mvr@z6vqzml_1Q9Ozv^u!;j0x8CW%ZR1Cm=YSh&1g|=gM1(4P4i(cjo(8b*`xowq zAH9LK^H@Ebjn$`%Hx7QY83nP)%yEP@0B`vl!dCYGqv@Q#u)?CUzu zC7CIwq4-nvj)(`Uf{P9N3xwFWR8CRxZzm)TQq{<8wlc~g*Eu(j_-+DUipBoSbDXt? z%j}2%Mu*ScWt6g!vjQSSq^uA*LOf>WdZ!^rD`F-V>?Gcfl0N8+H9h?%s+w?6oXEIg zP%>_4(JJ0B!#QRWPB8Y_0D@6L2B@_FZ|*5-{j`?$j6gjfOo!YKMND6?@?BohjOQgPB8ke0YEFic8}IE2EjQ1kX3(0A0aZSn`KLw+fMg+K?C*Gx%n^bUAc(F;z@cg04OlzMlLLB?A#g zQ!F#LbHJ*D`tm^kptw!sI2FEE-P}TJIWm;8$&_Cziz!qN7e$S)$snbGoD*h13;x(% zHdYtJ{E<~)HLs<6_x^WszGiC-MKD+&I*~v3Va?MgON&YKyzz)2H0C6$4yyCktafmk2%Mk$mNOLi&%>U^M4SX| zuhqIadfDiriYVjBM5pShAh@}U^xrk97o;5j2F2mGfLDlbp_0&t1k4dPU{6+mcziFm z3_6Aw)N!3D7dkr|0nE%2_jnOnjJW0vcq({Z>l84>AA&8-7{bT&}z z{uPcN+C&mesK^-_{qYI1oZcC}q7_9AtEDcg)o){j2B#`7!F%-?RkdZk|FEck-m2MN zmQl&M@y&SEDrFdXqoOq{~+@fYZ~v?pI}G?5>RvfEf#WQ>4X&21rwy2Pw-)t)#sL8-(piT zT`>fStM$o`WN9&i`Aqp=!5P!ZGVw&^sKS8ypUfVAx&5|fd_lLr4`jMrxP2c69zR}< zCVRkvTyToyv6|@s6iDy!ec}yk6wHaslor^(59RyEMhx|HhI39A6c&bAsnh5kAmA(ph?+D$imQTWB#{Est(yjV=DJ-T$%- zCMxcN*#Nn=$eR*R42E0E>#s*`=v?Whi8U5^uLCMj?YOIo;JNd`ckM2H4K`{1gHvX{ zg$>MFP5$*A@@g8nw53<9{AJrh0)ufw0cD0>U>kGD&JH6uSVy zYG1RC7=i7eC4bJhC|vfDUj}Y7-COUD^Kiu`V%3Io8?;v)V}i4W4VlBnUK<`vY9ACL zm28OO#V0lpzF;K8IRC?@^Ds)#El*Hbyy^3bJO3$b$9Cu^V-7MlwfBN=R2@aGYu;N8 zPuYuB|LUTKT9R6E0xjT3ye~s5?e#&ebyEH!&UrX&O>A6lE;Q(H>VK!#-RJ3bT#;q} zztc+!lMnH4&@UsubBhc^nuxDnE^^THF6m?&3x9bm+E1SqpXH5T7CvMBXn|K@3pyS# zRJ2&~QK%tl(p8%OQlN@KFP}`kSlD8niGrBn^?!O3*^ZVQ*MHA6QWOtW zrRbOz{jK(S*%iE)q+sS2VC;g6xbN<(VoU0HJjSsy+TrxI$nyzWiij%1&mkXqk3Ho< z_qPY(dAY&CdG?~>Rz_Xmfz-Vc#d0XKcFiuw`QA?sd@(rVoz0Jj_P@A-yELIc+7PXi z46aJYebwhEw*{Ho=xt=_potw`d@Zl_bA=omi-I1qA+G`k1UcmNN%_-0A(J3rjIw~) z#c;)>1ku4K2{g%npVFNW86TDVAZP2XOz+_nL5hD5j^ssT2))cFnI5Go!yhmTXx3@L z=izxS`s^MCety6Qc!L-_XB{2}`UF)>D*~I;*UE;^a(1$@Wa-C_s1Y(S5p)QNigZO1 z=Vu_P%>>@TANoH7wX_ZqJ!0%>HK)wgh*|mEzOQP~HZ>JJfSaoPCFFNK+P2z64gWDo zrluiZRhRBjm#Q5gIf5S^1{t4|HBI@PR%_?m(|&QqqRL;LG=(jtP%!Iw1Bj)t)0s{5 z!SF>m&Ly|9YI^oHG(Yqg5+p{7lC2WuAx=xQn5LbGXJ|4yN~G} z-e{AMUp-6$x{ntEPl=Sez*#&y=k^x!zbpT(*Ui6Dwt!P~mFXjm-e{DRqDBmt<-g9_ zfaCF{BL?A!f|xw*lM41WOY&%r_(P~&N-1%@n8Yr8#R~#{0O&}HVxF#6tuF!RWq#pX z)+Yw{XfIOu-`Ak~gFz+*Ocd0D98z)TLpoCDzx6^r9mkDBQKlyv#c#uFgHKCW`M$?0 zCYT%?gr~}xkRuiw08fte)NYiSr{7RMps4zxW;^iK_7bAIaAV8T9Ij<=bxztyH-AEi zZY(lqq;OP7$H7x>bD$Ze3mHy#Hghtyzm(@4&q8C9gGa~=E90N}m`hgg;ZOl5bRPQ_ znL<_}TH6R)Y*jMA6)6PV>L9L(UPRo_tA+YCB*~3Uz!W-X&3$As4hPI9K_gSZ1wb>&puGr znv*TJ$~zjZ{vdJ)%|>yN>37?w`d6x{B$MR8)&DD^uz7z_l4Xi0a_}V;k*8|}x{TOZ z*qRr2-JMg(#X!vVS~xxro_V%XVmVD&Q_x>LM>9Bqz$No`8n{U9-xTQx_a$LD9e=I$ z7Z80-VgQO${EyBRjHC2%BRe$!1X#U#*44V|+%-jvPA0h0?4Yf$5zBpb z;#HKgp#$JJN=pw;5gb*Bubk>!54oAj9Nn*N~!cuTPef@ zLjr{iu&+w3!ApjnYU>RV-w)=uOtP?}wWWA(MM+F`}&WCV2$)>!} zG8zQh1Mwte#E1FtMNU>xE)%)DM}x^_KxZG&5LW~u?U6>FTq^DUvj=G;4LMEtj*PAEwlp$2$3dBcBq$bTuJ zN=$=RM1hEkx6~2D=HQQrIz$2xr2V$Go`&3;@Cz=~+)O+d88z|cdjfF!OS$1&FqU+Z z501CdoGsW>28?uRLp1(jL8V_2z+=`L49k~y=0-Km2-}8+;xjoC7yP^8o|)Z@@%?7F zh1T6)M$+f)teGF0P}S1XRmvA6q$x-_>|2yzn?&*#{lbHg@NRYSxMeUPcErWFCVnA^ zmG7K)KAm-93TF;#+_^1-9H1wuY))rlfAnH~2P#g^o;s>_0>x*ShNPf4g`u@lYbb}f zlR54WCB!KqwgHqtO!I1FP9lelG8vO`3G$@K*MFZwQy~@F{@l}B!UvAg?N<*X28cp) za%K*Yg~jvEVk8~E!kQ|run$v71^-Jvy~Vj!sr)YzwhZ?jv9`?qGPkAGde9O_G=B@Q zi)>@Lyo;6?2-ul1O(B00OO9r_jzK01g&z`OX&18xN1;Ysq~Z&O1ZC}EOz{Gp%6uHVYgd6aC(Z>5GMz*FvC+s z(ZhemfxgVgPXnuW35o0Yn9An9-o=QmAzST--HIc+Yb$n)Jio?aR76gns9IGoMy*J_ zr`gtVo4$Xs7_-_^L6EdPRW9dL>pE^!5kg229+Vh#Rrq?Wm<;JqY(oJUkYV+ zRT4WHcPXT7QsEnLhk+mkGB0&@_Tq7hQG9k<=xzxR3`NDDQ{2ne5T|BwJrA{o zR-97E%)=~_x0DY`0TAYl&xRUtxEc;S8>>uVb&VQhom%9#kUtl7-p+3*J73V>cZ-<` zj^Aex`rkJi%n$!r{SDw;?8>7K!~eY?+phqyX8aTCTCM-cC!x)P*I#3 zAKRSL!~|53@8i2OP5)KfB->Q|`Bt-7jdH|ZOIz(ajHI`Qe;>rJ6%~=7_XCr86suHDdnXOCEAS6DUXJl zMWe-qEO(k4)JEK}ydz8p!DVjgfV6d@M+me@CHGoz+#p!GnR`w8z)_wU7>t4!6!N~1 z(LIReo3t0LM>!T}0jN=a5$#fxRt8M-8U5U899y!krgHD_4MSvl5}3{NI>h(1-!l5z z&60#t#n#N<{8?$T^7KdB=(2fe`Y+#OMORKU36shjnK%{GAtg1WMfBqNZ~mofTojdE zK-2M7&HQK>YFdF(SupK+V`}{B*kp$tFlv5 z1Gr@+X{Aw>9%3$3a7+E#?-as6ZNUcB#327#3{mlROu_hN)sfA9IFBCXR+dmquVojh z!O=(1xIt~PVm=i@lWj4{U4E&VaK#cOe7*JUuWiiN#9dvx#zF|>ZwNCw-eu2OLtT?y zxcX@+2l$I@MC<7h1hL|-IWTpWlhfgUI0f)@M9AZKSwnL2qB{zIHMqvW1~Wk-mY737 z>5ve_^qoDYHq@Bl6%**r~5wo%e+X^#&zjPqbn@7D>20C~E{(VvU*uBK>eJc6GQ{`n7?ju~Ohk#y&} z5Zh4Pxs9=f?L%*ym+yJ)XX7==;>r}TMChaV!(d1~iE@%L-VdWP5;weyjrhgF<%Vy_ zhh`U*v1uuFY75*m-;5e>;lPMkqiHkvtPISJz}IsU)RTflNxF$;c_+GFUFoJmW;uH> zH~rrl$6r~V*!Z=3*Fv60@3u}zYx3rcigMjyNvhoj%HP%HiYKxH`~NNv=v>l11C1)}qGwW*kfCQ%DM z*#-5K$ujqMqR5lCay|L&onISx4V$FZUGQb_imqG@)(SZSlP90XzXm;z3A%$mUSqh= zuJ^8#^}dY(D2G!0LjM!zYA$GQK!r)vR@81H%vH7=Nbux~v|K%J^tSuOudc6Ef^<@6 zI4?&&t7CqIz%1eybPsrG+ZxX-83N?th*A;3OGiwXR{(5girj$#R-rhxN5M5*KH!=Q zV(G6u@Spie<{kdg-v93KlH&+2HOAhY)`P7GpPh;BlJa(&bug^SYu!b9L2;}>7u=88 zi8H#RfQ}50`75}bIV2lC?LV-X|8Xb$+AOSIK)6dy$|JWc3r!H<%V5$Qd;%sX=CST8 zkP)*{x0WR3At?JUe5?5ho>=G1E|Sq;4~ru2Wi{o$?b8YxqiNYOr_G`+Gvyc!^VpC^4^6n_8autZ}T z7U^UR7+9VC^Ytv|f!Ja(lNV;LrSVVLG<*2>a`SFO93yd%3`a|Yq|!4HYrKgc|2wg= z9G>Td1x*(4${|z^`jY1+J1fK(R>d}UDFfUJ-+b&)XrPP?(LFiHS}IQMnI&(t@BM05 zS*4|-*4?j_7j`}Erb`5i5~IoCi+7AZDnEM7shY^TmGOMVBk8EFLwW>XM z1TG3@|Ax9)MinKxUSq~D9lGQYz{&r^s%z2grZ08VsFoqEs^NH9=QCK0C0 zScm%vgVKFBvFmUbbDFA^rduX$X`&)Dd%~bR|3$*pMyX}fI-k;;$h5*h{XhpqSwoRH zP)Z8@K0zN&+f75Z2L7{f(G(L%@8&Y&{DPMIni8vxV3_4P14bu|_v zuA^G!n!_|iM5GI?TRz9cNHJZAtoClT@4nXQo;hN|#|D`h3M?1se~;Df32mIvqbWEM z!K7NTb@aTp&G*{H#l};A2;qr%9!iPxUibsh$0ScE3Mq6B#5;j8aGju@F2^BYCI(2k z1h-e|uYEr4KhK9(q{Y8e#oHmZNiYA8ozjNm*N6fW^+1r(b`!v{{wP6MRO>vZ(d(2q z_I3V2@57msnoXtBzH2~wma%oMgIJM^q5VKg-5axsXn;bo%`=)#cyO(?l&E;2nS&7T zu1fZ=)M49yV{Yw2|6yhfd7J9cgvmPC=x~z1I&mbGymttAQpo;6jHh!dk?*mK*}2VnqO;F=n>93z4T&+kA|LTRQL3;o z=~vY=cJ*e@z@Q|3uvDcn z`;z(k#|HQ13aL2k)&yYxgDSxX4$!EdUP zB!Quur?RJ2NK71sLSLDHqc5YnX)Z8hcvH-%mCcBB@sz8jNshEI9!Xr`k1fvJ4Xd&? zr<_qPT?mpCFCA^LrUYc5)}yv7@QFKCDJ3v7u4?jny3;^1q~y5e>UlJsj?7N*&_pho z``QpDEONC%_IEPfy&b1zqgC%ai%Zdo`+Jb7>r^j|M3d%4Hw$a?i56A+{`4>mK>+iC2%Wg}<>4xb= zui{HHyai4nssml`U^c0226lxtw;mVN+??I-{}9U1XILhkY1#x<+^4uuXSp=jn3Xg^ z3KFq~B~0P*;<)KiI7$>fF-Q02DMiZXcnef6)^le13bHmVjAS{f2DZcYznh7fWCV&y z^-zM-u;xa2>RRNKU(mQ9M-NnvJFb{(4_ShoT{Gr)Hpwku!4rbxkZ-wvel5Aufcpq( zf(7tT;M|cvIPDYgahsn(Mh)BDuQ5rB8J6SzPIH9I=F@BT%fr8P#RnWi{76aimw2w0 zn3G#xh*>xpL~ z&<=BBHLoH{tLpmnj5zYrC-&t&IoyGVn{~FW&c%ZUzg@sMTLgYN@@-k3AN}VJPOspJ zTyUl}Cmsb>njd&xQ*>N50W3luf7aBXM2`gB0e1t>TYohjmE|~65UUlJ6QbW=d}%q! z1BZBTaA==?zwE}bY6Vr(xBz=iqh~J;T9ZH5gxNY>ou#%kolFY@zOg9_6|Y}dd+*fR zdv25XF&U+H28<5Ty}&oL*5lY1U4hWF<2x`&Zh(&eo6=mHl>QcCdIl#ug&z5lYFBto z#SgitcxAORarI7GSQ^9Pp9ts~anbtRJ%v~W!%Vx=x8N67o)6m(X8vLUGOw3^n3BWy zzl>QOGF=OJH$AQ^&qYD6>Nlx@;I^g?@;C!7-1b)l)Q`uy*G|G2a5M%|8ATE=7|TDT zabL%r-_*PK>KFk*1zMkq)8~NESXOx}O)ve3zOwu;cyb9lGO24^3fzH1vec_8ixK)y z0Yd+(Pa@!uBYy`vW97Rps`PV+!PYuc8*aI6s;M3(TsuIZoLfvS7$=&m36e~I`Kh3i zmBm*fS(OCrte7*%;6o`uiNVLbp?Y|e>ctg*IN=%>Ux?LD%-{$}^qN!%S`u)k=(8l| z%Ab9hC0Q+iGna-*rjYu<5K|>B|5E}_ZKZ;Vc)k*EMH$mIOl{(t1eF2MzhA{6xATMQ z`QX>j`dDQ8bXtdBC)@w^h?&0jf8#YKnb0?~k3R6OD|>yL9X9#aKrv^~iN%X7&iw7n@>| zcAYNhWe$@X{hINrok~?5y6cdUG51>e;`w1Kd(IdR4d?O&Wr5tA{X9iIG6N`qc_+-ZD?@{3LdoEu<#oNBD_qc3eRVEr;eI0lyJfqWoV`0cLpEn}!gW zLV<#75psb0dd1OSYLY$K2mq@`af$J$cy_66Nv)e`+Unuef`AaBR)|yqr+c(cK+FRA zu3iyLv^%Dz-gvY)F2Go&B81Q!tC1@l2Owq4@ufhzGNh4$ScDWKiO+GhE8L0|RmUbR zYJPeFO}AFZsyCTItOx@Hvs#qb!tCUj5hDPbz(jUgNXr?~%@xXlGX`8$BYUTP(+a7S zCX(MnD6rLQOmP=5iKmb!6{Oc+af~ZQgLJk<^Red4kXm#=Rty<0%H8EbEjNm^KmF(h zcyB{!lM|7Sf5MXTk1ND&YX|)#BJ6dMO@yB7Y z@xQg-+8hF%#hgy08j^g{6X?e)b#je0Upomd=zFPZ9Shtn!tvPT0tSdY5khX6`?%E+9US$qjIWc6J`rvVelb|32 z@LeRvMy$KYK{cwmsw|w7B}VI^<(znj{1-z}rK=PJ+^1zD)jOt9ku`Kt)*1MiLX$ww z{6tjqg|Pz=Nq~R)>vHkbojUTEEie-hO%f@=Z6UN>$-Ir7*R(+zA4CB=455H8g(Y=H zrvNvJ<^>aI{N}7a`~4>{0zUlmo7r)v=lrR8#Y~8h}q>2o%Bm(cnO?^ffxI zw)XDd8|iTZPAp#y0}UB5EQDi+LdrG1gQWJ+Q1BI@4O_()BL*AU!o2f&GLXBfQK0 zAUUxaEyZkO99fkT184&YMKf8^7C(A;6U)j8sx&B8yx8`(qA+myjlz{}SnyaEI#4l{}VDek2WEtBRA*3#n&C zzju*Om!%@@IbC;5tdO#)+(&4*Mh_4RIx&E>#Rj_~4jGf(IE%_Z$ZhnwR5n1x<#>PN zWQ_4vDahHZ#%`;KYk?8s4QhyK+!FX$_HG1UcC-o@d9OqPPPhWUAPg21zcE!tHM#W> zN93i*Xx&Q5W`yL@u)L8O0lbxv!qoOS>kiF>>4KkCu;BgC@enClh~i-Ny#-fQh>)q3 zE_trKxxdh4<02f>*y3ehV6tT|qv#?*F)rwe3d)37X3KLg4ARjf&ZR3dQt>i^I61L{ z=P&7b@>??XZ9oD$&Dlaas><@XdBAGEdJ@6yyX9$~uX36RJL?yOytK}&(}`-4LGc$- z&3hwI6jAGyDh(E3^rI$~m_nAbh|BFA$0n5DrLI*Ek|k6*i8X1;w?C$L?BS$rrF5Fn z3TE{w!uBZ^KZZ9g{@kcpR{dQ?ESGUkThtwF^N1X8vR*A>RuK5k>Tp`6miPCz3RhZJ zj7;))qj|OOr$`7PAE;IGDKk;ZDONsl0h$xT+{T+`iWuI%+GEaQ7clJ_qo&V%H%)l2 z3tD>W(Xsr^+XsV#`X4S&sOllL(xDL>u~14g`Phi532sS&HAO2<;W?g3DGvRUEw5T^ zz0eakrglqs2$Qt7ftri{G3|*{2ZKt919eYF6PE+B_w29wd+U`$PvEoN3 zHApIoTv_qJJ*=GynmwK1AYka(c9!<@j6@&Tl(o>EgIw74fkX#HwyMjHTLb+eH?dJe zERwFyyl6@+m|MAEYXdLE;X({oL`6&;JTyHB?M9Jmt=I(?3nDIxy2(;|_e$wc0^M?3 z%|c;GNC#XgXWi?Lz5=iSIv7=6HvdFH$3-FgtC=O!?86+$!%%rhhu27-B0<+sH8fYA zAf*}M6c$@Hv}1Ait%B`idp5dm!Ke`^(zzu1FmHwYkl$GsSegHy1psD<@Yjc2-UcgJ z!leN3*kjMdVPC+mk%w8YzFTlA>+F+&ZZlEA_maB%I3wH=7x8Yl;~I@3>?!!P{o$e` zdWet)RvP#Tu8+-S+xP*6bqBzRpnEs4pbt!X`9l2Xny=MPK|Pudh6IeAIa$V{e!}t1 zraPci+3+PVvBKObxK28D?QbZ$ZtyLhWJT_U#C`+sg>gl5OYzeNNzRXZwZ=gTEdp9H z!ncv(A`&|9&EQECI3e@T1>B%>*N()j5=)pMx**m7!%BJu^uD77eQF0E)|~qH62BJh z`$Gqmp%>rTG6FJu7yAAx_^_w_Bzx3b8*%BgOxI4+#p@FQ_$R!9iRl>PZk6Hec|zl# zj)n+?;p@W9^F1?1lwR6 z5+#N^HgbsZq>8s9jBn?2fi2FdP&T7?Zm7#dF`FhhlcgkFYm)BEJfy#QgB!V)%q(!u z*qibz^+_>1|jxJizO*5;}y*Ik`V;>uRo(K9OT}baSHTX z&av~VO+=|lWnX_`Zz|^2DDSZGgSfJst~{kYs|IDAx14bIEg$jPCXSnsk|8;)xER^XA=X{u%^69}vINUyej)5H&F@ z1%8?n!6uD<`HTApnmbZ(CXs18R-WhubmE9%QPaqM58(j`g6FatTDu5NETMv79*^By8-#5t zpCJ@qsbkIRve&b{N~NZ78Ey3s@QWD%rT_ih$twqi{ZHzDEcGOFJyej?2W${E)=z}g z??Xte`$WqO^8|&5>|>Y*6X0}eQhoFQha(_^kvAV-++Y$t=@3WJII1UNaMGk>iWtSf zc?!X8K6*-nVs+^BYtqc5PYCUe5jYtWps%0D4*Z(UO_`MTN#2r)@MAVxyO(2Nm)0Gd zPt>-1IiHwN>A(BUscoNPC#x4`edZ1YMCj3<%}FgJ$}xQOpl^FQ&Npm(%6saF#HCFL z&l=iszol39i5-^T!q)&&n07~L8&jz8&>4U{Zzq}_Y~2ry{jdK+gzWFD%%8*d@{g|) zBZ>?GGm+-Ny+uBwrb$CfYJy&ig5Uzp2za^v+Y4PNW=6LzGl4B5#Y=~LL}^VLw0-5B zaqSfnE5zI_+wWh-)1FS4FI;tr0?^p1w8LHCGpjZ2KV3fGs}NPFv&B%9Q9_F5^fe)b zGU;a2;y*RLxZKC9o=%YzfU_kmK|HtJzZxFG^$`koG=|9zL?P0v4{H5eNPB4W^MNs(d}8$U2Zs&BhoVcl+*!4I?@%b`P?)6=K(oq=)k zwklld>TJs*)bJlivI_e2D!6R>>q_)(1F>>%i88FG7PcIGTMUQ+NP62g@DML|?v;AIYa162;$Y7!-8E@0 z0^%(B9cKzbgi{q2d$zTXE){`D0@ARWx>{w-n+PHSDFrxxs5qBKyGj=~N(V?Cx(W_K zJH~WLq)vgKnQP%vOp1IbjFwh~oD>ZNUG@(LP+b~*r<#$;4*Z;|W9yV7au#>w{voI)SKllG3XhP=qj=0Nkl>kvi(}Ts`Kh)WRE<< z_Z72QkcQ=%BD9)3+L3ln=`0R*ywX$E(Q*Pc*fK+`TE{Ger}jY5NGiLbFhVmCxMe`t zT0a})pQcYFl0`Cd3SsyrWF!_~S$=C5m{ZGqr96W0%4}V0lavDlp9{K0UC{aKm04y$ zzC-(fr#D2u{;2TxfJgQo_2plwsR9ET&s|!5543~swd=c17?7#uzg}(&M8LTM7^*%6 z;(=ElUG!3z44RGqEwbK!dcO}6rA90c*zC9pIG@3$aYnD~h31ZOhT-d;{Zx6O=LzLq z6n zxD0v7UZ6^?*SP+tIDMyHoNucBOu!m3HUE904ER1U#SAe#Nb;oo+(0jL-Rl)>^B579 zA+J8v0UfC|w4G+v##+U91zdr(DJfVg0@d<}$y^||o(qq9bpr}+$u+ihgWCU$A)uWJ z8~@d~wp1>datUgR*^m7W;(DGjthGcG{2mj=aX7^+=(D-eV&9%zmTxUu-n{1UIS?!( zAH@|1YRwP_bR`U>nK297jcU{Qswrc+pnzQTu7t3kk`sA9!qx!W9K!Mci1;siZml)v z7IBqHDR}ygz#Kjp4X2ev-_bET&B4CSr=J{CYQY_i&Sq1M+5h=$c>E$aGt9l-56O%d z8bifmddlcMv-mV5wYle1Rb6wz~CEG&#iIbq?;HQ%g|(?7apk zlx^)VvKQc$VM~zn&ce}o!_Bw&Ql0Ch1xMCX$N!esM=OAx^fN(W^ai;LgJv@5B9~H9 zkLXj*RVNI4Y%bCwG;Nn_d*-_T*!B`pGriL#G;zEG&&){G$=^qm-@==hiJ!?xCIZo) zqFnHQ^$!iq)uy3sQO-#JYtD!}rPaA+eO1%-nnwe=L-64qnhCnUSk&I1oQ z{m(gOE0Dp%&Kcy9)vv-}mwacVT4SQDK%*oA&8%!Q}s!Of?rW;aTlt8#t|9jh+T?RqA>`1zXzfPJq<_Lj9CAM!ZGKxALnZkGa!!+b7qPT zd_Og=&ucrZ{h8a76RB8Iem?$)^|8;>6%hs9{6qXxHbuL&L6z_~bi~DGS@X&QY1sHS z`_~m!&x$L-h%FghS6@X#T;!jooiIEREc<}Js_|VruKueyr@5e|lm^7j4X(R=T3G~AUE4=XBT48#X&==y`z_w;UX6i3 z^OEztb%yT}29w(V=HcMr_znOt5Qmu+!f!!!lO3&%)3|~7$K^q7Zesl(Zt#&Uq2w8P zxs=qyM~cR(R(Lbdcnq}_(ror%gN54%)%>@m-L@KKin6LyI!?Kup9p1WkTosAwgl8Q zqwO?x-w0-kg8yJBziEbN-;1N8E{%@-LKZbJEYGfk-SM)9}t^tMst0iq4oQW-ALg>PPy(%~Bx7(B z3^i3t(I}%@f8Kaf|4Q^vPqCcv#1X0D@xL0wFI~?!I2bx%x6WeDJGPOz7>k`)UBHE9 z5=3toV4F^qmqf_RJKUwW+M{`=)M^y1>Y_VqT5l%2#kNlC1!T`9WChxA5i5hCT@16T zM4T3dR!F`H*8jn26{GL8yh$l5%vCU89}ytu*IbFHDL{a#yI@o%BoZ}!lB?+}uM2&Y zjOH8+QWFv6GN%ji*3>h#(jkV~rV$%ny(ZYxP-(h|kiP_5W2bT2L^Fk6L2Uod-dCU? z`%;!9UkvK)>`a05j^r6JBgo4dMjL)e4s*TAg%l#zI1rJC*>uONj)+9~4>|$SwUV3MJ{-UP)<%6~KkLxUt7tf#{jiW@j9NB!oGRrvLOiYp?pRdn!^UpqREhdtJdeVE44>DOf7K*%NNZ-@YG)8Pb^tWK~hm} z7o(Dt0InwR2Rq-p?r#@g$islm_n*R%rkG2>_bS*&)AjF&0X zbc4qP$2WBuW{<5)8uI)s(N*tWdd;8fT-%Bg+F<#Ns_nO?pX<>~0`1!Ln(w!+XnBv# zJ{rYOK*O;8CAzQaz0z%x+9=yC7%VNsk(^xm`dbed)@6UD&qCYOP>i_%x6z;w=v53< zbI%GJSLi>R|Jr&STN)!9aMN~9pj5C^B)-Oq>-%-BV65=Xk>PFDDN9ll$Z}URwA`x> zlYbNBylE*A%}J$zD32v)SHhSiOSR1y{G9+qC)l3`{zpR)x^q_26_QtrI8IV3ybO!$ z^T7@k+IEMUpGhezH$k@DoL;x@)x0QTI5|h;w7nWRuCe`x#PdWEk1T2Xs@L0cts@>C z?j*W#uA)cZHw|LSEYc_UED~F68B%I0;JsuilL$lGIiQ1RXN_Oy%t z-Z495j+zI40!LiB!n<*svL=;d<(9*#y;+kLf`&x;-SL+KZq>jTk$Y${*B0p)#Jf*o zz9c9~(avF%|+8L=67$^2DZELnPK7A(-t72>`oxPvr1lVL>`A(8w4Q3S7Fe%)xSQ zMBhdGl2{{40tONkJv3$hD023X^F}C(09>+R!k@(+mwXB$=a%ot<6HHh8JM3&bdGvc z==HIh8361#=0jlX1o=vx0+U%T#SoQQjZ{3VhRUQ;I*;NLB|f{t4f^=eBx|nk1m%?< z8kLo-C9R1=I3c^VsWl|V5pzb{>0ydXRYv8Ab>XZHJ7Ys8uLq2^k%D6bM4}zQ#lT_( zFl4jc`R!^FgI5PNbv~80S*)2uBt3cJtiZV?(%x+S4Hl{KsZ5-;dX(#1=-vU`Wixlu zo>`_Fbn36Z-viB>Q#3kbE3~qD{EDw1NyQeC1M`P>*yMW8W)9&K9&5(@IQZQ-cG~9L zgdoMOw{TIQtmFJ&9MvnK&ldg93e$?#cc8SSw)FTX;KCzbC ze&9+|mD2e#ou2~XzMO)m08X!IsnFufoqB}>cZkg7(fimp&xAVkV3qmJNZAOK1=VFp z{4=4H&Rie(4=sh_5EVF5h^(#vNK0}`j0Z6lEo^8NfM%9hLK{}x=*J!cB4|d((~?2N zMPyOz7kSEZKNcfF*pRB!*BM~=3XrIfOe*p~ewndjy(R^lE>&rwfLK@a{Z}Om!`wuT zhzG-XK?~@I<@Y(RSVV>Lm}3uHSo~>?l#okz9-JqXa3BGt0$kW0l&CfQ)7R|SN~8kH zM!oO4hKq4?Ixs33Hm;NL-v>-BJ%^|i!y|#oSLvcrn+1~FcAT~xUcc3U5lOrC*kC`c{#AN%xrmRA)z_fXKT8t?*-KjdLQ34Zc&oo{w3e=w7+QAjlcm7xf*%K^ zjh`L1KFoC+K6lTN?>mg;bI@~^Vf9xL_Qh4eh2=d6Cxg|E!PxUa5R5UOT4fZsgq?bL z{%;{qIMghoSWh=k8|LBZz91u)`XNklodfH~WdX0dAnxnOFxbw}m>-j6bK4DAHD-P4 zlLAA@8KY-XSck<%nThLBta%PQ0V$9WC!vO8^V9~N$!c2ovzXS%@*-dKGKv&|-|Uz8 zEupRv@FEI`$%a~*#++5)YY`UgFz?kI(%MjwY|8+U^6=U*Cx7xDYE!d4PoO1iBFGLa zc)oZ_jB-w51ftD1>ypFJTD=bR%F-$XzlA&2EPtoY5^c@VPqjhg7BQTTRHpBO$p<_` z#7B!Wg_cs*e7aLC&*$XUyAvI=^$XF))@Wq9Va@D`sAbLr{zqp}dT1QX;x5K$C z_bE9^6<(EthG$w;yQT>|M&dn)@vFVir7lzF7!5PCyEo1q!w+`s>N-dHql)KY{Lgez ziTFL-e06qZ4$zRiMMAU)l<`Lormot^#ktbj4xq+3sSC3G38IVUYakf93yV`7_to{|J z4C1gL57h7eCR`sqlP3-Mg857Z_nThfyDw|rMFL0f*`4G&Xqlw|cI86tDq<<)`^^S= z?)w>!dCvf?Y2RJBH{zd%s&!v>#4$4`BlyG2MzLhLq8-|@T{a2D^prx3Oq^XFvEBmv zGT?n(7>}0;qzN7>rJ^X>p*V+U-r^~avT0Wf4&~QcuQRHLQ*brak*pG3+(9h6NBhw~ z29DWZV=S50=H$L814Bwb>MFqA6xaLjYgNs;fujo~EtGmf^fop+v!NSwC=E~##6T(Z zah-%lrv5GJC&}f=>z1b!|BpHd12CfsqC?YsGeER{(bmP(?MJp~hPdWE^3M#MFm*ZD ze3Xy4v>zPivJH!p(7HsUv-o{!`;Z|t|JBz&gZ^X)^Acxel^J<@iPL4)B|^s=vSAvt z)^9MQYt{B$MX>sRYEb{&S(s;X#xk=(xw*Oj;2wDyN~U89yZtHrZwLHRgCczraU+M& z3rv5p*}ET2d6x#MS6v8emFJYaS!bl0Yf^#JN>KKo!0w|-#`-jj{V}&br>5Rymv7J8&>(Z$R~k>RmJZ=Rd*kjL~B9cie*|Ar%)|x8|@z)RW-Exir6b2 zK%NYc*s`Dix7R-%y?Ed^ZGb=D0ayyG_%my}#U7p8sd`HI>cx=sP}fycz|VyE1WUo= zyVJ;7cX-2KHpYr?fyYk77hh#ch50%7n&~f>t0HD`SzgoVY>9qJ$qv5Ny)sqvwGc_m zE~_@C2XjWx1=|e-* zGop_1^ge9rkLT~QG=EaJ;g^{?#_w=LLK{jF7BqI!+x-w4>H;!H%j#Z~TV}8)4jrYp z48N>_c(jLEa7p!V^)?$I-EtvX?5e~s{q+Y5hB!T!Z^hN6`otsz&l6L6F3oY49ZG65 zxG+qQBF7d!%|Gx_ov79fC<%s9aqB5Xz@PcP=OT_e z*z;~;Bt!gd%AhZ?QD(R2yAk^-L#4ufmVTMo?n4X6w@anmTBegjl=d_6b+C`-+vsPL zt0r{pC{)%c-KJQVI-O5+=zfusT6sXQEAz(}(h*1YYWbec+Hk^WpD>-wF z`?C(s2+=vA zm>W?K7n~d}(12?1TCUYGGQlX@q^|K9`TGUmP{5*A#?`-1N~69k<99m5*O(Nqu29@2 z8<Fy~NBX!z3W#cyJ&v^wL*%)fxKSkx9`@ zQo&ABB>ibVk$|pO1Y10Bxie#65H11)6!G*#(5O3JK-RVK)s3Ez=@cuptRW!2p+Z4D zET)aaEytNsiq%v7sw8Lz@}w#d(f;=i4j`5=ekI?w1Ab>Ul$a=INszb0AC(y-k9V5s z*cx7vLJqYY-N-ZH&PmMFjl(l6Y&9j!}Zt0O?XnVRSP z2u|x%nHRy{oLgl+F;e%ha0{N~(V`n6q#wAPUCRO4g6B&9){9JMI2E$HHkkO5WtC!B z9iYl(!=Lrg@7nwlGdtK-TD<|?Wlc4&;a;1~t!)D!f`$2m{B0>MwaYy1bm~ZDc*<;t z6HW40-x%L`6UO*JlgfUdHw764gVd$AR>}K&s_dKsLxBMGX0(MP1qP_%8%IW340j%!IE!}!SB;9r}M^%z*0e>R53fX)TT6N7g)s}jN zS*(}k0_ZhSm?qUh*xrG0maJ_OX0+jyLK}`XDjp>&wKSH02;tZ-q9YJXg3N;Y8hw5B zoGv5Gg?NVfK!Ehv?Jk(M4fSnH4{5&<(Hp}C!QqpM#)w!NC+vo`a7E3DgV{x) z7=o;*y*%O1#4v+(r6arJxjZ(a`5H8*-l>+<4ut0q_Ym63X6S36hva*9MU6y2(pjqF zqP+IA)INL#4P|4I4-REgW}SoD&l<(ePZ=V#YP$S_wXe<9tUAOS#sO#M@Xj@1kp+%cEJ86E9J(hhmJDrutU3c#t@J_^8rt zFiggoTrOV5@37J_*Dbw|kfYdmyz-X~Dw?wfG~xvT5-}xY%a};|@baMm=;*k5us!Gx zB&UCp?Dcc@3*>rCWVohs6XZ3=cigqpig==&l6pXiKAe{-dgrV4G8n>RRyaQ|`ZVGA6tARMd@@qV$CnW6PQiVF?XlYXc_2vfpWv%jW*4srX{?9c74;UZ3#F+3Grh(p;ssat#u*B z(EGRNZE$YI-kaYjrc2E;o!&oB+k>8`+T(cZ3B9B8$(GBHiTo&W+yec;TV_CL6P2HT zoZ5U$dG?Ef4C_?w-hA9JLIwps3`Q9{k9J?IhG0E*eCj>Bnh=1Sts5YR39vNYqXH){ zP&H?y&xZkKXPg~-h#dzP>_kwZ*3?rg`5z1VN@`F{WIMM+<$J#)#@lMB%umm>YcIIL zhh@EUtey>t{nf-rL)EV6)Yc`7u)h=LcVK}R#+cc(A3b~)f{h;M-`|P+N5hA3(%NTY z|HVMm$miG{lymb0eSPXh`G@NHK7L6AL%8{y`SqTd_0n>_|BiK!`kD7oBSjyIs>)UA zWQFd$LG%=u>RESFSkL|ZA@c5NTe5+Eu@h&f`Cc*>cvn`-`FmKG2kz8f>ue&=*y4BX z_XEKD!}D#zdMD3EH@mSjS-1JtguWVzi2tsiI64b04mMNl7;ojUde~}6^lHsfmTCOr z_htd1_GwEVhNRrFcmD4NE>Wz?AlTCXYoRm9m8m5Wjf>2TNmR~BJg`e>ot8`@u((H1 znLn&9{qZB=Ct)w;Ptg4xAY&M@b0*VEAGS-kd01jkt~MwV?!<0}_7&xr*hXo_HIYZC zO)swIJ?$94EVkMLd*nY@)(=EmIdPuTj4|~7JE}AWij#M`FDz{ zQKuw=B{M5h(O#aphplB4Q>vx89L?o=F3$!jS(?Dh{N4x$5ptl4ROYsWnB2R>fRGH} zaz!#3%~?u=7M5FTIIgKW2?b2cEJlyb7NjS0$g)R(^(fw(c}Oj*FVl4x)G($U%O$#; z0DxnxE~)+&X9!NCph!jSqCU+!0kL&|mUQ}va__}z`U-8ksyTge8}9NPXREnsQ})Y9^gTQq z##g%=;9T@H!)gzbHjALM_HiiuTWKt)&BMVcFfr5L8tnLN6I(0FzGWf1Mv%J@oAQIm zFWZF|akr1K^JBeWOft~s4tZi@@IFtXVN475BQh=2kVZ>N%?fE8pC&j-wa$;#O{iKK!=G&ZvD^|gzK5FXSbATJrjOn zPHl7zv5vX}tir3z^kuX?;YXP12OEK#WzFX50CsqiRIm_Mu|YIXtk1TT@&yos7K{PG zASb4I1`BCPeg#5>G;)X31o{%JY~DFWKig<|g$LV}O`2gybf7{X7EGW{0nqXY85tUJ zp2FWy)7-!G-vQBLC{rzKmZkbmMd^GJ%ARxM#qd^s7Z_RjFb1EKHs7ML;mz5$aO&y=@)D zq&vi&!Pfgw+8d|MrFf(FHq3H?;3(17~wNhc!WS|E^(h+sPUd zbm0e;{3%1h@=`4M^wRj*_TimFR=}|aww9*0vL!J?oD@B4qZdn>uKhkrP5?kEk)W40 z%HfiV4jiS4q?|rTMY3r|pR@37OXl8-8hd6l?fHg}-~#+E$;F&~sanRd-l_RDA9yiK z2Koj@_~eweDrx;c8&;OeE<(+vRQq(+7vSH@@6%wh00DO6FQuNNQZ0kc0Z@lQk#bF3 z8bm5q8z410T?SUu2UT1in06&99GC)rU>_L*{SWzh{4t@G zSs#~{UnNwD8z;CF~OutREz)i}Z-YN4pZ=l7rrN`rX6>|dh3ddg#y%E$U=VaCnGSZKsPXxra&E&*>hlozGidp~A(l77%1 zSWMj_R`_5E{nh*DOFiDg0{ugTj8p!4@~@YVUw$&y?PRt)mH#VI>y1Bx*NR|G%t)T_ zZpLlCz&xrqw(8-x!w+*0dswq^LKFR001XtS(0NyHJ*v3B`MY@Ya!P$?D@h~lHOXuI7j-iI(cT{M5;HFTGl|u3hnc;0! zwZ3*n52`d`_eV>(BE%ny$xx$RlzZrrJ*!}OMg#^-U53$=8x2(*>^7>Ky24KfUX-Gj z4HB68k9bA|qRLDU3Jqk0UNX#4%L+{)p5*DrFXZe&$zCGk%M4TDyjv*4%vV&8vh3`_ z{j_140uaW#L~u>)_c_YHOBmhS^I!k-M|8d~sDxrhsN1o zm(?(%U>@}aT;GtK^tXE4cx(U3zgJF)0op9%msm*Q2n(Gvqhf3?bQ!?0YBK(cJn-d} zH01R{B=gY-fiwx9F40nD0Dd*j%b&VR`gn&Ye<=c3O+@dil_+WigT|{hf*;=~r0M01 zDzN?w6b*Nr`6u&+`te<)>p-*%w~Q^)MtlPN z?TfHLSIso;N8dMT!RfsH7>aRY|d9j_83;B-24K6#JG6;Z3KmEI zsYuC#mA{VB%~<&}HML%-o2GNSWc=x1hF_i1`>na)`4SiMYgHyNWYN-eZ#B2aN_Kwv z;}Y_g)=cbcz${z;*qf_$@Vt<5l8twJfI#bq22a=g^HD=#AtvijX6dfcu2~+c_7|{E z3Kgkkta-V8$d3~lyQz2QIosaqOhLpSJ!9#y`=wLVc)r+B>RdNy>ZO6-tG!g15S$)- z39Vhbp`C{9(@QXDzN9KRcgnzMX$z)LGnpL>=8^y};$%4(+MBS7G;o@+oXcaDY~)H# zdYa@h0W$0*i#l*1k)s6V{%y&VXpBIi4-*yZXz;vXgW0}h6DQ5Nj7!9jB^El)>$%RO z_?3q$)&yYR_cI*F9i7SE+*41bj1tjS>$g>rq_%e=Igh3#2ARsSY<2sp!r*WoZnOgV zpW#{>#Ho+?dWKeWEneu7m2IP=Vzwd!Big_8@I5iP=16GKarWYE1{3w+lVSpB6JjSA z(7_MI(r1>!X&W%WJl{*wYJw8y=oro@y6$on8=6ipfo7H!7DqmchO*{2(maX>Znn0j zSv=N-^TNVUSM|xFUxmHz-&{PEnf~>+53m?sU@H$8-1!g>hmJ^Vl5z%XNnRh0LWgV8 zC4qBxyff*0W$sZ&z}>d}8Xd{ZU2xl305d(GGZ07ekBkp&XEBOD zb1$Dy%f@LhqG`TWe`vE}*F$@+*=$~W7xeDgvQqM2mYQbu_|IGDbW$`W#flD$B@%8E1tJr^K?MUObIp{W*~%}Vt6hy z9UH5kn!B3vC7k7rKTsPP$S^c`)b_@k{>#bg5P#r75>>qpck(Urt0g|zk2ftgUd4fD zE0(GR*-qCC_AqlvRuZg9H+9J^N-9RDHS^F++D4w@9PPM4sap{aqCRe z{XO(3FH|kwbPd2=YBxZlofK^XhL~W{D~iKq?|^Cq{Nl(BFUPgyN7NUsvEI53oOq3>wLheeO@OzzX!q)JJKP{6 zJ8W6U=(k0@v=+ytLTgFxP`HPCOHejzO%I(LYHHCl(*xWjvx};?pQ?by0^E zu4|_!L%ZEu_L}YZUX)x>k3U$G3Um^x_=|!(lVcK7_SgunZd^QpWm(+I+Z(-2_E3m* z)}Gk=c&Id@8z#aiF-%57H_o!KWg1?o$TsA`mIQYeLDg%)5@+6cKFety(xxURY!UZP}YF01{MB~@x z$6boyM7>O#UgKh7kh021?-?1Yt=^yS1Wexm=Mbnq6i2_Im(_?Ev}#@NhvT`=KV;62 zvMXYqSf$*QM=hob2S91`m=?Kk{IfzXP+~ox>(-!)W;ZaO!5CL(L-@u@#$jirSdmC^KEnQ z8);v6%QerNlUD66Cs=X_Ka$;`3bQ0upZuwR++nQf$1Ip6Km$*k*D{Qk-(OS_ZJ|Kh zmj6)>{AC%K#;eM?c8D@RxQZ2BX@b@cT=` z7+NW2cr~mph#3YO=Mt?fd=9f#XauF?M;sAPg((Kgjjp1Yy}PxOZGM&F+*ZyiPPdoD zXHFL4Vrr=Y+S^iH`$3DX?*gS92soKP0eU5>W?c!EC2N|LZ> zJ9fuZ3zBYq(dwT zfaY^3#zIn7A+S%hqnYFftC+d}@%0m$bw$_zHyF6pK9YY&w~^7jM#Ez5Y7hCQqP!f% zqAallAONd<*bTM8qe}E)Kmt?Wb}^!Xq=8u40<`e}&?>=D)|{T75;q_%fF{j`k>Mp@ z)f`9WcNeu;1!IBK@|Zp0S?;6qMcKul@qHD%3mV-_Qr3$_EzsBCcSHvyumkOz&jVK` z7g)SVImkY;y}Bb%$S)f4eAz~!LdKYuW{fot4=w_4+j0h2&qW>^V9(1rG7Hy{7(Ex* zvB6($Uov0whG+r-R#>!$ob2>)1k0!D1y>lk73r`zWr|u7XU5W@SJv<-e+sWi;#5~1 z%_pJAe5hN68aM%s9wW7nLH;&+ExIb6uni55-ceYWP~P!-o-#$A4aYZHbVgKjjoOAY z8jbKsJjFNIFjyyBgsF3&(RHElS=pfTR%}qVhJO4(4Y!7|YIZnAaRtC1Z96jZz{^)% zuS;pz7}C=GsdmtNsAB3UpCn?6;Q3nw@A;`sr@d$jEzgkBGA~2?aTOrJGBwMS;Oq$NKQ@zErJoEyh|j-l1?U(D{}cu z9>IgY|K*0`M59GY4yw7Vq|4;@PX{mLK(*tdYW6LARhT7@75oAxi>)z(Tha2-$s~_E zTqGBK9C4S31@DMW=nd&T z1r4UQ!C4Kz(PW~N(T6>kk6pigGmZ(-H1cxs;q`Zw20^=7BCO8aryU2FKFLfa$H>Ac zhCIzHn(&0uq}=Vn?`sIHb4Qw|VZl`U5pp zIHoUs0oylxB$1W$z^o8Mv1Dwlpi)v6YE@Tjm&%c9l^wzUo@i`}Umd5ehWAyOgAyHhjZ_<<2$`B^8x{IMAfSA)GFI_qmJkV< ze<$~CTemi%%;<9)9-yj0Q{nB{;E(XtXW(F#@KMB@Q85vL;VoPLxN_%Jc|ypRvF~)7 zea`NmKQ41WoXon?(X~vh-w+EoGw|`cv6NED@L9b=QlQGzA+|S^GpTsHSvBHvfovoL zCoHj1V%*v=!)On}v=y~?uGloKFx@HYX99VtbpXF{L%zW85_PQT={~!G zDV=pdVUTNX_<)dZ$yk<$+2CCU(u-TcC>VNnFM(a8a-TZo*fo1<;zjJHm>O=TCr>b) zTM}nln_t23=3Ej(=43L&D|u>bPgp{`!K5+=3cCcA{i@lA#i!gc{N?NDIzXr;Q$d8W z@gNG`3oU%`4!DE!{;9*oo7-D4F?zEJ<}5W8`@nrQHZJ8Dsu$lMr8zB^n6!%N1UNPIPDUQa#ovzbodw(UdbIwMMD4k5X5&c91v($2*1E6sJ8S-^p zC3WEZ^yHIhE$qGFerH;hPF2LjitSjr5FXVq$1VCiP0)4!gQ6A--B~;#^?>BmDB(}8 z7^JZJUGi{t0E61Fh^`S0$%mL^3k2IDN$|f+*7BvASbl(@)Y&qZWJ<01bE+!r)+*=H zOt^FUGqvKwuOM>tl6P%hmlEE#RaW!O1)9jf}bEu7EZQrjbQI$GEwPDln)EXt% z<<%54uv@P^mb{8CX7AkJv!1F8&sv}x)n|MWJZXYS@WHXoVRF<(#4Pm|L+Nn!nU~5m36oT6*@U5XuJ(pdWqH8{FBkZOoo$ER zH(A#;WG2z|O?)3$v6W65NlAgZDpsZCL&Ho6{Tiz}{Yp_XzNXZHd3IV~l_%J;NP-(f zHTNXT>f4Qd$GmALb?Zo}k!VpxQ{J3G9k4ydzhh0m@Ss$ff9K z;#Bct&a!ghOH^lh*~T(8MaLuq(cvaJHCQfm*xZqXOE<@~euSR2ml!FV={ASteR}<| z@(BcWLI3HkT*c;BB~-=81Ayno?G9Y>96v zwN#tc_pwdPR^`?^@xdKKG-pt)J!}JD-;noT(yFAGE*JFO(GA*b=Ya2ejI~=bL;XS*n}!du`HX z8U>u4qt-l|BtCUJVkTZ`VaGRNU%nNmPI`#c#^$cho@N|CcC!BtKAr@Q~jDue=IWAQkJND1uP10T864+buy)BT!BAdptNLl$zP$%SsL9K^JAh~3VK-~9hs z0Mp$G`lhQPW3wBzkXN;7(_1ns`>GiBO*JA0(ujp_`n8H{zcJ~4ALp59-wa7JA*S7! z-h)4`sl$2uv|B(Sb8jcCS7=gvx_xTXBxVrMb1?cQjyj{BG)=xS0jSv%i+1eQ(Pu^T z!go0;4nAkDKd4)EB8A%S5oDJY#W4^=$Rdo{?>8mEYGr?~710=!F(1@4J(O&g$Lk;tNE*kt)UP@CXXm_M}X6l#RM#51;lbo1+FuW@pPHT)u zE}!}LH6#D{pojYRK+zX|d(MT2F$Xkg#?Wv=0^tRW_(EcZwY)FA zY1F|l+OJUNkukpqjqWe6k$KQREe;mle0qOKU$y&NoQ@D~2AxklhFrhUv{*h$5)K*q zi@LnIUZ?A{qEF#u3jW2(`9o3Hcon*SV*Vq@ID&-ic_5H5{m=qscUbLXBDw3fc-na| zw`OIWHsh-Hvz~jV1xa5f=sdPtJhZQ4c=h}yL>01p5!;;cxm;h;zry}noY}5$7H4%I zTDbOIg;VvPRD_q&EtP<)V7?p_{Cp28dj))v zc#Yys=%BEx+)*(LR6?=`LTQ%+$|3y_D&wK#N}?cvuM}C9UJ+^c4h~saub-n3yPX0Emj>K)AzMP4X_77nuGN9$zE7&JU{deJ2zY?@*Ig?1B%o(2 zdtKl8yHCMniH?j!{cxl2y#5A`38rU|sh0AFX7orC*!%#gMi%6Ke?GYk0A?y*b<=gy z@X-DBq5DZYQOTcWv5!}?`Y?3#aW?_4yX^u+<3#MUSLo-mBoOuHLYz>3EVIR8NA_y2;z*@!!4HqP{E@y;i=% zUb%bWFFIU$4jlrD#RMiMw|5_3oA}>Fokja6x-MjuF4JOJ z2nObT261MOemz18Tz;Y~)y!}nwu^VmpdDVDmI@;|Y9^ny*M|H7aF$J8YGvva-Cu%} zuFS;eBEc{0KREwX?JPIy+{Mg7S&}rg4`YKraoXXfL@Iu6`tCEYrLCNRFVxnxj5CtM zuTB=Q2<8$doYX#vMw1HpD|?;110;bdIHAvCcP439TdB8RZ2Nrk;3%`9Y@i>Br3i(S zu+n=cT1Hvi+@qR;G*MhpcoNLuXdy%vlNMW;j&MawR9qwHX+7*;%vOx3&9HT@~xsETq%XZfn{idqe@qfenYVv;zo8VMwseog62!VPP zh-;nKKPUrS%>H$mn!de4Xd*;$^!*%-t;7UzGj4U4fs9DyUZQO$wSia#hNX#@`Zh%X zoV0q6^HON|qHUL2TO%W*y>-)(@yKkmXM~|CXUJBe5078cjPYPQ?|0CzA5oyrvUpgkZ&#}GVI!OQ#1w=SNzGT3If{w!MG zykgbZIz}WI2*`aYhmTwiPnh?F@zhdypAs6_k}RY+3v-t(AICUS*3B@mK|u<+-Wsho z@rX&F!|x4K+Fs#82y15)<|0?uRwk(w@5P^VEJ+t4(=<^d@$k2NMJI%f6CS z*{$$|fSC{tS9o%B1HcdO*=QyV#_Fi{!zGlDEzX{UCQ*_&Obw7~z6D#P7Qwm3Zf-Mh z*CQ1{2$HFG`(qq&my6hsR5lQWu>bEh$7}70N~!5w}_muYou&1z7CIgPORonvu%4R7grwXi{bEL_|wbE1sB@lrIvDL130}fTzH2}hp9jAsru`-& zKil3WSm0+ntSw$`f!Z(pU6j_&gIi__EmkXf<(i*LlJ$~;oRaKK5HO=sRsv^qqg<3_%LTo@D_cQo2%dh^Fvcto9%g5VQiR?8+ABm8Q8PE z&g))S!)q5@SoEv<3rca;?whEns%30Z)p#e1vqC zZ9~u1_>&fkGQWn&l^Jquc9)S(T}nq;(D`@!Ua^=~<$udRm3N0~QB zhj0of5x-znBfdwGT^(}C&{;k=_wP^Rf2+CD8=}7MQWWTU7NMP6Yd;oPa^tqGS^in0 zGSPz_Si85`%<(L=!8P^*`dKGn#V8)skA>ji83aD>Ll^Cn#{Xr)?5DND z`dQCaPGj2?&tb7WDan+25DHgyY^Rh{Sy_p5CE3`HHT4ZW*IbbV<$_5Se_w*a`rjW? zB1D(oD0YkUrm$$n28iyTq6`;Uua4yAg38RN*;l+;5HyWNq;H?ccFi|IzKthe&J8`e zet&XO9#L3j-t&o_{6-~$AWNEwiHmG?k5isdgbUO8+=c0n>yrP1@8~APkSA9b)5@Vh zxjymqr6+R4OCzUOS#H_-I?`jGCG_-@^eM)uzTOW}p*lM!J(>qNNMt!zX&htZN{J8R zUOZa8WHR+2Wl!_f2u3~k$VBlgE=+2ja{f#YKyrH*K!lQ4&ONEX0DQA^ZFp<{xln&q z`Mnf|b862wCx{#ovu=Oj#~i6&JwIe3VDeNMRM}Rq)WK1~RxeP@5MEXS*#V}*Z^J#P z`F$#WtZOHcM;66TFqT$$qvD$`GdyBcyAK_ra6W$^TL8@4olzUnV~z zPe9#GYJ;6dZnmGBu*g4uHK1>Y-29i&y7mM4Lw8MSN#OVO0} z6vh}1%P6_bh&31jDcHsqv%%_f696UfVMCIP^w7>a%`u4?I?AzNs^;i6uIy`^F z2LA10F6Q19{g8fZKAv66y2ed8UV}(JuCmF0HKJ`PKvW$wvL9xPMc=9i_I#G^zB3Q zeVbZx@i1|(_UDZ1Vbe0AGy4P7HmP}vv}y}5)b_60X4IrPe{O=md$NmmfTWeHOs4JH z!qa~0<5+E%`S=_BXIfXcjbXheubBSrTl{0geP=SD(H7mi_oE?viLxhYbbcP4`Gp7q zd>7`(n!`KeKP>#co-Zh`4eo5_#=U@A{&ezBQd9%)EOb%n(IEf5h!vEfylwwh*D7)d=?3Zxnz){udhAw=M@;krEIs?RWnY{@-s$_AD4?F2ZVV^n*S^p_AUXcj% zM|?)!s(OWV(Vg6B%GB=|=CvBE@nLQ`W8D*bkAzieCecx}e+lBq6eci(p2#;v3)WYP z_iPhgSIe%IVjnJOMLv-A+y0n9ovRdT7{V5^&;3y=(zit3CH;gR6(MG~nTp{=-R(Wb z>i#OEU&P9Xnt3NA+vfZIDpMG&xQ4l znKdwBP2;C;`2f!7ve$D3d(VfTpcm!AeXL8>SvTr~eRe$0(xv|!$a~J_V0y?>N`t}t zPCMjroO-{i=;LTQa+z>yS<~*TmUiateVk^RZ7?Z*|D9S3->Y1#lWgB-A02dtHlU^e z>S{gsOP+z1psj@S`ru!Ohfm`zpSgvdCv@c^7JIQ;!}ffne2`j++qKxyWFnj0#!ZY3@@}5l*bAM7a25 z#>$akDe`jsG!xNr{I3;`-DqS4j;7&)xQzkkIjv>o znjS5W3-D(UuP~c)RgAE(%BAaBXQ*=1#igZgGe0G_X8CTharE>{xk9f1$_=p%*U2oo4=Biuc~Xq$S3M99M8wkYdNj>Akf0-M>yD3H~2 zbfE;-jpSd682R>b8QB=*xLalQ?}u6I_CexYM6P`+QNtXl6?; zemmXe4~}h2_?TfV&3+bH6{*LI0YRHv{Sh&Kf~1#Fpqf$diY+6JIv$C$DVJTLd2m8D zh=*1xM$>Wyn=hKpTkTU(ykh|OtD&!>TO2d6zDvH%>k66vGuU0`GXcLgJ(VPNayhWe^J0Fef+Yj}Uef;qjSKyuqZM@MA zwpSwsH|la!BuX&D^vP8cTm5dE%tJ9#_>qF3%_kRvIDYQs?+3t^<{E;<%O*aZXFR@| zSS~g@TSH28PV!sWwqi|R??>`GtMlL|IC6s6I8F%^0h)f;Q!&(KAJ}FI8x$FMv{QB0 z2b*;<-HwI(kg03)T=Gok1G*dekbZe7aAtq12f((+KsU7ku%!(4fYX=Qg{!F)^;42) zlsQ9@XjS)4E7~2 zO;}FVlsDW19O`w32arh~wrDia-c*?BD)0@7(>yt?um^bz+7cZ-Vx>sH)+=8Hr_bHD zh&1+9Fz0v$gAkEgI1N7;IG+PUP_%avGbXmY(l6K|f{z$Br4ZBD{+5Y??3%n2Km4_J zpXc%v7yJItk5EJEwDp9Y!#Vm3W<+}*wr#) z+hTuBZx9rR!~L*ODf%OsuR#GET&m+8EIM!K*PPc>_vC4`ROCi!<9ow99&Gb%_ozA@ zRcLs4`k~pM6IOEewXm!LkGxQneFSY;50}*kHSpxcRh~gNF-gKC=fL*pKWP@rb6$cx z7T2sy2yJPd%mYcf6UJa5CbhSh9X+}U)kfh!aW8hNRU?PDt8##3YoEV;Jld~LCUsZ5 znvE&M!9uecB{-nlrazkf9^%8+NjELzlb(n~pbc7uIf12FPLb2Vx!L={=^F{1dwPleQ}L^Q(> zG!%vL3i$2!4)7O>u7KIh?e}ujf`Hkr^g*~r1V4a_Tc%}GPH|Z$nXqz-%ib);=Y}8e zN}D5jqTvHNPL32Z1wQ~1kEEEd>DYV5Ykhvt%O-x~_&=}Fs^&gWO5ZxOmK8f-%0HhU zalpZq_i{f5yd_I9Dj=HQ%&hN3x4|m#NGkr#XKYst2F%4}hJ16rcF5-Y$|o%(Wr2~p zH?K@!a1Dsu4wRT<*Q$D(Vpy^>U#($h^5wmBgd^Kg!KMJ%kb$5)AFe4! zAU6Gfw%8p3Gu*?P@|H42H*Jiwu5*!c5cu+Bdp(-#!^^w~RzB@7-YdScMoLJKi$5&^ zu#5kM1g;yG?|VgS%+ust%cixP`_uL8Si)>D@UM9AfOE0$jYWdGtw`GeIk;B>MyP3q zb_vvs?7=dDt2qriC~?BeqOh%1jd+Z;1o--CSuj+9iZ)%^VJMT^26if0q`8^3tnV?{ zLe7J*5&N^7IXx2qG90NuF5?}YwwP)4b=Xt5x-w)>5j2^R%dgSH-A7tZKlV1EoFDTw zb%c1&uH@U5!VCxrz4zvz=OWj|n0s>a?&l3&KIcr=E-)UDmgN_)O>jd*kNI9Ab@Amv z#S&*K*#Hz}h09;Aa%J&QSALSe^yfVlQZinPu4r}T-KtkXv{#tD)iyKD5<>sWjmYF& zQ(*li#<+Fg_ikIYn3Pk~x^m%)UHdAYZ@1$G1z%9DiR+{aurC6Qgn6uEvz4qMMTvir zA{#`v)kYz47tZ|r_Pssd+aaaw&x>!!iQql#rABgh=l)Xp3Bpj<-*UWkX>SE@6S-|+ zsJ8842!8>9L^5DV%#VhtycXWe?N3x4Co;86)x}V(OrLDK$y2%?w)%!(E7z z^tdVp3H=gXglz|f+qxVAPuPkHq5uuAiGJ-;&)JJ-kS8sKB`YQKS5)kQXpp0)O<3)p zm>5X@%z>{+4v^&QY1w3(lY8-@IR)KTE}`~Ew>C217}nm_G*Y9eLOebBV{YoJeY?*l!DQ=jTulb zB9fY*8}xx_lABV$VghL4&AbPaB)FY3j_*)*leJ7mqwG7Sr=g$Xirz8F4WG#v#?g47 zRx{44R2W`H6c&rH=i*mMvb~rT90`9HDfb0pub-MHqC~pMn#kR2uU;%3!=OB2zj%<6 zq>|zbr#(ycxOesf#%9qpzq{UH9UvS)CilO6t0qvj8*SuK-M2y{h$RNd)+;quSavK2 z*KHTESjKaqNztHb^;K+z&+)?DC=}MT9%8>H^r%8lk&ow2|_9%Z&ZvSvP38gQ$kapX)U@bYT_qG>{ z+!pJ}tC}P=ZceS3^9%gerUA+$DvSINbjJh$?pT%qxl1N5#kdZj2+2n+uG8*R9-jkm4i zhU65AzdZ7`#dy?jt7n*8@vO-qT7n>*4g34jC73;E3l+JB7?L3!#J(y+8Iz0`zXR=Ft1PPq7yhbu4{@#;|Ho>e@w$sut6LO(^Lgk- zz>l-dHv?=+7FL`D12+-f3>eJJk?-)w{o4NwyVv%*|5%&WC~i5faAfjjsF}}$=DrPy zNf8*&&1PG9YS9CO(bt-wQmGEUe}2l*!HEt~yh`Xk?{=m@ZB%p+rO(saw;on@nm#}s8M1uLqQ(Y;eA%&c1cnTne@?shYCb1gBgX50GdmjaH zogIHfqK;=i9fBmmf)F0vykJOIGM{@=r-XG!pO^Gmm&oSDP-tMc$fRgmoh`k?g+a4n z*9YwWigKlgP31>1p7A2|H>&_8}dCi}&}f?y%Au?=HAeMb@cwzYL+6+CB8#vecO z;qSG-xRu7MNe$c7T8o2|$#|~^!bZE8v;(uv`UY&n{6$?pEokW)*0Yalx%^?>l=O8> z$*{1YSd#FPL+K6R>g4D)@leB;RO(o_Jw|s~~A}^|oy1)c0 zfM{O(T?N0lclrIE)$E?Td6YGlykqn5ST3!r_K(KDIaN4%bCXYy0p1k<&jiWyDk?`m z8yaFUjL3CEZ-a=s`aV+X3~Tbp5s9!pX`|BeDGOMVfBn6X=a@eVk)KT1()Rbj-6!Ij zknY})!u{xDQrR*^3rYFw+!rRd-4_=@n#9W1zgHa?bZHlm(1Tg%Ma)PsVsnF=#OSvKEjCPpCmQz7?=%1QB24XBo%}&uP{j))jjPwuLeVG z<^n3JW+Qyiz(lSl%BKLuwwRT(h!Y{nfDkd%YiAn7K4!uE#J!3sxvBmUjk@BUZMprE zx$__orXDXH(|w?TZ@QWwS|^(#(v4;^KIY5ydY>FTku*WdaWiN3`o=oCWb6a%c)`n9 z1~4L--E84ECS0~(^4dAKQGiRWux5gh6w@UV$Y{Fv^3C_tyQR=HctQ}#AccX*=32+Y-^+h|;{+iy zlm^*!q8`6XJ$E}WtcWEl8Mue27AKgwRdtcAT8Hhak}Vq>=J9U_`oa$UEpKx~$ct$% zaUd5+p=S9EU&r}Es#3gF2<2xj$8{D8+KShmUpY@`b_JJ@GHI`@|LV=iaS56@4&aj@ z+aWr&?S#vMu8SJ0w?qsgW1k5uLkyKY1_0wH4TnGlE}ThQGykhcdOvODfkhiFxY^r$kh6lrg{9+g-fr+dBPEOhv(G z{fYYnSR*)cP;BjICM6A#Q$t6y!|I`8w)W0H;KFKNBg(&T`Nmbjt5F#R-xvKbl@yzoMe-XizS7LyTZP6b@_ z2b2YcuPgp_R=5Of9_3bNm(Ci@msKBd`@nM=;+Z+K%)t>3 zFCBVf=9GPF0quhvE@XX&I&`51icTivo^pbw0)L}cv-x%1gk=PM*2ah=qiNO7&B1Qn zF#(tjl@>G~tOfOhjaeD1sx;t6N2%QRV$cz-sWbEqNV()Ct*J~*14X8xvv$;p_TZVg z>7uKYO6}0?WGv%4w-BK_VUtB9=ZUtwXOaa?KwFdf>p1P4F&S5xN^2luE}e1B{>AFP_642a+?DZhyK^S*EG0}gYlV%bUz8U{ zQ9Gr)u|>!ny*1a!MmrN^2W@~XR99It(lDnxPB|jLw;bg0S}c25$K)$>Swfr zNSjmY^{=qa5H>t9<-mI!1yMJ=aPPu{Jshi?uu08y@g4J@%{2-zI*jQa@9Zb&2g%PFg{C8k4NzH_oR!L#K&{|_b}C&`1<% z*kVH@S8fRd3>5}G!NNX=F)fyTGd*heiUVaIrv}o2^d^pGxJ3)p+q(wcTF&3y%a>07 zx@mSi7wK3gongngaKiZ_lpn4h1TaB}q93|)YyRJd;Y{{d@PiUMdYlJ=H z!MFj4T`f(7m}}~0jpz@sy_#DWG~tyy(zC_TlV7Xp&Z2oOyKErlQ60{>wOtx+d9fGJ z*yCGSDpxw`ATee5W;qwzq04vHZ9Jyz*pdbNAzUOJIbU5V<`6fic*rx7#)zD+N^iBK z7EEP&G2iBWVsCUV8-Hy;S_rI;KF+lJ=3Gz#wcF`G{MtSgj5x%_tv$=G$| z_w)8+kJXaJPp^)eUslQ`k0g^vcbPz;tAI*R9-F}rzi6F@@_yw$0M`WD%#hZl-XxB% zgCAZ8VTUGoBPC?1RAGDDxXc^&i2uL@+Wjcns^>aKdLzl}=7xw`)K0z|8}>>ETx2ED za%L6+PFZXISFm<-CCj%qDLNTG_zkE#Q*Ti>@5!GP2C)-xiB#lYn1@op{7F-(y5tkn zHjAC%5FHxYN|tWof!Nx3@aIpSJn3Dno5lV_`up;$Ia?~pU+`i0a&-+Jh-yqJc*qQzHnS;u5=BDr*w2_GAml*wO#q7 zo3jsv*WnIT6>?rWhl|8`n!)A{3YxsS=jv!(r&_f^)sD`#hVJk(FQYmjCXGFl9|!Bg z=ew6l0eQvWJ)RHKL@K{Ix6x7!$oA#r&gxP+mSkVlEaIpF8%JU3B1aEQebXu`3O> z>~Bd$+I$%@taYDY@X33gw0i5Xm2200GnHx>)2RF{PtGAIWjy~*{0crAlB^KKEh#0L zqkdZXPIMQZ-9vf3VuKbnG!c~Xh9i8_TG+fx59Z-81RaX#d~{ptVHa3e5e9Q>CRj0S z=%>f~Ztm-+6ZR?5-GatOW$d7&lP`eP1pxDO&zDdbP}&~rGs2A@|M!}G|uKg>l}x;EYxcG z-6Q4pKk{6~l~1=YLQ`%QJ5dJtV#U`jueV>iOk=PdV<9bG(T1a zuM{mZa$OsVfIMSvBhCF`_fGd2&gpMBl@k9zWqKOCZ@P)w&E!789{dO6dlWV*)C)n0|O6S>PeZJtSsSGoV+U zo|n=&w$#t!K;_2bF&eA-Wd^MrDi%hZ&+pdi>ut6D0zxw2$8r32<<{zcy{B}BUJJu7 z4Xqv})5wgab)ltjtW~%NB;~NmBrWa^YPzxf#{Bg6CL+CKxq`itLN?4}z}BdUv%B&o z@85Htp!G+;F&qiEscC9@%DMhKR-ARP{pNL|uo3Z?XsZB13OdGvvCZF0!yIbGj*iD& zg=^4^$n7x~HIlM4K6|!C)Ed=Z1h)U}VO|od;M5uQQB%f1S(V{}$phx1Z0IiSWRal? zr?*L5gvCaEEW;)12XzFcPL}UO*K}mc^#XWa2TE|P%t>c$MesCXPWZh;8T~hvz>{Ij$^5KRg_&x7KchUj$ZoCh2asHDpg`4WAZAg2 z0A%pj$BlYW^(ryv2iPWW^(wLA)f9If`NE_!{ft1%&e-CYgS_1tReQ60tSfTp$-qx0 zUS;Nx71R7Vh{vSanN6zNyF7SqD{?&?H}^odD9@st-ctYXwI^FRu(#s>2!j0GA7TSo zA;^}W68@A)BQ&fCr=%YgSu-_E@|jBSenj9KBDAopmyGMf89Ihyx>WkE9~`)UrZ>nu zx5uNQicIoEGm;E2t2Su=qjh0P%xEU*5>iM16KX!}g+#KD$Zp-`2C{iUO7Ei94k+v9@$@{D?iEEkb(u2sUjX$VZH3bPY^1BkpWMO2TB$a+7||qPvjAB(rVcE&_d~ zXZs+3^8~K5wUWA@LKL8}y>z1duy7td71O65*G<`%UWgC99WZON5V+f10ivf;O)3CN zPACv6tFJpe_cL{Yo`28;MN;x)6FSS8;#z{!BH6c1G!%;jrZHD!SL^%eJ!s-Jtr!HRlq$W)`@iAGMHJ9YsdfvsITiruYSTcyQ7Jf)*j7KG zT+X~GQp8+m&J@oPg6Wr$x5+F%zu+=Sb}dZ)&Lq)oD+?Z5##=OsfW zX3QcR@XvzxCPzr=y(2Abox-JVy@|$<7~sckMqbBy$A*Z5;t^#G_eCxxEzlarohvLI z!mUac2RDHt-A6-uTprz}UO}JdU46eBLJ}xJ%h`!i70JG75ljV{kUCs&=%4Q9|&3 zr=$54bNa?8SF_s2W|VU-IGW6NN68t7Y4?3her47MNC8EUMN-87zCK*Mep;`teEFIy z>fJN;_>og$9#IAp3!V<<>QWi8#LtMK8l6Q8k(8Cd$AL{<=OhATBxEEcHE{@HMsWgB zGGsAqG49|zT3?U8UV&!LvOOP9tIie;JagRgddeU#;r}f+Kah&s{raz_`>aw}ixjMj zOCirj5YpFN4H!RmMvE=hoXz=eqk=m)SxS9N5Tkh-c)t1*dI(f?T?>{B1DfXKQq;5s zBN+|MEsNUqh#@Aik42a_EXPEIGSzVjeKC@tQSWNHA_gsNMk4$oJVKRp1)ST@U!Y6& zqX2sQn&v?utk-l&TU?h^RJkl~hF~1`JO%^Uz!Uu|Qv&cO%8r z_G_Uafgh-`;uD^k&%aN)<|L50@P4|jabEfXf2VSF@~gX{bCVXdqMXX>48DU%bXE3b ze@=`OzO*o$Y7;_=$scqxB43J5q#{tLJO>uny}aakq*lsPJqH9SD}@YqIVX_gU!z4m_Dne#l(op zb7m4ntmd*%c*^`t;K2Jlq%#^fan%=} zKyx-UBD?F&ACGC!>G@#Y(3tVnaDx&tZ+7=m%h#?_->~hGzj1;#B&#eRJ3R(? z@?nlAW_APZ|L!1{fY&KGA8Y}b)k6CvnL})5p2iysbD1g>78I2Ypux`A2Z$dhb~YKc&@4 z()dmZu3p>NC|$Y`57{&Bv$GLUcbZqOa-plm$StU#*G;wv#&$F#xWVY>+e6dNUKnf{D{h&8k zY$)wX!q1G#tvQhNBZiyB*3=J}pA}^|VROg-XLQEL634%T6GMs|x_5%bZO0D4iSCW< zOeE zWjc5fUK3OHYeeao|3nxK>hY)mSxVe|ygin^WuZ*i=et*-B&wzajtEa?@O!uzW1und zAP~)#>LijP!n5l%mi+)PP;_9Y1;5g5X%L0sst;8joh|OsgW~re`G^u4v~!nn|jm)#u>U1BHfM9R{)}U8+cMn+#WI(M*F)vsWepcVnO4hlE|V83b9L zQ6=W<_|111qs}*m=|NJc?~DuTu_;NE(@4Qqtnv@d-%L=%_hUv0xJvby=>jE@vZ|Z) zM)Pk=oIH-F%~WsFZPb->|BLGw0+@_)l}uYpk{H-LAy8)1vu?Hnqx(~;d>6rrotw9j6}M|oz5*Y0SHa8 zb@K~FR3oT|S}Mv)Ce42s<=B@vUSh|;RLTvjMWLoJid3d6$qD;uuEz*ZfnxAfO?x&< zDo2`aM`<&j5vWjnV)34?P#x6K(id=8{z%dS~m>cKT&aGJ8 zXhrM=f&#MF>PUYTJl^*chL z1UNO;F%|NR1C>B(!c}ucYhx;I=vj03XAIRc#v;vud{3c3ve4O*p7!G~I%$n>IBZ@F zdfZg-87g|lIH&;e>~xScmMwxg7JpGXs7yWnsDl$eAbTeSn^bo%hFDfEYSbNj2O-r~ zPjG(Pm3TCw5M}V!!8X25H_g279uYCKV%}`JseF=cAl^~h)Dv7?krBLi`9ytR+iP*w zp&-(LF=}Ebl0M;Xf#^kuCkZ2BXVIx6-MNEnR%8BEg`~K}v531LM8Kq3qoU#c>QR~f z77S%CPzh~$$sMPMX!0U>SQ{PxlD9~1WY*Igulh03!x3dW_(l!7@cm3dd#<$uBMHU^ zO+~oYdTP^p!)6hP4xRUG#nz=y2!<*v7<+;Jex&_(3P|Sqp2iu+Cb@e6(03i9>!I4p$mR3yli^$?JhKD-2dOUNm)(<~ z3B*C+M#sX;U-$Q`ViAckg3+-3_bYiaZrK}2KyvC2eu!0+xNy@ZNi@A?Ahum0bA=w6 z3~d-e{890@3deO6Dz%4@6Cy1=BX^)caL)^&eCO}esy{ce3jaOEwhz}c>nP}8O(k}X zN#9OTWGxWOB*|X|wH#1!)hrX3y!cpJ#Z{9hS&0l8%tuTx>&~OMz1}wq6AezCf=$J2;3r;7(hO~%?;#GU zbl_n;#FXO6W6bAkA!rlodCl~nG`#7G?sD4OWBCtySZqRT3m^|RRjwfOWKS!_9VL!m z8f@J)4;N}3gk6lRUi^D^2Ch;(wy5>lsD!LM90wTvyS~nA;dK(T13y<7Umddz+ZyWj zQ1;4&3Jnneo=tqb+jA32?EJi?jHgqjwTfCaH~}V7eq{AVwsqXHm9rV4NLUY` z|EB69lnZAohkITo@dKu)UbaY~6#<-B&Q+nF4v4!8SSqU3NU~#pCmt<1vI~fI97(<*E8@Uoz%qry{sKdj` zL=Tx(^xa}9P$8-5dK>Eq0tYgn-wNfGy7c z4jFLHGGQG&cl+=Ed6g0Jr_2dWC2a2KKWwv_EtAa6{d{9V61?>4j-!K7#Gu8;+*pmE z98U^!2eRz>W=ZHXZ0a04ttSXS3nM)KE#9w16f?%~X%qpU-bf774~b;=yeC@-jG@?w zf#m#9m3vy0Z1^sWCKw>hMclx$F%Wt#Asq_G*}}pL?)A)11hR&(=2f9Ub8yGfm%5CJ%D-=V;(n&#dWTys^d$T! zB77AJR-#u?6Y6L6oAJqkc83J?`+*Yy2-_j!WL)aj^FNeN-gW2xUMzc1x!-CGTb4qe z#8;c4FoN^yLJJ1fUG}uJu$lEP9klXf`x6fxEUL)Fh{h=ZqR}}g_H91;W-c&e$x07x zQVf;qDma?#jh1Ca@WBPxP^MWIdBZ~`(@42)Xa?pwS%sy?+`%XeK5XG@1MWuB$IG*x zF{O5+Fwr(lG1Gluym_Pc{uLuce+lV}$n(GFns*GEV5*bl+0P2ffLZ-4BNcH9za^v( zMFAvX`B0<6tz63xPTKB)L@-GU?zhg1j|ob(j5mG)ZwiG>gX5}dHVFnFt5 z?zYI^5n0%G=Bs7}Hf!boXjp6}SvBw>E?V~~uOO|QQ;g3n!C0dQwqWWlI;bjM%@52v zAfgd+)lBWbO~kZxjA38fJQJWL8Ih{W@XNL0OB}k2JC;neJL4*ijV5DS0Q5E%7dw)| zQ58iFY#Ajo>@dtP%Ux%q+4g{ey|utW&4V!C+H=pw=~WAai*NlhVfg$bzE5`}Z5KDaRS3bQCsT!@HYo4Juc5*8r4dJiYzD|tA^w~D^t zTC0ELEs+!`Iw z(`K|dp{YD5+&D0OEhGy0hE=Jj#7;ByAe`n(kW6){X421vVbD)VUPAzcbV@%kwrVGo z(SON~hn49$%twtw4`(8f$U0}bu*J;CgI<6lL?q~}oveu3L@S|`1bdx+LkW4rGadwLZt8iXbJ~C-KO{U~r_j2qOsDZqOQk z=Bqr!SD(KV^njF(s&UkFuId(fgQUN=XAqMlq;9;LV;{8`er|&xuz7H9q#IzxjFCNK z(a42Iif6?dMTSD$pTE0Q5S>#2qm`^67tH}XfK{}z#0Htok5_wO1 z1kQ|urV!5Ws$wS8pkPCrIMYVfxdxS03Tky~tFSD8; zu9{{ImI#&{rn5(!Ic$)WZHtgJwQNgejQiyVJ@`h}%0amH1>OQcIf zjooh%jUpL9Ix5<5?8CZci7YLr(t2;(cbPw0>`uP$~uN$+EY0XG(i^n!tA&Q^%p6X6RE9?x7;KH7$H@ z9iqFNX>P~bn_haq{MqTg0{an_NDi|;?4c`3QY|t=Fwj|LK8bC(-8j~zX=8-kn|L@; zDQ>b;C*71#YMGd;@=GMA@CdMo<<~BnK5+Ff)N^_Fl5($U|6C6p(7Fyrd-ra=_P<|t zQp<{(9bsLaHNfo zq9xDcfNmqfK~;+84+Xvye6LU7Yy?Li(52}IeKc?keT9(^Qak&Fn#_G>BvtaU8Z9H_ z(;{p($ATxcSsP8SU$y8Y7k)%z1QJ@se{oUH)6oP$hq%d96$CU5Pp)iQj#3Jw(pMR_JTj{%@q~iN|>A*E(P_K#Iy1+2CJ2EZuuM z@PAYtTUTPQf6G^1#q|?b+*=iwJ&kVZetm%Ie*2KJtYHbxQ}ieMJ3q~T$In0JwR&4B z&^^Xr>Z?(rVdo*}8_;n(3gcNgIQf!siDcXOz&8GV6=fiiyG*Jlm9$bnhrmdmkK#~| zGd6=fH?H>t|H15Q78{L|GU}tI^$+JcZyN=9j@SnRuz2~cCHbJBjz`5RWZjMVk_O|Y z{$6C-dvjvI65s`g=P+LWk_l2dU!o_W8E-7GscI8pZ%ejf8cfj&xtt#htJ|r5EKr^~ zm{jWI&N8WU={dLH=)4{#6UqMXfcE`!d)|xChET7wR78I0mC)9keWrEO6+KuL(OZ%O zo;eM@ok^NU#$xuT(YJ8U zZJZo3pR0m*n(F;iWQPO}<-cr$u-G^ZVOfE>x11SDFZN8IwyZc1n@RdpA!OrMO08eX z%z&ku8fjK0;C}6R`Y_|axoE=!v)>>-)8DD#pSZhTMw#SIS8`#M&Sz}ZKGqoXJ8Sgq z@W?kW917n%#qH;H&(4*Sfo3TaKK~21Jlf&>aX7b%jZfVW2DyG{|Ci*)JtvM+^Y|PD z6Ouhj*nXkWu@Q1a#qHZAuvjq>dr9b`P?5mnaRX_h!-aEEdCnm%n0L$=J~)# zi*(eRk$NuHlpB$Tzvt6@v?R_awJG?g*l_t0AF%~t;jy^!rU4gE^j_mg->B=N=7phVi)ux=Tfz%>PB-&^ms@)X;65{f zjb)J7z}ssssJmN(JfkEPIpAqsLA-mO#T2wN9F(LVs24hGw^Gz2=0@l2DmdVOvOm9s zvXXo^I?Hj^OAXl+ju8fSpmSon;Llx8@bLfJW6v;p{Xz8a2glzZu*?&IBsFsE1Bb3# zn$X1)gOJQ)8g*=ik4&s67P^$#FPKqBK6;^?nvJWdbk)rNA5vHkY_I3vas1y=`EP9B zm&|NU^D{vi}&_Bl@APBwX7nY|~U zlL8aAz4=kk*V>9oo={qw7Q8l#vs|eOI}LYC6mb=Vi+v_mxe_Iwhmy6@P%D3Nt6C! z8Pu~xrg(`wLk!~AfRXDff#A79H+>#SdQI_W?nY{j#_D!HQCd${+7s6Uo;Z#S`;Mk_ zl?2fwn?fan&M1F9!EA2VZh`%jNvwW#DELp! zrjo+vHid~s%6B{T;a3G(B1sbu1dVd8PW$USxndCB0}10ZDSaH3^9L#4ct{Z(TYHO~ z2;M+T$R#+wFO>CxTN+oA#T!ak=4HUWs;&3Lo*^{>;1bJXzt5qq7y|bc_^>x2!6{6R zSncyl#<=bIyF^+-&Ys_wQpXy3#Qd<1VGyFEU7h)k_OGiOAK#v>B~FC$Ga-Gc!spcB zUi`@VB_(cjTIU37upstfc{YRP@FAfCZ`o0VowU7Ub3w_nRV$vQIIN4AMd;(TlF+nv3Zp>{?8_ zo5RTcpl6!smKEZ zks+fe^Gi8wv{nDRmg@m?T*2{8#fVi#F${?q8}Q{D^_5!(zw7~tascPb&}78x#~Zgq zVN%I?YKf0?YYH4VuU$Nh+4^P8^H%1e-u{NFUArkb;bf5n4Pgt#$}**JM&}yT;ZXon zY3oIRl1LU?Bt~hWMEz#WzWG8uLBDI+u)Z0;=NO*hx-NQv(ZIbiZ5s=XUo84UW{%Hf zAJw?rV}rV%;p!a5*gV|o$EEGW3AMGp$lV~wt9jT*9a`FQ5PBfd)a-f$CkZPJH)j*8 zi?D_ERU{u815H_%44kyOIHrxeOF64a_V~+#-$RDOxJ+?%;5Y|5sy|R}-`>fC!F$ep zH^>{;ZO;7l6(BPQZ;58zm&{Nixuh1^WSg|^;%M@z(in9fg_E{j@<=&M)#82KU}g!; zGp?h^80$KgSZ5Ky){ct;DHHjgG*7ug$8jbc*%|9Fl$O^jO;-=E0u+JuzN|Z`4qq~Q zjo+r6Zd|HDiGq!7t^w5T@XJL5Ds@N@O*IKM6{7P*0Miyi}-Z(5lIO!HJV{^rSniyzH;w3 zti``i0ztlq?mwYQr$-W?`qwC-)Ce#mHCa-xJd3UFI2vD~_m<=Ioh-YZpp03XB13`X z2!dt{7M?U%nLs$pJ7rXFobSaEF5Z3c*gR$ID*YK=YbStCTMsIv-YY7*S}0My~I43%)!>*aTQSVXgZpxh^hBoKbr2V zGkNM;Wpk8v5Z%GmE#QcR&4yf)V59i#j8U$`e?(ECEzlBEbb1(Z}up_H?o@V)P|Q1gDog z;6uBEnGv;U_>@RAh{ywyQIyFEBq7Dlyc{E*BqG}w3a$isy1q59`}rm7_?r1HmUd2Z z&WkPxPuni^%b;};T|vVT&x&ULPwEO%lHed6Rv{IASxw6j%Sci>d%oYs<)CDCs#xLL z(HSV-4vw9*#}BFq@7B4)hLWnEr2K|4g)UErVwxDPH6)>G(m1o${Zxg02~51?9{Tfi zUFQad5e}yClx!tZg#IK6NP%auis%SN55@RfhhgO;i^Vx0u3?Lh^X2gAzS$ zt6a81q0T$2hG~Z((LoSnR^}U*W7{$E^D)i|UvH!Zi3hM`n3t?eD2aq=@1nzl3g48b?yLVQ6E#_(}T3@Gz=c zIslp1_Z{gLZXj-v15;PG4qx;u&c<0BXiGi*8+&{oG`&2!+@GngSYRS% zK|Rqg)NsJ%obGS?s{cm}$}d8iJ@4io;c%$zjcj^i5K7HqtA7x&p4zz&rb(j5)}mPT zl9p1Gd;4^*nC*QO;|4AJQJ-X_@aRjs7uIj{w7Sg3nX8vPs(jdazYaiA&z3E{99s2ZVb{_lZujC=#_zAYSU*U5r%|2P7;C zWb(O(^vvFsM%w+$Wkh4%lpH1Ecs5N6aMHxdXT;tu;e%#Gi)fAChu3 z@!0#mzGhmrl=0U3tl=>WIcsE)@}bT@g@_Qq#|eNXos zU3h#VI^A*X(9m>>%w!$27XotD9M#`50qB4KeeCVcR*2)ZB@0UXT$EW39V3FB&6l#ZwyW{jP|D9NQRzxT!fix>VpWT>-_ZwMh*Y1KC zqps(qbEW&@9_GUc5{XW=n*&TGSat-0);@^*meVrQJ_SvUV!!rb-z_cL^N$A=&oLWX zvZ-=zPQU3XB$q-y#1iXuK^M?9xd`!l*zf!rxHnuZ`wx0rm?kQ-zxlROr-KkLCt``3k-)oA#N)vj5>0m z4sTp0WqAin$pQIevD~}v-~KOfqFm6X*fm|T`}z}~NqeOv!i_Q~6^5f$Z0-x4-IE+5 z1A)tbuhpzVb;8S|4xP<4st@P=)inkmx;B9Q#tDR8+Tz)7eNgYRDn3b6c{-7*1!hPl zQ@}C@*{TI~Q}b;Q?Ot46>HL}4ut6@EbOz60Pui5QT0+-Vvl}){Q%NFV{1ApjsTutW z{^$e!1mvm!%^vp~&U13KAK+SqOYZzQ5nXo|7-}}EH(gMXoSz#=U1SN?p`>4D=3Xf*b+nv2e-YM*o?;>7 z-kMkrz$-I)U#AFecy9dg(r7IRj*5UlF%XWBhO3(up{YiazQ62@qL=fR@UX)4RPrM@ zn+GJ%qia1<$qx)&+WC@Ex4q5Bl_NDTS^jLv#QQ836|2@^!-^**)9Vk8Src7J0;j|7 zh4=G7FTa!Z$KLHr=C}oe#3rmKz}YOtl0h>mk_0igaBz=o4@Oe6 zJt-X+eMIvCZeGSZW`d3D+0*_9ez=7|#JVgLjlPUEf!c;pnCXEz&L{rVtu-6DPKBL7 zxfLo~2>Na5A7?H3JyE@BV~PuZ3Y|VKjqZqauN)1xJf@D`FkVxar?@qW6?2Q6c=tN2ku-2|S7Rgu(sSvZ; z;r`Y=c-|1nzg-KW%_!rEL&wXPSFH&k1d?2p=4S*8ic6#9b1+JNMZpzgG}@Y;Szpzt z+>!`&b&Ala=HDiM{*=T&!Q8J6fB<{z19{8i2K?TjXgMSuA3&d+{}q|+&qNo5bsf1? zgS+ogI0C}TMSD|?ktPag6FOR8qQ`MbMKkXUoEmVq=eB#_=_-n4J#6u!d3iK3LmU4k z;nAAGh??sld6#i^nG6p^EzM#`o@R>eXKjJ_zAV`hZuoCReX1@waYMEdVGMUCuDCbl z7#Y+}AdV!%8G`_wYgvXtF5xPR14%q%9VPqcZ30d;2@p^wTTV2G0$Vf*#bEmb^43h3 zI*XjDq>ah2Xeu~r)pZ5{ddTp^O2drVf(@(Gt~DeJj@e7CBMxJJ(yen%XUB0!gT}%$ zkRP$I>?ZX9jv8skA;k*UkjYYlfn6J=q&|{I(xr7W^q6-}8N7z8O@bMR0(&JRboM{h z&k{VXeD;cftasw#K^6?^6H8ply4?2cJbjt`aj8pSON?KKF8c_p0(Cts65AP-et`EV z^XYQ^JVW9~iQUzY-TQ`uByIZ?OX%-zu}-+mB>-w3Bn?}qy|6~h4lM0s4zexrYK~4) z-|d<^TI=I#6RiZ4ucK?R!@dKo6#FecqN0`SS^hk(UwcqZU(!5)&2`2QClniV`2sii zyYhQsWuc?1pVl-=w!a(nal@vx_aJued~oMT{$pyABP(7eYDLE`z(y#BhZ=xVMlZw^U)j|jeOCbb_d;g6LmJX(lgi1n#; zHrD3r?|S){ZY4^#cJ48zIQRZwMCR;npnXJo`_U(8tWO%DrcggnJmnZ(`zBQ1&QlEmKp4&Lp7dMBX>W@<-RWoHC06@l( ziw!x%YzNmAek$nk?lVBe6Tt^!NnLNBDr>T+h~6R|#Kb9O>RN>n*AfNAqr^H`WMi&E zEwJ~|Ml(cNI}mP~D33);(lrzo|4pThKBlIk|HAmU^>eTaOVodI<^g^4>u6Ipm(*>M zU6CeyQOO*r_lsjjFt=2G2cM7oIIw0iOxM2;g%S^1p*lvqr2R_y0Ij%rhG7yWC`Qs0 zT;O)+O1#7tetAEb#9kh7gkk8=bb4^}AVhfj978kd&y)n&nm6AP)IqOGZ3&lR+-?Vs<=??6!pC zzlsC$@h8=%!m+;XPO`UGNDcE|v#;!_Y?0ZdMMq0HvRe6RB;t)__>)uCHpBJY%R~f_ zGJZGzu6!tq`}%1J)_MF;zPR%=EbwZj9H;HG zl!yEeXIH0a{Vjj-h4mkElsBj|`|S(!ZnJ+1mOIF;h9$=Q{QCai)5xER#_lMe&QA|z zt^Y&QS#Y)0b!!waUfeCX6STNn(4xg%i%YQr#a)91cP*~P-QA@?ad&&s_6v86`x7#9 zlD*G*)-&hoqt~icCQISY%|BvY6I|HyGYe7S|9*Bq|AdMZ=cATf4E5CbXo(%i_cmPe zVPk^kr7+w|5SOut3F29=2W~Zay=xD8;$?JF9jpMP7_UO*Il$Deo z;(^&rKbF0I%D=UQ365IaeI`R`oi{s87g=)$6pc7sgEEuza!NyQ@Ck&u#GJe7h&7<$ zI_8d}g2hoM?@IJ40D>Ly-Uga0N9=%Nr&oh9j*kD^sj*Y%YyldC@AGW>V&Sdg%K3o| zo>1+ip!JLZ6b+UUu-vaX_HRoXSRK3Xd?3QHdu@X-PW)fs?t6;2VX$aHe6-05Z`Ag> zX#BP~+i}*&eurM!YOYVv{8p=5HX zfgofkFGoTuX&P#2`%!@0tn*O(&_;Le+L|I5`&3H(vDp@O6w@?B(F~L!QToZ2I5;yh zh93(nNs2$vVr+^Q9{JE*P7vw0jP{lTU)N+=DGg>2?YLAvZ%T)dukW#%dju<+49x}lYTc2IHz8>C?y^eo2q;DVll)#tr8B203l>SRE*$1r-3Y{!+O zH2r~~GnqOMw!}JIJOQ#ld%LWS{8vFg+E?ZPu9H=b%USO=i3NK~fG?i+f z_ftQ$8G;Uae2|uWRW2ky+J^raM`!d!4Xn^p({@j0;F0`^!(>#MxITAa2tdLY)~yZ- z=T^~5f!Rx0mNLy_M`7ZsZf%6>f6wxG3m>0tUVD>j5P-amOPjl{k<2AH6Myr?GZ0IV zJ`$y4ICvp&wU5}w;)cQEm~!=rW_~~V@6d1>&hDI`w8;Yjmffoo7QUZW;bF^#q(|<< zXqmF0oUEZ00P`MLBh!bbf#8~N4ZwVH=Z!+(k)Gf;+)>o@aK_@Niv`A|X3xfgeu9Q; z_6uf@m$|I(q_HPM1u}e5jZf%Nj>4Sx90Yi{q>@)OC%$~TkJ*V2xSwfkKG9U6Tb!%C_LY#~#fiB~NjaJPU4f z5Zp=>5wXIpgTmpr&a-lE(a)fs_**7^Ynb(aiyHf?otds-#9|hU(QaX`b!r&EfPV9r zUib0>8A{aBgic=$9e0L?4oyZ~^H-BW)-TWN*jpkc=e6XsbQ<@;%vsOd_ENR|B@G!l zjsclXpitt4<~rH1)WQmFcPNhD22Gp4i4B87BBrKeezN>my@o$>Pe9JEkxUw2vwLK{ z0d?V(1|=3#o&wooi_~dh*MSUzBwl9r`=c`=1s7jVn-MyYyN$l0jhvRB3Mt7TxeE{; zn#S*UH15W%%vb;o>9xho6oX<`XO~dpsS7?-55S3A+FFMi#myPU)ok^8}!5%MePu88Q>ZD`v;t%Fd;Q!sdWJn^+t|u+Q+(KtchY$bvSJuUu0VDB> z`zIqt&NF8UHhAWslGLWRFSR8EjARpSw9bx-I*Sz~7+}R(b3q=>t-j;HfroNNbrHM9 z1;50vHbN2r>t>4Z`PZdGyWE!Lb4#~Bc;6gg#6N*Rk1`G zmZ}TzOjey)F;~|(tZw;LR2<=-1wKWnD5~FBngGuZcbk1nxTHQrrYDCXv}Y+4>gGI= z$e9ax`f$Z8Fz}r`_VrqjHK6nXSP{~m4NNEyT6dEJQ+K%3=>C)eA`R)ky3s58pV05; zJ3I_1utw2Z?0qw4(;%!sL{5=( zE6+XgNHy75#jpn=EXqsEOj=%TWmWA@tz}k+fTBZHa757pmr%u&Q@M?FbMZ{8A#qaT z+1g5a|&I3;-e zhzpX4j--{#B>iNOP&;lYq=hur@kA0xw}C+X)j|FsOurnYnq9=F!8eo^vbyb;0caD@ zi;`(*HlxgSEEF(w-Ele^b{Z(B)m4G1%|NG8p^Fy_Yzat02WTu}q-7>G^!}|wN2EfB zX+Rx@4O>^vK&TQd8<*Lv~1A>hE6A#ZEKvb)p?6_Ps@8S_&T|8sKZ&(z&MXMbo$2@t|55@4UAfS+UGGON9nHBu-nzhL^@3P9eB7g+ zo1xbtC71-Cggrnv439*BcNUpjLpgCub?={|mhJ6NA(8xeQ=DBGb^nfoJB@#TWhv+@ z#7m*8ySn(7{#q(y>nQ-cLo3d*;_Q(sawHf`bF5BskIuIMYl$}==09~!8+!xseaclc z;nJeQ%fw6Di;W}XVS9UA!~VbxJkCIIkd-HiN|pM@Y_VfCa%RJ_6oFmK_f^*@QP(Jg z%gtK3?Z@zqI#nA0eAX|n;}@aZ?QVew?EA1?rBi~hG9H;dc@q*j3D)Oq>af4B_=u}X zHOdoWA}4yCHj*Yg1vkk{)XCNyf=zCvDA_j+2g#1U1;V$tc~hv2>4p{wK6ZaG)-L8( z!T)KmMNdZfY~GEn6J$@TP!zA?d_YZ~SS5DwK=LIW0Wgf_6wwL{V zB25tv{U-Fdo}$j~1GkBP@wiW_Z=rfc+9LR%epX#DNq_C5o}%JSyRxk4DEq9o;msbyq2|CLmbzK8DZvGVh|@%jlsH zuyd5h9jY{176PzeoWk`d*?Q@^e3@dd7ZQTUDKs>FC`Ba}EpRx1%5poQFWt_Vi@w>v zoH&cP_H!gAy=7F$Ebg-^z++`WqA%JZo3h2D>R>MV+`at1G^N!4WFB&e6RvSLv*TL^ zMiDb5PoeDkQL2R5v6g&+?+)gvZN6|!JpAyZB*yh@9=(Dz6sU)M{&KPuf-}F#?FJ>q zQ%!F1Ar=9NI>sm{w6JM;^r~}!dXZn;lSIZiFG=3NuM-OZfK0gA(Tbuv5K^w+5GS2R z5*e^QK7n%-ph4qwR6own9a5uK1cwtm^L1j*6*Mv^X)~ZVDO!X1L zkL2Butx}(8k_}t!D=||`pTD>x=Czwe7NglA;P#_6?E!gO$g%|4Nm>1f#Qk7Q122#z zUQcX2*mpBmu#+5xXzK#kKxR1S2pW&nkg!bEaA0aE(xpGvhEBs6EDT72EhO+8> z|NZ1R|8HIy&%s~QYZ=SmYjhfwpE;$hV8tYfmrIm&`@f{ko79%aMarlIh_-1MRG%e$ z;S%4_^g(Ex)Sklh2nw1xdfz5AUS+XeP^P{tXaKxHb>mkxuVXcjW9o@f*YDAb-+jvj zZm_gyIfQEERXy$g7{^{}O@j8tdriMBgDJ19^VIMXr;DSOHN4L{7F!PX=NsUocLXlH z_aE8guB)adf3_qgcJUOcZnZn8%6Q?UDpms$!cMe+7*qu&&#EzD1}8PQlRN?C*uaH{ zE=d)Bn9X5PVG-!La)OuQTBi36zCgm40$Y7u=bi9}jr*Q^qI0F{ zyMs&qmcpSil+Bb^VC=&7gs#xkdV8L4b=y?qS9RR5pbwn~K$E)aR$YOeiM1_g3uv zh_{+Yp3}_CsotItmDH_n-W~ECbL%^`px?EoGfe2o=msnZ*`@V znfd9FFO+M;()D#cTTAuF{^@FpJa65k_`Suvz~=V!E{5;-OhI;1%ufy|7SwBv_KG=k zAoG+j4xP6DUT$5E)M;6hY{))3tq8MKT7ro~CR-H(pl#iy`bgEerO@e;Mtk$DqN35# zq&5q#@i-kN9=rN;x~Pa$A{Dg9S~$@tJ!unp?7fbDs_+sV4Hg2Hd4lK?Gis{v^e9>g zl^m?zm12Yk7SiZJG{H zHgc3%@B5^BXh^~_&akEBr7CKW1hN5vEP{!0_V6DTk~W#JWUDvnjC{&C7fW_@zaoL; zur4sNnTR#Sd-L%-3iW&Du3t4PJ|bB*zP13BTHxl+=6BF?V-6nbPAtM|4m4GVd@a+R zXIq&@ZXJ~~G|+}nO;1U7`DZiYPM*V!rodpI?k@8U|5)Kb^XmgMAlGk zn}<29deR83Xi*R^(0-P*pfXHT$dwY~Ol%7&GGJ5AMikVnuju&Wb6Vy2m1+NrD-bqS zONqbTbQ-P*dh#;Af5YCqta zdLVuW;S&=Ht%~+^{&<6}!QmkL4LRSQS}SeE;m~kUjI749gL9xI!=_?oxHl{qr-dDr z?neR7dZbzAMh^%Y46T+B@@IAQz%N35O*HyTE(BDx_EE$<_p{}PBUbde!W1tHhwhT8 z;$#VrJ0wI&N8o_2MuxKy%*BC=IR)Te|VVf*9983bwRanD6P^P+I?a1lLT_k#fsK<|IaX;#J8UUb3~H zhWF?3xjr5yZW@*bZWv^pEB4Ybh@(}5eX^OD;X#OkeI$40_=}G?SUO(AqcKaxX|YN{VDk3LH&Q4bJvm^Th8UnN;kv=n=;~`W#ACXgy=YY@yyOhb6zV zi>vxon$3F(*bIes4o-}%tyNYL8^CHRdhLg4=e3dTy)>QM9l!?=rRBw7uv(u! zAKK_4@k;(+dya9MN#>a7_a3~g_lBomN#Aa6PWcw{x(3~quW)}q(5yH#J9smH@#>2# zC%ir9VFWf2t5rEnA-ZBB5~S56zh_j6@jNxlB7??Haqu%PCt84R7xL%j70(*)oXIZ5 zww<7X*_OKf>v@*)ZPxJ93-37mucJ3Ha4LVQycuW(c(cs(ih|n$N@G&)g0SDZ*=|Eo5`a$P-l#{D=eUP98^I z_Rhy__)t86CwO7Px8eBUK`n1WBWu_Y!YaVDkJvzJdh8-+yhprZY~FrBYbCzzJRSWi z1s#v8zAdPF*C?oIP-)_7f!H*J*r5Wb_jP|%WzxuxI8gqZDs_1X6T#P5oXW&6F7nR- z2ZqTCqz{yTw<(`F81K<)$3(heewvBhNr~N^cKlHCZPe{Ywtfb`mc@h zDUs48B6)gl#a2mr8CvO_J}I^ghV~qdc5EbNw|p83)8Qr$dEfg8V1$*`|9ES>W65P! z!DP6aQ4s=2On0K*wqjKF@!q{?MkYyH8AJ^Sh8($Z#-cw@cE>#ozz;;+r$_5IRH_rK zFr#_*CU5+Tt16Q1%9n>7G8Qy79S3>_B$uLz2ksE^!<2W~Q}$?xfk9s&?CpCk@go?# z=XdKn2|8-LB3sB}!!ciHc;eqtNrjoYW&g>ivbk-sTGa^fg>!6#-O>n#mNU#lZ8wEv z&nEZ(mcsG-KnH>+^1VX%A!$D@SXb#;w;Rtckms-K(>f>4hiWulh>T^!b(4rC^0Pnx zxsLOM7%+@LPi%oSExsoo=;O`ivHfe~os^du@pl_Z1@1yYo!#9wSZiI7By5>4~N3iJ=G2<2iXvZcz>>kOg3YooY?%sEJO=7 zXM3X&tn-37bE0-v?%pdr4V(mI0gs^=@~}vYcKJ}bp7t5e3u*T?>BGpiO}<_r{BOtq z#=Bp~X+KTRO3<<-$%sD)X1J}bdp918^dVldXy8(`*EB@nl3r%lVJXGBghUcJUEPVY z*b);SAZV?fiu}2OL&B+{dycQe)(2$mi9!#E370Av{zTU*)1|1RQ{#Va1Jx_GhJ$z1 z!#|O+1?Zrp>v-ct1EaQ8@_=7g3PY{lCqwEbKsNJ#c#J6IYh~yo03aZl(hLISFn;OK z)X$LQNILklz`Bd07=5AFVEzNytm!wd+wj|z-eizxdzDwN;;@9ZU%2K+xDCe-bk;8F zE>~bmHw04(Z%QEY#Qy#ai`ljLlK$=gVdlhzd$f^1wJ&>#SLD|CEdE?CMM3WXNK4P5 zQSeuZ{PY=Iu-M#q{@wld+bE40?Y)y^s3)9J+&;I?`xj-A>w$UjG&kjA=VxNV^(O{R zs^W$G)n0dKEPH{=>*Vc)@q1 zdE#K^L?MvJ=&+fs_7Xv?-rZ=!K&sblx-Y9X)mL}NoL7k6I9As3*Fn()rXMW?=GR2~ zYyp4JpSRBsIT=b%R=#IfqOYcyre$ifVUYp8-mQ{C&nu)^f3HJnLcVtTGM_%c_&Q0f z30-$~+7N`qG}p)@$FtgyKMFrsO_muBkm1K+ts%qHf8!$>=E#JN^S<*1?sz-X|T`HnJ-M_3v6A+o>X#Hk{BX^7)EkRn;R&XxJcaG;zN zxb1q)r}}LJ(OM6{7A=`H5g?wujtg5syG9-}AOFbMq84mOvHo9_8izC786|BE&;+`m z>St@^KWehglgJz;n_wC%2_Nqn2Tb^t!HZcM4a5~mOR-A{t_4ORxL#VANDnNFzI)lx zaU3{4lx6h5US9OarH@&UN0SbNyZk|=d?zJBal|dvS3*&d8+cN4r``g0n7o*x=m`n- zF6!2Qc!*_oGpQhkacTHLE3_6k@?qKdqmVIPukv5YZKoTNTj|OH_Y|GD%~2C*2_c;a zA<}J?EMVEfDhn9tJ#vcFZA}q*9FwS8ov4woiQatQhbiYJF+e8ts8SgSZM;|)j?5wZ zy|@OlSTNkxhY>=y?kJHK;KRmtcnSjXZ=gAwm6>*rIWFhn=*%R7Cw8Oa)`|)O8|H|w zbZn?0%;t?Jg}=&X6~ZdyVgfP>q?s%EF^N%?n;?*(Db9nXS&8eN2o0X`F&0cXS}IQO z@DF;M@q^#eNAViS$j8pqv&~9#=@NN;!8ZA$9rWMonR6W&##(w%dh&E|6CBz@6>$?& z;fq1Ee-;8x5=_Sg31$W_!Gczx{xlvbB~z}@8F4d=Kw@R|59H|S)`1-kTp)n>pp35> zsb2ba%Svxpsu}woYtn4tbvn*3+a@OZ$nwB6PXyvkQ=`)~nx!R7wsb^foxpI7zfgsG z=c;KG3~)3&ga8%5_p5m$1cc$Id^= zwankzQ=XFK!_+sy6$E@C>5Gag3?GPDjv2aag4MH2sh3rU&y$ihf|-wqM3b|NGL*Do zWCJ$(eg8=g^2V&Q-Q!*;-TXtqC^q&!^L9TDWx# z+LJIRlgp;vnoGc%afTz~Hk3lHvy13V_`Ceiwfpu62S#z>So`y1kIB*)42dy4spKzK zo*D-OxMKpC7#b<|Sh#t-&%+X>0B4b4XL@{aV^TB=+mp+r#J68sWwc*c>_y|D)J!;IyKFm z3-n7}?VbA=;FJ-BL^GXV|IY#lX_jz3pHa^iXVSy59nFu)4=pLCi-nSAZqpA#tx5|^ z6Hqd#;7Bz2O9HS7lKu4~o*j1+Q_*)CK!|FX*w9NAuSZ$ZHnv0(tnz;$Vcc;n6wG7$-m{C^pEi zrWCYbP-TKknN0-FCSzP#VNxP2T76+KqmP=JEvhPXq>-)`<+G?)-k)jM*=-3zF z=y5(FFc&DB9Iu2;JE{*a8OclfL}Jgaf)>sjE9c?W>ptqGX!+x+IrArg46w(77V}x| z5HUZo?h3~0gR;1ro!!P6`!yX#ts~2c`T9(Cb`QFJ#V!MooPlBQ?YZ{LeMqG&i~d;P zb20UVk@{#^7o(|cVd>Wxi$bMxo8g>(lK?&CFI&zFym4y)bS=vGjeEndp8-hU4f1%g zc@ed|6A28r$GbH(&cGd6N6I14cCyX&mUoO4dtY90=#5LTP-T0P7V zU|zP$P=Y&&!5oAy@5kzQIX zK~3{*A)U<$VnYU7u-&`73yEXb5UzSd;0m(B`U{?5>Z5DW&FRddi{X)xeUQrQtNkmA$Bb*z7LwuQdI3y zsW5L(B+>#4zR@HIqz>^fYvYZh!%?b;_!mlWp-S<`nyEuUVB6LJSU-X|M2l*Dr27&Y zpbxR5DNHaU!j<@m4G}Hawh0F=OqaE>Q9|DUA0s*(f@={M#q*?=t_TuO+8!sF=^H}Z zmBlpyX1IJFC7RUp^t{>6wMc_^lFQ0Muk;>1*+cjNrl}%h6ukJ+$*irV&VjDAu%l^a zFT;l}h0oimAQ#Zaqup!+h!gp_RVRSluMN=HLT4H<2`(aU|F3<@u)~bs0HqDF+!YDVaV{Z3Ag3}_I!k; zfJXlx@kVY$2OTm#p$W>mM6^xMdjTO#-nE)pDK9~$1PGr z$gX!(R9y*B5|jd!UEu)SAfg}`uk0wu*p!4e0!I+l37n62k1 z69)u?GlwIM>tJ($sqI=HvQ1`sQ}1WM-#~NNYDLBn5&@<`tx`Ni;D!|`+hVf@(Az;S zaTB>oT>_Lp z)T>#4{kZ=(Ge!wN$ovzmRG+DC41#l??dX17&&{zpUq7y2Sq|?g$GK0wZG*-be0M_a zv=FVpi7TmGoM*OcnLKasSz#s^7W_5$XnyK5Gk7X_f(O zPx2OIGQMm~nFPpHCg^UJF+#v}o3RIh|=eP5Nsv0I?PjI;$b-MAr;q#7@~KZf@hAf$e<|2Fkn^+R?%`D1+;g`Iz7MWDS>w&v9Rj z8=#Ocdzset@AQYF7D3}$DMO`o>A(AH6z)OfLrh9*rMi+Vm!j0V=^XG{H?-e2QXK!f z+b??%L!Lti53VF&>3Rj_`9`TZ%Iu|x>yL|ExO|)?#wRp|?jbZIWX;WaPb~|~F76Fj zPpzDRV}>M?LNC2E6|g<{vs7aDX2Yx~xsK0eRa91KiB(`Ap-I9fw1J+hL8jJj@N>gt zwkUE`>}aJjgC&iR1Qbh%WD{6rn+dn7qfn>3Ajq=zC zAts*?iD3LDo;AFat^Z7!H@fq-vNi+^dD71y9OY!-2jvnXps|r|T9&Nbzt&5cI3%6m z{MM}J$kn8!G#>v>DJJ8_R;Pr|@$w30018urv9HW&rUSYw_vc_^Q%XmLXSDTDdkk)7)EgjLz?!qXy~@sj z(UFm@N^o!;DRHi3`A+MZk#K*Ex(9VPwg2G_P{z~7%R2kihG4SrU%<1dA@la?(2Er@ z5P}#()BxVnA8X$;i_{>&2wV&Lq->fHj=^4Z^qyGdjnHzWe`i_|JIy=o^s_g3_(`NVh8h4^t(%MlMWTvK7(yzrT)$e;g{pAQG#xOPO z$RzpHj=trUez(UUmi~4F-2MRar??9E&|`}y2O{>=)jw9G$#V3lYmn{QqmAs(n7DNW zRFzRaaWyWGhe@A*$cn=JKpXpq%gTe|Izo>B+8i7>Zx=7YWw!I}cZLnOmQ`GggG?eC zu0_WB@dZucWL$7IqY`7>@zrl?M~`Y)pswR5Iaw)aiOe7>sEEUgo*tF2>gQBblE=ls zRI-Ua;EV-(f+Q$B+qPFD5m}yI;{-l~hGG>3X7GU!@M~O?;p%lPQfLj!?gi#Q!L;>q zu{SvF!d*wXtOWEk(I*#4dLLy7{^$MU#CYE#!5yK8PA@GvO-3mnrEoE!SdBcmq6-7> z{S-)-{Q9X=N}`$)cr09fXXNKZ)wMfPr8t+#^!J5A3d?`*{Dtq67+|%|o6?nX7mrD9 z=Woqg_RjPD&3}F7?6BgquRDZe9QKd&#)gyCU6BC?R?Ryv7 zXK?*VVWCJjt-@R7&H}!&rl;?W$DOtxt-elqc1aC&w2#*9c_@8#9Gd+cEu5 z46g zH*3Zt9$XJdf&qn#p^2wDuKp7=T`Br<=>gNj*8iRV{oe?ybkxnFS8SJfx^`=W#PQQH zD)+LZQg~~)*y}dL%>BX>Et3N*62@9gtDIY~S9^p>jusx&sQpW`r(dll>{VZeOVtQ( zDNIqR_z{Y);Gw^qlR?xQC*qT}qF$GlO{bQ9gq8}i>nZK3Sb>?!N$lKHCA7L!QHgYBX5VBvWk=t0GtsCs4MGX^MRlM!l+x(Sr8p!nv#k zky^7bVx(%FYZycrm*V*|Lc$rNPUG2n7X-zyysBeorR9wJHzgq^;#M`*!$p3z0x-Yzp0wPl#H1z4xea4>H9CLcrvefBr!U~r!00g4 z_5}FNaAYkZa|wGW}is>fl6)p^qm$SaJ2_7JNb@0%)(|KD)>T%>Am3&WHKhy zcNV`6W{ZjcOXY;Kk^*0f)_Xyv%MGlV?owcr#cTbw;ELreOWlO@RL*4r6mKcKVn$$q zH=k;~WsJ`6vV{<&%=LN`hkkTg4O!FRd3T-BIDT64oz7a*&+Zm?cCk+VdnyzGhn*2h zfe~I7+6HHZrbj~v=#+dnU@3_BDegi~ZDH#K7j>C+P!iLS_aPbuU-#3bQ=67PGy8S% znzS8Qs(uHi)g4wmTHKA9ow;)lsHuh%ZLjlDo2IWmnZO_0s0}%tDeXZ1OmpO_+8UPc zwt%68z$Jw7Cm5874ohs3MI*wQ7B(X*aq}#Vx1XR}IA{r&rIY&g9k$bsf%g4ogOYx9 zZ@PBbGzGneX;FuY$9_J*Vn*!h%lBmz99SF0Qb-ZBkuRqX`>dhK34U@T&SwDL67yANFr39Ym??MzoE8vDpJnw#Vy!?RCw8dIw`JqacgKvdHkzA=23GC9Ppooto zQti@K6Nsk*6wJ99tj9~N;nYELv|d*mP3wtZ<4{$UlBcWkVKxZZt1nhR#>G^jLbS8l zQ$4k0aK5%Q@zm^mJaGRRq4}XHzy|;IUFk&elf-majkm&PEW~rCqx0LUWtvtc%41f~ zq3C}C->S%?YYi0y9(>1zz_e)>-s$6o_#_0fvq`jKLKjsIDbdCw*i$9WJ~fkvS;BUs z+3FXuihT|^6fi6PGdnlPy`-QWY7qHjy#HOH|Bwdq*{?nJcnU6Wx7DN(lH`PA%e-CP#;<5gsxZLbrW*Bt$o6s!kXYx4&Wc09cQDlk~?tfda^2HKduMCsMvns z#h;kL(XYG2;m*RSD%Qv{LS8EJT$I_aWa}t0{{H^D+V0}8U zxUvW(i30$95|*?$l?=cHWk6DVtRN49j@2iOn*b9i4v~PBkOf5`Na^m2ZGHUn+|~9c zZL&Z8+5Jz~rxvH&xBiR!%FYM9+@^<3yURlX)!f^z|8#Ts+rpIz*~i00Ifp$*tEb15 z1!Uxqm4OINslg~t*vB{!C;!__aA|QM&F3n#$0{z{c@|C)0KGl7A+$6_Ty@!FiwFyh z+t?g@UOyBarl!r3OekIFcH)qpU1jcng$m$g>p%Qt*C$_S1Escfjs+ci5E6Odqspxt zeBDT+wuw>K5^?uH=`Om1a^KkTF}AKJA?R ztob|q<5jNdjy7e)QQb6BXY7{#Cm~(-?}6ci>(rKxecar~5K?#I5Z~|dio?9;#-DL z(`@GE9lbR@av-)6k^Spe2B()XDT*5`3IVlFDB3Nl_uMo#`a&W28P}$iFv~NPkKLXrQ_vY?ZZ2vRj?u| z-w2Bu57Vc0@@XhAk80V^h614*NhGHFVBv(!d6X{g*DjaV1lCJd`b3oW3+L(k!W9{p zc)fM^9v#Q^4o8o#H7DWL-RDUpr?Dq5L%EIULvdH}NJ*Zm|IQ+uBO_f@Nkwq_+;VQo zKzW7CUDWPTZr!0zE5o8o0u$?YB~`!;zl?Gl!w%@lZ-uOfNUjJ=>{IO!@X=}w-6JT4f=70J952=PfckGiW zZgCal@A`ClmTTH4g{Jx!=%e-k#pWSLSM~>^uxU}xJ2ZQ0I%k#Y{)57y$7q5j)lo`O zF15~Xr-W4dQ08I`)6S;2cN;xYo2G7CvLPZB>Tof5u-orzWviCxSXozBX#OGJN=`7INK-kmklH zF)CDg`kp5S4SFBb@@%<6Js@ENNU}qwBWj}>L$x5cV4}uhVd!)7!67Q@M>I(Mf&xxO zfK#NSuKf)5JkAi}0iob8K4z^5k5~C3nq3;T=VgLkw8bEd%%E8M72MpTR@2kdCbv8F zU;hz00PaFi_(T0C(q8%Zu(;6Y zQ0NE-MRYW+Li5&mERP^*FG0tf>7#U`_o(!B`N!LrL!v?8@h|5X@z4adrEI3}9{h{k z#k%ez@N?&jP(pRa7;5^QQ1@+M zHWhvQ1u1mnQf`_y))qln*)vE?0*3Fa>NT=`PKC;HAE1D)5FA7XIR3e@uIRzlM0U7t zwIe7dpffT8j-Zd6=!Z|6;*3&^)H=5*raedx6fxhsdqZXP63ucYN%CHW)A}2Vh0g1i z;8kCywbsP_^n<))+tc<10M9^@wEKQEb>A?8D1Rwl3#!L)a8dV!gk$CWIZGqd5Sds# zr|R9qY{xQ_Jhg&xIDC9xStWAGdeMuF9R_5G@6&)v-9*)8WRLK@iqn7{~%} zU-<0v>$CSlmznUx4pJtZO$a9F!6kjamGb_`rvrwNMdq))*iGjRC)s;2QUk4I7`^hf zV=6zGx&%*HmrEwYIK&!oo|94dPT;=B2h zOi(vVb8t3EU|*F~W9!<4N*2>^_|=*mx1Jfhp;uo#qSDjdpqCsAB00*kIfMklRs#4w zJYSLXS*}Q8h0TlQ{A6SNImfh~odS}CSFKVo(?&J1I5N$!^3Uh3Lj=H8(5I|UMQJ0W zXxQA~=4m@vCQ9!GX>$&ks;qIsGc6061xU0S3p*nQDTj8ha^}!U%UOn%d8;3OckQ0Qu-FjAhYOvcDWn zeMSVd156{nrB&`K4kPdO@xU5B@&>f-ab4yi@_s_$iAx?J4kN&6#AcztizwA$^59oS zR;q|Pl*G7I8WCy5Ho77q;nFO(#kEF=e?G(^P)^BMPyo-`EiHg6Req4SnwSSmy|w*WViClZ>#q z!B%E7uG~`CM=Ia-P~ffLoP-+pu@53(F!WAk06}O7I)L(Vh*M~B1n;V}I-ze`$Y~IS zDX%2eioHmJV{BGNDQz8~#O9sfaB);*z>)u%gpjFmxEj%7C~MqOeqy!$iP$7tSx!+ zwroNkp3@Mi&bYd6t~t3i4>LrD2&relqp_a7FUlxj5tWZbPG@ao8I~ykjyHKe4|&jC z5le8QpfOIR7MC<34@ZYzByLVRQ&IXJD^5r4%Wh`JaH2H$i&_!MqQM@i}Zwnko z5S@nzVJ2MQ;mngywncJQYNYUG#f{M75|z>^Lj=Q$6u)`t^&x~&93WMt-5(Xni?bo~ z3!dai8tFK)M{9j8=1tScdMvChiwx+(W1fip@Sz+dfSzj~;U+^JY}J!-@~RMN6cnK9 z1tA@fJg^b*heJP>PewnTp?98(R-wx?wGfLs3>h=^+ZGUeRFVR%Qam&)xXzy+knKsp18}sq@pbAmY*xF`5X;2(pgNF|h zM*c`Vs)E~Btj*(%ptYV@>D{|J<$GtrSa^3UnTh& zmo3Tn8|j2K!pU$s2dCLfMu?=h)eY1Ouzre%+K66#0R$HkmbGE2a8rk}t7g{YN1xa0 z$CGgUl$BG%AvV{;7DnFtgXx0)=7Cif$6-JGwa1Zd8BaDK zJc_7EwBRgBy_Lna&hM8Q*X`z$dq;VL_$BhyL{QgQ4i+4IrC!>$kXq z^;`(TmmL_zw&W=VH`jEYQjV^>K#tsk-vR~?*B1-KJ{HqBM_VnpzobVbg2hy^$~X#F zsXqpj4DTWsu2{-^r9mkz>9WE%_Pm5i*drNrts8fb<1R2lkd&0I@lc2aUx^Q1-5&%!_bSp-$*O!Hke`# z8O}Dr2^Iu$|1E|Xg~lPFY80Slf88X;lfE{t`r3#?VF|QGR$+p}$t66X%|L@!P2&%y znik^EUkt_PH>{ALqrZXh6snfin+vB2{HDdO2AEKgSl(|A@%9eA;jbPb%)>snB;%i*g_?C+p0*{4;Cnz87$$cA1rYNzDV8~b;sGn1L(51 zeNj`e^J%qM7h*K-HkJo5;y71%d(Xh|Mr{eW~aQ-xssK zHXbb^u{|6E?DWt86H#F9L9zzcI?^0UtoW&M*v+{xy7x0<_Gs{2dS!kp*B)#9bH}0) z#o5bMaZLT!WBVea-%8Wy+CA*)3Q|#Vu`&^D-KrPCLQ{_m7nczX|Z-B!hrC-4wOP zWjhT}68IM>;(t7yWm{Wa*LHEY;I6^ly~QE87k9Vf6pFh`;DTT+ZiPaz;_mKFaf*9! zdBS}h@B0t(A$#w&<~+|a3{)RVZC1KCsD(ypc?-SAl~$ODNUpY!OO}^TX3)UP6Q<$9 z*pyC*hjOq{!EkLRi7Vq5#FP=c3E~2NmfzQuK5xDi72e$-g-gB=MwxPwyj*7nzF9XET?@0R(ha9M4A(-QN@&tI<* zpGuH3n3WmBX*ZO4{e3#FbH@dR%K7oU5x)$qjnO;*Zt7?E@2m_fNvQh5gNcD*5YXGq zd0%hN8mYs@@3tI%C;O2hri+Dv43s*!MQ{=zBLsghVH&I14WL3ldS64;?6@k95!96# z5J$WWrO>%yg!}UNSI3Q_z}pfK6Q!Cma0?$MSr(0zMfTR;Xel%JAM-hD`5nk_9xFj_ z++?r%pCXOnvgS;JW*nM_EeX@K_o<^lUzHJ@L9|h-*p(T@6viB409=T3y0hL%Z$L1V~4W427xQzixcd=cdn`(LCB0! z^z&mdv&u}1boN7dLxuigntVDutO$2AHa2HdDiLG;ejXx<2`a+<_ADQ~L>il3RR``9 zaPxoH2GHF#M(i`A`~0HzzHx1)@S2^b1f z?hu7ZiBDRp?uo5OFD>QSfC|SDQ&G9?Q-f!91E6B?@50L2Ywud8>;lstwA5|8{IHet zjYmF4_qdJx`LU%G8Rv_}KE|z!7Zkw1+E2y$H23#xETWG;7we!{o_Fe@SSThifZ*~5 zW$;G*fP38Od-P$9x%}P_#HA~`^nLJmibv=K#*XihCjSMLs#ubz>H=T7x`Unv zgYJ2hEc}7k7-PWx*~5`yYUz%ZGa4u7?pWZ)bb65~5;wc}=J`QbIX;O`GehZ~Fdmcd z0FX*qIxp@Qmx*2KHPmXB9A;@s9RHbZhz!4>w;;kkWXEttdRPorM}f_@eAss`nl~hq zhV;f_+5m<>q9j>VZ**fZMPxFQt5V%M(d(p+YdReCVH=PX996{3*M>v>JI^NNtBoyN z*lb}hu{DF_DEr{;X_gV>SSWzK%J9K! z@^%qMm|!9TF;(7N=)1bPoi4bSfqITXt(P%aR}0{(N+9PZ@VKh6A%azq5XS)==kUL3 znM6)dRvvY>!WHo>RJf7LIkIgR+7FOn8tZ5 z7Y(47%%h5^M~1=32zM3wJikxl3>q)ij?r{*WtNw)c=KjXvF~SFZivI{N>TTuIh@hx zl9L*se-W9um(p`Y%lt+JNkNXML`ElrUy(+E1G_U5%a<#y5+{u`@-2!aGCLE51G+cy zpDBMM=%wXS)zxim9^aT5$RU;F74)s@ex)dU}gUvVv-HB{Awyb=$er_i27{ z{|J+JFR{E1Cw>`MMp1!TM@=%}P{H7UM}iq9EEx^qBEJ7e09%!AD{mfYSK?|`Qe`*A zu!_*s(M#u+$njB&Lxyka&;v$As0BU;DwZsaZz-bj!9lBU&h%#uxQR%=a?5PgIR4Ou zz3+zG)ivc8jyZQ|T;OKThi6wcXzw!n(j{xgyNm2Hbc?yt?og39k@y>DpcAbr#wf9EM z)B3IZ&q+F6^K`eu7YvY978`z=S^$RR0L71G++qHtzz_tc zCZLa@mdt3&%u%>kar7rBOP}LXo;mJ`me|7>!WVf3xt$#hF>_E;!yy*wm1F*JW&Zqi zb+ygMd>x=(ADdm~m(+jb3U9`ce0TX9!5tdTaHI{6nWAu}eRy8{OB|V}LA_B#8|DI< zal&ckJ9sR}An1v;m!L5W9#=^0c2@koq=GFtK=rgV`1-Q(W_(A82!ipOUH>r#>4$|G znT;Qi!P8}JsZ$C@e@_ZiUImypBY2z<27^S1w`r4&}{Z0>l= zQ-QB(Va7#@91<3Z@Erq_gWIbf?FftJ1A|#xdIGzzNtbk3he!*nfP{(Rk>=q09xTH& zP#89g+l!Mee2*iJBBXri0-D5%z^)cjqU>CG-A*t(kK)pvdLFrh`gDFyp<#(-8Lc4t zxv^f9ug^s>!KvJ-1PIYhp$?Bmn0%_u6*5uCsEzSRLdd`6S=gbx6Oz|smX7`d{m6e^ zpBmP2pyL9bl9*6lY!ImO_5mN?;mehE6GwI04&`9OQ|U?t5tCK-3TjYQYQm@TA*RaI z6RR+Ww<1Py=Gj)#y!XbUr_>&sY?3@+P6UN#D=6j_+M)ORwBk+ArVIV+dbAs_T&pgp zk8)8XjCYc8TKEZ5$?SAMb>D^T?H!IO zwS`NiFr|9^{%mRO{rm9NxR<+L5}tg;R4)ZBay^#5uQpOW^`JW}52wFI)Y9Krc2uiO z{^UGCcc#j<`cXB;^OyIIWK|ZUPK))wH9C?Wlc=^1i@L#{YS!e2{qH2`PpDP8*9%g- z2i8d82v?Q1;&JB#vM8U0NhtSwB??r}#}1-?*t4T=zFhbBFp`cxLkHOOpw5&1Oef2|i4Jbb*`%WwJ!Svw zJL=hTM9>oLKCzmrje3g}y<79> zguX;la*!$#vmfh|x)%PzWxJ!$Q40=7x_DR{zSUYzx&|%mp#5%hFWVMaJRIpHZ-;Jf zl2dXs$;s(U&UWity6JK9Gu|qE2SxwTY=Ff7eh=y}3IoZx&=MM(l0iy6Cma$RJ#AD~ z;>AD;Q+)Rsh)Fh!lPZ7K9-*?Jy&PLD^Ei9{T!|UN(~x4uj?>&Hp&Kc*(!a=8?v!rf zM0PN9m7{at1iy4_>(>qnPzn){sGv4!8;wj;O2gUjtjQ;ryQ5q%eIj>a>6fXB28VKu zK>eYq;{2C?AaB1te7ZB7Q@#fhuM{)(5gB`?&73xM!qcVF1^l%hm7O9Up21%f!1ap-%2GENo!ya zYYAe5>)xJHj)UjiNZPv4GqU+gAEeT3G-A6v(dzlwXu&O0NIKLR_J8C*NEXt^>oTh6htc`hhce%bG+ z`2ze*J8jRIe0RZXz@V&rx}X1KtFa;vRRm+nAS60}v=nfPmd1r$mgz_)a>6iudt9`3 zSndwdIbv3^qo<2_NM2#=7a-QyKMn7mi6o>Y@|5*C9u>|KsUFVyU=}#Ek`5GqTmA1WKR+_L($2wlNt1J z_qldYVxr*773p}H5L0cN*~sWNb<%35FFPHcZg|?xRIS25rs3G=x}$}jR=kFqgm}RL z8E!BJOgP0s0*_O2tLG!*7(e8in-#QThJa^d>3nml+%_dcAVpJIZGgA2ezCimrM`$C z7NmgXhf`=TO&)|0Zv)TLhP0ll@K#$T;HC9*K3+=R$YTfw-28bEs5$@yVuh~M({Vgo*a}{@isd{jU7qfl@U_ZiwCQZWv1@+x91|j!CFyC zo(GBwPhkiE2y-AC$l!j0E?H*J7_;_e5fy|>r?5 zI)f1~9EI1MGDS?tix4ZsYzbzdr+m3Tv&BMq3eMM(CiKeitc)VmWG|%#|C_!#%cxR* z!?ies=p@nXStERq+LllvL=Z{KJKnCv-$!7m!l9!prMCK=$n0>X>4B_XRf~=F0OVgL zoLa8`UYu0ydj~p_QCn{D0fpMv6_R-?Z`UW96#u$uDBN%f{`y4=1{&C8a+3Vy3BT2 z@BG0mLQN{48^4;3P2vAa`lqhSm?b|B>foEde3)rLkw_&`;4xqLRSQQ9 ziddRD2e%z;c_LJbvMyi^Bj_H8xv8|l!?Sc?Yd<44c(EHh%I+jM&0Q3qvOM_ z;6!L|^d0f|XNU~(R{f{(91VzKfGAa{=A4s_m%1a|eniX}`QuWfLbrLQpP1}9qBs+^ zQ=X=gVuZuJXQ!s3khmLKt#j6O=pn)k0{u4#55aPPmO6g3g?;a@B^Zx2F+j!pfgb7} z;p*!U>yN0C1a@Dim+w(l=b4CTPH!ftxLuHG)-*-UAmHeNm-a8aARt%gp5GnDXL7^S z3HB0`q$VMKgk|DccEIYYBN#j#ls)1=#QS35kmF(_;dO{&f#XO&iO4_v=w77Mh#%1W zz3w1_9`9OZ6b?7YVDfI=^_CtkA#ck?SMWf(E``D}ipv&5ksPn&VJbw&r~Sa5Jr9pz zwwB*Has^Kk!;Bf5QcMwVm@g6*QsReV?5AvZn|QXG3MHbdAMr=TmTyiaYaI#2fO-J& zi3A}W>RLLCQISxRCpr?pf}DJa{s4@LTX|$oC#J7e3Rsm)XYeG$5 z+{TddiGcBK2l|Z|r#l*LCl$oRx0vj4qRoZasT6FulJHrko?=4vd#VaRQ%|Ey6fh#WiL(^0wki4$LFY|Pqi)v##{ zkFJcf2cNXgZXi|(j_z}G=V8^SyB}4KsihjcI(*E`eAQV%Ax4)?ChR&=+&V#+F01w! z%wQ!%f%?B4;m1D;eJK?@WrAnp<(OIu5oN~JS2Q6NZJRO}N(HXC zU}d}!$S7ng@e6(oOkr1ddFdsyE-6*A&D z!CK#}Oo?Pc=WMB(qf(<0;XHQOf;v1 zUc8WiKXBM;o2u|?;-{Mtp45lbBPx4D4Vt0J>Q*{@pd_J#hAAiVWi?iV?y&WzGcwZ-C> zkYc+DNR+-yV!Uvfd`*Oe>G9e8*KR_I-K?3p zNS~8hrlpV2ec`-oDsxC4Dr>yAdT;)SwSqEDRaJ^r**aN|@jp0X3`C56gM;yv77UOkY?a+G=OU<;>w+C(MHK3uO_lM6JxoK_XNVHAq?$|5?GOwG|x&z zk%()BM;C<PBUg=FO zz$;U+iB1ni5P{{W_;}rYmf2}j`EpmFOCR^tY7qFlJ5tqQB$B{+w1&_&-f-8o0%R$wPX~mYHJ+L0*mfG5-c@hvMb&|Mg@4cavI-cCvg@6 zUMxD8kPn!Zu*Furrvyf_@S^;KN~G#(s6Q1pEFels_wXtTWYED$0X+#|*&=%sy7c%g zqb|hUoRS;Q8)6$X&0MlkwHs=WBBb-mCvw~*vk43W)@4i$WaLtt^J8#5q=|Sg_|*79 ziWt&YV8-BAIk7m)LJ1YL@QKa0h)Nh1%p(VjS9*RCX1Q!eE@uMLqqk5;NK|e7s2|e(DkZiGY-$_v%2|?;R zakyIcT->O)t$&zV9U-zdDRy)Bnqkkhk{i(U?jN#K1i)#DpHBiA8lJJouZj!_#7rM~4`m7{|6Ga0Y*?fnwC?h@ZPQP`;t@`MX4!NdB6IHCh<2kvAY(0z< z$O}I9j=7wxq9o$H2lwDK55Am|l{;xz43TriDoJl1BT+#MH#zMu{XcSF?}Ba3Gc4?6 zFw{*c(})YRq_#gbY_>sRcWBrh9#!Y&^L-Q_aA(_hK7dT0&IO$?epU^sts8la^OF;K ze;`e46z{&fMt}q2c*3^0&U9Op_Gcs@kjJ*`iMsGANqH($gI%(5 zHXLwo@+|6#`2qCW4R#ip*tUv8su!`iSuus9j6l7cnMm`$4A4n06&@2+P=4LdH%+hQ zJ9CW^jfQy@_-QHMPNHy#(Kc^hrGJtx=Z6p#>?PSHs5yH$2-saUm^IoUX<*!Tm*6Ly zky0YoeqKvUgSmd<>Gws8}SKjLfmKsstMmr=`-z#+M@`76ki~N zVgr||F76-+$A7ij#pu4Kb=XT#^)kS;KdLY;jCuD~X?5#et+c?srG0K0GEz7tc4fU! zJFv&ov{DiXz1U6@J)v_J27Vjl;Ftg+ssp&c26McxvZA|}Pi2w{?$B*v&3l|-R?10F zBFSJ&3+V)c{vQhfwgvig7bXL^j~rJ|*H8ulRX~E|&D}~5mNGb{uFswi^jtn48m)#B zvPgQEZ=hZUkJ%IGUJy7i`|Kdtqi-DDZ7%_kLW@V0t|P-ut;jSJz@m2>*vqHATIag- zGl*-3L2GTcP1IMRjj_|^1b%>5x*p!dvY8~}lQGh%cyw4MlJ*;a=x}A!Mu{Le}O46%iV} zOUU{!1`ZM^VYAyY{~#n|1*brYun#pIk{N&uNfKfxDUN*2GM?0~KmThG{RlFI2-POB zsU__uhBZQ45qYN|dLl1yK<&QhMJ63}L_e(Dg4XQ9Z5PLv`84^iaxZh3(`bt9dQJ4Y z0-}amU_F-RX$mlNe@IFkJrmY&2|tyFK_=2&QkqHGgS@kgN0C^7@l&|Q6uJ$MZz*R6 z{IJ#_Pq)$jIT{yh76gY-l7V-7ikKg>2fl6w3yl%up(o;&YaKKLFMQrrvQT4D;B}}l zg0B3P0Mq#+qB&yEw2aA8dH*H#;5Xa4H|TS+9eyhLxidt@Z0K`z1b~ay;%pC3(4Nw1 z^?p6V&;5H1HC>7AV1%MYqtyID;&5Tc*^QtfslLas9+^)>@L_&6hd~Soz!1j3+#|*v zbdWDeBi9uSb_)C{QJbW~7HT^n5M>{^JQIe8$pULvg{1{ht*Rnw-!y6x<7aNchW*K% zFX~H*P?OC;{-ZM3%weAUPE87@sidaNhC-nn>{E<_P*RMnLt;Xnr`SX@q{7GGTV>7O zfWTCgwKiY}zNw`*h6uK7$7GrJs{#J2B^;b+X1})xj_KeCohPn4oa21y|UPFCxx{Q&cxO-H60R!94kjmqT=czOVIB)rs z0^=E#$k&4@BSd820!3X24^Zx)xyA-gYAk(~Wq58pZkRHPaw=ym2{<(c zDSEII2}4SF#d`hhaIlKU&y+qO^UAl8rd`n>W+Kc)SLEqDGY)dem8+k+S{fNnzRrtD z3y+v`lVAPi4x3Ve$7X_e+Zgm5LEvg`?1VQ6e9+Z)_jZ zvp^9?N5#;4134AhH~6Q0+A+Jzm89dU`Z?Y$&XBHbzm+CZi_5o4hZ!Xpk*qU%na5S+ z40|aJ2dBN8o4Zd-!Zp^T3eif0ec6EcDBnRk=jZ$BPi-+}y_@r)K-=)~wTGxWL)B~;ma(w!~%cgS`E`SCsC{Z!oN zxs6_}GDKDud#WP8nUJz^=$%!M$vcjgOJP1Ka?JMmo*TG-1o*iH0C_glObsA{A%W9( z?*g6iZxvZwS#q3y#1)HXF437NU%ajDNU2rejtgyj@8+Q3HK-@PJ*pBSr%N1X%j;@@ z9buLA(LmJdi&bDh!6(QqmPnr-2%8(*Eui-NKk$VAKIF;dFW4M~#V_6+KB1cL5v9&< zDWOZo3Dp^ID(m7yxzF89xIJoiPI|U!!d7zBfs*!=a8+R{|{?MMvZ*g1LXkmZ!`_2i8lWYB!Lr)zD2!&K|fH!uAs3C{Q29QqH`Tw%5Ka> zK;gBSOx|HbIkqi=*q!DFsFeIskPejZui>3swCneEOzYcK8q^@v%A>$6X94cp!^*Hu z28gJHB_@}qk?c1CI}5y`F==0T<>ZekQ3PLzO#Oe+X-_INv3*j^MH%FOW4VF)fR>i+ zRK{ViKf*$}zSk6Thle@PN~uz*$T&1!f$JG!Bx?%}tS#JTw z^!{ZxcHq<*N(JVh)_$nLuv5YbsWhO6WSz{CjnuKa>;tsWa6IG^$)|=RA_C((e*#Z+ zFR_#p@PcfDJ(_9bDJFXjJP(298sO&2}r>*a*L(}d65Xofq#0&qxr@y+1`(v70nxLUHET6qVyBrx zcOaXKKLCpw3SQcgrj{~D-0`?^3}PE1eFA+nF&`4@eY*w3aJ zjzFypERq1%9j%^s-4kep^eWLxWS&<#sgG|jBU|n^Qy^b{KWj^kGipUr+3@e7uVJsE zytDC%G^I_w?~mrSS8jne(T#_RxA*W>R$a3BetbFHFMYfvO%{%Qj*9Hueu6xIs9aBv+O#I4;OOomOg9ZwbdE3j+ip;#tOQq3e-Pt_Y{l zTRkeIhuCON1Y{95p6P(Gvp zlWP)S&B}6in$KshE53Ek1eZwuu#4wqBB{{()h|-&@b5p{4|a! zFPf48Y+>$4R<|~%VEZ#);dyvQG!>0?eeI$6j^U)N6|@j*9_jlFoPJ;s;({471Zn*! z@UQ5GFSOPs6pF)jfK;Fhj#c`{r;9ZGZ2!&fU${w`Ay1)YVa%Zi(m4_YspPx-Q~XRx zNys<546PTfmaRnIE)22s>}(RAvCI}MO<)MOMkd3)H8B;1nT=0{ZzQG2b%qZwTx&ZU zoL{%)t%1w5iW01wz8`>3OT1+P)<)LKJIO>P&&qV?j}oU>5KUox7>A#Em2UV*|EX#b)fu{kBe`tfSrcB3{ahxU-^O0nlWKo34oi=rg0X@$+ff`N+mpCiU(9vPTvWk$nT2F4 zp?Ix)%3VP>0iCx5ekS^Ysd3x|70Ne@eM5m9wV*f95`Y?PDtDyP(`;-cKWnXCjQ ztRAJL0_#DF9}Z<0^J=-*aaA?XNw>Qz|B6wnG(ha%65X9K?MelJe)*S2^@6Z7fnLQ- z(n2_)?W+IuH?(si%)d->gnn zOVG_-LLrX%BdQjy2c!FQT4_M`sbyOuL*H#DUX=j%JeOKh2Ov}6Qm;E^I9934U=GE) z3$o~2ARI6OBhe+rGgbScCgM$IXF2;7uzICu4|@e0s7U0&Z)jNfnwq43YvVV2oGkx- z=x)Qy18T++AsVJpDEwsZSCFPqM8Pji(No*AYFXX#`~sHtJ^Cg8l`>HXrN`S_{5BV< z-+^M!FQIQe@lUtlzMX;mJf+ovposHii=b6PMu}L@U;9^w9v}VbqR&?<@EL7gZp$F< z20wacPetR$`~QkYEfku9n^q+q(a3uCVz(3E&gX75Id%M|rN6EFVOm6hRb~?bIC6LP zePhUPA`@?F-JR`V#HqKTRXcF@SMPzR*9sOOJ7mYN(-x>8JVC#OLngoaGGR( z#9LEo29EG*Hqw-_{1F+k{CuzSA0mkEGXaXCR1X0`odg z#w-eRC$H&OcXJfVO_AbH=KsdbG9Y*V zxU#JDjoyrxF!rHiRH$XDkbxRpP&$D_s&yk4VXy#|2~?7?MKmk!Ai@J<8A|1dh00Jn zU+9vB{B-EJB&Euxqn+0cbs{hNkvDh`DcgA^-R*|@8uzN~nq;bXN_=o~wE}vBdJ=jh zaBIA7oUFX#CF(+#8Wv5CNg91{Fwc%mTKH(`qvRGgb>mfwe>L`zHW?JoCWV!mIJ?RI zScdG=^dgju5*CtzsWCHCC2E8!C75)#$N?xiJmKhHCCMn%cr?=X9eXKikd$ui4s2;n zS;zdR>647y^+~E2m&+5HXQ|<`3ynT5( zUP@SZ&hqcYjq*{Pe7;z{MbeXGqIO$YmPJsZ`6!@(KwmJ36B_gF0~YI(tdQqzuvU8m z@AK~P-W;M2HKpFIyZNM8Jsbw5FMs{b1^$+n5~7$2$G?#b)!(R&{3&`j-wFMg@#XAj z3#pg-i=wR7x!vZ_(VbsGKTLC}ldTp?&*lX2(Em9>MCH1slDYX_u?L7!^-tEloUqqJ zk-u-NE#(}#u|04nV)i||ZaP)hA^HSd_lUwVz=Va?q_vcv;YLXz_SiA9sMzGL$n=X1 z({n8(+GB_D)JV=4)ZqSi&+q_}Yf5Zp7K8K~DIm|CCV$q^mi-B_&b@~}EXxCSG`hunxSgj>F%&`N4yz}Uz z2OXvetmQ1E3q$uUEesx`KoSl+{&{27fMrgur!sl7W`;}&$Md1qqb_+eXv-hz$@GAo6hk<4#v@l9rPuGpc1dh4O3coy>EiQ~6RX27D=sX6 z-;=}ri2=FKE5-|`q0oPsbFHurz)lp;BN6=Gm4}BtE?cRJ*P`C*zzSG1P`*=w>AIMe ze4i}n-b?nh#>nX1n*iLFY1pa?;5mWbFWj&uUeGh218qFfoU6WkgM`Hn-y($lees#G|1Pp`YNH3A0%EG~GurR3@bcNJ~h``1Dx{ucyt%LDmd8yC?kf!@z-W$-gnJ<*>KW*@zBihaOf^W^V4E?&X#drO}_9tp|hLrjs>|$Z}TH#SWKUk+McE0|j zv=%OI?!5DtjqSc$KksN)np}auFOErSWA*Zjzk!DC zcSl&OJ-OUt!OoZebiN1NE@S%+Nn7obS1vl(29O_OKw}h(?azChcL`Mj?%ditt5Lzt zv$ko`t^2u|w(%uv2v^>53>pR9^f}?v3lsXbxnA$fke7TD_H-ER);=Vats~qXtDD+D!}F>s7)NV3 zDZ*~L$ju(EU2rgiEKxu+Ny5~+ae}dQ!A@Kg=9dd47bvsiTI|);RyB!%BC0=F2U$lv zbTXONy8Iv7t_1&SYd*Hl`#VXRf9<1JWB&#>$4^f8^M`^qhSuSt_6VD7X4B{TYi8vT zmO)VWOb$8AUIHdAqrvTNNPv_>x{mOuRuy>$cbu}KYxMA363#3b4Cavb?D=2%p!kgdcLgDrf)o_mMM`Oqq&L>xe2 z>bD8lfAfy9>490o$DjDdGo?O3kE659jWE%Ssuv}sQwZBmi50vl!jc(CWvJBx{*fhx zETOVFzO5xA5E$HOW^+F>m$)H}dd)GsbuvYdKcML~uC*$-XI*-Fn@@7XbZNdGyyWXq zS6$gr45b~36I@&fG$edZ5I#?%-s-QUo}Xs0QN^#(c{wAAx4KD2F?pY}Aa=%fh^U>Y z=W;0!-T+47s?amHxljVI)mgFAtOMo_oY>s*Y&<@9ROczY*zj6Z<$0|bPod}x=>Xsrj?pf=Io$QiX zA-Ioq%Q*vqE=Jig(1uqm^YoC)ha51ot3spgy|Utw8*{J7-k6;bKPSCVP3e+iMlGeO z5Gz0_2;ocYp^#dI2NCoB?s4$75ud}u6GE@&UEudhe8A3R`K*51Z@p|^%)^0WaJ-n7~*cmsjF?zH&WD?g%t~GK zs>DB<;ydxYP?2|Fl@j>XaN_sxEDQ$2RGHL=LxQ7szttK4@jPR;c6V4!o*2^Y?9`d? z)~`pqh23;ix9jYUXThLr!NKGGz{~qs)}JsYTPqhR>@;hyx4#9y=EEVuRMn5m31lFM#uCALvbH+E1N7AG1Tz=rf-XpSU$g{xvwvi9>E$*f-WO8(C(#HYu=S z8G$*EkI=6SbT~C%D!yPg)QuCwsM@gs-QRFX*Z%A044f7vz$z49bn-GhLyJl);Pvj2c7JN zS)Tu$Nrfv#MRm@YB>kZt>3>Sce-_iSf&34$iA+SR!fi44@3XAq3Q<;ZL}1R(FK*C5 z&V!^XS(txT=@mt1{R+XEThiByAvqpgCfn)RusJ@Oqozb#=3fM;`;I2pq@2aW=M=es z*npuY!&mv!a%fat`%PrTCyit^o7-9MxM!+{;JavVVGr0!y-?nYwnPQBsKOazFcA!l zuzOa;$g2I2;7ls;ube!DTbeNR1mB`Bp_YC>!S-{Uh^J)rSP z8n3JJ3)Fe`^nT!hF2a9`Syt%bTP^W`tca_fK5U_?9bg`wG?oxrM8AvZI*)X!uiP6= zH|UiKa=Y_^1KYUqVw&OS%bU~F7I|%#zH}8-`;AQq0YFP$BqTb=3 zU8pT0=wxY-k4p4JWKuZqBebw|fm>0U^xo)t&*@*Szro||aAG*c6t!A2)<7XO=kMw= z{19H_&Qay+;YoncM23<3@VjSC;xjvZmq-~@$!zI)*8I0tbxGqD^YfRm?;IYH=?Ys2 zUa~gcfotqfAuzTZi`Lkn_Mg7L;J>) z_~ZH!b_3Zqj%=6MYFaNzh&TFO_3L%sQ(%l4F!vXdSmu3H(0x=GE^W*oUb45pA1)^G zzTu6oFb>hRh8A)af={^C-Pre`sdB2-Bh*^eDirc0_pf8x(yeosOlt(d1y-me#7pZJ zm+CQK9@Fjl{d^GoRl$A;I)^h1`YUgG#KoOO_ANx%{-2O*EaSLltX5ucP7?FY70hQA z-r`(qcEh)FY49||melcyW-&EK=d(LwRetI9ln_DpW+(iUEhi(_Bv#a}*rj~XjXWiN zt*G*(A+{b|&$eAd4;|(TtFR=oCH zX0UipR~nR*czicatJ9o5@sOPm(U{lsorsXb+LNU9b@LvXeLdQz-o#_KP?$Ra03Y^}DJqUBDo??-#9tU;b>bSOBwN@vtqC zt@4~XlM`WUX|vr5?(DR?7S6&u&yB9?CXe}!S%5o&QdyRjlyZY6*hYaT?QsaB@O~C7 z7Kd+ep5-q#PX0mAnixA9wov|ul0WL;AREYC*OV`VVhS}nDJ`PQ$VPjX63rPgpXpM` z3PZmamUl2B*NgAPZU`_?hJyb?Y-V@uyOkl*OGHYNAAwr9NuQo%wbsFOzgclQC1F3Z z!M!~WIXBzNG1J;mjtxN1hauO-( zsyNgfmi#)$(@-KVRJ=IUKMFTvlc(d-fVtEwR$-4f6V6$2Y)OhG7+9d!&N!NI9Gd*;~-wIQkMkq0!XG38@vjoT=3 z(lHUTSy2)t#ukyWugO!D@!9h{@JskCEoon(BJ({yBP5r@5g>g@E3cR_Gl3ZZM8MRW zONW&b$xq2uu_@*k#I=;<6Q**8f$~biqn6UB)!3Zu!gqxc#5^US4!sM(zO9%pEKX6X zZxZBEYR)u-ooZ(}>el`ZMf)~>;RQyO9K%?zJW?*C)|q2254DCOi|0cTnkEmwlNfv@ zrF}^xPan~utP}_Kq@)5T{ZQADKx`Q9Zms=j$JY}R9yTW&G7ZVXvu;LbieGLFqBd)5 z6M-b(ut3QxOI)kBt|f5N?xrXstXj@Or+HfYV&eWXp4zm9=WV+oJ7bgWNX63eMUpUs z;(C8o0ZbMS5uKW`bkqhC{fC{vr!Xus{+6^+y;3=$>ep2 zS{XMuVMUN#p1?r*8cUTXDXVT$=MXkG*9!xSob<18 ze%e}ktqA~8{mdI=lm(9^F2~OBYDXH(4{%&{@n%kr*~H~_wu_*#*6)*>RmYXOaubPdwgPOb>l}~L zc7!G~Rch7q*)1CsNk7DUJx{FNTdS^5J54Kt9NdJqHF5AAc*CiNm~Hm2Nb5W$PrfK_ z>KDn#h4PXLWKhU0hbpEfz??Q2HNl{eX$vnEZ%q|-RV$g0V-HRLZl0UfLdmp@h(RDX zZ>IZz8gD|jeeu6^ftckB?>CooI72G4|8$fzA;onmrB+dibsuMa1&K7{Yb}%b`@QGr zeqrg*>r*n5ZyDRlfLyKq_(l{yiPZdU-KpQ3>m#J~Fvpt=W_SPf~qiOlgYxUK9d;dnZx#s$tpC3*y# zmW#Jo)ES?I2d?1uV8T5bl|ZU;E>)WHM2!QwQ=gK6wQhsKqAx(3sr0kzqWWVde=l`lK1H^ zGb3Z&;rSBtCzj0?(en?E!CEn}dFVEb?p-Z?fO$BjDxUcL3=xZqMIZul@V-u$rwo3q z6r)|Cy-EYwuUUrwow#_@TD^-f_B?{Zi|EkrMQ}lq9bGAOenLg%YQKD}gBv60>3LNk zZcDiWrz6`q>7dbkha}f8z)4NVPj-{ZL4$_Pg^M+0kb8)7&bWL*ZgW-@M}w4& zugnT1*$Pg6fsYH9s@~^4?lV3S01<>mtPMi#ScSHVQb^y`NtZ+_`xudoLrY<_fhez0 z^*v9p6q8sc*(vEkQ11yuDWx)&a-<}wJEIeGAwnREY)RIxBKrCh2UnxEUG7O5XaIS= zw2(HYLLk4oR&=U`)UnKYDSr46t*VfrO)-axHN&(>W5bLASr(mqQ8$kLcnKEnKw4NL zfC}rF_A9ngHibI(i*i`E`bX>FJXuUE-5cGI36vs$Iv&UgI?k>ZUWTE{pVmB|H<>q) z!cn^=c1NmNZF3a=OVjYuUbW<|vi3MWnFUWrW!`(q2xUXRgDi4+A;vhOT=^To{8iN` zliJXfklBTp_Z^GsbLm=(LK30a9r>T$*An(Ba%FaNR-0f?>jEhrNq?pSsXU(ec_s1;VAtHRA!-+4Z>bFJQLd_k4s0@qZPr<>J#c?t}P`oV9z> zj56%3=ouKg53sX*J5E*I&-%Lmv{zxnkqpZ_*P|qz%v6xvX%GIW7IjieimX(MpzdcH3w6Q~4awOUGr7NcCQL9w&_CQwy_y-pG8-g@Q~hX(5X%6_|yS(-U!u zgjzDCf;V?N8)ubo*=-WvRP5dRPR`SeqWN60$W zjx<~e&?|G~TKPRh(303ZA!8X2SsBAiH0bva`yEKdbfY%D$)>gU0Ehb|AP?Nip*WjZ zySr}sRuNyX@W9Idg@J=<>(o`4{O^}pN{C_lk1J7rijP>mhf|=^obs#(gu`(bWW3@! z7cs5D6}6nT{1ei?$Pb-(QF(fqs=-8yRPZ|X>irXcfMyX1+#pdIE<~15r+3HOh=Wvq zIvIoICS|;~JS(Jx6p6+(J>++c&oHP&S#0!dqVP( z6__8F8*rSxI0kZB!($z*%rWuv){|jr%^Al-yaPkxp zdEe0CFo7KjjKyE0=DqB1*R+n1>?+r~f)b1qUb8m!_RT5xtwe)lKA7>eh{rxLMscxH zQv{}8vaJD&s2}EYZMlE3b1i3J8E1L!@e0lLo}X1PpGwrWg^$>bU*%7SgcWqbt$Bn2 zPN8^1)RZbXg(hWK-3YOfHhYl35ya*o3O-JH4r7dggk?_Ty4R4_vcpDmyy_S%d3b@{ zBJAZT!kZhd#^9Y~Y6&g+3zV`aFZ-hd!25_6u9YVvn0qFE%7xzC`5}Xs56zCORqJO> z{ZwTT$BKds`{_3(?5u_!ck-Wu0jQ3>Fb7z$Ko+A@ozVqEScQl4x3z!UANxwP8v zLcLDWtAb|t>a1$<(`xYcZ&gqZjr8vZD^Yylbua5|KUZ8QDMM5aabN5ym6fcJSjX*& z@RA2hL`gdr{!YD{bL@*XbBs7Hv;N5-!LXKpSu<7p;dugl?yjaveC(=L@kPgH|v<0 zi=5m6m^rzaZR#YB9m}pOhgcimy?9#QsK)z3F|$ZZ39)W?Fe1kK!j*S(l%lS4ECdXg ztDR1vhyyvG?N}MgML3*G&2gdQi#PQH|2t?JU#dYnKVkm*?xh^qMOUWxJeWzHj%is) zmi%KLDNnml%_8pmw}^0APbvwm2c{lvxRz96eEEr@+V@;a{T*3z<4axV`Ou7t8EZJ{ah!u& zT$2o5ry2y3<~L-BTPsUqHAy5EqXkIDr>=*Fd1%10b9;6`iaWew+Yjd5h0dg~a)z7) z>~F)w5n|>Q5vp-vCBpqvI(w1wMKk^7$y+7EbqCF#jp18SaG$@xgBFrdz-B-dBB9_O zh0ftaJfr{S-Ee>>lszNqMFO$_8>i^p20c}a`mjz;)e9I*u5|~w6*~{a z#9NB&;6#Q@)#*LI0V>WV3ecX?KoQ!wSozl7OH*T~T>D+vbQuiSbvp>R*_no;3QJW< zvx`$8)#ed)0g&~yn5rr3gDK*Of}P`AKjikr>p|<0!tXSD#vbmM&>z!T0w>bz!L=9_ zK>$Afsw(p_m>m<9%Dw5(q;}MUbeu9sK+l$l0qwB+h)|0dUw;xjv+-OMsd{K&RS!PM z7Y-mW4z0}YzXe@J1y0>r{fXrk2qB)V8#R{0q@c%;(!HDm1x~1m)n`Ex{JxKX~+Atw?>t&$5|@QwxBGa@EpAt-bQ05D(0l zZHyZ~Cu%sWH1b*S7AV#J*8hWL5H#&ErXnfrg1TG5}kDgXTBOErj*GL=H(fR^M&j2w_aE&YE1 z3LthagoZR=_6!-i z8Fma2)u=8fmuOqLn+DcJWg(vLz{RA~=*h9?4W55<{mp)+>jmt3-=blP3$us=$WQRM z$I*T+bcEGxZ_A>=KqbaJfqj_5{r=yG<8aY^z#M`Rka+F>UV@a^R>6Z(9z?;3`Z`9E z<&qq35a-RgWfzWNt@Qb3$*PE?NHO#>noHBJxO024a1afE?5kC zDx9fpbWleOGDFE*-;(G(f-o*1A?85^i%bSk&1sTdWv;J>`t^D2^G_rZgT7<_dg?8G zEG#Y*p9FUAvMurJ0Cjn?kZm!nAjmqbR(HTsumuUX-|8c=?->>Lq1HX*To+;={#U80 zaB|ZoQX`tC6tsgBLjAh^N%HqLJOZfq^tPJ6i0s+mLB*&@weVJVd1^0m3kLvJGG^*{w( z6db(|rJSapW$x=>QxjlB4o=G5?wVU~Sq?R*4w5ru7ti?(96 z(f${-RzeQg-Tqq$0nLBIS@l(@Q5C|wF!;9@VD;Gez$I_^0LxN^zLagB804WyK#%%P;==J{6W+Nd4*WsrvcK3&WVc%7QJy zZ65EL17Z7IC97Q_v(x==Y98-A%;khBTO|D(-u{#)^+Fg=decutj8Uy_|}T>J{do<96k zP-qjiarYqRm0hy%Bob@y>o)jrDE6X1Wea##bNPUPbuKIXPD``ufTMQUiFTsrF~B#X z*S!lQD(DX70LWVKa@8-}H}!YHZIZqJx=G6lwv`ar+vIh9vg8bYE86Ka7_x6d3X8mu zB{V&(5Tsr8uugb`)YF#<7+xk(mSBf^v8?m|%eq&Q@wfL#QKsA#8ox?hNCveQ!_%U=R5qKFW33Kzr+EADXPnodc|2XtEnj|fV@~loEDdpdD`j?-V!>pU-*bJ zK^-LNP>C6v-MkAp8yoHI1+f7QMT8`?0=|KIWE)?i)76B8SwGuFJbH4$Y_7tey^6%r zxki3cgP{xR{u@KFPKGWEbqAG59YtZ|L>@GkLLj^7xbgxhi4{>L{)4#S>!o9&xcFK(-~*btY*e@8>N=J z?ULrhL(6r{7@(BYyET%gS!j58M4Xktal?cZEnx4H#kQ!3gIi10wAs+KZ^(%O6IMIx zj3<)wcF@6GfszX{a`P#}O2V3DwQDg1`Mjl}rmBCe>{ejBr?Z93tE!zn21xFt%96QM3kuq98)l z*Mq+okCzkyCeGI@U0r^${bu)8SKMP{-bp(|-k+>zA0a3pW86^7MyX(Z?a9t9g)grK zG1%+mx&<-mcRCVArRP1o1>Fp;6Yz`aLs4R-$`Me5DaDzR8K{FY@zj;Y=~6$q(1A#= zqS7Z;H#yb5(M*So{$`R@AKB_Mx#|dU&HCnP^hy9+fmzZoqsQbkP;G~50{Zqm&5_=rAyX!Gs%PImMhI|JKg@L#dXo@Q@af3ftHW$*xJ$29LkM?S$GD$S zE!Tr~zScxtI&go4Hm43%&XKB+tmH#EZ;pRTIxcE0zN(Z)i5=%>N8J>ZLlg(=Qb`+YJDbz4gl14b{ zEFxjWEU7iY>v9P=d`H0L;&b$yICScKl`aMHgRmq5U6PDpJ7LXe#~1okjv$}+s|2PV zuH-^jG}Fied$9swg0N(Rkk3469Xzh(y}YE(1<3D zkgleUAV5QVba^E|(7(_tnHoWDQKk0cvtwsVMP{nQYN>$7vjY-8_Cp0e&%h@!;3eQf zYYIhOpWwF(^JQfq<_2$DwfKe^hw`dj$=~TrSQZzHsckH&YUJO0kP4I3VBjWOs({iTCu^jbFG83>{u{%v|K$(E ze+uwy)|j{%r{7gbrqBgC^rG1(8yHix%y@wB#8c*QKwSRz@5Vc?dg>I3nEqDz-}z_M z=Z^jT6#OIlLHoB!0A4id|Dmo~7kta#|MB2FVD~XQT$mC-GHRH(7xF z`s2pbpotTDYlIOLKpBo2zz0BGSZ3my(bN26ICb7PTj@*mh~k2KpBqHww9}8mfY#Z6 zK(+3~h-_=IOH_(xFDjWYdK^JSY0TAaE#(mw<(NvoQ}=M0aYtI9H^wc+FR>Mo~fpIpG;;1L1H*f{0md`8*_aNPAHxmiky> zKEr;D{$&y#`8*1u((2VnWCGZqYbCDx$rRzluIVL%dT*S2kDU)AKJC*UHeH4PASLqJ zk-7qsQP;EAo`Y;u5nTVvV1%twq~WS`?Q-(Z*5nL5U93RihOdS6Ycr}018Wndq5_eV zxG>Osidi$Vo)JD5YerQ@BT9LuRo=rFC2EowEF^lX?Sy}ocHRZaka1;nu5#5+xC=PC z{RxM&c$Uv`Q8P;rlt;r)S4Gbu3mg{}Sb@hmie~E9VGdLTMbJ~7SvCE#b6DjiWEok25kN;O!iu zq?@Ri;kRs?SE)FcWlM|)Cv%Bs(9I>DuVmytiyb^} zau^-g3ikx9$8z#EuF>~rd`wb@9e|JZk|?u(v!}0n)`) z6-7aZ*;C7unHO`Ak_S?(PVlJ;C`~@;8_(g1!wWq-h+cJ&Z`s(4L4rbCa!I>bULi%L zBAJD<(zaq6yG;I=B|ug|H%ZCHmNi?g*~F!W$3IC|glnKoIenp}XzDu%ol_q}Z93`} zKhWW7w^TTWr`?_0V$g>HlU@Cm|27#$I)um-@*>iz5HKNQV#5Ia{!A&rw|&tVe+CNQ zj8B6b#n|Jcf|*G?oyt;4S7iT`O_T1WU5T3R7wFsiv3IlJQK3Kp7iIQ2;x>gkJwJxF z#u5qvq18aP`8j##Il1@Yv+r33rH-vymM%K=Gy}QVo5_h$MOK)W{xE}4N(28f5)f4t zj+Ji+%*Q3=F)jvCXa2Vb86tIEw(;7}_J>KEWd|tg!WQT~hQaZZ6hU?T>hG|&Qc+!C z()U<`KdNAXp{a4k-|azE>_|;7iI>1FoA<$+UIqSGX2f5d`F|EbbiJbxu6NLPWEC=L zEeMZb5gb1kwWlh%{-9>r^3}fI#NT5OO8@{0WS$^b8n4Jw^0yIk=|tlz**8*9$=Xjy zJg6&T9b^J|CP`sQ)WAJ)*vsfGpN`Rqscsx9W`~!<;c#plhVMi12DChh z8Y$wk<0{rT0D5F?r)_aP$|+r4UyR*;7HB=$5ubeW{qT31$y{?09ViB0-7M*2?b z{q`tZ$P$@9V7Aif=@(E#V2omTug35ual=gy+xcfYp(QR{c^Phl5R!s-ds!M#cvAFy z7=j%ZMk?1xw@3BjzGycGcCJ2<>1wAv?RTw*^l&YnuLo*kQyLdr!GE_P;A@_} z0u$9qo;Uq?`28Lm6Z-XE%`OatyS>|x#+kjsb7{T{sj~DG$d>hI#Je;$y zSMhqSG8*Bq?oeHkkQE5+R3CqR{s=&+Tw%p++~1Njo6MB{chwZ^?Czdtx;B0(Sn1Mv zV9{aDBVFbUTu97^9N?q|nLdeQEmkToc})5;Xa7_Vsvg!S1aWo#L~4mB8%XS=gIMm> zFe8v1I)X1-*XsTfW{+MOd++?rq!8hkMhaVm4ByxFhk8}=?*^5-E;zhvrpMgCub3S9 zgTb@j`RR`#-(7f+gR)fJOPW6WGR2}xm2+Iv37!TMdWa&POAS{ZH^vjt*mB_u39?paOaMAVGH)Qz9u3{@xs!NeU~;CrX(H6tWY4Beslc z&lV{Uyk>KOiIXNhFJp*Ch_Dy^g^{8Whh`Z(a-0xvupzYsKH*tq^I6%wCoeC}kFTjg zXM~Lbp8L}AU?%|vR60b!H8siN8+JEkcC!cF&WJEQ$ZV>=-hGgRWL>cP&-YV+w0ze2 z!rr4KU+k2iwA~ke2f|ez2lYJ#v9nB$$QW^vL(trWy1x_%%U0gWAuk}hk>qv4-Wzz{ z^%fB75W5(-`_24!LsGUw=3i}`d#N12hQkMpgd8Ai*HYmsqT4oCtYSGK%rEy5A)aB| z!!#jWiI1D_FA^AUcT}HSw-&e;`zT7E-RDC_- zLA^DQnJI_httWDq*eRdVbo4To2r_COkZQX1d~MTSmTHMF4O>MBoZ-`m%;_-*{M?Yj8q^J5o zC;?7Osd^>W{0#mNCrYk&4yI13Lgev~-@r#GgXN@eV{rgvmcK4`K|^hL`bk}uac>%W zf-hPpI@a_^jOF)v+l-LbpP6UtRB;6F-O7k`d?eRV^Cw?(#;MKl-`WkBb3Yv;gxr2_ z9y=mX*x7TILyw92y(jsY1nq_+LU}NZx6(M$a--^-`r=Qp>emaFkM+s6q-}N4SnFbG zEUCDPsOO70Dz@m>56}qb%2Nak55Q9_95B18aKg*+STT1H9r*^`|+dY`fL5*-GGj#1MJuvQtj4>Ia&C+6R(6p{^|7Er-VdX2LyDsJNtV z|J8^8U5aOCe_aAg$)G?JO> zY?!el5JbZg^C<~+jbo!}$m0q}=W2uQ!wER`3kEo?|7S^EDAA!^(U0s8hTQ^zjws_% zWUiUq4VmYfeFi2F`^Vzo=h3Mal4g=U+>BIXcD3`JyL-%0wSrIR&DBW)L~%v&6Q*j@ zgQX=l`_k0)+`iP$DO@OHUs<90W2G4_ggm1XlY+;un)4sovOHpbKh*K1SC*KoO1MHN z;)s(Wu0$6=QBIIn>u+SV^P4)u*`y*;1~;Ud0g=k^iStDP-Suu-ZbJ5z#oi1$SD2 ziHpvXBA$B9JJGzwnG#;`I8lXw-p`^X zjmMpVA}_%b$TpUTFp}#~xau((+$}{1U%BDn6r8+Obq3mmHAl=_9I%)!*Z|At z1Ztu2q!DsNGK!LXWP354hTwraDruk^X%h7`G-TKD!6{K4Q)g**qS-pqPf!6JGr&mm zAu)v^&mO8!{DY>9Ai-{x`jPzFKlY$2N5pRIQv9QH3E7T{9oa2LuZB&S5ptaU?_h}X zy}_G8ko@rVMM16- zT^-i1Cfo8XA+jOuW+Xe*c|BSka1DIp-vV%%>%l|crCBJUIswjLQVP>cfVk(u)|v~I z0)0RmFB!3T!&p#ev2Im6FBY+^HZqqB9kXSNGp+&|gMyJ*(jq3K>obB?)!vxqyu@NZ zrw=^Bkg)}qkEHE_2lziQLz=t|6Qc%MCKajf4647@xivKd5!Ecze$kcJjX0E|^=&w!T>sLS)!6Ulo)z@CGbrAN+~4CY!1s6s00xo)8t7>|6nQKe zpqd%(l5D?YK60=ETw2@cMm&kbGKmyS*WD3$c+X=G>zFVMy>|SZAR8dsE?%A8Spmff z*=SV*PDvYw(J@X7064a((Q_eHd)F?&-U=u>) z0q{--Vjf-8C{9@dnq_NQ_ygEhWKf9iRFZYnOC}t*Kx#-4hgP~MH$~%w+T-W6LXz`v zMRBg9(goIYjg8tJJ(UtX%iFJ7N2o}tKsXft898VKflnCn8<$PGp`R53u%Tj%f_Urk zWAH>=-+~=GH~aZ4zX&E89m@&7NCI*?`?*#p`mr`V@Y=^VuqW)vp#{1S!@D&;xq`9w z%F62ByS7mgDu5D$qn>*yxta!^}2e zkf(kRJ1yQBvWSvEooMYDthcyqPOcN^>HP&~p_%T6?s&_yNsTb%6IE&q=(f%{i2FrY zjVIC)X#uRkxfiJwm6}*b8+fAQa8I-X8ti#7z=t`GZc}l%`}RjJp0ve8V!1kTK@5ja zm5(@zCTGE#CAt_$ny5&stxaeQPP$y=(o3hylPW=Wl_vSQH9%z*h>m9om?sG4Z}r6< z!nA4dd*qJq{}jIq^beihX8V|A;0R&{J7mDqMQb73Rkr08pBfynGCmb-38#DF4Xr%) zIyWD@5~$lz3lp20@#dm2>@{&o12jKpdp%@K*-R|vitG_<<@4kQSnLs|?({u2AN zaSI1sM(y)rSF36ev}Rf%j9pdV+uY8EpUB)M?@@ZwOm3aY(Qi$`Q>$1kc-{ z8gX1yI{^=i?!+(t?PLBzT+E08PO8a`olJ0d|G0xC{Y4$)Hz_4lc$BN2R)cbp`@+zO zpL~gy@tRoQds8mVlSopU>4A~=H*l;qu(0@VQgq`fRjgq_q_yywYZo+lrfFDq@D|Eb zB9iwcdr8p;FX=O2rwX97%~TR<8H3=DrnBG>mkyq94e*es1_q+bF}>(=y6t)VuX6SZ zujyYmR_DD`!_Bd_Fb~QY`f0#xPuExKf8ywOZ-rAnJ4-B);G#rN1$F8PGMxSpgi$T< zwVfcA!r#EMlrN!1LuZV<=0TijapH*VFhYXBzzBrt!aDeJk^Uh+I-(4VvRU3{ohU*d zw?$GHK+J*X$FT3an#or_&qQ!l!Hns(Ci+AGqZcJpuhwSgDnW?03x` zJesKG$nyNkM-|y@L>H1pIah326?=swl0eMWI>_0va5nb^ShD&Sq`s(>9(-33?uHy!McG zP(bzzJ#PK+TGe}Z-YE}Q~ zG2NuL9Xk3l%gKI>HS{cG8AKhmQ z=%gsUdh=>s40zi1!v#+Y!hX`ai$e>)P4oriE0wc&a}dL-icBP6sowr6|8v#FsW=&8 zbvi{LV!RRqb+BN==sp*x{%H^UCc1R5E07QxTWD@OOYgq!Q$BVY<(Oy3P!Elx4n@0L z30-SXc}@UMGPopN=_%80`5V?i1M7d`durb=OQew%xW?CN{7*4mLdh65KfOO6Ty^Jv z3L!B!qO(?TG<99`L5)&@O@-UjieHN7?AkVC;n5O<0=OT)ZbO-8O6La}Nl-z<8uj<% zYQgJhpK`?g5wU9~xY*Ve)HqEwI_N6(1GDX13L zK4-soGJV+=pMFR28=)JarY);4Q+!8#43JK>k<&8W2mj$Y3Y??vDd08vf{NUz=K>4Q z+S#BDKR zih6BW(s0rQ!)S{oR>v$YJY(s9kgTe`c*cCLOhECrZN!1!XUN9r>!HmAc~*Sl_~TDF zd}!%7MHv8K_rLiQGNQ+_0K;Z0At`*Vd{Kdpp$@lI7KFOM{(lazCPbpdI z!(+BEyw{Civ$%HN#pTDdsH&U?~OAaNu{&>T8Tq|LiF~c$%F~)>*0x#OXe5# zQ!%(HhcorWeJE|!P{-!1165Xn<>3c8^>(_7U0Tc0ydCbD)u60EDZRVI{dZEc79 zwlP8M*o6Q|o`@YUe2>qsUxH;^*5+TJ#4w|RpZvbIuQ~D$Q!j=TYL}~Z7^_Ps2Ak^& zSnSapD_g3U0Tz6$SF) zrMP8&5Ke3Nv*AHQk*dj=K3b?}+;M+>1o^S5Vuh`dHI_qN?x{*RFC+-VSiB6ZXCkT* zDv+5y_a}Y9H@?i%=D){Su%Tx21<Uw z_1_zwWv!ozc&3F``$Ncb3K;eGUJ5AKIXL zF@o?qt)diKdwV0hbSCH>=>_$o?U;ywW+&x{8&vaWDL=Vwrlwk_*SaOv{$u8pNS)TF zAeI=4)U7;WZv=#L8_b~x5bpxhGJMGo!csh|gm`KUMMm}fharB!vl`bwPh}(Bn}?sj z=Muo$=h!YeNv&}3sVHPt!&~%3u)&zrB~A&c(;pA5N1*5+k?;0%^!%riTl^edKTK!W z^k3oH-Dvp^lP|W!VN=JkkWqFWKNmVBgLq{EFK>zhfJM2^#-JYL6(cu6QltzRE`e6f zZ+5bk^JM?4R!tUV;_ftY!n3W?ZerXM*zq;ZeA*LEr?oNK&DQ%mC}-Lc2fXK1vfoN| z0Wv?s_TMN?;(QDXec9tITA!sS?}(2CC|8!_)i6izO?m!O6>;25(u(&=Pu13+gx0Xp z3Wg(c%?1f5b7fX~XVV~`xRP?E3FJ;`4o8K81~`;J-EGDvgYs;WW*BI{R*-T0HCpvs z(;fBDQkhKnvv5oNevo;GgcT)AsO0l39LJ`c;ufu++V7U)c4(uwfva4-5{&?Mhytaj zH#SA!s`mW2f`%xotnVnBR)oxLCvVEvF{8-rb=OI ztX}2wfa0WI2*lNB55q=8PA_lxfow3voF})?U+)AHg?y6*m9+xo?LaF{6XTYYC~-Qo zaY~@z7Kw*n>@YVVDaH80k%};#!KSNvog&osFRo8LU8c;~&P29iw(eS?ugy@R6Oz^D z$V@Ha^~`1S#^yHNFv6e|o1NszgInv6#E|Xp7umq-_>Kcpst@M^beiyM3orG0ko>YX zJiAGjO9##-AmB>_E`W9`Ib*l)Bgn#GY+u8o08CEvr;Yr|3U zKJ^1(a=)1`4t3*2NX0;DY-0SCLwWAr)OW?z%)*CZ+z{6pQQub~hOS~0X6@U(sFp`_ zojA*bFd+8jl?*plve3lT0H8emHnrW5)En4T9j6{7?B zgjTUKVlJbi1Oi7i$o?w(ewnKYUlOuBS2b?!Mhx%Kvl^pGpom)LQ26-U`<-2h%;v@F zzd=Jl%;rIed@e$t;VrCvALIRRzEnj2)dq$kYSMUO{@g~sgr@rEuP z<84OvK{&PXX-UmF{cT;{%wMs|82nir!i1x5*2YE}Y(vmt6{D%&dbslL_i0qhZJdS! zTDhyH(;^Q8AhVzeP6}!~YjjP)4xzWBl!+0+N8}otxzIV>ZKfVN{HWq{DyUi%=R(_T zAT@0t9l)?MSc|I5*|%&AT-T+i131yEDKm3(VgWhH;lCG?8mqEboPjE7h&A(YG){HS zOgX*_bsMl4I;}5sA*sN9kzYX`xuu!R$@!$-X^4`cx{Lw++d|khBE65U&`YEG&!=<36 zHiva+u^S18>`muO-myItMwV@XSBkugMg0ruP>};sF0t8Ksr3h;`k+!c{}&Z1xPoh0 z238>WUIFQgV;R8!XEmRQc^i;QEBXv9LY~bcIfsW zHM`kQ+n|%6A+kQ}`E6MJEy@oHmE4j$cMrTJ(UU-V)cyWg|70xpOFxx zh{f>^gNa6G;s6~dW}Yzs)?e6Un$Z$Mmt?5 z^^=6@*WtSZ7FL}jq?LffW1fH?QE*J$MAx*^IUBTbA>#5nVlZyu- z=8wAO^!RSbATe2q+WB?B@3 z3TU^^q}(1G!*-7nVA4{W4w%n?#Tu%9UZxWkI3Htk?Usyu%Uxk?S>{xQl$~ zSh!Ww3D($jzu$9Jc4F`DXVCTEfqxi*=Wt37<&`P8ZtTB)kQ(@>*M-!;`t)d)?tH!m zoh02|K5Xq>LOIOt&aLjY?Hsm`2lbETO~qQLIU<9V3kGc$;!7w^o%TOor#-lP`_s;- z@f$M^W498~zOqm*gM|d`^f)4@Fbo^~&W0(X(tI-e#bY%K+VcXc<*`tWcd#`5%$2Ck zQkdLd9y@h{vSC>vwnrqQgz&$=$FUT;+o8jE@X~BXur?Gr;~qd(FrB|gIaBT`=_LS3 z)C@WzNKrO8Ysz=g%FN*5I{K!@5=c*;EeilF1jnCd2WHC( zXpR@!HeSEhUEdA;;@Qqjvt#}1B&hRY1RDtp#`;Z z%oYu{LdItDN8%CmK8T4DB)0#lZaXKveUV>cB7@ck#Fr^aMoN~WOH-2pgYCx+a>X~R zp#U|C_m(K)S1T{%m`}}vOhg&$`fuu-x81L2)q8XML^Pa2DoD|FE|Q58emf?j6^0ZD z5w%&}jRbQLQeF@wsuc|-j%y}ocWK`V6(z1fs$MXDQ$j%K6*}DZSyJt0N-~x+4I~^B zW^z-xU*oOBsQh|M`1O{w@0K(({9|~?b_8%Qz#5B|Ml_REDt{80AblB+%lP&g=6dn2 zCG4aFu7+cv9bq{4kwGdgyo0Ko$aEk2`Z&k^i;)ov^127`pq0UruintFgMJ?0M!|VA z`t-A#0%|u^n4%~fmTjJ&X(R^4;|F&26;){U;(LjBE#?Rh~3c^c)b>8DTCK)-1f8$WcXpPsqw zuh1F><=rq)gD~2E+;!ciyW$iUR}Ch!s0R!7l`e3gz$KNpf>~t>iCg8s2r+IB3QgVQ^wEXivwR6UxwNnhUY-;-;gq(!4S` z6jd)vX9OUSgr>5AUv}1)ia)OpcCK783pH^liKF0RiM&sm3`iJsCF8ynNPl`1pmbkB zP;nY{shK{<6-s7!v4=$8F_&N`SES0wz`ZwUnZ?y| zSnXTnOD!cUP1Oz=TF-h%9NTrcPTy#vc8iY^I761NHqX)6L<;k8E}v&3fN=d5S(?uM z^5&u~?sdKc)(X*m&nRVKF3?|?O=k(vQ-xH>IA+Pd;#+4+*o*z z9)gT7uR0CW29*sSXfWJ$wx+w_tw&gX#+LfOKSG!*Vj-_SZV4W&MY=xzM}&;o&3e(5 zGF@HAgDpC_vW4taR$BG8432SfSu9bTwEau;EE{M#b6Vw@UaDq^DsM+=4#8j`tvU{` zf@&rQymm4eNJ413mWOu>{`?Al^Kz8Pp%bURWloU~*mEoWV7M$6c+9Ywg&*wP>;3H6 z*k!=xKO`uLF=jxuq}cb>;n%TkPtdL&Ycj%7_FQloCObzRaBps4p^eVJWQ_^;5FP*1 z8LClLm`_@?cKxy|UJ7Q#BHp@J#E-*o;W24G&%bvQ>X8y~Tp6b9%S$_o3YuRzCqcPh zM5XdSGx;iT(9_mohW^4_{U;}+MT{_&%^cl8sNGshI9CKO6lm|B$h5~I%78;`^9)`P^&Ql| zaF%AmMl5ds!|umjGWojmUDkS3iIlqBwvo45$e+!fE56;fCH411^^Ik6Tcq_O)pjgH z-`bW4b5(Vv-_aRfjr)m6-m%?}2czuXkW{o%95j&Bm`zlb&lK@{@J#8ysyn;Q3sID*`zE^as{}tA#x$atvISLX zhn%_OSgS7_mmj&JJ2EZ*rgVe-v@5*2cTS*e`XVt#G!PCxP7B>W3~H%@NxrT=_NUW@X!d8$p85{M{p@NwSIX~4xN1BFq3WMBM<3|D&4+WBP!q-@cNp~@GIB?N!Zt-VsS#N@A zCJ}Rw^m_W%p}f#x>rz*l!|blmbC4qX6LRv8kH7BPw)H8meQ_l%t7?@GP28BNgE5F& zKz0c9S*cYr=h^bx3F!?cG@G8;%Zj93u7#TnD7P6Y0kcD?@>p+x#-_1hzn^ZkT+H`Vu1OGs((^Y!u%gk=NMM$`-bb>%C>ErlWp6!HPvL> ztuWcvWKXs|*}q&9r@i{`WACqZtZ!?*@AKT(eVymkjp_`Pd$7Yib2H08hydv$6E z^%URllzvH&aWI(HH}UxCtXYB{SqS1SQa2s=)hvE6p(U%kASTaoZ3bEprYvOmGcllv zIKvqaLZLbm6KB4E$$r0I_u!y~HpqD7`DxDZR~zj0#$ngBJ2*8Y zm}!Neh}Zd2B~JG)bb>&dN#N_^&wsnH-%e|D+cLnTsr!jOZKK5+bhRDmRV1(VVe=)! zP}gHNEM1??WK4$D=MNvh{X6*fsz+jMI%d`&KkyRp=Wjs1>M?Hub04`Mh(`{hmX?hN z3<=mlj(bP&R_r9W7_V(+V?t0zlx=d*b8jQBZ%P|Vu=H7BO6OwcsekUG`~&-F{`S_) zv*i++Q#oh@Y`=~{g-3JR=d`{|(K$D`)6X!Q6iAhv@~6Y@xVGE=*TT!xMm%}^Ruf!` z{vi6gI*hysMbYS?N2WDc|FKd3!dIMi-^qbA6|(!Hr!4Bj4r?W9!{^v&md1+Sko4tw z-jF94f!GLDEMkU8^^?R{OYM(O1c@7wAkq2odoaB1ZfWFi88{vF0p)(H+n0!P@ z@As7H`TBRc+5C#!g&U%}w6{9J9O^Oz9cq>cLnwDCq+ye(Ilp-<@$)(H?Hhjrju&u{ za+FSAtgYu)aCSzAQ_rIothCf*Xo~p@8hXdn&NZ!x%$m@ndr1e3ZKO zefUvhx}5I%_xJbT?s|;Wh>%@&ijf*Uy1!t*`f;u#3=U9WS~gx%X-A(oD4%m9QsvG6 zE{s3@BAXj~DGU52^>@_#w_?5@F&LkSKw0l(2?5^Qtc$0~MY? zq`D~E!SR#rrOqFf>NbDo!KiZM{L$EGSI=Ahs(A29RNq_*uo5}+VuAC*!f>s zr7L-(7Evv3Q!EDQacC+6Y-Ga%nUu*Rby5}ZZDnA^5_9i1q|N5r?spIj&wlcx>q0W^ zi796F>Y--WCOW{9EMTdc1WTMTYcnx~^&FqYBK=0#9^+!zDkH)emgoX<;7iw^B68m2U zf-H90{&KV!47LDiE4&%9=%)POFZ)?3Jsfj!GugN$FEbCw|U>L?%hM!p@}?+{5T@NU@|tkihb!G0LY9@wu0hm^j4j>>!W&^{`%kf-gP zBC~ORxbIPQa$`5^5*mE?m4ALyB(22s_nV^>0KC56fP7$DVM5^Ro9+*tx2d+bq9qx9 zR~K{Zaiqw`@CE#4FiMO6QQ4CwO?H|6cf|T#wSu5-=3|EpUNZ$6l?iZeKp`6!J?W~E zr)xEnU?ehS&+PQZ8=%w!<5OHgFs%cSuYHXZ9UkWA2U zzXtDH3+N@x6CTGbulnD)ySdInS=bwr@nR){w5{RG&E;WUPD8o~?TKpR@}v5<8M*Kc$h# zs*_MSRO(PtQp;+rlW#fI)EHs%w>2uvPGQ-_TJ_gmLVG3vcU@gNUJXlLKF{GeU2ezt zII%JQkG+;KR;~b9`Ycj7oWGATM&J_n8U+Ivc?aS> zOZd-C?@HS5c$@V4_#Avyx0`{9Bu8jyEQ!2^LEm&~-NIF5P|SkPuQ zw-T*-b9hWmJP4yEU!Jo+NXveQ5~yxVdX4CzA%<#FT6fNs_p*Z;o60S2lcPF*u$v>D z$(N7@XnrJA8uaU^Aq7lzQXP22j(0LN?&<_vO<;*GM7Pme+B93?V<;s=u59mPHdQy2 zoXf9yg)wtcMH#M3762}5vkdtn(2{~I zFxEvK5mYmSD5KQS#g5VOY)hxyC{AY2p=dJAE1wFA_xYHJthiUWN&jN zWy&l#A5&yIIu9Jq)KbA3BPeB2gsG{bJftKLDtFAdR^o}MIv4nc4#M2C%0h9${A|ls zoFc^);+ual)dWtWZ+P6risZ<_CsyTWkuJc|`!K?wfDx7jRES*Q%eLgf>GfFLpq<<&=+;zCdIaolfwV3jj(rzwLdgs3#K26U$8J@Es8$xNw5yBLlVn25ml znudhppqNze-0g(IJ-aOTVVB}lylH?!Zm0$u5j_NDr5!(_20oX>bcpQQ#35#xozqd!IFS-HaDr>^!MUDJmZ@=xy04@>_6)wO0oqypTkjq`TQBVZcK~{%4-BY59Qd>eTK(#FgtD~hpzxV>JVcf!O{f&wl=@FC*`9m3oXwXcE zi4Vly30+_g?6?Ai0FCfxBileS5vmu(bq5nxXA}5gKAfQ@k*p>+m zfPy5g4^*6-r7Pi5{*h3F2f=0P&j~yJ=F?5hJ#B&`GDQ|A7rJ54tSJP^6FtHnLu%k| zoYZ+^S_~DmkEhql>;yEH1GvBz=F|0Kp4^0iL|nymczW)&bM+=6qKWJitCaR_U`0qJ z{>F`2BJ?%d>?N@|qQA=v&0l?6OPRzge4Kg5L7d)>{b>V!Ruo+&0`2SRTZYrd1V8XC~xpw;YlZ!t` z6mXQ6@m+|*(}-uwq<}g69uBNzU^7QMA3;|KQ}JdDt&+6>G$VlpXoTMdVTt#14wWHb zZ?Z1p`{5Pl*QP>iXrquW&px?I-LUvH^BQV!Gb>#u!|w(Fi2X- z_(C_}P`PC9!|r!m-a*LwfJi3Qu7c8rCZ5z1WEeLLm1M+$z$+1z=qC{A5r z#*EiPZDWyvo!LUBf<*-+zUiW9Db7YA+$HbL<&IpB9qjm zBpvFIeYP(%i`!n8`WQ75@f29qs!GMKtDyB5etf7^yh6#7WAbZy&23Ju!_C>-@V_lf z3xU*qnc!&i@+%Z!x>z5@?)T&dd& z;tCbbpe?S=Y1qJO*w{mBcPc&6CJ8ra!#e<;ubGN>8SuGTkZVcDMP%7Zruap^8e~Z& z_>tbMNpL6qv9yBwB?<5~LZ%SM23qr3*a0JZ5HX^+91Kl29Siaoqf5w^Yvkb1jAH z6?74lXbU`v{=f9EE$&M_KTUIOU$-Ga1Jy8<;&fLe`l0c5!}3*@*bn$o=TthfvP??y zK2D(yS~+Be>`;=F_~=dU%ek-|q$h`v+K<u?)G1Mf4EuAr97@ogyGPcM^w21xN~$vV<2()WUakBeH@!>oZ|ql z7@6>o>Gm=G|5p5ax^2c#%arRU-QVm`;KE(hsI>gc?NIim8Z&TPM@ZQ$9LQX_W8sQY z50d6=p&^P*78D`NXbO9-*P9$dGUO^WqtHgAabwNx`fc>?{gSSJ|7GYM)GJlFxs@~; z?`%A>Fl z$M|(|3rs?o?2e$uJ|TUfB7qs7soR~7-P1*m9Hn*zRSGw7Erh0%b?J4BeGd;0jWShB z54`YmddfCN&H!Vyqi~;Fvmd$N&C^usaGra%x?lftFZ`lG`*6nfT{+(KNmlYZ4J%ho zli4EHxztb`*;M--AJ~v8yVn18;t`{<-DJZ3S17L^r5Iw1o5C5BUtQk|M7RF)&l%en zVj%TsTz#zNG`WRBY#9+hP~-Qt=kxF4or592V0ws}H)FH#v6XPtH6u-V1vr=rWNgYx zc2ts?VliGn1t_4~JuZ0d_nsZ&iyw_I{|p_-8dsH)tS^1x3YE$?oL@c!n5&-cy_RLjT|b8Mbk?LStD+zsl!PF=3yuWUS}(Jla6}Tr z664QDW9MhC!+W_=OAdjr~|Mhe|p&c*I}1k~wgesN|JDC)2qHsjo%|oGGp7OY!SoFq7Z19I#;j0Renr`Q5w#`U_9AVwzks1LWufxiq{Q ze&Rg^ofUFh6T1$Rgl>`zk)Ye)VT&lRK2#&x$)gZH6Dcx`(|zpJP~^;&X3fqB)RLGV zKTJCG;>DmEczN3~@+Cu56pF?m8i7DXDA(Ml~wU9t2vi&nq>6lK1*Tg(TG@r7eXSv&7kl35?!+Q(2z?H<%hj`BC8#{D(8~b z@QCeZ0|RbdHIUDBm)#cw3Z`$afZG*fFh;i+{AUAMM5tX_NX4WMOJI{A@%KwM1$L=< zI2xY>6=WmIt{2!7$6wnc-Vln|Y(2X##wcNuj1Eh6ipIBbFJlymybDKkLjB79t5QT| zwmI+FKVPzq-$4zsB9On6Z>rw{$k-wh{6X{Mj^>Lgd$o0DoR(c?A);B7={X}fr5G&{5sMHdX6?OjKEzioTkrAt8+u|0ajEc(g4J^xNyTob)>o@ zsD*K&+roh+PN+px#X)9r=ZL?3?FEA@ZDF$fFs^fWfQaDCwV=2H^_mQ$XJt<<(869s z1wyj&!OWI0pY?XmSoh8!Cg15{6IL{+8ZT|OFhdrjC70`-zkV+3D~~ zL3}Whx}A?J@5vhz`SLUZ<}Bu^%$`fjnLlP1K&mZFOjs}3s@tNA6`&nlU)%T#83rG`}xB^iX#XNox<*yUw)4;1v4nwc!O^&+d_kx zg@DNvDmlL`tWdcsDycnR^{oFS{!vMZN74*6S4R*EQdf|V<4{v7mI>&!DyP*PIq{%8 zOYS@!+bry$%51n_8#EqVKSEohyM=HR>hc$m)dFQh#+!bu!bZPY!aJPf>s@fae>w37bTp#{Crdend4 zzQ`rre)_(cv*Q7J51{vJtQ2LsiKBKxRi&>CqV|+c^%IhaKRXQ6=-`sqmxa-@`=u)$ zMx0unx{+w+oK{M7 zZIncC2|AHt3e(8e&=@pFTu9MLZE{|Bw!T$BdI*z>NvH9|6t3_`t=SLlL3S2Re>kIc z5+pFBntS9R_WC`?qAZ(1&Kte>GI)&X3jqGu0VN`nkl$IkC@p8P=Q2ZWDo>IaVL6W~ zd3MUa?O&!DKLlaZu-de&ya?$_x0pcCJxic8fHSv^WCy$q)jZj)jgTVFl0VGPmK7cr zkyBQ2FhTvYOoBz$y`|jA6HGHyl!H7REb86p?>^1Bfk`9p+@BV9Q8KIP2!me!)qeLM zGe7(efspnzX9!$&jBB}WlhcE^KXQ5%9rvT@mJDEmbecog2m3L5$^`b(l4u-y6~Nu$ zTqK5X;>opcQh&tQS3`)6VI{c0b2}Y}F#EV*LKw^~9f8NK(Dz!sizd+Jr|pu;At1KO z=nQzj*yzdF+}S15X`Ked8dqQYGnrJ9Jh$bWS5Pbkd5(=~3IrTTAOeC{?5c)j{Bbu>;|STc>U< zlT5BAm?7-HZdR)hZU(>pm-V*$(jhTC#STJ z&?^2*zZnF?#laX-?b4h3Ju%F#{HV7 z3NPsBZtXtK8tD#tyS`oBfxxnq7?}HWCQ;j`y0d;6*Ny?RYg%EpGH=*jz~B;i3`E72 z+70irUJT4?G1UsXTfsjdP=J53A|IRo@1*jAD5F47CE*wZpsYrL+N8O%&pdg`R4sLZ>yD|F0d7w~4hkOHj+wbQKf19`2;+#PNS^XjzOvLOINq zqdXQ{Ert;wGW9vW*%=o#8$RniJcPs45v{-a5O&~SBB9g+UxLrq>crDI^xc|z-7V?N zQ^G#};IC;wKIu8RSrmOWk>F|q4QT0S7QZp;?3`+l3Xu~WcZsutVGlMD47bJAVBl6G znkGun4^1hhmM0PSB@^{aL1=>^)N|MNNxMgY!f(r(QL-`0tt=U8Cqyu_2qLCJQjZm@ zOJUKPrHwhW_zWOSQExPHt|khGS_De#K=>h2108wql@XPYH-%t6(c$`>S1M!h6d#vW6!c(>PzvoIj-f?=g?a z0<98WRq%2Ru1xa=ZRJm1m?&z z(xiA)yGSKjRO?^cSMV<`b#?O+vm&dX6a>p zkm~Ok)g6MEW3&$#dR@eGu!M$~AkiPk96wzxK0#{+-*X6)G~kE=!TzL2kl~<{n z5HoqqUef)ufltl6NlCe~!HajjSDhDvth>I7pYD4f*FXAZZ)BU+fIJg@fx98b_H6Mo zFVu+dR2-cEmdLpp-Gz!L)%z8FXU`6*wi-jTvY~;E;+N-{H0m+cRyZ>V!B{yQ6X9;Q zlUw7!mx2p2L*RCeqDf^&4yQnkxu4x1*l#3)@Ja*2k*R@0#8yJC3G9F_M|=uyn`jr*&|yjJ=7w zn>>-3Gi>30!uO5RTd7n!ZCAU=5|eE+=neIey_V;Cqz;MEQL0w#tuI0J&^_s{R65L4 zG-eJ<4}veezue1e;`-+nlA98jD6)0g2-<*RY+UEt5p$FPL&S4-xMG5F8dRK{zDZZX zn`|4oK9@LOQ;W1c#0Ib8%`lScNKfcVJAgTkw z{kJs)0$y97ZO5|_3=bTH)tDnBDH5U@TjMr+=Sfv6GgHXsI?Ldq2a^swWjqFCYxwNQ zI+(Az@0AQgcDoQ*GF^fodbC6LbzXsWrb{TH2 z303HDjeaE@Uadn2xNsg3*GFn&*ybY!UuHkv{^nE5;mm zk%cL9lEN*Lv00*50nY|b(#u`F%Am%!n)yH`{0^;GJSg#wO?p`kg__E)ZKdrb^zfjb z4sVYM3fErNC2X}N9=FJYg?c=W(ow1C>h%Fr8^SJJdYG4)^iFt{Res$ZZC)71dWji& z4yMktmTUFUUhXei7*U_UhKrzN9BbdMwnEZDNY4c7_lUCTaoVwLYUPpqNOSFCShk79 z5#5a&du}`6Rh62h`Qn9*4h#N35;H9R1(b9_2Dt2|Wfk9Y#uVLE!7^Wp#RY_b+Q{7a3Dj=Y0Qj9ja(M)`io(e zG$+`E6iP3wXsL9D1ZgIV!eI?PA&$A9n<)R6$8c<#D{x+2T89<379LW7yvFv_P2XIY zYnpr!9tV7EnwLjlj4WqZOfQX!6md_uQ-q4&?y$WRSaFC|Op z!f0Deyy+yu=+y^thz>E+RluO9M#Y}Bw~b1G3zZ3(u4ELLI5a^nd5{*=Xn$*L)O%@~ zQYlzDi5^a-kKVbR>6zZp=pMw4usOzv>jmbL%_7;Ig~@Rg{)`zyKHowK>!0wbaz9W; zjST~lek+49ZLhULI0~*TYZY+`%35X!g11#4yUAYfFq61=y`Iy^qUF`7MEPb!&YaUX zXQ{ny<&ixZlu|%=K^m`lsp-1K5e|q*N*k3nfb)}+8{)SpzW05Oi09t|yT0Y9p~htW zTwz9B!FcS$YUzzb#^^)F@GQ{C;^Gjvh)r}}$e{OAs>iRT8$u!D1veWL5v%#pcsWpzzR9?k za>&ZnCI2fS_SHR3p^}6#ZdT}|!b_j8>Z9DJV_~4ObPe)_>rIQN=qv7vB8FbzgzLr6 z0%h`8fOLx`MN4aGbt@J&`s+B!HLHyi*9IK)K{!|u;E;_CHHGKRU)#q?JG^qGD zM1d#E3dCe(1;0U?lwbO2m?}d^M-AQ^hnhA0o1s(mc$Ww3;Fxhlh1+uCb$=MmAiD|} zsWaKj$R9>d=#iLiW%C67^|1`Jz+kXoOrx+0c?z z2ru(MC)|5lTvl(N(nyP2I(F%hR3+FWWu{*(0{qpxpkBT^6k2d&?r`xTa@*u_{c!FDfgzXzAk`)&R5)l5WAY0?a^V5 zK7oC0!ISO80$B?`epl=eo)JB9d7|lQ6wHL%+ir;N*Tsly#%dB1Dp8|tMe+|P{PYQ> z;t9PlqRJPp*|rI*Qq++q$1q-`oXy-iCew*{gs2U1c4h1UlkgSo77cmyzgP<2Y=A2* zep1V{fDQZhHVZ2;=%Ufbcx#W&GW+Y#y_i3vPo%B2)-RKJG1K;!-yVbyaRtHu)Y0}2 z$5Z`A^T?P}1z;Z=HJK}@OokA=q>W>iZ62P` z@!MOg5;w8L#Jb-o%@YoPqb<>oz!cN1Kt)HB!{w;lOM>Hqd9vdfnqj*`BJn^eO%SB` z^ZkTrrT}DBn&r7oGnRSjs>`IfDZJ)L&qp<kgw$U&V$-4rO9qOEpcrMdXso)I%e@lK!_0fxB6Rjk_3&uuQ&MaJ2?SoPlfyv6ig z&WsYVf|i6{73r1zEte?-P0LMGf50}2t+Xx0nU82~_MJQe@BCGH+mD;-={U)77m{zR zZ~_%XJ4C=U4Swi_#f(G@bO@)BF4;3DRB8<6^%am%k(T``-H!z&tl$4!{ih#@|JI!` zrko>sBp?$~An$s4@19!v#tC4&>6}XFstSbt4^H0OF3%W=#zAwAwV2rh-Fnw61TJWg zE@&{;oc=>(Qy?YIGo^tV4)f)|4d#kpp$WW)z@bhZHYgDvR5@3ZZQ$jx5I%;(Xn^>f zsXcUzAT{zwzq%4wgBE)@q?_?8`oWY3tiTExVwR*C(jp?kg_Ulqz_A{VRbt>d`-%jB zcke+ZL>bpT`W@X>Z8;9o0ZlCAfT`-L7>8MrMyV&pSk$(2Uu1cb%kZ=TuB*&wX1~8u zwy?}s!knJ-5YxD5+UmY~{gSlo&_ru#uIhJ~lI5`1Ff#-WX7KhxM}bR#E}Zg+v_?s@ z`{8ch#7 zb^^z{B|86e#0Y;02~EGXYjp1GB;uboFp+1Ola zXgwp|8U8J6HNWJM(jd|EZ^gXq*S1#;4bTs|2y^1EnpML6H;Zg7=}pFQ1b+ya8skf@N%tmF+-Gx8Ax z1kBODQAQv=Hkm09v6q}0yCmp>3tGEw$CAK={U$VC1@Qr|AH9hFrUiuHE3{zB2V${D zDSESdDz0Nj4N-v2-8{2$@WwU(MNTx>{ouM>{7=uD30Hvu2?erl!H1xUIpPC2T@vqG z$nZCR*>t^{SA|m3Vzv? z!X(zbT3x|y4>$Q&l-_7r0RJNphM7J7>!eK@ot82| zjS<{h=0OoItL8-MW0_8NmpK&4seRQ3P(ptc4G!yiV zY&r(q00NLfEP46c4Z@S+mJ94+oL1f|+>rVV-!6_llasmoDQjVM`fnuy_N3NJH<1|K zmiMF^abPAPo%7IGVI3Noj*nlfgC{JWs$vTl>%I~-ka*?1_C^2WNri)kTFoG0RrDC{ z?`RlL8$$E{qMSH82h`J^lzgk}NtZp0+^4y|-BEnIWBPN))aGkXJzeY-f3s5rN@DU5 z893|L^)PmJ4)fL-8yrE+}VoZjts^woZs4< zG1LN0@sV#t!~F=@NThRzqindfr&hS{F^b>+yK4o zxkV)~L49@JKNq($lwcxDHpJ8zI|!WG_c~?+m}NeH_6U45axq+dk{sM$ix+j=(Ta;&^ z=YN6qRXhe;mp#==dFq}@KkGIw2C6Q4S6b_AYaewldjIx#cX-5IT-bEQ3-sY<5C={a zp1Feb9sCXOrmM#@(};ukxoONoc$pbfHg>I56jE*vh%^vCoe{aTr{M$jNcDb`_bhSu zetE^+f4&)f<|h6`x2)x(qvyo*#DHN33o94;&o(2)WRy^7!XO`VK)Ed!TIeXf;!EwM zl)IH-8h9s)8TBQ>oAsS>M?@0V0W&TO2zU_>$`bnr(yVNKl|jBE7PfZrijD_SuX8|6 zkqslDl6J4qCWPMh>{6OD+k{eDs|Z|q@~$D^xvHzLLpc(8{9@JAq9ymOZ)LZu}=jLIDvaOf?!X@ z7la&~Fn~gr*^UA0Kd)+0ZHa9hd`Ez!T9}#q!!46yEW@`eDfbsGb>hG;4soo}Ls4SD zrFno8@uHxpNB-N{&wsXeUJ?RS({26nz{Ct)0DHfwR{+t(r|4MNJ(Sq9U9HzcK5;xG zXgR;M(Iw(oFi$w_@&4?e>#1d?A$6p~vSpa`axw-YmYyna`RgA^B^0wmf=J0Uf^&+N ze8b2Rz;Uj`_HWs6g{I#Oty)f7k9FSZ*}cQm-^y}F-DX;WW0$$#R3Z)yQqBKGV<%&PZO8xFJ0Emtp*DYbHKOlAHxgqWle54SmRxFF*_*SU}LJ^bYZ5v`HpTM94HdBd6$SPJWD5OG;4RhR_Vcd;KTp^2vW>wzl;vdCRtd7;( zGMO{_QWM0Bs_Bt!gmQ>ULt*VY*Z#!_VjhRLm6%y;auS^+7s1FFT@!67trE%<2vc z4LqbMf7Cn?+GL%nr|(lBWb@0{e3w$u=ABR*ZP*L%kKC@>iKz{;OK2+Kb(^639Hd)1 zlQ-TN81x%vgi>k~vTpfZAKL z`ZJUYrfhx>V|!WC@ADBAI7Pp8FfIspCL=BX_MG00=kBM%n_=6=X8zK%OoR*5+c{LX z+2tQ!$#Xy`w7tIB5aRyU%3WN8yfG#MDTjG1ktX@9+_#F-!p=nIM;CQxkcH&>GMtU4 z|GfM?yyM83qah{uKf@V0F{KHrEpTk%YG_&&n7RQXE}0M~;M|cILxmcoD4`FO#~5ip z9_0dj1FeG5Xbx(G#6agDQWwRa0(xyMVmJM6Qk~${5UL2gpPv>o@G9L6U5n|gzln8l z4kYw4Jjm*U+#b}dSb#qTRcWpBQaj!Cy`dMWPT*W1f3OJMdXimJPW&kS4#V#W8hlWM zpt|5otgsp4^AaR7#YAk8vhe91iiE8o{&x+>z*&vubgF3@r6elLn71{gyw~)v?Rn-8 z)n^jt1)q5X_4t#s9W(>^6rMrZ_(2VBDR^X-9%gGyRQIHI-|O<1XE0vlUXfw?%pwh> zC5W(W^$n7xD^+hr&F_oT5W z%I;8wSpDp#sYH-fv?@#Dps|Bz`yJ&ZVrj%+r3eV{Bok3chRS?MT`eid3_lq$bd`(U zMFGZL*#*BDqG0nfKGP? z)e0_4_XKZg_-YcP-86-!n#m=qo-@IFXDzOT{@o`2wF-aZDYm*^_0ZZ_38!(Mq?Yw6 zUMBtbm9s2s8~>Nt_H6RZUvR3a`@~Q0hfdq+ys0bn!sO_AHNHvx4iXzaA}0?kG|c>< z-UJ!_RQ_C_;YutFQjWvN?wd`5T$6^fB;s!>`YE;ev44B61L}Xc$SEA_*QO-i2*<6W zFzzAey(t{S*`2)zd&B}XK;AQwmJok~nbf4zpD=?TYhOyTFI8~&e=?ce5i=_*F$8H0 zSyEeXGCRN6@IW^rgEq^N3-Cn$LyGK?!v&qhHG8Y8BZAhZOsweAxtx0A=Rq8WZdIlG zxt(ONW+Rkck+1c)p-jk4zntLaiT0n={^k~N)Am)S98uJIcOMY3VkSUJ@2yo3 z{+{c0OL4hti}ZDuPdzau`8bs}t)nfV$7{U#d2gh3KRlnkoS|;a73flv&`*cb1&S}& zPUH5vgnTYQt{zZ20m&d01+GVEV8~|-qqUAC2r`l7}=b*G5em!~KfW5eT z(cw7D87TK?VO|`O_0piAL`d-ds@8-~fb&ySfc&kIiO1^Uv=@EeRBUr}^PSNBO~#Fs zq(*d{ZBI0wZgoJ?MsMEj5p;;95Qg#nx@&@#gie%F7wP}ae!eSDD9V%RrvrYwu8fKf z``7(1 zi~^fZ1s;Xabdax%>}JO@#Vci&zl5ATy|?jqXF&-RMy;9((X7{=_1|T$i-{jA<||u6 zLUI44ti}G3iLQgAV@84a>OuaJ?TigbllV^YjyLNAQ*x9ZW>Xq`GEdP>)rQAw0yE3N(VW zbZ^d|PtM3kln78WQc!>G`ibHbvsR)$?6m~rl9^}C=Q{L+=XsHvoDdJYQJ+@ZIEAhp zDIE^O&RRNNQHpwbL$Dc(yF`CfHzDw!cKzjz+AfXDP0OIdAnGd{Uyhl2>2)ZoDsPAq zE-{RRbQfo9eFw{EE)GpgjXAMvV(M`d&>DGgX(Bd$(gtK^jdOCtjTM6Xf!cwi2B7O) znPROv342RGCr_7^&fgSFVZ7SIZ9m;CMZV0zWPbPjUr@P^-#`VbcE@HIB5)=(bZY9G7oK}Hs~0J*B|wgXh(Hn1 z4tYiO?+a(u@jpM`Prw=XN{@Ryh{K$Lts1|tT-k%%l$KS;Qur`LkhwaLi1Q9aa`D=+ z%!XH@M;f=-EePXris3WMa7iUoY4)?G#-n=$Nvzw3xk049;GE0()ph>P^lx{FU_>|I z7I`v32pi3jK`8AukB2Z5nJBgMbXKS}3c4~3Ex6F4Gp2e;7 zU!XITQu(jt`~-Sy_vMj<#Nur*CQXl;qt#%cW0e)@TPvmFjA^F>&=kl=OcnS%MB+6R zdhLi!7(v}n)?yUY@rlGMGKXb6d+L%}}eAOW27Sg+VM^kF<+g1`F=x zF~7l-n{JjdNSNY>Hn(AxiP|5I0{@WCldX-K70HqTN9E>JgO+=eqe_f{=nCW4Ff&Uo z)NSZnmPBki$PCT&Q>pHjY5>-NP+Vu1jey8=*mMguY7TSYPPDtlG-1X@d_8xRCO6JC ztu%QHeG`#T5OTBle8Amvi_#RY0K9kr7XJzo-vxVX4Skppo`V1UH+VRJ7guD{_CX9| zqz?{3=P(`kE$V%WM8x(RWIdqK{;0M>Hm1cywsXl)w0da2hn(C1!|b#tZ1qLgG~}CO zBd;J`e3Ko9-nFMs!diL_$8?gsoh9`Vb^oP!B#(C-mrU9~ia0?tv>B~X#1}~a{>xY( z9Q^py_Sclqo)L*%j=>&%Ay>8jMmoq%abo6SgNe%*c$#WV^27UVWT?foR5wgktA5^H z9ql;1Vwz$6mXG(Z%M=e3%6*lj-qRL=Ief|Zx-X!7^5Ha#cszM?(83b*OSak*7}Aw6 zzo@wDC%kwcxA_GW#KT2{0Ip?85e7=ws2r-OxTSbHnKUhPVhC(#cw|3X28VTze2 zS7ke2*lF)iM|w6gfxg3`7AD^{gk&-j$`xE-MCn5ip@PvcVM2n@L@2?KmR;qfd&HQl z%$T8_Qfgdt%>9pbHglL<&iv<(a+p$w=D1}Qi4+Xmmd8V{VBx~%J=rFB?ous&#VbC! z1@UZdpx&A$Z*BXPSq?qigggiJO!Y}`D_Zf5}pS4|R zd`yvNzJ(_38+M|dE*(D?#xT$RKQx_#cbwh(^<&#M8>>-c+qP{rMkkHYXfmr^w)5v*Tv9!SF{2$SfZORO996W!ioukUes}%V4kZ$BDLdRx z6Cs}ero%Z0G2#}=-2dFTSx~VU&q=ctD{AC_OaIIMJ8>&Wy>an)I4#vPx-b9h@S;zy z-EWH@T?NO}yWSl8?Bn7&9owY2*qe~km!pHwqIFa~=Ytkmh-|OL0@nIgxC_Vcv7KwO zWJ84%cLR;3keqNSV6TVNdm56uK!GESyYE=894I(4)LQI!z86}+yd3Tc7#Htd%2EVB zMVIo42>ouEMAe9$ zi~~)OAe(v;y|~4bcXW`+%&;q&_q~0iWVcdj^yI4}0!kE5X=0{j?yh)>I^@-DUy`BWaB+p(zo6!jnZbiXRbTN1orhx_n-pqK**lLB*0ryP&wyX{_PH zW#;)vbxE%7Y@!ndyCDY)j+(lyNPgHT_;`bwe)7@&OYisIKO*U6`WTu^=9I66!rjuc^JSyLRxt;cF0?z$RDrA- zd=S!8MR(0U4dO-mGl6Qfc#OlWw?{`1xd*X2)F(HUL-$%nI+^GudayO%KKgkIt`2hbkXWS!Nn|3es0}J;6;0zsho9 zq&sxUw4s6vFENSuQoq@+iW?pN9Se&b4Y~p;89M9l96Ta=^E1x33yb%Aut69;294|; z6s79KeX>T8Q`UIG_s5B-ZKDfkl}11J*HeP`zrXR)%FQ6P3Xk91?X_~$n{Uyngw7Qs zJ&Pnb{oEtZGk`ju(@EpP{4nqk&u4#G3|S=-?3YU++qh?`b^(-rhL4SytIAlY&HXU z&sd~w_aIY&o0xC_L_nBVK?;w+*g^WQ*sty%Myk}atr3MGXl2?!Q+BM#LE;qNjKYh)J;^F1dkOO+4goS?oc*(KP~PGA~InjEL6m@x4aTR<8P2( z;iZs2u4?~l5Fr|bBi@cIfD4f+xH0*Jq~EKJ?=@;rxI@Bwzwjw@iKK7kuiPASVea>; z5TS*uz2%AfIiNC$Py?=algSg{;Ev}x zN$|QQJwfe|V(`)0hzf^w7ShKi=5t$?VlJMVA#Lyudj+?zimJ+gx*3~Uo0_>|pt6jV z(uvmR3qS?l+heiLCMW18eqpnF*;R%BHSy!-I7jab0MLQ%MGvc9z=H+GMe2Qm!49Lc z4rfNvhdrmb%N%}rnSTEQ{s)!k%#-&3M`InqX|jC?shqjae_hFM9 zuKAK^nQhlo^L{#t3{~FoV4|bl>u_c|CmXsq%Erlp=k+(cnCSIitJ_2d^jJFOg=kN3 z)&8Q#v0$50kJu$+IMb|>-`h1bo9VlQ>^1}#A;u?2+-zrK8Ia4i!?o{Z_H5XK;%g~p zB*LHmGC`1MMD9q|Xqbo1E*x*@mq>D1yns*E2nN%o-j&s^SSsrKg;dTz*OgVRDIHP! zWoFv8NzjRzU{LrJL+n+(e~o$%epr)e{^Se)Rzx>I1UE4f5pOpz&W!qGK!oiKbQRck0FMC{lLBBQqJA z$L)bW{As*1=kWL{=~+ejw`t|>P=HfOo(IkJyKyx2M27&X5qp}tYdWump*lh#`nCV0 zZOrW$1vH@DzOliEL6t!vg(d#$JG_F_I5>m)Y8g1;@Xn(PT0%Q5Ve2O!N1b{_Fmj>k zp%tM@4ZP!w*1_eerXy=&19a4?dHDet? zi;Xv2m_djmz;fS1BQS+2)-WC^a$3+>v>5X;^W~B6Z{o=|N&no8R@?f|)agkgeY$^8GnbKLEY<7@!cc68XKTMfIQ%Q)pf3 zL%HW;c`54AWu#8sr)pUeQ3&-}>A4vqRm&Ahx6ZTIS$d`bG?GqEA%O|*#rpP%gvPOd-CTee5M)xzxA2hB%L$47-XA+E4Q|o2+^OFRAl_tkWnlqdo z+aL?E?HpoCMdRe%b>!&S@B3)SRUI6@b3DpX`PQ6@g1kG|4h&Z>$|!kU6J(>_fcPDy3Kr9lf>v94VkZt93Yk=vk^n21dHY zkxZe+B*(&6iMH9&XrNCFMsT$~4m}^rjv2i-1Kyuvd*Fl>?908^XaC ziBw`H@7RM(U2uSdVXF^OVwAYAD~bNmL_7?J9jA*7L|SQNdK^$t_Wo8>+=PlN*R3si z9`^eJaZ;I=jJGrAD=0HZ{i~=ZSBR$QJ(oZwfl{g>270o!Y8aBrI86}unC4Kx!uX>l z3GIN3E8QNawT>@I-@*bCduRTSLvgFhsnKGQN?-op{PPpV0>8GK5L9?BJ;Ytw4V(ld zspc)ESzwH1XA5&Uqa+A&n~?JV|*mBI4!Zp@;L3R^gWhjV)0Y%jg4CqfU;w5lh8 zs^_^o;_mXloE$3ndqjP8gdQetE7E$}|CF(g(blnMSlpqdP}-=)DPr0B?L}JYki*!n z7ex1kr`VxWBMLIma8bnXccF{Qc(01{^~G7SFiF3p-;;zzpGvli6i@TZ$hA*jxeF0C z7$FT3>1ff589L}=?sJl14tW!nWld{_XK1#x_2*0)B_!dRQMq(vc3kJvJp>8MNedu8 zl{^A-c5N|F}ZJxqD5)`9lcWIwAkqkMg{e8(hp7y z(`~0hBRAQC%vEu@niDDd$FdJH+V_Vq1#xAi%?_EYTa^e*xF-qp+5uQUxaOMT{Tv8; z%W|o=(!KxFmSqV4aU%dyEi1$&&ZklUD)AP_eg%0Yv)w@f3}NaMan5p~#1f(tk*0$q z`;1VUVGuDJ9jb(TE`6a#&)GuB6}bB|vgn9?=t;~7$Gl8&>G4909RG6U{@VV$Je&JP z)g&`jr;fa_ZPhCtr&5+Q64LC`I~di4(xtl?{J{4UKe~n` zH|HTBCutzU5D0;oik)uo@sZ3!=f1n=c(R|=4j}@oS?W`);=`1HTP_#tb^3+L4!-H% zp-h#cHO!+iFPNOoLm(RGZNcpO1)YMa9~^PYrd`{9ijwmv;=|D8Z(j5ccUr_uT<0BB zP`o88My)T4ATg(P!>5GXc)?UiNfK`xA_X?H^>v zH~#Xm%m#7?=yXYhKnQ?O3l&;mfU~I=P9USIMT2A#@*c)rKW0e%1CUc;Ed5Vb_sKr` zw(%|+_#zznuv9bo*a6-`ZvVsQaIuIAG^QDCl2-r|V}!v6eMe$a5{t@+D#Y%XhxG(b z9M4$}R@@Q{^ZhZl;(+P}c$DZ(<`7PFjnBsQo+-BE?Bzq_+89AZSSy6>t0B*!#50(1 zVduI1wTF+q2N~H8wlj=7QWb_kgh}?K6vZvpwIa8F+t%k6Z(9eL$4?*3m~Q4pToO(~ zS6lFpDMIc;m-f;;`tAjP(c{t@dXvoL4PQ}T^3GtffxrP@LJj%E0_%#IE}Ww(H^3TZ z*&hRJCCZF@17^XJ>$yt^?%62p6ohl^BDji{sZ`9liVB4QRx{fL$0|R(@o}ae)Lqj`EMSdbPLKYN^!J~}pfDT1^%WdH%F>_BhF=W}cRu8F z(H$87M=0Kr&2hvrk&J5>0EQ+#!y*Slz1++ar`*Yx5n>DDY<>@|arUy>vv+7DQ#hJq!(Y&FgP=p08Nw4k%jw+Mc!^S2jb7a3w&@{XP07D!-jt zpPg$myqnkgX;>I`jSwpF;gQ0?o5kFlsJjBD8Yvo?WuOfI5mr-R$^tG&J^dSzk2bt7 z7FkxRp8|59P3@)nv@O(artf$Nz=M3S`-fng$*_}KQn&;1?6?;ORbJj_oJV#c^-U)n ztKI78Z_i%3j;&yb^67$*b+^b+^T2Urj9;RE^=Lmn$b~^70PD}{*W^m}6tGjj>&`&N zU%FjO1a#dCgOQ0ZYP`mW3BD8)tcd$bE)GrQk8+eO=LMC5Tv>uN!F}Pupa9Iw(O_ws zRVI29cz~tBI)$y`uGgdZx63hLFgLLR51@V7Y0Rc@Er?X_qOGS_RYhn~(@~q!H)H*Q zP*IQk0&QT&@fCoPUet+JNydb~30v*j@DL;ICywSj8sVC@Iawfso%S z3h`XLabscpRCzvjuF1Em_CS>m=HfuF3S7s<_Qt^|Yv77n>ZB!CP*09W{HZh=j>P>4 z*276I%4CmeXH7r`{CZTpEd}DMc(kW&Uo(``i? zAyJ@0nm8C%#?%CNzTA46HmVG2O9AAlD8~SpiGW2#=k;t;0YHpK^iPgmPWr96zHuFsp=#LJ>O-4)!SJdK@%vT#O6SQF+>gPNhg1JrsF4RVyL4)M~W=5 za_wG7EX2{7bcN|C55FEOB+hr^T|k{gY)<^$QwpV0xFZ7ls zIei@Rq_dIDFS{^OQ1C%ic@#R71jjyat;x~c-fVT*`5DD;0N`^;?KFF*96thE-n zop>JlNqSr1jDidpT1Zyx<7gwXFT~O&T8{cv$fCB7+p`?+nvwhe+>HEr6#!@&WPyP$ zUe%cE_n4LQr8aOa&9f;aRfRBr7`$v2$QbYKfxw zsa$CHO+M^gJ87csP_4Fb4|Bk7t-L3iIj==0a>AO^bbZq;w8(@X@5?DucZP3VA}508 zgu6YbY3({-i$RYs8f7X_tO}i+o0hPP)E7T7`boD)&39N($=~`?W)6YbN?X)o$#3SJ zRQ`V!z}pPwYcjtuh>8|vidO#9EL}H=jyhirV#5>!^U};9eSCF!tK{E({ zBWb`ZKFlUDKb1ytr~A^UuIELSr#Vw=iaO^%TN0IWp<>6#n1$WDj1r~1&Ky(Hic?=2^;6tr{f35h#WM3pdL&?2$0mk(N?+I{CHzAdDb z^y7t2ycy=eT)*^f-9vk|+!{TE1phdVp7&pyPJg_oz&5XWHjeZ?n1(zZ@T1DLs&4KR zhY3SPl2S2{5zGIEV>i5cc<^Gzx@bere!)5A)qp2<&=T8&td|#xDGuyvD{NHBlmD{O zn0O*L>XLm`EYG)xj!^yL$P`oe4^wZuGnB>s!`=9vK&?_?^MfwSu+-ELAN&kp5VQ%4 zH${m+2uYmIJV;L0rYGpuL+@nv*gw$e?fOQ=Y6?qDlYPUJ|D-Ioe&NY`RjNW|l@_?) zoin?7L^ zGH4(e8nBD-Vw~M9+D1fh^5MwVLhOhm;Qox-M?O94_@AuLa6_}a)=$t#ru$RVc#k< z?w8;KcI!)hh*3wGZ|j<)7xtMKAo(Huk?#ZO0oyGS_g>l&j#~1ve!WEpF$iZL{>4|X zKffA2{(|g-L@UY-q#V_7O~gZHDPbVclBjo~vMLAiPoeRyQEuRPG z77mZeETH{@@$9u23z1cMyfWQpM|kU{5A!7qQ~wLYf{07=;XgsR=3Pca_qhp5-Q)6> zML@meY@Roc*7BkaN9W&^r?a}=w~s@nTD$Q55HcSmI!*kD@(gL(x|#CVmdmS`6pKsD zduvX|t^8u1@-heP*+(0bQqvF2sfbIQ835%KijKJ}enu>y*XuVIG70#3vU6r~6`&X7 zNN)NBMWg%WJOy*`>xefxiBT5X-h~&OQ?G#|4OD&=x(zFf6_6Q)+zrFEoPr>~veVLGoj4}jT+$t|?!)6|V}ou4_x}zx&&Tvf2S_#qbdU*JtexHB_3v@gMitm?fn$IFF%t3@fk!i zNre1eIhZN`{1Dk~6H?JUJ&7cTF$Kh{!_Lzec+~Yum%fV3kRu@oxpS_T7ST>9_L8Vp ztfi9u=?ah`LcxX26(=qd?DO}9v7pXf3RC8Yl#H&J*-qiq6FfHuW-_8jfEUIH<`*<2 z%hiUjA26*A5$~CAc7a|LBGp>*Ws?JPRi+%@ZX*SQA877%n9^vZ%v04_z&l@Fvr2ML zzS)@~2rX#RxF?>}?z>1i5NhwwADH&!>WN~aAAh*q?>8XI?*hUgvho%wL?}aE3U8>&hWYjB5FfBq~YC7e`ei;Ub{oTO~ef&=9dOe3f z2q;u$X{j~ZIMo$JeE7i?sVGladz0X9C;T5O9V1sa?K1?&ehe|rleuten*m7T|Es=$ z#{Aj`vDrPq%9aqmZZG$4zC8|$UAibenwqIh0blNkmmo9l`-dI+?1$^VyJ&76x2eyf zj@j#}o(G<4`c@FA;2C1+6(zBxzt zy(VQIyRfPJD#GEK8)P8n_ovrPWG0*oPqnHV)O`m0De6Jia#8d%=Hc0b@Z=w(@(BbI zeXRLB;sYV!m+w4cPpM)tuG~(G3tzaxxlCxj*TqnbJ%B-tl|BGl}aer#VBq6-b7B~L4xUnzL;Sa zyc5TR+%5i7(@u5W|8VmkrQNLIQM0_?Kf1)8A!hSxzXm|g=3F>6>Fa%Lyy)VUSK9nt7Mf>`@7SuVs!wIUP8gmEbAWpwy!`onX09`$Gs z14m!KtZ;)5X%Faq8SfQHt~vH;agPRACdRXIY+y5ro+Z%!AlA83Yh2H!^WUt%WLtl|N{%**D_&tnkt zsx!t_spBX|>842|If?q3Y~a8Mmb>=Bg^Q~f=?><*Bu?Je%W~3dW;SjV)Z4O_jnsEN z2Hkz|3MZM3WO^wkxcr{daxLAB#$|*~6 z?oC1+k+4ew5r%wN0+lmDBmw2~GyzwETjRT96V|if{df*Z&;;pS{s2xK=fK@eRS`$v z%J@fu$t_O>x9f()HI`2qA~EZBaEYDjw3TVd0t=D(svp@@hN-fUga0n3I% zlGq?po44~{Q`S|#Y|fAB>zH5;F*YM1avc%fHb_I5*GL`Pp zyM!ZWX0XG;BWo;!>;}BiR%r`ca2JpJp&jS2@SBS_;sg}c-8p)E2&6e794`z+^H-}Gj8?L}5P;0I=*!`@UPZ0fx_u#wH7N>BoGY+#td$E zdQ!xNudKMh+XZnZT;;58rdk0`Zm8cN?t1^>K>*((Kd9Rg6NbLf>ysFLEFEL+69Wom z=hb5H=yVR|Yp~N`#*AS4C+-XJml9o7=Zwv3qkkf_7mYsIavacc-D$T=_OX8?bboQ= zX-xa$xSQXW7^{R@F0Ki#q(R zkP(Q<|2tQe*tamKpvWpRO%?1}`aHB7vItbCrm)bpFDoftJ07m4lM(}s>f~u9GWld7 z9b>>9AGMq-2-Bk#^7$k5$ClTK542s+V?mX=WgEUeLxf6Bv3?+{;JnwsHGR}S_i$Sw z7bZ9X+Hk|gb@dsZ2pH;Z?nEV$mIKJb4)vAMv29vJzkc^Gt)0XtDxe)cELpDcjl^e$ zXu$&F0C8)ZI(Dqsu&hGrN4mRN+CCjk`vU%nwwUPonUCnibNdB zTEVT(eF)PtRiXcoGts$K%K4s0#B$)MHw`f ziy6i7DYp}}rtZ-I(lP=HXrAIla9(cG-Ru$JR4slP)SjUy_IOh?<#MSu@UU-D#(F#~ z`3uIqn|Hj}KmAv&wsxmgbKG-wi($;`V=}dS5tLeZ`VF9kAnW-OKR|qB+jKx1en{=l zZLG6rl=rf~<{h7}Uoiz>-=CEQptb6S#kv1xbCM_pToWIKqTICytk7qr;*DwAIl=a) zrZ6P8Zd_$C1tVlI=n3T^r@V12K1JX=W{(e-s+*W~fo zv(0&RZdep{iw{3BxM>Y)S`gMkcS8y*48|B?oOg!<`*G<%yon)V}}-L zLE4s5gfzQMNt%yURjkhhp+{o?CG~p_aVzq*VEt0bc`AJk3yQ~a&euCmVqu5^U*inojM%I6krtwYUGvjvo!=HGMhY;;av;JZpoMAv z_Zb*I70yecA02~M8rp|}BrA7)K~}9*s~0@4W$&+d7A~@ZJz*r>E-Ai0ig~E{t{Mf4 zC!~-LM?y1a;FhE50c9ghvyUp+VOo)}r1)-dQoU#4D4Wjv6>4vBG)nAcM-=s6%6CQ) z!GTd(167>79pU&BtF1rl1bcLoHXv4z>dz0}kBH9S>WvB*F9UXQPuuljf`^$Kbdk_3 zs2X?`F1fca*ypuQhdM!gVqWpfo(hhN&YnHBcB8~Qr9p}rmd6$uIRY%)NA952IpHiI zpc7th(Y5{N=pMvI7Ma41&25#%H=pGUH)l44<4T6B?<*FC)nbz9fuKvdL$;^hT1d_S zD-MSRi>DYt4e{xfKU)En>P6$*PdZVfOsfXWwl7LM3{jNI_mEEg#G3~jK(`rvVv1pO@fo9oO! z?9ul=^zG>=sl5ijxcR5#GDs$8*E_sMrJDN_pdh!@1V>I**;R_ZMyIn7UH8I7X?M`b zw5RA@#tC=Vy~XIST|6O&+L6B2(cJXJf9hJ~CR^-4q3MLOsCHr)#mD?l(z+;Hf{XhG zN!?2)lCrZNvMwi%y!6fN*;AA6E_GHpA7Z4{mo_reL_ z#Lf>y1Z)3;&o{l3IU*IqK3XibDmJz(UDzJWgd=&Cyo)0aQ6GH`+X~{uRffIO3hu#O z6ITm3O4%r*aceFz5(vVu6NtIGrHTu#@O38tUf}M1D7*SNFm1fc$S}Qlt**sAkNqoe zb63Y{v2@%9s8QthVtvRR?o~U#(x@qWF`$wO=hZIX>Rhp1KG=zYGX4RmiT zf>g5*$p65JQ&4!B{X7_Z+rEy&$oOFsA03G)d?KHS z$Ns=y%mPhAU{Tw=QY2N#4@UxLXQm6EDO%Ad+}KfS=&D(UXIC@!G9}B+ay%Z#rBoDo z<3xk5x*9a5pUfLX9V3Z1Dh$H}L@RqBuSFHHUU=IPJnjIHvzGu7I%BH-p*slLt4_(v z(b7oeHR-Wj?DZt1WS(qZXu#z5L9>|)6??VQK^b%Q4$!FOo3G)hiw=WlR8ms& zo7rei^`j$(^1q(tnq`Jgj$BAYlE_;PALWmJ6>2iUszt}E)u&7|VAQ2M!U>Xaf3Dh! zv{;?}^cqfHg5dHtJ_W(iiX}yZ`)#)D-@FuNS(v1)Q2Og~{=pWp^X*iLcr}olHax$# z&ahtg(#OkyUuh~f;v|E9%sJFaJ~F~%1}+c0)R8lkji*qhQo{t{wgnLOy^D1MUy3gx z2a%Gs|Km3Sx8e#|<5`(3IkgPZfaruD%2P`c6IbyZyXSK+@1y0uMA&{uu{ha}EQvHL z@f9vU4~BZ@8)hHTAuUX9{zN!e8n>dm*L+#nzqk*zBlkuLaj#_pdgKnwPz2?P0}wHI z62x(b$d;9+I}W|}IC;r|P4rf!L}vW91ZCxK2tb}17?XnJP%8#FH_l>UuwGD}dj_{8 zX{VB99W$Mq(l2@!1ViQ!y9LGk=k9%j`^IGs1i;G)>^OUNj9{NUcPjwY5 zkV{GnG@ln~Pb`k&9A2;`gc5|n)$kM&DGBc;<%Qr!=wSjXHaN4BdmrO^|(eHA2w!h*myXg+8f;V-BN(br|Ti9=l&BV zY%hL}LkR=JYSL$xL&yJL%QvIW5%_I=xI|O^dlM{iP?v6&K~z9q2Yh7KG2D+Yv)J>h z1yjUrNr%YOC*E)+^QDqupM^_JoBU(Nc`Q;$H;nAKQI4tGwD``PHDq|`Vf+eu$4xF_ zdd`*yGTBEt*~o4KX7>ss^+?DVn517IbWV=8d`g!C91EdmN|Q9G`-boezRpaLtKJy} zZCsD>l?GxnpyGh74$1zn`SLsl#zLHUCppSW>o5^P3*(*vEkOle-@MB!YG+s`5Bo{q&yQx^ze|IbpCZJCf@-U+0v;}(q~chJy^sr zHu|(idQ!ttJgOeZ<*t;|^zn;ibQzrHGQEaA3`=_}7}iDXo$+Xj7{?Oq^SKXarD`yN z-i7L~M=qpYFWINsgkrW&FEK?CDPUXv?N`AtKnz8K1k*{y;jbbPq`T|YhD#b=pVz9* zCD#^=U4Qsa{JNlIRw+QxG8Z$|nr2TwgpMfP4l^i73CA%o=tly3uWI!#salKP=Y>O4 z$ftj&L{j#Uk1NZN*Me68aH)K!*iW7D*#}lGhP{*}>kUA9u&#f@bNEyRG9t+HX3mLL z=4j>8h!?Z|E-E-^ZLVoY#+A@%$c&$wles9DO^;hQYGqoO?Eu==l>5o9;*-Kz=%sw7 zhiiF)lfSXe7ibq;^Q>0QNo*spg8W+SLVS)iKOv>1M5q)teYn_kh@itp&$(=XLRn5M zAYq_eWc33FklI?D{Q^wThL^Ty_}RSA>>(UJ^)%Qd`|~atye?0AHm+P&pCwZ-4l6l2 zI-8Ulh!j29WNL`J4Ld1-w1cG5h4T}&Q*qcBCcQMjqXf4RmIYmN?A`bPS%e)si>`dH zGlx?VM*?ROi@th3MmKbA``;Dv|B|Z_2+y2_zF$hA3j`ciG+qIugsLx%j8)H2eyS3GkdN52e3B3 z6Fy|5dvwV}oE9Gze$W387GgPl-g*zomp(()3722?gS5a7i(GnyBwej5c|f%-oQ8BUe(MR;LX)bWqPYH^B(dxt`{o;UxrHj8skuax5YZaq!; z{fj85YnpesdxYq~Z?%5iGT_qP>84DTF#-c}4zGyu*c|(_Fm2|9=B+&~cU(2M4=gm+gxXah0@cee z_6ZRHW<)pQNh?xTPX2!jlYjyA$&6Qfo~+ULW={;m*Pj=z-M6 zzD-@dVDt!X?dMW{|QupWpZ|?cwa>Ep^j}rGn?zpi}yQU;X zE8^Ug8kDJVWFPL;(^n5-I-&YQoL37Nkb$e@{IBuby<-Pnv;XFRiN9?i1p#2ffM3mo z_+6?{2TUx@k9 zP`cFS+%*RG2Q;qb|8v#BgFaZlkVaB55mZ>mu#|Q<`VY^T5*o!T#4G))?r;H47IukB z7WffafWNfk?EpgAZI?x;Q&po6jZWhd0uzIKpF4X|ABKO??=ZZ5v}~?%`UZxc$&V34 zYKJ@U1#p}_-*u<|&F+25o{A)9bH~~$_0uuCjvyStr0+@YPyJym6!UNU={H9R7uQ?- zZ^=BR!AA!UZwIFb$~>y)*w4VA>xHqUU63wG*_Eb6)5YN7U=tqO?~MC^y1QYER`4%o zgzo+^1(>7h@a(ulw#8)Rx68^8GFth@|dg~cPMVOu&?lUkbcpBp)bRs zSYA<2IY(dYvSdZUy#HLx)tDyXlynTH=3++f3&u)y0c(1Q>lj8S220hw`}7>t2qFuy zPikKG+#u$K%27|RA(w>t7Egeud@!W#1tZP6FR)eZD;T$9hq2wW!CSd^HQ*V5DC({eYZI~+F!dazAO8w$>fCLGi1b2p%BJ>TAj+-{cir6d@kd-g zFq|uk=7qV(^2}Iuxj6O@#2;ZgGi@m^U#%qPYnJpp$SC?_RVkvxM^zGSCOw7zv$W#<5toYFzyCf z;I1IeQ)G^?P9DuV@vVFM?J5&~glJd?h91Y-jhC8T-)-}v_o}N%a)mq<%(!Vke-p4I zj2}Vg8!j8c$D~&YLpJ6NWjB;cWg46t?H;-eI+`ruQ=SZE{0z0b##2*Q)+BWA{v{Hb zq24RySs$usH1=Qe;uyY?B~sElnJby&B!HJ6I@XUy(RAC8FC3n+#lZx{s^PMN(Y@Z5 zk85LJO<4q48FpUa#rtc+5Esv|u0V0zl3K`ZYS(YN!(T-QIg(@8lcsP#;Yc7Dj31gx zM%Xr0>{^7XK>NHB7q|>K=%@RW1PG(9D^0Ck1qbDc>Zh>2l+}(B_!uos-je}Ia^C;- z@1JiZFM&=>ux|tgs5r2+@<~?1W@NLc z7Vc{O{iPMm5SCjO>89{4h4KS!suVlh1OXZV7gPH7p=%p3=M~>CeoFRG&-@*a>ubF4zeXPZ`V^x1>jbP_EYuX zq$O}dDH-+7eHBd29Di2{N11%Ghe66YPT0`P+}9IW8+SpN`UJZph1%b7Ou^d5DI;9% zt;yx1GDSzO5|O1_q}QtA-~Atg7!(f;cBR1`euRXj(9_G(EJa>n*B3yKCQ8zc8sBg4EZVd;2qhxy}YR_su!pg z`AfbDin=amZ02zDNQPa`>M@5_Sn~|6c&Nbn%SBLw zc-gB}RKs8yA#eyyoJJpawI%fanpPQF++7+vvLMRZUWV-}c(|mWzDKG1v*Zr(hCT{s zWjqBOR{UNe>L@36hlg-L*CeR4g?@72;9$neN#G2y58)|C=)NHdo-OA5z{L>X;jWNf zTd=A7a>N)S{MwOD9~IM%wqnqP9^ZOFKZ@qnaW1w0f>zoSJHB&1@3-cCjYhT?^m!mx z($E8=BG_q6nwxDP)qwEO==LyFx*SBH?Nn%d^0UIGAvDkEJDrb$-R-@*!bnRie%S+Ir^NHA84==XSRh9r|dib%@&D=|KD6a1WM%&Am)5vg^R024CH-~$G3RP z-nVsjf=hWM3KsogUz-w6Itrkhyx5jGBQ~)yA#^QqZ!c?bGSSCgs^*LSZeByujk9cD zyXbXqqs5et zSm3Ptn&u|(Y$$RX%Kog6&=lZAu5W?p4$ak7`40i-DMwk9gaW(o#NAi4Xj`EtycaS^ zFcBl3Cb$I(LYeZ>_W~zmdjNQK9p*8mE|UMyVC7ua7<8R1zs+VA%>*RBT76;mH6f{Z zEaow?at$zPg43I}Kw@8Y7ii%svLe{yepeAhEhK_PVZ^-iDq|uxVI?cTb}8jmnzSaL zRjg_=g-a1MKQ)x*oiNlFim?TLs=?47#ArLF8f9|+b(Wcb@+WIRa*xwiuGW#PAPpzQ z!eI&XxK9y}ltZvj-PA_4WQE4eHBzmtk^4~8fSyA$;I>};^D4ap+nJ=3zHk{XyTfVM zEnW8K^0}RI_iG*_fYSfG0yk41UV*OR2c}|J-1={_ZF?06G}R}UEBq@LQZs|h$(hd% zUkQKykdxvkL4sun)Tz8pqA-`1HMk+#++lt4&>iepkj9)qU*&uPDIwKt6nDn_A5&); z)Mgv5Tio4>ySo+l-~@Lq&;WtrTHM{;y|@>5cXuchhvM!Zg_G_xduIR5g#h2;?*X}pvh8>};OCY^<>ajoOq&Txj)@M!GLCyLBfG>=MY^p_-!*GeZY{pLZy zc-lRYZnC!@pU-t;Fh#jBJ{{BX#^*PhVV4QO=SEQJUgF{Hxm<>1!vlRI@NSzG+YCbpst-_xGGdb?=8* zWmL3KR9I@++3{gS%$BaS^@9ah5>=F)>xyV*WqxoxVJVZuAxHfY!ZC$0Yw*U_M8Fa{ zLi4*k!J!DB4~7&MwvzOF94Y+z8KE=h!}6hl2xRs5m6Q@8c-?PYVa*EWW7?`{-uG^0s*Y1FhPp9 zu!)0_b+t_IO(RP-$#=z-kfNBch>Kpag9m@JcvS^q72rd0DHjTUV5yJJZyyqU`=cZt zsR)$*%9}9)8k>y?U-hGXgN)Sua%7?;`201*27Z$9Jk5Z!X8oEpj{XWwaX+4by$c$1 z$~0YpTC%nZw!Gb{D#W9_Kn&wkjZAu3BggtV(~ z*vIEqt_W4`v%Y+uZ=vZnELBn_dH9;7?T}JoecB*gnbz%Ycd3=3DSJyzC6LCjl4bN# zV<9fs)TPh;0>F$e@>eO0*4&2>B-s!e$bYW#hnZmW8-tesVD|PnQ;$F?+JJ*p@hzYs zpW}i*dnNg+_46!@NYg8l=GGhOM@5!N@rtvs+iA)dwE_LwwzPT|D)C`D_mAK21g&kM z#Wr$->iE0ztK2qwv8rv0}(@DFZ}OcO1_XFVOoehiV>`L zg5yX7#f3-n_-_;~Rbxt))k+l_7HGT0ezHs16FL_yj!V{DeLZ(p*>N{rNQ6iL0QP!J z-$PQ-r`$fI&0oJo%#Y8^S|uw zufDyrR`t&MsL|%01*bqUxV2Ic(lj)x6mBlqp1B1)W*_(k|HbfVgY{3!XY=IvOXJyx z7Eyj)v$RN7IDX6+aZfW6DAW<7V3N54VHbtXS+eBpR+7K0xJ?}|6|nT!QK!t&X7<5OCG6z6~1^+6WFb>$9lnDjd=2IDQm$Z-VkH6bAMkCUU1W2L( zl3yq1jHTKhubL)d>Ad+|ZcTn}y9}aU`t3dv&$={Eo!fuQ-GEEdsg7_M@`4hwd`o-I zi}nrw&63eJc8UaX6azR`R~0pHj!p$wUw$%_aQ6GhCi&;J;qCzD1J4*lPZS_nviKib zy8P$9yFWS@!$%Dw<0=K-mZBJ*k; zb_jYAYN_UqF5PIa4<)`2J){G&Q2MJ?2q4*XB47RuT7>%+&^GGL3pZUK55=XT6W`iV z?a2Gt`UW3zQqds{ipkUQVjeV-+a-na7ipr)5%U$o^^u=#_4Z$NmiLF*Um!vj=ezW% zu|q3LCStO=azf6cYWvGd=U(SGl@s~1A6*O=YWn@7@@wlo%oz_cSs;V~-Xi=Ly+VM| z9J8@sOV)eBw6uL(w*k&CdgL-b23rNps8gpE+PM|Osm+NmbmeM&Gr9 z6+X?z!QfX4=PN;h^*L1zMb1<5l|WeDU~`9Sb^H0xN#INuJei;D)`dM+spO{+D+j2d z_T+;plS;fC8*8otBg?WGP5ncL*1LSSDRz3SH$1$2y8GwQ;+B7;b(({R5?JJs< zNJX*sRnHQUEA=ghI3=XP_Xb^grA^P3YN~wrQhY+_cU)xAv9o?W{uD^onI2XJXg`?K zA*|_lKtpi@J#3kUsDgF(Rh7{SwY=J=E{B79Bkt!b0UA83zvH4 zt%pAh!9+mkm&Ot6#Pd>o#qESg+_sBR4S{$9-fKAp9e$PTKkcl?!mSgfG<4FbNFnr~ z`m0LyZ4l0~!4|+xKyh1OsB%X0m80u7Nl}0;#E(Z-sqlgOeV-}IG1^@*dqi{LC3pks zDN`l51qIhyXF%ANyWvK(EStdr9p7Ml(44pvhCx|W%07==$(Y&4P8G*0taR*)^&8Fv za&&>;p$a%c>_`fF=YFbCNk5u!h})@Wa1RmzjX9k_8fr##oL<+ndLpfJGTSkgZf3a* zkEyI0aSCh-rOipImK=ZS3Ukisc-~?Z_Z^EecZLz`JR_4_-Q$*a;YX(kf zFrSd8#|J_Xei!ae72Iv}9z%hmTF6CJA0q1=P2*gx@h6YDB#sEn8zjK=Y3~nNmOy%g zhyS*(^xItr;LHh%dn~?Z%8E_VO+yr0!>!p>!;|07tFA4OjDrkngs53}<93Rz zLb1daA-R3*0_Dg|sBjsoeAm4Y&J46rs1OLh)D(i8h2jEi(^_EV0ryYfOn0PcPdU+a zJX{)K1PTY?ra^zLL}hUv2+(3*^?KDRlM`s5I|lc4?cQ!w z5AUGYT9iWJWJ0ZjE4;~TlDezam<8n-4iBR=%jQ{iDMDN|ONdJb12_y^zfMYPEHq%= zO}IybiJftZg2^QPpJ|n=`Xso<&KB|jDT@+Ht4-WIhJD#>%)psdv7HSC2$lv>jwANG zJf(tPJecxXZH9G0TctR5Uv_2lVp9JiLwCR?@@6d~H*WP)1AI#JTO;0R6=Xk^z69@x z5CMv1uN<^k(BFQ9AlxMvj;JKtuGJW8d}BnWET>EJ>vq-sVKAm4srQMO%jOWS(F77O ztN5&N#OP#Qv;g?&hy}#M{>4kfbovlMoO@gB5O)|!oNp{$ft&K@Mu62h7&8lW8>8QG z4U>~%<$fm;Zm1@($Bcg)Nl%{^slH8%+8ZkIlU+q5BBTWM%a*G;8npHZOt=(_sHn4y z35Nw8eryjej&|0wg4wcpUjV z$w|8fRDvWUg-tI+RpWV=y^Tge6+!b!585V+*Ji4#W%>7r2 z|MbZCiH8qxroB!`GytlBU60LmzL2yxas)E?FpQe_s`34`?xTZW_(`K}rjA3b2#s=O z*pXKALW#W2@1d%jZH{1|11NOm<*U4;>i@ck2{x81R0mJq*Nt=+QZZJ5dv_zh`({o> z2mJd0|KY&4r5jRAjaP~Yd`Sa(FVxt(RZX&YP6;=Q_5Wy>sN^5v1{x+}+I^hQzMn^b zc{A@swNplL7|0|yLBum{@P}w#--5-TVL6oMrl5h!3x_U%s|!!n)nZC(t~P@|wU)Lu zxMD^mQ6-aq!>v*(PL=LwfBT!T%@kq1x&* z;Kw1v(m%NUHobjcH{Q-LOIrF^=671=<9tfj>+|31YOmk2wr=-{vcu`&*WKs{oE6{n zu`2JagfthQ-%JX#ig+T4j@=O_&(jWmcQPDa*wc_x$cG(hQGspG9ugaZ0O=xim-G7? z9JegL*prklKmUYzI{6^kewJ-i0gHT!)@QDoiCC$Nu=oFO<4=qATe|;Cx)`dvb=Q3= zsX2zr6C{u2_X2qllC)Av5(|DW7JsFo7$R|%qu{n6zkv+(vkZ1j=`*5^%CeZrsul|_ z56bYTOP;#^i2my?>yoFrYvP(#82l6J;NYG`F3QAf2NaB;r6!BTZqDF+&Pu@tA=AXf zNx>4q@Z1YbL@^lGa=KMFm3t1bNM<_!J8^@loaXqA0)|F_XwSCiG z;9B^l-W@&q_+JDbbQ(I2sK~2N{1cAgr}@Qq04%M+Bydilw=E~q_g)nO%lZ5;8{SUC zO^0r@`M0r>?Bhk@#y=Cy>99UyiVlv&4tMhMStXzExQH)UJ z)I4E;{uir$HFZxa+dMcV#U@r0!FQW=ZxeMP^LzO7A;FFY_;tX%d1`1XhNJW4T0pi2 zH!4Fehv&G`x#7~UtuECg={)rfk{74Gvw#+fB;G%7lAG7L_*VmQIMSsT{9r4!>=HR9 za}O-10D0%l>^MGyCt6l^xr-Q#e_r`Vl;T|y(MFFw0sS5b)m=6O%Qtc1qin2BBY(PP zJ*#k>^{w`Xb&d=>Jo_5-tWd4T*yIaI89dRQghrZJ+_-KuCgmSy%g z|ND`{d+DKgjncq>G7y$WPy&m?@ww#7YssMm$(%ysdG~cF#}uN=me(IZg~==?7qEul z2siIKq;zzR4AWu4nvn{mzAXVBDFe^zl@JO z-aP zzPv=io~P?atlW`^lEq{xqy6~c^E86#D*Tx{-LP>o@JSEI{R{@$bq(XO%&<)}d- zEe5KG^QHMbRbO#`87E89Mjize(TvafUb>`2$YxuJg$cHqSn~G%xI9`| zqh>2O1%02f!CAg9YuHSQp3LeYRdm*9eE$yQDP}mU?GjId^Q|ZgpQ)N-@%QTdNx$P= zpj%!BatiJdZ1X9`I>t|^MG&7mTuN@k$E8(=(#+gh54x40p-53n1aCiJB0In95V^F@ zQQyKf>-wJwMv|yhrzdjw2aZE4de){KHjPACY7pbbhq(9CtIL`8vaiUzxDjvv)o#ua}};4+f9|li%*?kLyoa97p6XQ(S)goPRza8J(GUv*rD{ZuOaLHJyk_ zqU#3NSjZ$Wb+CE!q`-Z%DLAy)ao9H5*u`?j2=C;w@k}76g zCcg%fzAmN(%5BRD+9gu#`F0VhdF3ox3(8Je7TSDA`x(`eqs%le2~E)X)BLGJaWRxjGxXN zsc9~9V;Jp?9BN7{xl_(fhHYX$X`mHSqSBl6_wA+O(67`<=u|YoX3Q53T`%D|^K~U! zI?y8zaehp-MtUolL3aoJ{=@3gH?>OCQhy33eC-cP&LA zCU5d&!TU01*!Xt-oXRoGez96KM!Hj(;d$#qDeJI|2n=Lji{pbaMOribn%7P?uk7gJ zh4_{18cU)|uz)r%Z%tgFYvgo=qZA?|OdzSo5bgQ@x&S19Cnz}uP)d79HI1^2l&9f` z$>x&$jH01_NAu@s(4v)Ct)PUn7p9V8jMd?sx@8(Ksq#rfL~0Cz6Y75a^?Nd8)=QEL zg$Eb;ZUXO&xIr)z4LM;IOF~|3s}C^4>!#)i(`4+#yAzaz$Uk4|NN5v9l4P0I_2z*( zuE5*Vn3)!FPx~31;njjQXJi8y;a%FB#R|W6KjI?ui8?8owlm)9`Xo=zV0oI+b=dBW zANPlSD$x_|eo-i+`bg#_wC(TS+&y6u&!>1$e-T{&Zqp*{U4Wj_wz1n^pM^k1}p>Y=N3(29}D#igQ>?0 z#hvoqHpOp^Ut3g_T{Y=4jRE%3rqp_P@Iq|#b0UAta&T0zCEMB#rdf|Pe%j_Nx=;d} zOmY(S?0*zrAF^fg6^h+11(t$c z_#ENVbcPQV^vsM5F^RP>a8W*T@^W#zTJEF_lHBYj#47Z2v@CVwuqPuvQiu^Zo+@>x zmK~-t2TAjy`v(E>N*apMGUNw3;N`y!XFm?Kx$>~|QyCOcOPeU0^zrD2@bL^w=aRdJ zZlUwN4F(v_+kg2Lj0Lun7JT-WZ6On%8#=Br+R`}L8)&U|G`%!oXi}<FmHs+H&Tbq z7d#JQo!MfK%#Tt*-l|zFzm=dA#>SGF<9T$iF_DR*@g>Qk6v|5Hhr2uxUnpPmCW&I; zQ@zqBF$GBMiFq8>dTmdtFSFUSX=(S$&Yj~)LZ2H|Qg0STYSNYd9*fg6$bMtgmh8b2 zAK35%NiLfFtTQL`mr{g<)cz0SRV-FO#SYB@v|O^guL2>kQEHL#w(;p|8l_NnIKev% zdp-nuuO7AW;q&H(9#bY#(o}N+L6FE|7L!12q4Tn>AeFe7$7O)IZ(SkmUC?abzHk)# zvnwf#2s5nBP|Hs{K44i8bMR%1mU#+3x2A0TK)-I}eF!#Z@{i*X`-qjjs$m-?UY5~5Jiov>Y77ME|;!arHe&FxoX7S_uqTk5%F^j7ZD8}gUNgTs&PNCwphJoZvEXz`QTka7LwCd zQvDv0oI#U}uM`$xiSfk9jyr#`D4Y6L|9+%O&B_|v4iBtGNG7~0lEJRG)IIqBZ z>nalnW1Ci^Bb~2{j?7BZlvcoc6C%{46QU@qzuQvC1mm+hBM5_lGvz60B?-N}EojL+a842+EyV&!*na1zFj}#v_>ZQE|n40NZykKqIy$^vW&r*SgbCdNlory35xn94Jw%+VTHf$2Q~&##^w$m zwZly`HNf{Z4fdsx*Qr2N0fC$iw~TfNkWqz}bG@r;WW@a{ZCWPfR->U|4A2eMq1PF- zNvI5QWGE;?n9oHiueY)M{5B;xoa<7+Xnyoa%K1FBqc%mF*$`bjoSCq@KWCt5PJm$< zzA{A)==(B#H2&O}_4%9+f}w;!r8-Fao4GdOanB%UXXiVDa7sC&@euoQnNCxN12;co zix)r4;B*W)VYt;2+6X$*#|!uK8A=m04YM&MjT?~+di5X3QWz`8uv>ixXH`4vTL_f?KN zx+dMPMeP|+$ui0?fX8@euH56XwMu!GCar2xTOxgJNbkT#6>AsYkF@cZP35j4Jg!x` zV28KWOD`TFNOn9O3;I?Bl$n@DyqlzdUdo*~s8zkxRY}B4z~vopk*; zPNZdLB$MLVlEfRLKyIog7$0B!XA6WwoT(#dR*K8xI*LPS9z(Etuf%B1U~SGSZZ@-m z9_8IPD4C$%+F3oBO64C?+^oBCnz1+hLvKA3%E=TVf-?E{66%k2?JqlCYFb%#fd`^yQBQMiI(&vW z=VFj+)K_LkvWAIRCOc~j8Qly{rlPqjAcP=B}(ZEI& zK;*q0a?~K5!Z&Nd&lhRT0G8e~r>-c30dWltF!c=tMve)C;@7i5HD6g|j46kVDnk@X z?SP+xLiY6(nUP=w!dNw!WFB!C(c8AP++f*~uU(uS1U$EhvFjD|B%A!PUMwTNpvnoH z{NfR?MNbqQ6!2MDSa9iV>9n~P45*8JO9ErV!zX<8NkHfI!~id|3uKfq8cHZ);HN6X zSdf^3D|umJuEoyIO&U!^{`B@l-~`(eXaZOb>$|AG>Rb&2405FLkXUMd9}}B9$Mb-A zZ!Nia_>&O#?m;__+M=T0{$|K8W5`HTRkQwX_TaU z!{A5U)icKDtTg@DS|$}KojCNsxn+L*xVnw=quuWXsrh>s-|teZ{>q;}`{O0DyUdm2 zPTFHTVKxr^oM}4x8s}TWVhq?#P%y!qNY6o?)54&z@OmD4GyARkcRvI{&Hi(#Q*|x} z|6zuyg_weY!S0=OZTWu&nO34_`Ui+_IdDD!j}l3t0kT7h3ft5(A)h-SdWLG-#%dbA zGvCLN!43|O^PY?imsjUHyne|!wpsK0i!R9bL|R718!g|1+Ul?|4}@+?1oc>O+kQGk z08-(>LuU}A)IbH|X5+uKIQ++lJnCBeAGeE=Wu+C>xJE1i>o&@qV{5~=Sjq(J{DQya zffhKw6!XydL*`mrkOMg}%;^LHc?J5C5$Qgf0yI2Cl(?drfFUb+z&Akv6rO?7Z!Ose zoVEXssj1iHFiVzFVyHOT8k#0s;5y1$Qha-gM3F=4^XmI#B$E`Ao-fRHz%zu-8b=VR zi|f<$xX;(z)@;I=7E3#=?epw>VC$xIC9-4nXJ7}dcf@U_#6b%c(SPBXB7)z{8ke2! zu^W#;+##AW#0?=25)*`PQg;b^njpMzrBbiLGpgI++AvE|4}}Spi;GNepwo61{^o;Bjr92G{s z56eS2pcv+YC}PH>8D?{dB@TX-FIX4+NINdsP>A=$&}PoaW;*eLaK>fWXF!RsG9@dp zPLwYe#49|xug|^IW256a5dsB2SvsFt(`ps{4r^_fQ)^iliq|d#|JBVc8$LRhfON+i;4{~!R`6T$X!i|1V z{GF#**L9~c+rNY*L<@b0uz=p zMh+^I*W&lUKcNFRIDLn4u>6u}!;T{J5dzlv`$)15YhpoZI^zti3?|ah_cVHG1?ctJ z5DSO76LJ(G9L95&g5Z#YH&U6a!VE+dN|S#{6asx3Id2@Kq{76_5{r&I*s7go7;UaO zgaAUits)=}v|i%+T%QrPm*iNuZadJx&#T(N$XlqOJ{^rKp0b0wd$WusGtNiP`p3CE z(irEQ^o#Tr%j@5e5Ip2BGrt1~EkZdlg6i?sN4U3VHLlC>ZkWSE0afJle-lv9%?u$xZ$yw@K-Yl;mcb*Ubt`%*kOZ1GYY6 zg2C;!FPQlmOOZ<-%1we)E=fEkS~wx5y)Vto_9?0vXtMQ&^ql51}(DDTvByiOUCvUN~`K+;3icu zI~m4Q(#&FI0=?~!bMjq9FXCRl8=}12_x$hD74hWUmr6~i< z7zWlllD}|X4Nh$uf=c3^2kb`6Y>J>Nq-{_J=K6P-3v%epFuaP4nzqar*LfL81up9E4T*m2qwn9*umwEFu04bLhMaJ&;ke!Cp@b|U1)9_G zz^sAY!id|6%w4PG%HK_K4Q*Ms%g0ZfF7a2AAY#_D;gWmrj}wUcbO#OaD;QJk7`1!6 z82K*T$GcDA4Pr}J6&$r|ED5FR0MwoH-NXLq5#Q!O;zUXAGD#kU82r0h$pO##A1@SN zoUV-U99{w`HLS|c&b4)oEx z)ivr5{cZy8ZN2rV{F5x>M_PcrHE=v8kHo8XL~iG+jfvD)P0i)EyT8>4Zj_=mnTZPG zd^+@jZMrWCJlTt^g3DjTAhrnZPe>3^d3XrrZhd*5WBCLW#*WD{Y|A-MMD1> zRC|3!poJXH$5XbAg-2$`|qsATAYSn16=p52Pf? zL!B*!$(_RgYB1 zu4E-cJ4F)AiK;fyq^MvNolqo&v5CR~7`v5L5$~z-YacGi#q5?+f@JjXQG{Jy6XotL zfx2dz`W~hQcbf4P%h|q6G)V^AH*7Bq|J^2|$xAtn`(McBV(=DaqJmpml=KBB^*Qf~|G%ynK9x zMN(fwa2X#ZMuZ-IHl*+yo;tfB6GAE%Z0YZ>=@?WIVq=)H6(4Pp?{SD4BSL6w#&_da zF}K{Z>9(5l(sJs{?FreFO*1|+EGHv7d(aciXZCSnXG)NonhZIf81xkd&XVZ{&dr@u zL7%=Qfm?PQ6{I7gaDJVhxxn_Wo2H9mb(~uYG2j+x^Bh1y`#F!}lZK0Pa*bzLq}$JI zb03MaI{DSQt~ ziO#mi$j92G0GQibE zA#g+_AoMQmZOTgYiBq{BjSq3`E)(kD+S=^2pF8Dx;p6Ku-eHXvFI>raN9rx~uOC&5 z)I@PaHa?V;8xc{>6<=9rv=V}jA`Zhi++hwBY)a=gcY0}l ztf?MDGV${z`2B8+ zERE|j7vSU*Q96l{3o5 zsf?n~FT$wpFQ39u90h#(ta)fAU_(rIDKkbm@((J$p7QGn$D)v%Wm1LJi(_YaO~Xtd zP2p-Hu}SsXlrl;kl`WHke1Hw0rR>~GM{bD#eCUB)PK<}wSj3H|S;dMuIHjq-sz()S zyxLM-JmHkVn4<)AF`OZ#RJ>D0Hh%^gXinFWML<$@PRrrwo5|pt{Fn+cEhwyMYM|y@ zAOI>>L7k_$xyy5|fUbgn*e=ICLSO9_>Heo=qaY94NZv$x#Oe*9x;BXsEDHFS&Ei1yc0qptTI~I>;Wfm87C}rXt_4K_Ee(( zB&3Ai@4pL_@T9$uRrv2ZCIDyTqIrn#_0)c99}>cn8^HXhcpOrF3+W9W z97U|nLPccbIk?G9d^<2%nQZr~o5xQMe@F9OROWvXCWad$Hm-jUI>NO3x8^0ZkXKEg zcfOS8JO?`&(DL}l8tV(%=&|Y)9-IEcEa2rW=1x%WX*gpK%EXKyO+dlWJU}3N--a9t zsJ(Uq5&M!76#|g*(QYzj{1N|@$yV`FGuq&kJIE_JKNG-+VQD@$0ZZ%!4Dm)QULd}v z>;I8h{IbgymwXv4!K8U@Vw6CdgG+_QLc2gr^0_QztO|K*dE*V0C!2;odZtfkg2Isq zXSKc_H%;psa`#pn_WStzg!)G_|5fY#c-JL6`Cm9L{CBasms#4iF)wMr%?UFSWM7{x z>MG_w!1d-VKeF$>AItxmzzewoEex2A1xY0w5dI;O@z%Oq%rD%AELhj4w1A0M`m$XR zVdrDR_k5fN>h7LqGew^ZP zB$zmTi$$mFonTCjx^^a*`?d!57tyXSAFr$Ung19`D^~**9KXfvt%H5UZsALdfcRG* zNPpy`Upsyod$LVv>TM!h#{17%bbIgK$CeHI&W9DlWr@78yd`z$Gum4UD)!zt=ja~( zSi~dvyufu3;@*j0@qv;NgzU}zFH z9}T&N>}Q3i{zV&oXI%0Y8IYFuxFhQYAKq7oA@#`^NlN*uQWX1Wi}pO6xtsqQiY)H* zrf)N07r@6?R~i?MKMv^BW^2D{W448`)9u&-sm+*0n-nC%@@2ori z$`BF#?v%=ilm3mrlTS{{0UROruOte}nOu*p6Lv8HmI1ki?rZtK`4DbpbJaMH5Jw5) z711m3N|&UKD2jkZ3JTLj5O8F<#c|7U||_6kXbbe~Cznj~j|)JmI~fX!c+G zdufNokC&aa!w(yf1S_yxxwM&USl76 z8t*V#i{syr9C)xC7a~*yAE)vc8HZgaVxSN=Q;p$-g)>bfQh%N%oz_`a3-f8{2NkRC z&942T8+hV-VaLFD`|q+-_4)FKOiPC%!cW)l(;ID$g#bgMxT2+Fb@61fPm=3csOegKspCZRaXo@k(bmDA6TP zcrUCdr$|iG9ZZsmf(+-?L2frz7XGsGbW^VaeC54;6tm!I8&Crye;eei+(-U5C zptY3y1!aL*L2I|P=+A1{u;4YX2XOU}B{-WYnA~Kg`%8I)SR=Om_-Wzyf8yWT(iuTg z|1iCZojXkq_nB%-tK(P&n1L${2A-_-V$+hz6i2P^XC!fqA=VRE#x3(1@4*$TP|n#P zCFK5;5Vc*XELcc2+nLsBCN4aw!9=1cmgQtRn*ag)Xy@-HACT9+#a;cTw1Ah`dQ^ct? zt^}s;xK;zL$_0dsSe{V!j96uzBkvD}Rx34vK#X$qrl# z9pCL%`dZ`JM)EukEApi_4^EDf;2S%-pgws1mTBwpQ~^rP(!n|FqFus}KDybc2m6@! zFk^Z|p-N;7d$!4^W&2l-G4TY{A3@R!zPZ%BoEg-7pnB(4`#~th40r3bF$b+p-e_O? zUl7{jOp4>inliYAn`q=y1R~KqOKs*aI&SF&#YlTyQvpk4@9Dvf_T@}`2mpbLl^YIj zQjtGE*rn2ms?OMBSR4>n1mbNb7i|&I=^W{TdCt8qwlHydb`Oib!q8Hdn13?ZC|*Si zVmpOWc7mE_|FuAISSG_@oev&bC=&3dkpZ|T`jDkTM@gqwJ3Fkx{QYY6aNkCVEPlWJFzJJ`>Din9@Z3PW1X=gFpQ4OKPDg2@X1 zGkH0LDiWOlYqeSpvP=m`iF=EZw-^?AadhFf1xy|@&LoiB@wa7)#t$Xm`yWOISAs@3 zP^Qd5sH1VBmj1O+R^LVaO=xE2FluWO4?w^g%yZ73OVh@P8J{%8CojWAV9ctV^7u0I8~NFEBKL z-1#0Bdu=?(qYE4A*F3FwBaoq^f4s@9suV!jq?&Cg&_!{8Y7rwQ&u&eXwI}=5}aGTP(@G^t1ihSQ0zk@^lK2*)fQ28?a?^arpcYLlzb4u%fhW zLy*OL)Hs9z8D3`KHQQ8M3HcE`aNRkE{h18Ei`HDAXWvmWp!_|#Te{U0RLhS5fNh)`oX{w?fv2%OLOSu{}||A_X!rr)2HW`o1-oglup)WD65!8mhqkmSAlG&il+gN|=i^ zhNdDNwnJ!xq^2XHI>u1XyNahW_4S;*lzj<}w6^lo=|mn4`(Z&*v0k~NrpFSDrXpaO z3UA6zdwnr?a7vS}do-0zNo{!eXTddn$gU~Dk>)NL2>oXsZ0hgVDGOhqL$}|(5$QWF zO_T@e8a$I=<0ef4N#|cA5#u4|B4y`K4r(%}Hmi60f^wnB?YBH()SRMtRcGot1({@? zgT>Vp7EcvNv!b>q2Mb`IzqkEgP*_hChmI6BEd2zVi%MjeVK`bRt<2~)6Y5uRmiVQ= z9d{eZaq%cRZLYD5v#>da(EeC6Oj>Havx-w1?50!=^OTy>NOVY=r5=rIAhC6tUr3wJ zR5q1B3#Jp?Io3Zuuw$@mawjWDLVGC~`>~Or?9Q}sL6$Bv$_}PVrI2-4IO~$ z?HeCmJL(tpv!j^ZRHssQQEgtIATiU6II{R{w^xF1icMVp zFsH=^wymqpb9^*)!09i*-i9E9Ytj=&lj(?$=!JzxH(nsB%^QVRpp9Wc^WkC7BIn=Dm)jp( zoIIOO;gotN` zr?)Og8y#LCmEGJDJ^kVJxottz#L`lCAa$p~qDAM|or`O}$b1s|47=FbwCt3lR-Uyq zRZQzj6KId-x_P}pb?XHO30JEV-fT^D*2ZSt&LeSraQvQK@Qs4zjn#Ri+nr+|*(}asbaWV<%}kmgUYBanY9Q4q+T!eSEQJ)t(&>Kkvs5y# z@IYpj_!c9`j#DxbQ-pUgui#`_MYbWGHuaO(`AY9zN&aV-Ut<(1GF>iafQ3JH>8J9*9Af3ql+NnsUM^Zs}D`raY@#KOo$i;85w zvE&UvDho^8+a?E9UAT|_V$?fGa&<2=;-%OL4>?>$1{D%dy*e*n<-;UOeDD}FhL9Tf zCdG(KQf0)jGMLYmaQ~LMHJX2-Q5buH(%%QZP|6dpoR1YVjkpRxu}(BH62fg>4EI6 z-o(GbH0@y;z|jZcKTwTI-`8xv*07BtW!n&prcJUi^D#SWzRk;u!IYi%-zS(yeFK3r z5BcJZCBsDgZOq~v;W|M>LG{rhNMXb|+B8?FVvyZHkDL0vV+JSfms)1}xuNJ}hldP0 zw$6+fYeo>@av4YOp>$^C#@{EF46skWW{p!GnH$auGp`wAVsIenw_6q7!@T^B?LX;h zD;6222AQe3)#fO&QNP*%N2q+xvxN1~6Uuu3R~R@2$}9Z@?Z%;7&;7keaV_XiZP(BX zK{`|udtHJTFZdXv&nKUtcaTQiC$xEUP7O;;2jISg%NSt8DRdy)$?iC<@$0p!olkbX zCa{CzFF(4FoflH{?|Wnp|dD$TGIC3w{EldU>!)z6{U zQDjB3p~;R-#mY5SDaH)3w}@%T!>z$`?f1S#enf}=7~eBiW=j5y9aT1YXe6RYySSV&VXEM^ zTOsJy>gz*x&v+`kC(zwjj^AYl2L@R6Jb>4xlqz+F@X^xRJ?)?q`zqw2x}Nce#dcm9 zLBL@pVeLT2mD+hmAO4Ag_s%g59}4C~a>71G%sE~8ab=uL>KOrF+ebaRW$b`wLqjCj(LM10}s?cCDBvfTU335O%NDV)E`sGj!9tprsJ5Ah5Nb=!cY4Z z%TQ@vX)%UJ?FH4bKie_LoF3>Gm75EVED;BUHKUX->WZ4nh?*m@#xXspdoDOKx1lRj z9pN~t@Z(88&xPFm8*HeEbw~)cYwHcqcaBX^GdB7F7$b(Br-OlZNtia5R;g;fkm%``6UHwnX7SkSs=Ud#T4pyqXTKeS$I^CjLWVrz@nX*r%GEFIa z|0YY29ntJ_kTye_IE=t@(i(n*61^3DiOF0Yk4dCCE3!krxnFKKHqa3+`JWWi;xxE#x*e2BL(; z7B*|RBlrRfgJo7pPOl)yOSk-Nk0!XYaK$j~Gc8OnLCGxgCL)v8d^Di3H(*OZDjM1mfp2j|P zAIorNewzjC*i|)3TYg*6h@p5HlM8SJP)3BDbTk+{4dV-t^R}m!K(6eK|0X)^wBiZM z>Si-_)GU-?I+ezi4w5e;{+(HDaGpN)44f@#1fZaX!B z^>jXC2Hzxe3A049U_tV?6x)Cwv>pD*t(~B-50R!#<|K+B>aUmyA5Z=t9^!Bk8hCr~ zFp}EpqFoE_O7!DqKAlMP29q63E1x-NH#J?t@Wt^_S7>aP4e)lFayV|8sI47zV`vuz zhJYt_w5lC>kpSUPA^{_9)!ia-;-Aa~S+*E~7x{N78FGJG{>19%D6To55_%c7@m-l# zs0DI_lHtG+E)*kAnKj}WE{t;sj?NjO8wut)ey5f&nBa%Ww@x)cURg3KQ8OH{Oo7bb zkz{lP*{PJq!Q3+eoS70+HzEUZ1SUj^!aguO_zgqx1Q;M)LztqSsR`A$HxH;WT2KDp z__iH*6}X%SyMl{7sLteq7qQ*rIfwMcsa#x&^1S?Mk=(9vilxVoFzkmL&a_{NYi|R- zCa>Y&j)VC{j=ob{uUiby+43XY+b}VNR1;G3y0iImVC<7FKfNH{a4TBkb6}i3k~pxH zV+r`+Y2{@c%T~ko-mj(FTGS_Mqwt=6Ts2WdT_~Y z*~|=k4W$u5;jmKBJIZ?K=0hp?RE>{g?*tP((+@NrM&OS($(9-{mKXyAqjj$mn`HBv zQ~LzEXm$P{O=rQ?R@=2(+}(=1yGzmH65v6L6n9#@xI=Ic7TjHmySuwnDDD(@`_gxu z^9QoW$k^Gr_gdFAryqMs{=SF+Rt0)QchX@~c%@%^!+9-U_<_lPv_faH@=^WT-3!?A z%`wvB-(gQ-y5%AuAH7;L^GG|+FR``xgTUKnLC(C>2W23}Xl6yak-2xngU|ZS-|JKZa=7j;W%g8^ zJ*VR1J4t9^(|VQ(^Y=T={kL}cU7ky7orbmtri1X|t$_Vpr_@SQN)wRaG2aP{njo1$ ztb{3!g{$80jc`y>!{s=w`S)#Kni0WbBx~zV_c-3I6xhQAIr3w~+O-NVF?k5cE-mW~ zR)tJi;+NVlz6E#HMxJxeW`I{G zTpa{#t-_`$7@Z#cWCTd6bch;oLR&Vlz=4mx(c`5I z#$WHpU51qhNhr-AB9CYa!CQD+n@cmmqK!t!A39|;u(Gk+jF>+nYu6n8*8faICiY}M zSLrfmIdsT;M{WlrCS*opmTo#8>5Yp=1rT|7zLy; zX6D;mHg7YRgw#*rLZu8Taps7%_VwV!^u<6aU<2?apIQK&YNh7N{do$`cb)*5dC`CW zWsrkgs?<(9!LCstjId{HE&T)uVDcL(BN zIrM+G3PF}@t-OT(n(ZStS|THy?R&oknPuNFlzh>;9$EG~u<|>&9_P5=B!{My`h_&8 z!uA4T#a^sCbZ_KjF6c5uI!CK2CER%`Q{dk{Fuj*1`*nTW4OYiEsa&0$J?+1=ia+Njb@}^k`%-%%-iAVTOsC=VM8`pYlcr}V|@RI>=wT0 zm{$(hIn@4+IDCAk1Thzj0cYAijm*ypuZcsfCW=W?3G1FyEZc%c230;wlSK3q!{v@* z_qB1JLR7%NhWsVLlY@N}slH<~S?{HcQ0ca{XV9o7M-yGg#Tih}Qjv9r+!pUA6~CHf z?L7ozS27&BbQMRFAc3*QaLz@blFm+&M3 z)#oVaIp7txwr=}&(XE>I`{wSAlXb}qQoCgVQsF0vW2h!Z90qUjxS;(#$UY z+|~FxW6^-#kwmIjXwWC}>0ReyHlB1!GdA2wNBSR6&DWG~TFyPyxK!)=hCBRDyvd-Q z!mkJwEEt~kzRps-sl}043Z7R~;_fm?AP0I*0YD-Rs64Q4J$YGEXr)Lffqhqq{+EcI z7x`|LZmlPdkXmZ1R;GvylmU(3jevhWCU!LxNgIscUzeQVW7)g!-S^+i_o@l4@aR+Z zl4A>lTyZFV-;g?VU!r#B!d(#jr%k%DY~y8E|Pii7$*;UjUs_{-1L^pVAU`B%I{;Jwg;VslRzm;BJlRKT5ho+bSBz?f^2k ziVS#*L*6U8pIHQrKQ1vpX1qNJ?CF+fvgYpaiZhx&j^;9%1M=qrr&WKc zeMMae9&$;0h#Zfh;7-q%}n2HROjeOI}{B~WPn3r%Zcs&cz>~hzI6-P86m*kxF^lT6uAu0 z4a;xOVks!o3q@M~+p>$XEDZ?x#l**A>Tuz4gAuldsDVUwV}R-`)nPwc-MwHStFY<* z$G1E$Ur0c0(^>!S=gZHz_`-cC7qPUt#}rpFfu9$eM+RKo5HRZ)SoffO3)pHBS+gFu zt1JzCOU1sRlcGOs7+0|VO?ga)WOEp-o9Y1al>G4ur?j~^pFu$T#9FagW)Y$t>q<`O z92)&mO%*v8L}W5L^QUGAngd_jJV##14f|X)?aFQTUmM(UCFw)&Z;S*g?d7I(LC8f> z_-1?XH4#Im7Du8J*7mwH#Mqr`phLvHc+#+X@^nCKF7DW)uiX^3m_SXABVSZ>+tlcFOsnAq zXDgD<9z(Rfq&zu`aQ^W&ft2&6_HJdQ%pBy@69tYthqCXEuzgGIJdH?UP%06PY=d-| zDRqQL#vqo19wcqbSnAqKC`QoghiSyBs`bV-_WW3-?R1!^Y`9 zwp-M_SF}i^iey!@U;#AYWs)dlzY5jPcNmCfdwDA|slBpT)5cO6f@&JP9kL6T<=ay22isulfQ&@UAuzN0tPGY#87q&#S~jL(9eb9gXGLn#C_=+l) z&1+h(n1V+6jY*HAQ-_|kU$BT}@UJTlAr)oHiJ~wY^He(fq>nXWwYJmFj{~jcZB-Sk2H{`Q~xJ^!6>ckvHxARGAsR-wYuN@zis5hL! zY))4~f7XTooO&rE?m6rXx!Nl1y~AGC<7N14;!s5u-_ur|sY$HquW1F$<2rscC(v?o z!70dEx%_>r9|hA#ALvsh-CubQgv$5SwAmdWHx&!zI;3Jyk@9l2;UhjyL^Ldq&U8E+ zciLvy0d}`YOi@~4=)|3OhHT1}88_8>Sy6x~74=7?TWs`Lyj2)T93m2vJBmzL=nR?1 z4ENil;gGit9+|ycIG^wav{Lx2AjRN1eKx5I%0+C`vG`(h&14nu=M!RyYoyQx`cBAY zsVzrz2Y45-`W2!ulMU#=)1k%@=XO}!ip`*^xSm<-qUz~y^^frx8@4~#>B3{7_YLy^ z0p28X&7rb$KekMN7HWlzLZ<1u4Z3U$<2YFLUiB$Z^{jkRqoya%NZHogabW|boN&MS z!MUaQtd`mc<*PIK-3gtnu9pps11y;xgUcT4REHjkh`hy%!yG50>Qs0K%y0lbaD#1{ z<9;$C@5aKNPk0)dXXe7wkSeLhyfYZZpBGg?gN6D}iYW9}^blOg(O-|D+4FG{wL`;z zVl=*}aV}p0%&&+@3r{ne8JuB6JBEQ1u_!2Kg|&_WW=)Jlq9)THo#()lc2k&bv_oZl z74j3IX}bdy+piDEj>a&oj#~f{$Xko%9+cRrxuSDKvVYmsdB=VPR^*PyF9|Y^8CJ&; za$x43REAsltAgN~W*^TWL8i}NCZ0lS#`icv3`aIkU$)D{+uUzr#-5$ zL|`0dSlbeM1T_)NB=tzaUFHvzL~+f&JWzmc455yOOt}DS^A*{R*=I+on6aeXB?oga4hd>xW zWf=ja&PA(l6a~JaBWRh(Fd*6x2C8=5DO%(@2N3in$qK4EhFT_xhe|lJrgaSR7Lt6) zEkUR^-m%jtSB znoi4S5^&_DWGA&pu;#P3+}1pD!kPu^7fm8pfoui6eA3?QD1?;l<#(Hix15mB95wgDBqx zIRS$8kuJm}VzXt2!+9TisN@+lnF=qxy+%w(R3=JkxH-!6g~t_ZC#H7H-cvt~J&1@g z5$vlXJ2We1Tr?q&nYfvQ-NW}e(2g1unAAj9rhJ%zm-!AO?Na8Gzs@NL;ouz}2la_~ zB2_lm2Fwhck?sgLZUgUM<7-|s}E`a@i=U%bdu7a$F2sXm_%a4 zF{r?_0`yUhokXJ`=dDBuxOKj>lo#h{CW1>?~NCSlY4Zp#Y5bptk zlX<7Mnu7$Na)&E982t`plZWw|NB;|B<)!*=J|+cR6~oW6&y&e1r0^uc7ghZac~3$N z@9Ud_F(x;pTpw0(Ql|HJ7*2oHnb$44j50C_r8J?!hZ3*RY*QmFv4kq)!`1mu56ZwF4L#qb2$dgcxzyPKnb6G&Ht#j;xlK^%C;yq-M~l} ztkkAWI=fo?o5NZe=e{i%u#d*8jc|J!+rbY;Cb6y!O`}`8p53%n3`{}M_74RpO(obLLZ4blRiq&>QYb=J#j6VBa6kp(hdKA z765|=7vJN}7F5FhYv!r}wLvEWkEEPL0r-jx%wTRB=l`>xrpIuHvPN(R87sbuH+;Fde+C2q8R;$R`%=LPE!T5I3&&r z@lpp~>4euuM9yVJREa#rKbZUKg@!xpd~p~aEL}NpiS=3a>?b)LkgdW=S|?RW^{cV0 zZFWJOb{c8#kLf(V}KNr?-S*Y$hLIk-2Jjwn2iE#=vL zGJk-TK}QBon(Tj44)wFpg%NeDw+_&QOyy)or3FYE9vq~5O=1AlMYa*J6*1Idd1WQK?b2}lu-J)*8s4CFFrNE zsCxA)VfrErP!%;Rhm?RU>dA7chL=52C>zna%garO-cdJ*i6GELL4`J64S2zIIgZ*_ zD@*Hp&fZ1!w19oCb!uJJ?sIrKW+(L}!AcSntLyEzdsGvNk|r{h+4ySW#I{Qv$J;)` z1Mg-ZV3xi)#)&q5$6mkH{3zn4vx=V|jzA;Adc%&kd)9ayc}BJRA?q97B*BZvcNabT zPulhT$;$?RSMzt{;<;u`p2?B3dF+%D&pry{?s_~W4}_*YW6{5fx%Uf&!kRmnSvUxz zMD~+Y|4AB1OaZW3WGHR}@Kk%I3(nREiRV-1?&I}Af?iI?MFw7jeQk)iRb??_l78v7 zCHu7a^}fCruX5fKS{a4gm|26#=2Bb4;!g$i-#XsNxSwpk9`V^b%3{}hhZrAG)ge;G zF9ewuL7khdHucK@Q+!~sy!h=H`e_3_c+o5j^F44D)I`OLqEK|W_ZS*}L$S+$d2+dSOUCV z!#!y46TSsIkC&_mmb@&|JewPwy-~i9vxj=_BoYv5hVB;Kje7HuE9eo*g`SlcgCM{l z?2YfOW4K=dDs2+C8Nd?`a{_Gpp=!|o5L~HzSTbqg=JwxI0YGFbMC0e#K#2Y$-PN5E z)MZt!|H)u#x19y)2BLwumO}0t&Y;G9mLvBp{Iv?XeLy&L|I2>*PkuMtZBiWPLnT&7 zJIp}PP&F){e81-S;07RRe^W$l8r)dN?GcY-i^5=d@_F12d!kJIJ+IFlN*ZQ*b^bs) zl%&sW^ygi(QaF=PhK*XI`WuJuv64f}HUjgpx{)lcQ2gE1Im*Eg=Fy+b`jiaSukp~< z5wp>HS*O+QQ*1LPn3L1@9*t16?Se>1e;NH~C%7Zvx%~lbxXBw94ol3!8FrYea{ATH z6SD-G0Zm~!oizeyL@!It)7QESRR!61rVs6y|M*d8p4H8%KgzrIhA97vi0eQD+0dlvE}(whj`}!ivv}2y#W;bGGq6*|#!#|G{&sWcd%z+@VLn0r;f$k2JeEdg+Ylo`yOG->!p}O}PS2!I6ZuF(4;2@rzp-ZU( z@!ea@)-Ib$>x^fgMisJmgF))TlTzjk?T?CGe->)C;q7zcse0n~ZYYY$c9zS3e-~PH zrUWkyt<#|gR&P{v!2bLb5Hx?DyYs(vJ|S2q%)uIa0Y^^#eR&t)ZtpD88S9WrAMUw(%rTa5d%&!UAZY zf+8`*h|q}v!<=l)(I6k=mnf*r-i5ENNZw`m?;bq?!%gQLHIpn@_1>96lIBUKJ`8{(XyArC{yLz(lk?F&Ay%m zIcpp;=n!~Xd|ZyjC`Ueyx^RurnrypFtT}~NJpVPE5;+n1Bq;WT*IQ>g_TDQkkw|B% zep0+Lr@^(5k<8MjPMh;{yyGRuH7vzIMRrAxU<89Jb7-vYiw-{o%};r1?5S0bZLFIL z_dtt18{}XBZc1us8CI~5UyyGL9zzK0UF$c@@gPOI`Ih0@ym*e~4NE^rONU!bHNBhI zyb5K@jj&ysi-Hv^(PBROh=mlS4I?;fex?K7|MO#=we~o|rgfn0&Bnn4_=FkR?9~;4 zUE&UHqCPs^>uCz-6PYW>G+L=oshf`12wgZ5e2gqJuwB@mWw|J5Hp+_rQPjupCI_5Z z3lV>NWU2<2-I&a+Xo6*JJ8$yk#Jk`c&FL!?V=_m!G&j6GkS^J-J%HJ z@?2`0@Zl|r9}=*{mp}l}X2g+K+e&X?{-rsQ&dti}M-2=v2rN=E71M7JdXVbOwy3M*GVh{%3W-;x!@_ z+gaaF`hD0;5bht%7<@hAc`{3u!1^H76C-UwhmCzXO5MFUss~`d=ma1N)u`V*8EmP2 z;3O@VT>(@$X)JO9Gu4I1Q~zh}HtUEKFV|zk;*2TJ)Tnc=6B@*a8s?f=)yT6k$LMu> zomNd%YFMZXzXcA0H^pw373|=$gWAS24iO6k-XwAf&{~NoU?wEP2N9^j>Cv2xS!heo zg=mP$#DtOx))Gs_bERVE3Ft(n5K6GGQdtu2i^mr`&OBdcD2frjhFj!d`k2l7*(?4m z*H|yemT}WHSHf6d6zY)nhWUx{AFKJJVCL|bdi#+ZAD#xpA5itysbIVSPUWrt>4XFh8U4@t?#nq0doSj#&3Mmtx!0QZE1)Ae zLP$K*XERbm5s%e1GQL0e^Uh-HE^ar?Z;FGC&tK)rf8vw5$`#!o#JFQ0mCK>TyGwU` z7N}$eA(l>^yj|hxF|fdaNJr|+@zcQvW+o_UUV7;Jv?iqQJYS$Dy&POUK2a&00B&%< zfSUQ1I?I?ymu$2Wh6yBhq3}U)Gw3{U=9)N5sZzB_JkZS6%t)CDXk%DNxXdlmPIcWJ ziG_2lU3i}JQ#G)mkt+(3pAx-5uXv3UBu%nEDSmfp=m$KWsW(f!SDzS2Fzt|&mUL0j z-yKk^f{Wz|a|iU~BB-T4xe$eHC;rGp9LLI3Q6`PSL~{y0?AUjK7z4NWm=2A_Tp;g&7TFKU|_r=k<< zU?w00vXM4@ew?X2DGNNf6Jznjs)!d6l3r`12bg(XT zG+Zt;e&KyM6cJ~v6>k{ty{nrRQM z*fCkCD*)8tN!@?rMZn|~v_U*u z<#!Y>E5rW|bx)Z&K^Rr}3KNwdoZIteVu9t4k|WyO&&2atpHZv>zZR@YUh>FDnQCIu z@@c@8(r_z^nwWxVafjUdMxPkOpA=G~C$MvsKn`My&pV&GbDQOH<{1H3cu9GN94VU zPFaok9fkRg9D23>+$70aHv>`X6cfo@5>Rb|mD-DWNlD_guS3CQ1->h5Z7*rg4+!2Q z;he&tP6k`=jx!66dex)4%~>S_ZYm@ZA7&Gr9z;_Vk2E5NK;yA{wPmsTcJ$npH{zE+ zZySGBhc>U_P;uvzT3F*7ym!2Y7dSe)cgZelR9Ojr@q#_~+bq{#N8(2ZJ29LhbHI519SEzNpMn{K3bnAxAfD-~|nI*iBm;B8iElu45U&iaZ4> zA^P^MA(6Td29&hI#2Yf1^S0Fj@jmR4;8TZ-g##=5BZJ+)-5-7w)6RY*+U%=qNptnh z3jK=Av4p9yqnK5D$Fivt+@Y}!iq7)Rlw6$%LXOP}x;R||Jk}-$P(*t6ms9wMnFDPP zANxk{MdLBk(|k%emBr5wfBJm9rj1fMTkrnu>i^z8l9*Y=Xof>_3IZU*y zbVB&Xd8aMPpmib3kv7AW4sDzJ(T5%e9+758ZUSsUXk}*lZ8{C{rO|2DZEjhp^wKKt z?6{7*x)3xw%nWJirUn{Mk-%c2lL%;F@dXnk|6{v>ymd&c3fS)O|3DVA|0P+HB<5)~*_oO4sYxM}ml3gZsY>b_A^FUYD9!SZ-L(f4 zUlz?4&sC%uUO(jZE9zDIxMuve~6uY4Y36Yzf9~&2b%^l~-{>Cq<)U_x~X~B9Wy2y%uERFVG%RIEbD)a^T1lIowlghJN8Hc$I1El~J&Ku@};#h^2 zRbne++ux`>JwJEP(C>Rh%#FEg4%ISSVVz8@B+@jzI!tyuJO7sLXf10JyhcW$9A)p} z%p_c#9A8}Er`rspY zB@uQ~io+A(^7pP1&9^FBNWFz8DW*8Ht|Bjd@&f?m^sI&ss`o_xL?es<@&j5GL`;@P zYf@?SE~=g}_GG~xCvG4O@_;Nt&hv!j2sXRhgXSwT99itkFeI!JV(IzvFL1J+Q$;@?cR_kiz{M(U%KRAs_i}jJzvFX(PZ4CeJUPAm6nb4Xb2rDM{&hX1h;QS-mx0 zW0*nWDM1{kz|l>$dg(^rS`23`%hU^u2UHH^(`ocJOft6BuO%W`8#i)EtDC8G#+>2PAha{ zMe9$D0Y4YRs%hrADnqq1&@$AquzSn3eQ~qKR8`_5RnBH$cS@ve{r-;AoC+m1kGW|HQL(OS6WMPXi>UQ zvcL+eUG`R{e9R5HP=zz%lLkWZ(tZhxy>WgWnCLsqSZ9C+BAT!g6A&}#fAUTaAV|-|;#{BM)}=hj>}7Qn zOXSeuooG@9$!OYJ$m&1YjA((^9y?fq`y(^=qKA22J3-O+Eiocok=|7qW1%AUb!meAS+?+&$f3;?j$ih)MU{QddE2^oO>BbVbHCd>pxmGO_ z%tM$wPfnIIqagHBWl@+Nu(TO{KykHuSs(3Ir3|Chln~I;Z51>;Z4HhHQE0|0p8^XF zu?)Hgx7c0E8M9mAPyTf&1kaRDp`}@5X>-wYt|HyjiuM3-5x^*xa4NjhM16Z7I=p)k zp-|L3vwc*m2{mYfz{_!bF8}lMpdfZ?kRHLEBoBNbiVP*XzG*||5zpta$x?9>>WPJ6 ziZ9!aG^Xane;WtSiPHwGp{3*6de)(63-0KuT!;Ull2bMW>P4Pg*k`V^s&X`@@G4aF z6HQb$JX!R7mTk`?F4p>XRD?W5vKFHU@~Rmau>OL}|D8hyS3)|G%5!22N7#~o`1Us; zmmm8RQC|d@Y_KSK#~OV$m@-q6XTk(Vigx08Y$iYi+B8=sUszZgn+5r`K{Q~GKhRCD zzUuLcz7#4Uem5$;l~t5U zq<0}aZ*}gP;NU7|>LYt15_VJ4+H%Jik_9Wr7AU#Su`ZH#Ey%tdz zg``H)PKCB<+~4Rkta4zQt00rPfh-rYnJpHWQ4b6ayyr#ojkyYCtwsZuN-hkA6kf10Dn*`JVKNDTLA5!$5tnmU%7Z(m zRZSelk%^~o7`I;MH-UUDTGx*TTe`w3`J!#Lk%b4Zx>QfR5q65oPzsf}3GT%*d2g6k z=@mjxeQQC9$hEab)c~L@sBJZu6E-iSM`t>5;QpS(h{7A*2m=wFyP#tSV86?m&KX4e zP>$n`UIm6nEg!Vy-`gQ(fjhu2D_cW3XCk&&uUC%UG#gRGME!#$xut)qm2;^!b@@99 zPVf6k_C924Ap&sNnL}v;LWU1JN3GHm^D#%doQ3(SAr*k}Lb1|#WJ+5pnym$A!k99$ z{c|o2rDV3DH2YEUnJ~1ZK)LBSDOnYLgz}PPHadmJ=Q5+v$b?Ok`4`c>3gIj)yu~i& z#vmC`HP7g1A!z4o*XT?iuTlt<&VL)iT*v8I>4YV=@?2t$%*O3=LB`N}zC$#P)Piub{JP#cq!`_dWjKkN;h;$)80*-XrVljbA421{3)q@(q335*_ zhXiRK7Sbu-NwJPJZ-$R4-7qV#Ql#IT3P~A3QK=Kkj?gD>)z#cl8pv3os`MW_x~Q^m znguHF=poJ@FGrCtk3c6@-Axs1?csdH9fz4vU>Pk|u3?SfBixi(hk@7Q=tm{sTDSMd z%@N=GgAg3(@HTH{Fyrz}LeMmCa}AsG+hzcIqsvYXN8k?#&sTwxq7k~7hyhOBVJ<+{V4n%~w8lcPVx6J%;&US2K;lUB zVO-RfmfzC+-Sz?&N<9=^xiKmbqG^LcG6B-Iw8+zA#80kezI`ibz?!)n++LQjz1GnR|6r@36$06Sf1KZQ1LeaBc)LM9U_s1r-( z@G$(G4iqS~HIVXXnx@?TX`5uUVO6l-l#bEs7|Mac##Ez z5u#r5Ee`U6-bK*VumQF?EPd`A+5*-4Vx=U;hYr6>%Q23wn0C(c!UQk5>NG6MK7Z+GXGAaH6Bw1 zrsKH;xv)+mq64BcIeez{W3B&W*$@W2PdRAp13$pd7&EQ}fx16AQ{r04?aE~blr>f3 zcumKmmss~`Q%H;t2MIom?e{q-hZC7v6TS4(H7C)N?HVM;@@5q4@_w~V)brn88D>Kz z+?fU9{`%zXdpl_BY{ucn%pvkH|oPC@eArn`FKGGD#%aCnD zy`hr6v3=PRDTrbjNj?R|xiLP~gGScodD-z@WIAz{f1ud8j>~hC22Dga-z^{Nl44(` zQ&W(bKiQu~F!Q!$_6IU+jttWw%y4hBEVdFuYBq0_1~>Yy{KXOildJ~P=fKs^ik_hz zq&p-Hf^I$LH}o^|aMT2g027gnlT2=?OrDq1Tq#umB6CGw(s zRG7!hiaw_?!CwqCI+ALp`2V1KJng5l#1{XBxWJ!dB{VRQN%t`|Vo((#%vOYTh|P`6 zV%?r`j-fD)*HwKn87Y3J_zYVC@XJrWZELh2cSGbpTu#4ve7w8GNvQWb4n=}U%qN{6 zy&-{FgGM2#NIxyY$x_`+B5PgtC+m23TsG+{fAw7%ys0SHX%7p$&dV~G+m!UiI}`ih7v)Wi znEzotrR{erz6OTN3W;_FEr@zh%lwzmCKRvKwXHy$V2nh*r0(}4hmx=?Qvvt^DudpV zk9|peMXGXVKi{smng-#t^NaNqSP}X<`F2%3YogCHKPEFBvn_6%tW})bqE2dgOz6sR zO9Ag4aD4&V*PxeerqQ0}-wblHSh{YPt z51L1hD2L246rkyf2CXnwe%-YwxaU8JYII>GHFMhXikpDjA?^|>6S-oSS-dO^Z}~wz zaHw<#{7!Qg`TJ$qi|p-Rw~EXOEWe|0$TM)3GnVkX(wEGAM+M;x^!<5P9tLz7X4qJk zPsC{t1qg!b%!!=uGm&hhqLY0;XHzHsEi)BcPan%T0TI_06~<3Aj=I;9FgjwLk;Xx6 zMxwG+_zfuLbcslX6>&M_mj!|lWtXpw&QQxOg{a0;J5WuOTl$f2|S9G0cf}_x} zSsDJwfimeTS3OYV%G|yrvV$FWIsb*7z;t0~hmcH5X;LZoTf>=OmvmIel7E{R3huz5lGe&x!-!3Z@bmT<6o7J|)4 zbKQC@GqwH^F{C%7(b$_rC=(eTMITF&%#3-^C4cyD)2lAr zMYY95oA2g-+U&>jRw%f8>pXPxEn&X|7HxK&)4mjKb~kfZsP9wUO(uEMqXPj*<|5?3 zD7UKPstYDFiDmU}9Q2t`gP7^fnx~xOSah@0p5W6m6Qyk`_j_2yKJHX7ICaB+~pk(BShrtVyM?)2hph17Euj z6f7VPEZdue<2(z+qJAjxLK}0S?i<&7!%zM>0uKKG*?iy(3A;;{A_Iey{H8Wx6TXHW8qAu>G}$l;Nbn**N?^=tT@5 z^-7ldulzKvkap9Z9$}><9AnoMa%#(D=O9~CK22qynzf@Q9sZJn)Bvj;c+oo6gj};2 z)j!QX5}8kPBWy33$rxpJVm9{>LQpJyz<_2BFRwpkqDAMG+R5c>=y~c{x8M)W4jQ5G zczuQf6Ss-cW7`=kPjXJ&nkEPk+J6#mZcSGb47Kc?$#keS0^%`pZq#qxg^>WN>~4m3bl7N?8H6{Ggbr_|}sv*i=6q2uy^^Aj~?iaO|5 zw>|1bE!R3|rI#rAfigNKMHOHZ#D?Yh{S>AqKSmsVcqWptJ>wOw#0W;cD{0?l+}uiX ztmbZ?#2+g@6ESx(9~GrO3MqD#-=&NlZnhVTiFYSH#6i*W@|?F_Qj)OGTtMn}Z~Yb< zDrtcxAN~7JoWdoylP^OQ&0Ofm&}J+y_$c_HIq{OH!LsH-;j;B5D_U9$A;=QR2=wYw zinql3qf5gbE!nMAK~LR6As5_skW&n*)!B13oBmGt@jN^mz1H)y|;-$sC1t1z#b}EG?Xg`!{>Z^EOVMCJ4tgL`gp@pbEka zDDH~_o0hT=yz2D-m`>s(tD`$@gCa!G}yZL3Kup0EX$;9M&iJ%e)5m=3!K z6uZJkAdW>og%njdTqqVPO)`t`EJg^tHdpq|qs`}N4fA9qKU{>!%>ESPF>Df!HIKK?q z$rGse<`t2PH?~cEwh8OMl$*w4dWlgXt)OH#enwB5zxLs|QBo@SmqC zf5^Hlj8;XTI7xHy15$k~`-ne>A}-bN?>^B zPM!a;r}{4a2myD{=qW0zF&4#Im8zmZF?(E;1jAYurxg~loI-p^D@E!6^cYd_paUUoDmo|@P>kJ#A`JrrA zPFnCMCDH%WKE+c4#Z`joDf@K2j?$#ikbv~xw8?&pZag6>HlCn;s*b4HFtJ;zkiW$l z_Sc1b;$4&d6&2NOCuOR><=s*^#AV%&QQePcR^q3I753rSgzAEZqbu@ao@cZ2B{AkC zAItu4sp?CzIN_(lh0B&=Y$szneS>{V3e;nyZ$D2;wl$`tvW>kq?v|Rnw5~;^<9{Pa ztl+bU16}}jzlO%yu$R7D8>9D%a;ZmQjf9E6nr!c?qFVmDWE7_Fk(6&faTq!2lZgrm zCv``*q*PpC*c(LXnmaj)Oa1EL?Kmx0eI9S$qeSQZtZClEzS=yW27UN5u$@5gZ2fNq zD9m$`Z&}cQa@**>E>&x`NsJ`EJenD;EZ+vDx~=KQ?Upbab1FM}_xox0->g>KTXiSV1TwvHl~tO&Fk8qEt>7@3dNES{R*BzW&}{ zoWZ1=lKrWkOY&w4%pm6Dz)WbF&LuB zCg>JL<3PH-YK-TGw6Fifw1odh(^*Be)plDLx8iQaid(UwMT)z-yE}yf#U)6Q;KAL3 z6qn-e?(SaPt(@@vGmLHsF7#oKsNct!}1oBrqHIxK$j#u zs%1Ee^9*(<7C*ZS;R`r2H^hg!k!n zIrO2ORlck8p^OcBFp^%w$!kQf6-ahc8@A)gxuS<>k+dvUYt;BuH$^TId-w0;#PFW~ zvs$Tc1N+wUD}-0X;#`CGq8{A{(3NZ>_L=%+`2Fthl1dFV^T3>z(dq9oNe`tAFsi-( zQ2Q#?&nML}kw!QtCr|&87JY!CDc-kp-!JF5nn7&|;Bl}K`t$n}Z#^gpQ!Pzx!0R08 z{J}-b4WCi4$e7VYj7vQ!yeZfN+cW9h`6`b*3_IF=tZM&rPTA)Aw42@EF_tqG7|jVc z_eqiv;H)k0jB(wAf`r>>{u!+}ib8t#unZU7EnvOt79A7B9D&YBcg;tuGRK-3A+Bz%g(|9bFKy6O%O zga&kP_o5Li=%fqVLz`h0O+gb#@Jm6Z^1+XzM1>NYXAgKQ#KYD8<%onpfd{oyywXhn zXVHZA10S5OoWHNw&Cm)*9*u7zKr9_H4y=Ev?$y@vhZhA6wx_r23eq!<#rqu}m z!h4q&$(+j-|m-^!Fx&{}ukjK+fgKCp|2d?y8ufblHn=u8jIPs|we zWvS6cJC+u2I}$okblx1slvtzPsmfcZ8E)oY6=-;U3@-fPRa0s;WTUsO zZATo^4|(;eaAuN^Q5%~76P6&BIrL@(>v~LI(FTp(Uaw6V+A=Twbd=$KOBNBP?RMGT=L3!K}-X?Xl0v4 zY%Z8;IZ4JrNqB5{hyZTYr{!tn3;@;zlB{)jex3~*AW_~%EWiYO3uO&QdxCsc5-f)Z zpp}S)IgL8PwP8HL`>q*jkZk;rk2RZYEH(%y^|qF}SrMGeBqU5@MB7K7n#UV;PQk}( zX@yMfLzGAv&|b$}>@ia=ClKWz3F}6hgUAlP_yPij-w|f7WVB8*M<#XWx|OM@>{1Fs zgD61zcbsVzH~BW7;DeD#t;DTQWOCW|9wPv=*b(i|H=!N!zuDZB#KXzpRBjYkrrkz| z*5m!L|FkCIxaU*1#LA}8{W@yiB7&)!!;yMaN!91CEr9TnRX~Mg9wRaf14Yi;B;Fn< z=6kseq-wfd@zcH5;IVlj1{Q9I6i)ddL0m7;RDP?$Rm$L;Y--Ig*8+HDE43l|i#!IF z|Ap70Ws!gByfQANnHGdms|^Un7jBudFJz%PEX+ou9BZI!-p#fAB_TgFi>RF@{n#!{ zL$qk5p)@3Vj-nQ->VjLoE(@pesYr_f3Ky$B-&Sv})HOAm6c}R(&w`=^?F0-Rs0eJ4Y8xX;nDn zB=Kko*S&w)?Z`2&7x}6~ir>Qa%K$^i-=$icVcB|Kt&dbOol%LS7ZJpp42$LKB6(gi z8*-l2E69T8Ga{I^5{5nKMo`)S^aEaq*7C?M*b`2C*aI9v%O!dCYz~h0l3>#zo>@Y=nC`q$?jQp*sBUFC1lqWW9 z0#tO>egvknHSUe8t0Lj1Fhm2pQm_q86~A+JkgJEcCBAzi`Dps|{=kI$qMGc$=GN9i!4J6YVp2Z_n3-*|?um}Q?Ce`F z_e9tqi0vP6c$gEKdRYzIJh2L0vZU+`s&LXu&gGG=wWnrWXZoW7;bhL^+9#-&vUqZC zSD|~3EtmXOnk=j4x<;zXV13<+=V|37C{|WuG$?;!x0(1a;y}hf0A$uAj74=q(s9D% zYyG(i^d;O4H`Y_szrVpLcTZ&GnZh}j2kZajDzPO+E-TVz1$J?X@p?%NMu@?8rNJ(Y zL2zA+R>uSybM+O9T=1iHFunMS-kWG&mT{LNQ_?iLwv`T0KqzHDDyE)ef&797T6M6NY^LgS~a8r4&2ld5=K8tI#bNq z%WqQdQi}2Rd^US}*$u#*Qa(n-LCi670v8f>3A%W5RCR!}vg!?`zyQ-y3IiB*CB&rT zQqmIINI7__C_}yz*ZeyyN~DZTk|>hgKS#;vLzen^(0&Hm%3}0!iVR`9e4x z1qZrsbJ4hp{(nR9Md7jBGA0tngm?}^)bWvBC5>n#V4I@hJ8!gv5(&}wgNhORv>3e; zTxTYS_?TnfK7AQ7cLZT^)^BH<(|67rTpipg<&q}rjZ3=^=%vh7#;#JBJ_gBz!!O@B zgkf-Nm-XOlpxW>{Aj{V|VV-E$?CHWt3(tnrV@t536oLs^hGYl-(Yr_ zrXsCQs40cIc|@R)faZ`Ip1v+N@l|wW-NSZsP2&k~VnoYPFK}?n-NGSqlgn$JgQVk&=Hrlk(&-TC+3RLFRM1nvXPAP1WZpmg zoJb3Cvuv6BxBu}xJ$fYf7`h$q#9b~<^%0*ESYpDpa*NmGCs=|q#>ObTMn?roOXhel@ zmW4~s#=U4v1%eeW@5vfPHOHeZsq<73^(H!TquGuy`}wKVQ^I|x?iC<+^3 zw#u5%-Ljv*3*Jh2w zE+!c=wlurPR(MX+ud*zhjCm*eLzezm`KF!$*@^cyiF(!92qYqADkXfs=rG8H(ZoWB=@Z1H@#Fho+08Cp*v!|H zppxo7B0re$*;t_9Ll=hS_-l}W7QCEK%;v9sZo(5{|D|*o5pVI& z%0)(({2V44k!|)aHk!{}!DLQq=mI8y&9rgVdVGYD=9bhLp1B@4MBH6g?I0{xgL|B> z!!t4mcmF;S{7GPSx?~XXYQ?w z5Hj~W$j*l<9Ra0TeE4*1g1%`0XY@?w$(2`{|8Ypna4ITx9KWT=nZIrFfz8{{M$=&% zCf|0JOd?T!05F32%RVkIav35{KOKGUnB5zt9na`cYY?QE86|a55diN&Ao0?F>8eNI zw1xTHcD8=w;}vP6&+lAVO}v;-)n>oiGmZ0$je2b)y7%1Cp^aY7_|52-Bb(ax3BbAW z0=6S*t$#fg$q>Z-`==WKf=X=C`+6j!boDIg;CT+?I=W!x3I*WotjneJe~%qZybK2K zsyRlo)aiUL3l5&V&M+3*jrW_=^#vJww=g;2UI7uJMVBuk^uB$kJ?;T*%cy!Ak5v}+ zitP$h)zFy3Ib*~b!PcaOLX{ROWS3nK4@g)4+=NsBQF20S3Z}@0R(zO=p8P@QBH$Op z!0Z?{UAZ~ zH-uOE9HoqOBT>+sYI`a*+U>~oNuKdh5(C12;I!K1bl;mtU{)7z#k=km?A0W}zAbu{n{KVF7ji2uoB*sG-< zg#UjQ08(EXnQ(ZXUumptF_j{z0S)7U+Vh3LMIxmZ=DoT%TNh({xNH)^S>+eT6bL(| zU1o(x4z?u|DNvZWp6%gjOH)Cjh(a0IJ|a^~~VUKUA&? zE`^rkKP)~lUUDH8(G}=$b;=N@1YC#Y5VQ2)UO6X{Kysb!(1CK2j1v8!((_ims82G;?NYNyMuvN1hlI^% zBebV)I3^;0fc~;_Q9GQKwhOJ%C|UE#WJnBj?6_&7bTxVqe5($?I`Bt7Saj6F86roC z7-SSJcsU?Rb8R~q`D;zq@^u!~1(R$Al1+T135*#WmHjQ(+}7?7$6}c!=k9mRjux0I z*9<#20#&!6aKQxG$hp!O`EfO5h@;euA%7~#ztda3do4@}eAT#})|(N)jKj`}0()n@ zpa6+;6V>IV;(jv5m?G{wVolqJWl&+GnW2>16`F>0Fng&%4&Z3VlM>{Ke?Al@V+?0V zW?-isc9a*BBCpwiUqSfFrt2oCQ00JCR5EvRLe)p;mnVWMJ}E4p!faPp;jxA ze6>a1^fQ-#CW1Q@sjB5%Sdb>6Pn>_9-h^Lc)mQ}qiZ=onG8@lWjd)2))<3eeRy2kk z*oa~?Un|Y`i-uclK84b1B{wd(62+A(WdYsNj?P zN~C9Kv^YU~V4a47S=%DbhhTA#=`XrGHtJBZs>~{J$7xjPgt_F>q5|VFSpz+)-}FPP zMGXmVCD;T^skGsXl;b=rN|F00G>-sLM-pJDOVW?uK^b=BOtm=X=?9;vSREHT4Qj(7 ze?!GSrVRs{Hb!1@8Gc`qZSW78k@|s4x$usMN6x1wln%F#6Z(L^8sO!LASzL0G*Lng zCUR}M^?bx~nox>(3Sk)?O~L%45I#MNW)vWY&Cw%JaVSJytXVWx*gjW_^)xKS2VxeZ zWPMb=hi2u>VP+g4`w1`i@hF<<^O*o330q=74<7K(s^b%!>edB#;U{oiP7T1nuCEcH zcBX(ehtot{TukI2?vkUMPiDhrc*a>kmYWc2KEfQjzI~Oqq0DmfR<$ZOz3R28ncH7| zmUWz{Fz3*?wvQ+5;yA;sZDC;GVeIM7DpD;6BbEUz_8sgJpu2|`(3f|nee4RG(*!vwqH8uqmxe(;>8$SF}*iHrypL2vIY7h7H8JY97PhvLJ zlHBoV^P&C3Th0*Ah@CkD<=!2|r!fDb{yLTgi!^s3YdwQL`$&?|(tB=dx2Ux4Vl^kG zr*OW^Gqmy@&lSD9!_SQ%;CjzavlOfdZ}%=?*vw8uC$l?hAz}cMQpwehYIj(vrt$O; z5pp9R5e)tpwAB@2EE@Q2WOz#$L_=ovEsDb}Y*A+Ubod!Dss^wiB_|DPy#w`FdXBfy zOw?x#_1tE($jZZFAdMPVI!2%Z^H>&f(s@b-T)#k| zMEdDt{YC+dVY>8;$nXa21(?AF`mZ!D1AjB4bD<R)G5q!mF-bP!?$<(sVVSc z5GWxX$08MS;2kaP=gl=sv)@_J4GjSz4WbeH_^wR&Z{B28jzy$m2Mnn`CVGJhu|Jq@ zC>kK3^DMRtL=!1*^4A(1z0>`huozJyL#;&iRPAsxpEn?`9?t=RM9viIB#CA(h<v03b%JP^6A$pV!-kvVB`j4O~qn0|I^G zclK^GyP9-T`q)hNzwh&~Wy|^!Wqt3=+4n3a_#C%p&;P$&^&K|?l(|&tde{fytGHM; zK{-Wgt<><+M68?8lQ zT0WcCW{^}VI$>?+Q@1|^0DJN_Ag0=~@|}GjtnE1-4YJ+>byxG>!HCGoLW&0OFm5F6`q z#>4x)Nsl~D{%U3D4Ei0ou{yCVCq#V_pVHckV5fJbc^zeq0ZGXHhgWs$s_Qq&*5bCa z`6}d*ImS#+>VI*+&(o1Q1;aNy;j=>qg8*{P{&Yi$IA1#FEu#Gc!*k<#oeoye&hW3` z9)pt0E^L({v-MP_z>l-cbDv`8fYLqi*F+HjZP^+hD%LdpW6puhYQ11p( z2ieyAqiO}6Bn%Jn`QmZH-w#88VLS2D@lF9tnqryG^R@8XHB)7iC=!*d#)sqm*Y_R= zQk;6p0!`+8mTp`~tA|?;Iks~t_=}$`F1lORM_D*`NN)4_(DwdkZ5V@aQ40<|r zAR%A-xzMt%v2}3|C!21HXskIkl^;Rj^L-+2R5?upU!h_ukH_~y6DVw;+J`I?iv+o+c_ zo$-_I{6lV&x{?i+{iUO1WBShBV-BLAbi{$-Bd$~E`lR4W_E2$GG=BU6kcLzw0a~zq z1e4m|LyzmHdVzT(H?*UJ)Dho&Ak=%Wv~Sb|39!OUZprpI^sy$T4RxB2r*uDSOJcE} z-`pl&mKnW!0n)bKP|alE!4f#ysIj}@Ft^4U2g!kY0mpZAXwQhQCcXY@qUngAB?4J6 z9Wqw|#07fYBJstISEGb_>hnS#~A9*oXy zxxIr_g&Em#ikJ4$*GHfYR_NO%qVVBdp9y~BcQT$IGe9BHHIiujOVP>3w-bpVlGcSv zY#zNpm50KwvEuD}wD%BUlZD1?%G%OtH8 zlvExP%o_}dX5D79>;DpHKw#X;RAd$2t)BZUg-@k3UG?`sf_!!rd1+#{vMoGLeVss_ zx`WykZFB;uTH8{H)&}C=8kPh+in)+qgzCr$&gYlSK8cP%+lmV*I$aHghiGT zAp!ezy5iP~)5&JyC4D!v8E>!_E+?mmgsO6p5gtMJg_HFfkdr+1#%RsRAIs0~X7tIp zX{WC|vx_$zE-$xa;++&3~LjT#thi}03AG~d(k;^grBw06I(dr?hj#TbMv-)N(U zz~7R7EEK2Jh)ve``|nvAfS5s6#@v%U?SH*0x$i*YYVz6KRo`djw(Sbs)yV`wS}tiOZO@Mx#|4poE#9cc6O#t6sQ zL4Cr&xC+R8B|F|`vNaZ(YJg3-^Y?isZV``D!J zDIexAE7K#{D<7Hp-+S?00`Yl48pgW%FYZi%O>ulBqs-32nD}AH z6u#G=pw6FLV@t`}vaG*>>#`7x#U)YUV;iP-^kPWtyj+5Z&gQqZJKZVyX1$J6%nAEk zc6_9Nzmo4U=`q*`Hl)YYo$Gb)dQ}=yBmYum@ddiaB~mL1YP5U9(Kr~4q7;$64FU&R zNo-i1LKxBB_QKi$h_+>e z)Kf+^T*wt1-9W?sf@C|AZX(;y>cDlN4JynMkompZ#JL=q5~h1&Zds=L8|^PzpcZ+& zY={<;4_wsSNRf#?WW##@w+P7%bQ``_8DwL^JW$lIg@owPb|YS%*1iObN6_9i<`CcT zQ7C=dIvuTf)dts*U%pvzl=T{@6NT6>=c?a(m%rzasa>WCtS#6o#DtrVt#!u}gS#aZF!|aLy z;fk41fz4nA5WCWP_K%Zpht1ufbm?4{HMWpkf0)!1Oy1CQq1ik*fKu=l2W5K0nP!Im zoK(3FQx817vjconf|#TO)RP^y0Il=x3?`1r;`oqKkNoxI-@to5>Ev=zy zR=5Q&&R`z6A^PYR+*{gbZzjLfa@A^rq?*5N6W);ieP*L=FJmimL~VB9kDaZN!hd@{bS}A{t*x|zd51w)7GZ5JH1!3`R#!uu+ZFSqQB>9SlsEBj2{dYHT^*ft^Z zpEmofSYppW9$pa&TZ@qIFh&5?zEtPXhst?@`Xhx-qx_Q>`p!kO`sK&pj9x{OR%&SJ z5@!A6~kwO9CROPw?*T#@lNcX%D2}PuiI3#{> zlyIxc?kdCFqK(|KQGQY5O}GF6XPoo;V3y!blg&!MIxOkl+H~4~k+A_WExKBBhl*iB zcj{Z-D$hXsgSwKznp{vkK?)R~$clA*du4mpthCW@TMP^kLK{|*y+`z!r%Z_dWlLou z+kT3Xr6BMBE>5yf@8h$D+IdHzZTB`Q69M3>!ownSV@rs}a|OU4XW)H@gVKqXcvU?Z zJd5x}&?IW|Mf^>B*E5p<{ly}3P~3olU46d}DrsuW^iR2wSS%P1I!A%BOt*rqY-{#Q z(8#f7bz zi;@GckZWkCkP;;4-Cz+&R|6+LQ=Z$!)r(@&V8C7jbtu*h+tq935pE1XN+Y@QVu(@n zK?yR6i^*!C>zdf})8k_xjZ0PvL2w3cd`JrMr2Kih`&K_PBpX4g?ciq1Ll-Jl`cVgp zWuU(?b&Z-gxEb}UqPILUV;IXec0(znV8n#I_f3xucBj{`<{NGr-Y8oO0iNXTpWfMl zL!JM?{H45wA*y+z3V7V*&eBq&k4jbmvr(y$v>~x_Mp!xcB6BlmFqde%qCL&B@y{lz48`1>k=mu%)}>q zq)2-`tP`bCcur#|LzW8AqchHv0}g5PbY=mPAosX#{q9MH(A70^@Yl(s;B;b9TqZO$ zh3MNg{_|0L$cOr+oRm;&D8Pl=;%QY_F72;p`4cpT1~o@}f$s2Q)~dmJrnX)0)K-FU zdjcIxjVus)^7p0iubl%p-a(o;q*1mMu6^5ZF}I3RyiRqxk>g9!S17S_$X(_ki1++g zf0?Mnj}Msj9?98p>0vDe$9D=`W44E?t1Z0XU7L|z6B^Z*gpV%Fl*IGS$!?T^vDh=b z!J-byd?3b@-%r}PRqj%__gw9>@=(Mb4;a8iEyznO%IvK|_XU9I*23|jwrL&C0u`7< zFX%++wM}9rz;Nyo`%^n8qLPy~zc&KHKfR?)L1%VAYrCR6@qRJ=rZydvcYx9GkiRvn zyPd1BWlgaE7Ze<@N*D6y7*~j~~jTj7E zs}^@a%*h8UOsDKnM%pKG{(RieVRE`C@3NI}2Bk-g;AMo;-&kpT8(C-Rqm=_c%S;JU zHFLV@!VVu}EVA7D`&&rZEm|QSLAqB}8MnO>J6mGdSE6t!kuHA1wj|mUn3#ISPl~b{PTwN#%_4_4| zpIs@K#jTwIV9;pDf7@=>dN2bn&XIYvv{R}ygXhbNHtFS102+6(h%b|KhLL`Y_j<53jy5`N^O*` zkbv>F?%Z!;*J@5S;S_9-sK`bX3|(C*sbbA$<*{Zltdu^FBS!O$p}mJc=*7)P9#4a_ zA5*hkdG17e|LmzW!yUs}IeKnCeHis zBc63*tvvo`W%OMf<3W}FXYKLvB#~{{!6j~5A3p1@uGmYYcW^?XB_Y-4gP3r)m^m^% z1F47FS=>!kOZ613Fcgl~GAewYlNN=&f%NtjZ1B9)C&-2Vg7qzxBQY|uKr{PIRRK;? zcvM43ZG|-nzeP?t`+4<%TG>xl<;%eG>y6S|9gOMu)KMBub|kD)lOQA%Hf)F85u)Y& zm@3?D5>(+q{QF{xmpIc}f%k!Gy8kgTz=bfu@;Af?EBvO`&M5}-AovNI&n#d}Q z#$FC5C+73abD@{v3((1ey3nU^Fcb5puM@^nkC2uzPt4H?N|=MmZ5|uKOhaZelzr7M zbKtA!J@((>@!Nrbs_45bXY8pzw@F9zspVh|{V@`%O_5g_G4bu4bh&$Fn1DDg<%Rc} zc|*6##8DDDo!V|SJH`%wA_^E~Dy4x7YJ4W{ePS6k>w{V$eN~AnjUsdUXsT-zN$&0k z>-X(HI=l0t33TFDV z;-?t-HRp$OO8~JuT;A6%Jr{8HF_QPXPT%Bkk!+#h?kwa8eNy}&? zFuP1V_E0L4G>G!WtNXv%Aw5NK8bn>~TZQ;+@D_Qpf04J@Dp;YTnz*FwQ$#iw`tIsU z*Ybn@BZ4Upyqh{s-1jl&x1$BKWXy5SVI}-7)SVscL#QI@+>rni*64jRs%fYS2GZ_(k=M7S%6LmcfD;*tbS%_2-&nj(OD0yIcC7oTmdWSGfH*3< zWJsN*SC}e@JC?Q(XQ5<|O^~z`+W2EdW1B_&K%_)8iv!%J@O07iJSkc%`5n+Uw&=qH z5)|#tp+!ElFb1E}@q4)^{SI%Hmz6QYe?r{LGAIGpR2>MGC_VCX`)XvUrG6JZl9Qx|;2G;oU!Y+hVUY#_S*;FPN}> zffN`-#wT{CU=}Wxc9{TfI$z8cy9NJRjb{*D!b%Wq7dmg;5z)WTbfxRavIQrlcG)$B z3~91ePkG>Dx-W{~3#-6jYzA}2CLIa7sz0^8>EKnU*m%6$_FC6HU8Wp`=2dZkaEJ1$q9rB-!Q3TO{Z`PNqDMq?8L=L4EUDR8n zUq`~?eP8MsfL1i=6J(=Xv+K)~-;t)(f`!VzUCkGVwS>ot&$Y-KMxcYVfv`za32=}H zlo{7mgR*@Mu3x83vhN_55Xr#h@s-Fkk6g^?mR!H|@H7Tf~2GJ5+I3sYD`wIP3;PNpO|bDN);;kXdis-=qC!gPD?GvUuk`#Dxum8)O~rLSTHGY zgk#Q9ZVJ0%6SP${utj`=)}@wOt)y(s_@wLGosDA7;<*cl>~q-mU&aKzt!d9BmNiG? zWs0p5wAv&&3ZvWtA}(iQl5G7{SNb~xO$Pl1`_3Y}^<=(%aZ;woEr1Oj^%~qsy z-ACL{sA9zE1qC#s!nC0e9QhMswP{P}1sn)NCjTzju)H`6DzrUACuPHvM0cqdnGs{~ za>qDAnLXxXZF@@{Ab0(YPYy~#0`FI+#g;%y#5%j42{PF=hYxqJ@ zN0|tIH`G*9(FEui%F(lV53Jg9WyeR}sQIQ`cDlJIDn71VH!)x9G(vursi~xQiNVyn6#y9l&jNu>g^e^E`>2n zb&Gg`wRHJFEuItSA|c|$#FiV{P_ho;c2>>Tp=2_*CCi8rgf8BUsbo*NQGQxCZ&^6j zjP>gMj$LbBdAV=}s?!}hp)UL&W~PjkgF66qN!iyF!5ZL$&Ol&>RyW|Ln#(D5R2O8SDE5bPu;22N@6*Jz1HoonNZW{Iie_VltZMPOdf1oqyghSNRDa>zV2Eysb)h{}xD>uajEB_UnW@E&)$>OF$UC=Is5FyA*kZzyrxb|AHvyG?u#%bUKB%7xweQr))Y8trE>$hZ)@<{RC4Ogkiy!lQh z5PpJi+nzq)i~RK#8;EjS@UJXPFmv*rNq~qmXBaG-Kc|I{Qrno>}hS!5Ji&b_`+fMI=5r z+@y58>0)>&<#}HpmE1Gzw?PWQy_dwxHrHe z3D&y;?usSG!WTk0J(#lo=_z85(I$5X$t-pr2){iVw3a-LLV{bX2SNnX+?-5u#@qq! z_mub;ac?rk4gFyXJlX|_{_|WIh|T)<-09asRYryPLzZ$&{2Zr>IR_0BWUcSq_h=h4 z-vM+6A1Jts_rMh-RAax;%cW*FVdQ%|=j3;tZea8<8u;GdSB+zjF~qQ&g$|+}~#%W1YIhd3D-bp~ubNzlHu?#)jQbeZ+{9%3sKa z68u=O`myiq?UJ%^P3XNw@G4mNA($)tM>kf^c0QahGRX%n3d`1kgz<+rDmcmix(bscefop&tUcs2(oX0d^OzcmZIb#19nbrAk!k8$uzNnudw(L9ar!vLU5i8v5KxsO%gB)8Hf+C(zlxSE*?T|*mrYU-n%ccRr%3vIkq;u~nN=A$`6W^xO_x4wwBepBC;Fr;^oSU*|^z@Fm z=Z+utEnM%Gv^2OhDvtT1-SlZ@s>(mkm{`AVJRUol@dNT^-0*Ow=L%LJi;QUFfHCUN zIPC?LXqn^~kSHu~zeb<{{OwNh&NcjJ&n~U@E4;yX{nIdP6nF9JcoWC({XI6K6)5Dy zq^2~1Z{Ar-Rox3075RSa4MQvW>X{+J#EU^zxM6rpGj^)O-^VG8uX+LRtr9=){_0e( zV9z@?CpJV197+j4sjM$weD4s7#TT^`HV8noZ9?S5m*`T^|(=*q)*u>k1UjO(9QQkm9L4teZt_l_Xla)1|-xh)2 z)-R)%yv5M``XZdccs7j$$szF+#5T4B3CwD=Wp~HuGe{TAi~gM0k9(u1LZhn=RxY2b zgzT?B&Q^IP&5w%1S79vHPvE5QXTMPulr3OeXN$Ne-I!4GpW=v(GLD85E-M;Ri7uyp z_1_`cSkwyd94x3KwQu>LH%@-N1|i58DuxqJBdV&wS9vcQcoyyp5EOE!6pP= zCw;#g%i^UWQf4N_3%ccaf{241j5^3_uNqYKdS1s0@cv`hTNwV@$lQCsCH0qae+wzk zE$NIEqD+(2p=iF@&C~Ws$;XzMX#P53GKo^$QNpWWET_xMo0@Q&<3`tFkZ;Xt{cuPN z*6+qOYy0(O@8JzHs_pt{;Jd6=w0#jxGS>N9B%Q7Xr`o!Xny- zd7`uBIpdyy(+6O#g*$E|XvJ^$no`I@Ns=gF_p6PwrG$Z<`b>#QpLla>P1Hk=hiL-! zsE=O6cL|dKa$Sc)XeMJcnn)<#psCTiNXN=K)y=ee7KQ;OUZy&2FHMj8>Aw=mqRZLF zWMfV#qaXi%WR696qO>Hgwn4V^N!W!Sw<-~=x*}COIwm^j)dIcUCy=nB(!@oTG==PHp3)nHwYBkGfYRk zrnzDv{CR{8961R@X3=;3@; z()J#56(9#%`*-~z2sk~$&gy#ynad}`gs7d)LLcVDYUad>Af|(R?1F-@kKZr@r2UfF zF+v3zol#G5NRU;LI+^BjU7lPFmA_BfqT_uAv`yGC&;?`z2D~Ri1 zUm5>Zi(5HB5dA7pT| zEex`jjZjx!EkR9EcOOoO^W>E%!;Yw+-|5lncrHZDRDN2wmI!||y#*n$I zrBj;nkz(OpKy1Psf1^~I`rw&Kui-v?MouO?E!js9 zi;)*xUfOT{h7@94blWF~KWe$?puV~Dg5CVx4=Mq%C}s0k{>lN<5__QVcXa7cz~_Em zj!zy7Mf0;Bwtcshr(RARSSBO>#XReG{5gg}MPruTFxB=7!W97LoI~4XLKECkcRq(9HCer{(TxKeV@bAZ4 zx8-tJ81OOq2aK5y5p{<^PtgCVW&KjaYiG~JbEn;s|| zf9s=zw?C+Zp6tCQrO4ESWjJo}aI$x|A7YkoL+jCKTY_RIijz~6)N*5QU)-!Gi*U}P7@{oIXV$jS5u5KYF}o& zz_dt`4n1zwje!AH@Z%%5G@M@R+^$0ku#71Kb{~hj&dd5d&!*I%81 z`(ffXp%N=j!-vH@pnH{AtNMhK{Z;eAV6e3cj2H{0J3-`9e`p=o&!wlF+)}s6lk_I{ zr?baNGUegpu#6vet^=vaO15_qAH*qsdJGVlrxy{71NQ1%;!Z{ox}Y1wKrCgnhGN^g zqe#*z)#kg4b1tU>i0I3)Qiz=YROj)^O8ME9P5}PH(t7_q9V~e zm+oD|<%5+gHz)vuT3Xuj! zZ@8qoGGiJP@adnK^%YS4^CgoZ7#r*JhMK^j6GydAEaeR8i2}U4CUYK>2$x75STNo#}LxJG#?(P=c-L<&2XmNLUcXurmcemp1R`e}aIN_T)`Jc>W z_D-I?*S*%d2%v6ORG`bEhM#gu(5F$F*-Y7U5dy4GOruc!P6(CtERS{ekWsOYa7`mf zI2Os~pZF4-9-Oyp=%zLN&A267$YC6~@gV~86SVinXdp7wq@nfR$LntBtclpv6YQs5 z=j5KBcgr>ddwPR}5@y7uzKToe2mMXid*!E4d!W#ttrRTe4ty378%i_I~fQ zo2ZL0cKj4}haHFWl%qha7a!OsLH9G|Prbl$P1OQ+^m(*~q$oW@Sguzxxx}CP zFIqs&k;<>Z&sLakXEBwW9Mf*Sm1n*j*x%Xc6U7&&%(7yY2T6~HZXpih5#9aYPj7D2r^Gzi~uhP(B$nVlT$pK}A{m8TK%LCkq7J}(TZUCq6RjOC82T(VI}&T|(O z9zOIhB4C-)UohHLK~e^BY#wL(S;{)7y@YXNiZ%-k#3Z3m`}6}A@OwbNqh_u&f7tKR znWp6b+d?x-iBY|XFvjH7#SEHuGnGXPErDPcLIYbe3n2^WunSfighL+(wM8=m(qW!( z!e&edGPvyN=HCY*iM^N;T*}l6PU3Z6q{1PXpEbV|NK$UsZC!PhLQ4coH4FP_VoHIU06q4XRUv~{a2tMSd|)E%mcAJkF?C#tqfj0l4o<>^ZDTi8x8r73HqX5y0nkYvDvCT z-5r4|238z{&<#AJsP={Ux$lMi$#+|vy)g;I#;Ci>KmC*o4fddy%2h76>mPBlXP|ZO zMkoLNJP{HgOnFaONVRHC(#`u|8R!}0f4W?9L4D?4`}0!w=lp^oDxzA?zf10wUh-Cc z9$Xu$b!oy2fu*!@a5u>!qq4EqyiBtpr}elFUU{v4Cw6s!pnJ%MY}%jhU$5O#qv1)5 z1BIq@z1UmE{TsxXcLDH%CcUWYQ6>=llhfq(Hz@zvJ{J=|(mo|YYt^CWgjj4@ zUA)5hwhJoXsO#h_5aXAQ9MBcj6gSs7{SGbfKQ8HXLeP*i2$G*b_}R>RDJ+<7c| zo#49I%B&U|vj~JUJpL!!Gfm9bMf-Jhh*Ci9(wJa|?w(CXDMmPr_jizoK6aVl05|5p zCw5(E8_P(57#0ELw8H>WU+@o?vT;fsHFC2!`fH4MQI2ymHS>8c^)tEJz1}Mh($8(8 ze8yd2L@OsBSzq(}7uX{1dE^?Ys_xwydy~y@ez%zSA1CbC_!ZKngNd{=>29#b;$JB>;w3kva}o+j!I~3{09%+ zm%_eLbRwW7!?pd!9CD(^9AVVyFybFr*C>`>x`EA;;tP=x*!7#`yRG*_l7( z!_c+!f>n=k)vKRBU(TyB7Q{QZm#m^i$}u3ku{^)+Mhv*>vqv_S);|4@LIfQjJSB@k zW7#Jq8MO&<2(!&18By`)AOxmB=DvjYmE_}TbVH;~#w(#~Am1|f%ln}z#9$<;qkMCU zk&uzwG?&&1xX%sqUk2Y?mUl>f_ccErqtbtX8Vv`cZSckH`szWjYR2D}es8-(qOn8RR=;}D>n6d!f#=vO>2H(e8V@>WNBG+cP<-wV z?3!$*OHT0ENXVf@$H?91F$}1)+RsCURfqPm)h$lBYP2@Z*WfU(54bPwRE;)&$})&l zo2nme{+WyxPlb6rDfRKOD`69QB*aC^P5nVFA^(B(FBlB8@O$n>`Xt+_SJxnIBu?C7 z9_1Y){(FcY)R~LA)4!rTIxy6#=Ic#WqZJp*Swtm9A`PoSJ4~%7+P&S6gje)ic+GzXD6cu(Tn`jbv|I6aoy2Xf| zmd1vwhsgOLmZz%Gs1DsUanOqEuj{Xv0@CwpiEm{d}!w1Ntt@oT&m+ zk9*Z$4pHCoDfsGR_~CqE8MOt_T#ZzU+z`DnSc-D+nu=-=6rZu8jiBM&5LEi->Fdo` z`*&l3)ON#4XmsJRMKQBr_My=78fgz}M#OfBsbSiZH?`6ifi=P3SZ6;iTE1c}nn|97 z(RR>-8g6p&Pw~~nX)tKQr9SS`e<2^d0VLwhSH-Gz)x8<({urlBnZeJXxFFz<=nIsP zDy}KC#h%LUVYhCH)5KZfGPWP>g~&aH4Zt)l8M``DN&?gl873z43g@0!eA3jS40LE3 z6Z}#79YneNIKL-)({76I&a;y)qrNl$>$#FF^uf#p$h95W>_TX&Ng}M%N}gA^Yo@0bc50s-1gF!D=ZC>%oYDZMU+bbkWDdN zFdET9&Bwd~NqGlb!Xx8omZq8PC=%CdWB0YORuOv&$vjT26 z+1LWQHr9xxtS2N&To>pN`mo8TnyN><74pbH68`>|<|M_wIY9Bpn!O^H%=E6qE{A&K7U=+;u>s=>TG0r zi1y(IM>ESebqd{rLM^;=rVx3aR7wC!cQma7C6G*H1W*}pOu9h$JUUct zMtw=-N1H0w06l8iTP${$AXbU!u|j|r`@v3V&*=z%7d3D%-NCxNCl-wwJwza(PpU8- zPq}J0OiwBEue|-~MB6ZGA6cpD@?NcP@MRYuL(qHMUxU+BsrqKAEH% z0H6Cp%OU%SINH(U4!35Gwqz9hg12wsq9|BIdQUsnl^8B#m4`!=?1+8G5KB>Bc}SxU z5x)PU<#q`B0;IE2sx+2^*DZy&{$c({>4(E~m3KVN-*+5o#q+sS!bs_%kO&oxH7Y<* zSZ`&KC^n=R3?%?c8e8QoxG+@(u%N)ABC3k3hzG(r2hT7cA?KTqdu$W zlkb;BUp-@VKfHN>?-sLTbL@KzywC-=^;h3Ph`Gt7Bd8`w2BgCHirqps!njvrv{B#U zr^3)Tl{7#DAW6b!DGkk_O3WbVsw`Nhys9V`MZ)zob$Xj($*bASx0b=kfC4gF8ZKtm}R!uIt*vU$Km=uiNWz zV^3S9h_Z9jrE?XVuBk1$+Ky2bEeZv0^tNBDQCSN#qal_!Fk2%+_N+ai%JZ;GS=a!% z?Y@}orAJ*N6!7NA77PpupOt*_r0unnWc8K*1}0g<+kCxuJsZ;Ey@Eac) zkRB@F^|7}}N|!6KgT^7rRV|gH4(F1kKipl}PrH?cul zY@HLCEjN7mP83*TY829<#jsV}NwHmr*?EF&15jwjBJ^RLZ83Vb8sL|p$$i60EII&R z?#*pg1O7_oW0_DrDmufrqM9Ml=D&fE%f#=& zX}MnfTP=YyI*2-#*%BW;zEoO?<1r4|cFc=w@4KO0pQ6i3dWK`!12l_&3(Q?L=g*?i z$Q~*Tjm)t@n7s<@r8AgCn5ZG{onkQ!Em&!wKlvv6&dW)Ya(B2%p)zF?O|piVE9^te zW;v7x3&IkxZUmgu35=SBcaWnoSkfU_H41CA`PZbX=>J)zz&{^DO-G66APyk@y&n3> z*EiIgTYQefEL^FIRp42ALo*PTX7o5L%2X|Cc^i<`hz(<|yQduD_W zG^^DzE2K8COE~%GevHCAPCfAnX_BHPH+#z%XNWCYXaS9u7zB)nhuI!QP-Xp zj$kL;|oupfVmT{ z9$6bh`~}8H_3R%!zTggn!gt()mJC#k$aVp!QOl`g1`x@LFIfMsJpOn1|6Kql&^yBF zkWm?3GPR;`W$`#hUPq}!_f@5zc{VMs6|qE`vdTW+)3s629>Q&3Q+AmcRf-q)6Ww^jit0JU>5)7}1naU0B7$+l%yM#CQkUypc)%^63@YexCVOrB#|piJ!MIy41^BDl6|LzL4OL z^F4jIBAjmHbG-c-oAkZU-q8qai;2W{J?Pl_oQpm6(ZWq~Kdqx~iCMhIdZU#*HKW88TI79dR6-3b8x}(^?;bK|L&v;^bE*j5T~; z*75xoTL?BgwWS}QzOneL8-p#HO2h|cJzKXeKgI+;GwRy)U3+PMLyW$ zw{}!xO>g|NkiHGB;RT=P9_4?~$-~9*HF^8x{QdUh?>GIM&zzY<9=IeV_qQu|SCPr@ zilUwJ?|xZpN&|DfxgE$;{2N#_OwgVT8(K7hv4j5Frh!fpjp{Z4j~MQxrWOr%TTXO9 zdp^)La&~`TO$aLazI9*fgv0DGnNrk9;!CV-2eEyvLMM48OeZ+!Ch{s|nh~9#+LLIQ#hX@V0_gj*W`5#aoCr}zanL(W)l@OW=kr!EC>u%$d@C~<=oC9t8;hawd6Wl#;9Jy|vu9l&C6CiNwD|Tv1wga+uJ+gGa0H zL*nFK5G}TILE^F|%(o=ez40f#=bH6*{-_mH1bW1W=gi+aC$o3ntO9Uio{9{Tof2~RlGb)PJr~8u$%O>HE-Hl zrHE0&+{B#xS3x$l6gjM06?5$Xa*nJfuwJj94^o@Ow_B3VtY#iRbz`@3S&K6)!a(O& zcj+2p(@?;(q6*zwBh<;rbp|bpt6NM~l-JH&E^qrurgfCt-5QU0x|sgKRRy0bUQG|K%(<^Cxk@9^o^ZDz+^{Cft_dk*Myt z4iC-O2;DEMbP4z*@x`E1JU5B)`nG|S0-TUN3iJRWe)Nzu!N&~a*Y)45(VS9V#Z=Pm zVP?bRH27GFgrbLTT3pX_td@OQ;kK$6!R9HrFtBNtx;Hh=854oZ;ha%JIxg^D)}jjm ztcCLs*YEq3Amz|Z_2#0UK$8@$wK0^gvIPmruX!F_FJ`8tq6Q-_x+TwCP;U5a>9Avx zxPiriq{y)ilQvwm;lKV}IdwnGwQKw}i%c%MXe*t3R+Z`dy$eAij4FpKA2?t42Pn%|I?l51uQch=ri-glS*z|Q*60{pAtF?pKAt&6nPnGOciD}Jtt zHecgGI;aOLLJ*QhH_FpAa>btWE@-99?cIy?f_*0uxoBbx8)ntWVKBaJR98e3a zHj~q0Udy`it@XKda-e~LBeO5N-8uI)*s;kL9ivpG67diSZfMq(#JeBgXEn+2qQUfX zg&9@rDi}LvSla60P>w*BT&Jcm3Cm(XaEAH2ua*Ucp|lG!#$Y0Ux)##F5}K^EwYbpQ zz7ZDZv5u`AdUWJmz-heFlk`oQKrYRC2Jzb-rC_zq69ZI4>NrDE9y?-Y!1r5)g2_Hu z;$z0nTvUrhM^iNxsi*TXQ_Q)TDm)4}T(|DqgvU(zucwDzN^w0GG}_yG2L*8ty0knqth-6ngVJ^DGwqA(A(lz zc|89PNo59ZoHfTrv;W3ZSK-FEYKVyY!Vfz7Z*cbch|LSQb3E2q>PbASYt}9#yK)Q( zP5b(IZo@~>>mZb1ho|EC#^`xdaP{O2J_7QF=b%hd6cXh_45LO`25@*wD{Db9NX7A4 z?Q+CYZ|a6-H2>o1Zthhx4*ZBWI97Xv*UpyoptlZ5+rT1<^JV7fymIsEqmkCx6Q4X9 z%0ozx5x;(vhN6@~hP2BnMC@g3L$0tcr6V>S+NJ#A=+|IfDiBvXDUo-<#hl82-EZ%3 zQa+azl-nkX!D`_#ZbYA<2Le8ws>RL>VT7V8SDY}Ja=;EDO-9kos=Eo$JgO&!$tB{V zn=wUZYJnsO|2WQDTKaC_pK)XHS|ySrx>2P;zbPa4r%CHbX5496(ZYQh2>Fu)F^t2G zY6$j>LxASRbmWV;eBDa=6A|@zZ=Ovwgaa*<*vA9t$Dag;hVXZ&w_SXWR^RW6X8U?I zdQQu~e+zKC|3fT{^{ttxmZwRTo&Vt~XLV-Ki+`t=@qA6wdbU;fpt<8dfR9nNlwiGM zT@@xxK4bgq{o!osJ;ev%u$ana(mqD{qbVvd|Br>48AyHT%r!Ii0D7A{$@2T%$llK@ zog)dk5t`sUEN~IUd~+s9PV{RWxQfkAcN!3Qtmm|J1b|;C9rEr^Hs{4b2e5B0O7kkE zKPmKy2~)ewbeUx`J|?i_-_z`b%!ywm)kZk%AVV%C%V=Da}jnm(1-pZFtyw-hPSJcDW1 zF*e97LaY8<$3u;=FrsQS>h8t>zQ~jmV`9$*I&IHT`a!?K+l2I96{Ph8Bi76_hl9XUj%j z^1_QNC1hs9U;rJ5K;IJ8fU!XxVG2j}A&4C4BzPD(LdE{Jlp(sf&rw9?RK9DjM#mXg zU6O5Sw!zfB@rE>(nXLpcc^eP+rd<69c>P0WiP?~*fCuSkk2l3MeLD%w*R|(4NxZ^Cy-f!86_7oBPKx@pxH4eg+@fubc*{ z(lexH+0?PD%&arQ=yv@6AJ?~#{Z|8-Otc@vGp4sn4Km&Eigj^-iGQf-$}y3;Ew$F^ zPp8aGa9AO9+UD(*B??VKi{3idbrhX6pZiW(Q+a?f-!O)|;7SN!eZuT1bHXy))~v8d zw(#GgT|^vPc!=MMwEY2dAblzy4QhV}EMb9qiSa*fh}w3QtKB{q{`rju93i&m$%+vY z0bz6+$UV(v4HJlPd@Oi$7=VJME6MGG@~AHK*ym!`N(If9E9cQa6fRzVdOY{*{^NJX;y%lt>fGm zGTGZ_3reZEQ@Q5~R;s(s85^+V?FL7_-Qn95Z$~eDQ@AiHl-bny3IDN^1WJrxPa-5x zH+HhpDYi>u%(PgT6+LG{+W<)mlAI>RC3M2t%9WMi{wqBn&%7umZxxu@ws5mOFrvS- z!0af#zsi_oEf(Txw3Qz_w9r3hjpHB0Q(e!)YCI!+B1ADNH(ioX@|lU#b0?LYlrkNR!4 zJJdD;D>)XPM%LMe8(J55*-PXMj}*+h-!_Gh+2U^v-Iwe;x!cWM zK3f+?%H9jfZ~pO4w45a#b85HIEJZ$_khsG>k%4_av}d&!FukO(7p0|M6}tnZC#58_ z^YQ0f)r%YxGhcWNd0D`&8iu05fpku%B;&t$E6XQ^5Qi9KaAuS2;LA=P+kfnJX9y#iM64NRRK0%B&>}sJ;!JBfVc@pK5b0h zBGDX^A<$~n$y@W^+{B8SpWNc|;i5R$j8AgG?Shnz-MhC)WxxN)z1t=lmFw-dHf)t= zXG^Mdt~9Q8ojh4sSV=mrFTAx|Djy_6Z%S%(r> zi90Gc#c<@9=5=wYfx{Tu9OA#cBM^%D81?|1p>DWqhy^cwJxHAJU2{s=fzuRO!2MJ zj)}g@s{hnW@LJwvTF@$sBT3nJ&W|0(cR2fv7umbTKXbG& zE;;b1#QHy3>a>A8GTyOKSKGl1p+U}|3(Sx{U0B|gc7()tuncs=&GUxJItFeamB66M z5!^k{@n14zR&>hgse~bMo+`vpcrHxNoW#&SV|Hn?J^#7D>$HNY@{m2f0s$$h^zu*H z1BY!u$uCgDzZ08i98?cfVGH>8{`XgXmJAPGEsCcm4yuz76TpbA3(F6U!9vfZ8Yd&c z6y8@vCQ=v48vnNr+8p}o8OD>ZsOYY!8Ep2KXAJ{8NXNeh@+Ql{(+)gAWYj;CRR1R9 z`ByKY<3G2EyFwT$kj6h^txw4lqCoEFSXv9#!L8FB>&JYaSD@lyVy3$N=~s)skP!Dx_-nmmfjH>09Y{mn**?QfzSo3Yvi!#K?Ta&%9$>h+nfD(J`G?j5R;9xVVH44P0Sl}Luq zzNDpzaaCT$nJ|(4YvOj93EJJk-KUWACfl+#^wn5D3}rxNlmZ1q)-VBFBp;qQ1nbIu_jff==2d4PxW@psEW? zSH~DL8MYE5Gv-zI?9{DfdEYMKY+r0Tmk5*8N=4Yn0L{=DKTk_|*oxP`SPoBqnT$bT zSBGl_#4b#CmCG+I>yfXaR}>=f{(MFk3qVWO#7*}Mr?#@`o|P!eMwOEdwQvx(Ss73+ z%R8ZHrsQShC*{ViBW}FJ**WJ^Rl!R?oRU;AHe8vB1&OUE7M-Fe3uMz9Ax=ss%(v{pDLuk}`Kb)Rp2evrd?eRo4C&eUBdCoqY zGE)`0jN61|QMb_Q`Fr9ZVE2BnwH~U#%CIr5#qbF7J1i!ea7yGT4~yMmJ;lqd5#Fw0b1$eXK9=3EEqxx}9kp^`l z{Y?Yf`X5LBbBr}5Vw0e$crv2DH#wKBMhDo#V4P@FhlrT}fy$)(`zOt*SD`|Kv*6F? zm*2mx6XT&7IhEwgC>mz{_`kt26Xt1oyFsuIv$E~+9_swnfXip5o^tX%Af$}UbgxU} zf67zid6Z^zAy}UQjZ=>3zgHUygD3D=crxswE(qbneK$YvysN6m74cOH)F zFlbAw_>OqmT!M(#c~nl;7C@S&X!F!UnjxJ3y9H1SqT~8Q>83f0H9Pgm{laaIK;H&X zgLo|1=bEmGwgpd^;4@C~PZs#SP|E!`dP;A&r&qYKMnSqbn9&JTsADwwx`}EMIb>ls zWGEzK80=X-d2vXa#b$arCvCl{e+&tDsL`f<>h0KLi-|%S*LM0tc*p@ay)0_IS}AyFZO6TL_HF^ zC>ra#P9MONvUw$qn+PD>CO*-g5dn8P`~*AsRS;JL*0bZ(y1$IBGe}XBwV6;IfA(ib zJSM8ACbZ}9E1(J-Qd7~xae9<~e1={~@|pz%RDlTYsj$e;&KsKAhDQ|H#U7lhY=t_v zQ?KBD_Z+PGTZvEwhc#4Wl02V2XyRSIm$Bw;6PVio=)|W+)G4|a_4yS!~&HE>Li+1d8^qi6^mCS9Ym2fQ>IjD~f|C{I|vxvn(B6E25@Kv6B*Ah%=9&+wzP~*$Yu* z8AXtiPCLxx7@DRQKY!*8{3}lV9M_;&q!i{lSWS4&XaCeX2IqCmQu%#7xuO!}yh9-t z;iWaVGeDo5zYg$&_%4|ef2H%B1inYIC58zneW^7Ub@!yxzZ~KiLqb5ai3-6$t@N`3 zvyH84)uLA;h55ed`fs39v~H5-c|G`yN4coiq=j%o2uv3)Bm>sdR?%sDHjgQfu@|%^ zP@YJTyv$t~e|Sr9MTPK{{dL)f7rqI6-$A9u5k6c+^kp7=C|d)A=NCe zsPN;4ZG+whOZi-1e}d&w?J|b+J!l$G63upj_1_7G`iDxhb73Ck1@PUFA2<2}Twd`2 z9=3=Kd(&|tmZQ&&mtgiteyKh}aGqeR`Er&4P zuotvB<6j~B_ahmZShuqZ+VH*KJ?-QDI{h$A^9e`s_BtaeNpT;A*O2AoT2{{GSE#VT zNmUo4O0Om|oN36NwwWF;B-)8RknO$C{d2h!!+V^g-+8{*l0r{@q%O6QtPt%$b(~c4 z1693XQbcantle@yqwEAsh*VtE-+9q`q3^n%b12$TtDJA$ z6`zLu8ei!jW&WD15C3cG^poOPQJcPUVlv|1_3KR0>8>V@QuG`Wl@a~z3?t@$q`RM< zE7oMn^_X|#t}1pbpG^*F{m4uR=QRvs7TX-G{?|1*YPTeY!o}m>kZF+VlUlWdLa5QQ zel?B)mzs5yuQVkW^}mRrOg|c19vtNEjWx^p^WRc7N^Ku3Y9e*YT;z5HRWE)qv>cVT z?k((VEI(3y-{eT;K(bSLBxk#RmZ9p*EliBRq5nIs?B66aX7a2mk7219&plL^V4kG< z;YHaQl%>#mhh+RDu3UegL#WrqDE0O8nrYX?SxDi%^(gpf`64xh6hY*Uo3Z zXf{Ab-uU0ScF!WEnn1evG%;uQf)t5AWE+mO04t?fGoQEQ;d65P2v9+N2$+bqAyb*W z{64)>s*X~&*|gwAJxGj2PY@TNhvG6~D>K>aB&*nmOYMuo3;N)=xRFh4he5sfdZPsS zSzh=uleww+(dn$TZVKGE-pk1=!{caT4n#!=Hi?gMdqI((Ke?CiMGC>&DSBVZ^Nw#K zWk&TWVnNC@bwPG~Y?B_yam0m4NLK`cqIgCb2%gRq_5BH;mZOuQzwtQP4XRECm2P4K8lC{=Ua6uhhMUf&z z@r%!5P1bYnXREwzLX7p)Q1Bk8OBcF04b2Je1v?KxNfvJ~H8(lZ!rw^fAh^rf(|iD^ zqahwKzfvWq0EOeDLMaiSQyga1d!iCF=l2p+B{6Y(FB_T3+4FWLz1{>#T5cOO=8_~- z(u`+q(vtVSaH&Ic?Mgs|Tq0E9M4YYce!=N1E&WCp(yKSLfa5c%(*Ofv zHjQ-x5hmg5qvUVR2(!+4!er9C2+kt~=CgTKbEQnpF&|K_9aR}4)Jy+Or=f&?ReKBp zJ;bpJp}LH$I$TM{0cBtd2isxl zlaLZQal6=nHT+G!!uI)Zbvu~5a}4k;UU7!B}D-kr^POw_qm4 zQhWH9qm270^q_nIzO341>bjD95`x>d9G{8?FpxQv!beJjeVDn$F6i(`l3>!gm2Mov zhK&Zn&2}C?CfVl+eZso(0Q2HhP|iirosW|#J@U+YL24-WwxrVvmgWYBy3fQ-!hq?E z2lULLHG3v>8UtGt=CF5hL?REpEer%=+8ezyDv}%Ku(DZ|j?(e0WLNSoVR4O5LoPGh z6s7=us-y32cDyON=tVSJBYXU89V6KT2Q2uZ!vbvV}V&AlBlEGwlhjnbTOSL0O-tjpK<7!uW+a^+$IX#z3zbI zv8|`#lb2b3^Qeio{ z8(C2Kkp=ZXg3(C76|IF%*CKW^j#i}htqnD*{<5%5Qa$t*$4(s!QX}Ll9DcA z0Wu+!J*5@D=m{~ghZvG~%ro8tv3-+n4X-5$tt{bzdQ^(M5Qa@frkF~k_e=419&yd{N4TeP?Vm0M5|OWDQwl zprJ9RRRR8UfsT`Yy|AfRv$HL<8CLD>EQ7*CQzo7yCr{Tx&XK~55|emmm0e_A%AvUp z$g&ythLA$Gt0XNg&;8^;I4rhzuuU6;w2bbIVjTi65)C>eW3yo9sn+SDfN)~ z0v#en27Ju&1I?{W{u=p$j(S#!_@TGa9^M*{LhiF9f z%V41|{Zu8%${C-R$sBrNva52~p+;P+TwIu3~-R`|7H9 zHM3y$ZH2$Zd*h|XWTV%*zI+323m5Gp;-B9Jy5ZtbrqaKk14~QzhpA!&_+!lRyeDn_ zER5l31`F*u-@g>5E4R@XB978(-)pJF2?==&knuL#%4KyRIxL;VouH`7A^lQ)p0&Xe z)25JsfHzzK``m_MQlT@BX&=SExG@AFN;QZgBZ!Ig7u_3Y$Q(@ZPvskk*S8p$1zEPZ z7nas_@N%HGjKGOC@TJitGswYN0`i%AwHPzPxgMu^H<78wbHa>XBH?&Fh^6T9C*0Zg zJ8B?Z5Jrzog$;E4g6byWmk37aMX&fF>7_1WzO!6+D8%-lX}cX$7Z z@`!EZxxaDRz2c5ZuE*^p^zsJ_3XgL?;0sZhezVHeIg#U%qm zS+b?683&lyf#lQg1Nl@Bw8?pD=OK`+<1Ffj1d)^3NHv~B^H_H{-KA|yyC2})thiT$ zph9n4U>lxn=0itv=6qq$^Z7u4ErS+=uwZFcq2h>0Ki`6guzL7Oho@oz)B{-p`~W^^ z6#x1T zEO*TfOtmuk)|^^muaG4KyGUH#{<=E+VBr`}INA^QW0Je^Mwf#&LC~pQBppOl1g#Yn z@NsE{yZpwy~ct=R*O3Shms{sp0jNCLnrM86g{=0lWs6A|U0@EdL&vyl~RBR1>VMOQ9L-+FrLQ7kPS z(O^!jU!}hu;N&}Ox~wxev~qMM>wvKcI_v@f@D=L_iACTGCF0%}Fc{SE2+x=vFRe>v zPAQtT8aV}9NIKQGK~RHo3w(z}=J${IMDx~dHz<=E~Z z@7mvcAPyv=%iU1@7dLfV)f`(i|H-6xzFTaMc#Va&{`G(Gc_}ViPWbS@ z@X?Hp$XMlDG_?mXvJFI)f0p9lq+t)3h(#;|p_!(5dWydesj~@P~<=Kma z9m*Qe>uF;2q_b@wVH?~017 zWD0H{gJrpw`Y;Kb95fo_h!n^%9G4w}J&8|%?qJp3x4 zDVx(M`QzByKP=`CAGry3vNl24(cWJu3t=5C`59BxIU!KML`^~|NLpbRKzXSK_Z@15 z{l9MAr>$QttUZS|-3@{b=?4y7Fga;V$C4>LmpJ9OX5 zuA+Si41b|mO=pj8GL!$~W<*8jusmnN(PQ@M;Tez)J?6oyF}jcV@87iFphy;n_kiFf zPP+aSSpAo52_ezwWwNc_GUP7o$0%4ijDwaKIw4bPq!|0wsVby{wq9}h>0%3>w%k$r z4wt4c+8x|euh@TUo-Vc#bk&Kf6#rna?}g7ThAG_DtD14Y9iyLdP3agIw+=V$co|{d{8Cq7lp7aP6RmNUD^a$ z9@`0dv#~{7sP}Hgw>uLUdaRvdm!HDupFHfigyg*d=eN1AbSy!+-!{)^iYVB^6)m!e zA8henF;1X+oQ7>lZa>RPm?|3L_nYv0tT@32)WzSFJ77=w5Tg@wV35QDqG}LCI}{U+ zwBMpIC`2-`q`Cq9mF0b(rK;{O@NEVzx!wJ-w$EDd0G}PLAu9$NJ9_DlZKl`?(#<#j zlW#RJzpRf-k>aFRH745lm#Z3<<}<>yR^UAW)Y37t3|{G*2j$&=`W8mC)FY{lDULBy z{-Ll3wSNxCm?(F+tJ)@kQi1xiX_;#^n}3__pg7e(dY_vtY*W0r560)63b0xKKy3?Pg9)kC0v;Z`G^zMF~Gs%`I{`X_>N}Ox| zT30$ec2Xx@^KPhL^Snahp0-1!aTLhH8m>^3Z(eL2B(~abJ87?v-O}BTv(TLR6gFwF z{<$iHt!(z$v^2!rf`7bb)lD3bE)QiRTE5&JtuB**;UA>y{#T^!->MVryWfBzR6EMJsM?h#(YR&D ziq@d|CTGe~?=;Y?q+-iRW|LiFg?Lp`C5QDjZzl2~rowgwv8)Gi77qN+zHtfCJ|ML+ zls%+uZzg$gMF$3kjvr7c3j#DvBUd7o@x&~L*l%|8Dq+KwuhT&@*mQVCowY%!I}cMQ zP8Ft%X}m50K%uua}rFHU+e8wVaWfzjtKCRt( zg<+()+pYm3MhG|iT;K`s3jYbhEOGlpbuSOiUqt?IOio(WvW5} zM>xNsbKYgUzmr5K+}rTZp(phv#2k_71L4HgnytoCtdDO-PZf%0FuA|9p9XyK$kzE!oa2}ZNbQwQh0D|k0UPmO7s2$0k%@Vdb;QqQ%Uf(! zM`yWR>E?-*1;MQ{ebo8d|6-D0^oc7Ja*gsV5!6+j(FuwwWt^Ro!?L&4bk^4wX~>{o z%d2Qi)8cUs?CRx4g@YP?c-bHPtq~$^yxm* zpf6VZzOQOVaRDu!P>%%ew|>_nUQlBrBK_ga>js|CI6HNQ0JXy+Tre@N)OHUs)XKGS zdASh2wJ<0LeqWMT*h!S0f|QF!NM7iIl?@HIT(*@DqfCF0Rs@Q>jbK3|sgt6MV$7NE z+pM5@RIZ>?;;>bz*{tA5Y)|E$E@(c%>F;J_7DHvGzL^q3EG1GIY7E`g-b zZ%fDJ0&X#g9`6;l0b>EST%DrmAsA0Fn9#C)miKjiQYQNmP=zvI`{?X=-5;4CB*sfx z6NOH*zybkfpX0MdTzF(ECp%xU3Kr_Bm{F9}#kh6@s&)35o2UMEO?tZlm55|z+AJ@X zCm}1U4lgEyg4*7SXv+Ul^%h)hwQaO61b2cKNP*xKcPLtdCpg93-Cx|HxI4vN3Pp?4 z;_g-`?oueO1$x4F#@=J>UjSnzS!+G_yytagsgfaI9kLU0kkulLq-3eGcxzOX^%kM7 zyT`UACGm!@qJSL7ilk8r7CWaME?N^{^zzVL&GAG%d!M+aT@!5hqIPny-re+juzY86 zMBD1OQxx`7h7d{G6YBMz>&e`f=2Jco(1f9xtX{fN%N5r9400~zaVUX8faJ^cK$vGQyiNkLTi?Vhm z!F73f#uzFiR=gS4_hCXZ$p*aMe!Pf_*)b%^Gp91im|`2_m8PHC!~RNr2$-esQ&G9x zF>sa6^Deg_do^LH_q^HTEY5VU@Z!3{`f-j$7&5d%l5B{c8TP4I0C>66_4Yqvn4o*h zb4kdE06K>G?IhG9x?AGU;k2iUDIy&(J3X~cu5A6Ln_D<(FUhP-f`|kg zl!4soxx47hY#ViHf=ZPDrZ&&XQZc00;b#79q1!#QI$a}>Y+uOcC6F|3%{_-%;&|*Y zF)*P-kn(dty<76sK?`fo?SYp>x?iVfgn~!q5JN{Ums9`D)179pZy1|4-zIUJ z1B%ga_ojp;cYD$DEk}WQ?yuJ6x*QiM+eqGG>J=KNB_h4Q=_i4v;lHea{CDs)>Q5~k zMEKfZ=e8Yc!4e)jy|*4Jq-_gi7b16-$p+@@-FKsjZT@ULKV9=7X=6nGRvW6>7JkIG z2~P`NURi=X-&Ng^do##DYSD?Tg;5_4xWhT8<*)Vo$wxv=ZHh{UP|WG!jST-JuF)#`X0ef2IKe04k%|T`!02j8-1h=p89QE z<=usifB;5yO?lTPj1QZ}Q(wl*rT~u;H3H^^s%T6Y8utugVjSAKRR-K9ks@Tn=$nzF z8zQ_Vg=C*b0=fAbr&W@_1T^jDQ)tksOTpoQSY9!xD2jdg^~5Zld2!^pBhXLCelbTLFkxpH z8b!;F{+Y8-6#glR|96~f&Yz}P_E)Zbm5+_mQ$^-gAKjAO(Mn(L$nTOfuDLFg@-qzS zgX^jk+(?aW|lh*4gQUAP#lDBC3xmBE(@g+zj zmCMy!i0bP2SL)UU^MSYoR@igD_B#ayIh(Ahwp6r1Lx)1c6&ymehGjxgo0K6_fP=Ka zW_&*Lv^biPwg z#W@MD%#P428pJ^AI~O9%h*%Lhz#=I-3zlg$`6!oj>K||PsgJRfFs;1j;1hB1zlN*j zsep9iZ`HF>{Fr`GFoH6WPo=!;&VElSo2dTm9%x8$mtSaHc_I6!Z$B~$A@xAy_C#0! zfU)|v)Y|);u;C+^U5bZ={cP(#%-W_T65Z+uOzvhLNl#|Akg~cA;N=~*7VPbD*|?bN z8sRd$;BmUqeER}V@6(D%3Hb5J(ye;wuqKEK*fa(_Gt)t7ag8m9yNYH8$`WZOB$mDQ zmPD@B2wZE8(Pq7vrUMn`4N7We@z??t>KC6?z}fkKUrH>D|7k45)j3&B2IbNef+wrp ze3LhuegE>K_lSMvGQaw7+}yL7Soj_tBraMYl3AZ7OnI_~0?;w*ZNyA~q$+rLN1y_R zrj`5_g(Yzbmn#2*G2k7TPsqasN!e!&|J^#r`c5(?e;(_V&rF+f?Zr@#*V=4~l?GjB;>y71K%{sb0iV#Bwx>>)JD-(JE9S&rqE zCF)@H$avr&QJmkVmuIM-?T}=UALDkEua?oupc`o!EYWb(0=QvJFb!SC(S&RZ>de#T zYp+v!{m_Z~lmeSnW-XBM%tp_7G}&+d7(cSbxY5sU);7ci3%@28`-~uwYzSAsV2jld z(H2?p()`PSnRefBPv;?l80DY1Nn|e#(pf}7PmkzgXbXq4(|KZGGQr~)Au#h&gm(_M zU{<>6itn83wTGNrYr2zl*gCG4NtZ+4Cm~-KhU?}v{#D#?vtOksb3(R5<+JN?Oku{t z2B|@}*Q3-6vr13#IMfjsC-ZPjv-c8@s?QZZKxwgtUP+-B8$2l0gqao_X-q?YTA*O; zQ6Rb@&+6m8xd zg+NZG_=9{*A|B1MU&cWN-Un`CKn)k@1Dk)JOV+3w@L#4wul@)mJ6*co%b=bhdrT38 zmQrM*)K2h*(SW2iGTp&B9DP({ak4em8~Taj+zO2I3x9e%=6k_*%MqLUjI|?LM-ECe z6NA%y=?sVx5&?v=M2zH67>SL+t&3<%UunD|8C0nM2#-0*07pn&GkDss8UGQ+P))oy zXJhkEe%MU5QSVa-&;>sT0V4f4kr~hZ182FNV;*-(P<|xb-ILY*U|qQ&c4AD19?W!B z{kU1pc8dqQ<8oT9I2?$U*>ng!NTfUNtgJSMaE7fLQ-P!-zQsp3;id>#eGfJ7U1jJt ztzy$YkkQ1~?R_-C3^TW&3cg1^v}NxjBhJB@J<=@%`%7hkA^ukWJju(Li6oLfvboyF z!1$?)KqBCZb=<5&Lpne@)$E=wDyl1z;cFWmLP>f=6JSKapW(bELWVW#G*4nYGAUsb zV=;>x^#rWS43X^Z-sCCmC9@=nDCdzLC(4Idt+gq$;A#%}@=7>e`;Ay>C@M zlLR#Mf{k5yPqsr+^zOz;*tA5L4f^YG?DRE ztJH5=Zr=8uc6}Gk{qziH8K`bZ?o;(v-4tr+o_DCeK_aL;3BUg(-oVUp zew|y4tMbKZ1O*#MYycPN8T19( zM2r)$8-3(@KC?2z_nG8oZx7R!@m^uSntckr;%U3ie)ra7(|On$d0IEQW{D;wi0l{o z8{4LUb5Cw7cWID>{jcaBSIIVpz^N4ylK{uDjWA#6d1hs?&A>9;2_h(z$V2va=+f;d z3Y!JTCfKeW*m;E2l~>yFE0WI!KOI~^jks<~R`$i{VJ z63<8fv5#OY^+(p+3v*!nw45(RK6Y_MNQxax<6&7tTqgX#V~0Dgyh(|U)7v~>-R-A} zW$%^1-ydkO!JzZw>_%?WF-;un$h2+y4QY+NKK0?g|HA^{{cl~t>#ytT3gvq=rO87f zLRYD$cL-Z!p@xL2r7N!Q)1&?5GNNVdC1Vmo6T+K;Lc^Sr;+gWtDfaGG?&jN0geed8 zlCGSdMW^Ps!NWul38aHSI0@K79iU|0pI$GO5FuQ%>I3umR_4kL|HZDE7D`$YE-O-{ zp8PXA{}gJ3nml7yxk(!`KzEY-pTEP(cCuUJ{LzoG8G1#UyU*6mv8L=6>F$$D%0E z(~_*Z;o;rVv4+zcC~(^q#IJ8eIL!1ro?Y)0PF~xmT3Ly_kSDJ?dop}3W|0>MZGK^4 z`Dlek1v~z(H!tuJ{M6ku^}ISoTnz0Uk^O7AX!P&KD8dcV^C|J+Y@_>iY+P?ObH_*C zt0fvE*D;s-XLrcAO3{C#qgL;3Pb$8&-;eua(R9Nui&ky>@wLb~IURNkViK70O47~YkMClQc=ZdRv*mfWgWf(K$4Il++Q908XtFtxPXb|0q zl1bNzK7AC3>+oA%`L$5>PFfP9?xW$d*mHeE*r@ZFl7th zx0g&MQgI{<3UEmaPq@)$cGBT}? z-OZ-MKff;};NO!I0)3ig?w&CAl4>a0g{54>JyTlo zAcp3NyKm>UO5}(EVF`b3M7JqjO&NaZ|`ti3Qb;u@3VpueXTnzt`b+nm-vIT+F zQv5RlNy?kKe(mezO*o^_v-R_Z%aLWtT;LoHJ~W61KqDPJ1K6sXw|T`M(vKunD=fm6 z;q!Fppx@p*UgW8Tz3;JIKJiY*TzoIT8|f2IOt%j!clt$6w3*69;l)K6NKdn5pJ4ifmyd_{k?4ypSj<@Oyn60JgDfkh<7hJCHZO)&;LpURy6|F$mQ zO`dU_W0rwEDzT=mnMxA5elvMNIK#DuO9mn>h?VecKo#;`k9N7U0Lh^(EyCvGRLhVO)-;n$j@gXyyf z#X(J&n$`ToYg0yhV&WmK@Ocj&(H=$b(n)nBxMT&tLIM5YZV?BbhTLUR>}7p>8gxAv z1=TOZogpQ7Nc3Xro^k}&x*D|RjyZt?;G?y_@Vu1PRF{H~tVs+~sh_wmR$=W0?>ikt zeSZ7EIW7Vu?R_{Px^T;lz}U&a!5%oKE+Edwyou+G_PRJAHUhyicvMZ203lSz+Zdsce! zanSdB%hczm(6heJ_{_>B8~!z%_R5dR5Lr3LLv4tL4UWjt@WP5FK}J@tpaq>{a*rb+ zQN%Zb&^MU2AxN{oOU=s!`VaNhu8#rgQm|sAajxJ4tE&O3i_47(lulnZx7R6zNOh4N zdPK=n&|ccyTk^6&Z-C!UpkMMyyf`$3ButPfD^!9q!V#-Fr+-F0*is`O9H5re*ZHx) z>p@D*K&d)|Dw%p5`Lkz=sSE$vUVe0w8$v!djQxZ0ry^%`-k)v#ZoQdfnndn#mX1R0 zB_F;qZ0#KU$UEwvE)5CNi1}#&RkgMT;aY3J^4+ua{g8=mW=gP>g7iZ|D-S57*DXK! zH7D!)C}9+1^3pg?Pohxg7=EM^YW$IqFqzV$Atb!w4Mm zU6$7uQtJcoXDxL?W-pubQl?wYJ;(`&ls+-^(*K@^{_U4sGd2D~k$)vwXWTlI-q6(W z+9t(qF7#iq+RWiGR&SJ5Z#g;?t@0bwTfc-yrg#n!4fG3m0Tdhhc|0Z^O|pG0wXe1k zR6E*R=lZ^#9Fr+^Rf1L%NXtUeO)gDm)i-rt!DDO*&##fD?-0%cFM1w6keWd5#s_U2 z=6>c}UqD$A=_}vnzu{%b5x|whOGM8k7t9oy@d_y}6h@uoSt@ zP`hdn0pC`mo&Ub~mISSQ9*Hxxxrp9>+NgSBGcsGW!^3U|F4SKFys;#BqG>VwAXd^U z)o(rx$}d{%7>^3X^5ex=>mV*P#o{y@89qo6zpMd+ge9wG zOCELzTL7l)4$nw(HzAw+T<``fPq4g9_B6p<-?%jkW(4~ZvQ*(^Um;c}d~ds|S=Tu_ zgOgk%=P5NulNAk>bLnURfWzAT)DQfLPTd;}7lXJ}+D|Fc!Ft-|eaRA|*A;cMmYyjX zOo9Zr7g&|%dLoj$Q~EXiy?N9TVo-*-_hZK;cKlw{o2)J;WQM-Xt|Vrx(lNWj*5xis z^lQdXIXE7%bJpkCA64!U*U8DOg_{SK5>E2OR5#sF*1w***Rzn#I^xVVv!RKY_y70P zAmW^%wk6RKN6)JNgtIRHmz%@1(bG2R$5Zx|h8quWZxs_Ss)>gQE3!tHe{geQV?>N~ zToJbxxy97q@OAo@wqgP1r?b~B@mIk^4i33VN87Hjke_A!RFF?Pk8*Yn{q6PboyL3e zl|y(*l6r(ETnGS7i#tP;<+Dtfo-Q)}l(HBEeMmwE-1}wr@zu%^P=|BAGe1aQ@{QiX zC|V-!$q73{NP(e;+@KZ-I8+L{SH9Nco?rV(&I5=8yc_uO?fLgn`R67&V#6X-FYqDX zTl+IPrS$Ii&$?8STritXN97JT$v9alw^o#sjLJStQdks($_VLUy>6gNc7A|lBYDzsd(I`2dQ#&8Loke zY)SzE2f`bOU)gQms-+@7%-ruMcf#AP*&Elk!T)VJ%VRD69TOApYX^N!?c8=gqFL2w zXXPQ%L*V=Y_vw6gk1n8oLjZI$+=AcG?-Ku2(c?KPwtqB1=O)zMA8(z)&<+dx5-@Cy zKsZ%&uej@0dp=r|Fp0EWw~F zs7Y{7U58M>mbF6{ac}lD|Ok6_{)y?*S39f!(iK4fs41D@C|HD z?g~SpnBfTC@k)`F#LuQ*4&mO%7KfAwM>M;sSh%+`znp0+5mC}ZTsPtsNPKE=;;MH7 za-oujTsO1p)k9jjqs-! z+bh}ZTi`O91Ke}wc8+Mcq?v@7f)Rf2q}(*b_N+g3tM_4}hOT1ofm-^-xsD|O=EW*%Z}q>*MjicUT$Qwi@%a;QXwBoa#wL(|}^1HQ@b zVfPh-ug45Qu%&W7bINIi$S(NZf62`^K7YTPNp!MftuEFAoymZgLU*&7?A?f!$;PEA ztYQKL{N%xqf+#t9`Dh9Or^l|#F#pS&hpE69_}lQfT*9YaH_KI7r`+nwSNYIY6lAFJ zNv@UX8$bS}WWMcx+R3|hJLkc8egz}{DSe?Etuo~H?>`rs@{T8mBRDnx5L0hl%GP2a z$|fHWSY<`)kAebBeL(*qSk143Sn#1UoiWh8XE@QdvkDrG?k0is)k^h8Q%EuJ?=GXb zjXVqODk&hiOjeKWu5HTyClC+Q%-s6K`kclgl+S-vw04U|1$_6Q}_Ul zDzZW~{lSlk*Op;A{_m_C3syoP%L`+z1#AiR@*wc#ph`3#1Rxmf>wh^9ujq^!y||7+ z(w<(0Wju^Aa%Z#euOHa?cqP<>3JyIQxh=Bu6K^DGkA_v;laYntR*%D{{JdC(Qj*RR z`L|5Nf z8o4#2gU_*6B7I8cgiRC6re(JS)mui1mRJ-8LzVfPs zi!e1Q?HjhcnC~ah0$+olgY=pQ_58=wKq|+x$$vnIAjOki5++0{e&vPBf}S(@FK>-m zUdgmb6B7o_$3KE&Z~x(1ZV4OBpbm zeivp&`Gvw6b`8I4J8n6r*<8}&d`EppxH>)DdR>59whOBpi=_7b^A#CUx^>*?FUD%3 zbAN@mg6)G&7_@@E2KA$M_eEY%yO9lF@fV7Xe?XtSjDhnuHvH>ZcyBaeHTgOoxdu_= zvPjV`t&8)yC4eu*_Cz4?Na3mxCLl>TlsI_JP%I!FN1Kn#DGs+%c~1+f zH0Eq;`@S2qWuO|pQ*)zxkk{T&tO?OTdBucQf7$mh37`W)wfD-BThOwc0{^Z&J1wiZ z%KI)JZlKa7et88+idx%iOlFu`D}Q_yO=$=M0^z-0ANc-<_W5U_G?~jk@lDl(@Vnoq z{(E@o_q%J}ujJHYjmt&I#E*yUA2y36W18yZRyvXuTTSc8^i6r;m(i+=P*nr^sM{4Hmh;5w6v-o{v51Hd` zT6<49`J+W=W%$Gn``gy>L8thy13jDhJly4x-FmbTr?+t)MA=Sz=<$po1>UGjE{vfX zeIdMlnz*KO=50Y?Q3j0$V;>v|EO6iH8UfbgktC(0(^uedG$aHZq_5V~bf(^;GXYGy zvX^A}=PansYX1%Oo|dr>yqxMMakgrKZl503X!FS#4G!gbZ?Ln7QI4M`F`K8*Q7gbo_0gE^dJD3oGb zB%R+1$s3J_TSS)9PXFKzuTxpodwF-9E+nf9a-S^o!1A0~skG^i)TWf9B+oZG7J@s> z1sJ#JY8BFzA*&4OD>@@&n&&eN?8J*}vKr&@*qP{c(s9hNw5AobHMl8+z4R%pKwxGz z1`kavM9Y*5SpgcZ4O*OWkMf56GkV!Gs;JnygiA+LS z-vn7$y3Rz-TBx=5Xrj}rvogHp{>_hur|Dg!lQ?H>V_v=P_X7W>n8qh#$AOg%`NGD% z*m@E>y@kL`@-kyGJ+5j})^?!?Ejm`ebc-C>(V=`be`<@Ujin2h9fAv6^cc=hjS)%# z4k2$AmO_@}n0Y{)(IfI4SP3>QEGye-hoPV6Ih#^^}1uuWMSyr*9zisu= z%XVmLG-2FV^DOV?%4$|Eb0{8P#yK61ZSFXgqMo|e_H0u>dCH1UiN|5!jlUReb`0IG z0k0>U3@5sw7jE}>GRJ)mi52+{8OwGIPF15u=LP@;&3UEKwEv13gcU}))6gvHP%tuD zT}uMZTJS^I44bYvCbbV1GWR{M@%#IKtEm%^r9nhlG(RuRU<|9(W@ILk@S4K_@e*C( z97qai?M*>D?vfcflg2`Hj?kgho57y(}CI!6`a)Raz_{o;32LLpt z1?Ow_Mn|HE^pnDD@?^slUOGR)#n3bu>weFP<9F#E_g!Kw7M;Uny7ZOmI%#aVd<%D- zLP$fwn?1IgeV|ecYB3R6h~`+Zbx`!0U$JBTg%tM)5%7ubqD}Q(e;%=@GC_gZa@`V) z-AbzDg+U^TxG@T0!PHpVElQ^|mVo5Huo>>|Kwh^Hwf)O144Ce{hCR76Z=+G2dFDQ9 zEpPP0IDPw`!o*ri08kb7mRvmJWmlXD*^SPEuS4)lI*nUwG&EowWzE|EcM4v$TrI}U zzcPto<9$lyk}s z3F}U2^vS=yU0F}pd^+*ge)cv`BlwS-{Q)tZnGD=$Zz7WHiM1PLoW$C z&=ivmjvtm?>4^xznH0|qKzX5g&AcQFCF$<@E!m~W=MNS|L7A~V(I$lxeb;U zl3+0SWsrYIb;E{-Y@8WI%rfU-J>Wy-Pl80)$K0%5FotGm)?!!`MvnvgR&|E_c)zA7 z)6s0UAUe3uJ&GNSuSTjtvXvs=3T{skMTT_^9;6K{&<{kB)^L?8S9e1#VMnfHxi&)b z)WiT5!oOqitu+5iA4vuus{NWgM7^qK13NTXPMf)w70VTj8N+I-Ux_u#-(hbXamWef zIy_)Q5N_kj-*GgYeEskiK90o&&0$Q_IXxkmXPelJj2+L~FM_I<31Gw_ZfIOFfPqQk5by!?Tr45h*E%osYmY14ihTU!!NS z9w+~7PL@5>XFRuH2P$|&bmOdzOz{>mrB5hGnPrQ}AcSU)p19XEA+*hQ_gj`}FS1N# zyDA89;Sy`>!l_dmG!_k|rkJ0L2kP-5a>5~mYZGJo{mnyH~3wy3csOI$7b>Lcc;IvMU2I)E9BNkzX&Y? z*dojv?{ETlap+S9PS=^dO%ZMyC1t)itBqUNp$waZcj^|bgsFkn9Nc^-2XbGpuFKS! zSo_L*q}z?=&1S9r)6T|)_muCAhnHe@7&r3rIy}rxbr0}O&8ZXZ#|AxT$8Fs8B7F3g z32V=V6_-g>mWKHhC7)?8yk;c6kpTY7#{vZwWaPY z5n33HPeGZfBhC4k+dV=IbgDjTrox?!KB3GM-N01>Mbg+g)>e>v3h``{G(eRQO8r1L zL#Jm+6bx|`@2T|(=l@+-Bj}@K%3p5Xk9|s~ptR*26+6qLJR6tQqQ5P{JlaHb zAv99Zp5*!K7Y}?~0AFv535bS|3(Ckc-Fg{TxTfRn$C^=!b0N1DP2c-Q9%c+ro}6!| zi|m^6?wai9@UM}vO?p3+qg&zDtnmKQ+tAiYW~XXPA!~b=UmEhvy_v|uvujZ{o>8hK z=*JySEs+9??zi6Rm=|E48OgWuLx8-YLF06(qQLharsDaUr8o`}9!E4SXjMR%&k?}$rghX zU8Xd5`LeyGQP2?sj#*|tqo5b?Qv1NDbu(P0gZ|92*Mk`PxWWZxVx1S)$T1GNc%-mc zx!$$)OzGGZpi`WNl32r&VTg|^g3aT#d@rjj)feZOlE9X^=)_7vIj6$jHTzY*bQXVJ}W?{rFK=1}dSr{{*pdGh1*=9#f0v(8I0r|~8LczDt)BWx!#EXAubUHbTomWWnlOBaM8yNB4h39=h zC|cv#UPO?Af<0Jxce-JVup)PvfPRJGWBLn;R8vZS43|5JM3smG%LddiJ+JXWJamZz4%io?$^L?!=*`%m20^YM$G zCh?0{+ue=7*)~=nbtRxjYC=&(Qj2$CT8?oRgGgFkuACRsHZcejk%*5U$jc>%7{aTN zaP7Z=5w^%6P29!xf^xU^eDYjF&YEX+=6`E*D^&hJ(}7u>(4){#kXen@>9<{9Iew|S z^6?8&3Bj*L$P#!;Wl<6m#X)@qL>|2vKnP3~I`hxp4YSl{o7@H?tn$>WVFlDcNc#9P z7NMVG(tGMy?^uN&8!OX|*=Y%Jq zkJq9!RB4^ZC!=E(g<3&Bec_(Hi`c=bfJj+hRiuZ;$UZJT_R|+BuX5qF5v(Ou0vglx z_spBapGif1aJrm;-am_H8oZRSZt_k`Bqc*Sec|ktxp)`m{EwVZrsY2i8l*nvCiqrK zASjb3%zs~Bwh{UihK4^(N>CCQGxQTN8cabT*d6|Ko<0ZPWw!F4jf}1~?TumfE0XL^ z`(Wtc3kRFuiN9Evu}7`Pq_AGX+1&fb3G8fdR;L@R9O69S3=IWe?n-_lmlTV6?DoXs z=j|8{{-clSNl8J~(?U^FgUJP5(hVBzVG*R85bW0gOPcjR&TaW>YqN{N03*Eu;C@jI zd;9e)wBt7NO>kPVr#116p~H}pm5T@a&EUY~ccwu(ib#}%a6i#gvv4vZx0s<(ApP(D z@uJH882jGeSfuu}VWOTLD{Eijr|_cm*}+&PE<)M(?)QofJV?j1{Apqt(vib`?v`;m z^od-S!GDo$cZJ6h+(wm>73=Gqm)T`2oiT`nB;(#Jv)TyTmUCi2rCI!7G|qjf?yydS zHGNuVcc8UrI@pi);PH3u-5#vneu&?KKJu+5^U>Ug?=SEA$dXOr_JasttE!)dMLq1# z1sS^dP&P6Apz#33{Z~{}NApin8VLp)#8^Nl;Mwr5owQ&aG02IiZf0^`CUE|8$X>cH z@ZVja@0kCY5&ahaFfI)cR|wiM5g@qdAeHju%I?xdhei~;S!*J zlHgh}CxPKO;UQ&}{Kc<8`r-@_^T)2ld_yOSn_1rCM%?9YQX}=>w76+L#io^{tE2N@ zY~(y{Zs6anA&QreJeJc>+z7Qce8MslV!`hi$B-=kT(zi2N!01aA$qAsH~Lr?brrs) z?Baon5W~{ZLZCD>ILUM&N4_BAS_m4 zy-StyCVa?@=l3Vp&!TSzAQG0+_qbTiwkwWZ2l=j~USDrQ0B^ri(SC}Yx zS*_pf>-IJqqh^IICEsdRzxHfMC{ymYV<#)w=hK@5T|ZoU|g;T8U=@e0Sb)%e__b4PJ{Q`77C>?5pnMaQ(e) zn~>RT&^4mh8UpU8G#Buji80*Gmhi{|i|ruLj+jF%f3|#4NEa*ZDj$SJkBixP2K?+; z|Hf!BED4_Yu}jZUFHI@2jPJ``?K)S+VPH{Wn0j(%k54Zh3bDlcJa0NS2v7ou2ua$; zWQhDq!g)A_HAp282+K}Wm&x5gT5YzqysoPO#mM-j<)U4?NOe{Z7``M$85M`7c$uUF zDf0FOkslH62^EA<0KXLoanh&d09MQ>tv`#(SbGO#BN4J93c$^kDyrMu$VV1AIRBwf zaS$&x{5wGI)hNJ0aFf}?sq)ck$C*(OhlZwo!QzGM% z8LrSuV@OD7ayKw7p+DT_InzHK|La%G+MoD5QMM2SE09lwEh`CksG2(Uyhb+#N(!n3 zj6r!BK|^6b2-27*nBSy*e+}8T)|o(QzysJJEvvzK6dFzdPl`g5cw}6?7tW-pEB~|ULvhI zLDmAN*L^l61$CXdo6suP$t_O3@@TXlL~D# zs3WY*T{u%`3(10bf7SEW;MyE~=iDb$=#F1p!%wo8Q?D&&+L1MmSC=ioVzbNiMm8Pd zGq+p?b9WW?liy_a#FrTuT=%+1s!3=B^t(bl9ZZK;Gvy)r)N{|IN+heE&WdJW#iDX07qG&IKVe~%=ELmPxM zeg%rz>;J@#F$}cwO3?4niwc*KCRi95YTa_O%l;Vq;bi_i_hW*awp^m7CSaf)326UQkREitP5rkHE|&2ss4IvafdL)*z~cA+zEm2| zo*uon8Vs*K|MXfKvt)yd0#A<`Vh#vJ9QK1b|BCsDrmtPQL!uQTMRh6Okf}2D9YB~T z7}ybmfKaD^=+b9es)u1T@%s<@=RjjsdvE0F9kN$;>RfgX;Vs;(v-TPwykaBlyrtzWN-)fFE(Udv8yC0STW<4JpA`8`VS>5SxIsOt*oWtXvR5ym$SLIe z97k$%mEb*YCNf4r8j_SQ;pN(ER_PDlJ*(e*jnc5H)n=K>r#nWfl8%IQwbYCH zX(4IJ0&n1Fp<#|prS(@F9@X=qEZaR`OoL^pM9@>D6I!Xb*!)NA3(Waqfb{Rr01Fax-kbWV z#hglO zwpci5`aa??#;ENyD{@@B=>R?kg_3WlsXj zNJu5dTe`v6twMQA@e@#Nm5YO49s=Zr=)+ zEfOE{!JafDq`U7XMN!_}*U^4?dWIMF5=}s8^GK|^(#NG4hR2^H&X7Ov#R5yQhd-5) zkaEU84GMg(zXo>9DLU8=?`0iR(cYiE{5jKqKP#vpn~EjEs=(zFRn-2-9TFDmT_{9^ ztodNXzE^82#;sdn`R)O5Ux?>FEaI_aWPw^+SZRWYUy7IvngwH+gfkH5`U4!loex)D z)HwN%O|#Oy17VK6miEg_0)e#Rh5*E3JFTn9={E??fLs^$Ml%;J?Vfw7-<#r(A$3Gl?be~s1Z*zoSsYzkko2pvpIaTa3Z9wo1sWn z>TXE=XP_c7Aop1nhq`6vtH>jq{Wy#|TzVdAa;G)FVeMT1A)a~1HCnqA=81+ktcNxx zZk$RZU9~YfbFR9Bk~ubCNwjv7dYZY*I73r*!14Jp5f_OXu_tj36+-)ih$QD@$8fEJ zpU>4>(S@*SxsJN~XHw{JQZpicymY7liY>SQ8&hI>^lB2(`YPlBw5>lYGaX>tAAP0I zGx$&xk*g-hK=RSp=iP3`Xd`wd7&{i9zPbpQ6N^1s!|W^JeO@#$Z(W0W5Lc!wiT^aRd>^kEpc&D?gw3q5j>*BFtUD<2B!iDg1uGbh=*wh;W zZ|5^X;YuKOFg<@;Blw}ag3jIRfzFCY;t?$)ry`|q)Y)9q+gZd6KR-!EOsLbChmDsZ zJsY9j+8i(NPF)N6n!J{WGI5ulG{H785_m}ei$5P!*y!)!+Am;k<4OM{Z@olrzIPz^t9!EoJ zK2&o^DpGOvVP%lIIN17edRk7<3ck@`B`3losQM@bGL~I-Y`u&})`e-xNsg16DzH%$ zcfu=k9SY{Bax(cayA}5WD^3NRL=)hlomqnFjp>2l$Yg83WWy*E#%5v^zzR&wv!8g* zHOS;?8f!63p!9O-O%ZLJd<5DW>+WM>upu(UL8PK6eb43-hwN4Co|Vh+<%qp*1g$vA z;zu5+U8M|wfMgk!mk{+Idn6v|We9Kaayb1KZr@3{-GI>&a7kywPLH-uW)mjey{@aH zE>`z;WjRzG?3s>kMH-%O;N=Nf-yxCoeQr*oYxyA?WZ+RKIh%W;{Y!?7>ru5Uf5}0b zPK%j9vehso$32^U*kN$4e>kJbIt+_}XLQ>yj7~qeNZ%Oys+W~d33F9GwBu;?5COuB z`%S-KzR+fr!!&!y)h(4rJ<%BcGeYJ+r!m?aGB&qCq$BI*-$L0H+zd*mhjhmVBfdRu zc{WH!NyrU)$~^`lVx+ssEK*3PJAXj3qct}-oyX74J(iAO0`g`f6jBdW40>LU0GWnu zI!ry@XR=DE(B^~{jV4=TCspS`@S1h;sVT5hL_E0h$R77Uk#*p%skG8Eq&qhsebW!Z zt4LtjQAdWLV5wSqq$UEbWG?&Y#QVyq8c}e_)Y*I~gR_u>z{ngVb(C1x|Mg*!iTWWw zBCygF2(c=-@cryJJ-N^yC^ar(^!CU!;PUlU^e69$96lk6?|ILtNFglmp*pjZAEm}6qnbetYyd%~N`J)?F zx3s0H?-cPH*}Ne2Jb6XN{rhj}RnG?$YvXniPan#PQ<}b~_=%@fKxjTqd{#Teej_5u z;7RklANuSx22NtrX#fAm(^1y*cc9@B-Kd}@ruUc)}lSaj~I0In>wP)F;MBvt=kNFZTZ@DZ6OxkIkMh_k`> z&j_j)GB9?p92e5gcgimOu+{>PV}BWKaaz6pcxz58?~HvU$>Vxzt#2IM7@LN&tnX?` zCn!%tkkG#RgjK|pN=d6D8o})2b;EnD)~9_+Ckwhkw5QncGj<&KOLnp{mPT_FT&79LgK?D36Q)K()vKZ-F4S4QG{n&!Gc_C&GE z5V#n%Rl-u55QexB>^$Sdp*uztc?cdwhG-Y3^H|Zp-AXP;ZN)I^*d(>6cXdaqCW+7}Oi;3Znx#d^IWD15R zO}evYn6{~V?AVJq=A*er6qq4`Ymcs?SNubCS#`u4dx%!qLxn<$gQ0YxdSuu*5{*?8 zNvduQ%3O&aYm6N)-);nNQdkJX2POl7K`C9HjOX>!#xfgc&DLM><)VA<`fD`_)GnUA z?e}5XabsA*x=$^`}Lg7T3Wm_Og#a?ANI6k#} z3IAy{gd8!G$(lfvj9U?aHwBlDb*uTM)Ui65++WS?#KAkniia{I7Ia|I1Y)xfSI}`6 zA&e>)Y>N0RL&Xbdoo>Yv=CRaj8X?9_s+YsXe1u!=7tdL*G|h|TN(Ar%x8(vM2qR1A zd|@B&GmVSUs^H-K*0Jh)Jbr0?Japy_mP-GD%(r~t= zV0gvw$(Q$Cwf<$Rfi3VILhR2vI|+0JY~4!ImSoRq8SVPSFPI@Nx&CEcYdfIpNTd+y zvA$>MVF5P#yx?AbFHPU@PGeBTz=)aYX>9k7iAn!|F0z5re+yACQsu-*AdC`#NLj8L zL;jMpXQP8O{f1e9aOiR^s1-T@oZxWvK(9nqM98VpYf44sc5KP35M?kQscyirbs6GA z_|;T1JXZ!LHNM4 z2^Yt>6Ka$M>GKPu(K8BSxi1c^ncfU!Cc)+Yu~Rtkqk~pD(prA2%y~_hzGHG{8!kP( zeEd80?}}ALkCX`8^m7c|T%97=0PCb(F1}~M{x;M3vE~or*P-ac@YUn?B-ikKOkcJ-6OnXru zk_JP;%Pv;a2#O-y;@|xD_koz1vL{$vnh|VhVladgc=cfx`7)Dc!tw6KZ_8}RLQX{YFJj2g*xV%{<{Ua)!wx0||GmXc zrtT0uh!eh_n{^T9YTFy)r3w;y{8#bN{G%%nDnFM=n5wBMc7If;NtmO-ehSQT+Y?uy z4Wu4Jqq_u1AS{-N=0KAcG-vP;j)+AcJnxmdY_hc7Zr>aU$cQC)!Db`2*>bMKvxuV!93joRZ8wmFBGXD%Z&$qIF!hc-{Akz@4ztyxEq=oVAOdE5J(`~;7( z0yGw-NPWHw;VP#Ut!_k|E0+-ftzt=t21#fyAwco__uBtReE%V)8qqWx$=BVb1uZG% zb7Z&mfFjZ(PiLr)NqvBK3A6xn0=1UXM&5>rbecJ)km1MFrsXK&;Er}iMQ;pG){lYyC>lWV%PGef5hn zs-+&AW+G#Ame)a5=`EgPofdSwD7;h#!LQ_Ec1FGGb zy3!qaC5;i{oj`5%*vJpY=GoT_`kovLfk(Z1`VMYrw+-CV4#PplvxoC7E6HH<+uv1o zotl6yH>szd+$COq6VL7$V;ui4Js`2s)nL^gr|6V+)Wh(ija$XKLj7M+%6?vDt-oRp z$&jhew$_V6^f@qa*t*vm4FJD~rI2c*wW?zYAt-SQ9=23(h7{9#RNk1*mHEA`(p9oyKk>56bX>$*H&FH*ByfRh3ZnhhAlXv8)Nhna zN+s59tXzBf&jM5$nN^8li&)mDT;98b1n#sTQ|1tX@QKZWfO(_boz&df`$T|+h`7|@ zInJ`Mq&oF%(n@#Jttz{h!1({UHS8Ow!fKygOzkA^{L6cZjG3J$Fwhs@ zetmG?{A*Cf$?Q3|+4{LPrq3z(;O3(&<#6D*6{Xe32ZMXPAJ-WdAOAfs#6iY*E~_|p zivAx9z&x-kP@KzuL`lR(e^ICm?Dvgj-*X|uGZams9PJcdXA=m|;rxR~L?lep&AEF^ zk)CsA>5%kHd=^B{J(5@l($J7CXQAbN$RS{0@rhqk{S ztAER@Qv*giB1U?cQ}|NDX@9RS{kVTE`N2?Rk(2r1Y4B6q^nVadK@Nsf)TI4oczFI_ zM#1aGheeYu8B*u$lAA6WtbQ-Slw;SVYQu*$$D0&c_Q&8dn)8>dVdgH4pFz`bdMx~XUrt-M zX0>zp2wzs;owPl3RIo!Ks` z30YceDE_r84s+p`uKU%uUB@aX+T5WVo`A8RuEOoIc1BtDHZ1>;Zs6F|CvkW{j|o!= z5sxqDIwyj|iX}W#e9)yzc#npR-Y`Kq^If`$bw5||Rov)4Zb`3s{obhG%Bos9Jhcty z2@~>2w^OMDn7#=i(NTVg$07utXcLY^TV~`zun5V|%d0asu<;pc9@rKK5`;(e=HMhj zGe7vPE2;qfgucdKyV^n%=Gx{tYEJ}jpsSmh=N^9D&7_VLa>tj=Y;Z-zI`@wT5EEY3 zpeg*<*tGufm(iAHCF|#Lu7!d8?p$enj(X1IbwuCcEKc#(g#IerUW$E!9L^Hja4ud5 z2W4?9x3Pv_$vmFssF4y~JsLY=y1lFP_Y?IfhR~{F3@o=2Ame0u5PZd?@j;kaMwm1R z^Xtu+LYb~$2D?QitN$rda`-Y**K0M_B}-nmON&IJBmXKnXVjnRtJZH_D%y4gT&Pl& zSHsAa=m6Z1y$W~CeLQM>Al+SC9YZBym@YLvNkZJ(H+Vv)kSz!fA&?*)eQjIRJ=G-0 zc3cZ9SttCe2X6b%aJ7@(^r@x42q&>2SZybnln%UW7{*i3q%>mt`6C5>NsG1#Wk>9wm%91G2Ka9dzcbLQ&+pQ2Sqwf}9La%vM6liTjLeoiaZ^wyGz zy(_J0gjk}~8rM>HI3XXab0t(0{`j-c#fE;*eT!37K0!|7b(}uW=A_Fq+J?m<70#w) zO`XWS*+o8Be}eO$8#N8RNg`jVJTz+WM@<*2fxny>!tXqWpO6;A>8{QAnD=UDH;x*D4y~X=Hd&=l=__Oc>ku53%356a${uIB`I2%oQh6_7!u5};Ph&w5& zRYi-I@aU@Cla8Y@IO8OL3S;T@^$LlnEjq@`_*Ta7dxVB#`w|LqxD{@9Az7Y zRX9bB^EEMSGQSb!+GC9pNY15Qb)Ha6qb}dzZfvH#Lo-63 zFzd*b?wHR@=A@u7Mp}QAFR^&FdKlLkKbo6nn{WM~&#hDfOo2Wg zT>z=p%uWztEpH|#qo^5^1Ivz26wN0pJqH}%q9%;ZVy6H}FEHc{CvPzSyV`cANf1UF zPf#nFc?q*uGy&{~(KrBXtM|?Qs^2PRvq)A!BSy+>5?O*sSy?nmArOpr`WK$weNZe1 zWv<_34sd`URM$V5ZpwyaA@?17B(||W&NeNLDJvkr@2buWB^ewDB@i1ye8)~;@XNH| zr~y+F=#lL-eDvQobbtASZK$$N$MhtgZsg1xP{E8X6-vApoUY%BhY|FlAr2|f*#`${th0OeakFx#(Cr5%_k zmg?*{@0Bk zenH#K{HY-0i*vP{<588cCI=IPNSbQwzPV)z+$`>d&&koVyiReCSbjz}sC%x#=hyFh zub5yfndE`D;9Krf4~(KJ&-Evm(KnOr)t!Yw1(x$tH+X!K&Wjd37s}Zv$|hWsy_i{tjeqSd3YSh1Zj~83^YwYW^k9@ zO-63MM&%DD4OqookV9n5OoA+o)=6FL&61H?H427a8lFDi&B$a{?Ugb)mbGBu05BRN z-an%zE%z=eVnk>WN*94R~IP)JSPjW z+=t(HX$U#g6fsNF@@a=faEXZ7ylU&?0F{02?Qc%W!=p->RRkVpNQk?GBs!;@p3d^5y&)xHUMGxX&c{wAmYnFj zVVqB8LC|gNR*Sx}IS~RX-&y_UJEZU53c#27Dg(TymDS!h-43$wIoZwd#>Z6O=_1=U zF2!f{&KlwE{p!)0`&$2yeN>;{sKjivqusYs1vlTf|JFZGl9(I{xo3-hqo-E~5RJ@p?>AaCf`Bxe1XkmDU%HPI%#$ zArUEpz9;CEQvESybXb#esq*nF21I)UV94;1p z&Q*+(eYEo{pQcivq_O}iVV{GgzUtvW7g%LQEcK;joKK8dV8t8lyiZ~Em6-7D8+ma_ z4IAgnqbe7TvLPD11qK!gLRR&Wf^CvJ5F-Wqc)>Y2{;dGL-}xNEBuVMsA;^*+dWisW zvvvL|db?6DDs#s_+iaiBV@#G9FU&)`s{yp@*0>o{Ee$}hfCZu%qzuu#{)CX*{ssj# ze{JcW-l5Xy5*vJGeCwOJGBAztAs0}-A1s`k7cCfIwtlZMO6PqSA6rP@eE65l6M?PE zWAVpV)OU8Z*n91+pH|mxbl19AM*}}tQy|&QS#HKJ-|jyK|D-=mr=WFlCZlow0zs-r zl1$Ld9F}&zQIj=>r9R_F;PS$N()J`Ux$7RGpX%w~mGNS)U2P;E)K?a}#j(eZ3=x#e zb6>QRTHSeHHSNr`)x18|DYF`EbXAWn8z6Whp5ca~5{r(s)y=-QcX^ydmgTF0(R z_yY2RUPqB-<3!@lzS?m33F`|Xi{0oKvroJ8`~mMf?Tx~BFgQ1}(`9ksPgFKIYaHXe zaXkN_Ci<9%M^MI?t0m zdK9R-x6Y9`kY7Q@;p%>7s+Q0cxz0lQxt%ZB=G?q0F-_Xc4K5sBq!^R5eF8lJ)RP#d zfk+I%v9?o?M%(BVM|8^H(Hh2@?~)ur#@QZ6wr@LfG+1xx+_x`t&=?KeIotQ}zP3_4 zt7riw&FAwJR}3)J#MP~4Q9~QR49mz#OC62YC$=6$QyZ6m%vgmkhFUI>h#G>$f9q0k zUFtpufNLTh(K2tz-^=d~5SyJwHXfM-_y<)~6Szn}*$OFADRQ&yvAdX}k&}cD+WKJc zYd zxwZ4${1%q~cU-Dr8>b+&LXca_^O^#FA{5kN1rl4!=JNWED>#io%<8(iW`q5qDWLz5OXyW-oHU)e);ie^ z-pOpozu5J8fEG`7eUVPRNjtj+p_XiL%NQjc{>R%=s+L`e)(dJ-cAtv|Q)I(}?}|$G zhRSt)NsM$FololbrY^u~pI zc2uX?|iOp+cARecd`kp9W)nv=C0N--Nbt^(B12~Sl>^q=9@ ztX%xI9aKugcMfNk^gibsjlKJg(N_*324Bgnm@LnOX@>}=+5Y+iq2qWY01XPFs8Al> zioP%aqg^tlN|Grba&w?k^RKs&9c#7oaGIqYnlqPguZ2OV6=7(B?8iEC(}DufpUI0q ziEb||V$N>_dHvR8e)S0Q2PW73UW23MKVCC^vXjUlDcpFCBhOGpV&Q7CpD zj$2W98$X^3KN@4E?KA}KGovDV3sB8ygW%QC_2mE2)zdQ_oQ|C0#Y?x#!N!Qpb7oa= z^WKHMDoDZDI;jT&W$n@q_(PU&-!o?@hMLkP@r;0?Inr1(_hpNdQ5BV#Zp-&mASL8s zmC3ZRbe9-;TgqMb6q>x8DW#Q>JZSsp5jGfK@Ezr-L8U1xd-mMR4qUF>%rrKZT!v9) z6wnsl|KMpT+Kl$TAb0S+mh9(o2ZPJ6#tv_PCScZLyW5zx<#86AG9%% z;vSpQ%&_n+)BnToQH`@6`O!PXgb=tjFC_N&Yhht9(&~_0V!^=u5=E9IC541ZAV1-~ zjPUBr@qgi|EurCS%-sz7zZyWy-${BYClYUpkyC=2x5II2aNW zsmE#V-9mlLdRLz$0ic^HozLScnWs_;D}~-@eC64!nY-6ojo@8KoxYG8e1QV=Zx4nQ zH$O2IhcQavAPwCRR``X_{&WzO)l9D#T&4D6J}pb3zHT!g_WtUvrZ~HeiUIqn5#b`7 zN0+*w8SnfpG@>Vwn2vg3dy?3a#)RAvfN28_O=!hqr!Vmo66$CcE&!vVP`hg~KPF;JoOjc%v%^P0E zY#*tUpI`WO6GO8+MVPj~DS4vB;ovg2Jc=%1FE$3U_zGh>zo8KpRlQvJ8muG0-doln zH)aUl=*x1*a$9e??(tC2`%;pQc8nRXr+TMFw@hlk*t)>MBfTs5nar6U#{H?^tl!#< z*Wu8wlY=`B2kNUaYHopK&oEP7@?tKQik~$bVNDVRNHsd_ti}DAcX$3_D3TH;?}r>4 z^|ozF)sI9Pp_Z7IKg1Rvc6yTS)sfxwfwqqx$}=@OVk?TClK@eMdLnX1C|$~;ZgXdv z2c2I2bg&)K>z^wJmoO+Iaga&iHg%e0Zm&+ii(;NRazet>p-RvIlo73Kr#b|$jL(l# z1LL8X5DvGwEIPOizTgln;$@jm9uJ*1zsioFs`HOXo!EjGO}sR_fO6oSSsE?$u)_cD zFs29^#l(MkkF_dKAlLtrs3db(Hjt;FPe2%$=j0fc!(J(2Ac87$1b9Gq;-F*FBa2K* zaMRB&JRr#!I&N!084ADTvaZ_CosbhXkm_n$D5gLnzYL~WX;u^subR-=-x3JJ8MS{esCZ@Wb8}5b z7;WCq!J@3iS$MCHNr_@Jqr$Nz>O#S#{GG4=$)$oRvk2f4UKL^`Jr5SL{!E2r_V+q# z?W4=lbq zt#bozou{wEh*%?B*Q(Jzx%?4?Dtk7kuuN)4j3bkTz~D}Xq&=3c99DIq^F7PXLpxnNVb6qUe-fq0d%+cD$=wB&Y^dzRpLJ$dU@5KtOx<$N2n^fL21=$*jdYp#E@ zb0vbBe6IJv&p;TwzU6E1sTEZzY5DapWG=r@s{PMz?2Os3e0 z-Q+~rs}_+i8#rGDF8+DFd2w=Q?4gQTleD;TFAS__>HXWr{tH{+TKIzGYjXkeMiEL1 zzJWuL;J1`QKh_??>gJALQxxgVhbhu_MTgraEt;|VD`zWPG8`%s=IN85`|Rn1bcL}? zBD=qiP>?mpmMG1Hd~3O0GzscG##7P1-$j80OoJ`ruDESGxz}y&T~BNXg*q+BRpOcD zjtqu2avO_Ij0XU6YafB6^VA%?lE5qP`=d~@)Y6-#bd>=c+Lwd6fR9aY9 zoFn$P`<%YCL&s$pWW>jyC32!C8lJ_=tiygh{m@3iraO3@3&Z=|$ncEGDsmP3(OM4%rnxv`Cclzjgfn1Ffu8_TXP^}_BDw2nV~wMXqf ztUC4xw^MutFa5`*{1#RWcH4a2_?ZQswH*CBF8VtHwgx54kXjCJ55YHgXlAUY_l;RS zpHAbI4lpq~*iKl~{9`HN=`vbZ1aYZpNPY~?zY?sOD)B3|Vm>4Q1*xR51E#|X;zXXh zww}8#!4-08m<`WE@6uVfUkhst+U%0XT-A%m<6|6oj3;}|wf~v+)>|#Qvb|$zsf`9` z!CQ#_!B>E<$M-Kp0Q|ZDQ$=DA>gp)2vtxJvg7N{=s33^td_SHTG14DS2MVTEW& z(pnM+?rNb*dr0mfkVAL9`=sv-7c@KNJm#stu+8O4UGUju1->(_phmSaP{kWK8uY&L z`dm6h|Ee=6Gd}ID8=vdCVk;{w-M=m0Og-Hr$oFv+muhdy=((5VJeu+^SWOfWHO~cM ziogUtxufEbg0qOCtf?CJ=lR?m24`0<`+U3s@c6lytkNUDj@tU50YVQ`ZEr7Grpq>e zf(Wgz?}5N?E3fZ@SZZ4#NSx2%HiaIDg7XP~fH)yc)H72w)P7GP78mZ#5le6A$vY(l zZ=ZpEKP2mm@?S3L>_Tu!#(c$*DiPzC8E`)QXQ{UdS7YI?yhnLI$GhJR@^Wj{RBy*} zOpc;8ccJ*g-&C}CR^Tc=+7$ktEQ1y~Dw7Kf?2q-nPlMu9ksuH1E>68&x1^9YkPpos zatjiBpwrHA|zb5g~AxpDUze|a|&QFu;`12Npqp1tay{rbCrIUJz%Ro@@$XU#0Oy>ltkoS4Eo*_Sl ztb!AD5<&TSg=gEl`E=ESlV9r0b~9!XSiNRONSsk`)s z2Kl+ar_e>__d&xBW)Yasz<y;x+}VnI1lSZ`!_U@SX6~-M3$h$ zqSU6}ZRwgDH}vGeYMqi|RB=H_gyIu2H&JRQ%^${ZQmRa(QF{gM6sdnjXoTG+#G;_( z0YZ{**dG(L5Q%+X@@0Ck`Y`I#smAcUMlXTa4;aVqI(YtzB7?Dz5z#qRvRK%3!(J^1 z#LE$dUxb5y6}j}@E0V`!kNb5OXfAxTY(0eVrB~M8)m=W=64m^vJcFO)|5$arF6)@L zj7EF`78N{dUR7HMQP|)Y6v^tU=C=q@ynj%}6eu_ua5|ih6RQK!RJefGm#QdGez5*mHQK$Kr?tctuu3g_>XQ`!Hn263b2@Veisp5a~HbfuX(L5O3 z@jUYDwY9d=Otd3+Eit9?JU6^=dITbReVFP4-P$>t{a02Ul@pD*>t#VcQeg9uBu6QC zZpUQQUJdJs26mDjkOeFe*;Q|VQO=z2G2TTQS-n^y~YcE7@9kdH7#TycD zpuKU`8+g9rcds>Cuj#zM4@Kc`$cBedCwtP@N|go~$jbqLPpAH#e*H80)sHKbbal6z z^2;!#=uPLFwO_Y^JjHG!ev+kc{nDB|*2o&%)cwgy4A-qU{v5o0pbZ$d=_~P1?t8H6 zRL@LK8;$&-wmYz!38aZ1VqJNq-1?aO6CxOYP+ZOO7ZXxpU%+kaSkTKH7c+Aj;nOlmHKW?MhF zdbu6Wl0a*V9WdyJvifT}NI4sv?7B?1U7=o&Hn_GeWSOYx0hy#oec(&g*;S&HZU41T zdBGHW5E8r`1@+|?$pX%wF|G6c>}$bHHm6K0A`cplhC|jlDsB6Q7*)k->bs| zZm?k@>g>K%>h4!%hsTv-J1-7@x1kDGOOtyJt#2&u;3-6_r9Bo#Z&YkA1891jTaEBM zi=NkqT$}bxc6RYY?=S&Fc3;#cwTzNX$|(Drhzy|OMFLsZ>n<2u(JbGD>xArSp+RBD z2^~vq+I)(RTz|3-Kh(qPlW`vX;*Ea>YHV(9-E#n~g%D7sQLB<8d4$E#${#qu_vs|L zGE^Z~sJc|)#~oT$?w(jjuW9PxM&)Y*y#OAx3i=@mww-?)F3yXta1hM%Io28T4Y3Mt za!t^Gni_HAxjV>qEmAVVjn497vJqaA=X)I(XE~T7@s6EhYgVATcM$bGt3!5Fdq4p0 zCk?mxohtpth&ryO)NxAg=iNwPGAi~U)?gT{*dTfP`9<==3nQHr&+GPw61~^+hw@V; z+jyn&N|ZQm$ZWs*MKZ%S2GJU>(|mFt0$xwNE8oMZJt4$>T$#59yX3j?BOytk`|H2X}<( z-xZY^ynzp68FelJi{@E_dDf_40gPRjKTz9tfa;~82vuX-2VRjeMI~RAG zpn4np;M5_(XQ7_cZ-r|-XT7tmeQk9UkWLrJz}g9uRrd?8JaaV+j!_n#>iB4sR8H;? zi1cho&A|D%A#(GEL17w<9ubaY^7}0zB_%Fogw`Kj;3BhNr7c4X<;h?KbtF*ol;dNT zwgw(I{qB|R$c$txH$iH_j;Hh&6tsh%ZCC>vIaf9Q2Clkr8jyF#|uf6 zLxu;XFwz+xNggFm6RS5H;X6M9gcCzX&;hl7$zr9SN!8X)2vu`|k)rYN%~gTYrYsJ%s=PHdqvr2|1iO8=_wZMyGw z4?ACM>*gaPzW9Ds7Ke1hGZ~KEH2rL`5DbYCD8ob{w-5msp*{`mMirTuKN#FXoo2T8 zklsYgH4mzLufsK;BZ?T@a&o@K3_j@3X| zVOscWzWV^9PKwqt%dH2mcCrL!2FgKzOz*j|NEuq7s4xR!{Dv!yOwF>}785W~i*XmP z!_0oAFXUy<84k{sxBXl!^|rG*T&^O+dA=0aEn0IV5|{ip$+(ItZkQhSSD&fDssYBJ zdsze0xA}^OxLUw%);wKIoL@MB<=8s_DRUf>0(CbMmR0Uk9u~%0|DIj}1RB|-6o6Fo zDZLq`Pjryw+BhvJd_a^#D@I@G8hYPH#an8hW~F0p-Lyb!JdUVUll3SxiMu1kRhCR> zz4o2AuCN7kOA8SLaG}l{d>6mM7nfw;>5tt*4T=FM*#Xz0M^#BkGvrF5Ld6g><3%N!h6=*SB$@DFQa_==2yZ3(wN=+ZGU1xqGqUs6@uK==8(Tn zoi{OA2+<6cRigtaiKm9V%@swem=>TQLt2Y+t{~+R=1bil2h1_of3W5#_rq-H;TU%j z#?7O+y`pu^Z54p7T)|6sLY{HiuRgya38DH3_)wOzZ|->uj`@U)-P8&{4dAJEF|Q!j z!c}(5CKaS*7H29f7bD+f-!m=TAbycGVdsGCQS-GTY5uw1d|ad9ufA8k5w9XgVO-0x z9yy2AR|1XH%o%RjUbxoBGskJb`ra z8Wz@Nl?fjY?1F7w2}^G;0$$<&b7k3)mVr%q8}YtLCjrUf3V|o02G%`x%0EDp@S#&k zt(7^0neYQbWHe@B!DT#D-=g}z6|F4yp10@#pH}s>-|+iX_=I)tJ3Rh{)GZ4YoFNv+ znR8;zxE%068jtmlUnUpV*tshTxP#h(lQQW9JtsmyZ#;k9A?#n;?)aDs2b0A`8wD~V zwCn1&#EzHMEwqpyIX0CH)*~&+hR)4t%Eqel^jEzO+mo{d=e2 zW?aqESHy+z<`tGvLQVp%n;r!v)iuA!f^>YLs4ZrKZnBDE+CXX@GEOj0W-UGR#6^BlwS!(XNk z|AlHM;F>x%BQ#X~A-ILRjWhnJv_u!*eljA299+%BGZRo=hP)AZIabqK%}vL=$c*Z@ zoJZTJ6n{B>WlL}}fpC50Ykp(3y>cG@X}r3lS@acNn~pDI^*W`hYf?+YDg$QwhbVZL z=wI!%4fU0++5u?w$aLF#O)?y+&#!$2HS;SD|5bg;svb6`sAhj{sR);){L6jP|N9l= z@AnEAX<+B6n9MhvwH7v$|3Qcf7bV4I)7ImLBt7#Uww%8Xh$rf5}$uQg&X*uI|bfpi+9 zkYpLi9PNuFwP&Vkl64SQXr>!II#nLmv}yGzlWJ__0z(S0=tLi$z#HO7qQjK~N0EQj zg5805VO68cVGpM)7$y?}eX-c13AzO*;P+#XaB>6Nn9;wI*hv3V_=wQ``xO}vzZ>rG z#gI2a=t44a^YR9)W2nM_KMVT8fdMxRjhLpA(~u3|U&=ZgiY`>SPqOv*@MPoPo^@O6 zGuKn}=g+pnkrUcYYMAJ#Z({~oj4rd!lIdJkPY<1+TMYN$K#aAWC1}w4%RFl({al+i zTD5JeP#FyVrzie$yvO*Y5s}q!r-mUq605Jk^lxR_riFAlQ)L(G4_V;krIP5OC!_HK zO}8G8%m_w|7t@?7Q1{cI(ql^k%4qy-FfA(@!7rS@CYyrHgW{990%qd+i!K6wRgUX1 z_e(zgc`dQ>2`SlucjNksgU}Lxe%gO4skKOrL;mGu!3>@TDc~ar`SDom^bbB_jl0kb zMo+cA{MKRCkCwRncZvNk8LdQLKK)dzX@v5^NL?Dg>Rm9rKqCv1KAcI}^UTzq)pcqk zx|S7-iKx1hoL_SCs#4FBdU24S|@@Ny*x&%1e4c4mo`A~GA zP&M_nr>*_5S}iCRlY>=~T5`=DX_FSCI^MUMTbIYV445DPcWnCD%GcPZ3S`%O;)n$| zN&C1^Hqe}r)u`Pk?=EsUEzG%QCVfxvGmQ9)JbI=Ou=Vicq1{0=-G%fljpjwEBk)U% ztXiaLx^jMu{nKo%T|Inc|9f%O8j)GkL+|torZd^6rM&mE$h>+phkPv9jSe6t>_0)C z)2^^|4AP_E%x=h5!KF5kze?pkY%DeoSxTNkk1;2;#(dT%eCZKg&>vnZLBdf5h3*}m z_DC(xpua=-WwOwk-qKBjaMp^&{$!)RZLu1(eU@i&N~hF#13u@U^y}(U6K+C@i(#it z0R9oHiok2oX6`PdS}{Z(#8Z%>IM7oqO>HhiXTj!C_%B82@;jm3Gm)cCbnzYxM@*=0 z&l;q8fg?fe09YVY?$<$CmeWSan(bwOrcpJQF2|2Yb>ksHNXK0fkCg#{&y1CbmmXC? zWixx`cAqItiT?dL6u+RvMmSa+S!NcIC`E19oz zJ-368b#)kr&sMxrzskbR;gC|o+QB#Y-5!z*HIBvnfuljOftc9kMUd+idq*}qPC zB|9J~4IAUCxSOiQ96Q{H{!;}F+`H`+Jzmq3dEJN)REX!Z?Q{#%sL%bZ^|49m=2L{T zBsS;@O9!>}>J!W7mJfMwvo)Nez~uYAGfyK*n!6K#G$wti zxjHy~?T#dcrWd;`bV`8xiUT|rzln*WRJEmJ>K2^Fk z{{+Txh4cT*^N)|3$vrCHlqe29|8zKznP`*fCqM`_`v*8QV+2uz{fpR4K$Y(he~ zNMz0T)Pdr`DW8POl+urowR+|mCSZL^rJ_;Q&2;A&CApk_hJe%4C!)YuoMh_90V>Ll z!W6@hzsdrM_SF?UCJ~3%_ABqm|DgTQY}9`{nfB9<_LT|OgN2aby-0CoC$e(c^=V=H&wGa7OF)c#cqDQ5 z-&DvrQqnuE-rHe7yo|C~?SH~QWzC!OU842Vsw7h}r~*CB z^`$%qFDjqPF1^c%iK*s{B$yS`r4uln7wP(ZLWrbNwUY4kq~xdV=h0Z+^gM+%73mu@ zj@j$-08o^9=~18NdjJ@ct@Ie>1MDQR1Jm0>s@ZeS?KwEHBstZW$yj&bJ}J0SVL88q zi@;-`#Ll#VH`dnBFy2uCYA}f<@>{^u()-I|P@;U4lEoU4lbH&>#u! z?gV$&V8PwpgIjP5!GgQJ&Fs$3%)bA^e(bKNZ&%%4Jtg;^bFRpkOU2<&A3*#5au>%P zE8eTcQAlXV469L^iE_R2vb3Eco1M$2jb5sm=GA}|2oH8*XpT{dH4Mi z+m?7N*pCE5=$>K^-3p#CDleWaSHkZuZ~{2mcceIWzl@(yqZpgS_i&iX;gLil7aE*j zePpwS1JN(&iB#*=8u}wu(bsRfh$Rd1;K%@WLsJZxYfx1u<OpAPkVSK1GEm~13Em$VzV>Y8rOdM+l${0WEP#_5w+FuL>sm6np zcm!I9&#=6Xj+lE2V$uP#5i-;`{)sU`xDYV_VMz#LcQRC$kC*4}`DbX%6Z-Ya#*2$c zYVw7hT^$9CZNbTOoq7(j-ZupsJ;BpaXtW~em`B!~G1jitCTJ@>Y~qI=+J0PiRli!M zZWXI<4*4PQP6B1I^){$U3DnN~=sSu{=ayFO$MkYe`x?o;Nn>s6ry3EahIpa)@2~O^ z9CU1JA}1Zh-dA{tl4PsF6omTIEldKR-8#5HsZUV7>@Mh&rDEKMb|Wy$&-QLHsRH`I z?|mz)djl*-F^5dLNc`rhB>>YB#!r!S3R^JM6lQ}L6~EL${DJ6$8K=$3QJY#$R|pl# zAvD%Lbry&M$hODJ(&Ww%4I+nBDhkXmx~lW~I^xu+laaKnp~~49@H7; z%;QQbpW8>d0q^9nx)t_hU5KP$*Ll!u2_<0{?m89m1THD11G6VStS4kctLqfZF})ym zhWqsl&t*~y^4l({Z$>~Qg_S5B0svl0wjYxqH}mi6Co1n`JRxLEyQ5PRj)q z3zU__mkJ=XwLOWL$p{8h$x?Ys@P}y~>rhM@2{TxAgmoTRdu^F!sChlE-X`WSD8ygJ zjltb2J%U^TgMuA>w7_`Lc+#1GRCgfML%oU}upsX#8VhlS zcwAO-yx}jxx}B%!zr-^t9IRdAKKdq3pOj&Nc~X6{1${8MSjY-dY`c64AL|5beyKOl z0@#TPqE3;bOVO+xTPKh{mGt$tm3+r-k=`VEBWzEaoK4nPhi_EIyz%>!KP6nah~8=~ zgPQ_svX;k4euPX*oV3wRfVa;%2OYi@-FluREVLvstRpF2kW^+$OR(rB zYFCrq4b~7_jf{O_t)mXAE#ylI73Wtd-87w*Sl zaL&w*8v^~LuJImme1`$E`k_W;0_LeZS-)*}QttCTeiUHIlX9?8VYa<&k;*ge?2X45 z?ViD);!Vf6uJoQMA~Zj{tTbdHu4L8ru6KQyZeVr@rM|lT*5q7rQv~?LQqqrCE z8oUV16v4df%7L6Jb3_&@k~1fO^+ltAQJ5~*@^{BZjg2qNbB#;ytjmKp*68eev$|`u zS$AM{>H=3D%!wWwQb6n1KU}@v3i8#L2u-XrPkks75Lmk+x z4vl$jo}2JG=$}2CdFekyXylrFdso5K3`uXeE}N%-(&s*5mSuf89&cUWW*2W3j^sIWs>-d^yjA zJDwVEeQI{Q9Vo{IJO(4P69cEQ8D9)<0L4Ve>V(}Nxse3kXt|8ogwm|0@C4#kt#O*z z1?`Z;(3{f2cY~4Vnq!89P|h>iD`Joy2pLxJL3%0>G0xR39sg6ou zmL_9D4H)APl)~dPB_A4rPnQNEn?BOXztPzUYE%VY`rh5JrL8kk*L2H5StSxAX4kJ? zBsWoSjP<_BqcBu=UKO!Q#j^i_dqPxp3;3$T^Ir5o@v|%jK+gIrd#;)`HZZtCw}M)u zO27HxupE<%6|0WoIs$*KZIX`T&j$=%`|H~xKS*4}KfoB35uxKVcJyJ6Xdd?DwnU2k z(<($$^h;Px+Aq$p)>PVL2W^U9*{`R+`P4tQ+3u)H z<++1l1Ls%kJxe-N|DKlKg5z35)2&l`Ks{Qr# z5)VP4yoUucR&W=?mD|cb7YW;e#qO9Gi7ZO`q4&!B&|%@Z%i<{RO|umH@Yd!vwFf+@8)|2cqvjqnWsnt`eNZSjAP z{bvHOqUg|_1GAj)t-!~^XPfvW=hu8(FH8&-vDS{bVo5RnE!j?DqsT94?JVfImdMN; z2l7M$wknuzzMju@`Ltgu8*Jzr>Z~U+T}cF^KJ{Dvb(HCMGo2Wh8|)?^fHgBliSlP> zga1Leq|kIhS!Jw-GCtwwymr)Hkcsl z-wZ_g+dwRISb$Ie!vJfLzk#OFusF)#zx80Sn;T-mkhAvoKMdgacK;}21yjJA{Z~i- zt8bg>5DQg=%a8wI0NKP?dmg_QBar=nh5#9y!vw^_V$`wse;5d6t1dr8)(z|Vmk%JO zn=K#~Y@~05|J}fuI03{t!A$+e|8Uhmy`#?wvA|8`N%lWZgtWL(K%Da+j%UjD&&U4H zz5hMM{?EPte6#*<_Wsu^^M8xOe=iPqgEj+@<&>_wd*f+h1Lyjv^Y4+c{~0p>+cMNF z1iwIFZ$A-oXVU{&$&8Q}x+3_M8QVwi=i52np~y7D>|F0`yR*y*7w z1`rQ1YrR-r9?OmrVqWz-CJ#hZ1+`a&Lror1#@|+9cV}VLr9-hv=X~|8FYshd+#>k< z)U8;;pPv|SFBwh~ax%>vXaqwq4bFB~E)9-Z)qQE)S$9?=o*K$-TiQ<}o67IVT!~2t zv>jt!7J`Y(7{6=9o|!M6x3qRv>tN@-#fG(!cS*e%o)b z$F4xor8Zs>dV|_|tz*C2@SZ^YxV|MEADPL+|J>KHkq{Se!}E7aem=$OS?)5`^XBlx?ScSbYJy`?fnO`Jollz z>!EyTfUh-cJt%wJ$=&uf^QC4_z#9DY2LELaJVV_$LxsNceLa1pk(FT^lV;8yOrsP@ z30CYR^g9{O-AlW{>`bDCY6R zb-jC+^LptEfA{*b@j50i3ijFI^*K-p;`p=?^(U*2rs2#cOdCGdXDs_o-VqMROWEnAmh_-8T=a|kr z;8jC-VX7N3l&oxhr}Y~*JCO}T@E(gTnJG@}XXIv5w6+Bs#>2Lo9r%no1Z2bqYxFSJ z;Q%R{n+h#+p3!-b5wouAEZkwpkimV8?|Y8_aPd~i`1QH#^;TeI=v>X%{r=(I-mjn^ zh2Bq9uh(71cL=YWWOIcu756WTuMbAA>l=@r8~0foAXd*?PIdSlx;PDc(i}p3=p)^t z%eg}R1Hm-SEXylzK|jp2!MQKG*$M{9#e7JHnPwz@37CFd<|e*rKNGd7Ae8CYohF~7 zreZ+qZ;|Jc*Q-~dD6@N#7l-8Z8dN{8exD&%F9brXM2i70j>m9c8spAXl8myTeA1nS z6!`e$4CMQZZ13ZZwyB5gIRxd0p#vQ?9^_9dWEs=y9C#QxTG(kD7t9;tR-+5GhKb-j zAn?<@-Nucb-9TpnICHkm9oT!@)_K&nWEQ?UgAv6@a1k-G7XDX7o=#)%^rAu`IVPio zoUN}4sYU!}2+8p4%f_of?8fuj1}gvam*WokL)WIb=ZZyW{j_shoF9~zweqQ&Vat@6 zB->-Vi2UTi((8cQR zK56oOY|8QDVyeUB5hDo{=9E*XoYG-Z??`?=QBH;*8aIX&O&e_@RG1Dk+9KlM+(gwK z-mKvVwG(x~uQ0``kj4)2QFtmR4-&sZYCiW}7EOf5Zbm&dz20nWUTqmCdj^z{L#c4w zATdW5od*piIPJI)-i5qzEV>M?Tw_*i`u&uijb6rlDFkAF?(?sw?DF;bK9u-Av_Ysa zogX?=NY_?bCxj_V>fD z>a*_(jQJq2HS?R<2~G~s1>FVRNUGV94L>7zen$4v=WD!4TPd1847)8ex z&D%`&H*DG*FX3+hyl@ugb3b_#w6TTymfYr1`1_r2FMqyWNt3j4h7nF0vhI z3M8SKah>&tt7z#a>*Vj7Gr%@&iQFfMn6SnHufR827zCyK#jL-?md;4r)?EsD*#;(OIAov`X0fB{ieRZ?ESf57rOsca*|bzsFr)$l82^(|aST zlK%L4-^d|^Zz4@&&*!7EhiHY)EIX(9M81bYa}q~oiT)&^Gx#jNDW8k%iK{Leu%NY{ zG)?wrgxx!J!L%!vj+5|wG;beyx{%TAxtW3U1zv}K@vir4v)6@ZTRKpd7Ji0_t%gf|?G$1M} z+2Z<(P2>z#WHT+r53VN<4J97Ub`)x!HTWh3=XE#d3A>vfJvxQ^0?X)7Rnm5teD-Tg|}j|K6gKzO8fySxv5lNma-eh3P3wM5~Z!x;I>T{)6>)v6N% z2*t)09ti0fP;%8q$JVNF#_JhS6a7Ik<0v>I@}<7sleb>zkF&u^wm3OLN(y<}?=7;8 z9Yo0B9l0cP+;dpe87{`hXJgT}xIJq9^#4#)VBDf;^KQVN->2hJxA=8a)92jRdFrW2g*|JTKY=)rz->KG@{;8NfF+L?<|`%Lq!|jJ^2;=^39z7@{cI)sD4@7hGcU_)-q?j=7|th?kw0`u!7rrBy5LV7`}tnu9v34+A!_c(cFdL{6770Hn+Y%xA9ykC!dh(0oD( zDPv9!naxfat|&@bi#C$3t0l-k&tKd%qy6p)L3p&4t^euu2CN`1hIzw1W4~wClX2l_ zK&e%)e7w?~*SbO*Y^|iKB)vQ2TVitlBJ<1tR^Bh!1m~mCnLNCwMa=V;k`4%u13In9 z@8TgmCH{14kqJe3u=O28Pk4Z-^Y^wHly5Ym_|3MTiKT+!HR-g*76=p7zm3mJ%D8G` znxHlkKI$8inF-++ii~UB3rwsC5)^gHE7(-YME7a4@HT&XleNnyJY+25D!3jt-H6(t z32gt6Ny7~uvDogJM5bCj$cb6rEOw$6Jh=4TkkIPSK;D&|L7v zaat`f5=nD5P?b_S9LmyjYQ;F;5ht38b@ZZG=J6lru0Qfad_4(KLS6jOuf@HgM4svK zaj332?nf|m8a##mt?Hz*0e4}))-lJ*IlQ@_S6oLaB~}A1T+a${hV;Cx3<& zs@t&SMroX}?xBmXxuepNZF7UukzJUteygzF}kJ- z2*F_f_AH&%tVIuD6edqvf1ZWpA+EP`xQ(VbkF#IR7wp^@WvBUO;l5+i~z7FILfllEA_aYc9N)>n=m6 zh&}gwREJ-yhl~zfx^ZU|WxK?<8l$F>9;i=J=j6XAlvET=N1LGzqdUT4cf$kw_*7Av zPY+G&XQJDKX7V=*y3Wq9%ZHh%Zip{%JliqlrhVbALiM5Iw65 z=p$=vVopcIW@x3|U^m-5BF#=Td!tkzbBCTbh{PeQzk95N(46qn0N_)@=4ps8Z46Lqi9nDghx&xtN5-B=XoZZDjy*Ev* zwmQ?~=Ff`@Toi#J?yOvgIugw7B*HS(m6i3)ay&PJ?h!2Gb36FTaAY^Fu2PGR3oInJ zTE8v2%@%JO;}rQAm~>NLh7NI?1!pp29QFnA0`aGfhsq7>Q|AEVkj&$|a%BH(ZtKAi z6=L4EkTq|+7peG3U*2z#zaET%Py#Wm1KtI~hn#KjN94TOImqka-= z1MuFo8b1WSZ#YeOXRsltxF5k9)4*>KQbkdrGHw|~Vq?N)`JU}=EzG})1NM78F0d!| z*R}kYif9H5Ear9I+M{5l-GJW6BA_)Wr7ieZQ8DzAExh$@LZ0*ur^qFz#dSZY<|~W> zS1o7*_uN^HU5vZvy*ikul{vZ-(cy#GDEvy0oYI-C1NC=thv{|(RCqZKd!%|jS~eI1NC%BeeVOxddZH0ENgamuNtWNC%uA9>{N1AZkq zLIra~X;Pq@Kd95&$xOnY1YqSfPj|9$kq3SDKS>T2Ens`?yO(>>kCJRml*YO7ki9^I zL+Kbh<8r=S`v;6l-gj1^!6(hW>HTO!2bC62r%$vgskpsNg4)VFC_f(>S)vfdF$-_@ zW3|ce)p~ah8kq7b4G)&s&X`z*j8~Js=v)LD1xN4552Ik8k0Z+^T|N1t-z0hmJ`0V$vs=)0hght zy7u{cM$E5quGVa3wp^Yf(?{dWN;#!^&D^`qU~3gruZyyMQI^g+W7hDEAG3BO`-@dZ zo^YaG=G(7NC(*lXZWkB*El~s(Ba5Y9y}x>)v}BT3G1*;cK}QGp?c%~S2XERUnO4HF zQ??LoDXSEJ4LJnh^st$SZCWuXy{q^^w(ZAIP+~Wj9nzr+FcEn=lkg*@c_o(`i6Ni~ z%#|z4^4JT@f$*j*kb6b%d7@DD6@uwyI!y4=QvCJy&M2#)!;x*l)BV(JcX?zF6mEwn z!qOhv@DR@4J`+hRIgX^4F4SLTIQAk~(WOn&!yg}(AEVjMz8bY*p4|dx5s&Xc>*rrS zlgi3P?-)Hr`fi0i5b<9&u#t+LPSHC{7~~)4zwE!jG+zqqmaAp`x({bXq6cp0MR5UDU%{F-580g<^m~t!ulFLZ=fMbq@Lm(~ zEeV+0BMS7Bsf8^>S6cqa9yAQ;e5?F3&6LBBX_H=q@Qr_RXUzECNvaR;i@dtW>NBC> zgd>IkJ55l4JgFOF%qngGusR?a9B8hoPjQSZuCc_!-d8@r!AOLH;>9|`rrlOrmwVii zP8rrcj@>azaR~>Hj)CPDHx}k%akYSUi53jh=WCUz1<~Tij9x9`V=q93 zloRg+tMBHvs+PuKQA;_?HyW6O`y$g&ExKCL`3gTnMGe?{-g(B$;~UAvu8V_)x>le9 z3x?Hl-=9HYbo1t6m$jjrV0gkw+`A9BArKX+36 zxkbD#gXZrh)v)Dj{n^-eENU&PRH56^hpuY-vMloWsg;7$L(J>M3)5MXOlm)~2-HEl z#ojbY>cqTR!yX-#Z2@;RcV2Yq9o$oHxRYNYbHqn!6P%7S-kD28h8pXU2_z?s;5gK0 z?^ehRp)FS+JhEhx(8C~u>T!4Hj;OMS8Jy9mywT`sGHJxRt91><7`-M{dXUdw`lO5T z{ijV2p(L;>0C^xp&4Gu%*aSnPilH~$FVXERAsgsMuE#CwrSU*ey%qe4&s)PZL_1FL zT&?0Xt#D$LQ6OVGaIPG96IITPzrm1$B$i4Dfa3EYG90 z*;|T;xHbS=ne~U4ievg=Li^AJ_E&&PM^Z6Yiv!AzNbv(Npbs(>Q#)!HfIn-sGvB2gejF0f(e?B|tnBp|N5a$Vy1xE#Wlo5Xex z^I|T&HO+N?r>X`7a23}LB9sFKwi8%lhZ|O|iU%D(FE&IC@JrCp{7QuOGHBJm0WY_; zOs>Si>wUYiPJnimVYpXoXzHo!rlMLn`B1zVEQ*iiHbS=Vqx~!M%X8k}h!6HqRcbf8 zZpOKWe`AM2_(mxrEn>;^H|}Z+_kV_D`s)S&VTg87;wO4%nR@J$MLji1P!~kgVa-Q{ z7bSGIk=#&hqCPhHB5HoOZZC`*v{BDqK%*w|s9m57qk-x!7qcfx8B-atSc(45hD1{< zzy;G&K5|z#)o{%V3CTZoo8TVnRq?=nKl5}-{2@NffGdff_cgG-p!Wlav=xHiVEuEM zx)q6Fv9&ex4aCJnw&^?9&<{3~!m<4F?q?i`bqDX4bVKLrJ>ESarNb|1=ES|=EqjuH zyod-`+j8a0(ovMDa`aH-K5BkH^O9F)e`qDDe`T~LcC=N_=#DFfzbPdQf##0L@TsT3 zY>X|+>vEwcN`s@NGZHYB7RfivmI$D_yNA@O{JSjQCql<-!$7qfvI))?3Cw;)G|m;R z_4(DIXoQ`%M@;#S1-g^)n4beLA-;GU zK4cfRuTy*;6A|`|ogUX^%%7T8e9&_Fq8rymY5r*ww+IRnE zA4=lSGKcP!1`BN*gI0LB3?vZe#W7+XZ=Nj~?7xPObd#ZcW{$Wx;e;FhMB!HYa96o z6mU`k5`)pxQ{{5%(JR=^UPU~fH&;GvMML(GN{HLU8Y#}&%&}i8;vrBX|N4dI(y6F1 z4eoX{n7jZcP*p9H6T75c1w^v{f^l(*YY94DX$6$i!abRc4b&BZDsb57@t|TFi#8L% z76EPz@1yt`C}@?x2c?Dwm6vvOdcC1Z?rp9By+1Qvw&k{BJ?9miG4MgPJwrV=2488e zc{@4_v};|PZ_ui8Wwr^ z2yOZA|}o)E>5hrD|Ww z2tuPgkMz-XT3#vp-M^ZK@P@FK}5cULuR0(}&h`23Q@{2cd z6hB`+J7b(v;%0KLf3r~Y&zUw8OLCv>3q7K2ZVUtlR)YSZ%ueDwAbf||$Z-ccVWhH3 z!;fISU^h*-wq9&z>s$0@ zBq3sDXhi?T#2}b>wLxnz>wtL>xN`tuCAex`suT|zw-<%Nb`y-vi8cKP{>ATL((EQU zJ{W_Cr)LK)L^aL2kpFzE5Z_;$MQb9AF&*Z;J_UGLYj4ZZ)o77o@9We zc(5d8;0zB2Kh{mV)EiJ~K=Tn;S5Usl_X8qZ@yF|7_e#;}XBK#af^e0p<6rgrh)nke`b-E)k8I8~m&0p#s|2tVDoI=hnUq(F zYzW;Adg^8>_Q9EoIfUK|T|J0h>-~dWXPahJXc@vqB>*`Se}6Ko>;}%x3{GT*uo_QKww;@cK#^gNfTy>R2e% zj|V^UBfPFP#0QhH=I9x0lciwQV%>~4Gy>YMo} za54T&!xf`c-(Cv(8;7?xY4CahNt|_8^Ab2vxFx5AIF?%_h{`5F%jn;iki5`3S|3{n zJ0z}sGvR2xxo^-k94lkN=T6c1@R(4=Gt*Gq?j;gV;WiHZ8O#*{G?)* zq&B7pw~c%^ZLaEwIA}_pghua5uJOiLDXd0tnLwJom=bO0k8J7lTMMTKzJWb|QoA~3ST>qfvb^lw`AF_8x zmfv7nbmWSB$5n--IWJ}$o!LS2f=Ll zBIlA7k`GM!9t~4QG5NVcAz=M>9-qiZJp?#IxXOQ1s4QG%h8YhLMNC57 zDgTYUHdI@B2hC^E{g-$I**0dHl5d^uH`7$kW(vVD!$rNpG~-;t-kDt(RZ3ZlpMOp) zBaaL`KsgYVjRa9TKo`a+1{_f80%sODGh5N?U6KS!6ghb^k(h+YXboT`Ae)ZrehF0V z%rB!^;_Cd9pXNNjAVJV)tC-f3Qau#USiy~ZrtN#JZ7$OpNlNVkr?I9wF7BD8@%@%h zGUh!YA~y@MVZ_x#pg5FPuzUth$W*?lloh90AgiY)G0d;Ys&_ARub5I+dWRyEe2QK* z{V9?0&xvDFA~k#c^^EAKukCWtU97bdJ?WV(G|G=>~Rd>TPr1#;p}vOO)ZL;Wdad8~m$Z zuWOV5sgtlfbrv4wZN<{R$MPt7+QIw>!{RmPv+~Xq{?V)mGhYo^TJvI1#z9Yo-SC{u zSkxLj301mOY^l4lh!W~o0HDzQ0|2RaFy|U6XlQ0G5zZuG5at^C2Nw&xZaus_!B=n! zGcHARK|cKmC1X&>;;}LS2K5&3L4LYUd{|gxDxc=Ja#fRP>npBE@b&;{)TnBT_TQBA zZ%?X(=wx}joX#|UNaN5XZq5`NIY^yDA?Td4-Vpl5=T|-R7~A7dhFJjtuvVj_W9#Y# zmU7LbD>h4KpkgP0yY1jwVl*|7S~%8rI0P=fyh9FS0tW(Xp$}MK?9g`nV+GVrHpsl{ zXzg##VvLQP5sd&_h~p|^upCcB;PG&vvZa}eQpK1BqfRripn6)sJk;T-#>8(>4fI!M z9h9;Ju?=Q-yKymKEli=db9l~V&EUA6Lx*4p zI)0QCB(SaCCqaxs7-x*gF2LFZqgP{oRJRk4N#uhrHcAXU92qdeVdDPM@k>`)fS|Y{ zj?Q#|7tI#lILynkhLXfxY~Fw$&59hS|K%!&aVrdg&F|pR^pK+#hnV*b&&AsWHi9|c z6$n!Ly~qDmnAHA6)YDmi!o@Pn(0ewKG37OwwFvv~`cCA)TIfciUw-6$5y`0p79PWa z*V!s=kk|7=L-I$X%ahW&BLRZvhz2N$}3C@7JM8$%Zz9zG8_+6UJ-+w2w~`wwsnHQ`CG$G-|AyDy7)?h|EXj5hD4Cl#)K#M0o8j;c-uSDZm<^p< zWviJRWhAV^jm!tp;w(SuV6(~2;MwhuGMUC9At|i9K0yu8w;r7j|9hM)7xoTClyv;h~9CccGmTGR5YLftq*aXEE ztzR=`ja*96rXyWdV_3A3)*k7%p;sw%vpm`WNB?Ym8__Rel zAj4qxl<8na5)y;AZj3{|NuOy=Vz0V%GS}e=2#vJ>1k-Ux!cEiCUJLzUv0+2<##(jB zRp1Hrt`BN0+kwXUmsSn$5BY32{^aL{J*kF=b{Wpg{@9H567_TI`pq z=0vVG4_6i~I}JAtW>M+5&M0Lqxx(abY^L@%F5TO8=c{ zZO{#x7pM<^19r~EKQ->0h7cR4<^)pd<=7Zde(f&n}R1vhyIZMSzWt@Jiv zsJ?=4mbKZohelIGhPp7U0VZ;s`GqD5#g0ewRSk6Jhx*(F+3`q}wREt~j*fwG8W_;? zmZPEfedr=!S|U{9$yzrg7+7MyxWO!{=K~KJzX-D`a36!;94?8mqjj$n=}hEM67Gh2PYNz(&M>#bb>)MZpp#k9Pcz_(8}m^{R4pJ z5v)DTLo_2Iu+Ge9G+*Xn4e9Hc@#HNGy&)-^yy|=dRLlsHm93Uq=s4M~hXy&x^hWhKauh4^1%y-6edsOIXJ| z-L+CU!%QYdNz(@{Y_1VsB(j%oI7`U5?Xul&j@v~EWXEvc{Z;BPqHzadyfV-T=)cgc z{Z#Uf7VNb+SISFBRRZaNF);j%V_VGa~biP#X-mL@-&hVir603 zB*JsDXh}MZf#tT!l5gKibGO%S1@Mjml1`xWj=|^Cj4(x;S7mNt4@GUBRi5ieZ~6RD zxenBl**{^{voS0J2rC1&omOG>!s6&sIO+j^aOJRlPsvpP|d)WcA^Z zxsT}$FJ8Mdn4N0>N<${Af~w6DU2L(BtHIXp1W>m2mf@^y_)v!H5Fw6G6D62x#bOfs>+kJaC3ioS(j z1kV)v?~h5>kC9U%PtP)*<6R2S8Mlmz> z^T#ERG+QA%MnCh$iHgJKnriD+MnF!1zmP;xXI2?w+x`wF6tSoaix=5Sp^23rm`ym@ z{=$20@jC4`_=X<`RaVbH^{>NC;Ir3fRjKkr@wk&5;T-ny-@u{HV;3q~_MDfC5h?no zol)PP>Y`QfLRfxz(DUVTUr@TuV|NpTAmr+5slfhny|9d+hGLv*tS4V1&&?gw==+<| z?%0^B=&jAj!2uh>G|UKPywyC;OdL8T`ZmTVQs|g4soI%iK$oE_Nl*tvS*p1^tMYlI zgbK{E5-gMkccUmfd|^^RwLn5Ef!j%L)~}91l(R%rBpN1GBF_;fLfFRlx(<$#5|QW4 z^kRQ>g~z)vyU&=YWI#dOjI^#qamY%`t((#B;=5%><1ZXrDVx8w_UXb^KH6FcY&Z$P zS?sCBm0(+2e#c;OD$OFV zAf-Wj2M7&fD%HQ}jl%9c#$GC?sb>Nyx|`=L`a>fw7t_f0$44KlL1_gI(I{Vnj3F!= zV#9t9IXJ$i7{=uT#j~%Vxo_6XF-@kAsiVl4R%hXw#Qvm3*%;&$v|Axr}=$ z-t(sQb%BsNF{syk(^tC61@BPdmz%1I(K#PJrjnOIC8;1^_S`Hl!~+2Hnz&eYasK4o zashK8rR_h5B$mt;D)jT+vm=@_Ln7(zaHKi`B+FNVgK+0_>_T~ajO2oyN1Y^mt}WDe zcHj(!G*@{#$Q&i*O$EcwT*Xpj_np6R9Qa+&jsW0F3>oX z&K&-xdZXk7P>%ks`famUlsYhth88PpWr`pDYXvplx!fmuL&%usaL=vidk@%&((18+ zS2G?_x?$*q?urvjA5)Rxk@}6CeSCO58fjRh(vSm^N~q8B8kz5LF#X7J9RMy{hV?4| zir>4>KL-|dy=x0tIw|hn6vybP1j0YIJcd3S4`cnFsSz1@W@C&ecGy_nF6*fyJTUdrr}nq=bp9@PjkYqJRfWO>}eZzct~w%;#$@6&7B+? zU!nL;4<}|9(c)~_@SRAXcQmpO+c7V}%)-S%4_QY^r&C5EmS}sxYWPC6y^56scnE%f zxAq<2hhwQoPrBZA$9{3n$Q>9YeP&bM)JQ}oHEm^!PYqZ;l z1WV)y;I)a3-fa?G24qD0-4JAUt1!rMWlYsQqf~17(H~Ur?_xQX;QP}MB%bI5Y;DV* zeoZ)lOOcI^T~TTuK2-DZL$@_#nq-uBs+wmZC-$HcCo!pR+fv07qdXUKcceg81JuIk zrkhvbIpUN%uTUq8@`}3Ec}*N9AT?1uJ6VkyeNLnV&d-FIfz3umeqMw|L>Ia^CLY|y zn%8{kccp;~k)DJOiQEhlCec)#@8!5m1a5J_*p7HP8k?0~kBmvHg)>CIpzKyhA;|>{ z2UK6N68r7W8k?I~qTlU|I_U`v#sm%@L-Rq?d5!*K4&vAIY+3OYp*6xDYaHP#HJ8V0 z-x6dEOnoJBVlMEc=up}uFeCqG*)gM($K1P9NV^3O|eZ62LNkdaro8%U+TFIkkgjR>z7ZrZP`=1&)BVmC_(+HdwP8hVG{9dK zSFzq*UNplI77F(8(&AX=6N^#F6m6w3OCqG1L3zc1O~p> zkK`2t7Fz<&KDro6TWlACY02vh5!qe14mS2c#S^9cI_Zp_aPNQdB>A?D5VoZ6g|WyP zqXYmchVqbGKhI_lw&g#`F(=BBeFwU5?Z!1mH z#Z`BvC^zFIe)>UWh|oR#zxLkpE6VnZ`zD5AC>f9(knR|15$W#kt{Kux7$k=rN>aKT z2BcvC5dkHXMmiM)#2_6JNx^$~e%D%$f5Cmfxn7>%c{6LT^W6Jb`}pq9zSvMsAT`L@ z$j)`7>Hy_knKkIXpVdp(Q_+=Do~eg0bkEnfRBuETp%+d)DR1)`?Pljw6R14mLMHBv zs*ip^Cf3^PsT=sbbuHtrcuNAy9LISMtf3IZ=Q4dhClc21Gj=5p3EpBIam{NC;uJP$ zan6fbN-l#m zzpXB(6Uf%KsT1BrmKTztbTJp$F6B#(FCOk5_$ZuWA?#SsV9n5eiZDTlz!Z=gv&z^N zKxy13R(7fl|H8DfbInz|u?5oMjI~(FZho{_?Kc&d-{N|De~E1N7ztFE0ua5xiP z(-SW5n}Y41w&`~LNwi!~{n)3TtujfBUP%@PNJesl-N^|inrgy=E=JSV>+?v&NXg1^ zW&9US>D_X+WVOXH3hv97NJ%c(Mw_d}6UTbXBupVip`>vVO$GsBqq}`RQ1>cj0U~(8Ow5jqamY1#-P0B7H{`hr8VuCD7W&(y=hkUoD$oFSJ zzN!wr%8^Eo#@YmHk;3nRwfQ4{xs^Jq4l2w}(jD6)6F=ZZl2> zPkQZM0Zhjms+L_>09&7E#C99l_zAGiUDgAD}#hv#=3IdQ{r+rTZd1@C#094rHy-JD~}>_oOPu}Rpw;* zr+_@ynUl*jD{x?^LscrSq}J00ZBN`L>8$?o`Q|^S5IF~KpWJ6`)yX-dG`nTAKZQz5 zt$*XJq`CZiPadXo3mlb{%HQ0sY)Up-N%t1}9Vjv(s@6P?=~4aa^e1Zf+7YGPy?yBJC36_oH{5_kl>Qp)?$ElU(XXZ=1U&SHj?J6A|bpeQYHDq!06 zE>#ogjwpe6xxk$E%0jVF`<%`21rSM*W-LS1qs`S^#lbw`(KDd({3324@D2DD;q}_H z7f;|xkgY%OgsqgiGIwW65LVp?M*x1-AgD>?^KpFe4s{Jpvj-8BmZBJ9II-!5$^iiJ<)YYa(`0{t|LSm###RYC@0 z{sr$A8a5n%&l_B2)pS=52{*){4+g5c3_ay8l9EzYvoPJe={uYFio{j>eq_-!v*#~c zv`#!lZrcuB@Z{?SO^~8F_k1~8s+N+_Kdp^{Sta%>Ua{4o=XhY^9z^i0IGZesJeTFK z`LV10O$CE*Doqn*n6G@0n7THOYcfgmF-isqv~YmHad8fhkc-N_;8%!@bpNcWSYY4F zvNop(pTtZdR2|F>PAf}AKKRm|*#{4MKRc!|Q5##wgn=bDnUa zdK$GfW#+wKdCU-~nUefKW=__l-3ZGhUg3o%x(UbkH8d$39Y(Cg$tm|(m*fB3eIv!7 zoL9TWP_vWW08m|d=Df9;cZc1SV=f3&Lj@KfL=+s`+wFwb#a4KqL+6U~o~XU5neV}* z+u>%907I@_44NA5c~=!@Gav8w!_~oa-UTQcVwST`kj^+V^0sUqUpBi`N!nn+!Q63b2KzK5>Qo@BW+974^TEm= zapC#%C1~-3NXGX}`M#n=RkI>}v26U_FJsWYFV)(j^k!6=9L~R^?q4gf2y={V<@e(^ z=tegyX?@vKJu7ufCyJVWTI(pi5j2<2&sc~C#NpM=2Q4xd4J(fp;xiG5>o}^tq1R5a z9UEa0I3eYF0_3H)EmxxqoF&@i@E^{xa$;2BOSO2MU=>d@CuoiJ$iY0O5`2Z9!A~`y zr7}d#E#8Jz+{3wd%OK=Z%K7MAR2V0o$YT~VC;^kU*>Xy=eJ`#_!LAd@zVA?3p+(6n zOYl#q0ORuPIu;{yeyhghV5scQ8QJ>6@Ke?f7Y*zB1*oK<+U_{CTBbVsVDGSSTl~9B zM(%qOCOMQSp{Un1YI=`N!a(d-k-gwd3xfB|=*`u{R|g-4$8N>r#Is>g@nW5%$D*^k zVRl&?+1+$s%q{L6$7Dt=HU~5-B2)>YU@4X#m*%{Z{LOrO1`MXJmys8fgCDmrOw9a~ z)PQ}L{UtKHSDPQzglN>gfiwCbBXQR`1VLj3KKZcuXTnXsGU3zfk5P*L4xJpJ zg!3S{0T`bJ<2<-wWs|$=t@B0eORAf}2}sEiZ$kTkByXx@(|Om#H3w~mz5PU;lF~G% z>?&H6e?%(V2oreoi10IM<91!RiXiGhb&6h1Dl(ghg?(Y!BxfJlAz^P8 z1$LP0vt7+p11_wew6!Y(V!n=5FOkw4(m|5+-GhiEmq&YNEqQQIbGv8bHK1zkI+>yD zxQMQn{<4ZRm*+G0X+Jb8Gm>#mWekOo1D z?Fey3zC~z8EXT;m40oTt;**0Kl4ZP5yNk)y*@Q;|pBI$?h@RO+v|alQ2JOL9 zI#I2L-~nJuG7z67>5Mo6OPu!XE#qTie?DE`r{I|^%0gc(xFKmkl6#QD+I+Iq7hY_h zYQ&Y52kbriY(_*L-bFkLt)RN?0c@jA7?NKxacz$D^_`{l`qMHT?B!&_Xpb(N3Gk+5 z>jyhn+Ngmc&C0&RB;HMR2vIg0{?reGA0C?Nb~WVgc_#=c0cMnM(XRO2OwihVOnxu? zsU-bD{<|LNm&7lm-(Gn7$e7+ErU$A=a{> zeZxyZF0uPOKbQskp&x6?rj)thWJB;#KcquYRo8xlF*Hm^*5-*0Ue<)WscU0w1+Ml> z<0%t~$?1gnj~>QtZha$*acw*HJP!NSD2I%D1w)ZingI%>}la zVL8W+>j#N7MCx_88u5ah8>^>evGxZtT$Y^LMGTr`ku7YvcNb@}X+5A~FsOIAL)mje zDA(^K0)@Q7|$*^86o{S>tJgg0ajDM4rT z2A?t>a0oYAEfuxpQ`y=P3L?@{$4k9-A@O_+f5>i;Lwf&^mxrliL>X&AM;I$2h35z# zYhkXD8)&d-**@x;3VR2+Pj%*GZW#jEUm=8WIt*Ewahg-Wd*OHKbwW^o-ZkBtX5HOy zd?ma&C164<%RVeo-4g;qEU0i8ZjRMxApY?E0dyrBDi&0>r|N^{^cDRNvp(_3rTv(h zs(`a1!XG1MU{Wdk%_mxNKlklBK(ppfj0?%4@XS3HjEH*e)$OnDfu>f*1^x$g`QG30 z;n-i^@88EmZV{a0?DSj?e?;Yf$u%l5>}n}h+m}Y)^eUDx)bX+E36a;STwydtFivb+xD)d)J%fDadEU6H#;=c`n#JX zmkKX)JcwD__@P=rty#HNu)Gv9sd}UCLCV=!9zF$OvA)UAs{X=9EmDcBb_;@qbKfrO z>_h`-=^V?+?d8M6A0GMd{A9ze>!|`W<&eV_3`t;$u@qLav9Rd;GE&4A;8PE#VW~|5 zU`o%xmN3e|5bbELrnt(|BNRe3Ya@hPy+XTwm7HW1VgTgkW?s=4Z&0mE<73IgFI`d6 z)B;jV4cR4=F8{RD*3O|Kf3PXc%CK;L)0-H+68n-qIq-@9^1N`ezMp54hW5`f-_h52 zNadlb4yY!Q)PkNTOlgIF8kid4ls?+07DeGg%RlK|Xd58)tZiDq-fy>nqe1%f0i)*F zi;h>X_NohL%PHpcBdf0Z$nHA_7=gNY$!8g{c?h%YbQrM03g;NfSkA+={+Q6Q41p6p zhObdOf`<{)nKoiG-r^yraEK_`E#o{AkM-+hQG*j>+mJhq1J7l|L7y{P*ZAng4Wiev zo@)Cxk{Aol)y7+WCvm$2teNC3HQ*DXDD$*iMDO@1$x|2S6@*1c;FbE8OoNg->%(so z6<0F*bbO#kiMCL~em|-H`o7F#P-uB?;-h>K&g$$foAWM1F`nD9p9~kgw-W)Fe#NQB zjmdyzZ^xN$6gfnucAcK600GH$=72#jDL{g%A(43H_gg^$5G$ETIZgm|s-+~XCHEE+ zko`!GBB%@j70_mH8U5_B=tXPyqiyNE^G4;muT5FJ6i_CyM(aNI-Sf&OuQS3Wqf;AA z;=CiR*^BjW1O-XeKD1b^+*9Bh1a z3wz@7Ncr})*InYbwa<4sn1rH!aJj_wY8&Zcg=Z#N8%oxhU{0eyTxC(OeY{!BE;VVS zR^Q@2+&=O)>C@I7?M;&11QmCGsN{DGAYLmT@?{YFS43BHUH$sLaFd|&(wLxTHEvFk zuGIdsrE2`UIu4t7P}gSJIm~DJ};}hT{CHozfQ9~pMUPjzHtW|5fj)CVI8c`CL0FQ~5 zH`R#%{=0EkYtE5h1xD35OhFv*a?63Kd-NA^hRG?;ulTRa)geIR>G$3}rb;ef#mkOq zS`-L{;va((4LqcIl6QnFH(0?E{l;b_mg?sDsVq&)F!m>Wz1Noz#AGvu$P8m8EvSJ?g_h_Uv~O6_2{OCYbkUH z^kdr{FqF9jE9xoXQuSmNQM$+pf(0ZV38dDrKcOMX?SC5DlltX~)M%Rxj3puIkGrdb z&G^`N#ew+E)D&WX5=H;6_{Co3LDkk7VE@VdB_;?$?#`8HDF)ofH?gZ6ebr4ab{jAn zi*5})601Jm_DW3oine7(S1Kq6%cU&Fa^~w52#p?Z16Lde)zBsC&|?WUZpF_F2g7#= zkk@C)o+Di?{A8P96e2MKXEx3yiOY|jh_agrJVICkhw$7Kty+6u#s<><9MfqzI@5_3<1OyyaLgfrb@y>t&~$OyCfPhy-r<9p3A36L63?g(QiWiNvL zrwngwsAJYvkNyjio1RDlEQGFVaqh>W*GQa-4O7LvP_a8Z@`)Bk7cvFT0gyKq2Mh{j z$e)p8x5*!V(<-uPnW}d#|JCp?7%~!pp(Y8kTWnV9=kV*izIYd1-WF_+{y^@5ga2iBq@YtzxX9vub;$=cVqISv!62nN=x&kF z;mVVbe0K$*#OcWjdIsBo;uY4%9gPWO=oBW)$bfR)W{$|s;CF@F>PJ!u! zLJH`TAjVTzQMHM@0Kzu(`tRPtlJ{Js=k4F~zBu~gHO9B0abEIAK`3d8g*qH55JYMP2@;ccWF3RMUeG9W=b*VCMC>O`hR9F)63H9SWjX=c;tHY@ z4@%C??8oPy{~@rHzXf9kf{kUgrGO66X`Fq^u$-aHFYFT#$341K&~e%F)XSLM zslHs9jqzcb7z43st$@dO^iyh04qOA+yr2d$CI8r%II8$95R^O)br>rkD^ijRS{J=m zLSiGVG;+MPb46c*a#Qxlfx+HvBf}|pqp(4WI5)iEba~ zQyIn?M7$zA4vom1RrgOAS=)FCSw5XY&q&9f^$CQHCq%aF zKNLP;_(tuQP=}}+$ZX96oLD5il@mWCa`PdHo*hYNyVdRuI;X?-?@p>nKuj2swE5j` zh|U;{A@#Sr;>IPu`qMMaN}*Og&qb|QwvX9ealZH^Z;;$&R3ox{g|IJcsf_y7{z$r& z70Y{Z@Btu{xwQWW2a_~aijKR-Q3aQHsuTC^j01eLLVsq^IfhGwFMKA$3IeBqm<$W) z!M~2aXu%)n9v_rKzmL$Fp3f}T*VSU07+V*NPRz)Pv)!~G9U?*QlVmZ1LuljUn$f&9 zrvfO87P7-^pV0T3$tgmNZr_73ZBN1QV|%%ULo*4^Fib7*^9--Ji2wf66^&b$3Y~*} z*KTH=ZRS&Kjr8-D{>J9|aEf=nzb2(wlk4%qtfe8$dl?or7h|90UI8(5=6~eEcJH*! zzxK?+)}t!fhF}2G7FRY-rF{5k$=UrOwMtR{tX$tF*Ap@2cX?#@37RKDU~FRfX||q- zF|p^K9_6~UjgJoksTv?X$O9;zK) z35G}%5hrx_?{CZWSr!N&X50(p%Jp4ClzIppWpt( zWA;hxH+P0YX}41bO$ZUbF|ddV(JBe<0xA)lO=5B-UWiq(cZWS|S1y=DV*m03mh^Xm z%kGO@QHJg3%t~N`=+@2bZdcm3H zKU|pY+j$mE;`pHsg1AI{Wi9%;=YNn=Y_0RgTnOw>`{J+K)zH#i=aaj5p>?@|Z&Ut% zHtI$WP<;Y#4BLS^uTX!Bf;Xa|pk&cs5Y!hBZnA$jw?qHmBJGWs zoeg>S7XtOeottZ$wT$MCzr}w&I}~640-zqI;-IMC{~5Kw{w4ksixVHg&~bi$;ZFl^ zJd}Z*+k!!ViJdp3)lQ7@;QvP*{1=Pb?SivvblV)!%HE&|{}pX+IIA{RwVTZU2J{AO zxh9Ikp{@y^ld}9JHr`NH8yn_*QvZtG;Y|bfFejAgFWBsc`Hg69?kW9uVl_NGJOJRbGw0Kglw%l}O)*kY zt0Z|L`#^%mMX{qO1j;jfP61@zk8Se~hQ4rmxzh?1=h5AJ=8U literal 356550 zcmeFZWmFq&*EWn6DMebWP~2UMOQE;~4esvlUMR((c##0b2`<5%;_eQ`-QC}CU5~Br z-}nE{nprb*uE}I(pL-ws*fI%I1W3L^B|wFNfq5q_C8i7m10M|og9w8R2OSA{NmGJu zV4amEMPbTDKJ7sdJWMsD&E(}_=%M?_FbJ>&(37F3KvyAH!vEQqfTe|j|7RR}oe)bH zg#S7R0NuWRq@e5TcmCbNXTkp0+0d~pxc@#IJ~|8jzxQ8%1O|pJlrs^!L2;1MbcTU> z`{8wkg-K1vhk^M5BP}MP>H&M$(jQNG=b4Y!>V4Q?Zpx&)JiTne2@{BI{v|NZ%*JM$ zlxUladf9bKm}XKONt!F*48f zdw$W|HL&96zq+mpoSq5bSIg#TI85(0Af!&~v+$^P${*cWAB+yA)|<~JNF(xS#}7KyI+|7ZB8 z>a_j;xssTHIEoawY&T-O;(x9V-GSZ~;s4wdbmu>}^{>qSBdvc`=|8&lUxxP|OZ*om z{sR#I0f_(OW&Y!Q{@cg?2O$1`0z_N(#>78d#f^-@<}5?W6@$VTW!EkJ*f+Fr#{5z|^xRzWrBaG_h8;H+&MLc2uiJ z?AEX*aL~yWWY6s4`Y!3m&;^gapvK}W^EZQ5u4XT%f^qFm)4%M6*S zdqfKFVpeGIx(A|oU%6%M=sw*>EsCE-QraGO-+L-gH;_ZhEymO|1sRMyC+Op=?L7bc^!9|?qfrWqAZfNf#IbDnplT(1=GFYx_O zRo}!KR~9VHZ}#F@N`>mKR@G4+_X8K@$8C+iSE%X=J{jLzyoS{6oIAGf)lZa3G_4hP zbi&l|2&!g^AeSYk#=-1@!uh=CMfAR2P3E~)UJWnG?s~_S?-mEebwaA^uW>+LR~5x^ z_xpW>=<1n;^Af4m9pv6u^b)oa0mzTlm_JpY%sa}`!UK?fxZ(6!fSK;4J0l-`d*>;| z7BB1^E8Ai-c9gHkiGM3)Q>Z{Xt%H>=?G>@v(7CF;w( zU%W9{iyRt&-0TA5B9!dh!4@(cJB;z>FpWLa!q9hMwu8;$(qj->b6XULByb zdJIOoIripsc}Cr`&h>sbma}@#-4G(-Hx2#$!LJt4E-dLY_l4%U`;#io6VG9O1o94S zZTh-W6BEaO&bB;tI;Q`AV^CNZd}!8B`W+>()rP4t7rpVTIxR+>IY<6Ay0|qbB`vxi zh0(3UhQ+c#&Uz#WPMvd4WG%JaM{zO#;JME*B&0Jjbyoub|)*Uf^`Px3Xg& z`=i@5je+|>;)reGK3B_EC^2kEZF;t@Vrm=XN5v6azs6a4*(z9IHrk$Yn*$6H+VY|O zo>k=v44s`7Z_YT-Z7mIEoMqF$-VZLjAJUuuWS{(01%R|f4quGr4--7wJhYNbyi%1-jb+(5=e3VnCl6YU!cPi z$r(0fneA|&(o62TJ@2{uJnBk+Kc)&gnO!(m1~0tPPo&mS%A~5pkmJl|Dqd1O%o~DG z5bA0S0?hlT3C8F9#`waN)rJHZx~9h`$yi?prj0-2Gs|c~SgI z9jhYy{)qNbS~R?fkG)N;$;qa>4*;d%i<-&3xt0O6mT4V<%SUSMJ+St?O_Rd(GKaf_ z688wXXf#Xe8d;F+q%UOLG7hVJY6nKe+bNw`x-6j%0gctA=-l`_XcDASKAUN@~Y{pMIaWAbTN*{Tydy>Pe4h@ zK=TkjFU<$KfKO&oN)e*hwp;1R169SsO`PkAzWBw3({3$UI)r2ohn4q~uK_Mga)8cs z@}Rmp9#p5;VX-m1PziC0!Xr%xu{=HJghenMQLW1X|b#QL&m*W~d@p*R=p?2f(!GXwK|{_rO_Gr;QqYjpFU7t7W;+ zj=&Kvl+k>{gF2L}ZjNajs0(V%fa$DBxs(JuQ4)j(zq`ad@Ru>koz$pAFM4vzn>ddi zXl{2*XTjZ7=foYMmvyG#AZW9)d^1*Z_w1Ad#4$CDEU=Z!h3>iTtiA}qBDE8pB3Sz74$ zc-`Lw2m269FF6>$!z`LE_*Fv%^++ zJ~M>)Uzj=bb<*!lc#hzO+>H%g?rnAuvWbYP2Eq`?DrMI zOv3%d3vfuc{zqYarhmC#uyg2a-7`Rb#_{VOqvgQkI6P1+lq|4{>4Rq7`tfn8MuY?VEz^6nD=r#w8= zM;`L!0~H3<^hj4qBER&ypWhwscC_d}?!4TLcZH-Kq;0Lmi#(rj`8|G}Sa76d7~TJo zD(}gxG1|qQW_SuTuHv$Oz|UF=6|^qEvfJ#TgMx2?hbC8L+fWYJG*pif_-BipH%6l~9-m44g<4-4xKp;Jy>3n>k7$>6 z>zZb3*GpZ^HplI@^=H&gf_Bw#vG?wnQb!??5*qm^AI>0m;q#U;hIu#R4stJxXWI#> zZ)~zfK1$%Lm<4D&T_4NGBKfxWurhPi(n2_!bdifnY${12sQ_G5zG2i@QI2%c)+VQNA_$pOh#ag@eR}3O>$&0=@!mBSoZI9KG%;{= z^LgAuB1wq2Q!D7oedxf`e=H-iJ+eKT~Os#iMkf1)J^UkifKn`3!Nl8PY7)Tfnl&fRNVPAWyB_KNK~e+O~{RobaxjEaQ}Z z1Z?`G?XX}CeT<8hdN>#>vQVoZ z6i4dyr0< z`Yg!KU9Z-MMT|NAg5*sCY5SB*XBJ3VYTCWZr~gq{j}c%xcKqG%uVbXThar~anUkMO z&5MPQryLqxvNPDyzVByKD+xb(hNU=ufV2X+dVd=|L$WA>=E~LVxr_8ZP5=o>ZaF0(Y?dsO zYndLb%X;_9Lp?m9^jx1E!q|EVEMoxyu>wQ=sO_jx!XNI7c#Qn-PUcOCrzFTzL1m5k!;u@_bXrHH&ocHO8-0 zFJf$DK5kp#Zm;Ws27NzUl?)#h1ky07iKoP8vd>(CG`l8b zGqAYU_p;fZa-vZbX#*JXzo&}k)s~e~@d6P+W1ZN@-|H0%e5%4xSuEB{f2(L_odq%% z4ML-%(01^LasWa7{vyj})v)-OaSf(vnuc;VXZ*a6kIVZK3?$nj zHD?ZfKZd=Yw-M~}1rIUQ2j11*yR8P^=GOHMd&(UHy;DQ9L|}vWk|o5+9mAx5!a-P^zPN_G9Z7kfbCXh;LaV!QBc1@ zp{*jn&NlS7Jw`hIQ~YT8i=U?xzqRZ{VmZ3I_WY4r)wVm+xyZ}1=Gk#94PPyHzb9`s6R?P+s~x=)L1*gype?K%m*xs97&e7**v>W?Z@V(pVLjk_cQla(lSq1mCnwMfhRH@J<6_bp$xN6B(`DaOdv1f{F4DdpO$t#iQPl|+y zoTc)4iRkEFjd^vyi(l=pNbS-)$EJNx&qTS&Gak)2@~z0|jNCH3sQd%&)x%ojg4w(u zbje-4Vwdkf8yLPpApFT~n%L?=Ibf|hN9$Pg$Od*DV)S-!(nnq_#%s7ANL5F_)gVl#5Rtnl4dN=lXBD0T26Gif_ z!RZ$1#b}DK^BxyULx`6alI^+J;sHhR*#$E7M?Tr`WpJbkgE%%;qdSLJh$bq2X48o# zXndO>3ovZ{1-ytf(op^RZmGS$1&%NojbZ<32XV`a7rPr(_(GUzaup6vug_?x#0%S7ng#UPayD_ z?{7;RKKEEX9KqO6#;kf+bI_OypO@L9QAhB8%i8T<%W~ded08LN35g+DDadY39--%s z(W#pa`=xCUaiXzs^&(^Y?aZCKss_-cpS0z=vGuKEd|G|~Jf7~6A)f+_RFGJIP>amu zQdPq2ZaGeB<5h51P zi#8%M4t}@LdW-A;svuIC`7F(gf~c+ZE&>(!eW+^g=LlXrn1#L)+(3y}=RH@Q`gx?2 zmTKL{#2d*bo=B(-@lCP^R_O>M#HTgD}5jC z3o=)?5<2cn4cjCQ=#{cBS@J6A5pRnU_a&DHK>jW#&sS}?mis)K5r;k@q$BOF6vA2J z0VJuBIfZRknWz+6t(bv|xVGXVC`rGS*+)zpHB2=FAN;vSmuac)ep>6cJ%5ELkcX(6j$Z!=;&- zOy_(sRc6(|JGqU_e?TDKF+sj#>8Kz*8zcI1PfRdv@4jo-sFNFkZbv^{RHAOh!=hDP za=tJ=TxYko@czpJHuL8O>z4Auv3)I+8RvuXNJ%~gC8@-=U9RBmO^@WEBHF_rpgD$| z_Pbk>7ejV!YR$lp2T8mItntDmnSy>E_7~g7BU*LYFvT0a#C#s2r?z%^Z%U+a;iH|c zOf-e(CVtO-`})mq;7?=2-GExlbds!~)k4j9!OrTGzW*>7Fig>&6N5- zx`PHa9&?A?An5ZSNVWH_Fn|MH$4_uZd>J`CNX<8d?l-zZRxPIwC*ur zRIc~KuL03BmA4w=bu+2cs`N|+tlsc0RJOT3G?zLPC8D!2PxS}x(t9yEB-c305gUzB5=9bZz)SYC~SPQ)Dc&57M_6>k9d$2T; zC%Cdxj6w{k)#F9@g=%++h&0pmmh; z*9^r#6IMi?bacnk7Ov`h)8OnsW$AKww~3DKbIVJ|HpkzO&=Fzkk>M~gK7?tKky`qN zJLPS{?A@u3XWPNtsr}yQp4zcjS{M*9=z&dzhJ7z&YfJZ$C08%(dlH>B9@Nu}=8J^iP5=0;>Ikqbsq7&{M2oMA3a%;M=r8XCl4LIL3APT zu)I0W(|P|SXYKThv2f^}ckR$qXP9)MlUDB?+-H7#J4l^Ta%B^Bq2m=+?ji8$ivu}-aA4o^4r?KS z){c+envRGBT5tM$+x#C!{U-JxSgj(vl#@0u9U(C%!dXcjD^Y18?oy(-5^NZONOEMr zH!-cbNc2o~n8|%+lLcznf1BCcNiOtSOVmtDp4kLk%U+o!wC3?7A;t%-e;7=o&Wp z5I(D@(oa`;I1Ux8H8YaxUk+4%{x(wv2wrnDskt5)Irgot6S%=@Qz{dpzh>2&RbK;E zoN{JnsAr)^W-W**wlHEtyKrf(tUSBcc5l7y&D@IbhD0&NeDq<-uiJZm?w>blXl-p+ zc9t#nurj9T2MueDYEtBLvPkCaot?3TX>Ky=Ho27&xfl7~|6SwUeK%NmLh1s~U7%CE zqrGcAPo4xRnph2I>_#OD`L)5KGOG4v;G(Nya_{ot37W#oh)TY6g!E|Dm%5t5WXrMn z@+PCP&{Y3G+?@7S>-alzvyxBIjueBAak8wxy0XP)oNW2R>7>2ql8!y?!@kgW{prmY zTD#bZZ!lX?#a1`n>fK0X3>IW6)^{=j0Y!3e;m7{z$SOyHLgDPDxaBV>FpkoUg{`~r z<&@HfiJRP)-#}SDzrXX#nj1?vf0tW9OtOcA%eDUVcH6oVdWiMQ!^?HsdmI^`B3EHk z(Uo<%BFRg7z2L*uNOGmGJ+il=>vHu;O@Lk8liJ^kfg1?414I%gH^}5Kmsx**M zYWjveO}Ce7*ujPnM~V@~>CDHluTX*7DNW{`+x&j( zo1|RbTrRo@=3&s=7RP0ATs9Iei-eUhc3EVY(d2ZqJ2tjlaj*KhyQKDdV@*W-d89SE z_TdE$<2#u1^i7Uu#EwNlg@_bI3;~I0~d7f3Wxj%8e|H-dMbONj{(A3>Y3SIx_SE5jpJm{;&_+1}sR%i||= zb(iFWZ9mxT5-_VO)uY%h*z5^q&?!(bu9Zlovre2(LbSX%c{;2kIZb zoRB@y2HQ_(2?#rfk1YIEfKtDV6MvCQtNlBgNfc-Tebs}1#Y)iU^!8%(*!O%dq~FQu zsb}Uv*u&i3odfxiQ9#Ovs7>}>CTJ-!@*apLEwv1N`y;`6w;nn6TzXXkLb3;Rx; zDCSRz{M-7{jdu>R@->~gdbHsI->g?Hp|J(#x7nXi7ioPv!D#|LFh|k2q&cSSm%=`b z2~^V)U;cYU@^tz;P55s8xTPy6C`3WaZWG=9P_Jox(P4X}HRF=1UD*G zYMQoJZ0UEi&mvkZ)Y>dA^utm`$nA7yS=lOk?BWy}a`QDha@+XDh_1?5ReFkwu*C-V ztwZcKMm9^w2DV+^75+CDqdSsF)j>h*@&k-{{5WAR@zs-)@m(DwSETzNLeI46 zf3tUtQ(^R~r%T+u(#h>@0>TSYi1{aBJ|6LadypOt`DX^bO>=BNubUPU-6qGKoR||o zj}z$vLLyKGAUR_6T4D8eMZ3=b(!6D@XKxM4D^~GkN>TJLmQ(pO*uH)v%zWD2dLxEt)A+i{{?=M4JYsr*$crA%?@mz z8M*FyLYj=Dt^~=SEF9i`&t+Y39KW{`0!0A;v)7Hkzz|mPbUpBvxkNU`KWumb3)%v4 zq?hsr+81&ffk}MSdj_b z*!q<c-oC%Ic6?i zFL*JN8F=3Un-6TnSJ>qhX9OcA>0y&V5%2f3QmRuA(pY7!f-vr2hLRjQp^(gO4T3lQPH$N0-`tSQn1(gAo zj;`KNCW1g9aqBeTGzSd!7#QyWuDyj->qSvOKT_e}DIfUoQ&sm)Js0-1_ksepDpW@6 zcbwlSg16naY4@f_YeTE^LsT6`F;YZ-m4>nr_5;U?hJG3`OOY`_aOsHJi~nQY%X5qS zs!!ERXl|ZcQwyY3QJF7bN+c-dWd8&J}gk;PZOln7($r1#Xi8I{_8G4*$ zzp^}@FjXp$C`gsb+qV=CVRW(F8?y|^+tO5L7^pYv@Aq)x1LXp(ZLJ?bB+u#eI?O05fz#}hgc$M+wuJ+NA4c`YO&KI zV6!duH?>s2wlln3cqn$OB|(jQpq1dA95fbKd{0{QLGuSmn5(9lOB5=3s{Gb8VciPq z+nsN#f__c}KdgfZNr)7XKSpJT8hi`Ae7PDiu=Q|oxLsWJ!@S#Euzx%aIiVRmzdS4% zs9wt=RQg0}QR->vcd#ABU&n~uj#~%TsJEQ;*n&&1h3`sSJ$_-r{Cz`L;7JzlmZW%> z`JMU1#D_~C^K&~6s{>JPDPgxP+?%99{9c@oa?dk~Y+nKexfuUV5)iz0_q@|j{qd^W zjIg;oaZjVorB+D!F2f5;|Ty3ov5?t;W=rl(y#~YJ5gv*9XCIvar zy5=qmJd2OV%i5lW82U?$|Lu-_EAPt@5=n-f@ch#G>>EOpU6l{?r+6>dEH9fg+U_f@ zj<%jo0w5Y|NB+_(HSUTDWgISMdZ**2->%F|Pf3LDzy4KZOBC~G;O`a_4ykn8OAj`9 zM<4!VK3JoHJKq)GWs@>i@OS3Me{N-&p{g0GQ;)mx;z~@niVYl%gty-bcp|zv-If^p zCpoF&hwOuKJk`agNlG9=dTX}`+?a}E^eUq6+G=``VNKPjE8W=|dau-kGHU$x=G6rU z-=tijuvh;Eh8n#tggg5T>coA_;cgRPHI+g|wU=1Y3JQALp0CPZ_PtMBn?Rt_E1L{l z!|Au)c7IQ7cyG|n57N91ACB5?i-p@RoaHw%k(d{4(-_B;epyJ<2TlV`hVIE&ZP z+UM1Gd!=c!_N(=PHaa+sUdzf_Z$UfBFjK`?Skw8JU7_y=8^seA1J4PTBJ4P8#kg>P z--|6A_kdWdQ15w@=)w#D?7Gwma_^Q(hfCKWMCG&8N5c4*fquPv-Swpw^Gg`0Lq^pS z{ScYnhJ&tRUQ_OaO-Nw^CGiV$xkQ;6wE1d6^>kFLhHUDO8$jThiMF1gR5R<%Y-K^qgx*IDsGJ}BsbP*aLLepqv?XqK- zP-J+Pf-8$>D)le&Ort!VG=?k^qJ{W1O)hFg2y|+2aE~@Kek}`rS}E<&G6#(m+uDpI zNp4LTuoIK4_@)n22LWyt95!Z3wQWZ;GvzV8=5lPy0;j;0YV1jhU~u;sA;Vt zkT^fcoi2XWXrTw^#kox*s~H&;$H~#$WAb#^H0SaGxAHVw(J1Uw@_QxCb0#(GT579X zW{=TQ;Slx4qSu-8z&@C>zj-HVUVF5l~SsC+`wd^E1EEL*V z#@;Gd>3J}`(SZ@XkX=dCJ5B{}SWc^HH|u{m4v-r9KFEN*r11x6=Ytx8RADyc0~~8K zzs2WuwI^1ehh_Jf+WSkVfv>%`-eg<%&O^OfB<1h8?f(RQTa20)Ghm)D@%Mj;R}dOB zk611p-p#LDIe0zMy}>z9BbpOm)RruJ1)>p z->`nO@Dmy3Rt?kj=WFt>L->iXd*m&8Mv-%<6WEt zw0QP9BT~{ZK5-K9RS;4kpddId={s)#7|>>CxmPbXT0nv_3f+dBS)5;#a*xEh(uS!g z)4!Lhi4Pb0a5cEQu$PA~AC*>cOP$glsCvr*BPdGY7=fD%T2oYm;R*CI&2g*Uluf*DbeopZqtWum zYud17spy~jss=AKc44@Y;UtA}+Y_09pNa=W)AZ+^`-f>Rm!RVcVWG5P=`!~S^kuc> z?>tJg5n$H+Qu~_Od%I6tswcfIE>CL?^{vjO5FL$rnu`MfjvK#tD(T&0lKac^S0jl! zJ01PS`H!_o{By)LX`IW74qJJ=jMD_t=$)x(n!=fT6LtDQBN#Ty;$eP>Bt@CI9ot z_RPIQDJhT{-eODU1jfHH|4!*7EMfXicOl5-<9@#t)-JYrAWy*yd1SluD;SK_5 zc-jRHYkG*hRj<-v#5GjDwF`@ANLT2ez^L9I4?=>L*#$r>eRHA_*RwM@QAb4|Nd0Ln zCy2`oQ)d*!%|4J{vEP5#lbK@dA~Q&cDxpWFph|+c2pGL7L{{VhCYfvUWz>7NhS=p( zwkLc7C%_=~7D!D`I6a36^6;YUc8Sl<40LCMNCfC;szvbcr_>?zrJD~Q2oJP9nD1Vq zn`-oQsg;R(1*Z9Ya0O-LY?l$+y>L#I{_Q&iygqP2U0!8)yR}S!^x0tSBHCSIO!7my zoxn-J#Z+E#$jo9iA>|+^YSEGy$#`Js@MP|8x&ErwXtMR>{N)tG*67Q@Dv>a+OSq4{v-joZX$MW_C}7m7t?_Q==i0AbTcIlJ){jEvXSyvc(9j#jpFGp3eY59MJ(qlPz|?GLB=MA62z0LgFLQ%BUthV<{cIoLn;ZOY{Kl43rib{Nf)G#ea?h zGUVbZkGx84*c_MB%R?Pq^Nll?*scF)#mV7zGb=UQ6))49qm`GXc3aq1_w=M9e>DPW;Z1bKKAlyXL9Sl7e#5bj%Kt z1KG>IYFd3tH!8AUYW3Z?PFseE=wbW6Tx1dv5w&^ll%P z37R(&NR32VT!i*m*e_@G7A+4mF_lee<&z_`u@~LhcLOUqv=gpJ%}u#V&rz6*^0o?q z?Dnxe3Tt$$UGH>9@FwStB*tK>ZZ3FTl}D$2mI-FUA2||*S248E&&r8Es+(1B&sE~$ z@h>iI-cInnbr_txT4XB!N(dLC2rG(N;cy|KIbwm)WD*L*4H-`3piVxi=tpXLEc_P~ zT8DM|`QMXjMZ;!9-pqHAaEpRecEwt@2^aB%~r;y$Vh9zmRoT=HWtF~TJs?{G| z$agpxxk zdqA@}<297?AJ7`p0lzXbS@1UYD9I-?8{x!p6mQz(9}Cjt%nbJ~1ChI&W2y3g9{Kf| z$jGE5Fj~@gFFghFsnbMkg+9&Y)mK<7`t@z8$Y`XHL-Gr$l@I71%;u#>b+y)@S zw1$K&%m0gq60dlelbrYaHQ@aWtKy3LV=v`F%7JFR6#WTJF|}1;xQJX~50RB1#_y?v zg?Op$rr_koA;R>g5%2jKTBMRvEnk-Hb*}nJEac_l<+N}zu>*eTm&_cZt}ZD7DD-f$ zMtOleQ{C^|PA<70nwku;sg^>_)VBlKZS8+&tJ#8G_&~&yrwDHpx2JBJS&=P;+Y1;$ z8ijOKI7OCxI4X&i>Oz5W!Ru;}N-HbK$Z7#`v9$g{Fwk0)d6=6x7@d(7MmI9&z=10m zeqVN2GDf+oc5dscIGyzSpNmDusXUW!Yn5A;_4LNKBhtVts+!lgeZQ%{wk`rEW?Ein z8VA;7QJq+wKU)9nou$0$ZOkv49puqbhmWx?LZ79zKlYe2(7bEo*wt-%UV*e+ZP^I% zf}C;CkI-kOAZ-t)Qz|+7%rihUCFMa>YJ^ z@r<#-1T7^;{MvI5_O$il357(}ywa#)w?WCLX@cehMSp(H0FC`;Z}y>18`DFmLW-Jcv4KDew@FXBl2t!50C zW7c->Rlb$TTk4<}qb7PTH?UB%C7=0HC|D{ta z8rwfKwi}S=8$dGg)0#7-tQ5n|y{^E#fC*0TiR*q2&R8B^I11JvLH*2ci|g!7@&5!9z{spg#jit*@bJ{B}&wtg6 zozF~i5GypbC4aw{vSZ7MNgjSHdp^@3)8arw&aHX-9h=G_{zFmspTO!+UYYKR?VKV3 z>UGVMaN0d7##)K}=>s(yd`8?0(&z~RLocC0_IPjvRgrXLSB|J=gB|qRqmhlw>ZqWFss0t`^8zyB4{Z4h zY>3JG*gcy~>SsfyA60SRDXA9)FG+FE!pMhdZ!$F}sS!XZtf(SXl%G=w&?zRfbUs0} zFzT7~c_w)ZgUy>}xwy?vE`^-NUHZC4Bg+`iGFMK-?;aljKr|X8}=GW#Brw zXjmd zXSntIHHw*$&Afxrr2gSkU@g8Jeogv;)+AmBvcL?`C~oXQF!35H;K$E=6I?c=3~?fd z*lq0AD#s~VXGi?1ip&@{YcM)K%)hB8nb#I_<)y|HXqW|r3mqhv9hWo2&&pK%I`lhD zh>7FA@1EvpSInZ*t?SEwv{wfQjzl|WMEL7l3UgUPFP2;|6YOrn$ zEphH6J0?+DP&A56~`}KjH((ezw3zGD#uq~-^3W%jGx&AUWae|GRbF@ zr#3g{4-Nn}QBL5B%goa)X`JuNlZ>W+OkUX2-N4=+7>@?oHK&it@+GP9{?6KtOf}s9 zd|VQ>=u*&MFHyY!OZ6Lhn48&;>g}u~b6S<%(70AjHv182ax(+2%Ic$OU@Q`?JlTg~ z0}M4Dzd7_ye8;q$6r~b`ynELM29=zs#x2>5Owcvx-8WGfF0Hbk-vOAOB6708Ktl#@ z`SjAQbkaTt_n zQ9-$fy0rEU)K_`@Xy53K5x)Hk4Xa3~2e(`V$h0`c{2-tH5L{c)>|Zu@tr>s82RDFLYK_-w@{jR4ZmmZ|1XD+I~+j~7km=H@MWF&i}T9M_xT#`D=OOu|L6VDS`r zT-ELvHZ^Xpy5}zc+Z)0(>t9J?4inKXE^eGce0@nDsK+hwfYx>?r)elrvY z>?6X?u*eW}&Dp4Z=y59u44q`8&q<~BZC)t9Li3Pnb|8~H$ zMB26anr|#XhSR){4E-B*FsuLmt!Iy1Ftn93FyX9Yg-^wwzsI^oUg`0%eNzJYr_J05 z%G%5E>+NWuSd#!FdT}u-{IbR3@9E*;ae3Q+Xfx!)m0d-0lTCW)`o>yndZl9d=(mbs zjmcs!Nwb^p$@Wp&@|r>IuZ&0lioo*9viIfbSucs7%gwRwly==BQA}@W&6bn21_NIV z;$m!GnD(+TpG!+XK#+Uu%?ifqOUHskUrGJW?Zw^g=5BwNcP3?gtSptP^JjTGau-4l zNG;)!Xdf?eP`Z~hpYNF=^|5O9k1ujcW_y~?nUIOy-5p1X< zh9*F9Mw-kM(#qHhNkvq$!xvOarP@vW_AL*%)`8MRD>14%Lrlw7*1j8;yV%na{DU22 zdPcL)VH_=eVvTvmm0~`B+)M#4n+ZJy&T!h}9iDtF7YPw{=>o%Mnrt!6YJX#Yntnz- zpJKm}57nw|9bQ}Hl1cK)Q+vW*9so)s=a}R258Zsm>IXRM+fL%j0CYE1e~Szwm{wM6 zTPE?928e2D?yHMiZCi*lY0y)e0Hv4{g1d}PW^N4BGF4ExKcjrYRBm4#d_3%U-WWYz zdAZ$)msH4)!Prp%m=%~S@#`)Ap6nyjV0QU{n=8cnW@BXYHUaJ- z-f7_QC2QFliD+sat&O#xPIAlr5!y*2knxF_q|_EI$n8_@SD%^8r$dqzpNnC)C3)Pz zE*d0kSY(Qa-gmQ@{Fs&9;W2*gkzTq*bXA@$1W^b z#fM=jwbG38YB@8g36aHB^W$@65s1qujiOn2;}$DD8d8cFA$`@4x!V+|iF?n~fCO8) zMF}wb^vN4jU9oBEGu{9dxE}kf`cV74Kf>-JUsAP9FwtfQiq3_5K)Kaj@d|!t2l`J( z{@$14G=t+jT3To@(_pTLuDTmLo8u#NNs4TS9^_TVmtA)f9>-8k?}uw!drYYJKeG-` zDTJS?2a927i-{Oha|C)l`urCRzJ_4xqdM-`-~1gB#vCj@&v0o*&lv$jbl=O$q!%8r z-Pu_kUjC&`E8wvu-OxVlH-X2A{{3DtB$@js6I^?3aX^%eMxnJnmD@1 zgJwAR-c_f*n`c!?VR!?JA~j*) z)w?#+(`o&*-Gw1^JB?I;)cdmMf2ZI+bBx{ER5DRBAj)cp6BM}Acr zL;In;O14?~v)lMUb6>G{&A)AM(6;*hx02wu(2zhNxt#+x75MgRO^W`C#_AUey*5u{ zV_Ro)-@*RnoL))ZfnjGRS6@EoAOqv3h>9G#Neg!RBo2VsmxYptz(81(eH_7%UthaZ zF~x*t){+u14Ax1g!so-jSrwhOtc;9|40GGnHa%6Jp(TITP2CAMv!%YdE0*3bCke{< ze`LK?SQ}i^1sdGlixzh)#l5&&a4!_s;;u!4yF+nzcc(#1ad#;0ZYO=e|6H8s8cutHd=y+-f>OY@kLxd>T80 zDJpNQFqAU)P;YXXQS=A1&2<#Cob|et1_JU^Bx@R*eEd(zJ=UJ# zJo+quf)Sp3-rnEdEZ!e$$Y1xV-d)y}D(G#c1I^Dn7Qwp@7E6bT!Hwf_4w%YZJbSOGS3yPlsnw)<{ZYfqCGS61wzD4#(q z#KVgfrm0ZQ3L{DeG-w+>P^lkKaphnzG<+3$YLXzIFw^QHvI zPnFArdgoU2{x?kIt?$0)ee(2P1`G|O`MC@JDD@jQ`Es<3-SBs-8bj3o8+iczlMmQV zKZ^WU+kVNL7CJaC54ASSC&4;&Kp2;}cR)o5-a4BngE!$h+IYQLH*xwaJumGdY@{?i zGvpKDHHg2rd3vgdy~*J8z6t(J5Xs@cQ~X zGkvpF;9D*ZnS~5i=M6B1l8c6KByFwbm(`)%Y)Gm4`{jeyPiWt(+{G{Ebbs<%=cGz- z3R0g3=udQI#77w{RVt=*-L0A;p%9JXl~)tmEVGPk;?3zat2~{bjNi8)eT~>Dct62#{xixV z4!kL&*u`(B(<8Hsx@Kd1P9-MZPAQX#R${T$%nXS-l41c2bI>u!3-XmXqUlaOjAk13TSy1$3uS^d&bt8m?_K5fwPbu{c{_VZlAX2!n z3*X<}l~RZDOK=uTx;b+%uda$CHt*zpzxGN`xxRF9<2L2aCb~^Zc*|LkD*ExU9t}y7 zt;D|LyPbDf5+mb}d?hQh&;?musN?#p-}=Aw%h{%zU05P{nw!Dn_muvv^K>60<7O&l zg3~mJJwIvz!0iz;8BhieZgs(*@7` zFk9G2Dj<(v@|Cef4Q3t*4C&yCQ1$mVQjzMg)Z&%y`qBIairj?D%8(v46&D6cnt#wN z*0e~RsokT)eW}qEMDJ?Ghpo@aQPbM0d4KBZyd18|oHcFreSRtbhPv>%?Pz*Vz|Jg{ z_}0D(Qd~-G4nby|d@mJTB_TxU0amZ1E&lP5h8Do%yz72`9-b6gJ^sOnVpR~kV`R7wm!#c~K%bt6tq3tyg5!ZgOmyt~TtJHNzQL-VkkB{4rTR3RakhRA*sfp<|6( zxv$Ct723bXTK&a@I1m57zG?cuH%V(?07*}Iv;o~)4vDtS^<|EQsw`gRHVba>!DOab zc84u5zhdFL#C}^-UH06Qiy>cn?hJw@(=(wY}K(+oISUM1qW-%rK=WX zZD$w#_$sI@v<+Ktmc&}K;q#UK#)vXXu2d+YMUrX4$PN9|C^FgD~IUX#zZ#K_j9O5ka^DF*zqu>WE z^bX*O%D0|=U%QreIAF!qZ1GuJ#t7*+Q&YRTt0J?KSd=c37AUGV!dqa{UG7*H2p>On ztvd(oml})0)Zf28oZ{DGCKL9<4aF7NB>8Sc$0hr#Qk-S3WSbY7fj_-j3uN9-Us9;E z*WJ?4rRcRpq4;!I@6XSlmhJas>F<@qPD>ZQ)~V32XX-XTy8Rl4LA!%hWJQD#l(VUC zNV>wzZEQ&X#ncL!maBh7_hFN#a&vkv}XPx;)H~$Y0a`E<=E@ST1RtJljNn(w`U6wALsq$ z&d9)4oGDN*GgF3V&=ONReED_fHTacI0;Tp~&3(gsO@iX#(8j?*w^vwgMuaHnZHw@$EBjS%=;VE;>~evP%?^=cvr3rl-yn zdHugdY0SV>afrE!jOQf((`6B*T2>KZRyaJ+;mgQ%+Y$agLu7ufP9jTZw0}JVHf^TB zVa#W+9y`4E8oxTALDRY3^NAo-yoR;noh(M=aA8dOSfv?XOVWF_WRY8&Sd(^3j_UnO zlXj4SH{c_Gwo=+AttlSZ#%6q)tB=L*hwo3^DUte_6A6$`EjE;AXle%TujaTIm_48P z97TMK0ONrCUQ3b#)O5kWnZy)P+uao)$wxiRBCy68=2^Y5?zEfZsfvhn1}1Z0*hmJ5ubMB->`{ zJ@oNIV1G9y>uM2aW}?EcBwH#;S$}#zSZDlnV~bOvE8iIT=#npnHB-eWSu0}|NojpL zgGJ%6M?;z7R$fI}H9CDVi=-!+d@F-q!01n!Z!@IFrT~^InLlPqW96B(2GvD760 ztWd>V^I1`*HsiLxmC~AfES%}|cBh_n%3@{)uBvrdkl-^it+aCfUWm0}u;26DdXq^H zO8X3WmqKTAQZ4mJTI6wz*r8j;^DmHdirc}kr>?E7t(n720=1Y3WAgrSrJbC~^+Gu$CIeyz9CHc|qe4~peTPdPqP)Les0k*TDuRc!48_7aH4iHQZl z(|_qFA}RW%Uct(KSHU8$Gu-ReyPpmn;5sd_R`THj+Q0y6lIBaz9((Pl|FqW(p&^w` zDgc-Y(HQeU53I0G{&Mu_uZJbVe}ejCg5mDSMWieRqKnO0eSMhm&Rr)Z&CVC%cu$*= zBIQh;8g!Qvp-(8p43|)A);(p<=jjdSE^8nfDq(imu;PHR_oF{mJ3gvvEx{lcrX~k{ zU0y?1h03%UxZTpNAx%U~P8b{vJuy8Dw9*gU9xrd8u9X)aI>4ZGZE=Mvsi2K%}i}RJha;3>X3Ddm}MNCBlxhm z;S}3Sl$=hZogA+K;x|-9)bHIod)TP2HzE<)J}elSA{RDP!k0|hxnx>G^`hz~e)6mG#gj&t1VU+(u$+_($JZArbNe6$l zRYc(;pZMEvAfHV&jc-yW>DfWy(QJ6D3?<9!3`X=w-G}hUj@XBFmm|h8O$@S&>PPU+ zMfX3`XykjKr<*xpg8h#Uq+4LJ!(Tp{wGse>^;5lRGT9axobHtuw5>qBDOe|LEw zUalv1GI+%uLvOJThgDg@N71VKqB@z3dB~;E=NeFwbMA~SO2v=^0bZ{P0(_qo6n@WS zW(_Cwb!;yA)P8!1Lh|-US7R!n=@GpoS^(w#E3-0_ZY-5mC?+H^@)}NdQ%%QjjQ@0 zr`~KHv)PbEHf!(zKXT`nWg!aUPEH$z#{rghXbm(Ndh)dRV8?&Q0ba1jJzjmPhHsL8 zDh)A@BnqK(%9dM5*wZlS7(=Ap_j$5!p2A>~o|qUicF5Q2^l+W~y4~XcO#JY+HDfVD zFydXnVy%7ol20%ExVGV7B(nN^p~SgMl;OhZH5qJS zXUA5E0_BV7noqY_C*YZ|>@Tpmv(1bRf*%TjdV$#qS)*k|+YCg-j?{6{ zjtM3B&}EoSi}D@6F2lq&K)$P()S8SWPj-uO{iDfVP+~IU>KMjFPbsZ`ya;1Ht|8Ab z-Bz?tJw&0vT~S$IXwdCWWZ|kpnt@<_Js+djAA*Q4gpWS5M{JS+#O=r($M>hR34yR# z>03REHbb(LbCWe8!Nn)YqGmL_l@6J}dYHhFW_`1Q%EHdSKA4#3rty;f_UHL4!M=<`ePc~kt zgaDRztS2@Kc`1r$kTRhZ6hCeM-t5MuY(tOsxF)DfeV*F7pI$xyAFTXQa7mJ`OC3ZN zs5RjJfYJE5<9)$Fzr)S0W&s3(kDcL+;MpH<*hA4Ad+P#J{?6PT#c+fU7q5xQ_LI(e zM+V#ml{zEVm4gi_Y^4(zm9R1|GG8 z#ADe_oUanjDgjYKuNKN=LO$98Or@GR+enwj$;;Z?Hc0i{(OEmHj$Y0;H?qs}JDu9k zva_NI-8Vrnr))7Pv?f5g&q#-nzBszYyf%zb+G%!c{1?l;HQS7=9p$bzQTdImm6yZ(`VOrWR{lU{`bDUz9=N5A3$!B~!{X z%y{YUa^U=&WFT9ws=ec8SNUVQW2&0opx9J|7(CgKq+cb(gW)BU;rw!B`RRN#m+T2(=#EXL-@!W;h0qjQ^Prs>;w~;Z zQ$}-FJ26LGAv1qs>Sm%M>UyMOx?#1-n2)RtFYGci4|^7Aah!3#bEe5HxFD9I z|0tOD5^Q&Kj9YDAPkDqSN*6D$^S*&bWv6AarY@mek}i)sORuY}cyx z-QC@r8(zICCl`v(csFb3IEE>Robq<%C;{Vx8_R!dW}m8%4;3K~?x7BuzWhxa?$-0) zp$}PQY~40iAc^{QyJD*0k>91@5lkJ`d3su>u1eKZpo^Ck*%xc)(L6N-%Ya_!0g#!+ zh_=n2$`ztYq({1_poFn7k-UQ#TA_| z!HdN^=n`=_XFKqz_NPo#neE<=w`h3@p+9f|X=%!WCTbA0gZ3Maz3^p)mp5iK;e)k0 z*tNzU8MSw|Iq2u>Z?v!Vk`c;5%z7k(VrpOV0r?&uvc53ZFdevD=!9IV3eBXA#0BWw zSD*e^la>hDLMKj)uF$6GszOjktS%4RxpeTmZFoHv!=*KQGGZa1mLWW~hp2O+2H*6h z#=gCfE646Lt-ILRWI~to*pr-`p79CS1f8bx44vQ6R7X-Dh!FHxA|{i6nI>R6Zu>9s zI_N;WwuQMAy#$hYH;kZyChGX`U0q$guAcp$2MTJ)V!VU1w;udo+1`miSIl3ZTxw0_ z2z!Y;(R;~p(j!G<%Tu3NxsQlx);jQK=46pb21?h_FxY&M1W?Am5~^=0gT;;#0l@xL z_Q+8scbxlO8MV!|Y4UryC7c)rxn?X6)RazYT z)bF0a7cy3^W4R2r1EF%`H9=ml%iXsDh`xc47)C>BfTGXk{ffvGi6PkRuuKsY+)!)M`p8 z8ts<&tZQAbrWCq7fboJGS4G2@nDL14-ys+mz-0j%^5Lfm^!E?H-iuQM+V0>S%_{#$ zw0znIml3Meg>O49&t6olWpQ^*ZVSnc0#Vc1%VuL3Yt8xnVAJ3o%_J{+mhMJca0Tdz z50t)esxpU}u!XPwPQud;j)(i9?V(DUW%is+wXcNahP{uwQ^gB|S%?uWC$9EKsV(Y6 z?vI8P4Lf=HF41u6@K=NIrbKPO@m`Zub2yQ4Xi@bz5Y3j1jn}|b>xg($)664$PkO{V z9m0NAfh;nGkfr!8{zp&uy0t$MEw}plQ*W2KZ<(2?y??_X!vOk8Y%vzGWZ9GOLJ7n6 z(IaBmiWb)gvAH7c@5aIgyo#8ER!!O>B7E!5Llz6@4x5AlRIuFIy*a7HUg|>fo*)-?-c~1HK{8;UwZ$qO5W0A#WGd$UG&Z-x z?$d`m`}I~S*AN7w7ppFPvkFfVx`lg;VD@YcjDw}f8@+-mj^=evrU5cxoVadgnW*-S zn!W>z@VD0|8@B%v?wcAMF7RD#sIdp)$uC35z5c`Kj2OsOThHO(1dyS$=oCcnV>8s% zklOF%Wx7G+ZH0U$z_i3n#DMwAa~3vS1AajWc>9`IIIy`4YXZ+$LrTp+=En_of>ONTSOpCmgYAd_*qRPE$A_(KqniOo!4ICQ zg7>c@$8%@vP}jq>x~Pg15@?^{E>QMCUcux6i`iHg@=nzX%H)0GKjwFo}7?VF1)f z6dau7=3mzXu&n?gxTl7E6g0)cztG9me<3Rk-CsqOjJFBOt9tuLT?_VBBqIz#Tepi9 zsl`Sz7sOL}>eXfOo51DE%|l@~kEV+OwOdhyFw@~XiAtb6HTBV2VXyip9u_!x-5Uf; z-cok%pv+?H;i7SnPe$JZBj&fsHDx6<{t!#5p0t^Q@TeGfE;0x*+Ng6g>&@Q%Ei4Wu z!`%H}d3sLp_P`#$aIamR+WGHNl5!>>>(0T#M^8Pk6E(tb4+CN%!oGL5+(s^b@i#wu z9`-g?+rEcsnft1-DF_l2(gvovG?o1q_SWh1N}tw!@Y*qfn}kuxswjvQ2-zsxKdOwR}c4 zKX)9~Qe)7QzBe`^O=sl$CTYks5F8xb;V$yDG}T4lC!>hYs%c8c;dLqde?@I5bY%JY z&_W(a1Ui*^S?{BfFUG)9H3a&S4+VuUB=lst*9m`s_uLznJPwWwOG+b$k^uFZzN#nl|#}FMpS%zr z%!TuFTSKK!c6T5CJ}@}6b$nV?&gx4!iQ%~F- zDrvRz0sCPlJnlV`#IkVf{L0!QQ}m`%MjSX{T6JXo+b7jOB}eLvn@e#%$#sKeb7l`E zof-lD700q-Q27mudkFMSG86@gi(*5lBr=nX*Wr$IlQp{p#^eT(W%GqV8kE#8?ST6F zghctP5jW`)9OrwS`OvSTGRaI(;`vRxSTGAQ1ni`bm4i8vTEQH64Q6HEDe#b5$6*Rl zOOZQubk1LH%sywv_%NadbiGYvc3dx=**Zth3Hx%0WV0CxR$Tk+aodc#ZD9rAn(IxC zIRg~#pY0`}VAi!O8}R*4aZ#)Og(r=`dkIK@y59x;Hiz`bCE);Ee)NB-v7QSTFnpS4 zbGvxk-sglaPUj~wXO=3hbGgSpXiyn2!mFEM^A7ni5T6sO?BN8^xL7og1xjw`KTvEb z<01`VT05&=##=zCRHm&oW@opOCtL|fQCr~t0CI0#q5$X*zePk#|JsPH!!-i-?X^>Q zkQ=FQ|LoP87c-<|?BrIIO%mCcS4cBez^hRPe^gP!1$out>cF``IkpJ!^L?u`<2@a+ z!oDkf5=~1mM=sGm*52HXVq#lV=@4zcS4^ygJCMgNJ>f^~KYq0J^m0C*%B?BBehnrq z8-$w(Tk~M*^7JJ>lh9W4BvqzU{x)LXJ^mojYnR{`Y3{zpEyhM_8x3U@Xur8w=rx3G zM=RlN2f<=_$enDELZO>&Bc%EZ-UAXN1)QqW3s>{hq{AOE4EfzIwjQ6GzgQPsA5b~W z?tWJMwka9hm-k6nR38%3$WS@r(-}n=sKgehA!K-dV`q4G?>G8mXB*x-{v z2as_-#u}F6ME9D7iV}!W`pXrF?fr%BuW)A@M*K+k%<<65&eq!*I#QDQbmN_YuCY}5~IA&J9I=tM?eLKvJ$q^d)P1q(}ItuUWut@dk(5s7U<#jkG5^q{t zR*csral&=!HI>C#CGk5)ICNQ>&5+u1P%ePuJI9CUaTrXC92}Y+-8kuTdc<4zQ1PjZ z-SVr!e#V&07@l0^2`9X`YVndKSkfJP zZP)o}{V4Y7tdXINl448ehM7iAo;d@PJ-ur43kSwZ01NH5gyG84+Tzyo{}Dv%#1Qbcky#^7kdLg-0*7krdzu_VWtGMx zTkCLU3?6(Sf)}#-AtO0V*n7Z_|}pX^W`JeWJnTl2>gFd`yWP&$K->FDTepS}uqxnAD^ zjDP_gm=-gfdOx~BOP{BDe_;pLw9>`}1u(zaY0eT2Yo&v>7RzI?MF@w#*4s*If3s+K zwB;T{kzE!!L1R#D(y!7hIf_N#g}+!g>o7&Tj5CGv=;iNN@pk%6rEe=pv774*VCQ&L z7?K)$Pj%Xc`*GYUK|)r^S7Y;{o(fvpc{X~z^nU~C;q#zl2)B7xjB0w&wHlJs4(%8V zt}c^K6)VSjl(@KSKo8w`?cRUMp`S}~{|N7M}GL~3q zaAA+?7`*HZXN_;T-{92PM8JC${^-o2JtO(1`}-d)T;5B=kXPy@+kaI1ugF?MuEk^h ztzLJ?{FZA5=lgO4ZXlQn6RY?4cy;i<7r0vSf169)CXwUnI@n^j=D@vXY-C&vY0}{2 zk%jGo)g`J<5Z(q`Q^;lMm{d1c%3J6ELAzi&!X`XM%O~b>FuvLqj(!G}>GnJrn7! zJ&a4_*N%tEyDexG`AegkHRw?`8ow~|kWoxa!~|EXV8!goF)GCeD?fzE)7@-^8(3a4 zGed`QzVUoDrFxRs^=@n-aI|cTuleZAFQm9lF|}?lys|{d zyg%$6oXAUeg}k+T2mNdY;|rpFEBvcY>At1qjgr$e(*|IDR79&3Z#H$r8>V?=DEe7i znE^H8fo4o^zLRs@YmJH7jn`x_9-L4Q#!FjYCbK;~IUE0mGTK?KY2!pxN+N!5z)AQ^ z*qbmevPnxT>I?5{xeaJOkoaqUnV<-RjYS*lTIC13bJ+DbzVddxJxP-L^n!#Vy>WXI z0RJDTaG^9be`kyM+T>QY55;>mXa0{DeO;WH-gWn5$|9tLPcu%gn z9HE{$4(8uQNzA6_O+^U)4+u~G11=V7#}ehe$_7v$*u1tl-=Ayl;N~qVy%d3C$WO<|2DLBo`IMqyNn>dmxkT{Mb(%0S?cYsO< z*{dsjRVTQyzqUQCI!{ySs&c?A!(xp3kTBD_)XHHnrHdeZ2WkkVo^n7}f7c8MC$(a@ zLDgnW`e2q>UI7=S2!>%pWmJI1lRTZu9Qef35n@<<0-Oyw2!R zE5zk%RRQ%-0S}f~BRSVtV@0Pha+6wPU?1*9GXI-HI{*9Qo-VgjT}#<^$8T($$G+l+Tzi!z98b{A~l=5O=%I^?-dve`gTNSpKoV)2Ge~hay zwVN!Ep97gYA*z=H0o0lgcmd^!OO3X2CI$@=-TJt%egY@bs&dQz*2C58JH--vAn!l~ zhI;Eut)`(CZEF&?lxy&=C8t2BugKHxjz9~Bo7;%J0jweyN%S&y?jp&gLW`RtYk2?L z2aKiSNm(^wiK63)`jf+5UQ#q!9!D-A1Hbj^qo=26Iv$bMYe+o-9~}8si7|vqv%(hM z#(XxWsPfvm)Nx0TVXY1a!P%Qvcq$rQKGCl5{~&iF^aTc#N=nM07g6Z*0!Fn_&szgz zVc=;}xRDF$X1}2|mBg?IqHq^>eA`}DABI8hcAx#|@-0!JuaezyPt;UgBadE&u~_V@ zc5=gyMitY6LC0{bxX?JnSKJzCUhT*dRBZ^2l~8>XH`Y}L!24-oHq&MODY$-K99fsP2@`&tZ}&hh)gq@!`Nds1h)J;{RJ z&c`Bk>4GXnw zNf?eWogcTGsbhN^E5VO@mxcm7XHpHG=vXac{ym7--(0!)4E7OP(4SXUc3y3$H`@K* zw+85xV+m&R2>c%UM*a@FaNPvzrQe-&U@HTxTsB=j;I_0#2qvql?yAWk6uu~4t1Sc) zu<4nQ8bJ`cL?91k%$`O>iMzq5wC~-qk*W}~w{_k4UyS}!gO0oObI8ZR;k=qa{(^xL zO`TAgmM)G7f2h6Mm_cSXgGJ0RZp_{Qr2!jHk{!QTJzZ8M8MG+S(k%V5+I9W$un<02 z3^<40@wcn+_UQNFpWgHIkV?V9ewm`tC-!=7ZP&U2O%|QTCtvUfm3>7Lg0A+3W^N8f z*$0|bQ8prWl=WQMr26mZ61wyoD}0M9OCpOs!plbuRk;T=OEAS06 zZqzH;F^=kU<>GH`{(j02zjJ8Tt<3^ab$@-nchK*Ncwnbz1V5QkapoUjGI_KBa53vweuAaax1EK z$@7^Rm`K!{)PP`k7@*F)aH#wsLIx+$@eCSDFmMGV@v93O@QJdBDGg#^HPGN2&C7lR zoYV@k4wXd);npVcCNHbtwHeE6YHQ;9eg^BWETgQFMLg7L4`abkCmzBcz>X)NN10|3Noj<-mUU%J zEWl8XUj$ZFG%i?V&6yI>ndoU05>P-9cGp&RmX03U*6CN1@brD5lznze*ggoTkt9SY zIGuiL`r;z>JtivFg~VKl_9N3l=Vw2HPO9S);q?JBP{2$DvfpQwiG-;!# z^wPf~q^6e3Jn`oXMbQ3Yw-#(#+2|{_Ij#SdN|Y%7h$TL#ij_ELvzAFHbasjXSJBbg5Pu$+wq? zim);2)t(1qt>d7xr5Gt9nj5K=Ceu}$tPkBuUgg$n5IYWoHvO&5mr5b$syy2Xd<*_b zv!pk)wl$7!eJ$fj$~A6X7*(-~{lHa)qGrRjx5lHz*JCNW$B&bB%QF+t4*C%b4HEx^ zn0$FSFlGu(9t+QzpcN(x~80wh(391Ve@qQ_YwCqlwfvOe(2YC&>u z&ie&{oegUiFLZ5)zeZhE@O{lHt5+0zw7Zr=@Ze5=6v zFHjWb9}L@}d*J|iMzojw2=efitLHY=$U^&Tai{-BiQUwj#t z3z(swcz_|dQFIZ$T3rlBRGQG_B)}%+`p*|$yd`bD{(iaPEvinYnBqm1EpxXQAqFPn z40gsJvJIWhqw;^WJ-a;!E}#pCDQy4_5y-Pm*8CAq$l}g2a4K{%Anz(c%M9GlywXx* zzd3~~w#n;culokT$;{AM*i$rQFqv+F%6l0fjs5hhc(>+upKKJXiL=e^sZMMRZh|0J zErm|4fXrF!9aR)mKnPACV6~k-^p!AV*OoC*-6Q<;+maLlLX{D%1%X=y9M(_TEn1@R zk!aUB*wKNG)nwvrEaNkIgyOIFYp7HlTA52?)m&#gd~!Zrtv}>~=*9ScCvUzAGDTFH z!gN=5Dac8oz3>(pmr-lu*?($Q`;sFbPu5+_8#hYEN4&$!b^*FYh>^4_<|HdMwF@;8 zsMlyRh)DlzN`c*}=AOsGzKxw2`UM&TAJ${~C(19bfKL)Oqc(Nio{}ex#n6m}AcvqL zpr^r^sYbI5gJjKaZ~E$msn?KJ%hZ#(~QZKD&ag z?EQ~2PkR4z1K__F_3hmBzZSI~F2!INh`bLc0eP5gU0Vvb?HhMx*3~COXYb+tc!~N-_K7(+XEC6U9#2OtxWlI57(3#kRS93c%b~(0g~(g%TN%uMBF_43*^8IW9Nbie^iJ*a|lL)+Ru^} z(|2(A%D$^l`KSobR13*To|-4c2K0T(ru4V13XD*7=Ex9v*X;fr+xf9tWBf)YYU$ae zY}MvNw!EVT=_y&orjDM}LI!1QU&%#W$cXivwbzZUuaAB;fpSR$LW5U2nU@|90)y(E z+A*?ANCXE=aBK)s1Poxk%C_ZG84gxH+b4Ilcpy6yxcI^e4RMd|piJG^#Mkj1WWm;* zp+q)f|M{Y`a6C+jBWhV0qsI4cESH=tL4onodqq1n(0OzqVK{P=g*Jg{^Vk#S&lC|3 zl&ufm8Okt<_;}v>ezUJ{&@8vdDBdw^Z-gXJs%ec|n*UQZq0PrFHRM0KTpKRGasFqd z^na9+f_1hG-oqhdZQ#%E^Vnw+F@q0Lkt+;lhxHYT-{>P=9Y&FR<`UmR3Xc|l8a}}O% zC>yX+NI0KBdF8tpmi-xnk7KUfW1zju>C1)!f{MLsG3_n2IJ1iO3B-FgY2c!Pd@xqA zDTcCc53F57Icji-`9Rr~8|Gu%98TOp(Ov<`U^TMa)qW-B&q9~VkW{ebV=5|wvoybs z@miKqWBI7TOc>4^`=T}wW^`SyF`c6|@>ci%H~jWuhF2Tsb$Q!HIV`>-X+5Ka)PUR+ zsrY+Q8m@bHm^78{uA<|AsviOO(YGMTsm)bk0ngXw233~2k8aM^e)bHc}8 z7-cDBf_^S8&RGXb*%06u1{1M4qKS<7m4ZdSgtfEzibSEx-T@OQjy!>!A`0R4XDjJA zBS-xcP}W#O>ne>rLLLCr(LrcZd&SJv7`2R7ZDPst0nR1D>D((5e7BaZA}+Z>Jl@W3 z$hY}^X=*qBQ_I7^5ZFdgWLB`v;;Y^&ii-t97iDRiE56T(Lhxv3sBf6&4_=8abk>^P z%3+ojj&lK|G`EavXN@_Kaj%`K-1vB!c84!SRdF`{AH!Dn@9k(iW-H-6$T9-nk?@Gd z6R3#d!t*FA!_jWyY#+x=10}i8UyHSa1FalXc8PFNU{i{AF=^-kud-~RYw=b7f8M9| z8~P~V@S!Se`y=Hd%g9=#)acUWE3*qZ;OzCJ1>vZF%k($red_=D(yWwtantDG^S*vc zyihlhqNKuivOERT^0%GDUuTamYii;YyB24ez(8 z+6woYIRI3MuU51`R6BZpt!iReCp9KR_?`GV40aF6wr*iK{(<#6FMaz&!T-N5og?4B zWFAw^Uk=G|J{WMY<%@0zYQdN>u(9l#LFGb6Q6KVy)CoXv#p-UohpXrJu+4>fF=0%? zS@Y3<96VFTS|gx~wo{Q7I5}6|HMH`b&`tjY{y4=yS8hI+)seJPt2_DekQOPxjA>ih z{*8Hu382^kBz-vDc-c-gdf(Ry3qx=>iy0Co!5ZnlYa)P zG;UCN#qHr`V&Z{ORjP8kwHi+eq()lhzY0`xT!yubsM9jU`NXo0d}UZ%hdFuaAOxfA zeJf3F6yq;E9ZRN$0I3lm3CiGKFOpSbp6}lw8o5_FO@vBN#an1qF=B@87s^mIf3sR% zBIYwETRq;Tf<2{*Je-C?RFeEe{hU`987hvxc&KowQ6~P^3caho*+zuh2f(acuymjS z4lQ-FRDTk^KXTQ45pMQ&^=xGVJo)wqreb-8h{9)tz{e#b4D{w<+@Iz1kH(8DM1!6> z78OHh6iaK5t(LESn;40Bl2yy}yU{`UX}~40^x$l7%VN*^o#ljSTQ^u`RW#%y(vrXM_KjKC-3=_H1}N~ zHi8l(Vr@_C4ucBq@MwlTP{+ehJcG%}Y)D?6Iw~`YV@`6*XTLz7)nnz8s3H9{jL&Gu=jTtJzYH{I*01o(u4}s>7mxY^sM4f($ zjXi&Z&DCS}N#FCOn;QOuW#|9jUTUxM$qbI~`4*Jua!G=zs(7hweQ~H z)~P#9+~7CU4>k3Rh{;8Do8P!bO0rK@;}x?W{r0jS0y)PHk>2D`1*pO#9#Kk7v&|hp zwAhLRh$GDVV)9r75z}xFw0TZEoqCwsEoQDRufWsGkK0RT+j~Qv#1_1Gey9ny)=5RtH$$2p!Dt$qn5paw@!)%y+s;^KsWO`!zu!g?gT%e>C-W_J(3|MWd*gO2*;f<2ZfC)P$q_1OM-)gYzXe+Q=TE9 z@~^c0;>PO(jC-4)PGvX$#Ci6r&6p%f<4S>8#!X*$ei_17x~qnvOB_xE&p|H5H!9sV zjBrr)E8cHV+(MBQF|6a6^1_Wvfy{Ng!LI_kzDCShNS6F$bCFJ`^W*E^#`eKOUr*fZ4 z87EwSlYRH3C2w4DSBQqX3VsuevE0%s-2#pdw6UD&9E~X{JS=}(^3Ies7n+`msWWV}H3}(|iu1g)IE%+jWIWY$vFIO%l^yaTVIP-K$hBTZ5^?Kvl zvgs@Zy?tZN2Fl()ah{Y61@D4n3C6p;u%ss~y+vfgW`ItO+FSafhR`0`j!CC};F!II zXtV8v0LI{CXCpzKq4@ie_mbX~=@VYfXmXL_n17W;d9Q#vK3GSs?>)z9K z>g=jrwaY6x+j*3k{HqP2`$+}&ajKHgtEZ<8b_{9v*>y9ayB&t746Z~7xx8_AO>fCz z%ARA_pFR!VB>`PtCv6oRn-kaif}g_j-t@GX%DFwavR{oM6f|n1nh`n^ekZ&Ub%P=Q zp;SqE2hC%eBMd82*lGV}?YN=8mE8f`%b@BM^dJp?m2?sq9zH)qI)vE#lulAoB(f~iU7@@V# znUBA@uV(9$S$fi=xI}^SCso)*D$_1ISJNvOn!BBmPg7V5Q*J&rQivf1y>=-nkoY2^ zihS7sX%k{-eKm_u&=_<#%QdeaZ>6MU=?wndDK`ob=W(&Ilu0t(8{IAkpJ!Rn9U^O^@Ghb+Gern*r@sw2Ev1C>^`WCOZfo z&ZTM%Z=o}Vt%&TVe!hMHz_vBC5%IQdY>~;mfg|L^Y}EX=7jVRU&JE~D`|ERg+g`Jn zl1$@hOw|+8Bez;Hre!@V-irT_qm%5v%H84Q>cMa9UDcAfMjSY`{6tlZSq!g5PK{97 z+`}uh3-gfbkjv%0$7r)pT6itFYRs{u9Hb6!0}`o%MbR4m^$Wa(dyDMVY~a88mkUs4 z-tVHDR4K9@Jm_nyjIcfssc?JZmQh`W41q-#w zUwk7Yqe6%Dj1|{etX0nO>{aPsu4q$m!NJIX%QOUsXR9Y!c2;Q#0T&n z!O9;4)geT}8?F}`9V7)SkQb9aTmBYR?@OGHclR#KymCpbN;zFJ@Z z{1A3S{VwdUmsD+|TDA=l`Pc~M9+%s#MXxb*bL7Y^5AzDD)-tW#kUrIJ+_u&ObEzCi z9#T_PG|Eot^4wAr&B>FrRAC1C_l`!ue^Yb5_p$HPa~m14eXY8HT+zdRsQ=zyM;jWE zMt5>X>#JaQDTsHi1+34Ow3j$uQbKaqTt0rZZO)$ZQlrnNhwJZ89y|HHl*^@|_seXg z_GvGj^$X4qJ4+V=a+{F}jT!kZU z+w&civG!D9{b9@kB|SwPkLc~+I~Z}yNG=g@IHYP$d#LFT64t_a!4Z#XoXqMx?C1IA z0o6e!RJ4>zp%{qKVXJqbI5B>u*xe#@9P@iRN6udpW{2hP2{-sJ9nrS!z8=1BC*X2h zmI=2_?}GZJ@~L)A+w*l=^mV0xlFP$tofdA;paQTL#K0Q}0gJ|EkUWN*pPgaXzXzvJ zDJUuDbDwe;3?c(!0jK*()UvB!@>NKep+*>4holH#^r~`34}B?36#(0^C5=X1I0tO~SI!WBdGL8w%O|)?EG(Fgu|59Ft~YG1AO>MOW^Cq9>Z7h+%@u#l>$RBD zhokim5?H&Xi7)Os$Ag|`6^Y#z1a+2q7Do6 zm8rk>pEBo3A@lAnOjj2HPA(t5Uy89%^_A$BLR4%+fQ^wtEgDFzU+@&V|LYfXJ`mw# z(L%%r<_ALc&|D%IHb_ZhWcM--3vy_ZZ$^A0BTXw)qrg9stcNokBDWTO5ObDDDDGw~ zT!Jy(>B0H@}lN6>S^kElcXS26(?STqwyM#HBHF zxxfn}HELfEkNbfrtcNd`=bnI`!+5$y38VkYw>Ch*>(7mixEe)_R#Nz3#b&sM1Fn3z zP+Fs~WMbMxN;BZjQ-Yc*d=uq~T5^%NSam8+I>uM6w~Di0u(MS%Hn`A+MWKv5#`;B7_B8L~Jv0k1Tdtk;wF*Kl50RK;)zuW0KPE1ERAERSvQi_Q= zjm$=KwhL$l8#yGjDB{=CmKcL`J1fq%BV*@Th42TcZnWDn11@Knz%}?y;MPj(Xv3Ga zvT*|CTWC6{Q}Zac+w0;`9hJ-h$Qj5ExXgO8Akn}VeG@*|(-t5+ z+g7XB8Yf&05N{cZBMP`%ws3d6nIERtfHx(V0vpuVAAT9GIHaL;@E_SgxVvBOeJJ}E zYK(mV(d!@c2_K1F45)r-n%MLM1_aVeSm_36aq4e|l!hr?KDfw~d}j|uvt>$OxP-H@ zh4-B5rDnfws}dKJXBw-Ud=D#pK)LL7V@DX+)K;?|9q4b>wa`La^cqyY#NQE1wD`oF zx_0B1^PV~jH5#UOZYpef9mNAaEdfd;y>z0x=C#|zDJUg)Qws%E&6X`)sm)OPNq=C=NU zK7~ZDxlm!8B~zcAJo2OiIGai-ThvzUaQ|beoB2$`V&Y`T%BcBcQ|ESli|VwUBKWC# zn9rsS)EUP%BUzKgDdoC%S2C6oQk>H(2)gDh{OA(sFg-t43~k9*;S(w3=s(v8mluI= z1|DIHG4wSM_64dS@0iKiCXw&=W(h}E5|j8>^Y=wB0V(Dp4Df@_YAbKAlkyrzus*pq z?8LdyQUYJ>9o9Q#Dgv%cSwZcOq;Oyv73uck8CBH`u|@Z!+8DK9(ar?x0~*#C@mvB9 zfM??gGZtqnu^Y?+gBr0Zkb41f*}flKwt-2`N3UAH-~;c0qr`QQsBJ&K%q2=cOr@k# zJ=lKHh<<>Auj<(Cblh>~av^{|g$gVuX2q9ow&NBpt2|u3e_yNwb|!x1=F+ z4Yi2s9R{3trrlxt1HBNW#z&@kDiK~hbCi;DDD_V=n^EV3G}X`=(gcyFi|E`t%=Kp} z;u0yvacAns)Hxi&vrHoZWf7-o<5)Dhnvx<&;_9Tl3iYJz7OQPL>w-NRd0A1l^r+{D zFTFm74AHo#mSJqCBc@lYf@mwJ61X8tyF)iSy^sbR`b%Ld zKON(!Dt&EEp;!ceq)XvQY|d`t+t>aa8Wa@Ea0Q5ZI?~cPYu*g(?t*&kRQDyA_w9y* z!ajvy8z7=Z8PM=v>W6=t^1R}B>?Z>}g{sM%P9?lRw>WGJ7L7{y0*#ar%82|P;FuJZ zcK1kQ!7+gz?(PfAiL1Z`uE6`f0iJ@0L&Gn2$DT&OJwSlm(n(}RZ2*clNQoY5J?I0h z37h7Keq59Vo~Db5g3-CFlmo&JEWx}15`uv#2m06}ArcB}rI`=jkqNS#G$Py)qpZ1= z4OWZ~qkGJ(MmK-qcq4W^#^hlgmx>m1 zSI_1O@db;pv=)%NYp{Y%^Gq$emfkH1sEP&c)OZqFSYbH;h-Vm& zvrW7~C^UNQ$2``-BVW+CBI==*o%@+b+g1RHr}@}EJk~x^3C&HG{2jZbpsa{DnZ#Jm zJh;M`4`YY4aivh3L9L!}gplIx$F{}ht>lVcbJsATfR|IJlHxpgL>=mBi85EZf&!hB zDwJl}6ScrVThZ5)D0{50zlbBgTK&pLx4Ac*j@-`hsSx z471i+?Y0I7MwsoKYyw)aznf2WTLHcGKsKTt1R~c}ZdujmSw0S*82IcnCWmuy;51U! z6cA!s0@U15xB{-F-AtOBL+vv%t}=Q zH`xr0?YisEs!Mjuv36re^CEP*`#SS4tUJ;x^hYsN94kA-%tt^!E*YOSM=izn5m!OE zryX+nmth-O4Y5cqu}LPQMPgbO4QAHUqv)?8IZpKgxOb`ZnJg@rH+e;B7^ZUkxCR00Z+ zcoo@N8A|@HFh?I|RLHDX8?~H0oR4N(7PFJY2&Avuh7*R;JeGVMj~WXaDf|=augMZb z)VRj5peLV)%_qQ&^HWb^lDFbF81MXhy{bqygABxsnogh4$UQsZy04&+K4lwlP#Lt%O ztzI{SpkiLUXDq;pDSIq?%`h4LjJm1e6810!Mo97!stH?6!sBs2iKf29g83!z^FGw= zzY#+*hz#(iX*kXU)eSnTfD6OqZNctj>!nTj(s(lw`OUs?wW=o;cFP#!b0?91sT}~o zCun#%J)J@wX!lSOd2oi`b#{W`HP*cRTA%$ zV*xty1C#B)SeIu74MuRRM9QL*GUzL?^>AVH!yZkS&` z>papJ-4-o7Q%BIQ9E3k?I^e92_ml}gX86rjudu^=3>Dh&4csLoR2DT`d+GMpfChxU zlib`j5Dv1&ekR3L@SH{_i5fC~sx)|w1gM`rn;>%J=sm2TzpcbwTT>>{O*zBw2Ulb_ zuK)OcNvgXl%uq&)Z9SMa(jI$3x_bdGRufz#e7~5b9gBLrC^4h-u|EG7Khy|FjckpZ zNh~P$EYM)k0G=k!5e$f1p=v(ri$c*FKW2GLs!W$e)7TxK%P9VaHN?oGFuFxfJAFvX z#=x~35SBKg4PG(m6p}jHs3Q)kUmv6ykxN zYT35GPBX8;7u`M1(br$K>v=P|-9|FUPfhI+WppVx^#~y-uWXpZftZaVGWzka-my#k zZT8^F9qg3graXYO)q>@d&V7)Y@>R(u<~Z(vgJ zqMV0GJyCk4^zEmv?%M*S0dMDTlb#NXGQr6FDVf05oY8$=;cr|tcXJ0*irt;}hE3x# zA@e7t%tY=ASs56;g=AT8jO@0UBFst2J-rSo)$R|-yZy^R&MpXqu2`kXxvFYSm83yn zABBT}Tf?Kh(A)093}|4zOy(|-z5y`=S#$ox zXZ_dY-y_>ErYW1Of^fUX!3Y1;Ek)7!b1LGf^E#{X0HG@~HkdNzo$pf;ijwc{d;(A}DEE^N%Z;-4({iYCavpV?H9 zRe-YGbnt=7S#)@`01s)Pgn#j}ZQ>ve%bVGi)ZYQ zJ#Gt*WFO|Nin0Sc^RO*Q)La-<3@EEpANXOJcCPJbgx|f^dhiR1uN>GnE zZ%5GtX{;N!Wix4<`a$SOXjAZfu5={V&J(o_JdL9=ipx~iUQB*T(oDh{@~pK#yRg47 zI6?Y@J4SU2zM4o}aUfM%Ngr@|d33Y$7=stmkEGeJmjDI!fKkaHIRv&-phTfAqTakV z;1MX`A^*MMc`CLmJK=JULbswkEk6rNUt>{@>bsOZx`}4BQjTFg#^0NP<6o!wLh@bQ zM`5uv1rq*XJ*qu%kh<4@w&mzt4CURjaRn)rqcUM2onks4@~|!_BC^z9TZx`UzCETR zKyxEv4=MYzg^tkDJwH6;e zIf-C{(BNqdm))#2%EN1wlki8}&6P2X00@DDumi&f3yL`~m;Z6Gg5CHQRhoqZklO&!h%5_;pWa| z+1jXariG4#-$cc3z3V)F#Flp#GQodVBG$~i3f6!3Fl07&@7+7%|4C)KA802!4 z;wGYz3qi<=7`=SasqIyjmtIipzTgEZg+cKU5-l3IiX zCadjx$~x2AEHMshkSp4pYi{IxAsxBm;!^`ZH{0cQJv6b1zW(%^chju`?U1BEvsUor*rOkO9Ab2qI=Old^oqLi;wH)H!x{Q>0;}qa-3~3nHNd1?F z%58L=bmAh)h{@TtMo2VavjxD91~ny3;|S*d)Ub_(4ku4LpCyWwS5xWmAPxCyRdM2o z$^zZ5Dh}oW--N)3mLsSJzbk#tsFF5-qHVAjiVi8-zzgd- zvw5zRVsae4m4+7H)=;&+3WcatTl~SzmVmp|RA#;LO~S!GpNQ2trvm0$RZ@SUo+piq zoox67#{lw~9_c#1%k3`ND>WKyAC6~QDmO8YB|>WD??Jy{!%;aE=o|#K!GwdNnY8?h z*z%8rfEw6BP)u~tG}XN&c7NdKO|3;QabNVG8QLJ};^h%j^Z}plhsTTe6QQ@YfG0#? zp82CSb0joh$m|<x^#=9CxCr@=1d)i;nUXJ3-w2oxQ^T*g$*4c5=CJ7gSZINg~2Y zCi`;_30(T{g6Z)1Njl+Q)Q4S|PS-24GMebUX3wwf*hVsO9DF=~mjC!XY_r$kxQ%!f=jK|aigt<{Y$@n3KB*B9ii#GQ+ znShU~N!rWQ4;o`E_}KB|q8*SL3WjTm@pm~;Mc5GiEwg4UHlS@3j5pAlGYdQ_&=wcQ zG?*02uNKRF9=S6!1uDd3EsCEO-1FR4j`!5EbKzNo!BWB&vX4JA9A08s>rx<$Uiz#K$H+3#3oh2Pjqy0wEz$eC|0** zD~qx;-&wXl-z^y+otUE(@O9e`ndTW3AgzA4^jYK~+q!E0zINNdE+|8mCAd>%Yp$b8W;#KAPsPAK;UNHjI zMuLBc02M3XcOj%gSm~HCQU8YGffc75jz~#TVt}<}%%+oHEIzlMB_Ls_RPBUWHPUOc`_u*3 zI#^LiDj@JDc^xGh=`QM>OBSztEyQ&GV`xMG=8y$j1cZVre%yjJ!eW(LU_zj-36 zPF^pwi-kMa6}6&d(`C7MiTq~NU(N>2Zb+fS%;Uo1qRNWkq{`Bf?=3hT(!{JgD*SgN zc1nB%(FN(e$)H`?sSW-Rhe!OG3ZLbV2v7D@W7u*I44Rd#Axyd^+@%s3O_OXSO{rX6 zqo~~~neow|b?}ku)hE|_{e&eN*B2GuD!mKWHd^c8;+FJmv6mahdIKuIhpR#fz&ffiit zf}T-DAG3tC;|$U+?w52su%qRsi0>2y~Myg z+I~ygJ8`aHBDgAR9|`46b~#kK@9L#RW??yN@JQgBnpG{G;Uqx%cxdgm^Lfv9RsWt( zC!9S^c{^zkd6fJZ(ir7}3HS6SOX^OcA;Mr>WC(~Iwb2%yX%f?%*AP(}NFgyo3JI~vpbnJ?j4*23sAe0GO3=PoA_|dT*6MtN+!S}G+-cv=G zmNq0q90@0#x}ou??>$;e1OsVsaPMKnZ$E3Rv_Q#tdI zFauqID8g;2fn_B>oWaUxe}gpSZbC!AO7xMt#!&JHG{G$(3+nHhn^~sY-BdkPmU%n* zD8B@*I(M3>q4VM0;3G1S<&$Z^uD01%jK4aYt+Lu}M2=4B#5G{6q)&aD07(TX9 zY9j9kndti!;D~Cjez(GcrkY47oznYPOTq_^`HO5TaOD$7ZHDDNBsTD!Ux(wCe@e>i zYzT!PPi>Lr+)HGdDg^k4DarqbmI+KT{;@6a0i|Of`?WW)r(!-ay(&)d>F^FDEa$L+ zWYsjA}G?Ul%jW02m zsIqJhkGgK$c=vClV@t)TRZ6o$9KAOBP~>VlGaap+Oam?Pyfmqj?9I}{z4g?+_erxZ zYnReQHJ*QG*YL_P88)4B@Qd9jHS)b z3*1^TqQ$>-K-#RJQRJ`w-_^k+nkO;Gu7p`E(rpkE6bILat*Y=J)()5bcfr4bxi`AFP)V2A=MT51it2hkMNez^fdCYtbV zV;t7nGwz@(f%T1z5HZH<2(aHs6;2i`eRq%D~7~p+va*nQI-z7Q<*PQ7)oBr8V=NjS^9hb%Kj~~$o|frLg7ci z!K4%m>?%dj#!x;nP7Ge$XbqT`aFdpN#WzVYM%-b`m?|ua=Ic>-CT?imQ^%`Scfsy! zbM>a9PuMY&S#RCLF z7EG*-1S(}$n(RD6nx?Q`xp08#gzHNtdEoE`h`g#KiyQDdgrkbcp+b*f{ zvF9hki^HY*ZY4k!Wb^JX(lT)E8x!{zJN%U2s)qB7xkuw1YAAvCC#a2ynn?O7tgL7p z_R5d;D6SM3uw^*$IgjC^#}nT1!?Yth_L88JNs+T7(^NP z0UwTVUAO~GE~y~HfmIc$%57si*(*+y2eTXhZZ!p{xr!&w`MLUkq7jTb`973$l4^mP z(h^*1!OCD`$}nokg@j?5x(I2ySb}+hHaZSvC%}NwoNXoE-8RpLFhkby!laaw8bq_R zD}JQG74;RUS44^jD;n`|%_}+dPabX0fLlWmD>}Y?R4?Jf>z8qT=1%I;>*P-WxpL*hYhRy;B|k>i z7G#zi8RBGSsx9Sk5pavAr1S4_&RtePhEL8jil*QxSX=OVd)pbsK>3Q#&{{Q}>t*mg za)F1ZTP7PRowY^X+h&effo|31OIn!|ZLnrA%h{I+E|r5PI|08jo`-(z*Obv*kcPN? zq774ED82UkRi)d)srUTtX#9HpMK#OlR{S5YKvW3w3UMk*-~SPVDh8Xrkre`it+XbH zM69pSg>&nTr1cEdL(wT&=7O1F_Ddv>d=2pY7QkWw2xyK-`5T?Y93FZ0o1HuMBz4PC zAjN9{*Lr1Nd;vln7owy-3-{aKsr?id&QN(JZ@DX=(HEIISyUijHr?G9VZ_36$Lh1; zYBnrLLe^J=>e1-_+Z7lCp6%@(43?j=6bwwRB8G}Mn!dojwF$iCG+v+Q86T=xQ*f%e945S~?(@^duhgfOzR*2}E&$7Ghz;Crbm5W^Ps-tk;9+x_ zMD_W)sy2Ibo-C1Tt*(0Qbtt>DzXyJfo?shic;LyYG;LleuUuGd_CC2nep@XlcfALi zN)k2k5|A$f$r%<0uDu?7 zqXL_Q0yCN=o1mS#Ili*Ft@z?{5Ju;ou~6(PR+)v;9b2?X z;}NQCpr3~E^YjgsVv0JoV|H@UR!EOK(oORz+vRLoEAWL*{NV`}tG09Yu@}-okYo00 zT3aJ1hR!-$I)h#rLwXM>l1r#c^Pgf~PpXd+2DA(}RL~-~<^>khjR8|rTO*JH1z>>n zhfec=Qxh2v>bWYLba7xhSS3&x6N&=e1`f7TJ+jz_}Y7Pft6j10*Z_i0o%JC|Kn4qpCv zysz^Qglsn1W$UOhQtdkgUJy$8{M+m21$sRF+-BZ}55%AyghcXRy_Z`g%f*`R5VkP4-?AYL#tKas@v)O)ip&;26isB-0ob?^cGR zyI6b*B~kT8#iJ$Cf#2k-0n;jLsl2s@vk^j#iwwTw1o;8ku$jx=Jc zAhtVcQj$nECjEf_0oHwpM*e>#rFNjl^Uvb-R{CHV>7Y2pZ$~TW4ZECG{{7ZLQ9C%) z9NZDSFQ^ajA6NX(TY+wWcw}#mZcRTr(7ONABk=K~CJ;f1R{QS4!@4tW1R0FZQ zm5*J=I{!fJe^>-iY8>h#<@^6X{E^uG|EuwT+D6a&)ViP4ihBwWj7a#9_%682%Mil$ z8^PEok#Ajjvyh_5bzrot_^fmJeF^!W@o1^_V3CnOHEY44s?>)>5=2BsK!MZDLR@)V z$ZK#Oth%iGU#xqak4&rvoVMJ3*?1b&wW)PDZ@O=*g~bPllm*815Oao-DnmvJqfi4R z@?h~5K5p)}a#sAGH~(M$WE~S^P3QHf->t*J|GaW3Vvy?mZ)iIVtRNc*z+U-cxJpGF zOkhvP#_Ku6bORE`h4*4dNmp&_cI1)S7--e1L^q>>h}BGhuitt$l@>eJZ$Gah;+#A! zUWonqTmx|s0_9aEK+xw=SCdO=C$T9UC_oZTg|6io@^X}()Q7mg0ICIXa16miNNcvh z$b2HYUl3<`ama_YMF2fWjEJ6?3kvqhe)(R?-v*Ne`O7gC!T=@11nigi)R=7}Uzn_NV^o@F4XMG28ET~r>2DvmSnN2O1u69Q0N^xws>$U(~ z;R9A)>NPa-WSNl?N|UDO8ZwGLb^(v3S2#g&y>~;cL`bD^0p|WCEjkyJTy1bo!ox9+ zs=xgWb4BIlsZwx9*?!&iKfZ$mnC#sfv)VSiw$0Uvn@e{qmf(=kPRxFsAA_{h{co~1 z=-sb=?hssj`^_}rldiWK_+CXsugn3u(p66G(oIf(TP zhvpEBm#1ZulfW2dr~5Cn112Ho4!Fy+1?UM4gYd+%oLBKU3YjtRQs7Vaq-uf2YCs(z zVJ?$rQ-!~Xt#<|^vU2Of7Bix$;_{j}0-TFj+fjd1R)z1Gje$?4&e|w}QEvy?@Obv4 zh(nK}5g{wePbaQJ z-7fC^FSyQNF^9U}pSvp$P;si&g38~*oW~i|+q0Mb+Dyxe+x z@IFNUIaeRDDkV0lfkff$KH&YHPX8)0;4v+r?aa>Mx%~T6xwDSDM-fbz&~u~Eb5{2w zp8Bnc(4C3U*>6F+m}~llPk>KvrZk!~d&6N4USm4?ug97z{jYgQPkFm@P+n;~m~-|I ziAa6hKlo{t+L-4#M;8l1xqS774S}x})5EpaU#5Lc8N*I79U(|d-a&;Jw;uw!4&J}B z^dCnx{hvw$o=Sa3OIrz61F^{g9t|WgzUcAhWxP^x*R zuMctW4}9xau__!JLBMOD&x}StC3vE0z2__6KK_L0;Mtevx18qJ1LG^4`-Kc5!{BAW zK>bGM`(GKN8y2FQe4?j(HoZT;&&PjKq07~k&iBLll?kIPp@DXZfRWXn5otUI+X2wO z%Gz(jM*oJd`-X4Id!g~|n(6(zviqqrj)2eoL}!Ed8DHJ%bzhIQHR+~xbd z-^RU!#k_@^zMzef~-Z!}nn5D%Lpak zg3^VRwR884Yle;M8KT!2UoDPgpU<*YrB?Hnim&67^=y$ZAFr2+>+in_-XdmC}a4RqC_I7)hmaQQKQGHoLqB>f(0 zgxl)lZEe6SMVfA~cKdj98Tmn7-b$Og7&c1hEYks#-;tbKf{^t3b!tn|?{I3M>z~;9ndY*Edf#Wmz`z>@ zd#5NptQx~}MUVF17XJGd*GaVG^LKFJPtTy;@$uZ1wpqI_Lia8>exQBh09cQ_UNCBz zrvR?YNxsXNDfl7nVoQ2alSUAAZEgaa3jRk6010WHx)MCi`P#eJG?SSn4JB|XSjbSl zFgK7@<|}TdnpXTquH2P5Wxq~6QgUz{GAubeF}65LhRLo3JiDIsvBdb^p(5z}%#BA{ zKud>ZLmRPk+t09Q?^f^apWFsbnTn~{m(YLbWb~AW?-FSahdfQccO5H?> z^X#Yc?WIzNa_3TK=JFl0Mntxc+%%ti+eCWXr0c$>drVbX`F$u_od1JzGucaKd(dK1 zSciyxFV;NFhZjCoPP%mQiLu)7{blN1UJ`xE|E}@E_keF>pR?tPCsf0D%4hw?G7qs@ zs<4`Yg#bHcag`Mvm8=k%t3iJ+JcjV0^@pPbeF{$>tp=&X@Lc6qbg-;7Mz)%CZEjT0 z7O8TDck9FA69;VQgjOK|YtsD7$6od`H798fl$ARk85Yn0!i`5dumHsamk z@u#4rNS+dkHB&OoqZw|?Vuy}?zyjfX)~6!-UCrMFO1?iggP8S*gc zY@){mBCiXdjps~Ii#gx{1CH#b5M3~#n6Bh`JNAWb||I3Ut8Weqj zYlqBySQi}fj3U+fdggFJC_b=?CD`WFVWen^f2mz){Rh$|@VV-D%n{>n6t7p%*Wg<# zo|n_1y4P!qkNa@xM0D?zD|BY?6Xe5%&JS53*i9GEA#V$?x?pF}p&+BnwI{xh!*G<7 zmk8R-@El|pMkDJO3GT27_Muh9CBW+XUJWdi)oCe>VZxB7?;iNAACO#`{6usw`!uwf zF^w&Y_?t#bwUP|YGY{S7BZi{SY3a&e8DIMI*?k-Dhu8zmUfkA<0vHx{CSL{dUq_P~k3nnwKZ&?(2seh56lW zL0h^mEpGkGAEvFM5K$Nh?XE8 zhBc}{V@^)c+~jE2R@Lc(Mnq6L1s?c>b!F6mribpY!3sZxesqi3#jnO?Ax!Yo8mIlKQx<*;7G6>j zj#^b$%qM&&55)>7d_?Wa_8aQf_1|>1_rAbQp(^b^TA&Q{6@{h96; zAm^5ey-{t_XP=(33-k0p>`M!s5O_qWgf5gHmkI1aPUjbA%_hmypG+E8R+^Eqg4Gp8 zj$Kg3VeiF?#L{y`>9sgWC)~u}mhwCinG{p>tcYQJ)+gkb$L<#;jz`I?XUoAi54*ZW zHpUyTi%d)J$zXn+PM{Kc9PvLnLnR|IysK&Px3l8-7R&(?dbBeJM9&W7`;=}NlvT@S zWO#q{w2*t?s=;=g8W)@ska#^kH9i}sr zHB(@&TsY%)1oLdA>vDL4>CEVfPIsPU$QxwZyyJ{SG}=n76@#k~^vSkAX9w-1dW@1C zzO)tfc-^wInFhBhodNrTc&1|RyDt3v5}4%I(4bgK!uFkBui^suB`f)Avpr%?ztJey zKo^A)AUqa~Xbud13n!E?TtTJ=t~H~y#XhlVSlj$)!rSth4k09m8OBMy9TL2&cekW( z_$KNfY#1Qd{`C0$-Am4W!4GFL@|0fWkK_Qh{>wI2l8E4GD#erx4>fx3u^YM3Cll6XH{{Fgb!M}rp@W{|8+v`sHNCplHWIUuc+gS=sM8&zeU2&EOpJ7kSiS~(<6tp) z@b8i!p|F;@q0sN=&vV{^=DXI4$zZnJ@2J7=H07uR=d@xCA0OpFa0zsV3w^cw=0WaY z$vsC*tuHLLQ~P#YtIQb3a^Jq#C6B?;{4@<^yg3_*K(nJY=q)$s@!cNVqiAT&D0k)a zO9Ig&ioA_d&UDX|sObzDF}07e$dv*D*HP`uXzh|h(FCF~W0>Hq(2tmg=fmfp7tj0{ zhh?*nE{!{;uqPnU$MmdCZpW^LjIi8Ccvp8Ic;7bsJ;?C_Pq1oo`5U&jE^-&!H$o}I znBpD-a%Nsr-9(Rl9=ZsWM%U+?Y2T92BAN3NcdU-x?h9moLY=&yw>sVP5Ltk|)yuqX ze~*zCTbIZvRH7r}RC`9sandPK^USQ_@p@!!nJNVGus$QG5*c1`M7nb*RfXJ`01%Ry za>*mmR(8Q24mXkKbaaw5Kr#Am&YgK~j$R`7)2e`~U;S4;GWl<)&3=MsJa_;56psOb(7iH`WrCQUqKHwjpWW=PiQIm^EfV^Bqa^ zg+tWuTZVkycX%_m>GCDU(B3X)=|zP`w1f$(Dy!G$vux~d+)EqtS0ULlgOQ*lHrWA( zNNrzA5$_sJi`O01;;xt2FcUP~Y|g;|+_w%1U?*0OFjwDBf7Pa+%@-3l#wuThW=soF zil&EEN;G0%WxTul@Y>F7v*zgEM%+#R5|k(SlTd*ZdDo474lR8Ok@aUc(Y<6=F(oy^ zHdeuG2$pxq4IEA&8N~Q`h1WfE-ryMlJ`wHAi6dSe_1I{8^#^Ej3YPe|iGQH-{Z}?- zF9{Mgj ztGZz)4+!E|b%dVph3?B=-W{29)0wRzUrb1J`E+1*9>69Xs+4XL4uB<$`EB zJu4zJgnIjF(iWS(*ui46$-=D9kW7w0sJRS|6hhV@^4T{z@IA zQzH5H2fkveKtY-YYj>r4 zDm{M3~&&eM=-^#hf3dD!X zIsKZ#^DDT1&B`)RaIz|>ASJy)rr;8RdFD+ZH6OCbF?`xx+YFEJEvc80uGUb1tU{H? zzG_WttlvrBGU0Ur#yHL)D?4gABCrE(6Hq?o99OfM%EMWhrnx=;y)z)$oXtqb!g`wB zoQIc53SII#$T?{HLfreeknUn5Ow5H+bw52vz59e!QzA6~T(tG3pwCxrVNqLm=WRPg zjt#lj9vBCNoZjnPKA@F>Vaa#OWzav`#>sUk>2i)Et+RtouCQPErYrTDpeb&D`=gUI zrfRd>$q?<}w@JpAU9+PmPyW z_U0pcZ#;KxoS48JErVnPIf^Y>d5APRD^CkbjYpK`5R-WNjEaT~Y=&%wjf#kgN!fm# z_F`Njh4wi{oqGh_dqhaEvJK%xo0!)$_}Gv~3hd_Dq+r$CyB{-sgCyL9Vt<&N=T?{yeTk)(CLvn?j2_ zd)qR-Nm8utUp@M%-*ht7PK{6*2b4ygwg$3fX387p!YX7;eX)!6R?ZivkR3v^ot30K z80aOcMBHPZ8GxuO{f*F4)>uE-UN2tozu#j^R#7u@Tt)j1m z#P`SErFx_-#z~wsCC9S`{vx699HCPhhEFxutJ)vIPlP{&J1Ns|jxR&6y1gS$U(lPZ z+a7bd4(g;3JM3M-COw@!p6dH+Cb3__EFOc$o0tX{|0S0Ri4#0U7gyU<+x(paKNd9? zHiIWko-cX8Mkg~`WBr=k_=^*OZ(4A_(ZzN}%ivdmyrV{0F;^9L}z><}uakd{`HJSZZ7P3nZbyR}6 z%ZOtKWX?!l8V?%)skvT|0VyE$6Wc%ufu@^`-!P_7TiSGqpJobTJr6N8jDV77FIrF7 zYrMx1J`liFiNdrpWzRxn(P8>2iZtX)5I~mD`6b5$f5xHcAqj4f2+9M}D}MIEP*KX_ zb{sqjPkACnl66iE(deSJEdi%;B#z)Uhp$9MCfBp@8p_}jDjb*;#Af2hF#1^g++KU* zLjykBlL{yqrlZ8>NLp)qOAR~I=^Cc8wx?Eug10}B%l%%}Sk@u*W}TvJWqcWVaO}2K zks@-c!FCPF?sYm-lpU9Y9gIg&Uo6L|-3XTHY+kM^nEOL8xoo!b~%P~M@z z&sEDSz79fGgvK+Qfsx*T@cnxQlLK8k}J(VCajI8xuy;*ZD$F_4M zGaEM6Wx12Eg;;)~&3j&5yw$ZQ;cs4Q(#7iRtd+3E8qADpN`VsG6ru6`mi-J_fnC;h z$w5rPnI4D2s$)Suy;ce10m+mSuoz`QS%+yJa!=Wj1hY!R$<|N(Sq>!5(8&j;5dzE} zt3y?Fl&Zb`^!+ZX8iv71n?r^pIg+b%l7zqRTIq3)QG9}ClDa@xdN#_q2!TXlbV$Yr zLqh``h#4IMYV@^5nh*X=6@6)lCj=PPS1(3g217pES~H{YY|71H|)K(knr+D=wPVkdG=&$}})U1GT{o?CPnagr6KpjLT?is`1W-_~U(JCB1@LxfU{y2j_5#VOm7oS6y340kr#zC#a%K>+^?~5+J_+mln z>p_K4P9|8P@mY*2O(!!mApl=!+-A#yVA|`eGDOfMG@U3hJ$(1#)r4PC=0gbG>9kCF zBV^*4kOX|gV7`gMq+%C_#AtSo8?5W42J0nn;vurSnDFe9As{GzCazdf)=MiixTI2z z$q=%x$)Oi>WE>evXO)`Nq_8X4QxVuA1WHx6XfWyu1Y{sv2&jNX**b1jm0JA&-SUL( z3Y(_Vn|etCL9t2m{O3R4Qj2Q%li=2L>v+~*i#1i)o@4tCACW)d`D*cNHu==7>LpdMXhYZEMD%SOi_(>EC?E5f z$0+DXAo*;Kl2yuA)vr>OdQd=HnO)#O3|mc7OcMlBs#(bpci(WGA&?}%+y8EDGsQ8Ptjlufyy=dVem;7l7#6e8x#oI{Oz78S5G zzR|ChY2et^^O>)mMLsZ!-Z z9*rWYmkFtC+tpV5EejYMoWJeczRfiAwuCCeP-PukB_@_> zq`CmdXGnQoGB^BrEYnrNukL&bqOT?$@o(XnjWGPdAN)Zxgn-2=9#WfuaB0Z&f^%Zj z6#of;6bJ@d*&vb;J9)E0ndb}#N zNQx>cvAA1y9oApz#Gldl8Eih0jFtGD zxK^E`Tx+^SOr^_AT{;=fo>u;s0iQo&U3R>JYUUmpKOFP`V1L)!;WN)XQ$#SKL@$4% z06ju|a4!*I9y}K{a|$u!Zyq6PZU?3{+4IBo!{>;xHO_byg=n8KGWjW_#3UDZ#1h4- zGv$01qb_6^@~mjf(*RKjPkW_kB2=|<+n_reJ8@yLo*z733Lj1Pl{3ERK~&VJ7!Yhs za)~GUG9(s;P)q|vQYE*a^rR;lL0|HCJwnpmK^qeJGe7e)NG)5eu;rN+Pt`r|Rk%k# z&tZa?+EoRtjzA;ekF)wrnUiE#AqIR7_&{0NAPUw5Gx5~(%KW!DWCWd2Jz=UR=Fhqc8A{@|O8RNwvxQNm=y+&4 zDXVuVu%aV#<499l3G^re+lD}?>b8x@b=n_Gt%PCuhJw{L%e@^V>#x<;s%_Z~86}Cm z$bTtEW?ueby; zIi3KQlvTznmn3lxD1jZGx`-wItC7x?Q3T`$*F-)j(KjO%aP*Q~5svTw{_ppvD3LQ; zaZDIuP*507W?#_%0HnJqVFEBs3F{dt&lQM1iv;X%WkxYg4@tX#c4Px4DvTfsO2+`p zpP8T$Gt*G3$m`BrlqfJn6_*%=k}c1tKmF;VCSX>Zkc^Tc=@2!}XUEauO|iGb+>W<4 zNA+?GAmunNa8OlUXpSndP$*tOc~>5_$`s~#kCh1LOwu+jZSW!B0nd=}Q0uC|6Ixn% z#T+XxvzzGKPz=&Ng}ou2{({8#yGS}37s}%Us6BxQ4XqTBS@gmezL1~TDuR3L*fE|M zCcVhh&z1wT#7F7RwlSV+PZYEFm#Xrm=>@w7AJ`&kJ{S}aJnS0Q9A=aPoqlu$Jo9-CEF234?(THNIWe9=5Zx{*=oUrtc{1sfs5A!ebO1 zayGgNF7CO6AsV5OY^rkXU@6n-QWS>CrF}1ZuK6E#&^6@1&`6~Q4km1&P@!vfUIi{& z8y%ah1X$GM?>yK~HSVCmv^-AGgCgiol`-N|6ALRTjI+MHWzi#tX9jp0K_t&!rv23LRFsZsbHg--lD=wmWX_uk z;0u!{l=ujQbq;$h@v@twpco}AWIl6@&WAtz;V`i$jgIF=Ru3p!r?3^Qa2!;51p0+v z_yq&1Opk#uGieK4hQNeLJs8=-l}$*~fCIh;$-se&bxO=7eo|%T7{^$#s+fej(@e&= zXoUdec}0eRsSYKVWHNO*rimwbwx95u+uRT!Vb8<%p`%bG=(xeREJ0=_F$ZvRrjrZ- zXNP)+j?S9M@QQUe9o`Ioh{4$eW6S*u0iJN!&E+s0Oz6u`I(KySC<0rCK&k4M4ajxd z9m}re)tc+WFMsyM3t}s~RaL5%mh6Z5bBSsk*4E?+WgiCU;;_E|)KC4Ctr~pArKR60 zEak}1WF(It`k^1PYFo;6mwu$!=kER;duzAKEcz5$uPyOBVS*kRDB9>(a2TbW4}7@f z7*_1|c{7_dBX%26I~nQfoRo}mfJtSjS`G>b@};y2F|9z8@Z@PI0Y^Oy9Sb;A6#}rrf32S8Tw%>WZqJhpq7IjHHi^=4nGg_$l=#c zCMP{2wJqw43(p=*@Cps0P#5rmniavi#QcCDd^4N|-8my_M(?KY>yf*Oj>L~@&OK)negH1RT|$$;v`F>cUctd(`d9o_7@up$sfQ94$B^hbY` z&j_nl)(L}4!M6<50QWI2QYeF_`NjKnspbBlr_P@e}!al^gVMfGu|lKk-yw zEGPiS+Tv^<-I&@}rhzb@xdZ_^9W)T8LA_RvDdZr}Tx66<8d(Kr(a~(V^IT_1G(C6) zA~kWtZRH~hGtJJuPb>)QNG&BjiomuZP^!9ZBXXVg#|kT*Sd?WNc?%Yna!a$_FDtA? zIqNb3m2!+VH~R!~t)*69UDR99H7Q6f>ZKWC3K9SfvXn(xmm~o7dPxi_Wh1RoqQD<( zH*H!OMHk|pLiS52p_9Bb;iMC`6ja6^YLy)XB2TBX5K`|vl7y_ImsbDDxO}X@4Yp7m zV%$rL8XZr$FubCH6){Ti_Lu=KTQj7dhYGAGff*5BL;699X9itJ;?TN~Ck!IO^zff@ zebXy2M&94+K_bbxl%DT-&wJ8fM0A9VQT7rU`S6o6FL2L3`)uq-HZ_PS2uS_4T^%XM z68wtJk8*I_JdJPw&+vmAd#Jv}^qfPUEx*XI4e6&^BO=aoRZwP>iD9N0JHqjS9!ES+ zdCob((x8y&j3ZZFI`h!Cl^pXOEw~&gohI^P!5Gdt=Nv9Q_OXw}&e3jLr}n^n`2ZQP zoO|xMk9yRjpo)ZHKXAiBIGi*6p6GNGzKO>c=ITkn+xb_%@|Boh9t<*VsPzV%X=-sJ zt)k;Yd{(~@Y;b@Nc?XBxGQJi?woo6v_#l?A_=>NwWow&fhUNs>`A4&g^FNyD9y ziczY>LYRz>DX7Wt>5HD4+tiZu&5VZ}&M-=z=X_Idj7&&Kx?jHG8@>UUx{EQx$|Aco zM`zDP;BXNrRXtq%YyCYCu*g~*EvZxd{T5EEERAg0^jfh#Mt@|FYj*fP|`90oEP8ak^l zF@X@n8qpnAF!;OP^{$vlc3~-@A-6+>@i|P6Z*BxQn`0aZyd?KL7|IO9du)H&eWXO0 z8#H@k&U5?Xb|1OHA5#|##1vT}AX0ZI6AbC@y}!ejs(o1${H(LiqW|KHFLvo3SH^?& zRWB9;Y0F!eJnYfNN$icE z9uoKlaFx{hfB_Fy=Bh)1+u*eX=>j)V8%S1gZ~0C>v#x2mxjaW z^U$Sm2x}tX_HpBIm~wg&vS5`RJ2tL97A~)@-uYM4=%V0GVGH;Ot7jF+Gs<%=Y1I@w z%^7{6;emnAKL3r*+$<^gTm-fOfl}3N7=`+96#|w>=|Nt%=^{g0Rc+Py9?q_S^x#W4 zTT>QU>$1gNtF_qDZ;6-uEW|Fq{oB9YZ=vW3QP7G3c)cj)c*$jR%NC1On?1q~d4e`# zvXNerN7OpolhX@Bl^|Uz@J(Nmx+t?N|H*c=kyP(sSB9oatMbVXEkk_Ji;3j3XmFXz zaZdd~os+##r62f#A3!nyB0!aLo1o-ThZyB`9?HA&pFKI-qQ->}n%3}C0+OOFHyc+1 zk&Nwx>8=aqMj;^sEdbu-E_XS0>=?!jZEonoI`*l%8vFx8@*W%)(Ha3tIL43>K~?cW zdy3Q|K)yBPt%26c1ncUJj>71x>0pn623xGK%X7XZUbfWpc^Fm3oXFVc6E9+CgJcnpA3bhSBkpI5O<&s1OjmH}}&hl!&Ce)q!H3 zdFGjJN#Ei4*n@`{q}#`h12KJt2^o4+LdGEKg~%Fx(||uTn+7H%yLRHuL#D7 zpi*I!7tFa7(P&l3nj-||Ob-LcTfb@Zbmy7JaIj()xi8%B8DbL#$nNF*eHE3Cp?2A5 zYl^^z5hzvNFyJ+}5`ip^vW1n@3NDQ)_yvyzT`rWvkQTET#nzNt9^^(;$Tv_r&hf=-Axysi;VQeW(f|*-N18K&4a({t>67`-{ zJab}}2HM9P_!$RW>Wi7VzijW_?|%0ag6Sk!5jn_^=KvX(;&K=}{#Ydv0zP0G~=fm++H;>skMgq z_=Gbto%5K4W1x{^Q9B5z#1w5OGa48@if8(<%O8d^^SNYnGPqOyqdasj*rh=eH`o$5 z1l(n28jDsu-&7#SW&)6bz^E-=ce;;xJUqBN;0Anu%)#@#j@lqH!R;S=?!0g@*8f7l|G69vuesE|6&L*V^8Nz3p0YohP#Gh#3 zUgjYNhF;i1ML;nyGm|!MQ-%LgZk}VG^k5{)fMUqU4=z~;pnX|;dkSs`j06b_2>Ql7 z=jlPeCeDD%0eoAP_9hJ_{BcU8E%K(iR~g8nHyAwhrH3~melR!qoLj>U;-S$jLUZkT z`#jgfCz2G;{XeUQ6&kiny-wkz@e(-w85%V_frd|A{V_5q*%kIc0v7cS?qxRWrR>H` z!8D+Ryh^G}DwA1LmIc;@#ug3YC8?k?WtTkn^lSIgb~10xe7Kn^V-ueHG}B!qlr-IF{=LMRUZ2W^>(w$$5_l9$@Tz14^s# zS=Zh39{x&(dv>EU&4g(P3vsEHC;iY@gH z2~{HWIe|vbO?sg|4*3t6e%|w*hixS3N>mtzoWYQENb?>+Ze5Qg`j*P9u=rneA+Tf5o!g)=|`hqcm5IcVSI499HEXSoV z-Az2leeE^6TRr2kf~vY_z3J8}K>MBkKc_rw=56yv^TJs^AoykOVG!ToVGYxoipaV6Z zIqw;>P?kpR(7D-#w2ExX?rUa|trZ7yI21d>M3Ij*KDeCdY+yKbX-$D`C1_Vk~ zw_z0O!wzw@KwGsPG9N^w1e-MSgmoOB@B+^7RplY;Yy>Ry#H_Ho+~+>`$v%@ydXR&x zw&X3)@`Ow?@1I zdBRrJICy?-8Cr+|%0Ah5e8+dlZJZYi{{@&RpoB$10~CUiebeMpM>WI%yDDB;6R^gP zA(9Ft^;K}D+$F#rOh=D%%FZL@lO!Jj`0J&WLLF7A;h0K(B20v}axe012|;ur%Er;A zqwOwRyt*9h!2t?6!zFfo3+R!?27H(tm%tl`g#!~VB}}Ml6_L5eTcDY!h!Luaqhosx zbnVN({L2ZLd-y98xdDxcN(X@qs9kn+)5Dt^!CtSI%l!A=nTI})$up!9%UJaujv7C98XD!-9O`c0+bYIXs zoKYC%sSItoq=Ytl5-jSh-navBxTGdaC_~;qSi3yZ=mkIzZwefS!=8qwMq4fd8$+N} zbz@N1&^iQ?JgnV>ETD3XpY-P4x>Z$nQKKoT$Ut1tjQv4btbIU zUaXgr3IwD~KdQh6ti`N2QzEbXfrUJjrI{zP9eL+ikwvo5;}c|XAXL>3gf2875WWtS zD%A6z42N0QcjOON4))+)6dqtYfuWEwejG^RheM8_0RgsvCPoF(1s`QNa3-j(3X`x= zqcE5lO=TznFd)+tIzodc+6-R=Bwek#Cu+l?l~{(4Dwy+%36*hA7xf-dnA1@c4V))n zGs&JS%1A(B#;e$kW_<~h+5f>7oe9?8jq(?fd=Eka>r#^BIc)BscUTUpZR?am!uA&dqF~F@A$CewL~Rj7w+8)Of-2@}&Xb%I zrY^xY1C(*sQ6;yv@;t-J0iOZ5*Zh3S&M~&?WxXcvps_u^83j9b{+gB8`K+VvD$O^S zbh?qrb4=6<#wGP61@4UXBHt>ZVGy15%DmzpZJM0pr0$x;OQA|UYCW#jIwaq>h=f(AKf!8sp2^h)L4R8*U=?aS*DB^ zaM0XT3WQ?|%GX?yk51+s)T(i?D-eZDMKZaBOy-rf%Z|7&dMPKSG9Uowq#Rh|Tbqi& z{t-Bsb$S1ORKs-~0ZXcdGOMk$B(3^_N|v?ks<*yd_x-=#wwEvrhcu5`N!5NBu9tf%taWXn3%T=_{B`LQ4SF$*zaX;1EvbtHzn-~I01^^?zgL#@h8jK!La z(NT}z=%ueqYQ2KQas9Hyhj)?_o*_fq#?TiZVlql_At~Rrl$Lt7J}1&dHR{ z{MUu^a7YRvNz6HgsghGGCrqwNmIx5uK#ySQ=YUq;4vVRD$t!1GImc&RqKZsvG>um8 ziwz?3gxQ0UIp7;p0g@LQTMWULW@Q~UL0&IJjU@dlHIboVNA>OzLJRLwYR5*K-NKLxEmZzaHaU7VSKn>8V@r&5_bSX^>LFOn)*cXrU=te!yTye2Y2 z;EawqoCjtCVmFqupMg-XFkvnXB5VvCWjgYXV#sm?mlH+0haXu zONoNM@Qk*rdiI|paHt5Bsvau*HGVY$mPkcww1PZ`Nl3;LhP4%gl!T=A{AEfDtM!+d zdVfJCzl^r3N*hvw`Yh$jR$&Q7GN9R7Oq+uGtk)zpsicjhCRUu~-7q$Wyy>$Y#UHGc zJoi|nQ@uBvb|d@>MCw9ue4Kz=5Rji_0t&75ByD;<{pnBl*Rohau<#+wX;32O77osH zk1#*uIf0}ul@TVRFfJD~oZ4ly4V?-(*isler{z&OEyTBJP0FC~p3$Zh1TZaGA7wOT z@-)CfCs;BLWtkgqhJ(=oI}L^g$MP@$3Zw@O(#n>MO9LK2Mh(zhDjP4;g8=2ox6xNg zIsXYWZGW9At*9yjbl>~l*P!U0s2Lr3+E9)W(bwSekQLogjY#Unma;*oGa%?C>*I^w z{(GjPM~vs4cb<<&%^3lbC(IC?(V)9o=aRS4mR4sW*hIu`g-qC=Q!xEN!5Lj(t4V-N zbIdj>xS(z7qT|F6DFqH7xONB0FhP&=oMT8b!AXZ+Y^ir-q8c@=p4@m2No>r7$Iguf zpV2#iXC8-!iG!q|NG3q4GN9DvW*lD8PfV+DvIVY-05NYsDLcSu|JYqgtub90!S(tReCDGl38b0nDp?eof^pe( zZRdLfURhFjYbq*};c#Nt1vvCD3Ksg+JFhyRp=o-KBwH-f#$1NOml9^3aMWm}oMz+B zmU+t)aJj9h;+q?dSGt>Kx|3I4z~&JsRoy)1wYWC|7RM~pUbmsDc!@>U8!<1` ztfW>?%P2l!t=C^Nu-ayQ*JSCpQp@Fj7GUvJBQaQ)r5uz6F;b)6n@2VJvX!JoiNt34 zwrbO0)kcHpk$7xD`QH)M(BR_%8J9w8?XuVz^4~m4S~hoe*JK-*7;QY{C*@4=U-FX} zv@)T)N*lx3SlSbXB(S6+J}0ZuChAnGaiqMbhEuDI!l71S926=KwbSybTvLc1aoKN% zEd&5!=gH2ZxB?4gj35AoEK?ez>~R8+X5&JMzxZeqkvz1`5X1{zpjO9B38_~{W%{v0 z1E;%IgKk{dA`Ci}2ook}R%kV{w#0lr>0pZ|iG^eeMqB}_HrW`(U1;{Vme5T@PpvM5 ziSgW}G9OauQXpnB(#9eLydt+h8i%PB7x{!hdDtFS0VOh;9C3gxpA~v>kNax%XoNg* z9?_xMjDiMj0Hjt8Iu3+j<#7&c;R)i%ZGg}jVw4zHohe*s5)p58PY7-$HDpv~;FLX# zWgwK%IFej-r>GZ&NwRs2%CfFrF4{g>B@=Q<#$)S9?5T8@O8^Kj$#0?77aG2ZvPJ(6U z(T{$#Wy<0PMz%ml%;a<*MUN@uW=vdgGg3hhu*;@fQv?nRfl}4OLcVqv5wLcrO4_qz zTeu}8e;fzDk#Vi~mRc*UH8**YfIO{i@x>0k)wL)~*y>f1mkw=&*a!9Y6Akheraz#A zE?A2-g_KaPyYJrg@|O0(3orC-tL0mb9Vy+VK*@t+GA>CzSk|>72l7o8bUXlg(jQ@Ri)nuf)Tdx_c005iTxNgdEKWY<_4X? zmT+boVLEj*b`<(;-xHtsM6&{C^4FSt{=s3U2|J8bV$Z0l=M2hX3TZM8j6TLgn@jZy zr~|iYh73k4c3i<(N3DVd7lGhucA4QM`HY5=#C}L(IqLaIIFgz~?V;$>OD{Du{fSwD z^Nn?}laJUboH>)*L0_f?0wR7IAO&}s+sBWPJYEho6bPsR9o+7Ax4Urw!YYHdGsGNI zf3)T@GVJCjO)gCd6T_HtK*)d+CJZ^I(o7qOO%+bdQLZm-&c@Eo4k!;f%5eF8Y2OE8o@`62vsDRFw>s!geSb@B`<-J-+=m4vgoWP zv9M@#%xYWXtS~`aIQ`V;^<~xpNV&;l^7}syye`PQ2!FVW|8bZt1*!;hk6nM9L0rta zl`LymI3)xiv)*D`i@+ukC{^7g+O;(c0gE_>Va@fT4WY5&Vcol3Jba%V0Bh+ z&CNnDAK1D`!boZXQv7khgj3VFYONO61;v$^c zd=_DJPd`^xCayiB^J-XLL_>`ZuIbZE+0hObRe&<4Nup9LYK882sS0QNmq?ybh8tmj z03R_mOg zFTptRX7Q2_2nmOhAjv4r=ALPQ=b3EWM*i}Rqv?uH(MCQU0jtJSQ$APqE?z66YE1ah zpm-G@PU_4V@j44Fs&oete~hnj0jvQP2xm-PJkssMH;;lg@C?0Y3_}TL%rd4;c%TWE z=gyAdQU=#Z=?gtNMF9r_d@xK*qksTm(Z~v1Xj2VCm4bS`b`0#2)D(mx7N#9sQsxi$ zEI!7?Gm@`;kZb^wH#fL60;e;BZh@jXd)`3SU6Tn33I&_lJjZ=0(d2<4v4e%T%1mp@ zjX;%pz2+Yr10Xcg*R#F3VUAsJ!3B_^$4i4e_0dd{|LVO@F!RG-)nnLhmgx+f??5Gs zz-dLGRQ0sNTjeK*fR)`s>Gh@kDkQ+(gVkS-w~SiEr2!m;fVEY^u;4nZ`_^0nQocjl z$Wp6@ZDO_-$XLqNyHrV)^guxJU{M#B@)II!HAe-=OEwmL`=*wAn_+UH-7JP|1p3W{ z-6`oUhU{4;m29^L6uya0vbP0g8!4{Zr}2NU^HWD^ zbF5Kv3Qh3QE9X&Q=oC~fbcweJy+r8uXSNs}E)h!44}NC@F=J$uU7~B~pck)5iJeza z`1?mj!C)aM_rL%B&p-csya(S!i99?=$w+`SFGaMyInwBhbsOcTb_&wtbyK zKMbAeAB>rB(pgd>t0)f1O17i9@%-q9?x$2P#3unS%su)VK7#-aS8^kO@ zM$q)oQ4?h9Qja3AB?y$NZplE@ zjcX9Fl;`hP%gWM#wcgTiwY3L;1Y`}B52Od=RoYNiiC@YS$@Fwt^qno=R`x9AYLXSC z5M5*o2PHNbG!c^paVe>S12Vd`+hHq2xIjP5SM(D10h%9)&=+r|KcO z+`4Czq2cz~XP+I~Cmfu{Zl4jvE`A)?zqpU}FO=S$Bq;(KHYc#y^aO8f1|(r~|6%=SM~m&olJg2rn_d z<_U7i5YM^vzz06irzwG zFBYAV7ZSEJ)0pD07OngAoy>_q;!-hfRo_Mh+L8OMYdg7e9%)qg8q&po+tWz?t$a0)u~N zjUsP+%@YC)X(gtdFk{!5A(gBAr{AG9g_K=Vo?d|U@r=1-Y2vy2!l(Zpv^>IT;vr#U zXF{5IaAVQD@*mG0KYpAi!b$k69B6$J*gOKIs+-5W7FQx*L6;IN-?EVfRKby@99^)d zWf@g3XIt^rOG{Q&RK^NRQnpZ_gn_KKS-z!t^3G{WG9Yi2Pj;7YWR85sN2exwh;fDn zV(jWpEwSiPkSuKxc}1vf#h0G#B=JozzOm)N3}|CrE~L;wiTaUXma)(j>&Q24%&|^M z@(_8g%f0ql6Mu$RpaCMOR1%f8@eEb~Xe!#5@=1qIRzZz{P^LDd zkpC&`60g)VL{*wHe=_J~bm!q1`h`G-l2M2N4;fX?Sb#AT-hMM}oXo3?^dc$P#A}}D z$rrh*k;9+Kgdt@Y}y zw&Wej7P2@Q3BXcIwO$HI)#Q^B)Mq)?i+-2%pdC7@w;|-LDV~jFqlQ=Ftr@bBwZ; zp!79ly5p%>rVj?}wCSst0g5v|v3SHI9$^C;>0t%(Ac71`IGhkX=SaQYW_phw|H;rm zCbkBW>QN{e8k_XJfjx4wi#dcNoP#8tIErNNy(+cH5VgivUroel=C&^x9{>2qqolfX zm903YjJk>42B)9*DVUG}gflJyCEiCp>QP9W9ZDcjo(T{=ppF%qO#^NqwYZUbA)E90 zgA&RnInAL#B;jDg6^+X%aN8~>oxEjNVa~ydg9Z~G<{)C)o}7JRm}mkK(k3WK+DY|< zz!3Hc9QyeT2L%su4|~|d?6cb2^SNrik>DiF6e5D2SP1)m11#sBd#>+U%|V$xrs33{Qju2S1E+)@9g*nX%j2%@%BPmkWsm(x`4+hAgM!i;I%G5GJ15C7L(h^Wl##z0CfJ+5U%5gaQjU7Ef zOkvLhApAtHO#}0vdsM+H!hB1?JaMo2Ul@El;pxbIO)Yb9U{M#~^AMQmxc$@toq>zM zp4MAg1P%p(Qq@C&y+-#&z$&aEYj-3p#8!W0`43C5u*w0}Wy`L5tF1-f;+tKWbhipC zXmyqVtp4OtkhBi{G;2-eXwo_@$A@GBN_0t$-5~p^_Lgk+NQC~ns^p3pSmomtF?Knr z#*rkEq!JCQ&hnX#=o;cH>&qpQD1OFOO44hJ&ni79tdC1n0oMP?E|c+G+P2rIZ!)OX zWi-}n27(_a;Tb&lOAZ zvGznk2L9Npvu`tuj$CVNjZyj$BilvfqhabZg>0$G8QK&Q<~hpZn*=1li&4Mh;kiB0 zyk6%O`ei@QnJwKZcZf*YnLqw+sNGiES2z%F0UHz9SVc*};+-tb0v8k}!BwNIFW60H zqo3V7R305Mw+&N3-alb@{ z2A8W2T?jbf;INyBi|eS&F}EQB6wNSk)#C^JvoneK0NJ+?WV~zkjAwTi z2em^f7HW;SIpb?rw9RC~51Yzhi3?I=_%PZknAE-44Of51x3fx&21yMLeL9-#Y5al*mhRy_bzms%C z50@x`QdqA_s^|g8a`zL~n0samomnV69#9Tv=U^^Ot@OZ3<-;HT@Jlbf)NZ}u^Uz{q zo8)}+Y-W)${XFNGC&JNPyr<^X3Ei$h5!fdJrKcXnky?kOjKq>#9V{%JuVG{~CXnG&O)QOPxG)i{)= z=V|x(W&Vf@T#_qu?1mUoPD%8qJYOeCc@%FzR`4NdHC7Z{GDkp}QD1NhN~KruutJm} ztd~)i(FYHJrvc*IPT0G9qMW1wsg?U}ySfA~4GigS2%O0?L}Ai-{2y_-41gI^9m!MZ z(1eIE>hZuR6EI1*WE7|k8z7VUz#oA)M4^e>whS>^tjPWxwT3={kfa38Sg#3eRycG- zCgQV**h1e0#g>qDQ4pPi%Mk+8_R`D^PBO|g&5i`+9ARRDBI$csAaEwJ&^aVeIJi7y zJ@PuDcXWylGIWa9!-iWDZ&Scixxr9;-~dk;%~+^Zrj3BfCQKyBV;%}+&(FgKBITZP z7(pl@PsBtA0rMY^1QgTe3>bM1K#bo9vJ`sK@JR;xu9a`B5awY(z|J{uEL>_;X5IU7 z{`=N~a)TvO&byJ#D5#QTBA(M094I903RYrW&v`_@L z1c6f3Eg6WqaTNktE60jy|HemzqGmW^z8AtT#uPN5GgpP|p$OB3WbVx&JPM2|50GO~jp@M$ zyS5yFm`fVst@G%9!UE0N0gV+-E_7j$jCu#RweAeV?nf-jiG^toW)Tw$2XYWlSWwu@ zBCrhzT=gz&8(gUmMZoHr1=JZD&K6ml8FGoVfj}r&ZB=SjAdn2LpvgL`V1d>oXIQLN z%5Yxx$qmxB9|(uO5OWY1DQEo}?X9j|9CpbkpUJF#S1V_G^T?Sn6*}pOOBY^vAzOCN z#w%LpcFkV({|~Ji?vO?4RusswGo6xj9M+5em{_G@eSLh$IiNv|LP<-2wtoP{Rfk}m zgUot-hDF0fGi^ER73BlxNU9`|R!w3QwO&D3Jw1GLkRLuMq-L0-M5XR(bf;?gsb1@X z{OA~+LzrZa$Y%TNSV1eJKu+J7;IN6RMiV6& zdQJ3T%(|qbddLvVWFQ&&s8Ws<@|tu}lS*Y4)r*1>XI)edhetUz;~dk>kw;b4a{!O@ z#f2U5Y@_N+EE5%fQsz0k>f?`I(GW?Oaah6qqD-f94k1(JTUfLht%OYK$x!0bdwgGh zBbuRuT7Bz$*=3j6Wkeq-WZM0rJ}{;`=T&lyOU_K#O-z%^_#8~)WGYjmm33!L>N%jJ zRY;}FC|N!e<_U+RTp_}~dGPYxaQG4f|E45pkf$W)Xp6;V&1y25Ix>-7I=a*)K961m z;KsDTm5CXBXO(22?UE15WFkOvbXS9yHYzFkde$K4GQ$f zhg43_{Ncc;i8FCkWeW5U6Qf4KK}J*DW+Ii$saFYDmAQ=AkRQTo#u0gv3VJEHS9nFN6O1)@i6k>eS zQ7g463_Ut7)Qlzttzu*%I;Ty_D(Q5jeyCzjng5y;hCsSds6Z!Y(k0!eVyWr52pkpy zrK*R8eC@77V63NOk(F#DrzGQ)t*ulHNz1gQHtTpQM}A7iQt3#Vk$z|+tjnAgnQ{k< zI_i=v7zbEUGpH4vk&zhG$3y2iR*2C|GG4LBVOA8>D9_hJa{WQu2wyp_20dp!q|!N_ z&-Y*8BMRdMe4fPrD4|nC$|^~cPfhUD1ty}6SVqbRqq-YYbTEC%cqSCM0&|Y3e%*;pE8{k8sh>tf*byicG!f2W zv)_C3p&4SCSCs5_y6V{m*K~;sss}H-k<7ZGa(ZwZZB1P2<5K+5mma3W)V0!_f#V)G zsGX`B<*8RH<1jaLcOI=Sl_`w55tlBEj*dg^DCok^piPoaemX~knyISMi;OZ`3W>rw z!f_yyDyQA2<)NyDB5)`Ol&T&I>@~VC1g0yp<<&|}-Lx|KY1AkX%c7jhoJZf8-t4_q zR2)&)wTsiZ1Zgz51!>$J8n*xm?(VL^Y24j|Yj6+l?k*uffZz};cuw=3@t*U)m;e2D z0b>ATR~KEqtM;C2uK6hL%Y>2ml~psUykn}T1fdpPNEo}3QZfU|Kf9{7hw>2Y_n5hP zyO~+l438`7y6kX0uoN|6kHXVx?mW^TMI?JY73NEOWT^8Hrhw>ZepGfh%Wwls**J4>f#-;dsSYv>R`5fBydxs_}xL zG0n>qm*iNxwtMRu|NVQO80f}147RrYKT*!maAv%qcIdk~EnVsIKR^8EFC=gIO9O!` zdjD_m_5U0;s#gzc4f{={`QPI)sG(gx#=W*R&}02)xU>-~bbh!dR{r<+|9G1J>wH0k z(A!_Ttmc1@A9zz8ftOhy-g3A9bKs0<=s%!W%=BO5>x`ji#f$DWh5!G*d_G_jDvrCe zeoXzZ@v9){S&<-h9{eZJ`+p9608RfCAgmbwukm(3=viUF8@T=-FV6ty3a!xOMr-W< z*ZBW^TmScM{ohaP|K0@t_ul${dvD!<{0}wY%*ARY`$KJ~i&x2M#?f#5&wA_vHB7Um z)}{TL^2(ksL2c=>t|E-#GU@zYV9s!?!QT)5-6#4NS*UD!%GoWQ=&i8#a_yBXIdQIL z%H!w3m;N^wWf#FDP_0apwO8JwId;Yv@pEn=B%4N+v-`vk6??|1uzaAsW1vVI;^myct?K?;u)FmX!%1pf zk;P0uX{K<&Mx#pxF#7jwPuV|7|C#>74olk)(PB6NxQ&c5K^_uGBeM>Ov^IfrO!GZn z+IB3&i6RVKj9h3hDo=n!RjEOhGB9Q?&*fvjoklkMdBLSC%iJE#MDn5heO@^`Z`c9G zWHQOtWtelwMu<%JK8vHaM-q@6RNlMTs!3VqFRm%j&|FFQP@rdA@C0LTVO(Bl$=9>V ztK|6Q7YTfKqqsJ8&o|>_ZWPo&c*&Z$orU9!e!eg26%(-zZq(dnq3!gYS>W{j;N_zj zeF9Zi)Y;e}R|e9#*epC{D?g?licWfF^@k!g|Ba2U1I9&J{^4JTbAW0!QUKh_#`Ux) z_L6496hI57p|1N#$?-e%i^={iL*4(!iGk;wG-21{QmsD}Ef7sYs}ivbs3ns~c6s9{ zKojau-(u129ep=8HV=4qB;gB{;;1Lfv=>T3=*Lb_m)%gF4tRUKIcWcRf9S%YP8KQ~ zyPW%_$}@XRtpYE1TQz^|Qa4#2%z9YPooB{&H_Y2zPYjo`Kr}T$e5XAi;CR&9;gOuZ zIhZMpn2H)BA*P2w>bqVTqy?O5fMUVv0})u|XASoe7*_duqv#HRQA3Le8^&1@41bcV zt!7gSBJtBFYH)w2XT%>VZ}dJmJ{s%jubuNN6aryd zZr`~SkB^+O)kX11u28c8G^FWjBKWeITF)AzU8S!L6Rf__Jo3A%^qyy^N!?P-(8r2I zKkZh}*EU9>4mW?y33_&qah{#O&Kx{D1UGju`+>#>+;uc8I%}NNRO9Ua6j{oGC5L|NnJGNctSGOd8=d~ z@c1wRuYyWU&PoRLyXCCmzsD8d80|QPQ5wj%&vxE>>aG*ITk{N|&ftKXL1efNOoO2^ zLOog)=9Ux`R~1SPHZx`O$@<-cuBB=yRMXn?PjE{F*&~0@NbD(W2!QUGtRF=LK~b$Q zYIH3Ssl3T1`1)U?=g*%l`sO?TMm+C{zW#X_GnU3q#EU{eDE^x?i$Wob0;He}baMw# z!Q;o^XVlz1mD>m(bzjTN_ZiFMyS?fqMs!1rszMc3~<-RUgR z$?I>HB7W1tUoB_4rgbdpjsenIXCr6njMx`o9HM+V7fcUm|3L`t!cLoEX0Ep7DPlYRZS#XiEa#9$6j2*uqA^>flt~@pMnE%1y|7!O{*x6}+<0IkkGQa5v9M*;Ta0?% z?Kevl%wjz+Egl(?zp~a!GDEW}FN-S8WhC4onImX*bPL(svPYj#7bo)-M@iZkP#Q1RF zSkk+5-_I%X^83U#`p@|cL9r%pbQ6r7O&5ZO4SN`sBJ4mikTW*vg?3QBK5hO+5E_sFvPb<^4&7FYHL6_9_UyFG^Dd1a zaGDAZ7?mUs{%EF%?USSwr2X^*Ilh3vICz2VDrrL*2PO6{DJi* z>iXtIF5ue_Mb1`X5?JYBZOhyx5i4KK@(0$FkF}bu58V#P^`_*>Q!RWR;7p60@G;A` z;_fvrBQzRvpg|dr_2ajs5)_kSJu6nlge}ss4mPhov>c6k^@f1OB67qvMl`saM2zwG z&)dlAGA&9lU;jP-zVPgMY6i+Gw0)<QBQ<_}$ z@Fm#JmTC6ha?-Qt2Dx#xJVt1k;I^}6mU^K85ORp`weq^wG2$_lgmeZC;xQinQ1^`a z^u`y#Ba#R+|AyThT~|)1$)nMEm0EjhDgXZK=xjXdz)eLB)2EDaT>HMo%J)7j{9Ore zizYReeMb04AZC48o=@d-Y_!J>!f|}lusNNx_P>{lfS>XBWTCB5gJt;p^Bn$H$zPvy zFTRA!5Il3{{Xt*AV9OY7iqkP(JPEk73Wb(v)hLWH2flihn3( zvT=;KSxVlRJT;_uDbgsRX2$!Snp#W2U|Eep{zywV>&TrM%)ebVbkRY~_;1LDC0{mI z$0{rWytmePL<4+qeaQnGi zg@Hls8b3mk{Zl7elz(oYb@CtzLU`scyU%uI0?w#M%yc&nR@BwDf;LWa6E|P)TA@^& zp8=~Y;hUxCCNmk-rCGqz^>GFLO09?0P^QyWM=So4K1l)YXDD*3OO?j{?AM9G-|v*k z1{R0v7#1;(g2!RwiPh3%z2)%u$69$Gk9A5w)&YCe?<+9NUv<;4*qGG=QUe2^K{bP~ za}ncxyGXSrs$~L`bU6YUJ}FkiA7QhJ-$_9Pj}s~iZi_XAV43vxbmTMBbJcyrrV{oN zkl;V@@V5;qyZcm7*CG8nJ%g?qx#c;kLc_|bQMYl>I6snl88dkoU>!s!^hfN-h(4-` zI{~c?gJn!*MTrT{pf=$jCFus^O06upUb~T>B;crr0U?tmPu_|p3|+^XwI30wLR8kX z^8GNtLWvJ~6qU1He=%wxWPOKA`F@+HSa?L0Dt3Npd|B?Kv#2}i6sq+g!8C24;e!-K zZTK-_;HvPF)Bv*lwJ+p}YS4+&=X#$!vRCu{`jMqw*k4(M=gx8)XJX6h4Y9MbN8#Nk zr^cCwHiX_od{oS!XCDB7vt&(4%Oa^pzKc#a#5jm#k28YcQPdV#^?%}GYHjWif4k<%$eeF936{*UoQMh7%P~QiHJdxjP=NLm)q^D z`H2Ha297LFZSNKIC`VLrOJzZ0>v&qKi*mXqYC1d-$?s|R5;}W3zVJ_yNFrE>ne1>P z?We4sw!$F&!hzd+1#z?KVFu>L9z!3yrL4d#18^g0&L}b2&4R*ZFFdi1Sj}2}Z2>Ge zA4~YajR|#=IYva087*aD0(1Lp*n`AVs7$)YIGf`fv2AEZ9T_=K*_3w+&0t1^RmO-_ zGu^b|Gf3p_4T0u$B15o2mG57B-*f&uc!F9Os8Jx`-XhI9d+PFq!Qs{}A3@IR5+cgT^b`QzVh=?bFN#pz}j{1|$BfFWRu@4Jku4-9Dd$eOGw(*Fk zjH4(ktVTQz@5J=5COLXZRW-an4R^ZO@O7SBWm(r?c8J^_IzciKzRaN+-3*{fqWn~i zqr^qWc!X6|TF;7n0&uYLM`D1jms?n*WDTw@yGqOt<(1P@s3L(PXE>y4e(W;`RPX4h zL&B*?3)uw_O}^d@$c*BAVBSrbjG&IDU;&p&N@7xQxN;qmkllE_`zU%j8hjh}eKLlU zM{PowAZ4;;#?3G&zWrZ=PANL)paZy$%HQTWidj&?1Lh8`La+sKL>Si}eiMh&f>K5w z;Xr+<$YI=L(&%5*-0)nBd54hR(@I=>lWTBPOs6L68h_stOC+t%Ki*&Yts3J@*CnaM z9|F+}5F~3j^_NN-(24?IvJUZfA^ z*HiH4zmSAtTKeGzN68c_(06Hh1N|Rxv|~DP%%d~puP!!0wmy-H6MkMdd0JetlPMWB zo7$hBiZGv=jAaOD+Ze@iS>bR_MoLiT6O`OpdL>1^a6Cv`lqyF?LU@VAx0F!gNHgqX zD*Cr&DVg{#;bG89?n_o*Bx+KuZCksVrABrHy3Z^CtW8g79j1GyH183lJPdet~ND zw8egUdb&=4li>)nO2s#FpKvwi2@^-y z1G!iEXlhXN+h{HAeRJ^PzgI(OfJJ*gCEBd1l$;KVk#u&FqH^CHvKdlFllvwmqh@pf zaeD$)C+Y|sW|4@h&oDG04_jF0ff^)C%xV%G)Z4(fYwit5jbiM7kVX~KCZ(~$aJt5^jK;a1cj_=u=V2|;jb2x^u% zjg=o~lhYtO;N~}kQXDtW!2s)=ea45Ys_@G0Lus}v3$mD4D&REhy@aD=o;w@n&*uZ) zuB$|%%ao5&a61O>9#E!eT|(NF6fKddg01-6a{6Y$x#8=+Va`iq=*MoDsMR+{i8nnq zoEI$VRXFV^Me`x7JnYQr^A1+PA-ny#|E~xy7b)uSy*K{i7TZ4mwV4kuzEAuEo>O3L5S@iw9?04a7SjioOz#4&(N!3U1q0OjxVs8w%2yQ|Q#%HURT&6m2 z94>m}QntoqH{fWp-<-2!ZS@S0od>S!H1FLzjO{a=$$0$Zm@=?OulJI1Yzc3r=jnZ+fExM zgamA)NQhX~jqJUaFaC_YSBawyf(WL)vu0j2t+xOgc?-S%iT{iJsc$5%JD)`*O)WmM z>##7ISvGO36KCg0Na6}HOfj(lBA4*cuu0hU%_M^W9H2#f5rz?SaiV6do35JPD-xL#zH0zxcQNZ8-*D!-vzVi#c416@BX!N~0R_f|Z0y zyaffR5uYbHXHv*C?NHHD4k_nWclRY`_*Ig>F|YYH4(z8JI&cNSB$uaYs`|t;fb|Zo z>Gf3B0qK+=bk?YZOy>)3+O-cWe=2h*P|UIq>@^Lp#_R@xoTdZ*0#RCfoGP_yBhJEG zb}*ojzDi@B*=Tem?2;T7M-()9NfIV=pfo~K4s2Qz$4!NbUnTNs6*`S_(I$ITMz&C4 z3KuZQZ};8T!xv3dnM&(1m#*JqRpOC0-5NEPx$bG{MmvS|<+vu@oxSh!&`5Onq&bpM zPhqyaxyvhMiOi1Z78o9wjT_n2D!HN>DrbqZP)VJJJ0_vgiZ})#zZ3JaZwik%G9^c0 zVLk!Sv_G5^B&O_Q^Mw+4F?=G@;e3yX=#hZQr)xXTs1sve=# z9c02UP1?$Y^78CDRm(`@38=Hsy|l<8V?2NnF5-I8c4ksdC#A=v3IWgKW=>UH@V+=% z*@Pq${Za}1r&#K4Q3Y+R94Q{H>!>J~Xw9+Q>ll7{toAsKePIqZ8hr9|yc6nuugEW( z28&PRXTm**fULFEdukoXB|G3FVgeVY(ZtnreaE9TJ=;##$Z9QFklzPYHO%#)Wzmwl z<9IzTe0|*|>}k_)o?7%beqaAL7NbUrb!v5=7B{;{9U-qJqzGZ+gUmgcdc;XJ%H`v( zdFqANh+yTX60VNtuy-TWQP}NA}Q^Fo=c_EGfF1agVqE|Y zjU+G@Glo-w(N%VXc$=H$V0{vNBn73LU>Fda}_FhB1*`8oRmb$kC?K9Cka+u1oe_;;-yb8QG~PB zXnsYpbIIcCH%20|hB|~^^u=yMwqam6hj^kC%V}*&BKh%el_YMtS+?VY*4|B-hF?Z%G%-MuHoU3Di4|}jk;5u3AgfWu6s=~UNvO=2 z%epZz&~sqjM2mx)jS^EM$9+sp!}i;*(R_r-hHO))t{q^tS10iOmnmy=w?xvYQkY@2 za}bPR4>mT{Hh4h-Co{z-IJ@#QNZROL1RvOWHclVlRL_|auM6U!sIgj>Z20uo42aej zwoPQQ^@c#s)B>j8>JIkpvI_tda~MA?h5|YsZr`-RRuA)H1}c)Gr7Rb>YI3-4`ypGT=(F=jGP!+cyXI=blH+ z+fX9H_Z<8F?X&s_SU%7SP45)2rNHg#5A=!Ax^g-G_^sbWE??-ZX@T_G&bKt$KVyWt z=cVg;pY7j#diSD`xwpL7Wr?o&Uyd5lek=FS)F}&4b4MYd@a-aQ~~tSAj+t z9-MJ!XD8P(UzqK(({3)}?@(B%g@k72gSi3IkF;hyMK6WJ&gz(en;v={y+*6~Xb1llQ}A<4`v^c^bxpB~P|KSA|%C+{x^n7z61rkTo{ z7Pwc73{TL+qKkz;v*99(mJ20OIqD|Ond)cw3}atgaAvCA&+e_t;HQG6eRm`2KRUlY z{Pul;HPZd*xtXWEJ%=0go;JQ{Xm@Q|KO#_xh2;*ju82)~Z1vrKDpVKmcMUdL$L z;?hy9=MdnAmASy@uSr4{a|wTdFYs@HZU{mcj6c>knNP^y4J|sp-j9gZ;NpL!TS;j8-P7=l zT_NI1UFu!-*S*#^cRbH2#f#`*xwonAU8e5=>0bd$_l9Q39eeSkS)IH-Bemn)hF(PA zlQUU;+l&;3JR#aos8;-tTE{ia6gaGWbSC=mS`>259`8Mw&Ok<(Y zf+Yh1?oz;uMo_QFVBH5uy*1&tnu2WDM*k@mo;Qh(0povR;ZOHxf68g-Awtt8pG2eJWeli9cA z^*CBbp0U)+k85>g@nS@f)hpy)5v!k$e_OL-x>USz{739por7XlPUGb@`}>%GqY--O ztwh1CZD**eG1zZpm5{bn$nI%;>SKUivc$we)Wg^jO|Md43XYfEPHYlHoK2Ix6s zRq+=c{jT4nN-1z=!K1-!M1+A@=yuP z5{#7f02wgq{)Dat&(EbRlR2+)GK&MH_8m8U(eZut?|QXFMn252E=9dPZy9}Mb}?IT zC%qp?JT%2t9%X7He?<(9kUF8Jf#cJ6NfT3SY+2DN0gnrxAe2)#D02iJJk@%4O8El# zrQcaPCeyK7wgrp=#* z8m~jHN3pcgM&Bpa3c`RTXabQ*;1P&BLJ1a#n_%nJIt9it zVwB{ABF+JT%;G+HD;)Mf1$^`jf*!Q+xhiT%Vq$TuK%|FR6&Eh>R5q0`6{mt6zs}{@ z=5t5ZddhL3RBqM)70p)5knze37qJD7Gm;xv5(&`KycUNZu2OKtP5RE^% z!Qk+r9>>66+E{3_!<}K8#=|t}w>*W=0<)uqOHSdC+)5EM37+CwGQpD63+P6iyDvkH z3D5OI8wk9~+r9C3^ZZX${vMloQ%!8Y*7T;#WD~giX2?lenL-UEFi=#}rLaO8gjm=+ z_7cgvj#MFSq>cP3yGsBSe-I^2zB4BSt4ZuGq8QR4PGe&)YL-IOO(m@SLXBr687Rd8 zHUW&rueVT^C``jJ>Lt#W4hvxBM@sk<3&|kRi<#S%s4Xzo^65aZ#1{%olupG?w<>>! z05>*^x?T zM0W%5nkt%dgO8}>zt(X7NCv2|_1P`Y>Ux>8xrO z!|;F)j^8z73#vVL#9IVr>8#L{^&h<4?*?So$fvfCX~cg?lo-I8WzU&xIFKvxw8n4j zmbeOYoPH>!GSj)yU{DH9Mp^DPBQDW_@3m@DM>dUW4AoqNDc?ltk^X9^$uvfpxvF7` zpb?Krl7y5A4drh)Ly7U{bjR4oL2KT54Xg-L#Hn?J6#^`|@O#+oHT56htWRDtvzNotI;_;?_H_2{Lhge$O-|vEBeGYxtWQOQ zR4`mowzkqSgCwS1{6kb6dzZ8*a_@q`t!dsdu~8umks;lPJ&l;S3P#S$ykzOheGo!*JL8;2(cXn$BvanlY3>t2lfz(k!tQBs>=eH77Yx2o34{p7k9cKL$8kV; zn)o=$cAHp;GMi|53OCnuhsk6i@EuUFm~K5ga-B_RLl^i7C-Z=d<#JC9)B4hGl)7k} zy$L3Nk%B)iui1z^F|3{&9tCWnk73Dj#WKih#m~bkEk??99_VUl2;(^@)2}4O0n3bq&#SWO}<2C1-BA_J#c*Y_?N;dY!G zpu+cg-xY_rioJ9lf1$y{wu@X#;ss0H?Hi8v<49CZcb&wBr*4%0L}as-4Sl3TVYMzUxoV{v=m~wAsRYX%5dOtc zMHsW-7N`fE8n0>$1%|VVfjpQu2|t<*_S36hG-**n0_EhEv8==K7<`C|90@9kAF47L zktp7MD7YqNm*p7%uCFUoO2o_;|CSap3Egv<%g3ZW6WnK1LztK5&|l{7Ih03Co@CSy z<5JG_0rt%-OigaPBSfG?qSub9?p;erkl+5G-eq1>JYbLHZQrF{r&7n3LIN{*3>scd zNiT>q@8D(Py{}rVE`%g#j#^}Okp}6nL;ku%{LQ+s|JbqZ-oD1_&2{e9;+|S^0Gr7q zvBNZ%rdDj9zS8r0yRSc#{9Dh5;2S+y4m2P5sT&8j$jj0HIy)ZM>|}HyI`GTF9&D`q z5)C>lih*n*k>*SgQH7ZXI7ZTNa0wO$OXos*Z{D~+ynG5~_$##ZnWuj|R%+GuuEa(Q zUXbaI?{OZA67uq}TaU)diVO1ggPIaP8y+R+K)T(7#fqX6$@j}GDvb*3r9RNH`#i(J zCuo1RFcx1g=-4BUJvFY2v`8&G_Q}`ct|~YsMY`=n{BvXk)!#OAAgLPm6MK>tF^ee{p=+j~l3$mq?r(If(bL-9^nH5Fyo}}W2-@mN zv&VZN?TGo$h8CXNRT6xRAbiDGPb$aEAWs`(Hn#TAC$5q|t7u23bHc=BwLUD%36}fetCeh+%ftTJVs@0?4Mr~F zFgVltGe{QbIsZKD_zVt*yv0EXb>MCNQbzffH&E!EliWJw;~N{ClxE*UuMv@uZ}um~ zFLl;DT^}61E=@yQN8?r3$vaCP@cakVMfMvS@71{*^}#A!ydsJ_wdt$dyxf}!2Bxy= zo4$t!k?YkMz2LjETV!w~ZL)nRAJVTmXf%zTW^}K6xDfIx}L;SO-@{? z$Sde)Zxqn|;b+$;d2z!-Cwp6RdB>Amff}gwcK(-aHTyh8buU%GFOr|DABs|5rHIx) zZ8IT!(`5T-+&p_#E+ahtPDS`!!Ǩ^>B!X)StW5SD!ypg68E_sCrBPT4g*WxMp{ z$7B3$Ibk0%+Ayi`%L59@B#$V1h z3*g8f*~l1H8=JXKCBo1O%nd&PL_ja$^u%^PmC;wG#&Otvg_$(Z(Lc~#sm5yproAS> z4h;CT*7B)|F0)A?G^r|Q4}G51dPGmHe}^`iKgEQjHAxM2oXkBB*HD;Ao}6MIQi4hc zW-^NxJm)Lfz;JMacM`R7X-r^(OQ-;;GFd^3KxgT04WD*i2UW_)$e&h6Dp&C&g+ZF2 z5i>@DvEu&vs-liJyq%_*1x`7Qys`!-__C`z>En_C{%{ylF)xSufqwcRQ>|Q)bX8cL zQ7GiXrz{fO)o_afrTDtnxRRx5xYof6lSnDRF>WO+@Y78f-}Z|yRXvX%%mv~R z^gyY6K8;3;p8*`~5)PCeobJdmhFAldv>mD2W-FC>)V4jF4}^ilmBz z49Kt~#HtwKTe>SstyhH9>D(Or$`R>VI{2$Bq6MXhla+xOLk`iCM#9o&B2Xdy&Gyu3 z5-X?&Vw{}ijJJ`tglmjFw%`BI-KDu|^GA5xCMHoZ^oiVrvcgyQM!k0_tS4m!L|pI{iuIc9DR735^XWb~i7Q*91kK_tzhFxCEq=3G<~R>` zox9hXZ+Pe(L7VJg@OG1Qmr&6VOUdH`^?v|&@*{a0f zp>rip!9kWU-_MYkz%n&wcX-w%yEJ^;2fyxd3$_d{9THg@~b82t?H6O94w>A%?XAf8n88y?%hj6n=@jRAAga+2xKod z#|`RZnFu{GMJTUpj^I7XPMHFGlJ+>f{#)^JU?SS)E?aM?*+nwk8^ZAI1VwT%Wtdp4 zVV6AP6O^>a%fYEd#Xq>*rHLhmYN)q-56h{59cpQgBE+Diu2Yu>@jp(QhIl}2w5BH^ zPB$!ho7&iiE&^pD^3#{kaM);1&dz-$4TIKbT$fLKGFs#Xb+5d*)R zQ-$$OW1w}E9d;2ThgH%h6K(s%qZFBz%2kT9WDupFf7i^UU}n!v30wW_T2LJb>nX)n zd|TtbrH*e;C-8`e?7T1yKn~?#JPOFyuC*RVtShPwgGQsfr!r!K-WJY37W3zJbP+533YT!@Ze>&%YJEBw3Vw z5|TqQu&UumxJ&U-)bu27upQt7r|t|gjrnIwj^Q9Ma7!kk68{#vyo$XXZ%&vt9BSM& z0&E{9PJolO#aikzu_0(+u5TZ=534JOq47LZFWM zVq^vbJM#vxw(rFIMxp0M0r+8)l1Ps3DHb#KvRP!pD0(4W7W&~KV&&QHpWyi_@5K@Q zEOM^@c%uF*b>dj#fIY^W_{SvLDx+XhDWS2e zwc@+y!DE7#fQRc-qSAQJYg<)=0JYzll3)jCk|NvKN98NO$bV45Ztt(#gN3B1=Vl;A zv)ENG?FH2KwPYNVGNysmkRHQo`)Iy~lJMSx5`*9WbsJgK>tR2AWAlM3_fYzyiEG-y zUsX}f4?_`t3)x$Hf`Nh`?0ey*$RX;O<*<^%LrGIQbzUWF zRWP=hgMZ!eaC#<`ZWn=@huT?<0R_wD{S|_14vLxNxU&s>;(El}hGUNY!G=D@y-wul z-T8~`!U>+0rdE1b2QE5h-x+Exo5Elsz3F>~mW=KR1O5;)FJc#S#cwiQUWSWqsvz$` zYMkt?fW$>WztD<1%13D1f*f59oJ4bchA-Bp!#UKv_adKGbe2mMfn>+Q>B4 z-l?t=rpS4c%*vP62le!xV*2tzuzr#drwdm3rFl%gIga8V7)6>e)9MfFu*R{cEj095 ztAy6uPGlTbaY9B@lI;TU_!|orr);*#aQuxV_L#(-dauu+{>!&@gL6WCs4S)_Q~fww zozHr%_jKM*XjS=5M%UzKwN3eiZ^`k2x34zfxA~tcoJ84hpNeC=Qopf`wLavIFHF%x`6w%vidAI>vuwKqpZvLq9(|xxi4Y6hcAZ; z8r(|20Z@nW%b1G4OVBW_Le4w&v*_?FxkMi*0`1FPQgsy7u3JbT{dy9Ymsi?Q}J=~rTe)3dPekT<+ZVP>5Xaq1xu7dD+y~nCVI(%#Huce zRM)9FTjRk}aEJxW>(8GnxQ0w$QY9Q=V+ulGf%%E~2cMW9=a)DP5-L1A{Z9pxl775o zy%BPs1GeCl()Y>*{Wb+?rbp@*kpua3 zzsFW|%_tYo!nXcUiG44)j^_;mbup1=7b(>_9#4Pv(3|kr*5XNOrv?^L|Uc$I@u9(gY53v4NCUE8KRyh)^=vVqzp+ulT;UDf!fUN)-dz9k28bUN@`q<6I zgXZuCvCzj-I0>rsZR1h1GGb!ia04g?MVjPOj(INAx^?dkeq0pgs}2hDqE@*j(^yVw zr}dl$l01W~K@oe1oftS@t-GqrOA3ucFO-B9wM4|^RM}}Q60x%^EAW1Kjt~n!62H)> zSx2g38wP=3m?kP|h&rSDnJ?o4EuNn^kx(;zPb=pzdv|JA?x5Vgw@qk_(s~&;uxU;s z%Ir}UXk&ewYtOm!6#cg=LZ*`HiqW25oAQNVCq|o0J4Lnf6AoUcF=e1J`L6Gl_wQS^ zeG#@B5xnfRh4H_X4VBU`+9%27^?cTZ-tX^lYNm?GP`?mlxzVu)vTYwBd&s0zS;SfHpTV{;Lz7SDaHXjU1l@-Yr6#|c+pr!#M5;X#I#YhaVm3l zkUS(^?VN$Fu9xDF-W`FVEHyJlF+!KE4)~)b5iH2D)`e&5F@A%-Y~}#e8DBWWSy6$o z%`g(jDLf?B8={rYDIqRurbkCofOLO=FbANPrR*?7YWV|NnZYoOhY6#i!X~?!d?C7^ zBe&>I3M~uyChLf8$dFJLUZREs3dAc*ud1FhgNiNe(nh;cvaQzv$g4NV6Gcu~VnJY_ zYf&(Y*Jzx=XsXHlt~SmX-bA=|Eyp8nFPhR$%OMSOlX(3sUXA0@{D5;l&#e_J|C&frKgeKM`Vq!tQ zJHxDz;3C31I0Mo_DKpg1bz`?I{pIB*Qs^OI&ZkvB zcGap#n&7G9#$9NVwyTT;@a6!bC|gvD1&x|azno%RV&K)|kJPE3S@Y=u6{oDml$Frh zuYr=l>-<)Tk98EL+2GH(F#1<$<_flrd{U7Ru}WlW>6`DxcnK45(=A*zhwIZx_#Ql$ zc#3?T%vbMer=I}s_ z*|6J$g^3_h7%~1;cBHec&AOUnneUil2XS=(=?!*Ym|TE_y#FaPGb@Sad#7R=`e+zZ zuB!NO>TrtOn8vP1I2-?y7;X8 zCCu*_5@Dm|-ecDRKT&_`qQssI1|0~q2GJ5Y7ESn>`OQa`=t$N&J`!jZo=%YHLv^tu z-F&?l4wOUK8y8L%5KV}&mpIt~mxs+4-YEY{s|Z})))OG&y^btEYk<2%1=1bZTDgFW z>w9DBQGSUN*HEB;;>}J65%$w+_)=y^QJsMmL|rWTq?Hq5fph>kbwpU^X=|UtS*-=E z#*|_>KESB%!`4km#>H|xprun{eM^r$4fIJ@fpSL=PWyz1DhpOt_aKEh11^1e4JtW56)-vUT0#rKr8MHO8FK zZ&?c6SnyQ3C1noy4KF3yuF%e$S9z^O11B&2O$N8fxe}P~T9HLc}Fv+!A2O%aqr zF$%_ux@oK{p*n(RbEo0b-?P z3b4oO!$KfSBK{JDa9C_e%u`_s8x4Ij*q%ugPDdw)hGa-^?;WCKbDo*7iT!90|6+A! z3FKpAf&fpbwySj)Sq#wxIZmb+EE~WYogZ8#kL4n#C_QyqPaO21ajTWPwpRNiE>K^q zzfmx~bsS^A(nyd4u6;p2BPMx?D=-Ew9vpe}(OVp_dn@FkNwz&77ypskl|{Ptx9A{; zEj|*E2#%JG-^>Ens{luOv<_7v6*cfr$@^0)c^?3%JuLDiE&*m&C5q@ZpFntM);GKJMroYlUI!Q+ zX|k<8%REdA$&)9z(zzpgtRmMI}lu|dNpbvk$4E9rgJ$6mx~hLX;gy7A)=2# zDSVAk1rFAtodWGttBX;B2=uu7^Ev4tIy6nVxNo5lnKPa%ebOqfcK|}^6aZ^7wgSRE zNm5K=K>=L@7y3U?>;`^hKl_L0$5l9^aevBwEbap6w2m~JTlJBSy&SG76V^h1(!wF1 z%-G?}V&?TJ*S#aPVR@nrSo!jkt;%ATTJ-JtvNtnlw=;(aTNdV$C$lR1FRNPnL&!lG zA#;1muO(w6l^7RBbsi@1-Qd3c#M6YN`Vg%dB5BSNE}D0rjlHZ&6f)(&gBc7jS?6Q> zy$Ziwcrssov#{;a5zBpq)im#hx+z?PT=Z}y^5IR98s#52!r-j%h$J~$=_js!T!$b{ zEh6>(aZ{P55`n5Lsy^o`|7?T@Kebiq`D&akLxyHun&8nI8Ko@3FP4)Yx5ll7_e%MY z0r_gT$p(9riMKhZb-~;mUG(e6Ro6%^u&NK**2JCKMK@5NTf;Wt=cW0&6hdnhdTR5< zX&X~=xPsbd6#cKt6;Qr~EZG1e&yaZA`rg=>6}jSD0C#AckYWEd_QJS2NUU4qOM>gN zw&epBR?1(f8H=ssltTrgu`=EfdP1vE0Vtu*@nwuliTunW0U(f$;hBQnuLf0u*$)2X z(T{EX(w9^31gqrR=%#*w%AyL_ZMb}~6yxT_I-z20k|xD6wy9T%i4>UfTD3L&w~Oj% zqi>sY%{Y4P%4CpB<`*6ci+Se}vcJ%tCv^-|Zzwi}a0)_baER`H+)P>688NEhy!auk zl;E5#=K?VtgW6#`hb*IFudUxs78EhI7Hl`*_5aXx7XEbp{~PD%IHtS1yKD03Zqqdk z6JvV1+tJN-0vilwr@ow*Z2>b<@Rde>5dCgu=wgps%+mi4J3CBVbbE5?TR z*6<=*Ol4oM!FMS&|AyYZwhtA#ME>m7si%ph#+AdbH7;vf=C2h!p?C<|E5+au2#ujU z0hZ9S6bTFH$vsc!Fo(;|puLjy4NZv1(@9It0u5E+=4Ha?R>nH*z%trrSDStr-r;}1 zy^MyFZCPQJwgMklOx{IM^T{_p*D+0RI5lYsk#nqo>p#>;rzSS3YH1{ zT5cQKKH56mdaOg|GUolUW>01OOZ$hJ zyNp#i+%(QN*f!B_4!u_|2G@^N2VF-Nc{V3Ns>jE_AHz(uN}29@SKcDa=wh0PE`mxO zSV1ci%l7}lP?8~*1R2&4-(Ia!a%@!65H_Q1O$6f&<3e|_>CA?}!2upE>0OgDHaTh% z%@CM4&?OO2^_y_Dmn{Ykg3R`~blDn(o0XLpvw8H{{8#WF0mj|F)%W$lPmbyb&wa>X zOQHuNmMNl*0*i8+Z_bYmNMN-(#jy=J_M|nUATfugB?N0K`&-$ zvkM3Nq10$@u~fcTw4!+JCqV>vCdHsnQ}5pifLq&YKUp+x6UYJ>r~bX9=paN%-XOw^ zV*1QbH~Ap3YV`C}Rb8vdi3p1hyUMHB31%F*N!*e!)g{|K{7^F$Z_q8h#UiF<^aO)- zR2g&nUSBMSYB`9Xt!`;w1w^RRFt7aqQj(al@2zF*-T_Bj?n{PbV)NMg`6x#(HO(^A z4xM|xjIyNMBqzZIl`jQMh6Seo5X%?GT=ZXTdOFUZq}_A;waBqG$2&|BGLSvxLm!HZ zFn)?ZKh$N%8)`4N6*)$v{`2i{XB2ox(w^YZE=GqrwX<%I#uAwOCUJ;g|I6aUkYv)i zZsRb+lt$ouCYp*{wDrns%^fP0HT^^u-R478>&qr9fBq!!;@sz}J64dOvGvkNXVf{M z1JiNBG!7WOGTGd;9d$LO2Da@kxVG!(%U8Tu~jo$@(&X9FfGG{W~4OaZH-shZ@ zf{Kwy%>iHvug`5=dKS>ci#?UHK(@~sMN|x8=OoA|PRo2p0)R9PL=hOg%A-hX(@K}X zE>|98q1WQoYXu6dnCnX+hgA?r6dCa|=y!&`W%7iO4$4oNY8UFg=j$0FjquokSSicJ zSSFe?B=MJ<1%lcRL!^RLczSf)j1C@T$jdzd7rDeRe+Z#7^J+#3Fh|oRII9W(Qo_06 zTRVSWt*6DYoHBh#jB^td9u?SbRCQ~m0Ur{H%WX56-S&pL0-JJt2k~O_^x*WG3$8Z% zotkH#r2jE+`9wEj2tYSCw-75U`4 z41AO+ttTV_nK<>qKXHP>e~cS_cA5I-|B3#G*k=V)6IK^DXM;0q4k+5{1q`(FZ4 zX3-fcY$~@|CKE16ER#*5oe|7q|77p$oS!FDlRHz?r&0a7WG_JW`Sj74J)< zb{l+VO4|z{$$gURG3^G*mO`#2`D%8EN_s5^Gr;eHN}v0#eDnXWYPkq%(*^2qlG%iJ zdg%tzG*%4)XyT@EnU`vpfnaooV0iuzPG0XwrlOyWz|}+NtQVv;Ue)b>a-8DY(OR% zN2M*+TFXa$ij``R3D7+rZK~PR#JnR_8uZSY;~N8@1Kf@Vg-I4%xK*v{?alitLf9HK zA@IRab(_HKbqopnG|TLZtXf{Y(LzUF%en$xJd?0M1`$F8caLI&wP8kWXtwm;V_Djd zAv=gGAverCSO@2z{bUb^I#yZvr4m>@%PkX;e&xg^hWdOO5WVmtCoYJRpp0C5d5M1wHGdqkdlUh^lb15q8!t?nJelBJ zGUPrkf@`ayL3G4A0>@vKDOaxRO3=Kk$)a~4hAOuP)!{b~*|cK6+m~|(e_SGl1-(c_ zSwRGfn+1ZTjLFNp_CjbARh4b`KV2?rQGIY&{I=&#S!HkPaymvltS-OLNI+lthF@9i zKsVBpYCxuln|?Ojj9i$qnNQ1VFtf1OhF|Qua!cpY-y9R-KMJ28?Z2xNxZ#wxM@oRE*O z|L~!=Kn%kOpcS4t0Zlu}`n$nC2h{iqIde85&4yHDOZY|{#deoX3uYXs$WF#CbMI}W z(`kxlT=Ll^^t~?h6Er9L$b%`Og4p%$jM+$*H3pQeQ_`zLKq4KyoVL{{1WKLG*ord{ zg@~E~!(m}kw%9br(0mD{B(9yB($Pa!IHFbkw1|AEwQ!=L>Z}{?rG&YT$&yK_Tx}@( z9uf8XuS@El1koMQJB388j!1g3`nPW(C{ijWP|)ELv67wDnuB8Kd#3BSW^?JPM4?|~ zGHBFPVuXCdGJP>;Ni2-ssY)3t62aoE!klfG6G8mNXc~FQN~H8UJ0yab5#-=rZK1F#gvG?Y^yP z)%G6Nl&9Q5gSTH2ved_kidZuqf(tzIfnswj;F~FCiSLb~-QL(D9g-b&OmH6r%Rj#s1&X%yu^arsuLZXpdoOQl2mns*xF7Afd zNZBq2?jwhD5nbrRl68htv00mqW^`>xGsPk_LwLI6sOUO=^*L|$=SV?2#vi?PHfOml zWE~)SA`TiL8n~$>vr0>TxF%A1!em5lYE=(uq{3)E#LNh*H8}n@9_U39t0Elcse^R7 z*dzUC5-}^zK?Oph5mqhP9Wp2Gh>5(X0B5|9x2hAoDY-`>!f7}i@>M$jUHF;k%IeS!AWb7|SBu2C- z9$w@T>{2`Q%HP`Oqb3=jXgtX46%Y!NZtAa1_4vYJ+f_Vshc)Z(=*PyS8QC$}7?bQP zsjH8(wCg%(AW3UUO=PtFn)_{%yomS?H;m#TkXr={Yt|ZGzp2xJ$eUe+nFSonMlVAX z3j~bt#V*!Hqxk`D>7*TxiocDSqHK9|u1<2V>&SSY+#X?CTIxt86=m@9nAyBuV_c2$ z?6#h`3#VKaE62GEEi*|d&AxaL%ErS?P6TzuRApS{O0F;R?CO`}u@WUX&1!`bczmHH z=cd|uKWvS%mY8@2`o=Il&i=8&U$)*+Dm2{X|Z7@2}PIL1zku_nEQ9!76;!b;WL9 z9OT#ubRfhTGNcyG#CY(0hy|CNbyN$M_N(o7`$bJ2j$1ew9}oR%?xWg#1Wy#B`jB&; zk}Z~<2FZg<_(9(vV!s~-=*Ah0D;l_GwzB@HBG%>Llz7w3Wa8^x5gDdX)lga8eQ`y0 zG)2cZN0xH2C`%e_jHJI5QTJuf-MHSf?!znggxOY8f((C17f+^;^mn;Xk3)=wz7tSN z%pIO=X5rwl`D@hgSoa|CYqKjPAd4(8DTX1H-K7FC?C<|vBuZn zW%F^k-%u_QH&yhu->#vb*UqK~bTIV`Z-cp@_n9NQB}x}gUuN=k39sfFb zbr{z_=~!xOYrQE6-a(r)iTR#y(-5o~8J({+rX^6_v#NRkWR_%QDVO#vD|_ovL8Nz5 z$7_X66=RK&&#CI7RVflZe{6eaYvR;mwhi|BF|(_tY6f5R;F<{%s8XeYKSqfBd})2x`sK>|$nX9%Hsg{uoCvgpF90)xbKA1m$j&lxsaU4%SvB(O+bD4ab~G6|VX-Il zon)-ntjq(GtGpP|M&zG4aU#M>7nL2%uD=Ho*%)H(!O|w;r=WojLlu6aqR&i>b`jkDfROA+`_M_5Cd_06AibN#6 ztT()@TT@;Wzll6IDs5(wzaTBc^xpVIS|6XhNxc`~z<^BpK9>KDMdk*bQH z7$$$d|1STn?{QVdyxAc!#K9e6*d_NfiC3$svM-*&I*t~P)130PMe{PsXZ~`gSpZAwdH5nopXOFCYHJa9dn@ zi1Xu>i1kX)Op|t`BOudaPEIcIzaL@zptN6iLikRD>;*_)ZCU%O2`THlWht1wr~a#k zqSDSyK!kG3CdgRC#23%z?hJuI^&E8>90~pT#iLf3qSAY_h_B|j#h&Hq@O3{jI>Ud@ z3WuiP@i>G;G-GqLgb9hs!#<;3hj023*81qIIi(zkMU?qveA^gil_!4*QS!TRPZ*@k zy`gaP`StvjuJ}ET2jZPN;`rLLr~mB`ljIx*0YUOry0T1*bPbIOD{Wp)+66f**XJN> zT4)4Lm%p;Qm{;b1^$v=oWs+3$ z>zVQbf6ZvCnd>d^HKu@vj@Mx3l*tXq)!i0M+pmed|9*%O*u_O)O7Pwie)*&BFb#Up z+_<41gmX_-fYU3Cxd32af$IzT%Sr^84)n7LeQP<7WOVeN7o=Jdtfa`=9L%W7vLiLz z-CC2^KRn=j(k;6+-=PLZR3W9wz2>^n(U8HPZ}x2D50eQ>xu7C5`;OXBK~$W&Zp%wNpLEF_Gzmr;c>j)l*CGaK zh%9L7rZ-o2=)ZDmLt=H#DKUuUk%|g(AG={lZ!_--c3+TyD@TtNDjISaj%fFdqeaO< zI7U$K*5U9SkYqomqr60&AS=nVp1TK!5pj4^9WOf{%#m^5dq^D!G+Mn58N*UjHXexW zF;YhglxdTF=p8AQ9x7N=c+v-tj#4WBjF_5Tw=dESMqMJGbqMi)LZ6F&l)Z`0D2*4?MF2 z{k+-wkz!xkgHfrGy#WwdtaDbA^S?aBJCBPbTHZftVbzhW(e~TJrCsP{_I-l@S|dmW zl3gwnY=??68=JyFu23$Jy@mQvpY`pa<{Wskd=px@1C4vB(enO?%BQsX7rPOL;V~Ic zx`t>c3Wf046#;|!cY8GoZD0p#zQR=(MOiL?38|qg``}DOVnIH$j{&?X`)WhbOh`YC zLP3uIXd8{KZ}M$hBza7N`S(j}fC+TQrZYxvLaiuJnj*CHh?LEVa}#X4XNYS<*mUV* z`CbJ|4)yLdFBIgb-qD{!Jt4FqBNe23Rgzzq0(lwzozwYz!>|HxZh<@(zN@WnGEwbNhOtZT z>bSn?IS*(+U$uAWP%Tu}5qbtVg-!p~*BUmqZ!iBV_#&D0cP>)OA&1V%HGjzIez9wR zJN;`nL)LtI7zMmo@=*o&+e4w{KR}MV10=Edab*ESvmw%^aRK>3kNj)$GtJ;YRvPbB zDh!RCv}j<$6ToFsr=v2sccXWpv;0#m z<-TorJH2W_KA@EQityA$2*C&?mU0U65YtPr(hYxg8LqvhAxSe*`Om)eUE@H=FbjfvV*(XMcr#k=3e*yyU zH*DsAVjSc0mcYK<9hv`q>D;J3#3b(5#UdSOiXtF$#|~Dpr5$|>wEK1Gn&U1dSJM!q z42D!;={qDx^OQwIv>`22Mu)Cc&U&Om;4&77%d{wq3_d*uUX2^{&L?}d$a-s4FG30* z#rL5)+e=@#0xx4NHH(93^bK>B&3uo_u%@*hD`>4)1X}Gz>-k4!b6p*m~0XX`-6JMGF>LNYW54iqLItkb{rliq2v-?xj18&CU|DNZI+U?WA{%LsrcKRf2So=d z(jIkKaqD87qUYet-b7mhzNoW6c~g!xS|QI#Yt+4jZNK@o!Q7?|8=-Wc%! zh`vfiu7#BYeKI(s$quL{$9i2cm?toE9(;AZw=YK;I&!FF)wn5``qc;W`pMDmq8K_H zho;TBVjacwtY#7*V`y3fFtj~eN!no1D7muOw^GCXR}!-ImPQ)4M!a}fbJUc3nwLc{ zbf5yKEFH0jk=@ue0CAvK{hR*fp0MiNp>|(@Y~>?;LGm6ovhM9;_Rcqj>s|Ivop(Bk zwGOtfyqlr}>av*Bxk;N2mCCOqGR} z`{a27e*Uh!Y{Fj)Qo66U6%yH!MjKjIyw=iUyu|T3y<&eD2i0vwe^N9s28$}Hdmh!p zQD#X?4&?mI-CQo+WFl@6(d$vZDZhEb5IP_J9$2kan~oIokJo+Vb>q1`s?J`Hz$dO? zk%qcjyU*tr|1vgWBl|P&S+xB-KNg>U)1Rby)Zr+&Ov^>vx`#gdyWemN!&q6 z(K1}Ws=KzMX?2jOp9ZWK`+PGjX&3%uDa?iMtMObrY?mP8zv5Fp=S@se%@(w?c^8Z` zG~f=W8X!9a@LWF9U{6`Vuk21)SkZ)HV2M?9wPQ zkmZQ23IqlV%+5G@5jN^=9(;CE?nt-ha!PRKni1Q2Rz>8Zv0tb=N-z#$m+{+>bciur zs0B*ebn%_c>$$=;c~x}VgxF{XGQCxCK~ay?t*O&&xdfj^>TVtntXV5SX2g3YENx^V zW!NuWC?EK>%0W$v5l-)fVuXFY;rwBg8$}r^JS(iSDnJy9ij`H`FeQv-%I<<24r7T_ zc`WF0sjLjCCqiftcV3gYWY|)+rZ@{L{y|Dz0p_4M^Fj8Lw7QQ$a0MY20Zl3i05Q~M zk7p53m>c?WRVfofiB5S|FEyvy5zzU=YlJXaLs?9;SrQ|Ku|($h$+oyV%t<6iXu!m;BzED99id*Po?F z<%zR;&hb=v?JD@7sbJx>f2tr@GLK-8A)c1{xR%a+N%YuNCvun%Or)$D;2EYT}8)Dx%W_i9MwjgR|J2uc@6%=3YzMrzPk8 zV^Om35p{uu+gu0Du)G_^VyD05;zLKH#k&EVi&lMXL0x0jkrTt>^$2Jr2U6TXkam8xLv6_F@TyCy2`{YM847734tfnz!h z?q!be%)FWgPA@%L?tQ zY4EbhIIMq4%u0GeVT8^LYurBjlMTXK_DKG&Lbnx8jJXSjpwA?I+}s#Gt>H>;G?ZIl z3ygXSa^+3bkLtEFpTPKz0p?`HvyrH?pWw1%B_(M-uVuWTW0<$Hx9YWv{5KE?Gs^Qu zM91(n{!k+PUg_eP_x-pCNPZirTfRmlC&OtZYkyhGbb|ct>H0_K@Pjm9`fOVgC?hzH zcu|S`67A} z7NqI>AUDx2%r}X=)IE>%EzYZ<7Fhu#p*-oBW{r(nCIntuoEX8;ZjEn(oFOC#l^>(3 z;E0`NgHeL^Kn_EKM@DH|o)QLn?sRg!!vfNFH1uXtL#r@p?1PK?_YrQT`ZlX0KYOuB zk)F$I`{I8^%@Nm8 z(EfS@al%lwbauFm%}duwuzBuBEx1ZKaUZfo*EHa!8AUJn-%CR98uwvCc4Yh^4DzD= zX6dv3-RU(hN*Ni}`trd#pJE_^k2R<8AId#+)Xcg=cK3~DoF;yJ`-z}^z%D%+6M1dg zcY&hNxrk;Qp%Mvf{CEW;A94a-cL-%XE^-iri>9aw*WHLL1)e*9H_R?Ou>z57pw`yI z%AuhM5qsE3)|dManX;i&F?~{K2VvX^ZZHas+m|6{>47WTekT?yD#SSY)bL?)3w(EM za&ali)9}hFAsi#KsLJiw23KFGHLFfu`1T3Cf^7RQud|Gbthp{LV!96|Dp;T6WYB9- z#GM&Uq}(I1<8>aVqCS(qmE@YVV9L4w)AW#`CuyrXWkH2E(zqO=gbEU`mgxDqMR!%Z|SkV8DQIi z6Z{7`2rwH6C!xmm!16ggDS%w4vffO@jY;WUIfqvz!ko~K!>?3R|IZcod#M_CK`*d} z9r&^?-u@^|DLis-wS1k046(A*YIx2<%cih(BjaH(uiEZSn3e|PIf<&*7sZ=Wk&%&N z2ov77$jQ)Qx#!q7&G6J0!oJX(a+fsX)dW99ke(dm2xla+KYT7Hf$vaq|)Vj-wSVgY;c!W&j>Vq!w zo%FZvYl5c^-?0{X({$w7R*kh5kOfwAvZ^lV+%-~6e4j<56Bxz0zRO^VRS~;N5g(1x z9r|4_fciTo#m`(fa#T zVLd#*j{&^ZYj~<;SxH5HZ9ITWf%@Xj-|aW3i^L5I=`Cc+7_iR*J^yuIQ4sl>eU*{> z>!9Jc4t!9@B1y3uhSs|`4C(0LxJ<$V953J9fQqml=7Bg8Rd z8*!VDoxol2OlPtbXApc8Anr`j`wh3oqOC6l<`ieJ7BKr|9gJ&FboD6O-@5HA9AQtc zl}##sJFUXgk;uNcNW|Tp$!#`sX|^q7Td)IowKjjC+{^Ia7bf1}kR^f3)E1C^fm#(~ zmb+KJSVRpC_o6*i43`1)W5JffVM)XEYBxbqlAGpqfE82CH~sje&dU)(NS=WkkxEA3 z=*JT}Jf1^2*Oy4Pt;k%BPNXE^N3X~--d{bCd=9FqfEpf2!+vY)VEXV?KviXY=aMvp zmGz_b{#bho?LPpIHn|!c)A&tdj-BZzOM|bxBU5~FT}2^wS;lwZ?q1UKTM=hcFm+5( zAZgITOEj?vgsajtAP@xR5IVNi)d0Zt1ZPfoksC~MhC^zrOC)ihm4+i^u;7#obX5Po zCebI%Zp&?EjN$(P^g=2#^3NM?txV=P1v$xVjFRGUR(V`b`L~>ecK_frKP9nS z?>`_PTHn69FozeiEmP2%F<1S8&H_}`43(b=-Je%lF6E#8y+2nkaQ;^P_;2O@$?qb- zDQzE5^9<}rW6MGtKqf;MCip2lj4}F#5QL;nZ3qGtGo!K+)7&6p2g615s!{XHgnD!dezNq*Q%*cDhQ1IFO?#G7H7Gvc&u60d9v`IE2=9Prz4kR^hS2KQuvnx3Mw>u2GdoZBIBso9tB zE65?s~BQD-7&j8+jjGft_je^~VMuR&iY z+MB!wu{0c75L7Yfc~5k`kEM0)%?$7^;K2`}U}8S+BCqNWh7izrB641G&@G1N@JI0} zMLN>y4T$t9f%w>Hkt?J`I3lvdYFmDE;05Kzxw^#%wQ$-VgU(F|Ba?{2swQFONY0tu z=(xN;lkolhdE|&@%sMQ$vOfw-)WmSdx@URgQ7@Uw4IeG0g=B^`ga_W z;whquIhH}{2q%(p974HIw=A-}WTL7#nL0~@{MkYYT-HmJL-8Sle@i!*%OkbOimc3^ zzkYcVGAb`KTIPIe^*8wOm!ffP-A!>lKj4XLrlkaqYpNL|W#}{cZr?n-hRR#Ky^4rp z*qh#mABhgvPO|6%bI1{lRf!)t7@|Z4wQ;c$sT8kD-Lzwx8Mcq0iXv5Men;wCgO~t} z_su2j@WXYg1T&}4UT(Ch&uY-uh*=Cu?y)BdU9Sm+K^P*p@mCa&-%}>Km*JC-0rgI> z^KoC*5Dcl~VlHr={&*LCGc-1_JX9I6U*BmG69yWSF6Z&}LKfE@9tQ4v+NGwrjGKzdrGvLYCq!liv%NoJh zA+zkIyWnZ)JRn_&Zl_05PBqMOmrSFXgwNN0I{owzWsbP`6OP!tZXGF_q&LwO8+2{sJ@_~{#F&9_$cQUye@Pfg( zJ&^7`2p>mWD5D2@-y|cJEuza_-HYbPC$D2>g}%V&ro@0r>vBP3x1?Ufs=B$D7NwsL zZx479|J40_)rT3_hZ znrD4~Jg(t!)^+as)a(-a8Y|^+F8-Mxa5+rm_i0A3K@X&WYo3hmod^2;`P+}pQq=6{ zz89caB~W8r8LQGc^u6)bf8T}yy|fR(hE3>pKg;6xd~*Kl(DCKg;0ptS9cUU?>?(!6 zqAou+sT>2tgT;sng*X52-UHLyKT2!g*-iR9GZA# z^TQNSu3ja=eM^}g%Qph=*HV^z0tY{j1BE=qySQyVM&h&TM^R8YQBD)PlddPXi zmVa6u{CC2MwqDLY-|r~kiRY~#LnQ1%r03Az$iyRSkfiW6F@h%U?dWP^73+_Lg@EuB zHwdNO=A->b!W=qRLpn`#s~_nN0Jpm!S?p@j<-J&|nldfL^XlzsL;kf#5NpoOPgAOw zLxpG&l;(}kf8V=h2<-l7VF+n=%x$WukIRqm2LA;L%9h`4T@fCUs*Bb4*0O0c|7Z5v zOlRvfFa1y8D)^1RRQg6nr`Nrp!=n=KvEd3|$?W4#F^94n89ZnDGOTA>E*e>H!B-W! zjLxtzL#Pfev5qbHwUP&S|24e)%-TXjXh*$&PfJHJmrYYAD~nF#h=%SgN&oPVa@sL% zftosO!KhF=*h5^#w1W_OvXinIF~WpcRqd3In;9O0)@E}2YV9nH?o4DhmX{)~Xjdfw z{ietrFQD&ws3BN*kT~~A)Jh77AaSBwDsym>6#INX)tq|rii2eOxESMq!Mu~KA?!#+ z;Nn^Hjz(3TJRrlg12Fzk6#9-2^Nrr*{F7ARh~0Vk$V6rBzk3zlEBg~@V7sP0*)k#| z^q-mYJzjjVokwq8!&>G4`)9pC%7> zKy+!eQYW+XO#p5rrt(rDGFv=F&kcKnMhW6dO{YrsPItUaKc~g!prfm{6o|+3&74Ql zct6%f{>}VLhF`4~qh%#oN1If zs&y0&WP$E?T8rcS@AVH2!*U3M^U0qcB@MD=nBWPQ*kThxXIS2Q{=4G(H$dwhOuzkP z8y?65C6Bd4Uov_3y#U7Te|wIte(#I+ZLIK{jXEb=(GE2m!lWb`Pp~=YexK`$&tBCt zXwdK)>d7sBybaytH$0L*n&X#yl52}RGcquszyJ5x@Xy#vnQU(tRwcv4)&szI{42L5 zl|tpU*_1ZF$_AQ>a)KC3QP5hI2?Nr(p)5E;1O63q3V45C`OIn}G`!Hm)+%t;ysjI| z=BHno>6xfh>f<_V3?+nLT1Za|4fY%sFarJ88q1vnR`mMtzg%-rpC%g18YNyGY&?0QOXoA~WNMC>H zraUPt#T<|K!_9B`q5*6?PBeRT*dr;NV{A%q7(yKKDnna$lJ+(;XJ>j{9{;r>5ezSw zm&U?^?Nbt;w4No}sd}~7a7Ai2TzakFcnDgCWSI?xf;w`JP5pE9^CSEwK@bAIAhR<1 zaLX^R%pAepk1noi+^`E~%Qgr0Zclo_a2v)PUD*njNEdXPuu2hGv^Gb^Nl|^9dc-iT z9s#uW|B(OG#(Mo%0?nvMS=@YfAPuEIdBo~dbGm|7(hbbk{$kv}_$J3z@gH};|09uf zeUNBWo(0}&mBYad&^#?04l7hY`t^g+`j@SCCXrAS+;5BnLI)|V170887;9ryvU2kb*|M7Jd6;vk zZKgXaZTn8!Zn&q6#syez`ZRru(*B|c3kIrM*?bCPl3>VKY;OzAQ(sr6*7lZ3YCKZ( zL1T92M+mAy3#OaFuEc?l#%beBs|vg#7_&qTx}3_x2Wdc@TE_apZt7r;S&La1v!3Id zqI7pl(2OPtt_*}B#r8iNR3|Yv1TI48Ps5DHc-kQQHVgDZML`r{E0b*8{p4=G9yB5T zVy!+;tvL2zNnbS-dFB|(_c;b#?@<*-?eKrokwT+5WQ89ni;A)+Rmu5E9r*TiRLXM& zRzPdmnCsjQw)|QCiF~bjjEGMC5h(q(I8tHHH&qH9QZZO$qz8ZiT=&jn|M888tUGg7 zvVg)ez(%)k3CuHg4?j(>mfXmeQG$z7v% zQh#V4JTmJ**`F|lqx?{>7QhM@+JS?uvAl#HEIh{vtAsB>@vzUSUXKIc zpiK;jRp^pzMo=F5EcJnq(1^wxEQw(_!}W{bicYTD&AsJW1SL`&zu!Hy-kOqFrfNBzaw*X4gF9bi9wU5nC<|f2b1P*DIrO|Vh7g5$#&{%## zCvu`&?~8o+u_$1iLZ^NkR{bZUCz6l+O6s`^15K(4}5Bsw8P@e^5+ z{O{#1W=xVis(lXS|82J z9Y<<3rS#5M?sQ!fkT2g{GyUv5hWAI|U4eqT=!usoJ0AQ8SKn8ZuRY;qx+ zEi=?ga}Rql%gc|LNzObk&r3^T@q^>?fy367u2&)UHsH3UnS>ccl_k;VF(E1i$#C0S zWQ20cPKT*LmWCTQ!uNEYL2kvC<=AkOwB{R&0pVaKJV^I8x$Xcf8XmS+zlAZgJ@N>O zNI#-djqzNzYNN(A>0&usVvrE$uN-)}IyLJ#LC66&55H1aV+k5`x{E)=277TALmi%` z!D4=GAVfn-8nt}2I-Y{QHTpfplBjkEw%)+QfryX(7?~TdX6J@$pmv~dI&JPR|2=l~ zesKwSu0qGoAS0eb<6s4@s3{;5LilZ5=kFcG9C3vwemY$A z&H1{z%Ovh>D%&!RJ{5=cZ7;kmxmoY)n)LwW%bzajhf0CwJxlHz- zY|Nbh;9Iq51Kd^xUG16zh*B{ZCS(gdpK+x4;W&RGB8aPEv0i%0vD@@G{BV}g>}0vI zExtf6Va%ZO8(ZM6{QTh%0_Ca(*DD^Nilc^qcg)yzNKsYbm;~4G5YV>a7O)0@!?NQt z@d+2SFUwGPa*LAUa)|iUXApm51KnGCq&ro;5AkpTU8;(ufEn!E zr=o{wVO5cx%_}y6Q$09!$4Iah?=5U@JlUQsKW(n;3(uV+*}n*l6e5asj^97|B0HNt zkMo`~2}zuZJ2!!bu_bg<7h zDUJocxA@X1^Xk>o5) zaA)5);CJ(L{BZEXH+D$?YX$fR?(tMD-BPnB<)21m+B!`KONqZ7q>(MeGX8z~{_jVn zfU9mEi*-}yO3U6~y2krk-+%4z!4;N>wRD8Z>9}HH`-80K5@K5nNIDga!wOc5v339+9XPu2<;U3d$qXJ(7fsvp!UigFi1nqr7ru7QNi0g{PWOA}D+= zQ8H7;zPBLYZq3YPeKlT*_Zin~eUd@eNf{7K3(_kR^uwOD)hd1znN#q^PhoRO*Eq1o zl^@r(O!LN1$-WKWkFO(SMkp#p`7XYMB4gH(rdrDAoOKg2z;`&`eaqPmR6sh5`yR?t zu|ABGgi+~^Z3?4a_dosWPFf`^kHioFj`K`9O~ku4vl(e|C{AN}#^FUh#~K^v3uPRh zuzy4NR}-(@V$Xdu_aMuxdJ`RACcJrSl^uJE*18EM@2o6wy=8d|8WA$nJIJiQLQW-B zw)^7T54~Z9S!yDl;GQXGmtO|4xx_f_(OZD?>3&|}T*%X5M;|VIc2(2)Sdt7{58nUX zbi~Hs3-~;l=5GG#W}yET5lfzdH=Q{@F*Qi{#10n$0BVm4_xTR_h0YAuxh zcOd^nB1kxw&TbuWOr+3$%y02#cSnLJR zXN}_nu&+Gq^;tFGNt6R^^TcpMJRCtTa(|3rEh*N0J@h-)%B2@uJ_+vo8(fd^U z^uRwn+Fw;uko)V`;BcOdT2~)3?2&p=4MvI;B(Znd=wn8td@A+r9XID@J`(FLP9; zey45Su0*O$ZjRf7L}ui3uBlzIYMx(HCTKiF@%}7@{A!7(iC8Xl_36lpQyF%if3(<$ zFZuZ{aD*@4O;k+ST1@Fx@k_;D<&!!+|M&O&J5b`;jBR+re#Stxz~Fuys%P!%!+cbA z{)g?m4-oU-UJ(|$F=)0*Y%NXs8j8+7;P@f04Pi~a^s}JTJ3F79#xWEAEbT1FP+1(tPY0CH#2i`C`i}LZuuTxiBv@Wj0+J@)E>Wd)~;n2u6!eXp94bI|H zyrpmrBhX@;h(W@@8<_0`M=xhtL5w(MmAcanrPpW+| z#AoA{%JO8iZ;}kw!sY05HlO4cF~$z|bmK5%hYTwe@IZJ?m;%lZVE$Zb*3z!u6CXeh zuF(hC<%Kcgn6h8OL_z8rnyAKZ7MxR#(}Jk*I#;Hf()YXs!7W{s=< zdC!?w0S*pw9eQ?i1*X0CXPIXxf6x-7?n->m{IV7LSS`S9-NuD=pV(Gr7dFCEQ8ZlF zk;3iq*ql8Dk5b6qE2@+1a|-jX+MY@YIyq8=8G5joSGAY<6rnBXpI$7XRcacY-A?vbEFz(-l7to9Ea4Ux&7Dx8;q(2U-8KWPp~OLko*U5HJH>js^d3P+@;FV7vw}c)h z%@aL27K;XkLAVXXyln3!zDv{bSqpm&2Q1+ z*(2b!xc8@0taYsa6O5wcxZ;n8X7Qy+2$?cx@!`e@@fMlJ@Q4tA$opm?!#!)$ zKeM*HN`WJi?I(KFH)($`X zklR@zh{y+8bS6T}3WU8p{%Jgg@?Rk|CK{;iTFc^6L(BJUwMkBR4}%O05v6BlBhIZG z3QvkzNMce5{7JNRRRk|GHf@_g&EXKa{^wV+7Fq!&+>8Df$ z+B)pdzg$y&G_ z)c%D<+XbR2h49ACL1nY@Xw+~Ea)@|dgUKaoxrUiyVGKQCui#=T6HH}IJd!VxBv)2q zb3+FjW`gG7SO$aAHGwtnV3|>dR*o*e`6C_PW)Zoma+u;!-#Ix)@qQjlbr2ioW8538 zK4aB?;m;~og&mtc%OE^NE*P!!OuV@h+eJ`&1XDEubPD|UBn}I;y6ij*&`+O!`<5Be zjgE-Mb(j>_|K68WsPU+se&g)UXQgUzmkU5X4YZ%S@d^%H%p%>=ba z)5aob45Hyox0a=4WZ%4eMxhHOdB-<1pzCHB!EW6?x{8W*&oc9B*V!y1_t<>WRIt*p zQc{e?aiDfwHMv`KI}PFXs|?fR;4>f}v#Ly71(>X;j{eiP6_2-J_;VSL$y?$yXyV8O zn`BGWqPf$9mtu%C8Z7CGG0tFVW;G*LRlm)Po`b}q%?q>BC)ZY19NRUq8a0V%KZ40E zAB?_y7`uQ-yVI2~z%*;Tg?AN)H;~GqUAWx&n%2jE|ABY=a6}^5J&tl$>j%HZ!KxJzH;Rak=?-;%9oF-(S#8yWw zI|DYvx(Vb2V1Exs{M9y3n}%hzmJr+v6+{@>a=ago7|fu}l#Bhi4d$}& z19~QmFNW9#=iE@t00*|HJ^kQvaU-uKoh18k3OpE1H+#+w7|mQBaaCykY}e)y%A|0s zSpJkD{zR*x&+Byo!+3jOeTbHQU!8VMeASQ^KaJlz$8Q>i_i<*g{XQyl6&u=Zk=iPx zP({zmS(|19JXwx6rGw8-@EAssNTpMHck<|tRMn_?@xOM)w1faM`w$M?&9h;c*{S-a z3E4>+z*p~n9;N|8mMF6?gLBN_>!GGQGfi= zRg32*GeoV0y=4@T?NM3jv(Ed?&TRN{_3_q^N!~EsjEL*>xHcN?dDZhlPY>~wE(Q8*@)k=NS3-nt9giBI5XjNsGTxeHC^m6iM0$iTD zUkY1C5nApH<(V%~%Ed{w=;{eV`=SG`)PzwygNt~`ZQRB-$G4b-_?C6uNr+ewEk|Xu z9e+~v^`W5Qgol;;C)oOp*zs(X1nnW_Rm^u>Juwn(E)@@=LL615U9g6n25C_l+!$wk zyzzPpEoc?QDiI^?f)o}es2GMR#7bCD1K0>pM1Lyduojg|gf65<)x|E_25n;5XfWwK zB5mTa7DsXc+3RCxB!5W-GjQ%XE&86&>Y(;cw1hKJfe%flpYGJzq8C0kHg2uNSAJ9T z0o0V7Zq0S70sCRFw)4Ig^UK!#-?TB>_%@83TfKF&czGFyVs(tz%)Kt;l^g8VYd7z@ zrLjEa+c#taoNnQaFC+z$a>TiUF+%%EM`VMKo0$Hg055JZO|)nTHE9exoQTrun+h6M zCge6j? zbiSSoVZ$h)9CygqF1+3%}7G!U0GywwK3x4uN2mQBhlwa=WQP5!VjS zbBFGexF#{|QZ^$18*jW;^Dv315tzl55ucY8Q+r*^foK&Q1-PDJTx?dOFll_=z7^`~ zDV?lEO}z+v!=vs1h0zt}-eL=BU;Q(HdlyQ4Y^kT|1o0sGBy0RY>}837ax@QA-@zTA z2sZEx26y}C$r|)Ytalz|=s_;G^MM8Y7Oarfc zmbZRoc9AKgREu`V@uYJ}TDxYZx2F*6Dz;`)+Rf%gZo6$ak4`fdz_?nXgf1&I!W+w1 z3dsIY#OO@r$*KL=0>$1$E%%F|IM%ciS|{tZ9A)7Mf)>8yS2=mwAj7nl$V6*jcEm)U z(t;a|I+j#P6R0SK;qduTz7zsECA|_9BAtL7Hb?rz&es(QUFy}jPn%NiPmEm6sxlE~ zxucg1jL3l1(WeWEfeXik@YF`%gc^z`7nmOpU}i>gsK|n`10rgnJB;JzPS?7I#)i70 zgZOgvv5Ae%1{7FmwO#kELSQWZ0Be8?c!^H1}6CyHM6 z2^oo??^eKVW3SGcPWmbdtgbJIbB+v7@a+{aF;!yL9?9unTZ@Ccf-Pt&Di^-+AqW*p zfh&^V;MlFRxP7=x0<~CCVpB z=x&TqUw7S64E$+I=hr9iYX8?qxAcRH1nl zAczTmcMen66CT7_QWzlnjF)LjK{4Xh%RAKMy&<8>TL=s~alTLrd4f8T7H6l9t|v&E zkm+e&`t#wq@PUD*Gj_QcE+>M3r?^yd0La>+t%= zVI?RJCp?w6=ES%M&IBy$uITNlxDr{+iRI&j-w_6uE0z3kkC?ojnrflWpGyVf{lr_*u(!mxncR zi^mw0%7PiQDjw|86Uz!LrLulmFrqd7r|;l}C$2l2&O}sAY1723$-OEO?htYWirbv< zjsa6TR@J%Kxi{oM8+3{smh0;T7M@Z%Qp$|6a8WJXtAz(xQ^aHu0oG_%_HvM>tNBrd zu#{@Y41d{)1v3p78g%m87?DVfQRAW^Td;mM*g$1$RStdu=Hfj}|grO_{ViZ_+( z3-t=9rH!$?HoaF^*|HGS7ThTs9#|EUdRV(%D>eFyXSp{E!VV;Dx}M13&FCY10aO_GG2SYgy0%}I(h-Yg4#(dy$$bW-cFKk*0!h_ueK#kwh)^>}S_0H_F# zXw2b`Md?wRDH)R*y^-(U2#lwD_NeH~u*LPtk#qJ(*9e~cTxFwkN-Sj&b9ddu1GueT zIU(UXY@UA_Rst6{X8}chDIP}p4YuVsTw$O=SHhSfdfLu};1zI6_p=|_v|N_2);2eUJ<@4M8

0KRF>=u#CWX8SEV~@;jn*+O8X6w- zRA@^p5_p6gPr>>$52wQF8$$NpgpQACHxN0K=Xx0qw;V9dJj{*lFIxUAdy^^U?wFWX5k#1@flvP@AePnv$||gWN|H7_!8535*Gx`x6#| z#tw+D+J@Yq{ab_Du;QiGeST43S2UI)Q;x}>4%!QtSW*lR5MmO)U8LNgM(bgiot*^+ zR@0{MrWqh|@>}0I-HY&08-hthWwdq4)*|)kIxWA>)og7F%95$&fq_JcDN+#Q0a!^{`tvAusc_GlLZM2?Pv}$xZ zF)>o(TDLPeT0&aIWwpP0Q2;kP^zZZNS;kC7QvjFZW%yt9}LqkKU4&DtnX1%M!GLkJR+Py8beuX=Lq-I*Uu&adY_mpTZi8sGlhZz{+ zJ*QdRTGQv`K9G|VMMNdU&pp0F)HAWDKR3HZkH&(Re6MFIjn=&X^-_vpaijYIa&#|PF9jj+n->C}PPo)BvoLHQWCDN*g> zCpe5~1@RSMmQX_(Bp$)?a}#n`e_2$BMmg2HHZqEdV5j}_)A_-S(}(v!2%n9%k_4Gi z#Q-jLm(_IO?m}1#v{>dKkN0NY)@@{tBw-8+(}d!*XOf*-7WwV0=l%N5XNnb!HlVwl zgpq0yO||t$w|NzkF;ms?iJRR0yCMAh)mtks(P_z>^3U~!&&IiDU@MC9zd|Woyl&3R zNBZ5gigmhxm@MtxRSIs5RaZA<&3+uP?@lmSjW&IC=9bdEOxO=QoEQnsx zkH=qN)6MsPsT$SPhOKS28%CF&6+#LPC>HrBbL(f9V4s%4SdWx8Uf>drP`QWoQ&&NU z^Lqq27JD!$*yiEO7Pm;dF==~MUU&V2z5&mOP!-<96mJy04VP-KGJ})%LFIG zWHw#V7FRJ)zc$2!K#1&r%<6SDy8%sl72?>?`v9IuIYh2&XpY|JR=-Lh{AXC&=UC(( z0f%wBAl;0zR;_i?^QUU4gq@HaZ6n=5y`#2;pGa4w>$JQf8n5?k0rcaH3{EA0A~t36 zX^ugxqfPcNHZMn3Ps=~4$IqO#Pb-7)(r`ZWgUP?HECk{64skA)cXs;3u*t2JWpqMa zKT^C9I-rgzn(4Dj=+?(fCeYtr5?v`6u?<%cUpj%2Kc1aq6NJ>J#OT0Kc9Oj z!S{>MGeltv43VH>mLqHDG{*atqe*FDq<%W)Z-z<4gP)!?{p{ooX80>q_i$%HOgSBo z@c3lvdw%vsO{wBc4@8l!qZ_mw_3_dRZk_1<@E>6^*%f^TXE}GuhuHc4A|%JC@DM`@ z_D952gnjk@cYFcH0ydI+s9S-#l#!?C9m3s>H2@=@kF)9-<^VfNGv~G&1Hn4fOoY~Z zjq3Gdl4(5&)Wiv-q$>?{17hc{O!*C2&SmN04x^)v!+Ey?Xo|lJ&vDLetIY>?zXmfz z>{b3{sJM&LwSm_GD9+xF4(C~j=0bZ@KR!6x16{2DWhk!)ftM}5jj5`u*b(ZLB!D>v zG~9ge<&zA5_Is6(OI7jmkmD)^XG#G&qzd7!i@vmK>ptzJjr+h~U5VFS@Vt}ryk5t6 zqWQ|TF!sbegH%Q^zH)jl6yGyjBUwuC_{WN8L(5H?Gc*2<52~+xSq1mBbp_>sSKAfq zZiALd8gkatTXwwgSCB{T1`payZ4w#RMQ@aNDVT#sMG|a;t^S@f@DRq?t~sVix$xTL zDnx;>+Yo+8wMnckdi9rACP_!QX0Yzo5{4mddtZ<++G@wsKUOH63@mGeC<5@0 z>=T!>3>^P?X1kv4-JxqCTb%M^IVa}2V)riE7dg-q5JvTvV@E&&iNB>{m5@M9pla%L zL6p4$$y3NS)Rw_1eQdt0shL5!l!_LBkPo*BWzVdLUn)SQwY-sI2*zfZVs{V&#(0?P zy;aqmM-(6XaMK-E^v+eHX5YPV_o$j|Ne|Wpa_K|SdooFlf!YENt0(R&S(_=on07ZIAta?S91CRVX)i; zNs67aD0ZJ4mRbxOHH-y6d-_?G6l0;_&js7yHw?*UTDISWg$jEe*FN$D^U4$gPJWS~+h^W&wSxx<+qss}WF&hle(7G!n%(F%i!CZFco9K=0R@vtw)X zpWz?7_SO8*e~N}jM7w%SSqElG=$Z;5R-g^58tc9URkg*$A{*{v6R4M~$gsVguv%kM zXYpNjHNaF|URglS|Wl6B>D3cxT|A9sv~e~5^F#ugB%5XFwhB9 zP@!l#4n)kzkFXID^EAp^^!MLGNX)V_o=;@x%>M>ZV5p^qYIHV~GOyEr`#8r|TSsg* zp}ICko!+6IAzsP0895(llO*ItG?pB413tw-pX4fk3xZ-GXvYPhVw!n|_Ak(+?1PDf zS}ZqEG^qO?`p(=;zwJW+REzxkeq~7eOTw7+e8#u!cC)3-KWEn=oRj?YLB+cOvxT4& z4aj_Vo97s5@R5}~CO+d**aheT&&4mN{qK%55UW>bS>6nOv4rRP;+MErt0j>g=MD$J zHrv|vu9coc9#Z~yaF)kmTZj3A_e)--=dec{DbpSGZ-gIDBG9Xir4^{Go%^Yum!)?% z81~*_c!T7Fr@a|NhC;As*w3OvO0kL3>_awxy1PRi?H|!HLj`TX%xX62dt}qcDI>+7 z?u1`j*=hlMSY-E=a-h|*|IT*7o6{upr%e5MDrqb5I??Z>rSQHMoW@c2@k`y$u(_t- zWhaL!;@#sh_Fl98>c5az-}mewMczGcELl{#hhc(-^%+lR)3=J84us1$$fmHJj=ga- zeOYI!@7UA&{*3KZyMsq>L24ZYZf5rdkF01Q`AcO3*@-N{-j#qb3fv}ETzObpy6d0sz z3iICoxfO_>saY!(fZ|hxp+e3gHli}0)=K)aB&<+c^l~uC1O&_n)`xFqi#Pju3)X+X00b( z+cgB6wW3awn<0I>B86VQkzGb%n)(a>fNO!`KP3YF{Xd^r6oIZ^eor(+Tq4BW?xu;c zDf50divtAXXaPIW)~yC^$dx8gM;fYw0^VoY@O&6U7GV_L?r{{o!fy=FV8o^9XbM5t zaqP)ZJ+A=l_Q$BgP(;D>xT+xE?!o}N6AkbalMon_+U~6tp@`Kl{0%t)-gT33NXO;J zjIjc~n__tAY^Y{@|)_F##_d+i*asZu@O5g^jxY+k#8+ zp~^av^@p!^LVs`7#6C4+rzchrz>;A?{!x`?J#anDZ$Q>{xTz%Hsd9u{{1F(vICYgn z0XO#g1cpUejIjsSlb6Pee;bw%0^Oo%!Wp09pB8(E%7?>z*)N!LD7S^MB>W}*$X2h~ zjMsJfcRpZY6M4VQ=PRhk*rK^!moSj4{o^0!MLrZ-u$Z^c(hookX6gT&6rxIRyT}fl zdw;(FjjPBr9xiKf+O=xJkob2Q^85H=1E)~m_tQ;n54K==5hmsoQZ+UJ(p^{c?Y2r9WaweqU!qC4k2e8HvRn`Yp!hO<=Ll$cVm%|Z{M#=^mR z7)JDksXQrJ1dlA%u;}ioCuyh``}hzh#d(*a_2iSGqVn0)0oW+SZsO_BfFwIWq-5WP zWT*@GJ!futBmd(ml7ix-l!a%PRTpR=N_M)uTrp;k@}tp0JeIbsYoHZQrE;gZ1J(%yBbtytg zOJNYS(uXEO=#;>#A)53!=R47CYD8-=I_PKfu@X*lFH=L5)u=}q))@piHR*v zqR{#wN2tY(8GGzQ!aI6?T}O;b z3})h46;*+0C~cdrT)!9EXNvld%d_+j(>3z=gaMAYFAw45m6NO^R!SM&U0;-%*-On# znTT@__#au^#aJeHC|FX1qprxbq6>gOk!__RD6WKZUU zU&`c=pE&jr@7@fC&2N(zOME@7LQI5)_ghnEvuP~<)lD^H4+qUq>SqD|N~Q3l#}Nd> ztI%bEE}k)Oe<_S^cp)Oph&OT^+8qZh}=I$@v-cbb{8IDHaDywo4 z-v-`)^9{AIykD!E3&InjsV4!x5dhQJf#2~t3q{EQy#2=g82wO?DYSXJ{A}kMM65!% z9x+Trqb_GmSD9iuI}(YrV12A+nuIeZCn5E^EFSIbn!_}){8e_*FaB!%2Af`nEH55Z z?FbB31;)0*ToA)!V=NuSJCb60Gb=N6%Z@bO4@ev?J|glg#8(nJq9Vc3@28(H(gS)Z zmlyPEc#TJv7C~r%?qBHNuxjN(c^mH44h!JTO>d8uG4cBOSuhRp7OU02wwZDd0rmd? zbLxBA$j*6X+oYXsyQbeyA)@qo2RxtD@yDDlcHU`nSQ{|mzdqSde0{;ARC(~V`|kv7 z-^!W8XnnI>RrndRuL|Y(xWm9*8IA7)91%)*wPQiOER#Eo^>FDU3j5}hshD~_;8ML< zP#l+BbnhmgMN4EjO5%Y}5|N~+3hK=+3e_N%NE)DS$dI`N4oGvWDXv8EMgWfwiWsy< zX(&-qV(yMkSwnK%xy|ey1D=-7BH_srLJD$0psq1|jI@Q)ee%H_vX_wk_~lW@$4IGx z;IaDy(I@-YV~PQ-Yw8vrxD~Zni3B~CVdpEfOn!7G_>z6Ix7;?8Z=aWX41yyZmv*&9 zGxJ3L$`Lz18P$)Q!yiyA`X))I6c^cz3A8}Xf9EUXayae}#>gqw zfy4`q>u4)jO^o7LF{o`U)FqJ@zAkH(GYCuMRu}m59b8HiNvNbmKY{ahErua1vL11g zDt0b6mH$w%222Y}g!I?Mw$a%U;Yz`hln>e5v5Gky8l>9uJLy>j) z2;-B*sV$+4--O|_Rcgi3gu0ih%|+(VJDtuRr*2eeW2m?fI zy2&blc0>v~_dK5c_HM&dQ3wWX#f9MgQmm`Ah(RD_Xx^6t`y?r)^eht5 zZtuKTLBpX}p;oHOziE9sev+_)nPzFTNOmI`vFq3AZ$_lpqfVeMZxe z&9uL6LJ^5;py|kj~PoZQbh-ntUUBxg49!<+OH&vs=T{M(qd6hY2RO^VRqQa z_na)-Yt|CV6N*srVcpe#T( zmlrI)IT47ZY=eV=B)X7j%IZtv<2FuLlD~MOU8w*SQ6UoCi0?PzPGRQ!@%ZIQf$~@G zzWv=35ltziu|0e9_BB#I+k{B*bKjW#&HEB`Pi)YuN+Pl?U=+6YY578DLFM%2`opcV zSh!Np_ZgNvSo?-1Mh)b-&@-8O+Ut4enSZgh~;qyz+ZzfsZF zgD;c9QWgs_pg?`E14h=WTH(UVM#ZrVUpgZAvLL(OK z?N74z*-NOH5R+n^_&PMA8{;HykQWAu$^w0zk9peiZ=*kF_%T(yeac@y>=#tIMUci4 zH$4y5sw`g*E=~{rF8{CJx(eKHEtgbi1I^;igqLp2qCgeXPR8`oVMLDaUVn)EQ?=2i zplwF~G+O*G*1~2yX%v0&cBWbBh(xlE4ig`TGwBuid?v&?T+ne|@ z+k!P%!s%tDkJ(rv?bN&Pz8&Zu=Kv8m-z=$MMKy*|*X1dYczcwgoFzKyN&Z8)!4;op zL*Y4Jiuu=+AF%-B0kVoMk|=eqaySP8r?yJPppKDZ1wC;Uey&ftBWzz25M>v$IAgu8 zxNFz!IIN+AuL^~o;0}9Zrwm;q34dB{IhCEOS8 zKlm0yCyqs#n5ap~tXe)gct%bt>50N-RJ{eWn7M{5sI5lp9Iv$wv_q(3B5X_PH-QQy?vn(FV zqQo`DgxH;ra8X(6?TN~x2LJ?R~6fo{S6yn?w9%B3{FucIMQaj85TN~Qc;|S7lQGaK7?p=Lq zHLh&}&Ad@f9q1F!-yEHD478xi#2xU+D@V1oMw(=5m9Yc2Wxb%r1`tV?>=TfxxRrG9 zJL$8VJslyziZwnA*uPbnZ{9&jMb@4qN$u~4Ynr30pn3%v zX~6hB)Mz-F4X1D`58WJ-+WTE~BW$N$XQWJQ;qS$hZwUYRlZnG{HPu&sk8~*yqOoNn zgrNMGwbwMHmsTi5VZ5ZrK!?Tr_OB7;bd=t&u16Pl(VZ;1f4H@aKf<&i_x7!9cPwQ@!?IApc8fMM>a z+r;hW>wlX1Bt0@eFJn)ntj7VD9A3cYywzL11+}Zwg0=|#DVDYmu;Kj*tUZ8oSG#Nw zfXmG^LIGn^q>>eZ-}b>>&m$A8-Dh!3^|RGhoBnc|S)af9gg81oc@rl8>jgIk-oS7O=6gB|GmuAzf{Em>!(%yZV##VE|qf9eL=J00}S+ zyk9DTWHdKKEoj#J2;JWmP|Nc|mtk3{-8|j=!PUmS09QO=?H5qUdJA5+LKB2=*&2Zr zAYyVtXVv0C^$Q|4`b%>Gd zI}Enwt<0UKV+;yeAL1h8JRK&ij@PjE-pzlekPFBWyCHFG$8oV9P ztac`T3JD{*!(t*`dHLBlA>bAi>r~`eNx>yV1-?V@@niMxn>0-I47fA|T(Qzbr;cL1 zkZeOfH_yZM^fVJ3)OiW6L35dYiLr>vyXDw4!o>JKC0z3?)PF0aoNaRft^~de1m-K( zbpQNaw0*wQsi`$RPL54UWhAtT$Mek%>GtR|uk+dUjTSWKKA;t1oAl>q@t5dB)B7bN zW+SATqkzs-V4EaG4!A)mTsYOZ7$=~2@lGBrfn7y=FdB~dS@-Vx9xDkrqo3@V>+%70 zrm;u@xLF@J^DwPH0=?d!{=P^zv5Np90H;ta&ck-?9i1GX1=(hdQrRIE!;znDFd}_u zt9wt^$-%#SCk40jBu9rDx4^j!URhLF`JtyIpPrwy-D}6xHnChlz``RKvlG3fM_9e` zS-P?;a^^CQ!H)PEnWFlqP_-1T0`vg3s}65Aq1;xe|MUYl_UKuPOem$|+>=MiadCj_ zbujR6ooJH`VAiSg8y-#Ja-Dti zGzczFU9QS(1Rj1quH?WoOHOv8-A~d>-7q$L%r^}~V&@2NeIdw$_H*#=>Dnt=OKS+a zBB3teADH?%4(1wUm5pS{wH}8h`GMb-XfJ-ql(e=9MbtBA{S{dJq4(gSs7=~dQK+_d z!=jOPV-IPYVxf0>Bo!}WWjW^Ap|x3vQEPrAgPn84QH?Bcv>lY5l11O1!z*mA&978} zQj3nT@~Ja^S|b;d_yji-M5@?fQgA>yD(l=qPZOpWFdE8=YDlVS(y!&!H`FbaJq|Mi z`!LU%C7BY8fIk;v`^3dOf}5zDRD&rSz2J_$R3t_HLa?yJi{+pRk6GNEFnIn4Ml}%J z9G@7Q&b|`W_*-?_*2VB_gl@rYbFksRj9QYFT?8S$*M13|zip^B16mvb3Z0eNL|sKFD>fFHXF|-r734 zaAY@w{&{3biliE9v0}X(xbJ}_aBa;rFja58Adq1yx_c@wrRZKq7%dlkLl;ar$0zds z@bzPPt(_KEPMF9@nat*KIliE7LwJ(n*=K&>;(&4&F0k*a_%FMsw7ja3Q`LM_mZ27GB+9IqRx#} z(luRvXyt3TAqF*-M_=+kCaAvDmyMWWlz$Dn%|l2i#t>0S#}AB+{9S-#X{YNTlrgE& zvq4k{&YNPzt@55)38X7`CE0y zXm+6DKC5k!XLP3s$lO)HXb{WuDM% zbI#M`hb!2=I}pAQB%T_jI3BH$)wl+?-j8Pxy{bsr#-nnaF$7LxMoSv|LSjmWO_KWnMh%2#AkT@?xzqW|Z2AK_|wOO3GqK0Q^DL(MpA#pTd&T zG%Tdd)+&K>aYYgw!xO3e0dsNcr7Vrclu%l63L(`I2zEnkL$Spm80JztjiE0UX(1-8 zIM2pOsi~0vT~$PYYN=Fp9jgCmI|2U!oG?FiQ)~|R^gVYIHPkXNg8WjE`H{n@_Y{|_vMREfX|8KRi>=n&1Qc(yp z;#QR;_UN=g9!SnSY{jV8^sTZ>LIPEHD~GO`#_Bi8wE!_mBo_$AV-b0+}rw(98j2>2EgNGjgmOAu=8GBy%U^!gW-u@ktE9MT>s$g0qxhqYnse&9w_i#tR5 zS)?053r5haeU;pw6m8F1F9WPf_RxMU0x2ne0z{(cg09I|Fl1TA>=%tq1uECataOp} zSeFf~{qdm0PUR2W>T|Ezy?M?bOurV)+B7{qtAPFGh;t4#x~ckArdphqi3?v4Dp+Cm z(8X(v;R>k?yWhNHOQ*XB_{C+0HBQHL$Dq>=k5C+qqxREDCq>X**Cq4I#>@PEs!)X? zIMAXazLTb(md}tp|pj29PWz#)|@BUu1pPOQROBll|)vnyWAdGt%& zOCzUFBtjHu*37=za+yQL%u`DcCEK+GCztAk-yfx+4KH2h{#}T$Jjz9*tT@HuZl=Om^-&HF=$E)49PNt zkLERLr9Ko=J>`Nbj4BM6)(x*$0O1II!HyPGhFkCn>C2aRc%ctf_PY zA(X8@(JxUL*=jm`$cww!E$MpekIT6h3^}Y!nREeOr<+j}b|TIG28#wSoWs*+GxV|r;elm(#5G|+`!y0L89UxO^WA9V4b|)@Y$6 zbdjUnOfej2Zj4sg0i~t&JB@atDY4!Nw(O~NRq>qJ5pz|EWbi6_Y~{;yuyle!S+OIg z_0g&pIOCSOr<{-Bsvphmut|pDD_U0w>i8UYJLp8Xcz0(HsqMx3+mk4z{1S2a@AXZZ z+tzZpUFbW_LxKiuup9&Ag#T=uEF`tlQ!B8EP5a>cDh+5ZFo%30 zT}ktobxsbKoY~J$Ju)g((8(e**_$d}<3oC0&|0EN{=k_Nli&Ks`>CYZfx9lu0k;*# zU_@ksvMj;)k*9{E{X+SIbWIEE^GQjpL4;9S2(TzsT5E|z%E365E>qI$lnvBJuJtcj z3mcP&->Y`#ti3Unt^2%#nN1NLSHTyCBHwNZg6i2Ug!Rcpw|Rg85P?Jzc?aJ?j#bny z&T=R6JL@-@|v*;cBHA0 zFytB4FQ7~ZB}V|UTq9!6RJ!IMs(irHSvy^za)>~HcwaJmj(h@k3*$ONEBbB}vvByh zMa^Cx7tdl-hNrC@FP34a0HErKxY6494ZJigIWgdfTT|N^8X2ZaN-R?-flyo`a%NvJ zI#?OjbiV69qDvRG{dCwfjd`VO_yD)t#Ve`k(#MkkrI&-_FUPG3{S!+}>>M_rw89?5 z%B-Uy#ntY)L|ET8+~a|SW4v%s0OCzUq zhzRIfj|ZF}?jkvujx!eRMc!P03UUIkA^u!A)$2t!y%l3n!w$|QaJ*4;AKqMMUXkD9 zx{46$bAtHtxjr(EJXJ?9EW>71&@sGVVcJky@G||ahjOmBRqpfpc)jT#^x5crPTxC< zm6>h`Q|F`0fj~cn%UM%4(zJ4$4mY9;@V>M#{)tLp%- zaW+$a+%T76AA>{sy;)VElNrL~PQH%T!kPjgDA7iYWoL_`e2=~F-$fJDJBeVJ7$zSF z-4BIsaNI_2cfe4w_?SnvZ?F}MkNg~kJI5-&n_G7j(KurS=|)d$2}Le#>9h+o3(Wub z5`&{Achg1IkZAlfD@f~ZwaLL!L50v7e;RjvF zfh79HEIwBVwS%3tPZ9Y>mNF7ZrI-bsd!U0*XS#y>au~ClD0e#0s7x(#sE%qZ?}f?` zySh7Ay${1Q6`yix-k&7doE<4;f_%$|TsZvQMU_x=L zqavgTfo8ym;3?JB!dLI*iK)71HYiOIrPyHKADn&QaP!Six`4BQxoTTCw^qxRo}-fZ zSLwKe(Q=+7WfC7m`M}v(cirIWzKewc%F&H8gEOlCy@hpXNt>&EDx*!?&$> z@Td#M;o9bg<9c4=(5dzR+j_Cb6{C>q{{n5&{T9y_RHY;s?;#RV7ar05`+zm5DYneo zht3v07{=C>lHWy1&n!tvmEj5v6=GrHF$}Kw`_mKH+&6$OY(-LTWcV4I@8>XHf3k zeoWjhN`TAuEk!}hQnXqvl26noF;lS4ZTBjNLP(rN~cIdlB zoVM67!|de?Gdfm)g|}2pGU;A8Q<&`8a&k4V`ZBK8W(L{?bV4dbnR%s`Ui$U%gAEuTOnR%rLi65Z?eV-LV8w^4pI9KfGE~iH*34`|n#kIthOw@l1~3=b0Uq^|0R0 zX5JI}sYlXmst2yFH)cGWw$x8fZGyoC!;ht8Z!!4$)Unsv4+_OJ8gf|!hL%9URP&Fi8CYt1UQ=p2S2f2dNq0eVi_ zf!6|YN6|^^P*pa~97-cofn`WOCqF9I5om$RNnLy`-9@=yLOd0}V7Nme8T4m1Nmbb*GWY)A@ieS~wkoSH zNK+c6;(~!1B3UL%)$<~aZ^@Vy@9+_c8eVJf3&auk2Sb@YQyA&$k+xj;uLkSL?t@m$ zc~EBP72;baQma`r6pn8u|LII40CV4w-Bm&kDr#N@2FDLJw2J(Z(pow_>EA<;+(f!% zwLQCR$zNP=>A1B(_?8*rok$ci6@h(B(~7d#-Mp(z>1tniVM&IlObZ8)wlcK?0|mS5 z2^3>wU`+5iqwhL$h?Gk z+7**#<|s?Yh_z-UIwxhbc9D<*A^uLWlm_j#)GAAjJ-}OSLN@ibOEfO43@^G^aK+d! zh_%-pW=`xV2bl59@OHliu9CzMX$ofM9Io`*3FOv2by$Z|an49UUHeazh3&a-lKi`T zFxnbJMo~}+HXQ7c0J%9ugntwgc<|rm0v|ijA^i#YO9`fx2a0B^M$OCDCg@QPT`e|3 zx1TefLeU`vy@tW}CP_^ukzDL*Wi;Z}3+)4_)^xOd!$Ue6>hNz~X{K4ZU3K&nX>yb^ zig!mH%8jTM7l|*;5J{7zep}*P2Co7Z)7a;sMp!GzWWJ&mb=v&dwMbA44i48IETOwR zlDnJ!$$$`vnGT*i%xD)BZZmFlDGvf|Ze&hL=_X34*j(h@l#U4YP==vhKuHpDg|706 z=pw4ZE4TX5Xe<4BnX6~-ow*5G^zzQQeO&HHc@6 zJwx;7vByZp7ZU|>Q+1T`Tpv`+Br>u0n*Qe+2=RI<=PyS8N7GrxHT}MAm>4pe(JhVC z7~M#Bmvl*YcQZs(e2K#c~*Lj`C;fC@x5AV?q zklJv$z2qC*)T7i2UJ3gaMVl-sZNs=sfR16-wgbf>0i=)H}ABHDn$IA-BAH;A9h>6t~P_==JX0oNn8Ugwu%7@+KrZ55u753A_t zEm3<%q?FYi?pc-wCGp<-UggW294a$U^YNkpo)HP^nWs%pI%-d1kB{{Kh)@TORzC~2 z6;bd}P){Vcum!>iP~ObT+SLo_q)8r6gJcUTmd;rdfpcKe+hQyd*wVx)VA=oV{B92| z%2nfvipe^d3+p$qPn{J*0GW9wfw5lY$;lQD=lmezxqFV?r&Ti3*q)p3)$WZfhep53 zpQ@E6%_v412P=O=Md@`cW+TdCCi;+ugb7{g`rJyy;~A-iB7vU|Wgjv9@9cveD{MHl zOy5bP$-xpBZKt7V6Hyf_A}2z>Lo_-)a2~(qN{e-*OtB8k+sQf`A3dBGcK*Fnx*~BY z!Jot#1jmkL{?nH*;Hstk6m%tl8QmV~|_dPZ}E*?eRDTKif&feYV z*X-ts%J}+(IREYX+v|p8O9rPXIu_uho!39HCY4;R+P`fvGpNt@rx7Iw%u$>|ggZ&~~ixnRIL zG)CAtAgk2-wNq57wA(Uc1YhHI_1A?z+jT<%2$7DcI0NDQteSe9H&nfk9W{=v|26%` z=qKDYUKnuI>G^4T8;+tTr|UKzz+_^W&H{3FYc!?F74T0IKsV_p5W)QB)f~xhQ@tATkHMEuHi?McR2-| z-?5VC@D>%-9;n_2=M|?TK$;En;~giK5(?lQtsDp*#udVj*7|F+<~0W6?_Qq??-fy6 z=gNVO^cbl)IcL!@1_lN(j}f!Bj|v{=-M3VV)@jUBYD}YLxu^&Nk?l0?P$smp0)0Me zj?iX4u6#-k+k(Tr+SwonP3s*LVZ7%0xYj8(=!R_Y-%-#(GwFY>*2Ww{R(!893!*I# z>K#fxI4%nONoxphwAA7VSf7F(FVvxTJ<46FNWy-&VbX!!&W{~Y;aa>p5bGfn)NlWGNJ-!erK5&cSIDj3nSV1MD^ z;g7LOag||}G@d_!F5RIV+^7#h^8Gj`*PqdFf6tupyDs8ZfF~Ytl+_7nP zm^}*t?h8vP!rZv0hc)6tM^dJ|CvD)j2QCsH3AC}nOEbf}x8(G74s-si%?GtabX;{t zTITvO3@=dg7Bl_I+CQtquZq}LO$Pg|mZ;W72(KX6ebACTBTa9=qHc+BWrn^1}u7Jc1W z79Q7Uwu=jbZ>8JLJ2|?WR!?ZhPwjK%!~YlB(HV_aGdtx#AH3=V^0h{bEyI!-6$$9q zxe)$!9gKUh^!sz0u33G~G!5=VbZ7PAuj66gP~`FygUj$tJ{lA4eeJlDuRqkE%w%gq zDcfT#Y3^|%%d>5bU|sj?_57A{1bilJ39m-mW#mc-QqB<)E0+-;J(5;2wX^E=++=8RZ{Ht{i!gvHj4nG82=^yVr9c$2(EZLyR zRYoM?N--odA1_tl2#U%4X8_qX>0YmDXv!9gco2Qa1KrQ%UmlUsDu-BPrH6gNAoeXi|O7jzvC zy+V#8xb{$M#chg0aB$I#wBcCCx8 zzO4uPxcR70t8A?fCF=z_p(e8vwac|*=HumEC>x-B1}gfgs#Hmbsw=Zpn$Z5nKttRh zaugba%bqYk7?GPFMB#2#&fgcnwi~nIADHv|N3RM{#uvAe5v%jI=BCL-b$Ov=dN#3AYB`MFql4P$01~!@0q&*Yp+Q zYVuREx*6$VID0e=lyM{v4;4<{ z&vA29Ii*STw?1^yiFJ`+Poe>9?P`_of|N^=t>qmr-SuPTeZuz5DIo7a{A4GHt zqh&^z`e|SS0MQsl5sfbaEPgd#d@1W1-r7sD#BEZ*7a##=gA1OoYUV3GLgood4$Yly z{Hv_CIvP}`%}B-8q^n8Zg!V62nHbyi&ikJ_?2*o(OoU~Z)%yqxc3uA$3z>yifT#4*B7Ei#bRYaSQw=DpNZNiGI7@J4J5h zU7WO-e7;Xm6`ap`PfzOhqJU7zsSa>0E;5WxEaLV94RgWs9dU@X%O_k)Ns^oo{`%)@ z7Ab?`_AAEh%i*QO9^w5$Il)Kri}ONeo@O4VYEGwOy?LjCNVE+WPWk)p(zNr7O9mf< z8V3z_+Kz^QHk*R%r;@$q@5}|A5xwmGtsX2IL^J?vZV9&*gb9@hNk6A!t)Q#c_73|S zWJX5LG5FmqCnrmM53LIwlJ?h>FNjr_u#ljz0M?xaN&u``8bZh*Q=*~>5dgG)Hwt;f zK0lTtbP_+nR}*?Au5sa)7A)LZUf4k^Ug}KQ<_)3HT}H495P6`QGhE05hKf*V2gBOC zA$Vgkxq~U$p?eoCE^Wc{{nJG&m^3m$V=FAIPJaNS892jn`}^N|_cx~RUuv%QISP(f z?um=aeO1F_7^=k6)d3JrYHB?r_AB>TW+Z8KiEwoS=0j_mcPwcm48S*v^mtcUxZ>lH zhVt5qKzVR@XvpaO=?i0OdT+q>kF6lp#p8z@4(p^>dCFh7JS9Q!=SKIh(fWQC>=w64 zw!lPaDkQSSjUp@?Es#gSz} zT>*#sq_V_7d$i#eR9o2qcjXWb`v8O}wfBq&wyU76N|j1EWLa)S7{~K~BL;6K!cxU| z)r=nuIiap-Vx;(E)AKEtjARvsmLhVWFx?+?&V*O~aOi zJ=+Id2jiT+J{Ot}=CYHcReny?1au&)veGyIxX=EK5eiXuCf#g|0%g;?V=VQQfUzUZi!hlqr_KENSACZ68jTDPZK7a zZobw9qaas$dHh77`lQE|>hh0hDf@VePy)Jd$+s=YUwig7f85p>JHrNUr%ab(Qj~om zhZZd@^4$MfiRu7f#_Iq^;Y?Oqvv3BokW{m3ZE3lCGzU+zHXtoW>Tnm)Z^jmVm!2)# z`yI9;D*YV+y&Kg|aPfDUmlTZ3kQYysTD6+2z9(KU@{4%A_Q5Xh&$;JAm zik!P&Qx@lh=#A*?((usZDu0~J7d|FtoJ1Bxq0A;`N?{^^o2wcb2->1Gro-tNfmmi- zz*PmI76e(`QS(TaB@jId;<|3|#K{O9z z4uq7b+G?xDtLnU%(3K0t+u`V^63QJkA&T#O=|^%DJ|BV}0dB)BGn&ZYm-(c~2vU{z zEmFH}afVi;kP}Js7ORn0z|pwc?aceHW6RrBHk{ym5SjuAwvVHF~>^j z+(8v`VoGUvrejq62jN>$N!I8>SkrKn_-x)`2g;>Jd-1&L%z(I9cg4J;VrF$o9_9?0 z0lv+PcdYu~)(Xt*lITyEqGnm=uuz&zS_LVXSxZOM`1uISO&XniA}%Qxp~+`%jk*d{ik zy4?~R814L%Hd?ajvI27oYMhE$tBiQwsV__V-JeI2n zb8mS-ddKrcffHPwl#(^+mY^6;D^IOsDW4P0{4LFSQUaxmhAS)QfF$4D(;`C6gmK2A zG(RoY3cSk(^UOBp38O+N<&^sFh6j7dOD+(GGmWBf^;SPdQAFGI4oMA%D=soHt`(G7 z?BOmUZ+iaDkDuyE-b^Ub*%i^0M+24CFxWR+jE7l*W>~0!36fkb3$BB?$&2+gBwo^1 z;hl-*a|E5%KO=gDP@(REF%0@!}?S*`)eS#p*(=3@)A4&AuU>R9du3(h%T3 z2nmB3h+&z+&_6dCJlq|lCSj-9{&S%;sE1_x?CPv2|>n>rCuTwnU zngcR5Kj>%t)@-%0@dTi(HRRXd8@b4n0<%i6k~{? zxS>!98Io2V%vj{zHqmhQ6een;sMYAmDN8+mrK!V1<{OeGg$HHvD#RjCVr>7iRCp1Q zst|G%9k%y}DJGeYvJ9UzTthygLudj`aCTO)wK;6Lo2Q1qhF9@-#|-DvdfFlZ_5>7_ zlUH;}4&Do?_V@ho)ss4CT;MK7TPGtnxrgUeIZ10&!@h%UUp~#so=dj;W77O&8z5#O zWANFoXdl6hDEJXwGMt+yU70#js+!zsRh9vLNds$v-Z+{3_ zoDH?7)TL-qj&rIe74bD2lCT}vk?%twbq{kQc&k+n-68hNJQG28Bk-s#vRjQ4cQE&V z`;Ucjno!p49ojUSr(X>^73(-aE(;$E1HeMYO@fwXm6l5n@<*C*U7AQhd*5I1>=71v zD$tUhJ2m7fY;S};I4qIMneVQ=^e7-(z2eFPK!kL~_nW6VRG^A^Jds)7L=`h5woTc& zpgZZ{JYn9p)a@X@TSVzW0jPYCEV@vt;7i+Y@A^xM zQ5P9F9&9~S?1XYcr&c2cpRrn(hQmTL&^Bs8B47!YZ2+4A)M|5^4^+dGQw&OpNstTsaz8TJD_oUoMkkWLs;cVbBpcAuP38T~{#16WQp_ z^TGPO25jP30_Ys099;&q@rzDDH-FI~=0wrWmSn~!x8$_SQi#Q2a=OvM!P()f-I(UA z9Yyv=Fhr9fiS~8d3f=vbAGr8YNd5jxbdU)EW=K3Evdyoloo1M-ZS5+Gz((cN5X(a0}L!Wx|VHJ6_2Bpz=oKE&}c1Ue+ z#q#JA421vdx3eH~jcKHc*Aci)<;dNXLF!aZ*3xX0x-&UGX!Az|ZV?D(KRhjL_((2E7FfHqX^fMk zVx*TGmTEw?d;U6cF)+cdY+}8)B^o{T5IHUKejuIQY8~f|?fOH*ZxqE?Dh0%3Evv+-EHFTP z+quyfdrLj$C^V12?{}B0xhEyI->E8MWCLOa7p6E;>`Kqja&1>xy17FV;h%S^Ezx;I zIw#RRP|^*nA}r<~{mPVBIZmvh=ijbH_;xpBUDsO}F7ynF6|MMJugRhScK^(*AoetX z^D|Bwk0GpX*-Oq4+s#guF}-0{w$iB7fz}#ZThqfGi1R zD(O%fVx`EwlUw58U1B4}ZXCaHsbKp*0RY6(CA&(Yw9T2lNR91=ah1%ewVz|8v4392 zA~9%4+OK?fcT^U6*PHAp+?mo_R;}JK_KP!ab@R~e500?PY}K&CNPTUZJk1h^@lr(> zm>As6=0+tTHZn#m>Yh;cqgveN@ssc3&)5Ev?&itMrV)1>&3o{CX0X%>6E4Z6db?g9 z)gyfLiMvM6u50@73MTAou*ZVXu;SGBUSylS>v4}`?2*7gy`>!W=;?O9?^ovaWh>=w zHmy3@jP22dx#5T^^>r0d0$)Kv*7fr8yyvqU;yK}r|Lq0Bn>oosw^7o>kR7Z`+n`BH zV@f)p$DAw2?wJDxW&#x$-ms}?YCey`Cb`29(k?~oN!UJ?eB-Q+^f|F(amM> zCAyEZx=g$e(JWG@gr2Dj1|O(sz*ER6csQ%6m8tE0p42F<0Wpyi&J@c6;{F$ac%F)R zX09#gZGJtYfmy{h~nH5MEodh|S8HuR(1xfz&<=O?sdZ=nW z>A`nr{$FHywVuu0e{7q>;gtdKcBggYrd%5N9!gbC?=fDg;Cl<3=!;L>_!T$Cf4BTm zaJ7jZjjB3FuH2FW`laduu&kR&R&T@Q6|Bm4-I~)Ej_!=K|AH|UsO=*1 zlm)Ws6mpR?fU5JtGVbn(-j`(y&3cfQGbgBHzk*ZMXJq(;bc4lZ`j z7~hDGWty%KK(_Sb3|TIvVo18*K$Q16MiUs?}ExwORQi$|J4 zmGjn%yCQ|GvHd{k5{E#QOqQ8E=7e?=fpSA#wW#&bcX@jCFT#@q;tqS0rI3Er14fpr6=} zzq?zCVdepNoq^+H@?V{+OE;QGt4Tt){+F&ZmW`@KpKhnR|Ni|633it}Al$As1Uj(j zuEx9x2&E^z`s2J&3Fmh>)ABR7KH+M95otw}U~v4hVmT%BX%XJVa50Q2pfDYcy_W4~ zk|I36I^+o4#lQvgzaNyWoN>{u9__Uz!r!{C%`M+Jn*DuTc)f`0x3=j(aV#T%cod0w zA8#Wv6qnsnH>MArh!GK8e&%d8!mbJJDEpn@5?E?gl3FINuX4+SUQ_UfiWAzNJjM4=6E&OZIV4 z2XhEbFiGTxZbG~~hB8Kd#GS1*b;Bn4pm@L?H-6fr4iOoN>mb*B}2rhlym=IFu(iDetPGR1A$Z2qq3TxM4b z^JK|WnYSww=d;TT34ku}9JI0rOD<_PT3X*n*n-4)eB-KMhvkI}kMbahK~m8z$z;J5g6EN)9GlqjX0u zXq`_~VzC3aEEwkR}u~5x_!HUP&B%GU16S&|C z4HbB~9Bk%K$`nSH*RpU5g9)$sJYz5+!UA3H4Y4PA$@|%UVGL4`N64)%sGE$JRCMqd zoQ!{u#$&`@a!pLrlfSkM_!I7)$RsQHR?rF@j7axjR0_q)p5t(Gd{b#GU8}Ol;a;%x0t8lCPzdfsFuTF0=-@3}z{%BC;kwg6VT$ z#4q7%S$(XW1Yr3untF@S4DnOEXuLl8GH%+JR#oCe$S0W3A>LlMod zjs3zRQab;pKGrYHZgtgN6Y>AtP_ulFBaxgosmR>VOY^e}ht8YM zXB-a9Y~hQerw)o??G-axE@)A<1BQt*!&q; zInqOT^1Q-r%Ly6+cdzfaq|P`km&;&>LRAjM}xc&P8$uv*YNQ;RE9(WQc2mD?BK~D3qG~tJnHo$W<0DVdblfK%5Cn@iwVAfxl zWFwM=1>fNrzNFS2obnj*avb6-%@jEawBatb$#Z*yfc;dFw8Li09qAD0*rjp%`&-C= zA8zvYc9&CcccN8YuDEHA%t|H>e-;3Tk!-KSbQhIV3`?nh zUFYLSWdX;}P^WwNV|pljgGptA13&inyQ#*HW78u9ScXU{Y)+3+k`9XMTV%ntYkY4= zq62gBA=fBzJwAmqybdS&{en+g7U|Qg_D=kt#iQtgN7omnrg(hcEFdw6i75#^`0|C! z@P2!jGqFZfvXFs{DOtGG@GPiw3?~P$DjqEoEzL@FEcO1os&E(zKz}+_3)x6kvY$BT zOTD7rO!cTcKrv&g#%5BpB zlHmuC8CdzG!%`D$(zmihYNU65{v#CC*@5fTv;k#!>%~jw&*$|aujiZp85U|ad-7O! zX$ic=FiuL7mo}W`Fb{LMmeHn#19Vm-9^uu{)3^U_-@Zx!1ZbWlW06ObS!UkTioDz= z{kmndiACiu{5@?0{`%LQ_gx5O^ojM#`MHorS6llvHGU7jFtCicdr+i8gFc#m znii9<>Ab1i2w|<%BB#rzA@bK(ZX6#IfU#ZjUh`^ihWhki^=5!BfI*rh5`X3X6vX1|y6_If<8>mqXa)x)6V0y31_Xlb}N9t6?%ryGG|o`Os(R8K>z>?3t*PJl-)-w{MkcTw$Qo%qPPmtsvhk z(vbMd#xe#Ek=Oi`hA0+rFni*|S+Z}tcB9B^z5Fq0h9^TBsvm>;mShi8%=+M)t@Qv* zkqWP}vCkc1MAu$9LMvceyG%0LiRyT7e0`sGas&3yKZ9l*OomKrE(#F{oCF7=g+uQ7 zL%6XH_L;aZ^*N=Hr&mWZ?(Oe044nsd36}gxdXhabzV4uKBoje<=e(33H+gwld=iSW z>L~a`$Oj8Xu3ms0=SSXYbUSWaGQ`HqW9f>w*mbJw-j$W1*b%)^;|fKB(X>B>g0}Bi zROcKiR1?2bUW3J+-y%gumX6rf4I1i1F6|)DF-v1>y#2SWLBp6o7j)&3ucul~?$UER zp%&aka`jHR@}HM0!q98u)+D`?O_$GSxf%`|JPl!^IM}Bgjbu*LA)@T3O7g2Y?mP|e z@6c9Ym8LigK);6XBc1N52Sn6F4#_6Gz@;dCm8P59>dl$51-@8j7|Ae=;?K~qKLaK=*rwAH)FL!L zHJv0@I5=(JR`D9`W#Zi;U zB>y<~*NdY=CXp;$H7(NYgo^RJAIH4D8OtRhg=e|QhoU+ex3T10qS`G>I!}nm9JS&} zD_|)EiaP0JYV$7AGfNgT&H6mDYmd z5nliq8kb2@Ut>3afyfZ%U6Bx2&hsoNRe4JYhdEm&aYKGv@mvGp8#BtB^y&gp^YKmZ zxIFzmZGi7*;NnViZL=VTj9$w>AP7c}BN|3)3B5EAhuSuOw1%!bMP1uR6x3M|dP}b* zh`r@IDt+!Jhj^G>w0MlS1NHC{`%x_8h6DZgq%tSFG_+D%Mgd87QD@xty1G3gMyand z=Gxqxj(eL*DzK*!Ew#Du>jQ_hc~Vs^+fhVKjx2(^5wfsd6hbo$|JQwGcyTtVe=n%x z_q6_!QohD6P$sR~Vxb4ZqOT zKIM;uaYjNIb+UeJ0`L&&D^M1J^VJLLQv1SeXog&ap4R?`H$Q)+orWcxn(>rf_fus~ z0rJA7nErEZ(m8RhD#0ylQ_)#&dP6Z7kyL?8;&Kvz1$jzFsJ_M6DqjFnaaMi<_80L~ zLJ_*vc@H!njQ9>TBb`c^`?Vq?On^v7FJxm&c8#`G@ojn%R^wCeGYy2D5(rI52=jWH z|5M&2V8oU(SW@7!GzP{XBSej_xlcV~*m*oAC)3zvghHZmzYvYrN%T>6*V@0$OB=G* zfJ)XB1A6l`%|gd&Zm|*M<=YA+km?gsk|>ys=mSpS>+aKgbfUD)guk4~meSC59}-n4 zP4(iDl;6iq!IEv4@vJE&MyZ;KAX(*OvB@Cy?DU!?{gkZCC{hiemuQ7ZHD}ePCtB=6B zr`@Me+arrJl;|>QAd24rC%=LQ%w*vJ#53=rh)S4v)Zu&>zNl zmatbj@G05zv`VTUP5h7;X^h}bKs-k>1opsV4@Q&%bMEpq5?Pb+*(rMzzPKLAY-Am^ zX5r4`%UgeFZAj6Grco}Ym$#J;T_7#*vEoGu*1Czkot6Gf2mB$%m*%zf`6k?)fGJtq zJbY^&@lTPaB>OpVO?y|Xbq|Ly&Qem0lG5|)9;iL7i?wxCF0s$dd3%hpfxWOO4(p$9 zQzqe!>-le0F_wlCJzE_v`g;eZUB}~KT}Q2Kn6E{&>wWj3GOGALeLaMRrMAC4`(NK= zbE8N?^%1ld%YU$86)JZRO7d?p%-G_mO7Gm{2P%@mxqMVq0a2kpEJ#Pjc-)FfY1NW6 zU_e!;&UWKs>u*L?JdKCn!lOz9_1BWz0oL2Uh{GtINB(2ZvB`G_CA%usW3%AU&o6$V zOQys7Qt>drbAY*)>cjO|aG+Myur%d&kzB;Rw&|Jiu44taXP>wdf+oNpF&qR}^U9RAp?+i>{7CyBHlHo1Na%PP zZgoz`kFmr8WmH}a=QtEpY5%u9e)zXxgC zW~HA;6~;I*m>Jb9%Q`XiF!%( zD>xv<%czDZWcnkF<5D|*(Z$7F=hIzHK3a$Ldk#WYnq6{OsL(XJ(+Xgi2wM3xmR*F? z%t)~d2z(3zwxz@FSZ`;}i3l7`vUuaWF2rcnfYfli> zKl}ZGC4rG+i&EiNiwepgw!NLmJv0ff!->5>=(-V7=P1X9G#cu5n2N%Vk2aT8(=3KS zbqPSjaLX9vu>WEN8JCP9&g-O8zf}ix3o`4Bt*~DIR+W!mWrH__TVp*S$ho zbF+@FLzEt2z01^$8Ty9(>jpP?hP`aav~iGt$RCrL)9u}y#US#Va2PlujEdx4vFxJtt%B0`qo8DiNQ;$TaR!Fk=9PpYP;yBar*x4L&+ilUNC*}q84F{K zh?n5a*lvo7l|{u2rE^NW!l;me06>9@Swfkd^|zI2>p2@DqI0;A3hzVwxEe2oK^OH~ z17Ge2I`XhW%fEEw;iab?+9rzWPFAj@Z3p0Mj2KIHt^KLyCa0t&)mZU?>;CzoNTX}@ zln}S4HNW^&IVebxlPRI5k$a9HGmw9zkp(*k-{B!$k+Lw~TP7*Ab1(+(%EZD%@;oyp z)ASu_2T*bUmU;u==xp%qzDt$Ni-$hk}H9}@K2rE zX!#o*w|)>qDH)@09Y&uL*4N1XbyM#A*}ANk?SB|J45AHkJM(k-X52QtzRT#?9=`>^ zbRGEHM*dGRNkrb?BeZ1w6ywn-CP#3y*zl+dz_xrT@v%Rp`Y=V2c(mf#dPGb=~80F71xo=-@}eBRTbKB!dv>tM_xjf z_IGv7J6)OP+Lh-9zB+fpeZW_Q+FT7r=714(BzzS2UzWbDi=kyZo%c600Zp^s19kc7{jly*P}#0=9z=l zMw7{+G)fz4eJIQ?e1I!iR;wK&!1f=GIwFmN+0-;;q3dND9;+5$NyA2-l#^wj=YtPR zXU>(cQm8u_dJ_#1Z6OJ{s?9;`I*VRc;UZCM>nHVzA@0{yDa?{@iz3s6M^`))g$}g9cGl) z8<-3qC1xx}WcU84j}sy04s=QFNHpt=1DPWSs;*aWRz6xTwzW?C zK;3G*)p&@5U5Ma|l11p<|N>{P>TgG-h+4T^vmO zP!^7{aq5HDbu)f(XsP)xrUr6~6>)hTLpRSnFLn!E z9s-BysN8(FI=Hz|BV6VmbmD%&7hCfaXW!e*3CukmhW?^_3L@?1zJOn-f8Oqoor>dY zeHWa=1*dDlGng-hHyX(QP0#&}*B{Q)RJN5oCa5Lyq(;;D7kH#39)w}X3qSx`T!a_< zP&~uf-WSq61$)Y^eg2YFnqBsTtrUB|c~v6CeG|Ra*F|(nuRmq-Xkb!n6+;Sv;*{^&gCT#!83U+;e+H5ym(8l(9%alzpFz zy^0}^$k}!MM(1<=oYmVE0r>5HR$w1fsIFdMPN1 zsipI$!Z41n4eNsZ#fea&)YO$Hr;hPlT#;8+qNzGiiXwY8h1gbL2=o1zorm2>P;+(X z11_!~!0C|ld~gpwR)WmjwRUGvmkLxkK$(dzU#pk2^R}#!YL3O(cxF}o4XNz749fdA z+8%a99D#*jzSm_UV)$eKI}HB=CKia^jwIc+!w>uC0rzkg^36^sI#MCpg!a&ND%G+e zSHJQX!yMxxyho>A7TZgw)O18|W7Rf|?zdR0p=YOLa?ei{sYywJ1OKWEpP5k?mkNIJ zY|F;Z$;}Fli1xTid#!g?U8oz1?32!^qmj}c;d)8`#*?$aW@4A*RJ<4daf{7Bm#-=u zri1A>KUl?FqKHiDru*mF*@G89F+AO1EQ`O}xQ$}?owkpV#jZBv;wh+9169OaYwc2f zSi4Z;3Ep&-*gePP1woj~6;(Alr-j(k~xC{N~ zjGNc@t=C>WkAIoDN0HVrQ7+jP)v-I#U?lnjO1VO9-T=@bRlNdS(>dt)vo^dEG<41@{Ax)wV$qmk_B z+{}6fck;IOwPo0@xw{?_Ln<&T0(N(CLOMQtdmTWzIjXA1KH_%a?i%_?CHXIx_8hr6 zAh^QG@l*95pGZ67VbZp>4nK426LmL;M5*=JYA^~0KaS&3zq@^|^Sw*6Y<`H}aNioN zEdzXQE4okXARygQL#yH*hr5mqefCd}S1uN!K*=^%dN#;@+g9x5LQ0mqIUDkLK5vvJ z$ys{7kEBI)?pK}1;lW3{nH+@2%wN;QL<>Ciga-3dSRgi)TByEAP=&>hEvR4Uu>=`c zu#UW^P7a;_stRXXbJjQx!ds>x@|9!@6ZS$*QNv55wJ&BUT2%@)L6lzBpo%h7)id^T zsl=)>ED0I3{MB${*o_|Lm|&9T2nZ${gfGUKK*I=ZRxPkAeFEQqJ7Jt*qsp#A!c_x* zo)|`DDHp6L&G!=0UzaxL3N{bR?axX?W|w@&hF+nR;GT#PWAfk%^F&k2)k28vB+z-k z4$sZbkndz4S6C^+Qln^z;v*h-KBuOI#xHtIvA0tL5VhO<+b&_^xr!XN8)T)7gKWUG z)b`;#LPK`er=Ry6j{oFq$MqhbgwF^x@BC{vG-%C!&+|nUxFbEp^jK>(ngn8-#G*oyU5H|9T%f`nqEO`r^<|N>v@N5T8cX!E zVGQuDo}!{fJD?KGLTqQNa3IVR_DLb+BIEH5}hIf>~ zs-R=kZ+SM!K4pR*-4k-NY`+MiQ2re1PKi z^fvXgDL*F&^;b+7VQT-Ent-NVYo-Y1^x zoO85ev7{yFA*r&2{C1GYmx^QTJcwChzjI0Q^gAxwQhRYL3`ul3`DjVT`JO2iPl~}3 z%M3z(^cor=&{JJF`vTr|S86moCDDD`*7L(4{gSI(3Bt2VLmG_sA*I-+R>rx@QidCv z`Uk91eKIU@Za442z9Fr;a=&bJl=bD}yKZMI;-W%lYz~kBkY&u3@&@)>9@$AYu5-aU zk}o^x7jvO%bgCWWiH)1yDPj%#r~Zr9F_L`ymqrMZ>X!F+r}iKIpGD5+VU_fBofDipDlNDA z{aPb_>9k2A`VWSgiEsM^ScH7@cnb1;SvToEKPq_BpO=&|U00tah5Y>pWhBEEv7lv) z_#+*rm0%~AuVqhwiuW92co%_eSx$wOzg;JDOiOkL9bn{sV8i_g7E`!RH&j_^=zJi* z3|;u+8#+go%t7xf{1?46bjJ`ou^d}=*K`kWVnpoe-SP3CiR{17(Z=RC3$j|1&M|~j$Iiy8P+D;u!-I=Gqhf^j$ zxk&$Mqov>@E&KG{=Zn2Ny4e9H<*@>L?-xDuj_OcC(O{U)%qE{l@hE_r#%oCD9n3Z5{AnGH&%2j_|wnvx;u{#8eOR zPEq$AxWCK%y4hJ!32)#=hAe!hUi!|ox8!_Vs9X<^4JrRAn7|pGFIcnSJM_t;Vu*rI z-lw0hEio3piP!vLfBUftUHmxt)2@n(f9fHlU31XW(A(gL(zkH-cuRS)2&d@ztLX07 z14JKfdivGDUzW5f?%@@dsWyxxxFd5v8`t}4XpvEyU7IJ0o);}+l#WULlS4B4dO;=>choRqpzW)1T!oA}om-ZelfNB-iaKqJ*u=LuXq-}5%ks%&I8bE&@BQ4rUm^c|NP2!k zP&gS2FwL501(E2G?!W4!hbLNakScV*Qc^E!K7Y|{+e@&UE z>E;~&rlyWDiMU%QrP(hD^NK#x?(ddxIY{}~7M;EFM&Y5Ul?O^ROE2SBIgHY1^B^HC zQGjkXH6%)t7yL^F;ob!fm~cHqZU`E8CRC0RA<+fvnf3_>;F6Q=Ju+k(?Uhb@YF2#{ zaw9~PJTog@nm-ca=Lz~2=QiVhP$4N@eG7+j_RM{C?_BL7Z)N@ar!xWi55566HieMH zXWpg&MM|YNkf?rqT0eaKQwcuPDs;DLqzxT*Bnfn|3?o3CRG+(q&tDBj=%r{7Co#Cr zEAX}Om1zxk^U6CtQ3UKBs*ND2@=c>v-s+34^Dp=4t9)0H?KG2P?jdjn_{i9>7U{i^2Fo9@?%jUPk#c}>hl?})-6p11E~d9~(+T!a935m5s(!JXFdW|% zcExbro5viKrszXl!&zeHon&If;Wnx0g=#6nUD9bpx`uz!uHr-Y58a|ji>cpceh59B z$UBFR>C^t%nbLaZN|U}|9^6XwmO>~H`S1GQ%k_u8yL9-Mf3tMGB4;fSs4imF0oj&% zWoOAjg3_3t-1Ybc&%Qtgv?^Q{Q%i}lQKi-q+-Z^U|K+QS-+$((#Ms?PyAi(7 zv01JP#Vv5U{A^(h;jRgA0KA3D66D!8X)5R^U13rGuIf6_j!i2aJjJf_`4BcocU<__ zaPZN$sFFH2z|unNU3DzZ;jFgeJn(4o?bt%AISbD2k(sW-ptw$Y0<|757UoK569S*7 z06!q3`0vcR$czIzr<)@^bPE4)oCWn7DHugg#@q)`dX=(Sj}B4}^YX!EoN!aR7GR1! z)x^)3*R;?*mz*v~UrR>)ex#{HXf81;eM_ILT5OHNEq@Y@si|feBoH>s_ZK10PPyVV zZ1ReC!Bdy4*TMgX6$q~`7pN+~A!CLh`v%pNWGFlL&zp5mdqW_E$8CJRp+JvlWnPlS zXq6vM+_vJKh;EJ**pdSnsC+qOKK@J@%pw+B;M?2T`d!^D;QIXZ z_XTP&P?tObm8wN_mO6C8Yx&JRftVH(>7v~IS`R1e@FwdqdOx*O{lV(Kc*8CK2NgrP zdW4)Qtr|_+ccRPoBYqw;(dvr^u4N-K!ku9RU}ZpJ6t3a0K=TAKI?dg3LLkMiq9(#b zToMhUHcl%5B?FRg!bzLfKtFTF9vrBQwa~|l9-lCyTRJJM>=_r1z~&f5QX^5-YB#aT zo6xywp7==7D0s`8=Ne_CrpGOf*XWY`5v;RGthURtQBwJTG@S)kTV1zCae})$1b2!{ zaR~%>cXxsmEiT2~CAfQ`Xwl;C?i49dtS^Pqe&LRB|3OB^$;sZ&de)o^lsRCQSG0YH z3h4pDRa(bmRyop&8A5NSFZ*dyLG9-{0u?@UBL_F5=oXEiE$>dtM0icHqNPOs!|P{O4*-_9|u(2 zgs9sS49b%oJx&Z#`PzzQ4c2ioi6OH5&W1p#udH4Hc@zA$8@O27r$Z;+4(j{`2~L!l zL^D74ZHCUp&aedh2J$n-KSCh2F?SE{)%WwCJZswwALb9yocbXJ$;ABs)pdSqFzuuY zZ7_w#9gqsi!%-#$I{4tB zDs3LEv3nifaWoK>8<1P`NnR1F<_s+yIl0<8?vjdCPFKpG_s^~v#!Qhalt{|ld{HbA zSUHnADd7Fp&c{m%rRjw3geAs)rA3%fdXr^9_6s8|sDGi7W;R3)5nd$4pM;lZs}z|h zX_RP-SCjyPq-F*?kv<-e{%Usioeg8z@s0-76w!5MGyrL{0l^QJey7+$g~WwtR6HU? zRqrB_^J%CHvkQe}EE|WXPwqrM83JzxT3^hyeMvUsk)nvkdKI3k5!HF4=#2qp91-T$ zk=jx5GIIP(y1oEi$Fky6fdI8QIx}z5&Pi7~>`h7JERtHTpu}cjQUM^Lk>%hR5GJ|A z z7V+jmj&kXhVKSgB8qRD#-l^l#4mO8OxX4MHOsG7VKkRt0ncj1LE8VR)M{E$|UV}6p zMO&+G4CtYcB2FTBgBqf}Psq{_A#kl0#$5CGV81Nt25Vv!FnA0ATz0AQqJas>71u?A01FMa6en@iZTF~971j->l$N{kZc|II|}8? z3ZZW52%acqewYUZ=GPDC7?tA$ZdvpbEG=BBRat6aiT6VsNT9aq6>?aqM&@1i-$+h+ z0=<#^m!eeb#div(hVK^%*oC%d+4kp6lMd7}Cw;OG9#mRT!~T4uomkN|qZ6m%n# z73;^pM8*?6`Eulyn{t^U{piPpAoP;>VE?zA{#hWn63AAtB_l z1^)y~`!SRlGu$QSrR|)$t#fma&37E(UJi|mzWycIRYh_g=S{pbisji+<+7y^Mk`^B z)F9r(-Ab||j*l)?eFyRGu5Vf7fZO~ACV+sz>bu@nTn9iG`s3c!UfLh4xb|f>{A~&; zj%`U9Ir6&?SN<;_O|#ReBz6c0is*27{#Yu!_?rFw=9$~Jtut!G@aH-{6%(yV#`d|H z5BAH(#t%cZ4T~Tx`o4RGm*Q>lGhPgKVLV##UHnvU^gGJ;xwOJ@kJA6T>wBY&u`hKQ zMs|c`Y(ml$ftpfYfBuf&W8GIVFG{*3^gn-HM{jhapc(SFk>mt<&_XasM zM)!#C1d4mDyHoBEpuFGZzP|DDVNS&%2T4xP(_H(*m+lIrA4rk^*!8X6zbSk8GmH@= zM`#^%x<)yKWUQCt6_#jzhN3_3-A+xQk^n<2k^SbTWl=sK`4uYl0xRA^DCB2{a&jLpu@wP3C5@FUCYQ%AOPs)*ZHIAZ zwuV>M=>G56_hC3ev>$`3Np=(tn*>(`m+67K=O^GfymddM)57+f`NBH_TLUz;rl3^t zo2D{*^@K`9pF3Dgq#zqRM|ZbTxv=h7UC?~!G3e58E`a#w8wx16u$*9&OglLG{HMpF zP9T|4GV_girNC+R&~!+a{O-IZnNJ>W$jnvdy$R;uUSVl ze-CH^kPa`Y3kj&&XDJdf)bzeqFKef(5;B!d-xYqZ#rispR74Bl6S|@lrFkep71`C% zi7fQ5TW&;u%=3tI+6?6$ugf^PskW!VfQ~nVz=YuBja~##ix&~0Y?Fbx;C7i29GY!d z*UGx^NH9}#Z=G8&r6=L?)w2!z;+@0i8n&RX)4&89HbAWB!S|5s??v|o-=6~f zMUl5TzJA?TF?iWDs?4>>YhJjY6;t1#6?WMBc|+WP-F+$E1uj{!ABxuh@K^`s!f74M zI>N!>nffzmnPkp|JgL~A4iX>s6lKy4h~+Q6 z!)Ur!Jt#92u`NCILbu3$M^y-8K?EiaoZr*6^#z2CoKRKpC6TM?rOg*c!EP08I_$c;wo-qcGu(ZbT}eX_XC)Vz9}~ukgByJx?uY&~012pQ+G5`XhyBL7v3A zALi=00&jBtG>ADIP>8lgoy3KXmOr{w#M4En?!(3lU)3vW-8ZYC3U$)`;+t@sw?E%; zbz3+)rD}mmW-!n%_hsO9b9&+r+`KyVabz{L-;9n) z3857L6QQ`&+atGWw&}_5))TC+a}pM4{Xz>jXCH8pIaA&ky+ zB(k&|s=VBGmO{Q?Ov-!_i!_Ckr#_|mvyZx}Muy&@0w$mSe2oua!anhSer3ZMPfWtJ z$k4P38Oy}Dswkj(l{PUh%1@pOD&W;|Nhh1;+S2?LteTcD1Y9w3knkXf!%ad`#1`6e=64i!C59D7qk9c0EEsQ(lpHcGQs*;ICdcp4e z*`tOwtL|x3Gw|Z!XmpHl#@Is#1+#eyIn6%&=qNV>Qtq77Hjb4Lzlw7@Sy%RP2G!e^ zOSx6~N)kaR`T8`cvNwVP-L$h_dc?!oZ?2s47F{{CG^WzeQfzT)un{lhUWRmGRI$&N z>oOW#Pnk=yD*8p4J}!kQl1RSj!8RiBKT2uOeTyFc8R~9*9&@ zidk^QketxxatYEA9gtca|1Cc`nFAV(0jJ7<#1hw+N6k2Rn{w=DeM{T{Y}Y)8-CqL)!&ja6T`VcP?06a zrHJs@;I?+lTPgW%ACbjdZMZC3m+m$)$0xbWqA}-}Y&cLX@c~|N!T1BLm>gWbuK_wK zM6Z+5a=Wfwp!&Vb@r$5|2T`^Qw*`U7C`jDKYu$k9HMFIS8vGu;XNP>U8mlSz0Jo-dM_`IFPm0Hx1 zp|bKo>~pk-!*v(aO}$Znv)i)FKNu;sUNJu>e9saz+}L7-5bN=92=HniaGozY6g3a3(7e)1*4#z)M9*oZ;N%G@}OPR$gM;;M+akm?A z;N$pg=66nL>CN5Fw_JE4L6%a&2$!&1irY*V{G4T;Ii-Qu21;NO8ORwO)1TcPK{A@QHUfC=_QZVp3pCt&>hI@^_RPYMMGI7w>c^7BNr9EzoO81(V{O40#^1IU)q5j)M$)^ZOkFzAmEFW5S8Tpc; zdvHpI%vhV{xkP9Q4EXTayYz54&=42T;8tLO)ux*yVx-V)#J z@T^5`uHvA_md*FP9Ph0di--ZL5nHONviH6zzA-J-%oe!5`RU$mA7PR3XQ$wdSWN)@ zJV#x?Gt6Q4l|0WU-zJ^5zO(<}%q&}Lv4l+gS_%8(qy9%*0=>oCQVH%H{5%|76>irL z(mc13az3(OW08pt3iU?%UjHQxN@;BA3*kv z>#&3*@J;a4^!4vEoJru-XQo;{MyXoBeV!dz8g%caZ|`MutzSXwLom-KC&!!yY&S!O z604cQ?MqnsE30xWyqGLRQqe*kZ#}?KxD$qiyBp_6I1)}hBHt0XQAa*zx=DS#rTOPc zgXUue@=v3Z;a0iO4f}V;{f|!|0Ksu%RZ@hP%}4o*Rs(o4KqTAeAJ=Q{T+p}NyRu*j^z%#mw!uk-2QV)aN^*@;*^0ze%PKWjWTfe8;Dr_ z_nf1GMk1`cwc7bOaQ9Y!R|jGLesrSHjggGSZgCqlCboMZ zTpm^wM1#&tWZ&dJ<6NH<{Mgai#|cUTBxyE^IJ7ki2f|3m4qtDT2&&KZwnuvCtPf#l zO-5AUzCQA1?!%Kin@}n~G!bgSrt$oVS>P;2@{eU&QI@I4AaZRGFIm~4ROcXs+0f7>`IIaIL6-3481O7LS?tM%JjW$d-%4wM{%cvCQCqd|O#KQzG6C@N;%eS z|9t$RtMcceuz?8=B$NyO51^IVa*wqk5(~Ck; zeW;PIYJF)CS{wcaeu1q^MO^Wpgv*kLda>M4ZfQ0A!Ppg8Ghv9)6V%(dLR>K^r>hd2h_C|Rek zE}j^-Jr7Q`q(XZA7t^PPrU(uAGS0oh+ZcE_OM3*Px^vf8+Zhi0jv(C$hqi&Gtf(8a zBndRQf&zT7pF~PdDT$?zLZn1Q`zz*cU&X?nz*CrIHfPi7cIGchOp7hV95`bu3*6qb z;2<1BSGa7GccvI@$<>Fk#s=g%&E4hmQ?oj$KPqYCn9kMy!Crqy-@MPSm<%)EAbAVq z>9r#lWi(g=e+D`+2Hc};`oQZcO5b)EPE>{ZFXFO{nuMToeI(kZjK}s2? z$QJAoyPCdJ`@D%+9}iMN!?GOCjL)fN+AH&DHwRDx(h=dm@B?VRn&FUvEux5X9nEUh zDAPrPm=1n*Hw@P3)fP53zU)X|GWfBF%+NR{(XT6OSXIYxUF>^XqHi-K556CDXr8=#%` z1@*O}k<#cq7AgCY{xqxc;)>B2{LWlhj;7Z&>MQ)T+M>GfyXhg?{Iz!^3lF_+!~Dmj zOcS_YfAZ!>E!BH|xt?emW||(;NNp0V1fm$ zfY3-3?uccyqd!}EudBAvaf<#K+>O~umxvOhvjO0Fy?V?TvD_ieV?P*p?t{Ecc9BOy zV@MnD(@D1CdoxWDPw~r%>)uz*Kb_^sQlq+#%W*mH#G$Qi=?tZX6qs%`_tzbB@F-g7 zBAr&%*3rMa|BoiD^khHuHkMwU}u;1`kLXj07L_Ok~tFQyT6V$e}UP+{mbif;HMW$#js!QdJsZ#N>}w6qo|O!wQnvmt1YTxTi(n{FT5H zYvMwO;E{cIC5;@LLGK!(EP6~!F2Y}`%Xuw#B`2lqD z&5<*@>VtQ5th9_ObMsPx$b-%H1nrcBlf z0}F2%6qDasB**#^SJ7b3c#uiP58%l5dZ7K9Wy|{V04FKqDo&p27Xi`vwIP9+)FhF?jB0W3O@9TX^4MaC!XZSBus| zxanJvqoO_PE2BFy_(#B!67A5f6jf$BZLA68!lTv?i+Y%-A7S6v4+dCqxI4LIMtfCW z$}Iiq&p$pH1#LhQCW}3pR>sqVWz3+c{0n)y!7I+^CS}X;aBO_EY}0Jo-)c1Gc>7Z^i3~+ z3?7sa0_(r)qRSQV!7M zTpn%H{Oh!BD8;^yQIPI!NXkm$Av`LGT}^Hj*${tT_`a)l!T*EfA+K8!iL_dJG>9lA)IzJc8StGgZUvu1l54mB~--ONW zvGPF~-^U{nb1D^954dMF63>KA@}=X0JFC$=^gft^xl6y-3$**M2TL|8J*TZ1yY~@^qb7e5XiT(nZYxjQh2;qdppM$?ggG%AfESF@05oSkKFvM zSqyKW!E$*(gXiYJ*hEnrKsMKE^>}MBnV;M=2d9=XPfAlIhArr`$ zfhfQwGJJ_X`Tu%CL-+<*lyu1CIqLtS#jVsIv&g}k`N>0UH-}~3CJM%x_7$WX_9UEJ z!$3!f@1%xT?r=@|+`nnPll_!i7j-^UTQ>q(u}P)FdQz*Cx1x6Xw>WySsiMLqHbKYD zVYV6qnIWDO9rY=wt?ou{+cB1igZ7!1ks}NRr4EkE4+#wx@MFeOBD1C1V|@!f`J9zw zs5sNUUUh6y>Jy^-MDrB#OBk|}cYQ639;DQ5WgE#Zm6c~!da^-4sam7v650cz)eQv2 ze+UyGfv1~+EA~Il)q`)l&oL-wKGmU&cZj>5du9G%xUE!eY93l-~V>+oB#NaiK@uYy-0R z9aR*@G!-}1MS`GC((dfEv00uZ`hgYF06nBfK=vb@{jAkECS}5qGyJZ!tboCx#h0r*hgepe( z0jI~IQp}c&&*{p@8OMYOw=flP9frgmsU25G6q8uc&bu6AA0Lyz}8_CGIDad7%09Agft&3 zoWx?$$*_rDqV?P`N(W)uh-PLQ*qC_mS~n)yc%3@jz5R%j=ZSd7o(;ufwW;S?G{6YK zic&rKd(^9qKlEp>#<63wuO~~3uU;asfa{(sWq4$Qp%(3|Q(~V)v@>+<{?M@)PEP<1 z$AUV*(?kiC`m3DsqFlfamN5F$MZJHpSn))#S5;|OLu{s6#fl5k#u(e!DLPs}deBm$ z;2L^6U5^}|QcFEfw$dHfdqmgqV1VapVMZ&%mo@z084rJ&CjLsB>dB54k3>)R^jW== zXT};GqzyyIaD^pcadWJh1vXSg+l46`Ad#M66qH6LpD*HcJ|Ae{oX52wi}Zhcp8NM_ zZVxt_qY$bTxU|T}A}diz?iYVKFmAZuA@EuJm2ZWVduTj4^W& z&$!U!++RjAe;TqOJ7Rus+><@nuSrDlzsSM7H;y40w@hSpkj;5twEyY5;`4OZBw5kS zqBk?g4@B7GkR(pj1IB2_t#f#=fhDVu+D^&#y@b5a0c6d6SfTm+YieER@F-W zBK-7cscErnd`)H9E^?)Xl!EhN0C8K+#4d>kRLpQ3?^^af$#lf?R==qi z28q!Lnr||5tXPczc9@kcTzeZoz`X38`Q!gaLdU9K>(Q91J^l}@q0)j~6>U(~OIwe} z!@ut{2D8e!-_iLLbweHn^8sJf`@F^f+lK7jWp!3}PkXiXfLw8U5X9r%xS{eZ9GwSy ze`fa93xItIzuP2V-i^CbY$j-pa_^!wB?29fd-S{PJPW$u1~eEPhhcg|9s2KL0UsNh zm#dWj!BYAAxAC^O(GG`CtVorK%wHHt=J{@l+kW#?=QZ+2k-x$=0l5e7uHUwFIM)*G z7&ZbK73$6jj@L{eiCUQ?=Kr4844GM@If!W_EMM+nkmPKRaO=ph z^R?us@(;-d;_-=lmKtm{Y1o4Ql;yoFcMc5gn97>(%@O#Ot`mG0z1Ka^6>kqL3^cx+ zdadcaM{Yx33I9viQL1eR2lMl=3Au?{j6oO7c2TeY zA`KpyEKT+yX~*F1)rdOa2pXo?ok#q@rx!C#7&^SwsL{l8o43~c?S%C6YkNy-234ON z6oPIiC2=sKhkH|f94#*&o$t_1fw~Wv>+B8ELatrkCLf~sIOqwcNe+P#Ma~_q4yc$+ z?DQoI@{(Z4TI+?0gjU(EKd>!E_w8m3TGMAgS;j(T2QUqK%!2Mn^N>}WLb5f3=U2u3 zDPK>QWXP<@*uQr*jTw4>105Axa{j(s{Fh?*@YX+Z+7?JNi`-I5>4lX@GU->90<7iM z>zv2fQ*>vqC+#(lKFoZ?HQKNYwnTfnUg>Gg_sGka9}cIZgz>?jV1c>nNuin$a=20L zVfBzXjJ}9Zpf04zeV+!h_#x4A3tL?S$zQ=WNBx~$9n;vdhF@pO_8n)kYMZ7EI{|F> zH*EDlK9o~`73TMO)#CgU}hI_yc&-QIf59eX#mtV22%p@z*Kf%o9TOY zQ(7!BYQAb4^B^rl!lw}TAdFaz56K9qA%W8!V{!Y)>N}nVPWiWfgr9Zd(z2Wx#)q|? zg|7LgTh3I&5<^rhDBdZS%nj^^vh5cQcd_;M6e*iO{Mnnf;m1{rV{f86sF9Jm{dSxe+yc7uv_(a9e-xi8bin#-r zWQmAH?wX->$|zO39JZu`ayql?zm5M2aIwwPBt29q*1W&>Y=!Xp#q!e>(3;XG#CKr<$quw| zT(rx0S5(>h;C=yeJGx1cp{F$|9kJC!;Cp3)nPY)lm6Byn-!vGmo*x6@KRk^7WEE(U z%%;>5L9I=6G?wXUr3eB$0}qX^e)LJWg>t-C`mt`FtWuB@NZCra+$StWVWr~5S0fw0 zAVEQ@jxvS;=c2j?^9(aGg+O3s5*NNNhZbBJ#GGgcfc7v|AjJ%@_LVZ4Z;;XLL0RpM z{xVJzzxS(_pISEZTrT{^LWk+m)oPju=f_W%H6^3x>Kqn>|5-+Arn^+Ete*Q)gke@n z_)1>#uV{hx#L}Y9mGxKFS**lyKaJ|ZB+`s<*$~4k<$@8GcIR3&(xlS_&5}qWgkA?+ zteDhrX0ky{3VNe~Hs|KEax9<|G8r^3l*=Wz56kb)9%`4J>4*ghF~kceQ;j~FrRSoM zrs20e#`oU+;jR28KEfoiCf>3bj zfyk9gz9+N{8ETkOTfZg|MZGArlz<$f8mH>aYvVU*Sov6J#Ooga?)6(ckzyRC0w4E) zwp<+d>d&+1TONC^#;Y zqSOwcac2;4SEnbFRGzR5TUhbY&aRgbw{tpoj{38~c8`yM5*;P{8yD z`jvu_r}vtCw38TA9IKn*EZY*qwpcMFhvQ5DVU1D4h)NkKi+kiVrO*P?csV*Tfays0 z{WZe&LiTy7NlHd*nkca%rkqBihp3Qi`NS{>EdVY)NV&AG8a|s$dRewPTPWYX#%$Hb zk0>&z6$ScpT-Bl$82u8mxlAZ(OZ5+dvQ^i^=q*E~jqwJWQ}oG%k)*Y^kMaOM(SE3+ zMs*V%lcQOei&x&K{d4&uN4`ly=CaBCAD{MjJa7jw^rnYTn^{TJXb%>a)8JPsn64pV z3~HZf6B$@_3mENI4D^1F!|q4F;hMMG2Vm6{D#bH(xMqtln22SOyn&l}q)DyyklZfX zr3y0nML2;BE9*c%1 zG0ZQ4o-|Z|M@K8?h1@e!M<>o$`ObCHyo7ZOimLXU*q=n7aDJ^a(@4(KFz-~0aZ24< zF@CgEq9Ob(Bcy;*9jcdhB05QwJrap6jW6LvYdPStt-T-{DxRy;CGKGu_iteHG>PN` zQb@)&_fIJkhwCZTPlT)zpqbW8IaY}Y6Rm_wJlrnh)7CMiz1EynEz7`Y6*_K%DO;_Nn+$T174^K?+f2C-?N${5##O%$7`4>-+d9nenj?vq|6 zHnzGx{)BTWK_M8-gzKb=9`47USr7sK9vTg2M<)Y;S4*A1xOSnbpyWqqW#v#%hQ|Cw znii@Ojls-IT?Kpf6d>Pg4o3 zjWnO#0#K=9c*yU0DRo;&& zdVmhCUqcDhR!SS0E7AZ?uHnNP4>wK8Xs$W%236$=WKl>x2NKiYwFjR_2%fd+2a%nju6vmB^ z(k4`7U%O}|=3T0{FX$#v>#7_kfvSP5mES?a+I{(>iZziU?L{9halO*j1fmLvC{I1Q zBcZT&arn}eHcuWf$7Vc+Cw$1r)Gm)STu}gOiz&cMyhF7BQs2B-v~4%DqW_C~NZ>ZX zfG=!=#r!%@9p9+m1@lI8UbR_42UC*uKgfLmJs3$)QM?gwTF2* zf>F|LE=n~YNRgvM&svf;bZn^F<|Y?%l!ZmClmUcE{YLrJu>}_^B~J`hbod(j2%(ke zJs;ewyY?ucY!Gvto#xDc z9zzNu1vYAR7u$GnUtAaA!^If(qtl!{HvfGaa78pWNT@N3T%x5-j2)-I$oD4Z#bP`G zmnD{MAi(iP#Lpk+)6+tia)(`@OB0z!LqkcD*sVGTF&`-kdNRXuWz3$kxXh%q#CfH| z+vIK1*n72MVGR{gzjpvGO?E(Tf$}wJwkfoNQZVcaQ}LZey%aW3=YSCWfE_Wx@_LaJ z+)tRRD5Dd!j0o3~)NGUwXA~tb?LAB3yurV;Q1QEjB+Q$hC-(^12oHQe&-h#KO!Ouw z(CGP*9(>;)zN4e?wE~`*N7-W1)McU|3ebyn)JOs^JfWe)8RUIRxSrAOF|ELgSIj9* zTc7Qi;}<;tLFh>u2-4Z{kxPzyzd@J=dc*g#|?d*v|{A=dmmed9CUh4El#;2o9W?v;w59qFCk zgXRQjFP&X8t}u}8osqOM1?FISQc!x`0(^Z7#xYNTQn+78mlV=jSQ{VDlP#-!+MuQW zB?`o{a?;|_b}mSt5){U5LT^0@Qhvx$aY#F7W&p^;aq96=xQqyH?Z7#@ zN?ZVn%bsnk)AE4V_7ygb>CEcS__?rwQ0A!1aA)^Q10}pG9THF&Rgr8);WC}CA+7So z%Td$I&-_~7qd*Uoc5BS~3&))K`X9tm1rwV6DrJ|E2R}cR{avLeBtxmxrrkSNd z1hU#xp@#8p)`y>A`A)7Wxe}W%M;wJw3Z?N|joCctb~I#0{y~}%M3geC&@RHfaiLV? z>*4~}tG7k+3eJ8O+xxBdyHF;QiCS~YTIWnz^q$Z?)!KCqF!VD)dsJueh-#3(W52v;J>R+=$`S= z8MWMeSUQ1ea9bxpnBsgM7q)r1?rI@h4BK5m(w|ZxFgNPf`B#c^YUjZ@Kgh6YR$KU9 zCL?BOQ0e*CxtT`$hNgThkUEtblmH>|2PG!J<|uYFh*cGQj4IXSrof*?UUC z{kfwd0c-6N&%N1)xg6Px6e3BmEr|n#4!p3jU2QVF!>csh=tb7gra8?%itl%;E_l1r47xt!zYWu0+N=~y^uY0% zn0m%=%$=)qOO|fr%W%|Feq!i`vlR zK{h0g@*;TS{hV!vI3p0P+Eoo*H;wx}$ox08T?2ecx(qmFXrj?d|0jPVm70@XxK{v6 zxw4GC5y?Y0LUNK>Q+W(#RJTR#ZIq1Ee)&8r@z_L!A8<=$wWe?M_ce{&ZWw-uHM4i= zV3Q1b@6mg^gARe20w(3#wGu@!Nn6!p1~a2KR2_e7;9q zir1+g&Y~qAb0|obLQmQvPYt1&_v&H7`EvPq@IPB8(5G^h1p<0>#!|CVp2UM?O$8_H zdG3G=+GQqu_U;!~WLetTQ}MDPl~A?d74(^`W+uHeV9lC?>M5MSrE)bbQk)__lbtY~ zrF_7|Nzk$!?Ii~3c((oc0Jv?h6@}ERJ>1;`tCW7<&ca@!5}8gNO(XoY>_d^T=MWf@ z>!nQEKsj*IHANX#77P1hkoZ(hjaYcX&=YQQnkyGu!8V~{I+^|#$N@^sY5%fVcTB+E zm!_DZzGB@}p(oRhN?WeE=|bUK4_rI1@~<#u(z~-g!0*i9yxCg$h8LqvnfhgF3MhsW zCikJDBc~$78{UwW6Qbg)}qayz;DD#Qtz2ov%#^hXn$Y}xRr~tqXmplb{ zU*RtB@qLis@T7fmjo596!Dc+J9Nn_U`#mmdT9*Yj2_F)P!z>-b0Mo5ShbhgX;W;IS z3r+~={p2)*#N8s+4o2j{7);T%wq?SO#vAQeZPjU%!-;3r%I}ttA_2@g*4tIIRqdY3 zn%wd2HCkC^$^`F)7P?6@FzJkDkJix5eA%-&qI@dq|2z?h{sNl_yqN!cG&gKdoH#E^P(GX` z`0-47T^i3tUx_yRW=z?8`X=N;I&l1+>A$}1Q^*z&4KgD@$+47N?n>T!bc>PKqrsdqHf`K5Uo3TjS>|FxZfY`w~PbHSyXqLh&58zkWxc(yy3UJ@W z2{|AX)fl{Ii<+w+Yq2v83g-p8%PvRBB(uGK==@y9WA~ zyH%cZk)!OS8_khS^eh|Ii&s7}q5bDmo@mrm`2-4>L-28lHLRMfo7j!y1tHDQNvX;X z#G)msC@+JLRS>wkthYI_?#P^eh_4g)(#>F01LSC0QR1R4su?OpEg9a;w>ndMZO<#*fAKGd|J-djKlI^Jsehe?QBekN%(A8H1wejb%wrG;`~RF0kSHRqxHvl|Wk zC@|=VXX>}(Q;B*)FPN2oe&B-;?;w89WX>&z-lK!_noIF0`WJT{oPcIAq!hiHDlcdM zT`6>CdJ&;u$4^sOsxkxU8hQ-!%81@NK^Ujwfh}|T;)m@V z4;D)0W)_?Pl)$a|Cfpl+Fe3T$4|_@W9Tp2EEw2>Vn<2~P>7hz8c=#VCUZcJb+5HjB z@gfN$jtiT%$Yg?dLZqt7Y9p54svvSzsIZ5RGAycI0*RFBAtOc0#~()Kcuh?X8c|Sb zQ0XD*aoJ!9o;)XNgwg761&s!FVZ)bR*jR?%agMf9Y{FOUdi79_Q(#{ z{p^P&>M-0%wnYDOQ&}O%z=gSf%dl@AG*_ct729`Tc;juyhYltI!I^A2{^);eS!ez)BSKAYKpVJwE9n(U+2Us+) zEH}WIa9jpxReCHh^itf(Mt3`O`z8f|1^mUn0ADmX*SL+JE~dZQUSJcaE;x#?6Z{0* zzoKgIwCj3e*I>`ETcCIr1h=KBjzX`8!yL0ByL|1OwfytNxT>btkC0JzGfVtMG=o7o z2fhcC*EfH_PEl$n3;5`5$~GYtHJ%;M-M@XU~z95$ltbsI`a|g%x)kxt}l=Zg{PwCocQrO^V}H&bK!TJQaM6z!y6{B?n+ zfAg_<_NL^fHF0IO>_xoUL+O<)P*e0|o%-0Sb`$g4b*9(WAJ_z9_sYkOd!pNAOY&Rm zs2g#`-@6`_xoJv5pgF3T{TPys4P(HMN@}W!nA^9tX0 z{(JpE8F~HIBB>y}jMu)YJEO^sS;D8Z3DC}#6jSZHm|)N~s81Y(|Bx*F6&LJ05OzV) zc}X$Rwu%S8qD!3ZP+Z5H+UOv9e}8rG(Gl!@CBrKwX9vzjSsRG3}+qZ1ya*I{nPf5n&lQFmI;#$%M zTxE6R1f?m_e5^>NaI4jjt8i6G1z#WQWPTKL2I05amg&J6Ub@Qa^jY$rAeX;|xhnsh z$R;wI28XHF4P^iNO^KDWTbcWxoW=|=xD^Fbg`7V2NNd}c;r%me>~8(npRwhO!gd^U zibZA2`(?7n5B9<5CHw);cfzA!d)>=r=>ES!m%6G7Zr3=v3gee8l4PGBw$7iEwo8d% zVTrn-|IYn>AIm}B!FloYen>bN_p1E-KC#&TCXLwmB81T}MpefDx zCWF{DXXif_TG|0JS`EyQR$-K(n!rPr5S@z;3paW7{HL7;vRyec9a-L?Hz|k;s?*&) z-`jMZVx^dhQyS0q0ku$64T?fXHy5ceF&Zpwj_!A zw_Drv5NTcC#B3c4EQ+QFevqys3hCHGcrV6pR--%QI=c|$*a;?P#{$A0l}=t!>NM10 z1hAKAEIchLQiOl7|Jj;1aToT7@*Gn8`Vuo@Vkuf$XRsXa3-v{M0t26`cm5jU1(wur zLOFHJ;xeSPuviJdD=0((j568zm6K^sS9S|j9r4x9F}5X~myEnQztC3vQojJk61KGd1%;YSc?A(LaqX*2ul@`z4rBTMv;kGHfHT5sKi1B z7~5fwfW_lahl+%ZAECn>5|zw#a}Y1n*)(4bhXYbgkW|R2Oe-x9{fJ~1@x^Y;d1#GV zQW06PL5&AD!l8zm_FY{UI<~Z=CuI!^LpeEEjaktgEFD#Z4kaa4F|QM_2VtS~x|X+( zmC^U!=;q?8?Q35%cTwQFk4Fd@^yyd&-it<+k6R(46mLwb>%vQt(Dj7&F_J1pMZ`2$ zf=r>zi)+6&hvfE-?Eg3FbJLcwZQ1qFD$FvQcW=a9-W!c?5Z&YIGcb#edzO<($33pDk0aK@ zaKwAqtp-)&bns(pLU>EiuvN1#yJzE6b-;Yiwm^iPP6OvG+CfRC$^!)ncVk+y9($yS zVhsp8iD~4}tsY3%$-9YPtnsCk0G~0!L%iZZv(cJ7v5>B@1CjwZQ;IvJ8d2UuG2wYu zWle}|3K2Q5R->D)>eI8s^Q~!JK?^xtEC-9DvvvJhG4ASTG!kt52!w zkHypBDOiF6>ca(F3QIffcB#F~lqN^kk0PYxGsFsEq9gK#fqibeh;e2#18MQTm5?iD zkJ~Sz!Zz&m7jg)I#wpCE6F(cjU|9F!siHMmf7;fn!SE9>&i5#ElT{HHCSZ2#Za%jn7wT?<-HNT zk~d_>cE8G704W}*CO}z`CAoReohcG24a@+HpBim?@6qNSUKNjKw%Bw{A%XlgS{iZogtl`*B)NS@U-WAQCG zx(ObkN(UpgnMMbeX(Bx2F*0}#A5$!s^rb=!(WwlO0>{=y*$zsIwYlI43pcs2Uy%mj zRLy3|nE^+Qp%E@sljq3cMo2T|5mK^nWAh(Zun$)YdniWeJ|?gR^Au~#;Pdf-2tR9B zAQ%Ezk#ZSY32aYwLq2?;X{9X7Bt-^$A+XcV#z)-%BxP?01$hDs8rcj!@D zQMH8hM%+^}X__?~Jm0Z*-VQ0(sACFq`O!CvER9s6u0zRb`GJ5xOQui&c81J~iz}+* zh5e3BnrKy-Aen|J=Wff#3nKqTszO^Ajet5P>d;gE@&F3xYTVN0cd8N#V)zb395$3) z=Os#MUj7}z4~D{}P?eVPkSoLT!MpeGg~JkxIzcBfRh*CrIR#G&@wV#ihHoLWXlS9a z$W857sulkh%QU$7CBjHc(M$a|Q)V+hM=7FX@Mt6|(hjG0V|Syof|YTPfym4@}9hntmkpM+;dUJ=cK z5i{xnzX%$ZoL-RRES&O1VX8_)t2hF=hM(}mRR(G`m;%B4qu0M8hDDh<=h$4lQ@>AS zl#BHa{;R7$eW1hyDd|8+{62(%CGBh9dyj70vA|!;&g4D7*m(wk2fDJok^31dx{=DDmWMk(v=hL^L7AuJ3dfgc( zJG_i$!)i-K*D0!699X9)U5fK6$xxika9DLktv)@6GXGgi#PKxP);MLAI+=S9@>-gt zA}K9HhaXySvw;$8L`NTjQldOzn*I~fvLP=DlwR2J9cF{ESZyx%m=yvhv7ec4d;@rA z4S9yOSjwcGg>2auk3+bm`?bgX+Iz$-TfZ48R2LK}NL=ZzCnYpLs<;)6r7Cj4xul(5 zAw@a`!Ixxds&Yw1FiubRilBF1B`mzy7Gmr(k&15ENMTL@Nk)9Dj484aQM&!$R8y*J zg)yGhmL0`qkRZq&W#^4WWA>e6ucE2m0N$Gj9G|OO*4Y%!sX;G~sTRU>FIJ-{=AT-O zWah5l|8g3P2G+Q7LIWuxt9JHjWvJLadC{@@tF=Do-+k^I6(?lzqmYW#@wzUQW2N7n zwb#ORi~0XAMTshEuZZ88ulTAWn&wwHP>p3O9xB5fDKs^sf~(=Ho0YKnM+Of25>+n$ zKp9IECOgfn3{D=#pY^%_$kO;1Dn&61>4vTq!?G@y$|i@yJ5ROscWu+OJpRS3VJj8& zyaq0y+mkm-^;3=?X8Z|?IhiJ&+nb`^XfuuZ{;l#nlJ!bOrlS+%q+N4lRsD5VJ(i6t zFL!f6?k1*~Rb7jHIG(eWCFQ;Q$hPE|up?1$9_^tt(Z^nYRpBSWq;mK{*fub`r7kmp zngIy}tuz691^WkQT?2~}Op@S+GZi%upI#PJ`D{cdUo5RI#f@T1;JVT8L1-ac96}L> z4ewYiXP~f#cXN@=u?CcnP8lOa1ZD?B-D8kDnw-jl-K$Kwg=S%ZCQ0RR;bEq+kDGd> z#rAUssICyS%^lhu!};Z(1|WLkhaP2P%RVeKQM~OW9{SRNO;Iodp&+{brJDu;r^#;> zil)PbS@&=Pnuc6?($;_C;6ub4b3C>t1nqe$^k}v-{<68C+Autn6?Dd0{>mtEdM2K2 z^J&4?G4%+r2W7Wm+AM-8s_d|<>5=w}-GFABtS)vd0e3ZB_n_vGhB9-hZRt{DgzQ&N z511ZJOn(uKf2>z0lq;-2PkSgye>mg=i=MUzZT?b*If|mv=2zDu+sFS2g=DuhDjDy} znh*r#zS3MB<^g8x>YWx%Q6JVHlsQ{0!rp|?O0vVxP>P-ZSKdD5mJgDKfDIdRf zK7H*lH$pl=$AQh+z3yr386JJ3^#mL~>-l~EKq|@@WD?+fUEa-rz5-}dQVPthbXlm- zW1-Xw@noJ9OtI@m$-F4bHa@}-raCwk`kVk~4Y{O}=_YWx%J}-G1ugsBimBMXmYF;; zmR4f?2@MUE4(vu5ehnWg>feNIM|bRhIA6k&**Bu?kL#)K-K)qYeab0(Br{30W76pN z>^P7ny&_;%TRrps;c>K^T5_(Ybe%2@lC#U@;)Qdi#IN~`(Df<%+9!W%wL+DZiRl;K zr#3>AB;OM8xR}S-`i`Ad+1visJ;@}3J(phD+zoCga7A-%4jULrZ5YHKgY)R(`@ABlMFPEiavyUb1^s_W?Mz2 z$tPytOAmSSMHQ$Q@rtb#Ex+)FIZsz>%(F&MUa-Q9bx3Q6B6uuxoT|LkHo;t_qEms9 z+>WzgIxN9*@{v)Z9G*)DQm&DHp?~fk)<2 z94n3!2`qSOAiD=;+?y^kpgM$dV-m8}={b9&`-dqEE2Z$knB)@-+<%Bp#i4`p#j*?* zO7U+4ifh2|kV3krEs-3Xc*(vI?Qa@HfiSlbzicvw znqtr=@sHeZL|6$wlOJl#zF>_*>5A=)AXK`E0`A9oe`dPQ6QyKnl?x|FdY2jZD%WbH z*ah2w9T?l0iWe;%niqnFHi2C)f8+y09?NaNSr19x!o29oAwE?eJG-gMjHZNVRp8I7 zH;FewC;vXazt2@n0V@XDP&t-=(s$gNBNrqnQ24yjwUGTpzC0n+#{!kgVDUu7++O#hX{T6LiET%Wz%0Ls((53Oe88;q=xyvHDI$gSH>3-XHaEy_-qE2 zpI0v;)A?`c5Q!l~O{A-L*e9v?a2;(%_KF>|$Gj|;0wBUDOXu_R`|9eiOrYI^a{7cA9CO9CIn)HHr`TWagl>QQIfN2U8vd5gb4-&f{at6EMuS)Kw}7 z+gDIcj0L+DlQCyR)+QriwJ$x}{*<6K8%tq1b8Y!9ZzqX`_Eal_;f0`G;T@`9j-9i+ zP65Z*ZEKjtS^3Y%<`w8mOCqCsf`E*pW>mG1vxrvMg7-VjZh9IM zjTD_}heN1NASWFhv$>3bk1jJI_MP!08g8{=b0&RTK01MkX#~K!AeUZgQ0-aV-FH0U zN2-+E0Te6}4O=#YNN!v^dx~SwQ8im{Nyo$dtoBLyz$ue`5f|QJx6=+t#S-pm9srow zfB~PQR;B;Z^IG7;Dey@t6?k^4|11Yu+tnDJ-5r0${+qpZB}U}_A-;0Fsd8OyT0a)} zvpbwXp+HU}GNf+jn@gK=bbn=4CVxKF^D^@n@_-%5FQp$4gMYEHJ@kw|4c+Qjy1(}@ zZ%&>4(W|P6iXv&!hPoIU{fkew1{|Kuz`H|aK==xnYyCPXS%mc?oveeW#I@UJ?T}2P z(#nX7R$;RK^Su2&GjkfPYUn#S(?!DK4Yful0;2KpcX@%u5m43EO@@$RhbuIX7MYN< zi2L4OTe)D=^t>aX{BmXBprfV)Y#CzpqhrVX;krodLPK`si&I*Y-4QFr*vCtdrSpl5V6@SQi5`Un+M+ebjF^N}09>+h zInB6!g%x=IT@=rCG$velK`bnUlK2)vaS~5XZ*Dfz1NvX-J;K28KpLE4MqU^>uIVwb zA-f&F_mb>pU*cZmk!M&Cjv|d@AyDNcW~M`%b`rl(i@a>fT0Jvil~eizhKJdFn|L<% z7#HYk)cQgKj9p}sttiE}KK$EI_<91{@T{oK!w4411}6^%#q5Rao9i>4z0u}ro)-sE zi^@#p1z6YjZpd_6a&JSMYr+73crqt=MAUeFADax5ooM~M@k~LZOO5dIXq|@kC9++$ z?RU#>ou1?*wY1x}Q-(w;5 zESz1q{URoK7_Q-{^7h?FI|uU^e4u}yC8p5098NT8q<-${Q<@FWD?k8EI0sPSU3!^m zYmTlDz@mIjd>7htkmhbLfal?VVCTG++)5l>6a~V}L}>*- z86>MXkl$JZq8-;zKF_f8jEf?&f$3)$Uo|R4-Zel-gad?csl3~z=z^1qFU3|0VO`{W z1%r2ilMNA13G!SaCNZ>0H=khCNe-?VI`VjV|rtwmVSNZ9V{={_ROLrCJF z>aW#e?SY$AT7XI2`aS!9) z>U;-#4F56%Mcau@%;^l*n=h~kmPcpa+AE5pOKm}nhtSaj4TFnzMb(OZLO?fDwT?Ib z3w8%Ack_Jmj<-0JlQk42s(k}?D*ilXLGAH+yRbiHXkv@^@Q?D{M7qrV$v}>*WSrX% zwzZ#rUUk=Sy;3MMEp@Zu%}v74R;wTPi|&@`3+-oKfS^0s0Y>;M)E;WmI(3yLI9XBe z>zV_(v41zd)G`$)(H~o;KH>5cNIuw*M+@eRg5aYo-l$!ehXqF5KP49ls2-?vt#to! zZfiX6as@A0%Xd*rcD4U(O7xbz(cw(d68|G4`C*!A@q|C{lT1NFU^Mr=AJVTu(!aNZ zeCM4nqn(YHG1Lk}Df`$jtDTnv6jbEmFUYz@&7mB$^e+6jM1GghXtnJxGB^L{aED;r?iE-Q9fcj{LR95>)3D_u>u-8#WtR+J3e?%TCm!!!US-A|e zy3SAE;(>gVp@%S^ydB42OlDMy=Xy!&hkTyVd+%uQM;=YRio3ksUK|nMU&j}lIa?He z9^^&Xg6A^nFJNZng2*%h64l%8xxa=z8ph8K`ze_(WhC2Scfrx-2gX}e=f2S@B_uoy zR<`&|taGGPg-TLaZwJk{XDw)2E@7>&i{U-T!D2AM7Vf&)#i$+SzlXv9ChqgbSs6IR zmSR;93$OgtYMYAk8+t_%SNxFX%Miw!tG;ks- zu%iEKHbYV4ZX>|z;A^Z{YsUHHRm=>OKH2f&BS~aPP!cuSh^8(RIn8lhl1|KUrV3wo z>-$5@s(}TF7ea<_#}LcRjj!6qdyEQ5m3UaQXDt`dfL2@7xyx@>l{Oa2A+<`YiQaaS z=Y!v0^H3Wz#>hC^1l;E@osf6o`5Npf&9c(mKsyIZv-M9ISl@YHZL^Z9HHJe0k-|5n z2IR!p`Plr2e~L~?1ui3f=Ias5J`SkFfsy}@1z^%IYQ!?F&t(!@$EfnN4mH)>HsZ%D zN2u_Ex7el`^kZo}lGfy;sQhRb%yj-Yo>Ebv(_R-Z!Z@sv3kXe%YBc39n~$dSq=d4BKo2|i|aJqLl6S!I?N zaNMeD2zT<`U;}XkQXE?Im@+c6f-Yc~fjln=58_-&Zw`kc40noNM2vnJO8I9vm-LG; zRs<)w?`P4TCNOW*YiXLw{;)A8bs?KNf;?T{)6K$PIkI6fk|0zkooxEWjeXA39ziI0 zj4?ZoDSqmg6U0wv-`%6S+D!?cuYLT*vucVlQNL8kLG0c@jx|LZK$L-%Wp*BY%>?vQ z$v^@j;X-aWieoW5bkU4r{dYtm@xe>sXxm}2lkM-7C?NWx3SCpXIa9kV^y(Eay+{gh ze31`frc`W!@2GedNc54Mhu5B@<8NE`Y7q+q^h6YsG{bx^;+ zB6t8Bn|{r^wf0Dt>7uP{@+(~W<=A4mmF<>8(`C)M2KJX<16+HY0q;i`RN9;0V=k2> ze44@~Bkw8#97|2Nmi6Sv*Lds`M>KlSRG=rPnn-!Ae%~6CF~+<=Mf?JC9V_=l%{pDrVHY{ZbeE^L1H|$uU59VOk0g^@VQgMmrk4J zBvWO`b?Nehs=8h!CHIHcNJocLm!>#S`}*$HR2tiJV*1`J_MGyBd+1C1C`~iS?!=2A z6!eG*xamjQsKPC0?pDJKmq+O!V_n0Yfzvr?d_a2ze&%O6f^m8gGlp8ZrU1MkNU z!^?Z7T6u8*;AmvZB*{nS;Fn)uF-Vd(UwXj?dYLh!FRxszntCT&lp&gi_f3B)?xX?@ zuYq#0L3_k2L(-E+6kQr!0Ad%eG-!8UCr}T{i!RQwAQUf)g~FD@QOkm8{fck7b@n<2 zg%GYmbK7Fx(Q@nc*-!vO4(jGqX*T>0?UEF`gtXKRnTa~A{m{&VH|3slQ&Cz^M$GP> zlBU0wBmec*>Z6o`ZJ8gKHp*JjhqsBhf`Pjg3Tl?yz#&V^-vLPUv=Xc*T)%JJ!xk^r z#(~_zdC=5E`L*(RSkmqUR8lgZ3mXs8HAoV+zPG2Zw&0oa5v|9ddK)#ijvuy5qn)*8 z>PaA<@uics&X6t&6P)qX!_76u*AOi~=?wOUT2WeUcBV6>RKucl-4Pd!{O&_%>cS9`gDntc+OAsg@R z0#PTxC09JO@roXc$m9Lo6*{pXtiHyqnz5m7Y3Bq2iM`(`e2B2r3`;pQRMIW`4+);C zja41l$s~26e6TWe)4VaU!f*_|2>?$jmoA;4);yE}bfeWIJsoF5;N*k08E;QU9rBLr zLD8jhr4bvwewEoLk$m8UV~R?V+^xaXWPAT0yh_8o5LTP%BO_1gU)%VA(QjRGQ)Uw* z2h!rYj3vz*U!JgL&;FFv5W6Y7tWU;27XE1d8PaH7zB>>9WiHyzzIc2kj&;_3#u8$u zYMQ^6#N?@kZ4APj>Z1;7vUYg8eX`Nrb;eEBcWJXx5?S8QZ7re85#sU;vKA6}>+Mmp zQ_U>4RL9_xRWe{jwnHpy_yamZoSQXt)0I`*;`p@VXcOqH%Q4OMFbpmD^>ifmFFp=v3}L9v zR(BQUcEb6n@N_u##otu2LAi5>@$sp`G;IfM``(!V@IGrb=(LbT6bKWf{+`DYFq>{< z@AtVo)FKsm4enP4o0oY9X)Iqr$%ggm5Y8(V)|j-Ke2bYZEu}@S{6E#>1(sQGUVT zAt!GAosEHqOJDpI)s%-&-kiw*r7x0mW;7Ss?!SrKY5Pb>=o2IYe0T!b(aIL?I3G*Q zijA8rjhm=_65F%aTS!#ODYS9rU9%sB2qt(=1E!rN?Wz9^}XX@ zMG7e>$UWuJjgUMnwFivyEr+!2GJW3{|3n7f(9}srLtCr4 z=hc0Qh%)iVZ0kRYbDu6X7l+k-0u74J$6?$O8WkIb6)fB2Z@@lZ_+ppsdhM8I<&8wt z<%yjYf))=La!Dq}cR#@9>5iqtwjc1@$L}MmSk2O*K4puJuq=Eu z+9)0FVj^_r)3&nKmm|`w_Vvybf&Y`Br;xpVZ1++@{o68pqvIJbcY>jOKM z9>#=BT&?9*;>RR&)uF2dwAuyOoe0TOL3y_JR1i@9B)vvN@DMgEcByG_7&vIi`Np&O z2ZJdrUjbOdMWXILfVws`tW@ID`jxL>E&7^Ljt^SnSVF6`0Wtev>iU%L7j0~Bal)6a zd?vRnVqNv*Vrb5gx?MJ zp<=M^o#z!BOzPqB$ATo3rXA7qr091D4gtKMst-jtM<3n{-{?ZeU6VJeiJ=WiYF(oe ziqEfYs#niASo1~La2=M`U)X)4Q!r;=#Q>xi%|3Oc%M@N^R6I~0@=5OoJiO|}5gt-h zd1d_lGQvOpUIGT{zLg2PD#CmhtHAo%WVU!l4cUoeU5>(_R}89S-^FO!dAo!4SF&yQp>taU2e z7)7~>Fkp1(fZU`lLEs*7GkrP6Uu2Kbc0p7ZTl^d*#GYSXq9jOd)rsRQC>0;ZdLs!V+S z);hvWZ3|*AJ+2Pf9L||HSUb|eW|Uu=KKPubk3xu`^P`RTdZwKc@UYWcYh3Y2xr0b^ zg6b)iUi3D{ApCxBL9)OH<{18XQVuHFbbV9^zEOCoVO-+P6lUpq0tb#UA^DO$jd+7btY+Yp1M} z2J`)as_FarL3>-eMT)KuW1Gsx6Fgc(W-kSvM_=cF(!>VBg9%V3_)G}!DA()9)D>+~ zIr?`sX4+vLcQ+dGrJRk7q?PFq&q@qaa0D7{Pi1UDV6mz<6PzHtxx3F}>RN+I$gn7> zt$KCKFqNXKtUUMVP@qEZ7*(2Wn&AN5#?aaJ!Uf6K@s0x)rc-_Z-hf)nKnl+wdVU6l zk{e$~tD{bUXH5w_pRbB9uO&_U->2hF7)$0UlM83!gLYU}*A%?)fBY2Y4&w^wpOqGj z%2ohAna&8;YAJZg{uDOjS{}a%1z4t~8#JAsfUFt1hNvFMQec>Yt2xwWSfG|zv>X9A z!6OH#r1<=z7EwwU0m^8MYu7ZE1?rs&p5;;HB%M<@#%AV>33T8Rk5!6+^fQoTEfwR! zX?1&?o$V&$(HydV4HfO8kk!JCtVC75r=ku5W+_jB<&3L}6J5Ra%qCnPy5c74hH=1< zw9563jVPuhcHTg;WG_y|WK4ltu>4LWS!AIPh3ACozTVq!sh?nx%}LS?0GL_q*-W5_ zRG&M$9UIR;SpJbEf0(u&nxV;&>)EMHt&l3qEvEf`W0KqkGUYkQoXpC{1gDOq?ao7n zz&~mQvyl~$N?U0M1k1BaF%>qDv}y%S4{6e+O8IeedU0=j za3cuDBOsqsz;HN5EE|KDi@DJJ_oXGF8xrMMGQ-_>#a5;upGI^=Jkl#STMADr1-axtF#nG4AspSXlS8_UOe0mJUptj*-9wlJoyYCWH{^mO+IM~Agh4C zO(xF*wFDa%k@#u*GgK2xh+l-#VV`lW&GxT|+QmU_#8XvNW@scK}9yU)15!WUMW=TKA8zJQypAg&b^bcH_&Y6`@H zMuZU7%eXq4-#4gyV}|l@GW%3#t|%@hp2{+d6vWC>Zr20scV?ZR=j|6KjJ` z9f(tPrM__m*9c!w3YC!qW1*9q;A@L0^;c;R!_PCR$jyOuu&K>J$wdLL71pwu6XzXH zpO*M+4Z9gRRY^3D4OTqK9<>P6WkqrUbEGuQU9^rYRp#{{<16> zwyJv1Qv95_+IS0&C^*XnJV`qLJlqV3kZgLv!|W#hD~EV}8;J|g=fz3lh_os*O1`dh zV_x#UND(D2hs$b+WZlmnMxojp+_FNCRVl)?;%vgiuYlXKH6l}a85x-$SD_NZu*IV2 z5i`j1Us+k#Ir>c!E1V2adLE27c`+}H$IB`;xk}3xj=xU{8KtKcsRI7(;d<#&hAE$* z3boXmz)M*3qAa_&PgboWt4?~6ZjAbRK&WHNLm~}@rMFv3aUQ*bm|lf;qRyOxl)r~y z5Oy2pByD$Zdr@~g-aoYzKDWGC*;KcvHs;GgjHiA7VDQYj=>8sEapi}7XQ%Rh7eJ%X= zvOgnF=l7(%yp`PW3wgWNv4=7e>|qc2gv|)7k+Ql^hxH9$zCuyKHuj*DSM%MFq%P%F zEGvj$W-KdnN|b=a6zTJg_r|+}m&lVVMJ)Vzf`SVqGTAWDk0n}wNi96>%fIoj#t|FNRusc9%qSn7N0<$BcyVNE8@0Tz=}UtdLJZwcfEA4g)1mczUlpj-94}IQ+%vbD z_I}b1-Ew~YfO|DYH1TE!)pJN_I}O-IlIE+mzV~-`g-aH$pU&pf($3nSf&l~Rq7jWT zQ=E*7iQw-6f33`_#E)kZi*=UmuS`7EPVHR7NZ_C5PCt15eJuRfqA)?7^Xu5?{K!pU zle%#BYo*-P@4qL%6{idLHhr571v%ypzy%Z{6@o;kBdj}wD5WI!&1{w#k@FaL^n^Uq>tm#p}-85BDDNGLrvu8k?yD{jW~XO@9}=@op9{m(~QSc~_ZpvOVnj(9DAtg|WvW zlO>yoo~nT~QE6migBuI|WyS?)M3kOC*pGy_EaDlNqQY3o_t5f@is(y$ecZPKsjWPd zY@QewhS*8Jfw#B(6Qh;X!k5YlIA0Dv9?TlG8i&wxZ$Gk)_dPdo{ z?E@;{k)qg|w`&=vyg_sww~!)i`gl`F=P@k}r{Yl2o|b$cX^38q=Hg{qqAcrQ+%&y? zV`rw7hAitm&|PhMRHj3EH4quhhs(|nKT=$;Wh)cY5{bsf?r+CfUi2x;ZBW9g%*GHK zatjtdIqQA=Pl&k`<9Neu97>PL5$v%PL5DmCYeIQ7#8}#+Ot{sGjX81izn|!PBoCzt z!guTN7k+NyM9_*7-!cn1p>j2;n5L=bEf?u;f+sftdJ>hrqzw$1N$Wc3*1jvLZtb)W8!cEg5 z_$$p^lqWy!W@O=J&gj7inSt=bw(026_~mE{)!~~wRrwDv>|N1*ANJ2a z-gdRmdo=G62ILfA{i_fX4srNXwO-Wn$qQ8hAG=Wguo?_LGbu+;x-3h|D}ER1r>T2G zrm=s#z$BqLzqnxqtB?gK?o6Ls1b90E)gsLY$ZT!|i0+92C;(U~D`UGd*0nan{`Q(g z!K+0e47ldFf7crPRfbEwKB(8L7vE(@v!5qW)KHwSP}HZHl&*w}U#Pz&Dcr!8Fj5y| zCrAfc5`p%zQzm6RZDNX;J0gn|G}vcTHp-;0j#fTLYmyOzuc|xlte?M^7i+MKcA=(? zY*4PJ^3A2#anib*>4obU@BDQ?7RBydHjLMeqV&F>pnW#^`Gp}rgI%S923EmO%J^9= z5B}Kn?d##a$^q=<+<3n@@*Eg7{`uS#OI9>X~fO8r3 zw!;HqZ)-NgU1zFA8K67|Bz2y=;>YVfZi%N6b-o+TGkn>PPM{DGFT*aEp42abPy_VD zJu3Fd;Wp;E&-ycN(vYGVRFgW-)KmkhjC!voqM*>A?Mm(wHAW`D)ab{?G~-G|1=hQE zOYTa}T5`L$90)GQOWE^GeSfqlBb%)S6e(k>oR?Bv*Hp~%5oDg>ldG5UqlMSG{2_6*8QFD5Q+S9YoT2OkT0II{h-|LXQ9Y#9SnB{=nv+uKnN$> zY!cl6Xp%f<#SFJ*R30exxkKC)X)Lb14_4C@?>*Z+8DI9aldVpQ@(K?e87G*r7)!yr zQds7<-a~LJmlvT&J==UNtIe^Cs*s)0#jv!W7R9z#wV)#Ev8NhUwp*;@9I|1Vkq?bE zTV`~E!PG1j9jqR5V;ewxRMdO8Qz0$-+3PUbAFGrv>J1#deQXOCMfIZhtfP`8K~7yfVW z5)NqjrL1O_h8qD7mXos|H-CZsHFS?QlDuwXyX8*9o7xU`gHODw;ady^n3~2#%gJ&H zaDOWMYcs*RM3e+TIt_M&i5Yn`wSP2wCNejXY>)g(c7_ z@ze_3ZnlE+H;nC)dDW?a=_+v|OgCF#%0fby3Ow5TqkdatVn?pT?!gSAZxB|}G zZka(}44^EqYmklFqpvVCA~~m=-lZR6RONQ09Q%Bl28a28o{u-j`CHm-G-jXcBj-4O zM2~31I7(8?j$RjEuJAk_IJs)j{{b7r`0mCQ>NDAUUn+zr=Z1q7b5zUL}XGY-SzM9 zvsz(mn=I<=B3s^0pg@A+bR~m~9fSAmJMabfh^SAX9(*ZSSP5=J6ZOH%OH41fFKhAO z%6UYI3F*e)*>X(G6Zf0eUzATSUWl(-CW&`GF!u*bGY$N$J69dW>KQB>jt~kM zx520)b9O(g`TojBMnm*HQ&J^hRFz!sAr==6VAcc^6IrKNm7bhq!gY*L4Gx3!h-U11 z6@H%Fm0IPpsb*q9d{+7>eOB)tNQMndX&Rb-krV|9MSeMdT&}s*Tk#_fZ8GTh+uJ{x za7Th-4$u0H)?yj?AC@8Q{A@RJ_-DbYT3`iG&Gi$K)(A$&==v zXD1>b$CeowI(V?&V*YRlWM||Fei;m2&9BRqVOYtgYq;vE2=n=OmT`MR_MoV;{`WjrzLaF2y-M=E(HBU&rVgpDkxP7xj>J8 zP-p$G8iBnic%!a@L~>|v+pX8 z@7_;8DSc;6UxdlU8_Iu0cKK8Tkg+R%vRc4Sx%YuELH)!B>uBqr;tLb>56F$1epo{+ zbP!+7>uvBje_CAXJ0nI?q4Y&!jg6EfaqobP z4;T8K-oD-vH6;TQ@&mHdHJ#BUKTtotCd3Sb0@1YGEj!o^y`v(6m4)B3P-jfzJ+o^I zp^ty{F+jTVT5KUWfg6Z#P5_#$Ld_hz5ksvu0bt{?Y5Hw8u;YsCL9~a~@NJaAE9|;t7!7xCk{GP^kf&{J;-9&ZD49YM>|Q?y@U)Tm8)Yjrv$Cnsf6!Cpfl%1`ZNl^AA0Mmd*yNZ-T?|}= z$b@N1M$MJCUKtgGEqM-JW>ke}nkB^JZW`^&$GT(R9vrsB{MPb6-Sp2g`i_?0#);5q zXNP+bQf|-5YUdIme=W5yjcRb5l{}v7bCx0tLOivCi%1nvKT@mskw~@70yH-9oWYm+ zJ^5!6XZ$jErE!y8MwosFV{AMdZc+zmV^0<)o+5+zx-%FtIQTsyMx>mQ|x$4ReG|* z?NXqu#r);gVOt<_Ri=XP^AYo9tnFGNdySc{?Tb}hGj4|8WPYl7j8r^DTRuhaJ=BmG zb3VgkEf`cC<$$Ff#aB>n;SQhEovp^i4+W2B6K6d>dF{;H1XL z2y3HNNn-76mE&BvuB19nuVN|o-IiMK*vjp&n!c!hM1q?k%&jgrxRC)l8G^ibvRBa_ zn_c>r*pB{ZzJKLlC!>O3i`Gm929hDG(q3WSk@qtZu!~05LO_rC*=MTas9+Z}|A8p4 zZFQH^_}X1WAD-eysl>2477DH9df{z@irfsPO|4Tq1k)R~E*O!^VMw>3YJ;y1eYsQg z&6RvbN6U}iRL4&pS41>XN4#ArvqxR~6e-n2#4$kWdDKN64E<1|QymeQB?r7I6S0jbsGJ zA%u{||Dr8DhpkZt!qDC=4HzFxBb>qyTMn}lC3_n~y1U3!ReC?&af`f)m!s@s+c%MW zBG}GcVf*|HFZKZ%sN7~qE$Dv_R}NI&rwrFjCO8{KB<(-( z$^c-!Oic8Wwvo@?@F|5p;HIu>5sdff|D#xD^<RVY(bn}PX9GD{#=X34j*YEk6!Q+6HqS5r z`P1_iJ}#a>_9^VwqmOKR*D09P?Ng5ELsF^e-*Q8%J8Zc;#$%fZNZ{SZ>#oCVA5*^J zR~KVocyoQd4f%I(&$E+v#lhi&Ev=5KtcZ^2IxN;XoRjvP3dGmNd-lEat$??(%w2j@ zHv-vX-nTJ9`<*Fo&WmKWQ^h&mcX%$ja{ZmSQI9-Lz1y(i`}oi2p`UHn#T+*YG-4}P zQMzKYSwbqRhP?Vz|6LIMw?P@iO2cEowLD7m_qZP0==Cxcga&Y3gqcm?oen%)KVtjp zt~BO(tt0Egd~o-nb$(R8+nz7?wxRR|YE`Y5Mexr^V+X$ldP0R%Ya&M}AD^MU*E{bH zffu;o%|Ty7_SWNi0jNj-;O!`QsW-CZk3uBUWhxo7MaD%r(^-y$mZGWcM?nQ54?J84wJ$(g|X>Zfk@Q^Dv~)Il zF0g7k#d}4ztq8NUnOgiSR~QNL+`IANJ`6VIQy4cfGLP_`Fb8d|yNF1t5S+CH93A-A z(kH*mL{KA(?cKlA0n0jU%uP=JPnjX(GeerM?|P~K=yVT2${%G)1K12}=N~&Ttc{y3VW_u3y%|np%*3nEcn3oD_qmzN z4nYdM7$f0=F{gZBU)jEL``toXy~*McpQoLZbol+)Nhmfasqbc^7CtgqF=Vma(_Pnu{US%6S;?zod>T2{b-I4P%pf zmHvVm8<#VxRFc0y&pr5SOpM`HIovN(K>Ylx3O}yV0+xN-h5U^b%(OO4uws5N^Hc7G zB`C4T;lG<6Rns&#QDHAbnC4xHmImp+x^bc%P6yR6dtdU;QB4GwwSWCMne^ncUB!ki zw2Gng*CBS|!R`-0HPw0f^7MIjo3~z2xWxr;XEFoPUdg0_E9^OGfCl!eR|Jqjwq%f@ z%H)!9plmL5O(B$yXr~cEpD8VQ(zcI>g_j_`g#R4D-ga*H6EyBGR*yKPM{8A6Ve|Pe zd`5Kst5OfP>L*4O=aptji9pqh{4gsom;QMW35tS=5FG;w4rX@MK6mfb932V08(u8u$m6)7S08v)VV3`LJoa@gl44nCelgFaW zr0nFa)RTJqC@eB>NfaaLzfIoB@f-{JZxS)7BCl9SRR#+^+uT2l0#gW6zbW-vI{s+C z8m%7*5IT{}Y;~Yae^G9|Bc+VpPf9vLaKk@XDAv|T>7JY2GtNBu`YjinTT-nu*2jZ^ zj|bpN{KC^+ce+4a{;J$y@`0yipN?Nl%Nf-Mm!B1M~?pC*;Fg zNuaJ$2||mKid~cZXjaOotb%}jKf3KYP)?&k)Wn*rjqR!OI2B}G&o^Fr6R4_^-|bMZ z66>O2Iz5Y;j4u5x9i_`w)~vfnW-gagz3|WZG5US4vX- zQzp}B^~%YAcwhS4>_mwo{kFbkwIC?gx%Rt|@qHw!{2aByei|;XSSL&G3Sprv>f=8Q2 zM+rzOlJeML`bw({nbEa*A0{rzO}uWs&s1Ri0~q9g;2Kxk=rPVjOsCKGb88Gr(Fzua zGw743=!2B;#EtjkLr~5Kx&#^=xdWy*=?cHBK-W%sA_{*>+kJKU;OgDNs~EeOz$ODj zjUf~%UnXa_FxuiTYv*8}BHHo(8y!Ep5Zh~GF$@feD;=7|UF7AFx0OqRV0&&}W_>?+ zgG+cJXlp`tIUrWJOs*Q|MI;J#vsJR=5$p-}U%wuwgcTB@Cf!OiPVc+M58L8oWZ!7O zYLwWJv@Zp)V!8?u9dfn$+suUwDN13wDVu2wTJYk~ZmEA`^~jDL?sgTLtn$% z^$&l}(LPKhn7+2;?E8-%2`DmE@{#^A`*XC4;2XzaK!9tkGcwGd@DL@U0Vn3a8@rX6 zr)!)9pJ7>0;^Mjxa+pJ$%d(_U&x>hUOXyQS_}$+)-|n;zQ%T{b1)RgkUL^fqP!h^k zJ&8lWTDM3^w$-y5%R&=^yHdN6rg&MoZ_k~xuNc!T>}CEwIOa^~mBc=KjT?71#afwD z{^Q#=)>e0*ACS;w#0~R_kYh=;$j(P(E!|5^M_n-pU15C&>q3Q-vbn zCaxy^YW?f!uk#~^0J5CQB+q1@b)!P8P+YF-bvDPD#&wXiEB;RYS`Ih5yEOeEK zHT0o9X#^%suOk(lfs9EMdEV!-yfk=pljxsrM=E;K+Q? zpJ9{Kakg)#y{g}kFl#tU`N>;5V@EmzELp5}93oZ%N)%)KH_LFYwAEaz^Xqo&^+Zc5 z>_N0VE)LovMDl%9=08E!IwU{~Gn}fJ8%`#lFGiL- zDX-7Z=Q9Snk!^>k6;UIpn_xmH|J&3<&Ek_uqm2`dVf1iHN7oeGRm0MHuA&QtPwN-; zV^hSfzxsBT>Xg3`rp-zn2HDeMF@yIW6!;5?+JhwsP>vq*&8{Vt6IR1#QY{D96tbcJ z;`bu-F@uzGb3c%n8Bh_=Bo;-MMDlY4EBJL*;lUGx9-^a>P?M>;{dRo3)^5yXB)Ig& z2(NV=E^HlFNIq}vC`;tsIu!?|72}RckJT@CS%Pm6E{EYdAXeN1g0W*&fKm)i8B8Cq zy5Q-!Sha`MgzbsHMQFIg-Ce=a?#zNN%_SgzW1M`9cKfjz(DH5TQWp zzzCJnTIIJfMkQzHftJ)!&qi$s!OVPP`Wm}I>BZLou5iW`Ei zFaVwJB8zsWjz*GO)3GBn353v@D%L2A0lzt`ieq-O$@JBYJFq>t`lgy!FPDPkf`o(4 zqdJ8ri`K7HSAA!M4N`kAKIVEctCsnt&V1PwBhM`-vbrNB87AgTJZ1Ah9J)JN6v*Ig z(UPsFJQM(wZO+a|MUZwZa5?Qa9R~9Yb>+${bGIVE!}Mjpp(z;PMut5RvHVG=&#JeEf{Z_N%^{bDng|(K{M9m@-yD^?$ zd1?>DB^rT?h<-Xqnv~U(`IQ`DUx86?zltn4G9z@K4su@)ny@bmUGql0 z2eTOIYs^WGE$9&>@EB>V6+}Li(C(5AlWmRVh&|CtT+)8@+j3kf7rjRo@{@TQN#}{? z9u|b4{F#Kl?$`NE%#=Y`pUJA17e|=BzNp*nIQxc6E`KCe1-!n=6uBi`if2}Z`uV4dEXXVE z&QN+_cOF%y?VVfrvw4?vc-*Oo6;<2MqHoHTRupPYz2Pag?E88k>#8GN_SpqbSCLTE zOIeNU&~aCS|6xyElyoJlNAo)G(Q>n2beC&p@)&_YEoh>n?3^FP{q@HGzsmgMGzDln z4!=-O$Y5_L0z`srO{u*`u+)4e_+s$WfMVaQUsQ`^K}<_bYudLiu=>%? z*chL?QRi&&$J%t0%)Np_KxG7%oMb>dbRKyUg0Ye10kdU)K%RI6@2e7TNWw-|d-7A_ zAyMLh^N;~ctjsYmzrbA^!m=>?Y|Fl^{P8v-zK8vt3Ho>^H1v|~zIw2M0J#Ma9`maD zHPt}NsugSzhy$rqzjBk>rVT65$<>Tyw+*{ZWR&LFk0^!jKgIefO;gyQsDiVx+UOsk zHG97&I^e*?7c$EY_5G(JrjY_jYbJMTfu}318-`}@iu>9N6oEN=MkZ7(9AE=Xo#QvZ%LiJpN zorpFwCWX!rz*EJZZqC<2_`S7u25CUaIU_VCLQQ zMtJpbwKwQ58xrN=$#4rT6#u*A+`fBz(O|r^S5BRSF-<|Ow6WJImHdR!6)r?Udl=v( z;y8*%WVHW?r87eUjBHWE*uZqYKFb>v#N?P-#Z$UeM+ilz-|AF>0Whaw9vOK#bWY!>`^_fxvx3?2L9E=51XSzP z(1g4i3#HnIDSng;t6fbv%Ik|!QM4gMgry9HJk{q;kCMQL?s&c3g-AsV`64uoeTdP> zsdwzcF+~!pmtbSVQrYSJ{hK(QS~0=BdAn$goCsV8V}6E{!8XDB0+mw6QmFECEoZH} zKsSKy=&Jx#JvwGrpE^VX+1yHg2bnU}*7&iG$@0n`iqeR}_+1xLp8UwWv6;W~$_x3> zSs(AhINt_2NJbs`_0Ku-9F{(%iyE^n>fzh*@K@i(_M@8CwtsNtia7F(bc%Q@#qNV= zQ0ja#uX~+t6EVtkw9Tg1$E6SPglxk&<~+tX+COjX1~B9z$*cLS23^mt`&vR~+RhcN zs^mrt*S8W*#X&ftwzz=v$%T0ZK*=TKXetZ9%4tn9|4gGQnzW zM90|cGnN9NQ%SlYcB2vxg~~8ad?tnHLsSh|DmH472d-t6?PS~zDyf*bmP2^CgsADw z?6!~(fDGDBI9j2xNQ;3)t_TzByp)BFUMy5E8S^k&Ak`M$AtzcFD>{r|C2E>_@9rbO zzP96|@c(~&$Ah#c@!Oe`Xll00Wl19sBS}kB8o#aQ{bCYks?g9Yxm7W$Ew8b;Wo~b( zbNjbYG3K?0?w71-X-Ktk!A6JWdXBo#=FM8P9vIBj84A-g$?}4adab6JdLsE5r>tMC zWHRs&#m~Y3b!Iq-4Wi=CFQGb&+dan~;qNqQ5yCI0%7vkJ#%mJ!w_y-*s_dnw%n-Z3 zsP&qVVw+U_>>O>4(LMcd7f~y+opLg4n(h`k=OwwiZYNnBK8ITnWN;IO++V$@KR^M0 zLO5Xw@;*!Q%(?rs_Vfo%z=EQjXdvJ--4Kt%w9@gO-|619z?u)_jsCyaXHRPsrUE+n zAqT(He2`^r@FuCOX5Tt5qm&+SAb7dLj zLHUahlnm+Al3#6LVLEbXMC~oC1(|0^y1LxKiORYO7{u3ATzqo|NTIqdq;TKGDG~KM zKLj{ksY@ja2v%$9SwNQ<(VpSPe}jA;_L5p~)kwN5kRb(99`(^E8@SeRUY7x~V8I{B z@~M1rzwaMsPtVxlku6Mav_&N?`j;%%j~WN@3denRd0wBI;7XCS4m3$dA$Sfu_rWBO z1HoGAKd41x9-&3Yoet8Hkf6_Vi<3{-1P}$%He@(5rvBR~k<;HjZ)Cqr!JF#Sd^Ns+ zG1S>7FiF@sCA6yB0kwjn81w{lntD36U+g3R-roPYp*V;t100Qv<$?j?8|pUbksSe0 zxYuJ&jAQ@eg#{38-+Xz`r<}8Qr0?@7AE_N`gg(~~4!@f=VW2x5Kb;J@b!8SPj@$p| zy4YOse(&m$s6M4@?8*k$&U*fw&>Um;II8~TcK|ZJ)a)xGT(a|m+k^K6T!a*2JqI_H zo{v6}m@Fwp1(5Bcifbj~!E}c@GO69#kgShgEWuq-6f=~sj=So)CUpJ+4#RgdMc6BZ z1qcL7M#S)q`bBNIj&-~&cMP7K{93EIV|Tke#W{*@>npi2A0#Q@=HW}};FGO6f|fU} zc9Y!Wq%Ae|H@i{^BaNxNBCp>02Ikt$+!47E4AX?A;;sVmTBSrH0iuT_PPQH~_SD6U z0V#FkUux+=yWJ~a!vP+ELCBBvohmk|f&;fgC+lpqlXv=oX%8=N1PU6(n7t_+DSfrY z+!MmNOzW{i8ajti{b3b?6cZW(+1yHOXQGp$mi4;~#6w)H1u=8cl%~FETXuNE8D+G- z?l6Pz@- z$%J2G_x{;;7rwY-ThXuv1K*ofId3Yy{5fn|w*QXKH&jlc7}2&Y(Wd|MP95_X8ivN3 z4n9yUwY9=FQ5Znl!S+~}$#gkEa`n1IKq$zowj$nCMb_)qcXHI-k^;J3znp7V_tSIK zwoUdTb{-K|FF|wRnjAmOKliabS9;iJ;ddsIb)S>8x&$0i@;WFH8N>7guUZ-@visVY zlj5x1thkDZB8s4-i%kh5;SCBastg)0IDzBxOn|BGW$B<9$I3Ygyp zZ=e8dXR=XjTh7l4f=rJS&+oqETA|I55u{-z-0-yF;t%x0PHk=f?XVahTv5mP-xr*g zeZ}ASo8Vn~=6Vr{WU_JzW8_8R^}`fgr_*V~-5ipwT`eiI(ngQ=E!+FTXT^2i6X!^s z3s6oPmZ+e3oe|bRD!QUL@Ogs;Y?%%2LZOb*?cJp>yqMQh=frWcJsm6N03zq*M3!t61URs3X zmMirA3|c*R#mh{=Sfx&;{V7aFt9?9D45{L9b}e$m*0r*+pb-u7=|VGF-|yTFE$8UN zFjc1{2_8-M_0DhiY_`r^vwIj5HuBroo%W8{MGOL5mz%AsgwY0K^9KPuO)?ioQ(gaR zUL74&l?Dl{xFlMShfpz=CQ>X)*ZWM?CoDU3S;ip|$5Mz9=82*x>C^WX|4zyJ?;-U+ zry=|SQ}CapdVeP2na7k_Q?p&Uh=1bt0+t)lcQ{dH+%@;*2SoTZ(x;=VK&H2Qdx4*I z)Qcw5LL{4bxo>9fz}p zK{@>O-_x%@y9Qpyt16*T@AV!~#1m~6t-5$S;r8$ps=xg)e=_pbWIq;>Z{x-~%zEEY^b$rD4e7Oq;cf4fu~SBCBhFgE+OBo2_{s2-G-t@ygL| zEd;j>7hQ`HKG1jIgy@AI3(#S#%Wk+P>*^y#Z(A_;z>1yr*Dx=ogmc-#LO=VX?ruXN zwziX<27_m>9t=~uw|EO6Ye2RFd@HN6IX~KoU{bNt8J;oSP}au6`>puwpUwyVOXv7$ zKYQ}O4I;m;ht)ygaRSqabOZKoItrG!#{`I~04;rnR5S;3{a1ETqnqb({pEJe(=H>4 z1*Y_=viQl2JXc66DYB*p2Q@uDwGkPIU+^)mo*FGDDt02Fd)$7+2x)H=fAi4IxA3r6Xjt9)$lEIOBj>UOuuT|Ri&|1O}Keec_&aFQ33xx;PYQ~>M{DI z&|bI=w-Qz9?*N;jKQ^&p-n(>Q_54@;`Yu-3WBy`qk^rcz5giMHTxYWTX-^2H=w zgE%6ccYW-7_o2>gAL&*7N6ZMBZsa+#+rP~QpaMF+Z@+-Cn#80Nb--x^l8*m^3i3F< zo0f46+~2>+>n$Ywa7<_KoV>%`Q1wj>pyjC*sh~(N$nG>kN&+-0*U2;pm{%BRi3L}; zOtM`S^HwG>mt>SV44X!KS>jhST|gG?Y&=1A$IA~N!lnfy8s{cW`PpRn%@aU&Acb=V zR>o>-x3YbaNX|`l+9(QF7ppJ`K}Ce^TH+Oszz@!AY2rneNO|?tZXR$RbR2x@MlWT+43S? ziIKW}o5{j3QC13V&n>(PpG}n-DInC{GfdL#*fLQNA;Nmdkvqw6MUn+_Ee>_Fj_DER z@~sx5S+5qCL?)AxsRhXco8p8(GJleT~nXOH;I-s7|;v9OhA514#1*CcN(d({G1smvKl}?JYdh>^(tnV?(Q4s_`4JV;7Y^T&>y5nRI!vh z)=Aw$QRT0WgOS;(*L0LZ|As+@a{YnfRSZc|ZMYn_s}aPNfg_Z(z->-}ff{l2aty^m zby5B6v67#_?Zy-bUa~eU#U{sPpR>c?vBEDCZhBk!mbx-o=aIun&nlpO{o7DY6VuI` zkaJ?n?DjRiJ_O9+1XN?wXiKB{sa9pF5L?brt|rA(fT>;wWXwkY3Qn%;qc>wE1J-6K z*O1IRwrqo$V6couE9To0sdW*NIT|)x5D;W=82nMFm%xXRBdT*gx9eck1zq4RZ}%@k zbd?m3$-uCMFMk|o(6Edx8>6MV`S?$00(z}==@WY`vg~#FhO(*CT{PjwNf0n&y^x9B~530M%nObdQFm>+bz^6&9_36 z?^~g<0DS3MIVp8PZd&S2WNx{+B02pQ;uh@d9lTu8n{5y&B%voHhltxMn25O@=WS`e zeQqARnk5TR0;TS|1lXm(3o(O$D84zw{bhgA(b)o6E!7QfY0SP0qPC92P+Nug zW2+4uwLWp8S|b>{5+H8i^3C;$i)(@uSzKyTBfxcN3LIpFfMAa6)y>!c-hMVBGZc7C z-fN6;Bh0whkL2sWQW_xv=CUO=f35$s#2Y|1Fc&h*!_oq(N*L zR!Z0`tF16#udF>xHB*?vE};?Zr~iu<_Ne1H2$I9V>k?mSB6Q2bEwVK>KdU4zj?s?r zv02{Z=@5+w;fvW1B=5+C`rV45@~gzkPD86WKoGUv7j~?ZQO&3n3^#7octB}Ag9Mluyg?M6Lz5}!rGm>F zu&)ablPx0OiO0QVKx`R-SZDy!Q=Lp}xK{n+g`$fj(^EPu$fde5*@_UvmzwShj92L$ zM;!jXvYjq!5FdnSQK*;4Fi&(zT&=cB%M*ljbmkpvQ|4mkaWf3Mm9R|if)-c z1WkbN%wP*`5qo|o05LW6Qgz{1*TlV-X&~2Cz00q{|9gra+IJ|nyIXbqAt?hhizOSH zI3_U@Xt?SVDrhlTVNqy`>1p`{gN!-o)_#N)_32qH&fscnH7Ic^kPbHt!J{Q&w=i8U zxCzQ+{)jr_Lt4xi*CIg1#X!H&6ZyWYd@BdrL@`|!F6iv_onB^vyTkg8p&ywT&UpN{ z8?*!@A+nwQ8AAx*nfq(I){bcATuh6O$&ItjHZ9qYdYR2&&VUA?JMZpp@XYe|NP))3 z#W)%_1VnKn6C5HLuQGS6wcfmqvS9~6{Y+wphaM5txqI@3aLN)&f(-$%Z9u5Vh!qcq zap|A_g4FT!)Fz~_q|?&+Nas004q1_t->GR-Z^(dwZwsfCjZe2??wfQIQ*g054`Kfp zRZ}f$DZ*3yi)`>isxB7Pq6&Lx_^vyV#V24N4=aDB6l9q>2h4fQQ0`x-o4Eb9 zvnn2Yz+Gp**}=$19V%2bg&Ma^q{JPoopn*5y_|BW@&a??O;kW=laC{`A_`W8 zyz0DsMwQ2lkGqu1fkkc|Pb*jymnpC$#Qel-0^c_jS|gG~iOL}+Bszy?rqjjWsn5_` zW@4RwQDDjy(_5uT(e#n-@}@3*U?u~BLxfUm1G*Yp5R~JhE@`~mXiYSdE?MgAec*!c z{unxzQqbElLs0qCof@Fmv)^ST_chRS?4m$;fuw_%Cl6oy$BY!pWHLo&98DyNf|m4p znMOpmv1a+=rIr{SE)Q%+p8eVlpLIXIp5_uvRQ;K{49gHnY2@6~1wCcJjV)8JI_f9H z$AeG*wXBt#at8lrF^s0LG({>0`!&siSi$6V{`Kv@!{O$Gr7vWB*X@lbU%FmeS!dIq zp~HXFqH`XjPa#E;H65>BZ%=vf#gqY;M`}JK2?9*X*o1cQetFl>J5k$VMJ0OjS2*r; zJ~OJpYC{AhX8D^myQMEa|B=|W=z+`cv!V7Ns~_o@9mv}gLV{e8OL62!Ek`w1%fOhN zCLf8j!+!^P>$7kQX(Q5`Qx043Of>0xcc-mqw?Vpb;4XT39og5+R8~)U6i!7qj>U;c z8c+X#5pFhaD$@d-Fg}Vk=qMqcdT=cMa)iET9)*?yI;#N1yvZW^$2sXFVpGBU$NdKe z32v)PrAdv-qVLjay79`m?5L=w(NUcUDwCLzq}_uIU0^I?(T?7pAFg!KrrJ-?j79a- zL@$O#RmU4+uY|eT$w^dTc(QPCcc!EiZl62bb$TsPsJ}9M{lu;sd6fyye_w<;<*QT; z-3jw5m-o0ou_i%z!umB7NLg8*u#-zn!ZZuvShf@2#EGS{%SW=qTJzg7TTDa5?aybZ>)HdF5!L9|72<5k9(3B5+{2GOPCTcYE^tggWQOIB7s9l3eWm?R=6JE%WLBqQz& zXQ_{qcA)%K;qo~)r#uQ{MFPS-hIjpMGO&n#yh7aS_JQYfGwXRpREBN;x2N=AO_EvG z%QQEXr%K9w?EzkWxsU!smO&S2tL`vb6s<&C!O5IjpC+E!LaGASMjZvL3}cP1`B(M*lxSvw3k)~*~?nQdd;6C zAP46|Z*K$muUZ{kMUOr4CI_9M#zf)0 z)_9-->}o*Rv_qu$HZ_(Ly-CsYIy^i?jbR<|()rXlZ!|nC`UwL9Y=99Z-zJwzB^vQs z*p6Ea-0Uu<7IZ?%wcCo3N-hgh0#{M=nEUwx0} zB1ztqyOx?nd22z=X3qO}gg)9jE@R5$9(_EHWTC;5Fc2n_A(~&L<5@!H1JSqdO+lui z^ua(Tf@(^6Xe?_R!Xj84|7;q4ah!?r=0C~`>H89$qQ;4Blv(%VynAFc=2PfP4{Icj zM@zVk=7eTM59qbJGc(X~oru%1x$K;DW{Ac&1>P3PSxi}auzG238P(PnYVn&RNS~*>w zRkuQ3JDXhWG8G8W`c)OikHxPMHYFB=8|%%|j# zATQ_)1gSVq6DJmy$xM4N?EbO?6kMa!QN)>9o9^o9l7wa8ZrJ73*gk7EVtxR!!JJ1v z9d_a6R{g@_@o)Nqf9b4d!F;y<{VqWYskCL6-Q-+dfrf&Y{)2E_+{5zD>`?m1rzK-l z9>uhfDRDR!**V3_1P)l?Z|~|)cO;r93DwDM!^zIllmtz|@BP==B&|E2J<%C7e}w&(xk^Vo z^U)CXoW?L^_OYHVcq|h8>oe&rl7AHJfjaI#96|yvW!oz31?t=yK6B6C4cjAVY|IH( z4IoITs?Bk=H7}b_!ZvxxO1@pe#bi|@{UUmrc&UZ9-XJ<>hSO;SYP4vE@Yy-USQdO* zpF65qaM4<-(>LztQGgse0zN+S{KXnV*zapyd=Wk^q;=u4);yBx2OS2G?&2=o>s?NE z8X)l6R(Dh??#I-}qr%^{4+{Ph}CF@oed$!>U0ncwZb(>}t$xhM~{-Rq5TI{!&qZ5JuVXL|r zPYHK95{N{d5qZ8B!&ly8ssMi8%tXX;StR0{|2u|enxG7ge~ADa0N@CCI)jM}X%L3L zj;A{Vu<)=z-9uiAN(_f(7mIoTr<~VUm@44YC~dHLm9`1Ic^G0{N>p=r@fICvpKxYA zua9W%U4J8n;-k+VBRlTVs8NP`MBfVLAb%j%RBi>Q7ToZLp5x1#zJBx6W=b>zYep!i`L( zJ<09?^d3Ms8Q8f;N-XR3T-o(aLRk%&1yhU#VnC=xg7R~y-1XI^AtptZ=}cLqa%3gp zjj~%;nLk~J<6xNJL&06FK3V7cAtU6f5ak3W0sLV=Ycg?He9GachnZ4aP57wDu7khS zrl|(ozV^$mae@{ZR3+G*C>6nJ^t?gjT5_iRrgIfpsCZjws#+{SAGWP7k%^m_=HX6M zD-(B3u`Y|%e&up^0+Igkj<=_dj+fizKekmlUk@{eENAeT&XhgT8aK;0alFU9R|`En zh3x0c2`kO`T|4v-sz2StAm;L1nH=-vK14|?mt<6SQnvw5cs}{I#FIZgGKgRN(0BOL z=-l>e@}vW?!x-yr96IXasEn=HOBu9`Ye6=5|L4?SDt=R*gBXaB@Q9Y_ZY5TO_vQ3h z`J3wTGSPu_C4(|zf8Tm7+-+*dv!!5qv7*0^EQ!YknlVa|N;n4wI`b_O83NGvi3Fmj z{HazPS|@pQ*hS#n$!aq?UX8il2vhAd@EF&OXyZaoP`hj*Nf`St=j|csV=Vbkm4g2S z$LQIVqd7+72g07SRspac%lWIlsMwtAH=9#ByMZmKjO?C5|Gl;qend~BPty3oSJ73j zi+Zll`HF>irs~IvLK$X@4@=l;=|4qYwfYjymdtdV4eHDUj}vCyKZ!iE~ldxS7e91CnRpoC3f3D&N9xIm<03SZ?)9F zGk3XR+XpgV{^+~BVLbL6Gklt|b{37DM?*+d2`Kax?vk7WftC)>juR$-g-F zEJha}tjSrF57g$8<@nUjrmR^`=ER3|sr^Q6jUYZCO&g7FP2SP54RG;S9&qI=lT1Q*!&3VnGhmmcg^M~5Nn78kKZlQ=yVg<{s-Sj~eG^;JK@pu>o$ zdx!7*OCMdt>ia8PN^P8V8LsNLFw<#nY`&Ir5(FL#2b_q7=@Jv+w3q(1%I&p`CjZli zSSC*U6iC!Y1q`F0L~eL+vgR%I>IV4UYqbHsN#uZqb8nai39{Ts)Bn4vG*+o!9J!Bw zc@Ks;z6kSP4X~C5Bz>an_Fg$MO2x@E$VCB2qDu!GeUEB#UOf*L*j}kKUvcoPbayOT zPGD4)cjRyA#pR@ZPyT(~S3qPR*}4a{#tSv#$I+&CCP9Tho?7PP;uCNLgxoYI(1b?A zRyoZc!A-~GVc7W8A`YNH7|O4A&$a08fzlHt$cf4@zzRySjJ@&6lu%yM zJO6#Mexu6@Z+nOn8K$^k)29|%xhds`UlWvRAaj2?81$FkRkjhiyWW?0-I72!<^TM2 zj^p*wUm+()#p^p>E+;T{R8f22m}SUvcBt&ril=b#s;A&K#2xcDYguhX{r9wz^NoA3 z1nnxDoM4R*s*NZ`n&+od(VxP0E{1>c%wl20Ua!%E2<@;dDu8gulk4y2Vc-;y$E#= zBX4V~&TX~)lz?N5l<-|eTWrJ)OelxMV^6p=n>FaQ5zwI$q+pOSXcnhiQZH`^mnr4V z4_hOKT`xjPQ%)T$Pr;v1f{R}5>-7;vf9RZ`%|JxV&X1UqzZ*_A@$TPzG1IwdGL!A> z{AV-!PDyo_7%Je0X$(4H1{h>G+Z?A<%=+H@4@P1oYKs%z1lvCTYnHMLza?Qp%j-(y zK7A_T&w65{2H6W#4kSP>EoIjA%4J;8THXIeeI5IQsmKj`}Sjr?$%q6k-a6eWst+gUhtNXH4^T6l;` ze3yt;;NnXwmuXI2d_WT4K_yQmC(F1(3<7(n%AdfP z4Q*rijo*+|50`KO3I*R&EE8cAjt)T&U~ZF6AR=z+iD^E~mip4erCVm$cW(KFy(I$B&81mVS{pX3lWdQ$oY*0P$+u_EuxX9|$N3 zrWH18mpQ2uAW0?MD5QJ=GZ>yV=uwOru^wBRz7_Uh>s{f7IA}8ez5@UIvQ_@e-ifMC ze0bJRhsX$kJ%NdEMc#?ucu>2}rul#qzi@Mzr~3@v&<9~EYvp_6x&9daTX!r87s^~J z2|EH8^B~7)%jQs=?7zzG_;!1N3rGLu=Y@`}Qds5yom_$#rxk`Z;7)sdUSfHu(QbRE z_AfB4B_jU|o<&rf8Mgo;9B$!UEu+P<`8+O~7K2GlUwaEIu|^8J2F$h@Hg}_KE4o1u z^s4;O>L$#S*Il7K#3+rFM4>{LvXbEP;j$-RJluAn_d=rXk+u4fSfJ$&|xo>T_7_SqM*(cI?y;KblTqg>ok=C0 zF!Y++mjyYIPX&<0$qxNg1Dc2~(FGl^pR<#-QUN_2(W7;Mkq%|L14MPet$@{E)`W&) zu`#|-d|yyV=RTWNw;$(JqFQX~aX-5+pwEFpw}917F;!nC!skOEIc3K!6$VnN#o30} zm(+p>X83BEKXEpQ$|9l&T+^jlT9ji_{D?wE76XYD{wy2N0CBA2&awjop#&tg`Mpf%wocCd^zQU z7s=@8Mr;Sv5#rx+QleWb3oS`wCrH)%-mrLcTPRhrH>u_t6NF4kjf#byu^o3IB&sm` zZUKs^FiOtH=(5r5#^McJEE_TQ+)2)f@&d>Y1AmPpDxn2Xyi&s?@`kBBaBXV{ta{({ zW+)K)D8_rm+?t%MDZwrb&->ZVBrvA4*O~iyKlPXlTsZ{{CKMEvio_3vA`E3V@1L&Y zSRZ3K8MxmmQzWdz_5~hv4$i#Fp0GKjPNa~)S+(g#${1#P7O|6!j)Ksfs5pI?quC)& zd7Mu}fi5;rtGCQNz~)gD02>blPMTnpt)^p&GJ__Z%gRABtvrlMSmLigy z!Ym$e%Xd5+cba7@B2_v_qq*EJztR9Dx$GpxQ7bCSYE7#{xF;D7F-Dh}nUplq-V#S8 zgvj@4!bt8PhZ}q81Rk1v3$Wk|DTF19ohQahcbpsz<&xCO*T+R>s}A&{RLH1v38dlW zHatWH+ceKi2;#8JkuJ^uuD$S&W>RYkSY-_U+|%W-hXkX73(=Jcn$*BUjiR^HC=#g= z;tn>KN2e1iw6nLLIjHxi0&;b*PfiUNs+D1s<&6^_LF+#SSoz?@&zbzj00Txu2Kfw`^d= z{lgb4GeV}@0*+AMQ0JJ9uF)5%S#t$s3hknVUZAmgdMH!sp;at8z!Dcr=b+o^-H(bF zHT)}{$nW5C~)CvA@DzV*{d<4a~&@)22*p*(0>>u z?j=aT0Pxtb3q9w@PXqfXx4h|Z$1}!cmd>wQn~{?_V3aaIB?UL1o5_L_0|YmuKrwky zU&D4Rc%b~)pa2fAuS$gIE)ts}X-ISm3F#C*YggFraYot+4@lrQrV)6bdfm!(SrRR z8KCS`H~m#AP7VGBgAPx$LB7wD?2jF|r-%`YbsbxkbqTveNoft4ihmV##t|H#LM+us z9&OKi)*Ok{suoNDVih+#5WX?&814jGu6x`)06kY0ADXNsf$F-v-Y0ENRjV7CQOsXY z5F*s*7K-n*P=CwP4n&6FxO9iinbt9DlkBKX0x0qF;Yy~ck2|xl2jp(*D83(VMG!7n zL`|ueP2lSEDIxVU-j^}z%T ze-)uFDG1evxdecW&Y8OS&1hghgH3#C2nq2Bsk_SKInHu}G@~TY1Oq0bO$W(NUM6sW zC{UYO5HQK-lSLo60OadSA7zSDjhM_|S`X3TL9;MBTG(FvATbesuB-TEteHmxCDxp- z|Kj@n4tn-`3)4Nib);(^8U0y8pEB4o(Kuqq+Qxu&jBv*H;#9zIOW?iVy5f7clGCx7 zxl!`2qsa)7?G!U#9r%QxvsnM}yQ6;H^qQZPrfJ7uH%Owv6_uRyA2Y+$iz!X2rr z@iIdgkyd-q%6o`Q86QExT!>w8m0SQCEz93FjA_QD z#Kf=xUGpXVPO#LS?a$33k}mA*uLCdrtJaRE*8fA(S+KR$bz3xq;2PYEy9O`v;tq_#T|+}6u08g_NL$S+`o|Iob0{UoMWWv8cp0Qfv+^HyF5P8#dfG4 z67oCHvimbh{aUUt!yVYF(Ps`1`(lmWp*i=?31O(N+z zt=erIK>+mlIi&g%EgDJs@RFd1B~Zlx#l={wN}6e%XTyfeeuhl_dFEwHca}Q}sZ)3c z^A@*;DsVKhnitTNSjU{m3(?*z(CO=XQJq)mZLi<+=0PH$5%0g6=Z;|qgr$|Lovv;q z91R2`{x{h*X*RG2aWmhaBiYf6y+%sb4nAW8+=LuJsQ}1|tJ78aF^D*0=}J2ZZr$C0 z1Ttt91!Bz9Q4&EE{wU(uy{oORkM44X;iBmQ>=?Rx3p+j@@4x%&)r)$bRQ(Ru3wA%b zWZ-k`zF+5`q{-VY)u>F15$}nbwRUNUlacN?urn{G!4bi zGUuK0(tkIV~E9Js@OFn#8h)a0JBFS zz`5Z>3Gw<`N12XmsU(r3^BjT@hW?sP_qDoAjhUT|&$Ysb^H570NIb(~&zo-N296t$ zT*2#PEw<3l1a9rqM!LVjfngaLOD+-PLl^1fbpsZvkGK!Tcy%s zg?0I#xG9V<#+#PX!KQkmFvQ0f%)PtWC?gD6$;vcg7=*X^PcwcZGlvmA@6tG3m{|&# zOc!MTQ@*rS_4gmN5F&J18?b=y!@0@@ziCX#yrQ%~i&(&ys~QWkNCXjs{}>q=>wh-I zR9)S|gjqivq^pJP+=jnYRHjiAAvfx8S=Ucy`-P~1kvL2^-~Mzp#{cz@oZ}H^EXXF; zH4~P7`ez`l?Yw;7yRS6=EVCHE6BDE05rPz<^N=G?aq`R*AcxM?pu`PUK0O-M7Dto7 z&|tMpe3TWvO%f#?&r|5dI6?BUe*hiuadhR3!!q=zOe)?n1xd-a1fysDLfG)0jy?-H zv8cGZzfF>>7-)ilt$4M)e_oDEUpcYDoM}`1y*bnL(N;l%r7wR8VNY!@3s(7z`i~lc zUdzMMts49Z2=$$blJ=&?a_IIvBsBR*(}evg?W3|#cQCX0T~cNSFt;O@qU&ES>9j9K z5tw<)IyeN{VupZF;%V{nwy;gEqfS!#ljt&#nay!ZHczs)G{M8!rm5pcYM2z zRZKcZ3TeM^e(W*WKvQ6c0^>}MR`xOYe9x`q@@P0sP6;oB;GFie+kx! zrC`1(I-?-Eh&sy6QQEJ>pJR%>@{B!RzTF>=kUk|1&e_eQKxEW&1+SC_^!qC*(ODn4-Rjr|(<($n*PKvrl!10Qa00 zXo*n8P=x)K&U(c8oGT!5o5S68sIVNBg?~I{@Aw0Q2=b8m!55?7%sCXI#16KaTy7RW z{u)xRVmD@LGD;xhkifx9OZr@;Fjpy~=Ns3f5Q(B^t0CO@_WbnC{kCY4f%+(HLEA?H zxAnMl$v<4*hw=)d3dOuTwh3DL)V7O=lr-L znDg&l_Bmu8`0P($CHNBReF{z`g7|3I_h&j=xpCM47W^1Bj>tbENMvU0?akfJhK(4P zu=Es?|Ks382aH{ZLj2TqP-D%dAnBFQ?_tN7ztKDWq_UJ>G}s5svZ&;zZ&X5V61Nf@huB~4@^nv@Wbc-6iEdw1~2cX07e$VP|sGr(lbLSd@t3Ci%F$$rZ(GG z>w!EHHe-waufZJOWOO8bLDmj#wlkuQzSxA6gBlO9KpQ;Ho(F_pFeY?lL1~1}OMU#q zTg}q1QRT|nqXD)Jl~^zVlaWlfy;JD}a6VM)HX`iT>P&z(Zz2*|@*=e3UHAO2>JgjKtV@!*ZaGg zvCh-e_x~;fTIa)Nz;*{pbWr|I+Xc5etiW$bTiCG~wjxJ0Gfe~Z9-w_10H5bmFwZFj zA0pGpXXr5md)=0w2KqEO+0r;%X%^vWL#^!!Fer@1v?+ZuEBq4G$nNo-@#~T+aKJeg z{&;h-cC<@`O2cZQw;|I&>C5*c#JY}JDyFuTJr1!%Y~jfo<@4$_d0k5y%v$faFc5r) zA?`amu5Tf+5MW8bhP!3jKV`T~_D#8()=cbu;D)icGc$9cizk75fz{Ji_z~cBchRHXKtzTv({6kTQZ>PPSI<+b+%V> zQ!`}G;Utrj?ZlZ%NH-i4S;@zOB;XiUF6S^>{b>B{3g@sZI zN@KZX47KrvVXeE^LPkYttQ%2m1EP2P3MTIa3MClT9oz&ZGUy;h4f%OLEC$IAv&kj9 z`qDMXIt0dIOURw&A=gT;t4z_}gh%FL2CAx-txk&?LDf2_VW`Dk#O{AIv=>FSM#|<> z5W?Y$V8@220jWZXn#)Q^+O2cO`yTjW5-ZJG$mt0%#hfmdrkvR}I!P0Hf^!DN56u@( z{_q(EJ^|jl9Ql_t5$@M|NyuAfL}d`OQ_?(jfsx86YHnB9tb3LZ5Ir)(9m4HO6 zd~%!Bq$IC7r72QQ`(NMQ9;JbDp%>0K7_#JEh0vaVwBXB;AC`NFe^sNUXq?U$N&KOniS!kv!I?cy^>Q8cZZmPt?Y^KGyaI z>&iTHTTOd??#rRdH~H1zQcG@qvBjNZDx#@AW$Z2B#FyjQ`Ze0gkWiFMt4wdOvT((u zf0K&Q6FXF9(|Leu!xw>ejA)N5>k<=DX9XM2yCXStR!$)&zqHLq3SI6)&Md4P6(8#cmOpqk%x@n+M)Z(WIWdN8&CZt@DuIFuGkv9Jz2kc?YS~DqU;hf@p8nR3a>Heq) zCXW(p<@*CVY$G%%zuIpfrq5llhU}12>fR@kT>Ty1?S7Dd*eB#FZ z8k4M$WmSD2OEe+CJ5W=El0yk$HKS)W^m8k+*v6Bsxf>d7)P538F7;|SqG?>6sS)#Y z6+0U9>`8SkxJ?cOl4S|iePu`SG&A(SU#ez|m-@Hqe1Rd^j&|SwxZJoEn`f|HxvNhH zwZ4U(K36NQm46+O3f^$OQen5$mU`g1nT>l z=at0Lt$FO9h&UQ4d_d*BdSAf~uf6guZw+13JkQ?GZ(;t!pH%cE`HL@j%-?&8_U<&o z+0@qwr@vaNsb)8ksh?4 z_eqvcP2&co*XX6p$R(tS6iiBNI{q7W@7aR20N1cE-MT5%$SPE3uF0H;OYD@&2%fM{}o~a^0I$y7EEegcmn0K>bSFYaVBi*=AruF#O$E_B- zhmcJ$D2Ooz1B18uF9NO}17^;M6F%o^_-7?>oW%gRa+=ylsA{5h(|Jlz%&RBhUlU1- zrM-Y-H45KrVF9;c(Q`&pHoj|jWXcx;dq9CWVNI7mu7 zv>G3O(dTflxz^v|K`-}ZfUE*MB@JPbj5I(joEzM8LE>$qA|rsL#j2DE#VX^uZtu#~ zUco;(*|uh8v<1W#>(M+zdu*srntew6uSWujE+dp0w7?f-~kceH_jzU*PF=cW#up z3(;DG27e4??YNYpm3|VEXk31cB&(qPrhw1yA8jGv-HpCt@o6%0)6}6f2ec z9CY8a9|@jtKFeBgc=e-MZXNn{k4*+&w8<{1|G0zOnLqpJnn%t)+02(A@QI&8P0nZP zgqR}UGxweiMU_o0Lp$C`&?(0kkBwb+GCK8BQoN_+90b?dm}9qw7`XD8hl6qoPZpQA z7%^yldC+FSaN^|Wa9@nYw<$SA%Vz6IaeS+22h9-@dr2A@fiX+J?uzTy&%l~dU93Jm=cK?R6DYD;12lhgcz!Xob3=3uZ5{)OT`Eg;T*HzX)FoK4Fb*%~!RpNICpGwpiA01O| zRv*i_wbr`_s-N7}bE+l~WyNHuOH6{Xqe+UDuIS&{{dYV+*4J0n)ptT} zl@ApRZ*ksf-j9ycXiccV{B3e=jk>A?bkM5ZMHJdJ*<7;RVC zLgMe9a`)I1q*d09ib2{P!DF3sDYigRbExvA#IUIG z0n1V0(7y(Yd{TM{k|*}BuB*H-4A z4_3UDiJmAe`!zrJ)Xk$1a$|8@d|;J-?ol+L3xs~Il8VV8e&F+`ZY@jl`0n`OB&`Xt z0{gDTwT8jglx`T9P8<+GXKB(8~^3s1>9fk>cpzCc;(|U)oNeW zgcdoPY$aq6)CA=Cd>Xv>8TXfH?qYt|X}!m2cJGg+Co6rBE>BfcEFZO6RW*gi3}72T zp5_Lm?4HtWI%tKQjB#9}S9;XODEIwtF!iLAvzWW})=JaBmN{t4kZH(@&(Hr-Mt2m; zt_?5)Vtk!112==;(!b$OAWyvQaRL*T4L{+%Lnk_CY{{ieYgHX%?z6@)k|ZM>v79un zgGO+8*>?v>kG7lw9IP8Jon_&#xLV-rt<>^Ip6x@~hzsnTPb{FL4U54z7uZKypm?jq zErNHN0>Ks3k@U)Tjt_-v!9l!!38{=Y=_c%`DLQd=t$2PrGvBegGRETvrB<=CPXs;% z$&S0C;!pVDH%~NCE*2}fRRJZ}-X31myT2F8{ICMC^mO>4q#d z5Sn=nw8J`1!+&{X|Ig@_vmlV-_N~KwxvYpCcNTZH%{b;WVCUKbkCum?x{}>hgy4VQ z+6~{=g_Mj1?5efh=^wekB~cjnaDMn3dnLzG3F`9LQJ4jy$t+%pEiq=mjeL3;57|uoIAx`Cb7Vkne{Ae^I*2U}K?&HNvQ@SKx)Y>M2Pos3NVMMFf5n5JIk;t1 z!~l`c<+~6-YMu(#T%0dlF^@@V!RNznL_xgO$q16tTQNeoI`n=WdS)EKmLCf zKy^!(RK;ha(5V2AOzPQ}3T4GL=h=4d0|;i=6JE35#mho^@TS^*)6^6Ho)-DW^Qi=H z$9qUONf8n8Qcsbq3tpoiT;XkX0{fRw3RnUf*kC91x!Ivb2#~#M{p;iSN`Qb&uxtud zAwweSF0=8QykH~yWAkH=kIEK>SbnJt!q0r(2aU-*!^}PbGDk;MR?b+a#FZqTN#k|3 zHBF}#LQF#Im@qV9PXYbbB?qja=446#`H#ge{Wf74sFNME<+8uRi8!HqDccl%e97Ly z3-XNJKW7Ra*)SL+t|lDKcIAlG5|doRewM%tZVdkLYaf#Hz}*NlwQ38r55)`ocB1jX z=vqEsq=m|aK!L7P*lpNlnJ0!gLyJl-o4;iHCf@T&su}Ai(LKdCv*Xo9t19e18_U%n zZG5s@eeS?NjsLxJZx@*$Sv5=vWG|2L84fX01KPw0C!SnT3?B)F*`?v&O>~hbm$|cj zis%xV?vD6O7k|*jHO!z*yjFEwuThT8x!dq?=KV1dy>w`}{B7!FY$$_T0dUm>8Yusv z(@|xo6P5;QSVRFY4N{BH+GKpE?2!bdC__ zG&RAEsqw(c5b~pG$eQ zHtMX?-aaeJOd?>m+LSqOK>h>Gk$S?&Vrmz=GbMiqLo3IaJ;*ancR)m_pTqE$Y%C(5 z97Z~Au{Vnp4vjsgTd)uS=VB&1Or~R;A~2$K_06;ax_e{yA+O;o;Tn_rowR};avd8Z z_oH$^4nS)9WQTbQ;j&Ltx(*TjN&|BoCoVfoR!G=Kxhm!a7EY`&uPBCvfS3LP1(wl2 z)omw6VF#S`X=n-F$Sq<0*>_?_K^_B>U-ij><6XbHHYQvajXiZ8Ikawi{P>dqmtC;aIZ^B>y;3jQgq*M5Yn?Y>SjN8ufzdoT!-LE;f(Ob++Zw))qmgNT2jrKU zt5ld`gbk+-t8HAWSQGNh8w5p&Gmd9FO6gG3%+If) zG}8V(hnh-{wsp2)IYwm~yv*i4ydk+HMO5b=qAP~GZI2?Mt3P#5s$O;gg&3l4fJF{u z+!45$5}^`uV8imDu%e^C_7$_=#ezBK$*tDm*K6V>;q8IiKLkQTQ68pl-;h=iLuh4# znsF6$7x7m0-5G$`p4=rrE42jmn=EmPntAeJCH$%G7w*%22MF$0bQ#h4V%YsEf5a4PT0 z)oc7%;ZUb9H4CmWZZ&C)(w&KyW;)w*%e&(0&nqNFr3weP_L%5L2MC4g;~3Q7L6@|= zuz5Ti(Mi|(q*$V_ziDG$B2&OsDYnG2zsXkM?FjAfM!Rc%7h+B`7wOMZA4)-YZ1GG_ zOV`qZkGD%nDkI9HbLYdrhM7DPop$zPNRP zj`FMkTCRn8$A=!Wsq^8>L#s;Jnr|eAB zv9`#%i!`&bDRY^opkB-4vx9KRCt|&N7tt*pdTo`=_qsGR7o2^PLDbp)O)}_6a5J2b zvL2gE|FE1sG4#G7nn;udE{*#yOYcjVo8?QR7>SYH#nb9>UqzB^$Gfk*t2U0?uT^J% zUJE1bx$P8b(S1X?V~O>@xP!y;0$_55tB-vP4%-Lq5LWyD)<;HvNgE0vk{%CNh#w{32%6_ms@A5SivuiMFUfK{s43?m%`b?+WLf0sgFMK3F z@$|>A&NJJ7KTMkiJ?LCW<%k8op?6a=HFMpB#_ zkul@|9w}0)gsqA6cO_d${ArY{zS$N;ZD)QXn8EXy^D!B|-o%{Wbe8oY$MaZRFOLK; zBs!r!D%>r>mWbTyq>nc^c-++WqPQgYT;~IEvqlyD zQ8u5jssx0xJ`Czz8CjU!R#finZBStU#t`RdbLwn4bXL+$oXa{Z3p30xsBSkC+{y+G z+pf{NOGa-zGS(X2PPdI2lf zQXbI@T$7-%hGowkYXs~6apG3i7pgV63ZOn6O0=WeUdNvwA_0U@`^di@DAC_{Ngn>> z)M?So?L(H7NY*h_Pg0M>4&rD9GE8RH+0ZyqOZ7v}y7oTZ)<$n6clYVlJ2Jfp)QYiU zL5i^j?i=tp(bCdMQ%Z-;(9}NE7TjJ|hT^(J^PURy3A)H-RzNSCKa3WIBCdMN;rAT*ozWea;Uc{t zw2HW%-uYmtT0=~c0GbgtyrgTo@L%EliW){+c^VPa0s8uZQhhw00a?4&cY89~#=DUT zn@6Y^(6{HzLRGVMD1rcJ1PDzx>=QV(+f{JFAO)TI15YXrqYj9#_?A~mMOX5#T&~-y z+I0s~;FC#P?uV3nTTpqm)wc8sE53ZB^nEx{kI(n0<#L5hOt3?$V(sFWqtketDoq>a zIhb4}O~r2y_ur}%elS3fkn7U$ZI5u~a`@`|e}9~fI%WFCkO_fB$GNAfXULfygF`Te z+@Jac|H+@g_M>nmPJnj*Z(M0v7UcG8XEDC+f-~n2^_~QHAx0CAFtj8OVVZsX%J!^z zU!_LUU)WxABOfTKl4)U!XM!uP0xr$Gkk3@?)WTvMbvX^{vopk2HG$-UPmT zvI=apou`_oVE}P|-1PK~KPLTeXvI7j{mlcR@dQaACtTGb$|B+;_UAz6qcia%1Cp|+ z_xrg%c{FM;S9z7!-qXL%uV@sLBj{;wEirGzM(>F|oN_738LW0b*VAN9Lp#_hrdW`e z0c7dO;b1E=dQLNX{^#!I1`3C+S*9IYHwI}$82vu|@OS#^Enaf>pY(T^0j0WSF(w_< zKj0{?d!T3#`1{_F30iW$)6kVA;C6yjrH0mrEBd!q>&g>dxZk1x6}qf_ok84f*+2o4 zZ`_%sbEfjYx!ZGRqrY-yc3zhFoB8U>G?%^S!eAio{`<#x*ZbQHvPnrMGDq=CflQbQ z-+kaqMd0aYqhgO=ICU*h-4BM&B8N;W{i*D(VbSSGx3qf_-{RTXWYg&a<-RTvx8`v2N*d}vr{|+$*=9wikW(4`D@kgNqHrk|q-ZDl z_ekTEcGQq)asRersxW+j`hbrgcUDqkvd9ODmtQ$TF{@O^;D!EB761Ko_#3WnH8*GP ze6>-_ zl_;UcKDIAiGi7eJ4f82tCmMDh)i6rMk+ekurlfbII4ge5{&xAqNP&i2g32fqai`0U zu2qN3Xwto>l1a`?W|37gZl|19hpC8OooT+q17euSq_kvN%LPoX$0Z^qF z&;f#t!x_Wq0gQ?T*>p1u0s~B`V5-c5p#AdhDH|qZnH#7~%?e=y`pT;XeIL+~x^MZT z5uf0>ft4j4P-NUmU!{RuC+HQ;wnsAv4gL`0ySk zXD&4~1QEkFD9Mz99*DNvZ{R~Yyazlj}bw8F+k&UZU)M;#SOQG@l z_4GU?KEbV+X+ZpsF(26#WSY@o1yaEKoOvM1X3lF(8Zlxt)EA8u10a-m_mMEK)YvB4 z(+%9|Q4Mk0&2_Fe-9li2mls1&5LEScX6Dj5`2D`+!}1ah?}SBJB#}4WjCT}*-%?C$ zvDs)&nvaDv7oFH}Ft59aCwlTCv$wKlY^9H_>Qam|2DdCcVu}(0x>iV5@ql!WyjC(H z^HW$jccd^S%F3Gy2yh?!ipLs?`ibD_u-G9;JMBGmB#vTvoT7IX4*!Uib5ztFP<<{u z?rk|XDhV9Mq!7AzciKjDuje7cC?1H!goU7Dz$$L# zu(_?EPXmvvSzXR_7yRlTf6O%_CgKh+u6Vv8f1wzsLCYsn3)#=~vu9R1$*5EsLrL$m z%-{X36GpF#3f6t#RG=Tg?%>ZO_RR8J*>Fo2;jr#5Dt7vtP3U}RkclT94Br)PhFwvz zgqrLd$YdrAF{G1n<@dDMDwEs)qWQB)Y_?AW>T(^GeRw*;s(FJN<5XpdA-kAMZCsaJ zCQT|tJNMOAN-G{AZoKC0@61;B-!&ht@V|fi|L(m~-Q;RuFmq9lD>3D^>|oHLQhNf2 zrD&o+nq5O5O|ciHqGiM}_~TqOVkjS%(+RMp#TBIvU8?bJwx4<)d|E@lTYc@G5&d~C z;ro#N-=xS<=Dz4pGFQ=zd;6pQMYIt*gA#`7%6WvULNyxYVJ=zWJ%9ftDdRxRZrh04 zd9wQ3GE(oNRB&S~pu{d&Ez5L1@~3R;md}?8!2nt?nn#t?B@F&D2}8u%Cq&XR=^!3< zZr!ubB zptKtVe~_&WVYfu8|0n@M5C?3qY;u%FTqKVdt1xKq~r~2!Nt3=~8r&rFF+g z#Hx?9OTrrX&tD5Mi$7BISA=_hZw({6%$fK4g~x%Cy)K~| z(+k9=HlJb;Qj;|Gt?W!NR11I*4(IxVLen88(f^CkkW@6Ok3=71xA-MmgP~6_xP#_x z91*t7OI#(!$?ebHX?n!ocpTkuGZ(yabC#;rI$r0^vk1ueWe1+_z%{qIEYn*xV#&>@^Iz}9Xf&;5$SnIQkru;UoNc0<p!u9pOPM%)N;fxFl#}C$THUA{VB800$}~GsU9+KaaCm>8WPA7s zNtPMBxTmU(O01c9)!jS6=K%aVaA;=N&J*!nw&M&b7@2EEQig&aWS2A`vv&N4V5V9T zV;tuc?1g%<+l4@wLIjumcZ;NXOcM7f&fi?+HB^ zWAqOTusRFxd?N3*IpzJqxre58yeGi2#1nOB)RX@WJ@FlmVB!gCmWlNn<|f5MDT4@8 zFw^@EWty_2C0gxZ&8Q`zP!ToMPtm1kSEC>~QvEHsXbLr8Y7pXzJXA03>j) zC#!Zx&xle4Q)+dF8OcV|V%pSx-cBc@yYZB63HNjViK^~XRly4rR-nQ0O9je5>#RKr zS>@_zbU5P=$B>;53G~0DyQhc<$JG^GdcZnLB5dNalBqW|Z=Ed{P ztH0oBh@ligRx35z)bvt%OrkwRQC2T&JW2D)Ha;4iokqH6xOmxq7yg#NH-?tBemKS4 zV?45l*y`OJZxTo-cKq#=VOvc3A}^m%XEJnD5$h4J>vYF@og?V}a-u4xuV1tkW@7>3 z#DEw?(oAWY%E;Y_aiLN-4N01NcTBIwNrBFA8^*_EJIH70`6ZdDKP`($ed)5BR7(rp zGCN_n^bMcX2{Q6h&Q*EDQhs>)?XhTOgUx<}JeZv8@Mr21rA*ZiEHGKM zRF0t#+_TwMrKN+cN%zWszfV-w1*GjKBPMY=@eBgUdDl;o1%ZVhh(nAAtYS~+(Mt>w zzY@8?t$J~_Oo{T`s*n{HSIyHa^}L!tNPI{B)&4wEmqsTeyV~|g>#?1n{Cml?R_WnA z&S*Gezb0~sq6R2nOf!W1?yEs*u*vgTwh`af}6y9`963c}o^MHJT8 zrMGZ?H8!gx4tnIUJdG(8g~7!%)ZE-Y^)Odvk|D3Ts37|7-!Y@B6SZw}5rWE8MGdr; zoaRJ7TaEzFm{T};($y0-32*?jQou&On;4JxBx8D8*?Y7Yo}R`=qtQvje^FtIACsc%szlR-?Pkdim;cors$s z9bDLde!QGjAbAI8Qp{ABh^x3(!9=)&)wJq1P*miO9?ijrCPV3z7-dfEBUIZ7f%M$X49WmUdPr7M=Xx% z1aeXAKHm}VCI*-UMbHWODexS%gNBWic;QD}{yS&OSD=#Z+v9YWTt0$h6s2X!Rv=MY zwsd-G`trdXmxuMyzyultlHznov`xyQvP`3gHy$a0gTyAbNv+R(>BnT*e;wywCr=%(FFoT(j6PkJt9u%-XI5#pG7b&_0)*^trB#P-!I+xv+^(^(SO1ea|wY@ zp-J6!GE1A^DX(wmkJppBotZq{&umqaJfX}oC$7e5($Z0Hc(JyjCzS`G8^`jD2Ee8r zd~#TYlu1yxgE|a4K>}X3{VVG(ValATvXHSwx4HSX(k5Y=H~|O3m0G_;mTaCFD=w*# z>E-Y&R`2_v6PaVD@?gNtZoWnAi((V&jupma%+n{O{+(}iD{)DurI zMwJayIWuA&u9>3yE=$IkoCB`PyHv5w!v>4Fpt3!Q)Jf3r`CLuY9~o0-sXN%CZizk? z^*B1wC~=0;ga!>=Z^+R^u&U-b#Q3DGQT92AN4NGXOsAZs&x8Kqhpcd%V})KG z_RGA7sEblKbzv#!DUC8izIZKu@FcgKOV?jB@Wl<^q4!xLgKX)qW7Jdn*GHF#O`)9W zShsatBq1q4mq;El3KaXZyaY^^#7SI_2{_hdRG$p1>nIEYq7eyX>m%!8m4HZzCkGXd zb#QXHCfLEUNd}_0d4ds_T4vchCp#HIkDvX(;0$|7l<;M5E;O;50Q1n84cWfwCgfv4cjj&$K>=X0qsrx(^mX?9?t|1_v8&zTwfT!%w#mC?!0D&hKSJqQN z4rSKaEc^AOnDdK>z*Qo2Nf$ZL^#bpFJeK)iby0x>`E&4yna*mUAAGzD(?C?5LJBJS zb#l|+Mar(Dy27lbqs&a-m-C1$v}jmL%*QO*doKdP!c{1=n=NwA6`ns>AHQ(-XkLRk z-s$T%I=Ek$zZl`QyC=BA>KqY&8T%&<=E0Ug_#%BF&CK9gUda|5cd3*Wg*}o4L`wY) zsZbOA!K7wdZh;HGFe}c|MYyaRz{3~l?4cOV+6b_m3SQG%U#ZL2H~yZmGjU!*!0g!N zNBSXK*(LIT2AmnVh?R+}R^byX5ASLeFcoEW63YDJRxV-{LRqK*Im3^xfI7$UAb8Q$6Kp`EbUhzpF6#QOZ6%k5ZIJ_vlB6t*v2Gn41r9eBY>jhjn#MeEu^@)k(E6EQcdk3-xnU zJ)R*hCEh7e&m5$E9DkyeqzGZ>OH}*;iP(w0;2IV!9Fr>X2OGafX(Qzh7~Fj%wk%Zb zi;6~SZru*($O{TsM@Z43HbYC<=A@vc+U^sh4T_oN4p3{{*_ zPFu6>v8{NPJ&XpRmp}F1U;^d3x!$%3*|)Ky3X@$rwm(*?B#XuXo&Omr>$iR=ST7ZM zF#_vIN?rjXji_moSuRm>)6A?P#bH$1_6aWJd${Fd@;n{J12m1nlsRP-%;QPCxt(`6 zz_}aF!Af1l!%d8`nnfzkgg|4S64pC}DnURW+{ePz)-1;Qg{Y8Nrdyw~$-11Jm?%Qa z9$RHtrzP?BLpx5&Ll@Qt@_9lv)<*s7nhv|&3aPwpQ~GGBFqDDjZXEVfkfOmK7dV`n zSGCe%O`cQTlcrG^uK@4RnH+ws@(%CX<~!6@=1SmTbqt&e=Mx6`l#G1_BCw0YOQEp3 z;qEeW=%Ued6T$PryQm0L;q$2?S(maiJ29+In{-rG))Kv17ov7bJp}#HIeOWV^sg$htaR7oDHFaz&FzG7 z^JB}Xr*6v89}+=xzG|pyq%bHod0>@**Dp*(;+xs3zh*kUrbB2!sx&(KzLv+m9Wd)2 z(o?5IH9KmV<7_^{s$$US@$pNvA~9*3Ag8(te1-!f|1Or4L+&)qxXu^bvkD=POkv9C8fw^Dyz^iP2Evp|R8MR4fa> zWz8BqR@?tR<2EWGlhCq=B!PCyQXc?xqvYEIR@D^yw{+Q3>9J`;_64m{Dx!=53-3pK z;by8xkf5A=^7}G|^KZ8kI;VUni1uz2n#Obu_18miG4Y9GL0VVJKIY*P9EF-_EqYGc zFp=gw<>p0Hg8^usJUib*8Xeax%g18SL}`ecsby0Xno8m?1R_O8z2HPwJ^k9Q!AkOU zAyAW;L@u|1zR^HvnXN!{Yp1aWo`OziD}Ty(VNZxGDn8JByh#Y$xQbuO26HxKomU;h z>{l0r+pDW6VqQu%t(sJuy?0{>{MI5ZBU>z^)QbC3_CYD`>EYz8=sp^s?fl-3W&e8_ z<_JjoR<1)6&`_PStQvnXxPgc2jEmcXl2pz#&X<`)nUC;Qc$O#M@Kbhugv z9)_HS$N1E|keJ1Dsj615Te%dWSh8o|9Zl(-{If=l!(Usg(PAiaB0=Yca&+=?L$~2~ zaIk?yRtvFCiT&2r{uU0z@x~VcTV_5<#34m0EvJ-W-mUrj>n>P+RemI+S6z)lljRs6 zbZHaU{D|PR^ZadK(SkUc&c!&%q+0jmP~?^3p#Zx$Bh5_Dp2i#5(3#%?hF~fxx{u3U z%lD_&A1l!!<@<~n!KA@+DUyZ38YCLcwQAM)-Kg?Br#Ezf1{^qnERF9%Q*f$Bqb9(s zq)s{~+FSw32=nZ3(n|`J5q$|;enP)Lz_bqk2JOCg+XU97BMX*=b74c%+kpP2M}~!~ za)0>BlA^4Qm_EiX8mpj``_EiC!QDTXg?wgRm>T`hCjKh#G&mIL%GCL)$ zVmZ!DKO@o&%0rHcM_f{c2Xdyo)iyaz&?}eSbJe42@WdI%_!Uw{5TOZV5rUbz8s$9P zJ6R^?NheF@L^7O$BfkZzA9+3)fqHh!b3S#vbglWi!Twclt0Q~Lg$1O`k<&kwVm)eK zghMEW6|I=OesceHJII>xD<8!60s3c_V{t?ITm0O;PDUKq{!$OO$AA)8H+yb9$bsP> zdFvq=FARaV3^w`dU*Hf8g*aqVecyx=9yBg;E_x{06J(Vp z2btV@xP{@_I(yDKtt;ZSd>qh?>FVR=)DaX%Pc44nD2Ko<45MUH?~cUwmdVe`cuc$p zNwq>qxctp4W2(#>+oQ8oPrmx(||kmUVm_VDpho1?}AX_z^Ny&s_I6pT!c2dzjN^e-|rIAdAd=J~%DMh4^SVM2Op(P^Egf z(Us!DR65D)^!^>(zs>o3*H8>b`5PYWthwmrJIkCv^_~Ano_?^&M24v~EsXB3tF#?M zh0c?b{3JSw(NH8go<)al{I?(dix&$A+s^uxQzGeDk)niGT1;nu|Hmz>Cue!i+J-Xr9By~L znz9?R-mroKth&7VuibWltpIeNq+cMKo1T^#>f_2mlMsmqXdC`$mbm0$9WN@NH%8eP ziEqkdW``e>)ko+*Z?@~Xbgxy2FOOR|UikwTgBDxn5XZDf-~P={yjEd>W(W48?!7tt za#q_*A!IPXo*z_}JHh#CO>oN{M8`w@;C{FLHnq(YC?L&Cy7(N>R5@|!plD_^pb#rq zJEkdaS@E}`~>zJ^H z6S1xaTV-;jvhJQQ(oJi}HCDk_24-X@)VMo;qIyNDy9Cit_Txz;%pog;odadpohGtKoGnqww4GKV5^(SPh(X@ zEUbz}<`4f=@ zjKR?)BEZZNfZ~s1$X}`)Q=iMEqno9`0(OC77Rkp|;viC&v+DE(|2LqEVElW>T7-_E z76Wq@0=LCgzZqstMo9rUP9D3ab&ByJ zdWfW^-oJO`|dLo!6(05Xpe~vM1oHEWgcqph~qZHOr|phWIep@KZeI!ZUY! zv+`Uw31CV=ebbFdlM+M1Pp%V&2pY7KL8n>6Kn6J#Gx$&4hG~Az^>C=Uj1wd%%q%Tg39DIv3!iS4B^5a zw(yV3&^f%&XEZ>iL)~j~C2pvX@}@SFh*mu8a}+bz>PJ&6RV&K5fS6#IQRSKHKt7z@ zSh-#sT&>&nrzWT2H4w&BJ));)8w=r0GIucM?X5q_WF@pfzSjKSDZDVEuSpQK26jUiX0b>}x*B zzkH)zRN>b)u&TUBG@_g9TrO~(salM~dyqe+!`C_a6^hSmG%s#gwA5#o0#4?MzE|N? zJ!{!mUfHx}7!jo8_93|oKEUo6&R5TMZW209QK~_1{U#D$`opFIhi2`QcN$H-9*0w+ zm!D9E_Sbmg6GVf>8SWZ2_3{uwv)<%QOfr1^IYtca?i{DPRjQ;a#k-Mrq|cuN9Ds8f z;p_Lx2aY*7B1uoBP9ScA-;vStZzDdgfi8-rjpRF>brF;GW+5(U+;IJ4DPd}Ovm)yH zv-4C8y253XZ|9t(y8B4FzC`v`q{*H7Bx)^Us2;rKgTSKcE=ogIeD0OO{u?PEzN$R5 zhz`w~A2(*?lyQM~R8^FV;789)tSUvL4yp*BSXhBATYYJs@{uijn~K1X7DhR1PJDkj z8Tu%5tRuItpp&=|WfdEI&+1et)|abr&*snW-BnTvGwFOF^MXE@&4d05@$*Ktd%`M; z3m*B*L$-yYpEZue45DZbOBiaSTyx>(=+oSXeJ!Ss$JxFOm*A9rzHld|@Cw;IBj3RJ zLTuRqBN@F;(+p}87^ZrBVXz4Nu`BvR7ShYjGzE~!_Q|4D4vv@CeCV~v} zfSNgWft$t)U!M+bJZ|m~8_TT(V)J-M7}*VS;GCg@kh% zdUm=T=MtPzN^it1zyD4A(KtvY_jd!!KF6Cgc7gM=B4h6i1TgSX;kq_Mvt?{m19A}- zFJd-&@;jYr>`Z@M!7t(?e6?%^S{=w$cc76ecXXKgeyihToy97-XPl1P%Ni@c9a%Vw zxzI!cMp@sGz#0ou4-y?=vv?R6OgJ~0rbaUZQmCJqf6-xWOHIkwkMltKDQ=i9=qs5o zqg!agA?PiNq#jJ_%oIqO;NJ?Cm{ zQ4?{b7{-_#nRC)S{xL7Vl~H&Nf6#PQI4F5{w~m@!^}c^dl~nBv8TX|c<~q}F@Xw&) z)%nIvXVZM1{RM-_UuK@O39PAYpD^4n#AXVG7!7dtlB;3O9kDL{!7mrt{Kctg$i8g( z&(Ghclg4ZNT|Dw+yJF#3k%vpC`!{yz6kfIBixos=Vis&<05aT27gYAC3;xMwP9yR$ zy4SZWtn1G(S)yL~m{+zBd?Iu`0`?NDz6&w5NhjnD-Z%Ub33s$m#xdBed(RUd;+hu} zD^`*3MiT&CzzMZkZ(KG<4}j`phYA8l1cXHBdCBxOziyXvsIOx66busFTD_Pc&LIrf z4)6cS-78V9porv`H|(puqF`GU;ayq%_%4Z>Sv-|Q)uBz>BTTAmv~s00uA0|daBfE; zMK(i-9Y?NO#9%)@FcAh;HRJbf8UQ+-GGvCQ;AnP*#E{rE{+y`VmDWZ}c! z7p4Sr{t3J)^A@%$!HvoOe@KKMC4bmzQiyH9B-ZXrNhf`~$2Yxv*EEJYo!Otnco{AvAL|BdMbNkivVXZ^ zQzgH^9psr$g!bm1T7oJ;J`8 zxFxbdHJTYbQ5t;jCg-q2pSAz-CtQD^Vjw-Wn00zhyL|Uv>I7WriYQ1qxg6b&u+0%m zPfy%!o!3N=A-h^UGY?8}8qxV~R&6*i!;EgZU2|HNn*bF!Sf*2C4^;m>KDDgn-prZ? zX_B)@s|tj(#EA&}-bYB@o6Z{23ek$!P=ym{Wcv&r*#G@g*G;2?jyB-K&4kf08bd%H>e{3Pj(i_z+C_yI0*a^ z5S!s1Rm7t}Nu5q)s3yExH**Bo>;19d7f>7HdX&eRCWO?e6u z?HaS!xCnGz-2vgXZsD=iysZazQa{B_Nm^uky$Rd1->I|nW z|A(MenSEtxHagU=k2(mkClxcA=3Tf6aatK!4IE`LGuzg(<=E1xTp_3H455DP%Bout zgfFz%j<)Asy&368ZdgLazso}h34%&c2}vMz?8G&Sk1FzJ|AuQTWTcnZD9x3uF(NpX zdi&XO9uFjdOq6f`2Sc*|h2SiGn6V#pe6<{_jR1^|5(2rNMZA|yOM9wp_JxPe`6-Mc zZc4b!PL890ggfY&?_jOmX;g5;S|n&AfNZ^p9I;wuJ^xdgYUL!x<`75N^DKmdhh|HM z`vFjV)TVky(t=N^s^SH575W)zq|P4d$_(6~@tVM3+&)2X#QWTmBXx}vFJ_*sF7T62 z6?v1>uQgGURJN{(d*=cgil(ICOz57cm4y8>1fSv?CKt_<%x@a_q8wXK#%z8{w{7Kr zQ^W=7kc@lbI*$hLD#cjU1uNN2^`f>YLF zkdyf9Rd1K<*J72sIc2AN1Qakb8Tr;sujn`iap0iDow{4pBM7XJGJ%U)Ev#qCB}GdI z5TGOQ~xqvW09tlM3bmq)Eww5w$J45?0eb6}FASc*$`+2>PCYxr4|8L{~EiGaB zXve9mliZvRF701dYuowMxmcf1W+>Cwh7LX2yNu-krIP`8d_=jg!-yBi=P_f_*o(+& z@%C|1QhYh8W24z+grJZ$X6e|T&Y9^!HUxEBQ%nl0+2(k~p#kJ>WxKK!%%~{wPOeUx z3gGi>doekHgwtoBNUxFks;Ax%qk)A2WA|g)Q&N8fY#k3yx(Q%WRxUO@~VLM#a)9IIDcP z4Ra7bHI_(n5v;&81b+W%vYR3jFB}%q0ikapNnv>OrwSdUb#IiwI$hmu*g;O8agFoD zyN3a9??)tVc~&cjtW?rPA+u?GX<2(oB&a>j#Gywp_^rWf%9uT!a>m&w8h4q0xdqRR zIkzUF7ky6?ee9LA3r5+0V4T*rydP6uvrRYAE}lWhSaj6FIaUw`(~=HB(~wa>b5FAF ze_ZU$x~MGd$Y%wG-(Q07zSyo}jKZqv#lgN^I+Y3yZ#^^zhDuB({h!b>p*v8@f&HM* z8Bdy{VkHB4F)%Q%qIMkmh6i@K!}XJ_spAKGnFqAj$jUVq@O8+&StH<(rg_yGWqfqp^P!WI(9wy=wC_LA$-@p zwRH#286>elZO|kJJI|97N>6UBeAT-odf9{5%gFmhpmaVnxzpB)kY`Bwy@_u%H~doC zq%#=r%htmV1)}wKP6T3It-tKQV3~BdR0Kt6)^;Qgp)6ME0V#Fw=uYlCP63C=m0oAF zdUOWtWcKOzTJ)nLmRY~S?cJ9QnK;dST1fRDPX{|n~vAELca~?aBbA z^g?)fwONhXPHCpTbSCe`7z*szeL16;JIaAw-`K}2??P`-F(=@hTA;lg`pGAStCiVx*wSnCpC5Hz*tKPcApP zHsAY>rLTc9Ag18es!upEs*9uZzQbLq2evyFWN|&^46u>?Ar34@Ab0TJ^1uv@Re?-Y5jdmaenR50np7a zr=%!^d&auA|6eCdnOAW%D9 zW3ZvOC}SluUF>LaJCfn{I(~Z89;TDh)GQleb8I50-(yF|nUiOm^?^}t$~nAv>M?h3 zV*V42PfV=#w`t;dPJZImJ!6KQ%{0kJPp1j=pukBIPdLerekd70dO)*rcqE!5|*2*2uPlZ zz~bFyi=?U0aA^UXuAy5ukEj4RDvaO%-`Haw(t5jhJL^WqGZcCVAyRZzBslZ%2bbac^(b8i%m(7%|@Jam<-i zpn@s?zi~x|A=S9_vM1PZeQDS7xVgpB&w}#iX(}M4kiq*YGOLl9^ug&DD~h3xEZ``o z=y1X^0EN&DkTW$Wi*?$I#PXQt1p}Z3?a@*F(Fx6GOP)w>C*&3}7ZZlny)AybmrsJm z%YQr^opLVM_7zM?#@$Gg@l;wi=*LVeXir=ldZc>&LvxpXW`Gr*25dfiwM!t44Ts5_G1)41 zW`*^)KFMjO&#sbs853^qIw@5gUEBa!DC{`{=CK6232{on8`yso!^zM9CQ zq}h|)AcAc|!`4Ep(gJbh&sJA$t!Uz56Gn9|K8-8Z4@p|C)DN4l&zrr2yCTAg>RW0% z@kAwsF#ky1mnN8KfD`%0{IGX7Nz{~_R#uZbgf8$dDdKYp{h6^%^W`44g&qgaiqOC4Fc7R0h{S*oEN7X{3c!g zi)=<=Vo-LT6l)Am{Z;(BEBQjVqhn4&vg;$gJ6(FK3w|rG|7LOKX$MqJOBJA~p}gxD z=_CuC)z}q2B0I)Z&}lbU&b;;P4Zpq%e!UY_FVSlkh_afU@+21TVb?7BKJs)Bev*FB zwvGt_!w9PPW?}2d<=-Y6I@k3aN8~?BCQ)v2pGze}Lqixs(l|86HgDZF5166tv}vi9 zEAq#0sP*N}n>%4d_TyxDE<4WS-q6LAYCfnDQGQTR7!GsILR6t`mLEpkwj&C;pu)r- zlUep{hRGl}E^jjt(|4Xq|9;n{H+zjMyY$_<^fCTy+h_uS;y$k;N}cHEOHhpFLrJ?+ z*$+G;ZU5C6_KqtjMZiFr&l^K-$~D@Y@kB?k4;3sak4tx64-vqMKW|rF&E^3YTn1eR z^zNPbc%vAs*IBlMyf4-|H=oxx)n#4;Wy1`?d{BXtH_;#F^Tqv{>akgpiB)h98~8+j zfzd{HCTvA!G2;(ae*W1!d#3X>eJLu>#1QA1QgotoOyCV-`@jbXf zdSvlF2-bW$MCV<^MfovZy(zk6aB0pCoqY&HtXg#{@?TP<=utDd7Qa*qY0|8HYE`?r zrVX1)R}|hKzZ!@{%M9fI<|rWI85zmQ;fu>aVDwM#3}3#~JbjeA#A?=b^TM`Muk3xz zb^9JQ>EMK7ql^8W;;FSVBKo8tb|^ZXQx=wohcO(!Taqpl@9J3qR025hrdLilo^7+m zNs*{WfiD73z#TdwwtlF?BvZ;tH9buC+rfZuKew69hE<3dd(LQ_Y)UJXF|;pk<4V=i=oTUYeEh6`=d~3ou3C#|asSRj*4(eP^XLQ^+=sql)&)aMM z8guHkL4nxCwxRcXh6!m+nAG0a<+@th3Ld?yz)&PsmSJ@?%+7*(q$wy(*1`5XNxNRZ z#iY@-5X}s}f-ht*C)I~mgClWy5bNfDhT0pPp06uhsmelWkt5^H8Ju=0itu1wU~DoJ z;C;poHWNv$2Pm09n#;@?9zr6H82FsL3zQ0cz++5WX~SpiyAI%$C{TmYQ;mIgSV+D` zE0gtx4lI^l%$H>oL9 zw?wIS*MQ$Vst3Yd)(M`oVfHSPVq_KUkz7`S=~m6yr5mAXUdsX^sDHck%*R6)^;)#} zAva-J?HtE+26PI9q7x{|t|;t(e<6!V_bD7u`fe$}g0VqcN$bz^*R#vKkr|biJ{4uV z-Kpd^av2N@I_Ab7S*UuT?W0wgcrd%A@DI3=GV)+PwKQ?xL0t^@MoO{@A(eY>St*Ux zK^}|_W)gXj{V(jwg8CT=*pCP>qvjQo0qwtp-P|sI;W%z&($-B@d_G-db)+du6`#Ly zj#OlZPrAjNK$ezNW#=UBb!6R2?KE-Bb;K>dp!RJ&vAM0_fscxOvX&v*%$SMM@nZfS znm{i&CL5w^*qb6o>g)KnBWvH*r#9p)FN+F}q;jv^2hI#!^P7P|-9QFl?rb7Zi56g; z2B4}S&wbYee}thSvmy)TKD+*Cojffn2&0UWjkz}=@h&*~yLd{IhzX-b+u?oFjQC*?ljo zGIYdkQSfEeu)1NIyln<3`RNChKkUQP>a?X)I7VV77bk_7P;rltm!hZQUs{D4w0PnSbqEw7lQv=TI&Kc z#AAB?%;DQn^l<0&V&$V!+ut1fSrvWDO~@S~qln#7lFC)umX<<71zq~nQSCkQo&dOe zThZG%&w2BZZ66i}h2e+6QL04QToG>H`N6%?OL@ zDZwvxdNCCC;&?&}g`0Y^ko_Q~e4>)nz92IKuCymzcq+E+?6Y~w#ZNf$&A`%la$-b$ zPWQz^CvbI2MPsRNkvOp~0gXl4;r7@GoCPUgSo?(F*-9+A!v z0JWR|+~$AZHl53G@v57+M%<`(R~?N=8v6g|dw!>nd0EiggRI1G z9XXc)oK9EVGc{HiX88u#GX?35c1pPH45}4;%!ibup9KzY28;g*3V2o3y4C)~z_+@` zZg&QvbH7!u=#5Y#?sAkn2w#}3#d^e3O=TPmy!y#$_g8j06%CA?mx6WqXsGr=moEG5 zuZy1nF1>m&=b~^J!{^~_IzWQlvQoYr%mxTiLdgZK7^79J8{WNTb~j*F=<5zn3#Zh( z2YEW56|}5iuPv%2(GWU;b^lkOQ zNZY*+lOKoWlSnIaQ$>w$M`3%RiZ!eb26ne_MSw$&s7`QKhxg#F70hBD);3IYID$jk z5yVCRoQ8xOf*Z2fSYv~Q2X;?rHA;3KWkkTqv1+;srfXd*|A0M%;Ls?y*sPXBN2NN|IPFuw|*7~ zk#v5uHShOj-V=Fnep+t0XZ`Y}+|F`&SMkf9VqiI}r-Cv&kiSg&Kx`I!;`Q?6H>QiLN}YJc!})W-GD14ate)DSSswkD=x;FNFX5kYhq{H= z_yKVKW=6P5_tMmY3>+P;nXusFaV$i9Zs$h0=kBJNj@n~_OGk5AD@c>J^X^A3=YxE` zw&TNFzsTSsX5DCh@4S&KVC$`d=mmw9^fR!LIm9Y|4N115MUP}{=49^cOKZaBaSfaI zq0ERx&Q!0CNb9+lJq#@=`4Bmo)v8=XYCLN?^k`x1ys{i#sM|IEEd?NN0xfhVJbBlZ z5|zzK__DtFT)U*!a{Ci8em7 z@{dV{(AL6@9ZjT&8s<2Pb#nq1X6ZgRUCL3y}xRuLx2N+Bz#&&OswDjjw#zAwsR_~Q*C@W)tI=&%ItkNGhLylFA`zi1t@FBH zzkCmV6tal$uBFZ4>2jlSV)MnZaS-XS97rj3=dieTX+8U&^-=rZO~O9{KUU)3)$8PSW;Q!$Fb4Gzdct1Q(-uH@PGqDC;#l|5~<8-j0G~sZarPg=tnV zC4ZPR(zQ%U5IbXrcWw~K6Vp-0(xxxQuUbTJ>7VWNyL%!J)(wk@uFOk{2jB_433C|c zJig3f$P35egDzB@PM3vA5i%~<}k>9lnE1cPs1i5Y-~

@@@%Nok-&>|^LoF;=oGQafGEvk)&JMtC zKi*|%<{btEbFlzDbxA6N9cW!fb<4l7C>%R!RO2<7BT+c;cFR{|H0ecx$+0&3V+ic; zUrRi(x2TOj@CKl$PI=n=8kUM_jU}w1{i^AN<%hH`gamf{CrwW_sfyJ`< zZoW=ja*9h*GQA*}AT{#ele&bIv}}V}iaRh~u!kw=tW~iYRA_Dn-4(W`i;QxoJ8Gg{ zy`g2B$_3m7nGsti;D$DmeU_n)wL_#IL}wuLl`F{J5+7i>p?|E5_odqfYAZILb#rn7 z)!Ti=-KNE4k~Wahzs?>(e0eP;vLE;q)LrqmV8AS7HG3PC=JzfY(aW<#jG%b)iF0Wz z{}e{+UXDXLc4_4f7Uyp{SFLnO6Cn83h{<=lO>Myu{F!uoBGnrBeE24o9VpWi2qmM7 z@}v{nY@(5;sL5zt{sX&_4)kL^TDUrD)GQRCbRfh~BN}(@Vib3HqY68+N2@A`swEm9 zO>RhQgz-XY7_$M-!c{Soid9QS?U+Y`-lsojI5{&BhTsN`^bu3`R%pxk4Ry{^8A;n2 zJyKnar1e>IGoe?!{k@QMLKOEy z^^mb*mV?ouko-n!=U&CoxwNeq42I}B#m8NiAkGDZ-~Fk z=F{`P#elUa^Mij?r_YzceTTY3;GERDl8Lk*F!J3W%I|H#MUq|9k*X@shp?I9=f1~v z>vCllryQpBv}60?Xh-~vu!k5mD+g)BvKaI75b|Qu2J_i7PzVga@cjGz$BaK#S2`f& z3i$GC*r->F*$BvTrZD%um{u8Cl%(kB`S#=ME!BM})m1ke56_P`6|rZ^3Js^JBqG6m z#Q1WalsdhYtn~Yjf8RF#YYejYL5xWdKZXgN9a*u@CG`~XKEk0 zZ6g-Wpo9RLZ?~uw{{pmW5W8}mric|k_VgSGG^x?Ig>Z5_-$aZdYNIfMp8^q_Q8)MiMMvu#xSpC2as!e{f?I4Bp*md@x4XVi((1%pX%a zovP(KMUuRiZWvc;mmjn4=LBkaoAcjwby7nTtXK*TP^mldxW!bq!)Q3N61P0r{U^s9 z6{ijK5y~RcKaH`KNN%^nvL;q(d)`e_J9SqV3 zR1%@(twYm|?nalr$MNf+zbDBdB<);}$mC4G>n#_HN0U6`9G5o1y&|f|CaN@{*k;Y5 zGq-t~yaaZn2Q!(#_-KD@q3s?Q*qgHlpHSgANj zmvnFg;Vukbo_@XdtWBES2*RH^4`k$W`!BeOrG!(Ntpa?MxCUdt1$*}Y zSx(bC#EgA5_nXVxNZ%I~58IQsx~aJQ^}P1$U$bj_+h8I@+?^JuQHqo$L>2<;>2o$L zPLzRf@+u=oO)Q14U8&y53Vz7?Glg$Ldcb}iM$`jAu-bir`78UVrrDjsU=D5@9)I!H z95vwu(Y9asu!4)fbCS<PgWbF)-Cb_LYJD zc9m7dlGCj$+%YzFS(!kiG+H}7_)NRf6H0F#a>8Dr&A`8~3|=>dGV$pO!o#WgT~{lX zsO6dR<@}ZZa*=(uX$_*HRJ9BX(0ugjtxd0h*Ki^*p}4@$wxspsZBm*gKK)B9lt+Pc zeZ7+U_mEBFvmG*Y42QY)UOeaYipLi#zXmzbn-!YB1pkP9mJl*>qrrhGI~(UpJCUxE zZwS$ueH#cPiE7^MHDd*C!DGtq2@hxtr&hYM&ThV4B;N{i{Lg8>KCT^VfvLUJcLsr_ zJ?Cy8y;ia8gaTA5a-zS`i)PSPs3!RYNBRg@ck;R@UxaP^nefZikuiFC%ele^14>_J zM`;qnDgC-HtFlCqRsK|O7&{~f#9iX-DwR}uIUe436~8-I=7gcX z{F&HA|H+iZt{-)jpX4h_a4N}If1g`IfAjKx`a9M@{-JZ9uv_~x%TOHoPzlK0+TFnf zz5mPJwmq@W?2?)%k|`$cew`Ex zRU%}wq$WU2;y>x;f9)h)%FdCmgc-kqioQdf%F^2CqgJ96nn2XZPNsiX#dd%FO%GOR z6^Iz*BG|w|{^@sHclH~%bOa1nMd?ds3Gc&-%DCjtJqtF>mW!vYR>Aol0E1n{_2pi8 zsUq0Ni2l$hQ3xf+bKU(f6jtIb2kJ@??L|zTwDe-(LdCSX8E5su=q+{pzbz6~!211e z%G?>WC!vUh6~sL**Bsl*kfEeT5mZK5Nph%XY=51)aq)c{oMBrlNWdkMQDL>Wc3i-( z!b^ZlYxy7tp5^^F{v~dp==)z0nWKcnI#UH^qWHcM+Syudf!DXY*KGUJRQ`7^fdEdOU9U8ql!U5z8v(MFGY_Oj&< z=AG&+jE4{NRm=uGzttj(TSY>fL^t7Y4swmGa5R-dXat!-*0H>tq_IEcSIUPjn?L)?CmVhBLBW>Rs|^vW&agEL3w3Lhuz2pbL^dZd!ouVetrVeYgD|4#m@D}KB>Q3l7vu~%hlr4&?&mu}-O4$cg<`?FJMMZK|fVEixR>VW- zy9ji#K+8}REI)0s`y@(|Py%lG9BD@S9HI;_KM;Fa?<93gHQfp1Z@?vdq!WH-`@Y#= zzlOSZ4}5~Y75`lJBJD?q66U5`f;o5vzVaPo_r`F=6^)_>pr2E*Ig_ht1lRNUf$ar; zvm#-reF2<~{n^l@NSjyLB}M?zG+F2o8M~BhXMzr|1RlEJi`y}?nW6Q*!? zQGa*wJ0oP`If6n+CJHGo=R4UHk3*?Hy=XN#Qc8?8$ffOw$D}G|79-6(54HAGn_!@* zG#+jLUV|_;P!eul47$9O-0&$698sR4%`asoneCQmQzh$6hbzH_`LxOIAX}Q1c~vc2 zo%K2QcvfsGeW~3ixfAv69%qgae&6OUy^|eOext3y9-AIA&VG((g?YW)`)mD%S5LQ~ zHRRljV?3tRg3%(obb=g}Wqb;3X^QmQwY?Sqh8xu(diF)t;x383c3dc>bxQLQFfPx6 z>0iloC%le=j8sec`z#roomyGBTygbH-141NVw}Im$Rzqc!GQs>Y}>K`n_v~;+Yb*# zu|{rk!(x*xGxMLmc*b4xu{Uh|$I(*MSt-NPG(HP1U#4@$s-vY=i37xyZN(QG^XwiK zSoVegK`Yzf8?IF~Mllw6Z=6V)gW-b5zR?9K;C6J79TdWoN;5K3cC4>BDnXR9Pim`B z(xO)HtA?x3I$H2n3yuA@G1i=4rMlCA!9InzRHAsvTFd=@aaQB1*)Ou9xj%)1hW;GN zU1USQ#LQ1}6_z8H1T-k&H}c0|D-y{pDX{T~z<8{$WqI?JF7W5x6?5(XrxTm5EeNN? z+?pB0KM_UQN+U%s9>$ycj@ZtOxc@^}5t5p;Pl~ZnWyz<0@)ot<8%KSI90)zf)`Q45 zqyU00-sIal8SF$kl#tfd1#fLKsRa0sWCWXmE zeMwRg8O*u2$8kz-&1k8&D3Bov(nIsyoPd1YuW#A!U6Nl{@89)`XMHWAA@fB*mPjZz z%rrZWo9V!-qAp4wj$;hVp}`@uo0DC%zlHVZ=}eYCF|46$nk2N!NoET9X*h#zS7)Q> zwqlYSUy(NkyD~jgzgX=tQa5aqMP|SWV5J2Hipfv-;*wngTG@P%WU-v0xa%f?KXTGQ zZ9nT1+_?RkQvWQtV2!2*2kPFX8!En8cWQ0OFTJ?RP-08bcZ79rxjd9)845hp`1h3H zes_;M*0D1rGJ9U(X4`@o>gbtlyN1X7D?35Nd;v5?^crC@h6AzXsRarBXbk}CgpPG0 z#6P243mRTbQtaDZfJg@3E+s@JKc>qJI$e`M$6uwnGX3hrz6jug+D&{iO~42>E~D=`#b%FS z1DxbiS~|gz0ANN8XxivJGYKG^$do9s1h9%gLU2U_;3nag!7U$azc}?efm8%w>93X~ zg&V6Nn_C;;DlE#gM0+qJwP5UVi3t(lG>&&*X(=2#$1;dG$+mDjWfKql^iu9g$NGgU zL`_Wiqibd}+b>1Wg)v%JL4`=Ha-0L_h}5hrQ|0bWuah??5)}_!3h`qtmIcI~Z{F-T{wRgn0D%DiP*_m4~1 z5>qpz)-~f2`a7~iB_@=Qgk)2=Z!$RzmxI$WrSM5TLTE4ymkrX$Va?HLF zA(0aYINW)Ma@mA}%x9qvVBeLW%P0pdmp3H|9n>jUV;Yk)2%PsA4CW!`o~T(Z$RX9h z)f~DO9>I$kgnlj=WU3}r%Qe^0Y`J^yMYF^F6M^x?zL$SP&8)q|Ge}swI;6st2BW%5 z{O&UJqzW8&&!b}^3t5FzAAi`#Nx5Q>H&+bdXw!m%!k3V!62ih3ec>3-D)LcCaEX@C zd8h>U?o2^D<2A5El5K10Sk!_m$+o`(Z%T;TOf6tkdP_*3-vo>vrOlK!8{*79aR5U57-e`p8c6_eazDCkf`XNKk0-E)HWcFOKtDAg`Y6Z)`QHOQU{Kgi zd+9M?2DvpcXySX|1Z+}*ofWdjLgFwx{T6E#o8dv&Klyxtn<*DgoMi#^h0_MNSrm!~ z7^rIq0_MhDgtm1UJ?HUB&9oNnZX{$js1cFZZep;-G-B#u|IX#`0E{eQh0S6V<#b!eASW z0LqY&Ff_}~Yn71R##O@svBPjOwIx$jo09?_+jQBh+SE)@_Fngu_0#E&)`wXqZ$y)9WpaAO0E4t;-|vftncx44~ynbh(ptW?W?3t{t* zaRJ_R=>A~-6v-4rIawzPS`W;L3X@MH|5a=L>n1sdF4_jZSCOtL(vHc%C^y3je&)g> zw*TzIGNS+SQ6{Y5{-XQRr~C!RFYg4gX7FV^(=U}hE0SZua)F(5*&hpDejU)6+F9|U zC_26O9vlk}Y+5*W{(n@RRaYBafJJeF6?YBp4uv8g?$F}y?(XgmA-KC2cP&oP;toYy zthm#b32W9o%rD@93(39boV|s%Ryv2|Iz|7D!-x+^Yw+VSZbU*ZwLi23(>dlupa&2Q zc&j|4GcWhk$s;0T*Gdm?SlI;6x)&U<{4FcK6IXygP5n3&4?{er#r&_sNpgNxSCqjQQ== zZ+P^>X1)H&Y!^}t;L4%ji@JZ)XictKgkhEJxa;6MdYNgP#Q3;nLd7cf)-wE!Z^*2K zn%_cZ(pN&5v}d>sxDtsJe-t%ZMCw;=x{N4h-usp6+q#>C^tpNwsDJLO7DRky%boZZ zS_uB$u|MjKMl|Lhav35@=Dab(FR2%ir7kCcU9pAgve@}ab@Z^F&@+G=?d+(O&Aiu1zY30tE01ZWI_e5GS<9f zxsfcj8CI7ODDodZg3*c@I%Uus>Q$^5d}0&=Pv{^cMq#ks z{njth)jKgJdtwEBrH@)E6FiJ;Ug{kh2Qj^iLn1e)NdtquUELyE{@!ZXjPn8^FSFmK z&4il1%S%>(*lP6oW^w71PsXsn?3^6<{>Gw(x%!0osZl|b=2bMZs-7yU6IAv3B8^wksZQCWPRUl&d zRNQS+7v`|y_%;@_@g+JcDg!Sg+6*iL`V70qh%-FEN~9v8-vt(X0ktG{F7_R+PcGKl z4(?yIdHw`#gote-)8vrrh%+3qj{|ucySLlHrY`v=Wpe`SG;^c051l&@ZzL1%4~-15 zm7Ul1A)FHxM^V}Hc$&SevIhbZ{!OPLv#t^jire;sNklgS*HU9XZ8+N4{4O%6}q(`nmiN0Wb=i%zd_4*wXPP_NLa`RmSMUrNb^dZ$W)O@Q~2fx0u@5a+UHgu zWZqDQMmPyf)EN^G6#*CN3+0>xcP_>DD@{Dh$FPjsu%5wbz9yq1E$ApCS@ICM0UL0O zdW*10u^>wJSQ_=0v!O_^*dw{2-A_UpT%1q|D;t|wMm~Re{UstU-KD-L}XBp3h>kb+N+BqNql1OHcD0QrBZjh!`E*8*4VlQi4tgiVV(gu7Y) z`Isu&5p};AsuE`PtWnGdn}{JmqC17l+tDVwLMCn?v@@J0Ar%%1&AmugNT~pA96&4> zAxR38MphOI(wIuNIfu<_GY5_Z&4R8Ym0>m8T<@}8p;wr^x$vSIHELnb&1c0j$JiS5XH#Sy4hK+JN-#yHhZLg!r{7lW%X0yfWsWix+w4 z1_4%1Vgzq1DSE^^`7ppvsh-lZ>(LTob3;WL3#%|e_;sKpy||TD?j8u8(;fQH;j4=k zHK?S5C5$-DwzFozTBcfzXbBSf5ALWIpo)TI7#B!d<{ zZ}<*cSz4;z;S6kBNWW&YF3AcNI9#A0YAS))DO}2l|Hm2P)dq?Kigm*HR8t8fGbuzq zQGLM;a~(<-yE}~GFR!!roD$5?V&RBk`(Q@{351JeVFTb)MQNLmIEBz}y1+tg+f5vn zc(cVF+Ec1y!oj>&EIuitxzqEV$SRWW-?$e!CmD9lV-u)Omg}%>0bepw)bAANE{Y(l zsl0pGax9E=6*1Up-XM8-rxK7nl^IT&17guvChSd$5)Ug+9Ps7VdD=F>`PVIVC`%A4 zo;VITqO5woNIR4guF+$H0^z2}=sX87nG1uM&0UfN(}){3YKWj)pm}If$Uo%tuNp#bc}|FZSq$IOk&5yGCUra|z3U4jKAk z-(!c_#LxV5pfv(~4C;SkGwExNp^xs<%pZI!`LS4yA4u?&B{4bZ)ss%Byjbb2%@rc$ zElB`WIzZ$^BOU~Y{G6*&r}9WT`luWw#pV-Jwk!==tTP9M2C%~AAc9IUOzsA-K8Uv^kW1|{&`e=?sD29T z&4nFzTpa>z4A0k$k~Y19?9C3`*-=x05V*Iaq*z6}W7Ob$U?+U6Sj-sNc1K6a&+W|S z^|K_Pbz+0C-3j!M_&3>c+kGyq6p^98RI!wi(X46x^;imV9C`sJX<{xTgmmGsc|s-5Gz-Wzb{KUuVBQd@I(CA0^NSEWv`@7DtObeqiONLGY(q6-`+$M34T0v zq>%Q#o%tAFv%O?Q4Sql$(J1^ccxN+WhoG}+48TpHbkEkYkh@c3rEl^Z z<_9f@0R+@A3{B%Tt?72Gd!;mKY=!5Q491zrsFN9R9d&H`FFV;W_Vyto6TscvDE95|cPp(7tC zRA;yrSYcfhZ<2&Ae5Ukw%qDK-GN0+q88doEFEr&i)U263E&jcoZ@)Gi>S{h-Qx*in z0U|Dl0rWWORg8?>Jd9Q1z1Y%#kK$>2^spFmopKs@7*wUyL}Faxu<7xfSQng}CU|&K zF{mP2wAaQyK|VLVDt(oN#xYbOX_md7ILP}jn z=(&Cwnu&JZwL-6`FhBO!eL24>6&n8+_`)k2u?=-MZ*Hd1dm_<#=}h&!0biGm|7v!C zr)~z|2#>E={Ux7o_HUs}xyzl${zpOGFsaVW$ADM}gGZoo)*DQzVu6@EWC`I2Cn4L+ z`{KQ=-ous8O76SIMYwIS!w7BVzq!8g|6)Y>FZBJlrO<)PVE+YnPVMoZko=zi^`$|r z{43NP2OFw5s+2n1`d#@Q-3RsVJQIVFi4B$s{)V7eik8HpaW(+}n7rD0oHo^G<`wZy zMj=WL4l)TV1)X}_b75I$9*0mbXuc+D#7 zZOM?<`5g9uN&O!1>lQ;1g8>a$6Vrc?k0{Jp?Z2UocGu@G7B}G`i*KJI7K8bqd%@3Y zkC|}C67EF-P-;WZ$&pQxf$!iz7=3C>Etmb`4eO~Thkte+npWvtlg z;r1=Vxmk>cp!?dEt9NYeH_^k^$oW=+-9BhR{A2%hqHcR0mVHu&%IYzEXRQ^^bJ*5$ z&h)<4D{>2w`X?-{?)~vlt9XiOh+NJGl#>xJ1F*Wn9J#$%8IKe zwg9?+c#5%O8Dw)1gl$=loOcM?$1QXjaUkZHk?~)Y0fG^hC%C3{VyCwJ+D0hZPBtXydg6fK4IpF zRX`2O7IIcuJ=-fktde>vha#Q-> zbK%>%^&fl^xO{<1f=aN?{Ze2#w_p0D>iBzmgIS-w*3!?j#t7s7$KBFzqqiH5xBY?1 zm;=L#F;TQj-|zlD)&#gvjDQ*Tl}S>7&mDg;!d--Y1P%X@tZQmf*hw&)FzSsD3Y%Jm zj?5vV3JR@xZHxc5-&x&Gx?=M$%8?D4iC$=~IF^JFUABTc?4-M)=Vcl%Et; zT*5ye84wZvDRYSHQX}Rhk$Pkq?y4$1WSn0#OMJR(MPtFS!(NYv&ZsHXL*DRP6lYVN zNF|?@Z}irY)&!bGn1^o1@DO2I*Cv@r?rQkA+|p>*t(vHu$aj2wk}mz|l8qDN42jpA zRA&k_D^JdSnH(}jI)I;m+bD5s_DFWw)1*Aenh_d;d*J?V#$R*2(3hHGX$-L-3pcqc z@`$`H`oNmI*5`M(66!rLf12<}x8+x|i^sfsjl7w=b4QORbfDkTJ%Rkc? z2?5W25@8)e>RQ+jk|Ir0I#4T2J1T27{6bvK($zw(sM#N=RgRdp(Eufiw+SmNMj%po zxK*@=iId6hS-Dg3N3J+ncC1bl&YlC0*fbGwYVGf6siK)VTduzU5Je7&+Dv!s99cR6 z|NK|j*kpleD~gGM>Lp(6EGJ2&M4E90cAdEcD%wb!YMr(j2~kSJwJ1GcyT12Dqk3$yBgU*PRz<*ICL<}WKnlADiv1L5Qi|rM| zk5R~$251{mk6>Ip!^s<4R^Scc&_CI$X_(GMoQW_bd38nc2+1ho<mEz1Q@U(2nm_3e5u)0{+ynaj-kP2R3~juM zK}l)ui!UNKbFVwl_G^=I_kdUgr!n!ku~EHm*$~{6Ne3VI4oQ(EWW`7d&rlE3;I@`w z9naeMI|-MP_U{9+)+T?W{&Pk457(AK(qOk%M^wbO zM}`vDYCV>@OM8$NGnwipvu2b%ovkcayvm)xpPT!O{nEXk=e!q}d|d^ogA?K$te20q zUfe$cuvw>Q|42wGNzuC3bflDlUoQH7N7T#f{#4&FurkQd$@o*QEGa8>nxbTlIJP*6 zhcA^&{Ay-uFqLEEo*h@Gp=Y*Fw&#T6;GJ{CMcTOS`3N4L603#4*=X``-`b1V2qcMC z(7fas$!sTXP41O!aCa-WmP3AiEdk0n03;JnZD+#BV5QLXo%4m%wX7HHd>QhbD3Qle zP|SWiDRhbwR|I7BH-l0xoLXN?dNc)=7r>y$@@g9@6o`D&v1FDLw|XLj&dA)vG#%Qo z>L+GpfvKV*OI!&h5ks);@7F*ic4Z{!U0N~q7t3HgYPm_QRNc9z51-+>nhUwj)r7|C z3LHP4tmRkm>Aan>X7Zpa@GH|w&WkQ_1^CeCaLV(hfoxhAZhZdti?M5}0lTHWs+k5q7x_7n)Z) zv|LG)GfON_gc`rwgXmKIN(?n~$n6R*wBOzVgEk&ZBaQIbd z0N+MO2`8qT6aLFU-YZzM-Zit>)u*U8Ku7k^g`Q_TCeImf)KC8vFW(iEFzMSws%7=x z-KltYr>eI0%ZLg2dtR+ph1E{mPSW8ogHmjntM#hKuiMrfiIOT;4cwI(NTnA+IOl)L zR@a0*PnVtxPHhk|iwE10_*xS$)?T#&1W<+>=7yPc1ZXt8zA5f#F&J{DDi!&R?l*_$ zUoK}-#|d@QTP;q~3nk1gV>vol&1L5P6q$P3ihVKR{$SgFMLkI}WhGk*DfPYfth1V1 z!n$oa$fAwJb z$tsYL2;XDnybmlDr2lbsR5~|y5b>tgv+4lZVB~k_YZ@g0q;%ooM%2WF*caHw%mLs1 zcX)_b7`aF3H{wP+An8e3eD)heTqNyFOe9CE5}HbS9qicC6knmMXdOICX~w_Ku>d7OMj_=XQJEC;AemxU;X>_i=|m*`j-S zs@O(A`n0Q$Kf|0&mNlF7e6He&zwn8cUoQ7-+-`ZQ_}9YL(i+f zda_vgcQ>xk%#B+0;qAsy~ z8~nG=w1bYc^FowEiE<-R0$5-fOn+FK3wfY2{YGz2Xs=!04c=!68v03|T4tEYDJPKu zy9?E?CI354eyJuU65wX`l0kYVX~I{Eqs=TeJQc62%kHkq6weVgA<&dsBf&t5P&8xb zV1^hbAPZEz!15!|%$G=ZTE}MVP7N^4t%jMA3^kePx&3_XKC9N~9D#_^62Y)(H zX>y|eRyZW2!M(d8mS8F6g{ASSLEQrP4Qe@4;~E-nj&gappHgc+{0OpCGGEF3k#eZ* zcW=;GVeop=05ySP8_AHAZ~mQ9^6<9!s_2L8X>dJY3(QKQ23 zdblIMk(r@Vf|sA_Wi|EMBQS%XhK*l0R;4r&+(wfW0Z=y$^2WySiPV`;$3#yWu654` z7urkLWdF6F`S9rF1(SmQ#taw!Pvn2m#-;G`x2M7hzI`;G+LQh#!m*cf-By*!Ubb3} z;zsa1_OXAE#8;%1x*744-zUxQ|K-FSms0+%GWMbx<9O9IALrV>9EpP@9WMyNAaN^t zOH#txT42R4E9#}T;dQRv!H6jx;DPJvt=aIOO!u6Z`>Lj4DVs7T25no_io7v%ENwrg z2emG)s{~S+%zQ@L$_mn4hJK7Ec#J!aNx-DGIU#&wEt>7*>x>yLRh1#b%?~7JoX}Uy zMr~B}l2}G9lZMggOD!?}*!I+R1)69$Xs|s0v%0U5#%lhf)vnq*86h`>@4TE|uC8P0 zdASqffS@NyN`21IgZJ6B>4Xa65bK7UFB)M))sj z&PAblYUs1uk4qkxePZYe^RsZdc7-@!ZFdE&Ak#x)pgJ#xCi^nScL_3fYqXT4Q%~RO zEWevykP@d){9MP=Wg+}!54I7m6@S(Rms~A#X#A5;*ZZX-X@$?J0zMS;sP}(3%k&{S zlpa3RZs;oOF{AW=6`I}vb5JK!QW5q?6s;rYq93^IGv3W^Ib=vSZ3-HAxlHp3nT-_U zvGtM32yv}F=hfW3MniiAOO?-8(3_RX& zjPz!0PYXo-N}oBeEQq+~S162`xapdRN9GMqT?O`Y0?_zcSb4Dx>v=zDY=!FyV9dC= z3Gp1^r2bfW(1BpXvO&9or>+K*@Gt|7mr)9Idrr8v7VCY(J)6iwGWWzMVDcSeUNoq# z&#u%@kpfx53#rb3rku3SyiYg{0SRbZ;d7qO!xf}kRL`~6vR3kQo0M<8I;+uuB)&U{ z^D;INNdLn>mb=g z|MelASaYFDp-y#ALZ86K%1|q5UXU()?o$_aM$bI9ptU#+4A6&J0OtJH5ElB--YjEF z%`^5&h9s5h1otSk9b(VkHMa@BfyBA#bA=t%xq?8gEu*NRXa1Wr>}>xgK+$HT+rmyo zMZiD^gGl;|D+&AN$aKC#7ELP>3h|CDF|`s7CFlH!qc&g$#J0kSpCyYUUeN7clbEV5 zrw0_65qf3AH#7P*AS35+NTqb1b&T-lTr3Gl@nb}N>ZtaCnRj8*Xj zcV(7E+32S}oE$tlJS7*-@;M{p@qo5k4j|GSTw$x!^**&_7 zZ|TJXMD&3Tfkuql08U;NFO{0CACN#Ew^t0n{I?~0PKpt`GZa<#XP0NcH_NzRqDuDT zB#CKeD`4CsXcQUV_#h4SARX@`2?9!+=vYH_I`;axOGM}@?!ju z;i6TW-zw}mGxhZMWl8Y) zc#sk#;@bEfvvELvd6m@2myr-x;Z*R+^Au|0NWhd!&*Oj+^n-F=p&}nW&ECz=-8Re{ z&=UJ6=R{3{#Xa9}GUb;B--WOE^oNH^3nDS|QN457y^5-w1 zMI-wQM$`=L1kSlP@7?iDSw5f4%~k0BQad==~jYp{Ge{ zoo^384R@Y~@>xzm{^!T4o?WFIpT9XAnZi)I-oHwVA=^Qr5fi)p$QcGoiu)?rXDYsF zZsP(De#k8b+rSGR@Uc4iUCGk*{4Ijxh+gmWfe|H@ zJcf8zp-67^K&@r}Gx--fzvbadL_AOioiAFrGUZADbfjVVdjbbdi}l_pa{o${n5F@7 zc@Em*Z-VNGj)EXNeKO^ez&wvvgqlsZ%Q$fEhFQz*vn7y*75ZxZ{o|qemH@jp4RSu? zLViDR*LAw$GoFw6-wb^x;7P z5A3==0<$%!fmnI6Dm=Yh0LGM6V<}TR}^IZc|C@)jA&y(6O4GX$$UTKz1w++(oV}#Dz*s5R9@aY!F#*G~5<=O2v*d^)kZ5gbb2G1B^Yi znGfIokq*m<3QSQeT*@2q=gi|C$|z>%IG?7+f>KHoDZ#s=i0(npJoyttIu)bx{f})dQD3-zT!3*jA@Kw>3OM zv>c|o;;hk5^Us$5d+S*HMw=rP_?avnwrv6X*Y;&l$LFooTiOBovH`&vA~i`it*&~*ys(>~!h8_0NW0&^yUhFWf(DyH_I@U(Hv0(Su(U!p}T$qJl_=0J(xL9d%X zF1YZ8T7^B&5O!}GWzKtZ>}Eyrk=1wh5C-V-;I11-7Ml&xhh!4E|LWuPeq{U4>xUOy z=wm@Y=$(TI+*GZI4b*e(N?04^BOdaTPjzn~IB&xRz%(L$ZWnP$cf9%6H;gyHR8H|b zhD0t)NT(1Q^h)w^gCbfCu|&Rf;Lz}c5yOmGK?5tLKLnz9Z`uQ3IDenLCr__ik&D(EeJk=6?19j9gR|&`gX}FCE<}I03qy_~bM8zAxk zS_><-Imw}#AdK-*ju7WMKol_nMxEzxH1dh{`{I@&9%WFwm00dy+@sMbh@8R@IQsd-T&nf zZJ+{aT)b+cJGQ-YH)o17y7fP=@AYNK26%rwq?oMXY_^+lty^k5$*W^v!t`@LTqxDT zbVb8**ULMc_toW=bt4SRe}8?%vDkh1dw}D!(bKubQv~tzG{Q?VsHudj6!_#zb>+Hb z9J$al(U&x?p@zTS3a}W|ik1ZbSyQrF*Uoo*IAsd@tF}92yQ^vOBxIT_4qI~ldvREp zVcy7cn1+d62(_e6wdDLWbu-kwIyS}HCZ2owoFtvmdz^$hko?pR}FTFbK2N!s$!Hc z!wusM#J_b`);luQ*qFy=_}VwYIUy$%@t6xH1D7j{`ux5fjke;s ztBq{7>H}#8*tjIyR&f@Oa*sm&bmLatQ$Z~5OpTR~#GR$kcVCVBBz_w2FT(Axd>w2f z7qz?0@$CM7s;0{a+Q`3A$stSXz;gT6#oT%3PI77evFV?@udtq(y|uIFG&gM;U08af z$U5n=Rj+<32b}S1^V>1vn?{>0iS1BHFVSR0H2ZHB!mt2!?fUZ=wGmrl8uc$IXtE@m zw+9OOK}P%lqL?3 zBk+f+kX)}~MK3U{jAL^fahv>yOl!|C>m;oT6Z)z)ydZ3p6;M$Q74E#{qBdkG6J+Fx zWg>2$*tAH_^@teW+WEoSJ~^vBYHN;H1*J9Nq`8PV(PYaEe%NhNC+tkM*xon<2+s>3QUy;*pBx|81T#k?n z6w|dth`4dE=^<JNK$+J;%)j~ znEi!Mrgh-S&@|rk&+U>0+~XqVLJ27=*@Oz2;Z=RbI^t4x*?uBx{`@?p@>~g(JNmTl`-#Y?S%9ys zj!e}@UNk|b0RT2$FJ2TpAm9l8x@te=2mrIo=lG3`Ie-1YZl6oGjr|JqBS1fLb@+fIX>oX` z?9->g$(K61iV%ZRnbGj?7g8PmD_I*&M2Isl?Nn!AQ z^{(Xb7&EuTRedQuB3JR|3M+dt`3=0W@kB`+l;6lZ)d92w9Wt)d!Q2pr6MnocG{g4s<0;vIxWXEBQ!i?UA!OQ!~1!mPwh$kI-h-r-*MQV-|V_$4!4xD>y$-H7ZD ziF{nT^m1bL3`w-QuNmz`Uj6cq;V{!+K?ENAKc{U`%%ri`C&f!ed8WsOwjWir6MPxocnw!-w7fqk-f}!p|ylzl(HzK(nyVv z5l9SU6+%X3AsRwPH{NwgR~oelI-o9q8b{3IM(j?D6*MbZ5rwK3Vo6~|OdkdMl@-q4 zLOq#zHO?2tIf^ZlR=#%!B(sWcNiRw_UTaO+>oZ|P!i5!92gs`+HFE8kCZVd2?pTOJ z06}B(razYu+BS40K`F#z;|&RXBY3$ML*ZQnK0a1UblpWZk?OO=;vHiN?Vtz~U}&as zocIiVo(atEvrPb1X3|>Tx#|fQbIJ68ZCbB?URlEu!~rfrpW=x=&3L;T zbh)wl8pcuMB;Q;IKBx(jg^IY|TfBds`2Bndqpq_vaG&8r?T)L^V4_~;I4YG~gMNp8 z?AiY9^n}{vjC%g6AkWOJIf1u#6&T&$Jntp9(4o1h%^UeysH&|tl^`j{KiPllpm!2C z&#slfe1^ZsqDKm*)ES^W-Lc<62Y=8^20O zVbbHXBj0`azFa5Fg%76{KB|nHP7#))p>M*DnUf_#b-4l`>N!0tC~+hXp^#qo3vX3D zH?K~zarD}^s|6tCDyZf`i*;{N#Oe&vfH}2m452)v1WUQrk}Kh9=jM+dP@@L)!67c> z91%wEOZjR!Pbg?y4vuhP3dSD9yRFp4x?G2~!*!HL8&sw6)s}Bn4+dROirz%+!Y#9h zsHBSPh^idZ7rWf1tz}qZQOc)ec;01g=`k$2ei=NTa_+WHI*GPsU?XFGil)_ojhjij z2uDSO!2E{*0ISsJ+?pN$*2X0=$S%loclT*Xtbnou>EGzDnkES#ZArWq*Fr=WM*VwK|WubRY8bJxu zk=Kg3e3Y2$vLqLD@-iSv@Iu0L>Qo-Ywz5iowa*@2sHCfDEjL*P?DKGKZG-)xy*3Gc zUG1huQo`oaLE=Pwg@Ty2zt|4AM^HsYwbRiOaE_3o3+N62<&nNc%t`Ei$Fq)J(*li~ z{EVT7vCO?bzl~3hGB~>-Vt-)H^hEmiJ>KZ9Wa?9h$dh6!ETY7yHe)(x&)3O)rj)+P z*zrLLa#iAYyuuScjD8rZT+z&0e{E4J?PncntxU@I2aZz*NoE1lUlKo`iie< zFp5I;uXL-GE(a&}^c|oHh~=jy1DRzuzn@nahDKhcrRQsD zPdz^5yulo48WHw)3cr9A{jdEBZ2{;W#ho`1}IV5IaN~Fa`&`}9$$+Rw| zZTpHpWKc0g!zBsEOprbzim(OR{)A(Deh1rbe{)h&1x&K&{BTk%>crB@+}Ut1feM%@ z&t%Wza)h3*HA`tH%}(>HFZggkdXU>%14} z{dwTs8h2hvyfsSoe4(FZpC<#D{BGL2i^y@+9b@Tr1y8kn4r9DvFj*FE71vuzegZ=f zuef75QHAiJuiM+QD|H6iSRF>0W8~EQ*0Xb8j~ceN?L>wG8}jzj@WvedLh=gOdt&>D zLP$en^+x*R38_jZQj)OHvLXJ@$QaZ=;1dMoFfZ2&0VMfwm36?O;FXFMjY6x8K-__O zy;=>3y})sHJe|liIZAi+S?=9ck#+&*CrNt>Z{B{w9yo3n|HK|R>h)+BRUQ*ktzb== z|4gd3gpR5bauzD)Hks25`C6^fYr5>7px~INZ*Q;P<|h+}Di5pq;>g*+Nre2+bN>7f ziaV?3)h?DQ2Ao!NmV`Zec#R*gHK4*Hu~qKc0xa2S$d2OC`UCDe3TML-g+z!4nO_QY zo|Lu6Kk)yS8TzQ;I!R}kd3ZfmM@C@Uafo$jSHs`5Bh&@JG%-R zvKhwbi(?v-lUKQLT{o-md~hM_z$bD1W^z}I83;L7{S;bD?vxay5EC;6C#8Ud9N38di9Vh~tIjD-%qb8BcnyS|T6?U# znbp9R9jN8AU&A%tVKM&D7KDt?Ox0qrYf}q}UvQ#^GbwUUw8}sg^*%PR9^`(A*M*Xs zwE?N2g7U~($+r3GY)El9ib_Z4{yKxDNhm}Jn6z-phKd5ouRDHuD{Do}85r{nX4sJ)z1qm^e@u@5~VlaN@$3ZBY z%)qH|BGI&Q(97aSkH{%mF=viE&1Z%#fER7_d(2S{6A32JRf;uQ@MNcN?Zmj#W#fPz zvBsKws5}Eyu65pK?5J6MLl&Q8;J?G=!F+~Tj5VwB(vZ*`b8ZgN#VN?Lcmaxt$IC1W zLm1>*c>%g|yw&mY6IYM2(5`D)be^}Y2sSzG@p&;Q?yH|8E=;R@E1l%7Z@T%HKjy1uGz~2HShjg$w z&(^>J3pdrQEP*6-0Rhobx>-JXd8!bmDib`pIKQ23+2-GP#|w;pL9`i8 zrz1L88m=jKovVuKk3yb2k?Ob-{RTHiZe*X<3oQ!L4c}Now^SRB>o7U$LtCHv3L>Iq zX<92j&wWavgQ2a-)z}d`k^r}b(>2$W(_uM2PpDZk*e5Vx3LE>GRV<*Uv8b%imxhar zxmSPpnaXvlI+g4>%p;uP)-bp#FpDn++W?44%>+4G{P$RB;9oIe42W-i=1afOEXit0 z`l_)m4cbNjRf?<$V5B2~HB+crDE*ZB^$Ocu%9pR^)YgMVvW5)}&z_aW1wu;Q;*V{S zA$!Bj!I{o4r^8cbN9tBHhxKFushy7;XwX;~nlD`k&b0^roF;xnAO@V+B}AlV-6TTU z8<2iQNx+jUZL!$ERRojhD_j~2J3xIEAlFt5KET0+iQH7tA|F4@Pxy@yn*B+Z$`@ur zRBuYiuyH;DEt;t`>$hnX5to$eceyo#lAe+I43E5nd$T)On4a^&5?wY@pj@P2v%@52 z(g^Aboex0ZUVIr1cu5QI6?#=4>yhHn`Dq9lqggWTUz4WC$9ORQz|`rydsmC&}9{!*{iS3&i7C! zuas?#06yp83q7zucNt;I$w2?&JlKe|rf@38TE)JN?FY_c75bnio-E8^lr1*e1G?^# zv$AK^wHmCt|L!keimxXHc}B!n-?bULKmQe(Z|gMt^Ap;k^f;n#*8O@Kfl{e&r5WDS zg$=NCx|2_gUT)Wxs*4N7MfKnOfWQb1*p*3@-M7q0pFUJvNyLYYn0kFX^l|~TWGitn zT7}f8Xl*YdD~%E565@=bsFFd4QH)5H!w0r0J@AWVgHfEl@SqsXkOWaVP@_sUlB{O+ zY;GwU$rG=A6YBz7-BORK{XG)HR&8M>e$YOWudc(YjRo+H{#@D#X<_DmBP=Y_Qx{)i zY4{4IiLgL{O2PNZZ%@exkh8A2mZH9=QI3aoh0BWHM7esO7ldry)4V>?GqEuy;b*tG zJFWB2Z+D;los+JcP@-hO&}&eU)?(`2MD)9pc&EQ?R59sL{F(kLPP=!1sal==BrYt$ zQ7m~(BVc(;g;{Mc@jl_{5I&FfcB)hfYznJVi0iX9Oz|^Ner(zGGW~Vg(;32i6mfQh zHS~^=6Ky^z#+GA;?#93OL$$Iu{f?Rxshnt{xqHg`g?}yQ7OARyc!iKtzJg_-o3-xVSTly%wqYCE})kf&ccP#558)WgDX2(0>b={Y$yM zOzo{n5EyldgDL&7_kNLBdCURQwH@qCe{zqGB0=m_0a$^9*op>n#s2J9VL)P5EFF)e zF9`vwijX*9gwh;BwYIU3tekLJKpw~|v`u2;ypF3_;5PwmY`aFZo?4^!X0U3^UT851 zeU9M?rdck@8H){MRa>%CpnaR;A#XKGy0L6~Kc2LvT+H8G7*M^8!L><>c9nK&wssp3t{jp};voeB}Ja z%Fo09CF<}Tx$OQ|8<4{@@h<47%?Z!?E?R3ogR_tuSjge=MeYVVM`}MZ1r##Dk%Uoy zxP+qNcqR;oICv{}-nSfA0*+t*{P2Le*JV-F1Fh#}LhSIG~z`ZZ- zCzVCS$i5KD-`8(%{>(r9SVH)$&P;n7eqKHJdK~P2H#`scvy1$nz^b3^(om822lr-+ zEkE}j!GMf_6 za?4`kB%Ww-wTgNZ0)E>YE4q<*9|Z`E(-0Nga9kOuJAI_EL~6fjpb9zEx9qhMF8JHG za#RrdSA98dtp7h*q#A=?SR1A~_wovkYHG`_h#T>?nNQm)<}!nB4>x#|UG7=3xct&c z&?vpZzcA%*MEY*HThB`+d-6D7%@$AB6Et3j^qX3-|L<`1Mo&amDOi~-VjO?k55~Yz z`7hwr%M2;hgPRHoT?qg0AHVv!aE$t+abS2a5EoV~eVcAW)rg!hQ}MgQ9~RQQ=o!M? z^EIb@DBT(J?igkAh|Xq*!qcohnE-Izg9x#^&kwU`e6EGWjxL zxJGh+jP^e?orPNy{?~?y0i(OSMmNal&e0&kq&p>rF9=9?4jA1H(%mq+8wn{10YQ|K zFy8sQuJ?b~_Sre-dG0#|H!d_ip53ve;|NL>DMqI{Td4}8*S#3%c`8M*$!URpz*3?U zDwPm)9+h-ylg3nn857I|3|r&uTtmD!TbcMR02Lf?R|e+_0tTpu%!m5FLKruTy`-%) z^#&+i3_82Rtxh}2#u)S8eELUQ%dLH;62=QmQ~x4OE|C&dQ_8(#(mms8_iPG$DmAB& z-0eBj7kSUEg^}I~gL<|A)S;ac9Uk>@@Yu|z~v-t>Tn?+y~p#L1#W!P=$6v9WK3J0Nft*Mu` zy&F6h>(meM-w!Rxc7%UQ9ptUIT;87_t}n4>lU?f8R-Kor^Fc11()9b*&rcHHu)A^G zV?tl{*exD3iq>`Duw2Dle$9isTeVdScoY02H-H<$kL^72 zGw8B*7E(ein0_$TPUGFuL6ogbTC zOiVR7)5pTe5;9kAJ^mZiC)NN;5?2Y-S&-zEnVNX{&)K`CvUBTu!oya9xBV=igReCh z+*g|kJ9hdP`T$m!BtBv}SaJ57!I7#=Y2ivpoNw--C*063|oS5Uu}WO<)BNDTc^8 z8{N^j;$feNP}CPQGw!KfUWU@G`AtdZ-tW8LcgMbXj)?CKH1=we`yi{HRY3n^WK&hq zVrGjZZm#S1e^b)o-|#K{CWoB2UC~FZ_o@*|Ty$B$abh+@1y{7QE<-L4|6x1L!8IxB zN3+V{x(yY3go8mYrT!5Q%LY4h@`g3YaG#QVgUW+DEN4Y2_10>}0>aZ)n8SBKeeRpU z1<3LdHqp$rsl?GtjGUX{ELG{p3m_3=sxbtpj(jLu5>r%;M4f+CW`q;gsH!l=b>K?T z^C`0VrCSp9ivulLY{4i}hVNbcm##f(mJCUbBu*4c#EO2Q9GjypNVNcgn}=_$ayXc>gmS@& z`RSl@`?&?U6I_?f*4#$Gq3b%ekNlrL?jnw}!$=2s_$SCNgxlXr%xO8FYjvIm#^VXwQtVA-_ z^Lje10oesN#}LKuAb@f*%c4QaN6D7_#)SH7>Q(W06P=0Nc)Ub5LHS1zr^OPX!EB+%emI? zQ=+MSN$&E|SJAQdTwGRbj6RvF{uFhpGt`1!G<|9iv~eAeAzWVMQ2Br+b2=)P$F4qi zr;uNFgPLsYbZr$8`DnAhnV7J5d>tE&Qz9cgz2_5S!YYomfrh ze&NYHs^?6Kwq}D4aw$)-?Moy4o7TpxsrHc&)k;oQGRw>S-sfCO?yyZ|h&RuCy%xf( z(Q5b4EhQVBl)~f+ltJDrKAfKlg5ulnmFQf}N-%F7;?qz4Kzwba(>L5W%v+s0L9O=P z$sSuoLpYn&M=16JVnv#U8$!&?W@Yi&3Pi{djuYY=Y=a-C0%7M9CD4d`flzg&cJpo3 z1*wRZzHH;lNz~_uX^jUagbou42D;Zp;aZ<$99R4_80D%|AASwG|L+^-uiQqnjK6aw zL34>e?K%TW4B$=*>dO!XFuL5q(JMv;UYjxS=?3*PznYK$*eJSNwf9rMJzGTE13gWs z>R0?YV5^Ddz|6zba0dWHOReSVZ}lbPh&_9ZNA`>L&uZ7VpNQVP8`yR%VNx%%|!{{-L8Y8kOhwtjhOGn~i}sEr)U+g2k*V$)q9+6|TxjR~q{7p+I*zI(rdH zr!uA9Te+&hIl1vCe18DB@RM`)ywIPOa2AvY@E6|CsUs_mA?Sy4F1V=;e+M1n=`Hg& z-?OA&s1XUit5(wD!3J7xa=HMf24sl&To6r}06I(E>PKBWKO9n>U3~2L_F<+v2OPtq z&=MfBgvt?pwp=|>qd;3)mzgws{>c@~rV>wK_v@Kj+v@M|?zRU@VJ0m$61)RQKPK3fA z#uE5hbjIGGCPW3^Cxi>SIrXS$4xtVCOO%a;lZIIWwTNE`tdsjc+AFZ?v0h}+K)sI+ zj^2bG5IOB0Yo9EIw-oYNCfdQ_|A}3X;YvU~G$;vn%zE7@J_t2a=IT39o1ymocFOzw zEx0F9??(ZNJXHPSkP;(g43%`^75r(MJG926P9isUKTD=M17yi@kw62CttMAdVQqB- zJRs6~emSIH+pD8bS^XFGA1&X@XhgwqrnuU% zXc3zQdBLKn{fuNy9Gfa+;BRgrAMO~tfV9iDjL#;6^Wmhmv!!BhSJ)#5Fk>6|liq$!^x*7E9%v+M);$sxzW>hv^N@SGAyJBCP|Nxk;Mrj^G!?M@XOtFf-hD;* z^F~Ec_U$>DhK8Ur33r1Aj#|$zmU*9|XS2aU3=Xzp&B~3L1Ge-&=vD7e`r3`Qs8cch zPL3$E#;^(EQZ80jismdvz;n2Jqj2PqT@s3QmK%$x>SF5GrBP*^a)@ORDi6J87)jt!Wr3Q-o^7z+J(? zuLdpGp1O;kCE_qIGZ^<+oc(e$(2E^?aHXkNMn7bk43z#wo>ahU zExtc{_jZ1I39lulHw)sO;hT0Y>7wB={*hXn6wU{?3)1nR_55NDw z+ZCt~Vy<4(B-9LH;w5;c*rc8{AD0WL-JS%oySj%?ao#X2k&@LBJxG5cnc>Av9W(!^h% zYbEp)4N!@BDf8wysmoxEIk-R57_g#2X`v;)OF=&rRW*NDx0+4e@T*vK{zVA}t4c#QKaru3Bo(EoZ1iX=t>tKMedtPHTy8#u6It z)8!u1FB_>fW;77&tZbR9!1b+&OVUq|)Jm3l9`mzl(obB|PvmhbPrlMH7>14EM*1Jd>$dT-Ap>mG+`7reVLS^XK1ke82rNb1Q<#^szt z+0U=W$lxaJ7*m=+Qb_a43tbYc&8E2rYh5% zX%Q3EV4@#(1W_Ou@!6!bNe^~tjoM&pH`&CI6#M`7C?aa98^T`7MtTGZ9lBMz4cc_9 zA!u_RM^DB^IbjrvA}no&RXQ5I_K8zyh9Mh>&!S6+CGfF%kI6rof!k~wVC*DD_Lh03 z?2CyVuyu%lk}z;FLUQf~kyT<3CM83&EZtXoXY%!xJRh5?nS-9}j^P{p!R4bgW@sX6 zv8#~)GjMk-Z)8Qx) zIPnPW`uizFmfVkOX>y;{GqLBW=iSO`9}>Y5uM2X$3sL?0&sebJpuoGUB6Jq=AT^NxHszaGFgu~w#v8P zKN3?Sc-gk4Xrp6!Z&s;p!ZX6!%BHLq%8GoCQE;>b;Wl$j>XD}FWy3_WJNcS#S0v-X zp3|6lBcGy7bU1U>9vx$Xv%2%j`S9Uigjdd8e(RM`$y|e-luDKU8!q-I3pF)+BLViRi6=$|0_1dmej`acJVz8lH z6Zm>G$Sp%KEHGKiK0TAwS0{ii0@NqAD@4m2!@?4D+xL!oykNxM2Z8drQVXOjAimLgd}8ecW0?l-*C< zLo-`Vpa3+?76<=DR`#{Wn)}ujQ^FOUu9h>$3E)AjaR#pEW@ z5z0G6Y9s_-ezY|Ec2*%rf44?~EN8)Y8~%}a)&A#cEuU=z`oYGDZMEgWJG&>3Nd@xm zEy3KX_q1q39>%5d4q{8yF}brO#;eyb3fyEE{h!)-aH`(wtArl`cI9(0dw@_;nn6(d z6frcdoiM;(YwW0j!+-&RHfx2C0?3=Lc64j=TNu2-k>+jPQ-x`7##&JgF}M@UGDEU}QgCcUOc+%FG;xR(iDn2r$|^TM|F^1F z5k1VlUa!CklQ|!kl>u%DH6Cyc~4SEyL{~aui%@Xb@m9mQ6)-d1|TzFdSPg6++y) zU#|t3oWXm<=8)3H(m1fwVwlUcri(Oz$~L8PhsQo~t8*wrq3jw$m6H`)UY=b|h-QfD& zr$PS9XqXy7uhUY#1uW3$Oy&fBk=py8s;PVkQ$pxEnwRkJk=J38xFn&z|2fiGy~h)D z713FQDj%gSl`pHF#I=ks06vU?xzvU%UQ}jn4yc3&I`A zn^}kXN_;fn;Ho%5%up5C3Td;j#7&`v3A5VyK6e)LItXh643W>$d*nr6M`1MaoSC;M zC1BPz$i(=?)_#h`JF7{C*4^LlC!}@{?v=43Fg7EGX+Izdy9Jx0F$$~8-y(2836|F5 z{sP&`2Sjk5gZ~^Kku|{ZcM#%{kUVu2vkLjxu}5;!MJq@K=t*L#Lf z*5k0O=Yn>bmqaN(8a;jNEQC_nRo;a_>3Ya5ps8UMfCb9=`Gcz2KcZ9Tf!&mcv#EQ( zGw+lXDX08bFU*-(3Rj~H#gg7fl?^-p?W8`NU>E*WArKsweL4!my*WKRl%-^=YqN8( zKl3xhyXHg(*5fIU*v8iI3p5EB+*3y?2p_AJ+kC+=5~bqDT`}w3{8#!BAOZUGvuS)h zfBW}I%bhXs2Q$Uk3Z1*k!wvFt1e#28UM2BveeHeCMIIDzhMS@^$jila9ruDvFvMBG z{w?1ZbuxvWbFYOygoqW_6|!#0k%@XYAAKM(aZ~tH`Y-(3iN0%3)M{nPrRWPpen%8% zRE!v=h9rs%lKSN@X|1ilqFeH6Uv&E(Nguxmr!kzaTfYyrQZQd%)GSercKwSeEi@(? ziF;F|w?dB^?3SRQTau5rg%QVhOs+?J(D-|+Q6lRGVe3V|Lu&iN3aD;163JZ+_S4RS zowWuN2A?V=$fV}O0a<>@6Efetjtr|18N2qw43YhTZJX>Gk#ido9vv~WI#;~cu&lmO zLsF}J^oGGdPcUgT;%tY$9QgI8W-dDIM71wLK1T7;rae$McnoB_gVf}&vW>=M z=8N61AMXWqzDFuxbYT#33-#YgKvo(4!aMuMB1vBCD7YKUW?*852%KB((_DVKDzREW z+0A*L6q+;*V+n8|cJM>Q5k-v?AA&6uyM%tfpA|l^-Q4_YP592lgT5>CS6q9*A^rP#J@>WlR4MdF?!8TA6j_#!BJwYW#L@_gFiY7^V=3c`Tdk`h`}3bv)vQh zy&ta}c>jaSE}UmBTki%RZSmksTqWCDzLrdic5DwB3|O4th--A8zCvhZ5i`GLut`ZT zo28+VJ~ckc+xz7ppogU6ctdyMJpLP@EmwcA=zRSbGR1!Rtz-Z3t!t`p5&tEd^W0?9 z>k)`?%*UZqCE<-x+@_hzg$hnT4TQys=Je21pYQ92C7EC`$KrQNre1Gu2(b(f+^id4 zR*`|qI+V0tr^VQfE@n2ZbqrMGrH4UJ1{?cCqRQaN$_4j;}D=`2|HAEvL_TYeIXJ|&4^3{>jickDATf)0pp)MRrjfE((M8Dg#l7T zu{`E^Z=M^f=hA+@4CuS;*#1=&)i;Iy7Pk6hbNIHpR|#F6A%7!#&Zz8&_=vdA=gW^g z&qao$cQAYgT>H$ubxf)C=!q|2(AbC@%&6^!IT{L;%_m%J-P~iwV3wqndzGec(k^LH z!@fz0t1qiU3si^bZx}*KN(iDc-0WD8M0mi;uo!&#fj%?kjWYo zs%QAnvE_Wwnz9!pp|8P8FgwJw@zKLQ?ALYHpc{qsCzh4N*Sok_Ix)76mQ{8TL_M1y zt~}WV2j&YZ8l*ib2I|K3pvvUsg?R=;z zjfo7+&nA-zz_K?S!X3C%O0=v$K7hBucKTGKLQ|^McwZ-&?&scNw(75US;f05*r%(d zJesmH@r#45R=GY4zTwosNadnRJjoyyc4%71IY4kyl93_^lV|*?6>j;Xx$j9*VJgx(v2;=_DsdGVu%<|CFEtc@$0mkIq3yRw8=}|g#rj4xia|*DcU_YQ_CPsatOVa z`TGSY3kxd%&K#Fs4nb|%8&~4}Bk}y19a95Q5ncnnlfIT6x0YY2FwlwB@UD={OCph{ zy7bQG+IkWH5mhBy>!5XIJoFx1{(Fj(nvRR)Y}P}9i!YnRl_l36u`;bYP_2wI@&RHK zHR5eCnlRa=|7%oHohOqdyn`}6ZCzOYm-$w;V8h#~43lbIC|+37-cfiYXkSG|FrQay zo%EC(;^WvBAw_=O2I3!Z(4JRB&kk$hNTo|;|ueeHQgp>P9HnZ&R`yJrp zEt*|<;jZd}a~@7LOqjJZ!M(M@p2@vGYp2I#O{n#7J34mK4L4Z^*)kZiY6%acGp_xj z%xC!_w2!rpy|E=PpjzUDwKb7rop{aF(Q+2>HKYR*T(9p&dG49yvy!-_!=YU)&aowDr@$dsL%I(^DCt8QC(qk)lSpWUbl zCQuwB+w0UN+x;?CSJA-*W)`tkU1DrxW#&Td_=22n2v{CYxPkiAI(X9L&^@z?v8+%Y zOXGqgPp?9Eor?D-`a#SnzU!;}9udf@jYW`{22BTgWDaV&EquB?IN~%9qJ!6rDrAs; zZ_5V49?aoIS{lg?WFlif+BL}ZcUw1;kYQ#(vHhotfwfq!*+mN5EXbX9l|O)Bww+=` zo*SFrF<`Pb{}zSTGL$Af5b9-?>yK?MIHT$XB4=GFj;!jvLh=uJ|D7?cbGi|ahO#=+ z^SpJMF7VwBnPc68TB8FkVrh<0HW8IBnhEgC%c-FDih`9bpdH8I_a+BmpC7m_ezqkz znG&(K($~dSQ^gRCV3WJoh3`i-LVrXXdrY#{SzVlp;(lNkpzx(0QgFm)9yj~y{wgqO z7C6D{abyoed2a1&PSuui$Qqq~nT36%Q|NwkdHcYdQUgT37uOie><74R%#OxN=rzq# z5I{(nfOWbr_V&>zyF*nD8&`)_vV1l%%x+PbiQEhelXMso;7XtD>44t7rXpC*pStN> zvw)}sc0ly_o-1&bn5U8<4P|j9Vm(mRjgN~^3!*qw38lIp9%qwXCkZu9SyPR(d*8y- zf})rur*fjQ9TZlhO{5S4VfMHv^GB$Tyk(@Sc=V2fhhK;jt@+LKdHD!mZ}VGlBAY}k zPVG}o%o@vEuWmmrk{{=q{h{+iTPJRwMb9+XBz<&_9jj^ZB4F39^wz7hBFe(A$4 zn)jPuqeSI{#Y@F%<9KLQKeeI}k$OazXZlvj$akQkg=U#Q!V)PFDDss8-v^6yVg zaYHvmK5JwQ`^%Stfu4vgitAd>w|-N5>% z9XRgRCNHsxUr9IvwY4TIa97xI4}Od`JjQEKHeDQ&VlE%5wzalnvsWIZ+lfd^T+fPy zH>nQU>jL7!4ulVRMKPurdl^|357X%L>EaqVHC5X5>(^ohMI{vWO$1ecEPYtw9^(J# z8IN$XhVi~Nh;&e3)s;{1lihhAinO>NguWRZ@*zM76NX5Xl*Ke($Bzi-{kkWNf*h_7sL zj;qlGYv#q!fosW|M|gQ3eH1H7LupF0iB%RWgtI6C&yXFTWu_%fV#VtmgQ#w+z1>4? z_aJz1_?%NyRTX*dG5=eg!7n^R7^zIozUD5}KXmBOR;RwWVZZJNO8hZNwZ?D7D;7~9 zDQRb>jvBUy@zaarPmya(m1N@x#Z5y8%v_uhN!JWXQ?WBvt@84X6T|2f+t*8P>}+~z1plImcTf`{3w3fz zns#L9yzhrK>yXeM%${R}*W>_q?YDmkkBM1A^7tPyNEBvP4HZ(6{K{)>PJ*zORlE}$ zXHSi+fa}dEP#7{7;5ql-rh^>0OfK7V;0BQC$WTd;obA@(kU&~Ex@&Tv9E0h~u50KB zqDRV=`6C$#TE7b0^z~OeBx5qVHkLh%RRojjzl}~*X}E5~b0Vf_F-xM?`dZZ@-yan} z#2DC;)Qyb$(G~pL1f2dd<15oNxI~~E*Nf_!)w&ukzT})EqT~h#`ddcQ(=e5nIwIu( z?}PdEP%mli-lQD8{_A!(24sVZWoWIXpI^8v^=+3bM-t+J%$wUP^hW{c@9WBN?Sx%> z?*!4U(f0#eu%r(kf{n?|fokvEZr=YBg0YH6P>t6gFBBou;+6ElRFoXHbY{#f3 zf3Y?Y84nwXJ0qysyjMH@ZOM*o293e{p@NBB1x5O2AYzpbHmCGNEtNRQfJmoKp_1s z_4xvoak`{H*Z;`=L0JC(hm72dj95Ff=B4YrMexktPI@V(^T55?Tf?uW&A*+p*ZeDy zq1ktzkoCXarAl`cK}-2yWJ&LSviABF`z6ugW>w=ipG2P0kwB~3K0FxezUIHi(H)tB9STA zmj%D#`-8l(O0G&NdpZ4@Hxr*bon913SBK(TYmkDIJAK^42s@@4T$%UL-t3Ufy=TCVT1rW0Bi_;`jE{!pl~zJGFyebZSb+R zDf3ko2AY1B=YS=CW?YNy&ir&S^I8~dyhmSuvZ~@bBCjYTVjV{TSe2jJEInFblQC45 z=$#_Tw_YFAdNy#v&8dyJGwsxTf20-?Nu@>IBs=2f2U5v?gWs85l~Qn$A{=ZS^zfxZ zND?gFc#s_|S71e^wo0=V`NH4g(rs$0d}A){J9akct3pqCtRTWh&jLu)%8>E2i+w3v zHX6$2roixCpt!|@Lj-;AXC-o$vQr&M3DkTUxz+ZWSD?Mh`=+T z)LZ}66`5H7X)Nq_stnZ4R3A)HdU~AT3)cMEvpCCV9eb<`N8Riop!k&krQV<0qH*4wpWi;)Z z|F%{N9b97=g#n|&F%TL>n~AdmT9Y3J3#}c#H=SPb5DNp%W6d9>(W#u+4EXvR%R;{6B0(ypLDH`6l3h_ag}7 zjm968Kz2FI_obBmlc+#7fg(DTQ{m>5NrmCCGklN#lpO6HiJd=oO$#B4!BePMX*>;G zpa01gTD_SUaPslK+nu`GuH=WFMSGU8fdeyL=aaZ1IxX zdBNC5e5b_E-S2;`LI`}K3B=-a;`6gDXEZM2slGmp8CTh#X)Fvf7Ex@-JW+U_`tPdCD)`x)i|;0OR;3&(dJEi=kwMG zA91f!43WG@=gXF!$KfaV4oD{EZOwd=Wn;zpLIW*@Grr<(V+Ew;hI+7}c4Q zp+I~l5P%LKzJ&=FBG9IindB!l=nkOFZMwr(&ox;eBEgm3jQ{k{E{E7$pM^I)aV#)2)$7vRtJIOTc&HC=?!hCEeu}v3`5F z?RvDhzoJf7Uw7;BMYv2t%aWv*U1AV5pTT zE)zj%qCD=o6jND>0v_b$S*Gn}*5t6D;bhQH8av3*+lw3_mE<@a6V`vNv0gfvGS)0D=~%Eu%wz^^CZ?dA(+ zPt|f@53pnkdn+bA(*E)>3}F22n8^X9&<7A zel+u({t#!vOb~yoBU$CIRYTN5l(KwO@U_iw+Y2Y=Tf8){KPRfxL!(Qv*n)BgS&#hq znWd>wQ#ieX^dH^s!A6OQ9EO%fE8*3EPB&W;CG;sqy4I5$>=21rYqZ#0=FwXtgNaB1 zT6{0`7+dgAua^}ZFtCRBAg-AuNGF4upPbFE4NMZ|W

XUF0c`@i00`b&M(7 z7;7rxsaXku1u_K&CE0=LfPMN}vS8*P+(mQ6ZJn4@;i+%3o#GRr40hneg^Ctp#BIQ5 z17*{NFCYRSlAVo!U}P?7R)h#H#1pyYcqDH?=ieoJ)kLbJt>{E*D{w=6V4vI}uve8s zoTN`)VrYtWDsU6!p9;8tPzZJa`gG>!xsm%shlQ$%kSBfRas#=^cb_92{|T$Qaf<^> zUinHxZ?brwEyt?O=TapHfxJS!&ewPn&;rS~F8&wCo?1srStzX0Q#V2T-6h?06CKz+*~QXiUM*MD zBsvqkLD;v|WrMB}nM$)kaGYnV-oKN~z;Qf%&8ooLZRD+&ArumQgj3o66Ph5BavZ zul?Qk-(WF9)B|A<`#TtR?2@_M_z`iO|hK{;5TqLRD7E^H`PH}z9RthoHvh1hKSBRzSzNKPg z8*>^-^&gc7i#Ga}5YW&mN}PW;Swic-cWmH}>sKVlXFznLPCLey*zfqxz22+p_{P|3 zUYw%eBY$(cp3du@TlcA3%SRVqR{e_niS&x08J!^FNrN4A z5_le{l{fL7);rE==9YB#pFlg9e0eHPB-cP4vUbl1Li$iCcT8eH=xb`i{9`(J$*`mp zP_f$K{ug3#a^zlXQ{cM5+bIv)Kh2}aB?(#mNV}-oF|fptz`e_s7kh??4w?JjL*phO|RN1~roT*|qg-g$$Lh zY$)dj`y6@xX=z_A%EqVPQYRR6_HGII*t=^VeoZQZ+C(9(6|!}rGBE|x_sF2KPI^cC zo=|qAJRzc*gU&reP(xO4;V<&O_WtjrnymMN%ulfS9qLeOv6BS!QL@-0;YmH699V`c zt%1lsA_jn+t9_3XW%*=sjo(BrazYPb`Zi%iD}V<3F-{?FbI_IW1e*9!M%l-48|Ww= zdn1yCD)$DtzAR(Ai#UA0W$w3WKhS-;Fq|knnl8^|#N!Aj zQGZ>D+p}p+6yv7oD{A_?BKLbm{`Qc2>!+!9kH^=iSd5i=FQhjvVfAoWo zcvPU%lou0W-ZvYyFX*1v#~ey`V5Q=Pj!bcW)F0#+xMw0okBN&L%aNNjK7}V$jd?#6 z=3kNhBf4|Pebb{jLmUW_&q6d}!7v9VujKGO32eP|OjhfXn zwAIcSO=u4!RbiX-880Ku_R{^?&ODV`&tG)y2nhsTu>5;xS$BspN_e@gnF(oMFeI9F zZS23#*3k1>ZOro+ctm0_PjBcazc`5t$42Ym z+^Y>j-rwInUv~OyRw_E+1tYVEK2JY_-(v*os3a-sMYX=fw~t)_8+uMOlng7krCXzQ zdg1J$LxQqj-bA`H%Mxy6N;DbmDYU-vrQ0X$*+JW5FAK0UNX|K^o3%h8DS`Vak5KKey0S-sGk6-Ds~ zeqxCs(QuYMWa6#CzweOVm!4^o^bq|{FqkIHitp_SZJ81g4_^WE_u#D1BH28NvUhGT zV6m0Ew%k~*mKwY!UJ53dIxvsOJ15ZMr%570sW14#LRwh>WoxeiWF)XvQ*B5BuLuvd z3TMHXK5r4C#l)|MG0g6Fcr@ir<}TVBd)-7fv#pPfBT|a>7R{@BH69aJ&=c5}5gP_2 zCdhS;`yud;oO@REX9{aFGjRsVkbQqQHN593{fdI-dz`=Qig2yhRCPeJ`mZAOnSZ!h z!S8~!N%vtniRjhO^W}e$dc3uN^Q!v_Sk~f+R~c6KbNAiVKX%EYJGFQo@BNRBYd_b$ z{|=KVd`OKzUnd;1RSFi8Y~Z^}!C(TzRV!14?<-L6x{i*3$@S0&X{MWh^j+t)J-=;t z**v6Z&5}FPPBSAeT?u>ev^0U~b|Mv){}=rfw)DaG?=m^%{3ISdqYhn9Ix6CEDlCXe zq)q=8<==X7dgx5e_}Mpq2#=F7*L}pf*r%4wXr}T*wYCmA0nWriN{&Z+nx+SV$qLNiOU)ZLkee32&Z-;x1V3;u+?&MQM zo?JMn6f>s`G2hipOugS=TEr8zWHfZQu1%HPg$n3PSY^=83&mw(6%sks+|FT@S+i7= zF4CbQFS6^trx7iJb{a*5PQL`_USSbuds5N!E%diZR07&BrhHJ;bRn%XPk`f*Wh)zy zJm$muUlZ@a0)DJipW{M=by4`RQ=O?vaG@jR7;;#iKv&=-&0q7UCcCsQGH26Lv`D!A zLODC*1d&6!?1>^MI<#24Tp&_4>v!0iiYw$ zC6YzT9WBK7g`|C#94|s-;QNq@v+_$K;$>LJuvA?hpE^ z83ho*zNM$Zv)e)}H^q)G!4u#LOdi+uEsOr_!z=Wgh;$OEN0G-IxU_weW#!;NKi8?4 zjxLwS{ZwS1$+reD7rMsY9%$h*tMcDFJgTy(|I9SWy2`4Zvy!3n*0QdH0jmi*sN~J1 zSHZ*bM=D-OTb_())us|dY`wcp5e~OjENdb0%*iB|6W@32*H+XlN&6V_Ii=M*$Fko`7YO+_s5djJXX= ztTp4={gxV4^Ys?gJ9dsJ03Q^Fe?J`d5}ps6`o3ucjAvGoR&L^#7bTx%-)Blemlh`` z-2%Fi7Doq=xuMOu`T4w?b!QFL41s^1#M}C$@Q20Y$06wp467QE;lGv3SklDgI;tFh zA%9KTUT{_58q%jr0u~?%h4{tD5smsoFvp`u5_JolSFq{YqrG$73|3NSPaJlrbQbMD#3nGp zqK%TKnRUlIe+rXpBh!!UmhuyZIvp;DULe2kAoM+BpO{__{s%lQb3IUL0UNg?e6;Q0ak`ACE%XVTvDg5GV_Nf! zV=@(}!jDJ-9%7>tUD#_2$#XPdw5NE)WiXbnaQ-PUWP^NeyCWb7ShwWUYe(tU6XYiW zhP;QL#3s$cs2*i2sKVVazkJ71c6FbO7*b7#NNmvgV$xh!u?cVJeg>mttY*KsPF3+Vo4=Gmkd^>|$Pq4)OGj zhWit%-h3X$tQk9nb=wQ(P@1P~K--~{(5T~OcGJ6N(!4N_%o5VPa8lYX;S#qRt`{UK zjC|zTnu#+`{Yy1A6H}R`HL@<`3IM*b>e_g{TY8hjBH~mLs7)POyo6E&dIu@D4sk$` zm|9Yyj3)|N*h`tY5#+PftENWf;Fs=SGsjulCLpnW3p#DxW$5rq{yYhb^R!@F9Dl*} z*+MENM5>=h2L|C8p_bpYYJi*%L#=o?nYQU>3-QvvWaqTgb0J1*fG&j1@k@tP`XgcKtQeS8}z26BXa!H zo6nrOey#;;r^`h`lt|ANXMTlN+Yuw6J3vu_r~DCd!TXkMe?PsPgzVr^5(o7s)aex7 zi51_kUm_{*?`f^T~IjT19I-ak)Q$Xx`k?U`CL7=k@S3byITMs1uJnDgD0C)#up zoui4?ETfM^BnR+jE4_m@Zg@<&x8gX+^N;ed1m~mz{eG8yp!}E!Rk5e7ibP-fewVF^ z&X_4e!j6xo5is+m?fTOnsH}LUjz4;@Xci#~S8@?4Ysd^kOsKR|#Ep7v5YBKnx5w-F zZVpMlEl#ZX!1?Kv(Wk!xJ1qrwQ}vJ~YVJ$L7v%?aRKX)snII^%N4hqv0Z$wBntbLg z@9i?PM=|FclJ`9~YMyF6(-{m*o;>+**%DtqhCh^O^XL3jztkeEdhSN5xzB%@-+O~} zqiuitG9(pgoqI12i*k^f?3&G-y%R;-wEZUHX-vKG{?*-w<+lphuL>i}DP9eh@{FEl zU!ppaOW0+v1u|(K<>TRT6*FY=6-8a3bSmY$FWGr1MwqG0hb5Ajz|ZK{7p!ADU;dh> z4q(C2GwqD)P%Csd`?5bvK&~-aB%B{}Ysb`t9@+V-SAh#sOu7l4=1%s05%o^|)QFS&J5Q|aQ$#JuLD54uH}`7`{bxN-B@xMo7|n6E z**9`tY(0L$>>I?^IL(5L6^=bYR^~fu>NGt3VtJ7n6tQj_4uTvF^auG~z)6XHPZV#< z95LeGXX%jTv6o86e9a{T4N|_pSiRR*N_$IIciYxb#l78O1}#e8bT%| zeGJSXTHC~kUPZvju{)~EL4jt-scc0H6g(ZUIv}QiT4s3bOp2L2jf^PSrt_e;4dfwbLg29XCJ+lwX!**ST#4dm}Oz9j}_zAXkU zKD?(-^qb}x(!X{MPSc4ZVpu%=l0je)hPl34p?9zIC6$f=i_Le?HZ{$5i<<)Y2G5~vpG7zb5+VL-CG&kEVwUr(WH}|^G z7#T~R4kcFMVRj^1h0tEOG)F-CI!#*67IXcAjY^*>>J{9GM5`>l4Bf!7*_89loHSDH zY*K4WR(C1I{z~_B0RZl){ixn=CRGXuvslN#;O4nb?gr+RYU0bu#C(?aV~U>azyTti zYF!lTo0l;1qMQhmfdG)8YIlcNQ*MuVbV>m#+s-;^XxEbA4pnC`SdZQb<@UCimG|+HwpSfY`z4C9HB%r%eSf` z^p3@CgMPZFi2)hWvkIc8ER|GCou0d&dVx5Lucd+-c!daBzfD}-A}iK43;ngdR6TfG zmrvde8}K=puyH;3TT%JT7xJvFoFS#9utI{D`x|uB^y9k`!x`|jL)`i9dXLV(4#6Mi zcL86uBGVUAVVy4{u7P)b731}*PJ4E|BJ}J(Wp*iuM(`BD^EA_WXQ3w z7NwZ!SWJNXnR4_}d<-5jm8Z$E>XC9~qhVMs-Ms>ZXS&PU!VM!!7ec{X9`Ww?>gM zVe;~3OsT}R7Yia5^#DB>6(-p4&C#X%c)eZMME*>|xg?*6WYQy{a5LY-*`e-Fws!UL zq3cS;N0VcDF2Zvkq}h*bQ}iDU-wu#ql#6PDLIhmE#(rf^IH3Ps_HC*9=EFzB*R7Gd z8icQZKh~&FB%IOjp?#*Z!>nUG>lyObs2!5zAAVjbP9Uww%q!6M!JB$mHu?9#+VTH6 zSr(P(2d6Rr^Ck}&5US<+e30>Pt>!JO!APu5s#p-YUV-5O!=03xGgX-+RQ$)u8lAqw==`A z1X!gIR)mG3k>AmH0q}%tWh5SL>=}`1yQj(Rq8vw!gD6qEY4p98Ve8ggEXR5=3Jq=I z$8O=H^Tia!w+Le$OBa!UzJ*8HO;N`W;UEFAP57t{_Ij)6LE!9Fr6>A!OA4C+I; znS+iqb}};E7^6{%Sf0yiuWZQta$M||CS<{{5INAL*blzo;fuL?6v9?v^WVl8*z?5T zDPHZ8mU;K`v}t^w28S}Fk+!%_4!|p-cVAQ-XumL zmC=-0!E#5R+9|jqtv0~0Txi>$V|Ex+5eVA!A0d{0?Tl?Ewi=xY5zluh_88(HEuu5) zZv$<7Ps_F_Lj92iLkgz!tLW~`5AtzLJ}n}0VakE~&tTq3Se;3ZJvM0kM6V*;&Tw>M z&*TpXvP zFUkw4!{HceDeh>n#4!vq=nK5zOHkH;XbwZoDn%==@+y88&2?{l^jX*%Je3uzw`^vu--y{E!XSgy9`a&Oy`gs6+ex?5cA=~|#<@t;| zWI!OaiT)J?_nE}MBHCTkV`1D8H8B-SXu_pL1knt96v)}`*pWht_KZ+V{H0`F?iaCZ zIiV3#Y_l6xdb_BL=&Tz89Gn?+WCjI$wA*Hiv&8zS!jzaj&o|4bTREc!bBP9d4CP@| zetI{kr1acq1zeeAH3*&1DowDxErckZd|U$i5Xt?7*38k4qN7q6e;eY~>zXfRdD5oY zvaUv~9U7qaKyAqW$LNx=<9rv6MlBU{tvx-0C5%dhzQ*k7k=A9fB_t59VLF1tvzaJq~w#N?`(2-E_ zmO@}N+yNMR2$n}As$99;TOQ;~i=4smLxvcY%LXTnqk`k5)#L=3*5wEj-{FJu8Sg zinP|lo}mE*pe#HM@MgD+Fz2R?k+7F=`&j5>D*xa=aE^4q50g0fIGMJyxu0jFGrmE# zN@^;M0u)y+&f&);zgU9^hs9t@hmJZIGQTG{>)GfqDAMWNJamJ;h(E{bp~9KTS<)%` zg+?B7$Z-sXCBi+%kLZL$lt0<$`cPGk;y`Qs*Oi1fydpq)Nk;840*X+^b;c#iBy@a~ zf_X9V)>U7Y>TUQvZpbDbdw^EUn%QmWJ}jD`DNox`vf7C_u->Dz<2zFW$&e!v-|?^$ zz(vu_muhQ7Ef6awp+@GFRlF+IoGWSh|H2Nljqy(tM~@^6tfI2N3@qeU^1 z6&cy|x<4PBbJfYefv5y+)_yz~V=<@aFn3_c?XuU<&kM8WB?+uT7V)KD1)P9WdAs!{ z=6*@iCFjsi4~SdLX36iJWZvo`|s#fSYgR)aovrWA$OrS&uY zPr2QK`hRy;pNS8EE=kIB7ohmJ<~FdJr|a&=)qTUVeNM7vS=N^j*XFMfB82zDq7LKR z2y#OE%b9nh*~^31r}iI3g(rR`EPr`6$BqBgkNr0C-tdHMh&FwWe#9=N3O=Y&UVpgW z{v*;lvCvmR&e}TZ{(IRWwi=~zmAV~Z_%>J4XLAXeGJl7-quxJqGyIIS1U_Laa4?VZ)=IxaHvkv-nY>{d|J^gW>Pt{nWBJSrO6Sta2e}P9g`VH zuhd!TKkFEEpt!RkBmUQ21(vo@!9$VP0TK8yz12fa8iCa7I|P-l{Yb{w!FjLXyb1ZI zj&Fg@g*2mWK}H(WHh?^00za#H-j&?@pR@=|hcB1jJ%1rR#wyOt{aVzV2y<7avvr76 zPafmkVCzM@=kBtxFSD5!loht$Qz7{8dD@!@!>%-XLz#ftD5Y^fV?un1bEnhoZjyJs z?T0g{+58}Sz#-FjOZm?tgn%dql&ZUca|q{~2gMaf zn_=vG@^6EypW}bMvrF%BP_4qYgX7ZQe}BwW^i=J|pCGlxC+~nqZ)FGUHu-Sovq{b9 zNYFpzF)p)~@CToNZ;#`AF;o~-I}MkN**b=$jsPkX4!pVRHBJY?nXQ5mr3sSul^Zz0>q_9cpDQ0*@L`@tB6i*hmxZ{-3iG|mtI`3F%2b#t&Gd8_0!B6~34G+CtY zSuj>iI=8j6bewaHl<(1w#22nHG?B=m#+$?Wpwhi}gm987F8*n%`ObWX5ZhT{!&!Uw z#Hz}(y=Txu%lG`@Srh`{_mT^4K7H&|SOcEN*>KDaTIX}s4xjRG?TPI#yx#wXa`MWl zgxDgOxy(>$P(hHF-E&@2^+i;?`(hfC+!?3uTp3hXZAT;^bD|0Az6hP3mqkt47wny% ziy^;~GUI~&^}Mb3T*x7V_jvJZSO24*u(D-w^wbVhgz;#->8Tq24MgAhecjyBHK~tD zBl0$qPt|fD_YS#?`(S`Y<$y&4`&dgEy)3*wLb47h@su$GVkz}*bHztlQ;5|*GLS^e z(!XD(cU}jUEJ+U0apG+^!-U_P!IunPEPTAcfJ8-VMn;2yP#zlXlA~lOx@2H{=?DA$ z>PrWfr*{fdkraXgi>igx@`>!KM$~G#&|2!)0p)hG|+(MS{;(C*MT{oFuA)d=I zpDzg9T%;cvuNG;2;U{L1dloD!{Em&+6DST5V(El-?x%krY)=x)+mXz5a_5O^cv4K` zyR7AF?O*rGb6Cp^W&N4?gT{M*8iAH$ooLomzunH}N5`BpsRQvt5g~yI{x*pGgJwwZAxO^P^louqQov@epx=*{PVUYEG zXidGqfi~Vm*)#ci2!fu^gFJ!~@=&Z4=smjIuDbu)LI(*B)iF`(G2cU%tk=VC!F$)th+qgQbVA)*%3U$Wr|esJ_|-yix*yshHKJo!Hsy%0o|XO_=&o;~ zZg`Dwg3lOTI3 zbDI-Nl&4(sKbow(SVXuudR&-u`)hIw{r$0wRgAFEM)Mn;$!Ka9TLXE_W6Zu#;~h6` zFOLD|F4r_zU!tY&GoD`{beL^~lBPbb%OvPz1*+o6pOH+OmBmD-8A?wsruwqUCr%vI zX4a{-RJ|jq69QMASalwR)pZ>k1h>`9 FqS7h1QGRwbFHSn=nB`je|BUf6!eq0L=wGk3b5o(y_R*{%_k=@HaHE30}xjATl#I8Z(%~QNNSP`eGPPIhd#F7UbFB`EnM|*YNfn{~>Hs zB>Esdl7l=WTy~7#$HV*JR)5mm*&cQ~Ub` z`eXn^=^99~L!MqBRWq1A@oER|;~fg2q{xlo7nvUuVzHy-dwO>okciHjt>-mY2V-`7auEh0Drjz_|*9y0ZX^y_W(gn=OUF3q;r}g+>qt*+y(g@qFf@7g-1{owYILS># zujJ`>zIAlJ8+FwTf-JF37F-x!UdqQo`1X5dS!^_qRH44`dM3W&=X4pU2lJnVZQFiO zS!c3(f~pkAu>8;?)oww@g5Ikqe^d?D6;%loPhIfDVS{Q|buc{S;`8`$P4%ctpzDIt z7KsL^0)Jfz_Q^*$^TBmotmwIBRcV5jOrs-*sFmk!{;-3YB1p)EP~qLLGi1{HGSvHD z(wr$>PywR0CE=c2fcesCKnc0eaFSmPGpV&l$(&*mJF6h?=}Epqpjlyyfmet-8}XJ zk~`mJe)JH0VGYROm@` zci{E7O+1QtMjy%Az)$!weV7CP9W7}LV7~Z#iXgV-^lzK(P8-vng{g1yJvLBUyxhv{ z>O_k)T^AKa3BlZEWg2USmt@$i#i~-2oZJ}QjssR5C8xuQ5G|*KQS-P{2<@tE8vCmw z7`QK$q=;KtyQ*a$r4=@-n1C$xuJY4JUd>a_pH6)imD|YGnJ#UA$9A1T(VfzLpU*Cj z#E%fKdUaUV7k-V}KgE-cG26$r+%bD)62FE<2ZQYZak4VFNtR!9KQIUH029EW7&DY8 zt$yVO10G18$h+Y@TNsJk*vxfJjnEH26(G3@tsLsFb731v*%+1a0ls4evfW7Q-aXY* z5ds0A!`yejA%T>%e>BvErOU@038reb!VNp1{HIChqLOUq4MU>gg$$wldL^E~T3x0& zh0h~prtC7vJ)XgAnp5}`IR(867;-~4hhvH78Q$4W0m zj!EZ^uUe}o)+!uP@S%zqkY`Z<$xr=0%s$R~J2zLZZA3;$yi;d)=Q`8|#8@GV#k521 zd{L4w0dH4%On;S=f)@mBl;-uRp#z~apYrSs9{NKW7;j-)8EFP4ZkM@g-luH zxI*>MF!rPG02u0phR1`V;-M`6x{gj@Oqm6ODDD3HPr(>}*G1UoKa=rAH8ertx*R$G z7sbGSFc%tk^V(|;-(f3MkccC4=s39_*+LN8_p&th79~{-0)Ilj!bFTuFl>ql=W+&{ zw~2X*?nTH&+(iWF9*18+(>LsT=hOMC@@C-vF=?8Glh{3-!P1%~WnShp95aGUzDUt&*z{PvmH@y47;_%N6LA zV^TnV_1P@`2ncM~R7b*Yd@R(>8?2vZ#>d5s?GFf*@j3T2_1E=kjyer*R&5cGshByW zbW|4;fOB}R%f);sp?F44H4~A~5{9+39ui@!|!&j$zU5r$e#Yi#n&W+W+cL8n#Vs~xd8}rjKdkR0IWV?bp!4BYV6L=O zS=CZx{9(#1#bX8oKDIN{1~B^h>fdPX5M&mOQ5czYDQ)WP%KGM7=7|nUx-dC^8aLol z7RK|WH@YgD%T8^3>c+Twv)644yg;%QuIF+!=MQ2 zGO*B!-nVgYbE~q=y68?r8_UtOSfTCAT`HGIpvg^ac)=QiXXIyXLuoB-yReI2uk3m+jrd>G?w#krs?8 zQs1^)Pj#n6Fv^5o=v~`paGx3R*Tdw&pGeR_1B{RP-z3*|vP(kXd1cyh1CbLY(NG%? zBXy{5;&%7(6sI0hzD;OrBG?%f*wukNQ{sW}-)?9zaGPL)NR?tZ2YEu^u;g!Mq>)Vw z!_ZOV9rk^Qa$CQTCQc7H72+cMm{*-O;nEiMdxIerP$0KQyp<8_@F7MdgG>yvEPH6R~z}GQ~;RMxnA0yh4e2?wFtgXsKLnuC8Yw*SU9!Gaa%Ni99qo<`68`F`T!g!p&eUobv@rS zsZoez_@Ab!W<%**@T#36^C7I6#1nirK>Q{wq5Scb$jP)>Z|>n2olu6oH0Kd!UiysN zaPhFjDKI=;xiD@RE;um7?iJX~`|2ZrW79fllZ|yWD@}{rnAjmnTFO4yLiG7daCF$T z3(YUKIDY<+G!=czvTR`J%JW`z&Tp3WFjYy-z!Wj;|EAYR-RldEWmXKj(B;3{5M<=+ z_?&Qrj-p^#DZ_VM+>(x>;={!K;l$^V-t_PQ1zvGUh^8~ajx#kHM)N%Qg`{v=fud)L zpTSPR*phKu_hq^wVAzDOogKqX!>Huh{5`w9T;N#UuKokUa)a`QK2C7z@XudSh0?vZ z+XzI-Qkp+@(40})hIG&GKSxuQIhp-q22)=b2I`r+&V)mKju(*%XUkD8i>wzTsUnxo zoOcUvVMdk!jPA+OS5uf<=`*l!%IEW^>#+3kK=7cQ{m>*B*q*AE@Y~mpRD4Bo-@qyf zR|6^y=iFU}O}$z3OC)7{ou7rDEH2}^sF{v9Jd5JWEP zzW1WNLeUe36I5u{9nVF$bv>@<@p~egWwb+LfTIm%T37eBpVahTAuXaRB-X;Jj?fbb3*+$UAj4#H`eKErcTJ6}|E<*es`ByD*A9#oZX1`f z8dejJ#Dm6Hi*T@QiLCncDoJIyfff|~h>f~-&It8m$M1RF~)jhYWf>HNt2ocjz*<<#U!s5np|dtrc+tx@6pm*Bx&U-nn&)WLFq=@VCJVQS@|{3|k@*3$q>93FebW_+gYx`d?7gxHKXs z?NN$nqIEG#WyfayC!ZsDill^|;2*iKuYIT^2tt$ipuV>r@R((45`LP(3VF(r@#q!Z$Qp2BuETAh0?E{9Tgfufj4R1+AnF8<7TpZo zQ<`n=%hxZ_1r_O=`>RN*Q530$^eYN09$MydhDUQ%ORyuPsuWenwJ93cVusOwV;1qt zP|$HVJpmUq|CvA%{=Y56U^F+T+ zV9&}|n6JlfGdCyCKO->)zep2tp_|Q1u?V;xysmD~n8{AG_L%RS=eF{UZ$Bh!v%;CtwWWjfRa*uN}ScM_Lm*~VA=pJETrZjQXA#hp zSP{HJ6?q^y;?T?L16Ft;rs*K|ng04wy{J!yeQ2Z_8NVRk6W!Jg>fKLJm~sJI{gNJ# z{0hc6yNN+1le>C-y!3efuS3X~K0~En5%0j=X@%)6Yq@FJ_>Ai3J!gj9Tl{CSwMkUP zZ|d3|=B9R$DMI^C^Vm5-Q=-oyAisM@DzDbAO~K%u*vv{;n-kMdNXunlI;I z=e?cV{5{}YuSF(=X&M-C$Ah6$$iY@yx6}Z$D_o8-*6fRt<^>YYwHAQRorFM~jcp~YhP?*2_I;rC+h4Xdu(Z3)-k$!9c0)(=}5pbCR<9Uwj{=F|1 znM~0Ph0@#WnJWmqFM08^9{-|o0EZf%`}5$wu~g{dV{(#`_iA}cv0HjY)0AkDi~G>+kS!@?-OCDfLyX}c&=Re$sqS(-Bs`(TyElIdvHBTXC1=)~Me@ua;97^U%vzdZ7bOl5ZbQ zm7bo1J2O3stA~l#M#C7SEhYt|UWmG`_Z*R<@5H~V zj>Sm?o@&cMwoI9Lq@CXU0Sh#?TB2#=@dxgmr*g@^+_j{X4%Fi-3!?vn$;0)`U?7kq z3|S8881(iCOjr_F_hEvbOcL+RwfS1y3`@t(Qb&^NI2RRX+0jAXwC+O?tUFp8Y^wJ2 z^}e>CJ~xm&dItSGng9kThzZAN6Vd_U`3&4YSQQrA41&#{rvpngbk0qJ#INircf25#>?W@ ze_7MBLYwc@W%IAjcZZczJLs0WPoC}+A1@8z_WLqG z9i-leAG8fms8a^~ zHsvt1G{(8xKyfZqnd6xS0V+-)(6+|U+uqgw=eQ$L$xZ{~ogha2=M>Pvk6(P|%9L`; z;uNewuMsIC7OwF9(%d`Qt}UNMyFOQtbL_{x;8C_yQJW~aSordf$_a0$$N>NFRo-$m) z-J|k5usJJsu2X7<+atF*$GSKiaL9lEhue7!A5*5{`Z@@0>|W0CM7LNiHb-}~aZ+XZ zg@}#H%Uv_}N$`Fg=FF-yPpyM)K*+xYy zzn(Y;ep@-6r08*KcE=f1>eex#>MHfpexeKG1GX~B*obd&mlXW*Bv zm14C(4X&F?q?0{dF(r{wJ)+8cz+Od(_TBz8q{2}TAe|K!%V%TfR@DAU(1V;^74IYs zZ5>8#ZmY)DG67ao&czWi@Zm6K*9ljMS6g~;qXQHPV$e@NgC!I*o^C@zmYh4F13-Ym zU#w`t7K-gqyRb6*;S;TmKm}Ixa1bR_sG{v;BsPYVP;47{bOyhozB`tlvnFsJJEi5< zJyS3@Al*rtJ*qC4Z5hRN_*pKx7q=fTj*g;;n@k!WCx1%!)C>O8aZ#-w{=IQb^cq!RI9duawx5ZB#dR?`olop{t5F5J;KTcS5 zYr8T!^H9+?#gAbDNy&V&>NsZzj)4MSx*W?(e8?Mb@yN0{T|Zy)!qOoUQITvR^H5qN zQ&88uFc(>28`3r5;sU}SX%1!LOj4H=&@9V0H1iEZ(+5ijN=Z&0RH!ZE6^kcpbM*>B zJ4N2biVx@b6hx|w!wficRi~xB9mtJ--2XAHpA+#mo}+^~W)BO_eJf5w3;xiPRwToi zji?j6LaTL^=@Y};Uof@f^_KUR7Dt;6i*b(76;`AY3cX7*)-0fuYb-3XPJdmHVd(pV z9O9e^4jncyXzEc}<%?WRKJnip+`6vqbN^K2C4dW#k-Zp}+@l+*Aa{2G%3+Yg9F>O- z;DY}U_OK%I87ZO`Et+t=$)RQ`_)U}DA;Mv!>MmKe)>O4E44#!&sG&*C%zzGK_dadO zA{zcI4wF)C92>T*hm3ri#f04964{6XAN&Hhm~6P9h5S(ZsP)8Y!{-mIUqu5I!UYeL z(4#QJj8AowB4Sv(SKK>XSrnxs?%)xoQt^cYJ86y-;l0<)_rU;JEEjhoH)zk6DlD0ouEnIa4dNk|B%Uohy?O|lZW-V z`>hCtEpLUCd1Qbr+%SSkujxeH3esRvtWQ$iH_95;_2E7Px<}2ws;r8mLro)`p0Fx4SP|)8mZuw_f;Tu)qe_8Ewv|@ zdxU@>SpuKt?GCEUHjio*Nz&rjWcq<|-ECXoAtQ9!yn`1uZh3)rN7^=hw@vZ>IC;yP zS!l#9lZ(byV*R$5om3QZk^O(y$Z-$#6^{`mX7#)O+5T{16leqv1B_Jcs~y92RlFnB zNQ3>9KJSl^4vu9T13^R@%HO3Vr{vT_W7!BCXg;$QmS+T@Z3t=R%Is+#b6AcBAJI04S)+Z*Nc8UU zVItOL7qa$G#ZkhkG_2r0O@f$dhqaTWibyzn2k&jV|LZ!IssJJWqG4zn%R?;or@x2D z9sk+Vs@`%XLv+?Xi|>6xafm)0`88o51x6TD^m>a&$cmdo!X>(xpj7hZat%_3M2UOY ztv9+!QP4Mo+2QO~D8?d1na|kAI|vL9OxWfV!SSB$3-TKw_I~nb?uflr)d&uwDg20_ zq4~iwq2;|Sl(Ilb49PrDYLs04Q}a3|-<#r?15DM+6B1P<^is_(?e^UDBmOKzsIWHz z3lBvs!)HKj54Pd5))WAa$$D~_a5@-2h#SCh9%pDDj@bpH3$o7rP-DyMTG;*unn-?O z%HzvS>pWl(Q6QM#dOhSdfo#q0Wi0R14<}3Xu5IR9IuDqcmEAqc@)Q-Z+@ku$xT=?s zrBFC)3f-kKH?PBafpWFBj=JLTj2eZ0rFWF1&+s};n(^|eWhLeLeu7_jkW7xrdmA~U-E_pv!dQN~mrh5htXJC^)Tm2(!N+J^h6qxL4b*Fv8%KP`9vY3epy;NmNL zo7{ShW7Viz^mPxRI%kxt`nTTmW`H}n;MlT3L(Xl!zsTNTr~I~snI{)2q1gEW(f?l0 zKqOR$ddcS8c_VESjENdS{-qFoyI@jv7Wy9qSZtxUODM|hYz6jt`QQ&L!Yj5Y!)!?p z(+<<=BE5UoeESiB%4Q{prMZn;>iism5c=?uLU5pEuskWG#(9rf5!k#z{nl6TewF#3 z-)B@|gR6D$gy^E=`IJgUi22WQBn;oh!NZHjmp%w>*+FCBy>WxlSiZC3XL$d;;395i zG`(B|4_c^T0o5~vRPvGlBW$m8c%LSCKv*sM?d43tBJr&>u2k@Vo(%`c@e*3uMrF2! zZ8p~19O1fP9@pZVd|H2HS7#iyc*kQ&t#ub5(|sMrn)nJantMZ{j{-S%Dd68OQ71h# z_m3Sa{ zX`&i(Nz`Y9;vAG%t&(8%FW}gf&M5AOFViHe55Q)M{M$(?H?1qE{n&>o?`{oWg^mf< zqXq15Um@7u&Lhxe)dVxE0!_yn6>in~WM=&XC8tuCaf2lD)MNK!*Pv+HqJ&V=D~1d9 z*C9q@@|<*Z#WNY$$aJqQ+y_TxAcsojUXj9+LPW-Wf%J47-;Ty3B!L~4_le~$yA_S! zMxZ5}lb4+#hkn>eG-KS4WZz>xUAV?J8dyH?3PDVtGTxq(tmRyE(gx}BmC`9NdGHdi zVQEX}oHB@+C*Aq(L}F~gS)*Z>Ga?D+&{`7#0vm5&>nQwtbSX3e?0VJpk60DHr$>MKd#4v z{xF&I-tJ&h1Y|wGu}?!BgkvU)KWNz{w|q5;^|tZ0Bcd{Yo)8GrrKg7MNPID5`Fh1yzJv zqr7@8nKpkpwxZukfIayM6rPNxfmXdDr0n9OIsOv+izOmJdbjNL=ufk6_}rY#gtCNx zAqk)_{ZBm1Iw%3t1{0~rQoiaw-XiiCUfFGtpZrzU@JAaR&HVg{wmOx`|U+2auz&zIlC6em#>%2+^!zkyw;$3~8!q(`}SeA%m0pc|krW8Xi^u zPHc( zHIvTavMtQqP|mCE5-rUX>b^AZ8XQv8n0zaa6jRv}rtg7!PTJ*j*TiC>`y67bOGO+h8rjwY|s#8Nie&dAH77MfhX3Q-gX1 zDE+xW1pFuCHF%YNKfe)kkM&9<{U*qTieFh+lYS<PDo)<9-KQ? zM>c_9=TLaQ5^rz4Uz=cUpLh*${mRL_<;5|erwn);W^c?Y|FkWLW9yskwr~GbCmMY>T4oM$Vbj5<)Mr0hMX4JKklLjJvCG>BB`Jeqh)$b*z zOXutJ+d{$lfqz4L9-|XY&J3^43rx9Cq(}2VWY~U~QX@p)& zTM&zH*%hS<5_&2TJwMM_Aj6HKuTGFx7_JNPvOSD%@X|0#w!?2~8-vkWXR|2qQugt_ zf4!dgXH7Tca?GYliV=W}LgydfrTiI9PF2K;S)=8LF4a*ka)3bkP#8ubNT5v($ArWllP z?b0S@&V*@ig!czm%n z{cI_vy=Tz(Xf3Bgi1%@O>AgeIH}=%4wIvC zKbBq}HA}7q zIiV8pHFS0@Ii6F0y=1gL|jpSd^y z?Ej*^Mp(FY585cNu|m3m44K>HE`G@ldeFe*tbI7Q-jry)5LsuFewJXoP} zZi{Hf_t`F*6HWVoWX{bX`!{q-BARZV&0!`#&~+Eq!j+(2#2{+=+JHhMJsIofN8lF= ziHM z-uk4egOKka%|~rPlr%W7oz#J#^;utWI%xCD_tG_;NTBEnIwXdr5o-Z2g2vb5hQq{; zfRSag#HRoK&@YK#$PYqB+?T$kS>r>?EPLO7XtYkvzb_%|K;Z6?1V(CvP^=)65W`k~4Hgv~eo>n#_D z!&Ga6>SHDmEz7D7b4nKQRG#EoURpUK6Kbl0nWclXtKx5oVC}yN0l@I+H-ogjy0TTb z(7-Nf{Otbqe>;zarlaEc)?-^c>C{vK`KybO?3NOk7<-u+#(GUDU3cgh^l9@AcFN8TG;QQhlvmg z?5sjY=T<*qal6Dm3wYKwxAy4=Y!oF9>|+uo|IzQ_7R_xTDvFu89&e_nN#Oa!yuHLj z`rBzL^^%*k@hgO+l1oUQN~EYZKjxe1s)tI>+2@0jVxi);ii#2trBq9Rl0h7z=do;8vEawPKadFg16^xs$b+bWUK*?~t4ihcMczTx)NERRQ; zwN8UmsD=Y;ZzL13A~`cm zhAX+LhAYtP)iLs1JjgcD!H@a2yKlLjPmr5q`!L`QJ{yq`mlo1J`~eh zrj7?2JMVUJRZWlv+N=VPXfcAqotQLDxkw(bgnz2Bfw+B9H*Wq54;xDpG$HlL_gNNp zG0!E)+1fN&W{XIXr!`#Tcfg1y{6vO>gYK3bnd{5YXHP*x(J|vvQgTF6GMAttJpiSzbpZQz0gew9?$l;BouS>Rc&oxU~Ir6mwH=k`-#%EE^5n7DL?aK6y;y^pm2 zVBv3i)DQbl**(U8^A)h>a<~4SY_-j~rk|On zYwTI+rtERJL(P@aVit+fM5Wl`A|eTYu$D^a|ooX8;J32Bsvuh}9C9X&vMI6zTdI8+G3I zsjr=?sBgAK`4&zl9f%toiViXqqom23u}#_!c|GPXvO9pKr;7k>aSLHs!U|1fnHUQvC2xTYDpdypQG?(URMX^`$1TKFQ} z-3%qt-6bFhLwA=*4Be8F>K%S}-L>wYFmu+~XYc)a-{*mr)-bK*?y;)T0^%&%bfT+p z*k$ed^hvW`iqiif> z40%hG#&p%=qQt~j+Ocu#>tkD#xXp>X1ZSo;j%BOoH=QjHBU`;>V)1-&bWT#Kuv#Na z*2`pymAdw?W_E(zwAQ|}*)jXi1EGS+Hsthun&e&xkm@RnH~2~WHZgbuVLW< zz+UaaWwPh-NcD4qoG0{u}6AT313bBBAfGFWB+DAs#2er1F0v{5A!A@WF!c znT{aiY}uuMr7N1|)->b`c$~SfY+Y5^jo2)HLB&^Dl~AP?TpDokDI0`}BxQ?T$ZfJW zG=USO)0*;;g-=pSGYDx?G*^|kk2A1UU(yy^i2=Fu8PE%C{|)9Z(HW$d)ik#QvkQWL zmcFz?`ggF>3uQ}U+&!^cUQ#rLwr;tj%?SsOc*%^Fmz~$bX5RBs;wK_2?#H=P;4~ha zg#9{BPeVMl*wS!8BPM8iHeYmq8FpV~7DZRn2J7EQ(_Wu%I^cp}8{PnTfpI|Z zXzVhj1}?3I4+!GvX>P-ImQBkgCI3nNzIa(_udROmhd1-jLUz^=hcS*rkcHUry;c}t zUdb`Dn1F}@U%Kpl;CI>{>wcBu}-?8n96sa?p!gqclE`vkPRB3+62QnpG&{3mDY^>{P36@Ix@sF z?~>soyevDTo%1|6gyS`w#aQBs;84_b(b@Cbr_5g3rtJLhjdUroH1j-Y0o;p0yku^L@z&r-Ou7@db z1*CH66e;6Mg-&Gd)C|~*?^5*Mf!_W;7@IGYI6lV*CzSkfkq=Qp3q`g;7V%Gez({$7 z2c-TCGE2@aP|J>Lj_C~s!6$uxY`Ol+Ne+9oK2lG^QBw=y=lfcj=ppw-DnB}~LLB|omst@XQ}epJ8{T7N4@BR3 z-n{Sq6|mBMomDFS5#<|}(%B$!qkhXXe1gPjSp{lOy|it_kqDiy$LeuO;zkUFF~6-T zzcRbqecuL1V;8|KRH5_^~UzbZuIK7Yh6B3Kx+oiSH1+?gwc3`G{6>4O%>`~4Byl|#H?d48gc4?R# zh$nE=N!2+YhPSPfFGaEXDBYQL!;Q?rg!&gQj9%4Ppm*kI2{Mv%u9i6Z4S&h@W8OA@ zHJqz$pZRa|CZ7=v1#y{>;_!8XwPf(YwXGRjB-*2#x&u|Uj_t?V1Y(SjeeLT&u4T;V zqQETcLBmr6d09ylDgo!Qwu4vLNSUKjOOLKzUfqY>8wwvs<=$B7R%QQ}Z~Ek@`wgx` zxQ?#Tdsw5-i_U!@u|g3~I+(?`$m@qFt}1+npW8%Jg)2nOSBr+j}|`fPS1#%?|Fcl%xnwjK*!1+b)_MzAXOnl^D& z*pj%|3gHhjKnu~1Drz=^iQ3)?0*93T=Ne5{xh_M1y03Q*b_pq+w)>U=B#C$ti|*M* z-c)g2 z79>!70Hh3;ei}#=!y-z$JsKYD^&1h5{qb!6J(!<_-^*w);uw7Mnmm*lgbjS<=SLE{ zP3->n!=sn(nC@Nnx?1uTU058RnIt23zZcA1$y-(Aacx6ByW*yDfL}^PP>#>->!7LI zJQF>QY?sSE{7AYrGBFeMyG7i)H2@y*70c#k*=FEsk~IF0+)NlGUf0B=3TBkTg~m=j zV9uHyMt#njzdTRqcbm&+{DPt86+Wvla2NltO7l}SS$G06-=POPd+-%mFihAvQ0j3^ z)A*ed_8b#%Wb(>?G6MZ?*GiAuu6Afy*6KgFCFC=5mO5Yc$QlvYhrLdW^f|`LyRUbL zq~TJtFq|PLonDP>PSyOH5DTDov#{-J2GC-iRBT(M^X4g#rr5pANR-zm5avKt|7-=E zia555#|~h>mhZRW3_aU%F*M3MR7P`K>yYAGG1xJk>0@_t`ydi43J^s!{9cP%cc!lc zv3PVd3Ok_lsK z`0U6|0c7z9DzA&TP`)1&Ufu)S`uAsx!_@(OAxjGS^W7X80}Jrp?A1ysma+zW0%@Pc zaW03d#yPi<%CH2=@}P z>&x(d!LPuI1q3t6KH?QXyha*{k`TIEN68uDw=|}lXoTtk99hEI{3iGQR8n>0p9m}* z2|q^5GQfVzM*Pxy7(ip%^iW4bYJpj`%h3N6NogbvL;e~?qzk(t-{=y`GrJ2r@taYk z54@Jfr!e0>!4G`N?)3dUhKAmp7FQflwQ%x{owX@_hU2~(-m~W$JNlgiE2TMl-QuyP?2xg-CK> zY*@oKz91$kPP$S0x>0Fa-(=58bG6`z3UQ`{>IvT;J7{(wuJi$hnYDe@RYtY;}S2Ha7%u1TB)QdAwi&wAr&PG>PY#toxcthKHeXhNR!3Iy@*ztp*ZVl&q2 zGsyrTr>f=fNPsZ;aMC$Jh&%^-7Y@I~7bC`0{z6&@M;kq*>3;s?w2mZFGH5!bw9zsh za%T|<-$pPQn<4ZFnQJ?J7C;u-@P7)zaZhyqj%|pAel-vFgeTUjyMw1biGw^n2(fNLg$(Mj`u!>@Y5V(Lwp(F?%1dKeLvO_{} z##Rb!04N$E$Lwj2!uXy`|JKJV=K5jC(FBCDSV$D01nm;X(#q4N_rhwr_DSTRVs)tF z>djYc;&N!ADg7}^V-Fn(r82FzU#4%l7RnZ(LkPFPqZ-5@x9>4(OsL)yJ9MA}1#n7| zo7j?(1w@+4$L{A6ouZiPYIoLV&+%V%7^X2^8P+SD6~ssC-~09h$GQRs#YCLOa#~1g zU)SGC21c9~D-6JQr5S?;mvgUfzjZwuArG_cTo#TmZ|)#;Ynv0RvaBL?S&Zilv4-krJpPA zWsnhJR(NNkZ<6RmO%=(e4U}^bWgc-xVWcIp4F}3si%Iag5|j_gxA3U-!uV8lh&RTk zf}vxV^0E556r%Rk(VdLtHL)FfD*`<*gLtdhkffH~L1-dQPMg1^jfIz8J|0g4&v*#a z*tji0)2h)me;sO8vJr3$KPFi?V7?MT8^0C5PDOuS7()7GzuJ%cW7?ug9YRuI&CPUk zM|TW!6=+QVz|$P^JK6i3jb{OxK*P@Q;{8aWmu7vB5T@#%$(M4>niCS0tj}gt1wzh3 zxQnQTyT+H5V{1-jW^93sBiK2VlsET}k=EIg^>MpK zqsXu1RAJ1{#UabsHl3}pU)|tK9n#5_)NIcF@I9CWV=iA6=O0##4fp5}RCpZf@WeSE zy$o_`Bdq^GOyYhFAj&FcQqtA%-XE|5S*8W{>CF@s)$3OBWehnaU3F?x^@*=6#*<2R ziG+~j-DSlwhGu9Y4b>z;PKyKWx@HNr@Lc@g*Uo)C6!8vm?y=i; z8SQ)XJhisHd@`VH-)FU=v+wq^)=gMn8Y?F}j3g0TXm(ut#W69wyp^_^jr)A71z`2& z(~679IFXODb4_sG!kG!s&bVOU(Vdz(q>w(sRCaG>abu}Z6H3EV{Qp=0ZwMB@CVDwo zGRYY!#kcmL+hasd-#Cp5J64H=6A>SZC6pH%%&|=(+@4Vj zjeT&k%EgqW_*;Z>%Fdhd-#!JDe4d0?L;KKDQI}DZIx$74Ehqgrl!HT{1n=(rBWheR zv5cZxLar$kw)vp%ZU97-c}vAfko4BcyDV^=kzWAF)I=SVCshPD^#m+o7%Z?ZVYrh^ z6o3LP1y7sP3LjjG?0Ic+!JoO~;4T=pT$MB{&GG~J=vcY0+;d&CMW|NowC{Epq(hg^ zDCL2w80ls_NR#wLM6#bpnEP;m6y&D@@x;2iGW=dyGKf_OBlfmnelO{4XdxIxm+L)t zH06B)nNmavs=>kCQ-Qud1NO1L0E0VriWrlA9DCtIJ!e~IeJtDCD4~|mZkP8i?eqOj zAXWxs`D_6_vW5RBDPeT9TCLOcmAmd@)@|p#vPc&+^4Ne-+%|A!Jbx%;?!?VtHcT;+ zahl){~7X^#}6|o42d;)V2V$9=$vq6V zTnrcCwGY|VTWTeUxg zPXxJvsvH`pA4dZSP%b}xSB&aPG5K=0124NeOT@q3!6uqc+q@K~;f|;5r#CF)M3H+) z8Dn|q%>Az_qE8|+!46oCJjr90+vP;>6cvjbtmH2gNHEl->eC9fFR(GU%(5R8uDuUQ z@oV~CK}n-lCkIfdA*o`F>%i>j!!g;kyEg#^*u+>on>wq z{Z&F?T_gN0k)Uu*A^N+8S`joUA{iXX_aW*7CKPBAW_K@quJF&w6 zq=?i;Vzd=jhLUJuQhtCTd)dXLS>cB7^F=5t^yE+-sMJyjQ}H%#zL%ge&!4jgHFWM5v0IME>@g4)ej=`%rqcDBT>jtrgrzZqbh(8e_E``c zrEpUqpBl>ICC2D`l*zw5WuP3hkWV!^Qf1n16yu}?FZ{quRf5y06j>}Xv#ggE+|$3V zl>~zZqcJtJ!!y&h(On%4TNR7i8kNlxmZAKGB2_iT1})&(V#U*99V6r6D#tU-wHF=~ zxUZuu-mQtjkY573Sp1!5G`2FRp~DoBQPGUchjy75rX{*~RL&GZ<(!l4t0 z+YFbna}ZH^yOGz8_9PBDf2NjPKVMH4gr?gc9m_&x=9ZRX4ZwY;U`#4R8zGVvyIcK; z+!FIK&ARW3FVSt*gOW0TUrNw1$qHGXM+z&k&zDEycD$&Mz}lHHdO)-s{=>TdJzB?O zM^9k)&h1%F*oC^3Iu}#15l~rC^*DP?^?BG@^wb2H=7^7g*>%KyDI4Sbk9UX2KGZs5 zwEXNiCQTl?fMRi(_NM=u6%LiY)OqiIrA7`aSE%z*Z&*S6{rx<;*ogjot)0f6?7P#( z1Vdd5H;ERL%+#Ua(d4_x$I0w``q_8AFjK2+cCy#tbK{|vNyz~|&Ylo)%p~nL51noe zp6=NW!%Ew$;DzkXdFl`=E?}%S2sWAv2aMoAr%xB>^tEVc-vdd6IR?F)t zfG;M{>p#Lr-SbbC!!eL6;|tdm9(BeZPtKg6>Gh8=gImv#xJiZ=oq>&CL4LF^5s$Cx z7kc^ zrr!hG2V+N-9F~>4zS!xzQBeS4yCgoNxEyH#%&Jk@<(u2IXFIaQZVELKT&+O^=sGI+KdBd+4QB2 z6R~9vmxIv`+7ShK!R>h-#-wGjY!bieYJg?7Z&q48!fqLe70Zk zn~#8?1;rpg<;8s3@csrpC~1O?b$!v%BU4*)o$wX-8d(~#*bQ4(Z22^rwGG){(!*pK z;jM?O{b<5|hoFo1ZA!0HT|J#PFkiwAb=19eq6_q%N8d&yE@0?@BTN`P7v19bnTqyt z4Seg32bHpQb>DShS9UDn$tePd1+G-T`QbI^l`G-(wLAa)ku9~UD`IyMtj#mw0Hv^ zC-=s*fo9y8zyBL}SMx#OJbkhY`$#|z$TWfW2v6)DR7?zJ__FYeph7wCg{>7l>B;6u z3{2T9yMIMf(!3a<}2R6$GV&76ih(cNr1R@C^a#1}-)P}=wV^m;f5?+h!}P@s-Gj&*Bv zr!V4GU?tfu?%;};pdYgGW6?tukLrFb2W+>~01qlnY%H&Jr@R8$n!&`Z-bQ5QJ~;~a zrhkx9dKzQCo#E3;VT3f7rT)sdOr~=*p!GkBn{?oXGlC7gx~YsQtE}N*v2H=*XK(Em z=lHhx7H8s^Hq@}@5x;WcD)24lh)1b3q(rv2z(h+Uj@yXQnjaO_=_lxyjiZU@(04h8(2A6SC9pgq*|4|S zEW|M#lO&=bZ`FT@&`?RsZ^Xzzw^(41&z?9@&mi{idsvol;r%3&$5f0~Eqfwv&+W+b z4HY%w4%-=PdCHACk@*5blUo!5og8^TN__1M|AC05nK;mk02IQl%Fq;xG^*pdh|}u9 zI3p1!Dc!{yI-7})+TZn@JDuU^nClre{~kLXTd29L9R%?KWfmVpzrmuYx?%w7lSJ+8 z)DincM1af9IQI~2-Gw}6P9SfyO||#X73p%PcN+y6tY3zyp~}aDMIE9B!Cyh9-mCc&w;$6*m}M z%U9dYKl%<8-Bj|AMMTy7T0yBP#$eI1Ru+?%ewy?)KwlUbmAovMit>sw=e&x}WW1?v5f*YW1`7{scEfYy=y{AFTr)K> zB@<6Iw_l8I_lTzD7zm72*_=`oLrS||=3bsuj*69<<<0ILDz z&kCFZUfzyww5R*wAARU(+f?^rhiiO>a1FxRqYQd_#l8`Yk!Fw2*u86`q~##Bbo6vvngAL&(jfI+ zaiWc=(lQw42^wa!z=2W4FQb!z6#OTIt`9V6sOc8Qdlp-2%8|Yitn6_&q2=zyT!D`= z;UCX$6o$#wBY87k*l>fk>v2;I-0ou!m;eR@DA-m>sJQ6Y$1Sa$kRC)?HL|z2yWP48 zA?j%32bj>qxCnTw$@*_{W7JA3l@TT>FrG zrJgPdMc(tTRKA9TVcV^Fq~Mt74_t7ZHpziXbDrYG)@tz&nAMMUz}JxlkAqI#@kT(gShq+=CZt0n;s-Mnq2ZotXWk z^`?lo7{gm90VykC`RxN!_g?5 z^tF!Om)W$cqHO3ZfwW)rh2N6)#~JfJzZ+wktI7fG2KnBrJc2lZC#}PnW4T@92-z0J zB(1zq0o8X8N8Eg(X)y@!MHQ$z4#yTSkx_$&JP7B)zuU;e*qznEhhkokYtZU%R6nQq z%7v3*EzX{@uUY@!;&A_^)**{Ee&wrM5s;DxYdOsy0jF_3>>YJK3g`!6RnjJRD-Gyw zF4B5Jo5<~W#tWkVf;iIJP8eS}v z&*6S0_gnB97=<>z!S&B-$3tQUHrG7R^9QTmvY zvUpPxi~4r|WGP$obZlwkz-?AaJ|DF%%yPmy z4cpvjg28euP;f$SuH($LIUGUK8|kMr!*n4qOJ@GDDCU0?x<;MC0es`(E?ra+1OLcr z6QpjppcT#hGQ3<}Ow(VL2#b4EnzxijP|v?nLf`uFrk;mQTNqQkb@oc<0qs9f4B9r$%f z8*tSAU*9mNVb5S#WcZj+PZZ$?KDHP%Sp%yFjLJFO@_GTUO?1X(FN};AzfOPtpK?9B z|H!9qU^J;;-pJ<&hAyQQxaT6Gs*mKcXjUj)sD3*p>4^5&FA9hBF4#e&;R(Y z-@M$_cA^gYG1ws4FW#o;5J+67CZ9>QUIzwF^z5y`H%V9aeR?Jnk2#3WiTggwS`oWp zk-X5Z2H}rJjhD#~`V))HJvro<@L_rOJf+Y!El+72nKha36v0*XSk08W>gL{5X~JPn zx^yWvw7KJz;c>}*$&#(*ZtLwlGm%b((jEJ>KvP91uMkCXOY9fMtbT0&-u!t~0T@WUi37cD69;5`idrih%_ zOl57@9YRUKDh&UUQN$c8U`zBUG0xYyRktXt6hL45mtNoxQP$E}N?oP<)W1HWX9I5Z z3+Sa_EZ4OLiFhA4<|Y1^J~fth$jx@=HBti=Nk*`k?d}I29Bb9-4h<^GehL!3G|ah)1+Kr&E5Ib zl>BM(*mW|8Tov8aO*3FVJt672x0VYofG;Df{fZwj;Yz`xa|`i(v=AH#3u{pRq&F)Z zU=;lKrttf>h!Gf|!s#EmQo=X9vOf#Gx^C1;n)k?Wq?<$Mb}J7Hxx_%RlU@opX?GsHyZ zp_N}GtI^!-;ySE&=V&bYVoBr{%zh8ymIK5Tw{RtmyxCsNYy>BKG`b7cyP#ROrOpfi zv;SLi@Fn?+A0;h4Cjh)CN<`&Ba_EU5sC~c=@i#5Q_R1VUa)CA?6;h#csv>2VMV!)? zD1SB#-6m5AJ)-{mdDHE7{7sW(m^zlR7C@*kurkFziQ)@;7R%q5utFz$=UpaxWR)mz zI!a-^O#l6UL+B}cUQuG#SMn($Ym_x~#vm)sNTmb#3L8aLzlXu6qDbcdrkJ_)h{9AI zah_0?Hy4v~deyU!w*erRb@+`QgwiiskeBXqmzv;)w5Qp*m%vV!AQ`B2NoD(}8AA6V z@3v@>$&~o#a-KAkr6!fO*JSVaoVjkdW-8bio*TBeq9Oj`aD$p#lvfkFDQbhW18C8`G1nvrl zU#$hA^crXDweD{VyJjf9)(*?0OZM|&T5UC zW=CElHMFxR>FEDq;iRLTErcr!zpX_1=cU$C#8`FtfjED#0d)f)rkf$S+n2{hg z)ey{J;vPAE>D*dkRguy#3Z?A#@mYE%Y|TSBG90dnbFW*>Gm3|cJMh^o+qOR>)ad=p zD&g=Bxr7R|u08g=>f@7}Sc=h94rFR9_stpPqWg#AHDfNOB|pkDP`0Ju?<~0-*bTv| zr3ra0=c~-8b|AlIJ{h&jnNXh?4`aT#<;ftNu7N!6@1PSsV-@ni?USm8)*ObMet0B; zu(pWK8Xr#c(O9m~vRFJm-fUoxF=AUhY4D(WGQ-u3&l1!Jl=S{a*sUO7a>fdHFy%GG z&u7hb3Dokw(sg^xso_K9$4WFLAaEYVlwTkgU1UR6Nh>nL5?j-9sG|GT?$&i4Cnywi zTwqF_3w#*U(vIQ;LLfk`hyy*!!r1&@NQ?ZcQyn=LouR=`W#NvF(d|6=)-jGv88@ya z#jAEZz}!NKwkYKus9UToKZ|0t;R1vI1zj$-gVj{DY)Fa0=cTk*+7bufF^1)4yKQV6 z3yJE_p^SxzAa>=E9ew9DLd=o4_Nfo!KjXY7E`%FXqZd5HDt(n61TmZg4(v3cO(v}r z560YHC6)2t(xd-ms)*%p{?5Dd*R&c)DX_B&<<|BJiFPX@(E8y+_%6sLku*o}xp-E- zRp=%nYtvfb&tJTL9xu&wQ7~%g7>*C$xP4<^C%=BB_s22~&v5`y8h`VGB;%LFC2A&>8Ll`_ zSyf{tzO-gkhsSS}EmAQ7+>r;}H?uCv1hRx`#^$J0MIEwCL2{Em7+&tq4>Tk z|F2GU6v6>$%OxjsUU#3E);w?E;`6tt*5~aHpVLmtb>6=3Xs#jIK9N7icgPD>*vdL^ z)A9rHV{CUbM!|Ly2=QZjLloeH%4jIXQ9sEnp9vFtG&1yy#7&n>qBYQ1$*;D7&6`yGT23{cu7qBCu%ljl)S|vDI~4m zMBdsxS*#{*>f!277N>NN8y@Dhj!MJ$%||2`21)+T+Z%Z25H#-{dBVQt=ZUC}@hMIO z5*fZB_VurPXk<0mMU%2sFtthc7Q`YNzgUdyfL?K z;vauF8gM*8Xq>*EEv79gi3+-U+R^_$C=*h;uLs=NFgmt5hL)w(H5o2y;Kl3|C%xN_ z@vyy`Tuc}0jWs*3FCF+JKbUA!3LxS@R(Xjb@@(_waiYCWq?^JeRSZ?-%k?=v|0b)z z5m9xUk*63e8uDq>E!;`j~ryri_%Tqn+4BA&;`Rck+$yT}G z;kabR2gZCoBUhxf{_@JyZ%wR2_42#gGIg5q>1BHU_zP!LCuBK5tgEe8ZO1R_(wIhB zu4a7z|J>eV@to*$Wa`odDe~KE-%wXl0M_Rlk^^dLpCUrH>(9tCwvlCp$#$a>0Oj3bZ zq#L(=7$1lqW49~tnmk$PiDD7p!}Gxqtr2W>*Qd(M&)%WS8) znfdB*bRccXISR_6T8-n{3rg^E49Us?i~zr!V8S3L30XZ1Pe7$ z-%?*T0%>&S>Jor9wk0ByG3Nou5drxJB3sxw(h&!B>5I1Re&p@}IZR15Pgiv`Fa0#7 zX?=!t;DCK_il*)r&3kn4a1`@)a&AnB>=BxJ34f4#E=fv9c|Ka-@ldo_| zW^hhPd^_*J`FYX(EuE&>hnm z=lq)`9lLN)qIH(}M_6PG63^*i830pP<6A?}`cJe)4yOZK*3H6Seneg3s4RiyLl<$o z$&+8fHbKYIZtf<))tIXEpAK#{zebM1{?TGT`aqF?x9O|KR* zJ}W5W=G`QMl+94^>6u)3zpVVxje|j=ukQy1j}IXEvL*?-CTmqRY?wJ^C+pvV-zvFOx42>Xf9O<^nJ2{o=kn zNSn#06p#nq`vtG~r;3<-?dX5*M+zcLM-Qr2ZoU}x?C9P&7wqW7$t{GZU-#kJTy>oW z!%;bWg2}??&O$Gp&;$m4Dah?>uF?DkBhkz<*EkToZG9ETR^J%xe2s$(Mp0n0%H^rK zx5*;9V;MGL#XUpwdQjb4^!UoG#(Tl`oQS4`|NVSV-@ARVOt|95v+Y>OII@OF(dP?7 z|H*wtvm)0A)0Lwnn>gLw3G*nMRptnIx>mB@mT2sb4K|!AWxHxL9teJCJE2|jLFJ}= zNm4e&gPw;4Kw};B+dg>N=(mNG5t)1VXxH&888Z@2~I=eiBsj+x32{ z2f~-2>1i!hZXEgQJIbIAR&nYTK?Jj=1lq}LkLo+Hd# zHO)2}6L&dfo^!wJb@E!K%dP(qsBf69^SEci?D#+gh$!NVUiJ4_GuT*ih_i5>g~gvJRRGpJ!I|!w z&(lQcj5aNe=4N~}6H>M`xR!;u9+f#7U_&AM6E4glHT|x0Br&7UR#S23kX4#>W`u8I z0>2K={s76c9#Ohya9wia{%S-|S4@;m?|X;xAB$y!r_L>hxB}dNR&ViNpPxQ>us_4F zJ2Dvs7l%3=(${3dIEmh2qw)+d#v_@BpOgYnGU%cZvO=`mIYd4+*K?0_eLw_5X$NSk z`V3Azo6kn)*Py+&`Y`~&>Nol*uv9X4E{5`gGpWCXy&?~TAtK9I?hx+O=Mk%Ep^|c3 z@EVDP50Y+6{J~6799_!H@~D!xwzv1`O`c6as#xwfXhbepXehFT+-MSaKQ};NWQi#; zr^q%jXVO>QMa9aWvru9%Kb_Z|jrgp>Z>6jgxLN@zbzOHP*}K$%>9DnG%(xTSUX;pHHfOi7vtbBozr z3uVzwdR#oromcIv4ZYxzGL-y>Cg`tkL7{4pR!|>Q*{oq=>TCC2nVv2TB0CwnIWE02 z58I^}a}V65s`pEyPvdDbPYb$sx~M)W>ji$X^;Xr?hu_^C+i(AuwYU&%LNJ|)ZRp2Z zr{osZ1H*B@6r0QXc!)jW@fd7&*llqC!GrS|=U< zh}P{#ESre*hAbyuhA1Pt8TyfrRv|G0{5j}3iSRAz!&6cDZ?t-v%rOUS32WoNn+Otg`Qm5 zpnwIt6hXyvro8FVv?68+XcHvNBxxW_{>K1;{Wx+8q%=FEm?nSOUaa;pIp>4E`2nV$ zTbr_#*8miJ$9#NvnJ?d%(nfyu_qCO=^)j{fFps`a?X5BFRjq;5`M%d>wJ9+Byz*%z z_+{ji_QeHK()(4X-k(Q^(%*QW$s=D~#+NBH-RGpw zFzn!!Gr#kT!)gh|>_20V!*#SHWcS8DTBWZ-9TjtY#W3fTN9!2;fi73ex&=a@=FV~qzxSy`wP{2fz(IURWAFdtALI_E@fzJhUlp4 zhfLX~I~O2)nV}DqQ|TIX58h(k;LT*^rz++90dgyYMIhj(-;-O^oGtWNh3it8OESPo z3+dj0tNg_j-n0hq$)qd5W|vO25rsMo9r-CJqrG^gdx+Js%W?3_yE9GAf&xn8@l4PD z?3zVm$Ei)+5NhepWyUeYxIE-cQMrFht<&I+G4)~C!V$ceQP5jyPX~XAR8}1Wjx}{N zMz8~|s3WIxWB*L)fMfgf>e5>)U+nCW-uHIDM?S+p~T5SRC z%MbZ$rYIQq><+6A61W=O6xSYYT-@Kt6CAx(yN$iYkNEVYKxvCnt~&5?s~+~8T5KKf z*b@=!qnT|}xWnC{Ydoq~=|>vz7H$cDQ(pF)DJpp(|Cd*lxmz|T|6?o`hw8o-fW8aP zw-~1~p*|&uYo!V};a&S`@BM{8S+=5W*%?iP9$Cm$oEfpl>hlyuV;B%mC?^F;i9jRM|kP^$5mw(ViIHVxLd+H#dlFD=abJI@|!PYZ>!4b3|^##(iX6e(sm^5vt;+%8QN#L9Nyy&6Ws8o?T0^Gv{Ui`qN;0=N#O zaheqGV;{0bZe?O_1TjNCj*U8>3USgi&7UKsDbX#67e=>=U&O zzimheW8ZB*0_@5m*&r?k!z^)B@SR!0wQljGatNoILFHHj84U>WUg?wU$3ccSbB8GQ z-7DV?1pfVY|92qDI~x^C=ev~qdEu^T^EaFdB*8<~)|GYp8Orv5 zqhS)&Zwx>)%0N{}+3!EUf~9_~56z5mYYaHXx3!sv7A<@04rcw&n1{BD7R50#9;C`) zIOxiU&b6Q9{5tKBe1YNFe;SBbcbsNv@B00axEY>@zIqobFW)X<(tVib+Vr2|{XSQ4 z4&-@U!{9H~fF*%_g0JzsxAirAK9u(S<*)m2&j7(H$fbsQaQ$xMlegAiC|PeKN9?XI zSLa<4`7twi2I?SIt2VSm`8sK`()S2lU+Q_+d~rW6mb@9#lsqynF7lco zh)!>{89RE$er$j{TBqey@pLnME7XESXN7<^_>nvoG$V2G{+4$?n)2s`NyuTD~GQr^Yjd5bPk~Ij#ql(knQ0t_b zf47?d_JHkkY%t-2itf(Wrs2=Jh_Q5S)A16fpJhd$n;dv6ZK)xs4VgvKKh9sr%?x6C z_ca62=keRIx;rmvRIRol)L0R_QgvYWyG6E{Dx8>rzx_J23S65ow|m2B8}*yGN>_MN z@)~tw9N>bFFtks!=nQAoOK@3UfBFDZxnFDW7o$zDr#t!Kko58z_AJ7#RazoaITJxR z9gbQTyx_iCqIB(Pd7tm@oYEHL>qk}1$RgbSKKk9g#?N7g?@~K4S$)WYzrgwH@Rh{Q zWo?>b=uj<>A4;A3+V?UQ?b_fG9c*{&r*w-ZIh2YLHXQ}TIVc+WsVXP>zQ~3*3#EGq zmn=PEpZ6VNX`z@wCw3L8$Z5Q_7a0$@Sp)eG&aU>(YawT%o5wrM%(fWmhDP+^T#j$> z`PDSCYMs;8I8n>=G4&6sATI(kICLmIVLoc|d>QmPDFRnZxd0ym<#N0?gps=?kpqYn zxMT$rDvbd!6mnU}QUnzxYr5hV(v1w6e;_Fdf5`)P=eT8)Ga-V4A$6~)zYnKKhqB$_ z;v@Dj+Z)n%TlIbXy{h+F{Hx>SvfND>6kXVjNepm%dxXa%5Qyv5w;^f%xD8vCN1(B2 zB8DQk{jW@3K+Pkfrix1v7iWZ+g%HG3Ju#0q+B}y3_7FSH$f^o{tVIDMd9uI)rqZXY zP`c>zf3GePH>3ZT4^g*!bUE2^C#x6yf#?24 zwe8;NL3N&id)P^wzJGNQ*&!*|U#E9_RAhEB@ll=8&ASjf%SlIuM3>hT2*_Pa*++7( z6T5nDtcvx`Ham+;^#$BJoUbAIEtYIv*s5a1slJTyv_LP)jJWJ7fN8?gV3+zd#j}tp zVVi3Li*=ce)8@ORnfZnqPOPF0}?KkJ%3t^fhu z^Q|1!b}r_^qtP(*ZJ`6js8GoK4sz@bseRUg;E^~GL^NC8$wJTK)Z@NoN+C(Diw9#{0twNDSp9U%?a%0 za);^-2SiQU^UBa|1KNw`el|?n7a=vNb&xa+{H=BP>iR zFalrB12p$upM{#8g}u7z>qzxp_tTi|pSDKhYIe)4x*HA>S5}UD*S@+%-?!`4FW#!Z z80W3Kk)1yIk6taRc@F$YoyI(VxvSr>*Yc?^HH+4scz*d{|{AX85CF7MQLc< zEx5b8zqq>-AUKU{u;9|TyF0<%9YSz-cMI+=K{Cx(H8nNA`gh;H)n}iz*LqfO@Vuz7 zC2Fk6vw9=ch?BHNW;$Jfezc4gY zu_{eF346z(UEl&^hZAK1d1$$<#5qquuqDuA#tG)xYa@!tv!o*oPmqR9M70mitO%EadrMYh~YwP&+jX>e88sJSQGhNzBlj zYCR`_86@TlgQ8g|F4(%X+iiVK+%NL-S)czeV7Ig{U{{g}LuWx#+^~X{C=7xK^}1Tr zc@Cw5e=MFUa*Auf%09j3geqAZg_k`NvVxn@iW(aL-$)Hq(NTS#zrR!$-%qeY9g+K>om!RGd=DW6+8-rpZEbSZ@8 zRt}Zx$)DJmq6W67A=3l|V4Ct_B@bYxQ$EN_qZ?ud8|ZW55cXv@6ltqo&xSkw(8H6F zr_Q6w1ooZsrHdazaRDC==lEJ^&&TvR9YZ-kZU6lUB2g2~J6p%*z{%BeO}a z=Bakly5+@#nKe3{#l^KuDt$2P$XM~~-|ZOe>MJ8ovi`O_20bm$J1G|RWWhEbWuRe? zWUDCv@Fjm}P+N4*E^3nAWD_LY!KFkfJBxm?-VIVphO#l`3dK~#$}c-ygxpS5exw*_ zR0uf{!{a4DZSJ$Gi>Plla9upJ5;$T5=9D@;kJeD2Kag?FmqehKc#Uo^zJg=(VZ)1x zl?s$$<-DQ_I<9;MfAr-OMY6w8V#B{tooEDXQLI7mH}QYip|^8kQR-#v==}1<0qWMW zaQktr4z5l^2Dl>78u>vaE`K#Rv`ksYVu)Yxj3WE4tcyuaD>^}w>+;)>j~s5rkx(Y2 z9|8dh(f_xLO(Y7sBRMn&$=(jDLitWy4T9j4w5{Cno^5pp@(VZ$@h{el zANMW&3B$CWi2pz$s&MFn3zeyEEf&)jvsy8`o}d-!v?O^}C$o?T zQ9je;agvu?i3ZmL1e3Q!4Xs(km%uf)COeuQEl{KFUN}J#6#pNtd~JHp=MQ$GNw{YA zhFM_4INZS8SYk~jJIZetGvRQ93Zx{QCjxgBB1{Wkgk~`;RlfX372SMk2n`KMK4J~g zT`EDK0tM+9T3WOK_Q>e9)$p{U{ooJj^H!4`ko7VS5i<$#4SU zQa#C<+NnVhFEQh+9XoV(ULSAqZs89ndPZX>0#u(q8@c|45Ur~tIUmjd#d;+2sD5^P zFF)5rQAQ~a4ZeOL$C8A5K6e%aCjw#M5PR675~dL#o)#j0S{gmDL#i7B65smw@dWLHpouk7lbsK^Aa+VHteIpUfg(3qzkHfK6fQd!g>ozB{mJgylz#?(6?~C{ImZm z0bQQO@0Z&fSl~057%+Ob^f&36^y5+=!c?hw1Kf)DXS36iTUhl$0U|Upsq% zogPA-j$dMO7`wc%h_6?GXL1j(;z&>E5|_EaljGkeu<7CGHVA882Y!iOJ`M8:H5 zi~+;^ivkcOef-0ZnQ%xv3Btu@1c3?C9p%G+K|%H#H4PyjJpN(2C+Yxt;rN_cw?FT~ zfcC(g;xW`$tRL1+a!0fh3n`fj0akTp19RMg8SBO3Nj)uEKAx}&Bmw=rWOEKy>L+b+ zG$mxtC5GIab9_XSRti({wVxBK&oqs@IFHtf3mueJ*#&jPztoe0x}jC4b#mR+>55~% z?TR(T?&y$dw@kjirUv)reTaW)r*Pp)%j(_DTOHGR&~EMlIVF3+`>nI@R4GKa6&F91 z((<5*=(~h4;Ap1O`I6CbnM0_q!;f79D7(_OvhFZ?I&r0(x(?RC>6s1hg`D-S-%0y( zat!u8Tlgo~MUR4`cHUECkj=z3M!|as6MNVtB}MJl(DUBUSr+P4Xnsy3HlMB4}|PGdLyvWck(-Su>L;z-#^ zx1K#qxdoYB1o_Ec^PO2a7UJ6GchGHp9ZdKHTq2F)b|T+5zi}C|@vjm(#^6e5t`t!J zf`4%>b`kJ@l*l>@7oBn>Bb8=%l=kg_xMZWfOVf8o@R`uJzvQ;}5x?%o63&JBAtuRmsxJVM9fWEReUA!!W~rPGrTX$>0FoiD3D z_%N+1JX}7iVvMm1HzqI=ct8GwQHRd0zQ{yS>`wS;<;n-Dp(5qTl%iab?A!Nz;9)|A z_KbJaR{fndXj!dHj;xKY!qXRt?19^+ao?m5%X@& z(Ur_D85UByUtW5XH^AGU9!+%|Gu1YRi0$g!gD zC|0iSAs518V8C$_$@F~s6k!(>r0t8{_F5EM-Y^p-`pwe}ER3km-5cK+Fo)kr4W}c~ zm#9=g`{35ROPXV~4Z@61yo>&Wg|o=fxSo$vH$F|eq3ypSTA}hIEFz?$!Kyn3SRDR% zL2MZ_ktP=~0t8M51l3JNW2jiJDiFGLz~cTgX!Itv>%m&y1Tr^R!%)sv9zAt#3tmgQ zq$#cm6Tbhc{&WNO#0?RCH(PkXB!i?y^Yd!%PQr5W-ZOTKI4CNKf1gNPo)r-FD9kow z7k9wnw|NzVG=*+lxPT-4?b41$yA>AqXAy_ZGhGco6-Q%l4vg|~e0u*knJvU_O;4@Q zX9fJ@#=!2$7=u`{F*f}jtVsw&dK%e1MMorH1nx~(YNg8#%I4zy*Aw%fk7Ce)?BvS)222zsZCrTT&qayQO@zvRY1(TC*R9wWvk8?y$9*Sr z@$A3v_I0lf)h(S$M&tJd4_V*(Sn-|=e+(D<(9~g!KL;8A^1KC8dcaG?Cpgvl z<&?1;HxM=E|I^AfyU+N2D;fJ%;{!g|QT`_iMmEh2+234s4|R8{B$+!~&=s;+WEjIr zKM^@v|5EuGbAFlp{tWBq6I3XTf>Iym6`pUHCv*xOL4Vv0rXm_?pOjG5%!W80qjFlvsYbhY>=+SP ztnXuVi;;~8Jk$?yuz)>Qlp8{w%w{q955MkmKomsVH3w}dq=iZr9TLr`?Kb16^N z;;J5bA6w}|sH?A@mPeD)^Wdyl)Z}QkXdrs(6K@EW6Q&?iZk4D_mcoI4QcwedlZB0juy9uuGj4r5Qa}qz|cAF&<3Ad^p2!BG0{-=xu}M8U5A?4f>bu z=MJC^-AQxFCG%EZJA)++q?#T#i1%loqhrFGB;GeFLLe&Ad zgKpNfveBZ(@N#Z|cOdWB7k(ybhJlsSIw04sBSc%^c75T0q8&ks`6cnIC|a9DB`{QP z!bADQK}E^dEy=ek(KyhJv+eOK1L=g^!8;pM4YN*wi#f_Dyv8 zlsx1dTd;BvRJxfG{D?76wCb{&n_6Yf=4^R;O*5}B3+ox6X#v&BnPrRDzyzWE#q_cISA?NEm z_~oHB#IFt_$lIG=GeMrkmcF^VZ@9DKpcn)X7DwgTV0a#fu(*f{O7Eo^{JzV%x^GW| zu&84*IIj^PGN0A~CTe@INXr*=12*Tk=&H?IFVNxCTUI$<`GXi-daPxp_qBgzN0oFo_khjX0 z*^Ez%u9Q)sE-301N6UsWZSK-aPRLjQzeg`bX9(NAzfM}u5axgO1@P&TURYuN*Z3)w z4^CkT$!JKh?m027Yd@6G0nFzzaO3t-Qjr6@8&cAY{P;^W{qGA&eP^Q#_s8|K7@vwV zqc^3};12DY9>065uh0ENytauU{*>`Sa5z}as0r5}!W|k?Z0{(%)ccXvv-bVA#XNqaClGil- zdyx!x=JG4YH5NV#)eI!fgIW)B8*6Kf-WQGDKiS%(`+QgIP-)j-yR@`OACoBMh-W?6 zoPnjm(jl<1iwYa{-~Nr@zfu}jbPnj$cH#hvIoAVm3wWVK*DM}NquR`)H!e{yS1*N0 ztq3(Z$&0>%^xyNa2pB2YC~lMJGc2$rwxUsOq7F%crbU}~hw%EFMK`jh#A>qHkkc^` z->Reb0c@@P1j{jVX%$$kR28K*X1FYIPe1Ebl<53q(9%)Z;#cGQF2e-vT|w*w*hr$o zZpm=}b!O0NVZ1!844Y5{3tVcJnfCfhv2n^jaxu_)u~tg(cL!1#;}E_(cZmGgqF*P$ihx>I zWAVObTl<4|A@~Y}w4|vmp>^%cqO>e=%EDWcvWc|Ud1RpEvgIyAMa<~ycZP4JJ*|G#PkR8_p$Bp9Kod}A z(}D?aZ(k^B_3Yb*zm~HRHSBL!sJ~VI{>xbJZu_kkU6uk~W8jGtRSqD-g=jbUnYE-% z4tS`kh;nBRv&=^UZJ>vpWh-HBxFH*WGmqFDmd zQSuF&d<(V;7kCE8{Q8Jg@#LAJf+;Qj%({}s7S));D|jiMk7jQLMd(#{D;zvE`swrS zhFJuXXIc!0_%rUAd96cc12waX4_)FiE;DQzM|P(rDNfq{3>B4pBMxu3ACvmi$pW9A zp)6}^uCijnu^9x{9;~88z`-Z3>j=bHt3E1AUKlIus6(+Gg`A+mla^lkN#ra1RQgOhgat)&R zlTET%%=6GOwM^p|dJ1aVJ2SAb{3eN>suEFi#I=O&Ai z=F|sQ;AhHxbaBc*Y#a=Yye24|Cq=fkzp;)gK=;+(<+^_*N)DZq_@rs?Xt8?NlDO7` zoVYAqDr~D*n^W)MvjI-}e60)jer}ds4)kQ6=?fBDX#Z0Ca=E4;Z(>i#Q>RRMv@tk6 zQvtJHlLcc9yq)wcHwFa0CyMDy>gFn$Xz~V*Jv`opH^Y$kkiDlDK8JGYvj-4O*6LSo zth5sAZL&$4jL=_7JAz_pw3MR2IfuG0qNK#kgAV?4>V035WeeFAa8WZ6yXQPkBKd`_ zhUBCTT%fgplRXILpYC*3p!P~53lz@MjkO%wokxUX(`HNly2kp;+I4zXNUq~;e?
leQzDcNXVlk79dH_EcvDe5(!PllIqLg``+u zKF0488xUjkUQ_ZoIvkorgF2^gA$1X1*|!(}GZAX$!`H-34bb$L1-GBxtn;?+-0N=M zcOU-pY}x>%7Fi|2Bn@^2p_vAw=Yff`;IzB;KgPP8H<%iXuaFLRX{VgttMZ9qkcUGp zUPK%UkV=sqeJ2c;;+Ke-f-~xXULpcGV!Oyuy9K3OvGrr2cZ-pv0BU1HYBmQdxhm0x zpm+zdm>x{W&$(S6)}c4j(OJ1_knlCP_IN|~RW_80%{u;2MG z=#_Uj*ZXW#)9u~1+JEiZ&G$86a{3kNJz78<-?FSp0Q1p8Ls-SjGEU#&jvh5|yY1Fl zo&iOP0RrrCV;?~>FaP5qRbbR#kjnxIGw+Y6@suR!-hG$Dj|Hf|m8SWxQ>J#8ib(vP zjhnOS&%k8ZPXzg^MCGUZGX(qm)Q^!lNNKsH&TZFB_RL*V^N8PeTXU5b5gB)cBUow! zMXterip&d8Nu9u7ZYUrY#Fzc_sH$OWx$lrmGLLitc4^*a8oF$C%94Iuhry{=w~m&d zJlJp9dA+W0Z;AYLL0)iEWiL(ZFuFhH9_qmRdi(RuoA&;b8v{vD62;O1@Auu9ItkA& zH{SoTF;6Kmuf`}%jujFf4ofqUW&JbtyWv*+9D>T_PZb;uXyHA&Q>x`{Pt?RqEVEGH zv+3*4K;Q)D9TClDq>(rjn^Oi-E-zZ(e_>&Kf4J4KxCD=DQMkjbararjU;?p>^Q6s& zylt}BcCoPh%oUI3+$8O&IR{!Mf;p|gSq4$qkLgeKiW}p|61I!wV?OVr>1zqL7G{-j zF@Rkm^v4n!iJ{XVwzow@(FJ69NS0_AXA}oBd@5B`f;bt0ze=`-=_8`(PIZyb&V--p z8@=f3nBMl^rOyHIRc?>=M5Z3*GL0N9e&e`7WVNyjcXMb$=+}mZ0L(`Z+FK9UZgvay zFc#%aJC!|{@+|rO-aF?0ZvZ)1A7K|vHM%e4L-U#mLdU{LW0;{yeH7uCQ`n5^#(up4 zo9O&U5GICZ+xVdMy-td!J*QmWwkU~eKbFpht@&2B<~^KpO{+w%1JLe~;PEqwqbSZ6 z!wb{Y@cWD*!=gE%brD)F^3wS^QHeJ9Ld^ooq;gVD2gXR0T~e&^O}S{#s8{jGVShf6 zPU3~YnjLx?^oBxIoAz2^OjSaID9iZtxaxy)GATN(ozzu>*@veSB#*yJaJG!?gwD?_f!7D}A7L znh|2#+wJ%}-W*t+wtK|+p_RJS8)-huo?!s+TkNaFx+BUogul)K`ZD=|O;k${wps!; zFT^xt*w2cV2cFa3x%^jHnJmBkkb8@Nju7^2e);%U0__s#wNRLQUqt&2pYMc%BiT<~ zk}PtSLi$7XCP{hfAo8qcfCd6F0m@498H*{3O;7fRJ?<|v$%>NV9mf*zw1dkeVG$z1 zWBKg%Cx+L{o`HS#0G7E_MMQK^<FTppyZW8)zfAjom|19HWq&iTvegnjOC!y92e?s*L$$6jA6Q-xHfhj!R6dUu`z6kL zu8}m75|Bz#u>{+1!9IeK(v~77J|k2)iyybF|8AH4E|yW__1(l;@c;0=MQkePN5mt- z%$GQLQyPmn5+azS9bk8>sh*=x#k#3_OONomc2bJt(l7$+RjySzJvkn|iSS$OHQ)jx zpu!M6wa&XUpJNx`JF9N6tEw?d`p~10ch|R`OIrV<)8#wWV5yS0WE!c@-X~FBItZw= zQk+Vj)8LUwh$t}DP9ir|dmL*oGLbJSN>DQcAwD^}ip3K((_jOLYpS>T2?-+rjOu+0*uMtg zDa)3FBUs2y3L@wUt+>yAjB@6%guwtu@cOFQCjH(2T4#71g6)uZ^G;!CZwOq*$ARlUBxtG$Acj;wO|gU64O-3G2mf~yM>2owkfh>&;3zWV z>dd?a_5bHn2PuxO8_|c%&#oxR2VY#4RzGZXcE<@d>=||THnHPL()_jdYsuI3>aouP zv~nyx#Np6HLtJ@Rc&^?$vbt}hl z$Z`^h&!hbAU6*Xy0=ZI_ZFI7?!o22j9_V-;8`-utagL5vSZp-kv2D9@Aw>1vC2QSv z$G9d~BFOst^;f1%X_+Kblx-q`eEQuZs9@2BIT9h%Y=FsBGP*-k1Zwy$qdHOOK*~P+ zhB`$U3;?m3OCr^cFggA}Nql4_;(*rjuRbKX0a>tl`L88(JW46n%yn!0VYX2jLIA)D zrlezELsQWrk-tzIcjD66US<;k#Egnn7}AJrrr56;P7hujVW3nqW*Q`hgf<>Irl}+n zi|v3(b@TLeEI*X(2eN)}T%EyWn>8>h=4EEvPWt1}V?qcxPziG5A9Cdog6 z{LD76wC!Vt&G(M^>|q;BMCwFe>0L_Qlx#bs@Ris5xuysBe$MKwuB*1tJ^K-2D1PC z@{E=D99$QkDDAwqxawnR^Fo*#S6Y?!x^KKZvdg+n{})WszA^guVC3+fEG;Au~_KSPFP{iy&c?L^B zCrNNlp<+Eerwh;w?UG%f10Ant|gtd!5* zf|Y{{uo`DfYuNZ0y&0knV@>&zPqfTN5pGA%lg@r#YM>|yfgFcH;|4K0a?Wx~E=9s_ z%FvjeW7D|VHE6Yb@fDZGG#*B?C{YfV+?9O(h?OAVfZL0!$t4xc=J|prfWwkLmo(D> z%9>PmxRk#6$E)xqMoUJ}-U7O$te>!6+jKBV$bm8k>ht~ic;Egky|8ER181M~z8y^VA>-Y0>F&bN#|nRq`?VpS#Be9Aesj9> zPkVDz>`nN^SHi7F2wE9dnp5XwcQ90Lp~~lotPABISRqWYu~!77JJYSovOrgyB;um4 zJHw!az5)jESY@qr*uWfSCYYLQf`A-@=9WfIz-Lzju}Tf3jI?$iQS4MnJ5P4er#~}| z{M4=@%-z{KG?J>;XSBg1q5`8i*^S7z!~dHU(kSY|lzZvcXJ1KijzYSpbIKMyz0k8| zxRWDekFWmE|awX-ZRBZZUN35sKs* zVvxvm0jIRQDTjZG=7Q1aB~lyAOW#GmaA4yAxn0$?QHw^LAsIafwi;0xBuJXVgyiJx z`KNVm9Dw6h1y9jQCyzbX8!ppQ^f`JOK<;}7e#4L3v`Wo_CLL{kr;vj>#)(H)`HT^~ ze<63D0SudCy2bKSwTKPPUa@Iqh6Tn?PThr>bOoXAKwIiBJY5+vD{lL^PwDUS*p5(O zKxzP%y>-zf8Q1@BslN?WQn^WQ_m78N?#KxnV_&AW3K`D+FVXa^U#nuqlNkg9kLwp; z+c#p!OKHsrw(<23zCap$L5WVZ57vN|tKumEAWvqFVLrt}@5zh12lYOLkIGnBJs90Y zYPX@)i`KYCUH)Ahz#7t%R;F4j7k&9`4D@IECbnECh3lU%yyq}nS>UjqctvvxeyOuM~%P_4<<$fbR_)LUIV`jC@$Y(cWV80 zZVs-RuO~4Cx9q&ZUI-Q}3xZHs=mwki_Y8lTQ}8S=`Ni}|LoccSpd_=Ly)KjgN~=xV z`IM3S*i_1olH;V@F;<(CPfbMEkY(=oE7fu(u`31M&WTnH&$3P>5?Qnd~xr#XLuSiiz4UX z932q>2gD5&yfwA|5xMvnIB&P|TRs(7E!~{pMjc!5up1`T|CcZe;p? zLUd`gV9GLmpe2I4@dV;5czG-)YRyrjafUw~MO2>F?h8DtXL%aU9#)tzM&^{9GbM?J zUpeu_BXGhol!Xw0bgp9w%v^vo1sg& z&S??1{N|G)6e*YDQH*6B(*!{W*Hz|Q4x7*Z=shzlOaLWlE@wWNIw*3=neX-(>ELyp zOeeV@Hi5Alu6IvzOY4I|#^C%f3YIw!nJ-x=8IfsnJ8T}N-@jc@jLT=9=J_~eHV^2K z3H7%mMYT+COOdFrL{#9rc}v7D-tQu~+3s5;+Ef>p9|eXEmENu3pV(t{QjcxW)`ew4 z2+R*o3H+?fvpynDPuLJcYstXi3+ZZDtWtntcY8(2_&V-u7SDpx(jLgA51&2&+8}qa zdn8)!RNPSeDu8KkeIBTY%5l&0o4n}T0G(~s+zuQ>t$j?7n9LkO4mUuLawnLeD`?_o z-zUtqjqi#`B8jiCiyD0J zuj@e_OK!W$l<^Z+LZh9`6`;dSPntX`sWT=iN&w`d5~U!E*SHNplrv25o|rS2GMnER zkfq`HhTc$6Jtnx4ig}h+>nHlF>EW#W9gqlguECJS!w|rgNIa@ zTLwU-xB8n}m68Z#me;FOBGXlH_Fi%)s%C%^lq_ zgUfgf1^CPYHMXF$NgIqXIRjuJ+TpqSa*q@DKqbtPum@W|pa&+7<}uYzj?FPyVL21{ zI0F$ZTQ-VZ%hI%Q9muaRb7@~ZQGlT$`;|sM$|0Rd{BQ`QI5Huc%GD3i*dA|qn%w1J zbs^_C=V;AEP|#Wefyb4)xCkxrdMn9qWZoI z@Af=KM|@x*@PxvxK{qRq2}yh-)aVpw3MVnvz|o;$m~=Xmc1>nVr2!xdn1}}vNt7qR zVtJdHpkb{<@GO4fL4Lohvru-X+U<#lFkZC}vC$zf;-bde*( z`=^5QHC^s~(mbhp3Wu{+%;VDHHH(VBd5Ch9L&O)xtSXR~B9xvbhh#IoGAnH_VZSWN z-nY^8?dc1ik$)?|*ZrHyQM5%NeyV4LWb*8VhC}V4a2k?_(1E3p*B2GrUowYt;iUeCeAERL32zE+EDya8I4j?Dt>^t zT|_D!M>)?z;zmc$G!r0HY6wC@E}X=4AapNcGaeTNe?PmksA$cGqfm<<3k{KZjfZ`M z%ma-ZV-~2^2ZfI8tldB5?=M5@=QWVITZ16*FDN`Qhg=RT4+j9*P>e*m?+P+_=Uo+@ z8oG9++V1G;qfV^$WAm;W9KeDI8md@T(1pc)X`zl@?Tw%B(1U^AorO@ehOmEx1-&`g zQigkc5i3dK5~XQI=+Czsv|KhZNyKp?39wIOLs-!E6}P}sV=u{BIX5%0O#XG`DvpMQ z;w7qVe~(f1P7n~$qg$a&r)3<|gCUvEnU;@g1;Sd5Kyy^o)`2E-+;h**;^wZKC#_16 zjsH<~#>n*Fr2?Tj2Hq%0k;#q>wH978MHR&=yAy9?UoaO{*DECSt_Ch7e`rY+AOQSm(sOu; zIs(|GkmPBaxhQs&q3X%KAx>b>2?g*db?|Pq_MmhfdZhns24jFQsHs45oFP&BW)8A^ zi6&ygm};#Z@jlk=FxBM7f%wwF)tNt=-Zz#sq5#rJS zY@X3FX>@iD6vZ!IAd97%J3bub?ImYlF&^7ZCyXqlhZ3@+35L_YmB;uM{KA0w6{hsB zR$b|4JOURk9zb_~w}OO&et6F6a{QVef`DdCgD3DuVRTRS8tS_o)EAIIa?bPA*%%U6 zCiKpXjK-eW371SzxBhW5tIB|sluY{;p+#||PyBZ>Zh#Zy2yciG`JIXWeXCY2!5;%R ziy)I#H6CoZa#tIgkKBfwKnV^6iu?qL@qyC1Li(veQe<=%qyS6>5Ad;Ku`4%(1hRA# zB^_(M=gQox3bkDh&T06H6UIxl=)sN|t{(TR09x2o-9DUAZT|~}gt9qAU^TNh2VYhc z=k9S9%uJw#t37rz_GoCeJ>v};7Y8pb&|X*UY>jJuDqy$dC;Zb|y-L5ynv{hSJ_T%R ze>D>Up0{WmW=wPX0b7%coo)v@1k-;&2`&V?NHe^|2P+Otb3zhU0JA}_)dbK4R?!VG zr(87|N>ho9!AS#Pl3eVuqLZSOCjhO`HAa?SACtS_m%ui*fUR4Ub*UBJrVYR)_-r6_ z_Q=%shuF{CGR*|OX>o{dhoOGhFuyRqi7)sz@F<1C@}r`6Mgq5zbx=8}&RK>h5pyCs z(da;g?dkycj)|TSkPZwYzmCHujU;CJKL%4|%8X$iKXya$gQ}~_G3AU}!L;6;>I(?> z89kU2te6onU@!hZFOxo8mE>#W#_*3n!PG*p(COk>_&8mXCQmA|@yIREp)0!>wEA(l z-39^3Ln1xBI(*3lML*&1C1V`NbEvyL=Fm}UGz+Xop0+K$((nKsMl-3{8*T?MHKE%)&ATnQT;f@Y8Qsr>|3Msb+mERG?^f zSCDZjqkHD5&D?Tbevzh64>Yi}(#m*N^*>lFcp6pCD!3}}Y{3DrE$@gPLafE$dw_R6 zetopt{&#gu3qLe^rVr~5o#!&e|G7=V7L9%V^rdv$)T8wlO44Zm$bZ!x05=%sHY8AP zwbJJLf4mf<_F<;ta7+ig_C^E*23$x#w{;Oi;@{fZV^3?6U*IIVC z2ClP0mriJgbsCt=7xkR|Qvz3lMjB}J8B&g8C5hjv5=FZ~uZOa`)T?#6(6bJ&Q$>%6j?;(_H$R!vN$w3uyNLQk9^1ve&W zUp0g&vI*8$p~K_i;8ODQka*bJLZgQF{Cfi1v93WUKTg4Cp&#-n?iD{rwo{ILQY(au zGQXCl_MQ0yA!Nj+=RTFQn-Lgz+l}Jt!5bdu$XCLVixRr_X-RJ0(PCDB%Si`ci2eUC zBDAW9QlXF`IBl4CK^!PvWL{J1NcN{WMTPA`o%2_bn?cr6OS1Ld9zfD4)Dye;v435DG?2>Yx#9vO}rBwl~j0zb?A9jMDQxYc)J~txkx*&D|0#c>g3P)F%zerp3Kygp4%Q#n=$KjJZ({WSoanroPosa@8R5 zl=)u$sP(?t%+wvzYHZHhb#B*wu8Qe-VoYr0fwrvvGwm_N`Nk9Rr=NZQ7z3_UVmP>e znO)N?+se;#TBS%azrZ?Nt$}Kwm-*@UF}UFNfYFG*tKWIQCtbc%a>^L*=+#dIAxUlo zkG0kV`NiG;$sJB7#Yd#-?_659=As9LxyAqxQsAJs0`34_)b62R-^wD0PL4D5nhtWL zqURn1Yj1{^@dy9*0m9rw!Nfc;R>xkx9Lq>JUc|U9l$iPvnCNL7Felqz(988>=r51l zsh5NHBakOm()yfzjT?XAgst$ zWv!{QAp@)Kwb#v&1p|TMEAsUNryyS^nuetWIxaJtH((12XgOZgOpSuF#Uj$kM`qhi zsI>i%TF6?9)3)~l=aEcW1FF+Za*H)M!sblbxNnk0&j|}soBBlyD<8QyO$V?V z1S?t#16UzMHm=5+o3e!ZVUgf8#$>o=O@;Fd<~9j(zsHOLf}K|gG@$&Yq3X8yeTBUN z2Sr}#xJ)|!Yst!}FD5*ba6CkTY776Y1g3dECo;9yX+wacCGKul32_fn8XJowBkVo6{yMji&~peL252+B(Ah^Fm^VipF^s??L z$FgR(R26G@zvIL{#KhqS+mpW=8wdp{oqS9Qo6d}XR?fDM6l07RQyMIZ5W#McyB@HP zd9CYl-;zPER|8`DwbJZGyY`hf1x&`#xNxHmShx{ap$UM9ZbMF+<1sdyMGr?p@^U6K z=|SLvwwi#_`!-O>0;abyjX%@qzQ z%&~nGMES6pRY_m-iAG1Kx!HjFf%AZRbag^64|$0i@I~RB0z8_%N?8no=Y@87zMSz8 zj-))j`>tNqBs9g7oGB8X=YeXt;-c|pzp=SLq%!S-&@wl z8NR<50(+2b!skgVvf&A-8O42UULc-tkjVbdBqT5obPxLT(=pCrl=y{5CDT~bLQnb` ziRC5F6p4O)O=0Eg#0Y!zuIg1P6WBSxugQ3Pw`itJd&h9$QTS}kVbk~Ai=xTrKZ!HY zMBf|uidfwNliTI5HD@FU-u@}h z)R8Ke8B(@b@A)-3s-)F>oFOJFlp$9F2sL4DN`HMYC}Ch(Z=$<<@4B066zM%CN602Y zPgL~Ky~e>>&Uu373lYVl?oe!pO=#cfik9RSERy*hTT69pYrUILspEqQki}&YW%H5% zqBXL|Mj8FfEymDMSZs9N)ozUw1fZI8__{qlg2{W#-#w#F$Hb~a9dQK8mE^*9Z>@h?BIBN*FYI-7c|{#i1s0)4cqS0y&Jp@#o0t^X}J=Cv_BJT7z_8M+d|O1yR9 z;C`o7sXb5QZQ}GdE&do~Wn@z3@`D^EwRi#NyWd^bHaPa`J&#K1eh(PYTymnyj|MhwO1TwIrdL^h{8oC)-qM(SiYN$~}(C z)xeXKMBeV3m`~$BHogF2Y$aPI@@*dDmPfr#D89(4W(_3{sGidXk$E+~H$w?%c^!_E1WP>eS zwMr-!&wKpb9#rr$k6Iyy^J2Wa=TDY*?}vO#>?GnD;5j$R{pw~7Mi^b~VBjH1Ll0EY zybH{N6L%k<7&93Z!}y(Nuy;s{H>}fX&2vVfxdi9lNM@v~Pr0h%>2sgC9F?F{Haek! zo9QmPiXf5pw~Fq-qJ{bOT=RL2#E`mRGlYJ}3NJ#TTKY8w%r6Annq>AD{kK~Ft_%x5 zPJZ{B-!eA4Z8s%+HEIPHeeZ#(MV;e$LeW=KVNDa1oEON9Eulv5r`p?Ks}^UElq5kZ zv{t{ez%R28uzRP=L;LxI#&B9;#5=e& zA?<(74dAkBQ3;D=FOG-L&U5`NhZgHRE198aa*1eT4{h)f;P?5Ky;C&qEyHK)L;vS; zPz3IWIs|W{^^cs(ry`i1JUGa)hy>gwe(zS2cfWxlJo}WSYLP#ga>_i2&gMW(wAEwH zb6tXPU>BN5mGW1_Xr-Ln#Dh;_6HNWT$A>x|{)VZdf>CH{hI2ey%F_v`kM~Q1E3f}U z(^>d6{XO7*qZ>w-bTewSba!`mH%KFnZWu5+q#Gp#q(c}T()dME6lnnw1n>CWd;f;* zbw1}j@qY3;`VD8f%5}5+|M5NT@s%R^id<(oNnGaDvT%9BR`0sie><2m-+$=+3E@1B z<+ma!h$hEH72-$PczN1T>`Bww){VZxO(FTAV+v~q2jWJp>Cb>ETY1VMR=Sx0Dlm#s zA;Jx*ii=%~)~c_&W(mP?o_@W9O79xJF5@QWNyEYENqAT|vEqf7)$VJutz|_xk2fBF zctSjGv8yW4_m43A8C*p+W8YSVHh3g;9%aJ&8v~d8n-Q6pt_aIS)5N;*tpT!9vfyh# z5`gyP_c_2m*!4pK*Xi4*A8+sS)fPWjlnWjH@)Pyvt$21&&whK-!8<_&y5}D!4U-Q` z7<6lGmcVx9LD;3L;cCj7+SQm?Mbo)tWfpuY}#rG7EwDhdj~vS6xjt(cdG#FwM{Zg=Ram zOb;||0Tk&qV^8tKl0`)X?Y(w{ntA*$S-sig)`ZVC6-t~6t{kj^fIW_Ce1(K=6_u<6 zvkDd~6`A#<^QOG!YJ7SWbt@Ltx2(`BV19&e(y*`pJm<$?QqL2Ul)Gyfe;_s{)wluw z;E?oEKXS)=1CN;`PfWwPT3M*{5{r%T*h-e*$NYgnWQuT5I3*{x%qG+qx+i= z=c3LS^1q`+3m}qMiEybcBFgPj!dGL+mYuK4ET?zD2F?=+q++OYGM~CDgeS>Xh{;Dw z;Lm;ha_>8ezDE@Bws>uFk=@M4s*kj_(ky#GQ{4w09xYl4dbvkK5os)F37ajLW1qB#oysr@9yvX(E-b||%W zj|ElC6q7%xrdTEt_t`Orh1wU0i(t*I!&v)lQ*~sx#fCaELIG$~xU0!AM1GhQF2mx{ zYz)}wM;F_tY4h6S+mAl4?Qzj%(Pc9aiQEyn*w!&!L;&k5iqv=_N1ke=*@AGa30C>+ z9rLAyids1(b5MZpOFJ5n9K)rdJep0f06*SQgeIAexmD2yrh+Sov5f;GudJB;#*&~3 zzX-__smlTl>6!@i8`&bfi4*1VD*Xe=95pk4kfZyjvKOmRS~<-OIsJ+Sk@K)Xy}C`a z>fONLchu#~RfvUZrIyYvvJK~RH>?vNs~en2jiB1qR6erR34o%IToKENrb!`|M!5*R zF{hEG$B?bbIfcv%H|+kY&RnJQNM?<#s@Slq7yXaIX}qnr8bQL;Lc+nXtjr~=RlfT| z6Vfip1H;dB`ioG(%eI3-qY|9akq%_qkhAobdI!@QRuf3f5smijuu9vmzV1XHg+Z}` zE3a&s_A5U@uo}8_)pnANxsq(6bMC$*siAH~sGDjHT>uhMBbaa>|(`95DDyb8pxJxR#oDMW+ z)IGF9)?_br9iy@oKeZ2QJAJa*zSNabwTtrL{UP&dQhX&28s}QOcrz`26+EhJzNA^z zi#v_Dqe9aqRYPhZC|iNzSA1TlE0e~_bxnSA=36S;_8x48Szbuoi!`(8LXN&lrl@$v zMa*o}QIS54YMNBRP81I`5hmX{i(CBCz;0#aCvFu>ES*er?p6DXL;X+1Kju7Ue^{F5 zs882))85w*p2?sF3CQQHon^MhpZS1h6mOXN{i+cwSmT| z>uq5xSx?>xKjksl4;{a(h&FYDjlnDtk9Y<*Lj-6Lb-7Hs4M+u6zHr`Tz~lgvgYt5s zUGVSX{uxowTg+Xon9Ky5}#vLyD?4 zMzZkvQGFYrRfy)o8k50|z)%kK-Khh>H?sbAhAF zfNWy6?eQCUrTrk?CY-C?90Jxi!?79rwmki@*|c(GMwgDwrUl8btI&6ruIlh%La$FI z36%jmDbp+wm+bWY)`CT{Lhw!1R@wCW#F&i&G=O~?D+kC^=-T{-miqc#Fdb-HtKJM8 zCVvf{RK2oWYOCD2i!mK2n`Z`~*b8{CXd|zb-^H;QByj^sPBg!_MXMpMEu6-^xr!!T zP&2ZMYrXh4g~Rkl92HJ(E`YAfQNfy zafqw-Edt#0il^crQD)MGSw6)l`qUxBIhuf69tP}7|I%w_QA+KsQB`V2sNDALKAU2( z6Z`uc@DUt?e(3jK`5|G%cihaGgvJXL-yfg201;C>s7vyRJ0!Ta09iukW@ns&L#(+u zgVk`H)YDi2F^N2oEzcGVJMVFHge$|=ULS*6HeL95?AVBi;)n29~~cgNP6$RP&<#Mxu)B&yyG->p7b~#gNp|< zRn#VFI2ydIoe`U5w7p$fngx#x5q;AS!yoN~S*+k^;i6UWQD4jqX*`%_xo2M91@wu@ zcGtU&;ehl$5!vzx9r}nIgoMpf^KNO&2GfYn64N;Kc_8ga__K3SOZzd$4|&F-70=DR z`Z1xHQw?V7RPEwl%GsXCobzj@C9fW1z-A0On^s`WejW(~L!>tLGun*asyO|8R_+9iZ7%(;Dm1gx-YPsV(+Cyw&k zEz>nXt7!An2~bYKn1)dU+HQUl?NHfPUS0~^7{ZfZcMdXT$g98@r{r7ngbsX3Ryi2W zhU(3ugICe%PBheBlaV4VZ*~4^D|K6%Nn@aERVFMHz$jmXS#*fb2qiBZj`N^Ou$5xu z5NKnWgn>1?=_LBN^E5N8O0Wl(@!~f)0&ohVA#Ro;ML;MjwRL-HRpB@(2z@o*Fws&N z`OG}U)>#HTsBI@bW&BNSIRa@Y@}#>M|9=)hJUQ=>W4|yPNQNStTu4UloxkAT64q*yua$+1<3pk zAP5c#qzvo-+&9x8(vRHHW1+*8BLAvc-={!j7HWPRC;t0Oz(d8V(8!nDBEF&%8v1FM zERQIA@w`80G`yc+=Q6(pW%juzawM2yC<{s-a=sz=m}O2M{`HEAalZdOjogobaHE)Q z=)1?;TR3n*d4)TCX0J!HR#+J)FitGCh>9VyU~9d$IN}jvnLOV)@gqv-(z|t~9I*47 zB+S%3m63Gm1)JM&1L>O*gTPr()Z6I9I6v>V)xMMx$vs;{+L*ylmQOh+s~`M zvfpbj_X8(sxc$_;AgjITTS#1*(Z~D|0ty9)CoPEzSD@@{QHGth6zoSk^e<$e6i+gL z%~t1>$f-5#ja}5->fEcDo2Tyk3PpY`cVaD84vz6oIDUc6+`g3H1v?REQ^J8WuI?X1PX{`Tf3gQh4z_$vOh;-*a zIPJN#9}QRRPCIGXQYvA$R>Fm!*KDVSEEY??@|WWV~kErvvMDpWm@B%f7(S?rfT@O za$;k`zWrW8zSnX7rOg5G*$O~Ny3F5bVqLRQZ8p0k50Mx7T=kRu)pPMmV&c$w($*6LV#Rjg`=!Z(Af!vk7{3&GeK7D+Z_oVuQQw5# ziUY*L6`fW}`>pi=8T+e}+94j#@jWYA`r^d7*PPCIBa{(wzuTxL7~>1+8Rewt<=FVc zpD4kryg%;moBg=X^HO~E~ofETU+!|HwAxp9d1UI z|D?J|j`}=`$J442ke=l@0Om*&GzcWTpXU+>4p{l9{vBDy41e!n9sARG7lH&DTu+${ z_=hAMBBBIxf>Z=!?EXTNm%EKj*ccu92>&yTiX`ykMy>>F#PYrVp+Odnsmoi7HBl#d zqqI?4g_ADC+1J(tX3EB{sX`~IM%&jIS^T}+g2o9{#VAZp^WDA#F@z!}C?zg$3W?>c ze*+xc#z7;?TFkk@!k2h52>iBT7d*a@iJkbcx0}DLOo`D^i3EhZ5;Tufb5qX;7)px1 zf6`)(<#lGz)iTDhjh+7>;Q8tly$$VAa~H>&$u45P$60(_Zb0|6zBIx8pam8L_uS(4 z;s=U%MoHS{w}TuhvB5u*xf`xG%^O(%HI2_5lQ~*ZC*!Sf;R+H;e+828Uj4@437nP| z%z_PZiBJkxYkB|761>`VGnq6C>uVCml_k;|9a|kWX(s-}oN~70%UPdoYbhPp#o<`N zhxPrj34_`kt4Uv{?Wpir##xsK%qyhfR+r`uW%KriOdc$bQQ@wGBUF7)Leb7gUq5_4 zFJK)1NfofA@IJ9ip{3<>)4pEG6!X9VvtE6B-p6&22W+xdsGoHBr*Ibb36N*#l$!;z zq&WW(ias2;t1k~IfMxPSf)D>|QkbDo4tuN#CJw@T`P9~38DCGiUpo8dgZ%{{(sL1lZ8t{W3j=KInG0r0=}Ok8vdhJkrpF4IrVO9K=yuHWQA*aSOkS>$RSED9-<-fhS5cA zXk9!XTD@U6X1SVBn`g8!Nuh97HaWNIq_DZY8+m(DjVGurU>gE7{EWaDXf((B55>-o zac!p^b72d1VQa9@z+kFl>otQV{c^hO^w#6AeC3k?Ec7i)5DKthj1tV!Aq%*sn@3$p&5Sp{)ji$o?7d*3 z%&u5Ws1I)4S}FEtFJnO`q=M@EQx3^f)L?~BMAyGFPFXp*7SNxPz+kW?D8P8lUycu z)pb!I+XDubkB&G$l-C!Z0|$1`4njiGl6pWLmRRk#I&-==8s8XAnKIA@4q51zBoo?D z3-=o^=W(TShfI?&<|UIBP#O6`CY1xCD=~{o5_4<>P}GS_9uBcJ(8;heQVs+$g|HBRAK%PV^Kc!UaTUQDk z`xT-q?mo@bPq+be+p@`317f~k;PI(OX4d*9II<(pG>gls1ZyyuG24g|n4B~P_h!F+ zseOe(eBM#x%6Ss&G2E;C-^m8eUX>l@8auF5AhLI9lz%{QrNs!NPF!-!;7#4=CZKfm zkE}5*p4)*K1b@k8Rh^z+aHofpx&!J~K$Ph`1)~B*Ae$z?8Cq0=9gQCsTmu!iM)^Av zA*=?tp5sRv@0?Q2?AZxYC!v0{wt_8k>qYm-<7|WzZfGl7#8EUB4wEm}w&#(g)R5&e zS65Z2X+xtx$!}W1RLsCgVc2@-8oNj!uuMtrS99;W9iVl2)LX>Sd;N?o=PAtOaI@o) zrJB{26Lc)E9;=wZRij=5guM;ye&aj&*`xWyC{ho%b55K#eES`vpyI zS~9Huvump+;N<(iqc=|pC7ud^7}Lr*vR!iA>J(hu0+AVf(Ju?i_C*NY65zI?KUrlf z=2$y@KACJ##iU<*A@_fQv1}5LO^uj;IGZyx&tpJi#>RCUJsuC*qG;U6OWOfc%NG~! z2xFxkWV;Otm;a?5wew6KCn>!^Q!`1<>dBE1 zN55_P{NO9UjB$}Xg4FH_lAzP}rc#V3Og}z-d7gNsVtDa{gx`y>Fgl+qT<2!_`t>4J z+#ff(@QCH#n(uZ_c=vO)X{C`#_$6Ms28}kDqlm^94B687B=fW{Qwo3BQ~SJav_9mB zZ||iLiKyx-oOo5+gMKE4h^{>k1vmrN7^}+z9VQWmm8ln(9yv>d!c_CAorlb1$?5D;#WLFVNoyIc%5^q_N>m;~wROzz^!R;v!Q zn7lXG1fnnWUH(OusRSf)+Mm}E{^P4>*isF{@9%d!MG^!F%N%2pZN~b({!kANWZub> zdf$U{7XJ0&2}#5;>NTmpD?XB(n4XoK4R$s){z+GDqK(aRi@epnf(~`b1`{PI$*;!)2WNHO|yCX2|C69!2HfJ#ei;|pVZ`0h<-b6;%|eBVjMNbmTd8I6lm2)!bh@(g*hOnW`AG8>v){dR>f zEu_qt4Bi`^pCfU|`gX@ii>CECbak9nb!ncsr_aTiKFgGA7T1vvI2d81Ap;)h4r^c9 zXou=Le*dN@ydV1E$PUtYt#*~=DU)Acb8A6r0HPfl7@mG2M2=QJ4?)E7^5#dtr=?J{ z|I4ZM#*K z-4?sV$%IC3x{-bDQFC*Gpfqwcjq}{=%Df1EWW+Et2#Y7AmluGgIJE2{^I(>f9WJ?& z5#N|=dP~V`g*rNvkm~6PaAm1%6+Be{g-=^-+he^AhQ@wJZg&3;+Ya4u%G+=_3wfT2 zAeV}`97bmtQ@%>?Ef3x!`^}5r_yZ`e>0Gurgc6C|M&LsG-$d2H3oOHs+Er4rFx+OB z@}KC{{{X+A&Oi{~qm_Mh-n9x=xb}%3XH;9dB8T{-RH?RK zLM`oyjnN&)kFa0BYW>lskC?3F1EZ>ekUBaH1}u5Q%-HHX#B3Hv)ROOpp^OuL+oNQT zgkO%m)Yl5pATG_;G42>=bXds)HshNO7}-V450@ZlH4NW$>>g@V&saKzg$6b>f^H;1 zOS~wD4K)poai|@H%=Kfl4Aw)ZY(S+bLe-h*DdozAn2iY6-^HopD09Ts?KwA80?5`F z(f;tGKKfJ|Bi<-Oa~mYFh;CCZta#=#%P#~hNOtqr2y8l}lOtxAhQL2wfhvBGX_RxW zkeF9g5Nx;90tN=UWL_)b(0LX5%Vd{uI@Kmd^^e--ns$-%x=?;RdFeNe!S!AET8;#2 zD(qd<-pfY`e+N4?B()8)#R$I^c!hRm2CW=k$2n@|L)Ky0m>tac=>6f_COj8PrN+1ZG{-? zD+KuCfbTE>PrMH3YQpd#W$5(n2ESrvC6FIwq2;T+5~?6~cSlsMBbzb4dqX3tEMGQ9 z+5oh@iZKc+y4GiP^HM`^n%FWz&!Yn9`e}8c37{Wkx{^p-jL+=*jvz$2V!3X$MR6R@ z`-(R_u~TrPtQGT66?MqfE)iu6-Pu9}{KF(9ZHVz%Jxjn_Ru5Xon$Zh1jW?*MtX8;~ zsgp=eo3kHZmRQgTX+t;7@@;cz8GYev=uDqej7kfyYb$0(IKI&KGw{w{{FQECi>)KV zg~b6(yjhU6WAYV)4-80_8Io4y8v&0o9YNjYg5VFFi;vo2r zH_eCSP1&Bhsj>MrSGf;f+_1nEu`T%rS|l-s?&gUsIZBmZ0-ddr`-(E;Qad*xdF1v z0*jxHEMuM2_;VuUsPmy7rFGrMOGcI-JIKxdggZkIo1Mh$3YWs(@nV&fF3ZtR)%^AX z)aF`Qi(DoUiq;9wWof}W5PlGbn_JFCgA}MMX6RH=ZiFLyxMh_ks%=A3Mzq1U&Rrb6 zd%@N-h?BmdXiZdp{pl<`N@ft$Z4qmx^uGVvuNi5!l00irHfe3M}&v&EX!B6 zWU8f~#*NQe;bAwSBYT|gsf`4D=#U^VoaOTJp=x%j(g>vL-1LFvF+RQ?$2w3$7? zTxGN}^Phq#?Qd=;v5IczZaX3EEZqy2C}wx2iL;$G*B@wk5F@n$xv?gE#N1DG7H7eV z`R*p`E2UHWObr->F5aj5tj5C~>??r; z(*&kTa-K?Z`CKMGR{IkB>we&+m_p7^Mu@I`y@q#mn52(Im!+b|G&#~s-6kGt+_}N1 z(+XNw?skPO^s6{b=_MGHrmF}-*(`$E_-PT50m83Yc5 zlgpiYNlQU}FVEJ9%L+43Kz8qCS&B{L}cq(-FTi+A#HXQs^KnVfOg#?e!J0ODEdMHgg~tIzNKPDjpdL^lf_%17xSIs}BZXXax|9AHK-k+q<|bH^qFN zU{bpsJL5~KL&EVBcH$RD_@OxF$!Aks`lB}w!vt%R_8+yVxnN$w@VR@7Px2bRE!*x> ztZA&d9k!B+i@)kNh-q~GIHCG#see`(dW0BI?<>JLej0HsD9T0?QH^9MJ5KWLe(LS; zvPDy(8_#9X!UwVq-@5LXyNTxuq|yLvMEGmPNp&E2nAJJlYBTkrf_#_z7S3TYzNXRhS z2|-1iM~T*}m*H4~cycIPG*9SLz9vK3;y-2H4IySArA*)K>{181UVwoPz6D<5x+9A1 zmXOtCJi!PXZ~-24F*&1@D9urI5sGb#Dqa)+{OzQbMwSS|?o6BE7EC*1C$vIGHp&rx zW#=3}4hjw2j=pbtxu(a|KCCf*CuLixwOxYluXNR2e@?V$l8oV4^i4PTo*85Pjaxv& z_9QklnRdfvp`xfhOWs>VTADK3SvX_L-1$qgeq>rfLM(1--bGU(6DMkJ|8-IuB-(VbW|N?G9#7A?XgBL8 zd330rNBwoP?vM$})`oAg3%9y6*aXV(FK&E+oeZnpoYb@(nGJu(n(wNd8V$^% zw?!L>qn)G8VtZ!|-c$)NhL0-gomg~wGBi3kd-&CkAU<$XuO=oNj$R;O5(f-)wRr4V zB=7L8!V@?g#-@qYg6Qe z5KU_vbhj{9W&-b@WZHgvw|2`16wD$LmFE3XdQg>zvbLq5a+V5BFX&JIR(s^qvF^eq z1uVCyqq38c#jjGsZsWaKEU_@8oci7!-R3%Ek~Ob5csulau~yNtil{YR=+#do+W!@D z;mfK`{3Sj+&ty-=1T((PcKzng0NbT%BrAXW0Lh}yyWDMU^I@Jz-TwxSV!{c(Rw10v z7&sX5AA5SWh_lB3zD#F@-RdSQ&#F&mQqG25rRjb6MOGWhtkMRCd_S#NHMAy`8eEiR zZlz@3)oWdmSB0Ovsx_2@xrenEFg18-KsfhCBK=1kFqiqF@WuA}Rj*PAW%nsW1(VJP zq(4g;4dhQpo9S!n>PrQrOTdBDS~arKgcckta<$v_}|=>;At zGZx(+*e+%}*$`_>m_Xm?i!)!OZ0*e&^UCgJ_ea)tw6pNWA|0Tef>{H+*K&duk*dDog?Hw!5#Y~GsiG{;Z^-8$Z5`h zdp|I>c08I9Lny9tpQ1{pbL=Tw|L;M%{yU~6o2+B$Z3)Qt`qjNy6|LqR-=OQB=qFb&$+pBvO0$ zUA6Gvvs5zYXEW>?rOFn?!LR-`E`6wBm>ah)msC%mN4kTV*>dEzvEdolH6%ZQXJC50 z)AZlg^kHxhlA~);vS^a9l=8xQUQ*2pT~>kz6Tw(uH}kFkID5SQ{nmX)svLwy+pM8z) zv23+aMd>h$#rUq8nHK$ytyt-F6Hpr_zFR6Nlp;Ft2Xo+H&8}!&lQi#=e-zO4IubGK z)l)%VT4HSc=R1wXWNW%B02wp=??@6U#T@W8e!P4@l8}ErCpWQRnKK4IwKGSvO@S_g zYeaXGfFhE#@yEY=iM^FJe{yWf3m+o4QfUWY*qSGQ_UM?&+fLnrN<-MYPHF; z=i7`l>X6y+0JL+_uDv(i%oj+DX8*Z$MN5@Vh>7D;!g-460?QWq{UYd@b!Kyg9G8}+ zCJ1v8)ni6G&phu)Wm)Y3WBx+vljP0Aa8YyVFuY7uksRTB55^YRk!NfkxUS~wzh2T1 zbta^nq9@ME=&NUTxq7EyV}G%H@WEHsB3QsKi4N?OBgfOlzq%93m1C|;N9FF9BqG|{ z_)!wOs6}I)WAT@iXf|I)*v`}=OOa782l~Qvlk=%8%5HNFrcdFQ8nw6Z3Xt+6FtZk+ z^48r3jt0SI4zip0PL-kK&}w3L&YnQkOpQ{Lg`JN(=9#sd6sOX}p3P)nNTH8LjfY~% zsAO8a$X#Q_0FG6W&E!mu-Snc1<^Wyy{|t?lm0j4EFH;7R${M(?0}!g4Nv!IIcB&Yr zmS~T}QU|6QV7i8QzPf+4O#PB4?&NcDEC=ksmq!0Is{A zpZG!+ht)lvua)-phYnKc3DH{GE#yA+LS(Fm>Hs4a>D@`u? zjpBSq*mvC2D0CTG-@U03YWS5%lxlp86!7R!HOY+VHk4>zrBqxC zIo7`Lh!V<$twLI}i*7NZNcC_=KBYy5$ zMg6byDQ)y0O*UD8Kk|GMdy1c!{J!%mJ1nM02{_TX%4n(;kkTMg?t3Ot7{1;j*(;Dc znr|L2R$gb3UKYW|qi1)DJoKU0*mHBlNi$qZYApJOXYfD#I1=h}(K!rR1qpeHD|;8% z^Ko_paFki%I`WNmmJ1Gt4)`tEZkTGS)9j(P#@%&|qo24x^9j~Cz({^6-UHQ@d9tLh zQmQ(YbB#$`EVX{dfzisRFbLzPH&0(Q4V#FouM(`%{mYK`Q)h2zpw@wOtfrbuqshvcZvU3 z&x=pft=cwhpCls=E|>+FjhWi(ZRU>lB7<(X&yUF8h*YW9$P=#g; z2QlocgIAuFye>lfj&PIWuq~{4j`a5HODojhXmR!W=(votD06jM;czEtLSf{a;Nd~u`(tIK+mo=PE zA`HFnV@>Xl;PKP%#~*B8L={$E&*Y0h^Ef1V|Kl_Y8noV4X^s3zTn$sM|5#xlNX;^7$^{#$_~ZlaNbcYe3;&Ti3do^FM5WrUbd z?}9q5$82{`Z8vbuY6AD0p9*2dcrxtAXRpAlXyQmuR8Pt;{C`pxZP#-{cc@TQovU7! z(h`=+{O*|-$nt=75b2LuQcDY{%yarTRoYBBiEDb`Cz-+xt9jGtc>PyX1fDURv}rHw zO@6)8O%yLMHaKt#Hd-2RIP_+w%F^uTapA*8x3Rt6PzFC(m69syMAA6{3L*(tNi&m8 z`mh#o>(>bT{*}qI+9=%Kynj<7E5xD;oYYR1M4Ugm$unr#eckN|J#b^B%_=EiROC&A z32KPt^(ziTt*AV@lx_cEy%K18G^31qW^?&Nn-{TBzNezT0)OzJ6@BJ<5mM2!o6I8j z!H%J*^jVKp2-Q`4px9mAwhoGePU7cv>P^4_??#v&iD(g~$7TmLKdons^b-en8s(31g{{*wf+JKGh`tE2FfIj=U)@Oyc;c4RLS@mI-MMAU zUV_u^0f_!F%)|51LvzQvMzdeE ze%M@Vs6$jeB4?;G@+{pvU$mE7CwcyfxbkpmNPTX|RL-*pI7(b&saVT)OFo6~&$ujnuwHiN zsHAqLvxUFzua5`MBSd79Q>mW)S!yRjltRwH1CN^M-^2kdTatewM`^Zqtc(V*LhKx6 zkE-(2`xED#iTikVn22}#Ry`y%I(to@SE*0vAxhhYo2W)<_GjyiABcc`hQ~~MxW7mr zpDDH7O$F}N*S3`KHJdk5kUV14d;y6*D|`o>rpvsz#81DT`=3(Wtg-m$g3LF!r)i?w zi8I3?$d8gFa_7K9rb^GJ9b00jHRE-YR8m%bC975aR@$YOpK^`g*W2#BWbTihW$Apm z`aWHE?1M*0Xy4f-llA|AA+|@i!Co#dXnl>x0Do6rjg@-i(IWqDv6r}+zg+ECdSpiN zZReT<@jUZe1;A9QTTiS`gG|DICvzK?#??CUN9QgUDxOE)A>>GXr#MI4{1x+C)VAmR~vl( zwoiZm54XHI26R>57CizvhqkzoR|>&E_7X9VgjCt!0sDzOGCv zzG=T^WTrqF&HIp$$?I$9e>F_DZ(1g>_Yl58&==h4RjFtho$34`6SKCtL$nhb2hCU+ z^~ERwEzDx{K1!qBWGewU3v_s{IW8QK+o8$A;I^NUZPyPQ3Ix-lVPmyyZ|g|$`NIqZ zM)7x+m%XsWvvw6x%hG08B@x-^{_T+_e}5m+Gq_U~SEGSrQ-x$9c?i@o?-KLlP4yOv z9y@)sk`VBZW9TbA4&d)L`qbffhikgj7=$gw)CY>r;u06creSHX#T7+RFbM?js0dmZ z?dpFD*>Sl$%(&rLZXmDGNIhKU%g^xSZ62Mvvk~qeJ0*N`U)1|qH#ps28hDoG-Q9s> z0_5HVt=3P&a7Xa+8qE^N*rN*|v>}vvLy=v)8if{E+wSYe2S5xksy|=@XdqNt1M`$# z_vdmqYl}?)EuHvt%~1M?jm5++=ECCzar5mQwPR4+M-Vg8Qs2lcslxbb*5%jBS*ogqK;K*e)($TV#ftfd`fF(V9_D z+4nAT*-JHErVo~L1x|fd8{$$T?enBWF2u@XG|&4)UKPHw4SiR3gS{5n_JPjp0rVEw zw^>LY2hZh;7Z1Vc__}HcCQ(+C=ZIC3C!=3QNuFQ2>L#$>cy#{U1}E>Mf3%)buopq| z#v^2A5!K@b`j5x477uakc8=DGLD{gUp8$J{1N2()X@~4p^x~KjZN*xj_|MP@_BDhy z#8**r@A|XsltYFVJn=APMlg|cNv0U<86h#h`4uQg-Kcl(O{obU($RbI*$U%_!|;`5 zzzQ2ktjR2qClO&JCG!HN;?QO_5#rEy$JAMD=N`j*$j@fQI%d<9? z3%<7d@1*iy-AW~tu321b`8|OmT50>s>6denx&##OtwVc~Rkj<8vi+c=$}Vp{(!<40 z&WFF@Wpv1sN|MH-(i4lJ=PIags|RV+X?#PAwZ0(6ZWs9Cz6C^7Z)n^Bauu{QKX|tP z!en5N28mtAY!I5_Y?Lvg)kHeDi!18#lT_0)+{SC<8pIHO7(2m`qkKKVPz@y*&xSx_ zt=@VYJEg~7dUuSX%`X!X;?Hbvux?;c9b~bJeFhAW@ zc7EPlO+^3RToaxVCVN+tZhYfqvk8GH*-|C+x0J2eTM`!+wokfY6EN=r(j1lm?4)9w zgf$0OM8ylxa!Iotz+}?PJ{!!&ZJou-&c}iFbZPe8;icO-`yazc5N||oSWModEB(8} z6O0Gz>KHTkC>DI@K@m%+EAl7aX?2J83q9DWZu__+o6GAoNKg;*tB=J~2*gMelPZF339ZL@vR3y-`phna;FbP-2;s&{Gi&7;dqSCKmC9e}pTNANyy`66@wPv`rnjlfZWkbXtXn5sSI?~@_$9ui zzUjnh zyNopB&5kj&_rtV|JBf9f8%b+Fg4?*THhf)1PYSH|*yrlK-8tIr9K_;3L69HS?pz3F zkBPq{jXcB$HS}&5LA!I&$9=d#j{HHSwv7KiJbBY=+R7U~trb1vFRxfv z2ADTv)KmjYpB~!0k!WN?DdJnn8zepD2w5mR)Dy@S4{6y|+P5uybk-oF;gTP3i?xHe z$+#s9&vU>3%L>Hk#a<6@X&?wU3Xz9fMhy?rCiqW%^29$CCa+x|(< z??|5e;>Ew;|L!9nkcsH3^K!*v=8N#0c(ac^^nLW_z>sgJh3)URQA6?!n)A9^8O0B` zzCEVuc6lkqlRL+}*7|tPK}Ne4O?i)DY(vebh$R^qP=Hk<`zd_z;lFd<;2vDwuM>YP z25&3|_+`XNu{p!W?0CC(P%L=Yc?5ao->?LB#$0^^@fY;Eq2UHH~9_L;73MzwZXjo)@I|H({z-f)P=9fK&OZxU$5`zV^ogKIkn*JFFioAc48;}rw34JNOjf7j@ z6$ab5oSN2~2g*vg(kf%B^~}x)tPslFUrs(Nadb^VM8V#4NogeyiaFv_3hB;aZUWqv z>ESK0aAgD&*lvh{+*B2e>(uNjNjBw;f3gl=GZd95c!0A7d2EoH_NwiBKh$a*` zMWoe#J`Jz;X};P*jjyk?(cm8H^iKHI#&U7xn-{o_kso9iU`|}>xUZ1GoVARaHbsNw z>R=)7WPbsoG4Ai_`c_S?oLyPJe-VCD1 z)_f4sjF4|*97KzfJ^79l?evkeolLP0t}|DpQD(v<8L?8LT8t#tA6V6O(#tu0lZP~- z%h4|8%rD?XgSNb&c!-kI(ObDNGu>SXV2 zY{nB~;`M&$wOtLe@c&Avqc4jG_+Y&1Wt!H9Lpd=`m4X7vy`D#E)Mm) z9bSaVAo$f#P56aVL~ZWG>}bc6hU@?pFeg(F6H|sb_&KbvtPZQ&9U!mBmv4lHX27Tq za;QsI2UBmn(1I{Jd0T#=AR5hG2k+*7 zWdVR&gVP~)WJOQlAkLqd&AY)aRd|W$Gq*G^D{+mTU5s6C^)XfJUMkMXhOvw#pnYak z8yu$7Ni}1`Cg&_N$+94Ay)eQLM@v6<7GUylQc||9Z^_g(r?7M!xgcQOB8^spMqIBV zzy+JcLn&gIN%rj6iogm*OXf7YGsYWJS3jDV{EQj^B0ma*Z%v&kmz;kSjcEXnTaSy& zjKgBq@Rh6at`z;$a3ZACO&`o!z^i&GpaJ2@&Dcgg@Km)_hr0L!dg=Gmt2nZ8CagZ}xxq z$QfjzB+foLGGUZqVsTPJH6?HOYdDO?_?!MiaPp4+u8Z8G;@cy~Dl1IIz-?U*T^{){ zN$QdV;|x#wdx+z_-Nr{9M8SgkvDcIsI{OX1k;4g9qF#31L%edJPDZsuoc?_YWUhcQCFU_5B~8;{TDnfBJ@_y+q7RlBCNkxcndX zzOpHfs9P5ZGBDWS?(PsQ!QFLmhu{({mWT^qTTH& z@v#A~MCOd;_dE{N9fH~RVpNIHhd0!>rT-8U;sMnClpGTAR3y@wPYH!u4(~t3Ha8vz z^i*zsI6s)kRO|WtW!ft*ChGn7SiG~@%AFc^8VAK~&3nM4TJi{R}$Sd9n9 zy`edewz!x-Hhpd~y=J-cz1W}`2>u%EPT{>3^jehRknF=-!#y?ZBj~@P{=2DvodoU+ zjSfU|`Mt{L;O^$OlR5zS(#tpRo zRa- z7+*~0%8JE0U;1X+vNINuM8_^RdM7m4&GPYUErZwEK=QCNHT8?upmXUm|2|WoU&gB4 z93iPSDO~O=v+Ix$?$i*AnV9;}fVOA!@(8BYK|MyEbvw=@3FrF`I@d1tuocqtnALM+ z%heBxbM$q8zZ($Qe}v5_BMyq^BOds%SX(VaICA^~1I#u{EmTQiurlirW;Nt>hQNN@ zu=ZTBLZnn9FL$b)7o8IYrA76t&l|>oYOyjKu`FP4WrDd4MvF8Rq9C`r{9x^$52;+n zGy0i2HkG0`RJ9?!L(h(Kw&5Xx?a-f0Cf{{ZfD9FCw|~&K=dBnLl!lG8yP{o?bZ_rJ zcm3T@6&eeJXQhDO$0#`K5bJ)uQLNoNtVB1NFEFjYx>rNg8`f|{K{scQ7>&z{>v1Pe zpE0F&c1+}61md(stXKPkQ5dtcBNb$4z~|S%!R1x3nfht6Bd=Y|h=OkeM6B=M*Q&9D zh}7^PXe{QN&7n%T-QvI2(uQX>m^lg*$0FDC=oXBQ_ANkPd03_C&ay(9oN}g{ny9k^&PDlcSuY7DEK3 zii|vf>Crr5{h7g%*x)~br_RMMMVWln(vyngG`DS}A)<~XNNm)%SLGex|4I_{5yDrTe6#dmM5x3J95SE9g1zetw}XPJ{J4AMOIFdd{D_zcDr~ zK!Q4d*)IXL#}4ZN(NIyEcF&_OibDXT9eF*wY&!KR8cd zF?e)s9!JP&cKM+90CN%fL-$9uT3?BoW*d86M2IjBXd7di88LAsaSkXw^&F;`vRKB^&tf>J9v zOM6P|f_2uC`Wt?8f%M%v3hIeJ>QjT*b3@uDMMZ-%+MjvEcD{V4%D2#SK7Xt|&BwO9 z=XcIIg9N`gs3n?d{+7h1W!u+4H|fGTauNNW53}g_iCy6vHKTVAiSMU*Ol~W5xtSIw zpd1vjTzrJ-1Ss2{(q7;2(D6f4!7KphoAW;#=f1zo0{RlkpqT0LNKok zgH8Xl!4(t5bpLa$yiG+Tthtm^Mao&0!-C_aT+WaBqs~GNRop8#oI!qJ=#>+i3dXVQ z#BfWJwDK?=)xTxm3d;>MYYmXO$%C99!ksVZIYP#(Qr>UYPbci& zd~f=?H7MoowfK#{iJT4(hBV? z8@CN=aAV#lza_>*FhslyV5zSz6-fc9FE}QLiA$9*LXQdL*7bSr1!ubnEp@|is@6Bs z&3F9gTZ#i}4p{RlxHvg*T9O??0!e;1yM#Px!-LOAd(np3Pjq@OkSh9#4@{g0kvc80m2$8#`LKe4+weP<)NvZa>AaYV1ssn4gQ-PvclkW)Qjq z5pTy5s??k0S^F!5^Rvox3ac@R>Dk1fJ3w1M#20^43Zep;J%tldJI>6~tIc^icQ1$3 z0s~~c4FT{GBR?>u#KP~~B!O|JU?ae=I#d(8M_)sqxsUcZDijjV;9Q~aP9{>7xDb*9 zw-lv@^A_H7LUv?=$BQO3x?sfgpw0$<*8-PF_;;n%yV7v?CaXLlsbzxd^MA@K*^3$< z-YSq9F2+-fFQ)~IYI)z>kVsKoK0=sAb?ITY$XxHk_p?d)u^n|h`{8}2Kc2dWw?}9F>e~!B2;$iMKuL?B z_r@DJe23hJ4!Tl4eUyR#E;Ol3ThCFjz))-$|2QBe1rt6|(khQ2VA~v0{kOl&xEBBa zX#r4iugqeLM~J5p(yp$&&>H&YC2V6MP;-&)mv`X$t!D&3eY`fkYslT(38IQwGr&u5yH$1*?O&C*(=9T$6%(7dJAr@Z0b=O-i5XX4cb`iHj|JiTNP&yIwlHst* zv~oG5yu&ZVcm=l>0BU4ZG}-rUi$xvh;|r{a66qh0=QuI@=Vm9MxzXL_POXFJ(}QY} zNJBhf@%6(wxk%M3?uNFI(-A^c;&BXdrj;Zb=2I=m*9#gw{zh?k)O%w`LwdbVN5IAY zq$1R+{>-P5H*Bf!;vdM&P#Xt@r<`yfG2BSGH;At~K#CORn@bD28_tZY(j z4S|8IgS{#WQm(9JikspUkb4;T?~tq`%-9t~fMfD8rjUB^>nuIL<7S5GiN^Y zX_Gh^DN766mv{S)s1Od_u*gYEpme36ggO;8kmWFWN>wXk)~&r>c)3vcr+9gK$}ee~ z-yoyX>hL((zRcQA@F41!W*f^Oe;B**cPot@#R|9crT3;6!Gt$hx}14M;~%umrDM~7 zzt^~Q_0~F5;CJ6m9HjpB-gSh^d(hpgU0x@$hbuZq|70l45F!zKXk@i}7#)i^N3DaMdG4@bi(YW?Se-4wh!jSa-nphK8?dw!yn`Vt)xw^##?2n z6u^x*1aPZ(AvDfwRr)VF{6YtxS>S`sgoCiTq%Wc}zI8GZbbWA9v6>8EP!IMoR}mfz zb*hl&fmulVq{+wA5SdelxJNbTuDD3WA8BX$k6MnzgRawxm{i|AB1Fs7nMpg-JO$GjU&tW8W$m&VaXj|%Dy80{8q|Avj{X9q z6Dw9VtMo{UXeR>H&hxFLjF~NUuF;p$?P4qCDlQdJJculD9C?xAJa?g5cwTeI#?$t! z>cE8UgzEVAa%eB_e+?%?1yGi1^d@T;jFJF;iIV+t0OWZtI1EEVX*C)P?A@@a#v6&J zR$P6Ef6q9dDtDC^5uu=_Ll^d-W!ecjQ)-`(Tw_NdT%IIO2(=ba)(p_l&k%@NmcG{O zg2R!!CI`YWb9c-1lRQq^vZV1buqw+ zfNRCAcu+!NM~C{h6{^^!ao-AB3iEc%`kZDa<1xe;haSdD2ljVh18Nk^8Hs&uJ=-J0 zs0n$VCTJuT-UFoAz2azpU9(thMR-|1w|NpZi>H@UMexzhR52fWVQxD$c3zM&o`wXO6-uX!i=q4k0mnQuo{|!! z^#E~{ZvB&wdA8{!4tH2R!aV(%G14MFQWTMOMVualP^?)w$qEK}zEA`==j>br4|7``GvIr{{B3EpKt#~;in$?np zl2ih3?jZ)`7(Ha5wJF>HCE}SVLRwegd4T2aB?r}3-U>^{M)}|6g2MCCmWuS9p(cb< z-A+6{zPdS2LdkX@2j0%UOps1a2Leb$#SiO-&-9w_uT4k*Dd$-A_qnckGp;J}gIJ^1 zw!1_xkzTM`zEE5`oTSNSk2sC;{Z+u*seHDdBBvcm=)`u+9aAcHgtC7JGyEQVaS?Dp zkzEVB1LwdeV-adp(5Mi+1qP5)AzLQ@+z2<0NO}|rTRIF|VZ%IPm|9#@O)x_#TpHAp+hZNec9aq$iZ`#OiSZ^3{s_TNx3ZLXOLJMn8ya5A>VfWUr~d z*XApSIYKiE`~V_$dR0Q?fcMd%3mmq_BBsCb=K)=zzr2Tm1w$B=aKp6;@A+u%8Ga5*nd@H#9SWU zrCIl?~N$f{RNCa`=eg@ zH*KrSfR9PfKD)Ck7CnQIGSKNT=@-vhPvo2>1W6pg^5qz< zixQ*772Xq%i0RLiHMUI}sG;E$lh5^A)1Rv+6*N8sDJS5DFmfvIuUqT!D?nHj9-C#O zg+A^HeI(y@JmwpjY_=J+07dz96H1L_lZSf9*(xP+oQEeSwyKZ2q8iDw#W_Nf!W_|< zA2-UYP}R_P<7{`{8>}yFR-`$ozD+ zxXAJLOa8(p>+Oh<>t4XjRy7)+ck}#4!2NsSNfK>2>VWP;-n~!WfftLkjOOCs9-R#` zTP#dvJ5B1Ne_S`O#ReN>PnVZ<4h-L}(`ulC0o$`zkm<{i>1hiemk+h+m&ycAA9F5N zWI3tx1T?iT2yEj)i?i5m(cQ4G<(W6e@tS(FX9(0dlce-N1CN{~SGF!Qb8*)TY$v_)P1{kON9+KX<5&TckrG8rxq{rLI3C$D&umeHC? z^~-8Bb3=yY@;3A(0r!jia;Yo#H<2XpAJ0l`)ulSCRF%A<(;!P10v^SZe;Gq>u!MV& zQXVV}ty>1?EM_*V)CuG@2TKh#7l$}4B*r*LK1qwy#-BLFvxNi~+M@Qt6vHEnX6d(x zo&2>aWQI-iv|TR9zr<;I&!J`4T8vbQ**vf0{aK+aZ;(RnJCAjkunXy}!)^`x78Q%X z^U#G0D3kLKzhgFSxU17{rU)7T<+D8p zpTh2a6yy<*6aHqwih9O*cu3-jf$I-5Qdn&ZeMm`ESEbsoI>}FevzGTY+I=(^!#H`2 z9s*WVw=iq_4Iwc7y==lf`_4qGg?{#+4spcTDw)cl@z1O6_Yoj2Nwlr26}VgiV=cE? z>CZ{KKb405z3jYJ0R7nyz68xql>*2DR$i*6pV+2NA3n3_A3DPfD;w>5E=hZ~tvHG9 z+CIt%ANjp^W8(S^|8JhHW7hQHYpG3{pp4|)1z2<+Y;sqhc5B7bV-JddwdCYtqC19F zF9K9f66{H@V~_q_-@wEheu$Ebz-pGt3Fc_jaBII_)zp6HQIyXSzH=a~iIpjq)YW$9 z+E< zTz&?{|GYkIK>~zpEfIpNU9bO~67Dq&H=~U8-`5Nqjtm&&Q$YcIycGJ+DdAqjaJEpC z|6Vz4xY)2>VePoEmk09yoH7s=#)9LW|If9LyuNRaNCv!M{^yk9urLZ-=Fxwy{R1_Z z+K&&^Vgdg-B_Hgnj@;~zQ|L4iXOPEUxmW+Rk zZ^6`vzP!C|EEW0fxlBsh65hM@#lbt~hRQ`3J3Yil*NlQumjagRO&;kxeGn?~&LY+) z8FwM(AfY~@4SV5dW%Bi@YGfA*$oQwbpxTfF9I2m^7aVz`KT?dA&x&0t1ve{l=)Y9P zdhYxbFuL@xz+0y#`$e3iMrW-rdzR*=O?2}Wr zQ%b{aK4WX8O>xuD^cZJR*9^zy+2{ALzGIq3TjZwI0n8rz&B0pYFVUXo=uMWtE2Uw} zNB3>5@jaYVhA{_{yKH)k$+9p5P%5w!Jp z+61;PDCiLgr|bHIBJ$D6`STjAQTXMEuj(JH<@PQwx@hevri?N5yU(Nl%XMPf-o*pv z`30sT@(xS{%@-aZBsl?49m5lo9O#ofy|&;tM$9;+{rlYW?|Gt^)_Axfe6haGvcl>i zqIy}h$M7#g_WaPasx|l63rwTUCNVvVDG`5|CN+nA=hc-?wdl+0ydLcYCfDXAIpuTN z%IR@hdochkq5c^6?;&oV)p~&bi%)Q0vnfmXs%F}0^LCUUYb~9#P{QU!p}8Bu>e@{D zen*Ux(tzUgt9I7HJ(BW}76kZdO?*69RBn(aB4Naod+Wn5TViIdfhqY0A(4!d*0~iP zuf1t3r;zl{2o_pj*$dDPo1Ap2Pcr#09|x~wFpx3qgvN)#1nJr;e4pbd0QBNE6l^)E zVK2|H{`OMIV?lqup?Q84pO{z1nwW4;@}VI_~8)^ z6~SaexGKY?0;go z`Fnlich}}~S6BhTzmuN7m4TbL#+x3djh41YDRjuQcqw#bfAmvJbC`e3IC?4*Cl2a= z>wDug>SPVlt^Uy!O+Sva)sAAvVw{oQ! zG-G)$)Z0S50c%`3(y5nhgQgQ!5=83?J93faE9mUBmdT{+>{;S-T&TV;v@;h7PX6S+_qB5&%yompbAgxZivTJ;AG(M z#E33Yudp6@rvAxGXz4-<*Y1PQ-Hde$v^UWJxTM+wTi2>!6Jg&8J6*!p^t;~ldGGm6$|}5$C4Qg3 z%^dOHwVpp~0zHqDn2(=wugMZ)Yry_qiQkl6blJhKHKsi^cm6kWUmE4{n)+SLUtsu; z^0n0%)uD@5wzTM;lxXNgm@5lZzs4^~-{U);0l1>wtFpmT(THwUbC8$rOF8am{UJ=Togan)&n=5lVUMZA32Q~oM~>A*51MZw|U^dF{1gjRmaAb67hhp*=LS8 z5*1prCJ)CUzlA8t;mP*XvNa!9+jKazHaD%LwS+q=^z4y0?fWjR;+>>1_-Ew&DZMcv zMT&ndwymOU&GqZoa)Z*V-r%vy%99C7#BX3P8fPC0lQG z9jHsmS(;FNc{UPu4FI%+Rp1=1@^s&k!mE@83#_TX6yi63K;Q=NMQ!3?I$T|$691*V zGp8g7XO%dS4EPN%Eo-Y0RNw{~NXrFpXtS3D3PDtftwCe7o~KWsxc+co@G+%2~VqehhUx)i_}<^E73G ziZj6I&tYOja*69H@w6fo$F32W!*1IZAms?tqOdjYU9)JspV{M*YU=GqT)#8 z7KXi53J*+Hu`6F_$P-Vr1}%Uzk@HuQl5nlZb{zx-><|I38qTO!>#eW93Q+OHl3ERpKNb>iJRkhz&sLx|m=rLWWfJ3Of0nVON zY0X(h1HID7P%+e_4!-lQN{NypQ)Nz9C$==_r5grtSt#!fvf^*+ogHm~<^ppoRzgch zn}7mh9!ED%<{2&$CiR?d=1f4}bNtJ-)XvXO5k`)g@;4AhPG6XyVjM>sROsMPt1wrq|Gh!L_fbWpgdC?tBj>3jXU zTbf>~{LbHwM0pA~cHHS8qKaNg%^(#!$=jz!f!2$65@zYZ8mHLC<%88yFLN$iod$Eg zqK#4+lfVH=CN4*v6;DR;5^&LCFR`@wCZ}U zRxBsaGJ)|39oIfy8S;W9qS*x=e06eNQQJsHV}moLlH*sXTL~2r+3hR_+>c}y1nY8JD|T7{lg)A3`P-`@DsFBrr5q5CuOGh(wVpU& zddN(VE1oc%Fl!rvt)eOAB3;64u+IC#;j$Ig&#vITO*}YpC_{ow4qKUHmR}&r9 zk0lt}8?*5OC0USfcw&(g9Kw|aZOpCO$#EJi*+LRJ=&#GJ=fCmGSgAZCBub#x=WWtA z1BQubZQpTr+p!{(@z@1{x|(CKgejt$Gjhy&P{WCY00CX9W*mg18^n&B8a84f?3Mc$ zQdqLWo@=DmNYi*Qt0{wRbH$)+b-S0SnD6EuejuI_FI+_b(R+vU1)SO|$yVybD6fdo+??$>Df59NB4hH12fyxxq<*02;zkP_M{Wx@sc7By3S7Gv&DpApi zO12sg-tjmb`RIoF@Qz0fld$_Waaa=Nd3wAit{=u7^P@Q~Vax0fFi51ym`*~DGX0z1 zT9u;4mER$&5_(M@#VK!EVnb9k`MiqBy*Ck=hz%mjfZbzMY7=#vUaPE3jevXwp3!gL zyt$7!{3aoNEue}>lBE^^A`@C5ExieRp^|cB!AB;8gjW6vof87a0jdne>eXWo?r}FV z>jqf??z)V^QRb{%B)<%raseR0886R|5h%Jo6v*M{)x5Q?Er>V1#4@^|j!Tp&(bZ|& zXUfGIsL9WY12k_9l$4e-+aF~xwpKtc;^ML*rz$m}G#0dW=#SF76xTb!wEoW4aOP+sXaC2!$u;6w}Ynbmnp&h33}XR+bL z334U5qRZl;V{>$H`kGWcgd`Mh)S>bmiw2NH6YqP#97D#Y2(1pj=@OxPB41pR-8fTD>zW%@o;=%_MwTas# zfyf539z-a|tOPr8KeT-si7F*hZ98e|hZCHUc7ye040*k+`ViPf>fGus^#b|3Z|gbg z!wdXw(IxeU-mv*FtxQA4ZcmoFmJwnK!Hz%BRU{NZdK&OS%qIX@7V82hkE$lwX#F4% zu4Nxk!9gE1c)=IyttmklIQ{H@zy1}A;Im#Yf6DLK;mYFc!i2WkjKbxj&S{E78fF%e z9zRfRjw6dJiR97tSIY3WV-1I@&KOr0+(3Ac8#&v|c&0lbYtC(TUbjk(Dv9+zlr zcoGsNHPu+hcMesJ3>I|ju?zZgtsBb=W67C7{2)hYiar94R{eTWp#k%ZRl&08jg**H zb~Ntr0wm9hY9Q2#y*qc=K3rL%8)IH1nUG}&oV`Om5jD9xfSQ>eu$D;eeEXY8VMssW z+F>!qw(WCiA}?O?t?^N53FEYAaP0wk|C;JI_8v zS1~lDikTmY0a$<>QBK1<9z0-W>|J`on^CX%5bv&i;tHXxVABI4LP=NgKUNC0c}A6^ z`^v0{ITE0QA2PY%n6yl)nEx*3Y^x?AWzm&KWJt_J%E_w2OYTZKiYTKxG`av*}>s^pex+y>DP?h;|bS$Cb@*qwp8=#A;W@uVo` z=YVQfyGyB51FFM5yeVFSjbYibi;ez6^##m{l^Uf@}m<^p#`mejVsaxX(`_)kr=NV$=IN9LQ>voht~|V zfd^e0@mS3*)F1Tj)*y)OkD-G(tQpbKT0S0=&v7eNs3s=L+c*09b+lEz9zg}D5upx? zH)Q5+vni+hmzOYC`Mq(C;HpSzTIgjKUmC$-^1Jq*<{X93vg=itJpECl85aBs%2x*b zw}o>+1#Nn@G-3Gi>UxJ!LT=en(!^vwChR>Ge026kG8qoOd}@dU8nHS2NdFiOA-cVL zIaMGu=TddEiO#ref?+})+HU;Qo*x~4aTF0xffwj&Jrrnq7Jk{#V~gO5eMF+EumSb> z*G3hDjz|%yAguKk=VSjkW@)N+{LIC^gK{dap%h2`8-?ywI_s8EIwLh}C$r}~q2tg2 z0`q$q=w+G@j}D)LoU*IH)(7;i(9ci>fiC06E-XW6J;uFJrqvWTOU2Rsqs6827UPL z4xOi-=g;-j0~Ht=rL<~wS zAWFsy&6$X3vX%z!x#4{Y}o;OOW8LHNiM%qA3P32EIj64OEE~eeIu+B(DHawbm60dGH~$2}6sEjaB>==PI2H%S#}VQ9naR&~S(vxCpzN^?LdGQV~F z%WSgI;jMxR{jR?ERrgo#IC^v?El8L%afIE&nxc_E;~JCg=#|kpz59SJS0!G5%D{Oy z3VG5>1!-v)yxVp=)KVti(GD9$)>h_ zDbGppSUtop;+vXo3fl@8H|{S2N7lY(JzWS$ER!ynMhJ?HQ61r7cNj+pNHj$ltST~* zjR%$L_kVX!kdG-Ip@;X2;Uvx1Hx*V-%LiuBf-?bOD2TisEc-)Hrw?Ce{5P(1ZNPQ3 z;a1=asBPF=T3D)9r50SeV8_OfPh~LXF9#3S$(p^u7!LB??c>}s9c=go)U;Z~yIJ0g zW$L_!nud?I@``9(bJC4pQembX0#<7-8ujp!frJ-0E~bTTtX^Ox>y>RS+Tl!mN6u~R zzz}-zfx)U_ki+1`SfYm>)hDy9Iwb#;)DY`TRHpCHFARA<@)e z-_1+fQ=2oU_v2yJzx0d@Nj?e=O=Qm59CfvCnL-`wd!e$?lK^G#?~*%;kYGG}=Z}eq zfQD(Fb*FJm!k-B(QKDzNqL?HPy`b8bZb|{4G+ekL%0IJ|9(PV~;;3cQ1dQO z=l0TsFcLjMqSdcF%g(4E+PdvEE`yP5Fp?rozo9D*?Zp_3c!EBM6IU=g-j6w=OfOVF zeDs!|wlm5!Zc$IlCJ#jB-d5BSi0&VTy}UlD%XCv}T_%Jy3V)U_IWX(dOm2;$3GZex z$)eDmP5bHJpZm)2!3*M}`3AS$q_R({bIAs{t`uwjUyV=&Iim-PHrPUZ@i&o913XZo z)U`z9Dt5zKZ)d8s1(JBBZ2>V5 zeb=32D*OT4vl)`Os>{ODC(-mYHf&6eE5poAf>P%0<$|zCXo{B527cQ&e&1YZxxPbZyrGZXn;0nt+^(sweAiUs^qJch z_4G!D-Wpn;+UI}em`g15hkVBt859H+07@wfzMaa9$6l25v@3vDU1sC5(p~O%LGxP) zPwJDbV3abpzd*G#Sq%+W27O`@X3i#${JgaKrtv}njjb>zMAj090z@@SB&5TK`cc(I zIkIPss5}1U&M+autZKrpC}r`&Nh<=-@0Xc$c*g8&i!66`shnl&;1++|1`NB6%3S=6 zJb-CC(Z4upsVV!ZT=3AxVSXhj>mnyPl}DM(3>O89{0KuA_24-~oS@M&Q+WC|b8<_%cGxvNz>RZiI@kR=;{-Ylxh3qIIp!6T%K!-bP{ zH)}OR3ny2tY3d?iZ-ov8qmBA^~$dLGIUBQn^D^ zpN}>p$thUj6&|GrHVi)VY%S3Ti@WOS*e1WD@ITcFyg_U9iew;a$UGic6C^(KS?2a}^H!E=)jK1Ne2CxeJlmt#NCJ87y1e zi%Dw>aSJ7q?4y$fs)Siw>}-wC)*?!A8o-6lS|bGx2c=WT`8wEGwc$D;z<2@$%?V7_ z=9IbCNE1!DNCs%-1;}DbQzw(lsd~L{6xyq zhx-+2$#L9wvMfK;8b_nh)Y)pC|1~6;YABHX5(T`g4fumc(DEL9GtN};erYsYxOm(U}d9fh}1AE;6B{9Y}KTz?%tZ*5{_yIWA zz+!HcEj`F*ET6tPj;)v6C}%h~b$`EymUItqZlhTLRHpqitX9@7F%sM`8K7Ug z7+K9R-_EF_t&M1>k!YERC3fK$xnrBH302Zf1?6?jB>Sl+%r52gkY0EUIJm~DsPVD* zSkD$aJ%4A)*f55SFX322gb)BRXE?H_qXNmC2$;TC23!OK!I!1s$`fD@Lu7OFDKlDjo^Lbbu{kZEc+98K7Tj zkSm14o$Re~)JH=rmj25aN?(&Egjjt34J9I8Cs64-7KR?2w@kPt##JNFSst~T%@Ataisw?EU0ohy!|02zdT6>OObLnjBDzZK;+c<`;hzadaomb$XM zL8n18!M9S3PZv(5_2FnHC_J(@UB(0nzhxo}m5x}^wH#DnuoT28;0!V5_7|mAOC$;z z2LefYXh7jQnQoRNT6dE>oWKVi6=0>+{5FeZqLU2dw}>DA=F2Yu(qJvE{@O(XP#+c8 zmsgIYpWn6LU7H_$$C*0VA|NWEE(9VTfO7O3ZU3FIfoJ!72bXF!Is@>kR2vx;JXSn)`cPR?_;RA%f}+X{iToD{##I`XmYA5ymTJJry%{3 z`N{>Oc=v=TVSK;ZDAV`o7CXgL%;0diG)(RWTR-I*cCsa5do4C~O45bR=se`7L!~fR zi#=u>YiW&P%TSfeEnNPI4r=r4@Y3+9Gj>QcipT6PCAC0;Ec-6^neIn8zV0mvxymh9 zo+veCGoGC(**STREFtN{(CS!qC1J2a;pA0+MA!iDLT1cVgg*kj>0|4oun=1ioPi2l zA~V<%UBMcST#RtAzH?ql(L3Lk9lZqs$q}YN&wstEq0Em2hg;`!Vu&YR5-}hT@ohBX zQG$k3QsETP!||xpjS)g)EbVxsIK0Hpr>sY@8A2A{PLW`mJ9F|6(b8taDt1I4MU#4G z`jP=MiTCSXl*R|6E!8-U(8YeK7%x>PEeHbDN&{_=`?>T7qp~4%lv=ozDWeVzy29JA zys`@!2PPcAOo|X<*;o6;iEvT}z_+^SveZGp3p1k~bjfJ0kUOIDsv}}%f4>t1-2VL9 z$pt2FH$uBOc)&Od4YXEKCf~Ig^O`yVsAZwz4sv~|zCb#b%Yjg@_JC===kP-M z-8R(slsM@_s7%Mg^~}ZiEY`g2G4q8UNN^d&zwHe(E!3xj7g64sxao4dquDKQKgDvz z2Q7bYG8(eXwdbxxGWjg}>wR4f0pC;xVz5b@K4J9zR}uqe*IZC+dwUVb*Yt{le8Jy8 zz6-$@85FhJ+PB+cAZ;NrtCkS__QZR$^u6(^a7QZS!*j^9tQnH(J>r2v z8-11kPTLE=N9Q|_YY;)L2Xz%{Q(5cV#-b-Y5JKGhFQ+{_C_;q3s^!A`Ub5RT&R6$zAl%{}=kvc6iesi5Ebd5HSo>Nhd#( z?(q1&;N-~m6*VpbP1kI=MT4HkOuvjSRWFpkwv5XO$F`B6klpP0adk!P5sOKAZH`jR zqR*}nNZ(!`U;oW*XzP@QA)HxLf$0;ykc}3M-B6q>nt2Uz}hQo3+17*1}f_`jm3ati!!h@L7jl%~=OxOZet*45>gr zb~FctUjx51KpGcJGqkz3%EoN~;Ghe}hKnlWFOLOF1!_6om)`QJ2%9B(=eqt1I%nSdk zqe@I5qG1ckb2*_xqX`kuzOG5V^#S(@DZ~=P8I<)nB7cWeI~-bc`RJC?o`^I+YZ@rC zw%jb?ptyWT5M3rIguvb>I?R?eK28I{$eq%PYK0Q?H8HE2TfO!AK0)FZq$WOK9%DHZ zNogF%nQQ5S9TqB&3}z+buMT^oI%F{V-mjIm3PhXTu~@h~1NBy8gD3OswW|JY@)h%| zFgNn{K?IS|{E?9|>lcthKr9bRVG+4;jK2OTt{C>5?N979ITpvVs+ z22mFIOu{2N6V$kyHG#S5Lvi76L?_0~YFeNLMeUyTlUuIP&iHAhezBlZ1YS=fcm()! zmcHH@SPMxVKZQ$=p!3hsC#bqMdjsCJgV+aO2Axg4>ok!W0LRUmEC>uo5TRmd>@CP+ zp##Q1kDPt~E!Gb5{uzOw;9}VhG*pxjlp8WFNJhoUtPH+WraUK}Ev_|^u2s%WHEpjI zPZ#v%@GCUy>zQu&N={rWU=;&^a&nxnzP7rUF^q}3yogRqrBCilmTI; zB3Ga-Nr-!Ad!Ez6z+0cc#N5dqR=v+tg-WRcs=Y+Xo%h9kJd7qiZF5XK=93xIOk+me z`@25-<~-auLi((1zAYK%ndxZ#Y`gfGu;WhH&fu!0m%y~s*%6Aaq=?a9K+ji#X3DLp zR?hS-k;YmvMfW|1Hit(=l(6`mRl~8Ya>)nqL-a2Ae4qtx!OG;SjIdxOUdvKquqiRk z*AF3lXnNI0YfvE&jA%}P_U*~!MY1Gfs{XW9c4FjF)2N?6bHU`aABDqYZ=w2!VSbpCy<8>Mfv*TsMyxPRli` z_^G6Ga9IKv*%Ze3YX>}QIT>+2Eeu55%H=mwYg!N| ze)IA)6LhP$G(`QvlaAIy*dl8FxgfKwv)yGmSs(JN1u?Q(o6AZsvvfri@`l}SGT~Bu zNr;cXLI8~rrY_e*Pt-4I1>x+XMnKSn3&wZf>6BNlOQj>`NBSW3gvv+kM<(TPe9*x5 z(`(cJ4>|9PCNwsV0n17LyUdG2f(_4&3m#N=grb$iRC_%nQ~hME(26rCNbR{ zNJnw(J1aSSYT*0Q$!4J+68=Xy5hxNz=elP&jmcikj41kyC-V1!hmMv`duijt%1mMW zxrZ$i3;YQ&N)=DUFk^IU?S5=AN?p}&UJ7b6Tt)p9hx42;&rCjxKBB&0>k5Aw$r^k$ ziJi~KAlwxF$N_a4GJG+19zjcSYL!{HAm{(n-d9Dn)&1L|ZIDtzgBDu6xI@w6?oN=Sa1#Q7Tk-|7N;!^#i4Nc{^yJ{?j85_K7RXg?={xL9&@iX_xjB_ ze|C|Pi*K-M0<95*VzmkxXOkhae#YxX;|$#UEV40DvV39gn@Q>kskMEnND}tM7jvc{ z!b7JM2t|=Xks0`(V|SaB0}j`L+LpQR`8cadiMkc|!i5@5e8)@k9R|uL#BNW49%27T zFjrE_-*}xjnowa*2b^>QkI<3IXg_nsimc1Y zlemM!GdA6$sp_)OntKXvtAEMIewNed? zep+_fb2LL%F^0`+99xiEP+osZ2_&4n-N_B66+jo8orbZZWfWY{kkc;h8Y*+wk{AO zAmWRdN_!f$UqAu4o{V)nM(>U^1Q#g?@x= z*C(|MVqFFWc{l5Cd})bI<;|B5?j##oKD|{~no)y<9E+g9%{nwUCXzdhzbvl(`*V!| z{eR3V`rwib^zUM^yy3ch)$#6wtF7?7WYU#v(Xt(+dB4tMYadD0?$UyF8C5*jw)q6e z9nYdBjF(%P!*Mv~bx41!Lm@_q7U@C9FSZXZ16&x9ICjUC1)f=|kJp}Ojq=Hp>o&hK zkVs626egg~}CU{jqE>q8riTGhrBly*o<*Q}acal{yol zm!iO2kmq5}K)#b&DNqEdNO~SZ(BBQ86g4tbX!Xn8Dju==UGtW2cXqt|mHeX-cHJ4( zNl*)o%!g(vfG}kUBG0|58Lv&ll(7xt8^`?K5rL&FEc7SX!p)Eiyl}qfp%TU=-@Ctu zfK@j@i|xo{C}i9zWideL$#Nyr#&$-jedb-fT0W+J+7VES&Bx=$A48uL0ADy7XBtpb zg?La6$#ZK-#8(b}bp3au+dgQz|7mQ#8Ygqm?Ru2f%g1ZdtMN-aeDo9Caepydz=Y}vcIT_ONaaJXSm~9y%g4}YNmlohz5eDhZVC|$Ef*vnA#0O9hq7f%0Pg! z11M3B35#u^N3Jfx{jW;mh!wa1x|?vYu2a9I$VO^KR6Q+gB77|gdUM{Un5dEWIE!S6@m)gB63h$Lg z%`6ok)I&dk!0Oc=!>z$^bC+Sy_t$dHbK8t~I1fi|*!e%`PK0`1F^ebvoPEg8s&||} z%B2&t=d;P^4rxR9aH$DC^g%41uXSngSZhPM41Ot|d|TlOusmp@4dhbf8!;0?D`S{H zD~$`qPq8bM(t(3)_WuOKH@ZuWz*X-WB^WlnPcap&5kUF;La*9~ZNtxg44~`>^OlQ> z=UJ+t)6g%DJ9sESV=7pMLo$0l)1ErLill$Xh#MBL;(rl}A%$aIhSGvp(>Fg!4JGe5 z3Ka(7<`1$5KbVubijYPCk4Hh(`Y*4CLjHq52hqwhkz$Q<>o_gJ%(pp??FbO_icHBv z3b(vzp{|=Ardk}2G3h%bODPp`2?i@QRm&PD9h&OOCq%Tkg$_hDr^kd@EQp^6c|sDL zw~?-w$QH#WCNuQx6>@=PTISsoi&_SAb>3N!G#@w+BUWsIgESJ(JHi|nzTVAP^(uef zAiYxR@I}uLDJ`r}z&wXCn`8JY3#H#`>pVK&)A1W+i(LhPnYf^fyP^VU^<)A|WItRv zNH7u7{>DjfQhm+!757S#$=37N&H!N?IV%H`{wtEU7uhh?Pok6(oq__S{mS$fp@A4? zSeH0fc_zZN%Z64*Z!gGl`0wN1Kgb{Aqf80Osn;hW_n%ffi7E_hU zXEirKf)JxRR>og0&t+9$tW1zYne#gq_Wl@-47-Ko(K$M)k|iHw0$d);B^oNvcSE< zYc!}TVt6|xR(STA+)f3qvZX~LNJPft#WAUZz?+S{WNyM)wVGT!F*n?{9;Cec6Xm?; z2(e)3aICr7jod=}(GjW(c;kbm_t51Alcs^Q*mNPGe0qP;Hs%`94sL;wYDTahz9C)a zA7@}TSEJlcT7jxvCG7@B#xQz$7TCK@wJnJ3`6l8&QcOO8^2YvJAG84TtEx=^ySzcJ zFKN&U)3#@k;ziWSRCf+tbd;b}0D_Y43i-NSS!qK2hCj5&`Dt+^VtEPZse7aW!5CR3 z*5vz-vV**iFLypu=kYS8XXz}#t8Z~Tgc8nrWa?9HgUN(8gFyp^5p8LcGr3~Ko7|HH<1~NsSpo!q?!%5QS7A#fHxPq@0ndJBUcC(*h zh*^1>gm+i1U0;8YFiEqQnk)wR@d{VlP7%kRvHo-$RtUW(7 zN;<%6?Zx9G92!`K=JZITU-gU@0*6-N%r5GjK?*Z% ziz`axwQLd62e)hl=?n^ef#(=Is){Eff+L`c2RE=*QtaHbAS3QzChJI1U3&88ZfcwAitCh(gJ+-t|R?dTz^-c;{yL(~&;wa{UPEcj(=ne1_C z{jyeVPf*x;=Xg3LTH>3}!GG_1z|n%@38=7%P)WZu9;B4dR0q)T}?i(QmPo&INJ|abDBOcQnw&vA^cSY1Do0$ zn=PQC1r~{Mp7TNB14~)Oe5IK#7C)%9kgd*#+bH2K=0;Jzt&*c1jqTr));jYbbps6znP^kzEY-`Cl)@6 z{UIJB_<(;0hcER&V})ZRw2|NUqtSxT3DvxvR#PdO8{@gcwH1Ju3}-_ynw5f0cuR>n zDdbaJN!CTUwSgz#fOwM|)GIJT&;vv%m~H|M5Ew<5ct%t`Sj0vcu+M&rlnTrIU3Cin zur6Bz!oIpN;fEX?t~X~KtHi5-Zo}gY64E9fFA~it)}}O)A}=8sLi8xPd>rA8fr~F- z`f0fT2L@R)2xA0q<%G5U+|Qn*{u57%Kid-Cj+`I4mD=f0*RGR}8Z|ti*L(m>T{@VG zxX-KhSLEq|JV*Ov>{|>7+}eETr^!upQVOC?55tp!LowIgtZS?FR~T-8x|W!5x!dVc z@6(O&Zf81HLS86mUt(i<)P(gMTzkQ@qp`lCuuZIUk(KAl_#GeFAnUmej%6K5fgSX- zZj7#9=TF+|dZx*}R8EXI$#*$rL$VXq-w9swQQgUW5q{zUy=d_ljgE(cN9V#RIu@;9 zxid$#OUE&9U^CDZ}8Zj zx2Hs2@6gLB9z|zq%OIU~97KnVem+hlO)~8rx}Y^GjLXH&Q1r!jP(HQ&IPR z4|F#?fQ$dR58t(U`PohVul_oL8aH9fWd(T)ySTYkVBq4kG*r=rPN3SvoKCw4@N8=7 zdD|B>rF1r-F64(EPNyreEP)(wdk$-0rJv7OPfE|kvZIaRNlhN59Su3^y95}s@7q)zxN1|@lhudA|k(&5^PN= zV(B=qsN84BEka7-7q6G5Z+pO_p19&EJYw%y9iR(x#KQLzrK8Nj7N2lir(oFHENd>$ zDaXQ&3F~L~jR3x3*I1)(j{lmAjXBddLgi!B8`b!d0|1kH2n%YCVi1~ zO(-$rD@W9`QZhq+D5tJp#7kx^67NH&)uZhEFV7TC`cm1{O~_|F1%qYKjj>3cp)$hM zZ#5Q!KwbqSqp5yg(9XNMQ)NH&%G)m&744=(t45LpsuBh?=Ww7`Nc)9lf3m z7qM}~pFGS@HnA)SB6xMD@0a1LeEd6y#{@ihMlH7pi$&6_JiOGgq%Obe#^+2-GLi1Q zxC-iT8=t?`csT4FwdtOzd-d|4wQW-Q>R{EM2lFTURF@axwPQV9@*<%vWp90 zU~Hqy9Wg$5g7!>4$U^auO@}s#ZHtz{yP3E||DET9fw2Ei_Jw%+Kv2(EIlOQW_T-Z; zdA3!NuoeC+wzlO?nATliZ~0}RtW=dovsr1|FDh?xQcOR-&7kjkNE%W;9ey+# zKVxAScPt#-A*G^FTt|#-V2dJa-geL1dcQvLtaRRv&P~M-I~2c!e%QHLTT9;8)Gm6k|q@GE=j z*P2dFF2ZXJokkaEbg-K{2p5`TESlHNa6Gf*3)wh4yr(6qq&Kuv$*)B$PViAoj?D?eV<5kAUNjNA%yY5dj1 z7<~D$I3NBOgKsf3g0=&YHtg5+syWam=5Jhus%Q{(0kaJ)Llaqs`%DqQisyCciub9c zY;FE992atmS6;12ey6>_JN2%jH6T0mQ5GPJW@;(M6=leK#TUg&5u(*>5Hw4vlx`Eb zf-^`P?#*WmJWoqxNES~dC-ugoH+uGp)F=o|Rni!(wYC(-E6;%nkspkuYgzzdm^)Ej z*J5YGcsrr3h6YMoraA5XTN426?L`9zuLvyK{K<&4FSK1<;1!fe(g;;FL z?-zUZ(C?}x62B?G;k_YY;e0B`=YV60tdy;D)BI2Re5wqwM-f|J$1pu25F=13uzEVI7 zOn)Mkjmu?Z!uegWpa;aP+zbfB?Uf;o9%E29U(mAm$3=pS*U65;Q*Joe|s)<(_SBM5=v0-SnGH6PZX@dY} z>MvYPNL8qJk%_oaE{v=~#0wI?=bFm}+|CO{CFp6JgjVle^GsxcB^0IR2=VH;Oh*iB zaDnAUkFo~xtes^YqBl4gOyE54>FT%qD85qs9HfU|KXLgGe5B`6hOMJf@)&^DVIjN) z6q&4hCc$V}b!<^!#~>tyoLWuET1pm2-)e?0-J*Qr7C?oH_ucX5xH;4}5?!}xrn2n# zPu`A}y7pnFs~B^LX9YY9wsQs#meP3E9UkEF!~Y+gsv=OU0CL;#GQ&?qm<(jT+1F$d zBq#^WLyPb4&>wkv_0Otrlu$Q+{Wa>_b!GP>N-;<`*N2h?bGY*6@V?Q@CBk#FKP|Lq z`fvHwL{(?+3hvv_wECqDPqZN)loTJWhlQ#^GtCNXUoY}DHm2+;g1E0fO1mMh3~JmI zIFcqv7A?5p9^E$qp|>c8u7tH};u!Mh-=nS3B{eAJvD2Puj*j%gqXbtHk-bcF`n{0! zLRun&SPiChdD_9ADelJ~38r%S@`2|R;S-~|_Gz(_kMmezd^+?E%V`yiUv9%TtHTa# z2~yCmsn@j4Y(~dnDjd@NyYU2=yi=<-1bayhQWBR0eBA7$eyRqkF%*RpsVX)WkNp|m zD>*kCfienL1$|+#?=4F{{%k}I3w({DSUxW(ru@>vtX`776w%vfSkc8^)O5TdO4AV< zbI*E;J&uo(V$$ZTuILbGIJ8wVEV6St7yC>q{lGJWWi^k~YoXtg>Vkfpj~I`a;`v=f z^YYj0o1`ym@|S$C#NdKSe2kJrO|bLpQzpStePcQ7P~TEm#JQIArkF~^Lkgdr_zRsQ zGaR_w3+zXTYE8jHj{doW;rV@2W+lw1?uBYMcoe^?ezO@)!hmV$-rJChV~Wcu)t9RY z@m_9FMI)%{WLZR5GRkH@eQ;HlGYkBdiyQditvpFdd~0J@;w7nVO=ymuK-zFjN;&!onup)!gN3KKacs&`B#YamiVt(6*B_DrzV~aZQactQGDcH! zLg>K!!War}6q#e{-{qCNu(%Bk1?s(y$NDCcsF%A%yoKX7KXJ1Ffg??wL5qRq^QV>C zT!VD3&i1j>vA^QfE%VqMPkD@P$fM#q*%9v`^ezsCE%j=*v#t;UN8l!hU$IShNE)^r zSwF;kvY*DQFQt9MO5(3Jp@wa5iPuFLO#ee%5 zZG57|gAy~L>aG~f*txzTDc1k%e{oRe&Rq}}59=Y=3q5t#73H3z|KR&~=-};r&DM!O z-!9KtyIYg6ZTpp2Fb+8L{-r<;5X78vY%O(mSe$5_Rr+4$ubt8+m%w#^BT~ z12(bTb`*lcVa*Jsz zTf`4n0wV0VAQPJE7~LY;_$A?8D{Id9M4Ak;TEjpEPl&U6%~j;3A_JEghg1xyHSb?6 zPWWSM9?fG#EedZ#Ebcg7@>V2a_xB|t%KaXpth=UwVSM3hJl}D2U6&wy?`Lg&JYJ=B z6DgSL4ZWYqxB2|7sWYx(xh#i27*Pr?)uvK$_^Efrv>%iT`k!d_?mGcUA}k0}DPPdl zQ)VmFK6Kj_rClb_Q>WZ3lDv{Ng0>@wUR8^3@5?60`>{!g#V|YjKuD)b78VitryeiNDz1C|;jJas?W2?B0{Z*I z#`|B>Ick>eV(k7davq=qJuIlDCUue>brT0(80$dZ*BnC7MGl>)bjP#J#6c0FdTZcM z`Om6#DApBke=qj%F&*qnQ&*!BsHJ}E)8HkfEVaq5T%F4;6^9<4p;80LxJSr-3hw++voHZx=DVWkQaanK5M(KO$r= z366e_yW!rKE5UYZ=#y^4mCiF_^ihUGwoepaa2W}lc3rRg2#)Uo8xG;+$x|~9ir!q&X{<4y=DO~rTZFqn*ykIm#n;_C6TY`q*zGB@I|88=7_`<$==qKk8wZVs&& zk!%N}dZhBUNFqmasL5<@IL;Rc+&4M>sLHe?(?)6xpL!Wa3HBTCZj>(@a9Uqi=t28e zjcB&07^noqMVb~_*=rB!2f0|ul^3hYBP}Kg!%h3ypdvSBDI-aAGt~R(ysEJTOyriw zDdT4^iNGJg;j7EIjY&PF>N@bwg!B1Y)cg#If7vgBTCi&WR|N)(_t_93lLXo_Ov@FZ z>{fV90)We{?_E~f^_2#4Wr1pud%JNqfHR;_Mfz|nkMiwuU)Z#M*I&xj3CZ7jgV_x2 z9bi9msSGYwZ*MbA3B}JxRhnN6&ddYiKI-RsO%piroaFh?c^Qa0wAcO6!5Sm{NZ1F# zsru{m?JlmpKe5#IQ&!u~yB{LN0R}s9=(5bj_H@IBRD#Pa-jUz7%vl@JW3M}_M#hD6 z@5C{Ay~@SLlJ^CEa*b5&N*2$7#gF$bG0t_s*766-)yQ4!4CM1bhf5^ zfqh9^Ci3^kDBgD3=&gD$7;b^3EaZn~nuJ6!TBPTsg{sYzvgsrXhS*tjXDPB|ZY@9# z_F6^ibo*wKNr&F?OzJy=?^ts+xV*vI6gWU8+h!8!gsJt7_W)UZi(vCS?}=7p=1AU%j9Y zc{cGk8+IF3SGD|?ws@{u)8U%EPN0@n`|x4lj;VGQbVr~hEuwoG$J)Ko^so>!vi<{J) zR{l3p^Y8U2{T>x5!c;gxmYOrswyfnj%NLrxaonmMBPX_%(T!^Lc;hz8KgH5wW)qSH zd~5emw$1vw(-aNKepCz)r@d7K?F`V4%!9>))%{i}1))fHdxXe=#EOp?b(x zZ-?_?vC3FznSkm9UM+%Y&+Jk3lZk5UnCvjQdiZC%@7qp&iA`%B{3#3xMT!&@{=K0?Dr zUEd>7GXo!*N2!oPBW}E78vG~^8xA<@v8`*vHh-)np+=Nvj0YA8<9CbZy;i|31JMNg zL6antS~vQazF1p?fL78^VO5H;;_W8DZ;_p=&Ugd!EwIs#27Ha_-B;Xdkio5$vO+wJ|EA4Eu3Wuu%SyURR#s}xF7#f0Sa5R?t&ngz9%i??Y;Jm4j>eMf?Z;}-Ey4#d-?V3 z8UG!uafIDI0(n77P04k7vzd9gKE2OYUJ(5nxyeKn!`hJ~@aV~30bQ=|ZKm@1X{(}F zqjxgI-W?tZyAFOjhsO&o6!)o00>Czcj~1w-s-62^#vh|cKj2oUMFrwC`VHYgoVG`@ z!+ub-iNvl4KY}R5=ZL``Q47C9G`u%KT-!fg;<9*YJ%E@2U74PQs zBFG#;NHxELK7Fc~>k8XgNnpBsHFBrE7;2+tlxhFbKY853r5bd#pouaO8oq(uTo^7_ zJn+Gj_cpM}GS9QtTD^wcMuP@0)%Df1=7tZx#i~|47c2<{j!esvgL8~?jJ0gN*>Waj zICRSuSZK=TL!^&=B)o&2T#(x~N~t=i&zJcs0P_f1fLRb1sJ{^k9=F2IoJzH;}PAkK$N z6L4GfGACP4YZ@R&ivb^UvtfrLTU=4|9j?t9(?$R8T>od1R&MY&nNdU82()u{&)TT7YzS` l;a@QP%NhQE@~f_UY^LRJ*7L2-k1!rCWqA#`N*N3Ie*tM1H$MOX diff --git a/cmd/picoclaw-launcher-tui/internal/ui/app.go b/cmd/picoclaw-launcher-tui/internal/ui/app.go index a2ccddf70..f26b6125c 100644 --- a/cmd/picoclaw-launcher-tui/internal/ui/app.go +++ b/cmd/picoclaw-launcher-tui/internal/ui/app.go @@ -325,7 +325,7 @@ func (s *appState) viewGatewayLog() { } func (s *appState) selectedModelName() string { - modelName := strings.TrimSpace(s.config.Agents.Defaults.Model) + modelName := strings.TrimSpace(s.config.Agents.Defaults.GetModelName()) if modelName == "" { return "" } @@ -413,7 +413,7 @@ func (s *appState) isGatewayRunning() bool { } func (s *appState) validateAgentModel() error { - modelName := strings.TrimSpace(s.config.Agents.Defaults.Model) + modelName := strings.TrimSpace(s.config.Agents.Defaults.GetModelName()) if modelName == "" { return nil } @@ -422,7 +422,7 @@ func (s *appState) validateAgentModel() error { } func (s *appState) isActiveModelValid() bool { - modelName := strings.TrimSpace(s.config.Agents.Defaults.Model) + modelName := strings.TrimSpace(s.config.Agents.Defaults.GetModelName()) if modelName == "" { return false } diff --git a/cmd/picoclaw-launcher-tui/internal/ui/model.go b/cmd/picoclaw-launcher-tui/internal/ui/model.go index 47ca5a355..93069ac7b 100644 --- a/cmd/picoclaw-launcher-tui/internal/ui/model.go +++ b/cmd/picoclaw-launcher-tui/internal/ui/model.go @@ -15,7 +15,7 @@ import ( func (s *appState) modelMenu() tview.Primitive { items := make([]MenuItem, 0, 1+len(s.config.ModelList)) - currentModel := strings.TrimSpace(s.config.Agents.Defaults.Model) + currentModel := strings.TrimSpace(s.config.Agents.Defaults.ModelName) for i := range s.config.ModelList { index := i model := s.config.ModelList[i] @@ -77,9 +77,9 @@ func (s *appState) modelMenu() tview.Primitive { ) return nil } - s.config.Agents.Defaults.Model = model.ModelName + s.config.Agents.Defaults.ModelName = model.ModelName s.dirty = true - refreshModelMenu(menu, s.config.Agents.Defaults.Model, s.config.ModelList) + refreshModelMenu(menu, s.config.Agents.Defaults.GetModelName(), s.config.ModelList) refreshMainMenuIfPresent(s) } return nil @@ -105,8 +105,8 @@ func (s *appState) modelForm(index int) tview.Primitive { } oldName := model.ModelName model.ModelName = value - if s.config.Agents.Defaults.Model == oldName { - s.config.Agents.Defaults.Model = value + if s.config.Agents.Defaults.ModelName == oldName { + s.config.Agents.Defaults.ModelName = value } s.dirty = true form.SetTitle(fmt.Sprintf("Model: %s", model.ModelName)) @@ -258,7 +258,7 @@ func refreshModelMenu(menu *Menu, currentModel string, models []picoclawconfig.M func refreshModelMenuFromState(menu *Menu, s *appState) { items := make([]MenuItem, 0, 1+len(s.config.ModelList)) - currentModel := strings.TrimSpace(s.config.Agents.Defaults.Model) + currentModel := strings.TrimSpace(s.config.Agents.Defaults.ModelName) for i := range s.config.ModelList { index := i model := s.config.ModelList[i] diff --git a/cmd/picoclaw/internal/auth/helpers.go b/cmd/picoclaw/internal/auth/helpers.go index a0a229167..02c78cf4e 100644 --- a/cmd/picoclaw/internal/auth/helpers.go +++ b/cmd/picoclaw/internal/auth/helpers.go @@ -56,9 +56,6 @@ func authLoginOpenAI(useDeviceCode bool) error { appCfg, err := internal.LoadConfig() if err == nil { - // Update Providers (legacy format) - appCfg.Providers.OpenAI.AuthMethod = "oauth" - // Update or add openai in ModelList foundOpenAI := false for i := range appCfg.ModelList { @@ -130,9 +127,6 @@ func authLoginGoogleAntigravity() error { appCfg, err := internal.LoadConfig() if err == nil { - // Update Providers (legacy format, for backward compatibility) - appCfg.Providers.Antigravity.AuthMethod = "oauth" - // Update or add antigravity in ModelList foundAntigravity := false for i := range appCfg.ModelList { @@ -210,8 +204,6 @@ func authLoginAnthropicSetupToken() error { appCfg, err := internal.LoadConfig() if err == nil { - appCfg.Providers.Anthropic.AuthMethod = "oauth" - found := false for i := range appCfg.ModelList { if isAnthropicModel(appCfg.ModelList[i].Model) { @@ -287,7 +279,6 @@ func authLoginPasteToken(provider string) error { if err == nil { switch provider { case "anthropic": - appCfg.Providers.Anthropic.AuthMethod = "token" // Update ModelList found := false for i := range appCfg.ModelList { @@ -306,7 +297,6 @@ func authLoginPasteToken(provider string) error { appCfg.Agents.Defaults.ModelName = defaultAnthropicModel } case "openai": - appCfg.Providers.OpenAI.AuthMethod = "token" // Update ModelList found := false for i := range appCfg.ModelList { @@ -365,15 +355,6 @@ func authLogoutCmd(provider string) error { } } } - // Clear AuthMethod in Providers (legacy) - switch provider { - case "openai": - appCfg.Providers.OpenAI.AuthMethod = "" - case "anthropic": - appCfg.Providers.Anthropic.AuthMethod = "" - case "google-antigravity", "antigravity": - appCfg.Providers.Antigravity.AuthMethod = "" - } config.SaveConfig(internal.GetConfigPath(), appCfg) } @@ -392,10 +373,6 @@ func authLogoutCmd(provider string) error { for i := range appCfg.ModelList { appCfg.ModelList[i].AuthMethod = "" } - // Clear all AuthMethods in Providers (legacy) - appCfg.Providers.OpenAI.AuthMethod = "" - appCfg.Providers.Anthropic.AuthMethod = "" - appCfg.Providers.Antigravity.AuthMethod = "" config.SaveConfig(internal.GetConfigPath(), appCfg) } diff --git a/cmd/picoclaw/internal/helpers.go b/cmd/picoclaw/internal/helpers.go index e04bccffb..120b740d8 100644 --- a/cmd/picoclaw/internal/helpers.go +++ b/cmd/picoclaw/internal/helpers.go @@ -4,19 +4,20 @@ import ( "os" "path/filepath" + "github.com/sipeed/picoclaw/pkg" "github.com/sipeed/picoclaw/pkg/config" ) -const Logo = "🦞" +const Logo = pkg.Logo // GetPicoclawHome returns the picoclaw home directory. // Priority: $PICOCLAW_HOME > ~/.picoclaw func GetPicoclawHome() string { - if home := os.Getenv("PICOCLAW_HOME"); home != "" { + if home := os.Getenv(pkg.PicoClawHome); home != "" { return home } home, _ := os.UserHomeDir() - return filepath.Join(home, ".picoclaw") + return filepath.Join(home, pkg.DefaultPicoClawHome) } func GetConfigPath() string { diff --git a/cmd/picoclaw/internal/helpers_test.go b/cmd/picoclaw/internal/helpers_test.go index 583751781..6e5123152 100644 --- a/cmd/picoclaw/internal/helpers_test.go +++ b/cmd/picoclaw/internal/helpers_test.go @@ -8,6 +8,8 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + + "github.com/sipeed/picoclaw/pkg" ) func TestGetConfigPath(t *testing.T) { @@ -20,7 +22,7 @@ func TestGetConfigPath(t *testing.T) { } func TestGetConfigPath_WithPICOCLAW_HOME(t *testing.T) { - t.Setenv("PICOCLAW_HOME", "/custom/picoclaw") + t.Setenv(pkg.PicoClawHome, "/custom/picoclaw") t.Setenv("HOME", "/tmp/home") got := GetConfigPath() @@ -31,7 +33,7 @@ func TestGetConfigPath_WithPICOCLAW_HOME(t *testing.T) { func TestGetConfigPath_WithPICOCLAW_CONFIG(t *testing.T) { t.Setenv("PICOCLAW_CONFIG", "/custom/config.json") - t.Setenv("PICOCLAW_HOME", "/custom/picoclaw") + t.Setenv(pkg.PicoClawHome, "/custom/picoclaw") t.Setenv("HOME", "/tmp/home") got := GetConfigPath() diff --git a/cmd/picoclaw/internal/status/helpers.go b/cmd/picoclaw/internal/status/helpers.go index dd7063fe6..43c5786a8 100644 --- a/cmd/picoclaw/internal/status/helpers.go +++ b/cmd/picoclaw/internal/status/helpers.go @@ -42,48 +42,6 @@ func statusCmd() { if _, err := os.Stat(configPath); err == nil { fmt.Printf("Model: %s\n", cfg.Agents.Defaults.GetModelName()) - hasOpenRouter := cfg.Providers.OpenRouter.APIKey != "" - hasAnthropic := cfg.Providers.Anthropic.APIKey != "" - hasOpenAI := cfg.Providers.OpenAI.APIKey != "" - hasGemini := cfg.Providers.Gemini.APIKey != "" - hasZhipu := cfg.Providers.Zhipu.APIKey != "" - hasQwen := cfg.Providers.Qwen.APIKey != "" - hasGroq := cfg.Providers.Groq.APIKey != "" - hasVLLM := cfg.Providers.VLLM.APIBase != "" - hasMoonshot := cfg.Providers.Moonshot.APIKey != "" - hasDeepSeek := cfg.Providers.DeepSeek.APIKey != "" - hasVolcEngine := cfg.Providers.VolcEngine.APIKey != "" - hasNvidia := cfg.Providers.Nvidia.APIKey != "" - hasOllama := cfg.Providers.Ollama.APIBase != "" - - status := func(enabled bool) string { - if enabled { - return "✓" - } - return "not set" - } - fmt.Println("OpenRouter API:", status(hasOpenRouter)) - fmt.Println("Anthropic API:", status(hasAnthropic)) - fmt.Println("OpenAI API:", status(hasOpenAI)) - fmt.Println("Gemini API:", status(hasGemini)) - fmt.Println("Zhipu API:", status(hasZhipu)) - fmt.Println("Qwen API:", status(hasQwen)) - fmt.Println("Groq API:", status(hasGroq)) - fmt.Println("Moonshot API:", status(hasMoonshot)) - fmt.Println("DeepSeek API:", status(hasDeepSeek)) - fmt.Println("VolcEngine API:", status(hasVolcEngine)) - fmt.Println("Nvidia API:", status(hasNvidia)) - if hasVLLM { - fmt.Printf("vLLM/Local: ✓ %s\n", cfg.Providers.VLLM.APIBase) - } else { - fmt.Println("vLLM/Local: not set") - } - if hasOllama { - fmt.Printf("Ollama: ✓ %s\n", cfg.Providers.Ollama.APIBase) - } else { - fmt.Println("Ollama: not set") - } - store, _ := auth.LoadStore() if store != nil && len(store.Credentials) > 0 { fmt.Println("\nOAuth/Token Auth:") diff --git a/config/config.example.json b/config/config.example.json index 49658b9f2..1eea37683 100644 --- a/config/config.example.json +++ b/config/config.example.json @@ -35,6 +35,11 @@ "model": "deepseek/deepseek-chat", "api_key": "sk-your-deepseek-key" }, + { + "model_name": "longcat", + "model": "longcat/LongCat-Flash-Thinking", + "api_key": "your-longcat-api-key" + }, { "model_name": "loadbalanced-gpt4", "model": "openai/gpt-5.2", @@ -274,6 +279,10 @@ "avian": { "api_key": "", "api_base": "https://api.avian.io/v1" + }, + "longcat": { + "api_key": "", + "api_base": "https://api.longcat.chat/openai" } }, "tools": { @@ -477,6 +486,9 @@ "enabled": false, "monitor_usb": true }, + "voice": { + "echo_transcription": false + }, "gateway": { "host": "127.0.0.1", "port": 18790 diff --git a/docs/channels/matrix/README.md b/docs/channels/matrix/README.md index c213aa80b..233f5c0a3 100644 --- a/docs/channels/matrix/README.md +++ b/docs/channels/matrix/README.md @@ -22,7 +22,8 @@ Add this to `config.json`: "enabled": true, "text": "Thinking..." }, - "reasoning_channel_id": "" + "reasoning_channel_id": "", + "message_format": "richtext" } } } @@ -42,10 +43,12 @@ Add this to `config.json`: | group_trigger | object | No | Group trigger strategy (`mention_only` / `prefixes`) | | placeholder | object | No | Placeholder message config | | reasoning_channel_id | string | No | Target channel for reasoning output | +| message_format | string | No | Output format: `"richtext"` (default) renders markdown as HTML; `"plain"` sends plain text only | ## 3. Currently Supported -- Text message send/receive +- Text message send/receive with markdown rendering (bold, italic, headers, code blocks, etc.) +- Configurable message format (`richtext` / `plain`) - Incoming image/audio/video/file download (MediaStore first, local path fallback) - Incoming audio normalization into existing transcription flow (`[audio: ...]`) - Outgoing image/audio/video/file upload and send diff --git a/docs/config-versioning.md b/docs/config-versioning.md new file mode 100644 index 000000000..36d7fdd25 --- /dev/null +++ b/docs/config-versioning.md @@ -0,0 +1,230 @@ +# Config Schema Versioning Guide + +## Overview + +PicoClaw uses a schema versioning system for `config.json` to ensure smooth upgrades as the configuration format evolves. + +## Version History + +### Version 1 +- **Introduction**: Initial version with version field support +- **Changes**: Added `version` field to Config struct +- **Migration**: No structural changes needed for existing configs + +## How It Works + +### Automatic Migration +When you load a config file: +1. The system first reads the `version` field from the JSON +2. Based on the detected version, it loads the appropriate config struct (`ConfigV0`, `ConfigV1`, etc.) +3. If the loaded version is less than the latest, migrations are applied incrementally +4. The version number is updated automatically +5. The migrated config is automatically saved back to disk + +### Version Field +The `version` field in `config.json` indicates the schema version: +- `0` or missing: Legacy config (no version field) +- `1`: Current version with versioning support + +```json +{ + "version": 1, + "agents": {...}, + ... +} +``` + +## Adding a New Migration + +When making breaking changes to the config schema: + +### Step 1: Define the New Version Struct + +Create a new struct for the new version if the structure changes significantly: + +```go +// ConfigV2 represents version 2 config structure +type ConfigV2 struct { + Version int `json:"version"` + Agents AgentsConfig `json:"agents"` + // ... other fields with new structure +} +``` + +### Step 2: Update Current Config Version + +```go +const CurrentConfigVersion = 2 // Increment this +``` + +### Step 3: Add a Loader Function + +```go +// loadConfigV2 loads a version 2 config +func loadConfigV2(data []byte) (*Config, error) { + cfg := DefaultConfig() + + // Parse to ConfigV2 struct + var v2 ConfigV2 + if err := json.Unmarshal(data, &v2); err != nil { + return nil, err + } + + // Convert to current Config + cfg.Version = v2.Version + cfg.Agents = v2.Agents + // ... map other fields + + return cfg, nil +} +``` + +### Step 4: Add Migration Logic + +```go +// applyMigration applies a single migration step from fromVersion to toVersion +func applyMigration(cfg *Config, fromVersion, toVersion int) (*Config, error) { + switch toVersion { + case 1: + // Migration from version 0 to 1 + return &Config{ + Version: 1, + Agents: cfg.Agents, + // ... copy all fields + }, nil + case 2: + // Migration from version 1 to 2 + // Example: Move or rename fields + migrated := *cfg + migrated.Version = 2 + // Apply structural changes + if cfg.SomeOldField != "" { + migrated.SomeNewField = cfg.SomeOldField + } + return &migrated, nil + default: + return nil, fmt.Errorf("unsupported migration target version: %d", toVersion) + } +} +``` + +### Step 5: Update LoadConfig Switch + +```go +func LoadConfig(path string) (*Config, error) { + // ... read file ... + + switch versionInfo.Version { + case 0: + cfg, err = loadConfigV0(data) + case 1: + cfg, err = loadConfigV1(data) + case 2: + cfg, err = loadConfigV2(data) + default: + return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version) + } + + // ... migrate and validate ... +} +``` + +### Step 6: Test Your Migration + +Create a test in `config_migration_test.go`: + +```go +func TestMigrateV1ToV2(t *testing.T) { + // Create a version 1 config + v1Config := Config{ + Version: 1, + // ... set up test data + } + + // Apply migration + migrated, err := applyMigration(&v1Config, 1, 2) + if err != nil { + t.Fatalf("Migration failed: %v", err) + } + + // Verify version is updated + if migrated.Version != 2 { + t.Errorf("Expected version 2, got %d", migrated.Version) + } + + // Verify data is preserved/transformed correctly + // ... +} +``` + +## Migration Best Practices + +1. **Version-Specific Structs**: Define a separate struct for each version that has structural changes +2. **Backward Compatibility**: Ensure old configs can still be loaded with their specific structs +3. **No Data Loss**: Migrations should preserve all user settings +4. **Idempotent**: Running the same migration multiple times should be safe +5. **Auto-Save**: Migrated configs are automatically saved to update the user's file +6. **Test Thoroughly**: Test with real user config files +7. **Update Defaults**: Keep `defaults.go` in sync with the latest schema + +## Example Migration + +### Scenario: Adding a new field with default value + +Old config (version 1): +```json +{ + "version": 1, + "agents": { + "defaults": { + "max_tokens": 32768 + } + } +} +``` + +Migration to version 2: +```go +case 2: + migrated := *cfg + migrated.Version = 2 + + // Add new field with default value if not set + if migrated.Agents.Defaults.NewFeatureEnabled == false { + // Use default value + } + + return &migrated, nil +``` + +New config (version 2): +```json +{ + "version": 2, + "agents": { + "defaults": { + "max_tokens": 32768, + "new_feature_enabled": false + } + } +} +``` + +## Troubleshooting + +### Config Not Upgrading +- Check that `CurrentConfigVersion` is incremented +- Verify migration logic in `applyMigration()` handles the target version +- Ensure `migrateConfig()` is called in `LoadConfig()` + +### Migration Errors +- Check error messages for specific migration failures +- Review migration logic for edge cases +- Ensure all required fields are properly initialized +- Verify the loader function for the source version + +### Data Loss After Migration +- Ensure all fields are copied during migration +- Check that the migration doesn't overwrite values with defaults unnecessarily +- Review the conversion logic in the loader functions + diff --git a/go.mod b/go.mod index f60be046f..3762015e9 100644 --- a/go.mod +++ b/go.mod @@ -11,6 +11,7 @@ require ( github.com/ergochat/irc-go v0.5.0 github.com/gdamore/tcell/v2 v2.13.8 github.com/google/uuid v1.6.0 + github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab github.com/gorilla/websocket v1.5.3 github.com/h2non/filetype v1.1.3 github.com/larksuite/oapi-sdk-go/v3 v3.5.3 @@ -20,6 +21,7 @@ require ( github.com/open-dingtalk/dingtalk-stream-sdk-go v0.9.1 github.com/openai/openai-go/v3 v3.22.0 github.com/rivo/tview v0.42.0 + github.com/rs/zerolog v1.34.0 github.com/slack-go/slack v0.17.3 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.11.1 @@ -49,7 +51,6 @@ require ( github.com/pmezard/go-difflib v1.0.0 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect github.com/rivo/uniseg v0.4.7 // indirect - github.com/rs/zerolog v1.34.0 // indirect github.com/segmentio/asm v1.1.3 // indirect github.com/segmentio/encoding v0.5.3 // indirect github.com/spf13/pflag v1.0.10 // indirect diff --git a/go.sum b/go.sum index 4060997f8..2e2b1a1ec 100644 --- a/go.sum +++ b/go.sum @@ -79,6 +79,8 @@ github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvq github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab h1:VYNivV7P8IRHUam2swVUNkhIdp0LRRFKe4hXNnoZKTc= +github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA= github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= diff --git a/pkg/agent/context.go b/pkg/agent/context.go index 5a84c45e2..dd030d1b1 100644 --- a/pkg/agent/context.go +++ b/pkg/agent/context.go @@ -12,6 +12,7 @@ import ( "sync" "time" + "github.com/sipeed/picoclaw/pkg" "github.com/sipeed/picoclaw/pkg/config" "github.com/sipeed/picoclaw/pkg/logger" "github.com/sipeed/picoclaw/pkg/providers" @@ -52,14 +53,14 @@ func (cb *ContextBuilder) WithToolDiscovery(useBM25, useRegex bool) *ContextBuil } func getGlobalConfigDir() string { - if home := os.Getenv("PICOCLAW_HOME"); home != "" { + if home := os.Getenv(pkg.PicoClawHome); home != "" { return home } home, err := os.UserHomeDir() if err != nil { return "" } - return filepath.Join(home, ".picoclaw") + return filepath.Join(home, pkg.DefaultPicoClawHome) } func NewContextBuilder(workspace string) *ContextBuilder { diff --git a/pkg/agent/instance_test.go b/pkg/agent/instance_test.go index 4f41ecd1c..335e236a0 100644 --- a/pkg/agent/instance_test.go +++ b/pkg/agent/instance_test.go @@ -18,7 +18,7 @@ func TestNewAgentInstance_UsesDefaultsTemperatureAndMaxTokens(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 1234, MaxToolIterations: 5, }, @@ -50,7 +50,7 @@ func TestNewAgentInstance_DefaultsTemperatureWhenZero(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 1234, MaxToolIterations: 5, }, @@ -79,7 +79,7 @@ func TestNewAgentInstance_DefaultsTemperatureWhenUnset(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 1234, MaxToolIterations: 5, }, @@ -133,7 +133,7 @@ func TestNewAgentInstance_ResolveCandidatesFromModelListAlias(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: tt.aliasName, + ModelName: tt.aliasName, }, }, ModelList: []config.ModelConfig{ diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 235d42fcc..28e549ce0 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -25,7 +25,6 @@ import ( "github.com/sipeed/picoclaw/pkg/config" "github.com/sipeed/picoclaw/pkg/constants" "github.com/sipeed/picoclaw/pkg/logger" - "github.com/sipeed/picoclaw/pkg/mcp" "github.com/sipeed/picoclaw/pkg/media" "github.com/sipeed/picoclaw/pkg/providers" "github.com/sipeed/picoclaw/pkg/routing" @@ -48,6 +47,7 @@ type AgentLoop struct { mediaStore media.MediaStore transcriber voice.Transcriber cmdRegistry *commands.Registry + mcp mcpRuntime } // processOptions configures how a message is processed @@ -239,119 +239,8 @@ func registerSharedTools( func (al *AgentLoop) Run(ctx context.Context) error { al.running.Store(true) - - // Initialize MCP servers for all agents - if al.cfg.Tools.IsToolEnabled("mcp") { - mcpManager := mcp.NewManager() - // Ensure MCP connections are cleaned up on exit, regardless of initialization success - // This fixes resource leak when LoadFromMCPConfig partially succeeds then fails - defer func() { - if err := mcpManager.Close(); err != nil { - logger.ErrorCF("agent", "Failed to close MCP manager", - map[string]any{ - "error": err.Error(), - }) - } - }() - - defaultAgent := al.registry.GetDefaultAgent() - var workspacePath string - if defaultAgent != nil && defaultAgent.Workspace != "" { - workspacePath = defaultAgent.Workspace - } else { - workspacePath = al.cfg.WorkspacePath() - } - - if err := mcpManager.LoadFromMCPConfig(ctx, al.cfg.Tools.MCP, workspacePath); err != nil { - logger.WarnCF("agent", "Failed to load MCP servers, MCP tools will not be available", - map[string]any{ - "error": err.Error(), - }) - } else { - // Register MCP tools for all agents - servers := mcpManager.GetServers() - uniqueTools := 0 - totalRegistrations := 0 - agentIDs := al.registry.ListAgentIDs() - agentCount := len(agentIDs) - - for serverName, conn := range servers { - uniqueTools += len(conn.Tools) - for _, tool := range conn.Tools { - for _, agentID := range agentIDs { - agent, ok := al.registry.GetAgent(agentID) - if !ok { - continue - } - - mcpTool := tools.NewMCPTool(mcpManager, serverName, tool) - - if al.cfg.Tools.MCP.Discovery.Enabled { - agent.Tools.RegisterHidden(mcpTool) - } else { - agent.Tools.Register(mcpTool) - } - - totalRegistrations++ - logger.DebugCF("agent", "Registered MCP tool", - map[string]any{ - "agent_id": agentID, - "server": serverName, - "tool": tool.Name, - "name": mcpTool.Name(), - }) - } - } - } - logger.InfoCF("agent", "MCP tools registered successfully", - map[string]any{ - "server_count": len(servers), - "unique_tools": uniqueTools, - "total_registrations": totalRegistrations, - "agent_count": agentCount, - }) - - // Initializes Discovery Tools only if enabled by configuration - if al.cfg.Tools.MCP.Enabled && al.cfg.Tools.MCP.Discovery.Enabled { - useBM25 := al.cfg.Tools.MCP.Discovery.UseBM25 - useRegex := al.cfg.Tools.MCP.Discovery.UseRegex - - // Fail fast: If discovery is enabled but no search method is turned on - if !useBM25 && !useRegex { - return fmt.Errorf( - "tool discovery is enabled but neither 'use_bm25' nor 'use_regex' is set to true in the configuration", - ) - } - - ttl := al.cfg.Tools.MCP.Discovery.TTL - if ttl <= 0 { - ttl = 5 // Default value - } - - maxSearchResults := al.cfg.Tools.MCP.Discovery.MaxSearchResults - if maxSearchResults <= 0 { - maxSearchResults = 5 // Default value - } - - logger.InfoCF("agent", "Initializing tool discovery", map[string]any{ - "bm25": useBM25, "regex": useRegex, "ttl": ttl, "max_results": maxSearchResults, - }) - - for _, agentID := range agentIDs { - agent, ok := al.registry.GetAgent(agentID) - if !ok { - continue - } - - if useRegex { - agent.Tools.Register(tools.NewRegexSearchTool(agent.Tools, ttl, maxSearchResults)) - } - if useBM25 { - agent.Tools.Register(tools.NewBM25SearchTool(agent.Tools, ttl, maxSearchResults)) - } - } - } - } + if err := al.ensureMCPInitialized(ctx); err != nil { + return err } for al.running.Load() { @@ -431,6 +320,17 @@ func (al *AgentLoop) Stop() { // Close releases resources held by agent session stores. Call after Stop. func (al *AgentLoop) Close() { + mcpManager := al.mcp.takeManager() + + if mcpManager != nil { + if err := mcpManager.Close(); err != nil { + logger.ErrorCF("agent", "Failed to close MCP manager", + map[string]any{ + "error": err.Error(), + }) + } + } + al.registry.Close() } @@ -467,9 +367,10 @@ var audioAnnotationRe = regexp.MustCompile(`\[(voice|audio)(?::[^\]]*)?\]`) // transcribeAudioInMessage resolves audio media refs, transcribes them, and // replaces audio annotations in msg.Content with the transcribed text. -func (al *AgentLoop) transcribeAudioInMessage(ctx context.Context, msg bus.InboundMessage) bus.InboundMessage { +// Returns the (possibly modified) message and true if audio was transcribed. +func (al *AgentLoop) transcribeAudioInMessage(ctx context.Context, msg bus.InboundMessage) (bus.InboundMessage, bool) { if al.transcriber == nil || al.mediaStore == nil || len(msg.Media) == 0 { - return msg + return msg, false } // Transcribe each audio media ref in order. @@ -493,9 +394,11 @@ func (al *AgentLoop) transcribeAudioInMessage(ctx context.Context, msg bus.Inbou } if len(transcriptions) == 0 { - return msg + return msg, false } + al.sendTranscriptionFeedback(ctx, msg.Channel, msg.ChatID, msg.MessageID, transcriptions) + // Replace audio annotations sequentially with transcriptions. idx := 0 newContent := audioAnnotationRe.ReplaceAllStringFunc(msg.Content, func(match string) string { @@ -513,7 +416,48 @@ func (al *AgentLoop) transcribeAudioInMessage(ctx context.Context, msg bus.Inbou } msg.Content = newContent - return msg + return msg, true +} + +// sendTranscriptionFeedback sends feedback to the user with the result of +// audio transcription if the option is enabled. It uses Manager.SendMessage +// which executes synchronously (rate limiting, splitting, retry) so that +// ordering with the subsequent placeholder is guaranteed. +func (al *AgentLoop) sendTranscriptionFeedback( + ctx context.Context, + channel, chatID, messageID string, + validTexts []string, +) { + if !al.cfg.Voice.EchoTranscription { + return + } + if al.channelManager == nil { + return + } + + var nonEmpty []string + for _, t := range validTexts { + if t != "" { + nonEmpty = append(nonEmpty, t) + } + } + + var feedbackMsg string + if len(nonEmpty) > 0 { + feedbackMsg = "Transcript: " + strings.Join(nonEmpty, "\n") + } else { + feedbackMsg = "No voice detected in the audio" + } + + err := al.channelManager.SendMessage(ctx, bus.OutboundMessage{ + Channel: channel, + ChatID: chatID, + Content: feedbackMsg, + ReplyToMessageID: messageID, + }) + if err != nil { + logger.WarnCF("voice", "Failed to send transcription feedback", map[string]any{"error": err.Error()}) + } } // inferMediaType determines the media type ("image", "audio", "video", "file") @@ -575,6 +519,10 @@ func (al *AgentLoop) ProcessDirectWithChannel( ctx context.Context, content, sessionKey, channel, chatID string, ) (string, error) { + if err := al.ensureMCPInitialized(ctx); err != nil { + return "", err + } + msg := bus.InboundMessage{ Channel: channel, SenderID: "cron", @@ -627,7 +575,14 @@ func (al *AgentLoop) processMessage(ctx context.Context, msg bus.InboundMessage) }, ) - msg = al.transcribeAudioInMessage(ctx, msg) + var hadAudio bool + msg, hadAudio = al.transcribeAudioInMessage(ctx, msg) + + // For audio messages the placeholder was deferred by the channel. + // Now that transcription (and optional feedback) is done, send it. + if hadAudio && al.channelManager != nil { + al.channelManager.SendPlaceholder(ctx, msg.Channel, msg.ChatID) + } // Route system messages to processSystemMessage if msg.Channel == "system" { diff --git a/pkg/agent/loop_mcp.go b/pkg/agent/loop_mcp.go new file mode 100644 index 000000000..2795db52a --- /dev/null +++ b/pkg/agent/loop_mcp.go @@ -0,0 +1,184 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// Inspired by and based on nanobot: https://github.com/HKUDS/nanobot +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package agent + +import ( + "context" + "fmt" + "sync" + + "github.com/sipeed/picoclaw/pkg/logger" + "github.com/sipeed/picoclaw/pkg/mcp" + "github.com/sipeed/picoclaw/pkg/tools" +) + +type mcpRuntime struct { + initOnce sync.Once + mu sync.Mutex + manager *mcp.Manager + initErr error +} + +func (r *mcpRuntime) setManager(manager *mcp.Manager) { + r.mu.Lock() + r.manager = manager + r.initErr = nil + r.mu.Unlock() +} + +func (r *mcpRuntime) setInitErr(err error) { + r.mu.Lock() + r.initErr = err + r.mu.Unlock() +} + +func (r *mcpRuntime) getInitErr() error { + r.mu.Lock() + defer r.mu.Unlock() + return r.initErr +} + +func (r *mcpRuntime) takeManager() *mcp.Manager { + r.mu.Lock() + defer r.mu.Unlock() + manager := r.manager + r.manager = nil + return manager +} + +func (r *mcpRuntime) hasManager() bool { + r.mu.Lock() + defer r.mu.Unlock() + return r.manager != nil +} + +// ensureMCPInitialized loads MCP servers/tools once so both Run() and direct +// agent mode share the same initialization path. +func (al *AgentLoop) ensureMCPInitialized(ctx context.Context) error { + if !al.cfg.Tools.IsToolEnabled("mcp") { + return nil + } + + al.mcp.initOnce.Do(func() { + mcpManager := mcp.NewManager() + + defaultAgent := al.registry.GetDefaultAgent() + workspacePath := al.cfg.WorkspacePath() + if defaultAgent != nil && defaultAgent.Workspace != "" { + workspacePath = defaultAgent.Workspace + } + + if err := mcpManager.LoadFromMCPConfig(ctx, al.cfg.Tools.MCP, workspacePath); err != nil { + logger.WarnCF("agent", "Failed to load MCP servers, MCP tools will not be available", + map[string]any{ + "error": err.Error(), + }) + if closeErr := mcpManager.Close(); closeErr != nil { + logger.ErrorCF("agent", "Failed to close MCP manager", + map[string]any{ + "error": closeErr.Error(), + }) + } + return + } + + // Register MCP tools for all agents + servers := mcpManager.GetServers() + uniqueTools := 0 + totalRegistrations := 0 + agentIDs := al.registry.ListAgentIDs() + agentCount := len(agentIDs) + + for serverName, conn := range servers { + uniqueTools += len(conn.Tools) + for _, tool := range conn.Tools { + for _, agentID := range agentIDs { + agent, ok := al.registry.GetAgent(agentID) + if !ok { + continue + } + + mcpTool := tools.NewMCPTool(mcpManager, serverName, tool) + + if al.cfg.Tools.MCP.Discovery.Enabled { + agent.Tools.RegisterHidden(mcpTool) + } else { + agent.Tools.Register(mcpTool) + } + + totalRegistrations++ + logger.DebugCF("agent", "Registered MCP tool", + map[string]any{ + "agent_id": agentID, + "server": serverName, + "tool": tool.Name, + "name": mcpTool.Name(), + }) + } + } + } + logger.InfoCF("agent", "MCP tools registered successfully", + map[string]any{ + "server_count": len(servers), + "unique_tools": uniqueTools, + "total_registrations": totalRegistrations, + "agent_count": agentCount, + }) + + // Initializes Discovery Tools only if enabled by configuration + if al.cfg.Tools.MCP.Enabled && al.cfg.Tools.MCP.Discovery.Enabled { + useBM25 := al.cfg.Tools.MCP.Discovery.UseBM25 + useRegex := al.cfg.Tools.MCP.Discovery.UseRegex + + // Fail fast: If discovery is enabled but no search method is turned on + if !useBM25 && !useRegex { + al.mcp.setInitErr(fmt.Errorf( + "tool discovery is enabled but neither 'use_bm25' nor 'use_regex' is set to true in the configuration", + )) + if closeErr := mcpManager.Close(); closeErr != nil { + logger.ErrorCF("agent", "Failed to close MCP manager", + map[string]any{ + "error": closeErr.Error(), + }) + } + return + } + + ttl := al.cfg.Tools.MCP.Discovery.TTL + if ttl <= 0 { + ttl = 5 // Default value + } + + maxSearchResults := al.cfg.Tools.MCP.Discovery.MaxSearchResults + if maxSearchResults <= 0 { + maxSearchResults = 5 // Default value + } + + logger.InfoCF("agent", "Initializing tool discovery", map[string]any{ + "bm25": useBM25, "regex": useRegex, "ttl": ttl, "max_results": maxSearchResults, + }) + + for _, agentID := range agentIDs { + agent, ok := al.registry.GetAgent(agentID) + if !ok { + continue + } + + if useRegex { + agent.Tools.Register(tools.NewRegexSearchTool(agent.Tools, ttl, maxSearchResults)) + } + if useBM25 { + agent.Tools.Register(tools.NewBM25SearchTool(agent.Tools, ttl, maxSearchResults)) + } + } + } + + al.mcp.setManager(mcpManager) + }) + + return al.mcp.getInitErr() +} diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 2e456fa60..6f90c6155 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -42,7 +42,7 @@ func newTestAgentLoop( Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -101,7 +101,7 @@ func TestNewAgentLoop_StateInitialized(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -137,7 +137,7 @@ func TestToolRegistry_ToolRegistration(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -194,7 +194,7 @@ func TestToolRegistry_GetDefinitions(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -230,7 +230,7 @@ func TestAgentLoop_GetStartupInfo(t *testing.T) { cfg := config.DefaultConfig() cfg.Agents.Defaults.Workspace = tmpDir - cfg.Agents.Defaults.Model = "test-model" + cfg.Agents.Defaults.ModelName = "test-model" cfg.Agents.Defaults.MaxTokens = 4096 cfg.Agents.Defaults.MaxToolIterations = 10 @@ -274,7 +274,7 @@ func TestAgentLoop_Stop(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -394,7 +394,7 @@ func TestProcessMessage_UsesRouteSessionKey(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -450,7 +450,7 @@ func TestProcessMessage_CommandOutcomes(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -530,7 +530,7 @@ func TestProcessMessage_SwitchModelShowModelConsistency(t *testing.T) { Defaults: config.AgentDefaults{ Workspace: tmpDir, Provider: "openai", - Model: "before-switch", + ModelName: "before-switch", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -587,7 +587,7 @@ func TestToolResult_SilentToolDoesNotSendUserMessage(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -629,7 +629,7 @@ func TestToolResult_UserFacingToolDoesSendMessage(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -700,7 +700,7 @@ func TestAgentLoop_ContextExhaustionRetry(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -770,6 +770,56 @@ func TestAgentLoop_ContextExhaustionRetry(t *testing.T) { } } +func TestProcessDirectWithChannel_InitializesMCPInAgentMode(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "agent-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + ModelName: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + Tools: config.ToolsConfig{ + MCP: config.MCPConfig{ + ToolConfig: config.ToolConfig{ + Enabled: true, + }, + }, + }, + } + + msgBus := bus.NewMessageBus() + provider := &mockProvider{} + al := NewAgentLoop(cfg, msgBus, provider) + defer al.Close() + + if al.mcp.hasManager() { + t.Fatal("expected MCP manager to be nil before first direct processing") + } + + _, err = al.ProcessDirectWithChannel( + context.Background(), + "hello", + "session-1", + "cli", + "direct", + ) + if err != nil { + t.Fatalf("ProcessDirectWithChannel failed: %v", err) + } + + if !al.mcp.hasManager() { + t.Fatal("expected MCP manager to be initialized in direct agent mode") + } +} + func TestTargetReasoningChannelID_AllChannels(t *testing.T) { tmpDir, err := os.MkdirTemp("", "agent-test-*") if err != nil { @@ -781,7 +831,7 @@ func TestTargetReasoningChannelID_AllChannels(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -851,7 +901,7 @@ func TestHandleReasoning(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, diff --git a/pkg/agent/registry_test.go b/pkg/agent/registry_test.go index 518bb441f..b173ef967 100644 --- a/pkg/agent/registry_test.go +++ b/pkg/agent/registry_test.go @@ -29,7 +29,7 @@ func testCfg(agents []config.AgentConfig) *config.Config { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: "/tmp/picoclaw-test-registry", - Model: "gpt-4", + ModelName: "gpt-4", MaxTokens: 8192, MaxToolIterations: 10, }, diff --git a/pkg/auth/store.go b/pkg/auth/store.go index 2e55d4877..dff011ee2 100644 --- a/pkg/auth/store.go +++ b/pkg/auth/store.go @@ -6,6 +6,7 @@ import ( "path/filepath" "time" + "github.com/sipeed/picoclaw/pkg" "github.com/sipeed/picoclaw/pkg/fileutil" ) @@ -39,11 +40,11 @@ func (c *AuthCredential) NeedsRefresh() bool { } func authFilePath() string { - if home := os.Getenv("PICOCLAW_HOME"); home != "" { + if home := os.Getenv(pkg.PicoClawHome); home != "" { return filepath.Join(home, "auth.json") } home, _ := os.UserHomeDir() - return filepath.Join(home, ".picoclaw", "auth.json") + return filepath.Join(home, pkg.DefaultPicoClawHome, "auth.json") } func LoadStore() (*AuthStore, error) { diff --git a/pkg/bus/types.go b/pkg/bus/types.go index 7ad8f0417..12da3f1dd 100644 --- a/pkg/bus/types.go +++ b/pkg/bus/types.go @@ -30,9 +30,10 @@ type InboundMessage struct { } type OutboundMessage struct { - Channel string `json:"channel"` - ChatID string `json:"chat_id"` - Content string `json:"content"` + Channel string `json:"channel"` + ChatID string `json:"chat_id"` + Content string `json:"content"` + ReplyToMessageID string `json:"reply_to_message_id,omitempty"` } // MediaPart describes a single media attachment to send. diff --git a/pkg/channels/base.go b/pkg/channels/base.go index 063a66523..edb5b6f08 100644 --- a/pkg/channels/base.go +++ b/pkg/channels/base.go @@ -5,6 +5,7 @@ import ( "crypto/rand" "encoding/binary" "encoding/hex" + "regexp" "strconv" "strings" "sync/atomic" @@ -32,6 +33,9 @@ func init() { uniqueIDPrefix = hex.EncodeToString(b[:]) } +// audioAnnotationRe matches audio/voice annotations injected by channels (e.g. [voice], [audio: file.ogg]). +var audioAnnotationRe = regexp.MustCompile(`\[(voice|audio)(?::[^\]]*)?\]`) + // uniqueID generates a process-unique ID using a random prefix and an atomic counter. // This ID is intended for internal correlation (e.g. media scope keys) and is NOT // cryptographically secure — it must not be used in contexts where unpredictability matters. @@ -284,10 +288,15 @@ func (c *BaseChannel) HandleMessage( c.placeholderRecorder.RecordReactionUndo(c.name, chatID, undo) } } - // Placeholder — independent pipeline - if pc, ok := c.owner.(PlaceholderCapable); ok { - if phID, err := pc.SendPlaceholder(ctx, chatID); err == nil && phID != "" { - c.placeholderRecorder.RecordPlaceholder(c.name, chatID, phID) + // Placeholder — independent pipeline. + // Skip when the message contains audio: the agent will send the + // placeholder after transcription completes, so the user sees + // "Thinking…" only once the voice has been processed. + if !audioAnnotationRe.MatchString(content) { + if pc, ok := c.owner.(PlaceholderCapable); ok { + if phID, err := pc.SendPlaceholder(ctx, chatID); err == nil && phID != "" { + c.placeholderRecorder.RecordPlaceholder(c.name, chatID, phID) + } } } } diff --git a/pkg/channels/dingtalk/dingtalk.go b/pkg/channels/dingtalk/dingtalk.go index 8642ad362..c03122892 100644 --- a/pkg/channels/dingtalk/dingtalk.go +++ b/pkg/channels/dingtalk/dingtalk.go @@ -10,6 +10,7 @@ import ( "github.com/open-dingtalk/dingtalk-stream-sdk-go/chatbot" "github.com/open-dingtalk/dingtalk-stream-sdk-go/client" + dinglog "github.com/open-dingtalk/dingtalk-stream-sdk-go/logger" "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/channels" @@ -39,6 +40,9 @@ func NewDingTalkChannel(cfg config.DingTalkConfig, messageBus *bus.MessageBus) ( return nil, fmt.Errorf("dingtalk client_id and client_secret are required") } + // Set the logger for the Stream SDK + dinglog.SetLogger(logger.NewLogger("dingtalk")) + base := channels.NewBaseChannel("dingtalk", cfg, messageBus, cfg.AllowFrom, channels.WithMaxMessageLength(20000), channels.WithGroupTrigger(cfg.GroupTrigger), diff --git a/pkg/channels/discord/discord.go b/pkg/channels/discord/discord.go index c3bcbff8d..83a04907c 100644 --- a/pkg/channels/discord/discord.go +++ b/pkg/channels/discord/discord.go @@ -45,6 +45,14 @@ type DiscordChannel struct { } func NewDiscordChannel(cfg config.DiscordConfig, bus *bus.MessageBus) (*DiscordChannel, error) { + discordgo.Logger = logger.NewLogger("discord"). + WithLevels(map[int]logger.LogLevel{ + discordgo.LogError: logger.ERROR, + discordgo.LogWarning: logger.WARN, + discordgo.LogInformational: logger.INFO, + discordgo.LogDebug: logger.DEBUG, + }).Log + session, err := discordgo.New("Bot " + cfg.Token) if err != nil { return nil, fmt.Errorf("failed to create discord session: %w", err) @@ -134,7 +142,7 @@ func (c *DiscordChannel) Send(ctx context.Context, msg bus.OutboundMessage) erro return nil } - return c.sendChunk(ctx, channelID, msg.Content) + return c.sendChunk(ctx, channelID, msg.Content, msg.ReplyToMessageID) } // SendMedia implements the channels.MediaSender interface. @@ -259,14 +267,29 @@ func (c *DiscordChannel) SendPlaceholder(ctx context.Context, chatID string) (st return msg.ID, nil } -func (c *DiscordChannel) sendChunk(ctx context.Context, channelID, content string) error { +func (c *DiscordChannel) sendChunk(ctx context.Context, channelID, content, replyToID string) error { // Use the passed ctx for timeout control sendCtx, cancel := context.WithTimeout(ctx, sendTimeout) defer cancel() done := make(chan error, 1) go func() { - _, err := c.session.ChannelMessageSend(channelID, content) + var err error + + // If we have an ID, we send the message as "Reply" + if replyToID != "" { + _, err = c.session.ChannelMessageSendComplex(channelID, &discordgo.MessageSend{ + Content: content, + Reference: &discordgo.MessageReference{ + MessageID: replyToID, + ChannelID: channelID, + }, + }) + } else { + // Otherwise, we send a normal message + _, err = c.session.ChannelMessageSend(channelID, content) + } + done <- err }() diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go index 1a24bb980..472895a7a 100644 --- a/pkg/channels/manager.go +++ b/pkg/channels/manager.go @@ -102,6 +102,27 @@ func (m *Manager) RecordPlaceholder(channel, chatID, placeholderID string) { m.placeholders.Store(key, placeholderEntry{id: placeholderID, createdAt: time.Now()}) } +// SendPlaceholder sends a "Thinking…" placeholder for the given channel/chatID +// and records it for later editing. Returns true if a placeholder was sent. +func (m *Manager) SendPlaceholder(ctx context.Context, channel, chatID string) bool { + m.mu.RLock() + ch, ok := m.channels[channel] + m.mu.RUnlock() + if !ok { + return false + } + pc, ok := ch.(PlaceholderCapable) + if !ok { + return false + } + phID, err := pc.SendPlaceholder(ctx, chatID) + if err != nil || phID == "" { + return false + } + m.RecordPlaceholder(channel, chatID, phID) + return true +} + // RecordTypingStop registers a typing stop function for later invocation. // Implements PlaceholderRecorder. func (m *Manager) RecordTypingStop(channel, chatID string, stop func()) { @@ -813,6 +834,39 @@ func (m *Manager) UnregisterChannel(name string) { delete(m.channels, name) } +// SendMessage sends an outbound message synchronously through the channel +// worker's rate limiter and retry logic. It blocks until the message is +// delivered (or all retries are exhausted), which preserves ordering when +// a subsequent operation depends on the message having been sent. +func (m *Manager) SendMessage(ctx context.Context, msg bus.OutboundMessage) error { + m.mu.RLock() + _, exists := m.channels[msg.Channel] + w, wExists := m.workers[msg.Channel] + m.mu.RUnlock() + + if !exists { + return fmt.Errorf("channel %s not found", msg.Channel) + } + if !wExists || w == nil { + return fmt.Errorf("channel %s has no active worker", msg.Channel) + } + + maxLen := 0 + if mlp, ok := w.ch.(MessageLengthProvider); ok { + maxLen = mlp.MaxMessageLength() + } + if maxLen > 0 && len([]rune(msg.Content)) > maxLen { + for _, chunk := range SplitMessage(msg.Content, maxLen) { + chunkMsg := msg + chunkMsg.Content = chunk + m.sendWithRetry(ctx, msg.Channel, w, chunkMsg) + } + } else { + m.sendWithRetry(ctx, msg.Channel, w, msg) + } + return nil +} + func (m *Manager) SendToChannel(ctx context.Context, channelName, chatID, content string) error { m.mu.RLock() _, exists := m.channels[channelName] diff --git a/pkg/channels/manager_test.go b/pkg/channels/manager_test.go index f09ecfe2f..1f3a628c2 100644 --- a/pkg/channels/manager_test.go +++ b/pkg/channels/manager_test.go @@ -17,16 +17,32 @@ import ( // mockChannel is a test double that delegates Send to a configurable function. type mockChannel struct { BaseChannel - sendFn func(ctx context.Context, msg bus.OutboundMessage) error + sendFn func(ctx context.Context, msg bus.OutboundMessage) error + sentMessages []bus.OutboundMessage + placeholdersSent int + editedMessages int + lastPlaceholderID string } func (m *mockChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { + m.sentMessages = append(m.sentMessages, msg) return m.sendFn(ctx, msg) } func (m *mockChannel) Start(ctx context.Context) error { return nil } func (m *mockChannel) Stop(ctx context.Context) error { return nil } +func (m *mockChannel) SendPlaceholder(ctx context.Context, chatID string) (string, error) { + m.placeholdersSent++ + m.lastPlaceholderID = "mock-ph-123" + return m.lastPlaceholderID, nil +} + +func (m *mockChannel) EditMessage(ctx context.Context, chatID, messageID, content string) error { + m.editedMessages++ + return nil +} + // newTestManager creates a minimal Manager suitable for unit tests. func newTestManager() *Manager { return &Manager{ @@ -860,3 +876,286 @@ func TestBuildMediaScope_WithMessageID(t *testing.T) { t.Fatalf("expected %s, got %s", expected, scope) } } + +func TestManager_PlaceholderConsumedByResponse(t *testing.T) { + mgr := &Manager{ + channels: make(map[string]Channel), + workers: make(map[string]*channelWorker), + placeholders: sync.Map{}, + } + + mockCh := &mockChannel{ + sendFn: func(ctx context.Context, msg bus.OutboundMessage) error { + return nil + }, + } + worker := newChannelWorker("mock", mockCh) + mgr.channels["mock"] = mockCh + mgr.workers["mock"] = worker + + ctx := context.Background() + key := "mock:chat-1" + + // Simulate a placeholder recorded by base.go HandleMessage + mgr.RecordPlaceholder("mock", "chat-1", "ph-123") + + if _, ok := mgr.placeholders.Load(key); !ok { + t.Fatal("expected placeholder to be recorded") + } + + // Transcription feedback arrives first — it should consume the placeholder + // and be delivered via EditMessage, not Send. + msgTranscript := bus.OutboundMessage{ + Channel: "mock", + ChatID: "chat-1", + Content: "Transcript: hello", + } + mgr.sendWithRetry(ctx, "mock", worker, msgTranscript) + + if mockCh.editedMessages != 1 { + t.Errorf("expected 1 edited message (placeholder consumed by transcript), got %d", mockCh.editedMessages) + } + if len(mockCh.sentMessages) != 0 { + t.Errorf("expected 0 normal messages (transcript used edit), got %d", len(mockCh.sentMessages)) + } + + // Placeholder should be gone now + if _, ok := mgr.placeholders.Load(key); ok { + t.Error("expected placeholder to be removed after being consumed") + } + + // Final LLM response arrives — no placeholder left, so it goes through Send + msgFinal := bus.OutboundMessage{ + Channel: "mock", + ChatID: "chat-1", + Content: "Final Answer", + } + mgr.sendWithRetry(ctx, "mock", worker, msgFinal) + + if len(mockCh.sentMessages) != 1 { + t.Errorf("expected 1 normal message sent, got %d", len(mockCh.sentMessages)) + } +} + +func TestSendMessage_Synchronous(t *testing.T) { + m := newTestManager() + + var received []bus.OutboundMessage + ch := &mockChannel{ + sendFn: func(_ context.Context, msg bus.OutboundMessage) error { + received = append(received, msg) + return nil + }, + } + + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + msg := bus.OutboundMessage{ + Channel: "test", + ChatID: "123", + Content: "hello world", + ReplyToMessageID: "msg-456", + } + + err := m.SendMessage(context.Background(), msg) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + // SendMessage is synchronous — message should already be delivered + if len(received) != 1 { + t.Fatalf("expected 1 message sent, got %d", len(received)) + } + if received[0].ReplyToMessageID != "msg-456" { + t.Fatalf("expected ReplyToMessageID msg-456, got %s", received[0].ReplyToMessageID) + } + if received[0].Content != "hello world" { + t.Fatalf("expected content 'hello world', got %s", received[0].Content) + } +} + +func TestSendMessage_UnknownChannel(t *testing.T) { + m := newTestManager() + + msg := bus.OutboundMessage{ + Channel: "nonexistent", + ChatID: "123", + Content: "hello", + } + + err := m.SendMessage(context.Background(), msg) + if err == nil { + t.Fatal("expected error for unknown channel") + } +} + +func TestSendMessage_NoWorker(t *testing.T) { + m := newTestManager() + + ch := &mockChannel{ + sendFn: func(_ context.Context, _ bus.OutboundMessage) error { return nil }, + } + m.channels["test"] = ch + // No worker registered + + msg := bus.OutboundMessage{ + Channel: "test", + ChatID: "123", + Content: "hello", + } + + err := m.SendMessage(context.Background(), msg) + if err == nil { + t.Fatal("expected error when no worker exists") + } +} + +func TestSendMessage_WithRetry(t *testing.T) { + m := newTestManager() + + var callCount int + ch := &mockChannel{ + sendFn: func(_ context.Context, _ bus.OutboundMessage) error { + callCount++ + if callCount == 1 { + return fmt.Errorf("transient: %w", ErrTemporary) + } + return nil + }, + } + + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + msg := bus.OutboundMessage{ + Channel: "test", + ChatID: "123", + Content: "retry me", + } + + err := m.SendMessage(context.Background(), msg) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + if callCount != 2 { + t.Fatalf("expected 2 Send calls (1 failure + 1 success), got %d", callCount) + } +} + +func TestSendMessage_WithSplitting(t *testing.T) { + m := newTestManager() + + var received []string + ch := &mockChannelWithLength{ + mockChannel: mockChannel{ + sendFn: func(_ context.Context, msg bus.OutboundMessage) error { + received = append(received, msg.Content) + return nil + }, + }, + maxLen: 5, + } + + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + msg := bus.OutboundMessage{ + Channel: "test", + ChatID: "123", + Content: "hello world", + } + + err := m.SendMessage(context.Background(), msg) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + if len(received) < 2 { + t.Fatalf("expected message to be split into at least 2 chunks, got %d", len(received)) + } +} + +func TestSendMessage_PreservesOrdering(t *testing.T) { + m := newTestManager() + + var order []string + ch := &mockChannel{ + sendFn: func(_ context.Context, msg bus.OutboundMessage) error { + order = append(order, msg.Content) + return nil + }, + } + + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + // Send two messages sequentially — they must arrive in order + _ = m.SendMessage(context.Background(), bus.OutboundMessage{ + Channel: "test", ChatID: "1", Content: "first", + }) + _ = m.SendMessage(context.Background(), bus.OutboundMessage{ + Channel: "test", ChatID: "1", Content: "second", + }) + + if len(order) != 2 { + t.Fatalf("expected 2 messages, got %d", len(order)) + } + if order[0] != "first" || order[1] != "second" { + t.Fatalf("expected [first, second], got %v", order) + } +} + +func TestManager_SendPlaceholder(t *testing.T) { + mgr := &Manager{ + channels: make(map[string]Channel), + workers: make(map[string]*channelWorker), + placeholders: sync.Map{}, + } + + mockCh := &mockChannel{ + sendFn: func(ctx context.Context, msg bus.OutboundMessage) error { + return nil + }, + } + mgr.channels["mock"] = mockCh + + ctx := context.Background() + + // SendPlaceholder should send a placeholder and record it + ok := mgr.SendPlaceholder(ctx, "mock", "chat-1") + if !ok { + t.Fatal("expected SendPlaceholder to succeed") + } + if mockCh.placeholdersSent != 1 { + t.Errorf("expected 1 placeholder sent, got %d", mockCh.placeholdersSent) + } + + key := "mock:chat-1" + if _, loaded := mgr.placeholders.Load(key); !loaded { + t.Error("expected placeholder to be recorded in manager") + } + + // SendPlaceholder on unknown channel should return false + ok = mgr.SendPlaceholder(ctx, "unknown", "chat-1") + if ok { + t.Error("expected SendPlaceholder to fail for unknown channel") + } +} diff --git a/pkg/channels/matrix/matrix.go b/pkg/channels/matrix/matrix.go index d51eee8fb..a45207f12 100644 --- a/pkg/channels/matrix/matrix.go +++ b/pkg/channels/matrix/matrix.go @@ -13,6 +13,9 @@ import ( "sync" "time" + "github.com/gomarkdown/markdown" + mdhtml "github.com/gomarkdown/markdown/html" + "github.com/gomarkdown/markdown/parser" "maunium.net/go/mautrix" "maunium.net/go/mautrix/event" "maunium.net/go/mautrix/id" @@ -268,6 +271,12 @@ func (c *MatrixChannel) Stop(ctx context.Context) error { return nil } +func markdownToHTML(md string) string { + p := parser.NewWithExtensions(parser.CommonExtensions | parser.AutoHeadingIDs) + renderer := mdhtml.NewRenderer(mdhtml.RendererOptions{Flags: mdhtml.CommonFlags}) + return strings.TrimSpace(string(markdown.ToHTML([]byte(md), p, renderer))) +} + func (c *MatrixChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { if !c.IsRunning() { return channels.ErrNotRunning @@ -283,16 +292,22 @@ func (c *MatrixChannel) Send(ctx context.Context, msg bus.OutboundMessage) error return nil } - _, err := c.client.SendMessageEvent(ctx, roomID, event.EventMessage, &event.MessageEventContent{ - MsgType: event.MsgText, - Body: content, - }) + _, err := c.client.SendMessageEvent(ctx, roomID, event.EventMessage, c.messageContent(content)) if err != nil { return fmt.Errorf("matrix send: %w", channels.ErrTemporary) } return nil } +func (c *MatrixChannel) messageContent(text string) *event.MessageEventContent { + mc := &event.MessageEventContent{MsgType: event.MsgText, Body: text} + if c.config.MessageFormat != "plain" { + mc.Format = event.FormatHTML + mc.FormattedBody = markdownToHTML(text) + } + return mc +} + // SendMedia implements channels.MediaSender. func (c *MatrixChannel) SendMedia(ctx context.Context, msg bus.OutboundMediaMessage) error { if !c.IsRunning() { @@ -482,10 +497,7 @@ func (c *MatrixChannel) EditMessage(ctx context.Context, chatID string, messageI return fmt.Errorf("matrix message ID is empty") } - editContent := &event.MessageEventContent{ - MsgType: event.MsgText, - Body: content, - } + editContent := c.messageContent(content) editContent.SetEdit(id.EventID(messageID)) _, err := c.client.SendMessageEvent(ctx, roomID, event.EventMessage, editContent) diff --git a/pkg/channels/matrix/matrix_test.go b/pkg/channels/matrix/matrix_test.go index e76db0d3e..806a98739 100644 --- a/pkg/channels/matrix/matrix_test.go +++ b/pkg/channels/matrix/matrix_test.go @@ -4,12 +4,15 @@ import ( "context" "os" "path/filepath" + "strings" "testing" "time" "maunium.net/go/mautrix" "maunium.net/go/mautrix/event" "maunium.net/go/mautrix/id" + + "github.com/sipeed/picoclaw/pkg/config" ) func TestMatrixLocalpartMentionRegexp(t *testing.T) { @@ -289,3 +292,50 @@ func TestMatrixOutboundContent(t *testing.T) { t.Fatalf("unexpected fallback body: %q", noCaption.Body) } } + +func TestMarkdownToHTML(t *testing.T) { + tests := []struct { + name string + input string + contains string + }{ + {"bold", "**hello**", "hello"}, + {"italic", "_world_", "world"}, + {"header", "### Title", ""}, + {"inline code", "`x`", "x"}, + {"plain text", "just text", "just text"}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := markdownToHTML(tt.input) + if !strings.Contains(got, tt.contains) { + t.Fatalf("markdownToHTML(%q) = %q, want it to contain %q", tt.input, got, tt.contains) + } + }) + } +} + +func TestMessageContent(t *testing.T) { + richtext := &MatrixChannel{config: config.MatrixConfig{MessageFormat: "richtext"}} + plain := &MatrixChannel{config: config.MatrixConfig{MessageFormat: "plain"}} + defaultt := &MatrixChannel{config: config.MatrixConfig{}} + + for _, c := range []*MatrixChannel{richtext, defaultt} { + mc := c.messageContent("**hi**") + if mc.Format != event.FormatHTML { + t.Errorf("format %q: expected FormatHTML, got %q", c.config.MessageFormat, mc.Format) + } + if !strings.Contains(mc.FormattedBody, "hi") { + t.Errorf("format %q: FormattedBody %q missing ", c.config.MessageFormat, mc.FormattedBody) + } + if mc.Body != "**hi**" { + t.Errorf("format %q: Body should remain plain, got %q", c.config.MessageFormat, mc.Body) + } + } + + mc := plain.messageContent("**hi**") + if mc.Format != "" || mc.FormattedBody != "" { + t.Errorf("plain: expected no formatting, got format=%q formattedBody=%q", mc.Format, mc.FormattedBody) + } +} diff --git a/pkg/channels/qq/qq.go b/pkg/channels/qq/qq.go index 540e3b7af..73200f64e 100644 --- a/pkg/channels/qq/qq.go +++ b/pkg/channels/qq/qq.go @@ -78,6 +78,7 @@ func (c *QQChannel) Start(ctx context.Context) error { return fmt.Errorf("QQ app_id and app_secret not configured") } + botgo.SetLogger(logger.NewLogger("botgo")) logger.InfoC("qq", "Starting QQ bot (WebSocket mode)") // Reinitialize shutdown signal for clean restart. diff --git a/pkg/channels/slack/slack.go b/pkg/channels/slack/slack.go index 024b1b023..3ee849621 100644 --- a/pkg/channels/slack/slack.go +++ b/pkg/channels/slack/slack.go @@ -122,7 +122,11 @@ func (c *SlackChannel) Send(ctx context.Context, msg bus.OutboundMessage) error slack.MsgOptionText(msg.Content, false), } - if threadTS != "" { + if msg.ReplyToMessageID != "" && threadTS == "" { + // Answer to the message by creating a Thread under it + opts = append(opts, slack.MsgOptionTS(msg.ReplyToMessageID)) + } else if threadTS != "" { + // If we are already in a thread, continue in the thread opts = append(opts, slack.MsgOptionTS(threadTS)) } diff --git a/pkg/channels/telegram/telegram.go b/pkg/channels/telegram/telegram.go index b04beeb6e..34ee46b7b 100644 --- a/pkg/channels/telegram/telegram.go +++ b/pkg/channels/telegram/telegram.go @@ -77,6 +77,7 @@ func NewTelegramChannel(cfg *config.Config, bus *bus.MessageBus) (*TelegramChann if baseURL := strings.TrimRight(strings.TrimSpace(telegramCfg.BaseURL), "/"); baseURL != "" { opts = append(opts, telego.WithAPIServer(baseURL)) } + opts = append(opts, telego.WithLogger(logger.NewLogger("telego"))) bot, err := telego.NewBot(telegramCfg.Token, opts...) if err != nil { @@ -180,6 +181,7 @@ func (c *TelegramChannel) Send(ctx context.Context, msg bus.OutboundMessage) err // The Manager already splits messages to ≤4000 chars (WithMaxMessageLength), // so msg.Content is guaranteed to be within that limit. We still need to // check if HTML expansion pushes it beyond Telegram's 4096-char API limit. + replyToID := msg.ReplyToMessageID queue := []string{msg.Content} for len(queue) > 0 { chunk := queue[0] @@ -200,9 +202,11 @@ func (c *TelegramChannel) Send(ctx context.Context, msg bus.OutboundMessage) err continue } - if err := c.sendHTMLChunk(ctx, chatID, threadID, htmlContent, chunk); err != nil { + if err := c.sendHTMLChunk(ctx, chatID, threadID, htmlContent, chunk, replyToID); err != nil { return err } + // Only the first chunk should be a reply; subsequent chunks are normal messages. + replyToID = "" } return nil @@ -211,12 +215,20 @@ func (c *TelegramChannel) Send(ctx context.Context, msg bus.OutboundMessage) err // sendHTMLChunk sends a single HTML message, falling back to the original // markdown as plain text on parse failure so users never see raw HTML tags. func (c *TelegramChannel) sendHTMLChunk( - ctx context.Context, chatID int64, threadID int, htmlContent, mdFallback string, + ctx context.Context, chatID int64, threadID int, htmlContent, mdFallback string, replyToID string, ) error { tgMsg := tu.Message(tu.ID(chatID), htmlContent) tgMsg.ParseMode = telego.ModeHTML tgMsg.MessageThreadID = threadID + if replyToID != "" { + if mid, parseErr := strconv.Atoi(replyToID); parseErr == nil { + tgMsg.ReplyParameters = &telego.ReplyParameters{ + MessageID: mid, + } + } + } + if _, err := c.bot.SendMessage(ctx, tgMsg); err != nil { logger.ErrorCF("telegram", "HTML parse failed, falling back to plain text", map[string]any{ "error": err.Error(), diff --git a/pkg/channels/wecom/app_test.go b/pkg/channels/wecom/app_test.go index 7f230494f..7d07041ad 100644 --- a/pkg/channels/wecom/app_test.go +++ b/pkg/channels/wecom/app_test.go @@ -209,7 +209,7 @@ func TestWeComAppVerifySignature(t *testing.T) { } }) - t.Run("empty token skips verification", func(t *testing.T) { + t.Run("empty token rejects verification (fail-closed)", func(t *testing.T) { cfgEmpty := config.WeComAppConfig{ CorpID: "test_corp_id", CorpSecret: "test_secret", @@ -218,8 +218,8 @@ func TestWeComAppVerifySignature(t *testing.T) { } chEmpty, _ := NewWeComAppChannel(cfgEmpty, msgBus) - if !verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { - t.Error("empty token should skip verification and return true") + if verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { + t.Error("empty token should reject verification (fail-closed)") } }) } diff --git a/pkg/channels/wecom/bot_test.go b/pkg/channels/wecom/bot_test.go index c053578b1..d223bb6b6 100644 --- a/pkg/channels/wecom/bot_test.go +++ b/pkg/channels/wecom/bot_test.go @@ -189,8 +189,7 @@ func TestWeComBotVerifySignature(t *testing.T) { } }) - t.Run("empty token skips verification", func(t *testing.T) { - // Create a channel manually with empty token to test the behavior + t.Run("empty token rejects verification (fail-closed)", func(t *testing.T) { cfgEmpty := config.WeComConfig{ Token: "", WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", @@ -199,8 +198,8 @@ func TestWeComBotVerifySignature(t *testing.T) { config: cfgEmpty, } - if !verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { - t.Error("empty token should skip verification and return true") + if verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { + t.Error("empty token should reject verification (fail-closed)") } }) } diff --git a/pkg/channels/wecom/common.go b/pkg/channels/wecom/common.go index 6510e6f81..9a622a2fc 100644 --- a/pkg/channels/wecom/common.go +++ b/pkg/channels/wecom/common.go @@ -31,7 +31,7 @@ func computeSignature(token, timestamp, nonce, encrypt string) string { // This is a common function used by both WeCom Bot and WeCom App func verifySignature(token, msgSignature, timestamp, nonce, msgEncrypt string) bool { if token == "" { - return true // Skip verification if token is not set + return false } return computeSignature(token, timestamp, nonce, msgEncrypt) == msgSignature } diff --git a/pkg/config/config.go b/pkg/config/config.go index 13d5a7306..8bc46dfc4 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -4,12 +4,15 @@ import ( "encoding/json" "fmt" "os" + "path/filepath" "strings" "sync/atomic" "github.com/caarlos0/env/v11" + "github.com/sipeed/picoclaw/pkg" "github.com/sipeed/picoclaw/pkg/fileutil" + "github.com/sipeed/picoclaw/pkg/logger" ) // rrCounter is a global counter for round-robin load balancing across models. @@ -17,6 +20,8 @@ var rrCounter atomic.Uint64 // FlexibleStringSlice is a []string that also accepts JSON numbers, // so allow_from can contain both "123" and 123. +// It also supports parsing comma-separated strings from environment variables, +// including both English (,) and Chinese (，) commas. type FlexibleStringSlice []string func (f *FlexibleStringSlice) UnmarshalJSON(data []byte) error { @@ -48,17 +53,46 @@ func (f *FlexibleStringSlice) UnmarshalJSON(data []byte) error { return nil } +// UnmarshalText implements encoding.TextUnmarshaler to support env variable parsing. +// It handles comma-separated values with both English (,) and Chinese (，) commas. +func (f *FlexibleStringSlice) UnmarshalText(text []byte) error { + if len(text) == 0 { + *f = nil + return nil + } + + s := string(text) + // Replace Chinese comma with English comma, then split + s = strings.ReplaceAll(s, "，", ",") + parts := strings.Split(s, ",") + + result := make([]string, 0, len(parts)) + for _, part := range parts { + part = strings.TrimSpace(part) + if part != "" { + result = append(result, part) + } + } + *f = result + return nil +} + +// CurrentVersion is the latest config schema version +const CurrentVersion = 1 + +// Config is the current config structure with version support type Config struct { + Version int `json:"version"` // Config schema version for migration Agents AgentsConfig `json:"agents"` Bindings []AgentBinding `json:"bindings,omitempty"` Session SessionConfig `json:"session,omitempty"` Channels ChannelsConfig `json:"channels"` - Providers ProvidersConfig `json:"providers,omitempty"` ModelList []ModelConfig `json:"model_list"` // New model-centric provider configuration Gateway GatewayConfig `json:"gateway"` Tools ToolsConfig `json:"tools"` Heartbeat HeartbeatConfig `json:"heartbeat"` Devices DevicesConfig `json:"devices"` + Voice VoiceConfig `json:"voice"` // BuildInfo contains build-time version information BuildInfo BuildInfo `json:"build_info,omitempty"` } @@ -73,19 +107,14 @@ type BuildInfo struct { // MarshalJSON implements custom JSON marshaling for Config // to omit providers section when empty and session when empty -func (c Config) MarshalJSON() ([]byte, error) { +func (c *Config) MarshalJSON() ([]byte, error) { type Alias Config aux := &struct { Providers *ProvidersConfig `json:"providers,omitempty"` Session *SessionConfig `json:"session,omitempty"` *Alias }{ - Alias: (*Alias)(&c), - } - - // Only include providers if not empty - if !c.Providers.IsEmpty() { - aux.Providers = &c.Providers + Alias: (*Alias)(c), } // Only include session if not empty @@ -196,7 +225,6 @@ type AgentDefaults struct { AllowReadOutsideWorkspace bool `json:"allow_read_outside_workspace" env:"PICOCLAW_AGENTS_DEFAULTS_ALLOW_READ_OUTSIDE_WORKSPACE"` Provider string `json:"provider" env:"PICOCLAW_AGENTS_DEFAULTS_PROVIDER"` ModelName string `json:"model_name,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_MODEL_NAME"` - Model string `json:"model" env:"PICOCLAW_AGENTS_DEFAULTS_MODEL"` // Deprecated: use model_name instead ModelFallbacks []string `json:"model_fallbacks,omitempty"` ImageModel string `json:"image_model,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_IMAGE_MODEL"` ImageModelFallbacks []string `json:"image_model_fallbacks,omitempty"` @@ -221,10 +249,7 @@ func (d *AgentDefaults) GetMaxMediaSize() int { // GetModelName returns the effective model name for the agent defaults. // It prefers the new "model_name" field but falls back to "model" for backward compatibility. func (d *AgentDefaults) GetModelName() string { - if d.ModelName != "" { - return d.ModelName - } - return d.Model + return d.ModelName } type ChannelsConfig struct { @@ -349,16 +374,17 @@ type SlackConfig struct { } type MatrixConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_MATRIX_ENABLED"` - Homeserver string `json:"homeserver" env:"PICOCLAW_CHANNELS_MATRIX_HOMESERVER"` - UserID string `json:"user_id" env:"PICOCLAW_CHANNELS_MATRIX_USER_ID"` - AccessToken string `json:"access_token" env:"PICOCLAW_CHANNELS_MATRIX_ACCESS_TOKEN"` - DeviceID string `json:"device_id,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_DEVICE_ID"` - JoinOnInvite bool `json:"join_on_invite" env:"PICOCLAW_CHANNELS_MATRIX_JOIN_ON_INVITE"` - AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_MATRIX_ALLOW_FROM"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_MATRIX_ENABLED"` + Homeserver string `json:"homeserver" env:"PICOCLAW_CHANNELS_MATRIX_HOMESERVER"` + UserID string `json:"user_id" env:"PICOCLAW_CHANNELS_MATRIX_USER_ID"` + AccessToken string `json:"access_token" env:"PICOCLAW_CHANNELS_MATRIX_ACCESS_TOKEN"` + DeviceID string `json:"device_id,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_DEVICE_ID"` + JoinOnInvite bool `json:"join_on_invite" env:"PICOCLAW_CHANNELS_MATRIX_JOIN_ON_INVITE"` + MessageFormat string `json:"message_format,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_MESSAGE_FORMAT"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_MATRIX_ALLOW_FROM"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` - ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_MATRIX_REASONING_CHANNEL_ID"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_MATRIX_REASONING_CHANNEL_ID"` } type LINEConfig struct { @@ -472,6 +498,10 @@ type DevicesConfig struct { MonitorUSB bool `json:"monitor_usb" env:"PICOCLAW_DEVICES_MONITOR_USB"` } +type VoiceConfig struct { + EchoTranscription bool `json:"echo_transcription" env:"PICOCLAW_VOICE_ECHO_TRANSCRIPTION"` +} + type ProvidersConfig struct { Anthropic ProviderConfig `json:"anthropic"` OpenAI OpenAIProviderConfig `json:"openai"` @@ -495,6 +525,7 @@ type ProvidersConfig struct { Mistral ProviderConfig `json:"mistral"` Avian ProviderConfig `json:"avian"` Minimax ProviderConfig `json:"minimax"` + LongCat ProviderConfig `json:"longcat"` } // IsEmpty checks if all provider configs are empty (no API keys or API bases set) @@ -521,7 +552,8 @@ func (p ProvidersConfig) IsEmpty() bool { p.Qwen.APIKey == "" && p.Qwen.APIBase == "" && p.Mistral.APIKey == "" && p.Mistral.APIBase == "" && p.Avian.APIKey == "" && p.Avian.APIBase == "" && - p.Minimax.APIKey == "" && p.Minimax.APIBase == "" + p.Minimax.APIKey == "" && p.Minimax.APIBase == "" && + p.LongCat.APIKey == "" && p.LongCat.APIBase == "" } // MarshalJSON implements custom JSON marshaling for ProvidersConfig @@ -668,6 +700,7 @@ type CronToolsConfig struct { type ExecConfig struct { ToolConfig ` envPrefix:"PICOCLAW_TOOLS_EXEC_"` EnableDenyPatterns bool ` env:"PICOCLAW_TOOLS_EXEC_ENABLE_DENY_PATTERNS" json:"enable_deny_patterns"` + AllowRemote bool ` env:"PICOCLAW_TOOLS_EXEC_ALLOW_REMOTE" json:"allow_remote"` CustomDenyPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS" json:"custom_deny_patterns"` CustomAllowPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS" json:"custom_allow_patterns"` TimeoutSeconds int ` env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS" json:"timeout_seconds"` // 0 means use default (60s) @@ -766,44 +799,53 @@ type MCPConfig struct { } func LoadConfig(path string) (*Config, error) { - cfg := DefaultConfig() - data, err := os.ReadFile(path) if err != nil { if os.IsNotExist(err) { - return cfg, nil + return DefaultConfig(), nil } return nil, err } - // Pre-scan the JSON to check how many model_list entries the user provided. - // Go's JSON decoder reuses existing slice backing-array elements rather than - // zero-initializing them, so fields absent from the user's JSON (e.g. api_base) - // would silently inherit values from the DefaultConfig template at the same - // index position. We only reset cfg.ModelList when the user actually provides - // entries; when count is 0 we keep DefaultConfig's built-in list as fallback. - var tmp Config - if err := json.Unmarshal(data, &tmp); err != nil { - return nil, err + // First, try to detect config version by reading the version field + var versionInfo struct { + Version int `json:"version"` } - if len(tmp.ModelList) > 0 { - cfg.ModelList = nil + if e := json.Unmarshal(data, &versionInfo); e != nil { + return nil, fmt.Errorf("failed to detect config version: %w", e) } - if err := json.Unmarshal(data, cfg); err != nil { - return nil, err + // Load config based on detected version + var cfg *Config + switch versionInfo.Version { + case 0: + // Legacy config (no version field) + v, e := loadConfigV0(data) + if e != nil { + return nil, e + } + cfg, e = v.Migrate() + if e != nil { + logger.DebugF("config migrate fail", map[string]any{"from": versionInfo.Version, "to": CurrentVersion}) + return nil, e + } + logger.DebugF("config migrate success", map[string]any{"from": versionInfo.Version, "to": CurrentVersion}) + defer func() { + _ = SaveConfig(path, cfg) + }() + case CurrentVersion: + // Current version + cfg, err = loadConfig(data) + if err != nil { + return nil, err + } + default: + return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version) } - if err := env.Parse(cfg); err != nil { - return nil, err - } - - // Migrate legacy channel config fields to new unified structures - cfg.migrateChannelConfigs() - - // Auto-migrate: if only legacy providers config exists, convert to model_list - if len(cfg.ModelList) == 0 && cfg.HasProvidersConfig() { - cfg.ModelList = ConvertProvidersToModelList(cfg) + // Apply environment variables + if e := env.Parse(cfg); e != nil { + return nil, e } // Validate model_list for uniqueness and required fields @@ -811,23 +853,26 @@ func LoadConfig(path string) (*Config, error) { return nil, err } + // Ensure Workspace has a default if not set + if cfg.Agents.Defaults.Workspace == "" { + homePath, _ := os.UserHomeDir() + if picoclawHome := os.Getenv(pkg.PicoClawHome); picoclawHome != "" { + homePath = picoclawHome + } else if homePath != "" { + homePath = filepath.Join(homePath, pkg.DefaultPicoClawHome) + } + cfg.Agents.Defaults.Workspace = filepath.Join(homePath, pkg.WorkspaceName) + } + return cfg, nil } -func (c *Config) migrateChannelConfigs() { - // Discord: mention_only -> group_trigger.mention_only - if c.Channels.Discord.MentionOnly && !c.Channels.Discord.GroupTrigger.MentionOnly { - c.Channels.Discord.GroupTrigger.MentionOnly = true - } - - // OneBot: group_trigger_prefix -> group_trigger.prefixes - if len(c.Channels.OneBot.GroupTriggerPrefix) > 0 && - len(c.Channels.OneBot.GroupTrigger.Prefixes) == 0 { - c.Channels.OneBot.GroupTrigger.Prefixes = c.Channels.OneBot.GroupTriggerPrefix - } -} - func SaveConfig(path string, cfg *Config) error { + // Ensure version is always set when saving + if cfg.Version == 0 { + cfg.Version = CurrentVersion + } + data, err := json.MarshalIndent(cfg, "", " ") if err != nil { return err @@ -841,53 +886,6 @@ func (c *Config) WorkspacePath() string { return expandHome(c.Agents.Defaults.Workspace) } -func (c *Config) GetAPIKey() string { - if c.Providers.OpenRouter.APIKey != "" { - return c.Providers.OpenRouter.APIKey - } - if c.Providers.Anthropic.APIKey != "" { - return c.Providers.Anthropic.APIKey - } - if c.Providers.OpenAI.APIKey != "" { - return c.Providers.OpenAI.APIKey - } - if c.Providers.Gemini.APIKey != "" { - return c.Providers.Gemini.APIKey - } - if c.Providers.Zhipu.APIKey != "" { - return c.Providers.Zhipu.APIKey - } - if c.Providers.Groq.APIKey != "" { - return c.Providers.Groq.APIKey - } - if c.Providers.VLLM.APIKey != "" { - return c.Providers.VLLM.APIKey - } - if c.Providers.ShengSuanYun.APIKey != "" { - return c.Providers.ShengSuanYun.APIKey - } - if c.Providers.Cerebras.APIKey != "" { - return c.Providers.Cerebras.APIKey - } - return "" -} - -func (c *Config) GetAPIBase() string { - if c.Providers.OpenRouter.APIKey != "" { - if c.Providers.OpenRouter.APIBase != "" { - return c.Providers.OpenRouter.APIBase - } - return "https://openrouter.ai/api/v1" - } - if c.Providers.Zhipu.APIKey != "" { - return c.Providers.Zhipu.APIBase - } - if c.Providers.VLLM.APIKey != "" && c.Providers.VLLM.APIBase != "" { - return c.Providers.VLLM.APIBase - } - return "" -} - func expandHome(path string) string { if path == "" { return path @@ -930,11 +928,6 @@ func (c *Config) findMatches(modelName string) []ModelConfig { return matches } -// HasProvidersConfig checks if any provider in the old providers config has configuration. -func (c *Config) HasProvidersConfig() bool { - return !c.Providers.IsEmpty() -} - // ValidateModelList validates all ModelConfig entries in the model_list. // It checks that each model config is valid. // Note: Multiple entries with the same model_name are allowed for load balancing. diff --git a/pkg/config/config_old.go b/pkg/config/config_old.go new file mode 100644 index 000000000..782c3dc44 --- /dev/null +++ b/pkg/config/config_old.go @@ -0,0 +1,108 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package config + +type agentDefaultsV0 struct { + Workspace string `json:"workspace" env:"PICOCLAW_AGENTS_DEFAULTS_WORKSPACE"` + RestrictToWorkspace bool `json:"restrict_to_workspace" env:"PICOCLAW_AGENTS_DEFAULTS_RESTRICT_TO_WORKSPACE"` + AllowReadOutsideWorkspace bool `json:"allow_read_outside_workspace" env:"PICOCLAW_AGENTS_DEFAULTS_ALLOW_READ_OUTSIDE_WORKSPACE"` + Provider string `json:"provider" env:"PICOCLAW_AGENTS_DEFAULTS_PROVIDER"` + ModelName string `json:"model_name,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_MODEL_NAME"` + Model string `json:"model" env:"PICOCLAW_AGENTS_DEFAULTS_MODEL"` // Deprecated: use model_name instead + ModelFallbacks []string `json:"model_fallbacks,omitempty"` + ImageModel string `json:"image_model,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_IMAGE_MODEL"` + ImageModelFallbacks []string `json:"image_model_fallbacks,omitempty"` + MaxTokens int `json:"max_tokens" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_TOKENS"` + Temperature *float64 `json:"temperature,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_TEMPERATURE"` + MaxToolIterations int `json:"max_tool_iterations" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_TOOL_ITERATIONS"` + SummarizeMessageThreshold int `json:"summarize_message_threshold" env:"PICOCLAW_AGENTS_DEFAULTS_SUMMARIZE_MESSAGE_THRESHOLD"` + SummarizeTokenPercent int `json:"summarize_token_percent" env:"PICOCLAW_AGENTS_DEFAULTS_SUMMARIZE_TOKEN_PERCENT"` + MaxMediaSize int `json:"max_media_size,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_MEDIA_SIZE"` + Routing *RoutingConfig `json:"routing,omitempty"` +} + +// GetModelName returns the effective model name for the agent defaults. +// It prefers the new "model_name" field but falls back to "model" for backward compatibility. +func (d *agentDefaultsV0) GetModelName() string { + if d.ModelName != "" { + return d.ModelName + } + return d.Model +} + +type agentsConfigV0 struct { + Defaults agentDefaultsV0 `json:"defaults"` + List []AgentConfig `json:"list,omitempty"` +} + +// configV0 represents the config structure before versioning was introduced. +// This struct is used for loading legacy config files (version 0). +// It is unexported since it's only used internally for migration. +type configV0 struct { + Agents agentsConfigV0 `json:"agents"` + Bindings []AgentBinding `json:"bindings,omitempty"` + Session SessionConfig `json:"session,omitempty"` + Channels ChannelsConfig `json:"channels"` + Providers ProvidersConfig `json:"providers,omitempty"` + ModelList []ModelConfig `json:"model_list"` + Gateway GatewayConfig `json:"gateway"` + Tools ToolsConfig `json:"tools"` + Heartbeat HeartbeatConfig `json:"heartbeat"` + Devices DevicesConfig `json:"devices"` +} + +func (c *configV0) migrateChannelConfigs() { + // Discord: mention_only -> group_trigger.mention_only + if c.Channels.Discord.MentionOnly && !c.Channels.Discord.GroupTrigger.MentionOnly { + c.Channels.Discord.GroupTrigger.MentionOnly = true + } + + // OneBot: group_trigger_prefix -> group_trigger.prefixes + if len(c.Channels.OneBot.GroupTriggerPrefix) > 0 && + len(c.Channels.OneBot.GroupTrigger.Prefixes) == 0 { + c.Channels.OneBot.GroupTrigger.Prefixes = c.Channels.OneBot.GroupTriggerPrefix + } +} + +func (c *configV0) Migrate() (*Config, error) { + // Migrate legacy channel config fields to new unified structures + cfg := DefaultConfig() + + // Always copy user's Agents config to preserve settings like Provider, Model, MaxTokens + cfg.Agents.List = c.Agents.List + cfg.Agents.Defaults.Workspace = c.Agents.Defaults.Workspace + cfg.Agents.Defaults.RestrictToWorkspace = c.Agents.Defaults.RestrictToWorkspace + cfg.Agents.Defaults.AllowReadOutsideWorkspace = c.Agents.Defaults.AllowReadOutsideWorkspace + cfg.Agents.Defaults.Provider = c.Agents.Defaults.Provider + cfg.Agents.Defaults.ModelName = c.Agents.Defaults.GetModelName() + cfg.Agents.Defaults.ModelFallbacks = c.Agents.Defaults.ModelFallbacks + cfg.Agents.Defaults.ImageModel = c.Agents.Defaults.ImageModel + cfg.Agents.Defaults.ImageModelFallbacks = c.Agents.Defaults.ImageModelFallbacks + cfg.Agents.Defaults.MaxTokens = c.Agents.Defaults.MaxTokens + cfg.Agents.Defaults.Temperature = c.Agents.Defaults.Temperature + cfg.Agents.Defaults.MaxToolIterations = c.Agents.Defaults.MaxToolIterations + cfg.Agents.Defaults.SummarizeMessageThreshold = c.Agents.Defaults.SummarizeMessageThreshold + cfg.Agents.Defaults.SummarizeTokenPercent = c.Agents.Defaults.SummarizeTokenPercent + cfg.Agents.Defaults.MaxMediaSize = c.Agents.Defaults.MaxMediaSize + cfg.Agents.Defaults.Routing = c.Agents.Defaults.Routing + + // Copy other top-level fields + cfg.Bindings = c.Bindings + cfg.Session = c.Session + cfg.Channels = c.Channels + cfg.Gateway = c.Gateway + cfg.Tools = c.Tools + cfg.Heartbeat = c.Heartbeat + cfg.Devices = c.Devices + + // Only override ModelList if user provided values + if len(c.ModelList) > 0 { + cfg.ModelList = c.ModelList + } + + cfg.Version = CurrentVersion + return cfg, nil +} diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 8baf3e6fd..8f495d5ec 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -5,7 +5,6 @@ import ( "os" "path/filepath" "runtime" - "strings" "testing" ) @@ -207,15 +206,6 @@ func TestDefaultConfig_WorkspacePath(t *testing.T) { } } -// TestDefaultConfig_Model verifies model is set -func TestDefaultConfig_Model(t *testing.T) { - cfg := DefaultConfig() - - if cfg.Agents.Defaults.Model != "" { - t.Error("Model should be empty") - } -} - // TestDefaultConfig_MaxTokens verifies max tokens has default value func TestDefaultConfig_MaxTokens(t *testing.T) { cfg := DefaultConfig() @@ -255,21 +245,6 @@ func TestDefaultConfig_Gateway(t *testing.T) { } } -// TestDefaultConfig_Providers verifies provider structure -func TestDefaultConfig_Providers(t *testing.T) { - cfg := DefaultConfig() - - if cfg.Providers.Anthropic.APIKey != "" { - t.Error("Anthropic API key should be empty by default") - } - if cfg.Providers.OpenAI.APIKey != "" { - t.Error("OpenAI API key should be empty by default") - } - if cfg.Providers.OpenRouter.APIKey != "" { - t.Error("OpenRouter API key should be empty by default") - } -} - // TestDefaultConfig_Channels verifies channels are disabled by default func TestDefaultConfig_Channels(t *testing.T) { cfg := DefaultConfig() @@ -328,25 +303,6 @@ func TestSaveConfig_FilePermissions(t *testing.T) { } } -func TestSaveConfig_IncludesEmptyLegacyModelField(t *testing.T) { - tmpDir := t.TempDir() - path := filepath.Join(tmpDir, "config.json") - - cfg := DefaultConfig() - if err := SaveConfig(path, cfg); err != nil { - t.Fatalf("SaveConfig failed: %v", err) - } - - data, err := os.ReadFile(path) - if err != nil { - t.Fatalf("ReadFile failed: %v", err) - } - - if !strings.Contains(string(data), `"model": ""`) { - t.Fatalf("saved config should include empty legacy model field, got: %s", string(data)) - } -} - // TestConfig_Complete verifies all config fields are set func TestConfig_Complete(t *testing.T) { cfg := DefaultConfig() @@ -354,9 +310,6 @@ func TestConfig_Complete(t *testing.T) { if cfg.Agents.Defaults.Workspace == "" { t.Error("Workspace should not be empty") } - if cfg.Agents.Defaults.Model != "" { - t.Error("Model should be empty") - } if cfg.Agents.Defaults.Temperature != nil { t.Error("Temperature should be nil when not provided") } @@ -375,19 +328,23 @@ func TestConfig_Complete(t *testing.T) { if !cfg.Heartbeat.Enabled { t.Error("Heartbeat should be enabled by default") } + if !cfg.Tools.Exec.AllowRemote { + t.Error("Exec.AllowRemote should be true by default") + } } -func TestDefaultConfig_OpenAIWebSearchEnabled(t *testing.T) { +func TestDefaultConfig_ExecAllowRemoteEnabled(t *testing.T) { cfg := DefaultConfig() - if !cfg.Providers.OpenAI.WebSearch { - t.Fatal("DefaultConfig().Providers.OpenAI.WebSearch should be true") + if !cfg.Tools.Exec.AllowRemote { + t.Fatal("DefaultConfig().Tools.Exec.AllowRemote should be true") } } -func TestLoadConfig_OpenAIWebSearchDefaultsTrueWhenUnset(t *testing.T) { +func TestLoadConfig_ExecAllowRemoteDefaultsTrueWhenUnset(t *testing.T) { dir := t.TempDir() configPath := filepath.Join(dir, "config.json") - if err := os.WriteFile(configPath, []byte(`{"providers":{"openai":{"api_base":""}}}`), 0o600); err != nil { + if err := os.WriteFile(configPath, []byte(`{"version":1,"tools":{"exec":{"enable_deny_patterns":true}}}`), + 0o600); err != nil { t.Fatalf("WriteFile() error: %v", err) } @@ -395,24 +352,8 @@ func TestLoadConfig_OpenAIWebSearchDefaultsTrueWhenUnset(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error: %v", err) } - if !cfg.Providers.OpenAI.WebSearch { - t.Fatal("OpenAI codex web search should remain true when unset in config file") - } -} - -func TestLoadConfig_OpenAIWebSearchCanBeDisabled(t *testing.T) { - dir := t.TempDir() - configPath := filepath.Join(dir, "config.json") - if err := os.WriteFile(configPath, []byte(`{"providers":{"openai":{"web_search":false}}}`), 0o600); err != nil { - t.Fatalf("WriteFile() error: %v", err) - } - - cfg, err := LoadConfig(configPath) - if err != nil { - t.Fatalf("LoadConfig() error: %v", err) - } - if cfg.Providers.OpenAI.WebSearch { - t.Fatal("OpenAI codex web search should be false when disabled in config file") + if !cfg.Tools.Exec.AllowRemote { + t.Fatal("tools.exec.allow_remote should remain true when unset in config file") } } @@ -482,3 +423,119 @@ func TestDefaultConfig_WorkspacePath_WithPicoclawHome(t *testing.T) { t.Errorf("Workspace path with PICOCLAW_HOME = %q, want %q", cfg.Agents.Defaults.Workspace, want) } } + +// TestFlexibleStringSlice_UnmarshalText tests UnmarshalText with various comma separators +func TestFlexibleStringSlice_UnmarshalText(t *testing.T) { + tests := []struct { + name string + input string + expected []string + }{ + { + name: "English commas only", + input: "123,456,789", + expected: []string{"123", "456", "789"}, + }, + { + name: "Chinese commas only", + input: "123，456，789", + expected: []string{"123", "456", "789"}, + }, + { + name: "Mixed English and Chinese commas", + input: "123,456，789", + expected: []string{"123", "456", "789"}, + }, + { + name: "Single value", + input: "123", + expected: []string{"123"}, + }, + { + name: "Values with whitespace", + input: " 123 , 456 , 789 ", + expected: []string{"123", "456", "789"}, + }, + { + name: "Empty string", + input: "", + expected: nil, + }, + { + name: "Only commas - English", + input: ",,", + expected: []string{}, + }, + { + name: "Only commas - Chinese", + input: "，，", + expected: []string{}, + }, + { + name: "Mixed commas with empty parts", + input: "123,,456，，789", + expected: []string{"123", "456", "789"}, + }, + { + name: "Complex mixed values", + input: "user1@example.com，user2@test.com, admin@domain.org", + expected: []string{"user1@example.com", "user2@test.com", "admin@domain.org"}, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + var f FlexibleStringSlice + err := f.UnmarshalText([]byte(tt.input)) + if err != nil { + t.Fatalf("UnmarshalText(%q) error = %v", tt.input, err) + } + + if tt.expected == nil { + if f != nil { + t.Errorf("UnmarshalText(%q) = %v, want nil", tt.input, f) + } + return + } + + if len(f) != len(tt.expected) { + t.Errorf("UnmarshalText(%q) length = %d, want %d", tt.input, len(f), len(tt.expected)) + return + } + + for i, v := range tt.expected { + if f[i] != v { + t.Errorf("UnmarshalText(%q)[%d] = %q, want %q", tt.input, i, f[i], v) + } + } + }) + } +} + +// TestFlexibleStringSlice_UnmarshalText_EmptySliceConsistency tests nil vs empty slice behavior +func TestFlexibleStringSlice_UnmarshalText_EmptySliceConsistency(t *testing.T) { + t.Run("Empty string returns nil", func(t *testing.T) { + var f FlexibleStringSlice + err := f.UnmarshalText([]byte("")) + if err != nil { + t.Fatalf("UnmarshalText error = %v", err) + } + if f != nil { + t.Errorf("Empty string should return nil, got %v", f) + } + }) + + t.Run("Commas only returns empty slice", func(t *testing.T) { + var f FlexibleStringSlice + err := f.UnmarshalText([]byte(",,,")) + if err != nil { + t.Fatalf("UnmarshalText error = %v", err) + } + if f == nil { + t.Error("Commas only should return empty slice, not nil") + } + if len(f) != 0 { + t.Errorf("Expected empty slice, got %v", f) + } + }) +} diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 5bb3bd1d6..938f74e73 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -8,6 +8,8 @@ package config import ( "os" "path/filepath" + + "github.com/sipeed/picoclaw/pkg" ) // DefaultConfig returns the default configuration for PicoClaw. @@ -15,21 +17,21 @@ func DefaultConfig() *Config { // Determine the base path for the workspace. // Priority: $PICOCLAW_HOME > ~/.picoclaw var homePath string - if picoclawHome := os.Getenv("PICOCLAW_HOME"); picoclawHome != "" { + if picoclawHome := os.Getenv(pkg.PicoClawHome); picoclawHome != "" { homePath = picoclawHome } else { userHome, _ := os.UserHomeDir() - homePath = filepath.Join(userHome, ".picoclaw") + homePath = filepath.Join(userHome, pkg.DefaultPicoClawHome) } - workspacePath := filepath.Join(homePath, "workspace") + workspacePath := filepath.Join(homePath, pkg.WorkspaceName) return &Config{ + Version: CurrentVersion, Agents: AgentsConfig{ Defaults: AgentDefaults{ Workspace: workspacePath, RestrictToWorkspace: true, Provider: "", - Model: "", MaxTokens: 32768, Temperature: nil, // nil means use provider default MaxToolIterations: 50, @@ -176,9 +178,6 @@ func DefaultConfig() *Config { AllowFrom: FlexibleStringSlice{}, }, }, - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{WebSearch: true}, - }, ModelList: []ModelConfig{ // ============================================ // Add your API key to the model you want to use @@ -355,6 +354,14 @@ func DefaultConfig() *Config { APIKey: "", }, + // LongCat - https://longcat.chat/platform + { + ModelName: "LongCat-Flash-Thinking", + Model: "longcat/LongCat-Flash-Thinking", + APIBase: "https://api.longcat.chat/openai", + APIKey: "", + }, + // VLLM (local) - http://localhost:8000 { ModelName: "local-model", @@ -427,6 +434,7 @@ func DefaultConfig() *Config { Enabled: true, }, EnableDenyPatterns: true, + AllowRemote: true, TimeoutSeconds: 60, }, Skills: SkillsToolsConfig{ @@ -510,6 +518,9 @@ func DefaultConfig() *Config { Enabled: false, MonitorUSB: true, }, + Voice: VoiceConfig{ + EchoTranscription: false, + }, BuildInfo: BuildInfo{ Version: Version, GitCommit: GitCommit, diff --git a/pkg/config/migration.go b/pkg/config/migration.go index 51f21e4f4..4ce02d401 100644 --- a/pkg/config/migration.go +++ b/pkg/config/migration.go @@ -6,10 +6,15 @@ package config import ( + "encoding/json" "slices" "strings" ) +type migratable interface { + Migrate() (*Config, error) +} + // buildModelWithProtocol constructs a model string with protocol prefix. // If the model already contains a "/" (indicating it has a protocol prefix), it is returned as-is. // Otherwise, the protocol prefix is added. @@ -21,24 +26,24 @@ func buildModelWithProtocol(protocol, model string) string { return protocol + "/" + model } -// providerMigrationConfig defines how to migrate a provider from old config to new format. -type providerMigrationConfig struct { - // providerNames are the possible names used in agents.defaults.provider - providerNames []string - // protocol is the protocol prefix for the model field - protocol string - // buildConfig creates the ModelConfig from ProviderConfig - buildConfig func(p ProvidersConfig) (ModelConfig, bool) -} - -// ConvertProvidersToModelList converts the old ProvidersConfig to a slice of ModelConfig. +// v0ConvertProvidersToModelList converts the old ProvidersConfig to a slice of ModelConfig. // This enables backward compatibility with existing configurations. // It preserves the user's configured model from agents.defaults.model when possible. -func ConvertProvidersToModelList(cfg *Config) []ModelConfig { +func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { if cfg == nil { return nil } + // providerMigrationConfig defines how to migrate a provider from old config to new format. + type providerMigrationConfig struct { + // providerNames are the possible names used in agents.defaults.provider + providerNames []string + // protocol is the protocol prefix for the model field + protocol string + // buildConfig creates the ModelConfig from ProviderConfig + buildConfig func(p ProvidersConfig) (ModelConfig, bool) + } + // Get user's configured provider and model userProvider := strings.ToLower(cfg.Agents.Defaults.Provider) userModel := cfg.Agents.Defaults.GetModelName() @@ -407,6 +412,23 @@ func ConvertProvidersToModelList(cfg *Config) []ModelConfig { }, true }, }, + { + providerNames: []string{"longcat"}, + protocol: "longcat", + buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + if p.LongCat.APIKey == "" && p.LongCat.APIBase == "" { + return ModelConfig{}, false + } + return ModelConfig{ + ModelName: "longcat", + Model: "longcat/LongCat-Flash-Thinking", + APIKey: p.LongCat.APIKey, + APIBase: p.LongCat.APIBase, + Proxy: p.LongCat.Proxy, + RequestTimeout: p.LongCat.RequestTimeout, + }, true + }, + }, } // Process each provider migration @@ -434,3 +456,44 @@ func ConvertProvidersToModelList(cfg *Config) []ModelConfig { return result } + +// loadConfigV0 loads a legacy config (no version field) +func loadConfigV0(data []byte) (migratable, error) { + var v0 configV0 + if err := json.Unmarshal(data, &v0); err != nil { + return nil, err + } + + v0.migrateChannelConfigs() + + // Auto-migrate: if only legacy providers config exists, convert to model_list + if len(v0.ModelList) == 0 && !v0.Providers.IsEmpty() { + v0.ModelList = v0ConvertProvidersToModelList(&v0) + } + + return &v0, nil +} + +// loadConfigV1 loads a version 1 config (current schema) +func loadConfig(data []byte) (*Config, error) { + cfg := DefaultConfig() + + // Pre-scan the JSON to check how many model_list entries the user provided. + // Go's JSON decoder reuses existing slice backing-array elements rather than + // zero-initializing them, so fields absent from the user's JSON (e.g. api_base) + // would silently inherit values from the DefaultConfig template at the same + // index position. We only reset cfg.ModelList when the user actually provides + // entries; when count is 0 we keep DefaultConfig's built-in list as fallback. + var tmp Config + if err := json.Unmarshal(data, &tmp); err != nil { + return nil, err + } + if len(tmp.ModelList) > 0 { + cfg.ModelList = nil + } + + if err := json.Unmarshal(data, cfg); err != nil { + return nil, err + } + return cfg, nil +} diff --git a/pkg/config/migration_test.go b/pkg/config/migration_test.go index d3019aab0..edf873b35 100644 --- a/pkg/config/migration_test.go +++ b/pkg/config/migration_test.go @@ -11,7 +11,7 @@ import ( ) func TestConvertProvidersToModelList_OpenAI(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ ProviderConfig: ProviderConfig{ @@ -22,7 +22,7 @@ func TestConvertProvidersToModelList_OpenAI(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -40,7 +40,7 @@ func TestConvertProvidersToModelList_OpenAI(t *testing.T) { } func TestConvertProvidersToModelList_Anthropic(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ Anthropic: ProviderConfig{ APIKey: "ant-key", @@ -49,7 +49,7 @@ func TestConvertProvidersToModelList_Anthropic(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -64,7 +64,7 @@ func TestConvertProvidersToModelList_Anthropic(t *testing.T) { } func TestConvertProvidersToModelList_LiteLLM(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ LiteLLM: ProviderConfig{ APIKey: "litellm-key", @@ -73,7 +73,7 @@ func TestConvertProvidersToModelList_LiteLLM(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -91,7 +91,7 @@ func TestConvertProvidersToModelList_LiteLLM(t *testing.T) { } func TestConvertProvidersToModelList_Multiple(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "openai-key"}}, Groq: ProviderConfig{APIKey: "groq-key"}, @@ -99,7 +99,7 @@ func TestConvertProvidersToModelList_Multiple(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 3 { t.Fatalf("len(result) = %d, want 3", len(result)) @@ -119,11 +119,11 @@ func TestConvertProvidersToModelList_Multiple(t *testing.T) { } func TestConvertProvidersToModelList_Empty(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{}, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 0 { t.Errorf("len(result) = %d, want 0", len(result)) @@ -131,7 +131,7 @@ func TestConvertProvidersToModelList_Empty(t *testing.T) { } func TestConvertProvidersToModelList_Nil(t *testing.T) { - result := ConvertProvidersToModelList(nil) + result := v0ConvertProvidersToModelList(nil) if result != nil { t.Errorf("result = %v, want nil", result) @@ -139,7 +139,7 @@ func TestConvertProvidersToModelList_Nil(t *testing.T) { } func TestConvertProvidersToModelList_AllProviders(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "key1"}}, LiteLLM: ProviderConfig{APIKey: "key-litellm", APIBase: "http://localhost:4000/v1"}, @@ -162,19 +162,20 @@ func TestConvertProvidersToModelList_AllProviders(t *testing.T) { Qwen: ProviderConfig{APIKey: "key17"}, Mistral: ProviderConfig{APIKey: "key18"}, Avian: ProviderConfig{APIKey: "key19"}, + LongCat: ProviderConfig{APIKey: "key-longcat"}, }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) - // All 21 providers should be converted - if len(result) != 21 { - t.Errorf("len(result) = %d, want 21", len(result)) + // All 22 providers should be converted + if len(result) != 22 { + t.Errorf("len(result) = %d, want 22", len(result)) } } func TestConvertProvidersToModelList_Proxy(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ ProviderConfig: ProviderConfig{ @@ -185,7 +186,7 @@ func TestConvertProvidersToModelList_Proxy(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -197,7 +198,7 @@ func TestConvertProvidersToModelList_Proxy(t *testing.T) { } func TestConvertProvidersToModelList_RequestTimeout(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ Ollama: ProviderConfig{ APIKey: "ollama-key", @@ -206,7 +207,7 @@ func TestConvertProvidersToModelList_RequestTimeout(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -218,7 +219,7 @@ func TestConvertProvidersToModelList_RequestTimeout(t *testing.T) { } func TestConvertProvidersToModelList_AuthMethod(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ ProviderConfig: ProviderConfig{ @@ -228,7 +229,7 @@ func TestConvertProvidersToModelList_AuthMethod(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 0 { t.Errorf("len(result) = %d, want 0 (AuthMethod alone should not create entry)", len(result)) @@ -238,9 +239,9 @@ func TestConvertProvidersToModelList_AuthMethod(t *testing.T) { // Tests for preserving user's configured model during migration func TestConvertProvidersToModelList_PreservesUserModel_DeepSeek(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "deepseek", Model: "deepseek-reasoner", }, @@ -250,7 +251,7 @@ func TestConvertProvidersToModelList_PreservesUserModel_DeepSeek(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -263,9 +264,9 @@ func TestConvertProvidersToModelList_PreservesUserModel_DeepSeek(t *testing.T) { } func TestConvertProvidersToModelList_PreservesUserModel_OpenAI(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "openai", Model: "gpt-4-turbo", }, @@ -275,7 +276,7 @@ func TestConvertProvidersToModelList_PreservesUserModel_OpenAI(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -287,9 +288,9 @@ func TestConvertProvidersToModelList_PreservesUserModel_OpenAI(t *testing.T) { } func TestConvertProvidersToModelList_PreservesUserModel_Anthropic(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "claude", // alternative name Model: "claude-opus-4-20250514", }, @@ -299,7 +300,7 @@ func TestConvertProvidersToModelList_PreservesUserModel_Anthropic(t *testing.T) }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -311,9 +312,9 @@ func TestConvertProvidersToModelList_PreservesUserModel_Anthropic(t *testing.T) } func TestConvertProvidersToModelList_PreservesUserModel_Qwen(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "qwen", Model: "qwen-plus", }, @@ -323,7 +324,7 @@ func TestConvertProvidersToModelList_PreservesUserModel_Qwen(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -335,9 +336,9 @@ func TestConvertProvidersToModelList_PreservesUserModel_Qwen(t *testing.T) { } func TestConvertProvidersToModelList_UsesDefaultWhenNoUserModel(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "deepseek", Model: "", // no model specified }, @@ -347,7 +348,7 @@ func TestConvertProvidersToModelList_UsesDefaultWhenNoUserModel(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -360,9 +361,9 @@ func TestConvertProvidersToModelList_UsesDefaultWhenNoUserModel(t *testing.T) { } func TestConvertProvidersToModelList_MultipleProviders_PreservesUserModel(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "deepseek", Model: "deepseek-reasoner", }, @@ -373,7 +374,7 @@ func TestConvertProvidersToModelList_MultipleProviders_PreservesUserModel(t *tes }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 2 { t.Fatalf("len(result) = %d, want 2", len(result)) @@ -409,9 +410,9 @@ func TestConvertProvidersToModelList_ProviderNameAliases(t *testing.T) { for _, tt := range tests { t.Run(tt.providerAlias, func(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: tt.providerAlias, Model: strings.TrimPrefix( tt.expectedModel, @@ -442,7 +443,7 @@ func TestConvertProvidersToModelList_ProviderNameAliases(t *testing.T) { tt.expectedModel[:strings.Index(tt.expectedModel, "/")+1], ) - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) } @@ -464,9 +465,9 @@ func TestConvertProvidersToModelList_NoProviderField_SingleProvider(t *testing.T // - No provider field set // - model = "glm-4.7" // - Only zhipu has API key configured - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "", // Not set Model: "glm-4.7", }, @@ -476,7 +477,7 @@ func TestConvertProvidersToModelList_NoProviderField_SingleProvider(t *testing.T }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -497,9 +498,9 @@ func TestConvertProvidersToModelList_NoProviderField_MultipleProviders(t *testin // When multiple providers are configured but no provider field is set, // the FIRST provider (in migration order) will use userModel as ModelName // for backward compatibility with legacy implicit provider selection - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "", // Not set Model: "some-model", }, @@ -510,7 +511,7 @@ func TestConvertProvidersToModelList_NoProviderField_MultipleProviders(t *testin }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 2 { t.Fatalf("len(result) = %d, want 2", len(result)) @@ -530,9 +531,9 @@ func TestConvertProvidersToModelList_NoProviderField_MultipleProviders(t *testin func TestConvertProvidersToModelList_NoProviderField_NoModel(t *testing.T) { // Edge case: no provider, no model - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "", Model: "", }, @@ -542,7 +543,7 @@ func TestConvertProvidersToModelList_NoProviderField_NoModel(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -583,9 +584,9 @@ func TestBuildModelWithProtocol_DifferentPrefix(t *testing.T) { // Test for legacy config with protocol prefix in model name func TestConvertProvidersToModelList_LegacyModelWithProtocolPrefix(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "", // No explicit provider Model: "openrouter/auto", // Model already has protocol prefix }, @@ -595,7 +596,7 @@ func TestConvertProvidersToModelList_LegacyModelWithProtocolPrefix(t *testing.T) }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) < 1 { t.Fatalf("len(result) = %d, want at least 1", len(result)) diff --git a/pkg/config/model_config_test.go b/pkg/config/model_config_test.go index da6e506f8..db0344311 100644 --- a/pkg/config/model_config_test.go +++ b/pkg/config/model_config_test.go @@ -113,39 +113,7 @@ func TestGetModelConfig_Concurrent(t *testing.T) { } } -func TestAgentDefaults_GetModelName_BackwardCompat(t *testing.T) { - tests := []struct { - name string - defaults AgentDefaults - wantName string - }{ - { - name: "new model_name field only", - defaults: AgentDefaults{ModelName: "new-model"}, - wantName: "new-model", - }, - { - name: "old model field only", - defaults: AgentDefaults{Model: "legacy-model"}, - wantName: "legacy-model", - }, - { - name: "both fields - model_name takes precedence", - defaults: AgentDefaults{ModelName: "new-model", Model: "old-model"}, - wantName: "new-model", - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - if got := tt.defaults.GetModelName(); got != tt.wantName { - t.Errorf("GetModelName() = %q, want %q", got, tt.wantName) - } - }) - } -} - -func TestAgentDefaults_JSON_BackwardCompat(t *testing.T) { +func TestAgentDefaultsV0_JSON_BackwardCompat(t *testing.T) { tests := []struct { name string json string @@ -170,7 +138,7 @@ func TestAgentDefaults_JSON_BackwardCompat(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - var defaults AgentDefaults + var defaults agentDefaultsV0 if err := json.Unmarshal([]byte(tt.json), &defaults); err != nil { t.Fatalf("Unmarshal error: %v", err) } @@ -181,69 +149,6 @@ func TestAgentDefaults_JSON_BackwardCompat(t *testing.T) { } } -func TestFullConfig_JSON_BackwardCompat(t *testing.T) { - // Test complete config with both old and new formats - oldFormat := `{ - "agents": { - "defaults": { - "workspace": "~/.picoclaw/workspace", - "model": "gpt4", - "max_tokens": 4096 - } - }, - "model_list": [ - { - "model_name": "gpt4", - "model": "openai/gpt-4o", - "api_key": "test-key" - } - ] - }` - - newFormat := `{ - "agents": { - "defaults": { - "workspace": "~/.picoclaw/workspace", - "model_name": "gpt4", - "max_tokens": 4096 - } - }, - "model_list": [ - { - "model_name": "gpt4", - "model": "openai/gpt-4o", - "api_key": "test-key" - } - ] - }` - - for name, jsonStr := range map[string]string{ - "old format (model)": oldFormat, - "new format (model_name)": newFormat, - } { - t.Run(name, func(t *testing.T) { - cfg := &Config{} - if err := json.Unmarshal([]byte(jsonStr), cfg); err != nil { - t.Fatalf("Unmarshal error: %v", err) - } - - // Check that GetModelName returns correct value - if got := cfg.Agents.Defaults.GetModelName(); got != "gpt4" { - t.Errorf("GetModelName() = %q, want %q", got, "gpt4") - } - - // Check that GetModelConfig works - modelCfg, err := cfg.GetModelConfig("gpt4") - if err != nil { - t.Fatalf("GetModelConfig error: %v", err) - } - if modelCfg.Model != "openai/gpt-4o" { - t.Errorf("Model = %q, want %q", modelCfg.Model, "openai/gpt-4o") - } - }) - } -} - func TestModelConfig_Validate(t *testing.T) { tests := []struct { name string diff --git a/pkg/env.go b/pkg/env.go new file mode 100644 index 000000000..47f219434 --- /dev/null +++ b/pkg/env.go @@ -0,0 +1,13 @@ +// all environment variables including default values put here + +package pkg + +const ( + Logo = "🦞" + // AppName is the name of the app + AppName = "PicoClaw" + + PicoClawHome = "PICOCLAW_HOME" + DefaultPicoClawHome = ".picoclaw" + WorkspaceName = "workspace" +) diff --git a/pkg/logger/logger.go b/pkg/logger/logger.go index 56dc87a53..80adcf86c 100644 --- a/pkg/logger/logger.go +++ b/pkg/logger/logger.go @@ -1,24 +1,24 @@ package logger import ( - "encoding/json" "fmt" - "log" "os" + "path/filepath" "runtime" "strings" "sync" - "time" + + "github.com/rs/zerolog" ) -type LogLevel int +type LogLevel = zerolog.Level const ( - DEBUG LogLevel = iota - INFO - WARN - ERROR - FATAL + DEBUG = zerolog.DebugLevel + INFO = zerolog.InfoLevel + WARN = zerolog.WarnLevel + ERROR = zerolog.ErrorLevel + FATAL = zerolog.FatalLevel ) var ( @@ -31,27 +31,24 @@ var ( } currentLevel = INFO - logger *Logger + logger zerolog.Logger + fileLogger zerolog.Logger + logFile *os.File once sync.Once mu sync.RWMutex ) -type Logger struct { - file *os.File -} - -type LogEntry struct { - Level string `json:"level"` - Timestamp string `json:"timestamp"` - Component string `json:"component,omitempty"` - Message string `json:"message"` - Fields map[string]any `json:"fields,omitempty"` - Caller string `json:"caller,omitempty"` -} - func init() { once.Do(func() { - logger = &Logger{} + zerolog.SetGlobalLevel(zerolog.InfoLevel) + + consoleWriter := zerolog.ConsoleWriter{ + Out: os.Stdout, + TimeFormat: "15:04:05", // TODO: make it configurable??? + } + + logger = zerolog.New(consoleWriter).With().Timestamp().Logger() + fileLogger = zerolog.Logger{} }) } @@ -59,6 +56,7 @@ func SetLevel(level LogLevel) { mu.Lock() defer mu.Unlock() currentLevel = level + zerolog.SetGlobalLevel(level) } func GetLevel() LogLevel { @@ -71,17 +69,22 @@ func EnableFileLogging(filePath string) error { mu.Lock() defer mu.Unlock() - file, err := os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644) + if err := os.MkdirAll(filepath.Dir(filePath), 0o755); err != nil { + return fmt.Errorf("failed to create log directory: %w", err) + } + + newFile, err := os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644) if err != nil { return fmt.Errorf("failed to open log file: %w", err) } - if logger.file != nil { - logger.file.Close() + // Close old file if exists + if logFile != nil { + logFile.Close() } - logger.file = file - log.Println("File logging enabled:", filePath) + logFile = newFile + fileLogger = zerolog.New(logFile).With().Timestamp().Caller().Logger() return nil } @@ -89,10 +92,57 @@ func DisableFileLogging() { mu.Lock() defer mu.Unlock() - if logger.file != nil { - logger.file.Close() - logger.file = nil - log.Println("File logging disabled") + if logFile != nil { + logFile.Close() + logFile = nil + } + fileLogger = zerolog.Logger{} +} + +func getCallerInfo() (string, int, string) { + for i := 2; i < 15; i++ { + pc, file, line, ok := runtime.Caller(i) + if !ok { + continue + } + + fn := runtime.FuncForPC(pc) + if fn == nil { + continue + } + + // bypass common loggers + if strings.HasSuffix(file, "/logger.go") || + strings.HasSuffix(file, "/log.go") { + continue + } + + funcName := fn.Name() + if strings.HasPrefix(funcName, "runtime.") { + continue + } + + return filepath.Base(file), line, filepath.Base(funcName) + } + + return "???", 0, "???" +} + +//nolint:zerologlint +func getEvent(logger zerolog.Logger, level LogLevel) *zerolog.Event { + switch level { + case zerolog.DebugLevel: + return logger.Debug() + case zerolog.InfoLevel: + return logger.Info() + case zerolog.WarnLevel: + return logger.Warn() + case zerolog.ErrorLevel: + return logger.Error() + case zerolog.FatalLevel: + return logger.Fatal() + default: + return logger.Info() } } @@ -101,65 +151,41 @@ func logMessage(level LogLevel, component string, message string, fields map[str return } - entry := LogEntry{ - Level: logLevelNames[level], - Timestamp: time.Now().UTC().Format(time.RFC3339), - Component: component, - Message: message, - Fields: fields, - } + callerFile, callerLine, callerFunc := getCallerInfo() - if pc, file, line, ok := runtime.Caller(2); ok { - fn := runtime.FuncForPC(pc) - if fn != nil { - entry.Caller = fmt.Sprintf("%s:%d (%s)", file, line, fn.Name()) - } - } + event := getEvent(logger, level) - if logger.file != nil { - jsonData, err := json.Marshal(entry) - if err == nil { - logger.file.Write(append(jsonData, '\n')) - } - } - - var fieldStr string - if len(fields) > 0 { - fieldStr = " " + formatFields(fields) + // Build combined field with component and caller + if component != "" { + event.Str("caller", fmt.Sprintf("%-6s %s:%d (%s)", component, callerFile, callerLine, callerFunc)) } else { - fieldStr = "" + event.Str("caller", fmt.Sprintf(" %s:%d (%s)", callerFile, callerLine, callerFunc)) } - logLine := fmt.Sprintf("[%s] [%s]%s %s%s", - entry.Timestamp, - logLevelNames[level], - formatComponent(component), - message, - fieldStr, - ) + for k, v := range fields { + event.Interface(k, v) + } - log.Println(logLine) + event.Msg(message) + + // Also log to file if enabled + if fileLogger.GetLevel() != zerolog.NoLevel { + fileEvent := getEvent(fileLogger, level) + + if component != "" { + fileEvent.Str("component", component) + } + for k, v := range fields { + fileEvent.Interface(k, v) + } + fileEvent.Msg(message) + } if level == FATAL { os.Exit(1) } } -func formatComponent(component string) string { - if component == "" { - return "" - } - return fmt.Sprintf(" %s:", component) -} - -func formatFields(fields map[string]any) string { - parts := make([]string, 0, len(fields)) - for k, v := range fields { - parts = append(parts, fmt.Sprintf("%s=%v", k, v)) - } - return fmt.Sprintf("{%s}", strings.Join(parts, ", ")) -} - func Debug(message string) { logMessage(DEBUG, "", message, nil) } @@ -232,6 +258,10 @@ func FatalC(component string, message string) { logMessage(FATAL, component, message, nil) } +func Fatalf(message string, ss ...any) { + logMessage(FATAL, "", fmt.Sprintf(message, ss...), nil) +} + func FatalF(message string, fields map[string]any) { logMessage(FATAL, "", message, fields) } diff --git a/pkg/logger/logger_3rd_party.go b/pkg/logger/logger_3rd_party.go new file mode 100644 index 000000000..da50d686a --- /dev/null +++ b/pkg/logger/logger_3rd_party.go @@ -0,0 +1,95 @@ +// this file is for compatible with 3rd party loggers, should not be called in PicoClaw project + +package logger + +import "fmt" + +// Logger implements common Logger interface +type Logger struct { + component string + levels map[int]LogLevel +} + +// Debug logs debug messages +func (b *Logger) Debug(v ...any) { + logMessage(DEBUG, b.component, fmt.Sprint(v...), nil) +} + +// Info logs info messages +func (b *Logger) Info(v ...any) { + logMessage(INFO, b.component, fmt.Sprint(v...), nil) +} + +// Warn logs warning messages +func (b *Logger) Warn(v ...any) { + logMessage(WARN, b.component, fmt.Sprint(v...), nil) +} + +// Error logs error messages +func (b *Logger) Error(v ...any) { + logMessage(ERROR, b.component, fmt.Sprint(v...), nil) +} + +// Debugf logs formatted debug messages +func (b *Logger) Debugf(format string, v ...any) { + logMessage(DEBUG, b.component, fmt.Sprintf(format, v...), nil) +} + +// Infof logs formatted info messages +func (b *Logger) Infof(format string, v ...any) { + logMessage(INFO, b.component, fmt.Sprintf(format, v...), nil) +} + +// Warnf logs formatted warning messages +func (b *Logger) Warnf(format string, v ...any) { + logMessage(WARN, b.component, fmt.Sprintf(format, v...), nil) +} + +// Warningf logs formatted warning messages +func (b *Logger) Warningf(format string, v ...any) { + logMessage(WARN, b.component, fmt.Sprintf(format, v...), nil) +} + +// Errorf logs formatted error messages +func (b *Logger) Errorf(format string, v ...any) { + logMessage(ERROR, b.component, fmt.Sprintf(format, v...), nil) +} + +// Fatalf logs formatted fatal messages and exits +func (b *Logger) Fatalf(format string, v ...any) { + logMessage(FATAL, b.component, fmt.Sprintf(format, v...), nil) +} + +// Log logs a message at a given level with caller information +// the func name must be this because 3rd party loggers expect this +// msgL: message level (DEBUG, INFO, WARN, ERROR, FATAL) +// caller: unused parameter reserved for compatibility +// format: format string +// a: format arguments +// +//nolint:goprintffuncname +func (b *Logger) Log(msgL, caller int, format string, a ...any) { + level := LogLevel(msgL) + if b.levels != nil { + if lvl, ok := b.levels[msgL]; ok { + level = lvl + } + } + logMessage(level, b.component, fmt.Sprintf(format, a...), nil) +} + +// Sync flushes log buffer (no-op for this implementation) +func (b *Logger) Sync() error { + return nil +} + +// WithLevels sets log levels mapping for this logger +func (b *Logger) WithLevels(levels map[int]LogLevel) *Logger { + b.levels = levels + return b +} + +// NewLogger creates a new logger instance with optional component name +func NewLogger(component string) *Logger { + return &Logger{component: component} +} diff --git a/pkg/memory/migration.go b/pkg/memory/migration.go index c9d5176ab..b64c62a9f 100644 --- a/pkg/memory/migration.go +++ b/pkg/memory/migration.go @@ -48,6 +48,12 @@ func MigrateFromJSON( if !strings.HasSuffix(name, ".json") { continue } + // Skip JSONL metadata files. They are part of the new storage format, + // not legacy session snapshots, and re-importing them would overwrite + // the paired .jsonl history with an empty message list. + if strings.HasSuffix(name, ".meta.json") { + continue + } // Skip already-migrated files. if strings.HasSuffix(name, ".migrated") { continue diff --git a/pkg/memory/migration_test.go b/pkg/memory/migration_test.go index 3170758b7..4466c96f9 100644 --- a/pkg/memory/migration_test.go +++ b/pkg/memory/migration_test.go @@ -382,3 +382,55 @@ func TestMigrateFromJSON_NonexistentDir(t *testing.T) { t.Errorf("expected 0, got %d", count) } } + +func TestMigrateFromJSON_SkipsMetaJSONFiles(t *testing.T) { + sessionsDir := t.TempDir() + store, err := NewJSONLStore(sessionsDir) + if err != nil { + t.Fatalf("NewJSONLStore: %v", err) + } + ctx := context.Background() + + if addErr := store.AddMessage(ctx, "agent:main:pico:direct:pico:test", "user", "keep me"); addErr != nil { + t.Fatalf("AddMessage: %v", addErr) + } + if summaryErr := store.SetSummary(ctx, "agent:main:pico:direct:pico:test", "keep summary"); summaryErr != nil { + t.Fatalf("SetSummary: %v", summaryErr) + } + + metaPath := filepath.Join(sessionsDir, "agent_main_pico_direct_pico_test.meta.json") + if _, statErr := os.Stat(metaPath); statErr != nil { + t.Fatalf("meta file missing before migration: %v", statErr) + } + + count, err := MigrateFromJSON(ctx, sessionsDir, store) + if err != nil { + t.Fatalf("MigrateFromJSON: %v", err) + } + if count != 0 { + t.Fatalf("expected 0 migrated, got %d", count) + } + + history, err := store.GetHistory(ctx, "agent:main:pico:direct:pico:test") + if err != nil { + t.Fatalf("GetHistory: %v", err) + } + if len(history) != 1 || history[0].Content != "keep me" { + t.Fatalf("history = %+v, want preserved single message", history) + } + + summary, err := store.GetSummary(ctx, "agent:main:pico:direct:pico:test") + if err != nil { + t.Fatalf("GetSummary: %v", err) + } + if summary != "keep summary" { + t.Fatalf("summary = %q, want %q", summary, "keep summary") + } + + if _, statErr := os.Stat(metaPath); statErr != nil { + t.Fatalf("meta file should remain in place: %v", statErr) + } + if _, statErr := os.Stat(metaPath + ".migrated"); !os.IsNotExist(statErr) { + t.Fatalf("meta file should not be renamed, stat err = %v", statErr) + } +} diff --git a/pkg/migrate/internal/common.go b/pkg/migrate/internal/common.go index c77ab9f26..32c6ac83b 100644 --- a/pkg/migrate/internal/common.go +++ b/pkg/migrate/internal/common.go @@ -5,20 +5,22 @@ import ( "io" "os" "path/filepath" + + "github.com/sipeed/picoclaw/pkg" ) func ResolveTargetHome(override string) (string, error) { if override != "" { return ExpandHome(override), nil } - if envHome := os.Getenv("PICOCLAW_HOME"); envHome != "" { + if envHome := os.Getenv(pkg.PicoClawHome); envHome != "" { return ExpandHome(envHome), nil } home, err := os.UserHomeDir() if err != nil { return "", fmt.Errorf("resolving home directory: %w", err) } - return filepath.Join(home, ".picoclaw"), nil + return filepath.Join(home, pkg.DefaultPicoClawHome), nil } func ExpandHome(path string) string { diff --git a/pkg/migrate/sources/openclaw/common.go b/pkg/migrate/sources/openclaw/common.go index d57dbe34f..337c950d0 100644 --- a/pkg/migrate/sources/openclaw/common.go +++ b/pkg/migrate/sources/openclaw/common.go @@ -4,7 +4,6 @@ var migrateableFiles = []string{ "AGENTS.md", "SOUL.md", "USER.md", - "TOOLS.md", "HEARTBEAT.md", } diff --git a/pkg/migrate/sources/openclaw/openclaw_config.go b/pkg/migrate/sources/openclaw/openclaw_config.go index e272d17a9..e95c2f3ec 100644 --- a/pkg/migrate/sources/openclaw/openclaw_config.go +++ b/pkg/migrate/sources/openclaw/openclaw_config.go @@ -1111,6 +1111,7 @@ func (c ToolsConfig) ToStandardTools() config.ToolsConfig { Exec: config.ExecConfig{ EnableDenyPatterns: c.Exec.EnableDenyPatterns, CustomDenyPatterns: c.Exec.CustomDenyPatterns, + AllowRemote: config.DefaultConfig().Tools.Exec.AllowRemote, }, } } diff --git a/pkg/migrate/sources/openclaw/openclaw_config_test.go b/pkg/migrate/sources/openclaw/openclaw_config_test.go index 3a7d0c686..802693825 100644 --- a/pkg/migrate/sources/openclaw/openclaw_config_test.go +++ b/pkg/migrate/sources/openclaw/openclaw_config_test.go @@ -290,6 +290,20 @@ func TestConvertToPicoClaw(t *testing.T) { } } +func TestToStandardConfig_ExecAllowRemoteDefaultsTrue(t *testing.T) { + cfg := (&PicoClawConfig{ + Tools: ToolsConfig{ + Exec: ExecConfig{ + EnableDenyPatterns: true, + }, + }, + }).ToStandardConfig() + + if !cfg.Tools.Exec.AllowRemote { + t.Fatal("ToStandardConfig() should preserve the default tools.exec.allow_remote=true") + } +} + func TestConvertToPicoClawWithQQAndDingTalk(t *testing.T) { tmpDir := t.TempDir() configPath := filepath.Join(tmpDir, "openclaw.json") diff --git a/pkg/providers/claude_cli_provider_test.go b/pkg/providers/claude_cli_provider_test.go index d4d648f5a..228cad9c9 100644 --- a/pkg/providers/claude_cli_provider_test.go +++ b/pkg/providers/claude_cli_provider_test.go @@ -416,7 +416,7 @@ func TestCreateProvider_ClaudeCli(t *testing.T) { cfg.ModelList = []config.ModelConfig{ {ModelName: "claude-sonnet-4.6", Model: "claude-cli/claude-sonnet-4.6", Workspace: "/test/ws"}, } - cfg.Agents.Defaults.Model = "claude-sonnet-4.6" + cfg.Agents.Defaults.ModelName = "claude-sonnet-4.6" provider, _, err := CreateProvider(cfg) if err != nil { @@ -437,7 +437,7 @@ func TestCreateProvider_ClaudeCode(t *testing.T) { cfg.ModelList = []config.ModelConfig{ {ModelName: "claude-code", Model: "claude-cli/claude-code"}, } - cfg.Agents.Defaults.Model = "claude-code" + cfg.Agents.Defaults.ModelName = "claude-code" provider, _, err := CreateProvider(cfg) if err != nil { @@ -453,7 +453,7 @@ func TestCreateProvider_ClaudeCodec(t *testing.T) { cfg.ModelList = []config.ModelConfig{ {ModelName: "claudecode", Model: "claude-cli/claudecode"}, } - cfg.Agents.Defaults.Model = "claudecode" + cfg.Agents.Defaults.ModelName = "claudecode" provider, _, err := CreateProvider(cfg) if err != nil { @@ -469,7 +469,7 @@ func TestCreateProvider_ClaudeCliDefaultWorkspace(t *testing.T) { cfg.ModelList = []config.ModelConfig{ {ModelName: "claude-cli", Model: "claude-cli/claude-sonnet"}, } - cfg.Agents.Defaults.Model = "claude-cli" + cfg.Agents.Defaults.ModelName = "claude-cli" cfg.Agents.Defaults.Workspace = "" provider, _, err := CreateProvider(cfg) diff --git a/pkg/providers/factory.go b/pkg/providers/factory.go index ee9c11899..354acafcb 100644 --- a/pkg/providers/factory.go +++ b/pkg/providers/factory.go @@ -1,384 +1,7 @@ package providers import ( - "fmt" - "strings" - "github.com/sipeed/picoclaw/pkg/auth" - "github.com/sipeed/picoclaw/pkg/config" ) -const defaultAnthropicAPIBase = "https://api.anthropic.com/v1" - var getCredential = auth.GetCredential - -type providerType int - -const ( - providerTypeHTTPCompat providerType = iota - providerTypeClaudeAuth - providerTypeCodexAuth - providerTypeCodexCLIToken - providerTypeClaudeCLI - providerTypeCodexCLI - providerTypeGitHubCopilot -) - -type providerSelection struct { - providerType providerType - apiKey string - apiBase string - proxy string - model string - workspace string - connectMode string - enableWebSearch bool -} - -func resolveProviderSelection(cfg *config.Config) (providerSelection, error) { - model := cfg.Agents.Defaults.GetModelName() - providerName := strings.ToLower(cfg.Agents.Defaults.Provider) - lowerModel := strings.ToLower(model) - - if providerName == "" && model == "" { - return providerSelection{}, fmt.Errorf("no model configured: agents.defaults.model is empty") - } - - sel := providerSelection{ - providerType: providerTypeHTTPCompat, - model: model, - } - - // First, prefer explicit provider configuration. - if providerName != "" { - switch providerName { - case "groq": - if cfg.Providers.Groq.APIKey != "" { - sel.apiKey = cfg.Providers.Groq.APIKey - sel.apiBase = cfg.Providers.Groq.APIBase - sel.proxy = cfg.Providers.Groq.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.groq.com/openai/v1" - } - } - case "openai", "gpt": - if cfg.Providers.OpenAI.APIKey != "" || cfg.Providers.OpenAI.AuthMethod != "" { - sel.enableWebSearch = cfg.Providers.OpenAI.WebSearch - if cfg.Providers.OpenAI.AuthMethod == "codex-cli" { - sel.providerType = providerTypeCodexCLIToken - return sel, nil - } - if cfg.Providers.OpenAI.AuthMethod == "oauth" || cfg.Providers.OpenAI.AuthMethod == "token" { - sel.providerType = providerTypeCodexAuth - return sel, nil - } - sel.apiKey = cfg.Providers.OpenAI.APIKey - sel.apiBase = cfg.Providers.OpenAI.APIBase - sel.proxy = cfg.Providers.OpenAI.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.openai.com/v1" - } - } - case "anthropic", "claude": - if cfg.Providers.Anthropic.APIKey != "" || cfg.Providers.Anthropic.AuthMethod != "" { - if cfg.Providers.Anthropic.AuthMethod == "oauth" || cfg.Providers.Anthropic.AuthMethod == "token" { - sel.apiBase = cfg.Providers.Anthropic.APIBase - if sel.apiBase == "" { - sel.apiBase = defaultAnthropicAPIBase - } - sel.providerType = providerTypeClaudeAuth - return sel, nil - } - sel.apiKey = cfg.Providers.Anthropic.APIKey - sel.apiBase = cfg.Providers.Anthropic.APIBase - sel.proxy = cfg.Providers.Anthropic.Proxy - if sel.apiBase == "" { - sel.apiBase = defaultAnthropicAPIBase - } - } - case "openrouter": - if cfg.Providers.OpenRouter.APIKey != "" { - sel.apiKey = cfg.Providers.OpenRouter.APIKey - sel.proxy = cfg.Providers.OpenRouter.Proxy - if cfg.Providers.OpenRouter.APIBase != "" { - sel.apiBase = cfg.Providers.OpenRouter.APIBase - } else { - sel.apiBase = "https://openrouter.ai/api/v1" - } - } - case "litellm": - if cfg.Providers.LiteLLM.APIKey != "" || cfg.Providers.LiteLLM.APIBase != "" { - sel.apiKey = cfg.Providers.LiteLLM.APIKey - sel.apiBase = cfg.Providers.LiteLLM.APIBase - sel.proxy = cfg.Providers.LiteLLM.Proxy - if sel.apiBase == "" { - sel.apiBase = "http://localhost:4000/v1" - } - } - case "zhipu", "glm": - if cfg.Providers.Zhipu.APIKey != "" { - sel.apiKey = cfg.Providers.Zhipu.APIKey - sel.apiBase = cfg.Providers.Zhipu.APIBase - sel.proxy = cfg.Providers.Zhipu.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://open.bigmodel.cn/api/paas/v4" - } - } - case "gemini", "google": - if cfg.Providers.Gemini.APIKey != "" { - sel.apiKey = cfg.Providers.Gemini.APIKey - sel.apiBase = cfg.Providers.Gemini.APIBase - sel.proxy = cfg.Providers.Gemini.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://generativelanguage.googleapis.com/v1beta" - } - } - case "vllm": - if cfg.Providers.VLLM.APIBase != "" { - sel.apiKey = cfg.Providers.VLLM.APIKey - sel.apiBase = cfg.Providers.VLLM.APIBase - sel.proxy = cfg.Providers.VLLM.Proxy - } - case "shengsuanyun": - if cfg.Providers.ShengSuanYun.APIKey != "" { - sel.apiKey = cfg.Providers.ShengSuanYun.APIKey - sel.apiBase = cfg.Providers.ShengSuanYun.APIBase - sel.proxy = cfg.Providers.ShengSuanYun.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://router.shengsuanyun.com/api/v1" - } - } - case "nvidia": - if cfg.Providers.Nvidia.APIKey != "" { - sel.apiKey = cfg.Providers.Nvidia.APIKey - sel.apiBase = cfg.Providers.Nvidia.APIBase - sel.proxy = cfg.Providers.Nvidia.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://integrate.api.nvidia.com/v1" - } - } - case "vivgrid": - if cfg.Providers.Vivgrid.APIKey != "" { - sel.apiKey = cfg.Providers.Vivgrid.APIKey - sel.apiBase = cfg.Providers.Vivgrid.APIBase - sel.proxy = cfg.Providers.Vivgrid.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.vivgrid.com/v1" - } - } - case "claude-cli", "claude-code", "claudecode": - workspace := cfg.WorkspacePath() - if workspace == "" { - workspace = "." - } - sel.providerType = providerTypeClaudeCLI - sel.workspace = workspace - return sel, nil - case "codex-cli", "codex-code": - workspace := cfg.WorkspacePath() - if workspace == "" { - workspace = "." - } - sel.providerType = providerTypeCodexCLI - sel.workspace = workspace - return sel, nil - case "deepseek": - if cfg.Providers.DeepSeek.APIKey != "" { - sel.apiKey = cfg.Providers.DeepSeek.APIKey - sel.apiBase = cfg.Providers.DeepSeek.APIBase - sel.proxy = cfg.Providers.DeepSeek.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.deepseek.com/v1" - } - if model != "deepseek-chat" && model != "deepseek-reasoner" { - sel.model = "deepseek-chat" - } - } - case "avian": - if cfg.Providers.Avian.APIKey != "" { - sel.apiKey = cfg.Providers.Avian.APIKey - sel.apiBase = cfg.Providers.Avian.APIBase - sel.proxy = cfg.Providers.Avian.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.avian.io/v1" - } - } - case "mistral": - if cfg.Providers.Mistral.APIKey != "" { - sel.apiKey = cfg.Providers.Mistral.APIKey - sel.apiBase = cfg.Providers.Mistral.APIBase - sel.proxy = cfg.Providers.Mistral.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.mistral.ai/v1" - } - } - case "minimax": - if cfg.Providers.Minimax.APIKey != "" { - sel.apiKey = cfg.Providers.Minimax.APIKey - sel.apiBase = cfg.Providers.Minimax.APIBase - sel.proxy = cfg.Providers.Minimax.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.minimaxi.com/v1" - } - } - case "github_copilot", "copilot": - sel.providerType = providerTypeGitHubCopilot - if cfg.Providers.GitHubCopilot.APIBase != "" { - sel.apiBase = cfg.Providers.GitHubCopilot.APIBase - } else { - sel.apiBase = "localhost:4321" - } - sel.connectMode = cfg.Providers.GitHubCopilot.ConnectMode - return sel, nil - } - } - - // Fallback: infer provider from model and configured keys. - if sel.apiKey == "" && sel.apiBase == "" { - switch { - case (strings.Contains(lowerModel, "kimi") || strings.Contains(lowerModel, "moonshot") || strings.HasPrefix(model, "moonshot/")) && cfg.Providers.Moonshot.APIKey != "": - sel.apiKey = cfg.Providers.Moonshot.APIKey - sel.apiBase = cfg.Providers.Moonshot.APIBase - sel.proxy = cfg.Providers.Moonshot.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.moonshot.cn/v1" - } - case strings.HasPrefix(model, "openrouter/") || - strings.HasPrefix(model, "anthropic/") || - strings.HasPrefix(model, "openai/") || - strings.HasPrefix(model, "meta-llama/") || - strings.HasPrefix(model, "deepseek/") || - strings.HasPrefix(model, "google/"): - sel.apiKey = cfg.Providers.OpenRouter.APIKey - sel.proxy = cfg.Providers.OpenRouter.Proxy - if cfg.Providers.OpenRouter.APIBase != "" { - sel.apiBase = cfg.Providers.OpenRouter.APIBase - } else { - sel.apiBase = "https://openrouter.ai/api/v1" - } - case (strings.Contains(lowerModel, "claude") || strings.HasPrefix(model, "anthropic/")) && - (cfg.Providers.Anthropic.APIKey != "" || cfg.Providers.Anthropic.AuthMethod != ""): - if cfg.Providers.Anthropic.AuthMethod == "oauth" || cfg.Providers.Anthropic.AuthMethod == "token" { - sel.apiBase = cfg.Providers.Anthropic.APIBase - if sel.apiBase == "" { - sel.apiBase = defaultAnthropicAPIBase - } - sel.providerType = providerTypeClaudeAuth - return sel, nil - } - sel.apiKey = cfg.Providers.Anthropic.APIKey - sel.apiBase = cfg.Providers.Anthropic.APIBase - sel.proxy = cfg.Providers.Anthropic.Proxy - if sel.apiBase == "" { - sel.apiBase = defaultAnthropicAPIBase - } - case (strings.Contains(lowerModel, "gpt") || strings.HasPrefix(model, "openai/")) && - (cfg.Providers.OpenAI.APIKey != "" || cfg.Providers.OpenAI.AuthMethod != ""): - sel.enableWebSearch = cfg.Providers.OpenAI.WebSearch - if cfg.Providers.OpenAI.AuthMethod == "codex-cli" { - sel.providerType = providerTypeCodexCLIToken - return sel, nil - } - if cfg.Providers.OpenAI.AuthMethod == "oauth" || cfg.Providers.OpenAI.AuthMethod == "token" { - sel.providerType = providerTypeCodexAuth - return sel, nil - } - sel.apiKey = cfg.Providers.OpenAI.APIKey - sel.apiBase = cfg.Providers.OpenAI.APIBase - sel.proxy = cfg.Providers.OpenAI.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.openai.com/v1" - } - case (strings.Contains(lowerModel, "gemini") || strings.HasPrefix(model, "google/")) && cfg.Providers.Gemini.APIKey != "": - sel.apiKey = cfg.Providers.Gemini.APIKey - sel.apiBase = cfg.Providers.Gemini.APIBase - sel.proxy = cfg.Providers.Gemini.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://generativelanguage.googleapis.com/v1beta" - } - case (strings.Contains(lowerModel, "glm") || strings.Contains(lowerModel, "zhipu") || strings.Contains(lowerModel, "zai")) && cfg.Providers.Zhipu.APIKey != "": - sel.apiKey = cfg.Providers.Zhipu.APIKey - sel.apiBase = cfg.Providers.Zhipu.APIBase - sel.proxy = cfg.Providers.Zhipu.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://open.bigmodel.cn/api/paas/v4" - } - case (strings.Contains(lowerModel, "groq") || strings.HasPrefix(model, "groq/")) && cfg.Providers.Groq.APIKey != "": - sel.apiKey = cfg.Providers.Groq.APIKey - sel.apiBase = cfg.Providers.Groq.APIBase - sel.proxy = cfg.Providers.Groq.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.groq.com/openai/v1" - } - case (strings.Contains(lowerModel, "nvidia") || strings.HasPrefix(model, "nvidia/")) && cfg.Providers.Nvidia.APIKey != "": - sel.apiKey = cfg.Providers.Nvidia.APIKey - sel.apiBase = cfg.Providers.Nvidia.APIBase - sel.proxy = cfg.Providers.Nvidia.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://integrate.api.nvidia.com/v1" - } - case strings.HasPrefix(model, "vivgrid/") && cfg.Providers.Vivgrid.APIKey != "": - sel.apiKey = cfg.Providers.Vivgrid.APIKey - sel.apiBase = cfg.Providers.Vivgrid.APIBase - sel.proxy = cfg.Providers.Vivgrid.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.vivgrid.com/v1" - } - case (strings.Contains(lowerModel, "ollama") || strings.HasPrefix(model, "ollama/")) && cfg.Providers.Ollama.APIKey != "": - sel.apiKey = cfg.Providers.Ollama.APIKey - sel.apiBase = cfg.Providers.Ollama.APIBase - sel.proxy = cfg.Providers.Ollama.Proxy - if sel.apiBase == "" { - sel.apiBase = "http://localhost:11434/v1" - } - case (strings.Contains(lowerModel, "mistral") || strings.HasPrefix(model, "mistral/")) && cfg.Providers.Mistral.APIKey != "": - sel.apiKey = cfg.Providers.Mistral.APIKey - sel.apiBase = cfg.Providers.Mistral.APIBase - sel.proxy = cfg.Providers.Mistral.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.mistral.ai/v1" - } - case (strings.Contains(lowerModel, "minimax") || strings.HasPrefix(model, "minimax/")) && cfg.Providers.Minimax.APIKey != "": - sel.apiKey = cfg.Providers.Minimax.APIKey - sel.apiBase = cfg.Providers.Minimax.APIBase - sel.proxy = cfg.Providers.Minimax.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.minimaxi.com/v1" - } - case strings.HasPrefix(model, "avian/") && cfg.Providers.Avian.APIKey != "": - sel.apiKey = cfg.Providers.Avian.APIKey - sel.apiBase = cfg.Providers.Avian.APIBase - sel.proxy = cfg.Providers.Avian.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.avian.io/v1" - } - case cfg.Providers.VLLM.APIBase != "": - sel.apiKey = cfg.Providers.VLLM.APIKey - sel.apiBase = cfg.Providers.VLLM.APIBase - sel.proxy = cfg.Providers.VLLM.Proxy - default: - if cfg.Providers.OpenRouter.APIKey != "" { - sel.apiKey = cfg.Providers.OpenRouter.APIKey - sel.proxy = cfg.Providers.OpenRouter.Proxy - if cfg.Providers.OpenRouter.APIBase != "" { - sel.apiBase = cfg.Providers.OpenRouter.APIBase - } else { - sel.apiBase = "https://openrouter.ai/api/v1" - } - } else { - return providerSelection{}, fmt.Errorf("no API key configured for model: %s", model) - } - } - } - - if sel.providerType == providerTypeHTTPCompat { - if sel.apiKey == "" && !strings.HasPrefix(model, "bedrock/") { - return providerSelection{}, fmt.Errorf("no API key configured for provider (model: %s)", model) - } - if sel.apiBase == "" { - return providerSelection{}, fmt.Errorf("no API base configured for provider (model: %s)", model) - } - } - - return sel, nil -} diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index a798154cb..9749e7a15 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -95,7 +95,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err case "litellm", "openrouter", "groq", "zhipu", "gemini", "nvidia", "ollama", "moonshot", "shengsuanyun", "deepseek", "cerebras", "vivgrid", "volcengine", "vllm", "qwen", "mistral", "avian", - "minimax": + "minimax", "longcat": // All other OpenAI-compatible HTTP providers if cfg.APIKey == "" && cfg.APIBase == "" { return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) @@ -215,6 +215,8 @@ func getDefaultAPIBase(protocol string) string { return "https://api.avian.io/v1" case "minimax": return "https://api.minimaxi.com/v1" + case "longcat": + return "https://api.longcat.chat/openai" default: return "" } diff --git a/pkg/providers/factory_provider_test.go b/pkg/providers/factory_provider_test.go index 17bc55d25..6c7bb4795 100644 --- a/pkg/providers/factory_provider_test.go +++ b/pkg/providers/factory_provider_test.go @@ -113,6 +113,7 @@ func TestCreateProviderFromConfig_DefaultAPIBase(t *testing.T) { {"vllm", "vllm"}, {"deepseek", "deepseek"}, {"ollama", "ollama"}, + {"longcat", "longcat"}, } for _, tt := range tests { @@ -162,6 +163,29 @@ func TestCreateProviderFromConfig_LiteLLM(t *testing.T) { } } +func TestCreateProviderFromConfig_LongCat(t *testing.T) { + cfg := &config.ModelConfig{ + ModelName: "test-longcat", + Model: "longcat/LongCat-Flash-Thinking", + APIKey: "test-key", + APIBase: "https://api.longcat.chat/openai", + } + + provider, modelID, err := CreateProviderFromConfig(cfg) + if err != nil { + t.Fatalf("CreateProviderFromConfig() error = %v", err) + } + if provider == nil { + t.Fatal("CreateProviderFromConfig() returned nil provider") + } + if modelID != "LongCat-Flash-Thinking" { + t.Errorf("modelID = %q, want %q", modelID, "LongCat-Flash-Thinking") + } + if _, ok := provider.(*HTTPProvider); !ok { + t.Fatalf("expected *HTTPProvider, got %T", provider) + } +} + func TestCreateProviderFromConfig_Anthropic(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-anthropic", diff --git a/pkg/providers/factory_test.go b/pkg/providers/factory_test.go index 36ccda4a1..bd8fbd1c4 100644 --- a/pkg/providers/factory_test.go +++ b/pkg/providers/factory_test.go @@ -1,234 +1,15 @@ package providers import ( - "strings" "testing" "github.com/sipeed/picoclaw/pkg/auth" "github.com/sipeed/picoclaw/pkg/config" ) -func TestResolveProviderSelection(t *testing.T) { - tests := []struct { - name string - setup func(*config.Config) - wantType providerType - wantAPIBase string - wantProxy string - wantErrSubstr string - }{ - { - name: "explicit litellm provider uses configured base", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "litellm" - cfg.Providers.LiteLLM.APIKey = "litellm-key" - cfg.Providers.LiteLLM.APIBase = "http://localhost:4000/v1" - cfg.Providers.LiteLLM.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "http://localhost:4000/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "explicit litellm provider defaults base when only key is configured", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "litellm" - cfg.Providers.LiteLLM.APIKey = "litellm-key" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "http://localhost:4000/v1", - }, - { - name: "explicit claude-cli provider routes to cli provider type", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "claude-cli" - cfg.Agents.Defaults.Workspace = "/tmp/ws" - }, - wantType: providerTypeClaudeCLI, - }, - { - name: "explicit copilot provider routes to github copilot type", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "copilot" - }, - wantType: providerTypeGitHubCopilot, - wantAPIBase: "localhost:4321", - }, - { - name: "explicit deepseek provider uses deepseek defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "deepseek" - cfg.Agents.Defaults.Model = "deepseek/deepseek-chat" - cfg.Providers.DeepSeek.APIKey = "deepseek-key" - cfg.Providers.DeepSeek.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://api.deepseek.com/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "explicit shengsuanyun provider uses defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "shengsuanyun" - cfg.Providers.ShengSuanYun.APIKey = "ssy-key" - cfg.Providers.ShengSuanYun.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://router.shengsuanyun.com/api/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "explicit nvidia provider uses defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "nvidia" - cfg.Providers.Nvidia.APIKey = "nvapi-test" - cfg.Providers.Nvidia.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://integrate.api.nvidia.com/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "explicit vivgrid provider uses defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "vivgrid" - cfg.Providers.Vivgrid.APIKey = "vivgrid-key" - cfg.Providers.Vivgrid.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://api.vivgrid.com/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "openrouter model uses openrouter defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "openrouter/auto" - cfg.Providers.OpenRouter.APIKey = "sk-or-test" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://openrouter.ai/api/v1", - }, - { - name: "anthropic oauth routes to claude auth provider", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "claude-sonnet-4.6" - cfg.Providers.Anthropic.AuthMethod = "oauth" - }, - wantType: providerTypeClaudeAuth, - }, - { - name: "openai oauth routes to codex auth provider", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "gpt-4o" - cfg.Providers.OpenAI.AuthMethod = "oauth" - }, - wantType: providerTypeCodexAuth, - }, - { - name: "openai codex-cli auth routes to codex cli token provider", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "gpt-4o" - cfg.Providers.OpenAI.AuthMethod = "codex-cli" - }, - wantType: providerTypeCodexCLIToken, - }, - { - name: "explicit codex-code provider routes to codex cli provider type", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "codex-code" - cfg.Agents.Defaults.Workspace = "/tmp/ws" - }, - wantType: providerTypeCodexCLI, - }, - { - name: "zhipu model uses zhipu base default", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "glm-4.7" - cfg.Providers.Zhipu.APIKey = "zhipu-key" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://open.bigmodel.cn/api/paas/v4", - }, - { - name: "groq model uses groq base default", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "groq/llama-3.3-70b" - cfg.Providers.Groq.APIKey = "gsk-key" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://api.groq.com/openai/v1", - }, - { - name: "ollama model uses ollama base default", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "ollama/qwen2.5:14b" - cfg.Providers.Ollama.APIKey = "ollama-key" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "http://localhost:11434/v1", - }, - { - name: "moonshot model keeps proxy and default base", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "moonshot/kimi-k2.5" - cfg.Providers.Moonshot.APIKey = "moonshot-key" - cfg.Providers.Moonshot.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://api.moonshot.cn/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "missing keys returns model config error", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "custom-model" - }, - wantErrSubstr: "no API key configured for model", - }, - { - name: "openrouter prefix without key returns provider key error", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "openrouter/auto" - }, - wantErrSubstr: "no API key configured for provider", - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - cfg := config.DefaultConfig() - tt.setup(cfg) - - got, err := resolveProviderSelection(cfg) - if tt.wantErrSubstr != "" { - if err == nil { - t.Fatalf("expected error containing %q, got nil", tt.wantErrSubstr) - } - if !strings.Contains(err.Error(), tt.wantErrSubstr) { - t.Fatalf("error = %q, want substring %q", err.Error(), tt.wantErrSubstr) - } - return - } - - if err != nil { - t.Fatalf("resolveProviderSelection() error = %v", err) - } - if got.providerType != tt.wantType { - t.Fatalf("providerType = %v, want %v", got.providerType, tt.wantType) - } - if tt.wantAPIBase != "" && got.apiBase != tt.wantAPIBase { - t.Fatalf("apiBase = %q, want %q", got.apiBase, tt.wantAPIBase) - } - if tt.wantProxy != "" && got.proxy != tt.wantProxy { - t.Fatalf("proxy = %q, want %q", got.proxy, tt.wantProxy) - } - }) - } -} - func TestCreateProviderReturnsHTTPProviderForOpenRouter(t *testing.T) { cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "test-openrouter" + cfg.Agents.Defaults.ModelName = "test-openrouter" cfg.ModelList = []config.ModelConfig{ { ModelName: "test-openrouter", @@ -250,7 +31,7 @@ func TestCreateProviderReturnsHTTPProviderForOpenRouter(t *testing.T) { func TestCreateProviderReturnsCodexCliProviderForCodexCode(t *testing.T) { cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "test-codex" + cfg.Agents.Defaults.ModelName = "test-codex" cfg.ModelList = []config.ModelConfig{ { ModelName: "test-codex", @@ -271,7 +52,7 @@ func TestCreateProviderReturnsCodexCliProviderForCodexCode(t *testing.T) { func TestCreateProviderReturnsClaudeCliProviderForClaudeCli(t *testing.T) { cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "test-claude-cli" + cfg.Agents.Defaults.ModelName = "test-claude-cli" cfg.ModelList = []config.ModelConfig{ { ModelName: "test-claude-cli", @@ -304,7 +85,7 @@ func TestCreateProviderReturnsClaudeProviderForAnthropicOAuth(t *testing.T) { } cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "test-claude-oauth" + cfg.Agents.Defaults.ModelName = "test-claude-oauth" cfg.ModelList = []config.ModelConfig{ { ModelName: "test-claude-oauth", diff --git a/pkg/providers/legacy_provider.go b/pkg/providers/legacy_provider.go index 26905159f..4b0815dd4 100644 --- a/pkg/providers/legacy_provider.go +++ b/pkg/providers/legacy_provider.go @@ -18,23 +18,6 @@ import ( func CreateProvider(cfg *config.Config) (LLMProvider, string, error) { model := cfg.Agents.Defaults.GetModelName() - // Ensure model_list is populated from providers config if needed - // This handles two cases: - // 1. ModelList is empty - convert all providers - // 2. ModelList has some entries but not all providers - merge missing ones - if cfg.HasProvidersConfig() { - providerModels := config.ConvertProvidersToModelList(cfg) - existingModelNames := make(map[string]bool) - for _, m := range cfg.ModelList { - existingModelNames[m.ModelName] = true - } - for _, pm := range providerModels { - if !existingModelNames[pm.ModelName] { - cfg.ModelList = append(cfg.ModelList, pm) - } - } - } - // Must have model_list at this point if len(cfg.ModelList) == 0 { return nil, "", fmt.Errorf("no providers configured. Please add entries to model_list in your config") diff --git a/pkg/providers/openai_compat/provider.go b/pkg/providers/openai_compat/provider.go index 0e8db7409..f97bf3acd 100644 --- a/pkg/providers/openai_compat/provider.go +++ b/pkg/providers/openai_compat/provider.go @@ -156,9 +156,10 @@ func (p *Provider) Chat( // The key is typically the agent ID — stable per agent, shared across requests. // See: https://platform.openai.com/docs/guides/prompt-caching // Prompt caching is only supported by OpenAI-native endpoints. - // Gemini and other providers reject unknown fields, so skip for non-OpenAI APIs. + // Non-OpenAI providers (Mistral, Gemini, DeepSeek, etc.) reject unknown + // fields with 422 errors, so only include it for OpenAI APIs. if cacheKey, ok := options["prompt_cache_key"].(string); ok && cacheKey != "" { - if !strings.Contains(p.apiBase, "generativelanguage.googleapis.com") { + if supportsPromptCacheKey(p.apiBase) { requestBody["prompt_cache_key"] = cacheKey } } @@ -283,8 +284,8 @@ func parseResponse(body io.Reader) (*LLMResponse, error) { ID string `json:"id"` Type string `json:"type"` Function *struct { - Name string `json:"name"` - Arguments string `json:"arguments"` + Name string `json:"name"` + Arguments json.RawMessage `json:"arguments"` } `json:"function"` ExtraContent *struct { Google *struct { @@ -323,12 +324,7 @@ func parseResponse(body io.Reader) (*LLMResponse, error) { if tc.Function != nil { name = tc.Function.Name - if tc.Function.Arguments != "" { - if err := json.Unmarshal([]byte(tc.Function.Arguments), &arguments); err != nil { - log.Printf("openai_compat: failed to decode tool call arguments for %q: %v", name, err) - arguments["raw"] = tc.Function.Arguments - } - } + arguments = decodeToolCallArguments(tc.Function.Arguments, name) } // Build ToolCall with ExtraContent for Gemini 3 thought_signature persistence @@ -361,6 +357,39 @@ func parseResponse(body io.Reader) (*LLMResponse, error) { }, nil } +func decodeToolCallArguments(raw json.RawMessage, name string) map[string]any { + arguments := make(map[string]any) + raw = bytes.TrimSpace(raw) + if len(raw) == 0 || bytes.Equal(raw, []byte("null")) { + return arguments + } + + var decoded any + if err := json.Unmarshal(raw, &decoded); err != nil { + log.Printf("openai_compat: failed to decode tool call arguments payload for %q: %v", name, err) + arguments["raw"] = string(raw) + return arguments + } + + switch v := decoded.(type) { + case string: + if strings.TrimSpace(v) == "" { + return arguments + } + if err := json.Unmarshal([]byte(v), &arguments); err != nil { + log.Printf("openai_compat: failed to decode tool call arguments for %q: %v", name, err) + arguments["raw"] = v + } + return arguments + case map[string]any: + return v + default: + log.Printf("openai_compat: unsupported tool call arguments type for %q: %T", name, decoded) + arguments["raw"] = string(raw) + return arguments + } +} + // openaiMessage is the wire-format message for OpenAI-compatible APIs. // It mirrors protocoltypes.Message but omits SystemParts, which is an // internal field that would be unknown to third-party endpoints. @@ -476,3 +505,16 @@ func asFloat(v any) (float64, bool) { return 0, false } } + +// supportsPromptCacheKey reports whether the given API base is known to +// support the prompt_cache_key request field. Currently only OpenAI's own +// API and Azure OpenAI support this. All other OpenAI-compatible providers +// (Mistral, Gemini, DeepSeek, Groq, etc.) reject unknown fields with 422 errors. +func supportsPromptCacheKey(apiBase string) bool { + u, err := url.Parse(apiBase) + if err != nil { + return false + } + host := u.Hostname() + return host == "api.openai.com" || strings.HasSuffix(host, ".openai.azure.com") +} diff --git a/pkg/providers/openai_compat/provider_test.go b/pkg/providers/openai_compat/provider_test.go index 9a3a7acc5..41f278a1b 100644 --- a/pkg/providers/openai_compat/provider_test.go +++ b/pkg/providers/openai_compat/provider_test.go @@ -108,6 +108,55 @@ func TestProviderChat_ParsesToolCalls(t *testing.T) { } } +func TestProviderChat_ParsesToolCallsWithObjectArguments(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{ + "content": "", + "tool_calls": []map[string]any{ + { + "id": "call_1", + "type": "function", + "function": map[string]any{ + "name": "get_weather", + "arguments": map[string]any{ + "city": "SF", + "metric": true, + }, + }, + }, + }, + }, + "finish_reason": "tool_calls", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + p := NewProvider("key", server.URL, "") + out, err := p.Chat(t.Context(), []Message{{Role: "user", Content: "hi"}}, nil, "gpt-4o", nil) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + if len(out.ToolCalls) != 1 { + t.Fatalf("len(ToolCalls) = %d, want 1", len(out.ToolCalls)) + } + if out.ToolCalls[0].Name != "get_weather" { + t.Fatalf("ToolCalls[0].Name = %q, want %q", out.ToolCalls[0].Name, "get_weather") + } + if out.ToolCalls[0].Arguments["city"] != "SF" { + t.Fatalf("ToolCalls[0].Arguments[city] = %v, want SF", out.ToolCalls[0].Arguments["city"]) + } + if out.ToolCalls[0].Arguments["metric"] != true { + t.Fatalf("ToolCalls[0].Arguments[metric] = %v, want true", out.ToolCalls[0].Arguments["metric"]) + } +} + func TestProviderChat_ParsesReasoningContent(t *testing.T) { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { resp := map[string]any{ @@ -669,6 +718,111 @@ func TestSerializeMessages_MediaWithToolCallID(t *testing.T) { } } +// chatWithCacheKey sets up a test server, sends a Chat request with prompt_cache_key, +// and returns the decoded request body for assertion. +func chatWithCacheKey(t *testing.T, apiBase string) map[string]any { + t.Helper() + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{"content": "ok"}, + "finish_reason": "stop", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + p := NewProvider("key", server.URL, "") + p.apiBase = apiBase + p.httpClient = &http.Client{ + Transport: roundTripperFunc(func(r *http.Request) (*http.Response, error) { + r.URL, _ = url.Parse(server.URL + r.URL.Path) + return http.DefaultTransport.RoundTrip(r) + }), + } + + _, err := p.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + "test-model", + map[string]any{"prompt_cache_key": "agent-main"}, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + return requestBody +} + +func TestProviderChat_PromptCacheKeySentToOpenAI(t *testing.T) { + body := chatWithCacheKey(t, "https://api.openai.com/v1") + if body["prompt_cache_key"] != "agent-main" { + t.Fatalf("prompt_cache_key = %v, want %q", body["prompt_cache_key"], "agent-main") + } +} + +func TestProviderChat_PromptCacheKeyOmittedForNonOpenAI(t *testing.T) { + tests := []struct { + name string + apiBase string + }{ + {"mistral", "https://api.mistral.ai/v1"}, + {"gemini", "https://generativelanguage.googleapis.com/v1beta"}, + {"deepseek", "https://api.deepseek.com/v1"}, + {"groq", "https://api.groq.com/openai/v1"}, + {"minimax", "https://api.minimaxi.com/v1"}, + {"ollama_local", "http://localhost:11434/v1"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + body := chatWithCacheKey(t, tt.apiBase) + if _, exists := body["prompt_cache_key"]; exists { + t.Fatalf("prompt_cache_key should NOT be sent to %s, but was included in request", tt.name) + } + }) + } +} + +func TestSupportsPromptCacheKey(t *testing.T) { + tests := []struct { + apiBase string + want bool + }{ + {"https://api.openai.com/v1", true}, + {"https://api.openai.com/v1/", true}, + {"https://myresource.openai.azure.com/openai/deployments/gpt-4", true}, + {"https://eastus.openai.azure.com/v1", true}, + {"https://api.mistral.ai/v1", false}, + {"https://generativelanguage.googleapis.com/v1beta", false}, + {"https://api.deepseek.com/v1", false}, + {"https://api.groq.com/openai/v1", false}, + {"http://localhost:11434/v1", false}, + {"https://openrouter.ai/api/v1", false}, + // Edge cases: proxy URLs with openai.com in path should NOT match + {"https://my-proxy.com/api.openai.com/v1", false}, + {"https://proxy.example.com/openai.azure.com/v1", false}, + // Malformed or empty + {"", false}, + {"not-a-url", false}, + } + for _, tt := range tests { + if got := supportsPromptCacheKey(tt.apiBase); got != tt.want { + t.Errorf("supportsPromptCacheKey(%q) = %v, want %v", tt.apiBase, got, tt.want) + } + } +} + func TestSerializeMessages_StripsSystemParts(t *testing.T) { messages := []protocoltypes.Message{ { diff --git a/pkg/routing/route_test.go b/pkg/routing/route_test.go index 8255db5f9..fdfc899f9 100644 --- a/pkg/routing/route_test.go +++ b/pkg/routing/route_test.go @@ -11,7 +11,7 @@ func testConfig(agents []config.AgentConfig, bindings []config.AgentBinding) *co Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: "/tmp/picoclaw-test", - Model: "gpt-4", + ModelName: "gpt-4", }, List: agents, }, diff --git a/pkg/session/manager.go b/pkg/session/manager.go index a31dbd55c..ef720b7c5 100644 --- a/pkg/session/manager.go +++ b/pkg/session/manager.go @@ -32,7 +32,7 @@ func NewSessionManager(storage string) *SessionManager { } if storage != "" { - os.MkdirAll(storage, 0o755) + os.MkdirAll(storage, 0o700) sm.loadSessions() } @@ -216,7 +216,7 @@ func (sm *SessionManager) Save(key string) error { _ = tmpFile.Close() return err } - if err := tmpFile.Chmod(0o644); err != nil { + if err := tmpFile.Chmod(0o600); err != nil { _ = tmpFile.Close() return err } diff --git a/pkg/skills/loader.go b/pkg/skills/loader.go index 30d84635a..f5985a662 100644 --- a/pkg/skills/loader.go +++ b/pkg/skills/loader.go @@ -10,14 +10,15 @@ import ( "regexp" "strings" + "github.com/gomarkdown/markdown" + "github.com/gomarkdown/markdown/ast" + "github.com/gomarkdown/markdown/parser" + "gopkg.in/yaml.v3" + "github.com/sipeed/picoclaw/pkg/logger" ) -var ( - namePattern = regexp.MustCompile(`^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$`) - reFrontmatter = regexp.MustCompile(`(?s)^---(?:\r\n|\n|\r)(.*?)(?:\r\n|\n|\r)---`) - reStripFrontmatter = regexp.MustCompile(`(?s)^---(?:\r\n|\n|\r)(.*?)(?:\r\n|\n|\r)---(?:\r\n|\n|\r)*`) -) +var namePattern = regexp.MustCompile(`^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$`) const ( MaxNameLength = 64 @@ -226,11 +227,20 @@ func (sl *SkillsLoader) getSkillMetadata(skillPath string) *SkillMetadata { return nil } - frontmatter := sl.extractFrontmatter(string(content)) + frontmatter, bodyContent := splitFrontmatter(string(content)) + dirName := filepath.Base(filepath.Dir(skillPath)) + title, bodyDescription := extractMarkdownMetadata(bodyContent) + + metadata := &SkillMetadata{ + Name: dirName, + Description: bodyDescription, + } + if title != "" && namePattern.MatchString(title) && len(title) <= MaxNameLength { + metadata.Name = title + } + if frontmatter == "" { - return &SkillMetadata{ - Name: filepath.Base(filepath.Dir(skillPath)), - } + return metadata } // Try JSON first (for backward compatibility) @@ -239,60 +249,133 @@ func (sl *SkillsLoader) getSkillMetadata(skillPath string) *SkillMetadata { Description string `json:"description"` } if err := json.Unmarshal([]byte(frontmatter), &jsonMeta); err == nil { - return &SkillMetadata{ - Name: jsonMeta.Name, - Description: jsonMeta.Description, + if jsonMeta.Name != "" { + metadata.Name = jsonMeta.Name } + if jsonMeta.Description != "" { + metadata.Description = jsonMeta.Description + } + return metadata } // Fall back to simple YAML parsing yamlMeta := sl.parseSimpleYAML(frontmatter) - return &SkillMetadata{ - Name: yamlMeta["name"], - Description: yamlMeta["description"], + if name := yamlMeta["name"]; name != "" { + metadata.Name = name } + if description := yamlMeta["description"]; description != "" { + metadata.Description = description + } + return metadata } -// parseSimpleYAML parses simple key: value YAML format -// Example: name: github\n description: "..." -// Normalizes line endings to handle \n (Unix), \r\n (Windows), and \r (classic Mac) +func extractMarkdownMetadata(content string) (title, description string) { + p := parser.NewWithExtensions(parser.CommonExtensions) + doc := markdown.Parse([]byte(content), p) + if doc == nil { + return "", "" + } + + ast.WalkFunc(doc, func(node ast.Node, entering bool) ast.WalkStatus { + if !entering { + return ast.GoToNext + } + + switch n := node.(type) { + case *ast.Heading: + if title == "" && n.Level == 1 { + title = nodeText(n) + if title != "" && description != "" { + return ast.Terminate + } + } + case *ast.Paragraph: + if description == "" { + description = nodeText(n) + if title != "" && description != "" { + return ast.Terminate + } + } + } + return ast.GoToNext + }) + + return title, description +} + +func nodeText(n ast.Node) string { + var b strings.Builder + ast.WalkFunc(n, func(node ast.Node, entering bool) ast.WalkStatus { + if !entering { + return ast.GoToNext + } + + switch t := node.(type) { + case *ast.Text: + b.Write(t.Literal) + case *ast.Code: + b.Write(t.Literal) + case *ast.Softbreak, *ast.Hardbreak, *ast.NonBlockingSpace: + b.WriteByte(' ') + } + return ast.GoToNext + }) + return strings.Join(strings.Fields(b.String()), " ") +} + +// parseSimpleYAML parses YAML frontmatter and extracts known metadata fields. func (sl *SkillsLoader) parseSimpleYAML(content string) map[string]string { result := make(map[string]string) - // Normalize line endings: convert \r\n and \r to \n - normalized := strings.ReplaceAll(content, "\r\n", "\n") - normalized = strings.ReplaceAll(normalized, "\r", "\n") - - for line := range strings.SplitSeq(normalized, "\n") { - line = strings.TrimSpace(line) - if line == "" || strings.HasPrefix(line, "#") { - continue - } - - parts := strings.SplitN(line, ":", 2) - if len(parts) == 2 { - key := strings.TrimSpace(parts[0]) - value := strings.TrimSpace(parts[1]) - // Remove quotes if present - value = strings.Trim(value, "\"'") - result[key] = value - } + var meta struct { + Name string `yaml:"name"` + Description string `yaml:"description"` + } + if err := yaml.Unmarshal([]byte(content), &meta); err != nil { + return result + } + if meta.Name != "" { + result["name"] = meta.Name + } + if meta.Description != "" { + result["description"] = meta.Description } return result } func (sl *SkillsLoader) extractFrontmatter(content string) string { - // Support \n (Unix), \r\n (Windows), and \r (classic Mac) line endings for frontmatter blocks - match := reFrontmatter.FindStringSubmatch(content) - if len(match) > 1 { - return match[1] - } - return "" + frontmatter, _ := splitFrontmatter(content) + return frontmatter } func (sl *SkillsLoader) stripFrontmatter(content string) string { - return reStripFrontmatter.ReplaceAllString(content, "") + _, body := splitFrontmatter(content) + return body +} + +func splitFrontmatter(content string) (frontmatter, body string) { + normalized := string(parser.NormalizeNewlines([]byte(content))) + lines := strings.Split(normalized, "\n") + if len(lines) == 0 || lines[0] != "---" { + return "", content + } + + end := -1 + for i := 1; i < len(lines); i++ { + if lines[i] == "---" { + end = i + break + } + } + if end == -1 { + return "", content + } + + frontmatter = strings.Join(lines[1:end], "\n") + body = strings.Join(lines[end+1:], "\n") + body = strings.TrimLeft(body, "\n") + return frontmatter, body } func escapeXML(s string) string { diff --git a/pkg/skills/loader_test.go b/pkg/skills/loader_test.go index 31619f9c2..645d8b7ac 100644 --- a/pkg/skills/loader_test.go +++ b/pkg/skills/loader_test.go @@ -342,3 +342,78 @@ func TestSkillRootsTrimsWhitespaceAndDedups(t *testing.T) { builtin, }, roots) } + +func TestGetSkillMetadata_UsesMarkdownParagraphWhenNoFrontmatter(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "plain-skill") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "# Plain Skill\n\nThis is parsed from markdown paragraph.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "plain-skill", meta.Name) + assert.Equal(t, "This is parsed from markdown paragraph.", meta.Description) +} + +func TestGetSkillMetadata_FrontmatterOverridesMarkdown(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "plain-skill") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "---\nname: frontmatter-skill\ndescription: frontmatter description\n---\n\n# Plain Skill\n\nBody description.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "frontmatter-skill", meta.Name) + assert.Equal(t, "frontmatter description", meta.Description) +} + +func TestGetSkillMetadata_YAMLMultilineDescription(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "plain-skill") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "---\nname: frontmatter-skill\ndescription: |\n line 1: with colon\n line 2\n---\n\n# Plain Skill\n\nBody description.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "frontmatter-skill", meta.Name) + assert.Equal(t, "line 1: with colon\nline 2", meta.Description) +} + +func TestGetSkillMetadata_InvalidHeadingNameFallsBackToDirName(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "valid-name") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "# Invalid Heading Name\n\nBody description.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "valid-name", meta.Name) + assert.Equal(t, "Body description.", meta.Description) +} + +func TestGetSkillMetadata_IgnoresHTMLCommentBlocks(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "biomed-skill") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "\n\n# Biomed Skill\n\nSummarize biomedical papers.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "biomed-skill", meta.Name) + assert.Equal(t, "Summarize biomedical papers.", meta.Description) +} diff --git a/pkg/state/state.go b/pkg/state/state.go index 57f371f12..5da7bbde1 100644 --- a/pkg/state/state.go +++ b/pkg/state/state.go @@ -40,8 +40,8 @@ func NewManager(workspace string) *Manager { oldStateFile := filepath.Join(workspace, "state.json") // Create state directory if it doesn't exist - if err := os.MkdirAll(stateDir, 0o755); err != nil { - log.Fatalf("[FATAL] state: failed to create state directory: %v", err) + if err := os.MkdirAll(stateDir, 0o700); err != nil { + log.Printf("[WARN] state: failed to create state directory %s: %v", stateDir, err) } sm := &Manager{ diff --git a/pkg/state/state_test.go b/pkg/state/state_test.go index e5e116ef6..3924e5533 100644 --- a/pkg/state/state_test.go +++ b/pkg/state/state_test.go @@ -2,7 +2,6 @@ package state import ( "encoding/json" - "errors" "fmt" "os" "os/exec" @@ -217,10 +216,7 @@ func TestNewManager_EmptyWorkspace(t *testing.T) { } } -func TestNewManager_MkdirFailureCrashes(t *testing.T) { - // Since log.Fatalf calls os.Exit(1), we cannot test it normally - // Otherwise, the test suite would stop altogether. - // We use the standard pattern of Go: rerun this test in a subprocess. +func TestNewManager_MkdirFailureDoesNotCrash(t *testing.T) { if os.Getenv("BE_CRASHER") == "1" { tmpDir := os.Getenv("CRASH_DIR") @@ -240,15 +236,11 @@ func TestNewManager_MkdirFailureCrashes(t *testing.T) { } defer os.RemoveAll(tmpDir) - cmd := exec.Command(os.Args[0], "-test.run=TestNewManager_MkdirFailureCrashes") + cmd := exec.Command(os.Args[0], "-test.run=TestNewManager_MkdirFailureDoesNotCrash") cmd.Env = append(os.Environ(), "BE_CRASHER=1", "CRASH_DIR="+tmpDir) err = cmd.Run() - - var e *exec.ExitError - if errors.As(err, &e) && !e.Success() { - return + if err != nil { + t.Fatalf("NewManager should not crash when state dir creation fails, got: %v", err) } - - t.Fatalf("The process ended without error, a crash was expected via os.Exit(1). Err: %v", err) } diff --git a/pkg/tools/cron.go b/pkg/tools/cron.go index 6af0aa9e1..648cc3c6c 100644 --- a/pkg/tools/cron.go +++ b/pkg/tools/cron.go @@ -8,6 +8,7 @@ import ( "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/constants" "github.com/sipeed/picoclaw/pkg/cron" "github.com/sipeed/picoclaw/pkg/utils" ) @@ -73,6 +74,10 @@ func (t *CronTool) Parameters() map[string]any { "type": "string", "description": "Optional: Shell command to execute directly (e.g., 'df -h'). If set, the agent will run this command and report output instead of just showing the message. 'deliver' will be forced to false for commands.", }, + "command_confirm": map[string]any{ + "type": "boolean", + "description": "Required when using command=true. Must be true to explicitly confirm scheduling a shell command.", + }, "at_seconds": map[string]any{ "type": "integer", "description": "One-time reminder: seconds from now when to trigger (e.g., 600 for 10 minutes later). Use this for one-time reminders like 'remind me in 10 minutes'.", @@ -175,12 +180,17 @@ func (t *CronTool) addJob(ctx context.Context, args map[string]any) *ToolResult deliver = d } + // GHSA-pv8c-p6jf-3fpp: command scheduling requires internal channel + explicit confirm. + // Non-command reminders (plain messages) remain open to all channels. command, _ := args["command"].(string) + commandConfirm, _ := args["command_confirm"].(bool) if command != "" { - // Commands must be processed by agent/exec tool, so deliver must be false (or handled specifically) - // Actually, let's keep deliver=false to let the system know it's not a simple chat message - // But for our new logic in ExecuteJob, we can handle it regardless of deliver flag if Payload.Command is set. - // However, logically, it's not "delivered" to chat directly as is. + if !constants.IsInternalChannel(channel) { + return ErrorResult("scheduling command execution is restricted to internal channels") + } + if !commandConfirm { + return ErrorResult("command_confirm=true is required to schedule command execution") + } deliver = false } @@ -281,7 +291,9 @@ func (t *CronTool) ExecuteJob(ctx context.Context, job *cron.CronJob) string { // Execute command if present if job.Payload.Command != "" { args := map[string]any{ - "command": job.Payload.Command, + "command": job.Payload.Command, + "__channel": channel, + "__chat_id": chatID, } result := t.execTool.Execute(ctx, args) diff --git a/pkg/tools/cron_test.go b/pkg/tools/cron_test.go new file mode 100644 index 000000000..1776abc65 --- /dev/null +++ b/pkg/tools/cron_test.go @@ -0,0 +1,116 @@ +package tools + +import ( + "context" + "path/filepath" + "strings" + "testing" + + "github.com/sipeed/picoclaw/pkg/bus" + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/cron" +) + +func newTestCronTool(t *testing.T) *CronTool { + t.Helper() + storePath := filepath.Join(t.TempDir(), "cron.json") + cronService := cron.NewCronService(storePath, nil) + msgBus := bus.NewMessageBus() + cfg := config.DefaultConfig() + tool, err := NewCronTool(cronService, nil, msgBus, t.TempDir(), true, 0, cfg) + if err != nil { + t.Fatalf("NewCronTool() error: %v", err) + } + return tool +} + +// TestCronTool_CommandBlockedFromRemoteChannel verifies command scheduling is restricted to internal channels +func TestCronTool_CommandBlockedFromRemoteChannel(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "command_confirm": true, + "at_seconds": float64(60), + }) + + if !result.IsError { + t.Fatal("expected command scheduling to be blocked from remote channel") + } + if !strings.Contains(result.ForLLM, "restricted to internal channels") { + t.Errorf("expected 'restricted to internal channels', got: %s", result.ForLLM) + } +} + +// TestCronTool_CommandRequiresConfirm verifies command_confirm=true is required +func TestCronTool_CommandRequiresConfirm(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "at_seconds": float64(60), + }) + + if !result.IsError { + t.Fatal("expected error when command_confirm is missing") + } + if !strings.Contains(result.ForLLM, "command_confirm=true") { + t.Errorf("expected 'command_confirm=true' message, got: %s", result.ForLLM) + } +} + +// TestCronTool_CommandAllowedFromInternalChannel verifies command scheduling works from internal channels +func TestCronTool_CommandAllowedFromInternalChannel(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "command_confirm": true, + "at_seconds": float64(60), + }) + + if result.IsError { + t.Fatalf("expected command scheduling to succeed from internal channel, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "Cron job added") { + t.Errorf("expected 'Cron job added', got: %s", result.ForLLM) + } +} + +// TestCronTool_AddJobRequiresSessionContext verifies fail-closed when channel/chatID missing +func TestCronTool_AddJobRequiresSessionContext(t *testing.T) { + tool := newTestCronTool(t) + result := tool.Execute(context.Background(), map[string]any{ + "action": "add", + "message": "reminder", + "at_seconds": float64(60), + }) + + if !result.IsError { + t.Fatal("expected error when session context is missing") + } + if !strings.Contains(result.ForLLM, "no session context") { + t.Errorf("expected 'no session context' message, got: %s", result.ForLLM) + } +} + +// TestCronTool_NonCommandJobAllowedFromRemoteChannel verifies regular reminders work from any channel +func TestCronTool_NonCommandJobAllowedFromRemoteChannel(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "time to stretch", + "at_seconds": float64(600), + }) + + if result.IsError { + t.Fatalf("expected non-command reminder to succeed from remote channel, got: %s", result.ForLLM) + } +} diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go index b8a811d03..67e2ad257 100644 --- a/pkg/tools/shell.go +++ b/pkg/tools/shell.go @@ -14,6 +14,7 @@ import ( "time" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/constants" ) type ExecTool struct { @@ -23,6 +24,7 @@ type ExecTool struct { allowPatterns []*regexp.Regexp customAllowPatterns []*regexp.Regexp restrictToWorkspace bool + allowRemote bool } var ( @@ -100,10 +102,12 @@ func NewExecTool(workingDir string, restrict bool) (*ExecTool, error) { func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Config) (*ExecTool, error) { denyPatterns := make([]*regexp.Regexp, 0) customAllowPatterns := make([]*regexp.Regexp, 0) + allowRemote := true if config != nil { execConfig := config.Tools.Exec enableDenyPatterns := execConfig.EnableDenyPatterns + allowRemote = execConfig.AllowRemote if enableDenyPatterns { denyPatterns = append(denyPatterns, defaultDenyPatterns...) if len(execConfig.CustomDenyPatterns) > 0 { @@ -143,6 +147,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf allowPatterns: nil, customAllowPatterns: customAllowPatterns, restrictToWorkspace: restrict, + allowRemote: allowRemote, }, nil } @@ -177,6 +182,19 @@ func (t *ExecTool) Execute(ctx context.Context, args map[string]any) *ToolResult return ErrorResult("command is required") } + // GHSA-pv8c-p6jf-3fpp: block exec from remote channels (e.g. Telegram webhooks) + // unless explicitly opted-in via config. Fail-closed: empty channel = blocked. + if !t.allowRemote { + channel := ToolChannel(ctx) + if channel == "" { + channel, _ = args["__channel"].(string) + } + channel = strings.TrimSpace(channel) + if channel == "" || !constants.IsInternalChannel(channel) { + return ErrorResult("exec is restricted to internal channels") + } + } + cwd := t.workingDir if wd, ok := args["working_dir"].(string); ok && wd != "" { if t.restrictToWorkspace && t.workingDir != "" { @@ -201,6 +219,25 @@ func (t *ExecTool) Execute(ctx context.Context, args map[string]any) *ToolResult return ErrorResult(guardError) } + // Re-resolve symlinks immediately before execution to shrink the TOCTOU window + // between validation and cmd.Dir assignment. + if t.restrictToWorkspace && t.workingDir != "" && cwd != t.workingDir { + resolved, err := filepath.EvalSymlinks(cwd) + if err != nil { + return ErrorResult(fmt.Sprintf("Command blocked by safety guard (path resolution failed: %v)", err)) + } + absWorkspace, _ := filepath.Abs(t.workingDir) + wsResolved, _ := filepath.EvalSymlinks(absWorkspace) + if wsResolved == "" { + wsResolved = absWorkspace + } + rel, err := filepath.Rel(wsResolved, resolved) + if err != nil || !filepath.IsLocal(rel) { + return ErrorResult("Command blocked by safety guard (working directory escaped workspace)") + } + cwd = resolved + } + // timeout == 0 means no timeout var cmdCtx context.Context var cancel context.CancelFunc diff --git a/pkg/tools/shell_test.go b/pkg/tools/shell_test.go index ff9ea4a15..90265e5bd 100644 --- a/pkg/tools/shell_test.go +++ b/pkg/tools/shell_test.go @@ -301,6 +301,85 @@ func TestShellTool_WorkingDir_SymlinkEscape(t *testing.T) { } } +// TestShellTool_RemoteChannelBlockedByDefault verifies exec is blocked for remote channels +func TestShellTool_RemoteChannelBlockedByDefault(t *testing.T) { + cfg := &config.Config{} + cfg.Tools.Exec.EnableDenyPatterns = true + cfg.Tools.Exec.AllowRemote = false + + tool, err := NewExecToolWithConfig("", false, cfg) + if err != nil { + t.Fatalf("NewExecToolWithConfig() error: %v", err) + } + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{"command": "echo hi"}) + + if !result.IsError { + t.Fatal("expected remote-channel exec to be blocked") + } + if !strings.Contains(result.ForLLM, "restricted to internal channels") { + t.Errorf("expected 'restricted to internal channels' message, got: %s", result.ForLLM) + } +} + +// TestShellTool_InternalChannelAllowed verifies exec is allowed for internal channels +func TestShellTool_InternalChannelAllowed(t *testing.T) { + cfg := &config.Config{} + cfg.Tools.Exec.EnableDenyPatterns = true + cfg.Tools.Exec.AllowRemote = false + + tool, err := NewExecToolWithConfig("", false, cfg) + if err != nil { + t.Fatalf("NewExecToolWithConfig() error: %v", err) + } + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{"command": "echo hi"}) + + if result.IsError { + t.Fatalf("expected internal channel exec to succeed, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "hi") { + t.Errorf("expected output to contain 'hi', got: %s", result.ForLLM) + } +} + +// TestShellTool_EmptyChannelBlockedWhenNotAllowRemote verifies fail-closed when no channel context +func TestShellTool_EmptyChannelBlockedWhenNotAllowRemote(t *testing.T) { + cfg := &config.Config{} + cfg.Tools.Exec.EnableDenyPatterns = true + cfg.Tools.Exec.AllowRemote = false + + tool, err := NewExecToolWithConfig("", false, cfg) + if err != nil { + t.Fatalf("NewExecToolWithConfig() error: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "command": "echo hi", + }) + + if !result.IsError { + t.Fatal("expected exec with empty channel to be blocked when allowRemote=false") + } +} + +// TestShellTool_AllowRemoteBypassesChannelCheck verifies allowRemote=true permits any channel +func TestShellTool_AllowRemoteBypassesChannelCheck(t *testing.T) { + cfg := &config.Config{} + cfg.Tools.Exec.EnableDenyPatterns = true + cfg.Tools.Exec.AllowRemote = true + + tool, err := NewExecToolWithConfig("", false, cfg) + if err != nil { + t.Fatalf("NewExecToolWithConfig() error: %v", err) + } + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{"command": "echo hi"}) + + if result.IsError { + t.Fatalf("expected allowRemote=true to permit remote channel, got: %s", result.ForLLM) + } +} + // TestShellTool_RestrictToWorkspace verifies workspace restriction func TestShellTool_RestrictToWorkspace(t *testing.T) { tmpDir := t.TempDir() diff --git a/pkg/tools/web.go b/pkg/tools/web.go index e248ea966..003cd860c 100644 --- a/pkg/tools/web.go +++ b/pkg/tools/web.go @@ -7,6 +7,7 @@ import ( "errors" "fmt" "io" + "net" "net/http" "net/url" "regexp" @@ -818,6 +819,10 @@ func NewWebFetchTool(maxChars int, fetchLimitBytes int64) (*WebFetchTool, error) return NewWebFetchToolWithProxy(maxChars, "", fetchLimitBytes) } +// allowPrivateWebFetchHosts controls whether loopback/private hosts are allowed. +// This is false in normal runtime to reduce SSRF exposure, and tests can override it temporarily. +var allowPrivateWebFetchHosts atomic.Bool + func NewWebFetchToolWithProxy(maxChars int, proxy string, fetchLimitBytes int64) (*WebFetchTool, error) { if maxChars <= 0 { maxChars = defaultMaxChars @@ -826,10 +831,20 @@ func NewWebFetchToolWithProxy(maxChars int, proxy string, fetchLimitBytes int64) if err != nil { return nil, fmt.Errorf("failed to create HTTP client for web fetch: %w", err) } + if transport, ok := client.Transport.(*http.Transport); ok { + dialer := &net.Dialer{ + Timeout: 15 * time.Second, + KeepAlive: 30 * time.Second, + } + transport.DialContext = newSafeDialContext(dialer) + } client.CheckRedirect = func(req *http.Request, via []*http.Request) error { if len(via) >= maxRedirects { return fmt.Errorf("stopped after %d redirects", maxRedirects) } + if isObviousPrivateHost(req.URL.Hostname()) { + return fmt.Errorf("redirect target is private or local network host") + } return nil } if fetchLimitBytes <= 0 { @@ -888,6 +903,13 @@ func (t *WebFetchTool) Execute(ctx context.Context, args map[string]any) *ToolRe return ErrorResult("missing domain in URL") } + // Lightweight pre-flight: block obvious localhost/literal-IP without DNS resolution. + // The real SSRF guard is newSafeDialContext at connect time. + hostname := parsedURL.Hostname() + if isObviousPrivateHost(hostname) { + return ErrorResult("fetching private or local network hosts is not allowed") + } + maxChars := t.maxChars if mc, ok := args["maxChars"].(float64); ok { if int(mc) > 100 { @@ -901,7 +923,6 @@ func (t *WebFetchTool) Execute(ctx context.Context, args map[string]any) *ToolRe } req.Header.Set("User-Agent", userAgent) - resp, err := t.client.Do(req) if err != nil { return ErrorResult(fmt.Sprintf("request failed: %v", err)) @@ -992,3 +1013,127 @@ func (t *WebFetchTool) extractText(htmlContent string) string { return strings.Join(cleanLines, "\n") } + +// newSafeDialContext re-resolves DNS at connect time to mitigate DNS rebinding (TOCTOU) +// where a hostname resolves to a public IP during pre-flight but a private IP at connect time. +func newSafeDialContext(dialer *net.Dialer) func(context.Context, string, string) (net.Conn, error) { + return func(ctx context.Context, network, address string) (net.Conn, error) { + if allowPrivateWebFetchHosts.Load() { + return dialer.DialContext(ctx, network, address) + } + + host, port, err := net.SplitHostPort(address) + if err != nil { + return nil, fmt.Errorf("invalid target address %q: %w", address, err) + } + if host == "" { + return nil, fmt.Errorf("empty target host") + } + + if ip := net.ParseIP(host); ip != nil { + if isPrivateOrRestrictedIP(ip) { + return nil, fmt.Errorf("blocked private or local target: %s", host) + } + return dialer.DialContext(ctx, network, net.JoinHostPort(ip.String(), port)) + } + + ipAddrs, err := net.DefaultResolver.LookupIPAddr(ctx, host) + if err != nil { + return nil, fmt.Errorf("failed to resolve %s: %w", host, err) + } + + attempted := 0 + var lastErr error + for _, ipAddr := range ipAddrs { + if isPrivateOrRestrictedIP(ipAddr.IP) { + continue + } + attempted++ + conn, err := dialer.DialContext(ctx, network, net.JoinHostPort(ipAddr.IP.String(), port)) + if err == nil { + return conn, nil + } + lastErr = err + } + + if attempted == 0 { + return nil, fmt.Errorf("all resolved addresses for %s are private or restricted", host) + } + if lastErr != nil { + return nil, fmt.Errorf("failed connecting to public addresses for %s: %w", host, lastErr) + } + return nil, fmt.Errorf("failed connecting to public addresses for %s", host) + } +} + +// isObviousPrivateHost performs a lightweight, no-DNS check for obviously private hosts. +// It catches localhost, literal private IPs, and empty hosts. It does NOT resolve DNS — +// the real SSRF guard is newSafeDialContext which checks IPs at connect time. +func isObviousPrivateHost(host string) bool { + if allowPrivateWebFetchHosts.Load() { + return false + } + + h := strings.ToLower(strings.TrimSpace(host)) + h = strings.TrimSuffix(h, ".") + if h == "" { + return true + } + + if h == "localhost" || strings.HasSuffix(h, ".localhost") { + return true + } + + if ip := net.ParseIP(h); ip != nil { + return isPrivateOrRestrictedIP(ip) + } + + return false +} + +// isPrivateOrRestrictedIP returns true for IPs that should never be reached via web_fetch: +// RFC 1918, loopback, link-local (incl. cloud metadata 169.254.x.x), carrier-grade NAT, +// IPv6 unique-local (fc00::/7), 6to4 (2002::/16), and Teredo (2001:0000::/32). +func isPrivateOrRestrictedIP(ip net.IP) bool { + if ip == nil { + return true + } + + if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || + ip.IsMulticast() || ip.IsUnspecified() { + return true + } + + if ip4 := ip.To4(); ip4 != nil { + // IPv4 private, loopback, link-local, and carrier-grade NAT ranges. + if ip4[0] == 10 || + ip4[0] == 127 || + ip4[0] == 0 || + (ip4[0] == 172 && ip4[1] >= 16 && ip4[1] <= 31) || + (ip4[0] == 192 && ip4[1] == 168) || + (ip4[0] == 169 && ip4[1] == 254) || + (ip4[0] == 100 && ip4[1] >= 64 && ip4[1] <= 127) { + return true + } + return false + } + + if len(ip) == net.IPv6len { + // IPv6 unique local addresses (fc00::/7) + if (ip[0] & 0xfe) == 0xfc { + return true + } + // 6to4 addresses (2002::/16): check the embedded IPv4 at bytes [2:6]. + if ip[0] == 0x20 && ip[1] == 0x02 { + embedded := net.IPv4(ip[2], ip[3], ip[4], ip[5]) + return isPrivateOrRestrictedIP(embedded) + } + // Teredo (2001:0000::/32): client IPv4 is at bytes [12:16], XOR-inverted. + if ip[0] == 0x20 && ip[1] == 0x01 && ip[2] == 0x00 && ip[3] == 0x00 { + client := net.IPv4(ip[12]^0xff, ip[13]^0xff, ip[14]^0xff, ip[15]^0xff) + return isPrivateOrRestrictedIP(client) + } + } + + return false +} diff --git a/pkg/tools/web_test.go b/pkg/tools/web_test.go index 188fb8adb..0737d2087 100644 --- a/pkg/tools/web_test.go +++ b/pkg/tools/web_test.go @@ -5,6 +5,7 @@ import ( "context" "encoding/json" "fmt" + "net" "net/http" "net/http/httptest" "strings" @@ -18,6 +19,8 @@ const testFetchLimit = int64(10 * 1024 * 1024) // TestWebTool_WebFetch_Success verifies successful URL fetching func TestWebTool_WebFetch_Success(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html") w.WriteHeader(http.StatusOK) @@ -55,6 +58,8 @@ func TestWebTool_WebFetch_Success(t *testing.T) { // TestWebTool_WebFetch_JSON verifies JSON content handling func TestWebTool_WebFetch_JSON(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + testData := map[string]string{"key": "value", "number": "123"} expectedJSON, _ := json.MarshalIndent(testData, "", " ") @@ -163,6 +168,8 @@ func TestWebTool_WebFetch_MissingURL(t *testing.T) { // TestWebTool_WebFetch_Truncation verifies content truncation func TestWebTool_WebFetch_Truncation(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + longContent := strings.Repeat("x", 20000) server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { @@ -205,6 +212,8 @@ func TestWebTool_WebFetch_Truncation(t *testing.T) { } func TestWebFetchTool_PayloadTooLarge(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + // Create a mock HTTP server ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html") @@ -290,6 +299,8 @@ func TestWebTool_WebSearch_MissingQuery(t *testing.T) { // TestWebTool_WebFetch_HTMLExtraction verifies HTML text extraction func TestWebTool_WebFetch_HTMLExtraction(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html") w.WriteHeader(http.StatusOK) @@ -404,6 +415,205 @@ func TestWebFetchTool_extractText(t *testing.T) { } } +func withPrivateWebFetchHostsAllowed(t *testing.T) { + t.Helper() + previous := allowPrivateWebFetchHosts.Load() + allowPrivateWebFetchHosts.Store(true) + t.Cleanup(func() { + allowPrivateWebFetchHosts.Store(previous) + }) +} + +func TestWebTool_WebFetch_PrivateHostBlocked(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://127.0.0.1:0", + }) + + if !result.IsError { + t.Errorf("expected error for private host URL, got success") + } + if !strings.Contains(result.ForLLM, "private or local network") && + !strings.Contains(result.ForUser, "private or local network") { + t.Errorf("expected private host block message, got %q", result.ForLLM) + } +} + +func TestWebTool_WebFetch_PrivateHostAllowedForTests(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "text/plain") + w.WriteHeader(http.StatusOK) + w.Write([]byte("ok")) + })) + defer server.Close() + + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": server.URL, + }) + + if result.IsError { + t.Errorf("expected success when private host access is allowed in tests, got %q", result.ForLLM) + } +} + +// TestWebFetch_BlocksIPv4MappedIPv6Loopback verifies ::ffff:127.0.0.1 is blocked +func TestWebFetch_BlocksIPv4MappedIPv6Loopback(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://[::ffff:127.0.0.1]:0", + }) + + if !result.IsError { + t.Error("expected error for IPv4-mapped IPv6 loopback URL, got success") + } +} + +// TestWebFetch_BlocksMetadataIP verifies 169.254.169.254 is blocked +func TestWebFetch_BlocksMetadataIP(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://169.254.169.254/latest/meta-data", + }) + + if !result.IsError { + t.Error("expected error for cloud metadata IP, got success") + } +} + +// TestWebFetch_BlocksIPv6UniqueLocal verifies fc00::/7 addresses are blocked +func TestWebFetch_BlocksIPv6UniqueLocal(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://[fd00::1]:0", + }) + + if !result.IsError { + t.Error("expected error for IPv6 unique local address, got success") + } +} + +// TestWebFetch_Blocks6to4WithPrivateEmbed verifies 6to4 with private embedded IPv4 is blocked +func TestWebFetch_Blocks6to4WithPrivateEmbed(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + // 2002:7f00:0001::1 embeds 127.0.0.1 + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://[2002:7f00:0001::1]:0", + }) + + if !result.IsError { + t.Error("expected error for 6to4 with private embedded IPv4, got success") + } +} + +// TestWebFetch_Allows6to4WithPublicEmbed verifies 6to4 with public embedded IPv4 is NOT blocked +func TestWebFetch_Allows6to4WithPublicEmbed(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + // 2002:0801:0101::1 embeds 8.1.1.1 (public) — pre-flight should pass, + // connection will fail (no listener) but that's after the SSRF check. + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://[2002:0801:0101::1]:0", + }) + + // Should NOT be blocked by SSRF check — error should be connection failure, not "private" + if result.IsError && strings.Contains(result.ForLLM, "private") { + t.Error("6to4 with public embedded IPv4 should not be blocked as private") + } +} + +// TestWebFetch_RedirectToPrivateBlocked verifies redirects to private IPs are blocked +func TestWebFetch_RedirectToPrivateBlocked(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Redirect to a private IP + http.Redirect(w, r, "http://10.0.0.1/secret", http.StatusFound) + })) + defer server.Close() + + // Temporarily disable private host allowance for the redirect check + allowPrivateWebFetchHosts.Store(false) + defer allowPrivateWebFetchHosts.Store(true) + + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": server.URL, + }) + + if !result.IsError { + t.Error("expected error when redirecting to private IP, got success") + } +} + +// TestIsPrivateOrRestrictedIP_Table tests IP classification logic +func TestIsPrivateOrRestrictedIP_Table(t *testing.T) { + tests := []struct { + ip string + blocked bool + desc string + }{ + {"127.0.0.1", true, "IPv4 loopback"}, + {"10.0.0.1", true, "IPv4 private class A"}, + {"172.16.0.1", true, "IPv4 private class B"}, + {"192.168.1.1", true, "IPv4 private class C"}, + {"169.254.169.254", true, "link-local / cloud metadata"}, + {"100.64.0.1", true, "carrier-grade NAT"}, + {"0.0.0.0", true, "unspecified"}, + {"8.8.8.8", false, "public DNS"}, + {"1.1.1.1", false, "public DNS"}, + {"::1", true, "IPv6 loopback"}, + {"::ffff:127.0.0.1", true, "IPv4-mapped IPv6 loopback"}, + {"::ffff:10.0.0.1", true, "IPv4-mapped IPv6 private"}, + {"fc00::1", true, "IPv6 unique local"}, + {"fd00::1", true, "IPv6 unique local"}, + {"2002:7f00:0001::1", true, "6to4 with embedded 127.x (private)"}, + {"2002:0a00:0001::1", true, "6to4 with embedded 10.0.0.1 (private)"}, + {"2002:0801:0101::1", false, "6to4 with embedded 8.1.1.1 (public)"}, + {"2001:0000:4136:e378:8000:63bf:f5ff:fffe", true, "Teredo with client 10.0.0.1 (private)"}, + {"2001:0000:4136:e378:8000:63bf:f7f6:fefe", false, "Teredo with client 8.9.1.1 (public)"}, + {"2607:f8b0:4004:800::200e", false, "public IPv6 (Google)"}, + } + + for _, tt := range tests { + t.Run(tt.desc, func(t *testing.T) { + ip := net.ParseIP(tt.ip) + if ip == nil { + t.Fatalf("failed to parse IP: %s", tt.ip) + } + got := isPrivateOrRestrictedIP(ip) + if got != tt.blocked { + t.Errorf("isPrivateOrRestrictedIP(%s) = %v, want %v", tt.ip, got, tt.blocked) + } + }) + } +} + // TestWebTool_WebFetch_MissingDomain verifies error handling for URL without domain func TestWebTool_WebFetch_MissingDomain(t *testing.T) { tool, err := NewWebFetchTool(50000, testFetchLimit) diff --git a/pkg/voice/transcriber.go b/pkg/voice/transcriber.go index e949d7a22..5b18612b1 100644 --- a/pkg/voice/transcriber.go +++ b/pkg/voice/transcriber.go @@ -166,11 +166,7 @@ func (t *GroqTranscriber) Name() string { // DetectTranscriber inspects cfg and returns the appropriate Transcriber, or // nil if no supported transcription provider is configured. func DetectTranscriber(cfg *config.Config) Transcriber { - // Direct Groq provider config takes priority. - if key := cfg.Providers.Groq.APIKey; key != "" { - return NewGroqTranscriber(key) - } - // Fall back to any model-list entry that uses the groq/ protocol. + // return any model-list entry that uses the groq/ protocol. for _, mc := range cfg.ModelList { if strings.HasPrefix(mc.Model, "groq/") && mc.APIKey != "" { return NewGroqTranscriber(mc.APIKey) diff --git a/pkg/voice/transcriber_test.go b/pkg/voice/transcriber_test.go index 9b6add333..e7d10c40f 100644 --- a/pkg/voice/transcriber_test.go +++ b/pkg/voice/transcriber_test.go @@ -34,15 +34,6 @@ func TestDetectTranscriber(t *testing.T) { cfg: &config.Config{}, wantNil: true, }, - { - name: "groq provider key", - cfg: &config.Config{ - Providers: config.ProvidersConfig{ - Groq: config.ProviderConfig{APIKey: "sk-groq-direct"}, - }, - }, - wantName: "groq", - }, { name: "groq via model list", cfg: &config.Config{ @@ -65,9 +56,6 @@ func TestDetectTranscriber(t *testing.T) { { name: "provider key takes priority over model list", cfg: &config.Config{ - Providers: config.ProvidersConfig{ - Groq: config.ProviderConfig{APIKey: "sk-groq-direct"}, - }, ModelList: []config.ModelConfig{ {Model: "groq/llama-3.3-70b", APIKey: "sk-groq-model"}, }, diff --git a/web/backend/api/config.go b/web/backend/api/config.go index f160b42b6..091e3fbae 100644 --- a/web/backend/api/config.go +++ b/web/backend/api/config.go @@ -5,7 +5,6 @@ import ( "fmt" "io" "net/http" - "os" "github.com/sipeed/picoclaw/pkg/config" ) @@ -17,36 +16,11 @@ func (h *Handler) registerConfigRoutes(mux *http.ServeMux) { mux.HandleFunc("PATCH /api/config", h.handlePatchConfig) } -// loadFilteredConfig loads the configuration and filters out default placeholder credentials -// (like API limits/keys) if the configuration file has not been created yet by the user. -func (h *Handler) loadFilteredConfig() (*config.Config, error) { - cfg, err := config.LoadConfig(h.configPath) - if err != nil { - return nil, err - } - - configExists := false - if h.configPath != "" { - if _, err := os.Stat(h.configPath); err == nil { - configExists = true - } - } - - if !configExists { - for i := range cfg.ModelList { - cfg.ModelList[i].APIKey = "" - cfg.ModelList[i].AuthMethod = "" - } - } - - return cfg, nil -} - // handleGetConfig returns the complete system configuration. // // GET /api/config func (h *Handler) handleGetConfig(w http.ResponseWriter, r *http.Request) { - cfg, err := h.loadFilteredConfig() + cfg, err := config.LoadConfig(h.configPath) if err != nil { http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) return @@ -74,6 +48,9 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) { http.Error(w, fmt.Sprintf("Invalid JSON: %v", err), http.StatusBadRequest) return } + if execAllowRemoteOmitted(body) { + cfg.Tools.Exec.AllowRemote = config.DefaultConfig().Tools.Exec.AllowRemote + } if errs := validateConfig(&cfg); len(errs) > 0 { w.Header().Set("Content-Type", "application/json") @@ -94,6 +71,20 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) { json.NewEncoder(w).Encode(map[string]string{"status": "ok"}) } +func execAllowRemoteOmitted(body []byte) bool { + var raw struct { + Tools *struct { + Exec *struct { + AllowRemote *bool `json:"allow_remote"` + } `json:"exec"` + } `json:"tools"` + } + if err := json.Unmarshal(body, &raw); err != nil { + return false + } + return raw.Tools == nil || raw.Tools.Exec == nil || raw.Tools.Exec.AllowRemote == nil +} + // handlePatchConfig partially updates the system configuration using JSON Merge Patch (RFC 7396). // Only the fields present in the request body will be updated; all other fields remain unchanged. // diff --git a/web/backend/api/config_test.go b/web/backend/api/config_test.go new file mode 100644 index 000000000..29811e37e --- /dev/null +++ b/web/backend/api/config_test.go @@ -0,0 +1,88 @@ +package api + +import ( + "bytes" + "net/http" + "net/http/httptest" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestHandleUpdateConfig_PreservesExecAllowRemoteDefaultWhenOmitted(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + req := httptest.NewRequest(http.MethodPut, "/api/config", bytes.NewBufferString(`{ + "agents": { + "defaults": { + "workspace": "~/.picoclaw/workspace" + } + }, + "model_list": [ + { + "model_name": "custom-default", + "model": "openai/gpt-4o", + "api_key": "sk-default" + } + ] + }`)) + req.Header.Set("Content-Type", "application/json") + + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + if !cfg.Tools.Exec.AllowRemote { + t.Fatal("tools.exec.allow_remote should remain true when omitted from PUT /api/config") + } +} + +func TestHandleUpdateConfig_DoesNotInheritDefaultModelFields(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + req := httptest.NewRequest(http.MethodPut, "/api/config", bytes.NewBufferString(`{ + "agents": { + "defaults": { + "workspace": "~/.picoclaw/workspace" + } + }, + "model_list": [ + { + "model_name": "custom-default", + "model": "openai/gpt-4o", + "api_key": "sk-default" + } + ] + }`)) + req.Header.Set("Content-Type", "application/json") + + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + if got := cfg.ModelList[0].APIBase; got != "" { + t.Fatalf("model_list[0].api_base = %q, want empty string", got) + } +} diff --git a/web/backend/api/gateway.go b/web/backend/api/gateway.go index 8f86dd73d..41f702e32 100644 --- a/web/backend/api/gateway.go +++ b/web/backend/api/gateway.go @@ -10,7 +10,6 @@ import ( "net/http" "os" "os/exec" - "path/filepath" "runtime" "strconv" "strings" @@ -19,6 +18,7 @@ import ( "time" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/web/backend/utils" ) // gateway holds the state for the managed gateway process. @@ -36,6 +36,7 @@ var gateway = struct { func (h *Handler) registerGatewayRoutes(mux *http.ServeMux) { mux.HandleFunc("GET /api/gateway/status", h.handleGatewayStatus) mux.HandleFunc("GET /api/gateway/events", h.handleGatewayEvents) + mux.HandleFunc("POST /api/gateway/logs/clear", h.handleGatewayClearLogs) mux.HandleFunc("POST /api/gateway/start", h.handleGatewayStart) mux.HandleFunc("POST /api/gateway/stop", h.handleGatewayStop) mux.HandleFunc("POST /api/gateway/restart", h.handleGatewayRestart) @@ -89,11 +90,12 @@ func (h *Handler) gatewayStartReady() (bool, string, error) { return false, fmt.Sprintf("default model %q is invalid", modelName), nil } - hasCredential := strings.TrimSpace(modelCfg.APIKey) != "" || - strings.TrimSpace(modelCfg.AuthMethod) != "" - if !hasCredential { + if !hasModelConfiguration(*modelCfg) { return false, fmt.Sprintf("default model %q has no credentials configured", modelName), nil } + if requiresRuntimeProbe(*modelCfg) && !probeLocalModelAvailability(*modelCfg) { + return false, fmt.Sprintf("default model %q is not reachable", modelName), nil + } return true, "", nil } @@ -131,14 +133,18 @@ func isCmdProcessAliveLocked(cmd *exec.Cmd) bool { func (h *Handler) startGatewayLocked() (int, error) { // Locate the picoclaw executable - execPath := findPicoclawBinary() + execPath := utils.FindPicoclawBinary() cmd := exec.Command(execPath, "gateway") + cmd.Env = os.Environ() // Forward the launcher's config path via the environment variable that // GetConfigPath() already reads, so the gateway sub-process uses the same // config file without requiring a --config flag on the gateway subcommand. if h.configPath != "" { - cmd.Env = append(os.Environ(), "PICOCLAW_CONFIG="+h.configPath) + cmd.Env = append(cmd.Env, "PICOCLAW_CONFIG="+h.configPath) + } + if host := h.gatewayHostOverride(); host != "" { + cmd.Env = append(cmd.Env, "PICOCLAW_GATEWAY_HOST="+host) } stdoutPipe, err := cmd.StdoutPipe() @@ -207,10 +213,7 @@ func (h *Handler) startGatewayLocked() (int, error) { if err != nil { continue } - healthHost := "127.0.0.1" - if cfg.Gateway.Host != "" && cfg.Gateway.Host != "0.0.0.0" { - healthHost = cfg.Gateway.Host - } + healthHost := gatewayProbeHost(h.effectiveGatewayBindHost(cfg)) healthPort := cfg.Gateway.Port if healthPort == 0 { healthPort = 18790 @@ -353,6 +356,20 @@ func (h *Handler) handleGatewayRestart(w http.ResponseWriter, r *http.Request) { h.handleGatewayStart(w, r) } +// handleGatewayClearLogs clears the in-memory gateway log buffer. +// +// POST /api/gateway/logs/clear +func (h *Handler) handleGatewayClearLogs(w http.ResponseWriter, r *http.Request) { + gateway.logs.Clear() + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]any{ + "status": "cleared", + "log_total": 0, + "log_run_id": gateway.logs.RunID(), + }) +} + // handleGatewayStatus returns the gateway run status, health info, and logs. // // GET /api/gateway/status @@ -375,9 +392,7 @@ func (h *Handler) handleGatewayStatus(w http.ResponseWriter, r *http.Request) { host := "127.0.0.1" port := 18790 if err == nil && cfg != nil { - if cfg.Gateway.Host != "" && cfg.Gateway.Host != "0.0.0.0" { - host = cfg.Gateway.Host - } + host = gatewayProbeHost(h.effectiveGatewayBindHost(cfg)) if cfg.Gateway.Port != 0 { port = cfg.Gateway.Port } @@ -535,36 +550,6 @@ func (h *Handler) currentGatewayStatus() string { return string(encoded) } -// findPicoclawBinary locates the picoclaw executable. -// Search order: -// 1. PICOCLAW_BINARY environment variable (explicit override) -// 2. Same directory as the current executable -// 3. Falls back to "picoclaw" and relies on $PATH -func findPicoclawBinary() string { - binaryName := "picoclaw" - if runtime.GOOS == "windows" { - binaryName = "picoclaw.exe" - } - - // 1. Explicit override via environment variable - if p := os.Getenv("PICOCLAW_BINARY"); p != "" { - if info, _ := os.Stat(p); info != nil && !info.IsDir() { - return p - } - } - - // 2. Same directory as the launcher executable - if exe, err := os.Executable(); err == nil { - candidate := filepath.Join(filepath.Dir(exe), binaryName) - if info, err := os.Stat(candidate); err == nil && !info.IsDir() { - return candidate - } - } - - // 3. Fall back to PATH lookup - return "picoclaw" -} - // scanPipe reads lines from r and appends them to buf. Returns when r reaches EOF. func scanPipe(r io.Reader, buf *LogBuffer) { scanner := bufio.NewScanner(r) diff --git a/web/backend/api/gateway_host.go b/web/backend/api/gateway_host.go new file mode 100644 index 000000000..a499c1ea2 --- /dev/null +++ b/web/backend/api/gateway_host.go @@ -0,0 +1,66 @@ +package api + +import ( + "net" + "net/http" + "strconv" + "strings" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func (h *Handler) effectiveLauncherPublic() bool { + if h.serverPublicExplicit { + return h.serverPublic + } + + cfg, err := h.loadLauncherConfig() + if err == nil { + return cfg.Public + } + + return h.serverPublic +} + +func (h *Handler) gatewayHostOverride() string { + if h.effectiveLauncherPublic() { + return "0.0.0.0" + } + return "" +} + +func (h *Handler) effectiveGatewayBindHost(cfg *config.Config) string { + if override := h.gatewayHostOverride(); override != "" { + return override + } + if cfg == nil { + return "" + } + return strings.TrimSpace(cfg.Gateway.Host) +} + +func gatewayProbeHost(bindHost string) string { + if bindHost == "" || bindHost == "0.0.0.0" { + return "127.0.0.1" + } + return bindHost +} + +func requestHostName(r *http.Request) string { + reqHost, _, err := net.SplitHostPort(r.Host) + if err == nil { + return reqHost + } + if strings.TrimSpace(r.Host) != "" { + return r.Host + } + return "127.0.0.1" +} + +func (h *Handler) buildWsURL(r *http.Request, cfg *config.Config) string { + host := h.effectiveGatewayBindHost(cfg) + if host == "" || host == "0.0.0.0" { + host = requestHostName(r) + } + return "ws://" + net.JoinHostPort(host, strconv.Itoa(cfg.Gateway.Port)) + "/pico/ws" +} diff --git a/web/backend/api/gateway_host_test.go b/web/backend/api/gateway_host_test.go new file mode 100644 index 000000000..afd600359 --- /dev/null +++ b/web/backend/api/gateway_host_test.go @@ -0,0 +1,59 @@ +package api + +import ( + "net/http/httptest" + "path/filepath" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/web/backend/launcherconfig" +) + +func TestGatewayHostOverrideUsesExplicitRuntimePublic(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + launcherPath := launcherconfig.PathForAppConfig(configPath) + if err := launcherconfig.Save(launcherPath, launcherconfig.Config{ + Port: 18800, + Public: false, + }); err != nil { + t.Fatalf("launcherconfig.Save() error = %v", err) + } + + h := NewHandler(configPath) + h.SetServerOptions(18800, true, true, nil) + + if got := h.gatewayHostOverride(); got != "0.0.0.0" { + t.Fatalf("gatewayHostOverride() = %q, want %q", got, "0.0.0.0") + } +} + +func TestBuildWsURLUsesRequestHostWhenLauncherPublicSaved(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + launcherPath := launcherconfig.PathForAppConfig(configPath) + if err := launcherconfig.Save(launcherPath, launcherconfig.Config{ + Port: 18800, + Public: true, + }); err != nil { + t.Fatalf("launcherconfig.Save() error = %v", err) + } + + h := NewHandler(configPath) + h.SetServerOptions(18800, false, false, nil) + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "127.0.0.1" + cfg.Gateway.Port = 18790 + + req := httptest.NewRequest("GET", "http://launcher.local/api/pico/token", nil) + req.Host = "192.168.1.9:18800" + + if got := h.buildWsURL(req, cfg); got != "ws://192.168.1.9:18790/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "ws://192.168.1.9:18790/pico/ws") + } +} + +func TestGatewayProbeHostUsesLoopbackForWildcardBind(t *testing.T) { + if got := gatewayProbeHost("0.0.0.0"); got != "127.0.0.1" { + t.Fatalf("gatewayProbeHost() = %q, want %q", got, "127.0.0.1") + } +} diff --git a/web/backend/api/gateway_test.go b/web/backend/api/gateway_test.go index 998c133b5..c7fb4dbc8 100644 --- a/web/backend/api/gateway_test.go +++ b/web/backend/api/gateway_test.go @@ -6,10 +6,13 @@ import ( "net/http/httptest" "os" "path/filepath" + "strconv" "strings" "testing" + "github.com/sipeed/picoclaw/pkg/auth" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/web/backend/utils" ) func TestGatewayStartReady_NoDefaultModel(t *testing.T) { @@ -31,8 +34,9 @@ func TestGatewayStartReady_NoDefaultModel(t *testing.T) { func TestGatewayStartReady_InvalidDefaultModel(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "missing-model" - if err := config.SaveConfig(configPath, cfg); err != nil { + cfg.Agents.Defaults.ModelName = "missing-model" + err := config.SaveConfig(configPath, cfg) + if err != nil { t.Fatalf("SaveConfig() error = %v", err) } @@ -54,7 +58,8 @@ func TestGatewayStartReady_ValidDefaultModel(t *testing.T) { cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName cfg.ModelList[0].APIKey = "test-key" - if err := config.SaveConfig(configPath, cfg); err != nil { + err := config.SaveConfig(configPath, cfg) + if err != nil { t.Fatalf("SaveConfig() error = %v", err) } @@ -74,7 +79,8 @@ func TestGatewayStartReady_DefaultModelWithoutCredential(t *testing.T) { cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName cfg.ModelList[0].APIKey = "" cfg.ModelList[0].AuthMethod = "" - if err := config.SaveConfig(configPath, cfg); err != nil { + err := config.SaveConfig(configPath, cfg) + if err != nil { t.Fatalf("SaveConfig() error = %v", err) } @@ -91,6 +97,195 @@ func TestGatewayStartReady_DefaultModelWithoutCredential(t *testing.T) { } } +func TestGatewayStartReady_LocalModelWithoutAPIKey(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetModelProbeHooks(t) + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + return false + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "local-vllm", + Model: "vllm/custom-model", + APIBase: "http://localhost:8000/v1", + }} + cfg.Agents.Defaults.ModelName = "local-vllm" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if ready { + t.Fatalf("gatewayStartReady() ready = true, want false without a running local service") + } + if !strings.Contains(reason, "not reachable") { + t.Fatalf("gatewayStartReady() reason = %q, want contains %q", reason, "not reachable") + } +} + +func TestGatewayStartReady_LocalModelWithRunningService(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetModelProbeHooks(t) + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "local-vllm", + Model: "vllm/custom-model", + APIBase: "http://127.0.0.1:8000/v1", + }} + cfg.Agents.Defaults.ModelName = "local-vllm" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if !ready { + t.Fatalf("gatewayStartReady() ready = false, want true with a running local service (reason=%q)", reason) + } +} + +func TestGatewayStartReady_RemoteVLLMWithAPIKeyDoesNotProbe(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetModelProbeHooks(t) + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + t.Fatalf("unexpected OpenAI-compatible probe for %q (%q)", apiBase, modelID) + return false + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "remote-vllm", + Model: "vllm/custom-model", + APIBase: "https://models.example.com/v1", + APIKey: "remote-key", + }} + cfg.Agents.Defaults.ModelName = "remote-vllm" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if !ready { + t.Fatalf("gatewayStartReady() ready = false, want true for remote vllm with api key (reason=%q)", reason) + } +} + +func TestGatewayStartReady_LocalOllamaUsesDefaultProbeBase(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetModelProbeHooks(t) + + probeOllamaModelFunc = func(apiBase, modelID string) bool { + return apiBase == "http://localhost:11434/v1" && modelID == "llama3" + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "local-ollama", + Model: "ollama/llama3", + }} + cfg.Agents.Defaults.ModelName = "local-ollama" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if !ready { + t.Fatalf("gatewayStartReady() ready = false, want true with default Ollama probe base (reason=%q)", reason) + } +} + +func TestGatewayStartReady_OAuthModelRequiresStoredCredential(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "openai-oauth", + Model: "openai/gpt-5.2", + AuthMethod: "oauth", + }} + cfg.Agents.Defaults.ModelName = "openai-oauth" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if ready { + t.Fatalf("gatewayStartReady() ready = true, want false without stored credential") + } + if !strings.Contains(reason, "no credentials configured") { + t.Fatalf("gatewayStartReady() reason = %q, want contains %q", reason, "no credentials configured") + } + + err = auth.SetCredential(oauthProviderOpenAI, &auth.AuthCredential{ + AccessToken: "openai-token", + Provider: oauthProviderOpenAI, + AuthMethod: "oauth", + }) + if err != nil { + t.Fatalf("SetCredential() error = %v", err) + } + + ready, reason, err = h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if !ready { + t.Fatalf("gatewayStartReady() ready = false, want true with stored credential (reason=%q)", reason) + } +} + func TestGatewayStatusIncludesStartConditionWhenNotReady(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") h := NewHandler(configPath) @@ -122,6 +317,71 @@ func TestGatewayStatusIncludesStartConditionWhenNotReady(t *testing.T) { } } +func TestGatewayClearLogsResetsBufferedHistory(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + gateway.logs.Clear() + gateway.logs.Append("first line") + gateway.logs.Append("second line") + previousRunID := gateway.logs.RunID() + + clearRec := httptest.NewRecorder() + clearReq := httptest.NewRequest(http.MethodPost, "/api/gateway/logs/clear", nil) + mux.ServeHTTP(clearRec, clearReq) + + if clearRec.Code != http.StatusOK { + t.Fatalf("clear status = %d, want %d", clearRec.Code, http.StatusOK) + } + + var clearBody map[string]any + if err := json.Unmarshal(clearRec.Body.Bytes(), &clearBody); err != nil { + t.Fatalf("unmarshal clear response: %v", err) + } + + if got := clearBody["status"]; got != "cleared" { + t.Fatalf("clear status body = %#v, want %q", got, "cleared") + } + + clearRunID, ok := clearBody["log_run_id"].(float64) + if !ok { + t.Fatalf("log_run_id missing or not number: %#v", clearBody["log_run_id"]) + } + if int(clearRunID) <= previousRunID { + t.Fatalf("log_run_id = %d, want > %d", int(clearRunID), previousRunID) + } + + statusRec := httptest.NewRecorder() + statusReq := httptest.NewRequest( + http.MethodGet, + "/api/gateway/status?log_offset=0&log_run_id="+strconv.Itoa(previousRunID), + nil, + ) + mux.ServeHTTP(statusRec, statusReq) + + if statusRec.Code != http.StatusOK { + t.Fatalf("status code = %d, want %d", statusRec.Code, http.StatusOK) + } + + var statusBody map[string]any + if err := json.Unmarshal(statusRec.Body.Bytes(), &statusBody); err != nil { + t.Fatalf("unmarshal status response: %v", err) + } + + logs, ok := statusBody["logs"].([]any) + if !ok { + t.Fatalf("logs missing or not array: %#v", statusBody["logs"]) + } + if len(logs) != 0 { + t.Fatalf("logs len = %d, want 0", len(logs)) + } + if got := statusBody["log_total"]; got != float64(0) { + t.Fatalf("log_total = %#v, want 0", got) + } +} + func TestFindPicoclawBinary_EnvOverride(t *testing.T) { // Create a temporary file to act as the mock binary tmpDir := t.TempDir() @@ -132,9 +392,9 @@ func TestFindPicoclawBinary_EnvOverride(t *testing.T) { t.Setenv("PICOCLAW_BINARY", mockBinary) - got := findPicoclawBinary() + got := utils.FindPicoclawBinary() if got != mockBinary { - t.Errorf("findPicoclawBinary() = %q, want %q", got, mockBinary) + t.Errorf("FindPicoclawBinary() = %q, want %q", got, mockBinary) } } @@ -142,9 +402,9 @@ func TestFindPicoclawBinary_EnvOverride_InvalidPath(t *testing.T) { // When PICOCLAW_BINARY points to a non-existent path, fall through to next strategy t.Setenv("PICOCLAW_BINARY", "/nonexistent/picoclaw-binary") - got := findPicoclawBinary() + got := utils.FindPicoclawBinary() // Should not return the invalid path; falls back to "picoclaw" or another found path if got == "/nonexistent/picoclaw-binary" { - t.Errorf("findPicoclawBinary() returned invalid env path %q, expected fallback", got) + t.Errorf("FindPicoclawBinary() returned invalid env path %q, expected fallback", got) } } diff --git a/web/backend/api/launcher_config_test.go b/web/backend/api/launcher_config_test.go index 5049dd88f..0d6af823c 100644 --- a/web/backend/api/launcher_config_test.go +++ b/web/backend/api/launcher_config_test.go @@ -14,7 +14,7 @@ import ( func TestGetLauncherConfigUsesRuntimeFallback(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") h := NewHandler(configPath) - h.SetServerOptions(19999, true, []string{"192.168.1.0/24"}) + h.SetServerOptions(19999, true, false, []string{"192.168.1.0/24"}) mux := http.NewServeMux() h.RegisterRoutes(mux) diff --git a/web/backend/api/log.go b/web/backend/api/log.go index ecf7d422f..f83f6f34c 100644 --- a/web/backend/api/log.go +++ b/web/backend/api/log.go @@ -4,7 +4,7 @@ import "sync" // LogBuffer is a thread-safe ring buffer that stores the most recent N log lines. // It supports incremental reads via LinesSince and tracks a runID that increments -// on each Reset (used to detect gateway restarts). +// whenever the buffer is reset or cleared so clients can detect log history resets. type LogBuffer struct { mu sync.RWMutex lines []string @@ -45,6 +45,12 @@ func (b *LogBuffer) Reset() { b.runID++ } +// Clear removes all buffered lines and increments the runID so clients treat +// subsequent reads as a new log stream. +func (b *LogBuffer) Clear() { + b.Reset() +} + // LinesSince returns lines appended after the given offset, the current total count, and the runID. // If offset >= total, no lines are returned. If offset is too old (evicted), all buffered lines are returned. func (b *LogBuffer) LinesSince(offset int) (lines []string, total int, runID int) { diff --git a/web/backend/api/model_status.go b/web/backend/api/model_status.go new file mode 100644 index 000000000..22bf5c15b --- /dev/null +++ b/web/backend/api/model_status.go @@ -0,0 +1,324 @@ +package api + +import ( + "encoding/json" + "fmt" + "net" + "net/http" + "net/url" + "strings" + "time" + + "github.com/sipeed/picoclaw/pkg/config" +) + +const modelProbeTimeout = 800 * time.Millisecond + +var ( + probeTCPServiceFunc = probeTCPService + probeOllamaModelFunc = probeOllamaModel + probeOpenAICompatibleModelFunc = probeOpenAICompatibleModel +) + +func hasModelConfiguration(m config.ModelConfig) bool { + authMethod := strings.ToLower(strings.TrimSpace(m.AuthMethod)) + apiKey := strings.TrimSpace(m.APIKey) + + if authMethod == "oauth" || authMethod == "token" { + if provider, ok := oauthProviderForModel(m.Model); ok { + cred, err := oauthGetCredential(provider) + if err != nil || cred == nil { + return false + } + return strings.TrimSpace(cred.AccessToken) != "" || strings.TrimSpace(cred.RefreshToken) != "" + } + return true + } + + if requiresRuntimeProbe(m) { + return true + } + + return apiKey != "" +} + +// isModelConfigured reports whether a model is currently available to use. +// Local models must be reachable; remote/API-key models only need saved config. +func isModelConfigured(m config.ModelConfig) bool { + if !hasModelConfiguration(m) { + return false + } + if requiresRuntimeProbe(m) { + return probeLocalModelAvailability(m) + } + return true +} + +func requiresRuntimeProbe(m config.ModelConfig) bool { + authMethod := strings.ToLower(strings.TrimSpace(m.AuthMethod)) + if authMethod == "local" { + return true + } + + switch modelProtocol(m.Model) { + case "claude-cli", "claudecli", "codex-cli", "codexcli", "github-copilot", "copilot": + return true + case "ollama", "vllm": + apiBase := strings.TrimSpace(m.APIBase) + return apiBase == "" || hasLocalAPIBase(apiBase) + } + + if hasLocalAPIBase(m.APIBase) { + return true + } + + return false +} + +func probeLocalModelAvailability(m config.ModelConfig) bool { + apiBase := modelProbeAPIBase(m) + protocol, modelID := splitModel(m.Model) + switch protocol { + case "ollama": + return probeOllamaModelFunc(apiBase, modelID) + case "vllm": + return probeOpenAICompatibleModelFunc(apiBase, modelID) + case "github-copilot", "copilot": + return probeTCPServiceFunc(apiBase) + case "claude-cli", "claudecli", "codex-cli", "codexcli": + return true + default: + if hasLocalAPIBase(apiBase) { + return probeOpenAICompatibleModelFunc(apiBase, modelID) + } + return false + } +} + +func modelProbeAPIBase(m config.ModelConfig) string { + if apiBase := strings.TrimSpace(m.APIBase); apiBase != "" { + return normalizeModelProbeAPIBase(apiBase) + } + + switch modelProtocol(m.Model) { + case "ollama": + return "http://localhost:11434/v1" + case "vllm": + return "http://localhost:8000/v1" + case "github-copilot", "copilot": + return "localhost:4321" + default: + return "" + } +} + +func normalizeModelProbeAPIBase(raw string) string { + u, err := parseAPIBase(raw) + if err != nil { + return strings.TrimSpace(raw) + } + + switch strings.ToLower(u.Hostname()) { + case "0.0.0.0": + u.Host = net.JoinHostPort("127.0.0.1", u.Port()) + case "::": + u.Host = net.JoinHostPort("::1", u.Port()) + default: + return strings.TrimSpace(raw) + } + + if u.Port() == "" { + u.Host = u.Hostname() + } + + return u.String() +} + +func oauthProviderForModel(model string) (string, bool) { + switch modelProtocol(model) { + case "openai": + return oauthProviderOpenAI, true + case "anthropic": + return oauthProviderAnthropic, true + case "antigravity", "google-antigravity": + return oauthProviderGoogleAntigravity, true + default: + return "", false + } +} + +func modelProtocol(model string) string { + protocol, _ := splitModel(model) + return protocol +} + +func splitModel(model string) (protocol, modelID string) { + model = strings.ToLower(strings.TrimSpace(model)) + protocol, _, found := strings.Cut(model, "/") + if !found { + return "openai", model + } + return protocol, strings.TrimSpace(model[strings.Index(model, "/")+1:]) +} + +func hasLocalAPIBase(raw string) bool { + raw = strings.TrimSpace(raw) + if raw == "" { + return false + } + + u, err := url.Parse(raw) + if err != nil || u.Hostname() == "" { + u, err = url.Parse("//" + raw) + if err != nil { + return false + } + } + + switch strings.ToLower(u.Hostname()) { + case "localhost", "127.0.0.1", "::1", "0.0.0.0": + return true + default: + return false + } +} + +func probeTCPService(raw string) bool { + hostPort, err := hostPortFromAPIBase(raw) + if err != nil { + return false + } + + conn, err := net.DialTimeout("tcp", hostPort, modelProbeTimeout) + if err != nil { + return false + } + _ = conn.Close() + return true +} + +func probeOllamaModel(apiBase, modelID string) bool { + root, err := apiRootFromAPIBase(apiBase) + if err != nil { + return false + } + + var resp struct { + Models []struct { + Name string `json:"name"` + Model string `json:"model"` + } `json:"models"` + } + if err := getJSON(root+"/api/tags", &resp); err != nil { + return false + } + + for _, model := range resp.Models { + if ollamaModelMatches(model.Name, modelID) || ollamaModelMatches(model.Model, modelID) { + return true + } + } + return false +} + +func probeOpenAICompatibleModel(apiBase, modelID string) bool { + if strings.TrimSpace(apiBase) == "" { + return false + } + + var resp struct { + Data []struct { + ID string `json:"id"` + } `json:"data"` + } + if err := getJSON(strings.TrimRight(strings.TrimSpace(apiBase), "/")+"/models", &resp); err != nil { + return false + } + + for _, model := range resp.Data { + if strings.EqualFold(strings.TrimSpace(model.ID), modelID) { + return true + } + } + return false +} + +func getJSON(rawURL string, out any) error { + req, err := http.NewRequest(http.MethodGet, rawURL, nil) + if err != nil { + return err + } + + client := &http.Client{Timeout: modelProbeTimeout} + resp, err := client.Do(req) + if err != nil { + return err + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + return fmt.Errorf("unexpected status %d", resp.StatusCode) + } + + return json.NewDecoder(resp.Body).Decode(out) +} + +func apiRootFromAPIBase(raw string) (string, error) { + u, err := parseAPIBase(raw) + if err != nil { + return "", err + } + return (&url.URL{Scheme: u.Scheme, Host: u.Host}).String(), nil +} + +func hostPortFromAPIBase(raw string) (string, error) { + u, err := parseAPIBase(raw) + if err != nil { + return "", err + } + + if port := u.Port(); port != "" { + return u.Host, nil + } + switch strings.ToLower(u.Scheme) { + case "https": + return net.JoinHostPort(u.Hostname(), "443"), nil + default: + return net.JoinHostPort(u.Hostname(), "80"), nil + } +} + +func parseAPIBase(raw string) (*url.URL, error) { + raw = strings.TrimSpace(raw) + if raw == "" { + return nil, fmt.Errorf("empty api base") + } + + u, err := url.Parse(raw) + if err == nil && u.Hostname() != "" { + return u, nil + } + + u, err = url.Parse("//" + raw) + if err != nil || u.Hostname() == "" { + return nil, fmt.Errorf("invalid api base %q", raw) + } + if u.Scheme == "" { + u.Scheme = "http" + } + return u, nil +} + +func ollamaModelMatches(candidate, want string) bool { + candidate = strings.TrimSpace(candidate) + want = strings.TrimSpace(want) + if candidate == "" || want == "" { + return false + } + if strings.EqualFold(candidate, want) { + return true + } + + base, _, _ := strings.Cut(candidate, ":") + return strings.EqualFold(base, want) +} diff --git a/web/backend/api/models.go b/web/backend/api/models.go index cb57d6f2e..2e3f3dd55 100644 --- a/web/backend/api/models.go +++ b/web/backend/api/models.go @@ -6,6 +6,7 @@ import ( "io" "net/http" "strconv" + "sync" "github.com/sipeed/picoclaw/pkg/config" ) @@ -45,13 +46,24 @@ type modelResponse struct { // // GET /api/models func (h *Handler) handleListModels(w http.ResponseWriter, r *http.Request) { - cfg, err := h.loadFilteredConfig() + cfg, err := config.LoadConfig(h.configPath) if err != nil { http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) return } defaultModel := cfg.Agents.Defaults.GetModelName() + configured := make([]bool, len(cfg.ModelList)) + + var wg sync.WaitGroup + wg.Add(len(cfg.ModelList)) + for i, m := range cfg.ModelList { + go func(i int, m config.ModelConfig) { + defer wg.Done() + configured[i] = isModelConfigured(m) + }(i, m) + } + wg.Wait() models := make([]modelResponse, 0, len(cfg.ModelList)) for i, m := range cfg.ModelList { @@ -69,7 +81,7 @@ func (h *Handler) handleListModels(w http.ResponseWriter, r *http.Request) { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, - Configured: m.APIKey != "" || m.AuthMethod != "", + Configured: configured[i], IsDefault: m.ModelName == defaultModel, }) } @@ -212,9 +224,6 @@ func (h *Handler) handleDeleteModel(w http.ResponseWriter, r *http.Request) { if cfg.Agents.Defaults.ModelName == deletedModelName { cfg.Agents.Defaults.ModelName = "" } - if cfg.Agents.Defaults.Model == deletedModelName { - cfg.Agents.Defaults.Model = "" - } if err := config.SaveConfig(h.configPath, cfg); err != nil { http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) diff --git a/web/backend/api/models_test.go b/web/backend/api/models_test.go new file mode 100644 index 000000000..7061eb3f7 --- /dev/null +++ b/web/backend/api/models_test.go @@ -0,0 +1,313 @@ +package api + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "sync" + "testing" + "time" + + "github.com/sipeed/picoclaw/pkg/auth" + "github.com/sipeed/picoclaw/pkg/config" +) + +func resetModelProbeHooks(t *testing.T) { + t.Helper() + + origTCPProbe := probeTCPServiceFunc + origOllamaProbe := probeOllamaModelFunc + origOpenAIProbe := probeOpenAICompatibleModelFunc + t.Cleanup(func() { + probeTCPServiceFunc = origTCPProbe + probeOllamaModelFunc = origOllamaProbe + probeOpenAICompatibleModelFunc = origOpenAIProbe + }) +} + +func TestHandleListModels_ConfiguredStatusUsesRuntimeProbesForLocalModels(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetOAuthHooks(t) + resetModelProbeHooks(t) + + var mu sync.Mutex + var openAIProbes []string + var ollamaProbes []string + var tcpProbes []string + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + mu.Lock() + openAIProbes = append(openAIProbes, apiBase+"|"+modelID) + mu.Unlock() + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + } + probeOllamaModelFunc = func(apiBase, modelID string) bool { + mu.Lock() + ollamaProbes = append(ollamaProbes, apiBase+"|"+modelID) + mu.Unlock() + return apiBase == "http://localhost:11434/v1" && modelID == "llama3" + } + probeTCPServiceFunc = func(apiBase string) bool { + mu.Lock() + tcpProbes = append(tcpProbes, apiBase) + mu.Unlock() + return apiBase == "http://127.0.0.1:4321" + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{ + { + ModelName: "openai-oauth", + Model: "openai/gpt-5.2", + AuthMethod: "oauth", + }, + { + ModelName: "vllm-local", + Model: "vllm/custom-model", + APIBase: "http://127.0.0.1:8000/v1", + }, + { + ModelName: "ollama-default", + Model: "ollama/llama3", + }, + { + ModelName: "vllm-remote", + Model: "vllm/custom-model", + APIBase: "https://models.example.com/v1", + APIKey: "remote-key", + }, + { + ModelName: "copilot-gpt-5.2", + Model: "github-copilot/gpt-5.2", + APIBase: "http://127.0.0.1:4321", + AuthMethod: "oauth", + }, + } + cfg.Agents.Defaults.ModelName = "openai-oauth" + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/models", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp struct { + Models []modelResponse `json:"models"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + + got := make(map[string]bool, len(resp.Models)) + for _, model := range resp.Models { + got[model.ModelName] = model.Configured + } + + if got["openai-oauth"] { + t.Fatalf("openai oauth model configured = true, want false without stored credential") + } + if !got["vllm-local"] { + t.Fatalf("vllm local model configured = false, want true when local probe succeeds") + } + if !got["ollama-default"] { + t.Fatalf("ollama default model configured = false, want true when default local probe succeeds") + } + if !got["vllm-remote"] { + t.Fatalf("remote vllm model configured = false, want true with api_key") + } + if !got["copilot-gpt-5.2"] { + t.Fatalf("copilot model configured = false, want true when local bridge probe succeeds") + } + if len(openAIProbes) != 1 || openAIProbes[0] != "http://127.0.0.1:8000/v1|custom-model" { + t.Fatalf("openAI probes = %#v, want only local vllm probe", openAIProbes) + } + if len(ollamaProbes) != 1 || ollamaProbes[0] != "http://localhost:11434/v1|llama3" { + t.Fatalf("ollama probes = %#v, want default local probe", ollamaProbes) + } + if len(tcpProbes) != 1 || tcpProbes[0] != "http://127.0.0.1:4321" { + t.Fatalf("tcp probes = %#v, want only local copilot probe", tcpProbes) + } +} + +func TestHandleListModels_ConfiguredStatusForOAuthModelWithCredential(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetOAuthHooks(t) + resetModelProbeHooks(t) + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "claude-oauth", + Model: "anthropic/claude-sonnet-4.6", + AuthMethod: "oauth", + }} + cfg.Agents.Defaults.ModelName = "claude-oauth" + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + if err := auth.SetCredential(oauthProviderAnthropic, &auth.AuthCredential{ + AccessToken: "anthropic-token", + Provider: oauthProviderAnthropic, + AuthMethod: "oauth", + }); err != nil { + t.Fatalf("SetCredential() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/models", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp struct { + Models []modelResponse `json:"models"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(resp.Models) != 1 { + t.Fatalf("len(models) = %d, want 1", len(resp.Models)) + } + if !resp.Models[0].Configured { + t.Fatalf("oauth model configured = false, want true with stored credential") + } +} + +func TestHandleListModels_ProbesLocalModelsConcurrently(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetOAuthHooks(t) + resetModelProbeHooks(t) + + started := make(chan string, 2) + release := make(chan struct{}) + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + started <- apiBase + "|" + modelID + <-release + return true + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{ + { + ModelName: "local-vllm-a", + Model: "vllm/custom-a", + APIBase: "http://127.0.0.1:8000/v1", + }, + { + ModelName: "local-vllm-b", + Model: "vllm/custom-b", + APIBase: "http://127.0.0.1:8001/v1", + }, + } + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + recCh := make(chan *httptest.ResponseRecorder, 1) + go func() { + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/models", nil) + mux.ServeHTTP(rec, req) + recCh <- rec + }() + + for i := 0; i < 2; i++ { + select { + case <-started: + case <-time.After(200 * time.Millisecond): + t.Fatal("expected both local probes to start before the first one completed") + } + } + close(release) + + rec := <-recCh + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } +} + +func TestHandleListModels_NormalizesWildcardLocalAPIBaseForProbe(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetOAuthHooks(t) + resetModelProbeHooks(t) + + var gotProbe string + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + gotProbe = apiBase + "|" + modelID + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "vllm-local", + Model: "vllm/custom-model", + APIBase: "http://0.0.0.0:8000/v1", + }} + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/models", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp struct { + Models []modelResponse `json:"models"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(resp.Models) != 1 { + t.Fatalf("len(models) = %d, want 1", len(resp.Models)) + } + if !resp.Models[0].Configured { + t.Fatal("wildcard-bound local model configured = false, want true after probe host normalization") + } + if gotProbe != "http://127.0.0.1:8000/v1|custom-model" { + t.Fatalf("probe api base = %q, want %q", gotProbe, "http://127.0.0.1:8000/v1|custom-model") + } +} diff --git a/web/backend/api/oauth.go b/web/backend/api/oauth.go index 04cd595f2..e264c2900 100644 --- a/web/backend/api/oauth.go +++ b/web/backend/api/oauth.go @@ -744,17 +744,6 @@ func (h *Handler) syncProviderAuthMethod(provider, authMethod string) error { return err } - switch provider { - case oauthProviderOpenAI: - cfg.Providers.OpenAI.AuthMethod = authMethod - case oauthProviderAnthropic: - cfg.Providers.Anthropic.AuthMethod = authMethod - case oauthProviderGoogleAntigravity: - cfg.Providers.Antigravity.AuthMethod = authMethod - default: - return fmt.Errorf("unsupported provider %q", provider) - } - found := false for i := range cfg.ModelList { if modelBelongsToProvider(provider, cfg.ModelList[i].Model) { diff --git a/web/backend/api/oauth_test.go b/web/backend/api/oauth_test.go index 2103e1efc..78249be40 100644 --- a/web/backend/api/oauth_test.go +++ b/web/backend/api/oauth_test.go @@ -166,7 +166,6 @@ func TestOAuthLogoutClearsCredentialAndConfig(t *testing.T) { if err != nil { t.Fatalf("LoadConfig error: %v", err) } - cfg.Providers.OpenAI.AuthMethod = "oauth" cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ ModelName: "gpt-5.2", Model: "openai/gpt-5.2", @@ -208,9 +207,6 @@ func TestOAuthLogoutClearsCredentialAndConfig(t *testing.T) { if err != nil { t.Fatalf("LoadConfig error: %v", err) } - if updated.Providers.OpenAI.AuthMethod != "" { - t.Fatalf("providers.openai.auth_method = %q, want empty", updated.Providers.OpenAI.AuthMethod) - } for _, m := range updated.ModelList { if strings.HasPrefix(m.Model, "openai/") && m.AuthMethod != "" { t.Fatalf("openai model auth_method = %q, want empty", m.AuthMethod) diff --git a/web/backend/api/pico.go b/web/backend/api/pico.go index fc942d51c..a4590dcde 100644 --- a/web/backend/api/pico.go +++ b/web/backend/api/pico.go @@ -5,9 +5,7 @@ import ( "encoding/hex" "encoding/json" "fmt" - "net" "net/http" - "strconv" "time" "github.com/sipeed/picoclaw/pkg/config" @@ -30,7 +28,7 @@ func (h *Handler) handleGetPicoToken(w http.ResponseWriter, r *http.Request) { return } - wsURL := buildWsURL(r, cfg) + wsURL := h.buildWsURL(r, cfg) w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ @@ -58,7 +56,7 @@ func (h *Handler) handleRegenPicoToken(w http.ResponseWriter, r *http.Request) { return } - wsURL := fmt.Sprintf("ws://%s/pico/ws", net.JoinHostPort(cfg.Gateway.Host, strconv.Itoa(cfg.Gateway.Port))) + wsURL := h.buildWsURL(r, cfg) w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ @@ -123,7 +121,7 @@ func (h *Handler) handlePicoSetup(w http.ResponseWriter, r *http.Request) { return } - wsURL := buildWsURL(r, cfg) + wsURL := h.buildWsURL(r, cfg) w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ @@ -134,22 +132,6 @@ func (h *Handler) handlePicoSetup(w http.ResponseWriter, r *http.Request) { }) } -// buildWsURL creates a WebSocket URL for the Pico Channel. -// When the gateway host is "0.0.0.0" or empty, it uses the hostname from the -// incoming HTTP request so the browser gets a connectable address. -func buildWsURL(r *http.Request, cfg *config.Config) string { - host := cfg.Gateway.Host - if host == "" || host == "0.0.0.0" { - // Use the hostname the browser used to reach this backend - reqHost, _, err := net.SplitHostPort(r.Host) - if err != nil { - reqHost = r.Host // r.Host might not have a port - } - host = reqHost - } - return "ws://" + net.JoinHostPort(host, strconv.Itoa(cfg.Gateway.Port)) + "/pico/ws" -} - // generateSecureToken creates a random 32-character hex string. func generateSecureToken() string { b := make([]byte, 16) diff --git a/web/backend/api/router.go b/web/backend/api/router.go index c250724d1..5f081dee9 100644 --- a/web/backend/api/router.go +++ b/web/backend/api/router.go @@ -9,13 +9,14 @@ import ( // Handler serves HTTP API requests. type Handler struct { - configPath string - serverPort int - serverPublic bool - serverCIDRs []string - oauthMu sync.Mutex - oauthFlows map[string]*oauthFlow - oauthState map[string]string + configPath string + serverPort int + serverPublic bool + serverPublicExplicit bool + serverCIDRs []string + oauthMu sync.Mutex + oauthFlows map[string]*oauthFlow + oauthState map[string]string } // NewHandler creates an instance of the API handler. @@ -29,9 +30,10 @@ func NewHandler(configPath string) *Handler { } // SetServerOptions stores current backend listen options for fallback behavior. -func (h *Handler) SetServerOptions(port int, public bool, allowedCIDRs []string) { +func (h *Handler) SetServerOptions(port int, public bool, publicExplicit bool, allowedCIDRs []string) { h.serverPort = port h.serverPublic = public + h.serverPublicExplicit = publicExplicit h.serverCIDRs = append([]string(nil), allowedCIDRs...) } @@ -58,6 +60,10 @@ func (h *Handler) RegisterRoutes(mux *http.ServeMux) { // Channel catalog (for frontend navigation/config pages) h.registerChannelRoutes(mux) + // Skills and tools support/actions + h.registerSkillRoutes(mux) + h.registerToolRoutes(mux) + // OS startup / launch-at-login h.registerStartupRoutes(mux) diff --git a/web/backend/api/session.go b/web/backend/api/session.go index e3cf674fc..42d451a05 100644 --- a/web/backend/api/session.go +++ b/web/backend/api/session.go @@ -1,7 +1,9 @@ package api import ( + "bufio" "encoding/json" + "errors" "net/http" "os" "path/filepath" @@ -33,12 +35,22 @@ type sessionFile struct { // sessionListItem is a lightweight summary returned by GET /api/sessions. type sessionListItem struct { ID string `json:"id"` + Title string `json:"title"` Preview string `json:"preview"` MessageCount int `json:"message_count"` Created string `json:"created"` Updated string `json:"updated"` } +type sessionMetaFile struct { + Key string `json:"key"` + Summary string `json:"summary"` + Skip int `json:"skip"` + Count int `json:"count"` + CreatedAt time.Time `json:"created_at"` + UpdatedAt time.Time `json:"updated_at"` +} + // picoSessionPrefix is the key prefix used by the gateway's routing for Pico // channel sessions. The full key format is: // @@ -47,7 +59,12 @@ type sessionListItem struct { // The sanitized filename replaces ':' with '_', so on disk it becomes: // // agent_main_pico_direct_pico_.json -const picoSessionPrefix = "agent:main:pico:direct:pico:" +const ( + picoSessionPrefix = "agent:main:pico:direct:pico:" + sanitizedPicoSessionPrefix = "agent_main_pico_direct_pico_" + maxSessionJSONLLineSize = 10 * 1024 * 1024 // 10 MB + maxSessionTitleRunes = 60 +) // extractPicoSessionID extracts the session UUID from a full session key. // Returns the UUID and true if the key matches the Pico session pattern. @@ -58,6 +75,178 @@ func extractPicoSessionID(key string) (string, bool) { return "", false } +func extractPicoSessionIDFromSanitizedKey(key string) (string, bool) { + if strings.HasPrefix(key, sanitizedPicoSessionPrefix) { + return strings.TrimPrefix(key, sanitizedPicoSessionPrefix), true + } + return "", false +} + +func sanitizeSessionKey(key string) string { + return strings.ReplaceAll(key, ":", "_") +} + +func (h *Handler) readLegacySession(dir, sessionID string) (sessionFile, error) { + path := filepath.Join(dir, sanitizeSessionKey(picoSessionPrefix+sessionID)+".json") + data, err := os.ReadFile(path) + if err != nil { + return sessionFile{}, err + } + + var sess sessionFile + if err := json.Unmarshal(data, &sess); err != nil { + return sessionFile{}, err + } + return sess, nil +} + +func (h *Handler) readSessionMeta(path, sessionKey string) (sessionMetaFile, error) { + data, err := os.ReadFile(path) + if os.IsNotExist(err) { + return sessionMetaFile{Key: sessionKey}, nil + } + if err != nil { + return sessionMetaFile{}, err + } + + var meta sessionMetaFile + if err := json.Unmarshal(data, &meta); err != nil { + return sessionMetaFile{}, err + } + if meta.Key == "" { + meta.Key = sessionKey + } + return meta, nil +} + +func (h *Handler) readSessionMessages(path string, skip int) ([]providers.Message, error) { + f, err := os.Open(path) + if err != nil { + return nil, err + } + defer f.Close() + + msgs := make([]providers.Message, 0) + scanner := bufio.NewScanner(f) + scanner.Buffer(make([]byte, 0, 64*1024), maxSessionJSONLLineSize) + + seen := 0 + for scanner.Scan() { + line := scanner.Bytes() + if len(line) == 0 { + continue + } + + seen++ + if seen <= skip { + continue + } + + var msg providers.Message + if err := json.Unmarshal(line, &msg); err != nil { + continue + } + msgs = append(msgs, msg) + } + if err := scanner.Err(); err != nil { + return nil, err + } + return msgs, nil +} + +func (h *Handler) readJSONLSession(dir, sessionID string) (sessionFile, error) { + sessionKey := picoSessionPrefix + sessionID + base := filepath.Join(dir, sanitizeSessionKey(sessionKey)) + jsonlPath := base + ".jsonl" + metaPath := base + ".meta.json" + + meta, err := h.readSessionMeta(metaPath, sessionKey) + if err != nil { + return sessionFile{}, err + } + + messages, err := h.readSessionMessages(jsonlPath, meta.Skip) + if err != nil { + return sessionFile{}, err + } + + updated := meta.UpdatedAt + created := meta.CreatedAt + if created.IsZero() || updated.IsZero() { + if info, statErr := os.Stat(jsonlPath); statErr == nil { + if created.IsZero() { + created = info.ModTime() + } + if updated.IsZero() { + updated = info.ModTime() + } + } + } + + return sessionFile{ + Key: meta.Key, + Messages: messages, + Summary: meta.Summary, + Created: created, + Updated: updated, + }, nil +} + +func buildSessionListItem(sessionID string, sess sessionFile) sessionListItem { + preview := "" + for _, msg := range sess.Messages { + if msg.Role == "user" && strings.TrimSpace(msg.Content) != "" { + preview = msg.Content + break + } + } + title := strings.TrimSpace(sess.Summary) + if title == "" { + title = preview + } + + title = truncateRunes(title, maxSessionTitleRunes) + preview = truncateRunes(preview, maxSessionTitleRunes) + + if preview == "" { + preview = "(empty)" + } + if title == "" { + title = preview + } + + validMessageCount := 0 + for _, msg := range sess.Messages { + if (msg.Role == "user" || msg.Role == "assistant") && strings.TrimSpace(msg.Content) != "" { + validMessageCount++ + } + } + + return sessionListItem{ + ID: sessionID, + Title: title, + Preview: preview, + MessageCount: validMessageCount, + Created: sess.Created.Format(time.RFC3339), + Updated: sess.Updated.Format(time.RFC3339), + } +} + +func isEmptySession(sess sessionFile) bool { + return len(sess.Messages) == 0 && strings.TrimSpace(sess.Summary) == "" +} + +func truncateRunes(s string, maxLen int) string { + if maxLen <= 0 { + return "" + } + runes := []rune(strings.TrimSpace(s)) + if len(runes) <= maxLen { + return string(runes) + } + return string(runes[:maxLen]) + "..." +} + // sessionsDir resolves the path to the gateway's session storage directory. // It reads the workspace from config, falling back to ~/.picoclaw/workspace. func (h *Handler) sessionsDir() (string, error) { @@ -104,58 +293,76 @@ func (h *Handler) handleListSessions(w http.ResponseWriter, r *http.Request) { } items := []sessionListItem{} + seen := make(map[string]struct{}) for _, entry := range entries { - if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" { + if entry.IsDir() { continue } - data, err := os.ReadFile(filepath.Join(dir, entry.Name())) - if err != nil { - continue - } + name := entry.Name() + var ( + sessionID string + sess sessionFile + loadErr error + ok bool + ) - var sess sessionFile - if err := json.Unmarshal(data, &sess); err != nil { - continue - } - - // Only include Pico channel sessions - sessionID, ok := extractPicoSessionID(sess.Key) - if !ok { - continue - } - - // Build a preview from the first user message - preview := "" - for _, msg := range sess.Messages { - if msg.Role == "user" && strings.TrimSpace(msg.Content) != "" { - preview = msg.Content - break + switch { + case strings.HasSuffix(name, ".jsonl"): + sessionID, ok = extractPicoSessionIDFromSanitizedKey(strings.TrimSuffix(name, ".jsonl")) + if !ok { + continue } - } - if len([]rune(preview)) > 60 { - preview = string([]rune(preview)[:60]) + "..." - } - if preview == "" { - preview = "(empty)" - } - - // Only count non-empty user and assistant messages - validMessageCount := 0 - for _, msg := range sess.Messages { - if (msg.Role == "user" || msg.Role == "assistant") && strings.TrimSpace(msg.Content) != "" { - validMessageCount++ + sess, loadErr = h.readJSONLSession(dir, sessionID) + if loadErr == nil && isEmptySession(sess) { + continue } + case strings.HasSuffix(name, ".meta.json"): + continue + case filepath.Ext(name) == ".json": + base := strings.TrimSuffix(name, ".json") + if _, statErr := os.Stat(filepath.Join(dir, base+".jsonl")); statErr == nil { + if jsonlSessionID, found := extractPicoSessionIDFromSanitizedKey(base); found { + if jsonlSess, jsonlErr := h.readJSONLSession( + dir, + jsonlSessionID, + ); jsonlErr == nil && + !isEmptySession(jsonlSess) { + continue + } + } + } + data, err := os.ReadFile(filepath.Join(dir, name)) + if err != nil { + continue + } + if err := json.Unmarshal(data, &sess); err != nil { + continue + } + if isEmptySession(sess) { + continue + } + sessionID, ok = extractPicoSessionID(sess.Key) + if !ok { + continue + } + if _, exists := seen[sessionID]; exists { + continue + } + default: + continue } - items = append(items, sessionListItem{ - ID: sessionID, - Preview: preview, - MessageCount: validMessageCount, - Created: sess.Created.Format(time.RFC3339), - Updated: sess.Updated.Format(time.RFC3339), - }) + if loadErr != nil { + continue + } + if _, exists := seen[sessionID]; exists { + continue + } + + seen[sessionID] = struct{}{} + items = append(items, buildSessionListItem(sessionID, sess)) } // Sort by updated descending (most recent first) @@ -209,20 +416,25 @@ func (h *Handler) handleGetSession(w http.ResponseWriter, r *http.Request) { return } - // The sanitized filename replaces ':' with '_': - // agent:main:pico:direct:pico: -> agent_main_pico_direct_pico_.json - filename := strings.ReplaceAll(picoSessionPrefix+sessionID, ":", "_") + ".json" - - data, err := os.ReadFile(filepath.Join(dir, filename)) - if err != nil { - http.Error(w, "session not found", http.StatusNotFound) - return + sess, err := h.readJSONLSession(dir, sessionID) + if err == nil && isEmptySession(sess) { + err = os.ErrNotExist } - - var sess sessionFile - if err := json.Unmarshal(data, &sess); err != nil { - http.Error(w, "failed to parse session", http.StatusInternalServerError) - return + if err != nil { + if errors.Is(err, os.ErrNotExist) { + sess, err = h.readLegacySession(dir, sessionID) + if err == nil && isEmptySession(sess) { + err = os.ErrNotExist + } + } + if err != nil { + if errors.Is(err, os.ErrNotExist) { + http.Error(w, "session not found", http.StatusNotFound) + } else { + http.Error(w, "failed to parse session", http.StatusInternalServerError) + } + return + } } // Convert to a simpler format for the frontend @@ -268,17 +480,25 @@ func (h *Handler) handleDeleteSession(w http.ResponseWriter, r *http.Request) { return } - // The sanitized filename replaces ':' with '_': - // agent:main:pico:direct:pico: -> agent_main_pico_direct_pico_.json - filename := strings.ReplaceAll(picoSessionPrefix+sessionID, ":", "_") + ".json" - filePath := filepath.Join(dir, filename) + base := filepath.Join(dir, sanitizeSessionKey(picoSessionPrefix+sessionID)) + jsonlPath := base + ".jsonl" + metaPath := base + ".meta.json" + legacyPath := base + ".json" - if err := os.Remove(filePath); err != nil { - if os.IsNotExist(err) { - http.Error(w, "session not found", http.StatusNotFound) - } else { + removed := false + for _, path := range []string{jsonlPath, metaPath, legacyPath} { + if err := os.Remove(path); err != nil { + if os.IsNotExist(err) { + continue + } http.Error(w, "failed to delete session", http.StatusInternalServerError) + return } + removed = true + } + + if !removed { + http.Error(w, "session not found", http.StatusNotFound) return } diff --git a/web/backend/api/session_test.go b/web/backend/api/session_test.go new file mode 100644 index 000000000..21ef5b5b8 --- /dev/null +++ b/web/backend/api/session_test.go @@ -0,0 +1,322 @@ +package api + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/memory" + "github.com/sipeed/picoclaw/pkg/providers" + "github.com/sipeed/picoclaw/pkg/session" +) + +func sessionsTestDir(t *testing.T, configPath string) string { + t.Helper() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + + dir := filepath.Join(cfg.Agents.Defaults.Workspace, "sessions") + if err := os.MkdirAll(dir, 0o755); err != nil { + t.Fatalf("MkdirAll() error = %v", err) + } + return dir +} + +func TestHandleListSessions_JSONLStorage(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + store, err := memory.NewJSONLStore(dir) + if err != nil { + t.Fatalf("NewJSONLStore() error = %v", err) + } + + sessionKey := picoSessionPrefix + "history-jsonl" + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "user", + Content: "Explain why the history API is empty after migration.", + }); err != nil { + t.Fatalf("AddFullMessage(user) error = %v", err) + } + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "assistant", + Content: "Because the API still reads only legacy JSON session files.", + }); err != nil { + t.Fatalf("AddFullMessage(assistant) error = %v", err) + } + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "tool", + Content: "ignored", + }); err != nil { + t.Fatalf("AddFullMessage(tool) error = %v", err) + } + if err := store.SetSummary(nil, sessionKey, "JSONL-backed session"); err != nil { + t.Fatalf("SetSummary() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/sessions", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var items []sessionListItem + if err := json.Unmarshal(rec.Body.Bytes(), &items); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(items) != 1 { + t.Fatalf("len(items) = %d, want 1", len(items)) + } + if items[0].ID != "history-jsonl" { + t.Fatalf("items[0].ID = %q, want %q", items[0].ID, "history-jsonl") + } + if items[0].MessageCount != 2 { + t.Fatalf("items[0].MessageCount = %d, want 2", items[0].MessageCount) + } + if items[0].Title != "JSONL-backed session" { + t.Fatalf("items[0].Title = %q, want %q", items[0].Title, "JSONL-backed session") + } + if items[0].Preview != "Explain why the history API is empty after migration." { + t.Fatalf("items[0].Preview = %q", items[0].Preview) + } +} + +func TestHandleListSessions_TitleUsesTrimmedSummary(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + store, err := memory.NewJSONLStore(dir) + if err != nil { + t.Fatalf("NewJSONLStore() error = %v", err) + } + + sessionKey := picoSessionPrefix + "summary-title" + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "user", + Content: "fallback preview", + }); err != nil { + t.Fatalf("AddFullMessage() error = %v", err) + } + if err := store.SetSummary( + nil, + sessionKey, + " This summary is intentionally longer than sixty characters so it must be truncated in the history menu. ", + ); err != nil { + t.Fatalf("SetSummary() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/sessions", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var items []sessionListItem + if err := json.Unmarshal(rec.Body.Bytes(), &items); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(items) != 1 { + t.Fatalf("len(items) = %d, want 1", len(items)) + } + expectedTitle := truncateRunes( + "This summary is intentionally longer than sixty characters so it must be truncated in the history menu.", + maxSessionTitleRunes, + ) + if items[0].Title != expectedTitle { + t.Fatalf("items[0].Title = %q", items[0].Title) + } + if items[0].Preview != "fallback preview" { + t.Fatalf("items[0].Preview = %q, want %q", items[0].Preview, "fallback preview") + } +} + +func TestHandleGetSession_JSONLStorage(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + store, err := memory.NewJSONLStore(dir) + if err != nil { + t.Fatalf("NewJSONLStore() error = %v", err) + } + + sessionKey := picoSessionPrefix + "detail-jsonl" + for _, msg := range []providers.Message{ + {Role: "user", Content: "first"}, + {Role: "assistant", Content: "second"}, + {Role: "tool", Content: "ignored"}, + } { + if err := store.AddFullMessage(nil, sessionKey, msg); err != nil { + t.Fatalf("AddFullMessage() error = %v", err) + } + } + if err := store.SetSummary(nil, sessionKey, "detail summary"); err != nil { + t.Fatalf("SetSummary() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/sessions/detail-jsonl", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp struct { + ID string `json:"id"` + Summary string `json:"summary"` + Messages []struct { + Role string `json:"role"` + Content string `json:"content"` + } `json:"messages"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if resp.ID != "detail-jsonl" { + t.Fatalf("resp.ID = %q, want %q", resp.ID, "detail-jsonl") + } + if resp.Summary != "detail summary" { + t.Fatalf("resp.Summary = %q, want %q", resp.Summary, "detail summary") + } + if len(resp.Messages) != 2 { + t.Fatalf("len(resp.Messages) = %d, want 2", len(resp.Messages)) + } + if resp.Messages[0].Role != "user" || resp.Messages[0].Content != "first" { + t.Fatalf("first message = %#v, want user/first", resp.Messages[0]) + } + if resp.Messages[1].Role != "assistant" || resp.Messages[1].Content != "second" { + t.Fatalf("second message = %#v, want assistant/second", resp.Messages[1]) + } +} + +func TestHandleDeleteSession_JSONLStorage(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + store, err := memory.NewJSONLStore(dir) + if err != nil { + t.Fatalf("NewJSONLStore() error = %v", err) + } + + sessionKey := picoSessionPrefix + "delete-jsonl" + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "user", + Content: "delete me", + }); err != nil { + t.Fatalf("AddFullMessage() error = %v", err) + } + if err := store.SetSummary(nil, sessionKey, "delete summary"); err != nil { + t.Fatalf("SetSummary() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodDelete, "/api/sessions/delete-jsonl", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusNoContent { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusNoContent, rec.Body.String()) + } + + base := filepath.Join(dir, sanitizeSessionKey(sessionKey)) + for _, path := range []string{base + ".jsonl", base + ".meta.json"} { + if _, err := os.Stat(path); !os.IsNotExist(err) { + t.Fatalf("expected %s to be removed, stat err = %v", path, err) + } + } +} + +func TestHandleGetSession_LegacyJSONFallback(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + manager := session.NewSessionManager(dir) + sessionKey := picoSessionPrefix + "legacy-json" + manager.AddMessage(sessionKey, "user", "legacy user") + manager.AddMessage(sessionKey, "assistant", "legacy assistant") + if err := manager.Save(sessionKey); err != nil { + t.Fatalf("Save() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/sessions/legacy-json", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } +} + +func TestHandleSessions_FiltersEmptyJSONLFiles(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + base := filepath.Join(dir, sanitizeSessionKey(picoSessionPrefix+"empty-jsonl")) + if err := os.WriteFile(base+".jsonl", []byte{}, 0o644); err != nil { + t.Fatalf("WriteFile(jsonl) error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + listRec := httptest.NewRecorder() + listReq := httptest.NewRequest(http.MethodGet, "/api/sessions", nil) + mux.ServeHTTP(listRec, listReq) + + if listRec.Code != http.StatusOK { + t.Fatalf("list status = %d, want %d, body=%s", listRec.Code, http.StatusOK, listRec.Body.String()) + } + + var items []sessionListItem + if err := json.Unmarshal(listRec.Body.Bytes(), &items); err != nil { + t.Fatalf("Unmarshal(list) error = %v", err) + } + if len(items) != 0 { + t.Fatalf("len(items) = %d, want 0", len(items)) + } + + detailRec := httptest.NewRecorder() + detailReq := httptest.NewRequest(http.MethodGet, "/api/sessions/empty-jsonl", nil) + mux.ServeHTTP(detailRec, detailReq) + + if detailRec.Code != http.StatusNotFound { + t.Fatalf("detail status = %d, want %d, body=%s", detailRec.Code, http.StatusNotFound, detailRec.Body.String()) + } +} diff --git a/web/backend/api/skills.go b/web/backend/api/skills.go new file mode 100644 index 000000000..936074fee --- /dev/null +++ b/web/backend/api/skills.go @@ -0,0 +1,331 @@ +package api + +import ( + "encoding/json" + "fmt" + "io" + "net/http" + "os" + "path/filepath" + "regexp" + "strings" + + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/skills" +) + +type skillSupportResponse struct { + Skills []skills.SkillInfo `json:"skills"` +} + +type skillDetailResponse struct { + Name string `json:"name"` + Path string `json:"path"` + Source string `json:"source"` + Description string `json:"description"` + Content string `json:"content"` +} + +var ( + skillNameSanitizer = regexp.MustCompile(`[^a-z0-9-]+`) + importedSkillFrontmatter = regexp.MustCompile(`(?s)^---(?:\r\n|\n|\r)(.*?)(?:\r\n|\n|\r)---(?:\r\n|\n|\r)*`) + skillFrontmatterStripper = regexp.MustCompile(`(?s)^---(?:\r\n|\n|\r)(.*?)(?:\r\n|\n|\r)---(?:\r\n|\n|\r)*`) +) + +func (h *Handler) registerSkillRoutes(mux *http.ServeMux) { + mux.HandleFunc("GET /api/skills", h.handleListSkills) + mux.HandleFunc("GET /api/skills/{name}", h.handleGetSkill) + mux.HandleFunc("POST /api/skills/import", h.handleImportSkill) + mux.HandleFunc("DELETE /api/skills/{name}", h.handleDeleteSkill) +} + +func (h *Handler) handleListSkills(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + loader := newSkillsLoader(cfg.WorkspacePath()) + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(skillSupportResponse{ + Skills: loader.ListSkills(), + }) +} + +func (h *Handler) handleGetSkill(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + loader := newSkillsLoader(cfg.WorkspacePath()) + name := r.PathValue("name") + allSkills := loader.ListSkills() + + for _, skill := range allSkills { + if skill.Name != name { + continue + } + + content, err := loadSkillContent(skill.Path) + if err != nil { + http.Error(w, "Skill content not found", http.StatusNotFound) + return + } + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(skillDetailResponse{ + Name: skill.Name, + Path: skill.Path, + Source: skill.Source, + Description: skill.Description, + Content: content, + }) + return + } + + http.Error(w, "Skill not found", http.StatusNotFound) +} + +func (h *Handler) handleImportSkill(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + err = r.ParseMultipartForm(2 << 20) + if err != nil { + http.Error(w, fmt.Sprintf("Invalid multipart form: %v", err), http.StatusBadRequest) + return + } + + uploadedFile, fileHeader, err := r.FormFile("file") + if err != nil { + http.Error(w, "file is required", http.StatusBadRequest) + return + } + defer uploadedFile.Close() + + content, err := io.ReadAll(io.LimitReader(uploadedFile, (1<<20)+1)) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to read file: %v", err), http.StatusBadRequest) + return + } + if len(content) > 1<<20 { + http.Error(w, "file exceeds 1MB limit", http.StatusBadRequest) + return + } + + skillName, err := normalizeImportedSkillName(fileHeader.Filename, content) + if err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + content = normalizeImportedSkillContent(content, skillName) + + workspace := cfg.WorkspacePath() + skillDir := filepath.Join(workspace, "skills", skillName) + skillFile := filepath.Join(skillDir, "SKILL.md") + if _, err := os.Stat(skillDir); err == nil { + http.Error(w, "skill already exists", http.StatusConflict) + return + } + + if err := os.MkdirAll(skillDir, 0o755); err != nil { + http.Error(w, fmt.Sprintf("Failed to create skill directory: %v", err), http.StatusInternalServerError) + return + } + if err := os.WriteFile(skillFile, content, 0o644); err != nil { + http.Error(w, fmt.Sprintf("Failed to save skill: %v", err), http.StatusInternalServerError) + return + } + + loader := newSkillsLoader(workspace) + for _, skill := range loader.ListSkills() { + if skill.Path == skillFile || (skill.Name == skillName && skill.Source == "workspace") { + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(skill) + return + } + } + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]string{ + "name": skillName, + "path": skillFile, + }) +} + +func (h *Handler) handleDeleteSkill(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + loader := newSkillsLoader(cfg.WorkspacePath()) + name := r.PathValue("name") + for _, skill := range loader.ListSkills() { + if skill.Name != name { + continue + } + if skill.Source != "workspace" { + http.Error(w, "only workspace skills can be deleted", http.StatusBadRequest) + return + } + if err := os.RemoveAll(filepath.Dir(skill.Path)); err != nil { + http.Error(w, fmt.Sprintf("Failed to delete skill: %v", err), http.StatusInternalServerError) + return + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]string{"status": "ok"}) + return + } + + http.Error(w, "Skill not found", http.StatusNotFound) +} + +func newSkillsLoader(workspace string) *skills.SkillsLoader { + return skills.NewSkillsLoader( + workspace, + filepath.Join(globalConfigDir(), "skills"), + builtinSkillsDir(), + ) +} + +func normalizeImportedSkillName(filename string, content []byte) (string, error) { + rawContent := strings.ReplaceAll(string(content), "\r\n", "\n") + rawContent = strings.ReplaceAll(rawContent, "\r", "\n") + metadata, _ := extractImportedSkillMetadata(rawContent) + + raw := strings.TrimSpace(metadata["name"]) + if raw == "" { + raw = strings.TrimSpace(strings.TrimSuffix(filepath.Base(filename), filepath.Ext(filename))) + } + raw = strings.ToLower(raw) + raw = strings.ReplaceAll(raw, "_", "-") + raw = strings.ReplaceAll(raw, " ", "-") + raw = skillNameSanitizer.ReplaceAllString(raw, "-") + raw = strings.Trim(raw, "-") + raw = strings.Join(strings.FieldsFunc(raw, func(r rune) bool { return r == '-' }), "-") + + if raw == "" { + return "", fmt.Errorf("skill name is required in frontmatter or filename") + } + if len(raw) > 64 { + return "", fmt.Errorf("skill name exceeds 64 characters") + } + matched, err := regexp.MatchString(`^[a-z0-9]+(-[a-z0-9]+)*$`, raw) + if err != nil || !matched { + return "", fmt.Errorf("skill name must be alphanumeric with hyphens") + } + return raw, nil +} + +func normalizeImportedSkillContent(content []byte, skillName string) []byte { + raw := strings.ReplaceAll(string(content), "\r\n", "\n") + raw = strings.ReplaceAll(raw, "\r", "\n") + + metadata, body := extractImportedSkillMetadata(raw) + description := strings.TrimSpace(metadata["description"]) + if description == "" { + description = inferImportedSkillDescription(body) + } + if description == "" { + description = "Imported skill" + } + if len(description) > 1024 { + description = strings.TrimSpace(description[:1024]) + } + + body = strings.TrimLeft(body, "\n") + var builder strings.Builder + builder.WriteString("---\n") + builder.WriteString("name: ") + builder.WriteString(skillName) + builder.WriteString("\n") + builder.WriteString("description: ") + builder.WriteString(description) + builder.WriteString("\n") + builder.WriteString("---\n\n") + builder.WriteString(body) + if !strings.HasSuffix(builder.String(), "\n") { + builder.WriteString("\n") + } + return []byte(builder.String()) +} + +func extractImportedSkillMetadata(raw string) (map[string]string, string) { + matches := importedSkillFrontmatter.FindStringSubmatch(raw) + if len(matches) != 2 { + return map[string]string{}, raw + } + meta := parseImportedSkillYAML(matches[1]) + body := importedSkillFrontmatter.ReplaceAllString(raw, "") + return meta, body +} + +func parseImportedSkillYAML(frontmatter string) map[string]string { + result := make(map[string]string) + for _, line := range strings.Split(frontmatter, "\n") { + line = strings.TrimSpace(line) + if line == "" || strings.HasPrefix(line, "#") { + continue + } + key, value, ok := strings.Cut(line, ":") + if !ok { + continue + } + result[strings.TrimSpace(key)] = strings.Trim(strings.TrimSpace(value), `"'`) + } + return result +} + +func inferImportedSkillDescription(body string) string { + for _, line := range strings.Split(body, "\n") { + line = strings.TrimSpace(line) + if line == "" { + continue + } + line = strings.TrimLeft(line, "#-*0123456789. ") + line = strings.TrimSpace(line) + if line != "" { + return line + } + } + return "" +} + +func loadSkillContent(path string) (string, error) { + content, err := os.ReadFile(path) + if err != nil { + return "", err + } + return skillFrontmatterStripper.ReplaceAllString(string(content), ""), nil +} + +func globalConfigDir() string { + if home := os.Getenv("PICOCLAW_HOME"); home != "" { + return home + } + home, err := os.UserHomeDir() + if err != nil { + return "" + } + return filepath.Join(home, ".picoclaw") +} + +func builtinSkillsDir() string { + if path := os.Getenv("PICOCLAW_BUILTIN_SKILLS"); path != "" { + return path + } + wd, err := os.Getwd() + if err != nil { + return "" + } + return filepath.Join(wd, "skills") +} diff --git a/web/backend/api/skills_test.go b/web/backend/api/skills_test.go new file mode 100644 index 000000000..3289d5b33 --- /dev/null +++ b/web/backend/api/skills_test.go @@ -0,0 +1,336 @@ +package api + +import ( + "bytes" + "encoding/json" + "io" + "mime/multipart" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestHandleListSkills(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + if err := os.MkdirAll(filepath.Join(workspace, "skills", "workspace-skill"), 0o755); err != nil { + t.Fatalf("MkdirAll(workspace skill) error = %v", err) + } + if err := os.WriteFile( + filepath.Join(workspace, "skills", "workspace-skill", "SKILL.md"), + []byte("---\nname: workspace-skill\ndescription: Workspace skill\n---\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile(workspace skill) error = %v", err) + } + + globalSkillDir := filepath.Join(globalConfigDir(), "skills", "global-skill") + if err := os.MkdirAll(globalSkillDir, 0o755); err != nil { + t.Fatalf("MkdirAll(global skill) error = %v", err) + } + if err := os.WriteFile( + filepath.Join(globalSkillDir, "SKILL.md"), + []byte("---\nname: global-skill\ndescription: Global skill\n---\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile(global skill) error = %v", err) + } + + builtinRoot := filepath.Join(t.TempDir(), "builtin-skills") + oldBuiltin := os.Getenv("PICOCLAW_BUILTIN_SKILLS") + if err := os.Setenv("PICOCLAW_BUILTIN_SKILLS", builtinRoot); err != nil { + t.Fatalf("Setenv(PICOCLAW_BUILTIN_SKILLS) error = %v", err) + } + defer func() { + if oldBuiltin == "" { + _ = os.Unsetenv("PICOCLAW_BUILTIN_SKILLS") + } else { + _ = os.Setenv("PICOCLAW_BUILTIN_SKILLS", oldBuiltin) + } + }() + + builtinSkillDir := filepath.Join(builtinRoot, "builtin-skill") + if err := os.MkdirAll(builtinSkillDir, 0o755); err != nil { + t.Fatalf("MkdirAll(builtin skill) error = %v", err) + } + if err := os.WriteFile( + filepath.Join(builtinSkillDir, "SKILL.md"), + []byte("---\nname: builtin-skill\ndescription: Builtin skill\n---\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile(builtin skill) error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/skills", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp skillSupportResponse + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(resp.Skills) != 3 { + t.Fatalf("skills count = %d, want 3", len(resp.Skills)) + } + + gotSkills := make(map[string]string, len(resp.Skills)) + for _, skill := range resp.Skills { + gotSkills[skill.Name] = skill.Source + } + if gotSkills["workspace-skill"] != "workspace" { + t.Fatalf("workspace-skill source = %q, want workspace", gotSkills["workspace-skill"]) + } + if gotSkills["global-skill"] != "global" { + t.Fatalf("global-skill source = %q, want global", gotSkills["global-skill"]) + } + if gotSkills["builtin-skill"] != "builtin" { + t.Fatalf("builtin-skill source = %q, want builtin", gotSkills["builtin-skill"]) + } +} + +func TestHandleGetSkill(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + skillDir := filepath.Join(workspace, "skills", "viewer-skill") + if err := os.MkdirAll(skillDir, 0o755); err != nil { + t.Fatalf("MkdirAll() error = %v", err) + } + if err := os.WriteFile( + filepath.Join(skillDir, "SKILL.md"), + []byte( + "---\nname: viewer-skill\ndescription: Viewable skill\n---\n# Viewer Skill\n\nThis is visible content.\n", + ), + 0o644, + ); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/skills/viewer-skill", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp skillDetailResponse + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if resp.Name != "viewer-skill" || resp.Source != "workspace" || resp.Description != "Viewable skill" { + t.Fatalf("unexpected response: %#v", resp) + } + if resp.Content != "# Viewer Skill\n\nThis is visible content.\n" { + t.Fatalf("content = %q", resp.Content) + } +} + +func TestHandleGetSkillUsesResolvedPath(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + skillDir := filepath.Join(workspace, "skills", "folder-name") + if err := os.MkdirAll(skillDir, 0o755); err != nil { + t.Fatalf("MkdirAll() error = %v", err) + } + if err := os.WriteFile( + filepath.Join(skillDir, "SKILL.md"), + []byte("---\nname: display-name\ndescription: Mismatched path skill\n---\n# Display Name\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/skills/display-name", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp skillDetailResponse + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if resp.Name != "display-name" { + t.Fatalf("resp.Name = %q, want display-name", resp.Name) + } + if resp.Content != "# Display Name\n" { + t.Fatalf("content = %q", resp.Content) + } +} + +func TestHandleImportSkill(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + var body bytes.Buffer + writer := multipart.NewWriter(&body) + part, err := writer.CreateFormFile("file", "Plain Skill.md") + if err != nil { + t.Fatalf("CreateFormFile() error = %v", err) + } + _, err = io.WriteString(part, "# Plain Skill\n\nUse this skill to test imports.\n") + if err != nil { + t.Fatalf("WriteString() error = %v", err) + } + err = writer.Close() + if err != nil { + t.Fatalf("Close() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodPost, "/api/skills/import", &body) + req.Header.Set("Content-Type", writer.FormDataContentType()) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + skillFile := filepath.Join(workspace, "skills", "plain-skill", "SKILL.md") + content, err := os.ReadFile(skillFile) + if err != nil { + t.Fatalf("ReadFile() error = %v", err) + } + expected := "---\nname: plain-skill\ndescription: Plain Skill\n---\n\n# Plain Skill\n\nUse this skill to test imports.\n" + if string(content) != expected { + t.Fatalf("saved skill content mismatch:\n%s", string(content)) + } + + rec2 := httptest.NewRecorder() + req2 := httptest.NewRequest(http.MethodGet, "/api/skills", nil) + mux.ServeHTTP(rec2, req2) + if rec2.Code != http.StatusOK { + t.Fatalf("list status = %d, want %d, body=%s", rec2.Code, http.StatusOK, rec2.Body.String()) + } + var listResp skillSupportResponse + if err := json.Unmarshal(rec2.Body.Bytes(), &listResp); err != nil { + t.Fatalf("Unmarshal list response error = %v", err) + } + found := false + for _, skill := range listResp.Skills { + if skill.Name == "plain-skill" && skill.Source == "workspace" && skill.Description == "Plain Skill" { + found = true + } + } + if !found { + t.Fatalf("plain-skill should be listed after import, got %#v", listResp.Skills) + } +} + +func TestHandleDeleteSkill(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + skillDir := filepath.Join(workspace, "skills", "delete-me") + if err := os.MkdirAll(skillDir, 0o755); err != nil { + t.Fatalf("MkdirAll() error = %v", err) + } + if err := os.WriteFile( + filepath.Join(skillDir, "SKILL.md"), + []byte("---\nname: delete-me\ndescription: delete me\n---\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodDelete, "/api/skills/delete-me", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + if _, err := os.Stat(skillDir); !os.IsNotExist(err) { + t.Fatalf("skill directory should be removed, stat err=%v", err) + } +} diff --git a/web/backend/api/tools.go b/web/backend/api/tools.go new file mode 100644 index 000000000..373a3be12 --- /dev/null +++ b/web/backend/api/tools.go @@ -0,0 +1,323 @@ +package api + +import ( + "encoding/json" + "fmt" + "net/http" + "runtime" + + "github.com/sipeed/picoclaw/pkg/config" +) + +type toolCatalogEntry struct { + Name string + Description string + Category string + ConfigKey string +} + +type toolSupportItem struct { + Name string `json:"name"` + Description string `json:"description"` + Category string `json:"category"` + ConfigKey string `json:"config_key"` + Status string `json:"status"` + ReasonCode string `json:"reason_code,omitempty"` +} + +type toolSupportResponse struct { + Tools []toolSupportItem `json:"tools"` +} + +type toolStateRequest struct { + Enabled bool `json:"enabled"` +} + +var toolCatalog = []toolCatalogEntry{ + { + Name: "read_file", + Description: "Read file content from the workspace or explicitly allowed paths.", + Category: "filesystem", + ConfigKey: "read_file", + }, + { + Name: "write_file", + Description: "Create or overwrite files within the writable workspace scope.", + Category: "filesystem", + ConfigKey: "write_file", + }, + { + Name: "list_dir", + Description: "Inspect directories and enumerate files available to the agent.", + Category: "filesystem", + ConfigKey: "list_dir", + }, + { + Name: "edit_file", + Description: "Apply targeted edits to existing files without rewriting everything.", + Category: "filesystem", + ConfigKey: "edit_file", + }, + { + Name: "append_file", + Description: "Append content to the end of an existing file.", + Category: "filesystem", + ConfigKey: "append_file", + }, + { + Name: "exec", + Description: "Run shell commands inside the configured workspace sandbox.", + Category: "filesystem", + ConfigKey: "exec", + }, + { + Name: "cron", + Description: "Schedule one-time or recurring reminders, jobs, and shell commands.", + Category: "automation", + ConfigKey: "cron", + }, + { + Name: "web_search", + Description: "Search the web using the configured providers.", + Category: "web", + ConfigKey: "web", + }, + { + Name: "web_fetch", + Description: "Fetch and summarize the contents of a webpage.", + Category: "web", + ConfigKey: "web_fetch", + }, + { + Name: "message", + Description: "Send a follow-up message back to the active user or chat.", + Category: "communication", + ConfigKey: "message", + }, + { + Name: "send_file", + Description: "Send an outbound file or media attachment to the active chat.", + Category: "communication", + ConfigKey: "send_file", + }, + { + Name: "find_skills", + Description: "Search external skill registries for installable skills.", + Category: "skills", + ConfigKey: "find_skills", + }, + { + Name: "install_skill", + Description: "Install a skill into the current workspace from a registry.", + Category: "skills", + ConfigKey: "install_skill", + }, + { + Name: "spawn", + Description: "Launch a background subagent for long-running or delegated work.", + Category: "agents", + ConfigKey: "spawn", + }, + { + Name: "i2c", + Description: "Interact with I2C hardware devices exposed on the host.", + Category: "hardware", + ConfigKey: "i2c", + }, + { + Name: "spi", + Description: "Interact with SPI hardware devices exposed on the host.", + Category: "hardware", + ConfigKey: "spi", + }, + { + Name: "tool_search_tool_regex", + Description: "Discover hidden MCP tools by regex search when tool discovery is enabled.", + Category: "discovery", + ConfigKey: "mcp.discovery.use_regex", + }, + { + Name: "tool_search_tool_bm25", + Description: "Discover hidden MCP tools by semantic ranking when tool discovery is enabled.", + Category: "discovery", + ConfigKey: "mcp.discovery.use_bm25", + }, +} + +func (h *Handler) registerToolRoutes(mux *http.ServeMux) { + mux.HandleFunc("GET /api/tools", h.handleListTools) + mux.HandleFunc("PUT /api/tools/{name}/state", h.handleUpdateToolState) +} + +func (h *Handler) handleListTools(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(toolSupportResponse{ + Tools: buildToolSupport(cfg), + }) +} + +func (h *Handler) handleUpdateToolState(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + var req toolStateRequest + if err := json.NewDecoder(r.Body).Decode(&req); err != nil { + http.Error(w, fmt.Sprintf("Invalid JSON: %v", err), http.StatusBadRequest) + return + } + + if err := applyToolState(cfg, r.PathValue("name"), req.Enabled); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + + if err := config.SaveConfig(h.configPath, cfg); err != nil { + http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) + return + } + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]string{"status": "ok"}) +} + +func buildToolSupport(cfg *config.Config) []toolSupportItem { + items := make([]toolSupportItem, 0, len(toolCatalog)) + for _, entry := range toolCatalog { + status := "disabled" + reasonCode := "" + + switch entry.Name { + case "find_skills", "install_skill": + if cfg.Tools.IsToolEnabled(entry.ConfigKey) { + if cfg.Tools.IsToolEnabled("skills") { + status = "enabled" + } else { + status = "blocked" + reasonCode = "requires_skills" + } + } + case "spawn": + if cfg.Tools.IsToolEnabled(entry.ConfigKey) { + if cfg.Tools.IsToolEnabled("subagent") { + status = "enabled" + } else { + status = "blocked" + reasonCode = "requires_subagent" + } + } + case "tool_search_tool_regex": + status, reasonCode = resolveDiscoveryToolSupport(cfg, cfg.Tools.MCP.Discovery.UseRegex) + case "tool_search_tool_bm25": + status, reasonCode = resolveDiscoveryToolSupport(cfg, cfg.Tools.MCP.Discovery.UseBM25) + case "i2c", "spi": + status, reasonCode = resolveHardwareToolSupport(cfg.Tools.IsToolEnabled(entry.ConfigKey)) + default: + if cfg.Tools.IsToolEnabled(entry.ConfigKey) { + status = "enabled" + } + } + + items = append(items, toolSupportItem{ + Name: entry.Name, + Description: entry.Description, + Category: entry.Category, + ConfigKey: entry.ConfigKey, + Status: status, + ReasonCode: reasonCode, + }) + } + return items +} + +func resolveHardwareToolSupport(enabled bool) (string, string) { + if !enabled { + return "disabled", "" + } + if runtime.GOOS != "linux" { + return "blocked", "requires_linux" + } + return "enabled", "" +} + +func resolveDiscoveryToolSupport(cfg *config.Config, methodEnabled bool) (string, string) { + if !cfg.Tools.IsToolEnabled("mcp") { + return "disabled", "" + } + if !cfg.Tools.MCP.Discovery.Enabled { + return "blocked", "requires_mcp_discovery" + } + if !methodEnabled { + return "disabled", "" + } + return "enabled", "" +} + +func applyToolState(cfg *config.Config, toolName string, enabled bool) error { + switch toolName { + case "read_file": + cfg.Tools.ReadFile.Enabled = enabled + case "write_file": + cfg.Tools.WriteFile.Enabled = enabled + case "list_dir": + cfg.Tools.ListDir.Enabled = enabled + case "edit_file": + cfg.Tools.EditFile.Enabled = enabled + case "append_file": + cfg.Tools.AppendFile.Enabled = enabled + case "exec": + cfg.Tools.Exec.Enabled = enabled + case "cron": + cfg.Tools.Cron.Enabled = enabled + case "web_search": + cfg.Tools.Web.Enabled = enabled + case "web_fetch": + cfg.Tools.WebFetch.Enabled = enabled + case "message": + cfg.Tools.Message.Enabled = enabled + case "send_file": + cfg.Tools.SendFile.Enabled = enabled + case "find_skills": + cfg.Tools.FindSkills.Enabled = enabled + if enabled { + cfg.Tools.Skills.Enabled = true + } + case "install_skill": + cfg.Tools.InstallSkill.Enabled = enabled + if enabled { + cfg.Tools.Skills.Enabled = true + } + case "spawn": + cfg.Tools.Spawn.Enabled = enabled + if enabled { + cfg.Tools.Subagent.Enabled = true + } + case "i2c": + cfg.Tools.I2C.Enabled = enabled + case "spi": + cfg.Tools.SPI.Enabled = enabled + case "tool_search_tool_regex": + cfg.Tools.MCP.Discovery.UseRegex = enabled + if enabled { + cfg.Tools.MCP.Enabled = true + cfg.Tools.MCP.Discovery.Enabled = true + } + case "tool_search_tool_bm25": + cfg.Tools.MCP.Discovery.UseBM25 = enabled + if enabled { + cfg.Tools.MCP.Enabled = true + cfg.Tools.MCP.Discovery.Enabled = true + } + default: + return fmt.Errorf("tool %q cannot be updated", toolName) + } + return nil +} diff --git a/web/backend/api/tools_test.go b/web/backend/api/tools_test.go new file mode 100644 index 000000000..646cefbe2 --- /dev/null +++ b/web/backend/api/tools_test.go @@ -0,0 +1,198 @@ +package api + +import ( + "bytes" + "encoding/json" + "net/http" + "net/http/httptest" + "runtime" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestHandleListTools(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.Tools.ReadFile.Enabled = true + cfg.Tools.WriteFile.Enabled = false + cfg.Tools.Cron.Enabled = true + cfg.Tools.FindSkills.Enabled = true + cfg.Tools.Skills.Enabled = true + cfg.Tools.Spawn.Enabled = true + cfg.Tools.Subagent.Enabled = false + cfg.Tools.MCP.Enabled = true + cfg.Tools.MCP.Discovery.Enabled = true + cfg.Tools.MCP.Discovery.UseRegex = true + cfg.Tools.MCP.Discovery.UseBM25 = false + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/tools", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp toolSupportResponse + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + gotTools := make(map[string]toolSupportItem, len(resp.Tools)) + for _, tool := range resp.Tools { + gotTools[tool.Name] = tool + } + if gotTools["read_file"].Status != "enabled" { + t.Fatalf("read_file status = %q, want enabled", gotTools["read_file"].Status) + } + if gotTools["write_file"].Status != "disabled" { + t.Fatalf("write_file status = %q, want disabled", gotTools["write_file"].Status) + } + if gotTools["cron"].Status != "enabled" { + t.Fatalf("cron status = %q, want enabled", gotTools["cron"].Status) + } + if gotTools["spawn"].Status != "blocked" || gotTools["spawn"].ReasonCode != "requires_subagent" { + t.Fatalf("spawn = %#v, want blocked/requires_subagent", gotTools["spawn"]) + } + if gotTools["find_skills"].Status != "enabled" { + t.Fatalf("find_skills status = %q, want enabled", gotTools["find_skills"].Status) + } + if gotTools["tool_search_tool_regex"].Status != "enabled" { + t.Fatalf("tool_search_tool_regex status = %q, want enabled", gotTools["tool_search_tool_regex"].Status) + } + if gotTools["tool_search_tool_regex"].ConfigKey != "mcp.discovery.use_regex" { + t.Fatalf( + "tool_search_tool_regex config_key = %q, want mcp.discovery.use_regex", + gotTools["tool_search_tool_regex"].ConfigKey, + ) + } + if gotTools["tool_search_tool_bm25"].Status != "disabled" { + t.Fatalf("tool_search_tool_bm25 status = %q, want disabled", gotTools["tool_search_tool_bm25"].Status) + } + if gotTools["tool_search_tool_bm25"].ConfigKey != "mcp.discovery.use_bm25" { + t.Fatalf( + "tool_search_tool_bm25 config_key = %q, want mcp.discovery.use_bm25", + gotTools["tool_search_tool_bm25"].ConfigKey, + ) + } + if runtime.GOOS == "linux" { + if gotTools["i2c"].Status != "disabled" { + t.Fatalf("i2c status = %q, want disabled on linux when config is off", gotTools["i2c"].Status) + } + } else { + cfg.Tools.I2C.Enabled = true + cfg.Tools.SPI.Enabled = true + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + rec = httptest.NewRecorder() + req = httptest.NewRequest(http.MethodGet, "/api/tools", nil) + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + gotTools = make(map[string]toolSupportItem, len(resp.Tools)) + for _, tool := range resp.Tools { + gotTools[tool.Name] = tool + } + + if gotTools["i2c"].Status != "blocked" || gotTools["i2c"].ReasonCode != "requires_linux" { + t.Fatalf("i2c = %#v, want blocked/requires_linux", gotTools["i2c"]) + } + if gotTools["spi"].Status != "blocked" || gotTools["spi"].ReasonCode != "requires_linux" { + t.Fatalf("spi = %#v, want blocked/requires_linux", gotTools["spi"]) + } + } +} + +func TestHandleUpdateToolState(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.Tools.Spawn.Enabled = false + cfg.Tools.Subagent.Enabled = false + cfg.Tools.Cron.Enabled = false + cfg.Tools.MCP.Enabled = false + cfg.Tools.MCP.Discovery.Enabled = false + cfg.Tools.MCP.Discovery.UseRegex = false + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest( + http.MethodPut, + "/api/tools/spawn/state", + bytes.NewBufferString(`{"enabled":true}`), + ) + req.Header.Set("Content-Type", "application/json") + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("spawn status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + rec2 := httptest.NewRecorder() + req2 := httptest.NewRequest( + http.MethodPut, + "/api/tools/tool_search_tool_regex/state", + bytes.NewBufferString(`{"enabled":true}`), + ) + req2.Header.Set("Content-Type", "application/json") + mux.ServeHTTP(rec2, req2) + if rec2.Code != http.StatusOK { + t.Fatalf("regex status = %d, want %d, body=%s", rec2.Code, http.StatusOK, rec2.Body.String()) + } + + rec3 := httptest.NewRecorder() + req3 := httptest.NewRequest( + http.MethodPut, + "/api/tools/cron/state", + bytes.NewBufferString(`{"enabled":true}`), + ) + req3.Header.Set("Content-Type", "application/json") + mux.ServeHTTP(rec3, req3) + if rec3.Code != http.StatusOK { + t.Fatalf("cron status = %d, want %d, body=%s", rec3.Code, http.StatusOK, rec3.Body.String()) + } + + updated, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig(updated) error = %v", err) + } + if !updated.Tools.Spawn.Enabled || !updated.Tools.Subagent.Enabled { + t.Fatalf("spawn/subagent should both be enabled: %#v", updated.Tools) + } + if !updated.Tools.MCP.Enabled || !updated.Tools.MCP.Discovery.Enabled || !updated.Tools.MCP.Discovery.UseRegex { + t.Fatalf("mcp regex discovery should be enabled: %#v", updated.Tools.MCP) + } + if !updated.Tools.Cron.Enabled { + t.Fatalf("cron should be enabled: %#v", updated.Tools.Cron) + } +} diff --git a/web/backend/dist/.gitkeep b/web/backend/dist/.gitkeep index e69de29bb..4b533f03a 100644 --- a/web/backend/dist/.gitkeep +++ b/web/backend/dist/.gitkeep @@ -0,0 +1 @@ +# Keep the embedded web backend dist directory in version control. diff --git a/web/backend/main.go b/web/backend/main.go index b8c4dc2bb..650540ea8 100644 --- a/web/backend/main.go +++ b/web/backend/main.go @@ -25,6 +25,7 @@ import ( "github.com/sipeed/picoclaw/web/backend/api" "github.com/sipeed/picoclaw/web/backend/launcherconfig" "github.com/sipeed/picoclaw/web/backend/middleware" + "github.com/sipeed/picoclaw/web/backend/utils" ) func main() { @@ -51,7 +52,7 @@ func main() { flag.Parse() // Resolve config path - configPath := getDefaultConfigPath() + configPath := utils.GetDefaultConfigPath() if flag.NArg() > 0 { configPath = flag.Arg(0) } @@ -60,6 +61,10 @@ func main() { if err != nil { log.Fatalf("Failed to resolve config path: %v", err) } + err = utils.EnsureOnboarded(absPath) + if err != nil { + log.Printf("Warning: Failed to initialize PicoClaw config automatically: %v", err) + } var explicitPort bool var explicitPublic bool @@ -109,7 +114,7 @@ func main() { // API Routes (e.g. /api/status) apiHandler := api.NewHandler(absPath) - apiHandler.SetServerOptions(portNum, effectivePublic, launcherCfg.AllowedCIDRs) + apiHandler.SetServerOptions(portNum, effectivePublic, explicitPublic, launcherCfg.AllowedCIDRs) apiHandler.RegisterRoutes(mux) // Frontend Embedded Assets @@ -128,13 +133,13 @@ func main() { ) // Print startup banner - fmt.Print(banner) + fmt.Print(utils.Banner) fmt.Println() fmt.Println(" Open the following URL in your browser:") fmt.Println() fmt.Printf(" >> http://localhost:%s <<\n", effectivePort) if effectivePublic { - if ip := getLocalIP(); ip != "" { + if ip := utils.GetLocalIP(); ip != "" { fmt.Printf(" >> http://%s:%s <<\n", ip, effectivePort) } } @@ -145,7 +150,7 @@ func main() { go func() { time.Sleep(500 * time.Millisecond) url := "http://localhost:" + effectivePort - if err := openBrowser(url); err != nil { + if err := utils.OpenBrowser(url); err != nil { log.Printf("Warning: Failed to auto-open browser: %v", err) } }() diff --git a/web/backend/utils.go b/web/backend/utils/banner.go similarity index 54% rename from web/backend/utils.go rename to web/backend/utils/banner.go index 6fa734aeb..a64ea6390 100644 --- a/web/backend/utils.go +++ b/web/backend/utils/banner.go @@ -1,19 +1,10 @@ -package main - -import ( - "fmt" - "net" - "os" - "os/exec" - "path/filepath" - "runtime" -) +package utils const ( colorBlue = "\x1b[38;2;62;93;185m" colorRed = "\x1b[38;2;213;70;70m" colorReset = "\x1b[0m" - banner = "\r\n" + + Banner = "\r\n" + colorBlue + "██████╗ ██╗ ██████╗ ██████╗ " + colorRed + " ██████╗██╗ █████╗ ██╗ ██╗\n" + colorBlue + "██╔══██╗██║██╔════╝██╔═══██╗" + colorRed + "██╔════╝██║ ██╔══██╗██║ ██║\n" + colorBlue + "██████╔╝██║██║ ██║ ██║" + colorRed + "██║ ██║ ███████║██║ █╗ ██║\n" + @@ -22,40 +13,3 @@ const ( colorBlue + "╚═╝ ╚═╝ ╚═════╝ ╚═════╝ " + colorRed + " ╚═════╝╚══════╝╚═╝ ╚═╝ ╚══╝╚══╝\n" + colorReset ) - -// getDefaultConfigPath returns the default path to the picoclaw config file. -func getDefaultConfigPath() string { - home, err := os.UserHomeDir() - if err != nil { - return "config.json" - } - return filepath.Join(home, ".picoclaw", "config.json") -} - -// getLocalIP returns the local IP address of the machine. -func getLocalIP() string { - addrs, err := net.InterfaceAddrs() - if err != nil { - return "" - } - for _, a := range addrs { - if ipnet, ok := a.(*net.IPNet); ok && !ipnet.IP.IsLoopback() && ipnet.IP.To4() != nil { - return ipnet.IP.String() - } - } - return "" -} - -// openBrowser automatically opens the given URL in the default browser. -func openBrowser(url string) error { - switch runtime.GOOS { - case "linux": - return exec.Command("xdg-open", url).Start() - case "windows": - return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start() - case "darwin": - return exec.Command("open", url).Start() - default: - return fmt.Errorf("unsupported platform") - } -} diff --git a/web/backend/utils/onboard.go b/web/backend/utils/onboard.go new file mode 100644 index 000000000..fbe34f220 --- /dev/null +++ b/web/backend/utils/onboard.go @@ -0,0 +1,42 @@ +package utils + +import ( + "fmt" + "os" + "os/exec" + "strings" +) + +var execCommand = exec.Command + +func EnsureOnboarded(configPath string) error { + _, err := os.Stat(configPath) + if err == nil { + return nil + } + if !os.IsNotExist(err) { + return fmt.Errorf("stat config: %w", err) + } + + cmd := execCommand(FindPicoclawBinary(), "onboard") + cmd.Env = append(os.Environ(), "PICOCLAW_CONFIG="+configPath) + cmd.Stdin = strings.NewReader("n\n") + + output, err := cmd.CombinedOutput() + if err != nil { + trimmed := strings.TrimSpace(string(output)) + if trimmed == "" { + return fmt.Errorf("run onboard: %w", err) + } + return fmt.Errorf("run onboard: %w: %s", err, trimmed) + } + + if _, err := os.Stat(configPath); err != nil { + if os.IsNotExist(err) { + return fmt.Errorf("onboard completed but did not create config %s", configPath) + } + return fmt.Errorf("verify config after onboard: %w", err) + } + + return nil +} diff --git a/web/backend/utils/onboard_test.go b/web/backend/utils/onboard_test.go new file mode 100644 index 000000000..06f967e76 --- /dev/null +++ b/web/backend/utils/onboard_test.go @@ -0,0 +1,101 @@ +package utils + +import ( + "os" + "os/exec" + "path/filepath" + "strings" + "testing" +) + +func TestEnsureOnboardedSkipsWhenConfigExists(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + if err := os.WriteFile(configPath, []byte(`{}`), 0o644); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + + origExecCommand := execCommand + defer func() { execCommand = origExecCommand }() + + called := false + execCommand = func(name string, args ...string) *exec.Cmd { + called = true + return exec.Command("sh", "-c", "exit 1") + } + + if err := EnsureOnboarded(configPath); err != nil { + t.Fatalf("EnsureOnboarded() error = %v", err) + } + if called { + t.Fatal("expected onboard command not to run when config already exists") + } +} + +func TestEnsureOnboardedRunsOnboardWhenConfigMissing(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + t.Setenv("EXPECTED_CONFIG_PATH", configPath) + + origExecCommand := execCommand + defer func() { execCommand = origExecCommand }() + + var gotName string + var gotArgs []string + execCommand = func(name string, args ...string) *exec.Cmd { + gotName = name + gotArgs = append([]string(nil), args...) + return exec.Command( + "sh", + "-c", + `test "$PICOCLAW_CONFIG" = "$EXPECTED_CONFIG_PATH" && +mkdir -p "$(dirname "$PICOCLAW_CONFIG")" && +printf '{}' > "$PICOCLAW_CONFIG"`, + ) + } + + if err := EnsureOnboarded(configPath); err != nil { + t.Fatalf("EnsureOnboarded() error = %v", err) + } + if gotName == "" { + t.Fatal("expected onboard command to run") + } + if len(gotArgs) != 1 || gotArgs[0] != "onboard" { + t.Fatalf("command args = %#v, want []string{\"onboard\"}", gotArgs) + } + if _, err := os.Stat(configPath); err != nil { + t.Fatalf("expected config to be created: %v", err) + } +} + +func TestEnsureOnboardedFailsWhenOnboardDoesNotCreateConfig(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + + origExecCommand := execCommand + defer func() { execCommand = origExecCommand }() + + execCommand = func(name string, args ...string) *exec.Cmd { + return exec.Command("sh", "-c", "exit 0") + } + + if err := EnsureOnboarded(configPath); err == nil { + t.Fatal("EnsureOnboarded() error = nil, want failure when onboard does not create config") + } +} + +func TestEnsureOnboardedIncludesOnboardOutputOnFailure(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + + origExecCommand := execCommand + defer func() { execCommand = origExecCommand }() + + execCommand = func(name string, args ...string) *exec.Cmd { + return exec.Command("sh", "-c", "echo onboarding failed >&2; exit 2") + } + + err := EnsureOnboarded(configPath) + if err == nil { + t.Fatal("EnsureOnboarded() error = nil, want failure") + } + if !strings.Contains(err.Error(), "onboarding failed") { + t.Fatalf("error = %q, want onboard output included", err) + } +} diff --git a/web/backend/utils/runtime.go b/web/backend/utils/runtime.go new file mode 100644 index 000000000..4e6c32c56 --- /dev/null +++ b/web/backend/utils/runtime.go @@ -0,0 +1,80 @@ +package utils + +import ( + "fmt" + "net" + "os" + "os/exec" + "path/filepath" + "runtime" +) + +// GetDefaultConfigPath returns the default path to the picoclaw config file. +func GetDefaultConfigPath() string { + if configPath := os.Getenv("PICOCLAW_CONFIG"); configPath != "" { + return configPath + } + if picoclawHome := os.Getenv("PICOCLAW_HOME"); picoclawHome != "" { + return filepath.Join(picoclawHome, "config.json") + } + home, err := os.UserHomeDir() + if err != nil { + return "config.json" + } + return filepath.Join(home, ".picoclaw", "config.json") +} + +// FindPicoclawBinary locates the picoclaw executable. +// Search order: +// 1. PICOCLAW_BINARY environment variable (explicit override) +// 2. Same directory as the current executable +// 3. Falls back to "picoclaw" and relies on $PATH +func FindPicoclawBinary() string { + binaryName := "picoclaw" + if runtime.GOOS == "windows" { + binaryName = "picoclaw.exe" + } + + if p := os.Getenv("PICOCLAW_BINARY"); p != "" { + if info, _ := os.Stat(p); info != nil && !info.IsDir() { + return p + } + } + + if exe, err := os.Executable(); err == nil { + candidate := filepath.Join(filepath.Dir(exe), binaryName) + if info, err := os.Stat(candidate); err == nil && !info.IsDir() { + return candidate + } + } + + return "picoclaw" +} + +// GetLocalIP returns the local IP address of the machine. +func GetLocalIP() string { + addrs, err := net.InterfaceAddrs() + if err != nil { + return "" + } + for _, a := range addrs { + if ipnet, ok := a.(*net.IPNet); ok && !ipnet.IP.IsLoopback() && ipnet.IP.To4() != nil { + return ipnet.IP.String() + } + } + return "" +} + +// OpenBrowser automatically opens the given URL in the default browser. +func OpenBrowser(url string) error { + switch runtime.GOOS { + case "linux": + return exec.Command("xdg-open", url).Start() + case "windows": + return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start() + case "darwin": + return exec.Command("open", url).Start() + default: + return fmt.Errorf("unsupported platform") + } +} diff --git a/web/frontend/package.json b/web/frontend/package.json index ee46cdcda..687fd5771 100644 --- a/web/frontend/package.json +++ b/web/frontend/package.json @@ -32,7 +32,7 @@ "react-markdown": "^10.1.0", "react-textarea-autosize": "^8.5.9", "remark-gfm": "^4.0.1", - "shadcn": "^3.8.5", + "shadcn": "^4.0.5", "sonner": "^2.0.7", "tailwind-merge": "^3.5.0", "tailwindcss": "^4.2.1", diff --git a/web/frontend/pnpm-lock.yaml b/web/frontend/pnpm-lock.yaml index 8e89cbbe5..9de3354a1 100644 --- a/web/frontend/pnpm-lock.yaml +++ b/web/frontend/pnpm-lock.yaml @@ -66,8 +66,8 @@ importers: specifier: ^4.0.1 version: 4.0.1 shadcn: - specifier: ^3.8.5 - version: 3.8.5(@types/node@24.11.0)(typescript@5.9.3) + specifier: ^4.0.5 + version: 4.0.5(@types/node@24.11.0)(typescript@5.9.3) sonner: specifier: ^2.0.7 version: 2.0.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4) @@ -512,8 +512,8 @@ packages: '@fontsource-variable/inter@5.2.8': resolution: {integrity: sha512-kOfP2D+ykbcX/P3IFnokOhVRNoTozo5/JxhAIVYLpea/UBmCQ/YWPBfWIDuBImXX/15KH+eKh4xpEUyS2sQQGQ==} - '@hono/node-server@1.19.9': - resolution: {integrity: sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==} + '@hono/node-server@1.19.11': + resolution: {integrity: sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==} engines: {node: '>=18.14.1'} peerDependencies: hono: ^4 @@ -1359,79 +1359,66 @@ packages: resolution: {integrity: sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==} cpu: [arm] os: [linux] - libc: [glibc] '@rollup/rollup-linux-arm-musleabihf@4.59.0': resolution: {integrity: sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==} cpu: [arm] os: [linux] - libc: [musl] '@rollup/rollup-linux-arm64-gnu@4.59.0': resolution: {integrity: sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==} cpu: [arm64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-arm64-musl@4.59.0': resolution: {integrity: sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==} cpu: [arm64] os: [linux] - libc: [musl] '@rollup/rollup-linux-loong64-gnu@4.59.0': resolution: {integrity: sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==} cpu: [loong64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-loong64-musl@4.59.0': resolution: {integrity: sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==} cpu: [loong64] os: [linux] - libc: [musl] '@rollup/rollup-linux-ppc64-gnu@4.59.0': resolution: {integrity: sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==} cpu: [ppc64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-ppc64-musl@4.59.0': resolution: {integrity: sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==} cpu: [ppc64] os: [linux] - libc: [musl] '@rollup/rollup-linux-riscv64-gnu@4.59.0': resolution: {integrity: sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==} cpu: [riscv64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-riscv64-musl@4.59.0': resolution: {integrity: sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==} cpu: [riscv64] os: [linux] - libc: [musl] '@rollup/rollup-linux-s390x-gnu@4.59.0': resolution: {integrity: sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==} cpu: [s390x] os: [linux] - libc: [glibc] '@rollup/rollup-linux-x64-gnu@4.59.0': resolution: {integrity: sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==} cpu: [x64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-x64-musl@4.59.0': resolution: {integrity: sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==} cpu: [x64] os: [linux] - libc: [musl] '@rollup/rollup-openbsd-x64@4.59.0': resolution: {integrity: sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==} @@ -1516,28 +1503,24 @@ packages: engines: {node: '>= 20'} cpu: [arm64] os: [linux] - libc: [glibc] '@tailwindcss/oxide-linux-arm64-musl@4.2.1': resolution: {integrity: sha512-WZA0CHRL/SP1TRbA5mp9htsppSEkWuQ4KsSUumYQnyl8ZdT39ntwqmz4IUHGN6p4XdSlYfJwM4rRzZLShHsGAQ==} engines: {node: '>= 20'} cpu: [arm64] os: [linux] - libc: [musl] '@tailwindcss/oxide-linux-x64-gnu@4.2.1': resolution: {integrity: sha512-qMFzxI2YlBOLW5PhblzuSWlWfwLHaneBE0xHzLrBgNtqN6mWfs+qYbhryGSXQjFYB1Dzf5w+LN5qbUTPhW7Y5g==} engines: {node: '>= 20'} cpu: [x64] os: [linux] - libc: [glibc] '@tailwindcss/oxide-linux-x64-musl@4.2.1': resolution: {integrity: sha512-5r1X2FKnCMUPlXTWRYpHdPYUY6a1Ar/t7P24OuiEdEOmms5lyqjDRvVY1yy9Rmioh+AunQ0rWiOTPE8F9A3v5g==} engines: {node: '>= 20'} cpu: [x64] os: [linux] - libc: [musl] '@tailwindcss/oxide-wasm32-wasi@4.2.1': resolution: {integrity: sha512-MGFB5cVPvshR85MTJkEvqDUnuNoysrsRxd6vnk1Lf2tbiqNlXpHYZqkqOQalydienEWOHHFyyuTSYRsLfxFJ2Q==} @@ -2296,8 +2279,8 @@ packages: resolution: {integrity: sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==} engines: {node: ^18.19.0 || >=20.5.0} - express-rate-limit@8.2.1: - resolution: {integrity: sha512-PCZEIEIxqwhzw4KF0n7QF4QqruVTcF73O5kFKUnGOyjbCCgizBBiFaYpd/fnBLUMPw/BWw9OsiN7GgrNYr7j6g==} + express-rate-limit@8.3.1: + resolution: {integrity: sha512-D1dKN+cmyPWuvB+G2SREQDzPY1agpBIcTa9sJxOPMCNeH3gwzhqJRDWCXW3gg0y//+LQ/8j52JbMROWyrKdMdw==} engines: {node: '>= 16'} peerDependencies: express: '>= 4.11' @@ -2496,8 +2479,8 @@ packages: hermes-parser@0.25.1: resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==} - hono@4.12.3: - resolution: {integrity: sha512-SFsVSjp8sj5UumXOOFlkZOG6XS9SJDKw0TbwFeV+AJ8xlST8kxK5Z/5EYa111UY8732lK2S/xB653ceuaoGwpg==} + hono@4.12.7: + resolution: {integrity: sha512-jq9l1DM0zVIvsm3lv9Nw9nlJnMNPOcAtsbsgiUhWcFzPE99Gvo6yRTlszSLLYacMeQ6quHD6hMfId8crVHvexw==} engines: {node: '>=16.9.0'} html-parse-stringify@3.0.1: @@ -2559,8 +2542,8 @@ packages: inline-style-parser@0.2.7: resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==} - ip-address@10.0.1: - resolution: {integrity: sha512-NWv9YLW4PoW2B7xtzaS3NCot75m6nK7Icdv0o3lfMceJVRfSoQwqD4wEH5rLwoKJwUiZ/rfpiVBhnaF0FK4HoA==} + ip-address@10.1.0: + resolution: {integrity: sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2785,28 +2768,24 @@ packages: engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] - libc: [glibc] lightningcss-linux-arm64-musl@1.31.1: resolution: {integrity: sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] - libc: [musl] lightningcss-linux-x64-gnu@1.31.1: resolution: {integrity: sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] - libc: [glibc] lightningcss-linux-x64-musl@1.31.1: resolution: {integrity: sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] - libc: [musl] lightningcss-win32-arm64-msvc@1.31.1: resolution: {integrity: sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==} @@ -3501,8 +3480,8 @@ packages: setprototypeof@1.2.0: resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==} - shadcn@3.8.5: - resolution: {integrity: sha512-jPRx44e+eyeV7xwY3BLJXcfrks00+M0h5BGB9l6DdcBW4BpAj4x3lVmVy0TXPEs2iHEisxejr62sZAAw6B1EVA==} + shadcn@4.0.5: + resolution: {integrity: sha512-z0SOHEU1+ADam1UJHrgxJhUsOb0/jBoYc+u9mhWs071KrnORq48X7uCwG3mD2ysQEBtOfeK/MxMGsmzL5Jt+Jg==} hasBin: true shebang-command@2.0.0: @@ -4332,9 +4311,9 @@ snapshots: '@fontsource-variable/inter@5.2.8': {} - '@hono/node-server@1.19.9(hono@4.12.3)': + '@hono/node-server@1.19.11(hono@4.12.7)': dependencies: - hono: 4.12.3 + hono: 4.12.7 '@humanfs/core@0.19.1': {} @@ -4396,7 +4375,7 @@ snapshots: '@modelcontextprotocol/sdk@1.27.1(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.9(hono@4.12.3) + '@hono/node-server': 1.19.11(hono@4.12.7) ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) content-type: 1.0.5 @@ -4405,8 +4384,8 @@ snapshots: eventsource: 3.0.7 eventsource-parser: 3.0.6 express: 5.2.1 - express-rate-limit: 8.2.1(express@5.2.1) - hono: 4.12.3 + express-rate-limit: 8.3.1(express@5.2.1) + hono: 4.12.7 jose: 6.1.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -6146,10 +6125,10 @@ snapshots: strip-final-newline: 4.0.0 yoctocolors: 2.1.2 - express-rate-limit@8.2.1(express@5.2.1): + express-rate-limit@8.3.1(express@5.2.1): dependencies: express: 5.2.1 - ip-address: 10.0.1 + ip-address: 10.1.0 express@5.2.1: dependencies: @@ -6374,7 +6353,7 @@ snapshots: dependencies: hermes-estree: 0.25.1 - hono@4.12.3: {} + hono@4.12.7: {} html-parse-stringify@3.0.1: dependencies: @@ -6430,7 +6409,7 @@ snapshots: inline-style-parser@0.2.7: {} - ip-address@10.0.1: {} + ip-address@10.1.0: {} ipaddr.js@1.9.1: {} @@ -7534,7 +7513,7 @@ snapshots: setprototypeof@1.2.0: {} - shadcn@3.8.5(@types/node@24.11.0)(typescript@5.9.3): + shadcn@4.0.5(@types/node@24.11.0)(typescript@5.9.3): dependencies: '@antfu/ni': 25.0.0 '@babel/core': 7.29.0 diff --git a/web/frontend/src/api/gateway.ts b/web/frontend/src/api/gateway.ts index 5a58d48f0..020e92e3a 100644 --- a/web/frontend/src/api/gateway.ts +++ b/web/frontend/src/api/gateway.ts @@ -14,6 +14,8 @@ interface GatewayStatusResponse { interface GatewayActionResponse { status: string pid?: number + log_total?: number + log_run_id?: number } const BASE_URL = "" @@ -59,4 +61,10 @@ export async function restartGateway(): Promise { }) } +export async function clearGatewayLogs(): Promise { + return request("/api/gateway/logs/clear", { + method: "POST", + }) +} + export type { GatewayStatusResponse, GatewayActionResponse } diff --git a/web/frontend/src/api/sessions.ts b/web/frontend/src/api/sessions.ts index 56ef148db..10b0d28fd 100644 --- a/web/frontend/src/api/sessions.ts +++ b/web/frontend/src/api/sessions.ts @@ -2,6 +2,7 @@ export interface SessionSummary { id: string + title: string preview: string message_count: number created: string diff --git a/web/frontend/src/api/skills.ts b/web/frontend/src/api/skills.ts new file mode 100644 index 000000000..307cbd788 --- /dev/null +++ b/web/frontend/src/api/skills.ts @@ -0,0 +1,79 @@ +export interface SkillSupportItem { + name: string + path: string + source: "workspace" | "global" | "builtin" | string + description: string +} + +export interface SkillDetailResponse extends SkillSupportItem { + content: string +} + +interface SkillsResponse { + skills: SkillSupportItem[] +} + +interface SkillActionResponse { + status?: string + name?: string + path?: string + source?: string + description?: string +} + +async function request(path: string, options?: RequestInit): Promise { + const res = await fetch(path, options) + if (!res.ok) { + throw new Error(await extractErrorMessage(res)) + } + return res.json() as Promise +} + +export async function getSkills(): Promise { + return request("/api/skills") +} + +export async function getSkill(name: string): Promise { + return request(`/api/skills/${encodeURIComponent(name)}`) +} + +export async function importSkill(file: File): Promise { + const formData = new FormData() + formData.set("file", file) + + const res = await fetch("/api/skills/import", { + method: "POST", + body: formData, + }) + if (!res.ok) { + throw new Error(await extractErrorMessage(res)) + } + return res.json() as Promise +} + +export async function deleteSkill(name: string): Promise { + return request( + `/api/skills/${encodeURIComponent(name)}`, + { + method: "DELETE", + }, + ) +} + +async function extractErrorMessage(res: Response): Promise { + try { + const body = (await res.json()) as { + error?: string + errors?: string[] + } + if (Array.isArray(body.errors) && body.errors.length > 0) { + return body.errors.join("; ") + } + if (typeof body.error === "string" && body.error.trim() !== "") { + return body.error + } + } catch { + // ignore invalid body + } + return `API error: ${res.status} ${res.statusText}` +} diff --git a/web/frontend/src/api/tools.ts b/web/frontend/src/api/tools.ts new file mode 100644 index 000000000..9f09efbfd --- /dev/null +++ b/web/frontend/src/api/tools.ts @@ -0,0 +1,56 @@ +export interface ToolSupportItem { + name: string + description: string + category: string + config_key: string + status: "enabled" | "disabled" | "blocked" + reason_code?: string +} + +interface ToolsResponse { + tools: ToolSupportItem[] +} + +interface ToolActionResponse { + status: string +} + +async function request(path: string, options?: RequestInit): Promise { + const res = await fetch(path, options) + if (!res.ok) { + let message = `API error: ${res.status} ${res.statusText}` + try { + const body = (await res.json()) as { + error?: string + errors?: string[] + } + if (Array.isArray(body.errors) && body.errors.length > 0) { + message = body.errors.join("; ") + } else if (typeof body.error === "string" && body.error.trim() !== "") { + message = body.error + } + } catch { + // ignore invalid body + } + throw new Error(message) + } + return res.json() as Promise +} + +export async function getTools(): Promise { + return request("/api/tools") +} + +export async function setToolEnabled( + name: string, + enabled: boolean, +): Promise { + return request( + `/api/tools/${encodeURIComponent(name)}/state`, + { + method: "PUT", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ enabled }), + }, + ) +} diff --git a/web/frontend/src/components/app-sidebar.tsx b/web/frontend/src/components/app-sidebar.tsx index dc24f8781..702212857 100644 --- a/web/frontend/src/components/app-sidebar.tsx +++ b/web/frontend/src/components/app-sidebar.tsx @@ -7,6 +7,8 @@ import { IconListDetails, IconMessageCircle, IconSettings, + IconSparkles, + IconTools, } from "@tabler/icons-react" import { Link, useRouterState } from "@tanstack/react-router" import * as React from "react" @@ -53,6 +55,10 @@ const baseNavGroups: Omit[] = [ label: "navigation.model_group", defaultOpen: true, }, + { + label: "navigation.agent_group", + defaultOpen: true, + }, { label: "navigation.services", defaultOpen: true, @@ -113,6 +119,23 @@ export function AppSidebar({ ...props }: React.ComponentProps) { }, { ...baseNavGroups[2], + items: [ + { + title: "navigation.skills", + url: "/agent/skills", + icon: IconSparkles, + translateTitle: true, + }, + { + title: "navigation.tools", + url: "/agent/tools", + icon: IconTools, + translateTitle: true, + }, + ], + }, + { + ...baseNavGroups[3], items: [ { title: "navigation.config", diff --git a/web/frontend/src/components/chat/chat-page.tsx b/web/frontend/src/components/chat/chat-page.tsx index 0fd23a6a5..a3ab843b4 100644 --- a/web/frontend/src/components/chat/chat-page.tsx +++ b/web/frontend/src/components/chat/chat-page.tsx @@ -43,11 +43,18 @@ export function ChatPage() { handleSetDefault, } = useChatModels({ isConnected }) - const { sessions, hasMore, observerRef, loadSessions, handleDeleteSession } = - useSessionHistory({ - activeSessionId, - onDeletedActiveSession: newChat, - }) + const { + sessions, + hasMore, + loadError, + loadErrorMessage, + observerRef, + loadSessions, + handleDeleteSession, + } = useSessionHistory({ + activeSessionId, + onDeletedActiveSession: newChat, + }) const handleScroll = (e: React.UIEvent) => { const { scrollTop, scrollHeight, clientHeight } = e.currentTarget @@ -96,6 +103,8 @@ export function ChatPage() { sessions={sessions} activeSessionId={activeSessionId} hasMore={hasMore} + loadError={loadError} + loadErrorMessage={loadErrorMessage} observerRef={observerRef} onOpenChange={(open) => { if (open) { diff --git a/web/frontend/src/components/chat/session-history-menu.tsx b/web/frontend/src/components/chat/session-history-menu.tsx index f2e93295c..3f293e353 100644 --- a/web/frontend/src/components/chat/session-history-menu.tsx +++ b/web/frontend/src/components/chat/session-history-menu.tsx @@ -17,6 +17,8 @@ interface SessionHistoryMenuProps { sessions: SessionSummary[] activeSessionId: string hasMore: boolean + loadError: boolean + loadErrorMessage: string observerRef: RefObject onOpenChange: (open: boolean) => void onSwitchSession: (sessionId: string) => void @@ -27,6 +29,8 @@ export function SessionHistoryMenu({ sessions, activeSessionId, hasMore, + loadError, + loadErrorMessage, observerRef, onOpenChange, onSwitchSession, @@ -44,7 +48,14 @@ export function SessionHistoryMenu({ - {sessions.length === 0 ? ( + {loadError && ( + + + {loadErrorMessage} + + + )} + {sessions.length === 0 && !loadError ? ( {t("chat.noHistory")} @@ -60,7 +71,7 @@ export function SessionHistoryMenu({ onClick={() => onSwitchSession(session.id)} > - {session.preview} + {session.title || session.preview} {t("chat.messagesCount", { diff --git a/web/frontend/src/components/config/config-page.tsx b/web/frontend/src/components/config/config-page.tsx index c2d502079..d7e1aa1b5 100644 --- a/web/frontend/src/components/config/config-page.tsx +++ b/web/frontend/src/components/config/config-page.tsx @@ -189,6 +189,11 @@ export function ConfigPage() { session: { dm_scope: dmScope, }, + tools: { + exec: { + allow_remote: form.allowRemote, + }, + }, heartbeat: { enabled: form.heartbeatEnabled, interval: heartbeatInterval, diff --git a/web/frontend/src/components/config/config-sections.tsx b/web/frontend/src/components/config/config-sections.tsx index 340ece333..90813be2a 100644 --- a/web/frontend/src/components/config/config-sections.tsx +++ b/web/frontend/src/components/config/config-sections.tsx @@ -63,6 +63,13 @@ export function AgentDefaultsSection({ } /> + onFieldChange("allowRemote", checked)} + /> + export interface CoreConfigForm { workspace: string restrictToWorkspace: boolean + allowRemote: boolean maxTokens: string maxToolIterations: string summarizeMessageThreshold: string @@ -54,6 +55,7 @@ export const DM_SCOPE_OPTIONS = [ export const EMPTY_FORM: CoreConfigForm = { workspace: "", restrictToWorkspace: true, + allowRemote: true, maxTokens: "32768", maxToolIterations: "50", summarizeMessageThreshold: "20", @@ -103,6 +105,8 @@ export function buildFormFromConfig(config: unknown): CoreConfigForm { const session = asRecord(root.session) const heartbeat = asRecord(root.heartbeat) const devices = asRecord(root.devices) + const tools = asRecord(root.tools) + const exec = asRecord(tools.exec) return { workspace: asString(defaults.workspace) || EMPTY_FORM.workspace, @@ -110,6 +114,10 @@ export function buildFormFromConfig(config: unknown): CoreConfigForm { defaults.restrict_to_workspace === undefined ? EMPTY_FORM.restrictToWorkspace : asBool(defaults.restrict_to_workspace), + allowRemote: + exec.allow_remote === undefined + ? EMPTY_FORM.allowRemote + : asBool(exec.allow_remote), maxTokens: asNumberString(defaults.max_tokens, EMPTY_FORM.maxTokens), maxToolIterations: asNumberString( defaults.max_tool_iterations, diff --git a/web/frontend/src/components/skills/skills-page.tsx b/web/frontend/src/components/skills/skills-page.tsx new file mode 100644 index 000000000..3b5c5acb4 --- /dev/null +++ b/web/frontend/src/components/skills/skills-page.tsx @@ -0,0 +1,314 @@ +import { + IconFileInfo, + IconLoader2, + IconPlus, + IconTrash, +} from "@tabler/icons-react" +import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query" +import { type ChangeEvent, useRef, useState } from "react" +import { useTranslation } from "react-i18next" +import ReactMarkdown from "react-markdown" +import remarkGfm from "remark-gfm" +import { toast } from "sonner" + +import { + type SkillSupportItem, + deleteSkill, + getSkill, + getSkills, + importSkill, +} from "@/api/skills" +import { PageHeader } from "@/components/page-header" +import { + AlertDialog, + AlertDialogAction, + AlertDialogCancel, + AlertDialogContent, + AlertDialogDescription, + AlertDialogFooter, + AlertDialogHeader, + AlertDialogTitle, +} from "@/components/ui/alert-dialog" +import { Button } from "@/components/ui/button" +import { + Card, + CardContent, + CardDescription, + CardHeader, + CardTitle, +} from "@/components/ui/card" +import { + Sheet, + SheetContent, + SheetDescription, + SheetHeader, + SheetTitle, +} from "@/components/ui/sheet" + +export function SkillsPage() { + const { t } = useTranslation() + const queryClient = useQueryClient() + const importInputRef = useRef(null) + const [selectedSkill, setSelectedSkill] = useState( + null, + ) + const [skillPendingDelete, setSkillPendingDelete] = + useState(null) + + const { data, isLoading, error } = useQuery({ + queryKey: ["skills"], + queryFn: getSkills, + }) + const { + data: selectedSkillDetail, + isLoading: isSkillDetailLoading, + error: skillDetailError, + } = useQuery({ + queryKey: ["skills", selectedSkill?.name], + queryFn: () => getSkill(selectedSkill!.name), + enabled: selectedSkill !== null, + }) + + const importMutation = useMutation({ + mutationFn: async (file: File) => importSkill(file), + onSuccess: () => { + toast.success(t("pages.agent.skills.import_success")) + void queryClient.invalidateQueries({ queryKey: ["skills"] }) + }, + onError: (err) => { + toast.error( + err instanceof Error + ? err.message + : t("pages.agent.skills.import_error"), + ) + }, + }) + + const deleteMutation = useMutation({ + mutationFn: async (name: string) => deleteSkill(name), + onSuccess: (_, deletedName) => { + toast.success(t("pages.agent.skills.delete_success")) + setSkillPendingDelete(null) + if ( + selectedSkill?.name === deletedName && + selectedSkill.source === "workspace" + ) { + setSelectedSkill(null) + } + void queryClient.invalidateQueries({ queryKey: ["skills"] }) + }, + onError: (err) => { + toast.error( + err instanceof Error + ? err.message + : t("pages.agent.skills.delete_error"), + ) + }, + }) + + const handleImportClick = () => { + importInputRef.current?.click() + } + + const handleImportFileChange = (event: ChangeEvent) => { + const file = event.target.files?.[0] + if (!file) return + importMutation.mutate(file) + event.target.value = "" + } + + return ( +
+ + + + + } + /> + +
+
+ {isLoading ? ( +
+ {t("labels.loading")} +
+ ) : error ? ( +
+ {t("pages.agent.load_error")} +
+ ) : ( +
+

+ {t("pages.agent.skills.description")} +

+ + {data?.skills.length ? ( +
+ {data.skills.map((skill) => ( + + +
+
+ + {skill.name} + + + {skill.description || + t("pages.agent.skills.no_description")} + +
+
+ + {skill.source === "workspace" ? ( + + ) : null} +
+
+ + +
+ {t("pages.agent.skills.path")} +
+
+ {skill.path} +
+ + + ))} +
+ ) : ( + + + {t("pages.agent.skills.empty")} + + + )} +
+ )} +
+
+ + { + if (!open) setSelectedSkill(null) + }} + > + + + + {selectedSkill?.name || t("pages.agent.skills.viewer_title")} + + + {selectedSkill?.description || + t("pages.agent.skills.viewer_description")} + + + +
+ {isSkillDetailLoading ? ( +
+ {t("pages.agent.skills.loading_detail")} +
+ ) : skillDetailError ? ( +
+ {t("pages.agent.skills.load_detail_error")} +
+ ) : selectedSkillDetail ? ( +
+
+ + {selectedSkillDetail.content} + +
+
+ ) : null} +
+ + + + { + if (!open) setSkillPendingDelete(null) + }} + > + + + + {t("pages.agent.skills.delete_title")} + + + {t("pages.agent.skills.delete_description", { + name: skillPendingDelete?.name, + })} + + + + + {t("common.cancel")} + + { + if (skillPendingDelete) + deleteMutation.mutate(skillPendingDelete.name) + }} + > + {deleteMutation.isPending ? ( + + ) : ( + + )} + {t("pages.agent.skills.delete_confirm")} + + + + +
+ ) +} diff --git a/web/frontend/src/components/tools/tools-page.tsx b/web/frontend/src/components/tools/tools-page.tsx new file mode 100644 index 000000000..05aa42122 --- /dev/null +++ b/web/frontend/src/components/tools/tools-page.tsx @@ -0,0 +1,190 @@ +import { IconLoader2 } from "@tabler/icons-react" +import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query" +import { useTranslation } from "react-i18next" +import { toast } from "sonner" + +import { type ToolSupportItem, getTools, setToolEnabled } from "@/api/tools" +import { PageHeader } from "@/components/page-header" +import { Button } from "@/components/ui/button" +import { + Card, + CardContent, + CardDescription, + CardHeader, + CardTitle, +} from "@/components/ui/card" +import { cn } from "@/lib/utils" + +export function ToolsPage() { + const { t } = useTranslation() + const queryClient = useQueryClient() + const { data, isLoading, error } = useQuery({ + queryKey: ["tools"], + queryFn: getTools, + }) + + const toggleMutation = useMutation({ + mutationFn: async ({ name, enabled }: { name: string; enabled: boolean }) => + setToolEnabled(name, enabled), + onSuccess: (_, variables) => { + toast.success( + variables.enabled + ? t("pages.agent.tools.enable_success") + : t("pages.agent.tools.disable_success"), + ) + void queryClient.invalidateQueries({ queryKey: ["tools"] }) + }, + onError: (err) => { + toast.error( + err instanceof Error + ? err.message + : t("pages.agent.tools.toggle_error"), + ) + }, + }) + + const groupedTools = (() => { + if (!data) return [] as Array<[string, ToolSupportItem[]]> + const buckets = new Map() + for (const item of data.tools) { + const list = buckets.get(item.category) ?? [] + list.push(item) + buckets.set(item.category, list) + } + return Array.from(buckets.entries()) + })() + + return ( +
+ + +
+
+ {isLoading ? ( +
+ {t("labels.loading")} +
+ ) : error ? ( +
+ {t("pages.agent.load_error")} +
+ ) : ( +
+

+ {t("pages.agent.tools.description")} +

+ + {data?.tools.length ? ( + groupedTools.map(([category, items]) => ( +
+
+ {t(`pages.agent.tools.categories.${category}`)} +
+
+ {items.map((tool) => { + const reasonText = tool.reason_code + ? t(`pages.agent.tools.reasons.${tool.reason_code}`) + : "" + const isPending = + toggleMutation.isPending && + toggleMutation.variables?.name === tool.name + const nextEnabled = tool.status !== "enabled" + + return ( + + +
+
+ + {tool.name} + + + {tool.description} + +
+
+ + +
+
+ + +
+ {t("pages.agent.tools.config_key", { + key: tool.config_key, + })} +
+ {reasonText ? ( +
+ {reasonText} +
+ ) : null} + + + ) + })} +
+
+ )) + ) : ( + + + {t("pages.agent.tools.empty")} + + + )} +
+ )} +
+
+
+ ) +} + +function ToolStatusBadge({ status }: { status: ToolSupportItem["status"] }) { + const { t } = useTranslation() + + return ( + + {t(`pages.agent.tools.status.${status}`)} + + ) +} diff --git a/web/frontend/src/hooks/use-pico-chat.ts b/web/frontend/src/hooks/use-pico-chat.ts index 7735ad928..4ce615dcf 100644 --- a/web/frontend/src/hooks/use-pico-chat.ts +++ b/web/frontend/src/hooks/use-pico-chat.ts @@ -1,6 +1,8 @@ import dayjs from "dayjs" import { useAtomValue } from "jotai" import { useCallback, useEffect, useRef, useState } from "react" +import { useTranslation } from "react-i18next" +import { toast } from "sonner" import { getPicoToken } from "@/api/pico" import { getSessionHistory } from "@/api/sessions" @@ -100,6 +102,7 @@ export function formatMessageTime(dateRaw: number | string | Date): string { } export function usePicoChat() { + const { t } = useTranslation() const { status: gatewayState } = useAtomValue(gatewayAtom) const [messages, setMessages] = useState([]) const [connectionState, setConnectionState] = @@ -317,43 +320,38 @@ export function usePicoChat() { // Switch to a historical session const switchSession = useCallback( async (sessionId: string) => { - // Disconnect current WebSocket - disconnect() - - // Set new session ID - setActiveSessionId(sessionId) - setIsTyping(false) - - // Load history from backend - try { - const detail = await getSessionHistory(sessionId) - // Set all history messages timestamp from the session updated time as fallback, - // since currently the backend doesn't return per-message timestamp in the history API. - // We'll use the session's updated time for now. - const fallbackTime = detail.updated - - setMessages( - detail.messages.map((m, i) => ({ - id: `hist-${i}-${Date.now()}`, - role: m.role as "user" | "assistant", - content: m.content, - timestamp: fallbackTime, - })), - ) - } catch (err) { - console.error("Failed to load session history:", err) - setMessages([]) + if (sessionId === activeSessionIdRef.current) { + return + } + + try { + const detail = await getSessionHistory(sessionId) + const fallbackTime = detail.updated + const historyMessages = detail.messages.map((m, i) => ({ + id: `hist-${i}-${Date.now()}`, + role: m.role as "user" | "assistant", + content: m.content, + timestamp: fallbackTime, + })) + + // Only switch the active websocket session after history has loaded successfully. + disconnect() + setActiveSessionId(sessionId) + setIsTyping(false) + setMessages(historyMessages) + } catch (err) { + console.error("Failed to load session history:", err) + toast.error(t("chat.historyOpenFailed")) + return } - // Reconnect with new session ID (will use the updated ref) - // Small delay to ensure state has settled setTimeout(() => { if (gatewayState === "running") { connect() } }, 100) }, - [disconnect, connect, gatewayState], + [connect, disconnect, gatewayState, t], ) // Start a new empty chat diff --git a/web/frontend/src/hooks/use-session-history.ts b/web/frontend/src/hooks/use-session-history.ts index 1a6d5c956..790339dba 100644 --- a/web/frontend/src/hooks/use-session-history.ts +++ b/web/frontend/src/hooks/use-session-history.ts @@ -1,4 +1,5 @@ import { useCallback, useEffect, useRef, useState } from "react" +import { useTranslation } from "react-i18next" import { type SessionSummary, deleteSession, getSessions } from "@/api/sessions" @@ -13,22 +14,26 @@ export function useSessionHistory({ activeSessionId, onDeletedActiveSession, }: UseSessionHistoryOptions) { + const { t } = useTranslation() const observerRef = useRef(null) const [sessions, setSessions] = useState([]) const [offset, setOffset] = useState(0) const [hasMore, setHasMore] = useState(true) const [isLoadingMore, setIsLoadingMore] = useState(false) + const [loadError, setLoadError] = useState(false) const loadSessions = useCallback( async (reset = true) => { try { const currentOffset = reset ? 0 : offset if (reset) { + setLoadError(false) setHasMore(true) setOffset(0) } const data = await getSessions(currentOffset, LIMIT) + setLoadError(false) if (data.length < LIMIT) { setHasMore(false) @@ -45,8 +50,12 @@ export function useSessionHistory({ } setOffset(currentOffset + data.length) - } catch { - // silently fail + } catch (err) { + console.error("Failed to fetch session history:", err) + setLoadError(true) + if (!reset) { + setHasMore(false) + } } finally { setIsLoadingMore(false) } @@ -55,11 +64,16 @@ export function useSessionHistory({ ) useEffect(() => { - if (!observerRef.current || !hasMore || isLoadingMore) return + if (!observerRef.current || !hasMore || isLoadingMore || loadError) return const observer = new IntersectionObserver( (entries) => { - if (entries[0].isIntersecting && hasMore && !isLoadingMore) { + if ( + entries[0].isIntersecting && + hasMore && + !isLoadingMore && + !loadError + ) { setIsLoadingMore(true) void loadSessions(false) } @@ -69,7 +83,7 @@ export function useSessionHistory({ observer.observe(observerRef.current) return () => observer.disconnect() - }, [hasMore, isLoadingMore, loadSessions]) + }, [hasMore, isLoadingMore, loadError, loadSessions]) const handleDeleteSession = useCallback( async (id: string) => { @@ -89,6 +103,8 @@ export function useSessionHistory({ return { sessions, hasMore, + loadError, + loadErrorMessage: t("chat.historyLoadFailed"), observerRef, loadSessions, handleDeleteSession, diff --git a/web/frontend/src/hooks/use-sidebar-channels.ts b/web/frontend/src/hooks/use-sidebar-channels.ts index 0848af468..5579a955b 100644 --- a/web/frontend/src/hooks/use-sidebar-channels.ts +++ b/web/frontend/src/hooks/use-sidebar-channels.ts @@ -27,7 +27,7 @@ import { import { getChannelDisplayName } from "@/components/channels/channel-display-name" import { gatewayAtom } from "@/store/gateway" -const DEFAULT_VISIBLE_CHANNELS = 5 +const DEFAULT_VISIBLE_CHANNELS = 4 const CHANNEL_IMPORTANCE_ORDER = [ "discord", "feishu", diff --git a/web/frontend/src/i18n/locales/en.json b/web/frontend/src/i18n/locales/en.json index f1ed0ac16..b88b5c924 100644 --- a/web/frontend/src/i18n/locales/en.json +++ b/web/frontend/src/i18n/locales/en.json @@ -4,6 +4,9 @@ "model_group": "Models", "models": "Models", "credentials": "Credentials", + "agent_group": "Agent", + "skills": "Skills", + "tools": "Tools", "services": "Services", "channels_group": "Channels", "show_more_channels": "More", @@ -25,6 +28,8 @@ }, "history": "History", "noHistory": "No chat history yet", + "historyLoadFailed": "Failed to load chat history", + "historyOpenFailed": "Failed to open this chat history", "loadingMore": "Loading more...", "deleteSession": "Delete session", "messagesCount": "{{count}} messages", @@ -324,12 +329,108 @@ } }, "pages": { + "agent": { + "load_error": "Failed to load agent support information.", + "stats": { + "workspace": "Workspace", + "workspace_hint": "The default agent workspace used for runtime files and workspace skills.", + "skills": "Available Skills", + "skills_hint": "Skills discovered from workspace, global, and builtin roots.", + "tools": "Enabled Tools", + "tools_hint": "{{blocked}} blocked by missing dependencies." + }, + "skills": { + "title": "Skills", + "description": "Skills are loaded from the workspace, global PicoClaw home, and builtin directories.", + "hero_title": "Skill Library", + "hero_description": "Browse every capability package the agent can load, then drill straight into the effective SKILL.md without leaving the page.", + "stats": { + "total": "Total Skills", + "workspace": "Workspace", + "shared": "Shared" + }, + "empty": "No skills are currently available.", + "import": "Import Skill", + "import_title": "Import Skill", + "import_description": "Create a workspace skill by uploading a markdown file as the new SKILL.md.", + "import_name": "Skill Name", + "import_name_placeholder": "e.g. my-workflow", + "import_file": "Markdown File", + "import_file_hint": "Upload a .md file. The backend stores it as workspace/skills//SKILL.md.", + "import_confirm": "Import Skill", + "import_success": "Skill imported.", + "import_error": "Failed to import skill.", + "view": "View", + "delete": "Delete", + "delete_title": "Delete Skill?", + "delete_description": "\"{{name}}\" will be removed from workspace skills.", + "delete_confirm": "Delete", + "delete_success": "Skill deleted.", + "delete_error": "Failed to delete skill.", + "viewer_title": "Skill Content", + "viewer_description": "Read the current effective SKILL.md content here.", + "loading_detail": "Loading skill content...", + "load_detail_error": "Failed to load skill content.", + "source": "Source", + "path": "Skill Path", + "no_description": "No description provided.", + "sources": { + "workspace": "Workspace", + "global": "Global", + "builtin": "Builtin" + }, + "errors": { + "file_required": "Please choose a markdown file to import." + } + }, + "tools": { + "title": "Tools", + "description": "This view reflects whether each agent tool is enabled, disabled, or blocked by a missing prerequisite.", + "hero_title": "Tool Surface", + "hero_description": "Inspect what the agent can actually call right now, which capabilities are blocked, and where each tool is controlled in config.", + "stats": { + "enabled": "Enabled", + "blocked": "Blocked", + "categories": "Categories" + }, + "empty": "No tools are available.", + "enable": "Enable", + "disable": "Disable", + "enable_success": "Tool enabled.", + "disable_success": "Tool disabled.", + "toggle_error": "Failed to update tool state.", + "config_key": "Controlled by tools.{{key}}", + "status": { + "enabled": "Enabled", + "disabled": "Disabled", + "blocked": "Blocked" + }, + "categories": { + "automation": "Automation", + "filesystem": "Filesystem", + "web": "Web", + "communication": "Communication", + "skills": "Skills", + "agents": "Agents", + "hardware": "Hardware", + "discovery": "Discovery" + }, + "reasons": { + "requires_linux": "This tool only works on Linux hosts with the required device files exposed.", + "requires_skills": "Enable `tools.skills` before this skill-registry tool can be used.", + "requires_subagent": "Enable `tools.subagent` before the spawn tool can delegate work.", + "requires_mcp_discovery": "Enable `tools.mcp.discovery` before MCP discovery tools become available." + } + } + }, "config": { "load_error": "Failed to load configuration. Please refresh and try again.", "workspace": "Workspace Directory", "workspace_hint": "Base directory for agent file operations.", "restrict_workspace": "Restrict to Workspace", "restrict_workspace_hint": "Only allow file operations inside workspace.", + "allow_remote": "Allow Remote Shell Execution", + "allow_remote_hint": "When enabled, shell commands can also run for remote sessions or non-local contexts. When disabled, shell execution stays limited to local safe contexts.", "max_tokens": "Max Tokens", "max_tokens_hint": "Upper token limit per model response.", "max_tool_iterations": "Max Tool Iterations", @@ -387,7 +488,9 @@ "unsaved_changes": "You have unsaved changes." }, "logs": { - "description": "System logs and monitoring." + "description": "System logs and monitoring.", + "clear": "Clear logs", + "empty": "Waiting for logs..." } } } diff --git a/web/frontend/src/i18n/locales/zh.json b/web/frontend/src/i18n/locales/zh.json index b66f0f03d..12833cbf5 100644 --- a/web/frontend/src/i18n/locales/zh.json +++ b/web/frontend/src/i18n/locales/zh.json @@ -4,6 +4,9 @@ "model_group": "模型", "models": "模型", "credentials": "凭据", + "agent_group": "智能体", + "skills": "技能", + "tools": "工具", "services": "服务", "channels_group": "频道", "show_more_channels": "更多", @@ -25,6 +28,8 @@ }, "history": "历史记录", "noHistory": "暂无对话历史", + "historyLoadFailed": "加载历史记录失败", + "historyOpenFailed": "打开该历史会话失败", "loadingMore": "加载更多...", "deleteSession": "删除会话", "messagesCount": "{{count}} 条消息", @@ -324,12 +329,108 @@ } }, "pages": { + "agent": { + "load_error": "加载 Agent 支持信息失败。", + "stats": { + "workspace": "工作目录", + "workspace_hint": "默认 Agent 运行时使用的工作目录，也用于加载工作区技能。", + "skills": "可用技能数", + "skills_hint": "从工作区、全局目录和内置目录发现的技能。", + "tools": "已启用工具", + "tools_hint": "其中 {{blocked}} 个因依赖未满足而不可用。" + }, + "skills": { + "title": "技能", + "description": "技能会从工作区、PicoClaw 全局目录和内置目录中加载。", + "hero_title": "技能库", + "hero_description": "在这里查看 Agent 当前可加载的能力包，并且不离开页面就能直接阅读生效后的 SKILL.md。", + "stats": { + "total": "技能总数", + "workspace": "工作区技能", + "shared": "共享技能" + }, + "empty": "当前没有可用技能。", + "import": "导入技能", + "import_title": "导入技能", + "import_description": "通过上传 Markdown 文件创建工作区技能，文件会保存为新的 SKILL.md。", + "import_name": "技能名称", + "import_name_placeholder": "例如 my-workflow", + "import_file": "Markdown 文件", + "import_file_hint": "上传一个 .md 文件。后端会保存到 workspace/skills//SKILL.md。", + "import_confirm": "导入技能", + "import_success": "技能导入成功。", + "import_error": "导入技能失败。", + "view": "查看", + "delete": "删除", + "delete_title": "删除技能？", + "delete_description": "将从工作区技能中移除「{{name}}」。", + "delete_confirm": "删除", + "delete_success": "技能已删除。", + "delete_error": "删除技能失败。", + "viewer_title": "技能内容", + "viewer_description": "这里展示当前生效的 SKILL.md 内容。", + "loading_detail": "正在加载技能内容...", + "load_detail_error": "加载技能内容失败。", + "source": "来源", + "path": "技能路径", + "no_description": "未提供描述。", + "sources": { + "workspace": "工作区", + "global": "全局", + "builtin": "内置" + }, + "errors": { + "file_required": "请先选择要导入的 Markdown 文件。" + } + }, + "tools": { + "title": "工具", + "description": "这里展示每个 Agent 工具当前是已启用、已禁用，还是被依赖条件阻塞。", + "hero_title": "工具面板", + "hero_description": "集中查看 Agent 现在真正可调用的工具、被阻塞的能力，以及它们分别受哪项配置控制。", + "stats": { + "enabled": "已启用", + "blocked": "被阻塞", + "categories": "分类数" + }, + "empty": "当前没有可用工具。", + "enable": "启用", + "disable": "禁用", + "enable_success": "工具已启用。", + "disable_success": "工具已禁用。", + "toggle_error": "更新工具状态失败。", + "config_key": "由 tools.{{key}} 控制", + "status": { + "enabled": "已启用", + "disabled": "已禁用", + "blocked": "被阻塞" + }, + "categories": { + "automation": "自动化", + "filesystem": "文件系统", + "web": "网页", + "communication": "通信", + "skills": "技能", + "agents": "Agent", + "hardware": "硬件", + "discovery": "发现" + }, + "reasons": { + "requires_linux": "该工具仅在 Linux 主机上可用，并且需要暴露对应的设备文件。", + "requires_skills": "需要先启用 `tools.skills`，该技能注册表工具才能使用。", + "requires_subagent": "需要先启用 `tools.subagent`，`spawn` 才能委派任务。", + "requires_mcp_discovery": "需要先启用 `tools.mcp.discovery`，MCP 发现工具才会可用。" + } + } + }, "config": { "load_error": "加载配置失败，请刷新后重试。", "workspace": "工作目录", "workspace_hint": "智能体执行文件读写操作时使用的基础目录。", "restrict_workspace": "限制工作目录访问", "restrict_workspace_hint": "仅允许在工作目录内执行文件操作。", + "allow_remote": "允许远程执行 Shell 命令", + "allow_remote_hint": "开启后，来自远程会话或非本地上下文的请求也可以执行 shell 命令；关闭后，仅允许本地安全上下文执行。", "max_tokens": "最大 Token 数", "max_tokens_hint": "单次模型响应允许的最大 Token 数。", "max_tool_iterations": "最大工具迭代次数", @@ -387,7 +488,9 @@ "unsaved_changes": "您有未保存的更改。" }, "logs": { - "description": "系统日志和监控。" + "description": "系统日志和监控。", + "clear": "清空日志", + "empty": "等待日志中..." } } } diff --git a/web/frontend/src/routeTree.gen.ts b/web/frontend/src/routeTree.gen.ts index 336504075..60f19ab53 100644 --- a/web/frontend/src/routeTree.gen.ts +++ b/web/frontend/src/routeTree.gen.ts @@ -13,10 +13,13 @@ import { Route as ModelsRouteImport } from './routes/models' import { Route as LogsRouteImport } from './routes/logs' import { Route as CredentialsRouteImport } from './routes/credentials' import { Route as ConfigRouteImport } from './routes/config' +import { Route as AgentRouteImport } from './routes/agent' import { Route as ChannelsRouteRouteImport } from './routes/channels/route' import { Route as IndexRouteImport } from './routes/index' import { Route as ConfigRawRouteImport } from './routes/config.raw' import { Route as ChannelsNameRouteImport } from './routes/channels/$name' +import { Route as AgentToolsRouteImport } from './routes/agent/tools' +import { Route as AgentSkillsRouteImport } from './routes/agent/skills' const ModelsRoute = ModelsRouteImport.update({ id: '/models', @@ -38,6 +41,11 @@ const ConfigRoute = ConfigRouteImport.update({ path: '/config', getParentRoute: () => rootRouteImport, } as any) +const AgentRoute = AgentRouteImport.update({ + id: '/agent', + path: '/agent', + getParentRoute: () => rootRouteImport, +} as any) const ChannelsRouteRoute = ChannelsRouteRouteImport.update({ id: '/channels', path: '/channels', @@ -58,24 +66,40 @@ const ChannelsNameRoute = ChannelsNameRouteImport.update({ path: '/$name', getParentRoute: () => ChannelsRouteRoute, } as any) +const AgentToolsRoute = AgentToolsRouteImport.update({ + id: '/tools', + path: '/tools', + getParentRoute: () => AgentRoute, +} as any) +const AgentSkillsRoute = AgentSkillsRouteImport.update({ + id: '/skills', + path: '/skills', + getParentRoute: () => AgentRoute, +} as any) export interface FileRoutesByFullPath { '/': typeof IndexRoute '/channels': typeof ChannelsRouteRouteWithChildren + '/agent': typeof AgentRouteWithChildren '/config': typeof ConfigRouteWithChildren '/credentials': typeof CredentialsRoute '/logs': typeof LogsRoute '/models': typeof ModelsRoute + '/agent/skills': typeof AgentSkillsRoute + '/agent/tools': typeof AgentToolsRoute '/channels/$name': typeof ChannelsNameRoute '/config/raw': typeof ConfigRawRoute } export interface FileRoutesByTo { '/': typeof IndexRoute '/channels': typeof ChannelsRouteRouteWithChildren + '/agent': typeof AgentRouteWithChildren '/config': typeof ConfigRouteWithChildren '/credentials': typeof CredentialsRoute '/logs': typeof LogsRoute '/models': typeof ModelsRoute + '/agent/skills': typeof AgentSkillsRoute + '/agent/tools': typeof AgentToolsRoute '/channels/$name': typeof ChannelsNameRoute '/config/raw': typeof ConfigRawRoute } @@ -83,10 +107,13 @@ export interface FileRoutesById { __root__: typeof rootRouteImport '/': typeof IndexRoute '/channels': typeof ChannelsRouteRouteWithChildren + '/agent': typeof AgentRouteWithChildren '/config': typeof ConfigRouteWithChildren '/credentials': typeof CredentialsRoute '/logs': typeof LogsRoute '/models': typeof ModelsRoute + '/agent/skills': typeof AgentSkillsRoute + '/agent/tools': typeof AgentToolsRoute '/channels/$name': typeof ChannelsNameRoute '/config/raw': typeof ConfigRawRoute } @@ -95,30 +122,39 @@ export interface FileRouteTypes { fullPaths: | '/' | '/channels' + | '/agent' | '/config' | '/credentials' | '/logs' | '/models' + | '/agent/skills' + | '/agent/tools' | '/channels/$name' | '/config/raw' fileRoutesByTo: FileRoutesByTo to: | '/' | '/channels' + | '/agent' | '/config' | '/credentials' | '/logs' | '/models' + | '/agent/skills' + | '/agent/tools' | '/channels/$name' | '/config/raw' id: | '__root__' | '/' | '/channels' + | '/agent' | '/config' | '/credentials' | '/logs' | '/models' + | '/agent/skills' + | '/agent/tools' | '/channels/$name' | '/config/raw' fileRoutesById: FileRoutesById @@ -126,6 +162,7 @@ export interface FileRouteTypes { export interface RootRouteChildren { IndexRoute: typeof IndexRoute ChannelsRouteRoute: typeof ChannelsRouteRouteWithChildren + AgentRoute: typeof AgentRouteWithChildren ConfigRoute: typeof ConfigRouteWithChildren CredentialsRoute: typeof CredentialsRoute LogsRoute: typeof LogsRoute @@ -162,6 +199,13 @@ declare module '@tanstack/react-router' { preLoaderRoute: typeof ConfigRouteImport parentRoute: typeof rootRouteImport } + '/agent': { + id: '/agent' + path: '/agent' + fullPath: '/agent' + preLoaderRoute: typeof AgentRouteImport + parentRoute: typeof rootRouteImport + } '/channels': { id: '/channels' path: '/channels' @@ -190,6 +234,20 @@ declare module '@tanstack/react-router' { preLoaderRoute: typeof ChannelsNameRouteImport parentRoute: typeof ChannelsRouteRoute } + '/agent/tools': { + id: '/agent/tools' + path: '/tools' + fullPath: '/agent/tools' + preLoaderRoute: typeof AgentToolsRouteImport + parentRoute: typeof AgentRoute + } + '/agent/skills': { + id: '/agent/skills' + path: '/skills' + fullPath: '/agent/skills' + preLoaderRoute: typeof AgentSkillsRouteImport + parentRoute: typeof AgentRoute + } } } @@ -205,6 +263,18 @@ const ChannelsRouteRouteWithChildren = ChannelsRouteRoute._addFileChildren( ChannelsRouteRouteChildren, ) +interface AgentRouteChildren { + AgentSkillsRoute: typeof AgentSkillsRoute + AgentToolsRoute: typeof AgentToolsRoute +} + +const AgentRouteChildren: AgentRouteChildren = { + AgentSkillsRoute: AgentSkillsRoute, + AgentToolsRoute: AgentToolsRoute, +} + +const AgentRouteWithChildren = AgentRoute._addFileChildren(AgentRouteChildren) + interface ConfigRouteChildren { ConfigRawRoute: typeof ConfigRawRoute } @@ -219,6 +289,7 @@ const ConfigRouteWithChildren = const rootRouteChildren: RootRouteChildren = { IndexRoute: IndexRoute, ChannelsRouteRoute: ChannelsRouteRouteWithChildren, + AgentRoute: AgentRouteWithChildren, ConfigRoute: ConfigRouteWithChildren, CredentialsRoute: CredentialsRoute, LogsRoute: LogsRoute, diff --git a/web/frontend/src/routes/agent.tsx b/web/frontend/src/routes/agent.tsx new file mode 100644 index 000000000..78104de5b --- /dev/null +++ b/web/frontend/src/routes/agent.tsx @@ -0,0 +1,22 @@ +import { + Navigate, + Outlet, + createFileRoute, + useRouterState, +} from "@tanstack/react-router" + +export const Route = createFileRoute("/agent")({ + component: AgentLayout, +}) + +function AgentLayout() { + const pathname = useRouterState({ + select: (state) => state.location.pathname, + }) + + if (pathname === "/agent") { + return + } + + return +} diff --git a/web/frontend/src/routes/agent/skills.tsx b/web/frontend/src/routes/agent/skills.tsx new file mode 100644 index 000000000..bbe396bdb --- /dev/null +++ b/web/frontend/src/routes/agent/skills.tsx @@ -0,0 +1,11 @@ +import { createFileRoute } from "@tanstack/react-router" + +import { SkillsPage } from "@/components/skills/skills-page" + +export const Route = createFileRoute("/agent/skills")({ + component: AgentSkillsRoute, +}) + +function AgentSkillsRoute() { + return +} diff --git a/web/frontend/src/routes/agent/tools.tsx b/web/frontend/src/routes/agent/tools.tsx new file mode 100644 index 000000000..ac8738a8f --- /dev/null +++ b/web/frontend/src/routes/agent/tools.tsx @@ -0,0 +1,11 @@ +import { createFileRoute } from "@tanstack/react-router" + +import { ToolsPage } from "@/components/tools/tools-page" + +export const Route = createFileRoute("/agent/tools")({ + component: AgentToolsRoute, +}) + +function AgentToolsRoute() { + return +} diff --git a/web/frontend/src/routes/logs.tsx b/web/frontend/src/routes/logs.tsx index 39688bd84..ef39e0bdf 100644 --- a/web/frontend/src/routes/logs.tsx +++ b/web/frontend/src/routes/logs.tsx @@ -1,10 +1,12 @@ +import { IconTrash } from "@tabler/icons-react" import { createFileRoute } from "@tanstack/react-router" import { useAtomValue } from "jotai" import { useEffect, useRef, useState } from "react" import { useTranslation } from "react-i18next" -import { getGatewayStatus } from "@/api/gateway" +import { clearGatewayLogs, getGatewayStatus } from "@/api/gateway" import { PageHeader } from "@/components/page-header" +import { Button } from "@/components/ui/button" import { ScrollArea } from "@/components/ui/scroll-area" import { gatewayAtom } from "@/store/gateway" @@ -15,12 +17,31 @@ export const Route = createFileRoute("/logs")({ function LogsPage() { const { t } = useTranslation() const [logs, setLogs] = useState([]) + const [clearing, setClearing] = useState(false) const logOffsetRef = useRef(0) const logRunIdRef = useRef(-1) + const syncTokenRef = useRef(0) const scrollRef = useRef(null) const gateway = useAtomValue(gatewayAtom) + const handleClearLogs = async () => { + setClearing(true) + try { + const data = await clearGatewayLogs() + syncTokenRef.current += 1 + setLogs([]) + logOffsetRef.current = data.log_total ?? 0 + if (data.log_run_id !== undefined) { + logRunIdRef.current = data.log_run_id + } + } catch { + // Ignore clear failures silently to avoid noisy transient errors. + } finally { + setClearing(false) + } + } + useEffect(() => { let mounted = true let timeout: ReturnType @@ -40,17 +61,17 @@ function LogsPage() { } try { + const requestToken = syncTokenRef.current + const requestOffset = logOffsetRef.current + const requestRunId = logRunIdRef.current const data = await getGatewayStatus({ - log_offset: logOffsetRef.current, - log_run_id: logRunIdRef.current, + log_offset: requestOffset, + log_run_id: requestRunId, }) - if (!mounted) return + if (!mounted || requestToken !== syncTokenRef.current) return - if ( - data.log_run_id !== undefined && - data.log_run_id !== logRunIdRef.current - ) { + if (data.log_run_id !== undefined && data.log_run_id !== requestRunId) { logRunIdRef.current = data.log_run_id logOffsetRef.current = 0 if (data.logs) { @@ -90,13 +111,25 @@ function LogsPage() {
-
-

- {t("navigation.logs")} -

-

- {t("pages.logs.description")} -

+
+
+

+ {t("navigation.logs")} +

+

+ {t("pages.logs.description")} +

+
+ +
@@ -104,7 +137,7 @@ function LogsPage() {
{logs.length === 0 ? (
- Waiting for logs... + {t("pages.logs.empty")}
) : ( logs.map((log, i) => ( From 7359b2c86c27108377b74bff5be960d54370f85f Mon Sep 17 00:00:00 2001 From: Cytown Date: Thu, 12 Mar 2026 14:09:31 +0800 Subject: [PATCH 002/202] add testcase for migrate from v0 to v1 --- pkg/config/migration_integration_test.go | 568 +++++++++++++++++++++++ 1 file changed, 568 insertions(+) create mode 100644 pkg/config/migration_integration_test.go diff --git a/pkg/config/migration_integration_test.go b/pkg/config/migration_integration_test.go new file mode 100644 index 000000000..4459c1316 --- /dev/null +++ b/pkg/config/migration_integration_test.go @@ -0,0 +1,568 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package config + +import ( + "encoding/json" + "os" + "path/filepath" + "testing" +) + +// TestMigration_Integration_LegacyConfigWithoutWorkspace tests the issue reported: +// User configured Model and Provider but no Workspace - settings should not be lost +func TestMigration_Integration_LegacyConfigWithoutWorkspace(t *testing.T) { + // Create a temporary directory for test config files + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + // Create a legacy config (version 0) with Model and Provider but NO Workspace + // This simulates the real-world scenario where user settings would be lost + legacyConfig := `{ + "agents": { + "defaults": { + "provider": "openai", + "model": "gpt-4o", + "max_tokens": 8192, + "temperature": 0.7 + } + }, + "channels": { + "telegram": { + "enabled": true, + "token": "test-token" + } + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": { + "enabled": true + } + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + // Load the config - this should trigger migration + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Verify version is updated + if cfg.Version != CurrentVersion { + t.Errorf("Version = %d, want %d", cfg.Version, CurrentVersion) + } + + // CRITICAL: Verify that user's settings are preserved + // This was the bug - these settings were lost when Workspace was empty + if cfg.Agents.Defaults.Provider != "openai" { + t.Errorf("Provider = %q, want %q (user's setting should be preserved)", cfg.Agents.Defaults.Provider, "openai") + } + // Old "model" field is migrated to "model_name" field + if cfg.Agents.Defaults.ModelName != "gpt-4o" { + t.Errorf( + "ModelName = %q, want %q (user's setting should be preserved)", + cfg.Agents.Defaults.ModelName, "gpt-4o", + ) + } + // GetModelName() should also return the migrated value + if cfg.Agents.Defaults.GetModelName() != "gpt-4o" { + t.Errorf("GetModelName() = %q, want %q", cfg.Agents.Defaults.GetModelName(), "gpt-4o") + } + if cfg.Agents.Defaults.MaxTokens != 8192 { + t.Errorf("MaxTokens = %d, want %d", cfg.Agents.Defaults.MaxTokens, 8192) + } + if cfg.Agents.Defaults.Temperature == nil { + t.Error("Temperature should not be nil") + } else if *cfg.Agents.Defaults.Temperature != 0.7 { + t.Errorf("Temperature = %v, want %v", *cfg.Agents.Defaults.Temperature, 0.7) + } + + // Verify Workspace has a default value (should not be empty) + if cfg.Agents.Defaults.Workspace == "" { + t.Error("Workspace should have a default value, not be empty") + } + + // Verify other config sections are preserved + if !cfg.Channels.Telegram.Enabled { + t.Error("Telegram.Enabled should be true") + } + if cfg.Channels.Telegram.Token != "test-token" { + t.Errorf("Telegram.Token = %q, want %q", cfg.Channels.Telegram.Token, "test-token") + } + if cfg.Gateway.Port != 18790 { + t.Errorf("Gateway.Port = %d, want %d", cfg.Gateway.Port, 18790) + } +} + +// TestMigration_Integration_LegacyConfigWithWorkspace tests migration with Workspace set +func TestMigration_Integration_LegacyConfigWithWorkspace(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + legacyConfig := `{ + "agents": { + "defaults": { + "workspace": "/custom/workspace", + "provider": "deepseek", + "model": "deepseek-chat", + "max_tokens": 16384 + } + }, + "channels": { + "telegram": { + "enabled": false + } + }, + "gateway": { + "host": "0.0.0.0", + "port": 8080 + }, + "tools": { + "web": { + "enabled": false + } + }, + "heartbeat": { + "enabled": false + }, + "devices": { + "enabled": true + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // All user settings should be preserved + if cfg.Agents.Defaults.Workspace != "/custom/workspace" { + t.Errorf("Workspace = %q, want %q", cfg.Agents.Defaults.Workspace, "/custom/workspace") + } + if cfg.Agents.Defaults.Provider != "deepseek" { + t.Errorf("Provider = %q, want %q", cfg.Agents.Defaults.Provider, "deepseek") + } + if cfg.Agents.Defaults.ModelName != "deepseek-chat" { + t.Errorf("ModelName = %q, want %q", cfg.Agents.Defaults.ModelName, "deepseek-chat") + } + if cfg.Agents.Defaults.MaxTokens != 16384 { + t.Errorf("MaxTokens = %d, want %d", cfg.Agents.Defaults.MaxTokens, 16384) + } + + // Verify other settings + if cfg.Gateway.Port != 8080 { + t.Errorf("Gateway.Port = %d, want %d", cfg.Gateway.Port, 8080) + } + if !cfg.Devices.Enabled { + t.Error("Devices.Enabled should be true") + } +} + +// TestMigration_Integration_PreservesAllAgentsFields tests that ALL Agents fields are preserved +func TestMigration_Integration_PreservesAllAgentsFields(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + legacyConfig := `{ + "agents": { + "defaults": { + "workspace": "", + "restrict_to_workspace": false, + "allow_read_outside_workspace": true, + "provider": "anthropic", + "model": "claude-opus-4", + "model_fallbacks": ["claude-sonnet-4", "claude-haiku-4"], + "image_model": "claude-opus-4-vision", + "image_model_fallbacks": ["claude-sonnet-4-vision"], + "max_tokens": 4096, + "temperature": 0.5, + "max_tool_iterations": 100, + "summarize_message_threshold": 30, + "summarize_token_percent": 80, + "max_media_size": 10485760 + }, + "list": [ + { + "id": "special-agent", + "default": false, + "name": "Special Agent", + "workspace": "/special/workspace" + } + ] + }, + "channels": { + "telegram": {"enabled": false} + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Verify ALL defaults fields are preserved + d := cfg.Agents.Defaults + + if d.RestrictToWorkspace != false { + t.Errorf("RestrictToWorkspace = %v, want false", d.RestrictToWorkspace) + } + if d.AllowReadOutsideWorkspace != true { + t.Errorf("AllowReadOutsideWorkspace = %v, want true", d.AllowReadOutsideWorkspace) + } + if d.Provider != "anthropic" { + t.Errorf("Provider = %q, want %q", d.Provider, "anthropic") + } + if d.ModelName != "claude-opus-4" { + t.Errorf("ModelName = %q, want %q", d.ModelName, "claude-opus-4") + } + if len(d.ModelFallbacks) != 2 { + t.Errorf("len(ModelFallbacks) = %d, want 2", len(d.ModelFallbacks)) + } else { + if d.ModelFallbacks[0] != "claude-sonnet-4" { + t.Errorf("ModelFallbacks[0] = %q, want %q", d.ModelFallbacks[0], "claude-sonnet-4") + } + if d.ModelFallbacks[1] != "claude-haiku-4" { + t.Errorf("ModelFallbacks[1] = %q, want %q", d.ModelFallbacks[1], "claude-haiku-4") + } + } + if d.ImageModel != "claude-opus-4-vision" { + t.Errorf("ImageModel = %q, want %q", d.ImageModel, "claude-opus-4-vision") + } + if len(d.ImageModelFallbacks) != 1 { + t.Errorf("len(ImageModelFallbacks) = %d, want 1", len(d.ImageModelFallbacks)) + } else if d.ImageModelFallbacks[0] != "claude-sonnet-4-vision" { + t.Errorf("ImageModelFallbacks[0] = %q, want %q", d.ImageModelFallbacks[0], "claude-sonnet-4-vision") + } + if d.MaxTokens != 4096 { + t.Errorf("MaxTokens = %d, want %d", d.MaxTokens, 4096) + } + if d.Temperature == nil || *d.Temperature != 0.5 { + t.Errorf("Temperature = %v, want 0.5", d.Temperature) + } + if d.MaxToolIterations != 100 { + t.Errorf("MaxToolIterations = %d, want %d", d.MaxToolIterations, 100) + } + if d.SummarizeMessageThreshold != 30 { + t.Errorf("SummarizeMessageThreshold = %d, want %d", d.SummarizeMessageThreshold, 30) + } + if d.SummarizeTokenPercent != 80 { + t.Errorf("SummarizeTokenPercent = %d, want %d", d.SummarizeTokenPercent, 80) + } + if d.MaxMediaSize != 10485760 { + t.Errorf("MaxMediaSize = %d, want %d", d.MaxMediaSize, 10485760) + } + + // Verify agent list is preserved + if len(cfg.Agents.List) != 1 { + t.Fatalf("len(Agents.List) = %d, want 1", len(cfg.Agents.List)) + } + if cfg.Agents.List[0].ID != "special-agent" { + t.Errorf("Agent.ID = %q, want %q", cfg.Agents.List[0].ID, "special-agent") + } + if cfg.Agents.List[0].Workspace != "/special/workspace" { + t.Errorf("Agent.Workspace = %q, want %q", cfg.Agents.List[0].Workspace, "/special/workspace") + } + + // Workspace should have default since it was empty in legacy config + if d.Workspace == "" { + t.Error("Workspace should have a default value, not be empty") + } +} + +// TestMigration_Integration_ChannelsConfigMigrated tests channel config migration +func TestMigration_Integration_ChannelsConfigMigrated(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + // Legacy config with old channel field formats + legacyConfig := `{ + "agents": { + "defaults": {} + }, + "channels": { + "discord": { + "enabled": true, + "token": "discord-token", + "mention_only": true + }, + "onebot": { + "enabled": true, + "ws_url": "ws://127.0.0.1:3001", + "group_trigger_prefix": ["/", "!"] + } + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Discord: mention_only should be migrated to group_trigger.mention_only + if cfg.Channels.Discord.GroupTrigger.MentionOnly != true { + t.Error("Discord.GroupTrigger.MentionOnly should be true after migration") + } + + // OneBot: group_trigger_prefix should be migrated to group_trigger.prefixes + if len(cfg.Channels.OneBot.GroupTrigger.Prefixes) != 2 { + t.Errorf("len(OneBot.GroupTrigger.Prefixes) = %d, want 2", len(cfg.Channels.OneBot.GroupTrigger.Prefixes)) + } else { + if cfg.Channels.OneBot.GroupTrigger.Prefixes[0] != "/" { + t.Errorf("Prefixes[0] = %q, want %q", cfg.Channels.OneBot.GroupTrigger.Prefixes[0], "/") + } + if cfg.Channels.OneBot.GroupTrigger.Prefixes[1] != "!" { + t.Errorf("Prefixes[1] = %q, want %q", cfg.Channels.OneBot.GroupTrigger.Prefixes[1], "!") + } + } +} + +// TestMigration_Integration_RoundTrip_SerializeAndLoad tests that migrated config can be saved and reloaded +func TestMigration_Integration_RoundTrip_SerializeAndLoad(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + legacyConfig := `{ + "agents": { + "defaults": { + "provider": "openai", + "model": "gpt-4o", + "max_tokens": 8192 + } + }, + "channels": { + "telegram": { + "enabled": true, + "token": "test-token" + } + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + // First load - triggers migration and saves + cfg1, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("First LoadConfig failed: %v", err) + } + + // Read the migrated config from disk + migratedData, err := os.ReadFile(configPath) + if err != nil { + t.Fatalf("Failed to read migrated config: %v", err) + } + + // Verify it has the current version + var versionCheck struct { + Version int `json:"version"` + } + if err = json.Unmarshal(migratedData, &versionCheck); err != nil { + t.Fatalf("Failed to parse migrated config version: %v", err) + } + if versionCheck.Version != CurrentVersion { + t.Errorf("Migrated config version = %d, want %d", versionCheck.Version, CurrentVersion) + } + + // Second load - should load the migrated config without changes + cfg2, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("Second LoadConfig failed: %v", err) + } + + // Verify configs are identical + if cfg2.Agents.Defaults.Provider != cfg1.Agents.Defaults.Provider { + t.Errorf("Provider changed from %q to %q", cfg1.Agents.Defaults.Provider, cfg2.Agents.Defaults.Provider) + } + if cfg2.Agents.Defaults.ModelName != cfg1.Agents.Defaults.ModelName { + t.Errorf("ModelName changed from %q to %q", cfg1.Agents.Defaults.ModelName, cfg2.Agents.Defaults.ModelName) + } + if cfg2.Agents.Defaults.MaxTokens != cfg1.Agents.Defaults.MaxTokens { + t.Errorf("MaxTokens changed from %d to %d", cfg1.Agents.Defaults.MaxTokens, cfg2.Agents.Defaults.MaxTokens) + } +} + +// TestMigration_Integration_EmptyAgentsDefaults tests migration with completely empty agents config +func TestMigration_Integration_EmptyAgentsDefaults(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + // Legacy config with empty agents defaults + legacyConfig := `{ + "agents": { + "defaults": {} + }, + "channels": { + "telegram": {"enabled": false} + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Workspace should have default value + if cfg.Agents.Defaults.Workspace == "" { + t.Error("Workspace should have a default value") + } + + // Note: When fields are explicitly set in config (even to zero values), + // they override defaults. This is correct JSON unmarshaling behavior. + // Users should set values they want; defaults are for unspecified fields. + if cfg.Agents.Defaults.MaxTokens == 0 { + // This is expected when users don't set max_tokens in their config + // The zero value (0) from the legacy config is preserved + } + if cfg.Agents.Defaults.MaxToolIterations == 0 { + // Same as above - zero value is preserved if it was in the config + } +} + +// TestMigration_Integration_ModelNameField tests migration using new model_name field +func TestMigration_Integration_ModelNameField(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + // Legacy config using the new model_name field + legacyConfig := `{ + "agents": { + "defaults": { + "provider": "deepseek", + "model_name": "deepseek-reasoner", + "model_fallbacks": ["deepseek-chat"] + } + }, + "channels": { + "telegram": {"enabled": false} + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // model_name field should be preserved + if cfg.Agents.Defaults.ModelName != "deepseek-reasoner" { + t.Errorf("ModelName = %q, want %q", cfg.Agents.Defaults.ModelName, "deepseek-reasoner") + } + + // GetModelName() should return model_name, not model (deprecated) + if cfg.Agents.Defaults.GetModelName() != "deepseek-reasoner" { + t.Errorf("GetModelName() = %q, want %q", cfg.Agents.Defaults.GetModelName(), "deepseek-reasoner") + } + + if len(cfg.Agents.Defaults.ModelFallbacks) != 1 { + t.Errorf("len(ModelFallbacks) = %d, want 1", len(cfg.Agents.Defaults.ModelFallbacks)) + } else if cfg.Agents.Defaults.ModelFallbacks[0] != "deepseek-chat" { + t.Errorf("ModelFallbacks[0] = %q, want %q", cfg.Agents.Defaults.ModelFallbacks[0], "deepseek-chat") + } +} From 26fa98c359a2411b418efcb272bfb0350baa1a7c Mon Sep 17 00:00:00 2001 From: Dimitrij Denissenko Date: Fri, 13 Mar 2026 13:17:38 +0000 Subject: [PATCH 003/202] Align rendering with Matrix' CommonMark guidelines --- pkg/channels/matrix/matrix.go | 5 +- pkg/channels/matrix/matrix_test.go | 101 +++++++++++++++++++++++++---- 2 files changed, 90 insertions(+), 16 deletions(-) diff --git a/pkg/channels/matrix/matrix.go b/pkg/channels/matrix/matrix.go index bec5dfdac..71561fcc6 100644 --- a/pkg/channels/matrix/matrix.go +++ b/pkg/channels/matrix/matrix.go @@ -273,8 +273,9 @@ func (c *MatrixChannel) Stop(ctx context.Context) error { } func markdownToHTML(md string) string { - p := parser.NewWithExtensions(parser.CommonExtensions | parser.AutoHeadingIDs) - renderer := mdhtml.NewRenderer(mdhtml.RendererOptions{Flags: mdhtml.CommonFlags}) + extensions := (parser.CommonExtensions | parser.NoEmptyLineBeforeBlock) &^ parser.DefinitionLists + p := parser.NewWithExtensions(extensions) + renderer := mdhtml.NewRenderer(mdhtml.RendererOptions{Flags: mdhtml.UseXHTML}) return strings.TrimSpace(string(markdown.ToHTML([]byte(md), p, renderer))) } diff --git a/pkg/channels/matrix/matrix_test.go b/pkg/channels/matrix/matrix_test.go index 07a35c021..1331ed22c 100644 --- a/pkg/channels/matrix/matrix_test.go +++ b/pkg/channels/matrix/matrix_test.go @@ -340,23 +340,96 @@ func TestMatrixOutboundContent(t *testing.T) { } func TestMarkdownToHTML(t *testing.T) { - tests := []struct { + cases := []struct { name string - input string - contains string + md string + rendered string }{ - {"bold", "**hello**", "hello"}, - {"italic", "_world_", "world"}, - {"header", "### Title", ""}, - {"inline code", "`x`", "x"}, - {"plain text", "just text", "just text"}, + { + name: "paragraph", + md: "just **some** text with _custom_ formatting and `inline` code", + rendered: "

just some text with custom formatting and inline code

", + }, + { + name: "heading", + md: "### Title", + rendered: `

Title

`, + }, + { + name: "fenced code block", + md: "```\nfoo()\n```", + rendered: "
foo()\n
", + }, + { + name: "loose list", + md: "- Item one\n\n- Item two\n", + rendered: `
    +

  • Item one

    • + +

  • Item two

    • +
`, + }, + { + name: "tight list", + md: "- Alpha\n- Beta\n", + rendered: `
    +
  • Alpha
    • +
  • Beta
    • +
`, + }, + { + name: "list item with nested sublist", + md: "1. Steps overview:\n\n - Step A\n - Step B\n", + rendered: `
    +

  1. Steps overview:

    + +
      +
    • Step A
      • +
    • Step B
      • +
    2. +
`, + }, + { + // Definition list syntax is not enabled; the term and definition are + // rendered as a plain paragraph rather than
/
/
elements. + name: "definition list syntax renders as plain paragraph", + md: "Term\n: Definition of the term.\n", + rendered: "

Term\n: Definition of the term.

", + }, + { + name: "comprehensive document with headings, paragraphs, list, and code block", + md: "# Overview\n\nThis is a sample document designed to demonstrate various Markdown elements in a single block of text.\n\nThe first paragraph introduces the concept of structured data.\n\n## Details\n\nThe following is a list:\n\n* First\n* Second\n* Third\n\nThe second paragraph focuses on details. Below is a generic code snippet:\n\n```python\ndef calculate_area(radius):\n import math\n return math.pi * (radius ** 2)\n```\n\nThis concludes the generic sample text.\n", + rendered: `

Overview

+ +

This is a sample document designed to demonstrate various Markdown elements in a single block of text.

+ +

The first paragraph introduces the concept of structured data.

+ +

Details

+ +

The following is a list:

+ +
    +
  • First
    • +
  • Second
    • +
  • Third
    • +
+ +

The second paragraph focuses on details. Below is a generic code snippet:

+ +
def calculate_area(radius):
+    import math
+    return math.pi * (radius ** 2)
+
+ +

This concludes the generic sample text.

`, + }, } - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - got := markdownToHTML(tt.input) - if !strings.Contains(got, tt.contains) { - t.Fatalf("markdownToHTML(%q) = %q, want it to contain %q", tt.input, got, tt.contains) + + for _, tc := range cases { + t.Run(tc.name, func(t *testing.T) { + if got := markdownToHTML(tc.md); got != tc.rendered { + t.Fatalf("markdownToHTML(%q)\n got: %q\nwant: %q", tc.md, got, tc.rendered) } }) } From d08bb02f8fe5092ff02469d10d372f897240504b Mon Sep 17 00:00:00 2001 From: Christoforus Surjoputro Date: Fri, 20 Mar 2026 15:35:18 +0700 Subject: [PATCH 004/202] update restart policy to unless-stopped --- docker/docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml index b26cf4199..0bf46a2ae 100644 --- a/docker/docker-compose.yml +++ b/docker/docker-compose.yml @@ -24,7 +24,7 @@ services: picoclaw-gateway: image: docker.io/sipeed/picoclaw:latest container_name: picoclaw-gateway - restart: on-failure + restart: unless-stopped profiles: - gateway # Uncomment to access host network; leave commented unless needed. @@ -40,7 +40,7 @@ services: picoclaw-launcher: image: docker.io/sipeed/picoclaw:launcher container_name: picoclaw-launcher - restart: on-failure + restart: unless-stopped profiles: - launcher environment: From 0276554d9c90d9782c999b0b61db0f3cea10584d Mon Sep 17 00:00:00 2001 From: perhapzz Date: Fri, 20 Mar 2026 10:41:08 +0000 Subject: [PATCH 005/202] test(fileutil,health): add unit tests for WriteFileAtomic and health server Add comprehensive test coverage for two previously untested packages: pkg/fileutil (9 tests): - Basic write and read-back - File permissions (0600) - Overwrite existing files - Empty data handling - Nested directory auto-creation - No temp files left after success - Large file (1MB) handling - Concurrent write safety - Invalid path error handling pkg/health (15 tests): - Health endpoint returns 200 with status, uptime, pid - Ready endpoint returns 503 when not ready - Ready endpoint returns 200 when ready - Ready fails when any registered check fails - Ready passes with all checks passing - Reload rejects non-POST methods - Reload returns 503 when no reload func set - Reload calls registered function on success - Reload returns 500 on function error - SetReady toggle behavior - Multiple health checks interaction - RegisterOnMux works with custom ServeMux - NewServer defaults - StartContext graceful shutdown on cancel - statusString helper --- pkg/fileutil/file_test.go | 176 ++++++++++++++++++++ pkg/health/server_test.go | 337 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 513 insertions(+) create mode 100644 pkg/fileutil/file_test.go create mode 100644 pkg/health/server_test.go diff --git a/pkg/fileutil/file_test.go b/pkg/fileutil/file_test.go new file mode 100644 index 000000000..b0494d0d3 --- /dev/null +++ b/pkg/fileutil/file_test.go @@ -0,0 +1,176 @@ +package fileutil + +import ( + "os" + "path/filepath" + "sync" + "testing" +) + +func TestWriteFileAtomic_Basic(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "test.txt") + data := []byte("hello picoclaw") + + err := WriteFileAtomic(path, data, 0o644) + if err != nil { + t.Fatalf("WriteFileAtomic failed: %v", err) + } + + got, err := os.ReadFile(path) + if err != nil { + t.Fatalf("ReadFile failed: %v", err) + } + if string(got) != string(data) { + t.Errorf("got %q, want %q", got, data) + } +} + +func TestWriteFileAtomic_Permissions(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "secret.txt") + + err := WriteFileAtomic(path, []byte("secret"), 0o600) + if err != nil { + t.Fatalf("WriteFileAtomic failed: %v", err) + } + + info, err := os.Stat(path) + if err != nil { + t.Fatalf("Stat failed: %v", err) + } + // On Unix, check file mode (ignoring directory bits) + if got := info.Mode().Perm(); got != 0o600 { + t.Errorf("permissions = %o, want %o", got, 0o600) + } +} + +func TestWriteFileAtomic_Overwrite(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "overwrite.txt") + + // Write initial content + if err := WriteFileAtomic(path, []byte("old"), 0o644); err != nil { + t.Fatalf("first write failed: %v", err) + } + + // Overwrite + if err := WriteFileAtomic(path, []byte("new"), 0o644); err != nil { + t.Fatalf("second write failed: %v", err) + } + + got, _ := os.ReadFile(path) + if string(got) != "new" { + t.Errorf("got %q after overwrite, want %q", got, "new") + } +} + +func TestWriteFileAtomic_EmptyData(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "empty.txt") + + err := WriteFileAtomic(path, []byte{}, 0o644) + if err != nil { + t.Fatalf("WriteFileAtomic with empty data failed: %v", err) + } + + got, _ := os.ReadFile(path) + if len(got) != 0 { + t.Errorf("expected empty file, got %d bytes", len(got)) + } +} + +func TestWriteFileAtomic_CreatesParentDirs(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "a", "b", "c", "deep.txt") + + err := WriteFileAtomic(path, []byte("deep"), 0o644) + if err != nil { + t.Fatalf("WriteFileAtomic with nested dirs failed: %v", err) + } + + got, _ := os.ReadFile(path) + if string(got) != "deep" { + t.Errorf("got %q, want %q", got, "deep") + } +} + +func TestWriteFileAtomic_NoTempFileOnSuccess(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "clean.txt") + + if err := WriteFileAtomic(path, []byte("data"), 0o644); err != nil { + t.Fatalf("WriteFileAtomic failed: %v", err) + } + + // Verify no temp files remain + entries, _ := os.ReadDir(dir) + for _, e := range entries { + if e.Name() != "clean.txt" { + t.Errorf("unexpected file remaining: %s", e.Name()) + } + } +} + +func TestWriteFileAtomic_LargeFile(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "large.bin") + + // 1MB of data + data := make([]byte, 1<<20) + for i := range data { + data[i] = byte(i % 256) + } + + if err := WriteFileAtomic(path, data, 0o644); err != nil { + t.Fatalf("WriteFileAtomic with large file failed: %v", err) + } + + got, _ := os.ReadFile(path) + if len(got) != len(data) { + t.Errorf("file size = %d, want %d", len(got), len(data)) + } +} + +func TestWriteFileAtomic_Concurrent(t *testing.T) { + dir := t.TempDir() + path := filepath.Join(dir, "concurrent.txt") + + var wg sync.WaitGroup + errs := make(chan error, 10) + + for i := 0; i < 10; i++ { + wg.Add(1) + go func(n int) { + defer wg.Done() + data := []byte(string(rune('A' + n))) + if err := WriteFileAtomic(path, data, 0o644); err != nil { + errs <- err + } + }(i) + } + + wg.Wait() + close(errs) + + for err := range errs { + t.Errorf("concurrent write error: %v", err) + } + + // File should exist and contain exactly 1 byte (last writer wins) + got, err := os.ReadFile(path) + if err != nil { + t.Fatalf("ReadFile after concurrent writes failed: %v", err) + } + if len(got) != 1 { + t.Errorf("expected 1 byte after concurrent writes, got %d", len(got)) + } +} + +func TestWriteFileAtomic_InvalidPath(t *testing.T) { + // /dev/null/impossible is not a valid path on any OS + err := WriteFileAtomic("/dev/null/impossible/file.txt", []byte("data"), 0o644) + if err == nil { + t.Error("expected error for invalid path, got nil") + } +} diff --git a/pkg/health/server_test.go b/pkg/health/server_test.go new file mode 100644 index 000000000..3e71be62a --- /dev/null +++ b/pkg/health/server_test.go @@ -0,0 +1,337 @@ +package health + +import ( + "context" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "testing" + "time" +) + +func newTestServer() *Server { + s := &Server{ + ready: false, + checks: make(map[string]Check), + startTime: time.Now(), + } + return s +} + +func TestHealthHandler_ReturnsOK(t *testing.T) { + s := newTestServer() + req := httptest.NewRequest(http.MethodGet, "/health", nil) + w := httptest.NewRecorder() + + s.healthHandler(w, req) + + if w.Code != http.StatusOK { + t.Errorf("health status = %d, want %d", w.Code, http.StatusOK) + } + + var resp StatusResponse + if err := json.NewDecoder(w.Body).Decode(&resp); err != nil { + t.Fatalf("failed to decode response: %v", err) + } + if resp.Status != "ok" { + t.Errorf("status = %q, want %q", resp.Status, "ok") + } + if resp.Pid == 0 { + t.Error("pid should not be 0") + } + if resp.Uptime == "" { + t.Error("uptime should not be empty") + } +} + +func TestReadyHandler_NotReady(t *testing.T) { + s := newTestServer() + // s.ready defaults to false + req := httptest.NewRequest(http.MethodGet, "/ready", nil) + w := httptest.NewRecorder() + + s.readyHandler(w, req) + + if w.Code != http.StatusServiceUnavailable { + t.Errorf("ready status = %d, want %d", w.Code, http.StatusServiceUnavailable) + } + + var resp StatusResponse + json.NewDecoder(w.Body).Decode(&resp) + if resp.Status != "not ready" { + t.Errorf("status = %q, want %q", resp.Status, "not ready") + } +} + +func TestReadyHandler_Ready(t *testing.T) { + s := newTestServer() + s.SetReady(true) + + req := httptest.NewRequest(http.MethodGet, "/ready", nil) + w := httptest.NewRecorder() + + s.readyHandler(w, req) + + if w.Code != http.StatusOK { + t.Errorf("ready status = %d, want %d", w.Code, http.StatusOK) + } + + var resp StatusResponse + json.NewDecoder(w.Body).Decode(&resp) + if resp.Status != "ready" { + t.Errorf("status = %q, want %q", resp.Status, "ready") + } +} + +func TestReadyHandler_FailedCheck(t *testing.T) { + s := newTestServer() + s.SetReady(true) + + // Register a failing check + s.RegisterCheck("database", func() (bool, string) { + return false, "connection refused" + }) + + req := httptest.NewRequest(http.MethodGet, "/ready", nil) + w := httptest.NewRecorder() + + s.readyHandler(w, req) + + if w.Code != http.StatusServiceUnavailable { + t.Errorf("ready with failed check = %d, want %d", w.Code, http.StatusServiceUnavailable) + } + + var resp StatusResponse + json.NewDecoder(w.Body).Decode(&resp) + if resp.Status != "not ready" { + t.Errorf("status = %q, want %q", resp.Status, "not ready") + } + check, ok := resp.Checks["database"] + if !ok { + t.Fatal("missing database check in response") + } + if check.Status != "fail" { + t.Errorf("check status = %q, want %q", check.Status, "fail") + } + if check.Message != "connection refused" { + t.Errorf("check message = %q, want %q", check.Message, "connection refused") + } +} + +func TestReadyHandler_PassingCheck(t *testing.T) { + s := newTestServer() + s.SetReady(true) + + s.RegisterCheck("redis", func() (bool, string) { + return true, "connected" + }) + + req := httptest.NewRequest(http.MethodGet, "/ready", nil) + w := httptest.NewRecorder() + + s.readyHandler(w, req) + + if w.Code != http.StatusOK { + t.Errorf("ready with passing check = %d, want %d", w.Code, http.StatusOK) + } + + var resp StatusResponse + json.NewDecoder(w.Body).Decode(&resp) + if resp.Checks["redis"].Status != "ok" { + t.Errorf("redis check status = %q, want %q", resp.Checks["redis"].Status, "ok") + } +} + +func TestReloadHandler_MethodNotAllowed(t *testing.T) { + s := newTestServer() + + req := httptest.NewRequest(http.MethodGet, "/reload", nil) + w := httptest.NewRecorder() + + s.reloadHandler(w, req) + + if w.Code != http.StatusMethodNotAllowed { + t.Errorf("reload GET status = %d, want %d", w.Code, http.StatusMethodNotAllowed) + } +} + +func TestReloadHandler_NoReloadFunc(t *testing.T) { + s := newTestServer() + + req := httptest.NewRequest(http.MethodPost, "/reload", nil) + w := httptest.NewRecorder() + + s.reloadHandler(w, req) + + if w.Code != http.StatusServiceUnavailable { + t.Errorf("reload without func = %d, want %d", w.Code, http.StatusServiceUnavailable) + } +} + +func TestReloadHandler_Success(t *testing.T) { + s := newTestServer() + called := false + s.SetReloadFunc(func() error { + called = true + return nil + }) + + req := httptest.NewRequest(http.MethodPost, "/reload", nil) + w := httptest.NewRecorder() + + s.reloadHandler(w, req) + + if w.Code != http.StatusOK { + t.Errorf("reload status = %d, want %d", w.Code, http.StatusOK) + } + if !called { + t.Error("reload function was not called") + } +} + +func TestReloadHandler_Error(t *testing.T) { + s := newTestServer() + s.SetReloadFunc(func() error { + return fmt.Errorf("config parse error") + }) + + req := httptest.NewRequest(http.MethodPost, "/reload", nil) + w := httptest.NewRecorder() + + s.reloadHandler(w, req) + + if w.Code != http.StatusInternalServerError { + t.Errorf("reload error status = %d, want %d", w.Code, http.StatusInternalServerError) + } +} + +func TestSetReady_Toggle(t *testing.T) { + s := newTestServer() + + s.SetReady(true) + req := httptest.NewRequest(http.MethodGet, "/ready", nil) + w := httptest.NewRecorder() + s.readyHandler(w, req) + if w.Code != http.StatusOK { + t.Errorf("after SetReady(true): status = %d, want %d", w.Code, http.StatusOK) + } + + s.SetReady(false) + w = httptest.NewRecorder() + s.readyHandler(w, httptest.NewRequest(http.MethodGet, "/ready", nil)) + if w.Code != http.StatusServiceUnavailable { + t.Errorf("after SetReady(false): status = %d, want %d", w.Code, http.StatusServiceUnavailable) + } +} + +func TestRegisterCheck_MultipleChecks(t *testing.T) { + s := newTestServer() + s.SetReady(true) + + s.RegisterCheck("db", func() (bool, string) { + return true, "ok" + }) + s.RegisterCheck("cache", func() (bool, string) { + return true, "ok" + }) + s.RegisterCheck("queue", func() (bool, string) { + return false, "timeout" + }) + + req := httptest.NewRequest(http.MethodGet, "/ready", nil) + w := httptest.NewRecorder() + s.readyHandler(w, req) + + // Should be not ready because queue check fails + if w.Code != http.StatusServiceUnavailable { + t.Errorf("status = %d, want %d (queue check failed)", w.Code, http.StatusServiceUnavailable) + } + + var resp StatusResponse + json.NewDecoder(w.Body).Decode(&resp) + if len(resp.Checks) != 3 { + t.Errorf("checks count = %d, want 3", len(resp.Checks)) + } +} + +func TestRegisterOnMux(t *testing.T) { + s := newTestServer() + s.SetReady(true) + + mux := http.NewServeMux() + s.RegisterOnMux(mux) + + // Test /health on custom mux + req := httptest.NewRequest(http.MethodGet, "/health", nil) + w := httptest.NewRecorder() + mux.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Errorf("/health on custom mux = %d, want %d", w.Code, http.StatusOK) + } + + // Test /ready on custom mux + req = httptest.NewRequest(http.MethodGet, "/ready", nil) + w = httptest.NewRecorder() + mux.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Errorf("/ready on custom mux = %d, want %d", w.Code, http.StatusOK) + } +} + +func TestNewServer(t *testing.T) { + s := NewServer("127.0.0.1", 0) + if s == nil { + t.Fatal("NewServer returned nil") + } + if s.ready { + t.Error("new server should not be ready by default") + } + if s.checks == nil { + t.Error("checks map should be initialized") + } +} + +func TestStartContext_Cancellation(t *testing.T) { + s := NewServer("127.0.0.1", 0) + + ctx, cancel := context.WithCancel(context.Background()) + + errCh := make(chan error, 1) + go func() { + errCh <- s.StartContext(ctx) + }() + + // Give server time to start + time.Sleep(50 * time.Millisecond) + + // Cancel context should trigger shutdown + cancel() + + select { + case err := <-errCh: + if err != nil { + t.Errorf("StartContext returned unexpected error: %v", err) + } + case <-time.After(2 * time.Second): + t.Error("StartContext did not return after context cancellation") + } +} + +func TestStatusString(t *testing.T) { + tests := []struct { + input bool + want string + }{ + {true, "ok"}, + {false, "fail"}, + } + for _, tt := range tests { + got := statusString(tt.input) + if got != tt.want { + t.Errorf("statusString(%v) = %q, want %q", tt.input, got, tt.want) + } + } +} From 2a28198d0f88d2a69f5fea69350ac0f1ba69a2eb Mon Sep 17 00:00:00 2001 From: perhapzz Date: Fri, 20 Mar 2026 10:48:04 +0000 Subject: [PATCH 006/202] fix: check json.Decode errors and use errors.New instead of fmt.Errorf --- pkg/health/server_test.go | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/pkg/health/server_test.go b/pkg/health/server_test.go index 3e71be62a..6e0b5e66b 100644 --- a/pkg/health/server_test.go +++ b/pkg/health/server_test.go @@ -3,7 +3,7 @@ package health import ( "context" "encoding/json" - "fmt" + "errors" "net/http" "net/http/httptest" "testing" @@ -58,7 +58,9 @@ func TestReadyHandler_NotReady(t *testing.T) { } var resp StatusResponse - json.NewDecoder(w.Body).Decode(&resp) + if err := json.NewDecoder(w.Body).Decode(&resp); err != nil { + t.Fatalf("failed to decode response: %v", err) + } if resp.Status != "not ready" { t.Errorf("status = %q, want %q", resp.Status, "not ready") } @@ -78,7 +80,9 @@ func TestReadyHandler_Ready(t *testing.T) { } var resp StatusResponse - json.NewDecoder(w.Body).Decode(&resp) + if err := json.NewDecoder(w.Body).Decode(&resp); err != nil { + t.Fatalf("failed to decode response: %v", err) + } if resp.Status != "ready" { t.Errorf("status = %q, want %q", resp.Status, "ready") } @@ -103,7 +107,9 @@ func TestReadyHandler_FailedCheck(t *testing.T) { } var resp StatusResponse - json.NewDecoder(w.Body).Decode(&resp) + if err := json.NewDecoder(w.Body).Decode(&resp); err != nil { + t.Fatalf("failed to decode response: %v", err) + } if resp.Status != "not ready" { t.Errorf("status = %q, want %q", resp.Status, "not ready") } @@ -137,7 +143,9 @@ func TestReadyHandler_PassingCheck(t *testing.T) { } var resp StatusResponse - json.NewDecoder(w.Body).Decode(&resp) + if err := json.NewDecoder(w.Body).Decode(&resp); err != nil { + t.Fatalf("failed to decode response: %v", err) + } if resp.Checks["redis"].Status != "ok" { t.Errorf("redis check status = %q, want %q", resp.Checks["redis"].Status, "ok") } @@ -193,7 +201,7 @@ func TestReloadHandler_Success(t *testing.T) { func TestReloadHandler_Error(t *testing.T) { s := newTestServer() s.SetReloadFunc(func() error { - return fmt.Errorf("config parse error") + return errors.New("config parse error") }) req := httptest.NewRequest(http.MethodPost, "/reload", nil) @@ -249,7 +257,9 @@ func TestRegisterCheck_MultipleChecks(t *testing.T) { } var resp StatusResponse - json.NewDecoder(w.Body).Decode(&resp) + if err := json.NewDecoder(w.Body).Decode(&resp); err != nil { + t.Fatalf("failed to decode response: %v", err) + } if len(resp.Checks) != 3 { t.Errorf("checks count = %d, want 3", len(resp.Checks)) } From ba1538f31d72acd50d1e1acc3bd69187712e9e9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ph=E1=BA=A1m=20Minh=20=C4=90=E1=BA=A1t?= Date: Fri, 20 Mar 2026 21:48:29 +0700 Subject: [PATCH 007/202] Fix: cannot create session github copilot --- pkg/providers/github_copilot_provider.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/providers/github_copilot_provider.go b/pkg/providers/github_copilot_provider.go index 6d642b2b5..9e2089219 100644 --- a/pkg/providers/github_copilot_provider.go +++ b/pkg/providers/github_copilot_provider.go @@ -41,8 +41,9 @@ func NewGitHubCopilotProvider(uri string, connectMode string, model string) (*Gi } session, err := client.CreateSession(context.Background(), &copilot.SessionConfig{ - Model: model, - Hooks: &copilot.SessionHooks{}, + Model: model,, + OnPermissionRequest: copilot.PermissionHandler.ApproveAll, + Hooks: &copilot.SessionHooks{} }) if err != nil { client.Stop() From efbe80691305dbc66f1881a4e103d89f2cd8175e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ph=E1=BA=A1m=20Minh=20=C4=90=E1=BA=A1t?= Date: Fri, 20 Mar 2026 22:15:13 +0700 Subject: [PATCH 008/202] Fix bug double , --- pkg/providers/github_copilot_provider.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/providers/github_copilot_provider.go b/pkg/providers/github_copilot_provider.go index 9e2089219..8748fd384 100644 --- a/pkg/providers/github_copilot_provider.go +++ b/pkg/providers/github_copilot_provider.go @@ -41,7 +41,7 @@ func NewGitHubCopilotProvider(uri string, connectMode string, model string) (*Gi } session, err := client.CreateSession(context.Background(), &copilot.SessionConfig{ - Model: model,, + Model: model, OnPermissionRequest: copilot.PermissionHandler.ApproveAll, Hooks: &copilot.SessionHooks{} }) From e4b104c0de1a259bf0946418dd91003ffe0e66ca Mon Sep 17 00:00:00 2001 From: "enoch.z" Date: Fri, 20 Mar 2026 23:15:18 +0800 Subject: [PATCH 009/202] Update helpers.go correction of the promt for the "picoclaw onboard" command. --- cmd/picoclaw/internal/onboard/helpers.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/cmd/picoclaw/internal/onboard/helpers.go b/cmd/picoclaw/internal/onboard/helpers.go index 6f1d4bdd7..626698fec 100644 --- a/cmd/picoclaw/internal/onboard/helpers.go +++ b/cmd/picoclaw/internal/onboard/helpers.go @@ -97,7 +97,11 @@ func onboard(encrypt bool) { fmt.Println("") fmt.Println(" See README.md for 17+ supported providers.") fmt.Println("") - fmt.Println(" 3. Chat: picoclaw agent -m \"Hello!\"") + if encrypt { + fmt.Println(" 3. Chat: picoclaw agent -m \"Hello!\"") + } else { + fmt.Println(" 2. Chat: picoclaw agent -m \"Hello!\"") + } } // promptPassphrase reads the encryption passphrase twice from the terminal From 8f56cceb078a37c55bdf63215ba9c6ae3705ad10 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ph=E1=BA=A1m=20Minh=20=C4=90=E1=BA=A1t?= Date: Fri, 20 Mar 2026 22:17:17 +0700 Subject: [PATCH 010/202] missing , --- pkg/providers/github_copilot_provider.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/providers/github_copilot_provider.go b/pkg/providers/github_copilot_provider.go index 8748fd384..e2d1d7d98 100644 --- a/pkg/providers/github_copilot_provider.go +++ b/pkg/providers/github_copilot_provider.go @@ -43,7 +43,7 @@ func NewGitHubCopilotProvider(uri string, connectMode string, model string) (*Gi session, err := client.CreateSession(context.Background(), &copilot.SessionConfig{ Model: model, OnPermissionRequest: copilot.PermissionHandler.ApproveAll, - Hooks: &copilot.SessionHooks{} + Hooks: &copilot.SessionHooks{}, }) if err != nil { client.Stop() From e455eb5e670e3d2a6e71df2800f45cc8458c40e0 Mon Sep 17 00:00:00 2001 From: Cytown Date: Sun, 22 Mar 2026 01:55:00 +0800 Subject: [PATCH 011/202] refactor: seperate security.yml for store keys --- cmd/picoclaw-launcher-tui/internal/ui/app.go | 2 +- .../internal/ui/channel.go | 72 +- .../internal/ui/model.go | 22 +- cmd/picoclaw/internal/auth/helpers.go | 10 +- cmd/picoclaw/internal/model/command.go | 4 +- cmd/picoclaw/internal/model/command_test.go | 160 ++- cmd/picoclaw/internal/skills/command.go | 2 +- cmd/picoclaw/internal/skills/helpers.go | 26 +- go.mod | 2 +- pkg/agent/instance_test.go | 2 +- pkg/agent/loop.go | 30 +- pkg/channels/dingtalk/dingtalk.go | 4 +- pkg/channels/discord/discord.go | 2 +- pkg/channels/feishu/feishu_64.go | 8 +- pkg/channels/irc/handler.go | 4 +- pkg/channels/irc/irc.go | 6 +- pkg/channels/line/line.go | 10 +- pkg/channels/manager.go | 16 +- pkg/channels/manager_channel.go | 99 ++ pkg/channels/manager_channel_test.go | 6 +- pkg/channels/matrix/matrix.go | 2 +- pkg/channels/onebot/onebot.go | 4 +- pkg/channels/pico/pico.go | 6 +- pkg/channels/qq/qq.go | 4 +- pkg/channels/slack/slack.go | 8 +- pkg/channels/slack/slack_test.go | 24 +- pkg/channels/telegram/telegram.go | 2 +- pkg/channels/wecom/aibot.go | 14 +- pkg/channels/wecom/aibot_test.go | 74 +- pkg/channels/wecom/app.go | 16 +- pkg/channels/wecom/app_test.go | 183 ++- pkg/channels/wecom/bot.go | 10 +- pkg/channels/wecom/bot_test.go | 144 +- pkg/config/REFACTORING_SUMMARY.md | 225 ++++ pkg/config/SECURITY_CONFIG.md | 551 ++++++++ pkg/config/config.go | 1198 ++++++++++++++--- pkg/config/config_old.go | 922 ++++++++++++- pkg/config/config_test.go | 155 ++- pkg/config/defaults.go | 123 +- pkg/config/example_security_usage.go | 423 ++++++ pkg/config/migration.go | 168 ++- pkg/config/migration_integration_test.go | 4 +- pkg/config/migration_test.go | 157 +-- pkg/config/model_config_test.go | 85 +- pkg/config/multikey_test.go | 102 +- pkg/config/security.go | 205 +++ pkg/config/security_integration_test.go | 472 +++++++ pkg/config/security_test.go | 90 ++ .../sources/openclaw/openclaw_config.go | 203 ++- .../sources/openclaw/openclaw_config_test.go | 6 +- pkg/providers/claude_cli_provider_test.go | 8 +- pkg/providers/factory_provider.go | 20 +- pkg/providers/factory_provider_test.go | 23 +- pkg/providers/factory_test.go | 19 +- pkg/voice/transcriber.go | 4 +- pkg/voice/transcriber_test.go | 37 +- security.example.yml | 184 +++ web/backend/api/config.go | 19 +- web/backend/api/config_test.go | 3 +- web/backend/api/gateway.go | 4 +- web/backend/api/gateway_test.go | 28 +- web/backend/api/model_status.go | 12 +- web/backend/api/models.go | 12 +- web/backend/api/models_test.go | 14 +- web/backend/api/oauth.go | 10 +- web/backend/api/oauth_test.go | 12 +- web/backend/api/pico.go | 10 +- web/backend/api/pico_test.go | 12 +- 68 files changed, 5313 insertions(+), 1185 deletions(-) create mode 100644 pkg/config/REFACTORING_SUMMARY.md create mode 100644 pkg/config/SECURITY_CONFIG.md create mode 100644 pkg/config/example_security_usage.go create mode 100644 pkg/config/security.go create mode 100644 pkg/config/security_integration_test.go create mode 100644 pkg/config/security_test.go create mode 100644 security.example.yml diff --git a/cmd/picoclaw-launcher-tui/internal/ui/app.go b/cmd/picoclaw-launcher-tui/internal/ui/app.go index f26b6125c..dced3ba56 100644 --- a/cmd/picoclaw-launcher-tui/internal/ui/app.go +++ b/cmd/picoclaw-launcher-tui/internal/ui/app.go @@ -430,7 +430,7 @@ func (s *appState) isActiveModelValid() bool { if err != nil { return false } - hasKey := strings.TrimSpace(cfg.APIKey) != "" || strings.TrimSpace(cfg.AuthMethod) == "oauth" + hasKey := strings.TrimSpace(cfg.APIKey()) != "" || strings.TrimSpace(cfg.AuthMethod) == "oauth" hasModel := strings.TrimSpace(cfg.Model) != "" return hasKey && hasModel } diff --git a/cmd/picoclaw-launcher-tui/internal/ui/channel.go b/cmd/picoclaw-launcher-tui/internal/ui/channel.go index 2f28af123..7d64407af 100644 --- a/cmd/picoclaw-launcher-tui/internal/ui/channel.go +++ b/cmd/picoclaw-launcher-tui/internal/ui/channel.go @@ -112,8 +112,8 @@ func refreshChannelMenuFromState(menu *Menu, s *appState) { func (s *appState) telegramForm() tview.Primitive { cfg := &s.config.Channels.Telegram form := baseChannelForm("Telegram", cfg.Enabled, s.makeChannelOnEnabled(&cfg.Enabled)) - form.AddInputField("Token", cfg.Token, 128, nil, func(text string) { - cfg.Token = strings.TrimSpace(text) + form.AddInputField("Token", cfg.Token(), 128, nil, func(text string) { + cfg.SetToken(strings.TrimSpace(text)) }) form.AddInputField("Proxy", cfg.Proxy, 128, nil, func(text string) { cfg.Proxy = strings.TrimSpace(text) @@ -125,8 +125,8 @@ func (s *appState) telegramForm() tview.Primitive { func (s *appState) discordForm() tview.Primitive { cfg := &s.config.Channels.Discord form := baseChannelForm("Discord", cfg.Enabled, s.makeChannelOnEnabled(&cfg.Enabled)) - form.AddInputField("Token", cfg.Token, 128, nil, func(text string) { - cfg.Token = strings.TrimSpace(text) + form.AddInputField("Token", cfg.Token(), 128, nil, func(text string) { + cfg.SetToken(strings.TrimSpace(text)) }) form.AddCheckbox("Mention Only", cfg.MentionOnly, func(checked bool) { cfg.MentionOnly = checked @@ -141,8 +141,8 @@ func (s *appState) qqForm() tview.Primitive { form.AddInputField("App ID", cfg.AppID, 64, nil, func(text string) { cfg.AppID = strings.TrimSpace(text) }) - form.AddInputField("App Secret", cfg.AppSecret, 128, nil, func(text string) { - cfg.AppSecret = strings.TrimSpace(text) + form.AddInputField("App Secret", cfg.AppSecret(), 128, nil, func(text string) { + cfg.SetAppSecret(strings.TrimSpace(text)) }) addAllowFromField(form, &cfg.AllowFrom) return wrapWithBack(form, s) @@ -175,14 +175,14 @@ func (s *appState) feishuForm() tview.Primitive { form.AddInputField("App ID", cfg.AppID, 64, nil, func(text string) { cfg.AppID = strings.TrimSpace(text) }) - form.AddInputField("App Secret", cfg.AppSecret, 128, nil, func(text string) { - cfg.AppSecret = strings.TrimSpace(text) + form.AddInputField("App Secret", cfg.AppSecret(), 128, nil, func(text string) { + cfg.SetAppSecret(strings.TrimSpace(text)) }) - form.AddInputField("Encrypt Key", cfg.EncryptKey, 128, nil, func(text string) { - cfg.EncryptKey = strings.TrimSpace(text) + form.AddInputField("Encrypt Key", cfg.EncryptKey(), 128, nil, func(text string) { + cfg.SetEncryptKey(strings.TrimSpace(text)) }) - form.AddInputField("Verification Token", cfg.VerificationToken, 128, nil, func(text string) { - cfg.VerificationToken = strings.TrimSpace(text) + form.AddInputField("Verification Token", cfg.VerificationToken(), 128, nil, func(text string) { + cfg.SetVerificationToken(strings.TrimSpace(text)) }) addAllowFromField(form, &cfg.AllowFrom) return wrapWithBack(form, s) @@ -194,8 +194,8 @@ func (s *appState) dingtalkForm() tview.Primitive { form.AddInputField("Client ID", cfg.ClientID, 64, nil, func(text string) { cfg.ClientID = strings.TrimSpace(text) }) - form.AddInputField("Client Secret", cfg.ClientSecret, 128, nil, func(text string) { - cfg.ClientSecret = strings.TrimSpace(text) + form.AddInputField("Client Secret", cfg.ClientSecret(), 128, nil, func(text string) { + cfg.SetClientSecret(strings.TrimSpace(text)) }) addAllowFromField(form, &cfg.AllowFrom) return wrapWithBack(form, s) @@ -204,11 +204,11 @@ func (s *appState) dingtalkForm() tview.Primitive { func (s *appState) slackForm() tview.Primitive { cfg := &s.config.Channels.Slack form := baseChannelForm("Slack", cfg.Enabled, s.makeChannelOnEnabled(&cfg.Enabled)) - form.AddInputField("Bot Token", cfg.BotToken, 128, nil, func(text string) { - cfg.BotToken = strings.TrimSpace(text) + form.AddInputField("Bot Token", cfg.BotToken(), 128, nil, func(text string) { + cfg.SetBotToken(strings.TrimSpace(text)) }) - form.AddInputField("App Token", cfg.AppToken, 128, nil, func(text string) { - cfg.AppToken = strings.TrimSpace(text) + form.AddInputField("App Token", cfg.AppToken(), 128, nil, func(text string) { + cfg.SetAppToken(strings.TrimSpace(text)) }) addAllowFromField(form, &cfg.AllowFrom) return wrapWithBack(form, s) @@ -217,11 +217,11 @@ func (s *appState) slackForm() tview.Primitive { func (s *appState) lineForm() tview.Primitive { cfg := &s.config.Channels.LINE form := baseChannelForm("LINE", cfg.Enabled, s.makeChannelOnEnabled(&cfg.Enabled)) - form.AddInputField("Channel Secret", cfg.ChannelSecret, 128, nil, func(text string) { - cfg.ChannelSecret = strings.TrimSpace(text) + form.AddInputField("Channel Secret", cfg.ChannelSecret(), 128, nil, func(text string) { + cfg.SetChannelSecret(strings.TrimSpace(text)) }) - form.AddInputField("Channel Access Token", cfg.ChannelAccessToken, 128, nil, func(text string) { - cfg.ChannelAccessToken = strings.TrimSpace(text) + form.AddInputField("Channel Access Token", cfg.ChannelAccessToken(), 128, nil, func(text string) { + cfg.SetChannelAccessToken(strings.TrimSpace(text)) }) form.AddInputField("Webhook Host", cfg.WebhookHost, 64, nil, func(text string) { cfg.WebhookHost = strings.TrimSpace(text) @@ -243,8 +243,8 @@ func (s *appState) matrixForm() tview.Primitive { form.AddInputField("User ID", cfg.UserID, 128, nil, func(text string) { cfg.UserID = strings.TrimSpace(text) }) - form.AddInputField("Access Token", cfg.AccessToken, 128, nil, func(text string) { - cfg.AccessToken = strings.TrimSpace(text) + form.AddInputField("Access Token", cfg.AccessToken(), 128, nil, func(text string) { + cfg.SetAccessToken(strings.TrimSpace(text)) }) form.AddInputField("Device ID", cfg.DeviceID, 128, nil, func(text string) { cfg.DeviceID = strings.TrimSpace(text) @@ -262,8 +262,8 @@ func (s *appState) onebotForm() tview.Primitive { form.AddInputField("WS URL", cfg.WSUrl, 128, nil, func(text string) { cfg.WSUrl = strings.TrimSpace(text) }) - form.AddInputField("Access Token", cfg.AccessToken, 128, nil, func(text string) { - cfg.AccessToken = strings.TrimSpace(text) + form.AddInputField("Access Token", cfg.AccessToken(), 128, nil, func(text string) { + cfg.SetAccessToken(strings.TrimSpace(text)) }) addIntField( form, @@ -287,11 +287,11 @@ func (s *appState) onebotForm() tview.Primitive { func (s *appState) wecomForm() tview.Primitive { cfg := &s.config.Channels.WeCom form := baseChannelForm("WeCom", cfg.Enabled, s.makeChannelOnEnabled(&cfg.Enabled)) - form.AddInputField("Token", cfg.Token, 128, nil, func(text string) { - cfg.Token = strings.TrimSpace(text) + form.AddInputField("Token", cfg.Token(), 128, nil, func(text string) { + cfg.SetToken(strings.TrimSpace(text)) }) - form.AddInputField("Encoding AES Key", cfg.EncodingAESKey, 128, nil, func(text string) { - cfg.EncodingAESKey = strings.TrimSpace(text) + form.AddInputField("Encoding AES Key", cfg.EncodingAESKey(), 128, nil, func(text string) { + cfg.SetEncodingAESKey(strings.TrimSpace(text)) }) form.AddInputField("Webhook URL", cfg.WebhookURL, 128, nil, func(text string) { cfg.WebhookURL = strings.TrimSpace(text) @@ -319,15 +319,15 @@ func (s *appState) wecomAppForm() tview.Primitive { form.AddInputField("Corp ID", cfg.CorpID, 64, nil, func(text string) { cfg.CorpID = strings.TrimSpace(text) }) - form.AddInputField("Corp Secret", cfg.CorpSecret, 128, nil, func(text string) { - cfg.CorpSecret = strings.TrimSpace(text) + form.AddInputField("Corp Secret", cfg.CorpSecret(), 128, nil, func(text string) { + cfg.SetCorpSecret(strings.TrimSpace(text)) }) addInt64Field(form, "Agent ID", cfg.AgentID, func(value int64) { cfg.AgentID = value }) - form.AddInputField("Token", cfg.Token, 128, nil, func(text string) { - cfg.Token = strings.TrimSpace(text) + form.AddInputField("Token", cfg.Token(), 128, nil, func(text string) { + cfg.SetToken(strings.TrimSpace(text)) }) - form.AddInputField("Encoding AES Key", cfg.EncodingAESKey, 128, nil, func(text string) { - cfg.EncodingAESKey = strings.TrimSpace(text) + form.AddInputField("Encoding AES Key", cfg.EncodingAESKey(), 128, nil, func(text string) { + cfg.SetEncodingAESKey(strings.TrimSpace(text)) }) form.AddInputField("Webhook Host", cfg.WebhookHost, 64, nil, func(text string) { cfg.WebhookHost = strings.TrimSpace(text) diff --git a/cmd/picoclaw-launcher-tui/internal/ui/model.go b/cmd/picoclaw-launcher-tui/internal/ui/model.go index c13bfff34..4488619ae 100644 --- a/cmd/picoclaw-launcher-tui/internal/ui/model.go +++ b/cmd/picoclaw-launcher-tui/internal/ui/model.go @@ -49,7 +49,7 @@ func (s *appState) modelMenu() tview.Primitive { Action: func() { newName := s.nextAvailableModelName("new-model") s.addModel( - picoclawconfig.ModelConfig{ModelName: newName, Model: "openai/gpt-5.4"}, + &picoclawconfig.ModelConfig{ModelName: newName, Model: "openai/gpt-5.4"}, ) s.push( fmt.Sprintf("model-%d", len(s.config.ModelList)-1), @@ -90,7 +90,7 @@ func (s *appState) modelMenu() tview.Primitive { } func (s *appState) modelForm(index int) tview.Primitive { - model := &s.config.ModelList[index] + model := s.config.ModelList[index] form := tview.NewForm() form.SetBorder(true).SetTitle(fmt.Sprintf("Model: %s", model.ModelName)) @@ -131,8 +131,8 @@ func (s *appState) modelForm(index int) tview.Primitive { refreshModelMenuFromState(menu, s) } }) - addInput(form, "API Key", model.APIKey, func(value string) { - model.APIKey = value + addInput(form, "API Key", model.APIKey(), func(value string) { + model.SetAPIKey(value) s.dirty = true refreshMainMenuIfPresent(s) if menu, ok := s.menus["model"]; ok { @@ -215,7 +215,7 @@ func addIntInput(form *tview.Form, label string, value int, onChange func(int)) }) } -func (s *appState) addModel(model picoclawconfig.ModelConfig) { +func (s *appState) addModel(model *picoclawconfig.ModelConfig) { s.config.ModelList = append(s.config.ModelList, model) } @@ -236,7 +236,7 @@ func modelStatusColor(valid bool, selected bool) *tcell.Color { return &color } -func refreshModelMenu(menu *Menu, currentModel string, models []picoclawconfig.ModelConfig) { +func refreshModelMenu(menu *Menu, currentModel string, models []*picoclawconfig.ModelConfig) { for i, model := range models { row := i label := fmt.Sprintf("%s (%s)", model.ModelName, model.Model) @@ -291,7 +291,7 @@ func refreshModelMenuFromState(menu *Menu, s *appState) { Action: func() { newName := s.nextAvailableModelName("new-model") s.addModel( - picoclawconfig.ModelConfig{ModelName: newName, Model: "openai/gpt-5.4"}, + &picoclawconfig.ModelConfig{ModelName: newName, Model: "openai/gpt-5.4"}, ) s.push(fmt.Sprintf("model-%d", len(s.config.ModelList)-1), s.modelForm(len(s.config.ModelList)-1)) }, @@ -300,8 +300,8 @@ func refreshModelMenuFromState(menu *Menu, s *appState) { menu.applyItems(items) } -func isModelValid(model picoclawconfig.ModelConfig) bool { - hasKey := strings.TrimSpace(model.APIKey) != "" || +func isModelValid(model *picoclawconfig.ModelConfig) bool { + hasKey := strings.TrimSpace(model.APIKey()) != "" || strings.TrimSpace(model.AuthMethod) == "oauth" hasModel := strings.TrimSpace(model.Model) != "" return hasKey && hasModel @@ -343,7 +343,7 @@ func (s *appState) testModel(model *picoclawconfig.ModelConfig) { if model == nil { return } - if strings.TrimSpace(model.APIKey) == "" { + if strings.TrimSpace(model.APIKey()) == "" { s.showMessage("Missing API Key", "Set api_key before testing") return } @@ -375,7 +375,7 @@ func (s *appState) testModel(model *picoclawconfig.ModelConfig) { return } request.Header.Set("Content-Type", "application/json") - request.Header.Set("Authorization", "Bearer "+strings.TrimSpace(model.APIKey)) + request.Header.Set("Authorization", "Bearer "+strings.TrimSpace(model.APIKey())) resp, err := client.Do(request) if err != nil { diff --git a/cmd/picoclaw/internal/auth/helpers.go b/cmd/picoclaw/internal/auth/helpers.go index 10cfad90c..531cb76aa 100644 --- a/cmd/picoclaw/internal/auth/helpers.go +++ b/cmd/picoclaw/internal/auth/helpers.go @@ -68,7 +68,7 @@ func authLoginOpenAI(useDeviceCode bool) error { // If no openai in ModelList, add it if !foundOpenAI { - appCfg.ModelList = append(appCfg.ModelList, config.ModelConfig{ + appCfg.ModelList = append(appCfg.ModelList, &config.ModelConfig{ ModelName: "gpt-5.4", Model: "openai/gpt-5.4", AuthMethod: "oauth", @@ -139,7 +139,7 @@ func authLoginGoogleAntigravity() error { // If no antigravity in ModelList, add it if !foundAntigravity { - appCfg.ModelList = append(appCfg.ModelList, config.ModelConfig{ + appCfg.ModelList = append(appCfg.ModelList, &config.ModelConfig{ ModelName: "gemini-flash", Model: "antigravity/gemini-3-flash", AuthMethod: "oauth", @@ -213,7 +213,7 @@ func authLoginAnthropicSetupToken() error { } } if !found { - appCfg.ModelList = append(appCfg.ModelList, config.ModelConfig{ + appCfg.ModelList = append(appCfg.ModelList, &config.ModelConfig{ ModelName: defaultAnthropicModel, Model: "anthropic/" + defaultAnthropicModel, AuthMethod: "oauth", @@ -289,7 +289,7 @@ func authLoginPasteToken(provider string) error { } } if !found { - appCfg.ModelList = append(appCfg.ModelList, config.ModelConfig{ + appCfg.ModelList = append(appCfg.ModelList, &config.ModelConfig{ ModelName: defaultAnthropicModel, Model: "anthropic/" + defaultAnthropicModel, AuthMethod: "token", @@ -307,7 +307,7 @@ func authLoginPasteToken(provider string) error { } } if !found { - appCfg.ModelList = append(appCfg.ModelList, config.ModelConfig{ + appCfg.ModelList = append(appCfg.ModelList, &config.ModelConfig{ ModelName: "gpt-5.4", Model: "openai/gpt-5.4", AuthMethod: "token", diff --git a/cmd/picoclaw/internal/model/command.go b/cmd/picoclaw/internal/model/command.go index cc72841e4..314259d0f 100644 --- a/cmd/picoclaw/internal/model/command.go +++ b/cmd/picoclaw/internal/model/command.go @@ -81,7 +81,7 @@ func listAvailableModels(cfg *config.Config) { if model.ModelName == defaultModel { marker = "> " } - if model.APIKey == "" { + if model.APIKey() == "" { continue } fmt.Printf("%s- %s (%s)\n", marker, model.ModelName, model.Model) @@ -92,7 +92,7 @@ func setDefaultModel(configPath string, cfg *config.Config, modelName string) er // Validate that the model exists in model_list modelFound := false for _, model := range cfg.ModelList { - if model.APIKey != "" && model.ModelName == modelName { + if model.APIKey() != "" && model.ModelName == modelName { modelFound = true break } diff --git a/cmd/picoclaw/internal/model/command_test.go b/cmd/picoclaw/internal/model/command_test.go index 9bf19deab..6cbbf0b55 100644 --- a/cmd/picoclaw/internal/model/command_test.go +++ b/cmd/picoclaw/internal/model/command_test.go @@ -58,17 +58,24 @@ func TestNewModelCommand(t *testing.T) { } func TestShowCurrentModel_WithDefaultModel(t *testing.T) { - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "gpt-4", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "gpt-4", Model: "openai/gpt-4", APIKey: "test"}, - {ModelName: "claude-3", Model: "anthropic/claude-3", APIKey: "test"}, + ModelList: []*config.ModelConfig{ + {ModelName: "gpt-4", Model: "openai/gpt-4"}, + {ModelName: "claude-3", Model: "anthropic/claude-3"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "gpt-4": { + APIKeys: []string{"test"}, + }, + "claude-3": { + APIKeys: []string{"test"}, + }, + }}) output := captureStdout(func() { showCurrentModel(cfg) @@ -81,16 +88,20 @@ func TestShowCurrentModel_WithDefaultModel(t *testing.T) { } func TestShowCurrentModel_NoDefaultModel(t *testing.T) { - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "gpt-4", Model: "openai/gpt-4", APIKey: "test"}, + ModelList: []*config.ModelConfig{ + {ModelName: "gpt-4", Model: "openai/gpt-4"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "gpt-4": { + APIKeys: []string{"test"}, + }, + }}) output := captureStdout(func() { showCurrentModel(cfg) @@ -102,7 +113,7 @@ func TestShowCurrentModel_NoDefaultModel(t *testing.T) { func TestListAvailableModels_Empty(t *testing.T) { cfg := &config.Config{ - ModelList: []config.ModelConfig{}, + ModelList: []*config.ModelConfig{}, } output := captureStdout(func() { @@ -113,18 +124,25 @@ func TestListAvailableModels_Empty(t *testing.T) { } func TestListAvailableModels_WithModels(t *testing.T) { - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "gpt-4", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "gpt-4", Model: "openai/gpt-4", APIKey: "test"}, - {ModelName: "claude-3", Model: "anthropic/claude-3", APIKey: "test"}, - {ModelName: "no-key-model", Model: "openai/test", APIKey: ""}, + ModelList: []*config.ModelConfig{ + {ModelName: "gpt-4", Model: "openai/gpt-4"}, + {ModelName: "claude-3", Model: "anthropic/claude-3"}, + {ModelName: "no-key-model", Model: "openai/test"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "gpt-4": { + APIKeys: []string{"test"}, + }, + "claude-3": { + APIKeys: []string{"test"}, + }, + }}) output := captureStdout(func() { listAvailableModels(cfg) @@ -139,17 +157,24 @@ func TestListAvailableModels_WithModels(t *testing.T) { func TestSetDefaultModel_ValidModel(t *testing.T) { initTest(t) - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "old-model", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "new-model", Model: "openai/new-model", APIKey: "test"}, - {ModelName: "old-model", Model: "openai/old-model", APIKey: "test"}, + ModelList: []*config.ModelConfig{ + {ModelName: "new-model", Model: "openai/new-model"}, + {ModelName: "old-model", Model: "openai/old-model"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "new-model": { + APIKeys: []string{"test"}, + }, + "old-model": { + APIKeys: []string{"test"}, + }, + }}) output := captureStdout(func() { err := setDefaultModel(configPath, cfg, "new-model") @@ -167,16 +192,20 @@ func TestSetDefaultModel_ValidModel(t *testing.T) { func TestSetDefaultModel_InvalidModel(t *testing.T) { initTest(t) - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "existing-model", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "existing-model", Model: "openai/existing", APIKey: "test"}, + ModelList: []*config.ModelConfig{ + {ModelName: "existing-model", Model: "openai/existing"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "existing-model": { + APIKeys: []string{"test"}, + }, + }}) assert.Error(t, setDefaultModel(configPath, cfg, "nonexistent-model")) } @@ -184,17 +213,24 @@ func TestSetDefaultModel_InvalidModel(t *testing.T) { func TestSetDefaultModel_ModelWithoutAPIKey(t *testing.T) { initTest(t) - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "existing-model", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "existing-model", Model: "openai/existing", APIKey: "test"}, - {ModelName: "no-key-model", Model: "openai/nokey", APIKey: ""}, + ModelList: []*config.ModelConfig{ + {ModelName: "existing-model", Model: "openai/existing"}, + {ModelName: "no-key-model", Model: "openai/nokey"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "existing-model": { + APIKeys: []string{"test"}, + }, + "no-key-model": { + APIKeys: []string{""}, + }, + }}) assert.Error(t, setDefaultModel(configPath, cfg, "no-key-model")) } @@ -203,16 +239,20 @@ func TestSetDefaultModel_SaveConfigError(t *testing.T) { // Use an invalid path to trigger save error invalidPath := "/nonexistent/directory/config.json" - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "old-model", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "new-model", Model: "openai/new-model", APIKey: "test"}, + ModelList: []*config.ModelConfig{ + {ModelName: "new-model", Model: "openai/new-model"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "new-model": { + APIKeys: []string{"test"}, + }, + }}) err := setDefaultModel(invalidPath, cfg, "new-model") @@ -244,16 +284,20 @@ func TestModelCommandExecution_Show(t *testing.T) { initTest(t) // Create a test config - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "test-model", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "test-model", Model: "openai/test", APIKey: "test"}, + ModelList: []*config.ModelConfig{ + {ModelName: "test-model", Model: "openai/test"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "test-model": { + APIKeys: []string{"test"}, + }, + }}) err := config.SaveConfig(configPath, cfg) require.NoError(t, err) @@ -271,17 +315,25 @@ func TestModelCommandExecution_Show(t *testing.T) { func TestModelCommandExecution_Set(t *testing.T) { initTest(t) - cfg := &config.Config{ + sec := &config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "old-model": { + APIKeys: []string{"test"}, + }, + "new-model": { + APIKeys: []string{"test"}, + }, + }} + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "old-model", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "old-model", Model: "openai/old", APIKey: "test"}, - {ModelName: "new-model", Model: "openai/new", APIKey: "test"}, + ModelList: []*config.ModelConfig{ + {ModelName: "old-model", Model: "openai/old"}, + {ModelName: "new-model", Model: "openai/new"}, }, - } + }).WithSecurity(sec) err := config.SaveConfig(configPath, cfg) require.NoError(t, err) @@ -305,18 +357,28 @@ func TestModelCommandExecution_TooManyArgs(t *testing.T) { } func TestListAvailableModels_MarkerLogic(t *testing.T) { - cfg := &config.Config{ + cfg := (&config.Config{ Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ ModelName: "middle-model", }, }, - ModelList: []config.ModelConfig{ - {ModelName: "first-model", Model: "openai/first", APIKey: "test"}, - {ModelName: "middle-model", Model: "openai/middle", APIKey: "test"}, - {ModelName: "last-model", Model: "openai/last", APIKey: "test"}, + ModelList: []*config.ModelConfig{ + {ModelName: "first-model", Model: "openai/first"}, + {ModelName: "middle-model", Model: "openai/middle"}, + {ModelName: "last-model", Model: "openai/last"}, }, - } + }).WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "first-model": { + APIKeys: []string{"test"}, + }, + "middle-model": { + APIKeys: []string{"test"}, + }, + "last-model": { + APIKeys: []string{"test"}, + }, + }}) output := captureStdout(func() { listAvailableModels(cfg) diff --git a/cmd/picoclaw/internal/skills/command.go b/cmd/picoclaw/internal/skills/command.go index 8c666b810..4f64ef3f9 100644 --- a/cmd/picoclaw/internal/skills/command.go +++ b/cmd/picoclaw/internal/skills/command.go @@ -31,7 +31,7 @@ func NewSkillsCommand() *cobra.Command { d.workspace = cfg.WorkspacePath() installer, err := skills.NewSkillInstaller( d.workspace, - cfg.Tools.Skills.Github.Token, + cfg.Tools.Skills.Github.Token(), cfg.Tools.Skills.Github.Proxy, ) if err != nil { diff --git a/cmd/picoclaw/internal/skills/helpers.go b/cmd/picoclaw/internal/skills/helpers.go index a59a2013a..a246f7da5 100644 --- a/cmd/picoclaw/internal/skills/helpers.go +++ b/cmd/picoclaw/internal/skills/helpers.go @@ -64,9 +64,20 @@ func skillsInstallFromRegistry(cfg *config.Config, registryName, slug string) er fmt.Printf("Installing skill '%s' from %s registry...\n", slug, registryName) + clawHubConfig := cfg.Tools.Skills.Registries.ClawHub registryMgr := skills.NewRegistryManagerFromConfig(skills.RegistryConfig{ MaxConcurrentSearches: cfg.Tools.Skills.MaxConcurrentSearches, - ClawHub: skills.ClawHubConfig(cfg.Tools.Skills.Registries.ClawHub), + ClawHub: skills.ClawHubConfig{ + Enabled: clawHubConfig.Enabled, + BaseURL: clawHubConfig.BaseURL, + AuthToken: clawHubConfig.AuthToken(), + SearchPath: clawHubConfig.SearchPath, + SkillsPath: clawHubConfig.SkillsPath, + DownloadPath: clawHubConfig.DownloadPath, + Timeout: clawHubConfig.Timeout, + MaxZipSize: clawHubConfig.MaxZipSize, + MaxResponseSize: clawHubConfig.MaxResponseSize, + }, }) registry := registryMgr.GetRegistry(registryName) @@ -226,9 +237,20 @@ func skillsSearchCmd(query string) { return } + clawHubConfig := cfg.Tools.Skills.Registries.ClawHub registryMgr := skills.NewRegistryManagerFromConfig(skills.RegistryConfig{ MaxConcurrentSearches: cfg.Tools.Skills.MaxConcurrentSearches, - ClawHub: skills.ClawHubConfig(cfg.Tools.Skills.Registries.ClawHub), + ClawHub: skills.ClawHubConfig{ + Enabled: clawHubConfig.Enabled, + BaseURL: clawHubConfig.BaseURL, + AuthToken: clawHubConfig.AuthToken(), + SearchPath: clawHubConfig.SearchPath, + SkillsPath: clawHubConfig.SkillsPath, + DownloadPath: clawHubConfig.DownloadPath, + Timeout: clawHubConfig.Timeout, + MaxZipSize: clawHubConfig.MaxZipSize, + MaxResponseSize: clawHubConfig.MaxResponseSize, + }, }) ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) diff --git a/go.mod b/go.mod index 4442b28fe..8c52895f2 100644 --- a/go.mod +++ b/go.mod @@ -93,7 +93,7 @@ require ( github.com/yosida95/uritemplate/v3 v3.0.2 // indirect golang.org/x/arch v0.24.0 // indirect golang.org/x/crypto v0.48.0 - golang.org/x/net v0.51.0 // indirect + golang.org/x/net v0.51.0 golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.41.0 // indirect ) diff --git a/pkg/agent/instance_test.go b/pkg/agent/instance_test.go index 8145cde62..1ea919478 100644 --- a/pkg/agent/instance_test.go +++ b/pkg/agent/instance_test.go @@ -140,7 +140,7 @@ func TestNewAgentInstance_ResolveCandidatesFromModelListAlias(t *testing.T) { ModelName: tt.aliasName, }, }, - ModelList: []config.ModelConfig{ + ModelList: []*config.ModelConfig{ { ModelName: tt.aliasName, Model: tt.modelName, diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index a6eccc3fe..9d7a0f3ef 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -130,25 +130,28 @@ func registerSharedTools( if cfg.Tools.IsToolEnabled("web") { searchTool, err := tools.NewWebSearchTool(tools.WebSearchToolOptions{ - BraveAPIKeys: config.MergeAPIKeys(cfg.Tools.Web.Brave.APIKey, cfg.Tools.Web.Brave.APIKeys), - BraveMaxResults: cfg.Tools.Web.Brave.MaxResults, - BraveEnabled: cfg.Tools.Web.Brave.Enabled, - TavilyAPIKeys: config.MergeAPIKeys(cfg.Tools.Web.Tavily.APIKey, cfg.Tools.Web.Tavily.APIKeys), + BraveAPIKeys: config.MergeAPIKeys(cfg.Tools.Web.Brave.APIKey(), cfg.Tools.Web.Brave.APIKeys()), + BraveMaxResults: cfg.Tools.Web.Brave.MaxResults, + BraveEnabled: cfg.Tools.Web.Brave.Enabled, + TavilyAPIKeys: config.MergeAPIKeys( + cfg.Tools.Web.Tavily.APIKey(), + cfg.Tools.Web.Tavily.APIKeys(), + ), TavilyBaseURL: cfg.Tools.Web.Tavily.BaseURL, TavilyMaxResults: cfg.Tools.Web.Tavily.MaxResults, TavilyEnabled: cfg.Tools.Web.Tavily.Enabled, DuckDuckGoMaxResults: cfg.Tools.Web.DuckDuckGo.MaxResults, DuckDuckGoEnabled: cfg.Tools.Web.DuckDuckGo.Enabled, PerplexityAPIKeys: config.MergeAPIKeys( - cfg.Tools.Web.Perplexity.APIKey, - cfg.Tools.Web.Perplexity.APIKeys, + cfg.Tools.Web.Perplexity.APIKey(), + cfg.Tools.Web.Perplexity.APIKeys(), ), PerplexityMaxResults: cfg.Tools.Web.Perplexity.MaxResults, PerplexityEnabled: cfg.Tools.Web.Perplexity.Enabled, SearXNGBaseURL: cfg.Tools.Web.SearXNG.BaseURL, SearXNGMaxResults: cfg.Tools.Web.SearXNG.MaxResults, SearXNGEnabled: cfg.Tools.Web.SearXNG.Enabled, - GLMSearchAPIKey: cfg.Tools.Web.GLMSearch.APIKey, + GLMSearchAPIKey: cfg.Tools.Web.GLMSearch.APIKey(), GLMSearchBaseURL: cfg.Tools.Web.GLMSearch.BaseURL, GLMSearchEngine: cfg.Tools.Web.GLMSearch.SearchEngine, GLMSearchMaxResults: cfg.Tools.Web.GLMSearch.MaxResults, @@ -215,9 +218,20 @@ func registerSharedTools( find_skills_enable := cfg.Tools.IsToolEnabled("find_skills") install_skills_enable := cfg.Tools.IsToolEnabled("install_skill") if skills_enabled && (find_skills_enable || install_skills_enable) { + clawHubConfig := cfg.Tools.Skills.Registries.ClawHub registryMgr := skills.NewRegistryManagerFromConfig(skills.RegistryConfig{ MaxConcurrentSearches: cfg.Tools.Skills.MaxConcurrentSearches, - ClawHub: skills.ClawHubConfig(cfg.Tools.Skills.Registries.ClawHub), + ClawHub: skills.ClawHubConfig{ + Enabled: clawHubConfig.Enabled, + BaseURL: clawHubConfig.BaseURL, + AuthToken: clawHubConfig.AuthToken(), + SearchPath: clawHubConfig.SearchPath, + SkillsPath: clawHubConfig.SkillsPath, + DownloadPath: clawHubConfig.DownloadPath, + Timeout: clawHubConfig.Timeout, + MaxZipSize: clawHubConfig.MaxZipSize, + MaxResponseSize: clawHubConfig.MaxResponseSize, + }, }) if find_skills_enable { diff --git a/pkg/channels/dingtalk/dingtalk.go b/pkg/channels/dingtalk/dingtalk.go index c03122892..7ac2c073f 100644 --- a/pkg/channels/dingtalk/dingtalk.go +++ b/pkg/channels/dingtalk/dingtalk.go @@ -36,7 +36,7 @@ type DingTalkChannel struct { // NewDingTalkChannel creates a new DingTalk channel instance func NewDingTalkChannel(cfg config.DingTalkConfig, messageBus *bus.MessageBus) (*DingTalkChannel, error) { - if cfg.ClientID == "" || cfg.ClientSecret == "" { + if cfg.ClientID == "" || cfg.ClientSecret() == "" { return nil, fmt.Errorf("dingtalk client_id and client_secret are required") } @@ -53,7 +53,7 @@ func NewDingTalkChannel(cfg config.DingTalkConfig, messageBus *bus.MessageBus) ( BaseChannel: base, config: cfg, clientID: cfg.ClientID, - clientSecret: cfg.ClientSecret, + clientSecret: cfg.ClientSecret(), }, nil } diff --git a/pkg/channels/discord/discord.go b/pkg/channels/discord/discord.go index 83a04907c..08506ff71 100644 --- a/pkg/channels/discord/discord.go +++ b/pkg/channels/discord/discord.go @@ -53,7 +53,7 @@ func NewDiscordChannel(cfg config.DiscordConfig, bus *bus.MessageBus) (*DiscordC discordgo.LogDebug: logger.DEBUG, }).Log - session, err := discordgo.New("Bot " + cfg.Token) + session, err := discordgo.New("Bot " + cfg.Token()) if err != nil { return nil, fmt.Errorf("failed to create discord session: %w", err) } diff --git a/pkg/channels/feishu/feishu_64.go b/pkg/channels/feishu/feishu_64.go index 3aea67b12..9c577d572 100644 --- a/pkg/channels/feishu/feishu_64.go +++ b/pkg/channels/feishu/feishu_64.go @@ -62,14 +62,14 @@ func NewFeishuChannel(cfg config.FeishuConfig, bus *bus.MessageBus) (*FeishuChan BaseChannel: base, config: cfg, tokenCache: tc, - client: lark.NewClient(cfg.AppID, cfg.AppSecret, opts...), + client: lark.NewClient(cfg.AppID, cfg.AppSecret(), opts...), } ch.SetOwner(ch) return ch, nil } func (c *FeishuChannel) Start(ctx context.Context) error { - if c.config.AppID == "" || c.config.AppSecret == "" { + if c.config.AppID == "" || c.config.AppSecret() == "" { return fmt.Errorf("feishu app_id or app_secret is empty") } @@ -80,7 +80,7 @@ func (c *FeishuChannel) Start(ctx context.Context) error { }) } - dispatcher := larkdispatcher.NewEventDispatcher(c.config.VerificationToken, c.config.EncryptKey). + dispatcher := larkdispatcher.NewEventDispatcher(c.config.VerificationToken(), c.config.EncryptKey()). OnP2MessageReceiveV1(c.handleMessageReceive) runCtx, cancel := context.WithCancel(ctx) @@ -93,7 +93,7 @@ func (c *FeishuChannel) Start(ctx context.Context) error { } c.wsClient = larkws.NewClient( c.config.AppID, - c.config.AppSecret, + c.config.AppSecret(), larkws.WithEventHandler(dispatcher), larkws.WithDomain(domain), ) diff --git a/pkg/channels/irc/handler.go b/pkg/channels/irc/handler.go index aca4ddd11..3fe9548f4 100644 --- a/pkg/channels/irc/handler.go +++ b/pkg/channels/irc/handler.go @@ -17,8 +17,8 @@ import ( // onConnect is called after a successful connection (and on reconnect). func (c *IRCChannel) onConnect(conn *ircevent.Connection) { // NickServ auth (only if SASL is not configured) - if c.config.NickServPassword != "" && c.config.SASLUser == "" { - conn.Privmsg("NickServ", "IDENTIFY "+c.config.NickServPassword) + if c.config.NickServPassword() != "" && c.config.SASLUser == "" { + conn.Privmsg("NickServ", "IDENTIFY "+c.config.NickServPassword()) } // Join configured channels diff --git a/pkg/channels/irc/irc.go b/pkg/channels/irc/irc.go index 28c59b540..289ce2c9b 100644 --- a/pkg/channels/irc/irc.go +++ b/pkg/channels/irc/irc.go @@ -68,7 +68,7 @@ func (c *IRCChannel) Start(ctx context.Context) error { Nick: c.config.Nick, User: user, RealName: realName, - Password: c.config.Password, + Password: c.config.Password(), UseTLS: c.config.TLS, RequestCaps: caps, QuitMessage: "Goodbye", @@ -83,9 +83,9 @@ func (c *IRCChannel) Start(ctx context.Context) error { } // SASL auth (takes priority over NickServ) - if c.config.SASLUser != "" && c.config.SASLPassword != "" { + if c.config.SASLUser != "" && c.config.SASLPassword() != "" { conn.SASLLogin = c.config.SASLUser - conn.SASLPassword = c.config.SASLPassword + conn.SASLPassword = c.config.SASLPassword() } // Register event handlers diff --git a/pkg/channels/line/line.go b/pkg/channels/line/line.go index 56ba02183..d7b9ecc22 100644 --- a/pkg/channels/line/line.go +++ b/pkg/channels/line/line.go @@ -62,7 +62,7 @@ type LINEChannel struct { // NewLINEChannel creates a new LINE channel instance. func NewLINEChannel(cfg config.LINEConfig, messageBus *bus.MessageBus) (*LINEChannel, error) { - if cfg.ChannelSecret == "" || cfg.ChannelAccessToken == "" { + if cfg.ChannelSecret() == "" || cfg.ChannelAccessToken() == "" { return nil, fmt.Errorf("line channel_secret and channel_access_token are required") } @@ -110,7 +110,7 @@ func (c *LINEChannel) fetchBotInfo() error { if err != nil { return err } - req.Header.Set("Authorization", "Bearer "+c.config.ChannelAccessToken) + req.Header.Set("Authorization", "Bearer "+c.config.ChannelAccessToken()) resp, err := c.infoClient.Do(req) if err != nil { @@ -216,7 +216,7 @@ func (c *LINEChannel) verifySignature(body []byte, signature string) bool { return false } - mac := hmac.New(sha256.New, []byte(c.config.ChannelSecret)) + mac := hmac.New(sha256.New, []byte(c.config.ChannelSecret())) mac.Write(body) expected := base64.StdEncoding.EncodeToString(mac.Sum(nil)) @@ -654,7 +654,7 @@ func (c *LINEChannel) callAPI(ctx context.Context, endpoint string, payload any) } req.Header.Set("Content-Type", "application/json") - req.Header.Set("Authorization", "Bearer "+c.config.ChannelAccessToken) + req.Header.Set("Authorization", "Bearer "+c.config.ChannelAccessToken()) resp, err := c.apiClient.Do(req) if err != nil { @@ -679,7 +679,7 @@ func (c *LINEChannel) downloadContent(messageID, filename string) string { return utils.DownloadFile(url, filename, utils.DownloadOptions{ LoggerPrefix: "line", ExtraHeaders: map[string]string{ - "Authorization": "Bearer " + c.config.ChannelAccessToken, + "Authorization": "Bearer " + c.config.ChannelAccessToken(), }, }) } diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go index 9e5fea1b6..d479ada8f 100644 --- a/pkg/channels/manager.go +++ b/pkg/channels/manager.go @@ -240,7 +240,7 @@ func (m *Manager) initChannel(name, displayName string) { func (m *Manager) initChannels(channels *config.ChannelsConfig) error { logger.InfoC("channels", "Initializing channel manager") - if channels.Telegram.Enabled && channels.Telegram.Token != "" { + if channels.Telegram.Enabled && channels.Telegram.Token() != "" { m.initChannel("telegram", "Telegram") } @@ -257,7 +257,7 @@ func (m *Manager) initChannels(channels *config.ChannelsConfig) error { m.initChannel("feishu", "Feishu") } - if channels.Discord.Enabled && channels.Discord.Token != "" { + if channels.Discord.Enabled && channels.Discord.Token() != "" { m.initChannel("discord", "Discord") } @@ -273,18 +273,18 @@ func (m *Manager) initChannels(channels *config.ChannelsConfig) error { m.initChannel("dingtalk", "DingTalk") } - if channels.Slack.Enabled && channels.Slack.BotToken != "" { + if channels.Slack.Enabled && channels.Slack.BotToken() != "" { m.initChannel("slack", "Slack") } if channels.Matrix.Enabled && m.config.Channels.Matrix.Homeserver != "" && m.config.Channels.Matrix.UserID != "" && - m.config.Channels.Matrix.AccessToken != "" { + m.config.Channels.Matrix.AccessToken() != "" { m.initChannel("matrix", "Matrix") } - if channels.LINE.Enabled && channels.LINE.ChannelAccessToken != "" { + if channels.LINE.Enabled && channels.LINE.ChannelAccessToken() != "" { m.initChannel("line", "LINE") } @@ -292,11 +292,11 @@ func (m *Manager) initChannels(channels *config.ChannelsConfig) error { m.initChannel("onebot", "OneBot") } - if channels.WeCom.Enabled && channels.WeCom.Token != "" { + if channels.WeCom.Enabled && channels.WeCom.Token() != "" { m.initChannel("wecom", "WeCom") } - if channels.WeComAIBot.Enabled && channels.WeComAIBot.Token != "" { + if channels.WeComAIBot.Enabled && channels.WeComAIBot.Token() != "" { m.initChannel("wecom_aibot", "WeCom AI Bot") } @@ -304,7 +304,7 @@ func (m *Manager) initChannels(channels *config.ChannelsConfig) error { m.initChannel("wecom_app", "WeCom App") } - if channels.Pico.Enabled && channels.Pico.Token != "" { + if channels.Pico.Enabled && channels.Pico.Token() != "" { m.initChannel("pico", "Pico") } diff --git a/pkg/channels/manager_channel.go b/pkg/channels/manager_channel.go index 57cb05412..1ec03f010 100644 --- a/pkg/channels/manager_channel.go +++ b/pkg/channels/manager_channel.go @@ -21,6 +21,7 @@ func toChannelHashes(cfg *config.Config) map[string]string { if !value["enabled"].(bool) { continue } + hiddenValues(key, value, ch) valueBytes, _ := json.Marshal(value) hash := md5.Sum(valueBytes) result[key] = hex.EncodeToString(hash[:]) @@ -29,6 +30,48 @@ func toChannelHashes(cfg *config.Config) map[string]string { return result } +func hiddenValues(key string, value map[string]any, ch config.ChannelsConfig) { + switch key { + case "pico": + value["token"] = ch.Pico.Token() + case "telegram": + value["token"] = ch.Telegram.Token() + case "discord": + value["token"] = ch.Discord.Token() + case "slack": + value["bot_token"] = ch.Slack.BotToken() + value["app_token"] = ch.Slack.AppToken() + case "matrix": + value["token"] = ch.Matrix.AccessToken() + case "onebot": + value["token"] = ch.OneBot.AccessToken() + case "line": + value["token"] = ch.LINE.ChannelAccessToken() + value["secret"] = ch.LINE.ChannelSecret() + case "wecom": + value["token"] = ch.WeCom.Token() + value["key"] = ch.WeCom.EncodingAESKey() + case "wecom_app": + value["token"] = ch.WeComApp.Token() + value["secret"] = ch.WeComApp.CorpSecret() + case "wecom_aibot": + value["token"] = ch.WeComAIBot.Token() + value["key"] = ch.WeComAIBot.EncodingAESKey() + case "dingtalk": + value["secret"] = ch.QQ.AppSecret() + case "qq": + value["secret"] = ch.DingTalk.ClientSecret() + case "irc": + value["password"] = ch.IRC.Password() + value["serv_password"] = ch.IRC.NickServPassword() + value["sasl_password"] = ch.IRC.SASLPassword() + case "feishu": + value["app_secret"] = ch.Feishu.AppSecret() + value["encrypt_key"] = ch.Feishu.EncryptKey() + value["verification_token"] = ch.Feishu.VerificationToken() + } +} + func compareChannels(old, news map[string]string) (added, removed []string) { for key, newHash := range news { if oldHash, ok := old[key]; ok { @@ -82,5 +125,61 @@ func toChannelConfig(cfg *config.Config, list []string) (*config.ChannelsConfig, return nil, err } + updateKeys(result, &ch) + return result, nil } + +func updateKeys(newcfg, old *config.ChannelsConfig) { + if newcfg.Pico.Enabled { + newcfg.Pico.SetToken(old.Pico.Token()) + } + if newcfg.Telegram.Enabled { + newcfg.Telegram.SetToken(old.Telegram.Token()) + } + if newcfg.Discord.Enabled { + newcfg.Discord.SetToken(old.Discord.Token()) + } + if newcfg.Slack.Enabled { + newcfg.Slack.SetBotToken(old.Slack.BotToken()) + newcfg.Slack.SetAppToken(old.Slack.AppToken()) + } + if newcfg.Matrix.Enabled { + newcfg.Matrix.SetAccessToken(old.Matrix.AccessToken()) + } + if newcfg.OneBot.Enabled { + newcfg.OneBot.SetAccessToken(old.OneBot.AccessToken()) + } + if newcfg.LINE.Enabled { + newcfg.LINE.SetChannelAccessToken(old.LINE.ChannelAccessToken()) + newcfg.LINE.SetChannelSecret(old.LINE.ChannelSecret()) + } + if newcfg.WeCom.Enabled { + newcfg.WeCom.SetToken(old.WeCom.Token()) + newcfg.WeCom.SetEncodingAESKey(old.WeCom.EncodingAESKey()) + } + if newcfg.WeComApp.Enabled { + newcfg.WeComApp.SetToken(old.WeComApp.Token()) + newcfg.WeComApp.SetCorpSecret(old.WeComApp.CorpSecret()) + } + if newcfg.WeComAIBot.Enabled { + newcfg.WeComAIBot.SetToken(old.WeComAIBot.Token()) + newcfg.WeComAIBot.SetEncodingAESKey(old.WeComAIBot.EncodingAESKey()) + } + if newcfg.DingTalk.Enabled { + newcfg.DingTalk.SetClientSecret(old.DingTalk.ClientSecret()) + } + if newcfg.QQ.Enabled { + newcfg.QQ.SetAppSecret(old.QQ.AppSecret()) + } + if newcfg.IRC.Enabled { + newcfg.IRC.SetPassword(old.IRC.Password()) + newcfg.IRC.SetNickServPassword(old.IRC.NickServPassword()) + newcfg.IRC.SetSASLPassword(old.IRC.SASLPassword()) + } + if newcfg.Feishu.Enabled { + newcfg.Feishu.SetAppSecret(old.Feishu.AppSecret()) + newcfg.Feishu.SetEncryptKey(old.Feishu.EncryptKey()) + newcfg.Feishu.SetVerificationToken(old.Feishu.VerificationToken()) + } +} diff --git a/pkg/channels/manager_channel_test.go b/pkg/channels/manager_channel_test.go index 651764c4f..e17dcf17d 100644 --- a/pkg/channels/manager_channel_test.go +++ b/pkg/channels/manager_channel_test.go @@ -31,7 +31,7 @@ func TestToChannelHashes(t *testing.T) { added, removed = compareChannels(results2, results3) assert.EqualValues(t, []string{"dingtalk"}, removed) assert.EqualValues(t, []string{"telegram"}, added) - cfg3.Channels.Telegram.Token = "114314" + cfg3.Channels.Telegram.SetToken("114314") results4 := toChannelHashes(cfg3) assert.Equal(t, 1, len(results4)) logger.Debugf("results4: %v", results4) @@ -41,11 +41,11 @@ func TestToChannelHashes(t *testing.T) { cc, err := toChannelConfig(cfg3, added) assert.NoError(t, err) logger.Debugf("cc: %#v", cc.Telegram) - assert.Equal(t, "114314", cc.Telegram.Token) + assert.Equal(t, "114314", cc.Telegram.Token()) assert.Equal(t, true, cc.Telegram.Enabled) cc, err = toChannelConfig(cfg2, added) assert.NoError(t, err) logger.Debugf("cc: %#v", cc.Telegram) - assert.Equal(t, "", cc.Telegram.Token) + assert.Equal(t, "", cc.Telegram.Token()) assert.Equal(t, false, cc.Telegram.Enabled) } diff --git a/pkg/channels/matrix/matrix.go b/pkg/channels/matrix/matrix.go index 4cbe95c5c..6c418af07 100644 --- a/pkg/channels/matrix/matrix.go +++ b/pkg/channels/matrix/matrix.go @@ -186,7 +186,7 @@ type MatrixChannel struct { func NewMatrixChannel(cfg config.MatrixConfig, messageBus *bus.MessageBus) (*MatrixChannel, error) { homeserver := strings.TrimSpace(cfg.Homeserver) userID := strings.TrimSpace(cfg.UserID) - accessToken := strings.TrimSpace(cfg.AccessToken) + accessToken := strings.TrimSpace(cfg.AccessToken()) if homeserver == "" { return nil, fmt.Errorf("matrix homeserver is required") } diff --git a/pkg/channels/onebot/onebot.go b/pkg/channels/onebot/onebot.go index 62a9eb34a..7a84d2fa0 100644 --- a/pkg/channels/onebot/onebot.go +++ b/pkg/channels/onebot/onebot.go @@ -184,8 +184,8 @@ func (c *OneBotChannel) connect() error { dialer.HandshakeTimeout = 10 * time.Second header := make(map[string][]string) - if c.config.AccessToken != "" { - header["Authorization"] = []string{"Bearer " + c.config.AccessToken} + if c.config.AccessToken() != "" { + header["Authorization"] = []string{"Bearer " + c.config.AccessToken()} } conn, resp, err := dialer.Dial(c.config.WSUrl, header) diff --git a/pkg/channels/pico/pico.go b/pkg/channels/pico/pico.go index 206e71f92..e5d092d2c 100644 --- a/pkg/channels/pico/pico.go +++ b/pkg/channels/pico/pico.go @@ -60,7 +60,7 @@ type PicoChannel struct { // NewPicoChannel creates a new Pico Protocol channel. func NewPicoChannel(cfg config.PicoConfig, messageBus *bus.MessageBus) (*PicoChannel, error) { - if cfg.Token == "" { + if cfg.Token() == "" { return nil, fmt.Errorf("pico token is required") } @@ -293,7 +293,7 @@ func (c *PicoChannel) handleWebSocket(w http.ResponseWriter, r *http.Request) { // 2. Sec-WebSocket-Protocol "token." (for browsers that can't set headers) // 3. Query parameter "token" (only when AllowTokenQuery is on) func (c *PicoChannel) authenticate(r *http.Request) bool { - token := c.config.Token + token := c.config.Token() if token == "" { return false } @@ -324,7 +324,7 @@ func (c *PicoChannel) authenticate(r *http.Request) bool { // matchedSubprotocol returns the "token." subprotocol that matches // the configured token, or "" if none do. func (c *PicoChannel) matchedSubprotocol(r *http.Request) string { - token := c.config.Token + token := c.config.Token() for _, proto := range websocket.Subprotocols(r) { if after, ok := strings.CutPrefix(proto, "token."); ok && after == token { return proto diff --git a/pkg/channels/qq/qq.go b/pkg/channels/qq/qq.go index 1a48369f8..2b4783b6f 100644 --- a/pkg/channels/qq/qq.go +++ b/pkg/channels/qq/qq.go @@ -98,7 +98,7 @@ func NewQQChannel(cfg config.QQConfig, messageBus *bus.MessageBus) (*QQChannel, } func (c *QQChannel) Start(ctx context.Context) error { - if c.config.AppID == "" || c.config.AppSecret == "" { + if c.config.AppID == "" || c.config.AppSecret() == "" { return fmt.Errorf("QQ app_id and app_secret not configured") } @@ -112,7 +112,7 @@ func (c *QQChannel) Start(ctx context.Context) error { // create token source credentials := &token.QQBotCredentials{ AppID: c.config.AppID, - AppSecret: c.config.AppSecret, + AppSecret: c.config.AppSecret(), } c.tokenSource = token.NewQQBotTokenSource(credentials) diff --git a/pkg/channels/slack/slack.go b/pkg/channels/slack/slack.go index 3ee849621..68a1585b2 100644 --- a/pkg/channels/slack/slack.go +++ b/pkg/channels/slack/slack.go @@ -37,13 +37,13 @@ type slackMessageRef struct { } func NewSlackChannel(cfg config.SlackConfig, messageBus *bus.MessageBus) (*SlackChannel, error) { - if cfg.BotToken == "" || cfg.AppToken == "" { + if cfg.BotToken() == "" || cfg.AppToken() == "" { return nil, fmt.Errorf("slack bot_token and app_token are required") } api := slack.New( - cfg.BotToken, - slack.OptionAppLevelToken(cfg.AppToken), + cfg.BotToken(), + slack.OptionAppLevelToken(cfg.AppToken()), ) socketClient := socketmode.New(api) @@ -515,7 +515,7 @@ func (c *SlackChannel) downloadSlackFile(file slack.File) string { return utils.DownloadFile(downloadURL, file.Name, utils.DownloadOptions{ LoggerPrefix: "slack", ExtraHeaders: map[string]string{ - "Authorization": "Bearer " + c.config.BotToken, + "Authorization": "Bearer " + c.config.BotToken(), }, }) } diff --git a/pkg/channels/slack/slack_test.go b/pkg/channels/slack/slack_test.go index 30e0d2d73..23a7ee5c4 100644 --- a/pkg/channels/slack/slack_test.go +++ b/pkg/channels/slack/slack_test.go @@ -102,10 +102,8 @@ func TestNewSlackChannel(t *testing.T) { msgBus := bus.NewMessageBus() t.Run("missing bot token", func(t *testing.T) { - cfg := config.SlackConfig{ - BotToken: "", - AppToken: "xapp-test", - } + cfg := config.SlackConfig{} + cfg.SetAppToken("xapp-test") _, err := NewSlackChannel(cfg, msgBus) if err == nil { t.Error("expected error for missing bot_token, got nil") @@ -113,10 +111,8 @@ func TestNewSlackChannel(t *testing.T) { }) t.Run("missing app token", func(t *testing.T) { - cfg := config.SlackConfig{ - BotToken: "xoxb-test", - AppToken: "", - } + cfg := config.SlackConfig{} + cfg.SetBotToken("xoxb-test") _, err := NewSlackChannel(cfg, msgBus) if err == nil { t.Error("expected error for missing app_token, got nil") @@ -125,10 +121,10 @@ func TestNewSlackChannel(t *testing.T) { t.Run("valid config", func(t *testing.T) { cfg := config.SlackConfig{ - BotToken: "xoxb-test", - AppToken: "xapp-test", AllowFrom: []string{"U123"}, } + cfg.SetBotToken("xoxb-test") + cfg.SetAppToken("xapp-test") ch, err := NewSlackChannel(cfg, msgBus) if err != nil { t.Fatalf("unexpected error: %v", err) @@ -147,10 +143,10 @@ func TestSlackChannelIsAllowed(t *testing.T) { t.Run("empty allowlist allows all", func(t *testing.T) { cfg := config.SlackConfig{ - BotToken: "xoxb-test", - AppToken: "xapp-test", AllowFrom: []string{}, } + cfg.SetBotToken("xoxb-test") + cfg.SetAppToken("xapp-test") ch, _ := NewSlackChannel(cfg, msgBus) if !ch.IsAllowed("U_ANYONE") { t.Error("empty allowlist should allow all users") @@ -159,10 +155,10 @@ func TestSlackChannelIsAllowed(t *testing.T) { t.Run("allowlist restricts users", func(t *testing.T) { cfg := config.SlackConfig{ - BotToken: "xoxb-test", - AppToken: "xapp-test", AllowFrom: []string{"U_ALLOWED"}, } + cfg.SetBotToken("xoxb-test") + cfg.SetAppToken("xapp-test") ch, _ := NewSlackChannel(cfg, msgBus) if !ch.IsAllowed("U_ALLOWED") { t.Error("allowed user should pass allowlist check") diff --git a/pkg/channels/telegram/telegram.go b/pkg/channels/telegram/telegram.go index 9d0325093..63cfd1915 100644 --- a/pkg/channels/telegram/telegram.go +++ b/pkg/channels/telegram/telegram.go @@ -80,7 +80,7 @@ func NewTelegramChannel(cfg *config.Config, bus *bus.MessageBus) (*TelegramChann } opts = append(opts, telego.WithLogger(logger.NewLogger("telego"))) - bot, err := telego.NewBot(telegramCfg.Token, opts...) + bot, err := telego.NewBot(telegramCfg.Token(), opts...) if err != nil { return nil, fmt.Errorf("failed to create telegram bot: %w", err) } diff --git a/pkg/channels/wecom/aibot.go b/pkg/channels/wecom/aibot.go index 93fe8c36d..87ab61452 100644 --- a/pkg/channels/wecom/aibot.go +++ b/pkg/channels/wecom/aibot.go @@ -139,7 +139,7 @@ func NewWeComAIBotChannel( cfg config.WeComAIBotConfig, messageBus *bus.MessageBus, ) (*WeComAIBotChannel, error) { - if cfg.Token == "" || cfg.EncodingAESKey == "" { + if cfg.Token() == "" || cfg.EncodingAESKey() == "" { return nil, fmt.Errorf("token and encoding_aes_key are required for WeCom AI Bot") } @@ -331,7 +331,7 @@ func (c *WeComAIBotChannel) handleVerification( }) // Verify signature - if !verifySignature(c.config.Token, msgSignature, timestamp, nonce, echostr) { + if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, echostr) { logger.ErrorC("wecom_aibot", "Signature verification failed") http.Error(w, "Signature verification failed", http.StatusUnauthorized) return @@ -339,7 +339,7 @@ func (c *WeComAIBotChannel) handleVerification( // Decrypt echostr // For WeCom AI Bot (智能机器人), receiveid should be empty string - decrypted, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey, "") + decrypted, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey(), "") if err != nil { logger.ErrorCF("wecom_aibot", "Failed to decrypt echostr", map[string]any{ "error": err, @@ -398,7 +398,7 @@ func (c *WeComAIBotChannel) handleMessageCallback( } // Verify signature - if !verifySignature(c.config.Token, msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { + if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { logger.ErrorC("wecom_aibot", "Signature verification failed") http.Error(w, "Signature verification failed", http.StatusUnauthorized) return @@ -406,7 +406,7 @@ func (c *WeComAIBotChannel) handleMessageCallback( // Decrypt message // For WeCom AI Bot (智能机器人), receiveid is empty string - decrypted, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey, "") + decrypted, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey(), "") if err != nil { logger.ErrorCF("wecom_aibot", "Failed to decrypt message", map[string]any{ "error": err, @@ -840,7 +840,7 @@ func (c *WeComAIBotChannel) encryptResponse( } // Generate signature - signature := computeSignature(c.config.Token, timestamp, nonce, encrypted) + signature := computeSignature(c.config.Token(), timestamp, nonce, encrypted) // Build encrypted response encryptedResp := WeComAIBotEncryptedResponse{ @@ -875,7 +875,7 @@ func (c *WeComAIBotChannel) encryptEmptyResponse(timestamp, nonce string) string // encryptMessage encrypts a plain text message for WeCom AI Bot func (c *WeComAIBotChannel) encryptMessage(plaintext, receiveid string) (string, error) { - aesKey, err := decodeWeComAESKey(c.config.EncodingAESKey) + aesKey, err := decodeWeComAESKey(c.config.EncodingAESKey()) if err != nil { return "", err } diff --git a/pkg/channels/wecom/aibot_test.go b/pkg/channels/wecom/aibot_test.go index 6f0664187..315dbec21 100644 --- a/pkg/channels/wecom/aibot_test.go +++ b/pkg/channels/wecom/aibot_test.go @@ -10,12 +10,11 @@ import ( func TestNewWeComAIBotChannel(t *testing.T) { t.Run("success with valid config", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - Token: "test_token", - EncodingAESKey: "testkey1234567890123456789012345678901234567", - WebhookPath: "/webhook/test", - } + cfg := config.WeComAIBotConfig{} + cfg.Enabled = true + cfg.SetToken("test_token") + cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") + cfg.WebhookPath = "/webhook/test" messageBus := bus.NewMessageBus() ch, err := NewWeComAIBotChannel(cfg, messageBus) @@ -33,10 +32,9 @@ func TestNewWeComAIBotChannel(t *testing.T) { }) t.Run("error with missing token", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - EncodingAESKey: "testkey1234567890123456789012345678901234567", - } + cfg := config.WeComAIBotConfig{} + cfg.Enabled = true + cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") messageBus := bus.NewMessageBus() _, err := NewWeComAIBotChannel(cfg, messageBus) @@ -47,10 +45,9 @@ func TestNewWeComAIBotChannel(t *testing.T) { }) t.Run("error with missing encoding key", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - Token: "test_token", - } + cfg := config.WeComAIBotConfig{} + cfg.Enabled = true + cfg.SetToken("test_token") messageBus := bus.NewMessageBus() _, err := NewWeComAIBotChannel(cfg, messageBus) @@ -62,11 +59,10 @@ func TestNewWeComAIBotChannel(t *testing.T) { } func TestWeComAIBotChannelStartStop(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - Token: "test_token", - EncodingAESKey: "testkey1234567890123456789012345678901234567", - } + cfg := config.WeComAIBotConfig{} + cfg.Enabled = true + cfg.SetToken("test_token") + cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") messageBus := bus.NewMessageBus() ch, err := NewWeComAIBotChannel(cfg, messageBus) @@ -97,11 +93,10 @@ func TestWeComAIBotChannelStartStop(t *testing.T) { func TestWeComAIBotChannelWebhookPath(t *testing.T) { t.Run("default path", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - Token: "test_token", - EncodingAESKey: "testkey1234567890123456789012345678901234567", - } + cfg := config.WeComAIBotConfig{} + cfg.Enabled = true + cfg.SetToken("test_token") + cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") messageBus := bus.NewMessageBus() ch, _ := NewWeComAIBotChannel(cfg, messageBus) @@ -114,12 +109,11 @@ func TestWeComAIBotChannelWebhookPath(t *testing.T) { t.Run("custom path", func(t *testing.T) { customPath := "/custom/webhook" - cfg := config.WeComAIBotConfig{ - Enabled: true, - Token: "test_token", - EncodingAESKey: "testkey1234567890123456789012345678901234567", - WebhookPath: customPath, - } + cfg := config.WeComAIBotConfig{} + cfg.Enabled = true + cfg.SetToken("test_token") + cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") + cfg.WebhookPath = customPath messageBus := bus.NewMessageBus() ch, _ := NewWeComAIBotChannel(cfg, messageBus) @@ -131,11 +125,10 @@ func TestWeComAIBotChannelWebhookPath(t *testing.T) { } func TestGenerateStreamID(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - Token: "test_token", - EncodingAESKey: "testkey1234567890123456789012345678901234567", - } + cfg := config.WeComAIBotConfig{} + cfg.Enabled = true + cfg.SetToken("test_token") + cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") messageBus := bus.NewMessageBus() ch, _ := NewWeComAIBotChannel(cfg, messageBus) @@ -158,11 +151,10 @@ func TestGenerateStreamID(t *testing.T) { func TestEncryptDecrypt(t *testing.T) { // Use a valid 43-character base64 key (企业微信标准格式) - cfg := config.WeComAIBotConfig{ - Enabled: true, - Token: "test_token", - EncodingAESKey: "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG", // 43 characters - } + cfg := config.WeComAIBotConfig{} + cfg.Enabled = true + cfg.SetToken("test_token") + cfg.SetEncodingAESKey("abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG") // 43 characters messageBus := bus.NewMessageBus() ch, _ := NewWeComAIBotChannel(cfg, messageBus) @@ -181,7 +173,7 @@ func TestEncryptDecrypt(t *testing.T) { } // Decrypt - decrypted, err := decryptMessageWithVerify(encrypted, cfg.EncodingAESKey, receiveid) + decrypted, err := decryptMessageWithVerify(encrypted, cfg.EncodingAESKey(), receiveid) if err != nil { t.Fatalf("Failed to decrypt message: %v", err) } diff --git a/pkg/channels/wecom/app.go b/pkg/channels/wecom/app.go index 2098fcd4e..fccfc60a3 100644 --- a/pkg/channels/wecom/app.go +++ b/pkg/channels/wecom/app.go @@ -119,7 +119,7 @@ type PKCS7Padding struct{} // NewWeComAppChannel creates a new WeCom App channel instance func NewWeComAppChannel(cfg config.WeComAppConfig, messageBus *bus.MessageBus) (*WeComAppChannel, error) { - if cfg.CorpID == "" || cfg.CorpSecret == "" || cfg.AgentID == 0 { + if cfg.CorpID == "" || cfg.CorpSecret() == "" || cfg.AgentID == 0 { return nil, fmt.Errorf("wecom_app corp_id, corp_secret and agent_id are required") } @@ -497,9 +497,9 @@ func (c *WeComAppChannel) handleVerification(ctx context.Context, w http.Respons } // Verify signature - if !verifySignature(c.config.Token, msgSignature, timestamp, nonce, echostr) { + if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, echostr) { logger.WarnCF("wecom_app", "Signature verification failed", map[string]any{ - "token": c.config.Token, + "token": c.config.Token(), "msg_signature": msgSignature, "timestamp": timestamp, "nonce": nonce, @@ -513,10 +513,10 @@ func (c *WeComAppChannel) handleVerification(ctx context.Context, w http.Respons // Decrypt echostr with CorpID verification // For WeCom App (自建应用), receiveid should be corp_id logger.DebugCF("wecom_app", "Attempting to decrypt echostr", map[string]any{ - "encoding_aes_key": c.config.EncodingAESKey, + "encoding_aes_key": c.config.EncodingAESKey(), "corp_id": c.config.CorpID, }) - decryptedEchoStr, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey, c.config.CorpID) + decryptedEchoStr, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey(), c.config.CorpID) if err != nil { logger.ErrorCF("wecom_app", "Failed to decrypt echostr", map[string]any{ "error": err.Error(), @@ -575,7 +575,7 @@ func (c *WeComAppChannel) handleMessageCallback(ctx context.Context, w http.Resp } // Verify signature - if !verifySignature(c.config.Token, msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { + if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { logger.WarnC("wecom_app", "Message signature verification failed") http.Error(w, "Invalid signature", http.StatusForbidden) return @@ -583,7 +583,7 @@ func (c *WeComAppChannel) handleMessageCallback(ctx context.Context, w http.Resp // Decrypt message with CorpID verification // For WeCom App (自建应用), receiveid should be corp_id - decryptedMsg, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey, c.config.CorpID) + decryptedMsg, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey(), c.config.CorpID) if err != nil { logger.ErrorCF("wecom_app", "Failed to decrypt message", map[string]any{ "error": err.Error(), @@ -689,7 +689,7 @@ func (c *WeComAppChannel) tokenRefreshLoop() { // refreshAccessToken gets a new access token from WeCom API func (c *WeComAppChannel) refreshAccessToken() error { apiURL := fmt.Sprintf("%s/cgi-bin/gettoken?corpid=%s&corpsecret=%s", - wecomAPIBase, url.QueryEscape(c.config.CorpID), url.QueryEscape(c.config.CorpSecret)) + wecomAPIBase, url.QueryEscape(c.config.CorpID), url.QueryEscape(c.config.CorpSecret())) resp, err := http.Get(apiURL) if err != nil { diff --git a/pkg/channels/wecom/app_test.go b/pkg/channels/wecom/app_test.go index 7d07041ad..502544441 100644 --- a/pkg/channels/wecom/app_test.go +++ b/pkg/channels/wecom/app_test.go @@ -91,10 +91,10 @@ func TestNewWeComAppChannel(t *testing.T) { t.Run("missing corp_id", func(t *testing.T) { cfg := config.WeComAppConfig{ - CorpID: "", - CorpSecret: "test_secret", - AgentID: 1000002, + CorpID: "", + AgentID: 1000002, } + cfg.SetCorpSecret("test_secret") _, err := NewWeComAppChannel(cfg, msgBus) if err == nil { t.Error("expected error for missing corp_id, got nil") @@ -103,9 +103,8 @@ func TestNewWeComAppChannel(t *testing.T) { t.Run("missing corp_secret", func(t *testing.T) { cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "", - AgentID: 1000002, + CorpID: "test_corp_id", + AgentID: 1000002, } _, err := NewWeComAppChannel(cfg, msgBus) if err == nil { @@ -115,10 +114,10 @@ func TestNewWeComAppChannel(t *testing.T) { t.Run("missing agent_id", func(t *testing.T) { cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 0, + CorpID: "test_corp_id", + AgentID: 0, } + cfg.SetCorpSecret("test_secret") _, err := NewWeComAppChannel(cfg, msgBus) if err == nil { t.Error("expected error for missing agent_id, got nil") @@ -127,11 +126,11 @@ func TestNewWeComAppChannel(t *testing.T) { t.Run("valid config", func(t *testing.T) { cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - AllowFrom: []string{"user1", "user2"}, + CorpID: "test_corp_id", + AgentID: 1000002, + AllowFrom: []string{"user1", "user2"}, } + cfg.SetCorpSecret("test_secret") ch, err := NewWeComAppChannel(cfg, msgBus) if err != nil { t.Fatalf("unexpected error: %v", err) @@ -150,11 +149,11 @@ func TestWeComAppChannelIsAllowed(t *testing.T) { t.Run("empty allowlist allows all", func(t *testing.T) { cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - AllowFrom: []string{}, + CorpID: "test_corp_id", + AgentID: 1000002, + AllowFrom: []string{}, } + cfg.SetCorpSecret("test_secret") ch, _ := NewWeComAppChannel(cfg, msgBus) if !ch.IsAllowed("any_user") { t.Error("empty allowlist should allow all users") @@ -163,11 +162,11 @@ func TestWeComAppChannelIsAllowed(t *testing.T) { t.Run("allowlist restricts users", func(t *testing.T) { cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - AllowFrom: []string{"allowed_user"}, + CorpID: "test_corp_id", + AgentID: 1000002, + AllowFrom: []string{"allowed_user"}, } + cfg.SetCorpSecret("test_secret") ch, _ := NewWeComAppChannel(cfg, msgBus) if !ch.IsAllowed("allowed_user") { t.Error("allowed user should pass allowlist check") @@ -180,12 +179,11 @@ func TestWeComAppChannelIsAllowed(t *testing.T) { func TestWeComAppVerifySignature(t *testing.T) { msgBus := bus.NewMessageBus() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - Token: "test_token", - } + cfg := config.WeComAppConfig{} + cfg.CorpID = "test_corp_id" + cfg.SetCorpSecret("test_secret") + cfg.AgentID = 1000002 + cfg.SetToken("test_token") ch, _ := NewWeComAppChannel(cfg, msgBus) t.Run("valid signature", func(t *testing.T) { @@ -194,7 +192,7 @@ func TestWeComAppVerifySignature(t *testing.T) { msgEncrypt := "test_message" expectedSig := generateSignatureApp("test_token", timestamp, nonce, msgEncrypt) - if !verifySignature(ch.config.Token, expectedSig, timestamp, nonce, msgEncrypt) { + if !verifySignature(ch.config.Token(), expectedSig, timestamp, nonce, msgEncrypt) { t.Error("valid signature should pass verification") } }) @@ -204,21 +202,20 @@ func TestWeComAppVerifySignature(t *testing.T) { nonce := "test_nonce" msgEncrypt := "test_message" - if verifySignature(ch.config.Token, "invalid_sig", timestamp, nonce, msgEncrypt) { + if verifySignature(ch.config.Token(), "invalid_sig", timestamp, nonce, msgEncrypt) { t.Error("invalid signature should fail verification") } }) t.Run("empty token rejects verification (fail-closed)", func(t *testing.T) { - cfgEmpty := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - Token: "", - } + cfgEmpty := config.WeComAppConfig{} + cfgEmpty.CorpID = "test_corp_id" + cfgEmpty.SetCorpSecret("test_secret") + cfgEmpty.AgentID = 1000002 + cfgEmpty.SetToken("") chEmpty, _ := NewWeComAppChannel(cfgEmpty, msgBus) - if verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { + if verifySignature(chEmpty.config.Token(), "any_sig", "any_ts", "any_nonce", "any_msg") { t.Error("empty token should reject verification (fail-closed)") } }) @@ -228,19 +225,18 @@ func TestWeComAppDecryptMessage(t *testing.T) { msgBus := bus.NewMessageBus() t.Run("decrypt without AES key", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - EncodingAESKey: "", - } + cfg := config.WeComAppConfig{} + cfg.CorpID = "test_corp_id" + cfg.SetCorpSecret("test_secret") + cfg.AgentID = 1000002 + cfg.SetEncodingAESKey("") ch, _ := NewWeComAppChannel(cfg, msgBus) // Without AES key, message should be base64 decoded only plainText := "hello world" encoded := base64.StdEncoding.EncodeToString([]byte(plainText)) - result, err := decryptMessage(encoded, ch.config.EncodingAESKey) + result, err := decryptMessage(encoded, ch.config.EncodingAESKey()) if err != nil { t.Fatalf("unexpected error: %v", err) } @@ -252,11 +248,11 @@ func TestWeComAppDecryptMessage(t *testing.T) { t.Run("decrypt with AES key", func(t *testing.T) { aesKey := generateTestAESKeyApp() cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - EncodingAESKey: aesKey, + CorpID: "test_corp_id", + AgentID: 1000002, } + cfg.SetCorpSecret("test_secret") + cfg.SetEncodingAESKey(aesKey) ch, _ := NewWeComAppChannel(cfg, msgBus) originalMsg := "Hello" @@ -265,7 +261,7 @@ func TestWeComAppDecryptMessage(t *testing.T) { t.Fatalf("failed to encrypt test message: %v", err) } - result, err := decryptMessage(encrypted, ch.config.EncodingAESKey) + result, err := decryptMessage(encrypted, ch.config.EncodingAESKey()) if err != nil { t.Fatalf("unexpected error: %v", err) } @@ -276,29 +272,28 @@ func TestWeComAppDecryptMessage(t *testing.T) { t.Run("invalid base64", func(t *testing.T) { cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - EncodingAESKey: "", + CorpID: "test_corp_id", + AgentID: 1000002, } + cfg.SetCorpSecret("test_secret") + cfg.SetEncodingAESKey("") ch, _ := NewWeComAppChannel(cfg, msgBus) - _, err := decryptMessage("invalid_base64!!!", ch.config.EncodingAESKey) + _, err := decryptMessage("invalid_base64!!!", ch.config.EncodingAESKey()) if err == nil { t.Error("expected error for invalid base64, got nil") } }) t.Run("invalid AES key", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - EncodingAESKey: "invalid_key", - } + cfg := config.WeComAppConfig{} + cfg.CorpID = "test_corp_id" + cfg.SetCorpSecret("test_secret") + cfg.AgentID = 1000002 + cfg.SetEncodingAESKey("invalid_key") ch, _ := NewWeComAppChannel(cfg, msgBus) - _, err := decryptMessage(base64.StdEncoding.EncodeToString([]byte("test")), ch.config.EncodingAESKey) + _, err := decryptMessage(base64.StdEncoding.EncodeToString([]byte("test")), ch.config.EncodingAESKey()) if err == nil { t.Error("expected error for invalid AES key, got nil") } @@ -306,17 +301,16 @@ func TestWeComAppDecryptMessage(t *testing.T) { t.Run("ciphertext too short", func(t *testing.T) { aesKey := generateTestAESKeyApp() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - EncodingAESKey: aesKey, - } + cfg := config.WeComAppConfig{} + cfg.CorpID = "test_corp_id" + cfg.SetCorpSecret("test_secret") + cfg.AgentID = 1000002 + cfg.SetEncodingAESKey(aesKey) ch, _ := NewWeComAppChannel(cfg, msgBus) // Encrypt a very short message that results in ciphertext less than block size shortData := make([]byte, 8) - _, err := decryptMessage(base64.StdEncoding.EncodeToString(shortData), ch.config.EncodingAESKey) + _, err := decryptMessage(base64.StdEncoding.EncodeToString(shortData), ch.config.EncodingAESKey()) if err == nil { t.Error("expected error for short ciphertext, got nil") } @@ -326,13 +320,12 @@ func TestWeComAppDecryptMessage(t *testing.T) { func TestWeComAppHandleVerification(t *testing.T) { msgBus := bus.NewMessageBus() aesKey := generateTestAESKeyApp() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - Token: "test_token", - EncodingAESKey: aesKey, - } + cfg := config.WeComAppConfig{} + cfg.CorpID = "test_corp_id" + cfg.SetCorpSecret("test_secret") + cfg.AgentID = 1000002 + cfg.SetToken("test_token") + cfg.SetEncodingAESKey(aesKey) ch, _ := NewWeComAppChannel(cfg, msgBus) t.Run("valid verification request", func(t *testing.T) { @@ -394,13 +387,12 @@ func TestWeComAppHandleVerification(t *testing.T) { func TestWeComAppHandleMessageCallback(t *testing.T) { msgBus := bus.NewMessageBus() aesKey := generateTestAESKeyApp() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - Token: "test_token", - EncodingAESKey: aesKey, - } + cfg := config.WeComAppConfig{} + cfg.CorpID = "test_corp_id" + cfg.SetCorpSecret("test_secret") + cfg.AgentID = 1000002 + cfg.SetToken("test_token") + cfg.SetEncodingAESKey(aesKey) ch, _ := NewWeComAppChannel(cfg, msgBus) t.Run("valid message callback", func(t *testing.T) { @@ -509,10 +501,10 @@ func TestWeComAppHandleMessageCallback(t *testing.T) { func TestWeComAppProcessMessage(t *testing.T) { msgBus := bus.NewMessageBus() cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, + CorpID: "test_corp_id", + AgentID: 1000002, } + cfg.SetCorpSecret("test_secret") ch, _ := NewWeComAppChannel(cfg, msgBus) t.Run("process text message", func(t *testing.T) { @@ -594,12 +586,11 @@ func TestWeComAppProcessMessage(t *testing.T) { func TestWeComAppHandleWebhook(t *testing.T) { msgBus := bus.NewMessageBus() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, - Token: "test_token", - } + cfg := config.WeComAppConfig{} + cfg.CorpID = "test_corp_id" + cfg.SetCorpSecret("test_secret") + cfg.AgentID = 1000002 + cfg.SetToken("test_token") ch, _ := NewWeComAppChannel(cfg, msgBus) t.Run("GET request calls verification", func(t *testing.T) { @@ -666,10 +657,10 @@ func TestWeComAppHandleWebhook(t *testing.T) { func TestWeComAppHandleHealth(t *testing.T) { msgBus := bus.NewMessageBus() cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, + CorpID: "test_corp_id", + AgentID: 1000002, } + cfg.SetCorpSecret("test_secret") ch, _ := NewWeComAppChannel(cfg, msgBus) req := httptest.NewRequest(http.MethodGet, "/health/wecom-app", nil) @@ -695,10 +686,10 @@ func TestWeComAppHandleHealth(t *testing.T) { func TestWeComAppAccessToken(t *testing.T) { msgBus := bus.NewMessageBus() cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - CorpSecret: "test_secret", - AgentID: 1000002, + CorpID: "test_corp_id", + AgentID: 1000002, } + cfg.SetCorpSecret("test_secret") ch, _ := NewWeComAppChannel(cfg, msgBus) t.Run("get empty access token initially", func(t *testing.T) { diff --git a/pkg/channels/wecom/bot.go b/pkg/channels/wecom/bot.go index 96d5a961f..22461b768 100644 --- a/pkg/channels/wecom/bot.go +++ b/pkg/channels/wecom/bot.go @@ -82,7 +82,7 @@ type WeComBotReplyMessage struct { // NewWeComBotChannel creates a new WeCom Bot channel instance func NewWeComBotChannel(cfg config.WeComConfig, messageBus *bus.MessageBus) (*WeComBotChannel, error) { - if cfg.Token == "" || cfg.WebhookURL == "" { + if cfg.Token() == "" || cfg.WebhookURL == "" { return nil, fmt.Errorf("wecom token and webhook_url are required") } @@ -216,7 +216,7 @@ func (c *WeComBotChannel) handleVerification(ctx context.Context, w http.Respons } // Verify signature - if !verifySignature(c.config.Token, msgSignature, timestamp, nonce, echostr) { + if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, echostr) { logger.WarnC("wecom", "Signature verification failed") http.Error(w, "Invalid signature", http.StatusForbidden) return @@ -225,7 +225,7 @@ func (c *WeComBotChannel) handleVerification(ctx context.Context, w http.Respons // Decrypt echostr // For AIBOT (智能机器人), receiveid should be empty string "" // Reference: https://developer.work.weixin.qq.com/document/path/101033 - decryptedEchoStr, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey, "") + decryptedEchoStr, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey(), "") if err != nil { logger.ErrorCF("wecom", "Failed to decrypt echostr", map[string]any{ "error": err.Error(), @@ -278,7 +278,7 @@ func (c *WeComBotChannel) handleMessageCallback(ctx context.Context, w http.Resp } // Verify signature - if !verifySignature(c.config.Token, msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { + if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { logger.WarnC("wecom", "Message signature verification failed") http.Error(w, "Invalid signature", http.StatusForbidden) return @@ -287,7 +287,7 @@ func (c *WeComBotChannel) handleMessageCallback(ctx context.Context, w http.Resp // Decrypt message // For AIBOT (智能机器人), receiveid should be empty string "" // Reference: https://developer.work.weixin.qq.com/document/path/101033 - decryptedMsg, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey, "") + decryptedMsg, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey(), "") if err != nil { logger.ErrorCF("wecom", "Failed to decrypt message", map[string]any{ "error": err.Error(), diff --git a/pkg/channels/wecom/bot_test.go b/pkg/channels/wecom/bot_test.go index d223bb6b6..7b50a86f7 100644 --- a/pkg/channels/wecom/bot_test.go +++ b/pkg/channels/wecom/bot_test.go @@ -89,10 +89,9 @@ func TestNewWeComBotChannel(t *testing.T) { msgBus := bus.NewMessageBus() t.Run("missing token", func(t *testing.T) { - cfg := config.WeComConfig{ - Token: "", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - } + cfg := config.WeComConfig{} + cfg.SetToken("") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" _, err := NewWeComBotChannel(cfg, msgBus) if err == nil { t.Error("expected error for missing token, got nil") @@ -100,10 +99,9 @@ func TestNewWeComBotChannel(t *testing.T) { }) t.Run("missing webhook_url", func(t *testing.T) { - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "" _, err := NewWeComBotChannel(cfg, msgBus) if err == nil { t.Error("expected error for missing webhook_url, got nil") @@ -111,11 +109,10 @@ func TestNewWeComBotChannel(t *testing.T) { }) t.Run("valid config", func(t *testing.T) { - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - AllowFrom: []string{"user1", "user2"}, - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" + cfg.AllowFrom = []string{"user1", "user2"} ch, err := NewWeComBotChannel(cfg, msgBus) if err != nil { t.Fatalf("unexpected error: %v", err) @@ -133,11 +130,10 @@ func TestWeComBotChannelIsAllowed(t *testing.T) { msgBus := bus.NewMessageBus() t.Run("empty allowlist allows all", func(t *testing.T) { - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - AllowFrom: []string{}, - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" + cfg.AllowFrom = []string{} ch, _ := NewWeComBotChannel(cfg, msgBus) if !ch.IsAllowed("any_user") { t.Error("empty allowlist should allow all users") @@ -145,11 +141,10 @@ func TestWeComBotChannelIsAllowed(t *testing.T) { }) t.Run("allowlist restricts users", func(t *testing.T) { - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - AllowFrom: []string{"allowed_user"}, - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" + cfg.AllowFrom = []string{"allowed_user"} ch, _ := NewWeComBotChannel(cfg, msgBus) if !ch.IsAllowed("allowed_user") { t.Error("allowed user should pass allowlist check") @@ -162,10 +157,9 @@ func TestWeComBotChannelIsAllowed(t *testing.T) { func TestWeComBotVerifySignature(t *testing.T) { msgBus := bus.NewMessageBus() - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" ch, _ := NewWeComBotChannel(cfg, msgBus) t.Run("valid signature", func(t *testing.T) { @@ -174,7 +168,7 @@ func TestWeComBotVerifySignature(t *testing.T) { msgEncrypt := "test_message" expectedSig := generateSignature("test_token", timestamp, nonce, msgEncrypt) - if !verifySignature(ch.config.Token, expectedSig, timestamp, nonce, msgEncrypt) { + if !verifySignature(ch.config.Token(), expectedSig, timestamp, nonce, msgEncrypt) { t.Error("valid signature should pass verification") } }) @@ -184,21 +178,20 @@ func TestWeComBotVerifySignature(t *testing.T) { nonce := "test_nonce" msgEncrypt := "test_message" - if verifySignature(ch.config.Token, "invalid_sig", timestamp, nonce, msgEncrypt) { + if verifySignature(ch.config.Token(), "invalid_sig", timestamp, nonce, msgEncrypt) { t.Error("invalid signature should fail verification") } }) t.Run("empty token rejects verification (fail-closed)", func(t *testing.T) { - cfgEmpty := config.WeComConfig{ - Token: "", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - } + cfgEmpty := config.WeComConfig{} + cfgEmpty.SetToken("") + cfgEmpty.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" chEmpty := &WeComBotChannel{ config: cfgEmpty, } - if verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { + if verifySignature(chEmpty.config.Token(), "any_sig", "any_ts", "any_nonce", "any_msg") { t.Error("empty token should reject verification (fail-closed)") } }) @@ -208,18 +201,17 @@ func TestWeComBotDecryptMessage(t *testing.T) { msgBus := bus.NewMessageBus() t.Run("decrypt without AES key", func(t *testing.T) { - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - EncodingAESKey: "", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" + cfg.SetEncodingAESKey("") ch, _ := NewWeComBotChannel(cfg, msgBus) // Without AES key, message should be base64 decoded only plainText := "hello world" encoded := base64.StdEncoding.EncodeToString([]byte(plainText)) - result, err := decryptMessage(encoded, ch.config.EncodingAESKey) + result, err := decryptMessage(encoded, ch.config.EncodingAESKey()) if err != nil { t.Fatalf("unexpected error: %v", err) } @@ -230,11 +222,10 @@ func TestWeComBotDecryptMessage(t *testing.T) { t.Run("decrypt with AES key", func(t *testing.T) { aesKey := generateTestAESKey() - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - EncodingAESKey: aesKey, - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" + cfg.SetEncodingAESKey(aesKey) ch, _ := NewWeComBotChannel(cfg, msgBus) originalMsg := "Hello" @@ -243,7 +234,7 @@ func TestWeComBotDecryptMessage(t *testing.T) { t.Fatalf("failed to encrypt test message: %v", err) } - result, err := decryptMessage(encrypted, ch.config.EncodingAESKey) + result, err := decryptMessage(encrypted, ch.config.EncodingAESKey()) if err != nil { t.Fatalf("unexpected error: %v", err) } @@ -253,28 +244,26 @@ func TestWeComBotDecryptMessage(t *testing.T) { }) t.Run("invalid base64", func(t *testing.T) { - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - EncodingAESKey: "", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" + cfg.SetEncodingAESKey("") ch, _ := NewWeComBotChannel(cfg, msgBus) - _, err := decryptMessage("invalid_base64!!!", ch.config.EncodingAESKey) + _, err := decryptMessage("invalid_base64!!!", ch.config.EncodingAESKey()) if err == nil { t.Error("expected error for invalid base64, got nil") } }) t.Run("invalid AES key", func(t *testing.T) { - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - EncodingAESKey: "invalid_key", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" + cfg.SetEncodingAESKey("invalid_key") ch, _ := NewWeComBotChannel(cfg, msgBus) - _, err := decryptMessage(base64.StdEncoding.EncodeToString([]byte("test")), ch.config.EncodingAESKey) + _, err := decryptMessage(base64.StdEncoding.EncodeToString([]byte("test")), ch.config.EncodingAESKey()) if err == nil { t.Error("expected error for invalid AES key, got nil") } @@ -338,11 +327,10 @@ func TestWeComBotPKCS7Unpad(t *testing.T) { func TestWeComBotHandleVerification(t *testing.T) { msgBus := bus.NewMessageBus() aesKey := generateTestAESKey() - cfg := config.WeComConfig{ - Token: "test_token", - EncodingAESKey: aesKey, - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.SetEncodingAESKey(aesKey) + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" ch, _ := NewWeComBotChannel(cfg, msgBus) t.Run("valid verification request", func(t *testing.T) { @@ -404,11 +392,10 @@ func TestWeComBotHandleVerification(t *testing.T) { func TestWeComBotHandleMessageCallback(t *testing.T) { msgBus := bus.NewMessageBus() aesKey := generateTestAESKey() - cfg := config.WeComConfig{ - Token: "test_token", - EncodingAESKey: aesKey, - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.SetEncodingAESKey(aesKey) + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" ch, _ := NewWeComBotChannel(cfg, msgBus) runBotMessageCallback := func(t *testing.T, jsonMsg string) *httptest.ResponseRecorder { @@ -530,10 +517,9 @@ func TestWeComBotHandleMessageCallback(t *testing.T) { func TestWeComBotProcessMessage(t *testing.T) { msgBus := bus.NewMessageBus() - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" ch, _ := NewWeComBotChannel(cfg, msgBus) t.Run("process direct text message", func(t *testing.T) { @@ -599,10 +585,9 @@ func TestWeComBotProcessMessage(t *testing.T) { func TestWeComBotHandleWebhook(t *testing.T) { msgBus := bus.NewMessageBus() - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" ch, _ := NewWeComBotChannel(cfg, msgBus) t.Run("GET request calls verification", func(t *testing.T) { @@ -668,10 +653,9 @@ func TestWeComBotHandleWebhook(t *testing.T) { func TestWeComBotHandleHealth(t *testing.T) { msgBus := bus.NewMessageBus() - cfg := config.WeComConfig{ - Token: "test_token", - WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - } + cfg := config.WeComConfig{} + cfg.SetToken("test_token") + cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" ch, _ := NewWeComBotChannel(cfg, msgBus) req := httptest.NewRequest(http.MethodGet, "/health/wecom", nil) diff --git a/pkg/config/REFACTORING_SUMMARY.md b/pkg/config/REFACTORING_SUMMARY.md new file mode 100644 index 000000000..2c4b30c9a --- /dev/null +++ b/pkg/config/REFACTORING_SUMMARY.md @@ -0,0 +1,225 @@ +# Security Configuration Refactoring Summary + +## Overview + +Successfully refactored `pkg/config/config.go` to support a separate `security.yml` file for storing all sensitive data (API keys, tokens, secrets, passwords). + +## Changes Made + +### New Files Created + +1. **`pkg/config/security.go`** (New file) + - Defines `SecurityConfig` structure for all sensitive data + - Implements `LoadSecurityConfig()` to load from YAML + - Implements `SaveSecurityConfig()` to save with secure permissions (0o600) + - Implements `ResolveReference()` to resolve `ref:` prefixed strings + - Supports all model, channel, web tool, and skills security entries + +2. **`pkg/config/security_test.go`** (New file) + - Comprehensive unit tests for security config loading + - Tests for reference resolution (models, channels, web tools, skills) + - Tests for file I/O operations + +3. **`pkg/config/security_integration_test.go`** (New file) + - Integration tests for full workflow + - Tests backward compatibility with direct values + - Tests mixed usage of references and direct values + - Tests error handling for invalid references + +4. **`security.example.yml`** (New file) + - Template for users to copy and fill in + - Includes all possible security entries with placeholder values + - Located at project root + +5. **`pkg/config/SECURITY_CONFIG.md`** (New file) + - Complete documentation for the security config feature + - Usage examples and reference format guide + - Migration guide from old config + - Security best practices + +6. **`pkg/config/example_security_usage.go`** (New file) + - Practical examples in Go comment format + - Shows complete workflow from creation to usage + - Lists all available reference paths + +### Modified Files + +1. **`pkg/config/config.go`** + - Added `applySecurityConfig()` function to resolve all `ref:` references + - Modified `LoadConfig()` to: + - Load security config from `security.yml` + - Apply security references to all config fields + - Maintain backward compatibility with direct values + - Updated warning message to suggest using `security.yml` + +## Key Features + +### Reference Format + +Uses dot notation for referencing values: +- Models: `ref:model_list..api_key` +- Channels: `ref:channels..` +- Web Tools: `ref:web..` +- Skills: `ref:skills..` + +### Supported Security Entries + +**Models:** +- API keys for all model configurations + +**Channels:** +- Telegram: token +- Feishu: app_secret, encrypt_key, verification_token +- Discord: token +- QQ: app_secret +- DingTalk: client_secret +- Slack: bot_token, app_token +- Matrix: access_token +- LINE: channel_secret, channel_access_token +- OneBot: access_token +- WeCom: token, encoding_aes_key +- WeComApp: corp_secret, token, encoding_aes_key +- WeComAIBot: token, encoding_aes_key +- Pico: token +- IRC: password, nickserv_password, sasl_password + +**Web Tools:** +- Brave: api_key +- Tavily: api_key +- Perplexity: api_key +- GLMSearch: api_key + +**Skills:** +- GitHub: token +- ClawHub: auth_token + +### Backward Compatibility + +- Direct values in `config.json` still work +- Mixed usage of references and direct values is supported +- Optional security file (if missing, only references fail) +- No breaking changes to existing configurations + +## Testing + +All tests pass successfully: + +```bash +go test ./pkg/config -v +``` + +Test coverage includes: +- ✅ Unit tests for reference resolution +- ✅ Integration tests for full workflow +- ✅ Backward compatibility tests +- ✅ Error handling tests +- ✅ File I/O and permission tests +- ✅ All existing config tests still pass + +## Usage Example + +### config.json +```json +{ + "version": 1, + "model_list": [ + { + "model_name": "gpt-5.4", + "model": "openai/gpt-5.4", + "api_base": "https://api.openai.com/v1", + "api_key": "ref:model_list.gpt-5.4.api_key" + } + ], + "channels": { + "telegram": { + "enabled": true, + "token": "ref:channels.telegram.token" + } + } +} +``` + +### security.yml +```yaml +model_list: + gpt-5.4: + api_key: "sk-proj-actual-key-here" + +channels: + telegram: + token: "1234567890:ABCdefGHIjklMNOpqrsTUVwxyz" +``` + +## Migration Path + +1. Copy `security.example.yml` to `~/.picoclaw/security.yml` +2. Fill in actual API keys and tokens +3. Update `config.json` to use `ref:` references +4. Set proper permissions: `chmod 600 ~/.picoclaw/security.yml` +5. Test with `picoclaw --version` + +## Security Benefits + +1. **Separation of concerns**: Configuration and secrets are in separate files +2. **Easier sharing**: Config can be shared without exposing secrets +3. **Better version control**: `security.yml` can be added to `.gitignore` +4. **Flexible deployment**: Different environments can use different security files +5. **Secure file permissions**: Saved with `0o600` by default + +## Implementation Details + +### File Loading Flow + +``` +LoadConfig() + ├─ Load config.json + ├─ Detect version + ├─ Parse config based on version + ├─ Load security.yml (optional) + ├─ Apply security references + │ └─ Resolve all "ref:" prefixes + ├─ Parse environment variables + ├─ Resolve API keys (file://, enc://) + ├─ Expand multi-key models + └─ Validate and return +``` + +### Reference Resolution + +The `ResolveReference()` function: +1. Checks if string starts with `ref:` +2. Parses the dot-notation path +3. Navigates the security config structure +4. Returns the actual value +5. Returns error if path doesn't exist + +### Error Handling + +- Clear error messages with full context +- Includes the reference path and field name +- Fails early on invalid references +- Maintains backward compatibility + +## Dependencies + +Added dependency: `gopkg.in/yaml.v3` for YAML parsing + +## Files Modified Summary + +- **Created**: 6 new files (security.go, tests, docs, examples) +- **Modified**: 1 file (config.go - added security integration) +- **Lines added**: ~1000+ lines (including tests and documentation) +- **Backward compatible**: ✅ Yes +- **Breaking changes**: ❌ None + +## Next Steps + +1. Update main README to mention security.yml +2. Add security.yml to .gitignore +3. Update documentation with security config examples +4. Consider adding migration tool for existing users +5. Add validation for security.yml schema + +## Conclusion + +The refactoring successfully implements a secure, flexible, and backward-compatible way to manage sensitive configuration data. All tests pass and the feature is ready for use. diff --git a/pkg/config/SECURITY_CONFIG.md b/pkg/config/SECURITY_CONFIG.md new file mode 100644 index 000000000..c1aa38acc --- /dev/null +++ b/pkg/config/SECURITY_CONFIG.md @@ -0,0 +1,551 @@ +# Security Configuration Refactoring + +## Overview + +This refactoring introduces a `security.yml` file to store all sensitive data (API keys, tokens, secrets, passwords) separately from the main configuration. This improves security by: + +1. **Separation of concerns**: Configuration settings and secrets are in separate files +2. **Easier sharing**: The main config can be shared without exposing sensitive data +3. **Better version control**: `security.yml` can be added to `.gitignore` +4. **Flexible deployment**: Different environments can use different security files + +## File Structure + +``` +~/.picoclaw/ +├── config.json # Main configuration (safe to share) +└── security.yml # Security data (never share) +``` + +## Usage + +### Basic Configuration + +In your `config.json`, use `ref:` references to point to values in `security.yml`: + +```json +{ + "version": 1, + "model_list": [ + { + "model_name": "gpt-5.4", + "model": "openai/gpt-5.4", + "api_base": "https://api.openai.com/v1", + "api_key": "ref:model_list.gpt-5.4.api_key" + } + ], + "channels": { + "telegram": { + "enabled": true, + "token": "ref:channels.telegram.token" + } + } +} +``` + +### Security Configuration + +In your `security.yml`, store the actual values: + +```yaml +model_list: + gpt-5.4: + api_keys: + - "sk-your-actual-api-key-1" + - "sk-your-actual-api-key-2" # Optional: Multiple keys for failover + claude-sonnet-4.6: + api_keys: + - "sk-your-actual-anthropic-key" # Single key in array format + +channels: + telegram: + token: "your-telegram-bot-token" + +web: + brave: + api_keys: + - "BSAyour-brave-api-key-1" + - "BSAyour-brave-api-key-2" # Optional: Multiple keys for failover + tavily: + api_keys: + - "tvly-your-tavily-api-key" # Single key in array format + glm_search: + api_key: "your-glm-search-api-key" # GLMSearch uses single key format +``` + +## Reference Format + +### Model API Keys + +Format: `ref:model_list..api_key` + +Example: `ref:model_list.gpt-5.4.api_key` + +### Channel Tokens/Secrets + +Format: `ref:channels..` + +Examples: +- `ref:channels.telegram.token` +- `ref:channels.feishu.app_secret` +- `ref:channels.feishu.encrypt_key` +- `ref:channels.feishu.verification_token` +- `ref:channels.discord.token` +- `ref:channels.qq.app_secret` +- `ref:channels.dingtalk.client_secret` +- `ref:channels.slack.bot_token` +- `ref:channels.slack.app_token` +- `ref:channels.matrix.access_token` +- `ref:channels.line.channel_secret` +- `ref:channels.line.channel_access_token` +- `ref:channels.onebot.access_token` +- `ref:channels.wecom.token` +- `ref:channels.wecom.encoding_aes_key` +- `ref:channels.wecom_app.corp_secret` +- `ref:channels.wecom_app.token` +- `ref:channels.wecom_app.encoding_aes_key` +- `ref:channels.wecom_aibot.token` +- `ref:channels.wecom_aibot.encoding_aes_key` +- `ref:channels.pico.token` +- `ref:channels.irc.password` +- `ref:channels.irc.nickserv_password` +- `ref:channels.irc.sasl_password` + +### Web Tool API Keys + +Format: `ref:web..` + +Examples: +- `ref:web.brave.api_key` +- `ref:web.tavily.api_key` +- `ref:web.perplexity.api_key` +- `ref:web.glm_search.api_key` + +### Skills Registry Tokens + +Format: `ref:skills..` + +Examples: +- `ref:skills.github.token` +- `ref:skills.clawhub.auth_token` + +## Backward Compatibility + +The refactoring maintains full backward compatibility: + +1. **Direct values**: You can still use direct values in `config.json` (not recommended for production) +2. **Mixed usage**: You can mix `ref:` references and direct values +3. **Optional security file**: If `security.yml` doesn't exist, all references will fail (but direct values still work) + +### API Key Formats in security.yml + +**Models (gpt-5.4, claude-sonnet-4.6, etc.):** +- Must use `api_keys` (array) format +- Both single and multiple keys use array format + +**Web Tools (Brave, Tavily, Perplexity):** +- Must use `api_keys` (array) format +- Both single and multiple keys use array format + +**Web Tools (GLMSearch):** +- Must use `api_key` (single string) format +- Does NOT support array format + +**Channels (Telegram, Discord, etc.):** +- Use single field names (e.g., `token`, `app_secret`) +- Each channel uses its specific field names + +### Single Key (Models) + +Use array format with one element: +```yaml +model_list: + gpt-5.4: + api_keys: + - "sk-your-key" +``` + +In `config.json`: +```json +{ + "api_key": "ref:model_list.gpt-5.4.api_key" +} +``` + +### Single Key (GLMSearch) + +Use single string format: +```yaml +web: + glm_search: + api_key: "your-glm-key" +``` + +In `config.json`: +```json +{ + "api_key": "ref:web.glm_search.api_key" +} +``` + +## Migration Guide + +### Step 1: Create security.yml + +Copy the example template: +```bash +cp security.example.yml ~/.picoclaw/security.yml +``` + +### Step 2: Fill in your actual values + +Edit `~/.picoclaw/security.yml` and replace placeholder values with your actual API keys and tokens. + +### Step 3: Update config.json + +Replace sensitive values in `~/.picoclaw/config.json` with `ref:` references: + +**Before:** +```json +{ + "model_list": [ + { + "model_name": "gpt-5.4", + "model": "openai/gpt-5.4", + "api_key": "sk-your-actual-api-key-here" + } + ] +} +``` + +**After:** +```json +{ + "model_list": [ + { + "model_name": "gpt-5.4", + "model": "openai/gpt-5.4", + "api_key": "ref:model_list.gpt-5.4.api_key" + } + ] +} +``` + +### Step 4: Verify + +Restart PicoClaw and verify it loads correctly: +```bash +picoclaw --version +``` + +## Security Best Practices + +1. **Never commit `security.yml`** to version control +2. **Set file permissions**: `chmod 600 ~/.picoclaw/security.yml` +3. **Use different keys** for different environments (dev, staging, production) +4. **Rotate keys regularly** and update `security.yml` +5. **Backup securely**: Encrypt backups containing `security.yml` + +## API + +### LoadSecurityConfig + +```go +func LoadSecurityConfig(securityPath string) (*SecurityConfig, error) +``` + +Loads the security configuration from `security.yml`. Returns an empty `SecurityConfig` if the file doesn't exist. + +### SaveSecurityConfig + +```go +func SaveSecurityConfig(securityPath string, sec *SecurityConfig) error +``` + +Saves the security configuration to `security.yml` with `0o600` permissions. + +### ResolveReference + +```go +func (sec *SecurityConfig) ResolveReference(ref string) (string, error) +``` + +Resolves a reference string (e.g., `"ref:model_list.test.api_key"`) and returns the actual value. + +### SecurityPath + +```go +func SecurityPath(configPath string) string +``` + +Returns the path to `security.yml` relative to the config file. + +## Example: Complete Configuration + +### config.json +```json +{ + "version": 1, + "agents": { + "defaults": { + "workspace": "~/picoclaw-workspace", + "model_name": "gpt-5.4" + } + }, + "model_list": [ + { + "model_name": "gpt-5.4", + "model": "openai/gpt-5.4", + "api_base": "https://api.openai.com/v1", + "api_key": "ref:model_list.gpt-5.4.api_key" + }, + { + "model_name": "claude-sonnet-4.6", + "model": "anthropic/claude-sonnet-4.6", + "api_base": "https://api.anthropic.com/v1", + "api_key": "ref:model_list.claude-sonnet-4.6.api_key" + } + ], + "channels": { + "telegram": { + "enabled": true, + "token": "ref:channels.telegram.token" + } + }, + "tools": { + "web": { + "brave": { + "enabled": true, + "api_key": "ref:web.brave.api_key" + } + } + } +} +``` + +### security.yml +```yaml +model_list: + gpt-5.4: + api_keys: + - "sk-proj-actual-openai-key-1" + - "sk-proj-actual-openai-key-2" + claude-sonnet-4.6: + api_keys: + - "sk-ant-actual-anthropic-key" # Single key in array format + +channels: + telegram: + token: "1234567890:ABCdefGHIjklMNOpqrsTUVwxyz" + +web: + brave: + api_keys: + - "BSAactualbravekey-1" + - "BSAactualbravekey-2" + tavily: + api_keys: + - "tvly-your-tavily-key" # Single key in array format + glm_search: + api_key: "your-glm-key" # GLMSearch uses single key format +``` + +## Testing + +The refactoring includes comprehensive tests: + +```bash +go test ./pkg/config -run TestSecurityConfig +``` + +## Troubleshooting + +### Error: "model security entry not found" + +- Ensure the model name in your reference matches exactly in `security.yml` +- Check that the `model_list` section exists in `security.yml` +- For models with indexed names (e.g., "gpt-5.4:0"), ensure the exact name is used or check the base name without index + +### Error: "failed to load security config" + +- Verify `security.yml` exists in the same directory as `config.json` +- Check the YAML syntax is valid (use a YAML validator) +- Ensure file permissions allow reading + +### Error: "unknown reference path" + +- Verify the reference format is correct +- Check the path structure matches the examples above +- Ensure all required sections exist in `security.yml` + +## Advanced Features + +### Multiple API Keys (Load Balancing & Failover) + +Both models and web tools support multiple API keys for improved reliability: + +**Benefits:** +- **Load balancing**: Requests are distributed across multiple keys +- **Failover**: Automatic switching to another key if one fails +- **Rate limit management**: Distribute usage across multiple keys +- **High availability**: Reduce downtime during API provider issues + +#### Example: Model with Multiple Keys + +**security.yml:** +```yaml +model_list: + gpt-5.4: + api_keys: + - "sk-proj-key-1" + - "sk-proj-key-2" + - "sk-proj-key-3" +``` + +**config.json:** +```json +{ + "model_list": [ + { + "model_name": "gpt-5.4", + "model": "openai/gpt-5.4", + "api_key": "ref:model_list.gpt-5.4.api_key" + } + ] +} +``` + +#### Example: Web Tool with Multiple Keys + +**security.yml:** +```yaml +web: + brave: + api_keys: + - "BSA-key-1" + - "BSA-key-2" + tavily: + api_keys: + - "tvly-your-key" # Single key in array format + glm_search: + api_key: "your-glm-key" # GLMSearch uses single key format +``` + +**config.json:** +```json +{ + "tools": { + "web": { + "brave": { + "enabled": true, + "api_key": "ref:web.brave.api_key" + }, + "tavily": { + "enabled": true, + "api_key": "ref:web.tavily.api_key" + } + } + } +} +``` + +#### Supported Formats + +**Models - Single key:** +```yaml +model_list: + gpt-5.4: + api_keys: + - "sk-your-key" # Array with one element +``` + +**Models - Multiple keys:** +```yaml +model_list: + gpt-5.4: + api_keys: + - "sk-your-key-1" + - "sk-your-key-2" + - "sk-your-key-3" +``` + +**Web Tools (Brave/Tavily/Perplexity) - Single key:** +```yaml +web: + brave: + api_keys: + - "BSA-your-key" # Array with one element +``` + +**Web Tools (Brave/Tavily/Perplexity) - Multiple keys:** +```yaml +web: + brave: + api_keys: + - "BSA-key-1" + - "BSA-key-2" +``` + +**Web Tool (GLMSearch) - Single key only:** +```yaml +web: + glm_search: + api_key: "your-glm-key" # Single string (NOT array) +``` + +All formats work identically in `config.json` - you always use the same reference format: +```json +{ + "api_key": "ref:model_list.gpt-5.4.api_key" +} +``` + +### Model Indexing for Load Balancing + +When you have multiple models with the same base name but different API keys, you can use indexed names: + +**security.yml:** +```yaml +model_list: + gpt-5.4: + api_keys: + - "sk-proj-key-1" + - "sk-proj-key-2" +``` + +The system will automatically expand this into multiple model entries with fallback support. + +### Environment Variables + +You can override any security value using environment variables: + +**For models:** +```bash +export PICOCLAW_MODEL_LIST_GPT-5.4_API_KEY="sk-from-env" +``` + +**For channels:** +```bash +export PICOCLAW_CHANNELS_TELEGRAM_TOKEN="token-from-env" +``` + +**For web tools:** +```bash +export PICOCLAW_WEB_BRAVE_API_KEY="key-from-env" +``` + +Environment variables follow this pattern: `PICOCLAW_
___` with dots replaced by underscores and converted to uppercase. + +### Multiple API Keys Not Working + +- Ensure you're using `api_keys` (plural) in `security.yml` for models and web tools (except GLMSearch) +- Check that the array format is correct in YAML (proper indentation) +- Remember: Models, Brave, Tavily, Perplexity MUST use `api_keys` (array format) +- GLMSearch MUST use `api_key` (single string format) +- The reference in `config.json` is the same regardless of single or multiple keys + +### Load Balancing/Failover Issues + +- Verify all API keys in the `api_keys` array are valid +- Check that all keys have the same rate limits and permissions +- Monitor logs to see which keys are being used and failing diff --git a/pkg/config/config.go b/pkg/config/config.go index bbf3f08b4..b43497948 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -88,7 +88,7 @@ type Config struct { Bindings []AgentBinding `json:"bindings,omitempty"` Session SessionConfig `json:"session,omitempty"` Channels ChannelsConfig `json:"channels"` - ModelList []ModelConfig `json:"model_list"` // New model-centric provider configuration + ModelList []*ModelConfig `json:"model_list"` // New model-centric provider configuration Gateway GatewayConfig `json:"gateway"` Tools ToolsConfig `json:"tools"` Heartbeat HeartbeatConfig `json:"heartbeat"` @@ -96,6 +96,21 @@ type Config struct { Voice VoiceConfig `json:"voice"` // BuildInfo contains build-time version information BuildInfo BuildInfo `json:"build_info,omitempty"` + + security *SecurityConfig +} + +func (c *Config) WithSecurity(sec *SecurityConfig) *Config { + if sec == nil { + c.security = sec + return c + } + err := applySecurityConfig(c, sec) + if err != nil { + return nil + } + c.security = sec + return c } // BuildInfo contains build-time version information @@ -111,8 +126,7 @@ type BuildInfo struct { func (c *Config) MarshalJSON() ([]byte, error) { type Alias Config aux := &struct { - Providers *ProvidersConfig `json:"providers,omitempty"` - Session *SessionConfig `json:"session,omitempty"` + Session *SessionConfig `json:"session,omitempty"` *Alias }{ Alias: (*Alias)(c), @@ -299,8 +313,8 @@ type WhatsAppConfig struct { } type TelegramConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_TELEGRAM_ENABLED"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_TELEGRAM_TOKEN"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_TELEGRAM_ENABLED"` + token string BaseURL string `json:"base_url" env:"PICOCLAW_CHANNELS_TELEGRAM_BASE_URL"` Proxy string `json:"proxy" env:"PICOCLAW_CHANNELS_TELEGRAM_PROXY"` AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_TELEGRAM_ALLOW_FROM"` @@ -309,25 +323,71 @@ type TelegramConfig struct { Placeholder PlaceholderConfig `json:"placeholder,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_TELEGRAM_REASONING_CHANNEL_ID"` UseMarkdownV2 bool `json:"use_markdown_v2" env:"PICOCLAW_CHANNELS_TELEGRAM_USE_MARKDOWN_V2"` + secDirty bool +} + +// Token returns the Telegram bot token +func (c *TelegramConfig) Token() string { + return c.token +} + +// SetToken sets the Telegram bot token +func (c *TelegramConfig) SetToken(token string) { + c.token = token + c.secDirty = true } type FeishuConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_FEISHU_ENABLED"` - AppID string `json:"app_id" env:"PICOCLAW_CHANNELS_FEISHU_APP_ID"` - AppSecret string `json:"app_secret" env:"PICOCLAW_CHANNELS_FEISHU_APP_SECRET"` - EncryptKey string `json:"encrypt_key" env:"PICOCLAW_CHANNELS_FEISHU_ENCRYPT_KEY"` - VerificationToken string `json:"verification_token" env:"PICOCLAW_CHANNELS_FEISHU_VERIFICATION_TOKEN"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_FEISHU_ENABLED"` + AppID string `json:"app_id" env:"PICOCLAW_CHANNELS_FEISHU_APP_ID"` + appSecret string + encryptKey string + verificationToken string AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_FEISHU_ALLOW_FROM"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_FEISHU_REASONING_CHANNEL_ID"` RandomReactionEmoji FlexibleStringSlice `json:"random_reaction_emoji" env:"PICOCLAW_CHANNELS_FEISHU_RANDOM_REACTION_EMOJI"` IsLark bool `json:"is_lark" env:"PICOCLAW_CHANNELS_FEISHU_IS_LARK"` + secDirty bool +} + +// AppSecret returns the Feishu app secret +func (c *FeishuConfig) AppSecret() string { + return c.appSecret +} + +// SetAppSecret sets the Feishu app secret +func (c *FeishuConfig) SetAppSecret(secret string) { + c.appSecret = secret + c.secDirty = true +} + +// EncryptKey returns the Feishu encrypt key +func (c *FeishuConfig) EncryptKey() string { + return c.encryptKey +} + +// SetEncryptKey sets the Feishu encrypt key +func (c *FeishuConfig) SetEncryptKey(key string) { + c.encryptKey = key + c.secDirty = true +} + +// VerificationToken returns the Feishu verification token +func (c *FeishuConfig) VerificationToken() string { + return c.verificationToken +} + +// SetVerificationToken sets the Feishu verification token +func (c *FeishuConfig) SetVerificationToken(token string) { + c.verificationToken = token + c.secDirty = true } type DiscordConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_DISCORD_ENABLED"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_DISCORD_TOKEN"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_DISCORD_ENABLED"` + token string Proxy string `json:"proxy" env:"PICOCLAW_CHANNELS_DISCORD_PROXY"` AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_DISCORD_ALLOW_FROM"` MentionOnly bool `json:"mention_only" env:"PICOCLAW_CHANNELS_DISCORD_MENTION_ONLY"` @@ -335,6 +395,18 @@ type DiscordConfig struct { Typing TypingConfig `json:"typing,omitempty"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_DISCORD_REASONING_CHANNEL_ID"` + secDirty bool +} + +// Token returns the Discord bot token +func (c *DiscordConfig) Token() string { + return c.token +} + +// SetToken sets the Discord bot token +func (c *DiscordConfig) SetToken(token string) { + c.token = token + c.secDirty = true } type MaixCamConfig struct { @@ -346,42 +418,89 @@ type MaixCamConfig struct { } type QQConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_QQ_ENABLED"` - AppID string `json:"app_id" env:"PICOCLAW_CHANNELS_QQ_APP_ID"` - AppSecret string `json:"app_secret" env:"PICOCLAW_CHANNELS_QQ_APP_SECRET"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_QQ_ENABLED"` + AppID string `json:"app_id" env:"PICOCLAW_CHANNELS_QQ_APP_ID"` + appSecret string AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_QQ_ALLOW_FROM"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` MaxMessageLength int `json:"max_message_length" env:"PICOCLAW_CHANNELS_QQ_MAX_MESSAGE_LENGTH"` MaxBase64FileSizeMiB int64 `json:"max_base64_file_size_mib" env:"PICOCLAW_CHANNELS_QQ_MAX_BASE64_FILE_SIZE_MIB"` SendMarkdown bool `json:"send_markdown" env:"PICOCLAW_CHANNELS_QQ_SEND_MARKDOWN"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_QQ_REASONING_CHANNEL_ID"` + secDirty bool +} + +// AppSecret returns the QQ app secret +func (c *QQConfig) AppSecret() string { + return c.appSecret +} + +// SetAppSecret sets the QQ app secret +func (c *QQConfig) SetAppSecret(secret string) { + c.appSecret = secret + c.secDirty = true } type DingTalkConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_DINGTALK_ENABLED"` - ClientID string `json:"client_id" env:"PICOCLAW_CHANNELS_DINGTALK_CLIENT_ID"` - ClientSecret string `json:"client_secret" env:"PICOCLAW_CHANNELS_DINGTALK_CLIENT_SECRET"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_DINGTALK_ENABLED"` + ClientID string `json:"client_id" env:"PICOCLAW_CHANNELS_DINGTALK_CLIENT_ID"` + clientSecret string AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_DINGTALK_ALLOW_FROM"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_DINGTALK_REASONING_CHANNEL_ID"` + secDirty bool +} + +// ClientSecret returns the DingTalk client secret +func (c *DingTalkConfig) ClientSecret() string { + return c.clientSecret +} + +// SetClientSecret sets the DingTalk client secret +func (c *DingTalkConfig) SetClientSecret(secret string) { + c.clientSecret = secret + c.secDirty = true } type SlackConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_SLACK_ENABLED"` - BotToken string `json:"bot_token" env:"PICOCLAW_CHANNELS_SLACK_BOT_TOKEN"` - AppToken string `json:"app_token" env:"PICOCLAW_CHANNELS_SLACK_APP_TOKEN"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_SLACK_ENABLED"` + botToken string + appToken string AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_SLACK_ALLOW_FROM"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` Typing TypingConfig `json:"typing,omitempty"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_SLACK_REASONING_CHANNEL_ID"` + secDirty bool +} + +// BotToken returns the Slack bot token +func (c *SlackConfig) BotToken() string { + return c.botToken +} + +// SetBotToken sets the Slack bot token +func (c *SlackConfig) SetBotToken(token string) { + c.botToken = token + c.secDirty = true +} + +// AppToken returns the Slack app token +func (c *SlackConfig) AppToken() string { + return c.appToken +} + +// SetAppToken sets the Slack app token +func (c *SlackConfig) SetAppToken(token string) { + c.appToken = token + c.secDirty = true } type MatrixConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_MATRIX_ENABLED"` - Homeserver string `json:"homeserver" env:"PICOCLAW_CHANNELS_MATRIX_HOMESERVER"` - UserID string `json:"user_id" env:"PICOCLAW_CHANNELS_MATRIX_USER_ID"` - AccessToken string `json:"access_token" env:"PICOCLAW_CHANNELS_MATRIX_ACCESS_TOKEN"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_MATRIX_ENABLED"` + Homeserver string `json:"homeserver" env:"PICOCLAW_CHANNELS_MATRIX_HOMESERVER"` + UserID string `json:"user_id" env:"PICOCLAW_CHANNELS_MATRIX_USER_ID"` + accessToken string DeviceID string `json:"device_id,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_DEVICE_ID"` JoinOnInvite bool `json:"join_on_invite" env:"PICOCLAW_CHANNELS_MATRIX_JOIN_ON_INVITE"` MessageFormat string `json:"message_format,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_MESSAGE_FORMAT"` @@ -389,12 +508,24 @@ type MatrixConfig struct { GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_MATRIX_REASONING_CHANNEL_ID"` + secDirty bool +} + +// AccessToken returns the Matrix access token +func (c *MatrixConfig) AccessToken() string { + return c.accessToken +} + +// SetAccessToken sets the Matrix access token +func (c *MatrixConfig) SetAccessToken(token string) { + c.accessToken = token + c.secDirty = true } type LINEConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_LINE_ENABLED"` - ChannelSecret string `json:"channel_secret" env:"PICOCLAW_CHANNELS_LINE_CHANNEL_SECRET"` - ChannelAccessToken string `json:"channel_access_token" env:"PICOCLAW_CHANNELS_LINE_CHANNEL_ACCESS_TOKEN"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_LINE_ENABLED"` + channelSecret string + channelAccessToken string WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_LINE_WEBHOOK_HOST"` WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_LINE_WEBHOOK_PORT"` WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_LINE_WEBHOOK_PATH"` @@ -403,12 +534,35 @@ type LINEConfig struct { Typing TypingConfig `json:"typing,omitempty"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_LINE_REASONING_CHANNEL_ID"` + secDirty bool +} + +// ChannelSecret returns the LINE channel secret +func (c *LINEConfig) ChannelSecret() string { + return c.channelSecret +} + +// SetChannelSecret sets the LINE channel secret +func (c *LINEConfig) SetChannelSecret(secret string) { + c.channelSecret = secret + c.secDirty = true +} + +// ChannelAccessToken returns the LINE channel access token +func (c *LINEConfig) ChannelAccessToken() string { + return c.channelAccessToken +} + +// SetChannelAccessToken sets the LINE channel access token +func (c *LINEConfig) SetChannelAccessToken(token string) { + c.channelAccessToken = token + c.secDirty = true } type OneBotConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_ONEBOT_ENABLED"` - WSUrl string `json:"ws_url" env:"PICOCLAW_CHANNELS_ONEBOT_WS_URL"` - AccessToken string `json:"access_token" env:"PICOCLAW_CHANNELS_ONEBOT_ACCESS_TOKEN"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_ONEBOT_ENABLED"` + WSUrl string `json:"ws_url" env:"PICOCLAW_CHANNELS_ONEBOT_WS_URL"` + accessToken string ReconnectInterval int `json:"reconnect_interval" env:"PICOCLAW_CHANNELS_ONEBOT_RECONNECT_INTERVAL"` GroupTriggerPrefix []string `json:"group_trigger_prefix" env:"PICOCLAW_CHANNELS_ONEBOT_GROUP_TRIGGER_PREFIX"` AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_ONEBOT_ALLOW_FROM"` @@ -416,12 +570,24 @@ type OneBotConfig struct { Typing TypingConfig `json:"typing,omitempty"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_ONEBOT_REASONING_CHANNEL_ID"` + secDirty bool +} + +// AccessToken returns the OneBot access token +func (c *OneBotConfig) AccessToken() string { + return c.accessToken +} + +// SetAccessToken sets the OneBot access token +func (c *OneBotConfig) SetAccessToken(token string) { + c.accessToken = token + c.secDirty = true } type WeComConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_ENABLED"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_TOKEN"` - EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_ENCODING_AES_KEY"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_ENABLED"` + token string + encodingAESKey string WebhookURL string `json:"webhook_url" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_URL"` WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_HOST"` WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_PORT"` @@ -430,15 +596,38 @@ type WeComConfig struct { ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_REPLY_TIMEOUT"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_REASONING_CHANNEL_ID"` + secDirty bool +} + +// Token returns the WeCom token +func (c *WeComConfig) Token() string { + return c.token +} + +// SetToken sets the WeCom token +func (c *WeComConfig) SetToken(token string) { + c.token = token + c.secDirty = true +} + +// EncodingAESKey returns the WeCom encoding AES key +func (c *WeComConfig) EncodingAESKey() string { + return c.encodingAESKey +} + +// SetEncodingAESKey sets the WeCom encoding AES key +func (c *WeComConfig) SetEncodingAESKey(key string) { + c.encodingAESKey = key + c.secDirty = true } type WeComAppConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_APP_ENABLED"` - CorpID string `json:"corp_id" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_ID"` - CorpSecret string `json:"corp_secret" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_SECRET"` - AgentID int64 `json:"agent_id" env:"PICOCLAW_CHANNELS_WECOM_APP_AGENT_ID"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_APP_TOKEN"` - EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_APP_ENCODING_AES_KEY"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_APP_ENABLED"` + CorpID string `json:"corp_id" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_ID"` + corpSecret string + AgentID int64 `json:"agent_id" env:"PICOCLAW_CHANNELS_WECOM_APP_AGENT_ID"` + token string + encodingAESKey string WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_HOST"` WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_PORT"` WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_PATH"` @@ -446,23 +635,80 @@ type WeComAppConfig struct { ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_APP_REPLY_TIMEOUT"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_APP_REASONING_CHANNEL_ID"` + secDirty bool +} + +// CorpSecret returns the corporate secret for WeCom app +func (c *WeComAppConfig) CorpSecret() string { + return c.corpSecret +} + +// SetCorpSecret sets the corporate secret for WeCom app +func (c *WeComAppConfig) SetCorpSecret(secret string) { + c.corpSecret = secret + c.secDirty = true +} + +// Token returns the webhook token for WeCom app +func (c *WeComAppConfig) Token() string { + return c.token +} + +// SetToken sets the webhook token for WeCom app +func (c *WeComAppConfig) SetToken(token string) { + c.token = token + c.secDirty = true +} + +// EncodingAESKey returns the encoding AES key for WeCom app +func (c *WeComAppConfig) EncodingAESKey() string { + return c.encodingAESKey +} + +// SetEncodingAESKey sets the encoding AES key for WeCom app +func (c *WeComAppConfig) SetEncodingAESKey(key string) { + c.encodingAESKey = key + c.secDirty = true } type WeComAIBotConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENABLED"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_TOKEN"` - EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENCODING_AES_KEY"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENABLED"` + token string + encodingAESKey string WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_WEBHOOK_PATH"` AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ALLOW_FROM"` ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REPLY_TIMEOUT"` MaxSteps int `json:"max_steps" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_MAX_STEPS"` // Maximum streaming steps WelcomeMessage string `json:"welcome_message" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_WELCOME_MESSAGE"` // Sent on enter_chat event; empty = no welcome ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REASONING_CHANNEL_ID"` + secDirty bool +} + +// Token returns the webhook token for WeCom AI bot +func (c *WeComAIBotConfig) Token() string { + return c.token +} + +// EncodingAESKey returns the encoding AES key for WeCom AI bot +func (c *WeComAIBotConfig) EncodingAESKey() string { + return c.encodingAESKey +} + +// SetToken sets the token for WeCom AI bot +func (c *WeComAIBotConfig) SetToken(token string) { + c.token = token + c.secDirty = true +} + +// SetEncodingAESKey sets the encoding AES key for WeCom AI bot +func (c *WeComAIBotConfig) SetEncodingAESKey(key string) { + c.encodingAESKey = key + c.secDirty = true } type PicoConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_PICO_ENABLED"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_PICO_TOKEN"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_PICO_ENABLED"` + token string AllowTokenQuery bool `json:"allow_token_query,omitempty"` AllowOrigins []string `json:"allow_origins,omitempty"` PingInterval int `json:"ping_interval,omitempty"` @@ -471,25 +717,68 @@ type PicoConfig struct { MaxConnections int `json:"max_connections,omitempty"` AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_PICO_ALLOW_FROM"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` + secDirty bool +} + +// Token returns the Pico channel token +func (c *PicoConfig) Token() string { + return c.token +} + +// SetToken sets the Pico channel token +func (c *PicoConfig) SetToken(token string) { + c.token = token + c.secDirty = true } type IRCConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_IRC_ENABLED"` - Server string `json:"server" env:"PICOCLAW_CHANNELS_IRC_SERVER"` - TLS bool `json:"tls" env:"PICOCLAW_CHANNELS_IRC_TLS"` - Nick string `json:"nick" env:"PICOCLAW_CHANNELS_IRC_NICK"` - User string `json:"user,omitempty" env:"PICOCLAW_CHANNELS_IRC_USER"` - RealName string `json:"real_name,omitempty" env:"PICOCLAW_CHANNELS_IRC_REAL_NAME"` - Password string `json:"password" env:"PICOCLAW_CHANNELS_IRC_PASSWORD"` - NickServPassword string `json:"nickserv_password" env:"PICOCLAW_CHANNELS_IRC_NICKSERV_PASSWORD"` - SASLUser string `json:"sasl_user" env:"PICOCLAW_CHANNELS_IRC_SASL_USER"` - SASLPassword string `json:"sasl_password" env:"PICOCLAW_CHANNELS_IRC_SASL_PASSWORD"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_IRC_ENABLED"` + Server string `json:"server" env:"PICOCLAW_CHANNELS_IRC_SERVER"` + TLS bool `json:"tls" env:"PICOCLAW_CHANNELS_IRC_TLS"` + Nick string `json:"nick" env:"PICOCLAW_CHANNELS_IRC_NICK"` + User string `json:"user,omitempty" env:"PICOCLAW_CHANNELS_IRC_USER"` + RealName string `json:"real_name,omitempty" env:"PICOCLAW_CHANNELS_IRC_REAL_NAME"` + password string + nickServPassword string + SASLUser string `json:"sasl_user" env:"PICOCLAW_CHANNELS_IRC_SASL_USER"` + saslPassword string Channels FlexibleStringSlice `json:"channels" env:"PICOCLAW_CHANNELS_IRC_CHANNELS"` RequestCaps FlexibleStringSlice `json:"request_caps,omitempty" env:"PICOCLAW_CHANNELS_IRC_REQUEST_CAPS"` AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_IRC_ALLOW_FROM"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` Typing TypingConfig `json:"typing,omitempty"` ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_IRC_REASONING_CHANNEL_ID"` + secDirty bool +} + +// Password returns the IRC password +func (c *IRCConfig) Password() string { + return c.password +} + +// NickServPassword returns the NickServ password +func (c *IRCConfig) NickServPassword() string { + return c.nickServPassword +} + +// SASLPassword returns the SASL password +func (c *IRCConfig) SASLPassword() string { + return c.saslPassword +} + +func (c *IRCConfig) SetPassword(password string) { + c.password = password + c.secDirty = true +} + +func (c *IRCConfig) SetNickServPassword(password string) { + c.nickServPassword = password + c.secDirty = true +} + +func (c *IRCConfig) SetSASLPassword(password string) { + c.saslPassword = password + c.secDirty = true } type HeartbeatConfig struct { @@ -506,88 +795,6 @@ type VoiceConfig struct { EchoTranscription bool `json:"echo_transcription" env:"PICOCLAW_VOICE_ECHO_TRANSCRIPTION"` } -type ProvidersConfig struct { - Anthropic ProviderConfig `json:"anthropic"` - OpenAI OpenAIProviderConfig `json:"openai"` - LiteLLM ProviderConfig `json:"litellm"` - OpenRouter ProviderConfig `json:"openrouter"` - Groq ProviderConfig `json:"groq"` - Zhipu ProviderConfig `json:"zhipu"` - VLLM ProviderConfig `json:"vllm"` - Gemini ProviderConfig `json:"gemini"` - Nvidia ProviderConfig `json:"nvidia"` - Ollama ProviderConfig `json:"ollama"` - Moonshot ProviderConfig `json:"moonshot"` - ShengSuanYun ProviderConfig `json:"shengsuanyun"` - DeepSeek ProviderConfig `json:"deepseek"` - Cerebras ProviderConfig `json:"cerebras"` - Vivgrid ProviderConfig `json:"vivgrid"` - VolcEngine ProviderConfig `json:"volcengine"` - GitHubCopilot ProviderConfig `json:"github_copilot"` - Antigravity ProviderConfig `json:"antigravity"` - Qwen ProviderConfig `json:"qwen"` - Mistral ProviderConfig `json:"mistral"` - Avian ProviderConfig `json:"avian"` - Minimax ProviderConfig `json:"minimax"` - LongCat ProviderConfig `json:"longcat"` - ModelScope ProviderConfig `json:"modelscope"` - Novita ProviderConfig `json:"novita"` -} - -// IsEmpty checks if all provider configs are empty (no API keys or API bases set) -// Note: WebSearch is an optimization option and doesn't count as "non-empty" -func (p ProvidersConfig) IsEmpty() bool { - return p.Anthropic.APIKey == "" && p.Anthropic.APIBase == "" && - p.OpenAI.APIKey == "" && p.OpenAI.APIBase == "" && - p.LiteLLM.APIKey == "" && p.LiteLLM.APIBase == "" && - p.OpenRouter.APIKey == "" && p.OpenRouter.APIBase == "" && - p.Groq.APIKey == "" && p.Groq.APIBase == "" && - p.Zhipu.APIKey == "" && p.Zhipu.APIBase == "" && - p.VLLM.APIKey == "" && p.VLLM.APIBase == "" && - p.Gemini.APIKey == "" && p.Gemini.APIBase == "" && - p.Nvidia.APIKey == "" && p.Nvidia.APIBase == "" && - p.Ollama.APIKey == "" && p.Ollama.APIBase == "" && - p.Moonshot.APIKey == "" && p.Moonshot.APIBase == "" && - p.ShengSuanYun.APIKey == "" && p.ShengSuanYun.APIBase == "" && - p.DeepSeek.APIKey == "" && p.DeepSeek.APIBase == "" && - p.Cerebras.APIKey == "" && p.Cerebras.APIBase == "" && - p.Vivgrid.APIKey == "" && p.Vivgrid.APIBase == "" && - p.VolcEngine.APIKey == "" && p.VolcEngine.APIBase == "" && - p.GitHubCopilot.APIKey == "" && p.GitHubCopilot.APIBase == "" && - p.Antigravity.APIKey == "" && p.Antigravity.APIBase == "" && - p.Qwen.APIKey == "" && p.Qwen.APIBase == "" && - p.Mistral.APIKey == "" && p.Mistral.APIBase == "" && - p.Avian.APIKey == "" && p.Avian.APIBase == "" && - p.Minimax.APIKey == "" && p.Minimax.APIBase == "" && - p.LongCat.APIKey == "" && p.LongCat.APIBase == "" && - p.ModelScope.APIKey == "" && p.ModelScope.APIBase == "" && - p.Novita.APIKey == "" && p.Novita.APIBase == "" -} - -// MarshalJSON implements custom JSON marshaling for ProvidersConfig -// to omit the entire section when empty -func (p ProvidersConfig) MarshalJSON() ([]byte, error) { - if p.IsEmpty() { - return []byte("null"), nil - } - type Alias ProvidersConfig - return json.Marshal((*Alias)(&p)) -} - -type ProviderConfig struct { - APIKey string `json:"api_key" env:"PICOCLAW_PROVIDERS_{{.Name}}_API_KEY"` - APIBase string `json:"api_base" env:"PICOCLAW_PROVIDERS_{{.Name}}_API_BASE"` - Proxy string `json:"proxy,omitempty" env:"PICOCLAW_PROVIDERS_{{.Name}}_PROXY"` - RequestTimeout int `json:"request_timeout,omitempty" env:"PICOCLAW_PROVIDERS_{{.Name}}_REQUEST_TIMEOUT"` - AuthMethod string `json:"auth_method,omitempty" env:"PICOCLAW_PROVIDERS_{{.Name}}_AUTH_METHOD"` - ConnectMode string `json:"connect_mode,omitempty" env:"PICOCLAW_PROVIDERS_{{.Name}}_CONNECT_MODE"` // only for Github Copilot, `stdio` or `grpc` -} - -type OpenAIProviderConfig struct { - ProviderConfig - WebSearch bool `json:"web_search" env:"PICOCLAW_PROVIDERS_OPENAI_WEB_SEARCH"` -} - // ModelConfig represents a model-centric provider configuration. // It allows adding new providers (especially OpenAI-compatible ones) via configuration only. // The model field uses protocol prefix format: [protocol/]model-identifier @@ -602,8 +809,6 @@ type ModelConfig struct { // HTTP-based providers APIBase string `json:"api_base,omitempty"` // API endpoint URL - APIKey string `json:"api_key"` // API authentication key (single key) - APIKeys []string `json:"api_keys,omitempty"` // API authentication keys (multiple keys for failover) Proxy string `json:"proxy,omitempty"` // HTTP proxy URL Fallbacks []string `json:"fallbacks,omitempty"` // Fallback model names for failover @@ -617,6 +822,19 @@ type ModelConfig struct { MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") RequestTimeout int `json:"request_timeout,omitempty"` ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + + // from security + secModelName string + apiKeys []string + secDirty bool +} + +// APIKey returns the first API key from apiKeys +func (c *ModelConfig) APIKey() string { + if len(c.apiKeys) > 0 { + return c.apiKeys[0] + } + return "" } // Validate checks if the ModelConfig has all required fields. @@ -630,6 +848,15 @@ func (c *ModelConfig) Validate() error { return nil } +func (c *ModelConfig) SetAPIKey(value string) { + if len(c.apiKeys) > 0 { + c.apiKeys[0] = value + } else { + c.apiKeys = append(c.apiKeys, value) + } + c.secDirty = true +} + type GatewayConfig struct { Host string `json:"host" env:"PICOCLAW_GATEWAY_HOST"` Port int `json:"port" env:"PICOCLAW_GATEWAY_PORT"` @@ -649,18 +876,68 @@ type ToolConfig struct { } type BraveConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_BRAVE_ENABLED"` - APIKey string `json:"api_key" env:"PICOCLAW_TOOLS_WEB_BRAVE_API_KEY"` - APIKeys []string `json:"api_keys" env:"PICOCLAW_TOOLS_WEB_BRAVE_API_KEYS"` - MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_BRAVE_MAX_RESULTS"` + Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_BRAVE_ENABLED"` + apiKeys []string + secDirty bool + MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_BRAVE_MAX_RESULTS"` +} + +// APIKey returns the Brave API key +func (c *BraveConfig) APIKey() string { + if len(c.apiKeys) == 0 { + return "" + } + return c.apiKeys[0] +} + +// APIKeys returns the Brave API keys +func (c *BraveConfig) APIKeys() []string { + return c.apiKeys +} + +// SetAPIKey sets the Brave API key +func (c *BraveConfig) SetAPIKey(key string) { + c.apiKeys = []string{key} + c.secDirty = true +} + +// SetAPIKeys sets the Brave API keys +func (c *BraveConfig) SetAPIKeys(keys []string) { + c.apiKeys = keys + c.secDirty = true } type TavilyConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_TAVILY_ENABLED"` - APIKey string `json:"api_key" env:"PICOCLAW_TOOLS_WEB_TAVILY_API_KEY"` - APIKeys []string `json:"api_keys" env:"PICOCLAW_TOOLS_WEB_TAVILY_API_KEYS"` - BaseURL string `json:"base_url" env:"PICOCLAW_TOOLS_WEB_TAVILY_BASE_URL"` - MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_TAVILY_MAX_RESULTS"` + Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_TAVILY_ENABLED"` + apiKeys []string + secDirty bool + BaseURL string `json:"base_url" env:"PICOCLAW_TOOLS_WEB_TAVILY_BASE_URL"` + MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_TAVILY_MAX_RESULTS"` +} + +// APIKey returns the Tavily API key +func (c *TavilyConfig) APIKey() string { + if len(c.apiKeys) == 0 { + return "" + } + return c.apiKeys[0] +} + +// APIKeys returns the Tavily API keys +func (c *TavilyConfig) APIKeys() []string { + return c.apiKeys +} + +// SetAPIKey sets the Tavily API key +func (c *TavilyConfig) SetAPIKey(key string) { + c.apiKeys = []string{key} + c.secDirty = true +} + +// SetAPIKeys sets the Tavily API keys +func (c *TavilyConfig) SetAPIKeys(keys []string) { + c.apiKeys = keys + c.secDirty = true } type DuckDuckGoConfig struct { @@ -669,10 +946,35 @@ type DuckDuckGoConfig struct { } type PerplexityConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_ENABLED"` - APIKey string `json:"api_key" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_API_KEY"` - APIKeys []string `json:"api_keys" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_API_KEYS"` - MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_MAX_RESULTS"` + Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_ENABLED"` + apiKeys []string + secDirty bool + MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_MAX_RESULTS"` +} + +// APIKey returns the Perplexity API key +func (c *PerplexityConfig) APIKey() string { + if len(c.apiKeys) == 0 { + return "" + } + return c.apiKeys[0] +} + +// SetAPIKey sets the Perplexity API key +func (c *PerplexityConfig) SetAPIKey(key string) { + c.apiKeys = []string{key} + c.secDirty = true +} + +// APIKeys returns the Perplexity API keys +func (c *PerplexityConfig) APIKeys() []string { + return c.apiKeys +} + +// SetAPIKeys sets the Perplexity API keys +func (c *PerplexityConfig) SetAPIKeys(keys []string) { + c.apiKeys = keys + c.secDirty = true } type SearXNGConfig struct { @@ -682,15 +984,27 @@ type SearXNGConfig struct { } type GLMSearchConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_GLM_ENABLED"` - APIKey string `json:"api_key" env:"PICOCLAW_TOOLS_WEB_GLM_API_KEY"` - BaseURL string `json:"base_url" env:"PICOCLAW_TOOLS_WEB_GLM_BASE_URL"` + Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_GLM_ENABLED"` + apiKey string + secDirty bool + BaseURL string `json:"base_url" env:"PICOCLAW_TOOLS_WEB_GLM_BASE_URL"` // SearchEngine specifies the search backend: "search_std" (default), // "search_pro", "search_pro_sogou", or "search_pro_quark". SearchEngine string `json:"search_engine" env:"PICOCLAW_TOOLS_WEB_GLM_SEARCH_ENGINE"` MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_GLM_MAX_RESULTS"` } +// APIKey returns the GLM search API key +func (c *GLMSearchConfig) APIKey() string { + return c.apiKey +} + +// SetAPIKey sets the GLM search API key (internal use only) +func (c *GLMSearchConfig) SetAPIKey(key string) { + c.apiKey = key + c.secDirty = true +} + type WebToolsConfig struct { ToolConfig ` envPrefix:"PICOCLAW_TOOLS_WEB_"` Brave BraveConfig ` json:"brave"` @@ -783,14 +1097,27 @@ type SkillsRegistriesConfig struct { } type SkillsGithubConfig struct { - Token string `json:"token,omitempty" env:"PICOCLAW_TOOLS_SKILLS_GITHUB_AUTH_TOKEN"` - Proxy string `json:"proxy,omitempty" env:"PICOCLAW_TOOLS_SKILLS_GITHUB_PROXY"` + token string + secDirty bool + Proxy string `json:"proxy,omitempty" env:"PICOCLAW_TOOLS_SKILLS_GITHUB_PROXY"` +} + +// Token returns the GitHub token +func (c *SkillsGithubConfig) Token() string { + return c.token +} + +// SetToken sets the GitHub token +func (c *SkillsGithubConfig) SetToken(token string) { + c.token = token + c.secDirty = true } type ClawHubRegistryConfig struct { Enabled bool `json:"enabled" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_ENABLED"` BaseURL string `json:"base_url" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_BASE_URL"` - AuthToken string `json:"auth_token" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_AUTH_TOKEN"` + authToken string + secDirty bool SearchPath string `json:"search_path" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_SEARCH_PATH"` SkillsPath string `json:"skills_path" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_SKILLS_PATH"` DownloadPath string `json:"download_path" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_DOWNLOAD_PATH"` @@ -799,6 +1126,17 @@ type ClawHubRegistryConfig struct { MaxResponseSize int `json:"max_response_size" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_MAX_RESPONSE_SIZE"` } +// AuthToken returns the ClawHub auth token +func (c *ClawHubRegistryConfig) AuthToken() string { + return c.authToken +} + +// SetAuthToken sets the ClawHub auth token +func (c *ClawHubRegistryConfig) SetAuthToken(token string) { + c.authToken = token + c.secDirty = true +} + // MCPServerConfig defines configuration for a single MCP server type MCPServerConfig struct { // Enabled indicates whether this MCP server is active @@ -852,6 +1190,7 @@ func LoadConfig(path string) (*Config, error) { var cfg *Config switch versionInfo.Version { case 0: + logger.InfoF("config migrate start", map[string]any{"from": versionInfo.Version, "to": CurrentVersion}) // Legacy config (no version field) v, e := loadConfigV0(data) if e != nil { @@ -876,27 +1215,53 @@ func LoadConfig(path string) (*Config, error) { return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version) } + // Load security configuration + securityPath := securityPath(path) + sec, err := loadSecurityConfig(securityPath) + if err != nil { + return nil, fmt.Errorf("failed to load security config: %w", err) + } + logger.Infof("sec: %#v", sec.ModelList) + + // Apply security references from security.yml BEFORE resolveAPIKeys + // This resolves ref: references to actual values + if err := applySecurityConfig(cfg, sec); err != nil { + return nil, fmt.Errorf("failed to apply security config: %w", err) + } + if passphrase := credential.PassphraseProvider(); passphrase != "" { for _, m := range cfg.ModelList { - if m.APIKey != "" && !strings.HasPrefix(m.APIKey, "enc://") && !strings.HasPrefix(m.APIKey, "file://") { - fmt.Fprintf(os.Stderr, - "picoclaw: warning: model %q has a plaintext api_key; call SaveConfig to encrypt it\n", - m.ModelName) + for _, k := range m.apiKeys { + if k != "" && !strings.HasPrefix(k, "enc://") && !strings.HasPrefix(k, "file://") { + fmt.Fprintf(os.Stderr, + "picoclaw: warning: model %q has a plaintext api_key; call SaveConfig to encrypt it\n", + m.ModelName) + break // Only warn once per model + } } } } + // logger.Infof("cfg: %#v", cfg.ModelList[0]) if err := env.Parse(cfg); err != nil { return nil, err } + // logger.Infof("cfg: %#v", cfg.ModelList[0]) if err := resolveAPIKeys(cfg.ModelList, filepath.Dir(path)); err != nil { return nil, err } - // Expand multi-key configs into separate entries for key-level failover - cfg.ModelList = ExpandMultiKeyModels(cfg.ModelList) + // Resolve security fields like authToken that may contain file:// references + if err := resolveSecurityFields(cfg, filepath.Dir(path)); err != nil { + return nil, err + } + // logger.Infof("cfg: %#v", cfg.ModelList[0]) + // Expand multi-key configs into separate entries for key-level failover + cfg.ModelList = expandMultiKeyModels(cfg.ModelList) + + // logger.Infof("cfg: %#v", cfg.ModelList[0]) // Migrate legacy channel config fields to new unified structures cfg.migrateChannelConfigs() @@ -919,27 +1284,222 @@ func LoadConfig(path string) (*Config, error) { return cfg, nil } +func copyArray[T any](dst, src *[]T) { + *dst = make([]T, len(*src)) + copy(*dst, *src) +} + +// applySecurityConfig resolves all security references in config +// It checks each field for "ref:" prefixed values and resolves them from security.yml +func applySecurityConfig(cfg *Config, sec *SecurityConfig) error { + if sec == nil { + return nil + } + + if sec.Web.Brave != nil && len(sec.Web.Brave.APIKeys) > 0 { + copyArray(&cfg.Tools.Web.Brave.apiKeys, &sec.Web.Brave.APIKeys) + } + + if sec.Web.Tavily != nil && len(sec.Web.Tavily.APIKeys) > 0 { + copyArray(&cfg.Tools.Web.Tavily.apiKeys, &sec.Web.Tavily.APIKeys) + } + + if sec.Web.Perplexity != nil && len(sec.Web.Perplexity.APIKeys) > 0 { + copyArray(&cfg.Tools.Web.Perplexity.apiKeys, &sec.Web.Perplexity.APIKeys) + } + + if sec.Web.GLMSearch != nil && sec.Web.GLMSearch.APIKey != "" { + cfg.Tools.Web.GLMSearch.apiKey = sec.Web.GLMSearch.APIKey + } + + if sec.Skills.Github != nil && sec.Skills.Github.Token != "" { + cfg.Tools.Skills.Github.token = sec.Skills.Github.Token + } + + if sec.Skills.ClawHub != nil && sec.Skills.ClawHub.AuthToken != "" { + cfg.Tools.Skills.Registries.ClawHub.authToken = sec.Skills.ClawHub.AuthToken + } + + names := toNameIndex(cfg.ModelList) + for i, model := range cfg.ModelList { + // Try exact match first (e.g., "abc:0" -> "abc:0") + if entry, exists := sec.ModelList[names[i]]; exists { + copyArray(&model.apiKeys, &entry.APIKeys) + model.secModelName = names[i] + continue + } + + // Try match without index suffix (e.g., "abc" -> "abc") + // This allows security.yml to use simpler keys like "test-model" instead of "test-model:0" + baseName := model.ModelName + if entry, exists := sec.ModelList[baseName]; exists { + copyArray(&model.apiKeys, &entry.APIKeys) + model.secModelName = baseName + continue + } + } + + // Handle Telegram token + if sec.Channels.Telegram != nil && sec.Channels.Telegram.Token != "" { + cfg.Channels.Telegram.SetToken(sec.Channels.Telegram.Token) + } + + // Handle Feishu credentials + if sec.Channels.Feishu != nil { + if sec.Channels.Feishu.AppSecret != "" { + cfg.Channels.Feishu.SetAppSecret(sec.Channels.Feishu.AppSecret) + } + if sec.Channels.Feishu.EncryptKey != "" { + cfg.Channels.Feishu.SetEncryptKey(sec.Channels.Feishu.EncryptKey) + } + if sec.Channels.Feishu.VerificationToken != "" { + cfg.Channels.Feishu.SetVerificationToken(sec.Channels.Feishu.VerificationToken) + } + } + + // Handle Discord token + if sec.Channels.Discord != nil && sec.Channels.Discord.Token != "" { + cfg.Channels.Discord.SetToken(sec.Channels.Discord.Token) + } + + // Handle DingTalk client secret + if sec.Channels.DingTalk != nil && sec.Channels.DingTalk.ClientSecret != "" { + cfg.Channels.DingTalk.SetClientSecret(sec.Channels.DingTalk.ClientSecret) + } + + // Handle Slack tokens + if sec.Channels.Slack != nil { + if sec.Channels.Slack.BotToken != "" { + cfg.Channels.Slack.SetBotToken(sec.Channels.Slack.BotToken) + } + if sec.Channels.Slack.AppToken != "" { + cfg.Channels.Slack.SetAppToken(sec.Channels.Slack.AppToken) + } + } + + // Handle Matrix access token + if sec.Channels.Matrix != nil && sec.Channels.Matrix.AccessToken != "" { + cfg.Channels.Matrix.SetAccessToken(sec.Channels.Matrix.AccessToken) + } + + // Handle LINE credentials + if sec.Channels.LINE != nil { + if sec.Channels.LINE.ChannelSecret != "" { + cfg.Channels.LINE.SetChannelSecret(sec.Channels.LINE.ChannelSecret) + } + if sec.Channels.LINE.ChannelAccessToken != "" { + cfg.Channels.LINE.SetChannelAccessToken(sec.Channels.LINE.ChannelAccessToken) + } + } + + // Handle OneBot access token + if sec.Channels.OneBot != nil && sec.Channels.OneBot.AccessToken != "" { + cfg.Channels.OneBot.SetAccessToken(sec.Channels.OneBot.AccessToken) + } + + // Handle WeCom token and encoding key + if sec.Channels.WeCom != nil { + if sec.Channels.WeCom.Token != "" { + cfg.Channels.WeCom.SetToken(sec.Channels.WeCom.Token) + } + if sec.Channels.WeCom.EncodingAESKey != "" { + cfg.Channels.WeCom.SetEncodingAESKey(sec.Channels.WeCom.EncodingAESKey) + } + } + + // Handle WeCom App credentials + if sec.Channels.WeComApp != nil { + if sec.Channels.WeComApp.CorpSecret != "" { + cfg.Channels.WeComApp.SetCorpSecret(sec.Channels.WeComApp.CorpSecret) + } + if sec.Channels.WeComApp.Token != "" { + cfg.Channels.WeComApp.SetToken(sec.Channels.WeComApp.Token) + } + if sec.Channels.WeComApp.EncodingAESKey != "" { + cfg.Channels.WeComApp.SetEncodingAESKey(sec.Channels.WeComApp.EncodingAESKey) + } + } + + // Handle WeCom AI Bot credentials + if sec.Channels.WeComAIBot != nil { + if sec.Channels.WeComAIBot.Token != "" { + cfg.Channels.WeComAIBot.SetToken(sec.Channels.WeComAIBot.Token) + } + if sec.Channels.WeComAIBot.EncodingAESKey != "" { + cfg.Channels.WeComAIBot.SetEncodingAESKey(sec.Channels.WeComAIBot.EncodingAESKey) + } + } + + // Handle Pico channel token + if sec.Channels.Pico != nil && sec.Channels.Pico.Token != "" { + cfg.Channels.Pico.SetToken(sec.Channels.Pico.Token) + } + + // Handle IRC passwords + if sec.Channels.IRC != nil { + if sec.Channels.IRC.Password != "" { + cfg.Channels.IRC.password = sec.Channels.IRC.Password + } + if sec.Channels.IRC.NickServPassword != "" { + cfg.Channels.IRC.nickServPassword = sec.Channels.IRC.NickServPassword + } + if sec.Channels.IRC.SASLPassword != "" { + cfg.Channels.IRC.saslPassword = sec.Channels.IRC.SASLPassword + } + } + + // Handle QQ app secret + if sec.Channels.QQ != nil && sec.Channels.QQ.AppSecret != "" { + cfg.Channels.QQ.SetAppSecret(sec.Channels.QQ.AppSecret) + } + + cfg.security = sec + + return nil +} + +func toNameIndex(list []*ModelConfig) []string { + nameList := make([]string, 0, len(list)) + countMap := make(map[string]int) + for _, model := range list { + name := model.ModelName + index := countMap[name] + nameList = append(nameList, fmt.Sprintf("%s:%d", name, index)) + countMap[name]++ + } + return nameList +} + // encryptPlaintextAPIKeys returns a copy of models with plaintext api_key values // encrypted. Returns (nil, nil) when nothing changed (all keys already sealed or // empty). Returns (nil, error) if any key fails to encrypt — callers must treat // this as a hard failure to prevent a mixed plaintext/ciphertext state on disk. // Symmetric counterpart of resolveAPIKeys: both operate purely on []ModelConfig // and leave JSON marshaling to the caller. -func encryptPlaintextAPIKeys(models []ModelConfig, passphrase string) ([]ModelConfig, error) { - sealed := make([]ModelConfig, len(models)) - copy(sealed, models) +func encryptPlaintextAPIKeys( + models map[string]ModelSecurityEntry, + passphrase string, +) (map[string]ModelSecurityEntry, error) { + sealed := make(map[string]ModelSecurityEntry, len(models)) changed := false - for i := range sealed { - m := &sealed[i] - if m.APIKey == "" || strings.HasPrefix(m.APIKey, "enc://") || strings.HasPrefix(m.APIKey, "file://") { - continue + for k, m := range models { + sealedEntry := ModelSecurityEntry{APIKeys: make([]string, len(m.APIKeys))} + + // Encrypt each key in APIKeys + for i, key := range m.APIKeys { + if key == "" || strings.HasPrefix(key, "enc://") || strings.HasPrefix(key, "file://") { + sealedEntry.APIKeys[i] = key + continue + } + encrypted, err := credential.Encrypt(passphrase, "", key) + if err != nil { + return nil, fmt.Errorf("cannot seal api_key for model %q: %w", k, err) + } + sealedEntry.APIKeys[i] = encrypted + changed = true } - encrypted, err := credential.Encrypt(passphrase, "", m.APIKey) - if err != nil { - return nil, fmt.Errorf("cannot seal api_key for model %q: %w", m.ModelName, err) - } - m.APIKey = encrypted - changed = true + + sealed[k] = sealedEntry } if !changed { return nil, nil @@ -949,24 +1509,16 @@ func encryptPlaintextAPIKeys(models []ModelConfig, passphrase string) ([]ModelCo // resolveAPIKeys decrypts or dereferences each api_key in models in-place. // Supports plaintext (no-op), file:// (read from configDir), and enc:// (AES-GCM decrypt). -// Also resolves api_keys array if present. -func resolveAPIKeys(models []ModelConfig, configDir string) error { +func resolveAPIKeys(models []*ModelConfig, configDir string) error { cr := credential.NewResolver(configDir) for i := range models { - // Resolve single APIKey - resolved, err := cr.Resolve(models[i].APIKey) - if err != nil { - return fmt.Errorf("model_list[%d] (%s): %w", i, models[i].ModelName, err) - } - models[i].APIKey = resolved - // Resolve APIKeys array - for j, key := range models[i].APIKeys { + for j, key := range models[i].apiKeys { resolved, err := cr.Resolve(key) if err != nil { return fmt.Errorf("model_list[%d] (%s): api_keys[%d]: %w", i, models[i].ModelName, j, err) } - models[i].APIKeys[j] = resolved + models[i].apiKeys[j] = resolved } } return nil @@ -986,21 +1538,174 @@ func (c *Config) migrateChannelConfigs() { } func SaveConfig(path string, cfg *Config) error { + if cfg.security == nil { + logger.Errorf("config %#v", *cfg) + if len(cfg.ModelList) > 0 { + logger.Errorf("model[0] %#v", cfg.ModelList[0]) + } + logger.ErrorC("config", "security is nil") + return fmt.Errorf("security is nil") + } // Ensure version is always set when saving if cfg.Version == 0 { cfg.Version = CurrentVersion } + names := toNameIndex(cfg.ModelList) + for i, m := range cfg.ModelList { + if m.secDirty { + if m.secModelName == "" { + m.secModelName = names[i] + } + cfg.security.ModelList[m.secModelName] = ModelSecurityEntry{ + APIKeys: m.apiKeys, + } + m.secDirty = false + } + } + if cfg.Channels.Pico.secDirty { + cfg.security.Channels.Pico = &PicoSecurity{ + Token: cfg.Channels.Pico.Token(), + } + cfg.Channels.Pico.secDirty = false + } + if cfg.Channels.IRC.secDirty { + cfg.security.Channels.IRC = &IRCSecurity{ + Password: cfg.Channels.IRC.password, + NickServPassword: cfg.Channels.IRC.nickServPassword, + SASLPassword: cfg.Channels.IRC.saslPassword, + } + cfg.Channels.IRC.secDirty = false + } + if cfg.Channels.Telegram.secDirty { + cfg.security.Channels.Telegram = &TelegramSecurity{ + Token: cfg.Channels.Telegram.Token(), + } + cfg.Channels.Telegram.secDirty = false + } + if cfg.Channels.Feishu.secDirty { + cfg.security.Channels.Feishu = &FeishuSecurity{ + AppSecret: cfg.Channels.Feishu.AppSecret(), + EncryptKey: cfg.Channels.Feishu.EncryptKey(), + VerificationToken: cfg.Channels.Feishu.VerificationToken(), + } + cfg.Channels.Feishu.secDirty = false + } + if cfg.Channels.Discord.secDirty { + cfg.security.Channels.Discord = &DiscordSecurity{ + Token: cfg.Channels.Discord.Token(), + } + cfg.Channels.Discord.secDirty = false + } + if cfg.Channels.QQ.secDirty { + cfg.security.Channels.QQ = &QQSecurity{ + AppSecret: cfg.Channels.QQ.AppSecret(), + } + cfg.Channels.QQ.secDirty = false + } + if cfg.Channels.DingTalk.secDirty { + cfg.security.Channels.DingTalk = &DingTalkSecurity{ + ClientSecret: cfg.Channels.DingTalk.ClientSecret(), + } + cfg.Channels.DingTalk.secDirty = false + } + if cfg.Channels.Slack.secDirty { + cfg.security.Channels.Slack = &SlackSecurity{ + BotToken: cfg.Channels.Slack.BotToken(), + AppToken: cfg.Channels.Slack.AppToken(), + } + cfg.Channels.Slack.secDirty = false + } + if cfg.Channels.Matrix.secDirty { + cfg.security.Channels.Matrix = &MatrixSecurity{ + AccessToken: cfg.Channels.Matrix.AccessToken(), + } + cfg.Channels.Matrix.secDirty = false + } + if cfg.Channels.LINE.secDirty { + cfg.security.Channels.LINE = &LINESecurity{ + ChannelSecret: cfg.Channels.LINE.ChannelSecret(), + ChannelAccessToken: cfg.Channels.LINE.ChannelAccessToken(), + } + cfg.Channels.LINE.secDirty = false + } + if cfg.Channels.OneBot.secDirty { + cfg.security.Channels.OneBot = &OneBotSecurity{ + AccessToken: cfg.Channels.OneBot.AccessToken(), + } + cfg.Channels.OneBot.secDirty = false + } + if cfg.Channels.WeCom.secDirty { + cfg.security.Channels.WeCom = &WeComSecurity{ + Token: cfg.Channels.WeCom.Token(), + EncodingAESKey: cfg.Channels.WeCom.EncodingAESKey(), + } + cfg.Channels.WeCom.secDirty = false + } + if cfg.Channels.WeComApp.secDirty { + cfg.security.Channels.WeComApp = &WeComAppSecurity{ + CorpSecret: cfg.Channels.WeComApp.CorpSecret(), + Token: cfg.Channels.WeComApp.Token(), + EncodingAESKey: cfg.Channels.WeComApp.EncodingAESKey(), + } + cfg.Channels.WeComApp.secDirty = false + } + if cfg.Channels.WeComAIBot.secDirty { + cfg.security.Channels.WeComAIBot = &WeComAIBotSecurity{ + Token: cfg.Channels.WeComAIBot.Token(), + EncodingAESKey: cfg.Channels.WeComAIBot.EncodingAESKey(), + } + cfg.Channels.WeComAIBot.secDirty = false + } + if cfg.Tools.Web.Brave.secDirty { + cfg.security.Web.Brave = &BraveSecurity{ + APIKeys: cfg.Tools.Web.Brave.APIKeys(), + } + cfg.Tools.Web.Brave.secDirty = false + } + if cfg.Tools.Web.Tavily.secDirty { + cfg.security.Web.Tavily = &TavilySecurity{ + APIKeys: cfg.Tools.Web.Tavily.APIKeys(), + } + cfg.Tools.Web.Tavily.secDirty = false + } + if cfg.Tools.Web.Perplexity.secDirty { + cfg.security.Web.Perplexity = &PerplexitySecurity{ + APIKeys: cfg.Tools.Web.Perplexity.APIKeys(), + } + cfg.Tools.Web.Perplexity.secDirty = false + } + if cfg.Tools.Web.GLMSearch.secDirty { + cfg.security.Web.GLMSearch = &GLMSearchSecurity{ + APIKey: cfg.Tools.Web.GLMSearch.APIKey(), + } + cfg.Tools.Web.GLMSearch.secDirty = false + } + if cfg.Tools.Skills.Github.secDirty { + cfg.security.Skills.Github = &GithubSecurity{ + Token: cfg.Tools.Skills.Github.Token(), + } + cfg.Tools.Skills.Github.secDirty = false + } + if cfg.Tools.Skills.Registries.ClawHub.secDirty { + cfg.security.Skills.ClawHub = &ClawHubSecurity{ + AuthToken: cfg.Tools.Skills.Registries.ClawHub.AuthToken(), + } + cfg.Tools.Skills.Registries.ClawHub.secDirty = false + } + if passphrase := credential.PassphraseProvider(); passphrase != "" { - sealed, err := encryptPlaintextAPIKeys(cfg.ModelList, passphrase) + sealed, err := encryptPlaintextAPIKeys(cfg.security.ModelList, passphrase) if err != nil { return err } if sealed != nil { - tmp := *cfg - tmp.ModelList = sealed - cfg = &tmp + cfg.security.ModelList = sealed } } + if err := saveSecurityConfig(securityPath(path), cfg.security); err != nil { + logger.ErrorCF("config", "cannot save security.yml", map[string]any{"error": err}) + return err + } data, err := json.MarshalIndent(cfg, "", " ") if err != nil { @@ -1036,17 +1741,17 @@ func (c *Config) GetModelConfig(modelName string) (*ModelConfig, error) { return nil, fmt.Errorf("model %q not found in model_list or providers", modelName) } if len(matches) == 1 { - return &matches[0], nil + return matches[0], nil } // Multiple configs - use round-robin for load balancing idx := (rrCounter.Add(1) - 1) % uint64(len(matches)) - return &matches[idx], nil + return matches[idx], nil } // findMatches finds all ModelConfig entries with the given model_name. -func (c *Config) findMatches(modelName string) []ModelConfig { - var matches []ModelConfig +func (c *Config) findMatches(modelName string) []*ModelConfig { + var matches []*ModelConfig for i := range c.ModelList { if c.ModelList[i].ModelName == modelName { matches = append(matches, c.ModelList[i]) @@ -1067,6 +1772,10 @@ func (c *Config) ValidateModelList() error { return nil } +func (c *Config) SecurityCopyFrom(cfg *Config) { + c.security = cfg.security +} + func MergeAPIKeys(apiKey string, apiKeys []string) []string { seen := make(map[string]struct{}) var all []string @@ -1090,28 +1799,93 @@ func MergeAPIKeys(apiKey string, apiKeys []string) []string { return all } -// ExpandMultiKeyModels expands ModelConfig entries with multiple API keys into +// resolveSecurityFields resolves file:// and enc:// references in security-sensitive fields +// like authToken and token that are not part of ModelConfig's apiKeys +func resolveSecurityFields(cfg *Config, configDir string) error { + cr := credential.NewResolver(configDir) + + // Resolve Web tool API keys - set apiKey field to first resolved apiKeys entry + if len(cfg.Tools.Web.Brave.apiKeys) > 0 { + keys := cfg.Tools.Web.Brave.apiKeys + for i, key := range keys { + resolved, err := cr.Resolve(key) + if err != nil { + return fmt.Errorf("brave api_keys[%d]: %w", i, err) + } + keys[i] = resolved + } + } + + if len(cfg.Tools.Web.Tavily.apiKeys) > 0 { + keys := cfg.Tools.Web.Tavily.apiKeys + for i, key := range keys { + resolved, err := cr.Resolve(key) + if err != nil { + return fmt.Errorf("tavily api_keys[%d]: %w", i, err) + } + keys[i] = resolved + } + } + + if len(cfg.Tools.Web.Perplexity.apiKeys) > 0 { + keys := cfg.Tools.Web.Perplexity.apiKeys + for i, key := range keys { + resolved, err := cr.Resolve(key) + if err != nil { + return fmt.Errorf("perplexity api_keys[%d]: %w", i, err) + } + keys[i] = resolved + } + } + + // GLMSearch has a private apiKey field + if cfg.Tools.Web.GLMSearch.apiKey != "" { + resolved, err := cr.Resolve(cfg.Tools.Web.GLMSearch.apiKey) + if err != nil { + return fmt.Errorf("glm api_key: %w", err) + } + cfg.Tools.Web.GLMSearch.apiKey = resolved + } + + // Resolve Skills tokens + if cfg.Tools.Skills.Github.token != "" { + resolved, err := cr.Resolve(cfg.Tools.Skills.Github.token) + if err != nil { + return fmt.Errorf("github token: %w", err) + } + cfg.Tools.Skills.Github.token = resolved + } + + if cfg.Tools.Skills.Registries.ClawHub.authToken != "" { + resolved, err := cr.Resolve(cfg.Tools.Skills.Registries.ClawHub.authToken) + if err != nil { + return fmt.Errorf("clawhub auth_token: %w", err) + } + cfg.Tools.Skills.Registries.ClawHub.authToken = resolved + } + + return nil +} + +// expandMultiKeyModels expands ModelConfig entries with multiple API keys into // separate entries for key-level failover. Each key gets its own ModelConfig entry, // and the original entry's fallbacks are set up to chain through the expanded entries. // // Example: {"model_name": "gpt-4", "api_keys": ["k1", "k2", "k3"]} // Becomes: -// - {"model_name": "gpt-4", "api_key": "k1", "fallbacks": ["gpt-4__key_1", "gpt-4__key_2"]} -// - {"model_name": "gpt-4__key_1", "api_key": "k2"} -// - {"model_name": "gpt-4__key_2", "api_key": "k3"} -func ExpandMultiKeyModels(models []ModelConfig) []ModelConfig { - var expanded []ModelConfig +// - {"model_name": "gpt-4", "api_keys": ["k1"], "fallbacks": ["gpt-4__key_1", "gpt-4__key_2"]} +// - {"model_name": "gpt-4__key_1", "api_keys": {"k2"}} +// - {"model_name": "gpt-4__key_2", "api_keys": {"k3"}} +func expandMultiKeyModels(models []*ModelConfig) []*ModelConfig { + var expanded []*ModelConfig for _, m := range models { - keys := MergeAPIKeys(m.APIKey, m.APIKeys) + keys := MergeAPIKeys("", m.apiKeys) // Single key or no keys: keep as-is if len(keys) <= 1 { - // Ensure APIKey is set from APIKeys if needed - if m.APIKey == "" && len(keys) == 1 { - m.APIKey = keys[0] - } - m.APIKeys = nil // Clear APIKeys to avoid confusion + m.apiKeys = keys + logger.Infof("keys:%v", keys) expanded = append(expanded, m) continue } @@ -1126,11 +1900,11 @@ func ExpandMultiKeyModels(models []ModelConfig) []ModelConfig { expandedName := originalName + suffix // Create a copy for the additional key - additionalEntry := ModelConfig{ + additionalEntry := &ModelConfig{ ModelName: expandedName, Model: m.Model, APIBase: m.APIBase, - APIKey: keys[i], + apiKeys: []string{keys[i]}, Proxy: m.Proxy, AuthMethod: m.AuthMethod, ConnectMode: m.ConnectMode, @@ -1145,11 +1919,10 @@ func ExpandMultiKeyModels(models []ModelConfig) []ModelConfig { } // Create the primary entry with first key and fallbacks - primaryEntry := ModelConfig{ + primaryEntry := &ModelConfig{ ModelName: originalName, Model: m.Model, APIBase: m.APIBase, - APIKey: keys[0], Proxy: m.Proxy, AuthMethod: m.AuthMethod, ConnectMode: m.ConnectMode, @@ -1158,6 +1931,7 @@ func ExpandMultiKeyModels(models []ModelConfig) []ModelConfig { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, + apiKeys: []string{keys[0]}, } // Prepend new fallbacks to existing ones diff --git a/pkg/config/config_old.go b/pkg/config/config_old.go index 782c3dc44..28670b0fc 100644 --- a/pkg/config/config_old.go +++ b/pkg/config/config_old.go @@ -5,6 +5,8 @@ package config +import "encoding/json" + type agentDefaultsV0 struct { Workspace string `json:"workspace" env:"PICOCLAW_AGENTS_DEFAULTS_WORKSPACE"` RestrictToWorkspace bool `json:"restrict_to_workspace" env:"PICOCLAW_AGENTS_DEFAULTS_RESTRICT_TO_WORKSPACE"` @@ -42,16 +44,670 @@ type agentsConfigV0 struct { // This struct is used for loading legacy config files (version 0). // It is unexported since it's only used internally for migration. type configV0 struct { - Agents agentsConfigV0 `json:"agents"` - Bindings []AgentBinding `json:"bindings,omitempty"` - Session SessionConfig `json:"session,omitempty"` - Channels ChannelsConfig `json:"channels"` - Providers ProvidersConfig `json:"providers,omitempty"` - ModelList []ModelConfig `json:"model_list"` - Gateway GatewayConfig `json:"gateway"` - Tools ToolsConfig `json:"tools"` - Heartbeat HeartbeatConfig `json:"heartbeat"` - Devices DevicesConfig `json:"devices"` + Agents agentsConfigV0 `json:"agents"` + Bindings []AgentBinding `json:"bindings,omitempty"` + Session SessionConfig `json:"session,omitempty"` + Channels channelsConfigV0 `json:"channels"` + Providers providersConfigV0 `json:"providers,omitempty"` + ModelList []modelConfigV0 `json:"model_list"` + Gateway GatewayConfig `json:"gateway"` + Tools toolsConfigV0 `json:"tools"` + Heartbeat HeartbeatConfig `json:"heartbeat"` + Devices DevicesConfig `json:"devices"` +} + +type toolsConfigV0 struct { + AllowReadPaths []string `json:"allow_read_paths" env:"PICOCLAW_TOOLS_ALLOW_READ_PATHS"` + AllowWritePaths []string `json:"allow_write_paths" env:"PICOCLAW_TOOLS_ALLOW_WRITE_PATHS"` + Web webToolsConfigV0 `json:"web"` + Cron CronToolsConfig `json:"cron"` + Exec ExecConfig `json:"exec"` + Skills skillsToolsConfigV0 `json:"skills"` + MediaCleanup MediaCleanupConfig `json:"media_cleanup"` + MCP MCPConfig `json:"mcp"` + AppendFile ToolConfig `json:"append_file" envPrefix:"PICOCLAW_TOOLS_APPEND_FILE_"` + EditFile ToolConfig `json:"edit_file" envPrefix:"PICOCLAW_TOOLS_EDIT_FILE_"` + FindSkills ToolConfig `json:"find_skills" envPrefix:"PICOCLAW_TOOLS_FIND_SKILLS_"` + I2C ToolConfig `json:"i2c" envPrefix:"PICOCLAW_TOOLS_I2C_"` + InstallSkill ToolConfig `json:"install_skill" envPrefix:"PICOCLAW_TOOLS_INSTALL_SKILL_"` + ListDir ToolConfig `json:"list_dir" envPrefix:"PICOCLAW_TOOLS_LIST_DIR_"` + Message ToolConfig `json:"message" envPrefix:"PICOCLAW_TOOLS_MESSAGE_"` + ReadFile ReadFileToolConfig `json:"read_file" envPrefix:"PICOCLAW_TOOLS_READ_FILE_"` + SendFile ToolConfig `json:"send_file" envPrefix:"PICOCLAW_TOOLS_SEND_FILE_"` + Spawn ToolConfig `json:"spawn" envPrefix:"PICOCLAW_TOOLS_SPAWN_"` + SpawnStatus ToolConfig `json:"spawn_status" envPrefix:"PICOCLAW_TOOLS_SPAWN_STATUS_"` + SPI ToolConfig `json:"spi" envPrefix:"PICOCLAW_TOOLS_SPI_"` + Subagent ToolConfig `json:"subagent" envPrefix:"PICOCLAW_TOOLS_SUBAGENT_"` + WebFetch ToolConfig `json:"web_fetch" envPrefix:"PICOCLAW_TOOLS_WEB_FETCH_"` + WriteFile ToolConfig `json:"write_file" envPrefix:"PICOCLAW_TOOLS_WRITE_FILE_"` +} + +type channelsConfigV0 struct { + WhatsApp WhatsAppConfig `json:"whatsapp"` + Telegram telegramConfigV0 `json:"telegram"` + Feishu feishuConfigV0 `json:"feishu"` + Discord discordConfigV0 `json:"discord"` + MaixCam maixcamConfigV0 `json:"maixcam"` + QQ qqConfigV0 `json:"qq"` + DingTalk dingtalkConfigV0 `json:"dingtalk"` + Slack slackConfigV0 `json:"slack"` + Matrix matrixConfigV0 `json:"matrix"` + LINE lineConfigV0 `json:"line"` + OneBot onebotConfigV0 `json:"onebot"` + WeCom wecomConfigV0 `json:"wecom"` + WeComApp wecomappConfigV0 `json:"wecom_app"` + WeComAIBot wecomaibotConfigV0 `json:"wecom_aibot"` + Pico picoConfigV0 `json:"pico"` + IRC ircConfigV0 `json:"irc"` +} + +func (v *channelsConfigV0) ToChannelsConfig() (ChannelsConfig, ChannelsSecurity) { + telegram, telegramSecurity := v.Telegram.ToTelegramConfig() + feishu, feishuSecurity := v.Feishu.ToFeishuConfig() + discord, discordSecurity := v.Discord.ToDiscordConfig() + maixcam := v.MaixCam.ToMaixCamConfig() + qq, qqSecurity := v.QQ.ToQQConfig() + dingtalk, dingtalkSecurity := v.DingTalk.ToDingTalkConfig() + slack, slackSecurity := v.Slack.ToSlackConfig() + matrix, matrixSecurity := v.Matrix.ToMatrixConfig() + line, lineSecurity := v.LINE.ToLINEConfig() + onebot, onebotSecurity := v.OneBot.ToOneBotConfig() + wecom, wecomSecurity := v.WeCom.ToWeComConfig() + wecomapp, wecomappSecurity := v.WeComApp.ToWeComAppConfig() + wecomaibot, wecomaibotSecurity := v.WeComAIBot.ToWeComAIBotConfig() + pico, picoSecurity := v.Pico.ToPicoConfig() + irc, ircSecurity := v.IRC.ToIRCConfig() + + return ChannelsConfig{ + WhatsApp: v.WhatsApp, + Telegram: telegram, + Feishu: feishu, + Discord: discord, + MaixCam: maixcam, + QQ: qq, + DingTalk: dingtalk, + Slack: slack, + Matrix: matrix, + LINE: line, + OneBot: onebot, + WeCom: wecom, + WeComApp: wecomapp, + WeComAIBot: wecomaibot, + Pico: pico, + IRC: irc, + }, ChannelsSecurity{ + Telegram: &telegramSecurity, + Feishu: &feishuSecurity, + Discord: &discordSecurity, + QQ: &qqSecurity, + DingTalk: &dingtalkSecurity, + Slack: &slackSecurity, + Matrix: &matrixSecurity, + LINE: &lineSecurity, + OneBot: &onebotSecurity, + WeCom: &wecomSecurity, + WeComApp: &wecomappSecurity, + WeComAIBot: &wecomaibotSecurity, + Pico: &picoSecurity, + IRC: &ircSecurity, + } +} + +type qqConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_QQ_ENABLED"` + AppID string `json:"app_id" env:"PICOCLAW_CHANNELS_QQ_APP_ID"` + AppSecret string `json:"app_secret" env:"PICOCLAW_CHANNELS_QQ_APP_SECRET"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_QQ_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + MaxMessageLength int `json:"max_message_length" env:"PICOCLAW_CHANNELS_QQ_MAX_MESSAGE_LENGTH"` + MaxBase64FileSizeMiB int64 `json:"max_base64_file_size_mib" env:"PICOCLAW_CHANNELS_QQ_MAX_BASE64_FILE_SIZE_MIB"` + SendMarkdown bool `json:"send_markdown" env:"PICOCLAW_CHANNELS_QQ_SEND_MARKDOWN"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_QQ_REASONING_CHANNEL_ID"` +} + +func (v *qqConfigV0) ToQQConfig() (QQConfig, QQSecurity) { + return QQConfig{ + Enabled: v.Enabled, + AppID: v.AppID, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + MaxMessageLength: v.MaxMessageLength, + MaxBase64FileSizeMiB: v.MaxBase64FileSizeMiB, + SendMarkdown: v.SendMarkdown, + ReasoningChannelID: v.ReasoningChannelID, + }, QQSecurity{ + AppSecret: v.AppSecret, + } +} + +type telegramConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_TELEGRAM_ENABLED"` + Token string `json:"token" env:"PICOCLAW_CHANNELS_TELEGRAM_TOKEN"` + BaseURL string `json:"base_url" env:"PICOCLAW_CHANNELS_TELEGRAM_BASE_URL"` + Proxy string `json:"proxy" env:"PICOCLAW_CHANNELS_TELEGRAM_PROXY"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_TELEGRAM_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + Typing TypingConfig `json:"typing,omitempty"` + Placeholder PlaceholderConfig `json:"placeholder,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_TELEGRAM_REASONING_CHANNEL_ID"` + UseMarkdownV2 bool `json:"use_markdown_v2" env:"PICOCLAW_CHANNELS_TELEGRAM_USE_MARKDOWN_V2"` +} + +func (v *telegramConfigV0) ToTelegramConfig() (TelegramConfig, TelegramSecurity) { + return TelegramConfig{ + Enabled: v.Enabled, + token: v.Token, + BaseURL: v.BaseURL, + Proxy: v.Proxy, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + Typing: v.Typing, + Placeholder: v.Placeholder, + ReasoningChannelID: v.ReasoningChannelID, + UseMarkdownV2: v.UseMarkdownV2, + }, TelegramSecurity{ + Token: v.Token, + } +} + +type feishuConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_FEISHU_ENABLED"` + AppID string `json:"app_id" env:"PICOCLAW_CHANNELS_FEISHU_APP_ID"` + AppSecret string `json:"app_secret" env:"PICOCLAW_CHANNELS_FEISHU_APP_SECRET"` + EncryptKey string `json:"encrypt_key" env:"PICOCLAW_CHANNELS_FEISHU_ENCRYPT_KEY"` + VerificationToken string `json:"verification_token" env:"PICOCLAW_CHANNELS_FEISHU_VERIFICATION_TOKEN"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_FEISHU_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + Placeholder PlaceholderConfig `json:"placeholder,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_FEISHU_REASONING_CHANNEL_ID"` + RandomReactionEmoji FlexibleStringSlice `json:"random_reaction_emoji" env:"PICOCLAW_CHANNELS_FEISHU_RANDOM_REACTION_EMOJI"` + IsLark bool `json:"is_lark" env:"PICOCLAW_CHANNELS_FEISHU_IS_LARK"` +} + +func (v *feishuConfigV0) ToFeishuConfig() (FeishuConfig, FeishuSecurity) { + return FeishuConfig{ + Enabled: v.Enabled, + AppID: v.AppID, + appSecret: v.AppSecret, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + Placeholder: v.Placeholder, + ReasoningChannelID: v.ReasoningChannelID, + }, FeishuSecurity{ + AppSecret: v.AppSecret, + EncryptKey: v.EncryptKey, + VerificationToken: v.VerificationToken, + } +} + +type discordConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_DISCORD_ENABLED"` + Token string `json:"token" env:"PICOCLAW_CHANNELS_DISCORD_TOKEN"` + Proxy string `json:"proxy" env:"PICOCLAW_CHANNELS_DISCORD_PROXY"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_DISCORD_ALLOW_FROM"` + MentionOnly bool `json:"mention_only" env:"PICOCLAW_CHANNELS_DISCORD_MENTION_ONLY"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + Typing TypingConfig `json:"typing,omitempty"` + Placeholder PlaceholderConfig `json:"placeholder,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_DISCORD_REASONING_CHANNEL_ID"` +} + +func (v *discordConfigV0) ToDiscordConfig() (DiscordConfig, DiscordSecurity) { + return DiscordConfig{ + Enabled: v.Enabled, + token: v.Token, + Proxy: v.Proxy, + AllowFrom: v.AllowFrom, + MentionOnly: v.MentionOnly, + GroupTrigger: v.GroupTrigger, + Typing: v.Typing, + Placeholder: v.Placeholder, + ReasoningChannelID: v.ReasoningChannelID, + }, DiscordSecurity{ + Token: v.Token, + } +} + +type maixcamConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_MAIXCAM_ENABLED"` + Host string `json:"host" env:"PICOCLAW_CHANNELS_MAIXCAM_HOST"` + Port int `json:"port" env:"PICOCLAW_CHANNELS_MAIXCAM_PORT"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_MAIXCAM_ALLOW_FROM"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_MAIXCAM_REASONING_CHANNEL_ID"` +} + +func (v *maixcamConfigV0) ToMaixCamConfig() MaixCamConfig { + return MaixCamConfig{ + Enabled: v.Enabled, + Host: v.Host, + Port: v.Port, + AllowFrom: v.AllowFrom, + ReasoningChannelID: v.ReasoningChannelID, + } +} + +type dingtalkConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_DINGTALK_ENABLED"` + ClientID string `json:"client_id" env:"PICOCLAW_CHANNELS_DINGTALK_CLIENT_ID"` + ClientSecret string `json:"client_secret" env:"PICOCLAW_CHANNELS_DINGTALK_CLIENT_SECRET"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_DINGTALK_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_DINGTALK_REASONING_CHANNEL_ID"` +} + +func (v *dingtalkConfigV0) ToDingTalkConfig() (DingTalkConfig, DingTalkSecurity) { + return DingTalkConfig{ + Enabled: v.Enabled, + ClientID: v.ClientID, + clientSecret: v.ClientSecret, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + ReasoningChannelID: v.ReasoningChannelID, + }, DingTalkSecurity{ + ClientSecret: v.ClientSecret, + } +} + +type slackConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_SLACK_ENABLED"` + BotToken string `json:"bot_token" env:"PICOCLAW_CHANNELS_SLACK_BOT_TOKEN"` + AppToken string `json:"app_token" env:"PICOCLAW_CHANNELS_SLACK_APP_TOKEN"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_SLACK_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + Typing TypingConfig `json:"typing,omitempty"` + Placeholder PlaceholderConfig `json:"placeholder,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_SLACK_REASONING_CHANNEL_ID"` +} + +func (v *slackConfigV0) ToSlackConfig() (SlackConfig, SlackSecurity) { + return SlackConfig{ + Enabled: v.Enabled, + botToken: v.BotToken, + appToken: v.AppToken, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + Typing: v.Typing, + Placeholder: v.Placeholder, + ReasoningChannelID: v.ReasoningChannelID, + }, SlackSecurity{ + BotToken: v.BotToken, + AppToken: v.AppToken, + } +} + +type matrixConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_MATRIX_ENABLED"` + Homeserver string `json:"homeserver" env:"PICOCLAW_CHANNELS_MATRIX_HOMESERVER"` + UserID string `json:"user_id" env:"PICOCLAW_CHANNELS_MATRIX_USER_ID"` + AccessToken string `json:"access_token" env:"PICOCLAW_CHANNELS_MATRIX_ACCESS_TOKEN"` + DeviceID string `json:"device_id,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_DEVICE_ID"` + JoinOnInvite bool `json:"join_on_invite" env:"PICOCLAW_CHANNELS_MATRIX_JOIN_ON_INVITE"` + MessageFormat string `json:"message_format,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_MESSAGE_FORMAT"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_MATRIX_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + Placeholder PlaceholderConfig `json:"placeholder,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_MATRIX_REASONING_CHANNEL_ID"` +} + +func (v *matrixConfigV0) ToMatrixConfig() (MatrixConfig, MatrixSecurity) { + return MatrixConfig{ + Enabled: v.Enabled, + Homeserver: v.Homeserver, + UserID: v.UserID, + accessToken: v.AccessToken, + DeviceID: v.DeviceID, + JoinOnInvite: v.JoinOnInvite, + MessageFormat: v.MessageFormat, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + Placeholder: v.Placeholder, + ReasoningChannelID: v.ReasoningChannelID, + }, MatrixSecurity{ + AccessToken: v.AccessToken, + } +} + +type lineConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_LINE_ENABLED"` + ChannelSecret string `json:"channel_secret" env:"PICOCLAW_CHANNELS_LINE_CHANNEL_SECRET"` + ChannelAccessToken string `json:"channel_access_token" env:"PICOCLAW_CHANNELS_LINE_CHANNEL_ACCESS_TOKEN"` + WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_LINE_WEBHOOK_HOST"` + WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_LINE_WEBHOOK_PORT"` + WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_LINE_WEBHOOK_PATH"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_LINE_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + Typing TypingConfig `json:"typing,omitempty"` + Placeholder PlaceholderConfig `json:"placeholder,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_LINE_REASONING_CHANNEL_ID"` +} + +func (v *lineConfigV0) ToLINEConfig() (LINEConfig, LINESecurity) { + return LINEConfig{ + Enabled: v.Enabled, + channelSecret: v.ChannelSecret, + channelAccessToken: v.ChannelAccessToken, + WebhookHost: v.WebhookHost, + WebhookPort: v.WebhookPort, + WebhookPath: v.WebhookPath, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + Typing: v.Typing, + Placeholder: v.Placeholder, + ReasoningChannelID: v.ReasoningChannelID, + }, LINESecurity{ + ChannelSecret: v.ChannelSecret, + ChannelAccessToken: v.ChannelAccessToken, + } +} + +type onebotConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_ONEBOT_ENABLED"` + WSUrl string `json:"ws_url" env:"PICOCLAW_CHANNELS_ONEBOT_WS_URL"` + AccessToken string `json:"access_token" env:"PICOCLAW_CHANNELS_ONEBOT_ACCESS_TOKEN"` + ReconnectInterval int `json:"reconnect_interval" env:"PICOCLAW_CHANNELS_ONEBOT_RECONNECT_INTERVAL"` + GroupTriggerPrefix []string `json:"group_trigger_prefix" env:"PICOCLAW_CHANNELS_ONEBOT_GROUP_TRIGGER_PREFIX"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_ONEBOT_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + Typing TypingConfig `json:"typing,omitempty"` + Placeholder PlaceholderConfig `json:"placeholder,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_ONEBOT_REASONING_CHANNEL_ID"` +} + +func (v *onebotConfigV0) ToOneBotConfig() (OneBotConfig, OneBotSecurity) { + return OneBotConfig{ + Enabled: v.Enabled, + WSUrl: v.WSUrl, + accessToken: v.AccessToken, + ReconnectInterval: v.ReconnectInterval, + GroupTriggerPrefix: v.GroupTriggerPrefix, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + Typing: v.Typing, + Placeholder: v.Placeholder, + ReasoningChannelID: v.ReasoningChannelID, + }, OneBotSecurity{ + AccessToken: v.AccessToken, + } +} + +type wecomConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_ENABLED"` + Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_TOKEN"` + EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_ENCODING_AES_KEY"` + WebhookURL string `json:"webhook_url" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_URL"` + WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_HOST"` + WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_PORT"` + WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_PATH"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_ALLOW_FROM"` + ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_REPLY_TIMEOUT"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_REASONING_CHANNEL_ID"` +} + +func (v *wecomConfigV0) ToWeComConfig() (WeComConfig, WeComSecurity) { + return WeComConfig{ + Enabled: v.Enabled, + token: v.Token, + encodingAESKey: v.EncodingAESKey, + WebhookURL: v.WebhookURL, + WebhookHost: v.WebhookHost, + WebhookPort: v.WebhookPort, + WebhookPath: v.WebhookPath, + AllowFrom: v.AllowFrom, + ReplyTimeout: v.ReplyTimeout, + GroupTrigger: v.GroupTrigger, + ReasoningChannelID: v.ReasoningChannelID, + }, WeComSecurity{ + Token: v.Token, + EncodingAESKey: v.EncodingAESKey, + } +} + +type wecomappConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_APP_ENABLED"` + CorpID string `json:"corp_id" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_ID"` + CorpSecret string `json:"corp_secret" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_SECRET"` + AgentID int64 `json:"agent_id" env:"PICOCLAW_CHANNELS_WECOM_APP_AGENT_ID"` + Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_APP_TOKEN"` + EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_APP_ENCODING_AES_KEY"` + WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_HOST"` + WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_PORT"` + WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_PATH"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_APP_ALLOW_FROM"` + ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_APP_REPLY_TIMEOUT"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_APP_REASONING_CHANNEL_ID"` +} + +func (v *wecomappConfigV0) ToWeComAppConfig() (WeComAppConfig, WeComAppSecurity) { + return WeComAppConfig{ + Enabled: v.Enabled, + CorpID: v.CorpID, + corpSecret: v.CorpSecret, + AgentID: v.AgentID, + token: v.Token, + encodingAESKey: v.EncodingAESKey, + WebhookHost: v.WebhookHost, + WebhookPort: v.WebhookPort, + WebhookPath: v.WebhookPath, + AllowFrom: v.AllowFrom, + ReplyTimeout: v.ReplyTimeout, + GroupTrigger: v.GroupTrigger, + ReasoningChannelID: v.ReasoningChannelID, + }, WeComAppSecurity{ + CorpSecret: v.CorpSecret, + Token: v.Token, + EncodingAESKey: v.EncodingAESKey, + } +} + +type wecomaibotConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENABLED"` + Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_TOKEN"` + EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENCODING_AES_KEY"` + WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_WEBHOOK_PATH"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ALLOW_FROM"` + ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REPLY_TIMEOUT"` + MaxSteps int `json:"max_steps" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_MAX_STEPS"` + WelcomeMessage string `json:"welcome_message" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_WELCOME_MESSAGE"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REASONING_CHANNEL_ID"` +} + +func (v *wecomaibotConfigV0) ToWeComAIBotConfig() (WeComAIBotConfig, WeComAIBotSecurity) { + return WeComAIBotConfig{ + Enabled: v.Enabled, + token: v.Token, + encodingAESKey: v.EncodingAESKey, + WebhookPath: v.WebhookPath, + AllowFrom: v.AllowFrom, + ReplyTimeout: v.ReplyTimeout, + MaxSteps: v.MaxSteps, + WelcomeMessage: v.WelcomeMessage, + ReasoningChannelID: v.ReasoningChannelID, + }, WeComAIBotSecurity{ + Token: v.Token, + EncodingAESKey: v.EncodingAESKey, + } +} + +type picoConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_PICO_ENABLED"` + Token string `json:"token" env:"PICOCLAW_CHANNELS_PICO_TOKEN"` + AllowTokenQuery bool `json:"allow_token_query,omitempty"` + AllowOrigins []string `json:"allow_origins,omitempty"` + PingInterval int `json:"ping_interval,omitempty"` + ReadTimeout int `json:"read_timeout,omitempty"` + WriteTimeout int `json:"write_timeout,omitempty"` + MaxConnections int `json:"max_connections,omitempty"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_PICO_ALLOW_FROM"` + Placeholder PlaceholderConfig `json:"placeholder,omitempty"` +} + +func (v *picoConfigV0) ToPicoConfig() (PicoConfig, PicoSecurity) { + return PicoConfig{ + Enabled: v.Enabled, + token: v.Token, + AllowTokenQuery: v.AllowTokenQuery, + AllowOrigins: v.AllowOrigins, + PingInterval: v.PingInterval, + ReadTimeout: v.ReadTimeout, + WriteTimeout: v.WriteTimeout, + MaxConnections: v.MaxConnections, + AllowFrom: v.AllowFrom, + Placeholder: v.Placeholder, + }, PicoSecurity{ + Token: v.Token, + } +} + +type ircConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_IRC_ENABLED"` + Server string `json:"server" env:"PICOCLAW_CHANNELS_IRC_SERVER"` + TLS bool `json:"tls" env:"PICOCLAW_CHANNELS_IRC_TLS"` + Nick string `json:"nick" env:"PICOCLAW_CHANNELS_IRC_NICK"` + User string `json:"user,omitempty" env:"PICOCLAW_CHANNELS_IRC_USER"` + RealName string `json:"real_name,omitempty" env:"PICOCLAW_CHANNELS_IRC_REAL_NAME"` + Password string `json:"password" env:"PICOCLAW_CHANNELS_IRC_PASSWORD"` + NickServPassword string `json:"nickserv_password" env:"PICOCLAW_CHANNELS_IRC_NICKSERV_PASSWORD"` + SASLUser string `json:"sasl_user" env:"PICOCLAW_CHANNELS_IRC_SASL_USER"` + SASLPassword string `json:"sasl_password" env:"PICOCLAW_CHANNELS_IRC_SASL_PASSWORD"` + Channels FlexibleStringSlice `json:"channels" env:"PICOCLAW_CHANNELS_IRC_CHANNELS"` + RequestCaps FlexibleStringSlice `json:"request_caps,omitempty" env:"PICOCLAW_CHANNELS_IRC_REQUEST_CAPS"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_IRC_ALLOW_FROM"` + GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` + Typing TypingConfig `json:"typing,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_IRC_REASONING_CHANNEL_ID"` +} + +func (v *ircConfigV0) ToIRCConfig() (IRCConfig, IRCSecurity) { + return IRCConfig{ + Enabled: v.Enabled, + Server: v.Server, + TLS: v.TLS, + Nick: v.Nick, + User: v.User, + RealName: v.RealName, + password: v.Password, + nickServPassword: v.NickServPassword, + SASLUser: v.SASLUser, + saslPassword: v.SASLPassword, + Channels: v.Channels, + RequestCaps: v.RequestCaps, + AllowFrom: v.AllowFrom, + GroupTrigger: v.GroupTrigger, + Typing: v.Typing, + ReasoningChannelID: v.ReasoningChannelID, + }, IRCSecurity{ + Password: v.Password, + NickServPassword: v.NickServPassword, + SASLPassword: v.SASLPassword, + } +} + +type providersConfigV0 struct { + Anthropic providerConfigV0 `json:"anthropic"` + OpenAI openAIProviderConfigV0 `json:"openai"` + LiteLLM providerConfigV0 `json:"litellm"` + OpenRouter providerConfigV0 `json:"openrouter"` + Groq providerConfigV0 `json:"groq"` + Zhipu providerConfigV0 `json:"zhipu"` + VLLM providerConfigV0 `json:"vllm"` + Gemini providerConfigV0 `json:"gemini"` + Nvidia providerConfigV0 `json:"nvidia"` + Ollama providerConfigV0 `json:"ollama"` + Moonshot providerConfigV0 `json:"moonshot"` + ShengSuanYun providerConfigV0 `json:"shengsuanyun"` + DeepSeek providerConfigV0 `json:"deepseek"` + Cerebras providerConfigV0 `json:"cerebras"` + Vivgrid providerConfigV0 `json:"vivgrid"` + VolcEngine providerConfigV0 `json:"volcengine"` + GitHubCopilot providerConfigV0 `json:"github_copilot"` + Antigravity providerConfigV0 `json:"antigravity"` + Qwen providerConfigV0 `json:"qwen"` + Mistral providerConfigV0 `json:"mistral"` + Avian providerConfigV0 `json:"avian"` + Minimax providerConfigV0 `json:"minimax"` + LongCat providerConfigV0 `json:"longcat"` + ModelScope providerConfigV0 `json:"modelscope"` + Novita providerConfigV0 `json:"novita"` +} + +// IsEmpty checks if all provider configs are empty (no API keys or API bases set) +// Note: WebSearch is an optimization option and doesn't count as "non-empty" +func (p providersConfigV0) IsEmpty() bool { + return p.Anthropic.APIKey == "" && p.Anthropic.APIBase == "" && + p.OpenAI.APIKey == "" && p.OpenAI.APIBase == "" && + p.LiteLLM.APIKey == "" && p.LiteLLM.APIBase == "" && + p.OpenRouter.APIKey == "" && p.OpenRouter.APIBase == "" && + p.Groq.APIKey == "" && p.Groq.APIBase == "" && + p.Zhipu.APIKey == "" && p.Zhipu.APIBase == "" && + p.VLLM.APIKey == "" && p.VLLM.APIBase == "" && + p.Gemini.APIKey == "" && p.Gemini.APIBase == "" && + p.Nvidia.APIKey == "" && p.Nvidia.APIBase == "" && + p.Ollama.APIKey == "" && p.Ollama.APIBase == "" && + p.Moonshot.APIKey == "" && p.Moonshot.APIBase == "" && + p.ShengSuanYun.APIKey == "" && p.ShengSuanYun.APIBase == "" && + p.DeepSeek.APIKey == "" && p.DeepSeek.APIBase == "" && + p.Cerebras.APIKey == "" && p.Cerebras.APIBase == "" && + p.Vivgrid.APIKey == "" && p.Vivgrid.APIBase == "" && + p.VolcEngine.APIKey == "" && p.VolcEngine.APIBase == "" && + p.GitHubCopilot.APIKey == "" && p.GitHubCopilot.APIBase == "" && + p.Antigravity.APIKey == "" && p.Antigravity.APIBase == "" && + p.Qwen.APIKey == "" && p.Qwen.APIBase == "" && + p.Mistral.APIKey == "" && p.Mistral.APIBase == "" && + p.Avian.APIKey == "" && p.Avian.APIBase == "" && + p.Minimax.APIKey == "" && p.Minimax.APIBase == "" && + p.LongCat.APIKey == "" && p.LongCat.APIBase == "" && + p.ModelScope.APIKey == "" && p.ModelScope.APIBase == "" && + p.Novita.APIKey == "" && p.Novita.APIBase == "" +} + +type providerConfigV0 struct { + APIKey string `json:"api_key" env:"PICOCLAW_PROVIDERS_{{.Name}}_API_KEY"` + APIBase string `json:"api_base" env:"PICOCLAW_PROVIDERS_{{.Name}}_API_BASE"` + Proxy string `json:"proxy,omitempty" env:"PICOCLAW_PROVIDERS_{{.Name}}_PROXY"` + RequestTimeout int `json:"request_timeout,omitempty" env:"PICOCLAW_PROVIDERS_{{.Name}}_REQUEST_TIMEOUT"` + AuthMethod string `json:"auth_method,omitempty" env:"PICOCLAW_PROVIDERS_{{.Name}}_AUTH_METHOD"` + ConnectMode string `json:"connect_mode,omitempty" env:"PICOCLAW_PROVIDERS_{{.Name}}_CONNECT_MODE"` // only for Github Copilot, `stdio` or `grpc` +} + +// MarshalJSON implements custom JSON marshaling for providersConfig +// to omit the entire section when empty +func (p providersConfigV0) MarshalJSON() ([]byte, error) { + if p.IsEmpty() { + return []byte("null"), nil + } + type Alias providersConfigV0 + return json.Marshal((*Alias)(&p)) +} + +type openAIProviderConfigV0 struct { + providerConfigV0 + WebSearch bool `json:"web_search" env:"PICOCLAW_PROVIDERS_OPENAI_WEB_SEARCH"` +} + +type modelConfigV0 struct { + // Required fields + ModelName string `json:"model_name"` // User-facing alias for the model + Model string `json:"model"` // Protocol/model-identifier (e.g., "openai/gpt-4o", "anthropic/claude-sonnet-4.6") + + // HTTP-based providers + APIBase string `json:"api_base,omitempty"` // API endpoint URL + APIKey string `json:"api_key"` // API authentication key (single key) + APIKeys []string `json:"api_keys,omitempty"` // API authentication keys (multiple keys for failover) + Proxy string `json:"proxy,omitempty"` // HTTP proxy URL + Fallbacks []string `json:"fallbacks,omitempty"` // Fallback model names for failover + + // Special providers (CLI-based, OAuth, etc.) + AuthMethod string `json:"auth_method,omitempty"` // Authentication method: oauth, token + ConnectMode string `json:"connect_mode,omitempty"` // Connection mode: stdio, grpc + Workspace string `json:"workspace,omitempty"` // Workspace path for CLI-based providers + + // Optional optimizations + RPM int `json:"rpm,omitempty"` // Requests per minute limit + MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") + RequestTimeout int `json:"request_timeout,omitempty"` + ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive } func (c *configV0) migrateChannelConfigs() { @@ -92,17 +748,257 @@ func (c *configV0) Migrate() (*Config, error) { // Copy other top-level fields cfg.Bindings = c.Bindings cfg.Session = c.Session - cfg.Channels = c.Channels + var secChannels ChannelsSecurity + cfg.Channels, secChannels = c.Channels.ToChannelsConfig() cfg.Gateway = c.Gateway - cfg.Tools = c.Tools + var secWeb WebToolsSecurity + cfg.Tools.Web, secWeb = c.Tools.Web.ToWebToolsConfig() + cfg.Tools.Cron = c.Tools.Cron + cfg.Tools.Exec = c.Tools.Exec + var secSkills SkillsSecurity + cfg.Tools.Skills, secSkills = c.Tools.Skills.ToSkillsToolsConfig() + cfg.Tools.MediaCleanup = c.Tools.MediaCleanup + cfg.Tools.MCP = c.Tools.MCP + cfg.Tools.AppendFile = c.Tools.AppendFile + cfg.Tools.EditFile = c.Tools.EditFile + cfg.Tools.FindSkills = c.Tools.FindSkills + cfg.Tools.I2C = c.Tools.I2C + cfg.Tools.InstallSkill = c.Tools.InstallSkill + cfg.Tools.ListDir = c.Tools.ListDir + cfg.Tools.Message = c.Tools.Message + cfg.Tools.ReadFile = c.Tools.ReadFile + cfg.Tools.SendFile = c.Tools.SendFile + cfg.Tools.Spawn = c.Tools.Spawn + cfg.Tools.SpawnStatus = c.Tools.SpawnStatus + cfg.Tools.SPI = c.Tools.SPI + cfg.Tools.Subagent = c.Tools.Subagent + cfg.Tools.WebFetch = c.Tools.WebFetch + cfg.Tools.AllowReadPaths = c.Tools.AllowReadPaths + cfg.Tools.AllowWritePaths = c.Tools.AllowWritePaths cfg.Heartbeat = c.Heartbeat cfg.Devices = c.Devices + secModels := make(map[string]ModelSecurityEntry, 0) // Only override ModelList if user provided values if len(c.ModelList) > 0 { - cfg.ModelList = c.ModelList + // Convert []modelConfigV0 to []ModelConfig + cfg.ModelList = make([]*ModelConfig, len(c.ModelList)) + for i, m := range c.ModelList { + // Merge APIKey and APIKeys, deduplicating + mergedKeys := MergeAPIKeys(m.APIKey, m.APIKeys) + + cfg.ModelList[i] = &ModelConfig{ + ModelName: m.ModelName, + Model: m.Model, + APIBase: m.APIBase, + Proxy: m.Proxy, + Fallbacks: m.Fallbacks, + AuthMethod: m.AuthMethod, + ConnectMode: m.ConnectMode, + Workspace: m.Workspace, + RPM: m.RPM, + MaxTokensField: m.MaxTokensField, + RequestTimeout: m.RequestTimeout, + ThinkingLevel: m.ThinkingLevel, + apiKeys: mergedKeys, + } + } + names := toNameIndex(cfg.ModelList) + for i, m := range c.ModelList { + // Merge APIKey and APIKeys, deduplicating + mergedKeys := MergeAPIKeys(m.APIKey, m.APIKeys) + secModels[names[i]] = ModelSecurityEntry{ + APIKeys: mergedKeys, + } + } } + cfg.WithSecurity(&SecurityConfig{ + ModelList: secModels, + Channels: secChannels, + Web: secWeb, + Skills: secSkills, + }) cfg.Version = CurrentVersion return cfg, nil } + +type webToolsConfigV0 struct { + ToolConfig ` envPrefix:"PICOCLAW_TOOLS_WEB_"` + Brave braveConfigV0 ` json:"brave"` + Tavily tavilyConfigV0 ` json:"tavily"` + DuckDuckGo DuckDuckGoConfig ` json:"duckduckgo"` + Perplexity perplexityConfigV0 ` json:"perplexity"` + SearXNG SearXNGConfig ` json:"searxng"` + GLMSearch glmSearchConfigV0 ` json:"glm_search"` + PreferNative bool ` json:"prefer_native" env:"PICOCLAW_TOOLS_WEB_PREFER_NATIVE"` + Proxy string ` json:"proxy,omitempty" env:"PICOCLAW_TOOLS_WEB_PROXY"` + FetchLimitBytes int64 ` json:"fetch_limit_bytes,omitempty" env:"PICOCLAW_TOOLS_WEB_FETCH_LIMIT_BYTES"` + Format string ` json:"format,omitempty" env:"PICOCLAW_TOOLS_WEB_FORMAT"` + PrivateHostWhitelist FlexibleStringSlice ` json:"private_host_whitelist,omitempty" env:"PICOCLAW_TOOLS_WEB_PRIVATE_HOST_WHITELIST"` +} + +type braveConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_BRAVE_ENABLED"` + APIKey string `json:"api_key" env:"PICOCLAW_TOOLS_WEB_BRAVE_API_KEY"` + APIKeys []string `json:"api_keys" env:"PICOCLAW_TOOLS_WEB_BRAVE_API_KEYS"` + MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_BRAVE_MAX_RESULTS"` +} + +func (v *braveConfigV0) ToBraveConfig() (BraveConfig, BraveSecurity) { + return BraveConfig{ + Enabled: v.Enabled, + MaxResults: v.MaxResults, + }, BraveSecurity{ + APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys), + } +} + +type tavilyConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_TAVILY_ENABLED"` + APIKey string `json:"api_key" env:"PICOCLAW_TOOLS_WEB_TAVILY_API_KEY"` + APIKeys []string `json:"api_keys" env:"PICOCLAW_TOOLS_WEB_TAVILY_API_KEYS"` + BaseURL string `json:"base_url" env:"PICOCLAW_TOOLS_WEB_TAVILY_BASE_URL"` + MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_TAVILY_MAX_RESULTS"` +} + +func (v *tavilyConfigV0) ToTavilyConfig() (TavilyConfig, TavilySecurity) { + return TavilyConfig{ + Enabled: v.Enabled, + BaseURL: v.BaseURL, + MaxResults: v.MaxResults, + }, TavilySecurity{ + APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys), + } +} + +type perplexityConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_ENABLED"` + APIKey string `json:"api_key" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_API_KEY"` + APIKeys []string `json:"api_keys" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_API_KEYS"` + MaxResults int `json:"max_results" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_MAX_RESULTS"` +} + +func (v *perplexityConfigV0) ToPerplexityConfig() (PerplexityConfig, PerplexitySecurity) { + return PerplexityConfig{ + Enabled: v.Enabled, + MaxResults: v.MaxResults, + }, PerplexitySecurity{ + APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys), + } +} + +type glmSearchConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_TOOLS_WEB_GLM_ENABLED"` + APIKey string `json:"api_key" env:"PICOCLAW_TOOLS_WEB_GLM_API_KEY"` + BaseURL string `json:"base_url" env:"PICOCLAW_TOOLS_WEB_GLM_BASE_URL"` + SearchEngine string `json:"search_engine" env:"PICOCLAW_TOOLS_WEB_GLM_SEARCH_ENGINE"` +} + +func (v *glmSearchConfigV0) ToGLMSearchConfig() (GLMSearchConfig, GLMSearchSecurity) { + return GLMSearchConfig{ + Enabled: v.Enabled, + apiKey: v.APIKey, + BaseURL: v.BaseURL, + SearchEngine: v.SearchEngine, + }, GLMSearchSecurity{ + APIKey: v.APIKey, + } +} + +func (v *webToolsConfigV0) ToWebToolsConfig() (WebToolsConfig, WebToolsSecurity) { + brave, braveSecurity := v.Brave.ToBraveConfig() + tavily, tavilySecurity := v.Tavily.ToTavilyConfig() + perplexity, perplexitySecurity := v.Perplexity.ToPerplexityConfig() + glmSearch, glmSearchSecurity := v.GLMSearch.ToGLMSearchConfig() + + return WebToolsConfig{ + ToolConfig: v.ToolConfig, + Brave: brave, + Tavily: tavily, + DuckDuckGo: v.DuckDuckGo, + Perplexity: perplexity, + SearXNG: v.SearXNG, + GLMSearch: glmSearch, + PreferNative: v.PreferNative, + Proxy: v.Proxy, + FetchLimitBytes: v.FetchLimitBytes, + Format: v.Format, + PrivateHostWhitelist: v.PrivateHostWhitelist, + }, WebToolsSecurity{ + Brave: &braveSecurity, + Tavily: &tavilySecurity, + Perplexity: &perplexitySecurity, + GLMSearch: &glmSearchSecurity, + } +} + +type skillsToolsConfigV0 struct { + ToolConfig ` envPrefix:"PICOCLAW_TOOLS_SKILLS_"` + Registries skillsRegistriesConfigV0 ` json:"registries"` + Github skillsGithubConfigV0 ` json:"github"` + MaxConcurrentSearches int ` json:"max_concurrent_searches" env:"PICOCLAW_TOOLS_SKILLS_MAX_CONCURRENT_SEARCHES"` + SearchCache SearchCacheConfig ` json:"search_cache"` +} + +type skillsRegistriesConfigV0 struct { + ClawHub clawHubRegistryConfigV0 `json:"clawhub"` +} + +type clawHubRegistryConfigV0 struct { + Enabled bool `json:"enabled" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_ENABLED"` + BaseURL string `json:"base_url" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_BASE_URL"` + AuthToken string `json:"auth_token" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_AUTH_TOKEN"` + SearchPath string `json:"search_path" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_SEARCH_PATH"` + SkillsPath string `json:"skills_path" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_SKILLS_PATH"` +} + +func (v *clawHubRegistryConfigV0) ToClawHubRegistryConfig() (ClawHubRegistryConfig, ClawHubSecurity) { + return ClawHubRegistryConfig{ + Enabled: v.Enabled, + BaseURL: v.BaseURL, + authToken: v.AuthToken, + SearchPath: v.SearchPath, + SkillsPath: v.SkillsPath, + }, ClawHubSecurity{ + AuthToken: v.AuthToken, + } +} + +type skillsGithubConfigV0 struct { + Token string `json:"token" env:"PICOCLAW_TOOLS_SKILLS_GITHUB_TOKEN"` + Proxy string `json:"proxy,omitempty" env:"PICOCLAW_TOOLS_SKILLS_GITHUB_PROXY"` +} + +func (v *skillsGithubConfigV0) ToSkillsGithubConfig() (SkillsGithubConfig, GithubSecurity) { + return SkillsGithubConfig{ + token: v.Token, + Proxy: v.Proxy, + }, GithubSecurity{ + Token: v.Token, + } +} + +func (v *skillsRegistriesConfigV0) ToSkillsRegistriesConfig() (SkillsRegistriesConfig, *ClawHubSecurity) { + clawHub, clawHubSecurity := v.ClawHub.ToClawHubRegistryConfig() + + return SkillsRegistriesConfig{ + ClawHub: clawHub, + }, &clawHubSecurity +} + +func (v *skillsToolsConfigV0) ToSkillsToolsConfig() (SkillsToolsConfig, SkillsSecurity) { + registries, registriesSecurity := v.Registries.ToSkillsRegistriesConfig() + github, githubSecurity := v.Github.ToSkillsGithubConfig() + + return SkillsToolsConfig{ + ToolConfig: v.ToolConfig, + Registries: registries, + Github: github, + MaxConcurrentSearches: v.MaxConcurrentSearches, + SearchCache: v.SearchCache, + }, SkillsSecurity{ + Github: &githubSecurity, + ClawHub: registriesSecurity, + } +} diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index ed6440c7a..5b7c1370b 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -8,6 +8,9 @@ import ( "strings" "testing" + "github.com/stretchr/testify/assert" + "gopkg.in/yaml.v3" + "github.com/sipeed/picoclaw/pkg/credential" ) @@ -78,18 +81,19 @@ func TestAgentModelConfig_MarshalObject(t *testing.T) { } func TestProvidersConfig_IsEmpty(t *testing.T) { - var empty ProvidersConfig + var empty providersConfigV0 + t.Logf("empty: %+v", empty) if !empty.IsEmpty() { - t.Fatal("empty ProvidersConfig should report empty") + t.Fatal("empty providersConfig should report empty") } - novita := ProvidersConfig{ - Novita: ProviderConfig{ + novita := providersConfigV0{ + Novita: providerConfigV0{ APIKey: "test-key", }, } if novita.IsEmpty() { - t.Fatal("ProvidersConfig with novita settings should not report empty") + t.Fatal("providersConfig with novita settings should not report empty") } } @@ -305,7 +309,7 @@ func TestDefaultConfig_WebTools(t *testing.T) { if cfg.Tools.Web.Brave.MaxResults != 5 { t.Error("Expected Brave MaxResults 5, got ", cfg.Tools.Web.Brave.MaxResults) } - if len(cfg.Tools.Web.Brave.APIKeys) != 0 { + if len(cfg.Tools.Web.Brave.APIKeys()) != 0 { t.Error("Brave API key should be empty by default") } if cfg.Tools.Web.DuckDuckGo.MaxResults != 5 { @@ -671,7 +675,20 @@ func TestFlexibleStringSlice_UnmarshalText_EmptySliceConsistency(t *testing.T) { func TestLoadConfig_WarnsForPlaintextAPIKey(t *testing.T) { dir := t.TempDir() cfgPath := filepath.Join(dir, "config.json") - const original = `{"model_list":[{"model_name":"test","model":"openai/gpt-4","api_key":"sk-plaintext"}]}` + const original = `{"version":1,"model_list":[{"model_name":"test","model":"openai/gpt-4","api_key":"sk-plaintext"}]}` + if err := os.WriteFile(cfgPath, []byte(original), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + secPath := filepath.Join(dir, SecurityConfigFile) + const securityConfig = ` +model_list: + test:0: + api_keys: + - "sk-plaintext" +` + if err := os.WriteFile(secPath, []byte(securityConfig), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } if err := os.WriteFile(cfgPath, []byte(original), 0o600); err != nil { t.Fatalf("setup: %v", err) } @@ -684,10 +701,10 @@ func TestLoadConfig_WarnsForPlaintextAPIKey(t *testing.T) { t.Fatalf("LoadConfig: %v", err) } // In-memory value must be the resolved plaintext. - if cfg.ModelList[0].APIKey != "sk-plaintext" { - t.Errorf("in-memory api_key = %q, want %q", cfg.ModelList[0].APIKey, "sk-plaintext") + if cfg.ModelList[0].APIKey() != "sk-plaintext" { + t.Errorf("in-memory api_key = %q, want %q", cfg.ModelList[0].APIKey(), "sk-plaintext") } - // The file on disk must remain unchanged — LoadConfig must not write anything. + // The file on disk must remain unchanged — no need upgrade version raw, _ := os.ReadFile(cfgPath) if string(raw) != original { t.Errorf("LoadConfig must not modify the config file; got:\n%s", string(raw)) @@ -704,15 +721,19 @@ func TestSaveConfig_EncryptsPlaintextAPIKey(t *testing.T) { mustSetupSSHKey(t) cfg := DefaultConfig() - cfg.ModelList = []ModelConfig{ - {ModelName: "test", Model: "openai/gpt-4", APIKey: "sk-plaintext"}, + cfg.ModelList = []*ModelConfig{ + {ModelName: "test", Model: "openai/gpt-4", apiKeys: []string{"sk-plaintext"}}, + } + cfg.security = &SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{"test:0": {APIKeys: []string{"sk-plaintext"}}}, } if err := SaveConfig(cfgPath, cfg); err != nil { t.Fatalf("SaveConfig: %v", err) } // Disk must contain enc://, not the raw key. - raw, _ := os.ReadFile(cfgPath) + secPath := filepath.Join(dir, SecurityConfigFile) + raw, _ := os.ReadFile(secPath) if !strings.Contains(string(raw), "enc://") { t.Errorf("saved file should contain enc://, got:\n%s", string(raw)) } @@ -725,8 +746,8 @@ func TestSaveConfig_EncryptsPlaintextAPIKey(t *testing.T) { if err != nil { t.Fatalf("LoadConfig after SaveConfig: %v", err) } - if cfg2.ModelList[0].APIKey != "sk-plaintext" { - t.Errorf("loaded api_key = %q, want %q", cfg2.ModelList[0].APIKey, "sk-plaintext") + if cfg2.ModelList[0].APIKey() != "sk-plaintext" { + t.Errorf("loaded api_key = %q, want %q", cfg2.ModelList[0].APIKey(), "sk-plaintext") } } @@ -762,10 +783,17 @@ func TestLoadConfig_FileRefNotSealed(t *testing.T) { if err := os.WriteFile(keyFile, []byte("sk-from-file"), 0o600); err != nil { t.Fatalf("setup: %v", err) } - data := `{"model_list":[{"model_name":"test","model":"openai/gpt-4","api_key":"file://openai.key"}]}` + data := `{"version":1,"model_list":[{"model_name":"test","model":"openai/gpt-4"}]}` if err := os.WriteFile(cfgPath, []byte(data), 0o600); err != nil { t.Fatalf("setup: %v", err) } + secPath := filepath.Join(dir, SecurityConfigFile) + if err := saveSecurityConfig( + secPath, + &SecurityConfig{ModelList: map[string]ModelSecurityEntry{"test:0": {APIKeys: []string{"file://openai.key"}}}}, + ); err != nil { + t.Fatalf("saveSecurityConfig: %v", err) + } t.Setenv("PICOCLAW_KEY_PASSPHRASE", "test-passphrase") t.Setenv("PICOCLAW_SSH_KEY_PATH", "") @@ -774,7 +802,7 @@ func TestLoadConfig_FileRefNotSealed(t *testing.T) { t.Fatalf("LoadConfig: %v", err) } - raw, _ := os.ReadFile(cfgPath) + raw, _ := os.ReadFile(secPath) if !strings.Contains(string(raw), "file://openai.key") { t.Error("file:// reference should be preserved unchanged in the config file") } @@ -794,23 +822,28 @@ func TestSaveConfig_MixedKeys(t *testing.T) { // Pre-encrypt one key so we have a genuine enc:// value to put in the config. if err := SaveConfig(cfgPath, &Config{ - ModelList: []ModelConfig{ - {ModelName: "pre", Model: "openai/gpt-4", APIKey: "sk-already-plain"}, + ModelList: []*ModelConfig{ + {ModelName: "pre", Model: "openai/gpt-4"}, + }, + security: &SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{ + "pre:0": {APIKeys: []string{"sk-already-plain"}}, + }, }, }); err != nil { t.Fatalf("setup SaveConfig: %v", err) } - raw, _ := os.ReadFile(cfgPath) + raw, _ := os.ReadFile(filepath.Join(dir, SecurityConfigFile)) // Extract the enc:// value from the saved file. var tmp struct { - ModelList []struct { - APIKey string `json:"api_key"` - } `json:"model_list"` + ModelList map[string]struct { + APIKeys []string `yaml:"api_keys"` + } `yaml:"model_list"` } - if err := json.Unmarshal(raw, &tmp); err != nil || len(tmp.ModelList) == 0 { + if err := yaml.Unmarshal(raw, &tmp); err != nil || len(tmp.ModelList) == 0 { t.Fatalf("setup: could not parse saved config: %v", err) } - alreadyEncrypted := tmp.ModelList[0].APIKey + alreadyEncrypted := tmp.ModelList["pre:0"].APIKeys[0] if !strings.HasPrefix(alreadyEncrypted, "enc://") { t.Fatalf("setup: expected enc:// key, got %q", alreadyEncrypted) } @@ -824,19 +857,28 @@ func TestSaveConfig_MixedKeys(t *testing.T) { t.Fatalf("setup: %v", err) } cfg := &Config{ - ModelList: []ModelConfig{ - {ModelName: "plain", Model: "openai/gpt-4", APIKey: "sk-new-plaintext"}, - {ModelName: "enc", Model: "openai/gpt-4", APIKey: alreadyEncrypted}, - {ModelName: "file", Model: "openai/gpt-4", APIKey: "file://api.key"}, + ModelList: []*ModelConfig{ + {ModelName: "plain", Model: "openai/gpt-4", apiKeys: []string{"sk-new-plaintext"}}, + {ModelName: "enc", Model: "openai/gpt-4", apiKeys: []string{alreadyEncrypted}}, + {ModelName: "file", Model: "openai/gpt-4", apiKeys: []string{"file://api.key"}}, + }, + security: &SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{ + "plain:0": {APIKeys: []string{"sk-new-plaintext"}}, + "enc:0": {APIKeys: []string{alreadyEncrypted}}, + "file:0": {APIKeys: []string{"file://api.key"}}, + }, }, } if err := SaveConfig(cfgPath, cfg); err != nil { t.Fatalf("SaveConfig: %v", err) } - raw, _ = os.ReadFile(cfgPath) + raw, _ = os.ReadFile(filepath.Join(dir, SecurityConfigFile)) s := string(raw) + t.Logf("saved file:\n%s", s) + // 1. Plaintext must be encrypted. if strings.Contains(s, "sk-new-plaintext") { t.Error("plaintext key must not appear in saved file") @@ -857,7 +899,7 @@ func TestSaveConfig_MixedKeys(t *testing.T) { } byName := make(map[string]string) for _, m := range cfg2.ModelList { - byName[m.ModelName] = m.APIKey + byName[m.ModelName] = m.APIKey() } if byName["plain"] != "sk-new-plaintext" { t.Errorf("plain model api_key = %q, want %q", byName["plain"], "sk-new-plaintext") @@ -881,26 +923,26 @@ func TestLoadConfig_MixedKeys_NoPassphrase(t *testing.T) { t.Setenv("PICOCLAW_KEY_PASSPHRASE", "test-passphrase") mustSetupSSHKey(t) if err := SaveConfig(cfgPath, &Config{ - ModelList: []ModelConfig{ - {ModelName: "m", Model: "openai/gpt-4", APIKey: "sk-secret"}, + ModelList: []*ModelConfig{ + {ModelName: "m", Model: "openai/gpt-4", apiKeys: []string{"sk-secret"}}, + }, + security: &SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{ + "m:0": {APIKeys: []string{"sk-secret"}}, + }, }, }); err != nil { t.Fatalf("setup SaveConfig: %v", err) } - raw, _ := os.ReadFile(cfgPath) - var tmp struct { - ModelList []struct { - APIKey string `json:"api_key"` - } `json:"model_list"` - } - if err := json.Unmarshal(raw, &tmp); err != nil { - t.Fatalf("setup parse: %v", err) - } - encValue := tmp.ModelList[0].APIKey + raw, err := LoadConfig(cfgPath) + assert.NoError(t, err) + encValue := raw.security.ModelList["m:0"].APIKeys[0] + assert.NotEmpty(t, encValue) + assert.Equal(t, "enc://", encValue[:6]) // Write a mixed config: enc:// + plaintext + file:// keyFile := filepath.Join(dir, "api.key") - if err := os.WriteFile(keyFile, []byte("sk-from-file"), 0o600); err != nil { + if err = os.WriteFile(keyFile, []byte("sk-from-file"), 0o600); err != nil { t.Fatalf("setup: %v", err) } mixed, _ := json.Marshal(map[string]any{ @@ -910,14 +952,24 @@ func TestLoadConfig_MixedKeys_NoPassphrase(t *testing.T) { {"model_name": "file", "model": "openai/gpt-4", "api_key": "file://api.key"}, }, }) - if err := os.WriteFile(cfgPath, mixed, 0o600); err != nil { + if err = os.WriteFile(cfgPath, mixed, 0o600); err != nil { t.Fatalf("setup write: %v", err) } + secs, _ := yaml.Marshal(map[string]any{ + "model_list": map[string]map[string]any{ + "enc:0": {"api_keys": []string{encValue}}, + "plain:0": {"api_keys": []string{"sk-plain"}}, + "file:0": {"api_keys": []string{"file://api.key"}}, + }, + }) + if err = os.WriteFile(filepath.Join(dir, SecurityConfigFile), secs, 0o600); err != nil { + t.Fatalf("security write: %v", err) + } // Now clear the passphrase — LoadConfig must fail because enc:// cannot be decrypted. t.Setenv("PICOCLAW_KEY_PASSPHRASE", "") - _, err := LoadConfig(cfgPath) + _, err = LoadConfig(cfgPath) if err == nil { t.Fatal("LoadConfig should fail when enc:// key is present and no passphrase is set") } @@ -945,14 +997,15 @@ func TestSaveConfig_UsesPassphraseProvider(t *testing.T) { t.Cleanup(func() { credential.PassphraseProvider = orig }) cfg := DefaultConfig() - cfg.ModelList = []ModelConfig{ - {ModelName: "test", Model: "openai/gpt-4", APIKey: "sk-plaintext"}, + cfg.ModelList = []*ModelConfig{ + {ModelName: "test", Model: "openai/gpt-4"}, } + cfg.security.ModelList["test:0"] = ModelSecurityEntry{APIKeys: []string{"sk-plaintext"}} if err := SaveConfig(cfgPath, cfg); err != nil { t.Fatalf("SaveConfig: %v", err) } - raw, _ := os.ReadFile(cfgPath) + raw, _ := os.ReadFile(filepath.Join(dir, SecurityConfigFile)) if !strings.Contains(string(raw), "enc://") { t.Errorf("SaveConfig should have encrypted plaintext key via PassphraseProvider; got:\n%s", raw) } @@ -995,7 +1048,7 @@ func TestLoadConfig_UsesPassphraseProvider(t *testing.T) { if err != nil { t.Fatalf("LoadConfig: %v", err) } - if cfg.ModelList[0].APIKey != plainKey { - t.Errorf("api_key = %q, want %q", cfg.ModelList[0].APIKey, plainKey) + if cfg.ModelList[0].APIKey() != plainKey { + t.Errorf("api_key = %q, want %q", cfg.ModelList[0].APIKey(), plainKey) } } diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index ae52446b1..1923b6dd9 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -53,7 +53,6 @@ func DefaultConfig() *Config { }, Telegram: TelegramConfig{ Enabled: false, - Token: "", AllowFrom: FlexibleStringSlice{}, Typing: TypingConfig{Enabled: true}, Placeholder: PlaceholderConfig{ @@ -63,16 +62,12 @@ func DefaultConfig() *Config { UseMarkdownV2: false, }, Feishu: FeishuConfig{ - Enabled: false, - AppID: "", - AppSecret: "", - EncryptKey: "", - VerificationToken: "", - AllowFrom: FlexibleStringSlice{}, + Enabled: false, + AppID: "", + AllowFrom: FlexibleStringSlice{}, }, Discord: DiscordConfig{ Enabled: false, - Token: "", AllowFrom: FlexibleStringSlice{}, MentionOnly: false, }, @@ -85,28 +80,23 @@ func DefaultConfig() *Config { QQ: QQConfig{ Enabled: false, AppID: "", - AppSecret: "", AllowFrom: FlexibleStringSlice{}, MaxMessageLength: 2000, MaxBase64FileSizeMiB: 0, }, DingTalk: DingTalkConfig{ - Enabled: false, - ClientID: "", - ClientSecret: "", - AllowFrom: FlexibleStringSlice{}, + Enabled: false, + ClientID: "", + AllowFrom: FlexibleStringSlice{}, }, Slack: SlackConfig{ Enabled: false, - BotToken: "", - AppToken: "", AllowFrom: FlexibleStringSlice{}, }, Matrix: MatrixConfig{ Enabled: false, Homeserver: "https://matrix.org", UserID: "", - AccessToken: "", DeviceID: "", JoinOnInvite: true, AllowFrom: FlexibleStringSlice{}, @@ -119,51 +109,40 @@ func DefaultConfig() *Config { }, }, LINE: LINEConfig{ - Enabled: false, - ChannelSecret: "", - ChannelAccessToken: "", - WebhookHost: "0.0.0.0", - WebhookPort: 18791, - WebhookPath: "/webhook/line", - AllowFrom: FlexibleStringSlice{}, - GroupTrigger: GroupTriggerConfig{MentionOnly: true}, + Enabled: false, + WebhookHost: "0.0.0.0", + WebhookPort: 18791, + WebhookPath: "/webhook/line", + AllowFrom: FlexibleStringSlice{}, + GroupTrigger: GroupTriggerConfig{MentionOnly: true}, }, OneBot: OneBotConfig{ - Enabled: false, - WSUrl: "ws://127.0.0.1:3001", - AccessToken: "", - ReconnectInterval: 5, - GroupTriggerPrefix: []string{}, - AllowFrom: FlexibleStringSlice{}, + Enabled: false, + WSUrl: "ws://127.0.0.1:3001", + ReconnectInterval: 5, + AllowFrom: FlexibleStringSlice{}, }, WeCom: WeComConfig{ - Enabled: false, - Token: "", - EncodingAESKey: "", - WebhookURL: "", - WebhookHost: "0.0.0.0", - WebhookPort: 18793, - WebhookPath: "/webhook/wecom", - AllowFrom: FlexibleStringSlice{}, - ReplyTimeout: 5, + Enabled: false, + WebhookURL: "", + WebhookHost: "0.0.0.0", + WebhookPort: 18793, + WebhookPath: "/webhook/wecom", + AllowFrom: FlexibleStringSlice{}, + ReplyTimeout: 5, }, WeComApp: WeComAppConfig{ - Enabled: false, - CorpID: "", - CorpSecret: "", - AgentID: 0, - Token: "", - EncodingAESKey: "", - WebhookHost: "0.0.0.0", - WebhookPort: 18792, - WebhookPath: "/webhook/wecom-app", - AllowFrom: FlexibleStringSlice{}, - ReplyTimeout: 5, + Enabled: false, + CorpID: "", + AgentID: 0, + WebhookHost: "0.0.0.0", + WebhookPort: 18792, + WebhookPath: "/webhook/wecom-app", + AllowFrom: FlexibleStringSlice{}, + ReplyTimeout: 5, }, WeComAIBot: WeComAIBotConfig{ Enabled: false, - Token: "", - EncodingAESKey: "", WebhookPath: "/webhook/wecom-aibot", AllowFrom: FlexibleStringSlice{}, ReplyTimeout: 5, @@ -172,7 +151,6 @@ func DefaultConfig() *Config { }, Pico: PicoConfig{ Enabled: false, - Token: "", PingInterval: 30, ReadTimeout: 60, WriteTimeout: 10, @@ -180,7 +158,7 @@ func DefaultConfig() *Config { AllowFrom: FlexibleStringSlice{}, }, }, - ModelList: []ModelConfig{ + ModelList: []*ModelConfig{ // ============================================ // Add your API key to the model you want to use // ============================================ @@ -190,7 +168,6 @@ func DefaultConfig() *Config { ModelName: "glm-4.7", Model: "zhipu/glm-4.7", APIBase: "https://open.bigmodel.cn/api/paas/v4", - APIKey: "", }, // OpenAI - https://platform.openai.com/api-keys @@ -198,7 +175,6 @@ func DefaultConfig() *Config { ModelName: "gpt-5.4", Model: "openai/gpt-5.4", APIBase: "https://api.openai.com/v1", - APIKey: "", }, // Anthropic Claude - https://console.anthropic.com/settings/keys @@ -206,7 +182,6 @@ func DefaultConfig() *Config { ModelName: "claude-sonnet-4.6", Model: "anthropic/claude-sonnet-4.6", APIBase: "https://api.anthropic.com/v1", - APIKey: "", }, // DeepSeek - https://platform.deepseek.com/ @@ -214,7 +189,6 @@ func DefaultConfig() *Config { ModelName: "deepseek-chat", Model: "deepseek/deepseek-chat", APIBase: "https://api.deepseek.com/v1", - APIKey: "", }, // Google Gemini - https://ai.google.dev/ @@ -222,7 +196,6 @@ func DefaultConfig() *Config { ModelName: "gemini-2.0-flash", Model: "gemini/gemini-2.0-flash-exp", APIBase: "https://generativelanguage.googleapis.com/v1beta", - APIKey: "", }, // Qwen (通义千问) - https://dashscope.console.aliyun.com/apiKey @@ -230,7 +203,6 @@ func DefaultConfig() *Config { ModelName: "qwen-plus", Model: "qwen/qwen-plus", APIBase: "https://dashscope.aliyuncs.com/compatible-mode/v1", - APIKey: "", }, // Moonshot (月之暗面) - https://platform.moonshot.cn/console/api-keys @@ -238,7 +210,6 @@ func DefaultConfig() *Config { ModelName: "moonshot-v1-8k", Model: "moonshot/moonshot-v1-8k", APIBase: "https://api.moonshot.cn/v1", - APIKey: "", }, // Groq - https://console.groq.com/keys @@ -246,7 +217,6 @@ func DefaultConfig() *Config { ModelName: "llama-3.3-70b", Model: "groq/llama-3.3-70b-versatile", APIBase: "https://api.groq.com/openai/v1", - APIKey: "", }, // OpenRouter (100+ models) - https://openrouter.ai/keys @@ -254,13 +224,11 @@ func DefaultConfig() *Config { ModelName: "openrouter-auto", Model: "openrouter/auto", APIBase: "https://openrouter.ai/api/v1", - APIKey: "", }, { ModelName: "openrouter-gpt-5.4", Model: "openrouter/openai/gpt-5.4", APIBase: "https://openrouter.ai/api/v1", - APIKey: "", }, // NVIDIA - https://build.nvidia.com/ @@ -268,7 +236,6 @@ func DefaultConfig() *Config { ModelName: "nemotron-4-340b", Model: "nvidia/nemotron-4-340b-instruct", APIBase: "https://integrate.api.nvidia.com/v1", - APIKey: "", }, // Cerebras - https://inference.cerebras.ai/ @@ -276,7 +243,6 @@ func DefaultConfig() *Config { ModelName: "cerebras-llama-3.3-70b", Model: "cerebras/llama-3.3-70b", APIBase: "https://api.cerebras.ai/v1", - APIKey: "", }, // Vivgrid - https://vivgrid.com @@ -284,7 +250,6 @@ func DefaultConfig() *Config { ModelName: "vivgrid-auto", Model: "vivgrid/auto", APIBase: "https://api.vivgrid.com/v1", - APIKey: "", }, // Volcengine (火山引擎) - https://console.volcengine.com/ark @@ -292,13 +257,11 @@ func DefaultConfig() *Config { ModelName: "ark-code-latest", Model: "volcengine/ark-code-latest", APIBase: "https://ark.cn-beijing.volces.com/api/v3", - APIKey: "", }, { ModelName: "doubao-pro", Model: "volcengine/doubao-pro-32k", APIBase: "https://ark.cn-beijing.volces.com/api/v3", - APIKey: "", }, // ShengsuanYun (神算云) @@ -306,7 +269,6 @@ func DefaultConfig() *Config { ModelName: "deepseek-v3", Model: "shengsuanyun/deepseek-v3", APIBase: "https://api.shengsuanyun.com/v1", - APIKey: "", }, // Antigravity (Google Cloud Code Assist) - OAuth only @@ -329,7 +291,6 @@ func DefaultConfig() *Config { ModelName: "llama3", Model: "ollama/llama3", APIBase: "http://localhost:11434/v1", - APIKey: "ollama", }, // Mistral AI - https://console.mistral.ai/api-keys @@ -337,7 +298,6 @@ func DefaultConfig() *Config { ModelName: "mistral-small", Model: "mistral/mistral-small-latest", APIBase: "https://api.mistral.ai/v1", - APIKey: "", }, // Avian - https://avian.io @@ -345,13 +305,11 @@ func DefaultConfig() *Config { ModelName: "deepseek-v3.2", Model: "avian/deepseek/deepseek-v3.2", APIBase: "https://api.avian.io/v1", - APIKey: "", }, { ModelName: "kimi-k2.5", Model: "avian/moonshotai/kimi-k2.5", APIBase: "https://api.avian.io/v1", - APIKey: "", }, // Minimax - https://api.minimaxi.com/ @@ -359,7 +317,6 @@ func DefaultConfig() *Config { ModelName: "MiniMax-M2.5", Model: "minimax/MiniMax-M2.5", APIBase: "https://api.minimaxi.com/v1", - APIKey: "", }, // LongCat - https://longcat.chat/platform @@ -367,7 +324,6 @@ func DefaultConfig() *Config { ModelName: "LongCat-Flash-Thinking", Model: "longcat/LongCat-Flash-Thinking", APIBase: "https://api.longcat.chat/openai", - APIKey: "", }, // ModelScope (魔搭社区) - https://modelscope.cn/my/tokens @@ -375,7 +331,6 @@ func DefaultConfig() *Config { ModelName: "modelscope-qwen", Model: "modelscope/Qwen/Qwen3-235B-A22B-Instruct-2507", APIBase: "https://api-inference.modelscope.cn/v1", - APIKey: "", }, // VLLM (local) - http://localhost:8000 @@ -383,7 +338,6 @@ func DefaultConfig() *Config { ModelName: "local-model", Model: "vllm/custom-model", APIBase: "http://localhost:8000/v1", - APIKey: "", }, // Azure OpenAI - https://portal.azure.com @@ -392,7 +346,6 @@ func DefaultConfig() *Config { ModelName: "azure-gpt5", Model: "azure/my-gpt5-deployment", APIBase: "https://your-resource.openai.azure.com", - APIKey: "", }, }, Gateway: GatewayConfig{ @@ -418,14 +371,10 @@ func DefaultConfig() *Config { Format: "plaintext", Brave: BraveConfig{ Enabled: false, - APIKey: "", - APIKeys: nil, MaxResults: 5, }, Tavily: TavilyConfig{ Enabled: false, - APIKey: "", - APIKeys: nil, MaxResults: 5, }, DuckDuckGo: DuckDuckGoConfig{ @@ -434,8 +383,6 @@ func DefaultConfig() *Config { }, Perplexity: PerplexityConfig{ Enabled: false, - APIKey: "", - APIKeys: nil, MaxResults: 5, }, SearXNG: SearXNGConfig{ @@ -445,7 +392,6 @@ func DefaultConfig() *Config { }, GLMSearch: GLMSearchConfig{ Enabled: false, - APIKey: "", BaseURL: "https://open.bigmodel.cn/api/paas/v4/web_search", SearchEngine: "search_std", MaxResults: 5, @@ -559,5 +505,10 @@ func DefaultConfig() *Config { BuildTime: BuildTime, GoVersion: GoVersion, }, + security: &SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{}, + Channels: ChannelsSecurity{}, + Web: WebToolsSecurity{}, + }, } } diff --git a/pkg/config/example_security_usage.go b/pkg/config/example_security_usage.go new file mode 100644 index 000000000..d4df93473 --- /dev/null +++ b/pkg/config/example_security_usage.go @@ -0,0 +1,423 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +// This file demonstrates how to use the security configuration feature +// It's not meant to be compiled, just for documentation purposes + +/* +Package config + +# Example: Using Security Configuration + +## 1. Create security.yml + +File: ~/.picoclaw/security.yml + +```yaml +# Model API Keys +# Note: Use 'api_keys' array for multiple keys (load balancing/failover) +# Single key should be provided as an array with one element +model_list: + + gpt-5.4: + api_keys: + - "sk-proj-your-actual-openai-key-1" + - "sk-proj-your-actual-openai-key-2" # Failover key + claude-sonnet-4.6: + api_keys: + - "sk-ant-your-actual-anthropic-key" # Single key in array format + +# Channel Tokens +channels: + + telegram: + token: "1234567890:ABCdefGHIjklMNOpqrsTUVwxyz" + discord: + token: "your-discord-bot-token" + +# Web Tool Keys +# Note: Use 'api_keys' array for multiple keys (load balancing/failover) +# For GLMSearch, use 'api_key' (single string) +web: + + brave: + api_keys: + - "BSAyour-brave-api-key-1" + - "BSAyour-brave-api-key-2" # Failover key + tavily: + api_keys: + - "tvly-your-tavily-api-key" # Single key in array format + glm_search: + api_key: "your-glm-search-api-key" # Single key (not array) + +``` + +## 2. Update config.json to use references + +File: ~/.picoclaw/config.json + +```json + + { + "version": 1, + "agents": { + "defaults": { + "workspace": "~/picoclaw-workspace", + "model_name": "gpt-5.4" + } + }, + "model_list": [ + { + "model_name": "gpt-5.4", + "model": "openai/gpt-5.4", + "api_base": "https://api.openai.com/v1", + "api_key": "ref:model_list.gpt-5.4.api_key" + }, + { + "model_name": "claude-sonnet-4.6", + "model": "anthropic/claude-sonnet-4.6", + "api_base": "https://api.anthropic.com/v1", + "api_key": "ref:model_list.claude-sonnet-4.6.api_key" + } + ], + "channels": { + "telegram": { + "enabled": true, + "token": "ref:channels.telegram.token" + }, + "discord": { + "enabled": true, + "token": "ref:channels.discord.token" + } + }, + "tools": { + "web": { + "brave": { + "enabled": true, + "api_key": "ref:web.brave.api_key" + }, + "tavily": { + "enabled": true, + "api_key": "ref:web.tavily.api_key" + } + } + } + } + +``` + +## 3. Set proper permissions + +```bash +chmod 600 ~/.picoclaw/security.yml +``` + +## 4. Add to .gitignore + +```gitignore +# Security configuration +security.yml +``` + +## 5. Verify it works + +```bash +picoclaw --version +``` + +# Available Reference Paths + +## Model API Keys +- ref:model_list..api_key + +Examples: +- ref:model_list.gpt-5.4.api_key +- ref:model_list.claude-sonnet-4.6.api_key + +**Note:** In security.yml, use `api_keys` (array) format for models. +Both single and multiple keys should use the array format. + +## Channel Tokens/Secrets +- ref:channels.telegram.token +- ref:channels.feishu.app_secret +- ref:channels.feishu.encrypt_key +- ref:channels.feishu.verification_token +- ref:channels.discord.token +- ref:channels.qq.app_secret +- ref:channels.dingtalk.client_secret +- ref:channels.slack.bot_token +- ref:channels.slack.app_token +- ref:channels.matrix.access_token +- ref:channels.line.channel_secret +- ref:channels.line.channel_access_token +- ref:channels.onebot.access_token +- ref:channels.wecom.token +- ref:channels.wecom.encoding_aes_key +- ref:channels.wecom_app.corp_secret +- ref:channels.wecom_app.token +- ref:channels.wecom_app.encoding_aes_key +- ref:channels.wecom_aibot.token +- ref:channels.wecom_aibot.encoding_aes_key +- ref:channels.pico.token +- ref:channels.irc.password +- ref:channels.irc.nickserv_password +- ref:channels.irc.sasl_password + +## Web Tool API Keys +- ref:web.brave.api_key +- ref:web.tavily.api_key +- ref:web.perplexity.api_key +- ref:web.glm_search.api_key + +**Note:** +- Brave, Tavily, Perplexity: Use `api_keys` (array) format in security.yml +- GLMSearch: Use `api_key` (single string) format in security.yml + +## Skills Registry Tokens +- ref:skills.github.token +- ref:skills.clawhub.auth_token + +# Backward Compatibility + +You can still use direct values in config.json if needed: + +```json + + { + "model_list": [ + { + "model_name": "local-model", + "model": "ollama/llama3", + "api_base": "http://localhost:11434/v1", + "api_key": "ollama" // Direct value (no reference) + } + ] + } + +``` + +You can also mix references and direct values: + +```json + + { + "model_list": [ + { + "model_name": "cloud-model", + "api_key": "ref:model_list.cloud-model.api_key" // From security.yml + }, + { + "model_name": "local-model", + "api_key": "ollama" // Direct value + } + ] + } + +``` + +# Migration from Old Config + +## Step 1: Backup your config +```bash +cp ~/.picoclaw/config.json ~/.picoclaw/config.json.backup +``` + +## Step 2: Copy the example security file +```bash +cp security.example.yml ~/.picoclaw/security.yml +``` + +## Step 3: Fill in your API keys +Edit ~/.picoclaw/security.yml and replace placeholders with your actual keys. + +## Step 4: Update config.json references +Replace sensitive values in ~/.picoclaw/config.json with ref: references. + +## Step 5: Test +```bash +picoclaw --version +``` + +If everything works, you can delete the backup: +```bash +rm ~/.picoclaw/config.json.backup +``` + +# Advanced Features + +## Multiple API Keys (Load Balancing & Failover) + +You can configure multiple API keys for both models and web tools to enable: +- **Load balancing**: Requests are distributed across multiple keys +- **Failover**: If a key fails, the system automatically switches to another key + +### Example: Model with Multiple Keys + +**security.yml:** +```yaml +model_list: + + gpt-5.4: + api_keys: + - "sk-proj-key-1" + - "sk-proj-key-2" + - "sk-proj-key-3" + +``` + +**config.json:** +```json + + { + "model_list": [ + { + "model_name": "gpt-5.4", + "model": "openai/gpt-5.4", + "api_key": "ref:model_list.gpt-5.4.api_key" + } + ] + } + +``` + +### Example: Web Tool with Multiple Keys + +**security.yml:** +```yaml +web: + + brave: + api_keys: + - "BSA-key-1" + - "BSA-key-2" + tavily: + api_keys: + - "tvly-your-key" # Single key in array format + glm_search: + api_key: "your-glm-key" # GLMSearch uses single key format + +``` + +**config.json:** +```json + + { + "tools": { + "web": { + "brave": { + "enabled": true, + "api_key": "ref:web.brave.api_key" + } + } + } + } + +``` + +### Single Key + +Use array format with one element: +```yaml +model_list: + + gpt-5.4: + api_keys: + - "sk-proj-your-key" # Single key in array format + +``` + +### Multiple Keys (Load Balancing & Failover) + +Use array format with multiple elements: +```yaml +model_list: + + gpt-5.4: + api_keys: + - "sk-proj-key-1" + - "sk-proj-key-2" + - "sk-proj-key-3" + +``` + +**Important:** All model keys in security.yml must use the `api_keys` (plural) array format. +The single `api_key` (singular) format is NOT supported for models. + +### Model Index Matching + +The system supports intelligent model name matching in security.yml: + +**Example 1: Exact Match** +```yaml +# config.json + + { + "model_name": "gpt-5.4:0" + } + +# security.yml (exact match with index) +model_list: + + gpt-5.4:0: + api_keys: ["key-1"] + +``` + +**Example 2: Base Name Match** +```yaml +# config.json + + { + "model_name": "gpt-5.4:0" + } + +# security.yml (base name without index) +model_list: + + gpt-5.4: + api_keys: ["key-1"] + +``` + +Both methods work. The base name match allows you to use simpler keys in security.yml +even when your config uses indexed model names for load balancing. + +### Security File Permissions + +The security file should have restricted permissions: + +```bash +chmod 600 ~/.picoclaw/security.yml +``` + +This ensures only the owner can read and write the file. + +# Security Best Practices + +1. Never commit security.yml to version control +2. Set file permissions: chmod 600 ~/.picoclaw/security.yml +3. Use different keys for different environments +4. Rotate keys regularly and update security.yml +5. Encrypt backups containing security.yml + +# Troubleshooting + +## Error: "model security entry not found" +- Check that the model name in config.json matches exactly in security.yml +- Verify the model_list section exists in security.yml + +## Error: "failed to load security config" +- Ensure security.yml exists in the same directory as config.json +- Check YAML syntax is valid +- Verify file permissions allow reading + +## Error: "unknown reference path" +- Verify the reference format is correct +- Check the path structure matches the examples above +- Ensure all required sections exist in security.yml +*/ +package config + +// This file is documentation only diff --git a/pkg/config/migration.go b/pkg/config/migration.go index 0263779ac..fee800a76 100644 --- a/pkg/config/migration.go +++ b/pkg/config/migration.go @@ -26,10 +26,10 @@ func buildModelWithProtocol(protocol, model string) string { return protocol + "/" + model } -// v0ConvertProvidersToModelList converts the old ProvidersConfig to a slice of ModelConfig. +// v0ConvertProvidersToModelList converts the old providersConfigV0 to a slice of ModelConfig. // This enables backward compatibility with existing configurations. // It preserves the user's configured model from agents.defaults.model when possible. -func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { +func v0ConvertProvidersToModelList(cfg *configV0) []modelConfigV0 { if cfg == nil { return nil } @@ -41,7 +41,7 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { // protocol is the protocol prefix for the model field protocol string // buildConfig creates the ModelConfig from ProviderConfig - buildConfig func(p ProvidersConfig) (ModelConfig, bool) + buildConfig func(p providersConfigV0) (modelConfigV0, bool) } // Get user's configured provider and model @@ -50,7 +50,7 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { p := cfg.Providers - var result []ModelConfig + var result []modelConfigV0 // Track if we've applied the legacy model name fix (only for first provider) legacyModelNameApplied := false @@ -60,11 +60,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"openai", "gpt"}, protocol: "openai", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.OpenAI.APIKey == "" && p.OpenAI.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "openai", Model: "openai/gpt-5.4", APIKey: p.OpenAI.APIKey, @@ -78,11 +78,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"anthropic", "claude"}, protocol: "anthropic", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Anthropic.APIKey == "" && p.Anthropic.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "anthropic", Model: "anthropic/claude-sonnet-4.6", APIKey: p.Anthropic.APIKey, @@ -96,11 +96,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"litellm"}, protocol: "litellm", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.LiteLLM.APIKey == "" && p.LiteLLM.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "litellm", Model: "litellm/auto", APIKey: p.LiteLLM.APIKey, @@ -113,11 +113,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"openrouter"}, protocol: "openrouter", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.OpenRouter.APIKey == "" && p.OpenRouter.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "openrouter", Model: "openrouter/auto", APIKey: p.OpenRouter.APIKey, @@ -130,11 +130,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"groq"}, protocol: "groq", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Groq.APIKey == "" && p.Groq.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "groq", Model: "groq/llama-3.1-70b-versatile", APIKey: p.Groq.APIKey, @@ -147,11 +147,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"zhipu", "glm"}, protocol: "zhipu", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Zhipu.APIKey == "" && p.Zhipu.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "zhipu", Model: "zhipu/glm-4", APIKey: p.Zhipu.APIKey, @@ -164,11 +164,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"vllm"}, protocol: "vllm", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.VLLM.APIKey == "" && p.VLLM.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "vllm", Model: "vllm/auto", APIKey: p.VLLM.APIKey, @@ -181,11 +181,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"gemini", "google"}, protocol: "gemini", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Gemini.APIKey == "" && p.Gemini.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "gemini", Model: "gemini/gemini-pro", APIKey: p.Gemini.APIKey, @@ -198,11 +198,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"nvidia"}, protocol: "nvidia", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Nvidia.APIKey == "" && p.Nvidia.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "nvidia", Model: "nvidia/meta/llama-3.1-8b-instruct", APIKey: p.Nvidia.APIKey, @@ -215,11 +215,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"ollama"}, protocol: "ollama", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Ollama.APIKey == "" && p.Ollama.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "ollama", Model: "ollama/llama3", APIKey: p.Ollama.APIKey, @@ -232,11 +232,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"moonshot", "kimi"}, protocol: "moonshot", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Moonshot.APIKey == "" && p.Moonshot.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "moonshot", Model: "moonshot/kimi", APIKey: p.Moonshot.APIKey, @@ -249,11 +249,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"shengsuanyun"}, protocol: "shengsuanyun", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.ShengSuanYun.APIKey == "" && p.ShengSuanYun.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "shengsuanyun", Model: "shengsuanyun/auto", APIKey: p.ShengSuanYun.APIKey, @@ -266,11 +266,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"deepseek"}, protocol: "deepseek", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.DeepSeek.APIKey == "" && p.DeepSeek.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "deepseek", Model: "deepseek/deepseek-chat", APIKey: p.DeepSeek.APIKey, @@ -283,11 +283,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"cerebras"}, protocol: "cerebras", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Cerebras.APIKey == "" && p.Cerebras.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "cerebras", Model: "cerebras/llama-3.3-70b", APIKey: p.Cerebras.APIKey, @@ -300,11 +300,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"vivgrid"}, protocol: "vivgrid", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Vivgrid.APIKey == "" && p.Vivgrid.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "vivgrid", Model: "vivgrid/auto", APIKey: p.Vivgrid.APIKey, @@ -317,11 +317,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"volcengine", "doubao"}, protocol: "volcengine", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.VolcEngine.APIKey == "" && p.VolcEngine.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "volcengine", Model: "volcengine/doubao-pro", APIKey: p.VolcEngine.APIKey, @@ -334,11 +334,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"github_copilot", "copilot"}, protocol: "github-copilot", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.GitHubCopilot.APIKey == "" && p.GitHubCopilot.APIBase == "" && p.GitHubCopilot.ConnectMode == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "github-copilot", Model: "github-copilot/gpt-5.4", APIBase: p.GitHubCopilot.APIBase, @@ -349,11 +349,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"antigravity"}, protocol: "antigravity", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Antigravity.APIKey == "" && p.Antigravity.AuthMethod == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "antigravity", Model: "antigravity/gemini-2.0-flash", APIKey: p.Antigravity.APIKey, @@ -364,11 +364,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"qwen", "tongyi"}, protocol: "qwen", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Qwen.APIKey == "" && p.Qwen.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "qwen", Model: "qwen/qwen-max", APIKey: p.Qwen.APIKey, @@ -381,11 +381,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"mistral"}, protocol: "mistral", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Mistral.APIKey == "" && p.Mistral.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "mistral", Model: "mistral/mistral-small-latest", APIKey: p.Mistral.APIKey, @@ -398,11 +398,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"avian"}, protocol: "avian", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.Avian.APIKey == "" && p.Avian.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "avian", Model: "avian/deepseek/deepseek-v3.2", APIKey: p.Avian.APIKey, @@ -415,11 +415,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"longcat"}, protocol: "longcat", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.LongCat.APIKey == "" && p.LongCat.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "longcat", Model: "longcat/LongCat-Flash-Thinking", APIKey: p.LongCat.APIKey, @@ -432,11 +432,11 @@ func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { { providerNames: []string{"modelscope"}, protocol: "modelscope", - buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + buildConfig: func(p providersConfigV0) (modelConfigV0, bool) { if p.ModelScope.APIKey == "" && p.ModelScope.APIBase == "" { - return ModelConfig{}, false + return modelConfigV0{}, false } - return ModelConfig{ + return modelConfigV0{ ModelName: "modelscope", Model: "modelscope/Qwen/Qwen3-235B-A22B-Instruct-2507", APIKey: p.ModelScope.APIKey, @@ -485,7 +485,27 @@ func loadConfigV0(data []byte) (migratable, error) { // Auto-migrate: if only legacy providers config exists, convert to model_list if len(v0.ModelList) == 0 && !v0.Providers.IsEmpty() { - v0.ModelList = v0ConvertProvidersToModelList(&v0) + newModelList := v0ConvertProvidersToModelList(&v0) + // Convert []ModelConfig to []modelConfigV0 + v0.ModelList = make([]modelConfigV0, len(newModelList)) + for i, m := range newModelList { + v0.ModelList[i] = modelConfigV0{ + ModelName: m.ModelName, + Model: m.Model, + APIBase: m.APIBase, + Proxy: m.Proxy, + Fallbacks: m.Fallbacks, + AuthMethod: m.AuthMethod, + ConnectMode: m.ConnectMode, + Workspace: m.Workspace, + RPM: m.RPM, + MaxTokensField: m.MaxTokensField, + RequestTimeout: m.RequestTimeout, + ThinkingLevel: m.ThinkingLevel, + APIKey: m.APIKey, + APIKeys: m.APIKeys, + } + } } return &v0, nil diff --git a/pkg/config/migration_integration_test.go b/pkg/config/migration_integration_test.go index 4459c1316..c884a6b5d 100644 --- a/pkg/config/migration_integration_test.go +++ b/pkg/config/migration_integration_test.go @@ -103,8 +103,8 @@ func TestMigration_Integration_LegacyConfigWithoutWorkspace(t *testing.T) { if !cfg.Channels.Telegram.Enabled { t.Error("Telegram.Enabled should be true") } - if cfg.Channels.Telegram.Token != "test-token" { - t.Errorf("Telegram.Token = %q, want %q", cfg.Channels.Telegram.Token, "test-token") + if cfg.Channels.Telegram.Token() != "test-token" { + t.Errorf("Telegram.Token = %q, want %q", cfg.Channels.Telegram.Token(), "test-token") } if cfg.Gateway.Port != 18790 { t.Errorf("Gateway.Port = %d, want %d", cfg.Gateway.Port, 18790) diff --git a/pkg/config/migration_test.go b/pkg/config/migration_test.go index 1da5035b5..aeabe9730 100644 --- a/pkg/config/migration_test.go +++ b/pkg/config/migration_test.go @@ -12,9 +12,9 @@ import ( func TestConvertProvidersToModelList_OpenAI(t *testing.T) { cfg := &configV0{ - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{ - ProviderConfig: ProviderConfig{ + Providers: providersConfigV0{ + OpenAI: openAIProviderConfigV0{ + providerConfigV0: providerConfigV0{ APIKey: "sk-test-key", APIBase: "https://custom.api.com/v1", }, @@ -41,9 +41,8 @@ func TestConvertProvidersToModelList_OpenAI(t *testing.T) { func TestConvertProvidersToModelList_Anthropic(t *testing.T) { cfg := &configV0{ - Providers: ProvidersConfig{ - Anthropic: ProviderConfig{ - APIKey: "ant-key", + Providers: providersConfigV0{ + Anthropic: providerConfigV0{ APIBase: "https://custom.anthropic.com", }, }, @@ -65,9 +64,8 @@ func TestConvertProvidersToModelList_Anthropic(t *testing.T) { func TestConvertProvidersToModelList_LiteLLM(t *testing.T) { cfg := &configV0{ - Providers: ProvidersConfig{ - LiteLLM: ProviderConfig{ - APIKey: "litellm-key", + Providers: providersConfigV0{ + LiteLLM: providerConfigV0{ APIBase: "http://localhost:4000/v1", }, }, @@ -92,10 +90,10 @@ func TestConvertProvidersToModelList_LiteLLM(t *testing.T) { func TestConvertProvidersToModelList_Multiple(t *testing.T) { cfg := &configV0{ - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "openai-key"}}, - Groq: ProviderConfig{APIKey: "groq-key"}, - Zhipu: ProviderConfig{APIKey: "zhipu-key"}, + Providers: providersConfigV0{ + OpenAI: openAIProviderConfigV0{providerConfigV0: providerConfigV0{APIKey: "openai-key"}}, + Groq: providerConfigV0{APIKey: "groq-key"}, + Zhipu: providerConfigV0{APIKey: "zhipu-key"}, }, } @@ -120,7 +118,7 @@ func TestConvertProvidersToModelList_Multiple(t *testing.T) { func TestConvertProvidersToModelList_Empty(t *testing.T) { cfg := &configV0{ - Providers: ProvidersConfig{}, + Providers: providersConfigV0{}, } result := v0ConvertProvidersToModelList(cfg) @@ -139,31 +137,34 @@ func TestConvertProvidersToModelList_Nil(t *testing.T) { } func TestConvertProvidersToModelList_AllProviders(t *testing.T) { + // This test verifies that when providers have at least one configured field, + // they are converted. GitHubCopilot has ConnectMode set, Antigravity has AuthMethod. + // Other providers have no configuration, so they won't be converted. cfg := &configV0{ - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "key1"}}, - LiteLLM: ProviderConfig{APIKey: "key-litellm", APIBase: "http://localhost:4000/v1"}, - Anthropic: ProviderConfig{APIKey: "key2"}, - OpenRouter: ProviderConfig{APIKey: "key3"}, - Groq: ProviderConfig{APIKey: "key4"}, - Zhipu: ProviderConfig{APIKey: "key5"}, - VLLM: ProviderConfig{APIKey: "key6"}, - Gemini: ProviderConfig{APIKey: "key7"}, - Nvidia: ProviderConfig{APIKey: "key8"}, - Ollama: ProviderConfig{APIKey: "key9"}, - Moonshot: ProviderConfig{APIKey: "key10"}, - ShengSuanYun: ProviderConfig{APIKey: "key11"}, - DeepSeek: ProviderConfig{APIKey: "key12"}, - Cerebras: ProviderConfig{APIKey: "key13"}, - Vivgrid: ProviderConfig{APIKey: "key14"}, - VolcEngine: ProviderConfig{APIKey: "key15"}, - GitHubCopilot: ProviderConfig{ConnectMode: "grpc"}, - Antigravity: ProviderConfig{AuthMethod: "oauth"}, - Qwen: ProviderConfig{APIKey: "key17"}, - Mistral: ProviderConfig{APIKey: "key18"}, - Avian: ProviderConfig{APIKey: "key19"}, - LongCat: ProviderConfig{APIKey: "key-longcat"}, - ModelScope: ProviderConfig{APIKey: "key-modelscope"}, + Providers: providersConfigV0{ + OpenAI: openAIProviderConfigV0{providerConfigV0: providerConfigV0{APIKey: "key1"}}, + LiteLLM: providerConfigV0{APIKey: "key-litellm", APIBase: "http://localhost:4000/v1"}, + Anthropic: providerConfigV0{APIKey: "key2"}, + OpenRouter: providerConfigV0{APIKey: "key3"}, + Groq: providerConfigV0{APIKey: "key4"}, + Zhipu: providerConfigV0{APIKey: "key5"}, + VLLM: providerConfigV0{APIKey: "key6"}, + Gemini: providerConfigV0{APIKey: "key7"}, + Nvidia: providerConfigV0{APIKey: "key8"}, + Ollama: providerConfigV0{APIKey: "key9"}, + Moonshot: providerConfigV0{APIKey: "key10"}, + ShengSuanYun: providerConfigV0{APIKey: "key11"}, + DeepSeek: providerConfigV0{APIKey: "key12"}, + Cerebras: providerConfigV0{APIKey: "key13"}, + Vivgrid: providerConfigV0{APIKey: "key14"}, + VolcEngine: providerConfigV0{APIKey: "key15"}, + GitHubCopilot: providerConfigV0{ConnectMode: "grpc"}, + Antigravity: providerConfigV0{AuthMethod: "oauth"}, + Qwen: providerConfigV0{APIKey: "key17"}, + Mistral: providerConfigV0{APIKey: "key18"}, + Avian: providerConfigV0{APIKey: "key19"}, + LongCat: providerConfigV0{APIKey: "key-longcat"}, + ModelScope: providerConfigV0{APIKey: "key-modelscope"}, }, } @@ -177,9 +178,9 @@ func TestConvertProvidersToModelList_AllProviders(t *testing.T) { func TestConvertProvidersToModelList_Proxy(t *testing.T) { cfg := &configV0{ - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{ - ProviderConfig: ProviderConfig{ + Providers: providersConfigV0{ + OpenAI: openAIProviderConfigV0{ + providerConfigV0: providerConfigV0{ APIKey: "key", Proxy: "http://proxy:8080", }, @@ -200,9 +201,9 @@ func TestConvertProvidersToModelList_Proxy(t *testing.T) { func TestConvertProvidersToModelList_RequestTimeout(t *testing.T) { cfg := &configV0{ - Providers: ProvidersConfig{ - Ollama: ProviderConfig{ - APIKey: "ollama-key", + Providers: providersConfigV0{ + Ollama: providerConfigV0{ + APIBase: "http://localhost:11434", RequestTimeout: 300, }, }, @@ -221,9 +222,9 @@ func TestConvertProvidersToModelList_RequestTimeout(t *testing.T) { func TestConvertProvidersToModelList_AuthMethod(t *testing.T) { cfg := &configV0{ - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{ - ProviderConfig: ProviderConfig{ + Providers: providersConfigV0{ + OpenAI: openAIProviderConfigV0{ + providerConfigV0: providerConfigV0{ AuthMethod: "oauth", }, }, @@ -247,8 +248,8 @@ func TestConvertProvidersToModelList_PreservesUserModel_DeepSeek(t *testing.T) { Model: "deepseek-reasoner", }, }, - Providers: ProvidersConfig{ - DeepSeek: ProviderConfig{APIKey: "sk-deepseek"}, + Providers: providersConfigV0{ + DeepSeek: providerConfigV0{APIKey: "sk-deepseek"}, }, } @@ -272,8 +273,8 @@ func TestConvertProvidersToModelList_PreservesUserModel_OpenAI(t *testing.T) { Model: "gpt-4-turbo", }, }, - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "sk-openai"}}, + Providers: providersConfigV0{ + OpenAI: openAIProviderConfigV0{providerConfigV0: providerConfigV0{APIKey: "sk-openai"}}, }, } @@ -296,8 +297,8 @@ func TestConvertProvidersToModelList_PreservesUserModel_Anthropic(t *testing.T) Model: "claude-opus-4-20250514", }, }, - Providers: ProvidersConfig{ - Anthropic: ProviderConfig{APIKey: "sk-ant"}, + Providers: providersConfigV0{ + Anthropic: providerConfigV0{APIKey: "sk-ant"}, }, } @@ -320,8 +321,8 @@ func TestConvertProvidersToModelList_PreservesUserModel_Qwen(t *testing.T) { Model: "qwen-plus", }, }, - Providers: ProvidersConfig{ - Qwen: ProviderConfig{APIKey: "sk-qwen"}, + Providers: providersConfigV0{ + Qwen: providerConfigV0{APIKey: "sk-qwen"}, }, } @@ -344,8 +345,8 @@ func TestConvertProvidersToModelList_UsesDefaultWhenNoUserModel(t *testing.T) { Model: "", // no model specified }, }, - Providers: ProvidersConfig{ - DeepSeek: ProviderConfig{APIKey: "sk-deepseek"}, + Providers: providersConfigV0{ + DeepSeek: providerConfigV0{APIKey: "sk-deepseek"}, }, } @@ -369,9 +370,9 @@ func TestConvertProvidersToModelList_MultipleProviders_PreservesUserModel(t *tes Model: "deepseek-reasoner", }, }, - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "sk-openai"}}, - DeepSeek: ProviderConfig{APIKey: "sk-deepseek"}, + Providers: providersConfigV0{ + OpenAI: openAIProviderConfigV0{providerConfigV0: providerConfigV0{APIKey: "sk-openai"}}, + DeepSeek: providerConfigV0{APIKey: "sk-deepseek"}, }, } @@ -400,13 +401,13 @@ func TestConvertProvidersToModelList_ProviderNameAliases(t *testing.T) { tests := []struct { providerAlias string expectedModel string - provider ProviderConfig + provider providerConfigV0 }{ - {"gpt", "openai/gpt-4-custom", ProviderConfig{APIKey: "key"}}, - {"claude", "anthropic/claude-custom", ProviderConfig{APIKey: "key"}}, - {"doubao", "volcengine/doubao-custom", ProviderConfig{APIKey: "key"}}, - {"tongyi", "qwen/qwen-custom", ProviderConfig{APIKey: "key"}}, - {"kimi", "moonshot/kimi-custom", ProviderConfig{APIKey: "key"}}, + {"gpt", "openai/gpt-4-custom", providerConfigV0{APIKey: "key"}}, + {"claude", "anthropic/claude-custom", providerConfigV0{APIKey: "key"}}, + {"doubao", "volcengine/doubao-custom", providerConfigV0{APIKey: "key"}}, + {"tongyi", "qwen/qwen-custom", providerConfigV0{APIKey: "key"}}, + {"kimi", "moonshot/kimi-custom", providerConfigV0{APIKey: "key"}}, } for _, tt := range tests { @@ -421,13 +422,13 @@ func TestConvertProvidersToModelList_ProviderNameAliases(t *testing.T) { ), }, }, - Providers: ProvidersConfig{}, + Providers: providersConfigV0{}, } // Set the appropriate provider config switch tt.providerAlias { case "gpt": - cfg.Providers.OpenAI = OpenAIProviderConfig{ProviderConfig: tt.provider} + cfg.Providers.OpenAI = openAIProviderConfigV0{providerConfigV0: tt.provider} case "claude": cfg.Providers.Anthropic = tt.provider case "doubao": @@ -473,8 +474,10 @@ func TestConvertProvidersToModelList_NoProviderField_SingleProvider(t *testing.T Model: "glm-4.7", }, }, - Providers: ProvidersConfig{ - Zhipu: ProviderConfig{APIKey: "test-zhipu-key"}, + Providers: providersConfigV0{ + Zhipu: providerConfigV0{ + APIKey: "test-zhipu-key", + }, }, } @@ -506,9 +509,9 @@ func TestConvertProvidersToModelList_NoProviderField_MultipleProviders(t *testin Model: "some-model", }, }, - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "openai-key"}}, - Zhipu: ProviderConfig{APIKey: "zhipu-key"}, + Providers: providersConfigV0{ + OpenAI: openAIProviderConfigV0{providerConfigV0: providerConfigV0{APIKey: "openai-key"}}, + Zhipu: providerConfigV0{APIKey: "zhipu-key"}, }, } @@ -539,8 +542,8 @@ func TestConvertProvidersToModelList_NoProviderField_NoModel(t *testing.T) { Model: "", }, }, - Providers: ProvidersConfig{ - Zhipu: ProviderConfig{APIKey: "zhipu-key"}, + Providers: providersConfigV0{ + Zhipu: providerConfigV0{APIKey: "zhipu-key"}, }, } @@ -592,8 +595,8 @@ func TestConvertProvidersToModelList_LegacyModelWithProtocolPrefix(t *testing.T) Model: "openrouter/auto", // Model already has protocol prefix }, }, - Providers: ProvidersConfig{ - OpenRouter: ProviderConfig{APIKey: "sk-or-test"}, + Providers: providersConfigV0{ + OpenRouter: providerConfigV0{APIKey: "sk-or-test"}, }, } diff --git a/pkg/config/model_config_test.go b/pkg/config/model_config_test.go index 5370255aa..3252d2f26 100644 --- a/pkg/config/model_config_test.go +++ b/pkg/config/model_config_test.go @@ -13,12 +13,20 @@ import ( ) func TestGetModelConfig_Found(t *testing.T) { - cfg := &Config{ - ModelList: []ModelConfig{ - {ModelName: "test-model", Model: "openai/gpt-4o", APIKey: "key1"}, - {ModelName: "other-model", Model: "anthropic/claude", APIKey: "key2"}, + cfg := (&Config{ + Version: CurrentVersion, + ModelList: []*ModelConfig{ + {ModelName: "test-model", Model: "openai/gpt-4o"}, + {ModelName: "other-model", Model: "anthropic/claude"}, }, - } + }).WithSecurity(&SecurityConfig{ModelList: map[string]ModelSecurityEntry{ + "test-model:0": { + APIKeys: []string{"key1"}, + }, + "other-model:0": { + APIKeys: []string{"key2"}, + }, + }}) result, err := cfg.GetModelConfig("test-model") if err != nil { @@ -30,11 +38,17 @@ func TestGetModelConfig_Found(t *testing.T) { } func TestGetModelConfig_NotFound(t *testing.T) { - cfg := &Config{ - ModelList: []ModelConfig{ - {ModelName: "test-model", Model: "openai/gpt-4o", APIKey: "key1"}, + cfg := (&Config{ + ModelList: []*ModelConfig{ + {ModelName: "test-model", Model: "openai/gpt-4o"}, }, - } + }).WithSecurity(&SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{ + "test-model:0": { + APIKeys: []string{"key1"}, + }, + }, + }) _, err := cfg.GetModelConfig("nonexistent") if err == nil { @@ -44,7 +58,7 @@ func TestGetModelConfig_NotFound(t *testing.T) { func TestGetModelConfig_EmptyList(t *testing.T) { cfg := &Config{ - ModelList: []ModelConfig{}, + ModelList: []*ModelConfig{}, } _, err := cfg.GetModelConfig("any-model") @@ -54,13 +68,25 @@ func TestGetModelConfig_EmptyList(t *testing.T) { } func TestGetModelConfig_RoundRobin(t *testing.T) { - cfg := &Config{ - ModelList: []ModelConfig{ - {ModelName: "lb-model", Model: "openai/gpt-4o-1", APIKey: "key1"}, - {ModelName: "lb-model", Model: "openai/gpt-4o-2", APIKey: "key2"}, - {ModelName: "lb-model", Model: "openai/gpt-4o-3", APIKey: "key3"}, + cfg := (&Config{ + ModelList: []*ModelConfig{ + {ModelName: "lb-model", Model: "openai/gpt-4o-1"}, + {ModelName: "lb-model", Model: "openai/gpt-4o-2"}, + {ModelName: "lb-model", Model: "openai/gpt-4o-3"}, }, - } + }).WithSecurity(&SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{ + "lb-model:0": { + APIKeys: []string{"key1"}, + }, + "lb-model:1": { + APIKeys: []string{"key2"}, + }, + "lb-model:2": { + APIKeys: []string{"key3"}, + }, + }, + }) // Test round-robin distribution results := make(map[string]int) @@ -84,10 +110,10 @@ func TestGetModelConfig_RoundRobinStartsFromFirstMatch(t *testing.T) { rrCounter.Store(0) cfg := &Config{ - ModelList: []ModelConfig{ - {ModelName: "lb-model", Model: "openai/gpt-4o-1", APIKey: "key1"}, - {ModelName: "lb-model", Model: "openai/gpt-4o-2", APIKey: "key2"}, - {ModelName: "lb-model", Model: "openai/gpt-4o-3", APIKey: "key3"}, + ModelList: []*ModelConfig{ + {ModelName: "lb-model", Model: "openai/gpt-4o-1", apiKeys: []string{"key1"}}, + {ModelName: "lb-model", Model: "openai/gpt-4o-2", apiKeys: []string{"key2"}}, + {ModelName: "lb-model", Model: "openai/gpt-4o-3", apiKeys: []string{"key3"}}, }, } @@ -112,9 +138,9 @@ func TestGetModelConfig_RoundRobinStartsFromFirstMatch(t *testing.T) { func TestGetModelConfig_Concurrent(t *testing.T) { cfg := &Config{ - ModelList: []ModelConfig{ - {ModelName: "concurrent-model", Model: "openai/gpt-4o-1", APIKey: "key1"}, - {ModelName: "concurrent-model", Model: "openai/gpt-4o-2", APIKey: "key2"}, + ModelList: []*ModelConfig{ + {ModelName: "concurrent-model", Model: "openai/gpt-4o-1", apiKeys: []string{"key1"}}, + {ModelName: "concurrent-model", Model: "openai/gpt-4o-2", apiKeys: []string{"key2"}}, }, } @@ -234,7 +260,7 @@ func TestConfig_ValidateModelList(t *testing.T) { { name: "valid list", config: &Config{ - ModelList: []ModelConfig{ + ModelList: []*ModelConfig{ {ModelName: "test1", Model: "openai/gpt-4o"}, {ModelName: "test2", Model: "anthropic/claude"}, }, @@ -244,7 +270,7 @@ func TestConfig_ValidateModelList(t *testing.T) { { name: "invalid entry", config: &Config{ - ModelList: []ModelConfig{ + ModelList: []*ModelConfig{ {ModelName: "test1", Model: "openai/gpt-4o"}, {ModelName: "", Model: "anthropic/claude"}, // missing model_name }, @@ -255,7 +281,7 @@ func TestConfig_ValidateModelList(t *testing.T) { { name: "empty list", config: &Config{ - ModelList: []ModelConfig{}, + ModelList: []*ModelConfig{}, }, wantErr: false, }, @@ -263,10 +289,7 @@ func TestConfig_ValidateModelList(t *testing.T) { // Load balancing: multiple entries with same model_name are allowed name: "duplicate model_name for load balancing", config: &Config{ - ModelList: []ModelConfig{ - {ModelName: "gpt-4", Model: "openai/gpt-4o", APIKey: "key1"}, - {ModelName: "gpt-4", Model: "openai/gpt-4-turbo", APIKey: "key2"}, - }, + ModelList: []*ModelConfig{}, }, wantErr: false, // Changed: duplicates are allowed for load balancing }, @@ -274,7 +297,7 @@ func TestConfig_ValidateModelList(t *testing.T) { // Load balancing: non-adjacent entries with same model_name are also allowed name: "duplicate model_name non-adjacent for load balancing", config: &Config{ - ModelList: []ModelConfig{ + ModelList: []*ModelConfig{ {ModelName: "model-a", Model: "openai/gpt-4o"}, {ModelName: "model-b", Model: "anthropic/claude"}, {ModelName: "model-a", Model: "openai/gpt-4-turbo"}, diff --git a/pkg/config/multikey_test.go b/pkg/config/multikey_test.go index b899b991c..cc529905c 100644 --- a/pkg/config/multikey_test.go +++ b/pkg/config/multikey_test.go @@ -5,15 +5,15 @@ import ( ) func TestExpandMultiKeyModels_SingleKey(t *testing.T) { - models := []ModelConfig{ + models := []*ModelConfig{ { ModelName: "gpt-4", Model: "openai/gpt-4o", - APIKey: "single-key", + apiKeys: []string{"single-key"}, }, } - result := ExpandMultiKeyModels(models) + result := expandMultiKeyModels(models) if len(result) != 1 { t.Fatalf("expected 1 model, got %d", len(result)) @@ -23,8 +23,8 @@ func TestExpandMultiKeyModels_SingleKey(t *testing.T) { t.Errorf("expected model_name 'gpt-4', got %q", result[0].ModelName) } - if result[0].APIKey != "single-key" { - t.Errorf("expected api_key 'single-key', got %q", result[0].APIKey) + if result[0].APIKey() != "single-key" { + t.Errorf("expected api_key 'single-key', got %q", result[0].APIKey()) } if len(result[0].Fallbacks) != 0 { @@ -33,16 +33,16 @@ func TestExpandMultiKeyModels_SingleKey(t *testing.T) { } func TestExpandMultiKeyModels_APIKeysOnly(t *testing.T) { - models := []ModelConfig{ + models := []*ModelConfig{ { ModelName: "glm-4.7", Model: "zhipu/glm-4.7", APIBase: "https://api.example.com", - APIKeys: []string{"key1", "key2", "key3"}, + apiKeys: []string{"key1", "key2", "key3"}, }, } - result := ExpandMultiKeyModels(models) + result := expandMultiKeyModels(models) // Should expand to 3 models if len(result) != 3 { @@ -54,8 +54,8 @@ func TestExpandMultiKeyModels_APIKeysOnly(t *testing.T) { if primary.ModelName != "glm-4.7" { t.Errorf("expected primary model_name 'glm-4.7', got %q", primary.ModelName) } - if primary.APIKey != "key1" { - t.Errorf("expected primary api_key 'key1', got %q", primary.APIKey) + if primary.APIKey() != "key1" { + t.Errorf("expected primary api_key 'key1', got %q", primary.APIKey()) } if len(primary.Fallbacks) != 2 { t.Errorf("expected 2 fallbacks, got %d", len(primary.Fallbacks)) @@ -72,8 +72,8 @@ func TestExpandMultiKeyModels_APIKeysOnly(t *testing.T) { if second.ModelName != "glm-4.7__key_1" { t.Errorf("expected second model_name 'glm-4.7__key_1', got %q", second.ModelName) } - if second.APIKey != "key2" { - t.Errorf("expected second api_key 'key2', got %q", second.APIKey) + if second.APIKey() != "key2" { + t.Errorf("expected second api_key 'key2', got %q", second.APIKey()) } // Third entry should be key3 @@ -81,22 +81,21 @@ func TestExpandMultiKeyModels_APIKeysOnly(t *testing.T) { if third.ModelName != "glm-4.7__key_2" { t.Errorf("expected third model_name 'glm-4.7__key_2', got %q", third.ModelName) } - if third.APIKey != "key3" { - t.Errorf("expected third api_key 'key3', got %q", third.APIKey) + if third.APIKey() != "key3" { + t.Errorf("expected third api_key 'key3', got %q", third.APIKey()) } } func TestExpandMultiKeyModels_APIKeyAndAPIKeys(t *testing.T) { - models := []ModelConfig{ + models := []*ModelConfig{ { ModelName: "gpt-4", Model: "openai/gpt-4o", - APIKey: "key0", - APIKeys: []string{"key1", "key2"}, + apiKeys: []string{"key0", "key1", "key2"}, }, } - result := ExpandMultiKeyModels(models) + result := expandMultiKeyModels(models) // Should expand to 3 models (key0 from APIKey + key1, key2 from APIKeys) if len(result) != 3 { @@ -105,8 +104,8 @@ func TestExpandMultiKeyModels_APIKeyAndAPIKeys(t *testing.T) { // Primary should use key0 primary := result[2] - if primary.APIKey != "key0" { - t.Errorf("expected primary api_key 'key0', got %q", primary.APIKey) + if primary.APIKey() != "key0" { + t.Errorf("expected primary api_key 'key0', got %q", primary.APIKey()) } if len(primary.Fallbacks) != 2 { t.Errorf("expected 2 fallbacks, got %d", len(primary.Fallbacks)) @@ -114,16 +113,15 @@ func TestExpandMultiKeyModels_APIKeyAndAPIKeys(t *testing.T) { } func TestExpandMultiKeyModels_WithExistingFallbacks(t *testing.T) { - models := []ModelConfig{ - { - ModelName: "gpt-4", - Model: "openai/gpt-4o", - APIKeys: []string{"key1", "key2"}, - Fallbacks: []string{"claude-3"}, - }, + modelCfg := &ModelConfig{ + ModelName: "gpt-4", + Model: "openai/gpt-4o", } + modelCfg.apiKeys = []string{"key0", "key1"} // Use internal field for multi-key testing + modelCfg.Fallbacks = []string{"claude-3"} + models := []*ModelConfig{modelCfg} - result := ExpandMultiKeyModels(models) + result := expandMultiKeyModels(models) primary := result[1] // With 2 keys, we get 1 key fallback + 1 existing fallback = 2 total @@ -141,16 +139,15 @@ func TestExpandMultiKeyModels_WithExistingFallbacks(t *testing.T) { } func TestExpandMultiKeyModels_EmptyAPIKeys(t *testing.T) { - models := []ModelConfig{ + models := []*ModelConfig{ { ModelName: "gpt-4", Model: "openai/gpt-4o", - APIKey: "", - APIKeys: []string{}, + apiKeys: []string{}, }, } - result := ExpandMultiKeyModels(models) + result := expandMultiKeyModels(models) // Should keep as-is with no changes if len(result) != 1 { @@ -163,25 +160,25 @@ func TestExpandMultiKeyModels_EmptyAPIKeys(t *testing.T) { } func TestExpandMultiKeyModels_Deduplication(t *testing.T) { - models := []ModelConfig{ + models := []*ModelConfig{ { ModelName: "gpt-4", Model: "openai/gpt-4o", - APIKey: "key1", - APIKeys: []string{"key1", "key2", "key1"}, // Duplicate key1 + apiKeys: []string{"key1", "key2", "key1"}, // Duplicate key1 }, } - result := ExpandMultiKeyModels(models) + result := expandMultiKeyModels(models) + t.Logf("result: %#v", result) // Should only create 2 models (deduplicated keys) if len(result) != 2 { t.Fatalf("expected 2 models (deduplicated), got %d", len(result)) } primary := result[1] - if primary.APIKey != "key1" { - t.Errorf("expected primary api_key 'key1', got %q", primary.APIKey) + if primary.APIKey() != "key1" { + t.Errorf("expected primary api_key 'key1', got %q", primary.APIKey()) } if len(primary.Fallbacks) != 1 { t.Errorf("expected 1 fallback, got %d", len(primary.Fallbacks)) @@ -189,21 +186,20 @@ func TestExpandMultiKeyModels_Deduplication(t *testing.T) { } func TestExpandMultiKeyModels_PreservesOtherFields(t *testing.T) { - models := []ModelConfig{ - { - ModelName: "gpt-4", - Model: "openai/gpt-4o", - APIBase: "https://api.example.com", - APIKeys: []string{"key1", "key2"}, - Proxy: "http://proxy:8080", - RPM: 60, - MaxTokensField: "max_completion_tokens", - RequestTimeout: 30, - ThinkingLevel: "high", - }, + modelCfg := &ModelConfig{ + ModelName: "gpt-4", + Model: "openai/gpt-4o", + APIBase: "https://api.example.com", + Proxy: "http://proxy:8080", + RPM: 60, + MaxTokensField: "max_completion_tokens", + RequestTimeout: 30, + ThinkingLevel: "high", } + modelCfg.apiKeys = []string{"key0", "key1"} // Use internal field for multi-key testing + models := []*ModelConfig{modelCfg} - result := ExpandMultiKeyModels(models) + result := expandMultiKeyModels(models) // Check primary entry preserves all fields primary := result[1] @@ -250,13 +246,13 @@ func TestMergeAPIKeys(t *testing.T) { expected: nil, }, { - name: "only apiKey", + name: "only ApiKey", apiKey: "key1", apiKeys: nil, expected: []string{"key1"}, }, { - name: "only apiKeys", + name: "only ApiKeys", apiKey: "", apiKeys: []string{"key1", "key2"}, expected: []string{"key1", "key2"}, diff --git a/pkg/config/security.go b/pkg/config/security.go new file mode 100644 index 000000000..8f2018196 --- /dev/null +++ b/pkg/config/security.go @@ -0,0 +1,205 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package config + +import ( + "fmt" + "os" + "path/filepath" + + "github.com/caarlos0/env/v11" + "github.com/tencent-connect/botgo/log" + "gopkg.in/yaml.v3" + + "github.com/sipeed/picoclaw/pkg/fileutil" +) + +const ( + SecurityConfigFile = "security.yml" +) + +// SecurityConfig stores all sensitive data (API keys, tokens, secrets, passwords) +// This data is loaded from security.yml and kept separate from the main config +type SecurityConfig struct { + // Model API keys. Map key is model_name, can include suffix like "abc:0", "abc:1" + // for load balancing with same model_name. The suffix ":N" is used to distinguish + // multiple configs that share the same base model_name. + ModelList map[string]ModelSecurityEntry `yaml:"model_list,omitempty"` + + // Channel tokens/secrets + Channels ChannelsSecurity `yaml:"channels,omitempty"` + + Web WebToolsSecurity `yaml:"web,omitempty"` + Skills SkillsSecurity `yaml:"skills,omitempty"` +} + +// ModelSecurityEntry stores security data for a model +type ModelSecurityEntry struct { + APIKeys []string `yaml:"api_keys,omitempty"` // API authentication keys (multiple keys for failover) +} + +// ChannelsSecurity stores channel-related security data +type ChannelsSecurity struct { + Telegram *TelegramSecurity `yaml:"telegram,omitempty"` + Feishu *FeishuSecurity `yaml:"feishu,omitempty"` + Discord *DiscordSecurity `yaml:"discord,omitempty"` + QQ *QQSecurity `yaml:"qq,omitempty"` + DingTalk *DingTalkSecurity `yaml:"dingtalk,omitempty"` + Slack *SlackSecurity `yaml:"slack,omitempty"` + Matrix *MatrixSecurity `yaml:"matrix,omitempty"` + LINE *LINESecurity `yaml:"line,omitempty"` + OneBot *OneBotSecurity `yaml:"onebot,omitempty"` + WeCom *WeComSecurity `yaml:"wecom,omitempty"` + WeComApp *WeComAppSecurity `yaml:"wecom_app,omitempty"` + WeComAIBot *WeComAIBotSecurity `yaml:"wecom_aibot,omitempty"` + Pico *PicoSecurity `yaml:"pico,omitempty"` + IRC *IRCSecurity `yaml:"irc,omitempty"` +} + +type TelegramSecurity struct { + Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_TELEGRAM_TOKEN"` +} + +type FeishuSecurity struct { + AppSecret string `yaml:"app_secret,omitempty" env:"PICOCLAW_CHANNELS_FEISHU_APP_SECRET"` + EncryptKey string `yaml:"encrypt_key,omitempty" env:"PICOCLAW_CHANNELS_FEISHU_ENCRYPT_KEY"` + VerificationToken string `yaml:"verification_token,omitempty" env:"PICOCLAW_CHANNELS_FEISHU_VERIFICATION_TOKEN"` +} + +type DiscordSecurity struct { + Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_DISCORD_TOKEN"` +} + +type QQSecurity struct { + AppSecret string `yaml:"app_secret,omitempty" env:"PICOCLAW_CHANNELS_QQ_APP_SECRET"` +} + +type DingTalkSecurity struct { + ClientSecret string `yaml:"client_secret,omitempty" env:"PICOCLAW_CHANNELS_DINGTALK_CLIENT_SECRET"` +} + +type SlackSecurity struct { + BotToken string `yaml:"bot_token,omitempty" env:"PICOCLAW_CHANNELS_SLACK_BOT_TOKEN"` + AppToken string `yaml:"app_token,omitempty" env:"PICOCLAW_CHANNELS_SLACK_APP_TOKEN"` +} + +type MatrixSecurity struct { + AccessToken string `yaml:"access_token,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_ACCESS_TOKEN"` +} + +type LINESecurity struct { + ChannelSecret string `yaml:"channel_secret,omitempty" env:"PICOCLAW_CHANNELS_LINE_CHANNEL_SECRET"` + ChannelAccessToken string `yaml:"channel_access_token,omitempty" env:"PICOCLAW_CHANNELS_LINE_CHANNEL_ACCESS_TOKEN"` +} + +type OneBotSecurity struct { + AccessToken string `yaml:"access_token,omitempty" env:"PICOCLAW_CHANNELS_ONEBOT_ACCESS_TOKEN"` +} + +type WeComSecurity struct { + Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_WECOM_TOKEN"` + EncodingAESKey string `yaml:"encoding_aes_key,omitempty" env:"PICOCLAW_CHANNELS_WECOM_ENCODING_AES_KEY"` +} + +type WeComAppSecurity struct { + CorpSecret string `yaml:"corp_secret,omitempty" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_SECRET"` + Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_WECOM_APP_TOKEN"` + EncodingAESKey string `yaml:"encoding_aes_key,omitempty" env:"PICOCLAW_CHANNELS_WECOM_APP_ENCODING_AES_KEY"` +} + +type WeComAIBotSecurity struct { + Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_TOKEN"` + EncodingAESKey string `yaml:"encoding_aes_key,omitempty" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENCODING_AES_KEY"` +} + +type PicoSecurity struct { + Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_PICO_TOKEN"` +} + +type IRCSecurity struct { + Password string `yaml:"password,omitempty" env:"PICOCLAW_CHANNELS_IRC_PASSWORD"` + NickServPassword string `yaml:"nickserv_password,omitempty" env:"PICOCLAW_CHANNELS_IRC_NICKSERV_PASSWORD"` + SASLPassword string `yaml:"sasl_password,omitempty" env:"PICOCLAW_CHANNELS_IRC_SASL_PASSWORD"` +} + +type WebToolsSecurity struct { + Brave *BraveSecurity `yaml:"brave,omitempty"` + Tavily *TavilySecurity `yaml:"tavily,omitempty"` + Perplexity *PerplexitySecurity `yaml:"perplexity,omitempty"` + GLMSearch *GLMSearchSecurity `yaml:"glm_search,omitempty"` +} + +type BraveSecurity struct { + APIKeys []string `yaml:"api_keys,omitempty"` +} + +type TavilySecurity struct { + APIKeys []string `yaml:"api_keys,omitempty"` +} + +type PerplexitySecurity struct { + APIKeys []string `yaml:"api_keys,omitempty"` +} + +type GLMSearchSecurity struct { + APIKey string `yaml:"api_key,omitempty"` +} + +type SkillsSecurity struct { + Github *GithubSecurity `yaml:"github,omitempty"` + ClawHub *ClawHubSecurity `yaml:"clawhub,omitempty"` +} + +type GithubSecurity struct { + Token string `yaml:"token,omitempty"` +} + +type ClawHubSecurity struct { + AuthToken string `yaml:"auth_token,omitempty"` +} + +// securityPath returns the path to security.yml relative to the config file +func securityPath(configPath string) string { + configDir := filepath.Dir(configPath) + return filepath.Join(configDir, SecurityConfigFile) +} + +// loadSecurityConfig loads the security configuration from security.yml +// Returns an empty SecurityConfig if the file doesn't exist +func loadSecurityConfig(securityPath string) (*SecurityConfig, error) { + data, err := os.ReadFile(securityPath) + if err != nil { + if os.IsNotExist(err) { + return &SecurityConfig{}, nil + } + return nil, fmt.Errorf("failed to read security config: %w", err) + } + + var sec SecurityConfig + if err := yaml.Unmarshal(data, &sec); err != nil { + return nil, fmt.Errorf("failed to parse security config: %w", err) + } + + // No need to validate model_name format here - both formats are supported: + // - "model-name:0" (with index for multiple entries) + // - "model-name" (without index for single entry or default to index 0) + + if err := env.Parse(&sec); err != nil { + log.Errorf("failed to parse environment variables: %v", err) + return nil, err + } + + return &sec, nil +} + +// saveSecurityConfig saves the security configuration to security.yml +func saveSecurityConfig(securityPath string, sec *SecurityConfig) error { + data, err := yaml.Marshal(sec) + if err != nil { + return fmt.Errorf("failed to marshal security config: %w", err) + } + return fileutil.WriteFileAtomic(securityPath, data, 0o600) +} diff --git a/pkg/config/security_integration_test.go b/pkg/config/security_integration_test.go new file mode 100644 index 000000000..99d4f01df --- /dev/null +++ b/pkg/config/security_integration_test.go @@ -0,0 +1,472 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package config + +import ( + "encoding/json" + "os" + "path/filepath" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// Test JSON unmarshal of private fields +func TestJSONUnmarshalPrivateFields(t *testing.T) { + //nolint: govet + type testStruct struct { + PublicField string `json:"public"` + privateField string `json:"private"` + } + + data := `{"public": "pub", "private": "priv"}` + var s testStruct + if err := json.Unmarshal([]byte(data), &s); err != nil { + t.Fatalf("JSON unmarshal failed: %v", err) + } + + t.Logf("PublicField: %s", s.PublicField) + t.Logf("privateField: %s", s.privateField) + + if s.PublicField != "pub" { + t.Errorf("PublicField = %q, want 'pub'", s.PublicField) + } + // This should fail because privateField is unexported + if s.privateField != "priv" { + t.Logf("privateField = %q, want 'priv' - THIS IS EXPECTED TO FAIL", s.privateField) + } +} + +func TestSecurityConfigIntegration(t *testing.T) { + t.Run("Full workflow with security references", func(t *testing.T) { + tmpDir := t.TempDir() + + // Create config.json with references + configPath := filepath.Join(tmpDir, "config.json") + configContent := `{ + "version": 1, + "model_list": [ + { + "model_name": "test-model", + "model": "openai/test-model", + "api_base": "https://api.openai.com/v1", + "api_key": "ref:model_list.test-model.api_key" + } + ], + "channels": { + "telegram": { + "enabled": true, + "token": "ref:channels.telegram.token" + } + }, + "tools": { + "web": { + "brave": { + "enabled": true, + "api_key": "ref:web.brave.api_key" + } + }, + "skills": { + "github": { + "token": "ref:skills.github.token" + } + } + } +}` + err := os.WriteFile(configPath, []byte(configContent), 0o644) + require.NoError(t, err) + + // Create security.yml with actual values + securityPath := filepath.Join(tmpDir, "security.yml") + securityContent := `model_list: + test-model: + api_keys: + - "sk-test-api-key-12345" + +channels: + telegram: + token: "123456789:ABCdefGHIjklMNOpqrsTUVwxyz" + +web: + brave: + api_keys: + - "BSAbrave-api-key-67890" + +skills: + github: + token: "ghp_github-token-abc123"` + err = os.WriteFile(securityPath, []byte(securityContent), 0o600) + require.NoError(t, err) + + // Load config and verify references are resolved + cfg, err := LoadConfig(configPath) + require.NoError(t, err) + require.NotNil(t, cfg) + + // Verify model API key is resolved + assert.Equal(t, 1, len(cfg.ModelList)) + assert.Equal(t, "test-model", cfg.ModelList[0].ModelName) + assert.Equal(t, "sk-test-api-key-12345", cfg.ModelList[0].apiKeys[0]) + + // Verify channel token is resolved + assert.Equal(t, "123456789:ABCdefGHIjklMNOpqrsTUVwxyz", cfg.Channels.Telegram.token) + + // Verify web tool API key is resolved + assert.Equal(t, "BSAbrave-api-key-67890", cfg.Tools.Web.Brave.APIKey()) + + // Verify skills token is resolved + assert.Equal(t, "ghp_github-token-abc123", cfg.Tools.Skills.Github.token) + }) +} + +func TestSecurityConfigWithAPIKeysArray(t *testing.T) { + t.Run("Multiple API keys via security", func(t *testing.T) { + tmpDir := t.TempDir() + + // Create config with APIKeys array + configPath := filepath.Join(tmpDir, "config.json") + configContent := `{ + "version": 1, + "model_list": [ + { + "model_name": "multi-key-model", + "model": "openai/multi-key-model" + } + ] +}` + err := os.WriteFile(configPath, []byte(configContent), 0o644) + require.NoError(t, err) + + // Create security.yml + securityPath := filepath.Join(tmpDir, "security.yml") + securityContent := `model_list: + multi-key-model:0: + api_key: "sk-key-1" + api_keys: + - "sk-key-1" + - "sk-key-2" + - "sk-key-3" +` + err = os.WriteFile(securityPath, []byte(securityContent), 0o600) + require.NoError(t, err) + + // Load config + cfg, err := LoadConfig(configPath) + require.NoError(t, err) + + t.Logf("Config: %+v", cfg.ModelList) + for _, m := range cfg.ModelList { + t.Logf("Model: %+v", m) + } + // Verify multi-key expansion works + assert.Equal(t, 3, len(cfg.ModelList)) + assert.Equal(t, "multi-key-model", cfg.ModelList[2].ModelName) + }) +} + +func TestAllSecurityKeysAccessible(t *testing.T) { + t.Run("All security keys accessible via Key() methods including file://", func(t *testing.T) { + tmpDir := t.TempDir() + + // Create test files for file:// references + modelAPIKeyFile := filepath.Join(tmpDir, "model_api_key.txt") + err := os.WriteFile(modelAPIKeyFile, []byte("sk-model-from-file-12345"), 0o600) + require.NoError(t, err) + + braveAPIKeyFile := filepath.Join(tmpDir, "brave_api_key.txt") + err = os.WriteFile(braveAPIKeyFile, []byte("BSA-brave-from-file-67890"), 0o600) + require.NoError(t, err) + + tavilyAPIKeyFile := filepath.Join(tmpDir, "tavily_api_key.txt") + err = os.WriteFile(tavilyAPIKeyFile, []byte("tvly-tavily-from-file-11111"), 0o600) + require.NoError(t, err) + + perplexityAPIKeyFile := filepath.Join(tmpDir, "perplexity_api_key.txt") + err = os.WriteFile(perplexityAPIKeyFile, []byte("pplx-perplexity-from-file-22222"), 0o600) + require.NoError(t, err) + + githubTokenFile := filepath.Join(tmpDir, "github_token.txt") + err = os.WriteFile(githubTokenFile, []byte("ghp-github-from-file-abc123"), 0o600) + require.NoError(t, err) + + clawhubAuthTokenFile := filepath.Join(tmpDir, "clawhub_auth_token.txt") + err = os.WriteFile(clawhubAuthTokenFile, []byte("clawhub-auth-token-from-file"), 0o600) + require.NoError(t, err) + + // Create config.json without sensitive values (they'll be in security.yml) + configPath := filepath.Join(tmpDir, "config.json") + configContent := `{ + "version": 1, + "model_list": [ + { + "model_name": "test-model-1", + "model": "openai/test-model-1" + } + ], + "channels": { + "telegram": { + "enabled": true + }, + "feishu": { + "enabled": true, + "app_id": "test_app_id" + }, + "discord": { + "enabled": true + }, + "dingtalk": { + "enabled": true, + "client_id": "test_client_id" + }, + "slack": { + "enabled": true + }, + "matrix": { + "enabled": true, + "homeserver": "https://matrix.org", + "user_id": "@test:matrix.org" + }, + "line": { + "enabled": true, + "webhook_host": "localhost", + "webhook_port": 8080, + "webhook_path": "/webhook" + }, + "onebot": { + "enabled": true, + "ws_url": "ws://localhost:8080" + }, + "wecom": { + "enabled": true, + "webhook_url": "https://qyapi.weixin.qq.com/cgi-bin/webhook" + }, + "wecom_app": { + "enabled": true, + "corp_id": "test_corp_id", + "agent_id": 123456 + }, + "wecom_aibot": { + "enabled": true + }, + "pico": { + "enabled": true + }, + "irc": { + "enabled": true, + "server": "irc.example.com", + "nick": "testbot" + }, + "qq": { + "enabled": true, + "app_id": "test_qq_app_id" + } + }, + "tools": { + "web": { + "brave": { + "enabled": true + }, + "tavily": { + "enabled": true + }, + "perplexity": { + "enabled": true + }, + "glm_search": { + "enabled": true + } + }, + "skills": { + "github": {} + } + } +}` + err = os.WriteFile(configPath, []byte(configContent), 0o644) + require.NoError(t, err) + + // Create security.yml with file:// references and plaintext values + securityPath := filepath.Join(tmpDir, "security.yml") + securityContent := `model_list: + test-model-1: + api_keys: + - "file://model_api_key.txt" + +channels: + telegram: + token: "123456789:ABCdefGHIjklMNOpqrsTUVwxyz" + feishu: + app_secret: "feishu_test_app_secret" + encrypt_key: "feishu_test_encrypt_key" + verification_token: "feishu_test_verification_token" + discord: + token: "discord_test_bot_token_xyz" + dingtalk: + client_secret: "dingtalk_test_client_secret" + slack: + bot_token: "xoxb-slack-bot-token-123" + app_token: "xapp-slack-app-token-456" + matrix: + access_token: "matrix_test_access_token" + line: + channel_secret: "line_test_channel_secret" + channel_access_token: "line_test_channel_access_token" + onebot: + access_token: "onebot_test_access_token" + wecom: + token: "wecom_test_webhook_token" + encoding_aes_key: "wecom_test_aes_key" + wecom_app: + corp_secret: "wecom_app_test_corp_secret" + token: "wecom_app_test_token" + encoding_aes_key: "wecom_app_test_aes_key" + wecom_aibot: + token: "wecom_aibot_test_token" + encoding_aes_key: "wecom_aibot_test_aes_key" + pico: + token: "pico_test_token" + irc: + password: "irc_test_password" + nickserv_password: "irc_test_nickserv_password" + sasl_password: "irc_test_sasl_password" + qq: + app_secret: "qq_test_app_secret" + +web: + brave: + api_keys: + - "file://brave_api_key.txt" + tavily: + api_keys: + - "file://tavily_api_key.txt" + perplexity: + api_keys: + - "file://perplexity_api_key.txt" + glm_search: + api_key: "glm-test-glm-search-key" + +skills: + github: + token: "file://github_token.txt" + clawhub: + auth_token: "file://clawhub_auth_token.txt" +` + err = os.WriteFile(securityPath, []byte(securityContent), 0o600) + require.NoError(t, err) + + // Load config and verify all security keys are accessible + cfg, err := LoadConfig(configPath) + require.NoError(t, err) + require.NotNil(t, cfg) + + // Verify Model API keys + assert.Equal(t, 1, len(cfg.ModelList)) + assert.Equal(t, "test-model-1", cfg.ModelList[0].ModelName) + // file:// reference should be resolved + assert.Equal(t, "sk-model-from-file-12345", cfg.ModelList[0].APIKey()) + t.Logf("Model APIKey(): %s", cfg.ModelList[0].APIKey()) + + // Verify Channel tokens via Key() methods + // Telegram + assert.Equal(t, "123456789:ABCdefGHIjklMNOpqrsTUVwxyz", cfg.Channels.Telegram.Token()) + t.Logf("Telegram Token(): %s", cfg.Channels.Telegram.Token()) + + // Feishu + assert.Equal(t, "feishu_test_app_secret", cfg.Channels.Feishu.AppSecret()) + assert.Equal(t, "feishu_test_encrypt_key", cfg.Channels.Feishu.EncryptKey()) + assert.Equal(t, "feishu_test_verification_token", cfg.Channels.Feishu.VerificationToken()) + t.Logf("Feishu AppSecret(): %s", cfg.Channels.Feishu.AppSecret()) + t.Logf("Feishu EncryptKey(): %s", cfg.Channels.Feishu.EncryptKey()) + t.Logf("Feishu VerificationToken(): %s", cfg.Channels.Feishu.VerificationToken()) + + // Discord + assert.Equal(t, "discord_test_bot_token_xyz", cfg.Channels.Discord.Token()) + t.Logf("Discord Token(): %s", cfg.Channels.Discord.Token()) + + // DingTalk + assert.Equal(t, "dingtalk_test_client_secret", cfg.Channels.DingTalk.ClientSecret()) + t.Logf("DingTalk ClientSecret(): %s", cfg.Channels.DingTalk.ClientSecret()) + + // Slack + assert.Equal(t, "xoxb-slack-bot-token-123", cfg.Channels.Slack.BotToken()) + assert.Equal(t, "xapp-slack-app-token-456", cfg.Channels.Slack.AppToken()) + t.Logf("Slack BotToken(): %s", cfg.Channels.Slack.BotToken()) + t.Logf("Slack AppToken(): %s", cfg.Channels.Slack.AppToken()) + + // Matrix + assert.Equal(t, "matrix_test_access_token", cfg.Channels.Matrix.AccessToken()) + t.Logf("Matrix AccessToken(): %s", cfg.Channels.Matrix.AccessToken()) + + // LINE + assert.Equal(t, "line_test_channel_secret", cfg.Channels.LINE.ChannelSecret()) + assert.Equal(t, "line_test_channel_access_token", cfg.Channels.LINE.ChannelAccessToken()) + t.Logf("LINE ChannelSecret(): %s", cfg.Channels.LINE.ChannelSecret()) + t.Logf("LINE ChannelAccessToken(): %s", cfg.Channels.LINE.ChannelAccessToken()) + + // OneBot + assert.Equal(t, "onebot_test_access_token", cfg.Channels.OneBot.AccessToken()) + t.Logf("OneBot AccessToken(): %s", cfg.Channels.OneBot.AccessToken()) + + // WeCom + assert.Equal(t, "wecom_test_webhook_token", cfg.Channels.WeCom.Token()) + assert.Equal(t, "wecom_test_aes_key", cfg.Channels.WeCom.EncodingAESKey()) + t.Logf("WeCom Token(): %s", cfg.Channels.WeCom.Token()) + t.Logf("WeCom EncodingAESKey(): %s", cfg.Channels.WeCom.EncodingAESKey()) + + // WeCom App + assert.Equal(t, "wecom_app_test_corp_secret", cfg.Channels.WeComApp.CorpSecret()) + assert.Equal(t, "wecom_app_test_token", cfg.Channels.WeComApp.Token()) + assert.Equal(t, "wecom_app_test_aes_key", cfg.Channels.WeComApp.EncodingAESKey()) + t.Logf("WeComApp CorpSecret(): %s", cfg.Channels.WeComApp.CorpSecret()) + t.Logf("WeComApp Token(): %s", cfg.Channels.WeComApp.Token()) + t.Logf("WeComApp EncodingAESKey(): %s", cfg.Channels.WeComApp.EncodingAESKey()) + + // WeCom AI Bot + assert.Equal(t, "wecom_aibot_test_token", cfg.Channels.WeComAIBot.Token()) + assert.Equal(t, "wecom_aibot_test_aes_key", cfg.Channels.WeComAIBot.EncodingAESKey()) + t.Logf("WeComAIBot Token(): %s", cfg.Channels.WeComAIBot.Token()) + t.Logf("WeComAIBot EncodingAESKey(): %s", cfg.Channels.WeComAIBot.EncodingAESKey()) + + // Pico + assert.Equal(t, "pico_test_token", cfg.Channels.Pico.Token()) + t.Logf("Pico Token(): %s", cfg.Channels.Pico.Token()) + + // IRC + assert.Equal(t, "irc_test_password", cfg.Channels.IRC.Password()) + assert.Equal(t, "irc_test_nickserv_password", cfg.Channels.IRC.NickServPassword()) + assert.Equal(t, "irc_test_sasl_password", cfg.Channels.IRC.SASLPassword()) + t.Logf("IRC Password(): %s", cfg.Channels.IRC.Password()) + t.Logf("IRC NickServPassword(): %s", cfg.Channels.IRC.NickServPassword()) + t.Logf("IRC SASLPassword(): %s", cfg.Channels.IRC.SASLPassword()) + + // QQ + assert.Equal(t, "qq_test_app_secret", cfg.Channels.QQ.AppSecret()) + t.Logf("QQ AppSecret(): %s", cfg.Channels.QQ.AppSecret()) + + // Verify Web tool API keys + assert.Equal(t, "BSA-brave-from-file-67890", cfg.Tools.Web.Brave.APIKey()) + t.Logf("Brave APIKey(): %s", cfg.Tools.Web.Brave.APIKey()) + + assert.Equal(t, "tvly-tavily-from-file-11111", cfg.Tools.Web.Tavily.APIKey()) + t.Logf("Tavily APIKey(): %s", cfg.Tools.Web.Tavily.APIKey()) + + assert.Equal(t, "pplx-perplexity-from-file-22222", cfg.Tools.Web.Perplexity.APIKey()) + t.Logf("Perplexity APIKey(): %s", cfg.Tools.Web.Perplexity.APIKey()) + + // GLM Search - Note: GLM uses SetAPIKey (lowercase) internally + t.Logf("GLMSearch APIKey(): %s", cfg.Tools.Web.GLMSearch.APIKey()) + assert.Equal(t, "glm-test-glm-search-key", cfg.Tools.Web.GLMSearch.APIKey()) + + // Verify Skills tokens + assert.Equal(t, "ghp-github-from-file-abc123", cfg.Tools.Skills.Github.Token()) + t.Logf("Github Token(): %s", cfg.Tools.Skills.Github.Token()) + + assert.Equal(t, "clawhub-auth-token-from-file", cfg.Tools.Skills.Registries.ClawHub.AuthToken()) + t.Logf("ClawHub AuthToken(): %s", cfg.Tools.Skills.Registries.ClawHub.AuthToken()) + + t.Log("All security keys are successfully accessible via their respective Key() methods") + }) +} diff --git a/pkg/config/security_test.go b/pkg/config/security_test.go new file mode 100644 index 000000000..482b3578e --- /dev/null +++ b/pkg/config/security_test.go @@ -0,0 +1,90 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package config + +import ( + "os" + "path/filepath" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestSecurityConfig(t *testing.T) { + t.Run("LoadNonExistent", func(t *testing.T) { + sec, err := loadSecurityConfig("/nonexistent/security.yml") + require.NoError(t, err) + assert.NotNil(t, sec) + assert.Empty(t, sec.ModelList) + }) +} + +func TestSecurityPath(t *testing.T) { + tests := []struct { + name string + configDir string + want string + }{ + { + name: "standard path", + configDir: "/home/user/.picoclaw/config.json", + want: "/home/user/.picoclaw/security.yml", + }, + { + name: "nested path", + configDir: "/path/to/config/myconfig.json", + want: "/path/to/config/security.yml", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := securityPath(tt.configDir) + assert.Equal(t, tt.want, got) + }) + } +} + +func TestSaveAndLoadSecurityConfig(t *testing.T) { + tmpDir := t.TempDir() + secPath := filepath.Join(tmpDir, "security.yml") + + original := &SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{ + "model1:0": { + APIKeys: []string{"key1", "key2"}, + }, + }, + Channels: ChannelsSecurity{ + Telegram: &TelegramSecurity{ + Token: "telegram-token", + }, + }, + Web: WebToolsSecurity{ + Brave: &BraveSecurity{ + APIKeys: []string{"brave-api-key"}, + }, + }, + } + + // Save + err := saveSecurityConfig(secPath, original) + require.NoError(t, err) + + // Verify file was created with correct permissions + info, err := os.Stat(secPath) + require.NoError(t, err) + assert.Equal(t, os.FileMode(0o600), info.Mode()) + + // Load + loaded, err := loadSecurityConfig(secPath) + require.NoError(t, err) + + assert.Equal(t, original.ModelList, loaded.ModelList) + assert.Equal(t, original.Channels.Telegram.Token, loaded.Channels.Telegram.Token) + assert.EqualValues(t, original.Web.Brave.APIKeys, loaded.Web.Brave.APIKeys) +} diff --git a/pkg/migrate/sources/openclaw/openclaw_config.go b/pkg/migrate/sources/openclaw/openclaw_config.go index 317bd3e84..b56194b3d 100644 --- a/pkg/migrate/sources/openclaw/openclaw_config.go +++ b/pkg/migrate/sources/openclaw/openclaw_config.go @@ -981,13 +981,16 @@ func (c *PicoClawConfig) ToStandardConfig() *config.Config { cfg.Agents.Defaults.ModelFallbacks = c.Agents.Defaults.ModelFallbacks for _, m := range c.ModelList { - cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ + mc := &config.ModelConfig{ ModelName: m.ModelName, Model: m.Model, APIBase: m.APIBase, - APIKey: m.APIKey, Proxy: m.Proxy, - }) + } + if m.APIKey != "" { + mc.SetAPIKey(m.APIKey) + } + cfg.ModelList = append(cfg.ModelList, mc) } cfg.Channels = c.Channels.ToStandardChannels() @@ -1020,59 +1023,107 @@ func (c ChannelsConfig) ToStandardChannels() config.ChannelsConfig { Enabled: c.WhatsApp.Enabled, BridgeURL: c.WhatsApp.BridgeURL, }, - Telegram: config.TelegramConfig{ - Enabled: c.Telegram.Enabled, - Token: c.Telegram.Token, - Proxy: c.Telegram.Proxy, - }, - Feishu: config.FeishuConfig{ - Enabled: c.Feishu.Enabled, - AppID: c.Feishu.AppID, - AppSecret: c.Feishu.AppSecret, - EncryptKey: c.Feishu.EncryptKey, - VerificationToken: c.Feishu.VerificationToken, - }, - Discord: config.DiscordConfig{ - Enabled: c.Discord.Enabled, - Token: c.Discord.Token, - MentionOnly: c.Discord.MentionOnly, - }, + Telegram: func() config.TelegramConfig { + tc := config.TelegramConfig{ + Enabled: c.Telegram.Enabled, + Proxy: c.Telegram.Proxy, + } + if c.Telegram.Token != "" { + tc.SetToken(c.Telegram.Token) + } + return tc + }(), + Feishu: func() config.FeishuConfig { + fc := config.FeishuConfig{ + Enabled: c.Feishu.Enabled, + AppID: c.Feishu.AppID, + } + if c.Feishu.AppSecret != "" { + fc.SetAppSecret(c.Feishu.AppSecret) + } + if c.Feishu.EncryptKey != "" { + fc.SetEncryptKey(c.Feishu.EncryptKey) + } + if c.Feishu.VerificationToken != "" { + fc.SetVerificationToken(c.Feishu.VerificationToken) + } + return fc + }(), + Discord: func() config.DiscordConfig { + dc := config.DiscordConfig{ + Enabled: c.Discord.Enabled, + MentionOnly: c.Discord.MentionOnly, + } + if c.Discord.Token != "" { + dc.SetToken(c.Discord.Token) + } + return dc + }(), MaixCam: config.MaixCamConfig{ Enabled: c.MaixCam.Enabled, Host: c.MaixCam.Host, Port: c.MaixCam.Port, }, - QQ: config.QQConfig{ - Enabled: c.QQ.Enabled, - AppID: c.QQ.AppID, - AppSecret: c.QQ.AppSecret, - }, - DingTalk: config.DingTalkConfig{ - Enabled: c.DingTalk.Enabled, - ClientID: c.DingTalk.ClientID, - ClientSecret: c.DingTalk.ClientSecret, - }, - Slack: config.SlackConfig{ - Enabled: c.Slack.Enabled, - BotToken: c.Slack.BotToken, - AppToken: c.Slack.AppToken, - }, - Matrix: config.MatrixConfig{ - Enabled: c.Matrix.Enabled, - Homeserver: c.Matrix.Homeserver, - UserID: c.Matrix.UserID, - AccessToken: c.Matrix.AccessToken, - AllowFrom: c.Matrix.AllowFrom, - JoinOnInvite: true, - }, - LINE: config.LINEConfig{ - Enabled: c.LINE.Enabled, - ChannelSecret: c.LINE.ChannelSecret, - ChannelAccessToken: c.LINE.ChannelAccessToken, - WebhookHost: c.LINE.WebhookHost, - WebhookPort: c.LINE.WebhookPort, - WebhookPath: c.LINE.WebhookPath, - }, + QQ: func() config.QQConfig { + qc := config.QQConfig{ + Enabled: c.QQ.Enabled, + AppID: c.QQ.AppID, + } + if c.QQ.AppSecret != "" { + qc.SetAppSecret(c.QQ.AppSecret) + } + return qc + }(), + DingTalk: func() config.DingTalkConfig { + dt := config.DingTalkConfig{ + Enabled: c.DingTalk.Enabled, + ClientID: c.DingTalk.ClientID, + } + if c.DingTalk.ClientSecret != "" { + dt.SetClientSecret(c.DingTalk.ClientSecret) + } + return dt + }(), + Slack: func() config.SlackConfig { + sc := config.SlackConfig{ + Enabled: c.Slack.Enabled, + } + if c.Slack.BotToken != "" { + sc.SetBotToken(c.Slack.BotToken) + } + if c.Slack.AppToken != "" { + sc.SetAppToken(c.Slack.AppToken) + } + return sc + }(), + Matrix: func() config.MatrixConfig { + mc := config.MatrixConfig{ + Enabled: c.Matrix.Enabled, + Homeserver: c.Matrix.Homeserver, + UserID: c.Matrix.UserID, + AllowFrom: c.Matrix.AllowFrom, + JoinOnInvite: true, + } + if c.Matrix.AccessToken != "" { + mc.SetAccessToken(c.Matrix.AccessToken) + } + return mc + }(), + LINE: func() config.LINEConfig { + lc := config.LINEConfig{ + Enabled: c.LINE.Enabled, + WebhookHost: c.LINE.WebhookHost, + WebhookPort: c.LINE.WebhookPort, + WebhookPath: c.LINE.WebhookPath, + } + if c.LINE.ChannelSecret != "" { + lc.SetChannelSecret(c.LINE.ChannelSecret) + } + if c.LINE.ChannelAccessToken != "" { + lc.SetChannelAccessToken(c.LINE.ChannelAccessToken) + } + return lc + }(), } } @@ -1084,30 +1135,44 @@ func (c GatewayConfig) ToStandardGateway() config.GatewayConfig { } func (c ToolsConfig) ToStandardTools() config.ToolsConfig { + brave := config.BraveConfig{ + Enabled: c.Web.Brave.Enabled, + MaxResults: c.Web.Brave.MaxResults, + } + if c.Web.Brave.APIKey != "" { + brave.SetAPIKey(c.Web.Brave.APIKey) + } + if len(c.Web.Brave.APIKeys) > 0 { + brave.SetAPIKeys(c.Web.Brave.APIKeys) + } + + tavily := config.TavilyConfig{ + Enabled: c.Web.Tavily.Enabled, + BaseURL: c.Web.Tavily.BaseURL, + MaxResults: c.Web.Tavily.MaxResults, + } + if c.Web.Tavily.APIKey != "" { + tavily.SetAPIKey(c.Web.Tavily.APIKey) + } + + perplexity := config.PerplexityConfig{ + Enabled: c.Web.Perplexity.Enabled, + MaxResults: c.Web.Perplexity.MaxResults, + } + if c.Web.Perplexity.APIKey != "" { + perplexity.SetAPIKey(c.Web.Perplexity.APIKey) + } + return config.ToolsConfig{ Web: config.WebToolsConfig{ - Brave: config.BraveConfig{ - Enabled: c.Web.Brave.Enabled, - APIKey: c.Web.Brave.APIKey, - APIKeys: c.Web.Brave.APIKeys, - MaxResults: c.Web.Brave.MaxResults, - }, - Tavily: config.TavilyConfig{ - Enabled: c.Web.Tavily.Enabled, - APIKey: c.Web.Tavily.APIKey, - BaseURL: c.Web.Tavily.BaseURL, - MaxResults: c.Web.Tavily.MaxResults, - }, + Brave: brave, + Tavily: tavily, DuckDuckGo: config.DuckDuckGoConfig{ Enabled: c.Web.DuckDuckGo.Enabled, MaxResults: c.Web.DuckDuckGo.MaxResults, }, - Perplexity: config.PerplexityConfig{ - Enabled: c.Web.Perplexity.Enabled, - APIKey: c.Web.Perplexity.APIKey, - MaxResults: c.Web.Perplexity.MaxResults, - }, - Proxy: c.Web.Proxy, + Perplexity: perplexity, + Proxy: c.Web.Proxy, }, Cron: config.CronToolsConfig{ ExecTimeoutMinutes: c.Cron.ExecTimeoutMinutes, diff --git a/pkg/migrate/sources/openclaw/openclaw_config_test.go b/pkg/migrate/sources/openclaw/openclaw_config_test.go index 802693825..350b29776 100644 --- a/pkg/migrate/sources/openclaw/openclaw_config_test.go +++ b/pkg/migrate/sources/openclaw/openclaw_config_test.go @@ -697,7 +697,7 @@ func TestToStandardConfig(t *testing.T) { for _, m := range stdCfg.ModelList { if m.ModelName == "claude-sonnet-4-20250514" { foundModel = true - foundAPIKey = m.APIKey + foundAPIKey = m.APIKey() break } } @@ -711,8 +711,8 @@ func TestToStandardConfig(t *testing.T) { if !stdCfg.Channels.Telegram.Enabled { t.Error("telegram should be enabled") } - if stdCfg.Channels.Telegram.Token != "test-token" { - t.Errorf("expected token 'test-token', got '%s'", stdCfg.Channels.Telegram.Token) + if stdCfg.Channels.Telegram.Token() != "test-token" { + t.Errorf("expected token 'test-token', got '%s'", stdCfg.Channels.Telegram.Token()) } if stdCfg.Gateway.Port != 8080 { diff --git a/pkg/providers/claude_cli_provider_test.go b/pkg/providers/claude_cli_provider_test.go index 228cad9c9..bc9960f0c 100644 --- a/pkg/providers/claude_cli_provider_test.go +++ b/pkg/providers/claude_cli_provider_test.go @@ -413,7 +413,7 @@ func TestChat_EmptyWorkspaceDoesNotSetDir(t *testing.T) { func TestCreateProvider_ClaudeCli(t *testing.T) { cfg := config.DefaultConfig() - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ {ModelName: "claude-sonnet-4.6", Model: "claude-cli/claude-sonnet-4.6", Workspace: "/test/ws"}, } cfg.Agents.Defaults.ModelName = "claude-sonnet-4.6" @@ -434,7 +434,7 @@ func TestCreateProvider_ClaudeCli(t *testing.T) { func TestCreateProvider_ClaudeCode(t *testing.T) { cfg := config.DefaultConfig() - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ {ModelName: "claude-code", Model: "claude-cli/claude-code"}, } cfg.Agents.Defaults.ModelName = "claude-code" @@ -450,7 +450,7 @@ func TestCreateProvider_ClaudeCode(t *testing.T) { func TestCreateProvider_ClaudeCodec(t *testing.T) { cfg := config.DefaultConfig() - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ {ModelName: "claudecode", Model: "claude-cli/claudecode"}, } cfg.Agents.Defaults.ModelName = "claudecode" @@ -466,7 +466,7 @@ func TestCreateProvider_ClaudeCodec(t *testing.T) { func TestCreateProvider_ClaudeCliDefaultWorkspace(t *testing.T) { cfg := config.DefaultConfig() - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ {ModelName: "claude-cli", Model: "claude-cli/claude-sonnet"}, } cfg.Agents.Defaults.ModelName = "claude-cli" diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index dbb5db5cb..ff2cff9d6 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -80,7 +80,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err return provider, modelID, nil } // OpenAI with API key - if cfg.APIKey == "" && cfg.APIBase == "" { + if cfg.APIKey() == "" && cfg.APIBase == "" { return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) } apiBase := cfg.APIBase @@ -88,7 +88,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err apiBase = getDefaultAPIBase(protocol) } return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( - cfg.APIKey, + cfg.APIKey(), apiBase, cfg.Proxy, cfg.MaxTokensField, @@ -98,7 +98,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err case "azure", "azure-openai": // Azure OpenAI uses deployment-based URLs, api-key header auth, // and always sends max_completion_tokens. - if cfg.APIKey == "" { + if cfg.APIKey() == "" { return nil, "", fmt.Errorf("api_key is required for azure protocol") } if cfg.APIBase == "" { @@ -107,7 +107,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err ) } return azure.NewProviderWithTimeout( - cfg.APIKey, + cfg.APIKey(), cfg.APIBase, cfg.Proxy, cfg.RequestTimeout, @@ -118,7 +118,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err "vivgrid", "volcengine", "vllm", "qwen", "mistral", "avian", "minimax", "longcat", "modelscope", "novita": // All other OpenAI-compatible HTTP providers - if cfg.APIKey == "" && cfg.APIBase == "" { + if cfg.APIKey() == "" && cfg.APIBase == "" { return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) } apiBase := cfg.APIBase @@ -126,7 +126,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err apiBase = getDefaultAPIBase(protocol) } return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( - cfg.APIKey, + cfg.APIKey(), apiBase, cfg.Proxy, cfg.MaxTokensField, @@ -147,11 +147,11 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err if apiBase == "" { apiBase = "https://api.anthropic.com/v1" } - if cfg.APIKey == "" { + if cfg.APIKey() == "" { return nil, "", fmt.Errorf("api_key is required for anthropic protocol (model: %s)", cfg.Model) } return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( - cfg.APIKey, + cfg.APIKey(), apiBase, cfg.Proxy, cfg.MaxTokensField, @@ -164,11 +164,11 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err if apiBase == "" { apiBase = "https://api.anthropic.com/v1" } - if cfg.APIKey == "" { + if cfg.APIKey() == "" { return nil, "", fmt.Errorf("api_key is required for anthropic-messages protocol (model: %s)", cfg.Model) } return anthropicmessages.NewProviderWithTimeout( - cfg.APIKey, + cfg.APIKey(), apiBase, cfg.RequestTimeout, ), modelID, nil diff --git a/pkg/providers/factory_provider_test.go b/pkg/providers/factory_provider_test.go index c7629ad9d..9b34b38e3 100644 --- a/pkg/providers/factory_provider_test.go +++ b/pkg/providers/factory_provider_test.go @@ -89,9 +89,9 @@ func TestCreateProviderFromConfig_OpenAI(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-openai", Model: "openai/gpt-4o", - APIKey: "test-key", APIBase: "https://api.example.com/v1", } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -129,8 +129,8 @@ func TestCreateProviderFromConfig_DefaultAPIBase(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-" + tt.protocol, Model: tt.protocol + "/test-model", - APIKey: "test-key", } + cfg.SetAPIKey("test-key") provider, _, err := CreateProviderFromConfig(cfg) if err != nil { @@ -155,9 +155,9 @@ func TestCreateProviderFromConfig_LiteLLM(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-litellm", Model: "litellm/my-proxy-alias", - APIKey: "test-key", APIBase: "http://localhost:4000/v1", } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -175,9 +175,9 @@ func TestCreateProviderFromConfig_LongCat(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-longcat", Model: "longcat/LongCat-Flash-Thinking", - APIKey: "test-key", APIBase: "https://api.longcat.chat/openai", } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -198,9 +198,9 @@ func TestCreateProviderFromConfig_ModelScope(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-modelscope", Model: "modelscope/Qwen/Qwen3-235B-A22B-Instruct-2507", - APIKey: "test-key", APIBase: "https://api-inference.modelscope.cn/v1", } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -227,8 +227,8 @@ func TestCreateProviderFromConfig_Novita(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-novita", Model: "novita/deepseek/deepseek-v3.2", - APIKey: "test-key", } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -255,8 +255,8 @@ func TestCreateProviderFromConfig_Anthropic(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-anthropic", Model: "anthropic/claude-sonnet-4.6", - APIKey: "test-key", } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -340,8 +340,8 @@ func TestCreateProviderFromConfig_UnknownProtocol(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-unknown", Model: "unknown-protocol/model", - APIKey: "test-key", } + cfg.SetAPIKey("test-key") _, _, err := CreateProviderFromConfig(cfg) if err == nil { @@ -382,6 +382,7 @@ func TestCreateProviderFromConfig_RequestTimeoutPropagation(t *testing.T) { APIBase: server.URL, RequestTimeout: 1, } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -411,9 +412,9 @@ func TestCreateProviderFromConfig_Azure(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "azure-gpt5", Model: "azure/my-gpt5-deployment", - APIKey: "test-azure-key", APIBase: "https://my-resource.openai.azure.com", } + cfg.SetAPIKey("test-azure-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -431,9 +432,9 @@ func TestCreateProviderFromConfig_AzureOpenAIAlias(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "azure-gpt4", Model: "azure-openai/my-deployment", - APIKey: "test-azure-key", APIBase: "https://my-resource.openai.azure.com", } + cfg.SetAPIKey("test-azure-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -464,8 +465,8 @@ func TestCreateProviderFromConfig_AzureMissingAPIBase(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "azure-gpt5", Model: "azure/my-gpt5-deployment", - APIKey: "test-azure-key", } + cfg.SetAPIKey("test-azure-key") _, _, err := CreateProviderFromConfig(cfg) if err == nil { diff --git a/pkg/providers/factory_test.go b/pkg/providers/factory_test.go index bd8fbd1c4..b99f5baf9 100644 --- a/pkg/providers/factory_test.go +++ b/pkg/providers/factory_test.go @@ -10,14 +10,13 @@ import ( func TestCreateProviderReturnsHTTPProviderForOpenRouter(t *testing.T) { cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = "test-openrouter" - cfg.ModelList = []config.ModelConfig{ - { - ModelName: "test-openrouter", - Model: "openrouter/auto", - APIKey: "sk-or-test", - APIBase: "https://openrouter.ai/api/v1", - }, + modelCfg := &config.ModelConfig{ + ModelName: "test-openrouter", + Model: "openrouter/auto", + APIBase: "https://openrouter.ai/api/v1", } + modelCfg.SetAPIKey("sk-or-test") + cfg.ModelList = []*config.ModelConfig{modelCfg} provider, _, err := CreateProvider(cfg) if err != nil { @@ -32,7 +31,7 @@ func TestCreateProviderReturnsHTTPProviderForOpenRouter(t *testing.T) { func TestCreateProviderReturnsCodexCliProviderForCodexCode(t *testing.T) { cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = "test-codex" - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ { ModelName: "test-codex", Model: "codex-cli/codex-model", @@ -53,7 +52,7 @@ func TestCreateProviderReturnsCodexCliProviderForCodexCode(t *testing.T) { func TestCreateProviderReturnsClaudeCliProviderForClaudeCli(t *testing.T) { cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = "test-claude-cli" - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ { ModelName: "test-claude-cli", Model: "claude-cli/claude-sonnet", @@ -86,7 +85,7 @@ func TestCreateProviderReturnsClaudeProviderForAnthropicOAuth(t *testing.T) { cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = "test-claude-oauth" - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ { ModelName: "test-claude-oauth", Model: "anthropic/claude-sonnet-4.6", diff --git a/pkg/voice/transcriber.go b/pkg/voice/transcriber.go index 5b18612b1..8b1194df2 100644 --- a/pkg/voice/transcriber.go +++ b/pkg/voice/transcriber.go @@ -168,8 +168,8 @@ func (t *GroqTranscriber) Name() string { func DetectTranscriber(cfg *config.Config) Transcriber { // return any model-list entry that uses the groq/ protocol. for _, mc := range cfg.ModelList { - if strings.HasPrefix(mc.Model, "groq/") && mc.APIKey != "" { - return NewGroqTranscriber(mc.APIKey) + if strings.HasPrefix(mc.Model, "groq/") && mc.APIKey() != "" { + return NewGroqTranscriber(mc.APIKey()) } } return nil diff --git a/pkg/voice/transcriber_test.go b/pkg/voice/transcriber_test.go index e7d10c40f..3cc540b80 100644 --- a/pkg/voice/transcriber_test.go +++ b/pkg/voice/transcriber_test.go @@ -36,30 +36,45 @@ func TestDetectTranscriber(t *testing.T) { }, { name: "groq via model list", - cfg: &config.Config{ - ModelList: []config.ModelConfig{ - {Model: "openai/gpt-4o", APIKey: "sk-openai"}, - {Model: "groq/llama-3.3-70b", APIKey: "sk-groq-model"}, + cfg: (&config.Config{ + ModelList: []*config.ModelConfig{ + {ModelName: "openai", Model: "openai/gpt-4o"}, + {ModelName: "groq", Model: "groq/llama-3.3-70b"}, }, - }, + }).WithSecurity(&config.SecurityConfig{ + ModelList: map[string]config.ModelSecurityEntry{ + "openai": { + APIKeys: []string{"sk-openai"}, + }, + "groq": { + APIKeys: []string{"sk-groq-model"}, + }, + }, + }), wantName: "groq", }, { name: "groq model list entry without key is skipped", cfg: &config.Config{ - ModelList: []config.ModelConfig{ - {Model: "groq/llama-3.3-70b", APIKey: ""}, + ModelList: []*config.ModelConfig{ + {Model: "groq/llama-3.3-70b"}, }, }, wantNil: true, }, { name: "provider key takes priority over model list", - cfg: &config.Config{ - ModelList: []config.ModelConfig{ - {Model: "groq/llama-3.3-70b", APIKey: "sk-groq-model"}, + cfg: (&config.Config{ + ModelList: []*config.ModelConfig{ + {ModelName: "groq", Model: "groq/llama-3.3-70b"}, }, - }, + }).WithSecurity(&config.SecurityConfig{ + ModelList: map[string]config.ModelSecurityEntry{ + "groq": { + APIKeys: []string{"sk-groq-model"}, + }, + }, + }), wantName: "groq", }, } diff --git a/security.example.yml b/security.example.yml new file mode 100644 index 000000000..1d7f8bd0c --- /dev/null +++ b/security.example.yml @@ -0,0 +1,184 @@ +# PicoClaw Security Configuration +# This file stores all sensitive data (API keys, tokens, secrets, passwords) +# Keep this file secure and never commit it to version control +# Copy this file to security.yml and fill in your actual values + +# Model API Keys +# Use dot notation references in config.json like: "ref:model_list.gpt-5.4.api_key" +# IMPORTANT: Use 'api_keys' (array) format - both single and multiple keys +model_list: + # Example: OpenAI GPT-5.4 (multiple keys for load balancing/failover) + gpt-5.4: + api_keys: + - "your-openai-api-key-1" + - "your-openai-api-key-2" # Optional: failover key + + # Example: Claude Sonnet (single key in array format) + claude-sonnet-4.6: + api_keys: + - "your-anthropic-api-key-here" # Single key MUST be in array format + + # Example: Zhipu GLM + glm-4.7: + api_key: "your-zhipu-api-key-here" + + # Example: DeepSeek + deepseek-chat: + api_key: "your-deepseek-api-key-here" + + # Example: Google Gemini + gemini-2.0-flash: + api_key: "your-gemini-api-key-here" + + # Example: Qwen + qwen-plus: + api_key: "your-qwen-api-key-here" + + # Example: Moonshot + moonshot-v1-8k: + api_key: "your-moonshot-api-key-here" + + # Example: Groq + llama-3.3-70b: + api_key: "your-groq-api-key-here" + + # Example: OpenRouter + openrouter-auto: + api_key: "your-openrouter-api-key-here" + openrouter-gpt-5.4: + api_key: "your-openrouter-api-key-here" + + # Example: NVIDIA + nemotron-4-340b: + api_key: "your-nvidia-api-key-here" + + # Example: Cerebras + cerebras-llama-3.3-70b: + api_key: "your-cerebras-api-key-here" + + # Example: Vivgrid + vivgrid-auto: + api_key: "your-vivgrid-api-key-here" + + # Example: Volcengine + ark-code-latest: + api_key: "your-volcengine-api-key-here" + doubao-pro: + api_key: "your-volcengine-api-key-here" + + # Example: ShengsuanYun + deepseek-v3: + api_key: "your-shengsuanyun-api-key-here" + + # Example: Mistral + mistral-small: + api_key: "your-mistral-api-key-here" + + # Example: Avian + deepseek-v3.2: + api_key: "your-avian-api-key-here" + kimi-k2.5: + api_key: "your-avian-api-key-here" + + # Example: Minimax + MiniMax-M2.5: + api_key: "your-minimax-api-key-here" + + # Example: LongCat + LongCat-Flash-Thinking: + api_key: "your-longcat-api-key-here" + + # Example: ModelScope + modelscope-qwen: + api_key: "your-modelscope-api-key-here" + + # Example: VLLM (local, usually no real key needed) + local-model: + api_key: "" + + # Example: Azure OpenAI + azure-gpt5: + api_key: "your-azure-api-key-here" + +# Channel Tokens and Secrets +channels: + telegram: + token: "your-telegram-bot-token" + + feishu: + app_secret: "your-feishu-app-secret" + encrypt_key: "your-feishu-encrypt-key" + verification_token: "your-feishu-verification-token" + + discord: + token: "your-discord-bot-token" + + qq: + app_secret: "your-qq-app-secret" + + dingtalk: + client_secret: "your-dingtalk-client-secret" + + slack: + bot_token: "your-slack-bot-token" + app_token: "your-slack-app-token" + + matrix: + access_token: "your-matrix-access-token" + + line: + channel_secret: "your-line-channel-secret" + channel_access_token: "your-line-channel-access-token" + + onebot: + access_token: "your-onebot-access-token" + + wecom: + token: "your-wecom-token" + encoding_aes_key: "your-wecom-encoding-aes-key" + + wecom_app: + corp_secret: "your-wecom-app-corp-secret" + token: "your-wecom-app-token" + encoding_aes_key: "your-wecom-app-encoding-aes-key" + + wecom_aibot: + token: "your-wecom-aibot-token" + encoding_aes_key: "your-wecom-aibot-encoding-aes-key" + + pico: + token: "your-pico-token" + + irc: + password: "your-irc-password" + nickserv_password: "your-irc-nickserv-password" + sasl_password: "your-irc-sasl-password" + +# Web Tool API Keys +# IMPORTANT: Use 'api_keys' (array) for Brave, Tavily, Perplexity +# Use 'api_key' (single string) for GLMSearch only +web: + brave: + api_keys: + - "your-brave-api-key-1" + - "your-brave-api-key-2" # Optional: failover key + + tavily: + api_keys: + - "your-tavily-api-key" # Single key MUST be in array format + + perplexity: + api_keys: + - "your-perplexity-api-key-1" + - "your-perplexity-api-key-2" + + glm_search: + api_key: "your-glm-search-api-key" # GLMSearch uses single string format (NOT array) + +# Skills Registry Tokens +skills: + github: + token: "your-github-token" + + clawhub: + auth_token: "your-clawhub-auth-token" diff --git a/web/backend/api/config.go b/web/backend/api/config.go index a7d5b3c5d..7cdfde174 100644 --- a/web/backend/api/config.go +++ b/web/backend/api/config.go @@ -8,6 +8,7 @@ import ( "regexp" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/logger" ) // registerConfigRoutes binds configuration management endpoints to the ServeMux. @@ -45,7 +46,7 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) { defer r.Body.Close() var cfg config.Config - if err := json.Unmarshal(body, &cfg); err != nil { + if err = json.Unmarshal(body, &cfg); err != nil { http.Error(w, fmt.Sprintf("Invalid JSON: %v", err), http.StatusBadRequest) return } @@ -63,6 +64,14 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) { return } + logger.Infof("new config: %+v", cfg) + oldCfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + cfg.SecurityCopyFrom(oldCfg) + if err := config.SaveConfig(h.configPath, &cfg); err != nil { http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) return @@ -150,6 +159,8 @@ func (h *Handler) handlePatchConfig(w http.ResponseWriter, r *http.Request) { return } + newCfg.SecurityCopyFrom(cfg) + if err := config.SaveConfig(h.configPath, &newCfg); err != nil { http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) return @@ -175,17 +186,17 @@ func validateConfig(cfg *config.Config) []string { } // Pico channel: token required when enabled - if cfg.Channels.Pico.Enabled && cfg.Channels.Pico.Token == "" { + if cfg.Channels.Pico.Enabled && cfg.Channels.Pico.Token() == "" { errs = append(errs, "channels.pico.token is required when pico channel is enabled") } // Telegram: token required when enabled - if cfg.Channels.Telegram.Enabled && cfg.Channels.Telegram.Token == "" { + if cfg.Channels.Telegram.Enabled && cfg.Channels.Telegram.Token() == "" { errs = append(errs, "channels.telegram.token is required when telegram channel is enabled") } // Discord: token required when enabled - if cfg.Channels.Discord.Enabled && cfg.Channels.Discord.Token == "" { + if cfg.Channels.Discord.Enabled && cfg.Channels.Discord.Token() == "" { errs = append(errs, "channels.discord.token is required when discord channel is enabled") } diff --git a/web/backend/api/config_test.go b/web/backend/api/config_test.go index 54ec8e857..bbf285e14 100644 --- a/web/backend/api/config_test.go +++ b/web/backend/api/config_test.go @@ -18,6 +18,7 @@ func TestHandleUpdateConfig_PreservesExecAllowRemoteDefaultWhenOmitted(t *testin h.RegisterRoutes(mux) req := httptest.NewRequest(http.MethodPut, "/api/config", bytes.NewBufferString(`{ +"version": 1, "agents": { "defaults": { "workspace": "~/.picoclaw/workspace" @@ -27,7 +28,7 @@ func TestHandleUpdateConfig_PreservesExecAllowRemoteDefaultWhenOmitted(t *testin { "model_name": "custom-default", "model": "openai/gpt-4o", - "api_key": "sk-default" + "api_keys": ["sk-default"] } ] }`)) diff --git a/web/backend/api/gateway.go b/web/backend/api/gateway.go index d5ccd6e29..7f72f12b8 100644 --- a/web/backend/api/gateway.go +++ b/web/backend/api/gateway.go @@ -159,10 +159,10 @@ func (h *Handler) gatewayStartReady() (bool, string, error) { return false, fmt.Sprintf("default model %q is invalid", modelName), nil } - if !hasModelConfiguration(*modelCfg) { + if !hasModelConfiguration(modelCfg) { return false, fmt.Sprintf("default model %q has no credentials configured", modelName), nil } - if requiresRuntimeProbe(*modelCfg) && !probeLocalModelAvailability(*modelCfg) { + if requiresRuntimeProbe(modelCfg) && !probeLocalModelAvailability(modelCfg) { return false, fmt.Sprintf("default model %q is not reachable", modelName), nil } diff --git a/web/backend/api/gateway_test.go b/web/backend/api/gateway_test.go index 482d8d1c0..0c43b6b5a 100644 --- a/web/backend/api/gateway_test.go +++ b/web/backend/api/gateway_test.go @@ -124,7 +124,7 @@ func TestGatewayStartReady_ValidDefaultModel(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName - cfg.ModelList[0].APIKey = "test-key" + cfg.ModelList[0].SetAPIKey("test-key") err := config.SaveConfig(configPath, cfg) if err != nil { t.Fatalf("SaveConfig() error = %v", err) @@ -144,7 +144,7 @@ func TestGatewayStartReady_DefaultModelWithoutCredential(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName - cfg.ModelList[0].APIKey = "" + cfg.ModelList[0].SetAPIKey("") cfg.ModelList[0].AuthMethod = "" err := config.SaveConfig(configPath, cfg) if err != nil { @@ -177,7 +177,7 @@ func TestGatewayStartReady_LocalModelWithoutAPIKey(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{{ + cfg.ModelList = []*config.ModelConfig{{ ModelName: "local-vllm", Model: "vllm/custom-model", APIBase: "http://localhost:8000/v1", @@ -214,7 +214,7 @@ func TestGatewayStartReady_LocalModelWithRunningService(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{{ + cfg.ModelList = []*config.ModelConfig{{ ModelName: "local-vllm", Model: "vllm/custom-model", APIBase: "http://127.0.0.1:8000/v1", @@ -249,12 +249,12 @@ func TestGatewayStartReady_RemoteVLLMWithAPIKeyDoesNotProbe(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{{ + cfg.ModelList = []*config.ModelConfig{{ ModelName: "remote-vllm", Model: "vllm/custom-model", APIBase: "https://models.example.com/v1", - APIKey: "remote-key", }} + cfg.ModelList[0o0].SetAPIKey("remote-key") cfg.Agents.Defaults.ModelName = "remote-vllm" err = config.SaveConfig(configPath, cfg) if err != nil { @@ -284,7 +284,7 @@ func TestGatewayStartReady_LocalOllamaUsesDefaultProbeBase(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{{ + cfg.ModelList = []*config.ModelConfig{{ ModelName: "local-ollama", Model: "ollama/llama3", }} @@ -312,7 +312,7 @@ func TestGatewayStartReady_OAuthModelRequiresStoredCredential(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{{ + cfg.ModelList = []*config.ModelConfig{{ ModelName: "openai-oauth", Model: "openai/gpt-5.4", AuthMethod: "oauth", @@ -483,12 +483,12 @@ func TestGatewayStatusRequiresRestartAfterDefaultModelChange(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName - cfg.ModelList[0].APIKey = "test-key" - cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ + cfg.ModelList[0].SetAPIKey("test-key") + cfg.ModelList = append(cfg.ModelList, &config.ModelConfig{ ModelName: "second-model", Model: "openai/gpt-4.1", - APIKey: "second-key", }) + cfg.ModelList[len(cfg.ModelList)-1].SetAPIKey("second-key") if err := config.SaveConfig(configPath, cfg); err != nil { t.Fatalf("SaveConfig() error = %v", err) } @@ -627,7 +627,7 @@ func TestGatewayRestartKeepsRunningProcessWhenPreconditionsFail(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName - cfg.ModelList[0].APIKey = "" + cfg.ModelList[0].SetAPIKey("") cfg.ModelList[0].AuthMethod = "" if err := config.SaveConfig(configPath, cfg); err != nil { t.Fatalf("SaveConfig() error = %v", err) @@ -680,7 +680,7 @@ func TestGatewayRestartKeepsOldProcessWhenItDoesNotExitInTime(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName - cfg.ModelList[0].APIKey = "test-key" + cfg.ModelList[0].SetAPIKey("test-key") if err := config.SaveConfig(configPath, cfg); err != nil { t.Fatalf("SaveConfig() error = %v", err) } @@ -741,7 +741,7 @@ func TestGatewayRestartReturnsErrorStatusWhenReplacementFailsToStart(t *testing. configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName - cfg.ModelList[0].APIKey = "test-key" + cfg.ModelList[0].SetAPIKey("test-key") if err := config.SaveConfig(configPath, cfg); err != nil { t.Fatalf("SaveConfig() error = %v", err) } diff --git a/web/backend/api/model_status.go b/web/backend/api/model_status.go index 22bf5c15b..03b966da4 100644 --- a/web/backend/api/model_status.go +++ b/web/backend/api/model_status.go @@ -20,9 +20,9 @@ var ( probeOpenAICompatibleModelFunc = probeOpenAICompatibleModel ) -func hasModelConfiguration(m config.ModelConfig) bool { +func hasModelConfiguration(m *config.ModelConfig) bool { authMethod := strings.ToLower(strings.TrimSpace(m.AuthMethod)) - apiKey := strings.TrimSpace(m.APIKey) + apiKey := strings.TrimSpace(m.APIKey()) if authMethod == "oauth" || authMethod == "token" { if provider, ok := oauthProviderForModel(m.Model); ok { @@ -44,7 +44,7 @@ func hasModelConfiguration(m config.ModelConfig) bool { // isModelConfigured reports whether a model is currently available to use. // Local models must be reachable; remote/API-key models only need saved config. -func isModelConfigured(m config.ModelConfig) bool { +func isModelConfigured(m *config.ModelConfig) bool { if !hasModelConfiguration(m) { return false } @@ -54,7 +54,7 @@ func isModelConfigured(m config.ModelConfig) bool { return true } -func requiresRuntimeProbe(m config.ModelConfig) bool { +func requiresRuntimeProbe(m *config.ModelConfig) bool { authMethod := strings.ToLower(strings.TrimSpace(m.AuthMethod)) if authMethod == "local" { return true @@ -75,7 +75,7 @@ func requiresRuntimeProbe(m config.ModelConfig) bool { return false } -func probeLocalModelAvailability(m config.ModelConfig) bool { +func probeLocalModelAvailability(m *config.ModelConfig) bool { apiBase := modelProbeAPIBase(m) protocol, modelID := splitModel(m.Model) switch protocol { @@ -95,7 +95,7 @@ func probeLocalModelAvailability(m config.ModelConfig) bool { } } -func modelProbeAPIBase(m config.ModelConfig) string { +func modelProbeAPIBase(m *config.ModelConfig) string { if apiBase := strings.TrimSpace(m.APIBase); apiBase != "" { return normalizeModelProbeAPIBase(apiBase) } diff --git a/web/backend/api/models.go b/web/backend/api/models.go index 2e3f3dd55..dd71ad25a 100644 --- a/web/backend/api/models.go +++ b/web/backend/api/models.go @@ -58,7 +58,7 @@ func (h *Handler) handleListModels(w http.ResponseWriter, r *http.Request) { var wg sync.WaitGroup wg.Add(len(cfg.ModelList)) for i, m := range cfg.ModelList { - go func(i int, m config.ModelConfig) { + go func(i int, m *config.ModelConfig) { defer wg.Done() configured[i] = isModelConfigured(m) }(i, m) @@ -72,7 +72,7 @@ func (h *Handler) handleListModels(w http.ResponseWriter, r *http.Request) { ModelName: m.ModelName, Model: m.Model, APIBase: m.APIBase, - APIKey: maskAPIKey(m.APIKey), + APIKey: maskAPIKey(m.APIKey()), Proxy: m.Proxy, AuthMethod: m.AuthMethod, ConnectMode: m.ConnectMode, @@ -122,7 +122,7 @@ func (h *Handler) handleAddModel(w http.ResponseWriter, r *http.Request) { return } - cfg.ModelList = append(cfg.ModelList, mc) + cfg.ModelList = append(cfg.ModelList, &mc) if err := config.SaveConfig(h.configPath, cfg); err != nil { http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) @@ -180,11 +180,11 @@ func (h *Handler) handleUpdateModel(w http.ResponseWriter, r *http.Request) { // Preserve the existing API key when the caller omits it (empty string). // This lets the UI update api_base / proxy without clearing the stored secret. - if mc.APIKey == "" { - mc.APIKey = cfg.ModelList[idx].APIKey + if mc.APIKey() == "" { + mc.SetAPIKey(cfg.ModelList[idx].APIKey()) } - cfg.ModelList[idx] = mc + cfg.ModelList[idx] = &mc if err := config.SaveConfig(h.configPath, cfg); err != nil { http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) diff --git a/web/backend/api/models_test.go b/web/backend/api/models_test.go index 2377b5b66..b593307a8 100644 --- a/web/backend/api/models_test.go +++ b/web/backend/api/models_test.go @@ -59,7 +59,7 @@ func TestHandleListModels_ConfiguredStatusUsesRuntimeProbesForLocalModels(t *tes if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ { ModelName: "openai-oauth", Model: "openai/gpt-5.4", @@ -78,7 +78,6 @@ func TestHandleListModels_ConfiguredStatusUsesRuntimeProbesForLocalModels(t *tes ModelName: "vllm-remote", Model: "vllm/custom-model", APIBase: "https://models.example.com/v1", - APIKey: "remote-key", }, { ModelName: "copilot-gpt-5.4", @@ -87,6 +86,11 @@ func TestHandleListModels_ConfiguredStatusUsesRuntimeProbesForLocalModels(t *tes AuthMethod: "oauth", }, } + cfg.WithSecurity(&config.SecurityConfig{ModelList: map[string]config.ModelSecurityEntry{ + "vllm-remote": { + APIKeys: []string{"remote-key"}, + }, + }}) cfg.Agents.Defaults.ModelName = "openai-oauth" if err := config.SaveConfig(configPath, cfg); err != nil { t.Fatalf("SaveConfig() error = %v", err) @@ -152,7 +156,7 @@ func TestHandleListModels_ConfiguredStatusForOAuthModelWithCredential(t *testing if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{{ + cfg.ModelList = []*config.ModelConfig{{ ModelName: "claude-oauth", Model: "anthropic/claude-sonnet-4.6", AuthMethod: "oauth", @@ -215,7 +219,7 @@ func TestHandleListModels_ProbesLocalModelsConcurrently(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{ + cfg.ModelList = []*config.ModelConfig{ { ModelName: "local-vllm-a", Model: "vllm/custom-a", @@ -274,7 +278,7 @@ func TestHandleListModels_NormalizesWildcardLocalAPIBaseForProbe(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error = %v", err) } - cfg.ModelList = []config.ModelConfig{{ + cfg.ModelList = []*config.ModelConfig{{ ModelName: "vllm-local", Model: "vllm/custom-model", APIBase: "http://0.0.0.0:8000/v1", diff --git a/web/backend/api/oauth.go b/web/backend/api/oauth.go index dbc9ee24e..213b53836 100644 --- a/web/backend/api/oauth.go +++ b/web/backend/api/oauth.go @@ -776,28 +776,28 @@ func modelBelongsToProvider(provider, model string) bool { } } -func defaultModelConfigForProvider(provider, authMethod string) config.ModelConfig { +func defaultModelConfigForProvider(provider, authMethod string) *config.ModelConfig { switch provider { case oauthProviderOpenAI: - return config.ModelConfig{ + return &config.ModelConfig{ ModelName: "gpt-5.4", Model: "openai/gpt-5.4", AuthMethod: authMethod, } case oauthProviderAnthropic: - return config.ModelConfig{ + return &config.ModelConfig{ ModelName: "claude-sonnet-4.6", Model: "anthropic/claude-sonnet-4.6", AuthMethod: authMethod, } case oauthProviderGoogleAntigravity: - return config.ModelConfig{ + return &config.ModelConfig{ ModelName: "gemini-flash", Model: "antigravity/gemini-3-flash", AuthMethod: authMethod, } default: - return config.ModelConfig{} + return &config.ModelConfig{} } } diff --git a/web/backend/api/oauth_test.go b/web/backend/api/oauth_test.go index 6864dcb2f..7cab79b52 100644 --- a/web/backend/api/oauth_test.go +++ b/web/backend/api/oauth_test.go @@ -166,7 +166,7 @@ func TestOAuthLogoutClearsCredentialAndConfig(t *testing.T) { if err != nil { t.Fatalf("LoadConfig error: %v", err) } - cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ + cfg.ModelList = append(cfg.ModelList, &config.ModelConfig{ ModelName: "gpt-5.4", Model: "openai/gpt-5.4", AuthMethod: "oauth", @@ -229,12 +229,18 @@ func setupOAuthTestEnv(t *testing.T) (string, func()) { } cfg := config.DefaultConfig() - cfg.ModelList = []config.ModelConfig{{ + cfg.ModelList = []*config.ModelConfig{{ ModelName: "custom-default", Model: "openai/gpt-4o", - APIKey: "sk-default", }} cfg.Agents.Defaults.ModelName = "custom-default" + cfg.WithSecurity(&config.SecurityConfig{ + ModelList: map[string]config.ModelSecurityEntry{ + "custom-default": { + APIKeys: []string{"sk-default"}, + }, + }, + }) configPath := filepath.Join(tmp, "config.json") if err := config.SaveConfig(configPath, cfg); err != nil { diff --git a/web/backend/api/pico.go b/web/backend/api/pico.go index a880f2f0c..8fbb8737f 100644 --- a/web/backend/api/pico.go +++ b/web/backend/api/pico.go @@ -57,7 +57,7 @@ func (h *Handler) handleGetPicoToken(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ - "token": cfg.Channels.Pico.Token, + "token": cfg.Channels.Pico.Token(), "ws_url": wsURL, "enabled": cfg.Channels.Pico.Enabled, }) @@ -74,7 +74,7 @@ func (h *Handler) handleRegenPicoToken(w http.ResponseWriter, r *http.Request) { } token := generateSecureToken() - cfg.Channels.Pico.Token = token + cfg.Channels.Pico.SetToken(token) if err := config.SaveConfig(h.configPath, cfg); err != nil { http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) @@ -110,8 +110,8 @@ func (h *Handler) ensurePicoChannel(callerOrigin string) (bool, error) { changed = true } - if cfg.Channels.Pico.Token == "" { - cfg.Channels.Pico.Token = generateSecureToken() + if cfg.Channels.Pico.Token() == "" { + cfg.Channels.Pico.SetToken(generateSecureToken()) changed = true } @@ -150,7 +150,7 @@ func (h *Handler) handlePicoSetup(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ - "token": cfg.Channels.Pico.Token, + "token": cfg.Channels.Pico.Token(), "ws_url": wsURL, "enabled": true, "changed": changed, diff --git a/web/backend/api/pico_test.go b/web/backend/api/pico_test.go index 075da4ddc..263253cb2 100644 --- a/web/backend/api/pico_test.go +++ b/web/backend/api/pico_test.go @@ -33,7 +33,7 @@ func TestEnsurePicoChannel_FreshConfig(t *testing.T) { if !cfg.Channels.Pico.Enabled { t.Error("expected Pico to be enabled after setup") } - if cfg.Channels.Pico.Token == "" { + if cfg.Channels.Pico.Token() == "" { t.Error("expected a non-empty token after setup") } } @@ -121,7 +121,7 @@ func TestEnsurePicoChannel_PreservesUserSettings(t *testing.T) { // Pre-configure with custom user settings cfg := config.DefaultConfig() cfg.Channels.Pico.Enabled = true - cfg.Channels.Pico.Token = "user-custom-token" + cfg.Channels.Pico.SetToken("user-custom-token") cfg.Channels.Pico.AllowTokenQuery = true cfg.Channels.Pico.AllowOrigins = []string{"https://myapp.example.com"} if err := config.SaveConfig(configPath, cfg); err != nil { @@ -143,8 +143,8 @@ func TestEnsurePicoChannel_PreservesUserSettings(t *testing.T) { t.Fatalf("LoadConfig() error = %v", err) } - if cfg.Channels.Pico.Token != "user-custom-token" { - t.Errorf("token = %q, want %q", cfg.Channels.Pico.Token, "user-custom-token") + if cfg.Channels.Pico.Token() != "user-custom-token" { + t.Errorf("token = %q, want %q", cfg.Channels.Pico.Token(), "user-custom-token") } if !cfg.Channels.Pico.AllowTokenQuery { t.Error("user's allow_token_query=true must be preserved") @@ -166,7 +166,7 @@ func TestEnsurePicoChannel_Idempotent(t *testing.T) { } cfg1, _ := config.LoadConfig(configPath) - token1 := cfg1.Channels.Pico.Token + token1 := cfg1.Channels.Pico.Token() // Second call should be a no-op changed, err := h.ensurePicoChannel(origin) @@ -178,7 +178,7 @@ func TestEnsurePicoChannel_Idempotent(t *testing.T) { } cfg2, _ := config.LoadConfig(configPath) - if cfg2.Channels.Pico.Token != token1 { + if cfg2.Channels.Pico.Token() != token1 { t.Error("token should not change on subsequent calls") } } From 4e876ebeee046463b073128538a836040bb36c5e Mon Sep 17 00:00:00 2001 From: Cytown Date: Sun, 22 Mar 2026 09:52:25 +0800 Subject: [PATCH 012/202] remove useless logs output --- pkg/config/config.go | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pkg/config/config.go b/pkg/config/config.go index 713ee1bac..dce88551a 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -1276,7 +1276,6 @@ func LoadConfig(path string) (*Config, error) { if err != nil { return nil, fmt.Errorf("failed to load security config: %w", err) } - logger.Infof("sec: %#v", sec.ModelList) // Apply security references from security.yml BEFORE resolveAPIKeys // This resolves ref: references to actual values @@ -1297,12 +1296,10 @@ func LoadConfig(path string) (*Config, error) { } } - // logger.Infof("cfg: %#v", cfg.ModelList[0]) if err := env.Parse(cfg); err != nil { return nil, err } - // logger.Infof("cfg: %#v", cfg.ModelList[0]) if err := resolveAPIKeys(cfg.ModelList, filepath.Dir(path)); err != nil { return nil, err } @@ -1312,11 +1309,9 @@ func LoadConfig(path string) (*Config, error) { return nil, err } - // logger.Infof("cfg: %#v", cfg.ModelList[0]) // Expand multi-key configs into separate entries for key-level failover cfg.ModelList = expandMultiKeyModels(cfg.ModelList) - // logger.Infof("cfg: %#v", cfg.ModelList[0]) // Migrate legacy channel config fields to new unified structures cfg.migrateChannelConfigs() @@ -1944,7 +1939,6 @@ func expandMultiKeyModels(models []*ModelConfig) []*ModelConfig { // Single key or no keys: keep as-is if len(keys) <= 1 { m.apiKeys = keys - logger.Infof("keys:%v", keys) expanded = append(expanded, m) continue } From 3dfe484f664727ccdad5f0882c4d2a8d8a0dd979 Mon Sep 17 00:00:00 2001 From: Cytown Date: Sun, 22 Mar 2026 11:07:22 +0800 Subject: [PATCH 013/202] make yaml indent with 2 --- pkg/config/security.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/pkg/config/security.go b/pkg/config/security.go index ec3333e43..c47d1330c 100644 --- a/pkg/config/security.go +++ b/pkg/config/security.go @@ -6,6 +6,7 @@ package config import ( + "bytes" "fmt" "os" "path/filepath" @@ -198,9 +199,12 @@ func loadSecurityConfig(securityPath string) (*SecurityConfig, error) { // saveSecurityConfig saves the security configuration to security.yml func saveSecurityConfig(securityPath string, sec *SecurityConfig) error { - data, err := yaml.Marshal(sec) + var buf bytes.Buffer + enc := yaml.NewEncoder(&buf) + enc.SetIndent(2) + err := enc.Encode(sec) if err != nil { return fmt.Errorf("failed to marshal security config: %w", err) } - return fileutil.WriteFileAtomic(securityPath, data, 0o600) + return fileutil.WriteFileAtomic(securityPath, buf.Bytes(), 0o600) } From a005e5bb7082b6e61fa6a2baeb6e1cac9f1e5ece Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Sun, 22 Mar 2026 15:49:25 +0800 Subject: [PATCH 014/202] feat(providers): add extra_body config to inject custom fields into request body Allow configuring provider-specific fields like reasoning_split for minimax via the model config's extra_body map. These fields are merged into the request body last, giving them precedence over default values. Co-Authored-By: Claude Opus 4.6 --- pkg/config/config.go | 9 ++- pkg/config/config_test.go | 56 +++++++++++++ pkg/config/defaults.go | 1 + pkg/providers/factory_provider.go | 3 + pkg/providers/http_provider.go | 4 +- pkg/providers/openai_compat/provider.go | 13 +++ pkg/providers/openai_compat/provider_test.go | 84 ++++++++++++++++++++ 7 files changed, 165 insertions(+), 5 deletions(-) diff --git a/pkg/config/config.go b/pkg/config/config.go index eab770991..c4f1e751f 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -674,10 +674,11 @@ type ModelConfig struct { Workspace string `json:"workspace,omitempty"` // Workspace path for CLI-based providers // Optional optimizations - RPM int `json:"rpm,omitempty"` // Requests per minute limit - MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") - RequestTimeout int `json:"request_timeout,omitempty"` - ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + RPM int `json:"rpm,omitempty"` // Requests per minute limit + MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") + RequestTimeout int `json:"request_timeout,omitempty"` + ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + ExtraBody map[string]any `json:"extra_body,omitempty"` // Additional fields to inject into request body } // Validate checks if the ModelConfig has all required fields. diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 45906ee70..678f02000 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1099,3 +1099,59 @@ func TestConfigLogLevelEmpty(t *testing.T) { t.Errorf("LogLevel = %q, want \"fatal\"", cfg.Agents.Defaults.LogLevel) } } + +func TestDefaultConfig_MinimaxExtraBody(t *testing.T) { + cfg := DefaultConfig() + + var minimaxCfg *ModelConfig + for i := range cfg.ModelList { + if cfg.ModelList[i].Model == "minimax/MiniMax-M2.5" { + minimaxCfg = &cfg.ModelList[i] + break + } + } + if minimaxCfg == nil { + t.Fatal("Minimax model not found in ModelList") + } + if minimaxCfg.ExtraBody == nil { + t.Fatal("Minimax ExtraBody should not be nil") + } + if got, ok := minimaxCfg.ExtraBody["reasoning_split"]; !ok || got != true { + t.Fatalf("Minimax ExtraBody[reasoning_split] = %v, want true", got) + } +} + +func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + + cfg := &Config{ + ModelList: []ModelConfig{ + { + ModelName: "test-model", + Model: "openai/test", + APIKey: "sk-test", + ExtraBody: map[string]any{"custom_field": "value", "num_field": 42}, + }, + }, + } + + if err := SaveConfig(cfgPath, cfg); err != nil { + t.Fatalf("SaveConfig error: %v", err) + } + + loaded, err := LoadConfig(cfgPath) + if err != nil { + t.Fatalf("LoadConfig error: %v", err) + } + + if loaded.ModelList[0].ExtraBody == nil { + t.Fatal("ExtraBody should not be nil after round-trip") + } + if got := loaded.ModelList[0].ExtraBody["custom_field"]; got != "value" { + t.Errorf("ExtraBody[custom_field] = %v, want value", got) + } + if got := loaded.ModelList[0].ExtraBody["num_field"]; got != float64(42) { + t.Errorf("ExtraBody[num_field] = %v, want 42", got) + } +} diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index f4056eca6..d96b139d1 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -376,6 +376,7 @@ func DefaultConfig() *Config { Model: "minimax/MiniMax-M2.5", APIBase: "https://api.minimaxi.com/v1", APIKey: "", + ExtraBody: map[string]any{"reasoning_split": true}, }, // LongCat - https://longcat.chat/platform diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index a7fef8f5b..98e781da3 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -93,6 +93,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "azure", "azure-openai": @@ -132,6 +133,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "anthropic": @@ -157,6 +159,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "anthropic-messages": diff --git a/pkg/providers/http_provider.go b/pkg/providers/http_provider.go index 803165edb..f2ff52f1d 100644 --- a/pkg/providers/http_provider.go +++ b/pkg/providers/http_provider.go @@ -24,12 +24,13 @@ func NewHTTPProvider(apiKey, apiBase, proxy string) *HTTPProvider { } func NewHTTPProviderWithMaxTokensField(apiKey, apiBase, proxy, maxTokensField string) *HTTPProvider { - return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout(apiKey, apiBase, proxy, maxTokensField, 0) + return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout(apiKey, apiBase, proxy, maxTokensField, 0, nil) } func NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( apiKey, apiBase, proxy, maxTokensField string, requestTimeoutSeconds int, + extraBody map[string]any, ) *HTTPProvider { return &HTTPProvider{ delegate: openai_compat.NewProvider( @@ -38,6 +39,7 @@ func NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( proxy, openai_compat.WithMaxTokensField(maxTokensField), openai_compat.WithRequestTimeout(time.Duration(requestTimeoutSeconds)*time.Second), + openai_compat.WithExtraBody(extraBody), ), } } diff --git a/pkg/providers/openai_compat/provider.go b/pkg/providers/openai_compat/provider.go index 938e4ea8b..90bc683b8 100644 --- a/pkg/providers/openai_compat/provider.go +++ b/pkg/providers/openai_compat/provider.go @@ -35,6 +35,7 @@ type Provider struct { apiBase string maxTokensField string // Field name for max tokens (e.g., "max_completion_tokens" for o1/glm models) httpClient *http.Client + extraBody map[string]any // Additional fields to inject into request body } type Option func(*Provider) @@ -55,6 +56,12 @@ func WithRequestTimeout(timeout time.Duration) Option { } } +func WithExtraBody(extraBody map[string]any) Option { + return func(p *Provider) { + p.extraBody = extraBody + } +} + func NewProvider(apiKey, apiBase, proxy string, opts ...Option) *Provider { p := &Provider{ apiKey: apiKey, @@ -140,6 +147,12 @@ func (p *Provider) buildRequestBody( } } + // Merge extra body fields configured per-provider/model. + // These are injected last so they take precedence over defaults. + for k, v := range p.extraBody { + requestBody[k] = v + } + return requestBody } diff --git a/pkg/providers/openai_compat/provider_test.go b/pkg/providers/openai_compat/provider_test.go index efb03ccb8..ab632ccf3 100644 --- a/pkg/providers/openai_compat/provider_test.go +++ b/pkg/providers/openai_compat/provider_test.go @@ -610,6 +610,90 @@ func TestProvider_RequestTimeoutOverride(t *testing.T) { } } +func TestProviderChat_ExtraBodyInjected(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{"content": "ok"}, + "finish_reason": "stop", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + extraBody := map[string]any{"reasoning_split": true, "custom_field": "test"} + p := NewProvider("key", server.URL, "", WithExtraBody(extraBody)) + + _, err := p.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + "minimax/abab7", + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } + if got, ok := requestBody["custom_field"]; !ok || got != "test" { + t.Fatalf("custom_field = %v, want test", got) + } +} + +func TestProviderChat_ExtraBodyOverridesOptions(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{"content": "ok"}, + "finish_reason": "stop", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + extraBody := map[string]any{"temperature": 0.9} + p := NewProvider("key", server.URL, "", WithExtraBody(extraBody)) + + _, err := p.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + "gpt-4o", + map[string]any{"temperature": 0.5}, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // ExtraBody takes precedence over options since it is merged last. + if got := requestBody["temperature"]; got != float64(0.9) { + t.Fatalf("temperature = %v, want 0.9 (from extraBody, overriding options)", got) + } +} + type roundTripperFunc func(*http.Request) (*http.Response, error) func (f roundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) { From df4f322f09239595bb9ddf163c885f936efff045 Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 22 Mar 2026 12:05:28 +0100 Subject: [PATCH 015/202] fix(tool): route binary outputs through the media pipeline. --- pkg/agent/loop.go | 145 +++++++++++++---- pkg/agent/loop_test.go | 296 +++++++++++++++++++++++++++++++++++ pkg/channels/manager.go | 42 ++++- pkg/channels/manager_test.go | 70 +++++++++ pkg/tools/mcp_tool.go | 280 +++++++++++++++++++++++++++++++-- pkg/tools/mcp_tool_test.go | 144 +++++++++++++++++ pkg/tools/normalization.go | 292 ++++++++++++++++++++++++++++++++++ pkg/tools/registry.go | 39 ++++- pkg/tools/registry_test.go | 111 +++++++++++++ pkg/tools/result.go | 58 ++++++- pkg/tools/result_test.go | 39 +++++ pkg/tools/send_file.go | 2 +- pkg/tools/send_file_test.go | 3 + pkg/tools/toolloop.go | 5 +- 14 files changed, 1462 insertions(+), 64 deletions(-) create mode 100644 pkg/tools/normalization.go diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index ed5c73afc..2b6672f9c 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -492,13 +492,13 @@ func (al *AgentLoop) GetConfig() *config.Config { func (al *AgentLoop) SetMediaStore(s media.MediaStore) { al.mediaStore = s - // Propagate store to send_file tools in all agents. + // Propagate store to all registered tools that can emit media. registry := al.GetRegistry() - registry.ForEachTool("send_file", func(t tools.Tool) { - if sf, ok := t.(*tools.SendFileTool); ok { - sf.SetMediaStore(s) + for _, agentID := range registry.ListAgentIDs() { + if agent, ok := registry.GetAgent(agentID); ok { + agent.Tools.SetMediaStore(s) } - }) + } } // SetTranscriber injects a voice transcriber for agent-level audio transcription. @@ -926,13 +926,26 @@ func (al *AgentLoop) runAgentLoop( agent.Sessions.AddMessage(opts.SessionKey, "user", opts.UserMessage) // 3. Run LLM iteration loop - finalContent, iteration, err := al.runLLMIteration(ctx, agent, messages, opts) + finalContent, iteration, responseHandled, err := al.runLLMIteration(ctx, agent, messages, opts) if err != nil { return "", err } - // If last tool had ForUser content and we already sent it, we might not need to send final response - // This is controlled by the tool's Silent flag and ForUser content + if responseHandled { + agent.Sessions.Save(opts.SessionKey) + + if opts.EnableSummary { + al.maybeSummarize(agent, opts.SessionKey, opts.Channel, opts.ChatID) + } + + logger.InfoCF("agent", "Response already handled by tool output", + map[string]any{ + "agent_id": agent.ID, + "session_key": opts.SessionKey, + "iterations": iteration, + }) + return "", nil + } // 4. Handle empty response if finalContent == "" { @@ -1030,14 +1043,57 @@ func (al *AgentLoop) handleReasoning( } } +const handledToolResponseSummary = "Requested output delivered via tool attachment." + +func (al *AgentLoop) buildOutboundMediaMessage( + channel string, + chatID string, + refs []string, +) bus.OutboundMediaMessage { + parts := make([]bus.MediaPart, 0, len(refs)) + for _, ref := range refs { + part := bus.MediaPart{Ref: ref} + if al.mediaStore != nil { + if _, meta, err := al.mediaStore.ResolveWithMeta(ref); err == nil { + part.Filename = meta.Filename + part.ContentType = meta.ContentType + part.Type = inferMediaType(meta.Filename, meta.ContentType) + } + } + parts = append(parts, part) + } + return bus.OutboundMediaMessage{ + Channel: channel, + ChatID: chatID, + Parts: parts, + } +} + +func (al *AgentLoop) buildArtifactTags(refs []string) []string { + if al.mediaStore == nil || len(refs) == 0 { + return nil + } + + tags := make([]string, 0, len(refs)) + for _, ref := range refs { + localPath, meta, err := al.mediaStore.ResolveWithMeta(ref) + if err != nil { + continue + } + mime := detectMIME(localPath, meta) + tags = append(tags, buildPathTag(mime, localPath)) + } + return tags +} + // runLLMIteration executes the LLM call loop with tool handling. -// Returns (finalContent, iteration, error). +// Returns (finalContent, iteration, responseHandled, error). func (al *AgentLoop) runLLMIteration( ctx context.Context, agent *AgentInstance, messages []providers.Message, opts processOptions, -) (string, int, error) { +) (string, int, bool, error) { iteration := 0 var finalContent string @@ -1240,7 +1296,7 @@ func (al *AgentLoop) runLLMIteration( "model": activeModel, "error": err.Error(), }) - return "", iteration, fmt.Errorf("LLM call failed after retries: %w", err) + return "", iteration, false, fmt.Errorf("LLM call failed after retries: %w", err) } go al.handleReasoning( @@ -1401,10 +1457,7 @@ func (al *AgentLoop) runLLMIteration( } // Determine content for the agent loop (ForLLM or error). - content := result.ForLLM - if content == "" && result.Err != nil { - content = result.Err.Error() - } + content := result.ContentForLLM() if content == "" { return } @@ -1439,8 +1492,14 @@ func (al *AgentLoop) runLLMIteration( } wg.Wait() + allResponsesHandled := len(agentResults) > 0 + // Process results in original order (send to user, save to session) for _, r := range agentResults { + if !r.result.ResponseHandled { + allResponsesHandled = false + } + // Send ForUser content to user immediately if not Silent if !r.result.Silent && r.result.ForUser != "" && opts.SendResponse { al.bus.PublishOutbound(ctx, bus.OutboundMessage{ @@ -1455,32 +1514,33 @@ func (al *AgentLoop) runLLMIteration( }) } - // If tool returned media refs, publish them as outbound media + // If tool returned media refs, publish them as outbound media only when the + // tool explicitly marked the user-visible delivery as already handled. if len(r.result.Media) > 0 { - parts := make([]bus.MediaPart, 0, len(r.result.Media)) - for _, ref := range r.result.Media { - part := bus.MediaPart{Ref: ref} - if al.mediaStore != nil { - if _, meta, err := al.mediaStore.ResolveWithMeta(ref); err == nil { - part.Filename = meta.Filename - part.ContentType = meta.ContentType - part.Type = inferMediaType(meta.Filename, meta.ContentType) + outboundMedia := al.buildOutboundMediaMessage(opts.Channel, opts.ChatID, r.result.Media) + if r.result.ResponseHandled { + if al.channelManager != nil { + if err := al.channelManager.SendMedia(ctx, outboundMedia); err != nil { + allResponsesHandled = false + logger.WarnCF("agent", "Synchronous media send failed, falling back to bus delivery", + map[string]any{ + "agent_id": agent.ID, + "tool": r.tc.Name, + "error": err.Error(), + }) + al.bus.PublishOutboundMedia(ctx, outboundMedia) } + } else { + al.bus.PublishOutboundMedia(ctx, outboundMedia) } - parts = append(parts, part) } - al.bus.PublishOutboundMedia(ctx, bus.OutboundMediaMessage{ - Channel: opts.Channel, - ChatID: opts.ChatID, - Parts: parts, - }) } // Determine content for LLM based on tool result - contentForLLM := r.result.ForLLM - if contentForLLM == "" && r.result.Err != nil { - contentForLLM = r.result.Err.Error() + if len(r.result.Media) > 0 && !r.result.ResponseHandled { + r.result.ArtifactTags = al.buildArtifactTags(r.result.Media) } + contentForLLM := r.result.ContentForLLM() toolResultMsg := providers.Message{ Role: "tool", @@ -1493,6 +1553,23 @@ func (al *AgentLoop) runLLMIteration( agent.Sessions.AddFullMessage(opts.SessionKey, toolResultMsg) } + if allResponsesHandled { + summaryMsg := providers.Message{ + Role: "assistant", + Content: handledToolResponseSummary, + } + messages = append(messages, summaryMsg) + agent.Sessions.AddFullMessage(opts.SessionKey, summaryMsg) + + logger.InfoCF("agent", "Tool output satisfied delivery; ending turn without follow-up LLM", + map[string]any{ + "agent_id": agent.ID, + "iteration": iteration, + "tool_count": len(agentResults), + }) + return "", iteration, true, nil + } + // Tick down TTL of discovered tools after processing tool results. // Only reached when tool calls were made (the loop continues); // the break on no-tool-call responses skips this. @@ -1505,7 +1582,7 @@ func (al *AgentLoop) runLLMIteration( }) } - return finalContent, iteration, nil + return finalContent, iteration, false, nil } // selectCandidates returns the model candidates and resolved model name to use diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 28eab03db..ea63d9634 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -298,6 +298,152 @@ func TestToolRegistry_GetDefinitions(t *testing.T) { } } +func TestProcessMessage_MediaToolHandledSkipsFollowUpLLMAndFinalText(t *testing.T) { + tmpDir := t.TempDir() + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + + msgBus := bus.NewMessageBus() + provider := &handledMediaProvider{} + al := NewAgentLoop(cfg, msgBus, provider) + + store := media.NewFileMediaStore() + al.SetMediaStore(store) + + imagePath := filepath.Join(tmpDir, "screen.png") + if err := os.WriteFile(imagePath, []byte("fake screenshot"), 0o644); err != nil { + t.Fatalf("WriteFile(imagePath) error = %v", err) + } + + al.RegisterTool(&handledMediaTool{ + store: store, + path: imagePath, + }) + + response, err := al.processMessage(context.Background(), bus.InboundMessage{ + Channel: "telegram", + ChatID: "chat1", + SenderID: "user1", + Content: "take a screenshot of the screen and send it to me", + }) + if err != nil { + t.Fatalf("processMessage() error = %v", err) + } + if response != "" { + t.Fatalf("expected no final response when media tool already handled delivery, got %q", response) + } + if provider.calls != 1 { + t.Fatalf("expected exactly 1 LLM call, got %d", provider.calls) + } + if len(provider.toolCounts) != 1 { + t.Fatalf("expected tool counts for 1 provider call, got %d", len(provider.toolCounts)) + } + if provider.toolCounts[0] == 0 { + t.Fatal("expected tools to be available on the first LLM call") + } + + select { + case mediaMsg := <-msgBus.OutboundMediaChan(): + if mediaMsg.Channel != "telegram" || mediaMsg.ChatID != "chat1" { + t.Fatalf("unexpected outbound media target: %+v", mediaMsg) + } + if len(mediaMsg.Parts) != 1 { + t.Fatalf("expected exactly 1 outbound media part, got %d", len(mediaMsg.Parts)) + } + default: + t.Fatal("expected outbound media message to be published") + } + + defaultAgent := al.GetRegistry().GetDefaultAgent() + if defaultAgent == nil { + t.Fatal("expected default agent") + } + route, _, err := al.resolveMessageRoute(bus.InboundMessage{ + Channel: "telegram", + ChatID: "chat1", + SenderID: "user1", + Content: "take a screenshot of the screen and send it to me", + }) + if err != nil { + t.Fatalf("resolveMessageRoute() error = %v", err) + } + sessionKey := resolveScopeKey(route, "") + history := defaultAgent.Sessions.GetHistory(sessionKey) + if len(history) == 0 { + t.Fatal("expected session history to be saved") + } + last := history[len(history)-1] + if last.Role != "assistant" || last.Content != handledToolResponseSummary { + t.Fatalf("expected handled assistant summary in history, got %+v", last) + } +} + +func TestProcessMessage_MediaArtifactCanBeForwardedBySendFile(t *testing.T) { + tmpDir := t.TempDir() + cfg := config.DefaultConfig() + cfg.Agents.Defaults.Workspace = tmpDir + cfg.Agents.Defaults.Model = "test-model" + cfg.Agents.Defaults.MaxTokens = 4096 + cfg.Agents.Defaults.MaxToolIterations = 10 + + msgBus := bus.NewMessageBus() + provider := &artifactThenSendProvider{} + al := NewAgentLoop(cfg, msgBus, provider) + + store := media.NewFileMediaStore() + al.SetMediaStore(store) + + mediaDir := media.TempDir() + if err := os.MkdirAll(mediaDir, 0o700); err != nil { + t.Fatalf("MkdirAll(mediaDir) error = %v", err) + } + imagePath := filepath.Join(mediaDir, "artifact-screen.png") + if err := os.WriteFile(imagePath, []byte("fake screenshot"), 0o644); err != nil { + t.Fatalf("WriteFile(imagePath) error = %v", err) + } + + al.RegisterTool(&mediaArtifactTool{ + store: store, + path: imagePath, + }) + + response, err := al.processMessage(context.Background(), bus.InboundMessage{ + Channel: "telegram", + ChatID: "chat1", + SenderID: "user1", + Content: "take a screenshot of the screen and send it to me", + }) + if err != nil { + t.Fatalf("processMessage() error = %v", err) + } + if response != "" { + t.Fatalf("expected no final response after send_file handled delivery, got %q", response) + } + if provider.calls != 2 { + t.Fatalf("expected 2 LLM calls (artifact + send_file), got %d", provider.calls) + } + + select { + case mediaMsg := <-msgBus.OutboundMediaChan(): + if mediaMsg.Channel != "telegram" || mediaMsg.ChatID != "chat1" { + t.Fatalf("unexpected outbound media target: %+v", mediaMsg) + } + if len(mediaMsg.Parts) != 1 { + t.Fatalf("expected exactly 1 outbound media part, got %d", len(mediaMsg.Parts)) + } + default: + t.Fatal("expected outbound media from send_file") + } +} + // TestAgentLoop_GetStartupInfo verifies startup info contains tools func TestAgentLoop_GetStartupInfo(t *testing.T) { tmpDir, err := os.MkdirTemp("", "agent-test-*") @@ -420,6 +566,98 @@ func (m *countingMockProvider) GetDefaultModel() string { return "counting-mock-model" } +type handledMediaProvider struct { + calls int + toolCounts []int +} + +func (m *handledMediaProvider) Chat( + ctx context.Context, + messages []providers.Message, + tools []providers.ToolDefinition, + model string, + opts map[string]any, +) (*providers.LLMResponse, error) { + m.calls++ + m.toolCounts = append(m.toolCounts, len(tools)) + if m.calls == 1 { + return &providers.LLMResponse{ + Content: "Taking the screenshot now.", + ToolCalls: []providers.ToolCall{{ + ID: "call_handled_media", + Type: "function", + Name: "handled_media_tool", + Arguments: map[string]any{}, + }}, + }, nil + } + return &providers.LLMResponse{}, nil +} + +func (m *handledMediaProvider) GetDefaultModel() string { + return "handled-media-model" +} + +type artifactThenSendProvider struct { + calls int +} + +func (m *artifactThenSendProvider) Chat( + ctx context.Context, + messages []providers.Message, + tools []providers.ToolDefinition, + model string, + opts map[string]any, +) (*providers.LLMResponse, error) { + m.calls++ + if m.calls == 1 { + return &providers.LLMResponse{ + Content: "Taking the screenshot now.", + ToolCalls: []providers.ToolCall{{ + ID: "call_artifact_media", + Type: "function", + Name: "media_artifact_tool", + Arguments: map[string]any{}, + }}, + }, nil + } + + var artifactPath string + for i := len(messages) - 1; i >= 0; i-- { + if messages[i].Role != "tool" { + continue + } + start := strings.Index(messages[i].Content, "[file:") + if start < 0 { + continue + } + rest := messages[i].Content[start+len("[file:"):] + end := strings.Index(rest, "]") + if end < 0 { + continue + } + artifactPath = rest[:end] + break + } + if artifactPath == "" { + return nil, fmt.Errorf("provider did not receive artifact path in tool result") + } + + return &providers.LLMResponse{ + Content: "", + ToolCalls: []providers.ToolCall{{ + ID: "call_send_file", + Type: "function", + Name: "send_file", + Arguments: map[string]any{"path": artifactPath}, + }}, + }, nil +} + +func (m *artifactThenSendProvider) GetDefaultModel() string { + return "artifact-then-send-model" +} + type toolLimitOnlyProvider struct{} func (m *toolLimitOnlyProvider) Chat( @@ -465,6 +703,64 @@ func (m *mockCustomTool) Execute(ctx context.Context, args map[string]any) *tool return tools.SilentResult("Custom tool executed") } +type handledMediaTool struct { + store media.MediaStore + path string +} + +func (m *handledMediaTool) Name() string { return "handled_media_tool" } +func (m *handledMediaTool) Description() string { + return "Returns a media attachment and fully handles the user response" +} + +func (m *handledMediaTool) Parameters() map[string]any { + return map[string]any{ + "type": "object", + "properties": map[string]any{}, + } +} + +func (m *handledMediaTool) Execute(ctx context.Context, args map[string]any) *tools.ToolResult { + ref, err := m.store.Store(m.path, media.MediaMeta{ + Filename: filepath.Base(m.path), + ContentType: "image/png", + Source: "test:handled_media_tool", + }, "test:handled_media") + if err != nil { + return tools.ErrorResult(err.Error()).WithError(err) + } + return tools.MediaResult("Attachment delivered by tool.", []string{ref}).WithResponseHandled() +} + +type mediaArtifactTool struct { + store media.MediaStore + path string +} + +func (m *mediaArtifactTool) Name() string { return "media_artifact_tool" } +func (m *mediaArtifactTool) Description() string { + return "Returns a media artifact that the agent can forward or save later" +} + +func (m *mediaArtifactTool) Parameters() map[string]any { + return map[string]any{ + "type": "object", + "properties": map[string]any{}, + } +} + +func (m *mediaArtifactTool) Execute(ctx context.Context, args map[string]any) *tools.ToolResult { + ref, err := m.store.Store(m.path, media.MediaMeta{ + Filename: filepath.Base(m.path), + ContentType: "image/png", + Source: "test:media_artifact_tool", + }, "test:media_artifact") + if err != nil { + return tools.ErrorResult(err.Error()).WithError(err) + } + return tools.MediaResult("Artifact created.", []string{ref}) +} + type toolLimitTestTool struct{} func (m *toolLimitTestTool) Name() string { diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go index ff3fa399c..f4a64807e 100644 --- a/pkg/channels/manager.go +++ b/pkg/channels/manager.go @@ -771,7 +771,7 @@ func (m *Manager) runMediaWorker(ctx context.Context, name string, w *channelWor if !ok { return } - m.sendMediaWithRetry(ctx, name, w, msg) + _ = m.sendMediaWithRetry(ctx, name, w, msg) case <-ctx.Done(): return } @@ -779,26 +779,31 @@ func (m *Manager) runMediaWorker(ctx context.Context, name string, w *channelWor } // sendMediaWithRetry sends a media message through the channel with rate limiting and -// retry logic. If the channel does not implement MediaSender, it silently skips. -func (m *Manager) sendMediaWithRetry(ctx context.Context, name string, w *channelWorker, msg bus.OutboundMediaMessage) { +// retry logic. It returns nil on success, or the last error after retries. +func (m *Manager) sendMediaWithRetry( + ctx context.Context, + name string, + w *channelWorker, + msg bus.OutboundMediaMessage, +) error { ms, ok := w.ch.(MediaSender) if !ok { logger.DebugCF("channels", "Channel does not support MediaSender, skipping media", map[string]any{ "channel": name, }) - return + return nil } // Rate limit: wait for token if err := w.limiter.Wait(ctx); err != nil { - return + return err } var lastErr error for attempt := 0; attempt <= maxRetries; attempt++ { lastErr = ms.SendMedia(ctx, msg) if lastErr == nil { - return + return nil } // Permanent failures — don't retry @@ -817,7 +822,7 @@ func (m *Manager) sendMediaWithRetry(ctx context.Context, name string, w *channe case <-time.After(rateLimitDelay): continue case <-ctx.Done(): - return + return ctx.Err() } } @@ -826,7 +831,7 @@ func (m *Manager) sendMediaWithRetry(ctx context.Context, name string, w *channe select { case <-time.After(backoff): case <-ctx.Done(): - return + return ctx.Err() } } @@ -837,6 +842,7 @@ func (m *Manager) sendMediaWithRetry(ctx context.Context, name string, w *channe "error": lastErr.Error(), "retries": maxRetries, }) + return lastErr } // runTTLJanitor periodically scans the typingStops and placeholders maps @@ -1029,6 +1035,26 @@ func (m *Manager) SendMessage(ctx context.Context, msg bus.OutboundMessage) erro return nil } +// SendMedia sends outbound media synchronously through the channel worker's +// rate limiter and retry logic. It blocks until the media is delivered (or all +// retries are exhausted), which preserves ordering when later agent behavior +// depends on actual media delivery. +func (m *Manager) SendMedia(ctx context.Context, msg bus.OutboundMediaMessage) error { + m.mu.RLock() + _, exists := m.channels[msg.Channel] + w, wExists := m.workers[msg.Channel] + m.mu.RUnlock() + + if !exists { + return fmt.Errorf("channel %s not found", msg.Channel) + } + if !wExists || w == nil { + return fmt.Errorf("channel %s has no active worker", msg.Channel) + } + + return m.sendMediaWithRetry(ctx, msg.Channel, w, msg) +} + func (m *Manager) SendToChannel(ctx context.Context, channelName, chatID, content string) error { m.mu.RLock() _, exists := m.channels[channelName] diff --git a/pkg/channels/manager_test.go b/pkg/channels/manager_test.go index 7dfec9ebf..6a5dd7e30 100644 --- a/pkg/channels/manager_test.go +++ b/pkg/channels/manager_test.go @@ -43,6 +43,20 @@ func (m *mockChannel) EditMessage(ctx context.Context, chatID, messageID, conten return nil } +type mockMediaChannel struct { + mockChannel + sendMediaFn func(ctx context.Context, msg bus.OutboundMediaMessage) error + sentMediaMessages []bus.OutboundMediaMessage +} + +func (m *mockMediaChannel) SendMedia(ctx context.Context, msg bus.OutboundMediaMessage) error { + m.sentMediaMessages = append(m.sentMediaMessages, msg) + if m.sendMediaFn != nil { + return m.sendMediaFn(ctx, msg) + } + return nil +} + // newTestManager creates a minimal Manager suitable for unit tests. func newTestManager() *Manager { return &Manager{ @@ -208,6 +222,62 @@ func TestSendWithRetry_MaxRetriesExhausted(t *testing.T) { } } +func TestSendMedia_Success(t *testing.T) { + m := newTestManager() + var callCount int + ch := &mockMediaChannel{ + sendMediaFn: func(_ context.Context, _ bus.OutboundMediaMessage) error { + callCount++ + return nil + }, + } + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + err := m.SendMedia(context.Background(), bus.OutboundMediaMessage{ + Channel: "test", + ChatID: "chat1", + Parts: []bus.MediaPart{{Ref: "media://abc"}}, + }) + if err != nil { + t.Fatalf("SendMedia() error = %v", err) + } + if callCount != 1 { + t.Fatalf("expected 1 SendMedia call, got %d", callCount) + } +} + +func TestSendMedia_PropagatesFailure(t *testing.T) { + m := newTestManager() + ch := &mockMediaChannel{ + sendMediaFn: func(_ context.Context, _ bus.OutboundMediaMessage) error { + return fmt.Errorf("bad upload: %w", ErrSendFailed) + }, + } + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + err := m.SendMedia(context.Background(), bus.OutboundMediaMessage{ + Channel: "test", + ChatID: "chat1", + Parts: []bus.MediaPart{{Ref: "media://abc"}}, + }) + if err == nil { + t.Fatal("expected SendMedia to return error") + } + if !errors.Is(err, ErrSendFailed) { + t.Fatalf("expected ErrSendFailed, got %v", err) + } +} + func TestSendWithRetry_UnknownError(t *testing.T) { m := newTestManager() var callCount int diff --git a/pkg/tools/mcp_tool.go b/pkg/tools/mcp_tool.go index 6e53cf354..5bffb4e89 100644 --- a/pkg/tools/mcp_tool.go +++ b/pkg/tools/mcp_tool.go @@ -5,9 +5,13 @@ import ( "encoding/json" "fmt" "hash/fnv" + "os" "strings" + "time" "github.com/modelcontextprotocol/go-sdk/mcp" + + "github.com/sipeed/picoclaw/pkg/media" ) // MCPManager defines the interface for MCP manager operations @@ -25,6 +29,7 @@ type MCPTool struct { manager MCPManager serverName string tool *mcp.Tool + mediaStore media.MediaStore } // NewMCPTool creates a new MCP tool wrapper @@ -36,6 +41,10 @@ func NewMCPTool(manager MCPManager, serverName string, tool *mcp.Tool) *MCPTool } } +func (t *MCPTool) SetMediaStore(store media.MediaStore) { + t.mediaStore = store +} + // sanitizeIdentifierComponent normalizes a string so it can be safely used // as part of a tool/function identifier for downstream providers. // It: @@ -218,13 +227,7 @@ func (t *MCPTool) Execute(ctx context.Context, args map[string]any) *ToolResult WithError(fmt.Errorf("MCP tool error: %s", errMsg)) } - // Extract text content from result - output := extractContentText(result.Content) - - return &ToolResult{ - ForLLM: output, - IsError: false, - } + return t.normalizeResultContent(ctx, result.Content) } // extractContentText extracts text from MCP content array @@ -233,14 +236,269 @@ func extractContentText(content []mcp.Content) string { for _, c := range content { switch v := c.(type) { case *mcp.TextContent: - parts = append(parts, v.Text) + parts = append(parts, sanitizeToolLLMContent(v.Text)) case *mcp.ImageContent: - // For images, just indicate that an image was returned - parts = append(parts, fmt.Sprintf("[Image: %s]", v.MIMEType)) + parts = append(parts, fmt.Sprintf("[Image: %s]", normalizedMIMEType(v.MIMEType))) + case *mcp.AudioContent: + parts = append(parts, fmt.Sprintf("[Audio: %s]", normalizedMIMEType(v.MIMEType))) + case *mcp.ResourceLink: + parts = append(parts, summarizeResourceLink(v)) + case *mcp.EmbeddedResource: + parts = append(parts, summarizeEmbeddedResource(v)) default: // For other content types, use string representation parts = append(parts, fmt.Sprintf("[Content: %T]", v)) } } - return strings.Join(parts, "\n") + return sanitizeToolLLMContent(strings.Join(parts, "\n")) +} + +func (t *MCPTool) normalizeResultContent(ctx context.Context, content []mcp.Content) *ToolResult { + llmParts := make([]string, 0, len(content)) + mediaRefs := make([]string, 0, len(content)) + + for _, c := range content { + switch v := c.(type) { + case *mcp.TextContent: + text := strings.TrimSpace(sanitizeToolLLMContent(v.Text)) + if text != "" { + llmParts = append(llmParts, text) + } + case *mcp.ImageContent: + ref, note := t.storeBinaryContent( + ctx, + "image", + normalizedMIMEType(v.MIMEType), + v.Data, + v.Annotations, + ) + if ref != "" { + mediaRefs = append(mediaRefs, ref) + } + if note != "" { + llmParts = append(llmParts, note) + } + case *mcp.AudioContent: + ref, note := t.storeBinaryContent( + ctx, + "audio", + normalizedMIMEType(v.MIMEType), + v.Data, + v.Annotations, + ) + if ref != "" { + mediaRefs = append(mediaRefs, ref) + } + if note != "" { + llmParts = append(llmParts, note) + } + case *mcp.ResourceLink: + llmParts = append(llmParts, summarizeResourceLink(v)) + case *mcp.EmbeddedResource: + ref, note := t.storeEmbeddedResource(ctx, v) + if ref != "" { + mediaRefs = append(mediaRefs, ref) + } + if note != "" { + llmParts = append(llmParts, note) + } + default: + llmParts = append(llmParts, fmt.Sprintf("[MCP returned unsupported content type %T]", v)) + } + } + + result := &ToolResult{ + ForLLM: strings.Join(compactStrings(llmParts), "\n"), + Media: mediaRefs, + } + return result +} + +func (t *MCPTool) storeEmbeddedResource(ctx context.Context, content *mcp.EmbeddedResource) (string, string) { + if content == nil || content.Resource == nil { + return "", "[MCP returned an embedded resource without data.]" + } + + resource := content.Resource + if len(resource.Blob) > 0 { + return t.storeBinaryContent( + ctx, + "resource", + normalizedMIMEType(resource.MIMEType), + resource.Blob, + content.Annotations, + ) + } + + if strings.TrimSpace(resource.Text) != "" { + return "", sanitizeToolLLMContent(resource.Text) + } + + return "", summarizeEmbeddedResource(content) +} + +func (t *MCPTool) storeBinaryContent( + ctx context.Context, + kind string, + mimeType string, + data []byte, + annotations *mcp.Annotations, +) (string, string) { + if len(data) == 0 { + return "", fmt.Sprintf("[MCP returned %s content (%s) but it was empty.]", kind, mimeType) + } + if !annotationsAllowUser(annotations) { + return "", fmt.Sprintf( + "[MCP returned %s content (%s) for non-user audience; omitted from model context.]", + kind, + mimeType, + ) + } + if t.mediaStore == nil { + return "", fmt.Sprintf( + "[MCP returned %s content (%s); omitted from model context because media delivery is unavailable.]", + kind, + mimeType, + ) + } + + channel := ToolChannel(ctx) + chatID := ToolChatID(ctx) + if channel == "" || chatID == "" { + return "", fmt.Sprintf( + "[MCP returned %s content (%s); omitted from model context because no target chat was available.]", + kind, + mimeType, + ) + } + + dir := media.TempDir() + if err := os.MkdirAll(dir, 0o700); err != nil { + return "", fmt.Sprintf("[MCP returned %s content (%s) but it could not be stored.]", kind, mimeType) + } + + ext := extensionForMIMEType(mimeType) + tmpFile, err := os.CreateTemp(dir, "mcp-*"+ext) + if err != nil { + return "", fmt.Sprintf("[MCP returned %s content (%s) but it could not be stored.]", kind, mimeType) + } + tmpPath := tmpFile.Name() + if _, err = tmpFile.Write(data); err != nil { + _ = tmpFile.Close() + _ = os.Remove(tmpPath) + return "", fmt.Sprintf("[MCP returned %s content (%s) but it could not be stored.]", kind, mimeType) + } + if err = tmpFile.Close(); err != nil { + _ = os.Remove(tmpPath) + return "", fmt.Sprintf("[MCP returned %s content (%s) but it could not be stored.]", kind, mimeType) + } + + scope := fmt.Sprintf( + "tool:mcp:%s:%s:%s:%d", + sanitizeIdentifierComponent(t.serverName), + channel, + chatID, + time.Now().UnixNano(), + ) + filename := fmt.Sprintf( + "%s_%s%s", + sanitizeIdentifierComponent(t.serverName), + sanitizeIdentifierComponent(t.tool.Name), + ext, + ) + + ref, err := t.mediaStore.Store(tmpPath, media.MediaMeta{ + Filename: filename, + ContentType: mimeType, + Source: fmt.Sprintf( + "tool:mcp:%s:%s", + sanitizeIdentifierComponent(t.serverName), + sanitizeIdentifierComponent(t.tool.Name), + ), + }, scope) + if err != nil { + _ = os.Remove(tmpPath) + return "", fmt.Sprintf( + "[MCP returned %s content (%s) but it could not be registered as media.]", + kind, + mimeType, + ) + } + + return ref, fmt.Sprintf( + "[MCP returned %s content (%s); omitted from model context and stored as a local media artifact.]", + kind, + mimeType, + ) +} + +func summarizeResourceLink(content *mcp.ResourceLink) string { + if content == nil { + return "[MCP returned an empty resource link.]" + } + + parts := []string{"[MCP returned resource link"} + if content.Name != "" { + parts = append(parts, fmt.Sprintf("name=%q", content.Name)) + } + if content.URI != "" { + parts = append(parts, fmt.Sprintf("uri=%q", content.URI)) + } + if content.MIMEType != "" { + parts = append(parts, fmt.Sprintf("mime=%q", content.MIMEType)) + } + if content.Description != "" { + desc := strings.TrimSpace(content.Description) + if len(desc) > 200 { + desc = desc[:200] + "..." + } + parts = append(parts, fmt.Sprintf("description=%q", desc)) + } + return strings.Join(parts, ", ") + "]" +} + +func summarizeEmbeddedResource(content *mcp.EmbeddedResource) string { + if content == nil || content.Resource == nil { + return "[MCP returned an embedded resource.]" + } + + resource := content.Resource + if resource.URI != "" { + return fmt.Sprintf( + "[MCP returned embedded resource %q (%s).]", + resource.URI, + normalizedMIMEType(resource.MIMEType), + ) + } + return fmt.Sprintf("[MCP returned embedded resource (%s).]", normalizedMIMEType(resource.MIMEType)) +} + +func annotationsAllowUser(annotations *mcp.Annotations) bool { + if annotations == nil || len(annotations.Audience) == 0 { + return true + } + for _, audience := range annotations.Audience { + if strings.EqualFold(string(audience), "user") { + return true + } + } + return false +} + +func normalizedMIMEType(mimeType string) string { + if strings.TrimSpace(mimeType) == "" { + return "application/octet-stream" + } + return mimeType +} + +func compactStrings(parts []string) []string { + compact := make([]string, 0, len(parts)) + for _, part := range parts { + if strings.TrimSpace(part) == "" { + continue + } + compact = append(compact, part) + } + return compact } diff --git a/pkg/tools/mcp_tool_test.go b/pkg/tools/mcp_tool_test.go index 95bb0f992..8bbac3bc7 100644 --- a/pkg/tools/mcp_tool_test.go +++ b/pkg/tools/mcp_tool_test.go @@ -3,10 +3,14 @@ package tools import ( "context" "fmt" + "os" + "path/filepath" "strings" "testing" "github.com/modelcontextprotocol/go-sdk/mcp" + + "github.com/sipeed/picoclaw/pkg/media" ) // MockMCPManager is a mock implementation of MCPManager interface for testing @@ -490,3 +494,143 @@ func TestMCPTool_Parameters_MapSchema(t *testing.T) { t.Errorf("Name type should be 'string', got '%v'", nameParam["type"]) } } + +func TestMCPTool_Execute_ImageContentStoredAsMedia(t *testing.T) { + store := media.NewFileMediaStore() + manager := &MockMCPManager{ + callToolFunc: func(ctx context.Context, serverName, toolName string, arguments map[string]any) (*mcp.CallToolResult, error) { + return &mcp.CallToolResult{ + Content: []mcp.Content{ + &mcp.ImageContent{ + Data: []byte("fake-image-bytes"), + MIMEType: "image/png", + }, + }, + }, nil + }, + } + + mcpTool := NewMCPTool(manager, "screenshoto", &mcp.Tool{Name: "take_screenshot"}) + mcpTool.SetMediaStore(store) + + result := mcpTool.Execute(WithToolContext(context.Background(), "telegram", "chat-42"), nil) + + if result.IsError { + t.Fatalf("expected success, got %q", result.ForLLM) + } + if len(result.Media) != 1 { + t.Fatalf("expected 1 media ref, got %d", len(result.Media)) + } + if result.ResponseHandled { + t.Fatal("expected MCP image artifact not to mark response as handled") + } + if !strings.Contains(result.ForLLM, "stored as a local media artifact") { + t.Fatalf("expected local media artifact note, got %q", result.ForLLM) + } + + path, meta, err := store.ResolveWithMeta(result.Media[0]) + if err != nil { + t.Fatalf("expected stored media ref to resolve: %v", err) + } + if meta.ContentType != "image/png" { + t.Fatalf("expected image/png content type, got %q", meta.ContentType) + } + if filepath.Ext(path) != ".png" { + t.Fatalf("expected png temp file, got %q", path) + } + data, err := os.ReadFile(path) + if err != nil { + t.Fatalf("expected stored media file to be readable: %v", err) + } + if string(data) != "fake-image-bytes" { + t.Fatalf("expected stored media bytes to match input, got %q", string(data)) + } +} + +func TestMCPTool_Execute_EmbeddedResourceBlobStoredAsMedia(t *testing.T) { + store := media.NewFileMediaStore() + manager := &MockMCPManager{ + callToolFunc: func(ctx context.Context, serverName, toolName string, arguments map[string]any) (*mcp.CallToolResult, error) { + return &mcp.CallToolResult{ + Content: []mcp.Content{ + &mcp.EmbeddedResource{ + Resource: &mcp.ResourceContents{ + URI: "file:///tmp/report.png", + MIMEType: "image/png", + Blob: []byte("blob-bytes"), + }, + }, + }, + }, nil + }, + } + + mcpTool := NewMCPTool(manager, "grafana", &mcp.Tool{Name: "get_dashboard_image"}) + mcpTool.SetMediaStore(store) + + result := mcpTool.Execute(WithToolContext(context.Background(), "telegram", "chat-42"), nil) + + if len(result.Media) != 1 { + t.Fatalf("expected embedded resource blob to be stored as media, got %d refs", len(result.Media)) + } + path, _, err := store.ResolveWithMeta(result.Media[0]) + if err != nil { + t.Fatalf("expected stored media ref to resolve: %v", err) + } + data, err := os.ReadFile(path) + if err != nil { + t.Fatalf("expected stored media file to be readable: %v", err) + } + if string(data) != "blob-bytes" { + t.Fatalf("expected stored blob bytes to match input, got %q", string(data)) + } +} + +func TestMCPTool_Execute_RespectsUserAudienceForBinaryContent(t *testing.T) { + store := media.NewFileMediaStore() + manager := &MockMCPManager{ + callToolFunc: func(ctx context.Context, serverName, toolName string, arguments map[string]any) (*mcp.CallToolResult, error) { + return &mcp.CallToolResult{ + Content: []mcp.Content{ + &mcp.ImageContent{ + Data: []byte("assistant-only"), + MIMEType: "image/png", + Annotations: &mcp.Annotations{Audience: []mcp.Role{"assistant"}}, + }, + }, + }, nil + }, + } + + mcpTool := NewMCPTool(manager, "screenshoto", &mcp.Tool{Name: "take_screenshot"}) + mcpTool.SetMediaStore(store) + + result := mcpTool.Execute(WithToolContext(context.Background(), "telegram", "chat-42"), nil) + + if len(result.Media) != 0 { + t.Fatalf("expected no media ref for non-user audience, got %d", len(result.Media)) + } + if !strings.Contains(result.ForLLM, "non-user audience") { + t.Fatalf("expected audience note, got %q", result.ForLLM) + } +} + +func TestMCPTool_Execute_LargeBase64TextIsOmittedFromContext(t *testing.T) { + manager := &MockMCPManager{ + callToolFunc: func(ctx context.Context, serverName, toolName string, arguments map[string]any) (*mcp.CallToolResult, error) { + return &mcp.CallToolResult{ + Content: []mcp.Content{ + &mcp.TextContent{Text: strings.Repeat("QUJD", 400)}, + }, + }, nil + }, + } + + mcpTool := NewMCPTool(manager, "test_server", &mcp.Tool{Name: "dump_payload"}) + + result := mcpTool.Execute(context.Background(), nil) + + if result.ForLLM != largeBase64OmittedMessage { + t.Fatalf("expected sanitized large base64 note, got %q", result.ForLLM) + } +} diff --git a/pkg/tools/normalization.go b/pkg/tools/normalization.go new file mode 100644 index 000000000..3a76c5d92 --- /dev/null +++ b/pkg/tools/normalization.go @@ -0,0 +1,292 @@ +package tools + +import ( + "encoding/base64" + "fmt" + "mime" + "os" + "path/filepath" + "regexp" + "strings" + "time" + "unicode" + + "github.com/sipeed/picoclaw/pkg/media" +) + +const ( + largeBase64OmittedMessage = "[Tool returned a large base64-like payload; omitted from model context.]" + inlineMediaOmittedMessage = "[Tool returned inline media content; omitted from model context.]" + inlineMediaStoredMessage = "[Tool returned inline media content (%s); omitted from model context and registered as a media attachment.]" +) + +var ( + inlineMarkdownDataURLRe = regexp.MustCompile(`!\[[^\]]*\]\((data:[^)]+)\)`) + inlineRawDataURLRe = regexp.MustCompile(`data:[^;\s]+;base64,[A-Za-z0-9+/=\r\n]+`) +) + +func normalizeToolResult( + result *ToolResult, + toolName string, + store media.MediaStore, + channel string, + chatID string, +) *ToolResult { + if result == nil { + return nil + } + + notes := make([]string, 0, 2) + seen := make(map[string]struct{}) + + if store != nil && channel != "" && chatID != "" { + var refs []string + var extractedNotes []string + + result.ForLLM, refs, extractedNotes = extractInlineMediaRefs( + result.ForLLM, + toolName, + store, + channel, + chatID, + seen, + ) + result.Media = append(result.Media, refs...) + notes = append(notes, extractedNotes...) + + result.ForUser, refs, extractedNotes = extractInlineMediaRefs( + result.ForUser, + toolName, + store, + channel, + chatID, + seen, + ) + result.Media = append(result.Media, refs...) + notes = append(notes, extractedNotes...) + } + + result.ForLLM = sanitizeToolLLMContent(result.ForLLM) + + if len(result.Media) > 0 && len(notes) > 0 { + if strings.TrimSpace(result.ForLLM) == "" { + result.ForLLM = strings.Join(notes, "\n") + } else { + result.ForLLM = strings.TrimSpace(result.ForLLM) + "\n" + strings.Join(notes, "\n") + } + } + if len(result.Media) > 0 && strings.TrimSpace(result.ForLLM) == "" { + result.ForLLM = "[Tool returned media content; omitted from model context and registered as a media attachment.]" + } + + return result +} + +func sanitizeToolLLMContent(text string) string { + trimmed := strings.TrimSpace(text) + if trimmed == "" { + return text + } + if inlineMarkdownDataURLRe.MatchString(trimmed) || inlineRawDataURLRe.MatchString(trimmed) { + cleaned := inlineMarkdownDataURLRe.ReplaceAllString(trimmed, "") + cleaned = inlineRawDataURLRe.ReplaceAllString(cleaned, "") + cleaned = strings.TrimSpace(cleaned) + if cleaned == "" { + return inlineMediaOmittedMessage + } + return cleaned + "\n" + inlineMediaOmittedMessage + } + if looksLikeLargeBase64Payload(trimmed) { + return largeBase64OmittedMessage + } + return text +} + +func looksLikeLargeBase64Payload(text string) bool { + trimmed := strings.TrimSpace(text) + if len(trimmed) < 1024 { + return false + } + + nonSpace := 0 + base64Like := 0 + spaceCount := 0 + + for _, r := range trimmed { + if unicode.IsSpace(r) { + spaceCount++ + continue + } + nonSpace++ + if (r >= 'A' && r <= 'Z') || + (r >= 'a' && r <= 'z') || + (r >= '0' && r <= '9') || + r == '+' || r == '/' || r == '=' { + base64Like++ + } + } + + if nonSpace == 0 { + return false + } + + ratio := float64(base64Like) / float64(nonSpace) + return ratio >= 0.97 && spaceCount <= len(trimmed)/128 +} + +func extractInlineMediaRefs( + text string, + toolName string, + store media.MediaStore, + channel string, + chatID string, + seen map[string]struct{}, +) (cleaned string, refs []string, notes []string) { + cleaned = text + + matches := inlineMarkdownDataURLRe.FindAllStringSubmatch(cleaned, -1) + for _, match := range matches { + if len(match) < 2 { + continue + } + dataURL := match[1] + ref, note := storeInlineDataURL(toolName, store, channel, chatID, dataURL, seen) + if ref != "" { + refs = append(refs, ref) + } + if note != "" { + notes = append(notes, note) + } + cleaned = strings.ReplaceAll(cleaned, match[0], "") + } + + rawMatches := inlineRawDataURLRe.FindAllString(cleaned, -1) + for _, dataURL := range rawMatches { + ref, note := storeInlineDataURL(toolName, store, channel, chatID, dataURL, seen) + if ref != "" { + refs = append(refs, ref) + } + if note != "" { + notes = append(notes, note) + } + cleaned = strings.ReplaceAll(cleaned, dataURL, "") + } + + return strings.TrimSpace(cleaned), refs, notes +} + +func storeInlineDataURL( + toolName string, + store media.MediaStore, + channel string, + chatID string, + dataURL string, + seen map[string]struct{}, +) (ref string, note string) { + dataURL = strings.TrimSpace(dataURL) + if _, ok := seen[dataURL]; ok { + return "", "" + } + seen[dataURL] = struct{}{} + + if !strings.HasPrefix(strings.ToLower(dataURL), "data:") { + return "", "" + } + + comma := strings.IndexByte(dataURL, ',') + if comma <= 5 { + return "", "[Tool returned inline media content that could not be parsed.]" + } + + metaPart := dataURL[:comma] + payload := dataURL[comma+1:] + if !strings.Contains(strings.ToLower(metaPart), ";base64") { + return "", "[Tool returned inline media content that was not base64-encoded.]" + } + + mimeType := strings.TrimSpace(strings.TrimPrefix(metaPart, "data:")) + if semi := strings.IndexByte(mimeType, ';'); semi >= 0 { + mimeType = mimeType[:semi] + } + if mimeType == "" { + mimeType = "application/octet-stream" + } + + payload = strings.NewReplacer("\n", "", "\r", "", "\t", "", " ", "").Replace(payload) + decoded, err := base64.StdEncoding.DecodeString(payload) + if err != nil { + return "", fmt.Sprintf("[Tool returned inline media content (%s) that could not be decoded.]", mimeType) + } + + dir := media.TempDir() + if err = os.MkdirAll(dir, 0o700); err != nil { + return "", fmt.Sprintf("[Tool returned inline media content (%s) but it could not be stored.]", mimeType) + } + + ext := extensionForMIMEType(mimeType) + tmpFile, err := os.CreateTemp(dir, "tool-inline-*"+ext) + if err != nil { + return "", fmt.Sprintf("[Tool returned inline media content (%s) but it could not be stored.]", mimeType) + } + tmpPath := tmpFile.Name() + if _, err = tmpFile.Write(decoded); err != nil { + tmpFile.Close() + _ = os.Remove(tmpPath) + return "", fmt.Sprintf("[Tool returned inline media content (%s) but it could not be stored.]", mimeType) + } + if err = tmpFile.Close(); err != nil { + _ = os.Remove(tmpPath) + return "", fmt.Sprintf("[Tool returned inline media content (%s) but it could not be stored.]", mimeType) + } + + filename := sanitizeIdentifierComponent(toolName) + ext + scope := fmt.Sprintf( + "tool:inline:%s:%s:%s:%d", + sanitizeIdentifierComponent(toolName), + channel, + chatID, + time.Now().UnixNano(), + ) + + ref, err = store.Store(tmpPath, media.MediaMeta{ + Filename: filename, + ContentType: mimeType, + Source: fmt.Sprintf("tool:inline:%s", sanitizeIdentifierComponent(toolName)), + }, scope) + if err != nil { + _ = os.Remove(tmpPath) + return "", fmt.Sprintf("[Tool returned inline media content (%s) but it could not be registered.]", mimeType) + } + + return ref, fmt.Sprintf(inlineMediaStoredMessage, mimeType) +} + +func extensionForMIMEType(mimeType string) string { + if mimeType == "" { + return ".bin" + } + if exts, err := mime.ExtensionsByType(mimeType); err == nil && len(exts) > 0 { + return exts[0] + } + + switch strings.ToLower(mimeType) { + case "image/jpeg": + return ".jpg" + case "image/png": + return ".png" + case "image/gif": + return ".gif" + case "image/webp": + return ".webp" + case "audio/wav", "audio/x-wav": + return ".wav" + case "audio/mpeg": + return ".mp3" + case "audio/ogg": + return ".ogg" + case "video/mp4": + return ".mp4" + default: + return filepath.Ext(mimeType) + } +} diff --git a/pkg/tools/registry.go b/pkg/tools/registry.go index 0b0f51cc1..902eb4423 100644 --- a/pkg/tools/registry.go +++ b/pkg/tools/registry.go @@ -9,6 +9,7 @@ import ( "time" "github.com/sipeed/picoclaw/pkg/logger" + "github.com/sipeed/picoclaw/pkg/media" "github.com/sipeed/picoclaw/pkg/providers" ) @@ -19,9 +20,14 @@ type ToolEntry struct { } type ToolRegistry struct { - tools map[string]*ToolEntry - mu sync.RWMutex - version atomic.Uint64 // incremented on Register/RegisterHidden for cache invalidation + tools map[string]*ToolEntry + mu sync.RWMutex + version atomic.Uint64 // incremented on Register/RegisterHidden for cache invalidation + mediaStore media.MediaStore +} + +type mediaStoreAware interface { + SetMediaStore(store media.MediaStore) } func NewToolRegistry() *ToolRegistry { @@ -43,6 +49,9 @@ func (r *ToolRegistry) Register(tool Tool) { IsCore: true, TTL: 0, // Core tools do not use TTL } + if aware, ok := tool.(mediaStoreAware); ok && r.mediaStore != nil { + aware.SetMediaStore(r.mediaStore) + } r.version.Add(1) logger.DebugCF("tools", "Registered core tool", map[string]any{"name": name}) } @@ -61,10 +70,27 @@ func (r *ToolRegistry) RegisterHidden(tool Tool) { IsCore: false, TTL: 0, } + if aware, ok := tool.(mediaStoreAware); ok && r.mediaStore != nil { + aware.SetMediaStore(r.mediaStore) + } r.version.Add(1) logger.DebugCF("tools", "Registered hidden tool", map[string]any{"name": name}) } +// SetMediaStore injects a MediaStore into all registered tools that can +// consume it, and remembers it for future registrations. +func (r *ToolRegistry) SetMediaStore(store media.MediaStore) { + r.mu.Lock() + defer r.mu.Unlock() + + r.mediaStore = store + for _, entry := range r.tools { + if aware, ok := entry.Tool.(mediaStoreAware); ok { + aware.SetMediaStore(store) + } + } +} + // PromoteTools atomically sets the TTL for multiple non-core tools. // This prevents a concurrent TickTTL from decrementing between promotions. func (r *ToolRegistry) PromoteTools(names []string, ttl int) { @@ -230,6 +256,8 @@ func (r *ToolRegistry) ExecuteWithContext( } } + result = normalizeToolResult(result, name, r.mediaStore, channel, chatID) + duration := time.Since(start) // Log based on result type @@ -251,7 +279,7 @@ func (r *ToolRegistry) ExecuteWithContext( map[string]any{ "tool": name, "duration_ms": duration.Milliseconds(), - "result_length": len(result.ForLLM), + "result_length": len(result.ContentForLLM()), }) } @@ -346,7 +374,8 @@ func (r *ToolRegistry) Clone() *ToolRegistry { r.mu.RLock() defer r.mu.RUnlock() clone := &ToolRegistry{ - tools: make(map[string]*ToolEntry, len(r.tools)), + tools: make(map[string]*ToolEntry, len(r.tools)), + mediaStore: r.mediaStore, } for name, entry := range r.tools { clone.tools[name] = &ToolEntry{ diff --git a/pkg/tools/registry_test.go b/pkg/tools/registry_test.go index 967758dfa..db52749f6 100644 --- a/pkg/tools/registry_test.go +++ b/pkg/tools/registry_test.go @@ -3,10 +3,13 @@ package tools import ( "context" "errors" + "os" + "path/filepath" "strings" "sync" "testing" + "github.com/sipeed/picoclaw/pkg/media" "github.com/sipeed/picoclaw/pkg/providers" ) @@ -46,6 +49,15 @@ func (m *mockAsyncRegistryTool) ExecuteAsync(_ context.Context, args map[string] return m.result } +type mockMediaStoreAwareTool struct { + mockRegistryTool + store media.MediaStore +} + +func (m *mockMediaStoreAwareTool) SetMediaStore(store media.MediaStore) { + m.store = store +} + // --- helpers --- func newMockTool(name, desc string) *mockRegistryTool { @@ -621,3 +633,102 @@ func TestToolRegistry_Execute_PanicDoesNotAffectOtherTools(t *testing.T) { t.Errorf("expected 'success', got %q", result2.ForLLM) } } + +func TestToolRegistry_SetMediaStore_PropagatesToExistingAndNewTools(t *testing.T) { + r := NewToolRegistry() + store := media.NewFileMediaStore() + + existing := &mockMediaStoreAwareTool{ + mockRegistryTool: *newMockTool("existing", "existing tool"), + } + r.Register(existing) + + r.SetMediaStore(store) + if existing.store != store { + t.Fatal("expected existing tool to receive media store") + } + + later := &mockMediaStoreAwareTool{ + mockRegistryTool: *newMockTool("later", "later tool"), + } + r.Register(later) + + if later.store != store { + t.Fatal("expected newly registered tool to inherit media store") + } +} + +func TestToolRegistry_ExecuteWithContext_SanitizesLargeBase64Payload(t *testing.T) { + r := NewToolRegistry() + payload := strings.Repeat("QUJD", 400) + r.Register(&mockRegistryTool{ + name: "base64_tool", + desc: "returns huge base64", + params: map[string]any{}, + result: SilentResult(payload), + }) + + result := r.ExecuteWithContext(context.Background(), "base64_tool", nil, "telegram", "chat-1", nil) + + if result.ForLLM != largeBase64OmittedMessage { + t.Fatalf("expected sanitized payload, got %q", result.ForLLM) + } +} + +func TestToolRegistry_ExecuteWithContext_ExtractsInlineMediaDataURL(t *testing.T) { + r := NewToolRegistry() + store := media.NewFileMediaStore() + r.SetMediaStore(store) + + payload := "![screenshot](data:image/png;base64,aGVsbG8=)" + r.Register(&mockRegistryTool{ + name: "inline_media_tool", + desc: "returns inline data url", + params: map[string]any{}, + result: SilentResult(payload), + }) + + result := r.ExecuteWithContext(context.Background(), "inline_media_tool", nil, "telegram", "chat-42", nil) + + if len(result.Media) != 1 { + t.Fatalf("expected 1 media ref, got %d", len(result.Media)) + } + if strings.Contains(result.ForLLM, "data:image/png;base64") { + t.Fatalf("expected inline data URL to be stripped from ForLLM, got %q", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "registered as a media attachment") { + t.Fatalf("expected delivery note in ForLLM, got %q", result.ForLLM) + } + + path, err := store.Resolve(result.Media[0]) + if err != nil { + t.Fatalf("expected stored media ref to resolve: %v", err) + } + if _, err := os.Stat(path); err != nil { + t.Fatalf("expected stored media file to exist: %v", err) + } + if filepath.Ext(path) != ".png" { + t.Fatalf("expected stored inline media to use png extension, got %q", path) + } +} + +func TestToolRegistry_ExecuteWithContext_SanitizesInlineMediaWithoutStore(t *testing.T) { + r := NewToolRegistry() + + payload := "before ![img](data:image/png;base64,aGVsbG8=) after" + r.Register(&mockRegistryTool{ + name: "inline_media_no_store", + desc: "returns inline data url without store", + params: map[string]any{}, + result: SilentResult(payload), + }) + + result := r.ExecuteWithContext(context.Background(), "inline_media_no_store", nil, "telegram", "chat-42", nil) + + if strings.Contains(result.ForLLM, "data:image/png;base64") { + t.Fatalf("expected inline data URL to be removed from ForLLM, got %q", result.ForLLM) + } + if !strings.Contains(result.ForLLM, inlineMediaOmittedMessage) { + t.Fatalf("expected inline media omission note, got %q", result.ForLLM) + } +} diff --git a/pkg/tools/result.go b/pkg/tools/result.go index cab833284..f75ce6d40 100644 --- a/pkg/tools/result.go +++ b/pkg/tools/result.go @@ -1,6 +1,14 @@ package tools -import "encoding/json" +import ( + "encoding/json" + "strings" +) + +const ( + handledToolLLMNote = "The requested output has already been delivered to the user in the current chat. Do not call send_file or any other delivery tool again. If you reply, provide only a brief confirmation." + artifactPathsLLMNote = "Use `send_file` with one of these paths to send it to the user, or use file/exec tools to save it inside the workspace if requested." +) // ToolResult represents the structured return value from tool execution. // It provides clear semantics for different types of results and supports @@ -34,6 +42,48 @@ type ToolResult struct { // Media contains media store refs produced by this tool. // When non-empty, the agent will publish these as OutboundMediaMessage. Media []string `json:"media,omitempty"` + + // ArtifactTags exposes local artifact paths back to the LLM in a structured + // form, e.g. "[file:/tmp/example.png]". This is used when a tool produced a + // reusable local artifact but did not deliver it to the user yet. + ArtifactTags []string `json:"artifact_tags,omitempty"` + + // ResponseHandled indicates that this tool execution already satisfied the + // user's request at the channel/output level, so the agent loop can stop + // without a follow-up assistant response. + ResponseHandled bool `json:"response_handled,omitempty"` +} + +// ContentForLLM returns the normalized textual content to append to the +// conversation after a tool call. Errors fall back to Err when ForLLM is empty. +func (tr *ToolResult) ContentForLLM() string { + if tr == nil { + return "" + } + content := tr.ForLLM + if content == "" && tr.Err != nil { + content = tr.Err.Error() + } + if tr.ResponseHandled { + if content == "" { + return handledToolLLMNote + } + if !strings.Contains(content, handledToolLLMNote) { + content += "\n" + handledToolLLMNote + } + } + if len(tr.ArtifactTags) > 0 { + artifactNote := "Local artifact paths: " + strings.Join(tr.ArtifactTags, " ") + "\n" + artifactPathsLLMNote + if content == "" { + content = artifactNote + } else if !strings.Contains(content, artifactNote) { + content += "\n" + artifactNote + } + } + if content != "" { + return content + } + return "" } // NewToolResult creates a basic ToolResult with content for the LLM. @@ -158,3 +208,9 @@ func (tr *ToolResult) WithError(err error) *ToolResult { tr.Err = err return tr } + +// WithResponseHandled marks the tool result as already delivered to the user. +func (tr *ToolResult) WithResponseHandled() *ToolResult { + tr.ResponseHandled = true + return tr +} diff --git a/pkg/tools/result_test.go b/pkg/tools/result_test.go index a234e33f3..5f08cb4fa 100644 --- a/pkg/tools/result_test.go +++ b/pkg/tools/result_test.go @@ -3,6 +3,7 @@ package tools import ( "encoding/json" "errors" + "strings" "testing" ) @@ -227,3 +228,41 @@ func TestToolResultJSONStructure(t *testing.T) { t.Errorf("Expected silent false, got %v", parsed["silent"]) } } + +func TestToolResultContentForLLM_AppendsHandledDeliveryNote(t *testing.T) { + result := MediaResult("Screenshot attached.", []string{"media://example"}).WithResponseHandled() + + content := result.ContentForLLM() + if !strings.Contains(content, "Screenshot attached.") { + t.Fatalf("expected original content in ContentForLLM, got %q", content) + } + if !strings.Contains(content, handledToolLLMNote) { + t.Fatalf("expected handled delivery note in ContentForLLM, got %q", content) + } +} + +func TestToolResultContentForLLM_UsesHandledDeliveryNoteWhenEmpty(t *testing.T) { + result := (&ToolResult{}).WithResponseHandled() + + if got := result.ContentForLLM(); got != handledToolLLMNote { + t.Fatalf("ContentForLLM() = %q, want %q", got, handledToolLLMNote) + } +} + +func TestToolResultContentForLLM_AppendsArtifactPaths(t *testing.T) { + result := &ToolResult{ + ForLLM: "Artifact created.", + ArtifactTags: []string{"[file:/tmp/example.png]"}, + } + + content := result.ContentForLLM() + if !strings.Contains(content, "Artifact created.") { + t.Fatalf("expected original content in ContentForLLM, got %q", content) + } + if !strings.Contains(content, "Local artifact paths: [file:/tmp/example.png]") { + t.Fatalf("expected artifact path note in ContentForLLM, got %q", content) + } + if !strings.Contains(content, artifactPathsLLMNote) { + t.Fatalf("expected artifact guidance note in ContentForLLM, got %q", content) + } +} diff --git a/pkg/tools/send_file.go b/pkg/tools/send_file.go index a67bd4210..a59ad56aa 100644 --- a/pkg/tools/send_file.go +++ b/pkg/tools/send_file.go @@ -141,7 +141,7 @@ func (t *SendFileTool) Execute(ctx context.Context, args map[string]any) *ToolRe return ErrorResult(fmt.Sprintf("failed to register media: %v", err)) } - return MediaResult(fmt.Sprintf("File %q sent to user", filename), []string{ref}) + return MediaResult(fmt.Sprintf("File %q sent to user", filename), []string{ref}).WithResponseHandled() } // detectMediaType determines the MIME type of a file. diff --git a/pkg/tools/send_file_test.go b/pkg/tools/send_file_test.go index 6daaab31c..cfe5b43e1 100644 --- a/pkg/tools/send_file_test.go +++ b/pkg/tools/send_file_test.go @@ -104,6 +104,9 @@ func TestSendFileTool_Success(t *testing.T) { if result.Media[0][:8] != "media://" { t.Errorf("expected media:// ref, got %q", result.Media[0]) } + if !result.ResponseHandled { + t.Fatal("expected send_file success to mark response handled") + } } func TestSendFileTool_CustomFilename(t *testing.T) { diff --git a/pkg/tools/toolloop.go b/pkg/tools/toolloop.go index 244f0d4a2..387813e94 100644 --- a/pkg/tools/toolloop.go +++ b/pkg/tools/toolloop.go @@ -159,10 +159,7 @@ func RunToolLoop( // Append results in original order for _, r := range results { - contentForLLM := r.result.ForLLM - if contentForLLM == "" && r.result.Err != nil { - contentForLLM = r.result.Err.Error() - } + contentForLLM := r.result.ContentForLLM() messages = append(messages, providers.Message{ Role: "tool", From de0364c8ec7bd829be81d27db9a1acda97324484 Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Sun, 22 Mar 2026 20:37:06 +0800 Subject: [PATCH 016/202] Move minimax reasoning_split injection to provider factory Inject reasoning_split at provider creation time to allow user ExtraBody settings to be preserved --- pkg/config/config_test.go | 21 ------ pkg/config/defaults.go | 1 - pkg/providers/factory_provider.go | 27 +++++++- pkg/providers/factory_provider_test.go | 96 ++++++++++++++++++++++++++ 4 files changed, 122 insertions(+), 23 deletions(-) diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 678f02000..0c7e0c002 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1100,27 +1100,6 @@ func TestConfigLogLevelEmpty(t *testing.T) { } } -func TestDefaultConfig_MinimaxExtraBody(t *testing.T) { - cfg := DefaultConfig() - - var minimaxCfg *ModelConfig - for i := range cfg.ModelList { - if cfg.ModelList[i].Model == "minimax/MiniMax-M2.5" { - minimaxCfg = &cfg.ModelList[i] - break - } - } - if minimaxCfg == nil { - t.Fatal("Minimax model not found in ModelList") - } - if minimaxCfg.ExtraBody == nil { - t.Fatal("Minimax ExtraBody should not be nil") - } - if got, ok := minimaxCfg.ExtraBody["reasoning_split"]; !ok || got != true { - t.Fatalf("Minimax ExtraBody[reasoning_split] = %v, want true", got) - } -} - func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { dir := t.TempDir() cfgPath := filepath.Join(dir, "config.json") diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index d96b139d1..f4056eca6 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -376,7 +376,6 @@ func DefaultConfig() *Config { Model: "minimax/MiniMax-M2.5", APIBase: "https://api.minimaxi.com/v1", APIKey: "", - ExtraBody: map[string]any{"reasoning_split": true}, }, // LongCat - https://longcat.chat/platform diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index 98e781da3..7e33f4d17 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -117,7 +117,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err case "litellm", "openrouter", "groq", "zhipu", "gemini", "nvidia", "ollama", "moonshot", "shengsuanyun", "deepseek", "cerebras", "vivgrid", "volcengine", "vllm", "qwen", "qwen-intl", "qwen-international", "dashscope-intl", - "qwen-us", "dashscope-us", "mistral", "avian", "minimax", "longcat", "modelscope", "novita", + "qwen-us", "dashscope-us", "mistral", "avian", "longcat", "modelscope", "novita", "coding-plan", "alibaba-coding", "qwen-coding": // All other OpenAI-compatible HTTP providers if cfg.APIKey == "" && cfg.APIBase == "" { @@ -136,6 +136,31 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.ExtraBody, ), modelID, nil + case "minimax": + // Minimax requires reasoning_split: true in the request body + if cfg.APIKey == "" && cfg.APIBase == "" { + return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) + } + apiBase := cfg.APIBase + if apiBase == "" { + apiBase = getDefaultAPIBase(protocol) + } + extraBody := cfg.ExtraBody + if extraBody == nil { + extraBody = make(map[string]any) + } + if _, ok := extraBody["reasoning_split"]; !ok { + extraBody["reasoning_split"] = true + } + return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( + cfg.APIKey, + apiBase, + cfg.Proxy, + cfg.MaxTokensField, + cfg.RequestTimeout, + extraBody, + ), modelID, nil + case "anthropic": if cfg.AuthMethod == "oauth" || cfg.AuthMethod == "token" { // Use OAuth credentials from auth store diff --git a/pkg/providers/factory_provider_test.go b/pkg/providers/factory_provider_test.go index 8b9ddeecd..cdc2cea8f 100644 --- a/pkg/providers/factory_provider_test.go +++ b/pkg/providers/factory_provider_test.go @@ -6,6 +6,7 @@ package providers import ( + "encoding/json" "net/http" "net/http/httptest" "strings" @@ -603,3 +604,98 @@ func TestGetDefaultAPIBase_QwenUSAliases(t *testing.T) { } } } + +func TestCreateProviderFromConfig_MinimaxInjectsReasoningSplit(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"},"finish_reason":"stop"}]}`)) + })) + defer server.Close() + + cfg := &config.ModelConfig{ + ModelName: "test-minimax", + Model: "minimax/MiniMax-M2.5", + APIKey: "test-key", + APIBase: server.URL, + } + + provider, modelID, err := CreateProviderFromConfig(cfg) + if err != nil { + t.Fatalf("CreateProviderFromConfig() error = %v", err) + } + if provider == nil { + t.Fatal("CreateProviderFromConfig() returned nil provider") + } + if modelID != "MiniMax-M2.5" { + t.Errorf("modelID = %q, want %q", modelID, "MiniMax-M2.5") + } + + _, err = provider.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + modelID, + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // Verify reasoning_split is automatically injected + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } +} + +func TestCreateProviderFromConfig_MinimaxPreservesUserExtraBody(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"},"finish_reason":"stop"}]}`)) + })) + defer server.Close() + + cfg := &config.ModelConfig{ + ModelName: "test-minimax-custom", + Model: "minimax/MiniMax-M2.5", + APIKey: "test-key", + APIBase: server.URL, + ExtraBody: map[string]any{"custom_field": "test"}, + } + + provider, modelID, err := CreateProviderFromConfig(cfg) + if err != nil { + t.Fatalf("CreateProviderFromConfig() error = %v", err) + } + + _, err = provider.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + modelID, + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // Verify reasoning_split is automatically injected + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } + // Verify user's custom field is preserved + if got, ok := requestBody["custom_field"]; !ok || got != "test" { + t.Fatalf("custom_field = %v, want test", got) + } +} From 930dd028f16742f52f33f7d8cc5ee780aa022ff2 Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 22 Mar 2026 13:47:23 +0100 Subject: [PATCH 017/202] fix err and placeholder --- pkg/channels/manager.go | 46 ++++++++++++++++++-- pkg/channels/manager_test.go | 84 ++++++++++++++++++++++++++++++++++++ 2 files changed, 127 insertions(+), 3 deletions(-) diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go index f4a64807e..fec4922c3 100644 --- a/pkg/channels/manager.go +++ b/pkg/channels/manager.go @@ -206,6 +206,40 @@ func (m *Manager) preSend(ctx context.Context, name string, msg bus.OutboundMess return false } +// preSendMedia handles typing stop, reaction undo, and placeholder cleanup +// before sending media attachments. Unlike preSend for text messages, media +// delivery never edits the placeholder because there is no text payload to +// replace it with; it only attempts to delete the placeholder when possible. +func (m *Manager) preSendMedia(ctx context.Context, name string, msg bus.OutboundMediaMessage, ch Channel) { + key := name + ":" + msg.ChatID + + // 1. Stop typing + if v, loaded := m.typingStops.LoadAndDelete(key); loaded { + if entry, ok := v.(typingEntry); ok { + entry.stop() // idempotent, safe + } + } + + // 2. Undo reaction + if v, loaded := m.reactionUndos.LoadAndDelete(key); loaded { + if entry, ok := v.(reactionEntry); ok { + entry.undo() // idempotent, safe + } + } + + // 3. Clear any finalized stream marker for this chat before media delivery. + m.streamActive.LoadAndDelete(key) + + // 4. Delete placeholder if present. + if v, loaded := m.placeholders.LoadAndDelete(key); loaded { + if entry, ok := v.(placeholderEntry); ok && entry.id != "" { + if deleter, ok := ch.(MessageDeleter); ok { + deleter.DeleteMessage(ctx, msg.ChatID, entry.id) // best effort + } + } + } +} + func NewManager(cfg *config.Config, messageBus *bus.MessageBus, store media.MediaStore) (*Manager, error) { m := &Manager{ channels: make(map[string]Channel), @@ -779,7 +813,8 @@ func (m *Manager) runMediaWorker(ctx context.Context, name string, w *channelWor } // sendMediaWithRetry sends a media message through the channel with rate limiting and -// retry logic. It returns nil on success, or the last error after retries. +// retry logic. It returns nil on success, or the last error after retries, +// including when the channel does not support MediaSender. func (m *Manager) sendMediaWithRetry( ctx context.Context, name string, @@ -788,10 +823,12 @@ func (m *Manager) sendMediaWithRetry( ) error { ms, ok := w.ch.(MediaSender) if !ok { - logger.DebugCF("channels", "Channel does not support MediaSender, skipping media", map[string]any{ + err := fmt.Errorf("channel %q does not support media sending", name) + logger.WarnCF("channels", "Channel does not support MediaSender", map[string]any{ "channel": name, + "error": err.Error(), }) - return nil + return err } // Rate limit: wait for token @@ -799,6 +836,9 @@ func (m *Manager) sendMediaWithRetry( return err } + // Pre-send: stop typing and clean up any placeholder before sending media. + m.preSendMedia(ctx, name, msg, w.ch) + var lastErr error for attempt := 0; attempt <= maxRetries; attempt++ { lastErr = ms.SendMedia(ctx, msg) diff --git a/pkg/channels/manager_test.go b/pkg/channels/manager_test.go index 6a5dd7e30..b4fd2ba3d 100644 --- a/pkg/channels/manager_test.go +++ b/pkg/channels/manager_test.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "strings" "sync" "sync/atomic" "testing" @@ -57,6 +58,26 @@ func (m *mockMediaChannel) SendMedia(ctx context.Context, msg bus.OutboundMediaM return nil } +type mockDeletingMediaChannel struct { + mockMediaChannel + deleteCalls int + lastDeleted struct { + chatID string + messageID string + } +} + +func (m *mockDeletingMediaChannel) DeleteMessage( + _ context.Context, + chatID string, + messageID string, +) error { + m.deleteCalls++ + m.lastDeleted.chatID = chatID + m.lastDeleted.messageID = messageID + return nil +} + // newTestManager creates a minimal Manager suitable for unit tests. func newTestManager() *Manager { return &Manager{ @@ -278,6 +299,69 @@ func TestSendMedia_PropagatesFailure(t *testing.T) { } } +func TestSendMedia_UnsupportedChannelReturnsError(t *testing.T) { + m := newTestManager() + ch := &mockChannel{ + sendFn: func(_ context.Context, _ bus.OutboundMessage) error { + return nil + }, + } + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + err := m.SendMedia(context.Background(), bus.OutboundMediaMessage{ + Channel: "test", + ChatID: "chat1", + Parts: []bus.MediaPart{{Ref: "media://abc"}}, + }) + if err == nil { + t.Fatal("expected SendMedia to return error for unsupported channel") + } + if !strings.Contains(err.Error(), "does not support media sending") { + t.Fatalf("unexpected error: %v", err) + } +} + +func TestSendMedia_DeletesPlaceholderBeforeSending(t *testing.T) { + m := newTestManager() + ch := &mockDeletingMediaChannel{ + mockMediaChannel: mockMediaChannel{ + sendMediaFn: func(_ context.Context, _ bus.OutboundMediaMessage) error { + return nil + }, + }, + } + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + m.RecordPlaceholder("test", "chat1", "placeholder-1") + + err := m.SendMedia(context.Background(), bus.OutboundMediaMessage{ + Channel: "test", + ChatID: "chat1", + Parts: []bus.MediaPart{{Ref: "media://abc"}}, + }) + if err != nil { + t.Fatalf("SendMedia() error = %v", err) + } + if ch.deleteCalls != 1 { + t.Fatalf("expected placeholder delete to be called once, got %d", ch.deleteCalls) + } + if ch.lastDeleted.chatID != "chat1" || ch.lastDeleted.messageID != "placeholder-1" { + t.Fatalf("unexpected placeholder deletion target: %+v", ch.lastDeleted) + } + if len(ch.sentMediaMessages) != 1 { + t.Fatalf("expected media to be sent once, got %d", len(ch.sentMediaMessages)) + } +} + func TestSendWithRetry_UnknownError(t *testing.T) { m := newTestManager() var callCount int From d7d2bf69bfc697e61bffc62e3dd61dd195d81e04 Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 22 Mar 2026 15:33:25 +0100 Subject: [PATCH 018/202] feat(skills): add channel commands to list and force installed skills --- docs/channels/telegram/README.md | 20 +++ docs/channels/telegram/README.zh.md | 20 +++ docs/chat-apps.md | 9 +- docs/configuration.md | 18 +++ docs/zh/chat-apps.md | 9 +- docs/zh/configuration.md | 18 +++ pkg/agent/context.go | 68 ++++++++++ pkg/agent/loop.go | 160 ++++++++++++++++++++++++ pkg/agent/loop_test.go | 157 +++++++++++++++++++++++ pkg/commands/builtin.go | 1 + pkg/commands/builtin_test.go | 47 ++++++- pkg/commands/cmd_list.go | 17 +++ pkg/commands/cmd_use.go | 9 ++ pkg/commands/request.go | 5 + pkg/commands/runtime.go | 1 + pkg/commands/show_list_handlers_test.go | 19 +++ 16 files changed, 575 insertions(+), 3 deletions(-) create mode 100644 pkg/commands/cmd_use.go diff --git a/docs/channels/telegram/README.md b/docs/channels/telegram/README.md index a3e057ba4..4995ad216 100644 --- a/docs/channels/telegram/README.md +++ b/docs/channels/telegram/README.md @@ -33,3 +33,23 @@ The Telegram channel uses long polling via the Telegram Bot API for bot-based co 3. Obtain the HTTP API Token 4. Fill in the Token in the configuration file 5. (Optional) Configure `allow_from` to restrict which user IDs can interact (you can get IDs via `@userinfobot`) + +## Built-in Commands + +Telegram auto-registers PicoClaw's top-level bot commands at startup, including `/start`, `/help`, `/show`, `/list`, and `/use`. + +Skill-related commands: + +- `/list skills` lists the installed skills visible to the current agent. +- `/use ` forces a skill for a single request. +- `/use ` arms the skill for your next message in the same chat. +- `/use clear` clears a pending skill override. + +Examples: + +```text +/list skills +/use git explain how to squash the last 3 commits +/use git +explain how to squash the last 3 commits +``` diff --git a/docs/channels/telegram/README.zh.md b/docs/channels/telegram/README.zh.md index f50c712ce..7dfd3027a 100644 --- a/docs/channels/telegram/README.zh.md +++ b/docs/channels/telegram/README.zh.md @@ -33,3 +33,23 @@ Telegram Channel 通过 Telegram 机器人 API 使用长轮询实现基于机器 3. 获取 HTTP API Token 4. 将 Token 填入配置文件中 5. (可选) 配置 `allow_from` 以限制允许互动的用户 ID (可通过 `@userinfobot` 获取 ID) + +## 内置命令 + +Telegram 会在启动时自动注册 PicoClaw 的顶级 Bot 命令，包括 `/start`、`/help`、`/show`、`/list` 和 `/use`。 + +与技能相关的命令： + +- `/list skills`：列出当前 Agent 可见的已安装技能。 +- `/use `：只在本次请求中强制使用指定技能。 +- `/use `：为同一聊天中的下一条消息预先启用该技能。 +- `/use clear`：清除待应用的技能覆盖。 + +示例： + +```text +/list skills +/use git explain how to squash the last 3 commits +/use italiapersonalfinance +dammi le ultime news +``` diff --git a/docs/chat-apps.md b/docs/chat-apps.md index 07297952a..a2441a9bf 100644 --- a/docs/chat-apps.md +++ b/docs/chat-apps.md @@ -60,11 +60,18 @@ picoclaw gateway **4. Telegram command menu (auto-registered at startup)** -PicoClaw now keeps command definitions in one shared registry. On startup, Telegram will automatically register supported bot commands (for example `/start`, `/help`, `/show`, `/list`) so command menu and runtime behavior stay in sync. +PicoClaw now keeps command definitions in one shared registry. On startup, Telegram will automatically register supported bot commands (for example `/start`, `/help`, `/show`, `/list`, `/use`) so command menu and runtime behavior stay in sync. Telegram command menu registration remains channel-local discovery UX; generic command execution is handled centrally in the agent loop via the commands executor. If command registration fails (network/API transient errors), the channel still starts and PicoClaw retries registration in the background. +You can also manage installed skills directly from Telegram: + +- `/list skills` +- `/use ` +- `/use ` and then send the actual request in the next message +- `/use clear` + **4. Advanced Formatting** You can set use_markdown_v2: true to enable enhanced formatting options. This allows the bot to utilize the full range of Telegram MarkdownV2 features, including nested styles, spoilers, and custom fixed-width blocks. diff --git a/docs/configuration.md b/docs/configuration.md index b5d652a85..26d31902b 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -65,6 +65,24 @@ For advanced/test setups, you can override the builtin skills root with: export PICOCLAW_BUILTIN_SKILLS=/path/to/skills ``` +### Using Skills From Chat Channels + +Once skills are installed, you can inspect and force them directly from a chat channel: + +- `/list skills` shows the installed skill names available to the current agent. +- `/use ` forces a specific skill for a single request. +- `/use ` arms that skill for your next message in the same chat session. +- `/use clear` cancels a pending skill override created by `/use `. + +Examples: + +```text +/list skills +/use git explain how to squash the last 3 commits +/use italiapersonalfinance +dammi le ultime news +``` + ### Unified Command Execution Policy - Generic slash commands are executed through a single path in `pkg/agent/loop.go` via `commands.Executor`. diff --git a/docs/zh/chat-apps.md b/docs/zh/chat-apps.md index 2d6e55c3d..a2613aa57 100644 --- a/docs/zh/chat-apps.md +++ b/docs/zh/chat-apps.md @@ -63,11 +63,18 @@ picoclaw gateway **4. Telegram 命令菜单（启动时自动注册）** -PicoClaw 使用统一的命令定义来源。启动时会自动将 Telegram 支持的命令（例如 `/start`、`/help`、`/show`、`/list`）注册到 Bot 命令菜单，确保菜单展示与实际行为一致。 +PicoClaw 使用统一的命令定义来源。启动时会自动将 Telegram 支持的命令（例如 `/start`、`/help`、`/show`、`/list`、`/use`）注册到 Bot 命令菜单，确保菜单展示与实际行为一致。 Telegram 侧保留的是命令菜单注册能力；通用命令的实际执行统一走 Agent Loop 中的 commands executor。 如果注册因网络或 API 短暂异常失败，不会阻塞 channel 启动；系统会在后台自动重试。 +你也可以直接在 Telegram 中管理已安装技能： + +- `/list skills` +- `/use ` +- `/use `，然后在下一条消息里发送真正的请求 +- `/use clear` +
diff --git a/docs/zh/configuration.md b/docs/zh/configuration.md index 68fb1fd1a..6eb53cb0f 100644 --- a/docs/zh/configuration.md +++ b/docs/zh/configuration.md @@ -65,6 +65,24 @@ PicoClaw 将数据存储在您配置的工作区中（默认：`~/.picoclaw/work export PICOCLAW_BUILTIN_SKILLS=/path/to/skills ``` +### 在聊天频道中使用技能 + +技能安装完成后，可以直接在聊天频道里查看并显式启用它们： + +- `/list skills`：显示当前 Agent 可用的已安装技能名称。 +- `/use `：只对当前这一条请求强制使用指定技能。 +- `/use `：为同一会话中的下一条消息预先启用该技能。 +- `/use clear`：取消通过 `/use ` 设置的待应用技能。 + +示例： + +```text +/list skills +/use git explain how to squash the last 3 commits +/use italiapersonalfinance +dammi le ultime news +``` + ### 统一命令执行策略 - 通用斜杠命令通过 `pkg/agent/loop.go` 中的 `commands.Executor` 统一执行。 diff --git a/pkg/agent/context.go b/pkg/agent/context.go index 8db8f0b5e..a1a735886 100644 --- a/pkg/agent/context.go +++ b/pkg/agent/context.go @@ -497,6 +497,7 @@ func (cb *ContextBuilder) BuildMessages( currentMessage string, media []string, channel, chatID, senderID, senderDisplayName string, + activeSkills ...string, ) []providers.Message { messages := []providers.Message{} @@ -530,6 +531,11 @@ func (cb *ContextBuilder) BuildMessages( {Type: "text", Text: dynamicCtx}, } + if skillsText := cb.buildActiveSkillsContext(activeSkills); skillsText != "" { + stringParts = append(stringParts, skillsText) + contentBlocks = append(contentBlocks, providers.ContentBlock{Type: "text", Text: skillsText}) + } + if summary != "" { summaryText := fmt.Sprintf( "CONTEXT_SUMMARY: The following is an approximate summary of prior conversation "+ @@ -737,6 +743,68 @@ func (cb *ContextBuilder) AddAssistantMessage( return messages } +func (cb *ContextBuilder) buildActiveSkillsContext(skillNames []string) string { + if cb.skillsLoader == nil || len(skillNames) == 0 { + return "" + } + + var ordered []string + seen := make(map[string]struct{}, len(skillNames)) + for _, name := range skillNames { + canonical, ok := cb.ResolveSkillName(name) + if !ok { + continue + } + if _, exists := seen[canonical]; exists { + continue + } + seen[canonical] = struct{}{} + ordered = append(ordered, canonical) + } + if len(ordered) == 0 { + return "" + } + + content := cb.skillsLoader.LoadSkillsForContext(ordered) + if strings.TrimSpace(content) == "" { + return "" + } + + return fmt.Sprintf(`# Active Skills + +The following skills are active for this request. Follow them when relevant. + +%s`, content) +} + +func (cb *ContextBuilder) ListSkillNames() []string { + if cb.skillsLoader == nil { + return nil + } + + allSkills := cb.skillsLoader.ListSkills() + names := make([]string, 0, len(allSkills)) + for _, skill := range allSkills { + names = append(names, skill.Name) + } + return names +} + +func (cb *ContextBuilder) ResolveSkillName(name string) (string, bool) { + name = strings.TrimSpace(name) + if name == "" || cb.skillsLoader == nil { + return "", false + } + + for _, skill := range cb.skillsLoader.ListSkills() { + if strings.EqualFold(skill.Name, name) { + return skill.Name, true + } + } + + return "", false +} + // GetSkillsInfo returns information about loaded skills. func (cb *ContextBuilder) GetSkillsInfo() map[string]any { allSkills := cb.skillsLoader.ListSkills() diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index ed5c73afc..81036e499 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -48,6 +48,7 @@ type AgentLoop struct { transcriber voice.Transcriber cmdRegistry *commands.Registry mcp mcpRuntime + pendingSkills sync.Map mu sync.RWMutex reloadFunc func() error // Track active requests for safe provider cleanup @@ -62,6 +63,7 @@ type processOptions struct { SenderID string // Current sender ID for dynamic context SenderDisplayName string // Current sender display name for dynamic context UserMessage string // User message content (may include prefix) + ForcedSkills []string // Skills explicitly requested for this message Media []string // media:// refs from inbound message DefaultResponse string // Response when LLM returns empty EnableSummary bool // Whether to trigger summarization @@ -782,6 +784,15 @@ func (al *AgentLoop) processMessage(ctx context.Context, msg bus.InboundMessage) return response, nil } + if pending := al.takePendingSkills(opts.SessionKey); len(pending) > 0 { + opts.ForcedSkills = append(opts.ForcedSkills, pending...) + logger.InfoCF("agent", "Applying pending skill override", + map[string]any{ + "session_key": opts.SessionKey, + "skills": strings.Join(pending, ","), + }) + } + return al.runAgentLoop(ctx, agent, opts) } @@ -915,6 +926,7 @@ func (al *AgentLoop) runAgentLoop( opts.ChatID, opts.SenderID, opts.SenderDisplayName, + activeSkillNames(agent, opts)..., ) // Resolve media:// refs: images→base64 data URLs, non-images→local paths in content @@ -1226,6 +1238,7 @@ func (al *AgentLoop) runLLMIteration( messages = agent.ContextBuilder.BuildMessages( newHistory, newSummary, "", nil, opts.Channel, opts.ChatID, opts.SenderID, opts.SenderDisplayName, + activeSkillNames(agent, opts)..., ) continue } @@ -1942,6 +1955,10 @@ func (al *AgentLoop) handleCommand( return "", false } + if matched, handled, reply := al.applyExplicitSkillCommand(msg.Content, agent, opts); matched { + return reply, handled + } + if al.cmdRegistry == nil { return "", false } @@ -1998,6 +2015,9 @@ func (al *AgentLoop) buildCommandsRuntime(agent *AgentInstance, opts *processOpt return nil }, } + if agent != nil && agent.ContextBuilder != nil { + rt.ListSkillNames = agent.ContextBuilder.ListSkillNames + } rt.ReloadConfig = func() error { if al.reloadFunc == nil { return fmt.Errorf("reload not configured") @@ -2057,6 +2077,146 @@ func (al *AgentLoop) buildCommandsRuntime(agent *AgentInstance, opts *processOpt return rt } +func activeSkillNames(agent *AgentInstance, opts processOptions) []string { + var out []string + seen := make(map[string]struct{}) + + appendNames := func(names []string) { + for _, name := range names { + name = strings.TrimSpace(name) + if name == "" { + continue + } + if _, exists := seen[name]; exists { + continue + } + seen[name] = struct{}{} + out = append(out, name) + } + } + + if agent != nil { + appendNames(agent.SkillsFilter) + } + appendNames(opts.ForcedSkills) + + return out +} + +func (al *AgentLoop) applyExplicitSkillCommand( + raw string, + agent *AgentInstance, + opts *processOptions, +) (matched bool, handled bool, reply string) { + commandName, ok := commands.CommandName(raw) + if !ok || commandName != "use" { + return false, false, "" + } + + if agent == nil || agent.ContextBuilder == nil { + return true, true, commandsUnavailableSkillMessage() + } + + fields := strings.Fields(strings.TrimSpace(raw)) + if len(fields) < 2 { + return true, true, buildUseCommandHelp(agent) + } + + if strings.EqualFold(fields[1], "clear") || strings.EqualFold(fields[1], "off") { + al.clearPendingSkills(opts.SessionKey) + return true, true, "Cleared pending skill override." + } + + canonicalSkill, ok := agent.ContextBuilder.ResolveSkillName(fields[1]) + if !ok { + return true, true, fmt.Sprintf("Unknown skill: %s\nUse /list skills to see installed skills.", fields[1]) + } + + if len(fields) == 2 { + al.setPendingSkills(opts.SessionKey, []string{canonicalSkill}) + return true, true, fmt.Sprintf( + "Skill %q is armed for your next message.\nSend your next request normally, or use /use clear to cancel.", + canonicalSkill, + ) + } + + message := strings.TrimSpace(strings.Join(fields[2:], " ")) + if message == "" { + return true, true, buildUseCommandHelp(agent) + } + + opts.UserMessage = message + opts.ForcedSkills = append(opts.ForcedSkills, canonicalSkill) + return true, false, "" +} + +func commandsUnavailableSkillMessage() string { + return "Skill selection is unavailable in the current context." +} + +func buildUseCommandHelp(agent *AgentInstance) string { + if agent == nil || agent.ContextBuilder == nil { + return "Usage: /use [message]" + } + + names := agent.ContextBuilder.ListSkillNames() + if len(names) == 0 { + return "Usage: /use [message]\nNo installed skills found." + } + + return fmt.Sprintf( + "Usage: /use [message]\n\nInstalled Skills:\n- %s\n\nUse /use to apply a skill to your next message, or /use to force it immediately.", + strings.Join(names, "\n- "), + ) +} + +func (al *AgentLoop) setPendingSkills(sessionKey string, skillNames []string) { + sessionKey = strings.TrimSpace(sessionKey) + if sessionKey == "" || len(skillNames) == 0 { + return + } + + filtered := make([]string, 0, len(skillNames)) + for _, name := range skillNames { + name = strings.TrimSpace(name) + if name != "" { + filtered = append(filtered, name) + } + } + if len(filtered) == 0 { + return + } + + al.pendingSkills.Store(sessionKey, filtered) +} + +func (al *AgentLoop) takePendingSkills(sessionKey string) []string { + sessionKey = strings.TrimSpace(sessionKey) + if sessionKey == "" { + return nil + } + + value, ok := al.pendingSkills.LoadAndDelete(sessionKey) + if !ok { + return nil + } + + skills, ok := value.([]string) + if !ok { + return nil + } + + return append([]string(nil), skills...) +} + +func (al *AgentLoop) clearPendingSkills(sessionKey string) { + sessionKey = strings.TrimSpace(sessionKey) + if sessionKey == "" { + return + } + al.pendingSkills.Delete(sessionKey) +} + func mapCommandError(result commands.ExecuteResult) string { if result.Command == "" { return fmt.Sprintf("Failed to execute command: %v", result.Err) diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 28eab03db..d6260c990 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -132,6 +132,163 @@ func TestProcessMessage_IncludesCurrentSenderInDynamicContext(t *testing.T) { } } +func TestProcessMessage_UseCommandLoadsRequestedSkill(t *testing.T) { + tmpDir := t.TempDir() + skillDir := filepath.Join(tmpDir, "skills", "shell") + if err := os.MkdirAll(skillDir, 0o755); err != nil { + t.Fatalf("mkdir skill dir: %v", err) + } + if err := os.WriteFile( + filepath.Join(skillDir, "SKILL.md"), + []byte("# shell\n\nPrefer concise shell commands and explain them briefly."), + 0o644, + ); err != nil { + t.Fatalf("write skill file: %v", err) + } + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + msgBus := bus.NewMessageBus() + provider := &recordingProvider{} + al := NewAgentLoop(cfg, msgBus, provider) + + response, err := al.processMessage(context.Background(), bus.InboundMessage{ + Channel: "telegram", + SenderID: "telegram:123", + ChatID: "chat-1", + Content: "/use shell explain how to list files", + }) + if err != nil { + t.Fatalf("processMessage() error = %v", err) + } + if response != "Mock response" { + t.Fatalf("processMessage() response = %q, want %q", response, "Mock response") + } + if len(provider.lastMessages) == 0 { + t.Fatal("provider did not receive any messages") + } + + systemPrompt := provider.lastMessages[0].Content + if !strings.Contains(systemPrompt, "# Active Skills") { + t.Fatalf("system prompt missing active skills section:\n%s", systemPrompt) + } + if !strings.Contains(systemPrompt, "### Skill: shell") { + t.Fatalf("system prompt missing requested skill content:\n%s", systemPrompt) + } + + lastMessage := provider.lastMessages[len(provider.lastMessages)-1] + if lastMessage.Role != "user" || lastMessage.Content != "explain how to list files" { + t.Fatalf("last provider message = %+v, want rewritten user message", lastMessage) + } +} + +func TestHandleCommand_UseCommandRejectsUnknownSkill(t *testing.T) { + tmpDir := t.TempDir() + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + msgBus := bus.NewMessageBus() + provider := &recordingProvider{} + al := NewAgentLoop(cfg, msgBus, provider) + agent := al.GetRegistry().GetDefaultAgent() + + opts := processOptions{} + reply, handled := al.handleCommand(context.Background(), bus.InboundMessage{ + Channel: "telegram", + SenderID: "telegram:123", + ChatID: "chat-1", + Content: "/use missing explain how to list files", + }, agent, &opts) + if !handled { + t.Fatal("expected /use with unknown skill to be handled") + } + if !strings.Contains(reply, "Unknown skill: missing") { + t.Fatalf("reply = %q, want unknown skill error", reply) + } +} + +func TestProcessMessage_UseCommandArmsSkillForNextMessage(t *testing.T) { + tmpDir := t.TempDir() + skillDir := filepath.Join(tmpDir, "skills", "shell") + if err := os.MkdirAll(skillDir, 0o755); err != nil { + t.Fatalf("mkdir skill dir: %v", err) + } + if err := os.WriteFile( + filepath.Join(skillDir, "SKILL.md"), + []byte("# shell\n\nPrefer concise shell commands and explain them briefly."), + 0o644, + ); err != nil { + t.Fatalf("write skill file: %v", err) + } + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + msgBus := bus.NewMessageBus() + provider := &recordingProvider{} + al := NewAgentLoop(cfg, msgBus, provider) + + response, err := al.processMessage(context.Background(), bus.InboundMessage{ + Channel: "telegram", + SenderID: "telegram:123", + ChatID: "chat-1", + Content: "/use shell", + }) + if err != nil { + t.Fatalf("processMessage() arm error = %v", err) + } + if !strings.Contains(response, `Skill "shell" is armed for your next message.`) { + t.Fatalf("arm response = %q, want armed confirmation", response) + } + + response, err = al.processMessage(context.Background(), bus.InboundMessage{ + Channel: "telegram", + SenderID: "telegram:123", + ChatID: "chat-1", + Content: "explain how to list files", + }) + if err != nil { + t.Fatalf("processMessage() follow-up error = %v", err) + } + if response != "Mock response" { + t.Fatalf("follow-up response = %q, want %q", response, "Mock response") + } + if len(provider.lastMessages) == 0 { + t.Fatal("provider did not receive any messages") + } + + systemPrompt := provider.lastMessages[0].Content + if !strings.Contains(systemPrompt, "### Skill: shell") { + t.Fatalf("system prompt missing pending skill content:\n%s", systemPrompt) + } + lastMessage := provider.lastMessages[len(provider.lastMessages)-1] + if lastMessage.Role != "user" || lastMessage.Content != "explain how to list files" { + t.Fatalf("last provider message = %+v, want unchanged follow-up user message", lastMessage) + } +} + func TestRecordLastChannel(t *testing.T) { al, cfg, msgBus, provider, cleanup := newTestAgentLoop(t) defer cleanup() diff --git a/pkg/commands/builtin.go b/pkg/commands/builtin.go index 6d9ece82f..9be8fdf04 100644 --- a/pkg/commands/builtin.go +++ b/pkg/commands/builtin.go @@ -10,6 +10,7 @@ func BuiltinDefinitions() []Definition { helpCommand(), showCommand(), listCommand(), + useCommand(), switchCommand(), checkCommand(), clearCommand(), diff --git a/pkg/commands/builtin_test.go b/pkg/commands/builtin_test.go index 66a84825e..5fd8dd9bc 100644 --- a/pkg/commands/builtin_test.go +++ b/pkg/commands/builtin_test.go @@ -39,9 +39,14 @@ func TestBuiltinHelpHandler_ReturnsFormattedMessage(t *testing.T) { if !strings.Contains(reply, "/show [model|channel|agents]") { t.Fatalf("/help reply missing /show usage, got %q", reply) } - if !strings.Contains(reply, "/list [models|channels|agents]") { + if !strings.Contains(reply, "/list [models|channels|agents|skills]") { t.Fatalf("/help reply missing /list usage, got %q", reply) } + if !strings.Contains(reply, "/use ") { + if !strings.Contains(reply, "/use [message]") { + t.Fatalf("/help reply missing /use usage, got %q", reply) + } + } } func TestBuiltinShowChannel_PreservesUserVisibleBehavior(t *testing.T) { @@ -143,3 +148,43 @@ func TestBuiltinListAgents_RestoresOldBehavior(t *testing.T) { t.Fatalf("/list agents reply=%q, want agent IDs", reply) } } + +func TestBuiltinListSkills_UsesRuntimeSkillNames(t *testing.T) { + rt := &Runtime{ + ListSkillNames: func() []string { + return []string{"shell", "git"} + }, + } + defs := BuiltinDefinitions() + ex := NewExecutor(NewRegistry(defs), rt) + + var reply string + res := ex.Execute(context.Background(), Request{ + Text: "/list skills", + Reply: func(text string) error { + reply = text + return nil + }, + }) + if res.Outcome != OutcomeHandled { + t.Fatalf("/list skills: outcome=%v, want=%v", res.Outcome, OutcomeHandled) + } + if !strings.Contains(reply, "shell") || !strings.Contains(reply, "git") { + t.Fatalf("/list skills reply=%q, want installed skill names", reply) + } +} + +func TestBuiltinUseCommand_PassthroughsToAgentLogic(t *testing.T) { + defs := BuiltinDefinitions() + ex := NewExecutor(NewRegistry(defs), nil) + + res := ex.Execute(context.Background(), Request{ + Text: "/use shell run ls", + }) + if res.Outcome != OutcomePassthrough { + t.Fatalf("/use outcome=%v, want=%v", res.Outcome, OutcomePassthrough) + } + if res.Command != "use" { + t.Fatalf("/use command=%q, want=%q", res.Command, "use") + } +} diff --git a/pkg/commands/cmd_list.go b/pkg/commands/cmd_list.go index bf47b6e9c..7186a6c25 100644 --- a/pkg/commands/cmd_list.go +++ b/pkg/commands/cmd_list.go @@ -47,6 +47,23 @@ func listCommand() Definition { Description: "Registered agents", Handler: agentsHandler(), }, + { + Name: "skills", + Description: "Installed skills", + Handler: func(_ context.Context, req Request, rt *Runtime) error { + if rt == nil || rt.ListSkillNames == nil { + return req.Reply(unavailableMsg) + } + names := rt.ListSkillNames() + if len(names) == 0 { + return req.Reply("No installed skills") + } + return req.Reply(fmt.Sprintf( + "Installed Skills:\n- %s\n\nUse /use to force one for a single request, or /use to apply it to your next message.", + strings.Join(names, "\n- "), + )) + }, + }, }, } } diff --git a/pkg/commands/cmd_use.go b/pkg/commands/cmd_use.go new file mode 100644 index 000000000..4698f5f5e --- /dev/null +++ b/pkg/commands/cmd_use.go @@ -0,0 +1,9 @@ +package commands + +func useCommand() Definition { + return Definition{ + Name: "use", + Description: "Force a specific installed skill for one request", + Usage: "/use [message]", + } +} diff --git a/pkg/commands/request.go b/pkg/commands/request.go index 62ee600f2..233b3ef9c 100644 --- a/pkg/commands/request.go +++ b/pkg/commands/request.go @@ -41,6 +41,11 @@ func parseCommandName(input string) (string, bool) { return name, true } +// CommandName returns the normalized command name for an input if present. +func CommandName(input string) (string, bool) { + return parseCommandName(input) +} + func trimCommandPrefix(token string) (string, bool) { for _, prefix := range commandPrefixes { if strings.HasPrefix(token, prefix) { diff --git a/pkg/commands/runtime.go b/pkg/commands/runtime.go index 84f775808..69403606e 100644 --- a/pkg/commands/runtime.go +++ b/pkg/commands/runtime.go @@ -10,6 +10,7 @@ type Runtime struct { GetModelInfo func() (name, provider string) ListAgentIDs func() []string ListDefinitions func() []Definition + ListSkillNames func() []string GetEnabledChannels func() []string SwitchModel func(value string) (oldModel string, err error) SwitchChannel func(value string) error diff --git a/pkg/commands/show_list_handlers_test.go b/pkg/commands/show_list_handlers_test.go index 047708f0f..28d481b67 100644 --- a/pkg/commands/show_list_handlers_test.go +++ b/pkg/commands/show_list_handlers_test.go @@ -61,6 +61,9 @@ func TestShowListHandlers_ListHandledOnAllChannels(t *testing.T) { GetEnabledChannels: func() []string { return []string{"telegram"} }, + ListSkillNames: func() []string { + return []string{"shell"} + }, } ex := NewExecutor(NewRegistry(BuiltinDefinitions()), rt) @@ -82,4 +85,20 @@ func TestShowListHandlers_ListHandledOnAllChannels(t *testing.T) { if !strings.Contains(reply, "telegram") { t.Fatalf("whatsapp /list reply=%q, expected enabled channels content", reply) } + + reply = "" + res = ex.Execute(context.Background(), Request{ + Channel: "whatsapp", + Text: "/list skills", + Reply: func(text string) error { + reply = text + return nil + }, + }) + if res.Outcome != OutcomeHandled { + t.Fatalf("whatsapp /list skills outcome=%v, want=%v", res.Outcome, OutcomeHandled) + } + if !strings.Contains(reply, "shell") { + t.Fatalf("whatsapp /list skills reply=%q, expected installed skills content", reply) + } } From be59133ce910fd380dd46fcc72f0069c728fe6ba Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 22 Mar 2026 20:58:46 +0100 Subject: [PATCH 019/202] resolve conflicts --- pkg/agent/loop.go | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 45f5e9d04..dde0ff957 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -78,7 +78,7 @@ type processOptions struct { SenderID string // Current sender ID for dynamic context SenderDisplayName string // Current sender display name for dynamic context UserMessage string // User message content (may include prefix) - ForcedSkills []string // Skills explicitly requested for this message + ForcedSkills []string // Skills explicitly requested for this message SystemPromptOverride string // Override the default system prompt (Used by SubTurns) Media []string // media:// refs from inbound message InitialSteeringMessages []providers.Message // Steering messages from refactor/agent @@ -1614,6 +1614,7 @@ func (al *AgentLoop) runTurn(ctx context.Context, ts *turnState) (turnResult, er ts.chatID, ts.opts.SenderID, ts.opts.SenderDisplayName, + activeSkillNames(ts.agent, ts.opts)..., ) cfg := al.GetConfig() @@ -1643,6 +1644,7 @@ func (al *AgentLoop) runTurn(ctx context.Context, ts *turnState) (turnResult, er newHistory, newSummary, ts.userMessage, ts.media, ts.channel, ts.chatID, ts.opts.SenderID, ts.opts.SenderDisplayName, + activeSkillNames(ts.agent, ts.opts)..., ) messages = resolveMediaRefs(messages, al.mediaStore, maxMediaSize) } @@ -2007,8 +2009,8 @@ turnLoop: newSummary := ts.agent.Sessions.GetSummary(ts.sessionKey) messages = ts.agent.ContextBuilder.BuildMessages( newHistory, newSummary, "", - nil, opts.Channel, opts.ChatID, opts.SenderID, opts.SenderDisplayName, - activeSkillNames(agent, opts)..., + nil, ts.channel, ts.chatID, ts.opts.SenderID, ts.opts.SenderDisplayName, + activeSkillNames(ts.agent, ts.opts)..., ) callMessages = messages if gracefulTerminal { From b90c5007f69b13fa633b47b7b9aeb9ddd2b73cc9 Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 22 Mar 2026 23:36:25 +0100 Subject: [PATCH 020/202] resolve conflicts --- pkg/agent/context.go | 68 +++++++ pkg/agent/loop.go | 342 ++++++++++++++++++++++------------- pkg/agent/loop_media.go | 18 ++ pkg/agent/loop_test.go | 82 ++++++++- pkg/commands/builtin.go | 1 + pkg/commands/builtin_test.go | 5 +- pkg/commands/cmd_list.go | 17 ++ pkg/commands/cmd_use.go | 9 + pkg/commands/request.go | 5 + pkg/commands/runtime.go | 1 + 10 files changed, 418 insertions(+), 130 deletions(-) create mode 100644 pkg/commands/cmd_use.go diff --git a/pkg/agent/context.go b/pkg/agent/context.go index 022230d41..d905674f3 100644 --- a/pkg/agent/context.go +++ b/pkg/agent/context.go @@ -508,6 +508,7 @@ func (cb *ContextBuilder) BuildMessages( currentMessage string, media []string, channel, chatID, senderID, senderDisplayName string, + activeSkills ...string, ) []providers.Message { messages := []providers.Message{} @@ -541,6 +542,11 @@ func (cb *ContextBuilder) BuildMessages( {Type: "text", Text: dynamicCtx}, } + if skillsText := cb.buildActiveSkillsContext(activeSkills); skillsText != "" { + stringParts = append(stringParts, skillsText) + contentBlocks = append(contentBlocks, providers.ContentBlock{Type: "text", Text: skillsText}) + } + if summary != "" { summaryText := fmt.Sprintf( "CONTEXT_SUMMARY: The following is an approximate summary of prior conversation "+ @@ -748,6 +754,68 @@ func (cb *ContextBuilder) AddAssistantMessage( return messages } +func (cb *ContextBuilder) buildActiveSkillsContext(skillNames []string) string { + if cb.skillsLoader == nil || len(skillNames) == 0 { + return "" + } + + var ordered []string + seen := make(map[string]struct{}, len(skillNames)) + for _, name := range skillNames { + canonical, ok := cb.ResolveSkillName(name) + if !ok { + continue + } + if _, exists := seen[canonical]; exists { + continue + } + seen[canonical] = struct{}{} + ordered = append(ordered, canonical) + } + if len(ordered) == 0 { + return "" + } + + content := cb.skillsLoader.LoadSkillsForContext(ordered) + if strings.TrimSpace(content) == "" { + return "" + } + + return fmt.Sprintf(`# Active Skills + +The following skills are active for this request. Follow them when relevant. + +%s`, content) +} + +func (cb *ContextBuilder) ListSkillNames() []string { + if cb.skillsLoader == nil { + return nil + } + + allSkills := cb.skillsLoader.ListSkills() + names := make([]string, 0, len(allSkills)) + for _, skill := range allSkills { + names = append(names, skill.Name) + } + return names +} + +func (cb *ContextBuilder) ResolveSkillName(name string) (string, bool) { + name = strings.TrimSpace(name) + if name == "" || cb.skillsLoader == nil { + return "", false + } + + for _, skill := range cb.skillsLoader.ListSkills() { + if strings.EqualFold(skill.Name, name) { + return skill.Name, true + } + } + + return "", false +} + // GetSkillsInfo returns information about loaded skills. func (cb *ContextBuilder) GetSkillsInfo() map[string]any { allSkills := cb.skillsLoader.ListSkills() diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 2a8cb883b..861be59db 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -56,6 +56,7 @@ type AgentLoop struct { mcp mcpRuntime hookRuntime hookRuntime steering *steeringQueue + pendingSkills sync.Map mu sync.RWMutex // Concurrent turn management (from HEAD) @@ -77,6 +78,7 @@ type processOptions struct { SenderID string // Current sender ID for dynamic context SenderDisplayName string // Current sender display name for dynamic context UserMessage string // User message content (may include prefix) + ForcedSkills []string // Skills explicitly requested for this message SystemPromptOverride string // Override the default system prompt (Used by SubTurns) Media []string // media:// refs from inbound message InitialSteeringMessages []providers.Message // Steering messages from refactor/agent @@ -1310,6 +1312,15 @@ func (al *AgentLoop) processMessage(ctx context.Context, msg bus.InboundMessage) return response, nil } + if pending := al.takePendingSkills(opts.SessionKey); len(pending) > 0 { + opts.ForcedSkills = append(opts.ForcedSkills, pending...) + logger.InfoCF("agent", "Applying pending skill override", + map[string]any{ + "session_key": opts.SessionKey, + "skills": strings.Join(pending, ","), + }) + } + return al.runAgentLoop(ctx, agent, opts) } @@ -1454,16 +1465,6 @@ func (al *AgentLoop) runAgentLoop( ts := newTurnState(agent, opts, al.newTurnEventScope(agent.ID, opts.SessionKey)) result, err := al.runTurn(ctx, ts) - // Resolve media:// refs: images→base64 data URLs, non-images→local paths in content - cfg := al.GetConfig() - maxMediaSize := cfg.Agents.Defaults.GetMaxMediaSize() - messages = resolveMediaRefs(messages, al.mediaStore, maxMediaSize) - - // 2. Save user message to session - agent.Sessions.AddMessage(opts.SessionKey, "user", opts.UserMessage) - - // 3. Run LLM iteration loop - finalContent, iteration, responseHandled, err := al.runLLMIteration(ctx, agent, messages, opts) if err != nil { return "", err } @@ -1471,22 +1472,6 @@ func (al *AgentLoop) runAgentLoop( return "", nil } - if responseHandled { - agent.Sessions.Save(opts.SessionKey) - - if opts.EnableSummary { - al.maybeSummarize(agent, opts.SessionKey, opts.Channel, opts.ChatID) - } - - logger.InfoCF("agent", "Response already handled by tool output", - map[string]any{ - "agent_id": agent.ID, - "session_key": opts.SessionKey, - "iterations": iteration, - }) - return "", nil - } - for _, followUp := range result.followUps { if pubErr := al.bus.PublishInbound(ctx, followUp); pubErr != nil { logger.WarnCF("agent", "Failed to publish follow-up after turn", @@ -1575,8 +1560,6 @@ func (al *AgentLoop) handleReasoning( } } -const handledToolResponseSummary = "Requested output delivered via tool attachment." - func (al *AgentLoop) runTurn(ctx context.Context, ts *turnState) (turnResult, error) { turnCtx, turnCancel := context.WithCancel(ctx) defer turnCancel() @@ -1631,6 +1614,7 @@ func (al *AgentLoop) runTurn(ctx context.Context, ts *turnState) (turnResult, er ts.chatID, ts.opts.SenderID, ts.opts.SenderDisplayName, + activeSkillNames(ts.agent, ts.opts)..., ) cfg := al.GetConfig() @@ -1660,6 +1644,7 @@ func (al *AgentLoop) runTurn(ctx context.Context, ts *turnState) (turnResult, er newHistory, newSummary, ts.userMessage, ts.media, ts.channel, ts.chatID, ts.opts.SenderID, ts.opts.SenderDisplayName, + activeSkillNames(ts.agent, ts.opts)..., ) messages = resolveMediaRefs(messages, al.mediaStore, maxMediaSize) } @@ -1682,59 +1667,8 @@ func (al *AgentLoop) runTurn(ctx context.Context, ts *turnState) (turnResult, er activeCandidates, activeModel := al.selectCandidates(ts.agent, ts.userMessage, messages) pendingMessages := append([]providers.Message(nil), ts.opts.InitialSteeringMessages...) -const handledToolResponseSummary = "Requested output delivered via tool attachment." - -func (al *AgentLoop) buildOutboundMediaMessage( - channel string, - chatID string, - refs []string, -) bus.OutboundMediaMessage { - parts := make([]bus.MediaPart, 0, len(refs)) - for _, ref := range refs { - part := bus.MediaPart{Ref: ref} - if al.mediaStore != nil { - if _, meta, err := al.mediaStore.ResolveWithMeta(ref); err == nil { - part.Filename = meta.Filename - part.ContentType = meta.ContentType - part.Type = inferMediaType(meta.Filename, meta.ContentType) - } - } - parts = append(parts, part) - } - return bus.OutboundMediaMessage{ - Channel: channel, - ChatID: chatID, - Parts: parts, - } -} - -func (al *AgentLoop) buildArtifactTags(refs []string) []string { - if al.mediaStore == nil || len(refs) == 0 { - return nil - } - - tags := make([]string, 0, len(refs)) - for _, ref := range refs { - localPath, meta, err := al.mediaStore.ResolveWithMeta(ref) - if err != nil { - continue - } - mime := detectMIME(localPath, meta) - tags = append(tags, buildPathTag(mime, localPath)) - } - return tags -} - -// runLLMIteration executes the LLM call loop with tool handling. -// Returns (finalContent, iteration, responseHandled, error). -func (al *AgentLoop) runLLMIteration( - ctx context.Context, - agent *AgentInstance, - messages []providers.Message, - opts processOptions, -) (string, int, bool, error) { - iteration := 0 var finalContent string + const handledToolResponseSummary = "Requested output delivered via tool attachment." turnLoop: for ts.currentIteration() < ts.agent.MaxIterations || len(pendingMessages) > 0 || func() bool { @@ -2078,6 +2012,7 @@ turnLoop: newHistory, newSummary, "", nil, ts.channel, ts.chatID, "", "", // Empty SenderID and SenderDisplayName for retry + activeSkillNames(ts.agent, ts.opts)..., ) callMessages = messages if gracefulTerminal { @@ -2138,7 +2073,6 @@ turnLoop: if response.Usage != nil { innerTS.SetLastUsage(response.Usage) } - return "", iteration, false, fmt.Errorf("LLM call failed after retries: %w", err) } go al.handleReasoning( @@ -2189,7 +2123,6 @@ turnLoop: "agent_id": ts.agent.ID, "iteration": iteration, "content_chars": len(finalContent), - "streamed": streamer != nil, }) break } @@ -2211,6 +2144,7 @@ turnLoop: "iteration": iteration, }) + allResponsesHandled := len(normalizedToolCalls) > 0 assistantMsg := providers.Message{ Role: "assistant", Content: response.Content, @@ -2460,18 +2394,11 @@ turnLoop: if toolResult == nil { toolResult = tools.ErrorResult("hook returned nil tool result") } - - if !toolResult.Silent && toolResult.ForUser != "" && ts.opts.SendResponse { - allResponsesHandled := len(agentResults) > 0 - - // Process results in original order (send to user, save to session) - for _, r := range agentResults { - if !r.result.ResponseHandled { + if !toolResult.ResponseHandled { allResponsesHandled = false } - // Send ForUser content to user immediately if not Silent - if !r.result.Silent && r.result.ForUser != "" && opts.SendResponse { + if !toolResult.Silent && toolResult.ForUser != "" && ts.opts.SendResponse { al.bus.PublishOutbound(ctx, bus.OutboundMessage{ Channel: ts.channel, ChatID: ts.chatID, @@ -2493,24 +2420,7 @@ turnLoop: part.Filename = meta.Filename part.ContentType = meta.ContentType part.Type = inferMediaType(meta.Filename, meta.ContentType) - // If tool returned media refs, publish them as outbound media only when the - // tool explicitly marked the user-visible delivery as already handled. - if len(r.result.Media) > 0 { - outboundMedia := al.buildOutboundMediaMessage(opts.Channel, opts.ChatID, r.result.Media) - if r.result.ResponseHandled { - if al.channelManager != nil { - if err := al.channelManager.SendMedia(ctx, outboundMedia); err != nil { - allResponsesHandled = false - logger.WarnCF("agent", "Synchronous media send failed, falling back to bus delivery", - map[string]any{ - "agent_id": agent.ID, - "tool": r.tc.Name, - "error": err.Error(), - }) - al.bus.PublishOutboundMedia(ctx, outboundMedia) } - } else { - al.bus.PublishOutboundMedia(ctx, outboundMedia) } parts = append(parts, part) } @@ -2521,14 +2431,10 @@ turnLoop: }) } - contentForLLM := toolResult.ForLLM - if contentForLLM == "" && toolResult.Err != nil { - contentForLLM = toolResult.Err.Error() - // Determine content for LLM based on tool result - if len(r.result.Media) > 0 && !r.result.ResponseHandled { - r.result.ArtifactTags = al.buildArtifactTags(r.result.Media) + if len(toolResult.Media) > 0 && !toolResult.ResponseHandled { + toolResult.ArtifactTags = buildArtifactTags(al.mediaStore, toolResult.Media) } - contentForLLM := r.result.ContentForLLM() + contentForLLM := toolResult.ContentForLLM() toolResultMsg := providers.Message{ Role: "tool", @@ -2617,31 +2523,48 @@ turnLoop: } } - ts.agent.Tools.TickTTL() if allResponsesHandled { summaryMsg := providers.Message{ Role: "assistant", Content: handledToolResponseSummary, } messages = append(messages, summaryMsg) - agent.Sessions.AddFullMessage(opts.SessionKey, summaryMsg) + if !ts.opts.NoHistory { + ts.agent.Sessions.AddMessage(ts.sessionKey, summaryMsg.Role, summaryMsg.Content) + ts.recordPersistedMessage(summaryMsg) + if err := ts.agent.Sessions.Save(ts.sessionKey); err != nil { + turnStatus = TurnEndStatusError + al.emitEvent( + EventKindError, + ts.eventMeta("runTurn", "turn.error"), + ErrorPayload{ + Stage: "session_save", + Message: err.Error(), + }, + ) + return turnResult{}, err + } + } + if ts.opts.EnableSummary { + al.maybeSummarize(ts.agent, ts.sessionKey, ts.scope) + } + ts.setPhase(TurnPhaseCompleted) + ts.setFinalContent("") logger.InfoCF("agent", "Tool output satisfied delivery; ending turn without follow-up LLM", map[string]any{ - "agent_id": agent.ID, + "agent_id": ts.agent.ID, "iteration": iteration, - "tool_count": len(agentResults), + "tool_count": len(normalizedToolCalls), }) - return "", iteration, true, nil + return turnResult{ + finalContent: "", + status: turnStatus, + followUps: append([]bus.InboundMessage(nil), ts.followUps...), + }, nil } - // Tick down TTL of discovered tools after processing tool results. - // Only reached when tool calls were made (the loop continues); - // the break on no-tool-call responses skips this. - // NOTE: This is safe because processMessage is sequential per agent. - // If per-agent concurrency is added, TTL consistency between - // ToProviderDefs and Get must be re-evaluated. - agent.Tools.TickTTL() + ts.agent.Tools.TickTTL() logger.DebugCF("agent", "TTL tick after tool execution", map[string]any{ "agent_id": ts.agent.ID, "iteration": iteration, }) @@ -2664,7 +2587,6 @@ turnLoop: return al.abortTurn(ts) } - return finalContent, iteration, false, nil if finalContent == "" { if ts.currentIteration() >= ts.agent.MaxIterations && ts.agent.MaxIterations > 0 { finalContent = toolLimitResponse @@ -3212,6 +3134,10 @@ func (al *AgentLoop) handleCommand( return "", false } + if matched, handled, reply := al.applyExplicitSkillCommand(msg.Content, agent, opts); matched { + return reply, handled + } + if al.cmdRegistry == nil { return "", false } @@ -3245,6 +3171,97 @@ func (al *AgentLoop) handleCommand( } } +func activeSkillNames(agent *AgentInstance, opts processOptions) []string { + if agent == nil { + return nil + } + + combined := make([]string, 0, len(agent.SkillsFilter)+len(opts.ForcedSkills)) + combined = append(combined, agent.SkillsFilter...) + combined = append(combined, opts.ForcedSkills...) + if len(combined) == 0 { + return nil + } + + var resolved []string + seen := make(map[string]struct{}, len(combined)) + for _, name := range combined { + name = strings.TrimSpace(name) + if name == "" { + continue + } + if agent.ContextBuilder != nil { + if canonical, ok := agent.ContextBuilder.ResolveSkillName(name); ok { + name = canonical + } + } + key := strings.ToLower(name) + if _, ok := seen[key]; ok { + continue + } + seen[key] = struct{}{} + resolved = append(resolved, name) + } + + return resolved +} + +func (al *AgentLoop) applyExplicitSkillCommand( + raw string, + agent *AgentInstance, + opts *processOptions, +) (matched bool, handled bool, reply string) { + cmdName, ok := commands.CommandName(raw) + if !ok || cmdName != "use" { + return false, false, "" + } + + if agent == nil || agent.ContextBuilder == nil { + return true, true, commandsUnavailableSkillMessage() + } + + parts := strings.Fields(strings.TrimSpace(raw)) + if len(parts) < 2 { + return true, true, buildUseCommandHelp(agent) + } + + arg := strings.TrimSpace(parts[1]) + if strings.EqualFold(arg, "clear") || strings.EqualFold(arg, "off") { + if opts != nil { + al.clearPendingSkills(opts.SessionKey) + } + return true, true, "Cleared pending skill override." + } + + skillName, ok := agent.ContextBuilder.ResolveSkillName(arg) + if !ok { + return true, true, fmt.Sprintf("Unknown skill %q.\n\n%s", arg, buildUseCommandHelp(agent)) + } + + if len(parts) < 3 { + if opts == nil || strings.TrimSpace(opts.SessionKey) == "" { + return true, true, commandsUnavailableSkillMessage() + } + al.setPendingSkills(opts.SessionKey, []string{skillName}) + return true, true, fmt.Sprintf( + "Skill %q is armed for your next message. Send your next prompt normally, or use /use clear to cancel.", + skillName, + ) + } + + message := strings.TrimSpace(strings.Join(parts[2:], " ")) + if message == "" { + return true, true, buildUseCommandHelp(agent) + } + + if opts != nil { + opts.ForcedSkills = append(opts.ForcedSkills, skillName) + opts.UserMessage = message + } + + return true, false, "" +} + func (al *AgentLoop) buildCommandsRuntime(agent *AgentInstance, opts *processOptions) *commands.Runtime { registry := al.GetRegistry() cfg := al.GetConfig() @@ -3282,6 +3299,7 @@ func (al *AgentLoop) buildCommandsRuntime(agent *AgentInstance, opts *processOpt return al.reloadFunc() } if agent != nil { + rt.ListSkillNames = agent.ContextBuilder.ListSkillNames rt.GetModelInfo = func() (string, string) { return agent.Model, resolvedCandidateProvider(agent.Candidates, cfg.Agents.Defaults.Provider) } @@ -3334,6 +3352,74 @@ func (al *AgentLoop) buildCommandsRuntime(agent *AgentInstance, opts *processOpt return rt } +func commandsUnavailableSkillMessage() string { + return "Skill commands are unavailable in the current context." +} + +func buildUseCommandHelp(agent *AgentInstance) string { + usage := "Usage:\n/use \n/use \n/use clear" + if agent == nil || agent.ContextBuilder == nil { + return usage + } + + names := agent.ContextBuilder.ListSkillNames() + if len(names) == 0 { + return "No installed skills.\n\n" + usage + } + + return fmt.Sprintf("%s\n\nInstalled Skills:\n- %s", usage, strings.Join(names, "\n- ")) +} + +func (al *AgentLoop) setPendingSkills(sessionKey string, skillNames []string) { + sessionKey = strings.TrimSpace(sessionKey) + if sessionKey == "" || len(skillNames) == 0 { + return + } + + values := make([]string, 0, len(skillNames)) + for _, name := range skillNames { + name = strings.TrimSpace(name) + if name == "" { + continue + } + values = append(values, name) + } + if len(values) == 0 { + return + } + + al.pendingSkills.Store(sessionKey, values) +} + +func (al *AgentLoop) takePendingSkills(sessionKey string) []string { + sessionKey = strings.TrimSpace(sessionKey) + if sessionKey == "" { + return nil + } + + value, ok := al.pendingSkills.LoadAndDelete(sessionKey) + if !ok { + return nil + } + + skills, ok := value.([]string) + if !ok || len(skills) == 0 { + return nil + } + + out := make([]string, len(skills)) + copy(out, skills) + return out +} + +func (al *AgentLoop) clearPendingSkills(sessionKey string) { + sessionKey = strings.TrimSpace(sessionKey) + if sessionKey == "" { + return + } + al.pendingSkills.Delete(sessionKey) +} + func mapCommandError(result commands.ExecuteResult) string { if result.Command == "" { return fmt.Sprintf("Failed to execute command: %v", result.Err) diff --git a/pkg/agent/loop_media.go b/pkg/agent/loop_media.go index 1380f0214..e8314c10d 100644 --- a/pkg/agent/loop_media.go +++ b/pkg/agent/loop_media.go @@ -87,6 +87,24 @@ func resolveMediaRefs(messages []providers.Message, store media.MediaStore, maxS return result } +func buildArtifactTags(store media.MediaStore, refs []string) []string { + if store == nil || len(refs) == 0 { + return nil + } + + tags := make([]string, 0, len(refs)) + for _, ref := range refs { + localPath, meta, err := store.ResolveWithMeta(ref) + if err != nil { + continue + } + mime := detectMIME(localPath, meta) + tags = append(tags, buildPathTag(mime, localPath)) + } + + return tags +} + // detectMIME determines the MIME type from metadata or magic-bytes detection. // Returns empty string if detection fails. func detectMIME(localPath string, meta media.MediaMeta) string { diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 8dbc5fae1..bca96934c 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -132,6 +132,86 @@ func TestProcessMessage_IncludesCurrentSenderInDynamicContext(t *testing.T) { } } +func TestApplyExplicitSkillCommand_ArmsSkillForNextMessage(t *testing.T) { + al, cfg, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + if err := os.MkdirAll(filepath.Join(cfg.Agents.Defaults.Workspace, "skills", "finance-news"), 0o755); err != nil { + t.Fatalf("MkdirAll(skill) error = %v", err) + } + if err := os.WriteFile( + filepath.Join(cfg.Agents.Defaults.Workspace, "skills", "finance-news", "SKILL.md"), + []byte("# Finance News\n\nUse web tools for current finance updates.\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile(SKILL.md) error = %v", err) + } + + agent := al.GetRegistry().GetDefaultAgent() + if agent == nil { + t.Fatal("expected default agent") + } + + opts := &processOptions{SessionKey: "agent:main:test"} + matched, handled, reply := al.applyExplicitSkillCommand("/use finance-news", agent, opts) + if !matched { + t.Fatal("expected /use command to match") + } + if !handled { + t.Fatal("expected /use without inline message to be handled immediately") + } + if !strings.Contains(reply, `Skill "finance-news" is armed for your next message`) { + t.Fatalf("unexpected reply: %q", reply) + } + + pending := al.takePendingSkills(opts.SessionKey) + if len(pending) != 1 || pending[0] != "finance-news" { + t.Fatalf("pending skills = %#v, want [finance-news]", pending) + } +} + +func TestApplyExplicitSkillCommand_InlineMessageMutatesOptions(t *testing.T) { + al, cfg, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + if err := os.MkdirAll(filepath.Join(cfg.Agents.Defaults.Workspace, "skills", "finance-news"), 0o755); err != nil { + t.Fatalf("MkdirAll(skill) error = %v", err) + } + if err := os.WriteFile( + filepath.Join(cfg.Agents.Defaults.Workspace, "skills", "finance-news", "SKILL.md"), + []byte("# Finance News\n\nUse web tools for current finance updates.\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile(SKILL.md) error = %v", err) + } + + agent := al.GetRegistry().GetDefaultAgent() + if agent == nil { + t.Fatal("expected default agent") + } + + opts := &processOptions{ + SessionKey: "agent:main:test", + UserMessage: "/use finance-news dammi le ultime news", + } + matched, handled, reply := al.applyExplicitSkillCommand(opts.UserMessage, agent, opts) + if !matched { + t.Fatal("expected /use command to match") + } + if handled { + t.Fatal("expected /use with inline message to fall through into normal agent execution") + } + if reply != "" { + t.Fatalf("unexpected reply: %q", reply) + } + if opts.UserMessage != "dammi le ultime news" { + t.Fatalf("opts.UserMessage = %q, want %q", opts.UserMessage, "dammi le ultime news") + } + if len(opts.ForcedSkills) != 1 || opts.ForcedSkills[0] != "finance-news" { + t.Fatalf("opts.ForcedSkills = %#v, want [finance-news]", opts.ForcedSkills) + } +} + func TestRecordLastChannel(t *testing.T) { al, cfg, msgBus, provider, cleanup := newTestAgentLoop(t) defer cleanup() @@ -381,7 +461,7 @@ func TestProcessMessage_MediaToolHandledSkipsFollowUpLLMAndFinalText(t *testing. t.Fatal("expected session history to be saved") } last := history[len(history)-1] - if last.Role != "assistant" || last.Content != handledToolResponseSummary { + if last.Role != "assistant" || last.Content != "Requested output delivered via tool attachment." { t.Fatalf("expected handled assistant summary in history, got %+v", last) } } diff --git a/pkg/commands/builtin.go b/pkg/commands/builtin.go index 7bd36b653..39e76f752 100644 --- a/pkg/commands/builtin.go +++ b/pkg/commands/builtin.go @@ -10,6 +10,7 @@ func BuiltinDefinitions() []Definition { helpCommand(), showCommand(), listCommand(), + useCommand(), switchCommand(), checkCommand(), clearCommand(), diff --git a/pkg/commands/builtin_test.go b/pkg/commands/builtin_test.go index 66a84825e..9f73b27b6 100644 --- a/pkg/commands/builtin_test.go +++ b/pkg/commands/builtin_test.go @@ -39,9 +39,12 @@ func TestBuiltinHelpHandler_ReturnsFormattedMessage(t *testing.T) { if !strings.Contains(reply, "/show [model|channel|agents]") { t.Fatalf("/help reply missing /show usage, got %q", reply) } - if !strings.Contains(reply, "/list [models|channels|agents]") { + if !strings.Contains(reply, "/list [models|channels|agents|skills]") { t.Fatalf("/help reply missing /list usage, got %q", reply) } + if !strings.Contains(reply, "/use [message]") { + t.Fatalf("/help reply missing /use usage, got %q", reply) + } } func TestBuiltinShowChannel_PreservesUserVisibleBehavior(t *testing.T) { diff --git a/pkg/commands/cmd_list.go b/pkg/commands/cmd_list.go index bf47b6e9c..7186a6c25 100644 --- a/pkg/commands/cmd_list.go +++ b/pkg/commands/cmd_list.go @@ -47,6 +47,23 @@ func listCommand() Definition { Description: "Registered agents", Handler: agentsHandler(), }, + { + Name: "skills", + Description: "Installed skills", + Handler: func(_ context.Context, req Request, rt *Runtime) error { + if rt == nil || rt.ListSkillNames == nil { + return req.Reply(unavailableMsg) + } + names := rt.ListSkillNames() + if len(names) == 0 { + return req.Reply("No installed skills") + } + return req.Reply(fmt.Sprintf( + "Installed Skills:\n- %s\n\nUse /use to force one for a single request, or /use to apply it to your next message.", + strings.Join(names, "\n- "), + )) + }, + }, }, } } diff --git a/pkg/commands/cmd_use.go b/pkg/commands/cmd_use.go new file mode 100644 index 000000000..4698f5f5e --- /dev/null +++ b/pkg/commands/cmd_use.go @@ -0,0 +1,9 @@ +package commands + +func useCommand() Definition { + return Definition{ + Name: "use", + Description: "Force a specific installed skill for one request", + Usage: "/use [message]", + } +} diff --git a/pkg/commands/request.go b/pkg/commands/request.go index 62ee600f2..233b3ef9c 100644 --- a/pkg/commands/request.go +++ b/pkg/commands/request.go @@ -41,6 +41,11 @@ func parseCommandName(input string) (string, bool) { return name, true } +// CommandName returns the normalized command name for an input if present. +func CommandName(input string) (string, bool) { + return parseCommandName(input) +} + func trimCommandPrefix(token string) (string, bool) { for _, prefix := range commandPrefixes { if strings.HasPrefix(token, prefix) { diff --git a/pkg/commands/runtime.go b/pkg/commands/runtime.go index f714e1ca4..5ba6a1bd2 100644 --- a/pkg/commands/runtime.go +++ b/pkg/commands/runtime.go @@ -10,6 +10,7 @@ type Runtime struct { GetModelInfo func() (name, provider string) ListAgentIDs func() []string ListDefinitions func() []Definition + ListSkillNames func() []string GetEnabledChannels func() []string GetActiveTurn func() any // Returning any to avoid circular dependency with agent package SwitchModel func(value string) (oldModel string, err error) From 388505d7e07388826dc9dc5f3cc5d360bbfc3c6c Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 22 Mar 2026 23:39:33 +0100 Subject: [PATCH 021/202] fix lint --- pkg/agent/loop.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 861be59db..5f816ec34 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -2528,7 +2528,7 @@ turnLoop: Role: "assistant", Content: handledToolResponseSummary, } - messages = append(messages, summaryMsg) + if !ts.opts.NoHistory { ts.agent.Sessions.AddMessage(ts.sessionKey, summaryMsg.Role, summaryMsg.Content) ts.recordPersistedMessage(summaryMsg) From f735b0551cc80a21e2843f93ddad41fef5b882af Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 22 Mar 2026 23:46:10 +0100 Subject: [PATCH 022/202] fix --- pkg/agent/loop.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 5f816ec34..debd99418 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -2201,6 +2201,7 @@ turnLoop: toolArgs = toolReq.Arguments } case HookActionDenyTool: + allResponsesHandled = false denyContent := hookDeniedToolContent("Tool execution denied by hook", decision.Reason) al.emitEvent( EventKindToolExecSkipped, @@ -2240,6 +2241,7 @@ turnLoop: ChatID: ts.chatID, }) if !approval.Approved { + allResponsesHandled = false denyContent := hookDeniedToolContent("Tool execution denied by approval hook", approval.Reason) al.emitEvent( EventKindToolExecSkipped, From 1e98f86fa9e203af3f7b3f7710e36e23d5a9da8f Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Mon, 23 Mar 2026 00:08:43 +0100 Subject: [PATCH 023/202] fix Ooutboundmedia --- pkg/agent/loop.go | 2 +- pkg/agent/loop_test.go | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index debd99418..c202eff17 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -2413,7 +2413,7 @@ turnLoop: }) } - if len(toolResult.Media) > 0 { + if len(toolResult.Media) > 0 && toolResult.ResponseHandled { parts := make([]bus.MediaPart, 0, len(toolResult.Media)) for _, ref := range toolResult.Media { part := bus.MediaPart{Ref: ref} diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index bca96934c..b7442e2fc 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -522,6 +522,12 @@ func TestProcessMessage_MediaArtifactCanBeForwardedBySendFile(t *testing.T) { default: t.Fatal("expected outbound media from send_file") } + + select { + case extra := <-msgBus.OutboundMediaChan(): + t.Fatalf("expected exactly one outbound media delivery, got extra %+v", extra) + default: + } } // TestAgentLoop_GetStartupInfo verifies startup info contains tools From 336d5d4c0739b2c61f54fe0f06636385141339d6 Mon Sep 17 00:00:00 2001 From: xiwuqi Date: Sun, 22 Mar 2026 19:57:47 -0500 Subject: [PATCH 024/202] fix(agent): route reasoning_content to reasoning channel --- pkg/agent/loop.go | 6 +++- pkg/agent/loop_test.go | 79 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 84 insertions(+), 1 deletion(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 840aa8fa1..c76954729 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -2060,9 +2060,13 @@ turnLoop: } } + reasoningContent := response.Reasoning + if reasoningContent == "" { + reasoningContent = response.ReasoningContent + } go al.handleReasoning( turnCtx, - response.Reasoning, + reasoningContent, ts.channel, al.targetReasoningChannelID(ts.channel), ) diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 71f2d15e4..727f6657f 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -397,6 +397,29 @@ func (m *simpleMockProvider) GetDefaultModel() string { return "mock-model" } +type reasoningContentProvider struct { + response string + reasoningContent string +} + +func (m *reasoningContentProvider) Chat( + ctx context.Context, + messages []providers.Message, + tools []providers.ToolDefinition, + model string, + opts map[string]any, +) (*providers.LLMResponse, error) { + return &providers.LLMResponse{ + Content: m.response, + ReasoningContent: m.reasoningContent, + ToolCalls: []providers.ToolCall{}, + }, nil +} + +func (m *reasoningContentProvider) GetDefaultModel() string { + return "reasoning-content-model" +} + type countingMockProvider struct { response string calls int @@ -1509,6 +1532,62 @@ func TestHandleReasoning(t *testing.T) { }) } +func TestProcessMessage_PublishesReasoningContentToReasoningChannel(t *testing.T) { + tmpDir := t.TempDir() + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + + msgBus := bus.NewMessageBus() + provider := &reasoningContentProvider{ + response: "final answer", + reasoningContent: "thinking trace", + } + al := NewAgentLoop(cfg, msgBus, provider) + + chManager, err := channels.NewManager(&config.Config{}, msgBus, nil) + if err != nil { + t.Fatalf("Failed to create channel manager: %v", err) + } + chManager.RegisterChannel("telegram", &fakeChannel{id: "reason-chat"}) + al.SetChannelManager(chManager) + + response, err := al.processMessage(context.Background(), bus.InboundMessage{ + Channel: "telegram", + SenderID: "user1", + ChatID: "chat1", + Content: "hello", + }) + if err != nil { + t.Fatalf("processMessage() error = %v", err) + } + if response != "final answer" { + t.Fatalf("processMessage() response = %q, want %q", response, "final answer") + } + + select { + case outbound := <-msgBus.OutboundChan(): + if outbound.Channel != "telegram" { + t.Fatalf("reasoning channel = %q, want %q", outbound.Channel, "telegram") + } + if outbound.ChatID != "reason-chat" { + t.Fatalf("reasoning chatID = %q, want %q", outbound.ChatID, "reason-chat") + } + if outbound.Content != "thinking trace" { + t.Fatalf("reasoning content = %q, want %q", outbound.Content, "thinking trace") + } + case <-time.After(2 * time.Second): + t.Fatal("expected reasoning content to be published to reasoning channel") + } +} + func TestResolveMediaRefs_ResolvesToBase64(t *testing.T) { store := media.NewFileMediaStore() dir := t.TempDir() From 310f788f5f675fecbea5b2de427efc02a8d5a4d0 Mon Sep 17 00:00:00 2001 From: Cytown Date: Mon, 23 Mar 2026 11:20:42 +0800 Subject: [PATCH 025/202] rename security.yml to .security.yml --- pkg/config/REFACTORING_SUMMARY.md | 225 ------------------------ pkg/config/SECURITY_CONFIG.md | 52 +++--- pkg/config/config.go | 8 +- pkg/config/example_security_usage.go | 46 ++--- pkg/config/security.go | 2 +- pkg/config/security_integration_test.go | 14 +- pkg/config/security_test.go | 8 +- security.example.yml | 184 ------------------- 8 files changed, 65 insertions(+), 474 deletions(-) delete mode 100644 pkg/config/REFACTORING_SUMMARY.md delete mode 100644 security.example.yml diff --git a/pkg/config/REFACTORING_SUMMARY.md b/pkg/config/REFACTORING_SUMMARY.md deleted file mode 100644 index 2c4b30c9a..000000000 --- a/pkg/config/REFACTORING_SUMMARY.md +++ /dev/null @@ -1,225 +0,0 @@ -# Security Configuration Refactoring Summary - -## Overview - -Successfully refactored `pkg/config/config.go` to support a separate `security.yml` file for storing all sensitive data (API keys, tokens, secrets, passwords). - -## Changes Made - -### New Files Created - -1. **`pkg/config/security.go`** (New file) - - Defines `SecurityConfig` structure for all sensitive data - - Implements `LoadSecurityConfig()` to load from YAML - - Implements `SaveSecurityConfig()` to save with secure permissions (0o600) - - Implements `ResolveReference()` to resolve `ref:` prefixed strings - - Supports all model, channel, web tool, and skills security entries - -2. **`pkg/config/security_test.go`** (New file) - - Comprehensive unit tests for security config loading - - Tests for reference resolution (models, channels, web tools, skills) - - Tests for file I/O operations - -3. **`pkg/config/security_integration_test.go`** (New file) - - Integration tests for full workflow - - Tests backward compatibility with direct values - - Tests mixed usage of references and direct values - - Tests error handling for invalid references - -4. **`security.example.yml`** (New file) - - Template for users to copy and fill in - - Includes all possible security entries with placeholder values - - Located at project root - -5. **`pkg/config/SECURITY_CONFIG.md`** (New file) - - Complete documentation for the security config feature - - Usage examples and reference format guide - - Migration guide from old config - - Security best practices - -6. **`pkg/config/example_security_usage.go`** (New file) - - Practical examples in Go comment format - - Shows complete workflow from creation to usage - - Lists all available reference paths - -### Modified Files - -1. **`pkg/config/config.go`** - - Added `applySecurityConfig()` function to resolve all `ref:` references - - Modified `LoadConfig()` to: - - Load security config from `security.yml` - - Apply security references to all config fields - - Maintain backward compatibility with direct values - - Updated warning message to suggest using `security.yml` - -## Key Features - -### Reference Format - -Uses dot notation for referencing values: -- Models: `ref:model_list..api_key` -- Channels: `ref:channels..` -- Web Tools: `ref:web..` -- Skills: `ref:skills..` - -### Supported Security Entries - -**Models:** -- API keys for all model configurations - -**Channels:** -- Telegram: token -- Feishu: app_secret, encrypt_key, verification_token -- Discord: token -- QQ: app_secret -- DingTalk: client_secret -- Slack: bot_token, app_token -- Matrix: access_token -- LINE: channel_secret, channel_access_token -- OneBot: access_token -- WeCom: token, encoding_aes_key -- WeComApp: corp_secret, token, encoding_aes_key -- WeComAIBot: token, encoding_aes_key -- Pico: token -- IRC: password, nickserv_password, sasl_password - -**Web Tools:** -- Brave: api_key -- Tavily: api_key -- Perplexity: api_key -- GLMSearch: api_key - -**Skills:** -- GitHub: token -- ClawHub: auth_token - -### Backward Compatibility - -- Direct values in `config.json` still work -- Mixed usage of references and direct values is supported -- Optional security file (if missing, only references fail) -- No breaking changes to existing configurations - -## Testing - -All tests pass successfully: - -```bash -go test ./pkg/config -v -``` - -Test coverage includes: -- ✅ Unit tests for reference resolution -- ✅ Integration tests for full workflow -- ✅ Backward compatibility tests -- ✅ Error handling tests -- ✅ File I/O and permission tests -- ✅ All existing config tests still pass - -## Usage Example - -### config.json -```json -{ - "version": 1, - "model_list": [ - { - "model_name": "gpt-5.4", - "model": "openai/gpt-5.4", - "api_base": "https://api.openai.com/v1", - "api_key": "ref:model_list.gpt-5.4.api_key" - } - ], - "channels": { - "telegram": { - "enabled": true, - "token": "ref:channels.telegram.token" - } - } -} -``` - -### security.yml -```yaml -model_list: - gpt-5.4: - api_key: "sk-proj-actual-key-here" - -channels: - telegram: - token: "1234567890:ABCdefGHIjklMNOpqrsTUVwxyz" -``` - -## Migration Path - -1. Copy `security.example.yml` to `~/.picoclaw/security.yml` -2. Fill in actual API keys and tokens -3. Update `config.json` to use `ref:` references -4. Set proper permissions: `chmod 600 ~/.picoclaw/security.yml` -5. Test with `picoclaw --version` - -## Security Benefits - -1. **Separation of concerns**: Configuration and secrets are in separate files -2. **Easier sharing**: Config can be shared without exposing secrets -3. **Better version control**: `security.yml` can be added to `.gitignore` -4. **Flexible deployment**: Different environments can use different security files -5. **Secure file permissions**: Saved with `0o600` by default - -## Implementation Details - -### File Loading Flow - -``` -LoadConfig() - ├─ Load config.json - ├─ Detect version - ├─ Parse config based on version - ├─ Load security.yml (optional) - ├─ Apply security references - │ └─ Resolve all "ref:" prefixes - ├─ Parse environment variables - ├─ Resolve API keys (file://, enc://) - ├─ Expand multi-key models - └─ Validate and return -``` - -### Reference Resolution - -The `ResolveReference()` function: -1. Checks if string starts with `ref:` -2. Parses the dot-notation path -3. Navigates the security config structure -4. Returns the actual value -5. Returns error if path doesn't exist - -### Error Handling - -- Clear error messages with full context -- Includes the reference path and field name -- Fails early on invalid references -- Maintains backward compatibility - -## Dependencies - -Added dependency: `gopkg.in/yaml.v3` for YAML parsing - -## Files Modified Summary - -- **Created**: 6 new files (security.go, tests, docs, examples) -- **Modified**: 1 file (config.go - added security integration) -- **Lines added**: ~1000+ lines (including tests and documentation) -- **Backward compatible**: ✅ Yes -- **Breaking changes**: ❌ None - -## Next Steps - -1. Update main README to mention security.yml -2. Add security.yml to .gitignore -3. Update documentation with security config examples -4. Consider adding migration tool for existing users -5. Add validation for security.yml schema - -## Conclusion - -The refactoring successfully implements a secure, flexible, and backward-compatible way to manage sensitive configuration data. All tests pass and the feature is ready for use. diff --git a/pkg/config/SECURITY_CONFIG.md b/pkg/config/SECURITY_CONFIG.md index c1aa38acc..c5aed54ae 100644 --- a/pkg/config/SECURITY_CONFIG.md +++ b/pkg/config/SECURITY_CONFIG.md @@ -2,11 +2,11 @@ ## Overview -This refactoring introduces a `security.yml` file to store all sensitive data (API keys, tokens, secrets, passwords) separately from the main configuration. This improves security by: +This refactoring introduces a `.security.yml` file to store all sensitive data (API keys, tokens, secrets, passwords) separately from the main configuration. This improves security by: 1. **Separation of concerns**: Configuration settings and secrets are in separate files 2. **Easier sharing**: The main config can be shared without exposing sensitive data -3. **Better version control**: `security.yml` can be added to `.gitignore` +3. **Better version control**: `.security.yml` can be added to `.gitignore` 4. **Flexible deployment**: Different environments can use different security files ## File Structure @@ -14,14 +14,14 @@ This refactoring introduces a `security.yml` file to store all sensitive data (A ``` ~/.picoclaw/ ├── config.json # Main configuration (safe to share) -└── security.yml # Security data (never share) +└── .security.yml # Security data (never share) ``` ## Usage ### Basic Configuration -In your `config.json`, use `ref:` references to point to values in `security.yml`: +In your `config.json`, use `ref:` references to point to values in `.security.yml`: ```json { @@ -45,7 +45,7 @@ In your `config.json`, use `ref:` references to point to values in `security.yml ### Security Configuration -In your `security.yml`, store the actual values: +In your `.security.yml`, store the actual values: ```yaml model_list: @@ -135,9 +135,9 @@ The refactoring maintains full backward compatibility: 1. **Direct values**: You can still use direct values in `config.json` (not recommended for production) 2. **Mixed usage**: You can mix `ref:` references and direct values -3. **Optional security file**: If `security.yml` doesn't exist, all references will fail (but direct values still work) +3. **Optional security file**: If `.security.yml` doesn't exist, all references will fail (but direct values still work) -### API Key Formats in security.yml +### API Key Formats in .security.yml **Models (gpt-5.4, claude-sonnet-4.6, etc.):** - Must use `api_keys` (array) format @@ -190,16 +190,16 @@ In `config.json`: ## Migration Guide -### Step 1: Create security.yml +### Step 1: Create .security.yml Copy the example template: ```bash -cp security.example.yml ~/.picoclaw/security.yml +cp security.example.yml ~/.picoclaw/.security.yml ``` ### Step 2: Fill in your actual values -Edit `~/.picoclaw/security.yml` and replace placeholder values with your actual API keys and tokens. +Edit `~/.picoclaw/.security.yml` and replace placeholder values with your actual API keys and tokens. ### Step 3: Update config.json @@ -240,11 +240,11 @@ picoclaw --version ## Security Best Practices -1. **Never commit `security.yml`** to version control -2. **Set file permissions**: `chmod 600 ~/.picoclaw/security.yml` +1. **Never commit `.security.yml`** to version control +2. **Set file permissions**: `chmod 600 ~/.picoclaw/.security.yml` 3. **Use different keys** for different environments (dev, staging, production) -4. **Rotate keys regularly** and update `security.yml` -5. **Backup securely**: Encrypt backups containing `security.yml` +4. **Rotate keys regularly** and update `.security.yml` +5. **Backup securely**: Encrypt backups containing `.security.yml` ## API @@ -254,7 +254,7 @@ picoclaw --version func LoadSecurityConfig(securityPath string) (*SecurityConfig, error) ``` -Loads the security configuration from `security.yml`. Returns an empty `SecurityConfig` if the file doesn't exist. +Loads the security configuration from `.security.yml`. Returns an empty `SecurityConfig` if the file doesn't exist. ### SaveSecurityConfig @@ -262,7 +262,7 @@ Loads the security configuration from `security.yml`. Returns an empty `Security func SaveSecurityConfig(securityPath string, sec *SecurityConfig) error ``` -Saves the security configuration to `security.yml` with `0o600` permissions. +Saves the security configuration to `.security.yml` with `0o600` permissions. ### ResolveReference @@ -278,7 +278,7 @@ Resolves a reference string (e.g., `"ref:model_list.test.api_key"`) and returns func SecurityPath(configPath string) string ``` -Returns the path to `security.yml` relative to the config file. +Returns the path to `.security.yml` relative to the config file. ## Example: Complete Configuration @@ -323,7 +323,7 @@ Returns the path to `security.yml` relative to the config file. } ``` -### security.yml +### .security.yml ```yaml model_list: gpt-5.4: @@ -362,13 +362,13 @@ go test ./pkg/config -run TestSecurityConfig ### Error: "model security entry not found" -- Ensure the model name in your reference matches exactly in `security.yml` -- Check that the `model_list` section exists in `security.yml` +- Ensure the model name in your reference matches exactly in `.security.yml` +- Check that the `model_list` section exists in `.security.yml` - For models with indexed names (e.g., "gpt-5.4:0"), ensure the exact name is used or check the base name without index ### Error: "failed to load security config" -- Verify `security.yml` exists in the same directory as `config.json` +- Verify `.security.yml` exists in the same directory as `config.json` - Check the YAML syntax is valid (use a YAML validator) - Ensure file permissions allow reading @@ -376,7 +376,7 @@ go test ./pkg/config -run TestSecurityConfig - Verify the reference format is correct - Check the path structure matches the examples above -- Ensure all required sections exist in `security.yml` +- Ensure all required sections exist in `.security.yml` ## Advanced Features @@ -392,7 +392,7 @@ Both models and web tools support multiple API keys for improved reliability: #### Example: Model with Multiple Keys -**security.yml:** +**.security.yml:** ```yaml model_list: gpt-5.4: @@ -417,7 +417,7 @@ model_list: #### Example: Web Tool with Multiple Keys -**security.yml:** +**.security.yml:** ```yaml web: brave: @@ -504,7 +504,7 @@ All formats work identically in `config.json` - you always use the same referenc When you have multiple models with the same base name but different API keys, you can use indexed names: -**security.yml:** +**.security.yml:** ```yaml model_list: gpt-5.4: @@ -538,7 +538,7 @@ Environment variables follow this pattern: `PICOCLAW_
___ "abc") - // This allows security.yml to use simpler keys like "test-model" instead of "test-model:0" + // This allows .security.yml to use simpler keys like "test-model" instead of "test-model:0" baseName := model.ModelName if entry, exists := sec.ModelList[baseName]; exists { copyArray(&model.apiKeys, &entry.APIKeys) @@ -1838,7 +1838,7 @@ func SaveConfig(path string, cfg *Config) error { } } if err := saveSecurityConfig(securityPath(path), cfg.security); err != nil { - logger.ErrorCF("config", "cannot save security.yml", map[string]any{"error": err}) + logger.ErrorCF("config", "cannot save .security.yml", map[string]any{"error": err}) return err } diff --git a/pkg/config/example_security_usage.go b/pkg/config/example_security_usage.go index d4df93473..cba76c6bc 100644 --- a/pkg/config/example_security_usage.go +++ b/pkg/config/example_security_usage.go @@ -118,7 +118,7 @@ chmod 600 ~/.picoclaw/security.yml ```gitignore # Security configuration -security.yml +.security.yml ``` ## 5. Verify it works @@ -136,7 +136,7 @@ Examples: - ref:model_list.gpt-5.4.api_key - ref:model_list.claude-sonnet-4.6.api_key -**Note:** In security.yml, use `api_keys` (array) format for models. +**Note:** In .security.yml, use `api_keys` (array) format for models. Both single and multiple keys should use the array format. ## Channel Tokens/Secrets @@ -172,8 +172,8 @@ Both single and multiple keys should use the array format. - ref:web.glm_search.api_key **Note:** -- Brave, Tavily, Perplexity: Use `api_keys` (array) format in security.yml -- GLMSearch: Use `api_key` (single string) format in security.yml +- Brave, Tavily, Perplexity: Use `api_keys` (array) format in .security.yml +- GLMSearch: Use `api_key` (single string) format in .security.yml ## Skills Registry Tokens - ref:skills.github.token @@ -206,7 +206,7 @@ You can also mix references and direct values: "model_list": [ { "model_name": "cloud-model", - "api_key": "ref:model_list.cloud-model.api_key" // From security.yml + "api_key": "ref:model_list.cloud-model.api_key" // From .security.yml }, { "model_name": "local-model", @@ -226,11 +226,11 @@ cp ~/.picoclaw/config.json ~/.picoclaw/config.json.backup ## Step 2: Copy the example security file ```bash -cp security.example.yml ~/.picoclaw/security.yml +cp security.example.yml ~/.picoclaw/.security.yml ``` ## Step 3: Fill in your API keys -Edit ~/.picoclaw/security.yml and replace placeholders with your actual keys. +Edit ~/.picoclaw/.security.yml and replace placeholders with your actual keys. ## Step 4: Update config.json references Replace sensitive values in ~/.picoclaw/config.json with ref: references. @@ -255,7 +255,7 @@ You can configure multiple API keys for both models and web tools to enable: ### Example: Model with Multiple Keys -**security.yml:** +**.security.yml:** ```yaml model_list: @@ -284,7 +284,7 @@ model_list: ### Example: Web Tool with Multiple Keys -**security.yml:** +**.security.yml:** ```yaml web: @@ -342,12 +342,12 @@ model_list: ``` -**Important:** All model keys in security.yml must use the `api_keys` (plural) array format. +**Important:** All model keys in .security.yml must use the `api_keys` (plural) array format. The single `api_key` (singular) format is NOT supported for models. ### Model Index Matching -The system supports intelligent model name matching in security.yml: +The system supports intelligent model name matching in .security.yml: **Example 1: Exact Match** ```yaml @@ -357,7 +357,7 @@ The system supports intelligent model name matching in security.yml: "model_name": "gpt-5.4:0" } -# security.yml (exact match with index) +# .security.yml (exact match with index) model_list: gpt-5.4:0: @@ -373,7 +373,7 @@ model_list: "model_name": "gpt-5.4:0" } -# security.yml (base name without index) +# .security.yml (base name without index) model_list: gpt-5.4: @@ -381,7 +381,7 @@ model_list: ``` -Both methods work. The base name match allows you to use simpler keys in security.yml +Both methods work. The base name match allows you to use simpler keys in .security.yml even when your config uses indexed model names for load balancing. ### Security File Permissions @@ -389,34 +389,34 @@ even when your config uses indexed model names for load balancing. The security file should have restricted permissions: ```bash -chmod 600 ~/.picoclaw/security.yml +chmod 600 ~/.picoclaw/.security.yml ``` This ensures only the owner can read and write the file. # Security Best Practices -1. Never commit security.yml to version control -2. Set file permissions: chmod 600 ~/.picoclaw/security.yml +1. Never commit .security.yml to version control +2. Set file permissions: chmod 600 ~/.picoclaw/.security.yml 3. Use different keys for different environments -4. Rotate keys regularly and update security.yml -5. Encrypt backups containing security.yml +4. Rotate keys regularly and update .security.yml +5. Encrypt backups containing .security.yml # Troubleshooting ## Error: "model security entry not found" -- Check that the model name in config.json matches exactly in security.yml -- Verify the model_list section exists in security.yml +- Check that the model name in config.json matches exactly in .security.yml +- Verify the model_list section exists in .security.yml ## Error: "failed to load security config" -- Ensure security.yml exists in the same directory as config.json +- Ensure .security.yml exists in the same directory as config.json - Check YAML syntax is valid - Verify file permissions allow reading ## Error: "unknown reference path" - Verify the reference format is correct - Check the path structure matches the examples above -- Ensure all required sections exist in security.yml +- Ensure all required sections exist in .security.yml */ package config diff --git a/pkg/config/security.go b/pkg/config/security.go index 66d1eef38..b6db7c0e3 100644 --- a/pkg/config/security.go +++ b/pkg/config/security.go @@ -19,7 +19,7 @@ import ( ) const ( - SecurityConfigFile = "security.yml" + SecurityConfigFile = ".security.yml" ) // SecurityConfig stores all sensitive data (API keys, tokens, secrets, passwords) diff --git a/pkg/config/security_integration_test.go b/pkg/config/security_integration_test.go index 99d4f01df..c1e1a2340 100644 --- a/pkg/config/security_integration_test.go +++ b/pkg/config/security_integration_test.go @@ -80,8 +80,8 @@ func TestSecurityConfigIntegration(t *testing.T) { err := os.WriteFile(configPath, []byte(configContent), 0o644) require.NoError(t, err) - // Create security.yml with actual values - securityPath := filepath.Join(tmpDir, "security.yml") + // Create .security.yml with actual values + securityPath := filepath.Join(tmpDir, SecurityConfigFile) securityContent := `model_list: test-model: api_keys: @@ -141,8 +141,8 @@ func TestSecurityConfigWithAPIKeysArray(t *testing.T) { err := os.WriteFile(configPath, []byte(configContent), 0o644) require.NoError(t, err) - // Create security.yml - securityPath := filepath.Join(tmpDir, "security.yml") + // Create .security.yml + securityPath := filepath.Join(tmpDir, SecurityConfigFile) securityContent := `model_list: multi-key-model:0: api_key: "sk-key-1" @@ -197,7 +197,7 @@ func TestAllSecurityKeysAccessible(t *testing.T) { err = os.WriteFile(clawhubAuthTokenFile, []byte("clawhub-auth-token-from-file"), 0o600) require.NoError(t, err) - // Create config.json without sensitive values (they'll be in security.yml) + // Create config.json without sensitive values (they'll be in .security.yml) configPath := filepath.Join(tmpDir, "config.json") configContent := `{ "version": 1, @@ -288,8 +288,8 @@ func TestAllSecurityKeysAccessible(t *testing.T) { err = os.WriteFile(configPath, []byte(configContent), 0o644) require.NoError(t, err) - // Create security.yml with file:// references and plaintext values - securityPath := filepath.Join(tmpDir, "security.yml") + // Create .security.yml with file:// references and plaintext values + securityPath := filepath.Join(tmpDir, SecurityConfigFile) securityContent := `model_list: test-model-1: api_keys: diff --git a/pkg/config/security_test.go b/pkg/config/security_test.go index 482b3578e..74e765f6b 100644 --- a/pkg/config/security_test.go +++ b/pkg/config/security_test.go @@ -16,7 +16,7 @@ import ( func TestSecurityConfig(t *testing.T) { t.Run("LoadNonExistent", func(t *testing.T) { - sec, err := loadSecurityConfig("/nonexistent/security.yml") + sec, err := loadSecurityConfig("/nonexistent/.security.yml") require.NoError(t, err) assert.NotNil(t, sec) assert.Empty(t, sec.ModelList) @@ -32,12 +32,12 @@ func TestSecurityPath(t *testing.T) { { name: "standard path", configDir: "/home/user/.picoclaw/config.json", - want: "/home/user/.picoclaw/security.yml", + want: "/home/user/.picoclaw/.security.yml", }, { name: "nested path", configDir: "/path/to/config/myconfig.json", - want: "/path/to/config/security.yml", + want: "/path/to/config/.security.yml", }, } @@ -51,7 +51,7 @@ func TestSecurityPath(t *testing.T) { func TestSaveAndLoadSecurityConfig(t *testing.T) { tmpDir := t.TempDir() - secPath := filepath.Join(tmpDir, "security.yml") + secPath := filepath.Join(tmpDir, SecurityConfigFile) original := &SecurityConfig{ ModelList: map[string]ModelSecurityEntry{ diff --git a/security.example.yml b/security.example.yml deleted file mode 100644 index 1d7f8bd0c..000000000 --- a/security.example.yml +++ /dev/null @@ -1,184 +0,0 @@ -# PicoClaw Security Configuration -# This file stores all sensitive data (API keys, tokens, secrets, passwords) -# Keep this file secure and never commit it to version control -# Copy this file to security.yml and fill in your actual values - -# Model API Keys -# Use dot notation references in config.json like: "ref:model_list.gpt-5.4.api_key" -# IMPORTANT: Use 'api_keys' (array) format - both single and multiple keys -model_list: - # Example: OpenAI GPT-5.4 (multiple keys for load balancing/failover) - gpt-5.4: - api_keys: - - "your-openai-api-key-1" - - "your-openai-api-key-2" # Optional: failover key - - # Example: Claude Sonnet (single key in array format) - claude-sonnet-4.6: - api_keys: - - "your-anthropic-api-key-here" # Single key MUST be in array format - - # Example: Zhipu GLM - glm-4.7: - api_key: "your-zhipu-api-key-here" - - # Example: DeepSeek - deepseek-chat: - api_key: "your-deepseek-api-key-here" - - # Example: Google Gemini - gemini-2.0-flash: - api_key: "your-gemini-api-key-here" - - # Example: Qwen - qwen-plus: - api_key: "your-qwen-api-key-here" - - # Example: Moonshot - moonshot-v1-8k: - api_key: "your-moonshot-api-key-here" - - # Example: Groq - llama-3.3-70b: - api_key: "your-groq-api-key-here" - - # Example: OpenRouter - openrouter-auto: - api_key: "your-openrouter-api-key-here" - openrouter-gpt-5.4: - api_key: "your-openrouter-api-key-here" - - # Example: NVIDIA - nemotron-4-340b: - api_key: "your-nvidia-api-key-here" - - # Example: Cerebras - cerebras-llama-3.3-70b: - api_key: "your-cerebras-api-key-here" - - # Example: Vivgrid - vivgrid-auto: - api_key: "your-vivgrid-api-key-here" - - # Example: Volcengine - ark-code-latest: - api_key: "your-volcengine-api-key-here" - doubao-pro: - api_key: "your-volcengine-api-key-here" - - # Example: ShengsuanYun - deepseek-v3: - api_key: "your-shengsuanyun-api-key-here" - - # Example: Mistral - mistral-small: - api_key: "your-mistral-api-key-here" - - # Example: Avian - deepseek-v3.2: - api_key: "your-avian-api-key-here" - kimi-k2.5: - api_key: "your-avian-api-key-here" - - # Example: Minimax - MiniMax-M2.5: - api_key: "your-minimax-api-key-here" - - # Example: LongCat - LongCat-Flash-Thinking: - api_key: "your-longcat-api-key-here" - - # Example: ModelScope - modelscope-qwen: - api_key: "your-modelscope-api-key-here" - - # Example: VLLM (local, usually no real key needed) - local-model: - api_key: "" - - # Example: Azure OpenAI - azure-gpt5: - api_key: "your-azure-api-key-here" - -# Channel Tokens and Secrets -channels: - telegram: - token: "your-telegram-bot-token" - - feishu: - app_secret: "your-feishu-app-secret" - encrypt_key: "your-feishu-encrypt-key" - verification_token: "your-feishu-verification-token" - - discord: - token: "your-discord-bot-token" - - qq: - app_secret: "your-qq-app-secret" - - dingtalk: - client_secret: "your-dingtalk-client-secret" - - slack: - bot_token: "your-slack-bot-token" - app_token: "your-slack-app-token" - - matrix: - access_token: "your-matrix-access-token" - - line: - channel_secret: "your-line-channel-secret" - channel_access_token: "your-line-channel-access-token" - - onebot: - access_token: "your-onebot-access-token" - - wecom: - token: "your-wecom-token" - encoding_aes_key: "your-wecom-encoding-aes-key" - - wecom_app: - corp_secret: "your-wecom-app-corp-secret" - token: "your-wecom-app-token" - encoding_aes_key: "your-wecom-app-encoding-aes-key" - - wecom_aibot: - token: "your-wecom-aibot-token" - encoding_aes_key: "your-wecom-aibot-encoding-aes-key" - - pico: - token: "your-pico-token" - - irc: - password: "your-irc-password" - nickserv_password: "your-irc-nickserv-password" - sasl_password: "your-irc-sasl-password" - -# Web Tool API Keys -# IMPORTANT: Use 'api_keys' (array) for Brave, Tavily, Perplexity -# Use 'api_key' (single string) for GLMSearch only -web: - brave: - api_keys: - - "your-brave-api-key-1" - - "your-brave-api-key-2" # Optional: failover key - - tavily: - api_keys: - - "your-tavily-api-key" # Single key MUST be in array format - - perplexity: - api_keys: - - "your-perplexity-api-key-1" - - "your-perplexity-api-key-2" - - glm_search: - api_key: "your-glm-search-api-key" # GLMSearch uses single string format (NOT array) - -# Skills Registry Tokens -skills: - github: - token: "your-github-token" - - clawhub: - auth_token: "your-clawhub-auth-token" From 75270c47770ddc121ba79e9bcd6a12fa9b658dc4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=BE=8E=E9=9B=BB=E7=90=83?= Date: Mon, 23 Mar 2026 12:13:59 +0800 Subject: [PATCH 026/202] Fix 1886 media cleanup policy (#1887) * fix(media): track cleanup ownership per path Add explicit cleanup policy handling to MediaStore and count refs by path before deleting the underlying file. This prevents cleanup from removing shared files until the final ref is gone. Refs #1886 * fix(tools): keep send_file refs forget-only Mark send_file media registrations as forget-only so cleanup drops the ref without deleting the original workspace file. Refs #1886 * fix(channels): declare managed media cleanup policy Explicitly mark downloaded and managed channel media as delete-on-cleanup so media ownership is visible at each registration site. Refs #1886 --- pkg/channels/discord/discord.go | 5 +- pkg/channels/feishu/feishu_64.go | 5 +- pkg/channels/line/line.go | 5 +- pkg/channels/matrix/matrix.go | 3 + pkg/channels/onebot/onebot.go | 5 +- pkg/channels/qq/qq.go | 7 +- pkg/channels/slack/slack.go | 5 +- pkg/channels/telegram/telegram.go | 5 +- pkg/channels/wecom/aibot_ws.go | 5 +- pkg/channels/weixin/media.go | 7 +- pkg/media/store.go | 117 +++++++++++++++++--- pkg/media/store_test.go | 176 ++++++++++++++++++++++++++++++ pkg/tools/send_file.go | 7 +- pkg/tools/send_file_test.go | 8 ++ 14 files changed, 321 insertions(+), 39 deletions(-) diff --git a/pkg/channels/discord/discord.go b/pkg/channels/discord/discord.go index 83a04907c..297bfe89f 100644 --- a/pkg/channels/discord/discord.go +++ b/pkg/channels/discord/discord.go @@ -396,8 +396,9 @@ func (c *DiscordChannel) handleMessage(s *discordgo.Session, m *discordgo.Messag storeMedia := func(localPath, filename string) string { if store := c.GetMediaStore(); store != nil { ref, err := store.Store(localPath, media.MediaMeta{ - Filename: filename, - Source: "discord", + Filename: filename, + Source: "discord", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, scope) if err == nil { return ref diff --git a/pkg/channels/feishu/feishu_64.go b/pkg/channels/feishu/feishu_64.go index 37a74718a..abc9291f6 100644 --- a/pkg/channels/feishu/feishu_64.go +++ b/pkg/channels/feishu/feishu_64.go @@ -725,8 +725,9 @@ func (c *FeishuChannel) downloadResource( out.Close() ref, err := store.Store(localPath, media.MediaMeta{ - Filename: filename, - Source: "feishu", + Filename: filename, + Source: "feishu", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, scope) if err != nil { logger.ErrorCF("feishu", "Failed to store downloaded resource", map[string]any{ diff --git a/pkg/channels/line/line.go b/pkg/channels/line/line.go index 56ba02183..b2cdb6267 100644 --- a/pkg/channels/line/line.go +++ b/pkg/channels/line/line.go @@ -301,8 +301,9 @@ func (c *LINEChannel) processEvent(event lineEvent) { storeMedia := func(localPath, filename string) string { if store := c.GetMediaStore(); store != nil { ref, err := store.Store(localPath, media.MediaMeta{ - Filename: filename, - Source: "line", + Filename: filename, + Source: "line", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, scope) if err == nil { return ref diff --git a/pkg/channels/matrix/matrix.go b/pkg/channels/matrix/matrix.go index 4cbe95c5c..fa16dd414 100644 --- a/pkg/channels/matrix/matrix.go +++ b/pkg/channels/matrix/matrix.go @@ -692,6 +692,9 @@ func (c *MatrixChannel) extractInboundMedia( func (c *MatrixChannel) storeMedia(localPath string, meta media.MediaMeta, scope string) string { if store := c.GetMediaStore(); store != nil { + if meta.CleanupPolicy == "" { + meta.CleanupPolicy = media.CleanupPolicyDeleteOnCleanup + } ref, err := store.Store(localPath, meta, scope) if err == nil { return ref diff --git a/pkg/channels/onebot/onebot.go b/pkg/channels/onebot/onebot.go index 62a9eb34a..b4bd1970c 100644 --- a/pkg/channels/onebot/onebot.go +++ b/pkg/channels/onebot/onebot.go @@ -749,8 +749,9 @@ func (c *OneBotChannel) parseMessageSegments( storeFile := func(localPath, filename string) string { if store != nil { ref, err := store.Store(localPath, media.MediaMeta{ - Filename: filename, - Source: "onebot", + Filename: filename, + Source: "onebot", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, scope) if err == nil { return ref diff --git a/pkg/channels/qq/qq.go b/pkg/channels/qq/qq.go index 2cd6e1747..9daf24f93 100644 --- a/pkg/channels/qq/qq.go +++ b/pkg/channels/qq/qq.go @@ -719,9 +719,10 @@ func (c *QQChannel) extractInboundAttachments( storeMedia := func(localPath string, attachment *dto.MessageAttachment) string { if store := c.GetMediaStore(); store != nil { ref, err := store.Store(localPath, media.MediaMeta{ - Filename: qqAttachmentFilename(attachment), - ContentType: attachment.ContentType, - Source: "qq", + Filename: qqAttachmentFilename(attachment), + ContentType: attachment.ContentType, + Source: "qq", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, scope) if err == nil { return ref diff --git a/pkg/channels/slack/slack.go b/pkg/channels/slack/slack.go index 3ee849621..f12c74cd7 100644 --- a/pkg/channels/slack/slack.go +++ b/pkg/channels/slack/slack.go @@ -327,8 +327,9 @@ func (c *SlackChannel) handleMessageEvent(ev *slackevents.MessageEvent) { storeMedia := func(localPath, filename string) string { if store := c.GetMediaStore(); store != nil { ref, err := store.Store(localPath, media.MediaMeta{ - Filename: filename, - Source: "slack", + Filename: filename, + Source: "slack", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, scope) if err == nil { return ref diff --git a/pkg/channels/telegram/telegram.go b/pkg/channels/telegram/telegram.go index 3eb89c636..18b034213 100644 --- a/pkg/channels/telegram/telegram.go +++ b/pkg/channels/telegram/telegram.go @@ -561,8 +561,9 @@ func (c *TelegramChannel) handleMessage(ctx context.Context, message *telego.Mes storeMedia := func(localPath, filename string) string { if store := c.GetMediaStore(); store != nil { ref, err := store.Store(localPath, media.MediaMeta{ - Filename: filename, - Source: "telegram", + Filename: filename, + Source: "telegram", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, scope) if err == nil { return ref diff --git a/pkg/channels/wecom/aibot_ws.go b/pkg/channels/wecom/aibot_ws.go index 830e763b9..feecd1f4b 100644 --- a/pkg/channels/wecom/aibot_ws.go +++ b/pkg/channels/wecom/aibot_ws.go @@ -1218,8 +1218,9 @@ func (c *WeComAIBotWSChannel) storeWSMedia( scope := channels.BuildMediaScope("wecom_aibot", chatID, msgID) ref, err := store.Store(tmpPath, media.MediaMeta{ - Filename: msgID + ext, - Source: "wecom_aibot", + Filename: msgID + ext, + Source: "wecom_aibot", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, scope) if err != nil { os.Remove(tmpPath) diff --git a/pkg/channels/weixin/media.go b/pkg/channels/weixin/media.go index 0332f48f6..72af27438 100644 --- a/pkg/channels/weixin/media.go +++ b/pkg/channels/weixin/media.go @@ -291,9 +291,10 @@ func (c *WeixinChannel) storeInboundBytes( return "", err } ref, err := store.Store(tmpPath, media.MediaMeta{ - Filename: filename, - ContentType: contentType, - Source: "weixin", + Filename: filename, + ContentType: contentType, + Source: "weixin", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, }, basechannels.BuildMediaScope("weixin", chatID, messageID)) if err != nil { os.Remove(tmpPath) diff --git a/pkg/media/store.go b/pkg/media/store.go index 30220986c..78cff8bb6 100644 --- a/pkg/media/store.go +++ b/pkg/media/store.go @@ -11,11 +11,25 @@ import ( "github.com/sipeed/picoclaw/pkg/logger" ) +// CleanupPolicy controls how the MediaStore treats the underlying file when +// a ref is released or expires. +type CleanupPolicy string + +const ( + // CleanupPolicyDeleteOnCleanup means the file is store-managed and may be + // deleted once the final ref for that path is gone. + CleanupPolicyDeleteOnCleanup CleanupPolicy = "delete_on_cleanup" + // CleanupPolicyForgetOnly means the store should only drop ref mappings and + // must never delete the underlying file. + CleanupPolicyForgetOnly CleanupPolicy = "forget_only" +) + // MediaMeta holds metadata about a stored media file. type MediaMeta struct { - Filename string - ContentType string - Source string // "telegram", "discord", "tool:image-gen", etc. + Filename string + ContentType string + Source string // "telegram", "discord", "tool:image-gen", etc. + CleanupPolicy CleanupPolicy // defaults to CleanupPolicyDeleteOnCleanup } // MediaStore manages the lifecycle of media files associated with processing scopes. @@ -23,6 +37,7 @@ type MediaStore interface { // Store registers an existing local file under the given scope. // Returns a ref identifier (e.g. "media://"). // Store does not move or copy the file; it only records the mapping. + // If meta.CleanupPolicy is empty, CleanupPolicyDeleteOnCleanup is assumed. Store(localPath string, meta MediaMeta, scope string) (ref string, err error) // Resolve returns the local file path for a given ref. @@ -43,6 +58,11 @@ type mediaEntry struct { storedAt time.Time } +type pathRefState struct { + refCount int + deleteEligible bool +} + // MediaCleanerConfig configures the background TTL cleanup. type MediaCleanerConfig struct { Enabled bool @@ -57,6 +77,8 @@ type FileMediaStore struct { refs map[string]mediaEntry scopeToRefs map[string]map[string]struct{} refToScope map[string]string + refToPath map[string]string + pathStates map[string]pathRefState cleanerCfg MediaCleanerConfig stop chan struct{} @@ -71,6 +93,8 @@ func NewFileMediaStore() *FileMediaStore { refs: make(map[string]mediaEntry), scopeToRefs: make(map[string]map[string]struct{}), refToScope: make(map[string]string), + refToPath: make(map[string]string), + pathStates: make(map[string]pathRefState), nowFunc: time.Now, } } @@ -81,6 +105,8 @@ func NewFileMediaStoreWithCleanup(cfg MediaCleanerConfig) *FileMediaStore { refs: make(map[string]mediaEntry), scopeToRefs: make(map[string]map[string]struct{}), refToScope: make(map[string]string), + refToPath: make(map[string]string), + pathStates: make(map[string]pathRefState), cleanerCfg: cfg, stop: make(chan struct{}), nowFunc: time.Now, @@ -94,6 +120,7 @@ func (s *FileMediaStore) Store(localPath string, meta MediaMeta, scope string) ( } ref := "media://" + uuid.New().String() + meta.CleanupPolicy = normalizeCleanupPolicy(meta.CleanupPolicy) s.mu.Lock() defer s.mu.Unlock() @@ -104,6 +131,18 @@ func (s *FileMediaStore) Store(localPath string, meta MediaMeta, scope string) ( } s.scopeToRefs[scope][ref] = struct{}{} s.refToScope[ref] = scope + s.refToPath[ref] = localPath + + pathState := s.pathStates[localPath] + if pathState.refCount == 0 { + pathState.deleteEligible = meta.CleanupPolicy == CleanupPolicyDeleteOnCleanup + } else if meta.CleanupPolicy == CleanupPolicyForgetOnly { + // Be conservative: once a path is borrowed externally, never let this + // lifecycle auto-delete it even if store-managed refs also exist. + pathState.deleteEligible = false + } + pathState.refCount++ + s.pathStates[localPath] = pathState return ref, nil } @@ -134,7 +173,8 @@ func (s *FileMediaStore) ResolveWithMeta(ref string) (string, MediaMeta, error) // ReleaseAll removes all files under the given scope and cleans up mappings. // Phase 1 (under lock): remove entries from maps. -// Phase 2 (no lock): delete files from disk. +// Phase 2 (no lock): delete store-managed files from disk once their final +// path ref is gone. func (s *FileMediaStore) ReleaseAll(scope string) error { // Phase 1: collect paths and remove from maps under lock var paths []string @@ -147,11 +187,13 @@ func (s *FileMediaStore) ReleaseAll(scope string) error { } for ref := range refs { + fallbackPath := "" if entry, exists := s.refs[ref]; exists { - paths = append(paths, entry.path) + fallbackPath = entry.path + } + if removablePath, shouldDelete := s.releaseRefLocked(ref, fallbackPath); shouldDelete { + paths = append(paths, removablePath) } - delete(s.refs, ref) - delete(s.refToScope, ref) } delete(s.scopeToRefs, scope) s.mu.Unlock() @@ -171,7 +213,7 @@ func (s *FileMediaStore) ReleaseAll(scope string) error { // CleanExpired removes all entries older than MaxAge. // Phase 1 (under lock): identify expired entries and remove from maps. -// Phase 2 (no lock): delete files from disk to minimize lock contention. +// Phase 2 (no lock): delete store-managed files from disk to minimize lock contention. func (s *FileMediaStore) CleanExpired() int { if s.cleanerCfg.MaxAge <= 0 { return 0 @@ -179,8 +221,8 @@ func (s *FileMediaStore) CleanExpired() int { // Phase 1: collect expired entries under lock type expiredEntry struct { - ref string - path string + ref string + deletePath string } s.mu.Lock() @@ -189,8 +231,6 @@ func (s *FileMediaStore) CleanExpired() int { for ref, entry := range s.refs { if entry.storedAt.Before(cutoff) { - expired = append(expired, expiredEntry{ref: ref, path: entry.path}) - if scope, ok := s.refToScope[ref]; ok { if scopeRefs, ok := s.scopeToRefs[scope]; ok { delete(scopeRefs, ref) @@ -200,17 +240,23 @@ func (s *FileMediaStore) CleanExpired() int { } } - delete(s.refs, ref) - delete(s.refToScope, ref) + expiredItem := expiredEntry{ref: ref} + if deletePath, shouldDelete := s.releaseRefLocked(ref, entry.path); shouldDelete { + expiredItem.deletePath = deletePath + } + expired = append(expired, expiredItem) } } s.mu.Unlock() // Phase 2: delete files without holding the lock for _, e := range expired { - if err := os.Remove(e.path); err != nil && !os.IsNotExist(err) { + if e.deletePath == "" { + continue + } + if err := os.Remove(e.deletePath); err != nil && !os.IsNotExist(err) { logger.WarnCF("media", "cleanup: failed to remove file", map[string]any{ - "path": e.path, + "path": e.deletePath, "error": err.Error(), }) } @@ -219,6 +265,45 @@ func (s *FileMediaStore) CleanExpired() int { return len(expired) } +func normalizeCleanupPolicy(policy CleanupPolicy) CleanupPolicy { + switch policy { + case "", CleanupPolicyDeleteOnCleanup: + return CleanupPolicyDeleteOnCleanup + case CleanupPolicyForgetOnly: + return CleanupPolicyForgetOnly + default: + return CleanupPolicyDeleteOnCleanup + } +} + +func (s *FileMediaStore) releaseRefLocked(ref, fallbackPath string) (string, bool) { + path := fallbackPath + if storedPath, ok := s.refToPath[ref]; ok { + path = storedPath + delete(s.refToPath, ref) + } + + delete(s.refs, ref) + delete(s.refToScope, ref) + + if path == "" { + return "", false + } + + pathState, ok := s.pathStates[path] + if !ok { + return "", false + } + if pathState.refCount <= 1 { + delete(s.pathStates, path) + return path, pathState.deleteEligible + } + + pathState.refCount-- + s.pathStates[path] = pathState + return "", false +} + // Start begins the background cleanup goroutine if cleanup is enabled. // Safe to call multiple times; only the first call starts the goroutine. func (s *FileMediaStore) Start() { diff --git a/pkg/media/store_test.go b/pkg/media/store_test.go index 1dcfdf350..dabcc3142 100644 --- a/pkg/media/store_test.go +++ b/pkg/media/store_test.go @@ -77,6 +77,106 @@ func TestReleaseAll(t *testing.T) { } } +func TestReleaseAllForgetOnlyKeepsFile(t *testing.T) { + dir := t.TempDir() + store := NewFileMediaStore() + + path := createTempFile(t, dir, "workspace.txt") + ref, err := store.Store(path, MediaMeta{ + Source: "test", + CleanupPolicy: CleanupPolicyForgetOnly, + }, "scope1") + if err != nil { + t.Fatalf("Store failed: %v", err) + } + + if err := store.ReleaseAll("scope1"); err != nil { + t.Fatalf("ReleaseAll failed: %v", err) + } + + if _, err := store.Resolve(ref); err == nil { + t.Error("forget-only ref should be unresolvable after release") + } + if _, err := os.Stat(path); err != nil { + t.Errorf("forget-only file should remain on disk: %v", err) + } +} + +func TestReleaseAllSharedPathDeletesOnFinalRefOnly(t *testing.T) { + dir := t.TempDir() + store := NewFileMediaStore() + + path := createTempFile(t, dir, "shared.jpg") + refA, err := store.Store(path, MediaMeta{ + Source: "test", + CleanupPolicy: CleanupPolicyDeleteOnCleanup, + }, "scopeA") + if err != nil { + t.Fatalf("Store(scopeA) failed: %v", err) + } + refB, err := store.Store(path, MediaMeta{ + Source: "test", + CleanupPolicy: CleanupPolicyDeleteOnCleanup, + }, "scopeB") + if err != nil { + t.Fatalf("Store(scopeB) failed: %v", err) + } + + if err := store.ReleaseAll("scopeA"); err != nil { + t.Fatalf("ReleaseAll(scopeA) failed: %v", err) + } + + if _, err := store.Resolve(refA); err == nil { + t.Error("refA should be unresolvable after ReleaseAll(scopeA)") + } + if _, err := store.Resolve(refB); err != nil { + t.Fatalf("refB should still resolve: %v", err) + } + if _, err := os.Stat(path); err != nil { + t.Errorf("shared file should remain until final ref is released: %v", err) + } + + if err := store.ReleaseAll("scopeB"); err != nil { + t.Fatalf("ReleaseAll(scopeB) failed: %v", err) + } + if _, err := os.Stat(path); !os.IsNotExist(err) { + t.Error("shared file should be deleted after final ref is released") + } +} + +func TestReleaseAllMixedPoliciesKeepsFile(t *testing.T) { + dir := t.TempDir() + store := NewFileMediaStore() + + path := createTempFile(t, dir, "shared.txt") + if _, err := store.Store(path, MediaMeta{ + Source: "test", + CleanupPolicy: CleanupPolicyDeleteOnCleanup, + }, "owned"); err != nil { + t.Fatalf("Store(owned) failed: %v", err) + } + if _, err := store.Store(path, MediaMeta{ + Source: "test", + CleanupPolicy: CleanupPolicyForgetOnly, + }, "borrowed"); err != nil { + t.Fatalf("Store(borrowed) failed: %v", err) + } + + if err := store.ReleaseAll("owned"); err != nil { + t.Fatalf("ReleaseAll(owned) failed: %v", err) + } + if _, err := os.Stat(path); err != nil { + t.Fatalf("mixed-policy file should remain after owned ref release: %v", err) + } + + if err := store.ReleaseAll("borrowed"); err != nil { + t.Fatalf("ReleaseAll(borrowed) failed: %v", err) + } + if _, err := os.Stat(path); err != nil { + t.Errorf("mixed-policy path should not be auto-deleted: %v", err) + } +} + func TestMultiScopeIsolation(t *testing.T) { dir := t.TempDir() store := NewFileMediaStore() @@ -293,6 +393,35 @@ func TestCleanExpiredRemovesOldEntries(t *testing.T) { } } +func TestCleanExpiredForgetOnlyKeepsFile(t *testing.T) { + dir := t.TempDir() + now := time.Now() + store := newTestStoreWithCleanup(10 * time.Minute) + store.nowFunc = func() time.Time { return now.Add(-20 * time.Minute) } + + path := createTempFile(t, dir, "workspace.txt") + ref, err := store.Store(path, MediaMeta{ + Source: "test", + CleanupPolicy: CleanupPolicyForgetOnly, + }, "scope1") + if err != nil { + t.Fatalf("Store failed: %v", err) + } + + store.nowFunc = func() time.Time { return now } + removed := store.CleanExpired() + + if removed != 1 { + t.Errorf("expected 1 removed, got %d", removed) + } + if _, err := store.Resolve(ref); err == nil { + t.Error("expired forget-only ref should be unresolvable") + } + if _, err := os.Stat(path); err != nil { + t.Errorf("forget-only file should remain on disk: %v", err) + } +} + func TestCleanExpiredKeepsNonExpired(t *testing.T) { dir := t.TempDir() now := time.Now() @@ -346,6 +475,53 @@ func TestCleanExpiredMixedAges(t *testing.T) { } } +func TestCleanExpiredSharedPathDeletesOnFinalRefOnly(t *testing.T) { + dir := t.TempDir() + now := time.Now() + store := newTestStoreWithCleanup(10 * time.Minute) + + path := createTempFile(t, dir, "shared.jpg") + + store.nowFunc = func() time.Time { return now.Add(-20 * time.Minute) } + oldRef, err := store.Store(path, MediaMeta{ + Source: "test", + CleanupPolicy: CleanupPolicyDeleteOnCleanup, + }, "scope-old") + if err != nil { + t.Fatalf("Store(old) failed: %v", err) + } + + store.nowFunc = func() time.Time { return now } + freshRef, err := store.Store(path, MediaMeta{ + Source: "test", + CleanupPolicy: CleanupPolicyDeleteOnCleanup, + }, "scope-fresh") + if err != nil { + t.Fatalf("Store(fresh) failed: %v", err) + } + + removed := store.CleanExpired() + if removed != 1 { + t.Errorf("expected 1 removed, got %d", removed) + } + if _, err := store.Resolve(oldRef); err == nil { + t.Error("old ref should be gone after cleanup") + } + if _, err := store.Resolve(freshRef); err != nil { + t.Fatalf("fresh ref should still resolve: %v", err) + } + if _, err := os.Stat(path); err != nil { + t.Errorf("shared file should remain while fresh ref exists: %v", err) + } + + if err := store.ReleaseAll("scope-fresh"); err != nil { + t.Fatalf("ReleaseAll(scope-fresh) failed: %v", err) + } + if _, err := os.Stat(path); !os.IsNotExist(err) { + t.Error("shared file should be deleted after final ref is released") + } +} + func TestCleanExpiredCleansEmptyScopes(t *testing.T) { dir := t.TempDir() now := time.Now() diff --git a/pkg/tools/send_file.go b/pkg/tools/send_file.go index a67bd4210..57b99a845 100644 --- a/pkg/tools/send_file.go +++ b/pkg/tools/send_file.go @@ -133,9 +133,10 @@ func (t *SendFileTool) Execute(ctx context.Context, args map[string]any) *ToolRe scope := fmt.Sprintf("tool:send_file:%s:%s", channel, chatID) ref, err := t.mediaStore.Store(resolved, media.MediaMeta{ - Filename: filename, - ContentType: mediaType, - Source: "tool:send_file", + Filename: filename, + ContentType: mediaType, + Source: "tool:send_file", + CleanupPolicy: media.CleanupPolicyForgetOnly, }, scope) if err != nil { return ErrorResult(fmt.Sprintf("failed to register media: %v", err)) diff --git a/pkg/tools/send_file_test.go b/pkg/tools/send_file_test.go index 6daaab31c..0a99e8028 100644 --- a/pkg/tools/send_file_test.go +++ b/pkg/tools/send_file_test.go @@ -104,6 +104,14 @@ func TestSendFileTool_Success(t *testing.T) { if result.Media[0][:8] != "media://" { t.Errorf("expected media:// ref, got %q", result.Media[0]) } + + _, meta, err := store.ResolveWithMeta(result.Media[0]) + if err != nil { + t.Fatalf("ResolveWithMeta failed: %v", err) + } + if meta.CleanupPolicy != media.CleanupPolicyForgetOnly { + t.Errorf("CleanupPolicy = %q, want %q", meta.CleanupPolicy, media.CleanupPolicyForgetOnly) + } } func TestSendFileTool_CustomFilename(t *testing.T) { From 40279c8dde65757973aa9ae9472c9c28986e94a2 Mon Sep 17 00:00:00 2001 From: Kunal Karmakar <5303824+kunalk16@users.noreply.github.com> Date: Mon, 23 Mar 2026 10:44:53 +0530 Subject: [PATCH 027/202] chore(config): move loglevel settings under gateway (#1912) * Move log level config to gateway property * Fix unit test * Fix linting * Fix linting * Add comment for log level --- cmd/picoclaw/internal/helpers.go | 2 +- config/config.example.json | 5 +++-- pkg/config/config.go | 8 ++++---- pkg/config/config_test.go | 14 +++++++------- pkg/config/defaults.go | 2 +- pkg/gateway/gateway.go | 2 +- 6 files changed, 17 insertions(+), 16 deletions(-) diff --git a/cmd/picoclaw/internal/helpers.go b/cmd/picoclaw/internal/helpers.go index ae1d58c29..0f45e7425 100644 --- a/cmd/picoclaw/internal/helpers.go +++ b/cmd/picoclaw/internal/helpers.go @@ -32,7 +32,7 @@ func LoadConfig() (*config.Config, error) { if err != nil { return nil, err } - logger.SetLevelFromString(cfg.Agents.Defaults.LogLevel) + logger.SetLevelFromString(cfg.Gateway.LogLevel) return cfg, nil } diff --git a/config/config.example.json b/config/config.example.json index 29655b594..88578701a 100644 --- a/config/config.example.json +++ b/config/config.example.json @@ -1,7 +1,6 @@ { "agents": { "defaults": { - "log_level": "fatal", "workspace": "~/.picoclaw/workspace", "restrict_to_workspace": true, "model_name": "gpt-5.4", @@ -560,8 +559,10 @@ } }, "gateway": { + "_comment": "Default log level is set to 'fatal'. Other available options are 'debug', 'info', 'warn' and 'error'.", "host": "127.0.0.1", "port": 18790, - "hot_reload": false + "hot_reload": false, + "log_level": "fatal" } } diff --git a/pkg/config/config.go b/pkg/config/config.go index cbed31ded..070e8e499 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -285,7 +285,6 @@ type AgentDefaults struct { SteeringMode string `json:"steering_mode,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_STEERING_MODE"` // "one-at-a-time" (default) or "all" SubTurn SubTurnConfig `json:"subturn" envPrefix:"PICOCLAW_AGENTS_DEFAULTS_SUBTURN_"` ToolFeedback ToolFeedbackConfig `json:"tool_feedback,omitempty"` - LogLevel string `json:"log_level,omitempty" env:"PICOCLAW_LOG_LEVEL"` } const ( @@ -733,9 +732,10 @@ func (c *ModelConfig) Validate() error { } type GatewayConfig struct { - Host string `json:"host" env:"PICOCLAW_GATEWAY_HOST"` - Port int `json:"port" env:"PICOCLAW_GATEWAY_PORT"` - HotReload bool `json:"hot_reload" env:"PICOCLAW_GATEWAY_HOT_RELOAD"` + Host string `json:"host" env:"PICOCLAW_GATEWAY_HOST"` + Port int `json:"port" env:"PICOCLAW_GATEWAY_PORT"` + HotReload bool `json:"hot_reload" env:"PICOCLAW_GATEWAY_HOT_RELOAD"` + LogLevel string `json:"log_level,omitempty" env:"PICOCLAW_LOG_LEVEL"` } type ToolDiscoveryConfig struct { diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 88ab1ed51..f1e94afbc 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -488,8 +488,8 @@ func TestDefaultConfig_HooksDefaults(t *testing.T) { func TestDefaultConfig_LogLevel(t *testing.T) { cfg := DefaultConfig() - if cfg.Agents.Defaults.LogLevel != "fatal" { - t.Errorf("LogLevel = %q, want \"fatal\"", cfg.Agents.Defaults.LogLevel) + if cfg.Gateway.LogLevel != "fatal" { + t.Errorf("LogLevel = %q, want \"fatal\"", cfg.Gateway.LogLevel) } } @@ -1166,7 +1166,7 @@ func TestLoadConfig_UsesPassphraseProvider(t *testing.T) { func TestConfigParsesLogLevel(t *testing.T) { dir := t.TempDir() cfgPath := filepath.Join(dir, "config.json") - data := `{"agents":{"defaults":{"log_level":"debug"}}}` + data := `{"gateway":{"log_level":"debug"}}` if err := os.WriteFile(cfgPath, []byte(data), 0o600); err != nil { t.Fatalf("setup: %v", err) } @@ -1175,8 +1175,8 @@ func TestConfigParsesLogLevel(t *testing.T) { if err != nil { t.Fatalf("LoadConfig: %v", err) } - if cfg.Agents.Defaults.LogLevel != "debug" { - t.Errorf("LogLevel = %q, want \"debug\"", cfg.Agents.Defaults.LogLevel) + if cfg.Gateway.LogLevel != "debug" { + t.Errorf("LogLevel = %q, want \"debug\"", cfg.Gateway.LogLevel) } } @@ -1193,7 +1193,7 @@ func TestConfigLogLevelEmpty(t *testing.T) { t.Fatalf("LoadConfig: %v", err) } // When config omits log_level, the DefaultConfig value ("fatal") is preserved. - if cfg.Agents.Defaults.LogLevel != "fatal" { - t.Errorf("LogLevel = %q, want \"fatal\"", cfg.Agents.Defaults.LogLevel) + if cfg.Gateway.LogLevel != "fatal" { + t.Errorf("LogLevel = %q, want \"fatal\"", cfg.Gateway.LogLevel) } } diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 2ec2b249d..7c47c8474 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -26,7 +26,6 @@ func DefaultConfig() *Config { return &Config{ Agents: AgentsConfig{ Defaults: AgentDefaults{ - LogLevel: "fatal", Workspace: workspacePath, RestrictToWorkspace: true, Provider: "", @@ -424,6 +423,7 @@ func DefaultConfig() *Config { Host: "127.0.0.1", Port: 18790, HotReload: false, + LogLevel: "fatal", }, Tools: ToolsConfig{ MediaCleanup: MediaCleanupConfig{ diff --git a/pkg/gateway/gateway.go b/pkg/gateway/gateway.go index 92bef6c15..7f920a6f1 100644 --- a/pkg/gateway/gateway.go +++ b/pkg/gateway/gateway.go @@ -85,7 +85,7 @@ func Run(debug bool, configPath string, allowEmptyStartup bool) error { return fmt.Errorf("error loading config: %w", err) } - logger.SetLevelFromString(cfg.Agents.Defaults.LogLevel) + logger.SetLevelFromString(cfg.Gateway.LogLevel) if debug { logger.SetLevel(logger.DEBUG) From d014f3e989f82f292419edacaee622ddf189d1b0 Mon Sep 17 00:00:00 2001 From: xiwuqi <64734786+xiwuqi@users.noreply.github.com> Date: Mon, 23 Mar 2026 00:41:40 -0500 Subject: [PATCH 028/202] fix(api): include auth header in local model probe (#1896) --- web/backend/api/gateway_test.go | 8 +++--- web/backend/api/model_status.go | 15 ++++++----- web/backend/api/model_status_test.go | 37 ++++++++++++++++++++++++++++ web/backend/api/models_test.go | 20 +++++++-------- 4 files changed, 60 insertions(+), 20 deletions(-) create mode 100644 web/backend/api/model_status_test.go diff --git a/web/backend/api/gateway_test.go b/web/backend/api/gateway_test.go index 504d091af..387c5ac53 100644 --- a/web/backend/api/gateway_test.go +++ b/web/backend/api/gateway_test.go @@ -169,7 +169,7 @@ func TestGatewayStartReady_LocalModelWithoutAPIKey(t *testing.T) { defer cleanup() resetModelProbeHooks(t) - probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + probeOpenAICompatibleModelFunc = func(apiBase, modelID, apiKey string) bool { return false } @@ -206,8 +206,8 @@ func TestGatewayStartReady_LocalModelWithRunningService(t *testing.T) { defer cleanup() resetModelProbeHooks(t) - probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { - return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + probeOpenAICompatibleModelFunc = func(apiBase, modelID, apiKey string) bool { + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" && apiKey == "" } cfg, err := config.LoadConfig(configPath) @@ -240,7 +240,7 @@ func TestGatewayStartReady_RemoteVLLMWithAPIKeyDoesNotProbe(t *testing.T) { defer cleanup() resetModelProbeHooks(t) - probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + probeOpenAICompatibleModelFunc = func(apiBase, modelID, apiKey string) bool { t.Fatalf("unexpected OpenAI-compatible probe for %q (%q)", apiBase, modelID) return false } diff --git a/web/backend/api/model_status.go b/web/backend/api/model_status.go index 22bf5c15b..b56fe5f39 100644 --- a/web/backend/api/model_status.go +++ b/web/backend/api/model_status.go @@ -82,14 +82,14 @@ func probeLocalModelAvailability(m config.ModelConfig) bool { case "ollama": return probeOllamaModelFunc(apiBase, modelID) case "vllm": - return probeOpenAICompatibleModelFunc(apiBase, modelID) + return probeOpenAICompatibleModelFunc(apiBase, modelID, m.APIKey) case "github-copilot", "copilot": return probeTCPServiceFunc(apiBase) case "claude-cli", "claudecli", "codex-cli", "codexcli": return true default: if hasLocalAPIBase(apiBase) { - return probeOpenAICompatibleModelFunc(apiBase, modelID) + return probeOpenAICompatibleModelFunc(apiBase, modelID, m.APIKey) } return false } @@ -209,7 +209,7 @@ func probeOllamaModel(apiBase, modelID string) bool { Model string `json:"model"` } `json:"models"` } - if err := getJSON(root+"/api/tags", &resp); err != nil { + if err := getJSON(root+"/api/tags", &resp, ""); err != nil { return false } @@ -221,7 +221,7 @@ func probeOllamaModel(apiBase, modelID string) bool { return false } -func probeOpenAICompatibleModel(apiBase, modelID string) bool { +func probeOpenAICompatibleModel(apiBase, modelID, apiKey string) bool { if strings.TrimSpace(apiBase) == "" { return false } @@ -231,7 +231,7 @@ func probeOpenAICompatibleModel(apiBase, modelID string) bool { ID string `json:"id"` } `json:"data"` } - if err := getJSON(strings.TrimRight(strings.TrimSpace(apiBase), "/")+"/models", &resp); err != nil { + if err := getJSON(strings.TrimRight(strings.TrimSpace(apiBase), "/")+"/models", &resp, apiKey); err != nil { return false } @@ -243,11 +243,14 @@ func probeOpenAICompatibleModel(apiBase, modelID string) bool { return false } -func getJSON(rawURL string, out any) error { +func getJSON(rawURL string, out any, apiKey string) error { req, err := http.NewRequest(http.MethodGet, rawURL, nil) if err != nil { return err } + if apiKey = strings.TrimSpace(apiKey); apiKey != "" { + req.Header.Set("Authorization", "Bearer "+apiKey) + } client := &http.Client{Timeout: modelProbeTimeout} resp, err := client.Do(req) diff --git a/web/backend/api/model_status_test.go b/web/backend/api/model_status_test.go new file mode 100644 index 000000000..047af7a4d --- /dev/null +++ b/web/backend/api/model_status_test.go @@ -0,0 +1,37 @@ +package api + +import ( + "net/http" + "net/http/httptest" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestProbeLocalModelAvailability_OpenAICompatibleIncludesAPIKey(t *testing.T) { + const apiKey = "test-api-key" + + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/v1/models" { + t.Fatalf("path = %q, want %q", r.URL.Path, "/v1/models") + } + if got := r.Header.Get("Authorization"); got != "Bearer "+apiKey { + http.Error(w, "missing auth", http.StatusUnauthorized) + return + } + + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"data":[{"id":"custom-model"}]}`)) + })) + defer srv.Close() + + model := config.ModelConfig{ + Model: "openai/custom-model", + APIBase: srv.URL + "/v1", + APIKey: apiKey, + } + + if !probeLocalModelAvailability(model) { + t.Fatal("probeLocalModelAvailability() = false, want true when api_key is configured") + } +} diff --git a/web/backend/api/models_test.go b/web/backend/api/models_test.go index 2377b5b66..1ec5fb8c9 100644 --- a/web/backend/api/models_test.go +++ b/web/backend/api/models_test.go @@ -36,11 +36,11 @@ func TestHandleListModels_ConfiguredStatusUsesRuntimeProbesForLocalModels(t *tes var ollamaProbes []string var tcpProbes []string - probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + probeOpenAICompatibleModelFunc = func(apiBase, modelID, apiKey string) bool { mu.Lock() - openAIProbes = append(openAIProbes, apiBase+"|"+modelID) + openAIProbes = append(openAIProbes, apiBase+"|"+modelID+"|"+apiKey) mu.Unlock() - return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" && apiKey == "" } probeOllamaModelFunc = func(apiBase, modelID string) bool { mu.Lock() @@ -131,7 +131,7 @@ func TestHandleListModels_ConfiguredStatusUsesRuntimeProbesForLocalModels(t *tes if !got["copilot-gpt-5.4"] { t.Fatalf("copilot model configured = false, want true when local bridge probe succeeds") } - if len(openAIProbes) != 1 || openAIProbes[0] != "http://127.0.0.1:8000/v1|custom-model" { + if len(openAIProbes) != 1 || openAIProbes[0] != "http://127.0.0.1:8000/v1|custom-model|" { t.Fatalf("openAI probes = %#v, want only local vllm probe", openAIProbes) } if len(ollamaProbes) != 1 || ollamaProbes[0] != "http://localhost:11434/v1|llama3" { @@ -205,7 +205,7 @@ func TestHandleListModels_ProbesLocalModelsConcurrently(t *testing.T) { started := make(chan string, 2) release := make(chan struct{}) - probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + probeOpenAICompatibleModelFunc = func(apiBase, modelID, apiKey string) bool { started <- apiBase + "|" + modelID <-release return true @@ -265,9 +265,9 @@ func TestHandleListModels_NormalizesWildcardLocalAPIBaseForProbe(t *testing.T) { resetModelProbeHooks(t) var gotProbe string - probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { - gotProbe = apiBase + "|" + modelID - return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + probeOpenAICompatibleModelFunc = func(apiBase, modelID, apiKey string) bool { + gotProbe = apiBase + "|" + modelID + "|" + apiKey + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" && apiKey == "" } cfg, err := config.LoadConfig(configPath) @@ -307,7 +307,7 @@ func TestHandleListModels_NormalizesWildcardLocalAPIBaseForProbe(t *testing.T) { if !resp.Models[0].Configured { t.Fatal("wildcard-bound local model configured = false, want true after probe host normalization") } - if gotProbe != "http://127.0.0.1:8000/v1|custom-model" { - t.Fatalf("probe api base = %q, want %q", gotProbe, "http://127.0.0.1:8000/v1|custom-model") + if gotProbe != "http://127.0.0.1:8000/v1|custom-model|" { + t.Fatalf("probe api base = %q, want %q", gotProbe, "http://127.0.0.1:8000/v1|custom-model|") } } From df17684dd4bedb89a54b01a0dcd430670207ea54 Mon Sep 17 00:00:00 2001 From: Cytown Date: Mon, 23 Mar 2026 15:40:17 +0800 Subject: [PATCH 029/202] implement panic log for gateway and launcher add file logger to gateway ref issue: #1734 Signed-off-by: Cytown --- cmd/picoclaw/internal/gateway/command.go | 2 +- pkg/gateway/gateway.go | 18 +++++++++++- pkg/logger/panic.go | 36 ++++++++++++++++++++++++ pkg/logger/panic_unix.go | 21 ++++++++++++++ pkg/logger/panic_win.go | 25 ++++++++++++++++ pkg/logger/syscall_amd64.go | 12 ++++++++ pkg/logger/syscall_arm64.go | 12 ++++++++ pkg/logger/syscall_darwin.go | 12 ++++++++ pkg/logger/syscall_loong64.go | 12 ++++++++ web/backend/main.go | 20 +++++++++---- 10 files changed, 163 insertions(+), 7 deletions(-) create mode 100644 pkg/logger/panic.go create mode 100644 pkg/logger/panic_unix.go create mode 100644 pkg/logger/panic_win.go create mode 100644 pkg/logger/syscall_amd64.go create mode 100644 pkg/logger/syscall_arm64.go create mode 100644 pkg/logger/syscall_darwin.go create mode 100644 pkg/logger/syscall_loong64.go diff --git a/cmd/picoclaw/internal/gateway/command.go b/cmd/picoclaw/internal/gateway/command.go index 4812f1bee..7fa588c5c 100644 --- a/cmd/picoclaw/internal/gateway/command.go +++ b/cmd/picoclaw/internal/gateway/command.go @@ -34,7 +34,7 @@ func NewGatewayCommand() *cobra.Command { return nil }, RunE: func(_ *cobra.Command, _ []string) error { - return gateway.Run(debug, internal.GetConfigPath(), allowEmpty) + return gateway.Run(debug, internal.GetPicoclawHome(), internal.GetConfigPath(), allowEmpty) }, } diff --git a/pkg/gateway/gateway.go b/pkg/gateway/gateway.go index 454ee2c48..fc2465747 100644 --- a/pkg/gateway/gateway.go +++ b/pkg/gateway/gateway.go @@ -47,6 +47,10 @@ const ( serviceShutdownTimeout = 30 * time.Second providerReloadTimeout = 30 * time.Second gracefulShutdownTimeout = 15 * time.Second + + logPath = "logs" + panicFile = "gateway_panic.log" + logFile = "gateway.log" ) type services struct { @@ -79,7 +83,19 @@ func (p *startupBlockedProvider) GetDefaultModel() string { } // Run starts the gateway runtime using the configuration loaded from configPath. -func Run(debug bool, configPath string, allowEmptyStartup bool) error { +func Run(debug bool, homePath, configPath string, allowEmptyStartup bool) error { + panicPath := filepath.Join(homePath, logPath, panicFile) + panicFunc, err := logger.InitPanic(panicPath) + if err != nil { + return fmt.Errorf("error initializing panic log: %w", err) + } + defer panicFunc() + + if err = logger.EnableFileLogging(filepath.Join(homePath, logPath, logFile)); err != nil { + panic(fmt.Sprintf("error enabling file logging: %v", err)) + } + defer logger.DisableFileLogging() + cfg, err := config.LoadConfig(configPath) if err != nil { return fmt.Errorf("error loading config: %w", err) diff --git a/pkg/logger/panic.go b/pkg/logger/panic.go new file mode 100644 index 000000000..e53e4351a --- /dev/null +++ b/pkg/logger/panic.go @@ -0,0 +1,36 @@ +package logger + +import ( + "fmt" + "os" + "path/filepath" + "runtime/debug" + "time" +) + +func InitPanic(filePath string) (func(), error) { + if err := os.MkdirAll(filepath.Dir(filePath), 0o755); err != nil { + return nil, fmt.Errorf("failed to create log directory: %w", err) + } + writer := initPanicFile(filePath) + if writer == nil { + return nil, fmt.Errorf("failed to create log file: %s", filePath) + } + return func() { + defer writer.Close() + if err := recover(); err != nil { + now := time.Now().Format("2006-01-02 15:04:05") + stack := debug.Stack() + logMsg := "\n\n====================\n[" + now + "] PANIC OCCURRED: " + fmt.Sprintf( + "%v", + err, + ) + "\n" + string( + stack, + ) + + writer.Write([]byte(logMsg)) + + os.Exit(1) + } + }, nil +} diff --git a/pkg/logger/panic_unix.go b/pkg/logger/panic_unix.go new file mode 100644 index 000000000..1178f6a5a --- /dev/null +++ b/pkg/logger/panic_unix.go @@ -0,0 +1,21 @@ +//go:build !windows +// +build !windows + +package logger + +import ( + "fmt" + "io" + "os" +) + +func initPanicFile(panicFile string) io.WriteCloser { + file, err := os.OpenFile(panicFile, os.O_WRONLY|os.O_CREATE|os.O_APPEND|os.O_SYNC, 0o600) + if err != nil { + panic(fmt.Sprintf("error in open panic: %v", err)) + } + if err = Dup2(int(file.Fd()), int(os.Stderr.Fd())); err != nil { + panic(fmt.Sprintf("error in syscall.Dup2: %v", err)) + } + return file +} diff --git a/pkg/logger/panic_win.go b/pkg/logger/panic_win.go new file mode 100644 index 000000000..29d3f21d8 --- /dev/null +++ b/pkg/logger/panic_win.go @@ -0,0 +1,25 @@ +//go:build windows +// +build windows + +package logger + +import ( + "fmt" + "io" + "os" + + "golang.org/x/sys/windows" +) + +func initPanicFile(panicFile string) io.WriteCloser { + file, err := os.OpenFile(panicFile, os.O_WRONLY|os.O_CREATE|os.O_SYNC|os.O_APPEND, 0600) + if err != nil { + panic(fmt.Sprintf("error in open panic: %v", err)) + } + err = windows.SetStdHandle(windows.STD_ERROR_HANDLE, windows.Handle(file.Fd())) + if err != nil { + panic(fmt.Sprintf("Failed to redirect stderr to file: %v", err)) + } + os.Stderr = file + return file +} diff --git a/pkg/logger/syscall_amd64.go b/pkg/logger/syscall_amd64.go new file mode 100644 index 000000000..e862b4578 --- /dev/null +++ b/pkg/logger/syscall_amd64.go @@ -0,0 +1,12 @@ +//go:build linux && amd64 +// +build linux,amd64 + +package logger + +import ( + "syscall" +) + +func Dup2(oldfd int, newfd int) error { + return syscall.Dup2(oldfd, newfd) +} diff --git a/pkg/logger/syscall_arm64.go b/pkg/logger/syscall_arm64.go new file mode 100644 index 000000000..9854bc85e --- /dev/null +++ b/pkg/logger/syscall_arm64.go @@ -0,0 +1,12 @@ +//go:build linux && arm64 +// +build linux,arm64 + +package logger + +import ( + "syscall" +) + +func Dup2(oldfd int, newfd int) error { + return syscall.Dup3(oldfd, newfd, 0) +} diff --git a/pkg/logger/syscall_darwin.go b/pkg/logger/syscall_darwin.go new file mode 100644 index 000000000..80306b521 --- /dev/null +++ b/pkg/logger/syscall_darwin.go @@ -0,0 +1,12 @@ +//go:build darwin +// +build darwin + +package logger + +import ( + "syscall" +) + +func Dup2(oldfd int, newfd int) error { + return syscall.Dup2(oldfd, newfd) +} diff --git a/pkg/logger/syscall_loong64.go b/pkg/logger/syscall_loong64.go new file mode 100644 index 000000000..6f36d26a4 --- /dev/null +++ b/pkg/logger/syscall_loong64.go @@ -0,0 +1,12 @@ +//go:build linux && loong64 +// +build linux,loong64 + +package logger + +import ( + "syscall" +) + +func Dup2(oldfd int, newfd int) error { + return syscall.Dup3(oldfd, newfd, 0) +} diff --git a/web/backend/main.go b/web/backend/main.go index b1db3c57a..8183731fe 100644 --- a/web/backend/main.go +++ b/web/backend/main.go @@ -33,6 +33,10 @@ import ( const ( appName = "PicoClaw" + + logPath = "logs" + panicFile = "launcher_panic.log" + logFile = "launcher.log" ) var ( @@ -72,6 +76,14 @@ func main() { // Initialize logger picoHome := utils.GetPicoclawHome() + + f := filepath.Join(picoHome, logPath, panicFile) + panicFunc, err := logger.InitPanic(f) + if err != nil { + panic(fmt.Sprintf("error initializing panic log: %v", err)) + } + defer panicFunc() + // By default, detect terminal to decide console log behavior // If -console-logs flag is explicitly set, it overrides the detection enableConsole := *console @@ -79,11 +91,9 @@ func main() { // Disable console logging by setting level to Fatal (no output) logger.SetConsoleLevel(logger.FATAL) - logPath := filepath.Join(picoHome, "logs", "web.log") - if err := logger.EnableFileLogging(logPath); err != nil { - // FIXME: https://github.com/sipeed/picoclaw/issues/1734 - fmt.Fprintf(os.Stderr, "Failed to initialize logger: %v\n", err) - os.Exit(1) + f := filepath.Join(picoHome, logPath, logFile) + if err = logger.EnableFileLogging(f); err != nil { + panic(fmt.Sprintf("error enabling file logging: %v", err)) } defer logger.DisableFileLogging() } From 8a046e951a4ae0e2b1373b03de6bdca64414fa2f Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Sun, 22 Mar 2026 15:49:25 +0800 Subject: [PATCH 030/202] feat(providers): add extra_body config to inject custom fields into request body Allow configuring provider-specific fields like reasoning_split for minimax via the model config's extra_body map. These fields are merged into the request body last, giving them precedence over default values. Co-Authored-By: Claude Opus 4.6 --- pkg/config/config.go | 11 ++- pkg/config/config_test.go | 56 +++++++++++++ pkg/config/defaults.go | 1 + pkg/providers/factory_provider.go | 3 + pkg/providers/http_provider.go | 4 +- pkg/providers/openai_compat/provider.go | 13 +++ pkg/providers/openai_compat/provider_test.go | 84 ++++++++++++++++++++ web/backend/api/models.go | 17 ++-- web/frontend/src/api/models.ts | 1 + 9 files changed, 179 insertions(+), 11 deletions(-) diff --git a/pkg/config/config.go b/pkg/config/config.go index c56c2645e..4dd1f9609 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -936,10 +936,11 @@ type ModelConfig struct { Workspace string `json:"workspace,omitempty"` // Workspace path for CLI-based providers // Optional optimizations - RPM int `json:"rpm,omitempty"` // Requests per minute limit - MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") - RequestTimeout int `json:"request_timeout,omitempty"` - ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + RPM int `json:"rpm,omitempty"` // Requests per minute limit + MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") + RequestTimeout int `json:"request_timeout,omitempty"` + ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + ExtraBody map[string]any `json:"extra_body,omitempty"` // Additional fields to inject into request body // from security secModelName string @@ -2079,6 +2080,7 @@ func expandMultiKeyModels(models []*ModelConfig) []*ModelConfig { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, + ExtraBody: m.ExtraBody, } expanded = append(expanded, additionalEntry) fallbackNames = append(fallbackNames, expandedName) @@ -2097,6 +2099,7 @@ func expandMultiKeyModels(models []*ModelConfig) []*ModelConfig { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, + ExtraBody: m.ExtraBody, apiKeys: []string{keys[0]}, } diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index a4c207470..429930eda 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1193,3 +1193,59 @@ func TestConfigLogLevelEmpty(t *testing.T) { t.Errorf("LogLevel = %q, want \"fatal\"", cfg.Gateway.LogLevel) } } + +func TestDefaultConfig_MinimaxExtraBody(t *testing.T) { + cfg := DefaultConfig() + + var minimaxCfg *ModelConfig + for i := range cfg.ModelList { + if cfg.ModelList[i].Model == "minimax/MiniMax-M2.5" { + minimaxCfg = &cfg.ModelList[i] + break + } + } + if minimaxCfg == nil { + t.Fatal("Minimax model not found in ModelList") + } + if minimaxCfg.ExtraBody == nil { + t.Fatal("Minimax ExtraBody should not be nil") + } + if got, ok := minimaxCfg.ExtraBody["reasoning_split"]; !ok || got != true { + t.Fatalf("Minimax ExtraBody[reasoning_split] = %v, want true", got) + } +} + +func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + + cfg := &Config{ + ModelList: []ModelConfig{ + { + ModelName: "test-model", + Model: "openai/test", + APIKey: "sk-test", + ExtraBody: map[string]any{"custom_field": "value", "num_field": 42}, + }, + }, + } + + if err := SaveConfig(cfgPath, cfg); err != nil { + t.Fatalf("SaveConfig error: %v", err) + } + + loaded, err := LoadConfig(cfgPath) + if err != nil { + t.Fatalf("LoadConfig error: %v", err) + } + + if loaded.ModelList[0].ExtraBody == nil { + t.Fatal("ExtraBody should not be nil after round-trip") + } + if got := loaded.ModelList[0].ExtraBody["custom_field"]; got != "value" { + t.Errorf("ExtraBody[custom_field] = %v, want value", got) + } + if got := loaded.ModelList[0].ExtraBody["num_field"]; got != float64(42) { + t.Errorf("ExtraBody[num_field] = %v, want 42", got) + } +} diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 18e0bbfd4..2a086821a 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -339,6 +339,7 @@ func DefaultConfig() *Config { ModelName: "MiniMax-M2.5", Model: "minimax/MiniMax-M2.5", APIBase: "https://api.minimaxi.com/v1", + ExtraBody: map[string]any{"reasoning_split": true}, }, // LongCat - https://longcat.chat/platform diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index 8a18f8fe7..55d5fd10e 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -93,6 +93,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "azure", "azure-openai": @@ -132,6 +133,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "anthropic": @@ -157,6 +159,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "anthropic-messages": diff --git a/pkg/providers/http_provider.go b/pkg/providers/http_provider.go index 803165edb..f2ff52f1d 100644 --- a/pkg/providers/http_provider.go +++ b/pkg/providers/http_provider.go @@ -24,12 +24,13 @@ func NewHTTPProvider(apiKey, apiBase, proxy string) *HTTPProvider { } func NewHTTPProviderWithMaxTokensField(apiKey, apiBase, proxy, maxTokensField string) *HTTPProvider { - return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout(apiKey, apiBase, proxy, maxTokensField, 0) + return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout(apiKey, apiBase, proxy, maxTokensField, 0, nil) } func NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( apiKey, apiBase, proxy, maxTokensField string, requestTimeoutSeconds int, + extraBody map[string]any, ) *HTTPProvider { return &HTTPProvider{ delegate: openai_compat.NewProvider( @@ -38,6 +39,7 @@ func NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( proxy, openai_compat.WithMaxTokensField(maxTokensField), openai_compat.WithRequestTimeout(time.Duration(requestTimeoutSeconds)*time.Second), + openai_compat.WithExtraBody(extraBody), ), } } diff --git a/pkg/providers/openai_compat/provider.go b/pkg/providers/openai_compat/provider.go index 938e4ea8b..90bc683b8 100644 --- a/pkg/providers/openai_compat/provider.go +++ b/pkg/providers/openai_compat/provider.go @@ -35,6 +35,7 @@ type Provider struct { apiBase string maxTokensField string // Field name for max tokens (e.g., "max_completion_tokens" for o1/glm models) httpClient *http.Client + extraBody map[string]any // Additional fields to inject into request body } type Option func(*Provider) @@ -55,6 +56,12 @@ func WithRequestTimeout(timeout time.Duration) Option { } } +func WithExtraBody(extraBody map[string]any) Option { + return func(p *Provider) { + p.extraBody = extraBody + } +} + func NewProvider(apiKey, apiBase, proxy string, opts ...Option) *Provider { p := &Provider{ apiKey: apiKey, @@ -140,6 +147,12 @@ func (p *Provider) buildRequestBody( } } + // Merge extra body fields configured per-provider/model. + // These are injected last so they take precedence over defaults. + for k, v := range p.extraBody { + requestBody[k] = v + } + return requestBody } diff --git a/pkg/providers/openai_compat/provider_test.go b/pkg/providers/openai_compat/provider_test.go index efb03ccb8..ab632ccf3 100644 --- a/pkg/providers/openai_compat/provider_test.go +++ b/pkg/providers/openai_compat/provider_test.go @@ -610,6 +610,90 @@ func TestProvider_RequestTimeoutOverride(t *testing.T) { } } +func TestProviderChat_ExtraBodyInjected(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{"content": "ok"}, + "finish_reason": "stop", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + extraBody := map[string]any{"reasoning_split": true, "custom_field": "test"} + p := NewProvider("key", server.URL, "", WithExtraBody(extraBody)) + + _, err := p.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + "minimax/abab7", + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } + if got, ok := requestBody["custom_field"]; !ok || got != "test" { + t.Fatalf("custom_field = %v, want test", got) + } +} + +func TestProviderChat_ExtraBodyOverridesOptions(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{"content": "ok"}, + "finish_reason": "stop", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + extraBody := map[string]any{"temperature": 0.9} + p := NewProvider("key", server.URL, "", WithExtraBody(extraBody)) + + _, err := p.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + "gpt-4o", + map[string]any{"temperature": 0.5}, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // ExtraBody takes precedence over options since it is merged last. + if got := requestBody["temperature"]; got != float64(0.9) { + t.Fatalf("temperature = %v, want 0.9 (from extraBody, overriding options)", got) + } +} + type roundTripperFunc func(*http.Request) (*http.Response, error) func (f roundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) { diff --git a/web/backend/api/models.go b/web/backend/api/models.go index dd71ad25a..802b28526 100644 --- a/web/backend/api/models.go +++ b/web/backend/api/models.go @@ -31,12 +31,13 @@ type modelResponse struct { Proxy string `json:"proxy,omitempty"` AuthMethod string `json:"auth_method,omitempty"` // Advanced fields - ConnectMode string `json:"connect_mode,omitempty"` - Workspace string `json:"workspace,omitempty"` - RPM int `json:"rpm,omitempty"` - MaxTokensField string `json:"max_tokens_field,omitempty"` - RequestTimeout int `json:"request_timeout,omitempty"` - ThinkingLevel string `json:"thinking_level,omitempty"` + ConnectMode string `json:"connect_mode,omitempty"` + Workspace string `json:"workspace,omitempty"` + RPM int `json:"rpm,omitempty"` + MaxTokensField string `json:"max_tokens_field,omitempty"` + RequestTimeout int `json:"request_timeout,omitempty"` + ThinkingLevel string `json:"thinking_level,omitempty"` + ExtraBody map[string]any `json:"extra_body,omitempty"` // Meta Configured bool `json:"configured"` IsDefault bool `json:"is_default"` @@ -81,6 +82,7 @@ func (h *Handler) handleListModels(w http.ResponseWriter, r *http.Request) { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, + ExtraBody: m.ExtraBody, Configured: configured[i], IsDefault: m.ModelName == defaultModel, }) @@ -183,6 +185,9 @@ func (h *Handler) handleUpdateModel(w http.ResponseWriter, r *http.Request) { if mc.APIKey() == "" { mc.SetAPIKey(cfg.ModelList[idx].APIKey()) } + if mc.ExtraBody == nil { + mc.ExtraBody = cfg.ModelList[idx].ExtraBody + } cfg.ModelList[idx] = &mc diff --git a/web/frontend/src/api/models.ts b/web/frontend/src/api/models.ts index 8e49b48b4..ff8c2e049 100644 --- a/web/frontend/src/api/models.ts +++ b/web/frontend/src/api/models.ts @@ -17,6 +17,7 @@ export interface ModelInfo { max_tokens_field?: string request_timeout?: number thinking_level?: string + extra_body?: Record // Meta configured: boolean is_default: boolean From 53c6dd3812408444f4561463611495665e5bc514 Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Sun, 22 Mar 2026 20:37:06 +0800 Subject: [PATCH 031/202] Move minimax reasoning_split injection to provider factory Inject reasoning_split at provider creation time to allow user ExtraBody settings to be preserved --- pkg/config/config_test.go | 21 ------ pkg/providers/factory_provider.go | 27 +++++++- pkg/providers/factory_provider_test.go | 96 ++++++++++++++++++++++++++ 3 files changed, 122 insertions(+), 22 deletions(-) diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 429930eda..5fc0fe8fc 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1194,27 +1194,6 @@ func TestConfigLogLevelEmpty(t *testing.T) { } } -func TestDefaultConfig_MinimaxExtraBody(t *testing.T) { - cfg := DefaultConfig() - - var minimaxCfg *ModelConfig - for i := range cfg.ModelList { - if cfg.ModelList[i].Model == "minimax/MiniMax-M2.5" { - minimaxCfg = &cfg.ModelList[i] - break - } - } - if minimaxCfg == nil { - t.Fatal("Minimax model not found in ModelList") - } - if minimaxCfg.ExtraBody == nil { - t.Fatal("Minimax ExtraBody should not be nil") - } - if got, ok := minimaxCfg.ExtraBody["reasoning_split"]; !ok || got != true { - t.Fatalf("Minimax ExtraBody[reasoning_split] = %v, want true", got) - } -} - func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { dir := t.TempDir() cfgPath := filepath.Join(dir, "config.json") diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index 55d5fd10e..68335a108 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -117,7 +117,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err case "litellm", "openrouter", "groq", "zhipu", "gemini", "nvidia", "ollama", "moonshot", "shengsuanyun", "deepseek", "cerebras", "vivgrid", "volcengine", "vllm", "qwen", "qwen-intl", "qwen-international", "dashscope-intl", - "qwen-us", "dashscope-us", "mistral", "avian", "minimax", "longcat", "modelscope", "novita", + "qwen-us", "dashscope-us", "mistral", "avian", "longcat", "modelscope", "novita", "coding-plan", "alibaba-coding", "qwen-coding": // All other OpenAI-compatible HTTP providers if cfg.APIKey() == "" && cfg.APIBase == "" { @@ -136,6 +136,31 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.ExtraBody, ), modelID, nil + case "minimax": + // Minimax requires reasoning_split: true in the request body + if cfg.APIKey == "" && cfg.APIBase == "" { + return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) + } + apiBase := cfg.APIBase + if apiBase == "" { + apiBase = getDefaultAPIBase(protocol) + } + extraBody := cfg.ExtraBody + if extraBody == nil { + extraBody = make(map[string]any) + } + if _, ok := extraBody["reasoning_split"]; !ok { + extraBody["reasoning_split"] = true + } + return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( + cfg.APIKey, + apiBase, + cfg.Proxy, + cfg.MaxTokensField, + cfg.RequestTimeout, + extraBody, + ), modelID, nil + case "anthropic": if cfg.AuthMethod == "oauth" || cfg.AuthMethod == "token" { // Use OAuth credentials from auth store diff --git a/pkg/providers/factory_provider_test.go b/pkg/providers/factory_provider_test.go index fb980f32f..06025fba2 100644 --- a/pkg/providers/factory_provider_test.go +++ b/pkg/providers/factory_provider_test.go @@ -6,6 +6,7 @@ package providers import ( + "encoding/json" "net/http" "net/http/httptest" "strings" @@ -604,3 +605,98 @@ func TestGetDefaultAPIBase_QwenUSAliases(t *testing.T) { } } } + +func TestCreateProviderFromConfig_MinimaxInjectsReasoningSplit(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"},"finish_reason":"stop"}]}`)) + })) + defer server.Close() + + cfg := &config.ModelConfig{ + ModelName: "test-minimax", + Model: "minimax/MiniMax-M2.5", + APIKey: "test-key", + APIBase: server.URL, + } + + provider, modelID, err := CreateProviderFromConfig(cfg) + if err != nil { + t.Fatalf("CreateProviderFromConfig() error = %v", err) + } + if provider == nil { + t.Fatal("CreateProviderFromConfig() returned nil provider") + } + if modelID != "MiniMax-M2.5" { + t.Errorf("modelID = %q, want %q", modelID, "MiniMax-M2.5") + } + + _, err = provider.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + modelID, + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // Verify reasoning_split is automatically injected + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } +} + +func TestCreateProviderFromConfig_MinimaxPreservesUserExtraBody(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"},"finish_reason":"stop"}]}`)) + })) + defer server.Close() + + cfg := &config.ModelConfig{ + ModelName: "test-minimax-custom", + Model: "minimax/MiniMax-M2.5", + APIKey: "test-key", + APIBase: server.URL, + ExtraBody: map[string]any{"custom_field": "test"}, + } + + provider, modelID, err := CreateProviderFromConfig(cfg) + if err != nil { + t.Fatalf("CreateProviderFromConfig() error = %v", err) + } + + _, err = provider.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + modelID, + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // Verify reasoning_split is automatically injected + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } + // Verify user's custom field is preserved + if got, ok := requestBody["custom_field"]; !ok || got != "test" { + t.Fatalf("custom_field = %v, want test", got) + } +} From 2d9517c6550297428044286c1a6f954e16edb01a Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Mon, 23 Mar 2026 15:51:13 +0800 Subject: [PATCH 032/202] Use getter/setter methods for API key access in ModelConfig --- pkg/config/config.go | 4 ++-- pkg/config/config_test.go | 4 ++-- pkg/config/defaults.go | 2 +- pkg/providers/factory_provider.go | 4 ++-- pkg/providers/factory_provider_test.go | 4 ++-- web/frontend/src/api/models.ts | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/pkg/config/config.go b/pkg/config/config.go index 4dd1f9609..33919d9d7 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -939,8 +939,8 @@ type ModelConfig struct { RPM int `json:"rpm,omitempty"` // Requests per minute limit MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") RequestTimeout int `json:"request_timeout,omitempty"` - ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive - ExtraBody map[string]any `json:"extra_body,omitempty"` // Additional fields to inject into request body + ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + ExtraBody map[string]any `json:"extra_body,omitempty"` // Additional fields to inject into request body // from security secModelName string diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 5fc0fe8fc..9bd27e5eb 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1199,11 +1199,11 @@ func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { cfgPath := filepath.Join(dir, "config.json") cfg := &Config{ - ModelList: []ModelConfig{ + ModelList: []*ModelConfig{ { ModelName: "test-model", Model: "openai/test", - APIKey: "sk-test", + apiKeys: []string{"sk-test"}, ExtraBody: map[string]any{"custom_field": "value", "num_field": 42}, }, }, diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 2a086821a..ccfd5732a 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -339,7 +339,7 @@ func DefaultConfig() *Config { ModelName: "MiniMax-M2.5", Model: "minimax/MiniMax-M2.5", APIBase: "https://api.minimaxi.com/v1", - ExtraBody: map[string]any{"reasoning_split": true}, + ExtraBody: map[string]any{"reasoning_split": true}, }, // LongCat - https://longcat.chat/platform diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index 68335a108..bc7c2ff70 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -138,7 +138,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err case "minimax": // Minimax requires reasoning_split: true in the request body - if cfg.APIKey == "" && cfg.APIBase == "" { + if cfg.APIKey() == "" && cfg.APIBase == "" { return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) } apiBase := cfg.APIBase @@ -153,7 +153,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err extraBody["reasoning_split"] = true } return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( - cfg.APIKey, + cfg.APIKey(), apiBase, cfg.Proxy, cfg.MaxTokensField, diff --git a/pkg/providers/factory_provider_test.go b/pkg/providers/factory_provider_test.go index 06025fba2..1bff0419d 100644 --- a/pkg/providers/factory_provider_test.go +++ b/pkg/providers/factory_provider_test.go @@ -622,9 +622,9 @@ func TestCreateProviderFromConfig_MinimaxInjectsReasoningSplit(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-minimax", Model: "minimax/MiniMax-M2.5", - APIKey: "test-key", APIBase: server.URL, } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -670,10 +670,10 @@ func TestCreateProviderFromConfig_MinimaxPreservesUserExtraBody(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-minimax-custom", Model: "minimax/MiniMax-M2.5", - APIKey: "test-key", APIBase: server.URL, ExtraBody: map[string]any{"custom_field": "test"}, } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { diff --git a/web/frontend/src/api/models.ts b/web/frontend/src/api/models.ts index ff8c2e049..2fd042593 100644 --- a/web/frontend/src/api/models.ts +++ b/web/frontend/src/api/models.ts @@ -17,7 +17,7 @@ export interface ModelInfo { max_tokens_field?: string request_timeout?: number thinking_level?: string - extra_body?: Record + extra_body?: Record // Meta configured: boolean is_default: boolean From b24c577e38e96624a936eaceca9d648785236e15 Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Mon, 23 Mar 2026 16:29:25 +0800 Subject: [PATCH 033/202] Add security config to ExtraBody round-trip test --- pkg/config/config_test.go | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 9bd27e5eb..0af14588b 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1207,6 +1207,9 @@ func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { ExtraBody: map[string]any{"custom_field": "value", "num_field": 42}, }, }, + security: &SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{"test-model:0": {APIKeys: []string{"sk-test"}}}, + }, } if err := SaveConfig(cfgPath, cfg); err != nil { From f2985b8bee02e01034ee6a4670645323b7e507da Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Sun, 22 Mar 2026 15:49:25 +0800 Subject: [PATCH 034/202] feat(providers): add extra_body config to inject custom fields into request body Allow configuring provider-specific fields like reasoning_split for minimax via the model config's extra_body map. These fields are merged into the request body last, giving them precedence over default values. Co-Authored-By: Claude Opus 4.6 --- pkg/config/config.go | 11 ++- pkg/config/config_test.go | 56 +++++++++++++ pkg/config/defaults.go | 1 + pkg/providers/factory_provider.go | 3 + pkg/providers/http_provider.go | 4 +- pkg/providers/openai_compat/provider.go | 13 +++ pkg/providers/openai_compat/provider_test.go | 84 ++++++++++++++++++++ web/backend/api/models.go | 17 ++-- web/frontend/src/api/models.ts | 1 + 9 files changed, 179 insertions(+), 11 deletions(-) diff --git a/pkg/config/config.go b/pkg/config/config.go index c56c2645e..4dd1f9609 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -936,10 +936,11 @@ type ModelConfig struct { Workspace string `json:"workspace,omitempty"` // Workspace path for CLI-based providers // Optional optimizations - RPM int `json:"rpm,omitempty"` // Requests per minute limit - MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") - RequestTimeout int `json:"request_timeout,omitempty"` - ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + RPM int `json:"rpm,omitempty"` // Requests per minute limit + MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") + RequestTimeout int `json:"request_timeout,omitempty"` + ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + ExtraBody map[string]any `json:"extra_body,omitempty"` // Additional fields to inject into request body // from security secModelName string @@ -2079,6 +2080,7 @@ func expandMultiKeyModels(models []*ModelConfig) []*ModelConfig { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, + ExtraBody: m.ExtraBody, } expanded = append(expanded, additionalEntry) fallbackNames = append(fallbackNames, expandedName) @@ -2097,6 +2099,7 @@ func expandMultiKeyModels(models []*ModelConfig) []*ModelConfig { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, + ExtraBody: m.ExtraBody, apiKeys: []string{keys[0]}, } diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index a4c207470..429930eda 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1193,3 +1193,59 @@ func TestConfigLogLevelEmpty(t *testing.T) { t.Errorf("LogLevel = %q, want \"fatal\"", cfg.Gateway.LogLevel) } } + +func TestDefaultConfig_MinimaxExtraBody(t *testing.T) { + cfg := DefaultConfig() + + var minimaxCfg *ModelConfig + for i := range cfg.ModelList { + if cfg.ModelList[i].Model == "minimax/MiniMax-M2.5" { + minimaxCfg = &cfg.ModelList[i] + break + } + } + if minimaxCfg == nil { + t.Fatal("Minimax model not found in ModelList") + } + if minimaxCfg.ExtraBody == nil { + t.Fatal("Minimax ExtraBody should not be nil") + } + if got, ok := minimaxCfg.ExtraBody["reasoning_split"]; !ok || got != true { + t.Fatalf("Minimax ExtraBody[reasoning_split] = %v, want true", got) + } +} + +func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + + cfg := &Config{ + ModelList: []ModelConfig{ + { + ModelName: "test-model", + Model: "openai/test", + APIKey: "sk-test", + ExtraBody: map[string]any{"custom_field": "value", "num_field": 42}, + }, + }, + } + + if err := SaveConfig(cfgPath, cfg); err != nil { + t.Fatalf("SaveConfig error: %v", err) + } + + loaded, err := LoadConfig(cfgPath) + if err != nil { + t.Fatalf("LoadConfig error: %v", err) + } + + if loaded.ModelList[0].ExtraBody == nil { + t.Fatal("ExtraBody should not be nil after round-trip") + } + if got := loaded.ModelList[0].ExtraBody["custom_field"]; got != "value" { + t.Errorf("ExtraBody[custom_field] = %v, want value", got) + } + if got := loaded.ModelList[0].ExtraBody["num_field"]; got != float64(42) { + t.Errorf("ExtraBody[num_field] = %v, want 42", got) + } +} diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 18e0bbfd4..2a086821a 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -339,6 +339,7 @@ func DefaultConfig() *Config { ModelName: "MiniMax-M2.5", Model: "minimax/MiniMax-M2.5", APIBase: "https://api.minimaxi.com/v1", + ExtraBody: map[string]any{"reasoning_split": true}, }, // LongCat - https://longcat.chat/platform diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index 8a18f8fe7..55d5fd10e 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -93,6 +93,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "azure", "azure-openai": @@ -132,6 +133,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "anthropic": @@ -157,6 +159,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.Proxy, cfg.MaxTokensField, cfg.RequestTimeout, + cfg.ExtraBody, ), modelID, nil case "anthropic-messages": diff --git a/pkg/providers/http_provider.go b/pkg/providers/http_provider.go index 803165edb..f2ff52f1d 100644 --- a/pkg/providers/http_provider.go +++ b/pkg/providers/http_provider.go @@ -24,12 +24,13 @@ func NewHTTPProvider(apiKey, apiBase, proxy string) *HTTPProvider { } func NewHTTPProviderWithMaxTokensField(apiKey, apiBase, proxy, maxTokensField string) *HTTPProvider { - return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout(apiKey, apiBase, proxy, maxTokensField, 0) + return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout(apiKey, apiBase, proxy, maxTokensField, 0, nil) } func NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( apiKey, apiBase, proxy, maxTokensField string, requestTimeoutSeconds int, + extraBody map[string]any, ) *HTTPProvider { return &HTTPProvider{ delegate: openai_compat.NewProvider( @@ -38,6 +39,7 @@ func NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( proxy, openai_compat.WithMaxTokensField(maxTokensField), openai_compat.WithRequestTimeout(time.Duration(requestTimeoutSeconds)*time.Second), + openai_compat.WithExtraBody(extraBody), ), } } diff --git a/pkg/providers/openai_compat/provider.go b/pkg/providers/openai_compat/provider.go index 938e4ea8b..90bc683b8 100644 --- a/pkg/providers/openai_compat/provider.go +++ b/pkg/providers/openai_compat/provider.go @@ -35,6 +35,7 @@ type Provider struct { apiBase string maxTokensField string // Field name for max tokens (e.g., "max_completion_tokens" for o1/glm models) httpClient *http.Client + extraBody map[string]any // Additional fields to inject into request body } type Option func(*Provider) @@ -55,6 +56,12 @@ func WithRequestTimeout(timeout time.Duration) Option { } } +func WithExtraBody(extraBody map[string]any) Option { + return func(p *Provider) { + p.extraBody = extraBody + } +} + func NewProvider(apiKey, apiBase, proxy string, opts ...Option) *Provider { p := &Provider{ apiKey: apiKey, @@ -140,6 +147,12 @@ func (p *Provider) buildRequestBody( } } + // Merge extra body fields configured per-provider/model. + // These are injected last so they take precedence over defaults. + for k, v := range p.extraBody { + requestBody[k] = v + } + return requestBody } diff --git a/pkg/providers/openai_compat/provider_test.go b/pkg/providers/openai_compat/provider_test.go index efb03ccb8..ab632ccf3 100644 --- a/pkg/providers/openai_compat/provider_test.go +++ b/pkg/providers/openai_compat/provider_test.go @@ -610,6 +610,90 @@ func TestProvider_RequestTimeoutOverride(t *testing.T) { } } +func TestProviderChat_ExtraBodyInjected(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{"content": "ok"}, + "finish_reason": "stop", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + extraBody := map[string]any{"reasoning_split": true, "custom_field": "test"} + p := NewProvider("key", server.URL, "", WithExtraBody(extraBody)) + + _, err := p.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + "minimax/abab7", + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } + if got, ok := requestBody["custom_field"]; !ok || got != "test" { + t.Fatalf("custom_field = %v, want test", got) + } +} + +func TestProviderChat_ExtraBodyOverridesOptions(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{"content": "ok"}, + "finish_reason": "stop", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + extraBody := map[string]any{"temperature": 0.9} + p := NewProvider("key", server.URL, "", WithExtraBody(extraBody)) + + _, err := p.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + "gpt-4o", + map[string]any{"temperature": 0.5}, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // ExtraBody takes precedence over options since it is merged last. + if got := requestBody["temperature"]; got != float64(0.9) { + t.Fatalf("temperature = %v, want 0.9 (from extraBody, overriding options)", got) + } +} + type roundTripperFunc func(*http.Request) (*http.Response, error) func (f roundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) { diff --git a/web/backend/api/models.go b/web/backend/api/models.go index dd71ad25a..802b28526 100644 --- a/web/backend/api/models.go +++ b/web/backend/api/models.go @@ -31,12 +31,13 @@ type modelResponse struct { Proxy string `json:"proxy,omitempty"` AuthMethod string `json:"auth_method,omitempty"` // Advanced fields - ConnectMode string `json:"connect_mode,omitempty"` - Workspace string `json:"workspace,omitempty"` - RPM int `json:"rpm,omitempty"` - MaxTokensField string `json:"max_tokens_field,omitempty"` - RequestTimeout int `json:"request_timeout,omitempty"` - ThinkingLevel string `json:"thinking_level,omitempty"` + ConnectMode string `json:"connect_mode,omitempty"` + Workspace string `json:"workspace,omitempty"` + RPM int `json:"rpm,omitempty"` + MaxTokensField string `json:"max_tokens_field,omitempty"` + RequestTimeout int `json:"request_timeout,omitempty"` + ThinkingLevel string `json:"thinking_level,omitempty"` + ExtraBody map[string]any `json:"extra_body,omitempty"` // Meta Configured bool `json:"configured"` IsDefault bool `json:"is_default"` @@ -81,6 +82,7 @@ func (h *Handler) handleListModels(w http.ResponseWriter, r *http.Request) { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, + ExtraBody: m.ExtraBody, Configured: configured[i], IsDefault: m.ModelName == defaultModel, }) @@ -183,6 +185,9 @@ func (h *Handler) handleUpdateModel(w http.ResponseWriter, r *http.Request) { if mc.APIKey() == "" { mc.SetAPIKey(cfg.ModelList[idx].APIKey()) } + if mc.ExtraBody == nil { + mc.ExtraBody = cfg.ModelList[idx].ExtraBody + } cfg.ModelList[idx] = &mc diff --git a/web/frontend/src/api/models.ts b/web/frontend/src/api/models.ts index 8e49b48b4..ff8c2e049 100644 --- a/web/frontend/src/api/models.ts +++ b/web/frontend/src/api/models.ts @@ -17,6 +17,7 @@ export interface ModelInfo { max_tokens_field?: string request_timeout?: number thinking_level?: string + extra_body?: Record // Meta configured: boolean is_default: boolean From 608ec6d329291f301b08a10b003f4cbc99d387c1 Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Sun, 22 Mar 2026 20:37:06 +0800 Subject: [PATCH 035/202] Move minimax reasoning_split injection to provider factory Inject reasoning_split at provider creation time to allow user ExtraBody settings to be preserved --- pkg/config/config_test.go | 21 ------ pkg/providers/factory_provider.go | 27 +++++++- pkg/providers/factory_provider_test.go | 96 ++++++++++++++++++++++++++ 3 files changed, 122 insertions(+), 22 deletions(-) diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 429930eda..5fc0fe8fc 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1194,27 +1194,6 @@ func TestConfigLogLevelEmpty(t *testing.T) { } } -func TestDefaultConfig_MinimaxExtraBody(t *testing.T) { - cfg := DefaultConfig() - - var minimaxCfg *ModelConfig - for i := range cfg.ModelList { - if cfg.ModelList[i].Model == "minimax/MiniMax-M2.5" { - minimaxCfg = &cfg.ModelList[i] - break - } - } - if minimaxCfg == nil { - t.Fatal("Minimax model not found in ModelList") - } - if minimaxCfg.ExtraBody == nil { - t.Fatal("Minimax ExtraBody should not be nil") - } - if got, ok := minimaxCfg.ExtraBody["reasoning_split"]; !ok || got != true { - t.Fatalf("Minimax ExtraBody[reasoning_split] = %v, want true", got) - } -} - func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { dir := t.TempDir() cfgPath := filepath.Join(dir, "config.json") diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index 55d5fd10e..68335a108 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -117,7 +117,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err case "litellm", "openrouter", "groq", "zhipu", "gemini", "nvidia", "ollama", "moonshot", "shengsuanyun", "deepseek", "cerebras", "vivgrid", "volcengine", "vllm", "qwen", "qwen-intl", "qwen-international", "dashscope-intl", - "qwen-us", "dashscope-us", "mistral", "avian", "minimax", "longcat", "modelscope", "novita", + "qwen-us", "dashscope-us", "mistral", "avian", "longcat", "modelscope", "novita", "coding-plan", "alibaba-coding", "qwen-coding": // All other OpenAI-compatible HTTP providers if cfg.APIKey() == "" && cfg.APIBase == "" { @@ -136,6 +136,31 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err cfg.ExtraBody, ), modelID, nil + case "minimax": + // Minimax requires reasoning_split: true in the request body + if cfg.APIKey == "" && cfg.APIBase == "" { + return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) + } + apiBase := cfg.APIBase + if apiBase == "" { + apiBase = getDefaultAPIBase(protocol) + } + extraBody := cfg.ExtraBody + if extraBody == nil { + extraBody = make(map[string]any) + } + if _, ok := extraBody["reasoning_split"]; !ok { + extraBody["reasoning_split"] = true + } + return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( + cfg.APIKey, + apiBase, + cfg.Proxy, + cfg.MaxTokensField, + cfg.RequestTimeout, + extraBody, + ), modelID, nil + case "anthropic": if cfg.AuthMethod == "oauth" || cfg.AuthMethod == "token" { // Use OAuth credentials from auth store diff --git a/pkg/providers/factory_provider_test.go b/pkg/providers/factory_provider_test.go index fb980f32f..06025fba2 100644 --- a/pkg/providers/factory_provider_test.go +++ b/pkg/providers/factory_provider_test.go @@ -6,6 +6,7 @@ package providers import ( + "encoding/json" "net/http" "net/http/httptest" "strings" @@ -604,3 +605,98 @@ func TestGetDefaultAPIBase_QwenUSAliases(t *testing.T) { } } } + +func TestCreateProviderFromConfig_MinimaxInjectsReasoningSplit(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"},"finish_reason":"stop"}]}`)) + })) + defer server.Close() + + cfg := &config.ModelConfig{ + ModelName: "test-minimax", + Model: "minimax/MiniMax-M2.5", + APIKey: "test-key", + APIBase: server.URL, + } + + provider, modelID, err := CreateProviderFromConfig(cfg) + if err != nil { + t.Fatalf("CreateProviderFromConfig() error = %v", err) + } + if provider == nil { + t.Fatal("CreateProviderFromConfig() returned nil provider") + } + if modelID != "MiniMax-M2.5" { + t.Errorf("modelID = %q, want %q", modelID, "MiniMax-M2.5") + } + + _, err = provider.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + modelID, + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // Verify reasoning_split is automatically injected + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } +} + +func TestCreateProviderFromConfig_MinimaxPreservesUserExtraBody(t *testing.T) { + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"},"finish_reason":"stop"}]}`)) + })) + defer server.Close() + + cfg := &config.ModelConfig{ + ModelName: "test-minimax-custom", + Model: "minimax/MiniMax-M2.5", + APIKey: "test-key", + APIBase: server.URL, + ExtraBody: map[string]any{"custom_field": "test"}, + } + + provider, modelID, err := CreateProviderFromConfig(cfg) + if err != nil { + t.Fatalf("CreateProviderFromConfig() error = %v", err) + } + + _, err = provider.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + modelID, + nil, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + + // Verify reasoning_split is automatically injected + if got, ok := requestBody["reasoning_split"]; !ok || got != true { + t.Fatalf("reasoning_split = %v, want true", got) + } + // Verify user's custom field is preserved + if got, ok := requestBody["custom_field"]; !ok || got != "test" { + t.Fatalf("custom_field = %v, want test", got) + } +} From 79df9386964651e4a711aae318dee3abfa28b1f2 Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Mon, 23 Mar 2026 15:51:13 +0800 Subject: [PATCH 036/202] Use getter/setter methods for API key access in ModelConfig --- pkg/config/config.go | 4 ++-- pkg/config/config_test.go | 4 ++-- pkg/config/defaults.go | 2 +- pkg/providers/factory_provider.go | 4 ++-- pkg/providers/factory_provider_test.go | 4 ++-- web/frontend/src/api/models.ts | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/pkg/config/config.go b/pkg/config/config.go index 4dd1f9609..33919d9d7 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -939,8 +939,8 @@ type ModelConfig struct { RPM int `json:"rpm,omitempty"` // Requests per minute limit MaxTokensField string `json:"max_tokens_field,omitempty"` // Field name for max tokens (e.g., "max_completion_tokens") RequestTimeout int `json:"request_timeout,omitempty"` - ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive - ExtraBody map[string]any `json:"extra_body,omitempty"` // Additional fields to inject into request body + ThinkingLevel string `json:"thinking_level,omitempty"` // Extended thinking: off|low|medium|high|xhigh|adaptive + ExtraBody map[string]any `json:"extra_body,omitempty"` // Additional fields to inject into request body // from security secModelName string diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 5fc0fe8fc..9bd27e5eb 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1199,11 +1199,11 @@ func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { cfgPath := filepath.Join(dir, "config.json") cfg := &Config{ - ModelList: []ModelConfig{ + ModelList: []*ModelConfig{ { ModelName: "test-model", Model: "openai/test", - APIKey: "sk-test", + apiKeys: []string{"sk-test"}, ExtraBody: map[string]any{"custom_field": "value", "num_field": 42}, }, }, diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 2a086821a..ccfd5732a 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -339,7 +339,7 @@ func DefaultConfig() *Config { ModelName: "MiniMax-M2.5", Model: "minimax/MiniMax-M2.5", APIBase: "https://api.minimaxi.com/v1", - ExtraBody: map[string]any{"reasoning_split": true}, + ExtraBody: map[string]any{"reasoning_split": true}, }, // LongCat - https://longcat.chat/platform diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index 68335a108..bc7c2ff70 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -138,7 +138,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err case "minimax": // Minimax requires reasoning_split: true in the request body - if cfg.APIKey == "" && cfg.APIBase == "" { + if cfg.APIKey() == "" && cfg.APIBase == "" { return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) } apiBase := cfg.APIBase @@ -153,7 +153,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err extraBody["reasoning_split"] = true } return NewHTTPProviderWithMaxTokensFieldAndRequestTimeout( - cfg.APIKey, + cfg.APIKey(), apiBase, cfg.Proxy, cfg.MaxTokensField, diff --git a/pkg/providers/factory_provider_test.go b/pkg/providers/factory_provider_test.go index 06025fba2..1bff0419d 100644 --- a/pkg/providers/factory_provider_test.go +++ b/pkg/providers/factory_provider_test.go @@ -622,9 +622,9 @@ func TestCreateProviderFromConfig_MinimaxInjectsReasoningSplit(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-minimax", Model: "minimax/MiniMax-M2.5", - APIKey: "test-key", APIBase: server.URL, } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { @@ -670,10 +670,10 @@ func TestCreateProviderFromConfig_MinimaxPreservesUserExtraBody(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-minimax-custom", Model: "minimax/MiniMax-M2.5", - APIKey: "test-key", APIBase: server.URL, ExtraBody: map[string]any{"custom_field": "test"}, } + cfg.SetAPIKey("test-key") provider, modelID, err := CreateProviderFromConfig(cfg) if err != nil { diff --git a/web/frontend/src/api/models.ts b/web/frontend/src/api/models.ts index ff8c2e049..2fd042593 100644 --- a/web/frontend/src/api/models.ts +++ b/web/frontend/src/api/models.ts @@ -17,7 +17,7 @@ export interface ModelInfo { max_tokens_field?: string request_timeout?: number thinking_level?: string - extra_body?: Record + extra_body?: Record // Meta configured: boolean is_default: boolean From c7544f7cb99cbd0e474c5a38c456de9b05deffe3 Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Sun, 22 Mar 2026 15:49:25 +0800 Subject: [PATCH 037/202] feat(providers): add extra_body config to inject custom fields into request body Allow configuring provider-specific fields like reasoning_split for minimax via the model config's extra_body map. These fields are merged into the request body last, giving them precedence over default values. Co-Authored-By: Claude Opus 4.6 --- pkg/config/config_test.go | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 9bd27e5eb..3f8ec6150 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1207,6 +1207,9 @@ func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { ExtraBody: map[string]any{"custom_field": "value", "num_field": 42}, }, }, + security: &SecurityConfig{ + ModelList: map[string]ModelSecurityEntry{"test-model:0": {APIKeys: []string{"sk-test"}}}, + }, } if err := SaveConfig(cfgPath, cfg); err != nil { @@ -1228,3 +1231,24 @@ func TestModelConfig_ExtraBodyRoundTrip(t *testing.T) { t.Errorf("ExtraBody[num_field] = %v, want 42", got) } } + +func TestDefaultConfig_MinimaxExtraBody(t *testing.T) { + cfg := DefaultConfig() + + var minimaxCfg *ModelConfig + for i := range cfg.ModelList { + if cfg.ModelList[i].Model == "minimax/MiniMax-M2.5" { + minimaxCfg = cfg.ModelList[i] + break + } + } + if minimaxCfg == nil { + t.Fatal("Minimax model not found in ModelList") + } + if minimaxCfg.ExtraBody == nil { + t.Fatal("Minimax ExtraBody should not be nil") + } + if got, ok := minimaxCfg.ExtraBody["reasoning_split"]; !ok || got != true { + t.Fatalf("Minimax ExtraBody[reasoning_split] = %v, want true", got) + } +} From d1d2155edbe63d8569f394966e01220d1db04b27 Mon Sep 17 00:00:00 2001 From: uiyzzi Date: Mon, 23 Mar 2026 16:47:13 +0800 Subject: [PATCH 038/202] Use ModelName instead of Model in test config structs --- pkg/agent/loop_test.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 863623f4c..ad0022138 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -150,7 +150,7 @@ func TestProcessMessage_UseCommandLoadsRequestedSkill(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -196,7 +196,7 @@ func TestHandleCommand_UseCommandRejectsUnknownSkill(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -240,7 +240,7 @@ func TestProcessMessage_UseCommandArmsSkillForNextMessage(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, From 1961aab85015d9f31a576ecd1b7556f59f0f7688 Mon Sep 17 00:00:00 2001 From: lc6464 <64722907+lc6464@users.noreply.github.com> Date: Mon, 23 Mar 2026 17:16:17 +0800 Subject: [PATCH 039/202] fix(agent): use ModelName in loop tests --- pkg/agent/loop_test.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 863623f4c..ad0022138 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -150,7 +150,7 @@ func TestProcessMessage_UseCommandLoadsRequestedSkill(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -196,7 +196,7 @@ func TestHandleCommand_UseCommandRejectsUnknownSkill(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -240,7 +240,7 @@ func TestProcessMessage_UseCommandArmsSkillForNextMessage(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, From f81b44bf194927e28f2a87a0b2f091bdb8d78a4c Mon Sep 17 00:00:00 2001 From: Liqiang Liu Date: Mon, 23 Mar 2026 17:24:46 +0800 Subject: [PATCH 040/202] fix(provider): deduplicate tool results and merge consecutive tool_result blocks for Anthropic API (#1793) Anthropic API returns 400 when multiple tool_result blocks share the same tool_use_id, or when consecutive tool results are sent as separate user messages. This fix: 1. Adds ToolCallID deduplication in sanitizeHistoryForProvider (context.go) to drop duplicate tool results before sending to any provider. 2. Merges consecutive tool result messages into a single user message with multiple tool_result content blocks in Anthropic's buildRequestBody, for both "user" (with ToolCallID) and "tool" role messages. 3. Adds tests for both behaviors. Co-authored-by: Claude Opus 4.6 (1M context) --- pkg/agent/context.go | 13 +++ pkg/agent/context_test.go | 25 ++++++ pkg/providers/anthropic_messages/provider.go | 44 +++++---- .../anthropic_messages/provider_test.go | 90 +++++++++++++++++++ 4 files changed, 156 insertions(+), 16 deletions(-) diff --git a/pkg/agent/context.go b/pkg/agent/context.go index 4f5d75a50..12e3cdd4d 100644 --- a/pkg/agent/context.go +++ b/pkg/agent/context.go @@ -678,8 +678,21 @@ func sanitizeHistoryForProvider(history []providers.Message) []providers.Message // like DeepSeek that enforce: "An assistant message with 'tool_calls' must // be followed by tool messages responding to each 'tool_call_id'." final := make([]providers.Message, 0, len(sanitized)) + seenToolCallID := make(map[string]bool) for i := 0; i < len(sanitized); i++ { msg := sanitized[i] + + // Deduplicate tool results by ToolCallID + if msg.Role == "tool" && msg.ToolCallID != "" { + if seenToolCallID[msg.ToolCallID] { + logger.DebugCF("agent", "Dropping duplicate tool result", map[string]any{ + "tool_call_id": msg.ToolCallID, + }) + continue + } + seenToolCallID[msg.ToolCallID] = true + } + if msg.Role == "assistant" && len(msg.ToolCalls) > 0 { // Collect expected tool_call IDs expected := make(map[string]bool, len(msg.ToolCalls)) diff --git a/pkg/agent/context_test.go b/pkg/agent/context_test.go index 5756ed911..0d7948eef 100644 --- a/pkg/agent/context_test.go +++ b/pkg/agent/context_test.go @@ -188,6 +188,31 @@ func TestSanitizeHistoryForProvider_PlainConversation(t *testing.T) { assertRoles(t, result, "user", "assistant", "user", "assistant") } +func TestSanitizeHistoryForProvider_DuplicateToolResults(t *testing.T) { + history := []providers.Message{ + msg("user", "do something"), + assistantWithTools("A", "B"), + toolResult("A"), + toolResult("B"), + toolResult("A"), // duplicate + toolResult("B"), // duplicate + msg("assistant", "done"), + } + + result := sanitizeHistoryForProvider(history) + if len(result) != 5 { + t.Fatalf("expected 5 messages, got %d: %+v", len(result), roles(result)) + } + assertRoles(t, result, "user", "assistant", "tool", "tool", "assistant") + // Verify the kept tool results have the correct IDs + if result[2].ToolCallID != "A" { + t.Errorf("expected tool result A, got %q", result[2].ToolCallID) + } + if result[3].ToolCallID != "B" { + t.Errorf("expected tool result B, got %q", result[3].ToolCallID) + } +} + func roles(msgs []providers.Message) []string { r := make([]string, len(msgs)) for i, m := range msgs { diff --git a/pkg/providers/anthropic_messages/provider.go b/pkg/providers/anthropic_messages/provider.go index 2b19e941a..6a1c473dd 100644 --- a/pkg/providers/anthropic_messages/provider.go +++ b/pkg/providers/anthropic_messages/provider.go @@ -188,17 +188,23 @@ func buildRequestBody( case "user": if msg.ToolCallID != "" { - // Tool result message - content := []map[string]any{ - { - "type": "tool_result", - "tool_use_id": msg.ToolCallID, - "content": msg.Content, - }, + // Tool result message — merge into previous user message if it contains tool_results + toolResultBlock := map[string]any{ + "type": "tool_result", + "tool_use_id": msg.ToolCallID, + "content": msg.Content, + } + if len(apiMessages) > 0 { + if prev, ok := apiMessages[len(apiMessages)-1].(map[string]any); ok && prev["role"] == "user" { + if content, ok := prev["content"].([]map[string]any); ok { + prev["content"] = append(content, toolResultBlock) + continue + } + } } apiMessages = append(apiMessages, map[string]any{ "role": "user", - "content": content, + "content": []map[string]any{toolResultBlock}, }) } else { // Regular user message @@ -246,17 +252,23 @@ func buildRequestBody( }) case "tool": - // Tool result (alternative format) - content := []map[string]any{ - { - "type": "tool_result", - "tool_use_id": msg.ToolCallID, - "content": msg.Content, - }, + // Tool result (alternative format) — merge into previous user message if it contains tool_results + toolResultBlock := map[string]any{ + "type": "tool_result", + "tool_use_id": msg.ToolCallID, + "content": msg.Content, + } + if len(apiMessages) > 0 { + if prev, ok := apiMessages[len(apiMessages)-1].(map[string]any); ok && prev["role"] == "user" { + if content, ok := prev["content"].([]map[string]any); ok { + prev["content"] = append(content, toolResultBlock) + continue + } + } } apiMessages = append(apiMessages, map[string]any{ "role": "user", - "content": content, + "content": []map[string]any{toolResultBlock}, }) } } diff --git a/pkg/providers/anthropic_messages/provider_test.go b/pkg/providers/anthropic_messages/provider_test.go index 8eabc15fa..39bc48117 100644 --- a/pkg/providers/anthropic_messages/provider_test.go +++ b/pkg/providers/anthropic_messages/provider_test.go @@ -562,6 +562,96 @@ func TestBuildRequestBodyEdgeCases(t *testing.T) { } } +func TestBuildRequestBody_ConsecutiveToolResultsMerged(t *testing.T) { + // Consecutive tool results (role "tool") should be merged into a single "user" message + messages := []Message{ + {Role: "user", Content: "Use tools"}, + {Role: "assistant", Content: "", ToolCalls: []ToolCall{ + {ID: "t1", Name: "tool_a", Arguments: map[string]any{"x": 1}}, + {ID: "t2", Name: "tool_b", Arguments: map[string]any{"y": 2}}, + }}, + {Role: "tool", ToolCallID: "t1", Content: "result1"}, + {Role: "tool", ToolCallID: "t2", Content: "result2"}, + } + + got, err := buildRequestBody(messages, nil, "test-model", map[string]any{"max_tokens": 8192}) + if err != nil { + t.Fatalf("buildRequestBody() error: %v", err) + } + + apiMessages, ok := got["messages"].([]any) + if !ok { + t.Fatalf("messages is not []any") + } + + // Expect: user, assistant, user (merged tool results) + if len(apiMessages) != 3 { + for i, m := range apiMessages { + t.Logf("message[%d]: %+v", i, m) + } + t.Fatalf("expected 3 API messages, got %d", len(apiMessages)) + } + + // The third message should be a user message with 2 tool_result blocks + toolResultMsg, ok := apiMessages[2].(map[string]any) + if !ok { + t.Fatalf("tool result message is not map[string]any") + } + if toolResultMsg["role"] != "user" { + t.Errorf("expected role 'user', got %v", toolResultMsg["role"]) + } + content, ok := toolResultMsg["content"].([]map[string]any) + if !ok { + t.Fatalf("content is not []map[string]any: %T", toolResultMsg["content"]) + } + if len(content) != 2 { + t.Fatalf("expected 2 tool_result blocks, got %d", len(content)) + } + if content[0]["tool_use_id"] != "t1" { + t.Errorf("first tool_result tool_use_id = %v, want t1", content[0]["tool_use_id"]) + } + if content[1]["tool_use_id"] != "t2" { + t.Errorf("second tool_result tool_use_id = %v, want t2", content[1]["tool_use_id"]) + } +} + +func TestBuildRequestBody_UserToolResultsMerged(t *testing.T) { + // Consecutive tool results using role "user" with ToolCallID should also be merged + messages := []Message{ + {Role: "user", Content: "Use tools"}, + {Role: "assistant", Content: "", ToolCalls: []ToolCall{ + {ID: "t1", Name: "tool_a", Arguments: map[string]any{"x": 1}}, + {ID: "t2", Name: "tool_b", Arguments: map[string]any{"y": 2}}, + }}, + {Role: "user", ToolCallID: "t1", Content: "result1"}, + {Role: "user", ToolCallID: "t2", Content: "result2"}, + } + + got, err := buildRequestBody(messages, nil, "test-model", map[string]any{"max_tokens": 8192}) + if err != nil { + t.Fatalf("buildRequestBody() error: %v", err) + } + + apiMessages, ok := got["messages"].([]any) + if !ok { + t.Fatalf("messages is not []any") + } + + // Expect: user, assistant, user (merged tool results) + if len(apiMessages) != 3 { + t.Fatalf("expected 3 API messages, got %d", len(apiMessages)) + } + + toolResultMsg := apiMessages[2].(map[string]any) + content, ok := toolResultMsg["content"].([]map[string]any) + if !ok { + t.Fatalf("content is not []map[string]any: %T", toolResultMsg["content"]) + } + if len(content) != 2 { + t.Fatalf("expected 2 tool_result blocks, got %d", len(content)) + } +} + // TestParseResponseBodyEdgeCases tests edge cases for parseResponseBody. func TestParseResponseBodyEdgeCases(t *testing.T) { tests := []struct { From 8e3e517135e8278c5128688189209899448bd0f4 Mon Sep 17 00:00:00 2001 From: LC <64722907+lc6464@users.noreply.github.com> Date: Mon, 23 Mar 2026 17:25:27 +0800 Subject: [PATCH 041/202] feat: render mixed Markdown+HTML in assistant messages and skills (#1900) * feat(chat): render mixed Markdown+HTML in assistant messages using rehype-raw + rehype-sanitize (safe default) * build: remove irrelevant changes of pnpm-lock.yaml * feat(skills): enable rendering of Markdown with HTML in skill details using rehype-raw and rehype-sanitize * fix(agent): use ModelName in loop tests --- web/frontend/package.json | 2 + web/frontend/pnpm-lock.yaml | 127 ++++++++++++++++++ .../src/components/chat/assistant-message.tsx | 9 +- .../src/components/skills/skills-page.tsx | 7 +- 4 files changed, 143 insertions(+), 2 deletions(-) diff --git a/web/frontend/package.json b/web/frontend/package.json index b1cc09b7b..8053d1f2a 100644 --- a/web/frontend/package.json +++ b/web/frontend/package.json @@ -31,6 +31,8 @@ "react-i18next": "^16.5.8", "react-markdown": "^10.1.0", "react-textarea-autosize": "^8.5.9", + "rehype-raw": "^7.0.0", + "rehype-sanitize": "^6.0.0", "remark-gfm": "^4.0.1", "shadcn": "^4.1.0", "sonner": "^2.0.7", diff --git a/web/frontend/pnpm-lock.yaml b/web/frontend/pnpm-lock.yaml index f893abda9..edaf49ccc 100644 --- a/web/frontend/pnpm-lock.yaml +++ b/web/frontend/pnpm-lock.yaml @@ -62,6 +62,12 @@ importers: react-textarea-autosize: specifier: ^8.5.9 version: 8.5.9(@types/react@19.2.14)(react@19.2.4) + rehype-raw: + specifier: ^7.0.0 + version: 7.0.0 + rehype-sanitize: + specifier: ^6.0.0 + version: 6.0.0 remark-gfm: specifier: ^4.0.1 version: 4.0.1 @@ -2155,6 +2161,10 @@ packages: resolution: {integrity: sha512-Qohcme7V1inbAfvjItgw0EaxVX5q2rdVEZHRBrEQdRZTssLDGsL8Lwrznl8oQ/6kuTJONLaDcGjkNP247XEhcA==} engines: {node: '>=10.13.0'} + entities@6.0.1: + resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==} + engines: {node: '>=0.12'} + env-paths@2.2.1: resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==} engines: {node: '>=6'} @@ -2467,12 +2477,30 @@ packages: resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==} engines: {node: '>= 0.4'} + hast-util-from-parse5@8.0.3: + resolution: {integrity: sha512-3kxEVkEKt0zvcZ3hCRYI8rqrgwtlIOFMWkbclACvjlDw8Li9S2hk/d51OI0nr/gIpdMHNepwgOKqZ/sy0Clpyg==} + + hast-util-parse-selector@4.0.0: + resolution: {integrity: sha512-wkQCkSYoOGCRKERFWcxMVMOcYE2K1AaNLU8DXS9arxnLOUEWbOXKXiJUNzEpqZ3JOKpnha3jkFrumEjVliDe7A==} + + hast-util-raw@9.1.0: + resolution: {integrity: sha512-Y8/SBAHkZGoNkpzqqfCldijcuUKh7/su31kEBp67cFY09Wy0mTRgtsLYsiIxMJxlu0f6AA5SUTbDR8K0rxnbUw==} + + hast-util-sanitize@5.0.2: + resolution: {integrity: sha512-3yTWghByc50aGS7JlGhk61SPenfE/p1oaFeNwkOOyrscaOkMGrcW9+Cy/QAIOBpZxP1yqDIzFMR0+Np0i0+usg==} + hast-util-to-jsx-runtime@2.3.6: resolution: {integrity: sha512-zl6s8LwNyo1P9uw+XJGvZtdFF1GdAkOg8ujOw+4Pyb76874fLps4ueHXDhXWdk6YHQ6OgUtinliG7RsYvCbbBg==} + hast-util-to-parse5@8.0.1: + resolution: {integrity: sha512-MlWT6Pjt4CG9lFCjiz4BH7l9wmrMkfkJYCxFwKQic8+RTZgWPuWxwAfjJElsXkex7DJjfSJsQIt931ilUgmwdA==} + hast-util-whitespace@3.0.0: resolution: {integrity: sha512-88JUN06ipLwsnv+dVn+OIYOvAuvBMy/Qoi6O7mQHxdPXpjy+Cd6xRkWwux7DKO+4sYILtLBRIKgsdpS2gQc7qw==} + hastscript@9.0.1: + resolution: {integrity: sha512-g7df9rMFX/SPi34tyGCyUBREQoKkapwdY/T04Qn9TDWfHhAYt4/I0gMVirzK5wEzeUqIjEB+LXC/ypb7Aqno5w==} + headers-polyfill@4.0.3: resolution: {integrity: sha512-IScLbePpkvO846sIwOtOTDjutRMWdXdJmXdMvk6gCBHxFO8d+QKOQedyZSxFTTFYRSmlgSTDtXqqq4pcenBXLQ==} @@ -2492,6 +2520,9 @@ packages: html-url-attributes@3.0.1: resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==} + html-void-elements@3.0.0: + resolution: {integrity: sha512-bEqo66MRXsUGxWHV5IP0PUiAWwoEjba4VCzg0LjFJBpchPaTfyfCKTG6bc5F8ucKec3q5y6qOdGyYTSBEvhCrg==} + http-errors@2.0.1: resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==} engines: {node: '>= 0.8'} @@ -3141,6 +3172,9 @@ packages: parse-statements@1.0.11: resolution: {integrity: sha512-HlsyYdMBnbPQ9Jr/VgJ1YF4scnldvJpJxCVx6KgqPL4dxppsWrJHCIIxQXMJrqGnsRkNPATbeMJ8Yxu7JMsYcA==} + parse5@7.3.0: + resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==} + parseurl@1.3.3: resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==} engines: {node: '>= 0.8'} @@ -3390,6 +3424,12 @@ packages: resolution: {integrity: sha512-YTUo+Flmw4ZXiWfQKGcwwc11KnoRAYgzAE2E7mXKCjSviTKShtxBsN6YUUBB2gtaBzKzeKunxhUwNHQuRryhWA==} engines: {node: '>= 4'} + rehype-raw@7.0.0: + resolution: {integrity: sha512-/aE8hCfKlQeA8LmyeyQvQF3eBiLRGNlfBJEvWH7ivp9sBqs7TNqBL5X3v157rM4IFETqDnIOO+z5M/biZbo9Ww==} + + rehype-sanitize@6.0.0: + resolution: {integrity: sha512-CsnhKNsyI8Tub6L4sm5ZFsme4puGfc6pYylvXo1AeqaGbjOYyzNv3qZPwvs0oMJ39eryyeOdmxwUIo94IpEhqg==} + remark-gfm@4.0.1: resolution: {integrity: sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==} @@ -3812,6 +3852,9 @@ packages: resolution: {integrity: sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==} engines: {node: '>= 0.8'} + vfile-location@5.0.3: + resolution: {integrity: sha512-5yXvWDEgqeiYiBe1lbxYF7UMAIm/IcopxMHrMQDq3nvKcjPKIhZklUKL+AE7J7uApI4kwe2snsK+eI6UTj9EHg==} + vfile-message@4.0.3: resolution: {integrity: sha512-QTHzsGd1EhbZs4AsQ20JX1rC3cOlt/IWJruk893DfLRr57lcnOeMaWG4K0JrRta4mIJZKth2Au3mM3u03/JWKw==} @@ -3862,6 +3905,9 @@ packages: resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==} engines: {node: '>=0.10.0'} + web-namespaces@2.0.1: + resolution: {integrity: sha512-bKr1DkiNa2krS7qxNtdrtHAmzuYGFQLiQ13TsorsdT6ULTkPLKuu5+GsFpDlg6JFjUTwX2DyhMPG2be8uPrqsQ==} + web-streams-polyfill@3.3.3: resolution: {integrity: sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==} engines: {node: '>= 8'} @@ -5945,6 +5991,8 @@ snapshots: graceful-fs: 4.2.11 tapable: 2.3.0 + entities@6.0.1: {} + env-paths@2.2.1: {} error-ex@1.3.4: @@ -6318,6 +6366,43 @@ snapshots: dependencies: function-bind: 1.1.2 + hast-util-from-parse5@8.0.3: + dependencies: + '@types/hast': 3.0.4 + '@types/unist': 3.0.3 + devlop: 1.1.0 + hastscript: 9.0.1 + property-information: 7.1.0 + vfile: 6.0.3 + vfile-location: 5.0.3 + web-namespaces: 2.0.1 + + hast-util-parse-selector@4.0.0: + dependencies: + '@types/hast': 3.0.4 + + hast-util-raw@9.1.0: + dependencies: + '@types/hast': 3.0.4 + '@types/unist': 3.0.3 + '@ungap/structured-clone': 1.3.0 + hast-util-from-parse5: 8.0.3 + hast-util-to-parse5: 8.0.1 + html-void-elements: 3.0.0 + mdast-util-to-hast: 13.2.1 + parse5: 7.3.0 + unist-util-position: 5.0.0 + unist-util-visit: 5.1.0 + vfile: 6.0.3 + web-namespaces: 2.0.1 + zwitch: 2.0.4 + + hast-util-sanitize@5.0.2: + dependencies: + '@types/hast': 3.0.4 + '@ungap/structured-clone': 1.3.0 + unist-util-position: 5.0.0 + hast-util-to-jsx-runtime@2.3.6: dependencies: '@types/estree': 1.0.8 @@ -6338,10 +6423,28 @@ snapshots: transitivePeerDependencies: - supports-color + hast-util-to-parse5@8.0.1: + dependencies: + '@types/hast': 3.0.4 + comma-separated-tokens: 2.0.3 + devlop: 1.1.0 + property-information: 7.1.0 + space-separated-tokens: 2.0.2 + web-namespaces: 2.0.1 + zwitch: 2.0.4 + hast-util-whitespace@3.0.0: dependencies: '@types/hast': 3.0.4 + hastscript@9.0.1: + dependencies: + '@types/hast': 3.0.4 + comma-separated-tokens: 2.0.3 + hast-util-parse-selector: 4.0.0 + property-information: 7.1.0 + space-separated-tokens: 2.0.2 + headers-polyfill@4.0.3: {} hermes-estree@0.25.1: {} @@ -6358,6 +6461,8 @@ snapshots: html-url-attributes@3.0.1: {} + html-void-elements@3.0.0: {} + http-errors@2.0.1: dependencies: depd: 2.0.0 @@ -7135,6 +7240,10 @@ snapshots: parse-statements@1.0.11: {} + parse5@7.3.0: + dependencies: + entities: 6.0.1 + parseurl@1.3.3: {} path-browserify@1.0.1: {} @@ -7369,6 +7478,17 @@ snapshots: tiny-invariant: 1.3.3 tslib: 2.8.1 + rehype-raw@7.0.0: + dependencies: + '@types/hast': 3.0.4 + hast-util-raw: 9.1.0 + vfile: 6.0.3 + + rehype-sanitize@6.0.0: + dependencies: + '@types/hast': 3.0.4 + hast-util-sanitize: 5.0.2 + remark-gfm@4.0.1: dependencies: '@types/mdast': 4.0.4 @@ -7860,6 +7980,11 @@ snapshots: vary@1.1.2: {} + vfile-location@5.0.3: + dependencies: + '@types/unist': 3.0.3 + vfile: 6.0.3 + vfile-message@4.0.3: dependencies: '@types/unist': 3.0.3 @@ -7887,6 +8012,8 @@ snapshots: void-elements@3.1.0: {} + web-namespaces@2.0.1: {} + web-streams-polyfill@3.3.3: {} webpack-virtual-modules@0.6.2: {} diff --git a/web/frontend/src/components/chat/assistant-message.tsx b/web/frontend/src/components/chat/assistant-message.tsx index 150f2f87d..05da3ceb1 100644 --- a/web/frontend/src/components/chat/assistant-message.tsx +++ b/web/frontend/src/components/chat/assistant-message.tsx @@ -1,6 +1,8 @@ import { IconCheck, IconCopy } from "@tabler/icons-react" import { useState } from "react" import ReactMarkdown from "react-markdown" +import rehypeRaw from "rehype-raw" +import rehypeSanitize from "rehype-sanitize" import remarkGfm from "remark-gfm" import { Button } from "@/components/ui/button" @@ -42,7 +44,12 @@ export function AssistantMessage({
- {content} + + {content} +
+
+ ) + } + return ( +
+

{t("channels.weixin.notBound")}

+ +
+ ) + } + + if (bindState === "loading") { + return ( +
+ +

{t("channels.weixin.generating")}

+
+ ) + } + + if (bindState === "waiting" || bindState === "scaned") { + return ( +
+ {qrDataURI ? ( + WeChat QR Code + ) : ( +
+ +
+ )} + {bindState === "scaned" ? ( +
+ + {t("channels.weixin.scanned")} +
+ ) : ( +

{t("channels.weixin.scanHint")}

+ )} + +
+ ) + } + + if (bindState === "confirmed") { + return ( +
+
+ +
+

+ {t("channels.weixin.bound")} +

+ {accountID && ( +

{accountID}

+ )} + +
+ ) + } + + if (bindState === "expired") { + return ( +
+
+ +
+

{t("channels.weixin.expired")}

+ +
+ ) + } + + if (bindState === "error") { + return ( +
+
+ +
+

{errorMsg || t("channels.weixin.errorGeneric")}

+ +
+ ) + } + + return null + } + + return ( +
+ {/* QR Bind Section */} +
+
+

{t("channels.weixin.bindTitle")}

+

{t("channels.weixin.bindDesc")}

+
+ {renderBindSection()} +
+ + {/* allow_from */} + + + onChange( + "allow_from", + e.target.value + .split(",") + .map((s: string) => s.trim()) + .filter(Boolean), + ) + } + placeholder={t("channels.field.allowFromPlaceholder")} + /> + + + {/* proxy */} + + onChange("proxy", e.target.value)} + placeholder="http://localhost:7890" + /> + +
+ ) +} diff --git a/web/frontend/src/i18n/locales/en.json b/web/frontend/src/i18n/locales/en.json index 66e39ad0e..0b0afa39d 100644 --- a/web/frontend/src/i18n/locales/en.json +++ b/web/frontend/src/i18n/locales/en.json @@ -240,7 +240,23 @@ "pico": "Web", "maixcam": "MaixCam", "matrix": "Matrix", - "irc": "IRC" + "irc": "IRC", + "weixin": "WeChat" + }, + "weixin": { + "bindTitle": "WeChat Account Binding", + "bindDesc": "Scan the QR code with WeChat to bind your personal account.", + "bind": "Bind WeChat", + "rebind": "Re-bind", + "bound": "WeChat Bound", + "notBound": "WeChat account not bound yet.", + "generating": "Generating QR code...", + "scanHint": "Open WeChat and scan the QR code", + "scanned": "Scanned — please confirm in WeChat", + "expired": "QR code expired", + "retry": "Try Again", + "refresh": "Refresh QR", + "errorGeneric": "An error occurred. Please try again." }, "field": { "token": "Bot Token", diff --git a/web/frontend/src/i18n/locales/zh.json b/web/frontend/src/i18n/locales/zh.json index 65f2a5548..e85e4dd44 100644 --- a/web/frontend/src/i18n/locales/zh.json +++ b/web/frontend/src/i18n/locales/zh.json @@ -240,7 +240,23 @@ "pico": "Web", "maixcam": "MaixCam", "matrix": "Matrix", - "irc": "IRC" + "irc": "IRC", + "weixin": "微信" + }, + "weixin": { + "bindTitle": "微信账号绑定", + "bindDesc": "使用微信扫描二维码以绑定您的个人微信账号。", + "bind": "绑定微信", + "rebind": "重新绑定", + "bound": "微信已绑定", + "notBound": "尚未绑定微信账号。", + "generating": "正在生成二维码...", + "scanHint": "打开微信，扫描二维码", + "scanned": "已扫码 — 请在微信中确认", + "expired": "二维码已过期", + "retry": "重试", + "refresh": "刷新二维码", + "errorGeneric": "发生错误，请重试。" }, "field": { "token": "Bot Token", From f2f6987f00c57950b7cf2f1a2298f154e176051f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E7=BE=8E=E9=9B=BB=E7=90=83?= Date: Tue, 24 Mar 2026 19:27:29 +0800 Subject: [PATCH 066/202] test(agent): allow mock custom tool args (#1965) --- pkg/agent/loop_test.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 976d25c4b..1a4a44edf 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -636,8 +636,9 @@ func (m *mockCustomTool) Description() string { func (m *mockCustomTool) Parameters() map[string]any { return map[string]any{ - "type": "object", - "properties": map[string]any{}, + "type": "object", + "properties": map[string]any{}, + "additionalProperties": true, } } From 8b6cbd99090908e2ccbd56e18ca06cf9a9283ee5 Mon Sep 17 00:00:00 2001 From: lxowalle <83055338+lxowalle@users.noreply.github.com> Date: Tue, 24 Mar 2026 20:02:58 +0800 Subject: [PATCH 067/202] Fix: Prevent security.yml from being overwritten during config migration (#1966) --- pkg/config/config.go | 12 ++ pkg/config/migration_integration_test.go | 115 +++++++++++++++++++ pkg/config/security.go | 136 +++++++++++++++++++++++ 3 files changed, 263 insertions(+) diff --git a/pkg/config/config.go b/pkg/config/config.go index b281824ce..84e1ab61a 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -1395,6 +1395,18 @@ func LoadConfig(path string) (*Config, error) { if err != nil { return nil, err } + // Load existing security config and merge with migrated one to prevent data loss + existingSec, secErr := loadSecurityConfig(securityPath(path)) + if secErr != nil { + logger.WarnF("failed to load existing security config during migration", map[string]any{"error": secErr}) + } + if existingSec != nil && cfg.security != nil { + cfg.security = mergeSecurityConfig(existingSec, cfg.security) + // Re-apply the merged security config to update all channels and models + if err = applySecurityConfig(cfg, cfg.security); err != nil { + logger.WarnF("failed to re-apply merged security config during migration", map[string]any{"error": err}) + } + } defer func(cfg *Config) { _ = SaveConfig(path, cfg) }(cfg) diff --git a/pkg/config/migration_integration_test.go b/pkg/config/migration_integration_test.go index c884a6b5d..49d2a5831 100644 --- a/pkg/config/migration_integration_test.go +++ b/pkg/config/migration_integration_test.go @@ -566,3 +566,118 @@ func TestMigration_Integration_ModelNameField(t *testing.T) { t.Errorf("ModelFallbacks[0] = %q, want %q", cfg.Agents.Defaults.ModelFallbacks[0], "deepseek-chat") } } + +// TestMigration_PreservesExistingSecurityConfig tests that when migrating from v0 to v1, +// existing .security.yml values (e.g., loaded from environment variables) are preserved +// and not overwritten by empty values from the legacy config. +func TestMigration_PreservesExistingSecurityConfig(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + securityPath := filepath.Join(tmpDir, ".security.yml") + + // Create a legacy config (version 0) with model_list and channel config + // The model_list doesn't have api_keys, they should come from existing .security.yml + legacyConfig := `{ + "agents": { + "defaults": { + "provider": "openai", + "model": "gpt-4" + } + }, + "model_list": [ + { + "model_name": "openai", + "model": "openai/gpt-4" + } + ], + "channels": { + "telegram": { + "enabled": true + } + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + // Create an existing .security.yml with values that might come from env vars + existingSecurity := `model_list: + openai:0: + api_keys: + - sk-existing-key-from-env +channels: + telegram: + token: existing-telegram-token-from-env + discord: + token: existing-discord-token-from-env +web: + brave: + api_keys: + - existing-brave-key +` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + if err := os.WriteFile(securityPath, []byte(existingSecurity), 0o600); err != nil { + t.Fatalf("Failed to write existing security config: %v", err) + } + + // Load the config - this should trigger migration + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Verify that the migrated config has the existing security values + // Telegram token should be preserved + if cfg.Channels.Telegram.Token() != "existing-telegram-token-from-env" { + t.Errorf("Telegram token was overwritten: got %q, want %q", + cfg.Channels.Telegram.Token(), "existing-telegram-token-from-env") + } + + // Discord token should be preserved (even though legacy config didn't have it) + if cfg.Channels.Discord.Token() != "existing-discord-token-from-env" { + t.Errorf("Discord token was overwritten: got %q, want %q", + cfg.Channels.Discord.Token(), "existing-discord-token-from-env") + } + + // Model API key should be preserved + if cfg.ModelList[0].APIKey() != "sk-existing-key-from-env" { + t.Errorf("Model API key was overwritten: got %q, want %q", + cfg.ModelList[0].APIKey(), "sk-existing-key-from-env") + } + + // Brave API key should be preserved + if cfg.Tools.Web.Brave.APIKey() != "existing-brave-key" { + t.Errorf("Brave API key was overwritten: got %q, want %q", + cfg.Tools.Web.Brave.APIKey(), "existing-brave-key") + } + + // Reload the security config from disk to verify it wasn't corrupted + reloadedSec, err := loadSecurityConfig(securityPath) + if err != nil { + t.Fatalf("Failed to reload security config: %v", err) + } + + if reloadedSec.Channels.Telegram == nil || + reloadedSec.Channels.Telegram.Token != "existing-telegram-token-from-env" { + t.Error("Telegram token not preserved in .security.yml file") + } + + if reloadedSec.Channels.Discord == nil || reloadedSec.Channels.Discord.Token != "existing-discord-token-from-env" { + t.Error("Discord token not preserved in .security.yml file") + } +} diff --git a/pkg/config/security.go b/pkg/config/security.go index 5c71bf8c3..da989ca88 100644 --- a/pkg/config/security.go +++ b/pkg/config/security.go @@ -244,6 +244,142 @@ func saveSecurityConfig(securityPath string, sec *SecurityConfig) error { return fileutil.WriteFileAtomic(securityPath, buf.Bytes(), 0o600) } +// mergeSecurityConfig merges two SecurityConfig instances, preferring non-empty values from 'newer'. +// This is used during config migration to preserve existing security data while adding new entries. +func mergeSecurityConfig(existing, newer *SecurityConfig) *SecurityConfig { + if existing == nil { + return normalizeSecurityConfig(newer) + } + if newer == nil { + return normalizeSecurityConfig(existing) + } + + result := normalizeSecurityConfig(nil) + + // Merge ModelList: prefer newer if it has keys, otherwise use existing + for k, v := range existing.ModelList { + result.ModelList[k] = v + } + for k, v := range newer.ModelList { + if len(v.APIKeys) > 0 { + result.ModelList[k] = v + } + } + + // Merge Channels + if existing.Channels != nil { + result.Channels = existing.Channels + } + if newer.Channels != nil { + if result.Channels == nil { + result.Channels = &ChannelsSecurity{} + } + mergeChannelsSecurity(result.Channels, newer.Channels) + } + + // Merge Web + if existing.Web != nil { + result.Web = existing.Web + } + if newer.Web != nil { + if result.Web == nil { + result.Web = &WebToolsSecurity{} + } + mergeWebToolsSecurity(result.Web, newer.Web) + } + + // Merge Skills + if existing.Skills != nil { + result.Skills = existing.Skills + } + if newer.Skills != nil { + if result.Skills == nil { + result.Skills = &SkillsSecurity{} + } + mergeSkillsSecurity(result.Skills, newer.Skills) + } + + return result +} + +func mergeChannelsSecurity(dst, src *ChannelsSecurity) { + if src.Telegram != nil && src.Telegram.Token != "" { + dst.Telegram = src.Telegram + } + if src.Feishu != nil && + (src.Feishu.AppSecret != "" || src.Feishu.EncryptKey != "" || src.Feishu.VerificationToken != "") { + dst.Feishu = src.Feishu + } + if src.Discord != nil && src.Discord.Token != "" { + dst.Discord = src.Discord + } + if src.Weixin != nil && src.Weixin.Token != "" { + dst.Weixin = src.Weixin + } + if src.QQ != nil && src.QQ.AppSecret != "" { + dst.QQ = src.QQ + } + if src.DingTalk != nil && src.DingTalk.ClientSecret != "" { + dst.DingTalk = src.DingTalk + } + if src.Slack != nil && (src.Slack.BotToken != "" || src.Slack.AppToken != "") { + dst.Slack = src.Slack + } + if src.Matrix != nil && src.Matrix.AccessToken != "" { + dst.Matrix = src.Matrix + } + if src.LINE != nil && (src.LINE.ChannelSecret != "" || src.LINE.ChannelAccessToken != "") { + dst.LINE = src.LINE + } + if src.OneBot != nil && src.OneBot.AccessToken != "" { + dst.OneBot = src.OneBot + } + if src.WeCom != nil && (src.WeCom.Token != "" || src.WeCom.EncodingAESKey != "") { + dst.WeCom = src.WeCom + } + if src.WeComApp != nil && + (src.WeComApp.CorpSecret != "" || src.WeComApp.Token != "" || src.WeComApp.EncodingAESKey != "") { + dst.WeComApp = src.WeComApp + } + if src.WeComAIBot != nil && + (src.WeComAIBot.Secret != "" || src.WeComAIBot.Token != "" || src.WeComAIBot.EncodingAESKey != "") { + dst.WeComAIBot = src.WeComAIBot + } + if src.Pico != nil && src.Pico.Token != "" { + dst.Pico = src.Pico + } + if src.IRC != nil && (src.IRC.Password != "" || src.IRC.NickServPassword != "" || src.IRC.SASLPassword != "") { + dst.IRC = src.IRC + } +} + +func mergeWebToolsSecurity(dst, src *WebToolsSecurity) { + if src.Brave != nil && len(src.Brave.APIKeys) > 0 { + dst.Brave = src.Brave + } + if src.Tavily != nil && len(src.Tavily.APIKeys) > 0 { + dst.Tavily = src.Tavily + } + if src.Perplexity != nil && len(src.Perplexity.APIKeys) > 0 { + dst.Perplexity = src.Perplexity + } + if src.GLMSearch != nil && src.GLMSearch.APIKey != "" { + dst.GLMSearch = src.GLMSearch + } + if src.BaiduSearch != nil && src.BaiduSearch.APIKey != "" { + dst.BaiduSearch = src.BaiduSearch + } +} + +func mergeSkillsSecurity(dst, src *SkillsSecurity) { + if src.Github != nil && src.Github.Token != "" { + dst.Github = src.Github + } + if src.ClawHub != nil && src.ClawHub.AuthToken != "" { + dst.ClawHub = src.ClawHub + } +} + // SensitiveDataCache caches the compiled regex for filtering sensitive data. // SensitiveDataCache caches the strings.Replacer for filtering sensitive data. // Computed once on first access via sync.Once. From a1f95f02bce27788da2a6f2e2da1a8c8a5250f46 Mon Sep 17 00:00:00 2001 From: Hoshina Date: Tue, 24 Mar 2026 15:03:41 +0800 Subject: [PATCH 068/202] refactor(wecom): rebuild ai bot channel --- pkg/agent/loop_test.go | 24 +- pkg/channels/manager.go | 11 +- pkg/channels/manager_channel.go | 21 +- pkg/channels/wecom/aibot.go | 1099 -------------- pkg/channels/wecom/aibot_test.go | 559 ------- pkg/channels/wecom/aibot_ws.go | 1347 ----------------- pkg/channels/wecom/aibot_ws_test.go | 295 ---- pkg/channels/wecom/app.go | 756 --------- pkg/channels/wecom/app_test.go | 1060 ------------- pkg/channels/wecom/bot.go | 499 ------ pkg/channels/wecom/bot_test.go | 734 --------- pkg/channels/wecom/common.go | 199 --- pkg/channels/wecom/dedupe.go | 54 - pkg/channels/wecom/dedupe_test.go | 83 - pkg/channels/wecom/init.go | 8 +- pkg/channels/wecom/media.go | 291 ++++ pkg/channels/wecom/media_test.go | 180 +++ pkg/channels/wecom/protocol.go | 122 ++ pkg/channels/wecom/reqid_store.go | 113 ++ pkg/channels/wecom/reqid_store_test.go | 24 + pkg/channels/wecom/wecom.go | 777 ++++++++++ pkg/channels/wecom/wecom_test.go | 167 ++ pkg/config/config.go | 203 +-- pkg/config/config_old.go | 216 +-- pkg/config/config_test.go | 3 +- pkg/config/defaults.go | 31 +- pkg/config/security.go | 43 +- pkg/config/security_integration_test.go | 42 +- pkg/migrate/sources/openclaw/common.go | 25 +- web/backend/api/channels.go | 2 - web/backend/api/config.go | 9 + .../channels/channel-config-page.tsx | 14 +- .../channels/channel-forms/generic-form.tsx | 10 + .../src/hooks/use-sidebar-channels.ts | 4 - web/frontend/src/i18n/locales/en.json | 2 - web/frontend/src/i18n/locales/zh.json | 2 - 36 files changed, 1833 insertions(+), 7196 deletions(-) delete mode 100644 pkg/channels/wecom/aibot.go delete mode 100644 pkg/channels/wecom/aibot_test.go delete mode 100644 pkg/channels/wecom/aibot_ws.go delete mode 100644 pkg/channels/wecom/aibot_ws_test.go delete mode 100644 pkg/channels/wecom/app.go delete mode 100644 pkg/channels/wecom/app_test.go delete mode 100644 pkg/channels/wecom/bot.go delete mode 100644 pkg/channels/wecom/bot_test.go delete mode 100644 pkg/channels/wecom/common.go delete mode 100644 pkg/channels/wecom/dedupe.go delete mode 100644 pkg/channels/wecom/dedupe_test.go create mode 100644 pkg/channels/wecom/media.go create mode 100644 pkg/channels/wecom/media_test.go create mode 100644 pkg/channels/wecom/protocol.go create mode 100644 pkg/channels/wecom/reqid_store.go create mode 100644 pkg/channels/wecom/reqid_store_test.go create mode 100644 pkg/channels/wecom/wecom.go create mode 100644 pkg/channels/wecom/wecom_test.go diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 1a4a44edf..ee3a3c8bd 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -1495,18 +1495,17 @@ func TestTargetReasoningChannelID_AllChannels(t *testing.T) { t.Fatalf("Failed to create channel manager: %v", err) } for name, id := range map[string]string{ - "whatsapp": "rid-whatsapp", - "telegram": "rid-telegram", - "feishu": "rid-feishu", - "discord": "rid-discord", - "maixcam": "rid-maixcam", - "qq": "rid-qq", - "dingtalk": "rid-dingtalk", - "slack": "rid-slack", - "line": "rid-line", - "onebot": "rid-onebot", - "wecom": "rid-wecom", - "wecom_app": "rid-wecom-app", + "whatsapp": "rid-whatsapp", + "telegram": "rid-telegram", + "feishu": "rid-feishu", + "discord": "rid-discord", + "maixcam": "rid-maixcam", + "qq": "rid-qq", + "dingtalk": "rid-dingtalk", + "slack": "rid-slack", + "line": "rid-line", + "onebot": "rid-onebot", + "wecom": "rid-wecom", } { chManager.RegisterChannel(name, &fakeChannel{id: id}) } @@ -1526,7 +1525,6 @@ func TestTargetReasoningChannelID_AllChannels(t *testing.T) { {channel: "line", wantID: "rid-line"}, {channel: "onebot", wantID: "rid-onebot"}, {channel: "wecom", wantID: "rid-wecom"}, - {channel: "wecom_app", wantID: "rid-wecom-app"}, {channel: "unknown", wantID: ""}, } diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go index f04d989a3..5cc15b4d2 100644 --- a/pkg/channels/manager.go +++ b/pkg/channels/manager.go @@ -371,19 +371,10 @@ func (m *Manager) initChannels(channels *config.ChannelsConfig) error { m.initChannel("onebot", "OneBot") } - if channels.WeCom.Enabled && channels.WeCom.Token() != "" { + if channels.WeCom.Enabled && channels.WeCom.BotID != "" && channels.WeCom.Secret() != "" { m.initChannel("wecom", "WeCom") } - if channels.WeComAIBot.Enabled && (channels.WeComAIBot.Token() != "" || - (channels.WeComAIBot.Secret() != "" && channels.WeComAIBot.BotID != "")) { - m.initChannel("wecom_aibot", "WeCom AI Bot") - } - - if channels.WeComApp.Enabled && channels.WeComApp.CorpID != "" { - m.initChannel("wecom_app", "WeCom App") - } - if channels.Weixin.Enabled && channels.Weixin.Token() != "" { m.initChannel("weixin", "Weixin") } diff --git a/pkg/channels/manager_channel.go b/pkg/channels/manager_channel.go index 86572e336..163218b75 100644 --- a/pkg/channels/manager_channel.go +++ b/pkg/channels/manager_channel.go @@ -49,15 +49,7 @@ func hiddenValues(key string, value map[string]any, ch config.ChannelsConfig) { value["token"] = ch.LINE.ChannelAccessToken() value["secret"] = ch.LINE.ChannelSecret() case "wecom": - value["token"] = ch.WeCom.Token() - value["key"] = ch.WeCom.EncodingAESKey() - case "wecom_app": - value["token"] = ch.WeComApp.Token() - value["secret"] = ch.WeComApp.CorpSecret() - case "wecom_aibot": - value["token"] = ch.WeComAIBot.Token() - value["key"] = ch.WeComAIBot.EncodingAESKey() - value["secret"] = ch.WeComAIBot.Secret() + value["secret"] = ch.WeCom.Secret() case "dingtalk": value["secret"] = ch.QQ.AppSecret() case "qq": @@ -156,16 +148,7 @@ func updateKeys(newcfg, old *config.ChannelsConfig) { newcfg.LINE.SetChannelSecret(old.LINE.ChannelSecret()) } if newcfg.WeCom.Enabled { - newcfg.WeCom.SetToken(old.WeCom.Token()) - newcfg.WeCom.SetEncodingAESKey(old.WeCom.EncodingAESKey()) - } - if newcfg.WeComApp.Enabled { - newcfg.WeComApp.SetToken(old.WeComApp.Token()) - newcfg.WeComApp.SetCorpSecret(old.WeComApp.CorpSecret()) - } - if newcfg.WeComAIBot.Enabled { - newcfg.WeComAIBot.SetToken(old.WeComAIBot.Token()) - newcfg.WeComAIBot.SetEncodingAESKey(old.WeComAIBot.EncodingAESKey()) + newcfg.WeCom.SetSecret(old.WeCom.Secret()) } if newcfg.DingTalk.Enabled { newcfg.DingTalk.SetClientSecret(old.DingTalk.ClientSecret()) diff --git a/pkg/channels/wecom/aibot.go b/pkg/channels/wecom/aibot.go deleted file mode 100644 index c5e148185..000000000 --- a/pkg/channels/wecom/aibot.go +++ /dev/null @@ -1,1099 +0,0 @@ -package wecom - -import ( - "bytes" - "context" - "crypto/rand" - "encoding/base64" - "encoding/json" - "fmt" - "io" - "math/big" - "net/http" - "strings" - "sync" - "time" - - "github.com/sipeed/picoclaw/pkg/bus" - "github.com/sipeed/picoclaw/pkg/channels" - "github.com/sipeed/picoclaw/pkg/config" - "github.com/sipeed/picoclaw/pkg/identity" - "github.com/sipeed/picoclaw/pkg/logger" - "github.com/sipeed/picoclaw/pkg/utils" -) - -// responseURLHTTPClient is a shared HTTP client for posting to WeCom response_url. -// Reusing it enables connection pooling across replies. -var responseURLHTTPClient = &http.Client{Timeout: 15 * time.Second} - -// WeComAIBotChannel implements the Channel interface for WeCom AI Bot (企业微信智能机器人) -type WeComAIBotChannel struct { - *channels.BaseChannel - config config.WeComAIBotConfig - ctx context.Context - cancel context.CancelFunc - streamTasks map[string]*streamTask // streamID -> task (for poll lookups) - chatTasks map[string][]*streamTask // chatID -> in-flight tasks queue (FIFO) - taskMu sync.RWMutex -} - -// streamTask represents a streaming task for AI Bot. -// -// Mutable fields (Finished, StreamClosed, StreamClosedAt) must be read/written -// while holding WeComAIBotChannel.taskMu. Immutable fields (StreamID, ChatID, -// ResponseURL, Question, CreatedTime, Deadline, answerCh, ctx, cancel) are set -// once at creation and never modified, so they are safe to read without a lock. -type streamTask struct { - // immutable after creation - StreamID string - ChatID string // used by Send() to find this task - ResponseURL string // temporary URL for proactive reply (valid 1 hour, use once) - Question string - CreatedTime time.Time - Deadline time.Time // ~30s, we close the stream here and switch to response_url - answerCh chan string // receives agent reply from Send() - ctx context.Context // canceled when task is removed; used to interrupt the agent goroutine - cancel context.CancelFunc // call on task removal to cancel ctx - - // mutable — guarded by WeComAIBotChannel.taskMu - StreamClosed bool // stream returned finish:true; waiting for agent to reply via response_url - StreamClosedAt time.Time // set when StreamClosed becomes true; used for accelerated cleanup - Finished bool // fully done -} - -// WeComAIBotMessage represents the decrypted JSON message from WeCom AI Bot -// Ref: https://developer.work.weixin.qq.com/document/path/100719 -type WeComAIBotMessage struct { - MsgID string `json:"msgid"` - AIBotID string `json:"aibotid"` - ChatID string `json:"chatid"` // only for group chat - ChatType string `json:"chattype"` // "single" or "group" - From struct { - UserID string `json:"userid"` - } `json:"from"` - ResponseURL string `json:"response_url"` // temporary URL for proactive reply - MsgType string `json:"msgtype"` - // text message - Text *struct { - Content string `json:"content"` - } `json:"text,omitempty"` - // stream polling refresh - Stream *struct { - ID string `json:"id"` - } `json:"stream,omitempty"` - // image message - Image *struct { - URL string `json:"url"` - } `json:"image,omitempty"` - // mixed message (text + image) - Mixed *struct { - MsgItem []struct { - MsgType string `json:"msgtype"` - Text *struct { - Content string `json:"content"` - } `json:"text,omitempty"` - Image *struct { - URL string `json:"url"` - } `json:"image,omitempty"` - } `json:"msg_item"` - } `json:"mixed,omitempty"` - // event field - Event *struct { - EventType string `json:"eventtype"` - } `json:"event,omitempty"` -} - -// WeComAIBotMsgItemImage holds the image payload inside a stream message item. -type WeComAIBotMsgItemImage struct { - Base64 string `json:"base64"` - MD5 string `json:"md5"` -} - -// WeComAIBotMsgItem is a single item inside a stream's msg_item list. -type WeComAIBotMsgItem struct { - MsgType string `json:"msgtype"` - Image *WeComAIBotMsgItemImage `json:"image,omitempty"` -} - -// WeComAIBotStreamInfo represents the detailed stream content in streaming responses. -type WeComAIBotStreamInfo struct { - ID string `json:"id"` - Finish bool `json:"finish"` - Content string `json:"content,omitempty"` - MsgItem []WeComAIBotMsgItem `json:"msg_item,omitempty"` -} - -// WeComAIBotStreamResponse represents the streaming response format -type WeComAIBotStreamResponse struct { - MsgType string `json:"msgtype"` - Stream WeComAIBotStreamInfo `json:"stream"` -} - -// WeComAIBotEncryptedResponse represents the encrypted response wrapper -// Fields match WXBizJsonMsgCrypt.generate() in Python SDK -type WeComAIBotEncryptedResponse struct { - Encrypt string `json:"encrypt"` - MsgSignature string `json:"msgsignature"` - Timestamp string `json:"timestamp"` - Nonce string `json:"nonce"` -} - -// NewWeComAIBotChannel creates a WeCom AI Bot channel instance. -// If cfg.BotID and cfg.secret are both set, it returns a WeComAIBotWSChannel -// using the WebSocket long-connection API. -// Otherwise it returns the webhook-mode WeComAIBotChannel (requires Token + -// EncodingAESKey). -func NewWeComAIBotChannel( - cfg config.WeComAIBotConfig, - messageBus *bus.MessageBus, -) (channels.Channel, error) { - // WebSocket long-connection mode takes priority when BotID + secret are set. - if cfg.BotID != "" && cfg.Secret() != "" { - logger.InfoC("wecom_aibot", "BotID and secret provided, using WebSocket mode") - return newWeComAIBotWSChannel(cfg, messageBus) - } - // Webhook (short-connection) mode. - if cfg.Token() == "" || cfg.EncodingAESKey() == "" { - return nil, fmt.Errorf( - "WeCom AI Bot requires either (bot_id + secret) for WebSocket mode " + - "or (token + encoding_aes_key) for webhook mode") - } - if cfg.ProcessingMessage == "" { - cfg.ProcessingMessage = config.DefaultWeComAIBotProcessingMessage - } - - base := channels.NewBaseChannel("wecom_aibot", cfg, messageBus, cfg.AllowFrom, - channels.WithMaxMessageLength(2048), - channels.WithReasoningChannelID(cfg.ReasoningChannelID), - ) - - return &WeComAIBotChannel{ - BaseChannel: base, - config: cfg, - streamTasks: make(map[string]*streamTask), - chatTasks: make(map[string][]*streamTask), - }, nil -} - -// Name returns the channel name -func (c *WeComAIBotChannel) Name() string { - return "wecom_aibot" -} - -// Start initializes the WeCom AI Bot channel -func (c *WeComAIBotChannel) Start(ctx context.Context) error { - logger.InfoC("wecom_aibot", "Starting WeCom AI Bot channel...") - - c.ctx, c.cancel = context.WithCancel(ctx) - - // Start cleanup goroutine for old tasks - go c.cleanupLoop() - - c.SetRunning(true) - logger.InfoC("wecom_aibot", "WeCom AI Bot channel started") - - return nil -} - -// Stop gracefully stops the WeCom AI Bot channel -func (c *WeComAIBotChannel) Stop(ctx context.Context) error { - logger.InfoC("wecom_aibot", "Stopping WeCom AI Bot channel...") - - if c.cancel != nil { - c.cancel() - } - - c.SetRunning(false) - logger.InfoC("wecom_aibot", "WeCom AI Bot channel stopped") - return nil -} - -// Send delivers the agent reply into the active streamTask for msg.ChatID. -// It writes into the earliest unfinished task in the queue (FIFO per chatID). -// If the stream has already closed (deadline passed), it posts directly to response_url. -func (c *WeComAIBotChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { - if !c.IsRunning() { - return channels.ErrNotRunning - } - c.taskMu.Lock() - queue := c.chatTasks[msg.ChatID] - // Only compact Finished tasks at the head of the queue. - // Tasks that are Finished in the middle are NOT removed here: doing a full - // scan on every Send() call would be O(n) and is unnecessary given that - // removeTask() always splices the task out of the queue immediately. - // Any Finished task left stranded in the middle (e.g. due to an unexpected - // code path) will be collected by cleanupOldTasks. - for len(queue) > 0 && queue[0].Finished { - queue = queue[1:] - } - c.chatTasks[msg.ChatID] = queue - var task *streamTask - var streamClosed bool - var responseURL string - if len(queue) > 0 { - task = queue[0] - // Read mutable fields while holding c.taskMu to avoid data races. - streamClosed = task.StreamClosed - responseURL = task.ResponseURL - } - c.taskMu.Unlock() - - if task == nil { - logger.DebugCF( - "wecom_aibot", - "Send: no active task for chat (may have timed out)", - map[string]any{ - "chat_id": msg.ChatID, - }, - ) - return nil - } - - if streamClosed { - // Stream already ended with a "please wait" notice; send the real reply via response_url. - // Note: task.StreamID and task.ChatID are immutable, safe to read without a lock. - logger.InfoCF("wecom_aibot", "Sending reply via response_url", map[string]any{ - "stream_id": task.StreamID, - "chat_id": msg.ChatID, - }) - if responseURL != "" { - if err := c.sendViaResponseURL(responseURL, msg.Content); err != nil { - logger.ErrorCF("wecom_aibot", "Failed to send via response_url", map[string]any{ - "error": err, - "stream_id": task.StreamID, - }) - c.removeTask(task) - return fmt.Errorf("response_url delivery failed: %w", channels.ErrSendFailed) - } - } else { - logger.WarnCF("wecom_aibot", "Stream closed but no response_url available", map[string]any{ - "stream_id": task.StreamID, - }) - } - c.removeTask(task) - return nil - } - - // Stream still open: deliver via answerCh for the next poll response. - select { - case task.answerCh <- msg.Content: - case <-task.ctx.Done(): - // Task was canceled (cleanup removed it); silently drop the reply. - return nil - case <-ctx.Done(): - return ctx.Err() - } - return nil -} - -// WebhookPath returns the path for registering on the shared HTTP server -func (c *WeComAIBotChannel) WebhookPath() string { - if c.config.WebhookPath == "" { - return "/webhook/wecom-aibot" - } - return c.config.WebhookPath -} - -// ServeHTTP implements http.Handler for the shared HTTP server -func (c *WeComAIBotChannel) ServeHTTP(w http.ResponseWriter, r *http.Request) { - c.handleWebhook(w, r) -} - -// HealthPath returns the health check endpoint path -func (c *WeComAIBotChannel) HealthPath() string { - return c.WebhookPath() + "/health" -} - -// HealthHandler handles health check requests -func (c *WeComAIBotChannel) HealthHandler(w http.ResponseWriter, r *http.Request) { - c.handleHealth(w, r) -} - -// handleWebhook handles incoming webhook requests from WeCom AI Bot -func (c *WeComAIBotChannel) handleWebhook(w http.ResponseWriter, r *http.Request) { - ctx := r.Context() - - // Log all incoming requests for debugging - logger.DebugCF("wecom_aibot", "Received webhook request", map[string]any{ - "method": r.Method, - "path": r.URL.Path, - "query": r.URL.RawQuery, - }) - - switch r.Method { - case http.MethodGet: - // URL verification - c.handleVerification(ctx, w, r) - case http.MethodPost: - // Message callback - c.handleMessageCallback(ctx, w, r) - default: - http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) - } -} - -// handleVerification handles the URL verification request from WeCom -func (c *WeComAIBotChannel) handleVerification( - ctx context.Context, - w http.ResponseWriter, - r *http.Request, -) { - msgSignature := r.URL.Query().Get("msg_signature") - timestamp := r.URL.Query().Get("timestamp") - nonce := r.URL.Query().Get("nonce") - echostr := r.URL.Query().Get("echostr") - - logger.DebugCF("wecom_aibot", "URL verification request", map[string]any{ - "msg_signature": msgSignature, - "timestamp": timestamp, - "nonce": nonce, - }) - - // Verify signature - if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, echostr) { - logger.ErrorC("wecom_aibot", "Signature verification failed") - http.Error(w, "Signature verification failed", http.StatusUnauthorized) - return - } - - // Decrypt echostr - // For WeCom AI Bot (智能机器人), receiveid should be empty string - decrypted, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey(), "") - if err != nil { - logger.ErrorCF("wecom_aibot", "Failed to decrypt echostr", map[string]any{ - "error": err, - }) - http.Error(w, "Decryption failed", http.StatusInternalServerError) - return - } - - // Remove BOM and whitespace as per WeCom documentation - decrypted = strings.TrimPrefix(decrypted, "\ufeff") - decrypted = strings.TrimSpace(decrypted) - - logger.InfoC("wecom_aibot", "URL verification successful") - w.Header().Set("Content-Type", "text/plain; charset=utf-8") - w.WriteHeader(http.StatusOK) - w.Write([]byte(decrypted)) -} - -// handleMessageCallback handles incoming messages from WeCom AI Bot -func (c *WeComAIBotChannel) handleMessageCallback( - ctx context.Context, - w http.ResponseWriter, - r *http.Request, -) { - msgSignature := r.URL.Query().Get("msg_signature") - timestamp := r.URL.Query().Get("timestamp") - nonce := r.URL.Query().Get("nonce") - - // Read request body (limit to 4 MB to prevent memory exhaustion) - const maxBodySize = 4 << 20 // 4 MB - body, err := io.ReadAll(io.LimitReader(r.Body, maxBodySize+1)) - if err != nil { - logger.ErrorCF("wecom_aibot", "Failed to read request body", map[string]any{ - "error": err, - }) - http.Error(w, "Failed to read body", http.StatusBadRequest) - return - } - if len(body) > maxBodySize { - http.Error(w, "Request body too large", http.StatusRequestEntityTooLarge) - return - } - - // Parse JSON body to get encrypted message - // Format: {"encrypt": "base64_encrypted_string"} - var encryptedMsg struct { - Encrypt string `json:"encrypt"` - } - if unmarshalErr := json.Unmarshal(body, &encryptedMsg); unmarshalErr != nil { - logger.ErrorCF("wecom_aibot", "Failed to parse JSON body", map[string]any{ - "error": unmarshalErr, - "body": string(body), - }) - http.Error(w, "Failed to parse JSON", http.StatusBadRequest) - return - } - - // Verify signature - if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { - logger.ErrorC("wecom_aibot", "Signature verification failed") - http.Error(w, "Signature verification failed", http.StatusUnauthorized) - return - } - - // Decrypt message - // For WeCom AI Bot (智能机器人), receiveid is empty string - decrypted, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey(), "") - if err != nil { - logger.ErrorCF("wecom_aibot", "Failed to decrypt message", map[string]any{ - "error": err, - }) - http.Error(w, "Decryption failed", http.StatusInternalServerError) - return - } - - // Parse decrypted JSON message - var msg WeComAIBotMessage - if unmarshalErr := json.Unmarshal([]byte(decrypted), &msg); unmarshalErr != nil { - logger.ErrorCF("wecom_aibot", "Failed to parse decrypted JSON", map[string]any{ - "error": unmarshalErr, - "decrypted": decrypted, - }) - http.Error(w, "Failed to parse message", http.StatusInternalServerError) - return - } - - logger.DebugCF("wecom_aibot", "Decrypted message", map[string]any{ - "msgtype": msg.MsgType, - }) - - // Process the message and get streaming response - response := c.processMessage(ctx, msg, timestamp, nonce) - - // Check if response is empty (e.g. due to unsupported message type) - if response == "" { - response = c.encryptEmptyResponse(timestamp, nonce) - } - - // Return encrypted JSON response - w.Header().Set("Content-Type", "application/json; charset=utf-8") - w.WriteHeader(http.StatusOK) - w.Write([]byte(response)) -} - -// processMessage processes the received message and returns encrypted response -func (c *WeComAIBotChannel) processMessage( - ctx context.Context, - msg WeComAIBotMessage, - timestamp, nonce string, -) string { - logger.DebugCF("wecom_aibot", "Processing message", map[string]any{ - "msgtype": msg.MsgType, - }) - - switch msg.MsgType { - case "text": - return c.handleTextMessage(ctx, msg, timestamp, nonce) - case "stream": - return c.handleStreamMessage(ctx, msg, timestamp, nonce) - case "image": - return c.handleImageMessage(ctx, msg, timestamp, nonce) - case "mixed": - return c.handleMixedMessage(ctx, msg, timestamp, nonce) - case "event": - return c.handleEventMessage(ctx, msg, timestamp, nonce) - default: - logger.WarnCF("wecom_aibot", "Unsupported message type", map[string]any{ - "msgtype": msg.MsgType, - }) - return c.encryptResponse("", timestamp, nonce, WeComAIBotStreamResponse{ - MsgType: "stream", - Stream: WeComAIBotStreamInfo{ - ID: c.generateStreamID(), - Finish: true, - Content: "Unsupported message type: " + msg.MsgType, - }, - }) - } -} - -// handleTextMessage handles text messages by starting a new streaming task -func (c *WeComAIBotChannel) handleTextMessage( - ctx context.Context, - msg WeComAIBotMessage, - timestamp, nonce string, -) string { - if msg.Text == nil { - logger.ErrorC("wecom_aibot", "text message missing text field") - return c.encryptEmptyResponse(timestamp, nonce) - } - - content := msg.Text.Content - userID := msg.From.UserID - if userID == "" { - userID = "unknown" - } - - // chatID: group chat uses chatid, single chat uses userid - chatID := msg.ChatID - if chatID == "" { - chatID = userID - } - - streamID := c.generateStreamID() - - // WeCom stops sending stream-refresh callbacks after 6 minutes. - // Set a slightly shorter deadline so we can send a timeout notice before it gives up. - deadline := time.Now().Add(30 * time.Second) - - // Each task gets its own context derived from the channel lifetime context. - // Canceling taskCancel interrupts the agent goroutine when the task is removed. - taskCtx, taskCancel := context.WithCancel(c.ctx) - - task := &streamTask{ - StreamID: streamID, - ChatID: chatID, - ResponseURL: msg.ResponseURL, - Question: content, - CreatedTime: time.Now(), - Deadline: deadline, - Finished: false, - answerCh: make(chan string, 1), - ctx: taskCtx, - cancel: taskCancel, - } - - c.taskMu.Lock() - c.streamTasks[streamID] = task - c.chatTasks[chatID] = append(c.chatTasks[chatID], task) - c.taskMu.Unlock() - - // Publish to agent asynchronously; agent will call Send() with reply. - // Use task.ctx (not c.ctx) so the agent goroutine is canceled when the task is removed. - go func() { - sender := bus.SenderInfo{ - Platform: "wecom_aibot", - PlatformID: userID, - CanonicalID: identity.BuildCanonicalID("wecom_aibot", userID), - DisplayName: userID, - } - peerKind := "direct" - if msg.ChatType == "group" { - peerKind = "group" - } - peer := bus.Peer{Kind: peerKind, ID: chatID} - metadata := map[string]string{ - "channel": "wecom_aibot", - "chat_type": msg.ChatType, - "msg_type": "text", - "msgid": msg.MsgID, - "aibotid": msg.AIBotID, - "stream_id": streamID, - "response_url": msg.ResponseURL, - } - c.HandleMessage(task.ctx, peer, msg.MsgID, userID, chatID, - content, nil, metadata, sender) - }() - - // Return first streaming response immediately (finish=false, content empty) - return c.getStreamResponse(task, timestamp, nonce) -} - -// handleStreamMessage handles stream polling requests -func (c *WeComAIBotChannel) handleStreamMessage( - ctx context.Context, - msg WeComAIBotMessage, - timestamp, nonce string, -) string { - if msg.Stream == nil { - logger.ErrorC("wecom_aibot", "Stream message missing stream field") - return c.encryptEmptyResponse(timestamp, nonce) - } - - streamID := msg.Stream.ID - - c.taskMu.RLock() - task, exists := c.streamTasks[streamID] - c.taskMu.RUnlock() - - if !exists { - logger.DebugCF( - "wecom_aibot", - "Stream task not found (may be from previous session)", - map[string]any{ - "stream_id": streamID, - }, - ) - return c.encryptResponse(streamID, timestamp, nonce, WeComAIBotStreamResponse{ - MsgType: "stream", - Stream: WeComAIBotStreamInfo{ - ID: streamID, - Finish: true, - Content: "Task not found or already finished. Please resend your message to start a new session.", - }, - }) - } - - // Get next response - return c.getStreamResponse(task, timestamp, nonce) -} - -// handleImageMessage handles image messages -func (c *WeComAIBotChannel) handleImageMessage( - ctx context.Context, - msg WeComAIBotMessage, - timestamp, nonce string, -) string { - logger.WarnC("wecom_aibot", "Image message type not yet fully implemented") - if msg.Image == nil { - logger.ErrorC("wecom_aibot", "Image message missing image field") - return c.encryptEmptyResponse(timestamp, nonce) - } - - imageURL := msg.Image.URL - - // For now, just acknowledge receipt without echoing the image - return c.encryptResponse("", timestamp, nonce, WeComAIBotStreamResponse{ - MsgType: "stream", - Stream: WeComAIBotStreamInfo{ - ID: c.generateStreamID(), - Finish: true, - Content: fmt.Sprintf( - "Image received (URL: %s), but image messages are not yet supported", - imageURL, - ), - }, - }) -} - -// handleMixedMessage handles mixed (text + image) messages -func (c *WeComAIBotChannel) handleMixedMessage( - ctx context.Context, - msg WeComAIBotMessage, - timestamp, nonce string, -) string { - logger.WarnC("wecom_aibot", "Mixed message type not yet fully implemented") - return c.encryptResponse("", timestamp, nonce, WeComAIBotStreamResponse{ - MsgType: "stream", - Stream: WeComAIBotStreamInfo{ - ID: c.generateStreamID(), - Finish: true, - Content: "Mixed message type is not yet supported", - }, - }) -} - -// handleEventMessage handles event messages -func (c *WeComAIBotChannel) handleEventMessage( - ctx context.Context, - msg WeComAIBotMessage, - timestamp, nonce string, -) string { - eventType := "" - if msg.Event != nil { - eventType = msg.Event.EventType - } - logger.DebugCF("wecom_aibot", "Received event", map[string]any{ - "event_type": eventType, - }) - - // Send welcome message when user opens the chat window - if eventType == "enter_chat" && c.config.WelcomeMessage != "" { - streamID := c.generateStreamID() - return c.encryptResponse(streamID, timestamp, nonce, WeComAIBotStreamResponse{ - MsgType: "stream", - Stream: WeComAIBotStreamInfo{ - ID: streamID, - Finish: true, - Content: c.config.WelcomeMessage, - }, - }) - } - - return c.encryptEmptyResponse(timestamp, nonce) -} - -// getStreamResponse gets the next streaming response for a task. -// - If agent replied: return finish=true with the real answer. -// - If deadline passed: return finish=true with a "please wait" notice, keep task alive for response_url. -// - Otherwise: return finish=false (empty), client will poll again. -func (c *WeComAIBotChannel) getStreamResponse(task *streamTask, timestamp, nonce string) string { - var content string - var finish bool - var closeStreamOnly bool // close stream but do NOT remove task (response_url still pending) - - select { - case answer := <-task.answerCh: - // Agent replied before deadline — normal finish. - content = answer - finish = true - default: - if time.Now().After(task.Deadline) { - // Deadline reached: close the stream with a notice, then wait for agent via response_url. - content = c.config.ProcessingMessage - finish = true - closeStreamOnly = true - logger.InfoCF( - "wecom_aibot", - "Stream deadline reached, switching to response_url mode", - map[string]any{ - "stream_id": task.StreamID, - "chat_id": task.ChatID, - "response_url": task.ResponseURL != "", - }, - ) - } - // else: still waiting, return finish=false - } - - if finish && !closeStreamOnly { - // Normal finish: remove from all maps. - c.removeTask(task) - } else if closeStreamOnly { - // Mark stream as closed and remove from streamTasks under a single lock - // to keep StreamClosed/StreamClosedAt consistent with map membership. - c.taskMu.Lock() - task.StreamClosed = true - task.StreamClosedAt = time.Now() - delete(c.streamTasks, task.StreamID) - c.taskMu.Unlock() - } - - response := WeComAIBotStreamResponse{ - MsgType: "stream", - Stream: WeComAIBotStreamInfo{ - ID: task.StreamID, - Finish: finish, - Content: content, - }, - } - - return c.encryptResponse(task.StreamID, timestamp, nonce, response) -} - -// removeTask removes a task from both streamTasks and chatTasks, marks it finished, -// and cancels its context to interrupt the associated agent goroutine. -func (c *WeComAIBotChannel) removeTask(task *streamTask) { - // Cancel first so the agent goroutine stops as soon as possible, - // before we acquire the write lock. - task.cancel() - - c.taskMu.Lock() - task.Finished = true // written under c.taskMu, consistent with all readers - delete(c.streamTasks, task.StreamID) - queue := c.chatTasks[task.ChatID] - for i, t := range queue { - if t == task { - c.chatTasks[task.ChatID] = append(queue[:i], queue[i+1:]...) - break - } - } - if len(c.chatTasks[task.ChatID]) == 0 { - delete(c.chatTasks, task.ChatID) - } - c.taskMu.Unlock() -} - -// sendViaResponseURL posts a markdown reply to the WeCom response_url. -// response_url is valid for 1 hour and can only be used once per callback. -// Returned errors are wrapped with channels.ErrRateLimit, channels.ErrTemporary, -// or channels.ErrSendFailed so the manager can apply the right retry policy. -func (c *WeComAIBotChannel) sendViaResponseURL(responseURL, content string) error { - payload := map[string]any{ - "msgtype": "markdown", - "markdown": map[string]string{ - "content": content, - }, - } - body, err := json.Marshal(payload) - if err != nil { - return fmt.Errorf("failed to marshal payload: %w", err) - } - - ctx, cancel := context.WithTimeout(c.ctx, 15*time.Second) - defer cancel() - - req, err := http.NewRequestWithContext(ctx, http.MethodPost, responseURL, bytes.NewBuffer(body)) - if err != nil { - return fmt.Errorf("failed to create request: %w", err) - } - req.Header.Set("Content-Type", "application/json; charset=utf-8") - - resp, err := responseURLHTTPClient.Do(req) - if err != nil { - return fmt.Errorf("post to response_url failed: %w: %w", channels.ErrTemporary, err) - } - defer resp.Body.Close() - - if resp.StatusCode == http.StatusOK { - return nil - } - - const maxErrBody = 64 << 10 // 64 KB is more than enough for any error response - respBody, err := io.ReadAll(io.LimitReader(resp.Body, maxErrBody)) - if err != nil { - return fmt.Errorf("reading response_url body: %w: %w", channels.ErrTemporary, err) - } - switch { - case resp.StatusCode == http.StatusTooManyRequests: - return fmt.Errorf("response_url rate limited (%d): %s: %w", - resp.StatusCode, respBody, channels.ErrRateLimit) - case resp.StatusCode >= 500: - return fmt.Errorf("response_url server error (%d): %s: %w", - resp.StatusCode, respBody, channels.ErrTemporary) - default: - return fmt.Errorf("response_url returned %d: %s: %w", - resp.StatusCode, respBody, channels.ErrSendFailed) - } -} - -// encryptResponse encrypts a streaming response -func (c *WeComAIBotChannel) encryptResponse( - streamID, timestamp, nonce string, - response WeComAIBotStreamResponse, -) string { - // Marshal response to JSON - plaintext, err := json.Marshal(response) - if err != nil { - logger.ErrorCF("wecom_aibot", "Failed to marshal response", map[string]any{ - "error": err, - }) - return "" - } - - logger.DebugCF("wecom_aibot", "Encrypting response", map[string]any{ - "stream_id": streamID, - "finish": response.Stream.Finish, - "preview": utils.Truncate(response.Stream.Content, 100), - }) - - // Encrypt message - encrypted, err := c.encryptMessage(string(plaintext), "") - if err != nil { - logger.ErrorCF("wecom_aibot", "Failed to encrypt message", map[string]any{ - "error": err, - }) - return "" - } - - // Generate signature - signature := computeSignature(c.config.Token(), timestamp, nonce, encrypted) - - // Build encrypted response - encryptedResp := WeComAIBotEncryptedResponse{ - Encrypt: encrypted, - MsgSignature: signature, - Timestamp: timestamp, - Nonce: nonce, - } - - respJSON, err := json.Marshal(encryptedResp) - if err != nil { - logger.ErrorCF("wecom_aibot", "Failed to marshal encrypted response", map[string]any{ - "error": err, - }) - return "" - } - - logger.DebugCF("wecom_aibot", "Response encrypted", map[string]any{ - "stream_id": streamID, - }) - - return string(respJSON) -} - -// encryptEmptyResponse returns a minimal valid encrypted response -func (c *WeComAIBotChannel) encryptEmptyResponse(timestamp, nonce string) string { - // Construct a zero-value stream response and encrypt it so that - // WeCom always receives a syntactically valid encrypted JSON object. - emptyResp := WeComAIBotStreamResponse{} - return c.encryptResponse("", timestamp, nonce, emptyResp) -} - -// encryptMessage encrypts a plain text message for WeCom AI Bot -func (c *WeComAIBotChannel) encryptMessage(plaintext, receiveid string) (string, error) { - aesKey, err := decodeWeComAESKey(c.config.EncodingAESKey()) - if err != nil { - return "", err - } - - frame, err := packWeComFrame(plaintext, receiveid) - if err != nil { - return "", err - } - - // PKCS7 padding then AES-CBC encrypt - paddedFrame := pkcs7Pad(frame, blockSize) - ciphertext, err := encryptAESCBC(aesKey, paddedFrame) - if err != nil { - return "", err - } - - return base64.StdEncoding.EncodeToString(ciphertext), nil -} - -// func (c *WeComAIBotChannel) downloadAndDecryptImage( -// ctx context.Context, -// imageURL string, -// ) ([]byte, error) { -// // Download image -// req, err := http.NewRequestWithContext(ctx, http.MethodGet, imageURL, nil) -// if err != nil { -// return nil, fmt.Errorf("failed to create request: %w", err) -// } - -// client := &http.Client{ -// Timeout: 15 * time.Second, -// } - -// resp, err := client.Do(req) -// if err != nil { -// return nil, fmt.Errorf("failed to download image: %w", err) -// } -// defer resp.Body.Close() - -// if resp.StatusCode != http.StatusOK { -// return nil, fmt.Errorf("download failed with status: %d", resp.StatusCode) -// } - -// // Limit image download to 20 MB to prevent memory exhaustion -// const maxImageSize = 20 << 20 // 20 MB -// encryptedData, err := io.ReadAll(io.LimitReader(resp.Body, maxImageSize+1)) -// if err != nil { -// return nil, fmt.Errorf("failed to read image data: %w", err) -// } -// if len(encryptedData) > maxImageSize { -// return nil, fmt.Errorf("image too large (exceeds %d MB)", maxImageSize>>20) -// } - -// logger.DebugCF("wecom_aibot", "Image downloaded", map[string]any{ -// "size": len(encryptedData), -// }) - -// // Decode AES key -// aesKey, err := decodeWeComAESKey(c.config.EncodingAESKey) -// if err != nil { -// return nil, err -// } - -// // Decrypt image (AES-CBC with IV = first 16 bytes of key, PKCS7 padding stripped) -// decryptedData, err := decryptAESCBC(aesKey, encryptedData) -// if err != nil { -// return nil, fmt.Errorf("failed to decrypt image: %w", err) -// } - -// logger.DebugCF("wecom_aibot", "Image decrypted", map[string]any{ -// "size": len(decryptedData), -// }) - -// return decryptedData, nil -// } - -// generateRandomID generates a cryptographically random alphanumeric ID of -// length n. Used for stream IDs and WebSocket request IDs. -func generateRandomID(n int) string { - const letters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" - b := make([]byte, n) - for i := range b { - num, _ := rand.Int(rand.Reader, big.NewInt(int64(len(letters)))) - b[i] = letters[num.Int64()] - } - return string(b) -} - -// generateStreamID generates a random 10-character stream ID (webhook mode). -func (c *WeComAIBotChannel) generateStreamID() string { - return generateRandomID(10) -} - -// cleanupLoop periodically cleans up old streaming tasks -func (c *WeComAIBotChannel) cleanupLoop() { - ticker := time.NewTicker(5 * time.Minute) - defer ticker.Stop() - - for { - select { - case <-ticker.C: - c.cleanupOldTasks() - case <-c.ctx.Done(): - return - } - } -} - -// cleanupOldTasks removes tasks that have exceeded their expected lifetime: -// - Active tasks (in streamTasks): cleaned up after 1 hour (response_url validity window). -// - StreamClosed tasks (in chatTasks only): cleaned up after streamClosedGracePeriod. -// These tasks are waiting for the agent to call Send() via response_url. If the agent -// crashes or times out without calling Send(), we must not let them accumulate indefinitely. -// The grace period is generous enough to cover typical LLM latency but far shorter than 1 hour, -// preventing chatTasks from filling up when many requests time out in quick succession. -const ( - streamClosedGracePeriod = 10 * time.Minute // max wait for agent after stream closes - taskMaxLifetime = 1 * time.Hour // absolute max (≈ response_url validity) -) - -func (c *WeComAIBotChannel) cleanupOldTasks() { - c.taskMu.Lock() - defer c.taskMu.Unlock() - - now := time.Now() - cutoff := now.Add(-taskMaxLifetime) - for id, task := range c.streamTasks { - if task.CreatedTime.Before(cutoff) { - delete(c.streamTasks, id) - task.cancel() // interrupt agent goroutine still waiting for LLM - queue := c.chatTasks[task.ChatID] - for i, t := range queue { - if t == task { - c.chatTasks[task.ChatID] = append(queue[:i], queue[i+1:]...) - break - } - } - if len(c.chatTasks[task.ChatID]) == 0 { - delete(c.chatTasks, task.ChatID) - } - logger.DebugCF("wecom_aibot", "Cleaned up expired task", map[string]any{ - "stream_id": id, - }) - } - } - // Clean up StreamClosed tasks from chatTasks. - // Two expiry conditions are checked: - // 1. Absolute expiry: task was created more than taskMaxLifetime ago. - // 2. Grace expiry: stream closed more than streamClosedGracePeriod ago - // (agent had enough time to reply; it is not coming back). - for chatID, queue := range c.chatTasks { - filtered := queue[:0] - for i, t := range queue { - absoluteExpired := t.CreatedTime.Before(cutoff) - graceExpired := t.StreamClosed && - !t.StreamClosedAt.IsZero() && - t.StreamClosedAt.Before(now.Add(-streamClosedGracePeriod)) - if t.Finished { - // Finished tasks should have been removed by removeTask(). - // Finding one here (especially not at position 0) means an - // unexpected code path left it stranded, causing the queue to - // grow silently. Log a warning so it is visible, then drop it. - if i > 0 { - logger.WarnCF("wecom_aibot", - "Found stranded Finished task in the middle of chatTasks queue; "+ - "this should not happen — removeTask() should have spliced it out", - map[string]any{ - "chat_id": chatID, - "stream_id": t.StreamID, - "position": i, - }) - } - // The task is already finished; its context was already canceled - // by removeTask(), so no further action is required. - continue - } else if !absoluteExpired && !graceExpired { - filtered = append(filtered, t) - } else { - t.cancel() // cancel any lingering agent goroutine - } - } - if len(filtered) == 0 { - delete(c.chatTasks, chatID) - } else { - c.chatTasks[chatID] = filtered - } - } -} - -// handleHealth handles health check requests -func (c *WeComAIBotChannel) handleHealth(w http.ResponseWriter, r *http.Request) { - status := "ok" - if !c.IsRunning() { - status = "not running" - } - - w.Header().Set("Content-Type", "application/json") - w.WriteHeader(http.StatusOK) - json.NewEncoder(w).Encode(map[string]string{ - "status": status, - }) -} diff --git a/pkg/channels/wecom/aibot_test.go b/pkg/channels/wecom/aibot_test.go deleted file mode 100644 index 11c4393d6..000000000 --- a/pkg/channels/wecom/aibot_test.go +++ /dev/null @@ -1,559 +0,0 @@ -package wecom - -import ( - "context" - "encoding/json" - "testing" - "time" - - "github.com/sipeed/picoclaw/pkg/bus" - "github.com/sipeed/picoclaw/pkg/channels" - "github.com/sipeed/picoclaw/pkg/config" -) - -// ---- Webhook mode tests ---- - -func TestNewWeComAIBotChannel_WebhookMode(t *testing.T) { - t.Run("success with valid config", func(t *testing.T) { - cfg := config.WeComAIBotConfig{} - cfg.Enabled = true - cfg.SetToken("test_token") - cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") - cfg.WebhookPath = "/webhook/test" - - messageBus := bus.NewMessageBus() - ch, err := NewWeComAIBotChannel(cfg, messageBus) - if err != nil { - t.Fatalf("Expected no error, got %v", err) - } - if ch == nil { - t.Fatal("Expected channel to be created") - } - if ch.Name() != "wecom_aibot" { - t.Errorf("Expected name 'wecom_aibot', got '%s'", ch.Name()) - } - // Webhook mode must implement WebhookHandler. - if _, ok := ch.(channels.WebhookHandler); !ok { - t.Error("Webhook mode channel should implement WebhookHandler") - } - }) - - t.Run("error with missing token", func(t *testing.T) { - cfg := config.WeComAIBotConfig{} - cfg.Enabled = true - cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") - - messageBus := bus.NewMessageBus() - _, err := NewWeComAIBotChannel(cfg, messageBus) - if err == nil { - t.Fatal("Expected error for missing token, got nil") - } - }) - - t.Run("error with missing encoding key", func(t *testing.T) { - cfg := config.WeComAIBotConfig{} - cfg.Enabled = true - cfg.SetToken("test_token") - - messageBus := bus.NewMessageBus() - _, err := NewWeComAIBotChannel(cfg, messageBus) - if err == nil { - t.Fatal("Expected error for missing encoding key, got nil") - } - }) -} - -func TestWeComAIBotWebhookChannelStartStop(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - } - cfg.SetToken("test_token") - cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") - - messageBus := bus.NewMessageBus() - ch, err := NewWeComAIBotChannel(cfg, messageBus) - if err != nil { - t.Fatalf("Failed to create channel: %v", err) - } - - ctx := context.Background() - - if err := ch.Start(ctx); err != nil { - t.Fatalf("Failed to start channel: %v", err) - } - if !ch.IsRunning() { - t.Error("Expected channel to be running after Start") - } - - if err := ch.Stop(ctx); err != nil { - t.Fatalf("Failed to stop channel: %v", err) - } - if ch.IsRunning() { - t.Error("Expected channel to be stopped after Stop") - } -} - -func TestWeComAIBotChannelWebhookPath(t *testing.T) { - t.Run("default path", func(t *testing.T) { - cfg := config.WeComAIBotConfig{} - cfg.Enabled = true - cfg.SetToken("test_token") - cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") - - messageBus := bus.NewMessageBus() - ch, _ := NewWeComAIBotChannel(cfg, messageBus) - - wh, ok := ch.(channels.WebhookHandler) - if !ok { - t.Fatal("Expected channel to implement WebhookHandler") - } - expectedPath := "/webhook/wecom-aibot" - if wh.WebhookPath() != expectedPath { - t.Errorf("Expected webhook path '%s', got '%s'", expectedPath, wh.WebhookPath()) - } - }) - - t.Run("custom path", func(t *testing.T) { - customPath := "/custom/webhook" - cfg := config.WeComAIBotConfig{} - cfg.Enabled = true - cfg.SetToken("test_token") - cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") - cfg.WebhookPath = customPath - - messageBus := bus.NewMessageBus() - ch, _ := NewWeComAIBotChannel(cfg, messageBus) - - wh, ok := ch.(channels.WebhookHandler) - if !ok { - t.Fatal("Expected channel to implement WebhookHandler") - } - if wh.WebhookPath() != customPath { - t.Errorf("Expected webhook path '%s', got '%s'", customPath, wh.WebhookPath()) - } - }) -} - -func TestWeComAIBotChannelGetStreamResponseProcessingMessage(t *testing.T) { - validAESKey := "abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG" - - t.Run("uses default processing message", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - } - cfg.SetToken("test_token") - cfg.SetEncodingAESKey(validAESKey) - - messageBus := bus.NewMessageBus() - channel, err := NewWeComAIBotChannel(cfg, messageBus) - if err != nil { - t.Fatalf("Failed to create channel: %v", err) - } - ch, ok := channel.(*WeComAIBotChannel) - if !ok { - t.Fatal("Expected webhook mode channel") - } - - task := &streamTask{ - StreamID: "stream-default", - ChatID: "chat-default", - Deadline: time.Now().Add(-time.Second), - } - ch.streamTasks[task.StreamID] = task - ch.chatTasks[task.ChatID] = []*streamTask{task} - - resp := decodeStreamResponse(t, ch, ch.getStreamResponse(task, "1234567890", "nonce")) - - if !resp.Stream.Finish { - t.Fatal("Expected finished stream response after deadline") - } - if resp.Stream.Content != config.DefaultWeComAIBotProcessingMessage { - t.Fatalf("Expected default processing message %q, got %q", - config.DefaultWeComAIBotProcessingMessage, resp.Stream.Content) - } - if !task.StreamClosed { - t.Fatal("Expected task stream to be marked closed") - } - if _, ok := ch.streamTasks[task.StreamID]; ok { - t.Fatal("Expected closed stream task to be removed from streamTasks") - } - if len(ch.chatTasks[task.ChatID]) != 1 { - t.Fatalf("Expected task to remain queued for response_url delivery, got %d entries", - len(ch.chatTasks[task.ChatID])) - } - }) - - t.Run("uses custom processing message", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - ProcessingMessage: "Please wait a moment. The result will be delivered in a follow-up message.", - } - cfg.SetToken("test_token") - cfg.SetEncodingAESKey(validAESKey) - - messageBus := bus.NewMessageBus() - channel, err := NewWeComAIBotChannel(cfg, messageBus) - if err != nil { - t.Fatalf("Failed to create channel: %v", err) - } - ch, ok := channel.(*WeComAIBotChannel) - if !ok { - t.Fatal("Expected webhook mode channel") - } - - task := &streamTask{ - StreamID: "stream-custom", - ChatID: "chat-custom", - Deadline: time.Now().Add(-time.Second), - } - - resp := decodeStreamResponse(t, ch, ch.getStreamResponse(task, "1234567890", "nonce")) - - if resp.Stream.Content != cfg.ProcessingMessage { - t.Fatalf("Expected custom processing message %q, got %q", cfg.ProcessingMessage, resp.Stream.Content) - } - }) -} - -func TestGenerateStreamID(t *testing.T) { - cfg := config.WeComAIBotConfig{} - cfg.Enabled = true - cfg.SetToken("test_token") - cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") - - messageBus := bus.NewMessageBus() - ch, _ := NewWeComAIBotChannel(cfg, messageBus) - webhookCh, ok := ch.(*WeComAIBotChannel) - if !ok { - t.Fatal("Expected webhook mode channel") - } - - ids := make(map[string]bool) - for i := 0; i < 100; i++ { - id := webhookCh.generateStreamID() - if len(id) != 10 { - t.Errorf("Expected stream ID length 10, got %d", len(id)) - } - if ids[id] { - t.Errorf("Duplicate stream ID generated: %s", id) - } - ids[id] = true - } -} - -func TestEncryptDecrypt(t *testing.T) { - // Use a valid 43-character base64 key (企业微信标准格式) - cfg := config.WeComAIBotConfig{} - cfg.Enabled = true - cfg.SetToken("test_token") - cfg.SetEncodingAESKey("abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG") // 43 characters - - messageBus := bus.NewMessageBus() - ch, _ := NewWeComAIBotChannel(cfg, messageBus) - webhookCh, ok := ch.(*WeComAIBotChannel) - if !ok { - t.Fatal("Expected webhook mode channel") - } - - plaintext := "Hello, World!" - receiveid := "" - - encrypted, err := webhookCh.encryptMessage(plaintext, receiveid) - if err != nil { - t.Fatalf("Failed to encrypt message: %v", err) - } - if encrypted == "" { - t.Fatal("Encrypted message is empty") - } - - // Decrypt - decrypted, err := decryptMessageWithVerify(encrypted, cfg.EncodingAESKey(), receiveid) - if err != nil { - t.Fatalf("Failed to decrypt message: %v", err) - } - if decrypted != plaintext { - t.Errorf("Expected decrypted message '%s', got '%s'", plaintext, decrypted) - } -} - -func TestGenerateSignature(t *testing.T) { - token := "test_token" - timestamp := "1234567890" - nonce := "test_nonce" - encrypt := "encrypted_msg" - - signature := computeSignature(token, timestamp, nonce, encrypt) - if signature == "" { - t.Error("Generated signature is empty") - } - if !verifySignature(token, signature, timestamp, nonce, encrypt) { - t.Error("Generated signature does not verify correctly") - } -} - -func decodeStreamResponse(t *testing.T, ch *WeComAIBotChannel, encryptedResponse string) WeComAIBotStreamResponse { - t.Helper() - - var wrapped WeComAIBotEncryptedResponse - if err := json.Unmarshal([]byte(encryptedResponse), &wrapped); err != nil { - t.Fatalf("Failed to unmarshal encrypted response: %v", err) - } - - plaintext, err := decryptMessageWithVerify(wrapped.Encrypt, ch.config.EncodingAESKey(), "") - if err != nil { - t.Fatalf("Failed to decrypt response: %v", err) - } - - var resp WeComAIBotStreamResponse - if err := json.Unmarshal([]byte(plaintext), &resp); err != nil { - t.Fatalf("Failed to unmarshal decrypted response: %v", err) - } - - return resp -} - -// ---- WebSocket long-connection mode tests ---- - -func TestNewWeComAIBotChannel_WSMode(t *testing.T) { - t.Run("success with bot_id and secret", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - BotID: "test_bot_id", - } - cfg.SetSecret("test_secret") - messageBus := bus.NewMessageBus() - ch, err := NewWeComAIBotChannel(cfg, messageBus) - if err != nil { - t.Fatalf("Expected no error, got %v", err) - } - if ch == nil { - t.Fatal("Expected channel to be created") - } - if ch.Name() != "wecom_aibot" { - t.Errorf("Expected name 'wecom_aibot', got '%s'", ch.Name()) - } - // WebSocket mode must NOT implement WebhookHandler. - if _, ok := ch.(channels.WebhookHandler); ok { - t.Error("WebSocket mode channel should NOT implement WebhookHandler") - } - }) - - t.Run("ws mode takes priority over webhook fields", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - BotID: "test_bot_id", - } - cfg.SetSecret("test_secret") - cfg.SetToken("also_set") - cfg.SetEncodingAESKey("testkey1234567890123456789012345678901234567") - messageBus := bus.NewMessageBus() - ch, err := NewWeComAIBotChannel(cfg, messageBus) - if err != nil { - t.Fatalf("Expected no error, got %v", err) - } - if _, ok := ch.(*WeComAIBotWSChannel); !ok { - t.Error("Expected WebSocket mode channel when both BotID+secret and Token+Key are set") - } - }) - - t.Run("error with missing bot_id", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - } - cfg.SetSecret("test_secret") - messageBus := bus.NewMessageBus() - _, err := NewWeComAIBotChannel(cfg, messageBus) - // Missing bot_id alone means neither WS mode nor webhook mode is fully configured. - if err == nil { - t.Fatal("Expected error for missing bot_id, got nil") - } - }) - - t.Run("error with missing secret", func(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - BotID: "test_bot_id", - } - messageBus := bus.NewMessageBus() - _, err := NewWeComAIBotChannel(cfg, messageBus) - if err == nil { - t.Fatal("Expected error for missing secret, got nil") - } - }) -} - -func TestWeComAIBotWSChannelStartStop(t *testing.T) { - cfg := config.WeComAIBotConfig{ - Enabled: true, - BotID: "test_bot_id", - } - cfg.SetSecret("test_secret") - messageBus := bus.NewMessageBus() - ch, err := NewWeComAIBotChannel(cfg, messageBus) - if err != nil { - t.Fatalf("Failed to create channel: %v", err) - } - - ctx := context.Background() - - // Start launches a background goroutine; it should not block or return an error. - if err := ch.Start(ctx); err != nil { - t.Fatalf("Failed to start channel: %v", err) - } - if !ch.IsRunning() { - t.Error("Expected channel to be running after Start") - } - - // Stop should work regardless of whether the WebSocket actually connected. - if err := ch.Stop(ctx); err != nil { - t.Fatalf("Failed to stop channel: %v", err) - } - if ch.IsRunning() { - t.Error("Expected channel to be stopped after Stop") - } -} - -func TestGenerateRandomID(t *testing.T) { - ids := make(map[string]bool) - for i := 0; i < 200; i++ { - id := generateRandomID(10) - if len(id) != 10 { - t.Errorf("Expected ID length 10, got %d", len(id)) - } - if ids[id] { - t.Errorf("Duplicate ID generated: %s", id) - } - ids[id] = true - } -} - -func TestWSGenerateID(t *testing.T) { - ids := make(map[string]bool) - for i := 0; i < 200; i++ { - id := wsGenerateID() - if len(id) != 10 { - t.Errorf("Expected ID length 10, got %d", len(id)) - } - if ids[id] { - t.Errorf("Duplicate wsGenerateID result: %s", id) - } - ids[id] = true - } -} - -// ---- Webhook streaming fallback tests ---- - -// makeWebhookChannel creates a started WeComAIBotChannel for testing. -func makeWebhookChannel(t *testing.T) *WeComAIBotChannel { - t.Helper() - cfg := config.WeComAIBotConfig{ - Enabled: true, - } - cfg.SetToken("test_token") - cfg.SetEncodingAESKey("abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG") - ch, err := NewWeComAIBotChannel(cfg, bus.NewMessageBus()) - if err != nil { - t.Fatalf("create channel: %v", err) - } - wc := ch.(*WeComAIBotChannel) - wc.ctx, wc.cancel = context.WithCancel(context.Background()) - return wc -} - -// makeStreamTask creates and registers a streamTask for testing. -func makeStreamTask(t *testing.T, ch *WeComAIBotChannel, streamID, chatID string, deadline time.Time) *streamTask { - t.Helper() - task := &streamTask{ - StreamID: streamID, - ChatID: chatID, - Deadline: deadline, - answerCh: make(chan string, 1), - } - task.ctx, task.cancel = context.WithCancel(ch.ctx) - ch.taskMu.Lock() - ch.streamTasks[streamID] = task - ch.chatTasks[chatID] = append(ch.chatTasks[chatID], task) - ch.taskMu.Unlock() - return task -} - -// TestGetStreamResponse_ImmediateAnswer verifies that when the agent has already -// placed its answer in answerCh, getStreamResponse returns a finish=true response -// and fully removes the task. -func TestGetStreamResponse_ImmediateAnswer(t *testing.T) { - ch := makeWebhookChannel(t) - defer ch.cancel() - - task := makeStreamTask(t, ch, "stream-1", "chat-1", time.Now().Add(30*time.Second)) - task.answerCh <- "hello from agent" - - result := ch.getStreamResponse(task, "ts123", "nonce123") - if result == "" { - t.Fatal("expected non-empty encrypted response") - } - - ch.taskMu.RLock() - _, exists := ch.streamTasks["stream-1"] - ch.taskMu.RUnlock() - if exists { - t.Error("task should have been removed from streamTasks after normal finish") - } - if !task.Finished { - t.Error("task.Finished should be true after normal finish") - } -} - -// TestGetStreamResponse_DeadlinePassed verifies that when the stream deadline has -// elapsed (no agent reply yet), getStreamResponse closes the stream but keeps the -// task alive so the response_url fallback can still deliver the answer. -func TestGetStreamResponse_DeadlinePassed(t *testing.T) { - ch := makeWebhookChannel(t) - defer ch.cancel() - - task := makeStreamTask(t, ch, "stream-2", "chat-2", time.Now().Add(-time.Millisecond)) - - result := ch.getStreamResponse(task, "ts456", "nonce456") - if result == "" { - t.Fatal("expected non-empty encrypted response") - } - - ch.taskMu.RLock() - _, stillStreaming := ch.streamTasks["stream-2"] - ch.taskMu.RUnlock() - if stillStreaming { - t.Error("task should have been removed from streamTasks after deadline") - } - if !task.StreamClosed { - t.Error("task.StreamClosed should be true after deadline") - } - if task.Finished { - t.Error("task.Finished must remain false: agent reply still expected via response_url") - } -} - -// TestGetStreamResponse_StillPending verifies that when neither the agent has -// replied nor the deadline has passed, getStreamResponse returns without altering -// task state (client should poll again). -func TestGetStreamResponse_StillPending(t *testing.T) { - ch := makeWebhookChannel(t) - defer ch.cancel() - - task := makeStreamTask(t, ch, "stream-3", "chat-3", time.Now().Add(30*time.Second)) - - result := ch.getStreamResponse(task, "ts789", "nonce789") - if result == "" { - t.Fatal("expected non-empty encrypted response") - } - - ch.taskMu.RLock() - _, exists := ch.streamTasks["stream-3"] - ch.taskMu.RUnlock() - if !exists { - t.Error("pending task should still be in streamTasks") - } - if task.Finished || task.StreamClosed { - t.Error("pending task should not be finished or stream-closed") - } - // Cleanup. - ch.removeTask(task) -} diff --git a/pkg/channels/wecom/aibot_ws.go b/pkg/channels/wecom/aibot_ws.go deleted file mode 100644 index 53dd7071f..000000000 --- a/pkg/channels/wecom/aibot_ws.go +++ /dev/null @@ -1,1347 +0,0 @@ -package wecom - -import ( - "context" - "encoding/base64" - "encoding/json" - "fmt" - "io" - "net/http" - "os" - "path/filepath" - "strings" - "sync" - "time" - - "github.com/gorilla/websocket" - - "github.com/sipeed/picoclaw/pkg/bus" - "github.com/sipeed/picoclaw/pkg/channels" - "github.com/sipeed/picoclaw/pkg/config" - "github.com/sipeed/picoclaw/pkg/identity" - "github.com/sipeed/picoclaw/pkg/logger" - "github.com/sipeed/picoclaw/pkg/media" - "github.com/sipeed/picoclaw/pkg/utils" -) - -// Long-connection WebSocket endpoint. -// Ref: https://developer.work.weixin.qq.com/document/path/101463 -const ( - wsEndpoint = "wss://openws.work.weixin.qq.com" - wsHeartbeatInterval = 30 * time.Second - wsConnectTimeout = 15 * time.Second - wsSubscribeTimeout = 10 * time.Second - wsSendMsgTimeout = 10 * time.Second - wsRespondMsgTimeout = 10 * time.Second - wsWelcomeMsgTimeout = 5 * time.Second // WeCom requires welcome reply within 5 seconds - wsMaxReconnectWait = 60 * time.Second - wsInitialReconnect = time.Second - - // WeCom requires finish=true within 6 minutes of the first stream frame. - // wsStreamTickInterval controls how often we send an in-progress hint. - // wsStreamMaxDuration is a safety margin below the 6-minute hard limit. - wsStreamTickInterval = 30 * time.Second - wsStreamMaxDuration = 5*time.Minute + 30*time.Second - - // wsImageDownloadTimeout caps the time we spend downloading an inbound image. - wsImageDownloadTimeout = 30 * time.Second - - // Keep req_id -> chat route for late fallback pushes after stream window closes. - wsLateReplyRouteTTL = 30 * time.Minute - - // wsStreamMaxContentBytes is the maximum UTF-8 byte length for the content field - // of a single WeCom AI Bot stream / text / markdown frame. - // Ref: https://developer.work.weixin.qq.com/document/path/101463 - wsStreamMaxContentBytes = 20480 -) - -// wsImageHTTPClient is a shared HTTP client for downloading inbound images. -// Reusing it enables connection pooling across multiple image downloads. -var wsImageHTTPClient = &http.Client{Timeout: wsImageDownloadTimeout} - -// WeComAIBotWSChannel implements channels.Channel for WeCom AI Bot using the -// WebSocket long-connection API. -// Unlike the webhook counterpart it does NOT implement WebhookHandler, so the -// HTTP manager will not register any callback URL for it. -type WeComAIBotWSChannel struct { - *channels.BaseChannel - config config.WeComAIBotConfig - ctx context.Context - cancel context.CancelFunc - - // conn is the active WebSocket connection; nil when disconnected. - // All writes are serialized through connMu. - conn *websocket.Conn - connMu sync.Mutex - - // dedupe prevents duplicate message processing (WeCom may re-deliver). - dedupe *MessageDeduplicator - - // reqStates holds per-req_id runtime state. - // It unifies active task state and late-reply fallback routing. - reqStates map[string]*wsReqState - reqStatesMu sync.Mutex - - // reqPending correlates command req_ids with response channels. - // Used only for subscribe/ping command-response pairs. - reqPending map[string]chan wsEnvelope - reqPendingMu sync.Mutex -} - -// wsTask tracks one in-progress agent reply for a single chat turn. -type wsTask struct { - ReqID string // req_id echoed in all replies for this turn - ChatID string - ChatType uint32 - StreamID string // our generated stream.id - answerCh chan string // agent delivers its reply here via Send() - ctx context.Context - cancel context.CancelFunc -} - -type wsReqState struct { - Task *wsTask - Route wsLateReplyRoute -} - -type wsLateReplyRoute struct { - ChatID string - ChatType uint32 - ReadyAt time.Time - ExpiresAt time.Time -} - -// ---- WebSocket protocol types ---- - -// wsEnvelope is the generic JSON envelope for all WebSocket messages. -type wsEnvelope struct { - Cmd string `json:"cmd,omitempty"` - Headers wsHeaders `json:"headers"` - Body json.RawMessage `json:"body,omitempty"` - ErrCode int `json:"errcode,omitempty"` - ErrMsg string `json:"errmsg,omitempty"` -} - -type wsHeaders struct { - ReqID string `json:"req_id"` -} - -// wsCommand is an outgoing request sent over the WebSocket. -type wsCommand struct { - Cmd string `json:"cmd"` - Headers wsHeaders `json:"headers"` - Body any `json:"body,omitempty"` -} - -type wsSendMsgBody struct { - ChatID string `json:"chatid"` - ChatType uint32 `json:"chat_type,omitempty"` - MsgType string `json:"msgtype"` - Markdown *wsMarkdownContent `json:"markdown,omitempty"` -} - -// wsRespondMsgBody is the body for aibot_respond_msg / aibot_respond_welcome_msg. -type wsRespondMsgBody struct { - MsgType string `json:"msgtype"` - Stream *wsStreamContent `json:"stream,omitempty"` - Text *wsTextContent `json:"text,omitempty"` - Markdown *wsMarkdownContent `json:"markdown,omitempty"` - Image *wsImageContent `json:"image,omitempty"` -} - -type wsStreamContent struct { - ID string `json:"id"` - Finish bool `json:"finish"` - Content string `json:"content,omitempty"` -} - -// wsImageContent carries a base64-encoded image payload for outbound messages. -type wsImageContent struct { - Base64 string `json:"base64"` - MD5 string `json:"md5"` -} - -type wsTextContent struct { - Content string `json:"content"` -} - -type wsMarkdownContent struct { - Content string `json:"content"` -} - -// WeComAIBotWSMessage is the decoded body of aibot_msg_callback / -// aibot_event_callback in WebSocket long-connection mode. -// The structure mirrors WeComAIBotMessage but includes extra fields -// that only appear in long-connection callbacks (Voice, AESKey on Image/File). -type WeComAIBotWSMessage struct { - MsgID string `json:"msgid"` - CreateTime int64 `json:"create_time,omitempty"` - AIBotID string `json:"aibotid"` - ChatID string `json:"chatid,omitempty"` - ChatType string `json:"chattype,omitempty"` // "single" | "group" - From struct { - UserID string `json:"userid"` - } `json:"from"` - MsgType string `json:"msgtype"` - Text *struct { - Content string `json:"content"` - } `json:"text,omitempty"` - Image *struct { - URL string `json:"url"` - AESKey string `json:"aeskey,omitempty"` // long-connection: per-resource decrypt key - } `json:"image,omitempty"` - Voice *struct { - Content string `json:"content"` // WeCom transcribes voice to text in callbacks - } `json:"voice,omitempty"` - Mixed *struct { - MsgItem []struct { - MsgType string `json:"msgtype"` - Text *struct { - Content string `json:"content"` - } `json:"text,omitempty"` - Image *struct { - URL string `json:"url"` - AESKey string `json:"aeskey,omitempty"` - } `json:"image,omitempty"` - } `json:"msg_item"` - } `json:"mixed,omitempty"` - Event *struct { - EventType string `json:"eventtype"` - } `json:"event,omitempty"` - File *struct { - URL string `json:"url"` - AESKey string `json:"aeskey,omitempty"` - } `json:"file,omitempty"` - Video *struct { - URL string `json:"url"` - AESKey string `json:"aeskey,omitempty"` - } `json:"video,omitempty"` -} - -// ---- Constructor ---- - -// newWeComAIBotWSChannel creates a WeComAIBotWSChannel for WebSocket mode. -func newWeComAIBotWSChannel( - cfg config.WeComAIBotConfig, - messageBus *bus.MessageBus, -) (*WeComAIBotWSChannel, error) { - if cfg.BotID == "" || cfg.Secret() == "" { - return nil, fmt.Errorf("bot_id and secret are required for WeCom AI Bot WebSocket mode") - } - - base := channels.NewBaseChannel("wecom_aibot", cfg, messageBus, cfg.AllowFrom, - channels.WithReasoningChannelID(cfg.ReasoningChannelID), - ) - - return &WeComAIBotWSChannel{ - BaseChannel: base, - config: cfg, - dedupe: NewMessageDeduplicator(wecomMaxProcessedMessages), - reqStates: make(map[string]*wsReqState), - reqPending: make(map[string]chan wsEnvelope), - }, nil -} - -// ---- Channel interface ---- - -// Name implements channels.Channel. -func (c *WeComAIBotWSChannel) Name() string { return "wecom_aibot" } - -// Start connects to the WeCom WebSocket endpoint and begins message processing. -func (c *WeComAIBotWSChannel) Start(ctx context.Context) error { - logger.InfoC("wecom_aibot", "Starting WeCom AI Bot channel (WebSocket long-connection mode)...") - c.ctx, c.cancel = context.WithCancel(ctx) - c.SetRunning(true) - go c.connectLoop() - logger.InfoC("wecom_aibot", "WeCom AI Bot channel started (WebSocket mode)") - return nil -} - -// Stop shuts down the channel and closes the WebSocket connection. -func (c *WeComAIBotWSChannel) Stop(_ context.Context) error { - logger.InfoC("wecom_aibot", "Stopping WeCom AI Bot channel (WebSocket mode)...") - if c.cancel != nil { - c.cancel() - } - c.connMu.Lock() - if c.conn != nil { - c.conn.Close() - c.conn = nil - } - c.connMu.Unlock() - c.SetRunning(false) - logger.InfoC("wecom_aibot", "WeCom AI Bot channel stopped") - return nil -} - -// Send delivers the agent reply for msg.ChatID. -// The waiting task goroutine picks it up and writes the final stream response. -func (c *WeComAIBotWSChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { - if !c.IsRunning() { - return channels.ErrNotRunning - } - - // msg.ChatID carries the inbound req_id (set by dispatchWSAgentTask). - // For cron-triggered messages, msg.ChatID is the real WeCom chat/user ID - // and there will be no matching entry in reqStates; fall through to proactive push. - task, route, ok := c.getReqState(msg.ChatID) - if !ok { - // No req_id record found — this is a cron/scheduler-originated message. - // Send it as a proactive markdown push using the chat ID directly. - logger.InfoCF("wecom_aibot", "Send: no req_id state, delivering via proactive push (cron/scheduler)", - map[string]any{"chat_id": msg.ChatID}) - if err := c.wsSendActivePush(msg.ChatID, 0, msg.Content); err != nil { - logger.WarnCF("wecom_aibot", "Proactive push failed", - map[string]any{"chat_id": msg.ChatID, "error": err.Error()}) - return fmt.Errorf("websocket delivery failed: %w", channels.ErrSendFailed) - } - return nil - } - - if task == nil { - if time.Now().Before(route.ReadyAt) { - // Keep using aibot_respond_msg within stream window; do not proactively - // push unless wsStreamMaxDuration has elapsed. - logger.WarnCF("wecom_aibot", "Send: stream window still open, skip proactive push", - map[string]any{"req_id": msg.ChatID, "ready_at": route.ReadyAt.Format(time.RFC3339)}) - return nil - } - - if err := c.wsSendActivePush(route.ChatID, route.ChatType, msg.Content); err != nil { - logger.WarnCF("wecom_aibot", "Late reply proactive push failed", - map[string]any{"req_id": msg.ChatID, "chat_id": route.ChatID, "error": err.Error()}) - return fmt.Errorf("websocket delivery failed: %w", channels.ErrSendFailed) - } - logger.InfoCF("wecom_aibot", "Late reply delivered via proactive push", - map[string]any{"req_id": msg.ChatID, "chat_id": route.ChatID, "chat_type": route.ChatType}) - c.deleteReqState(msg.ChatID) - return nil - } - - // Non-blocking fast path: when answerCh has space, deliver without racing - // against task.ctx.Done() (which fires when the task is canceled by a new - // incoming message, but the response must still be sent). - select { - case task.answerCh <- msg.Content: - return nil - default: - } - // answerCh was full; block with cancellation guards. - select { - case task.answerCh <- msg.Content: - case <-task.ctx.Done(): - return nil - case <-ctx.Done(): - return ctx.Err() - } - return nil -} - -// ---- Connection management ---- - -// wsBackoffResetDuration is the minimum duration a WebSocket connection must -// stay up before we reset the reconnect backoff to its initial value. This -// prevents a short burst of failures from causing long waits after later, -// stable connection periods. -const wsBackoffResetDuration = time.Minute - -// connectLoop maintains the WebSocket connection, reconnecting on failure with -// exponential backoff. -func (c *WeComAIBotWSChannel) connectLoop() { - backoff := wsInitialReconnect - for { - select { - case <-c.ctx.Done(): - return - default: - } - - logger.InfoC("wecom_aibot", "Connecting to WeCom WebSocket endpoint...") - start := time.Now() - if err := c.runConnection(); err != nil { - elapsed := time.Since(start) - // If the connection was stable for long enough, reset backoff so that - // a previous burst of failures does not keep us at the maximum delay. - if elapsed >= wsBackoffResetDuration { - backoff = wsInitialReconnect - } - select { - case <-c.ctx.Done(): - return - default: - logger.WarnCF("wecom_aibot", "WebSocket connection lost, reconnecting", - map[string]any{"error": err.Error(), "backoff": backoff.String()}) - select { - case <-time.After(backoff): - case <-c.ctx.Done(): - return - } - if backoff < wsMaxReconnectWait { - backoff *= 2 - if backoff > wsMaxReconnectWait { - backoff = wsMaxReconnectWait - } - } - } - } else { - // Clean exit (context canceled); stop reconnecting. - return - } - } -} - -// runConnection dials, subscribes, and runs the read/heartbeat loops until the -// connection closes or the channel context is canceled. -func (c *WeComAIBotWSChannel) runConnection() error { - dialCtx, dialCancel := context.WithTimeout(c.ctx, wsConnectTimeout) - conn, httpResp, err := websocket.DefaultDialer.DialContext(dialCtx, wsEndpoint, nil) - dialCancel() - if httpResp != nil { - httpResp.Body.Close() - } - if err != nil { - return fmt.Errorf("dial failed: %w", err) - } - - c.connMu.Lock() - c.conn = conn - c.connMu.Unlock() - - defer func() { - c.connMu.Lock() - if c.conn == conn { - c.conn = nil - } - c.connMu.Unlock() - // Cancel any tasks that were started over this connection so their - // agent goroutines do not keep running after the connection is gone. - c.cancelAllTasks() - }() - - // ---- Read loop (must start BEFORE subscribing) ---- - // sendAndWait blocks waiting for the subscribe response on reqPending; - // readLoop is the only goroutine that delivers messages to reqPending. - // Starting readLoop first avoids a deadlock where sendAndWait times out - // because no one reads the server's reply. - readErrCh := make(chan error, 1) - go func() { readErrCh <- c.readLoop(conn) }() - - // ---- Subscribe ---- - reqID := wsGenerateID() - resp, err := c.sendAndWait(conn, reqID, wsCommand{ - Cmd: "aibot_subscribe", - Headers: wsHeaders{ReqID: reqID}, - Body: map[string]string{ - "bot_id": c.config.BotID, - "secret": c.config.Secret(), - }, - }, wsSubscribeTimeout) - if err != nil { - conn.Close() // stop readLoop - <-readErrCh - return fmt.Errorf("subscribe failed: %w", err) - } - if resp.ErrCode != 0 { - conn.Close() - <-readErrCh - return fmt.Errorf("subscribe rejected (errcode=%d): %s", resp.ErrCode, resp.ErrMsg) - } - - logger.InfoC("wecom_aibot", "WebSocket subscription successful") - - // ---- Heartbeat goroutine ---- - hbDone := make(chan struct{}) - go func() { - defer close(hbDone) - c.heartbeatLoop(conn) - }() - - // Wait for the read loop to exit, then tear down the heartbeat. - readErr := <-readErrCh - conn.Close() // signal heartbeat to stop (idempotent) - <-hbDone - return readErr -} - -// sendAndWait registers a pending-response slot, sends cmd, and blocks until -// the matching response arrives or the timeout/context fires. -func (c *WeComAIBotWSChannel) sendAndWait( - conn *websocket.Conn, - reqID string, - cmd wsCommand, - timeout time.Duration, -) (wsEnvelope, error) { - ch := make(chan wsEnvelope, 1) - c.reqPendingMu.Lock() - c.reqPending[reqID] = ch - c.reqPendingMu.Unlock() - - cleanup := func() { - c.reqPendingMu.Lock() - delete(c.reqPending, reqID) - c.reqPendingMu.Unlock() - } - - data, err := json.Marshal(cmd) - if err != nil { - cleanup() - return wsEnvelope{}, fmt.Errorf("marshal command: %w", err) - } - c.connMu.Lock() - err = conn.WriteMessage(websocket.TextMessage, data) - c.connMu.Unlock() - if err != nil { - cleanup() - return wsEnvelope{}, fmt.Errorf("write command: %w", err) - } - - timer := time.NewTimer(timeout) - defer timer.Stop() - select { - case env := <-ch: - return env, nil - case <-timer.C: - cleanup() - return wsEnvelope{}, fmt.Errorf("timeout waiting for response (req_id=%s)", reqID) - case <-c.ctx.Done(): - cleanup() - return wsEnvelope{}, c.ctx.Err() - } -} - -// heartbeatLoop sends a ping every wsHeartbeatInterval until conn is closed. -// It validates the server's pong response via sendAndWait; a failed pong -// triggers a reconnection by closing the connection. -func (c *WeComAIBotWSChannel) heartbeatLoop(conn *websocket.Conn) { - ticker := time.NewTicker(wsHeartbeatInterval) - defer ticker.Stop() - for { - select { - case <-ticker.C: - reqID := wsGenerateID() - resp, err := c.sendAndWait(conn, reqID, wsCommand{ - Cmd: "ping", - Headers: wsHeaders{ReqID: reqID}, - }, wsHeartbeatInterval) - if err != nil { - logger.WarnCF("wecom_aibot", "Heartbeat failed, closing connection", - map[string]any{"error": err.Error()}) - conn.Close() - return - } - if resp.ErrCode != 0 { - logger.WarnCF("wecom_aibot", "Heartbeat rejected", - map[string]any{"errcode": resp.ErrCode, "errmsg": resp.ErrMsg}) - conn.Close() - return - } - logger.DebugCF("wecom_aibot", "Heartbeat pong received", map[string]any{"req_id": reqID}) - case <-c.ctx.Done(): - return - } - } -} - -// readLoop reads WebSocket messages and dispatches them until the connection -// closes or the channel is stopped. -func (c *WeComAIBotWSChannel) readLoop(conn *websocket.Conn) error { - for { - _, raw, err := conn.ReadMessage() - if err != nil { - select { - case <-c.ctx.Done(): - return nil // clean shutdown - default: - return fmt.Errorf("read error: %w", err) - } - } - - var env wsEnvelope - if err := json.Unmarshal(raw, &env); err != nil { - logger.WarnCF("wecom_aibot", "Failed to parse WebSocket message", - map[string]any{"error": err.Error(), "raw": string(raw)}) - continue - } - - // Command responses have an empty Cmd field; forward to any waiting - // sendAndWait() call, or silently drop if no one is waiting (e.g. - // late responses after timeout). - if env.Cmd == "" && env.Headers.ReqID != "" { - c.reqPendingMu.Lock() - ch, ok := c.reqPending[env.Headers.ReqID] - if ok { - delete(c.reqPending, env.Headers.ReqID) - } - c.reqPendingMu.Unlock() - if ok { - ch <- env - } - continue - } - - // Dispatch to appropriate handler in a separate goroutine so the - // read loop is never blocked by a slow agent. - go c.handleEnvelope(env) - } -} - -// ---- Message / event handlers ---- - -// handleEnvelope routes a WebSocket envelope to the right handler. -func (c *WeComAIBotWSChannel) handleEnvelope(env wsEnvelope) { - switch env.Cmd { - case "aibot_msg_callback": - c.handleMsgCallback(env) - case "aibot_event_callback": - c.handleEventCallback(env) - default: - logger.DebugCF("wecom_aibot", "Unhandled WebSocket command", - map[string]any{"cmd": env.Cmd}) - } -} - -// handleMsgCallback processes aibot_msg_callback. -func (c *WeComAIBotWSChannel) handleMsgCallback(env wsEnvelope) { - var msg WeComAIBotWSMessage - if err := json.Unmarshal(env.Body, &msg); err != nil { - logger.WarnCF("wecom_aibot", "Failed to parse msg callback body", - map[string]any{"error": err.Error()}) - return - } - - // Deduplicate by msgid (WeCom may re-deliver on network issues). - if msg.MsgID != "" && !c.dedupe.MarkMessageProcessed(msg.MsgID) { - logger.DebugCF("wecom_aibot", "Duplicate message ignored", - map[string]any{"msgid": msg.MsgID}) - return - } - - reqID := env.Headers.ReqID - switch msg.MsgType { - case "text": - c.handleWSTextMessage(reqID, msg) - case "image": - c.handleWSImageMessage(reqID, msg) - case "voice": - c.handleWSVoiceMessage(reqID, msg) - case "mixed": - c.handleWSMixedMessage(reqID, msg) - case "file": - c.handleWSFileMessage(reqID, msg) - case "video": - c.handleWSVideoMessage(reqID, msg) - default: - logger.WarnCF("wecom_aibot", "Unsupported message type", - map[string]any{"msgtype": msg.MsgType}) - c.wsSendStreamFinish(reqID, wsGenerateID(), - "Unsupported message type: "+msg.MsgType) - } -} - -// handleEventCallback processes aibot_event_callback. -func (c *WeComAIBotWSChannel) handleEventCallback(env wsEnvelope) { - var msg WeComAIBotWSMessage - if err := json.Unmarshal(env.Body, &msg); err != nil { - logger.WarnCF("wecom_aibot", "Failed to parse event callback body", - map[string]any{"error": err.Error()}) - return - } - - // Deduplicate by msgid. - if msg.MsgID != "" && !c.dedupe.MarkMessageProcessed(msg.MsgID) { - logger.DebugCF("wecom_aibot", "Duplicate event ignored", - map[string]any{"msgid": msg.MsgID}) - return - } - - var eventType string - if msg.Event != nil { - eventType = msg.Event.EventType - } - logger.DebugCF("wecom_aibot", "Received event callback", - map[string]any{"event_type": eventType}) - - switch eventType { - case "enter_chat": - if c.config.WelcomeMessage != "" { - c.wsSendWelcomeMsg(env.Headers.ReqID, c.config.WelcomeMessage) - } - case "disconnected_event": - // The server will close this connection after sending this event. - // connectLoop will detect the closure and reconnect automatically. - logger.WarnC("wecom_aibot", - "Received disconnected_event: this connection is being replaced by a newer one") - default: - logger.DebugCF("wecom_aibot", "Unhandled event type", - map[string]any{"event_type": eventType}) - } -} - -// handleWSTextMessage dispatches a plain-text message to the agent and streams -// the reply back over the WebSocket connection. -func (c *WeComAIBotWSChannel) handleWSTextMessage(reqID string, msg WeComAIBotWSMessage) { - if msg.Text == nil { - logger.ErrorC("wecom_aibot", "text message missing text field") - return - } - c.dispatchWSAgentTask(reqID, msg, msg.Text.Content, nil) -} - -// handleWSImageMessage downloads and stores the inbound image, then dispatches -// it to the agent as a media-tagged message. -func (c *WeComAIBotWSChannel) handleWSImageMessage(reqID string, msg WeComAIBotWSMessage) { - if msg.Image == nil { - logger.WarnC("wecom_aibot", "Image message missing image field") - c.wsSendStreamFinish(reqID, wsGenerateID(), "Image message could not be processed.") - return - } - c.wsHandleMediaMessage(reqID, msg, msg.Image.URL, msg.Image.AESKey, "image") -} - -// wsHandleMediaMessage is a shared helper for image, file and video messages. -// It downloads the resource, stores it in MediaStore, and dispatches to the agent. -func (c *WeComAIBotWSChannel) wsHandleMediaMessage( - reqID string, msg WeComAIBotWSMessage, - resourceURL, aesKey, label string, -) { - chatID := wsChatID(msg) - - ctx, cancel := context.WithTimeout(c.ctx, wsImageDownloadTimeout) - defer cancel() - - ref, err := c.storeWSMedia(ctx, chatID, msg.MsgID, resourceURL, aesKey, wsLabelToDefaultExt(label)) - if err != nil { - logger.WarnCF("wecom_aibot", "Failed to download/store WS "+label, - map[string]any{"error": err.Error(), "url": resourceURL}) - c.wsSendStreamFinish(reqID, wsGenerateID(), - strings.ToUpper(label[:1])+label[1:]+" message could not be processed.") - return - } - - c.dispatchWSAgentTask(reqID, msg, "["+label+"]", []string{ref}) -} - -// handleWSMixedMessage handles mixed text+image messages. -// All text parts are collected into the content string; all image parts are -// downloaded and stored in MediaStore before dispatching to the agent. -func (c *WeComAIBotWSChannel) handleWSMixedMessage(reqID string, msg WeComAIBotWSMessage) { - if msg.Mixed == nil { - logger.WarnC("wecom_aibot", "Mixed message has no content") - c.wsSendStreamFinish(reqID, wsGenerateID(), "Mixed message type is not yet fully supported.") - return - } - - chatID := wsChatID(msg) - - ctx, cancel := context.WithTimeout(c.ctx, wsImageDownloadTimeout) - defer cancel() - - var textParts []string - var mediaRefs []string - for _, item := range msg.Mixed.MsgItem { - switch item.MsgType { - case "text": - if item.Text != nil && item.Text.Content != "" { - textParts = append(textParts, item.Text.Content) - } - case "image": - if item.Image != nil { - ref, err := c.storeWSMedia(ctx, chatID, - msg.MsgID+"-"+wsGenerateID(), item.Image.URL, item.Image.AESKey, ".jpg") - if err != nil { - logger.WarnCF("wecom_aibot", "Failed to download/store mixed image", - map[string]any{"error": err.Error()}) - } else { - mediaRefs = append(mediaRefs, ref) - } - } - default: - logger.WarnCF("wecom_aibot", "Unsupported item type in mixed message", - map[string]any{"msgtype": item.MsgType}) - } - } - - if len(textParts) == 0 && len(mediaRefs) == 0 { - logger.WarnC("wecom_aibot", "Mixed message has no usable content") - c.wsSendStreamFinish(reqID, wsGenerateID(), "Mixed message type is not yet fully supported.") - return - } - - content := strings.Join(textParts, "\n") - if content == "" { - content = "[images]" - } - c.dispatchWSAgentTask(reqID, msg, content, mediaRefs) -} - -// dispatchWSAgentTask registers a new agent task, sends the opening stream frame, -// and starts a goroutine that runs the agent and streams the reply back. -// content is the text forwarded to the agent; mediaRefs are optional media -// store references attached to the inbound message. -func (c *WeComAIBotWSChannel) dispatchWSAgentTask( - reqID string, - msg WeComAIBotWSMessage, - content string, - mediaRefs []string, -) { - userID := msg.From.UserID - if userID == "" { - userID = "unknown" - } - // actualChatID is the real WeCom chat/user ID used for peer identification. - // reqID is used as the routing chatID so each turn is independently addressable. - actualChatID := wsChatID(msg) - - streamID := wsGenerateID() - chatType := wsChatTypeValue(msg.ChatType) - taskCtx, taskCancel := context.WithCancel(c.ctx) - - task := &wsTask{ - ReqID: reqID, - ChatID: actualChatID, - ChatType: chatType, - StreamID: streamID, - answerCh: make(chan string, 1), - ctx: taskCtx, - cancel: taskCancel, - } - // Each req_id is unique per WeCom turn; tasks run concurrently, no cancellation. - c.setReqState(reqID, &wsReqState{ - Task: task, - Route: wsLateReplyRoute{ - ChatID: actualChatID, - ChatType: chatType, - ReadyAt: time.Now().Add(wsStreamMaxDuration), - ExpiresAt: time.Now().Add(wsLateReplyRouteTTL), - }, - }) - - logger.DebugCF("wecom_aibot", "Registered new agent task", - map[string]any{"chat_id": actualChatID, "req_id": reqID, "stream_id": streamID}) - - // Send an empty stream opening frame (finish=false) immediately. - c.wsSendStreamChunk(reqID, streamID, false, "") - - go func() { - defer func() { - taskCancel() - c.clearReqTask(reqID, task) - }() - - sender := bus.SenderInfo{ - Platform: "wecom_aibot", - PlatformID: userID, - CanonicalID: identity.BuildCanonicalID("wecom_aibot", userID), - DisplayName: userID, - } - peerKind := "direct" - if msg.ChatType == "group" { - peerKind = "group" - } - peer := bus.Peer{Kind: peerKind, ID: actualChatID} - metadata := map[string]string{ - "channel": "wecom_aibot", - "chat_id": actualChatID, - "chat_type": msg.ChatType, - "msg_type": msg.MsgType, - "msgid": msg.MsgID, - "aibotid": msg.AIBotID, - "stream_id": streamID, - } - // Pass reqID as chatID: OutboundMessage.ChatID = reqID → Send() finds tasks[reqID]. - c.HandleMessage(taskCtx, peer, reqID, userID, reqID, - content, mediaRefs, metadata, sender) - - // Wait for the agent reply. While waiting, send periodic finish=false - // hints so the user knows processing is still in progress. - // WeCom requires finish=true within 6 minutes of the first stream frame; - // wsStreamMaxDuration enforces that limit with a safety margin. - waitHints := []string{ - "⏳ Processing, please wait...", - "⏳ Still processing, please wait...", - "⏳ Almost there, please wait...", - } - ticker := time.NewTicker(wsStreamTickInterval) - defer ticker.Stop() - deadlineTimer := time.NewTimer(wsStreamMaxDuration) - defer deadlineTimer.Stop() - tickCount := 0 - for { - select { - case answer := <-task.answerCh: - // Split the answer into byte-bounded chunks and send as stream frames. - // All but the last carry finish=false; the final frame closes the stream. - chunks := splitWSContent(answer, wsStreamMaxContentBytes) - for i, chunk := range chunks { - c.wsSendStreamChunk(reqID, streamID, i == len(chunks)-1, chunk) - } - c.deleteReqState(reqID) - return - case <-ticker.C: - hint := waitHints[tickCount%len(waitHints)] - tickCount++ - logger.DebugCF("wecom_aibot", "Sending stream progress hint", - map[string]any{"chat_id": actualChatID, "tick": tickCount}) - c.wsSendStreamChunk(reqID, streamID, false, hint) - case <-deadlineTimer.C: - logger.WarnCF("wecom_aibot", - "Stream response deadline reached, closing stream; late reply will be pushed", - map[string]any{"chat_id": actualChatID}) - c.wsSendStreamFinish(reqID, streamID, - "⏳ Processing is taking longer than expected, the response will be sent as a follow-up message.") - return - case <-taskCtx.Done(): - // Give a short grace period so that a response queued in the bus - // just before cancellation can still be delivered. This closes a - // race where a rapid second message cancels this task after the - // agent already published but before Send() wrote to answerCh. - // - // The connection is gone at this point, so we cannot use - // wsSendStreamFinish. Try wsSendActivePush on the (possibly - // already-restored) connection; if that also fails, leave the - // route intact so Send() can push the reply once reconnected. - select { - case answer := <-task.answerCh: - if err := c.wsSendActivePush(task.ChatID, task.ChatType, answer); err != nil { - logger.WarnCF("wecom_aibot", - "Grace-period push failed after task cancellation; reply may be lost", - map[string]any{"req_id": reqID, "chat_id": task.ChatID, "error": err.Error()}) - } else { - c.deleteReqState(reqID) - } - case <-time.After(100 * time.Millisecond): - } - return - } - } - }() -} - -// handleWSVoiceMessage handles voice messages. -// WeCom transcribes voice to text in the callback; if the transcription is -// present it is dispatched as plain text to the agent. -func (c *WeComAIBotWSChannel) handleWSVoiceMessage(reqID string, msg WeComAIBotWSMessage) { - if msg.Voice != nil && msg.Voice.Content != "" { - c.dispatchWSAgentTask(reqID, msg, msg.Voice.Content, nil) - return - } - c.wsSendStreamFinish(reqID, wsGenerateID(), "Voice messages are not yet supported.") -} - -// handleWSFileMessage handles file messages. -func (c *WeComAIBotWSChannel) handleWSFileMessage(reqID string, msg WeComAIBotWSMessage) { - if msg.File == nil { - logger.WarnC("wecom_aibot", "File message missing file field") - c.wsSendStreamFinish(reqID, wsGenerateID(), "File message could not be processed.") - return - } - c.wsHandleMediaMessage(reqID, msg, msg.File.URL, msg.File.AESKey, "file") -} - -// handleWSVideoMessage handles video messages. -func (c *WeComAIBotWSChannel) handleWSVideoMessage(reqID string, msg WeComAIBotWSMessage) { - if msg.Video == nil { - logger.WarnC("wecom_aibot", "Video message missing video field") - c.wsSendStreamFinish(reqID, wsGenerateID(), "Video message could not be processed.") - return - } - c.wsHandleMediaMessage(reqID, msg, msg.Video.URL, msg.Video.AESKey, "video") -} - -// ---- WebSocket write helpers ---- - -// wsSendStreamChunk sends an aibot_respond_msg stream frame. -func (c *WeComAIBotWSChannel) wsSendStreamChunk(reqID, streamID string, finish bool, content string) { - logger.DebugCF("wecom_aibot", "Sending stream chunk", map[string]any{ - "stream_id": streamID, - "finish": finish, - "preview": utils.Truncate(content, 100), - }) - cmd := wsCommand{ - Cmd: "aibot_respond_msg", - Headers: wsHeaders{ReqID: reqID}, - Body: wsRespondMsgBody{ - MsgType: "stream", - Stream: &wsStreamContent{ - ID: streamID, - Finish: finish, - Content: content, - }, - }, - } - if err := c.writeWSAndWait(cmd, wsRespondMsgTimeout); err != nil { - logger.WarnCF("wecom_aibot", "Stream chunk ack failed", map[string]any{ - "req_id": reqID, - "stream_id": streamID, - "finish": finish, - "error": err, - }) - } -} - -// wsSendStreamFinish sends the final aibot_respond_msg frame (finish=true, no images). -func (c *WeComAIBotWSChannel) wsSendStreamFinish(reqID, streamID, content string) { - c.wsSendStreamChunk(reqID, streamID, true, content) -} - -// wsSendWelcomeMsg sends a text welcome message via aibot_respond_welcome_msg. -func (c *WeComAIBotWSChannel) wsSendWelcomeMsg(reqID, content string) { - logger.DebugCF("wecom_aibot", "Sending welcome message", map[string]any{"req_id": reqID}) - cmd := wsCommand{ - Cmd: "aibot_respond_welcome_msg", - Headers: wsHeaders{ReqID: reqID}, - Body: wsRespondMsgBody{ - MsgType: "text", - Text: &wsTextContent{Content: content}, - }, - } - if err := c.writeWSAndWait(cmd, wsWelcomeMsgTimeout); err != nil { - logger.WarnCF("wecom_aibot", "Welcome message ack failed", - map[string]any{"req_id": reqID, "error": err.Error()}) - } -} - -// wsSendActivePush sends a proactive markdown message using aibot_send_msg. -// Long content is automatically split into byte-bounded chunks (≤ wsStreamMaxContentBytes -// each) and delivered as consecutive messages. -// It is used as a fallback for late replies after stream response window expires. -func (c *WeComAIBotWSChannel) wsSendActivePush(chatID string, chatType uint32, content string) error { - if chatID == "" { - return fmt.Errorf("chatid is empty") - } - for _, chunk := range splitWSContent(content, wsStreamMaxContentBytes) { - reqID := wsGenerateID() - if err := c.writeWSAndWait(wsCommand{ - Cmd: "aibot_send_msg", - Headers: wsHeaders{ReqID: reqID}, - Body: wsSendMsgBody{ - ChatID: chatID, - ChatType: chatType, - MsgType: "markdown", - Markdown: &wsMarkdownContent{Content: chunk}, - }, - }, wsSendMsgTimeout); err != nil { - return err - } - } - return nil -} - -// writeWSAndWait writes cmd to the active connection and validates the command response. -func (c *WeComAIBotWSChannel) writeWSAndWait(cmd wsCommand, timeout time.Duration) error { - if cmd.Headers.ReqID == "" { - return fmt.Errorf("req_id is empty") - } - - c.connMu.Lock() - conn := c.conn - c.connMu.Unlock() - if conn == nil { - return fmt.Errorf("websocket not connected") - } - - resp, err := c.sendAndWait(conn, cmd.Headers.ReqID, cmd, timeout) - if err != nil { - return err - } - if resp.ErrCode != 0 { - return fmt.Errorf("%s rejected (errcode=%d): %s", cmd.Cmd, resp.ErrCode, resp.ErrMsg) - } - return nil -} - -// cancelAllTasks cancels every pending agent task; called when the connection drops. -// It also expires each task's stream window (ReadyAt = now) so that when the agent -// eventually delivers its reply via Send(), the message is forwarded via -// wsSendActivePush on the restored connection instead of being silently discarded. -func (c *WeComAIBotWSChannel) cancelAllTasks() { - c.reqStatesMu.Lock() - defer c.reqStatesMu.Unlock() - now := time.Now() - for _, state := range c.reqStates { - if state != nil && state.Task != nil { - state.Task.cancel() - state.Task = nil - // Expire the stream window immediately so Send() uses wsSendActivePush. - state.Route.ReadyAt = now - } - } -} - -func (c *WeComAIBotWSChannel) setReqState(reqID string, state *wsReqState) { - c.reqStatesMu.Lock() - defer c.reqStatesMu.Unlock() - now := time.Now() - for k, v := range c.reqStates { - if v == nil || now.After(v.Route.ExpiresAt) { - delete(c.reqStates, k) - } - } - c.reqStates[reqID] = state -} - -func (c *WeComAIBotWSChannel) getReqState(reqID string) (*wsTask, wsLateReplyRoute, bool) { - c.reqStatesMu.Lock() - defer c.reqStatesMu.Unlock() - state, ok := c.reqStates[reqID] - if !ok || state == nil { - return nil, wsLateReplyRoute{}, false - } - if time.Now().After(state.Route.ExpiresAt) { - delete(c.reqStates, reqID) - return nil, wsLateReplyRoute{}, false - } - return state.Task, state.Route, true -} - -func (c *WeComAIBotWSChannel) deleteReqState(reqID string) { - c.reqStatesMu.Lock() - delete(c.reqStates, reqID) - c.reqStatesMu.Unlock() -} - -func (c *WeComAIBotWSChannel) clearReqTask(reqID string, task *wsTask) { - c.reqStatesMu.Lock() - defer c.reqStatesMu.Unlock() - state, ok := c.reqStates[reqID] - if !ok || state == nil { - return - } - if state.Task == task { - state.Task = nil - } -} - -func wsChatTypeValue(chatType string) uint32 { - if chatType == "group" { - return 2 - } - return 1 -} - -// wsChatID returns the effective chat ID from a WS message. -// For group messages it is msg.ChatID; for single chats it falls back to the sender's UserID. -func wsChatID(msg WeComAIBotWSMessage) string { - if msg.ChatID != "" { - return msg.ChatID - } - return msg.From.UserID -} - -// wsGenerateID generates a random 10-character alphanumeric ID. -// It is package-level (not a method) so it can be shared by both channel modes. -func wsGenerateID() string { - return generateRandomID(10) -} - -// ---- Inbound media download helpers ---- - -// storeWSMedia downloads the resource at resourceURL (with optional AES-CBC -// decryption) and stores it in the MediaStore. The file extension is inferred -// from the HTTP Content-Type response header; defaultExt is used as a fallback -// when the content type is absent or unrecognized. -func (c *WeComAIBotWSChannel) storeWSMedia( - ctx context.Context, - chatID, msgID, resourceURL, aesKey, defaultExt string, -) (string, error) { - store := c.GetMediaStore() - if store == nil { - return "", fmt.Errorf("no media store available") - } - - const maxSize = 20 << 20 // 20 MB - - req, err := http.NewRequestWithContext(ctx, http.MethodGet, resourceURL, nil) - if err != nil { - return "", fmt.Errorf("create request: %w", err) - } - resp, err := wsImageHTTPClient.Do(req) - if err != nil { - return "", fmt.Errorf("download: %w", err) - } - defer resp.Body.Close() - if resp.StatusCode != http.StatusOK { - return "", fmt.Errorf("download HTTP %d", resp.StatusCode) - } - - // Infer file extension from the Content-Type response header. - ext := wsMediaExtFromContentType(resp.Header.Get("Content-Type")) - if ext == "" { - ext = defaultExt - } - - // Buffer the media in memory, bounded to maxSize. - data, err := io.ReadAll(io.LimitReader(resp.Body, int64(maxSize)+1)) - if err != nil { - return "", fmt.Errorf("read media: %w", err) - } - if len(data) > maxSize { - return "", fmt.Errorf("media too large (> %d MB)", maxSize>>20) - } - - // AES-CBC decryption if a key is present. - if aesKey != "" { - key, decErr := base64.StdEncoding.DecodeString(aesKey) - if decErr != nil || len(key) != 32 { - key, decErr = decodeWeComAESKey(aesKey) - if decErr != nil { - return "", fmt.Errorf("decode media AES key: %w", decErr) - } - } - data, err = decryptAESCBC(key, data) - if err != nil { - return "", fmt.Errorf("decrypt media: %w", err) - } - } - - // Write to a temp file. The file is owned by the MediaStore and deleted by - // store.ReleaseAll — no caller-side cleanup needed. - mediaDir := filepath.Join(os.TempDir(), "picoclaw_media") - if err = os.MkdirAll(mediaDir, 0o700); err != nil { - return "", fmt.Errorf("mkdir: %w", err) - } - tmpFile, err := os.CreateTemp(mediaDir, msgID+"-*"+ext) - if err != nil { - return "", fmt.Errorf("create temp file: %w", err) - } - tmpPath := tmpFile.Name() - _, writeErr := tmpFile.Write(data) - closeErr := tmpFile.Close() - if writeErr != nil { - os.Remove(tmpPath) - return "", fmt.Errorf("write media: %w", writeErr) - } - if closeErr != nil { - os.Remove(tmpPath) - return "", fmt.Errorf("close media: %w", closeErr) - } - - scope := channels.BuildMediaScope("wecom_aibot", chatID, msgID) - ref, err := store.Store(tmpPath, media.MediaMeta{ - Filename: msgID + ext, - Source: "wecom_aibot", - CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, - }, scope) - if err != nil { - os.Remove(tmpPath) - return "", fmt.Errorf("store: %w", err) - } - return ref, nil -} - -// wsMediaExtFromContentType returns the lowercase file extension (with leading -// dot) for the given Content-Type value, or "" when the type is unrecognized. -func wsMediaExtFromContentType(contentType string) string { - if contentType == "" { - return "" - } - // Strip parameters (e.g. "image/jpeg; charset=utf-8" → "image/jpeg"). - mt := strings.ToLower(strings.TrimSpace(strings.SplitN(contentType, ";", 2)[0])) - switch mt { - case "image/jpeg", "image/jpg": - return ".jpg" - case "image/png": - return ".png" - case "image/gif": - return ".gif" - case "image/webp": - return ".webp" - case "video/mp4": - return ".mp4" - case "video/mpeg", "video/x-mpeg": - return ".mpeg" - case "video/quicktime": - return ".mov" - case "video/webm": - return ".webm" - case "audio/mpeg", "audio/mp3": - return ".mp3" - case "audio/ogg": - return ".ogg" - case "audio/wav": - return ".wav" - case "application/pdf": - return ".pdf" - case "application/zip": - return ".zip" - case "application/x-rar-compressed", "application/vnd.rar": - return ".rar" - case "text/plain": - return ".txt" - case "application/msword": - return ".doc" - case "application/vnd.openxmlformats-officedocument.wordprocessingml.document": - return ".docx" - case "application/vnd.ms-excel": - return ".xls" - case "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": - return ".xlsx" - case "application/vnd.ms-powerpoint": - return ".ppt" - case "application/vnd.openxmlformats-officedocument.presentationml.presentation": - return ".pptx" - } - return "" -} - -// wsLabelToDefaultExt returns the default file extension for the given media label -// used in wsHandleMediaMessage. It is the fallback when Content-Type detection fails. -func wsLabelToDefaultExt(label string) string { - switch label { - case "image": - return ".jpg" - case "video": - return ".mp4" - default: // "file" and any future labels - return ".bin" - } -} - -// ---- Content length helpers ---- - -// splitWSContent splits content into chunks each fitting within maxBytes UTF-8 -// bytes, preserving code block integrity via channels.SplitMessage. -// When SplitMessage still produces an oversized chunk (e.g. dense CJK content), -// splitAtByteBoundary is applied as a last-resort byte-level fallback. -func splitWSContent(content string, maxBytes int) []string { - if len(content) <= maxBytes { - return []string{content} - } - // SplitMessage works in runes. Use maxBytes as the rune limit: for pure ASCII - // this is exact; for multibyte content the byte verification below catches - // any chunk that still overflows. - chunks := channels.SplitMessage(content, maxBytes) - var result []string - for _, chunk := range chunks { - if len(chunk) <= maxBytes { - result = append(result, chunk) - } else { - // Still too large in bytes (e.g. dense CJK); force-split at UTF-8 boundaries. - result = append(result, splitAtByteBoundary(chunk, maxBytes)...) - } - } - return result -} - -// splitAtByteBoundary splits s into parts each ≤ maxBytes bytes by walking back -// from the hard byte limit to find a valid UTF-8 rune start boundary. -// This is a last-resort fallback; it does not try to preserve code blocks. -func splitAtByteBoundary(s string, maxBytes int) []string { - var parts []string - for len(s) > maxBytes { - end := maxBytes - // Walk back past any UTF-8 continuation bytes (high two bits == 10). - for end > 0 && s[end]>>6 == 0b10 { - end-- - } - if end == 0 { - end = maxBytes // shouldn't happen with valid UTF-8 - } - parts = append(parts, s[:end]) - s = strings.TrimLeft(s[end:], " \t\n\r") - } - if s != "" { - parts = append(parts, s) - } - return parts -} diff --git a/pkg/channels/wecom/aibot_ws_test.go b/pkg/channels/wecom/aibot_ws_test.go deleted file mode 100644 index f2f8833a1..000000000 --- a/pkg/channels/wecom/aibot_ws_test.go +++ /dev/null @@ -1,295 +0,0 @@ -package wecom - -import ( - "bytes" - "context" - "net/http" - "net/http/httptest" - "os" - "strings" - "testing" - - "github.com/sipeed/picoclaw/pkg/bus" - "github.com/sipeed/picoclaw/pkg/channels" - "github.com/sipeed/picoclaw/pkg/config" - "github.com/sipeed/picoclaw/pkg/media" -) - -// newTestWSChannel creates a WeComAIBotWSChannel ready for unit testing. -func newTestWSChannel(t *testing.T) *WeComAIBotWSChannel { - t.Helper() - cfg := config.WeComAIBotConfig{ - Enabled: true, - BotID: "test_bot_id", - } - cfg.SetSecret("test_secret") - ch, err := newWeComAIBotWSChannel(cfg, bus.NewMessageBus()) - if err != nil { - t.Fatalf("create WS channel: %v", err) - } - return ch -} - -// TestStoreWSMedia_NilStore verifies that storeWSMedia returns an error when no -// MediaStore has been injected. -func TestStoreWSMedia_NilStore(t *testing.T) { - ch := newTestWSChannel(t) - _, err := ch.storeWSMedia(context.Background(), "chat1", "msg1", "http://any", "", ".jpg") - if err == nil { - t.Fatal("expected error when no MediaStore is set") - } -} - -// TestStoreWSMedia_HTTPError verifies that storeWSMedia propagates HTTP errors -// from the media server. -func TestStoreWSMedia_HTTPError(t *testing.T) { - srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { - http.Error(w, "not found", http.StatusNotFound) - })) - defer srv.Close() - - ch := newTestWSChannel(t) - ch.SetMediaStore(media.NewFileMediaStore()) - - _, err := ch.storeWSMedia(context.Background(), "chat1", "msg1", srv.URL, "", ".jpg") - if err == nil { - t.Fatal("expected error for HTTP 404") - } -} - -// TestStoreWSMedia_ServerUnavailable verifies that storeWSMedia returns a clear -// error when the media server cannot be reached. -func TestStoreWSMedia_ServerUnavailable(t *testing.T) { - ch := newTestWSChannel(t) - ch.SetMediaStore(media.NewFileMediaStore()) - - // Port 1 is reserved and will refuse the connection immediately. - _, err := ch.storeWSMedia(context.Background(), "chat1", "msg1", "http://127.0.0.1:1", "", ".jpg") - if err == nil { - t.Fatal("expected error for unreachable server") - } -} - -// TestStoreWSMedia_Success_NoAES verifies the happy path: the media is downloaded, -// a media ref is returned, and the file persists and is readable via Resolve until -// ReleaseAll is called. The server returns no Content-Type, so the defaultExt is used. -func TestStoreWSMedia_Success_NoAES(t *testing.T) { - imageData := bytes.Repeat([]byte("x"), 256) - srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { - w.WriteHeader(http.StatusOK) - _, _ = w.Write(imageData) - })) - defer srv.Close() - - ch := newTestWSChannel(t) - store := media.NewFileMediaStore() - ch.SetMediaStore(store) - - ref, err := ch.storeWSMedia(context.Background(), "chat1", "msg1", srv.URL, "", ".jpg") - if err != nil { - t.Fatalf("expected no error, got %v", err) - } - if ref == "" { - t.Fatal("expected non-empty ref") - } - - // File must be accessible after storeWSMedia returns (no premature deletion). - path, err := store.Resolve(ref) - if err != nil { - t.Fatalf("ref should resolve: %v", err) - } - got, err := os.ReadFile(path) - if err != nil { - t.Fatalf("file should exist at %s: %v", path, err) - } - if !bytes.Equal(got, imageData) { - t.Errorf("content mismatch: got len=%d, want len=%d", len(got), len(imageData)) - } - - // ReleaseAll must delete the file (store owns lifecycle). - scope := channels.BuildMediaScope("wecom_aibot", "chat1", "msg1") - if err := store.ReleaseAll(scope); err != nil { - t.Fatalf("ReleaseAll failed: %v", err) - } - if _, err := os.Stat(path); !os.IsNotExist(err) { - t.Errorf("file should have been deleted by ReleaseAll, stat err: %v", err) - } -} - -// TestStoreWSMedia_MultipleMessages verifies that concurrent media messages with -// different msgIDs do not collide and each resolve to distinct files. -func TestStoreWSMedia_MultipleMessages(t *testing.T) { - imageA := bytes.Repeat([]byte("a"), 64) - imageB := bytes.Repeat([]byte("b"), 64) - - srvA := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { - w.WriteHeader(http.StatusOK) - _, _ = w.Write(imageA) - })) - defer srvA.Close() - srvB := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { - w.WriteHeader(http.StatusOK) - _, _ = w.Write(imageB) - })) - defer srvB.Close() - - ch := newTestWSChannel(t) - store := media.NewFileMediaStore() - ch.SetMediaStore(store) - - refA, err := ch.storeWSMedia(context.Background(), "chat1", "msgA", srvA.URL, "", ".jpg") - if err != nil { - t.Fatalf("storeWSMedia A: %v", err) - } - refB, err := ch.storeWSMedia(context.Background(), "chat1", "msgB", srvB.URL, "", ".jpg") - if err != nil { - t.Fatalf("storeWSMedia B: %v", err) - } - if refA == refB { - t.Fatal("distinct messages must produce distinct refs") - } - - pathA, _ := store.Resolve(refA) - pathB, _ := store.Resolve(refB) - if pathA == pathB { - t.Fatal("distinct messages must be stored at distinct paths") - } - - gotA, _ := os.ReadFile(pathA) - gotB, _ := os.ReadFile(pathB) - if !bytes.Equal(gotA, imageA) { - t.Errorf("content mismatch for message A") - } - if !bytes.Equal(gotB, imageB) { - t.Errorf("content mismatch for message B") - } -} - -// TestStoreWSMedia_ContentTypeExt verifies that the file extension is inferred -// from the HTTP Content-Type header and the defaultExt fallback is used when the -// type is absent or unrecognized. -func TestStoreWSMedia_ContentTypeExt(t *testing.T) { - tests := []struct { - contentType string - wantExt string - }{ - {"image/jpeg", ".jpg"}, - {"image/png", ".png"}, - {"video/mp4", ".mp4"}, - {"application/pdf", ".pdf"}, - {"application/zip", ".zip"}, - // With parameters stripped. - {"video/mp4; codecs=avc1", ".mp4"}, - // Unknown type → falls back to defaultExt. - {"", ""}, - {"application/octet-stream", ""}, - } - for _, tc := range tests { - got := wsMediaExtFromContentType(tc.contentType) - if got != tc.wantExt { - t.Errorf("wsMediaExtFromContentType(%q) = %q, want %q", tc.contentType, got, tc.wantExt) - } - } - - // End-to-end: server returns Content-Type: video/mp4, defaultExt is .bin. - // The stored file should carry the .mp4 extension, not .bin. - payload := bytes.Repeat([]byte("v"), 128) - srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { - w.Header().Set("Content-Type", "video/mp4") - w.WriteHeader(http.StatusOK) - _, _ = w.Write(payload) - })) - defer srv.Close() - - ch := newTestWSChannel(t) - store := media.NewFileMediaStore() - ch.SetMediaStore(store) - - ref, err := ch.storeWSMedia(context.Background(), "chat1", "vid1", srv.URL, "", ".bin") - if err != nil { - t.Fatalf("storeWSMedia: %v", err) - } - path, err := store.Resolve(ref) - if err != nil { - t.Fatalf("resolve: %v", err) - } - if ext := path[len(path)-4:]; ext != ".mp4" { - t.Errorf("expected .mp4 extension from Content-Type, got %q", ext) - } -} - -// TestSplitWSContent verifies byte-aware splitting of stream content. -func TestSplitWSContent(t *testing.T) { - t.Run("short content is not split", func(t *testing.T) { - chunks := splitWSContent("hello", 20480) - if len(chunks) != 1 || chunks[0] != "hello" { - t.Fatalf("unexpected chunks: %v", chunks) - } - }) - - t.Run("ASCII content split at byte boundary", func(t *testing.T) { - // Build a string just over the limit. - content := strings.Repeat("a", 20481) - chunks := splitWSContent(content, 20480) - if len(chunks) < 2 { - t.Fatalf("expected >= 2 chunks, got %d", len(chunks)) - } - for i, c := range chunks { - if len(c) > 20480 { - t.Errorf("chunk %d has %d bytes, want <= 20480", i, len(c)) - } - } - // Reassembled content must equal the original (possibly without leading - // whitespace that splitWSContent trims between chunks). - joined := strings.Join(chunks, "") - if len(joined) < len(content)-len(chunks) { - t.Errorf("joined length %d too short (original %d)", len(joined), len(content)) - } - }) - - t.Run("CJK content split within byte limit", func(t *testing.T) { - // Each CJK rune is 3 bytes in UTF-8. - // 7000 CJK chars = 21000 bytes, which exceeds 20480. - content := strings.Repeat("\u4e2d", 7000) - chunks := splitWSContent(content, 20480) - if len(chunks) < 2 { - t.Fatalf("expected >= 2 chunks for 21000-byte CJK content, got %d", len(chunks)) - } - for i, c := range chunks { - if len(c) > 20480 { - t.Errorf("chunk %d has %d bytes, want <= 20480", i, len(c)) - } - // Every chunk must be valid UTF-8. - if !strings.ContainsRune(c, '\u4e2d') && len(c) > 0 { - // quick plausibility check — content was pure CJK - } - } - }) -} - -// TestSplitAtByteBoundary verifies the last-resort byte-boundary splitter. -func TestSplitAtByteBoundary(t *testing.T) { - t.Run("ASCII fits in one chunk", func(t *testing.T) { - parts := splitAtByteBoundary("hello world", 100) - if len(parts) != 1 { - t.Fatalf("expected 1 part, got %d", len(parts)) - } - }) - - t.Run("splits at byte boundary, never mid-rune", func(t *testing.T) { - // 10 CJK characters = 30 bytes; split at 20 bytes. - s := strings.Repeat("\u6587", 10) // 10 × 3 bytes = 30 bytes - parts := splitAtByteBoundary(s, 20) - for i, p := range parts { - if len(p) > 20 { - t.Errorf("part %d has %d bytes, want <= 20", i, len(p)) - } - // Must be valid UTF-8 (no torn multi-byte sequences). - for j, r := range p { - if r == '\uFFFD' { - t.Errorf("part %d has replacement rune at position %d: torn UTF-8", i, j) - } - } - } - }) -} diff --git a/pkg/channels/wecom/app.go b/pkg/channels/wecom/app.go deleted file mode 100644 index fccfc60a3..000000000 --- a/pkg/channels/wecom/app.go +++ /dev/null @@ -1,756 +0,0 @@ -package wecom - -import ( - "bytes" - "context" - "encoding/json" - "encoding/xml" - "fmt" - "io" - "mime/multipart" - "net/http" - "net/url" - "os" - "path/filepath" - "strings" - "sync" - "time" - - "github.com/sipeed/picoclaw/pkg/bus" - "github.com/sipeed/picoclaw/pkg/channels" - "github.com/sipeed/picoclaw/pkg/config" - "github.com/sipeed/picoclaw/pkg/identity" - "github.com/sipeed/picoclaw/pkg/logger" - "github.com/sipeed/picoclaw/pkg/utils" -) - -const ( - wecomAPIBase = "https://qyapi.weixin.qq.com" -) - -// WeComAppChannel implements the Channel interface for WeCom App (企业微信自建应用) -type WeComAppChannel struct { - *channels.BaseChannel - config config.WeComAppConfig - client *http.Client - accessToken string - tokenExpiry time.Time - tokenMu sync.RWMutex - ctx context.Context - cancel context.CancelFunc - processedMsgs *MessageDeduplicator -} - -// WeComXMLMessage represents the XML message structure from WeCom -type WeComXMLMessage struct { - XMLName xml.Name `xml:"xml"` - ToUserName string `xml:"ToUserName"` - FromUserName string `xml:"FromUserName"` - CreateTime int64 `xml:"CreateTime"` - MsgType string `xml:"MsgType"` - Content string `xml:"Content"` - MsgId int64 `xml:"MsgId"` - AgentID int64 `xml:"AgentID"` - PicUrl string `xml:"PicUrl"` - MediaId string `xml:"MediaId"` - Format string `xml:"Format"` - ThumbMediaId string `xml:"ThumbMediaId"` - LocationX float64 `xml:"Location_X"` - LocationY float64 `xml:"Location_Y"` - Scale int `xml:"Scale"` - Label string `xml:"Label"` - Title string `xml:"Title"` - Description string `xml:"Description"` - Url string `xml:"Url"` - Event string `xml:"Event"` - EventKey string `xml:"EventKey"` -} - -// WeComTextMessage represents text message for sending -type WeComTextMessage struct { - ToUser string `json:"touser"` - MsgType string `json:"msgtype"` - AgentID int64 `json:"agentid"` - Text struct { - Content string `json:"content"` - } `json:"text"` - Safe int `json:"safe,omitempty"` -} - -// WeComMarkdownMessage represents markdown message for sending -type WeComMarkdownMessage struct { - ToUser string `json:"touser"` - MsgType string `json:"msgtype"` - AgentID int64 `json:"agentid"` - Markdown struct { - Content string `json:"content"` - } `json:"markdown"` -} - -// WeComImageMessage represents image message for sending -type WeComImageMessage struct { - ToUser string `json:"touser"` - MsgType string `json:"msgtype"` - AgentID int64 `json:"agentid"` - Image struct { - MediaID string `json:"media_id"` - } `json:"image"` -} - -// WeComAccessTokenResponse represents the access token API response -type WeComAccessTokenResponse struct { - ErrCode int `json:"errcode"` - ErrMsg string `json:"errmsg"` - AccessToken string `json:"access_token"` - ExpiresIn int `json:"expires_in"` -} - -// WeComSendMessageResponse represents the send message API response -type WeComSendMessageResponse struct { - ErrCode int `json:"errcode"` - ErrMsg string `json:"errmsg"` - InvalidUser string `json:"invaliduser"` - InvalidParty string `json:"invalidparty"` - InvalidTag string `json:"invalidtag"` -} - -// PKCS7Padding adds PKCS7 padding -type PKCS7Padding struct{} - -// NewWeComAppChannel creates a new WeCom App channel instance -func NewWeComAppChannel(cfg config.WeComAppConfig, messageBus *bus.MessageBus) (*WeComAppChannel, error) { - if cfg.CorpID == "" || cfg.CorpSecret() == "" || cfg.AgentID == 0 { - return nil, fmt.Errorf("wecom_app corp_id, corp_secret and agent_id are required") - } - - base := channels.NewBaseChannel("wecom_app", cfg, messageBus, cfg.AllowFrom, - channels.WithMaxMessageLength(2048), - channels.WithGroupTrigger(cfg.GroupTrigger), - channels.WithReasoningChannelID(cfg.ReasoningChannelID), - ) - - // Client timeout must be >= the configured ReplyTimeout so the - // per-request context deadline is always the effective limit. - clientTimeout := 30 * time.Second - if d := time.Duration(cfg.ReplyTimeout) * time.Second; d > clientTimeout { - clientTimeout = d - } - - ctx, cancel := context.WithCancel(context.Background()) - return &WeComAppChannel{ - BaseChannel: base, - config: cfg, - client: &http.Client{Timeout: clientTimeout}, - ctx: ctx, - cancel: cancel, - processedMsgs: NewMessageDeduplicator(wecomMaxProcessedMessages), - }, nil -} - -// Name returns the channel name -func (c *WeComAppChannel) Name() string { - return "wecom_app" -} - -// Start initializes the WeCom App channel -func (c *WeComAppChannel) Start(ctx context.Context) error { - logger.InfoC("wecom_app", "Starting WeCom App channel...") - - // Cancel the context created in the constructor to avoid a resource leak. - if c.cancel != nil { - c.cancel() - } - c.ctx, c.cancel = context.WithCancel(ctx) - - // Get initial access token - if err := c.refreshAccessToken(); err != nil { - logger.WarnCF("wecom_app", "Failed to get initial access token", map[string]any{ - "error": err.Error(), - }) - } - - // Start token refresh goroutine - go c.tokenRefreshLoop() - - c.SetRunning(true) - logger.InfoC("wecom_app", "WeCom App channel started") - - return nil -} - -// Stop gracefully stops the WeCom App channel -func (c *WeComAppChannel) Stop(ctx context.Context) error { - logger.InfoC("wecom_app", "Stopping WeCom App channel...") - - if c.cancel != nil { - c.cancel() - } - - c.SetRunning(false) - logger.InfoC("wecom_app", "WeCom App channel stopped") - return nil -} - -// Send sends a message to WeCom user proactively using access token -func (c *WeComAppChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { - if !c.IsRunning() { - return channels.ErrNotRunning - } - - accessToken := c.getAccessToken() - if accessToken == "" { - return fmt.Errorf("no valid access token available") - } - - logger.DebugCF("wecom_app", "Sending message", map[string]any{ - "chat_id": msg.ChatID, - "preview": utils.Truncate(msg.Content, 100), - }) - - return c.sendTextMessage(ctx, accessToken, msg.ChatID, msg.Content) -} - -// SendMedia implements the channels.MediaSender interface. -func (c *WeComAppChannel) SendMedia(ctx context.Context, msg bus.OutboundMediaMessage) error { - if !c.IsRunning() { - return channels.ErrNotRunning - } - - accessToken := c.getAccessToken() - if accessToken == "" { - return fmt.Errorf("no valid access token available: %w", channels.ErrTemporary) - } - - store := c.GetMediaStore() - if store == nil { - return fmt.Errorf("no media store available: %w", channels.ErrSendFailed) - } - - for _, part := range msg.Parts { - localPath, err := store.Resolve(part.Ref) - if err != nil { - logger.ErrorCF("wecom_app", "Failed to resolve media ref", map[string]any{ - "ref": part.Ref, - "error": err.Error(), - }) - continue - } - - // Map part type to WeCom media type - var mediaType string - switch part.Type { - case "image": - mediaType = "image" - case "audio": - mediaType = "voice" - case "video": - mediaType = "video" - default: - mediaType = "file" - } - - // Upload media to get media_id - mediaID, err := c.uploadMedia(ctx, accessToken, mediaType, localPath) - if err != nil { - logger.ErrorCF("wecom_app", "Failed to upload media", map[string]any{ - "type": mediaType, - "error": err.Error(), - }) - // Fallback: send caption as text - if part.Caption != "" { - _ = c.sendTextMessage(ctx, accessToken, msg.ChatID, part.Caption) - } - continue - } - - // Send media message using the media_id - if mediaType == "image" { - err = c.sendImageMessage(ctx, accessToken, msg.ChatID, mediaID) - } else { - // For non-image types, send as text fallback with caption - caption := part.Caption - if caption == "" { - caption = fmt.Sprintf("[%s: %s]", part.Type, part.Filename) - } - err = c.sendTextMessage(ctx, accessToken, msg.ChatID, caption) - } - - if err != nil { - return err - } - } - - return nil -} - -// uploadMedia uploads a local file to WeCom temporary media storage. -func (c *WeComAppChannel) uploadMedia(ctx context.Context, accessToken, mediaType, localPath string) (string, error) { - apiURL := fmt.Sprintf("%s/cgi-bin/media/upload?access_token=%s&type=%s", - wecomAPIBase, url.QueryEscape(accessToken), url.QueryEscape(mediaType)) - - file, err := os.Open(localPath) - if err != nil { - return "", fmt.Errorf("failed to open file: %w", err) - } - defer file.Close() - - body := &bytes.Buffer{} - writer := multipart.NewWriter(body) - - filename := filepath.Base(localPath) - formFile, err := writer.CreateFormFile("media", filename) - if err != nil { - return "", fmt.Errorf("failed to create form file: %w", err) - } - - if _, err = io.Copy(formFile, file); err != nil { - return "", fmt.Errorf("failed to copy file content: %w", err) - } - writer.Close() - - req, err := http.NewRequestWithContext(ctx, http.MethodPost, apiURL, body) - if err != nil { - return "", fmt.Errorf("failed to create request: %w", err) - } - req.Header.Set("Content-Type", writer.FormDataContentType()) - - resp, err := c.client.Do(req) - if err != nil { - return "", channels.ClassifyNetError(err) - } - defer resp.Body.Close() - - if resp.StatusCode != http.StatusOK { - respBody, readErr := io.ReadAll(resp.Body) - if readErr != nil { - return "", channels.ClassifySendError( - resp.StatusCode, - fmt.Errorf("reading wecom upload error response: %w", readErr), - ) - } - return "", channels.ClassifySendError( - resp.StatusCode, - fmt.Errorf("wecom upload error: %s", string(respBody)), - ) - } - - var result struct { - ErrCode int `json:"errcode"` - ErrMsg string `json:"errmsg"` - MediaID string `json:"media_id"` - } - if err := json.NewDecoder(resp.Body).Decode(&result); err != nil { - return "", fmt.Errorf("failed to parse upload response: %w", err) - } - - if result.ErrCode != 0 { - return "", fmt.Errorf("upload API error: %s (code: %d)", result.ErrMsg, result.ErrCode) - } - - return result.MediaID, nil -} - -// sendWeComMessage marshals payload and POSTs it to the WeCom message API. -func (c *WeComAppChannel) sendWeComMessage(ctx context.Context, accessToken string, payload any) error { - apiURL := fmt.Sprintf("%s/cgi-bin/message/send?access_token=%s", wecomAPIBase, accessToken) - - jsonData, err := json.Marshal(payload) - if err != nil { - return fmt.Errorf("failed to marshal message: %w", err) - } - - timeout := c.config.ReplyTimeout - if timeout <= 0 { - timeout = 5 - } - - reqCtx, cancel := context.WithTimeout(ctx, time.Duration(timeout)*time.Second) - defer cancel() - - req, err := http.NewRequestWithContext(reqCtx, http.MethodPost, apiURL, bytes.NewBuffer(jsonData)) - if err != nil { - return fmt.Errorf("failed to create request: %w", err) - } - req.Header.Set("Content-Type", "application/json") - - resp, err := c.client.Do(req) - if err != nil { - return channels.ClassifyNetError(err) - } - defer resp.Body.Close() - - if resp.StatusCode != http.StatusOK { - respBody, readErr := io.ReadAll(resp.Body) - if readErr != nil { - return channels.ClassifySendError( - resp.StatusCode, - fmt.Errorf("reading wecom_app error response: %w", readErr), - ) - } - return channels.ClassifySendError( - resp.StatusCode, - fmt.Errorf("wecom_app API error: %s", string(respBody)), - ) - } - - respBody, err := io.ReadAll(resp.Body) - if err != nil { - return fmt.Errorf("failed to read response: %w", err) - } - - var sendResp WeComSendMessageResponse - if err := json.Unmarshal(respBody, &sendResp); err != nil { - return fmt.Errorf("failed to parse response: %w", err) - } - - if sendResp.ErrCode != 0 { - return fmt.Errorf("API error: %s (code: %d)", sendResp.ErrMsg, sendResp.ErrCode) - } - - return nil -} - -// sendImageMessage sends an image message using a media_id. -func (c *WeComAppChannel) sendImageMessage(ctx context.Context, accessToken, userID, mediaID string) error { - msg := WeComImageMessage{ - ToUser: userID, - MsgType: "image", - AgentID: c.config.AgentID, - } - msg.Image.MediaID = mediaID - return c.sendWeComMessage(ctx, accessToken, msg) -} - -// WebhookPath returns the path for registering on the shared HTTP server. -func (c *WeComAppChannel) WebhookPath() string { - if c.config.WebhookPath != "" { - return c.config.WebhookPath - } - return "/webhook/wecom-app" -} - -// ServeHTTP implements http.Handler for the shared HTTP server. -func (c *WeComAppChannel) ServeHTTP(w http.ResponseWriter, r *http.Request) { - c.handleWebhook(w, r) -} - -// HealthPath returns the health check endpoint path. -func (c *WeComAppChannel) HealthPath() string { - return "/health/wecom-app" -} - -// HealthHandler handles health check requests. -func (c *WeComAppChannel) HealthHandler(w http.ResponseWriter, r *http.Request) { - c.handleHealth(w, r) -} - -// handleWebhook handles incoming webhook requests from WeCom -func (c *WeComAppChannel) handleWebhook(w http.ResponseWriter, r *http.Request) { - ctx := r.Context() - - // Log all incoming requests for debugging - logger.DebugCF("wecom_app", "Received webhook request", map[string]any{ - "method": r.Method, - "url": r.URL.String(), - "path": r.URL.Path, - "query": r.URL.RawQuery, - }) - - if r.Method == http.MethodGet { - // Handle verification request - c.handleVerification(ctx, w, r) - return - } - - if r.Method == http.MethodPost { - // Handle message callback - c.handleMessageCallback(ctx, w, r) - return - } - - logger.WarnCF("wecom_app", "Method not allowed", map[string]any{ - "method": r.Method, - }) - http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) -} - -// handleVerification handles the URL verification request from WeCom -func (c *WeComAppChannel) handleVerification(ctx context.Context, w http.ResponseWriter, r *http.Request) { - query := r.URL.Query() - msgSignature := query.Get("msg_signature") - timestamp := query.Get("timestamp") - nonce := query.Get("nonce") - echostr := query.Get("echostr") - - logger.DebugCF("wecom_app", "Handling verification request", map[string]any{ - "msg_signature": msgSignature, - "timestamp": timestamp, - "nonce": nonce, - "echostr": echostr, - "corp_id": c.config.CorpID, - }) - - if msgSignature == "" || timestamp == "" || nonce == "" || echostr == "" { - logger.ErrorC("wecom_app", "Missing parameters in verification request") - http.Error(w, "Missing parameters", http.StatusBadRequest) - return - } - - // Verify signature - if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, echostr) { - logger.WarnCF("wecom_app", "Signature verification failed", map[string]any{ - "token": c.config.Token(), - "msg_signature": msgSignature, - "timestamp": timestamp, - "nonce": nonce, - }) - http.Error(w, "Invalid signature", http.StatusForbidden) - return - } - - logger.DebugC("wecom_app", "Signature verification passed") - - // Decrypt echostr with CorpID verification - // For WeCom App (自建应用), receiveid should be corp_id - logger.DebugCF("wecom_app", "Attempting to decrypt echostr", map[string]any{ - "encoding_aes_key": c.config.EncodingAESKey(), - "corp_id": c.config.CorpID, - }) - decryptedEchoStr, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey(), c.config.CorpID) - if err != nil { - logger.ErrorCF("wecom_app", "Failed to decrypt echostr", map[string]any{ - "error": err.Error(), - "encoding_aes_key": c.config.EncodingAESKey, - "corp_id": c.config.CorpID, - }) - http.Error(w, "Decryption failed", http.StatusInternalServerError) - return - } - - logger.DebugCF("wecom_app", "Successfully decrypted echostr", map[string]any{ - "decrypted": decryptedEchoStr, - }) - - // Remove BOM and whitespace as per WeCom documentation - // The response must be plain text without quotes, BOM, or newlines - decryptedEchoStr = strings.TrimSpace(decryptedEchoStr) - decryptedEchoStr = strings.TrimPrefix(decryptedEchoStr, "\xef\xbb\xbf") // Remove UTF-8 BOM - w.Write([]byte(decryptedEchoStr)) -} - -// handleMessageCallback handles incoming messages from WeCom -func (c *WeComAppChannel) handleMessageCallback(ctx context.Context, w http.ResponseWriter, r *http.Request) { - query := r.URL.Query() - msgSignature := query.Get("msg_signature") - timestamp := query.Get("timestamp") - nonce := query.Get("nonce") - - if msgSignature == "" || timestamp == "" || nonce == "" { - http.Error(w, "Missing parameters", http.StatusBadRequest) - return - } - - // Read request body - body, err := io.ReadAll(r.Body) - if err != nil { - http.Error(w, "Failed to read body", http.StatusBadRequest) - return - } - defer r.Body.Close() - - // Parse XML to get encrypted message - var encryptedMsg struct { - XMLName xml.Name `xml:"xml"` - ToUserName string `xml:"ToUserName"` - Encrypt string `xml:"Encrypt"` - AgentID string `xml:"AgentID"` - } - - if err = xml.Unmarshal(body, &encryptedMsg); err != nil { - logger.ErrorCF("wecom_app", "Failed to parse XML", map[string]any{ - "error": err.Error(), - }) - http.Error(w, "Invalid XML", http.StatusBadRequest) - return - } - - // Verify signature - if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { - logger.WarnC("wecom_app", "Message signature verification failed") - http.Error(w, "Invalid signature", http.StatusForbidden) - return - } - - // Decrypt message with CorpID verification - // For WeCom App (自建应用), receiveid should be corp_id - decryptedMsg, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey(), c.config.CorpID) - if err != nil { - logger.ErrorCF("wecom_app", "Failed to decrypt message", map[string]any{ - "error": err.Error(), - }) - http.Error(w, "Decryption failed", http.StatusInternalServerError) - return - } - - // Parse decrypted XML message - var msg WeComXMLMessage - if err := xml.Unmarshal([]byte(decryptedMsg), &msg); err != nil { - logger.ErrorCF("wecom_app", "Failed to parse decrypted message", map[string]any{ - "error": err.Error(), - }) - http.Error(w, "Invalid message format", http.StatusBadRequest) - return - } - - // Process the message with the channel's long-lived context (not the HTTP - // request context, which is canceled as soon as we return the response). - go c.processMessage(c.ctx, msg) - - // Return success response immediately - // WeCom App requires response within configured timeout (default 5 seconds) - w.Write([]byte("success")) -} - -// processMessage processes the received message -func (c *WeComAppChannel) processMessage(ctx context.Context, msg WeComXMLMessage) { - // Skip non-text messages for now (can be extended) - if msg.MsgType != "text" && msg.MsgType != "image" && msg.MsgType != "voice" { - logger.DebugCF("wecom_app", "Skipping non-supported message type", map[string]any{ - "msg_type": msg.MsgType, - }) - return - } - - // Message deduplication: Use msg_id to prevent duplicate processing - // As per WeCom documentation, use msg_id for deduplication - msgID := fmt.Sprintf("%d", msg.MsgId) - if !c.processedMsgs.MarkMessageProcessed(msgID) { - logger.DebugCF("wecom_app", "Skipping duplicate message", map[string]any{ - "msg_id": msgID, - }) - return - } - - senderID := msg.FromUserName - chatID := senderID // WeCom App uses user ID as chat ID for direct messages - - // Build metadata - // WeCom App only supports direct messages (private chat) - peer := bus.Peer{Kind: "direct", ID: senderID} - messageID := fmt.Sprintf("%d", msg.MsgId) - - metadata := map[string]string{ - "msg_type": msg.MsgType, - "msg_id": fmt.Sprintf("%d", msg.MsgId), - "agent_id": fmt.Sprintf("%d", msg.AgentID), - "platform": "wecom_app", - "media_id": msg.MediaId, - "create_time": fmt.Sprintf("%d", msg.CreateTime), - } - - content := msg.Content - - logger.DebugCF("wecom_app", "Received message", map[string]any{ - "sender_id": senderID, - "msg_type": msg.MsgType, - "preview": utils.Truncate(content, 50), - }) - - // Build sender info - appSender := bus.SenderInfo{ - Platform: "wecom", - PlatformID: senderID, - CanonicalID: identity.BuildCanonicalID("wecom", senderID), - } - - // Handle the message through the base channel - c.HandleMessage(ctx, peer, messageID, senderID, chatID, content, nil, metadata, appSender) -} - -// tokenRefreshLoop periodically refreshes the access token -func (c *WeComAppChannel) tokenRefreshLoop() { - ticker := time.NewTicker(5 * time.Minute) - defer ticker.Stop() - - for { - select { - case <-c.ctx.Done(): - return - case <-ticker.C: - if err := c.refreshAccessToken(); err != nil { - logger.ErrorCF("wecom_app", "Failed to refresh access token", map[string]any{ - "error": err.Error(), - }) - } - } - } -} - -// refreshAccessToken gets a new access token from WeCom API -func (c *WeComAppChannel) refreshAccessToken() error { - apiURL := fmt.Sprintf("%s/cgi-bin/gettoken?corpid=%s&corpsecret=%s", - wecomAPIBase, url.QueryEscape(c.config.CorpID), url.QueryEscape(c.config.CorpSecret())) - - resp, err := http.Get(apiURL) - if err != nil { - return fmt.Errorf("failed to request access token: %w", err) - } - defer resp.Body.Close() - - body, err := io.ReadAll(resp.Body) - if err != nil { - return fmt.Errorf("failed to read response: %w", err) - } - - var tokenResp WeComAccessTokenResponse - if err := json.Unmarshal(body, &tokenResp); err != nil { - return fmt.Errorf("failed to parse response: %w", err) - } - - if tokenResp.ErrCode != 0 { - return fmt.Errorf("API error: %s (code: %d)", tokenResp.ErrMsg, tokenResp.ErrCode) - } - - c.tokenMu.Lock() - c.accessToken = tokenResp.AccessToken - c.tokenExpiry = time.Now().Add(time.Duration(tokenResp.ExpiresIn-300) * time.Second) // Refresh 5 minutes early - c.tokenMu.Unlock() - - logger.DebugC("wecom_app", "Access token refreshed successfully") - return nil -} - -// getAccessToken returns the current valid access token -func (c *WeComAppChannel) getAccessToken() string { - c.tokenMu.RLock() - defer c.tokenMu.RUnlock() - - if time.Now().After(c.tokenExpiry) { - return "" - } - - return c.accessToken -} - -// sendTextMessage sends a text message to a user. -func (c *WeComAppChannel) sendTextMessage(ctx context.Context, accessToken, userID, content string) error { - msg := WeComTextMessage{ - ToUser: userID, - MsgType: "text", - AgentID: c.config.AgentID, - } - msg.Text.Content = content - return c.sendWeComMessage(ctx, accessToken, msg) -} - -// handleHealth handles health check requests -func (c *WeComAppChannel) handleHealth(w http.ResponseWriter, r *http.Request) { - status := map[string]any{ - "status": "ok", - "running": c.IsRunning(), - "has_token": c.getAccessToken() != "", - } - - w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(status) -} diff --git a/pkg/channels/wecom/app_test.go b/pkg/channels/wecom/app_test.go deleted file mode 100644 index 502544441..000000000 --- a/pkg/channels/wecom/app_test.go +++ /dev/null @@ -1,1060 +0,0 @@ -package wecom - -import ( - "bytes" - "context" - "crypto/aes" - "crypto/cipher" - "crypto/sha1" - "encoding/base64" - "encoding/binary" - "encoding/json" - "encoding/xml" - "fmt" - "net/http" - "net/http/httptest" - "sort" - "strings" - "testing" - "time" - - "github.com/sipeed/picoclaw/pkg/bus" - "github.com/sipeed/picoclaw/pkg/config" -) - -// generateTestAESKeyApp generates a valid test AES key for WeCom App -func generateTestAESKeyApp() string { - // AES key needs to be 32 bytes (256 bits) for AES-256 - key := make([]byte, 32) - for i := range key { - key[i] = byte(i + 1) - } - // Return base64 encoded key without padding - return base64.StdEncoding.EncodeToString(key)[:43] -} - -// encryptTestMessageApp encrypts a message for testing WeCom App -func encryptTestMessageApp(message, aesKey string) (string, error) { - // Decode AES key - key, err := base64.StdEncoding.DecodeString(aesKey + "=") - if err != nil { - return "", err - } - - // Prepare message: random(16) + msg_len(4) + msg + corp_id - random := make([]byte, 0, 16) - for i := range 16 { - random = append(random, byte(i+1)) - } - - msgBytes := []byte(message) - corpID := []byte("test_corp_id") - - msgLen := uint32(len(msgBytes)) - lenBytes := make([]byte, 4) - binary.BigEndian.PutUint32(lenBytes, msgLen) - - plainText := append(random, lenBytes...) - plainText = append(plainText, msgBytes...) - plainText = append(plainText, corpID...) - - // PKCS7 padding - blockSize := aes.BlockSize - padding := blockSize - len(plainText)%blockSize - padText := bytes.Repeat([]byte{byte(padding)}, padding) - plainText = append(plainText, padText...) - - // Encrypt - block, err := aes.NewCipher(key) - if err != nil { - return "", err - } - - mode := cipher.NewCBCEncrypter(block, key[:aes.BlockSize]) - cipherText := make([]byte, len(plainText)) - mode.CryptBlocks(cipherText, plainText) - - return base64.StdEncoding.EncodeToString(cipherText), nil -} - -// generateSignatureApp generates a signature for testing WeCom App -func generateSignatureApp(token, timestamp, nonce, msgEncrypt string) string { - params := []string{token, timestamp, nonce, msgEncrypt} - sort.Strings(params) - str := strings.Join(params, "") - hash := sha1.Sum([]byte(str)) - return fmt.Sprintf("%x", hash) -} - -func TestNewWeComAppChannel(t *testing.T) { - msgBus := bus.NewMessageBus() - - t.Run("missing corp_id", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "", - AgentID: 1000002, - } - cfg.SetCorpSecret("test_secret") - _, err := NewWeComAppChannel(cfg, msgBus) - if err == nil { - t.Error("expected error for missing corp_id, got nil") - } - }) - - t.Run("missing corp_secret", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - } - _, err := NewWeComAppChannel(cfg, msgBus) - if err == nil { - t.Error("expected error for missing corp_secret, got nil") - } - }) - - t.Run("missing agent_id", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 0, - } - cfg.SetCorpSecret("test_secret") - _, err := NewWeComAppChannel(cfg, msgBus) - if err == nil { - t.Error("expected error for missing agent_id, got nil") - } - }) - - t.Run("valid config", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - AllowFrom: []string{"user1", "user2"}, - } - cfg.SetCorpSecret("test_secret") - ch, err := NewWeComAppChannel(cfg, msgBus) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if ch.Name() != "wecom_app" { - t.Errorf("Name() = %q, want %q", ch.Name(), "wecom_app") - } - if ch.IsRunning() { - t.Error("new channel should not be running") - } - }) -} - -func TestWeComAppChannelIsAllowed(t *testing.T) { - msgBus := bus.NewMessageBus() - - t.Run("empty allowlist allows all", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - AllowFrom: []string{}, - } - cfg.SetCorpSecret("test_secret") - ch, _ := NewWeComAppChannel(cfg, msgBus) - if !ch.IsAllowed("any_user") { - t.Error("empty allowlist should allow all users") - } - }) - - t.Run("allowlist restricts users", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - AllowFrom: []string{"allowed_user"}, - } - cfg.SetCorpSecret("test_secret") - ch, _ := NewWeComAppChannel(cfg, msgBus) - if !ch.IsAllowed("allowed_user") { - t.Error("allowed user should pass allowlist check") - } - if ch.IsAllowed("blocked_user") { - t.Error("non-allowed user should be blocked") - } - }) -} - -func TestWeComAppVerifySignature(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComAppConfig{} - cfg.CorpID = "test_corp_id" - cfg.SetCorpSecret("test_secret") - cfg.AgentID = 1000002 - cfg.SetToken("test_token") - ch, _ := NewWeComAppChannel(cfg, msgBus) - - t.Run("valid signature", func(t *testing.T) { - timestamp := "1234567890" - nonce := "test_nonce" - msgEncrypt := "test_message" - expectedSig := generateSignatureApp("test_token", timestamp, nonce, msgEncrypt) - - if !verifySignature(ch.config.Token(), expectedSig, timestamp, nonce, msgEncrypt) { - t.Error("valid signature should pass verification") - } - }) - - t.Run("invalid signature", func(t *testing.T) { - timestamp := "1234567890" - nonce := "test_nonce" - msgEncrypt := "test_message" - - if verifySignature(ch.config.Token(), "invalid_sig", timestamp, nonce, msgEncrypt) { - t.Error("invalid signature should fail verification") - } - }) - - t.Run("empty token rejects verification (fail-closed)", func(t *testing.T) { - cfgEmpty := config.WeComAppConfig{} - cfgEmpty.CorpID = "test_corp_id" - cfgEmpty.SetCorpSecret("test_secret") - cfgEmpty.AgentID = 1000002 - cfgEmpty.SetToken("") - chEmpty, _ := NewWeComAppChannel(cfgEmpty, msgBus) - - if verifySignature(chEmpty.config.Token(), "any_sig", "any_ts", "any_nonce", "any_msg") { - t.Error("empty token should reject verification (fail-closed)") - } - }) -} - -func TestWeComAppDecryptMessage(t *testing.T) { - msgBus := bus.NewMessageBus() - - t.Run("decrypt without AES key", func(t *testing.T) { - cfg := config.WeComAppConfig{} - cfg.CorpID = "test_corp_id" - cfg.SetCorpSecret("test_secret") - cfg.AgentID = 1000002 - cfg.SetEncodingAESKey("") - ch, _ := NewWeComAppChannel(cfg, msgBus) - - // Without AES key, message should be base64 decoded only - plainText := "hello world" - encoded := base64.StdEncoding.EncodeToString([]byte(plainText)) - - result, err := decryptMessage(encoded, ch.config.EncodingAESKey()) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if result != plainText { - t.Errorf("decryptMessage() = %q, want %q", result, plainText) - } - }) - - t.Run("decrypt with AES key", func(t *testing.T) { - aesKey := generateTestAESKeyApp() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - } - cfg.SetCorpSecret("test_secret") - cfg.SetEncodingAESKey(aesKey) - ch, _ := NewWeComAppChannel(cfg, msgBus) - - originalMsg := "Hello" - encrypted, err := encryptTestMessageApp(originalMsg, aesKey) - if err != nil { - t.Fatalf("failed to encrypt test message: %v", err) - } - - result, err := decryptMessage(encrypted, ch.config.EncodingAESKey()) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if result != originalMsg { - t.Errorf("WeComDecryptMessage() = %q, want %q", result, originalMsg) - } - }) - - t.Run("invalid base64", func(t *testing.T) { - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - } - cfg.SetCorpSecret("test_secret") - cfg.SetEncodingAESKey("") - ch, _ := NewWeComAppChannel(cfg, msgBus) - - _, err := decryptMessage("invalid_base64!!!", ch.config.EncodingAESKey()) - if err == nil { - t.Error("expected error for invalid base64, got nil") - } - }) - - t.Run("invalid AES key", func(t *testing.T) { - cfg := config.WeComAppConfig{} - cfg.CorpID = "test_corp_id" - cfg.SetCorpSecret("test_secret") - cfg.AgentID = 1000002 - cfg.SetEncodingAESKey("invalid_key") - ch, _ := NewWeComAppChannel(cfg, msgBus) - - _, err := decryptMessage(base64.StdEncoding.EncodeToString([]byte("test")), ch.config.EncodingAESKey()) - if err == nil { - t.Error("expected error for invalid AES key, got nil") - } - }) - - t.Run("ciphertext too short", func(t *testing.T) { - aesKey := generateTestAESKeyApp() - cfg := config.WeComAppConfig{} - cfg.CorpID = "test_corp_id" - cfg.SetCorpSecret("test_secret") - cfg.AgentID = 1000002 - cfg.SetEncodingAESKey(aesKey) - ch, _ := NewWeComAppChannel(cfg, msgBus) - - // Encrypt a very short message that results in ciphertext less than block size - shortData := make([]byte, 8) - _, err := decryptMessage(base64.StdEncoding.EncodeToString(shortData), ch.config.EncodingAESKey()) - if err == nil { - t.Error("expected error for short ciphertext, got nil") - } - }) -} - -func TestWeComAppHandleVerification(t *testing.T) { - msgBus := bus.NewMessageBus() - aesKey := generateTestAESKeyApp() - cfg := config.WeComAppConfig{} - cfg.CorpID = "test_corp_id" - cfg.SetCorpSecret("test_secret") - cfg.AgentID = 1000002 - cfg.SetToken("test_token") - cfg.SetEncodingAESKey(aesKey) - ch, _ := NewWeComAppChannel(cfg, msgBus) - - t.Run("valid verification request", func(t *testing.T) { - echostr := "test_echostr_123" - encryptedEchostr, _ := encryptTestMessageApp(echostr, aesKey) - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignatureApp("test_token", timestamp, nonce, encryptedEchostr) - - req := httptest.NewRequest( - http.MethodGet, - "/webhook/wecom-app?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce+"&echostr="+encryptedEchostr, - nil, - ) - w := httptest.NewRecorder() - - ch.handleVerification(context.Background(), w, req) - - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - if w.Body.String() != echostr { - t.Errorf("response body = %q, want %q", w.Body.String(), echostr) - } - }) - - t.Run("missing parameters", func(t *testing.T) { - req := httptest.NewRequest(http.MethodGet, "/webhook/wecom-app?msg_signature=sig×tamp=ts", nil) - w := httptest.NewRecorder() - - ch.handleVerification(context.Background(), w, req) - - if w.Code != http.StatusBadRequest { - t.Errorf("status code = %d, want %d", w.Code, http.StatusBadRequest) - } - }) - - t.Run("invalid signature", func(t *testing.T) { - echostr := "test_echostr" - encryptedEchostr, _ := encryptTestMessageApp(echostr, aesKey) - timestamp := "1234567890" - nonce := "test_nonce" - - req := httptest.NewRequest( - http.MethodGet, - "/webhook/wecom-app?msg_signature=invalid_sig×tamp="+timestamp+"&nonce="+nonce+"&echostr="+encryptedEchostr, - nil, - ) - w := httptest.NewRecorder() - - ch.handleVerification(context.Background(), w, req) - - if w.Code != http.StatusForbidden { - t.Errorf("status code = %d, want %d", w.Code, http.StatusForbidden) - } - }) -} - -func TestWeComAppHandleMessageCallback(t *testing.T) { - msgBus := bus.NewMessageBus() - aesKey := generateTestAESKeyApp() - cfg := config.WeComAppConfig{} - cfg.CorpID = "test_corp_id" - cfg.SetCorpSecret("test_secret") - cfg.AgentID = 1000002 - cfg.SetToken("test_token") - cfg.SetEncodingAESKey(aesKey) - ch, _ := NewWeComAppChannel(cfg, msgBus) - - t.Run("valid message callback", func(t *testing.T) { - // Create XML message - xmlMsg := WeComXMLMessage{ - ToUserName: "corp_id", - FromUserName: "user123", - CreateTime: 1234567890, - MsgType: "text", - Content: "Hello World", - MsgId: 123456, - AgentID: 1000002, - } - xmlData, _ := xml.Marshal(xmlMsg) - - // Encrypt message - encrypted, _ := encryptTestMessageApp(string(xmlData), aesKey) - - // Create encrypted XML wrapper - encryptedWrapper := struct { - XMLName xml.Name `xml:"xml"` - Encrypt string `xml:"Encrypt"` - }{ - Encrypt: encrypted, - } - wrapperData, _ := xml.Marshal(encryptedWrapper) - - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignatureApp("test_token", timestamp, nonce, encrypted) - - req := httptest.NewRequest( - http.MethodPost, - "/webhook/wecom-app?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce, - bytes.NewReader(wrapperData), - ) - w := httptest.NewRecorder() - - ch.handleMessageCallback(context.Background(), w, req) - - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - if w.Body.String() != "success" { - t.Errorf("response body = %q, want %q", w.Body.String(), "success") - } - }) - - t.Run("missing parameters", func(t *testing.T) { - req := httptest.NewRequest(http.MethodPost, "/webhook/wecom-app?msg_signature=sig", nil) - w := httptest.NewRecorder() - - ch.handleMessageCallback(context.Background(), w, req) - - if w.Code != http.StatusBadRequest { - t.Errorf("status code = %d, want %d", w.Code, http.StatusBadRequest) - } - }) - - t.Run("invalid XML", func(t *testing.T) { - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignatureApp("test_token", timestamp, nonce, "") - - req := httptest.NewRequest( - http.MethodPost, - "/webhook/wecom-app?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce, - strings.NewReader("invalid xml"), - ) - w := httptest.NewRecorder() - - ch.handleMessageCallback(context.Background(), w, req) - - if w.Code != http.StatusBadRequest { - t.Errorf("status code = %d, want %d", w.Code, http.StatusBadRequest) - } - }) - - t.Run("invalid signature", func(t *testing.T) { - encryptedWrapper := struct { - XMLName xml.Name `xml:"xml"` - Encrypt string `xml:"Encrypt"` - }{ - Encrypt: "encrypted_data", - } - wrapperData, _ := xml.Marshal(encryptedWrapper) - - timestamp := "1234567890" - nonce := "test_nonce" - - req := httptest.NewRequest( - http.MethodPost, - "/webhook/wecom-app?msg_signature=invalid_sig×tamp="+timestamp+"&nonce="+nonce, - bytes.NewReader(wrapperData), - ) - w := httptest.NewRecorder() - - ch.handleMessageCallback(context.Background(), w, req) - - if w.Code != http.StatusForbidden { - t.Errorf("status code = %d, want %d", w.Code, http.StatusForbidden) - } - }) -} - -func TestWeComAppProcessMessage(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - } - cfg.SetCorpSecret("test_secret") - ch, _ := NewWeComAppChannel(cfg, msgBus) - - t.Run("process text message", func(t *testing.T) { - msg := WeComXMLMessage{ - ToUserName: "corp_id", - FromUserName: "user123", - CreateTime: 1234567890, - MsgType: "text", - Content: "Hello World", - MsgId: 123456, - AgentID: 1000002, - } - - // Should not panic - ch.processMessage(context.Background(), msg) - }) - - t.Run("process image message", func(t *testing.T) { - msg := WeComXMLMessage{ - ToUserName: "corp_id", - FromUserName: "user123", - CreateTime: 1234567890, - MsgType: "image", - PicUrl: "https://example.com/image.jpg", - MediaId: "media_123", - MsgId: 123456, - AgentID: 1000002, - } - - // Should not panic - ch.processMessage(context.Background(), msg) - }) - - t.Run("process voice message", func(t *testing.T) { - msg := WeComXMLMessage{ - ToUserName: "corp_id", - FromUserName: "user123", - CreateTime: 1234567890, - MsgType: "voice", - MediaId: "media_123", - Format: "amr", - MsgId: 123456, - AgentID: 1000002, - } - - // Should not panic - ch.processMessage(context.Background(), msg) - }) - - t.Run("skip unsupported message type", func(t *testing.T) { - msg := WeComXMLMessage{ - ToUserName: "corp_id", - FromUserName: "user123", - CreateTime: 1234567890, - MsgType: "video", - MsgId: 123456, - AgentID: 1000002, - } - - // Should not panic - ch.processMessage(context.Background(), msg) - }) - - t.Run("process event message", func(t *testing.T) { - msg := WeComXMLMessage{ - ToUserName: "corp_id", - FromUserName: "user123", - CreateTime: 1234567890, - MsgType: "event", - Event: "subscribe", - MsgId: 123456, - AgentID: 1000002, - } - - // Should not panic - ch.processMessage(context.Background(), msg) - }) -} - -func TestWeComAppHandleWebhook(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComAppConfig{} - cfg.CorpID = "test_corp_id" - cfg.SetCorpSecret("test_secret") - cfg.AgentID = 1000002 - cfg.SetToken("test_token") - ch, _ := NewWeComAppChannel(cfg, msgBus) - - t.Run("GET request calls verification", func(t *testing.T) { - echostr := "test_echostr" - encoded := base64.StdEncoding.EncodeToString([]byte(echostr)) - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignatureApp("test_token", timestamp, nonce, encoded) - - req := httptest.NewRequest( - http.MethodGet, - "/webhook/wecom-app?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce+"&echostr="+encoded, - nil, - ) - w := httptest.NewRecorder() - - ch.handleWebhook(w, req) - - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - }) - - t.Run("POST request calls message callback", func(t *testing.T) { - encryptedWrapper := struct { - XMLName xml.Name `xml:"xml"` - Encrypt string `xml:"Encrypt"` - }{ - Encrypt: base64.StdEncoding.EncodeToString([]byte("test")), - } - wrapperData, _ := xml.Marshal(encryptedWrapper) - - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignatureApp("test_token", timestamp, nonce, encryptedWrapper.Encrypt) - - req := httptest.NewRequest( - http.MethodPost, - "/webhook/wecom-app?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce, - bytes.NewReader(wrapperData), - ) - w := httptest.NewRecorder() - - ch.handleWebhook(w, req) - - // Should not be method not allowed - if w.Code == http.StatusMethodNotAllowed { - t.Error("POST request should not return Method Not Allowed") - } - }) - - t.Run("unsupported method", func(t *testing.T) { - req := httptest.NewRequest(http.MethodPut, "/webhook/wecom-app", nil) - w := httptest.NewRecorder() - - ch.handleWebhook(w, req) - - if w.Code != http.StatusMethodNotAllowed { - t.Errorf("status code = %d, want %d", w.Code, http.StatusMethodNotAllowed) - } - }) -} - -func TestWeComAppHandleHealth(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - } - cfg.SetCorpSecret("test_secret") - ch, _ := NewWeComAppChannel(cfg, msgBus) - - req := httptest.NewRequest(http.MethodGet, "/health/wecom-app", nil) - w := httptest.NewRecorder() - - ch.handleHealth(w, req) - - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - - contentType := w.Header().Get("Content-Type") - if contentType != "application/json" { - t.Errorf("Content-Type = %q, want %q", contentType, "application/json") - } - - body := w.Body.String() - if !strings.Contains(body, "status") || !strings.Contains(body, "running") || !strings.Contains(body, "has_token") { - t.Errorf("response body should contain status, running, and has_token fields, got: %s", body) - } -} - -func TestWeComAppAccessToken(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComAppConfig{ - CorpID: "test_corp_id", - AgentID: 1000002, - } - cfg.SetCorpSecret("test_secret") - ch, _ := NewWeComAppChannel(cfg, msgBus) - - t.Run("get empty access token initially", func(t *testing.T) { - token := ch.getAccessToken() - if token != "" { - t.Errorf("getAccessToken() = %q, want empty string", token) - } - }) - - t.Run("set and get access token", func(t *testing.T) { - ch.tokenMu.Lock() - ch.accessToken = "test_token_123" - ch.tokenExpiry = time.Now().Add(1 * time.Hour) - ch.tokenMu.Unlock() - - token := ch.getAccessToken() - if token != "test_token_123" { - t.Errorf("getAccessToken() = %q, want %q", token, "test_token_123") - } - }) - - t.Run("expired token returns empty", func(t *testing.T) { - ch.tokenMu.Lock() - ch.accessToken = "expired_token" - ch.tokenExpiry = time.Now().Add(-1 * time.Hour) - ch.tokenMu.Unlock() - - token := ch.getAccessToken() - if token != "" { - t.Errorf("getAccessToken() = %q, want empty string for expired token", token) - } - }) -} - -func TestWeComAppMessageStructures(t *testing.T) { - t.Run("WeComTextMessage structure", func(t *testing.T) { - msg := WeComTextMessage{ - ToUser: "user123", - MsgType: "text", - AgentID: 1000002, - } - msg.Text.Content = "Hello World" - - if msg.ToUser != "user123" { - t.Errorf("ToUser = %q, want %q", msg.ToUser, "user123") - } - if msg.MsgType != "text" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "text") - } - if msg.AgentID != 1000002 { - t.Errorf("AgentID = %d, want %d", msg.AgentID, 1000002) - } - if msg.Text.Content != "Hello World" { - t.Errorf("Text.Content = %q, want %q", msg.Text.Content, "Hello World") - } - - // Test JSON marshaling - jsonData, err := json.Marshal(msg) - if err != nil { - t.Fatalf("failed to marshal JSON: %v", err) - } - - var unmarshaled WeComTextMessage - err = json.Unmarshal(jsonData, &unmarshaled) - if err != nil { - t.Fatalf("failed to unmarshal JSON: %v", err) - } - - if unmarshaled.ToUser != msg.ToUser { - t.Errorf("JSON round-trip failed for ToUser") - } - }) - - t.Run("WeComMarkdownMessage structure", func(t *testing.T) { - msg := WeComMarkdownMessage{ - ToUser: "user123", - MsgType: "markdown", - AgentID: 1000002, - } - msg.Markdown.Content = "# Hello\nWorld" - - if msg.Markdown.Content != "# Hello\nWorld" { - t.Errorf("Markdown.Content = %q, want %q", msg.Markdown.Content, "# Hello\nWorld") - } - - // Test JSON marshaling - jsonData, err := json.Marshal(msg) - if err != nil { - t.Fatalf("failed to marshal JSON: %v", err) - } - - if !bytes.Contains(jsonData, []byte("markdown")) { - t.Error("JSON should contain 'markdown' field") - } - }) - - t.Run("WeComImageMessage structure", func(t *testing.T) { - msg := WeComImageMessage{ - ToUser: "user123", - MsgType: "image", - AgentID: 1000002, - } - msg.Image.MediaID = "media_123456" - - if msg.Image.MediaID != "media_123456" { - t.Errorf("Image.MediaID = %q, want %q", msg.Image.MediaID, "media_123456") - } - if msg.ToUser != "user123" { - t.Errorf("ToUser = %q, want %q", msg.ToUser, "user123") - } - if msg.MsgType != "image" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "image") - } - if msg.AgentID != 1000002 { - t.Errorf("AgentID = %d, want %d", msg.AgentID, 1000002) - } - }) - - t.Run("WeComAccessTokenResponse structure", func(t *testing.T) { - jsonData := `{ - "errcode": 0, - "errmsg": "ok", - "access_token": "test_access_token", - "expires_in": 7200 - }` - - var resp WeComAccessTokenResponse - err := json.Unmarshal([]byte(jsonData), &resp) - if err != nil { - t.Fatalf("failed to unmarshal JSON: %v", err) - } - - if resp.ErrCode != 0 { - t.Errorf("ErrCode = %d, want %d", resp.ErrCode, 0) - } - if resp.ErrMsg != "ok" { - t.Errorf("ErrMsg = %q, want %q", resp.ErrMsg, "ok") - } - if resp.AccessToken != "test_access_token" { - t.Errorf("AccessToken = %q, want %q", resp.AccessToken, "test_access_token") - } - if resp.ExpiresIn != 7200 { - t.Errorf("ExpiresIn = %d, want %d", resp.ExpiresIn, 7200) - } - }) - - t.Run("WeComSendMessageResponse structure", func(t *testing.T) { - jsonData := `{ - "errcode": 0, - "errmsg": "ok", - "invaliduser": "", - "invalidparty": "", - "invalidtag": "" - }` - - var resp WeComSendMessageResponse - err := json.Unmarshal([]byte(jsonData), &resp) - if err != nil { - t.Fatalf("failed to unmarshal JSON: %v", err) - } - - if resp.ErrCode != 0 { - t.Errorf("ErrCode = %d, want %d", resp.ErrCode, 0) - } - if resp.ErrMsg != "ok" { - t.Errorf("ErrMsg = %q, want %q", resp.ErrMsg, "ok") - } - }) -} - -func TestWeComAppXMLMessageStructure(t *testing.T) { - xmlData := ` - - - - 1234567890 - - - 1234567890123456 - 1000002 -` - - var msg WeComXMLMessage - err := xml.Unmarshal([]byte(xmlData), &msg) - if err != nil { - t.Fatalf("failed to unmarshal XML: %v", err) - } - - if msg.ToUserName != "corp_id" { - t.Errorf("ToUserName = %q, want %q", msg.ToUserName, "corp_id") - } - if msg.FromUserName != "user123" { - t.Errorf("FromUserName = %q, want %q", msg.FromUserName, "user123") - } - if msg.CreateTime != 1234567890 { - t.Errorf("CreateTime = %d, want %d", msg.CreateTime, 1234567890) - } - if msg.MsgType != "text" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "text") - } - if msg.Content != "Hello World" { - t.Errorf("Content = %q, want %q", msg.Content, "Hello World") - } - if msg.MsgId != 1234567890123456 { - t.Errorf("MsgId = %d, want %d", msg.MsgId, 1234567890123456) - } - if msg.AgentID != 1000002 { - t.Errorf("AgentID = %d, want %d", msg.AgentID, 1000002) - } -} - -func TestWeComAppXMLMessageImage(t *testing.T) { - xmlData := ` - - - - 1234567890 - - - - 1234567890123456 - 1000002 -` - - var msg WeComXMLMessage - err := xml.Unmarshal([]byte(xmlData), &msg) - if err != nil { - t.Fatalf("failed to unmarshal XML: %v", err) - } - - if msg.MsgType != "image" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "image") - } - if msg.PicUrl != "https://example.com/image.jpg" { - t.Errorf("PicUrl = %q, want %q", msg.PicUrl, "https://example.com/image.jpg") - } - if msg.MediaId != "media_123" { - t.Errorf("MediaId = %q, want %q", msg.MediaId, "media_123") - } -} - -func TestWeComAppXMLMessageVoice(t *testing.T) { - xmlData := ` - - - - 1234567890 - - - - 1234567890123456 - 1000002 -` - - var msg WeComXMLMessage - err := xml.Unmarshal([]byte(xmlData), &msg) - if err != nil { - t.Fatalf("failed to unmarshal XML: %v", err) - } - - if msg.MsgType != "voice" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "voice") - } - if msg.Format != "amr" { - t.Errorf("Format = %q, want %q", msg.Format, "amr") - } -} - -func TestWeComAppXMLMessageLocation(t *testing.T) { - xmlData := ` - - - - 1234567890 - - 39.9042 - 116.4074 - 16 - - 1234567890123456 - 1000002 -` - - var msg WeComXMLMessage - err := xml.Unmarshal([]byte(xmlData), &msg) - if err != nil { - t.Fatalf("failed to unmarshal XML: %v", err) - } - - if msg.MsgType != "location" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "location") - } - if msg.LocationX != 39.9042 { - t.Errorf("LocationX = %f, want %f", msg.LocationX, 39.9042) - } - if msg.LocationY != 116.4074 { - t.Errorf("LocationY = %f, want %f", msg.LocationY, 116.4074) - } - if msg.Scale != 16 { - t.Errorf("Scale = %d, want %d", msg.Scale, 16) - } - if msg.Label != "Beijing" { - t.Errorf("Label = %q, want %q", msg.Label, "Beijing") - } -} - -func TestWeComAppXMLMessageLink(t *testing.T) { - xmlData := ` - - - - 1234567890 - - <![CDATA[Link Title]]> - - - 1234567890123456 - 1000002 -` - - var msg WeComXMLMessage - err := xml.Unmarshal([]byte(xmlData), &msg) - if err != nil { - t.Fatalf("failed to unmarshal XML: %v", err) - } - - if msg.MsgType != "link" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "link") - } - if msg.Title != "Link Title" { - t.Errorf("Title = %q, want %q", msg.Title, "Link Title") - } - if msg.Description != "Link Description" { - t.Errorf("Description = %q, want %q", msg.Description, "Link Description") - } - if msg.Url != "https://example.com" { - t.Errorf("Url = %q, want %q", msg.Url, "https://example.com") - } -} - -func TestWeComAppXMLMessageEvent(t *testing.T) { - xmlData := ` - - - - 1234567890 - - - - 1000002 -` - - var msg WeComXMLMessage - err := xml.Unmarshal([]byte(xmlData), &msg) - if err != nil { - t.Fatalf("failed to unmarshal XML: %v", err) - } - - if msg.MsgType != "event" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "event") - } - if msg.Event != "subscribe" { - t.Errorf("Event = %q, want %q", msg.Event, "subscribe") - } - if msg.EventKey != "event_key_123" { - t.Errorf("EventKey = %q, want %q", msg.EventKey, "event_key_123") - } -} diff --git a/pkg/channels/wecom/bot.go b/pkg/channels/wecom/bot.go deleted file mode 100644 index 22461b768..000000000 --- a/pkg/channels/wecom/bot.go +++ /dev/null @@ -1,499 +0,0 @@ -package wecom - -import ( - "bytes" - "context" - "encoding/json" - "encoding/xml" - "fmt" - "io" - "net/http" - "strings" - "time" - - "github.com/sipeed/picoclaw/pkg/bus" - "github.com/sipeed/picoclaw/pkg/channels" - "github.com/sipeed/picoclaw/pkg/config" - "github.com/sipeed/picoclaw/pkg/identity" - "github.com/sipeed/picoclaw/pkg/logger" - "github.com/sipeed/picoclaw/pkg/utils" -) - -// WeComBotChannel implements the Channel interface for WeCom Bot (企业微信智能机器人) -// Uses webhook callback mode - simpler than WeCom App but only supports passive replies -type WeComBotChannel struct { - *channels.BaseChannel - config config.WeComConfig - client *http.Client - ctx context.Context - cancel context.CancelFunc - processedMsgs *MessageDeduplicator -} - -// WeComBotMessage represents the JSON message structure from WeCom Bot (AIBOT) -type WeComBotMessage struct { - MsgID string `json:"msgid"` - AIBotID string `json:"aibotid"` - ChatID string `json:"chatid"` // Session ID, only present for group chats - ChatType string `json:"chattype"` // "single" for DM, "group" for group chat - From struct { - UserID string `json:"userid"` - } `json:"from"` - ResponseURL string `json:"response_url"` - MsgType string `json:"msgtype"` // text, image, voice, file, mixed - Text struct { - Content string `json:"content"` - } `json:"text"` - Image struct { - URL string `json:"url"` - } `json:"image"` - Voice struct { - Content string `json:"content"` // Voice to text content - } `json:"voice"` - File struct { - URL string `json:"url"` - } `json:"file"` - Mixed struct { - MsgItem []struct { - MsgType string `json:"msgtype"` - Text struct { - Content string `json:"content"` - } `json:"text"` - Image struct { - URL string `json:"url"` - } `json:"image"` - } `json:"msg_item"` - } `json:"mixed"` - Quote struct { - MsgType string `json:"msgtype"` - Text struct { - Content string `json:"content"` - } `json:"text"` - } `json:"quote"` -} - -// WeComBotReplyMessage represents the reply message structure -type WeComBotReplyMessage struct { - MsgType string `json:"msgtype"` - Text struct { - Content string `json:"content"` - } `json:"text,omitempty"` -} - -// NewWeComBotChannel creates a new WeCom Bot channel instance -func NewWeComBotChannel(cfg config.WeComConfig, messageBus *bus.MessageBus) (*WeComBotChannel, error) { - if cfg.Token() == "" || cfg.WebhookURL == "" { - return nil, fmt.Errorf("wecom token and webhook_url are required") - } - - base := channels.NewBaseChannel("wecom", cfg, messageBus, cfg.AllowFrom, - channels.WithMaxMessageLength(2048), - channels.WithGroupTrigger(cfg.GroupTrigger), - channels.WithReasoningChannelID(cfg.ReasoningChannelID), - ) - - // Client timeout must be >= the configured ReplyTimeout so the - // per-request context deadline is always the effective limit. - clientTimeout := 30 * time.Second - if d := time.Duration(cfg.ReplyTimeout) * time.Second; d > clientTimeout { - clientTimeout = d - } - - ctx, cancel := context.WithCancel(context.Background()) - return &WeComBotChannel{ - BaseChannel: base, - config: cfg, - client: &http.Client{Timeout: clientTimeout}, - ctx: ctx, - cancel: cancel, - processedMsgs: NewMessageDeduplicator(wecomMaxProcessedMessages), - }, nil -} - -// Name returns the channel name -func (c *WeComBotChannel) Name() string { - return "wecom" -} - -// Start initializes the WeCom Bot channel -func (c *WeComBotChannel) Start(ctx context.Context) error { - logger.InfoC("wecom", "Starting WeCom Bot channel...") - - // Cancel the context created in the constructor to avoid a resource leak. - if c.cancel != nil { - c.cancel() - } - c.ctx, c.cancel = context.WithCancel(ctx) - - c.SetRunning(true) - logger.InfoC("wecom", "WeCom Bot channel started") - - return nil -} - -// Stop gracefully stops the WeCom Bot channel -func (c *WeComBotChannel) Stop(ctx context.Context) error { - logger.InfoC("wecom", "Stopping WeCom Bot channel...") - - if c.cancel != nil { - c.cancel() - } - - c.SetRunning(false) - logger.InfoC("wecom", "WeCom Bot channel stopped") - return nil -} - -// Send sends a message to WeCom user via webhook API -// Note: WeCom Bot can only reply within the configured timeout (default 5 seconds) of receiving a message -// For delayed responses, we use the webhook URL -func (c *WeComBotChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { - if !c.IsRunning() { - return channels.ErrNotRunning - } - - logger.DebugCF("wecom", "Sending message via webhook", map[string]any{ - "chat_id": msg.ChatID, - "preview": utils.Truncate(msg.Content, 100), - }) - - return c.sendWebhookReply(ctx, msg.ChatID, msg.Content) -} - -// WebhookPath returns the path for registering on the shared HTTP server. -func (c *WeComBotChannel) WebhookPath() string { - if c.config.WebhookPath != "" { - return c.config.WebhookPath - } - return "/webhook/wecom" -} - -// ServeHTTP implements http.Handler for the shared HTTP server. -func (c *WeComBotChannel) ServeHTTP(w http.ResponseWriter, r *http.Request) { - c.handleWebhook(w, r) -} - -// HealthPath returns the health check endpoint path. -func (c *WeComBotChannel) HealthPath() string { - return "/health/wecom" -} - -// HealthHandler handles health check requests. -func (c *WeComBotChannel) HealthHandler(w http.ResponseWriter, r *http.Request) { - c.handleHealth(w, r) -} - -// handleWebhook handles incoming webhook requests from WeCom -func (c *WeComBotChannel) handleWebhook(w http.ResponseWriter, r *http.Request) { - ctx := r.Context() - - if r.Method == http.MethodGet { - // Handle verification request - c.handleVerification(ctx, w, r) - return - } - - if r.Method == http.MethodPost { - // Handle message callback - c.handleMessageCallback(ctx, w, r) - return - } - - http.Error(w, "Method not allowed", http.StatusMethodNotAllowed) -} - -// handleVerification handles the URL verification request from WeCom -func (c *WeComBotChannel) handleVerification(ctx context.Context, w http.ResponseWriter, r *http.Request) { - query := r.URL.Query() - msgSignature := query.Get("msg_signature") - timestamp := query.Get("timestamp") - nonce := query.Get("nonce") - echostr := query.Get("echostr") - - if msgSignature == "" || timestamp == "" || nonce == "" || echostr == "" { - http.Error(w, "Missing parameters", http.StatusBadRequest) - return - } - - // Verify signature - if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, echostr) { - logger.WarnC("wecom", "Signature verification failed") - http.Error(w, "Invalid signature", http.StatusForbidden) - return - } - - // Decrypt echostr - // For AIBOT (智能机器人), receiveid should be empty string "" - // Reference: https://developer.work.weixin.qq.com/document/path/101033 - decryptedEchoStr, err := decryptMessageWithVerify(echostr, c.config.EncodingAESKey(), "") - if err != nil { - logger.ErrorCF("wecom", "Failed to decrypt echostr", map[string]any{ - "error": err.Error(), - }) - http.Error(w, "Decryption failed", http.StatusInternalServerError) - return - } - - // Remove BOM and whitespace as per WeCom documentation - // The response must be plain text without quotes, BOM, or newlines - decryptedEchoStr = strings.TrimSpace(decryptedEchoStr) - decryptedEchoStr = strings.TrimPrefix(decryptedEchoStr, "\xef\xbb\xbf") // Remove UTF-8 BOM - w.Write([]byte(decryptedEchoStr)) -} - -// handleMessageCallback handles incoming messages from WeCom -func (c *WeComBotChannel) handleMessageCallback(ctx context.Context, w http.ResponseWriter, r *http.Request) { - query := r.URL.Query() - msgSignature := query.Get("msg_signature") - timestamp := query.Get("timestamp") - nonce := query.Get("nonce") - - if msgSignature == "" || timestamp == "" || nonce == "" { - http.Error(w, "Missing parameters", http.StatusBadRequest) - return - } - - // Read request body - body, err := io.ReadAll(r.Body) - if err != nil { - http.Error(w, "Failed to read body", http.StatusBadRequest) - return - } - defer r.Body.Close() - - // Parse XML to get encrypted message - var encryptedMsg struct { - XMLName xml.Name `xml:"xml"` - ToUserName string `xml:"ToUserName"` - Encrypt string `xml:"Encrypt"` - AgentID string `xml:"AgentID"` - } - - if err = xml.Unmarshal(body, &encryptedMsg); err != nil { - logger.ErrorCF("wecom", "Failed to parse XML", map[string]any{ - "error": err.Error(), - }) - http.Error(w, "Invalid XML", http.StatusBadRequest) - return - } - - // Verify signature - if !verifySignature(c.config.Token(), msgSignature, timestamp, nonce, encryptedMsg.Encrypt) { - logger.WarnC("wecom", "Message signature verification failed") - http.Error(w, "Invalid signature", http.StatusForbidden) - return - } - - // Decrypt message - // For AIBOT (智能机器人), receiveid should be empty string "" - // Reference: https://developer.work.weixin.qq.com/document/path/101033 - decryptedMsg, err := decryptMessageWithVerify(encryptedMsg.Encrypt, c.config.EncodingAESKey(), "") - if err != nil { - logger.ErrorCF("wecom", "Failed to decrypt message", map[string]any{ - "error": err.Error(), - }) - http.Error(w, "Decryption failed", http.StatusInternalServerError) - return - } - - // Parse decrypted JSON message (AIBOT uses JSON format) - var msg WeComBotMessage - if err := json.Unmarshal([]byte(decryptedMsg), &msg); err != nil { - logger.ErrorCF("wecom", "Failed to parse decrypted message", map[string]any{ - "error": err.Error(), - }) - http.Error(w, "Invalid message format", http.StatusBadRequest) - return - } - - // Process the message with the channel's long-lived context (not the HTTP - // request context, which is canceled as soon as we return the response). - go c.processMessage(c.ctx, msg) - - // Return success response immediately - // WeCom Bot requires response within configured timeout (default 5 seconds) - w.Write([]byte("success")) -} - -// processMessage processes the received message -func (c *WeComBotChannel) processMessage(ctx context.Context, msg WeComBotMessage) { - // Skip unsupported message types - if msg.MsgType != "text" && msg.MsgType != "image" && msg.MsgType != "voice" && msg.MsgType != "file" && - msg.MsgType != "mixed" { - logger.DebugCF("wecom", "Skipping non-supported message type", map[string]any{ - "msg_type": msg.MsgType, - }) - return - } - - // Message deduplication: Use msg_id to prevent duplicate processing - msgID := msg.MsgID - if !c.processedMsgs.MarkMessageProcessed(msgID) { - logger.DebugCF("wecom", "Skipping duplicate message", map[string]any{ - "msg_id": msgID, - }) - return - } - - senderID := msg.From.UserID - - // Determine if this is a group chat or direct message - // ChatType: "single" for DM, "group" for group chat - isGroupChat := msg.ChatType == "group" - - var chatID, peerKind, peerID string - if isGroupChat { - // Group chat: use ChatID as chatID and peer_id - chatID = msg.ChatID - peerKind = "group" - peerID = msg.ChatID - } else { - // Direct message: use senderID as chatID and peer_id - chatID = senderID - peerKind = "direct" - peerID = senderID - } - - // Extract content based on message type - var content string - switch msg.MsgType { - case "text": - content = msg.Text.Content - case "voice": - content = msg.Voice.Content // Voice to text content - case "mixed": - // For mixed messages, concatenate text items - for _, item := range msg.Mixed.MsgItem { - if item.MsgType == "text" { - content += item.Text.Content - } - } - case "image", "file": - // For image and file, we don't have text content - content = "" - } - - // Build metadata - peer := bus.Peer{Kind: peerKind, ID: peerID} - - // In group chats, apply unified group trigger filtering - if isGroupChat { - respond, cleaned := c.ShouldRespondInGroup(false, content) - if !respond { - return - } - content = cleaned - } - - metadata := map[string]string{ - "msg_type": msg.MsgType, - "msg_id": msg.MsgID, - "platform": "wecom", - "response_url": msg.ResponseURL, - } - if isGroupChat { - metadata["chat_id"] = msg.ChatID - metadata["sender_id"] = senderID - } - - logger.DebugCF("wecom", "Received message", map[string]any{ - "sender_id": senderID, - "msg_type": msg.MsgType, - "peer_kind": peerKind, - "is_group_chat": isGroupChat, - "preview": utils.Truncate(content, 50), - }) - - // Build sender info - sender := bus.SenderInfo{ - Platform: "wecom", - PlatformID: senderID, - CanonicalID: identity.BuildCanonicalID("wecom", senderID), - } - - if !c.IsAllowedSender(sender) { - return - } - - // Handle the message through the base channel - c.HandleMessage(ctx, peer, msg.MsgID, senderID, chatID, content, nil, metadata, sender) -} - -// sendWebhookReply sends a reply using the webhook URL -func (c *WeComBotChannel) sendWebhookReply(ctx context.Context, userID, content string) error { - reply := WeComBotReplyMessage{ - MsgType: "text", - } - reply.Text.Content = content - - jsonData, err := json.Marshal(reply) - if err != nil { - return fmt.Errorf("failed to marshal reply: %w", err) - } - - // Use configurable timeout (default 5 seconds) - timeout := c.config.ReplyTimeout - if timeout <= 0 { - timeout = 5 - } - - reqCtx, cancel := context.WithTimeout(ctx, time.Duration(timeout)*time.Second) - defer cancel() - - req, err := http.NewRequestWithContext(reqCtx, http.MethodPost, c.config.WebhookURL, bytes.NewBuffer(jsonData)) - if err != nil { - return fmt.Errorf("failed to create request: %w", err) - } - req.Header.Set("Content-Type", "application/json") - - resp, err := c.client.Do(req) - if err != nil { - return channels.ClassifyNetError(err) - } - defer resp.Body.Close() - - if resp.StatusCode != http.StatusOK { - body, readErr := io.ReadAll(resp.Body) - if readErr != nil { - return channels.ClassifySendError( - resp.StatusCode, - fmt.Errorf("reading webhook error response: %w", readErr), - ) - } - return channels.ClassifySendError( - resp.StatusCode, - fmt.Errorf("webhook API error: %s", string(body)), - ) - } - - body, err := io.ReadAll(resp.Body) - if err != nil { - return fmt.Errorf("failed to read response: %w", err) - } - - // Check response - var result struct { - ErrCode int `json:"errcode"` - ErrMsg string `json:"errmsg"` - } - if err := json.Unmarshal(body, &result); err != nil { - return fmt.Errorf("failed to parse response: %w", err) - } - - if result.ErrCode != 0 { - return fmt.Errorf("webhook API error: %s (code: %d)", result.ErrMsg, result.ErrCode) - } - - return nil -} - -// handleHealth handles health check requests -func (c *WeComBotChannel) handleHealth(w http.ResponseWriter, r *http.Request) { - status := map[string]any{ - "status": "ok", - "running": c.IsRunning(), - } - - w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(status) -} diff --git a/pkg/channels/wecom/bot_test.go b/pkg/channels/wecom/bot_test.go deleted file mode 100644 index 7b50a86f7..000000000 --- a/pkg/channels/wecom/bot_test.go +++ /dev/null @@ -1,734 +0,0 @@ -package wecom - -import ( - "bytes" - "context" - "crypto/aes" - "crypto/cipher" - "crypto/sha1" - "encoding/base64" - "encoding/binary" - "encoding/json" - "encoding/xml" - "fmt" - "net/http" - "net/http/httptest" - "sort" - "strings" - "testing" - - "github.com/sipeed/picoclaw/pkg/bus" - "github.com/sipeed/picoclaw/pkg/config" -) - -// generateTestAESKey generates a valid test AES key -func generateTestAESKey() string { - // AES key needs to be 32 bytes (256 bits) for AES-256 - key := make([]byte, 32) - for i := range key { - key[i] = byte(i) - } - // Return base64 encoded key without padding - return base64.StdEncoding.EncodeToString(key)[:43] -} - -// encryptTestMessage encrypts a message for testing (AIBOT JSON format) -func encryptTestMessage(message, aesKey string) (string, error) { - // Decode AES key - key, err := base64.StdEncoding.DecodeString(aesKey + "=") - if err != nil { - return "", err - } - - // Prepare message: random(16) + msg_len(4) + msg + receiveid - random := make([]byte, 0, 16) - for i := range 16 { - random = append(random, byte(i)) - } - - msgBytes := []byte(message) - receiveID := []byte("test_aibot_id") - - msgLen := uint32(len(msgBytes)) - lenBytes := make([]byte, 4) - binary.BigEndian.PutUint32(lenBytes, msgLen) - - plainText := append(random, lenBytes...) - plainText = append(plainText, msgBytes...) - plainText = append(plainText, receiveID...) - - // PKCS7 padding - blockSize := aes.BlockSize - padding := blockSize - len(plainText)%blockSize - padText := bytes.Repeat([]byte{byte(padding)}, padding) - plainText = append(plainText, padText...) - - // Encrypt - block, err := aes.NewCipher(key) - if err != nil { - return "", err - } - - mode := cipher.NewCBCEncrypter(block, key[:aes.BlockSize]) - cipherText := make([]byte, len(plainText)) - mode.CryptBlocks(cipherText, plainText) - - return base64.StdEncoding.EncodeToString(cipherText), nil -} - -// generateSignature generates a signature for testing -func generateSignature(token, timestamp, nonce, msgEncrypt string) string { - params := []string{token, timestamp, nonce, msgEncrypt} - sort.Strings(params) - str := strings.Join(params, "") - hash := sha1.Sum([]byte(str)) - return fmt.Sprintf("%x", hash) -} - -func TestNewWeComBotChannel(t *testing.T) { - msgBus := bus.NewMessageBus() - - t.Run("missing token", func(t *testing.T) { - cfg := config.WeComConfig{} - cfg.SetToken("") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - _, err := NewWeComBotChannel(cfg, msgBus) - if err == nil { - t.Error("expected error for missing token, got nil") - } - }) - - t.Run("missing webhook_url", func(t *testing.T) { - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "" - _, err := NewWeComBotChannel(cfg, msgBus) - if err == nil { - t.Error("expected error for missing webhook_url, got nil") - } - }) - - t.Run("valid config", func(t *testing.T) { - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - cfg.AllowFrom = []string{"user1", "user2"} - ch, err := NewWeComBotChannel(cfg, msgBus) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if ch.Name() != "wecom" { - t.Errorf("Name() = %q, want %q", ch.Name(), "wecom") - } - if ch.IsRunning() { - t.Error("new channel should not be running") - } - }) -} - -func TestWeComBotChannelIsAllowed(t *testing.T) { - msgBus := bus.NewMessageBus() - - t.Run("empty allowlist allows all", func(t *testing.T) { - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - cfg.AllowFrom = []string{} - ch, _ := NewWeComBotChannel(cfg, msgBus) - if !ch.IsAllowed("any_user") { - t.Error("empty allowlist should allow all users") - } - }) - - t.Run("allowlist restricts users", func(t *testing.T) { - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - cfg.AllowFrom = []string{"allowed_user"} - ch, _ := NewWeComBotChannel(cfg, msgBus) - if !ch.IsAllowed("allowed_user") { - t.Error("allowed user should pass allowlist check") - } - if ch.IsAllowed("blocked_user") { - t.Error("non-allowed user should be blocked") - } - }) -} - -func TestWeComBotVerifySignature(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - ch, _ := NewWeComBotChannel(cfg, msgBus) - - t.Run("valid signature", func(t *testing.T) { - timestamp := "1234567890" - nonce := "test_nonce" - msgEncrypt := "test_message" - expectedSig := generateSignature("test_token", timestamp, nonce, msgEncrypt) - - if !verifySignature(ch.config.Token(), expectedSig, timestamp, nonce, msgEncrypt) { - t.Error("valid signature should pass verification") - } - }) - - t.Run("invalid signature", func(t *testing.T) { - timestamp := "1234567890" - nonce := "test_nonce" - msgEncrypt := "test_message" - - if verifySignature(ch.config.Token(), "invalid_sig", timestamp, nonce, msgEncrypt) { - t.Error("invalid signature should fail verification") - } - }) - - t.Run("empty token rejects verification (fail-closed)", func(t *testing.T) { - cfgEmpty := config.WeComConfig{} - cfgEmpty.SetToken("") - cfgEmpty.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - chEmpty := &WeComBotChannel{ - config: cfgEmpty, - } - - if verifySignature(chEmpty.config.Token(), "any_sig", "any_ts", "any_nonce", "any_msg") { - t.Error("empty token should reject verification (fail-closed)") - } - }) -} - -func TestWeComBotDecryptMessage(t *testing.T) { - msgBus := bus.NewMessageBus() - - t.Run("decrypt without AES key", func(t *testing.T) { - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - cfg.SetEncodingAESKey("") - ch, _ := NewWeComBotChannel(cfg, msgBus) - - // Without AES key, message should be base64 decoded only - plainText := "hello world" - encoded := base64.StdEncoding.EncodeToString([]byte(plainText)) - - result, err := decryptMessage(encoded, ch.config.EncodingAESKey()) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if result != plainText { - t.Errorf("decryptMessage() = %q, want %q", result, plainText) - } - }) - - t.Run("decrypt with AES key", func(t *testing.T) { - aesKey := generateTestAESKey() - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - cfg.SetEncodingAESKey(aesKey) - ch, _ := NewWeComBotChannel(cfg, msgBus) - - originalMsg := "Hello" - encrypted, err := encryptTestMessage(originalMsg, aesKey) - if err != nil { - t.Fatalf("failed to encrypt test message: %v", err) - } - - result, err := decryptMessage(encrypted, ch.config.EncodingAESKey()) - if err != nil { - t.Fatalf("unexpected error: %v", err) - } - if result != originalMsg { - t.Errorf("WeComDecryptMessage() = %q, want %q", result, originalMsg) - } - }) - - t.Run("invalid base64", func(t *testing.T) { - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - cfg.SetEncodingAESKey("") - ch, _ := NewWeComBotChannel(cfg, msgBus) - - _, err := decryptMessage("invalid_base64!!!", ch.config.EncodingAESKey()) - if err == nil { - t.Error("expected error for invalid base64, got nil") - } - }) - - t.Run("invalid AES key", func(t *testing.T) { - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - cfg.SetEncodingAESKey("invalid_key") - ch, _ := NewWeComBotChannel(cfg, msgBus) - - _, err := decryptMessage(base64.StdEncoding.EncodeToString([]byte("test")), ch.config.EncodingAESKey()) - if err == nil { - t.Error("expected error for invalid AES key, got nil") - } - }) -} - -func TestWeComBotPKCS7Unpad(t *testing.T) { - tests := []struct { - name string - input []byte - expected []byte - }{ - { - name: "empty input", - input: []byte{}, - expected: []byte{}, - }, - { - name: "valid padding 3 bytes", - input: append([]byte("hello"), bytes.Repeat([]byte{3}, 3)...), - expected: []byte("hello"), - }, - { - name: "valid padding 16 bytes (full block)", - input: append([]byte("123456789012345"), bytes.Repeat([]byte{16}, 16)...), - expected: []byte("123456789012345"), - }, - { - name: "invalid padding larger than data", - input: []byte{20}, - expected: nil, // should return error - }, - { - name: "invalid padding zero", - input: append([]byte("test"), byte(0)), - expected: nil, // should return error - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - result, err := pkcs7Unpad(tt.input) - if tt.expected == nil { - // This case should return an error - if err == nil { - t.Errorf("pkcs7Unpad() expected error for invalid padding, got result: %v", result) - } - return - } - if err != nil { - t.Errorf("pkcs7Unpad() unexpected error: %v", err) - return - } - if !bytes.Equal(result, tt.expected) { - t.Errorf("pkcs7Unpad() = %v, want %v", result, tt.expected) - } - }) - } -} - -func TestWeComBotHandleVerification(t *testing.T) { - msgBus := bus.NewMessageBus() - aesKey := generateTestAESKey() - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.SetEncodingAESKey(aesKey) - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - ch, _ := NewWeComBotChannel(cfg, msgBus) - - t.Run("valid verification request", func(t *testing.T) { - echostr := "test_echostr_123" - encryptedEchostr, _ := encryptTestMessage(echostr, aesKey) - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignature("test_token", timestamp, nonce, encryptedEchostr) - - req := httptest.NewRequest( - http.MethodGet, - "/webhook/wecom?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce+"&echostr="+encryptedEchostr, - nil, - ) - w := httptest.NewRecorder() - - ch.handleVerification(context.Background(), w, req) - - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - if w.Body.String() != echostr { - t.Errorf("response body = %q, want %q", w.Body.String(), echostr) - } - }) - - t.Run("missing parameters", func(t *testing.T) { - req := httptest.NewRequest(http.MethodGet, "/webhook/wecom?msg_signature=sig×tamp=ts", nil) - w := httptest.NewRecorder() - - ch.handleVerification(context.Background(), w, req) - - if w.Code != http.StatusBadRequest { - t.Errorf("status code = %d, want %d", w.Code, http.StatusBadRequest) - } - }) - - t.Run("invalid signature", func(t *testing.T) { - echostr := "test_echostr" - encryptedEchostr, _ := encryptTestMessage(echostr, aesKey) - timestamp := "1234567890" - nonce := "test_nonce" - - req := httptest.NewRequest( - http.MethodGet, - "/webhook/wecom?msg_signature=invalid_sig×tamp="+timestamp+"&nonce="+nonce+"&echostr="+encryptedEchostr, - nil, - ) - w := httptest.NewRecorder() - - ch.handleVerification(context.Background(), w, req) - - if w.Code != http.StatusForbidden { - t.Errorf("status code = %d, want %d", w.Code, http.StatusForbidden) - } - }) -} - -func TestWeComBotHandleMessageCallback(t *testing.T) { - msgBus := bus.NewMessageBus() - aesKey := generateTestAESKey() - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.SetEncodingAESKey(aesKey) - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - ch, _ := NewWeComBotChannel(cfg, msgBus) - - runBotMessageCallback := func(t *testing.T, jsonMsg string) *httptest.ResponseRecorder { - t.Helper() - encrypted, _ := encryptTestMessage(jsonMsg, aesKey) - encryptedWrapper := struct { - XMLName xml.Name `xml:"xml"` - Encrypt string `xml:"Encrypt"` - }{ - Encrypt: encrypted, - } - wrapperData, _ := xml.Marshal(encryptedWrapper) - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignature("test_token", timestamp, nonce, encrypted) - req := httptest.NewRequest( - http.MethodPost, - "/webhook/wecom?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce, - bytes.NewReader(wrapperData), - ) - w := httptest.NewRecorder() - ch.handleMessageCallback(context.Background(), w, req) - return w - } - - t.Run("valid direct message callback", func(t *testing.T) { - w := runBotMessageCallback(t, `{ - "msgid": "test_msg_id_123", - "aibotid": "test_aibot_id", - "chattype": "single", - "from": {"userid": "user123"}, - "response_url": "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - "msgtype": "text", - "text": {"content": "Hello World"} - }`) - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - if w.Body.String() != "success" { - t.Errorf("response body = %q, want %q", w.Body.String(), "success") - } - }) - - t.Run("valid group message callback", func(t *testing.T) { - w := runBotMessageCallback(t, `{ - "msgid": "test_msg_id_456", - "aibotid": "test_aibot_id", - "chatid": "group_chat_id_123", - "chattype": "group", - "from": {"userid": "user456"}, - "response_url": "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - "msgtype": "text", - "text": {"content": "Hello Group"} - }`) - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - if w.Body.String() != "success" { - t.Errorf("response body = %q, want %q", w.Body.String(), "success") - } - }) - - t.Run("missing parameters", func(t *testing.T) { - req := httptest.NewRequest(http.MethodPost, "/webhook/wecom?msg_signature=sig", nil) - w := httptest.NewRecorder() - - ch.handleMessageCallback(context.Background(), w, req) - - if w.Code != http.StatusBadRequest { - t.Errorf("status code = %d, want %d", w.Code, http.StatusBadRequest) - } - }) - - t.Run("invalid XML", func(t *testing.T) { - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignature("test_token", timestamp, nonce, "") - - req := httptest.NewRequest( - http.MethodPost, - "/webhook/wecom?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce, - strings.NewReader("invalid xml"), - ) - w := httptest.NewRecorder() - - ch.handleMessageCallback(context.Background(), w, req) - - if w.Code != http.StatusBadRequest { - t.Errorf("status code = %d, want %d", w.Code, http.StatusBadRequest) - } - }) - - t.Run("invalid signature", func(t *testing.T) { - encryptedWrapper := struct { - XMLName xml.Name `xml:"xml"` - Encrypt string `xml:"Encrypt"` - }{ - Encrypt: "encrypted_data", - } - wrapperData, _ := xml.Marshal(encryptedWrapper) - - timestamp := "1234567890" - nonce := "test_nonce" - - req := httptest.NewRequest( - http.MethodPost, - "/webhook/wecom?msg_signature=invalid_sig×tamp="+timestamp+"&nonce="+nonce, - bytes.NewReader(wrapperData), - ) - w := httptest.NewRecorder() - - ch.handleMessageCallback(context.Background(), w, req) - - if w.Code != http.StatusForbidden { - t.Errorf("status code = %d, want %d", w.Code, http.StatusForbidden) - } - }) -} - -func TestWeComBotProcessMessage(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - ch, _ := NewWeComBotChannel(cfg, msgBus) - - t.Run("process direct text message", func(t *testing.T) { - msg := WeComBotMessage{ - MsgID: "test_msg_id_123", - AIBotID: "test_aibot_id", - ChatType: "single", - ResponseURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - MsgType: "text", - } - msg.From.UserID = "user123" - msg.Text.Content = "Hello World" - - // Should not panic - ch.processMessage(context.Background(), msg) - }) - - t.Run("process group text message", func(t *testing.T) { - msg := WeComBotMessage{ - MsgID: "test_msg_id_456", - AIBotID: "test_aibot_id", - ChatID: "group_chat_id_123", - ChatType: "group", - ResponseURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - MsgType: "text", - } - msg.From.UserID = "user456" - msg.Text.Content = "Hello Group" - - // Should not panic - ch.processMessage(context.Background(), msg) - }) - - t.Run("process voice message", func(t *testing.T) { - msg := WeComBotMessage{ - MsgID: "test_msg_id_789", - AIBotID: "test_aibot_id", - ChatType: "single", - ResponseURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - MsgType: "voice", - } - msg.From.UserID = "user123" - msg.Voice.Content = "Voice message text" - - // Should not panic - ch.processMessage(context.Background(), msg) - }) - - t.Run("skip unsupported message type", func(t *testing.T) { - msg := WeComBotMessage{ - MsgID: "test_msg_id_000", - AIBotID: "test_aibot_id", - ChatType: "single", - ResponseURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - MsgType: "video", - } - msg.From.UserID = "user123" - - // Should not panic - ch.processMessage(context.Background(), msg) - }) -} - -func TestWeComBotHandleWebhook(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - ch, _ := NewWeComBotChannel(cfg, msgBus) - - t.Run("GET request calls verification", func(t *testing.T) { - echostr := "test_echostr" - encoded := base64.StdEncoding.EncodeToString([]byte(echostr)) - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignature("test_token", timestamp, nonce, encoded) - - req := httptest.NewRequest( - http.MethodGet, - "/webhook/wecom?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce+"&echostr="+encoded, - nil, - ) - w := httptest.NewRecorder() - - ch.handleWebhook(w, req) - - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - }) - - t.Run("POST request calls message callback", func(t *testing.T) { - encryptedWrapper := struct { - XMLName xml.Name `xml:"xml"` - Encrypt string `xml:"Encrypt"` - }{ - Encrypt: base64.StdEncoding.EncodeToString([]byte("test")), - } - wrapperData, _ := xml.Marshal(encryptedWrapper) - - timestamp := "1234567890" - nonce := "test_nonce" - signature := generateSignature("test_token", timestamp, nonce, encryptedWrapper.Encrypt) - - req := httptest.NewRequest( - http.MethodPost, - "/webhook/wecom?msg_signature="+signature+"×tamp="+timestamp+"&nonce="+nonce, - bytes.NewReader(wrapperData), - ) - w := httptest.NewRecorder() - - ch.handleWebhook(w, req) - - // Should not be method not allowed - if w.Code == http.StatusMethodNotAllowed { - t.Error("POST request should not return Method Not Allowed") - } - }) - - t.Run("unsupported method", func(t *testing.T) { - req := httptest.NewRequest(http.MethodPut, "/webhook/wecom", nil) - w := httptest.NewRecorder() - - ch.handleWebhook(w, req) - - if w.Code != http.StatusMethodNotAllowed { - t.Errorf("status code = %d, want %d", w.Code, http.StatusMethodNotAllowed) - } - }) -} - -func TestWeComBotHandleHealth(t *testing.T) { - msgBus := bus.NewMessageBus() - cfg := config.WeComConfig{} - cfg.SetToken("test_token") - cfg.WebhookURL = "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test" - ch, _ := NewWeComBotChannel(cfg, msgBus) - - req := httptest.NewRequest(http.MethodGet, "/health/wecom", nil) - w := httptest.NewRecorder() - - ch.handleHealth(w, req) - - if w.Code != http.StatusOK { - t.Errorf("status code = %d, want %d", w.Code, http.StatusOK) - } - - contentType := w.Header().Get("Content-Type") - if contentType != "application/json" { - t.Errorf("Content-Type = %q, want %q", contentType, "application/json") - } - - body := w.Body.String() - if !strings.Contains(body, "status") || !strings.Contains(body, "running") { - t.Errorf("response body should contain status and running fields, got: %s", body) - } -} - -func TestWeComBotReplyMessage(t *testing.T) { - msg := WeComBotReplyMessage{ - MsgType: "text", - } - msg.Text.Content = "Hello World" - - if msg.MsgType != "text" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "text") - } - if msg.Text.Content != "Hello World" { - t.Errorf("Text.Content = %q, want %q", msg.Text.Content, "Hello World") - } -} - -func TestWeComBotMessageStructure(t *testing.T) { - jsonData := `{ - "msgid": "test_msg_id_123", - "aibotid": "test_aibot_id", - "chatid": "group_chat_id_123", - "chattype": "group", - "from": {"userid": "user123"}, - "response_url": "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", - "msgtype": "text", - "text": {"content": "Hello World"} - }` - - var msg WeComBotMessage - err := json.Unmarshal([]byte(jsonData), &msg) - if err != nil { - t.Fatalf("failed to unmarshal JSON: %v", err) - } - - if msg.MsgID != "test_msg_id_123" { - t.Errorf("MsgID = %q, want %q", msg.MsgID, "test_msg_id_123") - } - if msg.AIBotID != "test_aibot_id" { - t.Errorf("AIBotID = %q, want %q", msg.AIBotID, "test_aibot_id") - } - if msg.ChatID != "group_chat_id_123" { - t.Errorf("ChatID = %q, want %q", msg.ChatID, "group_chat_id_123") - } - if msg.ChatType != "group" { - t.Errorf("ChatType = %q, want %q", msg.ChatType, "group") - } - if msg.From.UserID != "user123" { - t.Errorf("From.UserID = %q, want %q", msg.From.UserID, "user123") - } - if msg.MsgType != "text" { - t.Errorf("MsgType = %q, want %q", msg.MsgType, "text") - } - if msg.Text.Content != "Hello World" { - t.Errorf("Text.Content = %q, want %q", msg.Text.Content, "Hello World") - } -} diff --git a/pkg/channels/wecom/common.go b/pkg/channels/wecom/common.go deleted file mode 100644 index 9a622a2fc..000000000 --- a/pkg/channels/wecom/common.go +++ /dev/null @@ -1,199 +0,0 @@ -package wecom - -import ( - "bytes" - "crypto/aes" - "crypto/cipher" - "crypto/rand" - "crypto/sha1" - "encoding/base64" - "encoding/binary" - "fmt" - "math/big" - "sort" - "strings" -) - -// blockSize is the PKCS7 block size used by WeCom (32) -const blockSize = 32 - -// computeSignature computes the WeCom message signature from the given parameters. -// It sorts [token, timestamp, nonce, encrypt], concatenates them and returns the SHA1 hex digest. -func computeSignature(token, timestamp, nonce, encrypt string) string { - params := []string{token, timestamp, nonce, encrypt} - sort.Strings(params) - str := strings.Join(params, "") - hash := sha1.Sum([]byte(str)) - return fmt.Sprintf("%x", hash) -} - -// verifySignature verifies the message signature for WeCom -// This is a common function used by both WeCom Bot and WeCom App -func verifySignature(token, msgSignature, timestamp, nonce, msgEncrypt string) bool { - if token == "" { - return false - } - return computeSignature(token, timestamp, nonce, msgEncrypt) == msgSignature -} - -// decryptMessage decrypts the encrypted message using AES -// For AIBOT, receiveid should be the aibotid; for other apps, it should be corp_id -func decryptMessage(encryptedMsg, encodingAESKey string) (string, error) { - return decryptMessageWithVerify(encryptedMsg, encodingAESKey, "") -} - -// decryptMessageWithVerify decrypts the encrypted message and optionally verifies receiveid -// receiveid: for AIBOT use aibotid, for WeCom App use corp_id. If empty, skip verification. -func decryptMessageWithVerify(encryptedMsg, encodingAESKey, receiveid string) (string, error) { - if encodingAESKey == "" { - // No encryption, return as is (base64 decode) - decoded, err := base64.StdEncoding.DecodeString(encryptedMsg) - if err != nil { - return "", err - } - return string(decoded), nil - } - - aesKey, err := decodeWeComAESKey(encodingAESKey) - if err != nil { - return "", err - } - - cipherText, err := base64.StdEncoding.DecodeString(encryptedMsg) - if err != nil { - return "", fmt.Errorf("failed to decode message: %w", err) - } - - plainText, err := decryptAESCBC(aesKey, cipherText) - if err != nil { - return "", err - } - - return unpackWeComFrame(plainText, receiveid) -} - -// decodeWeComAESKey base64-decodes the 43-character EncodingAESKey (trailing "=" is -// appended automatically) and validates that the result is exactly 32 bytes. -// It is the single place that handles this repeated pattern in both encrypt and decrypt paths. -func decodeWeComAESKey(encodingAESKey string) ([]byte, error) { - aesKey, err := base64.StdEncoding.DecodeString(encodingAESKey + "=") - if err != nil { - return nil, fmt.Errorf("failed to decode AES key: %w", err) - } - if len(aesKey) != 32 { - return nil, fmt.Errorf("invalid AES key length: %d", len(aesKey)) - } - return aesKey, nil -} - -// encryptAESCBC encrypts plaintext using AES-CBC with the given key, mirroring -// decryptAESCBC. IV = aesKey[:aes.BlockSize]. The caller must PKCS7-pad the -// plaintext to a multiple of aes.BlockSize before calling. -func encryptAESCBC(aesKey, plaintext []byte) ([]byte, error) { - block, err := aes.NewCipher(aesKey) - if err != nil { - return nil, fmt.Errorf("failed to create cipher: %w", err) - } - iv := aesKey[:aes.BlockSize] - ciphertext := make([]byte, len(plaintext)) - cipher.NewCBCEncrypter(block, iv).CryptBlocks(ciphertext, plaintext) - return ciphertext, nil -} - -// packWeComFrame builds the WeCom wire format: -// -// random(16 ASCII digits) + msg_len(4, big-endian) + msg + receiveid -func packWeComFrame(msg, receiveid string) ([]byte, error) { - randomBytes := make([]byte, 16) - for i := range 16 { - n, err := rand.Int(rand.Reader, big.NewInt(10)) - if err != nil { - return nil, fmt.Errorf("failed to generate random: %w", err) - } - randomBytes[i] = byte('0' + n.Int64()) - } - msgBytes := []byte(msg) - msgLenBytes := make([]byte, 4) - binary.BigEndian.PutUint32(msgLenBytes, uint32(len(msgBytes))) - var buf bytes.Buffer - buf.Write(randomBytes) - buf.Write(msgLenBytes) - buf.Write(msgBytes) - buf.WriteString(receiveid) - return buf.Bytes(), nil -} - -// unpackWeComFrame parses the WeCom wire format produced by packWeComFrame. -// If receiveid is non-empty it verifies the frame's trailing receiveid field. -func unpackWeComFrame(data []byte, receiveid string) (string, error) { - if len(data) < 20 { - return "", fmt.Errorf("decrypted frame too short: %d bytes", len(data)) - } - msgLen := binary.BigEndian.Uint32(data[16:20]) - if int(msgLen) > len(data)-20 { - return "", fmt.Errorf("invalid message length: %d", msgLen) - } - msg := data[20 : 20+msgLen] - if receiveid != "" && len(data) > 20+int(msgLen) { - actualReceiveID := string(data[20+msgLen:]) - if actualReceiveID != receiveid { - return "", fmt.Errorf("receiveid mismatch: expected %s, got %s", receiveid, actualReceiveID) - } - } - return string(msg), nil -} - -// decryptAESCBC decrypts ciphertext using AES-CBC with the given key. -// IV = aesKey[:aes.BlockSize]. PKCS7 padding is stripped from the returned plaintext. -func decryptAESCBC(aesKey, ciphertext []byte) ([]byte, error) { - if len(ciphertext) == 0 { - return nil, fmt.Errorf("ciphertext is empty") - } - if len(ciphertext)%aes.BlockSize != 0 { - return nil, fmt.Errorf("ciphertext length %d is not a multiple of block size", len(ciphertext)) - } - block, err := aes.NewCipher(aesKey) - if err != nil { - return nil, fmt.Errorf("failed to create cipher: %w", err) - } - iv := aesKey[:aes.BlockSize] - plaintext := make([]byte, len(ciphertext)) - cipher.NewCBCDecrypter(block, iv).CryptBlocks(plaintext, ciphertext) - plaintext, err = pkcs7Unpad(plaintext) - if err != nil { - return nil, fmt.Errorf("failed to unpad: %w", err) - } - return plaintext, nil -} - -// pkcs7Pad adds PKCS7 padding -func pkcs7Pad(data []byte, blockSize int) []byte { - padding := blockSize - (len(data) % blockSize) - if padding == 0 { - padding = blockSize - } - padText := bytes.Repeat([]byte{byte(padding)}, padding) - return append(data, padText...) -} - -// pkcs7Unpad removes PKCS7 padding with validation -func pkcs7Unpad(data []byte) ([]byte, error) { - if len(data) == 0 { - return data, nil - } - padding := int(data[len(data)-1]) - // WeCom uses 32-byte block size for PKCS7 padding - if padding == 0 || padding > blockSize { - return nil, fmt.Errorf("invalid padding size: %d", padding) - } - if padding > len(data) { - return nil, fmt.Errorf("padding size larger than data") - } - // Verify all padding bytes - for i := range padding { - if data[len(data)-1-i] != byte(padding) { - return nil, fmt.Errorf("invalid padding byte at position %d", i) - } - } - return data[:len(data)-padding], nil -} diff --git a/pkg/channels/wecom/dedupe.go b/pkg/channels/wecom/dedupe.go deleted file mode 100644 index 865be668e..000000000 --- a/pkg/channels/wecom/dedupe.go +++ /dev/null @@ -1,54 +0,0 @@ -package wecom - -import "sync" - -const wecomMaxProcessedMessages = 1000 - -// MessageDeduplicator provides thread-safe message deduplication using a circular queue (ring buffer) -// combined with a hash map. This ensures fast O(1) lookups while naturally evicting the oldest -// messages without causing "amnesia cliffs" when the limit is reached. -type MessageDeduplicator struct { - mu sync.Mutex - msgs map[string]bool - ring []string - idx int - max int -} - -// NewMessageDeduplicator creates a new deduplicator with the specified capacity. -func NewMessageDeduplicator(maxEntries int) *MessageDeduplicator { - if maxEntries <= 0 { - maxEntries = wecomMaxProcessedMessages - } - return &MessageDeduplicator{ - msgs: make(map[string]bool, maxEntries), - ring: make([]string, maxEntries), - max: maxEntries, - } -} - -// MarkMessageProcessed marks msgID as processed and returns false for duplicates. -func (d *MessageDeduplicator) MarkMessageProcessed(msgID string) bool { - d.mu.Lock() - defer d.mu.Unlock() - - // 1. Check for duplicate - if d.msgs[msgID] { - return false - } - - // 2. Evict the oldest message at our current ring position (if any) - oldestID := d.ring[d.idx] - if oldestID != "" { - delete(d.msgs, oldestID) - } - - // 3. Store the new message - d.msgs[msgID] = true - d.ring[d.idx] = msgID - - // 4. Advance the circle queue index - d.idx = (d.idx + 1) % d.max - - return true -} diff --git a/pkg/channels/wecom/dedupe_test.go b/pkg/channels/wecom/dedupe_test.go deleted file mode 100644 index 10dff4cfe..000000000 --- a/pkg/channels/wecom/dedupe_test.go +++ /dev/null @@ -1,83 +0,0 @@ -package wecom - -import ( - "sync" - "testing" -) - -func TestMessageDeduplicator_DuplicateDetection(t *testing.T) { - d := NewMessageDeduplicator(wecomMaxProcessedMessages) - - if ok := d.MarkMessageProcessed("msg-1"); !ok { - t.Fatalf("first message should be accepted") - } - - if ok := d.MarkMessageProcessed("msg-1"); ok { - t.Fatalf("duplicate message should be rejected") - } -} - -func TestMessageDeduplicator_ConcurrentSameMessage(t *testing.T) { - d := NewMessageDeduplicator(wecomMaxProcessedMessages) - - const goroutines = 64 - var wg sync.WaitGroup - wg.Add(goroutines) - - results := make(chan bool, goroutines) - for i := 0; i < goroutines; i++ { - go func() { - defer wg.Done() - results <- d.MarkMessageProcessed("msg-concurrent") - }() - } - - wg.Wait() - close(results) - - successes := 0 - for ok := range results { - if ok { - successes++ - } - } - - if successes != 1 { - t.Fatalf("expected exactly 1 successful mark, got %d", successes) - } -} - -func TestMessageDeduplicator_CircularQueueEviction(t *testing.T) { - // Create a deduplicator with a very small capacity to test eviction easily. - capacity := 3 - d := NewMessageDeduplicator(capacity) - - // Fill the queue. - d.MarkMessageProcessed("msg-1") - d.MarkMessageProcessed("msg-2") - d.MarkMessageProcessed("msg-3") - - // At this point, the queue is full. msg-1 is the oldest. - if len(d.msgs) != 3 { - t.Fatalf("expected map size to be 3, got %d", len(d.msgs)) - } - - // This should evict msg-1 and add msg-4. - if ok := d.MarkMessageProcessed("msg-4"); !ok { - t.Fatalf("msg-4 should be accepted") - } - - if len(d.msgs) != 3 { - t.Fatalf("expected map size to remain at max capacity (3), got %d", len(d.msgs)) - } - - // msg-1 should now be forgotten (evicted). - if ok := d.MarkMessageProcessed("msg-1"); !ok { - t.Fatalf("msg-1 should be accepted again because it was evicted") - } - - // msg-2 should have been evicted when we added msg-1 back. - if ok := d.MarkMessageProcessed("msg-2"); !ok { - t.Fatalf("msg-2 should be accepted again because it was evicted") - } -} diff --git a/pkg/channels/wecom/init.go b/pkg/channels/wecom/init.go index bc5a70fa3..3aad84d42 100644 --- a/pkg/channels/wecom/init.go +++ b/pkg/channels/wecom/init.go @@ -8,12 +8,6 @@ import ( func init() { channels.RegisterFactory("wecom", func(cfg *config.Config, b *bus.MessageBus) (channels.Channel, error) { - return NewWeComBotChannel(cfg.Channels.WeCom, b) - }) - channels.RegisterFactory("wecom_app", func(cfg *config.Config, b *bus.MessageBus) (channels.Channel, error) { - return NewWeComAppChannel(cfg.Channels.WeComApp, b) - }) - channels.RegisterFactory("wecom_aibot", func(cfg *config.Config, b *bus.MessageBus) (channels.Channel, error) { - return NewWeComAIBotChannel(cfg.Channels.WeComAIBot, b) + return NewChannel(cfg.Channels.WeCom, b) }) } diff --git a/pkg/channels/wecom/media.go b/pkg/channels/wecom/media.go new file mode 100644 index 000000000..defe226d4 --- /dev/null +++ b/pkg/channels/wecom/media.go @@ -0,0 +1,291 @@ +package wecom + +import ( + "context" + "crypto/aes" + "crypto/cipher" + "encoding/base64" + "fmt" + "io" + "mime" + "net/http" + "net/url" + "os" + "path/filepath" + "strings" + + "github.com/h2non/filetype" + + "github.com/sipeed/picoclaw/pkg/media" +) + +func decodeMediaAESKey(value string) ([]byte, error) { + if value == "" { + return nil, nil + } + key, err := base64.StdEncoding.DecodeString(value) + if err == nil && len(key) == 32 { + return key, nil + } + key, err = base64.StdEncoding.DecodeString(value + "=") + if err != nil { + return nil, fmt.Errorf("decode AES key: %w", err) + } + if len(key) != 32 { + return nil, fmt.Errorf("invalid AES key length %d", len(key)) + } + return key, nil +} + +func decryptAESCBC(key, ciphertext []byte) ([]byte, error) { + if len(ciphertext) == 0 { + return nil, fmt.Errorf("ciphertext is empty") + } + if len(ciphertext)%aes.BlockSize != 0 { + return nil, fmt.Errorf("ciphertext length %d is not a multiple of block size", len(ciphertext)) + } + block, err := aes.NewCipher(key) + if err != nil { + return nil, fmt.Errorf("create cipher: %w", err) + } + plaintext := make([]byte, len(ciphertext)) + iv := key[:aes.BlockSize] + cipher.NewCBCDecrypter(block, iv).CryptBlocks(plaintext, ciphertext) + return pkcs7Unpad(plaintext) +} + +func pkcs7Unpad(data []byte) ([]byte, error) { + if len(data) == 0 { + return nil, fmt.Errorf("empty plaintext") + } + padding := int(data[len(data)-1]) + if padding == 0 || padding > 32 || padding > len(data) { + return nil, fmt.Errorf("invalid padding size %d", padding) + } + for i := 0; i < padding; i++ { + if data[len(data)-1-i] != byte(padding) { + return nil, fmt.Errorf("invalid padding byte") + } + } + return data[:len(data)-padding], nil +} + +func inferMediaExt(contentType, fallback string) string { + contentType = normalizeWeComContentType(contentType) + switch contentType { + case "image/jpeg", "image/jpg": + return ".jpg" + case "image/png": + return ".png" + case "image/gif": + return ".gif" + case "image/webp": + return ".webp" + case "application/pdf": + return ".pdf" + case "video/mp4": + return ".mp4" + default: + return fallback + } +} + +func normalizeWeComContentType(value string) string { + value = strings.ToLower(strings.TrimSpace(value)) + if idx := strings.Index(value, ";"); idx >= 0 { + value = strings.TrimSpace(value[:idx]) + } + return value +} + +func isGenericWeComContentType(value string) bool { + switch normalizeWeComContentType(value) { + case "", "application/octet-stream", "binary/octet-stream", "application/unknown", "application/binary": + return true + default: + return false + } +} + +func sanitizeWeComFilename(name string) string { + name = filepath.Base(strings.TrimSpace(name)) + if name == "." || name == "/" || name == "" { + return "" + } + return name +} + +func candidateWeComFilename(resourceURL, contentDisposition, fallbackName string) string { + if _, params, err := mime.ParseMediaType(contentDisposition); err == nil { + if name := sanitizeWeComFilename(params["filename"]); name != "" { + return name + } + if name := sanitizeWeComFilename(params["filename*"]); name != "" { + return name + } + } + + if parsed, err := url.Parse(resourceURL); err == nil { + query := parsed.Query() + for _, key := range []string{"filename", "file_name", "name"} { + if name := sanitizeWeComFilename(query.Get(key)); name != "" { + return name + } + } + if name := sanitizeWeComFilename(parsed.Path); name != "" { + return name + } + } + + return sanitizeWeComFilename(fallbackName) +} + +func detectWeComFiletype(data []byte) (string, string) { + kind, err := filetype.Match(data) + if err != nil || kind == filetype.Unknown { + return "", "" + } + ext := "" + if kind.Extension != "" { + ext = "." + strings.ToLower(kind.Extension) + } + return normalizeWeComContentType(kind.MIME.Value), ext +} + +func detectWeComMediaMetadata(data []byte, fallbackName, fallbackContentType, resourceURL, contentDisposition string) (string, string) { + filename := candidateWeComFilename(resourceURL, contentDisposition, fallbackName) + if filename == "" { + filename = "media" + } + + ext := strings.ToLower(filepath.Ext(filename)) + contentType := normalizeWeComContentType(fallbackContentType) + detectedType, detectedExt := detectWeComFiletype(data) + + if ext != "" && isGenericWeComContentType(contentType) { + if byExt := normalizeWeComContentType(mime.TypeByExtension(ext)); byExt != "" { + contentType = byExt + } + } + + if detectedType != "" { + switch { + case contentType == "": + contentType = detectedType + case isGenericWeComContentType(contentType): + contentType = detectedType + case strings.HasPrefix(detectedType, "image/") && !strings.HasPrefix(contentType, "image/"): + contentType = detectedType + case strings.HasPrefix(detectedType, "audio/") && !strings.HasPrefix(contentType, "audio/"): + contentType = detectedType + case strings.HasPrefix(detectedType, "video/") && !strings.HasPrefix(contentType, "video/"): + contentType = detectedType + } + } + + if contentType == "" && ext != "" { + contentType = normalizeWeComContentType(mime.TypeByExtension(ext)) + } + if contentType == "" { + contentType = normalizeWeComContentType(http.DetectContentType(data)) + } + + if ext == "" { + ext = detectedExt + } + if ext == "" && contentType != "" { + if exts, err := mime.ExtensionsByType(contentType); err == nil && len(exts) > 0 { + ext = strings.ToLower(exts[0]) + } + } + + if filepath.Ext(filename) == "" && ext != "" { + filename += ext + } + return filename, contentType +} + +func (c *WeComChannel) storeRemoteMedia( + ctx context.Context, + scope, msgID, resourceURL, aesKey, fallbackExt string, +) (string, error) { + store := c.GetMediaStore() + if store == nil { + return "", fmt.Errorf("no media store available") + } + + req, err := http.NewRequestWithContext(ctx, http.MethodGet, resourceURL, nil) + if err != nil { + return "", fmt.Errorf("create request: %w", err) + } + resp, err := c.mediaClient.Do(req) + if err != nil { + return "", fmt.Errorf("download media: %w", err) + } + defer resp.Body.Close() + if resp.StatusCode != http.StatusOK { + return "", fmt.Errorf("download media returned HTTP %d", resp.StatusCode) + } + + const maxSize = 20 << 20 + data, err := io.ReadAll(io.LimitReader(resp.Body, maxSize+1)) + if err != nil { + return "", fmt.Errorf("read media: %w", err) + } + if len(data) > maxSize { + return "", fmt.Errorf("media too large") + } + + if aesKey != "" { + key, keyErr := decodeMediaAESKey(aesKey) + if keyErr != nil { + return "", keyErr + } + data, err = decryptAESCBC(key, data) + if err != nil { + return "", fmt.Errorf("decrypt media: %w", err) + } + } + + filename, contentType := detectWeComMediaMetadata( + data, + msgID+fallbackExt, + resp.Header.Get("Content-Type"), + resourceURL, + resp.Header.Get("Content-Disposition"), + ) + ext := filepath.Ext(filename) + if ext == "" { + ext = inferMediaExt(contentType, fallbackExt) + } + mediaDir := filepath.Join(os.TempDir(), "picoclaw_media") + if mkdirErr := os.MkdirAll(mediaDir, 0o700); mkdirErr != nil { + return "", fmt.Errorf("mkdir media dir: %w", mkdirErr) + } + tmpFile, err := os.CreateTemp(mediaDir, msgID+"-*"+ext) + if err != nil { + return "", fmt.Errorf("create temp file: %w", err) + } + tmpPath := tmpFile.Name() + if _, writeErr := tmpFile.Write(data); writeErr != nil { + tmpFile.Close() + _ = os.Remove(tmpPath) + return "", fmt.Errorf("write temp file: %w", writeErr) + } + if closeErr := tmpFile.Close(); closeErr != nil { + _ = os.Remove(tmpPath) + return "", fmt.Errorf("close temp file: %w", closeErr) + } + + ref, err := store.Store(tmpPath, media.MediaMeta{ + Filename: filename, + ContentType: contentType, + Source: "wecom", + CleanupPolicy: media.CleanupPolicyDeleteOnCleanup, + }, scope) + if err != nil { + _ = os.Remove(tmpPath) + return "", err + } + return ref, nil +} diff --git a/pkg/channels/wecom/media_test.go b/pkg/channels/wecom/media_test.go new file mode 100644 index 000000000..d5307e5d2 --- /dev/null +++ b/pkg/channels/wecom/media_test.go @@ -0,0 +1,180 @@ +package wecom + +import ( + "bytes" + "context" + "encoding/base64" + "io" + "net/http" + "strings" + "testing" + + basechannels "github.com/sipeed/picoclaw/pkg/channels" + "github.com/sipeed/picoclaw/pkg/media" +) + +func TestStoreRemoteMedia_DetectsJPEGContentTypeFromBody(t *testing.T) { + t.Parallel() + + const jpegBase64 = "/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAP//////////////////////////////////////////////////////////////////////////////////////" + + "//////////////////////////////////////////////////////////////////////////////////////////////2wBDAf//////////////////////////////////////////////////////////////////////////////////////" + + "//////////////////////////////////////////////////////////////////////////////////////////////wAARCAABAAEDASIAAhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAAAAb/xAAVEQEBAAAAAAAAAAAAAAAAAAAABf/aAAwDAQACEAMQAAAB6A//xAAVEAEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAQABBQJf/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwF//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwF//8QAFBABAAAAAAAAAAAAAAAAAAAAEP/aAAgBAQAGPwJf/8QAFBABAAAAAAAAAAAAAAAAAAAAEP/aAAgBAQABPyFf/9k=" + + jpegData := decodeTestBase64(t, jpegBase64) + store := media.NewFileMediaStore() + ch := &WeComChannel{ + BaseChannel: basechannels.NewBaseChannel("wecom", nil, nil, nil), + mediaClient: &http.Client{ + Transport: roundTripFunc(func(*http.Request) (*http.Response, error) { + return &http.Response{ + StatusCode: http.StatusOK, + Header: http.Header{"Content-Type": []string{"application/octet-stream"}}, + Body: io.NopCloser(bytes.NewReader(jpegData)), + }, nil + }), + }, + } + ch.SetMediaStore(store) + + ref, err := ch.storeRemoteMedia(context.Background(), "test-scope", "msg-1", "https://wecom.example/media", "", "") + if err != nil { + t.Fatalf("storeRemoteMedia returned error: %v", err) + } + t.Cleanup(func() { + _ = store.ReleaseAll("test-scope") + }) + + _, meta, err := store.ResolveWithMeta(ref) + if err != nil { + t.Fatalf("resolve media ref: %v", err) + } + if meta.ContentType != "image/jpeg" { + t.Fatalf("expected image/jpeg content type, got %q", meta.ContentType) + } + if !strings.HasSuffix(meta.Filename, ".jpg") && !strings.HasSuffix(meta.Filename, ".jpeg") { + t.Fatalf("expected jpeg filename, got %q", meta.Filename) + } +} + +func TestDetectWeComMediaMetadata_UsesFallbackExtensionWhenBodyUnknown(t *testing.T) { + t.Parallel() + + filename, contentType := detectWeComMediaMetadata([]byte("not a real image"), "msg-2.pdf", "", "", "") + if filename != "msg-2.pdf" { + t.Fatalf("expected fallback filename to be preserved, got %q", filename) + } + if contentType != "application/pdf" { + t.Fatalf("expected application/pdf from fallback extension, got %q", contentType) + } +} + +func TestStoreRemoteMedia_PreservesSuffixFromURL(t *testing.T) { + t.Parallel() + + docxLikeData := []byte("PK\x03\x04fake office payload") + store := media.NewFileMediaStore() + ch := &WeComChannel{ + BaseChannel: basechannels.NewBaseChannel("wecom", nil, nil, nil), + mediaClient: &http.Client{ + Transport: roundTripFunc(func(*http.Request) (*http.Response, error) { + return &http.Response{ + StatusCode: http.StatusOK, + Header: http.Header{"Content-Type": []string{"application/octet-stream"}}, + Body: io.NopCloser(bytes.NewReader(docxLikeData)), + }, nil + }), + }, + } + ch.SetMediaStore(store) + + ref, err := ch.storeRemoteMedia( + context.Background(), + "test-scope", + "msg-docx", + "https://wecom.example/media/report.docx?signature=1", + "", + ".bin", + ) + if err != nil { + t.Fatalf("storeRemoteMedia returned error: %v", err) + } + t.Cleanup(func() { + _ = store.ReleaseAll("test-scope") + }) + + localPath, meta, err := store.ResolveWithMeta(ref) + if err != nil { + t.Fatalf("resolve media ref: %v", err) + } + if !strings.HasSuffix(meta.Filename, ".docx") { + t.Fatalf("expected docx filename, got %q", meta.Filename) + } + if !strings.HasSuffix(strings.ToLower(localPath), ".docx") { + t.Fatalf("expected docx temp path, got %q", localPath) + } +} + +func TestStoreRemoteMedia_PreservesSuffixFromContentDisposition(t *testing.T) { + t.Parallel() + + pptxLikeData := []byte("PK\x03\x04fake office payload") + store := media.NewFileMediaStore() + ch := &WeComChannel{ + BaseChannel: basechannels.NewBaseChannel("wecom", nil, nil, nil), + mediaClient: &http.Client{ + Transport: roundTripFunc(func(*http.Request) (*http.Response, error) { + return &http.Response{ + StatusCode: http.StatusOK, + Header: http.Header{ + "Content-Type": []string{"application/octet-stream"}, + "Content-Disposition": []string{`attachment; filename="slides.pptx"`}, + }, + Body: io.NopCloser(bytes.NewReader(pptxLikeData)), + }, nil + }), + }, + } + ch.SetMediaStore(store) + + ref, err := ch.storeRemoteMedia( + context.Background(), + "test-scope", + "msg-pptx", + "https://wecom.example/media/download", + "", + ".bin", + ) + if err != nil { + t.Fatalf("storeRemoteMedia returned error: %v", err) + } + t.Cleanup(func() { + _ = store.ReleaseAll("test-scope") + }) + + localPath, meta, err := store.ResolveWithMeta(ref) + if err != nil { + t.Fatalf("resolve media ref: %v", err) + } + if !strings.HasSuffix(meta.Filename, ".pptx") { + t.Fatalf("expected pptx filename, got %q", meta.Filename) + } + if !strings.HasSuffix(strings.ToLower(localPath), ".pptx") { + t.Fatalf("expected pptx temp path, got %q", localPath) + } +} + +func decodeTestBase64(t *testing.T, value string) []byte { + t.Helper() + + data, err := io.ReadAll(base64.NewDecoder(base64.StdEncoding, strings.NewReader(value))) + if err != nil { + t.Fatalf("decode base64 fixture: %v", err) + } + return data +} + +type roundTripFunc func(*http.Request) (*http.Response, error) + +func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) { + return f(req) +} diff --git a/pkg/channels/wecom/protocol.go b/pkg/channels/wecom/protocol.go new file mode 100644 index 000000000..6867d8856 --- /dev/null +++ b/pkg/channels/wecom/protocol.go @@ -0,0 +1,122 @@ +package wecom + +import "encoding/json" + +const ( + wecomDefaultWebSocketURL = "wss://openws.work.weixin.qq.com" + wecomCmdSubscribe = "aibot_subscribe" + wecomCmdPing = "ping" + wecomCmdMsgCallback = "aibot_msg_callback" + wecomCmdEventCallback = "aibot_event_callback" + wecomCmdRespondMsg = "aibot_respond_msg" + wecomCmdSendMsg = "aibot_send_msg" + wecomMaxContentBytes = 20480 +) + +type wecomEnvelope struct { + Cmd string `json:"cmd,omitempty"` + Headers wecomHeaders `json:"headers"` + Body json.RawMessage `json:"body,omitempty"` + ErrCode int `json:"errcode,omitempty"` + ErrMsg string `json:"errmsg,omitempty"` +} + +type wecomHeaders struct { + ReqID string `json:"req_id,omitempty"` +} + +type wecomCommand struct { + Cmd string `json:"cmd"` + Headers wecomHeaders `json:"headers"` + Body any `json:"body,omitempty"` +} + +type wecomSendMsgBody struct { + ChatID string `json:"chatid"` + ChatType uint32 `json:"chat_type,omitempty"` + MsgType string `json:"msgtype"` + Markdown *wecomMarkdownContent `json:"markdown,omitempty"` +} + +type wecomRespondMsgBody struct { + MsgType string `json:"msgtype"` + Stream *wecomStreamContent `json:"stream,omitempty"` +} + +type wecomStreamContent struct { + ID string `json:"id"` + Finish bool `json:"finish"` + Content string `json:"content,omitempty"` +} + +type wecomMarkdownContent struct { + Content string `json:"content"` +} + +type wecomIncomingMessage struct { + MsgID string `json:"msgid"` + AIBotID string `json:"aibotid"` + ChatID string `json:"chatid,omitempty"` + ChatType string `json:"chattype,omitempty"` + From struct { + UserID string `json:"userid"` + } `json:"from"` + MsgType string `json:"msgtype"` + Text *struct { + Content string `json:"content"` + } `json:"text,omitempty"` + Image *struct { + URL string `json:"url"` + AESKey string `json:"aeskey,omitempty"` + } `json:"image,omitempty"` + File *struct { + URL string `json:"url"` + AESKey string `json:"aeskey,omitempty"` + } `json:"file,omitempty"` + Video *struct { + URL string `json:"url"` + AESKey string `json:"aeskey,omitempty"` + } `json:"video,omitempty"` + Voice *struct { + Content string `json:"content"` + } `json:"voice,omitempty"` + Mixed *struct { + MsgItem []struct { + MsgType string `json:"msgtype"` + Text *struct { + Content string `json:"content"` + } `json:"text,omitempty"` + Image *struct { + URL string `json:"url"` + AESKey string `json:"aeskey,omitempty"` + } `json:"image,omitempty"` + File *struct { + URL string `json:"url"` + AESKey string `json:"aeskey,omitempty"` + } `json:"file,omitempty"` + } `json:"msg_item"` + } `json:"mixed,omitempty"` + Quote *struct { + MsgType string `json:"msgtype"` + Text *struct { + Content string `json:"content"` + } `json:"text,omitempty"` + } `json:"quote,omitempty"` + Event *struct { + EventType string `json:"eventtype"` + } `json:"event,omitempty"` +} + +func incomingChatID(msg wecomIncomingMessage) string { + if msg.ChatID != "" { + return msg.ChatID + } + return msg.From.UserID +} + +func incomingChatTypeCode(kind string) uint32 { + if kind == "group" { + return 2 + } + return 1 +} diff --git a/pkg/channels/wecom/reqid_store.go b/pkg/channels/wecom/reqid_store.go new file mode 100644 index 000000000..59e64e63d --- /dev/null +++ b/pkg/channels/wecom/reqid_store.go @@ -0,0 +1,113 @@ +package wecom + +import ( + "encoding/json" + "errors" + "os" + "path/filepath" + "sync" + "time" +) + +type wecomRoute struct { + ReqID string `json:"req_id"` + ChatID string `json:"chat_id"` + ChatType uint32 `json:"chat_type"` + ExpiresAt time.Time `json:"expires_at"` +} + +type reqIDStore struct { + mu sync.Mutex + path string + routes map[string]wecomRoute +} + +func newReqIDStore(path string) *reqIDStore { + if path == "" { + path = defaultReqIDStorePath() + } + s := &reqIDStore{ + path: path, + routes: make(map[string]wecomRoute), + } + _ = s.load() + return s +} + +func defaultReqIDStorePath() string { + if home, err := os.UserHomeDir(); err == nil && home != "" { + return filepath.Join(home, ".picoclaw", "wecom", "reqid-store.json") + } + return filepath.Join(os.TempDir(), "picoclaw-wecom-reqid-store.json") +} + +func (s *reqIDStore) Put(chatID, reqID string, chatType uint32, ttl time.Duration) error { + if reqID == "" || chatID == "" { + return nil + } + s.mu.Lock() + defer s.mu.Unlock() + s.deleteExpiredLocked(time.Now()) + s.routes[chatID] = wecomRoute{ + ReqID: reqID, + ChatID: chatID, + ChatType: chatType, + ExpiresAt: time.Now().Add(ttl), + } + return s.saveLocked() +} + +func (s *reqIDStore) Get(chatID string) (wecomRoute, bool) { + s.mu.Lock() + defer s.mu.Unlock() + s.deleteExpiredLocked(time.Now()) + route, ok := s.routes[chatID] + return route, ok +} + +func (s *reqIDStore) Delete(chatID string) error { + s.mu.Lock() + defer s.mu.Unlock() + delete(s.routes, chatID) + return s.saveLocked() +} + +func (s *reqIDStore) load() error { + s.mu.Lock() + defer s.mu.Unlock() + + data, err := os.ReadFile(s.path) + if err != nil { + if errors.Is(err, os.ErrNotExist) { + return nil + } + return err + } + + var routes map[string]wecomRoute + if err := json.Unmarshal(data, &routes); err != nil { + return err + } + s.routes = routes + s.deleteExpiredLocked(time.Now()) + return nil +} + +func (s *reqIDStore) deleteExpiredLocked(now time.Time) { + for chatID, route := range s.routes { + if !route.ExpiresAt.IsZero() && now.After(route.ExpiresAt) { + delete(s.routes, chatID) + } + } +} + +func (s *reqIDStore) saveLocked() error { + if err := os.MkdirAll(filepath.Dir(s.path), 0o700); err != nil { + return err + } + data, err := json.MarshalIndent(s.routes, "", " ") + if err != nil { + return err + } + return os.WriteFile(s.path, data, 0o600) +} diff --git a/pkg/channels/wecom/reqid_store_test.go b/pkg/channels/wecom/reqid_store_test.go new file mode 100644 index 000000000..e68e82500 --- /dev/null +++ b/pkg/channels/wecom/reqid_store_test.go @@ -0,0 +1,24 @@ +package wecom + +import ( + "path/filepath" + "testing" + "time" +) + +func TestReqIDStorePersistsRoutes(t *testing.T) { + storePath := filepath.Join(t.TempDir(), "reqids.json") + store := newReqIDStore(storePath) + if err := store.Put("chat-1", "req-1", 2, time.Hour); err != nil { + t.Fatalf("Put() error = %v", err) + } + + reloaded := newReqIDStore(storePath) + route, ok := reloaded.Get("chat-1") + if !ok { + t.Fatal("expected persisted route to be loaded") + } + if route.ChatID != "chat-1" || route.ReqID != "req-1" || route.ChatType != 2 { + t.Fatalf("loaded route = %+v", route) + } +} diff --git a/pkg/channels/wecom/wecom.go b/pkg/channels/wecom/wecom.go new file mode 100644 index 000000000..11959c259 --- /dev/null +++ b/pkg/channels/wecom/wecom.go @@ -0,0 +1,777 @@ +package wecom + +import ( + "context" + "crypto/rand" + "encoding/json" + "fmt" + "math/big" + "net/http" + "strings" + "sync" + "time" + + "github.com/gorilla/websocket" + + "github.com/sipeed/picoclaw/pkg/bus" + "github.com/sipeed/picoclaw/pkg/channels" + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/identity" + "github.com/sipeed/picoclaw/pkg/logger" +) + +const ( + wecomConnectTimeout = 15 * time.Second + wecomCommandTimeout = 10 * time.Second + wecomHeartbeatInterval = 30 * time.Second + wecomStreamMaxDuration = 5*time.Minute + 30*time.Second + wecomRouteTTL = 30 * time.Minute + wecomMediaTimeout = 30 * time.Second + wecomRecentMessageMax = 1000 +) + +type WeComChannel struct { + *channels.BaseChannel + config config.WeComConfig + + ctx context.Context + cancel context.CancelFunc + + conn *websocket.Conn + connMu sync.Mutex + + pendingMu sync.Mutex + pending map[string]chan wecomEnvelope + + turnsMu sync.Mutex + turns map[string][]wecomTurn + + recent *recentMessageSet + routes *reqIDStore + mediaClient *http.Client + commandSend func(wecomCommand, time.Duration) error +} + +type wecomTurn struct { + ReqID string + ChatID string + ChatType uint32 + StreamID string + CreatedAt time.Time +} + +type recentMessageSet struct { + mu sync.Mutex + seen map[string]struct{} + ring []string + idx int +} + +func newRecentMessageSet(capacity int) *recentMessageSet { + if capacity <= 0 { + capacity = wecomRecentMessageMax + } + return &recentMessageSet{ + seen: make(map[string]struct{}, capacity), + ring: make([]string, capacity), + } +} + +func (s *recentMessageSet) Mark(id string) bool { + if id == "" { + return true + } + s.mu.Lock() + defer s.mu.Unlock() + if _, ok := s.seen[id]; ok { + return false + } + if old := s.ring[s.idx]; old != "" { + delete(s.seen, old) + } + s.ring[s.idx] = id + s.idx = (s.idx + 1) % len(s.ring) + s.seen[id] = struct{}{} + return true +} + +func NewChannel(cfg config.WeComConfig, messageBus *bus.MessageBus) (*WeComChannel, error) { + if cfg.BotID == "" || cfg.Secret() == "" { + return nil, fmt.Errorf("wecom bot_id and secret are required") + } + if cfg.WebSocketURL == "" { + cfg.WebSocketURL = wecomDefaultWebSocketURL + } + + base := channels.NewBaseChannel( + "wecom", + cfg, + messageBus, + cfg.AllowFrom, + channels.WithMaxMessageLength(wecomMaxContentBytes), + channels.WithReasoningChannelID(cfg.ReasoningChannelID), + ) + + ch := &WeComChannel{ + BaseChannel: base, + config: cfg, + pending: make(map[string]chan wecomEnvelope), + turns: make(map[string][]wecomTurn), + recent: newRecentMessageSet(wecomRecentMessageMax), + routes: newReqIDStore(""), + mediaClient: &http.Client{Timeout: wecomMediaTimeout}, + } + ch.SetOwner(ch) + return ch, nil +} + +func (c *WeComChannel) Name() string { return "wecom" } + +func (c *WeComChannel) Start(ctx context.Context) error { + logger.InfoC("wecom", "Starting WeCom channel...") + c.ctx, c.cancel = context.WithCancel(ctx) + c.SetRunning(true) + go c.connectLoop() + return nil +} + +func (c *WeComChannel) Stop(_ context.Context) error { + logger.InfoC("wecom", "Stopping WeCom channel...") + if c.cancel != nil { + c.cancel() + } + c.connMu.Lock() + if c.conn != nil { + _ = c.conn.Close() + c.conn = nil + } + c.connMu.Unlock() + c.clearTurns() + c.SetRunning(false) + return nil +} + +func (c *WeComChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { + if !c.IsRunning() { + return channels.ErrNotRunning + } + content := strings.TrimSpace(msg.Content) + if content == "" { + return nil + } + + if turn, ok := c.getTurn(msg.ChatID); ok { + if time.Since(turn.CreatedAt) <= wecomStreamMaxDuration { + if err := c.sendStreamReply(turn, content); err == nil { + c.deleteTurn(msg.ChatID) + return nil + } + } + c.deleteTurn(msg.ChatID) + } + + if route, ok := c.routes.Get(msg.ChatID); ok { + if err := c.sendActivePush(route.ChatID, route.ChatType, content); err != nil { + return err + } + return nil + } + + if err := c.sendActivePush(msg.ChatID, 0, content); err != nil { + return err + } + return nil +} + +func (c *WeComChannel) SendMedia(ctx context.Context, msg bus.OutboundMediaMessage) error { + if !c.IsRunning() { + return channels.ErrNotRunning + } + var parts []string + for _, part := range msg.Parts { + switch { + case part.Caption != "": + parts = append(parts, part.Caption) + case part.Filename != "": + parts = append(parts, fmt.Sprintf("[media: %s]", part.Filename)) + default: + parts = append(parts, "[media attachments are not yet supported]") + } + } + return c.Send(ctx, bus.OutboundMessage{ + Channel: msg.Channel, + ChatID: msg.ChatID, + Content: strings.Join(parts, "\n"), + }) +} + +func (c *WeComChannel) connectLoop() { + backoff := time.Second + for { + select { + case <-c.ctx.Done(): + return + default: + } + + if err := c.runConnection(); err != nil { + logger.WarnCF("wecom", "WeCom connection lost", map[string]any{ + "error": err.Error(), + "backoff": backoff.String(), + }) + select { + case <-time.After(backoff): + case <-c.ctx.Done(): + return + } + if backoff < time.Minute { + backoff *= 2 + if backoff > time.Minute { + backoff = time.Minute + } + } + continue + } + return + } +} + +func (c *WeComChannel) runConnection() error { + dialCtx, cancel := context.WithTimeout(c.ctx, wecomConnectTimeout) + defer cancel() + + conn, resp, err := websocket.DefaultDialer.DialContext(dialCtx, c.config.WebSocketURL, nil) + if resp != nil { + _ = resp.Body.Close() + } + if err != nil { + return fmt.Errorf("%w: %v", channels.ErrTemporary, err) + } + + c.connMu.Lock() + c.conn = conn + c.connMu.Unlock() + defer func() { + c.connMu.Lock() + if c.conn == conn { + c.conn = nil + } + c.connMu.Unlock() + _ = conn.Close() + c.clearTurns() + }() + + readErrCh := make(chan error, 1) + go func() { + readErrCh <- c.readLoop(conn) + }() + + if writeErr := c.writeAndWait(conn, wecomCommand{ + Cmd: wecomCmdSubscribe, + Headers: wecomHeaders{ReqID: randomID(10)}, + Body: map[string]string{ + "bot_id": c.config.BotID, + "secret": c.config.Secret(), + }, + }, wecomCommandTimeout); writeErr != nil { + return writeErr + } + + heartbeatDone := make(chan struct{}) + go func() { + defer close(heartbeatDone) + c.heartbeatLoop(conn) + }() + + err = <-readErrCh + _ = conn.Close() + <-heartbeatDone + return err +} + +func (c *WeComChannel) heartbeatLoop(conn *websocket.Conn) { + ticker := time.NewTicker(wecomHeartbeatInterval) + defer ticker.Stop() + for { + select { + case <-ticker.C: + if err := c.writeAndWait(conn, wecomCommand{ + Cmd: wecomCmdPing, + Headers: wecomHeaders{ReqID: randomID(10)}, + }, wecomCommandTimeout); err != nil { + logger.WarnCF("wecom", "Heartbeat failed", map[string]any{"error": err.Error()}) + _ = conn.Close() + return + } + case <-c.ctx.Done(): + return + } + } +} + +func (c *WeComChannel) readLoop(conn *websocket.Conn) error { + for { + _, raw, err := conn.ReadMessage() + if err != nil { + select { + case <-c.ctx.Done(): + return nil + default: + return fmt.Errorf("%w: %v", channels.ErrTemporary, err) + } + } + + var env wecomEnvelope + if err := json.Unmarshal(raw, &env); err != nil { + logger.WarnCF("wecom", "Failed to parse WebSocket message", map[string]any{"error": err.Error()}) + continue + } + + if env.Cmd == "" && env.Headers.ReqID != "" { + c.pendingMu.Lock() + ch, ok := c.pending[env.Headers.ReqID] + if ok { + delete(c.pending, env.Headers.ReqID) + } + c.pendingMu.Unlock() + if ok { + ch <- env + } + continue + } + + go c.handleEnvelope(env) + } +} + +func (c *WeComChannel) handleEnvelope(env wecomEnvelope) { + switch env.Cmd { + case wecomCmdMsgCallback: + c.handleMessageCallback(env) + case wecomCmdEventCallback: + c.handleEventCallback(env) + default: + logger.DebugCF("wecom", "Ignoring unsupported WeCom command", map[string]any{"cmd": env.Cmd}) + } +} + +func (c *WeComChannel) handleEventCallback(env wecomEnvelope) { + var msg wecomIncomingMessage + if err := json.Unmarshal(env.Body, &msg); err != nil { + logger.WarnCF("wecom", "Failed to parse WeCom event callback", map[string]any{"error": err.Error()}) + } +} + +func (c *WeComChannel) handleMessageCallback(env wecomEnvelope) { + var msg wecomIncomingMessage + if err := json.Unmarshal(env.Body, &msg); err != nil { + logger.WarnCF("wecom", "Failed to parse WeCom message callback", map[string]any{"error": err.Error()}) + return + } + if !c.recent.Mark(msg.MsgID) { + return + } + + reqID := env.Headers.ReqID + if reqID == "" { + logger.WarnC("wecom", "WeCom message callback missing req_id") + return + } + if msg.Event != nil && msg.Event.EventType != "" { + return + } + + if err := c.dispatchIncoming(reqID, msg); err != nil { + logger.WarnCF("wecom", "Failed to dispatch WeCom message", map[string]any{ + "req_id": reqID, + "error": err.Error(), + }) + _ = c.respondImmediate(reqID, "The WeCom message could not be processed.") + } +} + +func (c *WeComChannel) dispatchIncoming(reqID string, msg wecomIncomingMessage) error { + senderID := msg.From.UserID + if senderID == "" { + senderID = "unknown" + } + actualChatID := incomingChatID(msg) + chatType := incomingChatTypeCode(msg.ChatType) + peerKind := "direct" + if msg.ChatType == "group" { + peerKind = "group" + } + + sender := bus.SenderInfo{ + Platform: "wecom", + PlatformID: senderID, + CanonicalID: identity.BuildCanonicalID("wecom", senderID), + DisplayName: senderID, + } + + var ( + content string + quoteText string + mediaRefs []string + err error + ) + scope := channels.BuildMediaScope("wecom", actualChatID, msg.MsgID) + switch msg.MsgType { + case "text": + if msg.Text != nil { + content = strings.TrimSpace(msg.Text.Content) + } + case "voice": + if msg.Voice != nil { + content = strings.TrimSpace(msg.Voice.Content) + } + case "image": + content = "[image]" + mediaRefs, err = c.collectSingleMedia(c.ctx, scope, msg.MsgID, &mediaPayload{ + url: msg.Image.URL, + aesKey: msg.Image.AESKey, + }, "image", ".jpg") + case "file": + content = "[file]" + mediaRefs, err = c.collectSingleMedia(c.ctx, scope, msg.MsgID, &mediaPayload{ + url: msg.File.URL, + aesKey: msg.File.AESKey, + }, "file", ".bin") + case "video": + content = "[video]" + mediaRefs, err = c.collectSingleMedia(c.ctx, scope, msg.MsgID, &mediaPayload{ + url: msg.Video.URL, + aesKey: msg.Video.AESKey, + }, "video", ".mp4") + case "mixed": + content, mediaRefs, err = c.collectMixedMedia(c.ctx, scope, msg) + default: + return c.respondImmediate(reqID, "Unsupported WeCom message type: "+msg.MsgType) + } + if err != nil { + return err + } + if msg.Quote != nil && msg.Quote.Text != nil { + quoteText = strings.TrimSpace(msg.Quote.Text.Content) + if content == "" { + content = quoteText + } + } + if content == "" && len(mediaRefs) == 0 { + return c.respondImmediate(reqID, "The WeCom message did not contain usable content.") + } + + turn := wecomTurn{ + ReqID: reqID, + ChatID: actualChatID, + ChatType: chatType, + StreamID: randomID(10), + CreatedAt: time.Now(), + } + c.queueTurn(actualChatID, turn) + if err := c.routes.Put(actualChatID, reqID, chatType, wecomRouteTTL); err != nil { + logger.WarnCF("wecom", "Failed to persist req_id route", map[string]any{ + "chat_id": actualChatID, + "req_id": reqID, + "error": err.Error(), + }) + } + + opening := "" + if c.config.SendThinkingMessage { + opening = "Processing..." + } + if err := c.sendStreamChunk(turn, false, opening); err != nil { + return err + } + + peer := bus.Peer{Kind: peerKind, ID: actualChatID} + metadata := map[string]string{ + "channel": "wecom", + "req_id": reqID, + "chat_id": actualChatID, + "chat_type": msg.ChatType, + "msg_id": msg.MsgID, + "msg_type": msg.MsgType, + } + if quoteText != "" { + metadata["quote_text"] = quoteText + } + + c.HandleMessage(c.ctx, peer, msg.MsgID, senderID, actualChatID, content, mediaRefs, metadata, sender) + return nil +} + +func (c *WeComChannel) collectSingleMedia( + ctx context.Context, + scope, msgID string, + payload interface { + GetURL() string + GetAESKey() string + }, + label, fallbackExt string, +) ([]string, error) { + if payload == nil || payload.GetURL() == "" { + return nil, fmt.Errorf("%s payload is empty", label) + } + ref, err := c.storeRemoteMedia(ctx, scope, msgID, payload.GetURL(), payload.GetAESKey(), fallbackExt) + if err != nil { + return nil, err + } + return []string{ref}, nil +} + +type mediaPayload struct { + url string + aesKey string +} + +func (p *mediaPayload) GetURL() string { return p.url } +func (p *mediaPayload) GetAESKey() string { return p.aesKey } + +func (c *WeComChannel) collectMixedMedia( + ctx context.Context, + scope string, + msg wecomIncomingMessage, +) (string, []string, error) { + if msg.Mixed == nil { + return "", nil, fmt.Errorf("mixed message is empty") + } + + var textParts []string + var refs []string + for idx, item := range msg.Mixed.MsgItem { + switch item.MsgType { + case "text": + if item.Text != nil && strings.TrimSpace(item.Text.Content) != "" { + textParts = append(textParts, strings.TrimSpace(item.Text.Content)) + } + case "image": + if item.Image != nil && item.Image.URL != "" { + ref, err := c.storeRemoteMedia( + ctx, + scope, + fmt.Sprintf("%s-%d", msg.MsgID, idx), + item.Image.URL, + item.Image.AESKey, + ".jpg", + ) + if err != nil { + return "", nil, err + } + refs = append(refs, ref) + } + case "file": + if item.File != nil && item.File.URL != "" { + ref, err := c.storeRemoteMedia( + ctx, + scope, + fmt.Sprintf("%s-%d", msg.MsgID, idx), + item.File.URL, + item.File.AESKey, + ".bin", + ) + if err != nil { + return "", nil, err + } + refs = append(refs, ref) + } + } + } + + content := strings.Join(textParts, "\n") + if content == "" && len(refs) > 0 { + content = "[media]" + } + return content, refs, nil +} + +func (c *WeComChannel) respondImmediate(reqID, content string) error { + turn := wecomTurn{ + ReqID: reqID, + StreamID: randomID(10), + CreatedAt: time.Now(), + } + return c.sendStreamChunk(turn, true, content) +} + +func (c *WeComChannel) sendStreamReply(turn wecomTurn, content string) error { + chunks := splitContent(content, wecomMaxContentBytes) + for idx, chunk := range chunks { + if err := c.sendStreamChunk(turn, idx == len(chunks)-1, chunk); err != nil { + return err + } + } + return nil +} + +func (c *WeComChannel) sendStreamChunk(turn wecomTurn, finish bool, content string) error { + return c.sendCommand(wecomCommand{ + Cmd: wecomCmdRespondMsg, + Headers: wecomHeaders{ReqID: turn.ReqID}, + Body: wecomRespondMsgBody{ + MsgType: "stream", + Stream: &wecomStreamContent{ + ID: turn.StreamID, + Finish: finish, + Content: content, + }, + }, + }, wecomCommandTimeout) +} + +func (c *WeComChannel) sendActivePush(chatID string, chatType uint32, content string) error { + if strings.TrimSpace(chatID) == "" { + return fmt.Errorf("empty chat ID: %w", channels.ErrSendFailed) + } + for _, chunk := range splitContent(content, wecomMaxContentBytes) { + if err := c.sendCommand(wecomCommand{ + Cmd: wecomCmdSendMsg, + Headers: wecomHeaders{ReqID: randomID(10)}, + Body: wecomSendMsgBody{ + ChatID: chatID, + ChatType: chatType, + MsgType: "markdown", + Markdown: &wecomMarkdownContent{Content: chunk}, + }, + }, wecomCommandTimeout); err != nil { + return err + } + } + return nil +} + +func (c *WeComChannel) sendCommand(cmd wecomCommand, timeout time.Duration) error { + if c.commandSend != nil { + return c.commandSend(cmd, timeout) + } + return c.writeCurrent(cmd, timeout) +} + +func (c *WeComChannel) writeCurrent(cmd wecomCommand, timeout time.Duration) error { + c.connMu.Lock() + conn := c.conn + c.connMu.Unlock() + if conn == nil { + return fmt.Errorf("wecom websocket not connected: %w", channels.ErrTemporary) + } + return c.writeAndWait(conn, cmd, timeout) +} + +func (c *WeComChannel) writeAndWait(conn *websocket.Conn, cmd wecomCommand, timeout time.Duration) error { + if cmd.Headers.ReqID == "" { + cmd.Headers.ReqID = randomID(10) + } + waitCh := make(chan wecomEnvelope, 1) + c.pendingMu.Lock() + c.pending[cmd.Headers.ReqID] = waitCh + c.pendingMu.Unlock() + defer func() { + c.pendingMu.Lock() + delete(c.pending, cmd.Headers.ReqID) + c.pendingMu.Unlock() + }() + + data, err := json.Marshal(cmd) + if err != nil { + return fmt.Errorf("%w: %v", channels.ErrSendFailed, err) + } + c.connMu.Lock() + err = conn.WriteMessage(websocket.TextMessage, data) + c.connMu.Unlock() + if err != nil { + return fmt.Errorf("%w: %v", channels.ErrTemporary, err) + } + + timer := time.NewTimer(timeout) + defer timer.Stop() + select { + case env := <-waitCh: + if env.ErrCode != 0 { + return fmt.Errorf("%w: wecom errcode=%d errmsg=%s", channels.ErrTemporary, env.ErrCode, env.ErrMsg) + } + return nil + case <-timer.C: + return fmt.Errorf("%w: timeout waiting for WeCom ack", channels.ErrTemporary) + case <-c.ctx.Done(): + return c.ctx.Err() + } +} + +func (c *WeComChannel) getTurn(chatID string) (wecomTurn, bool) { + c.turnsMu.Lock() + defer c.turnsMu.Unlock() + queue := c.turns[chatID] + if len(queue) == 0 { + return wecomTurn{}, false + } + return queue[0], true +} + +func (c *WeComChannel) deleteTurn(chatID string) { + c.turnsMu.Lock() + defer c.turnsMu.Unlock() + queue := c.turns[chatID] + if len(queue) <= 1 { + delete(c.turns, chatID) + return + } + c.turns[chatID] = queue[1:] +} + +func (c *WeComChannel) queueTurn(chatID string, turn wecomTurn) { + c.turnsMu.Lock() + defer c.turnsMu.Unlock() + c.turns[chatID] = append(c.turns[chatID], turn) +} + +func (c *WeComChannel) clearTurns() { + c.turnsMu.Lock() + c.turns = make(map[string][]wecomTurn) + c.turnsMu.Unlock() +} + +func randomID(n int) string { + const alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" + if n <= 0 { + n = 10 + } + buf := make([]byte, n) + for i := range buf { + v, _ := rand.Int(rand.Reader, big.NewInt(int64(len(alphabet)))) + buf[i] = alphabet[v.Int64()] + } + return string(buf) +} + +func splitContent(content string, maxBytes int) []string { + if content == "" { + return []string{""} + } + if len(content) <= maxBytes { + return []string{content} + } + chunks := channels.SplitMessage(content, maxBytes) + var result []string + for _, chunk := range chunks { + if len(chunk) <= maxBytes { + result = append(result, chunk) + continue + } + for len(chunk) > maxBytes { + end := maxBytes + for end > 0 && chunk[end]>>6 == 0b10 { + end-- + } + if end == 0 { + end = maxBytes + } + result = append(result, chunk[:end]) + chunk = strings.TrimLeft(chunk[end:], " \t\r\n") + } + if chunk != "" { + result = append(result, chunk) + } + } + return result +} diff --git a/pkg/channels/wecom/wecom_test.go b/pkg/channels/wecom/wecom_test.go new file mode 100644 index 000000000..e0ee2e628 --- /dev/null +++ b/pkg/channels/wecom/wecom_test.go @@ -0,0 +1,167 @@ +package wecom + +import ( + "context" + "errors" + "path/filepath" + "testing" + "time" + + "github.com/sipeed/picoclaw/pkg/bus" + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestDispatchIncoming_UsesActualChatIDAndStoresReqIDRoute(t *testing.T) { + t.Parallel() + + messageBus := bus.NewMessageBus() + ch := newTestWeComChannel(t, messageBus) + + var commands []wecomCommand + ch.commandSend = func(cmd wecomCommand, _ time.Duration) error { + commands = append(commands, cmd) + return nil + } + + msg := wecomIncomingMessage{ + MsgID: "msg-1", + ChatID: "chat-1", + ChatType: "direct", + MsgType: "text", + Text: &struct { + Content string `json:"content"` + }{Content: "hello"}, + } + msg.From.UserID = "user-1" + + if err := ch.dispatchIncoming("req-1", msg); err != nil { + t.Fatalf("dispatchIncoming() error = %v", err) + } + + select { + case inbound := <-messageBus.InboundChan(): + if inbound.ChatID != "chat-1" { + t.Fatalf("inbound ChatID = %q, want chat-1", inbound.ChatID) + } + if inbound.MessageID != "msg-1" { + t.Fatalf("inbound MessageID = %q, want msg-1", inbound.MessageID) + } + if inbound.Peer.ID != "chat-1" { + t.Fatalf("inbound Peer.ID = %q, want chat-1", inbound.Peer.ID) + } + if inbound.Metadata["req_id"] != "req-1" { + t.Fatalf("inbound req_id = %q, want req-1", inbound.Metadata["req_id"]) + } + default: + t.Fatal("expected inbound message to be published") + } + + turn, ok := ch.getTurn("chat-1") + if !ok { + t.Fatal("expected queued turn for chat-1") + } + if turn.ReqID != "req-1" { + t.Fatalf("turn.ReqID = %q, want req-1", turn.ReqID) + } + + route, ok := ch.routes.Get("chat-1") + if !ok { + t.Fatal("expected persisted route for chat-1") + } + if route.ReqID != "req-1" || route.ChatType != 1 { + t.Fatalf("route = %+v", route) + } + + if len(commands) != 1 { + t.Fatalf("expected 1 opening command, got %d", len(commands)) + } + if commands[0].Cmd != wecomCmdRespondMsg { + t.Fatalf("opening command = %q, want %q", commands[0].Cmd, wecomCmdRespondMsg) + } + if commands[0].Headers.ReqID != "req-1" { + t.Fatalf("opening req_id = %q, want req-1", commands[0].Headers.ReqID) + } +} + +func TestSend_StreamFailureFallsBackToActualChatID(t *testing.T) { + t.Parallel() + + ch := newTestWeComChannel(t, bus.NewMessageBus()) + ch.SetRunning(true) + ch.queueTurn("chat-1", wecomTurn{ + ReqID: "req-1", + ChatID: "chat-1", + ChatType: 1, + StreamID: "stream-1", + CreatedAt: time.Now(), + }) + ch.queueTurn("chat-1", wecomTurn{ + ReqID: "req-2", + ChatID: "chat-1", + ChatType: 1, + StreamID: "stream-2", + CreatedAt: time.Now(), + }) + if err := ch.routes.Put("chat-1", "req-2", 1, time.Hour); err != nil { + t.Fatalf("Put() error = %v", err) + } + + var commands []wecomCommand + ch.commandSend = func(cmd wecomCommand, _ time.Duration) error { + commands = append(commands, cmd) + if len(commands) == 1 && cmd.Cmd == wecomCmdRespondMsg { + return errors.New("stream send failed") + } + return nil + } + + if err := ch.Send(context.Background(), bus.OutboundMessage{ + Channel: "wecom", + ChatID: "chat-1", + Content: "hello", + }); err != nil { + t.Fatalf("Send() error = %v", err) + } + + if len(commands) != 2 { + t.Fatalf("expected 2 commands, got %d", len(commands)) + } + if commands[0].Cmd != wecomCmdRespondMsg || commands[0].Headers.ReqID != "req-1" { + t.Fatalf("first command = %+v", commands[0]) + } + if commands[1].Cmd != wecomCmdSendMsg { + t.Fatalf("second command = %q, want %q", commands[1].Cmd, wecomCmdSendMsg) + } + body, ok := commands[1].Body.(wecomSendMsgBody) + if !ok { + t.Fatalf("unexpected send body type %T", commands[1].Body) + } + if body.ChatID != "chat-1" { + t.Fatalf("send chatid = %q, want chat-1", body.ChatID) + } + if body.ChatType != 1 { + t.Fatalf("send chat_type = %d, want 1", body.ChatType) + } + + nextTurn, ok := ch.getTurn("chat-1") + if !ok { + t.Fatal("expected second turn to remain queued") + } + if nextTurn.ReqID != "req-2" { + t.Fatalf("next queued req_id = %q, want req-2", nextTurn.ReqID) + } +} + +func newTestWeComChannel(t *testing.T, messageBus *bus.MessageBus) *WeComChannel { + t.Helper() + + cfg := config.WeComConfig{BotID: "bot-1"} + cfg.SetSecret("secret-1") + ch, err := NewChannel(cfg, messageBus) + if err != nil { + t.Fatalf("NewChannel() error = %v", err) + } + ch.ctx = context.Background() + ch.routes = newReqIDStore(filepath.Join(t.TempDir(), "reqids.json")) + return ch +} diff --git a/pkg/config/config.go b/pkg/config/config.go index 84e1ab61a..c2815c0db 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -321,10 +321,7 @@ type AgentDefaults struct { ToolFeedback ToolFeedbackConfig `json:"tool_feedback,omitempty"` } -const ( - DefaultMaxMediaSize = 20 * 1024 * 1024 // 20 MB - DefaultWeComAIBotProcessingMessage = "⏳ Processing, please wait. The results will be sent shortly." -) +const DefaultMaxMediaSize = 20 * 1024 * 1024 // 20 MB func (d *AgentDefaults) GetMaxMediaSize() int { if d.MaxMediaSize > 0 { @@ -364,9 +361,7 @@ type ChannelsConfig struct { Matrix MatrixConfig `json:"matrix"` LINE LINEConfig `json:"line"` OneBot OneBotConfig `json:"onebot"` - WeCom WeComConfig `json:"wecom"` - WeComApp WeComAppConfig `json:"wecom_app"` - WeComAIBot WeComAIBotConfig `json:"wecom_aibot"` + WeCom WeComConfig `json:"wecom" envPrefix:"PICOCLAW_CHANNELS_WECOM_"` Weixin WeixinConfig `json:"weixin"` Pico PicoConfig `json:"pico"` PicoClient PicoClientConfig `json:"pico_client"` @@ -678,136 +673,28 @@ func (c *OneBotConfig) SetAccessToken(token string) { c.secDirty = true } +type WeComGroupConfig struct { + AllowFrom FlexibleStringSlice `json:"allow_from,omitempty"` +} + type WeComConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_ENABLED"` - token string - encodingAESKey string - WebhookURL string `json:"webhook_url" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_URL"` - WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_HOST"` - WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_PORT"` - WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_PATH"` - AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_ALLOW_FROM"` - ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_REPLY_TIMEOUT"` - GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` - ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_REASONING_CHANNEL_ID"` - secDirty bool + Enabled bool `json:"enabled" env:"ENABLED"` + BotID string `json:"bot_id" env:"BOT_ID"` + secret string + WebSocketURL string `json:"websocket_url,omitempty" env:"WEBSOCKET_URL"` + SendThinkingMessage bool `json:"send_thinking_message" env:"SEND_THINKING_MESSAGE"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"ALLOW_FROM"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"REASONING_CHANNEL_ID"` + secDirty bool } -// Token returns the WeCom token -func (c *WeComConfig) Token() string { - return c.token -} - -// SetToken sets the WeCom token -func (c *WeComConfig) SetToken(token string) { - c.token = token - c.secDirty = true -} - -// EncodingAESKey returns the WeCom encoding AES key -func (c *WeComConfig) EncodingAESKey() string { - return c.encodingAESKey -} - -// SetEncodingAESKey sets the WeCom encoding AES key -func (c *WeComConfig) SetEncodingAESKey(key string) { - c.encodingAESKey = key - c.secDirty = true -} - -type WeComAppConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_APP_ENABLED"` - CorpID string `json:"corp_id" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_ID"` - corpSecret string - AgentID int64 `json:"agent_id" env:"PICOCLAW_CHANNELS_WECOM_APP_AGENT_ID"` - token string - encodingAESKey string - WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_HOST"` - WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_PORT"` - WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_PATH"` - AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_APP_ALLOW_FROM"` - ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_APP_REPLY_TIMEOUT"` - GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` - ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_APP_REASONING_CHANNEL_ID"` - secDirty bool -} - -// CorpSecret returns the corporate secret for WeCom app -func (c *WeComAppConfig) CorpSecret() string { - return c.corpSecret -} - -// SetCorpSecret sets the corporate secret for WeCom app -func (c *WeComAppConfig) SetCorpSecret(secret string) { - c.corpSecret = secret - c.secDirty = true -} - -// Token returns the webhook token for WeCom app -func (c *WeComAppConfig) Token() string { - return c.token -} - -// SetToken sets the webhook token for WeCom app -func (c *WeComAppConfig) SetToken(token string) { - c.token = token - c.secDirty = true -} - -// EncodingAESKey returns the encoding AES key for WeCom app -func (c *WeComAppConfig) EncodingAESKey() string { - return c.encodingAESKey -} - -// SetEncodingAESKey sets the encoding AES key for WeCom app -func (c *WeComAppConfig) SetEncodingAESKey(key string) { - c.encodingAESKey = key - c.secDirty = true -} - -type WeComAIBotConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENABLED"` - BotID string `json:"bot_id,omitempty" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_BOT_ID"` - secret string - token string - encodingAESKey string - WebhookPath string `json:"webhook_path,omitempty" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_WEBHOOK_PATH"` - AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ALLOW_FROM"` - ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REPLY_TIMEOUT"` - MaxSteps int `json:"max_steps" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_MAX_STEPS"` // Maximum streaming steps - WelcomeMessage string `json:"welcome_message" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_WELCOME_MESSAGE"` // Sent on enter_chat event; empty = no welcome - ProcessingMessage string `json:"processing_message,omitempty" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_PROCESSING_MESSAGE"` - ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REASONING_CHANNEL_ID"` - secDirty bool -} - -// Token returns the webhook token for WeCom AI bot -func (c *WeComAIBotConfig) Token() string { - return c.token -} - -// EncodingAESKey returns the encoding AES key for WeCom AI bot -func (c *WeComAIBotConfig) EncodingAESKey() string { - return c.encodingAESKey -} - -// SetToken sets the token for WeCom AI bot -func (c *WeComAIBotConfig) SetToken(token string) { - c.token = token - c.secDirty = true -} - -// SetEncodingAESKey sets the encoding AES key for WeCom AI bot -func (c *WeComAIBotConfig) SetEncodingAESKey(key string) { - c.encodingAESKey = key - c.secDirty = true -} - -func (c *WeComAIBotConfig) Secret() string { +// Secret returns the WeCom bot secret. +func (c *WeComConfig) Secret() string { return c.secret } -func (c *WeComAIBotConfig) SetSecret(secret string) { +// SetSecret sets the WeCom bot secret. +func (c *WeComConfig) SetSecret(secret string) { c.secret = secret c.secDirty = true } @@ -1623,39 +1510,10 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error { cfg.Channels.OneBot.accessToken = sec.Channels.OneBot.AccessToken } - // Handle WeCom token and encoding key + // Handle WeCom bot secret if sec.Channels.WeCom != nil { - if sec.Channels.WeCom.Token != "" { - cfg.Channels.WeCom.token = sec.Channels.WeCom.Token - } - if sec.Channels.WeCom.EncodingAESKey != "" { - cfg.Channels.WeCom.encodingAESKey = sec.Channels.WeCom.EncodingAESKey - } - } - - // Handle WeCom App credentials - if sec.Channels.WeComApp != nil { - if sec.Channels.WeComApp.CorpSecret != "" { - cfg.Channels.WeComApp.corpSecret = sec.Channels.WeComApp.CorpSecret - } - if sec.Channels.WeComApp.Token != "" { - cfg.Channels.WeComApp.token = sec.Channels.WeComApp.Token - } - if sec.Channels.WeComApp.EncodingAESKey != "" { - cfg.Channels.WeComApp.encodingAESKey = sec.Channels.WeComApp.EncodingAESKey - } - } - - // Handle WeCom AI Bot credentials - if sec.Channels.WeComAIBot != nil { - if sec.Channels.WeComAIBot.Token != "" { - cfg.Channels.WeComAIBot.token = sec.Channels.WeComAIBot.Token - } - if sec.Channels.WeComAIBot.EncodingAESKey != "" { - cfg.Channels.WeComAIBot.encodingAESKey = sec.Channels.WeComAIBot.EncodingAESKey - } - if sec.Channels.WeComAIBot.Secret != "" { - cfg.Channels.WeComAIBot.secret = sec.Channels.WeComAIBot.Secret + if sec.Channels.WeCom.Secret != "" { + cfg.Channels.WeCom.secret = sec.Channels.WeCom.Secret } } @@ -1879,27 +1737,10 @@ func SaveConfig(path string, cfg *Config) error { } if cfg.Channels.WeCom.secDirty { cfg.security.Channels.WeCom = &WeComSecurity{ - Token: cfg.Channels.WeCom.Token(), - EncodingAESKey: cfg.Channels.WeCom.EncodingAESKey(), + Secret: cfg.Channels.WeCom.Secret(), } cfg.Channels.WeCom.secDirty = false } - if cfg.Channels.WeComApp.secDirty { - cfg.security.Channels.WeComApp = &WeComAppSecurity{ - CorpSecret: cfg.Channels.WeComApp.CorpSecret(), - Token: cfg.Channels.WeComApp.Token(), - EncodingAESKey: cfg.Channels.WeComApp.EncodingAESKey(), - } - cfg.Channels.WeComApp.secDirty = false - } - if cfg.Channels.WeComAIBot.secDirty { - cfg.security.Channels.WeComAIBot = &WeComAIBotSecurity{ - Token: cfg.Channels.WeComAIBot.Token(), - EncodingAESKey: cfg.Channels.WeComAIBot.EncodingAESKey(), - Secret: cfg.Channels.WeComAIBot.Secret(), - } - cfg.Channels.WeComAIBot.secDirty = false - } if cfg.Tools.Web.Brave.secDirty { cfg.security.Web.Brave = &BraveSecurity{ APIKeys: cfg.Tools.Web.Brave.APIKeys(), diff --git a/pkg/config/config_old.go b/pkg/config/config_old.go index 01909f5a9..44c9435d1 100644 --- a/pkg/config/config_old.go +++ b/pkg/config/config_old.go @@ -85,23 +85,21 @@ type toolsConfigV0 struct { } type channelsConfigV0 struct { - WhatsApp WhatsAppConfig `json:"whatsapp"` - Telegram telegramConfigV0 `json:"telegram"` - Feishu feishuConfigV0 `json:"feishu"` - Discord discordConfigV0 `json:"discord"` - MaixCam maixcamConfigV0 `json:"maixcam"` - Weixin weixinConfigV0 `json:"weixin"` - QQ qqConfigV0 `json:"qq"` - DingTalk dingtalkConfigV0 `json:"dingtalk"` - Slack slackConfigV0 `json:"slack"` - Matrix matrixConfigV0 `json:"matrix"` - LINE lineConfigV0 `json:"line"` - OneBot onebotConfigV0 `json:"onebot"` - WeCom wecomConfigV0 `json:"wecom"` - WeComApp wecomappConfigV0 `json:"wecom_app"` - WeComAIBot wecomaibotConfigV0 `json:"wecom_aibot"` - Pico picoConfigV0 `json:"pico"` - IRC ircConfigV0 `json:"irc"` + WhatsApp WhatsAppConfig `json:"whatsapp"` + Telegram telegramConfigV0 `json:"telegram"` + Feishu feishuConfigV0 `json:"feishu"` + Discord discordConfigV0 `json:"discord"` + MaixCam maixcamConfigV0 `json:"maixcam"` + Weixin weixinConfigV0 `json:"weixin"` + QQ qqConfigV0 `json:"qq"` + DingTalk dingtalkConfigV0 `json:"dingtalk"` + Slack slackConfigV0 `json:"slack"` + Matrix matrixConfigV0 `json:"matrix"` + LINE lineConfigV0 `json:"line"` + OneBot onebotConfigV0 `json:"onebot"` + WeCom wecomConfigV0 `json:"wecom" envPrefix:"PICOCLAW_CHANNELS_WECOM_"` + Pico picoConfigV0 `json:"pico"` + IRC ircConfigV0 `json:"irc"` } func (v *channelsConfigV0) ToChannelsConfig() (ChannelsConfig, ChannelsSecurity) { @@ -117,45 +115,39 @@ func (v *channelsConfigV0) ToChannelsConfig() (ChannelsConfig, ChannelsSecurity) line, lineSecurity := v.LINE.ToLINEConfig() onebot, onebotSecurity := v.OneBot.ToOneBotConfig() wecom, wecomSecurity := v.WeCom.ToWeComConfig() - wecomapp, wecomappSecurity := v.WeComApp.ToWeComAppConfig() - wecomaibot, wecomaibotSecurity := v.WeComAIBot.ToWeComAIBotConfig() pico, picoSecurity := v.Pico.ToPicoConfig() irc, ircSecurity := v.IRC.ToIRCConfig() return ChannelsConfig{ - WhatsApp: v.WhatsApp, - Telegram: telegram, - Feishu: feishu, - Discord: discord, - MaixCam: maixcam, - QQ: qq, - Weixin: weixin, - DingTalk: dingtalk, - Slack: slack, - Matrix: matrix, - LINE: line, - OneBot: onebot, - WeCom: wecom, - WeComApp: wecomapp, - WeComAIBot: wecomaibot, - Pico: pico, - IRC: irc, + WhatsApp: v.WhatsApp, + Telegram: telegram, + Feishu: feishu, + Discord: discord, + MaixCam: maixcam, + QQ: qq, + Weixin: weixin, + DingTalk: dingtalk, + Slack: slack, + Matrix: matrix, + LINE: line, + OneBot: onebot, + WeCom: wecom, + Pico: pico, + IRC: irc, }, ChannelsSecurity{ - Telegram: telegramSecurity, - Feishu: feishuSecurity, - Discord: discordSecurity, - QQ: qqSecurity, - Weixin: weixinSecurity, - DingTalk: dingtalkSecurity, - Slack: slackSecurity, - Matrix: matrixSecurity, - LINE: lineSecurity, - OneBot: onebotSecurity, - WeCom: wecomSecurity, - WeComApp: wecomappSecurity, - WeComAIBot: wecomaibotSecurity, - Pico: picoSecurity, - IRC: ircSecurity, + Telegram: telegramSecurity, + Feishu: feishuSecurity, + Discord: discordSecurity, + QQ: qqSecurity, + Weixin: weixinSecurity, + DingTalk: dingtalkSecurity, + Slack: slackSecurity, + Matrix: matrixSecurity, + LINE: lineSecurity, + OneBot: onebotSecurity, + WeCom: wecomSecurity, + Pico: picoSecurity, + IRC: ircSecurity, } } @@ -473,39 +465,32 @@ func (v *onebotConfigV0) ToOneBotConfig() (OneBotConfig, *OneBotSecurity) { } type wecomConfigV0 struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_ENABLED"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_TOKEN"` - EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_ENCODING_AES_KEY"` - WebhookURL string `json:"webhook_url" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_URL"` - WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_HOST"` - WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_PORT"` - WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_WEBHOOK_PATH"` - AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_ALLOW_FROM"` - ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_REPLY_TIMEOUT"` - GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` - ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_REASONING_CHANNEL_ID"` + Enabled bool `json:"enabled" env:"ENABLED"` + BotID string `json:"bot_id" env:"BOT_ID"` + Secret string `json:"secret" env:"SECRET"` + WebSocketURL string `json:"websocket_url,omitempty" env:"WEBSOCKET_URL"` + SendThinkingMessage bool `json:"send_thinking_message" env:"SEND_THINKING_MESSAGE"` + DMPolicy string `json:"dm_policy,omitempty" env:"DM_POLICY"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"ALLOW_FROM"` + GroupPolicy string `json:"group_policy,omitempty" env:"GROUP_POLICY"` + GroupAllowFrom FlexibleStringSlice `json:"group_allow_from,omitempty" env:"GROUP_ALLOW_FROM"` + Groups map[string]WeComGroupConfig `json:"groups,omitempty"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"REASONING_CHANNEL_ID"` } func (v *wecomConfigV0) ToWeComConfig() (WeComConfig, *WeComSecurity) { var sec *WeComSecurity - if v.Token != "" || v.EncodingAESKey != "" { - sec = &WeComSecurity{ - Token: v.Token, - EncodingAESKey: v.EncodingAESKey, - } + if v.Secret != "" { + sec = &WeComSecurity{Secret: v.Secret} } return WeComConfig{ - Enabled: v.Enabled, - token: v.Token, - encodingAESKey: v.EncodingAESKey, - WebhookURL: v.WebhookURL, - WebhookHost: v.WebhookHost, - WebhookPort: v.WebhookPort, - WebhookPath: v.WebhookPath, - AllowFrom: v.AllowFrom, - ReplyTimeout: v.ReplyTimeout, - GroupTrigger: v.GroupTrigger, - ReasoningChannelID: v.ReasoningChannelID, + Enabled: v.Enabled, + BotID: v.BotID, + secret: v.Secret, + WebSocketURL: v.WebSocketURL, + SendThinkingMessage: v.SendThinkingMessage, + AllowFrom: v.AllowFrom, + ReasoningChannelID: v.ReasoningChannelID, }, sec } @@ -537,81 +522,6 @@ func (v *weixinConfigV0) ToWeiXinConfig() (WeixinConfig, *WeixinSecurity) { }, sec } -type wecomappConfigV0 struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_APP_ENABLED"` - CorpID string `json:"corp_id" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_ID"` - CorpSecret string `json:"corp_secret" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_SECRET"` - AgentID int64 `json:"agent_id" env:"PICOCLAW_CHANNELS_WECOM_APP_AGENT_ID"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_APP_TOKEN"` - EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_APP_ENCODING_AES_KEY"` - WebhookHost string `json:"webhook_host" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_HOST"` - WebhookPort int `json:"webhook_port" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_PORT"` - WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_APP_WEBHOOK_PATH"` - AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_APP_ALLOW_FROM"` - ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_APP_REPLY_TIMEOUT"` - GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` - ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_APP_REASONING_CHANNEL_ID"` -} - -func (v *wecomappConfigV0) ToWeComAppConfig() (WeComAppConfig, *WeComAppSecurity) { - var sec *WeComAppSecurity - if v.CorpSecret != "" || v.Token != "" || v.EncodingAESKey != "" { - sec = &WeComAppSecurity{ - CorpSecret: v.CorpSecret, - Token: v.Token, - EncodingAESKey: v.EncodingAESKey, - } - } - return WeComAppConfig{ - Enabled: v.Enabled, - CorpID: v.CorpID, - corpSecret: v.CorpSecret, - AgentID: v.AgentID, - token: v.Token, - encodingAESKey: v.EncodingAESKey, - WebhookHost: v.WebhookHost, - WebhookPort: v.WebhookPort, - WebhookPath: v.WebhookPath, - AllowFrom: v.AllowFrom, - ReplyTimeout: v.ReplyTimeout, - GroupTrigger: v.GroupTrigger, - ReasoningChannelID: v.ReasoningChannelID, - }, sec -} - -type wecomaibotConfigV0 struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENABLED"` - Token string `json:"token" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_TOKEN"` - Secret string `json:"secret" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_SECRET"` - EncodingAESKey string `json:"encoding_aes_key" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENCODING_AES_KEY"` - WebhookPath string `json:"webhook_path" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_WEBHOOK_PATH"` - AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ALLOW_FROM"` - ReplyTimeout int `json:"reply_timeout" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REPLY_TIMEOUT"` - MaxSteps int `json:"max_steps" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_MAX_STEPS"` - WelcomeMessage string `json:"welcome_message" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_WELCOME_MESSAGE"` - ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REASONING_CHANNEL_ID"` -} - -func (v *wecomaibotConfigV0) ToWeComAIBotConfig() (WeComAIBotConfig, *WeComAIBotSecurity) { - var sec *WeComAIBotSecurity - if v.Token != "" || v.Secret != "" || v.EncodingAESKey != "" { - sec = &WeComAIBotSecurity{ - Token: v.Token, - Secret: v.Secret, - EncodingAESKey: v.EncodingAESKey, - } - } - return WeComAIBotConfig{ - Enabled: v.Enabled, - WebhookPath: v.WebhookPath, - AllowFrom: v.AllowFrom, - ReplyTimeout: v.ReplyTimeout, - MaxSteps: v.MaxSteps, - WelcomeMessage: v.WelcomeMessage, - ReasoningChannelID: v.ReasoningChannelID, - }, sec -} - type picoConfigV0 struct { Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_PICO_ENABLED"` Token string `json:"token" env:"PICOCLAW_CHANNELS_PICO_TOKEN"` diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index b356d474f..2fa5d2195 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -1372,8 +1372,7 @@ func TestFilterSensitiveData_AllTokenTypes(t *testing.T) { Feishu: &FeishuSecurity{AppSecret: "feishu-app-secret-123", EncryptKey: "feishu-encrypt-key"}, DingTalk: &DingTalkSecurity{ClientSecret: "dingtalk-client-secret"}, OneBot: &OneBotSecurity{AccessToken: "onebot-access-token"}, - WeCom: &WeComSecurity{Token: "wecom-token", EncodingAESKey: "wecom-aes-key"}, - WeComApp: &WeComAppSecurity{CorpSecret: "wecom-app-secret", Token: "wecom-app-token"}, + WeCom: &WeComSecurity{Secret: "wecom-secret"}, Pico: &PicoSecurity{Token: "pico-token-abc123"}, IRC: &IRCSecurity{ Password: "irc-password", diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index c1d0ea0f6..b5d73977d 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -129,32 +129,11 @@ func DefaultConfig() *Config { AllowFrom: FlexibleStringSlice{}, }, WeCom: WeComConfig{ - Enabled: false, - WebhookURL: "", - WebhookHost: "0.0.0.0", - WebhookPort: 18793, - WebhookPath: "/webhook/wecom", - AllowFrom: FlexibleStringSlice{}, - ReplyTimeout: 5, - }, - WeComApp: WeComAppConfig{ - Enabled: false, - CorpID: "", - AgentID: 0, - WebhookHost: "0.0.0.0", - WebhookPort: 18792, - WebhookPath: "/webhook/wecom-app", - AllowFrom: FlexibleStringSlice{}, - ReplyTimeout: 5, - }, - WeComAIBot: WeComAIBotConfig{ - Enabled: false, - WebhookPath: "/webhook/wecom-aibot", - AllowFrom: FlexibleStringSlice{}, - ReplyTimeout: 5, - MaxSteps: 10, - WelcomeMessage: "Hello! I'm your AI assistant. How can I help you today?", - ProcessingMessage: DefaultWeComAIBotProcessingMessage, + Enabled: false, + BotID: "", + WebSocketURL: "wss://openws.work.weixin.qq.com", + SendThinkingMessage: true, + AllowFrom: FlexibleStringSlice{}, }, Weixin: WeixinConfig{ Enabled: false, diff --git a/pkg/config/security.go b/pkg/config/security.go index da989ca88..72f0c013f 100644 --- a/pkg/config/security.go +++ b/pkg/config/security.go @@ -69,21 +69,19 @@ type ModelSecurityEntry struct { // ChannelsSecurity stores channel-related security data type ChannelsSecurity struct { - Telegram *TelegramSecurity `yaml:"telegram,omitempty"` - Feishu *FeishuSecurity `yaml:"feishu,omitempty"` - Discord *DiscordSecurity `yaml:"discord,omitempty"` - Weixin *WeixinSecurity `yaml:"weixin,omitempty"` - QQ *QQSecurity `yaml:"qq,omitempty"` - DingTalk *DingTalkSecurity `yaml:"dingtalk,omitempty"` - Slack *SlackSecurity `yaml:"slack,omitempty"` - Matrix *MatrixSecurity `yaml:"matrix,omitempty"` - LINE *LINESecurity `yaml:"line,omitempty"` - OneBot *OneBotSecurity `yaml:"onebot,omitempty"` - WeCom *WeComSecurity `yaml:"wecom,omitempty"` - WeComApp *WeComAppSecurity `yaml:"wecom_app,omitempty"` - WeComAIBot *WeComAIBotSecurity `yaml:"wecom_aibot,omitempty"` - Pico *PicoSecurity `yaml:"pico,omitempty"` - IRC *IRCSecurity `yaml:"irc,omitempty"` + Telegram *TelegramSecurity `yaml:"telegram,omitempty"` + Feishu *FeishuSecurity `yaml:"feishu,omitempty"` + Discord *DiscordSecurity `yaml:"discord,omitempty"` + Weixin *WeixinSecurity `yaml:"weixin,omitempty"` + QQ *QQSecurity `yaml:"qq,omitempty"` + DingTalk *DingTalkSecurity `yaml:"dingtalk,omitempty"` + Slack *SlackSecurity `yaml:"slack,omitempty"` + Matrix *MatrixSecurity `yaml:"matrix,omitempty"` + LINE *LINESecurity `yaml:"line,omitempty"` + OneBot *OneBotSecurity `yaml:"onebot,omitempty"` + WeCom *WeComSecurity `yaml:"wecom,omitempty"` + Pico *PicoSecurity `yaml:"pico,omitempty"` + IRC *IRCSecurity `yaml:"irc,omitempty"` } type TelegramSecurity struct { @@ -131,20 +129,7 @@ type OneBotSecurity struct { } type WeComSecurity struct { - Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_WECOM_TOKEN"` - EncodingAESKey string `yaml:"encoding_aes_key,omitempty" env:"PICOCLAW_CHANNELS_WECOM_ENCODING_AES_KEY"` -} - -type WeComAppSecurity struct { - CorpSecret string `yaml:"corp_secret,omitempty" env:"PICOCLAW_CHANNELS_WECOM_APP_CORP_SECRET"` - Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_WECOM_APP_TOKEN"` - EncodingAESKey string `yaml:"encoding_aes_key,omitempty" env:"PICOCLAW_CHANNELS_WECOM_APP_ENCODING_AES_KEY"` -} - -type WeComAIBotSecurity struct { - Secret string `yaml:"secret,omitempty" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_SECRET"` - Token string `yaml:"token,omitempty" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_TOKEN"` - EncodingAESKey string `yaml:"encoding_aes_key,omitempty" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_ENCODING_AES_KEY"` + Secret string `yaml:"secret,omitempty" env:"PICOCLAW_CHANNELS_WECOM_SECRET"` } type PicoSecurity struct { diff --git a/pkg/config/security_integration_test.go b/pkg/config/security_integration_test.go index 218914590..03990ce5b 100644 --- a/pkg/config/security_integration_test.go +++ b/pkg/config/security_integration_test.go @@ -240,15 +240,7 @@ func TestAllSecurityKeysAccessible(t *testing.T) { }, "wecom": { "enabled": true, - "webhook_url": "https://qyapi.weixin.qq.com/cgi-bin/webhook" - }, - "wecom_app": { - "enabled": true, - "corp_id": "test_corp_id", - "agent_id": 123456 - }, - "wecom_aibot": { - "enabled": true + "bot_id": "test_wecom_bot_id" }, "pico": { "enabled": true @@ -315,15 +307,7 @@ channels: onebot: access_token: "onebot_test_access_token" wecom: - token: "wecom_test_webhook_token" - encoding_aes_key: "wecom_test_aes_key" - wecom_app: - corp_secret: "wecom_app_test_corp_secret" - token: "wecom_app_test_token" - encoding_aes_key: "wecom_app_test_aes_key" - wecom_aibot: - token: "wecom_aibot_test_token" - encoding_aes_key: "wecom_aibot_test_aes_key" + secret: "wecom_test_secret" pico: token: "pico_test_token" irc: @@ -409,24 +393,10 @@ skills: t.Logf("OneBot AccessToken(): %s", cfg.Channels.OneBot.AccessToken()) // WeCom - assert.Equal(t, "wecom_test_webhook_token", cfg.Channels.WeCom.Token()) - assert.Equal(t, "wecom_test_aes_key", cfg.Channels.WeCom.EncodingAESKey()) - t.Logf("WeCom Token(): %s", cfg.Channels.WeCom.Token()) - t.Logf("WeCom EncodingAESKey(): %s", cfg.Channels.WeCom.EncodingAESKey()) - - // WeCom App - assert.Equal(t, "wecom_app_test_corp_secret", cfg.Channels.WeComApp.CorpSecret()) - assert.Equal(t, "wecom_app_test_token", cfg.Channels.WeComApp.Token()) - assert.Equal(t, "wecom_app_test_aes_key", cfg.Channels.WeComApp.EncodingAESKey()) - t.Logf("WeComApp CorpSecret(): %s", cfg.Channels.WeComApp.CorpSecret()) - t.Logf("WeComApp Token(): %s", cfg.Channels.WeComApp.Token()) - t.Logf("WeComApp EncodingAESKey(): %s", cfg.Channels.WeComApp.EncodingAESKey()) - - // WeCom AI Bot - assert.Equal(t, "wecom_aibot_test_token", cfg.Channels.WeComAIBot.Token()) - assert.Equal(t, "wecom_aibot_test_aes_key", cfg.Channels.WeComAIBot.EncodingAESKey()) - t.Logf("WeComAIBot Token(): %s", cfg.Channels.WeComAIBot.Token()) - t.Logf("WeComAIBot EncodingAESKey(): %s", cfg.Channels.WeComAIBot.EncodingAESKey()) + assert.Equal(t, "test_wecom_bot_id", cfg.Channels.WeCom.BotID) + assert.Equal(t, "wecom_test_secret", cfg.Channels.WeCom.Secret()) + t.Logf("WeCom BotID: %s", cfg.Channels.WeCom.BotID) + t.Logf("WeCom Secret(): %s", cfg.Channels.WeCom.Secret()) // Pico assert.Equal(t, "pico_test_token", cfg.Channels.Pico.Token()) diff --git a/pkg/migrate/sources/openclaw/common.go b/pkg/migrate/sources/openclaw/common.go index 337c950d0..938f15b80 100644 --- a/pkg/migrate/sources/openclaw/common.go +++ b/pkg/migrate/sources/openclaw/common.go @@ -13,17 +13,16 @@ var migrateableDirs = []string{ } var supportedChannels = map[string]bool{ - "whatsapp": true, - "telegram": true, - "feishu": true, - "discord": true, - "maixcam": true, - "qq": true, - "dingtalk": true, - "slack": true, - "matrix": true, - "line": true, - "onebot": true, - "wecom": true, - "wecom_app": true, + "whatsapp": true, + "telegram": true, + "feishu": true, + "discord": true, + "maixcam": true, + "qq": true, + "dingtalk": true, + "slack": true, + "matrix": true, + "line": true, + "onebot": true, + "wecom": true, } diff --git a/web/backend/api/channels.go b/web/backend/api/channels.go index 21624d3ef..dd4c9af3d 100644 --- a/web/backend/api/channels.go +++ b/web/backend/api/channels.go @@ -22,8 +22,6 @@ var channelCatalog = []channelCatalogItem{ {Name: "qq", ConfigKey: "qq"}, {Name: "onebot", ConfigKey: "onebot"}, {Name: "wecom", ConfigKey: "wecom"}, - {Name: "wecom_app", ConfigKey: "wecom_app"}, - {Name: "wecom_aibot", ConfigKey: "wecom_aibot"}, {Name: "whatsapp", ConfigKey: "whatsapp", Variant: "bridge"}, {Name: "whatsapp_native", ConfigKey: "whatsapp", Variant: "native"}, {Name: "pico", ConfigKey: "pico"}, diff --git a/web/backend/api/config.go b/web/backend/api/config.go index e67e3e6d7..5a7f3cebc 100644 --- a/web/backend/api/config.go +++ b/web/backend/api/config.go @@ -209,6 +209,15 @@ func validateConfig(cfg *config.Config) []string { errs = append(errs, "channels.discord.token is required when discord channel is enabled") } + if cfg.Channels.WeCom.Enabled { + if cfg.Channels.WeCom.BotID == "" { + errs = append(errs, "channels.wecom.bot_id is required when wecom channel is enabled") + } + if cfg.Channels.WeCom.Secret() == "" { + errs = append(errs, "channels.wecom.secret is required when wecom channel is enabled") + } + } + if cfg.Tools.Exec.Enabled { if cfg.Tools.Exec.EnableDenyPatterns { errs = append( diff --git a/web/frontend/src/components/channels/channel-config-page.tsx b/web/frontend/src/components/channels/channel-config-page.tsx index 4996a6314..e621da70c 100644 --- a/web/frontend/src/components/channels/channel-config-page.tsx +++ b/web/frontend/src/components/channels/channel-config-page.tsx @@ -146,13 +146,7 @@ function isConfigured( case "weixin": return asString(config.account_id) !== "" case "wecom": - return asString(config.token) !== "" - case "wecom_app": - return ( - asString(config.corp_id) !== "" && asString(config.corp_secret) !== "" - ) - case "wecom_aibot": - return asString(config.token) !== "" + return asString(config.bot_id) !== "" case "whatsapp": return asString(config.bridge_url) !== "" case "whatsapp_native": @@ -193,11 +187,7 @@ function getRequiredFieldKeys(channelName: string): string[] { case "onebot": return ["ws_url"] case "wecom": - return ["token"] - case "wecom_app": - return ["corp_id", "corp_secret"] - case "wecom_aibot": - return ["token"] + return ["bot_id", "secret"] case "whatsapp": return ["bridge_url"] case "pico": diff --git a/web/frontend/src/components/channels/channel-forms/generic-form.tsx b/web/frontend/src/components/channels/channel-forms/generic-form.tsx index db14fc206..1a872542b 100644 --- a/web/frontend/src/components/channels/channel-forms/generic-form.tsx +++ b/web/frontend/src/components/channels/channel-forms/generic-form.tsx @@ -28,6 +28,7 @@ const SECRET_FIELDS = new Set([ "encoding_aes_key", "encrypt_key", "verification_token", + "secret", "password", "nickserv_password", "sasl_password", @@ -44,6 +45,7 @@ const OBJECT_FIELDS = new Set([ "allow_token_query", "allow_from", "allow_origins", + "groups", ]) function formatLabel(key: string): string { @@ -118,6 +120,14 @@ export function GenericForm({ app_id: t("channels.form.desc.appId"), client_id: t("channels.form.desc.clientId"), corp_id: t("channels.form.desc.corpId"), + bot_id: t("channels.form.desc.appId"), + websocket_url: t("channels.form.desc.wsUrl"), + dm_policy: t("channels.form.desc.genericField", { field: "DM policy" }), + group_policy: t("channels.form.desc.genericField", { field: "group policy" }), + group_allow_from: t("channels.form.desc.allowFrom"), + send_thinking_message: t("channels.form.desc.genericField", { + field: "thinking message behavior", + }), agent_id: t("channels.form.desc.agentId"), webhook_url: t("channels.form.desc.webhookUrl"), webhook_host: t("channels.form.desc.webhookHost"), diff --git a/web/frontend/src/hooks/use-sidebar-channels.ts b/web/frontend/src/hooks/use-sidebar-channels.ts index 5579a955b..be35f1a94 100644 --- a/web/frontend/src/hooks/use-sidebar-channels.ts +++ b/web/frontend/src/hooks/use-sidebar-channels.ts @@ -35,8 +35,6 @@ const CHANNEL_IMPORTANCE_ORDER = [ "slack", "line", "wecom", - "wecom_app", - "wecom_aibot", "dingtalk", "qq", "onebot", @@ -76,8 +74,6 @@ const CHANNEL_ICON_MAP: Record< line: IconBrandLine, qq: IconBrandQq, wecom: IconBrandWechat, - wecom_app: IconBrandWechat, - wecom_aibot: IconBrandWechat, whatsapp: IconBrandWhatsapp, whatsapp_native: IconBrandWhatsapp, matrix: IconBrandMatrix, diff --git a/web/frontend/src/i18n/locales/en.json b/web/frontend/src/i18n/locales/en.json index 0b0afa39d..207385aa1 100644 --- a/web/frontend/src/i18n/locales/en.json +++ b/web/frontend/src/i18n/locales/en.json @@ -233,8 +233,6 @@ "qq": "QQ", "onebot": "OneBot", "wecom": "WeCom", - "wecom_app": "WeCom App", - "wecom_aibot": "WeCom AI Bot", "whatsapp": "WhatsApp", "whatsapp_native": "WhatsApp Native", "pico": "Web", diff --git a/web/frontend/src/i18n/locales/zh.json b/web/frontend/src/i18n/locales/zh.json index e85e4dd44..8d452bac4 100644 --- a/web/frontend/src/i18n/locales/zh.json +++ b/web/frontend/src/i18n/locales/zh.json @@ -233,8 +233,6 @@ "qq": "QQ", "onebot": "OneBot", "wecom": "企业微信", - "wecom_app": "企业微信应用", - "wecom_aibot": "企业微信 AI 机器人", "whatsapp": "WhatsApp", "whatsapp_native": "WhatsApp Native", "pico": "Web", From b0bcf1d3c9258507decb92a3eec1551d9a92faa4 Mon Sep 17 00:00:00 2001 From: Hoshina Date: Tue, 24 Mar 2026 15:04:14 +0800 Subject: [PATCH 069/202] docs(wecom): update examples and docs --- config/config.example.json | 34 ++++------------------------ pkg/channels/README.md | 7 +++--- pkg/channels/README.zh.md | 7 +++--- pkg/config/SECURITY_CONFIG.md | 8 +------ pkg/config/example_security_usage.go | 8 +------ 5 files changed, 12 insertions(+), 52 deletions(-) diff --git a/config/config.example.json b/config/config.example.json index 88578701a..54d387548 100644 --- a/config/config.example.json +++ b/config/config.example.json @@ -182,39 +182,13 @@ "reasoning_channel_id": "" }, "wecom": { - "_comment": "WeCom Bot - Easier setup, supports group chats", - "enabled": false, - "token": "YOUR_TOKEN", - "encoding_aes_key": "YOUR_43_CHAR_ENCODING_AES_KEY", - "webhook_url": "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=YOUR_KEY", - "webhook_path": "/webhook/wecom", - "allow_from": [], - "reply_timeout": 5, - "reasoning_channel_id": "" - }, - "wecom_app": { - "_comment": "WeCom App (自建应用) - More features, proactive messaging, private chat only.", - "enabled": false, - "corp_id": "YOUR_CORP_ID", - "corp_secret": "YOUR_CORP_SECRET", - "agent_id": 1000002, - "token": "YOUR_TOKEN", - "encoding_aes_key": "YOUR_43_CHAR_ENCODING_AES_KEY", - "webhook_path": "/webhook/wecom-app", - "allow_from": [], - "reply_timeout": 5, - "reasoning_channel_id": "" - }, - "wecom_aibot": { - "_comment": "WeCom AI Bot (智能机器人) - Official WeCom AI Bot integration, supports proactive messaging and private chats.", + "_comment": "WeCom AI Bot over WebSocket.", "enabled": false, "bot_id": "YOUR_BOT_ID", "secret": "YOUR_SECRET", - "token": "YOUR_TOKEN", - "encoding_aes_key": "YOUR_43_CHAR_ENCODING_AES_KEY", - "webhook_path": "/webhook/wecom-aibot", - "max_steps": 10, - "welcome_message": "Hello! I'm your AI assistant. How can I help you today?", + "websocket_url": "wss://openws.work.weixin.qq.com", + "send_thinking_message": true, + "allow_from": [], "reasoning_channel_id": "" }, "pico": { diff --git a/pkg/channels/README.md b/pkg/channels/README.md index b7c56660b..7f238ece5 100644 --- a/pkg/channels/README.md +++ b/pkg/channels/README.md @@ -1255,8 +1255,7 @@ make test # Full test suite | `pkg/channels/onebot/` | `"onebot"` | ReactionCapable, MediaSender | | `pkg/channels/dingtalk/` | `"dingtalk"` | — | | `pkg/channels/feishu/` | `"feishu"` | — (architecture-specific build tags: `feishu_32.go` / `feishu_64.go`) | -| `pkg/channels/wecom/` | `"wecom"` | WebhookHandler, HealthChecker | -| `pkg/channels/wecom/` | `"wecom_app"` | MediaSender, WebhookHandler, HealthChecker | +| `pkg/channels/wecom/` | `"wecom"` | MediaSender | | `pkg/channels/qq/` | `"qq"` | — | | `pkg/channels/whatsapp/` | `"whatsapp"` | — (Bridge mode) | | `pkg/channels/whatsapp_native/` | `"whatsapp_native"` | — (Native whatsmeow mode) | @@ -1371,7 +1370,7 @@ agentLoop.Stop() // Stop Agent 2. **Feishu architecture-specific compilation**: The Feishu channel uses build tags to distinguish 32-bit and 64-bit architectures (`feishu_32.go` / `feishu_64.go`). Feishu uses the SDK's WebSocket mode (not HTTP webhook), so it does not implement `WebhookHandler`. -3. **WeCom has two factories**: `"wecom"` (Bot mode, webhook only) and `"wecom_app"` (App mode, supports MediaSender) are registered separately. Both implement `WebhookHandler` and `HealthChecker`. +3. **WeCom is now a single channel**: `"wecom"` is implemented as a WebSocket-based AI Bot channel with route persistence. Access control uses the shared channel allowlist mechanism. It no longer exposes the legacy webhook/app split. 4. **Pico Protocol**: `pkg/channels/pico/` implements a custom PicoClaw native protocol channel that receives messages via WebSocket webhook (`/pico/ws`). @@ -1381,4 +1380,4 @@ agentLoop.Stop() // Stop Agent 7. **PlaceholderConfig vs implementation**: `PlaceholderConfig` appears in 6 channel configs (Telegram, Discord, Slack, LINE, OneBot, Pico), but only channels that implement both `PlaceholderCapable` + `MessageEditor` (Telegram, Discord, Pico) can actually use placeholder message editing. The rest are reserved fields. -8. **ReasoningChannelID**: Most channel configs include a `reasoning_channel_id` field to route LLM reasoning/thinking output to a designated channel (WhatsApp, Telegram, Feishu, Discord, MaixCam, QQ, DingTalk, Slack, LINE, OneBot, WeCom, WeComApp). Note: `PicoConfig` does not currently expose this field. `BaseChannel` exposes this via the `WithReasoningChannelID` option and `ReasoningChannelID()` method. \ No newline at end of file +8. **ReasoningChannelID**: Most channel configs include a `reasoning_channel_id` field to route LLM reasoning/thinking output to a designated channel (WhatsApp, Telegram, Feishu, Discord, MaixCam, QQ, DingTalk, Slack, LINE, OneBot, WeCom). Note: `PicoConfig` does not currently expose this field. `BaseChannel` exposes this via the `WithReasoningChannelID` option and `ReasoningChannelID()` method. diff --git a/pkg/channels/README.zh.md b/pkg/channels/README.zh.md index 2c5e7356e..8bc8c8dbc 100644 --- a/pkg/channels/README.zh.md +++ b/pkg/channels/README.zh.md @@ -1254,8 +1254,7 @@ make test # 全量测试 | `pkg/channels/onebot/` | `"onebot"` | ReactionCapable, MediaSender | | `pkg/channels/dingtalk/` | `"dingtalk"` | — | | `pkg/channels/feishu/` | `"feishu"` | — (架构特定 build tags: `feishu_32.go` / `feishu_64.go`) | -| `pkg/channels/wecom/` | `"wecom"` | WebhookHandler, HealthChecker | -| `pkg/channels/wecom/` | `"wecom_app"` | MediaSender, WebhookHandler, HealthChecker | +| `pkg/channels/wecom/` | `"wecom"` | MediaSender | | `pkg/channels/qq/` | `"qq"` | — | | `pkg/channels/whatsapp/` | `"whatsapp"` | — (Bridge 模式) | | `pkg/channels/whatsapp_native/` | `"whatsapp_native"` | — (原生 whatsmeow 模式) | @@ -1370,7 +1369,7 @@ agentLoop.Stop() // 停止 Agent 2. **Feishu 架构特定编译**：Feishu channel 使用 build tags 区分 32 位和 64 位架构（`feishu_32.go` / `feishu_64.go`）。Feishu 使用 SDK 的 WebSocket 模式（非 HTTP webhook），因此不实现 `WebhookHandler`。 -3. **WeCom 有两个工厂**：`"wecom"`（Bot 模式，纯 webhook）和 `"wecom_app"`（应用模式，支持 MediaSender）分别注册。两者都实现了 `WebhookHandler` 和 `HealthChecker`。 +3. **WeCom 现在只有一个 channel**：`"wecom"` 采用 WebSocket AI Bot 实现，带路由持久化；访问控制走统一的 channel 白名单机制，不再保留旧的 webhook/app 双分支。 4. **Pico Protocol**：`pkg/channels/pico/` 实现了一个自定义的 PicoClaw 原生协议 channel，通过 WebSocket webhook (`/pico/ws`) 接收消息。 @@ -1380,4 +1379,4 @@ agentLoop.Stop() // 停止 Agent 7. **PlaceholderConfig 的配置与实现**：`PlaceholderConfig` 出现在 6 个 channel config 中（Telegram、Discord、Slack、LINE、OneBot、Pico），但只有实现了 `PlaceholderCapable` + `MessageEditor` 的 channel（Telegram、Discord、Pico）能真正使用占位消息编辑功能。其余 channel 的 `PlaceholderConfig` 为预留字段。 -8. **ReasoningChannelID**：大多数 channel config 都包含 `reasoning_channel_id` 字段，用于将 LLM 的思维链（reasoning/thinking）路由到指定 channel（WhatsApp、Telegram、Feishu、Discord、MaixCam、QQ、DingTalk、Slack、LINE、OneBot、WeCom、WeComApp）。注意：`PicoConfig` 目前不包含该字段。`BaseChannel` 通过 `WithReasoningChannelID` 选项和 `ReasoningChannelID()` 方法暴露此配置。 \ No newline at end of file +8. **ReasoningChannelID**：大多数 channel config 都包含 `reasoning_channel_id` 字段，用于将 LLM 的思维链（reasoning/thinking）路由到指定 channel（WhatsApp、Telegram、Feishu、Discord、MaixCam、QQ、DingTalk、Slack、LINE、OneBot、WeCom）。注意：`PicoConfig` 目前不包含该字段。`BaseChannel` 通过 `WithReasoningChannelID` 选项和 `ReasoningChannelID()` 方法暴露此配置。 diff --git a/pkg/config/SECURITY_CONFIG.md b/pkg/config/SECURITY_CONFIG.md index c5aed54ae..4f783aaa5 100644 --- a/pkg/config/SECURITY_CONFIG.md +++ b/pkg/config/SECURITY_CONFIG.md @@ -99,13 +99,7 @@ Examples: - `ref:channels.line.channel_secret` - `ref:channels.line.channel_access_token` - `ref:channels.onebot.access_token` -- `ref:channels.wecom.token` -- `ref:channels.wecom.encoding_aes_key` -- `ref:channels.wecom_app.corp_secret` -- `ref:channels.wecom_app.token` -- `ref:channels.wecom_app.encoding_aes_key` -- `ref:channels.wecom_aibot.token` -- `ref:channels.wecom_aibot.encoding_aes_key` +- `ref:channels.wecom.secret` - `ref:channels.pico.token` - `ref:channels.irc.password` - `ref:channels.irc.nickserv_password` diff --git a/pkg/config/example_security_usage.go b/pkg/config/example_security_usage.go index cba76c6bc..09aee9aa3 100644 --- a/pkg/config/example_security_usage.go +++ b/pkg/config/example_security_usage.go @@ -153,13 +153,7 @@ Both single and multiple keys should use the array format. - ref:channels.line.channel_secret - ref:channels.line.channel_access_token - ref:channels.onebot.access_token -- ref:channels.wecom.token -- ref:channels.wecom.encoding_aes_key -- ref:channels.wecom_app.corp_secret -- ref:channels.wecom_app.token -- ref:channels.wecom_app.encoding_aes_key -- ref:channels.wecom_aibot.token -- ref:channels.wecom_aibot.encoding_aes_key +- ref:channels.wecom.secret - ref:channels.pico.token - ref:channels.irc.password - ref:channels.irc.nickserv_password From e760cb737c9d8d0a00faf5cb75c352fdba914a73 Mon Sep 17 00:00:00 2001 From: Hoshina Date: Tue, 24 Mar 2026 15:04:46 +0800 Subject: [PATCH 070/202] feat(auth): add wecom cli qr login --- cmd/picoclaw/internal/auth/command.go | 1 + cmd/picoclaw/internal/auth/command_test.go | 1 + cmd/picoclaw/internal/auth/wecom.go | 407 +++++++++++++++++++++ cmd/picoclaw/internal/auth/wecom_test.go | 157 ++++++++ 4 files changed, 566 insertions(+) create mode 100644 cmd/picoclaw/internal/auth/wecom.go create mode 100644 cmd/picoclaw/internal/auth/wecom_test.go diff --git a/cmd/picoclaw/internal/auth/command.go b/cmd/picoclaw/internal/auth/command.go index 149095699..9de083d8d 100644 --- a/cmd/picoclaw/internal/auth/command.go +++ b/cmd/picoclaw/internal/auth/command.go @@ -17,6 +17,7 @@ func NewAuthCommand() *cobra.Command { newStatusCommand(), newModelsCommand(), newWeixinCommand(), + newWeComCommand(), ) return cmd diff --git a/cmd/picoclaw/internal/auth/command_test.go b/cmd/picoclaw/internal/auth/command_test.go index 12f2bc186..3c7f2d3d6 100644 --- a/cmd/picoclaw/internal/auth/command_test.go +++ b/cmd/picoclaw/internal/auth/command_test.go @@ -33,6 +33,7 @@ func TestNewAuthCommand(t *testing.T) { "status", "models", "weixin", + "wecom", } subcommands := cmd.Commands() diff --git a/cmd/picoclaw/internal/auth/wecom.go b/cmd/picoclaw/internal/auth/wecom.go new file mode 100644 index 000000000..8261f5f80 --- /dev/null +++ b/cmd/picoclaw/internal/auth/wecom.go @@ -0,0 +1,407 @@ +package auth + +import ( + "context" + "encoding/json" + "errors" + "fmt" + "io" + "net/http" + "net/url" + "os" + "runtime" + "strconv" + "strings" + "time" + + "github.com/mdp/qrterminal/v3" + "github.com/spf13/cobra" + + "github.com/sipeed/picoclaw/cmd/picoclaw/internal" + "github.com/sipeed/picoclaw/pkg/config" +) + +const ( + wecomQRSourceID = "picoclaw" + wecomQRGenerateEndpoint = "https://work.weixin.qq.com/ai/qc/generate" + wecomQRQueryEndpoint = "https://work.weixin.qq.com/ai/qc/query_result" + wecomQRPageEndpoint = "https://work.weixin.qq.com/ai/qc/gen" + wecomQRHTTPTimeout = 15 * time.Second + wecomQRPollInterval = 3 * time.Second + wecomQRPollTimeout = 5 * time.Minute + wecomDefaultWebSocketURL = "wss://openws.work.weixin.qq.com" +) + +type wecomQRScanner func(context.Context, wecomQRFlowOptions) (wecomQRBotInfo, error) + +type wecomQRFlowOptions struct { + HTTPClient *http.Client + GenerateURL string + QueryURL string + QRCodePageURL string + SourceID string + PollInterval time.Duration + PollTimeout time.Duration + Writer io.Writer +} + +type wecomQRBotInfo struct { + BotID string + Secret string +} + +type wecomQRSession struct { + SCode string + AuthURL string +} + +type wecomQRGenerateResponse struct { + ErrCode int `json:"errcode,omitempty"` + ErrMsg string `json:"errmsg,omitempty"` + Data struct { + SCode string `json:"scode"` + AuthURL string `json:"auth_url"` + } `json:"data"` +} + +type wecomQRQueryResponse struct { + ErrCode int `json:"errcode,omitempty"` + ErrMsg string `json:"errmsg,omitempty"` + Data struct { + Status string `json:"status"` + BotInfo struct { + BotID string `json:"botid"` + Secret string `json:"secret"` + } `json:"bot_info"` + } `json:"data"` +} + +func newWeComCommand() *cobra.Command { + var timeout time.Duration + + cmd := &cobra.Command{ + Use: "wecom", + Short: "Scan a WeCom QR code and configure channels.wecom", + Args: cobra.NoArgs, + RunE: func(_ *cobra.Command, _ []string) error { + return authWeComCmd(timeout) + }, + } + + cmd.Flags().DurationVar(&timeout, "timeout", wecomQRPollTimeout, "How long to wait for QR confirmation") + + return cmd +} + +func authWeComCmd(timeout time.Duration) error { + return authWeComCmdWithScanner(context.Background(), os.Stdout, timeout, scanWeComQRCodeInteractive) +} + +func authWeComCmdWithScanner( + ctx context.Context, + writer io.Writer, + timeout time.Duration, + scanner wecomQRScanner, +) error { + if scanner == nil { + return fmt.Errorf("wecom QR scanner is nil") + } + if writer == nil { + writer = os.Stdout + } + + cfg, err := internal.LoadConfig() + if err != nil { + return fmt.Errorf("failed to load config: %w", err) + } + + opts := defaultWeComQRFlowOptions(timeout) + opts.Writer = writer + + botInfo, err := scanner(ctx, opts) + if err != nil { + return err + } + + applyWeComAuthResult(cfg, botInfo) + + if saveErr := config.SaveConfig(internal.GetConfigPath(), cfg); saveErr != nil { + return fmt.Errorf("failed to save config: %w", saveErr) + } + + fmt.Fprintln(writer) + fmt.Fprintln(writer, "WeCom connected.") + fmt.Fprintf(writer, "Bot ID: %s\n", botInfo.BotID) + fmt.Fprintf(writer, "Config: %s\n", internal.GetConfigPath()) + + return nil +} + +func defaultWeComQRFlowOptions(timeout time.Duration) wecomQRFlowOptions { + if timeout <= 0 { + timeout = wecomQRPollTimeout + } + + return wecomQRFlowOptions{ + HTTPClient: &http.Client{Timeout: wecomQRHTTPTimeout}, + GenerateURL: wecomQRGenerateEndpoint, + QueryURL: wecomQRQueryEndpoint, + QRCodePageURL: wecomQRPageEndpoint, + SourceID: wecomQRSourceID, + PollInterval: wecomQRPollInterval, + PollTimeout: timeout, + Writer: os.Stdout, + } +} + +func applyWeComAuthResult(cfg *config.Config, botInfo wecomQRBotInfo) { + cfg.Channels.WeCom.Enabled = true + cfg.Channels.WeCom.BotID = botInfo.BotID + cfg.Channels.WeCom.SetSecret(botInfo.Secret) + if strings.TrimSpace(cfg.Channels.WeCom.WebSocketURL) == "" { + cfg.Channels.WeCom.WebSocketURL = wecomDefaultWebSocketURL + } +} + +func scanWeComQRCodeInteractive(ctx context.Context, opts wecomQRFlowOptions) (wecomQRBotInfo, error) { + opts = normalizeWeComQRFlowOptions(opts) + + fmt.Fprintln(opts.Writer, "Requesting WeCom QR code...") + + session, err := fetchWeComQRCode(ctx, opts) + if err != nil { + return wecomQRBotInfo{}, err + } + + fmt.Fprintln(opts.Writer) + fmt.Fprintln(opts.Writer, "=======================================================") + fmt.Fprintln(opts.Writer, "Please scan the following QR code with WeCom:") + fmt.Fprintln(opts.Writer, "=======================================================") + fmt.Fprintln(opts.Writer) + + qrterminal.GenerateWithConfig(session.AuthURL, qrterminal.Config{ + Level: qrterminal.L, + Writer: opts.Writer, + HalfBlocks: true, + }) + + pageURL, err := buildWeComQRCodePageURL(opts.QRCodePageURL, opts.SourceID, session.SCode) + if err != nil { + return wecomQRBotInfo{}, err + } + + fmt.Fprintln(opts.Writer) + fmt.Fprintf(opts.Writer, "QR Code Link: %s\n", pageURL) + fmt.Fprintln(opts.Writer) + fmt.Fprintln(opts.Writer, "Waiting for scan...") + + return pollWeComQRCodeResult(ctx, opts, session.SCode) +} + +func normalizeWeComQRFlowOptions(opts wecomQRFlowOptions) wecomQRFlowOptions { + if opts.HTTPClient == nil { + opts.HTTPClient = &http.Client{Timeout: wecomQRHTTPTimeout} + } + if strings.TrimSpace(opts.GenerateURL) == "" { + opts.GenerateURL = wecomQRGenerateEndpoint + } + if strings.TrimSpace(opts.QueryURL) == "" { + opts.QueryURL = wecomQRQueryEndpoint + } + if strings.TrimSpace(opts.QRCodePageURL) == "" { + opts.QRCodePageURL = wecomQRPageEndpoint + } + if strings.TrimSpace(opts.SourceID) == "" { + opts.SourceID = wecomQRSourceID + } + if opts.PollInterval <= 0 { + opts.PollInterval = wecomQRPollInterval + } + if opts.PollTimeout <= 0 { + opts.PollTimeout = wecomQRPollTimeout + } + if opts.Writer == nil { + opts.Writer = os.Stdout + } + + return opts +} + +func fetchWeComQRCode(ctx context.Context, opts wecomQRFlowOptions) (wecomQRSession, error) { + generateURL, err := buildWeComQRGenerateURL(opts.GenerateURL, opts.SourceID, wecomPlatformCode()) + if err != nil { + return wecomQRSession{}, err + } + + var resp wecomQRGenerateResponse + if err := doWeComJSONGet(ctx, opts.HTTPClient, generateURL, &resp); err != nil { + return wecomQRSession{}, fmt.Errorf("failed to get WeCom QR code: %w", err) + } + if resp.ErrCode != 0 { + return wecomQRSession{}, fmt.Errorf( + "failed to get WeCom QR code: errcode=%d errmsg=%s", + resp.ErrCode, + resp.ErrMsg, + ) + } + if resp.Data.SCode == "" || resp.Data.AuthURL == "" { + return wecomQRSession{}, fmt.Errorf("failed to get WeCom QR code: response missing scode or auth_url") + } + + return wecomQRSession{ + SCode: resp.Data.SCode, + AuthURL: resp.Data.AuthURL, + }, nil +} + +func pollWeComQRCodeResult(ctx context.Context, opts wecomQRFlowOptions, scode string) (wecomQRBotInfo, error) { + if strings.TrimSpace(scode) == "" { + return wecomQRBotInfo{}, fmt.Errorf("missing WeCom QR scode") + } + + timeoutCtx, cancel := context.WithTimeout(ctx, opts.PollTimeout) + defer cancel() + + var scannedPrinted bool + + for { + status, err := queryWeComQRCodeStatus(timeoutCtx, opts, scode) + if err != nil { + if errors.Is(err, context.DeadlineExceeded) || errors.Is(timeoutCtx.Err(), context.DeadlineExceeded) { + return wecomQRBotInfo{}, fmt.Errorf("WeCom QR scan timed out after %s", opts.PollTimeout) + } + return wecomQRBotInfo{}, err + } + + switch strings.ToLower(status.Data.Status) { + case "success": + if status.Data.BotInfo.BotID == "" || status.Data.BotInfo.Secret == "" { + return wecomQRBotInfo{}, fmt.Errorf("WeCom QR scan succeeded but bot credentials are missing") + } + return wecomQRBotInfo{ + BotID: status.Data.BotInfo.BotID, + Secret: status.Data.BotInfo.Secret, + }, nil + case "expired": + return wecomQRBotInfo{}, fmt.Errorf("WeCom QR code expired, please retry") + case "scaned", "scanned": + if !scannedPrinted { + fmt.Fprintln(opts.Writer, "QR code scanned. Confirm the login in WeCom.") + scannedPrinted = true + } + } + + select { + case <-timeoutCtx.Done(): + if errors.Is(timeoutCtx.Err(), context.DeadlineExceeded) { + return wecomQRBotInfo{}, fmt.Errorf("WeCom QR scan timed out after %s", opts.PollTimeout) + } + return wecomQRBotInfo{}, timeoutCtx.Err() + case <-time.After(opts.PollInterval): + } + } +} + +func queryWeComQRCodeStatus(ctx context.Context, opts wecomQRFlowOptions, scode string) (wecomQRQueryResponse, error) { + queryURL, err := buildWeComQRQueryURL(opts.QueryURL, scode) + if err != nil { + return wecomQRQueryResponse{}, err + } + + var resp wecomQRQueryResponse + if err := doWeComJSONGet(ctx, opts.HTTPClient, queryURL, &resp); err != nil { + return wecomQRQueryResponse{}, fmt.Errorf("failed to query WeCom QR result: %w", err) + } + if resp.ErrCode != 0 { + return wecomQRQueryResponse{}, fmt.Errorf( + "failed to query WeCom QR result: errcode=%d errmsg=%s", + resp.ErrCode, + resp.ErrMsg, + ) + } + + return resp, nil +} + +func buildWeComQRGenerateURL(baseURL, sourceID string, platformCode int) (string, error) { + u, err := url.Parse(baseURL) + if err != nil { + return "", fmt.Errorf("invalid WeCom QR generate URL: %w", err) + } + + query := u.Query() + query.Set("source", sourceID) + query.Set("sourceID", sourceID) + query.Set("plat", strconv.Itoa(platformCode)) + u.RawQuery = query.Encode() + + return u.String(), nil +} + +func buildWeComQRQueryURL(baseURL, scode string) (string, error) { + u, err := url.Parse(baseURL) + if err != nil { + return "", fmt.Errorf("invalid WeCom QR query URL: %w", err) + } + + query := u.Query() + query.Set("scode", scode) + u.RawQuery = query.Encode() + + return u.String(), nil +} + +func buildWeComQRCodePageURL(baseURL, sourceID, scode string) (string, error) { + u, err := url.Parse(baseURL) + if err != nil { + return "", fmt.Errorf("invalid WeCom QR page URL: %w", err) + } + + query := u.Query() + query.Set("source", sourceID) + query.Set("sourceID", sourceID) + query.Set("scode", scode) + u.RawQuery = query.Encode() + + return u.String(), nil +} + +func doWeComJSONGet(ctx context.Context, client *http.Client, targetURL string, out any) error { + req, err := http.NewRequestWithContext(ctx, http.MethodGet, targetURL, nil) + if err != nil { + return err + } + + resp, err := client.Do(req) + if err != nil { + return err + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + body, readErr := io.ReadAll(io.LimitReader(resp.Body, 8192)) + if readErr != nil { + return fmt.Errorf("unexpected status %s", resp.Status) + } + return fmt.Errorf("unexpected status %s: %s", resp.Status, strings.TrimSpace(string(body))) + } + + if err := json.NewDecoder(resp.Body).Decode(out); err != nil { + return fmt.Errorf("decode JSON response: %w", err) + } + + return nil +} + +func wecomPlatformCode() int { + switch runtime.GOOS { + case "darwin": + return 1 + case "windows": + return 2 + case "linux": + return 3 + default: + return 0 + } +} diff --git a/cmd/picoclaw/internal/auth/wecom_test.go b/cmd/picoclaw/internal/auth/wecom_test.go new file mode 100644 index 000000000..c2a4624ae --- /dev/null +++ b/cmd/picoclaw/internal/auth/wecom_test.go @@ -0,0 +1,157 @@ +package auth + +import ( + "bytes" + "context" + "net/http" + "net/http/httptest" + "net/url" + "path/filepath" + "strconv" + "sync/atomic" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/sipeed/picoclaw/cmd/picoclaw/internal" + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestNewWeComCommand(t *testing.T) { + cmd := newWeComCommand() + + require.NotNil(t, cmd) + assert.Equal(t, "wecom", cmd.Use) + assert.Equal(t, "Scan a WeCom QR code and configure channels.wecom", cmd.Short) + assert.NotNil(t, cmd.Flags().Lookup("timeout")) +} + +func TestBuildWeComQRGenerateURL(t *testing.T) { + rawURL, err := buildWeComQRGenerateURL("https://example.com/ai/qc/generate", wecomQRSourceID, 3) + require.NoError(t, err) + + parsed, err := url.Parse(rawURL) + require.NoError(t, err) + + assert.Equal(t, wecomQRSourceID, parsed.Query().Get("source")) + assert.Equal(t, wecomQRSourceID, parsed.Query().Get("sourceID")) + assert.Equal(t, "3", parsed.Query().Get("plat")) +} + +func TestBuildWeComQRCodePageURL(t *testing.T) { + rawURL, err := buildWeComQRCodePageURL("https://example.com/ai/qc/gen", wecomQRSourceID, "scode-1") + require.NoError(t, err) + + parsed, err := url.Parse(rawURL) + require.NoError(t, err) + + assert.Equal(t, wecomQRSourceID, parsed.Query().Get("source")) + assert.Equal(t, wecomQRSourceID, parsed.Query().Get("sourceID")) + assert.Equal(t, "scode-1", parsed.Query().Get("scode")) +} + +func TestFetchWeComQRCode(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + assert.Equal(t, "/generate", r.URL.Path) + assert.Equal(t, wecomQRSourceID, r.URL.Query().Get("source")) + assert.Equal(t, wecomQRSourceID, r.URL.Query().Get("sourceID")) + assert.Equal(t, strconv.Itoa(wecomPlatformCode()), r.URL.Query().Get("plat")) + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"data":{"scode":"scode-1","auth_url":"https://example.com/qr"}}`)) + })) + defer server.Close() + + opts := normalizeWeComQRFlowOptions(wecomQRFlowOptions{ + HTTPClient: server.Client(), + GenerateURL: server.URL + "/generate", + Writer: bytes.NewBuffer(nil), + }) + + session, err := fetchWeComQRCode(context.Background(), opts) + require.NoError(t, err) + assert.Equal(t, "scode-1", session.SCode) + assert.Equal(t, "https://example.com/qr", session.AuthURL) +} + +func TestPollWeComQRCodeResult(t *testing.T) { + var calls atomic.Int32 + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + call := calls.Add(1) + assert.Equal(t, "/query", r.URL.Path) + assert.Equal(t, "scode-1", r.URL.Query().Get("scode")) + w.Header().Set("Content-Type", "application/json") + switch call { + case 1: + _, _ = w.Write([]byte(`{"data":{"status":"wait"}}`)) + case 2: + _, _ = w.Write([]byte(`{"data":{"status":"scaned"}}`)) + default: + _, _ = w.Write([]byte(`{"data":{"status":"success","bot_info":{"botid":"bot-1","secret":"secret-1"}}}`)) + } + })) + defer server.Close() + + var output bytes.Buffer + opts := normalizeWeComQRFlowOptions(wecomQRFlowOptions{ + HTTPClient: server.Client(), + QueryURL: server.URL + "/query", + PollInterval: time.Millisecond, + PollTimeout: time.Second, + Writer: &output, + }) + + botInfo, err := pollWeComQRCodeResult(context.Background(), opts, "scode-1") + require.NoError(t, err) + assert.Equal(t, "bot-1", botInfo.BotID) + assert.Equal(t, "secret-1", botInfo.Secret) + assert.Contains(t, output.String(), "QR code scanned. Confirm the login in WeCom.") +} + +func TestApplyWeComAuthResult(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Channels.WeCom.WebSocketURL = "" + + applyWeComAuthResult(cfg, wecomQRBotInfo{ + BotID: "bot-1", + Secret: "secret-1", + }) + + assert.True(t, cfg.Channels.WeCom.Enabled) + assert.Equal(t, "bot-1", cfg.Channels.WeCom.BotID) + assert.Equal(t, "secret-1", cfg.Channels.WeCom.Secret()) + assert.Equal(t, wecomDefaultWebSocketURL, cfg.Channels.WeCom.WebSocketURL) +} + +func TestAuthWeComCmdWithScanner(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + t.Setenv(config.EnvHome, tmpDir) + t.Setenv(config.EnvConfig, configPath) + + var output bytes.Buffer + err := authWeComCmdWithScanner( + context.Background(), + &output, + time.Second, + func(_ context.Context, opts wecomQRFlowOptions) (wecomQRBotInfo, error) { + assert.Equal(t, wecomQRSourceID, opts.SourceID) + return wecomQRBotInfo{ + BotID: "bot-1", + Secret: "secret-1", + }, nil + }, + ) + require.NoError(t, err) + + cfg, err := config.LoadConfig(internal.GetConfigPath()) + require.NoError(t, err) + assert.True(t, cfg.Channels.WeCom.Enabled) + assert.Equal(t, "bot-1", cfg.Channels.WeCom.BotID) + assert.Equal(t, "secret-1", cfg.Channels.WeCom.Secret()) + assert.Equal(t, wecomDefaultWebSocketURL, cfg.Channels.WeCom.WebSocketURL) + assert.Contains(t, output.String(), "WeCom connected.") +} From c3631d84ba5ab68c7cb008681e317f32c728fba7 Mon Sep 17 00:00:00 2001 From: Hoshina Date: Tue, 24 Mar 2026 16:12:28 +0800 Subject: [PATCH 071/202] feat(wecom): send media via temp uploads --- pkg/channels/wecom/media.go | 513 ++++++++++++++++++++++++++++++- pkg/channels/wecom/protocol.go | 64 +++- pkg/channels/wecom/wecom.go | 146 +++++++-- pkg/channels/wecom/wecom_test.go | 351 ++++++++++++++++++++- 4 files changed, 1037 insertions(+), 37 deletions(-) diff --git a/pkg/channels/wecom/media.go b/pkg/channels/wecom/media.go index defe226d4..ebcc481e8 100644 --- a/pkg/channels/wecom/media.go +++ b/pkg/channels/wecom/media.go @@ -4,7 +4,10 @@ import ( "context" "crypto/aes" "crypto/cipher" + "crypto/md5" "encoding/base64" + "encoding/hex" + "encoding/json" "fmt" "io" "mime" @@ -13,12 +16,73 @@ import ( "os" "path/filepath" "strings" + "time" "github.com/h2non/filetype" + "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/media" ) +const ( + wecomOutboundMediaMaxBytes = 20 << 20 + wecomOutboundImageMaxBytes = 2 << 20 + wecomOutboundVoiceMaxBytes = 2 << 20 + wecomOutboundVideoMaxBytes = 10 << 20 + wecomUploadChunkMaxBytes = 512 << 10 + wecomUploadMaxChunks = 100 + wecomUploadMinBytes = 5 +) + +type wecomOutboundMedia struct { + MsgType string + MediaID string + Title string + Description string +} + +func (m *wecomOutboundMedia) respondBody() wecomRespondMsgBody { + body := wecomRespondMsgBody{MsgType: m.MsgType} + switch m.MsgType { + case "file": + body.File = &wecomMediaRefContent{MediaID: m.MediaID} + case "image": + body.Image = &wecomMediaRefContent{MediaID: m.MediaID} + case "voice": + body.Voice = &wecomMediaRefContent{MediaID: m.MediaID} + case "video": + body.Video = &wecomVideoContent{ + MediaID: m.MediaID, + Title: m.Title, + Description: m.Description, + } + } + return body +} + +func (m *wecomOutboundMedia) sendBody(chatID string, chatType uint32) wecomSendMsgBody { + body := wecomSendMsgBody{ + ChatID: chatID, + ChatType: chatType, + MsgType: m.MsgType, + } + switch m.MsgType { + case "file": + body.File = &wecomMediaRefContent{MediaID: m.MediaID} + case "image": + body.Image = &wecomMediaRefContent{MediaID: m.MediaID} + case "voice": + body.Voice = &wecomMediaRefContent{MediaID: m.MediaID} + case "video": + body.Video = &wecomVideoContent{ + MediaID: m.MediaID, + Title: m.Title, + Description: m.Description, + } + } + return body +} + func decodeMediaAESKey(value string) ([]byte, error) { if value == "" { return nil, nil @@ -227,12 +291,11 @@ func (c *WeComChannel) storeRemoteMedia( return "", fmt.Errorf("download media returned HTTP %d", resp.StatusCode) } - const maxSize = 20 << 20 - data, err := io.ReadAll(io.LimitReader(resp.Body, maxSize+1)) + data, err := io.ReadAll(io.LimitReader(resp.Body, wecomOutboundMediaMaxBytes+1)) if err != nil { return "", fmt.Errorf("read media: %w", err) } - if len(data) > maxSize { + if len(data) > wecomOutboundMediaMaxBytes { return "", fmt.Errorf("media too large") } @@ -289,3 +352,447 @@ func (c *WeComChannel) storeRemoteMedia( } return ref, nil } + +func detectLocalWeComContentType(localPath, hint string) string { + contentType := normalizeWeComContentType(hint) + if !isGenericWeComContentType(contentType) { + return contentType + } + + if kind, err := filetype.MatchFile(localPath); err == nil && kind != filetype.Unknown { + return normalizeWeComContentType(kind.MIME.Value) + } + + if ext := strings.ToLower(filepath.Ext(localPath)); ext != "" { + if byExt := normalizeWeComContentType(mime.TypeByExtension(ext)); byExt != "" { + return byExt + } + } + + file, err := os.Open(localPath) + if err != nil { + return contentType + } + defer file.Close() + + buf := make([]byte, 512) + n, err := file.Read(buf) + if err != nil && err != io.EOF { + return contentType + } + if n == 0 { + return contentType + } + return normalizeWeComContentType(http.DetectContentType(buf[:n])) +} + +func writeWeComTempFile(prefix, filename string, data []byte) (string, error) { + mediaDir := filepath.Join(os.TempDir(), "picoclaw_media") + if err := os.MkdirAll(mediaDir, 0o700); err != nil { + return "", fmt.Errorf("mkdir media dir: %w", err) + } + + ext := strings.ToLower(filepath.Ext(filename)) + tmpFile, err := os.CreateTemp(mediaDir, prefix+"-*"+ext) + if err != nil { + return "", fmt.Errorf("create temp file: %w", err) + } + tmpPath := tmpFile.Name() + + if _, err := tmpFile.Write(data); err != nil { + _ = tmpFile.Close() + _ = os.Remove(tmpPath) + return "", fmt.Errorf("write temp file: %w", err) + } + if err := tmpFile.Close(); err != nil { + _ = os.Remove(tmpPath) + return "", fmt.Errorf("close temp file: %w", err) + } + return tmpPath, nil +} + +func (c *WeComChannel) downloadRemoteMediaToTemp( + ctx context.Context, + resourceURL, fallbackName string, +) (string, string, string, error) { + req, err := http.NewRequestWithContext(ctx, http.MethodGet, resourceURL, nil) + if err != nil { + return "", "", "", fmt.Errorf("create request: %w", err) + } + + resp, err := c.mediaClient.Do(req) + if err != nil { + return "", "", "", fmt.Errorf("download media: %w", err) + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + body, _ := io.ReadAll(io.LimitReader(resp.Body, 1024)) + return "", "", "", fmt.Errorf("download media returned HTTP %d: %s", resp.StatusCode, string(body)) + } + + data, err := io.ReadAll(io.LimitReader(resp.Body, wecomOutboundMediaMaxBytes+1)) + if err != nil { + return "", "", "", fmt.Errorf("read media: %w", err) + } + if len(data) > wecomOutboundMediaMaxBytes { + return "", "", "", fmt.Errorf("media too large") + } + + filename, contentType := detectWeComMediaMetadata( + data, + fallbackName, + resp.Header.Get("Content-Type"), + resourceURL, + resp.Header.Get("Content-Disposition"), + ) + tmpPath, err := writeWeComTempFile("wecom-outbound", filename, data) + if err != nil { + return "", "", "", err + } + return tmpPath, filename, contentType, nil +} + +func (c *WeComChannel) resolveOutboundPart( + ctx context.Context, + part bus.MediaPart, +) (string, string, string, func(), error) { + cleanup := func() {} + filename := sanitizeWeComFilename(part.Filename) + contentType := normalizeWeComContentType(part.ContentType) + ref := strings.TrimSpace(part.Ref) + + switch { + case ref == "": + return "", filename, contentType, cleanup, nil + + case strings.HasPrefix(ref, "http://") || strings.HasPrefix(ref, "https://"): + localPath, name, ct, err := c.downloadRemoteMediaToTemp(ctx, ref, filename) + if err != nil { + return "", "", "", cleanup, err + } + return localPath, name, ct, func() { _ = os.Remove(localPath) }, nil + + case strings.HasPrefix(ref, "media://"): + store := c.GetMediaStore() + if store == nil { + return "", "", "", cleanup, fmt.Errorf("no media store available") + } + + localPath, meta, err := store.ResolveWithMeta(ref) + if err != nil { + return "", "", "", cleanup, err + } + if filename == "" { + filename = sanitizeWeComFilename(meta.Filename) + } + if contentType == "" { + contentType = normalizeWeComContentType(meta.ContentType) + } + if strings.HasPrefix(localPath, "http://") || strings.HasPrefix(localPath, "https://") { + tmpPath, name, ct, err := c.downloadRemoteMediaToTemp(ctx, localPath, filename) + if err != nil { + return "", "", "", cleanup, err + } + return tmpPath, name, ct, func() { _ = os.Remove(tmpPath) }, nil + } + if _, err := os.Stat(localPath); err != nil { + return "", "", "", cleanup, err + } + if filename == "" { + filename = sanitizeWeComFilename(filepath.Base(localPath)) + } + if contentType == "" { + contentType = detectLocalWeComContentType(localPath, "") + } + return localPath, filename, contentType, cleanup, nil + + case strings.HasPrefix(ref, "file://"): + u, err := url.Parse(ref) + if err != nil { + return "", "", "", cleanup, err + } + localPath := u.Path + if _, err := os.Stat(localPath); err != nil { + return "", "", "", cleanup, err + } + if filename == "" { + filename = sanitizeWeComFilename(filepath.Base(localPath)) + } + if contentType == "" { + contentType = detectLocalWeComContentType(localPath, "") + } + return localPath, filename, contentType, cleanup, nil + + default: + if _, err := os.Stat(ref); err != nil { + return "", "", "", cleanup, err + } + if filename == "" { + filename = sanitizeWeComFilename(filepath.Base(ref)) + } + if contentType == "" { + contentType = detectLocalWeComContentType(ref, "") + } + return ref, filename, contentType, cleanup, nil + } +} + +func canWeComSendImage(contentType, ext string, size int64) bool { + if size > wecomOutboundImageMaxBytes { + return false + } + switch normalizeWeComContentType(contentType) { + case "image/jpeg", "image/jpg", "image/png", "image/gif": + return true + } + switch strings.ToLower(ext) { + case ".jpg", ".jpeg", ".png", ".gif": + return true + default: + return false + } +} + +func canWeComSendVoice(contentType, ext string, size int64) bool { + if size > wecomOutboundVoiceMaxBytes { + return false + } + contentType = normalizeWeComContentType(contentType) + return strings.Contains(contentType, "amr") || strings.EqualFold(ext, ".amr") +} + +func canWeComSendVideo(contentType, ext string, size int64) bool { + if size > wecomOutboundVideoMaxBytes { + return false + } + return normalizeWeComContentType(contentType) == "video/mp4" || strings.EqualFold(ext, ".mp4") +} + +func outboundWeComMediaKind(partType, filename, contentType string, size int64) string { + if size < wecomUploadMinBytes { + return "" + } + + partType = strings.ToLower(strings.TrimSpace(partType)) + contentType = normalizeWeComContentType(contentType) + ext := strings.ToLower(filepath.Ext(filename)) + + if partType == "file" { + if size <= wecomOutboundMediaMaxBytes { + return "file" + } + return "" + } + + if (partType == "image" || partType == "") && canWeComSendImage(contentType, ext, size) { + return "image" + } + if (partType == "audio" || partType == "voice" || partType == "") && canWeComSendVoice(contentType, ext, size) { + return "voice" + } + if (partType == "video" || partType == "") && canWeComSendVideo(contentType, ext, size) { + return "video" + } + if size <= wecomOutboundMediaMaxBytes { + return "file" + } + return "" +} + +func trimWeComBytes(value string, limit int) string { + value = strings.TrimSpace(value) + if limit <= 0 || len(value) <= limit { + return value + } + size := 0 + var out strings.Builder + for _, r := range value { + width := len(string(r)) + if size+width > limit { + break + } + size += width + out.WriteRune(r) + } + return out.String() +} + +func ensureWeComOutboundFilename(filename, localPath, contentType string) string { + filename = sanitizeWeComFilename(filename) + if filename == "" { + filename = sanitizeWeComFilename(filepath.Base(localPath)) + } + if filename == "" { + filename = "media" + } + if filepath.Ext(filename) == "" { + fallbackExt := inferMediaExt(contentType, strings.ToLower(filepath.Ext(localPath))) + if fallbackExt != "" { + filename += fallbackExt + } + } + filename = trimWeComBytes(filename, 256) + if filename == "" { + return "media" + } + return filename +} + +func buildWeComVideoContent(mediaID, filename, description string) *wecomVideoContent { + title := strings.TrimSuffix(filename, filepath.Ext(filename)) + title = trimWeComBytes(title, 64) + if title == "" { + title = "video" + } + description = trimWeComBytes(description, 512) + return &wecomVideoContent{ + MediaID: mediaID, + Title: title, + Description: description, + } +} + +func decodeWeComEnvelopeBody[T any](env wecomEnvelope) (T, error) { + var out T + if len(env.Body) == 0 { + return out, fmt.Errorf("wecom response body is empty") + } + if err := json.Unmarshal(env.Body, &out); err != nil { + return out, fmt.Errorf("decode wecom response body: %w", err) + } + return out, nil +} + +func (c *WeComChannel) uploadOutboundMedia( + ctx context.Context, + localPath, filename, contentType string, + part bus.MediaPart, +) (*wecomOutboundMedia, error) { + _ = ctx + + contentType = detectLocalWeComContentType(localPath, contentType) + filename = ensureWeComOutboundFilename(filename, localPath, contentType) + + data, err := os.ReadFile(localPath) + if err != nil { + return nil, fmt.Errorf("read media file: %w", err) + } + size := int64(len(data)) + kind := outboundWeComMediaKind(part.Type, filename, contentType, size) + if kind == "" { + return nil, fmt.Errorf("unsupported wecom media type or size for %q", filename) + } + + totalChunks := (len(data) + wecomUploadChunkMaxBytes - 1) / wecomUploadChunkMaxBytes + if totalChunks <= 0 || totalChunks > wecomUploadMaxChunks { + return nil, fmt.Errorf("wecom upload requires 1-%d chunks, got %d", wecomUploadMaxChunks, totalChunks) + } + + sum := md5.Sum(data) + initEnv, err := c.sendCommandAck(wecomCommand{ + Cmd: wecomCmdUploadMediaInit, + Headers: wecomHeaders{ReqID: randomID(10)}, + Body: wecomUploadMediaInitBody{ + Type: kind, + Filename: filename, + TotalSize: size, + TotalChunks: totalChunks, + MD5: hex.EncodeToString(sum[:]), + }, + }, wecomUploadTimeout) + if err != nil { + return nil, err + } + initResp, err := decodeWeComEnvelopeBody[wecomUploadMediaInitResponse](initEnv) + if err != nil { + return nil, err + } + if strings.TrimSpace(initResp.UploadID) == "" { + return nil, fmt.Errorf("wecom upload init returned empty upload_id") + } + + for idx, offset := 0, 0; offset < len(data); idx, offset = idx+1, offset+wecomUploadChunkMaxBytes { + end := offset + wecomUploadChunkMaxBytes + if end > len(data) { + end = len(data) + } + if err := c.sendCommand(wecomCommand{ + Cmd: wecomCmdUploadMediaChunk, + Headers: wecomHeaders{ReqID: randomID(10)}, + Body: wecomUploadMediaChunkBody{ + UploadID: initResp.UploadID, + ChunkIndex: idx, + Base64Data: base64.StdEncoding.EncodeToString(data[offset:end]), + }, + }, wecomUploadTimeout); err != nil { + return nil, err + } + } + + finishEnv, err := c.sendCommandAck(wecomCommand{ + Cmd: wecomCmdUploadMediaEnd, + Headers: wecomHeaders{ReqID: randomID(10)}, + Body: wecomUploadMediaFinishBody{ + UploadID: initResp.UploadID, + }, + }, wecomUploadTimeout) + if err != nil { + return nil, err + } + finishResp, err := decodeWeComEnvelopeBody[wecomUploadMediaFinishResponse](finishEnv) + if err != nil { + return nil, err + } + if strings.TrimSpace(finishResp.MediaID) == "" { + return nil, fmt.Errorf("wecom upload finish returned empty media_id") + } + + uploaded := &wecomOutboundMedia{ + MsgType: kind, + MediaID: finishResp.MediaID, + } + if kind == "video" { + video := buildWeComVideoContent(finishResp.MediaID, filename, part.Caption) + uploaded.Title = video.Title + uploaded.Description = video.Description + } + return uploaded, nil +} + +func fallbackWeComMediaText(part bus.MediaPart, kind, filename string) string { + var lines []string + if caption := strings.TrimSpace(part.Caption); caption != "" { + lines = append(lines, caption) + } + + label := kind + if label == "" { + label = "media" + } + if filename != "" { + lines = append(lines, fmt.Sprintf("[%s: %s]", label, filename)) + } else { + lines = append(lines, fmt.Sprintf("[%s attachment]", label)) + } + + ref := strings.TrimSpace(part.Ref) + if strings.HasPrefix(ref, "http://") || strings.HasPrefix(ref, "https://") { + lines = append(lines, ref) + } + + return strings.Join(lines, "\n") +} + +func (c *WeComChannel) resolveMediaRoute(chatID string) (wecomTurn, uint32, bool) { + if turn, ok := c.getTurn(chatID); ok { + if time.Since(turn.CreatedAt) <= wecomStreamMaxDuration { + return turn, turn.ChatType, true + } + c.deleteTurn(chatID) + } + if route, ok := c.routes.Get(chatID); ok { + return wecomTurn{ChatID: route.ChatID, ChatType: route.ChatType}, route.ChatType, false + } + return wecomTurn{ChatID: chatID}, 0, false +} diff --git a/pkg/channels/wecom/protocol.go b/pkg/channels/wecom/protocol.go index 6867d8856..0190e70e5 100644 --- a/pkg/channels/wecom/protocol.go +++ b/pkg/channels/wecom/protocol.go @@ -10,6 +10,9 @@ const ( wecomCmdEventCallback = "aibot_event_callback" wecomCmdRespondMsg = "aibot_respond_msg" wecomCmdSendMsg = "aibot_send_msg" + wecomCmdUploadMediaInit = "aibot_upload_media_init" + wecomCmdUploadMediaChunk = "aibot_upload_media_chunk" + wecomCmdUploadMediaEnd = "aibot_upload_media_finish" wecomMaxContentBytes = 20480 ) @@ -32,15 +35,26 @@ type wecomCommand struct { } type wecomSendMsgBody struct { - ChatID string `json:"chatid"` - ChatType uint32 `json:"chat_type,omitempty"` - MsgType string `json:"msgtype"` - Markdown *wecomMarkdownContent `json:"markdown,omitempty"` + ChatID string `json:"chatid"` + ChatType uint32 `json:"chat_type,omitempty"` + MsgType string `json:"msgtype"` + Markdown *wecomMarkdownContent `json:"markdown,omitempty"` + File *wecomMediaRefContent `json:"file,omitempty"` + Image *wecomMediaRefContent `json:"image,omitempty"` + Voice *wecomMediaRefContent `json:"voice,omitempty"` + Video *wecomVideoContent `json:"video,omitempty"` + TemplateCard map[string]any `json:"template_card,omitempty"` } type wecomRespondMsgBody struct { - MsgType string `json:"msgtype"` - Stream *wecomStreamContent `json:"stream,omitempty"` + MsgType string `json:"msgtype"` + Stream *wecomStreamContent `json:"stream,omitempty"` + Markdown *wecomMarkdownContent `json:"markdown,omitempty"` + File *wecomMediaRefContent `json:"file,omitempty"` + Image *wecomMediaRefContent `json:"image,omitempty"` + Voice *wecomMediaRefContent `json:"voice,omitempty"` + Video *wecomVideoContent `json:"video,omitempty"` + TemplateCard map[string]any `json:"template_card,omitempty"` } type wecomStreamContent struct { @@ -53,6 +67,44 @@ type wecomMarkdownContent struct { Content string `json:"content"` } +type wecomMediaRefContent struct { + MediaID string `json:"media_id"` +} + +type wecomVideoContent struct { + MediaID string `json:"media_id"` + Title string `json:"title,omitempty"` + Description string `json:"description,omitempty"` +} + +type wecomUploadMediaInitBody struct { + Type string `json:"type"` + Filename string `json:"filename"` + TotalSize int64 `json:"total_size"` + TotalChunks int `json:"total_chunks"` + MD5 string `json:"md5,omitempty"` +} + +type wecomUploadMediaInitResponse struct { + UploadID string `json:"upload_id"` +} + +type wecomUploadMediaChunkBody struct { + UploadID string `json:"upload_id"` + ChunkIndex int `json:"chunk_index"` + Base64Data string `json:"base64_data"` +} + +type wecomUploadMediaFinishBody struct { + UploadID string `json:"upload_id"` +} + +type wecomUploadMediaFinishResponse struct { + Type string `json:"type"` + MediaID string `json:"media_id"` + CreatedAt json.RawMessage `json:"created_at"` +} + type wecomIncomingMessage struct { MsgID string `json:"msgid"` AIBotID string `json:"aibotid"` diff --git a/pkg/channels/wecom/wecom.go b/pkg/channels/wecom/wecom.go index 11959c259..ac8f8d9c8 100644 --- a/pkg/channels/wecom/wecom.go +++ b/pkg/channels/wecom/wecom.go @@ -23,6 +23,7 @@ import ( const ( wecomConnectTimeout = 15 * time.Second wecomCommandTimeout = 10 * time.Second + wecomUploadTimeout = 30 * time.Second wecomHeartbeatInterval = 30 * time.Second wecomStreamMaxDuration = 5*time.Minute + 30*time.Second wecomRouteTTL = 30 * time.Minute @@ -49,7 +50,7 @@ type WeComChannel struct { recent *recentMessageSet routes *reqIDStore mediaClient *http.Client - commandSend func(wecomCommand, time.Duration) error + commandSend func(wecomCommand, time.Duration) (wecomEnvelope, error) } type wecomTurn struct { @@ -187,22 +188,74 @@ func (c *WeComChannel) SendMedia(ctx context.Context, msg bus.OutboundMediaMessa if !c.IsRunning() { return channels.ErrNotRunning } - var parts []string + + route, chatType, hasTurn := c.resolveMediaRoute(msg.ChatID) + chatID := route.ChatID + if chatID == "" { + chatID = msg.ChatID + } + for _, part := range msg.Parts { - switch { - case part.Caption != "": - parts = append(parts, part.Caption) - case part.Filename != "": - parts = append(parts, fmt.Sprintf("[media: %s]", part.Filename)) - default: - parts = append(parts, "[media attachments are not yet supported]") + if strings.TrimSpace(part.Ref) == "" { + if caption := strings.TrimSpace(part.Caption); caption != "" { + if err := c.sendActivePush(chatID, chatType, caption); err != nil { + return err + } + } + continue + } + + localPath, filename, contentType, cleanup, err := c.resolveOutboundPart(ctx, part) + if err != nil { + return fmt.Errorf("wecom resolve media %q: %v: %w", part.Ref, err, channels.ErrSendFailed) + } + + func() { + if cleanup != nil { + defer cleanup() + } + + uploaded, uploadErr := c.uploadOutboundMedia(ctx, localPath, filename, contentType, part) + if uploadErr != nil { + logger.WarnCF("wecom", "Falling back to placeholder after media upload failure", map[string]any{ + "chat_id": chatID, + "ref": part.Ref, + "filename": filename, + "content_type": contentType, + "error": uploadErr.Error(), + }) + if hasTurn { + if finishErr := c.sendStreamChunk(route, true, ""); finishErr != nil { + err = finishErr + return + } + c.deleteTurn(msg.ChatID) + hasTurn = false + } + err = c.sendActivePush(chatID, chatType, fallbackWeComMediaText(part, "", filename)) + return + } + + if hasTurn { + err = c.sendTurnMedia(route, uploaded) + c.deleteTurn(msg.ChatID) + hasTurn = false + } else { + err = c.sendActiveMedia(chatID, chatType, uploaded) + } + if err != nil { + return + } + if caption := strings.TrimSpace(part.Caption); caption != "" { + err = c.sendActivePush(chatID, chatType, caption) + } + }() + if err != nil { + return err } } - return c.Send(ctx, bus.OutboundMessage{ - Channel: msg.Channel, - ChatID: msg.ChatID, - Content: strings.Join(parts, "\n"), - }) + + return nil } func (c *WeComChannel) connectLoop() { @@ -620,6 +673,20 @@ func (c *WeComChannel) sendStreamChunk(turn wecomTurn, finish bool, content stri }, wecomCommandTimeout) } +func (c *WeComChannel) sendTurnMedia(turn wecomTurn, uploaded *wecomOutboundMedia) error { + if uploaded == nil { + return fmt.Errorf("wecom outbound media is nil: %w", channels.ErrSendFailed) + } + if err := c.sendCommand(wecomCommand{ + Cmd: wecomCmdRespondMsg, + Headers: wecomHeaders{ReqID: turn.ReqID}, + Body: uploaded.respondBody(), + }, wecomCommandTimeout); err != nil { + return err + } + return c.sendStreamChunk(turn, true, "") +} + func (c *WeComChannel) sendActivePush(chatID string, chatType uint32, content string) error { if strings.TrimSpace(chatID) == "" { return fmt.Errorf("empty chat ID: %w", channels.ErrSendFailed) @@ -641,24 +708,57 @@ func (c *WeComChannel) sendActivePush(chatID string, chatType uint32, content st return nil } +func (c *WeComChannel) sendActiveMedia(chatID string, chatType uint32, uploaded *wecomOutboundMedia) error { + if strings.TrimSpace(chatID) == "" { + return fmt.Errorf("empty chat ID: %w", channels.ErrSendFailed) + } + if uploaded == nil { + return fmt.Errorf("wecom outbound media is nil: %w", channels.ErrSendFailed) + } + return c.sendCommand(wecomCommand{ + Cmd: wecomCmdSendMsg, + Headers: wecomHeaders{ReqID: randomID(10)}, + Body: uploaded.sendBody(chatID, chatType), + }, wecomCommandTimeout) +} + func (c *WeComChannel) sendCommand(cmd wecomCommand, timeout time.Duration) error { + _, err := c.sendCommandAck(cmd, timeout) + return err +} + +func (c *WeComChannel) sendCommandAck(cmd wecomCommand, timeout time.Duration) (wecomEnvelope, error) { if c.commandSend != nil { return c.commandSend(cmd, timeout) } - return c.writeCurrent(cmd, timeout) + return c.writeCurrentAck(cmd, timeout) } func (c *WeComChannel) writeCurrent(cmd wecomCommand, timeout time.Duration) error { + _, err := c.writeCurrentAck(cmd, timeout) + return err +} + +func (c *WeComChannel) writeCurrentAck(cmd wecomCommand, timeout time.Duration) (wecomEnvelope, error) { c.connMu.Lock() conn := c.conn c.connMu.Unlock() if conn == nil { - return fmt.Errorf("wecom websocket not connected: %w", channels.ErrTemporary) + return wecomEnvelope{}, fmt.Errorf("wecom websocket not connected: %w", channels.ErrTemporary) } - return c.writeAndWait(conn, cmd, timeout) + return c.writeAndWaitAck(conn, cmd, timeout) } func (c *WeComChannel) writeAndWait(conn *websocket.Conn, cmd wecomCommand, timeout time.Duration) error { + _, err := c.writeAndWaitAck(conn, cmd, timeout) + return err +} + +func (c *WeComChannel) writeAndWaitAck( + conn *websocket.Conn, + cmd wecomCommand, + timeout time.Duration, +) (wecomEnvelope, error) { if cmd.Headers.ReqID == "" { cmd.Headers.ReqID = randomID(10) } @@ -674,13 +774,13 @@ func (c *WeComChannel) writeAndWait(conn *websocket.Conn, cmd wecomCommand, time data, err := json.Marshal(cmd) if err != nil { - return fmt.Errorf("%w: %v", channels.ErrSendFailed, err) + return wecomEnvelope{}, fmt.Errorf("%w: %v", channels.ErrSendFailed, err) } c.connMu.Lock() err = conn.WriteMessage(websocket.TextMessage, data) c.connMu.Unlock() if err != nil { - return fmt.Errorf("%w: %v", channels.ErrTemporary, err) + return wecomEnvelope{}, fmt.Errorf("%w: %v", channels.ErrTemporary, err) } timer := time.NewTimer(timeout) @@ -688,13 +788,13 @@ func (c *WeComChannel) writeAndWait(conn *websocket.Conn, cmd wecomCommand, time select { case env := <-waitCh: if env.ErrCode != 0 { - return fmt.Errorf("%w: wecom errcode=%d errmsg=%s", channels.ErrTemporary, env.ErrCode, env.ErrMsg) + return wecomEnvelope{}, fmt.Errorf("%w: wecom errcode=%d errmsg=%s", channels.ErrTemporary, env.ErrCode, env.ErrMsg) } - return nil + return env, nil case <-timer.C: - return fmt.Errorf("%w: timeout waiting for WeCom ack", channels.ErrTemporary) + return wecomEnvelope{}, fmt.Errorf("%w: timeout waiting for WeCom ack", channels.ErrTemporary) case <-c.ctx.Done(): - return c.ctx.Err() + return wecomEnvelope{}, c.ctx.Err() } } diff --git a/pkg/channels/wecom/wecom_test.go b/pkg/channels/wecom/wecom_test.go index e0ee2e628..45176015f 100644 --- a/pkg/channels/wecom/wecom_test.go +++ b/pkg/channels/wecom/wecom_test.go @@ -2,13 +2,16 @@ package wecom import ( "context" + "encoding/json" "errors" + "os" "path/filepath" "testing" "time" "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/media" ) func TestDispatchIncoming_UsesActualChatIDAndStoresReqIDRoute(t *testing.T) { @@ -18,9 +21,9 @@ func TestDispatchIncoming_UsesActualChatIDAndStoresReqIDRoute(t *testing.T) { ch := newTestWeComChannel(t, messageBus) var commands []wecomCommand - ch.commandSend = func(cmd wecomCommand, _ time.Duration) error { + ch.commandSend = func(cmd wecomCommand, _ time.Duration) (wecomEnvelope, error) { commands = append(commands, cmd) - return nil + return wecomTestAck(nil), nil } msg := wecomIncomingMessage{ @@ -107,12 +110,12 @@ func TestSend_StreamFailureFallsBackToActualChatID(t *testing.T) { } var commands []wecomCommand - ch.commandSend = func(cmd wecomCommand, _ time.Duration) error { + ch.commandSend = func(cmd wecomCommand, _ time.Duration) (wecomEnvelope, error) { commands = append(commands, cmd) if len(commands) == 1 && cmd.Cmd == wecomCmdRespondMsg { - return errors.New("stream send failed") + return wecomEnvelope{}, errors.New("stream send failed") } - return nil + return wecomTestAck(nil), nil } if err := ch.Send(context.Background(), bus.OutboundMessage{ @@ -152,6 +155,301 @@ func TestSend_StreamFailureFallsBackToActualChatID(t *testing.T) { } } +func TestSendMedia_SendsActiveImage(t *testing.T) { + t.Parallel() + + ch := newTestWeComChannel(t, bus.NewMessageBus()) + ch.SetRunning(true) + + store := media.NewFileMediaStore() + ch.SetMediaStore(store) + + imageData := wecomTestJPEGData(t) + imagePath := filepath.Join(t.TempDir(), "photo.jpg") + if err := os.WriteFile(imagePath, imageData, 0o600); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + ref, err := store.Store(imagePath, media.MediaMeta{ + Filename: "photo.jpg", + ContentType: "image/jpeg", + Source: "test", + CleanupPolicy: media.CleanupPolicyForgetOnly, + }, "scope-1") + if err != nil { + t.Fatalf("Store() error = %v", err) + } + + var commands []wecomCommand + ch.commandSend = func(cmd wecomCommand, _ time.Duration) (wecomEnvelope, error) { + commands = append(commands, cmd) + switch cmd.Cmd { + case wecomCmdUploadMediaInit: + return wecomTestAck(wecomUploadMediaInitResponse{UploadID: "upload-1"}), nil + case wecomCmdUploadMediaEnd: + return wecomTestAck(wecomUploadMediaFinishResponse{ + Type: "image", + MediaID: "media-1", + }), nil + default: + return wecomTestAck(nil), nil + } + } + + err = ch.SendMedia(context.Background(), bus.OutboundMediaMessage{ + Channel: "wecom", + ChatID: "chat-1", + Parts: []bus.MediaPart{{ + Ref: ref, + Type: "image", + Filename: "photo.jpg", + ContentType: "image/jpeg", + }}, + }) + if err != nil { + t.Fatalf("SendMedia() error = %v", err) + } + + if len(commands) != 4 { + t.Fatalf("expected 4 commands, got %d", len(commands)) + } + if commands[0].Cmd != wecomCmdUploadMediaInit { + t.Fatalf("first command = %q, want %q", commands[0].Cmd, wecomCmdUploadMediaInit) + } + initBody, ok := commands[0].Body.(wecomUploadMediaInitBody) + if !ok { + t.Fatalf("unexpected init body type %T", commands[0].Body) + } + if initBody.Type != "image" || initBody.Filename != "photo.jpg" || initBody.TotalChunks != 1 { + t.Fatalf("init body = %+v", initBody) + } + if commands[1].Cmd != wecomCmdUploadMediaChunk { + t.Fatalf("second command = %q, want %q", commands[1].Cmd, wecomCmdUploadMediaChunk) + } + chunkBody, ok := commands[1].Body.(wecomUploadMediaChunkBody) + if !ok { + t.Fatalf("unexpected chunk body type %T", commands[1].Body) + } + if chunkBody.UploadID != "upload-1" || chunkBody.ChunkIndex != 0 || chunkBody.Base64Data == "" { + t.Fatalf("chunk body = %+v", chunkBody) + } + if commands[2].Cmd != wecomCmdUploadMediaEnd { + t.Fatalf("third command = %q, want %q", commands[2].Cmd, wecomCmdUploadMediaEnd) + } + if commands[3].Cmd != wecomCmdSendMsg { + t.Fatalf("fourth command = %q, want %q", commands[3].Cmd, wecomCmdSendMsg) + } + + body, ok := commands[3].Body.(wecomSendMsgBody) + if !ok { + t.Fatalf("unexpected send body type %T", commands[3].Body) + } + if body.MsgType != "image" || body.Image == nil { + t.Fatalf("send body = %+v", body) + } + if body.ChatID != "chat-1" { + t.Fatalf("send chatid = %q, want chat-1", body.ChatID) + } + if body.Image.MediaID != "media-1" { + t.Fatalf("image media_id = %q, want media-1", body.Image.MediaID) + } +} + +func TestSendMedia_UsesTurnImageAndFinishesStream(t *testing.T) { + t.Parallel() + + ch := newTestWeComChannel(t, bus.NewMessageBus()) + ch.SetRunning(true) + + store := media.NewFileMediaStore() + ch.SetMediaStore(store) + + imageData := wecomTestJPEGData(t) + imagePath := filepath.Join(t.TempDir(), "reply.jpg") + if err := os.WriteFile(imagePath, imageData, 0o600); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + ref, err := store.Store(imagePath, media.MediaMeta{ + Filename: "reply.jpg", + ContentType: "image/jpeg", + Source: "test", + CleanupPolicy: media.CleanupPolicyForgetOnly, + }, "scope-2") + if err != nil { + t.Fatalf("Store() error = %v", err) + } + + ch.queueTurn("chat-1", wecomTurn{ + ReqID: "req-1", + ChatID: "chat-1", + ChatType: 1, + StreamID: "stream-1", + CreatedAt: time.Now(), + }) + if err := ch.routes.Put("chat-1", "req-1", 1, time.Hour); err != nil { + t.Fatalf("Put() error = %v", err) + } + + var commands []wecomCommand + ch.commandSend = func(cmd wecomCommand, _ time.Duration) (wecomEnvelope, error) { + commands = append(commands, cmd) + switch cmd.Cmd { + case wecomCmdUploadMediaInit: + return wecomTestAck(wecomUploadMediaInitResponse{UploadID: "upload-2"}), nil + case wecomCmdUploadMediaEnd: + return wecomTestAck(wecomUploadMediaFinishResponse{ + Type: "image", + MediaID: "media-2", + }), nil + default: + return wecomTestAck(nil), nil + } + } + + err = ch.SendMedia(context.Background(), bus.OutboundMediaMessage{ + Channel: "wecom", + ChatID: "chat-1", + Parts: []bus.MediaPart{{ + Ref: ref, + Type: "image", + Filename: "reply.jpg", + ContentType: "image/jpeg", + }}, + }) + if err != nil { + t.Fatalf("SendMedia() error = %v", err) + } + + if len(commands) != 5 { + t.Fatalf("expected 5 commands, got %d", len(commands)) + } + if commands[0].Cmd != wecomCmdUploadMediaInit { + t.Fatalf("first command = %+v", commands[0]) + } + if commands[1].Cmd != wecomCmdUploadMediaChunk { + t.Fatalf("second command = %+v", commands[1]) + } + if commands[2].Cmd != wecomCmdUploadMediaEnd { + t.Fatalf("third command = %+v", commands[2]) + } + if commands[3].Cmd != wecomCmdRespondMsg || commands[3].Headers.ReqID != "req-1" { + t.Fatalf("fourth command = %+v", commands[3]) + } + if commands[4].Cmd != wecomCmdRespondMsg || commands[4].Headers.ReqID != "req-1" { + t.Fatalf("fifth command = %+v", commands[4]) + } + + imageBody, ok := commands[3].Body.(wecomRespondMsgBody) + if !ok { + t.Fatalf("unexpected image body type %T", commands[3].Body) + } + if imageBody.MsgType != "image" || imageBody.Image == nil { + t.Fatalf("image body = %+v", imageBody) + } + if imageBody.Image.MediaID != "media-2" { + t.Fatalf("image media_id = %q, want media-2", imageBody.Image.MediaID) + } + + streamBody, ok := commands[4].Body.(wecomRespondMsgBody) + if !ok { + t.Fatalf("unexpected finish body type %T", commands[4].Body) + } + if streamBody.MsgType != "stream" || streamBody.Stream == nil || !streamBody.Stream.Finish { + t.Fatalf("finish body = %+v", streamBody) + } + + if _, ok := ch.getTurn("chat-1"); ok { + t.Fatal("expected turn to be removed after media send") + } +} + +func TestSendMedia_SendsActiveFile(t *testing.T) { + t.Parallel() + + ch := newTestWeComChannel(t, bus.NewMessageBus()) + ch.SetRunning(true) + + store := media.NewFileMediaStore() + ch.SetMediaStore(store) + + filePath := filepath.Join(t.TempDir(), "report.pdf") + if err := os.WriteFile(filePath, []byte("%PDF-1.4"), 0o600); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + ref, err := store.Store(filePath, media.MediaMeta{ + Filename: "report.pdf", + ContentType: "application/pdf", + Source: "test", + CleanupPolicy: media.CleanupPolicyForgetOnly, + }, "scope-3") + if err != nil { + t.Fatalf("Store() error = %v", err) + } + + var commands []wecomCommand + ch.commandSend = func(cmd wecomCommand, _ time.Duration) (wecomEnvelope, error) { + commands = append(commands, cmd) + switch cmd.Cmd { + case wecomCmdUploadMediaInit: + return wecomTestAck(wecomUploadMediaInitResponse{UploadID: "upload-3"}), nil + case wecomCmdUploadMediaEnd: + return wecomTestAck(wecomUploadMediaFinishResponse{ + Type: "file", + MediaID: "media-3", + }), nil + default: + return wecomTestAck(nil), nil + } + } + + err = ch.SendMedia(context.Background(), bus.OutboundMediaMessage{ + Channel: "wecom", + ChatID: "chat-2", + Parts: []bus.MediaPart{{ + Ref: ref, + Type: "file", + Filename: "report.pdf", + ContentType: "application/pdf", + }}, + }) + if err != nil { + t.Fatalf("SendMedia() error = %v", err) + } + + if len(commands) != 4 { + t.Fatalf("expected 4 commands, got %d", len(commands)) + } + if commands[0].Cmd != wecomCmdUploadMediaInit { + t.Fatalf("first command = %q, want %q", commands[0].Cmd, wecomCmdUploadMediaInit) + } + initBody, ok := commands[0].Body.(wecomUploadMediaInitBody) + if !ok { + t.Fatalf("unexpected init body type %T", commands[0].Body) + } + if initBody.Type != "file" || initBody.Filename != "report.pdf" { + t.Fatalf("init body = %+v", initBody) + } + if commands[1].Cmd != wecomCmdUploadMediaChunk { + t.Fatalf("second command = %q, want %q", commands[1].Cmd, wecomCmdUploadMediaChunk) + } + if commands[2].Cmd != wecomCmdUploadMediaEnd { + t.Fatalf("third command = %q, want %q", commands[2].Cmd, wecomCmdUploadMediaEnd) + } + if commands[3].Cmd != wecomCmdSendMsg { + t.Fatalf("fourth command = %q, want %q", commands[3].Cmd, wecomCmdSendMsg) + } + + body, ok := commands[3].Body.(wecomSendMsgBody) + if !ok { + t.Fatalf("unexpected body type %T", commands[3].Body) + } + if body.MsgType != "file" || body.File == nil { + t.Fatalf("body = %+v", body) + } + if body.File.MediaID != "media-3" { + t.Fatalf("file media_id = %q, want media-3", body.File.MediaID) + } +} + func newTestWeComChannel(t *testing.T, messageBus *bus.MessageBus) *WeComChannel { t.Helper() @@ -165,3 +463,46 @@ func newTestWeComChannel(t *testing.T, messageBus *bus.MessageBus) *WeComChannel ch.routes = newReqIDStore(filepath.Join(t.TempDir(), "reqids.json")) return ch } + +func wecomTestJPEGData(t *testing.T) []byte { + t.Helper() + + const jpegBase64 = "/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAP//////////////////////////////////////////////////////////////////////////////////////" + + "//////////////////////////////////////////////////////////////////////////////////////////////2wBDAf//////////////////////////////////////////////////////////////////////////////////////" + + "//////////////////////////////////////////////////////////////////////////////////////////////wAARCAABAAEDASIAAhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAAAAb/xAAVEQEBAAAAAAAAAAAAAAAAAAAABf/aAAwDAQACEAMQAAAB6A//xAAVEAEBAAAAAAAAAAAAAAAAAAAAEf/aAAgBAQABBQJf/8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAwEBPwF//8QAFBEBAAAAAAAAAAAAAAAAAAAAEP/aAAgBAgEBPwF//8QAFBABAAAAAAAAAAAAAAAAAAAAEP/aAAgBAQAGPwJf/8QAFBABAAAAAAAAAAAAAAAAAAAAEP/aAAgBAQABPyFf/9k=" + + return decodeTestBase64(t, jpegBase64) +} + +func TestDecodeWeComUploadFinish_AcceptsNumericCreatedAt(t *testing.T) { + t.Parallel() + + resp, err := decodeWeComEnvelopeBody[wecomUploadMediaFinishResponse](wecomEnvelope{ + Body: json.RawMessage(`{"type":"file","media_id":"media-1","created_at":1380000000}`), + }) + if err != nil { + t.Fatalf("decodeWeComEnvelopeBody() error = %v", err) + } + if resp.Type != "file" || resp.MediaID != "media-1" { + t.Fatalf("response = %+v", resp) + } + if string(resp.CreatedAt) != "1380000000" { + t.Fatalf("created_at = %s, want 1380000000", string(resp.CreatedAt)) + } +} + +func wecomTestAck(body any) wecomEnvelope { + var raw []byte + if body != nil { + encoded, err := json.Marshal(body) + if err != nil { + panic(err) + } + raw = encoded + } + return wecomEnvelope{ + ErrCode: 0, + ErrMsg: "ok", + Body: raw, + } +} From 11b6b10d5947478e70c80acfc6c0841f8142bcca Mon Sep 17 00:00:00 2001 From: Hoshina Date: Tue, 24 Mar 2026 16:34:21 +0800 Subject: [PATCH 072/202] fix(linter): fix ci lint err --- pkg/channels/wecom/media.go | 12 ++++++++---- pkg/channels/wecom/wecom.go | 12 ++++++------ pkg/channels/wecom/wecom_test.go | 5 +++-- 3 files changed, 17 insertions(+), 12 deletions(-) diff --git a/pkg/channels/wecom/media.go b/pkg/channels/wecom/media.go index ebcc481e8..974a3bf4d 100644 --- a/pkg/channels/wecom/media.go +++ b/pkg/channels/wecom/media.go @@ -216,7 +216,10 @@ func detectWeComFiletype(data []byte) (string, string) { return normalizeWeComContentType(kind.MIME.Value), ext } -func detectWeComMediaMetadata(data []byte, fallbackName, fallbackContentType, resourceURL, contentDisposition string) (string, string) { +func detectWeComMediaMetadata( + data []byte, + fallbackName, fallbackContentType, resourceURL, contentDisposition string, +) (string, string) { filename := candidateWeComFilename(resourceURL, contentDisposition, fallbackName) if filename == "" { filename = "media" @@ -717,7 +720,7 @@ func (c *WeComChannel) uploadOutboundMedia( if end > len(data) { end = len(data) } - if err := c.sendCommand(wecomCommand{ + sendErr := c.sendCommand(wecomCommand{ Cmd: wecomCmdUploadMediaChunk, Headers: wecomHeaders{ReqID: randomID(10)}, Body: wecomUploadMediaChunkBody{ @@ -725,8 +728,9 @@ func (c *WeComChannel) uploadOutboundMedia( ChunkIndex: idx, Base64Data: base64.StdEncoding.EncodeToString(data[offset:end]), }, - }, wecomUploadTimeout); err != nil { - return nil, err + }, wecomUploadTimeout) + if sendErr != nil { + return nil, sendErr } } diff --git a/pkg/channels/wecom/wecom.go b/pkg/channels/wecom/wecom.go index ac8f8d9c8..075c1732f 100644 --- a/pkg/channels/wecom/wecom.go +++ b/pkg/channels/wecom/wecom.go @@ -734,11 +734,6 @@ func (c *WeComChannel) sendCommandAck(cmd wecomCommand, timeout time.Duration) ( return c.writeCurrentAck(cmd, timeout) } -func (c *WeComChannel) writeCurrent(cmd wecomCommand, timeout time.Duration) error { - _, err := c.writeCurrentAck(cmd, timeout) - return err -} - func (c *WeComChannel) writeCurrentAck(cmd wecomCommand, timeout time.Duration) (wecomEnvelope, error) { c.connMu.Lock() conn := c.conn @@ -788,7 +783,12 @@ func (c *WeComChannel) writeAndWaitAck( select { case env := <-waitCh: if env.ErrCode != 0 { - return wecomEnvelope{}, fmt.Errorf("%w: wecom errcode=%d errmsg=%s", channels.ErrTemporary, env.ErrCode, env.ErrMsg) + return wecomEnvelope{}, fmt.Errorf( + "%w: wecom errcode=%d errmsg=%s", + channels.ErrTemporary, + env.ErrCode, + env.ErrMsg, + ) } return env, nil case <-timer.C: diff --git a/pkg/channels/wecom/wecom_test.go b/pkg/channels/wecom/wecom_test.go index 45176015f..478423307 100644 --- a/pkg/channels/wecom/wecom_test.go +++ b/pkg/channels/wecom/wecom_test.go @@ -285,8 +285,9 @@ func TestSendMedia_UsesTurnImageAndFinishesStream(t *testing.T) { StreamID: "stream-1", CreatedAt: time.Now(), }) - if err := ch.routes.Put("chat-1", "req-1", 1, time.Hour); err != nil { - t.Fatalf("Put() error = %v", err) + putErr := ch.routes.Put("chat-1", "req-1", 1, time.Hour) + if putErr != nil { + t.Fatalf("Put() error = %v", putErr) } var commands []wecomCommand From 3b498d2e4b2b991c4c33cbc55e04d01cec307bbb Mon Sep 17 00:00:00 2001 From: Hoshina Date: Tue, 24 Mar 2026 20:17:16 +0800 Subject: [PATCH 073/202] feat(wecom): add channel-side streaming support --- pkg/channels/wecom/protocol.go | 1 - pkg/channels/wecom/wecom.go | 193 +++++++++++++++++++++++-------- pkg/channels/wecom/wecom_test.go | 151 ++++++++++++++++++++++++ 3 files changed, 294 insertions(+), 51 deletions(-) diff --git a/pkg/channels/wecom/protocol.go b/pkg/channels/wecom/protocol.go index 0190e70e5..f42ce3bf4 100644 --- a/pkg/channels/wecom/protocol.go +++ b/pkg/channels/wecom/protocol.go @@ -13,7 +13,6 @@ const ( wecomCmdUploadMediaInit = "aibot_upload_media_init" wecomCmdUploadMediaChunk = "aibot_upload_media_chunk" wecomCmdUploadMediaEnd = "aibot_upload_media_finish" - wecomMaxContentBytes = 20480 ) type wecomEnvelope struct { diff --git a/pkg/channels/wecom/wecom.go b/pkg/channels/wecom/wecom.go index 075c1732f..26e971921 100644 --- a/pkg/channels/wecom/wecom.go +++ b/pkg/channels/wecom/wecom.go @@ -26,6 +26,7 @@ const ( wecomUploadTimeout = 30 * time.Second wecomHeartbeatInterval = 30 * time.Second wecomStreamMaxDuration = 5*time.Minute + 30*time.Second + wecomStreamMinInterval = 500 * time.Millisecond wecomRouteTTL = 30 * time.Minute wecomMediaTimeout = 30 * time.Second wecomRecentMessageMax = 1000 @@ -61,6 +62,17 @@ type wecomTurn struct { CreatedAt time.Time } +type wecomStreamer struct { + channel *WeComChannel + chatID string + turn wecomTurn + + mu sync.Mutex + closed bool + lastSentAt time.Time + content string +} + type recentMessageSet struct { mu sync.Mutex seen map[string]struct{} @@ -109,7 +121,6 @@ func NewChannel(cfg config.WeComConfig, messageBus *bus.MessageBus) (*WeComChann cfg, messageBus, cfg.AllowFrom, - channels.WithMaxMessageLength(wecomMaxContentBytes), channels.WithReasoningChannelID(cfg.ReasoningChannelID), ) @@ -152,6 +163,27 @@ func (c *WeComChannel) Stop(_ context.Context) error { return nil } +func (c *WeComChannel) BeginStream(_ context.Context, chatID string) (channels.Streamer, error) { + if !c.IsRunning() { + return nil, channels.ErrNotRunning + } + + turn, ok := c.getTurn(chatID) + if !ok { + return nil, fmt.Errorf("wecom streaming unavailable: no active turn") + } + if time.Since(turn.CreatedAt) > wecomStreamMaxDuration { + c.consumeTurn(chatID, turn) + return nil, fmt.Errorf("wecom streaming unavailable: turn expired") + } + + return &wecomStreamer{ + channel: c, + chatID: chatID, + turn: turn, + }, nil +} + func (c *WeComChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { if !c.IsRunning() { return channels.ErrNotRunning @@ -164,11 +196,11 @@ func (c *WeComChannel) Send(ctx context.Context, msg bus.OutboundMessage) error if turn, ok := c.getTurn(msg.ChatID); ok { if time.Since(turn.CreatedAt) <= wecomStreamMaxDuration { if err := c.sendStreamReply(turn, content); err == nil { - c.deleteTurn(msg.ChatID) + c.consumeTurn(msg.ChatID, turn) return nil } } - c.deleteTurn(msg.ChatID) + c.consumeTurn(msg.ChatID, turn) } if route, ok := c.routes.Get(msg.ChatID); ok { @@ -649,13 +681,7 @@ func (c *WeComChannel) respondImmediate(reqID, content string) error { } func (c *WeComChannel) sendStreamReply(turn wecomTurn, content string) error { - chunks := splitContent(content, wecomMaxContentBytes) - for idx, chunk := range chunks { - if err := c.sendStreamChunk(turn, idx == len(chunks)-1, chunk); err != nil { - return err - } - } - return nil + return c.sendStreamChunk(turn, true, content) } func (c *WeComChannel) sendStreamChunk(turn wecomTurn, finish bool, content string) error { @@ -691,21 +717,16 @@ func (c *WeComChannel) sendActivePush(chatID string, chatType uint32, content st if strings.TrimSpace(chatID) == "" { return fmt.Errorf("empty chat ID: %w", channels.ErrSendFailed) } - for _, chunk := range splitContent(content, wecomMaxContentBytes) { - if err := c.sendCommand(wecomCommand{ - Cmd: wecomCmdSendMsg, - Headers: wecomHeaders{ReqID: randomID(10)}, - Body: wecomSendMsgBody{ - ChatID: chatID, - ChatType: chatType, - MsgType: "markdown", - Markdown: &wecomMarkdownContent{Content: chunk}, - }, - }, wecomCommandTimeout); err != nil { - return err - } - } - return nil + return c.sendCommand(wecomCommand{ + Cmd: wecomCmdSendMsg, + Headers: wecomHeaders{ReqID: randomID(10)}, + Body: wecomSendMsgBody{ + ChatID: chatID, + ChatType: chatType, + MsgType: "markdown", + Markdown: &wecomMarkdownContent{Content: content}, + }, + }, wecomCommandTimeout) } func (c *WeComChannel) sendActiveMedia(chatID string, chatType uint32, uploaded *wecomOutboundMedia) error { @@ -825,6 +846,26 @@ func (c *WeComChannel) queueTurn(chatID string, turn wecomTurn) { c.turns[chatID] = append(c.turns[chatID], turn) } +func (c *WeComChannel) consumeTurn(chatID string, turn wecomTurn) bool { + c.turnsMu.Lock() + defer c.turnsMu.Unlock() + + queue := c.turns[chatID] + if len(queue) == 0 { + return false + } + current := queue[0] + if current.ReqID != turn.ReqID || current.StreamID != turn.StreamID { + return false + } + if len(queue) == 1 { + delete(c.turns, chatID) + return true + } + c.turns[chatID] = queue[1:] + return true +} + func (c *WeComChannel) clearTurns() { c.turnsMu.Lock() c.turns = make(map[string][]wecomTurn) @@ -844,34 +885,86 @@ func randomID(n int) string { return string(buf) } -func splitContent(content string, maxBytes int) []string { - if content == "" { - return []string{""} +func (s *wecomStreamer) Update(ctx context.Context, content string) error { + s.mu.Lock() + defer s.mu.Unlock() + + if s.closed { + return nil } - if len(content) <= maxBytes { - return []string{content} + if err := s.validateActiveTurn(); err != nil { + return err } - chunks := channels.SplitMessage(content, maxBytes) - var result []string - for _, chunk := range chunks { - if len(chunk) <= maxBytes { - result = append(result, chunk) - continue - } - for len(chunk) > maxBytes { - end := maxBytes - for end > 0 && chunk[end]>>6 == 0b10 { - end-- + if err := ctx.Err(); err != nil { + return err + } + + if !s.lastSentAt.IsZero() { + wait := time.Until(s.lastSentAt.Add(wecomStreamMinInterval)) + if wait > 0 { + timer := time.NewTimer(wait) + defer timer.Stop() + select { + case <-ctx.Done(): + return ctx.Err() + case <-timer.C: } - if end == 0 { - end = maxBytes - } - result = append(result, chunk[:end]) - chunk = strings.TrimLeft(chunk[end:], " \t\r\n") - } - if chunk != "" { - result = append(result, chunk) } } - return result + + if err := s.channel.sendStreamChunk(s.turn, false, content); err != nil { + return err + } + s.content = content + s.lastSentAt = time.Now() + return nil +} + +func (s *wecomStreamer) Finalize(ctx context.Context, content string) error { + s.mu.Lock() + defer s.mu.Unlock() + + if s.closed { + return nil + } + if err := s.validateActiveTurn(); err != nil { + return err + } + if err := ctx.Err(); err != nil { + return err + } + if err := s.channel.sendStreamChunk(s.turn, true, content); err != nil { + return err + } + + s.content = content + s.closed = true + s.channel.consumeTurn(s.chatID, s.turn) + return nil +} + +func (s *wecomStreamer) Cancel(_ context.Context) { + s.mu.Lock() + defer s.mu.Unlock() + + if s.closed { + return + } + if s.validateActiveTurn() == nil { + _ = s.channel.sendStreamChunk(s.turn, true, s.content) + s.channel.consumeTurn(s.chatID, s.turn) + } + s.closed = true +} + +func (s *wecomStreamer) validateActiveTurn() error { + if time.Since(s.turn.CreatedAt) > wecomStreamMaxDuration { + s.channel.consumeTurn(s.chatID, s.turn) + return fmt.Errorf("wecom streaming unavailable: turn expired") + } + current, ok := s.channel.getTurn(s.chatID) + if !ok || current.ReqID != s.turn.ReqID || current.StreamID != s.turn.StreamID { + return fmt.Errorf("wecom streaming unavailable: turn no longer active") + } + return nil } diff --git a/pkg/channels/wecom/wecom_test.go b/pkg/channels/wecom/wecom_test.go index 478423307..c7a4adfc0 100644 --- a/pkg/channels/wecom/wecom_test.go +++ b/pkg/channels/wecom/wecom_test.go @@ -6,6 +6,7 @@ import ( "errors" "os" "path/filepath" + "strings" "testing" "time" @@ -86,6 +87,77 @@ func TestDispatchIncoming_UsesActualChatIDAndStoresReqIDRoute(t *testing.T) { } } +func TestNewChannel_DoesNotRegisterMessageSplitLimit(t *testing.T) { + t.Parallel() + + ch := newTestWeComChannel(t, bus.NewMessageBus()) + if got := ch.MaxMessageLength(); got != 0 { + t.Fatalf("MaxMessageLength() = %d, want 0", got) + } +} + +func TestBeginStream_UpdateAndFinalize(t *testing.T) { + t.Parallel() + + ch := newTestWeComChannel(t, bus.NewMessageBus()) + ch.SetRunning(true) + ch.queueTurn("chat-1", wecomTurn{ + ReqID: "req-1", + ChatID: "chat-1", + ChatType: 1, + StreamID: "stream-1", + CreatedAt: time.Now(), + }) + + var commands []wecomCommand + ch.commandSend = func(cmd wecomCommand, _ time.Duration) (wecomEnvelope, error) { + commands = append(commands, cmd) + return wecomTestAck(nil), nil + } + + streamer, err := ch.BeginStream(context.Background(), "chat-1") + if err != nil { + t.Fatalf("BeginStream() error = %v", err) + } + if err := streamer.Update(context.Background(), "draft"); err != nil { + t.Fatalf("Update() error = %v", err) + } + if err := streamer.Finalize(context.Background(), "final"); err != nil { + t.Fatalf("Finalize() error = %v", err) + } + + if len(commands) != 2 { + t.Fatalf("expected 2 commands, got %d", len(commands)) + } + for i, wantFinish := range []bool{false, true} { + if commands[i].Cmd != wecomCmdRespondMsg { + t.Fatalf("command[%d].Cmd = %q, want %q", i, commands[i].Cmd, wecomCmdRespondMsg) + } + body, ok := commands[i].Body.(wecomRespondMsgBody) + if !ok { + t.Fatalf("command[%d] body type = %T", i, commands[i].Body) + } + if body.Stream == nil { + t.Fatalf("command[%d] missing stream body", i) + } + if body.Stream.ID != "stream-1" { + t.Fatalf("command[%d] stream id = %q, want stream-1", i, body.Stream.ID) + } + if body.Stream.Finish != wantFinish { + t.Fatalf("command[%d] finish = %v, want %v", i, body.Stream.Finish, wantFinish) + } + } + if body := commands[0].Body.(wecomRespondMsgBody); body.Stream.Content != "draft" { + t.Fatalf("update content = %q, want draft", body.Stream.Content) + } + if body := commands[1].Body.(wecomRespondMsgBody); body.Stream.Content != "final" { + t.Fatalf("final content = %q, want final", body.Stream.Content) + } + if _, ok := ch.getTurn("chat-1"); ok { + t.Fatal("expected turn to be consumed after Finalize") + } +} + func TestSend_StreamFailureFallsBackToActualChatID(t *testing.T) { t.Parallel() @@ -155,6 +227,85 @@ func TestSend_StreamFailureFallsBackToActualChatID(t *testing.T) { } } +func TestSend_DoesNotSplitStreamReply(t *testing.T) { + t.Parallel() + + ch := newTestWeComChannel(t, bus.NewMessageBus()) + ch.SetRunning(true) + ch.queueTurn("chat-1", wecomTurn{ + ReqID: "req-1", + ChatID: "chat-1", + ChatType: 1, + StreamID: "stream-1", + CreatedAt: time.Now(), + }) + + var commands []wecomCommand + ch.commandSend = func(cmd wecomCommand, _ time.Duration) (wecomEnvelope, error) { + commands = append(commands, cmd) + return wecomTestAck(nil), nil + } + + content := strings.Repeat("\u4e2d", 30000) + if err := ch.Send(context.Background(), bus.OutboundMessage{ + Channel: "wecom", + ChatID: "chat-1", + Content: content, + }); err != nil { + t.Fatalf("Send() error = %v", err) + } + + if len(commands) != 1 { + t.Fatalf("expected 1 stream command, got %d", len(commands)) + } + body, ok := commands[0].Body.(wecomRespondMsgBody) + if !ok { + t.Fatalf("unexpected body type %T", commands[0].Body) + } + if body.Stream == nil || !body.Stream.Finish { + t.Fatalf("stream body = %+v", body.Stream) + } + if body.Stream.Content != content { + t.Fatalf("stream content length = %d, want %d", len(body.Stream.Content), len(content)) + } +} + +func TestSend_DoesNotSplitActivePush(t *testing.T) { + t.Parallel() + + ch := newTestWeComChannel(t, bus.NewMessageBus()) + ch.SetRunning(true) + + var commands []wecomCommand + ch.commandSend = func(cmd wecomCommand, _ time.Duration) (wecomEnvelope, error) { + commands = append(commands, cmd) + return wecomTestAck(nil), nil + } + + content := strings.Repeat("a", 30000) + if err := ch.Send(context.Background(), bus.OutboundMessage{ + Channel: "wecom", + ChatID: "chat-1", + Content: content, + }); err != nil { + t.Fatalf("Send() error = %v", err) + } + + if len(commands) != 1 { + t.Fatalf("expected 1 send command, got %d", len(commands)) + } + if commands[0].Cmd != wecomCmdSendMsg { + t.Fatalf("command = %q, want %q", commands[0].Cmd, wecomCmdSendMsg) + } + body, ok := commands[0].Body.(wecomSendMsgBody) + if !ok { + t.Fatalf("unexpected body type %T", commands[0].Body) + } + if body.Markdown == nil || body.Markdown.Content != content { + t.Fatalf("markdown content length = %d, want %d", len(body.Markdown.Content), len(content)) + } +} + func TestSendMedia_SendsActiveImage(t *testing.T) { t.Parallel() From cd48c3bde89ffcc66a1898657b9cd60dc805b274 Mon Sep 17 00:00:00 2001 From: Hoshina Date: Tue, 24 Mar 2026 20:27:31 +0800 Subject: [PATCH 074/202] fix(config): remove stale wecom security merge fields --- pkg/config/security.go | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/pkg/config/security.go b/pkg/config/security.go index 72f0c013f..47ad1a5b0 100644 --- a/pkg/config/security.go +++ b/pkg/config/security.go @@ -319,17 +319,9 @@ func mergeChannelsSecurity(dst, src *ChannelsSecurity) { if src.OneBot != nil && src.OneBot.AccessToken != "" { dst.OneBot = src.OneBot } - if src.WeCom != nil && (src.WeCom.Token != "" || src.WeCom.EncodingAESKey != "") { + if src.WeCom != nil && src.WeCom.Secret != "" { dst.WeCom = src.WeCom } - if src.WeComApp != nil && - (src.WeComApp.CorpSecret != "" || src.WeComApp.Token != "" || src.WeComApp.EncodingAESKey != "") { - dst.WeComApp = src.WeComApp - } - if src.WeComAIBot != nil && - (src.WeComAIBot.Secret != "" || src.WeComAIBot.Token != "" || src.WeComAIBot.EncodingAESKey != "") { - dst.WeComAIBot = src.WeComAIBot - } if src.Pico != nil && src.Pico.Token != "" { dst.Pico = src.Pico } From 4d7a629b7996145ff16a662832261c3e8b7954ed Mon Sep 17 00:00:00 2001 From: wenjie Date: Tue, 24 Mar 2026 20:33:32 +0800 Subject: [PATCH 075/202] feat(web): improve Weixin channel binding flow (#1968) - persist Weixin bindings, enable the channel automatically, and try to restart the gateway - refresh frontend channel and gateway state after successful binding - harden QR polling state handling and update related channel UI behavior - localize sidebar channel priority, add Weixin icon support, and add backend test coverage --- web/backend/api/weixin.go | 25 +++- web/backend/api/weixin_test.go | 56 ++++++++ web/frontend/src/api/channels.ts | 8 +- web/frontend/src/components/app-sidebar.tsx | 7 +- .../channels/channel-config-page.tsx | 104 ++++++++------ .../channels/channel-forms/weixin-form.tsx | 133 ++++++++++++++---- .../src/components/chat/user-message.tsx | 2 +- .../src/components/config/form-model.ts | 5 +- .../src/hooks/use-sidebar-channels.ts | 31 ++-- web/frontend/src/i18n/locales/en.json | 7 +- web/frontend/src/i18n/locales/zh.json | 7 +- 11 files changed, 290 insertions(+), 95 deletions(-) create mode 100644 web/backend/api/weixin_test.go diff --git a/web/backend/api/weixin.go b/web/backend/api/weixin.go index e7e94f39e..808b88c41 100644 --- a/web/backend/api/weixin.go +++ b/web/backend/api/weixin.go @@ -171,7 +171,7 @@ func (h *Handler) handlePollWeixinFlow(w http.ResponseWriter, r *http.Request) { h.setWeixinFlowError(flowID, "login confirmed but missing bot_token") break } - if saveErr := h.saveWeixinToken(statusResp.BotToken, statusResp.IlinkBotID); saveErr != nil { + if saveErr := h.saveWeixinBinding(statusResp.BotToken, statusResp.IlinkBotID); saveErr != nil { h.setWeixinFlowError(flowID, fmt.Sprintf("failed to save token: %v", saveErr)) logger.ErrorCF("weixin", "failed to save token", map[string]any{"error": saveErr.Error()}) break @@ -203,17 +203,34 @@ func (h *Handler) handlePollWeixinFlow(w http.ResponseWriter, r *http.Request) { _ = json.NewEncoder(w).Encode(resp) } -// saveWeixinToken writes the token and account ID into the config file. -func (h *Handler) saveWeixinToken(token, accountID string) error { +// saveWeixinBinding writes the token/account ID, enables the Weixin channel, +// and best-effort restarts the gateway when it is currently running. +func (h *Handler) saveWeixinBinding(token, accountID string) error { cfg, err := config.LoadConfig(h.configPath) if err != nil { return fmt.Errorf("load config: %w", err) } cfg.Channels.Weixin.SetToken(token) + cfg.Channels.Weixin.Enabled = true if accountID != "" { cfg.Channels.Weixin.AccountID = accountID } - return config.SaveConfig(h.configPath, cfg) + if err := config.SaveConfig(h.configPath, cfg); err != nil { + return err + } + + status := h.gatewayStatusData() + gatewayStatus, _ := status["gateway_status"].(string) + if gatewayStatus != "running" { + return nil + } + + if _, err := h.RestartGateway(); err != nil { + logger.ErrorCF("weixin", "failed to restart gateway after saving binding", map[string]any{ + "error": err.Error(), + }) + } + return nil } // generateQRDataURI encodes content as a QR code PNG and returns a data URI. diff --git a/web/backend/api/weixin_test.go b/web/backend/api/weixin_test.go new file mode 100644 index 000000000..03342b72b --- /dev/null +++ b/web/backend/api/weixin_test.go @@ -0,0 +1,56 @@ +package api + +import ( + "io" + "net/http" + "os" + "path/filepath" + "strconv" + "strings" + "testing" + "time" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestSaveWeixinBindingReturnsSuccessWhenRestartFails(t *testing.T) { + resetGatewayTestState(t) + + configPath := filepath.Join(t.TempDir(), "config.json") + cfg := config.DefaultConfig() + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + originalHealthGet := gatewayHealthGet + gatewayHealthGet = func(url string, timeout time.Duration) (*http.Response, error) { + return &http.Response{ + StatusCode: http.StatusOK, + Body: io.NopCloser(strings.NewReader( + `{"status":"ok","uptime":"1s","pid":` + strconv.Itoa(os.Getpid()) + `}`, + )), + }, nil + } + t.Cleanup(func() { + gatewayHealthGet = originalHealthGet + }) + + h := NewHandler(configPath) + if err := h.saveWeixinBinding("bot-token", "bot-account"); err != nil { + t.Fatalf("saveWeixinBinding() error = %v, want nil after config save succeeds", err) + } + + savedCfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + if got := savedCfg.Channels.Weixin.Token(); got != "bot-token" { + t.Fatalf("Weixin.Token() = %q, want %q", got, "bot-token") + } + if got := savedCfg.Channels.Weixin.AccountID; got != "bot-account" { + t.Fatalf("Weixin.AccountID = %q, want %q", got, "bot-account") + } + if !savedCfg.Channels.Weixin.Enabled { + t.Fatalf("Weixin.Enabled = false, want true") + } +} diff --git a/web/frontend/src/api/channels.ts b/web/frontend/src/api/channels.ts index c3d3a65f3..d4c3ac74b 100644 --- a/web/frontend/src/api/channels.ts +++ b/web/frontend/src/api/channels.ts @@ -76,8 +76,12 @@ export async function startWeixinFlow(): Promise { return request("/api/weixin/flows", { method: "POST" }) } -export async function pollWeixinFlow(flowID: string): Promise { - return request(`/api/weixin/flows/${encodeURIComponent(flowID)}`) +export async function pollWeixinFlow( + flowID: string, +): Promise { + return request( + `/api/weixin/flows/${encodeURIComponent(flowID)}`, + ) } export type { ChannelsCatalogResponse, ConfigActionResponse } diff --git a/web/frontend/src/components/app-sidebar.tsx b/web/frontend/src/components/app-sidebar.tsx index 702212857..0e135c0c1 100644 --- a/web/frontend/src/components/app-sidebar.tsx +++ b/web/frontend/src/components/app-sidebar.tsx @@ -67,14 +67,17 @@ const baseNavGroups: Omit[] = [ export function AppSidebar({ ...props }: React.ComponentProps) { const routerState = useRouterState() - const { t } = useTranslation() + const { i18n, t } = useTranslation() const currentPath = routerState.location.pathname const { channelItems, hasMoreChannels, showAllChannels, toggleShowAllChannels, - } = useSidebarChannels({ t }) + } = useSidebarChannels({ + language: (i18n.resolvedLanguage ?? i18n.language ?? "").toLowerCase(), + t, + }) const navGroups: NavGroup[] = React.useMemo(() => { return [ diff --git a/web/frontend/src/components/channels/channel-config-page.tsx b/web/frontend/src/components/channels/channel-config-page.tsx index 4996a6314..ee483d652 100644 --- a/web/frontend/src/components/channels/channel-config-page.tsx +++ b/web/frontend/src/components/channels/channel-config-page.tsx @@ -1,8 +1,6 @@ import { IconLoader2 } from "@tabler/icons-react" -import { useAtomValue } from "jotai" import { useCallback, useEffect, useMemo, useRef, useState } from "react" import { useTranslation } from "react-i18next" -import { toast } from "sonner" import { type ChannelConfig, @@ -21,7 +19,8 @@ import { WeixinForm } from "@/components/channels/channel-forms/weixin-form" import { PageHeader } from "@/components/page-header" import { Button } from "@/components/ui/button" import { Switch } from "@/components/ui/switch" -import { gatewayAtom } from "@/store/gateway" +import { useGateway } from "@/hooks/use-gateway" +import { refreshGatewayState } from "@/store/gateway" interface ChannelConfigPageProps { channelName: string @@ -241,7 +240,7 @@ const CHANNELS_WITHOUT_DOCS = new Set([ export function ChannelConfigPage({ channelName }: ChannelConfigPageProps) { const { t, i18n } = useTranslation() - const gateway = useAtomValue(gatewayAtom) + const { state: gatewayState } = useGateway() const [loading, setLoading] = useState(true) const [saving, setSaving] = useState(false) @@ -254,56 +253,59 @@ export function ChannelConfigPage({ channelName }: ChannelConfigPageProps) { const [editConfig, setEditConfig] = useState({}) const [enabled, setEnabled] = useState(false) - const loadData = useCallback(async (silent = false) => { - if (!silent) setLoading(true) - try { - const [catalog, appConfig] = await Promise.all([ - getChannelsCatalog(), - getAppConfig(), - ]) - const matched = - catalog.channels.find((item) => item.name === channelName) ?? null + const loadData = useCallback( + async (silent = false) => { + if (!silent) setLoading(true) + try { + const [catalog, appConfig] = await Promise.all([ + getChannelsCatalog(), + getAppConfig(), + ]) + const matched = + catalog.channels.find((item) => item.name === channelName) ?? null - if (!matched) { - setChannel(null) - setFetchError( - t("channels.page.notFound", { - name: channelName, - }), - ) - return + if (!matched) { + setChannel(null) + setFetchError( + t("channels.page.notFound", { + name: channelName, + }), + ) + return + } + + const channelsConfig = asRecord(asRecord(appConfig).channels) + const raw = asRecord(channelsConfig[matched.config_key]) + const normalized = normalizeConfig(matched, raw) + + setChannel(matched) + setBaseConfig(normalized) + setEditConfig(buildEditConfig(normalized)) + setEnabled(asBool(normalized.enabled)) + setFetchError("") + setServerError("") + setFieldErrors({}) + } catch (e) { + setFetchError(e instanceof Error ? e.message : t("channels.loadError")) + } finally { + if (!silent) setLoading(false) } - - const channelsConfig = asRecord(asRecord(appConfig).channels) - const raw = asRecord(channelsConfig[matched.config_key]) - const normalized = normalizeConfig(matched, raw) - - setChannel(matched) - setBaseConfig(normalized) - setEditConfig(buildEditConfig(normalized)) - setEnabled(asBool(normalized.enabled)) - setFetchError("") - setServerError("") - setFieldErrors({}) - } catch (e) { - setFetchError(e instanceof Error ? e.message : t("channels.loadError")) - } finally { - if (!silent) setLoading(false) - } - }, [channelName, t]) + }, + [channelName, t], + ) useEffect(() => { loadData() }, [loadData]) - const previousGatewayStatusRef = useRef(gateway.status) + const previousGatewayStatusRef = useRef(gatewayState) useEffect(() => { const previousStatus = previousGatewayStatusRef.current - if (previousStatus !== "running" && gateway.status === "running") { + if (previousStatus !== "running" && gatewayState === "running") { void loadData() } - previousGatewayStatusRef.current = gateway.status - }, [gateway.status, loadData]) + previousGatewayStatusRef.current = gatewayState + }, [gatewayState, loadData]) const savePayload = useMemo(() => { if (!channel) return null @@ -396,18 +398,28 @@ export function ChannelConfigPage({ channelName }: ChannelConfigPageProps) { [channel.config_key]: savePayload, }, }) - toast.success(t("channels.page.saveSuccess")) await loadData() } catch (e) { const message = e instanceof Error ? e.message : t("channels.page.saveError") setServerError(message) - toast.error(message) } finally { setSaving(false) } } + const handleWeixinBindSuccess = useCallback(async () => { + try { + setEnabled(true) + await Promise.all([loadData(true), refreshGatewayState({ force: true })]) + } catch (e) { + const message = + e instanceof Error ? e.message : t("channels.page.saveError") + setServerError(message) + await loadData(true) + } + }, [loadData, t]) + const renderForm = () => { if (!channel) return null const isEdit = configured @@ -455,7 +467,7 @@ export function ChannelConfigPage({ channelName }: ChannelConfigPageProps) { config={editConfig} onChange={handleChange} isEdit={isEdit} - onBindSuccess={() => void loadData(true)} + onBindSuccess={() => void handleWeixinBindSuccess()} /> ) default: diff --git a/web/frontend/src/components/channels/channel-forms/weixin-form.tsx b/web/frontend/src/components/channels/channel-forms/weixin-form.tsx index 765136b25..20e66ffc2 100644 --- a/web/frontend/src/components/channels/channel-forms/weixin-form.tsx +++ b/web/frontend/src/components/channels/channel-forms/weixin-form.tsx @@ -1,4 +1,10 @@ -import { IconLoader2, IconRefresh, IconCheck, IconX, IconQrcode } from "@tabler/icons-react" +import { + IconCheck, + IconLoader2, + IconQrcode, + IconRefresh, + IconX, +} from "@tabler/icons-react" import { useCallback, useEffect, useRef, useState } from "react" import { useTranslation } from "react-i18next" @@ -8,7 +14,14 @@ import { Field } from "@/components/shared-form" import { Button } from "@/components/ui/button" import { Input } from "@/components/ui/input" -type BindingState = "idle" | "loading" | "waiting" | "scaned" | "confirmed" | "expired" | "error" +type BindingState = + | "idle" + | "loading" + | "waiting" + | "scaned" + | "confirmed" + | "expired" + | "error" interface WeixinFormProps { config: ChannelConfig @@ -26,7 +39,12 @@ function asStringArray(value: unknown): string[] { return value.filter((item): item is string => typeof item === "string") } -export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFormProps) { +export function WeixinForm({ + config, + onChange, + isEdit, + onBindSuccess, +}: WeixinFormProps) { const { t } = useTranslation() const [bindState, setBindState] = useState("idle") @@ -35,10 +53,12 @@ export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFo const [errorMsg, setErrorMsg] = useState("") const pollTimerRef = useRef | null>(null) + const pollGenerationRef = useRef(0) const isBound = isEdit && asString(config.account_id) !== "" const existingAccountID = asString(config.account_id) const stopPolling = useCallback(() => { + pollGenerationRef.current += 1 if (pollTimerRef.current !== null) { clearInterval(pollTimerRef.current) pollTimerRef.current = null @@ -47,17 +67,32 @@ export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFo useEffect(() => () => stopPolling(), [stopPolling]) + useEffect(() => { + if (!existingAccountID) return + stopPolling() + setAccountID(existingAccountID) + setBindState("confirmed") + setErrorMsg("") + }, [existingAccountID, stopPolling]) + const startPolling = useCallback( (id: string) => { stopPolling() + const generation = pollGenerationRef.current + let inFlight = false pollTimerRef.current = setInterval(async () => { + if (inFlight) return + inFlight = true try { const resp = await pollWeixinFlow(id) + if (generation !== pollGenerationRef.current) { + return + } if (resp.status === "scaned") { setBindState("scaned") } else if (resp.status === "confirmed") { stopPolling() - setAccountID(resp.account_id ?? null) + setAccountID(resp.account_id ?? existingAccountID ?? null) setBindState("confirmed") onBindSuccess?.() } else if (resp.status === "expired") { @@ -70,10 +105,12 @@ export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFo } } catch { // transient network error — keep polling + } finally { + inFlight = false } }, 2000) }, - [stopPolling, onBindSuccess, t], + [existingAccountID, stopPolling, onBindSuccess, t], ) const handleBind = async () => { @@ -88,7 +125,9 @@ export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFo startPolling(resp.flow_id) } catch (e) { setBindState("error") - setErrorMsg(e instanceof Error ? e.message : t("channels.weixin.errorGeneric")) + setErrorMsg( + e instanceof Error ? e.message : t("channels.weixin.errorGeneric"), + ) } } @@ -111,9 +150,16 @@ export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFo {t("channels.weixin.bound")}
{existingAccountID && ( -

{existingAccountID}

+

+ {existingAccountID} +

)} - @@ -122,7 +168,9 @@ export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFo } return (
-

{t("channels.weixin.notBound")}

+

+ {t("channels.weixin.notBound")} +

@@ -174,15 +237,25 @@ export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFo return (
- +

{t("channels.weixin.bound")}

{accountID && ( -

{accountID}

+

+ {accountID} +

)} - @@ -196,7 +269,9 @@ export function WeixinForm({ config, onChange, isEdit, onBindSuccess }: WeixinFo
-

{t("channels.weixin.expired")}

+

+ {t("channels.weixin.expired")} +

+
+ {testResult && ( +
+ {testResult.allowed + ? `${t("pages.config.pattern_detector_result_allowed")}${testResult.matchedWhitelist ? ` (${testResult.matchedWhitelist})` : ""}` + : testResult.blocked + ? `${t("pages.config.pattern_detector_result_blocked")}${testResult.matchedBlacklist ? ` (${testResult.matchedBlacklist})` : ""}` + : t("pages.config.pattern_detector_result_no_match")} +
+ )} +
+ + Date: Wed, 25 Mar 2026 11:11:02 +0800 Subject: [PATCH 087/202] feat(models): add extra_body config field in model add/edit UI (#1969) * Add extraBody field to model configuration forms This adds a new field allowing users to specify additional JSON fields to inject into the request body when configuring models. * Handle ExtraBody clearing when frontend sends empty object The backend now interprets an empty object sent from the frontend as a signal to clear the ExtraBody field, while nil/undefined preserves the existing value. Frontend changed to send {} instead of undefined when the field is empty. --- web/backend/api/models.go | 5 ++++ .../src/components/models/add-model-sheet.tsx | 20 +++++++++++++++- .../components/models/edit-model-sheet.tsx | 23 ++++++++++++++++++- web/frontend/src/i18n/locales/en.json | 4 +++- web/frontend/src/i18n/locales/zh.json | 4 +++- 5 files changed, 52 insertions(+), 4 deletions(-) diff --git a/web/backend/api/models.go b/web/backend/api/models.go index ce7719906..38a55948b 100644 --- a/web/backend/api/models.go +++ b/web/backend/api/models.go @@ -204,8 +204,13 @@ func (h *Handler) handleUpdateModel(w http.ResponseWriter, r *http.Request) { } else { mc.ModelConfig.SetAPIKey(mc.APIKey) } + // Preserve existing ExtraBody when omitted (nil), but clear it when + // the frontend sends an empty object {} to indicate the field should + // be removed. if mc.ExtraBody == nil { mc.ExtraBody = cfg.ModelList[idx].ExtraBody + } else if len(mc.ExtraBody) == 0 { + mc.ExtraBody = nil } cfg.ModelList[idx] = &mc.ModelConfig diff --git a/web/frontend/src/components/models/add-model-sheet.tsx b/web/frontend/src/components/models/add-model-sheet.tsx index c760bc672..c0c48994f 100644 --- a/web/frontend/src/components/models/add-model-sheet.tsx +++ b/web/frontend/src/components/models/add-model-sheet.tsx @@ -12,6 +12,7 @@ import { } from "@/components/shared-form" import { Button } from "@/components/ui/button" import { Input } from "@/components/ui/input" +import { Textarea } from "@/components/ui/textarea" import { Sheet, SheetContent, @@ -34,6 +35,7 @@ interface AddForm { maxTokensField: string requestTimeout: string thinkingLevel: string + extraBody: string } const EMPTY_ADD_FORM: AddForm = { @@ -49,6 +51,7 @@ const EMPTY_ADD_FORM: AddForm = { maxTokensField: "", requestTimeout: "", thinkingLevel: "", + extraBody: "", } interface AddModelSheetProps { @@ -100,7 +103,7 @@ export function AddModelSheet({ } const setField = - (key: keyof AddForm) => (e: React.ChangeEvent) => { + (key: keyof AddForm) => (e: React.ChangeEvent) => { setForm((f) => ({ ...f, [key]: e.target.value })) if (fieldErrors[key]) { setFieldErrors((prev) => ({ ...prev, [key]: undefined })) @@ -129,6 +132,9 @@ export function AddModelSheet({ ? Number(form.requestTimeout) : undefined, thinking_level: form.thinkingLevel.trim() || undefined, + extra_body: form.extraBody.trim() + ? JSON.parse(form.extraBody.trim()) + : undefined, }) if (setAsDefault) { await setDefaultModel(modelName) @@ -305,6 +311,18 @@ export function AddModelSheet({ placeholder="max_completion_tokens" /> + + +