From dc037f0d79389d52f81c54a2c5177e0b24700251 Mon Sep 17 00:00:00 2001 From: kiannidev Date: Thu, 12 Mar 2026 02:22:04 +0200 Subject: [PATCH 001/234] fix(telegram): stop typing indicator when LLM fails or hangs --- pkg/agent/loop.go | 5 +++++ pkg/channels/manager.go | 13 +++++++++++ pkg/channels/manager_test.go | 37 +++++++++++++++++++++++++++++++ pkg/channels/telegram/telegram.go | 12 +++++++++- 4 files changed, 66 insertions(+), 1 deletion(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 28e549ce0..4860b9e2a 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -255,6 +255,11 @@ func (al *AgentLoop) Run(ctx context.Context) error { // Process message func() { + defer func() { + if al.channelManager != nil { + al.channelManager.InvokeTypingStop(msg.Channel, msg.ChatID) + } + }() // TODO: Re-enable media cleanup after inbound media is properly consumed by the agent. // Currently disabled because files are deleted before the LLM can access their content. // defer func() { diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go index 472895a7a..2c06feb38 100644 --- a/pkg/channels/manager.go +++ b/pkg/channels/manager.go @@ -130,6 +130,19 @@ func (m *Manager) RecordTypingStop(channel, chatID string, stop func()) { m.typingStops.Store(key, typingEntry{stop: stop, createdAt: time.Now()}) } +// InvokeTypingStop invokes the registered typing stop function for the given channel and chatID. +// It is safe to call even when no typing indicator is active (no-op). +// Used by the agent loop to stop typing when processing completes (success, error, or panic), +// regardless of whether an outbound message is published. +func (m *Manager) InvokeTypingStop(channel, chatID string) { + key := channel + ":" + chatID + if v, loaded := m.typingStops.LoadAndDelete(key); loaded { + if entry, ok := v.(typingEntry); ok { + entry.stop() + } + } +} + // RecordReactionUndo registers a reaction undo function for later invocation. // Implements PlaceholderRecorder. func (m *Manager) RecordReactionUndo(channel, chatID string, undo func()) { diff --git a/pkg/channels/manager_test.go b/pkg/channels/manager_test.go index 1f3a628c2..f92e4abb3 100644 --- a/pkg/channels/manager_test.go +++ b/pkg/channels/manager_test.go @@ -511,6 +511,43 @@ func TestPreSend_PlaceholderEditFails_FallsThrough(t *testing.T) { } } +func TestInvokeTypingStop_CallsRegisteredStop(t *testing.T) { + m := newTestManager() + var stopCalled bool + + m.RecordTypingStop("telegram", "chat123", func() { + stopCalled = true + }) + + m.InvokeTypingStop("telegram", "chat123") + + if !stopCalled { + t.Fatal("expected typing stop func to be called") + } +} + +func TestInvokeTypingStop_NoOpWhenNoEntry(t *testing.T) { + m := newTestManager() + // Should not panic + m.InvokeTypingStop("telegram", "nonexistent") +} + +func TestInvokeTypingStop_Idempotent(t *testing.T) { + m := newTestManager() + var callCount int + + m.RecordTypingStop("telegram", "chat123", func() { + callCount++ + }) + + m.InvokeTypingStop("telegram", "chat123") + m.InvokeTypingStop("telegram", "chat123") // Second call: entry already removed, no-op + + if callCount != 1 { + t.Fatalf("expected stop to be called once, got %d", callCount) + } +} + func TestPreSend_TypingStopCalled(t *testing.T) { m := newTestManager() var stopCalled bool diff --git a/pkg/channels/telegram/telegram.go b/pkg/channels/telegram/telegram.go index 34ee46b7b..5f86d24c9 100644 --- a/pkg/channels/telegram/telegram.go +++ b/pkg/channels/telegram/telegram.go @@ -242,10 +242,17 @@ func (c *TelegramChannel) sendHTMLChunk( return nil } +// maxTypingDuration limits how long the typing indicator can run. +// Prevents endless typing when the LLM fails/hangs and preSend never invokes cancel. +// Matches channels.Manager's typingStopTTL (5 min) so behavior is consistent. +const maxTypingDuration = 5 * time.Minute + // StartTyping implements channels.TypingCapable. // It sends ChatAction(typing) immediately and then repeats every 4 seconds // (Telegram's typing indicator expires after ~5s) in a background goroutine. // The returned stop function is idempotent and cancels the goroutine. +// The goroutine also exits automatically after maxTypingDuration if cancel is +// never called (e.g. when the LLM fails or times out without publishing). func (c *TelegramChannel) StartTyping(ctx context.Context, chatID string) (func(), error) { cid, threadID, err := parseTelegramChatID(chatID) if err != nil { @@ -259,12 +266,15 @@ func (c *TelegramChannel) StartTyping(ctx context.Context, chatID string) (func( _ = c.bot.SendChatAction(ctx, action) typingCtx, cancel := context.WithCancel(ctx) + // Cap lifetime so the goroutine cannot run indefinitely if cancel is never called + maxCtx, maxCancel := context.WithTimeout(typingCtx, maxTypingDuration) go func() { + defer maxCancel() ticker := time.NewTicker(4 * time.Second) defer ticker.Stop() for { select { - case <-typingCtx.Done(): + case <-maxCtx.Done(): return case <-ticker.C: a := tu.ChatAction(tu.ID(cid), telego.ChatActionTyping) From 1c123e016223d2a9e67c1427a08fd884c1e581bc Mon Sep 17 00:00:00 2001 From: Cytown Date: Wed, 11 Mar 2026 16:33:01 +0800 Subject: [PATCH 002/234] refactor Config to add Version and migratable --- README.fr.md | 2 +- README.ja.md | 2 +- README.md | 3 +- README.pt-br.md | 2 +- README.vi.md | 2 +- README.zh.md | 3 +- assets/wechat.png | Bin 356550 -> 352888 bytes cmd/picoclaw-launcher-tui/internal/ui/app.go | 6 +- .../internal/ui/model.go | 12 +- cmd/picoclaw/internal/auth/helpers.go | 23 -- cmd/picoclaw/internal/helpers.go | 7 +- cmd/picoclaw/internal/helpers_test.go | 6 +- cmd/picoclaw/internal/status/helpers.go | 42 -- config/config.example.json | 12 + docs/channels/matrix/README.md | 7 +- docs/config-versioning.md | 230 +++++++++++ go.mod | 3 +- go.sum | 2 + pkg/agent/context.go | 5 +- pkg/agent/instance_test.go | 8 +- pkg/agent/loop.go | 193 ++++----- pkg/agent/loop_mcp.go | 184 +++++++++ pkg/agent/loop_test.go | 78 +++- pkg/agent/registry_test.go | 2 +- pkg/auth/store.go | 5 +- pkg/bus/types.go | 7 +- pkg/channels/base.go | 17 +- pkg/channels/dingtalk/dingtalk.go | 4 + pkg/channels/discord/discord.go | 29 +- pkg/channels/manager.go | 54 +++ pkg/channels/manager_test.go | 301 +++++++++++++- pkg/channels/matrix/matrix.go | 28 +- pkg/channels/matrix/matrix_test.go | 50 +++ pkg/channels/qq/qq.go | 1 + pkg/channels/slack/slack.go | 6 +- pkg/channels/telegram/telegram.go | 16 +- pkg/channels/wecom/app_test.go | 6 +- pkg/channels/wecom/bot_test.go | 7 +- pkg/channels/wecom/common.go | 2 +- pkg/config/config.go | 219 +++++----- pkg/config/config_old.go | 108 +++++ pkg/config/config_test.go | 197 +++++---- pkg/config/defaults.go | 25 +- pkg/config/migration.go | 87 +++- pkg/config/migration_test.go | 133 +++--- pkg/config/model_config_test.go | 99 +---- pkg/env.go | 13 + pkg/logger/logger.go | 190 +++++---- pkg/logger/logger_3rd_party.go | 95 +++++ pkg/memory/migration.go | 6 + pkg/memory/migration_test.go | 52 +++ pkg/migrate/internal/common.go | 6 +- pkg/migrate/sources/openclaw/common.go | 1 - .../sources/openclaw/openclaw_config.go | 1 + .../sources/openclaw/openclaw_config_test.go | 14 + pkg/providers/claude_cli_provider_test.go | 8 +- pkg/providers/factory.go | 377 ------------------ pkg/providers/factory_provider.go | 4 +- pkg/providers/factory_provider_test.go | 24 ++ pkg/providers/factory_test.go | 227 +---------- pkg/providers/legacy_provider.go | 17 - pkg/providers/openai_compat/provider.go | 62 ++- pkg/providers/openai_compat/provider_test.go | 154 +++++++ pkg/routing/route_test.go | 2 +- pkg/session/manager.go | 4 +- pkg/skills/loader.go | 169 ++++++-- pkg/skills/loader_test.go | 75 ++++ pkg/state/state.go | 4 +- pkg/state/state_test.go | 16 +- pkg/tools/cron.go | 22 +- pkg/tools/cron_test.go | 116 ++++++ pkg/tools/shell.go | 37 ++ pkg/tools/shell_test.go | 79 ++++ pkg/tools/web.go | 147 ++++++- pkg/tools/web_test.go | 210 ++++++++++ pkg/voice/transcriber.go | 6 +- pkg/voice/transcriber_test.go | 12 - web/backend/api/config.go | 45 +-- web/backend/api/config_test.go | 88 ++++ web/backend/api/gateway.go | 71 ++-- web/backend/api/gateway_host.go | 66 +++ web/backend/api/gateway_host_test.go | 59 +++ web/backend/api/gateway_test.go | 276 ++++++++++++- web/backend/api/launcher_config_test.go | 2 +- web/backend/api/log.go | 8 +- web/backend/api/model_status.go | 324 +++++++++++++++ web/backend/api/models.go | 19 +- web/backend/api/models_test.go | 313 +++++++++++++++ web/backend/api/oauth.go | 11 - web/backend/api/oauth_test.go | 4 - web/backend/api/pico.go | 24 +- web/backend/api/router.go | 22 +- web/backend/api/session.go | 348 +++++++++++++--- web/backend/api/session_test.go | 322 +++++++++++++++ web/backend/api/skills.go | 331 +++++++++++++++ web/backend/api/skills_test.go | 336 ++++++++++++++++ web/backend/api/tools.go | 323 +++++++++++++++ web/backend/api/tools_test.go | 198 +++++++++ web/backend/dist/.gitkeep | 1 + web/backend/main.go | 15 +- web/backend/{utils.go => utils/banner.go} | 50 +-- web/backend/utils/onboard.go | 42 ++ web/backend/utils/onboard_test.go | 101 +++++ web/backend/utils/runtime.go | 80 ++++ web/frontend/package.json | 2 +- web/frontend/pnpm-lock.yaml | 65 +-- web/frontend/src/api/gateway.ts | 8 + web/frontend/src/api/sessions.ts | 1 + web/frontend/src/api/skills.ts | 79 ++++ web/frontend/src/api/tools.ts | 56 +++ web/frontend/src/components/app-sidebar.tsx | 23 ++ .../src/components/chat/chat-page.tsx | 19 +- .../components/chat/session-history-menu.tsx | 15 +- .../src/components/config/config-page.tsx | 5 + .../src/components/config/config-sections.tsx | 7 + .../src/components/config/form-model.ts | 8 + .../src/components/skills/skills-page.tsx | 314 +++++++++++++++ .../src/components/tools/tools-page.tsx | 190 +++++++++ web/frontend/src/hooks/use-pico-chat.ts | 56 ++- web/frontend/src/hooks/use-session-history.ts | 26 +- .../src/hooks/use-sidebar-channels.ts | 2 +- web/frontend/src/i18n/locales/en.json | 105 ++++- web/frontend/src/i18n/locales/zh.json | 105 ++++- web/frontend/src/routeTree.gen.ts | 71 ++++ web/frontend/src/routes/agent.tsx | 22 + web/frontend/src/routes/agent/skills.tsx | 11 + web/frontend/src/routes/agent/tools.tsx | 11 + web/frontend/src/routes/logs.tsx | 65 ++- 128 files changed, 7357 insertions(+), 1773 deletions(-) create mode 100644 docs/config-versioning.md create mode 100644 pkg/agent/loop_mcp.go create mode 100644 pkg/config/config_old.go create mode 100644 pkg/env.go create mode 100644 pkg/logger/logger_3rd_party.go create mode 100644 pkg/tools/cron_test.go create mode 100644 web/backend/api/config_test.go create mode 100644 web/backend/api/gateway_host.go create mode 100644 web/backend/api/gateway_host_test.go create mode 100644 web/backend/api/model_status.go create mode 100644 web/backend/api/models_test.go create mode 100644 web/backend/api/session_test.go create mode 100644 web/backend/api/skills.go create mode 100644 web/backend/api/skills_test.go create mode 100644 web/backend/api/tools.go create mode 100644 web/backend/api/tools_test.go rename web/backend/{utils.go => utils/banner.go} (54%) create mode 100644 web/backend/utils/onboard.go create mode 100644 web/backend/utils/onboard_test.go create mode 100644 web/backend/utils/runtime.go create mode 100644 web/frontend/src/api/skills.ts create mode 100644 web/frontend/src/api/tools.ts create mode 100644 web/frontend/src/components/skills/skills-page.tsx create mode 100644 web/frontend/src/components/tools/tools-page.tsx create mode 100644 web/frontend/src/routes/agent.tsx create mode 100644 web/frontend/src/routes/agent/skills.tsx create mode 100644 web/frontend/src/routes/agent/tools.tsx diff --git a/README.fr.md b/README.fr.md index 08a1926b6..574402a3e 100644 --- a/README.fr.md +++ b/README.fr.md @@ -649,7 +649,6 @@ PicoClaw stocke les données dans votre workspace configuré (par défaut : `~/. ├── HEARTBEAT.md # Invites de tâches périodiques (vérifiées toutes les 30 min) ├── IDENTITY.md # Identité de l'Agent ├── SOUL.md # Âme de l'Agent -├── TOOLS.md # Description des outils └── USER.md # Préférences utilisateur ``` @@ -980,6 +979,7 @@ Cette conception permet également le **support multi-agent** avec une sélectio | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [Obtenir Clé](https://cerebras.ai) | | **Volcengine** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [Obtenir Clé](https://console.volcengine.com) | | **ShengsuanYun** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [Obtenir une clé](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | Custom | OAuth uniquement | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | diff --git a/README.ja.md b/README.ja.md index c4c5b27a0..1eb47cfdc 100644 --- a/README.ja.md +++ b/README.ja.md @@ -610,7 +610,6 @@ PicoClaw は設定されたワークスペース（デフォルト: `~/.picoclaw ├── HEARTBEAT.md # 定期タスクプロンプト（30分ごとに確認） ├── IDENTITY.md # エージェントのアイデンティティ ├── SOUL.md # エージェントのソウル -├── TOOLS.md # ツールの説明 └── USER.md # ユーザー設定 ``` @@ -921,6 +920,7 @@ HEARTBEAT_OK 応答 ユーザーが直接結果を受け取る | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [キーを取得](https://cerebras.ai) | | **Volcengine** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [キーを取得](https://console.volcengine.com) | | **ShengsuanYun** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [キーを取得](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | カスタム | OAuthのみ | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | diff --git a/README.md b/README.md index bae3fa681..55e9fb187 100644 --- a/README.md +++ b/README.md @@ -787,7 +787,6 @@ PicoClaw stores data in your configured workspace (default: `~/.picoclaw/workspa ├── HEARTBEAT.md # Periodic task prompts (checked every 30 min) ├── IDENTITY.md # Agent identity ├── SOUL.md # Agent soul -├── TOOLS.md # Tool descriptions └── USER.md # User preferences ``` @@ -1034,6 +1033,7 @@ This design also enables **multi-agent support** with flexible provider selectio | **火山引擎** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [Get Key](https://console.volcengine.com) | | **神算云** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | | **Vivgrid** | `vivgrid/` | `https://api.vivgrid.com/v1` | OpenAI | [Get Key](https://vivgrid.com) | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [Get Key](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | Custom | OAuth only | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | @@ -1504,3 +1504,4 @@ This happens when another instance of the bot is running. Make sure only one `pi | **SearXNG** | Unlimited (self-hosted) | Privacy-focused metasearch (70+ engines) | | **Groq** | Free tier available | Fast inference (Llama, Mixtral) | | **Cerebras** | Free tier available | Fast inference (Llama, Qwen, etc.) | +| **LongCat** | Up to 5M tokens/day | Fast inference (free tier) | diff --git a/README.pt-br.md b/README.pt-br.md index 5f37ba457..066d71d6a 100644 --- a/README.pt-br.md +++ b/README.pt-br.md @@ -645,7 +645,6 @@ O PicoClaw armazena dados no workspace configurado (padrão: `~/.picoclaw/worksp ├── HEARTBEAT.md # Prompts de tarefas periodicas (verificado a cada 30 min) ├── IDENTITY.md # Identidade do Agente ├── SOUL.md # Alma do Agente -├── TOOLS.md # Descrição das ferramentas └── USER.md # Preferencias do usuario ``` @@ -976,6 +975,7 @@ Este design também possibilita o **suporte multi-agent** com seleção flexíve | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [Obter Chave](https://cerebras.ai) | | **Volcengine** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [Obter Chave](https://console.volcengine.com) | | **ShengsuanYun** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [Obter Chave](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | Custom | Apenas OAuth | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | diff --git a/README.vi.md b/README.vi.md index 92c6ecbae..66573a1c5 100644 --- a/README.vi.md +++ b/README.vi.md @@ -617,7 +617,6 @@ PicoClaw lưu trữ dữ liệu trong workspace đã cấu hình (mặc định: ├── HEARTBEAT.md # Prompt tác vụ định kỳ (kiểm tra mỗi 30 phút) ├── IDENTITY.md # Danh tính Agent ├── SOUL.md # Tâm hồn/Tính cách Agent -├── TOOLS.md # Mô tả công cụ └── USER.md # Tùy chọn người dùng ``` @@ -945,6 +944,7 @@ Thiết kế này cũng cho phép **hỗ trợ đa tác nhân** với lựa ch | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [Lấy Khóa](https://cerebras.ai) | | **Volcengine** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [Lấy Khóa](https://console.volcengine.com) | | **ShengsuanYun** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [Lấy Key](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | Tùy chỉnh | Chỉ OAuth | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | diff --git a/README.zh.md b/README.zh.md index c744e0d20..a3a4c7f5f 100644 --- a/README.zh.md +++ b/README.zh.md @@ -365,7 +365,6 @@ PicoClaw 将数据存储在您配置的工作区中（默认：`~/.picoclaw/work ├── HEARTBEAT.md # 周期性任务提示词 (每 30 分钟检查一次) ├── IDENTITY.md # Agent 身份设定 ├── SOUL.md # Agent 灵魂/性格 -├── TOOLS.md # 工具描述 └── USER.md # 用户偏好 ``` @@ -517,6 +516,7 @@ Agent 读取 HEARTBEAT.md | **Cerebras** | `cerebras/` | `https://api.cerebras.ai/v1` | OpenAI | [获取密钥](https://cerebras.ai) | | **火山引擎** | `volcengine/` | `https://ark.cn-beijing.volces.com/api/v3` | OpenAI | [获取密钥](https://console.volcengine.com) | | **神算云** | `shengsuanyun/` | `https://router.shengsuanyun.com/api/v1` | OpenAI | - | +| **LongCat** | `longcat/` | `https://api.longcat.chat/openai` | OpenAI | [获取密钥](https://longcat.chat/platform) | | **Antigravity** | `antigravity/` | Google Cloud | 自定义 | 仅 OAuth | | **GitHub Copilot** | `github-copilot/` | `localhost:4321` | gRPC | - | @@ -879,3 +879,4 @@ Discord: [https://discord.gg/V4sAZ9XWpN](https://discord.gg/V4sAZ9XWpN) | **Brave Search** | 2000 次查询/月 | 网络搜索功能 | | **Tavily** | 1000 次查询/月 | AI Agent 搜索优化 | | **Groq** | 提供免费层级 | 极速推理 (Llama, Mixtral) | +| **LongCat** | 最多 5M tokens/天 | 推理速度快 (免费额度) | diff --git a/assets/wechat.png b/assets/wechat.png index 4442ef2c7153ceb05250bc0a7ec3e83ca0aa54b7..4cfcbbb1a8a24f35dfceb8554aee56f2fb1c8ec9 100644 GIT binary patch literal 352888 zcmeGEbz56e*DVfXEm8rB7AY<6Ry24^pjhxga47EX)>4XEI6$$D{NQe)DPyXjfWnMC$3nqCB||nwHbK5cQOW=BxfCiR z3i`k6$om9YpkVw@8xZpN`1c9xfA3H%o;R@!7 zK_0N}KS7*OP@WMyzEM#Ul1Ncd#8G4!M;s;KQTPu)4Z?+zvvMe9gG_{=MxvFl}6D-TTmOim$1P7L{jpW5C1qzdCpv7Uuu{)_;ffADjKxTL1Adga7*0zi|0)B>oRf z{TCqq3lRTJKFDDBZ>s(ekNE#PgAjiA7=d5T-zo7Xt_mL)na@^eywBgg36wwgZh}g| z3d)`(BaZuL6?H0o?_8(*%y=~tas4KR2NeyL!Y&<;eKk4<^{Di>5<_^rNII*pCfd0; z-uNxt@7#@>*QNN)l{79tBryrweWE0J?1w~tDX}q8@2H6k^az2zZ&5QxskE z3tq~qL2b8Qmh!CObWqf8Qzy}}rCQIJip|&IS2}a5U`xAGibu<$`!6PkkeJGwB<%O=0X3%H!F$#pzaLC z|CtI=vgf_FPxCx2{keB58t-lY?j;wvmw{w!(9V9Hn%rgTIo#7^DU2&)lLWycv>xbj zA2T|zsHMB*O-7+lS?xZ**>iTPTuy_AGyzAn|45!5y>2)g8ubwZD=ii;7g+Xp7W~!a zd^qNpR(*<9)gk|mzTocbXNV+)u5DQdM?pd+j`4V6-kURFpPfVp*!%e&Xv5$fI3U%} z+eLM=(bsF!W8}_*%6sA1E}{-l3P_DFb6}fv@i2MT`fD<7d0y0x9>D(C`5+DQmkM(~ zemEMzej5YE;kDztm=^ex%`~ZpoomAL%J2P7XBb%;HjdvC6E4&s(NIV6R3Hab1% zictj;6|xeBl1g?6v>ms*V$m@O9TU^eQGi?Bs25vv{$TGT{ws zlnb3<<7P1cISAyC-lEEklVGWS4DrYE)<+9gs}T5E#`-a@wDE>EJ^V%US>Kld;Q0GR z#5>IXtBB;GvJa{P8SXjerKa35hn^mg-xWm8fL`l2HNNq$J4q0+8XocMeea!9HU9uK zVqr7tn`I)4hVo;~_%PEl*2%jk*52!-e7lD%kv;hDL8pnQ0!>S~+Cq&(s-1%zXJf}y zH&(h}ST`q&vn6bN#~C2`gmZUOB!S8kJDKD0Q7%R|5%>-I4i0YdJVMo#Hdb2B(SEUV zWZo9f1^K!w-&)v+_M%`b0~_eGN6k;{iM0UDti22-1!^@&`CW0(GYks57!RpW(A{gW zdQu#grtYr1iC(dsMyEzkl-p^-@m0}ul`shx@87<3A+y4lMXuIrr)BFkucO}gQ*qb` zO=jo>LtDidl#cd3!&4g1N7xI$0Fk+K2^(37DJ~6hAjeqbkJ91{--=LMciensL$~cK z$@PuAXYLO!lax8|;(ERZrxPA^9TjLl(H1Sta@xZhoVWlsdv!`N1DW>kj6~V&)DSYg zJ2j?r#Y?(^hNt!bH5dmdRTp$Ay)A!@TP%upMUn&_=xBfRw{cE1_AKbf*LM#i)mfhOAxL277L%`3~gLgUxeA^SRSL~c+0PL(t8IjmuLDnFGSQ^Vc* zs91aB0wdD$^MFYy6mRye?QC_oF$?2jpM-|j(F`oFZDPyXuC)OB3M*Bbywgja3dbe! z?X^H#&5+;BdU@~sGj8e(Q^`)V?t3VvjvA|R_-pf?i+^g8tIv7*4{gIRXw^AJh8|H- zj-hxYw~h=|(vu+Xxr~|Gye!FUSkzsX+2E?h{^ed-!>##e!$QYQ@OloIiiu_7T4vvI zC=!?;Sx7JiiewdiIF(NIzKfermV3BL^s70U2$xGt4CGQT`8ddPsG3&}kb`@AQYYz+ zXPUombdAS@YSV^m_2)&sLT4>13rq>YLFrg6Nqv)fjS#dj99(`nZT9n|ECYu!}a zCl;GVJ(?A++j$$S=A#_3?r}QofV3ljJhG}!ygPF_q&~{SPE&%M>95~rdK(6BwM4K?8)mR(mx6N*fjNbIk740Xhcvl9wyCZp zhGZHVrSdT$un>uYXyVxDn1+-EhbuD)BjH}Xxa zwNl%+d{|eIqCqCLx^Co%7uTRgUL;>MBvGoruPnR7fCg9^3p1H9!`-c(3+qkm#cS!# z*Wv4IlG6c|!)UiNGVxR3ys7eszUS+AN5iITHZHYg(wBY@5BFx3vo*)dL0*S-B2~^N z=fmTD(`KD@eB3`N4{TjpcHkg|Z_Fx0Z@^#xaDDl$wkv*o@#NPiw3zUHt+6u-&JWis zW*i4%ynEN$gSTC$KU4jVa+AmN2gO``1w-AE?KX~i`Q3eIR0Fm&{+avTqq(u9UQiFCNYxt`^H!tLxml69yFcM>z97a&)|d=W*I2 zq@XI1Jy|O;HtUeD!gM0Nzat7*_eO_G#coIS@2_gbo*G(R-ke_)AA&Y~2~Ga=bm(4C z%<>cIDVVpEjWdfV>UX&wZwqs!?W+vO$m(vSeI#vyn6rLAW&Vb)LG+9w(z2qn<}L*P zEDS3c`E=eQ(TxKu^E*Bgau+aCV80qJu{d@lX`XOgrN}>@{PpCZ$w|r5A$CMIZ0GV& zr<$11gD(+O&{9$=tk7|J=yM$;ws2)JPGv1Q57;Uf`bj|YgzH5YpsX&{%p!KFms*8p zFhc-F)QO4vrpjgfxW$tDK+UA$kHSkTu*u8<#Zq=umWI)Tdl5v~$XUjHk~M{;CL${O!P)k*Mk00% zNHJ!}QVvzG7XVzH3^ux1HjeMc7W(Z{iIVCyDw{n~&L(XK#(Ym1eF*@kn4WqF>;6;( zNp(v1u0{)k?rK2L5+U+U2Rw zP93oS2;+1_pFIpxh6)wugH;Chj66K;A9e?=CKI#c7cE}6alk{~*e5d&?z6h=HZjLu zHr%ZYY^JhFWmt1nhR%gYU%N-iL)W=WEbWp^I%VG2K3}-m9;Bpz489LnQ_i86pU5s! zkIr{-NDw=@?@?bzO&JXEv6yfon?XKa_t%fU{8T-h3F*tv(O4pDJbgN5i!Sgit>`p4 zJmbdJ%(_!v$9hP#G0HvE+tz}#eV59;2g9&%#YJjdwE*$jo?s5=f~HIAM)FrAc+mrP zB!cYLQ!h_eGdRQ$XAjqn_k%@Z*RS1a(u5{PD4| zc9hCAI-u4sxVm$HU#>v!aNyx`IN;Xp(C7R-Ls86vI{$l83R{`8sqwR)BXMgWx{UHnNvX93uwSGXS@wpt}%vX6wg zyLp0NYKU6DZ#Bpus(o9ml7lR6%w9lkaB5?-TVT>QUw`o4)QsZ;*7d^ zSFXcnK$;%I%`3EW3?`zBjhEBg%`!`YiHV8iP(K4&eY z{_Iom25KvXF%ggQ$}G##_e>@M_+WM&qh{1I@@;!KA~%$PkTy93t-_UMrvf&@768Dx z>#|b~%`2WyJ$PZk4=<4l@OHX65aOq*xa&5TWR6MhbP>MX$se_`bFRSs z`7(?;?5^u2pkyC9Y781@zbPBRs@^w&Q+b^-rXVz(( zDnZfAFu8o5m`?e!a50Uu>9{q(IOPU3y)RjiGmpJ;x3(~p>t=Trtg5hL5v!g;IX6Q| zA21=3_-8zzI_A(?H@!wYiQOvzwC`+@n?QiQ1h4A>)cJ@N!2CtkuW|}a=z(Dvo%Am+ z=ByFJZ}tfm*x8x!>r!^FvPHi{PAJkr5$2;~fk)iW(d>krfb!jbkVK2YRM1q#yqQ=Yx|0ChLDva(-Vzh4ZX1 z>9cuD3+8)U!9n(DgHDl+9^_WB;)qdjtg-uRioTVbGVjI1 zs#KDDSAwcrcQw`KFa-1-|Kv&+fedaWFa;tlE7zPSfgB|Au|H)lNMpB!4Jg6Y`G5yj zuToeC>21fEDHm~dLoYtZ(OZ1Gm8HsUqKh4K&0~(gd1J{Aog``;+3R^fpFLL|+MA?; z_VRCGp%7=XikzxHvo-K4n`f80IISlcqJtr^JF_sJGwIN3K$H{;=8HDuM0@!rY%)w$ zH^?V<+{GOyApooHF^w+%!Yr62L`KMW@eI{eS?w0$c4nYkjb;#iWjD^q49HRqx^MED z9wxVES=tp>0zvImVPmUwJSIJU4db?(Xp4lsQJDaS#7d^|J+)f;{qotS;b2%kGcFg{ z%B%bnwj;bQO=#*sZ{}3nX7*ej@lcwsHDQ@S+rG+m4BF_%kTH ze!A9CWNJ#*r?Gt70qCSYQ>ubk3|5;PKhH;pm#S5-W|vNQit6{vB8!dl$I|^qSZ+S# zQ4OFynkp3L2TwzC)!(CVPuvNBhis$~2WQR0d&`LWaPZ(h?u@Tn)$-GOqxj+x{n#f6 zrCg3cg>uMw4oa8gz=^Q;qq|uZBR1ka%Wv+_Sr|r>|l4hjYK%wXoTU3*1XZQ*906I4zCE>!rzP zf!A3R1*s1`iwiXUd9HUrt(&P5scbM0){$`MXHjr1k@)kslWD&=|)$IC+Y&WRna=<$GN% zL;^YY?e^r z%gWvwKzzU7L#@~fbOMYA=Uec4Fst`9J8oY-SO6=lm-RW$Cg%v{Sf|pX6Pm#1mR|h* zhgW!CsAR=e&Vyc!UO!3z3}42zZXp8MAvnchGv|N+xkmrj&a8uY@Brs4jT0Vb_M;5d;=quA{9yE8O z1(>G%=X^5Q_&d)SQWSnm#n|@7yMu^PY1~nhx?mV0cmBW^z_8}bQ{yIZu`@Stx==h- zyI^%*SvPdQ<<=-9pgVWdE#`f-?040AD0Y3a5J^>a+Rmt;2*AYD_L|jLytRPMzK)2? z9?XLv_&fenh2nj&dt^L(1eA}wvLE};ncr$6pNGWU?&rV3YQW4_*|O_QIEu$oda)n~ z;yOc7^m-3A-P{_kCsuS6hLm*_|P2mz(ZQm8tY`obAJZA zO};M{n(Je^9bT3xq5>BD@`h!sN@uip7j-uN6+%%)DF_v24h1`~**y9tQU`pr&T~e< zBjxcV5QxqWH&_Qb;rDL{<5U<|i@*F6GMHxsM!Xkd_wGHUpmZN3k78qK6E*m{?TdeU&27}A4M?$}!Ju@#nZIk~`ITzd%`WUg;NR!x6pe6zl z*?^c_sHG=Iyp}RX(Rbfs9rkAnr%CCo*0u6wD_6^{^Yin`wjBBM*4&D*+X1bkRXO{~ z%iBDs$#26}^$|BD#tpkNA0gI{Ga|%puQp80@V+Z6#o5kS zXir|;#Ox|Y@42rSWUnONuf$R5`0U~s!pOZ6>-C_G!#_uvcWkB#{k-k>gk1S?(wiXc zJ@*|Gv;4Lg1ryEY+={ln!VYZTmq-ELw?cIm?G!Zst*cmqKWh6kVn*|ilG`P< zKQ|8>$|tDfJetO6UR_se+%y6)D^#!>S6QTAUGv_BB?+{G!91HWFxFprBQbR{JA5nl zu)VIWQ5r>->jEW$_$ojq?l&eD#*>5e7ZtNdK}&G-MF&5Xv4P^r)Q;`#<6&+ZoVQlj zdMYXXzkaY^D8cyp%j6g0hV%ceQ(01=M~;VH%xAt9tL`rbICh7b&?T^G45LXEE*q*j ztVi@$W{GL~L2nC~+;!3dt|hmf)PqO`cbgK`74y}FyROf;;u&Ro)))8fAG>>B?%syE zzX1+UY;0T{e7DN#9c`jpNn>n%o4}B(J6qQqtManfnz!W->9lF8M^d+H?%2~{J!H0B za7N~TyBmJ-OQce35Ash}rbCPQ#yl(aa|5`3y`0sn;n~VI8fp%xjkrXK&BzLxQ%=QxMPgb=om z%ja5J3ZPJIDSh5D0y?FTF>-cm>M zj()ndM$E-IvmzmqFZ{7hz+_K+w1nZ)D{U@bHk6zqEyz!DJO@wj2R(|2o0MAo?-B-2 z7T*4tb1l-oEhP8+dHBu|8$;Ygs=&6AzuY=$x~A(SuT9!UP!FO_YXLu;ZxGU^jiEZw zsUNAWbKBk!QXflUADKCgmoo7f>*5w-)G!@V8>xBRQa_qXDDFZzkruoD^5;R*f<8*he$> zuU*wA#-!kL+uc|9$+r*d5BGx_?E9{FL$a_z(HnPf=N0X9_%6S8{qnp}C8kCpmm_3a z1~RUv8Na2Op%zxtW^^8`$rd*AV&M2r3A{-)_VZEoy3_qvu={!^)IFwF+Ty5|sdP{{ zxV%256{4|!|JFHq1UR}Ov9SA6{?&LRVw;2Y>`=G*ZlXZjkcGK-XH-$F(d+VlU|^u* zqGNg45H>C-Dl9kaAc6E zTCSC~;GwZg8dmbC9N8kN?ESnbKtTuN{vKO+kPetF;^gIv$lk0k)0%piF!+;ds=Yqr zcN!W2;RRcLHsr%EP%F;MH;Ff^7(YQ=7>quvV{~3^KXb+x^S0k?9$sGFX2LIwbLH^6 zzuv60TXeBL?15Wp6wTc&K^w2`IH;)R7Z=5M?!AZ3wfyc!Q)9zus~;FitrzazW)z6? z8*qw&PE18#>g6%zS*|hrCEOSO2aR4lqT_czROee{P%h$WT1d{aGoC6c`RAf2y`owg zs$dQwF;SLGQNNW~21xiFEd)_X)q`T`ZiAqyJ{QxqmA3o)`-l^g#+xOQhoOTrM#`bk znR(FSd5LWTlAoez;#-jRgMHEln}=@WaOqg!S#QMLs#W?BB2%dTWOE_E?kG3Mwy zsC7$qYg|NhGYp!`uQT9o^Z%RBio`-b=1)s55M-=UMf-EH^`D13U01=Fm`nP$owbNP zlnFc5GxM3k)wbyaliIBMdo3tOEq9D-u3Gg)YupYOX6^KSYDcq({0SsGp{v8z_j*uX z#prUzGM?L$f%$^wUju3u>Vw@AH~|620=d25nUqW>)I4CV&o#rL>+HSyvr^1QT(HmR*n|JUY z#fb48ezQaqzvsY7IMZ1K$b~KHMpqUU<8K^E_LQYXj4#Y(xBil!-DY6(wEZk|_Mopb z16-8Kx^a1Nx%ei6Q!?(9^xf^O*xdn%*zL8HUDf5pxjVpZb~yZU;g}+>34HT}B3uzO z;!XLb>xash2=+;MK~E*yA`P@ht?*`f;v`ULxbUB7&5k5n`f&`ow~rHr%@`?QnBkgG z786MQb?#10tXa&bar&P;1-11cJ<~Af6z!~4%+`Yb{Q^|KAlv7+8tjKE)_FOy99SSJ zXkzP&1YP*-{w4BpUAfCYXKBZ{NBG_0Ub7ndG>&fnc5$iu;}Kx!WBlrW^ID(}LV`UBLV zE<4O{8ev=-WVD!mo}(J$?3O-Du*1m^*{x<#8j$Y%4BS-0RggK5n{^1`6O^gbE(Q$L zh){xZHbkHi70nyp7sj= zePc<8@t11NSO7w7a(&9pzmd190bZ(7PTBm?endapb7yEwi~cHAmM7QFNxJ&;dSNx7 zBPVVwP-cbSt=|u$G2v>|)KvmFIYHgt=;E^&jwUKYVXf<7k$`yy=T=4`%~Ox%sOI|V zBxC~lZWsoE&(71z2()x<0$*VfqHtkO=hq3(a@7sC*bBB`eIw#Ltz-3{vW#3+S0HgR zauV#q-eAg)s>16gO0MbCJ)wG9eC=-7xAC1O*W?M?D?Y61eV3~r@%yLwwxUJ zUK5rE(7Gnv`FtL5q$D7*N_6YrPN`;Yd`I#AtlY+!|GDL&OQh`)?A z2^Y`oCmK>JH@)9DAphH-^1BWo6?Xc1z-+ZIiVN1_Uyw%oAox#*P z>NHF8H+UeZG(20X?j}W_fJQ6UwSN(mxsWjmj+dh6UHs!tPk_U5@*`I+wn1iTI^kF$~F0;Hi* zRqwvk`}aI-jgGhX*OPuR*TXN7;w4|+eQh`9D9b`C*u!^HDcD<;mm|4)MHcdtx6dq` zDNK}KUFUVMXnq^|TMkNoR#{pOvyD#{Ia2(S5c8yx<`^xT$gBYK*pwf6Cew*H^ zOk(5sEYvD)ZS+WkO%^qqincUU3ND`Qq3U%A#Y(6*sVNyW6k)|oqw zJ?o9!;VJ9tA^oB`%^+(j4Tx5jUrm3gjkuX!k3nuudo3wq; zsqcKAbIV@zU0Ii+?V|Y_8e1X(Wv}r@mK&k93--_T&P5*7om~`#6qaF`1y)F7@?Z=>NK;*72F#)}qK$Z9(MC0W z46&4#x4_EPQk3M+6rQY_pWl-O6uE}cu4~Ye_D;Esy8kXIzAb)(07%9XfjgM%R7n&< zn4+4>=6+b|#q_)0 zJ1{2`YKROOlW*6TbWHFdhnQP;Nimc6@2pfN(B0C1_+5-9lwVLx+cfs=IcaB1C0n-S zA9S-a6Dc%qX6htE{QNH2uS5bZ4z@5N&%;Ky(|}96DfUA`z1hXZ#fSaI`^j}9E-HnU zb?z_%(W?2`4~MVxXF~z?ww2Oz=9N_6moE@V z^-0O2O+id%fQDTSK{8(BK+(%NoJey*V}jI>bFH8b#e$GkR+<*{yz-t{mlU6y@y+Pt zV{g~B*s@rWL#2O+kDpYo%*a{?c%=8OTO9wUqaxP7opjh?f%}LPPHr1^p5+5Irr;`&Wvc)zTsAB zOnvX0Co}xk@S!w^q!Ht=CiKsvPm!*xqy}33nce#&t7=LDDk-*kbz5>N3P>c^|2HE6TCZp0x>0VzClv5n0igf%+Pm(LqG`7< zyXshmV5G^h5oG-J3~S08@OE1djdP~z3sQd*@A6H1CkAV~w`exCW`Z`41M7) zy%o%^mJ?@*pZqQ3IRwoe8@wk&s5!6-LJw3ykZQ@l=|1>S-fA7-fqmczMq0W-cYOLx z)5XHUz(j{NUoO>x97%~oV43sl=-UVjIo}use1E+nUJBcTgM$i$ec7l`@WtjRms^#v zURrt>pr6%E4-mHfHHj;8EudAJb;8ctREkaK$BK#%khBt64nEgmVOR7yV+r!n*WU5;tUK@B)rf7aGqXQFLy@ExV-!fl zQz}y$uyO$y2`*sMRDSjViGLv8nQljOontq9D;OUUnP=N`Ch(zv5rcmdxIeIQaNeuI z;l{uaR$eD|o$xM~@s~<>UfUO!Dsq*h629TM+BkOo`f~nR%FC9c;Z}sOLhIKBjNk2! z+TTzx-c8t1aG0Jx35|U_)*5u%+1bf@c^QPhf?mf-ssN$^eAaE~qrNxhp7lEmHVkKU z(KRxVDfv)A-4IS@$K9TjJ}${bitb*bN&VFWbM`#^rentxsWwi0LppMTFqXnc3_U-z zE(u9Xf*6^|+d0_CkfWA~irTZ03oGvLmMn5njwypH#|69mVt3nKhmAgPEszwZ^q29M zbN8Ky*)?Gw-v@JU!2aR>4C)Ixg3ho~0fjh*u3|tU!z$u>c%L>!RleuN`>#(&n2$q$ z*W81Gg$w6vo*x;WW~ryy&lYyuhEnzx<$e_39-m>dfxf+i+vl{-z*%Ob@xx?yi0z{G z37_Z@e&057^>qI=7}3o`Ez~->?8#g}xF_q>ex=BWX>D!hq(=g&8` zk*(DkK)gb$j8KY6G$g(ne*k7@`NTc*&g%`!gN*pesN?X(S3~GLPD{969BnRAtJSS{ zoS!K;@b!S|fXT^ce@|(3l=+$^LXO0umr|EUI=W8W$ryTne1ny%i4QT87cz4_^;Q_JV$^Vz z7kv%lQ%3J#o%jbR|9j3gMWIQJ+$1a6+q1MkvC*&iJvnT=ZpE69dTVCg>ahOyUfXVd z?;>E1g^O2c85~pHSX~MahApiY-5*_RI5edFQCILb(aho!-P!N%o(CiYj!R;as6Dx` z0-8AR|77no=k?{cCDOUy$*ra*>=x3J6v2q@XM)vLd2!tEgC+|{$+XMUUJ=QFQ>flj zmnh^40PDX1H91->m1(*12H6?ykYdCGgMCc866(8DdIfBzVCD`M`o%DN{~QHQmRtmV zoF#YaOhkUWwSxd)xkI5CrP~Nk;MO7!6sb6o)8yM20Sb3>^}QLr{56-{#dtTo{7n?C zs^25}&!D52DXhTt+YOK0 z9oO}Jb_>dJsYa3BzTH`fx=H7sA`G@~`S+=btESJhLqDyn%Z@J%Jtjy;Wc}PgQAqZv z!US*n1xBGsRjb$6)(5rW|wt=~j|282y9kojwCzjYbntNK~ zcQe0>Mxqi1czxKKbv%)Zuprl2Hi6iQ!6vol_Q`Sqm}~0=`pQejk4<~QqD=ud+5(GtWe%>xuNYiVuH#hs{KujMuV*^QgVq#aAK1}yef=p6&C+e zl(O}^gk9I!`bxXHaMSv7H*7fAZiF4>#J_Ee?p%-6^>gX)$2D&nSj7i+ zvgb67nvABp(?(3mCnu=ScJ6r8?_?k+O!tx;syO4RDM|O&imBm>pbOk0Y0AT`wX@~= z)>?fLV?hyf7kURiLn1G)t=fVb3Jwyvk<8F`8BI1!!(k`YqLf6ik{}USDEs#J#|)Oz zUyOB@&g3S=oMh8~B60`EH1j%k+9_yTlaC-6DUjKYTgkSaarCdvI zlG?9POpK1IPjc!d=KTgIPM1#l7K=pwH#|+(0o=*Yz{N|NqWP1rJOjaj;c>62E4qdv z)?#Cng-VIzOT5DM_(!=^EpA#oD~5yheXiGIdTTX`_FQUpd03c~=0#C46B{N0q5@ws z<1%IVo>4~!0PUG8O;v^%Etj4qyT-{Gud*I7vh9-l{jSZ_WJNsviWe8RTaq5pk;S@e zS_AyGy8@E`!HTV}lhEcDJvMIpo?bD>Gw0t|@^ zux-nSjo;+4J+BkcRqO7Gr#joIrXr#w!%}ma)cQ@td!TB!luaufPbS}>td)5a2htnb z>u&2KQ}(z>&HWO3bdo5+#3i*4UwX!a+ErO}z7GjjNi#85@>2OY1wJ%WQVA z=$G88EGGuLC!%4e_}E6lYO2>%fzmB8qi+n{Dr$f8+W(Y-iPqqnO!Ps$Gx4?!8D z6$O$xl70yFulK#zBt{U5&RcJgMiE>=|h^ zc^~8D{U#=LLtieL)a)~ERfJGwVUn;MoJqZqe*(UNbK~w5k}=uQOT6`GYVUb7Gu+~; zaQb`u2mLA{Kss11uTO7!cK4j0uhO-tZ7Ri!K`*m+yN=z8T3>-RaMv11`xin%`?yc% z-1RasF)KOA(9xyY9 zplSB!%ZF)ZsA_193xA}!fd8wnT&jS zfpm5{>2_4*v8%wxcfJ*1vB|NZ)Tt07!eM>=x1u+$R#q&*Euf+xikB_^DqshSL}K*c zHs)VFuj4wHYvMkj$e(EYUWexC{aYu|j)z>}$3?*#ibN6IcSFXTN+>;~d0lU!10+Yi zGMPIJx2s-r4^p#_ah$e01A4L}Dk^3*3NOOWhE5rU)~`ihU+Ps7NV3xbH*3B4SAlj> z@)4y|+ZA>V2m+P3D2U!0cH(S1rqVx2K2FNt4EJAs2#xlnSGx|NbIYh=R8_AwF?3*fU6Ce~`ZC0k+#mZ=^+O4F8_ z^It0Wfbe^<`wf2gN_i>s3n58ZS4u@C6tDUAq+T1~~ClD=0Ima&RL0(bEFboX#6MNe`L)3r6I^G z4(ZIdzt7?A8L5-0gwim>)2X4!#%hfW!MuZtxZB@vPRWz&^)@n5KlHl1`W?M1o!=f* zLGrtn?Ze0Y{SkKPH1%aN*l%}uIR8+{%?vt*vi1Ddp})t2_`6LU4yc`)C79(C%p0PV z!aUf$v2ya;r6nJTnK+Yfxbmy*@HUn_HiZhGh`fBJpm<=^wNc||B|Yxpo?p1G)x;IH zudcBLr4&#vS=h6=xW_qldjMaB$YDGHthB@&~O2D!(?=e0j?KF2u^r>phMF9vb3_(lRY*y5VEqgyMo< zrO=*;_Z6PD2R9k;O?YdpzV`)owC`cP8^>^S@8xinJB*$cEjKLR3`4b~nHh#w!ZM!s z5cjyb;BnT1Bcecx7&#GON9&LB0j=~#!H*$yGdiVVnmX8J<{3k#{Iu&=6_+{U<}}gX z?O=vg`Bz7l$0cLT0nEEq6MSFUPe{HY*F;sOlQF$0WcJ1L6G*uG!)rGOCTN{$%css# z7^Oc6$5Q4U&f5}9Qs>@FL{WfBl~uH`6J@&ck5aY(z4Y&{-GIoYXQs@}+1d9*{mP1r za6iw|L^_GeL*-oN=bubkH0i4T_9V#azB`#=%~uWcmvJB>>5N6u`T(w{Zw?dUmPjK^ zOppJ~#N9q3jIAgc=NQkI@P}BHbxR{`oweOJOKfLgV#3_bO=cDSRi}M6xk-pbFUn^t zVMVhfDN>XW@N6=rY@dpkOSSw3l}MAeu8Hbjx8WYvvr|Z+BH6_9eTHvit(Ql{E;p*T zu9i8fR^q>T6j`M8ilQnC>Co)hznBhB8BdFOedOS?<86*u>o8;QzBI4xNgq<1EUR&y zE*OsJZR`sXUuD?t zw(?CVb3SUpQ^(p&G{3SN#W3}Q$PBxsS&n( z9hxa8(XC*#xDJ`|a$~l~hb;-MH5m(8gww#ndM`P7`4|p;G`PJ%E^CY4#-#)xak2OAyrvOI<7C`5{op^Kc! zLxRr+nat#e?|7e#e#c!GlC+b`KwRR@Spv8g=j0_Zd`4}yuGy5 z_uZUGqgpQmhV;DP(%oL(89MzfuGVoGjBZn!SA~YH4j~&=pP+Be!&c*sESoc>QBh6@ z#wv8Y&$J|W;lxkz%fuvvcbpyzr*K$YhT{L&mo>NCdV1;}*%!q$YXmBOqCyn+ z$HaFB{jFtg5+LE{rqhmpKXKT#eNA`MWT8I88~-2)ZH^Bwk+X3btI-(&9|ztI=Xq#t zJh{~TkC$>kdg*gGJ1x>nQ8N@A*f~%HX6;mh-QDQ)1{chx6GXnMjMhK)^}UumRTOIlheb5AhdoM}KuD6Hlr?=+{lEV*% zvbs>-Vbj}w@rBS|#Qp-me@`t1v9LRP>jv5In4pz=XRn+%?}{lyCa8<1CoRoz*-+zm zI1te8Zi~aDdGY%dY!q8iMS>-VOD}}$t$UM0oJmJ92GsX>eKX>x{4h))EcYlvIm|S< zpPpfrfEoR5sq&1sF<&ad7xKSF3X4xqo#nmJ2iUc4zk*EMVvJlamd=9y;Q+=XilXLy zN3PCxNA8Orte!Dkw1$bvKk+Yf%V7#Me*YyaoK^Stv@i#&8+z?%e%or{NFVmG`HCQZ zatDizu=2a63 zU3*hcI=e~CZNH}-^f4zBJYH~?EWS+Dc#}5co2g;L8 z2V25f2HB#G_!16p_2w3~;zUh8Ih^C=V#EU6|7Kx7;ha}ty8YHhBSrMOZ$-2R`(f<2 zz6;`=PkN1w5brybKLK0XG|b^%H*5LfOjg8m(+T|Yjzpe3v;y$ibXV|)w=6)!HFB4? zaMMR!&jQ<7+}u`6Sr8Xr%moC#IK9vSuf05;)Ta`g5%WDeI+?Akq6buKvabwpUo|K5 z?CH+VOp`vBfl|B17LSCMY7hYu%YEMutoG-qub3!@_m}#Hd4b}N@9&%Ei!K-#q7k!~ zikFJH52-3PyxmNn{TaxfG;^~JB@1e_=?^IUYTf}4Czt?7V%pD3`+g^#%EtBwTo!*b^~35{bTv z*e|nfNHCnEWSjx>i#8;P{g*P}>X@qh^TcvQc3u6)0era|dgYJ=jgBB*IxU+Y>ggzX zWS2wfjLeQrxH)4e8{oSVl3CL;)_h(h>v^-7z#`B4OkA!)|DizjQo%1@59<5{1q~&6rx1i{2 zCroGSbtwM)@6{d)%fM1odei@pthWk_t81D-(FB(eTm!+~-7UDz;O_30;2LBg1b4T= zWpD}Z5M&4vAh;7;1DxT1zjJfW<-Xkg^y;pvRo&|Xlr)CbL#Gg`Y3ZQdEG;v@1ho?^ zLzh(E(-m{j*Qo#2qiko0AMtEzp{u{+C};uqu~h5F$VY3=OpO`>_!f|hV+>WYOiN8X z%?+!R6*nGPh^iIV_CL~ycCIW;{>z^X>_e6R&4;GEHXm9iBPFCYDuk~TG|!nUIAcgecy?O;u69yOs5yo3awTEhdmTvFEYaI*WV zW|i#{y+L~Q9}H}pNCy~nOiYo-z$aJ$(?~q zohrY}@Z_W_4OWDI|IRjhl}=&&ZY(}8=||pd8uOpj{l*wzaXXV}Y3Nv96CM2^W5)9p zc6o(#7WS}Q2U_ddYX#3A4xiUW8IILa$QhkEW zrsDGum9pRi%b0)bYs*4$YQ!6NXCo|E9$i+UQcmw}zMc)?TDJvWCm=O;t1YA&IJvlJ z37b-=5ssR7XKQ3b?|K1NF<7RPeUtvdFUp#P_dpr!A8Fvq#U|}Kv?2y+ty;RW|Hf@2 zUbFXuqY-Qr=EwF~yG=5ekrryoll8 zea=5fmt_FEIVjA!fDsmb;~B>30_SbT8p?jh@c2!+eJ{+9!E59?BsjO%KyL0UG#r8% zA7?^4Iy!u?6V!%_=K6~=0D;dl!#?6qj^6&tiqBVPi56S)-Ud%jV6&OvSS}q~X*}0h zeO~@BSDp-ImibHl6v6vP`nSWYbxNQRc6t+y^Q);GVW46Ouu;>bh1&YNB_nr%0LuoB ze_R1hN9pGfEu-b7_9h=Yp*#^0-}Ie&R7cl?DYQ`{_&n+j(2LU*=Zl72N?#>Cy}V^~ z{q%L4XsPw@^I_6G?&rhnbI$+Gg5|=buUH!}E=(@yP721YwB=~%(<7n5JFwrz z$th$I1Q7iDju+G>N%^IHsnK+OHa4jJ>+^tjArnlKIPY^|3v5UlWO~KfhKt zzRbPb?E}c!VIG{A*X$vbN2Vs%=sUv_pY}<`g5#apm_oVv=a%pK;i23yDLib3%0&Sn z7kmB6&!5^-5Xzh7Ir5XnKc)lkQ8-0A$JhtIEfa}`|}3e4#E=&k{b{iI86(M9$9 z_lhtP==tBCxN1T?Uq?()wFHE#=yH(34WILH|c*2JY47yV;eQPL~F;HAG7=Ow!LPk;6#WrpY7f-PfKN3imFt8v0f>y(RGdC7xEPyGtfn={|G^o=yl&9QA?E5Y7U4RT%Q;i?N7 zjtaD&f6USD#_2vU)Qn!zpTDeieaQuya*{h)tQ{+a??k_VeX|Cv$H3Y4{jF19W-a$lAY7JsBf*M`Z~fePCj9Z_vVLS z_*-8xrxrf`s4U@?@XA6U;b=p_<-k_5egHyL;OjUJ>T3-}(8hcn^VUHn`in&?had`` zl!+yAfJAd#D@O+of0(2{`<*lK@gvr71p5?eHayl3N!M^nv zU$JeUxqCFjp{G7yJkiKKzsMR+&7`M?cKcEC+DK{CyDcf_gA?1o^5I4Qh%7H*BdABE ztp``6X?f-02fZo5x3_-Rf$-5)%6-;XjM-^#Y;6ZS@P5OR$HbB{hsyYfN%fK#A47!c zU)p}B$Zq3W}jT* zpfS<$@o77dBX5eo1t!B@FIc-I?N*rP0|AlxR?-)j3YTVET%;%CIM!b4Qk7hO32T+z zTgYN@hlQ$2myAq)8J!%|R*iHw^IjZU(H5VM?Yj-BN;TT6flaz>h2C?g$;e<>+*0w178+V*B>hgq`zoeJUB-v>q{ZV2h+f9q${{iZih-2M#KBK}~9bhxze z{x6q3BqZu{F`~VYf%1LI&a-5PxR6l5)t^7%ab-m``dXrkK>`_SupJML7{t?FS>H9S zcPPUa;^t6*Yg{@Z@#E|F@zIEMp}qgMJFWQExZ~^ZN5%kyprI;R+D13@{2|?)XkNUz z|ICR(uhlaiQUl}fEbuhJadX3YbVegIEbo5Jjq1A5L3_?R1uD22vD7##1lUsrOQdpe zKBVYxOXHsy|6%(KOj)+aZV|$(p|9@a1Z}Fj>SPt^0khvZgwe+Y zAw}P0pZX??n$s-L9Yw@Mj3yd8c^A8%8?l9jf0?)JU_>n)Fml2*imcS6S8t?DcpZ z87-?1ULw&vT&ne?lf~;j1zr6)v*d~-6(1MDR9^;p%bQ;66$jzrIePN*D{ZhRxa#kh zC2OlFo5B^et8W#k>-VOERdFKxihz3u2-j=&E%n;+MOs4S99(0(j!{Dc&V2E8=gL_E zar`%x)ugW#_29J%2$>tb`eqdnCe1r4n5^!#l`m{j4mDz85b{Upl18@G{YDvM7O^>q zFT;`^?`>Z+$CuWK?}~*pAl6$Wnw)4UvS-0=77Fatt2vXOM4kn>UkZQFq@lWaeX;Nr zF(@XAW^}kH=TYUDs>U^-bNu0WOiB(i6kXvUQLx)I0=Gw2Q}I+@?u!k43_zK^u;lR$ zU0Are*`3Oj{yRso^iTS4U6QbuVR9@B&AVXTpK-RKbY5|5nyqysmf6!2A6E@Dh?+Wa z)VK%1PR+w<&d&o>&DpB89W5=tqHW!lv1)(rK?0r*L17&UICFN{8&9fxjeecVjCU>o znRN4acqC>>CDHy?!!irA|4ez^i`bTAzw#Z}U^3SHUL5νECe-OA-i>O%}aIb@Sb zU0Z2(1yk%`9>;hXV5+pJW`6#UBY=ZNOAn*CQ2N&1F(I@i;jOBsXMdeX((kt_c*+FZFd*c z<;#;n5kHiDOcO)O{?ikOYBF!^86&Km8yV?mgf|^-T8~jntn1PDxupbF;d(6~`3eRV%o!y(S9BU?)hV8?lJqKhh7#SpHgZ|qT#y*ZS?-kpQ&)CneC9uUU)2oWcg z6;+L(l#dW4muory4#!QmHJbM=;>!pjPWqs6%kl8C)KN<{o^;Ii&+Dnns=czq=JUkq z)TwRGGjsLFa2%MeG4uzr6w(y_kib%G{1}O+r94F?a?F#A1c6pyJ0mBsr9PRM%9_lbGxro zws|m!7a_Hrsp#^6IsHI}3ilHd1w4WRfD(RWNrw6xN);~3DLzY;vZZ~qQ0X5F?b2&q zc&}hj=eW$uq8-~cGixK&s7Ll&VEmUsWt*aU&KM;uy@xpaXYa+4hNB z?9XEeF>XUh3_-Z#bmP_?tIMm0;sHAsu~}ilEzVPE=z)b8txirCGK>4Xe9PnJi79r9 zoya<2eC9nKA#(k!R3BAR@d_>?Ml#h>$XN;A`b5qpwrZ$}ozHu8Rntd~FIX0>kQwTG z^OsGYdP0TBCfh(<2w72(Ot#1`^6WkS=sjy)-T|E4&um1@q)tiV{kB|2QwEX%3o5a6 zrl-p3>T=}9M0`zp;DnT}#d+Ad?-vhr`j@_hr;)wDeGh(@^>kE}6_=vhucgp-I1Q-) zWW8(3Tf}U={rMloxLf~z+6^azxt7HHw2?Jz{6OEELygsE<-&rhF{MFVmU#n3v`j7k z#g_Orw#4&G>af@%A+VI*SbY~RrCSK}Lzfkq)%enUh~dI=o7vc}Q6`!mk8SPK(>X_s zO(MM2W#D7olDEW2_G<#n@s~4{3)B4=0SQs!CMIV-`)11ei|ZspfpQUN zt%)Ph5JE}^#q8fK)X<>Xoup~ArC5&qh9*{**{lRb*;-| z4?<|Hr@E^acvX>e!km7(@l_*fW>!jjckZ%bl?c;jvU$`+`%lUsr$+B`ZF84B|m(ESwMA6e@{m0eB|NT6#ch>)}#wzyLD%{uz{tQ^p>2zcU^1 zd|A8d+a+B084A?iSsSO0b#{kC(G6`TAc-lDgf!^``WM@0vIiBBcUY+UJ4x`sj=ui& zbu~h(sVUmEhHZrlQ&U(bfWh|+oW{~gzu$$xBI|33@(~bVscs`3EkTXbTjCf|J!G#) zL?VPg?<#h}GL&XeIeB9{v*_Yerb4q<-49X%ofv-+?0$S;P8ugI8V6NduUj&RB(W|~ z1;x2FzJG`Fn`if8SmepHK62e+Sz8IQ%X{l^r@E}>7)E6pG7N<~bl${8uwGT3X`?qa z98-5}WRjSj=|s-bb8~}%cuKZvYS|67yg;&=a)kNB?G?R(% zo((43K~vr?4nMiH9HH@?9)Y#YWS&huL8g98DlYmChohtFzv(9$ta4LT!#TaiD$EGZ z!8`-Y`WTh%A3_~#SI8;J3uj`}a^&jJ zyy~io^WMs! zfH0nzX{V2kXRD80V~|sw$I0wzbq25bJ^t4WrkkTsQSU(oI5TK@d>ROY^i2i&Pf1FP z?hJ*8)tXNLle-N{zZ1x>ht=Mllhv*+L^|jhPdasHA?1K+0LH`073#NouFz$8Y&w#K zU26d$^+h2AH15*nKF(lhOKh4qn@M-4$HDh+O_xuiWuL$g+hVXH`z}O2K|&KMpWxS= zjw0fX@<;jBkr%N;s4{xLgL}pswxG0t)5NcMH>YdXoT5OYG<%WdMYrCAnV49Tfv*5S}H$xpD!rdxuUCDW3qJMgKP2LqbWVk zH`*O%@z8v+vHtYfafY!EjMmfc^F>I6>`GsU&17x)c)d&dQr9{b0O_?9M*S6H9tJuv z;zR^<^e;N3PWtk>@b}k5$Hfv|7r~;)9(W$h4s-L*{mNUSIM$Vk-M|~~{BrADUrmtY zj`~FTPZ*;Tqo!BgVmea4GzU5H_A&pPwnwu7IJ0;tmJq+@xdNrKJ=0>qE2Gdok&gR+ z6_xh2qS7ue0jbZ@sd4_zU_832gNP4%lgu%-adYFseCVPspA7hi`-QbGwQYRzeW8**am2cT!pQ?4OQZ95^m(jm(C7W$ED&ZR=c}`_PkpIhZ;1|JDY?}lp~8q zK{_S^o&Bl@l+?bSk66M-DU*{Y3x@=KqDIcf?OeD;DXU&W_+STLQ`aCCE}cr^bJTBr zUz=h|nysVW$}e=x4$o}N0DUe^gI>P$9Ce7l+)rayWh?+*N~My_-!DF5ef(V2(t>`OSGuRW-%e>@GcYH|1gMadP)iTiog@x@8x z{?GnTLpB27c8UXh`B5Kc!huTmswym((WR&=4w2#WCg~6oND(A~e^=>}ilFApcI-ZU z23ghJddIQN8#jZyrcpVK>!+lpHa{Kzd;tyNoO6@7d^IqgQ`H6Zlh5@jf%JyM11Grt zacKO>H~DH!L`%4}5E`ypyRvd{-CioH;+I$>C*S|e#2-@Mxq2c#XvxsZoOKjh8=Qii znzS3aBNt^Bx2+cYlU1m{AE!efL@IB6q=t3c9hv2Aa9QiWB=TY!2#)O8V<9jebT)Z0 zubd-v$t(E2f9fmXZr{+=Snr2=o~t|KDW#7c8z&1H=;ktZQC{n$oB2l%q)tD`ZX~mR ze41SH?K^>x<|0pa_}rNE_+`O+IdI&a4U7L%S-+apVgGwd`FqeXRy2d4k8r=o3)A{H z+;&T*lV{s!0(I!Opc3$)ItkF=b03qnc8ZEQN7iba$J^82fNJodee57tZ4BF&zqAuu z|G@>W*W~8RUPudJrY2( z#oc?NvvqJ>-jl9EvLFDO@h#?-yO$LONFhXED%mq5#K`>&++E?iS$(&{W?4VtT+yQNWP+4g znN%+Y#j5NxT~U_STIC2OH)r2O9&h9_Bb5N4svrV{=JpfHuWaBGY2YL8vCZqb$@Y_@ z?Z~~OzGB`milx`;b2<)UtX;>_u}?c@msFB)PMa+dcc{n9)%7fb-G5`;4`YArbd6eMp07^CqC-JGT#y)(Fs*COJvc3A<=9R>NC`q=keh*X>y0|9b<7oV^3^teU$l+$hF%t zxxd&qSjIgbd!>ReO26IAVt#$>lucaK?bV(ORgA7`$5BG(-K`)InPuT%r5-QI+5omM z;>5;4Jr_>hkukH5X9CX--(f9Om4f74#DwBZ8xXL0-aJr`RNy0!aCf(9!Iydh&VF$@ zPg_nXwtv2ckeb|WrrlsC|S7IR?qu0)WLfa53Hil&>9j8ylV{r-mk1` zK&8c-WI?g6n?qM?-0~sEr9+;F!omh`E^K!tCsY*EzInN_@LuYQezTP86g!XTXEu@~ z&`oc67oUh`Rt`BEBD2c1{^T=3SXH8rYE${|T~pF9%$~WW5A=w~jZRd?*&(GFcUL7% zOY)>$Q*>|QHjqECYE%iV-EaVyr8b5+5g8e*r1rSM|Sg-~9K#$Z25jn-qA+TZW%S8;znPz;6``FZA&2hOeorlW$S#K-X zcA(a^9*k0V+*t1TMiVvz(8*T*hjQbMfJ)P*Rlni0z`dI*)A_}0pDZ7`%I<4znnP{E ziX19ONeSV_kAZq3XkSI%FQj;nLoG*Tc?)BN@USYv8>JdlxMcKK@bL%eG^7IG(A`)R zR#i=O%I5sZaI7?~k{Co`{uEbeRb=3auUQImyV)7lr`A*$-J|}Y0o4Yp1wG77i{6rbsV)cn z{urY+h&qLT@|zw3MitJ^aAAn-jB|?MUC1y6eARo|>W{ocho}bR@v?X)&KTZVCzCtW zo1vSEnDtk}Qos+Dl1MwmG1!W~R!^^6GFP7LUY46YXyvL|We0O0U0?M8V?%$0FZ3ND z5nu`suj6}iS|=5ulgYAN2P0=5HlsbovB!qheU+>(1(wQXdtH8qZa3FG)yjI`i_x3} z%)FiVI2c}n`Ygi)!Jtw3-m^Y{gaGplhWQ#k3Ax2_y*49L)VIRAsb&kk5Os!h6ZMVn za&BQ04Z{tOhq_-GN_9VeALO3M5EeEtSXo{27a?P7Pi3?HnuPzs0_uKKVUxGi?LVqb zpIf!zDwG4^f1D0HE>a8Fmj0FZxv-_{x*#F2c*YL$xLU20=JLB6P+^a8l;uPxr1K4m z!h!Q?W3=2pBP0SmD-)uqD+o6q{Q|qUn-+VlLaygg`Bb-Ro(wu{gYg4cSj%x>VJ-hQ z<^9SXkV5)WHvf#BdLbTnq}8Nf<7pjZ4zQO2-$FzfJ*d7D6rGaRPtlv(W6imG{~+}= z;CQMQ3oTKu^{pp?uZ>TqRxyiL>1pjfQPxfPIs?i zGypDcsdcf(;qVSy~V? zF>!MuYb}aOfe&*9L8R5W_}avBD`8I?#r+!E(1jrw=b19avqN{NaSLRk@va9ZXWR|{ zRe)ATCp*trb7-C#_)Pq$gjmz|f zCWo>2R`%Up6}bmL#ym<21?K*$VsJ;QAQ6ctY$}lj>|Dler zXj84q)0S#BylGO{dfi~%uC13*Wogi2(7gVZL92)3b{6Kx&H24r9Ijui(u>qchC&7glmP9EAc7ISa7<6jU>``0&0e>hr-It(m_IkZJp z(V)OUT2vX?pLr-#Qnoq%=B?<`d*=ILbE{vO*ShT=RS)V?O;l~Gnh3Gr&~z$N!lJ1B zTaGJi(7VECq|9tWiIE_HZocHl|G!vAMuS7f(n|JdIC09qBPz9@l|9Ak0geBr8aa60 zN%VmA20t86QdWP9YV$!SQ@fnxv7Du;V)R|CWP!De&MuJ>Fe7`N#8f|%Df|0xsSks< zl;k8D!^-rrwCIK9${4k&_^bmO=d<1u3eQ3Ine(94Z<)AEU0{$q#P!iIB`CY@Yd& z;0Rfv10%#UE^59ZYoE{d!N&r4P1%ZB1q?0amy$3?kFMU9N=2M&Acd;h@KBJN@h`Fl zYiB9ZV_J*_&c{VR7D#?#F8UKuMp3q&AK=FKfZv()Mx#x=-+sNR%qba_ixu~!Z;uL1 zkN^?vtx;Ay-)zT8r$3YG%%$+dSTK$&;*A4Vh?%YR1*TxhsBV2F4?$>j4R_DJ(YP=n ziA>TALYyMN{E0VK#Tf-eja4*G&PF^XcS$<*H2BDLUD)+AzX|{Ge<;iL6=m7}Ed2w^ z0s%>?a`g@F^IsBz<3{P{RmzZ_pre%0J7>ZSCQr;VCOH+knJudPuhfbp;q^FGf8-;| zz7uQnV$GEO0Vv|Tz^e=vAaHUrzSCer`(u6Xv$UT+Gq0Oo(c|codlDH{WqvUuNg(r2 z`Dci$j%>spGy41Y=k}>YFCRvB9U(}+`oYF_*gE-cugGsn5}gL zLPVjNoCYi~Q}ef}dhhz;o7Q|lsLwmld;VKr68I2KdLU;3u0J{IjdT83CJlXivuSxPl;-2jhTY7T zaxXo30F!KKb!06-r71G&)I5>};1ASfaAzs1>+6Us5yhl~F}o$f@lO}Y3wngM=gA|~K4VDcrCJ46js$sA9$+*O zr1pA;_pr~`%OFf1B@cCd5h- zeyERlZW{@4AkgBYsAJkBu(5IG!WqMXjgKr6(6G)inaejP=Rq%hmKZ&kArvtGVYkhOk21Z?Ug?20qNCu5Uc~r(m(anO#-{VdZG6P z$81bj!w+#&e|6C<7MA)c=cR62j-Qgcjl|751E@Y8RH81uQ!8uS@D(A!+qXnt(-UTcKi>I&g>nrKMy1#B9Q7Ds{BMmH0h&qlukoAWvE9s3jFL+@ ziC~sHIp&_0^}M$Q32ycKA3Z;(g=Enho!Bx%p@bGTIMsG;HSfdF>M@!v#pcd|j(M}J zN8q8W7Yi-sAq9$3qRMQ(I>?~ASPVq(Tnd`TjD?t*)WD;SN`hasy-h@B;`SST4M@ z=*n^BT5jrXmDknOMMHgD{bT^6&nOpvW}As>iVi+*@+6-WOWWFOxCLZK|JO-)UbP0E zLPmC2fTkqiDq{@!y6QG$c>>P2_Xt8WCx*Gr;4-T@pPM)q*PG1y&CNcMK11qA z=D{=0*XbyP+*kHR>s{gEtb|DimWzhbf)TmMM$Dk79Q@1U>vmjx2#ktj#M*3t%-NlI z$~GSjXiRx2`3R`t&qQo}CM=h2vCOH+9C!fCiw3y9)V$BBx$gxn7g&ibS#@s=rIgwP zPPC7e1P5wzecn%Wk$pYazq7$54NrH%yIxqj@#Pwt`yy&ul`hEs*O8UZVi_VFFr<+P zVM;J6EVj~H?DhgbWNrR($2Tn${k^_7NwxiJA`=4YMusDa)kWlEsWn4~*e}=%k$TKq zwdBMN0iBWmIGV98$ptm`w0C_z*h$lWnu-#;F=W9eb?_f#GHm8YaVYq0r^}kg@AC?J z)n7rcx~WRR>qjmw3W=vk5;-zgGN?7vG2D&SRRQnjZ5Rb%h;!xANqRN=)!~#cU&a)D z;~>xRH%>>FVX?31um>enm`n!h;~`8}=b{e2L4(xy;Vr3iGn)zyw`oC9f&#RoH*|r6 z>466*3zVGj2pJ=iPxp=XSS`HX;uHxP8ueNkMKdUd4A%9VOz%iDO;WGWoCNidlrSru z(ygDEa5O$VP>V@*I3+Sw0upf`W3yF%)lXRdWWmLpk+rcq zGn`;;4-NV%t&qMUg1J$59{qG=sGUo5oNa9%)5>7+XD6+FdK41z&;{_^@tH7hXu|p= zVG)s2tr+5P__fpBR=t$Vsk~XC%M_Em4S~0HPLFD~#yzI#kYxsX;2T~xRod9$<8tY^xV9V`OVwb@@ONzxp$l`oQ6tbCM?FK* zDRxF!1U{e8KplE=;xt}~K=h17^MAboc9ALgn$d#WOQx{e*cl>WCT^&7v~H?~QN$Ti z{*KX(PMmMx+*gQXYG|t{qu}u-AI}+%8=c|0<3zH@BIenbhf-Df+orxLF~E>zR{^<$ zsZU{!jq=4E%(Tz7bafj7ldf*zje#mKuzL%Vn8-q7YLZGc zcmIqbHhfi<8Lb8-z@dZfq|X@9a&#(Ip`w4Uq+Q0*5kJGK6?JE_X@UEWmx!Y57alVD zUlBpyy`V5i*A5U}20Ii@e#2rl_K0-l&tbFe+QGb z3~MR(CMGMsOltCEuigPOu_*X=_Ws50k7Db1($SZs+)wtP;IWiCxh)#vzP_E{23q2+i+sa3(90z-76;%fm9jdr)nU1v7NE( zjyR-Xv*&_o3o1%6%HzO@-qwleyIB(E##TBY*QR>Y>Q?w;D5j^FE~CSt<$GjhPmA!< zH%hEuvr*+kN&|FVEoke~qX++y)cp7#|FwOU6>QI^7GBxOdjw90ZlqKuH%Yhg#q8lE z`@&wMwnTGZCgPW@$KSAN-U@|AH|?i(Y^vD;vfM{c!pTxXzP`%fVqP9RX%h_JzJ56AqyW0e*G4S;?Q6iyz=}7DUAlJNE68(|$ zo;b(aFm6Ykvn+968+10F9cOcyVVXBtsZ;ChbgK^78?42SB&6O;am42%o3Cktc%%B3 z>CbKFya!Z`h<6+dzjs%&O4cT{R8%hQRTPA)BJC3Z{X`6R;~_)DnK(dE=<>E|SwC@f zbgm|Ni?hMjTMc39*ddf0SVrq-Ib!i(&YhMRcQpt_wJl#R;EkfZ1V9Nm@J;wXCq(+C z|DSl)F9$1b{c-|3Fx>|ZNxk^GXKepity6P`?uxNf+X6TE9UN4>DY?LfxEjFnX4%n; z56N7gMZSJu7VPEAAtE5~@iPa}Z*q$3=FfdPj3CpDuMydTeL(!LUbQhN&B~Qb)+;DW zAJ^=^DOIuZRH!1#juO#ge~zJvp*W+PJIJh0iDAaQd3*}2px|u4!cI_^!`s7Lxov?F zpm!0$V*Q-bE+b~(WC0ImRtf{-N{PYGMrJ023&~tH;yKg1a~VY1B0zouJQW5x=#sCW zr$F16M=0fUBJ7E!6Z_gNBCJoXV zq`hn!ovwpj>GvnSEbA@%$sxkktITOE?{VJi5rw?t7>~%e`o~NfTx^-MR59^Nq-Fj* z(ZFtfpDfbfy?#hi2Zt2Ie`S4Uz;BGgp*Hk@@(?)r2XU=Xs@ar->)_He5*_j4F@m;= z5D@=prYGCU5#VvG?|)Pj-}_~*!BUVJ(+-J%>_UD#oE^*9dOPNT5Olfd#@;Z39JpM& zpC683S5upF(;^-q3Y8C+!e&dL3S&|SO;XrHi(>oeI@Xwl_o z$AV=Me9!k$x&rS@p0AI764-CTNQKEOsW3US+Ijt0N2$Y#G*i9P zE_9`Od-H*B5ih2ht7%eI$bsE@a?Ms`S)A;Il5BNJ7zYUsU}YrRr|iAHbj%voK4|Ne zZVRB}KCY0}Ptlu`H2Av`3hj0{qRJf$n$MkrtsZ?E)9H4<+?_1i_=bj%gEo>dRTzME zlG0fVZ5e|@lh=ThlTsyPevmV;sL`9NdRaIvQPS~Y^>6Pye^A1^fm&dPpybA=G@Y0x>(`;6h_K@{EwR6hS(*_1ED_Y!-Hc9!FOW7!9mm+!!sA*jn6t>mny@9tF zkBa?7{Fm$HQ!O>ow#G(jr{l(%LyUxYtlO|KDNDW#5LN=#&EJO*Q#`}`o;KdaHkqWQ z-y}Nn?XmtAU2osMJ+1)s*J0)@uSuPVr2Jpu`2V1y{ADc%a+XijH|P8;1zkREg*9v0xIvg|iy0=IaV5Ys5z@rtfPbilDje)n zBj_OLQJMqEt>9H#JY=lLt@xo(I+tb=NUS!fchIks0+sxg%^KvXZ^$VwTxN!`fkQHpM|r z>@sohA#4(4rBor;VS`^8*55DebLvX8OPK!zEDLD=OD`0;*DsXwKk^{(3bh1^8988? zv__6l6=tU8#BrWNtcsQCM3JmCqs?jvu)dr~BlV}9f%)+4s)j9HgRDM@`r3q>Z1xIK zsAL+1Ie)Rzd~ZFd1vwaa;sGnWi;qWsmRsWYvQ(M3?-Qf5nY6xR$o>3y;{;T$O17cz zKb$1x$4ZD#H_8!h?U09F`W|L2`(F0;F_ljY&7@n7GQAu+D&+ynLI29R31bJUFBQ{T7hM1!omC+J%GbC1uzR4Gi|fy*7ThUS*Bf z4>nv5mA!#hzf2T!aV(m*04E<=11=j>ai`{X$4Wz1`CTx&3G{?V7*`#Y*UB>|oN%wO z1!F6(;`|t#jRck&H2~tJ?cdgdx3JJc;5)6ijY|t9e(?mUK>Azqm-u|yDG9BhR(d

E!BtsbA)M4DS3exufDt_$*1#cZv{`V(nz z$<^xND_`H$FPe#6OQu(zLW%4W@=j_)cQ{z|q~g}FPUN*~LzK z)?Mk8dku3{;;^9@4ld(LK0aAVnJgm5X`X_7Fbboz*`mHuC!8w0B(Oi9WUjLB-`C>^ z@!sew*HBpiGe3k~);wtW%XP7ejlo)8fPfH(A6ptheuF!7^{L}GM*B&6Vq}6Gzr|^{pUx-Yu}N_N z(t^ZCj7kLDCK9@Hc7ECGzgIJ}fs}=p834eNNy|SHA~dd__S5~y0-M?=f7c;k1W43Y zQM3eLv&Eg*n6(4BocH~^_BJtp#9HP5?mqtD`1<^veEZ8;Q4tn_VHEgqIU;rR&x(sg zXig~B%x|9g!__f+=1Uo6aNz;2^fXhw9Ha#KhkW{?r)6Ee?xC`ngs^MTxigcj0c52u z`*(AHR&rEZR`+@KFt@9qe>bcM5YvksapkDuf;O;zTL5F&8EYdE>5| zV)HMLQT)!Gaf9v{9P?}G@}GjT=$Ptj_~H50qqgPyar2m2y20}Hf+sh^TZqan{Zgcr zTJ;5J%pE=JE+%$9nJl%d-YqspdX7B56%T|#I~53e8&5Vk1}q(EExPJkX>f4XbGS>C z4?npZ6AAdvo|m*+0aI@j*<4Q7$<^dx?_0Duuj{LO2s-!}pfD3I{^Y2du5Z=F#TSR8 z{)ylc`#;%J;I%aiw3g1pTC)IUh^fd34YjVhB7URcL_AuleKLs>v-H~RJ_$jL^kiu$ zi<_}g_|i9NIP{{5XCSWEB3Ac2*OAE+Z4gi^@#my&KI(nd5EQ}&IY^Qol#0Tuv@iE` zXZlp+x#}U#O0!k)v3V@c9(I{uolFaDeZf;RN{#^RPG;45=nOjG z0zX1#e=_O)MQOsnbmL();tnf{bkk))3ee9F!_CNpfxM;7dmJ+?GNc|$BRQKdPpZ=A z=^^+@)%#PPhj3_dvk_@ozr;OMNhZ~jYwk2q^nc=M$I zh(o@abBZ>`TevHS_!RsbIzBwKR+&DMSiDLT+%7r;W=RC#TAH6#&{SOTe|(GKwd^v?Of|y}-20F*FVE+6P!305W`ZCwF7^UZG7DeWJm(u{w$D}d zmV+M)jxAgR#iZ*nZfT4pyF=>=i}}!{oRoD)Iit}+@G=xDq@aBa#0WFhI0jW9$?!Ic zaKQJ`pW>4ZtcB(?-b+%YAoaOrP6a{-FJiR4P}L8YOv=T<;5-%52NhezoP=I zy#_^!H|l`%Jj+b>$xAxEOlTvR!B{epcVIQ*TWn`zEI>UJVT@>hFWkN~=@iPS!o|5; z=ko@Fjg8{H;mV2m#a_9+fdEjn1Yge9vSb*$kxGcD#eExA^1@G7Ro3iW2F1(4PwubF z%H*XLf`VYJ@aFc(T>>Cj(aum1$v1|Kx~bHrWnc*Tg7K?t%9`sxi1%tbyiG7ue03nU z$mf4=oZH#fUIUI$TSp*AoX^rxKCu9jIaL_`ePX?zcUG%c2Ff7gsK}_8(hdr(5&!`- zS{aDpz>L6;ViKRY!krQv2WM|0f5uLJpOYX0f;tUs@|zD(xWxn+92*WD6WkigHZx&H zo;1!G8`xt74&A#B82jjoRs$waWqE-MOr@cKg5a-J{x(j(5wWmu$;|`3q|y2fx)G{M=QeKC}(6n<3m+7_}!b3=OX813JCPfGUb!zpRwKV^FlnGvt*U)?K`X&vKd zlCW@-eSANp(f=zn434EQ6jP?Lx}BR1K0C+{rrafQin^Vj`}Xzb3yHjUCi%rkrYT9J z+Wfx^`t+JXpEjn3U>QUVk5T1p7KPqO-99RykLrK~kS$FWVB#Yb0idW;WSp3~;7T$s zl08HlG@GaANkVy89Dt)HAL?_wJsKR92X%6kS(fJQZvC)`dg5^%arG?};QE%RGtAt0 z=>QrAu>e4O>rf553P-0oW7RUr6FnO3pcb(_u~yHGLk|I_tb#)w)75E7nz5PapkSo} zeg(idGx56xoJ+{h=A{8cm3FQkv|FegZRzr$@Q$slYEwW1Zu#8e$IKP$k6vi~mTZt4 z0E{E4ghr@#Bt_b(S<88~=a|+%W1EwFmE{Vhhl8-DN>~*A+9U|BNh?8KUfuN<*?Ae~ z6BZ#`YYm76L*-zLG8mcr`s!=#Vf)=1|7HDWKY2Cz6-f!LC?HW-Acb12wjd`m6>XR` zqF*r3`16n>LC`3b(BXNMxA}!Yf%UD;D@K-6rMekh)2NLT1^P9ub!`0lTRZL|nekt? zCXH)XkE${oL3E_dswDo}$r_H;OSW0X?~il_-vK$Vj9Sj#GDMCPI;or8$Hnr+B?W<@ zxw(G3#FfQpXW?ZOYA^f_f%U!{5tNU;l>a2>&Nx+#!Qjrj%~+F%*))M>w0{G93L9Dc zF5f2r64#0VE4jR^$=(~RJRRd|tfNx9XbEY{@IiZ#49FF-LEJtnX}Gctjf`IT(#`0% z&c5A@LF1CTpzaxN^vZ^jhp5j8oD4#w7YHUT>eaOP%D?p~KviA#lcBnjRF35vavFiW zG8;J1nK}C$wl9K`vCS^a);n-ulYhRc8*%~@6DK-`WOHC4~KTrYKf{JzaJzo zC1Vw|{?Qm@sPu6cyKS3h4E}z>PrJVKXY1s~V>$>Vo$;yqdrGwstu9!4(6)YG|Lq69 z`NXZ`wZO0+=?)9bcx8pRWT>9>Uzr#*RIsYRD^iYb<)+H4&$aDC3nb;LrSFHwbWkeg z$_xC>4kSa+6BDj0gXO-W<8F=tm0RfF-t+$__eH*f!#7T7sz?+rNK6M6MA^k*Ph@x> z@aA<$yNr>H-WiM8npu2^ww$g;$K^VHrPAKn9X~!^>xb1kpr3Q=;x**S(uhG_H)A_^Qwg;8@ zX4Uz_&k(oY1baU*!yeiFcbE&y-Bq9V<;7!Y%t0x+LjU%Ma~pp$pNL&%)RqzLMv18o zHHP(z1}rbz|3B=#RaB%;5U>K;v$WySuwXV6);Kio?(XgdTl{AJ zJ2U6(>+aJ&)q$#$Uw$c(5jSt#@c!HE3FBbKi6(+#Rk?F{fmbw1wRSv~O*HYKU0&P^8z{n@F5g+?A5W{Yu;En{k;!ZG543%O3dFnICafQ)yZ_y2SJ(-)k|M`nl z!rKGUSxTs{kFZ2jJ;?W0`Lr$gY2B!SEK44ay3Fr_=S}kXfp`l_gSO84zJl=LQE}x( zUe|+TlT;ofs!}4S((f7X8}CiiZg1(0iE#5khxfT0N@C8DMUm~T^~5#~iH1Rg@r1y5 znXm=S;)e-3$JD~;%h&Uynh#!TJiXZ6`L~J6Re;Xva#ZouPSd+pMG7#GoUO5S3`|5} zfU$f-MqITB9;XlKTi$r5s2Gf_{}b;wy=#z*U8bdM6bUyVwe_J_`fvL_{Au5Zi6+0G z_zfZZ{kl+=(1#R&H#Ww0_o-{}qL${cr&S665RZxUXuC?#kNswx4VzmcWD0m zk7`p2M?mhE@9?!H<`xzfhoke93ZZs8zOI>yrg#^oa^amBw$v2ZRJ(J`nv)6B&!U+$ z`=~2a+2oCCBj5PSs-hH205~DCi|=eWzo^BdiopQXzVFZv)uK>2gPH)^tX6%!tcl0| zhiurdm24!|AEQPnGhfP&O@r+QcXSLx&=NxEB5pk0YJ6O82ea-=9v+9FMHnDJnhu1h z6S83$&nsxE1oC&I_>g8#4dXrH#=8H3d3m%xxfNQTita#|HzQ17pG#2jRpqV2a$W(3 zLEY+`YVToD{JtMywlHWG@fv?VX}!^ysV;;f>T6fDBsFJ*Z=S1Z`}Y*(v7DG^h0uKE z^4JdJb`LX?#k}%i>Z*aRVYLXXCgLm*>0+ZyC^6+zXPLiGs40|6eR`>t-R&0UJ~W|a zvB;J&i3R4oG97;?cN2u)et?=FsXUu=R`jWxT z%Flu_#u3{aM}-)=K0r#h{!A0P{}xn{G12&Nn{0ps>wciG+N!{xn((CHkhAn<%KK;! zq}j3!&xx>q$0Gut@rZyxQOdvK5h;s>!^IF}6^%LuiU5=9RgvykQbS3Im+hZ49sS{0 z+vQVIeNVWmAt*x7zY@Y6?XlFxqkhu|wHz`a<^muGhE&FfgdD^}cJ~*=T&9?hsRp|v z^wEU(tJRCJSSu-gV}qt^E&ojTTMY)AAp1Kqm1?N;K(#vM8+6X(7;RJaG({K$TRTyU zp!`MC2PuZti6BK+w36pEmNH~_Eb^(8Ukxj=I8mD@~PD=zXFFc-o z65%Yf)tlyy>6s(0D=FhP9XB&aranAeEzW?E%<}e3!Ogn*osV+v%n1ZB6=KXy*ZT(; zU3WX5kD6|*`u3DyRtn5>PklOUYMN6UJp=BA>Nn29xz3d@wX!6qX1+|BKo)-!C4^Ht*k&*$&~#`XN3W8fzXcA2~O4+{#1^oMg?SSYYEO@H5f%kbVWSQ6=iLw!1c> zOf{1%*_5rqbwEJ7`(zC?Vy#B&*uz(=w+sxS=J_)xja8vKy2uCmCmGnw4Q)E&rnC7G z+fyLpfPL$mCkGDv5U@6B9{`Y_Q%2uuu&}5II3IAuMXBirPoI=*`f6FdNqI^Y=-l&w zlIwc)g)@2!Y&xC2X}G?V^EPTW^%E@++4A~?+`WWTz&`(2CzLNu$41sKf;})h@j(=H zR#H(4xF38+h=DJfW#m`tdpx&}jF}uafi^H~N}R#f2ms%SxPf(;3{=d7{kFEUjBA;C zvmtCt>o7{Ap~dqxxycz@ll+*()j?%GWu#w@u&Jg_AsC0c3VVo1`OAG|ns^1p$_jVF zu@*1wZAwYv1-G(;;Q|=aUXCSMwyzPx+03;931Z2&LUZbSODheoVb^j-Y`7njo9oMH z2OlMFhGpo?=D#>ktBgC1F*`=~9<>!CX zcI7{_v)=?ms99^&Lhpw}7sz~N#F4U{NHO{GH#d$5*Ym9Ge%3Udne(NNPg!3@!pA`PXI?Yx zN0={H|CKW+s3%)!8@UC|=H)Q-Uf^|g$A+(@>>0xYTP)hiDHfnWLN#q!xM(OV zzFmZ5`u&e<9`NaA1_&|jf6~O$5lbwM$A6KI>D47l-g)xDO-*{NDXn%2R(DUQq>j*y z%{uZJJ#b@3jmr^4ixD$zC!iN#IF@c&xUfyHRBb=?fy=(GW-gmR=KVLP!vJBHX>R^m$? z8BSy0jfP;Ud?r??+;~sN)ZG$ORQTLqJh$72XqpZPl11D&BiK}7vxAS86{n@VOCnl* zP`m{F$H7s4HBO?jgMn7a)R_Mms-IU#sUC40l(m9f=+yLpVz*g1))MhwSZ@!JDbu2d zn%jf|lg}$dM{&A?VubX!w!nBpq6V@0f)%Gtr=`qf9IC8nVRTd6p78G!al}tA6ET*O z{L{-s2BrCKs$bi)&0a#}ZWzZyU790ZNj^I7gnXT5EeH9P6(O{^)Xw~N0qX~3HnASt z<`FHsYc-n-SG@W!)0cTezZk3@@jS%olq^=wFnq%IPWj@+>@M;_{x6a8`r6n+y$#Zd zd1u!(T_p7pW3%>D{>-8f(^6gj&7~feFCEnZN^SI)mCVtc+D3WB5h@cHbC(HjXfA;< zZc6zi7l=hU$NhI(dN!>o*q5q!BWJZzui4ZBUt6{8-{u{d3j@VMTfQEY(Xv@@wv0To zl+dB#boP;Wmy2T)PoN!#o1Y@57@{w1+A4uS2!LX2_l=32I)?Kz#%|aKs@=|k@clar z@qgWJ5EZ4=yb-zKY+*ZI%}nd!^?DxU3vAG%pyNwI6BV~KYisQd9-fnPf(rut$dEsh z&x+XgxOsU6&R8(r?DTttG6V zt{JYNlCxcUb2`HSE>^U+34p{%BNlMQXvddGhV znU}~wpXU;}h9(PWs4vk#9bp)$s)~yQ!u+r;hn_yhz;YcjSjDnOfJHjbqnt6Z(v1NO zPVi0S{&MH+kH)hp)AS`X!OCDXLvw>IY#yC_;tPZhj92`4@G)u-%L-p_;q-+oRgB!x zuy*r>$G5dR=roBd^2+p=;flw0;TiFho=WG!6N{xF%BQ{(X(n^hxxWpivYT`OkhUK& zpv9+9oGU6aa-Hr+QFi1~BiYQ(@YZ>69C9G?;Kb*o+moyL0SV_}-?JE=$10ex;fL}u zbX@(E?;p-rk*ozx%j;w?R#xC$e0T5L42}pCD_>td5;^}Bc|d(e9#E)?VxI&PGO$0A z5zlac_1lMB4Zf!r{sVtX^^)$%et6|O4m+0KR zTTp5+PXx`Xt>C@tgEE42i)cB{ITMspo6jCwzb^(hk^{W~_{Phd!hoy^A4dx3}wmIjRyeOmKA_}7K&20PFKZ?XqcekyisFoLD%I;kpyqxGR!z|WBABkB@* zqomuCfRAB*_ecBl4k>nSqrHKZ->UKzlOW1Kpl#WVtu2W+5sRf|c?s8=kwOP6Dg{pa$s8{Aq;^MX*sv2}P6!|c*2w^Hn%Nr}yRa{G-qve=8kIn%@eL+gr{O-($i$W_q zC3cT>i^VKN{Kn?`f!N5ch(t7N^p_2+hNdR=Y97W6*)M>1OGaK?xhg!km}ukO5r2}N z>1ibClMw#5?c(g#i@YVmU{8{vC4k~BR!I2!0uZOU(T_ye&m1cnjkTg?{Pimdt?Gh5 zzG@?H(Txf?Lcp8I0D=2acYfqL>wos8O@IKIjs@G`DzY3?0zZP>-=#TvLrP3dAiW~I z{=No_d|?z=#bF=HQ`bN?HwiifFUgH5L&2g#-dQYYYEm6orHp)m3SEj;@tt**^@89* zDH^o0MCYET^4loI2f&87HH#ABFv+KFmlaRHBfQv@o5$U(2nUJIT*~RxnwEV9sbX}k zObs{5w=r??XCR||{@DPS9zo+<1tHiDcm+0|L;jVtABLmDdOJwvR{s4-yoLj6kAYQk zb_e)9a8Tr%HmK)enKK#sZD-*=7dPLTkdy#CvJhgGf&S*ULIJZ16B5o8t&`(nCq%wyY zL8Iw_ZNc!W2o5Slms5G;>7lZ@laiAzc}M9rAE4K>HyRKG6xTBnlqr`wShbxfb6k11FgPy#P^ASQ%!ZnEyxNruOqOs8D64x2*a zOX?G|mD^MvkL0(*htS1UdKzOTa8ZW!a*NYL0~BaOwXRvV7R;`+Q_3;x(8pOr%^LJ( z6y&EvIS{SCu%Vs4v*=fzi2iwOO_WqH8K$7tp7+$Kgdv;}go7bT#`)7IHMKa(l4-ym zT_05Q1&tQ`dgx(}m~0KZKS4YAlKw{H$^6(I_lf?hR88{8)mLGmsEi8)RL)3l-^sU3 zOxjKqZ0)8wY1HeV)rNrN=Lq5&x>a=aNhyMXxZcwYC5>H_!dg7w6|yCNMIlC0>3t=Q;26lm#62%iqwJm2a9!o9AB&@!vF$?HC3_~r z+ncAU)@Zq~n04~e&A%keXK@r8@VHr|twKS<-v03u%HKU}V*ywDz^qB*FGCA58Nc&D zexoB|E`Jh=i5w4sQYpI88mjPs;riQ zhJ^Wkg+&<`K1@A!x;aGxU}U=!wQ^Ln%zWFuMHWTV;S2^VLVKjtlYOv#5t4Kv1i5if z@_Dv!!{dd=?9{pZh&{X(B3u48&P`_4jVZ9{d!SurkLjdR^klgw^1_-nF*a?v1E=!W zm+PPD3XBW72CN`#2d~*${%IWbVgF{#5fK6VL~w$py`wYqDwm3G+18hrs@Y$d*>{GTEl;bITvU?{>4H0pX5tE zh$Y1U+)PnlDt3)USBo;oA_ynyeGQoHdG%SO9m*q(*iP)z1_|4TjnpEW^$W_8ONua` zY<24&$`O2tydgJQa&lV2!usE3VM{GIzpvG*aB+GWQ`=;!``{@3IJ3x8$(8((G2v-p z=EnAqo&6dFTs2>V3`Zq_s|H3`Z@lngny^$Ea*u^CY=oCx694liEvsTD za6^2W=YM|;A^3TSx8w6e)D3+`_R28=8qnP*^!m>K`jrEsMEMD4kD>EFyXqgW;dAaq zKQWWMYJsNg&uI8FL+qaqTX>)WnFJ-T2hPQRJ%tV%=#pW0LDm8O`@hJ3z{bnm;Tcjt zp{oCCWE#p)Yd)e2Z26P-`k!xlIH3xZ?{W2*xc|HVB3pStWWs$~m2g$=KW_zm4#!vE zLk~gXm;cl9XKNUrG6esRjgu<#eoYzsWJUj{mo2714@u_^ZTR7T-)KS*828>2mrp2gYU@Me|r5ny%C@6TTxv<%YU)H|Ie3OxWE_60+%uV-$t}P zQ&H$&pbcODceD;aH~jxUzPyuc_i0U^Xp*$ZeJ@TdV7B!uI+gdTjW zeW}_S?bYps+DqTQYyA85g9SVF-S>0jf_wYnE8cgAoj%~dY+AC-YpZsAyeds*(bdzv zwUFT>L-jA5+x6YrU0ebXR$j$-_xRj*?YhJdR?%C!-*`C@_G~K$4QgFA{cfMNQrmo1 zdl4Ez8VSnYP_v+TC_Y093R1-haA7?FSS5k43q>>f1L)NVO9t(BJrQrJjD&5Ix2SQw zdLq4@t!++^dpYt+mrCie6X-Y2(>|w>vRuz^=jJ~(8`sN(XJ3;kW$~&ev(TR?W-+RI^3N=r?&l)}UdvVQ=iY|M!0zW;z5S$?PQK~^u+&`ED39B! zzv&KDR?;57*kQwd>9XyDt5hjpxcT;bX?^`1DD7{(h|zF>(q&z8kbzEZ;-xmZQr#F= zGJgLGa9&1TFs)v^HL`EARt{BcYUHypi{TIqaf+B>(IUu_&7gDU`l$R{ZIP*Z)=+|= z6`NjY6sp9b__aezZ z(i{car#hMp{u{vmaroi6`RGMZ_L2%z<@o-wm;F}su;H1L`-;}`-J}xsnNO&1TmJOv z8pt+Q?k;^ya8UzR$-FO#IjXU~adgjo&O#|Jtem}k;C{){^!Y$rW!Z4@5p!AJc zQ>?@95*BhcUauY;W94We0bJJ;y!|0yF~0`t-~3U0pxwNo#Sf8M-vDPqbAW9`Ht?v4 z&;MC$KKtlfM9cXpq=f*OLIA1J zZTeM!G#~YBNnJ<}f=Zvq%lGx{XJ((^vCX%1pWFFzRW$kLuDZ)j)mjV4g-VIFdd7u~ z7Q0=C?ANsqK=()TnC^YK_k5vra*DH-tAo z{wttVP8srAvz5DcPLmG8{l&XVMw!t`*U7>6>zKFUn73V@x0uF@M&U!XW_lY!8w!W@aDS%TaYIl=@H#?x zYMcyJ*pFVmOB2~G%o7A+I*aMGe%IA!j3$2aX~ND zFH%|Vf;^&l_sTt$^4}NFs9?PSNf5e!{n!093Q4IPLM}B6N zG`_u!e$(!*Q$LBE@gmtzEaLKY-8P|8;W zOG^_pG*r!Vi&R?yi*@G|5GlS=E9M=v12XKThZB-Y)q;NVL7Y)fSTyjPYI|?J2nbXY z9rJx$h491ThFF8|V*a!Dlp3RZJuWsRXKm}T5Evb0p>WQ#pHO^uUhYr3Ph9|X!em*0 zUUp~Ee#(G)kjY6q|Fl)Sgm|HNAou{zOJn!LqWSu)OWTrWLF0wh75n?(<`ms?*4@iq zoJuyvkCufjQ}&nzGyyIo#b=;EV?n(J^jl%~U9$JaWoR}g#K3)aB7Cmt4eICn z8oPEVd-%$J4wMK=nqUbDNpGBGOk{#GhT#U%p@!FByz%8uik#EgtF8h^ZYcw*JP zW$oT?eoJC^_ZFn=S&&nLY-Oq}`;J+z@B$R|oClkVC-Kra)fja8{S7FwN3N^SX<=4e zu4TExtK!2cpI>AVbGEK(v0h-|W3iay_d=*|&1po%QFf%)No#cC(aF3hm3y91ZOyjm?Ybcl`1rFwuKC}GVCXxp_TuH-AMo0k<#cymEh-%n?gE~x-{-qe z^4cr#;np3em8;LDDy!DpC@WmL&yoR5kBJz+FY@OQw;~H*T1v(7<;X8v00q>wMIwcN#&XD1=jU>rQ_oK&p=)n-wS3= zS(n0x?s5ho>+(74;{|9fsH;1AJFaJaUgRFnl~QmUPZs}%d|j-tj3d9lJ(Kqa^uH)j z<#bH*?z((3+T@jsHrrh;^9uT3I2cRoF8OZ9n7QtvHv9iBJT|~ zzxveM{+xqaBDbI^4IX3x$MP8Yx_Nsq_dddZ?TTITv~da0>E2(1z3+0j;4Gd*mY^wu za*#`v-pv#!D(@Q#zAWwSY0j)_lzpW=`Q7iR+~M`wlwBRHtCjEMcZ;l?V|{wg|$D2h~xrr+uIrkFxu+$QB=8DOz}NGt!@&!r!|JD) zvtpzaW9r5kA7)C(Hd|4|#}&alxW{*PU)^hJZ^+Wzq1lWGNh zCof%}5&CDcqSG=kXXja)w?UhNxaN*vnYgJuCjP_2H{ATxGcs2OrV}UnSr!ul+2W2D zuL8-UCOK3u^Wp-p-unr$RhaGy<*)1Fr?uvrN+P&We1j|y z@ACfiVzdq6e%_b9ww(H>g)8^Vc~DNAc&v-@E2 z4g1;Kiptk=UKdqtHS?adS9iqybfGwseAJ^Ms(1G{zF6cl!F!+2Q69BkzT|nDH2Jo| zN(aRWY_U84>Z{jI-l@{QGip!D{%)phX$e=V*v}4Vp51UaofCwW(Zx)IS-|4Qi*CEa zno!xSE~wWb`JX4~a8?>7$(%}Sg&91F7IMda${((kSQce-n8a;a2p8PL44-?TW9NQZbCtbsXe6cU zu~C)w3*pD-BDsWnXZ9YPWRMOxO<}LTL}6#rC8Rglg!LHkOv*3-XNDM=8c5jT{$qZ0 z8&=FT68kp3`8G~dnMSf%T;*+vdt>?fd8BV5psVNAL~TC4dS}!7Y4{vozGYrMMPFXs z--pGOGNdYr8gyJBagfd*WjU8ChcS)elg7tfGG#x3rN)d^l>bB<`5?69vv)uI8xnDf zN@ga?`&^}KrOTt$1-DYs5jH>n8!sEGwagqzct_m0=C@nS< z#1RBWyuLe4c{Niv?eUqU{No>;?xq^7(}oktO}HOvIT}tg@8~;XC?jAAZSC^;G1r=m z`W1)|0uNwjzs=NMX=sw7cm&jcfbl|=Ru)npRYRhi-Mt2uu5Vc9)yyo@}S%krZQYtJHF+OiZ z-xtUS3%YU7O)U#5Du=gXTKCK0Kp9DsOpBJE$))mq1cgE|t7fWe8}N*tPs6NhxmI>a+r*t#|b4?WqA1OC)hG zKj!mg?CHJwuKDbJjt~GuMR;iYi`BoIc~UoayRi7mH=g+HH`dwmpoq{1?x-H;@6Jg_ zadfd*RH?g68py8L0Y#gET^x7YBBq{SaA(AwHosXtkG}8dzD3O6r|N@?#gzq-yg1w8 zc=?*ml6WmDW}r>L>w_t$-c>_`sYpIEh@-yoJpJ-Hivg973>v*pR29>1c|JMie!d6y zwA1!1PdcUDv;W7f!i3S5&z$#4-k6_OPXy0&)=buBDhBbV%eglPyaV?@_q}HKyj6Y- zmu8{zDe8paux2A*-d47oimY^Y z`+15UC!RC+plrpw{pR0s$g7&fAK??7>5r34z};js+eEl@Q6V$&^7E`u{3+nC@+Erw z7A;>q!skQ|P>K!eE8ygndh#gXM7A%YO7A`kGb(@<$)@#V$m<8(nj(%0^byQ{E(8P= zg)fAJ@ATpAXPi*ESN-bLJ)ugl0{se67j)ZRlIObxUXh>3rR5lNX|+?i?p93S09!b@iOw`4+ps(lK>Deo~GNg0y{=Y>EF z!z2n9$Vc^CV)sr``Sn4hMhhLPN|r4el97o~8v^T|d0R`GqA#`%YB*8a18S0PWAEXd z)A`!S$x3^I1ujKS0Tt<#IEF-gDM$hjxphj~)XOHI-A7e~hs*V9ok8HrTV4nBm*53@ z+`1|c@ks#rki0h@{Y*oY0h3@z!3*oY4%t_1)F}h6TloN~878ucHFK=uwVvTB0*%pC zU-AuF#Jfcz%gKtYRG?c30SuK1Vqt!pLxAZ3HVz~Tl3QHb=tHVQRoM=yOgc~DycuEV zE|Z#TmcP;HAd4+5!FG&yI(TJ!f+ReiS8U=idC_`SB_v#ZDX`Xy}`5fvbqYT?@-?J3&8}A`V!MLJtl4uWGKpUwih0zllS! zF*GrHY?=0uIUiEkfFEG}@K!cD=Jq;eg^Z>n$r&74XES-|^V;XU2^jhTj}oHyO;%}a zh7<&g-+_7fx~AtuhI6mI9i&`}R`@GfIiJA7sLc~x_n-Bkx9fMudDmoxN#3GJ?&b0x zqe{>p`%lOB9^R9e`e4N%eit(ID2u@21SM4JT?Y*oJ%R5mbMk0G@}s!{CYw|Iy~Qvh ztymrT4bu9ZVsh)>;Q?y*xV4Gy^ny7%Io-$-L_dSo&9S8lkfh1d$q~gnb6`0&iqjv% zzDL7={?yTB;&st;G*#?@`9YvOO%n2GBU>t(Q=Ax2?Z;JBBLR8gj5mE36R>*!9&Iua z!wd}e-Z|QHbl2Cf4;r77-lq9q#5?o7q&v(zckIZ&(W?*;efdHVXAU;4d8wX_{_9k0 zfdMufwECd!QLHNch7Wvgc*)Y!%yQ$kz%Ag_p0H&Pap(LpV!u64)cmRH3H#Z##2RYy za8`nV6-sp-LrC9a6Vr*c%pGu5QXbAEWiG^MK0F7ViduCtFD)wcqvA15-rMU*4<(@# z>{#G@g=^nx#`{}JQ*~s$V@YP^faguBK5VbO%P+)$5BgX*W77g09*Xf$HL}|W<^ce z7M6D`A>2$=MQ1jJHBO`DeOo(L1LiQg;!fK=GfG(n{dg+m2Ad*vT35H)xC^HieKUpC zB#pC=C})|kzX6;5iPPg2$Np4T_>5iVJ??dY2refDH;i(o0^Uud%V4!zhDUUNUowK` zJoO`)A4?2AX=d3z>j`IFa%l>k{Dykmv-*2N_KhOxokRq3!S9?%i<6x=J&=CWZzd`Y zV*~a{!QNACp@Ftd2S&1l-{x|<35Xg=HW2PhKPG^13qPRvqroH_EQj!q3hT3j&&A|C z9Ytxt{jy8hL>0++I~09EjI5xrkS>tyWLE+beUw$I+J7z*x*FH8($?8jqXWqE{T?BZ zB^rFzdHVi&_H9I+nE$?Ep)Bh(D@H3;QXTY&%uN4A*f`O#zn$c%bxPINX#xnzzfmw2eh{y$m(E1lxm?j@J3+v#7SNou-Uycu%v z5O0@-H`OVogET67p(GcBRBWQg+|1iq3g*+d-uUGrL5wYVI2g)E`-G2u1+NUF3zzbT5mh|AGMkmQyHMRi@=B!m+tU8Gg z6Xhy&I#ILMF2ue$J$sDK2^%a1?N=ZG?b35vx3R_{8h8E0u?*U=oLgp`Gqb$13+WWz zWO4}PtI0zEl>+40iWhriI;b5>{xFY3b8PPsi4BUqJo`EkaKWTxLpLhY1s?QJY|>MZ zE^%~8Z@HV*63eS+sshFLz*<=(Cs@cAham^Tv?RLdM0?$J?&Y!CftczGSqH)llG_`cxnvx8)=I|YJ>ry2f`D7Swxko-%UZH?@$i-laud((z; zDE-LGCtF%&d)~{7e8YhBv_)w9(Ec8fuWNpjLb#<}TD(!o_bn0iMb9-pZGKO)*FD7R z<)&8HwUT<5S$^{d+T+LToZB>s44>@%l*bwjUa|otqkDOk98`MXFo>+1g@ts)jn}V^ z>q6y((w`=c7kz{N!xD-(^IFO`cW6JK?zRDDE2BJ}-Q8ncAuKPZ67Y&r04l{WKF6vP zPM(;&%KeUVk@-rM)^2WW$cc~14X>}7E{XTxACwOp?Y}l4`olY$+3BfDC`5!HkjV>t zBZ;V_7`doq#CCllrRA}N;{0+FKtn(+iM}EI;RAzqwp<#}5q$Ex0FYC2A7*%LtX}eR zZr%@dSybOw6nkbjF5aFsJ}xJVaOEHgdh!1W&?_zTvxk)9HzJA+VFSCf2b%zE|J6$* zb)9nHer*>yb;iKyzV5%h)p$yROkx{8gJfjvzkQ

-N2B#AUJ4(fC(0#c;Uk_(&L z1M4drK$Q98`%5|wru*9Ep$prRD;6kI)NGz8<9;az_c3z(Y^LB1Rqu$8de@M#QK9$8k-9tgydGog~|H)ZO56$y6olbT8vwk5&@w z`dV5K4`YQgXu^cT=S!mOme=2hg9yQszP2OXkCeT|#nieBhJXxTGc~WskwK{}Nu8bH z-C$tL*JKu^EcGVHOQ|_f!34qveyuscG@{U>O4Ar*0tIz7+I}*9?4_iY}i6J%rvkb%m6xUm>cHe&zU)EaI0p2Y5Gk3n{f0G@XoYnq!;!vCAd3hJWZ%Q{qE5+?@@~?0XNnsx8$Y6_Rw$?Rq}F~&gZfvcVRz$d zQUIPj(GOBYeA0**x3OP=C_jgaO4lKY1Yxf@*^bOWmGmTI9aIUw<&a_;HQay@$LU@BhvyAY zu&o%nZ^P(Pti!Gl*Ot&kyN@UbIqrn!fY@P{4e9PwsTzB|FCb)*!Ug}LUlLC?=xU zenertN2JIc2ScW|Uok>z;z9BMFV zc4SNWMEJfcK%;zj>Qf)kCTsU4Y)qtg&lILQTc16OL`W2{BKs}4vQ`*Il)})zLB%BY zJ1bQTD`g3*b3aKF5!2dQ;t6(7ggZyUfsZxg0KePybr|C!miJgvE>1B{T9~IV>Xk<2 zi8&TNl`R?sA##Ozeww=Amk|eun>b!D_Q*_$|B_mQELviVT>GqFt~0yevo7h_Hf55# zFNp0ObmG;vJn>OJX8VY}k4kIJNiEbFo?lU!$50LK!&gw4!p0>q^Yt;EP>S-OR}FxQUyf8C@`!aj3{15 z;{S`bjYtZPLN3hq>q>3YWF<3CF7;Ali8#&-qb<f@&-us)1r$^X359N$ z<~LJX=BI3gA9SHmk_dGYVJk<;s5@U6>*l~o5*xOTQ+N{1Dw1R+skgzEC8D>HT_kIU zcA8w39U;v(*>3JsvJ8VgtWWvi$XVnxO5-TEU3i#~v%Llo3F`#dJ(}9`JwqMtxQSrH z@&jZfydy_ipoO~kLOIKqO`(|l*DQw>&5lkO7%e?@Jg*1p6q@oITvBjA9gHcJKi;dD*7lT*xiLx{(1Xy_vA>Qi0u}RM#3_(w1QG4j<0QKCnHXh= zE_<_h+-8PACpdOtJ?~}$dxPsyo8nw0(>Vn)9-*fY1@$2+b}Qdp*0Z)&>Ezm%9R3eOSm$;=Wrs(xQyvB8IN;<*ep{XC>A*hH-@QBNT~q ztjK;e4jv41(ah=>I9AM>*D|iRf=QQkLPb;P>aLdTWr+2}o_-`s zOL4{Tn-AlHfHPKa;stNQeZ_JfKlYQ40S4azjlNvk7yS}FFA4wJl#0JSDFJ9zi&AgfE@6>9AbzYE6${koZ! z%eoV6$Cf|LUQp~E?e~E!Y6^+mbTAgKRR>laBeTdt1p4?0&ajiv`!=JQoe%e^Y_OGI zQQbwjPg77~5rk1bEO7(^jpxXkmI^r=%17S3P-bk)Q+jyBji}f^dEE zydI-`SkoBe;l8bFTtu!CELc;+P@rEHU4jm>Em0480e+XX=dmOr%Yjv7f_|o=(=Y7+ z(zbouNf5dAxFSDxTg%_knlKn7#}p1;f?4oQwSa2+g%P{;a)~Z1Ct%GssR}Q08I^E; z-ecjU?ckP|HQA?2`CtxK-kjeub6?6@|4b*0c+pVm6`+L>4}N8@n0rn>=ovB0&q@VX z9)7(`N!{uirbZ8(5%dpLBXby`2)>H0rD5H))H@{$5-#kvuF8nB=D>z1;%XR=jlG7- z$soSM4q#7iU>=`Nyr^0d5}DUpH>D_AENv6=5$~spmh#jeHeFlFdj_;aw+sOP2ZSdnMz$ zHBksY`w={W(yADqR_jw_h6fo0+Zu2_@Zu5lBk9pBB<+fj)WV_s>9a-3ggXC{*DM+$ zBbtw#^^~8iT}o;QjU%Kza}=99$9m#Yr+;C{Z5YN2i^P2PuK=Ijo25dcfoTi_|` z+wpeu7lj6CxXRLQgokH&$d6F&7VxGn7L=$*e*rA-9ZOO`nb+{>`aXABjR#tAVU>n9)(@5cITqE}Hz;#GjYxG%;r7+Kx^N786v z2G`1RUH1UpGLeCM+9Cf_06#E|8!LuKOyM+Bsgz2X6vep9c_c$gvYOqlQBPDEVs7db z{s%b(%DILB5sBS=icl&Wtm^NiV=x%(roREHGCmc?6)EhT&Vq8=gw41*^9-EV`lS$a z_{DD22t|o7;T*y}5z4;%tkA=UggulT5(kdUun!ItBdK)l9aTR@uiz_(?X|!5*}OK{ z#LK%+O`>amiQ6wUBu*J2_I#SQgau7Ql{xYaBO=FV1!~})-+fPpda?keQ5pL~JCetu zA!bdL_G@W|p!Rvv8TL2l4EkAx3WacZ;ot}8^$v~ymamM|C-&?29NDPJ%k1rADG;i@NyA&smD0Sns0L`8F~K(n8uB(5*4 zReKiBZYo0AiLU+|(~m)qM1-aR_b)4r$So1u5gJBu6N;yJT}H3{i?6>z6nR zoSXvmRd3lS(MW{RhEwEt5t2@B?4G^n@t05ht)Vj`3~+1&-h zJL@tUygmv2uCc-LSVH76s2OPod0*;;vpAX;$gs0f+u*;sg>yt8qEA!0Hoe7ucZ*e9 zo_%oa62v3+C#lt&f+i@@$Y4pf9tHF3R*dmH5Mjb5fDi3zHy28vWvj7 zWr&n!Y4duNYz&A<61?A3sJD06su>C=#|W5^#EtUL$L+cttvFG?1O z71Z$kIiEtxHx2(*RquTTXU!j~!^3`iyw247ja_|ccUP*m5BfjlV5dD1XPk4ErsTMagt06LBM<(p^#;04)A%oJAPj?A%EM|4B) zIAT2vC{xv+1&Yq=|BJo1{%Z3J-bIT;kYd3p?j9_-yN2NIUfc?_NO27iTnYqt*W&K( zQoLvj6ey)Fy?oBS_pI|jobRuDt^MZByJpYqnR(`Uy2&ew*Tm(s^WHE??ng;kPwTPP z?4$&0uIRxa%+8ic>mCM;t%F@-+(FmIJ_;c^^Sm2|UV50mxkqs@6YuC>_=4B+_-Dk9 zY{*JU($EzKe;Hs03KDkp{Tjfns9oE5Ba)n8gxl#LLQvN|yv5w5PS0?J-t8Fp>6*}n zN{&Ilay?qk{-zZ_-Zrk)T!uMAUi`VE653C|f!*^@p0?QWCL#GWMFOTAM+T!C1!yX! zlt!LpxyX~8Y)Pd?@}D(%{J|Q5`F2GY0?nOSDJ;F0U*aLhOylese7i1H;`ADJW!`8B!YDI+c5YQ^+{NSx5V|kx4$`QVF+L`c!f*2a6?g z>RjXS=`SMlD=|dQ0G5W_D&$R>jEDtO-)T=rz~6?Z!J5!&A!e{ua^~4O>sAcF|&J!FQ6Cxx)d5UMFaPVjl?mR1YpaO zswQSo^ne2vGOQ!eVfY`hRgFDPD2Uea(I@p0>(`H?I00jc{xKZE;RDDURji z%6uXVWOWAAA%O?6ay5!11W9tGF}YIKS>y#S^AcFn;LW4PfTjgk-S+QEuN!+nwliG`R3P^-QZ_Tw$;`&o)UqYs`W&QjJrXda29_R^%tmxV8z2lQ8-qIFe(j>7y#ABKQ#S{=5-ZHrHTFdx(8N=b z4^>hJcSt64{4K5Ld6F0LZhNv@F0VdHglf}^zE0pRP%G}LXT*iqfHf*vSEZ^-Sx+!- z>6S1SP42EK(nq~RD-ui(<5~!QM~X)mQ}xlxKC%vXM#wh}NjqQ~0F@RK_INcjWS(7uC8i9ji%=41CLWvdyg zDYUm&%jVuQf(^)pD{`uD3#nbO8naPG-Jeg~+n8MOruKB>qmsRWTV^pZDG(nG|Mjc(8^IXaZ>S=2`kxVtdjK@b^wDM?=0%#{rY4wOKt zb}GZN9*%`RDBYpzdHH1=3<1PNVShc7%>%@;5o@>DD2EN}QlY*|k?Zg!4oXl}W)K}P zXZ!)Bqucgy)>cHz9;YVQl3KJaAk$(meXn~m@vw+YqY_$(<`IP*P($=19DSD1DDoGd zMpnoX1C5iMn!$tXU71S}MV{kV9AR58>?CFN8CG{`beolJ}I$d zvXzV~KEjMB48odx^7gcPGk>v=cQacX@FZrv^vgUs+^yq7AxERl*y&$1ZK9OY3gsh~ zY@HHx)@BuH@xNwOR_D)xG<*E+TZSyoEyt!<+j8gH2$^UKd6%{|_gpz^aT>eXwlIai zhpG}CGc6LUADvRMzs6Rb*o;Mo+s=+Y_+1uLo}kL42U00f@!AF4LfWakK)+z_t}01( zLk|sqpC|NAywbdGKrj`?9hc#xZ49DVM2`xf0gtA4k96xnXgRxIRFng~ctRmXv^z$Q z=XfwW(8;06HI=g%rG}w{v21TJA}S^kWLArnMXT)qpHPhGlsWKWZrBunhF?;AZpc4#_Q-TAE610kBLgS$CD_sO~Dj)AvRhVkha~zygl8=w^P)5Pb;y*Ye% z5Dz5idvJz_rHv{+Egu>ttzC>Zdy{N`Z;JfarYY_p8CAQqG}mZnwepzzVbq&KuuED( z47o;rFI?TVDd@0D!ksnc8a@|9+aTqFtWJ~aEpE|A28kh}+go5A>3f3p$z$e|(~)`G z{tbLH-9c?8sy3YuVpmzi_)5N!Sm*~d1jarpDooysZYBl9{4?A8<0TsIzR;LW9Ek2w zr6mT)ds^;YIUS)k)+b!q?Fudh?=VYljMVq4RCbK#%x&-On(}l|0nfj_ZdKt(^h-?ke~HE;bNmTeJk*S$RmXuBzZ0Sl zIWVH=`r1;UwA#IC=*>&9jHpVjJ*w%vWjhleRzr?!n$3oFa}y z^rHb&b51F$%FV}EEER3r1;(K;^~NllLeO{kDalhdgIkd>jXL2X-JD16{O*D8M4^M& z2(j~NI$v|X(+L*pGzSlnH@B_wr~NNW^d1qI0(ug%*BpT)VVsCn=u};WJ&KBa`yI9o zh|HZMuqjq?zG*ccNk2r5UG-O5hn?AK>f^rSPP@57_aLinVC=G67ztTk98nj(n6&~4 zGH@fy@H9l;=)jIpC{A2JcR@{f5$LSU^GBD}{k;<@sR9GvD>-`Qyw>ZEf-zRdbs=nP zfl?_s;!s`ya~u5Vr5GB(_zIcG=loKkGyT0+4b19zf=8zRE6<&=^4gRUyXlK)sjmBH z_0nlTj}FyY5;vDMdy%5ZK`2-hzlfAb35!Ec8B0byDRtH}&x96%?_T;xb87-*W;BL+ zpT!mgy9s#1<<9@M0+kOnY_|US7$7YaQew2}$vc1?-lCIg3pQ!`!KGK)fOSS8Ge?CQ z2cUV^M(YWG2cFb5j2_i5=1k-AYkj*k80MA*=H{C>yw+h@o1I8w8Bn0XDuqmxoT;?D zRg=O_OG}|IIzsLXI^_9tJH_rAt2huVk&lrcdS@tVyX{hBtClc{$}xo$s68yOKK z+dbumE%SACL7>6kr2`tpfqt?nV9-j5sfeJ;PyH4{*Seoeg-6aYlW z#d3a}6qsOt@?^>hjDw651Is-csx@Gu!xf2i`fgd&`KcB8gGutxA*xw6X5$u0!nXZ- zNmW!4>U5tX+upAIKit*!#BLuRF%5&dHobxKiSlsq5h|Xo03omY6$9w&#IqxWP1f9X zGW?}70HJ%i=2XDyx5emSXo39O+imaZiFdrFxcqo(4rQA#JTyn>kQ5yS)@7+k6n}jc z@GBS`mUYk8G?eAJUYBjacbRzNP!tuU;+SgRH&&L3E%GRy68*-SXTx+V8mBk-qWUh) zi|=3i_y8*rTaVKcvTPvS8uqdQmivQl$v*MIemzVC6Dlj0iK`V2+v;ORoL@!;AFx&| zxGYD46M45M`@V*d)6qBSK{Eij;ua> zGBW1T19#>I?%1YIEB;uT=KYrRlc_BP7KN8m{-BChD-u&TYl$}(X+WKgrbj<*O#?Gn1=F zhXR*$x={^;aFDXrN$<3?Oar+a-LgKSdu|VK_kAwnMF_Ar5{&z8*eMJ{bVd&;@dR4j z9lorMxQxLIK)Rg-di>hhZMW{~9#OGSUnP=CR!6uxSsOnph+CyS(k+{H0uU+bm`5)J zsinM;v@RdcW`Qqf#U|>QxeM%Lt79gvB*iImrP^2sSrS+OJ%!W>dY$%yV#nCK@# zJ@1_CXr9Ol?9Bc!U~-sIjEHlYBR9(^NEBgaUt(aGS!b16AiC%P_vmwfYZIhF$Sb?Q zhVa|kE~Jrk9@rmQg2Ur614flJ)1(>s=h3ow+hTbs?6G8@})(gJSdF@V7D1 zN_kbU1+#3b#w~BdSaNJ<*R$ZEAS6d23O0u9v<00l4}peavM0m0q-ojqaGzE6jHE1k zowxoPF)BCPB*MTvV4EDAJfstOc}k@1?ZOzV%SJ z@zBYUWJ+GeQ+|GHro)5Y5qHKmb3gR&bEz}!od^FH*uE3;JbP1%r6xTEaA_zng0W5h zMP=!4~jpTuBSJSv%l$Asf}=+BdKk}T9oWy)r>KZVrB2Dc_gv$TsVV% zdRiVvr&1>H!nym1(wC_4eHju@Psi*0aq2|a)Z3X;Fkz*19rk0S6k4u%{PW}kj8Sr9 z2xdM7#D^&dK4c37Qg9SoW`#~JIti$@Of9UVzIkF8#lSNj#YZW(`3bU89tPZ|Qeweg zMdd2jq)-GJ)hb93>g6r6*d{HIJ61Yo^MJTCiSdr{=~+GJ(V0~xD`NzB0b1T$zhT>X67h%VRZczPY-Z`uw7s(URA7nadIlXFq-j`0zdG3uVY} z6|WRWP5cp@fi#LNv7IbH?wm(7?PTFsYOZrI3@A5Wo++8CE7h98DVrrCB(FhsM&aog zQ^rW}0qr|d*T#XsQA&#lGu!Z&?Y6Y@Xwbrv2Rh+oaJ!x) zg>&=v$}n14#og>b4QUjjlLpP$l^B+k!tB%;nXihg^u~VnK z8^<28nQCkWX8Y0b-Ui@h1BDvLK(%i0^fl-BqJWR)GKEYW9ndSrIHq%>%t&dQ5nwiq zb6~L6;BzM5)P95P351ryY4s(#&xu}evTv}ahCe#Vt_Fr-IKboR9&@kim94 zNiN@iGxmd)IXQ3{vAw07se$sO{VEXx_taIgsVOGK0J_G)(BJ)AjH>92UR(*oV$Gwt z$o}v!%3H#y8q3*oe4t}%OUUMHwh5s?#t&{g>}F%C6|#S@e?v6Gho%2Hs+Q%sC9;G# zJ2&eU6LWxsbOC#xZAy=dC|QLhaX&5}ym+f69-=8B#P_b>C1&4sSZFOWEKnmA}}U)K74n#d@WI(ogFf2c%k==Z<#=T zNZpKU9CH%c`WstTbnZlQ!lq_QDM4db7_?Q(gvPR}!;qKHY=&ui20wS+_<*Mdq_V9> zYu|K6;7MF4g-o%y-y*B_60dMyGNfp9U$lI5q#K3{M1p+Pxm;?7*LUL$*49E32?dv5 z@+8pesu=4XQZgT-V6MsH%=fFjjob+0Xj}eb-(pf^_)>T*SB5-ke0PKGKFQ;;jwGEE zseS?bH$WY|1RCqvuY3(ok?1vyQalPK#UlV#N9o8SjrZlVGwDPg^TN%yurL!VnRh3c zbeOt^GA7&Wsft{x=O%m`3PEIeZS07>GRXkV3&c$e(C-&o!YL+(@T(?avG~hyE*iFJ zI5LP_Rkr5(lf^E6v|_h}NV4@iqh4#(h*u^kxJsk3rZ4(WmIi_oNCc_Pu3G1^qZUH{ zT)Dj(8+EAKY23ny^B?u)MX@Rx1G?C=nw`HYzP0CNk~n|X(1$- zWc-EAchR!m^O3OT@+{|*0N+n_vmDx~ykrU!YQ%0!W`Q(+Uf3piodVMb)JV}0U2xGAnqC(w~|7=O;@q`H6yaHq+K^1%oD8>BCk#^AYMG>;bm0~i=PWF zdRGEw55vB}72e*XkIa3|KPD6E%i{VQI@0u!<&_4?BKhFxKpw@T^edX`hquJ(NQt>@>=Dng(8qZS?XXr4!>$8c7(R^ZMm4qL!zzNDH%;_%M}>q0 z$$x6Tho>!vId)qg#L)p%T~&yy#dTY2(n=M&7=8{;uGarVPFt|%X2f)gqjQX)Kc4`K zpKJjL;0LHiF$=s%A?VHqW3XX(E%>rdB9EHildDbvB*=C6Ch-^p3Y7N@5ib#B0(T?qH&}(p-j_Ey$b8dW$xU6VrzeY96|wg7-+Kk1OrL zI0Rs8$6`W<$wt<+G}Ga(mT}z@iw9^AS6mS{*R2`7-&c7AYg({we&aF<9yOT)(o=W- zwPME~L(uM6m*d4m)wMnRVZWTD#H3(Yk~Ekojr-xrO*u zS}vIzW>X}Z2^0M(4UZbfuW@P+Gldi7>`Ncnmq;&T?suoBf>vnM_f*q)QW%6LWIaGA}CEr&inLisERVR=V%&0!g;s7 zVkGeeYf^dk6t*9jwMtW2a9m5UOtu@sNRJ6|?%RmNb*PVJjMz zuN>7|NtFWF#0ONIKO^kb;sl%d0A9%x`fX-QY_8iXO83u@hT-#<3`UyPxX>q#ZiG>f zP|)@vOunh43bS~0n$IRS!*xRWE{?vqo+@%;dZB4$om~I7S64E@6vC<<*W*>|Po~er zbd9g@BsxKzNnI?ry(-*0DckGsB))(Cu}!A^Qc4Wk8xYnl;-X2Hc)S7S9b)fYH|5RQ zXMJf^w!6L?;mf)}wm-ok2yfickh1Zju@1bhan#^wvaLQLixQ`N)oG5dSiB}7!K_~% z+O;vllMNf%iExL;!u@YfA$v8D*mP-pQ4Cwb@q&tr7_K;E{`DV z-l?_c#3=}|ErlA5^GW0!P$k05hsI1$MigPzXPQj8b9yF*&b*64^C+D*OkK~7ogzpF z<(@{=`sL)Zlu_j^lo%lB-}Ssm57PB>tJm;8Hs?^N+oJ`>EUaX7t)<9`JlfeMb(J50lF zt{g8_j$VL>1R7%qxB8>b4~x zazQUrD><_U0;gNk*Nt(8;p=YIF~uXy8CUc<%C+M3@`VMy7I*hU*hR*{si$B?(SnxZ z@*3soG=#Pyt635Wcl)sA)bFh`Ol+qifmKAE?b0CoQBJFF*n&h)t;7K z?&`yjw<>k=?32$I)p%N0SZX86rMVY>52P(y*zb|IU$c#F#e_39{g{*bGUxNC@N`_s z)Hh|R4opK;HFeEgX6-IH_mXk^IO|gk^k;>R2%8NTa;`&wUfgAQ(TAS z4t1jOvOb6*5@GitAcwyRNos^2cf6D`N}YCjIW<{zxHU_b;@H{E@_OPodRd&4D-;Hi zUUgiG$GgSK+B+enUGo5LdLe=6b;&gAC<_=5PJLAxY{{D1L-#5cY8dkOITz`n!%zl| za78di;uX~mPBuWJVUmrhRKASE<0XPojk(k@lLgj7Q?Mq|{|?86oK4$4vZmSx1&n9) z3owaSs>ThT7w*e`)FJeN1!fiG>If)qyiKnHEk%B0`3ZTIYO;Z5G9oPy2Z%MY<;7YC zQ@VW{SS^w8J%lGAFxHR=MsrK_=*X-<~ihkNcI}US|!Ni!Ld}yUfrNZD}ZzV!IOH z6QgD*yBZLH)lvPt^{C1|q_;+48eUvw7)dMG@dOwRb9GpM^amWrPkiD$&G-PZID)RR zIsnmY24iWkUS(Cp&{M3Sp#&83q4snsB6L#HpEjb4>5H-BkhT2!KHRc|=nSWC#9#~p z-J)U;2VsAuIy3Kg*m>F}+-{QP1+23ej8x$Si4ke2{AT=UGzul81d&9(ZDOhEbewv{ z{nP6`dCZ{1M*+n4b6Z(JdiGdC=`pY7_p zTF{$zp9&N7!KC>?L&1nhuHd}rtt0`!JZ8gtMB82wi4xWo!1z1@W!S#nr^P(9cXPby z4w&qiOIhFON;AFfMbH_lXdV7M$`|L*>N+ise{&s*LCcE(MQ#&V$-YZAeLJGE8BF-; zS-p8=B)!Rlt=^xW2}9@{q-AKupAIa`J4&Vf#hv~r>YX0bky}-VZMdNgCvFvpghcwpA$Sl{z#0WYMd(gDgOH?8BH!mv)5+P+qP$9_Vvb5@g)w;Aq-Bmp{rnqhY zpuPRDHY?+Xjhozttucg~W-1waAU3W&Q4<=Q!AXmRp;aF_em$*ddxBE{I=ras#w#@s z22Dozn0?j7c1Uy)Y9pH>>Dsp`POWxZR8)}#!c#6fh9e^VoCG4~8N1Ef`2H&MA#4|! z6Ye%~KgLqCWkA<*>iQi?HvH}t6OZvY)L*rx7q*dx4Jo|@yL}t;SQC0nav)00y%5h> zmpehbn<_>rGfCi;b(@}Hcg;c*ce;!veD7@!35pLL!{}!1R3*0!5f&kO1W|cxBx@`Q znCtk!?vCG?bAufWwstFoAg8bYx^$5G{cbMkjgf51H76Pt635{1NnTguav=^|($pc$ zd^jM^mXj&zqz0iCaIRrTlMHcU71I2vMlvk#s1i$h|A@ytpSC_R{Zfb9%a)$f`Ox^@ zQFuzLw$z8uq8|15qVM@a4`+>ad-6j`s!n1F0edR{e#Y~|k2g0lO5@Q1xbJZ$AUwJv zn;ah>gFv~LB1>}uL)mzM2wWv~2^ngd*r^v0yi@%++F;)0c%9-2Y2yW%bLQ4TqfuJl zG@{%dkjRi-z((lwFh3urUglzUP;WK+Pf%nFeqv{FxRjwTA zdvU-cGpf@8P_$fumVGIe*J*jAvd+!ssxE_|_s`5wS!1jOX`aol^9UF$%qxX|1A4c4 z18PgwQte4I+c~%Ml%4rfW|8G@hi#>cAeP6g;Zxw8f&`sV^mmB8nv^SUfpFT11);Ul zsy$x^WNGiwyHJ!)#}jNapg7%}1(n9zA--sn;1q}>SoYf#0P9oroTyDq%eooHbLU48 zY(kosgae_y=zSW>#S*SL!g{X_nyD0x6vo{#tUo=`70aCA==;nBjij|T{cf=qKJFs) zM^j+tN*!8&c`kCEzTGTK{|#?`Cv)v@^SFHC@xi7EDjv~)30th6UH%&+mzGGe1;|L1 z^L>k7wPE}*#zWom$m=V5?!b{84&#^u$C{~(ARt0_9u~I(tA*@%_Cl7)ZBq)MF2a(= zCHlt7EnG)T#ynpkdYRjseJR9l_w*SUG4(A#I{cV-Sd9Dj0qjdQm}CloC~HH;MIwxH z#UhzKA5jl~UsdZMilJZAvvQ0xOU?U}c5CA+i)bXLJ#?74bsp^yPp{>(it|WH2!j^>q;r zH9n;>&2(v~m)I}slg_`&Pq0D%Fp5%cXMWtxTXx@?!lJ_E?iq1lV;Eq;3!3$DJks7< zH#L)zSGF{nN+yqGd^a8@xQM?DFXv??PV#2>ni452ApW;qaF*4Tnkn4vbxAEMId<9$ zhYZCA883Y#VG8MDfTepEbFnUL#*DOD1VHLI zq1G_Y2v8;B7q4yrlH(!|$E_HdVe6w4S{1SudyePS(+({WXnCUbT+1=>gqa0hwH6$y zYG9^1i+}S>ZvGNwLJ|nvpM>zStK$%(l&#LF5wAp0oo$MI%{v_6D-s|*!A-c0;{3`x z=WT`UCNKtQc#$Kn!%06$U1q#ETclJb^)g&%wflL@>WM?5{q)ER~ z#6Z61^POJ16(~YQKLn&8Pns504QBcE-33GB@6W8}IU?l{VTK9V;0IT#NCleOy`{3YL z*#ZiP#%0PA$B92{^jh~pv}w_t!L$rOO8D?wX>SLQyCe{%P-{RnDP=ICpi$FIj9U&> z_n29``)@-f7EL*=!l*|iwvg_Z&)@c>$&KI98CE$%SAUBqHJNjtAU6*(SCeDPE$tE) zzfpU)Vc*tJ-0(RvQGz!xE_V8J34LjKbBMJv81ri5%yM*cdVnRQZ-Xybl z#~ixgTe;ExgqWjc0lbOZcoPxt(k4(UoY108Wdtzbbm-Ql3x>d}Rs5w~5N5dgrgxrK zZv6|YW5dz`996~yS1vjd=QHZ{K_cPV4VW0dO3dWzSKyY|QSUO}#_tN_+i(QkWjm~7 z(0jCCa>g$yRU4I(hSluo+cplzxn4}UWruQ|pL$K7yRWo;W0)7r_yFW+CF!wFA9s%7 zMc13^;356@?y?>J1(k8HgNx{ z#{@neW&+c!$1BC5_3+rGSIYFr6vdfJ>|M5W6inRAILN!h_(apO;}HW!r23jp@gU=k z!c?SF!R-huOAlJS>^V~DQTrm5!E&&&e+lQ~P=sSAsQc80)2J&zKFB9&6P3>tS=E6m z?;ruxLnmZfl-tP?CU+>%hMFi%V1lzzMN8&E&PvUwdoXU^kal4|#B_$PGcuE&alKp( zOAYS>PvMqoCfQpL9kjfM%_exV==qP= zT75w#4Un%lP9Iai?)p`u`yQ-KnOasYiag1IX`jU@A~>mo*qfko)-E6(JFB3jnZ5R; z)S|bslH~{m3%>0qw9K9sP%qXoyi#tgyjzX$?|ngF`+lM08j_&1tQC+{0wPTaCEV|< zrtDck+Ln#W2x0)|t59q=dC?gim*dv53t5KH4IwDOKbRfFZyI(*g~mVCb-ZiL)7U(} z6?g5IIb!B~Fi}62Lmcnewa-RPN8AHW368uqdXf_&GLE89$5&W)Nn@*tvB8eSWqINJ zwZqwPvg4(Tr%)Bz8dTCH>7hqPI-tHO?M?aKLG$QPtO3w>5#%_3|o1 zm0wSnJyiZ51mTD5e%TrY2bm$fX-?u1{-<>-dq_n=WV2T7QQ1eZ~ zB16`zqNBhz?lk^m9<2%1Ja}FjlmQ)$Xc%16GAMp&;^GXD9eguK-BT*nA@{@HN}zt( zrwny68{Fx1LJxdx9eW~uORAwvg9?q7=`AMv6SW0bTh)%zom(%1u+KA5R42?_*2NQp zP&NEA#k&RNI&$k5!!;`B` zxm5I@g{~W-CDf}X?YKonLsPT?9quWL7~W0SSbL+JD1LL6@sMwhm@k;aW&&?6@EBFF z2ciL5hxI0C(x!1S#Hll2g9Gaw3O5Z(0c^$mS6So=281fiE7Ow}kAX@gPCqW!5~ogxGyf z*&0Yuluw-2MEc$E?j1!jpAwt`B_1)V9@`%t3!s?xRhZ;8jkgX^_W**^>&J^`Dqv@N zCw$p$FIO~gZHl^hy4`?AEcU(@mUHqz;#v8bSvS|^H)Jo6^z=nCwm;RfpNe8h_5xmp z3r~dHrK`eGKvExM_jIgv6_3}<%wg%0IX$$A6uKZ)I@ujNOx&hx8I*sg{i0RQ1M?oX znlg!o*l!8QO0hX?*g~b-GM9L>MRYhH@V@VbmWMStlajhUxRpN2$OVB*K$;HgNzmz) zeR8(b8&6$y4R)v?86oNEVu`F;Txk+Dq_EMgKNBXr;gcLCtf~mA zwlOIut%N$SMq|8bq9zYT?goZtvM^I%8EU zuTlP$I~)I_JfJ_qcaBTxi6_^i`WV4Nq3_Pxl07S`!K4%{`#Hb5-)!gq=K?^Glf89v zq{X`vfYBPHDLRk;8C>$AS950uQrw-zrD_6uR7<>B2^>=?>|L`u0?eQRigk2+(0Yv1 zI!?J!Ux!{Nf0G!gS|9SHHwhvu@yUuf*@f70!>l$8phV--7e=|nq)wb@rG`|#tuHHr zFI4LKs&zbGHv>x*+r0Bj{or_c_&z`T4_61{(?YbbOmf#+v5-pzsiCiasfj9e-(om{ zc^KYY2+5(Ma)mt)e8;LlFxX&n7N0C0acpiTPrUM?o%5m6M30Xeu5at&nM4pZEzLC% zZE^Tu1PgoH+KqK+th?&*y3&?!Xh9h%zshkTH+2`x zckV=fa%7G3Ra-QNE6Y*-(}loYmu+cX$2^qHmOLhv_!mv*IfZu*17)zz>z+oytRiIV zA{RV&8ru)Uw}nHek!JnE^UB_zC>J+6rD`KxK7iahhqr6^u-jY{z^H*~~E-=hD=&=H@SS{so9A?7y;88ZA4k(Lzwifa!X zR`jPy4HBaOtOGlezeVS#)NzR!*^}d*?Zw-1KX5+1EjUo5k3{%AWP?b27D9I8BBvc_ zapkeuF#Zi+=4oE#H{}F+aBQ`5FrciL4XXK=ECP*^O5_i8hqA-ymcZ=%sQl%0l=ECv zf^YMX1q~DTZMYSX#=@rI6J%hh73p*5m#puDRwYGC=5pwu%}mU}5W2Jq2^-@RmM9xy z5Ma84w(T|Qyw(L&+GnD#~Pj-2UGO{;zd?jF&{a`moyB_<#S<|2*=4 zzU6-w@;^rOKd0x#`TURD_`lX)e#<8a*xK6l`x<3d@b}BVzhAhOzP(-F`ttnH!?!+j z`kuH;L%-W^X-|s1oA1$M>=LpffoEZTkwA*4IZsIKw*!2ed@j19dKF2=?YbQ&w-w(n z`hwu{rT+Z6G;!?h{;tjf%0rtiHR1DNg>(@Tc{2J`e+YCQrjOumTf`ND8#mv+sT z9k?@=&O5OQFoYR5XD!N8zzsR<4Go^E4L_e`aY%)}ndyrVhpi~=wfP47;#Qpe4i8m$ z*Cok(;xsYIy*wjd`JNy!I7>O9EzW98X`;t5b^3e$?peOyq^-U6rO%`OosHt(@Bf~^ zi}n2w)B3urFZa;+Uiphs0mfL|_r2z8HIzGVWAzVp3#(F z)ee2?aTK$?8cYsK2~r<@{u%PG9SDwZz;f3BGso#A+Wc3Rv^j_w(zlVn2>IO}67nrh5Y&S?-xzA1M<;=+h=N40rh6d-m#$1W3fam zl2=QTSJV7+e=3rnDmdXN#rf>8VFQXAi+}eP-+xGcPos@6A;i|k&J&wqZ>y9OAE5{8 z5c_H-sAeU^D3f17KGvrsat|z?y`l?ltL#r2XC-HoYl#DCOy%iV{&p?TsN!(7#lvI3 zvJ6`6zG{}BQcbe_jl&FG$i4oYPZy_BjU5%m%bUoqxk8?lEP6+kk0&W(lUEl0qs2Og zyn2{=2<_jWxqpA2Up^x1QUTrahc*BAYs(mEI7M&%ARc5pmmnBs7=wh=p=H9(xpc1O zouC$Lg+RINhp=hdEi*K&CQP(4H1f2*r|Q0^|F~_}dLLRter1M;fJAJ&4@0Jvva9!Y zvOL^_ay#z`Xl@8TJ;r_tST%BZKgbd+YufMM<>f@>ZBn%>^BfcyEs{qO33 z2J%?_etESyi^oCI-N1|5|A@M*9&d_dk>*i*>nid{qG@KH}1?Z7xjY1kn?|1yCqkOjypJY|6XXyRew}c z6xT1Ur}|pJec9QH&}UwHUV)Lg0?4*^%UKV9b;v@VP%|{LzPw-sMe$X=flaVVrIw6} zF74=SSGGUY*_Vzrvew4P3$l_*>*Hv=<&;#Z>;v*lZq#)pMT!j_0q>$Q2*`5(Fh3ol zRPR0fXRG_!P|Q<$>rtJnxKXMZ8Us`|D2QwnZGJTgOJ*q6r*OKTgr>)le(h~;<4`WN z4a10B+#5BT?aCl0xk6|chYssCUbkU0oUVxXy53ON{OW% zFzTy1A@ALWufh}kF!SC9@xO-GzjIBR?@&uk{7Rh;D)SS2U?$gLFA>kqC#b z`YR%aa8?wI6Gu;ZX)V+mgsnP1BO=R2H;Z@vk9?>Oq7iYqiOLE|mE_jRlUNRXTKe?i zWzHkF0?>vZ?{J3S*`49*iqVw+(xRc92?-oTrC5!|ka`?Q4j5**Y;ax%`cs+6Rjnia zHwY3MYDV5xAGlK8`$D{HQJ`wWH*LUM*`5Kc`Bj_T+uUle{T@d z%8DI9u;0dZ^fl!9Ysit(hvDaz4tmO=rCavK{)fxvxet#+G|$() z;hUe}7$gf?twr%UtFjUA#s9Pu5}ul+e)F$(9uC5;5}G8uzjb~!57>{Sxuv5)CJ{;n z^ZyywlEFnC$l^)m`um^9v3c`@OiNrG+g>wxm=*XAXe0I0TPjloNB;UhQ|0+^6E8uS z65}$gp;H>X>hPXqtM7oLSC*P0isJ`V^hzWgxs*#{=`g)M_&9g>u57y(S)*GIS!)AD zScdS1^2_6>lEgV=eEVV%Hyc}3jQY*rQ>BpOmkED|kOv2`V^t-yAB(Nu-6!nS$N?Xh zQ?vsIk-*$UiBPKEA1?FBYxujv^mel$-ZaRh(0?23oo#ibPJx-;dv3JRC=hqB! zv@X!(i`Y;H^-NPQ75ZpQTarm&o+x`ZTpwdfDYdhE7gD3qVOR5B2_mJBZOjuefGvM2 z|946AwG~++V){E}-wh>7Wr8r6Rwm)j}>7;na&~!tcL;;`jRMC1*<9lOh zrP*4J(b7-7PqH0$U*?o<3(nS;R&U@j5g#|=>4ubYexq4jqwxf7Ohxn?`WU+@DOdtF ztmw^7SX^FOX2ZO6CmztesfE5wU& zgojpmw-)ku&A|L!=@~_Vsa#j8-9X9Hs{7y7|E@@5^N9mQpB{%l_fs5Dv5`yko#pmo z*}-UtXmhCUQn)w)1@-S{T)z4D{qDpd}9XXPK^9Q$1r(^Y)U(dflFG!th2x3>+`m<>*FG#bdqZnX40P^pb$i2J_g zXKEXxuvk7NVVP@A5)Mk#<6+*b!xfI-wu7md?LTRS5e0X~;tX!`t=ZRhQVBkF?Iz4m zI)qF+tl11qh%31_x3K>djzlpfO7RHu`$4!}0_4XpSBxLl6nYM>+vm$sjUowLY1x*b zX3Qa~R(w^T#rWDRDyyIqlzyA0ZOu595PZI{XB&DxZL?X%=As75+4^5O^$X$ZGBn6s zabcS7U1w$csvEfwe(yP_+vU9<|Jl)ph49?{BydFY(j(?);V;4b1&9 z_xQBvJKjfsi|1j4KjH_@2(ESLVT14THjjz5-!Q*Il9-f%ardxK<77SPU$uGR2l7wi zgD;Iuay!UfUjH`#*+t4mpj0edocaXTI25J&#qk3dBy~e1W_FwxMCd7iOL_z_J?n z(#AmG)0&0aGEACr60eBi*(r7t;nK%WkkUb^9#tU1#Okz^;5G%cT!1GpIZfR*j+F>M zK@}r!8Ia-v`M;4F;_?gQ^u8yy#>D>NrHU5KC!X%v1^m$>7In2ZEjT&P)$=i+jF4#} zCxbi(MIsUTkjzN4JUwqzdQ2t{psHNOFXH;Bq6)S7^#-_23Y(zwcu~7hp6GHEmj#O2shjafCp| zRb}T)+Uc$gEqk9i_pg*0Iq*5@2igqlS-!}KOnhCDH0ENlXRo^Nl%eJ)()VC4;;c1Z zE-0F{Zc?By^TmmLBG;x8yOVBU`H;VHW>xAz-TKy*TQUQm@eGasWbn$_*q<<*;F{5D zH^_f~S*gwWQgbJ1Qwi1dA> z7>R{l?|TblLJQI+3gb#`OXoAp9tarKkx>-e=&HxF>Z@)VKs-pyI!)mj;8i8Rh z&LPwuvD9AJ7B__x8PnK$ks|w{0G!V+%W0YHO}MmZtBc33FPgCMsD5rtE`-xHx}ZCw zDGr5>f0?9K9E+;Fwg!moAN(btcDk++|GF#PeWpTLug9&_nrrtgyaW35QSrlYx&+{M znwa_e208S!Rmp8>KQ?kH<9&@yL8xc|-Y4{IRO8MmkL`+xMW?}!ho=+Z7FVd2D({V*|@$eKgG`j%dZXv5MDXrI@HVi zHsgh+ZVXKjS#mV5BhsEtJ)xyNv6Dsdt!wh9xxCq>??KqHl>BFY`G{XIkOVGyypAW8 z?ZiD@3KBfdm!M8GEK94e=H$XCUJp^6&`Qmq4i0p8$~vE4ahsx^V%7a06~wpOFBt)7*!BcBb3p7x#{PJ82oC zqWU<-_7O}vt{h2vo2NQP)gEb!u@KPxjj~fP{^UL(dniw)o{-8X5n%1h^(S@IbG!8x zLYoKu@*MG{b$*2c^N2I+jW_klkr5aC+wK2D(^t4P)jodHB}gOP14egur*wCRNP{$^ zySqk?RvJm^?tB1|Zly;`{O0$1-#=ly&N=t}>2-eHp2;rX+|Vqz-_~t9qo3d=QR)=T zIpJgCn##6Q`$XNiO~i0NW?KMf4(!>(?WkDtpEiB^eEdn(p7)Col(KcX;q3?{{fhlj zXlX0@|EKORlu=_zayPVWpFO2xjmz~kSHS5@pW=5pl-z%{tMD9WtTQ>Qsmf>6YT^4DU! z3oqx>F1-aw+KkItC(&h|f_rvb4pPcx0|)%VtrC=?vW0SwWTMcnNB^67Cyf(@$Ucte z0gi`=_TO7tE+rZGs<0#Fu04J^sjtSeL!m$}5J@qEuA%x!$MrNiu$&%?q6}1~jmtzP z!JME>m-lsndISZ7%BuUm=ifZe)6qhr|bG|qH`W@WXEF*#5P%6aY`VmGi{IE@= zQOm#$R!o>9*EA}0{Grxiy@VRrhidV<{@;%*#}onb^vjav%HY$=Cjp}$E0k^#Hs(?H z;@{$2>u7n9Sl%!PLWr*;ACq5Jlb5B(OOE(&h1f^{5W#=g9fNBE6!xCFssEyAQFI#~ z`?43{?O3T>uC2PJjPEA(Qxtkb@aE3epiSv1I^OvQRxR=4!K%WM7uAhY8IN~0sq;VU zFtVoV4Jpp3+9}?o#>LQZ$}2sLlpG;+3=WQ`QB&8zJ+hvnQQG&Vq8SFV##zBIGUaZW@H*x&sW~M1dd_g5pVTQHPDx-{i>E|4^ zjM2_;$f=*f<@K7dA$p8z3F(J?dk3#Z&NFI~^Li8+|AFPZ5+>A}zKuu0DozU-!1Cj? z_Q$Enk3Erdn7wr*dB=jF197$FjGx8eu@|uys?xjfts2JEZDWzuM0{=()!eC>A^I8# zjw3-}$vX-)3naj_Zr_C6$ge6i8PeY7+K>u-e(B<_q7|{pS;T<|*VgSr8_WzS>KK?; z9L(GFS$Fk_pjrPVEPRS7TTICF5P23JuHw?MQqjpwf85Id4&y%_cG2@JhkqQ$(hNOQ zRg6l!UcE-AX!nbRYKs`!7q~|y|BSyM5>gY#Fg_NNtER-1GYpNs&N^w~nCIN4OCb+D z$que2rXG$(8@%e@&{i3bev_bwI%RAH{u`bnq7kB<(@yis}Bp#c%hC98Q-JQ z(Hc3T-$RC1m1_b(vP`R4{*YEAPDlr>G6nc z`SR(ai6(mzy@R3Rox9X|Rc?ty-U>rTm`H_0?`c)UzLEQmrc> z7IpgeZ9K|a94t7QAH-}PWkZ_poZ|+teKyv=xARvjF~j7A^+}zeF(GQfQn1`*l9#B+ zm)_OHlpLzS!~<5QoxNinj%=Z6Nd-ibnTR?aLAqu)C9l9n^L~@~oleXlshX$pqUZ6Y zm0gtE*ZW=x=eK?J*9e3$RT^H=f&G7Q*jXSht1|#dY5@YHED7C)PyzP-7iEUiueA1ZRH-x#bL4{Hr34@J6ElISYnm6P#bAnJnRz? zbOD>kT+OwR^p9lsR=MLccNij!iZQcFRvmkrQEHoDcmG87LK7n`bJ-Rf>Bmi&SXu#M zw4JXtC_~mnp4Jftq|WQ%x}Vt95%37A13#=F>&(!azK@eB*sXH;tpd1M6&g0Yvsi@w zLp^T1^XPXu*>k4`6WHnZKWz`wTk>!U`sWHf}m zhv@yU|H}>>&(8TSC|jGj)?AJ5KV;R7A?9fH*F08yFQ&skYP&9hy)EG>a9E-&J8fNR zh-MH-UXr0y#wNK9n(?V0mbwn*7PKbTKXkB@P7uHYo%Jqd4b$bv4 zT6SN|qB)KQil$t#c@(&5?j~MQVnW+bAv*$@0<;JQJk_*9b@S{2*e@4 z+@FYC9E9yMG9(w56`jwRwF145(@B2vb!lg_-FDjqJsH_-VDUXA*+1MHXK_d@ew-hM zPBw;O$6`1&M5YZtix2sjK2HYupTwGpNZH}4@Z1+9aa-uD;d*H%fL%PcB@?IciMVnP zNg?3aYb^V+y#*CUHtcLP}9c5c~~cil$;0J|=+1_w|bEtx=!?;krMT{V4Naq))l)LNen! zDTB^C%q(on)pUm0?jdZIDYTELM9RP0`-;h9nE&=?M4@{yXARFj7R*{^>#vwSPUxSb z{uQ}W6uf_1DSG*1AMmK^HKnI5U7Q2!i(;EiXH<_XMmS>ozOhRc^0&xxtVt_er+*aX z4n~Pke@ET%W8^X}YPf=M1OeNU$RjwVGGsmj{Rn5{!)cM!1`vDjnglbT{o?Mn1(crw zhktZXshh`;Qp_57NpeDFANCm~3_%$=rvus_iV3z?sRPGkC=qD!{lL6G(tgVM!#hWKA)TWG29fL4? z^a*A}E<`iN!vRjP2~ME@J*DPCYFdKF{R3>?be_lG$Wq$)46pjDUA&ofrQ9T*;>n(Q zYtOM92aH-YJJ2N}Qd%MiBld>HUbZfR@BdzNyj|M_zp9PE#&sPy;Kr=Ty9ow# zMetrZ_SzUlM#{kYDc+usB+O%ma|sgN!ZR2D>pAx}az5AU&fFCAyRZ-4+o!elGb{t`=!3`Z8uu8$62a~2fs=Ea=fN+gcGO=R5|epJ z0dFF(1Y65R6q!p3Kn3ZFW`LDjHj?layD}8d_C6)*cwhoavf(9cR&OY{+#5zg!bq#P z76JIVZPfx2cHA#cDyu3Z!Q23A>uYWBH9?9NaleJ4dR!1peZkJK*}V2Poy?B+9lZ`a zQvaL<=Rke3r?vds-X_o{M3W!JdWvh;oUTiuAW7?n=?3E;qJUnb_GUT!KM)~m?~nTW zt0^8jSqNeyFC6Rp_YdK0WKnl$tb8LwxAFzMz>hW++fp}wYK!KdLn>}S#}?=tND=C; z)|?ci%o8VUVMg0%3~yp4)t^O_lLVo^vCf@xi?XPsvDL;};2`|AUdPrc3bOp@H_V(n zRtawP2+4l1VZ7T3hRI8Y^3nxgNn?O@4HzO5iTh&w<4n}mgbwL!=n-)GrDQ1wNE{)L zlVZWccP)O*Gu$*~vhHs{k>b?J{3RUhmQ~NRf|rfi7Zd)Qv2~r#bd%^W?&8uMwqKM- zv~tKOKPcYHgE0UPh|GSN*rx|l>NmD*AH9b;7*xAsv59ZjRWpq`AW~K-~eiV4DJapv=iU7m<5;n-{x;mt1hhm&x9BnWK>!ZP9sJ%~))NB@i}iSKiVdqhyAtfh*0*YuqR-ewINH zN1lG8X?$F|`GWNy$8v}<#Jh61yl|uo9rd&koZIuFvjtb2wkMsNsoVNct!7(0UBd)zmFJ^lL zWfDDnQf)do*7>j%x$qh8gTs()*~U_;a$f@K?IB6e*ntmUd@hNST$CZ&k6 ze-h>FI5LmNZT!<_v`4Jo!^;6=rj)uGI&sE6dcB0)oj;GmqGr#pH$mVFs%>?h9Z(TY zqpTc>>=2WU1t#+iy)1$zE`h8&+=PduTOTtpqBI6H6@fEAfB-LzM;)b^5>~1qgBKP` z^~?y?zt4BZzW3SsQFQ*ZsCxF*@?Q8;ea}eHz0sGg#iRWm5dzl-cf^Blng&mI+BS$xxt$3Ss*K!xF6fU{}p*x98X~TCC z-EpAcE9kwaVg)6_Epmzn=Y5J2O z=b`umcgC~f2^?qKs);WR_4}4SSH}~jftM( ztrSxo{_u!s$TF`LVBMQooM9LpYAXYuVPYBiU?kGbTQQpGZ)p_JABC|(EiTA8w4+KC z#Tov&%rs1hC&b8_CZF4m@5@?MzZ*(YF>0IM^M)PvpPz_6xp#&A@bb;k>=%5HTq!@d zVzs%X1RnPY%7Po;o* z{V*c`{lmxmI+@g#=_NaTeqmAEPac#%zeOlO7Wn(1Ch)H6t|1(jyvTouIe-%gz!f6b zPR~LS0^6}w6Ds^-5sks>4{0c zpyR7YT@fP4%aEW@so`L`JBkZT>@Zk~OUD|Q4iogCfHcXfeF@4Qh89y|dAT54@{!=0 zm}svC1YD_FgpCE#pxqRT@*TTK`Y`XungIgi35}d$Om}rQEAz%Qv?A_~NpxE|2^nGs zht{Y>T9-~Bh+s@&Lk>rLZ4)N}2jr=rJzuHXuRQqcNzgi8$%#{q5S+U-r#Sy$lN0+B zEPuvug|tnQi8?mX7hwb;OBH`m&E4BbGo$!j(wAow9{lf>-=h8 zp3+!}*g|1{hOMNhgkVetnQD;`&o2aU-K%SQrSC%le?R~JKBW)umXwgQ4kNwgK4a9& zlT^!T>A)-A<#r^24K(`-ea`pk!VqjxK z+QG?iI-Hj2OV#k*>RLF|*jh(w@xsM^#pej2TQ7@i5RL2mqUE^=*|$w?UI7(eD&X+HQz2~G2Wtyk-opv97&=k5zQr) zb+@cNOJazDl+rX4x4(a}E<-*-IE`Lcb)1sT{3XrI>gf$Of@gn}n`aSY+r9>UIV34(0?1Z=zf`|pgtmqioO#CfR zG*fPn7&&+#thGXK9KEdSS>bQNt~36{WgXA2@aT^ z23iO|LYv5L^R6eo|5y!>%!=LKH!*a_o!*nbmHh; znC4+XPYd!(_P5Q($EiyPgsFJi=^}q{KQXi~)U9Twm5+aqHGhme{2Q-;fEgb76FEt# z&d|^t!Eck|mm&=a=J$Zia07i&T@@OaC45P-0%FevG2Q?6sx%mcqpUO?4|>|2M6MQ& zffTByw(dE(>S z<@KY<|I53pCVL}~$p;di01IE(e;o}AR7g^$==_Pg1LkKeQlCt-SAVx0FaCUB5pWPX z6!>P-G^Xn__E|RMZF{^UZJX*kCA#6ocb2KEq)RUgVePv)d3=T0e5rAObDv{ zaFsA(xj6m zDU=Q(+N@$^C1w|cu|Sj$eW?DFm5~!a<%LEk2ngPdYro(U)GJ6l%_k{JT*azCVBl7i zM*q%;rF|$y6&quv41i5MfVS5^)f0|p0iyE4g?H{qRWDKq^fLanj;nRRT4nlk%1ZWq zp5M$v|F)X{ZT)B9L2H2_G~@}sWL!BScwIhi@@jv`3XJ4)ebSJ(mJZ!Cf7lg0d{X|O zik@*l!(5s^z)t+>pX&Xe-%;VwFVy`SZS&h2{g;14hk~A=bIeT#7z~?;62F}Bf9Cp5 z4et@pmQ3nU-;)rp7LnAS3o1i6d40Rzia=LwVmN6D1CmyuzI7~;HYgloh?3dp|Xo$EX=(B*^A1`^wrt&67hT0w{DAZnL|R_jv47D z@nsfeaZuRb7l*Ijt(EjI336A#m6l3RMkuD(jajW3x@D`M^Si92SlBbq*&a zKK&?Y@7hum^yJjf%dU%_>!2hub%zytUl&-m$vt7c$=z2Am5my)?`Msyt67hpgwSBL zU}h0YhEwKt)SZ(Ry5{e5FV;Ofx1tp|?2h1|Anc-;eO_;x!w2EwDm?sSmBQ_7t|dxL zT7bI7oxWB~K18v5cg?fnKfmyd?chs}oHKn%kmtE?M$Hm~U4bUWg`{)tVj8vKP@L6I znu1R=qDQ}!eEzApe+Hjz~Q6iy{v}WhqRT5jSJaPPn za{G4>M+}*>gp{wD=o`(2Go(CBxX$7CA>Yk81Du{*$c!HYl z3?EN=L4t=HW&y{3H8mnw`P0JNS2B$Fn_|!~i`fo8-jha}RmN7aNmx#`J>QIf=#82T ztuM@7cplJoOt(!g4KET$1eHhqPBRUo z1v`ratM#w53A#tDLvk~jKQaVC^XUspo4es}&T`Dm8ad}Rm;hB9q1-c*UT#^&iPsz^ zuj~?H9^L#0&zP2+A~(&IYjmi39Cq9R#QOFwP{hm11(eg9(3Bm2R_!}gdD$`{W9%kP zP)B9&ce^P*mbRhD5_T?+mv#KM2f{AldvfS+I0H=(0sO?x3V*bxV;Ii14EfikxtPB*G6KDJZe4>O zi@3k}pr$R9UUu- zqESp=;oYF+;fYU*1LYkmVGU}Zp;MOCfKZweS^c-2!}h$#8uDf)Ycwit#nE(9i!!8N zK0iMby!%KrtmySRLF@aT9u2?uWN{(`_kA`g?k`o<^cs64U!q7UQMhLz<-uI=>J#-) zw4N7ryd0^E@2eAq{18R_he_-uanvi&`HMZmH-EnG*?#?G{@3V)t#v(z{|8BGd~+a9i21I> zU1Rd2QcGa-pVUN_2I{a!06+Te9@SgBK=~xTm-fMG-Ptey+|}8qV0~{LJO96b5sD%w z9hTs!9>)}(|4Z7EnLIaCD^>lY;M5!4`5CuyDR@y$py%!7qWAGIzj2o;DUG2zT5I{b z`$$Y(>Y}NygrqO**d2&(9(22W{&ff+zh8}o$nqFfuQ&X!rm=EX?;Ff0I`i)Q#ZJx3 zW4!chkwcgJTo5T;02Xc~X&)mHINkLEjW>VZZ7*8I`Ob5;+Grj8&PSp#a7yyd?&Q_E zzvNc?*T~?*gWn6xsR=oLC*{IOTVM0Hu<$R5l%;(s_Ai*3nWjiQQ+vX|Bd=Ic)WGp?cm%b?treVQ@I6iPgi}f*I6X1%LVdDI4W^zJc*{ zta?vUv73xzK_chXgyx=CJGm6Ub(&k`4NHi;?8e{h<~6*gV52|$==Z`m%&m=lEW=R7 zV$BgTMcP$)FU1AqZ)m%-h<`jzx>6)X2))M8Y8k*&g4xU6`%2v?6);{ygbYSA&o!Lir4xSa&5 zFx>S1%v=g^*_g7)kbQXiuXoe1wXV4?N3~k-l7~vl;ol`?e50II10yAz3Q$(mT>A~j zg1t4TT~f41hZd$fx%#Mvc?e}p2rAyDC@T_rtl4G@?RqqEAK=s}4)n9-pGI*8PN zBU$8V7fxW@QqAh$bHvz1dQSfv7){bAn-F?u^V{4b$*l^uvXG^dGSLc~Q%xh?wiS0$ zD}BjM)(zF#5b-iECMf0zI#E%U1nd7b%7qoqbkN#`PC>S02m&WWhMDwW@VM2XY4k1yAo7`DJnbtpFar8|5Paw)6T|-S?TNvaoPwdfbe04ju z-#VQXl=)h)34Z=Un{4^gy+@It1>m@$H!Z1$vz>=kpkDq9C?IsIqR4c1E>e6yvldxU zO+5<`_jmPQ%!i7w`w|K%JPzF|rXaE>S3|umKE>W+6!~jxm)a7a&P3L#@?b#}WUT*HEvlpjnzPaTWXh zAPcsL8Ny9R(ci)j<*e({McXfxN-7pec}5-h)ENW&Erj)6!VY)KV+OvJEtQc%W>UUk$z~W$o+*~S*v3$i5;s!Pa66*~CJ>Y6Mol#}`XK1*)Xf7>h{FQRWI5=)gIzfb28@=;jU@bqdF-Tw!S+3r1W5tdC z0Crf4e?}Zx!+swX^O4CS{-RCg<>?BRAIWxjj)a3>^qm@_AX7=rmGk#@3RInf*sWm% zj&sGSTP|OWopGj^j3VI~!pck$IP=qvwM7lq%-q`G1mV-#kxEFSTs5F6B8Uq8h&R=z znlaZj>#O|b*^KM?&hcl4-?5-L^uLji?%8A#!SdMZsiJmnm z^sYkOv-DON9PjvWsU+Y%>v%yqJ;dwK1C?H$iQ@@mQO(lSvHqqqLx-pvEGgyFoE#S& z`F_jU{m`@-0-3sXVp0!rVs(b}D&;=q*mPNB7GSu+E5H7yEKTi^<7z}ssWKrBN5j7Kf|KA0W_^U`L2Pf5wynzsk(M62MRT^smm@ZYV9lr=cXENlLZ<>r21=2Wf7AYZ8J3W_kpDRj}oB(IH3rulC^aor9V zexzt-DQ3Zh*fVzzl=TRWDCeQiD{*_qg`*D2Lj)g_(ue;PmsmjtSYjPan0 z*_+ZA9LCsWkF-F{5sSwK*nX0@h%-bogR^8h2IWkWvNNdVAQd>*PrNj#4AnIs`H&U~ zB$4EoV+Lq=X(Let7I8U|5*^wY8YjqknQ)7FakaWN?jXa3^zuPZXxw?!o~A^4oHnY| z+H{ptdIn{(hj^YFb>wU%ha>$%S@;**wxZtQ zZ)}<4shi_}FhBWY9rm!+->x7HSL=n59~+yzcl94KNcx z9a5HDo@yy$Uj|P6VuUb(mtRg&7Q9YAgt!{$&} zQ?Ua-81Ycb38)dq_J4gd5`#ved@ou_tD7i*R}% z^FU|HqpQfr6T1=8qFgmn^2`@=GofriRm<<-@5ci>!&OgiR#u{y z`2Rduq4cx&BTyf^1Y)AEMz?!cjKPmFX&C7?R3xO8vUTYw!=ta_lplH=t1jD0rCA{{ z&37%O0V1=5RlR6!ztJLci^m*H+MOT{AqzY>Oh82@DDt)!bD260^Q1fVNJoh9P{j@% z=JMYmN@B{G{I)z!8OoZ#@xp_TOZ_-5%Al3;p<+Wt-52R{5V1m%cCt!S);$;ACzlplqo>r;pKH zhCG}XPP(N|oR?4rS9G(H-01}KwxxuSE66JzNWfy8qHazUj+m`>7I%G)r|^%(5rMEk}TwOd3LfX=#bgoB03^o^`ysXqRY*7+Htr^eB5G zw=sLyVxPNFRDw6ere_3$h|hM5!D5oo4{<6$c2ok4j;w!*tKiVEiwUl^gjz>hgb^|v zGOwE;)JgKf4Ox&gk3}7a?c%|=DK#Q!%Ru3OCano;3^i*dWT0WTigv=jK)WfH2=W$0 z^G3X73I%ML`Ap4#6M0SP(|*!lZX;MIlJ?KhHJt3xjmLwS?v1AlPeZ6&qq~CzC&xM5 zpkN^qvw<~@ofwo_si}f~EXi~(Uc_cpJM6l>&<-8bQ5Bx)KcU`Y)B%})DIkI~sW@O5u^V!O(3-zdfzl8iuDEF@_3f$6Y(65 z6?uXOUqTjxtSec|Z9d{4mx2sH8oo{vq~u@fjy|J>4=ZC4_e*FjFK?j9F2^afVi-6! zJ@xCu-+1Q8<_LiHcVOq0P>==DF4DQhic=%Y(|{r4>#55L1!9~57V7_`6fk=px*axo zG^$SGrs+AZkXA7!Tc{G`8nOf#H=uMyr>k`OeaZKqCrM$BKfi|RR2sFd0;s#{KF9s- zmujhMLT{L^X(`(!<1hRN8e1!2hu=0DZ~Es_4V2@CnHoWooqs+G-1$3Iz!rxxbPAi- ztEkMb(YaneoU|$W`g@g%^?nadC0Mk57FJP|NT(8 z!${H0$Vonu9A@MRSE4t{s6KjZ%8E9`QVS5LnXdua6dxRQ7|B4Fm^L=(YbaZ@rkWDO z^gl5-)*Eo$$6DZ$%^Me`7z}@Q672qu*CLEj`8kMpw_zh7R-TaUNL$`|-Gxd^G<9cO zc(N>6UNjmZP*J^zTNQ&A++A*-C2kE9sVEJ0{yn8T1%3{9eeMC1cgj6S1BB<6H z5iBKctA)=%+eV@K)w)f?zpHE}jzqZ50$Y<}8MgO5ZqAmorV$pp1?*GXjf0VjIq zsD2|Kdl7gf^72U{Gob=prr}z9z0M=OoNdN+K(KXlc{^`0b`uk6j9Vekdr;Rr0~<1- zJTSveer+{Uq({Sg2|BQNA8>oNPzi20Xt6<~pUFZ>v zXCAVZj++_~eUZH>L2(Z9{dwV^4M0mQ7i^ni(!uR9dx4IoII6mqgwLY?j za~N*RKPc4Q%$IAaEU#Vyf~Ej%557|CuxvByCu}?t74z$~Y=VQ;)5XP~HG!O(q6n=p#!M z1R>N5&J@4j@I;;Fw#f1^0WNAb#woPYY%$`ZO4Nh_qcR6Y9}Q@JV=5UF2@jWF5_oD^ zOuR#qc`zwMB*vSf1y4Z&zk#$xu>kW8`dsBSp5wI5eaN+G$eRRpZ4+5%qnrTSOG7wP zHg?^|RsZP|gtY+xKJ#Iq#5|GwD8TsGdYNX#lh63O8z)vHo(7pJ3iXO(d{pD^dHxh} zAp(=B7T)#;l-~++Re}4bC)^ELmzG@th{q=aL8t}dvMk~XV+{bKgBrC+_CDS5lo$#* zj)adKavJ4sW)wi}stL%H{@16@h25g22?JuE`NbzokN(26>B~Q%Yp^B{*q!{ps|8h< z3TKL4m!7f&zfeM6!QjRYP@ha?NTaD0%1PA*s1PnNna{OXYS0Qynh2@0NIgmEQN)Iy z;GKcv@RrlUyeBueKix1KJO!F`4ZS`N0|aEk#+Sw8YLtaklq z(PZMSpl|%SuSiF0oJ-+^4vD>RzgkFCjM810ZZ0CWmV$&?8zvne(PH&ktFlxG{`H}e zHyOGVL$q;uHC*viz_cAO#{8OP%biF5L4BQ_C)diL@^#M`CeduV)iWdW9=g^~U%ZT_ zHESJIdk>&@PZz!ST656DoL~IP=V)s9F^72B%Nvb$N2BP^?WxLvOdo>IMTMesT9~F-iXcrDakq3_QK-vzx0`>C;JH{A2lepM>Pbf zpFXF0FFipkC0>5q_srJL9!TR0k!-R){tOCuKMu?0Ml&(pvvN0(=C*5Ds7LDJxdz|l zzl0=u}tUkE2lUn-@@z#5%A(VDq6IUcxmQ(Lc+3N;sMO9b}$M-m3E# z^pU&hm=Wu0KK8G(Wx_Sl1~Ku?_gLVKgE-0uk778$8H1KQDUEaw{0x<>0bb47KhIw_Il4MT;S> zd5`F6nynos)!}Lp`qLw!E+wy|+aE^$q4&JOS)+BNIA1;9&bzrLBscu^VQshsw!PZh zY(-7s+hZ44Qm%S`5gGhbFr6#rrtBx#^v``;Z}GG`Dt^dW;mkIuTcZ6d$^6tgCgtH<)^&5Y4wS27%d8#DJ z)GSb!;=szR`h}`}aQ3deh?Llc_w9lDuV9~N*p@s}P~k<22>bT`o>VyOzzcI0JM({^ zNHgdOP&aR9a({Kd$>=^5Z>@EUya4oNMuG))}P>k;_@K+lKk0 z!5_-w?=0jNg&ari1V-`TfO2*W9ND?Niet2JbZOY%&bD5$+;#IDmK=fxVGCB27vpK2UXxs;(%+k{WA z(RJ;Yo+UzNSlF51N4|ICVfTx@__ixtQg!iN-qNTIx=RXsoZ>mrPKQ&0cYW1|p^rMZ zI`Lz5vzk|+jJokaX5!m)XuT-2%w$-cMCDgzqe{NuwIc!;xnk8!n}vMf%NIH?<3SD} zB+6ODFHV)~R1RZE<3-3`rvbX*w2==(1l>4vf#cDt#m!EGIREJef-DnAwd@;ke>f=# zs!D;->0L-B1HIA9g;l$^3+HP#-R3?l5~r2!s7DKu4^^cLW}_?Fqy6+7i3R51Z)3PqZAZIo387b_y3ubG$i5@j&dW*XH z(NH?N5<*(IgAW}oY2~_&U`QO4cVA5Tn(U=@B%giMj2|Xv|O{+Xn86a z6Qv!16W)5muSkiBY`q0p>Tz8qSxj(%{Y%PXU7MH?H#kYB3Wq@;=DSN$G`;pVWd$f zAXVR>yd`vPl3d;q86idaGG=;$(cd->C?DHrj!X`3gyk=E3uf3RJSi6Q; z8HxIFUOQ!R;7fBF?A~++ujDfI>!Y8s5O%Rq<}b3e$Bk>I8#(Hb>;X+ZM4CC}=$D_$ zz0&-`4^%jc%BnFwN|1fLU$%!D7oaA7ak1zJ(v*N@1I`-A(nm|ZxuQkr$4Mw>1@w1s zY>V`T2k|j?xiBHCjh*Er4{2Xr5}B!duHzWot>wph@L>l#SvX18=lhi!v@yx-?g?1r zdQ|It+0zv~_1zCn{x>~gC{a3ax_Xc0wDFtVK&N;!?F`$J9iMSj8woeNJ?vEe6S{W` zbC*!okJ>%0A(CB!Y#16da{$)W9|?5}Z5;N!-|FaQOISU#uMZRzby;mXwoE~rI3rwAtep8d_-sx+?4^=83~cmx1rc zcl?RVIN4v+zt3^jC}-EYdpfcQAWv>o*!(aQGbPLo;R%yPA8DXvFweC@3vpK!dvQ67 z$aMIVcPcr4a)6*3Ld*asx+Xby6RU!u9yBl#1OM!}(!dn*9y8f;Z27Ct5ASM#usJfv zefZHej=1(d#sqMUfIUVVGe^^_SrqyQ&#E8@E?To-j$7uBX49`_jG4wqo6w`c|6Na< z{-J-Tx2dvbRQ?NiB^@FtLq5#5LH4Cp`XDTB6tYo)rm^eW(7TyZndSch@@zlWTdug- zWUc+I(yCAqFy));v3E-wr1-W&^=b*q)9uVGNl$C*`B}~LOGml`#yYFt_~(LuCw)I8 zR;@7=oLD>*J8OEA#z*s=x+ScTX#8b>dcsx=CY>B--Sugci9?`>7;Kgn8vRU+DdF=c z#~=C6TlAd8w>;ds*WQWW0zF-0tXeJ4JOnZlqVh%T`q>WQ!E|uLQSW7HDTK7aQB(UE z?>O>qW<+MCDKN_VH4rZ|8F${cv0sY~(YnpxAt&t9YDD*?`;C8pT?Cs|3$I*S2=bQf z&++VYV+Hc^l5<)JDEq%J8uf%m2ACjd7||1)hhmq`3j0dg6L{jSza;|ukxeBII0yeR zP=5vy-~Q4Ki!;n>|AYFg(Wn#l%$gj{SF+5>82ZFYp-l`f@`PdwcQ6?kE#*yglM3Q> zo~gne3mDHd$tNVu&uS?!>e=BXmSQ+s7z2 zCEne*M=(tFx>z!iXCg3sgIIn_A9kWaOo^yLmIzh>)-^e28P#;GLHKX)IA-)6HV@dp zShj!A3xf49-F2(m2vGr|B<`#w4*B4xMm27@nP;w~QO!J})^CPWs{1YpCQ!wWrD}{% zbHAyvR6*@$P)F3MQc_ zS(SX4mvr@z6vqzml_1Q9Ozv^u!;j0x8CW%ZR1Cm=YSh&1g|=gM1(4P4i(cjo(8b*`xowq zAH9LK^H@Ebjn$`%Hx7QY83nP)%yEP@0B`vl!dCYGqv@Q#u)?CUzu zC7CIwq4-nvj)(`Uf{P9N3xwFWR8CRxZzm)TQq{<8wlc~g*Eu(j_-+DUipBoSbDXt? z%j}2%Mu*ScWt6g!vjQSSq^uA*LOf>WdZ!^rD`F-V>?Gcfl0N8+H9h?%s+w?6oXEIg zP%>_4(JJ0B!#QRWPB8Y_0D@6L2B@_FZ|*5-{j`?$j6gjfOo!YKMND6?@?BohjOQgPB8ke0YEFic8}IE2EjQ1kX3(0A0aZSn`KLw+fMg+K?C*Gx%n^bUAc(F;z@cg04OlzMlLLB?A#g zQ!F#LbHJ*D`tm^kptw!sI2FEE-P}TJIWm;8$&_Cziz!qN7e$S)$snbGoD*h13;x(% zHdYtJ{E<~)HLs<6_x^WszGiC-MKD+&I*~v3Va?MgON&YKyzz)2H0C6$4yyCktafmk2%Mk$mNOLi&%>U^M4SX| zuhqIadfDiriYVjBM5pShAh@}U^xrk97o;5j2F2mGfLDlbp_0&t1k4dPU{6+mcziFm z3_6Aw)N!3D7dkr|0nE%2_jnOnjJW0vcq({Z>l84>AA&8-7{bT&}z z{uPcN+C&mesK^-_{qYI1oZcC}q7_9AtEDcg)o){j2B#`7!F%-?RkdZk|FEck-m2MN zmQl&M@y&SEDrFdXqoOq{~+@fYZ~v?pI}G?5>RvfEf#WQ>4X&21rwy2Pw-)t)#sL8-(piT zT`>fStM$o`WN9&i`Aqp=!5P!ZGVw&^sKS8ypUfVAx&5|fd_lLr4`jMrxP2c69zR}< zCVRkvTyToyv6|@s6iDy!ec}yk6wHaslor^(59RyEMhx|HhI39A6c&bAsnh5kAmA(ph?+D$imQTWB#{Est(yjV=DJ-T$%- zCMxcN*#Nn=$eR*R42E0E>#s*`=v?Whi8U5^uLCMj?YOIo;JNd`ckM2H4K`{1gHvX{ zg$>MFP5$*A@@g8nw53<9{AJrh0)ufw0cD0>U>kGD&JH6uSVy zYG1RC7=i7eC4bJhC|vfDUj}Y7-COUD^Kiu`V%3Io8?;v)V}i4W4VlBnUK<`vY9ACL zm28OO#V0lpzF;K8IRC?@^Ds)#El*Hbyy^3bJO3$b$9Cu^V-7MlwfBN=R2@aGYu;N8 zPuYuB|LUTKT9R6E0xjT3ye~s5?e#&ebyEH!&UrX&O>A6lE;Q(H>VK!#-RJ3bT#;q} zztc+!lMnH4&@UsubBhc^nuxDnE^^THF6m?&3x9bm+E1SqpXH5T7CvMBXn|K@3pyS# zRJ2&~QK%tl(p8%OQlN@KFP}`kSlD8niGrBn^?!O3*^ZVQ*MHA6QWOtW zrRbOz{jK(S*%iE)q+sS2VC;g6xbN<(VoU0HJjSsy+TrxI$nyzWiij%1&mkXqk3Ho< z_qPY(dAY&CdG?~>Rz_Xmfz-Vc#d0XKcFiuw`QA?sd@(rVoz0Jj_P@A-yELIc+7PXi z46aJYebwhEw*{Ho=xt=_potw`d@Zl_bA=omi-I1qA+G`k1UcmNN%_-0A(J3rjIw~) z#c;)>1ku4K2{g%npVFNW86TDVAZP2XOz+_nL5hD5j^ssT2))cFnI5Go!yhmTXx3@L z=izxS`s^MCety6Qc!L-_XB{2}`UF)>D*~I;*UE;^a(1$@Wa-C_s1Y(S5p)QNigZO1 z=Vu_P%>>@TANoH7wX_ZqJ!0%>HK)wgh*|mEzOQP~HZ>JJfSaoPCFFNK+P2z64gWDo zrluiZRhRBjm#Q5gIf5S^1{t4|HBI@PR%_?m(|&QqqRL;LG=(jtP%!Iw1Bj)t)0s{5 z!SF>m&Ly|9YI^oHG(Yqg5+p{7lC2WuAx=xQn5LbGXJ|4yN~G} z-e{AMUp-6$x{ntEPl=Sez*#&y=k^x!zbpT(*Ui6Dwt!P~mFXjm-e{DRqDBmt<-g9_ zfaCF{BL?A!f|xw*lM41WOY&%r_(P~&N-1%@n8Yr8#R~#{0O&}HVxF#6tuF!RWq#pX z)+Yw{XfIOu-`Ak~gFz+*Ocd0D98z)TLpoCDzx6^r9mkDBQKlyv#c#uFgHKCW`M$?0 zCYT%?gr~}xkRuiw08fte)NYiSr{7RMps4zxW;^iK_7bAIaAV8T9Ij<=bxztyH-AEi zZY(lqq;OP7$H7x>bD$Ze3mHy#Hghtyzm(@4&q8C9gGa~=E90N}m`hgg;ZOl5bRPQ_ znL<_}TH6R)Y*jMA6)6PV>L9L(UPRo_tA+YCB*~3Uz!W-X&3$As4hPI9K_gSZ1wb>&puGr znv*TJ$~zjZ{vdJ)%|>yN>37?w`d6x{B$MR8)&DD^uz7z_l4Xi0a_}V;k*8|}x{TOZ z*qRr2-JMg(#X!vVS~xxro_V%XVmVD&Q_x>LM>9Bqz$No`8n{U9-xTQx_a$LD9e=I$ z7Z80-VgQO${EyBRjHC2%BRe$!1X#U#*44V|+%-jvPA0h0?4Yf$5zBpb z;#HKgp#$JJN=pw;5gb*Bubk>!54oAj9Nn*N~!cuTPef@ zLjr{iu&+w3!ApjnYU>RV-w)=uOtP?}wWWA(MM+F`}&WCV2$)>!} zG8zQh1Mwte#E1FtMNU>xE)%)DM}x^_KxZG&5LW~u?U6>FTq^DUvj=G;4LMEtj*PAEwlp$2$3dBcBq$bTuJ zN=$=RM1hEkx6~2D=HQQrIz$2xr2V$Go`&3;@Cz=~+)O+d88z|cdjfF!OS$1&FqU+Z z501CdoGsW>28?uRLp1(jL8V_2z+=`L49k~y=0-Km2-}8+;xjoC7yP^8o|)Z@@%?7F zh1T6)M$+f)teGF0P}S1XRmvA6q$x-_>|2yzn?&*#{lbHg@NRYSxMeUPcErWFCVnA^ zmG7K)KAm-93TF;#+_^1-9H1wuY))rlfAnH~2P#g^o;s>_0>x*ShNPf4g`u@lYbb}f zlR54WCB!KqwgHqtO!I1FP9lelG8vO`3G$@K*MFZwQy~@F{@l}B!UvAg?N<*X28cp) za%K*Yg~jvEVk8~E!kQ|run$v71^-Jvy~Vj!sr)YzwhZ?jv9`?qGPkAGde9O_G=B@Q zi)>@Lyo;6?2-ul1O(B00OO9r_jzK01g&z`OX&18xN1;Ysq~Z&O1ZC}EOz{Gp%6uHVYgd6aC(Z>5GMz*FvC+s z(ZhemfxgVgPXnuW35o0Yn9An9-o=QmAzST--HIc+Yb$n)Jio?aR76gns9IGoMy*J_ zr`gtVo4$Xs7_-_^L6EdPRW9dL>pE^!5kg229+Vh#Rrq?Wm<;JqY(oJUkYV+ zRT4WHcPXT7QsEnLhk+mkGB0&@_Tq7hQG9k<=xzxR3`NDDQ{2ne5T|BwJrA{o zR-97E%)=~_x0DY`0TAYl&xRUtxEc;S8>>uVb&VQhom%9#kUtl7-p+3*J73V>cZ-<` zj^Aex`rkJi%n$!r{SDw;?8>7K!~eY?+phqyX8aTCTCM-cC!x)P*I#3 zAKRSL!~|53@8i2OP5)KfB->Q|`Bt-7jdH|ZOIz(ajHI`Qe;>rJ6%~=7_XCr86suHDdnXOCEAS6DUXJl zMWe-qEO(k4)JEK}ydz8p!DVjgfV6d@M+me@CHGoz+#p!GnR`w8z)_wU7>t4!6!N~1 z(LIReo3t0LM>!T}0jN=a5$#fxRt8M-8U5U899y!krgHD_4MSvl5}3{NI>h(1-!l5z z&60#t#n#N<{8?$T^7KdB=(2fe`Y+#OMORKU36shjnK%{GAtg1WMfBqNZ~mofTojdE zK-2M7&HQK>YFdF(SupK+V`}{B*kp$tFlv5 z1Gr@+X{Aw>9%3$3a7+E#?-as6ZNUcB#327#3{mlROu_hN)sfA9IFBCXR+dmquVojh z!O=(1xIt~PVm=i@lWj4{U4E&VaK#cOe7*JUuWiiN#9dvx#zF|>ZwNCw-eu2OLtT?y zxcX@+2l$I@MC<7h1hL|-IWTpWlhfgUI0f)@M9AZKSwnL2qB{zIHMqvW1~Wk-mY737 z>5ve_^qoDYHq@Bl6%**r~5wo%e+X^#&zjPqbn@7D>20C~E{(VvU*uBK>eJc6GQ{`n7?ju~Ohk#y&} z5Zh4Pxs9=f?L%*ym+yJ)XX7==;>r}TMChaV!(d1~iE@%L-VdWP5;weyjrhgF<%Vy_ zhh`U*v1uuFY75*m-;5e>;lPMkqiHkvtPISJz}IsU)RTflNxF$;c_+GFUFoJmW;uH> zH~rrl$6r~V*!Z=3*Fv60@3u}zYx3rcigMjyNvhoj%HP%HiYKxH`~NNv=v>l11C1)}qGwW*kfCQ%DM z*#-5K$ujqMqR5lCay|L&onISx4V$FZUGQb_imqG@)(SZSlP90XzXm;z3A%$mUSqh= zuJ^8#^}dY(D2G!0LjM!zYA$GQK!r)vR@81H%vH7=Nbux~v|K%J^tSuOudc6Ef^<@6 zI4?&&t7CqIz%1eybPsrG+ZxX-83N?th*A;3OGiwXR{(5girj$#R-rhxN5M5*KH!=Q zV(G6u@Spie<{kdg-v93KlH&+2HOAhY)`P7GpPh;BlJa(&bug^SYu!b9L2;}>7u=88 zi8H#RfQ}50`75}bIV2lC?LV-X|8Xb$+AOSIK)6dy$|JWc3r!H<%V5$Qd;%sX=CST8 zkP)*{x0WR3At?JUe5?5ho>=G1E|Sq;4~ru2Wi{o$?b8YxqiNYOr_G`+Gvyc!^VpC^4^6n_8autZ}T z7U^UR7+9VC^Ytv|f!Ja(lNV;LrSVVLG<*2>a`SFO93yd%3`a|Yq|!4HYrKgc|2wg= z9G>Td1x*(4${|z^`jY1+J1fK(R>d}UDFfUJ-+b&)XrPP?(LFiHS}IQMnI&(t@BM05 zS*4|-*4?j_7j`}Erb`5i5~IoCi+7AZDnEM7shY^TmGOMVBk8EFLwW>XM z1TG3@|Ax9)MinKxUSq~D9lGQYz{&r^s%z2grZ08VsFoqEs^NH9=QCK0C0 zScm%vgVKFBvFmUbbDFA^rduX$X`&)Dd%~bR|3$*pMyX}fI-k;;$h5*h{XhpqSwoRH zP)Z8@K0zN&+f75Z2L7{f(G(L%@8&Y&{DPMIni8vxV3_4P14bu|_v zuA^G!n!_|iM5GI?TRz9cNHJZAtoClT@4nXQo;hN|#|D`h3M?1se~;Df32mIvqbWEM z!K7NTb@aTp&G*{H#l};A2;qr%9!iPxUibsh$0ScE3Mq6B#5;j8aGju@F2^BYCI(2k z1h-e|uYEr4KhK9(q{Y8e#oHmZNiYA8ozjNm*N6fW^+1r(b`!v{{wP6MRO>vZ(d(2q z_I3V2@57msnoXtBzH2~wma%oMgIJM^q5VKg-5axsXn;bo%`=)#cyO(?l&E;2nS&7T zu1fZ=)M49yV{Yw2|6yhfd7J9cgvmPC=x~z1I&mbGymttAQpo;6jHh!dk?*mK*}2VnqO;F=n>93z4T&+kA|LTRQL3;o z=~vY=cJ*e@z@Q|3uvDcn z`;z(k#|HQ13aL2k)&yYxgDSxX4$!EdUP zB!Quur?RJ2NK71sLSLDHqc5YnX)Z8hcvH-%mCcBB@sz8jNshEI9!Xr`k1fvJ4Xd&? zr<_qPT?mpCFCA^LrUYc5)}yv7@QFKCDJ3v7u4?jny3;^1q~y5e>UlJsj?7N*&_pho z``QpDEONC%_IEPfy&b1zqgC%ai%Zdo`+Jb7>r^j|M3d%4Hw$a?i56A+{`4>mK>+iC2%Wg}<>4xb= zui{HHyai4nssml`U^c0226lxtw;mVN+??I-{}9U1XILhkY1#x<+^4uuXSp=jn3Xg^ z3KFq~B~0P*;<)KiI7$>fF-Q02DMiZXcnef6)^le13bHmVjAS{f2DZcYznh7fWCV&y z^-zM-u;xa2>RRNKU(mQ9M-NnvJFb{(4_ShoT{Gr)Hpwku!4rbxkZ-wvel5Aufcpq( zf(7tT;M|cvIPDYgahsn(Mh)BDuQ5rB8J6SzPIH9I=F@BT%fr8P#RnWi{76aimw2w0 zn3G#xh*>xpL~ z&<=BBHLoH{tLpmnj5zYrC-&t&IoyGVn{~FW&c%ZUzg@sMTLgYN@@-k3AN}VJPOspJ zTyUl}Cmsb>njd&xQ*>N50W3luf7aBXM2`gB0e1t>TYohjmE|~65UUlJ6QbW=d}%q! z1BZBTaA==?zwE}bY6Vr(xBz=iqh~J;T9ZH5gxNY>ou#%kolFY@zOg9_6|Y}dd+*fR zdv25XF&U+H28<5Ty}&oL*5lY1U4hWF<2x`&Zh(&eo6=mHl>QcCdIl#ug&z5lYFBto z#SgitcxAORarI7GSQ^9Pp9ts~anbtRJ%v~W!%Vx=x8N67o)6m(X8vLUGOw3^n3BWy zzl>QOGF=OJH$AQ^&qYD6>Nlx@;I^g?@;C!7-1b)l)Q`uy*G|G2a5M%|8ATE=7|TDT zabL%r-_*PK>KFk*1zMkq)8~NESXOx}O)ve3zOwu;cyb9lGO24^3fzH1vec_8ixK)y z0Yd+(Pa@!uBYy`vW97Rps`PV+!PYuc8*aI6s;M3(TsuIZoLfvS7$=&m36e~I`Kh3i zmBm*fS(OCrte7*%;6o`uiNVLbp?Y|e>ctg*IN=%>Ux?LD%-{$}^qN!%S`u)k=(8l| z%Ab9hC0Q+iGna-*rjYu<5K|>B|5E}_ZKZ;Vc)k*EMH$mIOl{(t1eF2MzhA{6xATMQ z`QX>j`dDQ8bXtdBC)@w^h?&0jf8#YKnb0?~k3R6OD|>yL9X9#aKrv^~iN%X7&iw7n@>| zcAYNhWe$@X{hINrok~?5y6cdUG51>e;`w1Kd(IdR4d?O&Wr5tA{X9iIG6N`qc_+-ZD?@{3LdoEu<#oNBD_qc3eRVEr;eI0lyJfqWoV`0cLpEn}!gW zLV<#75psb0dd1OSYLY$K2mq@`af$J$cy_66Nv)e`+Unuef`AaBR)|yqr+c(cK+FRA zu3iyLv^%Dz-gvY)F2Go&B81Q!tC1@l2Owq4@ufhzGNh4$ScDWKiO+GhE8L0|RmUbR zYJPeFO}AFZsyCTItOx@Hvs#qb!tCUj5hDPbz(jUgNXr?~%@xXlGX`8$BYUTP(+a7S zCX(MnD6rLQOmP=5iKmb!6{Oc+af~ZQgLJk<^Red4kXm#=Rty<0%H8EbEjNm^KmF(h zcyB{!lM|7Sf5MXTk1ND&YX|)#BJ6dMO@yB7Y z@xQg-+8hF%#hgy08j^g{6X?e)b#je0Upomd=zFPZ9Shtn!tvPT0tSdY5khX6`?%E+9US$qjIWc6J`rvVelb|32 z@LeRvMy$KYK{cwmsw|w7B}VI^<(znj{1-z}rK=PJ+^1zD)jOt9ku`Kt)*1MiLX$ww z{6tjqg|Pz=Nq~R)>vHkbojUTEEie-hO%f@=Z6UN>$-Ir7*R(+zA4CB=455H8g(Y=H zrvNvJ<^>aI{N}7a`~4>{0zUlmo7r)v=lrR8#Y~8h}q>2o%Bm(cnO?^ffxI zw)XDd8|iTZPAp#y0}UB5EQDi+LdrG1gQWJ+Q1BI@4O_()BL*AU!o2f&GLXBfQK0 zAUUxaEyZkO99fkT184&YMKf8^7C(A;6U)j8sx&B8yx8`(qA+myjlz{}SnyaEI#4l{}VDek2WEtBRA*3#n&C zzju*Om!%@@IbC;5tdO#)+(&4*Mh_4RIx&E>#Rj_~4jGf(IE%_Z$ZhnwR5n1x<#>PN zWQ_4vDahHZ#%`;KYk?8s4QhyK+!FX$_HG1UcC-o@d9OqPPPhWUAPg21zcE!tHM#W> zN93i*Xx&Q5W`yL@u)L8O0lbxv!qoOS>kiF>>4KkCu;BgC@enClh~i-Ny#-fQh>)q3 zE_trKxxdh4<02f>*y3ehV6tT|qv#?*F)rwe3d)37X3KLg4ARjf&ZR3dQt>i^I61L{ z=P&7b@>??XZ9oD$&Dlaas><@XdBAGEdJ@6yyX9$~uX36RJL?yOytK}&(}`-4LGc$- z&3hwI6jAGyDh(E3^rI$~m_nAbh|BFA$0n5DrLI*Ek|k6*i8X1;w?C$L?BS$rrF5Fn z3TE{w!uBZ^KZZ9g{@kcpR{dQ?ESGUkThtwF^N1X8vR*A>RuK5k>Tp`6miPCz3RhZJ zj7;))qj|OOr$`7PAE;IGDKk;ZDONsl0h$xT+{T+`iWuI%+GEaQ7clJ_qo&V%H%)l2 z3tD>W(Xsr^+XsV#`X4S&sOllL(xDL>u~14g`Phi532sS&HAO2<;W?g3DGvRUEw5T^ zz0eakrglqs2$Qt7ftri{G3|*{2ZKt919eYF6PE+B_w29wd+U`$PvEoN3 zHApIoTv_qJJ*=GynmwK1AYka(c9!<@j6@&Tl(o>EgIw74fkX#HwyMjHTLb+eH?dJe zERwFyyl6@+m|MAEYXdLE;X({oL`6&;JTyHB?M9Jmt=I(?3nDIxy2(;|_e$wc0^M?3 z%|c;GNC#XgXWi?Lz5=iSIv7=6HvdFH$3-FgtC=O!?86+$!%%rhhu27-B0<+sH8fYA zAf*}M6c$@Hv}1Ait%B`idp5dm!Ke`^(zzu1FmHwYkl$GsSegHy1psD<@Yjc2-UcgJ z!leN3*kjMdVPC+mk%w8YzFTlA>+F+&ZZlEA_maB%I3wH=7x8Yl;~I@3>?!!P{o$e` zdWet)RvP#Tu8+-S+xP*6bqBzRpnEs4pbt!X`9l2Xny=MPK|Pudh6IeAIa$V{e!}t1 zraPci+3+PVvBKObxK28D?QbZ$ZtyLhWJT_U#C`+sg>gl5OYzeNNzRXZwZ=gTEdp9H z!ncv(A`&|9&EQECI3e@T1>B%>*N()j5=)pMx**m7!%BJu^uD77eQF0E)|~qH62BJh z`$Gqmp%>rTG6FJu7yAAx_^_w_Bzx3b8*%BgOxI4+#p@FQ_$R!9iRl>PZk6Hec|zl# zj)n+?;p@W9^F1?1lwR6 z5+#N^HgbsZq>8s9jBn?2fi2FdP&T7?Zm7#dF`FhhlcgkFYm)BEJfy#QgB!V)%q(!u z*qibz^+_>1|jxJizO*5;}y*Ik`V;>uRo(K9OT}baSHTX z&av~VO+=|lWnX_`Zz|^2DDSZGgSfJst~{kYs|IDAx14bIEg$jPCXSnsk|8;)xER^XA=X{u%^69}vINUyej)5H&F@ z1%8?n!6uD<`HTApnmbZ(CXs18R-WhubmE9%QPaqM58(j`g6FatTDu5NETMv79*^By8-#5t zpCJ@qsbkIRve&b{N~NZ78Ey3s@QWD%rT_ih$twqi{ZHzDEcGOFJyej?2W${E)=z}g z??Xte`$WqO^8|&5>|>Y*6X0}eQhoFQha(_^kvAV-++Y$t=@3WJII1UNaMGk>iWtSf zc?!X8K6*-nVs+^BYtqc5PYCUe5jYtWps%0D4*Z(UO_`MTN#2r)@MAVxyO(2Nm)0Gd zPt>-1IiHwN>A(BUscoNPC#x4`edZ1YMCj3<%}FgJ$}xQOpl^FQ&Npm(%6saF#HCFL z&l=iszol39i5-^T!q)&&n07~L8&jz8&>4U{Zzq}_Y~2ry{jdK+gzWFD%%8*d@{g|) zBZ>?GGm+-Ny+uBwrb$CfYJy&ig5Uzp2za^v+Y4PNW=6LzGl4B5#Y=~LL}^VLw0-5B zaqSfnE5zI_+wWh-)1FS4FI;tr0?^p1w8LHCGpjZ2KV3fGs}NPFv&B%9Q9_F5^fe)b zGU;a2;y*RLxZKC9o=%YzfU_kmK|HtJzZxFG^$`koG=|9zL?P0v4{H5eNPB4W^MNs(d}8$U2Zs&BhoVcl+*!4I?@%b`P?)6=K(oq=)k zwklld>TJs*)bJlivI_e2D!6R>>q_)(1F>>%i88FG7PcIGTMUQ+NP62g@DML|?v;AIYa162;$Y7!-8E@0 z0^%(B9cKzbgi{q2d$zTXE){`D0@ARWx>{w-n+PHSDFrxxs5qBKyGj=~N(V?Cx(W_K zJH~WLq)vgKnQP%vOp1IbjFwh~oD>ZNUG@(LP+b~*r<#$;4*Z;|W9yV7au#>w{voI)SKllG3XhP=qj=0Nkl>kvi(}Ts`Kh)WRE<< z_Z72QkcQ=%BD9)3+L3ln=`0R*ywX$E(Q*Pc*fK+`TE{Ger}jY5NGiLbFhVmCxMe`t zT0a})pQcYFl0`Cd3SsyrWF!_~S$=C5m{ZGqr96W0%4}V0lavDlp9{K0UC{aKm04y$ zzC-(fr#D2u{;2TxfJgQo_2plwsR9ET&s|!5543~swd=c17?7#uzg}(&M8LTM7^*%6 z;(=ElUG!3z44RGqEwbK!dcO}6rA90c*zC9pIG@3$aYnD~h31ZOhT-d;{Zx6O=LzLq z6n zxD0v7UZ6^?*SP+tIDMyHoNucBOu!m3HUE904ER1U#SAe#Nb;oo+(0jL-Rl)>^B579 zA+J8v0UfC|w4G+v##+U91zdr(DJfVg0@d<}$y^||o(qq9bpr}+$u+ihgWCU$A)uWJ z8~@d~wp1>datUgR*^m7W;(DGjthGcG{2mj=aX7^+=(D-eV&9%zmTxUu-n{1UIS?!( zAH@|1YRwP_bR`U>nK297jcU{Qswrc+pnzQTu7t3kk`sA9!qx!W9K!Mci1;siZml)v z7IBqHDR}ygz#Kjp4X2ev-_bET&B4CSr=J{CYQY_i&Sq1M+5h=$c>E$aGt9l-56O%d z8bifmddlcMv-mV5wYle1Rb6wz~CEG&#iIbq?;HQ%g|(?7apk zlx^)VvKQc$VM~zn&ce}o!_Bw&Ql0Ch1xMCX$N!esM=OAx^fN(W^ai;LgJv@5B9~H9 zkLXj*RVNI4Y%bCwG;Nn_d*-_T*!B`pGriL#G;zEG&&){G$=^qm-@==hiJ!?xCIZo) zqFnHQ^$!iq)uy3sQO-#JYtD!}rPaA+eO1%-nnwe=L-64qnhCnUSk&I1oQ z{m(gOE0Dp%&Kcy9)vv-}mwacVT4SQDK%*oA&8%!Q}s!Of?rW;aTlt8#t|9jh+T?RqA>`1zXzfPJq<_Lj9CAM!ZGKxALnZkGa!!+b7qPT zd_Og=&ucrZ{h8a76RB8Iem?$)^|8;>6%hs9{6qXxHbuL&L6z_~bi~DGS@X&QY1sHS z`_~m!&x$L-h%FghS6@X#T;!jooiIEREc<}Js_|VruKueyr@5e|lm^7j4X(R=T3G~AUE4=XBT48#X&==y`z_w;UX6i3 z^OEztb%yT}29w(V=HcMr_znOt5Qmu+!f!!!lO3&%)3|~7$K^q7Zesl(Zt#&Uq2w8P zxs=qyM~cR(R(Lbdcnq}_(ror%gN54%)%>@m-L@KKin6LyI!?Kup9p1WkTosAwgl8Q zqwO?x-w0-kg8yJBziEbN-;1N8E{%@-LKZbJEYGfk-SM)9}t^tMst0iq4oQW-ALg>PPy(%~Bx7(B z3^i3t(I}%@f8Kaf|4Q^vPqCcv#1X0D@xL0wFI~?!I2bx%x6WeDJGPOz7>k`)UBHE9 z5=3toV4F^qmqf_RJKUwW+M{`=)M^y1>Y_VqT5l%2#kNlC1!T`9WChxA5i5hCT@16T zM4T3dR!F`H*8jn26{GL8yh$l5%vCU89}ytu*IbFHDL{a#yI@o%BoZ}!lB?+}uM2&Y zjOH8+QWFv6GN%ji*3>h#(jkV~rV$%ny(ZYxP-(h|kiP_5W2bT2L^Fk6L2Uod-dCU? z`%;!9UkvK)>`a05j^r6JBgo4dMjL)e4s*TAg%l#zI1rJC*>uONj)+9~4>|$SwUV3MJ{-UP)<%6~KkLxUt7tf#{jiW@j9NB!oGRrvLOiYp?pRdn!^UpqREhdtJdeVE44>DOf7K*%NNZ-@YG)8Pb^tWK~hm} z7o(Dt0InwR2Rq-p?r#@g$islm_n*R%rkG2>_bS*&)AjF&0X zbc4qP$2WBuW{<5)8uI)s(N*tWdd;8fT-%Bg+F<#Ns_nO?pX<>~0`1!Ln(w!+XnBv# zJ{rYOK*O;8CAzQaz0z%x+9=yC7%VNsk(^xm`dbed)@6UD&qCYOP>i_%x6z;w=v53< zbI%GJSLi>R|Jr&STN)!9aMN~9pj5C^B)-Oq>-%-BV65=Xk>PFDDN9ll$Z}URwA`x> zlYbNBylE*A%}J$zD32v)SHhSiOSR1y{G9+qC)l3`{zpR)x^q_26_QtrI8IV3ybO!$ z^T7@k+IEMUpGhezH$k@DoL;x@)x0QTI5|h;w7nWRuCe`x#PdWEk1T2Xs@L0cts@>C z?j*W#uA)cZHw|LSEYc_UED~F68B%I0;JsuilL$lGIiQ1RXN_Oy%t z-Z495j+zI40!LiB!n<*svL=;d<(9*#y;+kLf`&x;-SL+KZq>jTk$Y${*B0p)#Jf*o zz9c9~(avF%|+8L=67$^2DZELnPK7A(-t72>`oxPvr1lVL>`A(8w4Q3S7Fe%)xSQ zMBhdGl2{{40tONkJv3$hD023X^F}C(09>+R!k@(+mwXB$=a%ot<6HHh8JM3&bdGvc z==HIh8361#=0jlX1o=vx0+U%T#SoQQjZ{3VhRUQ;I*;NLB|f{t4f^=eBx|nk1m%?< z8kLo-C9R1=I3c^VsWl|V5pzb{>0ydXRYv8Ab>XZHJ7Ys8uLq2^k%D6bM4}zQ#lT_( zFl4jc`R!^FgI5PNbv~80S*)2uBt3cJtiZV?(%x+S4Hl{KsZ5-;dX(#1=-vU`Wixlu zo>`_Fbn36Z-viB>Q#3kbE3~qD{EDw1NyQeC1M`P>*yMW8W)9&K9&5(@IQZQ-cG~9L zgdoMOw{TIQtmFJ&9MvnK&ldg93e$?#cc8SSw)FTX;KCzbC ze&9+|mD2e#ou2~XzMO)m08X!IsnFufoqB}>cZkg7(fimp&xAVkV3qmJNZAOK1=VFp z{4=4H&Rie(4=sh_5EVF5h^(#vNK0}`j0Z6lEo^8NfM%9hLK{}x=*J!cB4|d((~?2N zMPyOz7kSEZKNcfF*pRB!*BM~=3XrIfOe*p~ewndjy(R^lE>&rwfLK@a{Z}Om!`wuT zhzG-XK?~@I<@Y(RSVV>Lm}3uHSo~>?l#okz9-JqXa3BGt0$kW0l&CfQ)7R|SN~8kH zM!oO4hKq4?Ixs33Hm;NL-v>-BJ%^|i!y|#oSLvcrn+1~FcAT~xUcc3U5lOrC*kC`c{#AN%xrmRA)z_fXKT8t?*-KjdLQ34Zc&oo{w3e=w7+QAjlcm7xf*%K^ zjh`L1KFoC+K6lTN?>mg;bI@~^Vf9xL_Qh4eh2=d6Cxg|E!PxUa5R5UOT4fZsgq?bL z{%;{qIMghoSWh=k8|LBZz91u)`XNklodfH~WdX0dAnxnOFxbw}m>-j6bK4DAHD-P4 zlLAA@8KY-XSck<%nThLBta%PQ0V$9WC!vO8^V9~N$!c2ovzXS%@*-dKGKv&|-|Uz8 zEupRv@FEI`$%a~*#++5)YY`UgFz?kI(%MjwY|8+U^6=U*Cx7xDYE!d4PoO1iBFGLa zc)oZ_jB-w51ftD1>ypFJTD=bR%F-$XzlA&2EPtoY5^c@VPqjhg7BQTTRHpBO$p<_` z#7B!Wg_cs*e7aLC&*$XUyAvI=^$XF))@Wq9Va@D`sAbLr{zqp}dT1QX;x5K$C z_bE9^6<(EthG$w;yQT>|M&dn)@vFVir7lzF7!5PCyEo1q!w+`s>N-dHql)KY{Lgez ziTFL-e06qZ4$zRiMMAU)l<`Lormot^#ktbj4xq+3sSC3G38IVUYakf93yV`7_to{|J z4C1gL57h7eCR`sqlP3-Mg857Z_nThfyDw|rMFL0f*`4G&Xqlw|cI86tDq<<)`^^S= z?)w>!dCvf?Y2RJBH{zd%s&!v>#4$4`BlyG2MzLhLq8-|@T{a2D^prx3Oq^XFvEBmv zGT?n(7>}0;qzN7>rJ^X>p*V+U-r^~avT0Wf4&~QcuQRHLQ*brak*pG3+(9h6NBhw~ z29DWZV=S50=H$L814Bwb>MFqA6xaLjYgNs;fujo~EtGmf^fop+v!NSwC=E~##6T(Z zah-%lrv5GJC&}f=>z1b!|BpHd12CfsqC?YsGeER{(bmP(?MJp~hPdWE^3M#MFm*ZD ze3Xy4v>zPivJH!p(7HsUv-o{!`;Z|t|JBz&gZ^X)^Acxel^J<@iPL4)B|^s=vSAvt z)^9MQYt{B$MX>sRYEb{&S(s;X#xk=(xw*Oj;2wDyN~U89yZtHrZwLHRgCczraU+M& z3rv5p*}ET2d6x#MS6v8emFJYaS!bl0Yf^#JN>KKo!0w|-#`-jj{V}&br>5Rymv7J8&>(Z$R~k>RmJZ=Rd*kjL~B9cie*|Ar%)|x8|@z)RW-Exir6b2 zK%NYc*s`Dix7R-%y?Ed^ZGb=D0ayyG_%my}#U7p8sd`HI>cx=sP}fycz|VyE1WUo= zyVJ;7cX-2KHpYr?fyYk77hh#ch50%7n&~f>t0HD`SzgoVY>9qJ$qv5Ny)sqvwGc_m zE~_@C2XjWx1=|e-* zGop_1^ge9rkLT~QG=EaJ;g^{?#_w=LLK{jF7BqI!+x-w4>H;!H%j#Z~TV}8)4jrYp z48N>_c(jLEa7p!V^)?$I-EtvX?5e~s{q+Y5hB!T!Z^hN6`otsz&l6L6F3oY49ZG65 zxG+qQBF7d!%|Gx_ov79fC<%s9aqB5Xz@PcP=OT_e z*z;~;Bt!gd%AhZ?QD(R2yAk^-L#4ufmVTMo?n4X6w@anmTBegjl=d_6b+C`-+vsPL zt0r{pC{)%c-KJQVI-O5+=zfusT6sXQEAz(}(h*1YYWbec+Hk^WpD>-wF z`?C(s2+=vA zm>W?K7n~d}(12?1TCUYGGQlX@q^|K9`TGUmP{5*A#?`-1N~69k<99m5*O(Nqu29@2 z8<Fy~NBX!z3W#cyJ&v^wL*%)fxKSkx9`@ zQo&ABB>ibVk$|pO1Y10Bxie#65H11)6!G*#(5O3JK-RVK)s3Ez=@cuptRW!2p+Z4D zET)aaEytNsiq%v7sw8Lz@}w#d(f;=i4j`5=ekI?w1Ab>Ul$a=INszb0AC(y-k9V5s z*cx7vLJqYY-N-ZH&PmMFjl(l6Y&9j!}Zt0O?XnVRSP z2u|x%nHRy{oLgl+F;e%ha0{N~(V`n6q#wAPUCRO4g6B&9){9JMI2E$HHkkO5WtC!B z9iYl(!=Lrg@7nwlGdtK-TD<|?Wlc4&;a;1~t!)D!f`$2m{B0>MwaYy1bm~ZDc*<;t z6HW40-x%L`6UO*JlgfUdHw764gVd$AR>}K&s_dKsLxBMGX0(MP1qP_%8%IW340j%!IE!}!SB;9r}M^%z*0e>R53fX)TT6N7g)s}jN zS*(}k0_ZhSm?qUh*xrG0maJ_OX0+jyLK}`XDjp>&wKSH02;tZ-q9YJXg3N;Y8hw5B zoGv5Gg?NVfK!Ehv?Jk(M4fSnH4{5&<(Hp}C!QqpM#)w!NC+vo`a7E3DgV{x) z7=o;*y*%O1#4v+(r6arJxjZ(a`5H8*-l>+<4ut0q_Ym63X6S36hva*9MU6y2(pjqF zqP+IA)INL#4P|4I4-REgW}SoD&l<(ePZ=V#YP$S_wXe<9tUAOS#sO#M@Xj@1kp+%cEJ86E9J(hhmJDrutU3c#t@J_^8rt zFiggoTrOV5@37J_*Dbw|kfYdmyz-X~Dw?wfG~xvT5-}xY%a};|@baMm=;*k5us!Gx zB&UCp?Dcc@3*>rCWVohs6XZ3=cigqpig==&l6pXiKAe{-dgrV4G8n>RRyaQ|`ZVGA6tARMd@@qV$CnW6PQiVF?XlYXc_2vfpWv%jW*4srX{?9c74;UZ3#F+3Grh(p;ssat#u*B z(EGRNZE$YI-kaYjrc2E;o!&oB+k>8`+T(cZ3B9B8$(GBHiTo&W+yec;TV_CL6P2HT zoZ5U$dG?Ef4C_?w-hA9JLIwps3`Q9{k9J?IhG0E*eCj>Bnh=1Sts5YR39vNYqXH){ zP&H?y&xZkKXPg~-h#dzP>_kwZ*3?rg`5z1VN@`F{WIMM+<$J#)#@lMB%umm>YcIIL zhh@EUtey>t{nf-rL)EV6)Yc`7u)h=LcVK}R#+cc(A3b~)f{h;M-`|P+N5hA3(%NTY z|HVMm$miG{lymb0eSPXh`G@NHK7L6AL%8{y`SqTd_0n>_|BiK!`kD7oBSjyIs>)UA zWQFd$LG%=u>RESFSkL|ZA@c5NTe5+Eu@h&f`Cc*>cvn`-`FmKG2kz8f>ue&=*y4BX z_XEKD!}D#zdMD3EH@mSjS-1JtguWVzi2tsiI64b04mMNl7;ojUde~}6^lHsfmTCOr z_htd1_GwEVhNRrFcmD4NE>Wz?AlTCXYoRm9m8m5Wjf>2TNmR~BJg`e>ot8`@u((H1 znLn&9{qZB=Ct)w;Ptg4xAY&M@b0*VEAGS-kd01jkt~MwV?!<0}_7&xr*hXo_HIYZC zO)swIJ?$94EVkMLd*nY@)(=EmIdPuTj4|~7JE}AWij#M`FDz{ zQKuw=B{M5h(O#aphplB4Q>vx89L?o=F3$!jS(?Dh{N4x$5ptl4ROYsWnB2R>fRGH} zaz!#3%~?u=7M5FTIIgKW2?b2cEJlyb7NjS0$g)R(^(fw(c}Oj*FVl4x)G($U%O$#; z0DxnxE~)+&X9!NCph!jSqCU+!0kL&|mUQ}va__}z`U-8ksyTge8}9NPXREnsQ})Y9^gTQq z##g%=;9T@H!)gzbHjALM_HiiuTWKt)&BMVcFfr5L8tnLN6I(0FzGWf1Mv%J@oAQIm zFWZF|akr1K^JBeWOft~s4tZi@@IFtXVN475BQh=2kVZ>N%?fE8pC&j-wa$;#O{iKK!=G&ZvD^|gzK5FXSbATJrjOn zPHl7zv5vX}tir3z^kuX?;YXP12OEK#WzFX50CsqiRIm_Mu|YIXtk1TT@&yos7K{PG zASb4I1`BCPeg#5>G;)X31o{%JY~DFWKig<|g$LV}O`2gybf7{X7EGW{0nqXY85tUJ zp2FWy)7-!G-vQBLC{rzKmZkbmMd^GJ%ARxM#qd^s7Z_RjFb1EKHs7ML;mz5$aO&y=@)D zq&vi&!Pfgw+8d|MrFf(FHq3H?;3(17~wNhc!WS|E^(h+sPUd zbm0e;{3%1h@=`4M^wRj*_TimFR=}|aww9*0vL!J?oD@B4qZdn>uKhkrP5?kEk)W40 z%HfiV4jiS4q?|rTMY3r|pR@37OXl8-8hd6l?fHg}-~#+E$;F&~sanRd-l_RDA9yiK z2Koj@_~eweDrx;c8&;OeE<(+vRQq(+7vSH@@6%wh00DO6FQuNNQZ0kc0Z@lQk#bF3 z8bm5q8z410T?SUu2UT1in06&99GC)rU>_L*{SWzh{4t@G zSs#~{UnNwD8z;CF~OutREz)i}Z-YN4pZ=l7rrN`rX6>|dh3ddg#y%E$U=VaCnGSZKsPXxra&E&*>hlozGidp~A(l77%1 zSWMj_R`_5E{nh*DOFiDg0{ugTj8p!4@~@YVUw$&y?PRt)mH#VI>y1Bx*NR|G%t)T_ zZpLlCz&xrqw(8-x!w+*0dswq^LKFR001XtS(0NyHJ*v3B`MY@Ya!P$?D@h~lHOXuI7j-iI(cT{M5;HFTGl|u3hnc;0! zwZ3*n52`d`_eV>(BE%ny$xx$RlzZrrJ*!}OMg#^-U53$=8x2(*>^7>Ky24KfUX-Gj z4HB68k9bA|qRLDU3Jqk0UNX#4%L+{)p5*DrFXZe&$zCGk%M4TDyjv*4%vV&8vh3`_ z{j_140uaW#L~u>)_c_YHOBmhS^I!k-M|8d~sDxrhsN1o zm(?(%U>@}aT;GtK^tXE4cx(U3zgJF)0op9%msm*Q2n(Gvqhf3?bQ!?0YBK(cJn-d} zH01R{B=gY-fiwx9F40nD0Dd*j%b&VR`gn&Ye<=c3O+@dil_+WigT|{hf*;=~r0M01 zDzN?w6b*Nr`6u&+`te<)>p-*%w~Q^)MtlPN z?TfHLSIso;N8dMT!RfsH7>aRY|d9j_83;B-24K6#JG6;Z3KmEI zsYuC#mA{VB%~<&}HML%-o2GNSWc=x1hF_i1`>na)`4SiMYgHyNWYN-eZ#B2aN_Kwv z;}Y_g)=cbcz${z;*qf_$@Vt<5l8twJfI#bq22a=g^HD=#AtvijX6dfcu2~+c_7|{E z3Kgkkta-V8$d3~lyQz2QIosaqOhLpSJ!9#y`=wLVc)r+B>RdNy>ZO6-tG!g15S$)- z39Vhbp`C{9(@QXDzN9KRcgnzMX$z)LGnpL>=8^y};$%4(+MBS7G;o@+oXcaDY~)H# zdYa@h0W$0*i#l*1k)s6V{%y&VXpBIi4-*yZXz;vXgW0}h6DQ5Nj7!9jB^El)>$%RO z_?3q$)&yYR_cI*F9i7SE+*41bj1tjS>$g>rq_%e=Igh3#2ARsSY<2sp!r*WoZnOgV zpW#{>#Ho+?dWKeWEneu7m2IP=Vzwd!Big_8@I5iP=16GKarWYE1{3w+lVSpB6JjSA z(7_MI(r1>!X&W%WJl{*wYJw8y=oro@y6$on8=6ipfo7H!7DqmchO*{2(maX>Znn0j zSv=N-^TNVUSM|xFUxmHz-&{PEnf~>+53m?sU@H$8-1!g>hmJ^Vl5z%XNnRh0LWgV8 zC4qBxyff*0W$sZ&z}>d}8Xd{ZU2xl305d(GGZ07ekBkp&XEBOD zb1$Dy%f@LhqG`TWe`vE}*F$@+*=$~W7xeDgvQqM2mYQbu_|IGDbW$`W#flD$B@%8E1tJr^K?MUObIp{W*~%}Vt6hy z9UH5kn!B3vC7k7rKTsPP$S^c`)b_@k{>#bg5P#r75>>qpck(Urt0g|zk2ftgUd4fD zE0(GR*-qCC_AqlvRuZg9H+9J^N-9RDHS^F++D4w@9PPM4sap{aqCRe z{XO(3FH|kwbPd2=YBxZlofK^XhL~W{D~iKq?|^Cq{Nl(BFUPgyN7NUsvEI53oOq3>wLheeO@OzzX!q)JJKP{6 zJ8W6U=(k0@v=+ytLTgFxP`HPCOHejzO%I(LYHHCl(*xWjvx};?pQ?by0^E zu4|_!L%ZEu_L}YZUX)x>k3U$G3Um^x_=|!(lVcK7_SgunZd^QpWm(+I+Z(-2_E3m* z)}Gk=c&Id@8z#aiF-%57H_o!KWg1?o$TsA`mIQYeLDg%)5@+6cKFety(xxURY!UZP}YF01{MB~@x z$6boyM7>O#UgKh7kh021?-?1Yt=^yS1Wexm=Mbnq6i2_Im(_?Ev}#@NhvT`=KV;62 zvMXYqSf$*QM=hob2S91`m=?Kk{IfzXP+~ox>(-!)W;ZaO!5CL(L-@u@#$jirSdmC^KEnQ z8);v6%QerNlUD66Cs=X_Ka$;`3bQ0upZuwR++nQf$1Ip6Km$*k*D{Qk-(OS_ZJ|Kh zmj6)>{AC%K#;eM?c8D@RxQZ2BX@b@cT=` z7+NW2cr~mph#3YO=Mt?fd=9f#XauF?M;sAPg((Kgjjp1Yy}PxOZGM&F+*ZyiPPdoD zXHFL4Vrr=Y+S^iH`$3DX?*gS92soKP0eU5>W?c!EC2N|LZ> zJ9fuZ3zBYq(dwT zfaY^3#zIn7A+S%hqnYFftC+d}@%0m$bw$_zHyF6pK9YY&w~^7jM#Ez5Y7hCQqP!f% zqAallAONd<*bTM8qe}E)Kmt?Wb}^!Xq=8u40<`e}&?>=D)|{T75;q_%fF{j`k>Mp@ z)f`9WcNeu;1!IBK@|Zp0S?;6qMcKul@qHD%3mV-_Qr3$_EzsBCcSHvyumkOz&jVK` z7g)SVImkY;y}Bb%$S)f4eAz~!LdKYuW{fot4=w_4+j0h2&qW>^V9(1rG7Hy{7(Ex* zvB6($Uov0whG+r-R#>!$ob2>)1k0!D1y>lk73r`zWr|u7XU5W@SJv<-e+sWi;#5~1 z%_pJAe5hN68aM%s9wW7nLH;&+ExIb6uni55-ceYWP~P!-o-#$A4aYZHbVgKjjoOAY z8jbKsJjFNIFjyyBgsF3&(RHElS=pfTR%}qVhJO4(4Y!7|YIZnAaRtC1Z96jZz{^)% zuS;pz7}C=GsdmtNsAB3UpCn?6;Q3nw@A;`sr@d$jEzgkBGA~2?aTOrJGBwMS;Oq$NKQ@zErJoEyh|j-l1?U(D{}cu z9>IgY|K*0`M59GY4yw7Vq|4;@PX{mLK(*tdYW6LARhT7@75oAxi>)z(Tha2-$s~_E zTqGBK9C4S31@DMW=nd&T z1r4UQ!C4Kz(PW~N(T6>kk6pigGmZ(-H1cxs;q`Zw20^=7BCO8aryU2FKFLfa$H>Ac zhCIzHn(&0uq}=Vn?`sIHb4Qw|VZl`U5pp zIHoUs0oylxB$1W$z^o8Mv1Dwlpi)v6YE@Tjm&%c9l^wzUo@i`}Umd5ehWAyOgAyHhjZ_<<2$`B^8x{IMAfSA)GFI_qmJkV< ze<$~CTemi%%;<9)9-yj0Q{nB{;E(XtXW(F#@KMB@Q85vL;VoPLxN_%Jc|ypRvF~)7 zea`NmKQ41WoXon?(X~vh-w+EoGw|`cv6NED@L9b=QlQGzA+|S^GpTsHSvBHvfovoL zCoHj1V%*v=!)On}v=y~?uGloKFx@HYX99VtbpXF{L%zW85_PQT={~!G zDV=pdVUTNX_<)dZ$yk<$+2CCU(u-TcC>VNnFM(a8a-TZo*fo1<;zjJHm>O=TCr>b) zTM}nln_t23=3Ej(=43L&D|u>bPgp{`!K5+=3cCcA{i@lA#i!gc{N?NDIzXr;Q$d8W z@gNG`3oU%`4!DE!{;9*oo7-D4F?zEJ<}5W8`@nrQHZJ8Dsu$lMr8zB^n6!%N1UNPIPDUQa#ovzbodw(UdbIwMMD4k5X5&c91v($2*1E6sJ8S-^p zC3WEZ^yHIhE$qGFerH;hPF2LjitSjr5FXVq$1VCiP0)4!gQ6A--B~;#^?>BmDB(}8 z7^JZJUGi{t0E61Fh^`S0$%mL^3k2IDN$|f+*7BvASbl(@)Y&qZWJ<01bE+!r)+*=H zOt^FUGqvKwuOM>tl6P%hmlEE#RaW!O1)9jf}bEu7EZQrjbQI$GEwPDln)EXt% z<<%54uv@P^mb{8CX7AkJv!1F8&sv}x)n|MWJZXYS@WHXoVRF<(#4Pm|L+Nn!nU~5m36oT6*@U5XuJ(pdWqH8{FBkZOoo$ER zH(A#;WG2z|O?)3$v6W65NlAgZDpsZCL&Ho6{Tiz}{Yp_XzNXZHd3IV~l_%J;NP-(f zHTNXT>f4Qd$GmALb?Zo}k!VpxQ{J3G9k4ydzhh0m@Ss$ff9K z;#Bct&a!ghOH^lh*~T(8MaLuq(cvaJHCQfm*xZqXOE<@~euSR2ml!FV={ASteR}<| z@(BcWLI3HkT*c;BB~-=81Ayno?G9Y>96v zwN#tc_pwdPR^`?^@xdKKG-pt)J!}JD-;noT(yFAGE*JFO(GA*b=Ya2ejI~=bL;XS*n}!du`HX z8U>u4qt-l|BtCUJVkTZ`VaGRNU%nNmPI`#c#^$cho@N|CcC!BtKAr@Q~jDue=IWAQkJND1uP10T864+buy)BT!BAdptNLl$zP$%SsL9K^JAh~3VK-~9hs z0Mp$G`lhQPW3wBzkXN;7(_1ns`>GiBO*JA0(ujp_`n8H{zcJ~4ALp59-wa7JA*S7! z-h)4`sl$2uv|B(Sb8jcCS7=gvx_xTXBxVrMb1?cQjyj{BG)=xS0jSv%i+1eQ(Pu^T z!go0;4nAkDKd4)EB8A%S5oDJY#W4^=$Rdo{?>8mEYGr?~710=!F(1@4J(O&g$Lk;tNE*kt)UP@CXXm_M}X6l#RM#51;lbo1+FuW@pPHT)u zE}!}LH6#D{pojYRK+zX|d(MT2F$Xkg#?Wv=0^tRW_(EcZwY)FA zY1F|l+OJUNkukpqjqWe6k$KQREe;mle0qOKU$y&NoQ@D~2AxklhFrhUv{*h$5)K*q zi@LnIUZ?A{qEF#u3jW2(`9o3Hcon*SV*Vq@ID&-ic_5H5{m=qscUbLXBDw3fc-na| zw`OIWHsh-Hvz~jV1xa5f=sdPtJhZQ4c=h}yL>01p5!;;cxm;h;zry}noY}5$7H4%I zTDbOIg;VvPRD_q&EtP<)V7?p_{Cp28dj))v zc#Yys=%BEx+)*(LR6?=`LTQ%+$|3y_D&wK#N}?cvuM}C9UJ+^c4h~saub-n3yPX0Emj>K)AzMP4X_77nuGN9$zE7&JU{deJ2zY?@*Ig?1B%o(2 zdtKl8yHCMniH?j!{cxl2y#5A`38rU|sh0AFX7orC*!%#gMi%6Ke?GYk0A?y*b<=gy z@X-DBq5DZYQOTcWv5!}?`Y?3#aW?_4yX^u+<3#MUSLo-mBoOuHLYz>3EVIR8NA_y2;z*@!!4HqP{E@y;i=% zUb%bWFFIU$4jlrD#RMiMw|5_3oA}>Fokja6x-MjuF4JOJ z2nObT261MOemz18Tz;Y~)y!}nwu^VmpdDVDmI@;|Y9^ny*M|H7aF$J8YGvva-Cu%} zuFS;eBEc{0KREwX?JPIy+{Mg7S&}rg4`YKraoXXfL@Iu6`tCEYrLCNRFVxnxj5CtM zuTB=Q2<8$doYX#vMw1HpD|?;110;bdIHAvCcP439TdB8RZ2Nrk;3%`9Y@i>Br3i(S zu+n=cT1Hvi+@qR;G*MhpcoNLuXdy%vlNMW;j&MawR9qwHX+7*;%vOx3&9HT@~xsETq%XZfn{idqe@qfenYVv;zo8VMwseog62!VPP zh-;nKKPUrS%>H$mn!de4Xd*;$^!*%-t;7UzGj4U4fs9DyUZQO$wSia#hNX#@`Zh%X zoV0q6^HON|qHUL2TO%W*y>-)(@yKkmXM~|CXUJBe5078cjPYPQ?|0CzA5oyrvUpgkZ&#}GVI!OQ#1w=SNzGT3If{w!MG zykgbZIz}WI2*`aYhmTwiPnh?F@zhdypAs6_k}RY+3v-t(AICUS*3B@mK|u<+-Wsho z@rX&F!|x4K+Fs#82y15)<|0?uRwk(w@5P^VEJ+t4(=<^d@$k2NMJI%f6CS z*{$$|fSC{tS9o%B1HcdO*=QyV#_Fi{!zGlDEzX{UCQ*_&Obw7~z6D#P7Qwm3Zf-Mh z*CQ1{2$HFG`(qq&my6hsR5lQWu>bEh$7}70N~!5w}_muYou&1z7CIgPORonvu%4R7grwXi{bEL_|wbE1sB@lrIvDL130}fTzH2}hp9jAsru`-& zKil3WSm0+ntSw$`f!Z(pU6j_&gIi__EmkXf<(i*LlJ$~;oRaKK5HO=sRsv^qqg<3_%LTo@D_cQo2%dh^Fvcto9%g5VQiR?8+ABm8Q8PE z&g))S!)q5@SoEv<3rca;?whEns%30Z)p#e1vqC zZ9~u1_>&fkGQWn&l^Jquc9)S(T}nq;(D`@!Ua^=~<$udRm3N0~QB zhj0of5x-znBfdwGT^(}C&{;k=_wP^Rf2+CD8=}7MQWWTU7NMP6Yd;oPa^tqGS^in0 zGSPz_Si85`%<(L=!8P^*`dKGn#V8)skA>ji83aD>Ll^Cn#{Xr)?5DND z`dQCaPGj2?&tb7WDan+25DHgyY^Rh{Sy_p5CE3`HHT4ZW*IbbV<$_5Se_w*a`rjW? zB1D(oD0YkUrm$$n28iyTq6`;Uua4yAg38RN*;l+;5HyWNq;H?ccFi|IzKthe&J8`e zet&XO9#L3j-t&o_{6-~$AWNEwiHmG?k5isdgbUO8+=c0n>yrP1@8~APkSA9b)5@Vh zxjymqr6+R4OCzUOS#H_-I?`jGCG_-@^eM)uzTOW}p*lM!J(>qNNMt!zX&htZN{J8R zUOZa8WHR+2Wl!_f2u3~k$VBlgE=+2ja{f#YKyrH*K!lQ4&ONEX0DQA^ZFp<{xln&q z`Mnf|b862wCx{#ovu=Oj#~i6&JwIe3VDeNMRM}Rq)WK1~RxeP@5MEXS*#V}*Z^J#P z`F$#WtZOHcM;66TFqT$$qvD$`GdyBcyAK_ra6W$^TL8@4olzUnV~z zPe9#GYJ;6dZnmGBu*g4uHK1>Y-29i&y7mM4Lw8MSN#OVO0} z6vh}1%P6_bh&31jDcHsqv%%_f696UfVMCIP^w7>a%`u4?I?AzNs^;i6uIy`^F z2LA10F6Q19{g8fZKAv66y2ed8UV}(JuCmF0HKJ`PKvW$wvL9xPMc=9i_I#G^zB3Q zeVbZx@i1|(_UDZ1Vbe0AGy4P7HmP}vv}y}5)b_60X4IrPe{O=md$NmmfTWeHOs4JH z!qa~0<5+E%`S=_BXIfXcjbXheubBSrTl{0geP=SD(H7mi_oE?viLxhYbbcP4`Gp7q zd>7`(n!`KeKP>#co-Zh`4eo5_#=U@A{&ezBQd9%)EOb%n(IEf5h!vEfylwwh*D7)d=?3Zxnz){udhAw=M@;krEIs?RWnY{@-s$_AD4?F2ZVV^n*S^p_AUXcj% zM|?)!s(OWV(Vg6B%GB=|=CvBE@nLQ`W8D*bkAzieCecx}e+lBq6eci(p2#;v3)WYP z_iPhgSIe%IVjnJOMLv-A+y0n9ovRdT7{V5^&;3y=(zit3CH;gR6(MG~nTp{=-R(Wb z>i#OEU&P9Xnt3NA+vfZIDpMG&xQ4l znKdwBP2;C;`2f!7ve$D3d(VfTpcm!AeXL8>SvTr~eRe$0(xv|!$a~J_V0y?>N`t}t zPCMjroO-{i=;LTQa+z>yS<~*TmUiateVk^RZ7?Z*|D9S3->Y1#lWgB-A02dtHlU^e z>S{gsOP+z1psj@S`ru!Ohfm`zpSgvdCv@c^7JIQ;!}ffne2`j++qKxyWFnj0#!ZY3@@}5l*bAM7a25 z#>$akDe`jsG!xNr{I3;`-DqS4j;7&)xQzkkIjv>o znjS5W3-D(UuP~c)RgAE(%BAaBXQ*=1#igZgGe0G_X8CTharE>{xk9f1$_=p%*U2oo4=Biuc~Xq$S3M99M8wkYdNj>Akf0-M>yD3H~2 zbfE;-jpSd682R>b8QB=*xLalQ?}u6I_CexYM6P`+QNtXl6?; zemmXe4~}h2_?TfV&3+bH6{*LI0YRHv{Sh&Kf~1#Fpqf$diY+6JIv$C$DVJTLd2m8D zh=*1xM$>Wyn=hKpTkTU(ykh|OtD&!>TO2d6zDvH%>k66vGuU0`GXcLgJ(VPNayhWe^J0Fef+Yj}Uef;qjSKyuqZM@MA zwpSwsH|la!BuX&D^vP8cTm5dE%tJ9#_>qF3%_kRvIDYQs?+3t^<{E;<%O*aZXFR@| zSS~g@TSH28PV!sWwqi|R??>`GtMlL|IC6s6I8F%^0h)f;Q!&(KAJ}FI8x$FMv{QB0 z2b*;<-HwI(kg03)T=Gok1G*dekbZe7aAtq12f((+KsU7ku%!(4fYX=Qg{!F)^;42) zlsQ9@XjS)4E7~2 zO;}FVlsDW19O`w32arh~wrDia-c*?BD)0@7(>yt?um^bz+7cZ-Vx>sH)+=8Hr_bHD zh&1+9Fz0v$gAkEgI1N7;IG+PUP_%avGbXmY(l6K|f{z$Br4ZBD{+5Y??3%n2Km4_J zpXc%v7yJItk5EJEwDp9Y!#Vm3W<+}*wr#) z+hTuBZx9rR!~L*ODf%OsuR#GET&m+8EIM!K*PPc>_vC4`ROCi!<9ow99&Gb%_ozA@ zRcLs4`k~pM6IOEewXm!LkGxQneFSY;50}*kHSpxcRh~gNF-gKC=fL*pKWP@rb6$cx z7T2sy2yJPd%mYcf6UJa5CbhSh9X+}U)kfh!aW8hNRU?PDt8##3YoEV;Jld~LCUsZ5 znvE&M!9uecB{-nlrazkf9^%8+NjELzlb(n~pbc7uIf12FPLb2Vx!L={=^F{1dwPleQ}L^Q(> zG!%vL3i$2!4)7O>u7KIh?e}ujf`Hkr^g*~r1V4a_Tc%}GPH|Z$nXqz-%ib);=Y}8e zN}D5jqTvHNPL32Z1wQ~1kEEEd>DYV5Ykhvt%O-x~_&=}Fs^&gWO5ZxOmK8f-%0HhU zalpZq_i{f5yd_I9Dj=HQ%&hN3x4|m#NGkr#XKYst2F%4}hJ16rcF5-Y$|o%(Wr2~p zH?K@!a1Dsu4wRT<*Q$D(Vpy^>U#($h^5wmBgd^Kg!KMJ%kb$5)AFe4! zAU6Gfw%8p3Gu*?P@|H42H*Jiwu5*!c5cu+Bdp(-#!^^w~RzB@7-YdScMoLJKi$5&^ zu#5kM1g;yG?|VgS%+ust%cixP`_uL8Si)>D@UM9AfOE0$jYWdGtw`GeIk;B>MyP3q zb_vvs?7=dDt2qriC~?BeqOh%1jd+Z;1o--CSuj+9iZ)%^VJMT^26if0q`8^3tnV?{ zLe7J*5&N^7IXx2qG90NuF5?}YwwP)4b=Xt5x-w)>5j2^R%dgSH-A7tZKlV1EoFDTw zb%c1&uH@U5!VCxrz4zvz=OWj|n0s>a?&l3&KIcr=E-)UDmgN_)O>jd*kNI9Ab@Amv z#S&*K*#Hz}h09;Aa%J&QSALSe^yfVlQZinPu4r}T-KtkXv{#tD)iyKD5<>sWjmYF& zQ(*li#<+Fg_ikIYn3Pk~x^m%)UHdAYZ@1$G1z%9DiR+{aurC6Qgn6uEvz4qMMTvir zA{#`v)kYz47tZ|r_Pssd+aaaw&x>!!iQql#rABgh=l)Xp3Bpj<-*UWkX>SE@6S-|+ zsJ8842!8>9L^5DV%#VhtycXWe?N3x4Co;86)x}V(OrLDK$y2%?w)%!(E7z z^tdVp3H=gXglz|f+qxVAPuPkHq5uuAiGJ-;&)JJ-kS8sKB`YQKS5)kQXpp0)O<3)p zm>5X@%z>{+4v^&QY1w3(lY8-@IR)KTE}`~Ew>C217}nm_G*Y9eLOebBV{YoJeY?*l!DQ=jTulb zB9fY*8}xx_lABV$VghL4&AbPaB)FY3j_*)*leJ7mqwG7Sr=g$Xirz8F4WG#v#?g47 zRx{44R2W`H6c&rH=i*mMvb~rT90`9HDfb0pub-MHqC~pMn#kR2uU;%3!=OB2zj%<6 zq>|zbr#(ycxOesf#%9qpzq{UH9UvS)CilO6t0qvj8*SuK-M2y{h$RNd)+;quSavK2 z*KHTESjKaqNztHb^;K+z&+)?DC=}MT9%8>H^r%8lk&ow2|_9%Z&ZvSvP38gQ$kapX)U@bYT_qG>{ z+!pJ}tC}P=ZceS3^9%gerUA+$DvSINbjJh$?pT%qxl1N5#kdZj2+2n+uG8*R9-jkm4i zhU65AzdZ7`#dy?jt7n*8@vO-qT7n>*4g34jC73;E3l+JB7?L3!#J(y+8Iz0`zXR=Ft1PPq7yhbu4{@#;|Ho>e@w$sut6LO(^Lgk- zz>l-dHv?=+7FL`D12+-f3>eJJk?-)w{o4NwyVv%*|5%&WC~i5faAfjjsF}}$=DrPy zNf8*&&1PG9YS9CO(bt-wQmGEUe}2l*!HEt~yh`Xk?{=m@ZB%p+rO(saw;on@nm#}s8M1uLqQ(Y;eA%&c1cnTne@?shYCb1gBgX50GdmjaH zogIHfqK;=i9fBmmf)F0vykJOIGM{@=r-XG!pO^Gmm&oSDP-tMc$fRgmoh`k?g+a4n z*9YwWigKlgP31>1p7A2|H>&_8}dCi}&}f?y%Au?=HAeMb@cwzYL+6+CB8#vecO z;qSG-xRu7MNe$c7T8o2|$#|~^!bZE8v;(uv`UY&n{6$?pEokW)*0Yalx%^?>l=O8> z$*{1YSd#FPL+K6R>g4D)@leB;RO(o_Jw|s~~A}^|oy1)c0 zfM{O(T?N0lclrIE)$E?Td6YGlykqn5ST3!r_K(KDIaN4%bCXYy0p1k<&jiWyDk?`m z8yaFUjL3CEZ-a=s`aV+X3~Tbp5s9!pX`|BeDGOMVfBn6X=a@eVk)KT1()Rbj-6!Ij zknY})!u{xDQrR*^3rYFw+!rRd-4_=@n#9W1zgHa?bZHlm(1Tg%Ma)PsVsnF=#OSvKEjCPpCmQz7?=%1QB24XBo%}&uP{j))jjPwuLeVG z<^n3JW+Qyiz(lSl%BKLuwwRT(h!Y{nfDkd%YiAn7K4!uE#J!3sxvBmUjk@BUZMprE zx$__orXDXH(|w?TZ@QWwS|^(#(v4;^KIY5ydY>FTku*WdaWiN3`o=oCWb6a%c)`n9 z1~4L--E84ECS0~(^4dAKQGiRWux5gh6w@UV$Y{Fv^3C_tyQR=HctQ}#AccX*=32+Y-^+h|;{+iy zlm^*!q8`6XJ$E}WtcWEl8Mue27AKgwRdtcAT8Hhak}Vq>=J9U_`oa$UEpKx~$ct$% zaUd5+p=S9EU&r}Es#3gF2<2xj$8{D8+KShmUpY@`b_JJ@GHI`@|LV=iaS56@4&aj@ z+aWr&?S#vMu8SJ0w?qsgW1k5uLkyKY1_0wH4TnGlE}ThQGykhcdOvODfkhiFxY^r$kh6lrg{9+g-fr+dBPEOhv(G z{fYYnSR*)cP;BjICM6A#Q$t6y!|I`8w)W0H;KFKNBg(&T`Nmbjt5F#R-xvKbl@yzoMe-XizS7LyTZP6b@_ z2b2YcuPgp_R=5Of9_3bNm(Ci@msKBd`@nM=;+Z+K%)t>3 zFCBVf=9GPF0quhvE@XX&I&`51icTivo^pbw0)L}cv-x%1gk=PM*2ah=qiNO7&B1Qn zF#(tjl@>G~tOfOhjaeD1sx;t6N2%QRV$cz-sWbEqNV()Ct*J~*14X8xvv$;p_TZVg z>7uKYO6}0?WGv%4w-BK_VUtB9=ZUtwXOaa?KwFdf>p1P4F&S5xN^2luE}e1B{>AFP_642a+?DZhyK^S*EG0}gYlV%bUz8U{ zQ9Gr)u|>!ny*1a!MmrN^2W@~XR99It(lDnxPB|jLw;bg0S}c25$K)$>Swfr zNSjmY^{=qa5H>t9<-mI!1yMJ=aPPu{Jshi?uu08y@g4J@%{2-zI*jQa@9Zb&2g%PFg{C8k4NzH_oR!L#K&{|_b}C&`1<% z*kVH@S8fRd3>5}G!NNX=F)fyTGd*heiUVaIrv}o2^d^pGxJ3)p+q(wcTF&3y%a>07 zx@mSi7wK3gongngaKiZ_lpn4h1TaB}q93|)YyRJd;Y{{d@PiUMdYlJ=H z!MFj4T`f(7m}}~0jpz@sy_#DWG~tyy(zC_TlV7Xp&Z2oOyKErlQ60{>wOtx+d9fGJ z*yCGSDpxw`ATee5W;qwzq04vHZ9Jyz*pdbNAzUOJIbU5V<`6fic*rx7#)zD+N^iBK z7EEP&G2iBWVsCUV8-Hy;S_rI;KF+lJ=3Gz#wcF`G{MtSgj5x%_tv$=G$| z_w)8+kJXaJPp^)eUslQ`k0g^vcbPz;tAI*R9-F}rzi6F@@_yw$0M`WD%#hZl-XxB% zgCAZ8VTUGoBPC?1RAGDDxXc^&i2uL@+Wjcns^>aKdLzl}=7xw`)K0z|8}>>ETx2ED za%L6+PFZXISFm<-CCj%qDLNTG_zkE#Q*Ti>@5!GP2C)-xiB#lYn1@op{7F-(y5tkn zHjAC%5FHxYN|tWof!Nx3@aIpSJn3Dno5lV_`up;$Ia?~pU+`i0a&-+Jh-yqJc*qQzHnS;u5=BDr*w2_GAml*wO#q7 zo3jsv*WnIT6>?rWhl|8`n!)A{3YxsS=jv!(r&_f^)sD`#hVJk(FQYmjCXGFl9|!Bg z=ew6l0eQvWJ)RHKL@K{Ix6x7!$oA#r&gxP+mSkVlEaIpF8%JU3B1aEQebXu`3O> z>~Bd$+I$%@taYDY@X33gw0i5Xm2200GnHx>)2RF{PtGAIWjy~*{0crAlB^KKEh#0L zqkdZXPIMQZ-9vf3VuKbnG!c~Xh9i8_TG+fx59Z-81RaX#d~{ptVHa3e5e9Q>CRj0S z=%>f~Ztm-+6ZR?5-GatOW$d7&lP`eP1pxDO&zDdbP}&~rGs2A@|M!}G|uKg>l}x;EYxcG z-6Q4pKk{6~l~1=YLQ`%QJ5dJtV#U`jueV>iOk=PdV<9bG(T1a zuM{mZa$OsVfIMSvBhCF`_fGd2&gpMBl@k9zWqKOCZ@P)w&E!789{dO6dlWV*)C)n0|O6S>PeZJtSsSGoV+U zo|n=&w$#t!K;_2bF&eA-Wd^MrDi%hZ&+pdi>ut6D0zxw2$8r32<<{zcy{B}BUJJu7 z4Xqv})5wgab)ltjtW~%NB;~NmBrWa^YPzxf#{Bg6CL+CKxq`itLN?4}z}BdUv%B&o z@85Htp!G+;F&qiEscC9@%DMhKR-ARP{pNL|uo3Z?XsZB13OdGvvCZF0!yIbGj*iD& zg=^4^$n7x~HIlM4K6|!C)Ed=Z1h)U}VO|od;M5uQQB%f1S(V{}$phx1Z0IiSWRal? zr?*L5gvCaEEW;)12XzFcPL}UO*K}mc^#XWa2TE|P%t>c$MesCXPWZh;8T~hvz>{Ij$^5KRg_&x7KchUj$ZoCh2asHDpg`4WAZAg2 z0A%pj$BlYW^(ryv2iPWW^(wLA)f9If`NE_!{ft1%&e-CYgS_1tReQ60tSfTp$-qx0 zUS;Nx71R7Vh{vSanN6zNyF7SqD{?&?H}^odD9@st-ctYXwI^FRu(#s>2!j0GA7TSo zA;^}W68@A)BQ&fCr=%YgSu-_E@|jBSenj9KBDAopmyGMf89Ihyx>WkE9~`)UrZ>nu zx5uNQicIoEGm;E2t2Su=qjh0P%xEU*5>iM16KX!}g+#KD$Zp-`2C{iUO7Ei94k+v9@$@{D?iEEkb(u2sUjX$VZH3bPY^1BkpWMO2TB$a+7||qPvjAB(rVcE&_d~ zXZs+3^8~K5wUWA@LKL8}y>z1duy7td71O65*G<`%UWgC99WZON5V+f10ivf;O)3CN zPACv6tFJpe_cL{Yo`28;MN;x)6FSS8;#z{!BH6c1G!%;jrZHD!SL^%eJ!s-Jtr!HRlq$W)`@iAGMHJ9YsdfvsITiruYSTcyQ7Jf)*j7KG zT+X~GQp8+m&J@oPg6Wr$x5+F%zu+=Sb}dZ)&Lq)oD+?Z5##=OsfW zX3QcR@XvzxCPzr=y(2Abox-JVy@|$<7~sckMqbBy$A*Z5;t^#G_eCxxEzlarohvLI z!mUac2RDHt-A6-uTprz}UO}JdU46eBLJ}xJ%h`!i70JG75ljV{kUCs&=%4Q9|&3 zr=$54bNa?8SF_s2W|VU-IGW6NN68t7Y4?3her47MNC8EUMN-87zCK*Mep;`teEFIy z>fJN;_>og$9#IAp3!V<<>QWi8#LtMK8l6Q8k(8Cd$AL{<=OhATBxEEcHE{@HMsWgB zGGsAqG49|zT3?U8UV&!LvOOP9tIie;JagRgddeU#;r}f+Kah&s{raz_`>aw}ixjMj zOCirj5YpFN4H!RmMvE=hoXz=eqk=m)SxS9N5Tkh-c)t1*dI(f?T?>{B1DfXKQq;5s zBN+|MEsNUqh#@Aik42a_EXPEIGSzVjeKC@tQSWNHA_gsNMk4$oJVKRp1)ST@U!Y6& zqX2sQn&v?utk-l&TU?h^RJkl~hF~1`JO%^Uz!Uu|Qv&cO%8r z_G_Uafgh-`;uD^k&%aN)<|L50@P4|jabEfXf2VSF@~gX{bCVXdqMXX>48DU%bXE3b ze@=`OzO*o$Y7;_=$scqxB43J5q#{tLJO>uny}aakq*lsPJqH9SD}@YqIVX_gU!z4m_Dne#l(op zb7m4ntmd*%c*^`t;K2Jlq%#^fan%=} zKyx-UBD?F&ACGC!>G@#Y(3tVnaDx&tZ+7=m%h#?_->~hGzj1;#B&#eRJ3R(? z@?nlAW_APZ|L!1{fY&KGA8Y}b)k6CvnL})5p2iysbD1g>78I2Ypux`A2Z$dhb~YKc&@4 z()dmZu3p>NC|$Y`57{&Bv$GLUcbZqOa-plm$StU#*G;wv#&$F#xWVY>+e6dNUKnf{D{h&8k zY$)wX!q1G#tvQhNBZiyB*3=J}pA}^|VROg-XLQEL634%T6GMs|x_5%bZO0D4iSCW< zOeE zWjc5fUK3OHYeeao|3nxK>hY)mSxVe|ygin^WuZ*i=et*-B&wzajtEa?@O!uzW1und zAP~)#>LijP!n5l%mi+)PP;_9Y1;5g5X%L0sst;8joh|OsgW~re`G^u4v~!nn|jm)#u>U1BHfM9R{)}U8+cMn+#WI(M*F)vsWepcVnO4hlE|V83b9L zQ6=W<_|111qs}*m=|NJc?~DuTu_;NE(@4Qqtnv@d-%L=%_hUv0xJvby=>jE@vZ|Z) zM)Pk=oIH-F%~WsFZPb->|BLGw0+@_)l}uYpk{H-LAy8)1vu?Hnqx(~;d>6rrotw9j6}M|oz5*Y0SHa8 zb@K~FR3oT|S}Mv)Ce42s<=B@vUSh|;RLTvjMWLoJid3d6$qD;uuEz*ZfnxAfO?x&< zDo2`aM`<&j5vWjnV)34?P#x6K(id=8{z%dS~m>cKT&aGJ8 zXhrM=f&#MF>PUYTJl^*chL z1UNO;F%|NR1C>B(!c}ucYhx;I=vj03XAIRc#v;vud{3c3ve4O*p7!G~I%$n>IBZ@F zdfZg-87g|lIH&;e>~xScmMwxg7JpGXs7yWnsDl$eAbTeSn^bo%hFDfEYSbNj2O-r~ zPjG(Pm3TCw5M}V!!8X25H_g279uYCKV%}`JseF=cAl^~h)Dv7?krBLi`9ytR+iP*w zp&-(LF=}Ebl0M;Xf#^kuCkZ2BXVIx6-MNEnR%8BEg`~K}v531LM8Kq3qoU#c>QR~f z77S%CPzh~$$sMPMX!0U>SQ{PxlD9~1WY*Igulh03!x3dW_(l!7@cm3dd#<$uBMHU^ zO+~oYdTP^p!)6hP4xRUG#nz=y2!<*v7<+;Jex&_(3P|Sqp2iu+Cb@e6(03i9>!I4p$mR3yli^$?JhKD-2dOUNm)(<~ z3B*C+M#sX;U-$Q`ViAckg3+-3_bYiaZrK}2KyvC2eu!0+xNy@ZNi@A?Ahum0bA=w6 z3~d-e{890@3deO6Dz%4@6Cy1=BX^)caL)^&eCO}esy{ce3jaOEwhz}c>nP}8O(k}X zN#9OTWGxWOB*|X|wH#1!)hrX3y!cpJ#Z{9hS&0l8%tuTx>&~OMz1}wq6AezCf=$J2;3r;7(hO~%?;#GU zbl_n;#FXO6W6bAkA!rlodCl~nG`#7G?sD4OWBCtySZqRT3m^|RRjwfOWKS!_9VL!m z8f@J)4;N}3gk6lRUi^D^2Ch;(wy5>lsD!LM90wTvyS~nA;dK(T13y<7Umddz+ZyWj zQ1;4&3Jnneo=tqb+jA32?EJi?jHgqjwTfCaH~}V7eq{AVwsqXHm9rV4NLUY` z|EB69lnZAohkITo@dKu)UbaY~6#<-B&Q+nF4v4!8SSqU3NU~#pCmt<1vI~fI97(<*E8@Uoz%qry{sKdj` zL=Tx(^xa}9P$8-5dK>Eq0tYgn-wNfGy7c z4jFLHGGQG&cl+=Ed6g0Jr_2dWC2a2KKWwv_EtAa6{d{9V61?>4j-!K7#Gu8;+*pmE z98U^!2eRz>W=ZHXZ0a04ttSXS3nM)KE#9w16f?%~X%qpU-bf774~b;=yeC@-jG@?w zf#m#9m3vy0Z1^sWCKw>hMclx$F%Wt#Asq_G*}}pL?)A)11hR&(=2f9Ub8yGfm%5CJ%D-=V;(n&#dWTys^d$T! zB77AJR-#u?6Y6L6oAJqkc83J?`+*Yy2-_j!WL)aj^FNeN-gW2xUMzc1x!-CGTb4qe z#8;c4FoN^yLJJ1fUG}uJu$lEP9klXf`x6fxEUL)Fh{h=ZqR}}g_H91;W-c&e$x07x zQVf;qDma?#jh1Ca@WBPxP^MWIdBZ~`(@42)Xa?pwS%sy?+`%XeK5XG@1MWuB$IG*x zF{O5+Fwr(lG1Gluym_Pc{uLuce+lV}$n(GFns*GEV5*bl+0P2ffLZ-4BNcH9za^v( zMFAvX`B0<6tz63xPTKB)L@-GU?zhg1j|ob(j5mG)ZwiG>gX5}dHVFnFt5 z?zYI^5n0%G=Bs7}Hf!boXjp6}SvBw>E?V~~uOO|QQ;g3n!C0dQwqWWlI;bjM%@52v zAfgd+)lBWbO~kZxjA38fJQJWL8Ih{W@XNL0OB}k2JC;neJL4*ijV5DS0Q5E%7dw)| zQ58iFY#Ajo>@dtP%Ux%q+4g{ey|utW&4V!C+H=pw=~WAai*NlhVfg$bzE5`}Z5KDaRS3bQCsT!@HYo4Juc5*8r4dJiYzD|tA^w~D^t zTC0ELEs+!`Iw z(`K|dp{YD5+&D0OEhGy0hE=Jj#7;ByAe`n(kW6){X421vVbD)VUPAzcbV@%kwrVGo z(SON~hn49$%twtw4`(8f$U0}bu*J;CgI<6lL?q~}oveu3L@S|`1bdx+LkW4rGadwLZt8iXbJ~C-KO{U~r_j2qOsDZqOQk z=Bqr!SD(KV^njF(s&UkFuId(fgQUN=XAqMlq;9;LV;{8`er|&xuz7H9q#IzxjFCNK z(a42Iif6?dMTSD$pTE0Q5S>#2qm`^67tH}XfK{}z#0Htok5_wO1 z1kQ|urV!5Ws$wS8pkPCrIMYVfxdxS03Tky~tFSD8; zu9{{ImI#&{rn5(!Ic$)WZHtgJwQNgejQiyVJ@`h}%0amH1>OQcIf zjooh%jUpL9Ix5<5?8CZci7YLr(t2;(cbPw0>`uP$~uN$+EY0XG(i^n!tA&Q^%p6X6RE9?x7;KH7$H@ z9iqFNX>P~bn_haq{MqTg0{an_NDi|;?4c`3QY|t=Fwj|LK8bC(-8j~zX=8-kn|L@; zDQ>b;C*71#YMGd;@=GMA@CdMo<<~BnK5+Ff)N^_Fl5($U|6C6p(7Fyrd-ra=_P<|t zQp<{(9bsLaHNfo zq9xDcfNmqfK~;+84+Xvye6LU7Yy?Li(52}IeKc?keT9(^Qak&Fn#_G>BvtaU8Z9H_ z(;{p($ATxcSsP8SU$y8Y7k)%z1QJ@se{oUH)6oP$hq%d96$CU5Pp)iQj#3Jw(pMR_JTj{%@q~iN|>A*E(P_K#Iy1+2CJ2EZuuM z@PAYtTUTPQf6G^1#q|?b+*=iwJ&kVZetm%Ie*2KJtYHbxQ}ieMJ3q~T$In0JwR&4B z&^^Xr>Z?(rVdo*}8_;n(3gcNgIQf!siDcXOz&8GV6=fiiyG*Jlm9$bnhrmdmkK#~| zGd6=fH?H>t|H15Q78{L|GU}tI^$+JcZyN=9j@SnRuz2~cCHbJBjz`5RWZjMVk_O|Y z{$6C-dvjvI65s`g=P+LWk_l2dU!o_W8E-7GscI8pZ%ejf8cfj&xtt#htJ|r5EKr^~ zm{jWI&N8WU={dLH=)4{#6UqMXfcE`!d)|xChET7wR78I0mC)9keWrEO6+KuL(OZ%O zo;eM@ok^NU#$xuT(YJ8U zZJZo3pR0m*n(F;iWQPO}<-cr$u-G^ZVOfE>x11SDFZN8IwyZc1n@RdpA!OrMO08eX z%z&ku8fjK0;C}6R`Y_|axoE=!v)>>-)8DD#pSZhTMw#SIS8`#M&Sz}ZKGqoXJ8Sgq z@W?kW917n%#qH;H&(4*Sfo3TaKK~21Jlf&>aX7b%jZfVW2DyG{|Ci*)JtvM+^Y|PD z6Ouhj*nXkWu@Q1a#qHZAuvjq>dr9b`P?5mnaRX_h!-aEEdCnm%n0L$=J~)# zi*(eRk$NuHlpB$Tzvt6@v?R_awJG?g*l_t0AF%~t;jy^!rU4gE^j_mg->B=N=7phVi)ux=Tfz%>PB-&^ms@)X;65{f zjb)J7z}ssssJmN(JfkEPIpAqsLA-mO#T2wN9F(LVs24hGw^Gz2=0@l2DmdVOvOm9s zvXXo^I?Hj^OAXl+ju8fSpmSon;Llx8@bLfJW6v;p{Xz8a2glzZu*?&IBsFsE1Bb3# zn$X1)gOJQ)8g*=ik4&s67P^$#FPKqBK6;^?nvJWdbk)rNA5vHkY_I3vas1y=`EP9B zm&|NU^D{vi}&_Bl@APBwX7nY|~U zlL8aAz4=kk*V>9oo={qw7Q8l#vs|eOI}LYC6mb=Vi+v_mxe_Iwhmy6@P%D3Nt6C! z8Pu~xrg(`wLk!~AfRXDff#A79H+>#SdQI_W?nY{j#_D!HQCd${+7s6Uo;Z#S`;Mk_ zl?2fwn?fan&M1F9!EA2VZh`%jNvwW#DELp! zrjo+vHid~s%6B{T;a3G(B1sbu1dVd8PW$USxndCB0}10ZDSaH3^9L#4ct{Z(TYHO~ z2;M+T$R#+wFO>CxTN+oA#T!ak=4HUWs;&3Lo*^{>;1bJXzt5qq7y|bc_^>x2!6{6R zSncyl#<=bIyF^+-&Ys_wQpXy3#Qd<1VGyFEU7h)k_OGiOAK#v>B~FC$Ga-Gc!spcB zUi`@VB_(cjTIU37upstfc{YRP@FAfCZ`o0VowU7Ub3w_nRV$vQIIN4AMd;(TlF+nv3Zp>{?8_ zo5RTcpl6!smKEZ zks+fe^Gi8wv{nDRmg@m?T*2{8#fVi#F${?q8}Q{D^_5!(zw7~tascPb&}78x#~Zgq zVN%I?YKf0?YYH4VuU$Nh+4^P8^H%1e-u{NFUArkb;bf5n4Pgt#$}**JM&}yT;ZXon zY3oIRl1LU?Bt~hWMEz#WzWG8uLBDI+u)Z0;=NO*hx-NQv(ZIbiZ5s=XUo84UW{%Hf zAJw?rV}rV%;p!a5*gV|o$EEGW3AMGp$lV~wt9jT*9a`FQ5PBfd)a-f$CkZPJH)j*8 zi?D_ERU{u815H_%44kyOIHrxeOF64a_V~+#-$RDOxJ+?%;5Y|5sy|R}-`>fC!F$ep zH^>{;ZO;7l6(BPQZ;58zm&{Nixuh1^WSg|^;%M@z(in9fg_E{j@<=&M)#82KU}g!; zGp?h^80$KgSZ5Ky){ct;DHHjgG*7ug$8jbc*%|9Fl$O^jO;-=E0u+JuzN|Z`4qq~Q zjo+r6Zd|HDiGq!7t^w5T@XJL5Ds@N@O*IKM6{7P*0Miyi}-Z(5lIO!HJV{^rSniyzH;w3 zti``i0ztlq?mwYQr$-W?`qwC-)Ce#mHCa-xJd3UFI2vD~_m<=Ioh-YZpp03XB13`X z2!dt{7M?U%nLs$pJ7rXFobSaEF5Z3c*gR$ID*YK=YbStCTMsIv-YY7*S}0My~I43%)!>*aTQSVXgZpxh^hBoKbr2V zGkNM;Wpk8v5Z%GmE#QcR&4yf)V59i#j8U$`e?(ECEzlBEbb1(Z}up_H?o@V)P|Q1gDog z;6uBEnGv;U_>@RAh{ywyQIyFEBq7Dlyc{E*BqG}w3a$isy1q59`}rm7_?r1HmUd2Z z&WkPxPuni^%b;};T|vVT&x&ULPwEO%lHed6Rv{IASxw6j%Sci>d%oYs<)CDCs#xLL z(HSV-4vw9*#}BFq@7B4)hLWnEr2K|4g)UErVwxDPH6)>G(m1o${Zxg02~51?9{Tfi zUFQad5e}yClx!tZg#IK6NP%auis%SN55@RfhhgO;i^Vx0u3?Lh^X2gAzS$ zt6a81q0T$2hG~Z((LoSnR^}U*W7{$E^D)i|UvH!Zi3hM`n3t?eD2aq=@1nzl3g48b?yLVQ6E#_(}T3@Gz=c zIslp1_Z{gLZXj-v15;PG4qx;u&c<0BXiGi*8+&{oG`&2!+@GngSYRS% zK|Rqg)NsJ%obGS?s{cm}$}d8iJ@4io;c%$zjcj^i5K7HqtA7x&p4zz&rb(j5)}mPT zl9p1Gd;4^*nC*QO;|4AJQJ-X_@aRjs7uIj{w7Sg3nX8vPs(jdazYaiA&z3E{99s2ZVb{_lZujC=#_zAYSU*U5r%|2P7;C zWb(O(^vvFsM%w+$Wkh4%lpH1Ecs5N6aMHxdXT;tu;e%#Gi)fAChu3 z@!0#mzGhmrl=0U3tl=>WIcsE)@}bT@g@_Qq#|eNXos zU3h#VI^A*X(9m>>%w!$27XotD9M#`50qB4KeeCVcR*2)ZB@0UXT$EW39V3FB&6l#ZwyW{jP|D9NQRzxT!fix>VpWT>-_ZwMh*Y1KC zqps(qbEW&@9_GUc5{XW=n*&TGSat-0);@^*meVrQJ_SvUV!!rb-z_cL^N$A=&oLWX zvZ-=zPQU3XB$q-y#1iXuK^M?9xd`!l*zf!rxHnuZ`wx0rm?kQ-zxlROr-KkLCt``3k-)oA#N)vj5>0m z4sTp0WqAin$pQIevD~}v-~KOfqFm6X*fm|T`}z}~NqeOv!i_Q~6^5f$Z0-x4-IE+5 z1A)tbuhpzVb;8S|4xP<4st@P=)inkmx;B9Q#tDR8+Tz)7eNgYRDn3b6c{-7*1!hPl zQ@}C@*{TI~Q}b;Q?Ot46>HL}4ut6@EbOz60Pui5QT0+-Vvl}){Q%NFV{1ApjsTutW z{^$e!1mvm!%^vp~&U13KAK+SqOYZzQ5nXo|7-}}EH(gMXoSz#=U1SN?p`>4D=3Xf*b+nv2e-YM*o?;>7 z-kMkrz$-I)U#AFecy9dg(r7IRj*5UlF%XWBhO3(up{YiazQ62@qL=fR@UX)4RPrM@ zn+GJ%qia1<$qx)&+WC@Ex4q5Bl_NDTS^jLv#QQ836|2@^!-^**)9Vk8Src7J0;j|7 zh4=G7FTa!Z$KLHr=C}oe#3rmKz}YOtl0h>mk_0igaBz=o4@Oe6 zJt-X+eMIvCZeGSZW`d3D+0*_9ez=7|#JVgLjlPUEf!c;pnCXEz&L{rVtu-6DPKBL7 zxfLo~2>Na5A7?H3JyE@BV~PuZ3Y|VKjqZqauN)1xJf@D`FkVxar?@qW6?2Q6c=tN2ku-2|S7Rgu(sSvZ; z;r`Y=c-|1nzg-KW%_!rEL&wXPSFH&k1d?2p=4S*8ic6#9b1+JNMZpzgG}@Y;Szpzt z+>!`&b&Ala=HDiM{*=T&!Q8J6fB<{z19{8i2K?TjXgMSuA3&d+{}q|+&qNo5bsf1? zgS+ogI0C}TMSD|?ktPag6FOR8qQ`MbMKkXUoEmVq=eB#_=_-n4J#6u!d3iK3LmU4k z;nAAGh??sld6#i^nG6p^EzM#`o@R>eXKjJ_zAV`hZuoCReX1@waYMEdVGMUCuDCbl z7#Y+}AdV!%8G`_wYgvXtF5xPR14%q%9VPqcZ30d;2@p^wTTV2G0$Vf*#bEmb^43h3 zI*XjDq>ah2Xeu~r)pZ5{ddTp^O2drVf(@(Gt~DeJj@e7CBMxJJ(yen%XUB0!gT}%$ zkRP$I>?ZX9jv8skA;k*UkjYYlfn6J=q&|{I(xr7W^q6-}8N7z8O@bMR0(&JRboM{h z&k{VXeD;cftasw#K^6?^6H8ply4?2cJbjt`aj8pSON?KKF8c_p0(Cts65AP-et`EV z^XYQ^JVW9~iQUzY-TQ`uByIZ?OX%-zu}-+mB>-w3Bn?}qy|6~h4lM0s4zexrYK~4) z-|d<^TI=I#6RiZ4ucK?R!@dKo6#FecqN0`SS^hk(UwcqZU(!5)&2`2QClniV`2sii zyYhQsWuc?1pVl-=w!a(nal@vx_aJued~oMT{$pyABP(7eYDLE`z(y#BhZ=xVMlZw^U)j|jeOCbb_d;g6LmJX(lgi1n#; zHrD3r?|S){ZY4^#cJ48zIQRZwMCR;npnXJo`_U(8tWO%DrcggnJmnZ(`zBQ1&QlEmKp4&Lp7dMBX>W@<-RWoHC06@l( ziw!x%YzNmAek$nk?lVBe6Tt^!NnLNBDr>T+h~6R|#Kb9O>RN>n*AfNAqr^H`WMi&E zEwJ~|Ml(cNI}mP~D33);(lrzo|4pThKBlIk|HAmU^>eTaOVodI<^g^4>u6Ipm(*>M zU6CeyQOO*r_lsjjFt=2G2cM7oIIw0iOxM2;g%S^1p*lvqr2R_y0Ij%rhG7yWC`Qs0 zT;O)+O1#7tetAEb#9kh7gkk8=bb4^}AVhfj978kd&y)n&nm6AP)IqOGZ3&lR+-?Vs<=??6!pC zzlsC$@h8=%!m+;XPO`UGNDcE|v#;!_Y?0ZdMMq0HvRe6RB;t)__>)uCHpBJY%R~f_ zGJZGzu6!tq`}%1J)_MF;zPR%=EbwZj9H;HG zl!yEeXIH0a{Vjj-h4mkElsBj|`|S(!ZnJ+1mOIF;h9$=Q{QCai)5xER#_lMe&QA|z zt^Y&QS#Y)0b!!waUfeCX6STNn(4xg%i%YQr#a)91cP*~P-QA@?ad&&s_6v86`x7#9 zlD*G*)-&hoqt~icCQISY%|BvY6I|HyGYe7S|9*Bq|AdMZ=cATf4E5CbXo(%i_cmPe zVPk^kr7+w|5SOut3F29=2W~Zay=xD8;$?JF9jpMP7_UO*Il$Deo z;(^&rKbF0I%D=UQ365IaeI`R`oi{s87g=)$6pc7sgEEuza!NyQ@Ck&u#GJe7h&7<$ zI_8d}g2hoM?@IJ40D>Ly-Uga0N9=%Nr&oh9j*kD^sj*Y%YyldC@AGW>V&Sdg%K3o| zo>1+ip!JLZ6b+UUu-vaX_HRoXSRK3Xd?3QHdu@X-PW)fs?t6;2VX$aHe6-05Z`Ag> zX#BP~+i}*&eurM!YOYVv{8p=5HX zfgofkFGoTuX&P#2`%!@0tn*O(&_;Le+L|I5`&3H(vDp@O6w@?B(F~L!QToZ2I5;yh zh93(nNs2$vVr+^Q9{JE*P7vw0jP{lTU)N+=DGg>2?YLAvZ%T)dukW#%dju<+49x}lYTc2IHz8>C?y^eo2q;DVll)#tr8B203l>SRE*$1r-3Y{!+O zH2r~~GnqOMw!}JIJOQ#ld%LWS{8vFg+E?ZPu9H=b%USO=i3NK~fG?i+f z_ftQ$8G;Uae2|uWRW2ky+J^raM`!d!4Xn^p({@j0;F0`^!(>#MxITAa2tdLY)~yZ- z=T^~5f!Rx0mNLy_M`7ZsZf%6>f6wxG3m>0tUVD>j5P-amOPjl{k<2AH6Myr?GZ0IV zJ`$y4ICvp&wU5}w;)cQEm~!=rW_~~V@6d1>&hDI`w8;Yjmffoo7QUZW;bF^#q(|<< zXqmF0oUEZ00P`MLBh!bbf#8~N4ZwVH=Z!+(k)Gf;+)>o@aK_@Niv`A|X3xfgeu9Q; z_6uf@m$|I(q_HPM1u}e5jZf%Nj>4Sx90Yi{q>@)OC%$~TkJ*V2xSwfkKG9U6Tb!%C_LY#~#fiB~NjaJPU4f z5Zp=>5wXIpgTmpr&a-lE(a)fs_**7^Ynb(aiyHf?otds-#9|hU(QaX`b!r&EfPV9r zUib0>8A{aBgic=$9e0L?4oyZ~^H-BW)-TWN*jpkc=e6XsbQ<@;%vsOd_ENR|B@G!l zjsclXpitt4<~rH1)WQmFcPNhD22Gp4i4B87BBrKeezN>my@o$>Pe9JEkxUw2vwLK{ z0d?V(1|=3#o&wooi_~dh*MSUzBwl9r`=c`=1s7jVn-MyYyN$l0jhvRB3Mt7TxeE{; zn#S*UH15W%%vb;o>9xho6oX<`XO~dpsS7?-55S3A+FFMi#myPU)ok^8}!5%MePu88Q>ZD`v;t%Fd;Q!sdWJn^+t|u+Q+(KtchY$bvSJuUu0VDB> z`zIqt&NF8UHhAWslGLWRFSR8EjARpSw9bx-I*Sz~7+}R(b3q=>t-j;HfroNNbrHM9 z1;50vHbN2r>t>4Z`PZdGyWE!Lb4#~Bc;6gg#6N*Rk1`G zmZ}TzOjey)F;~|(tZw;LR2<=-1wKWnD5~FBngGuZcbk1nxTHQrrYDCXv}Y+4>gGI= z$e9ax`f$Z8Fz}r`_VrqjHK6nXSP{~m4NNEyT6dEJQ+K%3=>C)eA`R)ky3s58pV05; zJ3I_1utw2Z?0qw4(;%!sL{5=( zE6+XgNHy75#jpn=EXqsEOj=%TWmWA@tz}k+fTBZHa757pmr%u&Q@M?FbMZ{8A#qaT z+1g5a|&I3;-e zhzpX4j--{#B>iNOP&;lYq=hur@kA0xw}C+X)j|FsOurnYnq9=F!8eo^vbyb;0caD@ zi;`(*HlxgSEEF(w-Ele^b{Z(B)m4G1%|NG8p^Fy_Yzat02WTu}q-7>G^!}|wN2EfB zX+Rx@4O>^vK&TQd8<*Lv~1A>hE6A#ZEKvb)p?6_Ps@8S_&T|8sKZ&(z&MXMbo$2@t|55@4UAfS+UGGON9nHBu-nzhL^@3P9eB7g+ zo1xbtC71-Cggrnv439*BcNUpjLpgCub?={|mhJ6NA(8xeQ=DBGb^nfoJB@#TWhv+@ z#7m*8ySn(7{#q(y>nQ-cLo3d*;_Q(sawHf`bF5BskIuIMYl$}==09~!8+!xseaclc z;nJeQ%fw6Di;W}XVS9UA!~VbxJkCIIkd-HiN|pM@Y_VfCa%RJ_6oFmK_f^*@QP(Jg z%gtK3?Z@zqI#nA0eAX|n;}@aZ?QVew?EA1?rBi~hG9H;dc@q*j3D)Oq>af4B_=u}X zHOdoWA}4yCHj*Yg1vkk{)XCNyf=zCvDA_j+2g#1U1;V$tc~hv2>4p{wK6ZaG)-L8( z!T)KmMNdZfY~GEn6J$@TP!zA?d_YZ~SS5DwK=LIW0Wgf_6wwL{V zB25tv{U-Fdo}$j~1GkBP@wiW_Z=rfc+9LR%epX#DNq_C5o}%JSyRxk4DEq9o;msbyq2|CLmbzK8DZvGVh|@%jlsH zuyd5h9jY{176PzeoWk`d*?Q@^e3@dd7ZQTUDKs>FC`Ba}EpRx1%5poQFWt_Vi@w>v zoH&cP_H!gAy=7F$Ebg-^z++`WqA%JZo3h2D>R>MV+`at1G^N!4WFB&e6RvSLv*TL^ zMiDb5PoeDkQL2R5v6g&+?+)gvZN6|!JpAyZB*yh@9=(Dz6sU)M{&KPuf-}F#?FJ>q zQ%!F1Ar=9NI>sm{w6JM;^r~}!dXZn;lSIZiFG=3NuM-OZfK0gA(Tbuv5K^w+5GS2R z5*e^QK7n%-ph4qwR6own9a5uK1cwtm^L1j*6*Mv^X)~ZVDO!X1L zkL2Butx}(8k_}t!D=||`pTD>x=Czwe7NglA;P#_6?E!gO$g%|4Nm>1f#Qk7Q122#z zUQcX2*mpBmu#+5xXzK#kKxR1S2pW&nkg!bEaA0aE(xpGvhEBs6EDT72EhO+8> z|NZ1R|8HIy&%s~QYZ=SmYjhfwpE;$hV8tYfmrIm&`@f{ko79%aMarlIh_-1MRG%e$ z;S%4_^g(Ex)Sklh2nw1xdfz5AUS+XeP^P{tXaKxHb>mkxuVXcjW9o@f*YDAb-+jvj zZm_gyIfQEERXy$g7{^{}O@j8tdriMBgDJ19^VIMXr;DSOHN4L{7F!PX=NsUocLXlH z_aE8guB)adf3_qgcJUOcZnZn8%6Q?UDpms$!cMe+7*qu&&#EzD1}8PQlRN?C*uaH{ zE=d)Bn9X5PVG-!La)OuQTBi36zCgm40$Y7u=bi9}jr*Q^qI0F{ zyMs&qmcpSil+Bb^VC=&7gs#xkdV8L4b=y?qS9RR5pbwn~K$E)aR$YOeiM1_g3uv zh_{+Yp3}_CsotItmDH_n-W~ECbL%^`px?EoGfe2o=msnZ*`@V znfd9FFO+M;()D#cTTAuF{^@FpJa65k_`Suvz~=V!E{5;-OhI;1%ufy|7SwBv_KG=k zAoG+j4xP6DUT$5E)M;6hY{))3tq8MKT7ro~CR-H(pl#iy`bgEerO@e;Mtk$DqN35# zq&5q#@i-kN9=rN;x~Pa$A{Dg9S~$@tJ!unp?7fbDs_+sV4Hg2Hd4lK?Gis{v^e9>g zl^m?zm12Yk7SiZJG{H zHgc3%@B5^BXh^~_&akEBr7CKW1hN5vEP{!0_V6DTk~W#JWUDvnjC{&C7fW_@zaoL; zur4sNnTR#Sd-L%-3iW&Du3t4PJ|bB*zP13BTHxl+=6BF?V-6nbPAtM|4m4GVd@a+R zXIq&@ZXJ~~G|+}nO;1U7`DZiYPM*V!rodpI?k@8U|5)Kb^XmgMAlGk zn}<29deR83Xi*R^(0-P*pfXHT$dwY~Ol%7&GGJ5AMikVnuju&Wb6Vy2m1+NrD-bqS zONqbTbQ-P*dh#;Af5YCqta zdLVuW;S&=Ht%~+^{&<6}!QmkL4LRSQS}SeE;m~kUjI749gL9xI!=_?oxHl{qr-dDr z?neR7dZbzAMh^%Y46T+B@@IAQz%N35O*HyTE(BDx_EE$<_p{}PBUbde!W1tHhwhT8 z;$#VrJ0wI&N8o_2MuxKy%*BC=IR)Te|VVf*9983bwRanD6P^P+I?a1lLT_k#fsK<|IaX;#J8UUb3~H zhWF?3xjr5yZW@*bZWv^pEB4Ybh@(}5eX^OD;X#OkeI$40_=}G?SUO(AqcKaxX|YN{VDk3LH&Q4bJvm^Th8UnN;kv=n=;~`W#ACXgy=YY@yyOhb6zV zi>vxon$3F(*bIes4o-}%tyNYL8^CHRdhLg4=e3dTy)>QM9l!?=rRBw7uv(u! zAKK_4@k;(+dya9MN#>a7_a3~g_lBomN#Aa6PWcw{x(3~quW)}q(5yH#J9smH@#>2# zC%ir9VFWf2t5rEnA-ZBB5~S56zh_j6@jNxlB7??Haqu%PCt84R7xL%j70(*)oXIZ5 zww<7X*_OKf>v@*)ZPxJ93-37mucJ3Ha4LVQycuW(c(cs(ih|n$N@G&)g0SDZ*=|Eo5`a$P-l#{D=eUP98^I z_Rhy__)t86CwO7Px8eBUK`n1WBWu_Y!YaVDkJvzJdh8-+yhprZY~FrBYbCzzJRSWi z1s#v8zAdPF*C?oIP-)_7f!H*J*r5Wb_jP|%WzxuxI8gqZDs_1X6T#P5oXW&6F7nR- z2ZqTCqz{yTw<(`F81K<)$3(heewvBhNr~N^cKlHCZPe{Ywtfb`mc@h zDUs48B6)gl#a2mr8CvO_J}I^ghV~qdc5EbNw|p83)8Qr$dEfg8V1$*`|9ES>W65P! z!DP6aQ4s=2On0K*wqjKF@!q{?MkYyH8AJ^Sh8($Z#-cw@cE>#ozz;;+r$_5IRH_rK zFr#_*CU5+Tt16Q1%9n>7G8Qy79S3>_B$uLz2ksE^!<2W~Q}$?xfk9s&?CpCk@go?# z=XdKn2|8-LB3sB}!!ciHc;eqtNrjoYW&g>ivbk-sTGa^fg>!6#-O>n#mNU#lZ8wEv z&nEZ(mcsG-KnH>+^1VX%A!$D@SXb#;w;Rtckms-K(>f>4hiWulh>T^!b(4rC^0Pnx zxsLOM7%+@LPi%oSExsoo=;O`ivHfe~os^du@pl_Z1@1yYo!#9wSZiI7By5>4~N3iJ=G2<2iXvZcz>>kOg3YooY?%sEJO=7 zXM3X&tn-37bE0-v?%pdr4V(mI0gs^=@~}vYcKJ}bp7t5e3u*T?>BGpiO}<_r{BOtq z#=Bp~X+KTRO3<<-$%sD)X1J}bdp918^dVldXy8(`*EB@nl3r%lVJXGBghUcJUEPVY z*b);SAZV?fiu}2OL&B+{dycQe)(2$mi9!#E370Av{zTU*)1|1RQ{#Va1Jx_GhJ$z1 z!#|O+1?Zrp>v-ct1EaQ8@_=7g3PY{lCqwEbKsNJ#c#J6IYh~yo03aZl(hLISFn;OK z)X$LQNILklz`Bd07=5AFVEzNytm!wd+wj|z-eizxdzDwN;;@9ZU%2K+xDCe-bk;8F zE>~bmHw04(Z%QEY#Qy#ai`ljLlK$=gVdlhzd$f^1wJ&>#SLD|CEdE?CMM3WXNK4P5 zQSeuZ{PY=Iu-M#q{@wld+bE40?Y)y^s3)9J+&;I?`xj-A>w$UjG&kjA=VxNV^(O{R zs^W$G)n0dKEPH{=>*Vc)@q1 zdE#K^L?MvJ=&+fs_7Xv?-rZ=!K&sblx-Y9X)mL}NoL7k6I9As3*Fn()rXMW?=GR2~ zYyp4JpSRBsIT=b%R=#IfqOYcyre$ifVUYp8-mQ{C&nu)^f3HJnLcVtTGM_%c_&Q0f z30-$~+7N`qG}p)@$FtgyKMFrsO_muBkm1K+ts%qHf8!$>=E#JN^S<*1?sz-X|T`HnJ-M_3v6A+o>X#Hk{BX^7)EkRn;R&XxJcaG;zN zxb1q)r}}LJ(OM6{7A=`H5g?wujtg5syG9-}AOFbMq84mOvHo9_8izC786|BE&;+`m z>St@^KWehglgJz;n_wC%2_Nqn2Tb^t!HZcM4a5~mOR-A{t_4ORxL#VANDnNFzI)lx zaU3{4lx6h5US9OarH@&UN0SbNyZk|=d?zJBal|dvS3*&d8+cN4r``g0n7o*x=m`n- zF6!2Qc!*_oGpQhkacTHLE3_6k@?qKdqmVIPukv5YZKoTNTj|OH_Y|GD%~2C*2_c;a zA<}J?EMVEfDhn9tJ#vcFZA}q*9FwS8ov4woiQatQhbiYJF+e8ts8SgSZM;|)j?5wZ zy|@OlSTNkxhY>=y?kJHK;KRmtcnSjXZ=gAwm6>*rIWFhn=*%R7Cw8Oa)`|)O8|H|w zbZn?0%;t?Jg}=&X6~ZdyVgfP>q?s%EF^N%?n;?*(Db9nXS&8eN2o0X`F&0cXS}IQO z@DF;M@q^#eNAViS$j8pqv&~9#=@NN;!8ZA$9rWMonR6W&##(w%dh&E|6CBz@6>$?& z;fq1Ee-;8x5=_Sg31$W_!Gczx{xlvbB~z}@8F4d=Kw@R|59H|S)`1-kTp)n>pp35> zsb2ba%Svxpsu}woYtn4tbvn*3+a@OZ$nwB6PXyvkQ=`)~nx!R7wsb^foxpI7zfgsG z=c;KG3~)3&ga8%5_p5m$1cc$Id^= zwankzQ=XFK!_+sy6$E@C>5Gag3?GPDjv2aag4MH2sh3rU&y$ihf|-wqM3b|NGL*Do zWCJ$(eg8=g^2V&Q-Q!*;-TXtqC^q&!^L9TDWx# z+LJIRlgp;vnoGc%afTz~Hk3lHvy13V_`Ceiwfpu62S#z>So`y1kIB*)42dy4spKzK zo*D-OxMKpC7#b<|Sh#t-&%+X>0B4b4XL@{aV^TB=+mp+r#J68sWwc*c>_y|D)J!;IyKFm z3-n7}?VbA=;FJ-BL^GXV|IY#lX_jz3pHa^iXVSy59nFu)4=pLCi-nSAZqpA#tx5|^ z6Hqd#;7Bz2O9HS7lKu4~o*j1+Q_*)CK!|FX*w9NAuSZ$ZHnv0(tnz;$Vcc;n6wG7$-m{C^pEi zrWCYbP-TKknN0-FCSzP#VNxP2T76+KqmP=JEvhPXq>-)`<+G?)-k)jM*=-3zF z=y5(FFc&DB9Iu2;JE{*a8OclfL}Jgaf)>sjE9c?W>ptqGX!+x+IrArg46w(77V}x| z5HUZo?h3~0gR;1ro!!P6`!yX#ts~2c`T9(Cb`QFJ#V!MooPlBQ?YZ{LeMqG&i~d;P zb20UVk@{#^7o(|cVd>Wxi$bMxo8g>(lK?&CFI&zFym4y)bS=vGjeEndp8-hU4f1%g zc@ed|6A28r$GbH(&cGd6N6I14cCyX&mUoO4dtY90=#5LTP-T0P7V zU|zP$P=Y&&!5oAy@5kzQIX zK~3{*A)U<$VnYU7u-&`73yEXb5UzSd;0m(B`U{?5>Z5DW&FRddi{X)xeUQrQtNkmA$Bb*z7LwuQdI3y zsW5L(B+>#4zR@HIqz>^fYvYZh!%?b;_!mlWp-S<`nyEuUVB6LJSU-X|M2l*Dr27&Y zpbxR5DNHaU!j<@m4G}Hawh0F=OqaE>Q9|DUA0s*(f@={M#q*?=t_TuO+8!sF=^H}Z zmBlpyX1IJFC7RUp^t{>6wMc_^lFQ0Muk;>1*+cjNrl}%h6ukJ+$*irV&VjDAu%l^a zFT;l}h0oimAQ#Zaqup!+h!gp_RVRSluMN=HLT4H<2`(aU|F3<@u)~bs0HqDF+!YDVaV{Z3Ag3}_I!k; zfJXlx@kVY$2OTm#p$W>mM6^xMdjTO#-nE)pDK9~$1PGr z$gX!(R9y*B5|jd!UEu)SAfg}`uk0wu*p!4e0!I+l37n62k1 z69)u?GlwIM>tJ($sqI=HvQ1`sQ}1WM-#~NNYDLBn5&@<`tx`Ni;D!|`+hVf@(Az;S zaTB>oT>_Lp z)T>#4{kZ=(Ge!wN$ovzmRG+DC41#l??dX17&&{zpUq7y2Sq|?g$GK0wZG*-be0M_a zv=FVpi7TmGoM*OcnLKasSz#s^7W_5$XnyK5Gk7X_f(O zPx2OIGQMm~nFPpHCg^UJF+#v}o3RIh|=eP5Nsv0I?PjI;$b-MAr;q#7@~KZf@hAf$e<|2Fkn^+R?%`D1+;g`Iz7MWDS>w&v9Rj z8=#Ocdzset@AQYF7D3}$DMO`o>A(AH6z)OfLrh9*rMi+Vm!j0V=^XG{H?-e2QXK!f z+b??%L!Lti53VF&>3Rj_`9`TZ%Iu|x>yL|ExO|)?#wRp|?jbZIWX;WaPb~|~F76Fj zPpzDRV}>M?LNC2E6|g<{vs7aDX2Yx~xsK0eRa91KiB(`Ap-I9fw1J+hL8jJj@N>gt zwkUE`>}aJjgC&iR1Qbh%WD{6rn+dn7qfn>3Ajq=zC zAts*?iD3LDo;AFat^Z7!H@fq-vNi+^dD71y9OY!-2jvnXps|r|T9&Nbzt&5cI3%6m z{MM}J$kn8!G#>v>DJJ8_R;Pr|@$w30018urv9HW&rUSYw_vc_^Q%XmLXSDTDdkk)7)EgjLz?!qXy~@sj z(UFm@N^o!;DRHi3`A+MZk#K*Ex(9VPwg2G_P{z~7%R2kihG4SrU%<1dA@la?(2Er@ z5P}#()BxVnA8X$;i_{>&2wV&Lq->fHj=^4Z^qyGdjnHzWe`i_|JIy=o^s_g3_(`NVh8h4^t(%MlMWTvK7(yzrT)$e;g{pAQG#xOPO z$RzpHj=trUez(UUmi~4F-2MRar??9E&|`}y2O{>=)jw9G$#V3lYmn{QqmAs(n7DNW zRFzRaaWyWGhe@A*$cn=JKpXpq%gTe|Izo>B+8i7>Zx=7YWw!I}cZLnOmQ`GggG?eC zu0_WB@dZucWL$7IqY`7>@zrl?M~`Y)pswR5Iaw)aiOe7>sEEUgo*tF2>gQBblE=ls zRI-Ua;EV-(f+Q$B+qPFD5m}yI;{-l~hGG>3X7GU!@M~O?;p%lPQfLj!?gi#Q!L;>q zu{SvF!d*wXtOWEk(I*#4dLLy7{^$MU#CYE#!5yK8PA@GvO-3mnrEoE!SdBcmq6-7> z{S-)-{Q9X=N}`$)cr09fXXNKZ)wMfPr8t+#^!J5A3d?`*{Dtq67+|%|o6?nX7mrD9 z=Woqg_RjPD&3}F7?6BgquRDZe9QKd&#)gyCU6BC?R?Ryv7 zXK?*VVWCJjt-@R7&H}!&rl;?W$DOtxt-elqc1aC&w2#*9c_@8#9Gd+cEu5 z46g zH*3Zt9$XJdf&qn#p^2wDuKp7=T`Br<=>gNj*8iRV{oe?ybkxnFS8SJfx^`=W#PQQH zD)+LZQg~~)*y}dL%>BX>Et3N*62@9gtDIY~S9^p>jusx&sQpW`r(dll>{VZeOVtQ( zDNIqR_z{Y);Gw^qlR?xQC*qT}qF$GlO{bQ9gq8}i>nZK3Sb>?!N$lKHCA7L!QHgYBX5VBvWk=t0GtsCs4MGX^MRlM!l+x(Sr8p!nv#k zky^7bVx(%FYZycrm*V*|Lc$rNPUG2n7X-zyysBeorR9wJHzgq^;#M`*!$p3z0x-Yzp0wPl#H1z4xea4>H9CLcrvefBr!U~r!00g4 z_5}FNaAYkZa|wGW}is>fl6)p^qm$SaJ2_7JNb@0%)(|KD)>T%>Am3&WHKhy zcNV`6W{ZjcOXY;Kk^*0f)_Xyv%MGlV?owcr#cTbw;ELreOWlO@RL*4r6mKcKVn$$q zH=k;~WsJ`6vV{<&%=LN`hkkTg4O!FRd3T-BIDT64oz7a*&+Zm?cCk+VdnyzGhn*2h zfe~I7+6HHZrbj~v=#+dnU@3_BDegi~ZDH#K7j>C+P!iLS_aPbuU-#3bQ=67PGy8S% znzS8Qs(uHi)g4wmTHKA9ow;)lsHuh%ZLjlDo2IWmnZO_0s0}%tDeXZ1OmpO_+8UPc zwt%68z$Jw7Cm5874ohs3MI*wQ7B(X*aq}#Vx1XR}IA{r&rIY&g9k$bsf%g4ogOYx9 zZ@PBbGzGneX;FuY$9_J*Vn*!h%lBmz99SF0Qb-ZBkuRqX`>dhK34U@T&SwDL67yANFr39Ym??MzoE8vDpJnw#Vy!?RCw8dIw`JqacgKvdHkzA=23GC9Ppooto zQti@K6Nsk*6wJ99tj9~N;nYELv|d*mP3wtZ<4{$UlBcWkVKxZZt1nhR#>G^jLbS8l zQ$4k0aK5%Q@zm^mJaGRRq4}XHzy|;IUFk&elf-majkm&PEW~rCqx0LUWtvtc%41f~ zq3C}C->S%?YYi0y9(>1zz_e)>-s$6o_#_0fvq`jKLKjsIDbdCw*i$9WJ~fkvS;BUs z+3FXuihT|^6fi6PGdnlPy`-QWY7qHjy#HOH|Bwdq*{?nJcnU6Wx7DN(lH`PA%e-CP#;<5gsxZLbrW*Bt$o6s!kXYx4&Wc09cQDlk~?tfda^2HKduMCsMvns z#h;kL(XYG2;m*RSD%Qv{LS8EJT$I_aWa}t0{{H^D+V0}8U zxUvW(i30$95|*?$l?=cHWk6DVtRN49j@2iOn*b9i4v~PBkOf5`Na^m2ZGHUn+|~9c zZL&Z8+5Jz~rxvH&xBiR!%FYM9+@^<3yURlX)!f^z|8#Ts+rpIz*~i00Ifp$*tEb15 z1!Uxqm4OINslg~t*vB{!C;!__aA|QM&F3n#$0{z{c@|C)0KGl7A+$6_Ty@!FiwFyh z+t?g@UOyBarl!r3OekIFcH)qpU1jcng$m$g>p%Qt*C$_S1Escfjs+ci5E6Odqspxt zeBDT+wuw>K5^?uH=`Om1a^KkTF}AKJA?R ztob|q<5jNdjy7e)QQb6BXY7{#Cm~(-?}6ci>(rKxecar~5K?#I5Z~|dio?9;#-DL z(`@GE9lbR@av-)6k^Spe2B()XDT*5`3IVlFDB3Nl_uMo#`a&W28P}$iFv~NPkKLXrQ_vY?ZZ2vRj?u| z-w2Bu57Vc0@@XhAk80V^h614*NhGHFVBv(!d6X{g*DjaV1lCJd`b3oW3+L(k!W9{p zc)fM^9v#Q^4o8o#H7DWL-RDUpr?Dq5L%EIULvdH}NJ*Zm|IQ+uBO_f@Nkwq_+;VQo zKzW7CUDWPTZr!0zE5o8o0u$?YB~`!;zl?Gl!w%@lZ-uOfNUjJ=>{IO!@X=}w-6JT4f=70J952=PfckGiW zZgCal@A`ClmTTH4g{Jx!=%e-k#pWSLSM~>^uxU}xJ2ZQ0I%k#Y{)57y$7q5j)lo`O zF15~Xr-W4dQ08I`)6S;2cN;xYo2G7CvLPZB>Tof5u-orzWviCxSXozBX#OGJN=`7INK-kmklH zF)CDg`kp5S4SFBb@@%<6Js@ENNU}qwBWj}>L$x5cV4}uhVd!)7!67Q@M>I(Mf&xxO zfK#NSuKf)5JkAi}0iob8K4z^5k5~C3nq3;T=VgLkw8bEd%%E8M72MpTR@2kdCbv8F zU;hz00PaFi_(T0C(q8%Zu(;6Y zQ0NE-MRYW+Li5&mERP^*FG0tf>7#U`_o(!B`N!LrL!v?8@h|5X@z4adrEI3}9{h{k z#k%ez@N?&jP(pRa7;5^QQ1@+M zHWhvQ1u1mnQf`_y))qln*)vE?0*3Fa>NT=`PKC;HAE1D)5FA7XIR3e@uIRzlM0U7t zwIe7dpffT8j-Zd6=!Z|6;*3&^)H=5*raedx6fxhsdqZXP63ucYN%CHW)A}2Vh0g1i z;8kCywbsP_^n<))+tc<10M9^@wEKQEb>A?8D1Rwl3#!L)a8dV!gk$CWIZGqd5Sds# zr|R9qY{xQ_Jhg&xIDC9xStWAGdeMuF9R_5G@6&)v-9*)8WRLK@iqn7{~%} zU-<0v>$CSlmznUx4pJtZO$a9F!6kjamGb_`rvrwNMdq))*iGjRC)s;2QUk4I7`^hf zV=6zGx&%*HmrEwYIK&!oo|94dPT;=B2h zOi(vVb8t3EU|*F~W9!<4N*2>^_|=*mx1Jfhp;uo#qSDjdpqCsAB00*kIfMklRs#4w zJYSLXS*}Q8h0TlQ{A6SNImfh~odS}CSFKVo(?&J1I5N$!^3Uh3Lj=H8(5I|UMQJ0W zXxQA~=4m@vCQ9!GX>$&ks;qIsGc6061xU0S3p*nQDTj8ha^}!U%UOn%d8;3OckQ0Qu-FjAhYOvcDWn zeMSVd156{nrB&`K4kPdO@xU5B@&>f-ab4yi@_s_$iAx?J4kN&6#AcztizwA$^59oS zR;q|Pl*G7I8WCy5Ho77q;nFO(#kEF=e?G(^P)^BMPyo-`EiHg6Req4SnwSSmy|w*WViClZ>#q z!B%E7uG~`CM=Ia-P~ffLoP-+pu@53(F!WAk06}O7I)L(Vh*M~B1n;V}I-ze`$Y~IS zDX%2eioHmJV{BGNDQz8~#O9sfaB);*z>)u%gpjFmxEj%7C~MqOeqy!$iP$7tSx!+ zwroNkp3@Mi&bYd6t~t3i4>LrD2&relqp_a7FUlxj5tWZbPG@ao8I~ykjyHKe4|&jC z5le8QpfOIR7MC<34@ZYzByLVRQ&IXJD^5r4%Wh`JaH2H$i&_!MqQM@i}Zwnko z5S@nzVJ2MQ;mngywncJQYNYUG#f{M75|z>^Lj=Q$6u)`t^&x~&93WMt-5(Xni?bo~ z3!dai8tFK)M{9j8=1tScdMvChiwx+(W1fip@Sz+dfSzj~;U+^JY}J!-@~RMN6cnK9 z1tA@fJg^b*heJP>PewnTp?98(R-wx?wGfLs3>h=^+ZGUeRFVR%Qam&)xXzy+knKsp18}sq@pbAmY*xF`5X;2(pgNF|h zM*c`Vs)E~Btj*(%ptYV@>D{|J<$GtrSa^3UnTh& zmo3Tn8|j2K!pU$s2dCLfMu?=h)eY1Ouzre%+K66#0R$HkmbGE2a8rk}t7g{YN1xa0 z$CGgUl$BG%AvV{;7DnFtgXx0)=7Cif$6-JGwa1Zd8BaDK zJc_7EwBRgBy_Lna&hM8Q*X`z$dq;VL_$BhyL{QgQ4i+4IrC!>$kXq z^;`(TmmL_zw&W=VH`jEYQjV^>K#tsk-vR~?*B1-KJ{HqBM_VnpzobVbg2hy^$~X#F zsXqpj4DTWsu2{-^r9mkz>9WE%_Pm5i*drNrts8fb<1R2lkd&0I@lc2aUx^Q1-5&%!_bSp-$*O!Hke`# z8O}Dr2^Iu$|1E|Xg~lPFY80Slf88X;lfE{t`r3#?VF|QGR$+p}$t66X%|L@!P2&%y znik^EUkt_PH>{ALqrZXh6snfin+vB2{HDdO2AEKgSl(|A@%9eA;jbPb%)>snB;%i*g_?C+p0*{4;Cnz87$$cA1rYNzDV8~b;sGn1L(51 zeNj`e^J%qM7h*K-HkJo5;y71%d(Xh|Mr{eW~aQ-xssK zHXbb^u{|6E?DWt86H#F9L9zzcI?^0UtoW&M*v+{xy7x0<_Gs{2dS!kp*B)#9bH}0) z#o5bMaZLT!WBVea-%8Wy+CA*)3Q|#Vu`&^D-KrPCLQ{_m7nczX|Z-B!hrC-4wOP zWjhT}68IM>;(t7yWm{Wa*LHEY;I6^ly~QE87k9Vf6pFh`;DTT+ZiPaz;_mKFaf*9! zdBS}h@B0t(A$#w&<~+|a3{)RVZC1KCsD(ypc?-SAl~$ODNUpY!OO}^TX3)UP6Q<$9 z*pyC*hjOq{!EkLRi7Vq5#FP=c3E~2NmfzQuK5xDi72e$-g-gB=MwxPwyj*7nzF9XET?@0R(ha9M4A(-QN@&tI<* zpGuH3n3WmBX*ZO4{e3#FbH@dR%K7oU5x)$qjnO;*Zt7?E@2m_fNvQh5gNcD*5YXGq zd0%hN8mYs@@3tI%C;O2hri+Dv43s*!MQ{=zBLsghVH&I14WL3ldS64;?6@k95!96# z5J$WWrO>%yg!}UNSI3Q_z}pfK6Q!Cma0?$MSr(0zMfTR;Xel%JAM-hD`5nk_9xFj_ z++?r%pCXOnvgS;JW*nM_EeX@K_o<^lUzHJ@L9|h-*p(T@6viB409=T3y0hL%Z$L1V~4W427xQzixcd=cdn`(LCB0! z^z&mdv&u}1boN7dLxuigntVDutO$2AHa2HdDiLG;ejXx<2`a+<_ADQ~L>il3RR``9 zaPxoH2GHF#M(i`A`~0HzzHx1)@S2^b1f z?hu7ZiBDRp?uo5OFD>QSfC|SDQ&G9?Q-f!91E6B?@50L2Ywud8>;lstwA5|8{IHet zjYmF4_qdJx`LU%G8Rv_}KE|z!7Zkw1+E2y$H23#xETWG;7we!{o_Fe@SSThifZ*~5 zW$;G*fP38Od-P$9x%}P_#HA~`^nLJmibv=K#*XihCjSMLs#ubz>H=T7x`Unv zgYJ2hEc}7k7-PWx*~5`yYUz%ZGa4u7?pWZ)bb65~5;wc}=J`QbIX;O`GehZ~Fdmcd z0FX*qIxp@Qmx*2KHPmXB9A;@s9RHbZhz!4>w;;kkWXEttdRPorM}f_@eAss`nl~hq zhV;f_+5m<>q9j>VZ**fZMPxFQt5V%M(d(p+YdReCVH=PX996{3*M>v>JI^NNtBoyN z*lb}hu{DF_DEr{;X_gV>SSWzK%J9K! z@^%qMm|!9TF;(7N=)1bPoi4bSfqITXt(P%aR}0{(N+9PZ@VKh6A%azq5XS)==kUL3 znM6)dRvvY>!WHo>RJf7LIkIgR+7FOn8tZ5 z7Y(47%%h5^M~1=32zM3wJikxl3>q)ij?r{*WtNw)c=KjXvF~SFZivI{N>TTuIh@hx zl9L*se-W9um(p`Y%lt+JNkNXML`ElrUy(+E1G_U5%a<#y5+{u`@-2!aGCLE51G+cy zpDBMM=%wXS)zxim9^aT5$RU;F74)s@ex)dU}gUvVv-HB{Awyb=$er_i27{ z{|J+JFR{E1Cw>`MMp1!TM@=%}P{H7UM}iq9EEx^qBEJ7e09%!AD{mfYSK?|`Qe`*A zu!_*s(M#u+$njB&Lxyka&;v$As0BU;DwZsaZz-bj!9lBU&h%#uxQR%=a?5PgIR4Ou zz3+zG)ivc8jyZQ|T;OKThi6wcXzw!n(j{xgyNm2Hbc?yt?og39k@y>DpcAbr#wf9EM z)B3IZ&q+F6^K`eu7YvY978`z=S^$RR0L71G++qHtzz_tc zCZLa@mdt3&%u%>kar7rBOP}LXo;mJ`me|7>!WVf3xt$#hF>_E;!yy*wm1F*JW&Zqi zb+ygMd>x=(ADdm~m(+jb3U9`ce0TX9!5tdTaHI{6nWAu}eRy8{OB|V}LA_B#8|DI< zal&ckJ9sR}An1v;m!L5W9#=^0c2@koq=GFtK=rgV`1-Q(W_(A82!ipOUH>r#>4$|G znT;Qi!P8}JsZ$C@e@_ZiUImypBY2z<27^S1w`r4&}{Z0>l= zQ-QB(Va7#@91<3Z@Erq_gWIbf?FftJ1A|#xdIGzzNtbk3he!*nfP{(Rk>=q09xTH& zP#89g+l!Mee2*iJBBXri0-D5%z^)cjqU>CG-A*t(kK)pvdLFrh`gDFyp<#(-8Lc4t zxv^f9ug^s>!KvJ-1PIYhp$?Bmn0%_u6*5uCsEzSRLdd`6S=gbx6Oz|smX7`d{m6e^ zpBmP2pyL9bl9*6lY!ImO_5mN?;mehE6GwI04&`9OQ|U?t5tCK-3TjYQYQm@TA*RaI z6RR+Ww<1Py=Gj)#y!XbUr_>&sY?3@+P6UN#D=6j_+M)ORwBk+ArVIV+dbAs_T&pgp zk8)8XjCYc8TKEZ5$?SAMb>D^T?H!IO zwS`NiFr|9^{%mRO{rm9NxR<+L5}tg;R4)ZBay^#5uQpOW^`JW}52wFI)Y9Krc2uiO z{^UGCcc#j<`cXB;^OyIIWK|ZUPK))wH9C?Wlc=^1i@L#{YS!e2{qH2`PpDP8*9%g- z2i8d82v?Q1;&JB#vM8U0NhtSwB??r}#}1-?*t4T=zFhbBFp`cxLkHOOpw5&1Oef2|i4Jbb*`%WwJ!Svw zJL=hTM9>oLKCzmrje3g}y<79> zguX;la*!$#vmfh|x)%PzWxJ!$Q40=7x_DR{zSUYzx&|%mp#5%hFWVMaJRIpHZ-;Jf zl2dXs$;s(U&UWity6JK9Gu|qE2SxwTY=Ff7eh=y}3IoZx&=MM(l0iy6Cma$RJ#AD~ z;>AD;Q+)Rsh)Fh!lPZ7K9-*?Jy&PLD^Ei9{T!|UN(~x4uj?>&Hp&Kc*(!a=8?v!rf zM0PN9m7{at1iy4_>(>qnPzn){sGv4!8;wj;O2gUjtjQ;ryQ5q%eIj>a>6fXB28VKu zK>eYq;{2C?AaB1te7ZB7Q@#fhuM{)(5gB`?&73xM!qcVF1^l%hm7O9Up21%f!1ap-%2GENo!ya zYYAe5>)xJHj)UjiNZPv4GqU+gAEeT3G-A6v(dzlwXu&O0NIKLR_J8C*NEXt^>oTh6htc`hhce%bG+ z`2ze*J8jRIe0RZXz@V&rx}X1KtFa;vRRm+nAS60}v=nfPmd1r$mgz_)a>6iudt9`3 zSndwdIbv3^qo<2_NM2#=7a-QyKMn7mi6o>Y@|5*C9u>|KsUFVyU=}#Ek`5GqTmA1WKR+_L($2wlNt1J z_qldYVxr*773p}H5L0cN*~sWNb<%35FFPHcZg|?xRIS25rs3G=x}$}jR=kFqgm}RL z8E!BJOgP0s0*_O2tLG!*7(e8in-#QThJa^d>3nml+%_dcAVpJIZGgA2ezCimrM`$C z7NmgXhf`=TO&)|0Zv)TLhP0ll@K#$T;HC9*K3+=R$YTfw-28bEs5$@yVuh~M({Vgo*a}{@isd{jU7qfl@U_ZiwCQZWv1@+x91|j!CFyC zo(GBwPhkiE2y-AC$l!j0E?H*J7_;_e5fy|>r?5 zI)f1~9EI1MGDS?tix4ZsYzbzdr+m3Tv&BMq3eMM(CiKeitc)VmWG|%#|C_!#%cxR* z!?ies=p@nXStERq+LllvL=Z{KJKnCv-$!7m!l9!prMCK=$n0>X>4B_XRf~=F0OVgL zoLa8`UYu0ydj~p_QCn{D0fpMv6_R-?Z`UW96#u$uDBN%f{`y4=1{&C8a+3Vy3BT2 z@BG0mLQN{48^4;3P2vAa`lqhSm?b|B>foEde3)rLkw_&`;4xqLRSQQ9 ziddRD2e%z;c_LJbvMyi^Bj_H8xv8|l!?Sc?Yd<44c(EHh%I+jM&0Q3qvOM_ z;6!L|^d0f|XNU~(R{f{(91VzKfGAa{=A4s_m%1a|eniX}`QuWfLbrLQpP1}9qBs+^ zQ=X=gVuZuJXQ!s3khmLKt#j6O=pn)k0{u4#55aPPmO6g3g?;a@B^Zx2F+j!pfgb7} z;p*!U>yN0C1a@Dim+w(l=b4CTPH!ftxLuHG)-*-UAmHeNm-a8aARt%gp5GnDXL7^S z3HB0`q$VMKgk|DccEIYYBN#j#ls)1=#QS35kmF(_;dO{&f#XO&iO4_v=w77Mh#%1W zz3w1_9`9OZ6b?7YVDfI=^_CtkA#ck?SMWf(E``D}ipv&5ksPn&VJbw&r~Sa5Jr9pz zwwB*Has^Kk!;Bf5QcMwVm@g6*QsReV?5AvZn|QXG3MHbdAMr=TmTyiaYaI#2fO-J& zi3A}W>RLLCQISxRCpr?pf}DJa{s4@LTX|$oC#J7e3Rsm)XYeG$5 z+{TddiGcBK2l|Z|r#l*LCl$oRx0vj4qRoZasT6FulJHrko?=4vd#VaRQ%|Ey6fh#WiL(^0wki4$LFY|Pqi)v##{ zkFJcf2cNXgZXi|(j_z}G=V8^SyB}4KsihjcI(*E`eAQV%Ax4)?ChR&=+&V#+F01w! z%wQ!%f%?B4;m1D;eJK?@WrAnp<(OIu5oN~JS2Q6NZJRO}N(HXC zU}d}!$S7ng@e6(oOkr1ddFdsyE-6*A&D z!CK#}Oo?Pc=WMB(qf(<0;XHQOf;v1 zUc8WiKXBM;o2u|?;-{Mtp45lbBPx4D4Vt0J>Q*{@pd_J#hAAiVWi?iV?y&WzGcwZ-C> zkYc+DNR+-yV!Uvfd`*Oe>G9e8*KR_I-K?3p zNS~8hrlpV2ec`-oDsxC4Dr>yAdT;)SwSqEDRaJ^r**aN|@jp0X3`C56gM;yv77UOkY?a+G=OU<;>w+C(MHK3uO_lM6JxoK_XNVHAq?$|5?GOwG|x&z zk%()BM;C<PBUg=FO zz$;U+iB1ni5P{{W_;}rYmf2}j`EpmFOCR^tY7qFlJ5tqQB$B{+w1&_&-f-8o0%R$wPX~mYHJ+L0*mfG5-c@hvMb&|Mg@4cavI-cCvg@6 zUMxD8kPn!Zu*Furrvyf_@S^;KN~G#(s6Q1pEFels_wXtTWYED$0X+#|*&=%sy7c%g zqb|hUoRS;Q8)6$X&0MlkwHs=WBBb-mCvw~*vk43W)@4i$WaLtt^J8#5q=|Sg_|*79 ziWt&YV8-BAIk7m)LJ1YL@QKa0h)Nh1%p(VjS9*RCX1Q!eE@uMLqqk5;NK|e7s2|e(DkZiGY-$_v%2|?;R zakyIcT->O)t$&zV9U-zdDRy)Bnqkkhk{i(U?jN#K1i)#DpHBiA8lJJouZj!_#7rM~4`m7{|6Ga0Y*?fnwC?h@ZPQP`;t@`MX4!NdB6IHCh<2kvAY(0z< z$O}I9j=7wxq9o$H2lwDK55Am|l{;xz43TriDoJl1BT+#MH#zMu{XcSF?}Ba3Gc4?6 zFw{*c(})YRq_#gbY_>sRcWBrh9#!Y&^L-Q_aA(_hK7dT0&IO$?epU^sts8la^OF;K ze;`e46z{&fMt}q2c*3^0&U9Op_Gcs@kjJ*`iMsGANqH($gI%(5 zHXLwo@+|6#`2qCW4R#ip*tUv8su!`iSuus9j6l7cnMm`$4A4n06&@2+P=4LdH%+hQ zJ9CW^jfQy@_-QHMPNHy#(Kc^hrGJtx=Z6p#>?PSHs5yH$2-saUm^IoUX<*!Tm*6Ly zky0YoeqKvUgSmd<>Gws8}SKjLfmKsstMmr=`-z#+M@`76ki~N zVgr||F76-+$A7ij#pu4Kb=XT#^)kS;KdLY;jCuD~X?5#et+c?srG0K0GEz7tc4fU! zJFv&ov{DiXz1U6@J)v_J27Vjl;Ftg+ssp&c26McxvZA|}Pi2w{?$B*v&3l|-R?10F zBFSJ&3+V)c{vQhfwgvig7bXL^j~rJ|*H8ulRX~E|&D}~5mNGb{uFswi^jtn48m)#B zvPgQEZ=hZUkJ%IGUJy7i`|Kdtqi-DDZ7%_kLW@V0t|P-ut;jSJz@m2>*vqHATIag- zGl*-3L2GTcP1IMRjj_|^1b%>5x*p!dvY8~}lQGh%cyw4MlJ*;a=x}A!Mu{Le}O46%iV} zOUU{!1`ZM^VYAyY{~#n|1*brYun#pIk{N&uNfKfxDUN*2GM?0~KmThG{RlFI2-POB zsU__uhBZQ45qYN|dLl1yK<&QhMJ63}L_e(Dg4XQ9Z5PLv`84^iaxZh3(`bt9dQJ4Y z0-}amU_F-RX$mlNe@IFkJrmY&2|tyFK_=2&QkqHGgS@kgN0C^7@l&|Q6uJ$MZz*R6 z{IJ#_Pq)$jIT{yh76gY-l7V-7ikKg>2fl6w3yl%up(o;&YaKKLFMQrrvQT4D;B}}l zg0B3P0Mq#+qB&yEw2aA8dH*H#;5Xa4H|TS+9eyhLxidt@Z0K`z1b~ay;%pC3(4Nw1 z^?p6V&;5H1HC>7AV1%MYqtyID;&5Tc*^QtfslLas9+^)>@L_&6hd~Soz!1j3+#|*v zbdWDeBi9uSb_)C{QJbW~7HT^n5M>{^JQIe8$pULvg{1{ht*Rnw-!y6x<7aNchW*K% zFX~H*P?OC;{-ZM3%weAUPE87@sidaNhC-nn>{E<_P*RMnLt;Xnr`SX@q{7GGTV>7O zfWTCgwKiY}zNw`*h6uK7$7GrJs{#J2B^;b+X1})xj_KeCohPn4oa21y|UPFCxx{Q&cxO-H60R!94kjmqT=czOVIB)rs z0^=E#$k&4@BSd820!3X24^Zx)xyA-gYAk(~Wq58pZkRHPaw=ym2{<(c zDSEII2}4SF#d`hhaIlKU&y+qO^UAl8rd`n>W+Kc)SLEqDGY)dem8+k+S{fNnzRrtD z3y+v`lVAPi4x3Ve$7X_e+Zgm5LEvg`?1VQ6e9+Z)_jZ zvp^9?N5#;4134AhH~6Q0+A+Jzm89dU`Z?Y$&XBHbzm+CZi_5o4hZ!Xpk*qU%na5S+ z40|aJ2dBN8o4Zd-!Zp^T3eif0ec6EcDBnRk=jZ$BPi-+}y_@r)K-=)~wTGxWL)B~;ma(w!~%cgS`E`SCsC{Z!oN zxs6_}GDKDud#WP8nUJz^=$%!M$vcjgOJP1Ka?JMmo*TG-1o*iH0C_glObsA{A%W9( z?*g6iZxvZwS#q3y#1)HXF437NU%ajDNU2rejtgyj@8+Q3HK-@PJ*pBSr%N1X%j;@@ z9buLA(LmJdi&bDh!6(QqmPnr-2%8(*Eui-NKk$VAKIF;dFW4M~#V_6+KB1cL5v9&< zDWOZo3Dp^ID(m7yxzF89xIJoiPI|U!!d7zBfs*!=a8+R{|{?MMvZ*g1LXkmZ!`_2i8lWYB!Lr)zD2!&K|fH!uAs3C{Q29QqH`Tw%5Ka> zK;gBSOx|HbIkqi=*q!DFsFeIskPejZui>3swCneEOzYcK8q^@v%A>$6X94cp!^*Hu z28gJHB_@}qk?c1CI}5y`F==0T<>ZekQ3PLzO#Oe+X-_INv3*j^MH%FOW4VF)fR>i+ zRK{ViKf*$}zSk6Thle@PN~uz*$T&1!f$JG!Bx?%}tS#JTw z^!{ZxcHq<*N(JVh)_$nLuv5YbsWhO6WSz{CjnuKa>;tsWa6IG^$)|=RA_C((e*#Z+ zFR_#p@PcfDJ(_9bDJFXjJP(298sO&2}r>*a*L(}d65Xofq#0&qxr@y+1`(v70nxLUHET6qVyBrx zcOaXKKLCpw3SQcgrj{~D-0`?^3}PE1eFA+nF&`4@eY*w3aJ zjzFypERq1%9j%^s-4kep^eWLxWS&<#sgG|jBU|n^Qy^b{KWj^kGipUr+3@e7uVJsE zytDC%G^I_w?~mrSS8jne(T#_RxA*W>R$a3BetbFHFMYfvO%{%Qj*9Hueu6xIs9aBv+O#I4;OOomOg9ZwbdE3j+ip;#tOQq3e-Pt_Y{l zTRkeIhuCON1Y{95p6P(Gvp zlWP)S&B}6in$KshE53Ek1eZwuu#4wqBB{{()h|-&@b5p{4|a! zFPf48Y+>$4R<|~%VEZ#);dyvQG!>0?eeI$6j^U)N6|@j*9_jlFoPJ;s;({471Zn*! z@UQ5GFSOPs6pF)jfK;Fhj#c`{r;9ZGZ2!&fU${w`Ay1)YVa%Zi(m4_YspPx-Q~XRx zNys<546PTfmaRnIE)22s>}(RAvCI}MO<)MOMkd3)H8B;1nT=0{ZzQG2b%qZwTx&ZU zoL{%)t%1w5iW01wz8`>3OT1+P)<)LKJIO>P&&qV?j}oU>5KUox7>A#Em2UV*|EX#b)fu{kBe`tfSrcB3{ahxU-^O0nlWKo34oi=rg0X@$+ff`N+mpCiU(9vPTvWk$nT2F4 zp?Ix)%3VP>0iCx5ekS^Ysd3x|70Ne@eM5m9wV*f95`Y?PDtDyP(`;-cKWnXCjQ ztRAJL0_#DF9}Z<0^J=-*aaA?XNw>Qz|B6wnG(ha%65X9K?MelJe)*S2^@6Z7fnLQ- z(n2_)?W+IuH?(si%)d->gnn zOVG_-LLrX%BdQjy2c!FQT4_M`sbyOuL*H#DUX=j%JeOKh2Ov}6Qm;E^I9934U=GE) z3$o~2ARI6OBhe+rGgbScCgM$IXF2;7uzICu4|@e0s7U0&Z)jNfnwq43YvVV2oGkx- z=x)Qy18T++AsVJpDEwsZSCFPqM8Pji(No*AYFXX#`~sHtJ^Cg8l`>HXrN`S_{5BV< z-+^M!FQIQe@lUtlzMX;mJf+ovposHii=b6PMu}L@U;9^w9v}VbqR&?<@EL7gZp$F< z20wacPetR$`~QkYEfku9n^q+q(a3uCVz(3E&gX75Id%M|rN6EFVOm6hRb~?bIC6LP zePhUPA`@?F-JR`V#HqKTRXcF@SMPzR*9sOOJ7mYN(-x>8JVC#OLngoaGGR( z#9LEo29EG*Hqw-_{1F+k{CuzSA0mkEGXaXCR1X0`odg z#w-eRC$H&OcXJfVO_AbH=KsdbG9Y*V zxU#JDjoyrxF!rHiRH$XDkbxRpP&$D_s&yk4VXy#|2~?7?MKmk!Ai@J<8A|1dh00Jn zU+9vB{B-EJB&Euxqn+0cbs{hNkvDh`DcgA^-R*|@8uzN~nq;bXN_=o~wE}vBdJ=jh zaBIA7oUFX#CF(+#8Wv5CNg91{Fwc%mTKH(`qvRGgb>mfwe>L`zHW?JoCWV!mIJ?RI zScdG=^dgju5*CtzsWCHCC2E8!C75)#$N?xiJmKhHCCMn%cr?=X9eXKikd$ui4s2;n zS;zdR>647y^+~E2m&+5HXQ|<`3ynT5( zUP@SZ&hqcYjq*{Pe7;z{MbeXGqIO$YmPJsZ`6!@(KwmJ36B_gF0~YI(tdQqzuvU8m z@AK~P-W;M2HKpFIyZNM8Jsbw5FMs{b1^$+n5~7$2$G?#b)!(R&{3&`j-wFMg@#XAj z3#pg-i=wR7x!vZ_(VbsGKTLC}ldTp?&*lX2(Em9>MCH1slDYX_u?L7!^-tEloUqqJ zk-u-NE#(}#u|04nV)i||ZaP)hA^HSd_lUwVz=Va?q_vcv;YLXz_SiA9sMzGL$n=X1 z({n8(+GB_D)JV=4)ZqSi&+q_}Yf5Zp7K8K~DIm|CCV$q^mi-B_&b@~}EXxCSG`hunxSgj>F%&`N4yz}Uz z2OXvetmQ1E3q$uUEesx`KoSl+{&{27fMrgur!sl7W`;}&$Md1qqb_+eXv-hz$@GAo6hk<4#v@l9rPuGpc1dh4O3coy>EiQ~6RX27D=sX6 z-;=}ri2=FKE5-|`q0oPsbFHurz)lp;BN6=Gm4}BtE?cRJ*P`C*zzSG1P`*=w>AIMe ze4i}n-b?nh#>nX1n*iLFY1pa?;5mWbFWj&uUeGh218qFfoU6WkgM`Hn-y($lees#G|1Pp`YNH3A0%EG~GurR3@bcNJ~h``1Dx{ucyt%LDmd8yC?kf!@z-W$-gnJ<*>KW*@zBihaOf^W^V4E?&X#drO}_9tp|hLrjs>|$Z}TH#SWKUk+McE0|j zv=%OI?!5DtjqSc$KksN)np}auFOErSWA*Zjzk!DC zcSl&OJ-OUt!OoZebiN1NE@S%+Nn7obS1vl(29O_OKw}h(?azChcL`Mj?%ditt5Lzt zv$ko`t^2u|w(%uv2v^>53>pR9^f}?v3lsXbxnA$fke7TD_H-ER);=Vats~qXtDD+D!}F>s7)NV3 zDZ*~L$ju(EU2rgiEKxu+Ny5~+ae}dQ!A@Kg=9dd47bvsiTI|);RyB!%BC0=F2U$lv zbTXONy8Iv7t_1&SYd*Hl`#VXRf9<1JWB&#>$4^f8^M`^qhSuSt_6VD7X4B{TYi8vT zmO)VWOb$8AUIHdAqrvTNNPv_>x{mOuRuy>$cbu}KYxMA363#3b4Cavb?D=2%p!kgdcLgDrf)o_mMM`Oqq&L>xe2 z>bD8lfAfy9>490o$DjDdGo?O3kE659jWE%Ssuv}sQwZBmi50vl!jc(CWvJBx{*fhx zETOVFzO5xA5E$HOW^+F>m$)H}dd)GsbuvYdKcML~uC*$-XI*-Fn@@7XbZNdGyyWXq zS6$gr45b~36I@&fG$edZ5I#?%-s-QUo}Xs0QN^#(c{wAAx4KD2F?pY}Aa=%fh^U>Y z=W;0!-T+47s?amHxljVI)mgFAtOMo_oY>s*Y&<@9ROczY*zj6Z<$0|bPod}x=>Xsrj?pf=Io$QiX zA-Ioq%Q*vqE=Jig(1uqm^YoC)ha51ot3spgy|Utw8*{J7-k6;bKPSCVP3e+iMlGeO z5Gz0_2;ocYp^#dI2NCoB?s4$75ud}u6GE@&UEudhe8A3R`K*51Z@p|^%)^0WaJ-n7~*cmsjF?zH&WD?g%t~GK zs>DB<;ydxYP?2|Fl@j>XaN_sxEDQ$2RGHL=LxQ7szttK4@jPR;c6V4!o*2^Y?9`d? z)~`pqh23;ix9jYUXThLr!NKGGz{~qs)}JsYTPqhR>@;hyx4#9y=EEVuRMn5m31lFM#uCALvbH+E1N7AG1Tz=rf-XpSU$g{xvwvi9>E$*f-WO8(C(#HYu=S z8G$*EkI=6SbT~C%D!yPg)QuCwsM@gs-QRFX*Z%A044f7vz$z49bn-GhLyJl);Pvj2c7JN zS)Tu$Nrfv#MRm@YB>kZt>3>Sce-_iSf&34$iA+SR!fi44@3XAq3Q<;ZL}1R(FK*C5 z&V!^XS(txT=@mt1{R+XEThiByAvqpgCfn)RusJ@Oqozb#=3fM;`;I2pq@2aW=M=es z*npuY!&mv!a%fat`%PrTCyit^o7-9MxM!+{;JavVVGr0!y-?nYwnPQBsKOazFcA!l zuzOa;$g2I2;7ls;ube!DTbeNR1mB`Bp_YC>!S-{Uh^J)rSP z8n3JJ3)Fe`^nT!hF2a9`Syt%bTP^W`tca_fK5U_?9bg`wG?oxrM8AvZI*)X!uiP6= zH|UiKa=Y_^1KYUqVw&OS%bU~F7I|%#zH}8-`;AQq0YFP$BqTb=3 zU8pT0=wxY-k4p4JWKuZqBebw|fm>0U^xo)t&*@*Szro||aAG*c6t!A2)<7XO=kMw= z{19H_&Qay+;YoncM23<3@VjSC;xjvZmq-~@$!zI)*8I0tbxGqD^YfRm?;IYH=?Ys2 zUa~gcfotqfAuzTZi`Lkn_Mg7L;J>) z_~ZH!b_3Zqj%=6MYFaNzh&TFO_3L%sQ(%l4F!vXdSmu3H(0x=GE^W*oUb45pA1)^G zzTu6oFb>hRh8A)af={^C-Pre`sdB2-Bh*^eDirc0_pf8x(yeosOlt(d1y-me#7pZJ zm+CQK9@Fjl{d^GoRl$A;I)^h1`YUgG#KoOO_ANx%{-2O*EaSLltX5ucP7?FY70hQA z-r`(qcEh)FY49||melcyW-&EK=d(LwRetI9ln_DpW+(iUEhi(_Bv#a}*rj~XjXWiN zt*G*(A+{b|&$eAd4;|(TtFR=oCH zX0UipR~nR*czicatJ9o5@sOPm(U{lsorsXb+LNU9b@LvXeLdQz-o#_KP?$Ra03Y^}DJqUBDo??-#9tU;b>bSOBwN@vtqC zt@4~XlM`WUX|vr5?(DR?7S6&u&yB9?CXe}!S%5o&QdyRjlyZY6*hYaT?QsaB@O~C7 z7Kd+ep5-q#PX0mAnixA9wov|ul0WL;AREYC*OV`VVhS}nDJ`PQ$VPjX63rPgpXpM` z3PZmamUl2B*NgAPZU`_?hJyb?Y-V@uyOkl*OGHYNAAwr9NuQo%wbsFOzgclQC1F3Z z!M!~WIXBzNG1J;mjtxN1hauO-( zsyNgfmi#)$(@-KVRJ=IUKMFTvlc(d-fVtEwR$-4f6V6$2Y)OhG7+9d!&N!NI9Gd*;~-wIQkMkq0!XG38@vjoT=3 z(lHUTSy2)t#ukyWugO!D@!9h{@JskCEoon(BJ({yBP5r@5g>g@E3cR_Gl3ZZM8MRW zONW&b$xq2uu_@*k#I=;<6Q**8f$~biqn6UB)!3Zu!gqxc#5^US4!sM(zO9%pEKX6X zZxZBEYR)u-ooZ(}>el`ZMf)~>;RQyO9K%?zJW?*C)|q2254DCOi|0cTnkEmwlNfv@ zrF}^xPan~utP}_Kq@)5T{ZQADKx`Q9Zms=j$JY}R9yTW&G7ZVXvu;LbieGLFqBd)5 z6M-b(ut3QxOI)kBt|f5N?xrXstXj@Or+HfYV&eWXp4zm9=WV+oJ7bgWNX63eMUpUs z;(C8o0ZbMS5uKW`bkqhC{fC{vr!Xus{+6^+y;3=$>ep2 zS{XMuVMUN#p1?r*8cUTXDXVT$=MXkG*9!xSob<18 ze%e}ktqA~8{mdI=lm(9^F2~OBYDXH(4{%&{@n%kr*~H~_wu_*#*6)*>RmYXOaubPdwgPOb>l}~L zc7!G~Rch7q*)1CsNk7DUJx{FNTdS^5J54Kt9NdJqHF5AAc*CiNm~Hm2Nb5W$PrfK_ z>KDn#h4PXLWKhU0hbpEfz??Q2HNl{eX$vnEZ%q|-RV$g0V-HRLZl0UfLdmp@h(RDX zZ>IZz8gD|jeeu6^ftckB?>CooI72G4|8$fzA;onmrB+dibsuMa1&K7{Yb}%b`@QGr zeqrg*>r*n5ZyDRlfLyKq_(l{yiPZdU-KpQ3>m#J~Fvpt=W_SPf~qiOlgYxUK9d;dnZx#s$tpC3*y# zmW#Jo)ES?I2d?1uV8T5bl|ZU;E>)WHM2!QwQ=gK6wQhsKqAx(3sr0kzqWWVde=l`lK1H^ zGb3Z&;rSBtCzj0?(en?E!CEn}dFVEb?p-Z?fO$BjDxUcL3=xZqMIZul@V-u$rwo3q z6r)|Cy-EYwuUUrwow#_@TD^-f_B?{Zi|EkrMQ}lq9bGAOenLg%YQKD}gBv60>3LNk zZcDiWrz6`q>7dbkha}f8z)4NVPj-{ZL4$_Pg^M+0kb8)7&bWL*ZgW-@M}w4& zugnT1*$Pg6fsYH9s@~^4?lV3S01<>mtPMi#ScSHVQb^y`NtZ+_`xudoLrY<_fhez0 z^*v9p6q8sc*(vEkQ11yuDWx)&a-<}wJEIeGAwnREY)RIxBKrCh2UnxEUG7O5XaIS= zw2(HYLLk4oR&=U`)UnKYDSr46t*VfrO)-axHN&(>W5bLASr(mqQ8$kLcnKEnKw4NL zfC}rF_A9ngHibI(i*i`E`bX>FJXuUE-5cGI36vs$Iv&UgI?k>ZUWTE{pVmB|H<>q) z!cn^=c1NmNZF3a=OVjYuUbW<|vi3MWnFUWrW!`(q2xUXRgDi4+A;vhOT=^To{8iN` zliJXfklBTp_Z^GsbLm=(LK30a9r>T$*An(Ba%FaNR-0f?>jEhrNq?pSsXU(ec_s1;VAtHRA!-+4Z>bFJQLd_k4s0@qZPr<>J#c?t}P`oV9z> zj56%3=ouKg53sX*J5E*I&-%Lmv{zxnkqpZ_*P|qz%v6xvX%GIW7IjieimX(MpzdcH3w6Q~4awOUGr7NcCQL9w&_CQwy_y-pG8-g@Q~hX(5X%6_|yS(-U!u zgjzDCf;V?N8)ubo*=-WvRP5dRPR`SeqWN60$W zjx<~e&?|G~TKPRh(303ZA!8X2SsBAiH0bva`yEKdbfY%D$)>gU0Ehb|AP?Nip*WjZ zySr}sRuNyX@W9Idg@J=<>(o`4{O^}pN{C_lk1J7rijP>mhf|=^obs#(gu`(bWW3@! z7cs5D6}6nT{1ei?$Pb-(QF(fqs=-8yRPZ|X>irXcfMyX1+#pdIE<~15r+3HOh=Wvq zIvIoICS|;~JS(Jx6p6+(J>++c&oHP&S#0!dqVP( z6__8F8*rSxI0kZB!($z*%rWuv){|jr%^Al-yaPkxp zdEe0CFo7KjjKyE0=DqB1*R+n1>?+r~f)b1qUb8m!_RT5xtwe)lKA7>eh{rxLMscxH zQv{}8vaJD&s2}EYZMlE3b1i3J8E1L!@e0lLo}X1PpGwrWg^$>bU*%7SgcWqbt$Bn2 zPN8^1)RZbXg(hWK-3YOfHhYl35ya*o3O-JH4r7dggk?_Ty4R4_vcpDmyy_S%d3b@{ zBJAZT!kZhd#^9Y~Y6&g+3zV`aFZ-hd!25_6u9YVvn0qFE%7xzC`5}Xs56zCORqJO> z{ZwTT$BKds`{_3(?5u_!ck-Wu0jQ3>Fb7z$Ko+A@ozVqEScQl4x3z!UANxwP8v zLcLDWtAb|t>a1$<(`xYcZ&gqZjr8vZD^Yylbua5|KUZ8QDMM5aabN5ym6fcJSjX*& z@RA2hL`gdr{!YD{bL@*XbBs7Hv;N5-!LXKpSu<7p;dugl?yjaveC(=L@kPgH|v<0 zi=5m6m^rzaZR#YB9m}pOhgcimy?9#QsK)z3F|$ZZ39)W?Fe1kK!j*S(l%lS4ECdXg ztDR1vhyyvG?N}MgML3*G&2gdQi#PQH|2t?JU#dYnKVkm*?xh^qMOUWxJeWzHj%is) zmi%KLDNnml%_8pmw}^0APbvwm2c{lvxRz96eEEr@+V@;a{T*3z<4axV`Ou7t8EZJ{ah!u& zT$2o5ry2y3<~L-BTPsUqHAy5EqXkIDr>=*Fd1%10b9;6`iaWew+Yjd5h0dg~a)z7) z>~F)w5n|>Q5vp-vCBpqvI(w1wMKk^7$y+7EbqCF#jp18SaG$@xgBFrdz-B-dBB9_O zh0ftaJfr{S-Ee>>lszNqMFO$_8>i^p20c}a`mjz;)e9I*u5|~w6*~{a z#9NB&;6#Q@)#*LI0V>WV3ecX?KoQ!wSozl7OH*T~T>D+vbQuiSbvp>R*_no;3QJW< zvx`$8)#ed)0g&~yn5rr3gDK*Of}P`AKjikr>p|<0!tXSD#vbmM&>z!T0w>bz!L=9_ zK>$Afsw(p_m>m<9%Dw5(q;}MUbeu9sK+l$l0qwB+h)|0dUw;xjv+-OMsd{K&RS!PM z7Y-mW4z0}YzXe@J1y0>r{fXrk2qB)V8#R{0q@c%;(!HDm1x~1m)n`Ex{JxKX~+Atw?>t&$5|@QwxBGa@EpAt-bQ05D(0l zZHyZ~Cu%sWH1b*S7AV#J*8hWL5H#&ErXnfrg1TG5}kDgXTBOErj*GL=H(fR^M&j2w_aE&YE1 z3LthagoZR=_6!-i z8Fma2)u=8fmuOqLn+DcJWg(vLz{RA~=*h9?4W55<{mp)+>jmt3-=blP3$us=$WQRM z$I*T+bcEGxZ_A>=KqbaJfqj_5{r=yG<8aY^z#M`Rka+F>UV@a^R>6Z(9z?;3`Z`9E z<&qq35a-RgWfzWNt@Qb3$*PE?NHO#>noHBJxO024a1afE?5kC zDx9fpbWleOGDFE*-;(G(f-o*1A?85^i%bSk&1sTdWv;J>`t^D2^G_rZgT7<_dg?8G zEG#Y*p9FUAvMurJ0Cjn?kZm!nAjmqbR(HTsumuUX-|8c=?->>Lq1HX*To+;={#U80 zaB|ZoQX`tC6tsgBLjAh^N%HqLJOZfq^tPJ6i0s+mLB*&@weVJVd1^0m3kLvJGG^*{w( z6db(|rJSapW$x=>QxjlB4o=G5?wVU~Sq?R*4w5ru7ti?(96 z(f${-RzeQg-Tqq$0nLBIS@l(@Q5C|wF!;9@VD;Gez$I_^0LxN^zLagB804WyK#%%P;==J{6W+Nd4*WsrvcK3&WVc%7QJy zZ65EL17Z7IC97Q_v(x==Y98-A%;khBTO|D(-u{#)^+Fg=decutj8Uy_|}T>J{do<96k zP-qjiarYqRm0hy%Bob@y>o)jrDE6X1Wea##bNPUPbuKIXPD``ufTMQUiFTsrF~B#X z*S!lQD(DX70LWVKa@8-}H}!YHZIZqJx=G6lwv`ar+vIh9vg8bYE86Ka7_x6d3X8mu zB{V&(5Tsr8uugb`)YF#<7+xk(mSBf^v8?m|%eq&Q@wfL#QKsA#8ox?hNCveQ!_%U=R5qKFW33Kzr+EADXPnodc|2XtEnj|fV@~loEDdpdD`j?-V!>pU-*bJ zK^-LNP>C6v-MkAp8yoHI1+f7QMT8`?0=|KIWE)?i)76B8SwGuFJbH4$Y_7tey^6%r zxki3cgP{xR{u@KFPKGWEbqAG59YtZ|L>@GkLLj^7xbgxhi4{>L{)4#S>!o9&xcFK(-~*btY*e@8>N=J z?ULrhL(6r{7@(BYyET%gS!j58M4Xktal?cZEnx4H#kQ!3gIi10wAs+KZ^(%O6IMIx zj3<)wcF@6GfszX{a`P#}O2V3DwQDg1`Mjl}rmBCe>{ejBr?Z93tE!zn21xFt%96QM3kuq98)l z*Mq+okCzkyCeGI@U0r^${bu)8SKMP{-bp(|-k+>zA0a3pW86^7MyX(Z?a9t9g)grK zG1%+mx&<-mcRCVArRP1o1>Fp;6Yz`aLs4R-$`Me5DaDzR8K{FY@zj;Y=~6$q(1A#= zqS7Z;H#yb5(M*So{$`R@AKB_Mx#|dU&HCnP^hy9+fmzZoqsQbkP;G~50{Zqm&5_=rAyX!Gs%PImMhI|JKg@L#dXo@Q@af3ftHW$*xJ$29LkM?S$GD$S zE!Tr~zScxtI&go4Hm43%&XKB+tmH#EZ;pRTIxcE0zN(Z)i5=%>N8J>ZLlg(=Qb`+YJDbz4gl14b{ zEFxjWEU7iY>v9P=d`H0L;&b$yICScKl`aMHgRmq5U6PDpJ7LXe#~1okjv$}+s|2PV zuH-^jG}Fied$9swg0N(Rkk3469Xzh(y}YE(1<3D zkgleUAV5QVba^E|(7(_tnHoWDQKk0cvtwsVMP{nQYN>$7vjY-8_Cp0e&%h@!;3eQf zYYIhOpWwF(^JQfq<_2$DwfKe^hw`dj$=~TrSQZzHsckH&YUJO0kP4I3VBjWOs({iTCu^jbFG83>{u{%v|K$(E ze+uwy)|j{%r{7gbrqBgC^rG1(8yHix%y@wB#8c*QKwSRz@5Vc?dg>I3nEqDz-}z_M z=Z^jT6#OIlLHoB!0A4id|Dmo~7kta#|MB2FVD~XQT$mC-GHRH(7xF z`s2pbpotTDYlIOLKpBo2zz0BGSZ3my(bN26ICb7PTj@*mh~k2KpBqHww9}8mfY#Z6 zK(+3~h-_=IOH_(xFDjWYdK^JSY0TAaE#(mw<(NvoQ}=M0aYtI9H^wc+FR>Mo~fpIpG;;1L1H*f{0md`8*_aNPAHxmiky> zKEr;D{$&y#`8*1u((2VnWCGZqYbCDx$rRzluIVL%dT*S2kDU)AKJC*UHeH4PASLqJ zk-7qsQP;EAo`Y;u5nTVvV1%twq~WS`?Q-(Z*5nL5U93RihOdS6Ycr}018Wndq5_eV zxG>Osidi$Vo)JD5YerQ@BT9LuRo=rFC2EowEF^lX?Sy}ocHRZaka1;nu5#5+xC=PC z{RxM&c$Uv`Q8P;rlt;r)S4Gbu3mg{}Sb@hmie~E9VGdLTMbJ~7SvCE#b6DjiWEok25kN;O!iu zq?@Ri;kRs?SE)FcWlM|)Cv%Bs(9I>DuVmytiyb^} zau^-g3ikx9$8z#EuF>~rd`wb@9e|JZk|?u(v!}0n)`) z6-7aZ*;C7unHO`Ak_S?(PVlJ;C`~@;8_(g1!wWq-h+cJ&Z`s(4L4rbCa!I>bULi%L zBAJD<(zaq6yG;I=B|ug|H%ZCHmNi?g*~F!W$3IC|glnKoIenp}XzDu%ol_q}Z93`} zKhWW7w^TTWr`?_0V$g>HlU@Cm|27#$I)um-@*>iz5HKNQV#5Ia{!A&rw|&tVe+CNQ zj8B6b#n|Jcf|*G?oyt;4S7iT`O_T1WU5T3R7wFsiv3IlJQK3Kp7iIQ2;x>gkJwJxF z#u5qvq18aP`8j##Il1@Yv+r33rH-vymM%K=Gy}QVo5_h$MOK)W{xE}4N(28f5)f4t zj+Ji+%*Q3=F)jvCXa2Vb86tIEw(;7}_J>KEWd|tg!WQT~hQaZZ6hU?T>hG|&Qc+!C z()U<`KdNAXp{a4k-|azE>_|;7iI>1FoA<$+UIqSGX2f5d`F|EbbiJbxu6NLPWEC=L zEeMZb5gb1kwWlh%{-9>r^3}fI#NT5OO8@{0WS$^b8n4Jw^0yIk=|tlz**8*9$=Xjy zJg6&T9b^J|CP`sQ)WAJ)*vsfGpN`Rqscsx9W`~!<;c#plhVMi12DChh z8Y$wk<0{rT0D5F?r)_aP$|+r4UyR*;7HB=$5ubeW{qT31$y{?09ViB0-7M*2?b z{q`tZ$P$@9V7Aif=@(E#V2omTug35ual=gy+xcfYp(QR{c^Phl5R!s-ds!M#cvAFy z7=j%ZMk?1xw@3BjzGycGcCJ2<>1wAv?RTw*^l&YnuLo*kQyLdr!GE_P;A@_} z0u$9qo;Uq?`28Lm6Z-XE%`OatyS>|x#+kjsb7{T{sj~DG$d>hI#Je;$y zSMhqSG8*Bq?oeHkkQE5+R3CqR{s=&+Tw%p++~1Njo6MB{chwZ^?Czdtx;B0(Sn1Mv zV9{aDBVFbUTu97^9N?q|nLdeQEmkToc})5;Xa7_Vsvg!S1aWo#L~4mB8%XS=gIMm> zFe8v1I)X1-*XsTfW{+MOd++?rq!8hkMhaVm4ByxFhk8}=?*^5-E;zhvrpMgCub3S9 zgTb@j`RR`#-(7f+gR)fJOPW6WGR2}xm2+Iv37!TMdWa&POAS{ZH^vjt*mB_u39?paOaMAVGH)Qz9u3{@xs!NeU~;CrX(H6tWY4Beslc z&lV{Uyk>KOiIXNhFJp*Ch_Dy^g^{8Whh`Z(a-0xvupzYsKH*tq^I6%wCoeC}kFTjg zXM~Lbp8L}AU?%|vR60b!H8siN8+JEkcC!cF&WJEQ$ZV>=-hGgRWL>cP&-YV+w0ze2 z!rr4KU+k2iwA~ke2f|ez2lYJ#v9nB$$QW^vL(trWy1x_%%U0gWAuk}hk>qv4-Wzz{ z^%fB75W5(-`_24!LsGUw=3i}`d#N12hQkMpgd8Ai*HYmsqT4oCtYSGK%rEy5A)aB| z!!#jWiI1D_FA^AUcT}HSw-&e;`zT7E-RDC_- zLA^DQnJI_httWDq*eRdVbo4To2r_COkZQX1d~MTSmTHMF4O>MBoZ-`m%;_-*{M?Yj8q^J5o zC;?7Osd^>W{0#mNCrYk&4yI13Lgev~-@r#GgXN@eV{rgvmcK4`K|^hL`bk}uac>%W zf-hPpI@a_^jOF)v+l-LbpP6UtRB;6F-O7k`d?eRV^Cw?(#;MKl-`WkBb3Yv;gxr2_ z9y=mX*x7TILyw92y(jsY1nq_+LU}NZx6(M$a--^-`r=Qp>emaFkM+s6q-}N4SnFbG zEUCDPsOO70Dz@m>56}qb%2Nak55Q9_95B18aKg*+STT1H9r*^`|+dY`fL5*-GGj#1MJuvQtj4>Ia&C+6R(6p{^|7Er-VdX2LyDsJNtV z|J8^8U5aOCe_aAg$)G?JO> zY?!el5JbZg^C<~+jbo!}$m0q}=W2uQ!wER`3kEo?|7S^EDAA!^(U0s8hTQ^zjws_% zWUiUq4VmYfeFi2F`^Vzo=h3Mal4g=U+>BIXcD3`JyL-%0wSrIR&DBW)L~%v&6Q*j@ zgQX=l`_k0)+`iP$DO@OHUs<90W2G4_ggm1XlY+;un)4sovOHpbKh*K1SC*KoO1MHN z;)s(Wu0$6=QBIIn>u+SV^P4)u*`y*;1~;Ud0g=k^iStDP-Suu-ZbJ5z#oi1$SD2 ziHpvXBA$B9JJGzwnG#;`I8lXw-p`^X zjmMpVA}_%b$TpUTFp}#~xau((+$}{1U%BDn6r8+Obq3mmHAl=_9I%)!*Z|At z1Ztu2q!DsNGK!LXWP354hTwraDruk^X%h7`G-TKD!6{K4Q)g**qS-pqPf!6JGr&mm zAu)v^&mO8!{DY>9Ai-{x`jPzFKlY$2N5pRIQv9QH3E7T{9oa2LuZB&S5ptaU?_h}X zy}_G8ko@rVMM16- zT^-i1Cfo8XA+jOuW+Xe*c|BSka1DIp-vV%%>%l|crCBJUIswjLQVP>cfVk(u)|v~I z0)0RmFB!3T!&p#ev2Im6FBY+^HZqqB9kXSNGp+&|gMyJ*(jq3K>obB?)!vxqyu@NZ zrw=^Bkg)}qkEHE_2lziQLz=t|6Qc%MCKajf4647@xivKd5!Ecze$kcJjX0E|^=&w!T>sLS)!6Ulo)z@CGbrAN+~4CY!1s6s00xo)8t7>|6nQKe zpqd%(l5D?YK60=ETw2@cMm&kbGKmyS*WD3$c+X=G>zFVMy>|SZAR8dsE?%A8Spmff z*=SV*PDvYw(J@X7064a((Q_eHd)F?&-U=u>) z0q{--Vjf-8C{9@dnq_NQ_ygEhWKf9iRFZYnOC}t*Kx#-4hgP~MH$~%w+T-W6LXz`v zMRBg9(goIYjg8tJJ(UtX%iFJ7N2o}tKsXft898VKflnCn8<$PGp`R53u%Tj%f_Urk zWAH>=-+~=GH~aZ4zX&E89m@&7NCI*?`?*#p`mr`V@Y=^VuqW)vp#{1S!@D&;xq`9w z%F62ByS7mgDu5D$qn>*yxta!^}2e zkf(kRJ1yQBvWSvEooMYDthcyqPOcN^>HP&~p_%T6?s&_yNsTb%6IE&q=(f%{i2FrY zjVIC)X#uRkxfiJwm6}*b8+fAQa8I-X8ti#7z=t`GZc}l%`}RjJp0ve8V!1kTK@5ja zm5(@zCTGE#CAt_$ny5&stxaeQPP$y=(o3hylPW=Wl_vSQH9%z*h>m9om?sG4Z}r6< z!nA4dd*qJq{}jIq^beihX8V|A;0R&{J7mDqMQb73Rkr08pBfynGCmb-38#DF4Xr%) zIyWD@5~$lz3lp20@#dm2>@{&o12jKpdp%@K*-R|vitG_<<@4kQSnLs|?({u2AN zaSI1sM(y)rSF36ev}Rf%j9pdV+uY8EpUB)M?@@ZwOm3aY(Qi$`Q>$1kc-{ z8gX1yI{^=i?!+(t?PLBzT+E08PO8a`olJ0d|G0xC{Y4$)Hz_4lc$BN2R)cbp`@+zO zpL~gy@tRoQds8mVlSopU>4A~=H*l;qu(0@VQgq`fRjgq_q_yywYZo+lrfFDq@D|Eb zB9iwcdr8p;FX=O2rwX97%~TR<8H3=DrnBG>mkyq94e*es1_q+bF}>(=y6t)VuX6SZ zujyYmR_DD`!_Bd_Fb~QY`f0#xPuExKf8ywOZ-rAnJ4-B);G#rN1$F8PGMxSpgi$T< zwVfcA!r#EMlrN!1LuZV<=0TijapH*VFhYXBzzBrt!aDeJk^Uh+I-(4VvRU3{ohU*d zw?$GHK+J*X$FT3an#or_&qQ!l!Hns(Ci+AGqZcJpuhwSgDnW?03x` zJesKG$nyNkM-|y@L>H1pIah326?=swl0eMWI>_0va5nb^ShD&Sq`s(>9(-33?uHy!McG zP(bzzJ#PK+TGe}Z-YE}Q~ zG2NuL9Xk3l%gKI>HS{cG8AKhmQ z=%gsUdh=>s40zi1!v#+Y!hX`ai$e>)P4oriE0wc&a}dL-icBP6sowr6|8v#FsW=&8 zbvi{LV!RRqb+BN==sp*x{%H^UCc1R5E07QxTWD@OOYgq!Q$BVY<(Oy3P!Elx4n@0L z30-SXc}@UMGPopN=_%80`5V?i1M7d`durb=OQew%xW?CN{7*4mLdh65KfOO6Ty^Jv z3L!B!qO(?TG<99`L5)&@O@-UjieHN7?AkVC;n5O<0=OT)ZbO-8O6La}Nl-z<8uj<% zYQgJhpK`?g5wU9~xY*Ve)HqEwI_N6(1GDX13L zK4-soGJV+=pMFR28=)JarY);4Q+!8#43JK>k<&8W2mj$Y3Y??vDd08vf{NUz=K>4Q z+S#BDKR zih6BW(s0rQ!)S{oR>v$YJY(s9kgTe`c*cCLOhECrZN!1!XUN9r>!HmAc~*Sl_~TDF zd}!%7MHv8K_rLiQGNQ+_0K;Z0At`*Vd{Kdpp$@lI7KFOM{(lazCPbpdI z!(+BEyw{Civ$%HN#pTDdsH&U?~OAaNu{&>T8Tq|LiF~c$%F~)>*0x#OXe5# zQ!%(HhcorWeJE|!P{-!1165Xn<>3c8^>(_7U0Tc0ydCbD)u60EDZRVI{dZEc79 zwlP8M*o6Q|o`@YUe2>qsUxH;^*5+TJ#4w|RpZvbIuQ~D$Q!j=TYL}~Z7^_Ps2Ak^& zSnSapD_g3U0Tz6$SF) zrMP8&5Ke3Nv*AHQk*dj=K3b?}+;M+>1o^S5Vuh`dHI_qN?x{*RFC+-VSiB6ZXCkT* zDv+5y_a}Y9H@?i%=D){Su%Tx21<Uw z_1_zwWv!ozc&3F``$Ncb3K;eGUJ5AKIXL zF@o?qt)diKdwV0hbSCH>=>_$o?U;ywW+&x{8&vaWDL=Vwrlwk_*SaOv{$u8pNS)TF zAeI=4)U7;WZv=#L8_b~x5bpxhGJMGo!csh|gm`KUMMm}fharB!vl`bwPh}(Bn}?sj z=Muo$=h!YeNv&}3sVHPt!&~%3u)&zrB~A&c(;pA5N1*5+k?;0%^!%riTl^edKTK!W z^k3oH-Dvp^lP|W!VN=JkkWqFWKNmVBgLq{EFK>zhfJM2^#-JYL6(cu6QltzRE`e6f zZ+5bk^JM?4R!tUV;_ftY!n3W?ZerXM*zq;ZeA*LEr?oNK&DQ%mC}-Lc2fXK1vfoN| z0Wv?s_TMN?;(QDXec9tITA!sS?}(2CC|8!_)i6izO?m!O6>;25(u(&=Pu13+gx0Xp z3Wg(c%?1f5b7fX~XVV~`xRP?E3FJ;`4o8K81~`;J-EGDvgYs;WW*BI{R*-T0HCpvs z(;fBDQkhKnvv5oNevo;GgcT)AsO0l39LJ`c;ufu++V7U)c4(uwfva4-5{&?Mhytaj zH#SA!s`mW2f`%xotnVnBR)oxLCvVEvF{8-rb=OI ztX}2wfa0WI2*lNB55q=8PA_lxfow3voF})?U+)AHg?y6*m9+xo?LaF{6XTYYC~-Qo zaY~@z7Kw*n>@YVVDaH80k%};#!KSNvog&osFRo8LU8c;~&P29iw(eS?ugy@R6Oz^D z$V@Ha^~`1S#^yHNFv6e|o1NszgInv6#E|Xp7umq-_>Kcpst@M^beiyM3orG0ko>YX zJiAGjO9##-AmB>_E`W9`Ib*l)Bgn#GY+u8o08CEvr;Yr|3U zKJ^1(a=)1`4t3*2NX0;DY-0SCLwWAr)OW?z%)*CZ+z{6pQQub~hOS~0X6@U(sFp`_ zojA*bFd+8jl?*plve3lT0H8emHnrW5)En4T9j6{7?B zgjTUKVlJbi1Oi7i$o?w(ewnKYUlOuBS2b?!Mhx%Kvl^pGpom)LQ26-U`<-2h%;v@F zzd=Jl%;rIed@e$t;VrCvALIRRzEnj2)dq$kYSMUO{@g~sgr@rEuP z<84OvK{&PXX-UmF{cT;{%wMs|82nir!i1x5*2YE}Y(vmt6{D%&dbslL_i0qhZJdS! zTDhyH(;^Q8AhVzeP6}!~YjjP)4xzWBl!+0+N8}otxzIV>ZKfVN{HWq{DyUi%=R(_T zAT@0t9l)?MSc|I5*|%&AT-T+i131yEDKm3(VgWhH;lCG?8mqEboPjE7h&A(YG){HS zOgX*_bsMl4I;}5sA*sN9kzYX`xuu!R$@!$-X^4`cx{Lw++d|khBE65U&`YEG&!=<36 zHiva+u^S18>`muO-myItMwV@XSBkugMg0ruP>};sF0t8Ksr3h;`k+!c{}&Z1xPoh0 z238>WUIFQgV;R8!XEmRQc^i;QEBXv9LY~bcIfsW zHM`kQ+n|%6A+kQ}`E6MJEy@oHmE4j$cMrTJ(UU-V)cyWg|70xpOFxx zh{f>^gNa6G;s6~dW}Yzs)?e6Un$Z$Mmt?5 z^^=6@*WtSZ7FL}jq?LffW1fH?QE*J$MAx*^IUBTbA>#5nVlZyu- z=8wAO^!RSbATe2q+WB?B@3 z3TU^^q}(1G!*-7nVA4{W4w%n?#Tu%9UZxWkI3Htk?Usyu%Uxk?S>{xQl$~ zSh!Ww3D($jzu$9Jc4F`DXVCTEfqxi*=Wt37<&`P8ZtTB)kQ(@>*M-!;`t)d)?tH!m zoh02|K5Xq>LOIOt&aLjY?Hsm`2lbETO~qQLIU<9V3kGc$;!7w^o%TOor#-lP`_s;- z@f$M^W498~zOqm*gM|d`^f)4@Fbo^~&W0(X(tI-e#bY%K+VcXc<*`tWcd#`5%$2Ck zQkdLd9y@h{vSC>vwnrqQgz&$=$FUT;+o8jE@X~BXur?Gr;~qd(FrB|gIaBT`=_LS3 z)C@WzNKrO8Ysz=g%FN*5I{K!@5=c*;EeilF1jnCd2WHC( zXpR@!HeSEhUEdA;;@Qqjvt#}1B&hRY1RDtp#`;Z z%oYu{LdItDN8%CmK8T4DB)0#lZaXKveUV>cB7@ck#Fr^aMoN~WOH-2pgYCx+a>X~R zp#U|C_m(K)S1T{%m`}}vOhg&$`fuu-x81L2)q8XML^Pa2DoD|FE|Q58emf?j6^0ZD z5w%&}jRbQLQeF@wsuc|-j%y}ocWK`V6(z1fs$MXDQ$j%K6*}DZSyJt0N-~x+4I~^B zW^z-xU*oOBsQh|M`1O{w@0K(({9|~?b_8%Qz#5B|Ml_REDt{80AblB+%lP&g=6dn2 zCG4aFu7+cv9bq{4kwGdgyo0Ko$aEk2`Z&k^i;)ov^127`pq0UruintFgMJ?0M!|VA z`t-A#0%|u^n4%~fmTjJ&X(R^4;|F&26;){U;(LjBE#?Rh~3c^c)b>8DTCK)-1f8$WcXpPsqw zuh1F><=rq)gD~2E+;!ciyW$iUR}Ch!s0R!7l`e3gz$KNpf>~t>iCg8s2r+IB3QgVQ^wEXivwR6UxwNnhUY-;-;gq(!4S` z6jd)vX9OUSgr>5AUv}1)ia)OpcCK783pH^liKF0RiM&sm3`iJsCF8ynNPl`1pmbkB zP;nY{shK{<6-s7!v4=$8F_&N`SES0wz`ZwUnZ?y| zSnXTnOD!cUP1Oz=TF-h%9NTrcPTy#vc8iY^I761NHqX)6L<;k8E}v&3fN=d5S(?uM z^5&u~?sdKc)(X*m&nRVKF3?|?O=k(vQ-xH>IA+Pd;#+4+*o*z z9)gT7uR0CW29*sSXfWJ$wx+w_tw&gX#+LfOKSG!*Vj-_SZV4W&MY=xzM}&;o&3e(5 zGF@HAgDpC_vW4taR$BG8432SfSu9bTwEau;EE{M#b6Vw@UaDq^DsM+=4#8j`tvU{` zf@&rQymm4eNJ413mWOu>{`?Al^Kz8Pp%bURWloU~*mEoWV7M$6c+9Ywg&*wP>;3H6 z*k!=xKO`uLF=jxuq}cb>;n%TkPtdL&Ycj%7_FQloCObzRaBps4p^eVJWQ_^;5FP*1 z8LClLm`_@?cKxy|UJ7Q#BHp@J#E-*o;W24G&%bvQ>X8y~Tp6b9%S$_o3YuRzCqcPh zM5XdSGx;iT(9_mohW^4_{U;}+MT{_&%^cl8sNGshI9CKO6lm|B$h5~I%78;`^9)`P^&Ql| zaF%AmMl5ds!|umjGWojmUDkS3iIlqBwvo45$e+!fE56;fCH411^^Ik6Tcq_O)pjgH z-`bW4b5(Vv-_aRfjr)m6-m%?}2czuXkW{o%95j&Bm`zlb&lK@{@J#8ysyn;Q3sID*`zE^as{}tA#x$atvISLX zhn%_OSgS7_mmj&JJ2EZ*rgVe-v@5*2cTS*e`XVt#G!PCxP7B>W3~H%@NxrT=_NUW@X!d8$p85{M{p@NwSIX~4xN1BFq3WMBM<3|D&4+WBP!q-@cNp~@GIB?N!Zt-VsS#N@A zCJ}Rw^m_W%p}f#x>rz*l!|blmbC4qX6LRv8kH7BPw)H8meQ_l%t7?@GP28BNgE5F& zKz0c9S*cYr=h^bx3F!?cG@G8;%Zj93u7#TnD7P6Y0kcD?@>p+x#-_1hzn^ZkT+H`Vu1OGs((^Y!u%gk=NMM$`-bb>%C>ErlWp6!HPvL> ztuWcvWKXs|*}q&9r@i{`WACqZtZ!?*@AKT(eVymkjp_`Pd$7Yib2H08hydv$6E z^%URllzvH&aWI(HH}UxCtXYB{SqS1SQa2s=)hvE6p(U%kASTaoZ3bEprYvOmGcllv zIKvqaLZLbm6KB4E$$r0I_u!y~HpqD7`DxDZR~zj0#$ngBJ2*8Y zm}!Neh}Zd2B~JG)bb>&dN#N_^&wsnH-%e|D+cLnTsr!jOZKK5+bhRDmRV1(VVe=)! zP}gHNEM1??WK4$D=MNvh{X6*fsz+jMI%d`&KkyRp=Wjs1>M?Hub04`Mh(`{hmX?hN z3<=mlj(bP&R_r9W7_V(+V?t0zlx=d*b8jQBZ%P|Vu=H7BO6OwcsekUG`~&-F{`S_) zv*i++Q#oh@Y`=~{g-3JR=d`{|(K$D`)6X!Q6iAhv@~6Y@xVGE=*TT!xMm%}^Ruf!` z{vi6gI*hysMbYS?N2WDc|FKd3!dIMi-^qbA6|(!Hr!4Bj4r?W9!{^v&md1+Sko4tw z-jF94f!GLDEMkU8^^?R{OYM(O1c@7wAkq2odoaB1ZfWFi88{vF0p)(H+n0!P@ z@As7H`TBRc+5C#!g&U%}w6{9J9O^Oz9cq>cLnwDCq+ye(Ilp-<@$)(H?Hhjrju&u{ za+FSAtgYu)aCSzAQ_rIothCf*Xo~p@8hXdn&NZ!x%$m@ndr1e3ZKO zefUvhx}5I%_xJbT?s|;Wh>%@&ijf*Uy1!t*`f;u#3=U9WS~gx%X-A(oD4%m9QsvG6 zE{s3@BAXj~DGU52^>@_#w_?5@F&LkSKw0l(2?5^Qtc$0~MY? zq`D~E!SR#rrOqFf>NbDo!KiZM{L$EGSI=Ahs(A29RNq_*uo5}+VuAC*!f>s zr7L-(7Evv3Q!EDQacC+6Y-Ga%nUu*Rby5}ZZDnA^5_9i1q|N5r?spIj&wlcx>q0W^ zi796F>Y--WCOW{9EMTdc1WTMTYcnx~^&FqYBK=0#9^+!zDkH)emgoX<;7iw^B68m2U zf-H90{&KV!47LDiE4&%9=%)POFZ)?3Jsfj!GugN$FEbCw|U>L?%hM!p@}?+{5T@NU@|tkihb!G0LY9@wu0hm^j4j>>!W&^{`%kf-gP zBC~ORxbIPQa$`5^5*mE?m4ALyB(22s_nV^>0KC56fP7$DVM5^Ro9+*tx2d+bq9qx9 zR~K{Zaiqw`@CE#4FiMO6QQ4CwO?H|6cf|T#wSu5-=3|EpUNZ$6l?iZeKp`6!J?W~E zr)xEnU?ehS&+PQZ8=%w!<5OHgFs%cSuYHXZ9UkWA2U zzXtDH3+N@x6CTGbulnD)ySdInS=bwr@nR){w5{RG&E;WUPD8o~?TKpR@}v5<8M*Kc$h# zs*_MSRO(PtQp;+rlW#fI)EHs%w>2uvPGQ-_TJ_gmLVG3vcU@gNUJXlLKF{GeU2ezt zII%JQkG+;KR;~b9`Ycj7oWGATM&J_n8U+Ivc?aS> zOZd-C?@HS5c$@V4_#Avyx0`{9Bu8jyEQ!2^LEm&~-NIF5P|SkPuQ zw-T*-b9hWmJP4yEU!Jo+NXveQ5~yxVdX4CzA%<#FT6fNs_p*Z;o60S2lcPF*u$v>D z$(N7@XnrJA8uaU^Aq7lzQXP22j(0LN?&<_vO<;*GM7Pme+B93?V<;s=u59mPHdQy2 zoXf9yg)wtcMH#M3762}5vkdtn(2{~I zFxEvK5mYmSD5KQS#g5VOY)hxyC{AY2p=dJAE1wFA_xYHJthiUWN&jN zWy&l#A5&yIIu9Jq)KbA3BPeB2gsG{bJftKLDtFAdR^o}MIv4nc4#M2C%0h9${A|ls zoFc^);+ual)dWtWZ+P6risZ<_CsyTWkuJc|`!K?wfDx7jRES*Q%eLgf>GfFLpq<<&=+;zCdIaolfwV3jj(rzwLdgs3#K26U$8J@Es8$xNw5yBLlVn25ml znudhppqNze-0g(IJ-aOTVVB}lylH?!Zm0$u5j_NDr5!(_20oX>bcpQQ#35#xozqd!IFS-HaDr>^!MUDJmZ@=xy04@>_6)wO0oqypTkjq`TQBVZcK~{%4-BY59Qd>eTK(#FgtD~hpzxV>JVcf!O{f&wl=@FC*`9m3oXwXcE zi4Vly30+_g?6?Ai0FCfxBileS5vmu(bq5nxXA}5gKAfQ@k*p>+m zfPy5g4^*6-r7Pi5{*h3F2f=0P&j~yJ=F?5hJ#B&`GDQ|A7rJ54tSJP^6FtHnLu%k| zoYZ+^S_~DmkEhql>;yEH1GvBz=F|0Kp4^0iL|nymczW)&bM+=6qKWJitCaR_U`0qJ z{>F`2BJ?%d>?N@|qQA=v&0l?6OPRzge4Kg5L7d)>{b>V!Ruo+&0`2SRTZYrd1V8XC~xpw;YlZ!t` z6mXQ6@m+|*(}-uwq<}g69uBNzU^7QMA3;|KQ}JdDt&+6>G$VlpXoTMdVTt#14wWHb zZ?Z1p`{5Pl*QP>iXrquW&px?I-LUvH^BQV!Gb>#u!|w(Fi2X- z_(C_}P`PC9!|r!m-a*LwfJi3Qu7c8rCZ5z1WEeLLm1M+$z$+1z=qC{A5r z#*EiPZDWyvo!LUBf<*-+zUiW9Db7YA+$HbL<&IpB9qjm zBpvFIeYP(%i`!n8`WQ75@f29qs!GMKtDyB5etf7^yh6#7WAbZy&23Ju!_C>-@V_lf z3xU*qnc!&i@+%Z!x>z5@?)T&dd& z;tCbbpe?S=Y1qJO*w{mBcPc&6CJ8ra!#e<;ubGN>8SuGTkZVcDMP%7Zruap^8e~Z& z_>tbMNpL6qv9yBwB?<5~LZ%SM23qr3*a0JZ5HX^+91Kl29Siaoqf5w^Yvkb1jAH z6?74lXbU`v{=f9EE$&M_KTUIOU$-Ga1Jy8<;&fLe`l0c5!}3*@*bn$o=TthfvP??y zK2D(yS~+Be>`;=F_~=dU%ek-|q$h`v+K<u?)G1Mf4EuAr97@ogyGPcM^w21xN~$vV<2()WUakBeH@!>oZ|ql z7@6>o>Gm=G|5p5ax^2c#%arRU-QVm`;KE(hsI>gc?NIim8Z&TPM@ZQ$9LQX_W8sQY z50d6=p&^P*78D`NXbO9-*P9$dGUO^WqtHgAabwNx`fc>?{gSSJ|7GYM)GJlFxs@~; z?`%A>Fl z$M|(|3rs?o?2e$uJ|TUfB7qs7soR~7-P1*m9Hn*zRSGw7Erh0%b?J4BeGd;0jWShB z54`YmddfCN&H!Vyqi~;Fvmd$N&C^usaGra%x?lftFZ`lG`*6nfT{+(KNmlYZ4J%ho zli4EHxztb`*;M--AJ~v8yVn18;t`{<-DJZ3S17L^r5Iw1o5C5BUtQk|M7RF)&l%en zVj%TsTz#zNG`WRBY#9+hP~-Qt=kxF4or592V0ws}H)FH#v6XPtH6u-V1vr=rWNgYx zc2ts?VliGn1t_4~JuZ0d_nsZ&iyw_I{|p_-8dsH)tS^1x3YE$?oL@c!n5&-cy_RLjT|b8Mbk?LStD+zsl!PF=3yuWUS}(Jla6}Tr z664QDW9MhC!+W_=OAdjr~|Mhe|p&c*I}1k~wgesN|JDC)2qHsjo%|oGGp7OY!SoFq7Z19I#;j0Renr`Q5w#`U_9AVwzks1LWufxiq{Q ze&Rg^ofUFh6T1$Rgl>`zk)Ye)VT&lRK2#&x$)gZH6Dcx`(|zpJP~^;&X3fqB)RLGV zKTJCG;>DmEczN3~@+Cu56pF?m8i7DXDA(Ml~wU9t2vi&nq>6lK1*Tg(TG@r7eXSv&7kl35?!+Q(2z?H<%hj`BC8#{D(8~b z@QCeZ0|RbdHIUDBm)#cw3Z`$afZG*fFh;i+{AUAMM5tX_NX4WMOJI{A@%KwM1$L=< zI2xY>6=WmIt{2!7$6wnc-Vln|Y(2X##wcNuj1Eh6ipIBbFJlymybDKkLjB79t5QT| zwmI+FKVPzq-$4zsB9On6Z>rw{$k-wh{6X{Mj^>Lgd$o0DoR(c?A);B7={X}fr5G&{5sMHdX6?OjKEzioTkrAt8+u|0ajEc(g4J^xNyTob)>o@ zsD*K&+roh+PN+px#X)9r=ZL?3?FEA@ZDF$fFs^fWfQaDCwV=2H^_mQ$XJt<<(869s z1wyj&!OWI0pY?XmSoh8!Cg15{6IL{+8ZT|OFhdrjC70`-zkV+3D~~ zL3}Whx}A?J@5vhz`SLUZ<}Bu^%$`fjnLlP1K&mZFOjs}3s@tNA6`&nlU)%T#83rG`}xB^iX#XNox<*yUw)4;1v4nwc!O^&+d_kx zg@DNvDmlL`tWdcsDycnR^{oFS{!vMZN74*6S4R*EQdf|V<4{v7mI>&!DyP*PIq{%8 zOYS@!+bry$%51n_8#EqVKSEohyM=HR>hc$m)dFQh#+!bu!bZPY!aJPf>s@fae>w37bTp#{Crdend4 zzQ`rre)_(cv*Q7J51{vJtQ2LsiKBKxRi&>CqV|+c^%IhaKRXQ6=-`sqmxa-@`=u)$ zMx0unx{+w+oK{M7 zZIncC2|AHt3e(8e&=@pFTu9MLZE{|Bw!T$BdI*z>NvH9|6t3_`t=SLlL3S2Re>kIc z5+pFBntS9R_WC`?qAZ(1&Kte>GI)&X3jqGu0VN`nkl$IkC@p8P=Q2ZWDo>IaVL6W~ zd3MUa?O&!DKLlaZu-de&ya?$_x0pcCJxic8fHSv^WCy$q)jZj)jgTVFl0VGPmK7cr zkyBQ2FhTvYOoBz$y`|jA6HGHyl!H7REb86p?>^1Bfk`9p+@BV9Q8KIP2!me!)qeLM zGe7(efspnzX9!$&jBB}WlhcE^KXQ5%9rvT@mJDEmbecog2m3L5$^`b(l4u-y6~Nu$ zTqK5X;>opcQh&tQS3`)6VI{c0b2}Y}F#EV*LKw^~9f8NK(Dz!sizd+Jr|pu;At1KO z=nQzj*yzdF+}S15X`Ked8dqQYGnrJ9Jh$bWS5Pbkd5(=~3IrTTAOeC{?5c)j{Bbu>;|STc>U< zlT5BAm?7-HZdR)hZU(>pm-V*$(jhTC#STJ z&?^2*zZnF?#laX-?b4h3Ju%F#{HV7 z3NPsBZtXtK8tD#tyS`oBfxxnq7?}HWCQ;j`y0d;6*Ny?RYg%EpGH=*jz~B;i3`E72 z+70irUJT4?G1UsXTfsjdP=J53A|IRo@1*jAD5F47CE*wZpsYrL+N8O%&pdg`R4sLZ>yD|F0d7w~4hkOHj+wbQKf19`2;+#PNS^XjzOvLOINq zqdXQ{Ert;wGW9vW*%=o#8$RniJcPs45v{-a5O&~SBB9g+UxLrq>crDI^xc|z-7V?N zQ^G#};IC;wKIu8RSrmOWk>F|q4QT0S7QZp;?3`+l3Xu~WcZsutVGlMD47bJAVBl6G znkGun4^1hhmM0PSB@^{aL1=>^)N|MNNxMgY!f(r(QL-`0tt=U8Cqyu_2qLCJQjZm@ zOJUKPrHwhW_zWOSQExPHt|khGS_De#K=>h2108wql@XPYH-%t6(c$`>S1M!h6d#vW6!c(>PzvoIj-f?=g?a z0<98WRq%2Ru1xa=ZRJm1m?&z z(xiA)yGSKjRO?^cSMV<`b#?O+vm&dX6a>p zkm~Ok)g6MEW3&$#dR@eGu!M$~AkiPk96wzxK0#{+-*X6)G~kE=!TzL2kl~<{n z5HoqqUef)ufltl6NlCe~!HajjSDhDvth>I7pYD4f*FXAZZ)BU+fIJg@fx98b_H6Mo zFVu+dR2-cEmdLpp-Gz!L)%z8FXU`6*wi-jTvY~;E;+N-{H0m+cRyZ>V!B{yQ6X9;Q zlUw7!mx2p2L*RCeqDf^&4yQnkxu4x1*l#3)@Ja*2k*R@0#8yJC3G9F_M|=uyn`jr*&|yjJ=7w zn>>-3Gi>30!uO5RTd7n!ZCAU=5|eE+=neIey_V;Cqz;MEQL0w#tuI0J&^_s{R65L4 zG-eJ<4}veezue1e;`-+nlA98jD6)0g2-<*RY+UEt5p$FPL&S4-xMG5F8dRK{zDZZX zn`|4oK9@LOQ;W1c#0Ib8%`lScNKfcVJAgTkw z{kJs)0$y97ZO5|_3=bTH)tDnBDH5U@TjMr+=Sfv6GgHXsI?Ldq2a^swWjqFCYxwNQ zI+(Az@0AQgcDoQ*GF^fodbC6LbzXsWrb{TH2 z303HDjeaE@Uadn2xNsg3*GFn&*ybY!UuHkv{^nE5;mm zk%cL9lEN*Lv00*50nY|b(#u`F%Am%!n)yH`{0^;GJSg#wO?p`kg__E)ZKdrb^zfjb z4sVYM3fErNC2X}N9=FJYg?c=W(ow1C>h%Fr8^SJJdYG4)^iFt{Res$ZZC)71dWji& z4yMktmTUFUUhXei7*U_UhKrzN9BbdMwnEZDNY4c7_lUCTaoVwLYUPpqNOSFCShk79 z5#5a&du}`6Rh62h`Qn9*4h#N35;H9R1(b9_2Dt2|Wfk9Y#uVLE!7^Wp#RY_b+Q{7a3Dj=Y0Qj9ja(M)`io(e zG$+`E6iP3wXsL9D1ZgIV!eI?PA&$A9n<)R6$8c<#D{x+2T89<379LW7yvFv_P2XIY zYnpr!9tV7EnwLjlj4WqZOfQX!6md_uQ-q4&?y$WRSaFC|Op z!f0Deyy+yu=+y^thz>E+RluO9M#Y}Bw~b1G3zZ3(u4ELLI5a^nd5{*=Xn$*L)O%@~ zQYlzDi5^a-kKVbR>6zZp=pMw4usOzv>jmbL%_7;Ig~@Rg{)`zyKHowK>!0wbaz9W; zjST~lek+49ZLhULI0~*TYZY+`%35X!g11#4yUAYfFq61=y`Iy^qUF`7MEPb!&YaUX zXQ{ny<&ixZlu|%=K^m`lsp-1K5e|q*N*k3nfb)}+8{)SpzW05Oi09t|yT0Y9p~htW zTwz9B!FcS$YUzzb#^^)F@GQ{C;^Gjvh)r}}$e{OAs>iRT8$u!D1veWL5v%#pcsWpzzR9?k za>&ZnCI2fS_SHR3p^}6#ZdT}|!b_j8>Z9DJV_~4ObPe)_>rIQN=qv7vB8FbzgzLr6 z0%h`8fOLx`MN4aGbt@J&`s+B!HLHyi*9IK)K{!|u;E;_CHHGKRU)#q?JG^qGD zM1d#E3dCe(1;0U?lwbO2m?}d^M-AQ^hnhA0o1s(mc$Ww3;Fxhlh1+uCb$=MmAiD|} zsWaKj$R9>d=#iLiW%C67^|1`Jz+kXoOrx+0c?z z2ru(MC)|5lTvl(N(nyP2I(F%hR3+FWWu{*(0{qpxpkBT^6k2d&?r`xTa@*u_{c!FDfgzXzAk`)&R5)l5WAY0?a^V5 zK7oC0!ISO80$B?`epl=eo)JB9d7|lQ6wHL%+ir;N*Tsly#%dB1Dp8|tMe+|P{PYQ> z;t9PlqRJPp*|rI*Qq++q$1q-`oXy-iCew*{gs2U1c4h1UlkgSo77cmyzgP<2Y=A2* zep1V{fDQZhHVZ2;=%Ufbcx#W&GW+Y#y_i3vPo%B2)-RKJG1K;!-yVbyaRtHu)Y0}2 z$5Z`A^T?P}1z;Z=HJK}@OokA=q>W>iZ62P` z@!MOg5;w8L#Jb-o%@YoPqb<>oz!cN1Kt)HB!{w;lOM>Hqd9vdfnqj*`BJn^eO%SB` z^ZkTrrT}DBn&r7oGnRSjs>`IfDZJ)L&qp<kgw$U&V$-4rO9qOEpcrMdXso)I%e@lK!_0fxB6Rjk_3&uuQ&MaJ2?SoPlfyv6ig z&WsYVf|i6{73r1zEte?-P0LMGf50}2t+Xx0nU82~_MJQe@BCGH+mD;-={U)77m{zR zZ~_%XJ4C=U4Swi_#f(G@bO@)BF4;3DRB8<6^%am%k(T``-H!z&tl$4!{ih#@|JI!` zrko>sBp?$~An$s4@19!v#tC4&>6}XFstSbt4^H0OF3%W=#zAwAwV2rh-Fnw61TJWg zE@&{;oc=>(Qy?YIGo^tV4)f)|4d#kpp$WW)z@bhZHYgDvR5@3ZZQ$jx5I%;(Xn^>f zsXcUzAT{zwzq%4wgBE)@q?_?8`oWY3tiTExVwR*C(jp?kg_Ulqz_A{VRbt>d`-%jB zcke+ZL>bpT`W@X>Z8;9o0ZlCAfT`-L7>8MrMyV&pSk$(2Uu1cb%kZ=TuB*&wX1~8u zwy?}s!knJ-5YxD5+UmY~{gSlo&_ru#uIhJ~lI5`1Ff#-WX7KhxM}bR#E}Zg+v_?s@ z`{8ch#7 zb^^z{B|86e#0Y;02~EGXYjp1GB;uboFp+1Ola zXgwp|8U8J6HNWJM(jd|EZ^gXq*S1#;4bTs|2y^1EnpML6H;Zg7=}pFQ1b+ya8skf@N%tmF+-Gx8Ax z1kBODQAQv=Hkm09v6q}0yCmp>3tGEw$CAK={U$VC1@Qr|AH9hFrUiuHE3{zB2V${D zDSESdDz0Nj4N-v2-8{2$@WwU(MNTx>{ouM>{7=uD30Hvu2?erl!H1xUIpPC2T@vqG z$nZCR*>t^{SA|m3Vzv? z!X(zbT3x|y4>$Q&l-_7r0RJNphM7J7>!eK@ot82| zjS<{h=0OoItL8-MW0_8NmpK&4seRQ3P(ptc4G!yiV zY&r(q00NLfEP46c4Z@S+mJ94+oL1f|+>rVV-!6_llasmoDQjVM`fnuy_N3NJH<1|K zmiMF^abPAPo%7IGVI3Noj*nlfgC{JWs$vTl>%I~-ka*?1_C^2WNri)kTFoG0RrDC{ z?`RlL8$$E{qMSH82h`J^lzgk}NtZp0+^4y|-BEnIWBPN))aGkXJzeY-f3s5rN@DU5 z893|L^)PmJ4)fL-8yrE+}VoZjts^woZs4< zG1LN0@sV#t!~F=@NThRzqindfr&hS{F^b>+yK4o zxkV)~L49@JKNq($lwcxDHpJ8zI|!WG_c~?+m}NeH_6U45axq+dk{sM$ix+j=(Ta;&^ z=YN6qRXhe;mp#==dFq}@KkGIw2C6Q4S6b_AYaewldjIx#cX-5IT-bEQ3-sY<5C={a zp1Feb9sCXOrmM#@(};ukxoONoc$pbfHg>I56jE*vh%^vCoe{aTr{M$jNcDb`_bhSu zetE^+f4&)f<|h6`x2)x(qvyo*#DHN33o94;&o(2)WRy^7!XO`VK)Ed!TIeXf;!EwM zl)IH-8h9s)8TBQ>oAsS>M?@0V0W&TO2zU_>$`bnr(yVNKl|jBE7PfZrijD_SuX8|6 zkqslDl6J4qCWPMh>{6OD+k{eDs|Z|q@~$D^xvHzLLpc(8{9@JAq9ymOZ)LZu}=jLIDvaOf?!X@ z7la&~Fn~gr*^UA0Kd)+0ZHa9hd`Ez!T9}#q!!46yEW@`eDfbsGb>hG;4soo}Ls4SD zrFno8@uHxpNB-N{&wsXeUJ?RS({26nz{Ct)0DHfwR{+t(r|4MNJ(Sq9U9HzcK5;xG zXgR;M(Iw(oFi$w_@&4?e>#1d?A$6p~vSpa`axw-YmYyna`RgA^B^0wmf=J0Uf^&+N ze8b2Rz;Uj`_HWs6g{I#Oty)f7k9FSZ*}cQm-^y}F-DX;WW0$$#R3Z)yQqBKGV<%&PZO8xFJ0Emtp*DYbHKOlAHxgqWle54SmRxFF*_*SU}LJ^bYZ5v`HpTM94HdBd6$SPJWD5OG;4RhR_Vcd;KTp^2vW>wzl;vdCRtd7;( zGMO{_QWM0Bs_Bt!gmQ>ULt*VY*Z#!_VjhRLm6%y;auS^+7s1FFT@!67trE%<2vc z4LqbMf7Cn?+GL%nr|(lBWb@0{e3w$u=ABR*ZP*L%kKC@>iKz{;OK2+Kb(^639Hd)1 zlQ-TN81x%vgi>k~vTpfZAKL z`ZJUYrfhx>V|!WC@ADBAI7Pp8FfIspCL=BX_MG00=kBM%n_=6=X8zK%OoR*5+c{LX z+2tQ!$#Xy`w7tIB5aRyU%3WN8yfG#MDTjG1ktX@9+_#F-!p=nIM;CQxkcH&>GMtU4 z|GfM?yyM83qah{uKf@V0F{KHrEpTk%YG_&&n7RQXE}0M~;M|cILxmcoD4`FO#~5ip z9_0dj1FeG5Xbx(G#6agDQWwRa0(xyMVmJM6Qk~${5UL2gpPv>o@G9L6U5n|gzln8l z4kYw4Jjm*U+#b}dSb#qTRcWpBQaj!Cy`dMWPT*W1f3OJMdXimJPW&kS4#V#W8hlWM zpt|5otgsp4^AaR7#YAk8vhe91iiE8o{&x+>z*&vubgF3@r6elLn71{gyw~)v?Rn-8 z)n^jt1)q5X_4t#s9W(>^6rMrZ_(2VBDR^X-9%gGyRQIHI-|O<1XE0vlUXfw?%pwh> zC5W(W^$n7xD^+hr&F_oT5W z%I;8wSpDp#sYH-fv?@#Dps|Bz`yJ&ZVrj%+r3eV{Bok3chRS?MT`eid3_lq$bd`(U zMFGZL*#*BDqG0nfKGP? z)e0_4_XKZg_-YcP-86-!n#m=qo-@IFXDzOT{@o`2wF-aZDYm*^_0ZZ_38!(Mq?Yw6 zUMBtbm9s2s8~>Nt_H6RZUvR3a`@~Q0hfdq+ys0bn!sO_AHNHvx4iXzaA}0?kG|c>< z-UJ!_RQ_C_;YutFQjWvN?wd`5T$6^fB;s!>`YE;ev44B61L}Xc$SEA_*QO-i2*<6W zFzzAey(t{S*`2)zd&B}XK;AQwmJok~nbf4zpD=?TYhOyTFI8~&e=?ce5i=_*F$8H0 zSyEeXGCRN6@IW^rgEq^N3-Cn$LyGK?!v&qhHG8Y8BZAhZOsweAxtx0A=Rq8WZdIlG zxt(ONW+Rkck+1c)p-jk4zntLaiT0n={^k~N)Am)S98uJIcOMY3VkSUJ@2yo3 z{+{c0OL4hti}ZDuPdzau`8bs}t)nfV$7{U#d2gh3KRlnkoS|;a73flv&`*cb1&S}& zPUH5vgnTYQt{zZ20m&d01+GVEV8~|-qqUAC2r`l7}=b*G5em!~KfW5eT z(cw7D87TK?VO|`O_0piAL`d-ds@8-~fb&ySfc&kIiO1^Uv=@EeRBUr}^PSNBO~#Fs zq(*d{ZBI0wZgoJ?MsMEj5p;;95Qg#nx@&@#gie%F7wP}ae!eSDD9V%RrvrYwu8fKf z``7(1 zi~^fZ1s;Xabdax%>}JO@#Vci&zl5ATy|?jqXF&-RMy;9((X7{=_1|T$i-{jA<||u6 zLUI44ti}G3iLQgAV@84a>OuaJ?TigbllV^YjyLNAQ*x9ZW>Xq`GEdP>)rQAw0yE3N(VW zbZ^d|PtM3kln78WQc!>G`ibHbvsR)$?6m~rl9^}C=Q{L+=XsHvoDdJYQJ+@ZIEAhp zDIE^O&RRNNQHpwbL$Dc(yF`CfHzDw!cKzjz+AfXDP0OIdAnGd{Uyhl2>2)ZoDsPAq zE-{RRbQfo9eFw{EE)GpgjXAMvV(M`d&>DGgX(Bd$(gtK^jdOCtjTM6Xf!cwi2B7O) znPROv342RGCr_7^&fgSFVZ7SIZ9m;CMZV0zWPbPjUr@P^-#`VbcE@HIB5)=(bZY9G7oK}Hs~0J*B|wgXh(Hn1 z4tYiO?+a(u@jpM`Prw=XN{@Ryh{K$Lts1|tT-k%%l$KS;Qur`LkhwaLi1Q9aa`D=+ z%!XH@M;f=-EePXris3WMa7iUoY4)?G#-n=$Nvzw3xk049;GE0()ph>P^lx{FU_>|I z7I`v32pi3jK`8AukB2Z5nJBgMbXKS}3c4~3Ex6F4Gp2e;7 zU!XITQu(jt`~-Sy_vMj<#Nur*CQXl;qt#%cW0e)@TPvmFjA^F>&=kl=OcnS%MB+6R zdhLi!7(v}n)?yUY@rlGMGKXb6d+L%}}eAOW27Sg+VM^kF<+g1`F=x zF~7l-n{JjdNSNY>Hn(AxiP|5I0{@WCldX-K70HqTN9E>JgO+=eqe_f{=nCW4Ff&Uo z)NSZnmPBki$PCT&Q>pHjY5>-NP+Vu1jey8=*mMguY7TSYPPDtlG-1X@d_8xRCO6JC ztu%QHeG`#T5OTBle8Amvi_#RY0K9kr7XJzo-vxVX4Skppo`V1UH+VRJ7guD{_CX9| zqz?{3=P(`kE$V%WM8x(RWIdqK{;0M>Hm1cywsXl)w0da2hn(C1!|b#tZ1qLgG~}CO zBd;J`e3Ko9-nFMs!diL_$8?gsoh9`Vb^oP!B#(C-mrU9~ia0?tv>B~X#1}~a{>xY( z9Q^py_Sclqo)L*%j=>&%Ay>8jMmoq%abo6SgNe%*c$#WV^27UVWT?foR5wgktA5^H z9ql;1Vwz$6mXG(Z%M=e3%6*lj-qRL=Ief|Zx-X!7^5Ha#cszM?(83b*OSak*7}Aw6 zzo@wDC%kwcxA_GW#KT2{0Ip?85e7=ws2r-OxTSbHnKUhPVhC(#cw|3X28VTze2 zS7ke2*lF)iM|w6gfxg3`7AD^{gk&-j$`xE-MCn5ip@PvcVM2n@L@2?KmR;qfd&HQl z%$T8_Qfgdt%>9pbHglL<&iv<(a+p$w=D1}Qi4+Xmmd8V{VBx~%J=rFB?ous&#VbC! z1@UZdpx&A$Z*BXPSq?qigggiJO!Y}`D_Zf5}pS4|R zd`yvNzJ(_38+M|dE*(D?#xT$RKQx_#cbwh(^<&#M8>>-c+qP{rMkkHYXfmr^w)5v*Tv9!SF{2$SfZORO996W!ioukUes}%V4kZ$BDLdRx z6Cs}ero%Z0G2#}=-2dFTSx~VU&q=ctD{AC_OaIIMJ8>&Wy>an)I4#vPx-b9h@S;zy z-EWH@T?NO}yWSl8?Bn7&9owY2*qe~km!pHwqIFa~=Ytkmh-|OL0@nIgxC_Vcv7KwO zWJ84%cLR;3keqNSV6TVNdm56uK!GESyYE=894I(4)LQI!z86}+yd3Tc7#Htd%2EVB zMVIo42>ouEMAe9$ zi~~)OAe(v;y|~4bcXW`+%&;q&_q~0iWVcdj^yI4}0!kE5X=0{j?yh)>I^@-DUy`BWaB+p(zo6!jnZbiXRbTN1orhx_n-pqK**lLB*0ryP&wyX{_PH zW#;)vbxE%7Y@!ndyCDY)j+(lyNPgHT_;`bwe)7@&OYisIKO*U6`WTu^=9I66!rjuc^JSyLRxt;cF0?z$RDrA- zd=S!8MR(0U4dO-mGl6Qfc#OlWw?{`1xd*X2)F(HUL-$%nI+^GudayO%KKgkIt`2hbkXWS!Nn|3es0}J;6;0zsho9 zq&sxUw4s6vFENSuQoq@+iW?pN9Se&b4Y~p;89M9l96Ta=^E1x33yb%Aut69;294|; z6s79KeX>T8Q`UIG_s5B-ZKDfkl}11J*HeP`zrXR)%FQ6P3Xk91?X_~$n{Uyngw7Qs zJ&Pnb{oEtZGk`ju(@EpP{4nqk&u4#G3|S=-?3YU++qh?`b^(-rhL4SytIAlY&HXU z&sd~w_aIY&o0xC_L_nBVK?;w+*g^WQ*sty%Myk}atr3MGXl2?!Q+BM#LE;qNjKYh)J;^F1dkOO+4goS?oc*(KP~PGA~InjEL6m@x4aTR<8P2( z;iZs2u4?~l5Fr|bBi@cIfD4f+xH0*Jq~EKJ?=@;rxI@Bwzwjw@iKK7kuiPASVea>; z5TS*uz2%AfIiNC$Py?=algSg{;Ev}x zN$|QQJwfe|V(`)0hzf^w7ShKi=5t$?VlJMVA#Lyudj+?zimJ+gx*3~Uo0_>|pt6jV z(uvmR3qS?l+heiLCMW18eqpnF*;R%BHSy!-I7jab0MLQ%MGvc9z=H+GMe2Qm!49Lc z4rfNvhdrmb%N%}rnSTEQ{s)!k%#-&3M`InqX|jC?shqjae_hFM9 zuKAK^nQhlo^L{#t3{~FoV4|bl>u_c|CmXsq%Erlp=k+(cnCSIitJ_2d^jJFOg=kN3 z)&8Q#v0$50kJu$+IMb|>-`h1bo9VlQ>^1}#A;u?2+-zrK8Ia4i!?o{Z_H5XK;%g~p zB*LHmGC`1MMD9q|Xqbo1E*x*@mq>D1yns*E2nN%o-j&s^SSsrKg;dTz*OgVRDIHP! zWoFv8NzjRzU{LrJL+n+(e~o$%epr)e{^Se)Rzx>I1UE4f5pOpz&W!qGK!oiKbQRck0FMC{lLBBQqJA z$L)bW{As*1=kWL{=~+ejw`t|>P=HfOo(IkJyKyx2M27&X5qp}tYdWump*lh#`nCV0 zZOrW$1vH@DzOliEL6t!vg(d#$JG_F_I5>m)Y8g1;@Xn(PT0%Q5Ve2O!N1b{_Fmj>k zp%tM@4ZP!w*1_eerXy=&19a4?dHDet? zi;Xv2m_djmz;fS1BQS+2)-WC^a$3+>v>5X;^W~B6Z{o=|N&no8R@?f|)agkgeY$^8GnbKLEY<7@!cc68XKTMfIQ%Q)pf3 zL%HW;c`54AWu#8sr)pUeQ3&-}>A4vqRm&Ahx6ZTIS$d`bG?GqEA%O|*#rpP%gvPOd-CTee5M)xzxA2hB%L$47-XA+E4Q|o2+^OFRAl_tkWnlqdo z+aL?E?HpoCMdRe%b>!&S@B3)SRUI6@b3DpX`PQ6@g1kG|4h&Z>$|!kU6J(>_fcPDy3Kr9lf>v94VkZt93Yk=vk^n21dHY zkxZe+B*(&6iMH9&XrNCFMsT$~4m}^rjv2i-1Kyuvd*Fl>?908^XaC ziBw`H@7RM(U2uSdVXF^OVwAYAD~bNmL_7?J9jA*7L|SQNdK^$t_Wo8>+=PlN*R3si z9`^eJaZ;I=jJGrAD=0HZ{i~=ZSBR$QJ(oZwfl{g>270o!Y8aBrI86}unC4Kx!uX>l z3GIN3E8QNawT>@I-@*bCduRTSLvgFhsnKGQN?-op{PPpV0>8GK5L9?BJ;Ytw4V(ld zspc)ESzwH1XA5&Uqa+A&n~?JV|*mBI4!Zp@;L3R^gWhjV)0Y%jg4CqfU;w5lh8 zs^_^o;_mXloE$3ndqjP8gdQetE7E$}|CF(g(blnMSlpqdP}-=)DPr0B?L}JYki*!n z7ex1kr`VxWBMLIma8bnXccF{Qc(01{^~G7SFiF3p-;;zzpGvli6i@TZ$hA*jxeF0C z7$FT3>1ff589L}=?sJl14tW!nWld{_XK1#x_2*0)B_!dRQMq(vc3kJvJp>8MNedu8 zl{^A-c5N|F}ZJxqD5)`9lcWIwAkqkMg{e8(hp7y z(`~0hBRAQC%vEu@niDDd$FdJH+V_Vq1#xAi%?_EYTa^e*xF-qp+5uQUxaOMT{Tv8; z%W|o=(!KxFmSqV4aU%dyEi1$&&ZklUD)AP_eg%0Yv)w@f3}NaMan5p~#1f(tk*0$q z`;1VUVGuDJ9jb(TE`6a#&)GuB6}bB|vgn9?=t;~7$Gl8&>G4909RG6U{@VV$Je&JP z)g&`jr;fa_ZPhCtr&5+Q64LC`I~di4(xtl?{J{4UKe~n` zH|HTBCutzU5D0;oik)uo@sZ3!=f1n=c(R|=4j}@oS?W`);=`1HTP_#tb^3+L4!-H% zp-h#cHO!+iFPNOoLm(RGZNcpO1)YMa9~^PYrd`{9ijwmv;=|D8Z(j5ccUr_uT<0BB zP`o88My)T4ATg(P!>5GXc)?UiNfK`xA_X?H^>v zH~#Xm%m#7?=yXYhKnQ?O3l&;mfU~I=P9USIMT2A#@*c)rKW0e%1CUc;Ed5Vb_sKr` zw(%|+_#zznuv9bo*a6-`ZvVsQaIuIAG^QDCl2-r|V}!v6eMe$a5{t@+D#Y%XhxG(b z9M4$}R@@Q{^ZhZl;(+P}c$DZ(<`7PFjnBsQo+-BE?Bzq_+89AZSSy6>t0B*!#50(1 zVduI1wTF+q2N~H8wlj=7QWb_kgh}?K6vZvpwIa8F+t%k6Z(9eL$4?*3m~Q4pToO(~ zS6lFpDMIc;m-f;;`tAjP(c{t@dXvoL4PQ}T^3GtffxrP@LJj%E0_%#IE}Ww(H^3TZ z*&hRJCCZF@17^XJ>$yt^?%62p6ohl^BDji{sZ`9liVB4QRx{fL$0|R(@o}ae)Lqj`EMSdbPLKYN^!J~}pfDT1^%WdH%F>_BhF=W}cRu8F z(H$87M=0Kr&2hvrk&J5>0EQ+#!y*Slz1++ar`*Yx5n>DDY<>@|arUy>vv+7DQ#hJq!(Y&FgP=p08Nw4k%jw+Mc!^S2jb7a3w&@{XP07D!-jt zpPg$myqnkgX;>I`jSwpF;gQ0?o5kFlsJjBD8Yvo?WuOfI5mr-R$^tG&J^dSzk2bt7 z7FkxRp8|59P3@)nv@O(artf$Nz=M3S`-fng$*_}KQn&;1?6?;ORbJj_oJV#c^-U)n ztKI78Z_i%3j;&yb^67$*b+^b+^T2Urj9;RE^=Lmn$b~^70PD}{*W^m}6tGjj>&`&N zU%FjO1a#dCgOQ0ZYP`mW3BD8)tcd$bE)GrQk8+eO=LMC5Tv>uN!F}Pupa9Iw(O_ws zRVI29cz~tBI)$y`uGgdZx63hLFgLLR51@V7Y0Rc@Er?X_qOGS_RYhn~(@~q!H)H*Q zP*IQk0&QT&@fCoPUet+JNydb~30v*j@DL;ICywSj8sVC@Iawfso%S z3h`XLabscpRCzvjuF1Em_CS>m=HfuF3S7s<_Qt^|Yv77n>ZB!CP*09W{HZh=j>P>4 z*276I%4CmeXH7r`{CZTpEd}DMc(kW&Uo(``i? zAyJ@0nm8C%#?%CNzTA46HmVG2O9AAlD8~SpiGW2#=k;t;0YHpK^iPgmPWr96zHuFsp=#LJ>O-4)!SJdK@%vT#O6SQF+>gPNhg1JrsF4RVyL4)M~W=5 za_wG7EX2{7bcN|C55FEOB+hr^T|k{gY)<^$QwpV0xFZ7ls zIei@Rq_dIDFS{^OQ1C%ic@#R71jjyat;x~c-fVT*`5DD;0N`^;?KFF*96thE-n zop>JlNqSr1jDidpT1Zyx<7gwXFT~O&T8{cv$fCB7+p`?+nvwhe+>HEr6#!@&WPyP$ zUe%cE_n4LQr8aOa&9f;aRfRBr7`$v2$QbYKfxw zsa$CHO+M^gJ87csP_4Fb4|Bk7t-L3iIj==0a>AO^bbZq;w8(@X@5?DucZP3VA}508 zgu6YbY3({-i$RYs8f7X_tO}i+o0hPP)E7T7`boD)&39N($=~`?W)6YbN?X)o$#3SJ zRQ`V!z}pPwYcjtuh>8|vidO#9EL}H=jyhirV#5>!^U};9eSCF!tK{E({ zBWb`ZKFlUDKb1ytr~A^UuIELSr#Vw=iaO^%TN0IWp<>6#n1$WDj1r~1&Ky(Hic?=2^;6tr{f35h#WM3pdL&?2$0mk(N?+I{CHzAdDb z^y7t2ycy=eT)*^f-9vk|+!{TE1phdVp7&pyPJg_oz&5XWHjeZ?n1(zZ@T1DLs&4KR zhY3SPl2S2{5zGIEV>i5cc<^Gzx@bere!)5A)qp2<&=T8&td|#xDGuyvD{NHBlmD{O zn0O*L>XLm`EYG)xj!^yL$P`oe4^wZuGnB>s!`=9vK&?_?^MfwSu+-ELAN&kp5VQ%4 zH${m+2uYmIJV;L0rYGpuL+@nv*gw$e?fOQ=Y6?qDlYPUJ|D-Ioe&NY`RjNW|l@_?) zoin?7L^ zGH4(e8nBD-Vw~M9+D1fh^5MwVLhOhm;Qox-M?O94_@AuLa6_}a)=$t#ru$RVc#k< z?w8;KcI!)hh*3wGZ|j<)7xtMKAo(Huk?#ZO0oyGS_g>l&j#~1ve!WEpF$iZL{>4|X zKffA2{(|g-L@UY-q#V_7O~gZHDPbVclBjo~vMLAiPoeRyQEuRPG z77mZeETH{@@$9u23z1cMyfWQpM|kU{5A!7qQ~wLYf{07=;XgsR=3Pca_qhp5-Q)6> zML@meY@Roc*7BkaN9W&^r?a}=w~s@nTD$Q55HcSmI!*kD@(gL(x|#CVmdmS`6pKsD zduvX|t^8u1@-heP*+(0bQqvF2sfbIQ835%KijKJ}enu>y*XuVIG70#3vU6r~6`&X7 zNN)NBMWg%WJOy*`>xefxiBT5X-h~&OQ?G#|4OD&=x(zFf6_6Q)+zrFEoPr>~veVLGoj4}jT+$t|?!)6|V}ou4_x}zx&&Tvf2S_#qbdU*JtexHB_3v@gMitm?fn$IFF%t3@fk!i zNre1eIhZN`{1Dk~6H?JUJ&7cTF$Kh{!_Lzec+~Yum%fV3kRu@oxpS_T7ST>9_L8Vp ztfi9u=?ah`LcxX26(=qd?DO}9v7pXf3RC8Yl#H&J*-qiq6FfHuW-_8jfEUIH<`*<2 z%hiUjA26*A5$~CAc7a|LBGp>*Ws?JPRi+%@ZX*SQA877%n9^vZ%v04_z&l@Fvr2ML zzS)@~2rX#RxF?>}?z>1i5NhwwADH&!>WN~aAAh*q?>8XI?*hUgvho%wL?}aE3U8>&hWYjB5FfBq~YC7e`ei;Ub{oTO~ef&=9dOe3f z2q;u$X{j~ZIMo$JeE7i?sVGladz0X9C;T5O9V1sa?K1?&ehe|rleuten*m7T|Es=$ z#{Aj`vDrPq%9aqmZZG$4zC8|$UAibenwqIh0blNkmmo9l`-dI+?1$^VyJ&76x2eyf zj@j#}o(G<4`c@FA;2C1+6(zBxzt zy(VQIyRfPJD#GEK8)P8n_ovrPWG0*oPqnHV)O`m0De6Jia#8d%=Hc0b@Z=w(@(BbI zeXRLB;sYV!m+w4cPpM)tuG~(G3tzaxxlCxj*TqnbJ%B-tl|BGl}aer#VBq6-b7B~L4xUnzL;Sa zyc5TR+%5i7(@u5W|8VmkrQNLIQM0_?Kf1)8A!hSxzXm|g=3F>6>Fa%Lyy)VUSK9nt7Mf>`@7SuVs!wIUP8gmEbAWpwy!`onX09`$Gs z14m!KtZ;)5X%Faq8SfQHt~vH;agPRACdRXIY+y5ro+Z%!AlA83Yh2H!^WUt%WLtl|N{%**D_&tnkt zsx!t_spBX|>842|If?q3Y~a8Mmb>=Bg^Q~f=?><*Bu?Je%W~3dW;SjV)Z4O_jnsEN z2Hkz|3MZM3WO^wkxcr{daxLAB#$|*~6 z?oC1+k+4ew5r%wN0+lmDBmw2~GyzwETjRT96V|if{df*Z&;;pS{s2xK=fK@eRS`$v z%J@fu$t_O>x9f()HI`2qA~EZBaEYDjw3TVd0t=D(svp@@hN-fUga0n3I% zlGq?po44~{Q`S|#Y|fAB>zH5;F*YM1avc%fHb_I5*GL`Pp zyM!ZWX0XG;BWo;!>;}BiR%r`ca2JpJp&jS2@SBS_;sg}c-8p)E2&6e794`z+^H-}Gj8?L}5P;0I=*!`@UPZ0fx_u#wH7N>BoGY+#td$E zdQ!xNudKMh+XZnZT;;58rdk0`Zm8cN?t1^>K>*((Kd9Rg6NbLf>ysFLEFEL+69Wom z=hb5H=yVR|Yp~N`#*AS4C+-XJml9o7=Zwv3qkkf_7mYsIavacc-D$T=_OX8?bboQ= zX-xa$xSQXW7^{R@F0Ki#q(R zkP(Q<|2tQe*tamKpvWpRO%?1}`aHB7vItbCrm)bpFDoftJ07m4lM(}s>f~u9GWld7 z9b>>9AGMq-2-Bk#^7$k5$ClTK542s+V?mX=WgEUeLxf6Bv3?+{;JnwsHGR}S_i$Sw z7bZ9X+Hk|gb@dsZ2pH;Z?nEV$mIKJb4)vAMv29vJzkc^Gt)0XtDxe)cELpDcjl^e$ zXu$&F0C8)ZI(Dqsu&hGrN4mRN+CCjk`vU%nwwUPonUCnibNdB zTEVT(eF)PtRiXcoGts$K%K4s0#B$)MHw`f ziy6i7DYp}}rtZ-I(lP=HXrAIla9(cG-Ru$JR4slP)SjUy_IOh?<#MSu@UU-D#(F#~ z`3uIqn|Hj}KmAv&wsxmgbKG-wi($;`V=}dS5tLeZ`VF9kAnW-OKR|qB+jKx1en{=l zZLG6rl=rf~<{h7}Uoiz>-=CEQptb6S#kv1xbCM_pToWIKqTICytk7qr;*DwAIl=a) zrZ6P8Zd_$C1tVlI=n3T^r@V12K1JX=W{(e-s+*W~fo zv(0&RZdep{iw{3BxM>Y)S`gMkcS8y*48|B?oOg!<`*G<%yon)V}}-L zLE4s5gfzQMNt%yURjkhhp+{o?CG~p_aVzq*VEt0bc`AJk3yQ~a&euCmVqu5^U*inojM%I6krtwYUGvjvo!=HGMhY;;av;JZpoMAv z_Zb*I70yecA02~M8rp|}BrA7)K~}9*s~0@4W$&+d7A~@ZJz*r>E-Ai0ig~E{t{Mf4 zC!~-LM?y1a;FhE50c9ghvyUp+VOo)}r1)-dQoU#4D4Wjv6>4vBG)nAcM-=s6%6CQ) z!GTd(167>79pU&BtF1rl1bcLoHXv4z>dz0}kBH9S>WvB*F9UXQPuuljf`^$Kbdk_3 zs2X?`F1fca*ypuQhdM!gVqWpfo(hhN&YnHBcB8~Qr9p}rmd6$uIRY%)NA952IpHiI zpc7th(Y5{N=pMvI7Ma41&25#%H=pGUH)l44<4T6B?<*FC)nbz9fuKvdL$;^hT1d_S zD-MSRi>DYt4e{xfKU)En>P6$*PdZVfOsfXWwl7LM3{jNI_mEEg#G3~jK(`rvVv1pO@fo9oO! z?9ul=^zG>=sl5ijxcR5#GDs$8*E_sMrJDN_pdh!@1V>I**;R_ZMyIn7UH8I7X?M`b zw5RA@#tC=Vy~XIST|6O&+L6B2(cJXJf9hJ~CR^-4q3MLOsCHr)#mD?l(z+;Hf{XhG zN!?2)lCrZNvMwi%y!6fN*;AA6E_GHpA7Z4{mo_reL_ z#Lf>y1Z)3;&o{l3IU*IqK3XibDmJz(UDzJWgd=&Cyo)0aQ6GH`+X~{uRffIO3hu#O z6ITm3O4%r*aceFz5(vVu6NtIGrHTu#@O38tUf}M1D7*SNFm1fc$S}Qlt**sAkNqoe zb63Y{v2@%9s8QthVtvRR?o~U#(x@qWF`$wO=hZIX>Rhp1KG=zYGX4RmiT zf>g5*$p65JQ&4!B{X7_Z+rEy&$oOFsA03G)d?KHS z$Ns=y%mPhAU{Tw=QY2N#4@UxLXQm6EDO%Ad+}KfS=&D(UXIC@!G9}B+ay%Z#rBoDo z<3xk5x*9a5pUfLX9V3Z1Dh$H}L@RqBuSFHHUU=IPJnjIHvzGu7I%BH-p*slLt4_(v z(b7oeHR-Wj?DZt1WS(qZXu#z5L9>|)6??VQK^b%Q4$!FOo3G)hiw=WlR8ms& zo7rei^`j$(^1q(tnq`Jgj$BAYlE_;PALWmJ6>2iUszt}E)u&7|VAQ2M!U>Xaf3Dh! zv{;?}^cqfHg5dHtJ_W(iiX}yZ`)#)D-@FuNS(v1)Q2Og~{=pWp^X*iLcr}olHax$# z&ahtg(#OkyUuh~f;v|E9%sJFaJ~F~%1}+c0)R8lkji*qhQo{t{wgnLOy^D1MUy3gx z2a%Gs|Km3Sx8e#|<5`(3IkgPZfaruD%2P`c6IbyZyXSK+@1y0uMA&{uu{ha}EQvHL z@f9vU4~BZ@8)hHTAuUX9{zN!e8n>dm*L+#nzqk*zBlkuLaj#_pdgKnwPz2?P0}wHI z62x(b$d;9+I}W|}IC;r|P4rf!L}vW91ZCxK2tb}17?XnJP%8#FH_l>UuwGD}dj_{8 zX{VB99W$Mq(l2@!1ViQ!y9LGk=k9%j`^IGs1i;G)>^OUNj9{NUcPjwY5 zkV{GnG@ln~Pb`k&9A2;`gc5|n)$kM&DGBc;<%Qr!=wSjXHaN4BdmrO^|(eHA2w!h*myXg+8f;V-BN(br|Ti9=l&BV zY%hL}LkR=JYSL$xL&yJL%QvIW5%_I=xI|O^dlM{iP?v6&K~z9q2Yh7KG2D+Yv)J>h z1yjUrNr%YOC*E)+^QDqupM^_JoBU(Nc`Q;$H;nAKQI4tGwD``PHDq|`Vf+eu$4xF_ zdd`*yGTBEt*~o4KX7>ss^+?DVn517IbWV=8d`g!C91EdmN|Q9G`-boezRpaLtKJy} zZCsD>l?GxnpyGh74$1zn`SLsl#zLHUCppSW>o5^P3*(*vEkOle-@MB!YG+s`5Bo{q&yQx^ze|IbpCZJCf@-U+0v;}(q~chJy^sr zHu|(idQ!ttJgOeZ<*t;|^zn;ibQzrHGQEaA3`=_}7}iDXo$+Xj7{?Oq^SKXarD`yN z-i7L~M=qpYFWINsgkrW&FEK?CDPUXv?N`AtKnz8K1k*{y;jbbPq`T|YhD#b=pVz9* zCD#^=U4Qsa{JNlIRw+QxG8Z$|nr2TwgpMfP4l^i73CA%o=tly3uWI!#salKP=Y>O4 z$ftj&L{j#Uk1NZN*Me68aH)K!*iW7D*#}lGhP{*}>kUA9u&#f@bNEyRG9t+HX3mLL z=4j>8h!?Z|E-E-^ZLVoY#+A@%$c&$wles9DO^;hQYGqoO?Eu==l>5o9;*-Kz=%sw7 zhiiF)lfSXe7ibq;^Q>0QNo*spg8W+SLVS)iKOv>1M5q)teYn_kh@itp&$(=XLRn5M zAYq_eWc33FklI?D{Q^wThL^Ty_}RSA>>(UJ^)%Qd`|~atye?0AHm+P&pCwZ-4l6l2 zI-8Ulh!j29WNL`J4Ld1-w1cG5h4T}&Q*qcBCcQMjqXf4RmIYmN?A`bPS%e)si>`dH zGlx?VM*?ROi@th3MmKbA``;Dv|B|Z_2+y2_zF$hA3j`ciG+qIugsLx%j8)H2eyS3GkdN52e3B3 z6Fy|5dvwV}oE9Gze$W387GgPl-g*zomp(()3722?gS5a7i(GnyBwej5c|f%-oQ8BUe(MR;LX)bWqPYH^B(dxt`{o;UxrHj8skuax5YZaq!; z{fj85YnpesdxYq~Z?%5iGT_qP>84DTF#-c}4zGyu*c|(_Fm2|9=B+&~cU(2M4=gm+gxXah0@cee z_6ZRHW<)pQNh?xTPX2!jlYjyA$&6Qfo~+ULW={;m*Pj=z-M6 zzD-@dVDt!X?dMW{|QupWpZ|?cwa>Ep^j}rGn?zpi}yQU;X zE8^Ug8kDJVWFPL;(^n5-I-&YQoL37Nkb$e@{IBuby<-Pnv;XFRiN9?i1p#2ffM3mo z_+6?{2TUx@k9 zP`cFS+%*RG2Q;qb|8v#BgFaZlkVaB55mZ>mu#|Q<`VY^T5*o!T#4G))?r;H47IukB z7WffafWNfk?EpgAZI?x;Q&po6jZWhd0uzIKpF4X|ABKO??=ZZ5v}~?%`UZxc$&V34 zYKJ@U1#p}_-*u<|&F+25o{A)9bH~~$_0uuCjvyStr0+@YPyJym6!UNU={H9R7uQ?- zZ^=BR!AA!UZwIFb$~>y)*w4VA>xHqUU63wG*_Eb6)5YN7U=tqO?~MC^y1QYER`4%o zgzo+^1(>7h@a(ulw#8)Rx68^8GFth@|dg~cPMVOu&?lUkbcpBp)bRs zSYA<2IY(dYvSdZUy#HLx)tDyXlynTH=3++f3&u)y0c(1Q>lj8S220hw`}7>t2qFuy zPikKG+#u$K%27|RA(w>t7Egeud@!W#1tZP6FR)eZD;T$9hq2wW!CSd^HQ*V5DC({eYZI~+F!dazAO8w$>fCLGi1b2p%BJ>TAj+-{cir6d@kd-g zFq|uk=7qV(^2}Iuxj6O@#2;ZgGi@m^U#%qPYnJpp$SC?_RVkvxM^zGSCOw7zv$W#<5toYFzyCf z;I1IeQ)G^?P9DuV@vVFM?J5&~glJd?h91Y-jhC8T-)-}v_o}N%a)mq<%(!Vke-p4I zj2}Vg8!j8c$D~&YLpJ6NWjB;cWg46t?H;-eI+`ruQ=SZE{0z0b##2*Q)+BWA{v{Hb zq24RySs$usH1=Qe;uyY?B~sElnJby&B!HJ6I@XUy(RAC8FC3n+#lZx{s^PMN(Y@Z5 zk85LJO<4q48FpUa#rtc+5Esv|u0V0zl3K`ZYS(YN!(T-QIg(@8lcsP#;Yc7Dj31gx zM%Xr0>{^7XK>NHB7q|>K=%@RW1PG(9D^0Ck1qbDc>Zh>2l+}(B_!uos-je}Ia^C;- z@1JiZFM&=>ux|tgs5r2+@<~?1W@NLc z7Vc{O{iPMm5SCjO>89{4h4KS!suVlh1OXZV7gPH7p=%p3=M~>CeoFRG&-@*a>ubF4zeXPZ`V^x1>jbP_EYuX zq$O}dDH-+7eHBd29Di2{N11%Ghe66YPT0`P+}9IW8+SpN`UJZph1%b7Ou^d5DI;9% zt;yx1GDSzO5|O1_q}QtA-~Atg7!(f;cBR1`euRXj(9_G(EJa>n*B3yKCQ8zc8sBg4EZVd;2qhxy}YR_su!pg z`AfbDin=amZ02zDNQPa`>M@5_Sn~|6c&Nbn%SBLw zc-gB}RKs8yA#eyyoJJpawI%fanpPQF++7+vvLMRZUWV-}c(|mWzDKG1v*Zr(hCT{s zWjqBOR{UNe>L@36hlg-L*CeR4g?@72;9$neN#G2y58)|C=)NHdo-OA5z{L>X;jWNf zTd=A7a>N)S{MwOD9~IM%wqnqP9^ZOFKZ@qnaW1w0f>zoSJHB&1@3-cCjYhT?^m!mx z($E8=BG_q6nwxDP)qwEO==LyFx*SBH?Nn%d^0UIGAvDkEJDrb$-R-@*!bnRie%S+Ir^NHA84==XSRh9r|dib%@&D=|KD6a1WM%&Am)5vg^R024CH-~$G3RP z-nVsjf=hWM3KsogUz-w6Itrkhyx5jGBQ~)yA#^QqZ!c?bGSSCgs^*LSZeByujk9cD zyXbXqqs5et zSm3Ptn&u|(Y$$RX%Kog6&=lZAu5W?p4$ak7`40i-DMwk9gaW(o#NAi4Xj`EtycaS^ zFcBl3Cb$I(LYeZ>_W~zmdjNQK9p*8mE|UMyVC7ua7<8R1zs+VA%>*RBT76;mH6f{Z zEaow?at$zPg43I}Kw@8Y7ii%svLe{yepeAhEhK_PVZ^-iDq|uxVI?cTb}8jmnzSaL zRjg_=g-a1MKQ)x*oiNlFim?TLs=?47#ArLF8f9|+b(Wcb@+WIRa*xwiuGW#PAPpzQ z!eI&XxK9y}ltZvj-PA_4WQE4eHBzmtk^4~8fSyA$;I>};^D4ap+nJ=3zHk{XyTfVM zEnW8K^0}RI_iG*_fYSfG0yk41UV*OR2c}|J-1={_ZF?06G}R}UEBq@LQZs|h$(hd% zUkQKykdxvkL4sun)Tz8pqA-`1HMk+#++lt4&>iepkj9)qU*&uPDIwKt6nDn_A5&); z)Mgv5Tio4>ySo+l-~@Lq&;WtrTHM{;y|@>5cXuchhvM!Zg_G_xduIR5g#h2;?*X}pvh8>};OCY^<>ajoOq&Txj)@M!GLCyLBfG>=MY^p_-!*GeZY{pLZy zc-lRYZnC!@pU-t;Fh#jBJ{{BX#^*PhVV4QO=SEQJUgF{Hxm<>1!vlRI@NSzG+YCbpst-_xGGdb?=8* zWmL3KR9I@++3{gS%$BaS^@9ah5>=F)>xyV*WqxoxVJVZuAxHfY!ZC$0Yw*U_M8Fa{ zLi4*k!J!DB4~7&MwvzOF94Y+z8KE=h!}6hl2xRs5m6Q@8c-?PYVa*EWW7?`{-uG^0s*Y1FhPp9 zu!)0_b+t_IO(RP-$#=z-kfNBch>Kpag9m@JcvS^q72rd0DHjTUV5yJJZyyqU`=cZt zsR)$*%9}9)8k>y?U-hGXgN)Sua%7?;`201*27Z$9Jk5Z!X8oEpj{XWwaX+4by$c$1 z$~0YpTC%nZw!Gb{D#W9_Kn&wkjZAu3BggtV(~ z*vIEqt_W4`v%Y+uZ=vZnELBn_dH9;7?T}JoecB*gnbz%Ycd3=3DSJyzC6LCjl4bN# zV<9fs)TPh;0>F$e@>eO0*4&2>B-s!e$bYW#hnZmW8-tesVD|PnQ;$F?+JJ*p@hzYs zpW}i*dnNg+_46!@NYg8l=GGhOM@5!N@rtvs+iA)dwE_LwwzPT|D)C`D_mAK21g&kM z#Wr$->iE0ztK2qwv8rv0}(@DFZ}OcO1_XFVOoehiV>`L zg5yX7#f3-n_-_;~Rbxt))k+l_7HGT0ezHs16FL_yj!V{DeLZ(p*>N{rNQ6iL0QP!J z-$PQ-r`$fI&0oJo%#Y8^S|uw zufDyrR`t&MsL|%01*bqUxV2Ic(lj)x6mBlqp1B1)W*_(k|HbfVgY{3!XY=IvOXJyx z7Eyj)v$RN7IDX6+aZfW6DAW<7V3N54VHbtXS+eBpR+7K0xJ?}|6|nT!QK!t&X7<5OCG6z6~1^+6WFb>$9lnDjd=2IDQm$Z-VkH6bAMkCUU1W2L( zl3yq1jHTKhubL)d>Ad+|ZcTn}y9}aU`t3dv&$={Eo!fuQ-GEEdsg7_M@`4hwd`o-I zi}nrw&63eJc8UaX6azR`R~0pHj!p$wUw$%_aQ6GhCi&;J;qCzD1J4*lPZS_nviKib zy8P$9yFWS@!$%Dw<0=K-mZBJ*k; zb_jYAYN_UqF5PIa4<)`2J){G&Q2MJ?2q4*XB47RuT7>%+&^GGL3pZUK55=XT6W`iV z?a2Gt`UW3zQqds{ipkUQVjeV-+a-na7ipr)5%U$o^^u=#_4Z$NmiLF*Um!vj=ezW% zu|q3LCStO=azf6cYWvGd=U(SGl@s~1A6*O=YWn@7@@wlo%oz_cSs;V~-Xi=Ly+VM| z9J8@sOV)eBw6uL(w*k&CdgL-b23rNps8gpE+PM|Osm+NmbmeM&Gr9 z6+X?z!QfX4=PN;h^*L1zMb1<5l|WeDU~`9Sb^H0xN#INuJei;D)`dM+spO{+D+j2d z_T+;plS;fC8*8otBg?WGP5ncL*1LSSDRz3SH$1$2y8GwQ;+B7;b(({R5?JJs< zNJX*sRnHQUEA=ghI3=XP_Xb^grA^P3YN~wrQhY+_cU)xAv9o?W{uD^onI2XJXg`?K zA*|_lKtpi@J#3kUsDgF(Rh7{SwY=J=E{B79Bkt!b0UA83zvH4 zt%pAh!9+mkm&Ot6#Pd>o#qESg+_sBR4S{$9-fKAp9e$PTKkcl?!mSgfG<4FbNFnr~ z`m0LyZ4l0~!4|+xKyh1OsB%X0m80u7Nl}0;#E(Z-sqlgOeV-}IG1^@*dqi{LC3pks zDN`l51qIhyXF%ANyWvK(EStdr9p7Ml(44pvhCx|W%07==$(Y&4P8G*0taR*)^&8Fv za&&>;p$a%c>_`fF=YFbCNk5u!h})@Wa1RmzjX9k_8fr##oL<+ndLpfJGTSkgZf3a* zkEyI0aSCh-rOipImK=ZS3Ukisc-~?Z_Z^EecZLz`JR_4_-Q$*a;YX(kf zFrSd8#|J_Xei!ae72Iv}9z%hmTF6CJA0q1=P2*gx@h6YDB#sEn8zjK=Y3~nNmOy%g zhyS*(^xItr;LHh%dn~?Z%8E_VO+yr0!>!p>!;|07tFA4OjDrkngs53}<93Rz zLb1daA-R3*0_Dg|sBjsoeAm4Y&J46rs1OLh)D(i8h2jEi(^_EV0ryYfOn0PcPdU+a zJX{)K1PTY?ra^zLL}hUv2+(3*^?KDRlM`s5I|lc4?cQ!w z5AUGYT9iWJWJ0ZjE4;~TlDezam<8n-4iBR=%jQ{iDMDN|ONdJb12_y^zfMYPEHq%= zO}IybiJftZg2^QPpJ|n=`Xso<&KB|jDT@+Ht4-WIhJD#>%)psdv7HSC2$lv>jwANG zJf(tPJecxXZH9G0TctR5Uv_2lVp9JiLwCR?@@6d~H*WP)1AI#JTO;0R6=Xk^z69@x z5CMv1uN<^k(BFQ9AlxMvj;JKtuGJW8d}BnWET>EJ>vq-sVKAm4srQMO%jOWS(F77O ztN5&N#OP#Qv;g?&hy}#M{>4kfbovlMoO@gB5O)|!oNp{$ft&K@Mu62h7&8lW8>8QG z4U>~%<$fm;Zm1@($Bcg)Nl%{^slH8%+8ZkIlU+q5BBTWM%a*G;8npHZOt=(_sHn4y z35Nw8eryjej&|0wg4wcpUjV z$w|8fRDvWUg-tI+RpWV=y^Tge6+!b!585V+*Ji4#W%>7r2 z|MbZCiH8qxroB!`GytlBU60LmzL2yxas)E?FpQe_s`34`?xTZW_(`K}rjA3b2#s=O z*pXKALW#W2@1d%jZH{1|11NOm<*U4;>i@ck2{x81R0mJq*Nt=+QZZJ5dv_zh`({o> z2mJd0|KY&4r5jRAjaP~Yd`Sa(FVxt(RZX&YP6;=Q_5Wy>sN^5v1{x+}+I^hQzMn^b zc{A@swNplL7|0|yLBum{@P}w#--5-TVL6oMrl5h!3x_U%s|!!n)nZC(t~P@|wU)Lu zxMD^mQ6-aq!>v*(PL=LwfBT!T%@kq1x&* z;Kw1v(m%NUHobjcH{Q-LOIrF^=671=<9tfj>+|31YOmk2wr=-{vcu`&*WKs{oE6{n zu`2JagfthQ-%JX#ig+T4j@=O_&(jWmcQPDa*wc_x$cG(hQGspG9ugaZ0O=xim-G7? z9JegL*prklKmUYzI{6^kewJ-i0gHT!)@QDoiCC$Nu=oFO<4=qATe|;Cx)`dvb=Q3= zsX2zr6C{u2_X2qllC)Av5(|DW7JsFo7$R|%qu{n6zkv+(vkZ1j=`*5^%CeZrsul|_ z56bYTOP;#^i2my?>yoFrYvP(#82l6J;NYG`F3QAf2NaB;r6!BTZqDF+&Pu@tA=AXf zNx>4q@Z1YbL@^lGa=KMFm3t1bNM<_!J8^@loaXqA0)|F_XwSCiG z;9B^l-W@&q_+JDbbQ(I2sK~2N{1cAgr}@Qq04%M+Bydilw=E~q_g)nO%lZ5;8{SUC zO^0r@`M0r>?Bhk@#y=Cy>99UyiVlv&4tMhMStXzExQH)UJ z)I4E;{uir$HFZxa+dMcV#U@r0!FQW=ZxeMP^LzO7A;FFY_;tX%d1`1XhNJW4T0pi2 zH!4Fehv&G`x#7~UtuECg={)rfk{74Gvw#+fB;G%7lAG7L_*VmQIMSsT{9r4!>=HR9 za}O-10D0%l>^MGyCt6l^xr-Q#e_r`Vl;T|y(MFFw0sS5b)m=6O%Qtc1qin2BBY(PP zJ*#k>^{w`Xb&d=>Jo_5-tWd4T*yIaI89dRQghrZJ+_-KuCgmSy%g z|ND`{d+DKgjncq>G7y$WPy&m?@ww#7YssMm$(%ysdG~cF#}uN=me(IZg~==?7qEul z2siIKq;zzR4AWu4nvn{mzAXVBDFe^zl@JO z-aP zzPv=io~P?atlW`^lEq{xqy6~c^E86#D*Tx{-LP>o@JSEI{R{@$bq(XO%&<)}d- zEe5KG^QHMbRbO#`87E89Mjize(TvafUb>`2$YxuJg$cHqSn~G%xI9`| zqh>2O1%02f!CAg9YuHSQp3LeYRdm*9eE$yQDP}mU?GjId^Q|ZgpQ)N-@%QTdNx$P= zpj%!BatiJdZ1X9`I>t|^MG&7mTuN@k$E8(=(#+gh54x40p-53n1aCiJB0In95V^F@ zQQyKf>-wJwMv|yhrzdjw2aZE4de){KHjPACY7pbbhq(9CtIL`8vaiUzxDjvv)o#ua}};4+f9|li%*?kLyoa97p6XQ(S)goPRza8J(GUv*rD{ZuOaLHJyk_ zqU#3NSjZ$Wb+CE!q`-Z%DLAy)ao9H5*u`?j2=C;w@k}76g zCcg%fzAmN(%5BRD+9gu#`F0VhdF3ox3(8Je7TSDA`x(`eqs%le2~E)X)BLGJaWRxjGxXN zsc9~9V;Jp?9BN7{xl_(fhHYX$X`mHSqSBl6_wA+O(67`<=u|YoX3Q53T`%D|^K~U! zI?y8zaehp-MtUolL3aoJ{=@3gH?>OCQhy33eC-cP&LA zCU5d&!TU01*!Xt-oXRoGez96KM!Hj(;d$#qDeJI|2n=Lji{pbaMOribn%7P?uk7gJ zh4_{18cU)|uz)r%Z%tgFYvgo=qZA?|OdzSo5bgQ@x&S19Cnz}uP)d79HI1^2l&9f` z$>x&$jH01_NAu@s(4v)Ct)PUn7p9V8jMd?sx@8(Ksq#rfL~0Cz6Y75a^?Nd8)=QEL zg$Eb;ZUXO&xIr)z4LM;IOF~|3s}C^4>!#)i(`4+#yAzaz$Uk4|NN5v9l4P0I_2z*( zuE5*Vn3)!FPx~31;njjQXJi8y;a%FB#R|W6KjI?ui8?8owlm)9`Xo=zV0oI+b=dBW zANPlSD$x_|eo-i+`bg#_wC(TS+&y6u&!>1$e-T{&Zqp*{U4Wj_wz1n^pM^k1}p>Y=N3(29}D#igQ>?0 z#hvoqHpOp^Ut3g_T{Y=4jRE%3rqp_P@Iq|#b0UAta&T0zCEMB#rdf|Pe%j_Nx=;d} zOmY(S?0*zrAF^fg6^h+11(t$c z_#ENVbcPQV^vsM5F^RP>a8W*T@^W#zTJEF_lHBYj#47Z2v@CVwuqPuvQiu^Zo+@>x zmK~-t2TAjy`v(E>N*apMGUNw3;N`y!XFm?Kx$>~|QyCOcOPeU0^zrD2@bL^w=aRdJ zZlUwN4F(v_+kg2Lj0Lun7JT-WZ6On%8#=Br+R`}L8)&U|G`%!oXi}<FmHs+H&Tbq z7d#JQo!MfK%#Tt*-l|zFzm=dA#>SGF<9T$iF_DR*@g>Qk6v|5Hhr2uxUnpPmCW&I; zQ@zqBF$GBMiFq8>dTmdtFSFUSX=(S$&Yj~)LZ2H|Qg0STYSNYd9*fg6$bMtgmh8b2 zAK35%NiLfFtTQL`mr{g<)cz0SRV-FO#SYB@v|O^guL2>kQEHL#w(;p|8l_NnIKev% zdp-nuuO7AW;q&H(9#bY#(o}N+L6FE|7L!12q4Tn>AeFe7$7O)IZ(SkmUC?abzHk)# zvnwf#2s5nBP|Hs{K44i8bMR%1mU#+3x2A0TK)-I}eF!#Z@{i*X`-qjjs$m-?UY5~5Jiov>Y77ME|;!arHe&FxoX7S_uqTk5%F^j7ZD8}gUNgTs&PNCwphJoZvEXz`QTka7LwCd zQvDv0oI#U}uM`$xiSfk9jyr#`D4Y6L|9+%O&B_|v4iBtGNG7~0lEJRG)IIqBZ z>nalnW1Ci^Bb~2{j?7BZlvcoc6C%{46QU@qzuQvC1mm+hBM5_lGvz60B?-N}EojL+a842+EyV&!*na1zFj}#v_>ZQE|n40NZykKqIy$^vW&r*SgbCdNlory35xn94Jw%+VTHf$2Q~&##^w$m zwZly`HNf{Z4fdsx*Qr2N0fC$iw~TfNkWqz}bG@r;WW@a{ZCWPfR->U|4A2eMq1PF- zNvI5QWGE;?n9oHiueY)M{5B;xoa<7+Xnyoa%K1FBqc%mF*$`bjoSCq@KWCt5PJm$< zzA{A)==(B#H2&O}_4%9+f}w;!r8-Fao4GdOanB%UXXiVDa7sC&@euoQnNCxN12;co zix)r4;B*W)VYt;2+6X$*#|!uK8A=m04YM&MjT?~+di5X3QWz`8uv>ixXH`4vTL_f?KN zx+dMPMeP|+$ui0?fX8@euH56XwMu!GCar2xTOxgJNbkT#6>AsYkF@cZP35j4Jg!x` zV28KWOD`TFNOn9O3;I?Bl$n@DyqlzdUdo*~s8zkxRY}B4z~vopk*; zPNZdLB$MLVlEfRLKyIog7$0B!XA6WwoT(#dR*K8xI*LPS9z(Etuf%B1U~SGSZZ@-m z9_8IPD4C$%+F3oBO64C?+^oBCnz1+hLvKA3%E=TVf-?E{66%k2?JqlCYFb%#fd`^yQBQMiI(&vW z=VFj+)K_LkvWAIRCOc~j8Qly{rlPqjAcP=B}(ZEI& zK;*q0a?~K5!Z&Nd&lhRT0G8e~r>-c30dWltF!c=tMve)C;@7i5HD6g|j46kVDnk@X z?SP+xLiY6(nUP=w!dNw!WFB!C(c8AP++f*~uU(uS1U$EhvFjD|B%A!PUMwTNpvnoH z{NfR?MNbqQ6!2MDSa9iV>9n~P45*8JO9ErV!zX<8NkHfI!~id|3uKfq8cHZ);HN6X zSdf^3D|umJuEoyIO&U!^{`B@l-~`(eXaZOb>$|AG>Rb&2405FLkXUMd9}}B9$Mb-A zZ!Nia_>&O#?m;__+M=T0{$|K8W5`HTRkQwX_TaU z!{A5U)icKDtTg@DS|$}KojCNsxn+L*xVnw=quuWXsrh>s-|teZ{>q;}`{O0DyUdm2 zPTFHTVKxr^oM}4x8s}TWVhq?#P%y!qNY6o?)54&z@OmD4GyARkcRvI{&Hi(#Q*|x} z|6zuyg_weY!S0=OZTWu&nO34_`Ui+_IdDD!j}l3t0kT7h3ft5(A)h-SdWLG-#%dbA zGvCLN!43|O^PY?imsjUHyne|!wpsK0i!R9bL|R718!g|1+Ul?|4}@+?1oc>O+kQGk z08-(>LuU}A)IbH|X5+uKIQ++lJnCBeAGeE=Wu+C>xJE1i>o&@qV{5~=Sjq(J{DQya zffhKw6!XydL*`mrkOMg}%;^LHc?J5C5$Qgf0yI2Cl(?drfFUb+z&Akv6rO?7Z!Ose zoVEXssj1iHFiVzFVyHOT8k#0s;5y1$Qha-gM3F=4^XmI#B$E`Ao-fRHz%zu-8b=VR zi|f<$xX;(z)@;I=7E3#=?epw>VC$xIC9-4nXJ7}dcf@U_#6b%c(SPBXB7)z{8ke2! zu^W#;+##AW#0?=25)*`PQg;b^njpMzrBbiLGpgI++AvE|4}}Spi;GNepwo61{^o;Bjr92G{s z56eS2pcv+YC}PH>8D?{dB@TX-FIX4+NINdsP>A=$&}PoaW;*eLaK>fWXF!RsG9@dp zPLwYe#49|xug|^IW256a5dsB2SvsFt(`ps{4r^_fQ)^iliq|d#|JBVc8$LRhfON+i;4{~!R`6T$X!i|1V z{GF#**L9~c+rNY*L<@b0uz=p zMh+^I*W&lUKcNFRIDLn4u>6u}!;T{J5dzlv`$)15YhpoZI^zti3?|ah_cVHG1?ctJ z5DSO76LJ(G9L95&g5Z#YH&U6a!VE+dN|S#{6asx3Id2@Kq{76_5{r&I*s7go7;UaO zgaAUits)=}v|i%+T%QrPm*iNuZadJx&#T(N$XlqOJ{^rKp0b0wd$WusGtNiP`p3CE z(irEQ^o#Tr%j@5e5Ip2BGrt1~EkZdlg6i?sN4U3VHLlC>ZkWSE0afJle-lv9%?u$xZ$yw@K-Yl;mcb*Ubt`%*kOZ1GYY6 zg2C;!FPQlmOOZ<-%1we)E=fEkS~wx5y)Vto_9?0vXtMQ&^ql51}(DDTvByiOUCvUN~`K+;3icu zI~m4Q(#&FI0=?~!bMjq9FXCRl8=}12_x$hD74hWUmr6~i< z7zWlllD}|X4Nh$uf=c3^2kb`6Y>J>Nq-{_J=K6P-3v%epFuaP4nzqar*LfL81up9E4T*m2qwn9*umwEFu04bLhMaJ&;ke!Cp@b|U1)9_G zz^sAY!id|6%w4PG%HK_K4Q*Ms%g0ZfF7a2AAY#_D;gWmrj}wUcbO#OaD;QJk7`1!6 z82K*T$GcDA4Pr}J6&$r|ED5FR0MwoH-NXLq5#Q!O;zUXAGD#kU82r0h$pO##A1@SN zoUV-U99{w`HLS|c&b4)oEx z)ivr5{cZy8ZN2rV{F5x>M_PcrHE=v8kHo8XL~iG+jfvD)P0i)EyT8>4Zj_=mnTZPG zd^+@jZMrWCJlTt^g3DjTAhrnZPe>3^d3XrrZhd*5WBCLW#*WD{Y|A-MMD1> zRC|3!poJXH$5XbAg-2$`|qsATAYSn16=p52Pf? zL!B*!$(_RgYB1 zu4E-cJ4F)AiK;fyq^MvNolqo&v5CR~7`v5L5$~z-YacGi#q5?+f@JjXQG{Jy6XotL zfx2dz`W~hQcbf4P%h|q6G)V^AH*7Bq|J^2|$xAtn`(McBV(=DaqJmpml=KBB^*Qf~|G%ynK9x zMN(fwa2X#ZMuZ-IHl*+yo;tfB6GAE%Z0YZ>=@?WIVq=)H6(4Pp?{SD4BSL6w#&_da zF}K{Z>9(5l(sJs{?FreFO*1|+EGHv7d(aciXZCSnXG)NonhZIf81xkd&XVZ{&dr@u zL7%=Qfm?PQ6{I7gaDJVhxxn_Wo2H9mb(~uYG2j+x^Bh1y`#F!}lZK0Pa*bzLq}$JI zb03MaI{DSQt~ ziO#mi$j92G0GQibE zA#g+_AoMQmZOTgYiBq{BjSq3`E)(kD+S=^2pF8Dx;p6Ku-eHXvFI>raN9rx~uOC&5 z)I@PaHa?V;8xc{>6<=9rv=V}jA`Zhi++hwBY)a=gcY0}l ztf?MDGV${z`2B8+ zERE|j7vSU*Q96l{3o5 zsf?n~FT$wpFQ39u90h#(ta)fAU_(rIDKkbm@((J$p7QGn$D)v%Wm1LJi(_YaO~Xtd zP2p-Hu}SsXlrl;kl`WHke1Hw0rR>~GM{bD#eCUB)PK<}wSj3H|S;dMuIHjq-sz()S zyxLM-JmHkVn4<)AF`OZ#RJ>D0Hh%^gXinFWML<$@PRrrwo5|pt{Fn+cEhwyMYM|y@ zAOI>>L7k_$xyy5|fUbgn*e=ICLSO9_>Heo=qaY94NZv$x#Oe*9x;BXsEDHFS&Ei1yc0qptTI~I>;Wfm87C}rXt_4K_Ee(( zB&3Ai@4pL_@T9$uRrv2ZCIDyTqIrn#_0)c99}>cn8^HXhcpOrF3+W9W z97U|nLPccbIk?G9d^<2%nQZr~o5xQMe@F9OROWvXCWad$Hm-jUI>NO3x8^0ZkXKEg zcfOS8JO?`&(DL}l8tV(%=&|Y)9-IEcEa2rW=1x%WX*gpK%EXKyO+dlWJU}3N--a9t zsJ(Uq5&M!76#|g*(QYzj{1N|@$yV`FGuq&kJIE_JKNG-+VQD@$0ZZ%!4Dm)QULd}v z>;I8h{IbgymwXv4!K8U@Vw6CdgG+_QLc2gr^0_QztO|K*dE*V0C!2;odZtfkg2Isq zXSKc_H%;psa`#pn_WStzg!)G_|5fY#c-JL6`Cm9L{CBasms#4iF)wMr%?UFSWM7{x z>MG_w!1d-VKeF$>AItxmzzewoEex2A1xY0w5dI;O@z%Oq%rD%AELhj4w1A0M`m$XR zVdrDR_k5fN>h7LqGew^ZP zB$zmTi$$mFonTCjx^^a*`?d!57tyXSAFr$Ung19`D^~**9KXfvt%H5UZsALdfcRG* zNPpy`Upsyod$LVv>TM!h#{17%bbIgK$CeHI&W9DlWr@78yd`z$Gum4UD)!zt=ja~( zSi~dvyufu3;@*j0@qv;NgzU}zFH z9}T&N>}Q3i{zV&oXI%0Y8IYFuxFhQYAKq7oA@#`^NlN*uQWX1Wi}pO6xtsqQiY)H* zrf)N07r@6?R~i?MKMv^BW^2D{W448`)9u&-sm+*0n-nC%@@2ori z$`BF#?v%=ilm3mrlTS{{0UROruOte}nOu*p6Lv8HmI1ki?rZtK`4DbpbJaMH5Jw5) z711m3N|&UKD2jkZ3JTLj5O8F<#c|7U||_6kXbbe~Cznj~j|)JmI~fX!c+G zdufNokC&aa!w(yf1S_yxxwM&USl76 z8t*V#i{syr9C)xC7a~*yAE)vc8HZgaVxSN=Q;p$-g)>bfQh%N%oz_`a3-f8{2NkRC z&942T8+hV-VaLFD`|q+-_4)FKOiPC%!cW)l(;ID$g#bgMxT2+Fb@61fPm=3csOegKspCZRaXo@k(bmDA6TP zcrUCdr$|iG9ZZsmf(+-?L2frz7XGsGbW^VaeC54;6tm!I8&Crye;eei+(-U5C zptY3y1!aL*L2I|P=+A1{u;4YX2XOU}B{-WYnA~Kg`%8I)SR=Om_-Wzyf8yWT(iuTg z|1iCZojXkq_nB%-tK(P&n1L${2A-_-V$+hz6i2P^XC!fqA=VRE#x3(1@4*$TP|n#P zCFK5;5Vc*XELcc2+nLsBCN4aw!9=1cmgQtRn*ag)Xy@-HACT9+#a;cTw1Ah`dQ^ct? zt^}s;xK;zL$_0dsSe{V!j96uzBkvD}Rx34vK#X$qrl# z9pCL%`dZ`JM)EukEApi_4^EDf;2S%-pgws1mTBwpQ~^rP(!n|FqFus}KDybc2m6@! zFk^Z|p-N;7d$!4^W&2l-G4TY{A3@R!zPZ%BoEg-7pnB(4`#~th40r3bF$b+p-e_O? zUl7{jOp4>inliYAn`q=y1R~KqOKs*aI&SF&#YlTyQvpk4@9Dvf_T@}`2mpbLl^YIj zQjtGE*rn2ms?OMBSR4>n1mbNb7i|&I=^W{TdCt8qwlHydb`Oib!q8Hdn13?ZC|*Si zVmpOWc7mE_|FuAISSG_@oev&bC=&3dkpZ|T`jDkTM@gqwJ3Fkx{QYY6aNkCVEPlWJFzJJ`>Din9@Z3PW1X=gFpQ4OKPDg2@X1 zGkH0LDiWOlYqeSpvP=m`iF=EZw-^?AadhFf1xy|@&LoiB@wa7)#t$Xm`yWOISAs@3 zP^Qd5sH1VBmj1O+R^LVaO=xE2FluWO4?w^g%yZ73OVh@P8J{%8CojWAV9ctV^7u0I8~NFEBKL z-1#0Bdu=?(qYE4A*F3FwBaoq^f4s@9suV!jq?&Cg&_!{8Y7rwQ&u&eXwI}=5}aGTP(@G^t1ihSQ0zk@^lK2*)fQ28?a?^arpcYLlzb4u%fhW zLy*OL)Hs9z8D3`KHQQ8M3HcE`aNRkE{h18Ei`HDAXWvmWp!_|#Te{U0RLhS5fNh)`oX{w?fv2%OLOSu{}||A_X!rr)2HW`o1-oglup)WD65!8mhqkmSAlG&il+gN|=i^ zhNdDNwnJ!xq^2XHI>u1XyNahW_4S;*lzj<}w6^lo=|mn4`(Z&*v0k~NrpFSDrXpaO z3UA6zdwnr?a7vS}do-0zNo{!eXTddn$gU~Dk>)NL2>oXsZ0hgVDGOhqL$}|(5$QWF zO_T@e8a$I=<0ef4N#|cA5#u4|B4y`K4r(%}Hmi60f^wnB?YBH()SRMtRcGot1({@? zgT>Vp7EcvNv!b>q2Mb`IzqkEgP*_hChmI6BEd2zVi%MjeVK`bRt<2~)6Y5uRmiVQ= z9d{eZaq%cRZLYD5v#>da(EeC6Oj>Havx-w1?50!=^OTy>NOVY=r5=rIAhC6tUr3wJ zR5q1B3#Jp?Io3Zuuw$@mawjWDLVGC~`>~Or?9Q}sL6$Bv$_}PVrI2-4IO~$ z?HeCmJL(tpv!j^ZRHssQQEgtIATiU6II{R{w^xF1icMVp zFsH=^wymqpb9^*)!09i*-i9E9Ytj=&lj(?$=!JzxH(nsB%^QVRpp9Wc^WkC7BIn=Dm)jp( zoIIOO;gotN` zr?)Og8y#LCmEGJDJ^kVJxottz#L`lCAa$p~qDAM|or`O}$b1s|47=FbwCt3lR-Uyq zRZQzj6KId-x_P}pb?XHO30JEV-fT^D*2ZSt&LeSraQvQK@Qs4zjn#Ri+nr+|*(}asbaWV<%}kmgUYBanY9Q4q+T!eSEQJ)t(&>Kkvs5y# z@IYpj_!c9`j#DxbQ-pUgui#`_MYbWGHuaO(`AY9zN&aV-Ut<(1GF>iafQ3JH>8J9*9Af3ql+NnsUM^Zs}D`raY@#KOo$i;85w zvE&UvDho^8+a?E9UAT|_V$?fGa&<2=;-%OL4>?>$1{D%dy*e*n<-;UOeDD}FhL9Tf zCdG(KQf0)jGMLYmaQ~LMHJX2-Q5buH(%%QZP|6dpoR1YVjkpRxu}(BH62fg>4EI6 z-o(GbH0@y;z|jZcKTwTI-`8xv*07BtW!n&prcJUi^D#SWzRk;u!IYi%-zS(yeFK3r z5BcJZCBsDgZOq~v;W|M>LG{rhNMXb|+B8?FVvyZHkDL0vV+JSfms)1}xuNJ}hldP0 zw$6+fYeo>@av4YOp>$^C#@{EF46skWW{p!GnH$auGp`wAVsIenw_6q7!@T^B?LX;h zD;6222AQe3)#fO&QNP*%N2q+xvxN1~6Uuu3R~R@2$}9Z@?Z%;7&;7keaV_XiZP(BX zK{`|udtHJTFZdXv&nKUtcaTQiC$xEUP7O;;2jISg%NSt8DRdy)$?iC<@$0p!olkbX zCa{CzFF(4FoflH{?|Wnp|dD$TGIC3w{EldU>!)z6{U zQDjB3p~;R-#mY5SDaH)3w}@%T!>z$`?f1S#enf}=7~eBiW=j5y9aT1YXe6RYySSV&VXEM^ zTOsJy>gz*x&v+`kC(zwjj^AYl2L@R6Jb>4xlqz+F@X^xRJ?)?q`zqw2x}Nce#dcm9 zLBL@pVeLT2mD+hmAO4Ag_s%g59}4C~a>71G%sE~8ab=uL>KOrF+ebaRW$b`wLqjCj(LM10}s?cCDBvfTU335O%NDV)E`sGj!9tprsJ5Ah5Nb=!cY4Z z%TQ@vX)%UJ?FH4bKie_LoF3>Gm75EVED;BUHKUX->WZ4nh?*m@#xXspdoDOKx1lRj z9pN~t@Z(88&xPFm8*HeEbw~)cYwHcqcaBX^GdB7F7$b(Br-OlZNtia5R;g;fkm%``6UHwnX7SkSs=Ud#T4pyqXTKeS$I^CjLWVrz@nX*r%GEFIa z|0YY29ntJ_kTye_IE=t@(i(n*61^3DiOF0Yk4dCCE3!krxnFKKHqa3+`JWWi;xxE#x*e2BL(; z7B*|RBlrRfgJo7pPOl)yOSk-Nk0!XYaK$j~Gc8OnLCGxgCL)v8d^Di3H(*OZDjM1mfp2j|P zAIorNewzjC*i|)3TYg*6h@p5HlM8SJP)3BDbTk+{4dV-t^R}m!K(6eK|0X)^wBiZM z>Si-_)GU-?I+ezi4w5e;{+(HDaGpN)44f@#1fZaX!B z^>jXC2Hzxe3A049U_tV?6x)Cwv>pD*t(~B-50R!#<|K+B>aUmyA5Z=t9^!Bk8hCr~ zFp}EpqFoE_O7!DqKAlMP29q63E1x-NH#J?t@Wt^_S7>aP4e)lFayV|8sI47zV`vuz zhJYt_w5lC>kpSUPA^{_9)!ia-;-Aa~S+*E~7x{N78FGJG{>19%D6To55_%c7@m-l# zs0DI_lHtG+E)*kAnKj}WE{t;sj?NjO8wut)ey5f&nBa%Ww@x)cURg3KQ8OH{Oo7bb zkz{lP*{PJq!Q3+eoS70+HzEUZ1SUj^!aguO_zgqx1Q;M)LztqSsR`A$HxH;WT2KDp z__iH*6}X%SyMl{7sLteq7qQ*rIfwMcsa#x&^1S?Mk=(9vilxVoFzkmL&a_{NYi|R- zCa>Y&j)VC{j=ob{uUiby+43XY+b}VNR1;G3y0iImVC<7FKfNH{a4TBkb6}i3k~pxH zV+r`+Y2{@c%T~ko-mj(FTGS_Mqwt=6Ts2WdT_~Y z*~|=k4W$u5;jmKBJIZ?K=0hp?RE>{g?*tP((+@NrM&OS($(9-{mKXyAqjj$mn`HBv zQ~LzEXm$P{O=rQ?R@=2(+}(=1yGzmH65v6L6n9#@xI=Ic7TjHmySuwnDDD(@`_gxu z^9QoW$k^Gr_gdFAryqMs{=SF+Rt0)QchX@~c%@%^!+9-U_<_lPv_faH@=^WT-3!?A z%`wvB-(gQ-y5%AuAH7;L^GG|+FR``xgTUKnLC(C>2W23}Xl6yak-2xngU|ZS-|JKZa=7j;W%g8^ zJ*VR1J4t9^(|VQ(^Y=T={kL}cU7ky7orbmtri1X|t$_Vpr_@SQN)wRaG2aP{njo1$ ztb{3!g{$80jc`y>!{s=w`S)#Kni0WbBx~zV_c-3I6xhQAIr3w~+O-NVF?k5cE-mW~ zR)tJi;+NVlz6E#HMxJxeW`I{G zTpa{#t-_`$7@Z#cWCTd6bch;oLR&Vlz=4mx(c`5I z#$WHpU51qhNhr-AB9CYa!CQD+n@cmmqK!t!A39|;u(Gk+jF>+nYu6n8*8faICiY}M zSLrfmIdsT;M{WlrCS*opmTo#8>5Yp=1rT|7zLy; zX6D;mHg7YRgw#*rLZu8Taps7%_VwV!^u<6aU<2?apIQK&YNh7N{do$`cb)*5dC`CW zWsrkgs?<(9!LCstjId{HE&T)uVDcL(BN zIrM+G3PF}@t-OT(n(ZStS|THy?R&oknPuNFlzh>;9$EG~u<|>&9_P5=B!{My`h_&8 z!uA4T#a^sCbZ_KjF6c5uI!CK2CER%`Q{dk{Fuj*1`*nTW4OYiEsa&0$J?+1=ia+Njb@}^k`%-%%-iAVTOsC=VM8`pYlcr}V|@RI>=wT0 zm{$(hIn@4+IDCAk1Thzj0cYAijm*ypuZcsfCW=W?3G1FyEZc%c230;wlSK3q!{v@* z_qB1JLR7%NhWsVLlY@N}slH<~S?{HcQ0ca{XV9o7M-yGg#Tih}Qjv9r+!pUA6~CHf z?L7ozS27&BbQMRFAc3*QaLz@blFm+&M3 z)#oVaIp7txwr=}&(XE>I`{wSAlXb}qQoCgVQsF0vW2h!Z90qUjxS;(#$UY z+|~FxW6^-#kwmIjXwWC}>0ReyHlB1!GdA2wNBSR6&DWG~TFyPyxK!)=hCBRDyvd-Q z!mkJwEEt~kzRps-sl}043Z7R~;_fm?AP0I*0YD-Rs64Q4J$YGEXr)Lffqhqq{+EcI z7x`|LZmlPdkXmZ1R;GvylmU(3jevhWCU!LxNgIscUzeQVW7)g!-S^+i_o@l4@aR+Z zl4A>lTyZFV-;g?VU!r#B!d(#jr%k%DY~y8E|Pii7$*;UjUs_{-1L^pVAU`B%I{;Jwg;VslRzm;BJlRKT5ho+bSBz?f^2k ziVS#*L*6U8pIHQrKQ1vpX1qNJ?CF+fvgYpaiZhx&j^;9%1M=qrr&WKc zeMMae9&$;0h#Zfh;7-q%}n2HROjeOI}{B~WPn3r%Zcs&cz>~hzI6-P86m*kxF^lT6uAu0 z4a;xOVks!o3q@M~+p>$XEDZ?x#l**A>Tuz4gAuldsDVUwV}R-`)nPwc-MwHStFY<* z$G1E$Ur0c0(^>!S=gZHz_`-cC7qPUt#}rpFfu9$eM+RKo5HRZ)SoffO3)pHBS+gFu zt1JzCOU1sRlcGOs7+0|VO?ga)WOEp-o9Y1al>G4ur?j~^pFu$T#9FagW)Y$t>q<`O z92)&mO%*v8L}W5L^QUGAngd_jJV##14f|X)?aFQTUmM(UCFw)&Z;S*g?d7I(LC8f> z_-1?XH4#Im7Du8J*7mwH#Mqr`phLvHc+#+X@^nCKF7DW)uiX^3m_SXABVSZ>+tlcFOsnAq zXDgD<9z(Rfq&zu`aQ^W&ft2&6_HJdQ%pBy@69tYthqCXEuzgGIJdH?UP%06PY=d-| zDRqQL#vqo19wcqbSnAqKC`QoghiSyBs`bV-_WW3-?R1!^Y`9 zwp-M_SF}i^iey!@U;#AYWs)dlzY5jPcNmCfdwDA|slBpT)5cO6f@&JP9kL6T<=ay22isulfQ&@UAuzN0tPGY#87q&#S~jL(9eb9gXGLn#C_=+l) z&1+h(n1V+6jY*HAQ-_|kU$BT}@UJTlAr)oHiJ~wY^He(fq>nXWwYJmFj{~jcZB-Sk2H{`Q~xJ^!6>ckvHxARGAsR-wYuN@zis5hL! zY))4~f7XTooO&rE?m6rXx!Nl1y~AGC<7N14;!s5u-_ur|sY$HquW1F$<2rscC(v?o z!70dEx%_>r9|hA#ALvsh-CubQgv$5SwAmdWHx&!zI;3Jyk@9l2;UhjyL^Ldq&U8E+ zciLvy0d}`YOi@~4=)|3OhHT1}88_8>Sy6x~74=7?TWs`Lyj2)T93m2vJBmzL=nR?1 z4ENil;gGit9+|ycIG^wav{Lx2AjRN1eKx5I%0+C`vG`(h&14nu=M!RyYoyQx`cBAY zsVzrz2Y45-`W2!ulMU#=)1k%@=XO}!ip`*^xSm<-qUz~y^^frx8@4~#>B3{7_YLy^ z0p28X&7rb$KekMN7HWlzLZ<1u4Z3U$<2YFLUiB$Z^{jkRqoya%NZHogabW|boN&MS z!MUaQtd`mc<*PIK-3gtnu9pps11y;xgUcT4REHjkh`hy%!yG50>Qs0K%y0lbaD#1{ z<9;$C@5aKNPk0)dXXe7wkSeLhyfYZZpBGg?gN6D}iYW9}^blOg(O-|D+4FG{wL`;z zVl=*}aV}p0%&&+@3r{ne8JuB6JBEQ1u_!2Kg|&_WW=)Jlq9)THo#()lc2k&bv_oZl z74j3IX}bdy+piDEj>a&oj#~f{$Xko%9+cRrxuSDKvVYmsdB=VPR^*PyF9|Y^8CJ&; za$x43REAsltAgN~W*^TWL8i}NCZ0lS#`icv3`aIkU$)D{+uUzr#-5$ zL|`0dSlbeM1T_)NB=tzaUFHvzL~+f&JWzmc455yOOt}DS^A*{R*=I+on6aeXB?oga4hd>xW zWf=ja&PA(l6a~JaBWRh(Fd*6x2C8=5DO%(@2N3in$qK4EhFT_xhe|lJrgaSR7Lt6) zEkUR^-m%jtSB znoi4S5^&_DWGA&pu;#P3+}1pD!kPu^7fm8pfoui6eA3?QD1?;l<#(Hix15mB95wgDBqx zIRS$8kuJm}VzXt2!+9TisN@+lnF=qxy+%w(R3=JkxH-!6g~t_ZC#H7H-cvt~J&1@g z5$vlXJ2We1Tr?q&nYfvQ-NW}e(2g1unAAj9rhJ%zm-!AO?Na8Gzs@NL;ouz}2la_~ zB2_lm2Fwhck?sgLZUgUM<7-|s}E`a@i=U%bdu7a$F2sXm_%a4 zF{r?_0`yUhokXJ`=dDBuxOKj>lo#h{CW1>?~NCSlY4Zp#Y5bptk zlX<7Mnu7$Na)&E982t`plZWw|NB;|B<)!*=J|+cR6~oW6&y&e1r0^uc7ghZac~3$N z@9Ud_F(x;pTpw0(Ql|HJ7*2oHnb$44j50C_r8J?!hZ3*RY*QmFv4kq)!`1mu56ZwF4L#qb2$dgcxzyPKnb6G&Ht#j;xlK^%C;yq-M~l} ztkkAWI=fo?o5NZe=e{i%u#d*8jc|J!+rbY;Cb6y!O`}`8p53%n3`{}M_74RpO(obLLZ4blRiq&>QYb=J#j6VBa6kp(hdKA z765|=7vJN}7F5FhYv!r}wLvEWkEEPL0r-jx%wTRB=l`>xrpIuHvPN(R87sbuH+;Fde+C2q8R;$R`%=LPE!T5I3&&r z@lpp~>4euuM9yVJREa#rKbZUKg@!xpd~p~aEL}NpiS=3a>?b)LkgdW=S|?RW^{cV0 zZFWJOb{c8#kLf(V}KNr?-S*Y$hLIk-2Jjwn2iE#=vL zGJk-TK}QBon(Tj44)wFpg%NeDw+_&QOyy)or3FYE9vq~5O=1AlMYa*J6*1Idd1WQK?b2}lu-J)*8s4CFFrNE zsCxA)VfrErP!%;Rhm?RU>dA7chL=52C>zna%garO-cdJ*i6GELL4`J64S2zIIgZ*_ zD@*Hp&fZ1!w19oCb!uJJ?sIrKW+(L}!AcSntLyEzdsGvNk|r{h+4ySW#I{Qv$J;)` z1Mg-ZV3xi)#)&q5$6mkH{3zn4vx=V|jzA;Adc%&kd)9ayc}BJRA?q97B*BZvcNabT zPulhT$;$?RSMzt{;<;u`p2?B3dF+%D&pry{?s_~W4}_*YW6{5fx%Uf&!kRmnSvUxz zMD~+Y|4AB1OaZW3WGHR}@Kk%I3(nREiRV-1?&I}Af?iI?MFw7jeQk)iRb??_l78v7 zCHu7a^}fCruX5fKS{a4gm|26#=2Bb4;!g$i-#XsNxSwpk9`V^b%3{}hhZrAG)ge;G zF9ewuL7khdHucK@Q+!~sy!h=H`e_3_c+o5j^F44D)I`OLqEK|W_ZS*}L$S+$d2+dSOUCV z!#!y46TSsIkC&_mmb@&|JewPwy-~i9vxj=_BoYv5hVB;Kje7HuE9eo*g`SlcgCM{l z?2YfOW4K=dDs2+C8Nd?`a{_Gpp=!|o5L~HzSTbqg=JwxI0YGFbMC0e#K#2Y$-PN5E z)MZt!|H)u#x19y)2BLwumO}0t&Y;G9mLvBp{Iv?XeLy&L|I2>*PkuMtZBiWPLnT&7 zJIp}PP&F){e81-S;07RRe^W$l8r)dN?GcY-i^5=d@_F12d!kJIJ+IFlN*ZQ*b^bs) zl%&sW^ygi(QaF=PhK*XI`WuJuv64f}HUjgpx{)lcQ2gE1Im*Eg=Fy+b`jiaSukp~< z5wp>HS*O+QQ*1LPn3L1@9*t16?Se>1e;NH~C%7Zvx%~lbxXBw94ol3!8FrYea{ATH z6SD-G0Zm~!oizeyL@!It)7QESRR!61rVs6y|M*d8p4H8%KgzrIhA97vi0eQD+0dlvE}(whj`}!ivv}2y#W;bGGq6*|#!#|G{&sWcd%z+@VLn0r;f$k2JeEdg+Ylo`yOG->!p}O}PS2!I6ZuF(4;2@rzp-ZU( z@!ea@)-Ib$>x^fgMisJmgF))TlTzjk?T?CGe->)C;q7zcse0n~ZYYY$c9zS3e-~PH zrUWkyt<#|gR&P{v!2bLb5Hx?DyYs(vJ|S2q%)uIa0Y^^#eR&t)ZtpD88S9WrAMUw(%rTa5d%&!UAZY zf+8`*h|q}v!<=l)(I6k=mnf*r-i5ENNZw`m?;bq?!%gQLHIpn@_1>96lIBUKJ`8{(XyArC{yLz(lk?F&Ay%m zIcpp;=n!~Xd|ZyjC`Ueyx^RurnrypFtT}~NJpVPE5;+n1Bq;WT*IQ>g_TDQkkw|B% zep0+Lr@^(5k<8MjPMh;{yyGRuH7vzIMRrAxU<89Jb7-vYiw-{o%};r1?5S0bZLFIL z_dtt18{}XBZc1us8CI~5UyyGL9zzK0UF$c@@gPOI`Ih0@ym*e~4NE^rONU!bHNBhI zyb5K@jj&ysi-Hv^(PBROh=mlS4I?;fex?K7|MO#=we~o|rgfn0&Bnn4_=FkR?9~;4 zUE&UHqCPs^>uCz-6PYW>G+L=oshf`12wgZ5e2gqJuwB@mWw|J5Hp+_rQPjupCI_5Z z3lV>NWU2<2-I&a+Xo6*JJ8$yk#Jk`c&FL!?V=_m!G&j6GkS^J-J%HJ z@?2`0@Zl|r9}=*{mp}l}X2g+K+e&X?{-rsQ&dti}M-2=v2rN=E71M7JdXVbOwy3M*GVh{%3W-;x!@_ z+gaaF`hD0;5bht%7<@hAc`{3u!1^H76C-UwhmCzXO5MFUss~`d=ma1N)u`V*8EmP2 z;3O@VT>(@$X)JO9Gu4I1Q~zh}HtUEKFV|zk;*2TJ)Tnc=6B@*a8s?f=)yT6k$LMu> zomNd%YFMZXzXcA0H^pw373|=$gWAS24iO6k-XwAf&{~NoU?wEP2N9^j>Cv2xS!heo zg=mP$#DtOx))Gs_bERVE3Ft(n5K6GGQdtu2i^mr`&OBdcD2frjhFj!d`k2l7*(?4m z*H|yemT}WHSHf6d6zY)nhWUx{AFKJJVCL|bdi#+ZAD#xpA5itysbIVSPUWrt>4XFh8U4@t?#nq0doSj#&3Mmtx!0QZE1)Ae zLP$K*XERbm5s%e1GQL0e^Uh-HE^ar?Z;FGC&tK)rf8vw5$`#!o#JFQ0mCK>TyGwU` z7N}$eA(l>^yj|hxF|fdaNJr|+@zcQvW+o_UUV7;Jv?iqQJYS$Dy&POUK2a&00B&%< zfSUQ1I?I?ymu$2Wh6yBhq3}U)Gw3{U=9)N5sZzB_JkZS6%t)CDXk%DNxXdlmPIcWJ ziG_2lU3i}JQ#G)mkt+(3pAx-5uXv3UBu%nEDSmfp=m$KWsW(f!SDzS2Fzt|&mUL0j z-yKk^f{Wz|a|iU~BB-T4xe$eHC;rGp9LLI3Q6`PSL~{y0?AUjK7z4NWm=2A_Tp;g&7TFKU|_r=k<< zU?w00vXM4@ew?X2DGNNf6Jznjs)!d6l3r`12bg(XT zG+Zt;e&KyM6cJ~v6>k{ty{nrRQM z*fCkCD*)8tN!@?rMZn|~v_U*u z<#!Y>E5rW|bx)Z&K^Rr}3KNwdoZIteVu9t4k|WyO&&2atpHZv>zZR@YUh>FDnQCIu z@@c@8(r_z^nwWxVafjUdMxPkOpA=G~C$MvsKn`My&pV&GbDQOH<{1H3cu9GN94VU zPFaok9fkRg9D23>+$70aHv>`X6cfo@5>Rb|mD-DWNlD_guS3CQ1->h5Z7*rg4+!2Q z;he&tP6k`=jx!66dex)4%~>S_ZYm@ZA7&Gr9z;_Vk2E5NK;yA{wPmsTcJ$npH{zE+ zZySGBhc>U_P;uvzT3F*7ym!2Y7dSe)cgZelR9Ojr@q#_~+bq{#N8(2ZJ29LhbHI519SEzNpMn{K3bnAxAfD-~|nI*iBm;B8iElu45U&iaZ4> zA^P^MA(6Td29&hI#2Yf1^S0Fj@jmR4;8TZ-g##=5BZJ+)-5-7w)6RY*+U%=qNptnh z3jK=Av4p9yqnK5D$Fivt+@Y}!iq7)Rlw6$%LXOP}x;R||Jk}-$P(*t6ms9wMnFDPP zANxk{MdLBk(|k%emBr5wfBJm9rj1fMTkrnu>i^z8l9*Y=Xof>_3IZU*y zbVB&Xd8aMPpmib3kv7AW4sDzJ(T5%e9+758ZUSsUXk}*lZ8{C{rO|2DZEjhp^wKKt z?6{7*x)3xw%nWJirUn{Mk-%c2lL%;F@dXnk|6{v>ymd&c3fS)O|3DVA|0P+HB<5)~*_oO4sYxM}ml3gZsY>b_A^FUYD9!SZ-L(f4 zUlz?4&sC%uUO(jZE9zDIxMuve~6uY4Y36Yzf9~&2b%^l~-{>Cq<)U_x~X~B9Wy2y%uERFVG%RIEbD)a^T1lIowlghJN8Hc$I1El~J&Ku@};#h^2 zRbne++ux`>JwJEP(C>Rh%#FEg4%ISSVVz8@B+@jzI!tyuJO7sLXf10JyhcW$9A)p} z%p_c#9A8}Er`rspY zB@uQ~io+A(^7pP1&9^FBNWFz8DW*8Ht|Bjd@&f?m^sI&ss`o_xL?es<@&j5GL`;@P zYf@?SE~=g}_GG~xCvG4O@_;Nt&hv!j2sXRhgXSwT99itkFeI!JV(IzvFL1J+Q$;@?cR_kiz{M(U%KRAs_i}jJzvFX(PZ4CeJUPAm6nb4Xb2rDM{&hX1h;QS-mx0 zW0*nWDM1{kz|l>$dg(^rS`23`%hU^u2UHH^(`ocJOft6BuO%W`8#i)EtDC8G#+>2PAha{ zMe9$D0Y4YRs%hrADnqq1&@$AquzSn3eQ~qKR8`_5RnBH$cS@ve{r-;AoC+m1kGW|HQL(OS6WMPXi>UQ zvcL+eUG`R{e9R5HP=zz%lLkWZ(tZhxy>WgWnCLsqSZ9C+BAT!g6A&}#fAUTaAV|-|;#{BM)}=hj>}7Qn zOXSeuooG@9$!OYJ$m&1YjA((^9y?fq`y(^=qKA22J3-O+Eiocok=|7qW1%AUb!meAS+?+&$f3;?j$ih)MU{QddE2^oO>BbVbHCd>pxmGO_ z%tM$wPfnIIqagHBWl@+Nu(TO{KykHuSs(3Ir3|Chln~I;Z51>;Z4HhHQE0|0p8^XF zu?)Hgx7c0E8M9mAPyTf&1kaRDp`}@5X>-wYt|HyjiuM3-5x^*xa4NjhM16Z7I=p)k zp-|L3vwc*m2{mYfz{_!bF8}lMpdfZ?kRHLEBoBNbiVP*XzG*||5zpta$x?9>>WPJ6 ziZ9!aG^Xane;WtSiPHwGp{3*6de)(63-0KuT!;Ull2bMW>P4Pg*k`V^s&X`@@G4aF z6HQb$JX!R7mTk`?F4p>XRD?W5vKFHU@~Rmau>OL}|D8hyS3)|G%5!22N7#~o`1Us; zmmm8RQC|d@Y_KSK#~OV$m@-q6XTk(Vigx08Y$iYi+B8=sUszZgn+5r`K{Q~GKhRCD zzUuLcz7#4Uem5$;l~t5U zq<0}aZ*}gP;NU7|>LYt15_VJ4+H%Jik_9Wr7AU#Su`ZH#Ey%tdz zg``H)PKCB<+~4Rkta4zQt00rPfh-rYnJpHWQ4b6ayyr#ojkyYCtwsZuN-hkA6kf10Dn*`JVKNDTLA5!$5tnmU%7Z(m zRZSelk%^~o7`I;MH-UUDTGx*TTe`w3`J!#Lk%b4Zx>QfR5q65oPzsf}3GT%*d2g6k z=@mjxeQQC9$hEab)c~L@sBJZu6E-iSM`t>5;QpS(h{7A*2m=wFyP#tSV86?m&KX4e zP>$n`UIm6nEg!Vy-`gQ(fjhu2D_cW3XCk&&uUC%UG#gRGME!#$xut)qm2;^!b@@99 zPVf6k_C924Ap&sNnL}v;LWU1JN3GHm^D#%doQ3(SAr*k}Lb1|#WJ+5pnym$A!k99$ z{c|o2rDV3DH2YEUnJ~1ZK)LBSDOnYLgz}PPHadmJ=Q5+v$b?Ok`4`c>3gIj)yu~i& z#vmC`HP7g1A!z4o*XT?iuTlt<&VL)iT*v8I>4YV=@?2t$%*O3=LB`N}zC$#P)Piub{JP#cq!`_dWjKkN;h;$)80*-XrVljbA421{3)q@(q335*_ zhXiRK7Sbu-NwJPJZ-$R4-7qV#Ql#IT3P~A3QK=Kkj?gD>)z#cl8pv3os`MW_x~Q^m znguHF=poJ@FGrCtk3c6@-Axs1?csdH9fz4vU>Pk|u3?SfBixi(hk@7Q=tm{sTDSMd z%@N=GgAg3(@HTH{Fyrz}LeMmCa}AsG+hzcIqsvYXN8k?#&sTwxq7k~7hyhOBVJ<+{V4n%~w8lcPVx6J%;&US2K;lUB zVO-RfmfzC+-Sz?&N<9=^xiKmbqG^LcG6B-Iw8+zA#80kezI`ibz?!)n++LQjz1GnR|6r@36$06Sf1KZQ1LeaBc)LM9U_s1r-( z@G$(G4iqS~HIVXXnx@?TX`5uUVO6l-l#bEs7|Mac##Ez z5u#r5Ee`U6-bK*VumQF?EPd`A+5*-4Vx=U;hYr6>%Q23wn0C(c!UQk5>NG6MK7Z+GXGAaH6Bw1 zrsKH;xv)+mq64BcIeez{W3B&W*$@W2PdRAp13$pd7&EQ}fx16AQ{r04?aE~blr>f3 zcumKmmss~`Q%H;t2MIom?e{q-hZC7v6TS4(H7C)N?HVM;@@5q4@_w~V)brn88D>Kz z+?fU9{`%zXdpl_BY{ucn%pvkH|oPC@eArn`FKGGD#%aCnD zy`hr6v3=PRDTrbjNj?R|xiLP~gGScodD-z@WIAz{f1ud8j>~hC22Dga-z^{Nl44(` zQ&W(bKiQu~F!Q!$_6IU+jttWw%y4hBEVdFuYBq0_1~>Yy{KXOildJ~P=fKs^ik_hz zq&p-Hf^I$LH}o^|aMT2g027gnlT2=?OrDq1Tq#umB6CGw(s zRG7!hiaw_?!CwqCI+ALp`2V1KJng5l#1{XBxWJ!dB{VRQN%t`|Vo((#%vOYTh|P`6 zV%?r`j-fD)*HwKn87Y3J_zYVC@XJrWZELh2cSGbpTu#4ve7w8GNvQWb4n=}U%qN{6 zy&-{FgGM2#NIxyY$x_`+B5PgtC+m23TsG+{fAw7%ys0SHX%7p$&dV~G+m!UiI}`ih7v)Wi znEzotrR{erz6OTN3W;_FEr@zh%lwzmCKRvKwXHy$V2nh*r0(}4hmx=?Qvvt^DudpV zk9|peMXGXVKi{smng-#t^NaNqSP}X<`F2%3YogCHKPEFBvn_6%tW})bqE2dgOz6sR zO9Ag4aD4&V*PxeerqQ0}-wblHSh{YPt z51L1hD2L246rkyf2CXnwe%-YwxaU8JYII>GHFMhXikpDjA?^|>6S-oSS-dO^Z}~wz zaHw<#{7!Qg`TJ$qi|p-Rw~EXOEWe|0$TM)3GnVkX(wEGAM+M;x^!<5P9tLz7X4qJk zPsC{t1qg!b%!!=uGm&hhqLY0;XHzHsEi)BcPan%T0TI_06~<3Aj=I;9FgjwLk;Xx6 zMxwG+_zfuLbcslX6>&M_mj!|lWtXpw&QQxOg{a0;J5WuOTl$f2|S9G0cf}_x} zSsDJwfimeTS3OYV%G|yrvV$FWIsb*7z;t0~hmcH5X;LZoTf>=OmvmIel7E{R3huz5lGe&x!-!3Z@bmT<6o7J|)4 zbKQC@GqwH^F{C%7(b$_rC=(eTMITF&%#3-^C4cyD)2lAr zMYY95oA2g-+U&>jRw%f8>pXPxEn&X|7HxK&)4mjKb~kfZsP9wUO(uEMqXPj*<|5?3 zD7UKPstYDFiDmU}9Q2t`gP7^fnx~xOSah@0p5W6m6Qyk`_j_2yKJHX7ICaB+~pk(BShrtVyM?)2hph17Euj z6f7VPEZdue<2(z+qJAjxLK}0S?i<&7!%zM>0uKKG*?iy(3A;;{A_Iey{H8Wx6TXHW8qAu>G}$l;Nbn**N?^=tT@5 z^-7ldulzKvkap9Z9$}><9AnoMa%#(D=O9~CK22qynzf@Q9sZJn)Bvj;c+oo6gj};2 z)j!QX5}8kPBWy33$rxpJVm9{>LQpJyz<_2BFRwpkqDAMG+R5c>=y~c{x8M)W4jQ5G zczuQf6Ss-cW7`=kPjXJ&nkEPk+J6#mZcSGb47Kc?$#keS0^%`pZq#qxg^>WN>~4m3bl7N?8H6{Ggbr_|}sv*i=6q2uy^^Aj~?iaO|5 zw>|1bE!R3|rI#rAfigNKMHOHZ#D?Yh{S>AqKSmsVcqWptJ>wOw#0W;cD{0?l+}uiX ztmbZ?#2+g@6ESx(9~GrO3MqD#-=&NlZnhVTiFYSH#6i*W@|?F_Qj)OGTtMn}Z~Yb< zDrtcxAN~7JoWdoylP^OQ&0Ofm&}J+y_$c_HIq{OH!LsH-;j;B5D_U9$A;=QR2=wYw zinql3qf5gbE!nMAK~LR6As5_skW&n*)!B13oBmGt@jN^mz1H)y|;-$sC1t1z#b}EG?Xg`!{>Z^EOVMCJ4tgL`gp@pbEka zDDH~_o0hT=yz2D-m`>s(tD`$@gCa!G}yZL3Kup0EX$;9M&iJ%e)5m=3!K z6uZJkAdW>og%njdTqqVPO)`t`EJg^tHdpq|qs`}N4fA9qKU{>!%>ESPF>Df!HIKK?q z$rGse<`t2PH?~cEwh8OMl$*w4dWlgXt)OH#enwB5zxLs|QBo@SmqC zf5^Hlj8;XTI7xHy15$k~`-ne>A}-bN?>^B zPM!a;r}{4a2myD{=qW0zF&4#Im8zmZF?(E;1jAYurxg~loI-p^D@E!6^cYd_paUUoDmo|@P>kJ#A`JrrA zPFnCMCDH%WKE+c4#Z`joDf@K2j?$#ikbv~xw8?&pZag6>HlCn;s*b4HFtJ;zkiW$l z_Sc1b;$4&d6&2NOCuOR><=s*^#AV%&QQePcR^q3I753rSgzAEZqbu@ao@cZ2B{AkC zAItu4sp?CzIN_(lh0B&=Y$szneS>{V3e;nyZ$D2;wl$`tvW>kq?v|Rnw5~;^<9{Pa ztl+bU16}}jzlO%yu$R7D8>9D%a;ZmQjf9E6nr!c?qFVmDWE7_Fk(6&faTq!2lZgrm zCv``*q*PpC*c(LXnmaj)Oa1EL?Kmx0eI9S$qeSQZtZClEzS=yW27UN5u$@5gZ2fNq zD9m$`Z&}cQa@**>E>&x`NsJ`EJenD;EZ+vDx~=KQ?Upbab1FM}_xox0->g>KTXiSV1TwvHl~tO&Fk8qEt>7@3dNES{R*BzW&}{ zoWZ1=lKrWkOY&w4%pm6Dz)WbF&LuB zCg>JL<3PH-YK-TGw6Fifw1odh(^*Be)plDLx8iQaid(UwMT)z-yE}yf#U)6Q;KAL3 z6qn-e?(SaPt(@@vGmLHsF7#oKsNct!}1oBrqHIxK$j#u zs%1Ee^9*(<7C*ZS;R`r2H^hg!k!n zIrO2ORlck8p^OcBFp^%w$!kQf6-ahc8@A)gxuS<>k+dvUYt;BuH$^TId-w0;#PFW~ zvs$Tc1N+wUD}-0X;#`CGq8{A{(3NZ>_L=%+`2Fthl1dFV^T3>z(dq9oNe`tAFsi-( zQ2Q#?&nML}kw!QtCr|&87JY!CDc-kp-!JF5nn7&|;Bl}K`t$n}Z#^gpQ!Pzx!0R08 z{J}-b4WCi4$e7VYj7vQ!yeZfN+cW9h`6`b*3_IF=tZM&rPTA)Aw42@EF_tqG7|jVc z_eqiv;H)k0jB(wAf`r>>{u!+}ib8t#unZU7EnvOt79A7B9D&YBcg;tuGRK-3A+Bz%g(|9bFKy6O%O zga&kP_o5Li=%fqVLz`h0O+gb#@Jm6Z^1+XzM1>NYXAgKQ#KYD8<%onpfd{oyywXhn zXVHZA10S5OoWHNw&Cm)*9*u7zKr9_H4y=Ev?$y@vhZhA6wx_r23eq!<#rqu}m z!h4q&$(+j-|m-^!Fx&{}ukjK+fgKCp|2d?y8ufblHn=u8jIPs|we zWvS6cJC+u2I}$okblx1slvtzPsmfcZ8E)oY6=-;U3@-fPRa0s;WTUsO zZATo^4|(;eaAuN^Q5%~76P6&BIrL@(>v~LI(FTp(Uaw6V+A=Twbd=$KOBNBP?RMGT=L3!K}-X?Xl0v4 zY%Z8;IZ4JrNqB5{hyZTYr{!tn3;@;zlB{)jex3~*AW_~%EWiYO3uO&QdxCsc5-f)Z zpp}S)IgL8PwP8HL`>q*jkZk;rk2RZYEH(%y^|qF}SrMGeBqU5@MB7K7n#UV;PQk}( zX@yMfLzGAv&|b$}>@ia=ClKWz3F}6hgUAlP_yPij-w|f7WVB8*M<#XWx|OM@>{1Fs zgD61zcbsVzH~BW7;DeD#t;DTQWOCW|9wPv=*b(i|H=!N!zuDZB#KXzpRBjYkrrkz| z*5m!L|FkCIxaU*1#LA}8{W@yiB7&)!!;yMaN!91CEr9TnRX~Mg9wRaf14Yi;B;Fn< z=6kseq-wfd@zcH5;IVlj1{Q9I6i)ddL0m7;RDP?$Rm$L;Y--Ig*8+HDE43l|i#!IF z|Ap70Ws!gByfQANnHGdms|^Un7jBudFJz%PEX+ou9BZI!-p#fAB_TgFi>RF@{n#!{ zL$qk5p)@3Vj-nQ->VjLoE(@pesYr_f3Ky$B-&Sv})HOAm6c}R(&w`=^?F0-Rs0eJ4Y8xX;nDn zB=Kko*S&w)?Z`2&7x}6~ir>Qa%K$^i-=$icVcB|Kt&dbOol%LS7ZJpp42$LKB6(gi z8*-l2E69T8Ga{I^5{5nKMo`)S^aEaq*7C?M*b`2C*aI9v%O!dCYz~h0l3>#zo>@Y=nC`q$?jQp*sBUFC1lqWW9 z0#tO>egvknHSUe8t0Lj1Fhm2pQm_q86~A+JkgJEcCBAzi`Dps|{=kI$qMGc$=GN9i!4J6YVp2Z_n3-*|?um}Q?Ce`F z_e9tqi0vP6c$gEKdRYzIJh2L0vZU+`s&LXu&gGG=wWnrWXZoW7;bhL^+9#-&vUqZC zSD|~3EtmXOnk=j4x<;zXV13<+=V|37C{|WuG$?;!x0(1a;y}hf0A$uAj74=q(s9D% zYyG(i^d;O4H`Y_szrVpLcTZ&GnZh}j2kZajDzPO+E-TVz1$J?X@p?%NMu@?8rNJ(Y zL2zA+R>uSybM+O9T=1iHFunMS-kWG&mT{LNQ_?iLwv`T0KqzHDDyE)ef&797T6M6NY^LgS~a8r4&2ld5=K8tI#bNq z%WqQdQi}2Rd^US}*$u#*Qa(n-LCi670v8f>3A%W5RCR!}vg!?`zyQ-y3IiB*CB&rT zQqmIINI7__C_}yz*ZeyyN~DZTk|>hgKS#;vLzen^(0&Hm%3}0!iVR`9e4x z1qZrsbJ4hp{(nR9Md7jBGA0tngm?}^)bWvBC5>n#V4I@hJ8!gv5(&}wgNhORv>3e; zTxTYS_?TnfK7AQ7cLZT^)^BH<(|67rTpipg<&q}rjZ3=^=%vh7#;#JBJ_gBz!!O@B zgkf-Nm-XOlpxW>{Aj{V|VV-E$?CHWt3(tnrV@t536oLs^hGYl-(Yr_ zrXsCQs40cIc|@R)faZ`Ip1v+N@l|wW-NSZsP2&k~VnoYPFK}?n-NGSqlgn$JgQVk&=Hrlk(&-TC+3RLFRM1nvXPAP1WZpmg zoJb3Cvuv6BxBu}xJ$fYf7`h$q#9b~<^%0*ESYpDpa*NmGCs=|q#>ObTMn?roOXhel@ zmW4~s#=U4v1%eeW@5vfPHOHeZsq<73^(H!TquGuy`}wKVQ^I|x?iC<+^3 zw#u5%-Ljv*3*Jh2w zE+!c=wlurPR(MX+ud*zhjCm*eLzezm`KF!$*@^cyiF(!92qYqADkXfs=rG8H(ZoWB=@Z1H@#Fho+08Cp*v!|H zppxo7B0re$*;t_9Ll=hS_-l}W7QCEK%;v9sZo(5{|D|*o5pVI& z%0)(({2V44k!|)aHk!{}!DLQq=mI8y&9rgVdVGYD=9bhLp1B@4MBH6g?I0{xgL|B> z!!t4mcmF;S{7GPSx?~XXYQ?w z5Hj~W$j*l<9Ra0TeE4*1g1%`0XY@?w$(2`{|8Ypna4ITx9KWT=nZIrFfz8{{M$=&% zCf|0JOd?T!05F32%RVkIav35{KOKGUnB5zt9na`cYY?QE86|a55diN&Ao0?F>8eNI zw1xTHcD8=w;}vP6&+lAVO}v;-)n>oiGmZ0$je2b)y7%1Cp^aY7_|52-Bb(ax3BbAW z0=6S*t$#fg$q>Z-`==WKf=X=C`+6j!boDIg;CT+?I=W!x3I*WotjneJe~%qZybK2K zsyRlo)aiUL3l5&V&M+3*jrW_=^#vJww=g;2UI7uJMVBuk^uB$kJ?;T*%cy!Ak5v}+ zitP$h)zFy3Ib*~b!PcaOLX{ROWS3nK4@g)4+=NsBQF20S3Z}@0R(zO=p8P@QBH$Op z!0Z?{UAZ~ zH-uOE9HoqOBT>+sYI`a*+U>~oNuKdh5(C12;I!K1bl;mtU{)7z#k=km?A0W}zAbu{n{KVF7ji2uoB*sG-< zg#UjQ08(EXnQ(ZXUumptF_j{z0S)7U+Vh3LMIxmZ=DoT%TNh({xNH)^S>+eT6bL(| zU1o(x4z?u|DNvZWp6%gjOH)Cjh(a0IJ|a^~~VUKUA&? zE`^rkKP)~lUUDH8(G}=$b;=N@1YC#Y5VQ2)UO6X{Kysb!(1CK2j1v8!((_ims82G;?NYNyMuvN1hlI^% zBebV)I3^;0fc~;_Q9GQKwhOJ%C|UE#WJnBj?6_&7bTxVqe5($?I`Bt7Saj6F86roC z7-SSJcsU?Rb8R~q`D;zq@^u!~1(R$Al1+T135*#WmHjQ(+}7?7$6}c!=k9mRjux0I z*9<#20#&!6aKQxG$hp!O`EfO5h@;euA%7~#ztda3do4@}eAT#})|(N)jKj`}0()n@ zpa6+;6V>IV;(jv5m?G{wVolqJWl&+GnW2>16`F>0Fng&%4&Z3VlM>{Ke?Al@V+?0V zW?-isc9a*BBCpwiUqSfFrt2oCQ00JCR5EvRLe)p;mnVWMJ}E4p!faPp;jxA ze6>a1^fQ-#CW1Q@sjB5%Sdb>6Pn>_9-h^Lc)mQ}qiZ=onG8@lWjd)2))<3eeRy2kk z*oa~?Un|Y`i-uclK84b1B{wd(62+A(WdYsNj?P zN~C9Kv^YU~V4a47S=%DbhhTA#=`XrGHtJBZs>~{J$7xjPgt_F>q5|VFSpz+)-}FPP zMGXmVCD;T^skGsXl;b=rN|F00G>-sLM-pJDOVW?uK^b=BOtm=X=?9;vSREHT4Qj(7 ze?!GSrVRs{Hb!1@8Gc`qZSW78k@|s4x$usMN6x1wln%F#6Z(L^8sO!LASzL0G*Lng zCUR}M^?bx~nox>(3Sk)?O~L%45I#MNW)vWY&Cw%JaVSJytXVWx*gjW_^)xKS2VxeZ zWPMb=hi2u>VP+g4`w1`i@hF<<^O*o330q=74<7K(s^b%!>edB#;U{oiP7T1nuCEcH zcBX(ehtot{TukI2?vkUMPiDhrc*a>kmYWc2KEfQjzI~Oqq0DmfR<$ZOz3R28ncH7| zmUWz{Fz3*?wvQ+5;yA;sZDC;GVeIM7DpD;6BbEUz_8sgJpu2|`(3f|nee4RG(*!vwqH8uqmxe(;>8$SF}*iHrypL2vIY7h7H8JY97PhvLJ zlHBoV^P&C3Th0*Ah@CkD<=!2|r!fDb{yLTgi!^s3YdwQL`$&?|(tB=dx2Ux4Vl^kG zr*OW^Gqmy@&lSD9!_SQ%;CjzavlOfdZ}%=?*vw8uC$l?hAz}cMQpwehYIj(vrt$O; z5pp9R5e)tpwAB@2EE@Q2WOz#$L_=ovEsDb}Y*A+Ubod!Dss^wiB_|DPy#w`FdXBfy zOw?x#_1tE($jZZFAdMPVI!2%Z^H>&f(s@b-T)#k| zMEdDt{YC+dVY>8;$nXa21(?AF`mZ!D1AjB4bD<R)G5q!mF-bP!?$<(sVVSc z5GWxX$08MS;2kaP=gl=sv)@_J4GjSz4WbeH_^wR&Z{B28jzy$m2Mnn`CVGJhu|Jq@ zC>kK3^DMRtL=!1*^4A(1z0>`huozJyL#;&iRPAsxpEn?`9?t=RM9viIB#CA(h<v03b%JP^6A$pV!-kvVB`j4O~qn0|I^G zclK^GyP9-T`q)hNzwh&~Wy|^!Wqt3=+4n3a_#C%p&;P$&^&K|?l(|&tde{fytGHM; zK{-Wgt<><+M68?8lQ zT0WcCW{^}VI$>?+Q@1|^0DJN_Ag0=~@|}GjtnE1-4YJ+>byxG>!HCGoLW&0OFm5F6`q z#>4x)Nsl~D{%U3D4Ei0ou{yCVCq#V_pVHckV5fJbc^zeq0ZGXHhgWs$s_Qq&*5bCa z`6}d*ImS#+>VI*+&(o1Q1;aNy;j=>qg8*{P{&Yi$IA1#FEu#Gc!*k<#oeoye&hW3` z9)pt0E^L({v-MP_z>l-cbDv`8fYLqi*F+HjZP^+hD%LdpW6puhYQ11p( z2ieyAqiO}6Bn%Jn`QmZH-w#88VLS2D@lF9tnqryG^R@8XHB)7iC=!*d#)sqm*Y_R= zQk;6p0!`+8mTp`~tA|?;Iks~t_=}$`F1lORM_D*`NN)4_(DwdkZ5V@aQ40<|r zAR%A-xzMt%v2}3|C!21HXskIkl^;Rj^L-+2R5?upU!h_ukH_~y6DVw;+J`I?iv+o+c_ zo$-_I{6lV&x{?i+{iUO1WBShBV-BLAbi{$-Bd$~E`lR4W_E2$GG=BU6kcLzw0a~zq z1e4m|LyzmHdVzT(H?*UJ)Dho&Ak=%Wv~Sb|39!OUZprpI^sy$T4RxB2r*uDSOJcE} z-`pl&mKnW!0n)bKP|alE!4f#ysIj}@Ft^4U2g!kY0mpZAXwQhQCcXY@qUngAB?4J6 z9Wqw|#07fYBJstISEGb_>hnS#~A9*oXy zxxIr_g&Em#ikJ4$*GHfYR_NO%qVVBdp9y~BcQT$IGe9BHHIiujOVP>3w-bpVlGcSv zY#zNpm50KwvEuD}wD%BUlZD1?%G%OtH8 zlvExP%o_}dX5D79>;DpHKw#X;RAd$2t)BZUg-@k3UG?`sf_!!rd1+#{vMoGLeVss_ zx`WykZFB;uTH8{H)&}C=8kPh+in)+qgzCr$&gYlSK8cP%+lmV*I$aHghiGT zAp!ezy5iP~)5&JyC4D!v8E>!_E+?mmgsO6p5gtMJg_HFfkdr+1#%RsRAIs0~X7tIp zX{WC|vx_$zE-$xa;++&3~LjT#thi}03AG~d(k;^grBw06I(dr?hj#TbMv-)N(U zz~7R7EEK2Jh)ve``|nvAfS5s6#@v%U?SH*0x$i*YYVz6KRo`djw(Sbs)yV`wS}tiOZO@Mx#|4poE#9cc6O#t6sQ zL4Cr&xC+R8B|F|`vNaZ(YJg3-^Y?isZV``D!J zDIexAE7K#{D<7Hp-+S?00`Yl48pgW%FYZi%O>ulBqs-32nD}AH z6u#G=pw6FLV@t`}vaG*>>#`7x#U)YUV;iP-^kPWtyj+5Z&gQqZJKZVyX1$J6%nAEk zc6_9Nzmo4U=`q*`Hl)YYo$Gb)dQ}=yBmYum@ddiaB~mL1YP5U9(Kr~4q7;$64FU&R zNo-i1LKxBB_QKi$h_+>e z)Kf+^T*wt1-9W?sf@C|AZX(;y>cDlN4JynMkompZ#JL=q5~h1&Zds=L8|^PzpcZ+& zY={<;4_wsSNRf#?WW##@w+P7%bQ``_8DwL^JW$lIg@owPb|YS%*1iObN6_9i<`CcT zQ7C=dIvuTf)dts*U%pvzl=T{@6NT6>=c?a(m%rzasa>WCtS#6o#DtrVt#!u}gS#aZF!|aLy z;fk41fz4nA5WCWP_K%Zpht1ufbm?4{HMWpkf0)!1Oy1CQq1ik*fKu=l2W5K0nP!Im zoK(3FQx817vjconf|#TO)RP^y0Il=x3?`1r;`oqKkNoxI-@to5>Ev=zy zR=5Q&&R`z6A^PYR+*{gbZzjLfa@A^rq?*5N6W);ieP*L=FJmimL~VB9kDaZN!hd@{bS}A{t*x|zd51w)7GZ5JH1!3`R#!uu+ZFSqQB>9SlsEBj2{dYHT^*ft^Z zpEmofSYppW9$pa&TZ@qIFh&5?zEtPXhst?@`Xhx-qx_Q>`p!kO`sK&pj9x{OR%&SJ z5@!A6~kwO9CROPw?*T#@lNcX%D2}PuiI3#{> zlyIxc?kdCFqK(|KQGQY5O}GF6XPoo;V3y!blg&!MIxOkl+H~4~k+A_WExKBBhl*iB zcj{Z-D$hXsgSwKznp{vkK?)R~$clA*du4mpthCW@TMP^kLK{|*y+`z!r%Z_dWlLou z+kT3Xr6BMBE>5yf@8h$D+IdHzZTB`Q69M3>!ownSV@rs}a|OU4XW)H@gVKqXcvU?Z zJd5x}&?IW|Mf^>B*E5p<{ly}3P~3olU46d}DrsuW^iR2wSS%P1I!A%BOt*rqY-{#Q z(8#f7bz zi;@GckZWkCkP;;4-Cz+&R|6+LQ=Z$!)r(@&V8C7jbtu*h+tq935pE1XN+Y@QVu(@n zK?yR6i^*!C>zdf})8k_xjZ0PvL2w3cd`JrMr2Kih`&K_PBpX4g?ciq1Ll-Jl`cVgp zWuU(?b&Z-gxEb}UqPILUV;IXec0(znV8n#I_f3xucBj{`<{NGr-Y8oO0iNXTpWfMl zL!JM?{H45wA*y+z3V7V*&eBq&k4jbmvr(y$v>~x_Mp!xcB6BlmFqde%qCL&B@y{lz48`1>k=mu%)}>q zq)2-`tP`bCcur#|LzW8AqchHv0}g5PbY=mPAosX#{q9MH(A70^@Yl(s;B;b9TqZO$ zh3MNg{_|0L$cOr+oRm;&D8Pl=;%QY_F72;p`4cpT1~o@}f$s2Q)~dmJrnX)0)K-FU zdjcIxjVus)^7p0iubl%p-a(o;q*1mMu6^5ZF}I3RyiRqxk>g9!S17S_$X(_ki1++g zf0?Mnj}Msj9?98p>0vDe$9D=`W44E?t1Z0XU7L|z6B^Z*gpV%Fl*IGS$!?T^vDh=b z!J-byd?3b@-%r}PRqj%__gw9>@=(Mb4;a8iEyznO%IvK|_XU9I*23|jwrL&C0u`7< zFX%++wM}9rz;Nyo`%^n8qLPy~zc&KHKfR?)L1%VAYrCR6@qRJ=rZydvcYx9GkiRvn zyPd1BWlgaE7Ze<@N*D6y7*~j~~jTj7E zs}^@a%*h8UOsDKnM%pKG{(RieVRE`C@3NI}2Bk-g;AMo;-&kpT8(C-Rqm=_c%S;JU zHFLV@!VVu}EVA7D`&&rZEm|QSLAqB}8MnO>J6mGdSE6t!kuHA1wj|mUn3#ISPl~b{PTwN#%_4_4| zpIs@K#jTwIV9;pDf7@=>dN2bn&XIYvv{R}ygXhbNHtFS102+6(h%b|KhLL`Y_j<53jy5`N^O*` zkbv>F?%Z!;*J@5S;S_9-sK`bX3|(C*sbbA$<*{Zltdu^FBS!O$p}mJc=*7)P9#4a_ zA5*hkdG17e|LmzW!yUs}IeKnCeHis zBc63*tvvo`W%OMf<3W}FXYKLvB#~{{!6j~5A3p1@uGmYYcW^?XB_Y-4gP3r)m^m^% z1F47FS=>!kOZ613Fcgl~GAewYlNN=&f%NtjZ1B9)C&-2Vg7qzxBQY|uKr{PIRRK;? zcvM43ZG|-nzeP?t`+4<%TG>xl<;%eG>y6S|9gOMu)KMBub|kD)lOQA%Hf)F85u)Y& zm@3?D5>(+q{QF{xmpIc}f%k!Gy8kgTz=bfu@;Af?EBvO`&M5}-AovNI&n#d}Q z#$FC5C+73abD@{v3((1ey3nU^Fcb5puM@^nkC2uzPt4H?N|=MmZ5|uKOhaZelzr7M zbKtA!J@((>@!Nrbs_45bXY8pzw@F9zspVh|{V@`%O_5g_G4bu4bh&$Fn1DDg<%Rc} zc|*6##8DDDo!V|SJH`%wA_^E~Dy4x7YJ4W{ePS6k>w{V$eN~AnjUsdUXsT-zN$&0k z>-X(HI=l0t33TFDV z;-?t-HRp$OO8~JuT;A6%Jr{8HF_QPXPT%Bkk!+#h?kwa8eNy}&? zFuP1V_E0L4G>G!WtNXv%Aw5NK8bn>~TZQ;+@D_Qpf04J@Dp;YTnz*FwQ$#iw`tIsU z*Ybn@BZ4Upyqh{s-1jl&x1$BKWXy5SVI}-7)SVscL#QI@+>rni*64jRs%fYS2GZ_(k=M7S%6LmcfD;*tbS%_2-&nj(OD0yIcC7oTmdWSGfH*3< zWJsN*SC}e@JC?Q(XQ5<|O^~z`+W2EdW1B_&K%_)8iv!%J@O07iJSkc%`5n+Uw&=qH z5)|#tp+!ElFb1E}@q4)^{SI%Hmz6QYe?r{LGAIGpR2>MGC_VCX`)XvUrG6JZl9Qx|;2G;oU!Y+hVUY#_S*;FPN}> zffN`-#wT{CU=}Wxc9{TfI$z8cy9NJRjb{*D!b%Wq7dmg;5z)WTbfxRavIQrlcG)$B z3~91ePkG>Dx-W{~3#-6jYzA}2CLIa7sz0^8>EKnU*m%6$_FC6HU8Wp`=2dZkaEJ1$q9rB-!Q3TO{Z`PNqDMq?8L=L4EUDR8n zUq`~?eP8MsfL1i=6J(=Xv+K)~-;t)(f`!VzUCkGVwS>ot&$Y-KMxcYVfv`za32=}H zlo{7mgR*@Mu3x83vhN_55Xr#h@s-Fkk6g^?mR!H|@H7Tf~2GJ5+I3sYD`wIP3;PNpO|bDN);;kXdis-=qC!gPD?GvUuk`#Dxum8)O~rLSTHGY zgk#Q9ZVJ0%6SP${utj`=)}@wOt)y(s_@wLGosDA7;<*cl>~q-mU&aKzt!d9BmNiG? zWs0p5wAv&&3ZvWtA}(iQl5G7{SNb~xO$Pl1`_3Y}^<=(%aZ;woEr1Oj^%~qsy z-ACL{sA9zE1qC#s!nC0e9QhMswP{P}1sn)NCjTzju)H`6DzrUACuPHvM0cqdnGs{~ za>qDAnLXxXZF@@{Ab0(YPYy~#0`FI+#g;%y#5%j42{PF=hYxqJ@ zN0|tIH`G*9(FEui%F(lV53Jg9WyeR}sQIQ`cDlJIDn71VH!)x9G(vursi~xQiNVyn6#y9l&jNu>g^e^E`>2n zb&Gg`wRHJFEuItSA|c|$#FiV{P_ho;c2>>Tp=2_*CCi8rgf8BUsbo*NQGQxCZ&^6j zjP>gMj$LbBdAV=}s?!}hp)UL&W~PjkgF66qN!iyF!5ZL$&Ol&>RyW|Ln#(D5R2O8SDE5bPu;22N@6*Jz1HoonNZW{Iie_VltZMPOdf1oqyghSNRDa>zV2Eysb)h{}xD>uajEB_UnW@E&)$>OF$UC=Is5FyA*kZzyrxb|AHvyG?u#%bUKB%7xweQr))Y8trE>$hZ)@<{RC4Ogkiy!lQh z5PpJi+nzq)i~RK#8;EjS@UJXPFmv*rNq~qmXBaG-Kc|I{Qrno>}hS!5Ji&b_`+fMI=5r z+@y58>0)>&<#}HpmE1Gzw?PWQy_dwxHrHe z3D&y;?usSG!WTk0J(#lo=_z85(I$5X$t-pr2){iVw3a-LLV{bX2SNnX+?-5u#@qq! z_mub;ac?rk4gFyXJlX|_{_|WIh|T)<-09asRYryPLzZ$&{2Zr>IR_0BWUcSq_h=h4 z-vM+6A1Jts_rMh-RAax;%cW*FVdQ%|=j3;tZea8<8u;GdSB+zjF~qQ&g$|+}~#%W1YIhd3D-bp~ubNzlHu?#)jQbeZ+{9%3sKa z68u=O`myiq?UJ%^P3XNw@G4mNA($)tM>kf^c0QahGRX%n3d`1kgz<+rDmcmix(bscefop&tUcs2(oX0d^OzcmZIb#19nbrAk!k8$uzNnudw(L9ar!vLU5i8v5KxsO%gB)8Hf+C(zlxSE*?T|*mrYU-n%ccRr%3vIkq;u~nN=A$`6W^xO_x4wwBepBC;Fr;^oSU*|^z@Fm z=Z+utEnM%Gv^2OhDvtT1-SlZ@s>(mkm{`AVJRUol@dNT^-0*Ow=L%LJi;QUFfHCUN zIPC?LXqn^~kSHu~zeb<{{OwNh&NcjJ&n~U@E4;yX{nIdP6nF9JcoWC({XI6K6)5Dy zq^2~1Z{Ar-Rox3075RSa4MQvW>X{+J#EU^zxM6rpGj^)O-^VG8uX+LRtr9=){_0e( zV9z@?CpJV197+j4sjM$weD4s7#TT^`HV8noZ9?S5m*`T^|(=*q)*u>k1UjO(9QQkm9L4teZt_l_Xla)1|-xh)2 z)-R)%yv5M``XZdccs7j$$szF+#5T4B3CwD=Wp~HuGe{TAi~gM0k9(u1LZhn=RxY2b zgzT?B&Q^IP&5w%1S79vHPvE5QXTMPulr3OeXN$Ne-I!4GpW=v(GLD85E-M;Ri7uyp z_1_`cSkwyd94x3KwQu>LH%@-N1|i58DuxqJBdV&wS9vcQcoyyp5EOE!6pP= zCw;#g%i^UWQf4N_3%ccaf{241j5^3_uNqYKdS1s0@cv`hTNwV@$lQCsCH0qae+wzk zE$NIEqD+(2p=iF@&C~Ws$;XzMX#P53GKo^$QNpWWET_xMo0@Q&<3`tFkZ;Xt{cuPN z*6+qOYy0(O@8JzHs_pt{;Jd6=w0#jxGS>N9B%Q7Xr`o!Xny- zd7`uBIpdyy(+6O#g*$E|XvJ^$no`I@Ns=gF_p6PwrG$Z<`b>#QpLla>P1Hk=hiL-! zsE=O6cL|dKa$Sc)XeMJcnn)<#psCTiNXN=K)y=ee7KQ;OUZy&2FHMj8>Aw=mqRZLF zWMfV#qaXi%WR696qO>Hgwn4V^N!W!Sw<-~=x*}COIwm^j)dIcUCy=nB(!@oTG==PHp3)nHwYBkGfYRk zrnzDv{CR{8961R@X3=;3@; z()J#56(9#%`*-~z2sk~$&gy#ynad}`gs7d)LLcVDYUad>Af|(R?1F-@kKZr@r2UfF zF+v3zol#G5NRU;LI+^BjU7lPFmA_BfqT_uAv`yGC&;?`z2D~Ri1 zUm5>Zi(5HB5dA7pT| zEex`jjZjx!EkR9EcOOoO^W>E%!;Yw+-|5lncrHZDRDN2wmI!||y#*n$I zrBj;nkz(OpKy1Psf1^~I`rw&Kui-v?MouO?E!js9 zi;)*xUfOT{h7@94blWF~KWe$?puV~Dg5CVx4=Mq%C}s0k{>lN<5__QVcXa7cz~_Em zj!zy7Mf0;Bwtcshr(RARSSBO>#XReG{5gg}MPruTFxB=7!W97LoI~4XLKECkcRq(9HCer{(TxKeV@bAZ4 zx8-tJ81OOq2aK5y5p{<^PtgCVW&KjaYiG~JbEn;s|| zf9s=zw?C+Zp6tCQrO4ESWjJo}aI$x|A7YkoL+jCKTY_RIijz~6)N*5QU)-!Gi*U}P7@{oIXV$jS5u5KYF}o& zz_dt`4n1zwje!AH@Z%%5G@M@R+^$0ku#71Kb{~hj&dd5d&!*I%81 z`(ffXp%N=j!-vH@pnH{AtNMhK{Z;eAV6e3cj2H{0J3-`9e`p=o&!wlF+)}s6lk_I{ zr?baNGUegpu#6vet^=vaO15_qAH*qsdJGVlrxy{71NQ1%;!Z{ox}Y1wKrCgnhGN^g zqe#*z)#kg4b1tU>i0I3)Qiz=YROj)^O8ME9P5}PH(t7_q9V~e zm+oD|<%5+gHz)vuT3Xuj! zZ@8qoGGiJP@adnK^%YS4^CgoZ7#r*JhMK^j6GydAEaeR8i2}U4CUYK>2$x75STNo#}LxJG#?(P=c-L<&2XmNLUcXurmcemp1R`e}aIN_T)`Jc>W z_D-I?*S*%d2%v6ORG`bEhM#gu(5F$F*-Y7U5dy4GOruc!P6(CtERS{ekWsOYa7`mf zI2Os~pZF4-9-Oyp=%zLN&A267$YC6~@gV~86SVinXdp7wq@nfR$LntBtclpv6YQs5 z=j5KBcgr>ddwPR}5@y7uzKToe2mMXid*!E4d!W#ttrRTe4ty378%i_I~fQ zo2ZL0cKj4}haHFWl%qha7a!OsLH9G|Prbl$P1OQ+^m(*~q$oW@Sguzxxx}CP zFIqs&k;<>Z&sLakXEBwW9Mf*Sm1n*j*x%Xc6U7&&%(7yY2T6~HZXpih5#9aYPj7D2r^Gzi~uhP(B$nVlT$pK}A{m8TK%LCkq7J}(TZUCq6RjOC82T(VI}&T|(O z9zOIhB4C-)UohHLK~e^BY#wL(S;{)7y@YXNiZ%-k#3Z3m`}6}A@OwbNqh_u&f7tKR znWp6b+d?x-iBY|XFvjH7#SEHuGnGXPErDPcLIYbe3n2^WunSfighL+(wM8=m(qW!( z!e&edGPvyN=HCY*iM^N;T*}l6PU3Z6q{1PXpEbV|NK$UsZC!PhLQ4coH4FP_VoHIU06q4XRUv~{a2tMSd|)E%mcAJkF?C#tqfj0l4o<>^ZDTi8x8r73HqX5y0nkYvDvCT z-5r4|238z{&<#AJsP={Ux$lMi$#+|vy)g;I#;Ci>KmC*o4fddy%2h76>mPBlXP|ZO zMkoLNJP{HgOnFaONVRHC(#`u|8R!}0f4W?9L4D?4`}0!w=lp^oDxzA?zf10wUh-Cc z9$Xu$b!oy2fu*!@a5u>!qq4EqyiBtpr}elFUU{v4Cw6s!pnJ%MY}%jhU$5O#qv1)5 z1BIq@z1UmE{TsxXcLDH%CcUWYQ6>=llhfq(Hz@zvJ{J=|(mo|YYt^CWgjj4@ zUA)5hwhJoXsO#h_5aXAQ9MBcj6gSs7{SGbfKQ8HXLeP*i2$G*b_}R>RDJ+<7c| zo#49I%B&U|vj~JUJpL!!Gfm9bMf-Jhh*Ci9(wJa|?w(CXDMmPr_jizoK6aVl05|5p zCw5(E8_P(57#0ELw8H>WU+@o?vT;fsHFC2!`fH4MQI2ymHS>8c^)tEJz1}Mh($8(8 ze8yd2L@OsBSzq(}7uX{1dE^?Ys_xwydy~y@ez%zSA1CbC_!ZKngNd{=>29#b;$JB>;w3kva}o+j!I~3{09%+ zm%_eLbRwW7!?pd!9CD(^9AVVyFybFr*C>`>x`EA;;tP=x*!7#`yRG*_l7( z!_c+!f>n=k)vKRBU(TyB7Q{QZm#m^i$}u3ku{^)+Mhv*>vqv_S);|4@LIfQjJSB@k zW7#Jq8MO&<2(!&18By`)AOxmB=DvjYmE_}TbVH;~#w(#~Am1|f%ln}z#9$<;qkMCU zk&uzwG?&&1xX%sqUk2Y?mUl>f_ccErqtbtX8Vv`cZSckH`szWjYR2D}es8-(qOn8RR=;}D>n6d!f#=vO>2H(e8V@>WNBG+cP<-wV z?3!$*OHT0ENXVf@$H?91F$}1)+RsCURfqPm)h$lBYP2@Z*WfU(54bPwRE;)&$})&l zo2nme{+WyxPlb6rDfRKOD`69QB*aC^P5nVFA^(B(FBlB8@O$n>`Xt+_SJxnIBu?C7 z9_1Y){(FcY)R~LA)4!rTIxy6#=Ic#WqZJp*Swtm9A`PoSJ4~%7+P&S6gje)ic+GzXD6cu(Tn`jbv|I6aoy2Xf| zmd1vwhsgOLmZz%Gs1DsUanOqEuj{Xv0@CwpiEm{d}!w1Ntt@oT&m+ zk9*Z$4pHCoDfsGR_~CqE8MOt_T#ZzU+z`DnSc-D+nu=-=6rZu8jiBM&5LEi->Fdo` z`*&l3)ON#4XmsJRMKQBr_My=78fgz}M#OfBsbSiZH?`6ifi=P3SZ6;iTE1c}nn|97 z(RR>-8g6p&Pw~~nX)tKQr9SS`e<2^d0VLwhSH-Gz)x8<({urlBnZeJXxFFz<=nIsP zDy}KC#h%LUVYhCH)5KZfGPWP>g~&aH4Zt)l8M``DN&?gl873z43g@0!eA3jS40LE3 z6Z}#79YneNIKL-)({76I&a;y)qrNl$>$#FF^uf#p$h95W>_TX&Ng}M%N}gA^Yo@0bc50s-1gF!D=ZC>%oYDZMU+bbkWDdN zFdET9&Bwd~NqGlb!Xx8omZq8PC=%CdWB0YORuOv&$vjT26 z+1LWQHr9xxtS2N&To>pN`mo8TnyN><74pbH68`>|<|M_wIY9Bpn!O^H%=E6qE{A&K7U=+;u>s=>TG0r zi1y(IM>ESebqd{rLM^;=rVx3aR7wC!cQma7C6G*H1W*}pOu9h$JUUct zMtw=-N1H0w06l8iTP${$AXbU!u|j|r`@v3V&*=z%7d3D%-NCxNCl-wwJwza(PpU8- zPq}J0OiwBEue|-~MB6ZGA6cpD@?NcP@MRYuL(qHMUxU+BsrqKAEH% z0H6Cp%OU%SINH(U4!35Gwqz9hg12wsq9|BIdQUsnl^8B#m4`!=?1+8G5KB>Bc}SxU z5x)PU<#q`B0;IE2sx+2^*DZy&{$c({>4(E~m3KVN-*+5o#q+sS!bs_%kO&oxH7Y<* zSZ`&KC^n=R3?%?c8e8QoxG+@(u%N)ABC3k3hzG(r2hT7cA?KTqdu$W zlkb;BUp-@VKfHN>?-sLTbL@KzywC-=^;h3Ph`Gt7Bd8`w2BgCHirqps!njvrv{B#U zr^3)Tl{7#DAW6b!DGkk_O3WbVsw`Nhys9V`MZ)zob$Xj($*bASx0b=kfC4gF8ZKtm}R!uIt*vU$Km=uiNWz zV^3S9h_Z9jrE?XVuBk1$+Ky2bEeZv0^tNBDQCSN#qal_!Fk2%+_N+ai%JZ;GS=a!% z?Y@}orAJ*N6!7NA77PpupOt*_r0unnWc8K*1}0g<+kCxuJsZ;Ey@Eac) zkRB@F^|7}}N|!6KgT^7rRV|gH4(F1kKipl}PrH?cul zY@HLCEjN7mP83*TY829<#jsV}NwHmr*?EF&15jwjBJ^RLZ83Vb8sL|p$$i60EII&R z?#*pg1O7_oW0_DrDmufrqM9Ml=D&fE%f#=& zX}MnfTP=YyI*2-#*%BW;zEoO?<1r4|cFc=w@4KO0pQ6i3dWK`!12l_&3(Q?L=g*?i z$Q~*Tjm)t@n7s<@r8AgCn5ZG{onkQ!Em&!wKlvv6&dW)Ya(B2%p)zF?O|piVE9^te zW;v7x3&IkxZUmgu35=SBcaWnoSkfU_H41CA`PZbX=>J)zz&{^DO-G66APyk@y&n3> z*EiIgTYQefEL^FIRp42ALo*PTX7o5L%2X|Cc^i<`hz(<|yQduD_W zG^^DzE2K8COE~%GevHCAPCfAnX_BHPH+#z%XNWCYXaS9u7zB)nhuI!QP-Xp zj$kL;|oupfVmT{ z9$6bh`~}8H_3R%!zTggn!gt()mJC#k$aVp!QOl`g1`x@LFIfMsJpOn1|6Kql&^yBF zkWm?3GPR;`W$`#hUPq}!_f@5zc{VMs6|qE`vdTW+)3s629>Q&3Q+AmcRf-q)6Ww^jit0JU>5)7}1naU0B7$+l%yM#CQkUypc)%^63@YexCVOrB#|piJ!MIy41^BDl6|LzL4OL z^F4jIBAjmHbG-c-oAkZU-q8qai;2W{J?Pl_oQpm6(ZWq~Kdqx~iCMhIdZU#*HKW88TI79dR6-3b8x}(^?;bK|L&v;^bE*j5T~; z*75xoTL?BgwWS}QzOneL8-p#HO2h|cJzKXeKgI+;GwRy)U3+PMLyW$ zw{}!xO>g|NkiHGB;RT=P9_4?~$-~9*HF^8x{QdUh?>GIM&zzY<9=IeV_qQu|SCPr@ zilUwJ?|xZpN&|DfxgE$;{2N#_OwgVT8(K7hv4j5Frh!fpjp{Z4j~MQxrWOr%TTXO9 zdp^)La&~`TO$aLazI9*fgv0DGnNrk9;!CV-2eEyvLMM48OeZ+!Ch{s|nh~9#+LLIQ#hX@V0_gj*W`5#aoCr}zanL(W)l@OW=kr!EC>u%$d@C~<=oC9t8;hawd6Wl#;9Jy|vu9l&C6CiNwD|Tv1wga+uJ+gGa0H zL*nFK5G}TILE^F|%(o=ez40f#=bH6*{-_mH1bW1W=gi+aC$o3ntO9Uio{9{Tof2~RlGb)PJr~8u$%O>HE-Hl zrHE0&+{B#xS3x$l6gjM06?5$Xa*nJfuwJj94^o@Ow_B3VtY#iRbz`@3S&K6)!a(O& zcj+2p(@?;(q6*zwBh<;rbp|bpt6NM~l-JH&E^qrurgfCt-5QU0x|sgKRRy0bUQG|K%(<^Cxk@9^o^ZDz+^{Cft_dk*Myt z4iC-O2;DEMbP4z*@x`E1JU5B)`nG|S0-TUN3iJRWe)Nzu!N&~a*Y)45(VS9V#Z=Pm zVP?bRH27GFgrbLTT3pX_td@OQ;kK$6!R9HrFtBNtx;Hh=854oZ;ha%JIxg^D)}jjm ztcCLs*YEq3Amz|Z_2#0UK$8@$wK0^gvIPmruX!F_FJ`8tq6Q-_x+TwCP;U5a>9Avx zxPiriq{y)ilQvwm;lKV}IdwnGwQKw}i%c%MXe*t3R+Z`dy$eAij4FpKA2?t42Pn%|I?l51uQch=ri-glS*z|Q*60{pAtF?pKAt&6nPnGOciD}Jtt zHecgGI;aOLLJ*QhH_FpAa>btWE@-99?cIy?f_*0uxoBbx8)ntWVKBaJR98e3a zHj~q0Udy`it@XKda-e~LBeO5N-8uI)*s;kL9ivpG67diSZfMq(#JeBgXEn+2qQUfX zg&9@rDi}LvSla60P>w*BT&Jcm3Cm(XaEAH2ua*Ucp|lG!#$Y0Ux)##F5}K^EwYbpQ zz7ZDZv5u`AdUWJmz-heFlk`oQKrYRC2Jzb-rC_zq69ZI4>NrDE9y?-Y!1r5)g2_Hu z;$z0nTvUrhM^iNxsi*TXQ_Q)TDm)4}T(|DqgvU(zucwDzN^w0GG}_yG2L*8ty0knqth-6ngVJ^DGwqA(A(lz zc|89PNo59ZoHfTrv;W3ZSK-FEYKVyY!Vfz7Z*cbch|LSQb3E2q>PbASYt}9#yK)Q( zP5b(IZo@~>>mZb1ho|EC#^`xdaP{O2J_7QF=b%hd6cXh_45LO`25@*wD{Db9NX7A4 z?Q+CYZ|a6-H2>o1Zthhx4*ZBWI97Xv*UpyoptlZ5+rT1<^JV7fymIsEqmkCx6Q4X9 z%0ozx5x;(vhN6@~hP2BnMC@g3L$0tcr6V>S+NJ#A=+|IfDiBvXDUo-<#hl82-EZ%3 zQa+azl-nkX!D`_#ZbYA<2Le8ws>RL>VT7V8SDY}Ja=;EDO-9kos=Eo$JgO&!$tB{V zn=wUZYJnsO|2WQDTKaC_pK)XHS|ySrx>2P;zbPa4r%CHbX5496(ZYQh2>Fu)F^t2G zY6$j>LxASRbmWV;eBDa=6A|@zZ=Ovwgaa*<*vA9t$Dag;hVXZ&w_SXWR^RW6X8U?I zdQQu~e+zKC|3fT{^{ttxmZwRTo&Vt~XLV-Ki+`t=@qA6wdbU;fpt<8dfR9nNlwiGM zT@@xxK4bgq{o!osJ;ev%u$ana(mqD{qbVvd|Br>48AyHT%r!Ii0D7A{$@2T%$llK@ zog)dk5t`sUEN~IUd~+s9PV{RWxQfkAcN!3Qtmm|J1b|;C9rEr^Hs{4b2e5B0O7kkE zKPmKy2~)ewbeUx`J|?i_-_z`b%!ywm)kZk%AVV%C%V=Da}jnm(1-pZFtyw-hPSJcDW1 zF*e97LaY8<$3u;=FrsQS>h8t>zQ~jmV`9$*I&IHT`a!?K+l2I96{Ph8Bi76_hl9XUj%j z^1_QNC1hs9U;rJ5K;IJ8fU!XxVG2j}A&4C4BzPD(LdE{Jlp(sf&rw9?RK9DjM#mXg zU6O5Sw!zfB@rE>(nXLpcc^eP+rd<69c>P0WiP?~*fCuSkk2l3MeLD%w*R|(4NxZ^Cy-f!86_7oBPKx@pxH4eg+@fubc*{ z(lexH+0?PD%&arQ=yv@6AJ?~#{Z|8-Otc@vGp4sn4Km&Eigj^-iGQf-$}y3;Ew$F^ zPp8aGa9AO9+UD(*B??VKi{3idbrhX6pZiW(Q+a?f-!O)|;7SN!eZuT1bHXy))~v8d zw(#GgT|^vPc!=MMwEY2dAblzy4QhV}EMb9qiSa*fh}w3QtKB{q{`rju93i&m$%+vY z0bz6+$UV(v4HJlPd@Oi$7=VJME6MGG@~AHK*ym!`N(If9E9cQa6fRzVdOY{*{^NJX;y%lt>fGm zGTGZ_3reZEQ@Q5~R;s(s85^+V?FL7_-Qn95Z$~eDQ@AiHl-bny3IDN^1WJrxPa-5x zH+HhpDYi>u%(PgT6+LG{+W<)mlAI>RC3M2t%9WMi{wqBn&%7umZxxu@ws5mOFrvS- z!0af#zsi_oEf(Txw3Qz_w9r3hjpHB0Q(e!)YCI!+B1ADNH(ioX@|lU#b0?LYlrkNR!4 zJJdD;D>)XPM%LMe8(J55*-PXMj}*+h-!_Gh+2U^v-Iwe;x!cWM zK3f+?%H9jfZ~pO4w45a#b85HIEJZ$_khsG>k%4_av}d&!FukO(7p0|M6}tnZC#58_ z^YQ0f)r%YxGhcWNd0D`&8iu05fpku%B;&t$E6XQ^5Qi9KaAuS2;LA=P+kfnJX9y#iM64NRRK0%B&>}sJ;!JBfVc@pK5b0h zBGDX^A<$~n$y@W^+{B8SpWNc|;i5R$j8AgG?Shnz-MhC)WxxN)z1t=lmFw-dHf)t= zXG^Mdt~9Q8ojh4sSV=mrFTAx|Djy_6Z%S%(r> zi90Gc#c<@9=5=wYfx{Tu9OA#cBM^%D81?|1p>DWqhy^cwJxHAJU2{s=fzuRO!2MJ zj)}g@s{hnW@LJwvTF@$sBT3nJ&W|0(cR2fv7umbTKXbG& zE;;b1#QHy3>a>A8GTyOKSKGl1p+U}|3(Sx{U0B|gc7()tuncs=&GUxJItFeamB66M z5!^k{@n14zR&>hgse~bMo+`vpcrHxNoW#&SV|Hn?J^#7D>$HNY@{m2f0s$$h^zu*H z1BY!u$uCgDzZ08i98?cfVGH>8{`XgXmJAPGEsCcm4yuz76TpbA3(F6U!9vfZ8Yd&c z6y8@vCQ=v48vnNr+8p}o8OD>ZsOYY!8Ep2KXAJ{8NXNeh@+Ql{(+)gAWYj;CRR1R9 z`ByKY<3G2EyFwT$kj6h^txw4lqCoEFSXv9#!L8FB>&JYaSD@lyVy3$N=~s)skP!Dx_-nmmfjH>09Y{mn**?QfzSo3Yvi!#K?Ta&%9$>h+nfD(J`G?j5R;9xVVH44P0Sl}Luq zzNDpzaaCT$nJ|(4YvOj93EJJk-KUWACfl+#^wn5D3}rxNlmZ1q)-VBFBp;qQ1nbIu_jff==2d4PxW@psEW? zSH~DL8MYE5Gv-zI?9{DfdEYMKY+r0Tmk5*8N=4Yn0L{=DKTk_|*oxP`SPoBqnT$bT zSBGl_#4b#CmCG+I>yfXaR}>=f{(MFk3qVWO#7*}Mr?#@`o|P!eMwOEdwQvx(Ss73+ z%R8ZHrsQShC*{ViBW}FJ**WJ^Rl!R?oRU;AHe8vB1&OUE7M-Fe3uMz9Ax=ss%(v{pDLuk}`Kb)Rp2evrd?eRo4C&eUBdCoqY zGE)`0jN61|QMb_Q`Fr9ZVE2BnwH~U#%CIr5#qbF7J1i!ea7yGT4~yMmJ;lqd5#Fw0b1$eXK9=3EEqxx}9kp^`l z{Y?Yf`X5LBbBr}5Vw0e$crv2DH#wKBMhDo#V4P@FhlrT}fy$)(`zOt*SD`|Kv*6F? zm*2mx6XT&7IhEwgC>mz{_`kt26Xt1oyFsuIv$E~+9_swnfXip5o^tX%Af$}UbgxU} zf67zid6Z^zAy}UQjZ=>3zgHUygD3D=crxswE(qbneK$YvysN6m74cOH)F zFlbAw_>OqmT!M(#c~nl;7C@S&X!F!UnjxJ3y9H1SqT~8Q>83f0H9Pgm{laaIK;H&X zgLo|1=bEmGwgpd^;4@C~PZs#SP|E!`dP;A&r&qYKMnSqbn9&JTsADwwx`}EMIb>ls zWGEzK80=X-d2vXa#b$arCvCl{e+&tDsL`f<>h0KLi-|%S*LM0tc*p@ay)0_IS}AyFZO6TL_HF^ zC>ra#P9MONvUw$qn+PD>CO*-g5dn8P`~*AsRS;JL*0bZ(y1$IBGe}XBwV6;IfA(ib zJSM8ACbZ}9E1(J-Qd7~xae9<~e1={~@|pz%RDlTYsj$e;&KsKAhDQ|H#U7lhY=t_v zQ?KBD_Z+PGTZvEwhc#4Wl02V2XyRSIm$Bw;6PVio=)|W+)G4|a_4yS!~&HE>Li+1d8^qi6^mCS9Ym2fQ>IjD~f|C{I|vxvn(B6E25@Kv6B*Ah%=9&+wzP~*$Yu* z8AXtiPCLxx7@DRQKY!*8{3}lV9M_;&q!i{lSWS4&XaCeX2IqCmQu%#7xuO!}yh9-t z;iWaVGeDo5zYg$&_%4|ef2H%B1inYIC58zneW^7Ub@!yxzZ~KiLqb5ai3-6$t@N`3 zvyH84)uLA;h55ed`fs39v~H5-c|G`yN4coiq=j%o2uv3)Bm>sdR?%sDHjgQfu@|%^ zP@YJTyv$t~e|Sr9MTPK{{dL)f7rqI6-$A9u5k6c+^kp7=C|d)A=NCe zsPN;4ZG+whOZi-1e}d&w?J|b+J!l$G63upj_1_7G`iDxhb73Ck1@PUFA2<2}Twd`2 z9=3=Kd(&|tmZQ&&mtgiteyKh}aGqeR`Er&4P zuotvB<6j~B_ahmZShuqZ+VH*KJ?-QDI{h$A^9e`s_BtaeNpT;A*O2AoT2{{GSE#VT zNmUo4O0Om|oN36NwwWF;B-)8RknO$C{d2h!!+V^g-+8{*l0r{@q%O6QtPt%$b(~c4 z1693XQbcantle@yqwEAsh*VtE-+9q`q3^n%b12$TtDJA$ z6`zLu8ei!jW&WD15C3cG^poOPQJcPUVlv|1_3KR0>8>V@QuG`Wl@a~z3?t@$q`RM< zE7oMn^_X|#t}1pbpG^*F{m4uR=QRvs7TX-G{?|1*YPTeY!o}m>kZF+VlUlWdLa5QQ zel?B)mzs5yuQVkW^}mRrOg|c19vtNEjWx^p^WRc7N^Ku3Y9e*YT;z5HRWE)qv>cVT z?k((VEI(3y-{eT;K(bSLBxk#RmZ9p*EliBRq5nIs?B66aX7a2mk7219&plL^V4kG< z;YHaQl%>#mhh+RDu3UegL#WrqDE0O8nrYX?SxDi%^(gpf`64xh6hY*Uo3Z zXf{Ab-uU0ScF!WEnn1evG%;uQf)t5AWE+mO04t?fGoQEQ;d65P2v9+N2$+bqAyb*W z{64)>s*X~&*|gwAJxGj2PY@TNhvG6~D>K>aB&*nmOYMuo3;N)=xRFh4he5sfdZPsS zSzh=uleww+(dn$TZVKGE-pk1=!{caT4n#!=Hi?gMdqI((Ke?CiMGC>&DSBVZ^Nw#K zWk&TWVnNC@bwPG~Y?B_yam0m4NLK`cqIgCb2%gRq_5BH;mZOuQzwtQP4XRECm2P4K8lC{=Ua6uhhMUf&z z@r%!5P1bYnXREwzLX7p)Q1Bk8OBcF04b2Je1v?KxNfvJ~H8(lZ!rw^fAh^rf(|iD^ zqahwKzfvWq0EOeDLMaiSQyga1d!iCF=l2p+B{6Y(FB_T3+4FWLz1{>#T5cOO=8_~- z(u`+q(vtVSaH&Ic?Mgs|Tq0E9M4YYce!=N1E&WCp(yKSLfa5c%(*Ofv zHjQ-x5hmg5qvUVR2(!+4!er9C2+kt~=CgTKbEQnpF&|K_9aR}4)Jy+Or=f&?ReKBp zJ;bpJp}LH$I$TM{0cBtd2isxl zlaLZQal6=nHT+G!!uI)Zbvu~5a}4k;UU7!B}D-kr^POw_qm4 zQhWH9qm270^q_nIzO341>bjD95`x>d9G{8?FpxQv!beJjeVDn$F6i(`l3>!gm2Mov zhK&Zn&2}C?CfVl+eZso(0Q2HhP|iirosW|#J@U+YL24-WwxrVvmgWYBy3fQ-!hq?E z2lULLHG3v>8UtGt=CF5hL?REpEer%=+8ezyDv}%Ku(DZ|j?(e0WLNSoVR4O5LoPGh z6s7=us-y32cDyON=tVSJBYXU89V6KT2Q2uZ!vbvV}V&AlBlEGwlhjnbTOSL0O-tjpK<7!uW+a^+$IX#z3zbI zv8|`#lb2b3^Qeio{ z8(C2Kkp=ZXg3(C76|IF%*CKW^j#i}htqnD*{<5%5Qa$t*$4(s!QX}Ll9DcA z0Wu+!J*5@D=m{~ghZvG~%ro8tv3-+n4X-5$tt{bzdQ^(M5Qa@frkF~k_e=419&yd{N4TeP?Vm0M5|OWDQwl zprJ9RRRR8UfsT`Yy|AfRv$HL<8CLD>EQ7*CQzo7yCr{Tx&XK~55|emmm0e_A%AvUp z$g&ythLA$Gt0XNg&;8^;I4rhzuuU6;w2bbIVjTi65)C>eW3yo9sn+SDfN)~ z0v#en27Ju&1I?{W{u=p$j(S#!_@TGa9^M*{LhiF9f z%V41|{Zu8%${C-R$sBrNva52~p+;P+TwIu3~-R`|7H9 zHM3y$ZH2$Zd*h|XWTV%*zI+323m5Gp;-B9Jy5ZtbrqaKk14~QzhpA!&_+!lRyeDn_ zER5l31`F*u-@g>5E4R@XB978(-)pJF2?==&knuL#%4KyRIxL;VouH`7A^lQ)p0&Xe z)25JsfHzzK``m_MQlT@BX&=SExG@AFN;QZgBZ!Ig7u_3Y$Q(@ZPvskk*S8p$1zEPZ z7nas_@N%HGjKGOC@TJitGswYN0`i%AwHPzPxgMu^H<78wbHa>XBH?&Fh^6T9C*0Zg zJ8B?Z5Jrzog$;E4g6byWmk37aMX&fF>7_1WzO!6+D8%-lX}cX$7Z z@`!EZxxaDRz2c5ZuE*^p^zsJ_3XgL?;0sZhezVHeIg#U%qm zS+b?683&lyf#lQg1Nl@Bw8?pD=OK`+<1Ffj1d)^3NHv~B^H_H{-KA|yyC2})thiT$ zph9n4U>lxn=0itv=6qq$^Z7u4ErS+=uwZFcq2h>0Ki`6guzL7Oho@oz)B{-p`~W^^ z6#x1T zEO*TfOtmuk)|^^muaG4KyGUH#{<=E+VBr`}INA^QW0Je^Mwf#&LC~pQBppOl1g#Yn z@NsE{yZpwy~ct=R*O3Shms{sp0jNCLnrM86g{=0lWs6A|U0@EdL&vyl~RBR1>VMOQ9L-+FrLQ7kPS z(O^!jU!}hu;N&}Ox~wxev~qMM>wvKcI_v@f@D=L_iACTGCF0%}Fc{SE2+x=vFRe>v zPAQtT8aV}9NIKQGK~RHo3w(z}=J${IMDx~dHz<=E~Z z@7mvcAPyv=%iU1@7dLfV)f`(i|H-6xzFTaMc#Va&{`G(Gc_}ViPWbS@ z@X?Hp$XMlDG_?mXvJFI)f0p9lq+t)3h(#;|p_!(5dWydesj~@P~<=Kma z9m*Qe>uF;2q_b@wVH?~017 zWD0H{gJrpw`Y;Kb95fo_h!n^%9G4w}J&8|%?qJp3x4 zDVx(M`QzByKP=`CAGry3vNl24(cWJu3t=5C`59BxIU!KML`^~|NLpbRKzXSK_Z@15 z{l9MAr>$QttUZS|-3@{b=?4y7Fga;V$C4>LmpJ9OX5 zuA+Si41b|mO=pj8GL!$~W<*8jusmnN(PQ@M;Tez)J?6oyF}jcV@87iFphy;n_kiFf zPP+aSSpAo52_ezwWwNc_GUP7o$0%4ijDwaKIw4bPq!|0wsVby{wq9}h>0%3>w%k$r z4wt4c+8x|euh@TUo-Vc#bk&Kf6#rna?}g7ThAG_DtD14Y9iyLdP3agIw+=V$co|{d{8Cq7lp7aP6RmNUD^a$ z9@`0dv#~{7sP}Hgw>uLUdaRvdm!HDupFHfigyg*d=eN1AbSy!+-!{)^iYVB^6)m!e zA8henF;1X+oQ7>lZa>RPm?|3L_nYv0tT@32)WzSFJ77=w5Tg@wV35QDqG}LCI}{U+ zwBMpIC`2-`q`Cq9mF0b(rK;{O@NEVzx!wJ-w$EDd0G}PLAu9$NJ9_DlZKl`?(#<#j zlW#RJzpRf-k>aFRH745lm#Z3<<}<>yR^UAW)Y37t3|{G*2j$&=`W8mC)FY{lDULBy z{-Ll3wSNxCm?(F+tJ)@kQi1xiX_;#^n}3__pg7e(dY_vtY*W0r560)63b0xKKy3?Pg9)kC0v;Z`G^zMF~Gs%`I{`X_>N}Ox| zT30$ec2Xx@^KPhL^Snahp0-1!aTLhH8m>^3Z(eL2B(~abJ87?v-O}BTv(TLR6gFwF z{<$iHt!(z$v^2!rf`7bb)lD3bE)QiRTE5&JtuB**;UA>y{#T^!->MVryWfBzR6EMJsM?h#(YR&D ziq@d|CTGe~?=;Y?q+-iRW|LiFg?Lp`C5QDjZzl2~rowgwv8)Gi77qN+zHtfCJ|ML+ zls%+uZzg$gMF$3kjvr7c3j#DvBUd7o@x&~L*l%|8Dq+KwuhT&@*mQVCowY%!I}cMQ zP8Ft%X}m50K%uua}rFHU+e8wVaWfzjtKCRt( zg<+()+pYm3MhG|iT;K`s3jYbhEOGlpbuSOiUqt?IOio(WvW5} zM>xNsbKYgUzmr5K+}rTZp(phv#2k_71L4HgnytoCtdDO-PZf%0FuA|9p9XyK$kzE!oa2}ZNbQwQh0D|k0UPmO7s2$0k%@Vdb;QqQ%Uf(! zM`yWR>E?-*1;MQ{ebo8d|6-D0^oc7Ja*gsV5!6+j(FuwwWt^Ro!?L&4bk^4wX~>{o z%d2Qi)8cUs?CRx4g@YP?c-bHPtq~$^yxm* zpf6VZzOQOVaRDu!P>%%ew|>_nUQlBrBK_ga>js|CI6HNQ0JXy+Tre@N)OHUs)XKGS zdASh2wJ<0LeqWMT*h!S0f|QF!NM7iIl?@HIT(*@DqfCF0Rs@Q>jbK3|sgt6MV$7NE z+pM5@RIZ>?;;>bz*{tA5Y)|E$E@(c%>F;J_7DHvGzL^q3EG1GIY7E`g-b zZ%fDJ0&X#g9`6;l0b>EST%DrmAsA0Fn9#C)miKjiQYQNmP=zvI`{?X=-5;4CB*sfx z6NOH*zybkfpX0MdTzF(ECp%xU3Kr_Bm{F9}#kh6@s&)35o2UMEO?tZlm55|z+AJ@X zCm}1U4lgEyg4*7SXv+Ul^%h)hwQaO61b2cKNP*xKcPLtdCpg93-Cx|HxI4vN3Pp?4 z;_g-`?oueO1$x4F#@=J>UjSnzS!+G_yytagsgfaI9kLU0kkulLq-3eGcxzOX^%kM7 zyT`UACGm!@qJSL7ilk8r7CWaME?N^{^zzVL&GAG%d!M+aT@!5hqIPny-re+juzY86 zMBD1OQxx`7h7d{G6YBMz>&e`f=2Jco(1f9xtX{fN%N5r9400~zaVUX8faJ^cK$vGQyiNkLTi?Vhm z!F73f#uzFiR=gS4_hCXZ$p*aMe!Pf_*)b%^Gp91im|`2_m8PHC!~RNr2$-esQ&G9x zF>sa6^Deg_do^LH_q^HTEY5VU@Z!3{`f-j$7&5d%l5B{c8TP4I0C>66_4Yqvn4o*h zb4kdE06K>G?IhG9x?AGU;k2iUDIy&(J3X~cu5A6Ln_D<(FUhP-f`|kg zl!4soxx47hY#ViHf=ZPDrZ&&XQZc00;b#79q1!#QI$a}>Y+uOcC6F|3%{_-%;&|*Y zF)*P-kn(dty<76sK?`fo?SYp>x?iVfgn~!q5JN{Ums9`D)179pZy1|4-zIUJ z1B%ga_ojp;cYD$DEk}WQ?yuJ6x*QiM+eqGG>J=KNB_h4Q=_i4v;lHea{CDs)>Q5~k zMEKfZ=e8Yc!4e)jy|*4Jq-_gi7b16-$p+@@-FKsjZT@ULKV9=7X=6nGRvW6>7JkIG z2~P`NURi=X-&Ng^do##DYSD?Tg;5_4xWhT8<*)Vo$wxv=ZHh{UP|WG!jST-JuF)#`X0ef2IKe04k%|T`!02j8-1h=p89QE z<=usifB;5yO?lTPj1QZ}Q(wl*rT~u;H3H^^s%T6Y8utugVjSAKRR-K9ks@Tn=$nzF z8zQ_Vg=C*b0=fAbr&W@_1T^jDQ)tksOTpoQSY9!xD2jdg^~5Zld2!^pBhXLCelbTLFkxpH z8b!;F{+Y8-6#glR|96~f&Yz}P_E)Zbm5+_mQ$^-gAKjAO(Mn(L$nTOfuDLFg@-qzS zgX^jk+(?aW|lh*4gQUAP#lDBC3xmBE(@g+zj zmCMy!i0bP2SL)UU^MSYoR@igD_B#ayIh(Ahwp6r1Lx)1c6&ymehGjxgo0K6_fP=Ka zW_&*Lv^biPwg z#W@MD%#P428pJ^AI~O9%h*%Lhz#=I-3zlg$`6!oj>K||PsgJRfFs;1j;1hB1zlN*j zsep9iZ`HF>{Fr`GFoH6WPo=!;&VElSo2dTm9%x8$mtSaHc_I6!Z$B~$A@xAy_C#0! zfU)|v)Y|);u;C+^U5bZ={cP(#%-W_T65Z+uOzvhLNl#|Akg~cA;N=~*7VPbD*|?bN z8sRd$;BmUqeER}V@6(D%3Hb5J(ye;wuqKEK*fa(_Gt)t7ag8m9yNYH8$`WZOB$mDQ zmPD@B2wZE8(Pq7vrUMn`4N7We@z??t>KC6?z}fkKUrH>D|7k45)j3&B2IbNef+wrp ze3LhuegE>K_lSMvGQaw7+}yL7Soj_tBraMYl3AZ7OnI_~0?;w*ZNyA~q$+rLN1y_R zrj`5_g(Yzbmn#2*G2k7TPsqasN!e!&|J^#r`c5(?e;(_V&rF+f?Zr@#*V=4~l?GjB;>y71K%{sb0iV#Bwx>>)JD-(JE9S&rqE zCF)@H$avr&QJmkVmuIM-?T}=UALDkEua?oupc`o!EYWb(0=QvJFb!SC(S&RZ>de#T zYp+v!{m_Z~lmeSnW-XBM%tp_7G}&+d7(cSbxY5sU);7ci3%@28`-~uwYzSAsV2jld z(H2?p()`PSnRefBPv;?l80DY1Nn|e#(pf}7PmkzgXbXq4(|KZGGQr~)Au#h&gm(_M zU{<>6itn83wTGNrYr2zl*gCG4NtZ+4Cm~-KhU?}v{#D#?vtOksb3(R5<+JN?Oku{t z2B|@}*Q3-6vr13#IMfjsC-ZPjv-c8@s?QZZKxwgtUP+-B8$2l0gqao_X-q?YTA*O; zQ6Rb@&+6m8xd zg+NZG_=9{*A|B1MU&cWN-Un`CKn)k@1Dk)JOV+3w@L#4wul@)mJ6*co%b=bhdrT38 zmQrM*)K2h*(SW2iGTp&B9DP({ak4em8~Taj+zO2I3x9e%=6k_*%MqLUjI|?LM-ECe z6NA%y=?sVx5&?v=M2zH67>SL+t&3<%UunD|8C0nM2#-0*07pn&GkDss8UGQ+P))oy zXJhkEe%MU5QSVa-&;>sT0V4f4kr~hZ182FNV;*-(P<|xb-ILY*U|qQ&c4AD19?W!B z{kU1pc8dqQ<8oT9I2?$U*>ng!NTfUNtgJSMaE7fLQ-P!-zQsp3;id>#eGfJ7U1jJt ztzy$YkkQ1~?R_-C3^TW&3cg1^v}NxjBhJB@J<=@%`%7hkA^ukWJju(Li6oLfvboyF z!1$?)KqBCZb=<5&Lpne@)$E=wDyl1z;cFWmLP>f=6JSKapW(bELWVW#G*4nYGAUsb zV=;>x^#rWS43X^Z-sCCmC9@=nDCdzLC(4Idt+gq$;A#%}@=7>e`;Ay>C@M zlLR#Mf{k5yPqsr+^zOz;*tA5L4f^YG?DRE ztJH5=Zr=8uc6}Gk{qziH8K`bZ?o;(v-4tr+o_DCeK_aL;3BUg(-oVUp zew|y4tMbKZ1O*#MYycPN8T19( zM2r)$8-3(@KC?2z_nG8oZx7R!@m^uSntckr;%U3ie)ra7(|On$d0IEQW{D;wi0l{o z8{4LUb5Cw7cWID>{jcaBSIIVpz^N4ylK{uDjWA#6d1hs?&A>9;2_h(z$V2va=+f;d z3Y!JTCfKeW*m;E2l~>yFE0WI!KOI~^jks<~R`$i{VJ z63<8fv5#OY^+(p+3v*!nw45(RK6Y_MNQxax<6&7tTqgX#V~0Dgyh(|U)7v~>-R-A} zW$%^1-ydkO!JzZw>_%?WF-;un$h2+y4QY+NKK0?g|HA^{{cl~t>#ytT3gvq=rO87f zLRYD$cL-Z!p@xL2r7N!Q)1&?5GNNVdC1Vmo6T+K;Lc^Sr;+gWtDfaGG?&jN0geed8 zlCGSdMW^Ps!NWul38aHSI0@K79iU|0pI$GO5FuQ%>I3umR_4kL|HZDE7D`$YE-O-{ zp8PXA{}gJ3nml7yxk(!`KzEY-pTEP(cCuUJ{LzoG8G1#UyU*6mv8L=6>F$$D%0E z(~_*Z;o;rVv4+zcC~(^q#IJ8eIL!1ro?Y)0PF~xmT3Ly_kSDJ?dop}3W|0>MZGK^4 z`Dlek1v~z(H!tuJ{M6ku^}ISoTnz0Uk^O7AX!P&KD8dcV^C|J+Y@_>iY+P?ObH_*C zt0fvE*D;s-XLrcAO3{C#qgL;3Pb$8&-;eua(R9Nui&ky>@wLb~IURNkViK70O47~YkMClQc=ZdRv*mfWgWf(K$4Il++Q908XtFtxPXb|0q zl1bNzK7AC3>+oA%`L$5>PFfP9?xW$d*mHeE*r@ZFl7th zx0g&MQgI{<3UEmaPq@)$cGBT}? z-OZ-MKff;};NO!I0)3ig?w&CAl4>a0g{54>JyTlo zAcp3NyKm>UO5}(EVF`b3M7JqjO&NaZ|`ti3Qb;u@3VpueXTnzt`b+nm-vIT+F zQv5RlNy?kKe(mezO*o^_v-R_Z%aLWtT;LoHJ~W61KqDPJ1K6sXw|T`M(vKunD=fm6 z;q!Fppx@p*UgW8Tz3;JIKJiY*TzoIT8|f2IOt%j!clt$6w3*69;l)K6NKdn5pJ4ifmyd_{k?4ypSj<@Oyn60JgDfkh<7hJCHZO)&;LpURy6|F$mQ zO`dU_W0rwEDzT=mnMxA5elvMNIK#DuO9mn>h?VecKo#;`k9N7U0Lh^(EyCvGRLhVO)-;n$j@gXyyf z#X(J&n$`ToYg0yhV&WmK@Ocj&(H=$b(n)nBxMT&tLIM5YZV?BbhTLUR>}7p>8gxAv z1=TOZogpQ7Nc3Xro^k}&x*D|RjyZt?;G?y_@Vu1PRF{H~tVs+~sh_wmR$=W0?>ikt zeSZ7EIW7Vu?R_{Px^T;lz}U&a!5%oKE+Edwyou+G_PRJAHUhyicvMZ203lSz+Zdsce! zanSdB%hczm(6heJ_{_>B8~!z%_R5dR5Lr3LLv4tL4UWjt@WP5FK}J@tpaq>{a*rb+ zQN%Zb&^MU2AxN{oOU=s!`VaNhu8#rgQm|sAajxJ4tE&O3i_47(lulnZx7R6zNOh4N zdPK=n&|ccyTk^6&Z-C!UpkMMyyf`$3ButPfD^!9q!V#-Fr+-F0*is`O9H5re*ZHx) z>p@D*K&d)|Dw%p5`Lkz=sSE$vUVe0w8$v!djQxZ0ry^%`-k)v#ZoQdfnndn#mX1R0 zB_F;qZ0#KU$UEwvE)5CNi1}#&RkgMT;aY3J^4+ua{g8=mW=gP>g7iZ|D-S57*DXK! zH7D!)C}9+1^3pg?Pohxg7=EM^YW$IqFqzV$Atb!w4Mm zU6$7uQtJcoXDxL?W-pubQl?wYJ;(`&ls+-^(*K@^{_U4sGd2D~k$)vwXWTlI-q6(W z+9t(qF7#iq+RWiGR&SJ5Z#g;?t@0bwTfc-yrg#n!4fG3m0Tdhhc|0Z^O|pG0wXe1k zR6E*R=lZ^#9Fr+^Rf1L%NXtUeO)gDm)i-rt!DDO*&##fD?-0%cFM1w6keWd5#s_U2 z=6>c}UqD$A=_}vnzu{%b5x|whOGM8k7t9oy@d_y}6h@uoSt@ zP`hdn0pC`mo&Ub~mISSQ9*Hxxxrp9>+NgSBGcsGW!^3U|F4SKFys;#BqG>VwAXd^U z)o(rx$}d{%7>^3X^5ex=>mV*P#o{y@89qo6zpMd+ge9wG zOCELzTL7l)4$nw(HzAw+T<``fPq4g9_B6p<-?%jkW(4~ZvQ*(^Um;c}d~ds|S=Tu_ zgOgk%=P5NulNAk>bLnURfWzAT)DQfLPTd;}7lXJ}+D|Fc!Ft-|eaRA|*A;cMmYyjX zOo9Zr7g&|%dLoj$Q~EXiy?N9TVo-*-_hZK;cKlw{o2)J;WQM-Xt|Vrx(lNWj*5xis z^lQdXIXE7%bJpkCA64!U*U8DOg_{SK5>E2OR5#sF*1w***Rzn#I^xVVv!RKY_y70P zAmW^%wk6RKN6)JNgtIRHmz%@1(bG2R$5Zx|h8quWZxs_Ss)>gQE3!tHe{geQV?>N~ zToJbxxy97q@OAo@wqgP1r?b~B@mIk^4i33VN87Hjke_A!RFF?Pk8*Yn{q6PboyL3e zl|y(*l6r(ETnGS7i#tP;<+Dtfo-Q)}l(HBEeMmwE-1}wr@zu%^P=|BAGe1aQ@{QiX zC|V-!$q73{NP(e;+@KZ-I8+L{SH9Nco?rV(&I5=8yc_uO?fLgn`R67&V#6X-FYqDX zTl+IPrS$Ii&$?8STritXN97JT$v9alw^o#sjLJStQdks($_VLUy>6gNc7A|lBYDzsd(I`2dQ#&8Loke zY)SzE2f`bOU)gQms-+@7%-ruMcf#AP*&Elk!T)VJ%VRD69TOApYX^N!?c8=gqFL2w zXXPQ%L*V=Y_vw6gk1n8oLjZI$+=AcG?-Ku2(c?KPwtqB1=O)zMA8(z)&<+dx5-@Cy zKsZ%&uej@0dp=r|Fp0EWw~F zs7Y{7U58M>mbF6{ac}lD|Ok6_{)y?*S39f!(iK4fs41D@C|HD z?g~SpnBfTC@k)`F#LuQ*4&mO%7KfAwM>M;sSh%+`znp0+5mC}ZTsPtsNPKE=;;MH7 za-oujTsO1p)k9jjqs-! z+bh}ZTi`O91Ke}wc8+Mcq?v@7f)Rf2q}(*b_N+g3tM_4}hOT1ofm-^-xsD|O=EW*%Z}q>*MjicUT$Qwi@%a;QXwBoa#wL(|}^1HQ@b zVfPh-ug45Qu%&W7bINIi$S(NZf62`^K7YTPNp!MftuEFAoymZgLU*&7?A?f!$;PEA ztYQKL{N%xqf+#t9`Dh9Or^l|#F#pS&hpE69_}lQfT*9YaH_KI7r`+nwSNYIY6lAFJ zNv@UX8$bS}WWMcx+R3|hJLkc8egz}{DSe?Etuo~H?>`rs@{T8mBRDnx5L0hl%GP2a z$|fHWSY<`)kAebBeL(*qSk143Sn#1UoiWh8XE@QdvkDrG?k0is)k^h8Q%EuJ?=GXb zjXVqODk&hiOjeKWu5HTyClC+Q%-s6K`kclgl+S-vw04U|1$_6Q}_Ul zDzZW~{lSlk*Op;A{_m_C3syoP%L`+z1#AiR@*wc#ph`3#1Rxmf>wh^9ujq^!y||7+ z(w<(0Wju^Aa%Z#euOHa?cqP<>3JyIQxh=Bu6K^DGkA_v;laYntR*%D{{JdC(Qj*RR z`L|5Nf z8o4#2gU_*6B7I8cgiRC6re(JS)mui1mRJ-8LzVfPs zi!e1Q?HjhcnC~ah0$+olgY=pQ_58=wKq|+x$$vnIAjOki5++0{e&vPBf}S(@FK>-m zUdgmb6B7o_$3KE&Z~x(1ZV4OBpbm zeivp&`Gvw6b`8I4J8n6r*<8}&d`EppxH>)DdR>59whOBpi=_7b^A#CUx^>*?FUD%3 zbAN@mg6)G&7_@@E2KA$M_eEY%yO9lF@fV7Xe?XtSjDhnuHvH>ZcyBaeHTgOoxdu_= zvPjV`t&8)yC4eu*_Cz4?Na3mxCLl>TlsI_JP%I!FN1Kn#DGs+%c~1+f zH0Eq;`@S2qWuO|pQ*)zxkk{T&tO?OTdBucQf7$mh37`W)wfD-BThOwc0{^Z&J1wiZ z%KI)JZlKa7et88+idx%iOlFu`D}Q_yO=$=M0^z-0ANc-<_W5U_G?~jk@lDl(@Vnoq z{(E@o_q%J}ujJHYjmt&I#E*yUA2y36W18yZRyvXuTTSc8^i6r;m(i+=P*nr^sM{4Hmh;5w6v-o{v51Hd` zT6<49`J+W=W%$Gn``gy>L8thy13jDhJly4x-FmbTr?+t)MA=Sz=<$po1>UGjE{vfX zeIdMlnz*KO=50Y?Q3j0$V;>v|EO6iH8UfbgktC(0(^uedG$aHZq_5V~bf(^;GXYGy zvX^A}=PansYX1%Oo|dr>yqxMMakgrKZl503X!FS#4G!gbZ?Ln7QI4M`F`K8*Q7gbo_0gE^dJD3oGb zB%R+1$s3J_TSS)9PXFKzuTxpodwF-9E+nf9a-S^o!1A0~skG^i)TWf9B+oZG7J@s> z1sJ#JY8BFzA*&4OD>@@&n&&eN?8J*}vKr&@*qP{c(s9hNw5AobHMl8+z4R%pKwxGz z1`kavM9Y*5SpgcZ4O*OWkMf56GkV!Gs;JnygiA+LS z-vn7$y3Rz-TBx=5Xrj}rvogHp{>_hur|Dg!lQ?H>V_v=P_X7W>n8qh#$AOg%`NGD% z*m@E>y@kL`@-kyGJ+5j})^?!?Ejm`ebc-C>(V=`be`<@Ujin2h9fAv6^cc=hjS)%# z4k2$AmO_@}n0Y{)(IfI4SP3>QEGye-hoPV6Ih#^^}1uuWMSyr*9zisu= z%XVmLG-2FV^DOV?%4$|Eb0{8P#yK61ZSFXgqMo|e_H0u>dCH1UiN|5!jlUReb`0IG z0k0>U3@5sw7jE}>GRJ)mi52+{8OwGIPF15u=LP@;&3UEKwEv13gcU}))6gvHP%tuD zT}uMZTJS^I44bYvCbbV1GWR{M@%#IKtEm%^r9nhlG(RuRU<|9(W@ILk@S4K_@e*C( z97qai?M*>D?vfcflg2`Hj?kgho57y(}CI!6`a)Raz_{o;32LLpt z1?Ow_Mn|HE^pnDD@?^slUOGR)#n3bu>weFP<9F#E_g!Kw7M;Uny7ZOmI%#aVd<%D- zLP$fwn?1IgeV|ecYB3R6h~`+Zbx`!0U$JBTg%tM)5%7ubqD}Q(e;%=@GC_gZa@`V) z-AbzDg+U^TxG@T0!PHpVElQ^|mVo5Huo>>|Kwh^Hwf)O144Ce{hCR76Z=+G2dFDQ9 zEpPP0IDPw`!o*ri08kb7mRvmJWmlXD*^SPEuS4)lI*nUwG&EowWzE|EcM4v$TrI}U zzcPto<9$lyk}s z3F}U2^vS=yU0F}pd^+*ge)cv`BlwS-{Q)tZnGD=$Zz7WHiM1PLoW$C z&=ivmjvtm?>4^xznH0|qKzX5g&AcQFCF$<@E!m~W=MNS|L7A~V(I$lxeb;U zl3+0SWsrYIb;E{-Y@8WI%rfU-J>Wy-Pl80)$K0%5FotGm)?!!`MvnvgR&|E_c)zA7 z)6s0UAUe3uJ&GNSuSTjtvXvs=3T{skMTT_^9;6K{&<{kB)^L?8S9e1#VMnfHxi&)b z)WiT5!oOqitu+5iA4vuus{NWgM7^qK13NTXPMf)w70VTj8N+I-Ux_u#-(hbXamWef zIy_)Q5N_kj-*GgYeEskiK90o&&0$Q_IXxkmXPelJj2+L~FM_I<31Gw_ZfIOFfPqQk5by!?Tr45h*E%osYmY14ihTU!!NS z9w+~7PL@5>XFRuH2P$|&bmOdzOz{>mrB5hGnPrQ}AcSU)p19XEA+*hQ_gj`}FS1N# zyDA89;Sy`>!l_dmG!_k|rkJ0L2kP-5a>5~mYZGJo{mnyH~3wy3csOI$7b>Lcc;IvMU2I)E9BNkzX&Y? z*dojv?{ETlap+S9PS=^dO%ZMyC1t)itBqUNp$waZcj^|bgsFkn9Nc^-2XbGpuFKS! zSo_L*q}z?=&1S9r)6T|)_muCAhnHe@7&r3rIy}rxbr0}O&8ZXZ#|AxT$8Fs8B7F3g z32V=V6_-g>mWKHhC7)?8yk;c6kpTY7#{vZwWaPY z5n33HPeGZfBhC4k+dV=IbgDjTrox?!KB3GM-N01>Mbg+g)>e>v3h``{G(eRQO8r1L zL#Jm+6bx|`@2T|(=l@+-Bj}@K%3p5Xk9|s~ptR*26+6qLJR6tQqQ5P{JlaHb zAv99Zp5*!K7Y}?~0AFv535bS|3(Ckc-Fg{TxTfRn$C^=!b0N1DP2c-Q9%c+ro}6!| zi|m^6?wai9@UM}vO?p3+qg&zDtnmKQ+tAiYW~XXPA!~b=UmEhvy_v|uvujZ{o>8hK z=*JySEs+9??zi6Rm=|E48OgWuLx8-YLF06(qQLharsDaUr8o`}9!E4SXjMR%&k?}$rghX zU8Xd5`LeyGQP2?sj#*|tqo5b?Qv1NDbu(P0gZ|92*Mk`PxWWZxVx1S)$T1GNc%-mc zx!$$)OzGGZpi`WNl32r&VTg|^g3aT#d@rjj)feZOlE9X^=)_7vIj6$jHTzY*bQXVJ}W?{rFK=1}dSr{{*pdGh1*=9#f0v(8I0r|~8LczDt)BWx!#EXAubUHbTomWWnlOBaM8yNB4h39=h zC|cv#UPO?Af<0Jxce-JVup)PvfPRJGWBLn;R8vZS43|5JM3smG%LddiJ+JXWJamZz4%io?$^L?!=*`%m20^YM$G zCh?0{+ue=7*)~=nbtRxjYC=&(Qj2$CT8?oRgGgFkuACRsHZcejk%*5U$jc>%7{aTN zaP7Z=5w^%6P29!xf^xU^eDYjF&YEX+=6`E*D^&hJ(}7u>(4){#kXen@>9<{9Iew|S z^6?8&3Bj*L$P#!;Wl<6m#X)@qL>|2vKnP3~I`hxp4YSl{o7@H?tn$>WVFlDcNc#9P z7NMVG(tGMy?^uN&8!OX|*=Y%Jq zkJq9!RB4^ZC!=E(g<3&Bec_(Hi`c=bfJj+hRiuZ;$UZJT_R|+BuX5qF5v(Ou0vglx z_spBapGif1aJrm;-am_H8oZRSZt_k`Bqc*Sec|ktxp)`m{EwVZrsY2i8l*nvCiqrK zASjb3%zs~Bwh{UihK4^(N>CCQGxQTN8cabT*d6|Ko<0ZPWw!F4jf}1~?TumfE0XL^ z`(Wtc3kRFuiN9Evu}7`Pq_AGX+1&fb3G8fdR;L@R9O69S3=IWe?n-_lmlTV6?DoXs z=j|8{{-clSNl8J~(?U^FgUJP5(hVBzVG*R85bW0gOPcjR&TaW>YqN{N03*Eu;C@jI zd;9e)wBt7NO>kPVr#116p~H}pm5T@a&EUY~ccwu(ib#}%a6i#gvv4vZx0s<(ApP(D z@uJH882jGeSfuu}VWOTLD{Eijr|_cm*}+&PE<)M(?)QofJV?j1{Apqt(vib`?v`;m z^od-S!GDo$cZJ6h+(wm>73=Gqm)T`2oiT`nB;(#Jv)TyTmUCi2rCI!7G|qjf?yydS zHGNuVcc8UrI@pi);PH3u-5#vneu&?KKJu+5^U>Ug?=SEA$dXOr_JasttE!)dMLq1# z1sS^dP&P6Apz#33{Z~{}NApin8VLp)#8^Nl;Mwr5owQ&aG02IiZf0^`CUE|8$X>cH z@ZVja@0kCY5&ahaFfI)cR|wiM5g@qdAeHju%I?xdhei~;S!*J zlHgh}CxPKO;UQ&}{Kc<8`r-@_^T)2ld_yOSn_1rCM%?9YQX}=>w76+L#io^{tE2N@ zY~(y{Zs6anA&QreJeJc>+z7Qce8MslV!`hi$B-=kT(zi2N!01aA$qAsH~Lr?brrs) z?Baon5W~{ZLZCD>ILUM&N4_BAS_m4 zy-StyCVa?@=l3Vp&!TSzAQG0+_qbTiwkwWZ2l=j~USDrQ0B^ri(SC}Yx zS*_pf>-IJqqh^IICEsdRzxHfMC{ymYV<#)w=hK@5T|ZoU|g;T8U=@e0Sb)%e__b4PJ{Q`77C>?5pnMaQ(e) zn~>RT&^4mh8UpU8G#Buji80*Gmhi{|i|ruLj+jF%f3|#4NEa*ZDj$SJkBixP2K?+; z|Hf!BED4_Yu}jZUFHI@2jPJ``?K)S+VPH{Wn0j(%k54Zh3bDlcJa0NS2v7ou2ua$; zWQhDq!g)A_HAp282+K}Wm&x5gT5YzqysoPO#mM-j<)U4?NOe{Z7``M$85M`7c$uUF zDf0FOkslH62^EA<0KXLoanh&d09MQ>tv`#(SbGO#BN4J93c$^kDyrMu$VV1AIRBwf zaS$&x{5wGI)hNJ0aFf}?sq)ck$C*(OhlZwo!QzGM% z8LrSuV@OD7ayKw7p+DT_InzHK|La%G+MoD5QMM2SE09lwEh`CksG2(Uyhb+#N(!n3 zj6r!BK|^6b2-27*nBSy*e+}8T)|o(QzysJJEvvzK6dFzdPl`g5cw}6?7tW-pEB~|ULvhI zLDmAN*L^l61$CXdo6suP$t_O3@@TXlL~D# zs3WY*T{u%`3(10bf7SEW;MyE~=iDb$=#F1p!%wo8Q?D&&+L1MmSC=ioVzbNiMm8Pd zGq+p?b9WW?liy_a#FrTuT=%+1s!3=B^t(bl9ZZK;Gvy)r)N{|IN+heE&WdJW#iDX07qG&IKVe~%=ELmPxM zeg%rz>;J@#F$}cwO3?4niwc*KCRi95YTa_O%l;Vq;bi_i_hW*awp^m7CSaf)326UQkREitP5rkHE|&2ss4IvafdL)*z~cA+zEm2| zo*uon8Vs*K|MXfKvt)yd0#A<`Vh#vJ9QK1b|BCsDrmtPQL!uQTMRh6Okf}2D9YB~T z7}ybmfKaD^=+b9es)u1T@%s<@=RjjsdvE0F9kN$;>RfgX;Vs;(v-TPwykaBlyrtzWN-)fFE(Udv8yC0STW<4JpA`8`VS>5SxIsOt*oWtXvR5ym$SLIe z97k$%mEb*YCNf4r8j_SQ;pN(ER_PDlJ*(e*jnc5H)n=K>r#nWfl8%IQwbYCH zX(4IJ0&n1Fp<#|prS(@F9@X=qEZaR`OoL^pM9@>D6I!Xb*!)NA3(Waqfb{Rr01Fax-kbWV z#hglO zwpci5`aa??#;ENyD{@@B=>R?kg_3WlsXj zNJu5dTe`v6twMQA@e@#Nm5YO49s=Zr=)+ zEfOE{!JafDq`U7XMN!_}*U^4?dWIMF5=}s8^GK|^(#NG4hR2^H&X7Ov#R5yQhd-5) zkaEU84GMg(zXo>9DLU8=?`0iR(cYiE{5jKqKP#vpn~EjEs=(zFRn-2-9TFDmT_{9^ ztodNXzE^82#;sdn`R)O5Ux?>FEaI_aWPw^+SZRWYUy7IvngwH+gfkH5`U4!loex)D z)HwN%O|#Oy17VK6miEg_0)e#Rh5*E3JFTn9={E??fLs^$Ml%;J?Vfw7-<#r(A$3Gl?be~s1Z*zoSsYzkko2pvpIaTa3Z9wo1sWn z>TXE=XP_c7Aop1nhq`6vtH>jq{Wy#|TzVdAa;G)FVeMT1A)a~1HCnqA=81+ktcNxx zZk$RZU9~YfbFR9Bk~ubCNwjv7dYZY*I73r*!14Jp5f_OXu_tj36+-)ih$QD@$8fEJ zpU>4>(S@*SxsJN~XHw{JQZpicymY7liY>SQ8&hI>^lB2(`YPlBw5>lYGaX>tAAP0I zGx$&xk*g-hK=RSp=iP3`Xd`wd7&{i9zPbpQ6N^1s!|W^JeO@#$Z(W0W5Lc!wiT^aRd>^kEpc&D?gw3q5j>*BFtUD<2B!iDg1uGbh=*wh;W zZ|5^X;YuKOFg<@;Blw}ag3jIRfzFCY;t?$)ry`|q)Y)9q+gZd6KR-!EOsLbChmDsZ zJsY9j+8i(NPF)N6n!J{WGI5ulG{H785_m}ei$5P!*y!)!+Am;k<4OM{Z@olrzIPz^t9!EoJ zK2&o^DpGOvVP%lIIN17edRk7<3ck@`B`3losQM@bGL~I-Y`u&})`e-xNsg16DzH%$ zcfu=k9SY{Bax(cayA}5WD^3NRL=)hlomqnFjp>2l$Yg83WWy*E#%5v^zzR&wv!8g* zHOS;?8f!63p!9O-O%ZLJd<5DW>+WM>upu(UL8PK6eb43-hwN4Co|Vh+<%qp*1g$vA z;zu5+U8M|wfMgk!mk{+Idn6v|We9Kaayb1KZr@3{-GI>&a7kywPLH-uW)mjey{@aH zE>`z;WjRzG?3s>kMH-%O;N=Nf-yxCoeQr*oYxyA?WZ+RKIh%W;{Y!?7>ru5Uf5}0b zPK%j9vehso$32^U*kN$4e>kJbIt+_}XLQ>yj7~qeNZ%Oys+W~d33F9GwBu;?5COuB z`%S-KzR+fr!!&!y)h(4rJ<%BcGeYJ+r!m?aGB&qCq$BI*-$L0H+zd*mhjhmVBfdRu zc{WH!NyrU)$~^`lVx+ssEK*3PJAXj3qct}-oyX74J(iAO0`g`f6jBdW40>LU0GWnu zI!ry@XR=DE(B^~{jV4=TCspS`@S1h;sVT5hL_E0h$R77Uk#*p%skG8Eq&qhsebW!Z zt4LtjQAdWLV5wSqq$UEbWG?&Y#QVyq8c}e_)Y*I~gR_u>z{ngVb(C1x|Mg*!iTWWw zBCygF2(c=-@cryJJ-N^yC^ar(^!CU!;PUlU^e69$96lk6?|ILtNFglmp*pjZAEm}6qnbetYyd%~N`J)?F zx3s0H?-cPH*}Ne2Jb6XN{rhj}RnG?$YvXniPan#PQ<}b~_=%@fKxjTqd{#Teej_5u z;7RklANuSx22NtrX#fAm(^1y*cc9@B-Kd}@ruUc)}lSaj~I0In>wP)F;MBvt=kNFZTZ@DZ6OxkIkMh_k`> z&j_j)GB9?p92e5gcgimOu+{>PV}BWKaaz6pcxz58?~HvU$>Vxzt#2IM7@LN&tnX?` zCn!%tkkG#RgjK|pN=d6D8o})2b;EnD)~9_+Ckwhkw5QncGj<&KOLnp{mPT_FT&79LgK?D36Q)K()vKZ-F4S4QG{n&!Gc_C&GE z5V#n%Rl-u55QexB>^$Sdp*uztc?cdwhG-Y3^H|Zp-AXP;ZN)I^*d(>6cXdaqCW+7}Oi;3Znx#d^IWD15R zO}evYn6{~V?AVJq=A*er6qq4`Ymcs?SNubCS#`u4dx%!qLxn<$gQ0YxdSuu*5{*?8 zNvduQ%3O&aYm6N)-);nNQdkJX2POl7K`C9HjOX>!#xfgc&DLM><)VA<`fD`_)GnUA z?e}5XabsA*x=$^`}Lg7T3Wm_Og#a?ANI6k#} z3IAy{gd8!G$(lfvj9U?aHwBlDb*uTM)Ui65++WS?#KAkniia{I7Ia|I1Y)xfSI}`6 zA&e>)Y>N0RL&Xbdoo>Yv=CRaj8X?9_s+YsXe1u!=7tdL*G|h|TN(Ar%x8(vM2qR1A zd|@B&GmVSUs^H-K*0Jh)Jbr0?Japy_mP-GD%(r~t= zV0gvw$(Q$Cwf<$Rfi3VILhR2vI|+0JY~4!ImSoRq8SVPSFPI@Nx&CEcYdfIpNTd+y zvA$>MVF5P#yx?AbFHPU@PGeBTz=)aYX>9k7iAn!|F0z5re+yACQsu-*AdC`#NLj8L zL;jMpXQP8O{f1e9aOiR^s1-T@oZxWvK(9nqM98VpYf44sc5KP35M?kQscyirbs6GA z_|;T1JXZ!LHNM4 z2^Yt>6Ka$M>GKPu(K8BSxi1c^ncfU!Cc)+Yu~Rtkqk~pD(prA2%y~_hzGHG{8!kP( zeEd80?}}ALkCX`8^m7c|T%97=0PCb(F1}~M{x;M3vE~or*P-ac@YUn?B-ikKOkcJ-6OnXru zk_JP;%Pv;a2#O-y;@|xD_koz1vL{$vnh|VhVladgc=cfx`7)Dc!tw6KZ_8}RLQX{YFJj2g*xV%{<{Ua)!wx0||GmXc zrtT0uh!eh_n{^T9YTFy)r3w;y{8#bN{G%%nDnFM=n5wBMc7If;NtmO-ehSQT+Y?uy z4Wu4Jqq_u1AS{-N=0KAcG-vP;j)+AcJnxmdY_hc7Zr>aU$cQC)!Db`2*>bMKvxuV!93joRZ8wmFBGXD%Z&$qIF!hc-{Akz@4ztyxEq=oVAOdE5J(`~;7( z0yGw-NPWHw;VP#Ut!_k|E0+-ftzt=t21#fyAwco__uBtReE%V)8qqWx$=BVb1uZG% zb7Z&mfFjZ(PiLr)NqvBK3A6xn0=1UXM&5>rbecJ)km1MFrsXK&;Er}iMQ;pG){lYyC>lWV%PGef5hn zs-+&AW+G#Ame)a5=`EgPofdSwD7;h#!LQ_Ec1FGGb zy3!qaC5;i{oj`5%*vJpY=GoT_`kovLfk(Z1`VMYrw+-CV4#PplvxoC7E6HH<+uv1o zotl6yH>szd+$COq6VL7$V;ui4Js`2s)nL^gr|6V+)Wh(ija$XKLj7M+%6?vDt-oRp z$&jhew$_V6^f@qa*t*vm4FJD~rI2c*wW?zYAt-SQ9=23(h7{9#RNk1*mHEA`(p9oyKk>56bX>$*H&FH*ByfRh3ZnhhAlXv8)Nhna zN+s59tXzBf&jM5$nN^8li&)mDT;98b1n#sTQ|1tX@QKZWfO(_boz&df`$T|+h`7|@ zInJ`Mq&oF%(n@#Jttz{h!1({UHS8Ow!fKygOzkA^{L6cZjG3J$Fwhs@ zetmG?{A*Cf$?Q3|+4{LPrq3z(;O3(&<#6D*6{Xe32ZMXPAJ-WdAOAfs#6iY*E~_|p zivAx9z&x-kP@KzuL`lR(e^ICm?Dvgj-*X|uGZams9PJcdXA=m|;rxR~L?lep&AEF^ zk)CsA>5%kHd=^B{J(5@l($J7CXQAbN$RS{0@rhqk{S ztAER@Qv*giB1U?cQ}|NDX@9RS{kVTE`N2?Rk(2r1Y4B6q^nVadK@Nsf)TI4oczFI_ zM#1aGheeYu8B*u$lAA6WtbQ-Slw;SVYQu*$$D0&c_Q&8dn)8>dVdgH4pFz`bdMx~XUrt-M zX0>zp2wzs;owPl3RIo!Ks` z30YceDE_r84s+p`uKU%uUB@aX+T5WVo`A8RuEOoIc1BtDHZ1>;Zs6F|CvkW{j|o!= z5sxqDIwyj|iX}W#e9)yzc#npR-Y`Kq^If`$bw5||Rov)4Zb`3s{obhG%Bos9Jhcty z2@~>2w^OMDn7#=i(NTVg$07utXcLY^TV~`zun5V|%d0asu<;pc9@rKK5`;(e=HMhj zGe7vPE2;qfgucdKyV^n%=Gx{tYEJ}jpsSmh=N^9D&7_VLa>tj=Y;Z-zI`@wT5EEY3 zpeg*<*tGufm(iAHCF|#Lu7!d8?p$enj(X1IbwuCcEKc#(g#IerUW$E!9L^Hja4ud5 z2W4?9x3Pv_$vmFssF4y~JsLY=y1lFP_Y?IfhR~{F3@o=2Ame0u5PZd?@j;kaMwm1R z^Xtu+LYb~$2D?QitN$rda`-Y**K0M_B}-nmON&IJBmXKnXVjnRtJZH_D%y4gT&Pl& zSHsAa=m6Z1y$W~CeLQM>Al+SC9YZBym@YLvNkZJ(H+Vv)kSz!fA&?*)eQjIRJ=G-0 zc3cZ9SttCe2X6b%aJ7@(^r@x42q&>2SZybnln%UW7{*i3q%>mt`6C5>NsG1#Wk>9wm%91G2Ka9dzcbLQ&+pQ2Sqwf}9La%vM6liTjLeoiaZ^wyGz zy(_J0gjk}~8rM>HI3XXab0t(0{`j-c#fE;*eT!37K0!|7b(}uW=A_Fq+J?m<70#w) zO`XWS*+o8Be}eO$8#N8RNg`jVJTz+WM@<*2fxny>!tXqWpO6;A>8{QAnD=UDH;x*D4y~X=Hd&=l=__Oc>ku53%356a${uIB`I2%oQh6_7!u5};Ph&w5& zRYi-I@aU@Cla8Y@IO8OL3S;T@^$LlnEjq@`_*Ta7dxVB#`w|LqxD{@9Az7Y zRX9bB^EEMSGQSb!+GC9pNY15Qb)Ha6qb}dzZfvH#Lo-63 zFzd*b?wHR@=A@u7Mp}QAFR^&FdKlLkKbo6nn{WM~&#hDfOo2Wg zT>z=p%uWztEpH|#qo^5^1Ivz26wN0pJqH}%q9%;ZVy6H}FEHc{CvPzSyV`cANf1UF zPf#nFc?q*uGy&{~(KrBXtM|?Qs^2PRvq)A!BSy+>5?O*sSy?nmArOpr`WK$weNZe1 zWv<_34sd`URM$V5ZpwyaA@?17B(||W&NeNLDJvkr@2buWB^ewDB@i1ye8)~;@XNH| zr~y+F=#lL-eDvQobbtASZK$$N$MhtgZsg1xP{E8X6-vApoUY%BhY|FlAr2|f*#`${th0OeakFx#(Cr5%_k zmg?*{@0Bk zenH#K{HY-0i*vP{<588cCI=IPNSbQwzPV)z+$`>d&&koVyiReCSbjz}sC%x#=hyFh zub5yfndE`D;9Krf4~(KJ&-Evm(KnOr)t!Yw1(x$tH+X!K&Wjd37s}Zv$|hWsy_i{tjeqSd3YSh1Zj~83^YwYW^k9@ zO-63MM&%DD4OqookV9n5OoA+o)=6FL&61H?H427a8lFDi&B$a{?Ugb)mbGBu05BRN z-an%zE%z=eVnk>WN*94R~IP)JSPjW z+=t(HX$U#g6fsNF@@a=faEXZ7ylU&?0F{02?Qc%W!=p->RRkVpNQk?GBs!;@p3d^5y&)xHUMGxX&c{wAmYnFj zVVqB8LC|gNR*Sx}IS~RX-&y_UJEZU53c#27Dg(TymDS!h-43$wIoZwd#>Z6O=_1=U zF2!f{&KlwE{p!)0`&$2yeN>;{sKjivqusYs1vlTf|JFZGl9(I{xo3-hqo-E~5RJ@p?>AaCf`Bxe1XkmDU%HPI%#$ zArUEpz9;CEQvESybXb#esq*nF21I)UV94;1p z&Q*+(eYEo{pQcivq_O}iVV{GgzUtvW7g%LQEcK;joKK8dV8t8lyiZ~Em6-7D8+ma_ z4IAgnqbe7TvLPD11qK!gLRR&Wf^CvJ5F-Wqc)>Y2{;dGL-}xNEBuVMsA;^*+dWisW zvvvL|db?6DDs#s_+iaiBV@#G9FU&)`s{yp@*0>o{Ee$}hfCZu%qzuu#{)CX*{ssj# ze{JcW-l5Xy5*vJGeCwOJGBAztAs0}-A1s`k7cCfIwtlZMO6PqSA6rP@eE65l6M?PE zWAVpV)OU8Z*n91+pH|mxbl19AM*}}tQy|&QS#HKJ-|jyK|D-=mr=WFlCZlow0zs-r zl1$Ld9F}&zQIj=>r9R_F;PS$N()J`Ux$7RGpX%w~mGNS)U2P;E)K?a}#j(eZ3=x#e zb6>QRTHSeHHSNr`)x18|DYF`EbXAWn8z6Whp5ca~5{r(s)y=-QcX^ydmgTF0(R z_yY2RUPqB-<3!@lzS?m33F`|Xi{0oKvroJ8`~mMf?Tx~BFgQ1}(`9ksPgFKIYaHXe zaXkN_Ci<9%M^MI?t0m zdK9R-x6Y9`kY7Q@;p%>7s+Q0cxz0lQxt%ZB=G?q0F-_Xc4K5sBq!^R5eF8lJ)RP#d zfk+I%v9?o?M%(BVM|8^H(Hh2@?~)ur#@QZ6wr@LfG+1xx+_x`t&=?KeIotQ}zP3_4 zt7riw&FAwJR}3)J#MP~4Q9~QR49mz#OC62YC$=6$QyZ6m%vgmkhFUI>h#G>$f9q0k zUFtpufNLTh(K2tz-^=d~5SyJwHXfM-_y<)~6Szn}*$OFADRQ&yvAdX}k&}cD+WKJc zYd zxwZ4${1%q~cU-Dr8>b+&LXca_^O^#FA{5kN1rl4!=JNWED>#io%<8(iW`q5qDWLz5OXyW-oHU)e);ie^ z-pOpozu5J8fEG`7eUVPRNjtj+p_XiL%NQjc{>R%=s+L`e)(dJ-cAtv|Q)I(}?}|$G zhRSt)NsM$FololbrY^u~pI zc2uX?|iOp+cARecd`kp9W)nv=C0N--Nbt^(B12~Sl>^q=9@ ztX%xI9aKugcMfNk^gibsjlKJg(N_*324Bgnm@LnOX@>}=+5Y+iq2qWY01XPFs8Al> zioP%aqg^tlN|Grba&w?k^RKs&9c#7oaGIqYnlqPguZ2OV6=7(B?8iEC(}DufpUI0q ziEb||V$N>_dHvR8e)S0Q2PW73UW23MKVCC^vXjUlDcpFCBhOGpV&Q7CpD zj$2W98$X^3KN@4E?KA}KGovDV3sB8ygW%QC_2mE2)zdQ_oQ|C0#Y?x#!N!Qpb7oa= z^WKHMDoDZDI;jT&W$n@q_(PU&-!o?@hMLkP@r;0?Inr1(_hpNdQ5BV#Zp-&mASL8s zmC3ZRbe9-;TgqMb6q>x8DW#Q>JZSsp5jGfK@Ezr-L8U1xd-mMR4qUF>%rrKZT!v9) z6wnsl|KMpT+Kl$TAb0S+mh9(o2ZPJ6#tv_PCScZLyW5zx<#86AG9%% z;vSpQ%&_n+)BnToQH`@6`O!PXgb=tjFC_N&Yhht9(&~_0V!^=u5=E9IC541ZAV1-~ zjPUBr@qgi|EurCS%-sz7zZyWy-${BYClYUpkyC=2x5II2aNW zsmE#V-9mlLdRLz$0ic^HozLScnWs_;D}~-@eC64!nY-6ojo@8KoxYG8e1QV=Zx4nQ zH$O2IhcQavAPwCRR``X_{&WzO)l9D#T&4D6J}pb3zHT!g_WtUvrZ~HeiUIqn5#b`7 zN0+*w8SnfpG@>Vwn2vg3dy?3a#)RAvfN28_O=!hqr!Vmo66$CcE&!vVP`hg~KPF;JoOjc%v%^P0E zY#*tUpI`WO6GO8+MVPj~DS4vB;ovg2Jc=%1FE$3U_zGh>zo8KpRlQvJ8muG0-doln zH)aUl=*x1*a$9e??(tC2`%;pQc8nRXr+TMFw@hlk*t)>MBfTs5nar6U#{H?^tl!#< z*Wu8wlY=`B2kNUaYHopK&oEP7@?tKQik~$bVNDVRNHsd_ti}DAcX$3_D3TH;?}r>4 z^|ozF)sI9Pp_Z7IKg1Rvc6yTS)sfxwfwqqx$}=@OVk?TClK@eMdLnX1C|$~;ZgXdv z2c2I2bg&)K>z^wJmoO+Iaga&iHg%e0Zm&+ii(;NRazet>p-RvIlo73Kr#b|$jL(l# z1LL8X5DvGwEIPOizTgln;$@jm9uJ*1zsioFs`HOXo!EjGO}sR_fO6oSSsE?$u)_cD zFs29^#l(MkkF_dKAlLtrs3db(Hjt;FPe2%$=j0fc!(J(2Ac87$1b9Gq;-F*FBa2K* zaMRB&JRr#!I&N!084ADTvaZ_CosbhXkm_n$D5gLnzYL~WX;u^subR-=-x3JJ8MS{esCZ@Wb8}5b z7;WCq!J@3iS$MCHNr_@Jqr$Nz>O#S#{GG4=$)$oRvk2f4UKL^`Jr5SL{!E2r_V+q# z?W4=lbq zt#bozou{wEh*%?B*Q(Jzx%?4?Dtk7kuuN)4j3bkTz~D}Xq&=3c99DIq^F7PXLpxnNVb6qUe-fq0d%+cD$=wB&Y^dzRpLJ$dU@5KtOx<$N2n^fL21=$*jdYp#E@ zb0vbBe6IJv&p;TwzU6E1sTEZzY5DapWG=r@s{PMz?2Os3e0 z-Q+~rs}_+i8#rGDF8+DFd2w=Q?4gQTleD;TFAS__>HXWr{tH{+TKIzGYjXkeMiEL1 zzJWuL;J1`QKh_??>gJALQxxgVhbhu_MTgraEt;|VD`zWPG8`%s=IN85`|Rn1bcL}? zBD=qiP>?mpmMG1Hd~3O0GzscG##7P1-$j80OoJ`ruDESGxz}y&T~BNXg*q+BRpOcD zjtqu2avO_Ij0XU6YafB6^VA%?lE5qP`=d~@)Y6-#bd>=c+Lwd6fR9aY9 zoFn$P`<%YCL&s$pWW>jyC32!C8lJ_=tiygh{m@3iraO3@3&Z=|$ncEGDsmP3(OM4%rnxv`Cclzjgfn1Ffu8_TXP^}_BDw2nV~wMXqf ztUC4xw^MutFa5`*{1#RWcH4a2_?ZQswH*CBF8VtHwgx54kXjCJ55YHgXlAUY_l;RS zpHAbI4lpq~*iKl~{9`HN=`vbZ1aYZpNPY~?zY?sOD)B3|Vm>4Q1*xR51E#|X;zXXh zww}8#!4-08m<`WE@6uVfUkhst+U%0XT-A%m<6|6oj3;}|wf~v+)>|#Qvb|$zsf`9` z!CQ#_!B>E<$M-Kp0Q|ZDQ$=DA>gp)2vtxJvg7N{=s33^td_SHTG14DS2MVTEW& z(pnM+?rNb*dr0mfkVAL9`=sv-7c@KNJm#stu+8O4UGUju1->(_phmSaP{kWK8uY&L z`dm6h|Ee=6Gd}ID8=vdCVk;{w-M=m0Og-Hr$oFv+muhdy=((5VJeu+^SWOfWHO~cM ziogUtxufEbg0qOCtf?CJ=lR?m24`0<`+U3s@c6lytkNUDj@tU50YVQ`ZEr7Grpq>e zf(Wgz?}5N?E3fZ@SZZ4#NSx2%HiaIDg7XP~fH)yc)H72w)P7GP78mZ#5le6A$vY(l zZ=ZpEKP2mm@?S3L>_Tu!#(c$*DiPzC8E`)QXQ{UdS7YI?yhnLI$GhJR@^Wj{RBy*} zOpc;8ccJ*g-&C}CR^Tc=+7$ktEQ1y~Dw7Kf?2q-nPlMu9ksuH1E>68&x1^9YkPpos zatjiBpwrHA|zb5g~AxpDUze|a|&QFu;`12Npqp1tay{rbCrIUJz%Ro@@$XU#0Oy>ltkoS4Eo*_Sl ztb!AD5<&TSg=gEl`E=ESlV9r0b~9!XSiNRONSsk`)s z2Kl+ar_e>__d&xBW)Yasz<y;x+}VnI1lSZ`!_U@SX6~-M3$h$ zqSU6}ZRwgDH}vGeYMqi|RB=H_gyIu2H&JRQ%^${ZQmRa(QF{gM6sdnjXoTG+#G;_( z0YZ{**dG(L5Q%+X@@0Ck`Y`I#smAcUMlXTa4;aVqI(YtzB7?Dz5z#qRvRK%3!(J^1 z#LE$dUxb5y6}j}@E0V`!kNb5OXfAxTY(0eVrB~M8)m=W=64m^vJcFO)|5$arF6)@L zj7EF`78N{dUR7HMQP|)Y6v^tU=C=q@ynj%}6eu_ua5|ih6RQK!RJefGm#QdGez5*mHQK$Kr?tctuu3g_>XQ`!Hn263b2@Veisp5a~HbfuX(L5O3 z@jUYDwY9d=Otd3+Eit9?JU6^=dITbReVFP4-P$>t{a02Ul@pD*>t#VcQeg9uBu6QC zZpUQQUJdJs26mDjkOeFe*;Q|VQO=z2G2TTQS-n^y~YcE7@9kdH7#TycD zpuKU`8+g9rcds>Cuj#zM4@Kc`$cBedCwtP@N|go~$jbqLPpAH#e*H80)sHKbbal6z z^2;!#=uPLFwO_Y^JjHG!ev+kc{nDB|*2o&%)cwgy4A-qU{v5o0pbZ$d=_~P1?t8H6 zRL@LK8;$&-wmYz!38aZ1VqJNq-1?aO6CxOYP+ZOO7ZXxpU%+kaSkTKH7c+Aj;nOlmHKW?MhF zdbu6Wl0a*V9WdyJvifT}NI4sv?7B?1U7=o&Hn_GeWSOYx0hy#oec(&g*;S&HZU41T zdBGHW5E8r`1@+|?$pX%wF|G6c>}$bHHm6K0A`cplhC|jlDsB6Q7*)k->bs| zZm?k@>g>K%>h4!%hsTv-J1-7@x1kDGOOtyJt#2&u;3-6_r9Bo#Z&YkA1891jTaEBM zi=NkqT$}bxc6RYY?=S&Fc3;#cwTzNX$|(Drhzy|OMFLsZ>n<2u(JbGD>xArSp+RBD z2^~vq+I)(RTz|3-Kh(qPlW`vX;*Ea>YHV(9-E#n~g%D7sQLB<8d4$E#${#qu_vs|L zGE^Z~sJc|)#~oT$?w(jjuW9PxM&)Y*y#OAx3i=@mww-?)F3yXta1hM%Io28T4Y3Mt za!t^Gni_HAxjV>qEmAVVjn497vJqaA=X)I(XE~T7@s6EhYgVATcM$bGt3!5Fdq4p0 zCk?mxohtpth&ryO)NxAg=iNwPGAi~U)?gT{*dTfP`9<==3nQHr&+GPw61~^+hw@V; z+jyn&N|ZQm$ZWs*MKZ%S2GJU>(|mFt0$xwNE8oMZJt4$>T$#59yX3j?BOytk`|H2X}<( z-xZY^ynzp68FelJi{@E_dDf_40gPRjKTz9tfa;~82vuX-2VRjeMI~RAG zpn4np;M5_(XQ7_cZ-r|-XT7tmeQk9UkWLrJz}g9uRrd?8JaaV+j!_n#>iB4sR8H;? zi1cho&A|D%A#(GEL17w<9ubaY^7}0zB_%Fogw`Kj;3BhNr7c4X<;h?KbtF*ol;dNT zwgw(I{qB|R$c$txH$iH_j;Hh&6tsh%ZCC>vIaf9Q2Clkr8jyF#|uf6 zLxu;XFwz+xNggFm6RS5H;X6M9gcCzX&;hl7$zr9SN!8X)2vu`|k)rYN%~gTYrYsJ%s=PHdqvr2|1iO8=_wZMyGw z4?ACM>*gaPzW9Ds7Ke1hGZ~KEH2rL`5DbYCD8ob{w-5msp*{`mMirTuKN#FXoo2T8 zklsYgH4mzLufsK;BZ?T@a&o@K3_j@3X| zVOscWzWV^9PKwqt%dH2mcCrL!2FgKzOz*j|NEuq7s4xR!{Dv!yOwF>}785W~i*XmP z!_0oAFXUy<84k{sxBXl!^|rG*T&^O+dA=0aEn0IV5|{ip$+(ItZkQhSSD&fDssYBJ zdsze0xA}^OxLUw%);wKIoL@MB<=8s_DRUf>0(CbMmR0Uk9u~%0|DIj}1RB|-6o6Fo zDZLq`Pjryw+BhvJd_a^#D@I@G8hYPH#an8hW~F0p-Lyb!JdUVUll3SxiMu1kRhCR> zz4o2AuCN7kOA8SLaG}l{d>6mM7nfw;>5tt*4T=FM*#Xz0M^#BkGvrF5Ld6g><3%N!h6=*SB$@DFQa_==2yZ3(wN=+ZGU1xqGqUs6@uK==8(Tn zoi{OA2+<6cRigtaiKm9V%@swem=>TQLt2Y+t{~+R=1bil2h1_of3W5#_rq-H;TU%j z#?7O+y`pu^Z54p7T)|6sLY{HiuRgya38DH3_)wOzZ|->uj`@U)-P8&{4dAJEF|Q!j z!c}(5CKaS*7H29f7bD+f-!m=TAbycGVdsGCQS-GTY5uw1d|ad9ufA8k5w9XgVO-0x z9yy2AR|1XH%o%RjUbxoBGskJb`ra z8Wz@Nl?fjY?1F7w2}^G;0$$<&b7k3)mVr%q8}YtLCjrUf3V|o02G%`x%0EDp@S#&k zt(7^0neYQbWHe@B!DT#D-=g}z6|F4yp10@#pH}s>-|+iX_=I)tJ3Rh{)GZ4YoFNv+ znR8;zxE%068jtmlUnUpV*tshTxP#h(lQQW9JtsmyZ#;k9A?#n;?)aDs2b0A`8wD~V zwCn1&#EzHMEwqpyIX0CH)*~&+hR)4t%Eqel^jEzO+mo{d=e2 zW?aqESHy+z<`tGvLQVp%n;r!v)iuA!f^>YLs4ZrKZnBDE+CXX@GEOj0W-UGR#6^BlwS!(XNk z|AlHM;F>x%BQ#X~A-ILRjWhnJv_u!*eljA299+%BGZRo=hP)AZIabqK%}vL=$c*Z@ zoJZTJ6n{B>WlL}}fpC50Ykp(3y>cG@X}r3lS@acNn~pDI^*W`hYf?+YDg$QwhbVZL z=wI!%4fU0++5u?w$aLF#O)?y+&#!$2HS;SD|5bg;svb6`sAhj{sR);){L6jP|N9l= z@AnEAX<+B6n9MhvwH7v$|3Qcf7bV4I)7ImLBt7#Uww%8Xh$rf5}$uQg&X*uI|bfpi+9 zkYpLi9PNuFwP&Vkl64SQXr>!II#nLmv}yGzlWJ__0z(S0=tLi$z#HO7qQjK~N0EQj zg5805VO68cVGpM)7$y?}eX-c13AzO*;P+#XaB>6Nn9;wI*hv3V_=wQ``xO}vzZ>rG z#gI2a=t44a^YR9)W2nM_KMVT8fdMxRjhLpA(~u3|U&=ZgiY`>SPqOv*@MPoPo^@O6 zGuKn}=g+pnkrUcYYMAJ#Z({~oj4rd!lIdJkPY<1+TMYN$K#aAWC1}w4%RFl({al+i zTD5JeP#FyVrzie$yvO*Y5s}q!r-mUq605Jk^lxR_riFAlQ)L(G4_V;krIP5OC!_HK zO}8G8%m_w|7t@?7Q1{cI(ql^k%4qy-FfA(@!7rS@CYyrHgW{990%qd+i!K6wRgUX1 z_e(zgc`dQ>2`SlucjNksgU}Lxe%gO4skKOrL;mGu!3>@TDc~ar`SDom^bbB_jl0kb zMo+cA{MKRCkCwRncZvNk8LdQLKK)dzX@v5^NL?Dg>Rm9rKqCv1KAcI}^UTzq)pcqk zx|S7-iKx1hoL_SCs#4FBdU24S|@@Ny*x&%1e4c4mo`A~GA zP&M_nr>*_5S}iCRlY>=~T5`=DX_FSCI^MUMTbIYV445DPcWnCD%GcPZ3S`%O;)n$| zN&C1^Hqe}r)u`Pk?=EsUEzG%QCVfxvGmQ9)JbI=Ou=Vicq1{0=-G%fljpjwEBk)U% ztXiaLx^jMu{nKo%T|Inc|9f%O8j)GkL+|torZd^6rM&mE$h>+phkPv9jSe6t>_0)C z)2^^|4AP_E%x=h5!KF5kze?pkY%DeoSxTNkk1;2;#(dT%eCZKg&>vnZLBdf5h3*}m z_DC(xpua=-WwOwk-qKBjaMp^&{$!)RZLu1(eU@i&N~hF#13u@U^y}(U6K+C@i(#it z0R9oHiok2oX6`PdS}{Z(#8Z%>IM7oqO>HhiXTj!C_%B82@;jm3Gm)cCbnzYxM@*=0 z&l;q8fg?fe09YVY?$<$CmeWSan(bwOrcpJQF2|2Yb>ksHNXK0fkCg#{&y1CbmmXC? zWixx`cAqItiT?dL6u+RvMmSa+S!NcIC`E19oz zJ-368b#)kr&sMxrzskbR;gC|o+QB#Y-5!z*HIBvnfuljOftc9kMUd+idq*}qPC zB|9J~4IAUCxSOiQ96Q{H{!;}F+`H`+Jzmq3dEJN)REX!Z?Q{#%sL%bZ^|49m=2L{T zBsS;@O9!>}>J!W7mJfMwvo)Nez~uYAGfyK*n!6K#G$wti zxjHy~?T#dcrWd;`bV`8xiUT|rzln*WRJEmJ>K2^Fk z{{+Txh4cT*^N)|3$vrCHlqe29|8zKznP`*fCqM`_`v*8QV+2uz{fpR4K$Y(he~ zNMz0T)Pdr`DW8POl+urowR+|mCSZL^rJ_;Q&2;A&CApk_hJe%4C!)YuoMh_90V>Ll z!W6@hzsdrM_SF?UCJ~3%_ABqm|DgTQY}9`{nfB9<_LT|OgN2aby-0CoC$e(c^=V=H&wGa7OF)c#cqDQ5 z-&DvrQqnuE-rHe7yo|C~?SH~QWzC!OU842Vsw7h}r~*CB z^`$%qFDjqPF1^c%iK*s{B$yS`r4uln7wP(ZLWrbNwUY4kq~xdV=h0Z+^gM+%73mu@ zj@j$-08o^9=~18NdjJ@ct@Ie>1MDQR1Jm0>s@ZeS?KwEHBstZW$yj&bJ}J0SVL88q zi@;-`#Ll#VH`dnBFy2uCYA}f<@>{^u()-I|P@;U4lEoU4lbH&>#u! z?gV$&V8PwpgIjP5!GgQJ&Fs$3%)bA^e(bKNZ&%%4Jtg;^bFRpkOU2<&A3*#5au>%P zE8eTcQAlXV469L^iE_R2vb3Eco1M$2jb5sm=GA}|2oH8*XpT{dH4Mi z+m?7N*pCE5=$>K^-3p#CDleWaSHkZuZ~{2mcceIWzl@(yqZpgS_i&iX;gLil7aE*j zePpwS1JN(&iB#*=8u}wu(bsRfh$Rd1;K%@WLsJZxYfx1u<OpAPkVSK1GEm~13Em$VzV>Y8rOdM+l${0WEP#_5w+FuL>sm6np zcm!I9&#=6Xj+lE2V$uP#5i-;`{)sU`xDYV_VMz#LcQRC$kC*4}`DbX%6Z-Ya#*2$c zYVw7hT^$9CZNbTOoq7(j-ZupsJ;BpaXtW~em`B!~G1jitCTJ@>Y~qI=+J0PiRli!M zZWXI<4*4PQP6B1I^){$U3DnN~=sSu{=ayFO$MkYe`x?o;Nn>s6ry3EahIpa)@2~O^ z9CU1JA}1Zh-dA{tl4PsF6omTIEldKR-8#5HsZUV7>@Mh&rDEKMb|Wy$&-QLHsRH`I z?|mz)djl*-F^5dLNc`rhB>>YB#!r!S3R^JM6lQ}L6~EL${DJ6$8K=$3QJY#$R|pl# zAvD%Lbry&M$hODJ(&Ww%4I+nBDhkXmx~lW~I^xu+laaKnp~~49@H7; z%;QQbpW8>d0q^9nx)t_hU5KP$*Ll!u2_<0{?m89m1THD11G6VStS4kctLqfZF})ym zhWqsl&t*~y^4l({Z$>~Qg_S5B0svl0wjYxqH}mi6Co1n`JRxLEyQ5PRj)q z3zU__mkJ=XwLOWL$p{8h$x?Ys@P}y~>rhM@2{TxAgmoTRdu^F!sChlE-X`WSD8ygJ zjltb2J%U^TgMuA>w7_`Lc+#1GRCgfML%oU}upsX#8VhlS zcwAO-yx}jxx}B%!zr-^t9IRdAKKdq3pOj&Nc~X6{1${8MSjY-dY`c64AL|5beyKOl z0@#TPqE3;bOVO+xTPKh{mGt$tm3+r-k=`VEBWzEaoK4nPhi_EIyz%>!KP6nah~8=~ zgPQ_svX;k4euPX*oV3wRfVa;%2OYi@-FluREVLvstRpF2kW^+$OR(rB zYFCrq4b~7_jf{O_t)mXAE#ylI73Wtd-87w*Sl zaL&w*8v^~LuJImme1`$E`k_W;0_LeZS-)*}QttCTeiUHIlX9?8VYa<&k;*ge?2X45 z?ViD);!Vf6uJoQMA~Zj{tTbdHu4L8ru6KQyZeVr@rM|lT*5q7rQv~?LQqqrCE z8oUV16v4df%7L6Jb3_&@k~1fO^+ltAQJ5~*@^{BZjg2qNbB#;ytjmKp*68eev$|`u zS$AM{>H=3D%!wWwQb6n1KU}@v3i8#L2u-XrPkks75Lmk+x z4vl$jo}2JG=$}2CdFekyXylrFdso5K3`uXeE}N%-(&s*5mSuf89&cUWW*2W3j^sIWs>-d^yjA zJDwVEeQI{Q9Vo{IJO(4P69cEQ8D9)<0L4Ve>V(}Nxse3kXt|8ogwm|0@C4#kt#O*z z1?`Z;(3{f2cY~4Vnq!89P|h>iD`Joy2pLxJL3%0>G0xR39sg6ou zmL_9D4H)APl)~dPB_A4rPnQNEn?BOXztPzUYE%VY`rh5JrL8kk*L2H5StSxAX4kJ? zBsWoSjP<_BqcBu=UKO!Q#j^i_dqPxp3;3$T^Ir5o@v|%jK+gIrd#;)`HZZtCw}M)u zO27HxupE<%6|0WoIs$*KZIX`T&j$=%`|H~xKS*4}KfoB35uxKVcJyJ6Xdd?DwnU2k z(<($$^h;Px+Aq$p)>PVL2W^U9*{`R+`P4tQ+3u)H z<++1l1Ls%kJxe-N|DKlKg5z35)2&l`Ks{Qr# z5)VP4yoUucR&W=?mD|cb7YW;e#qO9Gi7ZO`q4&!B&|%@Z%i<{RO|umH@Yd!vwFf+@8)|2cqvjqnWsnt`eNZSjAP z{bvHOqUg|_1GAj)t-!~^XPfvW=hu8(FH8&-vDS{bVo5RnE!j?DqsT94?JVfImdMN; z2l7M$wknuzzMju@`Ltgu8*Jzr>Z~U+T}cF^KJ{Dvb(HCMGo2Wh8|)?^fHgBliSlP> zga1Leq|kIhS!Jw-GCtwwymr)Hkcsl z-wZ_g+dwRISb$Ie!vJfLzk#OFusF)#zx80Sn;T-mkhAvoKMdgacK;}21yjJA{Z~i- zt8bg>5DQg=%a8wI0NKP?dmg_QBar=nh5#9y!vw^_V$`wse;5d6t1dr8)(z|Vmk%JO zn=K#~Y@~05|J}fuI03{t!A$+e|8Uhmy`#?wvA|8`N%lWZgtWL(K%Da+j%UjD&&U4H zz5hMM{?EPte6#*<_Wsu^^M8xOe=iPqgEj+@<&>_wd*f+h1Lyjv^Y4+c{~0p>+cMNF z1iwIFZ$A-oXVU{&$&8Q}x+3_M8QVwi=i52np~y7D>|F0`yR*y*7w z1`rQ1YrR-r9?OmrVqWz-CJ#hZ1+`a&Lror1#@|+9cV}VLr9-hv=X~|8FYshd+#>k< z)U8;;pPv|SFBwh~ax%>vXaqwq4bFB~E)9-Z)qQE)S$9?=o*K$-TiQ<}o67IVT!~2t zv>jt!7J`Y(7{6=9o|!M6x3qRv>tN@-#fG(!cS*e%o)b z$F4xor8Zs>dV|_|tz*C2@SZ^YxV|MEADPL+|J>KHkq{Se!}E7aem=$OS?)5`^XBlx?ScSbYJy`?fnO`Jollz z>!EyTfUh-cJt%wJ$=&uf^QC4_z#9DY2LELaJVV_$LxsNceLa1pk(FT^lV;8yOrsP@ z30CYR^g9{O-AlW{>`bDCY6R zb-jC+^LptEfA{*b@j50i3ijFI^*K-p;`p=?^(U*2rs2#cOdCGdXDs_o-VqMROWEnAmh_-8T=a|kr z;8jC-VX7N3l&oxhr}Y~*JCO}T@E(gTnJG@}XXIv5w6+Bs#>2Lo9r%no1Z2bqYxFSJ z;Q%R{n+h#+p3!-b5wouAEZkwpkimV8?|Y8_aPd~i`1QH#^;TeI=v>X%{r=(I-mjn^ zh2Bq9uh(71cL=YWWOIcu756WTuMbAA>l=@r8~0foAXd*?PIdSlx;PDc(i}p3=p)^t z%eg}R1Hm-SEXylzK|jp2!MQKG*$M{9#e7JHnPwz@37CFd<|e*rKNGd7Ae8CYohF~7 zreZ+qZ;|Jc*Q-~dD6@N#7l-8Z8dN{8exD&%F9brXM2i70j>m9c8spAXl8myTeA1nS z6!`e$4CMQZZ13ZZwyB5gIRxd0p#vQ?9^_9dWEs=y9C#QxTG(kD7t9;tR-+5GhKb-j zAn?<@-Nucb-9TpnICHkm9oT!@)_K&nWEQ?UgAv6@a1k-G7XDX7o=#)%^rAu`IVPio zoUN}4sYU!}2+8p4%f_of?8fuj1}gvam*WokL)WIb=ZZyW{j_shoF9~zweqQ&Vat@6 zB->-Vi2UTi((8cQR zK56oOY|8QDVyeUB5hDo{=9E*XoYG-Z??`?=QBH;*8aIX&O&e_@RG1Dk+9KlM+(gwK z-mKvVwG(x~uQ0``kj4)2QFtmR4-&sZYCiW}7EOf5Zbm&dz20nWUTqmCdj^z{L#c4w zATdW5od*piIPJI)-i5qzEV>M?Tw_*i`u&uijb6rlDFkAF?(?sw?DF;bK9u-Av_Ysa zogX?=NY_?bCxj_V>fD z>a*_(jQJq2HS?R<2~G~s1>FVRNUGV94L>7zen$4v=WD!4TPd1847)8ex z&D%`&H*DG*FX3+hyl@ugb3b_#w6TTymfYr1`1_r2FMqyWNt3j4h7nF0vhI z3M8SKah>&tt7z#a>*Vj7Gr%@&iQFfMn6SnHufR827zCyK#jL-?md;4r)?EsD*#;(OIAov`X0fB{ieRZ?ESf57rOsca*|bzsFr)$l82^(|aST zlK%L4-^d|^Zz4@&&*!7EhiHY)EIX(9M81bYa}q~oiT)&^Gx#jNDW8k%iK{Leu%NY{ zG)?wrgxx!J!L%!vj+5|wG;beyx{%TAxtW3U1zv}K@vir4v)6@ZTRKpd7Ji0_t%gf|?G$1M} z+2Z<(P2>z#WHT+r53VN<4J97Ub`)x!HTWh3=XE#d3A>vfJvxQ^0?X)7Rnm5teD-Tg|}j|K6gKzO8fySxv5lNma-eh3P3wM5~Z!x;I>T{)6>)v6N% z2*t)09ti0fP;%8q$JVNF#_JhS6a7Ik<0v>I@}<7sleb>zkF&u^wm3OLN(y<}?=7;8 z9Yo0B9l0cP+;dpe87{`hXJgT}xIJq9^#4#)VBDf;^KQVN->2hJxA=8a)92jRdFrW2g*|JTKY=)rz->KG@{;8NfF+L?<|`%Lq!|jJ^2;=^39z7@{cI)sD4@7hGcU_)-q?j=7|th?kw0`u!7rrBy5LV7`}tnu9v34+A!_c(cFdL{6770Hn+Y%xA9ykC!dh(0oD( zDPv9!naxfat|&@bi#C$3t0l-k&tKd%qy6p)L3p&4t^euu2CN`1hIzw1W4~wClX2l_ zK&e%)e7w?~*SbO*Y^|iKB)vQ2TVitlBJ<1tR^Bh!1m~mCnLNCwMa=V;k`4%u13In9 z@8TgmCH{14kqJe3u=O28Pk4Z-^Y^wHly5Ym_|3MTiKT+!HR-g*76=p7zm3mJ%D8G` znxHlkKI$8inF-++ii~UB3rwsC5)^gHE7(-YME7a4@HT&XleNnyJY+25D!3jt-H6(t z32gt6Ny7~uvDogJM5bCj$cb6rEOw$6Jh=4TkkIPSK;D&|L7v zaat`f5=nD5P?b_S9LmyjYQ;F;5ht38b@ZZG=J6lru0Qfad_4(KLS6jOuf@HgM4svK zaj332?nf|m8a##mt?Hz*0e4}))-lJ*IlQ@_S6oLaB~}A1T+a${hV;Cx3<& zs@t&SMroX}?xBmXxuepNZF7UukzJUteygzF}kJ- z2*F_f_AH&%tVIuD6edqvf1ZWpA+EP`xQ(VbkF#IR7wp^@WvBUO;l5+i~z7FILfllEA_aYc9N)>n=m6 zh&}gwREJ-yhl~zfx^ZU|WxK?<8l$F>9;i=J=j6XAlvET=N1LGzqdUT4cf$kw_*7Av zPY+G&XQJDKX7V=*y3Wq9%ZHh%Zip{%JliqlrhVbALiM5Iw65 z=p$=vVopcIW@x3|U^m-5BF#=Td!tkzbBCTbh{PeQzk95N(46qn0N_)@=4ps8Z46Lqi9nDghx&xtN5-B=XoZZDjy*Ev* zwmQ?~=Ff`@Toi#J?yOvgIugw7B*HS(m6i3)ay&PJ?h!2Gb36FTaAY^Fu2PGR3oInJ zTE8v2%@%JO;}rQAm~>NLh7NI?1!pp29QFnA0`aGfhsq7>Q|AEVkj&$|a%BH(ZtKAi z6=L4EkTq|+7peG3U*2z#zaET%Py#Wm1KtI~hn#KjN94TOImqka-= z1MuFo8b1WSZ#YeOXRsltxF5k9)4*>KQbkdrGHw|~Vq?N)`JU}=EzG})1NM78F0d!| z*R}kYif9H5Ear9I+M{5l-GJW6BA_)Wr7ieZQ8DzAExh$@LZ0*ur^qFz#dSZY<|~W> zS1o7*_uN^HU5vZvy*ikul{vZ-(cy#GDEvy0oYI-C1NC=thv{|(RCqZKd!%|jS~eI1NC%BeeVOxddZH0ENgamuNtWNC%uA9>{N1AZkq zLIra~X;Pq@Kd95&$xOnY1YqSfPj|9$kq3SDKS>T2Ens`?yO(>>kCJRml*YO7ki9^I zL+Kbh<8r=S`v;6l-gj1^!6(hW>HTO!2bC62r%$vgskpsNg4)VFC_f(>S)vfdF$-_@ zW3|ce)p~ah8kq7b4G)&s&X`z*j8~Js=v)LD1xN4552Ik8k0Z+^T|N1t-z0hmJ`0V$vs=)0hght zy7u{cM$E5quGVa3wp^Yf(?{dWN;#!^&D^`qU~3gruZyyMQI^g+W7hDEAG3BO`-@dZ zo^YaG=G(7NC(*lXZWkB*El~s(Ba5Y9y}x>)v}BT3G1*;cK}QGp?c%~S2XERUnO4HF zQ??LoDXSEJ4LJnh^st$SZCWuXy{q^^w(ZAIP+~Wj9nzr+FcEn=lkg*@c_o(`i6Ni~ z%#|z4^4JT@f$*j*kb6b%d7@DD6@uwyI!y4=QvCJy&M2#)!;x*l)BV(JcX?zF6mEwn z!qOhv@DR@4J`+hRIgX^4F4SLTIQAk~(WOn&!yg}(AEVjMz8bY*p4|dx5s&Xc>*rrS zlgi3P?-)Hr`fi0i5b<9&u#t+LPSHC{7~~)4zwE!jG+zqqmaAp`x({bXq6cp0MR5UDU%{F-580g<^m~t!ulFLZ=fMbq@Lm(~ zEeV+0BMS7Bsf8^>S6cqa9yAQ;e5?F3&6LBBX_H=q@Qr_RXUzECNvaR;i@dtW>NBC> zgd>IkJ55l4JgFOF%qngGusR?a9B8hoPjQSZuCc_!-d8@r!AOLH;>9|`rrlOrmwVii zP8rrcj@>azaR~>Hj)CPDHx}k%akYSUi53jh=WCUz1<~Tij9x9`V=q93 zloRg+tMBHvs+PuKQA;_?HyW6O`y$g&ExKCL`3gTnMGe?{-g(B$;~UAvu8V_)x>le9 z3x?Hl-=9HYbo1t6m$jjrV0gkw+`A9BArKX+36 zxkbD#gXZrh)v)Dj{n^-eENU&PRH56^hpuY-vMloWsg;7$L(J>M3)5MXOlm)~2-HEl z#ojbY>cqTR!yX-#Z2@;RcV2Yq9o$oHxRYNYbHqn!6P%7S-kD28h8pXU2_z?s;5gK0 z?^ehRp)FS+JhEhx(8C~u>T!4Hj;OMS8Jy9mywT`sGHJxRt91><7`-M{dXUdw`lO5T z{ijV2p(L;>0C^xp&4Gu%*aSnPilH~$FVXERAsgsMuE#CwrSU*ey%qe4&s)PZL_1FL zT&?0Xt#D$LQ6OVGaIPG96IITPzrm1$B$i4Dfa3EYG90 z*;|T;xHbS=ne~U4ievg=Li^AJ_E&&PM^Z6Yiv!AzNbv(Npbs(>Q#)!HfIn-sGvB2gejF0f(e?B|tnBp|N5a$Vy1xE#Wlo5Xex z^I|T&HO+N?r>X`7a23}LB9sFKwi8%lhZ|O|iU%D(FE&IC@JrCp{7QuOGHBJm0WY_; zOs>Si>wUYiPJnimVYpXoXzHo!rlMLn`B1zVEQ*iiHbS=Vqx~!M%X8k}h!6HqRcbf8 zZpOKWe`AM2_(mxrEn>;^H|}Z+_kV_D`s)S&VTg87;wO4%nR@J$MLji1P!~kgVa-Q{ z7bSGIk=#&hqCPhHB5HoOZZC`*v{BDqK%*w|s9m57qk-x!7qcfx8B-atSc(45hD1{< zzy;G&K5|z#)o{%V3CTZoo8TVnRq?=nKl5}-{2@NffGdff_cgG-p!Wlav=xHiVEuEM zx)q6Fv9&ex4aCJnw&^?9&<{3~!m<4F?q?i`bqDX4bVKLrJ>ESarNb|1=ES|=EqjuH zyod-`+j8a0(ovMDa`aH-K5BkH^O9F)e`qDDe`T~LcC=N_=#DFfzbPdQf##0L@TsT3 zY>X|+>vEwcN`s@NGZHYB7RfivmI$D_yNA@O{JSjQCql<-!$7qfvI))?3Cw;)G|m;R z_4(DIXoQ`%M@;#S1-g^)n4beLA-;GU zK4cfRuTy*;6A|`|ogUX^%%7T8e9&_Fq8rymY5r*ww+IRnE zA4=lSGKcP!1`BN*gI0LB3?vZe#W7+XZ=Nj~?7xPObd#ZcW{$Wx;e;FhMB!HYa96o z6mU`k5`)pxQ{{5%(JR=^UPU~fH&;GvMML(GN{HLU8Y#}&%&}i8;vrBX|N4dI(y6F1 z4eoX{n7jZcP*p9H6T75c1w^v{f^l(*YY94DX$6$i!abRc4b&BZDsb57@t|TFi#8L% z76EPz@1yt`C}@?x2c?Dwm6vvOdcC1Z?rp9By+1Qvw&k{BJ?9miG4MgPJwrV=2488e zc{@4_v};|PZ_ui8Wwr^ z2yOZA|}o)E>5hrD|Ww z2tuPgkMz-XT3#vp-M^ZK@P@FK}5cULuR0(}&h`23Q@{2cd z6hB`+J7b(v;%0KLf3r~Y&zUw8OLCv>3q7K2ZVUtlR)YSZ%ueDwAbf||$Z-ccVWhH3 z!;fISU^h*-wq9&z>s$0@ zBq3sDXhi?T#2}b>wLxnz>wtL>xN`tuCAex`suT|zw-<%Nb`y-vi8cKP{>ATL((EQU zJ{W_Cr)LK)L^aL2kpFzE5Z_;$MQb9AF&*Z;J_UGLYj4ZZ)o77o@9We zc(5d8;0zB2Kh{mV)EiJ~K=Tn;S5Usl_X8qZ@yF|7_e#;}XBK#af^e0p<6rgrh)nke`b-E)k8I8~m&0p#s|2tVDoI=hnUq(F zYzW;Adg^8>_Q9EoIfUK|T|J0h>-~dWXPahJXc@vqB>*`Se}6Ko>;}%x3{GT*uo_QKww;@cK#^gNfTy>R2e% zj|V^UBfPFP#0QhH=I9x0lciwQV%>~4Gy>YMo} za54T&!xf`c-(Cv(8;7?xY4CahNt|_8^Ab2vxFx5AIF?%_h{`5F%jn;iki5`3S|3{n zJ0z}sGvR2xxo^-k94lkN=T6c1@R(4=Gt*Gq?j;gV;WiHZ8O#*{G?)* zq&B7pw~c%^ZLaEwIA}_pghua5uJOiLDXd0tnLwJom=bO0k8J7lTMMTKzJWb|QoA~3ST>qfvb^lw`AF_8x zmfv7nbmWSB$5n--IWJ}$o!LS2f=Ll zBIlA7k`GM!9t~4QG5NVcAz=M>9-qiZJp?#IxXOQ1s4QG%h8YhLMNC57 zDgTYUHdI@B2hC^E{g-$I**0dHl5d^uH`7$kW(vVD!$rNpG~-;t-kDt(RZ3ZlpMOp) zBaaL`KsgYVjRa9TKo`a+1{_f80%sODGh5N?U6KS!6ghb^k(h+YXboT`Ae)ZrehF0V z%rB!^;_Cd9pXNNjAVJV)tC-f3Qau#USiy~ZrtN#JZ7$OpNlNVkr?I9wF7BD8@%@%h zGUh!YA~y@MVZ_x#pg5FPuzUth$W*?lloh90AgiY)G0d;Ys&_ARub5I+dWRyEe2QK* z{V9?0&xvDFA~k#c^^EAKukCWtU97bdJ?WV(G|G=>~Rd>TPr1#;p}vOO)ZL;Wdad8~m$Z zuWOV5sgtlfbrv4wZN<{R$MPt7+QIw>!{RmPv+~Xq{?V)mGhYo^TJvI1#z9Yo-SC{u zSkxLj301mOY^l4lh!W~o0HDzQ0|2RaFy|U6XlQ0G5zZuG5at^C2Nw&xZaus_!B=n! zGcHARK|cKmC1X&>;;}LS2K5&3L4LYUd{|gxDxc=Ja#fRP>npBE@b&;{)TnBT_TQBA zZ%?X(=wx}joX#|UNaN5XZq5`NIY^yDA?Td4-Vpl5=T|-R7~A7dhFJjtuvVj_W9#Y# zmU7LbD>h4KpkgP0yY1jwVl*|7S~%8rI0P=fyh9FS0tW(Xp$}MK?9g`nV+GVrHpsl{ zXzg##VvLQP5sd&_h~p|^upCcB;PG&vvZa}eQpK1BqfRripn6)sJk;T-#>8(>4fI!M z9h9;Ju?=Q-yKymKEli=db9l~V&EUA6Lx*4p zI)0QCB(SaCCqaxs7-x*gF2LFZqgP{oRJRk4N#uhrHcAXU92qdeVdDPM@k>`)fS|Y{ zj?Q#|7tI#lILynkhLXfxY~Fw$&59hS|K%!&aVrdg&F|pR^pK+#hnV*b&&AsWHi9|c z6$n!Ly~qDmnAHA6)YDmi!o@Pn(0ewKG37OwwFvv~`cCA)TIfciUw-6$5y`0p79PWa z*V!s=kk|7=L-I$X%ahW&BLRZvhz2N$}3C@7JM8$%Zz9zG8_+6UJ-+w2w~`wwsnHQ`CG$G-|AyDy7)?h|EXj5hD4Cl#)K#M0o8j;c-uSDZm<^p< zWviJRWhAV^jm!tp;w(SuV6(~2;MwhuGMUC9At|i9K0yu8w;r7j|9hM)7xoTClyv;h~9CccGmTGR5YLftq*aXEE ztzR=`ja*96rXyWdV_3A3)*k7%p;sw%vpm`WNB?Ym8__Rel zAj4qxl<8na5)y;AZj3{|NuOy=Vz0V%GS}e=2#vJ>1k-Ux!cEiCUJLzUv0+2<##(jB zRp1Hrt`BN0+kwXUmsSn$5BY32{^aL{J*kF=b{Wpg{@9H567_TI`pq z=0vVG4_6i~I}JAtW>M+5&M0Lqxx(abY^L@%F5TO8=c{ zZO{#x7pM<^19r~EKQ->0h7cR4<^)pd<=7Zde(f&n}R1vhyIZMSzWt@Jiv zsJ?=4mbKZohelIGhPp7U0VZ;s`GqD5#g0ewRSk6Jhx*(F+3`q}wREt~j*fwG8W_;? zmZPEfedr=!S|U{9$yzrg7+7MyxWO!{=K~KJzX-D`a36!;94?8mqjj$n=}hEM67Gh2PYNz(&M>#bb>)MZpp#k9Pcz_(8}m^{R4pJ z5v)DTLo_2Iu+Ge9G+*Xn4e9Hc@#HNGy&)-^yy|=dRLlsHm93Uq=s4M~hXy&x^hWhKauh4^1%y-6edsOIXJ| z-L+CU!%QYdNz(@{Y_1VsB(j%oI7`U5?Xul&j@v~EWXEvc{Z;BPqHzadyfV-T=)cgc z{Z#Uf7VNb+SISFBRRZaNF);j%V_VGa~biP#X-mL@-&hVir603 zB*JsDXh}MZf#tT!l5gKibGO%S1@Mjml1`xWj=|^Cj4(x;S7mNt4@GUBRi5ieZ~6RD zxenBl**{^{voS0J2rC1&omOG>!s6&sIO+j^aOJRlPsvpP|d)WcA^Z zxsT}$FJ8Mdn4N0>N<${Af~w6DU2L(BtHIXp1W>m2mf@^y_)v!H5Fw6G6D62x#bOfs>+kJaC3ioS(j z1kV)v?~h5>kC9U%PtP)*<6R2S8Mlmz> z^T#ERG+QA%MnCh$iHgJKnriD+MnF!1zmP;xXI2?w+x`wF6tSoaix=5Sp^23rm`ym@ z{=$20@jC4`_=X<`RaVbH^{>NC;Ir3fRjKkr@wk&5;T-ny-@u{HV;3q~_MDfC5h?no zol)PP>Y`QfLRfxz(DUVTUr@TuV|NpTAmr+5slfhny|9d+hGLv*tS4V1&&?gw==+<| z?%0^B=&jAj!2uh>G|UKPywyC;OdL8T`ZmTVQs|g4soI%iK$oE_Nl*tvS*p1^tMYlI zgbK{E5-gMkccUmfd|^^RwLn5Ef!j%L)~}91l(R%rBpN1GBF_;fLfFRlx(<$#5|QW4 z^kRQ>g~z)vyU&=YWI#dOjI^#qamY%`t((#B;=5%><1ZXrDVx8w_UXb^KH6FcY&Z$P zS?sCBm0(+2e#c;OD$OFV zAf-Wj2M7&fD%HQ}jl%9c#$GC?sb>Nyx|`=L`a>fw7t_f0$44KlL1_gI(I{Vnj3F!= zV#9t9IXJ$i7{=uT#j~%Vxo_6XF-@kAsiVl4R%hXw#Qvm3*%;&$v|Axr}=$ z-t(sQb%BsNF{syk(^tC61@BPdmz%1I(K#PJrjnOIC8;1^_S`Hl!~+2Hnz&eYasK4o zashK8rR_h5B$mt;D)jT+vm=@_Ln7(zaHKi`B+FNVgK+0_>_T~ajO2oyN1Y^mt}WDe zcHj(!G*@{#$Q&i*O$EcwT*Xpj_np6R9Qa+&jsW0F3>oX z&K&-xdZXk7P>%ks`famUlsYhth88PpWr`pDYXvplx!fmuL&%usaL=vidk@%&((18+ zS2G?_x?$*q?urvjA5)Rxk@}6CeSCO58fjRh(vSm^N~q8B8kz5LF#X7J9RMy{hV?4| zir>4>KL-|dy=x0tIw|hn6vybP1j0YIJcd3S4`cnFsSz1@W@C&ecGy_nF6*fyJTUdrr}nq=bp9@PjkYqJRfWO>}eZzct~w%;#$@6&7B+? zU!nL;4<}|9(c)~_@SRAXcQmpO+c7V}%)-S%4_QY^r&C5EmS}sxYWPC6y^56scnE%f zxAq<2hhwQoPrBZA$9{3n$Q>9YeP&bM)JQ}oHEm^!PYqZ;l z1WV)y;I)a3-fa?G24qD0-4JAUt1!rMWlYsQqf~17(H~Ur?_xQX;QP}MB%bI5Y;DV* zeoZ)lOOcI^T~TTuK2-DZL$@_#nq-uBs+wmZC-$HcCo!pR+fv07qdXUKcceg81JuIk zrkhvbIpUN%uTUq8@`}3Ec}*N9AT?1uJ6VkyeNLnV&d-FIfz3umeqMw|L>Ia^CLY|y zn%8{kccp;~k)DJOiQEhlCec)#@8!5m1a5J_*p7HP8k?0~kBmvHg)>CIpzKyhA;|>{ z2UK6N68r7W8k?I~qTlU|I_U`v#sm%@L-Rq?d5!*K4&vAIY+3OYp*6xDYaHP#HJ8V0 z-x6dEOnoJBVlMEc=up}uFeCqG*)gM($K1P9NV^3O|eZ62LNkdaro8%U+TFIkkgjR>z7ZrZP`=1&)BVmC_(+HdwP8hVG{9dK zSFzq*UNplI77F(8(&AX=6N^#F6m6w3OCqG1L3zc1O~p> zkK`2t7Fz<&KDro6TWlACY02vh5!qe14mS2c#S^9cI_Zp_aPNQdB>A?D5VoZ6g|WyP zqXYmchVqbGKhI_lw&g#`F(=BBeFwU5?Z!1mH z#Z`BvC^zFIe)>UWh|oR#zxLkpE6VnZ`zD5AC>f9(knR|15$W#kt{Kux7$k=rN>aKT z2BcvC5dkHXMmiM)#2_6JNx^$~e%D%$f5Cmfxn7>%c{6LT^W6Jb`}pq9zSvMsAT`L@ z$j)`7>Hy_knKkIXpVdp(Q_+=Do~eg0bkEnfRBuETp%+d)DR1)`?Pljw6R14mLMHBv zs*ip^Cf3^PsT=sbbuHtrcuNAy9LISMtf3IZ=Q4dhClc21Gj=5p3EpBIam{NC;uJP$ zan6fbN-l#m zzpXB(6Uf%KsT1BrmKTztbTJp$F6B#(FCOk5_$ZuWA?#SsV9n5eiZDTlz!Z=gv&z^N zKxy13R(7fl|H8DfbInz|u?5oMjI~(FZho{_?Kc&d-{N|De~E1N7ztFE0ua5xiP z(-SW5n}Y41w&`~LNwi!~{n)3TtujfBUP%@PNJesl-N^|inrgy=E=JSV>+?v&NXg1^ zW&9US>D_X+WVOXH3hv97NJ%c(Mw_d}6UTbXBupVip`>vVO$GsBqq}`RQ1>cj0U~(8Ow5jqamY1#-P0B7H{`hr8VuCD7W&(y=hkUoD$oFSJ zzN!wr%8^Eo#@YmHk;3nRwfQ4{xs^Jq4l2w}(jD6)6F=ZZl2> zPkQZM0Zhjms+L_>09&7E#C99l_zAGiUDgAD}#hv#=3IdQ{r+rTZd1@C#094rHy-JD~}>_oOPu}Rpw;* zr+_@ynUl*jD{x?^LscrSq}J00ZBN`L>8$?o`Q|^S5IF~KpWJ6`)yX-dG`nTAKZQz5 zt$*XJq`CZiPadXo3mlb{%HQ0sY)Up-N%t1}9Vjv(s@6P?=~4aa^e1Zf+7YGPy?yBJC36_oH{5_kl>Qp)?$ElU(XXZ=1U&SHj?J6A|bpeQYHDq!06 zE>#ogjwpe6xxk$E%0jVF`<%`21rSM*W-LS1qs`S^#lbw`(KDd({3324@D2DD;q}_H z7f;|xkgY%OgsqgiGIwW65LVp?M*x1-AgD>?^KpFe4s{Jpvj-8BmZBJ9II-!5$^iiJ<)YYa(`0{t|LSm###RYC@0 z{sr$A8a5n%&l_B2)pS=52{*){4+g5c3_ay8l9EzYvoPJe={uYFio{j>eq_-!v*#~c zv`#!lZrcuB@Z{?SO^~8F_k1~8s+N+_Kdp^{Sta%>Ua{4o=XhY^9z^i0IGZesJeTFK z`LV10O$CE*Doqn*n6G@0n7THOYcfgmF-isqv~YmHad8fhkc-N_;8%!@bpNcWSYY4F zvNop(pTtZdR2|F>PAf}AKKRm|*#{4MKRc!|Q5##wgn=bDnUa zdK$GfW#+wKdCU-~nUefKW=__l-3ZGhUg3o%x(UbkH8d$39Y(Cg$tm|(m*fB3eIv!7 zoL9TWP_vWW08m|d=Df9;cZc1SV=f3&Lj@KfL=+s`+wFwb#a4KqL+6U~o~XU5neV}* z+u>%907I@_44NA5c~=!@Gav8w!_~oa-UTQcVwST`kj^+V^0sUqUpBi`N!nn+!Q63b2KzK5>Qo@BW+974^TEm= zapC#%C1~-3NXGX}`M#n=RkI>}v26U_FJsWYFV)(j^k!6=9L~R^?q4gf2y={V<@e(^ z=tegyX?@vKJu7ufCyJVWTI(pi5j2<2&sc~C#NpM=2Q4xd4J(fp;xiG5>o}^tq1R5a z9UEa0I3eYF0_3H)EmxxqoF&@i@E^{xa$;2BOSO2MU=>d@CuoiJ$iY0O5`2Z9!A~`y zr7}d#E#8Jz+{3wd%OK=Z%K7MAR2V0o$YT~VC;^kU*>Xy=eJ`#_!LAd@zVA?3p+(6n zOYl#q0ORuPIu;{yeyhghV5scQ8QJ>6@Ke?f7Y*zB1*oK<+U_{CTBbVsVDGSSTl~9B zM(%qOCOMQSp{Un1YI=`N!a(d-k-gwd3xfB|=*`u{R|g-4$8N>r#Is>g@nW5%$D*^k zVRl&?+1+$s%q{L6$7Dt=HU~5-B2)>YU@4X#m*%{Z{LOrO1`MXJmys8fgCDmrOw9a~ z)PQ}L{UtKHSDPQzglN>gfiwCbBXQR`1VLj3KKZcuXTnXsGU3zfk5P*L4xJpJ zg!3S{0T`bJ<2<-wWs|$=t@B0eORAf}2}sEiZ$kTkByXx@(|Om#H3w~mz5PU;lF~G% z>?&H6e?%(V2oreoi10IM<91!RiXiGhb&6h1Dl(ghg?(Y!BxfJlAz^P8 z1$LP0vt7+p11_wew6!Y(V!n=5FOkw4(m|5+-GhiEmq&YNEqQQIbGv8bHK1zkI+>yD zxQMQn{<4ZRm*+G0X+Jb8Gm>#mWekOo1D z?Fey3zC~z8EXT;m40oTt;**0Kl4ZP5yNk)y*@Q;|pBI$?h@RO+v|alQ2JOL9 zI#I2L-~nJuG7z67>5Mo6OPu!XE#qTie?DE`r{I|^%0gc(xFKmkl6#QD+I+Iq7hY_h zYQ&Y52kbriY(_*L-bFkLt)RN?0c@jA7?NKxacz$D^_`{l`qMHT?B!&_Xpb(N3Gk+5 z>jyhn+Ngmc&C0&RB;HMR2vIg0{?reGA0C?Nb~WVgc_#=c0cMnM(XRO2OwihVOnxu? zsU-bD{<|LNm&7lm-(Gn7$e7+ErU$A=a{> zeZxyZF0uPOKbQskp&x6?rj)thWJB;#KcquYRo8xlF*Hm^*5-*0Ue<)WscU0w1+Ml> z<0%t~$?1gnj~>QtZha$*acw*HJP!NSD2I%D1w)ZingI%>}la zVL8W+>j#N7MCx_88u5ah8>^>evGxZtT$Y^LMGTr`ku7YvcNb@}X+5A~FsOIAL)mje zDA(^K0)@Q7|$*^86o{S>tJgg0ajDM4rT z2A?t>a0oYAEfuxpQ`y=P3L?@{$4k9-A@O_+f5>i;Lwf&^mxrliL>X&AM;I$2h35z# zYhkXD8)&d-**@x;3VR2+Pj%*GZW#jEUm=8WIt*Ewahg-Wd*OHKbwW^o-ZkBtX5HOy zd?ma&C164<%RVeo-4g;qEU0i8ZjRMxApY?E0dyrBDi&0>r|N^{^cDRNvp(_3rTv(h zs(`a1!XG1MU{Wdk%_mxNKlklBK(ppfj0?%4@XS3HjEH*e)$OnDfu>f*1^x$g`QG30 z;n-i^@88EmZV{a0?DSj?e?;Yf$u%l5>}n}h+m}Y)^eUDx)bX+E36a;STwydtFivb+xD)d)J%fDadEU6H#;=c`n#JX zmkKX)JcwD__@P=rty#HNu)Gv9sd}UCLCV=!9zF$OvA)UAs{X=9EmDcBb_;@qbKfrO z>_h`-=^V?+?d8M6A0GMd{A9ze>!|`W<&eV_3`t;$u@qLav9Rd;GE&4A;8PE#VW~|5 zU`o%xmN3e|5bbELrnt(|BNRe3Ya@hPy+XTwm7HW1VgTgkW?s=4Z&0mE<73IgFI`d6 z)B;jV4cR4=F8{RD*3O|Kf3PXc%CK;L)0-H+68n-qIq-@9^1N`ezMp54hW5`f-_h52 zNadlb4yY!Q)PkNTOlgIF8kid4ls?+07DeGg%RlK|Xd58)tZiDq-fy>nqe1%f0i)*F zi;h>X_NohL%PHpcBdf0Z$nHA_7=gNY$!8g{c?h%YbQrM03g;NfSkA+={+Q6Q41p6p zhObdOf`<{)nKoiG-r^yraEK_`E#o{AkM-+hQG*j>+mJhq1J7l|L7y{P*ZAng4Wiev zo@)Cxk{Aol)y7+WCvm$2teNC3HQ*DXDD$*iMDO@1$x|2S6@*1c;FbE8OoNg->%(so z6<0F*bbO#kiMCL~em|-H`o7F#P-uB?;-h>K&g$$foAWM1F`nD9p9~kgw-W)Fe#NQB zjmdyzZ^xN$6gfnucAcK600GH$=72#jDL{g%A(43H_gg^$5G$ETIZgm|s-+~XCHEE+ zko`!GBB%@j70_mH8U5_B=tXPyqiyNE^G4;muT5FJ6i_CyM(aNI-Sf&OuQS3Wqf;AA z;=CiR*^BjW1O-XeKD1b^+*9Bh1a z3wz@7Ncr})*InYbwa<4sn1rH!aJj_wY8&Zcg=Z#N8%oxhU{0eyTxC(OeY{!BE;VVS zR^Q@2+&=O)>C@I7?M;&11QmCGsN{DGAYLmT@?{YFS43BHUH$sLaFd|&(wLxTHEvFk zuGIdsrE2`UIu4t7P}gSJIm~DJ};}hT{CHozfQ9~pMUPjzHtW|5fj)CVI8c`CL0FQ~5 zH`R#%{=0EkYtE5h1xD35OhFv*a?63Kd-NA^hRG?;ulTRa)geIR>G$3}rb;ef#mkOq zS`-L{;va((4LqcIl6QnFH(0?E{l;b_mg?sDsVq&)F!m>Wz1Noz#AGvu$P8m8EvSJ?g_h_Uv~O6_2{OCYbkUH z^kdr{FqF9jE9xoXQuSmNQM$+pf(0ZV38dDrKcOMX?SC5DlltX~)M%Rxj3puIkGrdb z&G^`N#ew+E)D&WX5=H;6_{Co3LDkk7VE@VdB_;?$?#`8HDF)ofH?gZ6ebr4ab{jAn zi*5})601Jm_DW3oine7(S1Kq6%cU&Fa^~w52#p?Z16Lde)zBsC&|?WUZpF_F2g7#= zkk@C)o+Di?{A8P96e2MKXEx3yiOY|jh_agrJVICkhw$7Kty+6u#s<><9MfqzI@5_3<1OyyaLgfrb@y>t&~$OyCfPhy-r<9p3A36L63?g(QiWiNvL zrwngwsAJYvkNyjio1RDlEQGFVaqh>W*GQa-4O7LvP_a8Z@`)Bk7cvFT0gyKq2Mh{j z$e)p8x5*!V(<-uPnW}d#|JCp?7%~!pp(Y8kTWnV9=kV*izIYd1-WF_+{y^@5ga2iBq@YtzxX9vub;$=cVqISv!62nN=x&kF z;mVVbe0K$*#OcWjdIsBo;uY4%9gPWO=oBW)$bfR)W{$|s;CF@F>PJ!u! zLJH`TAjVTzQMHM@0Kzu(`tRPtlJ{Js=k4F~zBu~gHO9B0abEIAK`3d8g*qH55JYMP2@;ccWF3RMUeG9W=b*VCMC>O`hR9F)63H9SWjX=c;tHY@ z4@%C??8oPy{~@rHzXf9kf{kUgrGO66X`Fq^u$-aHFYFT#$341K&~e%F)XSLM zslHs9jqzcb7z43st$@dO^iyh04qOA+yr2d$CI8r%II8$95R^O)br>rkD^ijRS{J=m zLSiGVG;+MPb46c*a#Qxlfx+HvBf}|pqp(4WI5)iEba~ zQyIn?M7$zA4vom1RrgOAS=)FCSw5XY&q&9f^$CQHCq%aF zKNLP;_(tuQP=}}+$ZX96oLD5il@mWCa`PdHo*hYNyVdRuI;X?-?@p>nKuj2swE5j` zh|U;{A@#Sr;>IPu`qMMaN}*Og&qb|QwvX9ealZH^Z;;$&R3ox{g|IJcsf_y7{z$r& z70Y{Z@Btu{xwQWW2a_~aijKR-Q3aQHsuTC^j01eLLVsq^IfhGwFMKA$3IeBqm<$W) z!M~2aXu%)n9v_rKzmL$Fp3f}T*VSU07+V*NPRz)Pv)!~G9U?*QlVmZ1LuljUn$f&9 zrvfO87P7-^pV0T3$tgmNZr_73ZBN1QV|%%ULo*4^Fib7*^9--Ji2wf66^&b$3Y~*} z*KTH=ZRS&Kjr8-D{>J9|aEf=nzb2(wlk4%qtfe8$dl?or7h|90UI8(5=6~eEcJH*! zzxK?+)}t!fhF}2G7FRY-rF{5k$=UrOwMtR{tX$tF*Ap@2cX?#@37RKDU~FRfX||q- zF|p^K9_6~UjgJoksTv?X$O9;zK) z35G}%5hrx_?{CZWSr!N&X50(p%Jp4ClzIppWpt( zWA;hxH+P0YX}41bO$ZUbF|ddV(JBe<0xA)lO=5B-UWiq(cZWS|S1y=DV*m03mh^Xm z%kGO@QHJg3%t~N`=+@2bZdcm3H zKU|pY+j$mE;`pHsg1AI{Wi9%;=YNn=Y_0RgTnOw>`{J+K)zH#i=aaj5p>?@|Z&Ut% zHtI$WP<;Y#4BLS^uTX!Bf;Xa|pk&cs5Y!hBZnA$jw?qHmBJGWs zoeg>S7XtOeottZ$wT$MCzr}w&I}~640-zqI;-IMC{~5Kw{w4ksixVHg&~bi$;ZFl^ zJd}Z*+k!!ViJdp3)lQ7@;QvP*{1=Pb?SivvblV)!%HE&|{}pX+IIA{RwVTZU2J{AO zxh9Ikp{@y^ld}9JHr`NH8yn_*QvZtG;Y|bfFejAgFWBsc`Hg69?kW9uVl_NGJOJRbGw0Kglw%l}O)*kY zt0Z|L`#^%mMX{qO1j;jfP61@zk8Se~hQ4rmxzh?1=h5AJ=8U literal 356550 zcmeFZWmFq&*EWn6DMebWP~2UMOQE;~4esvlUMR((c##0b2`<5%;_eQ`-QC}CU5~Br z-}nE{nprb*uE}I(pL-ws*fI%I1W3L^B|wFNfq5q_C8i7m10M|og9w8R2OSA{NmGJu zV4amEMPbTDKJ7sdJWMsD&E(}_=%M?_FbJ>&(37F3KvyAH!vEQqfTe|j|7RR}oe)bH zg#S7R0NuWRq@e5TcmCbNXTkp0+0d~pxc@#IJ~|8jzxQ8%1O|pJlrs^!L2;1MbcTU> z`{8wkg-K1vhk^M5BP}MP>H&M$(jQNG=b4Y!>V4Q?Zpx&)JiTne2@{BI{v|NZ%*JM$ zlxUladf9bKm}XKONt!F*48f zdw$W|HL&96zq+mpoSq5bSIg#TI85(0Af!&~v+$^P${*cWAB+yA)|<~JNF(xS#}7KyI+|7ZB8 z>a_j;xssTHIEoawY&T-O;(x9V-GSZ~;s4wdbmu>}^{>qSBdvc`=|8&lUxxP|OZ*om z{sR#I0f_(OW&Y!Q{@cg?2O$1`0z_N(#>78d#f^-@<}5?W6@$VTW!EkJ*f+Fr#{5z|^xRzWrBaG_h8;H+&MLc2uiJ z?AEX*aL~yWWY6s4`Y!3m&;^gapvK}W^EZQ5u4XT%f^qFm)4%M6*S zdqfKFVpeGIx(A|oU%6%M=sw*>EsCE-QraGO-+L-gH;_ZhEymO|1sRMyC+Op=?L7bc^!9|?qfrWqAZfNf#IbDnplT(1=GFYx_O zRo}!KR~9VHZ}#F@N`>mKR@G4+_X8K@$8C+iSE%X=J{jLzyoS{6oIAGf)lZa3G_4hP zbi&l|2&!g^AeSYk#=-1@!uh=CMfAR2P3E~)UJWnG?s~_S?-mEebwaA^uW>+LR~5x^ z_xpW>=<1n;^Af4m9pv6u^b)oa0mzTlm_JpY%sa}`!UK?fxZ(6!fSK;4J0l-`d*>;| z7BB1^E8Ai-c9gHkiGM3)Q>Z{Xt%H>=?G>@v(7CF;w( zU%W9{iyRt&-0TA5B9!dh!4@(cJB;z>FpWLa!q9hMwu8;$(qj->b6XULByb zdJIOoIripsc}Cr`&h>sbma}@#-4G(-Hx2#$!LJt4E-dLY_l4%U`;#io6VG9O1o94S zZTh-W6BEaO&bB;tI;Q`AV^CNZd}!8B`W+>()rP4t7rpVTIxR+>IY<6Ay0|qbB`vxi zh0(3UhQ+c#&Uz#WPMvd4WG%JaM{zO#;JME*B&0Jjbyoub|)*Uf^`Px3Xg& z`=i@5je+|>;)reGK3B_EC^2kEZF;t@Vrm=XN5v6azs6a4*(z9IHrk$Yn*$6H+VY|O zo>k=v44s`7Z_YT-Z7mIEoMqF$-VZLjAJUuuWS{(01%R|f4quGr4--7wJhYNbyi%1-jb+(5=e3VnCl6YU!cPi z$r(0fneA|&(o62TJ@2{uJnBk+Kc)&gnO!(m1~0tPPo&mS%A~5pkmJl|Dqd1O%o~DG z5bA0S0?hlT3C8F9#`waN)rJHZx~9h`$yi?prj0-2Gs|c~SgI z9jhYy{)qNbS~R?fkG)N;$;qa>4*;d%i<-&3xt0O6mT4V<%SUSMJ+St?O_Rd(GKaf_ z688wXXf#Xe8d;F+q%UOLG7hVJY6nKe+bNw`x-6j%0gctA=-l`_XcDASKAUN@~Y{pMIaWAbTN*{Tydy>Pe4h@ zK=TkjFU<$KfKO&oN)e*hwp;1R169SsO`PkAzWBw3({3$UI)r2ohn4q~uK_Mga)8cs z@}Rmp9#p5;VX-m1PziC0!Xr%xu{=HJghenMQLW1X|b#QL&m*W~d@p*R=p?2f(!GXwK|{_rO_Gr;QqYjpFU7t7W;+ zj=&Kvl+k>{gF2L}ZjNajs0(V%fa$DBxs(JuQ4)j(zq`ad@Ru>koz$pAFM4vzn>ddi zXl{2*XTjZ7=foYMmvyG#AZW9)d^1*Z_w1Ad#4$CDEU=Z!h3>iTtiA}qBDE8pB3Sz74$ zc-`Lw2m269FF6>$!z`LE_*Fv%^++ zJ~M>)Uzj=bb<*!lc#hzO+>H%g?rnAuvWbYP2Eq`?DrMI zOv3%d3vfuc{zqYarhmC#uyg2a-7`Rb#_{VOqvgQkI6P1+lq|4{>4Rq7`tfn8MuY?VEz^6nD=r#w8= zM;`L!0~H3<^hj4qBER&ypWhwscC_d}?!4TLcZH-Kq;0Lmi#(rj`8|G}Sa76d7~TJo zD(}gxG1|qQW_SuTuHv$Oz|UF=6|^qEvfJ#TgMx2?hbC8L+fWYJG*pif_-BipH%6l~9-m44g<4-4xKp;Jy>3n>k7$>6 z>zZb3*GpZ^HplI@^=H&gf_Bw#vG?wnQb!??5*qm^AI>0m;q#U;hIu#R4stJxXWI#> zZ)~zfK1$%Lm<4D&T_4NGBKfxWurhPi(n2_!bdifnY${12sQ_G5zG2i@QI2%c)+VQNA_$pOh#ag@eR}3O>$&0=@!mBSoZI9KG%;{= z^LgAuB1wq2Q!D7oedxf`e=H-iJ+eKT~Os#iMkf1)J^UkifKn`3!Nl8PY7)Tfnl&fRNVPAWyB_KNK~e+O~{RobaxjEaQ}Z z1Z?`G?XX}CeT<8hdN>#>vQVoZ z6i4dyr0< z`Yg!KU9Z-MMT|NAg5*sCY5SB*XBJ3VYTCWZr~gq{j}c%xcKqG%uVbXThar~anUkMO z&5MPQryLqxvNPDyzVByKD+xb(hNU=ufV2X+dVd=|L$WA>=E~LVxr_8ZP5=o>ZaF0(Y?dsO zYndLb%X;_9Lp?m9^jx1E!q|EVEMoxyu>wQ=sO_jx!XNI7c#Qn-PUcOCrzFTzL1m5k!;u@_bXrHH&ocHO8-0 zFJf$DK5kp#Zm;Ws27NzUl?)#h1ky07iKoP8vd>(CG`l8b zGqAYU_p;fZa-vZbX#*JXzo&}k)s~e~@d6P+W1ZN@-|H0%e5%4xSuEB{f2(L_odq%% z4ML-%(01^LasWa7{vyj})v)-OaSf(vnuc;VXZ*a6kIVZK3?$nj zHD?ZfKZd=Yw-M~}1rIUQ2j11*yR8P^=GOHMd&(UHy;DQ9L|}vWk|o5+9mAx5!a-P^zPN_G9Z7kfbCXh;LaV!QBc1@ zp{*jn&NlS7Jw`hIQ~YT8i=U?xzqRZ{VmZ3I_WY4r)wVm+xyZ}1=Gk#94PPyHzb9`s6R?P+s~x=)L1*gype?K%m*xs97&e7**v>W?Z@V(pVLjk_cQla(lSq1mCnwMfhRH@J<6_bp$xN6B(`DaOdv1f{F4DdpO$t#iQPl|+y zoTc)4iRkEFjd^vyi(l=pNbS-)$EJNx&qTS&Gak)2@~z0|jNCH3sQd%&)x%ojg4w(u zbje-4Vwdkf8yLPpApFT~n%L?=Ibf|hN9$Pg$Od*DV)S-!(nnq_#%s7ANL5F_)gVl#5Rtnl4dN=lXBD0T26Gif_ z!RZ$1#b}DK^BxyULx`6alI^+J;sHhR*#$E7M?Tr`WpJbkgE%%;qdSLJh$bq2X48o# zXndO>3ovZ{1-ytf(op^RZmGS$1&%NojbZ<32XV`a7rPr(_(GUzaup6vug_?x#0%S7ng#UPayD_ z?{7;RKKEEX9KqO6#;kf+bI_OypO@L9QAhB8%i8T<%W~ded08LN35g+DDadY39--%s z(W#pa`=xCUaiXzs^&(^Y?aZCKss_-cpS0z=vGuKEd|G|~Jf7~6A)f+_RFGJIP>amu zQdPq2ZaGeB<5h51P zi#8%M4t}@LdW-A;svuIC`7F(gf~c+ZE&>(!eW+^g=LlXrn1#L)+(3y}=RH@Q`gx?2 zmTKL{#2d*bo=B(-@lCP^R_O>M#HTgD}5jC z3o=)?5<2cn4cjCQ=#{cBS@J6A5pRnU_a&DHK>jW#&sS}?mis)K5r;k@q$BOF6vA2J z0VJuBIfZRknWz+6t(bv|xVGXVC`rGS*+)zpHB2=FAN;vSmuac)ep>6cJ%5ELkcX(6j$Z!=;&- zOy_(sRc6(|JGqU_e?TDKF+sj#>8Kz*8zcI1PfRdv@4jo-sFNFkZbv^{RHAOh!=hDP za=tJ=TxYko@czpJHuL8O>z4Auv3)I+8RvuXNJ%~gC8@-=U9RBmO^@WEBHF_rpgD$| z_Pbk>7ejV!YR$lp2T8mItntDmnSy>E_7~g7BU*LYFvT0a#C#s2r?z%^Z%U+a;iH|c zOf-e(CVtO-`})mq;7?=2-GExlbds!~)k4j9!OrTGzW*>7Fig>&6N5- zx`PHa9&?A?An5ZSNVWH_Fn|MH$4_uZd>J`CNX<8d?l-zZRxPIwC*ur zRIc~KuL03BmA4w=bu+2cs`N|+tlsc0RJOT3G?zLPC8D!2PxS}x(t9yEB-c305gUzB5=9bZz)SYC~SPQ)Dc&57M_6>k9d$2T; zC%Cdxj6w{k)#F9@g=%++h&0pmmh; z*9^r#6IMi?bacnk7Ov`h)8OnsW$AKww~3DKbIVJ|HpkzO&=Fzkk>M~gK7?tKky`qN zJLPS{?A@u3XWPNtsr}yQp4zcjS{M*9=z&dzhJ7z&YfJZ$C08%(dlH>B9@Nu}=8J^iP5=0;>Ikqbsq7&{M2oMA3a%;M=r8XCl4LIL3APT zu)I0W(|P|SXYKThv2f^}ckR$qXP9)MlUDB?+-H7#J4l^Ta%B^Bq2m=+?ji8$ivu}-aA4o^4r?KS z){c+envRGBT5tM$+x#C!{U-JxSgj(vl#@0u9U(C%!dXcjD^Y18?oy(-5^NZONOEMr zH!-cbNc2o~n8|%+lLcznf1BCcNiOtSOVmtDp4kLk%U+o!wC3?7A;t%-e;7=o&Wp z5I(D@(oa`;I1Ux8H8YaxUk+4%{x(wv2wrnDskt5)Irgot6S%=@Qz{dpzh>2&RbK;E zoN{JnsAr)^W-W**wlHEtyKrf(tUSBcc5l7y&D@IbhD0&NeDq<-uiJZm?w>blXl-p+ zc9t#nurj9T2MueDYEtBLvPkCaot?3TX>Ky=Ho27&xfl7~|6SwUeK%NmLh1s~U7%CE zqrGcAPo4xRnph2I>_#OD`L)5KGOG4v;G(Nya_{ot37W#oh)TY6g!E|Dm%5t5WXrMn z@+PCP&{Y3G+?@7S>-alzvyxBIjueBAak8wxy0XP)oNW2R>7>2ql8!y?!@kgW{prmY zTD#bZZ!lX?#a1`n>fK0X3>IW6)^{=j0Y!3e;m7{z$SOyHLgDPDxaBV>FpkoUg{`~r z<&@HfiJRP)-#}SDzrXX#nj1?vf0tW9OtOcA%eDUVcH6oVdWiMQ!^?HsdmI^`B3EHk z(Uo<%BFRg7z2L*uNOGmGJ+il=>vHu;O@Lk8liJ^kfg1?414I%gH^}5Kmsx**M zYWjveO}Ce7*ujPnM~V@~>CDHluTX*7DNW{`+x&j( zo1|RbTrRo@=3&s=7RP0ATs9Iei-eUhc3EVY(d2ZqJ2tjlaj*KhyQKDdV@*W-d89SE z_TdE$<2#u1^i7Uu#EwNlg@_bI3;~I0~d7f3Wxj%8e|H-dMbONj{(A3>Y3SIx_SE5jpJm{;&_+1}sR%i||= zb(iFWZ9mxT5-_VO)uY%h*z5^q&?!(bu9Zlovre2(LbSX%c{;2kIZb zoRB@y2HQ_(2?#rfk1YIEfKtDV6MvCQtNlBgNfc-Tebs}1#Y)iU^!8%(*!O%dq~FQu zsb}Uv*u&i3odfxiQ9#Ovs7>}>CTJ-!@*apLEwv1N`y;`6w;nn6TzXXkLb3;Rx; zDCSRz{M-7{jdu>R@->~gdbHsI->g?Hp|J(#x7nXi7ioPv!D#|LFh|k2q&cSSm%=`b z2~^V)U;cYU@^tz;P55s8xTPy6C`3WaZWG=9P_Jox(P4X}HRF=1UD*G zYMQoJZ0UEi&mvkZ)Y>dA^utm`$nA7yS=lOk?BWy}a`QDha@+XDh_1?5ReFkwu*C-V ztwZcKMm9^w2DV+^75+CDqdSsF)j>h*@&k-{{5WAR@zs-)@m(DwSETzNLeI46 zf3tUtQ(^R~r%T+u(#h>@0>TSYi1{aBJ|6LadypOt`DX^bO>=BNubUPU-6qGKoR||o zj}z$vLLyKGAUR_6T4D8eMZ3=b(!6D@XKxM4D^~GkN>TJLmQ(pO*uH)v%zWD2dLxEt)A+i{{?=M4JYsr*$crA%?@mz z8M*FyLYj=Dt^~=SEF9i`&t+Y39KW{`0!0A;v)7Hkzz|mPbUpBvxkNU`KWumb3)%v4 zq?hsr+81&ffk}MSdj_b z*!q<c-oC%Ic6?i zFL*JN8F=3Un-6TnSJ>qhX9OcA>0y&V5%2f3QmRuA(pY7!f-vr2hLRjQp^(gO4T3lQPH$N0-`tSQn1(gAo zj;`KNCW1g9aqBeTGzSd!7#QyWuDyj->qSvOKT_e}DIfUoQ&sm)Js0-1_ksepDpW@6 zcbwlSg16naY4@f_YeTE^LsT6`F;YZ-m4>nr_5;U?hJG3`OOY`_aOsHJi~nQY%X5qS zs!!ERXl|ZcQwyY3QJF7bN+c-dWd8&J}gk;PZOln7($r1#Xi8I{_8G4*$ zzp^}@FjXp$C`gsb+qV=CVRW(F8?y|^+tO5L7^pYv@Aq)x1LXp(ZLJ?bB+u#eI?O05fz#}hgc$M+wuJ+NA4c`YO&KI zV6!duH?>s2wlln3cqn$OB|(jQpq1dA95fbKd{0{QLGuSmn5(9lOB5=3s{Gb8VciPq z+nsN#f__c}KdgfZNr)7XKSpJT8hi`Ae7PDiu=Q|oxLsWJ!@S#Euzx%aIiVRmzdS4% zs9wt=RQg0}QR->vcd#ABU&n~uj#~%TsJEQ;*n&&1h3`sSJ$_-r{Cz`L;7JzlmZW%> z`JMU1#D_~C^K&~6s{>JPDPgxP+?%99{9c@oa?dk~Y+nKexfuUV5)iz0_q@|j{qd^W zjIg;oaZjVorB+D!F2f5;|Ty3ov5?t;W=rl(y#~YJ5gv*9XCIvar zy5=qmJd2OV%i5lW82U?$|Lu-_EAPt@5=n-f@ch#G>>EOpU6l{?r+6>dEH9fg+U_f@ zj<%jo0w5Y|NB+_(HSUTDWgISMdZ**2->%F|Pf3LDzy4KZOBC~G;O`a_4ykn8OAj`9 zM<4!VK3JoHJKq)GWs@>i@OS3Me{N-&p{g0GQ;)mx;z~@niVYl%gty-bcp|zv-If^p zCpoF&hwOuKJk`agNlG9=dTX}`+?a}E^eUq6+G=``VNKPjE8W=|dau-kGHU$x=G6rU z-=tijuvh;Eh8n#tggg5T>coA_;cgRPHI+g|wU=1Y3JQALp0CPZ_PtMBn?Rt_E1L{l z!|Au)c7IQ7cyG|n57N91ACB5?i-p@RoaHw%k(d{4(-_B;epyJ<2TlV`hVIE&ZP z+UM1Gd!=c!_N(=PHaa+sUdzf_Z$UfBFjK`?Skw8JU7_y=8^seA1J4PTBJ4P8#kg>P z--|6A_kdWdQ15w@=)w#D?7Gwma_^Q(hfCKWMCG&8N5c4*fquPv-Swpw^Gg`0Lq^pS z{ScYnhJ&tRUQ_OaO-Nw^CGiV$xkQ;6wE1d6^>kFLhHUDO8$jThiMF1gR5R<%Y-K^qgx*IDsGJ}BsbP*aLLepqv?XqK- zP-J+Pf-8$>D)le&Ort!VG=?k^qJ{W1O)hFg2y|+2aE~@Kek}`rS}E<&G6#(m+uDpI zNp4LTuoIK4_@)n22LWyt95!Z3wQWZ;GvzV8=5lPy0;j;0YV1jhU~u;sA;Vt zkT^fcoi2XWXrTw^#kox*s~H&;$H~#$WAb#^H0SaGxAHVw(J1Uw@_QxCb0#(GT579X zW{=TQ;Slx4qSu-8z&@C>zj-HVUVF5l~SsC+`wd^E1EEL*V z#@;Gd>3J}`(SZ@XkX=dCJ5B{}SWc^HH|u{m4v-r9KFEN*r11x6=Ytx8RADyc0~~8K zzs2WuwI^1ehh_Jf+WSkVfv>%`-eg<%&O^OfB<1h8?f(RQTa20)Ghm)D@%Mj;R}dOB zk611p-p#LDIe0zMy}>z9BbpOm)RruJ1)>p z->`nO@Dmy3Rt?kj=WFt>L->iXd*m&8Mv-%<6WEt zw0QP9BT~{ZK5-K9RS;4kpddId={s)#7|>>CxmPbXT0nv_3f+dBS)5;#a*xEh(uS!g z)4!Lhi4Pb0a5cEQu$PA~AC*>cOP$glsCvr*BPdGY7=fD%T2oYm;R*CI&2g*Uluf*DbeopZqtWum zYud17spy~jss=AKc44@Y;UtA}+Y_09pNa=W)AZ+^`-f>Rm!RVcVWG5P=`!~S^kuc> z?>tJg5n$H+Qu~_Od%I6tswcfIE>CL?^{vjO5FL$rnu`MfjvK#tD(T&0lKac^S0jl! zJ01PS`H!_o{By)LX`IW74qJJ=jMD_t=$)x(n!=fT6LtDQBN#Ty;$eP>Bt@CI9ot z_RPIQDJhT{-eODU1jfHH|4!*7EMfXicOl5-<9@#t)-JYrAWy*yd1SluD;SK_5 zc-jRHYkG*hRj<-v#5GjDwF`@ANLT2ez^L9I4?=>L*#$r>eRHA_*RwM@QAb4|Nd0Ln zCy2`oQ)d*!%|4J{vEP5#lbK@dA~Q&cDxpWFph|+c2pGL7L{{VhCYfvUWz>7NhS=p( zwkLc7C%_=~7D!D`I6a36^6;YUc8Sl<40LCMNCfC;szvbcr_>?zrJD~Q2oJP9nD1Vq zn`-oQsg;R(1*Z9Ya0O-LY?l$+y>L#I{_Q&iygqP2U0!8)yR}S!^x0tSBHCSIO!7my zoxn-J#Z+E#$jo9iA>|+^YSEGy$#`Js@MP|8x&ErwXtMR>{N)tG*67Q@Dv>a+OSq4{v-joZX$MW_C}7m7t?_Q==i0AbTcIlJ){jEvXSyvc(9j#jpFGp3eY59MJ(qlPz|?GLB=MA62z0LgFLQ%BUthV<{cIoLn;ZOY{Kl43rib{Nf)G#ea?h zGUVbZkGx84*c_MB%R?Pq^Nll?*scF)#mV7zGb=UQ6))49qm`GXc3aq1_w=M9e>DPW;Z1bKKAlyXL9Sl7e#5bj%Kt z1KG>IYFd3tH!8AUYW3Z?PFseE=wbW6Tx1dv5w&^ll%P z37R(&NR32VT!i*m*e_@G7A+4mF_lee<&z_`u@~LhcLOUqv=gpJ%}u#V&rz6*^0o?q z?Dnxe3Tt$$UGH>9@FwStB*tK>ZZ3FTl}D$2mI-FUA2||*S248E&&r8Es+(1B&sE~$ z@h>iI-cInnbr_txT4XB!N(dLC2rG(N;cy|KIbwm)WD*L*4H-`3piVxi=tpXLEc_P~ zT8DM|`QMXjMZ;!9-pqHAaEpRecEwt@2^aB%~r;y$Vh9zmRoT=HWtF~TJs?{G| z$agpxxk zdqA@}<297?AJ7`p0lzXbS@1UYD9I-?8{x!p6mQz(9}Cjt%nbJ~1ChI&W2y3g9{Kf| z$jGE5Fj~@gFFghFsnbMkg+9&Y)mK<7`t@z8$Y`XHL-Gr$l@I71%;u#>b+y)@S zw1$K&%m0gq60dlelbrYaHQ@aWtKy3LV=v`F%7JFR6#WTJF|}1;xQJX~50RB1#_y?v zg?Op$rr_koA;R>g5%2jKTBMRvEnk-Hb*}nJEac_l<+N}zu>*eTm&_cZt}ZD7DD-f$ zMtOleQ{C^|PA<70nwku;sg^>_)VBlKZS8+&tJ#8G_&~&yrwDHpx2JBJS&=P;+Y1;$ z8ijOKI7OCxI4X&i>Oz5W!Ru;}N-HbK$Z7#`v9$g{Fwk0)d6=6x7@d(7MmI9&z=10m zeqVN2GDf+oc5dscIGyzSpNmDusXUW!Yn5A;_4LNKBhtVts+!lgeZQ%{wk`rEW?Ein z8VA;7QJq+wKU)9nou$0$ZOkv49puqbhmWx?LZ79zKlYe2(7bEo*wt-%UV*e+ZP^I% zf}C;CkI-kOAZ-t)Qz|+7%rihUCFMa>YJ^ z@r<#-1T7^;{MvI5_O$il357(}ywa#)w?WCLX@cehMSp(H0FC`;Z}y>18`DFmLW-Jcv4KDew@FXBl2t!50C zW7c->Rlb$TTk4<}qb7PTH?UB%C7=0HC|D{ta z8rwfKwi}S=8$dGg)0#7-tQ5n|y{^E#fC*0TiR*q2&R8B^I11JvLH*2ci|g!7@&5!9z{spg#jit*@bJ{B}&wtg6 zozF~i5GypbC4aw{vSZ7MNgjSHdp^@3)8arw&aHX-9h=G_{zFmspTO!+UYYKR?VKV3 z>UGVMaN0d7##)K}=>s(yd`8?0(&z~RLocC0_IPjvRgrXLSB|J=gB|qRqmhlw>ZqWFss0t`^8zyB4{Z4h zY>3JG*gcy~>SsfyA60SRDXA9)FG+FE!pMhdZ!$F}sS!XZtf(SXl%G=w&?zRfbUs0} zFzT7~c_w)ZgUy>}xwy?vE`^-NUHZC4Bg+`iGFMK-?;aljKr|X8}=GW#Brw zXjmd zXSntIHHw*$&Afxrr2gSkU@g8Jeogv;)+AmBvcL?`C~oXQF!35H;K$E=6I?c=3~?fd z*lq0AD#s~VXGi?1ip&@{YcM)K%)hB8nb#I_<)y|HXqW|r3mqhv9hWo2&&pK%I`lhD zh>7FA@1EvpSInZ*t?SEwv{wfQjzl|WMEL7l3UgUPFP2;|6YOrn$ zEphH6J0?+DP&A56~`}KjH((ezw3zGD#uq~-^3W%jGx&AUWae|GRbF@ zr#3g{4-Nn}QBL5B%goa)X`JuNlZ>W+OkUX2-N4=+7>@?oHK&it@+GP9{?6KtOf}s9 zd|VQ>=u*&MFHyY!OZ6Lhn48&;>g}u~b6S<%(70AjHv182ax(+2%Ic$OU@Q`?JlTg~ z0}M4Dzd7_ye8;q$6r~b`ynELM29=zs#x2>5Owcvx-8WGfF0Hbk-vOAOB6708Ktl#@ z`SjAQbkaTt_n zQ9-$fy0rEU)K_`@Xy53K5x)Hk4Xa3~2e(`V$h0`c{2-tH5L{c)>|Zu@tr>s82RDFLYK_-w@{jR4ZmmZ|1XD+I~+j~7km=H@MWF&i}T9M_xT#`D=OOu|L6VDS`r zT-ELvHZ^Xpy5}zc+Z)0(>t9J?4inKXE^eGce0@nDsK+hwfYx>?r)elrvY z>?6X?u*eW}&Dp4Z=y59u44q`8&q<~BZC)t9Li3Pnb|8~H$ zMB26anr|#XhSR){4E-B*FsuLmt!Iy1Ftn93FyX9Yg-^wwzsI^oUg`0%eNzJYr_J05 z%G%5E>+NWuSd#!FdT}u-{IbR3@9E*;ae3Q+Xfx!)m0d-0lTCW)`o>yndZl9d=(mbs zjmcs!Nwb^p$@Wp&@|r>IuZ&0lioo*9viIfbSucs7%gwRwly==BQA}@W&6bn21_NIV z;$m!GnD(+TpG!+XK#+Uu%?ifqOUHskUrGJW?Zw^g=5BwNcP3?gtSptP^JjTGau-4l zNG;)!Xdf?eP`Z~hpYNF=^|5O9k1ujcW_y~?nUIOy-5p1X< zh9*F9Mw-kM(#qHhNkvq$!xvOarP@vW_AL*%)`8MRD>14%Lrlw7*1j8;yV%na{DU22 zdPcL)VH_=eVvTvmm0~`B+)M#4n+ZJy&T!h}9iDtF7YPw{=>o%Mnrt!6YJX#Yntnz- zpJKm}57nw|9bQ}Hl1cK)Q+vW*9so)s=a}R258Zsm>IXRM+fL%j0CYE1e~Szwm{wM6 zTPE?928e2D?yHMiZCi*lY0y)e0Hv4{g1d}PW^N4BGF4ExKcjrYRBm4#d_3%U-WWYz zdAZ$)msH4)!Prp%m=%~S@#`)Ap6nyjV0QU{n=8cnW@BXYHUaJ- z-f7_QC2QFliD+sat&O#xPIAlr5!y*2knxF_q|_EI$n8_@SD%^8r$dqzpNnC)C3)Pz zE*d0kSY(Qa-gmQ@{Fs&9;W2*gkzTq*bXA@$1W^b z#fM=jwbG38YB@8g36aHB^W$@65s1qujiOn2;}$DD8d8cFA$`@4x!V+|iF?n~fCO8) zMF}wb^vN4jU9oBEGu{9dxE}kf`cV74Kf>-JUsAP9FwtfQiq3_5K)Kaj@d|!t2l`J( z{@$14G=t+jT3To@(_pTLuDTmLo8u#NNs4TS9^_TVmtA)f9>-8k?}uw!drYYJKeG-` zDTJS?2a927i-{Oha|C)l`urCRzJ_4xqdM-`-~1gB#vCj@&v0o*&lv$jbl=O$q!%8r z-Pu_kUjC&`E8wvu-OxVlH-X2A{{3DtB$@js6I^?3aX^%eMxnJnmD@1 zgJwAR-c_f*n`c!?VR!?JA~j*) z)w?#+(`o&*-Gw1^JB?I;)cdmMf2ZI+bBx{ER5DRBAj)cp6BM}Acr zL;In;O14?~v)lMUb6>G{&A)AM(6;*hx02wu(2zhNxt#+x75MgRO^W`C#_AUey*5u{ zV_Ro)-@*RnoL))ZfnjGRS6@EoAOqv3h>9G#Neg!RBo2VsmxYptz(81(eH_7%UthaZ zF~x*t){+u14Ax1g!so-jSrwhOtc;9|40GGnHa%6Jp(TITP2CAMv!%YdE0*3bCke{< ze`LK?SQ}i^1sdGlixzh)#l5&&a4!_s;;u!4yF+nzcc(#1ad#;0ZYO=e|6H8s8cutHd=y+-f>OY@kLxd>T80 zDJpNQFqAU)P;YXXQS=A1&2<#Cob|et1_JU^Bx@R*eEd(zJ=UJ# zJo+quf)Sp3-rnEdEZ!e$$Y1xV-d)y}D(G#c1I^Dn7Qwp@7E6bT!Hwf_4w%YZJbSOGS3yPlsnw)<{ZYfqCGS61wzD4#(q z#KVgfrm0ZQ3L{DeG-w+>P^lkKaphnzG<+3$YLXzIFw^QHvI zPnFArdgoU2{x?kIt?$0)ee(2P1`G|O`MC@JDD@jQ`Es<3-SBs-8bj3o8+iczlMmQV zKZ^WU+kVNL7CJaC54ASSC&4;&Kp2;}cR)o5-a4BngE!$h+IYQLH*xwaJumGdY@{?i zGvpKDHHg2rd3vgdy~*J8z6t(J5Xs@cQ~X zGkvpF;9D*ZnS~5i=M6B1l8c6KByFwbm(`)%Y)Gm4`{jeyPiWt(+{G{Ebbs<%=cGz- z3R0g3=udQI#77w{RVt=*-L0A;p%9JXl~)tmEVGPk;?3zat2~{bjNi8)eT~>Dct62#{xixV z4!kL&*u`(B(<8Hsx@Kd1P9-MZPAQX#R${T$%nXS-l41c2bI>u!3-XmXqUlaOjAk13TSy1$3uS^d&bt8m?_K5fwPbu{c{_VZlAX2!n z3*X<}l~RZDOK=uTx;b+%uda$CHt*zpzxGN`xxRF9<2L2aCb~^Zc*|LkD*ExU9t}y7 zt;D|LyPbDf5+mb}d?hQh&;?musN?#p-}=Aw%h{%zU05P{nw!Dn_muvv^K>60<7O&l zg3~mJJwIvz!0iz;8BhieZgs(*@7` zFk9G2Dj<(v@|Cef4Q3t*4C&yCQ1$mVQjzMg)Z&%y`qBIairj?D%8(v46&D6cnt#wN z*0e~RsokT)eW}qEMDJ?Ghpo@aQPbM0d4KBZyd18|oHcFreSRtbhPv>%?Pz*Vz|Jg{ z_}0D(Qd~-G4nby|d@mJTB_TxU0amZ1E&lP5h8Do%yz72`9-b6gJ^sOnVpR~kV`R7wm!#c~K%bt6tq3tyg5!ZgOmyt~TtJHNzQL-VkkB{4rTR3RakhRA*sfp<|6( zxv$Ct723bXTK&a@I1m57zG?cuH%V(?07*}Iv;o~)4vDtS^<|EQsw`gRHVba>!DOab zc84u5zhdFL#C}^-UH06Qiy>cn?hJw@(=(wY}K(+oISUM1qW-%rK=WX zZD$w#_$sI@v<+Ktmc&}K;q#UK#)vXXu2d+YMUrX4$PN9|C^FgD~IUX#zZ#K_j9O5ka^DF*zqu>WE z^bX*O%D0|=U%QreIAF!qZ1GuJ#t7*+Q&YRTt0J?KSd=c37AUGV!dqa{UG7*H2p>On ztvd(oml})0)Zf28oZ{DGCKL9<4aF7NB>8Sc$0hr#Qk-S3WSbY7fj_-j3uN9-Us9;E z*WJ?4rRcRpq4;!I@6XSlmhJas>F<@qPD>ZQ)~V32XX-XTy8Rl4LA!%hWJQD#l(VUC zNV>wzZEQ&X#ncL!maBh7_hFN#a&vkv}XPx;)H~$Y0a`E<=E@ST1RtJljNn(w`U6wALsq$ z&d9)4oGDN*GgF3V&=ONReED_fHTacI0;Tp~&3(gsO@iX#(8j?*w^vwgMuaHnZHw@$EBjS%=;VE;>~evP%?^=cvr3rl-yn zdHugdY0SV>afrE!jOQf((`6B*T2>KZRyaJ+;mgQ%+Y$agLu7ufP9jTZw0}JVHf^TB zVa#W+9y`4E8oxTALDRY3^NAo-yoR;noh(M=aA8dOSfv?XOVWF_WRY8&Sd(^3j_UnO zlXj4SH{c_Gwo=+AttlSZ#%6q)tB=L*hwo3^DUte_6A6$`EjE;AXle%TujaTIm_48P z97TMK0ONrCUQ3b#)O5kWnZy)P+uao)$wxiRBCy68=2^Y5?zEfZsfvhn1}1Z0*hmJ5ubMB->`{ zJ@oNIV1G9y>uM2aW}?EcBwH#;S$}#zSZDlnV~bOvE8iIT=#npnHB-eWSu0}|NojpL zgGJ%6M?;z7R$fI}H9CDVi=-!+d@F-q!01n!Z!@IFrT~^InLlPqW96B(2GvD760 ztWd>V^I1`*HsiLxmC~AfES%}|cBh_n%3@{)uBvrdkl-^it+aCfUWm0}u;26DdXq^H zO8X3WmqKTAQZ4mJTI6wz*r8j;^DmHdirc}kr>?E7t(n720=1Y3WAgrSrJbC~^+Gu$CIeyz9CHc|qe4~peTPdPqP)Les0k*TDuRc!48_7aH4iHQZl z(|_qFA}RW%Uct(KSHU8$Gu-ReyPpmn;5sd_R`THj+Q0y6lIBaz9((Pl|FqW(p&^w` zDgc-Y(HQeU53I0G{&Mu_uZJbVe}ejCg5mDSMWieRqKnO0eSMhm&Rr)Z&CVC%cu$*= zBIQh;8g!Qvp-(8p43|)A);(p<=jjdSE^8nfDq(imu;PHR_oF{mJ3gvvEx{lcrX~k{ zU0y?1h03%UxZTpNAx%U~P8b{vJuy8Dw9*gU9xrd8u9X)aI>4ZGZE=Mvsi2K%}i}RJha;3>X3Ddm}MNCBlxhm z;S}3Sl$=hZogA+K;x|-9)bHIod)TP2HzE<)J}elSA{RDP!k0|hxnx>G^`hz~e)6mG#gj&t1VU+(u$+_($JZArbNe6$l zRYc(;pZMEvAfHV&jc-yW>DfWy(QJ6D3?<9!3`X=w-G}hUj@XBFmm|h8O$@S&>PPU+ zMfX3`XykjKr<*xpg8h#Uq+4LJ!(Tp{wGse>^;5lRGT9axobHtuw5>qBDOe|LEw zUalv1GI+%uLvOJThgDg@N71VKqB@z3dB~;E=NeFwbMA~SO2v=^0bZ{P0(_qo6n@WS zW(_Cwb!;yA)P8!1Lh|-US7R!n=@GpoS^(w#E3-0_ZY-5mC?+H^@)}NdQ%%QjjQ@0 zr`~KHv)PbEHf!(zKXT`nWg!aUPEH$z#{rghXbm(Ndh)dRV8?&Q0ba1jJzjmPhHsL8 zDh)A@BnqK(%9dM5*wZlS7(=Ap_j$5!p2A>~o|qUicF5Q2^l+W~y4~XcO#JY+HDfVD zFydXnVy%7ol20%ExVGV7B(nN^p~SgMl;OhZH5qJS zXUA5E0_BV7noqY_C*YZ|>@Tpmv(1bRf*%TjdV$#qS)*k|+YCg-j?{6{ zjtM3B&}EoSi}D@6F2lq&K)$P()S8SWPj-uO{iDfVP+~IU>KMjFPbsZ`ya;1Ht|8Ab z-Bz?tJw&0vT~S$IXwdCWWZ|kpnt@<_Js+djAA*Q4gpWS5M{JS+#O=r($M>hR34yR# z>03REHbb(LbCWe8!Nn)YqGmL_l@6J}dYHhFW_`1Q%EHdSKA4#3rty;f_UHL4!M=<`ePc~kt zgaDRztS2@Kc`1r$kTRhZ6hCeM-t5MuY(tOsxF)DfeV*F7pI$xyAFTXQa7mJ`OC3ZN zs5RjJfYJE5<9)$Fzr)S0W&s3(kDcL+;MpH<*hA4Ad+P#J{?6PT#c+fU7q5xQ_LI(e zM+V#ml{zEVm4gi_Y^4(zm9R1|GG8 z#ADe_oUanjDgjYKuNKN=LO$98Or@GR+enwj$;;Z?Hc0i{(OEmHj$Y0;H?qs}JDu9k zva_NI-8Vrnr))7Pv?f5g&q#-nzBszYyf%zb+G%!c{1?l;HQS7=9p$bzQTdImm6yZ(`VOrWR{lU{`bDUz9=N5A3$!B~!{X z%y{YUa^U=&WFT9ws=ec8SNUVQW2&0opx9J|7(CgKq+cb(gW)BU;rw!B`RRN#m+T2(=#EXL-@!W;h0qjQ^Prs>;w~;Z zQ$}-FJ26LGAv1qs>Sm%M>UyMOx?#1-n2)RtFYGci4|^7Aah!3#bEe5HxFD9I z|0tOD5^Q&Kj9YDAPkDqSN*6D$^S*&bWv6AarY@mek}i)sORuY}cyx z-QC@r8(zICCl`v(csFb3IEE>Robq<%C;{Vx8_R!dW}m8%4;3K~?x7BuzWhxa?$-0) zp$}PQY~40iAc^{QyJD*0k>91@5lkJ`d3su>u1eKZpo^Ck*%xc)(L6N-%Ya_!0g#!+ zh_=n2$`ztYq({1_poFn7k-UQ#TA_| z!HdN^=n`=_XFKqz_NPo#neE<=w`h3@p+9f|X=%!WCTbA0gZ3Maz3^p)mp5iK;e)k0 z*tNzU8MSw|Iq2u>Z?v!Vk`c;5%z7k(VrpOV0r?&uvc53ZFdevD=!9IV3eBXA#0BWw zSD*e^la>hDLMKj)uF$6GszOjktS%4RxpeTmZFoHv!=*KQGGZa1mLWW~hp2O+2H*6h z#=gCfE646Lt-ILRWI~to*pr-`p79CS1f8bx44vQ6R7X-Dh!FHxA|{i6nI>R6Zu>9s zI_N;WwuQMAy#$hYH;kZyChGX`U0q$guAcp$2MTJ)V!VU1w;udo+1`miSIl3ZTxw0_ z2z!Y;(R;~p(j!G<%Tu3NxsQlx);jQK=46pb21?h_FxY&M1W?Am5~^=0gT;;#0l@xL z_Q+8scbxlO8MV!|Y4UryC7c)rxn?X6)RazYT z)bF0a7cy3^W4R2r1EF%`H9=ml%iXsDh`xc47)C>BfTGXk{ffvGi6PkRuuKsY+)!)M`p8 z8ts<&tZQAbrWCq7fboJGS4G2@nDL14-ys+mz-0j%^5Lfm^!E?H-iuQM+V0>S%_{#$ zw0znIml3Meg>O49&t6olWpQ^*ZVSnc0#Vc1%VuL3Yt8xnVAJ3o%_J{+mhMJca0Tdz z50t)esxpU}u!XPwPQud;j)(i9?V(DUW%is+wXcNahP{uwQ^gB|S%?uWC$9EKsV(Y6 z?vI8P4Lf=HF41u6@K=NIrbKPO@m`Zub2yQ4Xi@bz5Y3j1jn}|b>xg($)664$PkO{V z9m0NAfh;nGkfr!8{zp&uy0t$MEw}plQ*W2KZ<(2?y??_X!vOk8Y%vzGWZ9GOLJ7n6 z(IaBmiWb)gvAH7c@5aIgyo#8ER!!O>B7E!5Llz6@4x5AlRIuFIy*a7HUg|>fo*)-?-c~1HK{8;UwZ$qO5W0A#WGd$UG&Z-x z?$d`m`}I~S*AN7w7ppFPvkFfVx`lg;VD@YcjDw}f8@+-mj^=evrU5cxoVadgnW*-S zn!W>z@VD0|8@B%v?wcAMF7RD#sIdp)$uC35z5c`Kj2OsOThHO(1dyS$=oCcnV>8s% zklOF%Wx7G+ZH0U$z_i3n#DMwAa~3vS1AajWc>9`IIIy`4YXZ+$LrTp+=En_of>ONTSOpCmgYAd_*qRPE$A_(KqniOo!4ICQ zg7>c@$8%@vP}jq>x~Pg15@?^{E>QMCUcux6i`iHg@=nzX%H)0GKjwFo}7?VF1)f z6dau7=3mzXu&n?gxTl7E6g0)cztG9me<3Rk-CsqOjJFBOt9tuLT?_VBBqIz#Tepi9 zsl`Sz7sOL}>eXfOo51DE%|l@~kEV+OwOdhyFw@~XiAtb6HTBV2VXyip9u_!x-5Uf; z-cok%pv+?H;i7SnPe$JZBj&fsHDx6<{t!#5p0t^Q@TeGfE;0x*+Ng6g>&@Q%Ei4Wu z!`%H}d3sLp_P`#$aIamR+WGHNl5!>>>(0T#M^8Pk6E(tb4+CN%!oGL5+(s^b@i#wu z9`-g?+rEcsnft1-DF_l2(gvovG?o1q_SWh1N}tw!@Y*qfn}kuxswjvQ2-zsxKdOwR}c4 zKX)9~Qe)7QzBe`^O=sl$CTYks5F8xb;V$yDG}T4lC!>hYs%c8c;dLqde?@I5bY%JY z&_W(a1Ui*^S?{BfFUG)9H3a&S4+VuUB=lst*9m`s_uLznJPwWwOG+b$k^uFZzN#nl|#}FMpS%zr z%!TuFTSKK!c6T5CJ}@}6b$nV?&gx4!iQ%~F- zDrvRz0sCPlJnlV`#IkVf{L0!QQ}m`%MjSX{T6JXo+b7jOB}eLvn@e#%$#sKeb7l`E zof-lD700q-Q27mudkFMSG86@gi(*5lBr=nX*Wr$IlQp{p#^eT(W%GqV8kE#8?ST6F zghctP5jW`)9OrwS`OvSTGRaI(;`vRxSTGAQ1ni`bm4i8vTEQH64Q6HEDe#b5$6*Rl zOOZQubk1LH%sywv_%NadbiGYvc3dx=**Zth3Hx%0WV0CxR$Tk+aodc#ZD9rAn(IxC zIRg~#pY0`}VAi!O8}R*4aZ#)Og(r=`dkIK@y59x;Hiz`bCE);Ee)NB-v7QSTFnpS4 zbGvxk-sglaPUj~wXO=3hbGgSpXiyn2!mFEM^A7ni5T6sO?BN8^xL7og1xjw`KTvEb z<01`VT05&=##=zCRHm&oW@opOCtL|fQCr~t0CI0#q5$X*zePk#|JsPH!!-i-?X^>Q zkQ=FQ|LoP87c-<|?BrIIO%mCcS4cBez^hRPe^gP!1$out>cF``IkpJ!^L?u`<2@a+ z!oDkf5=~1mM=sGm*52HXVq#lV=@4zcS4^ygJCMgNJ>f^~KYq0J^m0C*%B?BBehnrq z8-$w(Tk~M*^7JJ>lh9W4BvqzU{x)LXJ^mojYnR{`Y3{zpEyhM_8x3U@Xur8w=rx3G zM=RlN2f<=_$enDELZO>&Bc%EZ-UAXN1)QqW3s>{hq{AOE4EfzIwjQ6GzgQPsA5b~W z?tWJMwka9hm-k6nR38%3$WS@r(-}n=sKgehA!K-dV`q4G?>G8mXB*x-{v z2as_-#u}F6ME9D7iV}!W`pXrF?fr%BuW)A@M*K+k%<<65&eq!*I#QDQbmN_YuCY}5~IA&J9I=tM?eLKvJ$q^d)P1q(}ItuUWut@dk(5s7U<#jkG5^q{t zR*csral&=!HI>C#CGk5)ICNQ>&5+u1P%ePuJI9CUaTrXC92}Y+-8kuTdc<4zQ1PjZ z-SVr!e#V&07@l0^2`9X`YVndKSkfJP zZP)o}{V4Y7tdXINl448ehM7iAo;d@PJ-ur43kSwZ01NH5gyG84+Tzyo{}Dv%#1Qbcky#^7kdLg-0*7krdzu_VWtGMx zTkCLU3?6(Sf)}#-AtO0V*n7Z_|}pX^W`JeWJnTl2>gFd`yWP&$K->FDTepS}uqxnAD^ zjDP_gm=-gfdOx~BOP{BDe_;pLw9>`}1u(zaY0eT2Yo&v>7RzI?MF@w#*4s*If3s+K zwB;T{kzE!!L1R#D(y!7hIf_N#g}+!g>o7&Tj5CGv=;iNN@pk%6rEe=pv774*VCQ&L z7?K)$Pj%Xc`*GYUK|)r^S7Y;{o(fvpc{X~z^nU~C;q#zl2)B7xjB0w&wHlJs4(%8V zt}c^K6)VSjl(@KSKo8w`?cRUMp`S}~{|N7M}GL~3q zaAA+?7`*HZXN_;T-{92PM8JC${^-o2JtO(1`}-d)T;5B=kXPy@+kaI1ugF?MuEk^h ztzLJ?{FZA5=lgO4ZXlQn6RY?4cy;i<7r0vSf169)CXwUnI@n^j=D@vXY-C&vY0}{2 zk%jGo)g`J<5Z(q`Q^;lMm{d1c%3J6ELAzi&!X`XM%O~b>FuvLqj(!G}>GnJrn7! zJ&a4_*N%tEyDexG`AegkHRw?`8ow~|kWoxa!~|EXV8!goF)GCeD?fzE)7@-^8(3a4 zGed`QzVUoDrFxRs^=@n-aI|cTuleZAFQm9lF|}?lys|{d zyg%$6oXAUeg}k+T2mNdY;|rpFEBvcY>At1qjgr$e(*|IDR79&3Z#H$r8>V?=DEe7i znE^H8fo4o^zLRs@YmJH7jn`x_9-L4Q#!FjYCbK;~IUE0mGTK?KY2!pxN+N!5z)AQ^ z*qbmevPnxT>I?5{xeaJOkoaqUnV<-RjYS*lTIC13bJ+DbzVddxJxP-L^n!#Vy>WXI z0RJDTaG^9be`kyM+T>QY55;>mXa0{DeO;WH-gWn5$|9tLPcu%gn z9HE{$4(8uQNzA6_O+^U)4+u~G11=V7#}ehe$_7v$*u1tl-=Ayl;N~qVy%d3C$WO<|2DLBo`IMqyNn>dmxkT{Mb(%0S?cYsO< z*{dsjRVTQyzqUQCI!{ySs&c?A!(xp3kTBD_)XHHnrHdeZ2WkkVo^n7}f7c8MC$(a@ zLDgnW`e2q>UI7=S2!>%pWmJI1lRTZu9Qef35n@<<0-Oyw2!R zE5zk%RRQ%-0S}f~BRSVtV@0Pha+6wPU?1*9GXI-HI{*9Qo-VgjT}#<^$8T($$G+l+Tzi!z98b{A~l=5O=%I^?-dve`gTNSpKoV)2Ge~hay zwVN!Ep97gYA*z=H0o0lgcmd^!OO3X2CI$@=-TJt%egY@bs&dQz*2C58JH--vAn!l~ zhI;Eut)`(CZEF&?lxy&=C8t2BugKHxjz9~Bo7;%J0jweyN%S&y?jp&gLW`RtYk2?L z2aKiSNm(^wiK63)`jf+5UQ#q!9!D-A1Hbj^qo=26Iv$bMYe+o-9~}8si7|vqv%(hM z#(XxWsPfvm)Nx0TVXY1a!P%Qvcq$rQKGCl5{~&iF^aTc#N=nM07g6Z*0!Fn_&szgz zVc=;}xRDF$X1}2|mBg?IqHq^>eA`}DABI8hcAx#|@-0!JuaezyPt;UgBadE&u~_V@ zc5=gyMitY6LC0{bxX?JnSKJzCUhT*dRBZ^2l~8>XH`Y}L!24-oHq&MODY$-K99fsP2@`&tZ}&hh)gq@!`Nds1h)J;{RJ z&c`Bk>4GXnw zNf?eWogcTGsbhN^E5VO@mxcm7XHpHG=vXac{ym7--(0!)4E7OP(4SXUc3y3$H`@K* zw+85xV+m&R2>c%UM*a@FaNPvzrQe-&U@HTxTsB=j;I_0#2qvql?yAWk6uu~4t1Sc) zu<4nQ8bJ`cL?91k%$`O>iMzq5wC~-qk*W}~w{_k4UyS}!gO0oObI8ZR;k=qa{(^xL zO`TAgmM)G7f2h6Mm_cSXgGJ0RZp_{Qr2!jHk{!QTJzZ8M8MG+S(k%V5+I9W$un<02 z3^<40@wcn+_UQNFpWgHIkV?V9ewm`tC-!=7ZP&U2O%|QTCtvUfm3>7Lg0A+3W^N8f z*$0|bQ8prWl=WQMr26mZ61wyoD}0M9OCpOs!plbuRk;T=OEAS06 zZqzH;F^=kU<>GH`{(j02zjJ8Tt<3^ab$@-nchK*Ncwnbz1V5QkapoUjGI_KBa53vweuAaax1EK z$@7^Rm`K!{)PP`k7@*F)aH#wsLIx+$@eCSDFmMGV@v93O@QJdBDGg#^HPGN2&C7lR zoYV@k4wXd);npVcCNHbtwHeE6YHQ;9eg^BWETgQFMLg7L4`abkCmzBcz>X)NN10|3Noj<-mUU%J zEWl8XUj$ZFG%i?V&6yI>ndoU05>P-9cGp&RmX03U*6CN1@brD5lznze*ggoTkt9SY zIGuiL`r;z>JtivFg~VKl_9N3l=Vw2HPO9S);q?JBP{2$DvfpQwiG-;!# z^wPf~q^6e3Jn`oXMbQ3Yw-#(#+2|{_Ij#SdN|Y%7h$TL#ij_ELvzAFHbasjXSJBbg5Pu$+wq? zim);2)t(1qt>d7xr5Gt9nj5K=Ceu}$tPkBuUgg$n5IYWoHvO&5mr5b$syy2Xd<*_b zv!pk)wl$7!eJ$fj$~A6X7*(-~{lHa)qGrRjx5lHz*JCNW$B&bB%QF+t4*C%b4HEx^ zn0$FSFlGu(9t+QzpcN(x~80wh(391Ve@qQ_YwCqlwfvOe(2YC&>u z&ie&{oegUiFLZ5)zeZhE@O{lHt5+0zw7Zr=@Ze5=6v zFHjWb9}L@}d*J|iMzojw2=efitLHY=$U^&Tai{-BiQUwj#t z3z(swcz_|dQFIZ$T3rlBRGQG_B)}%+`p*|$yd`bD{(iaPEvinYnBqm1EpxXQAqFPn z40gsJvJIWhqw;^WJ-a;!E}#pCDQy4_5y-Pm*8CAq$l}g2a4K{%Anz(c%M9GlywXx* zzd3~~w#n;culokT$;{AM*i$rQFqv+F%6l0fjs5hhc(>+upKKJXiL=e^sZMMRZh|0J zErm|4fXrF!9aR)mKnPACV6~k-^p!AV*OoC*-6Q<;+maLlLX{D%1%X=y9M(_TEn1@R zk!aUB*wKNG)nwvrEaNkIgyOIFYp7HlTA52?)m&#gd~!Zrtv}>~=*9ScCvUzAGDTFH z!gN=5Dac8oz3>(pmr-lu*?($Q`;sFbPu5+_8#hYEN4&$!b^*FYh>^4_<|HdMwF@;8 zsMlyRh)DlzN`c*}=AOsGzKxw2`UM&TAJ${~C(19bfKL)Oqc(Nio{}ex#n6m}AcvqL zpr^r^sYbI5gJjKaZ~E$msn?KJ%hZ#(~QZKD&ag z?EQ~2PkR4z1K__F_3hmBzZSI~F2!INh`bLc0eP5gU0Vvb?HhMx*3~COXYb+tc!~N-_K7(+XEC6U9#2OtxWlI57(3#kRS93c%b~(0g~(g%TN%uMBF_43*^8IW9Nbie^iJ*a|lL)+Ru^} z(|2(A%D$^l`KSobR13*To|-4c2K0T(ru4V13XD*7=Ex9v*X;fr+xf9tWBf)YYU$ae zY}MvNw!EVT=_y&orjDM}LI!1QU&%#W$cXivwbzZUuaAB;fpSR$LW5U2nU@|90)y(E z+A*?ANCXE=aBK)s1Poxk%C_ZG84gxH+b4Ilcpy6yxcI^e4RMd|piJG^#Mkj1WWm;* zp+q)f|M{Y`a6C+jBWhV0qsI4cESH=tL4onodqq1n(0OzqVK{P=g*Jg{^Vk#S&lC|3 zl&ufm8Okt<_;}v>ezUJ{&@8vdDBdw^Z-gXJs%ec|n*UQZq0PrFHRM0KTpKRGasFqd z^na9+f_1hG-oqhdZQ#%E^Vnw+F@q0Lkt+;lhxHYT-{>P=9Y&FR<`UmR3Xc|l8a}}O% zC>yX+NI0KBdF8tpmi-xnk7KUfW1zju>C1)!f{MLsG3_n2IJ1iO3B-FgY2c!Pd@xqA zDTcCc53F57Icji-`9Rr~8|Gu%98TOp(Ov<`U^TMa)qW-B&q9~VkW{ebV=5|wvoybs z@miKqWBI7TOc>4^`=T}wW^`SyF`c6|@>ci%H~jWuhF2Tsb$Q!HIV`>-X+5Ka)PUR+ zsrY+Q8m@bHm^78{uA<|AsviOO(YGMTsm)bk0ngXw233~2k8aM^e)bHc}8 z7-cDBf_^S8&RGXb*%06u1{1M4qKS<7m4ZdSgtfEzibSEx-T@OQjy!>!A`0R4XDjJA zBS-xcP}W#O>ne>rLLLCr(LrcZd&SJv7`2R7ZDPst0nR1D>D((5e7BaZA}+Z>Jl@W3 z$hY}^X=*qBQ_I7^5ZFdgWLB`v;;Y^&ii-t97iDRiE56T(Lhxv3sBf6&4_=8abk>^P z%3+ojj&lK|G`EavXN@_Kaj%`K-1vB!c84!SRdF`{AH!Dn@9k(iW-H-6$T9-nk?@Gd z6R3#d!t*FA!_jWyY#+x=10}i8UyHSa1FalXc8PFNU{i{AF=^-kud-~RYw=b7f8M9| z8~P~V@S!Se`y=Hd%g9=#)acUWE3*qZ;OzCJ1>vZF%k($red_=D(yWwtantDG^S*vc zyihlhqNKuivOERT^0%GDUuTamYii;YyB24ez(8 z+6woYIRI3MuU51`R6BZpt!iReCp9KR_?`GV40aF6wr*iK{(<#6FMaz&!T-N5og?4B zWFAw^Uk=G|J{WMY<%@0zYQdN>u(9l#LFGb6Q6KVy)CoXv#p-UohpXrJu+4>fF=0%? zS@Y3<96VFTS|gx~wo{Q7I5}6|HMH`b&`tjY{y4=yS8hI+)seJPt2_DekQOPxjA>ih z{*8Hu382^kBz-vDc-c-gdf(Ry3qx=>iy0Co!5ZnlYa)P zG;UCN#qHr`V&Z{ORjP8kwHi+eq()lhzY0`xT!yubsM9jU`NXo0d}UZ%hdFuaAOxfA zeJf3F6yq;E9ZRN$0I3lm3CiGKFOpSbp6}lw8o5_FO@vBN#an1qF=B@87s^mIf3sR% zBIYwETRq;Tf<2{*Je-C?RFeEe{hU`987hvxc&KowQ6~P^3caho*+zuh2f(acuymjS z4lQ-FRDTk^KXTQ45pMQ&^=xGVJo)wqreb-8h{9)tz{e#b4D{w<+@Iz1kH(8DM1!6> z78OHh6iaK5t(LESn;40Bl2yy}yU{`UX}~40^x$l7%VN*^o#ljSTQ^u`RW#%y(vrXM_KjKC-3=_H1}N~ zHi8l(Vr@_C4ucBq@MwlTP{+ehJcG%}Y)D?6Iw~`YV@`6*XTLz7)nnz8s3H9{jL&Gu=jTtJzYH{I*01o(u4}s>7mxY^sM4f($ zjXi&Z&DCS}N#FCOn;QOuW#|9jUTUxM$qbI~`4*Jua!G=zs(7hweQ~H z)~P#9+~7CU4>k3Rh{;8Do8P!bO0rK@;}x?W{r0jS0y)PHk>2D`1*pO#9#Kk7v&|hp zwAhLRh$GDVV)9r75z}xFw0TZEoqCwsEoQDRufWsGkK0RT+j~Qv#1_1Gey9ny)=5RtH$$2p!Dt$qn5paw@!)%y+s;^KsWO`!zu!g?gT%e>C-W_J(3|MWd*gO2*;f<2ZfC)P$q_1OM-)gYzXe+Q=TE9 z@~^c0;>PO(jC-4)PGvX$#Ci6r&6p%f<4S>8#!X*$ei_17x~qnvOB_xE&p|H5H!9sV zjBrr)E8cHV+(MBQF|6a6^1_Wvfy{Ng!LI_kzDCShNS6F$bCFJ`^W*E^#`eKOUr*fZ4 z87EwSlYRH3C2w4DSBQqX3VsuevE0%s-2#pdw6UD&9E~X{JS=}(^3Ies7n+`msWWV}H3}(|iu1g)IE%+jWIWY$vFIO%l^yaTVIP-K$hBTZ5^?Kvl zvgs@Zy?tZN2Fl()ah{Y61@D4n3C6p;u%ss~y+vfgW`ItO+FSafhR`0`j!CC};F!II zXtV8v0LI{CXCpzKq4@ie_mbX~=@VYfXmXL_n17W;d9Q#vK3GSs?>)z9K z>g=jrwaY6x+j*3k{HqP2`$+}&ajKHgtEZ<8b_{9v*>y9ayB&t746Z~7xx8_AO>fCz z%ARA_pFR!VB>`PtCv6oRn-kaif}g_j-t@GX%DFwavR{oM6f|n1nh`n^ekZ&Ub%P=Q zp;SqE2hC%eBMd82*lGV}?YN=8mE8f`%b@BM^dJp?m2?sq9zH)qI)vE#lulAoB(f~iU7@@V# znUBA@uV(9$S$fi=xI}^SCso)*D$_1ISJNvOn!BBmPg7V5Q*J&rQivf1y>=-nkoY2^ zihS7sX%k{-eKm_u&=_<#%QdeaZ>6MU=?wndDK`ob=W(&Ilu0t(8{IAkpJ!Rn9U^O^@Ghb+Gern*r@sw2Ev1C>^`WCOZfo z&ZTM%Z=o}Vt%&TVe!hMHz_vBC5%IQdY>~;mfg|L^Y}EX=7jVRU&JE~D`|ERg+g`Jn zl1$@hOw|+8Bez;Hre!@V-irT_qm%5v%H84Q>cMa9UDcAfMjSY`{6tlZSq!g5PK{97 z+`}uh3-gfbkjv%0$7r)pT6itFYRs{u9Hb6!0}`o%MbR4m^$Wa(dyDMVY~a88mkUs4 z-tVHDR4K9@Jm_nyjIcfssc?JZmQh`W41q-#w zUwk7Yqe6%Dj1|{etX0nO>{aPsu4q$m!NJIX%QOUsXR9Y!c2;Q#0T&n z!O9;4)geT}8?F}`9V7)SkQb9aTmBYR?@OGHclR#KymCpbN;zFJ@Z z{1A3S{VwdUmsD+|TDA=l`Pc~M9+%s#MXxb*bL7Y^5AzDD)-tW#kUrIJ+_u&ObEzCi z9#T_PG|Eot^4wAr&B>FrRAC1C_l`!ue^Yb5_p$HPa~m14eXY8HT+zdRsQ=zyM;jWE zMt5>X>#JaQDTsHi1+34Ow3j$uQbKaqTt0rZZO)$ZQlrnNhwJZ89y|HHl*^@|_seXg z_GvGj^$X4qJ4+V=a+{F}jT!kZU z+w&civG!D9{b9@kB|SwPkLc~+I~Z}yNG=g@IHYP$d#LFT64t_a!4Z#XoXqMx?C1IA z0o6e!RJ4>zp%{qKVXJqbI5B>u*xe#@9P@iRN6udpW{2hP2{-sJ9nrS!z8=1BC*X2h zmI=2_?}GZJ@~L)A+w*l=^mV0xlFP$tofdA;paQTL#K0Q}0gJ|EkUWN*pPgaXzXzvJ zDJUuDbDwe;3?c(!0jK*()UvB!@>NKep+*>4holH#^r~`34}B?36#(0^C5=X1I0tO~SI!WBdGL8w%O|)?EG(Fgu|59Ft~YG1AO>MOW^Cq9>Z7h+%@u#l>$RBD zhokim5?H&Xi7)Os$Ag|`6^Y#z1a+2q7Do6 zm8rk>pEBo3A@lAnOjj2HPA(t5Uy89%^_A$BLR4%+fQ^wtEgDFzU+@&V|LYfXJ`mw# z(L%%r<_ALc&|D%IHb_ZhWcM--3vy_ZZ$^A0BTXw)qrg9stcNokBDWTO5ObDDDDGw~ zT!Jy(>B0H@}lN6>S^kElcXS26(?STqwyM#HBHF zxxfn}HELfEkNbfrtcNd`=bnI`!+5$y38VkYw>Ch*>(7mixEe)_R#Nz3#b&sM1Fn3z zP+Fs~WMbMxN;BZjQ-Yc*d=uq~T5^%NSam8+I>uM6w~Di0u(MS%Hn`A+MWKv5#`;B7_B8L~Jv0k1Tdtk;wF*Kl50RK;)zuW0KPE1ERAERSvQi_Q= zjm$=KwhL$l8#yGjDB{=CmKcL`J1fq%BV*@Th42TcZnWDn11@Knz%}?y;MPj(Xv3Ga zvT*|CTWC6{Q}Zac+w0;`9hJ-h$Qj5ExXgO8Akn}VeG@*|(-t5+ z+g7XB8Yf&05N{cZBMP`%ws3d6nIERtfHx(V0vpuVAAT9GIHaL;@E_SgxVvBOeJJ}E zYK(mV(d!@c2_K1F45)r-n%MLM1_aVeSm_36aq4e|l!hr?KDfw~d}j|uvt>$OxP-H@ zh4-B5rDnfws}dKJXBw-Ud=D#pK)LL7V@DX+)K;?|9q4b>wa`La^cqyY#NQE1wD`oF zx_0B1^PV~jH5#UOZYpef9mNAaEdfd;y>z0x=C#|zDJUg)Qws%E&6X`)sm)OPNq=C=NU zK7~ZDxlm!8B~zcAJo2OiIGai-ThvzUaQ|beoB2$`V&Y`T%BcBcQ|ESli|VwUBKWC# zn9rsS)EUP%BUzKgDdoC%S2C6oQk>H(2)gDh{OA(sFg-t43~k9*;S(w3=s(v8mluI= z1|DIHG4wSM_64dS@0iKiCXw&=W(h}E5|j8>^Y=wB0V(Dp4Df@_YAbKAlkyrzus*pq z?8LdyQUYJ>9o9Q#Dgv%cSwZcOq;Oyv73uck8CBH`u|@Z!+8DK9(ar?x0~*#C@mvB9 zfM??gGZtqnu^Y?+gBr0Zkb41f*}flKwt-2`N3UAH-~;c0qr`QQsBJ&K%q2=cOr@k# zJ=lKHh<<>Auj<(Cblh>~av^{|g$gVuX2q9ow&NBpt2|u3e_yNwb|!x1=F+ z4Yi2s9R{3trrlxt1HBNW#z&@kDiK~hbCi;DDD_V=n^EV3G}X`=(gcyFi|E`t%=Kp} z;u0yvacAns)Hxi&vrHoZWf7-o<5)Dhnvx<&;_9Tl3iYJz7OQPL>w-NRd0A1l^r+{D zFTFm74AHo#mSJqCBc@lYf@mwJ61X8tyF)iSy^sbR`b%Ld zKON(!Dt&EEp;!ceq)XvQY|d`t+t>aa8Wa@Ea0Q5ZI?~cPYu*g(?t*&kRQDyA_w9y* z!ajvy8z7=Z8PM=v>W6=t^1R}B>?Z>}g{sM%P9?lRw>WGJ7L7{y0*#ar%82|P;FuJZ zcK1kQ!7+gz?(PfAiL1Z`uE6`f0iJ@0L&Gn2$DT&OJwSlm(n(}RZ2*clNQoY5J?I0h z37h7Keq59Vo~Db5g3-CFlmo&JEWx}15`uv#2m06}ArcB}rI`=jkqNS#G$Py)qpZ1= z4OWZ~qkGJ(MmK-qcq4W^#^hlgmx>m1 zSI_1O@db;pv=)%NYp{Y%^Gq$emfkH1sEP&c)OZqFSYbH;h-Vm& zvrW7~C^UNQ$2``-BVW+CBI==*o%@+b+g1RHr}@}EJk~x^3C&HG{2jZbpsa{DnZ#Jm zJh;M`4`YY4aivh3L9L!}gplIx$F{}ht>lVcbJsATfR|IJlHxpgL>=mBi85EZf&!hB zDwJl}6ScrVThZ5)D0{50zlbBgTK&pLx4Ac*j@-`hsSx z471i+?Y0I7MwsoKYyw)aznf2WTLHcGKsKTt1R~c}ZdujmSw0S*82IcnCWmuy;51U! z6cA!s0@U15xB{-F-AtOBL+vv%t}=Q zH`xr0?YisEs!Mjuv36re^CEP*`#SS4tUJ;x^hYsN94kA-%tt^!E*YOSM=izn5m!OE zryX+nmth-O4Y5cqu}LPQMPgbO4QAHUqv)?8IZpKgxOb`ZnJg@rH+e;B7^ZUkxCR00Z+ zcoo@N8A|@HFh?I|RLHDX8?~H0oR4N(7PFJY2&Avuh7*R;JeGVMj~WXaDf|=augMZb z)VRj5peLV)%_qQ&^HWb^lDFbF81MXhy{bqygABxsnogh4$UQsZy04&+K4lwlP#Lt%O ztzI{SpkiLUXDq;pDSIq?%`h4LjJm1e6810!Mo97!stH?6!sBs2iKf29g83!z^FGw= zzY#+*hz#(iX*kXU)eSnTfD6OqZNctj>!nTj(s(lw`OUs?wW=o;cFP#!b0?91sT}~o zCun#%J)J@wX!lSOd2oi`b#{W`HP*cRTA%$ zV*xty1C#B)SeIu74MuRRM9QL*GUzL?^>AVH!yZkS&` z>papJ-4-o7Q%BIQ9E3k?I^e92_ml}gX86rjudu^=3>Dh&4csLoR2DT`d+GMpfChxU zlib`j5Dv1&ekR3L@SH{_i5fC~sx)|w1gM`rn;>%J=sm2TzpcbwTT>>{O*zBw2Ulb_ zuK)OcNvgXl%uq&)Z9SMa(jI$3x_bdGRufz#e7~5b9gBLrC^4h-u|EG7Khy|FjckpZ zNh~P$EYM)k0G=k!5e$f1p=v(ri$c*FKW2GLs!W$e)7TxK%P9VaHN?oGFuFxfJAFvX z#=x~35SBKg4PG(m6p}jHs3Q)kUmv6ykxN zYT35GPBX8;7u`M1(br$K>v=P|-9|FUPfhI+WppVx^#~y-uWXpZftZaVGWzka-my#k zZT8^F9qg3graXYO)q>@d&V7)Y@>R(u<~Z(vgJ zqMV0GJyCk4^zEmv?%M*S0dMDTlb#NXGQr6FDVf05oY8$=;cr|tcXJ0*irt;}hE3x# zA@e7t%tY=ASs56;g=AT8jO@0UBFst2J-rSo)$R|-yZy^R&MpXqu2`kXxvFYSm83yn zABBT}Tf?Kh(A)093}|4zOy(|-z5y`=S#$ox zXZ_dY-y_>ErYW1Of^fUX!3Y1;Ek)7!b1LGf^E#{X0HG@~HkdNzo$pf;ijwc{d;(A}DEE^N%Z;-4({iYCavpV?H9 zRe-YGbnt=7S#)@`01s)Pgn#j}ZQ>ve%bVGi)ZYQ zJ#Gt*WFO|Nin0Sc^RO*Q)La-<3@EEpANXOJcCPJbgx|f^dhiR1uN>GnE zZ%5GtX{;N!Wix4<`a$SOXjAZfu5={V&J(o_JdL9=ipx~iUQB*T(oDh{@~pK#yRg47 zI6?Y@J4SU2zM4o}aUfM%Ngr@|d33Y$7=stmkEGeJmjDI!fKkaHIRv&-phTfAqTakV z;1MX`A^*MMc`CLmJK=JULbswkEk6rNUt>{@>bsOZx`}4BQjTFg#^0NP<6o!wLh@bQ zM`5uv1rq*XJ*qu%kh<4@w&mzt4CURjaRn)rqcUM2onks4@~|!_BC^z9TZx`UzCETR zKyxEv4=MYzg^tkDJwH6;e zIf-C{(BNqdm))#2%EN1wlki8}&6P2X00@DDumi&f3yL`~m;Z6Gg5CHQRhoqZklO&!h%5_;pWa| z+1jXariG4#-$cc3z3V)F#Flp#GQodVBG$~i3f6!3Fl07&@7+7%|4C)KA802!4 z;wGYz3qi<=7`=SasqIyjmtIipzTgEZg+cKU5-l3IiX zCadjx$~x2AEHMshkSp4pYi{IxAsxBm;!^`ZH{0cQJv6b1zW(%^chju`?U1BEvsUor*rOkO9Ab2qI=Old^oqLi;wH)H!x{Q>0;}qa-3~3nHNd1?F z%58L=bmAh)h{@TtMo2VavjxD91~ny3;|S*d)Ub_(4ku4LpCyWwS5xWmAPxCyRdM2o z$^zZ5Dh}oW--N)3mLsSJzbk#tsFF5-qHVAjiVi8-zzgd- zvw5zRVsae4m4+7H)=;&+3WcatTl~SzmVmp|RA#;LO~S!GpNQ2trvm0$RZ@SUo+piq zoox67#{lw~9_c#1%k3`ND>WKyAC6~QDmO8YB|>WD??Jy{!%;aE=o|#K!GwdNnY8?h z*z%8rfEw6BP)u~tG}XN&c7NdKO|3;QabNVG8QLJ};^h%j^Z}plhsTTe6QQ@YfG0#? zp82CSb0joh$m|<x^#=9CxCr@=1d)i;nUXJ3-w2oxQ^T*g$*4c5=CJ7gSZINg~2Y zCi`;_30(T{g6Z)1Njl+Q)Q4S|PS-24GMebUX3wwf*hVsO9DF=~mjC!XY_r$kxQ%!f=jK|aigt<{Y$@n3KB*B9ii#GQ+ znShU~N!rWQ4;o`E_}KB|q8*SL3WjTm@pm~;Mc5GiEwg4UHlS@3j5pAlGYdQ_&=wcQ zG?*02uNKRF9=S6!1uDd3EsCEO-1FR4j`!5EbKzNo!BWB&vX4JA9A08s>rx<$Uiz#K$H+3#3oh2Pjqy0wEz$eC|0** zD~qx;-&wXl-z^y+otUE(@O9e`ndTW3AgzA4^jYK~+q!E0zINNdE+|8mCAd>%Yp$b8W;#KAPsPAK;UNHjI zMuLBc02M3XcOj%gSm~HCQU8YGffc75jz~#TVt}<}%%+oHEIzlMB_Ls_RPBUWHPUOc`_u*3 zI#^LiDj@JDc^xGh=`QM>OBSztEyQ&GV`xMG=8y$j1cZVre%yjJ!eW(LU_zj-36 zPF^pwi-kMa6}6&d(`C7MiTq~NU(N>2Zb+fS%;Uo1qRNWkq{`Bf?=3hT(!{JgD*SgN zc1nB%(FN(e$)H`?sSW-Rhe!OG3ZLbV2v7D@W7u*I44Rd#Axyd^+@%s3O_OXSO{rX6 zqo~~~neow|b?}ku)hE|_{e&eN*B2GuD!mKWHd^c8;+FJmv6mahdIKuIhpR#fz&ffiit zf}T-DAG3tC;|$U+?w52su%qRsi0>2y~Myg z+I~ygJ8`aHBDgAR9|`46b~#kK@9L#RW??yN@JQgBnpG{G;Uqx%cxdgm^Lfv9RsWt( zC!9S^c{^zkd6fJZ(ir7}3HS6SOX^OcA;Mr>WC(~Iwb2%yX%f?%*AP(}NFgyo3JI~vpbnJ?j4*23sAe0GO3=PoA_|dT*6MtN+!S}G+-cv=G zmNq0q90@0#x}ou??>$;e1OsVsaPMKnZ$E3Rv_Q#tdI zFauqID8g;2fn_B>oWaUxe}gpSZbC!AO7xMt#!&JHG{G$(3+nHhn^~sY-BdkPmU%n* zD8B@*I(M3>q4VM0;3G1S<&$Z^uD01%jK4aYt+Lu}M2=4B#5G{6q)&aD07(TX9 zY9j9kndti!;D~Cjez(GcrkY47oznYPOTq_^`HO5TaOD$7ZHDDNBsTD!Ux(wCe@e>i zYzT!PPi>Lr+)HGdDg^k4DarqbmI+KT{;@6a0i|Of`?WW)r(!-ay(&)d>F^FDEa$L+ zWYsjA}G?Ul%jW02m zsIqJhkGgK$c=vClV@t)TRZ6o$9KAOBP~>VlGaap+Oam?Pyfmqj?9I}{z4g?+_erxZ zYnReQHJ*QG*YL_P88)4B@Qd9jHS)b z3*1^TqQ$>-K-#RJQRJ`w-_^k+nkO;Gu7p`E(rpkE6bILat*Y=J)()5bcfr4bxi`AFP)V2A=MT51it2hkMNez^fdCYtbV zV;t7nGwz@(f%T1z5HZH<2(aHs6;2i`eRq%D~7~p+va*nQI-z7Q<*PQ7)oBr8V=NjS^9hb%Kj~~$o|frLg7ci z!K4%m>?%dj#!x;nP7Ge$XbqT`aFdpN#WzVYM%-b`m?|ua=Ic>-CT?imQ^%`Scfsy! zbM>a9PuMY&S#RCLF z7EG*-1S(}$n(RD6nx?Q`xp08#gzHNtdEoE`h`g#KiyQDdgrkbcp+b*f{ zvF9hki^HY*ZY4k!Wb^JX(lT)E8x!{zJN%U2s)qB7xkuw1YAAvCC#a2ynn?O7tgL7p z_R5d;D6SM3uw^*$IgjC^#}nT1!?Yth_L88JNs+T7(^NP z0UwTVUAO~GE~y~HfmIc$%57si*(*+y2eTXhZZ!p{xr!&w`MLUkq7jTb`973$l4^mP z(h^*1!OCD`$}nokg@j?5x(I2ySb}+hHaZSvC%}NwoNXoE-8RpLFhkby!laaw8bq_R zD}JQG74;RUS44^jD;n`|%_}+dPabX0fLlWmD>}Y?R4?Jf>z8qT=1%I;>*P-WxpL*hYhRy;B|k>i z7G#zi8RBGSsx9Sk5pavAr1S4_&RtePhEL8jil*QxSX=OVd)pbsK>3Q#&{{Q}>t*mg za)F1ZTP7PRowY^X+h&effo|31OIn!|ZLnrA%h{I+E|r5PI|08jo`-(z*Obv*kcPN? zq774ED82UkRi)d)srUTtX#9HpMK#OlR{S5YKvW3w3UMk*-~SPVDh8Xrkre`it+XbH zM69pSg>&nTr1cEdL(wT&=7O1F_Ddv>d=2pY7QkWw2xyK-`5T?Y93FZ0o1HuMBz4PC zAjN9{*Lr1Nd;vln7owy-3-{aKsr?id&QN(JZ@DX=(HEIISyUijHr?G9VZ_36$Lh1; zYBnrLLe^J=>e1-_+Z7lCp6%@(43?j=6bwwRB8G}Mn!dojwF$iCG+v+Q86T=xQ*f%e945S~?(@^duhgfOzR*2}E&$7Ghz;Crbm5W^Ps-tk;9+x_ zMD_W)sy2Ibo-C1Tt*(0Qbtt>DzXyJfo?shic;LyYG;LleuUuGd_CC2nep@XlcfALi zN)k2k5|A$f$r%<0uDu?7 zqXL_Q0yCN=o1mS#Ili*Ft@z?{5Ju;ou~6(PR+)v;9b2?X z;}NQCpr3~E^YjgsVv0JoV|H@UR!EOK(oORz+vRLoEAWL*{NV`}tG09Yu@}-okYo00 zT3aJ1hR!-$I)h#rLwXM>l1r#c^Pgf~PpXd+2DA(}RL~-~<^>khjR8|rTO*JH1z>>n zhfec=Qxh2v>bWYLba7xhSS3&x6N&=e1`f7TJ+jz_}Y7Pft6j10*Z_i0o%JC|Kn4qpCv zysz^Qglsn1W$UOhQtdkgUJy$8{M+m21$sRF+-BZ}55%AyghcXRy_Z`g%f*`R5VkP4-?AYL#tKas@v)O)ip&;26isB-0ob?^cGR zyI6b*B~kT8#iJ$Cf#2k-0n;jLsl2s@vk^j#iwwTw1o;8ku$jx=Jc zAhtVcQj$nECjEf_0oHwpM*e>#rFNjl^Uvb-R{CHV>7Y2pZ$~TW4ZECG{{7ZLQ9C%) z9NZDSFQ^ajA6NX(TY+wWcw}#mZcRTr(7ONABk=K~CJ;f1R{QS4!@4tW1R0FZQ zm5*J=I{!fJe^>-iY8>h#<@^6X{E^uG|EuwT+D6a&)ViP4ihBwWj7a#9_%682%Mil$ z8^PEok#Ajjvyh_5bzrot_^fmJeF^!W@o1^_V3CnOHEY44s?>)>5=2BsK!MZDLR@)V z$ZK#Oth%iGU#xqak4&rvoVMJ3*?1b&wW)PDZ@O=*g~bPllm*815Oao-DnmvJqfi4R z@?h~5K5p)}a#sAGH~(M$WE~S^P3QHf->t*J|GaW3Vvy?mZ)iIVtRNc*z+U-cxJpGF zOkhvP#_Ku6bORE`h4*4dNmp&_cI1)S7--e1L^q>>h}BGhuitt$l@>eJZ$Gah;+#A! zUWonqTmx|s0_9aEK+xw=SCdO=C$T9UC_oZTg|6io@^X}()Q7mg0ICIXa16miNNcvh z$b2HYUl3<`ama_YMF2fWjEJ6?3kvqhe)(R?-v*Ne`O7gC!T=@11nigi)R=7}Uzn_NV^o@F4XMG28ET~r>2DvmSnN2O1u69Q0N^xws>$U(~ z;R9A)>NPa-WSNl?N|UDO8ZwGLb^(v3S2#g&y>~;cL`bD^0p|WCEjkyJTy1bo!ox9+ zs=xgWb4BIlsZwx9*?!&iKfZ$mnC#sfv)VSiw$0Uvn@e{qmf(=kPRxFsAA_{h{co~1 z=-sb=?hssj`^_}rldiWK_+CXsugn3u(p66G(oIf(TP zhvpEBm#1ZulfW2dr~5Cn112Ho4!Fy+1?UM4gYd+%oLBKU3YjtRQs7Vaq-uf2YCs(z zVJ?$rQ-!~Xt#<|^vU2Of7Bix$;_{j}0-TFj+fjd1R)z1Gje$?4&e|w}QEvy?@Obv4 zh(nK}5g{wePbaQJ z-7fC^FSyQNF^9U}pSvp$P;si&g38~*oW~i|+q0Mb+Dyxe+x z@IFNUIaeRDDkV0lfkff$KH&YHPX8)0;4v+r?aa>Mx%~T6xwDSDM-fbz&~u~Eb5{2w zp8Bnc(4C3U*>6F+m}~llPk>KvrZk!~d&6N4USm4?ug97z{jYgQPkFm@P+n;~m~-|I ziAa6hKlo{t+L-4#M;8l1xqS774S}x})5EpaU#5Lc8N*I79U(|d-a&;Jw;uw!4&J}B z^dCnx{hvw$o=Sa3OIrz61F^{g9t|WgzUcAhWxP^x*R zuMctW4}9xau__!JLBMOD&x}StC3vE0z2__6KK_L0;Mtevx18qJ1LG^4`-Kc5!{BAW zK>bGM`(GKN8y2FQe4?j(HoZT;&&PjKq07~k&iBLll?kIPp@DXZfRWXn5otUI+X2wO z%Gz(jM*oJd`-X4Id!g~|n(6(zviqqrj)2eoL}!Ed8DHJ%bzhIQHR+~xbd z-^RU!#k_@^zMzef~-Z!}nn5D%Lpak zg3^VRwR884Yle;M8KT!2UoDPgpU<*YrB?Hnim&67^=y$ZAFr2+>+in_-XdmC}a4RqC_I7)hmaQQKQGHoLqB>f(0 zgxl)lZEe6SMVfA~cKdj98Tmn7-b$Og7&c1hEYks#-;tbKf{^t3b!tn|?{I3M>z~;9ndY*Edf#Wmz`z>@ zd#5NptQx~}MUVF17XJGd*GaVG^LKFJPtTy;@$uZ1wpqI_Lia8>exQBh09cQ_UNCBz zrvR?YNxsXNDfl7nVoQ2alSUAAZEgaa3jRk6010WHx)MCi`P#eJG?SSn4JB|XSjbSl zFgK7@<|}TdnpXTquH2P5Wxq~6QgUz{GAubeF}65LhRLo3JiDIsvBdb^p(5z}%#BA{ zKud>ZLmRPk+t09Q?^f^apWFsbnTn~{m(YLbWb~AW?-FSahdfQccO5H?> z^X#Yc?WIzNa_3TK=JFl0Mntxc+%%ti+eCWXr0c$>drVbX`F$u_od1JzGucaKd(dK1 zSciyxFV;NFhZjCoPP%mQiLu)7{blN1UJ`xE|E}@E_keF>pR?tPCsf0D%4hw?G7qs@ zs<4`Yg#bHcag`Mvm8=k%t3iJ+JcjV0^@pPbeF{$>tp=&X@Lc6qbg-;7Mz)%CZEjT0 z7O8TDck9FA69;VQgjOK|YtsD7$6od`H798fl$ARk85Yn0!i`5dumHsamk z@u#4rNS+dkHB&OoqZw|?Vuy}?zyjfX)~6!-UCrMFO1?iggP8S*gc zY@){mBCiXdjps~Ii#gx{1CH#b5M3~#n6Bh`JNAWb||I3Ut8Weqj zYlqBySQi}fj3U+fdggFJC_b=?CD`WFVWen^f2mz){Rh$|@VV-D%n{>n6t7p%*Wg<# zo|n_1y4P!qkNa@xM0D?zD|BY?6Xe5%&JS53*i9GEA#V$?x?pF}p&+BnwI{xh!*G<7 zmk8R-@El|pMkDJO3GT27_Muh9CBW+XUJWdi)oCe>VZxB7?;iNAACO#`{6usw`!uwf zF^w&Y_?t#bwUP|YGY{S7BZi{SY3a&e8DIMI*?k-Dhu8zmUfkA<0vHx{CSL{dUq_P~k3nnwKZ&?(2seh56lW zL0h^mEpGkGAEvFM5K$Nh?XE8 zhBc}{V@^)c+~jE2R@Lc(Mnq6L1s?c>b!F6mribpY!3sZxesqi3#jnO?Ax!Yo8mIlKQx<*;7G6>j zj#^b$%qM&&55)>7d_?Wa_8aQf_1|>1_rAbQp(^b^TA&Q{6@{h96; zAm^5ey-{t_XP=(33-k0p>`M!s5O_qWgf5gHmkI1aPUjbA%_hmypG+E8R+^Eqg4Gp8 zj$Kg3VeiF?#L{y`>9sgWC)~u}mhwCinG{p>tcYQJ)+gkb$L<#;jz`I?XUoAi54*ZW zHpUyTi%d)J$zXn+PM{Kc9PvLnLnR|IysK&Px3l8-7R&(?dbBeJM9&W7`;=}NlvT@S zWO#q{w2*t?s=;=g8W)@ska#^kH9i}sr zHB(@&TsY%)1oLdA>vDL4>CEVfPIsPU$QxwZyyJ{SG}=n76@#k~^vSkAX9w-1dW@1C zzO)tfc-^wInFhBhodNrTc&1|RyDt3v5}4%I(4bgK!uFkBui^suB`f)Avpr%?ztJey zKo^A)AUqa~Xbud13n!E?TtTJ=t~H~y#XhlVSlj$)!rSth4k09m8OBMy9TL2&cekW( z_$KNfY#1Qd{`C0$-Am4W!4GFL@|0fWkK_Qh{>wI2l8E4GD#erx4>fx3u^YM3Cll6XH{{Fgb!M}rp@W{|8+v`sHNCplHWIUuc+gS=sM8&zeU2&EOpJ7kSiS~(<6tp) z@b8i!p|F;@q0sN=&vV{^=DXI4$zZnJ@2J7=H07uR=d@xCA0OpFa0zsV3w^cw=0WaY z$vsC*tuHLLQ~P#YtIQb3a^Jq#C6B?;{4@<^yg3_*K(nJY=q)$s@!cNVqiAT&D0k)a zO9Ig&ioA_d&UDX|sObzDF}07e$dv*D*HP`uXzh|h(FCF~W0>Hq(2tmg=fmfp7tj0{ zhh?*nE{!{;uqPnU$MmdCZpW^LjIi8Ccvp8Ic;7bsJ;?C_Pq1oo`5U&jE^-&!H$o}I znBpD-a%Nsr-9(Rl9=ZsWM%U+?Y2T92BAN3NcdU-x?h9moLY=&yw>sVP5Ltk|)yuqX ze~*zCTbIZvRH7r}RC`9sandPK^USQ_@p@!!nJNVGus$QG5*c1`M7nb*RfXJ`01%Ry za>*mmR(8Q24mXkKbaaw5Kr#Am&YgK~j$R`7)2e`~U;S4;GWl<)&3=MsJa_;56psOb(7iH`WrCQUqKHwjpWW=PiQIm^EfV^Bqa^ zg+tWuTZVkycX%_m>GCDU(B3X)=|zP`w1f$(Dy!G$vux~d+)EqtS0ULlgOQ*lHrWA( zNNrzA5$_sJi`O01;;xt2FcUP~Y|g;|+_w%1U?*0OFjwDBf7Pa+%@-3l#wuThW=soF zil&EEN;G0%WxTul@Y>F7v*zgEM%+#R5|k(SlTd*ZdDo474lR8Ok@aUc(Y<6=F(oy^ zHdeuG2$pxq4IEA&8N~Q`h1WfE-ryMlJ`wHAi6dSe_1I{8^#^Ej3YPe|iGQH-{Z}?- zF9{Mgj ztGZz)4+!E|b%dVph3?B=-W{29)0wRzUrb1J`E+1*9>69Xs+4XL4uB<$`EB zJu4zJgnIjF(iWS(*ui46$-=D9kW7w0sJRS|6hhV@^4T{z@IA zQzH5H2fkveKtY-YYj>r4 zDm{M3~&&eM=-^#hf3dD!X zIsKZ#^DDT1&B`)RaIz|>ASJy)rr;8RdFD+ZH6OCbF?`xx+YFEJEvc80uGUb1tU{H? zzG_WttlvrBGU0Ur#yHL)D?4gABCrE(6Hq?o99OfM%EMWhrnx=;y)z)$oXtqb!g`wB zoQIc53SII#$T?{HLfreeknUn5Ow5H+bw52vz59e!QzA6~T(tG3pwCxrVNqLm=WRPg zjt#lj9vBCNoZjnPKA@F>Vaa#OWzav`#>sUk>2i)Et+RtouCQPErYrTDpeb&D`=gUI zrfRd>$q?<}w@JpAU9+PmPyW z_U0pcZ#;KxoS48JErVnPIf^Y>d5APRD^CkbjYpK`5R-WNjEaT~Y=&%wjf#kgN!fm# z_F`Njh4wi{oqGh_dqhaEvJK%xo0!)$_}Gv~3hd_Dq+r$CyB{-sgCyL9Vt<&N=T?{yeTk)(CLvn?j2_ zd)qR-Nm8utUp@M%-*ht7PK{6*2b4ygwg$3fX387p!YX7;eX)!6R?ZivkR3v^ot30K z80aOcMBHPZ8GxuO{f*F4)>uE-UN2tozu#j^R#7u@Tt)j1m z#P`SErFx_-#z~wsCC9S`{vx699HCPhhEFxutJ)vIPlP{&J1Ns|jxR&6y1gS$U(lPZ z+a7bd4(g;3JM3M-COw@!p6dH+Cb3__EFOc$o0tX{|0S0Ri4#0U7gyU<+x(paKNd9? zHiIWko-cX8Mkg~`WBr=k_=^*OZ(4A_(ZzN}%ivdmyrV{0F;^9L}z><}uakd{`HJSZZ7P3nZbyR}6 z%ZOtKWX?!l8V?%)skvT|0VyE$6Wc%ufu@^`-!P_7TiSGqpJobTJr6N8jDV77FIrF7 zYrMx1J`liFiNdrpWzRxn(P8>2iZtX)5I~mD`6b5$f5xHcAqj4f2+9M}D}MIEP*KX_ zb{sqjPkACnl66iE(deSJEdi%;B#z)Uhp$9MCfBp@8p_}jDjb*;#Af2hF#1^g++KU* zLjykBlL{yqrlZ8>NLp)qOAR~I=^Cc8wx?Eug10}B%l%%}Sk@u*W}TvJWqcWVaO}2K zks@-c!FCPF?sYm-lpU9Y9gIg&Uo6L|-3XTHY+kM^nEOL8xoo!b~%P~M@z z&sEDSz79fGgvK+Qfsx*T@cnxQlLK8k}J(VCajI8xuy;*ZD$F_4M zGaEM6Wx12Eg;;)~&3j&5yw$ZQ;cs4Q(#7iRtd+3E8qADpN`VsG6ru6`mi-J_fnC;h z$w5rPnI4D2s$)Suy;ce10m+mSuoz`QS%+yJa!=Wj1hY!R$<|N(Sq>!5(8&j;5dzE} zt3y?Fl&Zb`^!+ZX8iv71n?r^pIg+b%l7zqRTIq3)QG9}ClDa@xdN#_q2!TXlbV$Yr zLqh``h#4IMYV@^5nh*X=6@6)lCj=PPS1(3g217pES~H{YY|71H|)K(knr+D=wPVkdG=&$}})U1GT{o?CPnagr6KpjLT?is`1W-_~U(JCB1@LxfU{y2j_5#VOm7oS6y340kr#zC#a%K>+^?~5+J_+mln z>p_K4P9|8P@mY*2O(!!mApl=!+-A#yVA|`eGDOfMG@U3hJ$(1#)r4PC=0gbG>9kCF zBV^*4kOX|gV7`gMq+%C_#AtSo8?5W42J0nn;vurSnDFe9As{GzCazdf)=MiixTI2z z$q=%x$)Oi>WE>evXO)`Nq_8X4QxVuA1WHx6XfWyu1Y{sv2&jNX**b1jm0JA&-SUL( z3Y(_Vn|etCL9t2m{O3R4Qj2Q%li=2L>v+~*i#1i)o@4tCACW)d`D*cNHu==7>LpdMXhYZEMD%SOi_(>EC?E5f z$0+DXAo*;Kl2yuA)vr>OdQd=HnO)#O3|mc7OcMlBs#(bpci(WGA&?}%+y8EDGsQ8Ptjlufyy=dVem;7l7#6e8x#oI{Oz78S5G zzR|ChY2et^^O>)mMLsZ!-Z z9*rWYmkFtC+tpV5EejYMoWJeczRfiAwuCCeP-PukB_@_> zq`CmdXGnQoGB^BrEYnrNukL&bqOT?$@o(XnjWGPdAN)Zxgn-2=9#WfuaB0Z&f^%Zj z6#of;6bJ@d*&vb;J9)E0ndb}#N zNQx>cvAA1y9oApz#Gldl8Eih0jFtGD zxK^E`Tx+^SOr^_AT{;=fo>u;s0iQo&U3R>JYUUmpKOFP`V1L)!;WN)XQ$#SKL@$4% z06ju|a4!*I9y}K{a|$u!Zyq6PZU?3{+4IBo!{>;xHO_byg=n8KGWjW_#3UDZ#1h4- zGv$01qb_6^@~mjf(*RKjPkW_kB2=|<+n_reJ8@yLo*z733Lj1Pl{3ERK~&VJ7!Yhs za)~GUG9(s;P)q|vQYE*a^rR;lL0|HCJwnpmK^qeJGe7e)NG)5eu;rN+Pt`r|Rk%k# z&tZa?+EoRtjzA;ekF)wrnUiE#AqIR7_&{0NAPUw5Gx5~(%KW!DWCWd2Jz=UR=Fhqc8A{@|O8RNwvxQNm=y+&4 zDXVuVu%aV#<499l3G^re+lD}?>b8x@b=n_Gt%PCuhJw{L%e@^V>#x<;s%_Z~86}Cm z$bTtEW?ueby; zIi3KQlvTznmn3lxD1jZGx`-wItC7x?Q3T`$*F-)j(KjO%aP*Q~5svTw{_ppvD3LQ; zaZDIuP*507W?#_%0HnJqVFEBs3F{dt&lQM1iv;X%WkxYg4@tX#c4Px4DvTfsO2+`p zpP8T$Gt*G3$m`BrlqfJn6_*%=k}c1tKmF;VCSX>Zkc^Tc=@2!}XUEauO|iGb+>W<4 zNA+?GAmunNa8OlUXpSndP$*tOc~>5_$`s~#kCh1LOwu+jZSW!B0nd=}Q0uC|6Ixn% z#T+XxvzzGKPz=&Ng}ou2{({8#yGS}37s}%Us6BxQ4XqTBS@gmezL1~TDuR3L*fE|M zCcVhh&z1wT#7F7RwlSV+PZYEFm#Xrm=>@w7AJ`&kJ{S}aJnS0Q9A=aPoqlu$Jo9-CEF234?(THNIWe9=5Zx{*=oUrtc{1sfs5A!ebO1 zayGgNF7CO6AsV5OY^rkXU@6n-QWS>CrF}1ZuK6E#&^6@1&`6~Q4km1&P@!vfUIi{& z8y%ah1X$GM?>yK~HSVCmv^-AGgCgiol`-N|6ALRTjI+MHWzi#tX9jp0K_t&!rv23LRFsZsbHg--lD=wmWX_uk z;0u!{l=ujQbq;$h@v@twpco}AWIl6@&WAtz;V`i$jgIF=Ru3p!r?3^Qa2!;51p0+v z_yq&1Opk#uGieK4hQNeLJs8=-l}$*~fCIh;$-se&bxO=7eo|%T7{^$#s+fej(@e&= zXoUdec}0eRsSYKVWHNO*rimwbwx95u+uRT!Vb8<%p`%bG=(xeREJ0=_F$ZvRrjrZ- zXNP)+j?S9M@QQUe9o`Ioh{4$eW6S*u0iJN!&E+s0Oz6u`I(KySC<0rCK&k4M4ajxd z9m}re)tc+WFMsyM3t}s~RaL5%mh6Z5bBSsk*4E?+WgiCU;;_E|)KC4Ctr~pArKR60 zEak}1WF(It`k^1PYFo;6mwu$!=kER;duzAKEcz5$uPyOBVS*kRDB9>(a2TbW4}7@f z7*_1|c{7_dBX%26I~nQfoRo}mfJtSjS`G>b@};y2F|9z8@Z@PI0Y^Oy9Sb;A6#}rrf32S8Tw%>WZqJhpq7IjHHi^=4nGg_$l=#c zCMP{2wJqw43(p=*@Cps0P#5rmniavi#QcCDd^4N|-8my_M(?KY>yf*Oj>L~@&OK)negH1RT|$$;v`F>cUctd(`d9o_7@up$sfQ94$B^hbY` z&j_nl)(L}4!M6<50QWI2QYeF_`NjKnspbBlr_P@e}!al^gVMfGu|lKk-yw zEGPiS+Tv^<-I&@}rhzb@xdZ_^9W)T8LA_RvDdZr}Tx66<8d(Kr(a~(V^IT_1G(C6) zA~kWtZRH~hGtJJuPb>)QNG&BjiomuZP^!9ZBXXVg#|kT*Sd?WNc?%Yna!a$_FDtA? zIqNb3m2!+VH~R!~t)*69UDR99H7Q6f>ZKWC3K9SfvXn(xmm~o7dPxi_Wh1RoqQD<( zH*H!OMHk|pLiS52p_9Bb;iMC`6ja6^YLy)XB2TBX5K`|vl7y_ImsbDDxO}X@4Yp7m zV%$rL8XZr$FubCH6){Ti_Lu=KTQj7dhYGAGff*5BL;699X9itJ;?TN~Ck!IO^zff@ zebXy2M&94+K_bbxl%DT-&wJ8fM0A9VQT7rU`S6o6FL2L3`)uq-HZ_PS2uS_4T^%XM z68wtJk8*I_JdJPw&+vmAd#Jv}^qfPUEx*XI4e6&^BO=aoRZwP>iD9N0JHqjS9!ES+ zdCob((x8y&j3ZZFI`h!Cl^pXOEw~&gohI^P!5Gdt=Nv9Q_OXw}&e3jLr}n^n`2ZQP zoO|xMk9yRjpo)ZHKXAiBIGi*6p6GNGzKO>c=ITkn+xb_%@|Boh9t<*VsPzV%X=-sJ zt)k;Yd{(~@Y;b@Nc?XBxGQJi?woo6v_#l?A_=>NwWow&fhUNs>`A4&g^FNyD9y ziczY>LYRz>DX7Wt>5HD4+tiZu&5VZ}&M-=z=X_Idj7&&Kx?jHG8@>UUx{EQx$|Aco zM`zDP;BXNrRXtq%YyCYCu*g~*EvZxd{T5EEERAg0^jfh#Mt@|FYj*fP|`90oEP8ak^l zF@X@n8qpnAF!;OP^{$vlc3~-@A-6+>@i|P6Z*BxQn`0aZyd?KL7|IO9du)H&eWXO0 z8#H@k&U5?Xb|1OHA5#|##1vT}AX0ZI6AbC@y}!ejs(o1${H(LiqW|KHFLvo3SH^?& zRWB9;Y0F!eJnYfNN$icE z9uoKlaFx{hfB_Fy=Bh)1+u*eX=>j)V8%S1gZ~0C>v#x2mxjaW z^U$Sm2x}tX_HpBIm~wg&vS5`RJ2tL97A~)@-uYM4=%V0GVGH;Ot7jF+Gs<%=Y1I@w z%^7{6;emnAKL3r*+$<^gTm-fOfl}3N7=`+96#|w>=|Nt%=^{g0Rc+Py9?q_S^x#W4 zTT>QU>$1gNtF_qDZ;6-uEW|Fq{oB9YZ=vW3QP7G3c)cj)c*$jR%NC1On?1q~d4e`# zvXNerN7OpolhX@Bl^|Uz@J(Nmx+t?N|H*c=kyP(sSB9oatMbVXEkk_Ji;3j3XmFXz zaZdd~os+##r62f#A3!nyB0!aLo1o-ThZyB`9?HA&pFKI-qQ->}n%3}C0+OOFHyc+1 zk&Nwx>8=aqMj;^sEdbu-E_XS0>=?!jZEonoI`*l%8vFx8@*W%)(Ha3tIL43>K~?cW zdy3Q|K)yBPt%26c1ncUJj>71x>0pn623xGK%X7XZUbfWpc^Fm3oXFVc6E9+CgJcnpA3bhSBkpI5O<&s1OjmH}}&hl!&Ce)q!H3 zdFGjJN#Ei4*n@`{q}#`h12KJt2^o4+LdGEKg~%Fx(||uTn+7H%yLRHuL#D7 zpi*I!7tFa7(P&l3nj-||Ob-LcTfb@Zbmy7JaIj()xi8%B8DbL#$nNF*eHE3Cp?2A5 zYl^^z5hzvNFyJ+}5`ip^vW1n@3NDQ)_yvyzT`rWvkQTET#nzNt9^^(;$Tv_r&hf=-Axysi;VQeW(f|*-N18K&4a({t>67`-{ zJab}}2HM9P_!$RW>Wi7VzijW_?|%0ag6Sk!5jn_^=KvX(;&K=}{#Ydv0zP0G~=fm++H;>skMgq z_=Gbto%5K4W1x{^Q9B5z#1w5OGa48@if8(<%O8d^^SNYnGPqOyqdasj*rh=eH`o$5 z1l(n28jDsu-&7#SW&)6bz^E-=ce;;xJUqBN;0Anu%)#@#j@lqH!R;S=?!0g@*8f7l|G69vuesE|6&L*V^8Nz3p0YohP#Gh#3 zUgjYNhF;i1ML;nyGm|!MQ-%LgZk}VG^k5{)fMUqU4=z~;pnX|;dkSs`j06b_2>Ql7 z=jlPeCeDD%0eoAP_9hJ_{BcU8E%K(iR~g8nHyAwhrH3~melR!qoLj>U;-S$jLUZkT z`#jgfCz2G;{XeUQ6&kiny-wkz@e(-w85%V_frd|A{V_5q*%kIc0v7cS?qxRWrR>H` z!8D+Ryh^G}DwA1LmIc;@#ug3YC8?k?WtTkn^lSIgb~10xe7Kn^V-ueHG}B!qlr-IF{=LMRUZ2W^>(w$$5_l9$@Tz14^s# zS=Zh39{x&(dv>EU&4g(P3vsEHC;iY@gH z2~{HWIe|vbO?sg|4*3t6e%|w*hixS3N>mtzoWYQENb?>+Ze5Qg`j*P9u=rneA+Tf5o!g)=|`hqcm5IcVSI499HEXSoV z-Az2leeE^6TRr2kf~vY_z3J8}K>MBkKc_rw=56yv^TJs^AoykOVG!ToVGYxoipaV6Z zIqw;>P?kpR(7D-#w2ExX?rUa|trZ7yI21d>M3Ij*KDeCdY+yKbX-$D`C1_Vk~ zw_z0O!wzw@KwGsPG9N^w1e-MSgmoOB@B+^7RplY;Yy>Ry#H_Ho+~+>`$v%@ydXR&x zw&X3)@`Ow?@1I zdBRrJICy?-8Cr+|%0Ah5e8+dlZJZYi{{@&RpoB$10~CUiebeMpM>WI%yDDB;6R^gP zA(9Ft^;K}D+$F#rOh=D%%FZL@lO!Jj`0J&WLLF7A;h0K(B20v}axe012|;ur%Er;A zqwOwRyt*9h!2t?6!zFfo3+R!?27H(tm%tl`g#!~VB}}Ml6_L5eTcDY!h!Luaqhosx zbnVN({L2ZLd-y98xdDxcN(X@qs9kn+)5Dt^!CtSI%l!A=nTI})$up!9%UJaujv7C98XD!-9O`c0+bYIXs zoKYC%sSItoq=Ytl5-jSh-navBxTGdaC_~;qSi3yZ=mkIzZwefS!=8qwMq4fd8$+N} zbz@N1&^iQ?JgnV>ETD3XpY-P4x>Z$nQKKoT$Ut1tjQv4btbIU zUaXgr3IwD~KdQh6ti`N2QzEbXfrUJjrI{zP9eL+ikwvo5;}c|XAXL>3gf2875WWtS zD%A6z42N0QcjOON4))+)6dqtYfuWEwejG^RheM8_0RgsvCPoF(1s`QNa3-j(3X`x= zqcE5lO=TznFd)+tIzodc+6-R=Bwek#Cu+l?l~{(4Dwy+%36*hA7xf-dnA1@c4V))n zGs&JS%1A(B#;e$kW_<~h+5f>7oe9?8jq(?fd=Eka>r#^BIc)BscUTUpZR?am!uA&dqF~F@A$CewL~Rj7w+8)Of-2@}&Xb%I zrY^xY1C(*sQ6;yv@;t-J0iOZ5*Zh3S&M~&?WxXcvps_u^83j9b{+gB8`K+VvD$O^S zbh?qrb4=6<#wGP61@4UXBHt>ZVGy15%DmzpZJM0pr0$x;OQA|UYCW#jIwaq>h=f(AKf!8sp2^h)L4R8*U=?aS*DB^ zaM0XT3WQ?|%GX?yk51+s)T(i?D-eZDMKZaBOy-rf%Z|7&dMPKSG9Uowq#Rh|Tbqi& z{t-Bsb$S1ORKs-~0ZXcdGOMk$B(3^_N|v?ks<*yd_x-=#wwEvrhcu5`N!5NBu9tf%taWXn3%T=_{B`LQ4SF$*zaX;1EvbtHzn-~I01^^?zgL#@h8jK!La z(NT}z=%ueqYQ2KQas9Hyhj)?_o*_fq#?TiZVlql_At~Rrl$Lt7J}1&dHR{ z{MUu^a7YRvNz6HgsghGGCrqwNmIx5uK#ySQ=YUq;4vVRD$t!1GImc&RqKZsvG>um8 ziwz?3gxQ0UIp7;p0g@LQTMWULW@Q~UL0&IJjU@dlHIboVNA>OzLJRLwYR5*K-NKLxEmZzaHaU7VSKn>8V@r&5_bSX^>LFOn)*cXrU=te!yTye2Y2 z;EawqoCjtCVmFqupMg-XFkvnXB5VvCWjgYXV#sm?mlH+0haXu zONoNM@Qk*rdiI|paHt5Bsvau*HGVY$mPkcww1PZ`Nl3;LhP4%gl!T=A{AEfDtM!+d zdVfJCzl^r3N*hvw`Yh$jR$&Q7GN9R7Oq+uGtk)zpsicjhCRUu~-7q$Wyy>$Y#UHGc zJoi|nQ@uBvb|d@>MCw9ue4Kz=5Rji_0t&75ByD;<{pnBl*Rohau<#+wX;32O77osH zk1#*uIf0}ul@TVRFfJD~oZ4ly4V?-(*isler{z&OEyTBJP0FC~p3$Zh1TZaGA7wOT z@-)CfCs;BLWtkgqhJ(=oI}L^g$MP@$3Zw@O(#n>MO9LK2Mh(zhDjP4;g8=2ox6xNg zIsXYWZGW9At*9yjbl>~l*P!U0s2Lr3+E9)W(bwSekQLogjY#Unma;*oGa%?C>*I^w z{(GjPM~vs4cb<<&%^3lbC(IC?(V)9o=aRS4mR4sW*hIu`g-qC=Q!xEN!5Lj(t4V-N zbIdj>xS(z7qT|F6DFqH7xONB0FhP&=oMT8b!AXZ+Y^ir-q8c@=p4@m2No>r7$Iguf zpV2#iXC8-!iG!q|NG3q4GN9DvW*lD8PfV+DvIVY-05NYsDLcSu|JYqgtub90!S(tReCDGl38b0nDp?eof^pe( zZRdLfURhFjYbq*};c#Nt1vvCD3Ksg+JFhyRp=o-KBwH-f#$1NOml9^3aMWm}oMz+B zmU+t)aJj9h;+q?dSGt>Kx|3I4z~&JsRoy)1wYWC|7RM~pUbmsDc!@>U8!<1` ztfW>?%P2l!t=C^Nu-ayQ*JSCpQp@Fj7GUvJBQaQ)r5uz6F;b)6n@2VJvX!JoiNt34 zwrbO0)kcHpk$7xD`QH)M(BR_%8J9w8?XuVz^4~m4S~hoe*JK-*7;QY{C*@4=U-FX} zv@)T)N*lx3SlSbXB(S6+J}0ZuChAnGaiqMbhEuDI!l71S926=KwbSybTvLc1aoKN% zEd&5!=gH2ZxB?4gj35AoEK?ez>~R8+X5&JMzxZeqkvz1`5X1{zpjO9B38_~{W%{v0 z1E;%IgKk{dA`Ci}2ook}R%kV{w#0lr>0pZ|iG^eeMqB}_HrW`(U1;{Vme5T@PpvM5 ziSgW}G9OauQXpnB(#9eLydt+h8i%PB7x{!hdDtFS0VOh;9C3gxpA~v>kNax%XoNg* z9?_xMjDiMj0Hjt8Iu3+j<#7&c;R)i%ZGg}jVw4zHohe*s5)p58PY7-$HDpv~;FLX# zWgwK%IFej-r>GZ&NwRs2%CfFrF4{g>B@=Q<#$)S9?5T8@O8^Kj$#0?77aG2ZvPJ(6U z(T{$#Wy<0PMz%ml%;a<*MUN@uW=vdgGg3hhu*;@fQv?nRfl}4OLcVqv5wLcrO4_qz zTeu}8e;fzDk#Vi~mRc*UH8**YfIO{i@x>0k)wL)~*y>f1mkw=&*a!9Y6Akheraz#A zE?A2-g_KaPyYJrg@|O0(3orC-tL0mb9Vy+VK*@t+GA>CzSk|>72l7o8bUXlg(jQ@Ri)nuf)Tdx_c005iTxNgdEKWY<_4X? zmT+boVLEj*b`<(;-xHtsM6&{C^4FSt{=s3U2|J8bV$Z0l=M2hX3TZM8j6TLgn@jZy zr~|iYh73k4c3i<(N3DVd7lGhucA4QM`HY5=#C}L(IqLaIIFgz~?V;$>OD{Du{fSwD z^Nn?}laJUboH>)*L0_f?0wR7IAO&}s+sBWPJYEho6bPsR9o+7Ax4Urw!YYHdGsGNI zf3)T@GVJCjO)gCd6T_HtK*)d+CJZ^I(o7qOO%+bdQLZm-&c@Eo4k!;f%5eF8Y2OE8o@`62vsDRFw>s!geSb@B`<-J-+=m4vgoWP zv9M@#%xYWXtS~`aIQ`V;^<~xpNV&;l^7}syye`PQ2!FVW|8bZt1*!;hk6nM9L0rta zl`LymI3)xiv)*D`i@+ukC{^7g+O;(c0gE_>Va@fT4WY5&Vcol3Jba%V0Bh+ z&CNnDAK1D`!boZXQv7khgj3VFYONO61;v$^c zd=_DJPd`^xCayiB^J-XLL_>`ZuIbZE+0hObRe&<4Nup9LYK882sS0QNmq?ybh8tmj z03R_mOg zFTptRX7Q2_2nmOhAjv4r=ALPQ=b3EWM*i}Rqv?uH(MCQU0jtJSQ$APqE?z66YE1ah zpm-G@PU_4V@j44Fs&oete~hnj0jvQP2xm-PJkssMH;;lg@C?0Y3_}TL%rd4;c%TWE z=gyAdQU=#Z=?gtNMF9r_d@xK*qksTm(Z~v1Xj2VCm4bS`b`0#2)D(mx7N#9sQsxi$ zEI!7?Gm@`;kZb^wH#fL60;e;BZh@jXd)`3SU6Tn33I&_lJjZ=0(d2<4v4e%T%1mp@ zjX;%pz2+Yr10Xcg*R#F3VUAsJ!3B_^$4i4e_0dd{|LVO@F!RG-)nnLhmgx+f??5Gs zz-dLGRQ0sNTjeK*fR)`s>Gh@kDkQ+(gVkS-w~SiEr2!m;fVEY^u;4nZ`_^0nQocjl z$Wp6@ZDO_-$XLqNyHrV)^guxJU{M#B@)II!HAe-=OEwmL`=*wAn_+UH-7JP|1p3W{ z-6`oUhU{4;m29^L6uya0vbP0g8!4{Zr}2NU^HWD^ zbF5Kv3Qh3QE9X&Q=oC~fbcweJy+r8uXSNs}E)h!44}NC@F=J$uU7~B~pck)5iJeza z`1?mj!C)aM_rL%B&p-csya(S!i99?=$w+`SFGaMyInwBhbsOcTb_&wtbyK zKMbAeAB>rB(pgd>t0)f1O17i9@%-q9?x$2P#3unS%su)VK7#-aS8^kO@ zM$q)oQ4?h9Qja3AB?y$NZplE@ zjcX9Fl;`hP%gWM#wcgTiwY3L;1Y`}B52Od=RoYNiiC@YS$@Fwt^qno=R`x9AYLXSC z5M5*o2PHNbG!c^paVe>S12Vd`+hHq2xIjP5SM(D10h%9)&=+r|KcO z+`4Czq2cz~XP+I~Cmfu{Zl4jvE`A)?zqpU}FO=S$Bq;(KHYc#y^aO8f1|(r~|6%=SM~m&olJg2rn_d z<_U7i5YM^vzz06irzwG zFBYAV7ZSEJ)0pD07OngAoy>_q;!-hfRo_Mh+L8OMYdg7e9%)qg8q&po+tWz?t$a0)u~N zjUsP+%@YC)X(gtdFk{!5A(gBAr{AG9g_K=Vo?d|U@r=1-Y2vy2!l(Zpv^>IT;vr#U zXF{5IaAVQD@*mG0KYpAi!b$k69B6$J*gOKIs+-5W7FQx*L6;IN-?EVfRKby@99^)d zWf@g3XIt^rOG{Q&RK^NRQnpZ_gn_KKS-z!t^3G{WG9Yi2Pj;7YWR85sN2exwh;fDn zV(jWpEwSiPkSuKxc}1vf#h0G#B=JozzOm)N3}|CrE~L;wiTaUXma)(j>&Q24%&|^M z@(_8g%f0ql6Mu$RpaCMOR1%f8@eEb~Xe!#5@=1qIRzZz{P^LDd zkpC&`60g)VL{*wHe=_J~bm!q1`h`G-l2M2N4;fX?Sb#AT-hMM}oXo3?^dc$P#A}}D z$rrh*k;9+Kgdt@Y}y zw&Wej7P2@Q3BXcIwO$HI)#Q^B)Mq)?i+-2%pdC7@w;|-LDV~jFqlQ=Ftr@bBwZ; zp!79ly5p%>rVj?}wCSst0g5v|v3SHI9$^C;>0t%(Ac71`IGhkX=SaQYW_phw|H;rm zCbkBW>QN{e8k_XJfjx4wi#dcNoP#8tIErNNy(+cH5VgivUroel=C&^x9{>2qqolfX zm903YjJk>42B)9*DVUG}gflJyCEiCp>QP9W9ZDcjo(T{=ppF%qO#^NqwYZUbA)E90 zgA&RnInAL#B;jDg6^+X%aN8~>oxEjNVa~ydg9Z~G<{)C)o}7JRm}mkK(k3WK+DY|< zz!3Hc9QyeT2L%su4|~|d?6cb2^SNrik>DiF6e5D2SP1)m11#sBd#>+U%|V$xrs33{Qju2S1E+)@9g*nX%j2%@%BPmkWsm(x`4+hAgM!i;I%G5GJ15C7L(h^Wl##z0CfJ+5U%5gaQjU7Ef zOkvLhApAtHO#}0vdsM+H!hB1?JaMo2Ul@El;pxbIO)Yb9U{M#~^AMQmxc$@toq>zM zp4MAg1P%p(Qq@C&y+-#&z$&aEYj-3p#8!W0`43C5u*w0}Wy`L5tF1-f;+tKWbhipC zXmyqVtp4OtkhBi{G;2-eXwo_@$A@GBN_0t$-5~p^_Lgk+NQC~ns^p3pSmomtF?Knr z#*rkEq!JCQ&hnX#=o;cH>&qpQD1OFOO44hJ&ni79tdC1n0oMP?E|c+G+P2rIZ!)OX zWi-}n27(_a;Tb&lOAZ zvGznk2L9Npvu`tuj$CVNjZyj$BilvfqhabZg>0$G8QK&Q<~hpZn*=1li&4Mh;kiB0 zyk6%O`ei@QnJwKZcZf*YnLqw+sNGiES2z%F0UHz9SVc*};+-tb0v8k}!BwNIFW60H zqo3V7R305Mw+&N3-alb@{ z2A8W2T?jbf;INyBi|eS&F}EQB6wNSk)#C^JvoneK0NJ+?WV~zkjAwTi z2em^f7HW;SIpb?rw9RC~51Yzhi3?I=_%PZknAE-44Of51x3fx&21yMLeL9-#Y5al*mhRy_bzms%C z50@x`QdqA_s^|g8a`zL~n0samomnV69#9Tv=U^^Ot@OZ3<-;HT@Jlbf)NZ}u^Uz{q zo8)}+Y-W)${XFNGC&JNPyr<^X3Ei$h5!fdJrKcXnky?kOjKq>#9V{%JuVG{~CXnG&O)QOPxG)i{)= z=V|x(W&Vf@T#_qu?1mUoPD%8qJYOeCc@%FzR`4NdHC7Z{GDkp}QD1NhN~KruutJm} ztd~)i(FYHJrvc*IPT0G9qMW1wsg?U}ySfA~4GigS2%O0?L}Ai-{2y_-41gI^9m!MZ z(1eIE>hZuR6EI1*WE7|k8z7VUz#oA)M4^e>whS>^tjPWxwT3={kfa38Sg#3eRycG- zCgQV**h1e0#g>qDQ4pPi%Mk+8_R`D^PBO|g&5i`+9ARRDBI$csAaEwJ&^aVeIJi7y zJ@PuDcXWylGIWa9!-iWDZ&Scixxr9;-~dk;%~+^Zrj3BfCQKyBV;%}+&(FgKBITZP z7(pl@PsBtA0rMY^1QgTe3>bM1K#bo9vJ`sK@JR;xu9a`B5awY(z|J{uEL>_;X5IU7 z{`=N~a)TvO&byJ#D5#QTBA(M094I903RYrW&v`_@L z1c6f3Eg6WqaTNktE60jy|HemzqGmW^z8AtT#uPN5GgpP|p$OB3WbVx&JPM2|50GO~jp@M$ zyS5yFm`fVst@G%9!UE0N0gV+-E_7j$jCu#RweAeV?nf-jiG^toW)Tw$2XYWlSWwu@ zBCrhzT=gz&8(gUmMZoHr1=JZD&K6ml8FGoVfj}r&ZB=SjAdn2LpvgL`V1d>oXIQLN z%5Yxx$qmxB9|(uO5OWY1DQEo}?X9j|9CpbkpUJF#S1V_G^T?Sn6*}pOOBY^vAzOCN z#w%LpcFkV({|~Ji?vO?4RusswGo6xj9M+5em{_G@eSLh$IiNv|LP<-2wtoP{Rfk}m zgUot-hDF0fGi^ER73BlxNU9`|R!w3QwO&D3Jw1GLkRLuMq-L0-M5XR(bf;?gsb1@X z{OA~+LzrZa$Y%TNSV1eJKu+J7;IN6RMiV6& zdQJ3T%(|qbddLvVWFQ&&s8Ws<@|tu}lS*Y4)r*1>XI)edhetUz;~dk>kw;b4a{!O@ z#f2U5Y@_N+EE5%fQsz0k>f?`I(GW?Oaah6qqD-f94k1(JTUfLht%OYK$x!0bdwgGh zBbuRuT7Bz$*=3j6Wkeq-WZM0rJ}{;`=T&lyOU_K#O-z%^_#8~)WGYjmm33!L>N%jJ zRY;}FC|N!e<_U+RTp_}~dGPYxaQG4f|E45pkf$W)Xp6;V&1y25Ix>-7I=a*)K961m z;KsDTm5CXBXO(22?UE15WFkOvbXS9yHYzFkde$K4GQ$f zhg43_{Ncc;i8FCkWeW5U6Qf4KK}J*DW+Ii$saFYDmAQ=AkRQTo#u0gv3VJEHS9nFN6O1)@i6k>eS zQ7g463_Ut7)Qlzttzu*%I;Ty_D(Q5jeyCzjng5y;hCsSds6Z!Y(k0!eVyWr52pkpy zrK*R8eC@77V63NOk(F#DrzGQ)t*ulHNz1gQHtTpQM}A7iQt3#Vk$z|+tjnAgnQ{k< zI_i=v7zbEUGpH4vk&zhG$3y2iR*2C|GG4LBVOA8>D9_hJa{WQu2wyp_20dp!q|!N_ z&-Y*8BMRdMe4fPrD4|nC$|^~cPfhUD1ty}6SVqbRqq-YYbTEC%cqSCM0&|Y3e%*;pE8{k8sh>tf*byicG!f2W zv)_C3p&4SCSCs5_y6V{m*K~;sss}H-k<7ZGa(ZwZZB1P2<5K+5mma3W)V0!_f#V)G zsGX`B<*8RH<1jaLcOI=Sl_`w55tlBEj*dg^DCok^piPoaemX~knyISMi;OZ`3W>rw z!f_yyDyQA2<)NyDB5)`Ol&T&I>@~VC1g0yp<<&|}-Lx|KY1AkX%c7jhoJZf8-t4_q zR2)&)wTsiZ1Zgz51!>$J8n*xm?(VL^Y24j|Yj6+l?k*uffZz};cuw=3@t*U)m;e2D z0b>ATR~KEqtM;C2uK6hL%Y>2ml~psUykn}T1fdpPNEo}3QZfU|Kf9{7hw>2Y_n5hP zyO~+l438`7y6kX0uoN|6kHXVx?mW^TMI?JY73NEOWT^8Hrhw>ZepGfh%Wwls**J4>f#-;dsSYv>R`5fBydxs_}xL zG0n>qm*iNxwtMRu|NVQO80f}147RrYKT*!maAv%qcIdk~EnVsIKR^8EFC=gIO9O!` zdjD_m_5U0;s#gzc4f{={`QPI)sG(gx#=W*R&}02)xU>-~bbh!dR{r<+|9G1J>wH0k z(A!_Ttmc1@A9zz8ftOhy-g3A9bKs0<=s%!W%=BO5>x`ji#f$DWh5!G*d_G_jDvrCe zeoXzZ@v9){S&<-h9{eZJ`+p9608RfCAgmbwukm(3=viUF8@T=-FV6ty3a!xOMr-W< z*ZBW^TmScM{ohaP|K0@t_ul${dvD!<{0}wY%*ARY`$KJ~i&x2M#?f#5&wA_vHB7Um z)}{TL^2(ksL2c=>t|E-#GU@zYV9s!?!QT)5-6#4NS*UD!%GoWQ=&i8#a_yBXIdQIL z%H!w3m;N^wWf#FDP_0apwO8JwId;Yv@pEn=B%4N+v-`vk6??|1uzaAsW1vVI;^myct?K?;u)FmX!%1pf zk;P0uX{K<&Mx#pxF#7jwPuV|7|C#>74olk)(PB6NxQ&c5K^_uGBeM>Ov^IfrO!GZn z+IB3&i6RVKj9h3hDo=n!RjEOhGB9Q?&*fvjoklkMdBLSC%iJE#MDn5heO@^`Z`c9G zWHQOtWtelwMu<%JK8vHaM-q@6RNlMTs!3VqFRm%j&|FFQP@rdA@C0LTVO(Bl$=9>V ztK|6Q7YTfKqqsJ8&o|>_ZWPo&c*&Z$orU9!e!eg26%(-zZq(dnq3!gYS>W{j;N_zj zeF9Zi)Y;e}R|e9#*epC{D?g?licWfF^@k!g|Ba2U1I9&J{^4JTbAW0!QUKh_#`Ux) z_L6496hI57p|1N#$?-e%i^={iL*4(!iGk;wG-21{QmsD}Ef7sYs}ivbs3ns~c6s9{ zKojau-(u129ep=8HV=4qB;gB{;;1Lfv=>T3=*Lb_m)%gF4tRUKIcWcRf9S%YP8KQ~ zyPW%_$}@XRtpYE1TQz^|Qa4#2%z9YPooB{&H_Y2zPYjo`Kr}T$e5XAi;CR&9;gOuZ zIhZMpn2H)BA*P2w>bqVTqy?O5fMUVv0})u|XASoe7*_duqv#HRQA3Le8^&1@41bcV zt!7gSBJtBFYH)w2XT%>VZ}dJmJ{s%jubuNN6aryd zZr`~SkB^+O)kX11u28c8G^FWjBKWeITF)AzU8S!L6Rf__Jo3A%^qyy^N!?P-(8r2I zKkZh}*EU9>4mW?y33_&qah{#O&Kx{D1UGju`+>#>+;uc8I%}NNRO9Ua6j{oGC5L|NnJGNctSGOd8=d~ z@c1wRuYyWU&PoRLyXCCmzsD8d80|QPQ5wj%&vxE>>aG*ITk{N|&ftKXL1efNOoO2^ zLOog)=9Ux`R~1SPHZx`O$@<-cuBB=yRMXn?PjE{F*&~0@NbD(W2!QUGtRF=LK~b$Q zYIH3Ssl3T1`1)U?=g*%l`sO?TMm+C{zW#X_GnU3q#EU{eDE^x?i$Wob0;He}baMw# z!Q;o^XVlz1mD>m(bzjTN_ZiFMyS?fqMs!1rszMc3~<-RUgR z$?I>HB7W1tUoB_4rgbdpjsenIXCr6njMx`o9HM+V7fcUm|3L`t!cLoEX0Ep7DPlYRZS#XiEa#9$6j2*uqA^>flt~@pMnE%1y|7!O{*x6}+<0IkkGQa5v9M*;Ta0?% z?Kevl%wjz+Egl(?zp~a!GDEW}FN-S8WhC4onImX*bPL(svPYj#7bo)-M@iZkP#Q1RF zSkk+5-_I%X^83U#`p@|cL9r%pbQ6r7O&5ZO4SN`sBJ4mikTW*vg?3QBK5hO+5E_sFvPb<^4&7FYHL6_9_UyFG^Dd1a zaGDAZ7?mUs{%EF%?USSwr2X^*Ilh3vICz2VDrrL*2PO6{DJi* z>iXtIF5ue_Mb1`X5?JYBZOhyx5i4KK@(0$FkF}bu58V#P^`_*>Q!RWR;7p60@G;A` z;_fvrBQzRvpg|dr_2ajs5)_kSJu6nlge}ss4mPhov>c6k^@f1OB67qvMl`saM2zwG z&)dlAGA&9lU;jP-zVPgMY6i+Gw0)<QBQ<_}$ z@Fm#JmTC6ha?-Qt2Dx#xJVt1k;I^}6mU^K85ORp`weq^wG2$_lgmeZC;xQinQ1^`a z^u`y#Ba#R+|AyThT~|)1$)nMEm0EjhDgXZK=xjXdz)eLB)2EDaT>HMo%J)7j{9Ore zizYReeMb04AZC48o=@d-Y_!J>!f|}lusNNx_P>{lfS>XBWTCB5gJt;p^Bn$H$zPvy zFTRA!5Il3{{Xt*AV9OY7iqkP(JPEk73Wb(v)hLWH2flihn3( zvT=;KSxVlRJT;_uDbgsRX2$!Snp#W2U|Eep{zywV>&TrM%)ebVbkRY~_;1LDC0{mI z$0{rWytmePL<4+qeaQnGi zg@Hls8b3mk{Zl7elz(oYb@CtzLU`scyU%uI0?w#M%yc&nR@BwDf;LWa6E|P)TA@^& zp8=~Y;hUxCCNmk-rCGqz^>GFLO09?0P^QyWM=So4K1l)YXDD*3OO?j{?AM9G-|v*k z1{R0v7#1;(g2!RwiPh3%z2)%u$69$Gk9A5w)&YCe?<+9NUv<;4*qGG=QUe2^K{bP~ za}ncxyGXSrs$~L`bU6YUJ}FkiA7QhJ-$_9Pj}s~iZi_XAV43vxbmTMBbJcyrrV{oN zkl;V@@V5;qyZcm7*CG8nJ%g?qx#c;kLc_|bQMYl>I6snl88dkoU>!s!^hfN-h(4-` zI{~c?gJn!*MTrT{pf=$jCFus^O06upUb~T>B;crr0U?tmPu_|p3|+^XwI30wLR8kX z^8GNtLWvJ~6qU1He=%wxWPOKA`F@+HSa?L0Dt3Npd|B?Kv#2}i6sq+g!8C24;e!-K zZTK-_;HvPF)Bv*lwJ+p}YS4+&=X#$!vRCu{`jMqw*k4(M=gx8)XJX6h4Y9MbN8#Nk zr^cCwHiX_od{oS!XCDB7vt&(4%Oa^pzKc#a#5jm#k28YcQPdV#^?%}GYHjWif4k<%$eeF936{*UoQMh7%P~QiHJdxjP=NLm)q^D z`H2Ha297LFZSNKIC`VLrOJzZ0>v&qKi*mXqYC1d-$?s|R5;}W3zVJ_yNFrE>ne1>P z?We4sw!$F&!hzd+1#z?KVFu>L9z!3yrL4d#18^g0&L}b2&4R*ZFFdi1Sj}2}Z2>Ge zA4~YajR|#=IYva087*aD0(1Lp*n`AVs7$)YIGf`fv2AEZ9T_=K*_3w+&0t1^RmO-_ zGu^b|Gf3p_4T0u$B15o2mG57B-*f&uc!F9Os8Jx`-XhI9d+PFq!Qs{}A3@IR5+cgT^b`QzVh=?bFN#pz}j{1|$BfFWRu@4Jku4-9Dd$eOGw(*Fk zjH4(ktVTQz@5J=5COLXZRW-an4R^ZO@O7SBWm(r?c8J^_IzciKzRaN+-3*{fqWn~i zqr^qWc!X6|TF;7n0&uYLM`D1jms?n*WDTw@yGqOt<(1P@s3L(PXE>y4e(W;`RPX4h zL&B*?3)uw_O}^d@$c*BAVBSrbjG&IDU;&p&N@7xQxN;qmkllE_`zU%j8hjh}eKLlU zM{PowAZ4;;#?3G&zWrZ=PANL)paZy$%HQTWidj&?1Lh8`La+sKL>Si}eiMh&f>K5w z;Xr+<$YI=L(&%5*-0)nBd54hR(@I=>lWTBPOs6L68h_stOC+t%Ki*&Yts3J@*CnaM z9|F+}5F~3j^_NN-(24?IvJUZfA^ z*HiH4zmSAtTKeGzN68c_(06Hh1N|Rxv|~DP%%d~puP!!0wmy-H6MkMdd0JetlPMWB zo7$hBiZGv=jAaOD+Ze@iS>bR_MoLiT6O`OpdL>1^a6Cv`lqyF?LU@VAx0F!gNHgqX zD*Cr&DVg{#;bG89?n_o*Bx+KuZCksVrABrHy3Z^CtW8g79j1GyH183lJPdet~ND zw8egUdb&=4li>)nO2s#FpKvwi2@^-y z1G!iEXlhXN+h{HAeRJ^PzgI(OfJJ*gCEBd1l$;KVk#u&FqH^CHvKdlFllvwmqh@pf zaeD$)C+Y|sW|4@h&oDG04_jF0ff^)C%xV%G)Z4(fYwit5jbiM7kVX~KCZ(~$aJt5^jK;a1cj_=u=V2|;jb2x^u% zjg=o~lhYtO;N~}kQXDtW!2s)=ea45Ys_@G0Lus}v3$mD4D&REhy@aD=o;w@n&*uZ) zuB$|%%ao5&a61O>9#E!eT|(NF6fKddg01-6a{6Y$x#8=+Va`iq=*MoDsMR+{i8nnq zoEI$VRXFV^Me`x7JnYQr^A1+PA-ny#|E~xy7b)uSy*K{i7TZ4mwV4kuzEAuEo>O3L5S@iw9?04a7SjioOz#4&(N!3U1q0OjxVs8w%2yQ|Q#%HURT&6m2 z94>m}QntoqH{fWp-<-2!ZS@S0od>S!H1FLzjO{a=$$0$Zm@=?OulJI1Yzc3r=jnZ+fExM zgamA)NQhX~jqJUaFaC_YSBawyf(WL)vu0j2t+xOgc?-S%iT{iJsc$5%JD)`*O)WmM z>##7ISvGO36KCg0Na6}HOfj(lBA4*cuu0hU%_M^W9H2#f5rz?SaiV6do35JPD-xL#zH0zxcQNZ8-*D!-vzVi#c416@BX!N~0R_f|Z0y zyaffR5uYbHXHv*C?NHHD4k_nWclRY`_*Ig>F|YYH4(z8JI&cNSB$uaYs`|t;fb|Zo z>Gf3B0qK+=bk?YZOy>)3+O-cWe=2h*P|UIq>@^Lp#_R@xoTdZ*0#RCfoGP_yBhJEG zb}*ojzDi@B*=Tem?2;T7M-()9NfIV=pfo~K4s2Qz$4!NbUnTNs6*`S_(I$ITMz&C4 z3KuZQZ};8T!xv3dnM&(1m#*JqRpOC0-5NEPx$bG{MmvS|<+vu@oxSh!&`5Onq&bpM zPhqyaxyvhMiOi1Z78o9wjT_n2D!HN>DrbqZP)VJJJ0_vgiZ})#zZ3JaZwik%G9^c0 zVLk!Sv_G5^B&O_Q^Mw+4F?=G@;e3yX=#hZQr)xXTs1sve=# z9c02UP1?$Y^78CDRm(`@38=Hsy|l<8V?2NnF5-I8c4ksdC#A=v3IWgKW=>UH@V+=% z*@Pq${Za}1r&#K4Q3Y+R94Q{H>!>J~Xw9+Q>ll7{toAsKePIqZ8hr9|yc6nuugEW( z28&PRXTm**fULFEdukoXB|G3FVgeVY(ZtnreaE9TJ=;##$Z9QFklzPYHO%#)Wzmwl z<9IzTe0|*|>}k_)o?7%beqaAL7NbUrb!v5=7B{;{9U-qJqzGZ+gUmgcdc;XJ%H`v( zdFqANh+yTX60VNtuy-TWQP}NA}Q^Fo=c_EGfF1agVqE|Y zjU+G@Glo-w(N%VXc$=H$V0{vNBn73LU>Fda}_FhB1*`8oRmb$kC?K9Cka+u1oe_;;-yb8QG~PB zXnsYpbIIcCH%20|hB|~^^u=yMwqam6hj^kC%V}*&BKh%el_YMtS+?VY*4|B-hF?Z%G%-MuHoU3Di4|}jk;5u3AgfWu6s=~UNvO=2 z%epZz&~sqjM2mx)jS^EM$9+sp!}i;*(R_r-hHO))t{q^tS10iOmnmy=w?xvYQkY@2 za}bPR4>mT{Hh4h-Co{z-IJ@#QNZROL1RvOWHclVlRL_|auM6U!sIgj>Z20uo42aej zwoPQQ^@c#s)B>j8>JIkpvI_tda~MA?h5|YsZr`-RRuA)H1}c)Gr7Rb>YI3-4`ypGT=(F=jGP!+cyXI=blH+ z+fX9H_Z<8F?X&s_SU%7SP45)2rNHg#5A=!Ax^g-G_^sbWE??-ZX@T_G&bKt$KVyWt z=cVg;pY7j#diSD`xwpL7Wr?o&Uyd5lek=FS)F}&4b4MYd@a-aQ~~tSAj+t z9-MJ!XD8P(UzqK(({3)}?@(B%g@k72gSi3IkF;hyMK6WJ&gz(en;v={y+*6~Xb1llQ}A<4`v^c^bxpB~P|KSA|%C+{x^n7z61rkTo{ z7Pwc73{TL+qKkz;v*99(mJ20OIqD|Ond)cw3}atgaAvCA&+e_t;HQG6eRm`2KRUlY z{Pul;HPZd*xtXWEJ%=0go;JQ{Xm@Q|KO#_xh2;*ju82)~Z1vrKDpVKmcMUdL$L z;?hy9=MdnAmASy@uSr4{a|wTdFYs@HZU{mcj6c>knNP^y4J|sp-j9gZ;NpL!TS;j8-P7=l zT_NI1UFu!-*S*#^cRbH2#f#`*xwonAU8e5=>0bd$_l9Q39eeSkS)IH-Bemn)hF(PA zlQUU;+l&;3JR#aos8;-tTE{ia6gaGWbSC=mS`>259`8Mw&Ok<(Y zf+Yh1?oz;uMo_QFVBH5uy*1&tnu2WDM*k@mo;Qh(0povR;ZOHxf68g-Awtt8pG2eJWeli9cA z^*CBbp0U)+k85>g@nS@f)hpy)5v!k$e_OL-x>USz{739por7XlPUGb@`}>%GqY--O ztwh1CZD**eG1zZpm5{bn$nI%;>SKUivc$we)Wg^jO|Md43XYfEPHYlHoK2Ix6s zRq+=c{jT4nN-1z=!K1-!M1+A@=yuP z5{#7f02wgq{)Dat&(EbRlR2+)GK&MH_8m8U(eZut?|QXFMn252E=9dPZy9}Mb}?IT zC%qp?JT%2t9%X7He?<(9kUF8Jf#cJ6NfT3SY+2DN0gnrxAe2)#D02iJJk@%4O8El# zrQcaPCeyK7wgrp=#* z8m~jHN3pcgM&Bpa3c`RTXabQ*;1P&BLJ1a#n_%nJIt9it zVwB{ABF+JT%;G+HD;)Mf1$^`jf*!Q+xhiT%Vq$TuK%|FR6&Eh>R5q0`6{mt6zs}{@ z=5t5ZddhL3RBqM)70p)5knze37qJD7Gm;xv5(&`KycUNZu2OKtP5RE^% z!Qk+r9>>66+E{3_!<}K8#=|t}w>*W=0<)uqOHSdC+)5EM37+CwGQpD63+P6iyDvkH z3D5OI8wk9~+r9C3^ZZX${vMloQ%!8Y*7T;#WD~giX2?lenL-UEFi=#}rLaO8gjm=+ z_7cgvj#MFSq>cP3yGsBSe-I^2zB4BSt4ZuGq8QR4PGe&)YL-IOO(m@SLXBr687Rd8 zHUW&rueVT^C``jJ>Lt#W4hvxBM@sk<3&|kRi<#S%s4Xzo^65aZ#1{%olupG?w<>>! z05>*^x?T zM0W%5nkt%dgO8}>zt(X7NCv2|_1P`Y>Ux>8xrO z!|;F)j^8z73#vVL#9IVr>8#L{^&h<4?*?So$fvfCX~cg?lo-I8WzU&xIFKvxw8n4j zmbeOYoPH>!GSj)yU{DH9Mp^DPBQDW_@3m@DM>dUW4AoqNDc?ltk^X9^$uvfpxvF7` zpb?Krl7y5A4drh)Ly7U{bjR4oL2KT54Xg-L#Hn?J6#^`|@O#+oHT56htWRDtvzNotI;_;?_H_2{Lhge$O-|vEBeGYxtWQOQ zR4`mowzkqSgCwS1{6kb6dzZ8*a_@q`t!dsdu~8umks;lPJ&l;S3P#S$ykzOheGo!*JL8;2(cXn$BvanlY3>t2lfz(k!tQBs>=eH77Yx2o34{p7k9cKL$8kV; zn)o=$cAHp;GMi|53OCnuhsk6i@EuUFm~K5ga-B_RLl^i7C-Z=d<#JC9)B4hGl)7k} zy$L3Nk%B)iui1z^F|3{&9tCWnk73Dj#WKih#m~bkEk??99_VUl2;(^@)2}4O0n3bq&#SWO}<2C1-BA_J#c*Y_?N;dY!G zpu+cg-xY_rioJ9lf1$y{wu@X#;ss0H?Hi8v<49CZcb&wBr*4%0L}as-4Sl3TVYMzUxoV{v=m~wAsRYX%5dOtc zMHsW-7N`fE8n0>$1%|VVfjpQu2|t<*_S36hG-**n0_EhEv8==K7<`C|90@9kAF47L zktp7MD7YqNm*p7%uCFUoO2o_;|CSap3Egv<%g3ZW6WnK1LztK5&|l{7Ih03Co@CSy z<5JG_0rt%-OigaPBSfG?qSub9?p;erkl+5G-eq1>JYbLHZQrF{r&7n3LIN{*3>scd zNiT>q@8D(Py{}rVE`%g#j#^}Okp}6nL;ku%{LQ+s|JbqZ-oD1_&2{e9;+|S^0Gr7q zvBNZ%rdDj9zS8r0yRSc#{9Dh5;2S+y4m2P5sT&8j$jj0HIy)ZM>|}HyI`GTF9&D`q z5)C>lih*n*k>*SgQH7ZXI7ZTNa0wO$OXos*Z{D~+ynG5~_$##ZnWuj|R%+GuuEa(Q zUXbaI?{OZA67uq}TaU)diVO1ggPIaP8y+R+K)T(7#fqX6$@j}GDvb*3r9RNH`#i(J zCuo1RFcx1g=-4BUJvFY2v`8&G_Q}`ct|~YsMY`=n{BvXk)!#OAAgLPm6MK>tF^ee{p=+j~l3$mq?r(If(bL-9^nH5Fyo}}W2-@mN zv&VZN?TGo$h8CXNRT6xRAbiDGPb$aEAWs`(Hn#TAC$5q|t7u23bHc=BwLUD%36}fetCeh+%ftTJVs@0?4Mr~F zFgVltGe{QbIsZKD_zVt*yv0EXb>MCNQbzffH&E!EliWJw;~N{ClxE*UuMv@uZ}um~ zFLl;DT^}61E=@yQN8?r3$vaCP@cakVMfMvS@71{*^}#A!ydsJ_wdt$dyxf}!2Bxy= zo4$t!k?YkMz2LjETV!w~ZL)nRAJVTmXf%zTW^}K6xDfIx}L;SO-@{? z$Sde)Zxqn|;b+$;d2z!-Cwp6RdB>Amff}gwcK(-aHTyh8buU%GFOr|DABs|5rHIx) zZ8IT!(`5T-+&p_#E+ahtPDS`!!Ǩ^>B!X)StW5SD!ypg68E_sCrBPT4g*WxMp{ z$7B3$Ibk0%+Ayi`%L59@B#$V1h z3*g8f*~l1H8=JXKCBo1O%nd&PL_ja$^u%^PmC;wG#&Otvg_$(Z(Lc~#sm5yproAS> z4h;CT*7B)|F0)A?G^r|Q4}G51dPGmHe}^`iKgEQjHAxM2oXkBB*HD;Ao}6MIQi4hc zW-^NxJm)Lfz;JMacM`R7X-r^(OQ-;;GFd^3KxgT04WD*i2UW_)$e&h6Dp&C&g+ZF2 z5i>@DvEu&vs-liJyq%_*1x`7Qys`!-__C`z>En_C{%{ylF)xSufqwcRQ>|Q)bX8cL zQ7GiXrz{fO)o_afrTDtnxRRx5xYof6lSnDRF>WO+@Y78f-}Z|yRXvX%%mv~R z^gyY6K8;3;p8*`~5)PCeobJdmhFAldv>mD2W-FC>)V4jF4}^ilmBz z49Kt~#HtwKTe>SstyhH9>D(Or$`R>VI{2$Bq6MXhla+xOLk`iCM#9o&B2Xdy&Gyu3 z5-X?&Vw{}ijJJ`tglmjFw%`BI-KDu|^GA5xCMHoZ^oiVrvcgyQM!k0_tS4m!L|pI{iuIc9DR735^XWb~i7Q*91kK_tzhFxCEq=3G<~R>` zox9hXZ+Pe(L7VJg@OG1Qmr&6VOUdH`^?v|&@*{a0f zp>rip!9kWU-_MYkz%n&wcX-w%yEJ^;2fyxd3$_d{9THg@~b82t?H6O94w>A%?XAf8n88y?%hj6n=@jRAAga+2xKod z#|`RZnFu{GMJTUpj^I7XPMHFGlJ+>f{#)^JU?SS)E?aM?*+nwk8^ZAI1VwT%Wtdp4 zVV6AP6O^>a%fYEd#Xq>*rHLhmYN)q-56h{59cpQgBE+Diu2Yu>@jp(QhIl}2w5BH^ zPB$!ho7&iiE&^pD^3#{kaM);1&dz-$4TIKbT$fLKGFs#Xb+5d*)R zQ-$$OW1w}E9d;2ThgH%h6K(s%qZFBz%2kT9WDupFf7i^UU}n!v30wW_T2LJb>nX)n zd|TtbrH*e;C-8`e?7T1yKn~?#JPOFyuC*RVtShPwgGQsfr!r!K-WJY37W3zJbP+533YT!@Ze>&%YJEBw3Vw z5|TqQu&UumxJ&U-)bu27upQt7r|t|gjrnIwj^Q9Ma7!kk68{#vyo$XXZ%&vt9BSM& z0&E{9PJolO#aikzu_0(+u5TZ=534JOq47LZFWM zVq^vbJM#vxw(rFIMxp0M0r+8)l1Ps3DHb#KvRP!pD0(4W7W&~KV&&QHpWyi_@5K@Q zEOM^@c%uF*b>dj#fIY^W_{SvLDx+XhDWS2e zwc@+y!DE7#fQRc-qSAQJYg<)=0JYzll3)jCk|NvKN98NO$bV45Ztt(#gN3B1=Vl;A zv)ENG?FH2KwPYNVGNysmkRHQo`)Iy~lJMSx5`*9WbsJgK>tR2AWAlM3_fYzyiEG-y zUsX}f4?_`t3)x$Hf`Nh`?0ey*$RX;O<*<^%LrGIQbzUWF zRWP=hgMZ!eaC#<`ZWn=@huT?<0R_wD{S|_14vLxNxU&s>;(El}hGUNY!G=D@y-wul z-T8~`!U>+0rdE1b2QE5h-x+Exo5Elsz3F>~mW=KR1O5;)FJc#S#cwiQUWSWqsvz$` zYMkt?fW$>WztD<1%13D1f*f59oJ4bchA-Bp!#UKv_adKGbe2mMfn>+Q>B4 z-l?t=rpS4c%*vP62le!xV*2tzuzr#drwdm3rFl%gIga8V7)6>e)9MfFu*R{cEj095 ztAy6uPGlTbaY9B@lI;TU_!|orr);*#aQuxV_L#(-dauu+{>!&@gL6WCs4S)_Q~fww zozHr%_jKM*XjS=5M%UzKwN3eiZ^`k2x34zfxA~tcoJ84hpNeC=Qopf`wLavIFHF%x`6w%vidAI>vuwKqpZvLq9(|xxi4Y6hcAZ; z8r(|20Z@nW%b1G4OVBW_Le4w&v*_?FxkMi*0`1FPQgsy7u3JbT{dy9Ymsi?Q}J=~rTe)3dPekT<+ZVP>5Xaq1xu7dD+y~nCVI(%#Huce zRM)9FTjRk}aEJxW>(8GnxQ0w$QY9Q=V+ulGf%%E~2cMW9=a)DP5-L1A{Z9pxl775o zy%BPs1GeCl()Y>*{Wb+?rbp@*kpua3 zzsFW|%_tYo!nXcUiG44)j^_;mbup1=7b(>_9#4Pv(3|kr*5XNOrv?^L|Uc$I@u9(gY53v4NCUE8KRyh)^=vVqzp+ulT;UDf!fUN)-dz9k28bUN@`q<6I zgXZuCvCzj-I0>rsZR1h1GGb!ia04g?MVjPOj(INAx^?dkeq0pgs}2hDqE@*j(^yVw zr}dl$l01W~K@oe1oftS@t-GqrOA3ucFO-B9wM4|^RM}}Q60x%^EAW1Kjt~n!62H)> zSx2g38wP=3m?kP|h&rSDnJ?o4EuNn^kx(;zPb=pzdv|JA?x5Vgw@qk_(s~&;uxU;s z%Ir}UXk&ewYtOm!6#cg=LZ*`HiqW25oAQNVCq|o0J4Lnf6AoUcF=e1J`L6Gl_wQS^ zeG#@B5xnfRh4H_X4VBU`+9%27^?cTZ-tX^lYNm?GP`?mlxzVu)vTYwBd&s0zS;SfHpTV{;Lz7SDaHXjU1l@-Yr6#|c+pr!#M5;X#I#YhaVm3l zkUS(^?VN$Fu9xDF-W`FVEHyJlF+!KE4)~)b5iH2D)`e&5F@A%-Y~}#e8DBWWSy6$o z%`g(jDLf?B8={rYDIqRurbkCofOLO=FbANPrR*?7YWV|NnZYoOhY6#i!X~?!d?C7^ zBe&>I3M~uyChLf8$dFJLUZREs3dAc*ud1FhgNiNe(nh;cvaQzv$g4NV6Gcu~VnJY_ zYf&(Y*Jzx=XsXHlt~SmX-bA=|Eyp8nFPhR$%OMSOlX(3sUXA0@{D5;l&#e_J|C&frKgeKM`Vq!tQ zJHxDz;3C31I0Mo_DKpg1bz`?I{pIB*Qs^OI&ZkvB zcGap#n&7G9#$9NVwyTT;@a6!bC|gvD1&x|azno%RV&K)|kJPE3S@Y=u6{oDml$Frh zuYr=l>-<)Tk98EL+2GH(F#1<$<_flrd{U7Ru}WlW>6`DxcnK45(=A*zhwIZx_#Ql$ zc#3?T%vbMer=I}s_ z*|6J$g^3_h7%~1;cBHec&AOUnneUil2XS=(=?!*Ym|TE_y#FaPGb@Sad#7R=`e+zZ zuB!NO>TrtOn8vP1I2-?y7;X8 zCCu*_5@Dm|-ecDRKT&_`qQssI1|0~q2GJ5Y7ESn>`OQa`=t$N&J`!jZo=%YHLv^tu z-F&?l4wOUK8y8L%5KV}&mpIt~mxs+4-YEY{s|Z})))OG&y^btEYk<2%1=1bZTDgFW z>w9DBQGSUN*HEB;;>}J65%$w+_)=y^QJsMmL|rWTq?Hq5fph>kbwpU^X=|UtS*-=E z#*|_>KESB%!`4km#>H|xprun{eM^r$4fIJ@fpSL=PWyz1DhpOt_aKEh11^1e4JtW56)-vUT0#rKr8MHO8FK zZ&?c6SnyQ3C1noy4KF3yuF%e$S9z^O11B&2O$N8fxe}P~T9HLc}Fv+!A2O%aqr zF$%_ux@oK{p*n(RbEo0b-?P z3b4oO!$KfSBK{JDa9C_e%u`_s8x4Ij*q%ugPDdw)hGa-^?;WCKbDo*7iT!90|6+A! z3FKpAf&fpbwySj)Sq#wxIZmb+EE~WYogZ8#kL4n#C_QyqPaO21ajTWPwpRNiE>K^q zzfmx~bsS^A(nyd4u6;p2BPMx?D=-Ew9vpe}(OVp_dn@FkNwz&77ypskl|{Ptx9A{; zEj|*E2#%JG-^>Ens{luOv<_7v6*cfr$@^0)c^?3%JuLDiE&*m&C5q@ZpFntM);GKJMroYlUI!Q+ zX|k<8%REdA$&)9z(zzpgtRmMI}lu|dNpbvk$4E9rgJ$6mx~hLX;gy7A)=2# zDSVAk1rFAtodWGttBX;B2=uu7^Ev4tIy6nVxNo5lnKPa%ebOqfcK|}^6aZ^7wgSRE zNm5K=K>=L@7y3U?>;`^hKl_L0$5l9^aevBwEbap6w2m~JTlJBSy&SG76V^h1(!wF1 z%-G?}V&?TJ*S#aPVR@nrSo!jkt;%ATTJ-JtvNtnlw=;(aTNdV$C$lR1FRNPnL&!lG zA#;1muO(w6l^7RBbsi@1-Qd3c#M6YN`Vg%dB5BSNE}D0rjlHZ&6f)(&gBc7jS?6Q> zy$Ziwcrssov#{;a5zBpq)im#hx+z?PT=Z}y^5IR98s#52!r-j%h$J~$=_js!T!$b{ zEh6>(aZ{P55`n5Lsy^o`|7?T@Kebiq`D&akLxyHun&8nI8Ko@3FP4)Yx5ll7_e%MY z0r_gT$p(9riMKhZb-~;mUG(e6Ro6%^u&NK**2JCKMK@5NTf;Wt=cW0&6hdnhdTR5< zX&X~=xPsbd6#cKt6;Qr~EZG1e&yaZA`rg=>6}jSD0C#AckYWEd_QJS2NUU4qOM>gN zw&epBR?1(f8H=ssltTrgu`=EfdP1vE0Vtu*@nwuliTunW0U(f$;hBQnuLf0u*$)2X z(T{EX(w9^31gqrR=%#*w%AyL_ZMb}~6yxT_I-z20k|xD6wy9T%i4>UfTD3L&w~Oj% zqi>sY%{Y4P%4CpB<`*6ci+Se}vcJ%tCv^-|Zzwi}a0)_baER`H+)P>688NEhy!auk zl;E5#=K?VtgW6#`hb*IFudUxs78EhI7Hl`*_5aXx7XEbp{~PD%IHtS1yKD03Zqqdk z6JvV1+tJN-0vilwr@ow*Z2>b<@Rde>5dCgu=wgps%+mi4J3CBVbbE5?TR z*6<=*Ol4oM!FMS&|AyYZwhtA#ME>m7si%ph#+AdbH7;vf=C2h!p?C<|E5+au2#ujU z0hZ9S6bTFH$vsc!Fo(;|puLjy4NZv1(@9It0u5E+=4Ha?R>nH*z%trrSDStr-r;}1 zy^MyFZCPQJwgMklOx{IM^T{_p*D+0RI5lYsk#nqo>p#>;rzSS3YH1{ zT5cQKKH56mdaOg|GUolUW>01OOZ$hJ zyNp#i+%(QN*f!B_4!u_|2G@^N2VF-Nc{V3Ns>jE_AHz(uN}29@SKcDa=wh0PE`mxO zSV1ci%l7}lP?8~*1R2&4-(Ia!a%@!65H_Q1O$6f&<3e|_>CA?}!2upE>0OgDHaTh% z%@CM4&?OO2^_y_Dmn{Ykg3R`~blDn(o0XLpvw8H{{8#WF0mj|F)%W$lPmbyb&wa>X zOQHuNmMNl*0*i8+Z_bYmNMN-(#jy=J_M|nUATfugB?N0K`&-$ zvkM3Nq10$@u~fcTw4!+JCqV>vCdHsnQ}5pifLq&YKUp+x6UYJ>r~bX9=paN%-XOw^ zV*1QbH~Ap3YV`C}Rb8vdi3p1hyUMHB31%F*N!*e!)g{|K{7^F$Z_q8h#UiF<^aO)- zR2g&nUSBMSYB`9Xt!`;w1w^RRFt7aqQj(al@2zF*-T_Bj?n{PbV)NMg`6x#(HO(^A z4xM|xjIyNMBqzZIl`jQMh6Seo5X%?GT=ZXTdOFUZq}_A;waBqG$2&|BGLSvxLm!HZ zFn)?ZKh$N%8)`4N6*)$v{`2i{XB2ox(w^YZE=GqrwX<%I#uAwOCUJ;g|I6aUkYv)i zZsRb+lt$ouCYp*{wDrns%^fP0HT^^u-R478>&qr9fBq!!;@sz}J64dOvGvkNXVf{M z1JiNBG!7WOGTGd;9d$LO2Da@kxVG!(%U8Tu~jo$@(&X9FfGG{W~4OaZH-shZ@ zf{Kwy%>iHvug`5=dKS>ci#?UHK(@~sMN|x8=OoA|PRo2p0)R9PL=hOg%A-hX(@K}X zE>|98q1WQoYXu6dnCnX+hgA?r6dCa|=y!&`W%7iO4$4oNY8UFg=j$0FjquokSSicJ zSSFe?B=MJ<1%lcRL!^RLczSf)j1C@T$jdzd7rDeRe+Z#7^J+#3Fh|oRII9W(Qo_06 zTRVSWt*6DYoHBh#jB^td9u?SbRCQ~m0Ur{H%WX56-S&pL0-JJt2k~O_^x*WG3$8Z% zotkH#r2jE+`9wEj2tYSCw-75U`4 z41AO+ttTV_nK<>qKXHP>e~cS_cA5I-|B3#G*k=V)6IK^DXM;0q4k+5{1q`(FZ4 zX3-fcY$~@|CKE16ER#*5oe|7q|77p$oS!FDlRHz?r&0a7WG_JW`Sj74J)< zb{l+VO4|z{$$gURG3^G*mO`#2`D%8EN_s5^Gr;eHN}v0#eDnXWYPkq%(*^2qlG%iJ zdg%tzG*%4)XyT@EnU`vpfnaooV0iuzPG0XwrlOyWz|}+NtQVv;Ue)b>a-8DY(OR% zN2M*+TFXa$ij``R3D7+rZK~PR#JnR_8uZSY;~N8@1Kf@Vg-I4%xK*v{?alitLf9HK zA@IRab(_HKbqopnG|TLZtXf{Y(LzUF%en$xJd?0M1`$F8caLI&wP8kWXtwm;V_Djd zAv=gGAverCSO@2z{bUb^I#yZvr4m>@%PkX;e&xg^hWdOO5WVmtCoYJRpp0C5d5M1wHGdqkdlUh^lb15q8!t?nJelBJ zGUPrkf@`ayL3G4A0>@vKDOaxRO3=Kk$)a~4hAOuP)!{b~*|cK6+m~|(e_SGl1-(c_ zSwRGfn+1ZTjLFNp_CjbARh4b`KV2?rQGIY&{I=&#S!HkPaymvltS-OLNI+lthF@9i zKsVBpYCxuln|?Ojj9i$qnNQ1VFtf1OhF|Qua!cpY-y9R-KMJ28?Z2xNxZ#wxM@oRE*O z|L~!=Kn%kOpcS4t0Zlu}`n$nC2h{iqIde85&4yHDOZY|{#deoX3uYXs$WF#CbMI}W z(`kxlT=Ll^^t~?h6Er9L$b%`Og4p%$jM+$*H3pQeQ_`zLKq4KyoVL{{1WKLG*ord{ zg@~E~!(m}kw%9br(0mD{B(9yB($Pa!IHFbkw1|AEwQ!=L>Z}{?rG&YT$&yK_Tx}@( z9uf8XuS@El1koMQJB388j!1g3`nPW(C{ijWP|)ELv67wDnuB8Kd#3BSW^?JPM4?|~ zGHBFPVuXCdGJP>;Ni2-ssY)3t62aoE!klfG6G8mNXc~FQN~H8UJ0yab5#-=rZK1F#gvG?Y^yP z)%G6Nl&9Q5gSTH2ved_kidZuqf(tzIfnswj;F~FCiSLb~-QL(D9g-b&OmH6r%Rj#s1&X%yu^arsuLZXpdoOQl2mns*xF7Afd zNZBq2?jwhD5nbrRl68htv00mqW^`>xGsPk_LwLI6sOUO=^*L|$=SV?2#vi?PHfOml zWE~)SA`TiL8n~$>vr0>TxF%A1!em5lYE=(uq{3)E#LNh*H8}n@9_U39t0Elcse^R7 z*dzUC5-}^zK?Oph5mqhP9Wp2Gh>5(X0B5|9x2hAoDY-`>!f7}i@>M$jUHF;k%IeS!AWb7|SBu2C- z9$w@T>{2`Q%HP`Oqb3=jXgtX46%Y!NZtAa1_4vYJ+f_Vshc)Z(=*PyS8QC$}7?bQP zsjH8(wCg%(AW3UUO=PtFn)_{%yomS?H;m#TkXr={Yt|ZGzp2xJ$eUe+nFSonMlVAX z3j~bt#V*!Hqxk`D>7*TxiocDSqHK9|u1<2V>&SSY+#X?CTIxt86=m@9nAyBuV_c2$ z?6#h`3#VKaE62GEEi*|d&AxaL%ErS?P6TzuRApS{O0F;R?CO`}u@WUX&1!`bczmHH z=cd|uKWvS%mY8@2`o=Il&i=8&U$)*+Dm2{X|Z7@2}PIL1zku_nEQ9!76;!b;WL9 z9OT#ubRfhTGNcyG#CY(0hy|CNbyN$M_N(o7`$bJ2j$1ew9}oR%?xWg#1Wy#B`jB&; zk}Z~<2FZg<_(9(vV!s~-=*Ah0D;l_GwzB@HBG%>Llz7w3Wa8^x5gDdX)lga8eQ`y0 zG)2cZN0xH2C`%e_jHJI5QTJuf-MHSf?!znggxOY8f((C17f+^;^mn;Xk3)=wz7tSN z%pIO=X5rwl`D@hgSoa|CYqKjPAd4(8DTX1H-K7FC?C<|vBuZn zW%F^k-%u_QH&yhu->#vb*UqK~bTIV`Z-cp@_n9NQB}x}gUuN=k39sfFb zbr{z_=~!xOYrQE6-a(r)iTR#y(-5o~8J({+rX^6_v#NRkWR_%QDVO#vD|_ovL8Nz5 z$7_X66=RK&&#CI7RVflZe{6eaYvR;mwhi|BF|(_tY6f5R;F<{%s8XeYKSqfBd})2x`sK>|$nX9%Hsg{uoCvgpF90)xbKA1m$j&lxsaU4%SvB(O+bD4ab~G6|VX-Il zon)-ntjq(GtGpP|M&zG4aU#M>7nL2%uD=Ho*%)H(!O|w;r=WojLlu6aqR&i>b`jkDfROA+`_M_5Cd_06AibN#6 ztT()@TT@;Wzll6IDs5(wzaTBc^xpVIS|6XhNxc`~z<^BpK9>KDMdk*bQH z7$$$d|1STn?{QVdyxAc!#K9e6*d_NfiC3$svM-*&I*t~P)130PMe{PsXZ~`gSpZAwdH5nopXOFCYHJa9dn@ zi1Xu>i1kX)Op|t`BOudaPEIcIzaL@zptN6iLikRD>;*_)ZCU%O2`THlWht1wr~a#k zqSDSyK!kG3CdgRC#23%z?hJuI^&E8>90~pT#iLf3qSAY_h_B|j#h&Hq@O3{jI>Ud@ z3WuiP@i>G;G-GqLgb9hs!#<;3hj023*81qIIi(zkMU?qveA^gil_!4*QS!TRPZ*@k zy`gaP`StvjuJ}ET2jZPN;`rLLr~mB`ljIx*0YUOry0T1*bPbIOD{Wp)+66f**XJN> zT4)4Lm%p;Qm{;b1^$v=oWs+3$ z>zVQbf6ZvCnd>d^HKu@vj@Mx3l*tXq)!i0M+pmed|9*%O*u_O)O7Pwie)*&BFb#Up z+_<41gmX_-fYU3Cxd32af$IzT%Sr^84)n7LeQP<7WOVeN7o=Jdtfa`=9L%W7vLiLz z-CC2^KRn=j(k;6+-=PLZR3W9wz2>^n(U8HPZ}x2D50eQ>xu7C5`;OXBK~$W&Zp%wNpLEF_Gzmr;c>j)l*CGaK zh%9L7rZ-o2=)ZDmLt=H#DKUuUk%|g(AG={lZ!_--c3+TyD@TtNDjISaj%fFdqeaO< zI7U$K*5U9SkYqomqr60&AS=nVp1TK!5pj4^9WOf{%#m^5dq^D!G+Mn58N*UjHXexW zF;YhglxdTF=p8AQ9x7N=c+v-tj#4WBjF_5Tw=dESMqMJGbqMi)LZ6F&l)Z`0D2*4?MF2 z{k+-wkz!xkgHfrGy#WwdtaDbA^S?aBJCBPbTHZftVbzhW(e~TJrCsP{_I-l@S|dmW zl3gwnY=??68=JyFu23$Jy@mQvpY`pa<{Wskd=px@1C4vB(enO?%BQsX7rPOL;V~Ic zx`t>c3Wf046#;|!cY8GoZD0p#zQR=(MOiL?38|qg``}DOVnIH$j{&?X`)WhbOh`YC zLP3uIXd8{KZ}M$hBza7N`S(j}fC+TQrZYxvLaiuJnj*CHh?LEVa}#X4XNYS<*mUV* z`CbJ|4)yLdFBIgb-qD{!Jt4FqBNe23Rgzzq0(lwzozwYz!>|HxZh<@(zN@WnGEwbNhOtZT z>bSn?IS*(+U$uAWP%Tu}5qbtVg-!p~*BUmqZ!iBV_#&D0cP>)OA&1V%HGjzIez9wR zJN;`nL)LtI7zMmo@=*o&+e4w{KR}MV10=Edab*ESvmw%^aRK>3kNj)$GtJ;YRvPbB zDh!RCv}j<$6ToFsr=v2sccXWpv;0#m z<-TorJH2W_KA@EQityA$2*C&?mU0U65YtPr(hYxg8LqvhAxSe*`Om)eUE@H=FbjfvV*(XMcr#k=3e*yyU zH*DsAVjSc0mcYK<9hv`q>D;J3#3b(5#UdSOiXtF$#|~Dpr5$|>wEK1Gn&U1dSJM!q z42D!;={qDx^OQwIv>`22Mu)Cc&U&Om;4&77%d{wq3_d*uUX2^{&L?}d$a-s4FG30* z#rL5)+e=@#0xx4NHH(93^bK>B&3uo_u%@*hD`>4)1X}Gz>-k4!b6p*m~0XX`-6JMGF>LNYW54iqLItkb{rliq2v-?xj18&CU|DNZI+U?WA{%LsrcKRf2So=d z(jIkKaqD87qUYet-b7mhzNoW6c~g!xS|QI#Yt+4jZNK@o!Q7?|8=-Wc%! zh`vfiu7#BYeKI(s$quL{$9i2cm?toE9(;AZw=YK;I&!FF)wn5``qc;W`pMDmq8K_H zho;TBVjacwtY#7*V`y3fFtj~eN!no1D7muOw^GCXR}!-ImPQ)4M!a}fbJUc3nwLc{ zbf5yKEFH0jk=@ue0CAvK{hR*fp0MiNp>|(@Y~>?;LGm6ovhM9;_Rcqj>s|Ivop(Bk zwGOtfyqlr}>av*Bxk;N2mCCOqGR} z`{a27e*Uh!Y{Fj)Qo66U6%yH!MjKjIyw=iUyu|T3y<&eD2i0vwe^N9s28$}Hdmh!p zQD#X?4&?mI-CQo+WFl@6(d$vZDZhEb5IP_J9$2kan~oIokJo+Vb>q1`s?J`Hz$dO? zk%qcjyU*tr|1vgWBl|P&S+xB-KNg>U)1Rby)Zr+&Ov^>vx`#gdyWemN!&q6 z(K1}Ws=KzMX?2jOp9ZWK`+PGjX&3%uDa?iMtMObrY?mP8zv5Fp=S@se%@(w?c^8Z` zG~f=W8X!9a@LWF9U{6`Vuk21)SkZ)HV2M?9wPQ zkmZQ23IqlV%+5G@5jN^=9(;CE?nt-ha!PRKni1Q2Rz>8Zv0tb=N-z#$m+{+>bciur zs0B*ebn%_c>$$=;c~x}VgxF{XGQCxCK~ay?t*O&&xdfj^>TVtntXV5SX2g3YENx^V zW!NuWC?EK>%0W$v5l-)fVuXFY;rwBg8$}r^JS(iSDnJy9ij`H`FeQv-%I<<24r7T_ zc`WF0sjLjCCqiftcV3gYWY|)+rZ@{L{y|Dz0p_4M^Fj8Lw7QQ$a0MY20Zl3i05Q~M zk7p53m>c?WRVfofiB5S|FEyvy5zzU=YlJXaLs?9;SrQ|Ku|($h$+oyV%t<6iXu!m;BzED99id*Po?F z<%zR;&hb=v?JD@7sbJx>f2tr@GLK-8A)c1{xR%a+N%YuNCvun%Or)$D;2EYT}8)Dx%W_i9MwjgR|J2uc@6%=3YzMrzPk8 zV^Om35p{uu+gu0Du)G_^VyD05;zLKH#k&EVi&lMXL0x0jkrTt>^$2Jr2U6TXkam8xLv6_F@TyCy2`{YM847734tfnz!h z?q!be%)FWgPA@%L?tQ zY4EbhIIMq4%u0GeVT8^LYurBjlMTXK_DKG&Lbnx8jJXSjpwA?I+}s#Gt>H>;G?ZIl z3ygXSa^+3bkLtEFpTPKz0p?`HvyrH?pWw1%B_(M-uVuWTW0<$Hx9YWv{5KE?Gs^Qu zM91(n{!k+PUg_eP_x-pCNPZirTfRmlC&OtZYkyhGbb|ct>H0_K@Pjm9`fOVgC?hzH zcu|S`67A} z7NqI>AUDx2%r}X=)IE>%EzYZ<7Fhu#p*-oBW{r(nCIntuoEX8;ZjEn(oFOC#l^>(3 z;E0`NgHeL^Kn_EKM@DH|o)QLn?sRg!!vfNFH1uXtL#r@p?1PK?_YrQT`ZlX0KYOuB zk)F$I`{I8^%@Nm8 z(EfS@al%lwbauFm%}duwuzBuBEx1ZKaUZfo*EHa!8AUJn-%CR98uwvCc4Yh^4DzD= zX6dv3-RU(hN*Ni}`trd#pJE_^k2R<8AId#+)Xcg=cK3~DoF;yJ`-z}^z%D%+6M1dg zcY&hNxrk;Qp%Mvf{CEW;A94a-cL-%XE^-iri>9aw*WHLL1)e*9H_R?Ou>z57pw`yI z%AuhM5qsE3)|dManX;i&F?~{K2VvX^ZZHas+m|6{>47WTekT?yD#SSY)bL?)3w(EM za&ali)9}hFAsi#KsLJiw23KFGHLFfu`1T3Cf^7RQud|Gbthp{LV!96|Dp;T6WYB9- z#GM&Uq}(I1<8>aVqCS(qmE@YVV9L4w)AW#`CuyrXWkH2E(zqO=gbEU`mgxDqMR!%Z|SkV8DQIi z6Z{7`2rwH6C!xmm!16ggDS%w4vffO@jY;WUIfqvz!ko~K!>?3R|IZcod#M_CK`*d} z9r&^?-u@^|DLis-wS1k046(A*YIx2<%cih(BjaH(uiEZSn3e|PIf<&*7sZ=Wk&%&N z2ov77$jQ)Qx#!q7&G6J0!oJX(a+fsX)dW99ke(dm2xla+KYT7Hf$vaq|)Vj-wSVgY;c!W&j>Vq!w zo%FZvYl5c^-?0{X({$w7R*kh5kOfwAvZ^lV+%-~6e4j<56Bxz0zRO^VRS~;N5g(1x z9r|4_fciTo#m`(fa#T zVLd#*j{&^ZYj~<;SxH5HZ9ITWf%@Xj-|aW3i^L5I=`Cc+7_iR*J^yuIQ4sl>eU*{> z>!9Jc4t!9@B1y3uhSs|`4C(0LxJ<$V953J9fQqml=7Bg8Rd z8*!VDoxol2OlPtbXApc8Anr`j`wh3oqOC6l<`ieJ7BKr|9gJ&FboD6O-@5HA9AQtc zl}##sJFUXgk;uNcNW|Tp$!#`sX|^q7Td)IowKjjC+{^Ia7bf1}kR^f3)E1C^fm#(~ zmb+KJSVRpC_o6*i43`1)W5JffVM)XEYBxbqlAGpqfE82CH~sje&dU)(NS=WkkxEA3 z=*JT}Jf1^2*Oy4Pt;k%BPNXE^N3X~--d{bCd=9FqfEpf2!+vY)VEXV?KviXY=aMvp zmGz_b{#bho?LPpIHn|!c)A&tdj-BZzOM|bxBU5~FT}2^wS;lwZ?q1UKTM=hcFm+5( zAZgITOEj?vgsajtAP@xR5IVNi)d0Zt1ZPfoksC~MhC^zrOC)ihm4+i^u;7#obX5Po zCebI%Zp&?EjN$(P^g=2#^3NM?txV=P1v$xVjFRGUR(V`b`L~>ecK_frKP9nS z?>`_PTHn69FozeiEmP2%F<1S8&H_}`43(b=-Je%lF6E#8y+2nkaQ;^P_;2O@$?qb- zDQzE5^9<}rW6MGtKqf;MCip2lj4}F#5QL;nZ3qGtGo!K+)7&6p2g615s!{XHgnD!dezNq*Q%*cDhQ1IFO?#G7H7Gvc&u60d9v`IE2=9Prz4kR^hS2KQuvnx3Mw>u2GdoZBIBso9tB zE65?s~BQD-7&j8+jjGft_je^~VMuR&iY z+MB!wu{0c75L7Yfc~5k`kEM0)%?$7^;K2`}U}8S+BCqNWh7izrB641G&@G1N@JI0} zMLN>y4T$t9f%w>Hkt?J`I3lvdYFmDE;05Kzxw^#%wQ$-VgU(F|Ba?{2swQFONY0tu z=(xN;lkolhdE|&@%sMQ$vOfw-)WmSdx@URgQ7@Uw4IeG0g=B^`ga_W z;whquIhH}{2q%(p974HIw=A-}WTL7#nL0~@{MkYYT-HmJL-8Sle@i!*%OkbOimc3^ zzkYcVGAb`KTIPIe^*8wOm!ffP-A!>lKj4XLrlkaqYpNL|W#}{cZr?n-hRR#Ky^4rp z*qh#mABhgvPO|6%bI1{lRf!)t7@|Z4wQ;c$sT8kD-Lzwx8Mcq0iXv5Men;wCgO~t} z_su2j@WXYg1T&}4UT(Ch&uY-uh*=Cu?y)BdU9Sm+K^P*p@mCa&-%}>Km*JC-0rgI> z^KoC*5Dcl~VlHr={&*LCGc-1_JX9I6U*BmG69yWSF6Z&}LKfE@9tQ4v+NGwrjGKzdrGvLYCq!liv%NoJh zA+zkIyWnZ)JRn_&Zl_05PBqMOmrSFXgwNN0I{owzWsbP`6OP!tZXGF_q&LwO8+2{sJ@_~{#F&9_$cQUye@Pfg( zJ&^7`2p>mWD5D2@-y|cJEuza_-HYbPC$D2>g}%V&ro@0r>vBP3x1?Ufs=B$D7NwsL zZx479|J40_)rT3_hZ znrD4~Jg(t!)^+as)a(-a8Y|^+F8-Mxa5+rm_i0A3K@X&WYo3hmod^2;`P+}pQq=6{ zz89caB~W8r8LQGc^u6)bf8T}yy|fR(hE3>pKg;6xd~*Kl(DCKg;0ptS9cUU?>?(!6 zqAou+sT>2tgT;sng*X52-UHLyKT2!g*-iR9GZA# z^TQNSu3ja=eM^}g%Qph=*HV^z0tY{j1BE=qySQyVM&h&TM^R8YQBD)PlddPXi zmVa6u{CC2MwqDLY-|r~kiRY~#LnQ1%r03Az$iyRSkfiW6F@h%U?dWP^73+_Lg@EuB zHwdNO=A->b!W=qRLpn`#s~_nN0Jpm!S?p@j<-J&|nldfL^XlzsL;kf#5NpoOPgAOw zLxpG&l;(}kf8V=h2<-l7VF+n=%x$WukIRqm2LA;L%9h`4T@fCUs*Bb4*0O0c|7Z5v zOlRvfFa1y8D)^1RRQg6nr`Nrp!=n=KvEd3|$?W4#F^94n89ZnDGOTA>E*e>H!B-W! zjLxtzL#Pfev5qbHwUP&S|24e)%-TXjXh*$&PfJHJmrYYAD~nF#h=%SgN&oPVa@sL% zftosO!KhF=*h5^#w1W_OvXinIF~WpcRqd3In;9O0)@E}2YV9nH?o4DhmX{)~Xjdfw z{ietrFQD&ws3BN*kT~~A)Jh77AaSBwDsym>6#INX)tq|rii2eOxESMq!Mu~KA?!#+ z;Nn^Hjz(3TJRrlg12Fzk6#9-2^Nrr*{F7ARh~0Vk$V6rBzk3zlEBg~@V7sP0*)k#| z^q-mYJzjjVokwq8!&>G4`)9pC%7> zKy+!eQYW+XO#p5rrt(rDGFv=F&kcKnMhW6dO{YrsPItUaKc~g!prfm{6o|+3&74Ql zct6%f{>}VLhF`4~qh%#oN1If zs&y0&WP$E?T8rcS@AVH2!*U3M^U0qcB@MD=nBWPQ*kThxXIS2Q{=4G(H$dwhOuzkP z8y?65C6Bd4Uov_3y#U7Te|wIte(#I+ZLIK{jXEb=(GE2m!lWb`Pp~=YexK`$&tBCt zXwdK)>d7sBybaytH$0L*n&X#yl52}RGcquszyJ5x@Xy#vnQU(tRwcv4)&szI{42L5 zl|tpU*_1ZF$_AQ>a)KC3QP5hI2?Nr(p)5E;1O63q3V45C`OIn}G`!Hm)+%t;ysjI| z=BHno>6xfh>f<_V3?+nLT1Za|4fY%sFarJ88q1vnR`mMtzg%-rpC%g18YNyGY&?0QOXoA~WNMC>H zraUPt#T<|K!_9B`q5*6?PBeRT*dr;NV{A%q7(yKKDnna$lJ+(;XJ>j{9{;r>5ezSw zm&U?^?Nbt;w4No}sd}~7a7Ai2TzakFcnDgCWSI?xf;w`JP5pE9^CSEwK@bAIAhR<1 zaLX^R%pAepk1noi+^`E~%Qgr0Zclo_a2v)PUD*njNEdXPuu2hGv^Gb^Nl|^9dc-iT z9s#uW|B(OG#(Mo%0?nvMS=@YfAPuEIdBo~dbGm|7(hbbk{$kv}_$J3z@gH};|09uf zeUNBWo(0}&mBYad&^#?04l7hY`t^g+`j@SCCXrAS+;5BnLI)|V170887;9ryvU2kb*|M7Jd6;vk zZKgXaZTn8!Zn&q6#syez`ZRru(*B|c3kIrM*?bCPl3>VKY;OzAQ(sr6*7lZ3YCKZ( zL1T92M+mAy3#OaFuEc?l#%beBs|vg#7_&qTx}3_x2Wdc@TE_apZt7r;S&La1v!3Id zqI7pl(2OPtt_*}B#r8iNR3|Yv1TI48Ps5DHc-kQQHVgDZML`r{E0b*8{p4=G9yB5T zVy!+;tvL2zNnbS-dFB|(_c;b#?@<*-?eKrokwT+5WQ89ni;A)+Rmu5E9r*TiRLXM& zRzPdmnCsjQw)|QCiF~bjjEGMC5h(q(I8tHHH&qH9QZZO$qz8ZiT=&jn|M888tUGg7 zvVg)ez(%)k3CuHg4?j(>mfXmeQG$z7v% zQh#V4JTmJ**`F|lqx?{>7QhM@+JS?uvAl#HEIh{vtAsB>@vzUSUXKIc zpiK;jRp^pzMo=F5EcJnq(1^wxEQw(_!}W{bicYTD&AsJW1SL`&zu!Hy-kOqFrfNBzaw*X4gF9bi9wU5nC<|f2b1P*DIrO|Vh7g5$#&{%## zCvu`&?~8o+u_$1iLZ^NkR{bZUCz6l+O6s`^15K(4}5Bsw8P@e^5+ z{O{#1W=xVis(lXS|82J z9Y<<3rS#5M?sQ!fkT2g{GyUv5hWAI|U4eqT=!usoJ0AQ8SKn8ZuRY;qx+ zEi=?ga}Rql%gc|LNzObk&r3^T@q^>?fy367u2&)UHsH3UnS>ccl_k;VF(E1i$#C0S zWQ20cPKT*LmWCTQ!uNEYL2kvC<=AkOwB{R&0pVaKJV^I8x$Xcf8XmS+zlAZgJ@N>O zNI#-djqzNzYNN(A>0&usVvrE$uN-)}IyLJ#LC66&55H1aV+k5`x{E)=277TALmi%` z!D4=GAVfn-8nt}2I-Y{QHTpfplBjkEw%)+QfryX(7?~TdX6J@$pmv~dI&JPR|2=l~ zesKwSu0qGoAS0eb<6s4@s3{;5LilZ5=kFcG9C3vwemY$A z&H1{z%Ovh>D%&!RJ{5=cZ7;kmxmoY)n)LwW%bzajhf0CwJxlHz- zY|Nbh;9Iq51Kd^xUG16zh*B{ZCS(gdpK+x4;W&RGB8aPEv0i%0vD@@G{BV}g>}0vI zExtf6Va%ZO8(ZM6{QTh%0_Ca(*DD^Nilc^qcg)yzNKsYbm;~4G5YV>a7O)0@!?NQt z@d+2SFUwGPa*LAUa)|iUXApm51KnGCq&ro;5AkpTU8;(ufEn!E zr=o{wVO5cx%_}y6Q$09!$4Iah?=5U@JlUQsKW(n;3(uV+*}n*l6e5asj^97|B0HNt zkMo`~2}zuZJ2!!bu_bg<7h zDUJocxA@X1^Xk>o5) zaA)5);CJ(L{BZEXH+D$?YX$fR?(tMD-BPnB<)21m+B!`KONqZ7q>(MeGX8z~{_jVn zfU9mEi*-}yO3U6~y2krk-+%4z!4;N>wRD8Z>9}HH`-80K5@K5nNIDga!wOc5v339+9XPu2<;U3d$qXJ(7fsvp!UigFi1nqr7ru7QNi0g{PWOA}D+= zQ8H7;zPBLYZq3YPeKlT*_Zin~eUd@eNf{7K3(_kR^uwOD)hd1znN#q^PhoRO*Eq1o zl^@r(O!LN1$-WKWkFO(SMkp#p`7XYMB4gH(rdrDAoOKg2z;`&`eaqPmR6sh5`yR?t zu|ABGgi+~^Z3?4a_dosWPFf`^kHioFj`K`9O~ku4vl(e|C{AN}#^FUh#~K^v3uPRh zuzy4NR}-(@V$Xdu_aMuxdJ`RACcJrSl^uJE*18EM@2o6wy=8d|8WA$nJIJiQLQW-B zw)^7T54~Z9S!yDl;GQXGmtO|4xx_f_(OZD?>3&|}T*%X5M;|VIc2(2)Sdt7{58nUX zbi~Hs3-~;l=5GG#W}yET5lfzdH=Q{@F*Qi{#10n$0BVm4_xTR_h0YAuxh zcOd^nB1kxw&TbuWOr+3$%y02#cSnLJR zXN}_nu&+Gq^;tFGNt6R^^TcpMJRCtTa(|3rEh*N0J@h-)%B2@uJ_+vo8(fd^U z^uRwn+Fw;uko)V`;BcOdT2~)3?2&p=4MvI;B(Znd=wn8td@A+r9XID@J`(FLP9; zey45Su0*O$ZjRf7L}ui3uBlzIYMx(HCTKiF@%}7@{A!7(iC8Xl_36lpQyF%if3(<$ zFZuZ{aD*@4O;k+ST1@Fx@k_;D<&!!+|M&O&J5b`;jBR+re#Stxz~Fuys%P!%!+cbA z{)g?m4-oU-UJ(|$F=)0*Y%NXs8j8+7;P@f04Pi~a^s}JTJ3F79#xWEAEbT1FP+1(tPY0CH#2i`C`i}LZuuTxiBv@Wj0+J@)E>Wd)~;n2u6!eXp94bI|H zyrpmrBhX@;h(W@@8<_0`M=xhtL5w(MmAcanrPpW+| z#AoA{%JO8iZ;}kw!sY05HlO4cF~$z|bmK5%hYTwe@IZJ?m;%lZVE$Zb*3z!u6CXeh zuF(hC<%Kcgn6h8OL_z8rnyAKZ7MxR#(}Jk*I#;Hf()YXs!7W{s=< zdC!?w0S*pw9eQ?i1*X0CXPIXxf6x-7?n->m{IV7LSS`S9-NuD=pV(Gr7dFCEQ8ZlF zk;3iq*ql8Dk5b6qE2@+1a|-jX+MY@YIyq8=8G5joSGAY<6rnBXpI$7XRcacY-A?vbEFz(-l7to9Ea4Ux&7Dx8;q(2U-8KWPp~OLko*U5HJH>js^d3P+@;FV7vw}c)h z%@aL27K;XkLAVXXyln3!zDv{bSqpm&2Q1+ z*(2b!xc8@0taYsa6O5wcxZ;n8X7Qy+2$?cx@!`e@@fMlJ@Q4tA$opm?!#!)$ zKeM*HN`WJi?I(KFH)($`X zklR@zh{y+8bS6T}3WU8p{%Jgg@?Rk|CK{;iTFc^6L(BJUwMkBR4}%O05v6BlBhIZG z3QvkzNMce5{7JNRRRk|GHf@_g&EXKa{^wV+7Fq!&+>8Df$ z+B)pdzg$y&G_ z)c%D<+XbR2h49ACL1nY@Xw+~Ea)@|dgUKaoxrUiyVGKQCui#=T6HH}IJd!VxBv)2q zb3+FjW`gG7SO$aAHGwtnV3|>dR*o*e`6C_PW)Zoma+u;!-#Ix)@qQjlbr2ioW8538 zK4aB?;m;~og&mtc%OE^NE*P!!OuV@h+eJ`&1XDEubPD|UBn}I;y6ij*&`+O!`<5Be zjgE-Mb(j>_|K68WsPU+se&g)UXQgUzmkU5X4YZ%S@d^%H%p%>=ba z)5aob45Hyox0a=4WZ%4eMxhHOdB-<1pzCHB!EW6?x{8W*&oc9B*V!y1_t<>WRIt*p zQc{e?aiDfwHMv`KI}PFXs|?fR;4>f}v#Ly71(>X;j{eiP6_2-J_;VSL$y?$yXyV8O zn`BGWqPf$9mtu%C8Z7CGG0tFVW;G*LRlm)Po`b}q%?q>BC)ZY19NRUq8a0V%KZ40E zAB?_y7`uQ-yVI2~z%*;Tg?AN)H;~GqUAWx&n%2jE|ABY=a6}^5J&tl$>j%HZ!KxJzH;Rak=?-;%9oF-(S#8yWw zI|DYvx(Vb2V1Exs{M9y3n}%hzmJr+v6+{@>a=ago7|fu}l#Bhi4d$}& z19~QmFNW9#=iE@t00*|HJ^kQvaU-uKoh18k3OpE1H+#+w7|mQBaaCykY}e)y%A|0s zSpJkD{zR*x&+Byo!+3jOeTbHQU!8VMeASQ^KaJlz$8Q>i_i<*g{XQyl6&u=Zk=iPx zP({zmS(|19JXwx6rGw8-@EAssNTpMHck<|tRMn_?@xOM)w1faM`w$M?&9h;c*{S-a z3E4>+z*p~n9;N|8mMF6?gLBN_>!GGQGfi= zRg32*GeoV0y=4@T?NM3jv(Ed?&TRN{_3_q^N!~EsjEL*>xHcN?dDZhlPY>~wE(Q8*@)k=NS3-nt9giBI5XjNsGTxeHC^m6iM0$iTD zUkY1C5nApH<(V%~%Ed{w=;{eV`=SG`)PzwygNt~`ZQRB-$G4b-_?C6uNr+ewEk|Xu z9e+~v^`W5Qgol;;C)oOp*zs(X1nnW_Rm^u>Juwn(E)@@=LL615U9g6n25C_l+!$wk zyzzPpEoc?QDiI^?f)o}es2GMR#7bCD1K0>pM1Lyduojg|gf65<)x|E_25n;5XfWwK zB5mTa7DsXc+3RCxB!5W-GjQ%XE&86&>Y(;cw1hKJfe%flpYGJzq8C0kHg2uNSAJ9T z0o0V7Zq0S70sCRFw)4Ig^UK!#-?TB>_%@83TfKF&czGFyVs(tz%)Kt;l^g8VYd7z@ zrLjEa+c#taoNnQaFC+z$a>TiUF+%%EM`VMKo0$Hg055JZO|)nTHE9exoQTrun+h6M zCge6j? zbiSSoVZ$h)9CygqF1+3%}7G!U0GywwK3x4uN2mQBhlwa=WQP5!VjS zbBFGexF#{|QZ^$18*jW;^Dv315tzl55ucY8Q+r*^foK&Q1-PDJTx?dOFll_=z7^`~ zDV?lEO}z+v!=vs1h0zt}-eL=BU;Q(HdlyQ4Y^kT|1o0sGBy0RY>}837ax@QA-@zTA z2sZEx26y}C$r|)Ytalz|=s_;G^MM8Y7Oarfc zmbZRoc9AKgREu`V@uYJ}TDxYZx2F*6Dz;`)+Rf%gZo6$ak4`fdz_?nXgf1&I!W+w1 z3dsIY#OO@r$*KL=0>$1$E%%F|IM%ciS|{tZ9A)7Mf)>8yS2=mwAj7nl$V6*jcEm)U z(t;a|I+j#P6R0SK;qduTz7zsECA|_9BAtL7Hb?rz&es(QUFy}jPn%NiPmEm6sxlE~ zxucg1jL3l1(WeWEfeXik@YF`%gc^z`7nmOpU}i>gsK|n`10rgnJB;JzPS?7I#)i70 zgZOgvv5Ae%1{7FmwO#kELSQWZ0Be8?c!^H1}6CyHM6 z2^oo??^eKVW3SGcPWmbdtgbJIbB+v7@a+{aF;!yL9?9unTZ@Ccf-Pt&Di^-+AqW*p zfh&^V;MlFRxP7=x0<~CCVpB z=x&TqUw7S64E$+I=hr9iYX8?qxAcRH1nl zAczTmcMen66CT7_QWzlnjF)LjK{4Xh%RAKMy&<8>TL=s~alTLrd4f8T7H6l9t|v&E zkm+e&`t#wq@PUD*Gj_QcE+>M3r?^yd0La>+t%= zVI?RJCp?w6=ES%M&IBy$uITNlxDr{+iRI&j-w_6uE0z3kkC?ojnrflWpGyVf{lr_*u(!mxncR zi^mw0%7PiQDjw|86Uz!LrLulmFrqd7r|;l}C$2l2&O}sAY1723$-OEO?htYWirbv< zjsa6TR@J%Kxi{oM8+3{smh0;T7M@Z%Qp$|6a8WJXtAz(xQ^aHu0oG_%_HvM>tNBrd zu#{@Y41d{)1v3p78g%m87?DVfQRAW^Td;mM*g$1$RStdu=Hfj}|grO_{ViZ_+( z3-t=9rH!$?HoaF^*|HGS7ThTs9#|EUdRV(%D>eFyXSp{E!VV;Dx}M13&FCY10aO_GG2SYgy0%}I(h-Yg4#(dy$$bW-cFKk*0!h_ueK#kwh)^>}S_0H_F# zXw2b`Md?wRDH)R*y^-(U2#lwD_NeH~u*LPtk#qJ(*9e~cTxFwkN-Sj&b9ddu1GueT zIU(UXY@UA_Rst6{X8}chDIP}p4YuVsTw$O=SHhSfdfLu};1zI6_p=|_v|N_2);2eUJ<@4M8

0KRF>=u#CWX8SEV~@;jn*+O8X6w- zRA@^p5_p6gPr>>$52wQF8$$NpgpQACHxN0K=Xx0qw;V9dJj{*lFIxUAdy^^U?wFWX5k#1@flvP@AePnv$||gWN|H7_!8535*Gx`x6#| z#tw+D+J@Yq{ab_Du;QiGeST43S2UI)Q;x}>4%!QtSW*lR5MmO)U8LNgM(bgiot*^+ zR@0{MrWqh|@>}0I-HY&08-hthWwdq4)*|)kIxWA>)og7F%95$&fq_JcDN+#Q0a!^{`tvAusc_GlLZM2?Pv}$xZ zF)>o(TDLPeT0&aIWwpP0Q2;kP^zZZNS;kC7QvjFZW%yt9}LqkKU4&DtnX1%M!GLkJR+Py8beuX=Lq-I*Uu&adY_mpTZi8sGlhZz{+ zJ*QdRTGQv`K9G|VMMNdU&pp0F)HAWDKR3HZkH&(Re6MFIjn=&X^-_vpaijYIa&#|PF9jj+n->C}PPo)BvoLHQWCDN*g> zCpe5~1@RSMmQX_(Bp$)?a}#n`e_2$BMmg2HHZqEdV5j}_)A_-S(}(v!2%n9%k_4Gi z#Q-jLm(_IO?m}1#v{>dKkN0NY)@@{tBw-8+(}d!*XOf*-7WwV0=l%N5XNnb!HlVwl zgpq0yO||t$w|NzkF;ms?iJRR0yCMAh)mtks(P_z>^3U~!&&IiDU@MC9zd|Woyl&3R zNBZ5gigmhxm@MtxRSIs5RaZA<&3+uP?@lmSjW&IC=9bdEOxO=QoEQnsx zkH=qN)6MsPsT$SPhOKS28%CF&6+#LPC>HrBbL(f9V4s%4SdWx8Uf>drP`QWoQ&&NU z^Lqq27JD!$*yiEO7Pm;dF==~MUU&V2z5&mOP!-<96mJy04VP-KGJ})%LFIG zWHw#V7FRJ)zc$2!K#1&r%<6SDy8%sl72?>?`v9IuIYh2&XpY|JR=-Lh{AXC&=UC(( z0f%wBAl;0zR;_i?^QUU4gq@HaZ6n=5y`#2;pGa4w>$JQf8n5?k0rcaH3{EA0A~t36 zX^ugxqfPcNHZMn3Ps=~4$IqO#Pb-7)(r`ZWgUP?HECk{64skA)cXs;3u*t2JWpqMa zKT^C9I-rgzn(4Dj=+?(fCeYtr5?v`6u?<%cUpj%2Kc1aq6NJ>J#OT0Kc9Oj z!S{>MGeltv43VH>mLqHDG{*atqe*FDq<%W)Z-z<4gP)!?{p{ooX80>q_i$%HOgSBo z@c3lvdw%vsO{wBc4@8l!qZ_mw_3_dRZk_1<@E>6^*%f^TXE}GuhuHc4A|%JC@DM`@ z_D952gnjk@cYFcH0ydI+s9S-#l#!?C9m3s>H2@=@kF)9-<^VfNGv~G&1Hn4fOoY~Z zjq3Gdl4(5&)Wiv-q$>?{17hc{O!*C2&SmN04x^)v!+Ey?Xo|lJ&vDLetIY>?zXmfz z>{b3{sJM&LwSm_GD9+xF4(C~j=0bZ@KR!6x16{2DWhk!)ftM}5jj5`u*b(ZLB!D>v zG~9ge<&zA5_Is6(OI7jmkmD)^XG#G&qzd7!i@vmK>ptzJjr+h~U5VFS@Vt}ryk5t6 zqWQ|TF!sbegH%Q^zH)jl6yGyjBUwuC_{WN8L(5H?Gc*2<52~+xSq1mBbp_>sSKAfq zZiALd8gkatTXwwgSCB{T1`payZ4w#RMQ@aNDVT#sMG|a;t^S@f@DRq?t~sVix$xTL zDnx;>+Yo+8wMnckdi9rACP_!QX0Yzo5{4mddtZ<++G@wsKUOH63@mGeC<5@0 z>=T!>3>^P?X1kv4-JxqCTb%M^IVa}2V)riE7dg-q5JvTvV@E&&iNB>{m5@M9pla%L zL6p4$$y3NS)Rw_1eQdt0shL5!l!_LBkPo*BWzVdLUn)SQwY-sI2*zfZVs{V&#(0?P zy;aqmM-(6XaMK-E^v+eHX5YPV_o$j|Ne|Wpa_K|SdooFlf!YENt0(R&S(_=on07ZIAta?S91CRVX)i; zNs67aD0ZJ4mRbxOHH-y6d-_?G6l0;_&js7yHw?*UTDISWg$jEe*FN$D^U4$gPJWS~+h^W&wSxx<+qss}WF&hle(7G!n%(F%i!CZFco9K=0R@vtw)X zpWz?7_SO8*e~N}jM7w%SSqElG=$Z;5R-g^58tc9URkg*$A{*{v6R4M~$gsVguv%kM zXYpNjHNaF|URglS|Wl6B>D3cxT|A9sv~e~5^F#ugB%5XFwhB9 zP@!l#4n)kzkFXID^EAp^^!MLGNX)V_o=;@x%>M>ZV5p^qYIHV~GOyEr`#8r|TSsg* zp}ICko!+6IAzsP0895(llO*ItG?pB413tw-pX4fk3xZ-GXvYPhVw!n|_Ak(+?1PDf zS}ZqEG^qO?`p(=;zwJW+REzxkeq~7eOTw7+e8#u!cC)3-KWEn=oRj?YLB+cOvxT4& z4aj_Vo97s5@R5}~CO+d**aheT&&4mN{qK%55UW>bS>6nOv4rRP;+MErt0j>g=MD$J zHrv|vu9coc9#Z~yaF)kmTZj3A_e)--=dec{DbpSGZ-gIDBG9Xir4^{Go%^Yum!)?% z81~*_c!T7Fr@a|NhC;As*w3OvO0kL3>_awxy1PRi?H|!HLj`TX%xX62dt}qcDI>+7 z?u1`j*=hlMSY-E=a-h|*|IT*7o6{upr%e5MDrqb5I??Z>rSQHMoW@c2@k`y$u(_t- zWhaL!;@#sh_Fl98>c5az-}mewMczGcELl{#hhc(-^%+lR)3=J84us1$$fmHJj=ga- zeOYI!@7UA&{*3KZyMsq>L24ZYZf5rdkF01Q`AcO3*@-N{-j#qb3fv}ETzObpy6d0sz z3iICoxfO_>saY!(fZ|hxp+e3gHli}0)=K)aB&<+c^l~uC1O&_n)`xFqi#Pju3)X+X00b( z+cgB6wW3awn<0I>B86VQkzGb%n)(a>fNO!`KP3YF{Xd^r6oIZ^eor(+Tq4BW?xu;c zDf50divtAXXaPIW)~yC^$dx8gM;fYw0^VoY@O&6U7GV_L?r{{o!fy=FV8o^9XbM5t zaqP)ZJ+A=l_Q$BgP(;D>xT+xE?!o}N6AkbalMon_+U~6tp@`Kl{0%t)-gT33NXO;J zjIjc~n__tAY^Y{@|)_F##_d+i*asZu@O5g^jxY+k#8+ zp~^av^@p!^LVs`7#6C4+rzchrz>;A?{!x`?J#anDZ$Q>{xTz%Hsd9u{{1F(vICYgn z0XO#g1cpUejIjsSlb6Pee;bw%0^Oo%!Wp09pB8(E%7?>z*)N!LD7S^MB>W}*$X2h~ zjMsJfcRpZY6M4VQ=PRhk*rK^!moSj4{o^0!MLrZ-u$Z^c(hookX6gT&6rxIRyT}fl zdw;(FjjPBr9xiKf+O=xJkob2Q^85H=1E)~m_tQ;n54K==5hmsoQZ+UJ(p^{c?Y2r9WaweqU!qC4k2e8HvRn`Yp!hO<=Ll$cVm%|Z{M#=^mR z7)JDksXQrJ1dlA%u;}ioCuyh``}hzh#d(*a_2iSGqVn0)0oW+SZsO_BfFwIWq-5WP zWT*@GJ!futBmd(ml7ix-l!a%PRTpR=N_M)uTrp;k@}tp0JeIbsYoHZQrE;gZ1J(%yBbtytg zOJNYS(uXEO=#;>#A)53!=R47CYD8-=I_PKfu@X*lFH=L5)u=}q))@piHR*v zqR{#wN2tY(8GGzQ!aI6?T}O;b z3})h46;*+0C~cdrT)!9EXNvld%d_+j(>3z=gaMAYFAw45m6NO^R!SM&U0;-%*-On# znTT@__#au^#aJeHC|FX1qprxbq6>gOk!__RD6WKZUU zU&`c=pE&jr@7@fC&2N(zOME@7LQI5)_ghnEvuP~<)lD^H4+qUq>SqD|N~Q3l#}Nd> ztI%bEE}k)Oe<_S^cp)Oph&OT^+8qZh}=I$@v-cbb{8IDHaDywo4 z-v-`)^9{AIykD!E3&InjsV4!x5dhQJf#2~t3q{EQy#2=g82wO?DYSXJ{A}kMM65!% z9x+Trqb_GmSD9iuI}(YrV12A+nuIeZCn5E^EFSIbn!_}){8e_*FaB!%2Af`nEH55Z z?FbB31;)0*ToA)!V=NuSJCb60Gb=N6%Z@bO4@ev?J|glg#8(nJq9Vc3@28(H(gS)Z zmlyPEc#TJv7C~r%?qBHNuxjN(c^mH44h!JTO>d8uG4cBOSuhRp7OU02wwZDd0rmd? zbLxBA$j*6X+oYXsyQbeyA)@qo2RxtD@yDDlcHU`nSQ{|mzdqSde0{;ARC(~V`|kv7 z-^!W8XnnI>RrndRuL|Y(xWm9*8IA7)91%)*wPQiOER#Eo^>FDU3j5}hshD~_;8ML< zP#l+BbnhmgMN4EjO5%Y}5|N~+3hK=+3e_N%NE)DS$dI`N4oGvWDXv8EMgWfwiWsy< zX(&-qV(yMkSwnK%xy|ey1D=-7BH_srLJD$0psq1|jI@Q)ee%H_vX_wk_~lW@$4IGx z;IaDy(I@-YV~PQ-Yw8vrxD~Zni3B~CVdpEfOn!7G_>z6Ix7;?8Z=aWX41yyZmv*&9 zGxJ3L$`Lz18P$)Q!yiyA`X))I6c^cz3A8}Xf9EUXayae}#>gqw zfy4`q>u4)jO^o7LF{o`U)FqJ@zAkH(GYCuMRu}m59b8HiNvNbmKY{ahErua1vL11g zDt0b6mH$w%222Y}g!I?Mw$a%U;Yz`hln>e5v5Gky8l>9uJLy>j) z2;-B*sV$+4--O|_Rcgi3gu0ih%|+(VJDtuRr*2eeW2m?fI zy2&blc0>v~_dK5c_HM&dQ3wWX#f9MgQmm`Ah(RD_Xx^6t`y?r)^eht5 zZtuKTLBpX}p;oHOziE9sev+_)nPzFTNOmI`vFq3AZ$_lpqfVeMZxe z&9uL6LJ^5;py|kj~PoZQbh-ntUUBxg49!<+OH&vs=T{M(qd6hY2RO^VRqQa z_na)-Yt|CV6N*srVcpe#T( zmlrI)IT47ZY=eV=B)X7j%IZtv<2FuLlD~MOU8w*SQ6UoCi0?PzPGRQ!@%ZIQf$~@G zzWv=35ltziu|0e9_BB#I+k{B*bKjW#&HEB`Pi)YuN+Pl?U=+6YY578DLFM%2`opcV zSh!Np_ZgNvSo?-1Mh)b-&@-8O+Ut4enSZgh~;qyz+ZzfsZF zgD;c9QWgs_pg?`E14h=WTH(UVM#ZrVUpgZAvLL(OK z?N74z*-NOH5R+n^_&PMA8{;HykQWAu$^w0zk9peiZ=*kF_%T(yeac@y>=#tIMUci4 zH$4y5sw`g*E=~{rF8{CJx(eKHEtgbi1I^;igqLp2qCgeXPR8`oVMLDaUVn)EQ?=2i zplwF~G+O*G*1~2yX%v0&cBWbBh(xlE4ig`TGwBuid?v&?T+ne|@ z+k!P%!s%tDkJ(rv?bN&Pz8&Zu=Kv8m-z=$MMKy*|*X1dYczcwgoFzKyN&Z8)!4;op zL*Y4Jiuu=+AF%-B0kVoMk|=eqaySP8r?yJPppKDZ1wC;Uey&ftBWzz25M>v$IAgu8 zxNFz!IIN+AuL^~o;0}9Zrwm;q34dB{IhCEOS8 zKlm0yCyqs#n5ap~tXe)gct%bt>50N-RJ{eWn7M{5sI5lp9Iv$wv_q(3B5X_PH-QQy?vn(FV zqQo`DgxH;ra8X(6?TN~x2LJ?R~6fo{S6yn?w9%B3{FucIMQaj85TN~Qc;|S7lQGaK7?p=Lq zHLh&}&Ad@f9q1F!-yEHD478xi#2xU+D@V1oMw(=5m9Yc2Wxb%r1`tV?>=TfxxRrG9 zJL$8VJslyziZwnA*uPbnZ{9&jMb@4qN$u~4Ynr30pn3%v zX~6hB)Mz-F4X1D`58WJ-+WTE~BW$N$XQWJQ;qS$hZwUYRlZnG{HPu&sk8~*yqOoNn zgrNMGwbwMHmsTi5VZ5ZrK!?Tr_OB7;bd=t&u16Pl(VZ;1f4H@aKf<&i_x7!9cPwQ@!?IApc8fMM>a z+r;hW>wlX1Bt0@eFJn)ntj7VD9A3cYywzL11+}Zwg0=|#DVDYmu;Kj*tUZ8oSG#Nw zfXmG^LIGn^q>>eZ-}b>>&m$A8-Dh!3^|RGhoBnc|S)af9gg81oc@rl8>jgIk-oS7O=6gB|GmuAzf{Em>!(%yZV##VE|qf9eL=J00}S+ zyk9DTWHdKKEoj#J2;JWmP|Nc|mtk3{-8|j=!PUmS09QO=?H5qUdJA5+LKB2=*&2Zr zAYyVtXVv0C^$Q|4`b%>Gd zI}Enwt<0UKV+;yeAL1h8JRK&ij@PjE-pzlekPFBWyCHFG$8oV9P ztac`T3JD{*!(t*`dHLBlA>bAi>r~`eNx>yV1-?V@@niMxn>0-I47fA|T(Qzbr;cL1 zkZeOfH_yZM^fVJ3)OiW6L35dYiLr>vyXDw4!o>JKC0z3?)PF0aoNaRft^~de1m-K( zbpQNaw0*wQsi`$RPL54UWhAtT$Mek%>GtR|uk+dUjTSWKKA;t1oAl>q@t5dB)B7bN zW+SATqkzs-V4EaG4!A)mTsYOZ7$=~2@lGBrfn7y=FdB~dS@-Vx9xDkrqo3@V>+%70 zrm;u@xLF@J^DwPH0=?d!{=P^zv5Np90H;ta&ck-?9i1GX1=(hdQrRIE!;znDFd}_u zt9wt^$-%#SCk40jBu9rDx4^j!URhLF`JtyIpPrwy-D}6xHnChlz``RKvlG3fM_9e` zS-P?;a^^CQ!H)PEnWFlqP_-1T0`vg3s}65Aq1;xe|MUYl_UKuPOem$|+>=MiadCj_ zbujR6ooJH`VAiSg8y-#Ja-Dti zGzczFU9QS(1Rj1quH?WoOHOv8-A~d>-7q$L%r^}~V&@2NeIdw$_H*#=>Dnt=OKS+a zBB3teADH?%4(1wUm5pS{wH}8h`GMb-XfJ-ql(e=9MbtBA{S{dJq4(gSs7=~dQK+_d z!=jOPV-IPYVxf0>Bo!}WWjW^Ap|x3vQEPrAgPn84QH?Bcv>lY5l11O1!z*mA&978} zQj3nT@~Ja^S|b;d_yji-M5@?fQgA>yD(l=qPZOpWFdE8=YDlVS(y!&!H`FbaJq|Mi z`!LU%C7BY8fIk;v`^3dOf}5zDRD&rSz2J_$R3t_HLa?yJi{+pRk6GNEFnIn4Ml}%J z9G@7Q&b|`W_*-?_*2VB_gl@rYbFksRj9QYFT?8S$*M13|zip^B16mvb3Z0eNL|sKFD>fFHXF|-r734 zaAY@w{&{3biliE9v0}X(xbJ}_aBa;rFja58Adq1yx_c@wrRZKq7%dlkLl;ar$0zds z@bzPPt(_KEPMF9@nat*KIliE7LwJ(n*=K&>;(&4&F0k*a_%FMsw7ja3Q`LM_mZ27GB+9IqRx#} z(luRvXyt3TAqF*-M_=+kCaAvDmyMWWlz$Dn%|l2i#t>0S#}AB+{9S-#X{YNTlrgE& zvq4k{&YNPzt@55)38X7`CE0y zXm+6DKC5k!XLP3s$lO)HXb{WuDM% zbI#M`hb!2=I}pAQB%T_jI3BH$)wl+?-j8Pxy{bsr#-nnaF$7LxMoSv|LSjmWO_KWnMh%2#AkT@?xzqW|Z2AK_|wOO3GqK0Q^DL(MpA#pTd&T zG%Tdd)+&K>aYYgw!xO3e0dsNcr7Vrclu%l63L(`I2zEnkL$Spm80JztjiE0UX(1-8 zIM2pOsi~0vT~$PYYN=Fp9jgCmI|2U!oG?FiQ)~|R^gVYIHPkXNg8WjE`H{n@_Y{|_vMREfX|8KRi>=n&1Qc(yp z;#QR;_UN=g9!SnSY{jV8^sTZ>LIPEHD~GO`#_Bi8wE!_mBo_$AV-b0+}rw(98j2>2EgNGjgmOAu=8GBy%U^!gW-u@ktE9MT>s$g0qxhqYnse&9w_i#tR5 zS)?053r5haeU;pw6m8F1F9WPf_RxMU0x2ne0z{(cg09I|Fl1TA>=%tq1uECataOp} zSeFf~{qdm0PUR2W>T|Ezy?M?bOurV)+B7{qtAPFGh;t4#x~ckArdphqi3?v4Dp+Cm z(8X(v;R>k?yWhNHOQ*XB_{C+0HBQHL$Dq>=k5C+qqxREDCq>X**Cq4I#>@PEs!)X? zIMAXazLTb(md}tp|pj29PWz#)|@BUu1pPOQROBll|)vnyWAdGt%& zOCzUFBtjHu*37=za+yQL%u`DcCEK+GCztAk-yfx+4KH2h{#}T$Jjz9*tT@HuZl=Om^-&HF=$E)49PNt zkLERLr9Ko=J>`Nbj4BM6)(x*$0O1II!HyPGhFkCn>C2aRc%ctf_PY zA(X8@(JxUL*=jm`$cww!E$MpekIT6h3^}Y!nREeOr<+j}b|TIG28#wSoWs*+GxV|r;elm(#5G|+`!y0L89UxO^WA9V4b|)@Y$6 zbdjUnOfej2Zj4sg0i~t&JB@atDY4!Nw(O~NRq>qJ5pz|EWbi6_Y~{;yuyle!S+OIg z_0g&pIOCSOr<{-Bsvphmut|pDD_U0w>i8UYJLp8Xcz0(HsqMx3+mk4z{1S2a@AXZZ z+tzZpUFbW_LxKiuup9&Ag#T=uEF`tlQ!B8EP5a>cDh+5ZFo%30 zT}ktobxsbKoY~J$Ju)g((8(e**_$d}<3oC0&|0EN{=k_Nli&Ks`>CYZfx9lu0k;*# zU_@ksvMj;)k*9{E{X+SIbWIEE^GQjpL4;9S2(TzsT5E|z%E365E>qI$lnvBJuJtcj z3mcP&->Y`#ti3Unt^2%#nN1NLSHTyCBHwNZg6i2Ug!Rcpw|Rg85P?Jzc?aJ?j#bny z&T=R6JL@-@|v*;cBHA0 zFytB4FQ7~ZB}V|UTq9!6RJ!IMs(irHSvy^za)>~HcwaJmj(h@k3*$ONEBbB}vvByh zMa^Cx7tdl-hNrC@FP34a0HErKxY6494ZJigIWgdfTT|N^8X2ZaN-R?-flyo`a%NvJ zI#?OjbiV69qDvRG{dCwfjd`VO_yD)t#Ve`k(#MkkrI&-_FUPG3{S!+}>>M_rw89?5 z%B-Uy#ntY)L|ET8+~a|SW4v%s0OCzUq zhzRIfj|ZF}?jkvujx!eRMc!P03UUIkA^u!A)$2t!y%l3n!w$|QaJ*4;AKqMMUXkD9 zx{46$bAtHtxjr(EJXJ?9EW>71&@sGVVcJky@G||ahjOmBRqpfpc)jT#^x5crPTxC< zm6>h`Q|F`0fj~cn%UM%4(zJ4$4mY9;@V>M#{)tLp%- zaW+$a+%T76AA>{sy;)VElNrL~PQH%T!kPjgDA7iYWoL_`e2=~F-$fJDJBeVJ7$zSF z-4BIsaNI_2cfe4w_?SnvZ?F}MkNg~kJI5-&n_G7j(KurS=|)d$2}Le#>9h+o3(Wub z5`&{Achg1IkZAlfD@f~ZwaLL!L50v7e;RjvF zfh79HEIwBVwS%3tPZ9Y>mNF7ZrI-bsd!U0*XS#y>au~ClD0e#0s7x(#sE%qZ?}f?` zySh7Ay${1Q6`yix-k&7doE<4;f_%$|TsZvQMU_x=L zqavgTfo8ym;3?JB!dLI*iK)71HYiOIrPyHKADn&QaP!Six`4BQxoTTCw^qxRo}-fZ zSLwKe(Q=+7WfC7m`M}v(cirIWzKewc%F&H8gEOlCy@hpXNt>&EDx*!?&$> z@Td#M;o9bg<9c4=(5dzR+j_Cb6{C>q{{n5&{T9y_RHY;s?;#RV7ar05`+zm5DYneo zht3v07{=C>lHWy1&n!tvmEj5v6=GrHF$}Kw`_mKH+&6$OY(-LTWcV4I@8>XHf3k zeoWjhN`TAuEk!}hQnXqvl26noF;lS4ZTBjNLP(rN~cIdlB zoVM67!|de?Gdfm)g|}2pGU;A8Q<&`8a&k4V`ZBK8W(L{?bV4dbnR%s`Ui$U%gAEuTOnR%rLi65Z?eV-LV8w^4pI9KfGE~iH*34`|n#kIthOw@l1~3=b0Uq^|0R0 zX5JI}sYlXmst2yFH)cGWw$x8fZGyoC!;ht8Z!!4$)Unsv4+_OJ8gf|!hL%9URP&Fi8CYt1UQ=p2S2f2dNq0eVi_ zf!6|YN6|^^P*pa~97-cofn`WOCqF9I5om$RNnLy`-9@=yLOd0}V7Nme8T4m1Nmbb*GWY)A@ieS~wkoSH zNK+c6;(~!1B3UL%)$<~aZ^@Vy@9+_c8eVJf3&auk2Sb@YQyA&$k+xj;uLkSL?t@m$ zc~EBP72;baQma`r6pn8u|LII40CV4w-Bm&kDr#N@2FDLJw2J(Z(pow_>EA<;+(f!% zwLQCR$zNP=>A1B(_?8*rok$ci6@h(B(~7d#-Mp(z>1tniVM&IlObZ8)wlcK?0|mS5 z2^3>wU`+5iqwhL$h?Gk z+7**#<|s?Yh_z-UIwxhbc9D<*A^uLWlm_j#)GAAjJ-}OSLN@ibOEfO43@^G^aK+d! zh_%-pW=`xV2bl59@OHliu9CzMX$ofM9Io`*3FOv2by$Z|an49UUHeazh3&a-lKi`T zFxnbJMo~}+HXQ7c0J%9ugntwgc<|rm0v|ijA^i#YO9`fx2a0B^M$OCDCg@QPT`e|3 zx1TefLeU`vy@tW}CP_^ukzDL*Wi;Z}3+)4_)^xOd!$Ue6>hNz~X{K4ZU3K&nX>yb^ zig!mH%8jTM7l|*;5J{7zep}*P2Co7Z)7a;sMp!GzWWJ&mb=v&dwMbA44i48IETOwR zlDnJ!$$$`vnGT*i%xD)BZZmFlDGvf|Ze&hL=_X34*j(h@l#U4YP==vhKuHpDg|706 z=pw4ZE4TX5Xe<4BnX6~-ow*5G^zzQQeO&HHc@6 zJwx;7vByZp7ZU|>Q+1T`Tpv`+Br>u0n*Qe+2=RI<=PyS8N7GrxHT}MAm>4pe(JhVC z7~M#Bmvl*YcQZs(e2K#c~*Lj`C;fC@x5AV?q zklJv$z2qC*)T7i2UJ3gaMVl-sZNs=sfR16-wgbf>0i=)H}ABHDn$IA-BAH;A9h>6t~P_==JX0oNn8Ugwu%7@+KrZ55u753A_t zEm3<%q?FYi?pc-wCGp<-UggW294a$U^YNkpo)HP^nWs%pI%-d1kB{{Kh)@TORzC~2 z6;bd}P){Vcum!>iP~ObT+SLo_q)8r6gJcUTmd;rdfpcKe+hQyd*wVx)VA=oV{B92| z%2nfvipe^d3+p$qPn{J*0GW9wfw5lY$;lQD=lmezxqFV?r&Ti3*q)p3)$WZfhep53 zpQ@E6%_v412P=O=Md@`cW+TdCCi;+ugb7{g`rJyy;~A-iB7vU|Wgjv9@9cveD{MHl zOy5bP$-xpBZKt7V6Hyf_A}2z>Lo_-)a2~(qN{e-*OtB8k+sQf`A3dBGcK*Fnx*~BY z!Jot#1jmkL{?nH*;Hstk6m%tl8QmV~|_dPZ}E*?eRDTKif&feYV z*X-ts%J}+(IREYX+v|p8O9rPXIu_uho!39HCY4;R+P`fvGpNt@rx7Iw%u$>|ggZ&~~ixnRIL zG)CAtAgk2-wNq57wA(Uc1YhHI_1A?z+jT<%2$7DcI0NDQteSe9H&nfk9W{=v|26%` z=qKDYUKnuI>G^4T8;+tTr|UKzz+_^W&H{3FYc!?F74T0IKsV_p5W)QB)f~xhQ@tATkHMEuHi?McR2-| z-?5VC@D>%-9;n_2=M|?TK$;En;~giK5(?lQtsDp*#udVj*7|F+<~0W6?_Qq??-fy6 z=gNVO^cbl)IcL!@1_lN(j}f!Bj|v{=-M3VV)@jUBYD}YLxu^&Nk?l0?P$smp0)0Me zj?iX4u6#-k+k(Tr+SwonP3s*LVZ7%0xYj8(=!R_Y-%-#(GwFY>*2Ww{R(!893!*I# z>K#fxI4%nONoxphwAA7VSf7F(FVvxTJ<46FNWy-&VbX!!&W{~Y;aa>p5bGfn)NlWGNJ-!erK5&cSIDj3nSV1MD^ z;g7LOag||}G@d_!F5RIV+^7#h^8Gj`*PqdFf6tupyDs8ZfF~Ytl+_7nP zm^}*t?h8vP!rZv0hc)6tM^dJ|CvD)j2QCsH3AC}nOEbf}x8(G74s-si%?GtabX;{t zTITvO3@=dg7Bl_I+CQtquZq}LO$Pg|mZ;W72(KX6ebACTBTa9=qHc+BWrn^1}u7Jc1W z79Q7Uwu=jbZ>8JLJ2|?WR!?ZhPwjK%!~YlB(HV_aGdtx#AH3=V^0h{bEyI!-6$$9q zxe)$!9gKUh^!sz0u33G~G!5=VbZ7PAuj66gP~`FygUj$tJ{lA4eeJlDuRqkE%w%gq zDcfT#Y3^|%%d>5bU|sj?_57A{1bilJ39m-mW#mc-QqB<)E0+-;J(5;2wX^E=++=8RZ{Ht{i!gvHj4nG82=^yVr9c$2(EZLyR zRYoM?N--odA1_tl2#U%4X8_qX>0YmDXv!9gco2Qa1KrQ%UmlUsDu-BPrH6gNAoeXi|O7jzvC zy+V#8xb{$M#chg0aB$I#wBcCCx8 zzO4uPxcR70t8A?fCF=z_p(e8vwac|*=HumEC>x-B1}gfgs#Hmbsw=Zpn$Z5nKttRh zaugba%bqYk7?GPFMB#2#&fgcnwi~nIADHv|N3RM{#uvAe5v%jI=BCL-b$Ov=dN#3AYB`MFql4P$01~!@0q&*Yp+Q zYVuREx*6$VID0e=lyM{v4;4<{ z&vA29Ii*STw?1^yiFJ`+Poe>9?P`_of|N^=t>qmr-SuPTeZuz5DIo7a{A4GHt zqh&^z`e|SS0MQsl5sfbaEPgd#d@1W1-r7sD#BEZ*7a##=gA1OoYUV3GLgood4$Yly z{Hv_CIvP}`%}B-8q^n8Zg!V62nHbyi&ikJ_?2*o(OoU~Z)%yqxc3uA$3z>yifT#4*B7Ei#bRYaSQw=DpNZNiGI7@J4J5h zU7WO-e7;Xm6`ap`PfzOhqJU7zsSa>0E;5WxEaLV94RgWs9dU@X%O_k)Ns^oo{`%)@ z7Ab?`_AAEh%i*QO9^w5$Il)Kri}ONeo@O4VYEGwOy?LjCNVE+WPWk)p(zNr7O9mf< z8V3z_+Kz^QHk*R%r;@$q@5}|A5xwmGtsX2IL^J?vZV9&*gb9@hNk6A!t)Q#c_73|S zWJX5LG5FmqCnrmM53LIwlJ?h>FNjr_u#ljz0M?xaN&u``8bZh*Q=*~>5dgG)Hwt;f zK0lTtbP_+nR}*?Au5sa)7A)LZUf4k^Ug}KQ<_)3HT}H495P6`QGhE05hKf*V2gBOC zA$Vgkxq~U$p?eoCE^Wc{{nJG&m^3m$V=FAIPJaNS892jn`}^N|_cx~RUuv%QISP(f z?um=aeO1F_7^=k6)d3JrYHB?r_AB>TW+Z8KiEwoS=0j_mcPwcm48S*v^mtcUxZ>lH zhVt5qKzVR@XvpaO=?i0OdT+q>kF6lp#p8z@4(p^>dCFh7JS9Q!=SKIh(fWQC>=w64 zw!lPaDkQSSjUp@?Es#gSz} zT>*#sq_V_7d$i#eR9o2qcjXWb`v8O}wfBq&wyU76N|j1EWLa)S7{~K~BL;6K!cxU| z)r=nuIiap-Vx;(E)AKEtjARvsmLhVWFx?+?&V*O~aOi zJ=+Id2jiT+J{Ot}=CYHcReny?1au&)veGyIxX=EK5eiXuCf#g|0%g;?V=VQQfUzUZi!hlqr_KENSACZ68jTDPZK7a zZobw9qaas$dHh77`lQE|>hh0hDf@VePy)Jd$+s=YUwig7f85p>JHrNUr%ab(Qj~om zhZZd@^4$MfiRu7f#_Iq^;Y?Oqvv3BokW{m3ZE3lCGzU+zHXtoW>Tnm)Z^jmVm!2)# z`yI9;D*YV+y&Kg|aPfDUmlTZ3kQYysTD6+2z9(KU@{4%A_Q5Xh&$;JAm zik!P&Qx@lh=#A*?((usZDu0~J7d|FtoJ1Bxq0A;`N?{^^o2wcb2->1Gro-tNfmmi- zz*PmI76e(`QS(TaB@jId;<|3|#K{O9z z4uq7b+G?xDtLnU%(3K0t+u`V^63QJkA&T#O=|^%DJ|BV}0dB)BGn&ZYm-(c~2vU{z zEmFH}afVi;kP}Js7ORn0z|pwc?aceHW6RrBHk{ym5SjuAwvVHF~>^j z+(8v`VoGUvrejq62jN>$N!I8>SkrKn_-x)`2g;>Jd-1&L%z(I9cg4J;VrF$o9_9?0 z0lv+PcdYu~)(Xt*lITyEqGnm=uuz&zS_LVXSxZOM`1uISO&XniA}%Qxp~+`%jk*d{ik zy4?~R814L%Hd?ajvI27oYMhE$tBiQwsV__V-JeI2n zb8mS-ddKrcffHPwl#(^+mY^6;D^IOsDW4P0{4LFSQUaxmhAS)QfF$4D(;`C6gmK2A zG(RoY3cSk(^UOBp38O+N<&^sFh6j7dOD+(GGmWBf^;SPdQAFGI4oMA%D=soHt`(G7 z?BOmUZ+iaDkDuyE-b^Ub*%i^0M+24CFxWR+jE7l*W>~0!36fkb3$BB?$&2+gBwo^1 z;hl-*a|E5%KO=gDP@(REF%0@!}?S*`)eS#p*(=3@)A4&AuU>R9du3(h%T3 z2nmB3h+&z+&_6dCJlq|lCSj-9{&S%;sE1_x?CPv2|>n>rCuTwnU zngcR5Kj>%t)@-%0@dTi(HRRXd8@b4n0<%i6k~{? zxS>!98Io2V%vj{zHqmhQ6een;sMYAmDN8+mrK!V1<{OeGg$HHvD#RjCVr>7iRCp1Q zst|G%9k%y}DJGeYvJ9UzTthygLudj`aCTO)wK;6Lo2Q1qhF9@-#|-DvdfFlZ_5>7_ zlUH;}4&Do?_V@ho)ss4CT;MK7TPGtnxrgUeIZ10&!@h%UUp~#so=dj;W77O&8z5#O zWANFoXdl6hDEJXwGMt+yU70#js+!zsRh9vLNds$v-Z+{3_ zoDH?7)TL-qj&rIe74bD2lCT}vk?%twbq{kQc&k+n-68hNJQG28Bk-s#vRjQ4cQE&V z`;Ucjno!p49ojUSr(X>^73(-aE(;$E1HeMYO@fwXm6l5n@<*C*U7AQhd*5I1>=71v zD$tUhJ2m7fY;S};I4qIMneVQ=^e7-(z2eFPK!kL~_nW6VRG^A^Jds)7L=`h5woTc& zpgZZ{JYn9p)a@X@TSVzW0jPYCEV@vt;7i+Y@A^xM zQ5P9F9&9~S?1XYcr&c2cpRrn(hQmTL&^Bs8B47!YZ2+4A)M|5^4^+dGQw&OpNstTsaz8TJD_oUoMkkWLs;cVbBpcAuP38T~{#16WQp_ z^TGPO25jP30_Ys099;&q@rzDDH-FI~=0wrWmSn~!x8$_SQi#Q2a=OvM!P()f-I(UA z9Yyv=Fhr9fiS~8d3f=vbAGr8YNd5jxbdU)EW=K3Evdyoloo1M-ZS5+Gz((cN5X(a0}L!Wx|VHJ6_2Bpz=oKE&}c1Ue+ z#q#JA421vdx3eH~jcKHc*Aci)<;dNXLF!aZ*3xX0x-&UGX!Az|ZV?D(KRhjL_((2E7FfHqX^fMk zVx*TGmTEw?d;U6cF)+cdY+}8)B^o{T5IHUKejuIQY8~f|?fOH*ZxqE?Dh0%3Evv+-EHFTP z+quyfdrLj$C^V12?{}B0xhEyI->E8MWCLOa7p6E;>`Kqja&1>xy17FV;h%S^Ezx;I zIw#RRP|^*nA}r<~{mPVBIZmvh=ijbH_;xpBUDsO}F7ynF6|MMJugRhScK^(*AoetX z^D|Bwk0GpX*-Oq4+s#guF}-0{w$iB7fz}#ZThqfGi1R zD(O%fVx`EwlUw58U1B4}ZXCaHsbKp*0RY6(CA&(Yw9T2lNR91=ah1%ewVz|8v4392 zA~9%4+OK?fcT^U6*PHAp+?mo_R;}JK_KP!ab@R~e500?PY}K&CNPTUZJk1h^@lr(> zm>As6=0+tTHZn#m>Yh;cqgveN@ssc3&)5Ev?&itMrV)1>&3o{CX0X%>6E4Z6db?g9 z)gyfLiMvM6u50@73MTAou*ZVXu;SGBUSylS>v4}`?2*7gy`>!W=;?O9?^ovaWh>=w zHmy3@jP22dx#5T^^>r0d0$)Kv*7fr8yyvqU;yK}r|Lq0Bn>oosw^7o>kR7Z`+n`BH zV@f)p$DAw2?wJDxW&#x$-ms}?YCey`Cb`29(k?~oN!UJ?eB-Q+^f|F(amM> zCAyEZx=g$e(JWG@gr2Dj1|O(sz*ER6csQ%6m8tE0p42F<0Wpyi&J@c6;{F$ac%F)R zX09#gZGJtYfmy{h~nH5MEodh|S8HuR(1xfz&<=O?sdZ=nW z>A`nr{$FHywVuu0e{7q>;gtdKcBggYrd%5N9!gbC?=fDg;Cl<3=!;L>_!T$Cf4BTm zaJ7jZjjB3FuH2FW`laduu&kR&R&T@Q6|Bm4-I~)Ej_!=K|AH|UsO=*1 zlm)Ws6mpR?fU5JtGVbn(-j`(y&3cfQGbgBHzk*ZMXJq(;bc4lZ`j z7~hDGWty%KK(_Sb3|TIvVo18*K$Q16MiUs?}ExwORQi$|J4 zmGjn%yCQ|GvHd{k5{E#QOqQ8E=7e?=fpSA#wW#&bcX@jCFT#@q;tqS0rI3Er14fpr6=} zzq?zCVdepNoq^+H@?V{+OE;QGt4Tt){+F&ZmW`@KpKhnR|Ni|633it}Al$As1Uj(j zuEx9x2&E^z`s2J&3Fmh>)ABR7KH+M95otw}U~v4hVmT%BX%XJVa50Q2pfDYcy_W4~ zk|I36I^+o4#lQvgzaNyWoN>{u9__Uz!r!{C%`M+Jn*DuTc)f`0x3=j(aV#T%cod0w zA8#Wv6qnsnH>MArh!GK8e&%d8!mbJJDEpn@5?E?gl3FINuX4+SUQ_UfiWAzNJjM4=6E&OZIV4 z2XhEbFiGTxZbG~~hB8Kd#GS1*b;Bn4pm@L?H-6fr4iOoN>mb*B}2rhlym=IFu(iDetPGR1A$Z2qq3TxM4b z^JK|WnYSww=d;TT34ku}9JI0rOD<_PT3X*n*n-4)eB-KMhvkI}kMbahK~m8z$z;J5g6EN)9GlqjX0u zXq`_~VzC3aEEwkR}u~5x_!HUP&B%GU16S&|C z4HbB~9Bk%K$`nSH*RpU5g9)$sJYz5+!UA3H4Y4PA$@|%UVGL4`N64)%sGE$JRCMqd zoQ!{u#$&`@a!pLrlfSkM_!I7)$RsQHR?rF@j7axjR0_q)p5t(Gd{b#GU8}Ol;a;%x0t8lCPzdfsFuTF0=-@3}z{%BC;kwg6VT$ z#4q7%S$(XW1Yr3untF@S4DnOEXuLl8GH%+JR#oCe$S0W3A>LlMod zjs3zRQab;pKGrYHZgtgN6Y>AtP_ulFBaxgosmR>VOY^e}ht8YM zXB-a9Y~hQerw)o??G-axE@)A<1BQt*!&q; zInqOT^1Q-r%Ly6+cdzfaq|P`km&;&>LRAjM}xc&P8$uv*YNQ;RE9(WQc2mD?BK~D3qG~tJnHo$W<0DVdblfK%5Cn@iwVAfxl zWFwM=1>fNrzNFS2obnj*avb6-%@jEawBatb$#Z*yfc;dFw8Li09qAD0*rjp%`&-C= zA8zvYc9&CcccN8YuDEHA%t|H>e-;3Tk!-KSbQhIV3`?nh zUFYLSWdX;}P^WwNV|pljgGptA13&inyQ#*HW78u9ScXU{Y)+3+k`9XMTV%ntYkY4= zq62gBA=fBzJwAmqybdS&{en+g7U|Qg_D=kt#iQtgN7omnrg(hcEFdw6i75#^`0|C! z@P2!jGqFZfvXFs{DOtGG@GPiw3?~P$DjqEoEzL@FEcO1os&E(zKz}+_3)x6kvY$BT zOTD7rO!cTcKrv&g#%5BpB zlHmuC8CdzG!%`D$(zmihYNU65{v#CC*@5fTv;k#!>%~jw&*$|aujiZp85U|ad-7O! zX$ic=FiuL7mo}W`Fb{LMmeHn#19Vm-9^uu{)3^U_-@Zx!1ZbWlW06ObS!UkTioDz= z{kmndiACiu{5@?0{`%LQ_gx5O^ojM#`MHorS6llvHGU7jFtCicdr+i8gFc#m znii9<>Ab1i2w|<%BB#rzA@bK(ZX6#IfU#ZjUh`^ihWhki^=5!BfI*rh5`X3X6vX1|y6_If<8>mqXa)x)6V0y31_Xlb}N9t6?%ryGG|o`Os(R8K>z>?3t*PJl-)-w{MkcTw$Qo%qPPmtsvhk z(vbMd#xe#Ek=Oi`hA0+rFni*|S+Z}tcB9B^z5Fq0h9^TBsvm>;mShi8%=+M)t@Qv* zkqWP}vCkc1MAu$9LMvceyG%0LiRyT7e0`sGas&3yKZ9l*OomKrE(#F{oCF7=g+uQ7 zL%6XH_L;aZ^*N=Hr&mWZ?(Oe044nsd36}gxdXhabzV4uKBoje<=e(33H+gwld=iSW z>L~a`$Oj8Xu3ms0=SSXYbUSWaGQ`HqW9f>w*mbJw-j$W1*b%)^;|fKB(X>B>g0}Bi zROcKiR1?2bUW3J+-y%gumX6rf4I1i1F6|)DF-v1>y#2SWLBp6o7j)&3ucul~?$UER zp%&aka`jHR@}HM0!q98u)+D`?O_$GSxf%`|JPl!^IM}Bgjbu*LA)@T3O7g2Y?mP|e z@6c9Ym8LigK);6XBc1N52Sn6F4#_6Gz@;dCm8P59>dl$51-@8j7|Ae=;?K~qKLaK=*rwAH)FL!L zHJv0@I5=(JR`D9`W#Zi;U zB>y<~*NdY=CXp;$H7(NYgo^RJAIH4D8OtRhg=e|QhoU+ex3T10qS`G>I!}nm9JS&} zD_|)EiaP0JYV$7AGfNgT&H6mDYmd z5nliq8kb2@Ut>3afyfZ%U6Bx2&hsoNRe4JYhdEm&aYKGv@mvGp8#BtB^y&gp^YKmZ zxIFzmZGi7*;NnViZL=VTj9$w>AP7c}BN|3)3B5EAhuSuOw1%!bMP1uR6x3M|dP}b* zh`r@IDt+!Jhj^G>w0MlS1NHC{`%x_8h6DZgq%tSFG_+D%Mgd87QD@xty1G3gMyand z=Gxqxj(eL*DzK*!Ew#Du>jQ_hc~Vs^+fhVKjx2(^5wfsd6hbo$|JQwGcyTtVe=n%x z_q6_!QohD6P$sR~Vxb4ZqOT zKIM;uaYjNIb+UeJ0`L&&D^M1J^VJLLQv1SeXog&ap4R?`H$Q)+orWcxn(>rf_fus~ z0rJA7nErEZ(m8RhD#0ylQ_)#&dP6Z7kyL?8;&Kvz1$jzFsJ_M6DqjFnaaMi<_80L~ zLJ_*vc@H!njQ9>TBb`c^`?Vq?On^v7FJxm&c8#`G@ojn%R^wCeGYy2D5(rI52=jWH z|5M&2V8oU(SW@7!GzP{XBSej_xlcV~*m*oAC)3zvghHZmzYvYrN%T>6*V@0$OB=G* zfJ)XB1A6l`%|gd&Zm|*M<=YA+km?gsk|>ys=mSpS>+aKgbfUD)guk4~meSC59}-n4 zP4(iDl;6iq!IEv4@vJE&MyZ;KAX(*OvB@Cy?DU!?{gkZCC{hiemuQ7ZHD}ePCtB=6B zr`@Me+arrJl;|>QAd24rC%=LQ%w*vJ#53=rh)S4v)Zu&>zNl zmatbj@G05zv`VTUP5h7;X^h}bKs-k>1opsV4@Q&%bMEpq5?Pb+*(rMzzPKLAY-Am^ zX5r4`%UgeFZAj6Grco}Ym$#J;T_7#*vEoGu*1Czkot6Gf2mB$%m*%zf`6k?)fGJtq zJbY^&@lTPaB>OpVO?y|Xbq|Ly&Qem0lG5|)9;iL7i?wxCF0s$dd3%hpfxWOO4(p$9 zQzqe!>-le0F_wlCJzE_v`g;eZUB}~KT}Q2Kn6E{&>wWj3GOGALeLaMRrMAC4`(NK= zbE8N?^%1ld%YU$86)JZRO7d?p%-G_mO7Gm{2P%@mxqMVq0a2kpEJ#Pjc-)FfY1NW6 zU_e!;&UWKs>u*L?JdKCn!lOz9_1BWz0oL2Uh{GtINB(2ZvB`G_CA%usW3%AU&o6$V zOQys7Qt>drbAY*)>cjO|aG+Myur%d&kzB;Rw&|Jiu44taXP>wdf+oNpF&qR}^U9RAp?+i>{7CyBHlHo1Na%PP zZgoz`kFmr8WmH}a=QtEpY5%u9e)zXxgC zW~HA;6~;I*m>Jb9%Q`XiF!%( zD>xv<%czDZWcnkF<5D|*(Z$7F=hIzHK3a$Ldk#WYnq6{OsL(XJ(+Xgi2wM3xmR*F? z%t)~d2z(3zwxz@FSZ`;}i3l7`vUuaWF2rcnfYfli> zKl}ZGC4rG+i&EiNiwepgw!NLmJv0ff!->5>=(-V7=P1X9G#cu5n2N%Vk2aT8(=3KS zbqPSjaLX9vu>WEN8JCP9&g-O8zf}ix3o`4Bt*~DIR+W!mWrH__TVp*S$ho zbF+@FLzEt2z01^$8Ty9(>jpP?hP`aav~iGt$RCrL)9u}y#US#Va2PlujEdx4vFxJtt%B0`qo8DiNQ;$TaR!Fk=9PpYP;yBar*x4L&+ilUNC*}q84F{K zh?n5a*lvo7l|{u2rE^NW!l;me06>9@Swfkd^|zI2>p2@DqI0;A3hzVwxEe2oK^OH~ z17Ge2I`XhW%fEEw;iab?+9rzWPFAj@Z3p0Mj2KIHt^KLyCa0t&)mZU?>;CzoNTX}@ zln}S4HNW^&IVebxlPRI5k$a9HGmw9zkp(*k-{B!$k+Lw~TP7*Ab1(+(%EZD%@;oyp z)ASu_2T*bUmU;u==xp%qzDt$Ni-$hk}H9}@K2rE zX!#o*w|)>qDH)@09Y&uL*4N1XbyM#A*}ANk?SB|J45AHkJM(k-X52QtzRT#?9=`>^ zbRGEHM*dGRNkrb?BeZ1w6ywn-CP#3y*zl+dz_xrT@v%Rp`Y=V2c(mf#dPGb=~80F71xo=-@}eBRTbKB!dv>tM_xjf z_IGv7J6)OP+Lh-9zB+fpeZW_Q+FT7r=714(BzzS2UzWbDi=kyZo%c600Zp^s19kc7{jly*P}#0=9z=l zMw7{+G)fz4eJIQ?e1I!iR;wK&!1f=GIwFmN+0-;;q3dND9;+5$NyA2-l#^wj=YtPR zXU>(cQm8u_dJ_#1Z6OJ{s?9;`I*VRc;UZCM>nHVzA@0{yDa?{@iz3s6M^`))g$}g9cGl) z8<-3qC1xx}WcU84j}sy04s=QFNHpt=1DPWSs;*aWRz6xTwzW?C zK;3G*)p&@5U5Ma|l11p<|N>{P>TgG-h+4T^vmO zP!^7{aq5HDbu)f(XsP)xrUr6~6>)hTLpRSnFLn!E z9s-BysN8(FI=Hz|BV6VmbmD%&7hCfaXW!e*3CukmhW?^_3L@?1zJOn-f8Oqoor>dY zeHWa=1*dDlGng-hHyX(QP0#&}*B{Q)RJN5oCa5Lyq(;;D7kH#39)w}X3qSx`T!a_< zP&~uf-WSq61$)Y^eg2YFnqBsTtrUB|c~v6CeG|Ra*F|(nuRmq-Xkb!n6+;Sv;*{^&gCT#!83U+;e+H5ym(8l(9%alzpFz zy^0}^$k}!MM(1<=oYmVE0r>5HR$w1fsIFdMPN1 zsipI$!Z41n4eNsZ#fea&)YO$Hr;hPlT#;8+qNzGiiXwY8h1gbL2=o1zorm2>P;+(X z11_!~!0C|ld~gpwR)WmjwRUGvmkLxkK$(dzU#pk2^R}#!YL3O(cxF}o4XNz749fdA z+8%a99D#*jzSm_UV)$eKI}HB=CKia^jwIc+!w>uC0rzkg^36^sI#MCpg!a&ND%G+e zSHJQX!yMxxyho>A7TZgw)O18|W7Rf|?zdR0p=YOLa?ei{sYywJ1OKWEpP5k?mkNIJ zY|F;Z$;}Fli1xTid#!g?U8oz1?32!^qmj}c;d)8`#*?$aW@4A*RJ<4daf{7Bm#-=u zri1A>KUl?FqKHiDru*mF*@G89F+AO1EQ`O}xQ$}?owkpV#jZBv;wh+9169OaYwc2f zSi4Z;3Ep&-*gePP1woj~6;(Alr-j(k~xC{N~ zjGNc@t=C>WkAIoDN0HVrQ7+jP)v-I#U?lnjO1VO9-T=@bRlNdS(>dt)vo^dEG<41@{Ax)wV$qmk_B z+{}6fck;IOwPo0@xw{?_Ln<&T0(N(CLOMQtdmTWzIjXA1KH_%a?i%_?CHXIx_8hr6 zAh^QG@l*95pGZ67VbZp>4nK426LmL;M5*=JYA^~0KaS&3zq@^|^Sw*6Y<`H}aNioN zEdzXQE4okXARygQL#yH*hr5mqefCd}S1uN!K*=^%dN#;@+g9x5LQ0mqIUDkLK5vvJ z$ys{7kEBI)?pK}1;lW3{nH+@2%wN;QL<>Ciga-3dSRgi)TByEAP=&>hEvR4Uu>=`c zu#UW^P7a;_stRXXbJjQx!ds>x@|9!@6ZS$*QNv55wJ&BUT2%@)L6lzBpo%h7)id^T zsl=)>ED0I3{MB${*o_|Lm|&9T2nZ${gfGUKK*I=ZRxPkAeFEQqJ7Jt*qsp#A!c_x* zo)|`DDHp6L&G!=0UzaxL3N{bR?axX?W|w@&hF+nR;GT#PWAfk%^F&k2)k28vB+z-k z4$sZbkndz4S6C^+Qln^z;v*h-KBuOI#xHtIvA0tL5VhO<+b&_^xr!XN8)T)7gKWUG z)b`;#LPK`er=Ry6j{oFq$MqhbgwF^x@BC{vG-%C!&+|nUxFbEp^jK>(ngn8-#G*oyU5H|9T%f`nqEO`r^<|N>v@N5T8cX!E zVGQuDo}!{fJD?KGLTqQNa3IVR_DLb+BIEH5}hIf>~ zs-R=kZ+SM!K4pR*-4k-NY`+MiQ2re1PKi z^fvXgDL*F&^;b+7VQT-Ent-NVYo-Y1^x zoO85ev7{yFA*r&2{C1GYmx^QTJcwChzjI0Q^gAxwQhRYL3`ul3`DjVT`JO2iPl~}3 z%M3z(^cor=&{JJF`vTr|S86moCDDD`*7L(4{gSI(3Bt2VLmG_sA*I-+R>rx@QidCv z`Uk91eKIU@Za442z9Fr;a=&bJl=bD}yKZMI;-W%lYz~kBkY&u3@&@)>9@$AYu5-aU zk}o^x7jvO%bgCWWiH)1yDPj%#r~Zr9F_L`ymqrMZ>X!F+r}iKIpGD5+VU_fBofDipDlNDA z{aPb_>9k2A`VWSgiEsM^ScH7@cnb1;SvToEKPq_BpO=&|U00tah5Y>pWhBEEv7lv) z_#+*rm0%~AuVqhwiuW92co%_eSx$wOzg;JDOiOkL9bn{sV8i_g7E`!RH&j_^=zJi* z3|;u+8#+go%t7xf{1?46bjJ`ou^d}=*K`kWVnpoe-SP3CiR{17(Z=RC3$j|1&M|~j$Iiy8P+D;u!-I=Gqhf^j$ zxk&$Mqov>@E&KG{=Zn2Ny4e9H<*@>L?-xDuj_OcC(O{U)%qE{l@hE_r#%oCD9n3Z5{AnGH&%2j_|wnvx;u{#8eOR zPEq$AxWCK%y4hJ!32)#=hAe!hUi!|ox8!_Vs9X<^4JrRAn7|pGFIcnSJM_t;Vu*rI z-lw0hEio3piP!vLfBUftUHmxt)2@n(f9fHlU31XW(A(gL(zkH-cuRS)2&d@ztLX07 z14JKfdivGDUzW5f?%@@dsWyxxxFd5v8`t}4XpvEyU7IJ0o);}+l#WULlS4B4dO;=>choRqpzW)1T!oA}om-ZelfNB-iaKqJ*u=LuXq-}5%ks%&I8bE&@BQ4rUm^c|NP2!k zP&gS2FwL501(E2G?!W4!hbLNakScV*Qc^E!K7Y|{+e@&UE z>E;~&rlyWDiMU%QrP(hD^NK#x?(ddxIY{}~7M;EFM&Y5Ul?O^ROE2SBIgHY1^B^HC zQGjkXH6%)t7yL^F;ob!fm~cHqZU`E8CRC0RA<+fvnf3_>;F6Q=Ju+k(?Uhb@YF2#{ zaw9~PJTog@nm-ca=Lz~2=QiVhP$4N@eG7+j_RM{C?_BL7Z)N@ar!xWi55566HieMH zXWpg&MM|YNkf?rqT0eaKQwcuPDs;DLqzxT*Bnfn|3?o3CRG+(q&tDBj=%r{7Co#Cr zEAX}Om1zxk^U6CtQ3UKBs*ND2@=c>v-s+34^Dp=4t9)0H?KG2P?jdjn_{i9>7U{i^2Fo9@?%jUPk#c}>hl?})-6p11E~d9~(+T!a935m5s(!JXFdW|% zcExbro5viKrszXl!&zeHon&If;Wnx0g=#6nUD9bpx`uz!uHr-Y58a|ji>cpceh59B z$UBFR>C^t%nbLaZN|U}|9^6XwmO>~H`S1GQ%k_u8yL9-Mf3tMGB4;fSs4imF0oj&% zWoOAjg3_3t-1Ybc&%Qtgv?^Q{Q%i}lQKi-q+-Z^U|K+QS-+$((#Ms?PyAi(7 zv01JP#Vv5U{A^(h;jRgA0KA3D66D!8X)5R^U13rGuIf6_j!i2aJjJf_`4BcocU<__ zaPZN$sFFH2z|unNU3DzZ;jFgeJn(4o?bt%AISbD2k(sW-ptw$Y0<|757UoK569S*7 z06!q3`0vcR$czIzr<)@^bPE4)oCWn7DHugg#@q)`dX=(Sj}B4}^YX!EoN!aR7GR1! z)x^)3*R;?*mz*v~UrR>)ex#{HXf81;eM_ILT5OHNEq@Y@si|feBoH>s_ZK10PPyVV zZ1ReC!Bdy4*TMgX6$q~`7pN+~A!CLh`v%pNWGFlL&zp5mdqW_E$8CJRp+JvlWnPlS zXq6vM+_vJKh;EJ**pdSnsC+qOKK@J@%pw+B;M?2T`d!^D;QIXZ z_XTP&P?tObm8wN_mO6C8Yx&JRftVH(>7v~IS`R1e@FwdqdOx*O{lV(Kc*8CK2NgrP zdW4)Qtr|_+ccRPoBYqw;(dvr^u4N-K!ku9RU}ZpJ6t3a0K=TAKI?dg3LLkMiq9(#b zToMhUHcl%5B?FRg!bzLfKtFTF9vrBQwa~|l9-lCyTRJJM>=_r1z~&f5QX^5-YB#aT zo6xywp7==7D0s`8=Ne_CrpGOf*XWY`5v;RGthURtQBwJTG@S)kTV1zCae})$1b2!{ zaR~%>cXxsmEiT2~CAfQ`Xwl;C?i49dtS^Pqe&LRB|3OB^$;sZ&de)o^lsRCQSG0YH z3h4pDRa(bmRyop&8A5NSFZ*dyLG9-{0u?@UBL_F5=oXEiE$>dtM0icHqNPOs!|P{O4*-_9|u(2 zgs9sS49b%oJx&Z#`PzzQ4c2ioi6OH5&W1p#udH4Hc@zA$8@O27r$Z;+4(j{`2~L!l zL^D74ZHCUp&aedh2J$n-KSCh2F?SE{)%WwCJZswwALb9yocbXJ$;ABs)pdSqFzuuY zZ7_w#9gqsi!%-#$I{4tB zDs3LEv3nifaWoK>8<1P`NnR1F<_s+yIl0<8?vjdCPFKpG_s^~v#!Qhalt{|ld{HbA zSUHnADd7Fp&c{m%rRjw3geAs)rA3%fdXr^9_6s8|sDGi7W;R3)5nd$4pM;lZs}z|h zX_RP-SCjyPq-F*?kv<-e{%Usioeg8z@s0-76w!5MGyrL{0l^QJey7+$g~WwtR6HU? zRqrB_^J%CHvkQe}EE|WXPwqrM83JzxT3^hyeMvUsk)nvkdKI3k5!HF4=#2qp91-T$ zk=jx5GIIP(y1oEi$Fky6fdI8QIx}z5&Pi7~>`h7JERtHTpu}cjQUM^Lk>%hR5GJ|A z z7V+jmj&kXhVKSgB8qRD#-l^l#4mO8OxX4MHOsG7VKkRt0ncj1LE8VR)M{E$|UV}6p zMO&+G4CtYcB2FTBgBqf}Psq{_A#kl0#$5CGV81Nt25Vv!FnA0ATz0AQqJas>71u?A01FMa6en@iZTF~971j->l$N{kZc|II|}8? z3ZZW52%acqewYUZ=GPDC7?tA$ZdvpbEG=BBRat6aiT6VsNT9aq6>?aqM&@1i-$+h+ z0=<#^m!eeb#div(hVK^%*oC%d+4kp6lMd7}Cw;OG9#mRT!~T4uomkN|qZ6m%n# z73;^pM8*?6`Eulyn{t^U{piPpAoP;>VE?zA{#hWn63AAtB_l z1^)y~`!SRlGu$QSrR|)$t#fma&37E(UJi|mzWycIRYh_g=S{pbisji+<+7y^Mk`^B z)F9r(-Ab||j*l)?eFyRGu5Vf7fZO~ACV+sz>bu@nTn9iG`s3c!UfLh4xb|f>{A~&; zj%`U9Ir6&?SN<;_O|#ReBz6c0is*27{#Yu!_?rFw=9$~Jtut!G@aH-{6%(yV#`d|H z5BAH(#t%cZ4T~Tx`o4RGm*Q>lGhPgKVLV##UHnvU^gGJ;xwOJ@kJA6T>wBY&u`hKQ zMs|c`Y(ml$ftpfYfBuf&W8GIVFG{*3^gn-HM{jhapc(SFk>mt<&_XasM zM)!#C1d4mDyHoBEpuFGZzP|DDVNS&%2T4xP(_H(*m+lIrA4rk^*!8X6zbSk8GmH@= zM`#^%x<)yKWUQCt6_#jzhN3_3-A+xQk^n<2k^SbTWl=sK`4uYl0xRA^DCB2{a&jLpu@wP3C5@FUCYQ%AOPs)*ZHIAZ zwuV>M=>G56_hC3ev>$`3Np=(tn*>(`m+67K=O^GfymddM)57+f`NBH_TLUz;rl3^t zo2D{*^@K`9pF3Dgq#zqRM|ZbTxv=h7UC?~!G3e58E`a#w8wx16u$*9&OglLG{HMpF zP9T|4GV_girNC+R&~!+a{O-IZnNJ>W$jnvdy$R;uUSVl ze-CH^kPa`Y3kj&&XDJdf)bzeqFKef(5;B!d-xYqZ#rispR74Bl6S|@lrFkep71`C% zi7fQ5TW&;u%=3tI+6?6$ugf^PskW!VfQ~nVz=YuBja~##ix&~0Y?Fbx;C7i29GY!d z*UGx^NH9}#Z=G8&r6=L?)w2!z;+@0i8n&RX)4&89HbAWB!S|5s??v|o-=6~f zMUl5TzJA?TF?iWDs?4>>YhJjY6;t1#6?WMBc|+WP-F+$E1uj{!ABxuh@K^`s!f74M zI>N!>nffzmnPkp|JgL~A4iX>s6lKy4h~+Q6 z!)Ur!Jt#92u`NCILbu3$M^y-8K?EiaoZr*6^#z2CoKRKpC6TM?rOg*c!EP08I_$c;wo-qcGu(ZbT}eX_XC)Vz9}~ukgByJx?uY&~012pQ+G5`XhyBL7v3A zALi=00&jBtG>ADIP>8lgoy3KXmOr{w#M4En?!(3lU)3vW-8ZYC3U$)`;+t@sw?E%; zbz3+)rD}mmW-!n%_hsO9b9&+r+`KyVabz{L-;9n) z3857L6QQ`&+atGWw&}_5))TC+a}pM4{Xz>jXCH8pIaA&ky+ zB(k&|s=VBGmO{Q?Ov-!_i!_Ckr#_|mvyZx}Muy&@0w$mSe2oua!anhSer3ZMPfWtJ z$k4P38Oy}Dswkj(l{PUh%1@pOD&W;|Nhh1;+S2?LteTcD1Y9w3knkXf!%ad`#1`6e=64i!C59D7qk9c0EEsQ(lpHcGQs*;ICdcp4e z*`tOwtL|x3Gw|Z!XmpHl#@Is#1+#eyIn6%&=qNV>Qtq77Hjb4Lzlw7@Sy%RP2G!e^ zOSx6~N)kaR`T8`cvNwVP-L$h_dc?!oZ?2s47F{{CG^WzeQfzT)un{lhUWRmGRI$&N z>oOW#Pnk=yD*8p4J}!kQl1RSj!8RiBKT2uOeTyFc8R~9*9&@ zidk^QketxxatYEA9gtca|1Cc`nFAV(0jJ7<#1hw+N6k2Rn{w=DeM{T{Y}Y)8-CqL)!&ja6T`VcP?06a zrHJs@;I?+lTPgW%ACbjdZMZC3m+m$)$0xbWqA}-}Y&cLX@c~|N!T1BLm>gWbuK_wK zM6Z+5a=Wfwp!&Vb@r$5|2T`^Qw*`U7C`jDKYu$k9HMFIS8vGu;XNP>U8mlSz0Jo-dM_`IFPm0Hx1 zp|bKo>~pk-!*v(aO}$Znv)i)FKNu;sUNJu>e9saz+}L7-5bN=92=HniaGozY6g3a3(7e)1*4#z)M9*oZ;N%G@}OPR$gM;;M+akm?A z;N$pg=66nL>CN5Fw_JE4L6%a&2$!&1irY*V{G4T;Ii-Qu21;NO8ORwO)1TcPK{A@QHUfC=_QZVp3pCt&>hI@^_RPYMMGI7w>c^7BNr9EzoO81(V{O40#^1IU)q5j)M$)^ZOkFzAmEFW5S8Tpc; zdvHpI%vhV{xkP9Q4EXTayYz54&=42T;8tLO)ux*yVx-V)#J z@T^5`uHvA_md*FP9Ph0di--ZL5nHONviH6zzA-J-%oe!5`RU$mA7PR3XQ$wdSWN)@ zJV#x?Gt6Q4l|0WU-zJ^5zO(<}%q&}Lv4l+gS_%8(qy9%*0=>oCQVH%H{5%|76>irL z(mc13az3(OW08pt3iU?%UjHQxN@;BA3*kv z>#&3*@J;a4^!4vEoJru-XQo;{MyXoBeV!dz8g%caZ|`MutzSXwLom-KC&!!yY&S!O z604cQ?MqnsE30xWyqGLRQqe*kZ#}?KxD$qiyBp_6I1)}hBHt0XQAa*zx=DS#rTOPc zgXUue@=v3Z;a0iO4f}V;{f|!|0Ksu%RZ@hP%}4o*Rs(o4KqTAeAJ=Q{T+p}NyRu*j^z%#mw!uk-2QV)aN^*@;*^0ze%PKWjWTfe8;Dr_ z_nf1GMk1`cwc7bOaQ9Y!R|jGLesrSHjggGSZgCqlCboMZ zTpm^wM1#&tWZ&dJ<6NH<{Mgai#|cUTBxyE^IJ7ki2f|3m4qtDT2&&KZwnuvCtPf#l zO-5AUzCQA1?!%Kin@}n~G!bgSrt$oVS>P;2@{eU&QI@I4AaZRGFIm~4ROcXs+0f7>`IIaIL6-3481O7LS?tM%JjW$d-%4wM{%cvCQCqd|O#KQzG6C@N;%eS z|9t$RtMcceuz?8=B$NyO51^IVa*wqk5(~Ck; zeW;PIYJF)CS{wcaeu1q^MO^Wpgv*kLda>M4ZfQ0A!Ppg8Ghv9)6V%(dLR>K^r>hd2h_C|Rek zE}j^-Jr7Q`q(XZA7t^PPrU(uAGS0oh+ZcE_OM3*Px^vf8+Zhi0jv(C$hqi&Gtf(8a zBndRQf&zT7pF~PdDT$?zLZn1Q`zz*cU&X?nz*CrIHfPi7cIGchOp7hV95`bu3*6qb z;2<1BSGa7GccvI@$<>Fk#s=g%&E4hmQ?oj$KPqYCn9kMy!Crqy-@MPSm<%)EAbAVq z>9r#lWi(g=e+D`+2Hc};`oQZcO5b)EPE>{ZFXFO{nuMToeI(kZjK}s2? z$QJAoyPCdJ`@D%+9}iMN!?GOCjL)fN+AH&DHwRDx(h=dm@B?VRn&FUvEux5X9nEUh zDAPrPm=1n*Hw@P3)fP53zU)X|GWfBF%+NR{(XT6OSXIYxUF>^XqHi-K556CDXr8=#%` z1@*O}k<#cq7AgCY{xqxc;)>B2{LWlhj;7Z&>MQ)T+M>GfyXhg?{Iz!^3lF_+!~Dmj zOcS_YfAZ!>E!BH|xt?emW||(;NNp0V1fm$ zfY3-3?uccyqd!}EudBAvaf<#K+>O~umxvOhvjO0Fy?V?TvD_ieV?P*p?t{Ecc9BOy zV@MnD(@D1CdoxWDPw~r%>)uz*Kb_^sQlq+#%W*mH#G$Qi=?tZX6qs%`_tzbB@F-g7 zBAr&%*3rMa|BoiD^khHuHkMwU}u;1`kLXj07L_Ok~tFQyT6V$e}UP+{mbif;HMW$#js!QdJsZ#N>}w6qo|O!wQnvmt1YTxTi(n{FT5H zYvMwO;E{cIC5;@LLGK!(EP6~!F2Y}`%Xuw#B`2lqD z&5<*@>VtQ5th9_ObMsPx$b-%H1nrcBlf z0}F2%6qDasB**#^SJ7b3c#uiP58%l5dZ7K9Wy|{V04FKqDo&p27Xi`vwIP9+)FhF?jB0W3O@9TX^4MaC!XZSBus| zxanJvqoO_PE2BFy_(#B!67A5f6jf$BZLA68!lTv?i+Y%-A7S6v4+dCqxI4LIMtfCW z$}Iiq&p$pH1#LhQCW}3pR>sqVWz3+c{0n)y!7I+^CS}X;aBO_EY}0Jo-)c1Gc>7Z^i3~+ z3?7sa0_(r)qRSQV!7M zTpn%H{Oh!BD8;^yQIPI!NXkm$Av`LGT}^Hj*${tT_`a)l!T*EfA+K8!iL_dJG>9lA)IzJc8StGgZUvu1l54mB~--ONW zvGPF~-^U{nb1D^954dMF63>KA@}=X0JFC$=^gft^xl6y-3$**M2TL|8J*TZ1yY~@^qb7e5XiT(nZYxjQh2;qdppM$?ggG%AfESF@05oSkKFvM zSqyKW!E$*(gXiYJ*hEnrKsMKE^>}MBnV;M=2d9=XPfAlIhArr`$ zfhfQwGJJ_X`Tu%CL-+<*lyu1CIqLtS#jVsIv&g}k`N>0UH-}~3CJM%x_7$WX_9UEJ z!$3!f@1%xT?r=@|+`nnPll_!i7j-^UTQ>q(u}P)FdQz*Cx1x6Xw>WySsiMLqHbKYD zVYV6qnIWDO9rY=wt?ou{+cB1igZ7!1ks}NRr4EkE4+#wx@MFeOBD1C1V|@!f`J9zw zs5sNUUUh6y>Jy^-MDrB#OBk|}cYQ639;DQ5WgE#Zm6c~!da^-4sam7v650cz)eQv2 ze+UyGfv1~+EA~Il)q`)l&oL-wKGmU&cZj>5du9G%xUE!eY93l-~V>+oB#NaiK@uYy-0R z9aR*@G!-}1MS`GC((dfEv00uZ`hgYF06nBfK=vb@{jAkECS}5qGyJZ!tboCx#h0r*hgepe( z0jI~IQp}c&&*{p@8OMYOw=flP9frgmsU25G6q8uc&bu6AA0Lyz}8_CGIDad7%09Agft&3 zoWx?$$*_rDqV?P`N(W)uh-PLQ*qC_mS~n)yc%3@jz5R%j=ZSd7o(;ufwW;S?G{6YK zic&rKd(^9qKlEp>#<63wuO~~3uU;asfa{(sWq4$Qp%(3|Q(~V)v@>+<{?M@)PEP<1 z$AUV*(?kiC`m3DsqFlfamN5F$MZJHpSn))#S5;|OLu{s6#fl5k#u(e!DLPs}deBm$ z;2L^6U5^}|QcFEfw$dHfdqmgqV1VapVMZ&%mo@z084rJ&CjLsB>dB54k3>)R^jW== zXT};GqzyyIaD^pcadWJh1vXSg+l46`Ad#M66qH6LpD*HcJ|Ae{oX52wi}Zhcp8NM_ zZVxt_qY$bTxU|T}A}diz?iYVKFmAZuA@EuJm2ZWVduTj4^W& z&$!U!++RjAe;TqOJ7Rus+><@nuSrDlzsSM7H;y40w@hSpkj;5twEyY5;`4OZBw5kS zqBk?g4@B7GkR(pj1IB2_t#f#=fhDVu+D^&#y@b5a0c6d6SfTm+YieER@F-W zBK-7cscErnd`)H9E^?)Xl!EhN0C8K+#4d>kRLpQ3?^^af$#lf?R==qi z28q!Lnr||5tXPczc9@kcTzeZoz`X38`Q!gaLdU9K>(Q91J^l}@q0)j~6>U(~OIwe} z!@ut{2D8e!-_iLLbweHn^8sJf`@F^f+lK7jWp!3}PkXiXfLw8U5X9r%xS{eZ9GwSy ze`fa93xItIzuP2V-i^CbY$j-pa_^!wB?29fd-S{PJPW$u1~eEPhhcg|9s2KL0UsNh zm#dWj!BYAAxAC^O(GG`CtVorK%wHHt=J{@l+kW#?=QZ+2k-x$=0l5e7uHUwFIM)*G z7&ZbK73$6jj@L{eiCUQ?=Kr4844GM@If!W_EMM+nkmPKRaO=ph z^R?us@(;-d;_-=lmKtm{Y1o4Ql;yoFcMc5gn97>(%@O#Ot`mG0z1Ka^6>kqL3^cx+ zdadcaM{Yx33I9viQL1eR2lMl=3Au?{j6oO7c2TeY zA`KpyEKT+yX~*F1)rdOa2pXo?ok#q@rx!C#7&^SwsL{l8o43~c?S%C6YkNy-234ON z6oPIiC2=sKhkH|f94#*&o$t_1fw~Wv>+B8ELatrkCLf~sIOqwcNe+P#Ma~_q4yc$+ z?DQoI@{(Z4TI+?0gjU(EKd>!E_w8m3TGMAgS;j(T2QUqK%!2Mn^N>}WLb5f3=U2u3 zDPK>QWXP<@*uQr*jTw4>105Axa{j(s{Fh?*@YX+Z+7?JNi`-I5>4lX@GU->90<7iM z>zv2fQ*>vqC+#(lKFoZ?HQKNYwnTfnUg>Gg_sGka9}cIZgz>?jV1c>nNuin$a=20L zVfBzXjJ}9Zpf04zeV+!h_#x4A3tL?S$zQ=WNBx~$9n;vdhF@pO_8n)kYMZ7EI{|F> zH*EDlK9o~`73TMO)#CgU}hI_yc&-QIf59eX#mtV22%p@z*Kf%o9TOY zQ(7!BYQAb4^B^rl!lw}TAdFaz56K9qA%W8!V{!Y)>N}nVPWiWfgr9Zd(z2Wx#)q|? zg|7LgTh3I&5<^rhDBdZS%nj^^vh5cQcd_;M6e*iO{Mnnf;m1{rV{f86sF9Jm{dSxe+yc7uv_(a9e-xi8bin#-r zWQmAH?wX->$|zO39JZu`ayql?zm5M2aIwwPBt29q*1W&>Y=!Xp#q!e>(3;XG#CKr<$quw| zT(rx0S5(>h;C=yeJGx1cp{F$|9kJC!;Cp3)nPY)lm6Byn-!vGmo*x6@KRk^7WEE(U z%%;>5L9I=6G?wXUr3eB$0}qX^e)LJWg>t-C`mt`FtWuB@NZCra+$StWVWr~5S0fw0 zAVEQ@jxvS;=c2j?^9(aGg+O3s5*NNNhZbBJ#GGgcfc7v|AjJ%@_LVZ4Z;;XLL0RpM z{xVJzzxS(_pISEZTrT{^LWk+m)oPju=f_W%H6^3x>Kqn>|5-+Arn^+Ete*Q)gke@n z_)1>#uV{hx#L}Y9mGxKFS**lyKaJ|ZB+`s<*$~4k<$@8GcIR3&(xlS_&5}qWgkA?+ zteDhrX0ky{3VNe~Hs|KEax9<|G8r^3l*=Wz56kb)9%`4J>4*ghF~kceQ;j~FrRSoM zrs20e#`oU+;jR28KEfoiCf>3bj zfyk9gz9+N{8ETkOTfZg|MZGArlz<$f8mH>aYvVU*Sov6J#Ooga?)6(ckzyRC0w4E) zwp<+d>d&+1TONC^#;Y zqSOwcac2;4SEnbFRGzR5TUhbY&aRgbw{tpoj{38~c8`yM5*;P{8yD z`jvu_r}vtCw38TA9IKn*EZY*qwpcMFhvQ5DVU1D4h)NkKi+kiVrO*P?csV*Tfays0 z{WZe&LiTy7NlHd*nkca%rkqBihp3Qi`NS{>EdVY)NV&AG8a|s$dRewPTPWYX#%$Hb zk0>&z6$ScpT-Bl$82u8mxlAZ(OZ5+dvQ^i^=q*E~jqwJWQ}oG%k)*Y^kMaOM(SE3+ zMs*V%lcQOei&x&K{d4&uN4`ly=CaBCAD{MjJa7jw^rnYTn^{TJXb%>a)8JPsn64pV z3~HZf6B$@_3mENI4D^1F!|q4F;hMMG2Vm6{D#bH(xMqtln22SOyn&l}q)DyyklZfX zr3y0nML2;BE9*c%1 zG0ZQ4o-|Z|M@K8?h1@e!M<>o$`ObCHyo7ZOimLXU*q=n7aDJ^a(@4(KFz-~0aZ24< zF@CgEq9Ob(Bcy;*9jcdhB05QwJrap6jW6LvYdPStt-T-{DxRy;CGKGu_iteHG>PN` zQb@)&_fIJkhwCZTPlT)zpqbW8IaY}Y6Rm_wJlrnh)7CMiz1EynEz7`Y6*_K%DO;_Nn+$T174^K?+f2C-?N${5##O%$7`4>-+d9nenj?vq|6 zHnzGx{)BTWK_M8-gzKb=9`47USr7sK9vTg2M<)Y;S4*A1xOSnbpyWqqW#v#%hQ|Cw znii@Ojls-IT?Kpf6d>Pg4o3 zjWnO#0#K=9c*yU0DRo;&& zdVmhCUqcDhR!SS0E7AZ?uHnNP4>wK8Xs$W%236$=WKl>x2NKiYwFjR_2%fd+2a%nju6vmB^ z(k4`7U%O}|=3T0{FX$#v>#7_kfvSP5mES?a+I{(>iZziU?L{9halO*j1fmLvC{I1Q zBcZT&arn}eHcuWf$7Vc+Cw$1r)Gm)STu}gOiz&cMyhF7BQs2B-v~4%DqW_C~NZ>ZX zfG=!=#r!%@9p9+m1@lI8UbR_42UC*uKgfLmJs3$)QM?gwTF2* zf>F|LE=n~YNRgvM&svf;bZn^F<|Y?%l!ZmClmUcE{YLrJu>}_^B~J`hbod(j2%(ke zJs;ewyY?ucY!Gvto#xDc z9zzNu1vYAR7u$GnUtAaA!^If(qtl!{HvfGaa78pWNT@N3T%x5-j2)-I$oD4Z#bP`G zmnD{MAi(iP#Lpk+)6+tia)(`@OB0z!LqkcD*sVGTF&`-kdNRXuWz3$kxXh%q#CfH| z+vIK1*n72MVGR{gzjpvGO?E(Tf$}wJwkfoNQZVcaQ}LZey%aW3=YSCWfE_Wx@_LaJ z+)tRRD5Dd!j0o3~)NGUwXA~tb?LAB3yurV;Q1QEjB+Q$hC-(^12oHQe&-h#KO!Ouw z(CGP*9(>;)zN4e?wE~`*N7-W1)McU|3ebyn)JOs^JfWe)8RUIRxSrAOF|ELgSIj9* zTc7Qi;}<;tLFh>u2-4Z{kxPzyzd@J=dc*g#|?d*v|{A=dmmed9CUh4El#;2o9W?v;w59qFCk zgXRQjFP&X8t}u}8osqOM1?FISQc!x`0(^Z7#xYNTQn+78mlV=jSQ{VDlP#-!+MuQW zB?`o{a?;|_b}mSt5){U5LT^0@Qhvx$aY#F7W&p^;aq96=xQqyH?Z7#@ zN?ZVn%bsnk)AE4V_7ygb>CEcS__?rwQ0A!1aA)^Q10}pG9THF&Rgr8);WC}CA+7So z%Td$I&-_~7qd*Uoc5BS~3&))K`X9tm1rwV6DrJ|E2R}cR{avLeBtxmxrrkSNd z1hU#xp@#8p)`y>A`A)7Wxe}W%M;wJw3Z?N|joCctb~I#0{y~}%M3geC&@RHfaiLV? z>*4~}tG7k+3eJ8O+xxBdyHF;QiCS~YTIWnz^q$Z?)!KCqF!VD)dsJueh-#3(W52v;J>R+=$`S= z8MWMeSUQ1ea9bxpnBsgM7q)r1?rI@h4BK5m(w|ZxFgNPf`B#c^YUjZ@Kgh6YR$KU9 zCL?BOQ0e*CxtT`$hNgThkUEtblmH>|2PG!J<|uYFh*cGQj4IXSrof*?UUC z{kfwd0c-6N&%N1)xg6Px6e3BmEr|n#4!p3jU2QVF!>csh=tb7gra8?%itl%;E_l1r47xt!zYWu0+N=~y^uY0% zn0m%=%$=)qOO|fr%W%|Feq!i`vlR zK{h0g@*;TS{hV!vI3p0P+Eoo*H;wx}$ox08T?2ecx(qmFXrj?d|0jPVm70@XxK{v6 zxw4GC5y?Y0LUNK>Q+W(#RJTR#ZIq1Ee)&8r@z_L!A8<=$wWe?M_ce{&ZWw-uHM4i= zV3Q1b@6mg^gARe20w(3#wGu@!Nn6!p1~a2KR2_e7;9q zir1+g&Y~qAb0|obLQmQvPYt1&_v&H7`EvPq@IPB8(5G^h1p<0>#!|CVp2UM?O$8_H zdG3G=+GQqu_U;!~WLetTQ}MDPl~A?d74(^`W+uHeV9lC?>M5MSrE)bbQk)__lbtY~ zrF_7|Nzk$!?Ii~3c((oc0Jv?h6@}ERJ>1;`tCW7<&ca@!5}8gNO(XoY>_d^T=MWf@ z>!nQEKsj*IHANX#77P1hkoZ(hjaYcX&=YQQnkyGu!8V~{I+^|#$N@^sY5%fVcTB+E zm!_DZzGB@}p(oRhN?WeE=|bUK4_rI1@~<#u(z~-g!0*i9yxCg$h8LqvnfhgF3MhsW zCikJDBc~$78{UwW6Qbg)}qayz;DD#Qtz2ov%#^hXn$Y}xRr~tqXmplb{ zU*RtB@qLis@T7fmjo596!Dc+J9Nn_U`#mmdT9*Yj2_F)P!z>-b0Mo5ShbhgX;W;IS z3r+~={p2)*#N8s+4o2j{7);T%wq?SO#vAQeZPjU%!-;3r%I}ttA_2@g*4tIIRqdY3 zn%wd2HCkC^$^`F)7P?6@FzJkDkJix5eA%-&qI@dq|2z?h{sNl_yqN!cG&gKdoH#E^P(GX` z`0-47T^i3tUx_yRW=z?8`X=N;I&l1+>A$}1Q^*z&4KgD@$+47N?n>T!bc>PKqrsdqHf`K5Uo3TjS>|FxZfY`w~PbHSyXqLh&58zkWxc(yy3UJ@W z2{|AX)fl{Ii<+w+Yq2v83g-p8%PvRBB(uGK==@y9WA~ zyH%cZk)!OS8_khS^eh|Ii&s7}q5bDmo@mrm`2-4>L-28lHLRMfo7j!y1tHDQNvX;X z#G)msC@+JLRS>wkthYI_?#P^eh_4g)(#>F01LSC0QR1R4su?OpEg9a;w>ndMZO<#*fAKGd|J-djKlI^Jsehe?QBekN%(A8H1wejb%wrG;`~RF0kSHRqxHvl|Wk zC@|=VXX>}(Q;B*)FPN2oe&B-;?;w89WX>&z-lK!_noIF0`WJT{oPcIAq!hiHDlcdM zT`6>CdJ&;u$4^sOsxkxU8hQ-!%81@NK^Ujwfh}|T;)m@V z4;D)0W)_?Pl)$a|Cfpl+Fe3T$4|_@W9Tp2EEw2>Vn<2~P>7hz8c=#VCUZcJb+5HjB z@gfN$jtiT%$Yg?dLZqt7Y9p54svvSzsIZ5RGAycI0*RFBAtOc0#~()Kcuh?X8c|Sb zQ0XD*aoJ!9o;)XNgwg761&s!FVZ)bR*jR?%agMf9Y{FOUdi79_Q(#{ z{p^P&>M-0%wnYDOQ&}O%z=gSf%dl@AG*_ct729`Tc;juyhYltI!I^A2{^);eS!ez)BSKAYKpVJwE9n(U+2Us+) zEH}WIa9jpxReCHh^itf(Mt3`O`z8f|1^mUn0ADmX*SL+JE~dZQUSJcaE;x#?6Z{0* zzoKgIwCj3e*I>`ETcCIr1h=KBjzX`8!yL0ByL|1OwfytNxT>btkC0JzGfVtMG=o7o z2fhcC*EfH_PEl$n3;5`5$~GYtHJ%;M-M@XU~z95$ltbsI`a|g%x)kxt}l=Zg{PwCocQrO^V}H&bK!TJQaM6z!y6{B?n+ zfAg_<_NL^fHF0IO>_xoUL+O<)P*e0|o%-0Sb`$g4b*9(WAJ_z9_sYkOd!pNAOY&Rm zs2g#`-@6`_xoJv5pgF3T{TPys4P(HMN@}W!nA^9tX0 z{(JpE8F~HIBB>y}jMu)YJEO^sS;D8Z3DC}#6jSZHm|)N~s81Y(|Bx*F6&LJ05OzV) zc}X$Rwu%S8qD!3ZP+Z5H+UOv9e}8rG(Gl!@CBrKwX9vzjSsRG3}+qZ1ya*I{nPf5n&lQFmI;#$%M zTxE6R1f?m_e5^>NaI4jjt8i6G1z#WQWPTKL2I05amg&J6Ub@Qa^jY$rAeX;|xhnsh z$R;wI28XHF4P^iNO^KDWTbcWxoW=|=xD^Fbg`7V2NNd}c;r%me>~8(npRwhO!gd^U zibZA2`(?7n5B9<5CHw);cfzA!d)>=r=>ES!m%6G7Zr3=v3gee8l4PGBw$7iEwo8d% zVTrn-|IYn>AIm}B!FloYen>bN_p1E-KC#&TCXLwmB81T}MpefDx zCWF{DXXif_TG|0JS`EyQR$-K(n!rPr5S@z;3paW7{HL7;vRyec9a-L?Hz|k;s?*&) z-`jMZVx^dhQyS0q0ku$64T?fXHy5ceF&Zpwj_!A zw_Drv5NTcC#B3c4EQ+QFevqys3hCHGcrV6pR--%QI=c|$*a;?P#{$A0l}=t!>NM10 z1hAKAEIchLQiOl7|Jj;1aToT7@*Gn8`Vuo@Vkuf$XRsXa3-v{M0t26`cm5jU1(wur zLOFHJ;xeSPuviJdD=0((j568zm6K^sS9S|j9r4x9F}5X~myEnQztC3vQojJk61KGd1%;YSc?A(LaqX*2ul@`z4rBTMv;kGHfHT5sKi1B z7~5fwfW_lahl+%ZAECn>5|zw#a}Y1n*)(4bhXYbgkW|R2Oe-x9{fJ~1@x^Y;d1#GV zQW06PL5&AD!l8zm_FY{UI<~Z=CuI!^LpeEEjaktgEFD#Z4kaa4F|QM_2VtS~x|X+( zmC^U!=;q?8?Q35%cTwQFk4Fd@^yyd&-it<+k6R(46mLwb>%vQt(Dj7&F_J1pMZ`2$ zf=r>zi)+6&hvfE-?Eg3FbJLcwZQ1qFD$FvQcW=a9-W!c?5Z&YIGcb#edzO<($33pDk0aK@ zaKwAqtp-)&bns(pLU>EiuvN1#yJzE6b-;Yiwm^iPP6OvG+CfRC$^!)ncVk+y9($yS zVhsp8iD~4}tsY3%$-9YPtnsCk0G~0!L%iZZv(cJ7v5>B@1CjwZQ;IvJ8d2UuG2wYu zWle}|3K2Q5R->D)>eI8s^Q~!JK?^xtEC-9DvvvJhG4ASTG!kt52!w zkHypBDOiF6>ca(F3QIffcB#F~lqN^kk0PYxGsFsEq9gK#fqibeh;e2#18MQTm5?iD zkJ~Sz!Zz&m7jg)I#wpCE6F(cjU|9F!siHMmf7;fn!SE9>&i5#ElT{HHCSZ2#Za%jn7wT?<-HNT zk~d_>cE8G704W}*CO}z`CAoReohcG24a@+HpBim?@6qNSUKNjKw%Bw{A%XlgS{iZogtl`*B)NS@U-WAQCG zx(ObkN(UpgnMMbeX(Bx2F*0}#A5$!s^rb=!(WwlO0>{=y*$zsIwYlI43pcs2Uy%mj zRLy3|nE^+Qp%E@sljq3cMo2T|5mK^nWAh(Zun$)YdniWeJ|?gR^Au~#;Pdf-2tR9B zAQ%Ezk#ZSY32aYwLq2?;X{9X7Bt-^$A+XcV#z)-%BxP?01$hDs8rcj!@D zQMH8hM%+^}X__?~Jm0Z*-VQ0(sACFq`O!CvER9s6u0zRb`GJ5xOQui&c81J~iz}+* zh5e3BnrKy-Aen|J=Wff#3nKqTszO^Ajet5P>d;gE@&F3xYTVN0cd8N#V)zb395$3) z=Os#MUj7}z4~D{}P?eVPkSoLT!MpeGg~JkxIzcBfRh*CrIR#G&@wV#ihHoLWXlS9a z$W857sulkh%QU$7CBjHc(M$a|Q)V+hM=7FX@Mt6|(hjG0V|Syof|YTPfym4@}9hntmkpM+;dUJ=cK z5i{xnzX%$ZoL-RRES&O1VX8_)t2hF=hM(}mRR(G`m;%B4qu0M8hDDh<=h$4lQ@>AS zl#BHa{;R7$eW1hyDd|8+{62(%CGBh9dyj70vA|!;&g4D7*m(wk2fDJok^31dx{=DDmWMk(v=hL^L7AuJ3dfgc( zJG_i$!)i-K*D0!699X9)U5fK6$xxika9DLktv)@6GXGgi#PKxP);MLAI+=S9@>-gt zA}K9HhaXySvw;$8L`NTjQldOzn*I~fvLP=DlwR2J9cF{ESZyx%m=yvhv7ec4d;@rA z4S9yOSjwcGg>2auk3+bm`?bgX+Iz$-TfZ48R2LK}NL=ZzCnYpLs<;)6r7Cj4xul(5 zAw@a`!Ixxds&Yw1FiubRilBF1B`mzy7Gmr(k&15ENMTL@Nk)9Dj484aQM&!$R8y*J zg)yGhmL0`qkRZq&W#^4WWA>e6ucE2m0N$Gj9G|OO*4Y%!sX;G~sTRU>FIJ-{=AT-O zWah5l|8g3P2G+Q7LIWuxt9JHjWvJLadC{@@tF=Do-+k^I6(?lzqmYW#@wzUQW2N7n zwb#ORi~0XAMTshEuZZ88ulTAWn&wwHP>p3O9xB5fDKs^sf~(=Ho0YKnM+Of25>+n$ zKp9IECOgfn3{D=#pY^%_$kO;1Dn&61>4vTq!?G@y$|i@yJ5ROscWu+OJpRS3VJj8& zyaq0y+mkm-^;3=?X8Z|?IhiJ&+nb`^XfuuZ{;l#nlJ!bOrlS+%q+N4lRsD5VJ(i6t zFL!f6?k1*~Rb7jHIG(eWCFQ;Q$hPE|up?1$9_^tt(Z^nYRpBSWq;mK{*fub`r7kmp zngIy}tuz691^WkQT?2~}Op@S+GZi%upI#PJ`D{cdUo5RI#f@T1;JVT8L1-ac96}L> z4ewYiXP~f#cXN@=u?CcnP8lOa1ZD?B-D8kDnw-jl-K$Kwg=S%ZCQ0RR;bEq+kDGd> z#rAUssICyS%^lhu!};Z(1|WLkhaP2P%RVeKQM~OW9{SRNO;Iodp&+{brJDu;r^#;> zil)PbS@&=Pnuc6?($;_C;6ub4b3C>t1nqe$^k}v-{<68C+Autn6?Dd0{>mtEdM2K2 z^J&4?G4%+r2W7Wm+AM-8s_d|<>5=w}-GFABtS)vd0e3ZB_n_vGhB9-hZRt{DgzQ&N z511ZJOn(uKf2>z0lq;-2PkSgye>mg=i=MUzZT?b*If|mv=2zDu+sFS2g=DuhDjDy} znh*r#zS3MB<^g8x>YWx%Q6JVHlsQ{0!rp|?O0vVxP>P-ZSKdD5mJgDKfDIdRf zK7H*lH$pl=$AQh+z3yr386JJ3^#mL~>-l~EKq|@@WD?+fUEa-rz5-}dQVPthbXlm- zW1-Xw@noJ9OtI@m$-F4bHa@}-raCwk`kVk~4Y{O}=_YWx%J}-G1ugsBimBMXmYF;; zmR4f?2@MUE4(vu5ehnWg>feNIM|bRhIA6k&**Bu?kL#)K-K)qYeab0(Br{30W76pN z>^P7ny&_;%TRrps;c>K^T5_(Ybe%2@lC#U@;)Qdi#IN~`(Df<%+9!W%wL+DZiRl;K zr#3>AB;OM8xR}S-`i`Ad+1visJ;@}3J(phD+zoCga7A-%4jULrZ5YHKgY)R(`@ABlMFPEiavyUb1^s_W?Mz2 z$tPytOAmSSMHQ$Q@rtb#Ex+)FIZsz>%(F&MUa-Q9bx3Q6B6uuxoT|LkHo;t_qEms9 z+>WzgIxN9*@{v)Z9G*)DQm&DHp?~fk)<2 z94n3!2`qSOAiD=;+?y^kpgM$dV-m8}={b9&`-dqEE2Z$knB)@-+<%Bp#i4`p#j*?* zO7U+4ifh2|kV3krEs-3Xc*(vI?Qa@HfiSlbzicvw znqtr=@sHeZL|6$wlOJl#zF>_*>5A=)AXK`E0`A9oe`dPQ6QyKnl?x|FdY2jZD%WbH z*ah2w9T?l0iWe;%niqnFHi2C)f8+y09?NaNSr19x!o29oAwE?eJG-gMjHZNVRp8I7 zH;FewC;vXazt2@n0V@XDP&t-=(s$gNBNrqnQ24yjwUGTpzC0n+#{!kgVDUu7++O#hX{T6LiET%Wz%0Ls((53Oe88;q=xyvHDI$gSH>3-XHaEy_-qE2 zpI0v;)A?`c5Q!l~O{A-L*e9v?a2;(%_KF>|$Gj|;0wBUDOXu_R`|9eiOrYI^a{7cA9CO9CIn)HHr`TWagl>QQIfN2U8vd5gb4-&f{at6EMuS)Kw}7 z+gDIcj0L+DlQCyR)+QriwJ$x}{*<6K8%tq1b8Y!9ZzqX`_Eal_;f0`G;T@`9j-9i+ zP65Z*ZEKjtS^3Y%<`w8mOCqCsf`E*pW>mG1vxrvMg7-VjZh9IM zjTD_}heN1NASWFhv$>3bk1jJI_MP!08g8{=b0&RTK01MkX#~K!AeUZgQ0-aV-FH0U zN2-+E0Te6}4O=#YNN!v^dx~SwQ8im{Nyo$dtoBLyz$ue`5f|QJx6=+t#S-pm9srow zfB~PQR;B;Z^IG7;Dey@t6?k^4|11Yu+tnDJ-5r0${+qpZB}U}_A-;0Fsd8OyT0a)} zvpbwXp+HU}GNf+jn@gK=bbn=4CVxKF^D^@n@_-%5FQp$4gMYEHJ@kw|4c+Qjy1(}@ zZ%&>4(W|P6iXv&!hPoIU{fkew1{|Kuz`H|aK==xnYyCPXS%mc?oveeW#I@UJ?T}2P z(#nX7R$;RK^Su2&GjkfPYUn#S(?!DK4Yful0;2KpcX@%u5m43EO@@$RhbuIX7MYN< zi2L4OTe)D=^t>aX{BmXBprfV)Y#CzpqhrVX;krodLPK`si&I*Y-4QFr*vCtdrSpl5V6@SQi5`Un+M+ebjF^N}09>+h zInB6!g%x=IT@=rCG$velK`bnUlK2)vaS~5XZ*Dfz1NvX-J;K28KpLE4MqU^>uIVwb zA-f&F_mb>pU*cZmk!M&Cjv|d@AyDNcW~M`%b`rl(i@a>fT0Jvil~eizhKJdFn|L<% z7#HYk)cQgKj9p}sttiE}KK$EI_<91{@T{oK!w4411}6^%#q5Rao9i>4z0u}ro)-sE zi^@#p1z6YjZpd_6a&JSMYr+73crqt=MAUeFADax5ooM~M@k~LZOO5dIXq|@kC9++$ z?RU#>ou1?*wY1x}Q-(w;5 zESz1q{URoK7_Q-{^7h?FI|uU^e4u}yC8p5098NT8q<-${Q<@FWD?k8EI0sPSU3!^m zYmTlDz@mIjd>7htkmhbLfal?VVCTG++)5l>6a~V}L}>*- z86>MXkl$JZq8-;zKF_f8jEf?&f$3)$Uo|R4-Zel-gad?csl3~z=z^1qFU3|0VO`{W z1%r2ilMNA13G!SaCNZ>0H=khCNe-?VI`VjV|rtwmVSNZ9V{={_ROLrCJF z>aW#e?SY$AT7XI2`aS!9) z>U;-#4F56%Mcau@%;^l*n=h~kmPcpa+AE5pOKm}nhtSaj4TFnzMb(OZLO?fDwT?Ib z3w8%Ack_Jmj<-0JlQk42s(k}?D*ilXLGAH+yRbiHXkv@^@Q?D{M7qrV$v}>*WSrX% zwzZ#rUUk=Sy;3MMEp@Zu%}v74R;wTPi|&@`3+-oKfS^0s0Y>;M)E;WmI(3yLI9XBe z>zV_(v41zd)G`$)(H~o;KH>5cNIuw*M+@eRg5aYo-l$!ehXqF5KP49ls2-?vt#to! zZfiX6as@A0%Xd*rcD4U(O7xbz(cw(d68|G4`C*!A@q|C{lT1NFU^Mr=AJVTu(!aNZ zeCM4nqn(YHG1Lk}Df`$jtDTnv6jbEmFUYz@&7mB$^e+6jM1GghXtnJxGB^L{aED;r?iE-Q9fcj{LR95>)3D_u>u-8#WtR+J3e?%TCm!!!US-A|e zy3SAE;(>gVp@%S^ydB42OlDMy=Xy!&hkTyVd+%uQM;=YRio3ksUK|nMU&j}lIa?He z9^^&Xg6A^nFJNZng2*%h64l%8xxa=z8ph8K`ze_(WhC2Scfrx-2gX}e=f2S@B_uoy zR<`&|taGGPg-TLaZwJk{XDw)2E@7>&i{U-T!D2AM7Vf&)#i$+SzlXv9ChqgbSs6IR zmSR;93$OgtYMYAk8+t_%SNxFX%Miw!tG;ks- zu%iEKHbYV4ZX>|z;A^Z{YsUHHRm=>OKH2f&BS~aPP!cuSh^8(RIn8lhl1|KUrV3wo z>-$5@s(}TF7ea<_#}LcRjj!6qdyEQ5m3UaQXDt`dfL2@7xyx@>l{Oa2A+<`YiQaaS z=Y!v0^H3Wz#>hC^1l;E@osf6o`5Npf&9c(mKsyIZv-M9ISl@YHZL^Z9HHJe0k-|5n z2IR!p`Plr2e~L~?1ui3f=Ias5J`SkFfsy}@1z^%IYQ!?F&t(!@$EfnN4mH)>HsZ%D zN2u_Ex7el`^kZo}lGfy;sQhRb%yj-Yo>Ebv(_R-Z!Z@sv3kXe%YBc39n~$dSq=d4BKo2|i|aJqLl6S!I?N zaNMeD2zT<`U;}XkQXE?Im@+c6f-Yc~fjln=58_-&Zw`kc40noNM2vnJO8I9vm-LG; zRs<)w?`P4TCNOW*YiXLw{;)A8bs?KNf;?T{)6K$PIkI6fk|0zkooxEWjeXA39ziI0 zj4?ZoDSqmg6U0wv-`%6S+D!?cuYLT*vucVlQNL8kLG0c@jx|LZK$L-%Wp*BY%>?vQ z$v^@j;X-aWieoW5bkU4r{dYtm@xe>sXxm}2lkM-7C?NWx3SCpXIa9kV^y(Eay+{gh ze31`frc`W!@2GedNc54Mhu5B@<8NE`Y7q+q^h6YsG{bx^;+ zB6t8Bn|{r^wf0Dt>7uP{@+(~W<=A4mmF<>8(`C)M2KJX<16+HY0q;i`RN9;0V=k2> ze44@~Bkw8#97|2Nmi6Sv*Lds`M>KlSRG=rPnn-!Ae%~6CF~+<=Mf?JC9V_=l%{pDrVHY{ZbeE^L1H|$uU59VOk0g^@VQgMmrk4J zBvWO`b?Nehs=8h!CHIHcNJocLm!>#S`}*$HR2tiJV*1`J_MGyBd+1C1C`~iS?!=2A z6!eG*xamjQsKPC0?pDJKmq+O!V_n0Yfzvr?d_a2ze&%O6f^m8gGlp8ZrU1MkNU z!^?Z7T6u8*;AmvZB*{nS;Fn)uF-Vd(UwXj?dYLh!FRxszntCT&lp&gi_f3B)?xX?@ zuYq#0L3_k2L(-E+6kQr!0Ad%eG-!8UCr}T{i!RQwAQUf)g~FD@QOkm8{fck7b@n<2 zg%GYmbK7Fx(Q@nc*-!vO4(jGqX*T>0?UEF`gtXKRnTa~A{m{&VH|3slQ&Cz^M$GP> zlBU0wBmec*>Z6o`ZJ8gKHp*JjhqsBhf`Pjg3Tl?yz#&V^-vLPUv=Xc*T)%JJ!xk^r z#(~_zdC=5E`L*(RSkmqUR8lgZ3mXs8HAoV+zPG2Zw&0oa5v|9ddK)#ijvuy5qn)*8 z>PaA<@uics&X6t&6P)qX!_76u*AOi~=?wOUT2WeUcBV6>RKucl-4Pd!{O&_%>cS9`gDntc+OAsg@R z0#PTxC09JO@roXc$m9Lo6*{pXtiHyqnz5m7Y3Bq2iM`(`e2B2r3`;pQRMIW`4+);C zja41l$s~26e6TWe)4VaU!f*_|2>?$jmoA;4);yE}bfeWIJsoF5;N*k08E;QU9rBLr zLD8jhr4bvwewEoLk$m8UV~R?V+^xaXWPAT0yh_8o5LTP%BO_1gU)%VA(QjRGQ)Uw* z2h!rYj3vz*U!JgL&;FFv5W6Y7tWU;27XE1d8PaH7zB>>9WiHyzzIc2kj&;_3#u8$u zYMQ^6#N?@kZ4APj>Z1;7vUYg8eX`Nrb;eEBcWJXx5?S8QZ7re85#sU;vKA6}>+Mmp zQ_U>4RL9_xRWe{jwnHpy_yamZoSQXt)0I`*;`p@VXcOqH%Q4OMFbpmD^>ifmFFp=v3}L9v zR(BQUcEb6n@N_u##otu2LAi5>@$sp`G;IfM``(!V@IGrb=(LbT6bKWf{+`DYFq>{< z@AtVo)FKsm4enP4o0oY9X)Iqr$%ggm5Y8(V)|j-Ke2bYZEu}@S{6E#>1(sQGUVT zAt!GAosEHqOJDpI)s%-&-kiw*r7x0mW;7Ss?!SrKY5Pb>=o2IYe0T!b(aIL?I3G*Q zijA8rjhm=_65F%aTS!#ODYS9rU9%sB2qt(=1E!rN?Wz9^}XX@ zMG7e>$UWuJjgUMnwFivyEr+!2GJW3{|3n7f(9}srLtCr4 z=hc0Qh%)iVZ0kRYbDu6X7l+k-0u74J$6?$O8WkIb6)fB2Z@@lZ_+ppsdhM8I<&8wt z<%yjYf))=La!Dq}cR#@9>5iqtwjc1@$L}MmSk2O*K4puJuq=Eu z+9)0FVj^_r)3&nKmm|`w_Vvybf&Y`Br;xpVZ1++@{o68pqvIJbcY>jOKM z9>#=BT&?9*;>RR&)uF2dwAuyOoe0TOL3y_JR1i@9B)vvN@DMgEcByG_7&vIi`Np&O z2ZJdrUjbOdMWXILfVws`tW@ID`jxL>E&7^Ljt^SnSVF6`0Wtev>iU%L7j0~Bal)6a zd?vRnVqNv*Vrb5gx?MJ zp<=M^o#z!BOzPqB$ATo3rXA7qr091D4gtKMst-jtM<3n{-{?ZeU6VJeiJ=WiYF(oe ziqEfYs#niASo1~La2=M`U)X)4Q!r;=#Q>xi%|3Oc%M@N^R6I~0@=5OoJiO|}5gt-h zd1d_lGQvOpUIGT{zLg2PD#CmhtHAo%WVU!l4cUoeU5>(_R}89S-^FO!dAo!4SF&yQp>taU2e z7)7~>Fkp1(fZU`lLEs*7GkrP6Uu2Kbc0p7ZTl^d*#GYSXq9jOd)rsRQC>0;ZdLs!V+S z);hvWZ3|*AJ+2Pf9L||HSUb|eW|Uu=KKPubk3xu`^P`RTdZwKc@UYWcYh3Y2xr0b^ zg6b)iUi3D{ApCxBL9)OH<{18XQVuHFbbV9^zEOCoVO-+P6lUpq0tb#UA^DO$jd+7btY+Yp1M} z2J`)as_FarL3>-eMT)KuW1Gsx6Fgc(W-kSvM_=cF(!>VBg9%V3_)G}!DA()9)D>+~ zIr?`sX4+vLcQ+dGrJRk7q?PFq&q@qaa0D7{Pi1UDV6mz<6PzHtxx3F}>RN+I$gn7> zt$KCKFqNXKtUUMVP@qEZ7*(2Wn&AN5#?aaJ!Uf6K@s0x)rc-_Z-hf)nKnl+wdVU6l zk{e$~tD{bUXH5w_pRbB9uO&_U->2hF7)$0UlM83!gLYU}*A%?)fBY2Y4&w^wpOqGj z%2ohAna&8;YAJZg{uDOjS{}a%1z4t~8#JAsfUFt1hNvFMQec>Yt2xwWSfG|zv>X9A z!6OH#r1<=z7EwwU0m^8MYu7ZE1?rs&p5;;HB%M<@#%AV>33T8Rk5!6+^fQoTEfwR! zX?1&?o$V&$(HydV4HfO8kk!JCtVC75r=ku5W+_jB<&3L}6J5Ra%qCnPy5c74hH=1< zw9563jVPuhcHTg;WG_y|WK4ltu>4LWS!AIPh3ACozTVq!sh?nx%}LS?0GL_q*-W5_ zRG&M$9UIR;SpJbEf0(u&nxV;&>)EMHt&l3qEvEf`W0KqkGUYkQoXpC{1gDOq?ao7n zz&~mQvyl~$N?U0M1k1BaF%>qDv}y%S4{6e+O8IeedU0=j za3cuDBOsqsz;HN5EE|KDi@DJJ_oXGF8xrMMGQ-_>#a5;upGI^=Jkl#STMADr1-axtF#nG4AspSXlS8_UOe0mJUptj*-9wlJoyYCWH{^mO+IM~Agh4C zO(xF*wFDa%k@#u*GgK2xh+l-#VV`lW&GxT|+QmU_#8XvNW@scK}9yU)15!WUMW=TKA8zJQypAg&b^bcH_&Y6`@H zMuZU7%eXq4-#4gyV}|l@GW%3#t|%@hp2{+d6vWC>Zr20scV?ZR=j|6KjJ` z9f(tPrM__m*9c!w3YC!qW1*9q;A@L0^;c;R!_PCR$jyOuu&K>J$wdLL71pwu6XzXH zpO*M+4Z9gRRY^3D4OTqK9<>P6WkqrUbEGuQU9^rYRp#{{<16> zwyJv1Qv95_+IS0&C^*XnJV`qLJlqV3kZgLv!|W#hD~EV}8;J|g=fz3lh_os*O1`dh zV_x#UND(D2hs$b+WZlmnMxojp+_FNCRVl)?;%vgiuYlXKH6l}a85x-$SD_NZu*IV2 z5i`j1Us+k#Ir>c!E1V2adLE27c`+}H$IB`;xk}3xj=xU{8KtKcsRI7(;d<#&hAE$* z3boXmz)M*3qAa_&PgboWt4?~6ZjAbRK&WHNLm~}@rMFv3aUQ*bm|lf;qRyOxl)r~y z5Oy2pByD$Zdr@~g-aoYzKDWGC*;KcvHs;GgjHiA7VDQYj=>8sEapi}7XQ%Rh7eJ%X= zvOgnF=l7(%yp`PW3wgWNv4=7e>|qc2gv|)7k+Ql^hxH9$zCuyKHuj*DSM%MFq%P%F zEGvj$W-KdnN|b=a6zTJg_r|+}m&lVVMJ)Vzf`SVqGTAWDk0n}wNi96>%fIoj#t|FNRusc9%qSn7N0<$BcyVNE8@0Tz=}UtdLJZwcfEA4g)1mczUlpj-94}IQ+%vbD z_I}b1-Ew~YfO|DYH1TE!)pJN_I}O-IlIE+mzV~-`g-aH$pU&pf($3nSf&l~Rq7jWT zQ=E*7iQw-6f33`_#E)kZi*=UmuS`7EPVHR7NZ_C5PCt15eJuRfqA)?7^Xu5?{K!pU zle%#BYo*-P@4qL%6{idLHhr571v%ypzy%Z{6@o;kBdj}wD5WI!&1{w#k@FaL^n^Uq>tm#p}-85BDDNGLrvu8k?yD{jW~XO@9}=@op9{m(~QSc~_ZpvOVnj(9DAtg|WvW zlO>yoo~nT~QE6migBuI|WyS?)M3kOC*pGy_EaDlNqQY3o_t5f@is(y$ecZPKsjWPd zY@QewhS*8Jfw#B(6Qh;X!k5YlIA0Dv9?TlG8i&wxZ$Gk)_dPdo{ z?E@;{k)qg|w`&=vyg_sww~!)i`gl`F=P@k}r{Yl2o|b$cX^38q=Hg{qqAcrQ+%&y? zV`rw7hAitm&|PhMRHj3EH4quhhs(|nKT=$;Wh)cY5{bsf?r+CfUi2x;ZBW9g%*GHK zatjtdIqQA=Pl&k`<9Neu97>PL5$v%PL5DmCYeIQ7#8}#+Ot{sGjX81izn|!PBoCzt z!guTN7k+NyM9_*7-!cn1p>j2;n5L=bEf?u;f+sftdJ>hrqzw$1N$Wc3*1jvLZtb)W8!cEg5 z_$$p^lqWy!W@O=J&gj7inSt=bw(026_~mE{)!~~wRrwDv>|N1*ANJ2a z-gdRmdo=G62ILfA{i_fX4srNXwO-Wn$qQ8hAG=Wguo?_LGbu+;x-3h|D}ER1r>T2G zrm=s#z$BqLzqnxqtB?gK?o6Ls1b90E)gsLY$ZT!|i0+92C;(U~D`UGd*0nan{`Q(g z!K+0e47ldFf7crPRfbEwKB(8L7vE(@v!5qW)KHwSP}HZHl&*w}U#Pz&Dcr!8Fj5y| zCrAfc5`p%zQzm6RZDNX;J0gn|G}vcTHp-;0j#fTLYmyOzuc|xlte?M^7i+MKcA=(? zY*4PJ^3A2#anib*>4obU@BDQ?7RBydHjLMeqV&F>pnW#^`Gp}rgI%S923EmO%J^9= z5B}Kn?d##a$^q=<+<3n@@*Eg7{`uS#OI9>X~fO8r3 zw!;HqZ)-NgU1zFA8K67|Bz2y=;>YVfZi%N6b-o+TGkn>PPM{DGFT*aEp42abPy_VD zJu3Fd;Wp;E&-ycN(vYGVRFgW-)KmkhjC!voqM*>A?Mm(wHAW`D)ab{?G~-G|1=hQE zOYTa}T5`L$90)GQOWE^GeSfqlBb%)S6e(k>oR?Bv*Hp~%5oDg>ldG5UqlMSG{2_6*8QFD5Q+S9YoT2OkT0II{h-|LXQ9Y#9SnB{=nv+uKnN$> zY!cl6Xp%f<#SFJ*R30exxkKC)X)Lb14_4C@?>*Z+8DI9aldVpQ@(K?e87G*r7)!yr zQds7<-a~LJmlvT&J==UNtIe^Cs*s)0#jv!W7R9z#wV)#Ev8NhUwp*;@9I|1Vkq?bE zTV`~E!PG1j9jqR5V;ewxRMdO8Qz0$-+3PUbAFGrv>J1#deQXOCMfIZhtfP`8K~7yfVW z5)NqjrL1O_h8qD7mXos|H-CZsHFS?QlDuwXyX8*9o7xU`gHODw;ady^n3~2#%gJ&H zaDOWMYcs*RM3e+TIt_M&i5Yn`wSP2wCNejXY>)g(c7_ z@ze_3ZnlE+H;nC)dDW?a=_+v|OgCF#%0fby3Ow5TqkdatVn?pT?!gSAZxB|}G zZka(}44^EqYmklFqpvVCA~~m=-lZR6RONQ09Q%Bl28a28o{u-j`CHm-G-jXcBj-4O zM2~31I7(8?j$RjEuJAk_IJs)j{{b7r`0mCQ>NDAUUn+zr=Z1q7b5zUL}XGY-SzM9 zvsz(mn=I<=B3s^0pg@A+bR~m~9fSAmJMabfh^SAX9(*ZSSP5=J6ZOH%OH41fFKhAO z%6UYI3F*e)*>X(G6Zf0eUzATSUWl(-CW&`GF!u*bGY$N$J69dW>KQB>jt~kM zx520)b9O(g`TojBMnm*HQ&J^hRFz!sAr==6VAcc^6IrKNm7bhq!gY*L4Gx3!h-U11 z6@H%Fm0IPpsb*q9d{+7>eOB)tNQMndX&Rb-krV|9MSeMdT&}s*Tk#_fZ8GTh+uJ{x za7Th-4$u0H)?yj?AC@8Q{A@RJ_-DbYT3`iG&Gi$K)(A$&==v zXD1>b$CeowI(V?&V*YRlWM||Fei;m2&9BRqVOYtgYq;vE2=n=OmT`MR_MoV;{`WjrzLaF2y-M=E(HBU&rVgpDkxP7xj>J8 zP-p$G8iBnic%!a@L~>|v+pX8 z@7_;8DSc;6UxdlU8_Iu0cKK8Tkg+R%vRc4Sx%YuELH)!B>uBqr;tLb>56F$1epo{+ zbP!+7>uvBje_CAXJ0nI?q4Y&!jg6EfaqobP z4;T8K-oD-vH6;TQ@&mHdHJ#BUKTtotCd3Sb0@1YGEj!o^y`v(6m4)B3P-jfzJ+o^I zp^ty{F+jTVT5KUWfg6Z#P5_#$Ld_hz5ksvu0bt{?Y5Hw8u;YsCL9~a~@NJaAE9|;t7!7xCk{GP^kf&{J;-9&ZD49YM>|Q?y@U)Tm8)Yjrv$Cnsf6!Cpfl%1`ZNl^AA0Mmd*yNZ-T?|}= z$b@N1M$MJCUKtgGEqM-JW>ke}nkB^JZW`^&$GT(R9vrsB{MPb6-Sp2g`i_?0#);5q zXNP+bQf|-5YUdIme=W5yjcRb5l{}v7bCx0tLOivCi%1nvKT@mskw~@70yH-9oWYm+ zJ^5!6XZ$jErE!y8MwosFV{AMdZc+zmV^0<)o+5+zx-%FtIQTsyMx>mQ|x$4ReG|* z?NXqu#r);gVOt<_Ri=XP^AYo9tnFGNdySc{?Tb}hGj4|8WPYl7j8r^DTRuhaJ=BmG zb3VgkEf`cC<$$Ff#aB>n;SQhEovp^i4+W2B6K6d>dF{;H1XL z2y3HNNn-76mE&BvuB19nuVN|o-IiMK*vjp&n!c!hM1q?k%&jgrxRC)l8G^ibvRBa_ zn_c>r*pB{ZzJKLlC!>O3i`Gm929hDG(q3WSk@qtZu!~05LO_rC*=MTas9+Z}|A8p4 zZFQH^_}X1WAD-eysl>2477DH9df{z@irfsPO|4Tq1k)R~E*O!^VMw>3YJ;y1eYsQg z&6RvbN6U}iRL4&pS41>XN4#ArvqxR~6e-n2#4$kWdDKN64E<1|QymeQB?r7I6S0jbsGJ zA%u{||Dr8DhpkZt!qDC=4HzFxBb>qyTMn}lC3_n~y1U3!ReC?&af`f)m!s@s+c%MW zBG}GcVf*|HFZKZ%sN7~qE$Dv_R}NI&rwrFjCO8{KB<(-( z$^c-!Oic8Wwvo@?@F|5p;HIu>5sdff|D#xD^<RVY(bn}PX9GD{#=X34j*YEk6!Q+6HqS5r z`P1_iJ}#a>_9^VwqmOKR*D09P?Ng5ELsF^e-*Q8%J8Zc;#$%fZNZ{SZ>#oCVA5*^J zR~KVocyoQd4f%I(&$E+v#lhi&Ev=5KtcZ^2IxN;XoRjvP3dGmNd-lEat$??(%w2j@ zHv-vX-nTJ9`<*Fo&WmKWQ^h&mcX%$ja{ZmSQI9-Lz1y(i`}oi2p`UHn#T+*YG-4}P zQMzKYSwbqRhP?Vz|6LIMw?P@iO2cEowLD7m_qZP0==Cxcga&Y3gqcm?oen%)KVtjp zt~BO(tt0Egd~o-nb$(R8+nz7?wxRR|YE`Y5Mexr^V+X$ldP0R%Ya&M}AD^MU*E{bH zffu;o%|Ty7_SWNi0jNj-;O!`QsW-CZk3uBUWhxo7MaD%r(^-y$mZGWcM?nQ54?J84wJ$(g|X>Zfk@Q^Dv~)Il zF0g7k#d}4ztq8NUnOgiSR~QNL+`IANJ`6VIQy4cfGLP_`Fb8d|yNF1t5S+CH93A-A z(kH*mL{KA(?cKlA0n0jU%uP=JPnjX(GeerM?|P~K=yVT2${%G)1K12}=N~&Ttc{y3VW_u3y%|np%*3nEcn3oD_qmzN z4nYdM7$f0=F{gZBU)jEL``toXy~*McpQoLZbol+)Nhmfasqbc^7CtgqF=Vma(_Pnu{US%6S;?zod>T2{b-I4P%pf zmHvVm8<#VxRFc0y&pr5SOpM`HIovN(K>Ylx3O}yV0+xN-h5U^b%(OO4uws5N^Hc7G zB`C4T;lG<6Rns&#QDHAbnC4xHmImp+x^bc%P6yR6dtdU;QB4GwwSWCMne^ncUB!ki zw2Gng*CBS|!R`-0HPw0f^7MIjo3~z2xWxr;XEFoPUdg0_E9^OGfCl!eR|Jqjwq%f@ z%H)!9plmL5O(B$yXr~cEpD8VQ(zcI>g_j_`g#R4D-ga*H6EyBGR*yKPM{8A6Ve|Pe zd`5Kst5OfP>L*4O=aptji9pqh{4gsom;QMW35tS=5FG;w4rX@MK6mfb932V08(u8u$m6)7S08v)VV3`LJoa@gl44nCelgFaW zr0nFa)RTJqC@eB>NfaaLzfIoB@f-{JZxS)7BCl9SRR#+^+uT2l0#gW6zbW-vI{s+C z8m%7*5IT{}Y;~Yae^G9|Bc+VpPf9vLaKk@XDAv|T>7JY2GtNBu`YjinTT-nu*2jZ^ zj|bpN{KC^+ce+4a{;J$y@`0yipN?Nl%Nf-Mm!B1M~?pC*;Fg zNuaJ$2||mKid~cZXjaOotb%}jKf3KYP)?&k)Wn*rjqR!OI2B}G&o^Fr6R4_^-|bMZ z66>O2Iz5Y;j4u5x9i_`w)~vfnW-gagz3|WZG5US4vX- zQzp}B^~%YAcwhS4>_mwo{kFbkwIC?gx%Rt|@qHw!{2aByei|;XSSL&G3Sprv>f=8Q2 zM+rzOlJeML`bw({nbEa*A0{rzO}uWs&s1Ri0~q9g;2Kxk=rPVjOsCKGb88Gr(Fzua zGw743=!2B;#EtjkLr~5Kx&#^=xdWy*=?cHBK-W%sA_{*>+kJKU;OgDNs~EeOz$ODj zjUf~%UnXa_FxuiTYv*8}BHHo(8y!Ep5Zh~GF$@feD;=7|UF7AFx0OqRV0&&}W_>?+ zgG+cJXlp`tIUrWJOs*Q|MI;J#vsJR=5$p-}U%wuwgcTB@Cf!OiPVc+M58L8oWZ!7O zYLwWJv@Zp)V!8?u9dfn$+suUwDN13wDVu2wTJYk~ZmEA`^~jDL?sgTLtn$% z^$&l}(LPKhn7+2;?E8-%2`DmE@{#^A`*XC4;2XzaK!9tkGcwGd@DL@U0Vn3a8@rX6 zr)!)9pJ7>0;^Mjxa+pJ$%d(_U&x>hUOXyQS_}$+)-|n;zQ%T{b1)RgkUL^fqP!h^k zJ&8lWTDM3^w$-y5%R&=^yHdN6rg&MoZ_k~xuNc!T>}CEwIOa^~mBc=KjT?71#afwD z{^Q#=)>e0*ACS;w#0~R_kYh=;$j(P(E!|5^M_n-pU15C&>q3Q-vbn zCaxy^YW?f!uk#~^0J5CQB+q1@b)!P8P+YF-bvDPD#&wXiEB;RYS`Ih5yEOeEK zHT0o9X#^%suOk(lfs9EMdEV!-yfk=pljxsrM=E;K+Q? zpJ9{Kakg)#y{g}kFl#tU`N>;5V@EmzELp5}93oZ%N)%)KH_LFYwAEaz^Xqo&^+Zc5 z>_N0VE)LovMDl%9=08E!IwU{~Gn}fJ8%`#lFGiL- zDX-7Z=Q9Snk!^>k6;UIpn_xmH|J&3<&Ek_uqm2`dVf1iHN7oeGRm0MHuA&QtPwN-; zV^hSfzxsBT>Xg3`rp-zn2HDeMF@yIW6!;5?+JhwsP>vq*&8{Vt6IR1#QY{D96tbcJ z;`bu-F@uzGb3c%n8Bh_=Bo;-MMDlY4EBJL*;lUGx9-^a>P?M>;{dRo3)^5yXB)Ig& z2(NV=E^HlFNIq}vC`;tsIu!?|72}RckJT@CS%Pm6E{EYdAXeN1g0W*&fKm)i8B8Cq zy5Q-!Sha`MgzbsHMQFIg-Ce=a?#zNN%_SgzW1M`9cKfjz(DH5TQWp zzzCJnTIIJfMkQzHftJ)!&qi$s!OVPP`Wm}I>BZLou5iW`Ei zFaVwJB8zsWjz*GO)3GBn353v@D%L2A0lzt`ieq-O$@JBYJFq>t`lgy!FPDPkf`o(4 zqdJ8ri`K7HSAA!M4N`kAKIVEctCsnt&V1PwBhM`-vbrNB87AgTJZ1Ah9J)JN6v*Ig z(UPsFJQM(wZO+a|MUZwZa5?Qa9R~9Yb>+${bGIVE!}Mjpp(z;PMut5RvHVG=&#JeEf{Z_N%^{bDng|(K{M9m@-yD^?$ zd1?>DB^rT?h<-Xqnv~U(`IQ`DUx86?zltn4G9z@K4su@)ny@bmUGql0 z2eTOIYs^WGE$9&>@EB>V6+}Li(C(5AlWmRVh&|CtT+)8@+j3kf7rjRo@{@TQN#}{? z9u|b4{F#Kl?$`NE%#=Y`pUJA17e|=BzNp*nIQxc6E`KCe1-!n=6uBi`if2}Z`uV4dEXXVE z&QN+_cOF%y?VVfrvw4?vc-*Oo6;<2MqHoHTRupPYz2Pag?E88k>#8GN_SpqbSCLTE zOIeNU&~aCS|6xyElyoJlNAo)G(Q>n2beC&p@)&_YEoh>n?3^FP{q@HGzsmgMGzDln z4!=-O$Y5_L0z`srO{u*`u+)4e_+s$WfMVaQUsQ`^K}<_bYudLiu=>%? z*chL?QRi&&$J%t0%)Np_KxG7%oMb>dbRKyUg0Ye10kdU)K%RI6@2e7TNWw-|d-7A_ zAyMLh^N;~ctjsYmzrbA^!m=>?Y|Fl^{P8v-zK8vt3Ho>^H1v|~zIw2M0J#Ma9`maD zHPt}NsugSzhy$rqzjBk>rVT65$<>Tyw+*{ZWR&LFk0^!jKgIefO;gyQsDiVx+UOsk zHG97&I^e*?7c$EY_5G(JrjY_jYbJMTfu}318-`}@iu>9N6oEN=MkZ7(9AE=Xo#QvZ%LiJpN zorpFwCWX!rz*EJZZqC<2_`S7u25CUaIU_VCLQQ zMtJpbwKwQ58xrN=$#4rT6#u*A+`fBz(O|r^S5BRSF-<|Ow6WJImHdR!6)r?Udl=v( z;y8*%WVHW?r87eUjBHWE*uZqYKFb>v#N?P-#Z$UeM+ilz-|AF>0Whaw9vOK#bWY!>`^_fxvx3?2L9E=51XSzP z(1g4i3#HnIDSng;t6fbv%Ik|!QM4gMgry9HJk{q;kCMQL?s&c3g-AsV`64uoeTdP> zsdwzcF+~!pmtbSVQrYSJ{hK(QS~0=BdAn$goCsV8V}6E{!8XDB0+mw6QmFECEoZH} zKsSKy=&Jx#JvwGrpE^VX+1yHg2bnU}*7&iG$@0n`iqeR}_+1xLp8UwWv6;W~$_x3> zSs(AhINt_2NJbs`_0Ku-9F{(%iyE^n>fzh*@K@i(_M@8CwtsNtia7F(bc%Q@#qNV= zQ0ja#uX~+t6EVtkw9Tg1$E6SPglxk&<~+tX+COjX1~B9z$*cLS23^mt`&vR~+RhcN zs^mrt*S8W*#X&ftwzz=v$%T0ZK*=TKXetZ9%4tn9|4gGQnzW zM90|cGnN9NQ%SlYcB2vxg~~8ad?tnHLsSh|DmH472d-t6?PS~zDyf*bmP2^CgsADw z?6!~(fDGDBI9j2xNQ;3)t_TzByp)BFUMy5E8S^k&Ak`M$AtzcFD>{r|C2E>_@9rbO zzP96|@c(~&$Ah#c@!Oe`Xll00Wl19sBS}kB8o#aQ{bCYks?g9Yxm7W$Ew8b;Wo~b( zbNjbYG3K?0?w71-X-Ktk!A6JWdXBo#=FM8P9vIBj84A-g$?}4adab6JdLsE5r>tMC zWHRs&#m~Y3b!Iq-4Wi=CFQGb&+dan~;qNqQ5yCI0%7vkJ#%mJ!w_y-*s_dnw%n-Z3 zsP&qVVw+U_>>O>4(LMcd7f~y+opLg4n(h`k=OwwiZYNnBK8ITnWN;IO++V$@KR^M0 zLO5Xw@;*!Q%(?rs_Vfo%z=EQjXdvJ--4Kt%w9@gO-|619z?u)_jsCyaXHRPsrUE+n zAqT(He2`^r@FuCOX5Tt5qm&+SAb7dLj zLHUahlnm+Al3#6LVLEbXMC~oC1(|0^y1LxKiORYO7{u3ATzqo|NTIqdq;TKGDG~KM zKLj{ksY@ja2v%$9SwNQ<(VpSPe}jA;_L5p~)kwN5kRb(99`(^E8@SeRUY7x~V8I{B z@~M1rzwaMsPtVxlku6Mav_&N?`j;%%j~WN@3denRd0wBI;7XCS4m3$dA$Sfu_rWBO z1HoGAKd41x9-&3Yoet8Hkf6_Vi<3{-1P}$%He@(5rvBR~k<;HjZ)Cqr!JF#Sd^Ns+ zG1S>7FiF@sCA6yB0kwjn81w{lntD36U+g3R-roPYp*V;t100Qv<$?j?8|pUbksSe0 zxYuJ&jAQ@eg#{38-+Xz`r<}8Qr0?@7AE_N`gg(~~4!@f=VW2x5Kb;J@b!8SPj@$p| zy4YOse(&m$s6M4@?8*k$&U*fw&>Um;II8~TcK|ZJ)a)xGT(a|m+k^K6T!a*2JqI_H zo{v6}m@Fwp1(5Bcifbj~!E}c@GO69#kgShgEWuq-6f=~sj=So)CUpJ+4#RgdMc6BZ z1qcL7M#S)q`bBNIj&-~&cMP7K{93EIV|Tke#W{*@>npi2A0#Q@=HW}};FGO6f|fU} zc9Y!Wq%Ae|H@i{^BaNxNBCp>02Ikt$+!47E4AX?A;;sVmTBSrH0iuT_PPQH~_SD6U z0V#FkUux+=yWJ~a!vP+ELCBBvohmk|f&;fgC+lpqlXv=oX%8=N1PU6(n7t_+DSfrY z+!MmNOzW{i8ajti{b3b?6cZW(+1yHOXQGp$mi4;~#6w)H1u=8cl%~FETXuNE8D+G- z?l6Pz@- z$%J2G_x{;;7rwY-ThXuv1K*ofId3Yy{5fn|w*QXKH&jlc7}2&Y(Wd|MP95_X8ivN3 z4n9yUwY9=FQ5Znl!S+~}$#gkEa`n1IKq$zowj$nCMb_)qcXHI-k^;J3znp7V_tSIK zwoUdTb{-K|FF|wRnjAmOKliabS9;iJ;ddsIb)S>8x&$0i@;WFH8N>7guUZ-@visVY zlj5x1thkDZB8s4-i%kh5;SCBastg)0IDzBxOn|BGW$B<9$I3Ygyp zZ=e8dXR=XjTh7l4f=rJS&+oqETA|I55u{-z-0-yF;t%x0PHk=f?XVahTv5mP-xr*g zeZ}ASo8Vn~=6Vr{WU_JzW8_8R^}`fgr_*V~-5ipwT`eiI(ngQ=E!+FTXT^2i6X!^s z3s6oPmZ+e3oe|bRD!QUL@Ogs;Y?%%2LZOb*?cJp>yqMQh=frWcJsm6N03zq*M3!t61URs3X zmMirA3|c*R#mh{=Sfx&;{V7aFt9?9D45{L9b}e$m*0r*+pb-u7=|VGF-|yTFE$8UN zFjc1{2_8-M_0DhiY_`r^vwIj5HuBroo%W8{MGOL5mz%AsgwY0K^9KPuO)?ioQ(gaR zUL74&l?Dl{xFlMShfpz=CQ>X)*ZWM?CoDU3S;ip|$5Mz9=82*x>C^WX|4zyJ?;-U+ zry=|SQ}CapdVeP2na7k_Q?p&Uh=1bt0+t)lcQ{dH+%@;*2SoTZ(x;=VK&H2Qdx4*I z)Qcw5LL{4bxo>9fz}p zK{@>O-_x%@y9Qpyt16*T@AV!~#1m~6t-5$S;r8$ps=xg)e=_pbWIq;>Z{x-~%zEEY^b$rD4e7Oq;cf4fu~SBCBhFgE+OBo2_{s2-G-t@ygL| zEd;j>7hQ`HKG1jIgy@AI3(#S#%Wk+P>*^y#Z(A_;z>1yr*Dx=ogmc-#LO=VX?ruXN zwziX<27_m>9t=~uw|EO6Ye2RFd@HN6IX~KoU{bNt8J;oSP}au6`>puwpUwyVOXv7$ zKYQ}O4I;m;ht)ygaRSqabOZKoItrG!#{`I~04;rnR5S;3{a1ETqnqb({pEJe(=H>4 z1*Y_=viQl2JXc66DYB*p2Q@uDwGkPIU+^)mo*FGDDt02Fd)$7+2x)H=fAi4IxA3r6Xjt9)$lEIOBj>UOuuT|Ri&|1O}Keec_&aFQ33xx;PYQ~>M{DI z&|bI=w-Qz9?*N;jKQ^&p-n(>Q_54@;`Yu-3WBy`qk^rcz5giMHTxYWTX-^2H=w zgE%6ccYW-7_o2>gAL&*7N6ZMBZsa+#+rP~QpaMF+Z@+-Cn#80Nb--x^l8*m^3i3F< zo0f46+~2>+>n$Ywa7<_KoV>%`Q1wj>pyjC*sh~(N$nG>kN&+-0*U2;pm{%BRi3L}; zOtM`S^HwG>mt>SV44X!KS>jhST|gG?Y&=1A$IA~N!lnfy8s{cW`PpRn%@aU&Acb=V zR>o>-x3YbaNX|`l+9(QF7ppJ`K}Ce^TH+Oszz@!AY2rneNO|?tZXR$RbR2x@MlWT+43S? ziIKW}o5{j3QC13V&n>(PpG}n-DInC{GfdL#*fLQNA;Nmdkvqw6MUn+_Ee>_Fj_DER z@~sx5S+5qCL?)AxsRhXco8p8(GJleT~nXOH;I-s7|;v9OhA514#1*CcN(d({G1smvKl}?JYdh>^(tnV?(Q4s_`4JV;7Y^T&>y5nRI!vh z)=Aw$QRT0WgOS;(*L0LZ|As+@a{YnfRSZc|ZMYn_s}aPNfg_Z(z->-}ff{l2aty^m zby5B6v67#_?Zy-bUa~eU#U{sPpR>c?vBEDCZhBk!mbx-o=aIun&nlpO{o7DY6VuI` zkaJ?n?DjRiJ_O9+1XN?wXiKB{sa9pF5L?brt|rA(fT>;wWXwkY3Qn%;qc>wE1J-6K z*O1IRwrqo$V6couE9To0sdW*NIT|)x5D;W=82nMFm%xXRBdT*gx9eck1zq4RZ}%@k zbd?m3$-uCMFMk|o(6Edx8>6MV`S?$00(z}==@WY`vg~#FhO(*CT{PjwNf0n&y^x9B~530M%nObdQFm>+bz^6&9_36 z?^~g<0DS3MIVp8PZd&S2WNx{+B02pQ;uh@d9lTu8n{5y&B%voHhltxMn25O@=WS`e zeQqARnk5TR0;TS|1lXm(3o(O$D84zw{bhgA(b)o6E!7QfY0SP0qPC92P+Nug zW2+4uwLWp8S|b>{5+H8i^3C;$i)(@uSzKyTBfxcN3LIpFfMAa6)y>!c-hMVBGZc7C z-fN6;Bh0whkL2sWQW_xv=CUO=f35$s#2Y|1Fc&h*!_oq(N*L zR!Z0`tF16#udF>xHB*?vE};?Zr~iu<_Ne1H2$I9V>k?mSB6Q2bEwVK>KdU4zj?s?r zv02{Z=@5+w;fvW1B=5+C`rV45@~gzkPD86WKoGUv7j~?ZQO&3n3^#7octB}Ag9Mluyg?M6Lz5}!rGm>F zu&)ablPx0OiO0QVKx`R-SZDy!Q=Lp}xK{n+g`$fj(^EPu$fde5*@_UvmzwShj92L$ zM;!jXvYjq!5FdnSQK*;4Fi&(zT&=cB%M*ljbmkpvQ|4mkaWf3Mm9R|if)-c z1WkbN%wP*`5qo|o05LW6Qgz{1*TlV-X&~2Cz00q{|9gra+IJ|nyIXbqAt?hhizOSH zI3_U@Xt?SVDrhlTVNqy`>1p`{gN!-o)_#N)_32qH&fscnH7Ic^kPbHt!J{Q&w=i8U zxCzQ+{)jr_Lt4xi*CIg1#X!H&6ZyWYd@BdrL@`|!F6iv_onB^vyTkg8p&ywT&UpN{ z8?*!@A+nwQ8AAx*nfq(I){bcATuh6O$&ItjHZ9qYdYR2&&VUA?JMZpp@XYe|NP))3 z#W)%_1VnKn6C5HLuQGS6wcfmqvS9~6{Y+wphaM5txqI@3aLN)&f(-$%Z9u5Vh!qcq zap|A_g4FT!)Fz~_q|?&+Nas004q1_t->GR-Z^(dwZwsfCjZe2??wfQIQ*g054`Kfp zRZ}f$DZ*3yi)`>isxB7Pq6&Lx_^vyV#V24N4=aDB6l9q>2h4fQQ0`x-o4Eb9 zvnn2Yz+Gp**}=$19V%2bg&Ma^q{JPoopn*5y_|BW@&a??O;kW=laC{`A_`W8 zyz0DsMwQ2lkGqu1fkkc|Pb*jymnpC$#Qel-0^c_jS|gG~iOL}+Bszy?rqjjWsn5_` zW@4RwQDDjy(_5uT(e#n-@}@3*U?u~BLxfUm1G*Yp5R~JhE@`~mXiYSdE?MgAec*!c z{unxzQqbElLs0qCof@Fmv)^ST_chRS?4m$;fuw_%Cl6oy$BY!pWHLo&98DyNf|m4p znMOpmv1a+=rIr{SE)Q%+p8eVlpLIXIp5_uvRQ;K{49gHnY2@6~1wCcJjV)8JI_f9H z$AeG*wXBt#at8lrF^s0LG({>0`!&siSi$6V{`Kv@!{O$Gr7vWB*X@lbU%FmeS!dIq zp~HXFqH`XjPa#E;H65>BZ%=vf#gqY;M`}JK2?9*X*o1cQetFl>J5k$VMJ0OjS2*r; zJ~OJpYC{AhX8D^myQMEa|B=|W=z+`cv!V7Ns~_o@9mv}gLV{e8OL62!Ek`w1%fOhN zCLf8j!+!^P>$7kQX(Q5`Qx043Of>0xcc-mqw?Vpb;4XT39og5+R8~)U6i!7qj>U;c z8c+X#5pFhaD$@d-Fg}Vk=qMqcdT=cMa)iET9)*?yI;#N1yvZW^$2sXFVpGBU$NdKe z32v)PrAdv-qVLjay79`m?5L=w(NUcUDwCLzq}_uIU0^I?(T?7pAFg!KrrJ-?j79a- zL@$O#RmU4+uY|eT$w^dTc(QPCcc!EiZl62bb$TsPsJ}9M{lu;sd6fyye_w<;<*QT; z-3jw5m-o0ou_i%z!umB7NLg8*u#-zn!ZZuvShf@2#EGS{%SW=qTJzg7TTDa5?aybZ>)HdF5!L9|72<5k9(3B5+{2GOPCTcYE^tggWQOIB7s9l3eWm?R=6JE%WLBqQz& zXQ_{qcA)%K;qo~)r#uQ{MFPS-hIjpMGO&n#yh7aS_JQYfGwXRpREBN;x2N=AO_EvG z%QQEXr%K9w?EzkWxsU!smO&S2tL`vb6s<&C!O5IjpC+E!LaGASMjZvL3}cP1`B(M*lxSvw3k)~*~?nQdd;6C zAP46|Z*K$muUZ{kMUOr4CI_9M#zf)0 z)_9-->}o*Rv_qu$HZ_(Ly-CsYIy^i?jbR<|()rXlZ!|nC`UwL9Y=99Z-zJwzB^vQs z*p6Ea-0Uu<7IZ?%wcCo3N-hgh0#{M=nEUwx0} zB1ztqyOx?nd22z=X3qO}gg)9jE@R5$9(_EHWTC;5Fc2n_A(~&L<5@!H1JSqdO+lui z^ua(Tf@(^6Xe?_R!Xj84|7;q4ah!?r=0C~`>H89$qQ;4Blv(%VynAFc=2PfP4{Icj zM@zVk=7eTM59qbJGc(X~oru%1x$K;DW{Ac&1>P3PSxi}auzG238P(PnYVn&RNS~*>w zRkuQ3JDXhWG8G8W`c)OikHxPMHYFB=8|%%|j# zATQ_)1gSVq6DJmy$xM4N?EbO?6kMa!QN)>9o9^o9l7wa8ZrJ73*gk7EVtxR!!JJ1v z9d_a6R{g@_@o)Nqf9b4d!F;y<{VqWYskCL6-Q-+dfrf&Y{)2E_+{5zD>`?m1rzK-l z9>uhfDRDR!**V3_1P)l?Z|~|)cO;r93DwDM!^zIllmtz|@BP==B&|E2J<%C7e}w&(xk^Vo z^U)CXoW?L^_OYHVcq|h8>oe&rl7AHJfjaI#96|yvW!oz31?t=yK6B6C4cjAVY|IH( z4IoITs?Bk=H7}b_!ZvxxO1@pe#bi|@{UUmrc&UZ9-XJ<>hSO;SYP4vE@Yy-USQdO* zpF65qaM4<-(>LztQGgse0zN+S{KXnV*zapyd=Wk^q;=u4);yBx2OS2G?&2=o>s?NE z8X)l6R(Dh??#I-}qr%^{4+{Ph}CF@oed$!>U0ncwZb(>}t$xhM~{-Rq5TI{!&qZ5JuVXL|r zPYHK95{N{d5qZ8B!&ly8ssMi8%tXX;StR0{|2u|enxG7ge~ADa0N@CCI)jM}X%L3L zj;A{Vu<)=z-9uiAN(_f(7mIoTr<~VUm@44YC~dHLm9`1Ic^G0{N>p=r@fICvpKxYA zua9W%U4J8n;-k+VBRlTVs8NP`MBfVLAb%j%RBi>Q7ToZLp5x1#zJBx6W=b>zYep!i`L( zJ<09?^d3Ms8Q8f;N-XR3T-o(aLRk%&1yhU#VnC=xg7R~y-1XI^AtptZ=}cLqa%3gp zjj~%;nLk~J<6xNJL&06FK3V7cAtU6f5ak3W0sLV=Ycg?He9GachnZ4aP57wDu7khS zrl|(ozV^$mae@{ZR3+G*C>6nJ^t?gjT5_iRrgIfpsCZjws#+{SAGWP7k%^m_=HX6M zD-(B3u`Y|%e&up^0+Igkj<=_dj+fizKekmlUk@{eENAeT&XhgT8aK;0alFU9R|`En zh3x0c2`kO`T|4v-sz2StAm;L1nH=-vK14|?mt<6SQnvw5cs}{I#FIZgGKgRN(0BOL z=-l>e@}vW?!x-yr96IXasEn=HOBu9`Ye6=5|L4?SDt=R*gBXaB@Q9Y_ZY5TO_vQ3h z`J3wTGSPu_C4(|zf8Tm7+-+*dv!!5qv7*0^EQ!YknlVa|N;n4wI`b_O83NGvi3Fmj z{HazPS|@pQ*hS#n$!aq?UX8il2vhAd@EF&OXyZaoP`hj*Nf`St=j|csV=Vbkm4g2S z$LQIVqd7+72g07SRspac%lWIlsMwtAH=9#ByMZmKjO?C5|Gl;qend~BPty3oSJ73j zi+Zll`HF>irs~IvLK$X@4@=l;=|4qYwfYjymdtdV4eHDUj}vCyKZ!iE~ldxS7e91CnRpoC3f3D&N9xIm<03SZ?)9F zGk3XR+XpgV{^+~BVLbL6Gklt|b{37DM?*+d2`Kax?vk7WftC)>juR$-g-F zEJha}tjSrF57g$8<@nUjrmR^`=ER3|sr^Q6jUYZCO&g7FP2SP54RG;S9&qI=lT1Q*!&3VnGhmmcg^M~5Nn78kKZlQ=yVg<{s-Sj~eG^;JK@pu>o$ zdx!7*OCMdt>ia8PN^P8V8LsNLFw<#nY`&Ir5(FL#2b_q7=@Jv+w3q(1%I&p`CjZli zSSC*U6iC!Y1q`F0L~eL+vgR%I>IV4UYqbHsN#uZqb8nai39{Ts)Bn4vG*+o!9J!Bw zc@Ks;z6kSP4X~C5Bz>an_Fg$MO2x@E$VCB2qDu!GeUEB#UOf*L*j}kKUvcoPbayOT zPGD4)cjRyA#pR@ZPyT(~S3qPR*}4a{#tSv#$I+&CCP9Tho?7PP;uCNLgxoYI(1b?A zRyoZc!A-~GVc7W8A`YNH7|O4A&$a08fzlHt$cf4@zzRySjJ@&6lu%yM zJO6#Mexu6@Z+nOn8K$^k)29|%xhds`UlWvRAaj2?81$FkRkjhiyWW?0-I72!<^TM2 zj^p*wUm+()#p^p>E+;T{R8f22m}SUvcBt&ril=b#s;A&K#2xcDYguhX{r9wz^NoA3 z1nnxDoM4R*s*NZ`n&+od(VxP0E{1>c%wl20Ua!%E2<@;dDu8gulk4y2Vc-;y$E#= zBX4V~&TX~)lz?N5l<-|eTWrJ)OelxMV^6p=n>FaQ5zwI$q+pOSXcnhiQZH`^mnr4V z4_hOKT`xjPQ%)T$Pr;v1f{R}5>-7;vf9RZ`%|JxV&X1UqzZ*_A@$TPzG1IwdGL!A> z{AV-!PDyo_7%Je0X$(4H1{h>G+Z?A<%=+H@4@P1oYKs%z1lvCTYnHMLza?Qp%j-(y zK7A_T&w65{2H6W#4kSP>EoIjA%4J;8THXIeeI5IQsmKj`}Sjr?$%q6k-a6eWst+gUhtNXH4^T6l;` ze3yt;;NnXwmuXI2d_WT4K_yQmC(F1(3<7(n%AdfP z4Q*rijo*+|50`KO3I*R&EE8cAjt)T&U~ZF6AR=z+iD^E~mip4erCVm$cW(KFy(I$B&81mVS{pX3lWdQ$oY*0P$+u_EuxX9|$N3 zrWH18mpQ2uAW0?MD5QJ=GZ>yV=uwOru^wBRz7_Uh>s{f7IA}8ez5@UIvQ_@e-ifMC ze0bJRhsX$kJ%NdEMc#?ucu>2}rul#qzi@Mzr~3@v&<9~EYvp_6x&9daTX!r87s^~J z2|EH8^B~7)%jQs=?7zzG_;!1N3rGLu=Y@`}Qds5yom_$#rxk`Z;7)sdUSfHu(QbRE z_AfB4B_jU|o<&rf8Mgo;9B$!UEu+P<`8+O~7K2GlUwaEIu|^8J2F$h@Hg}_KE4o1u z^s4;O>L$#S*Il7K#3+rFM4>{LvXbEP;j$-RJluAn_d=rXk+u4fSfJ$&|xo>T_7_SqM*(cI?y;KblTqg>ok=C0 zF!Y++mjyYIPX&<0$qxNg1Dc2~(FGl^pR<#-QUN_2(W7;Mkq%|L14MPet$@{E)`W&) zu`#|-d|yyV=RTWNw;$(JqFQX~aX-5+pwEFpw}917F;!nC!skOEIc3K!6$VnN#o30} zm(+p>X83BEKXEpQ$|9l&T+^jlT9ji_{D?wE76XYD{wy2N0CBA2&awjop#&tg`Mpf%wocCd^zQU z7s=@8Mr;Sv5#rx+QleWb3oS`wCrH)%-mrLcTPRhrH>u_t6NF4kjf#byu^o3IB&sm` zZUKs^FiOtH=(5r5#^McJEE_TQ+)2)f@&d>Y1AmPpDxn2Xyi&s?@`kBBaBXV{ta{({ zW+)K)D8_rm+?t%MDZwrb&->ZVBrvA4*O~iyKlPXlTsZ{{CKMEvio_3vA`E3V@1L&Y zSRZ3K8MxmmQzWdz_5~hv4$i#Fp0GKjPNa~)S+(g#${1#P7O|6!j)Ksfs5pI?quC)& zd7Mu}fi5;rtGCQNz~)gD02>blPMTnpt)^p&GJ__Z%gRABtvrlMSmLigy z!Ym$e%Xd5+cba7@B2_v_qq*EJztR9Dx$GpxQ7bCSYE7#{xF;D7F-Dh}nUplq-V#S8 zgvj@4!bt8PhZ}q81Rk1v3$Wk|DTF19ohQahcbpsz<&xCO*T+R>s}A&{RLH1v38dlW zHatWH+ceKi2;#8JkuJ^uuD$S&W>RYkSY-_U+|%W-hXkX73(=Jcn$*BUjiR^HC=#g= z;tn>KN2e1iw6nLLIjHxi0&;b*PfiUNs+D1s<&6^_LF+#SSoz?@&zbzj00Txu2Kfw`^d= z{lgb4GeV}@0*+AMQ0JJ9uF)5%S#t$s3hknVUZAmgdMH!sp;at8z!Dcr=b+o^-H(bF zHT)}{$nW5C~)CvA@DzV*{d<4a~&@)22*p*(0>>u z?j=aT0Pxtb3q9w@PXqfXx4h|Z$1}!cmd>wQn~{?_V3aaIB?UL1o5_L_0|YmuKrwky zU&D4Rc%b~)pa2fAuS$gIE)ts}X-ISm3F#C*YggFraYot+4@lrQrV)6bdfm!(SrRR z8KCS`H~m#AP7VGBgAPx$LB7wD?2jF|r-%`YbsbxkbqTveNoft4ihmV##t|H#LM+us z9&OKi)*Ok{suoNDVih+#5WX?&814jGu6x`)06kY0ADXNsf$F-v-Y0ENRjV7CQOsXY z5F*s*7K-n*P=CwP4n&6FxO9iinbt9DlkBKX0x0qF;Yy~ck2|xl2jp(*D83(VMG!7n zL`|ueP2lSEDIxVU-j^}z%T ze-)uFDG1evxdecW&Y8OS&1hghgH3#C2nq2Bsk_SKInHu}G@~TY1Oq0bO$W(NUM6sW zC{UYO5HQK-lSLo60OadSA7zSDjhM_|S`X3TL9;MBTG(FvATbesuB-TEteHmxCDxp- z|Kj@n4tn-`3)4Nib);(^8U0y8pEB4o(Kuqq+Qxu&jBv*H;#9zIOW?iVy5f7clGCx7 zxl!`2qsa)7?G!U#9r%QxvsnM}yQ6;H^qQZPrfJ7uH%Owv6_uRyA2Y+$iz!X2rr z@iIdgkyd-q%6o`Q86QExT!>w8m0SQCEz93FjA_QD z#Kf=xUGpXVPO#LS?a$33k}mA*uLCdrtJaRE*8fA(S+KR$bz3xq;2PYEy9O`v;tq_#T|+}6u08g_NL$S+`o|Iob0{UoMWWv8cp0Qfv+^HyF5P8#dfG4 z67oCHvimbh{aUUt!yVYF(Ps`1`(lmWp*i=?31O(N+z zt=erIK>+mlIi&g%EgDJs@RFd1B~Zlx#l={wN}6e%XTyfeeuhl_dFEwHca}Q}sZ)3c z^A@*;DsVKhnitTNSjU{m3(?*z(CO=XQJq)mZLi<+=0PH$5%0g6=Z;|qgr$|Lovv;q z91R2`{x{h*X*RG2aWmhaBiYf6y+%sb4nAW8+=LuJsQ}1|tJ78aF^D*0=}J2ZZr$C0 z1Ttt91!Bz9Q4&EE{wU(uy{oORkM44X;iBmQ>=?Rx3p+j@@4x%&)r)$bRQ(Ru3wA%b zWZ-k`zF+5`q{-VY)u>F15$}nbwRUNUlacN?urn{G!4bi zGUuK0(tkIV~E9Js@OFn#8h)a0JBFS zz`5Z>3Gw<`N12XmsU(r3^BjT@hW?sP_qDoAjhUT|&$Ysb^H570NIb(~&zo-N296t$ zT*2#PEw<3l1a9rqM!LVjfngaLOD+-PLl^1fbpsZvkGK!Tcy%s zg?0I#xG9V<#+#PX!KQkmFvQ0f%)PtWC?gD6$;vcg7=*X^PcwcZGlvmA@6tG3m{|&# zOc!MTQ@*rS_4gmN5F&J18?b=y!@0@@ziCX#yrQ%~i&(&ys~QWkNCXjs{}>q=>wh-I zR9)S|gjqivq^pJP+=jnYRHjiAAvfx8S=Ucy`-P~1kvL2^-~Mzp#{cz@oZ}H^EXXF; zH4~P7`ez`l?Yw;7yRS6=EVCHE6BDE05rPz<^N=G?aq`R*AcxM?pu`PUK0O-M7Dto7 z&|tMpe3TWvO%f#?&r|5dI6?BUe*hiuadhR3!!q=zOe)?n1xd-a1fysDLfG)0jy?-H zv8cGZzfF>>7-)ilt$4M)e_oDEUpcYDoM}`1y*bnL(N;l%r7wR8VNY!@3s(7z`i~lc zUdzMMts49Z2=$$blJ=&?a_IIvBsBR*(}evg?W3|#cQCX0T~cNSFt;O@qU&ES>9j9K z5tw<)IyeN{VupZF;%V{nwy;gEqfS!#ljt&#nay!ZHczs)G{M8!rm5pcYM2z zRZKcZ3TeM^e(W*WKvQ6c0^>}MR`xOYe9x`q@@P0sP6;oB;GFie+kx! zrC`1(I-?-Eh&sy6QQEJ>pJR%>@{B!RzTF>=kUk|1&e_eQKxEW&1+SC_^!qC*(ODn4-Rjr|(<($n*PKvrl!10Qa00 zXo*n8P=x)K&U(c8oGT!5o5S68sIVNBg?~I{@Aw0Q2=b8m!55?7%sCXI#16KaTy7RW z{u)xRVmD@LGD;xhkifx9OZr@;Fjpy~=Ns3f5Q(B^t0CO@_WbnC{kCY4f%+(HLEA?H zxAnMl$v<4*hw=)d3dOuTwh3DL)V7O=lr-L znDg&l_Bmu8`0P($CHNBReF{z`g7|3I_h&j=xpCM47W^1Bj>tbENMvU0?akfJhK(4P zu=Es?|Ks382aH{ZLj2TqP-D%dAnBFQ?_tN7ztKDWq_UJ>G}s5svZ&;zZ&X5V61Nf@huB~4@^nv@Wbc-6iEdw1~2cX07e$VP|sGr(lbLSd@t3Ci%F$$rZ(GG z>w!EHHe-waufZJOWOO8bLDmj#wlkuQzSxA6gBlO9KpQ;Ho(F_pFeY?lL1~1}OMU#q zTg}q1QRT|nqXD)Jl~^zVlaWlfy;JD}a6VM)HX`iT>P&z(Zz2*|@*=e3UHAO2>JgjKtV@!*ZaGg zvCh-e_x~;fTIa)Nz;*{pbWr|I+Xc5etiW$bTiCG~wjxJ0Gfe~Z9-w_10H5bmFwZFj zA0pGpXXr5md)=0w2KqEO+0r;%X%^vWL#^!!Fer@1v?+ZuEBq4G$nNo-@#~T+aKJeg z{&;h-cC<@`O2cZQw;|I&>C5*c#JY}JDyFuTJr1!%Y~jfo<@4$_d0k5y%v$faFc5r) zA?`amu5Tf+5MW8bhP!3jKV`T~_D#8()=cbu;D)icGc$9cizk75fz{Ji_z~cBchRHXKtzTv({6kTQZ>PPSI<+b+%V> zQ!`}G;Utrj?ZlZ%NH-i4S;@zOB;XiUF6S^>{b>B{3g@sZI zN@KZX47KrvVXeE^LPkYttQ%2m1EP2P3MTIa3MClT9oz&ZGUy;h4f%OLEC$IAv&kj9 z`qDMXIt0dIOURw&A=gT;t4z_}gh%FL2CAx-txk&?LDf2_VW`Dk#O{AIv=>FSM#|<> z5W?Y$V8@220jWZXn#)Q^+O2cO`yTjW5-ZJG$mt0%#hfmdrkvR}I!P0Hf^!DN56u@( z{_q(EJ^|jl9Ql_t5$@M|NyuAfL}d`OQ_?(jfsx86YHnB9tb3LZ5Ir)(9m4HO6 zd~%!Bq$IC7r72QQ`(NMQ9;JbDp%>0K7_#JEh0vaVwBXB;AC`NFe^sNUXq?U$N&KOniS!kv!I?cy^>Q8cZZmPt?Y^KGyaI z>&iTHTTOd??#rRdH~H1zQcG@qvBjNZDx#@AW$Z2B#FyjQ`Ze0gkWiFMt4wdOvT((u zf0K&Q6FXF9(|Leu!xw>ejA)N5>k<=DX9XM2yCXStR!$)&zqHLq3SI6)&Md4P6(8#cmOpqk%x@n+M)Z(WIWdN8&CZt@DuIFuGkv9Jz2kc?YS~DqU;hf@p8nR3a>Heq) zCXW(p<@*CVY$G%%zuIpfrq5llhU}12>fR@kT>Ty1?S7Dd*eB#FZ z8k4M$WmSD2OEe+CJ5W=El0yk$HKS)W^m8k+*v6Bsxf>d7)P538F7;|SqG?>6sS)#Y z6+0U9>`8SkxJ?cOl4S|iePu`SG&A(SU#ez|m-@Hqe1Rd^j&|SwxZJoEn`f|HxvNhH zwZ4U(K36NQm46+O3f^$OQen5$mU`g1nT>l z=at0Lt$FO9h&UQ4d_d*BdSAf~uf6guZw+13JkQ?GZ(;t!pH%cE`HL@j%-?&8_U<&o z+0@qwr@vaNsb)8ksh?4 z_eqvcP2&co*XX6p$R(tS6iiBNI{q7W@7aR20N1cE-MT5%$SPE3uF0H;OYD@&2%fM{}o~a^0I$y7EEegcmn0K>bSFYaVBi*=AruF#O$E_B- zhmcJ$D2Ooz1B18uF9NO}17^;M6F%o^_-7?>oW%gRa+=ylsA{5h(|Jlz%&RBhUlU1- zrM-Y-H45KrVF9;c(Q`&pHoj|jWXcx;dq9CWVNI7mu7 zv>G3O(dTflxz^v|K`-}ZfUE*MB@JPbj5I(joEzM8LE>$qA|rsL#j2DE#VX^uZtu#~ zUco;(*|uh8v<1W#>(M+zdu*srntew6uSWujE+dp0w7?f-~kceH_jzU*PF=cW#up z3(;DG27e4??YNYpm3|VEXk31cB&(qPrhw1yA8jGv-HpCt@o6%0)6}6f2ec z9CY8a9|@jtKFeBgc=e-MZXNn{k4*+&w8<{1|G0zOnLqpJnn%t)+02(A@QI&8P0nZP zgqR}UGxweiMU_o0Lp$C`&?(0kkBwb+GCK8BQoN_+90b?dm}9qw7`XD8hl6qoPZpQA z7%^yldC+FSaN^|Wa9@nYw<$SA%Vz6IaeS+22h9-@dr2A@fiX+J?uzTy&%l~dU93Jm=cK?R6DYD;12lhgcz!Xob3=3uZ5{)OT`Eg;T*HzX)FoK4Fb*%~!RpNICpGwpiA01O| zRv*i_wbr`_s-N7}bE+l~WyNHuOH6{Xqe+UDuIS&{{dYV+*4J0n)ptT} zl@ApRZ*ksf-j9ycXiccV{B3e=jk>A?bkM5ZMHJdJ*<7;RVC zLgMe9a`)I1q*d09ib2{P!DF3sDYigRbExvA#IUIG z0n1V0(7y(Yd{TM{k|*}BuB*H-4A z4_3UDiJmAe`!zrJ)Xk$1a$|8@d|;J-?ol+L3xs~Il8VV8e&F+`ZY@jl`0n`OB&`Xt z0{gDTwT8jglx`T9P8<+GXKB(8~^3s1>9fk>cpzCc;(|U)oNeW zgcdoPY$aq6)CA=Cd>Xv>8TXfH?qYt|X}!m2cJGg+Co6rBE>BfcEFZO6RW*gi3}72T zp5_Lm?4HtWI%tKQjB#9}S9;XODEIwtF!iLAvzWW})=JaBmN{t4kZH(@&(Hr-Mt2m; zt_?5)Vtk!112==;(!b$OAWyvQaRL*T4L{+%Lnk_CY{{ieYgHX%?z6@)k|ZM>v79un zgGO+8*>?v>kG7lw9IP8Jon_&#xLV-rt<>^Ip6x@~hzsnTPb{FL4U54z7uZKypm?jq zErNHN0>Ks3k@U)Tjt_-v!9l!!38{=Y=_c%`DLQd=t$2PrGvBegGRETvrB<=CPXs;% z$&S0C;!pVDH%~NCE*2}fRRJZ}-X31myT2F8{ICMC^mO>4q#d z5Sn=nw8J`1!+&{X|Ig@_vmlV-_N~KwxvYpCcNTZH%{b;WVCUKbkCum?x{}>hgy4VQ z+6~{=g_Mj1?5efh=^wekB~cjnaDMn3dnLzG3F`9LQJ4jy$t+%pEiq=mjeL3;57|uoIAx`Cb7Vkne{Ae^I*2U}K?&HNvQ@SKx)Y>M2Pos3NVMMFf5n5JIk;t1 z!~l`c<+~6-YMu(#T%0dlF^@@V!RNznL_xgO$q16tTQNeoI`n=WdS)EKmLCf zKy^!(RK;ha(5V2AOzPQ}3T4GL=h=4d0|;i=6JE35#mho^@TS^*)6^6Ho)-DW^Qi=H z$9qUONf8n8Qcsbq3tpoiT;XkX0{fRw3RnUf*kC91x!Ivb2#~#M{p;iSN`Qb&uxtud zAwweSF0=8QykH~yWAkH=kIEK>SbnJt!q0r(2aU-*!^}PbGDk;MR?b+a#FZqTN#k|3 zHBF}#LQF#Im@qV9PXYbbB?qja=446#`H#ge{Wf74sFNME<+8uRi8!HqDccl%e97Ly z3-XNJKW7Ra*)SL+t|lDKcIAlG5|doRewM%tZVdkLYaf#Hz}*NlwQ38r55)`ocB1jX z=vqEsq=m|aK!L7P*lpNlnJ0!gLyJl-o4;iHCf@T&su}Ai(LKdCv*Xo9t19e18_U%n zZG5s@eeS?NjsLxJZx@*$Sv5=vWG|2L84fX01KPw0C!SnT3?B)F*`?v&O>~hbm$|cj zis%xV?vD6O7k|*jHO!z*yjFEwuThT8x!dq?=KV1dy>w`}{B7!FY$$_T0dUm>8Yusv z(@|xo6P5;QSVRFY4N{BH+GKpE?2!bdC__ zG&RAEsqw(c5b~pG$eQ zHtMX?-aaeJOd?>m+LSqOK>h>Gk$S?&Vrmz=GbMiqLo3IaJ;*ancR)m_pTqE$Y%C(5 z97Z~Au{Vnp4vjsgTd)uS=VB&1Or~R;A~2$K_06;ax_e{yA+O;o;Tn_rowR};avd8Z z_oH$^4nS)9WQTbQ;j&Ltx(*TjN&|BoCoVfoR!G=Kxhm!a7EY`&uPBCvfS3LP1(wl2 z)omw6VF#S`X=n-F$Sq<0*>_?_K^_B>U-ij><6XbHHYQvajXiZ8Ikawi{P>dqmtC;aIZ^B>y;3jQgq*M5Yn?Y>SjN8ufzdoT!-LE;f(Ob++Zw))qmgNT2jrKU zt5ld`gbk+-t8HAWSQGNh8w5p&Gmd9FO6gG3%+If) zG}8V(hnh-{wsp2)IYwm~yv*i4ydk+HMO5b=qAP~GZI2?Mt3P#5s$O;gg&3l4fJF{u z+!45$5}^`uV8imDu%e^C_7$_=#ezBK$*tDm*K6V>;q8IiKLkQTQ68pl-;h=iLuh4# znsF6$7x7m0-5G$`p4=rrE42jmn=EmPntAeJCH$%G7w*%22MF$0bQ#h4V%YsEf5a4PT0 z)oc7%;ZUb9H4CmWZZ&C)(w&KyW;)w*%e&(0&nqNFr3weP_L%5L2MC4g;~3Q7L6@|= zuz5Ti(Mi|(q*$V_ziDG$B2&OsDYnG2zsXkM?FjAfM!Rc%7h+B`7wOMZA4)-YZ1GG_ zOV`qZkGD%nDkI9HbLYdrhM7DPop$zPNRP zj`FMkTCRn8$A=!Wsq^8>L#s;Jnr|eAB zv9`#%i!`&bDRY^opkB-4vx9KRCt|&N7tt*pdTo`=_qsGR7o2^PLDbp)O)}_6a5J2b zvL2gE|FE1sG4#G7nn;udE{*#yOYcjVo8?QR7>SYH#nb9>UqzB^$Gfk*t2U0?uT^J% zUJE1bx$P8b(S1X?V~O>@xP!y;0$_55tB-vP4%-Lq5LWyD)<;HvNgE0vk{%CNh#w{32%6_ms@A5SivuiMFUfK{s43?m%`b?+WLf0sgFMK3F z@$|>A&NJJ7KTMkiJ?LCW<%k8op?6a=HFMpB#_ zkul@|9w}0)gsqA6cO_d${ArY{zS$N;ZD)QXn8EXy^D!B|-o%{Wbe8oY$MaZRFOLK; zBs!r!D%>r>mWbTyq>nc^c-++WqPQgYT;~IEvqlyD zQ8u5jssx0xJ`Czz8CjU!R#finZBStU#t`RdbLwn4bXL+$oXa{Z3p30xsBSkC+{y+G z+pf{NOGa-zGS(X2PPdI2lf zQXbI@T$7-%hGowkYXs~6apG3i7pgV63ZOn6O0=WeUdNvwA_0U@`^di@DAC_{Ngn>> z)M?So?L(H7NY*h_Pg0M>4&rD9GE8RH+0ZyqOZ7v}y7oTZ)<$n6clYVlJ2Jfp)QYiU zL5i^j?i=tp(bCdMQ%Z-;(9}NE7TjJ|hT^(J^PURy3A)H-RzNSCKa3WIBCdMN;rAT*ozWea;Uc{t zw2HW%-uYmtT0=~c0GbgtyrgTo@L%EliW){+c^VPa0s8uZQhhw00a?4&cY89~#=DUT zn@6Y^(6{HzLRGVMD1rcJ1PDzx>=QV(+f{JFAO)TI15YXrqYj9#_?A~mMOX5#T&~-y z+I0s~;FC#P?uV3nTTpqm)wc8sE53ZB^nEx{kI(n0<#L5hOt3?$V(sFWqtketDoq>a zIhb4}O~r2y_ur}%elS3fkn7U$ZI5u~a`@`|e}9~fI%WFCkO_fB$GNAfXULfygF`Te z+@Jac|H+@g_M>nmPJnj*Z(M0v7UcG8XEDC+f-~n2^_~QHAx0CAFtj8OVVZsX%J!^z zU!_LUU)WxABOfTKl4)U!XM!uP0xr$Gkk3@?)WTvMbvX^{vopk2HG$-UPmT zvI=apou`_oVE}P|-1PK~KPLTeXvI7j{mlcR@dQaACtTGb$|B+;_UAz6qcia%1Cp|+ z_xrg%c{FM;S9z7!-qXL%uV@sLBj{;wEirGzM(>F|oN_738LW0b*VAN9Lp#_hrdW`e z0c7dO;b1E=dQLNX{^#!I1`3C+S*9IYHwI}$82vu|@OS#^Enaf>pY(T^0j0WSF(w_< zKj0{?d!T3#`1{_F30iW$)6kVA;C6yjrH0mrEBd!q>&g>dxZk1x6}qf_ok84f*+2o4 zZ`_%sbEfjYx!ZGRqrY-yc3zhFoB8U>G?%^S!eAio{`<#x*ZbQHvPnrMGDq=CflQbQ z-+kaqMd0aYqhgO=ICU*h-4BM&B8N;W{i*D(VbSSGx3qf_-{RTXWYg&a<-RTvx8`v2N*d}vr{|+$*=9wikW(4`D@kgNqHrk|q-ZDl z_ekTEcGQq)asRersxW+j`hbrgcUDqkvd9ODmtQ$TF{@O^;D!EB761Ko_#3WnH8*GP ze6>-_ zl_;UcKDIAiGi7eJ4f82tCmMDh)i6rMk+ekurlfbII4ge5{&xAqNP&i2g32fqai`0U zu2qN3Xwto>l1a`?W|37gZl|19hpC8OooT+q17euSq_kvN%LPoX$0Z^qF z&;f#t!x_Wq0gQ?T*>p1u0s~B`V5-c5p#AdhDH|qZnH#7~%?e=y`pT;XeIL+~x^MZT z5uf0>ft4j4P-NUmU!{RuC+HQ;wnsAv4gL`0ySk zXD&4~1QEkFD9Mz99*DNvZ{R~Yyazlj}bw8F+k&UZU)M;#SOQG@l z_4GU?KEbV+X+ZpsF(26#WSY@o1yaEKoOvM1X3lF(8Zlxt)EA8u10a-m_mMEK)YvB4 z(+%9|Q4Mk0&2_Fe-9li2mls1&5LEScX6Dj5`2D`+!}1ah?}SBJB#}4WjCT}*-%?C$ zvDs)&nvaDv7oFH}Ft59aCwlTCv$wKlY^9H_>Qam|2DdCcVu}(0x>iV5@ql!WyjC(H z^HW$jccd^S%F3Gy2yh?!ipLs?`ibD_u-G9;JMBGmB#vTvoT7IX4*!Uib5ztFP<<{u z?rk|XDhV9Mq!7AzciKjDuje7cC?1H!goU7Dz$$L# zu(_?EPXmvvSzXR_7yRlTf6O%_CgKh+u6Vv8f1wzsLCYsn3)#=~vu9R1$*5EsLrL$m z%-{X36GpF#3f6t#RG=Tg?%>ZO_RR8J*>Fo2;jr#5Dt7vtP3U}RkclT94Br)PhFwvz zgqrLd$YdrAF{G1n<@dDMDwEs)qWQB)Y_?AW>T(^GeRw*;s(FJN<5XpdA-kAMZCsaJ zCQT|tJNMOAN-G{AZoKC0@61;B-!&ht@V|fi|L(m~-Q;RuFmq9lD>3D^>|oHLQhNf2 zrD&o+nq5O5O|ciHqGiM}_~TqOVkjS%(+RMp#TBIvU8?bJwx4<)d|E@lTYc@G5&d~C z;ro#N-=xS<=Dz4pGFQ=zd;6pQMYIt*gA#`7%6WvULNyxYVJ=zWJ%9ftDdRxRZrh04 zd9wQ3GE(oNRB&S~pu{d&Ez5L1@~3R;md}?8!2nt?nn#t?B@F&D2}8u%Cq&XR=^!3< zZr!ubB zptKtVe~_&WVYfu8|0n@M5C?3qY;u%FTqKVdt1xKq~r~2!Nt3=~8r&rFF+g z#Hx?9OTrrX&tD5Mi$7BISA=_hZw({6%$fK4g~x%Cy)K~| z(+k9=HlJb;Qj;|Gt?W!NR11I*4(IxVLen88(f^CkkW@6Ok3=71xA-MmgP~6_xP#_x z91*t7OI#(!$?ebHX?n!ocpTkuGZ(yabC#;rI$r0^vk1ueWe1+_z%{qIEYn*xV#&>@^Iz}9Xf&;5$SnIQkru;UoNc0<p!u9pOPM%)N;fxFl#}C$THUA{VB800$}~GsU9+KaaCm>8WPA7s zNtPMBxTmU(O01c9)!jS6=K%aVaA;=N&J*!nw&M&b7@2EEQig&aWS2A`vv&N4V5V9T zV;tuc?1g%<+l4@wLIjumcZ;NXOcM7f&fi?+HB^ zWAqOTusRFxd?N3*IpzJqxre58yeGi2#1nOB)RX@WJ@FlmVB!gCmWlNn<|f5MDT4@8 zFw^@EWty_2C0gxZ&8Q`zP!ToMPtm1kSEC>~QvEHsXbLr8Y7pXzJXA03>j) zC#!Zx&xle4Q)+dF8OcV|V%pSx-cBc@yYZB63HNjViK^~XRly4rR-nQ0O9je5>#RKr zS>@_zbU5P=$B>;53G~0DyQhc<$JG^GdcZnLB5dNalBqW|Z=Ed{P ztH0oBh@ligRx35z)bvt%OrkwRQC2T&JW2D)Ha;4iokqH6xOmxq7yg#NH-?tBemKS4 zV?45l*y`OJZxTo-cKq#=VOvc3A}^m%XEJnD5$h4J>vYF@og?V}a-u4xuV1tkW@7>3 z#DEw?(oAWY%E;Y_aiLN-4N01NcTBIwNrBFA8^*_EJIH70`6ZdDKP`($ed)5BR7(rp zGCN_n^bMcX2{Q6h&Q*EDQhs>)?XhTOgUx<}JeZv8@Mr21rA*ZiEHGKM zRF0t#+_TwMrKN+cN%zWszfV-w1*GjKBPMY=@eBgUdDl;o1%ZVhh(nAAtYS~+(Mt>w zzY@8?t$J~_Oo{T`s*n{HSIyHa^}L!tNPI{B)&4wEmqsTeyV~|g>#?1n{Cml?R_WnA z&S*Gezb0~sq6R2nOf!W1?yEs*u*vgTwh`af}6y9`963c}o^MHJT8 zrMGZ?H8!gx4tnIUJdG(8g~7!%)ZE-Y^)Odvk|D3Ts37|7-!Y@B6SZw}5rWE8MGdr; zoaRJ7TaEzFm{T};($y0-32*?jQou&On;4JxBx8D8*?Y7Yo}R`=qtQvje^FtIACsc%szlR-?Pkdim;cors$s z9bDLde!QGjAbAI8Qp{ABh^x3(!9=)&)wJq1P*miO9?ijrCPV3z7-dfEBUIZ7f%M$X49WmUdPr7M=Xx% z1aeXAKHm}VCI*-UMbHWODexS%gNBWic;QD}{yS&OSD=#Z+v9YWTt0$h6s2X!Rv=MY zwsd-G`trdXmxuMyzyultlHznov`xyQvP`3gHy$a0gTyAbNv+R(>BnT*e;wywCr=%(FFoT(j6PkJt9u%-XI5#pG7b&_0)*^trB#P-!I+xv+^(^(SO1ea|wY@ zp-J6!GE1A^DX(wmkJppBotZq{&umqaJfX}oC$7e5($Z0Hc(JyjCzS`G8^`jD2Ee8r zd~#TYlu1yxgE|a4K>}X3{VVG(ValATvXHSwx4HSX(k5Y=H~|O3m0G_;mTaCFD=w*# z>E-Y&R`2_v6PaVD@?gNtZoWnAi((V&jupma%+n{O{+(}iD{)DurI zMwJayIWuA&u9>3yE=$IkoCB`PyHv5w!v>4Fpt3!Q)Jf3r`CLuY9~o0-sXN%CZizk? z^*B1wC~=0;ga!>=Z^+R^u&U-b#Q3DGQT92AN4NGXOsAZs&x8Kqhpcd%V})KG z_RGA7sEblKbzv#!DUC8izIZKu@FcgKOV?jB@Wl<^q4!xLgKX)qW7Jdn*GHF#O`)9W zShsatBq1q4mq;El3KaXZyaY^^#7SI_2{_hdRG$p1>nIEYq7eyX>m%!8m4HZzCkGXd zb#QXHCfLEUNd}_0d4ds_T4vchCp#HIkDvX(;0$|7l<;M5E;O;50Q1n84cWfwCgfv4cjj&$K>=X0qsrx(^mX?9?t|1_v8&zTwfT!%w#mC?!0D&hKSJqQN z4rSKaEc^AOnDdK>z*Qo2Nf$ZL^#bpFJeK)iby0x>`E&4yna*mUAAGzD(?C?5LJBJS zb#l|+Mar(Dy27lbqs&a-m-C1$v}jmL%*QO*doKdP!c{1=n=NwA6`ns>AHQ(-XkLRk z-s$T%I=Ek$zZl`QyC=BA>KqY&8T%&<=E0Ug_#%BF&CK9gUda|5cd3*Wg*}o4L`wY) zsZbOA!K7wdZh;HGFe}c|MYyaRz{3~l?4cOV+6b_m3SQG%U#ZL2H~yZmGjU!*!0g!N zNBSXK*(LIT2AmnVh?R+}R^byX5ASLeFcoEW63YDJRxV-{LRqK*Im3^xfI7$UAb8Q$6Kp`EbUhzpF6#QOZ6%k5ZIJ_vlB6t*v2Gn41r9eBY>jhjn#MeEu^@)k(E6EQcdk3-xnU zJ)R*hCEh7e&m5$E9DkyeqzGZ>OH}*;iP(w0;2IV!9Fr>X2OGafX(Qzh7~Fj%wk%Zb zi;6~SZru*($O{TsM@Z43HbYC<=A@vc+U^sh4T_oN4p3{{*_ zPFu6>v8{NPJ&XpRmp}F1U;^d3x!$%3*|)Ky3X@$rwm(*?B#XuXo&Omr>$iR=ST7ZM zF#_vIN?rjXji_moSuRm>)6A?P#bH$1_6aWJd${Fd@;n{J12m1nlsRP-%;QPCxt(`6 zz_}aF!Af1l!%d8`nnfzkgg|4S64pC}DnURW+{ePz)-1;Qg{Y8Nrdyw~$-11Jm?%Qa z9$RHtrzP?BLpx5&Ll@Qt@_9lv)<*s7nhv|&3aPwpQ~GGBFqDDjZXEVfkfOmK7dV`n zSGCe%O`cQTlcrG^uK@4RnH+ws@(%CX<~!6@=1SmTbqt&e=Mx6`l#G1_BCw0YOQEp3 z;qEeW=%Ued6T$PryQm0L;q$2?S(maiJ29+In{-rG))Kv17ov7bJp}#HIeOWV^sg$htaR7oDHFaz&FzG7 z^JB}Xr*6v89}+=xzG|pyq%bHod0>@**Dp*(;+xs3zh*kUrbB2!sx&(KzLv+m9Wd)2 z(o?5IH9KmV<7_^{s$$US@$pNvA~9*3Ag8(te1-!f|1Or4L+&)qxXu^bvkD=POkv9C8fw^Dyz^iP2Evp|R8MR4fa> zWz8BqR@?tR<2EWGlhCq=B!PCyQXc?xqvYEIR@D^yw{+Q3>9J`;_64m{Dx!=53-3pK z;by8xkf5A=^7}G|^KZ8kI;VUni1uz2n#Obu_18miG4Y9GL0VVJKIY*P9EF-_EqYGc zFp=gw<>p0Hg8^usJUib*8Xeax%g18SL}`ecsby0Xno8m?1R_O8z2HPwJ^k9Q!AkOU zAyAW;L@u|1zR^HvnXN!{Yp1aWo`OziD}Ty(VNZxGDn8JByh#Y$xQbuO26HxKomU;h z>{l0r+pDW6VqQu%t(sJuy?0{>{MI5ZBU>z^)QbC3_CYD`>EYz8=sp^s?fl-3W&e8_ z<_JjoR<1)6&`_PStQvnXxPgc2jEmcXl2pz#&X<`)nUC;Qc$O#M@Kbhugv z9)_HS$N1E|keJ1Dsj615Te%dWSh8o|9Zl(-{If=l!(Usg(PAiaB0=Yca&+=?L$~2~ zaIk?yRtvFCiT&2r{uU0z@x~VcTV_5<#34m0EvJ-W-mUrj>n>P+RemI+S6z)lljRs6 zbZHaU{D|PR^ZadK(SkUc&c!&%q+0jmP~?^3p#Zx$Bh5_Dp2i#5(3#%?hF~fxx{u3U z%lD_&A1l!!<@<~n!KA@+DUyZ38YCLcwQAM)-Kg?Br#Ezf1{^qnERF9%Q*f$Bqb9(s zq)s{~+FSw32=nZ3(n|`J5q$|;enP)Lz_bqk2JOCg+XU97BMX*=b74c%+kpP2M}~!~ za)0>BlA^4Qm_EiX8mpj``_EiC!QDTXg?wgRm>T`hCjKh#G&mIL%GCL)$ zVmZ!DKO@o&%0rHcM_f{c2Xdyo)iyaz&?}eSbJe42@WdI%_!Uw{5TOZV5rUbz8s$9P zJ6R^?NheF@L^7O$BfkZzA9+3)fqHh!b3S#vbglWi!Twclt0Q~Lg$1O`k<&kwVm)eK zghMEW6|I=OesceHJII>xD<8!60s3c_V{t?ITm0O;PDUKq{!$OO$AA)8H+yb9$bsP> zdFvq=FARaV3^w`dU*Hf8g*aqVecyx=9yBg;E_x{06J(Vp z2btV@xP{@_I(yDKtt;ZSd>qh?>FVR=)DaX%Pc44nD2Ko<45MUH?~cUwmdVe`cuc$p zNwq>qxctp4W2(#>+oQ8oPrmx(||kmUVm_VDpho1?}AX_z^Ny&s_I6pT!c2dzjN^e-|rIAdAd=J~%DMh4^SVM2Op(P^Egf z(Us!DR65D)^!^>(zs>o3*H8>b`5PYWthwmrJIkCv^_~Ano_?^&M24v~EsXB3tF#?M zh0c?b{3JSw(NH8go<)al{I?(dix&$A+s^uxQzGeDk)niGT1;nu|Hmz>Cue!i+J-Xr9By~L znz9?R-mroKth&7VuibWltpIeNq+cMKo1T^#>f_2mlMsmqXdC`$mbm0$9WN@NH%8eP ziEqkdW``e>)ko+*Z?@~Xbgxy2FOOR|UikwTgBDxn5XZDf-~P={yjEd>W(W48?!7tt za#q_*A!IPXo*z_}JHh#CO>oN{M8`w@;C{FLHnq(YC?L&Cy7(N>R5@|!plD_^pb#rq zJEkdaS@E}`~>zJ^H z6S1xaTV-;jvhJQQ(oJi}HCDk_24-X@)VMo;qIyNDy9Cit_Txz;%pog;odadpohGtKoGnqww4GKV5^(SPh(X@ zEUbz}<`4f=@ zjKR?)BEZZNfZ~s1$X}`)Q=iMEqno9`0(OC77Rkp|;viC&v+DE(|2LqEVElW>T7-_E z76Wq@0=LCgzZqstMo9rUP9D3ab&ByJ zdWfW^-oJO`|dLo!6(05Xpe~vM1oHEWgcqph~qZHOr|phWIep@KZeI!ZUY! zv+`Uw31CV=ebbFdlM+M1Pp%V&2pY7KL8n>6Kn6J#Gx$&4hG~Az^>C=Uj1wd%%q%Tg39DIv3!iS4B^5a zw(yV3&^f%&XEZ>iL)~j~C2pvX@}@SFh*mu8a}+bz>PJ&6RV&K5fS6#IQRSKHKt7z@ zSh-#sT&>&nrzWT2H4w&BJ));)8w=r0GIucM?X5q_WF@pfzSjKSDZDVEuSpQK26jUiX0b>}x*B zzkH)zRN>b)u&TUBG@_g9TrO~(salM~dyqe+!`C_a6^hSmG%s#gwA5#o0#4?MzE|N? zJ!{!mUfHx}7!jo8_93|oKEUo6&R5TMZW209QK~_1{U#D$`opFIhi2`QcN$H-9*0w+ zm!D9E_Sbmg6GVf>8SWZ2_3{uwv)<%QOfr1^IYtca?i{DPRjQ;a#k-Mrq|cuN9Ds8f z;p_Lx2aY*7B1uoBP9ScA-;vStZzDdgfi8-rjpRF>brF;GW+5(U+;IJ4DPd}Ovm)yH zv-4C8y253XZ|9t(y8B4FzC`v`q{*H7Bx)^Us2;rKgTSKcE=ogIeD0OO{u?PEzN$R5 zhz`w~A2(*?lyQM~R8^FV;789)tSUvL4yp*BSXhBATYYJs@{uijn~K1X7DhR1PJDkj z8Tu%5tRuItpp&=|WfdEI&+1et)|abr&*snW-BnTvGwFOF^MXE@&4d05@$*Ktd%`M; z3m*B*L$-yYpEZue45DZbOBiaSTyx>(=+oSXeJ!Ss$JxFOm*A9rzHld|@Cw;IBj3RJ zLTuRqBN@F;(+p}87^ZrBVXz4Nu`BvR7ShYjGzE~!_Q|4D4vv@CeCV~v} zfSNgWft$t)U!M+bJZ|m~8_TT(V)J-M7}*VS;GCg@kh% zdUm=T=MtPzN^it1zyD4A(KtvY_jd!!KF6Cgc7gM=B4h6i1TgSX;kq_Mvt?{m19A}- zFJd-&@;jYr>`Z@M!7t(?e6?%^S{=w$cc76ecXXKgeyihToy97-XPl1P%Ni@c9a%Vw zxzI!cMp@sGz#0ou4-y?=vv?R6OgJ~0rbaUZQmCJqf6-xWOHIkwkMltKDQ=i9=qs5o zqg!agA?PiNq#jJ_%oIqO;NJ?Cm{ zQ4?{b7{-_#nRC)S{xL7Vl~H&Nf6#PQI4F5{w~m@!^}c^dl~nBv8TX|c<~q}F@Xw&) z)%nIvXVZM1{RM-_UuK@O39PAYpD^4n#AXVG7!7dtlB;3O9kDL{!7mrt{Kctg$i8g( z&(Ghclg4ZNT|Dw+yJF#3k%vpC`!{yz6kfIBixos=Vis&<05aT27gYAC3;xMwP9yR$ zy4SZWtn1G(S)yL~m{+zBd?Iu`0`?NDz6&w5NhjnD-Z%Ub33s$m#xdBed(RUd;+hu} zD^`*3MiT&CzzMZkZ(KG<4}j`phYA8l1cXHBdCBxOziyXvsIOx66busFTD_Pc&LIrf z4)6cS-78V9porv`H|(puqF`GU;ayq%_%4Z>Sv-|Q)uBz>BTTAmv~s00uA0|daBfE; zMK(i-9Y?NO#9%)@FcAh;HRJbf8UQ+-GGvCQ;AnP*#E{rE{+y`VmDWZ}c! z7p4Sr{t3J)^A@%$!HvoOe@KKMC4bmzQiyH9B-ZXrNhf`~$2Yxv*EEJYo!Otnco{AvAL|BdMbNkivVXZ^ zQzgH^9psr$g!bm1T7oJ;J`8 zxFxbdHJTYbQ5t;jCg-q2pSAz-CtQD^Vjw-Wn00zhyL|Uv>I7WriYQ1qxg6b&u+0%m zPfy%!o!3N=A-h^UGY?8}8qxV~R&6*i!;EgZU2|HNn*bF!Sf*2C4^;m>KDDgn-prZ? zX_B)@s|tj(#EA&}-bYB@o6Z{23ek$!P=ym{Wcv&r*#G@g*G;2?jyB-K&4kf08bd%H>e{3Pj(i_z+C_yI0*a^ z5S!s1Rm7t}Nu5q)s3yExH**Bo>;19d7f>7HdX&eRCWO?e6u z?HaS!xCnGz-2vgXZsD=iysZazQa{B_Nm^uky$Rd1->I|nW z|A(MenSEtxHagU=k2(mkClxcA=3Tf6aatK!4IE`LGuzg(<=E1xTp_3H455DP%Bout zgfFz%j<)Asy&368ZdgLazso}h34%&c2}vMz?8G&Sk1FzJ|AuQTWTcnZD9x3uF(NpX zdi&XO9uFjdOq6f`2Sc*|h2SiGn6V#pe6<{_jR1^|5(2rNMZA|yOM9wp_JxPe`6-Mc zZc4b!PL890ggfY&?_jOmX;g5;S|n&AfNZ^p9I;wuJ^xdgYUL!x<`75N^DKmdhh|HM z`vFjV)TVky(t=N^s^SH575W)zq|P4d$_(6~@tVM3+&)2X#QWTmBXx}vFJ_*sF7T62 z6?v1>uQgGURJN{(d*=cgil(ICOz57cm4y8>1fSv?CKt_<%x@a_q8wXK#%z8{w{7Kr zQ^W=7kc@lbI*$hLD#cjU1uNN2^`f>YLF zkdyf9Rd1K<*J72sIc2AN1Qakb8Tr;sujn`iap0iDow{4pBM7XJGJ%U)Ev#qCB}GdI z5TGOQ~xqvW09tlM3bmq)Eww5w$J45?0eb6}FASc*$`+2>PCYxr4|8L{~EiGaB zXve9mliZvRF701dYuowMxmcf1W+>Cwh7LX2yNu-krIP`8d_=jg!-yBi=P_f_*o(+& z@%C|1QhYh8W24z+grJZ$X6e|T&Y9^!HUxEBQ%nl0+2(k~p#kJ>WxKK!%%~{wPOeUx z3gGi>doekHgwtoBNUxFks;Ax%qk)A2WA|g)Q&N8fY#k3yx(Q%WRxUO@~VLM#a)9IIDcP z4Ra7bHI_(n5v;&81b+W%vYR3jFB}%q0ikapNnv>OrwSdUb#IiwI$hmu*g;O8agFoD zyN3a9??)tVc~&cjtW?rPA+u?GX<2(oB&a>j#Gywp_^rWf%9uT!a>m&w8h4q0xdqRR zIkzUF7ky6?ee9LA3r5+0V4T*rydP6uvrRYAE}lWhSaj6FIaUw`(~=HB(~wa>b5FAF ze_ZU$x~MGd$Y%wG-(Q07zSyo}jKZqv#lgN^I+Y3yZ#^^zhDuB({h!b>p*v8@f&HM* z8Bdy{VkHB4F)%Q%qIMkmh6i@K!}XJ_spAKGnFqAj$jUVq@O8+&StH<(rg_yGWqfqp^P!WI(9wy=wC_LA$-@p zwRH#286>elZO|kJJI|97N>6UBeAT-odf9{5%gFmhpmaVnxzpB)kY`Bwy@_u%H~doC zq%#=r%htmV1)}wKP6T3It-tKQV3~BdR0Kt6)^;Qgp)6ME0V#Fw=uYlCP63C=m0oAF zdUOWtWcKOzTJ)nLmRY~S?cJ9QnK;dST1fRDPX{|n~vAELca~?aBbA z^g?)fwONhXPHCpTbSCe`7z*szeL16;JIaAw-`K}2??P`-F(=@hTA;lg`pGAStCiVx*wSnCpC5Hz*tKPcApP zHsAY>rLTc9Ag18es!upEs*9uZzQbLq2evyFWN|&^46u>?Ar34@Ab0TJ^1uv@Re?-Y5jdmaenR50np7a zr=%!^d&auA|6eCdnOAW%D9 zW3ZvOC}SluUF>LaJCfn{I(~Z89;TDh)GQleb8I50-(yF|nUiOm^?^}t$~nAv>M?h3 zV*V42PfV=#w`t;dPJZImJ!6KQ%{0kJPp1j=pukBIPdLerekd70dO)*rcqE!5|*2*2uPlZ zz~bFyi=?U0aA^UXuAy5ukEj4RDvaO%-`Haw(t5jhJL^WqGZcCVAyRZzBslZ%2bbac^(b8i%m(7%|@Jam<-i zpn@s?zi~x|A=S9_vM1PZeQDS7xVgpB&w}#iX(}M4kiq*YGOLl9^ug&DD~h3xEZ``o z=y1X^0EN&DkTW$Wi*?$I#PXQt1p}Z3?a@*F(Fx6GOP)w>C*&3}7ZZlny)AybmrsJm z%YQr^opLVM_7zM?#@$Gg@l;wi=*LVeXir=ldZc>&LvxpXW`Gr*25dfiwM!t44Ts5_G1)41 zW`*^)KFMjO&#sbs853^qIw@5gUEBa!DC{`{=CK6232{on8`yso!^zM9CQ zq}h|)AcAc|!`4Ep(gJbh&sJA$t!Uz56Gn9|K8-8Z4@p|C)DN4l&zrr2yCTAg>RW0% z@kAwsF#ky1mnN8KfD`%0{IGX7Nz{~_R#uZbgf8$dDdKYp{h6^%^W`44g&qgaiqOC4Fc7R0h{S*oEN7X{3c!g zi)=<=Vo-LT6l)Am{Z;(BEBQjVqhn4&vg;$gJ6(FK3w|rG|7LOKX$MqJOBJA~p}gxD z=_CuC)z}q2B0I)Z&}lbU&b;;P4Zpq%e!UY_FVSlkh_afU@+21TVb?7BKJs)Bev*FB zwvGt_!w9PPW?}2d<=-Y6I@k3aN8~?BCQ)v2pGze}Lqixs(l|86HgDZF5166tv}vi9 zEAq#0sP*N}n>%4d_TyxDE<4WS-q6LAYCfnDQGQTR7!GsILR6t`mLEpkwj&C;pu)r- zlUep{hRGl}E^jjt(|4Xq|9;n{H+zjMyY$_<^fCTy+h_uS;y$k;N}cHEOHhpFLrJ?+ z*$+G;ZU5C6_KqtjMZiFr&l^K-$~D@Y@kB?k4;3sak4tx64-vqMKW|rF&E^3YTn1eR z^zNPbc%vAs*IBlMyf4-|H=oxx)n#4;Wy1`?d{BXtH_;#F^Tqv{>akgpiB)h98~8+j zfzd{HCTvA!G2;(ae*W1!d#3X>eJLu>#1QA1QgotoOyCV-`@jbXf zdSvlF2-bW$MCV<^MfovZy(zk6aB0pCoqY&HtXg#{@?TP<=utDd7Qa*qY0|8HYE`?r zrVX1)R}|hKzZ!@{%M9fI<|rWI85zmQ;fu>aVDwM#3}3#~JbjeA#A?=b^TM`Muk3xz zb^9JQ>EMK7ql^8W;;FSVBKo8tb|^ZXQx=wohcO(!Taqpl@9J3qR025hrdLilo^7+m zNs*{WfiD73z#TdwwtlF?BvZ;tH9buC+rfZuKew69hE<3dd(LQ_Y)UJXF|;pk<4V=i=oTUYeEh6`=d~3ou3C#|asSRj*4(eP^XLQ^+=sql)&)aMM z8guHkL4nxCwxRcXh6!m+nAG0a<+@th3Ld?yz)&PsmSJ@?%+7*(q$wy(*1`5XNxNRZ z#iY@-5X}s}f-ht*C)I~mgClWy5bNfDhT0pPp06uhsmelWkt5^H8Ju=0itu1wU~DoJ z;C;poHWNv$2Pm09n#;@?9zr6H82FsL3zQ0cz++5WX~SpiyAI%$C{TmYQ;mIgSV+D` zE0gtx4lI^l%$H>oL9 zw?wIS*MQ$Vst3Yd)(M`oVfHSPVq_KUkz7`S=~m6yr5mAXUdsX^sDHck%*R6)^;)#} zAva-J?HtE+26PI9q7x{|t|;t(e<6!V_bD7u`fe$}g0VqcN$bz^*R#vKkr|biJ{4uV z-Kpd^av2N@I_Ab7S*UuT?W0wgcrd%A@DI3=GV)+PwKQ?xL0t^@MoO{@A(eY>St*Ux zK^}|_W)gXj{V(jwg8CT=*pCP>qvjQo0qwtp-P|sI;W%z&($-B@d_G-db)+du6`#Ly zj#OlZPrAjNK$ezNW#=UBb!6R2?KE-Bb;K>dp!RJ&vAM0_fscxOvX&v*%$SMM@nZfS znm{i&CL5w^*qb6o>g)KnBWvH*r#9p)FN+F}q;jv^2hI#!^P7P|-9QFl?rb7Zi56g; z2B4}S&wbYee}thSvmy)TKD+*Cojffn2&0UWjkz}=@h&*~yLd{IhzX-b+u?oFjQC*?ljo zGIYdkQSfEeu)1NIyln<3`RNChKkUQP>a?X)I7VV77bk_7P;rltm!hZQUs{D4w0PnSbqEw7lQv=TI&Kc z#AAB?%;DQn^l<0&V&$V!+ut1fSrvWDO~@S~qln#7lFC)umX<<71zq~nQSCkQo&dOe zThZG%&w2BZZ66i}h2e+6QL04QToG>H`N6%?OL@ zDZwvxdNCCC;&?&}g`0Y^ko_Q~e4>)nz92IKuCymzcq+E+?6Y~w#ZNf$&A`%la$-b$ zPWQz^CvbI2MPsRNkvOp~0gXl4;r7@GoCPUgSo?(F*-9+A!v z0JWR|+~$AZHl53G@v57+M%<`(R~?N=8v6g|dw!>nd0EiggRI1G z9XXc)oK9EVGc{HiX88u#GX?35c1pPH45}4;%!ibup9KzY28;g*3V2o3y4C)~z_+@` zZg&QvbH7!u=#5Y#?sAkn2w#}3#d^e3O=TPmy!y#$_g8j06%CA?mx6WqXsGr=moEG5 zuZy1nF1>m&=b~^J!{^~_IzWQlvQoYr%mxTiLdgZK7^79J8{WNTb~j*F=<5zn3#Zh( z2YEW56|}5iuPv%2(GWU;b^lkOQ zNZY*+lOKoWlSnIaQ$>w$M`3%RiZ!eb26ne_MSw$&s7`QKhxg#F70hBD);3IYID$jk z5yVCRoQ8xOf*Z2fSYv~Q2X;?rHA;3KWkkTqv1+;srfXd*|A0M%;Ls?y*sPXBN2NN|IPFuw|*7~ zk#v5uHShOj-V=Fnep+t0XZ`Y}+|F`&SMkf9VqiI}r-Cv&kiSg&Kx`I!;`Q?6H>QiLN}YJc!})W-GD14ate)DSSswkD=x;FNFX5kYhq{H= z_yKVKW=6P5_tMmY3>+P;nXusFaV$i9Zs$h0=kBJNj@n~_OGk5AD@c>J^X^A3=YxE` zw&TNFzsTSsX5DCh@4S&KVC$`d=mmw9^fR!LIm9Y|4N115MUP}{=49^cOKZaBaSfaI zq0ERx&Q!0CNb9+lJq#@=`4Bmo)v8=XYCLN?^k`x1ys{i#sM|IEEd?NN0xfhVJbBlZ z5|zzK__DtFT)U*!a{Ci8em7 z@{dV{(AL6@9ZjT&8s<2Pb#nq1X6ZgRUCL3y}xRuLx2N+Bz#&&OswDjjw#zAwsR_~Q*C@W)tI=&%ItkNGhLylFA`zi1t@FBH zzkCmV6tal$uBFZ4>2jlSV)MnZaS-XS97rj3=dieTX+8U&^-=rZO~O9{KUU)3)$8PSW;Q!$Fb4Gzdct1Q(-uH@PGqDC;#l|5~<8-j0G~sZarPg=tnV zC4ZPR(zQ%U5IbXrcWw~K6Vp-0(xxxQuUbTJ>7VWNyL%!J)(wk@uFOk{2jB_433C|c zJig3f$P35egDzB@PM3vA5i%~<}k>9lnE1cPs1i5Y-~

@@@%Nok-&>|^LoF;=oGQafGEvk)&JMtC zKi*|%<{btEbFlzDbxA6N9cW!fb<4l7C>%R!RO2<7BT+c;cFR{|H0ecx$+0&3V+ic; zUrRi(x2TOj@CKl$PI=n=8kUM_jU}w1{i^AN<%hH`gamf{CrwW_sfyJ`< zZoW=ja*9h*GQA*}AT{#ele&bIv}}V}iaRh~u!kw=tW~iYRA_Dn-4(W`i;QxoJ8Gg{ zy`g2B$_3m7nGsti;D$DmeU_n)wL_#IL}wuLl`F{J5+7i>p?|E5_odqfYAZILb#rn7 z)!Ti=-KNE4k~Wahzs?>(e0eP;vLE;q)LrqmV8AS7HG3PC=JzfY(aW<#jG%b)iF0Wz z{}e{+UXDXLc4_4f7Uyp{SFLnO6Cn83h{<=lO>Myu{F!uoBGnrBeE24o9VpWi2qmM7 z@}v{nY@(5;sL5zt{sX&_4)kL^TDUrD)GQRCbRfh~BN}(@Vib3HqY68+N2@A`swEm9 zO>RhQgz-XY7_$M-!c{Soid9QS?U+Y`-lsojI5{&BhTsN`^bu3`R%pxk4Ry{^8A;n2 zJyKnar1e>IGoe?!{k@QMLKOEy z^^mb*mV?ouko-n!=U&CoxwNeq42I}B#m8NiAkGDZ-~Fk z=F{`P#elUa^Mij?r_YzceTTY3;GERDl8Lk*F!J3W%I|H#MUq|9k*X@shp?I9=f1~v z>vCllryQpBv}60?Xh-~vu!k5mD+g)BvKaI75b|Qu2J_i7PzVga@cjGz$BaK#S2`f& z3i$GC*r->F*$BvTrZD%um{u8Cl%(kB`S#=ME!BM})m1ke56_P`6|rZ^3Js^JBqG6m z#Q1WalsdhYtn~Yjf8RF#YYejYL5xWdKZXgN9a*u@CG`~XKEk0 zZ6g-Wpo9RLZ?~uw{{pmW5W8}mric|k_VgSGG^x?Ig>Z5_-$aZdYNIfMp8^q_Q8)MiMMvu#xSpC2as!e{f?I4Bp*md@x4XVi((1%pX%a zovP(KMUuRiZWvc;mmjn4=LBkaoAcjwby7nTtXK*TP^mldxW!bq!)Q3N61P0r{U^s9 z6{ijK5y~RcKaH`KNN%^nvL;q(d)`e_J9SqV3 zR1%@(twYm|?nalr$MNf+zbDBdB<);}$mC4G>n#_HN0U6`9G5o1y&|f|CaN@{*k;Y5 zGq-t~yaaZn2Q!(#_-KD@q3s?Q*qgHlpHSgANj zmvnFg;Vukbo_@XdtWBES2*RH^4`k$W`!BeOrG!(Ntpa?MxCUdt1$*}Y zSx(bC#EgA5_nXVxNZ%I~58IQsx~aJQ^}P1$U$bj_+h8I@+?^JuQHqo$L>2<;>2o$L zPLzRf@+u=oO)Q14U8&y53Vz7?Glg$Ldcb}iM$`jAu-bir`78UVrrDjsU=D5@9)I!H z95vwu(Y9asu!4)fbCS<PgWbF)-Cb_LYJD zc9m7dlGCj$+%YzFS(!kiG+H}7_)NRf6H0F#a>8Dr&A`8~3|=>dGV$pO!o#WgT~{lX zsO6dR<@}ZZa*=(uX$_*HRJ9BX(0ugjtxd0h*Ki^*p}4@$wxspsZBm*gKK)B9lt+Pc zeZ7+U_mEBFvmG*Y42QY)UOeaYipLi#zXmzbn-!YB1pkP9mJl*>qrrhGI~(UpJCUxE zZwS$ueH#cPiE7^MHDd*C!DGtq2@hxtr&hYM&ThV4B;N{i{Lg8>KCT^VfvLUJcLsr_ zJ?Cy8y;ia8gaTA5a-zS`i)PSPs3!RYNBRg@ck;R@UxaP^nefZikuiFC%ele^14>_J zM`;qnDgC-HtFlCqRsK|O7&{~f#9iX-DwR}uIUe436~8-I=7gcX z{F&HA|H+iZt{-)jpX4h_a4N}If1g`IfAjKx`a9M@{-JZ9uv_~x%TOHoPzlK0+TFnf zz5mPJwmq@W?2?)%k|`$cew`Ex zRU%}wq$WU2;y>x;f9)h)%FdCmgc-kqioQdf%F^2CqgJ96nn2XZPNsiX#dd%FO%GOR z6^Iz*BG|w|{^@sHclH~%bOa1nMd?ds3Gc&-%DCjtJqtF>mW!vYR>Aol0E1n{_2pi8 zsUq0Ni2l$hQ3xf+bKU(f6jtIb2kJ@??L|zTwDe-(LdCSX8E5su=q+{pzbz6~!211e z%G?>WC!vUh6~sL**Bsl*kfEeT5mZK5Nph%XY=51)aq)c{oMBrlNWdkMQDL>Wc3i-( z!b^ZlYxy7tp5^^F{v~dp==)z0nWKcnI#UH^qWHcM+Syudf!DXY*KGUJRQ`7^fdEdOU9U8ql!U5z8v(MFGY_Oj&< z=AG&+jE4{NRm=uGzttj(TSY>fL^t7Y4swmGa5R-dXat!-*0H>tq_IEcSIUPjn?L)?CmVhBLBW>Rs|^vW&agEL3w3Lhuz2pbL^dZd!ouVetrVeYgD|4#m@D}KB>Q3l7vu~%hlr4&?&mu}-O4$cg<`?FJMMZK|fVEixR>VW- zy9ji#K+8}REI)0s`y@(|Py%lG9BD@S9HI;_KM;Fa?<93gHQfp1Z@?vdq!WH-`@Y#= zzlOSZ4}5~Y75`lJBJD?q66U5`f;o5vzVaPo_r`F=6^)_>pr2E*Ig_ht1lRNUf$ar; zvm#-reF2<~{n^l@NSjyLB}M?zG+F2o8M~BhXMzr|1RlEJi`y}?nW6Q*!? zQGa*wJ0oP`If6n+CJHGo=R4UHk3*?Hy=XN#Qc8?8$ffOw$D}G|79-6(54HAGn_!@* zG#+jLUV|_;P!eul47$9O-0&$698sR4%`asoneCQmQzh$6hbzH_`LxOIAX}Q1c~vc2 zo%K2QcvfsGeW~3ixfAv69%qgae&6OUy^|eOext3y9-AIA&VG((g?YW)`)mD%S5LQ~ zHRRljV?3tRg3%(obb=g}Wqb;3X^QmQwY?Sqh8xu(diF)t;x383c3dc>bxQLQFfPx6 z>0iloC%le=j8sec`z#roomyGBTygbH-141NVw}Im$Rzqc!GQs>Y}>K`n_v~;+Yb*# zu|{rk!(x*xGxMLmc*b4xu{Uh|$I(*MSt-NPG(HP1U#4@$s-vY=i37xyZN(QG^XwiK zSoVegK`Yzf8?IF~Mllw6Z=6V)gW-b5zR?9K;C6J79TdWoN;5K3cC4>BDnXR9Pim`B z(xO)HtA?x3I$H2n3yuA@G1i=4rMlCA!9InzRHAsvTFd=@aaQB1*)Ou9xj%)1hW;GN zU1USQ#LQ1}6_z8H1T-k&H}c0|D-y{pDX{T~z<8{$WqI?JF7W5x6?5(XrxTm5EeNN? z+?pB0KM_UQN+U%s9>$ycj@ZtOxc@^}5t5p;Pl~ZnWyz<0@)ot<8%KSI90)zf)`Q45 zqyU00-sIal8SF$kl#tfd1#fLKsRa0sWCWXmE zeMwRg8O*u2$8kz-&1k8&D3Bov(nIsyoPd1YuW#A!U6Nl{@89)`XMHWAA@fB*mPjZz z%rrZWo9V!-qAp4wj$;hVp}`@uo0DC%zlHVZ=}eYCF|46$nk2N!NoET9X*h#zS7)Q> zwqlYSUy(NkyD~jgzgX=tQa5aqMP|SWV5J2Hipfv-;*wngTG@P%WU-v0xa%f?KXTGQ zZ9nT1+_?RkQvWQtV2!2*2kPFX8!En8cWQ0OFTJ?RP-08bcZ79rxjd9)845hp`1h3H zes_;M*0D1rGJ9U(X4`@o>gbtlyN1X7D?35Nd;v5?^crC@h6AzXsRarBXbk}CgpPG0 z#6P243mRTbQtaDZfJg@3E+s@JKc>qJI$e`M$6uwnGX3hrz6jug+D&{iO~42>E~D=`#b%FS z1DxbiS~|gz0ANN8XxivJGYKG^$do9s1h9%gLU2U_;3nag!7U$azc}?efm8%w>93X~ zg&V6Nn_C;;DlE#gM0+qJwP5UVi3t(lG>&&*X(=2#$1;dG$+mDjWfKql^iu9g$NGgU zL`_Wiqibd}+b>1Wg)v%JL4`=Ha-0L_h}5hrQ|0bWuah??5)}_!3h`qtmIcI~Z{F-T{wRgn0D%DiP*_m4~1 z5>qpz)-~f2`a7~iB_@=Qgk)2=Z!$RzmxI$WrSM5TLTE4ymkrX$Va?HLF zA(0aYINW)Ma@mA}%x9qvVBeLW%P0pdmp3H|9n>jUV;Yk)2%PsA4CW!`o~T(Z$RX9h z)f~DO9>I$kgnlj=WU3}r%Qe^0Y`J^yMYF^F6M^x?zL$SP&8)q|Ge}swI;6st2BW%5 z{O&UJqzW8&&!b}^3t5FzAAi`#Nx5Q>H&+bdXw!m%!k3V!62ih3ec>3-D)LcCaEX@C zd8h>U?o2^D<2A5El5K10Sk!_m$+o`(Z%T;TOf6tkdP_*3-vo>vrOlK!8{*79aR5U57-e`p8c6_eazDCkf`XNKk0-E)HWcFOKtDAg`Y6Z)`QHOQU{Kgi zd+9M?2DvpcXySX|1Z+}*ofWdjLgFwx{T6E#o8dv&Klyxtn<*DgoMi#^h0_MNSrm!~ z7^rIq0_MhDgtm1UJ?HUB&9oNnZX{$js1cFZZep;-G-B#u|IX#`0E{eQh0S6V<#b!eASW z0LqY&Ff_}~Yn71R##O@svBPjOwIx$jo09?_+jQBh+SE)@_Fngu_0#E&)`wXqZ$y)9WpaAO0E4t;-|vftncx44~ynbh(ptW?W?3t{t* zaRJ_R=>A~-6v-4rIawzPS`W;L3X@MH|5a=L>n1sdF4_jZSCOtL(vHc%C^y3je&)g> zw*TzIGNS+SQ6{Y5{-XQRr~C!RFYg4gX7FV^(=U}hE0SZua)F(5*&hpDejU)6+F9|U zC_26O9vlk}Y+5*W{(n@RRaYBafJJeF6?YBp4uv8g?$F}y?(XgmA-KC2cP&oP;toYy zthm#b32W9o%rD@93(39boV|s%Ryv2|Iz|7D!-x+^Yw+VSZbU*ZwLi23(>dlupa&2Q zc&j|4GcWhk$s;0T*Gdm?SlI;6x)&U<{4FcK6IXygP5n3&4?{er#r&_sNpgNxSCqjQQ== zZ+P^>X1)H&Y!^}t;L4%ji@JZ)XictKgkhEJxa;6MdYNgP#Q3;nLd7cf)-wE!Z^*2K zn%_cZ(pN&5v}d>sxDtsJe-t%ZMCw;=x{N4h-usp6+q#>C^tpNwsDJLO7DRky%boZZ zS_uB$u|MjKMl|Lhav35@=Dab(FR2%ir7kCcU9pAgve@}ab@Z^F&@+G=?d+(O&Aiu1zY30tE01ZWI_e5GS<9f zxsfcj8CI7ODDodZg3*c@I%Uus>Q$^5d}0&=Pv{^cMq#ks z{njth)jKgJdtwEBrH@)E6FiJ;Ug{kh2Qj^iLn1e)NdtquUELyE{@!ZXjPn8^FSFmK z&4il1%S%>(*lP6oW^w71PsXsn?3^6<{>Gw(x%!0osZl|b=2bMZs-7yU6IAv3B8^wksZQCWPRUl&d zRNQS+7v`|y_%;@_@g+JcDg!Sg+6*iL`V70qh%-FEN~9v8-vt(X0ktG{F7_R+PcGKl z4(?yIdHw`#gote-)8vrrh%+3qj{|ucySLlHrY`v=Wpe`SG;^c051l&@ZzL1%4~-15 zm7Ul1A)FHxM^V}Hc$&SevIhbZ{!OPLv#t^jire;sNklgS*HU9XZ8+N4{4O%6}q(`nmiN0Wb=i%zd_4*wXPP_NLa`RmSMUrNb^dZ$W)O@Q~2fx0u@5a+UHgu zWZqDQMmPyf)EN^G6#*CN3+0>xcP_>DD@{Dh$FPjsu%5wbz9yq1E$ApCS@ICM0UL0O zdW*10u^>wJSQ_=0v!O_^*dw{2-A_UpT%1q|D;t|wMm~Re{UstU-KD-L}XBp3h>kb+N+BqNql1OHcD0QrBZjh!`E*8*4VlQi4tgiVV(gu7Y) z`Isu&5p};AsuE`PtWnGdn}{JmqC17l+tDVwLMCn?v@@J0Ar%%1&AmugNT~pA96&4> zAxR38MphOI(wIuNIfu<_GY5_Z&4R8Ym0>m8T<@}8p;wr^x$vSIHELnb&1c0j$JiS5XH#Sy4hK+JN-#yHhZLg!r{7lW%X0yfWsWix+w4 z1_4%1Vgzq1DSE^^`7ppvsh-lZ>(LTob3;WL3#%|e_;sKpy||TD?j8u8(;fQH;j4=k zHK?S5C5$-DwzFozTBcfzXbBSf5ALWIpo)TI7#B!d<{ zZ}<*cSz4;z;S6kBNWW&YF3AcNI9#A0YAS))DO}2l|Hm2P)dq?Kigm*HR8t8fGbuzq zQGLM;a~(<-yE}~GFR!!roD$5?V&RBk`(Q@{351JeVFTb)MQNLmIEBz}y1+tg+f5vn zc(cVF+Ec1y!oj>&EIuitxzqEV$SRWW-?$e!CmD9lV-u)Omg}%>0bepw)bAANE{Y(l zsl0pGax9E=6*1Up-XM8-rxK7nl^IT&17guvChSd$5)Ug+9Ps7VdD=F>`PVIVC`%A4 zo;VITqO5woNIR4guF+$H0^z2}=sX87nG1uM&0UfN(}){3YKWj)pm}If$Uo%tuNp#bc}|FZSq$IOk&5yGCUra|z3U4jKAk z-(!c_#LxV5pfv(~4C;SkGwExNp^xs<%pZI!`LS4yA4u?&B{4bZ)ss%Byjbb2%@rc$ zElB`WIzZ$^BOU~Y{G6*&r}9WT`luWw#pV-Jwk!==tTP9M2C%~AAc9IUOzsA-K8Uv^kW1|{&`e=?sD29T z&4nFzTpa>z4A0k$k~Y19?9C3`*-=x05V*Iaq*z6}W7Ob$U?+U6Sj-sNc1K6a&+W|S z^|K_Pbz+0C-3j!M_&3>c+kGyq6p^98RI!wi(X46x^;imV9C`sJX<{xTgmmGsc|s-5Gz-Wzb{KUuVBQd@I(CA0^NSEWv`@7DtObeqiONLGY(q6-`+$M34T0v zq>%Q#o%tAFv%O?Q4Sql$(J1^ccxN+WhoG}+48TpHbkEkYkh@c3rEl^Z z<_9f@0R+@A3{B%Tt?72Gd!;mKY=!5Q491zrsFN9R9d&H`FFV;W_Vyto6TscvDE95|cPp(7tC zRA;yrSYcfhZ<2&Ae5Ukw%qDK-GN0+q88doEFEr&i)U263E&jcoZ@)Gi>S{h-Qx*in z0U|Dl0rWWORg8?>Jd9Q1z1Y%#kK$>2^spFmopKs@7*wUyL}Faxu<7xfSQng}CU|&K zF{mP2wAaQyK|VLVDt(oN#xYbOX_md7ILP}jn z=(&Cwnu&JZwL-6`FhBO!eL24>6&n8+_`)k2u?=-MZ*Hd1dm_<#=}h&!0biGm|7v!C zr)~z|2#>E={Ux7o_HUs}xyzl${zpOGFsaVW$ADM}gGZoo)*DQzVu6@EWC`I2Cn4L+ z`{KQ=-ous8O76SIMYwIS!w7BVzq!8g|6)Y>FZBJlrO<)PVE+YnPVMoZko=zi^`$|r z{43NP2OFw5s+2n1`d#@Q-3RsVJQIVFi4B$s{)V7eik8HpaW(+}n7rD0oHo^G<`wZy zMj=WL4l)TV1)X}_b75I$9*0mbXuc+D#7 zZOM?<`5g9uN&O!1>lQ;1g8>a$6Vrc?k0{Jp?Z2UocGu@G7B}G`i*KJI7K8bqd%@3Y zkC|}C67EF-P-;WZ$&pQxf$!iz7=3C>Etmb`4eO~Thkte+npWvtlg z;r1=Vxmk>cp!?dEt9NYeH_^k^$oW=+-9BhR{A2%hqHcR0mVHu&%IYzEXRQ^^bJ*5$ z&h)<4D{>2w`X?-{?)~vlt9XiOh+NJGl#>xJ1F*Wn9J#$%8IKe zwg9?+c#5%O8Dw)1gl$=loOcM?$1QXjaUkZHk?~)Y0fG^hC%C3{VyCwJ+D0hZPBtXydg6fK4IpF zRX`2O7IIcuJ=-fktde>vha#Q-> zbK%>%^&fl^xO{<1f=aN?{Ze2#w_p0D>iBzmgIS-w*3!?j#t7s7$KBFzqqiH5xBY?1 zm;=L#F;TQj-|zlD)&#gvjDQ*Tl}S>7&mDg;!d--Y1P%X@tZQmf*hw&)FzSsD3Y%Jm zj?5vV3JR@xZHxc5-&x&Gx?=M$%8?D4iC$=~IF^JFUABTc?4-M)=Vcl%Et; zT*5ye84wZvDRYSHQX}Rhk$Pkq?y4$1WSn0#OMJR(MPtFS!(NYv&ZsHXL*DRP6lYVN zNF|?@Z}irY)&!bGn1^o1@DO2I*Cv@r?rQkA+|p>*t(vHu$aj2wk}mz|l8qDN42jpA zRA&k_D^JdSnH(}jI)I;m+bD5s_DFWw)1*Aenh_d;d*J?V#$R*2(3hHGX$-L-3pcqc z@`$`H`oNmI*5`M(66!rLf12<}x8+x|i^sfsjl7w=b4QORbfDkTJ%Rkc? z2?5W25@8)e>RQ+jk|Ir0I#4T2J1T27{6bvK($zw(sM#N=RgRdp(Eufiw+SmNMj%po zxK*@=iId6hS-Dg3N3J+ncC1bl&YlC0*fbGwYVGf6siK)VTduzU5Je7&+Dv!s99cR6 z|NK|j*kpleD~gGM>Lp(6EGJ2&M4E90cAdEcD%wb!YMr(j2~kSJwJ1GcyT12Dqk3$yBgU*PRz<*ICL<}WKnlADiv1L5Qi|rM| zk5R~$251{mk6>Ip!^s<4R^Scc&_CI$X_(GMoQW_bd38nc2+1ho<mEz1Q@U(2nm_3e5u)0{+ynaj-kP2R3~juM zK}l)ui!UNKbFVwl_G^=I_kdUgr!n!ku~EHm*$~{6Ne3VI4oQ(EWW`7d&rlE3;I@`w z9naeMI|-MP_U{9+)+T?W{&Pk457(AK(qOk%M^wbO zM}`vDYCV>@OM8$NGnwipvu2b%ovkcayvm)xpPT!O{nEXk=e!q}d|d^ogA?K$te20q zUfe$cuvw>Q|42wGNzuC3bflDlUoQH7N7T#f{#4&FurkQd$@o*QEGa8>nxbTlIJP*6 zhcA^&{Ay-uFqLEEo*h@Gp=Y*Fw&#T6;GJ{CMcTOS`3N4L603#4*=X``-`b1V2qcMC z(7fas$!sTXP41O!aCa-WmP3AiEdk0n03;JnZD+#BV5QLXo%4m%wX7HHd>QhbD3Qle zP|SWiDRhbwR|I7BH-l0xoLXN?dNc)=7r>y$@@g9@6o`D&v1FDLw|XLj&dA)vG#%Qo z>L+GpfvKV*OI!&h5ks);@7F*ic4Z{!U0N~q7t3HgYPm_QRNc9z51-+>nhUwj)r7|C z3LHP4tmRkm>Aan>X7Zpa@GH|w&WkQ_1^CeCaLV(hfoxhAZhZdti?M5}0lTHWs+k5q7x_7n)Z) zv|LG)GfON_gc`rwgXmKIN(?n~$n6R*wBOzVgEk&ZBaQIbd z0N+MO2`8qT6aLFU-YZzM-Zit>)u*U8Ku7k^g`Q_TCeImf)KC8vFW(iEFzMSws%7=x z-KltYr>eI0%ZLg2dtR+ph1E{mPSW8ogHmjntM#hKuiMrfiIOT;4cwI(NTnA+IOl)L zR@a0*PnVtxPHhk|iwE10_*xS$)?T#&1W<+>=7yPc1ZXt8zA5f#F&J{DDi!&R?l*_$ zUoK}-#|d@QTP;q~3nk1gV>vol&1L5P6q$P3ihVKR{$SgFMLkI}WhGk*DfPYfth1V1 z!n$oa$fAwJb z$tsYL2;XDnybmlDr2lbsR5~|y5b>tgv+4lZVB~k_YZ@g0q;%ooM%2WF*caHw%mLs1 zcX)_b7`aF3H{wP+An8e3eD)heTqNyFOe9CE5}HbS9qicC6knmMXdOICX~w_Ku>d7OMj_=XQJEC;AemxU;X>_i=|m*`j-S zs@O(A`n0Q$Kf|0&mNlF7e6He&zwn8cUoQ7-+-`ZQ_}9YL(i+f zda_vgcQ>xk%#B+0;qAsy~ z8~nG=w1bYc^FowEiE<-R0$5-fOn+FK3wfY2{YGz2Xs=!04c=!68v03|T4tEYDJPKu zy9?E?CI354eyJuU65wX`l0kYVX~I{Eqs=TeJQc62%kHkq6weVgA<&dsBf&t5P&8xb zV1^hbAPZEz!15!|%$G=ZTE}MVP7N^4t%jMA3^kePx&3_XKC9N~9D#_^62Y)(H zX>y|eRyZW2!M(d8mS8F6g{ASSLEQrP4Qe@4;~E-nj&gappHgc+{0OpCGGEF3k#eZ* zcW=;GVeop=05ySP8_AHAZ~mQ9^6<9!s_2L8X>dJY3(QKQ23 zdblIMk(r@Vf|sA_Wi|EMBQS%XhK*l0R;4r&+(wfW0Z=y$^2WySiPV`;$3#yWu654` z7urkLWdF6F`S9rF1(SmQ#taw!Pvn2m#-;G`x2M7hzI`;G+LQh#!m*cf-By*!Ubb3} z;zsa1_OXAE#8;%1x*744-zUxQ|K-FSms0+%GWMbx<9O9IALrV>9EpP@9WMyNAaN^t zOH#txT42R4E9#}T;dQRv!H6jx;DPJvt=aIOO!u6Z`>Lj4DVs7T25no_io7v%ENwrg z2emG)s{~S+%zQ@L$_mn4hJK7Ec#J!aNx-DGIU#&wEt>7*>x>yLRh1#b%?~7JoX}Uy zMr~B}l2}G9lZMggOD!?}*!I+R1)69$Xs|s0v%0U5#%lhf)vnq*86h`>@4TE|uC8P0 zdASqffS@NyN`21IgZJ6B>4Xa65bK7UFB)M))sj z&PAblYUs1uk4qkxePZYe^RsZdc7-@!ZFdE&Ak#x)pgJ#xCi^nScL_3fYqXT4Q%~RO zEWevykP@d){9MP=Wg+}!54I7m6@S(Rms~A#X#A5;*ZZX-X@$?J0zMS;sP}(3%k&{S zlpa3RZs;oOF{AW=6`I}vb5JK!QW5q?6s;rYq93^IGv3W^Ib=vSZ3-HAxlHp3nT-_U zvGtM32yv}F=hfW3MniiAOO?-8(3_RX& zjPz!0PYXo-N}oBeEQq+~S162`xapdRN9GMqT?O`Y0?_zcSb4Dx>v=zDY=!FyV9dC= z3Gp1^r2bfW(1BpXvO&9or>+K*@Gt|7mr)9Idrr8v7VCY(J)6iwGWWzMVDcSeUNoq# z&#u%@kpfx53#rb3rku3SyiYg{0SRbZ;d7qO!xf}kRL`~6vR3kQo0M<8I;+uuB)&U{ z^D;INNdLn>mb=g z|MelASaYFDp-y#ALZ86K%1|q5UXU()?o$_aM$bI9ptU#+4A6&J0OtJH5ElB--YjEF z%`^5&h9s5h1otSk9b(VkHMa@BfyBA#bA=t%xq?8gEu*NRXa1Wr>}>xgK+$HT+rmyo zMZiD^gGl;|D+&AN$aKC#7ELP>3h|CDF|`s7CFlH!qc&g$#J0kSpCyYUUeN7clbEV5 zrw0_65qf3AH#7P*AS35+NTqb1b&T-lTr3Gl@nb}N>ZtaCnRj8*Xj zcV(7E+32S}oE$tlJS7*-@;M{p@qo5k4j|GSTw$x!^**&_7 zZ|TJXMD&3Tfkuql08U;NFO{0CACN#Ew^t0n{I?~0PKpt`GZa<#XP0NcH_NzRqDuDT zB#CKeD`4CsXcQUV_#h4SARX@`2?9!+=vYH_I`;axOGM}@?!ju z;i6TW-zw}mGxhZMWl8Y) zc#sk#;@bEfvvELvd6m@2myr-x;Z*R+^Au|0NWhd!&*Oj+^n-F=p&}nW&ECz=-8Re{ z&=UJ6=R{3{#Xa9}GUb;B--WOE^oNH^3nDS|QN457y^5-w1 zMI-wQM$`=L1kSlP@7?iDSw5f4%~k0BQad==~jYp{Ge{ zoo^384R@Y~@>xzm{^!T4o?WFIpT9XAnZi)I-oHwVA=^Qr5fi)p$QcGoiu)?rXDYsF zZsP(De#k8b+rSGR@Uc4iUCGk*{4Ijxh+gmWfe|H@ zJcf8zp-67^K&@r}Gx--fzvbadL_AOioiAFrGUZADbfjVVdjbbdi}l_pa{o${n5F@7 zc@Em*Z-VNGj)EXNeKO^ez&wvvgqlsZ%Q$fEhFQz*vn7y*75ZxZ{o|qemH@jp4RSu? zLViDR*LAw$GoFw6-wb^x;7P z5A3==0<$%!fmnI6Dm=Yh0LGM6V<}TR}^IZc|C@)jA&y(6O4GX$$UTKz1w++(oV}#Dz*s5R9@aY!F#*G~5<=O2v*d^)kZ5gbb2G1B^Yi znGfIokq*m<3QSQeT*@2q=gi|C$|z>%IG?7+f>KHoDZ#s=i0(npJoyttIu)bx{f})dQD3-zT!3*jA@Kw>3OM zv>c|o;;hk5^Us$5d+S*HMw=rP_?avnwrv6X*Y;&l$LFooTiOBovH`&vA~i`it*&~*ys(>~!h8_0NW0&^yUhFWf(DyH_I@U(Hv0(Su(U!p}T$qJl_=0J(xL9d%X zF1YZ8T7^B&5O!}GWzKtZ>}Eyrk=1wh5C-V-;I11-7Ml&xhh!4E|LWuPeq{U4>xUOy z=wm@Y=$(TI+*GZI4b*e(N?04^BOdaTPjzn~IB&xRz%(L$ZWnP$cf9%6H;gyHR8H|b zhD0t)NT(1Q^h)w^gCbfCu|&Rf;Lz}c5yOmGK?5tLKLnz9Z`uQ3IDenLCr__ik&D(EeJk=6?19j9gR|&`gX}FCE<}I03qy_~bM8zAxk zS_><-Imw}#AdK-*ju7WMKol_nMxEzxH1dh{`{I@&9%WFwm00dy+@sMbh@8R@IQsd-T&nf zZJ+{aT)b+cJGQ-YH)o17y7fP=@AYNK26%rwq?oMXY_^+lty^k5$*W^v!t`@LTqxDT zbVb8**ULMc_toW=bt4SRe}8?%vDkh1dw}D!(bKubQv~tzG{Q?VsHudj6!_#zb>+Hb z9J$al(U&x?p@zTS3a}W|ik1ZbSyQrF*Uoo*IAsd@tF}92yQ^vOBxIT_4qI~ldvREp zVcy7cn1+d62(_e6wdDLWbu-kwIyS}HCZ2owoFtvmdz^$hko?pR}FTFbK2N!s$!Hc z!wusM#J_b`);luQ*qFy=_}VwYIUy$%@t6xH1D7j{`ux5fjke;s ztBq{7>H}#8*tjIyR&f@Oa*sm&bmLatQ$Z~5OpTR~#GR$kcVCVBBz_w2FT(Axd>w2f z7qz?0@$CM7s;0{a+Q`3A$stSXz;gT6#oT%3PI77evFV?@udtq(y|uIFG&gM;U08af z$U5n=Rj+<32b}S1^V>1vn?{>0iS1BHFVSR0H2ZHB!mt2!?fUZ=wGmrl8uc$IXtE@m zw+9OOK}P%lqL?3 zBk+f+kX)}~MK3U{jAL^fahv>yOl!|C>m;oT6Z)z)ydZ3p6;M$Q74E#{qBdkG6J+Fx zWg>2$*tAH_^@teW+WEoSJ~^vBYHN;H1*J9Nq`8PV(PYaEe%NhNC+tkM*xon<2+s>3QUy;*pBx|81T#k?n z6w|dth`4dE=^<JNK$+J;%)j~ znEi!Mrgh-S&@|rk&+U>0+~XqVLJ27=*@Oz2;Z=RbI^t4x*?uBx{`@?p@>~g(JNmTl`-#Y?S%9ys zj!e}@UNk|b0RT2$FJ2TpAm9l8x@te=2mrIo=lG3`Ie-1YZl6oGjr|JqBS1fLb@+fIX>oX` z?9->g$(K61iV%ZRnbGj?7g8PmD_I*&M2Isl?Nn!AQ z^{(Xb7&EuTRedQuB3JR|3M+dt`3=0W@kB`+l;6lZ)d92w9Wt)d!Q2pr6MnocG{g4s<0;vIxWXEBQ!i?UA!OQ!~1!mPwh$kI-h-r-*MQV-|V_$4!4xD>y$-H7ZD ziF{nT^m1bL3`w-QuNmz`Uj6cq;V{!+K?ENAKc{U`%%ri`C&f!ed8WsOwjWir6MPxocnw!-w7fqk-f}!p|ylzl(HzK(nyVv z5l9SU6+%X3AsRwPH{NwgR~oelI-o9q8b{3IM(j?D6*MbZ5rwK3Vo6~|OdkdMl@-q4 zLOq#zHO?2tIf^ZlR=#%!B(sWcNiRw_UTaO+>oZ|P!i5!92gs`+HFE8kCZVd2?pTOJ z06}B(razYu+BS40K`F#z;|&RXBY3$ML*ZQnK0a1UblpWZk?OO=;vHiN?Vtz~U}&as zocIiVo(atEvrPb1X3|>Tx#|fQbIJ68ZCbB?URlEu!~rfrpW=x=&3L;T zbh)wl8pcuMB;Q;IKBx(jg^IY|TfBds`2Bndqpq_vaG&8r?T)L^V4_~;I4YG~gMNp8 z?AiY9^n}{vjC%g6AkWOJIf1u#6&T&$Jntp9(4o1h%^UeysH&|tl^`j{KiPllpm!2C z&#slfe1^ZsqDKm*)ES^W-Lc<62Y=8^20O zVbbHXBj0`azFa5Fg%76{KB|nHP7#))p>M*DnUf_#b-4l`>N!0tC~+hXp^#qo3vX3D zH?K~zarD}^s|6tCDyZf`i*;{N#Oe&vfH}2m452)v1WUQrk}Kh9=jM+dP@@L)!67c> z91%wEOZjR!Pbg?y4vuhP3dSD9yRFp4x?G2~!*!HL8&sw6)s}Bn4+dROirz%+!Y#9h zsHBSPh^idZ7rWf1tz}qZQOc)ec;01g=`k$2ei=NTa_+WHI*GPsU?XFGil)_ojhjij z2uDSO!2E{*0ISsJ+?pN$*2X0=$S%loclT*Xtbnou>EGzDnkES#ZArWq*Fr=WM*VwK|WubRY8bJxu zk=Kg3e3Y2$vLqLD@-iSv@Iu0L>Qo-Ywz5iowa*@2sHCfDEjL*P?DKGKZG-)xy*3Gc zUG1huQo`oaLE=Pwg@Ty2zt|4AM^HsYwbRiOaE_3o3+N62<&nNc%t`Ei$Fq)J(*li~ z{EVT7vCO?bzl~3hGB~>-Vt-)H^hEmiJ>KZ9Wa?9h$dh6!ETY7yHe)(x&)3O)rj)+P z*zrLLa#iAYyuuScjD8rZT+z&0e{E4J?PncntxU@I2aZz*NoE1lUlKo`iie< zFp5I;uXL-GE(a&}^c|oHh~=jy1DRzuzn@nahDKhcrRQsD zPdz^5yulo48WHw)3cr9A{jdEBZ2{;W#ho`1}IV5IaN~Fa`&`}9$$+Rw| zZTpHpWKc0g!zBsEOprbzim(OR{)A(Deh1rbe{)h&1x&K&{BTk%>crB@+}Ut1feM%@ z&t%Wza)h3*HA`tH%}(>HFZggkdXU>%14} z{dwTs8h2hvyfsSoe4(FZpC<#D{BGL2i^y@+9b@Tr1y8kn4r9DvFj*FE71vuzegZ=f zuef75QHAiJuiM+QD|H6iSRF>0W8~EQ*0Xb8j~ceN?L>wG8}jzj@WvedLh=gOdt&>D zLP$en^+x*R38_jZQj)OHvLXJ@$QaZ=;1dMoFfZ2&0VMfwm36?O;FXFMjY6x8K-__O zy;=>3y})sHJe|liIZAi+S?=9ck#+&*CrNt>Z{B{w9yo3n|HK|R>h)+BRUQ*ktzb== z|4gd3gpR5bauzD)Hks25`C6^fYr5>7px~INZ*Q;P<|h+}Di5pq;>g*+Nre2+bN>7f ziaV?3)h?DQ2Ao!NmV`Zec#R*gHK4*Hu~qKc0xa2S$d2OC`UCDe3TML-g+z!4nO_QY zo|Lu6Kk)yS8TzQ;I!R}kd3ZfmM@C@Uafo$jSHs`5Bh&@JG%-R zvKhwbi(?v-lUKQLT{o-md~hM_z$bD1W^z}I83;L7{S;bD?vxay5EC;6C#8Ud9N38di9Vh~tIjD-%qb8BcnyS|T6?U# znbp9R9jN8AU&A%tVKM&D7KDt?Ox0qrYf}q}UvQ#^GbwUUw8}sg^*%PR9^`(A*M*Xs zwE?N2g7U~($+r3GY)El9ib_Z4{yKxDNhm}Jn6z-phKd5ouRDHuD{Do}85r{nX4sJ)z1qm^e@u@5~VlaN@$3ZBY z%)qH|BGI&Q(97aSkH{%mF=viE&1Z%#fER7_d(2S{6A32JRf;uQ@MNcN?Zmj#W#fPz zvBsKws5}Eyu65pK?5J6MLl&Q8;J?G=!F+~Tj5VwB(vZ*`b8ZgN#VN?Lcmaxt$IC1W zLm1>*c>%g|yw&mY6IYM2(5`D)be^}Y2sSzG@p&;Q?yH|8E=;R@E1l%7Z@T%HKjy1uGz~2HShjg$w z&(^>J3pdrQEP*6-0Rhobx>-JXd8!bmDib`pIKQ23+2-GP#|w;pL9`i8 zrz1L88m=jKovVuKk3yb2k?Ob-{RTHiZe*X<3oQ!L4c}Now^SRB>o7U$LtCHv3L>Iq zX<92j&wWavgQ2a-)z}d`k^r}b(>2$W(_uM2PpDZk*e5Vx3LE>GRV<*Uv8b%imxhar zxmSPpnaXvlI+g4>%p;uP)-bp#FpDn++W?44%>+4G{P$RB;9oIe42W-i=1afOEXit0 z`l_)m4cbNjRf?<$V5B2~HB+crDE*ZB^$Ocu%9pR^)YgMVvW5)}&z_aW1wu;Q;*V{S zA$!Bj!I{o4r^8cbN9tBHhxKFushy7;XwX;~nlD`k&b0^roF;xnAO@V+B}AlV-6TTU z8<2iQNx+jUZL!$ERRojhD_j~2J3xIEAlFt5KET0+iQH7tA|F4@Pxy@yn*B+Z$`@ur zRBuYiuyH;DEt;t`>$hnX5to$eceyo#lAe+I43E5nd$T)On4a^&5?wY@pj@P2v%@52 z(g^Aboex0ZUVIr1cu5QI6?#=4>yhHn`Dq9lqggWTUz4WC$9ORQz|`rydsmC&}9{!*{iS3&i7C! zuas?#06yp83q7zucNt;I$w2?&JlKe|rf@38TE)JN?FY_c75bnio-E8^lr1*e1G?^# zv$AK^wHmCt|L!keimxXHc}B!n-?bULKmQe(Z|gMt^Ap;k^f;n#*8O@Kfl{e&r5WDS zg$=NCx|2_gUT)Wxs*4N7MfKnOfWQb1*p*3@-M7q0pFUJvNyLYYn0kFX^l|~TWGitn zT7}f8Xl*YdD~%E565@=bsFFd4QH)5H!w0r0J@AWVgHfEl@SqsXkOWaVP@_sUlB{O+ zY;GwU$rG=A6YBz7-BORK{XG)HR&8M>e$YOWudc(YjRo+H{#@D#X<_DmBP=Y_Qx{)i zY4{4IiLgL{O2PNZZ%@exkh8A2mZH9=QI3aoh0BWHM7esO7ldry)4V>?GqEuy;b*tG zJFWB2Z+D;los+JcP@-hO&}&eU)?(`2MD)9pc&EQ?R59sL{F(kLPP=!1sal==BrYt$ zQ7m~(BVc(;g;{Mc@jl_{5I&FfcB)hfYznJVi0iX9Oz|^Ner(zGGW~Vg(;32i6mfQh zHS~^=6Ky^z#+GA;?#93OL$$Iu{f?Rxshnt{xqHg`g?}yQ7OARyc!iKtzJg_-o3-xVSTly%wqYCE})kf&ccP#558)WgDX2(0>b={Y$yM zOzo{n5EyldgDL&7_kNLBdCURQwH@qCe{zqGB0=m_0a$^9*op>n#s2J9VL)P5EFF)e zF9`vwijX*9gwh;BwYIU3tekLJKpw~|v`u2;ypF3_;5PwmY`aFZo?4^!X0U3^UT851 zeU9M?rdck@8H){MRa>%CpnaR;A#XKGy0L6~Kc2LvT+H8G7*M^8!L><>c9nK&wssp3t{jp};voeB}Ja z%Fo09CF<}Tx$OQ|8<4{@@h<47%?Z!?E?R3ogR_tuSjge=MeYVVM`}MZ1r##Dk%Uoy zxP+qNcqR;oICv{}-nSfA0*+t*{P2Le*JV-F1Fh#}LhSIG~z`ZZ- zCzVCS$i5KD-`8(%{>(r9SVH)$&P;n7eqKHJdK~P2H#`scvy1$nz^b3^(om822lr-+ zEkE}j!GMf_6 za?4`kB%Ww-wTgNZ0)E>YE4q<*9|Z`E(-0Nga9kOuJAI_EL~6fjpb9zEx9qhMF8JHG za#RrdSA98dtp7h*q#A=?SR1A~_wovkYHG`_h#T>?nNQm)<}!nB4>x#|UG7=3xct&c z&?vpZzcA%*MEY*HThB`+d-6D7%@$AB6Et3j^qX3-|L<`1Mo&amDOi~-VjO?k55~Yz z`7hwr%M2;hgPRHoT?qg0AHVv!aE$t+abS2a5EoV~eVcAW)rg!hQ}MgQ9~RQQ=o!M? z^EIb@DBT(J?igkAh|Xq*!qcohnE-Izg9x#^&kwU`e6EGWjxL zxJGh+jP^e?orPNy{?~?y0i(OSMmNal&e0&kq&p>rF9=9?4jA1H(%mq+8wn{10YQ|K zFy8sQuJ?b~_Sre-dG0#|H!d_ip53ve;|NL>DMqI{Td4}8*S#3%c`8M*$!URpz*3?U zDwPm)9+h-ylg3nn857I|3|r&uTtmD!TbcMR02Lf?R|e+_0tTpu%!m5FLKruTy`-%) z^#&+i3_82Rtxh}2#u)S8eELUQ%dLH;62=QmQ~x4OE|C&dQ_8(#(mms8_iPG$DmAB& z-0eBj7kSUEg^}I~gL<|A)S;ac9Uk>@@Yu|z~v-t>Tn?+y~p#L1#W!P=$6v9WK3J0Nft*Mu` zy&F6h>(meM-w!Rxc7%UQ9ptUIT;87_t}n4>lU?f8R-Kor^Fc11()9b*&rcHHu)A^G zV?tl{*exD3iq>`Duw2Dle$9isTeVdScoY02H-H<$kL^72 zGw8B*7E(ein0_$TPUGFuL6ogbTC zOiVR7)5pTe5;9kAJ^mZiC)NN;5?2Y-S&-zEnVNX{&)K`CvUBTu!oya9xBV=igReCh z+*g|kJ9hdP`T$m!BtBv}SaJ57!I7#=Y2ivpoNw--C*063|oS5Uu}WO<)BNDTc^8 z8{N^j;$feNP}CPQGw!KfUWU@G`AtdZ-tW8LcgMbXj)?CKH1=we`yi{HRY3n^WK&hq zVrGjZZm#S1e^b)o-|#K{CWoB2UC~FZ_o@*|Ty$B$abh+@1y{7QE<-L4|6x1L!8IxB zN3+V{x(yY3go8mYrT!5Q%LY4h@`g3YaG#QVgUW+DEN4Y2_10>}0>aZ)n8SBKeeRpU z1<3LdHqp$rsl?GtjGUX{ELG{p3m_3=sxbtpj(jLu5>r%;M4f+CW`q;gsH!l=b>K?T z^C`0VrCSp9ivulLY{4i}hVNbcm##f(mJCUbBu*4c#EO2Q9GjypNVNcgn}=_$ayXc>gmS@& z`RSl@`?&?U6I_?f*4#$Gq3b%ekNlrL?jnw}!$=2s_$SCNgxlXr%xO8FYjvIm#^VXwQtVA-_ z^Lje10oesN#}LKuAb@f*%c4QaN6D7_#)SH7>Q(W06P=0Nc)Ub5LHS1zr^OPX!EB+%emI? zQ=+MSN$&E|SJAQdTwGRbj6RvF{uFhpGt`1!G<|9iv~eAeAzWVMQ2Br+b2=)P$F4qi zr;uNFgPLsYbZr$8`DnAhnV7J5d>tE&Qz9cgz2_5S!YYomfrh ze&NYHs^?6Kwq}D4aw$)-?Moy4o7TpxsrHc&)k;oQGRw>S-sfCO?yyZ|h&RuCy%xf( z(Q5b4EhQVBl)~f+ltJDrKAfKlg5ulnmFQf}N-%F7;?qz4Kzwba(>L5W%v+s0L9O=P z$sSuoLpYn&M=16JVnv#U8$!&?W@Yi&3Pi{djuYY=Y=a-C0%7M9CD4d`flzg&cJpo3 z1*wRZzHH;lNz~_uX^jUagbou42D;Zp;aZ<$99R4_80D%|AASwG|L+^-uiQqnjK6aw zL34>e?K%TW4B$=*>dO!XFuL5q(JMv;UYjxS=?3*PznYK$*eJSNwf9rMJzGTE13gWs z>R0?YV5^Ddz|6zba0dWHOReSVZ}lbPh&_9ZNA`>L&uZ7VpNQVP8`yR%VNx%%|!{{-L8Y8kOhwtjhOGn~i}sEr)U+g2k*V$)q9+6|TxjR~q{7p+I*zI(rdH zr!uA9Te+&hIl1vCe18DB@RM`)ywIPOa2AvY@E6|CsUs_mA?Sy4F1V=;e+M1n=`Hg& z-?OA&s1XUit5(wD!3J7xa=HMf24sl&To6r}06I(E>PKBWKO9n>U3~2L_F<+v2OPtq z&=MfBgvt?pwp=|>qd;3)mzgws{>c@~rV>wK_v@Kj+v@M|?zRU@VJ0m$61)RQKPK3fA z#uE5hbjIGGCPW3^Cxi>SIrXS$4xtVCOO%a;lZIIWwTNE`tdsjc+AFZ?v0h}+K)sI+ zj^2bG5IOB0Yo9EIw-oYNCfdQ_|A}3X;YvU~G$;vn%zE7@J_t2a=IT39o1ymocFOzw zEx0F9??(ZNJXHPSkP;(g43%`^75r(MJG926P9isUKTD=M17yi@kw62CttMAdVQqB- zJRs6~emSIH+pD8bS^XFGA1&X@XhgwqrnuU% zXc3zQdBLKn{fuNy9Gfa+;BRgrAMO~tfV9iDjL#;6^Wmhmv!!BhSJ)#5Fk>6|liq$!^x*7E9%v+M);$sxzW>hv^N@SGAyJBCP|Nxk;Mrj^G!?M@XOtFf-hD;* z^F~Ec_U$>DhK8Ur33r1Aj#|$zmU*9|XS2aU3=Xzp&B~3L1Ge-&=vD7e`r3`Qs8cch zPL3$E#;^(EQZ80jismdvz;n2Jqj2PqT@s3QmK%$x>SF5GrBP*^a)@ORDi6J87)jt!Wr3Q-o^7z+J(? zuLdpGp1O;kCE_qIGZ^<+oc(e$(2E^?aHXkNMn7bk43z#wo>ahU zExtc{_jZ1I39lulHw)sO;hT0Y>7wB={*hXn6wU{?3)1nR_55NDw z+ZCt~Vy<4(B-9LH;w5;c*rc8{AD0WL-JS%oySj%?ao#X2k&@LBJxG5cnc>Av9W(!^h% zYbEp)4N!@BDf8wysmoxEIk-R57_g#2X`v;)OF=&rRW*NDx0+4e@T*vK{zVA}t4c#QKaru3Bo(EoZ1iX=t>tKMedtPHTy8#u6It z)8!u1FB_>fW;77&tZbR9!1b+&OVUq|)Jm3l9`mzl(obB|PvmhbPrlMH7>14EM*1Jd>$dT-Ap>mG+`7reVLS^XK1ke82rNb1Q<#^szt z+0U=W$lxaJ7*m=+Qb_a43tbYc&8E2rYh5% zX%Q3EV4@#(1W_Ou@!6!bNe^~tjoM&pH`&CI6#M`7C?aa98^T`7MtTGZ9lBMz4cc_9 zA!u_RM^DB^IbjrvA}no&RXQ5I_K8zyh9Mh>&!S6+CGfF%kI6rof!k~wVC*DD_Lh03 z?2CyVuyu%lk}z;FLUQf~kyT<3CM83&EZtXoXY%!xJRh5?nS-9}j^P{p!R4bgW@sX6 zv8#~)GjMk-Z)8Qx) zIPnPW`uizFmfVkOX>y;{GqLBW=iSO`9}>Y5uM2X$3sL?0&sebJpuoGUB6Jq=AT^NxHszaGFgu~w#v8P zKN3?Sc-gk4Xrp6!Z&s;p!ZX6!%BHLq%8GoCQE;>b;Wl$j>XD}FWy3_WJNcS#S0v-X zp3|6lBcGy7bU1U>9vx$Xv%2%j`S9Uigjdd8e(RM`$y|e-luDKU8!q-I3pF)+BLViRi6=$|0_1dmej`acJVz8lH z6Zm>G$Sp%KEHGKiK0TAwS0{ii0@NqAD@4m2!@?4D+xL!oykNxM2Z8drQVXOjAimLgd}8ecW0?l-*C< zLo-`Vpa3+?76<=DR`#{Wn)}ujQ^FOUu9h>$3E)AjaR#pEW@ z5z0G6Y9s_-ezY|Ec2*%rf44?~EN8)Y8~%}a)&A#cEuU=z`oYGDZMEgWJG&>3Nd@xm zEy3KX_q1q39>%5d4q{8yF}brO#;eyb3fyEE{h!)-aH`(wtArl`cI9(0dw@_;nn6(d z6frcdoiM;(YwW0j!+-&RHfx2C0?3=Lc64j=TNu2-k>+jPQ-x`7##&JgF}M@UGDEU}QgCcUOc+%FG;xR(iDn2r$|^TM|F^1F z5k1VlUa!CklQ|!kl>u%DH6Cyc~4SEyL{~aui%@Xb@m9mQ6)-d1|TzFdSPg6++y) zU#|t3oWXm<=8)3H(m1fwVwlUcri(Oz$~L8PhsQo~t8*wrq3jw$m6H`)UY=b|h-QfD& zr$PS9XqXy7uhUY#1uW3$Oy&fBk=py8s;PVkQ$pxEnwRkJk=J38xFn&z|2fiGy~h)D z713FQDj%gSl`pHF#I=ks06vU?xzvU%UQ}jn4yc3&I`A zn^}kXN_;fn;Ho%5%up5C3Td;j#7&`v3A5VyK6e)LItXh643W>$d*nr6M`1MaoSC;M zC1BPz$i(=?)_#h`JF7{C*4^LlC!}@{?v=43Fg7EGX+Izdy9Jx0F$$~8-y(2836|F5 z{sP&`2Sjk5gZ~^Kku|{ZcM#%{kUVu2vkLjxu}5;!MJq@K=t*L#Lf z*5k0O=Yn>bmqaN(8a;jNEQC_nRo;a_>3Ya5ps8UMfCb9=`Gcz2KcZ9Tf!&mcv#EQ( zGw+lXDX08bFU*-(3Rj~H#gg7fl?^-p?W8`NU>E*WArKsweL4!my*WKRl%-^=YqN8( zKl3xhyXHg(*5fIU*v8iI3p5EB+*3y?2p_AJ+kC+=5~bqDT`}w3{8#!BAOZUGvuS)h zfBW}I%bhXs2Q$Uk3Z1*k!wvFt1e#28UM2BveeHeCMIIDzhMS@^$jila9ruDvFvMBG z{w?1ZbuxvWbFYOygoqW_6|!#0k%@XYAAKM(aZ~tH`Y-(3iN0%3)M{nPrRWPpen%8% zRE!v=h9rs%lKSN@X|1ilqFeH6Uv&E(Nguxmr!kzaTfYyrQZQd%)GSercKwSeEi@(? ziF;F|w?dB^?3SRQTau5rg%QVhOs+?J(D-|+Q6lRGVe3V|Lu&iN3aD;163JZ+_S4RS zowWuN2A?V=$fV}O0a<>@6Efetjtr|18N2qw43YhTZJX>Gk#ido9vv~WI#;~cu&lmO zLsF}J^oGGdPcUgT;%tY$9QgI8W-dDIM71wLK1T7;rae$McnoB_gVf}&vW>=M z=8N61AMXWqzDFuxbYT#33-#YgKvo(4!aMuMB1vBCD7YKUW?*852%KB((_DVKDzREW z+0A*L6q+;*V+n8|cJM>Q5k-v?AA&6uyM%tfpA|l^-Q4_YP592lgT5>CS6q9*A^rP#J@>WlR4MdF?!8TA6j_#!BJwYW#L@_gFiY7^V=3c`Tdk`h`}3bv)vQh zy&ta}c>jaSE}UmBTki%RZSmksTqWCDzLrdic5DwB3|O4th--A8zCvhZ5i`GLut`ZT zo28+VJ~ckc+xz7ppogU6ctdyMJpLP@EmwcA=zRSbGR1!Rtz-Z3t!t`p5&tEd^W0?9 z>k)`?%*UZqCE<-x+@_hzg$hnT4TQys=Je21pYQ92C7EC`$KrQNre1Gu2(b(f+^id4 zR*`|qI+V0tr^VQfE@n2ZbqrMGrH4UJ1{?cCqRQaN$_4j;}D=`2|HAEvL_TYeIXJ|&4^3{>jickDATf)0pp)MRrjfE((M8Dg#l7T zu{`E^Z=M^f=hA+@4CuS;*#1=&)i;Iy7Pk6hbNIHpR|#F6A%7!#&Zz8&_=vdA=gW^g z&qao$cQAYgT>H$ubxf)C=!q|2(AbC@%&6^!IT{L;%_m%J-P~iwV3wqndzGec(k^LH z!@fz0t1qiU3si^bZx}*KN(iDc-0WD8M0mi;uo!&#fj%?kjWYo zs%QAnvE_Wwnz9!pp|8P8FgwJw@zKLQ?ALYHpc{qsCzh4N*Sok_Ix)76mQ{8TL_M1y zt~}WV2j&YZ8l*ib2I|K3pvvUsg?R=;z zjfo7+&nA-zz_K?S!X3C%O0=v$K7hBucKTGKLQ|^McwZ-&?&scNw(75US;f05*r%(d zJesmH@r#45R=GY4zTwosNadnRJjoyyc4%71IY4kyl93_^lV|*?6>j;Xx$j9*VJgx(v2;=_DsdGVu%<|CFEtc@$0mkIq3yRw8=}|g#rj4xia|*DcU_YQ_CPsatOVa z`TGSY3kxd%&K#Fs4nb|%8&~4}Bk}y19a95Q5ncnnlfIT6x0YY2FwlwB@UD={OCph{ zy7bQG+IkWH5mhBy>!5XIJoFx1{(Fj(nvRR)Y}P}9i!YnRl_l36u`;bYP_2wI@&RHK zHR5eCnlRa=|7%oHohOqdyn`}6ZCzOYm-$w;V8h#~43lbIC|+37-cfiYXkSG|FrQay zo%EC(;^WvBAw_=O2I3!Z(4JRB&kk$hNTo|;|ueeHQgp>P9HnZ&R`yJrp zEt*|<;jZd}a~@7LOqjJZ!M(M@p2@vGYp2I#O{n#7J34mK4L4Z^*)kZiY6%acGp_xj z%xC!_w2!rpy|E=PpjzUDwKb7rop{aF(Q+2>HKYR*T(9p&dG49yvy!-_!=YU)&aowDr@$dsL%I(^DCt8QC(qk)lSpWUbl zCQuwB+w0UN+x;?CSJA-*W)`tkU1DrxW#&Td_=22n2v{CYxPkiAI(X9L&^@z?v8+%Y zOXGqgPp?9Eor?D-`a#SnzU!;}9udf@jYW`{22BTgWDaV&EquB?IN~%9qJ!6rDrAs; zZ_5V49?aoIS{lg?WFlif+BL}ZcUw1;kYQ#(vHhotfwfq!*+mN5EXbX9l|O)Bww+=` zo*SFrF<`Pb{}zSTGL$Af5b9-?>yK?MIHT$XB4=GFj;!jvLh=uJ|D7?cbGi|ahO#=+ z^SpJMF7VwBnPc68TB8FkVrh<0HW8IBnhEgC%c-FDih`9bpdH8I_a+BmpC7m_ezqkz znG&(K($~dSQ^gRCV3WJoh3`i-LVrXXdrY#{SzVlp;(lNkpzx(0QgFm)9yj~y{wgqO z7C6D{abyoed2a1&PSuui$Qqq~nT36%Q|NwkdHcYdQUgT37uOie><74R%#OxN=rzq# z5I{(nfOWbr_V&>zyF*nD8&`)_vV1l%%x+PbiQEhelXMso;7XtD>44t7rXpC*pStN> zvw)}sc0ly_o-1&bn5U8<4P|j9Vm(mRjgN~^3!*qw38lIp9%qwXCkZu9SyPR(d*8y- zf})rur*fjQ9TZlhO{5S4VfMHv^GB$Tyk(@Sc=V2fhhK;jt@+LKdHD!mZ}VGlBAY}k zPVG}o%o@vEuWmmrk{{=q{h{+iTPJRwMb9+XBz<&_9jj^ZB4F39^wz7hBFe(A$4 zn)jPuqeSI{#Y@F%<9KLQKeeI}k$OazXZlvj$akQkg=U#Q!V)PFDDss8-v^6yVg zaYHvmK5JwQ`^%Stfu4vgitAd>w|-N5>% z9XRgRCNHsxUr9IvwY4TIa97xI4}Od`JjQEKHeDQ&VlE%5wzalnvsWIZ+lfd^T+fPy zH>nQU>jL7!4ulVRMKPurdl^|357X%L>EaqVHC5X5>(^ohMI{vWO$1ecEPYtw9^(J# z8IN$XhVi~Nh;&e3)s;{1lihhAinO>NguWRZ@*zM76NX5Xl*Ke($Bzi-{kkWNf*h_7sL zj;qlGYv#q!fosW|M|gQ3eH1H7LupF0iB%RWgtI6C&yXFTWu_%fV#VtmgQ#w+z1>4? z_aJz1_?%NyRTX*dG5=eg!7n^R7^zIozUD5}KXmBOR;RwWVZZJNO8hZNwZ?D7D;7~9 zDQRb>jvBUy@zaarPmya(m1N@x#Z5y8%v_uhN!JWXQ?WBvt@84X6T|2f+t*8P>}+~z1plImcTf`{3w3fz zns#L9yzhrK>yXeM%${R}*W>_q?YDmkkBM1A^7tPyNEBvP4HZ(6{K{)>PJ*zORlE}$ zXHSi+fa}dEP#7{7;5ql-rh^>0OfK7V;0BQC$WTd;obA@(kU&~Ex@&Tv9E0h~u50KB zqDRV=`6C$#TE7b0^z~OeBx5qVHkLh%RRojjzl}~*X}E5~b0Vf_F-xM?`dZZ@-yan} z#2DC;)Qyb$(G~pL1f2dd<15oNxI~~E*Nf_!)w&ukzT})EqT~h#`ddcQ(=e5nIwIu( z?}PdEP%mli-lQD8{_A!(24sVZWoWIXpI^8v^=+3bM-t+J%$wUP^hW{c@9WBN?Sx%> z?*!4U(f0#eu%r(kf{n?|fokvEZr=YBg0YH6P>t6gFBBou;+6ElRFoXHbY{#f3 zf3Y?Y84nwXJ0qysyjMH@ZOM*o293e{p@NBB1x5O2AYzpbHmCGNEtNRQfJmoKp_1s z_4xvoak`{H*Z;`=L0JC(hm72dj95Ff=B4YrMexktPI@V(^T55?Tf?uW&A*+p*ZeDy zq1ktzkoCXarAl`cK}-2yWJ&LSviABF`z6ugW>w=ipG2P0kwB~3K0FxezUIHi(H)tB9STA zmj%D#`-8l(O0G&NdpZ4@Hxr*bon913SBK(TYmkDIJAK^42s@@4T$%UL-t3Ufy=TCVT1rW0Bi_;`jE{!pl~zJGFyebZSb+R zDf3ko2AY1B=YS=CW?YNy&ir&S^I8~dyhmSuvZ~@bBCjYTVjV{TSe2jJEInFblQC45 z=$#_Tw_YFAdNy#v&8dyJGwsxTf20-?Nu@>IBs=2f2U5v?gWs85l~Qn$A{=ZS^zfxZ zND?gFc#s_|S71e^wo0=V`NH4g(rs$0d}A){J9akct3pqCtRTWh&jLu)%8>E2i+w3v zHX6$2roixCpt!|@Lj-;AXC-o$vQr&M3DkTUxz+ZWSD?Mh`=+T z)LZ}66`5H7X)Nq_stnZ4R3A)HdU~AT3)cMEvpCCV9eb<`N8Riop!k&krQV<0qH*4wpWi;)Z z|F%{N9b97=g#n|&F%TL>n~AdmT9Y3J3#}c#H=SPb5DNp%W6d9>(W#u+4EXvR%R;{6B0(ypLDH`6l3h_ag}7 zjm968Kz2FI_obBmlc+#7fg(DTQ{m>5NrmCCGklN#lpO6HiJd=oO$#B4!BePMX*>;G zpa01gTD_SUaPslK+nu`GuH=WFMSGU8fdeyL=aaZ1IxX zdBNC5e5b_E-S2;`LI`}K3B=-a;`6gDXEZM2slGmp8CTh#X)Fvf7Ex@-JW+U_`tPdCD)`x)i|;0OR;3&(dJEi=kwMG zA91f!43WG@=gXF!$KfaV4oD{EZOwd=Wn;zpLIW*@Grr<(V+Ew;hI+7}c4Q zp+I~l5P%LKzJ&=FBG9IindB!l=nkOFZMwr(&ox;eBEgm3jQ{k{E{E7$pM^I)aV#)2)$7vRtJIOTc&HC=?!hCEeu}v3`5F z?RvDhzoJf7Uw7;BMYv2t%aWv*U1AV5pTT zE)zj%qCD=o6jND>0v_b$S*Gn}*5t6D;bhQH8av3*+lw3_mE<@a6V`vNv0gfvGS)0D=~%Eu%wz^^CZ?dA(+ zPt|f@53pnkdn+bA(*E)>3}F22n8^X9&<7A zel+u({t#!vOb~yoBU$CIRYTN5l(KwO@U_iw+Y2Y=Tf8){KPRfxL!(Qv*n)BgS&#hq znWd>wQ#ieX^dH^s!A6OQ9EO%fE8*3EPB&W;CG;sqy4I5$>=21rYqZ#0=FwXtgNaB1 zT6{0`7+dgAua^}ZFtCRBAg-AuNGF4upPbFE4NMZ|W

XUF0c`@i00`b&M(7 z7;7rxsaXku1u_K&CE0=LfPMN}vS8*P+(mQ6ZJn4@;i+%3o#GRr40hneg^Ctp#BIQ5 z17*{NFCYRSlAVo!U}P?7R)h#H#1pyYcqDH?=ieoJ)kLbJt>{E*D{w=6V4vI}uve8s zoTN`)VrYtWDsU6!p9;8tPzZJa`gG>!xsm%shlQ$%kSBfRas#=^cb_92{|T$Qaf<^> zUinHxZ?brwEyt?O=TapHfxJS!&ewPn&;rS~F8&wCo?1srStzX0Q#V2T-6h?06CKz+*~QXiUM*MD zBsvqkLD;v|WrMB}nM$)kaGYnV-oKN~z;Qf%&8ooLZRD+&ArumQgj3o66Ph5BavZ zul?Qk-(WF9)B|A<`#TtR?2@_M_z`iO|hK{;5TqLRD7E^H`PH}z9RthoHvh1hKSBRzSzNKPg z8*>^-^&gc7i#Ga}5YW&mN}PW;Swic-cWmH}>sKVlXFznLPCLey*zfqxz22+p_{P|3 zUYw%eBY$(cp3du@TlcA3%SRVqR{e_niS&x08J!^FNrN4A z5_le{l{fL7);rE==9YB#pFlg9e0eHPB-cP4vUbl1Li$iCcT8eH=xb`i{9`(J$*`mp zP_f$K{ug3#a^zlXQ{cM5+bIv)Kh2}aB?(#mNV}-oF|fptz`e_s7kh??4w?JjL*phO|RN1~roT*|qg-g$$Lh zY$)dj`y6@xX=z_A%EqVPQYRR6_HGII*t=^VeoZQZ+C(9(6|!}rGBE|x_sF2KPI^cC zo=|qAJRzc*gU&reP(xO4;V<&O_WtjrnymMN%ulfS9qLeOv6BS!QL@-0;YmH699V`c zt%1lsA_jn+t9_3XW%*=sjo(BrazYPb`Zi%iD}V<3F-{?FbI_IW1e*9!M%l-48|Ww= zdn1yCD)$DtzAR(Ai#UA0W$w3WKhS-;Fq|knnl8^|#N!Aj zQGZ>D+p}p+6yv7oD{A_?BKLbm{`Qc2>!+!9kH^=iSd5i=FQhjvVfAoWo zcvPU%lou0W-ZvYyFX*1v#~ey`V5Q=Pj!bcW)F0#+xMw0okBN&L%aNNjK7}V$jd?#6 z=3kNhBf4|Pebb{jLmUW_&q6d}!7v9VujKGO32eP|OjhfXn zwAIcSO=u4!RbiX-880Ku_R{^?&ODV`&tG)y2nhsTu>5;xS$BspN_e@gnF(oMFeI9F zZS23#*3k1>ZOro+ctm0_PjBcazc`5t$42Ym z+^Y>j-rwInUv~OyRw_E+1tYVEK2JY_-(v*os3a-sMYX=fw~t)_8+uMOlng7krCXzQ zdg1J$LxQqj-bA`H%Mxy6N;DbmDYU-vrQ0X$*+JW5FAK0UNX|K^o3%h8DS`Vak5KKey0S-sGk6-Ds~ zeqxCs(QuYMWa6#CzweOVm!4^o^bq|{FqkIHitp_SZJ81g4_^WE_u#D1BH28NvUhGT zV6m0Ew%k~*mKwY!UJ53dIxvsOJ15ZMr%570sW14#LRwh>WoxeiWF)XvQ*B5BuLuvd z3TMHXK5r4C#l)|MG0g6Fcr@ir<}TVBd)-7fv#pPfBT|a>7R{@BH69aJ&=c5}5gP_2 zCdhS;`yud;oO@REX9{aFGjRsVkbQqQHN593{fdI-dz`=Qig2yhRCPeJ`mZAOnSZ!h z!S8~!N%vtniRjhO^W}e$dc3uN^Q!v_Sk~f+R~c6KbNAiVKX%EYJGFQo@BNRBYd_b$ z{|=KVd`OKzUnd;1RSFi8Y~Z^}!C(TzRV!14?<-L6x{i*3$@S0&X{MWh^j+t)J-=;t z**v6Z&5}FPPBSAeT?u>ev^0U~b|Mv){}=rfw)DaG?=m^%{3ISdqYhn9Ix6CEDlCXe zq)q=8<==X7dgx5e_}Mpq2#=F7*L}pf*r%4wXr}T*wYCmA0nWriN{&Z+nx+SV$qLNiOU)ZLkee32&Z-;x1V3;u+?&MQM zo?JMn6f>s`G2hipOugS=TEr8zWHfZQu1%HPg$n3PSY^=83&mw(6%sks+|FT@S+i7= zF4CbQFS6^trx7iJb{a*5PQL`_USSbuds5N!E%diZR07&BrhHJ;bRn%XPk`f*Wh)zy zJm$muUlZ@a0)DJipW{M=by4`RQ=O?vaG@jR7;;#iKv&=-&0q7UCcCsQGH26Lv`D!A zLODC*1d&6!?1>^MI<#24Tp&_4>v!0iiYw$ zC6YzT9WBK7g`|C#94|s-;QNq@v+_$K;$>LJuvA?hpE^ z83ho*zNM$Zv)e)}H^q)G!4u#LOdi+uEsOr_!z=Wgh;$OEN0G-IxU_weW#!;NKi8?4 zjxLwS{ZwS1$+reD7rMsY9%$h*tMcDFJgTy(|I9SWy2`4Zvy!3n*0QdH0jmi*sN~J1 zSHZ*bM=D-OTb_())us|dY`wcp5e~OjENdb0%*iB|6W@32*H+XlN&6V_Ii=M*$Fko`7YO+_s5djJXX= ztTp4={gxV4^Ys?gJ9dsJ03Q^Fe?J`d5}ps6`o3ucjAvGoR&L^#7bTx%-)Blemlh`` z-2%Fi7Doq=xuMOu`T4w?b!QFL41s^1#M}C$@Q20Y$06wp467QE;lGv3SklDgI;tFh zA%9KTUT{_58q%jr0u~?%h4{tD5smsoFvp`u5_JolSFq{YqrG$73|3NSPaJlrbQbMD#3nGp zqK%TKnRUlIe+rXpBh!!UmhuyZIvp;DULe2kAoM+BpO{__{s%lQb3IUL0UNg?e6;Q0ak`ACE%XVTvDg5GV_Nf! zV=@(}!jDJ-9%7>tUD#_2$#XPdw5NE)WiXbnaQ-PUWP^NeyCWb7ShwWUYe(tU6XYiW zhP;QL#3s$cs2*i2sKVVazkJ71c6FbO7*b7#NNmvgV$xh!u?cVJeg>mttY*KsPF3+Vo4=Gmkd^>|$Pq4)OGj zhWit%-h3X$tQk9nb=wQ(P@1P~K--~{(5T~OcGJ6N(!4N_%o5VPa8lYX;S#qRt`{UK zjC|zTnu#+`{Yy1A6H}R`HL@<`3IM*b>e_g{TY8hjBH~mLs7)POyo6E&dIu@D4sk$` zm|9Yyj3)|N*h`tY5#+PftENWf;Fs=SGsjulCLpnW3p#DxW$5rq{yYhb^R!@F9Dl*} z*+MENM5>=h2L|C8p_bpYYJi*%L#=o?nYQU>3-QvvWaqTgb0J1*fG&j1@k@tP`XgcKtQeS8}z26BXa!H zo6nrOey#;;r^`h`lt|ANXMTlN+Yuw6J3vu_r~DCd!TXkMe?PsPgzVr^5(o7s)aex7 zi51_kUm_{*?`f^T~IjT19I-ak)Q$Xx`k?U`CL7=k@S3byITMs1uJnDgD0C)#up zoui4?ETfM^BnR+jE4_m@Zg@<&x8gX+^N;ed1m~mz{eG8yp!}E!Rk5e7ibP-fewVF^ z&X_4e!j6xo5is+m?fTOnsH}LUjz4;@Xci#~S8@?4Ysd^kOsKR|#Ep7v5YBKnx5w-F zZVpMlEl#ZX!1?Kv(Wk!xJ1qrwQ}vJ~YVJ$L7v%?aRKX)snII^%N4hqv0Z$wBntbLg z@9i?PM=|FclJ`9~YMyF6(-{m*o;>+**%DtqhCh^O^XL3jztkeEdhSN5xzB%@-+O~} zqiuitG9(pgoqI12i*k^f?3&G-y%R;-wEZUHX-vKG{?*-w<+lphuL>i}DP9eh@{FEl zU!ppaOW0+v1u|(K<>TRT6*FY=6-8a3bSmY$FWGr1MwqG0hb5Ajz|ZK{7p!ADU;dh> z4q(C2GwqD)P%Csd`?5bvK&~-aB%B{}Ysb`t9@+V-SAh#sOu7l4=1%s05%o^|)QFS&J5Q|aQ$#JuLD54uH}`7`{bxN-B@xMo7|n6E z**9`tY(0L$>>I?^IL(5L6^=bYR^~fu>NGt3VtJ7n6tQj_4uTvF^auG~z)6XHPZV#< z95LeGXX%jTv6o86e9a{T4N|_pSiRR*N_$IIciYxb#l78O1}#e8bT%| zeGJSXTHC~kUPZvju{)~EL4jt-scc0H6g(ZUIv}QiT4s3bOp2L2jf^PSrt_e;4dfwbLg29XCJ+lwX!**ST#4dm}Oz9j}_zAXkU zKD?(-^qb}x(!X{MPSc4ZVpu%=l0je)hPl34p?9zIC6$f=i_Le?HZ{$5i<<)Y2G5~vpG7zb5+VL-CG&kEVwUr(WH}|^G z7#T~R4kcFMVRj^1h0tEOG)F-CI!#*67IXcAjY^*>>J{9GM5`>l4Bf!7*_89loHSDH zY*K4WR(C1I{z~_B0RZl){ixn=CRGXuvslN#;O4nb?gr+RYU0bu#C(?aV~U>azyTti zYF!lTo0l;1qMQhmfdG)8YIlcNQ*MuVbV>m#+s-;^XxEbA4pnC`SdZQb<@UCimG|+HwpSfY`z4C9HB%r%eSf` z^p3@CgMPZFi2)hWvkIc8ER|GCou0d&dVx5Lucd+-c!daBzfD}-A}iK43;ngdR6TfG zmrvde8}K=puyH;3TT%JT7xJvFoFS#9utI{D`x|uB^y9k`!x`|jL)`i9dXLV(4#6Mi zcL86uBGVUAVVy4{u7P)b731}*PJ4E|BJ}J(Wp*iuM(`BD^EA_WXQ3w z7NwZ!SWJNXnR4_}d<-5jm8Z$E>XC9~qhVMs-Ms>ZXS&PU!VM!!7ec{X9`Ww?>gM zVe;~3OsT}R7Yia5^#DB>6(-p4&C#X%c)eZMME*>|xg?*6WYQy{a5LY-*`e-Fws!UL zq3cS;N0VcDF2Zvkq}h*bQ}iDU-wu#ql#6PDLIhmE#(rf^IH3Ps_HC*9=EFzB*R7Gd z8icQZKh~&FB%IOjp?#*Z!>nUG>lyObs2!5zAAVjbP9Uww%q!6M!JB$mHu?9#+VTH6 zSr(P(2d6Rr^Ck}&5US<+e30>Pt>!JO!APu5s#p-YUV-5O!=03xGgX-+RQ$)u8lAqw==`A z1X!gIR)mG3k>AmH0q}%tWh5SL>=}`1yQj(Rq8vw!gD6qEY4p98Ve8ggEXR5=3Jq=I z$8O=H^Tia!w+Le$OBa!UzJ*8HO;N`W;UEFAP57t{_Ij)6LE!9Fr6>A!OA4C+I; znS+iqb}};E7^6{%Sf0yiuWZQta$M||CS<{{5INAL*blzo;fuL?6v9?v^WVl8*z?5T zDPHZ8mU;K`v}t^w28S}Fk+!%_4!|p-cVAQ-XumL zmC=-0!E#5R+9|jqtv0~0Txi>$V|Ex+5eVA!A0d{0?Tl?Ewi=xY5zluh_88(HEuu5) zZv$<7Ps_F_Lj92iLkgz!tLW~`5AtzLJ}n}0VakE~&tTq3Se;3ZJvM0kM6V*;&Tw>M z&*TpXvP zFUkw4!{HceDeh>n#4!vq=nK5zOHkH;XbwZoDn%==@+y88&2?{l^jX*%Je3uzw`^vu--y{E!XSgy9`a&Oy`gs6+ex?5cA=~|#<@t;| zWI!OaiT)J?_nE}MBHCTkV`1D8H8B-SXu_pL1knt96v)}`*pWht_KZ+V{H0`F?iaCZ zIiV3#Y_l6xdb_BL=&Tz89Gn?+WCjI$wA*Hiv&8zS!jzaj&o|4bTREc!bBP9d4CP@| zetI{kr1acq1zeeAH3*&1DowDxErckZd|U$i5Xt?7*38k4qN7q6e;eY~>zXfRdD5oY zvaUv~9U7qaKyAqW$LNx=<9rv6MlBU{tvx-0C5%dhzQ*k7k=A9fB_t59VLF1tvzaJq~w#N?`(2-E_ zmO@}N+yNMR2$n}As$99;TOQ;~i=4smLxvcY%LXTnqk`k5)#L=3*5wEj-{FJu8Sg zinP|lo}mE*pe#HM@MgD+Fz2R?k+7F=`&j5>D*xa=aE^4q50g0fIGMJyxu0jFGrmE# zN@^;M0u)y+&f&);zgU9^hs9t@hmJZIGQTG{>)GfqDAMWNJamJ;h(E{bp~9KTS<)%` zg+?B7$Z-sXCBi+%kLZL$lt0<$`cPGk;y`Qs*Oi1fydpq)Nk;840*X+^b;c#iBy@a~ zf_X9V)>U7Y>TUQvZpbDbdw^EUn%QmWJ}jD`DNox`vf7C_u->Dz<2zFW$&e!v-|?^$ zz(vu_muhQ7Ef6awp+@GFRlF+IoGWSh|H2Nljqy(tM~@^6tfI2N3@qeU^1 z6&cy|x<4PBbJfYefv5y+)_yz~V=<@aFn3_c?XuU<&kM8WB?+uT7V)KD1)P9WdAs!{ z=6*@iCFjsi4~SdLX36iJWZvo`|s#fSYgR)aovrWA$OrS&uY zPr2QK`hRy;pNS8EE=kIB7ohmJ<~FdJr|a&=)qTUVeNM7vS=N^j*XFMfB82zDq7LKR z2y#OE%b9nh*~^31r}iI3g(rR`EPr`6$BqBgkNr0C-tdHMh&FwWe#9=N3O=Y&UVpgW z{v*;lvCvmR&e}TZ{(IRWwi=~zmAV~Z_%>J4XLAXeGJl7-quxJqGyIIS1U_Laa4?VZ)=IxaHvkv-nY>{d|J^gW>Pt{nWBJSrO6Sta2e}P9g`VH zuhd!TKkFEEpt!RkBmUQ21(vo@!9$VP0TK8yz12fa8iCa7I|P-l{Yb{w!FjLXyb1ZI zj&Fg@g*2mWK}H(WHh?^00za#H-j&?@pR@=|hcB1jJ%1rR#wyOt{aVzV2y<7avvr76 zPafmkVCzM@=kBtxFSD5!loht$Qz7{8dD@!@!>%-XLz#ftD5Y^fV?un1bEnhoZjyJs z?T0g{+58}Sz#-FjOZm?tgn%dql&ZUca|q{~2gMaf zn_=vG@^6EypW}bMvrF%BP_4qYgX7ZQe}BwW^i=J|pCGlxC+~nqZ)FGUHu-Sovq{b9 zNYFpzF)p)~@CToNZ;#`AF;o~-I}MkN**b=$jsPkX4!pVRHBJY?nXQ5mr3sSul^Zz0>q_9cpDQ0*@L`@tB6i*hmxZ{-3iG|mtI`3F%2b#t&Gd8_0!B6~34G+CtY zSuj>iI=8j6bewaHl<(1w#22nHG?B=m#+$?Wpwhi}gm987F8*n%`ObWX5ZhT{!&!Uw z#Hz}(y=Txu%lG`@Srh`{_mT^4K7H&|SOcEN*>KDaTIX}s4xjRG?TPI#yx#wXa`MWl zgxDgOxy(>$P(hHF-E&@2^+i;?`(hfC+!?3uTp3hXZAT;^bD|0Az6hP3mqkt47wny% ziy^;~GUI~&^}Mb3T*x7V_jvJZSO24*u(D-w^wbVhgz;#->8Tq24MgAhecjyBHK~tD zBl0$qPt|fD_YS#?`(S`Y<$y&4`&dgEy)3*wLb47h@su$GVkz}*bHztlQ;5|*GLS^e z(!XD(cU}jUEJ+U0apG+^!-U_P!IunPEPTAcfJ8-VMn;2yP#zlXlA~lOx@2H{=?DA$ z>PrWfr*{fdkraXgi>igx@`>!KM$~G#&|2!)0p)hG|+(MS{;(C*MT{oFuA)d=I zpDzg9T%;cvuNG;2;U{L1dloD!{Em&+6DST5V(El-?x%krY)=x)+mXz5a_5O^cv4K` zyR7AF?O*rGb6Cp^W&N4?gT{M*8iAH$ooLomzunH}N5`BpsRQvt5g~yI{x*pGgJwwZAxO^P^louqQov@epx=*{PVUYEG zXidGqfi~Vm*)#ci2!fu^gFJ!~@=&Z4=smjIuDbu)LI(*B)iF`(G2cU%tk=VC!F$)th+qgQbVA)*%3U$Wr|esJ_|-yix*yshHKJo!Hsy%0o|XO_=&o;~ zZg`Dwg3lOTI3 zbDI-Nl&4(sKbow(SVXuudR&-u`)hIw{r$0wRgAFEM)Mn;$!Ka9TLXE_W6Zu#;~h6` zFOLD|F4r_zU!tY&GoD`{beL^~lBPbb%OvPz1*+o6pOH+OmBmD-8A?wsruwqUCr%vI zX4a{-RJ|jq69QMASalwR)pZ>k1h>`9 FqS7h1QGRwbFHSn=nB`je|BUf6!eq0L=wGk3b5o(y_R*{%_k=@HaHE30}xjATl#I8Z(%~QNNSP`eGPPIhd#F7UbFB`EnM|*YNfn{~>Hs zB>Esdl7l=WTy~7#$HV*JR)5mm*&cQ~Ub` z`eXn^=^99~L!MqBRWq1A@oER|;~fg2q{xlo7nvUuVzHy-dwO>okciHjt>-mY2V-`7auEh0Drjz_|*9y0ZX^y_W(gn=OUF3q;r}g+>qt*+y(g@qFf@7g-1{owYILS># zujJ`>zIAlJ8+FwTf-JF37F-x!UdqQo`1X5dS!^_qRH44`dM3W&=X4pU2lJnVZQFiO zS!c3(f~pkAu>8;?)oww@g5Ikqe^d?D6;%loPhIfDVS{Q|buc{S;`8`$P4%ctpzDIt z7KsL^0)Jfz_Q^*$^TBmotmwIBRcV5jOrs-*sFmk!{;-3YB1p)EP~qLLGi1{HGSvHD z(wr$>PywR0CE=c2fcesCKnc0eaFSmPGpV&l$(&*mJF6h?=}Epqpjlyyfmet-8}XJ zk~`mJe)JH0VGYROm@` zci{E7O+1QtMjy%Az)$!weV7CP9W7}LV7~Z#iXgV-^lzK(P8-vng{g1yJvLBUyxhv{ z>O_k)T^AKa3BlZEWg2USmt@$i#i~-2oZJ}QjssR5C8xuQ5G|*KQS-P{2<@tE8vCmw z7`QK$q=;KtyQ*a$r4=@-n1C$xuJY4JUd>a_pH6)imD|YGnJ#UA$9A1T(VfzLpU*Cj z#E%fKdUaUV7k-V}KgE-cG26$r+%bD)62FE<2ZQYZak4VFNtR!9KQIUH029EW7&DY8 zt$yVO10G18$h+Y@TNsJk*vxfJjnEH26(G3@tsLsFb731v*%+1a0ls4evfW7Q-aXY* z5ds0A!`yejA%T>%e>BvErOU@038reb!VNp1{HIChqLOUq4MU>gg$$wldL^E~T3x0& zh0h~prtC7vJ)XgAnp5}`IR(867;-~4hhvH78Q$4W0m zj!EZ^uUe}o)+!uP@S%zqkY`Z<$xr=0%s$R~J2zLZZA3;$yi;d)=Q`8|#8@GV#k521 zd{L4w0dH4%On;S=f)@mBl;-uRp#z~apYrSs9{NKW7;j-)8EFP4ZkM@g-luH zxI*>MF!rPG02u0phR1`V;-M`6x{gj@Oqm6ODDD3HPr(>}*G1UoKa=rAH8ertx*R$G z7sbGSFc%tk^V(|;-(f3MkccC4=s39_*+LN8_p&th79~{-0)Ilj!bFTuFl>ql=W+&{ zw~2X*?nTH&+(iWF9*18+(>LsT=hOMC@@C-vF=?8Glh{3-!P1%~WnShp95aGUzDUt&*z{PvmH@y47;_%N6LA zV^TnV_1P@`2ncM~R7b*Yd@R(>8?2vZ#>d5s?GFf*@j3T2_1E=kjyer*R&5cGshByW zbW|4;fOB}R%f);sp?F44H4~A~5{9+39ui@!|!&j$zU5r$e#Yi#n&W+W+cL8n#Vs~xd8}rjKdkR0IWV?bp!4BYV6L=O zS=CZx{9(#1#bX8oKDIN{1~B^h>fdPX5M&mOQ5czYDQ)WP%KGM7=7|nUx-dC^8aLol z7RK|WH@YgD%T8^3>c+Twv)644yg;%QuIF+!=MQ2 zGO*B!-nVgYbE~q=y68?r8_UtOSfTCAT`HGIpvg^ac)=QiXXIyXLuoB-yReI2uk3m+jrd>G?w#krs?8 zQs1^)Pj#n6Fv^5o=v~`paGx3R*Tdw&pGeR_1B{RP-z3*|vP(kXd1cyh1CbLY(NG%? zBXy{5;&%7(6sI0hzD;OrBG?%f*wukNQ{sW}-)?9zaGPL)NR?tZ2YEu^u;g!Mq>)Vw z!_ZOV9rk^Qa$CQTCQc7H72+cMm{*-O;nEiMdxIerP$0KQyp<8_@F7MdgG>yvEPH6R~z}GQ~;RMxnA0yh4e2?wFtgXsKLnuC8Yw*SU9!Gaa%Ni99qo<`68`F`T!g!p&eUobv@rS zsZoez_@Ab!W<%**@T#36^C7I6#1nirK>Q{wq5Scb$jP)>Z|>n2olu6oH0Kd!UiysN zaPhFjDKI=;xiD@RE;um7?iJX~`|2ZrW79fllZ|yWD@}{rnAjmnTFO4yLiG7daCF$T z3(YUKIDY<+G!=czvTR`J%JW`z&Tp3WFjYy-z!Wj;|EAYR-RldEWmXKj(B;3{5M<=+ z_?&Qrj-p^#DZ_VM+>(x>;={!K;l$^V-t_PQ1zvGUh^8~ajx#kHM)N%Qg`{v=fud)L zpTSPR*phKu_hq^wVAzDOogKqX!>Huh{5`w9T;N#UuKokUa)a`QK2C7z@XudSh0?vZ z+XzI-Qkp+@(40})hIG&GKSxuQIhp-q22)=b2I`r+&V)mKju(*%XUkD8i>wzTsUnxo zoOcUvVMdk!jPA+OS5uf<=`*l!%IEW^>#+3kK=7cQ{m>*B*q*AE@Y~mpRD4Bo-@qyf zR|6^y=iFU}O}$z3OC)7{ou7rDEH2}^sF{v9Jd5JWEP zzW1WNLeUe36I5u{9nVF$bv>@<@p~egWwb+LfTIm%T37eBpVahTAuXaRB-X;Jj?fbb3*+$UAj4#H`eKErcTJ6}|E<*es`ByD*A9#oZX1`f z8dejJ#Dm6Hi*T@QiLCncDoJIyfff|~h>f~-&It8m$M1RF~)jhYWf>HNt2ocjz*<<#U!s5np|dtrc+tx@6pm*Bx&U-nn&)WLFq=@VCJVQS@|{3|k@*3$q>93FebW_+gYx`d?7gxHKXs z?NN$nqIEG#WyfayC!ZsDill^|;2*iKuYIT^2tt$ipuV>r@R((45`LP(3VF(r@#q!Z$Qp2BuETAh0?E{9Tgfufj4R1+AnF8<7TpZo zQ<`n=%hxZ_1r_O=`>RN*Q530$^eYN09$MydhDUQ%ORyuPsuWenwJ93cVusOwV;1qt zP|$HVJpmUq|CvA%{=Y56U^F+T+ zV9&}|n6JlfGdCyCKO->)zep2tp_|Q1u?V;xysmD~n8{AG_L%RS=eF{UZ$Bh!v%;CtwWWjfRa*uN}ScM_Lm*~VA=pJETrZjQXA#hp zSP{HJ6?q^y;?T?L16Ft;rs*K|ng04wy{J!yeQ2Z_8NVRk6W!Jg>fKLJm~sJI{gNJ# z{0hc6yNN+1le>C-y!3efuS3X~K0~En5%0j=X@%)6Yq@FJ_>Ai3J!gj9Tl{CSwMkUP zZ|d3|=B9R$DMI^C^Vm5-Q=-oyAisM@DzDbAO~K%u*vv{;n-kMdNXunlI;I z=e?cV{5{}YuSF(=X&M-C$Ah6$$iY@yx6}Z$D_o8-*6fRt<^>YYwHAQRorFM~jcp~YhP?*2_I;rC+h4Xdu(Z3)-k$!9c0)(=}5pbCR<9Uwj{=F|1 znM~0Ph0@#WnJWmqFM08^9{-|o0EZf%`}5$wu~g{dV{(#`_iA}cv0HjY)0AkDi~G>+kS!@?-OCDfLyX}c&=Re$sqS(-Bs`(TyElIdvHBTXC1=)~Me@ua;97^U%vzdZ7bOl5ZbQ zm7bo1J2O3stA~l#M#C7SEhYt|UWmG`_Z*R<@5H~V zj>Sm?o@&cMwoI9Lq@CXU0Sh#?TB2#=@dxgmr*g@^+_j{X4%Fi-3!?vn$;0)`U?7kq z3|S8881(iCOjr_F_hEvbOcL+RwfS1y3`@t(Qb&^NI2RRX+0jAXwC+O?tUFp8Y^wJ2 z^}e>CJ~xm&dItSGng9kThzZAN6Vd_U`3&4YSQQrA41&#{rvpngbk0qJ#INircf25#>?W@ ze_7MBLYwc@W%IAjcZZczJLs0WPoC}+A1@8z_WLqG z9i-leAG8fms8a^~ zHsvt1G{(8xKyfZqnd6xS0V+-)(6+|U+uqgw=eQ$L$xZ{~ogha2=M>Pvk6(P|%9L`; z;uNewuMsIC7OwF9(%d`Qt}UNMyFOQtbL_{x;8C_yQJW~aSordf$_a0$$N>NFRo-$m) z-J|k5usJJsu2X7<+atF*$GSKiaL9lEhue7!A5*5{`Z@@0>|W0CM7LNiHb-}~aZ+XZ zg@}#H%Uv_}N$`Fg=FF-yPpyM)K*+xYy zzn(Y;ep@-6r08*KcE=f1>eex#>MHfpexeKG1GX~B*obd&mlXW*Bv zm14C(4X&F?q?0{dF(r{wJ)+8cz+Od(_TBz8q{2}TAe|K!%V%TfR@DAU(1V;^74IYs zZ5>8#ZmY)DG67ao&czWi@Zm6K*9ljMS6g~;qXQHPV$e@NgC!I*o^C@zmYh4F13-Ym zU#w`t7K-gqyRb6*;S;TmKm}Ixa1bR_sG{v;BsPYVP;47{bOyhozB`tlvnFsJJEi5< zJyS3@Al*rtJ*qC4Z5hRN_*pKx7q=fTj*g;;n@k!WCx1%!)C>O8aZ#-w{=IQb^cq!RI9duawx5ZB#dR?`olop{t5F5J;KTcS5 zYr8T!^H9+?#gAbDNy&V&>NsZzj)4MSx*W?(e8?Mb@yN0{T|Zy)!qOoUQITvR^H5qN zQ&88uFc(>28`3r5;sU}SX%1!LOj4H=&@9V0H1iEZ(+5ijN=Z&0RH!ZE6^kcpbM*>B zJ4N2biVx@b6hx|w!wficRi~xB9mtJ--2XAHpA+#mo}+^~W)BO_eJf5w3;xiPRwToi zji?j6LaTL^=@Y};Uof@f^_KUR7Dt;6i*b(76;`AY3cX7*)-0fuYb-3XPJdmHVd(pV z9O9e^4jncyXzEc}<%?WRKJnip+`6vqbN^K2C4dW#k-Zp}+@l+*Aa{2G%3+Yg9F>O- z;DY}U_OK%I87ZO`Et+t=$)RQ`_)U}DA;Mv!>MmKe)>O4E44#!&sG&*C%zzGK_dadO zA{zcI4wF)C92>T*hm3ri#f04964{6XAN&Hhm~6P9h5S(ZsP)8Y!{-mIUqu5I!UYeL z(4#QJj8AowB4Sv(SKK>XSrnxs?%)xoQt^cYJ86y-;l0<)_rU;JEEjhoH)zk6DlD0ouEnIa4dNk|B%Uohy?O|lZW-V z`>hCtEpLUCd1Qbr+%SSkujxeH3esRvtWQ$iH_95;_2E7Px<}2ws;r8mLro)`p0Fx4SP|)8mZuw_f;Tu)qe_8Ewv|@ zdxU@>SpuKt?GCEUHjio*Nz&rjWcq<|-ECXoAtQ9!yn`1uZh3)rN7^=hw@vZ>IC;yP zS!l#9lZ(byV*R$5om3QZk^O(y$Z-$#6^{`mX7#)O+5T{16leqv1B_Jcs~y92RlFnB zNQ3>9KJSl^4vu9T13^R@%HO3Vr{vT_W7!BCXg;$QmS+T@Z3t=R%Is+#b6AcBAJI04S)+Z*Nc8UU zVItOL7qa$G#ZkhkG_2r0O@f$dhqaTWibyzn2k&jV|LZ!IssJJWqG4zn%R?;or@x2D z9sk+Vs@`%XLv+?Xi|>6xafm)0`88o51x6TD^m>a&$cmdo!X>(xpj7hZat%_3M2UOY ztv9+!QP4Mo+2QO~D8?d1na|kAI|vL9OxWfV!SSB$3-TKw_I~nb?uflr)d&uwDg20_ zq4~iwq2;|Sl(Ilb49PrDYLs04Q}a3|-<#r?15DM+6B1P<^is_(?e^UDBmOKzsIWHz z3lBvs!)HKj54Pd5))WAa$$D~_a5@-2h#SCh9%pDDj@bpH3$o7rP-DyMTG;*unn-?O z%HzvS>pWl(Q6QM#dOhSdfo#q0Wi0R14<}3Xu5IR9IuDqcmEAqc@)Q-Z+@ku$xT=?s zrBFC)3f-kKH?PBafpWFBj=JLTj2eZ0rFWF1&+s};n(^|eWhLeLeu7_jkW7xrdmA~U-E_pv!dQN~mrh5htXJC^)Tm2(!N+J^h6qxL4b*Fv8%KP`9vY3epy;NmNL zo7{ShW7Viz^mPxRI%kxt`nTTmW`H}n;MlT3L(Xl!zsTNTr~I~snI{)2q1gEW(f?l0 zKqOR$ddcS8c_VESjENdS{-qFoyI@jv7Wy9qSZtxUODM|hYz6jt`QQ&L!Yj5Y!)!?p z(+<<=BE5UoeESiB%4Q{prMZn;>iism5c=?uLU5pEuskWG#(9rf5!k#z{nl6TewF#3 z-)B@|gR6D$gy^E=`IJgUi22WQBn;oh!NZHjmp%w>*+FCBy>WxlSiZC3XL$d;;395i zG`(B|4_c^T0o5~vRPvGlBW$m8c%LSCKv*sM?d43tBJr&>u2k@Vo(%`c@e*3uMrF2! zZ8p~19O1fP9@pZVd|H2HS7#iyc*kQ&t#ub5(|sMrn)nJantMZ{j{-S%Dd68OQ71h# z_m3Sa{ zX`&i(Nz`Y9;vAG%t&(8%FW}gf&M5AOFViHe55Q)M{M$(?H?1qE{n&>o?`{oWg^mf< zqXq15Um@7u&Lhxe)dVxE0!_yn6>in~WM=&XC8tuCaf2lD)MNK!*Pv+HqJ&V=D~1d9 z*C9q@@|<*Z#WNY$$aJqQ+y_TxAcsojUXj9+LPW-Wf%J47-;Ty3B!L~4_le~$yA_S! zMxZ5}lb4+#hkn>eG-KS4WZz>xUAV?J8dyH?3PDVtGTxq(tmRyE(gx}BmC`9NdGHdi zVQEX}oHB@+C*Aq(L}F~gS)*Z>Ga?D+&{`7#0vm5&>nQwtbSX3e?0VJpk60DHr$>MKd#4v z{xF&I-tJ&h1Y|wGu}?!BgkvU)KWNz{w|q5;^|tZ0Bcd{Yo)8GrrKg7MNPID5`Fh1yzJv zqr7@8nKpkpwxZukfIayM6rPNxfmXdDr0n9OIsOv+izOmJdbjNL=ufk6_}rY#gtCNx zAqk)_{ZBm1Iw%3t1{0~rQoiaw-XiiCUfFGtpZrzU@JAaR&HVg{wmOx`|U+2auz&zIlC6em#>%2+^!zkyw;$3~8!q(`}SeA%m0pc|krW8Xi^u zPHc( zHIvTavMtQqP|mCE5-rUX>b^AZ8XQv8n0zaa6jRv}rtg7!PTJ*j*TiC>`y67bOGO+h8rjwY|s#8Nie&dAH77MfhX3Q-gX1 zDE+xW1pFuCHF%YNKfe)kkM&9<{U*qTieFh+lYS<PDo)<9-KQ? zM>c_9=TLaQ5^rz4Uz=cUpLh*${mRL_<;5|erwn);W^c?Y|FkWLW9yskwr~GbCmMY>T4oM$Vbj5<)Mr0hMX4JKklLjJvCG>BB`Jeqh)$b*z zOXutJ+d{$lfqz4L9-|XY&J3^43rx9Cq(}2VWY~U~QX@p)& zTM&zH*%hS<5_&2TJwMM_Aj6HKuTGFx7_JNPvOSD%@X|0#w!?2~8-vkWXR|2qQugt_ zf4!dgXH7Tca?GYliV=W}LgydfrTiI9PF2K;S)=8LF4a*ka)3bkP#8ubNT5v($ArWllP z?b0S@&V*@ig!czm%n z{cI_vy=Tz(Xf3Bgi1%@O>AgeIH}=%4wIvC zKbBq}HA}7q zIiV8pHFS0@Ii6F0y=1gL|jpSd^y z?Ej*^Mp(FY585cNu|m3m44K>HE`G@ldeFe*tbI7Q-jry)5LsuFewJXoP} zZi{Hf_t`F*6HWVoWX{bX`!{q-BARZV&0!`#&~+Eq!j+(2#2{+=+JHhMJsIofN8lF= ziHM z-uk4egOKka%|~rPlr%W7oz#J#^;utWI%xCD_tG_;NTBEnIwXdr5o-Z2g2vb5hQq{; zfRSag#HRoK&@YK#$PYqB+?T$kS>r>?EPLO7XtYkvzb_%|K;Z6?1V(CvP^=)65W`k~4Hgv~eo>n#_D z!&Ga6>SHDmEz7D7b4nKQRG#EoURpUK6Kbl0nWclXtKx5oVC}yN0l@I+H-ogjy0TTb z(7-Nf{Otbqe>;zarlaEc)?-^c>C{vK`KybO?3NOk7<-u+#(GUDU3cgh^l9@AcFN8TG;QQhlvmg z?5sjY=T<*qal6Dm3wYKwxAy4=Y!oF9>|+uo|IzQ_7R_xTDvFu89&e_nN#Oa!yuHLj z`rBzL^^%*k@hgO+l1oUQN~EYZKjxe1s)tI>+2@0jVxi);ii#2trBq9Rl0h7z=do;8vEawPKadFg16^xs$b+bWUK*?~t4ihcMczTx)NERRQ; zwN8UmsD=Y;ZzL13A~`cm zhAX+LhAYtP)iLs1JjgcD!H@a2yKlLjPmr5q`!L`QJ{yq`mlo1J`~eh zrj7?2JMVUJRZWlv+N=VPXfcAqotQLDxkw(bgnz2Bfw+B9H*Wq54;xDpG$HlL_gNNp zG0!E)+1fN&W{XIXr!`#Tcfg1y{6vO>gYK3bnd{5YXHP*x(J|vvQgTF6GMAttJpiSzbpZQz0gew9?$l;BouS>Rc&oxU~Ir6mwH=k`-#%EE^5n7DL?aK6y;y^pm2 zVBv3i)DQbl**(U8^A)h>a<~4SY_-j~rk|On zYwTI+rtERJL(P@aVit+fM5Wl`A|eTYu$D^a|ooX8;J32Bsvuh}9C9X&vMI6zTdI8+G3I zsjr=?sBgAK`4&zl9f%toiViXqqom23u}#_!c|GPXvO9pKr;7k>aSLHs!U|1fnHUQvC2xTYDpdypQG?(URMX^`$1TKFQ} z-3%qt-6bFhLwA=*4Be8F>K%S}-L>wYFmu+~XYc)a-{*mr)-bK*?y;)T0^%&%bfT+p z*k$ed^hvW`iqiif> z40%hG#&p%=qQt~j+Ocu#>tkD#xXp>X1ZSo;j%BOoH=QjHBU`;>V)1-&bWT#Kuv#Na z*2`pymAdw?W_E(zwAQ|}*)jXi1EGS+Hsthun&e&xkm@RnH~2~WHZgbuVLW< zz+UaaWwPh-NcD4qoG0{u}6AT313bBBAfGFWB+DAs#2er1F0v{5A!A@WF!c znT{aiY}uuMr7N1|)->b`c$~SfY+Y5^jo2)HLB&^Dl~AP?TpDokDI0`}BxQ?T$ZfJW zG=USO)0*;;g-=pSGYDx?G*^|kk2A1UU(yy^i2=Fu8PE%C{|)9Z(HW$d)ik#QvkQWL zmcFz?`ggF>3uQ}U+&!^cUQ#rLwr;tj%?SsOc*%^Fmz~$bX5RBs;wK_2?#H=P;4~ha zg#9{BPeVMl*wS!8BPM8iHeYmq8FpV~7DZRn2J7EQ(_Wu%I^cp}8{PnTfpI|Z zXzVhj1}?3I4+!GvX>P-ImQBkgCI3nNzIa(_udROmhd1-jLUz^=hcS*rkcHUry;c}t zUdb`Dn1F}@U%Kpl;CI>{>wcBu}-?8n96sa?p!gqclE`vkPRB3+62QnpG&{3mDY^>{P36@Ix@sF z?~>soyevDTo%1|6gyS`w#aQBs;84_b(b@Cbr_5g3rtJLhjdUroH1j-Y0o;p0yku^L@z&r-Ou7@db z1*CH66e;6Mg-&Gd)C|~*?^5*Mf!_W;7@IGYI6lV*CzSkfkq=Qp3q`g;7V%Gez({$7 z2c-TCGE2@aP|J>Lj_C~s!6$uxY`Ol+Ne+9oK2lG^QBw=y=lfcj=ppw-DnB}~LLB|omst@XQ}epJ8{T7N4@BR3 z-n{Sq6|mBMomDFS5#<|}(%B$!qkhXXe1gPjSp{lOy|it_kqDiy$LeuO;zkUFF~6-T zzcRbqecuL1V;8|KRH5_^~UzbZuIK7Yh6B3Kx+oiSH1+?gwc3`G{6>4O%>`~4Byl|#H?d48gc4?R# zh$nE=N!2+YhPSPfFGaEXDBYQL!;Q?rg!&gQj9%4Ppm*kI2{Mv%u9i6Z4S&h@W8OA@ zHJqz$pZRa|CZ7=v1#y{>;_!8XwPf(YwXGRjB-*2#x&u|Uj_t?V1Y(SjeeLT&u4T;V zqQETcLBmr6d09ylDgo!Qwu4vLNSUKjOOLKzUfqY>8wwvs<=$B7R%QQ}Z~Ek@`wgx` zxQ?#Tdsw5-i_U!@u|g3~I+(?`$m@qFt}1+npW8%Jg)2nOSBr+j}|`fPS1#%?|Fcl%xnwjK*!1+b)_MzAXOnl^D& z*pj%|3gHhjKnu~1Drz=^iQ3)?0*93T=Ne5{xh_M1y03Q*b_pq+w)>U=B#C$ti|*M* z-c)g2 z79>!70Hh3;ei}#=!y-z$JsKYD^&1h5{qb!6J(!<_-^*w);uw7Mnmm*lgbjS<=SLE{ zP3->n!=sn(nC@Nnx?1uTU058RnIt23zZcA1$y-(Aacx6ByW*yDfL}^PP>#>->!7LI zJQF>QY?sSE{7AYrGBFeMyG7i)H2@y*70c#k*=FEsk~IF0+)NlGUf0B=3TBkTg~m=j zV9uHyMt#njzdTRqcbm&+{DPt86+Wvla2NltO7l}SS$G06-=POPd+-%mFihAvQ0j3^ z)A*ed_8b#%Wb(>?G6MZ?*GiAuu6Afy*6KgFCFC=5mO5Yc$QlvYhrLdW^f|`LyRUbL zq~TJtFq|PLonDP>PSyOH5DTDov#{-J2GC-iRBT(M^X4g#rr5pANR-zm5avKt|7-=E zia555#|~h>mhZRW3_aU%F*M3MR7P`K>yYAGG1xJk>0@_t`ydi43J^s!{9cP%cc!lc zv3PVd3Ok_lsK z`0U6|0c7z9DzA&TP`)1&Ufu)S`uAsx!_@(OAxjGS^W7X80}Jrp?A1ysma+zW0%@Pc zaW03d#yPi<%CH2=@}P z>&x(d!LPuI1q3t6KH?QXyha*{k`TIEN68uDw=|}lXoTtk99hEI{3iGQR8n>0p9m}* z2|q^5GQfVzM*Pxy7(ip%^iW4bYJpj`%h3N6NogbvL;e~?qzk(t-{=y`GrJ2r@taYk z54@Jfr!e0>!4G`N?)3dUhKAmp7FQflwQ%x{owX@_hU2~(-m~W$JNlgiE2TMl-QuyP?2xg-CK> zY*@oKz91$kPP$S0x>0Fa-(=58bG6`z3UQ`{>IvT;J7{(wuJi$hnYDe@RYtY;}S2Ha7%u1TB)QdAwi&wAr&PG>PY#toxcthKHeXhNR!3Iy@*ztp*ZVl&q2 zGsyrTr>f=fNPsZ;aMC$Jh&%^-7Y@I~7bC`0{z6&@M;kq*>3;s?w2mZFGH5!bw9zsh za%T|<-$pPQn<4ZFnQJ?J7C;u-@P7)zaZhyqj%|pAel-vFgeTUjyMw1biGw^n2(fNLg$(Mj`u!>@Y5V(Lwp(F?%1dKeLvO_{} z##Rb!04N$E$Lwj2!uXy`|JKJV=K5jC(FBCDSV$D01nm;X(#q4N_rhwr_DSTRVs)tF z>djYc;&N!ADg7}^V-Fn(r82FzU#4%l7RnZ(LkPFPqZ-5@x9>4(OsL)yJ9MA}1#n7| zo7j?(1w@+4$L{A6ouZiPYIoLV&+%V%7^X2^8P+SD6~ssC-~09h$GQRs#YCLOa#~1g zU)SGC21c9~D-6JQr5S?;mvgUfzjZwuArG_cTo#TmZ|)#;Ynv0RvaBL?S&Zilv4-krJpPA zWsnhJR(NNkZ<6RmO%=(e4U}^bWgc-xVWcIp4F}3si%Iag5|j_gxA3U-!uV8lh&RTk zf}vxV^0E556r%Rk(VdLtHL)FfD*`<*gLtdhkffH~L1-dQPMg1^jfIz8J|0g4&v*#a z*tji0)2h)me;sO8vJr3$KPFi?V7?MT8^0C5PDOuS7()7GzuJ%cW7?ug9YRuI&CPUk zM|TW!6=+QVz|$P^JK6i3jb{OxK*P@Q;{8aWmu7vB5T@#%$(M4>niCS0tj}gt1wzh3 zxQnQTyT+H5V{1-jW^93sBiK2VlsET}k=EIg^>MpK zqsXu1RAJ1{#UabsHl3}pU)|tK9n#5_)NIcF@I9CWV=iA6=O0##4fp5}RCpZf@WeSE zy$o_`Bdq^GOyYhFAj&FcQqtA%-XE|5S*8W{>CF@s)$3OBWehnaU3F?x^@*=6#*<2R ziG+~j-DSlwhGu9Y4b>z;PKyKWx@HNr@Lc@g*Uo)C6!8vm?y=i; z8SQ)XJhisHd@`VH-)FU=v+wq^)=gMn8Y?F}j3g0TXm(ut#W69wyp^_^jr)A71z`2& z(~679IFXODb4_sG!kG!s&bVOU(Vdz(q>w(sRCaG>abu}Z6H3EV{Qp=0ZwMB@CVDwo zGRYY!#kcmL+hasd-#Cp5J64H=6A>SZC6pH%%&|=(+@4Vj zjeT&k%EgqW_*;Z>%Fdhd-#!JDe4d0?L;KKDQI}DZIx$74Ehqgrl!HT{1n=(rBWheR zv5cZxLar$kw)vp%ZU97-c}vAfko4BcyDV^=kzWAF)I=SVCshPD^#m+o7%Z?ZVYrh^ z6o3LP1y7sP3LjjG?0Ic+!JoO~;4T=pT$MB{&GG~J=vcY0+;d&CMW|NowC{Epq(hg^ zDCL2w80ls_NR#wLM6#bpnEP;m6y&D@@x;2iGW=dyGKf_OBlfmnelO{4XdxIxm+L)t zH06B)nNmavs=>kCQ-Qud1NO1L0E0VriWrlA9DCtIJ!e~IeJtDCD4~|mZkP8i?eqOj zAXWxs`D_6_vW5RBDPeT9TCLOcmAmd@)@|p#vPc&+^4Ne-+%|A!Jbx%;?!?VtHcT;+ zahl){~7X^#}6|o42d;)V2V$9=$vq6V zTnrcCwGY|VTWTeUxg zPXxJvsvH`pA4dZSP%b}xSB&aPG5K=0124NeOT@q3!6uqc+q@K~;f|;5r#CF)M3H+) z8Dn|q%>Az_qE8|+!46oCJjr90+vP;>6cvjbtmH2gNHEl->eC9fFR(GU%(5R8uDuUQ z@oV~CK}n-lCkIfdA*o`F>%i>j!!g;kyEg#^*u+>on>wq z{Z&F?T_gN0k)Uu*A^N+8S`joUA{iXX_aW*7CKPBAW_K@quJF&w6 zq=?i;Vzd=jhLUJuQhtCTd)dXLS>cB7^F=5t^yE+-sMJyjQ}H%#zL%ge&!4jgHFWM5v0IME>@g4)ej=`%rqcDBT>jtrgrzZqbh(8e_E``c zrEpUqpBl>ICC2D`l*zw5WuP3hkWV!^Qf1n16yu}?FZ{quRf5y06j>}Xv#ggE+|$3V zl>~zZqcJtJ!!y&h(On%4TNR7i8kNlxmZAKGB2_iT1})&(V#U*99V6r6D#tU-wHF=~ zxUZuu-mQtjkY573Sp1!5G`2FRp~DoBQPGUchjy75rX{*~RL&GZ<(!l4t0 z+YFbna}ZH^yOGz8_9PBDf2NjPKVMH4gr?gc9m_&x=9ZRX4ZwY;U`#4R8zGVvyIcK; z+!FIK&ARW3FVSt*gOW0TUrNw1$qHGXM+z&k&zDEycD$&Mz}lHHdO)-s{=>TdJzB?O zM^9k)&h1%F*oC^3Iu}#15l~rC^*DP?^?BG@^wb2H=7^7g*>%KyDI4Sbk9UX2KGZs5 zwEXNiCQTl?fMRi(_NM=u6%LiY)OqiIrA7`aSE%z*Z&*S6{rx<;*ogjot)0f6?7P#( z1Vdd5H;ERL%+#Ua(d4_x$I0w``q_8AFjK2+cCy#tbK{|vNyz~|&Ylo)%p~nL51noe zp6=NW!%Ew$;DzkXdFl`=E?}%S2sWAv2aMoAr%xB>^tEVc-vdd6IR?F)t zfG;M{>p#Lr-SbbC!!eL6;|tdm9(BeZPtKg6>Gh8=gImv#xJiZ=oq>&CL4LF^5s$Cx z7kc^ zrr!hG2V+N-9F~>4zS!xzQBeS4yCgoNxEyH#%&Jk@<(u2IXFIaQZVELKT&+O^=sGI+KdBd+4QB2 z6R~9vmxIv`+7ShK!R>h-#-wGjY!bieYJg?7Z&q48!fqLe70Zk zn~#8?1;rpg<;8s3@csrpC~1O?b$!v%BU4*)o$wX-8d(~#*bQ4(Z22^rwGG){(!*pK z;jM?O{b<5|hoFo1ZA!0HT|J#PFkiwAb=19eq6_q%N8d&yE@0?@BTN`P7v19bnTqyt z4Seg32bHpQb>DShS9UDn$tePd1+G-T`QbI^l`G-(wLAa)ku9~UD`IyMtj#mw0Hv^ zC-=s*fo9y8zyBL}SMx#OJbkhY`$#|z$TWfW2v6)DR7?zJ__FYeph7wCg{>7l>B;6u z3{2T9yMIMf(!3a<}2R6$GV&76ih(cNr1R@C^a#1}-)P}=wV^m;f5?+h!}P@s-Gj&*Bv zr!V4GU?tfu?%;};pdYgGW6?tukLrFb2W+>~01qlnY%H&Jr@R8$n!&`Z-bQ5QJ~;~a zrhkx9dKzQCo#E3;VT3f7rT)sdOr~=*p!GkBn{?oXGlC7gx~YsQtE}N*v2H=*XK(Em z=lHhx7H8s^Hq@}@5x;WcD)24lh)1b3q(rv2z(h+Uj@yXQnjaO_=_lxyjiZU@(04h8(2A6SC9pgq*|4|S zEW|M#lO&=bZ`FT@&`?RsZ^Xzzw^(41&z?9@&mi{idsvol;r%3&$5f0~Eqfwv&+W+b z4HY%w4%-=PdCHACk@*5blUo!5og8^TN__1M|AC05nK;mk02IQl%Fq;xG^*pdh|}u9 zI3p1!Dc!{yI-7})+TZn@JDuU^nClre{~kLXTd29L9R%?KWfmVpzrmuYx?%w7lSJ+8 z)DincM1af9IQI~2-Gw}6P9SfyO||#X73p%PcN+y6tY3zyp~}aDMIE9B!Cyh9-mCc&w;$6*m}M z%U9dYKl%<8-Bj|AMMTy7T0yBP#$eI1Ru+?%ewy?)KwlUbmAovMit>sw=e&x}WW1?v5f*YW1`7{scEfYy=y{AFTr)K> zB@<6Iw_l8I_lTzD7zm72*_=`oLrS||=3bsuj*69<<<0ILDz z&kCFZUfzyww5R*wAARU(+f?^rhiiO>a1FxRqYQd_#l8`Yk!Fw2*u86`q~##Bbo6vvngAL&(jfI+ zaiWc=(lQw42^wa!z=2W4FQb!z6#OTIt`9V6sOc8Qdlp-2%8|Yitn6_&q2=zyT!D`= z;UCX$6o$#wBY87k*l>fk>v2;I-0ou!m;eR@DA-m>sJQ6Y$1Sa$kRC)?HL|z2yWP48 zA?j%32bj>qxCnTw$@*_{W7JA3l@TT>FrG zrJgPdMc(tTRKA9TVcV^Fq~Mt74_t7ZHpziXbDrYG)@tz&nAMMUz}JxlkAqI#@kT(gShq+=CZt0n;s-Mnq2ZotXWk z^`?lo7{gm90VykC`RxN!_g?5 z^tF!Om)W$cqHO3ZfwW)rh2N6)#~JfJzZ+wktI7fG2KnBrJc2lZC#}PnW4T@92-z0J zB(1zq0o8X8N8Eg(X)y@!MHQ$z4#yTSkx_$&JP7B)zuU;e*qznEhhkokYtZU%R6nQq z%7v3*EzX{@uUY@!;&A_^)**{Ee&wrM5s;DxYdOsy0jF_3>>YJK3g`!6RnjJRD-Gyw zF4B5Jo5<~W#tWkVf;iIJP8eS}v z&*6S0_gnB97=<>z!S&B-$3tQUHrG7R^9QTmvY zvUpPxi~4r|WGP$obZlwkz-?AaJ|DF%%yPmy z4cpvjg28euP;f$SuH($LIUGUK8|kMr!*n4qOJ@GDDCU0?x<;MC0es`(E?ra+1OLcr z6QpjppcT#hGQ3<}Ow(VL2#b4EnzxijP|v?nLf`uFrk;mQTNqQkb@oc<0qs9f4B9r$%f z8*tSAU*9mNVb5S#WcZj+PZZ$?KDHP%Sp%yFjLJFO@_GTUO?1X(FN};AzfOPtpK?9B z|H!9qU^J;;-pJ<&hAyQQxaT6Gs*mKcXjUj)sD3*p>4^5&FA9hBF4#e&;R(Y z-@M$_cA^gYG1ws4FW#o;5J+67CZ9>QUIzwF^z5y`H%V9aeR?Jnk2#3WiTggwS`oWp zk-X5Z2H}rJjhD#~`V))HJvro<@L_rOJf+Y!El+72nKha36v0*XSk08W>gL{5X~JPn zx^yWvw7KJz;c>}*$&#(*ZtLwlGm%b((jEJ>KvP91uMkCXOY9fMtbT0&-u!t~0T@WUi37cD69;5`idrih%_ zOl57@9YRUKDh&UUQN$c8U`zBUG0xYyRktXt6hL45mtNoxQP$E}N?oP<)W1HWX9I5Z z3+Sa_EZ4OLiFhA4<|Y1^J~fth$jx@=HBti=Nk*`k?d}I29Bb9-4h<^GehL!3G|ah)1+Kr&E5Ib zl>BM(*mW|8Tov8aO*3FVJt672x0VYofG;Df{fZwj;Yz`xa|`i(v=AH#3u{pRq&F)Z zU=;lKrttf>h!Gf|!s#EmQo=X9vOf#Gx^C1;n)k?Wq?<$Mb}J7Hxx_%RlU@opX?GsHyZ zp_N}GtI^!-;ySE&=V&bYVoBr{%zh8ymIK5Tw{RtmyxCsNYy>BKG`b7cyP#ROrOpfi zv;SLi@Fn?+A0;h4Cjh)CN<`&Ba_EU5sC~c=@i#5Q_R1VUa)CA?6;h#csv>2VMV!)? zD1SB#-6m5AJ)-{mdDHE7{7sW(m^zlR7C@*kurkFziQ)@;7R%q5utFz$=UpaxWR)mz zI!a-^O#l6UL+B}cUQuG#SMn($Ym_x~#vm)sNTmb#3L8aLzlXu6qDbcdrkJ_)h{9AI zah_0?Hy4v~deyU!w*erRb@+`QgwiiskeBXqmzv;)w5Qp*m%vV!AQ`B2NoD(}8AA6V z@3v@>$&~o#a-KAkr6!fO*JSVaoVjkdW-8bio*TBeq9Oj`aD$p#lvfkFDQbhW18C8`G1nvrl zU#$hA^crXDweD{VyJjf9)(*?0OZM|&T5UC zW=CElHMFxR>FEDq;iRLTErcr!zpX_1=cU$C#8`FtfjED#0d)f)rkf$S+n2{hg z)ey{J;vPAE>D*dkRguy#3Z?A#@mYE%Y|TSBG90dnbFW*>Gm3|cJMh^o+qOR>)ad=p zD&g=Bxr7R|u08g=>f@7}Sc=h94rFR9_stpPqWg#AHDfNOB|pkDP`0Ju?<~0-*bTv| zr3ra0=c~-8b|AlIJ{h&jnNXh?4`aT#<;ftNu7N!6@1PSsV-@ni?USm8)*ObMet0B; zu(pWK8Xr#c(O9m~vRFJm-fUoxF=AUhY4D(WGQ-u3&l1!Jl=S{a*sUO7a>fdHFy%GG z&u7hb3Dokw(sg^xso_K9$4WFLAaEYVlwTkgU1UR6Nh>nL5?j-9sG|GT?$&i4Cnywi zTwqF_3w#*U(vIQ;LLfk`hyy*!!r1&@NQ?ZcQyn=LouR=`W#NvF(d|6=)-jGv88@ya z#jAEZz}!NKwkYKus9UToKZ|0t;R1vI1zj$-gVj{DY)Fa0=cTk*+7bufF^1)4yKQV6 z3yJE_p^SxzAa>=E9ew9DLd=o4_Nfo!KjXY7E`%FXqZd5HDt(n61TmZg4(v3cO(v}r z560YHC6)2t(xd-ms)*%p{?5Dd*R&c)DX_B&<<|BJiFPX@(E8y+_%6sLku*o}xp-E- zRp=%nYtvfb&tJTL9xu&wQ7~%g7>*C$xP4<^C%=BB_s22~&v5`y8h`VGB;%LFC2A&>8Ll`_ zSyf{tzO-gkhsSS}EmAQ7+>r;}H?uCv1hRx`#^$J0MIEwCL2{Em7+&tq4>Tk z|F2GU6v6>$%OxjsUU#3E);w?E;`6tt*5~aHpVLmtb>6=3Xs#jIK9N7icgPD>*vdL^ z)A9rHV{CUbM!|Ly2=QZjLloeH%4jIXQ9sEnp9vFtG&1yy#7&n>qBYQ1$*;D7&6`yGT23{cu7qBCu%ljl)S|vDI~4m zMBdsxS*#{*>f!277N>NN8y@Dhj!MJ$%||2`21)+T+Z%Z25H#-{dBVQt=ZUC}@hMIO z5*fZB_VurPXk<0mMU%2sFtthc7Q`YNzgUdyfL?K z;vauF8gM*8Xq>*EEv79gi3+-U+R^_$C=*h;uLs=NFgmt5hL)w(H5o2y;Kl3|C%xN_ z@vyy`Tuc}0jWs*3FCF+JKbUA!3LxS@R(Xjb@@(_waiYCWq?^JeRSZ?-%k?=v|0b)z z5m9xUk*63e8uDq>E!;`j~ryri_%Tqn+4BA&;`Rck+$yT}G z;kabR2gZCoBUhxf{_@JyZ%wR2_42#gGIg5q>1BHU_zP!LCuBK5tgEe8ZO1R_(wIhB zu4a7z|J>eV@to*$Wa`odDe~KE-%wXl0M_Rlk^^dLpCUrH>(9tCwvlCp$#$a>0Oj3bZ zq#L(=7$1lqW49~tnmk$PiDD7p!}Gxqtr2W>*Qd(M&)%WS8) znfdB*bRccXISR_6T8-n{3rg^E49Us?i~zr!V8S3L30XZ1Pe7$ z-%?*T0%>&S>Jor9wk0ByG3Nou5drxJB3sxw(h&!B>5I1Re&p@}IZR15Pgiv`Fa0#7 zX?=!t;DCK_il*)r&3kn4a1`@)a&AnB>=BxJ34f4#E=fv9c|Ka-@ldo_| zW^hhPd^_*J`FYX(EuE&>hnm z=lq)`9lLN)qIH(}M_6PG63^*i830pP<6A?}`cJe)4yOZK*3H6Seneg3s4RiyLl<$o z$&+8fHbKYIZtf<))tIXEpAK#{zebM1{?TGT`aqF?x9O|KR* zJ}W5W=G`QMl+94^>6u)3zpVVxje|j=ukQy1j}IXEvL*?-CTmqRY?wJ^C+pvV-zvFOx42>Xf9O<^nJ2{o=kn zNSn#06p#nq`vtG~r;3<-?dX5*M+zcLM-Qr2ZoU}x?C9P&7wqW7$t{GZU-#kJTy>oW z!%;bWg2}??&O$Gp&;$m4Dah?>uF?DkBhkz<*EkToZG9ETR^J%xe2s$(Mp0n0%H^rK zx5*;9V;MGL#XUpwdQjb4^!UoG#(Tl`oQS4`|NVSV-@ARVOt|95v+Y>OII@OF(dP?7 z|H*wtvm)0A)0Lwnn>gLw3G*nMRptnIx>mB@mT2sb4K|!AWxHxL9teJCJE2|jLFJ}= zNm4e&gPw;4Kw};B+dg>N=(mNG5t)1VXxH&888Z@2~I=eiBsj+x32{ z2f~-2>1i!hZXEgQJIbIAR&nYTK?Jj=1lq}LkLo+Hd# zHO)2}6L&dfo^!wJb@E!K%dP(qsBf69^SEci?D#+gh$!NVUiJ4_GuT*ih_i5>g~gvJRRGpJ!I|!w z&(lQcj5aNe=4N~}6H>M`xR!;u9+f#7U_&AM6E4glHT|x0Br&7UR#S23kX4#>W`u8I z0>2K={s76c9#Ohya9wia{%S-|S4@;m?|X;xAB$y!r_L>hxB}dNR&ViNpPxQ>us_4F zJ2Dvs7l%3=(${3dIEmh2qw)+d#v_@BpOgYnGU%cZvO=`mIYd4+*K?0_eLw_5X$NSk z`V3Azo6kn)*Py+&`Y`~&>Nol*uv9X4E{5`gGpWCXy&?~TAtK9I?hx+O=Mk%Ep^|c3 z@EVDP50Y+6{J~6799_!H@~D!xwzv1`O`c6as#xwfXhbepXehFT+-MSaKQ};NWQi#; zr^q%jXVO>QMa9aWvru9%Kb_Z|jrgp>Z>6jgxLN@zbzOHP*}K$%>9DnG%(xTSUX;pHHfOi7vtbBozr z3uVzwdR#oromcIv4ZYxzGL-y>Cg`tkL7{4pR!|>Q*{oq=>TCC2nVv2TB0CwnIWE02 z58I^}a}V65s`pEyPvdDbPYb$sx~M)W>ji$X^;Xr?hu_^C+i(AuwYU&%LNJ|)ZRp2Z zr{osZ1H*B@6r0QXc!)jW@fd7&*llqC!GrS|=U< zh}P{#ESre*hAbyuhA1Pt8TyfrRv|G0{5j}3iSRAz!&6cDZ?t-v%rOUS32WoNn+Otg`Qm5 zpnwIt6hXyvro8FVv?68+XcHvNBxxW_{>K1;{Wx+8q%=FEm?nSOUaa;pIp>4E`2nV$ zTbr_#*8miJ$9#NvnJ?d%(nfyu_qCO=^)j{fFps`a?X5BFRjq;5`M%d>wJ9+Byz*%z z_+{ji_QeHK()(4X-k(Q^(%*QW$s=D~#+NBH-RGpw zFzn!!Gr#kT!)gh|>_20V!*#SHWcS8DTBWZ-9TjtY#W3fTN9!2;fi73ex&=a@=FV~qzxSy`wP{2fz(IURWAFdtALI_E@fzJhUlp4 zhfLX~I~O2)nV}DqQ|TIX58h(k;LT*^rz++90dgyYMIhj(-;-O^oGtWNh3it8OESPo z3+dj0tNg_j-n0hq$)qd5W|vO25rsMo9r-CJqrG^gdx+Js%W?3_yE9GAf&xn8@l4PD z?3zVm$Ei)+5NhepWyUeYxIE-cQMrFht<&I+G4)~C!V$ceQP5jyPX~XAR8}1Wjx}{N zMz8~|s3WIxWB*L)fMfgf>e5>)U+nCW-uHIDM?S+p~T5SRC z%MbZ$rYIQq><+6A61W=O6xSYYT-@Kt6CAx(yN$iYkNEVYKxvCnt~&5?s~+~8T5KKf z*b@=!qnT|}xWnC{Ydoq~=|>vz7H$cDQ(pF)DJpp(|Cd*lxmz|T|6?o`hw8o-fW8aP zw-~1~p*|&uYo!V};a&S`@BM{8S+=5W*%?iP9$Cm$oEfpl>hlyuV;B%mC?^F;i9jRM|kP^$5mw(ViIHVxLd+H#dlFD=abJI@|!PYZ>!4b3|^##(iX6e(sm^5vt;+%8QN#L9Nyy&6Ws8o?T0^Gv{Ui`qN;0=N#O zaheqGV;{0bZe?O_1TjNCj*U8>3USgi&7UKsDbX#67e=>=U&O zzimheW8ZB*0_@5m*&r?k!z^)B@SR!0wQljGatNoILFHHj84U>WUg?wU$3ccSbB8GQ z-7DV?1pfVY|92qDI~x^C=ev~qdEu^T^EaFdB*8<~)|GYp8Orv5 zqhS)&Zwx>)%0N{}+3!EUf~9_~56z5mYYaHXx3!sv7A<@04rcw&n1{BD7R50#9;C`) zIOxiU&b6Q9{5tKBe1YNFe;SBbcbsNv@B00axEY>@zIqobFW)X<(tVib+Vr2|{XSQ4 z4&-@U!{9H~fF*%_g0JzsxAirAK9u(S<*)m2&j7(H$fbsQaQ$xMlegAiC|PeKN9?XI zSLa<4`7twi2I?SIt2VSm`8sK`()S2lU+Q_+d~rW6mb@9#lsqynF7lco zh)!>{89RE$er$j{TBqey@pLnME7XESXN7<^_>nvoG$V2G{+4$?n)2s`NyuTD~GQr^Yjd5bPk~Ij#ql(knQ0t_b zf47?d_JHkkY%t-2itf(Wrs2=Jh_Q5S)A16fpJhd$n;dv6ZK)xs4VgvKKh9sr%?x6C z_ca62=keRIx;rmvRIRol)L0R_QgvYWyG6E{Dx8>rzx_J23S65ow|m2B8}*yGN>_MN z@)~tw9N>bFFtks!=nQAoOK@3UfBFDZxnFDW7o$zDr#t!Kko58z_AJ7#RazoaITJxR z9gbQTyx_iCqIB(Pd7tm@oYEHL>qk}1$RgbSKKk9g#?N7g?@~K4S$)WYzrgwH@Rh{Q zWo?>b=uj<>A4;A3+V?UQ?b_fG9c*{&r*w-ZIh2YLHXQ}TIVc+WsVXP>zQ~3*3#EGq zmn=PEpZ6VNX`z@wCw3L8$Z5Q_7a0$@Sp)eG&aU>(YawT%o5wrM%(fWmhDP+^T#j$> z`PDSCYMs;8I8n>=G4&6sATI(kICLmIVLoc|d>QmPDFRnZxd0ym<#N0?gps=?kpqYn zxMT$rDvbd!6mnU}QUnzxYr5hV(v1w6e;_Fdf5`)P=eT8)Ga-V4A$6~)zYnKKhqB$_ z;v@Dj+Z)n%TlIbXy{h+F{Hx>SvfND>6kXVjNepm%dxXa%5Qyv5w;^f%xD8vCN1(B2 zB8DQk{jW@3K+Pkfrix1v7iWZ+g%HG3Ju#0q+B}y3_7FSH$f^o{tVIDMd9uI)rqZXY zP`c>zf3GePH>3ZT4^g*!bUE2^C#x6yf#?24 zwe8;NL3N&id)P^wzJGNQ*&!*|U#E9_RAhEB@ll=8&ASjf%SlIuM3>hT2*_Pa*++7( z6T5nDtcvx`Ham+;^#$BJoUbAIEtYIv*s5a1slJTyv_LP)jJWJ7fN8?gV3+zd#j}tp zVVi3Li*=ce)8@ORnfZnqPOPF0}?KkJ%3t^fhu z^Q|1!b}r_^qtP(*ZJ`6js8GoK4sz@bseRUg;E^~GL^NC8$wJTK)Z@NoN+C(Diw9#{0twNDSp9U%?a%0 za);^-2SiQU^UBa|1KNw`el|?n7a=vNb&xa+{H=BP>iR zFalrB12p$upM{#8g}u7z>qzxp_tTi|pSDKhYIe)4x*HA>S5}UD*S@+%-?!`4FW#!Z z80W3Kk)1yIk6taRc@F$YoyI(VxvSr>*Yc?^HH+4scz*d{|{AX85CF7MQLc< zEx5b8zqq>-AUKU{u;9|TyF0<%9YSz-cMI+=K{Cx(H8nNA`gh;H)n}iz*LqfO@Vuz7 zC2Fk6vw9=ch?BHNW;$Jfezc4gY zu_{eF346z(UEl&^hZAK1d1$$<#5qquuqDuA#tG)xYa@!tv!o*oPmqR9M70mitO%EadrMYh~YwP&+jX>e88sJSQGhNzBlj zYCR`_86@TlgQ8g|F4(%X+iiVK+%NL-S)czeV7Ig{U{{g}LuWx#+^~X{C=7xK^}1Tr zc@Cw5e=MFUa*Auf%09j3geqAZg_k`NvVxn@iW(aL-$)Hq(NTS#zrR!$-%qeY9g+K>om!RGd=DW6+8-rpZEbSZ@8 zRt}Zx$)DJmq6W67A=3l|V4Ct_B@bYxQ$EN_qZ?ud8|ZW55cXv@6ltqo&xSkw(8H6F zr_Q6w1ooZsrHdazaRDC==lEJ^&&TvR9YZ-kZU6lUB2g2~J6p%*z{%BeO}a z=Bakly5+@#nKe3{#l^KuDt$2P$XM~~-|ZOe>MJ8ovi`O_20bm$J1G|RWWhEbWuRe? zWUDCv@Fjm}P+N4*E^3nAWD_LY!KFkfJBxm?-VIVphO#l`3dK~#$}c-ygxpS5exw*_ zR0uf{!{a4DZSJ$Gi>Plla9upJ5;$T5=9D@;kJeD2Kag?FmqehKc#Uo^zJg=(VZ)1x zl?s$$<-DQ_I<9;MfAr-OMY6w8V#B{tooEDXQLI7mH}QYip|^8kQR-#v==}1<0qWMW zaQktr4z5l^2Dl>78u>vaE`K#Rv`ksYVu)Yxj3WE4tcyuaD>^}w>+;)>j~s5rkx(Y2 z9|8dh(f_xLO(Y7sBRMn&$=(jDLitWy4T9j4w5{Cno^5pp@(VZ$@h{el zANMW&3B$CWi2pz$s&MFn3zeyEEf&)jvsy8`o}d-!v?O^}C$o?T zQ9je;agvu?i3ZmL1e3Q!4Xs(km%uf)COeuQEl{KFUN}J#6#pNtd~JHp=MQ$GNw{YA zhFM_4INZS8SYk~jJIZetGvRQ93Zx{QCjxgBB1{Wkgk~`;RlfX372SMk2n`KMK4J~g zT`EDK0tM+9T3WOK_Q>e9)$p{U{ooJj^H!4`ko7VS5i<$#4SU zQa#C<+NnVhFEQh+9XoV(ULSAqZs89ndPZX>0#u(q8@c|45Ur~tIUmjd#d;+2sD5^P zFF)5rQAQ~a4ZeOL$C8A5K6e%aCjw#M5PR675~dL#o)#j0S{gmDL#i7B65smw@dWLHpouk7lbsK^Aa+VHteIpUfg(3qzkHfK6fQd!g>ozB{mJgylz#?(6?~C{ImZm z0bQQO@0Z&fSl~057%+Ob^f&36^y5+=!c?hw1Kf)DXS36iTUhl$0U|Upsq% zogPA-j$dMO7`wc%h_6?GXL1j(;z&>E5|_EaljGkeu<7CGHVA882Y!iOJ`M8:H5 zi~+;^ivkcOef-0ZnQ%xv3Btu@1c3?C9p%G+K|%H#H4PyjJpN(2C+Yxt;rN_cw?FT~ zfcC(g;xW`$tRL1+a!0fh3n`fj0akTp19RMg8SBO3Nj)uEKAx}&Bmw=rWOEKy>L+b+ zG$mxtC5GIab9_XSRti({wVxBK&oqs@IFHtf3mueJ*#&jPztoe0x}jC4b#mR+>55~% z?TR(T?&y$dw@kjirUv)reTaW)r*Pp)%j(_DTOHGR&~EMlIVF3+`>nI@R4GKa6&F91 z((<5*=(~h4;Ap1O`I6CbnM0_q!;f79D7(_OvhFZ?I&r0(x(?RC>6s1hg`D-S-%0y( zat!u8Tlgo~MUR4`cHUECkj=z3M!|as6MNVtB}MJl(DUBUSr+P4Xnsy3HlMB4}|PGdLyvWck(-Su>L;z-#^ zx1K#qxdoYB1o_Ec^PO2a7UJ6GchGHp9ZdKHTq2F)b|T+5zi}C|@vjm(#^6e5t`t!J zf`4%>b`kJ@l*l>@7oBn>Bb8=%l=kg_xMZWfOVf8o@R`uJzvQ;}5x?%o63&JBAtuRmsxJVM9fWEReUA!!W~rPGrTX$>0FoiD3D z_%N+1JX}7iVvMm1HzqI=ct8GwQHRd0zQ{yS>`wS;<;n-Dp(5qTl%iab?A!Nz;9)|A z_KbJaR{fndXj!dHj;xKY!qXRt?19^+ao?m5%X@& z(Ur_D85UByUtW5XH^AGU9!+%|Gu1YRi0$g!gD zC|0iSAs518V8C$_$@F~s6k!(>r0t8{_F5EM-Y^p-`pwe}ER3km-5cK+Fo)kr4W}c~ zm#9=g`{35ROPXV~4Z@61yo>&Wg|o=fxSo$vH$F|eq3ypSTA}hIEFz?$!Kyn3SRDR% zL2MZ_ktP=~0t8M51l3JNW2jiJDiFGLz~cTgX!Itv>%m&y1Tr^R!%)sv9zAt#3tmgQ zq$#cm6Tbhc{&WNO#0?RCH(PkXB!i?y^Yd!%PQr5W-ZOTKI4CNKf1gNPo)r-FD9kow z7k9wnw|NzVG=*+lxPT-4?b41$yA>AqXAy_ZGhGco6-Q%l4vg|~e0u*knJvU_O;4@Q zX9fJ@#=!2$7=u`{F*f}jtVsw&dK%e1MMorH1nx~(YNg8#%I4zy*Aw%fk7Ce)?BvS)222zsZCrTT&qayQO@zvRY1(TC*R9wWvk8?y$9*Sr z@$A3v_I0lf)h(S$M&tJd4_V*(Sn-|=e+(D<(9~g!KL;8A^1KC8dcaG?Cpgvl z<&?1;HxM=E|I^AfyU+N2D;fJ%;{!g|QT`_iMmEh2+234s4|R8{B$+!~&=s;+WEjIr zKM^@v|5EuGbAFlp{tWBq6I3XTf>Iym6`pUHCv*xOL4Vv0rXm_?pOjG5%!W80qjFlvsYbhY>=+SP ztnXuVi;;~8Jk$?yuz)>Qlp8{w%w{q955MkmKomsVH3w}dq=iZr9TLr`?Kb16^N z;;J5bA6w}|sH?A@mPeD)^Wdyl)Z}QkXdrs(6K@EW6Q&?iZk4D_mcoI4QcwedlZB0juy9uuGj4r5Qa}qz|cAF&<3Ad^p2!BG0{-=xu}M8U5A?4f>bu z=MJC^-AQxFCG%EZJA)++q?#T#i1%loqhrFGB;GeFLLe&Ad zgKpNfveBZ(@N#Z|cOdWB7k(ybhJlsSIw04sBSc%^c75T0q8&ks`6cnIC|a9DB`{QP z!bADQK}E^dEy=ek(KyhJv+eOK1L=g^!8;pM4YN*wi#f_Dyv8 zlsx1dTd;BvRJxfG{D?76wCb{&n_6Yf=4^R;O*5}B3+ox6X#v&BnPrRDzyzWE#q_cISA?NEm z_~oHB#IFt_$lIG=GeMrkmcF^VZ@9DKpcn)X7DwgTV0a#fu(*f{O7Eo^{JzV%x^GW| zu&84*IIj^PGN0A~CTe@INXr*=12*Tk=&H?IFVNxCTUI$<`GXi-daPxp_qBgzN0oFo_khjX0 z*^Ez%u9Q)sE-301N6UsWZSK-aPRLjQzeg`bX9(NAzfM}u5axgO1@P&TURYuN*Z3)w z4^CkT$!JKh?m027Yd@6G0nFzzaO3t-Qjr6@8&cAY{P;^W{qGA&eP^Q#_s8|K7@vwV zqc^3};12DY9>065uh0ENytauU{*>`Sa5z}as0r5}!W|k?Z0{(%)ccXvv-bVA#XNqaClGil- zdyx!x=JG4YH5NV#)eI!fgIW)B8*6Kf-WQGDKiS%(`+QgIP-)j-yR@`OACoBMh-W?6 zoPnjm(jl<1iwYa{-~Nr@zfu}jbPnj$cH#hvIoAVm3wWVK*DM}NquR`)H!e{yS1*N0 ztq3(Z$&0>%^xyNa2pB2YC~lMJGc2$rwxUsOq7F%crbU}~hw%EFMK`jh#A>qHkkc^` z->Reb0c@@P1j{jVX%$$kR28K*X1FYIPe1Ebl<53q(9%)Z;#cGQF2e-vT|w*w*hr$o zZpm=}b!O0NVZ1!844Y5{3tVcJnfCfhv2n^jaxu_)u~tg(cL!1#;}E_(cZmGgqF*P$ihx>I zWAVObTl<4|A@~Y}w4|vmp>^%cqO>e=%EDWcvWc|Ud1RpEvgIyAMa<~ycZP4JJ*|G#PkR8_p$Bp9Kod}A z(}D?aZ(k^B_3Yb*zm~HRHSBL!sJ~VI{>xbJZu_kkU6uk~W8jGtRSqD-g=jbUnYE-% z4tS`kh;nBRv&=^UZJ>vpWh-HBxFH*WGmqFDmd zQSuF&d<(V;7kCE8{Q8Jg@#LAJf+;Qj%({}s7S));D|jiMk7jQLMd(#{D;zvE`swrS zhFJuXXIc!0_%rUAd96cc12waX4_)FiE;DQzM|P(rDNfq{3>B4pBMxu3ACvmi$pW9A zp)6}^uCijnu^9x{9;~88z`-Z3>j=bHt3E1AUKlIus6(+Gg`A+mla^lkN#ra1RQgOhgat)&R zlTET%%=6GOwM^p|dJ1aVJ2SAb{3eN>suEFi#I=O&Ai z=F|sQ;AhHxbaBc*Y#a=Yye24|Cq=fkzp;)gK=;+(<+^_*N)DZq_@rs?Xt8?NlDO7` zoVYAqDr~D*n^W)MvjI-}e60)jer}ds4)kQ6=?fBDX#Z0Ca=E4;Z(>i#Q>RRMv@tk6 zQvtJHlLcc9yq)wcHwFa0CyMDy>gFn$Xz~V*Jv`opH^Y$kkiDlDK8JGYvj-4O*6LSo zth5sAZL&$4jL=_7JAz_pw3MR2IfuG0qNK#kgAV?4>V035WeeFAa8WZ6yXQPkBKd`_ zhUBCTT%fgplRXILpYC*3p!P~53lz@MjkO%wokxUX(`HNly2kp;+I4zXNUq~;e?
leQzDcNXVlk79dH_EcvDe5(!PllIqLg``+u zKF0488xUjkUQ_ZoIvkorgF2^gA$1X1*|!(}GZAX$!`H-34bb$L1-GBxtn;?+-0N=M zcOU-pY}x>%7Fi|2Bn@^2p_vAw=Yff`;IzB;KgPP8H<%iXuaFLRX{VgttMZ9qkcUGp zUPK%UkV=sqeJ2c;;+Ke-f-~xXULpcGV!Oyuy9K3OvGrr2cZ-pv0BU1HYBmQdxhm0x zpm+zdm>x{W&$(S6)}c4j(OJ1_knlCP_IN|~RW_80%{u;2MG z=#_Uj*ZXW#)9u~1+JEiZ&G$86a{3kNJz78<-?FSp0Q1p8Ls-SjGEU#&jvh5|yY1Fl zo&iOP0RrrCV;?~>FaP5qRbbR#kjnxIGw+Y6@suR!-hG$Dj|Hf|m8SWxQ>J#8ib(vP zjhnOS&%k8ZPXzg^MCGUZGX(qm)Q^!lNNKsH&TZFB_RL*V^N8PeTXU5b5gB)cBUow! zMXterip&d8Nu9u7ZYUrY#Fzc_sH$OWx$lrmGLLitc4^*a8oF$C%94Iuhry{=w~m&d zJlJp9dA+W0Z;AYLL0)iEWiL(ZFuFhH9_qmRdi(RuoA&;b8v{vD62;O1@Auu9ItkA& zH{SoTF;6Kmuf`}%jujFf4ofqUW&JbtyWv*+9D>T_PZb;uXyHA&Q>x`{Pt?RqEVEGH zv+3*4K;Q)D9TClDq>(rjn^Oi-E-zZ(e_>&Kf4J4KxCD=DQMkjbararjU;?p>^Q6s& zylt}BcCoPh%oUI3+$8O&IR{!Mf;p|gSq4$qkLgeKiW}p|61I!wV?OVr>1zqL7G{-j zF@Rkm^v4n!iJ{XVwzow@(FJ69NS0_AXA}oBd@5B`f;bt0ze=`-=_8`(PIZyb&V--p z8@=f3nBMl^rOyHIRc?>=M5Z3*GL0N9e&e`7WVNyjcXMb$=+}mZ0L(`Z+FK9UZgvay zFc#%aJC!|{@+|rO-aF?0ZvZ)1A7K|vHM%e4L-U#mLdU{LW0;{yeH7uCQ`n5^#(up4 zo9O&U5GICZ+xVdMy-td!J*QmWwkU~eKbFpht@&2B<~^KpO{+w%1JLe~;PEqwqbSZ6 z!wb{Y@cWD*!=gE%brD)F^3wS^QHeJ9Ld^ooq;gVD2gXR0T~e&^O}S{#s8{jGVShf6 zPU3~YnjLx?^oBxIoAz2^OjSaID9iZtxaxy)GATN(ozzu>*@veSB#*yJaJG!?gwD?_f!7D}A7L znh|2#+wJ%}-W*t+wtK|+p_RJS8)-huo?!s+TkNaFx+BUogul)K`ZD=|O;k${wps!; zFT^xt*w2cV2cFa3x%^jHnJmBkkb8@Nju7^2e);%U0__s#wNRLQUqt&2pYMc%BiT<~ zk}PtSLi$7XCP{hfAo8qcfCd6F0m@498H*{3O;7fRJ?<|v$%>NV9mf*zw1dkeVG$z1 zWBKg%Cx+L{o`HS#0G7E_MMQK^<FTppyZW8)zfAjom|19HWq&iTvegnjOC!y92e?s*L$$6jA6Q-xHfhj!R6dUu`z6kL zu8}m75|Bz#u>{+1!9IeK(v~77J|k2)iyybF|8AH4E|yW__1(l;@c;0=MQkePN5mt- z%$GQLQyPmn5+azS9bk8>sh*=x#k#3_OONomc2bJt(l7$+RjySzJvkn|iSS$OHQ)jx zpu!M6wa&XUpJNx`JF9N6tEw?d`p~10ch|R`OIrV<)8#wWV5yS0WE!c@-X~FBItZw= zQk+Vj)8LUwh$t}DP9ir|dmL*oGLbJSN>DQcAwD^}ip3K((_jOLYpS>T2?-+rjOu+0*uMtg zDa)3FBUs2y3L@wUt+>yAjB@6%guwtu@cOFQCjH(2T4#71g6)uZ^G;!CZwOq*$ARlUBxtG$Acj;wO|gU64O-3G2mf~yM>2owkfh>&;3zWV z>dd?a_5bHn2PuxO8_|c%&#oxR2VY#4RzGZXcE<@d>=||THnHPL()_jdYsuI3>aouP zv~nyx#Np6HLtJ@Rc&^?$vbt}hl z$Z`^h&!hbAU6*Xy0=ZI_ZFI7?!o22j9_V-;8`-utagL5vSZp-kv2D9@Aw>1vC2QSv z$G9d~BFOst^;f1%X_+Kblx-q`eEQuZs9@2BIT9h%Y=FsBGP*-k1Zwy$qdHOOK*~P+ zhB`$U3;?m3OCr^cFggA}Nql4_;(*rjuRbKX0a>tl`L88(JW46n%yn!0VYX2jLIA)D zrlezELsQWrk-tzIcjD66US<;k#Egnn7}AJrrr56;P7hujVW3nqW*Q`hgf<>Irl}+n zi|v3(b@TLeEI*X(2eN)}T%EyWn>8>h=4EEvPWt1}V?qcxPziG5A9Cdog6 z{LD76wC!Vt&G(M^>|q;BMCwFe>0L_Qlx#bs@Ris5xuysBe$MKwuB*1tJ^K-2D1PC z@{E=D99$QkDDAwqxawnR^Fo*#S6Y?!x^KKZvdg+n{})WszA^guVC3+fEG;Au~_KSPFP{iy&c?L^B zCrNNlp<+Eerwh;w?UG%f10Ant|gtd!5* zf|Y{{uo`DfYuNZ0y&0knV@>&zPqfTN5pGA%lg@r#YM>|yfgFcH;|4K0a?Wx~E=9s_ z%FvjeW7D|VHE6Yb@fDZGG#*B?C{YfV+?9O(h?OAVfZL0!$t4xc=J|prfWwkLmo(D> z%9>PmxRk#6$E)xqMoUJ}-U7O$te>!6+jKBV$bm8k>ht~ic;Egky|8ER181M~z8y^VA>-Y0>F&bN#|nRq`?VpS#Be9Aesj9> zPkVDz>`nN^SHi7F2wE9dnp5XwcQ90Lp~~lotPABISRqWYu~!77JJYSovOrgyB;um4 zJHw!az5)jESY@qr*uWfSCYYLQf`A-@=9WfIz-Lzju}Tf3jI?$iQS4MnJ5P4er#~}| z{M4=@%-z{KG?J>;XSBg1q5`8i*^S7z!~dHU(kSY|lzZvcXJ1KijzYSpbIKMyz0k8| zxRWDekFWmE|awX-ZRBZZUN35sKs* zVvxvm0jIRQDTjZG=7Q1aB~lyAOW#GmaA4yAxn0$?QHw^LAsIafwi;0xBuJXVgyiJx z`KNVm9Dw6h1y9jQCyzbX8!ppQ^f`JOK<;}7e#4L3v`Wo_CLL{kr;vj>#)(H)`HT^~ ze<63D0SudCy2bKSwTKPPUa@Iqh6Tn?PThr>bOoXAKwIiBJY5+vD{lL^PwDUS*p5(O zKxzP%y>-zf8Q1@BslN?WQn^WQ_m78N?#KxnV_&AW3K`D+FVXa^U#nuqlNkg9kLwp; z+c#p!OKHsrw(<23zCap$L5WVZ57vN|tKumEAWvqFVLrt}@5zh12lYOLkIGnBJs90Y zYPX@)i`KYCUH)Ahz#7t%R;F4j7k&9`4D@IECbnECh3lU%yyq}nS>UjqctvvxeyOuM~%P_4<<$fbR_)LUIV`jC@$Y(cWV80 zZVs-RuO~4Cx9q&ZUI-Q}3xZHs=mwki_Y8lTQ}8S=`Ni}|LoccSpd_=Ly)KjgN~=xV z`IM3S*i_1olH;V@F;<(CPfbMEkY(=oE7fu(u`31M&WTnH&$3P>5?Qnd~xr#XLuSiiz4UX z932q>2gD5&yfwA|5xMvnIB&P|TRs(7E!~{pMjc!5up1`T|CcZe;p? zLUd`gV9GLmpe2I4@dV;5czG-)YRyrjafUw~MO2>F?h8DtXL%aU9#)tzM&^{9GbM?J zUpeu_BXGhol!Xw0bgp9w%v^vo1sg& z&S??1{N|G)6e*YDQH*6B(*!{W*Hz|Q4x7*Z=shzlOaLWlE@wWNIw*3=neX-(>ELyp zOeeV@Hi5Alu6IvzOY4I|#^C%f3YIw!nJ-x=8IfsnJ8T}N-@jc@jLT=9=J_~eHV^2K z3H7%mMYT+COOdFrL{#9rc}v7D-tQu~+3s5;+Ef>p9|eXEmENu3pV(t{QjcxW)`ew4 z2+R*o3H+?fvpynDPuLJcYstXi3+ZZDtWtntcY8(2_&V-u7SDpx(jLgA51&2&+8}qa zdn8)!RNPSeDu8KkeIBTY%5l&0o4n}T0G(~s+zuQ>t$j?7n9LkO4mUuLawnLeD`?_o z-zUtqjqi#`B8jiCiyD0J zuj@e_OK!W$l<^Z+LZh9`6`;dSPntX`sWT=iN&w`d5~U!E*SHNplrv25o|rS2GMnER zkfq`HhTc$6Jtnx4ig}h+>nHlF>EW#W9gqlguECJS!w|rgNIa@ zTLwU-xB8n}m68Z#me;FOBGXlH_Fi%)s%C%^lq_ zgUfgf1^CPYHMXF$NgIqXIRjuJ+TpqSa*q@DKqbtPum@W|pa&+7<}uYzj?FPyVL21{ zI0F$ZTQ-VZ%hI%Q9muaRb7@~ZQGlT$`;|sM$|0Rd{BQ`QI5Huc%GD3i*dA|qn%w1J zbs^_C=V;AEP|#Wefyb4)xCkxrdMn9qWZoI z@Af=KM|@x*@PxvxK{qRq2}yh-)aVpw3MVnvz|o;$m~=Xmc1>nVr2!xdn1}}vNt7qR zVtJdHpkb{<@GO4fL4Lohvru-X+U<#lFkZC}vC$zf;-bde*( z`=^5QHC^s~(mbhp3Wu{+%;VDHHH(VBd5Ch9L&O)xtSXR~B9xvbhh#IoGAnH_VZSWN z-nY^8?dc1ik$)?|*ZrHyQM5%NeyV4LWb*8VhC}V4a2k?_(1E3p*B2GrUowYt;iUeCeAERL32zE+EDya8I4j?Dt>^t zT|_D!M>)?z;zmc$G!r0HY6wC@E}X=4AapNcGaeTNe?PmksA$cGqfm<<3k{KZjfZ`M z%ma-ZV-~2^2ZfI8tldB5?=M5@=QWVITZ16*FDN`Qhg=RT4+j9*P>e*m?+P+_=Uo+@ z8oG9++V1G;qfV^$WAm;W9KeDI8md@T(1pc)X`zl@?Tw%B(1U^AorO@ehOmEx1-&`g zQigkc5i3dK5~XQI=+Czsv|KhZNyKp?39wIOLs-!E6}P}sV=u{BIX5%0O#XG`DvpMQ z;w7qVe~(f1P7n~$qg$a&r)3<|gCUvEnU;@g1;Sd5Kyy^o)`2E-+;h**;^wZKC#_16 zjsH<~#>n*Fr2?Tj2Hq%0k;#q>wH978MHR&=yAy9?UoaO{*DECSt_Ch7e`rY+AOQSm(sOu; zIs(|GkmPBaxhQs&q3X%KAx>b>2?g*db?|Pq_MmhfdZhns24jFQsHs45oFP&BW)8A^ zi6&ygm};#Z@jlk=FxBM7f%wwF)tNt=-Zz#sq5#rJS zY@X3FX>@iD6vZ!IAd97%J3bub?ImYlF&^7ZCyXqlhZ3@+35L_YmB;uM{KA0w6{hsB zR$b|4JOURk9zb_~w}OO&et6F6a{QVef`DdCgD3DuVRTRS8tS_o)EAIIa?bPA*%%U6 zCiKpXjK-eW371SzxBhW5tIB|sluY{;p+#||PyBZ>Zh#Zy2yciG`JIXWeXCY2!5;%R ziy)I#H6CoZa#tIgkKBfwKnV^6iu?qL@qyC1Li(veQe<=%qyS6>5Ad;Ku`4%(1hRA# zB^_(M=gQox3bkDh&T06H6UIxl=)sN|t{(TR09x2o-9DUAZT|~}gt9qAU^TNh2VYhc z=k9S9%uJw#t37rz_GoCeJ>v};7Y8pb&|X*UY>jJuDqy$dC;Zb|y-L5ynv{hSJ_T%R ze>D>Up0{WmW=wPX0b7%coo)v@1k-;&2`&V?NHe^|2P+Otb3zhU0JA}_)dbK4R?!VG zr(87|N>ho9!AS#Pl3eVuqLZSOCjhO`HAa?SACtS_m%ui*fUR4Ub*UBJrVYR)_-r6_ z_Q=%shuF{CGR*|OX>o{dhoOGhFuyRqi7)sz@F<1C@}r`6Mgq5zbx=8}&RK>h5pyCs z(da;g?dkycj)|TSkPZwYzmCHujU;CJKL%4|%8X$iKXya$gQ}~_G3AU}!L;6;>I(?> z89kU2te6onU@!hZFOxo8mE>#W#_*3n!PG*p(COk>_&8mXCQmA|@yIREp)0!>wEA(l z-39^3Ln1xBI(*3lML*&1C1V`NbEvyL=Fm}UGz+Xop0+K$((nKsMl-3{8*T?MHKE%)&ATnQT;f@Y8Qsr>|3Msb+mERG?^f zSCDZjqkHD5&D?Tbevzh64>Yi}(#m*N^*>lFcp6pCD!3}}Y{3DrE$@gPLafE$dw_R6 zetopt{&#gu3qLe^rVr~5o#!&e|G7=V7L9%V^rdv$)T8wlO44Zm$bZ!x05=%sHY8AP zwbJJLf4mf<_F<;ta7+ig_C^E*23$x#w{;Oi;@{fZV^3?6U*IIVC z2ClP0mriJgbsCt=7xkR|Qvz3lMjB}J8B&g8C5hjv5=FZ~uZOa`)T?#6(6bJ&Q$>%6j?;(_H$R!vN$w3uyNLQk9^1ve&W zUp0g&vI*8$p~K_i;8ODQka*bJLZgQF{Cfi1v93WUKTg4Cp&#-n?iD{rwo{ILQY(au zGQXCl_MQ0yA!Nj+=RTFQn-Lgz+l}Jt!5bdu$XCLVixRr_X-RJ0(PCDB%Si`ci2eUC zBDAW9QlXF`IBl4CK^!PvWL{J1NcN{WMTPA`o%2_bn?cr6OS1Ld9zfD4)Dye;v435DG?2>Yx#9vO}rBwl~j0zb?A9jMDQxYc)J~txkx*&D|0#c>g3P)F%zerp3Kygp4%Q#n=$KjJZ({WSoanroPosa@8R5 zl=)u$sP(?t%+wvzYHZHhb#B*wu8Qe-VoYr0fwrvvGwm_N`Nk9Rr=NZQ7z3_UVmP>e znO)N?+se;#TBS%azrZ?Nt$}Kwm-*@UF}UFNfYFG*tKWIQCtbc%a>^L*=+#dIAxUlo zkG0kV`NiG;$sJB7#Yd#-?_659=As9LxyAqxQsAJs0`34_)b62R-^wD0PL4D5nhtWL zqURn1Yj1{^@dy9*0m9rw!Nfc;R>xkx9Lq>JUc|U9l$iPvnCNL7Felqz(988>=r51l zsh5NHBakOm()yfzjT?XAgst$ zWv!{QAp@)Kwb#v&1p|TMEAsUNryyS^nuetWIxaJtH((12XgOZgOpSuF#Uj$kM`qhi zsI>i%TF6?9)3)~l=aEcW1FF+Za*H)M!sblbxNnk0&j|}soBBlyD<8QyO$V?V z1S?t#16UzMHm=5+o3e!ZVUgf8#$>o=O@;Fd<~9j(zsHOLf}K|gG@$&Yq3X8yeTBUN z2Sr}#xJ)|!Yst!}FD5*ba6CkTY776Y1g3dECo;9yX+wacCGKul32_fn8XJowBkVo6{yMji&~peL252+B(Ah^Fm^VipF^s??L z$FgR(R26G@zvIL{#KhqS+mpW=8wdp{oqS9Qo6d}XR?fDM6l07RQyMIZ5W#McyB@HP zd9CYl-;zPER|8`DwbJZGyY`hf1x&`#xNxHmShx{ap$UM9ZbMF+<1sdyMGr?p@^U6K z=|SLvwwi#_`!-O>0;abyjX%@qzQ z%&~nGMES6pRY_m-iAG1Kx!HjFf%AZRbag^64|$0i@I~RB0z8_%N?8no=Y@87zMSz8 zj-))j`>tNqBs9g7oGB8X=YeXt;-c|pzp=SLq%!S-&@wl z8NR<50(+2b!skgVvf&A-8O42UULc-tkjVbdBqT5obPxLT(=pCrl=y{5CDT~bLQnb` ziRC5F6p4O)O=0Eg#0Y!zuIg1P6WBSxugQ3Pw`itJd&h9$QTS}kVbk~Ai=xTrKZ!HY zMBf|uidfwNliTI5HD@FU-u@}h z)R8Ke8B(@b@A)-3s-)F>oFOJFlp$9F2sL4DN`HMYC}Ch(Z=$<<@4B066zM%CN602Y zPgL~Ky~e>>&Uu373lYVl?oe!pO=#cfik9RSERy*hTT69pYrUILspEqQki}&YW%H5% zqBXL|Mj8FfEymDMSZs9N)ozUw1fZI8__{qlg2{W#-#w#F$Hb~a9dQK8mE^*9Z>@h?BIBN*FYI-7c|{#i1s0)4cqS0y&Jp@#o0t^X}J=Cv_BJT7z_8M+d|O1yR9 z;C`o7sXb5QZQ}GdE&do~Wn@z3@`D^EwRi#NyWd^bHaPa`J&#K1eh(PYTymnyj|MhwO1TwIrdL^h{8oC)-qM(SiYN$~}(C z)xeXKMBeV3m`~$BHogF2Y$aPI@@*dDmPfr#D89(4W(_3{sGidXk$E+~H$w?%c^!_E1WP>eS zwMr-!&wKpb9#rr$k6Iyy^J2Wa=TDY*?}vO#>?GnD;5j$R{pw~7Mi^b~VBjH1Ll0EY zybH{N6L%k<7&93Z!}y(Nuy;s{H>}fX&2vVfxdi9lNM@v~Pr0h%>2sgC9F?F{Haek! zo9QmPiXf5pw~Fq-qJ{bOT=RL2#E`mRGlYJ}3NJ#TTKY8w%r6Annq>AD{kK~Ft_%x5 zPJZ{B-!eA4Z8s%+HEIPHeeZ#(MV;e$LeW=KVNDa1oEON9Eulv5r`p?Ks}^UElq5kZ zv{t{ez%R28uzRP=L;LxI#&B9;#5=e& zA?<(74dAkBQ3;D=FOG-L&U5`NhZgHRE198aa*1eT4{h)f;P?5Ky;C&qEyHK)L;vS; zPz3IWIs|W{^^cs(ry`i1JUGa)hy>gwe(zS2cfWxlJo}WSYLP#ga>_i2&gMW(wAEwH zb6tXPU>BN5mGW1_Xr-Ln#Dh;_6HNWT$A>x|{)VZdf>CH{hI2ey%F_v`kM~Q1E3f}U z(^>d6{XO7*qZ>w-bTewSba!`mH%KFnZWu5+q#Gp#q(c}T()dME6lnnw1n>CWd;f;* zbw1}j@qY3;`VD8f%5}5+|M5NT@s%R^id<(oNnGaDvT%9BR`0sie><2m-+$=+3E@1B z<+ma!h$hEH72-$PczN1T>`Bww){VZxO(FTAV+v~q2jWJp>Cb>ETY1VMR=Sx0Dlm#s zA;Jx*ii=%~)~c_&W(mP?o_@W9O79xJF5@QWNyEYENqAT|vEqf7)$VJutz|_xk2fBF zctSjGv8yW4_m43A8C*p+W8YSVHh3g;9%aJ&8v~d8n-Q6pt_aIS)5N;*tpT!9vfyh# z5`gyP_c_2m*!4pK*Xi4*A8+sS)fPWjlnWjH@)Pyvt$21&&whK-!8<_&y5}D!4U-Q` z7<6lGmcVx9LD;3L;cCj7+SQm?Mbo)tWfpuY}#rG7EwDhdj~vS6xjt(cdG#FwM{Zg=Ram zOb;||0Tk&qV^8tKl0`)X?Y(w{ntA*$S-sig)`ZVC6-t~6t{kj^fIW_Ce1(K=6_u<6 zvkDd~6`A#<^QOG!YJ7SWbt@Ltx2(`BV19&e(y*`pJm<$?QqL2Ul)Gyfe;_s{)wluw z;E?oEKXS)=1CN;`PfWwPT3M*{5{r%T*h-e*$NYgnWQuT5I3*{x%qG+qx+i= z=c3LS^1q`+3m}qMiEybcBFgPj!dGL+mYuK4ET?zD2F?=+q++OYGM~CDgeS>Xh{;Dw z;Lm;ha_>8ezDE@Bws>uFk=@M4s*kj_(ky#GQ{4w09xYl4dbvkK5os)F37ajLW1qB#oysr@9yvX(E-b||%W zj|ElC6q7%xrdTEt_t`Orh1wU0i(t*I!&v)lQ*~sx#fCaELIG$~xU0!AM1GhQF2mx{ zYz)}wM;F_tY4h6S+mAl4?Qzj%(Pc9aiQEyn*w!&!L;&k5iqv=_N1ke=*@AGa30C>+ z9rLAyids1(b5MZpOFJ5n9K)rdJep0f06*SQgeIAexmD2yrh+Sov5f;GudJB;#*&~3 zzX-__smlTl>6!@i8`&bfi4*1VD*Xe=95pk4kfZyjvKOmRS~<-OIsJ+Sk@K)Xy}C`a z>fONLchu#~RfvUZrIyYvvJK~RH>?vNs~en2jiB1qR6erR34o%IToKENrb!`|M!5*R zF{hEG$B?bbIfcv%H|+kY&RnJQNM?<#s@Slq7yXaIX}qnr8bQL;Lc+nXtjr~=RlfT| z6Vfip1H;dB`ioG(%eI3-qY|9akq%_qkhAobdI!@QRuf3f5smijuu9vmzV1XHg+Z}` zE3a&s_A5U@uo}8_)pnANxsq(6bMC$*siAH~sGDjHT>uhMBbaa>|(`95DDyb8pxJxR#oDMW+ z)IGF9)?_br9iy@oKeZ2QJAJa*zSNabwTtrL{UP&dQhX&28s}QOcrz`26+EhJzNA^z zi#v_Dqe9aqRYPhZC|iNzSA1TlE0e~_bxnSA=36S;_8x48Szbuoi!`(8LXN&lrl@$v zMa*o}QIS54YMNBRP81I`5hmX{i(CBCz;0#aCvFu>ES*er?p6DXL;X+1Kju7Ue^{F5 zs882))85w*p2?sF3CQQHon^MhpZS1h6mOXN{i+cwSmT| z>uq5xSx?>xKjksl4;{a(h&FYDjlnDtk9Y<*Lj-6Lb-7Hs4M+u6zHr`Tz~lgvgYt5s zUGVSX{uxowTg+Xon9Ky5}#vLyD?4 zMzZkvQGFYrRfy)o8k50|z)%kK-Khh>H?sbAhAF zfNWy6?eQCUrTrk?CY-C?90Jxi!?79rwmki@*|c(GMwgDwrUl8btI&6ruIlh%La$FI z36%jmDbp+wm+bWY)`CT{Lhw!1R@wCW#F&i&G=O~?D+kC^=-T{-miqc#Fdb-HtKJM8 zCVvf{RK2oWYOCD2i!mK2n`Z`~*b8{CXd|zb-^H;QByj^sPBg!_MXMpMEu6-^xr!!T zP&2ZMYrXh4g~Rkl92HJ(E`YAfQNfy zafqw-Edt#0il^crQD)MGSw6)l`qUxBIhuf69tP}7|I%w_QA+KsQB`V2sNDALKAU2( z6Z`uc@DUt?e(3jK`5|G%cihaGgvJXL-yfg201;C>s7vyRJ0!Ta09iukW@ns&L#(+u zgVk`H)YDi2F^N2oEzcGVJMVFHge$|=ULS*6HeL95?AVBi;)n29~~cgNP6$RP&<#Mxu)B&yyG->p7b~#gNp|< zRn#VFI2ydIoe`U5w7p$fngx#x5q;AS!yoN~S*+k^;i6UWQD4jqX*`%_xo2M91@wu@ zcGtU&;ehl$5!vzx9r}nIgoMpf^KNO&2GfYn64N;Kc_8ga__K3SOZzd$4|&F-70=DR z`Z1xHQw?V7RPEwl%GsXCobzj@C9fW1z-A0On^s`WejW(~L!>tLGun*asyO|8R_+9iZ7%(;Dm1gx-YPsV(+Cyw&k zEz>nXt7!An2~bYKn1)dU+HQUl?NHfPUS0~^7{ZfZcMdXT$g98@r{r7ngbsX3Ryi2W zhU(3ugICe%PBheBlaV4VZ*~4^D|K6%Nn@aERVFMHz$jmXS#*fb2qiBZj`N^Ou$5xu z5NKnWgn>1?=_LBN^E5N8O0Wl(@!~f)0&ohVA#Ro;ML;MjwRL-HRpB@(2z@o*Fws&N z`OG}U)>#HTsBI@bW&BNSIRa@Y@}#>M|9=)hJUQ=>W4|yPNQNStTu4UloxkAT64q*yua$+1<3pk zAP5c#qzvo-+&9x8(vRHHW1+*8BLAvc-={!j7HWPRC;t0Oz(d8V(8!nDBEF&%8v1FM zERQIA@w`80G`yc+=Q6(pW%juzawM2yC<{s-a=sz=m}O2M{`HEAalZdOjogobaHE)Q z=)1?;TR3n*d4)TCX0J!HR#+J)FitGCh>9VyU~9d$IN}jvnLOV)@gqv-(z|t~9I*47 zB+S%3m63Gm1)JM&1L>O*gTPr()Z6I9I6v>V)xMMx$vs;{+L*ylmQOh+s~`M zvfpbj_X8(sxc$_;AgjITTS#1*(Z~D|0ty9)CoPEzSD@@{QHGth6zoSk^e<$e6i+gL z%~t1>$f-5#ja}5->fEcDo2Tyk3PpY`cVaD84vz6oIDUc6+`g3H1v?REQ^J8WuI?X1PX{`Tf3gQh4z_$vOh;-*a zIPJN#9}QRRPCIGXQYvA$R>Fm!*KDVSEEY??@|WWV~kErvvMDpWm@B%f7(S?rfT@O za$;k`zWrW8zSnX7rOg5G*$O~Ny3F5bVqLRQZ8p0k50Mx7T=kRu)pPMmV&c$w($*6LV#Rjg`=!Z(Af!vk7{3&GeK7D+Z_oVuQQw5# ziUY*L6`fW}`>pi=8T+e}+94j#@jWYA`r^d7*PPCIBa{(wzuTxL7~>1+8Rewt<=FVc zpD4kryg%;moBg=X^HO~E~ofETU+!|HwAxp9d1UI z|D?J|j`}=`$J442ke=l@0Om*&GzcWTpXU+>4p{l9{vBDy41e!n9sARG7lH&DTu+${ z_=hAMBBBIxf>Z=!?EXTNm%EKj*ccu92>&yTiX`ykMy>>F#PYrVp+Odnsmoi7HBl#d zqqI?4g_ADC+1J(tX3EB{sX`~IM%&jIS^T}+g2o9{#VAZp^WDA#F@z!}C?zg$3W?>c ze*+xc#z7;?TFkk@!k2h52>iBT7d*a@iJkbcx0}DLOo`D^i3EhZ5;Tufb5qX;7)px1 zf6`)(<#lGz)iTDhjh+7>;Q8tly$$VAa~H>&$u45P$60(_Zb0|6zBIx8pam8L_uS(4 z;s=U%MoHS{w}TuhvB5u*xf`xG%^O(%HI2_5lQ~*ZC*!Sf;R+H;e+828Uj4@437nP| z%z_PZiBJkxYkB|761>`VGnq6C>uVCml_k;|9a|kWX(s-}oN~70%UPdoYbhPp#o<`N zhxPrj34_`kt4Uv{?Wpir##xsK%qyhfR+r`uW%KriOdc$bQQ@wGBUF7)Leb7gUq5_4 zFJK)1NfofA@IJ9ip{3<>)4pEG6!X9VvtE6B-p6&22W+xdsGoHBr*Ibb36N*#l$!;z zq&WW(ias2;t1k~IfMxPSf)D>|QkbDo4tuN#CJw@T`P9~38DCGiUpo8dgZ%{{(sL1lZ8t{W3j=KInG0r0=}Ok8vdhJkrpF4IrVO9K=yuHWQA*aSOkS>$RSED9-<-fhS5cA zXk9!XTD@U6X1SVBn`g8!Nuh97HaWNIq_DZY8+m(DjVGurU>gE7{EWaDXf((B55>-o zac!p^b72d1VQa9@z+kFl>otQV{c^hO^w#6AeC3k?Ec7i)5DKthj1tV!Aq%*sn@3$p&5Sp{)ji$o?7d*3 z%&u5Ws1I)4S}FEtFJnO`q=M@EQx3^f)L?~BMAyGFPFXp*7SNxPz+kW?D8P8lUycu z)pb!I+XDubkB&G$l-C!Z0|$1`4njiGl6pWLmRRk#I&-==8s8XAnKIA@4q51zBoo?D z3-=o^=W(TShfI?&<|UIBP#O6`CY1xCD=~{o5_4<>P}GS_9uBcJ(8;heQVs+$g|HBRAK%PV^Kc!UaTUQDk z`xT-q?mo@bPq+be+p@`317f~k;PI(OX4d*9II<(pG>gls1ZyyuG24g|n4B~P_h!F+ zseOe(eBM#x%6Ss&G2E;C-^m8eUX>l@8auF5AhLI9lz%{QrNs!NPF!-!;7#4=CZKfm zkE}5*p4)*K1b@k8Rh^z+aHofpx&!J~K$Ph`1)~B*Ae$z?8Cq0=9gQCsTmu!iM)^Av zA*=?tp5sRv@0?Q2?AZxYC!v0{wt_8k>qYm-<7|WzZfGl7#8EUB4wEm}w&#(g)R5&e zS65Z2X+xtx$!}W1RLsCgVc2@-8oNj!uuMtrS99;W9iVl2)LX>Sd;N?o=PAtOaI@o) zrJB{26Lc)E9;=wZRij=5guM;ye&aj&*`xWyC{ho%b55K#eES`vpyI zS~9Huvump+;N<(iqc=|pC7ud^7}Lr*vR!iA>J(hu0+AVf(Ju?i_C*NY65zI?KUrlf z=2$y@KACJ##iU<*A@_fQv1}5LO^uj;IGZyx&tpJi#>RCUJsuC*qG;U6OWOfc%NG~! z2xFxkWV;Otm;a?5wew6KCn>!^Q!`1<>dBE1 zN55_P{NO9UjB$}Xg4FH_lAzP}rc#V3Og}z-d7gNsVtDa{gx`y>Fgl+qT<2!_`t>4J z+#ff(@QCH#n(uZ_c=vO)X{C`#_$6Ms28}kDqlm^94B687B=fW{Qwo3BQ~SJav_9mB zZ||iLiKyx-oOo5+gMKE4h^{>k1vmrN7^}+z9VQWmm8ln(9yv>d!c_CAorlb1$?5D;#WLFVNoyIc%5^q_N>m;~wROzz^!R;v!Q zn7lXG1fnnWUH(OusRSf)+Mm}E{^P4>*isF{@9%d!MG^!F%N%2pZN~b({!kANWZub> zdf$U{7XJ0&2}#5;>NTmpD?XB(n4XoK4R$s){z+GDqK(aRi@epnf(~`b1`{PI$*;!)2WNHO|yCX2|C69!2HfJ#ei;|pVZ`0h<-b6;%|eBVjMNbmTd8I6lm2)!bh@(g*hOnW`AG8>v){dR>f zEu_qt4Bi`^pCfU|`gX@ii>CECbak9nb!ncsr_aTiKFgGA7T1vvI2d81Ap;)h4r^c9 zXou=Le*dN@ydV1E$PUtYt#*~=DU)Acb8A6r0HPfl7@mG2M2=QJ4?)E7^5#dtr=?J{ z|I4ZM#*K z-4?sV$%IC3x{-bDQFC*Gpfqwcjq}{=%Df1EWW+Et2#Y7AmluGgIJE2{^I(>f9WJ?& z5#N|=dP~V`g*rNvkm~6PaAm1%6+Be{g-=^-+he^AhQ@wJZg&3;+Ya4u%G+=_3wfT2 zAeV}`97bmtQ@%>?Ef3x!`^}5r_yZ`e>0Gurgc6C|M&LsG-$d2H3oOHs+Er4rFx+OB z@}KC{{{X+A&Oi{~qm_Mh-n9x=xb}%3XH;9dB8T{-RH?RK zLM`oyjnN&)kFa0BYW>lskC?3F1EZ>ekUBaH1}u5Q%-HHX#B3Hv)ROOpp^OuL+oNQT zgkO%m)Yl5pATG_;G42>=bXds)HshNO7}-V450@ZlH4NW$>>g@V&saKzg$6b>f^H;1 zOS~wD4K)poai|@H%=Kfl4Aw)ZY(S+bLe-h*DdozAn2iY6-^HopD09Ts?KwA80?5`F z(f;tGKKfJ|Bi<-Oa~mYFh;CCZta#=#%P#~hNOtqr2y8l}lOtxAhQL2wfhvBGX_RxW zkeF9g5Nx;90tN=UWL_)b(0LX5%Vd{uI@Kmd^^e--ns$-%x=?;RdFeNe!S!AET8;#2 zD(qd<-pfY`e+N4?B()8)#R$I^c!hRm2CW=k$2n@|L)Ky0m>tac=>6f_COj8PrN+1ZG{-? zD+KuCfbTE>PrMH3YQpd#W$5(n2ESrvC6FIwq2;T+5~?6~cSlsMBbzb4dqX3tEMGQ9 z+5oh@iZKc+y4GiP^HM`^n%FWz&!Yn9`e}8c37{Wkx{^p-jL+=*jvz$2V!3X$MR6R@ z`-(R_u~TrPtQGT66?MqfE)iu6-Pu9}{KF(9ZHVz%Jxjn_Ru5Xon$Zh1jW?*MtX8;~ zsgp=eo3kHZmRQgTX+t;7@@;cz8GYev=uDqej7kfyYb$0(IKI&KGw{w{{FQECi>)KV zg~b6(yjhU6WAYV)4-80_8Io4y8v&0o9YNjYg5VFFi;vo2r zH_eCSP1&Bhsj>MrSGf;f+_1nEu`T%rS|l-s?&gUsIZBmZ0-ddr`-(E;Qad*xdF1v z0*jxHEMuM2_;VuUsPmy7rFGrMOGcI-JIKxdggZkIo1Mh$3YWs(@nV&fF3ZtR)%^AX z)aF`Qi(DoUiq;9wWof}W5PlGbn_JFCgA}MMX6RH=ZiFLyxMh_ks%=A3Mzq1U&Rrb6 zd%@N-h?BmdXiZdp{pl<`N@ft$Z4qmx^uGVvuNi5!l00irHfe3M}&v&EX!B6 zWU8f~#*NQe;bAwSBYT|gsf`4D=#U^VoaOTJp=x%j(g>vL-1LFvF+RQ?$2w3$7? zTxGN}^Phq#?Qd=;v5IczZaX3EEZqy2C}wx2iL;$G*B@wk5F@n$xv?gE#N1DG7H7eV z`R*p`E2UHWObr->F5aj5tj5C~>??r; z(*&kTa-K?Z`CKMGR{IkB>we&+m_p7^Mu@I`y@q#mn52(Im!+b|G&#~s-6kGt+_}N1 z(+XNw?skPO^s6{b=_MGHrmF}-*(`$E_-PT50m83Yc5 zlgpiYNlQU}FVEJ9%L+43Kz8qCS&B{L}cq(-FTi+A#HXQs^KnVfOg#?e!J0ODEdMHgg~tIzNKPDjpdL^lf_%17xSIs}BZXXax|9AHK-k+q<|bH^qFN zU{bpsJL5~KL&EVBcH$RD_@OxF$!Aks`lB}w!vt%R_8+yVxnN$w@VR@7Px2bRE!*x> ztZA&d9k!B+i@)kNh-q~GIHCG#see`(dW0BI?<>JLej0HsD9T0?QH^9MJ5KWLe(LS; zvPDy(8_#9X!UwVq-@5LXyNTxuq|yLvMEGmPNp&E2nAJJlYBTkrf_#_z7S3TYzNXRhS z2|-1iM~T*}m*H4~cycIPG*9SLz9vK3;y-2H4IySArA*)K>{181UVwoPz6D<5x+9A1 zmXOtCJi!PXZ~-24F*&1@D9urI5sGb#Dqa)+{OzQbMwSS|?o6BE7EC*1C$vIGHp&rx zW#=3}4hjw2j=pbtxu(a|KCCf*CuLixwOxYluXNR2e@?V$l8oV4^i4PTo*85Pjaxv& z_9QklnRdfvp`xfhOWs>VTADK3SvX_L-1$qgeq>rfLM(1--bGU(6DMkJ|8-IuB-(VbW|N?G9#7A?XgBL8 zd330rNBwoP?vM$})`oAg3%9y6*aXV(FK&E+oeZnpoYb@(nGJu(n(wNd8V$^% zw?!L>qn)G8VtZ!|-c$)NhL0-gomg~wGBi3kd-&CkAU<$XuO=oNj$R;O5(f-)wRr4V zB=7L8!V@?g#-@qYg6Qe z5KU_vbhj{9W&-b@WZHgvw|2`16wD$LmFE3XdQg>zvbLq5a+V5BFX&JIR(s^qvF^eq z1uVCyqq38c#jjGsZsWaKEU_@8oci7!-R3%Ek~Ob5csulau~yNtil{YR=+#do+W!@D z;mfK`{3Sj+&ty-=1T((PcKzng0NbT%BrAXW0Lh}yyWDMU^I@Jz-TwxSV!{c(Rw10v z7&sX5AA5SWh_lB3zD#F@-RdSQ&#F&mQqG25rRjb6MOGWhtkMRCd_S#NHMAy`8eEiR zZlz@3)oWdmSB0Ovsx_2@xrenEFg18-KsfhCBK=1kFqiqF@WuA}Rj*PAW%nsW1(VJP zq(4g;4dhQpo9S!n>PrQrOTdBDS~arKgcckta<$v_}|=>;At zGZx(+*e+%}*$`_>m_Xm?i!)!OZ0*e&^UCgJ_ea)tw6pNWA|0Tef>{H+*K&duk*dDog?Hw!5#Y~GsiG{;Z^-8$Z5`h zdp|I>c08I9Lny9tpQ1{pbL=Tw|L;M%{yU~6o2+B$Z3)Qt`qjNy6|LqR-=OQB=qFb&$+pBvO0$ zUA6Gvvs5zYXEW>?rOFn?!LR-`E`6wBm>ah)msC%mN4kTV*>dEzvEdolH6%ZQXJC50 z)AZlg^kHxhlA~);vS^a9l=8xQUQ*2pT~>kz6Tw(uH}kFkID5SQ{nmX)svLwy+pM8z) zv23+aMd>h$#rUq8nHK$ytyt-F6Hpr_zFR6Nlp;Ft2Xo+H&8}!&lQi#=e-zO4IubGK z)l)%VT4HSc=R1wXWNW%B02wp=??@6U#T@W8e!P4@l8}ErCpWQRnKK4IwKGSvO@S_g zYeaXGfFhE#@yEY=iM^FJe{yWf3m+o4QfUWY*qSGQ_UM?&+fLnrN<-MYPHF; z=i7`l>X6y+0JL+_uDv(i%oj+DX8*Z$MN5@Vh>7D;!g-460?QWq{UYd@b!Kyg9G8}+ zCJ1v8)ni6G&phu)Wm)Y3WBx+vljP0Aa8YyVFuY7uksRTB55^YRk!NfkxUS~wzh2T1 zbta^nq9@ME=&NUTxq7EyV}G%H@WEHsB3QsKi4N?OBgfOlzq%93m1C|;N9FF9BqG|{ z_)!wOs6}I)WAT@iXf|I)*v`}=OOa782l~Qvlk=%8%5HNFrcdFQ8nw6Z3Xt+6FtZk+ z^48r3jt0SI4zip0PL-kK&}w3L&YnQkOpQ{Lg`JN(=9#sd6sOX}p3P)nNTH8LjfY~% zsAO8a$X#Q_0FG6W&E!mu-Snc1<^Wyy{|t?lm0j4EFH;7R${M(?0}!g4Nv!IIcB&Yr zmS~T}QU|6QV7i8QzPf+4O#PB4?&NcDEC=ksmq!0Is{A zpZG!+ht)lvua)-phYnKc3DH{GE#yA+LS(Fm>Hs4a>D@`u? zjpBSq*mvC2D0CTG-@U03YWS5%lxlp86!7R!HOY+VHk4>zrBqxC zIo7`Lh!V<$twLI}i*7NZNcC_=KBYy5$ zMg6byDQ)y0O*UD8Kk|GMdy1c!{J!%mJ1nM02{_TX%4n(;kkTMg?t3Ot7{1;j*(;Dc znr|L2R$gb3UKYW|qi1)DJoKU0*mHBlNi$qZYApJOXYfD#I1=h}(K!rR1qpeHD|;8% z^Ko_paFki%I`WNmmJ1Gt4)`tEZkTGS)9j(P#@%&|qo24x^9j~Cz({^6-UHQ@d9tLh zQmQ(YbB#$`EVX{dfzisRFbLzPH&0(Q4V#FouM(`%{mYK`Q)h2zpw@wOtfrbuqshvcZvU3 z&x=pft=cwhpCls=E|>+FjhWi(ZRU>lB7<(X&yUF8h*YW9$P=#g; z2QlocgIAuFye>lfj&PIWuq~{4j`a5HODojhXmR!W=(votD06jM;czEtLSf{a;Nd~u`(tIK+mo=PE zA`HFnV@>Xl;PKP%#~*B8L={$E&*Y0h^Ef1V|Kl_Y8noV4X^s3zTn$sM|5#xlNX;^7$^{#$_~ZlaNbcYe3;&Ti3do^FM5WrUbd z?}9q5$82{`Z8vbuY6AD0p9*2dcrxtAXRpAlXyQmuR8Pt;{C`pxZP#-{cc@TQovU7! z(h`=+{O*|-$nt=75b2LuQcDY{%yarTRoYBBiEDb`Cz-+xt9jGtc>PyX1fDURv}rHw zO@6)8O%yLMHaKt#Hd-2RIP_+w%F^uTapA*8x3Rt6PzFC(m69syMAA6{3L*(tNi&m8 z`mh#o>(>bT{*}qI+9=%Kynj<7E5xD;oYYR1M4Ugm$unr#eckN|J#b^B%_=EiROC&A z32KPt^(ziTt*AV@lx_cEy%K18G^31qW^?&Nn-{TBzNezT0)OzJ6@BJ<5mM2!o6I8j z!H%J*^jVKp2-Q`4px9mAwhoGePU7cv>P^4_??#v&iD(g~$7TmLKdons^b-en8s(31g{{*wf+JKGh`tE2FfIj=U)@Oyc;c4RLS@mI-MMAU zUV_u^0f_!F%)|51LvzQvMzdeE ze%M@Vs6$jeB4?;G@+{pvU$mE7CwcyfxbkpmNPTX|RL-*pI7(b&saVT)OFo6~&$ujnuwHiN zsHAqLvxUFzua5`MBSd79Q>mW)S!yRjltRwH1CN^M-^2kdTatewM`^Zqtc(V*LhKx6 zkE-(2`xED#iTikVn22}#Ry`y%I(to@SE*0vAxhhYo2W)<_GjyiABcc`hQ~~MxW7mr zpDDH7O$F}N*S3`KHJdk5kUV14d;y6*D|`o>rpvsz#81DT`=3(Wtg-m$g3LF!r)i?w zi8I3?$d8gFa_7K9rb^GJ9b00jHRE-YR8m%bC975aR@$YOpK^`g*W2#BWbTihW$Apm z`aWHE?1M*0Xy4f-llA|AA+|@i!Co#dXnl>x0Do6rjg@-i(IWqDv6r}+zg+ECdSpiN zZReT<@jUZe1;A9QTTiS`gG|DICvzK?#??CUN9QgUDxOE)A>>GXr#MI4{1x+C)VAmR~vl( zwoiZm54XHI26R>57CizvhqkzoR|>&E_7X9VgjCt!0sDzOGCv zzG=T^WTrqF&HIp$$?I$9e>F_DZ(1g>_Yl58&==h4RjFtho$34`6SKCtL$nhb2hCU+ z^~ERwEzDx{K1!qBWGewU3v_s{IW8QK+o8$A;I^NUZPyPQ3Ix-lVPmyyZ|g|$`NIqZ zM)7x+m%XsWvvw6x%hG08B@x-^{_T+_e}5m+Gq_U~SEGSrQ-x$9c?i@o?-KLlP4yOv z9y@)sk`VBZW9TbA4&d)L`qbffhikgj7=$gw)CY>r;u06creSHX#T7+RFbM?js0dmZ z?dpFD*>Sl$%(&rLZXmDGNIhKU%g^xSZ62Mvvk~qeJ0*N`U)1|qH#ps28hDoG-Q9s> z0_5HVt=3P&a7Xa+8qE^N*rN*|v>}vvLy=v)8if{E+wSYe2S5xksy|=@XdqNt1M`$# z_vdmqYl}?)EuHvt%~1M?jm5++=ECCzar5mQwPR4+M-Vg8Qs2lcslxbb*5%jBS*ogqK;K*e)($TV#ftfd`fF(V9_D z+4nAT*-JHErVo~L1x|fd8{$$T?enBWF2u@XG|&4)UKPHw4SiR3gS{5n_JPjp0rVEw zw^>LY2hZh;7Z1Vc__}HcCQ(+C=ZIC3C!=3QNuFQ2>L#$>cy#{U1}E>Mf3%)buopq| z#v^2A5!K@b`j5x477uakc8=DGLD{gUp8$J{1N2()X@~4p^x~KjZN*xj_|MP@_BDhy z#8**r@A|XsltYFVJn=APMlg|cNv0U<86h#h`4uQg-Kcl(O{obU($RbI*$U%_!|;`5 zzzQ2ktjR2qClO&JCG!HN;?QO_5#rEy$JAMD=N`j*$j@fQI%d<9? z3%<7d@1*iy-AW~tu321b`8|OmT50>s>6denx&##OtwVc~Rkj<8vi+c=$}Vp{(!<40 z&WFF@Wpv1sN|MH-(i4lJ=PIags|RV+X?#PAwZ0(6ZWs9Cz6C^7Z)n^Bauu{QKX|tP z!en5N28mtAY!I5_Y?Lvg)kHeDi!18#lT_0)+{SC<8pIHO7(2m`qkKKVPz@y*&xSx_ zt=@VYJEg~7dUuSX%`X!X;?Hbvux?;c9b~bJeFhAW@ zc7EPlO+^3RToaxVCVN+tZhYfqvk8GH*-|C+x0J2eTM`!+wokfY6EN=r(j1lm?4)9w zgf$0OM8ylxa!Iotz+}?PJ{!!&ZJou-&c}iFbZPe8;icO-`yazc5N||oSWModEB(8} z6O0Gz>KHTkC>DI@K@m%+EAl7aX?2J83q9DWZu__+o6GAoNKg;*tB=J~2*gMelPZF339ZL@vR3y-`phna;FbP-2;s&{Gi&7;dqSCKmC9e}pTNANyy`66@wPv`rnjlfZWkbXtXn5sSI?~@_$9ui zzUjnh zyNopB&5kj&_rtV|JBf9f8%b+Fg4?*THhf)1PYSH|*yrlK-8tIr9K_;3L69HS?pz3F zkBPq{jXcB$HS}&5LA!I&$9=d#j{HHSwv7KiJbBY=+R7U~trb1vFRxfv z2ADTv)KmjYpB~!0k!WN?DdJnn8zepD2w5mR)Dy@S4{6y|+P5uybk-oF;gTP3i?xHe z$+#s9&vU>3%L>Hk#a<6@X&?wU3Xz9fMhy?rCiqW%^29$CCa+x|(< z??|5e;>Ew;|L!9nkcsH3^K!*v=8N#0c(ac^^nLW_z>sgJh3)URQA6?!n)A9^8O0B` zzCEVuc6lkqlRL+}*7|tPK}Ne4O?i)DY(vebh$R^qP=Hk<`zd_z;lFd<;2vDwuM>YP z25&3|_+`XNu{p!W?0CC(P%L=Yc?5ao->?LB#$0^^@fY;Eq2UHH~9_L;73MzwZXjo)@I|H({z-f)P=9fK&OZxU$5`zV^ogKIkn*JFFioAc48;}rw34JNOjf7j@ z6$ab5oSN2~2g*vg(kf%B^~}x)tPslFUrs(Nadb^VM8V#4NogeyiaFv_3hB;aZUWqv z>ESK0aAgD&*lvh{+*B2e>(uNjNjBw;f3gl=GZd95c!0A7d2EoH_NwiBKh$a*` zMWoe#J`Jz;X};P*jjyk?(cm8H^iKHI#&U7xn-{o_kso9iU`|}>xUZ1GoVARaHbsNw z>R=)7WPbsoG4Ai_`c_S?oLyPJe-VCD1 z)_f4sjF4|*97KzfJ^79l?evkeolLP0t}|DpQD(v<8L?8LT8t#tA6V6O(#tu0lZP~- z%h4|8%rD?XgSNb&c!-kI(ObDNGu>SXV2 zY{nB~;`M&$wOtLe@c&Avqc4jG_+Y&1Wt!H9Lpd=`m4X7vy`D#E)Mm) z9bSaVAo$f#P56aVL~ZWG>}bc6hU@?pFeg(F6H|sb_&KbvtPZQ&9U!mBmv4lHX27Tq za;QsI2UBmn(1I{Jd0T#=AR5hG2k+*7 zWdVR&gVP~)WJOQlAkLqd&AY)aRd|W$Gq*G^D{+mTU5s6C^)XfJUMkMXhOvw#pnYak z8yu$7Ni}1`Cg&_N$+94Ay)eQLM@v6<7GUylQc||9Z^_g(r?7M!xgcQOB8^spMqIBV zzy+JcLn&gIN%rj6iogm*OXf7YGsYWJS3jDV{EQj^B0ma*Z%v&kmz;kSjcEXnTaSy& zjKgBq@Rh6at`z;$a3ZACO&`o!z^i&GpaJ2@&Dcgg@Km)_hr0L!dg=Gmt2nZ8CagZ}xxq z$QfjzB+foLGGUZqVsTPJH6?HOYdDO?_?!MiaPp4+u8Z8G;@cy~Dl1IIz-?U*T^{){ zN$QdV;|x#wdx+z_-Nr{9M8SgkvDcIsI{OX1k;4g9qF#31L%edJPDZsuoc?_YWUhcQCFU_5B~8;{TDnfBJ@_y+q7RlBCNkxcndX zzOpHfs9P5ZGBDWS?(PsQ!QFLmhu{({mWT^qTTH& z@v#A~MCOd;_dE{N9fH~RVpNIHhd0!>rT-8U;sMnClpGTAR3y@wPYH!u4(~t3Ha8vz z^i*zsI6s)kRO|WtW!ft*ChGn7SiG~@%AFc^8VAK~&3nM4TJi{R}$Sd9n9 zy`edewz!x-Hhpd~y=J-cz1W}`2>u%EPT{>3^jehRknF=-!#y?ZBj~@P{=2DvodoU+ zjSfU|`Mt{L;O^$OlR5zS(#tpRo zRa- z7+*~0%8JE0U;1X+vNINuM8_^RdM7m4&GPYUErZwEK=QCNHT8?upmXUm|2|WoU&gB4 z93iPSDO~O=v+Ix$?$i*AnV9;}fVOA!@(8BYK|MyEbvw=@3FrF`I@d1tuocqtnALM+ z%heBxbM$q8zZ($Qe}v5_BMyq^BOds%SX(VaICA^~1I#u{EmTQiurlirW;Nt>hQNN@ zu=ZTBLZnn9FL$b)7o8IYrA76t&l|>oYOyjKu`FP4WrDd4MvF8Rq9C`r{9x^$52;+n zGy0i2HkG0`RJ9?!L(h(Kw&5Xx?a-f0Cf{{ZfD9FCw|~&K=dBnLl!lG8yP{o?bZ_rJ zcm3T@6&eeJXQhDO$0#`K5bJ)uQLNoNtVB1NFEFjYx>rNg8`f|{K{scQ7>&z{>v1Pe zpE0F&c1+}61md(stXKPkQ5dtcBNb$4z~|S%!R1x3nfht6Bd=Y|h=OkeM6B=M*Q&9D zh}7^PXe{QN&7n%T-QvI2(uQX>m^lg*$0FDC=oXBQ_ANkPd03_C&ay(9oN}g{ny9k^&PDlcSuY7DEK3 zii|vf>Crr5{h7g%*x)~br_RMMMVWln(vyngG`DS}A)<~XNNm)%SLGex|4I_{5yDrTe6#dmM5x3J95SE9g1zetw}XPJ{J4AMOIFdd{D_zcDr~ zK!Q4d*)IXL#}4ZN(NIyEcF&_OibDXT9eF*wY&!KR8cd zF?e)s9!JP&cKM+90CN%fL-$9uT3?BoW*d86M2IjBXd7di88LAsaSkXw^&F;`vRKB^&tf>J9v zOM6P|f_2uC`Wt?8f%M%v3hIeJ>QjT*b3@uDMMZ-%+MjvEcD{V4%D2#SK7Xt|&BwO9 z=XcIIg9N`gs3n?d{+7h1W!u+4H|fGTauNNW53}g_iCy6vHKTVAiSMU*Ol~W5xtSIw zpd1vjTzrJ-1Ss2{(q7;2(D6f4!7KphoAW;#=f1zo0{RlkpqT0LNKok zgH8Xl!4(t5bpLa$yiG+Tthtm^Mao&0!-C_aT+WaBqs~GNRop8#oI!qJ=#>+i3dXVQ z#BfWJwDK?=)xTxm3d;>MYYmXO$%C99!ksVZIYP#(Qr>UYPbci& zd~f=?H7MoowfK#{iJT4(hBV? z8@CN=aAV#lza_>*FhslyV5zSz6-fc9FE}QLiA$9*LXQdL*7bSr1!ubnEp@|is@6Bs z&3F9gTZ#i}4p{RlxHvg*T9O??0!e;1yM#Px!-LOAd(np3Pjq@OkSh9#4@{g0kvc80m2$8#`LKe4+weP<)NvZa>AaYV1ssn4gQ-PvclkW)Qjq z5pTy5s??k0S^F!5^Rvox3ac@R>Dk1fJ3w1M#20^43Zep;J%tldJI>6~tIc^icQ1$3 z0s~~c4FT{GBR?>u#KP~~B!O|JU?ae=I#d(8M_)sqxsUcZDijjV;9Q~aP9{>7xDb*9 zw-lv@^A_H7LUv?=$BQO3x?sfgpw0$<*8-PF_;;n%yV7v?CaXLlsbzxd^MA@K*^3$< z-YSq9F2+-fFQ)~IYI)z>kVsKoK0=sAb?ITY$XxHk_p?d)u^n|h`{8}2Kc2dWw?}9F>e~!B2;$iMKuL?B z_r@DJe23hJ4!Tl4eUyR#E;Ol3ThCFjz))-$|2QBe1rt6|(khQ2VA~v0{kOl&xEBBa zX#r4iugqeLM~J5p(yp$&&>H&YC2V6MP;-&)mv`X$t!D&3eY`fkYslT(38IQwGr&u5yH$1*?O&C*(=9T$6%(7dJAr@Z0b=O-i5XX4cb`iHj|JiTNP&yIwlHst* zv~oG5yu&ZVcm=l>0BU4ZG}-rUi$xvh;|r{a66qh0=QuI@=Vm9MxzXL_POXFJ(}QY} zNJBhf@%6(wxk%M3?uNFI(-A^c;&BXdrj;Zb=2I=m*9#gw{zh?k)O%w`LwdbVN5IAY zq$1R+{>-P5H*Bf!;vdM&P#Xt@r<`yfG2BSGH;At~K#CORn@bD28_tZY(j z4S|8IgS{#WQm(9JikspUkb4;T?~tq`%-9t~fMfD8rjUB^>nuIL<7S5GiN^Y zX_Gh^DN766mv{S)s1Od_u*gYEpme36ggO;8kmWFWN>wXk)~&r>c)3vcr+9gK$}ee~ z-yoyX>hL((zRcQA@F41!W*f^Oe;B**cPot@#R|9crT3;6!Gt$hx}14M;~%umrDM~7 zzt^~Q_0~F5;CJ6m9HjpB-gSh^d(hpgU0x@$hbuZq|70l45F!zKXk@i}7#)i^N3DaMdG4@bi(YW?Se-4wh!jSa-nphK8?dw!yn`Vt)xw^##?2n z6u^x*1aPZ(AvDfwRr)VF{6YtxS>S`sgoCiTq%Wc}zI8GZbbWA9v6>8EP!IMoR}mfz zb*hl&fmulVq{+wA5SdelxJNbTuDD3WA8BX$k6MnzgRawxm{i|AB1Fs7nMpg-JO$GjU&tW8W$m&VaXj|%Dy80{8q|Avj{X9q z6Dw9VtMo{UXeR>H&hxFLjF~NUuF;p$?P4qCDlQdJJculD9C?xAJa?g5cwTeI#?$t! z>cE8UgzEVAa%eB_e+?%?1yGi1^d@T;jFJF;iIV+t0OWZtI1EEVX*C)P?A@@a#v6&J zR$P6Ef6q9dDtDC^5uu=_Ll^d-W!ecjQ)-`(Tw_NdT%IIO2(=ba)(p_l&k%@NmcG{O zg2R!!CI`YWb9c-1lRQq^vZV1buqw+ zfNRCAcu+!NM~C{h6{^^!ao-AB3iEc%`kZDa<1xe;haSdD2ljVh18Nk^8Hs&uJ=-J0 zs0n$VCTJuT-UFoAz2azpU9(thMR-|1w|NpZi>H@UMexzhR52fWVQxD$c3zM&o`wXO6-uX!i=q4k0mnQuo{|!! z^#E~{ZvB&wdA8{!4tH2R!aV(%G14MFQWTMOMVualP^?)w$qEK}zEA`==j>br4|7``GvIr{{B3EpKt#~;in$?np zl2ih3?jZ)`7(Ha5wJF>HCE}SVLRwegd4T2aB?r}3-U>^{M)}|6g2MCCmWuS9p(cb< z-A+6{zPdS2LdkX@2j0%UOps1a2Leb$#SiO-&-9w_uT4k*Dd$-A_qnckGp;J}gIJ^1 zw!1_xkzTM`zEE5`oTSNSk2sC;{Z+u*seHDdBBvcm=)`u+9aAcHgtC7JGyEQVaS?Dp zkzEVB1LwdeV-adp(5Mi+1qP5)AzLQ@+z2<0NO}|rTRIF|VZ%IPm|9#@O)x_#TpHAp+hZNec9aq$iZ`#OiSZ^3{s_TNx3ZLXOLJMn8ya5A>VfWUr~d z*XApSIYKiE`~V_$dR0Q?fcMd%3mmq_BBsCb=K)=zzr2Tm1w$B=aKp6;@A+u%8Ga5*nd@H#9SWU zrCIl?~N$f{RNCa`=eg@ zH*KrSfR9PfKD)Ck7CnQIGSKNT=@-vhPvo2>1W6pg^5qz< zixQ*772Xq%i0RLiHMUI}sG;E$lh5^A)1Rv+6*N8sDJS5DFmfvIuUqT!D?nHj9-C#O zg+A^HeI(y@JmwpjY_=J+07dz96H1L_lZSf9*(xP+oQEeSwyKZ2q8iDw#W_Nf!W_|< zA2-UYP}R_P<7{`{8>}yFR-`$ozD+ zxXAJLOa8(p>+Oh<>t4XjRy7)+ck}#4!2NsSNfK>2>VWP;-n~!WfftLkjOOCs9-R#` zTP#dvJ5B1Ne_S`O#ReN>PnVZ<4h-L}(`ulC0o$`zkm<{i>1hiemk+h+m&ycAA9F5N zWI3tx1T?iT2yEj)i?i5m(cQ4G<(W6e@tS(FX9(0dlce-N1CN{~SGF!Qb8*)TY$v_)P1{kON9+KX<5&TckrG8rxq{rLI3C$D&umeHC? z^~-8Bb3=yY@;3A(0r!jia;Yo#H<2XpAJ0l`)ulSCRF%A<(;!P10v^SZe;Gq>u!MV& zQXVV}ty>1?EM_*V)CuG@2TKh#7l$}4B*r*LK1qwy#-BLFvxNi~+M@Qt6vHEnX6d(x zo&2>aWQI-iv|TR9zr<;I&!J`4T8vbQ**vf0{aK+aZ;(RnJCAjkunXy}!)^`x78Q%X z^U#G0D3kLKzhgFSxU17{rU)7T<+D8p zpTh2a6yy<*6aHqwih9O*cu3-jf$I-5Qdn&ZeMm`ESEbsoI>}FevzGTY+I=(^!#H`2 z9s*WVw=iq_4Iwc7y==lf`_4qGg?{#+4spcTDw)cl@z1O6_Yoj2Nwlr26}VgiV=cE? z>CZ{KKb405z3jYJ0R7nyz68xql>*2DR$i*6pV+2NA3n3_A3DPfD;w>5E=hZ~tvHG9 z+CIt%ANjp^W8(S^|8JhHW7hQHYpG3{pp4|)1z2<+Y;sqhc5B7bV-JddwdCYtqC19F zF9K9f66{H@V~_q_-@wEheu$Ebz-pGt3Fc_jaBII_)zp6HQIyXSzH=a~iIpjq)YW$9 z+E< zTz&?{|GYkIK>~zpEfIpNU9bO~67Dq&H=~U8-`5Nqjtm&&Q$YcIycGJ+DdAqjaJEpC z|6Vz4xY)2>VePoEmk09yoH7s=#)9LW|If9LyuNRaNCv!M{^yk9urLZ-=Fxwy{R1_Z z+K&&^Vgdg-B_Hgnj@;~zQ|L4iXOPEUxmW+Rk zZ^6`vzP!C|EEW0fxlBsh65hM@#lbt~hRQ`3J3Yil*NlQumjagRO&;kxeGn?~&LY+) z8FwM(AfY~@4SV5dW%Bi@YGfA*$oQwbpxTfF9I2m^7aVz`KT?dA&x&0t1ve{l=)Y9P zdhYxbFuL@xz+0y#`$e3iMrW-rdzR*=O?2}Wr zQ%b{aK4WX8O>xuD^cZJR*9^zy+2{ALzGIq3TjZwI0n8rz&B0pYFVUXo=uMWtE2Uw} zNB3>5@jaYVhA{_{yKH)k$+9p5P%5w!Jp z+61;PDCiLgr|bHIBJ$D6`STjAQTXMEuj(JH<@PQwx@hevri?N5yU(Nl%XMPf-o*pv z`30sT@(xS{%@-aZBsl?49m5lo9O#ofy|&;tM$9;+{rlYW?|Gt^)_Axfe6haGvcl>i zqIy}h$M7#g_WaPasx|l63rwTUCNVvVDG`5|CN+nA=hc-?wdl+0ydLcYCfDXAIpuTN z%IR@hdochkq5c^6?;&oV)p~&bi%)Q0vnfmXs%F}0^LCUUYb~9#P{QU!p}8Bu>e@{D zen*Ux(tzUgt9I7HJ(BW}76kZdO?*69RBn(aB4Naod+Wn5TViIdfhqY0A(4!d*0~iP zuf1t3r;zl{2o_pj*$dDPo1Ap2Pcr#09|x~wFpx3qgvN)#1nJr;e4pbd0QBNE6l^)E zVK2|H{`OMIV?lqup?Q84pO{z1nwW4;@}VI_~8)^ z6~SaexGKY?0;go z`Fnlich}}~S6BhTzmuN7m4TbL#+x3djh41YDRjuQcqw#bfAmvJbC`e3IC?4*Cl2a= z>wDug>SPVlt^Uy!O+Sva)sAAvVw{oQ! zG-G)$)Z0S50c%`3(y5nhgQgQ!5=83?J93faE9mUBmdT{+>{;S-T&TV;v@;h7PX6S+_qB5&%yompbAgxZivTJ;AG(M z#E33Yudp6@rvAxGXz4-<*Y1PQ-Hde$v^UWJxTM+wTi2>!6Jg&8J6*!p^t;~ldGGm6$|}5$C4Qg3 z%^dOHwVpp~0zHqDn2(=wugMZ)Yry_qiQkl6blJhKHKsi^cm6kWUmE4{n)+SLUtsu; z^0n0%)uD@5wzTM;lxXNgm@5lZzs4^~-{U);0l1>wtFpmT(THwUbC8$rOF8am{UJ=Togan)&n=5lVUMZA32Q~oM~>A*51MZw|U^dF{1gjRmaAb67hhp*=LS8 z5*1prCJ)CUzlA8t;mP*XvNa!9+jKazHaD%LwS+q=^z4y0?fWjR;+>>1_-Ew&DZMcv zMT&ndwymOU&GqZoa)Z*V-r%vy%99C7#BX3P8fPC0lQG z9jHsmS(;FNc{UPu4FI%+Rp1=1@^s&k!mE@83#_TX6yi63K;Q=NMQ!3?I$T|$691*V zGp8g7XO%dS4EPN%Eo-Y0RNw{~NXrFpXtS3D3PDtftwCe7o~KWsxc+co@G+%2~VqehhUx)i_}<^E73G ziZj6I&tYOja*69H@w6fo$F32W!*1IZAms?tqOdjYU9)JspV{M*YU=GqT)#8 z7KXi53J*+Hu`6F_$P-Vr1}%Uzk@HuQl5nlZb{zx-><|I38qTO!>#eW93Q+OHl3ERpKNb>iJRkhz&sLx|m=rLWWfJ3Of0nVON zY0X(h1HID7P%+e_4!-lQN{NypQ)Nz9C$==_r5grtSt#!fvf^*+ogHm~<^ppoRzgch zn}7mh9!ED%<{2&$CiR?d=1f4}bNtJ-)XvXO5k`)g@;4AhPG6XyVjM>sROsMPt1wrq|Gh!L_fbWpgdC?tBj>3jXU zTbf>~{LbHwM0pA~cHHS8qKaNg%^(#!$=jz!f!2$65@zYZ8mHLC<%88yFLN$iod$Eg zqK#4+lfVH=CN4*v6;DR;5^&LCFR`@wCZ}U zRxBsaGJ)|39oIfy8S;W9qS*x=e06eNQQJsHV}moLlH*sXTL~2r+3hR_+>c}y1nY8JD|T7{lg)A3`P-`@DsFBrr5q5CuOGh(wVpU& zddN(VE1oc%Fl!rvt)eOAB3;64u+IC#;j$Ig&#vITO*}YpC_{ow4qKUHmR}&r9 zk0lt}8?*5OC0USfcw&(g9Kw|aZOpCO$#EJi*+LRJ=&#GJ=fCmGSgAZCBub#x=WWtA z1BQubZQpTr+p!{(@z@1{x|(CKgejt$Gjhy&P{WCY00CX9W*mg18^n&B8a84f?3Mc$ zQdqLWo@=DmNYi*Qt0{wRbH$)+b-S0SnD6EuejuI_FI+_b(R+vU1)SO|$yVybD6fdo+??$>Df59NB4hH12fyxxq<*02;zkP_M{Wx@sc7By3S7Gv&DpApi zO12sg-tjmb`RIoF@Qz0fld$_Waaa=Nd3wAit{=u7^P@Q~Vax0fFi51ym`*~DGX0z1 zT9u;4mER$&5_(M@#VK!EVnb9k`MiqBy*Ck=hz%mjfZbzMY7=#vUaPE3jevXwp3!gL zyt$7!{3aoNEue}>lBE^^A`@C5ExieRp^|cB!AB;8gjW6vof87a0jdne>eXWo?r}FV z>jqf??z)V^QRb{%B)<%raseR0886R|5h%Jo6v*M{)x5Q?Er>V1#4@^|j!Tp&(bZ|& zXUfGIsL9WY12k_9l$4e-+aF~xwpKtc;^ML*rz$m}G#0dW=#SF76xTb!wEoW4aOP+sXaC2!$u;6w}Ynbmnp&h33}XR+bL z334U5qRZl;V{>$H`kGWcgd`Mh)S>bmiw2NH6YqP#97D#Y2(1pj=@OxPB41pR-8fTD>zW%@o;=%_MwTas# zfyf539z-a|tOPr8KeT-si7F*hZ98e|hZCHUc7ye040*k+`ViPf>fGus^#b|3Z|gbg z!wdXw(IxeU-mv*FtxQA4ZcmoFmJwnK!Hz%BRU{NZdK&OS%qIX@7V82hkE$lwX#F4% zu4Nxk!9gE1c)=IyttmklIQ{H@zy1}A;Im#Yf6DLK;mYFc!i2WkjKbxj&S{E78fF%e z9zRfRjw6dJiR97tSIY3WV-1I@&KOr0+(3Ac8#&v|c&0lbYtC(TUbjk(Dv9+zlr zcoGsNHPu+hcMesJ3>I|ju?zZgtsBb=W67C7{2)hYiar94R{eTWp#k%ZRl&08jg**H zb~Ntr0wm9hY9Q2#y*qc=K3rL%8)IH1nUG}&oV`Om5jD9xfSQ>eu$D;eeEXY8VMssW z+F>!qw(WCiA}?O?t?^N53FEYAaP0wk|C;JI_8v zS1~lDikTmY0a$<>QBK1<9z0-W>|J`on^CX%5bv&i;tHXxVABI4LP=NgKUNC0c}A6^ z`^v0{ITE0QA2PY%n6yl)nEx*3Y^x?AWzm&KWJt_J%E_w2OYTZKiYTKxG`av*}>s^pex+y>DP?h;|bS$Cb@*qwp8=#A;W@uVo` z=YVQfyGyB51FFM5yeVFSjbYibi;ez6^##m{l^Uf@}m<^p#`mejVsaxX(`_)kr=NV$=IN9LQ>voht~|V zfd^e0@mS3*)F1Tj)*y)OkD-G(tQpbKT0S0=&v7eNs3s=L+c*09b+lEz9zg}D5upx? zH)Q5+vni+hmzOYC`Mq(C;HpSzTIgjKUmC$-^1Jq*<{X93vg=itJpECl85aBs%2x*b zw}o>+1#Nn@G-3Gi>UxJ!LT=en(!^vwChR>Ge026kG8qoOd}@dU8nHS2NdFiOA-cVL zIaMGu=TddEiO#ref?+})+HU;Qo*x~4aTF0xffwj&Jrrnq7Jk{#V~gO5eMF+EumSb> z*G3hDjz|%yAguKk=VSjkW@)N+{LIC^gK{dap%h2`8-?ywI_s8EIwLh}C$r}~q2tg2 z0`q$q=w+G@j}D)LoU*IH)(7;i(9ci>fiC06E-XW6J;uFJrqvWTOU2Rsqs6827UPL z4xOi-=g;-j0~Ht=rL<~wS zAWFsy&6$X3vX%z!x#4{Y}o;OOW8LHNiM%qA3P32EIj64OEE~eeIu+B(DHawbm60dGH~$2}6sEjaB>==PI2H%S#}VQ9naR&~S(vxCpzN^?LdGQV~F z%WSgI;jMxR{jR?ERrgo#IC^v?El8L%afIE&nxc_E;~JCg=#|kpz59SJS0!G5%D{Oy z3VG5>1!-v)yxVp=)KVti(GD9$)>h_ zDbGppSUtop;+vXo3fl@8H|{S2N7lY(JzWS$ER!ynMhJ?HQ61r7cNj+pNHj$ltST~* zjR%$L_kVX!kdG-Ip@;X2;Uvx1Hx*V-%LiuBf-?bOD2TisEc-)Hrw?Ce{5P(1ZNPQ3 z;a1=asBPF=T3D)9r50SeV8_OfPh~LXF9#3S$(p^u7!LB??c>}s9c=go)U;Z~yIJ0g zW$L_!nud?I@``9(bJC4pQembX0#<7-8ujp!frJ-0E~bTTtX^Ox>y>RS+Tl!mN6u~R zzz}-zfx)U_ki+1`SfYm>)hDy9Iwb#;)DY`TRHpCHFARA<@)e z-_1+fQ=2oU_v2yJzx0d@Nj?e=O=Qm59CfvCnL-`wd!e$?lK^G#?~*%;kYGG}=Z}eq zfQD(Fb*FJm!k-B(QKDzNqL?HPy`b8bZb|{4G+ekL%0IJ|9(PV~;;3cQ1dQO z=l0TsFcLjMqSdcF%g(4E+PdvEE`yP5Fp?rozo9D*?Zp_3c!EBM6IU=g-j6w=OfOVF zeDs!|wlm5!Zc$IlCJ#jB-d5BSi0&VTy}UlD%XCv}T_%Jy3V)U_IWX(dOm2;$3GZex z$)eDmP5bHJpZm)2!3*M}`3AS$q_R({bIAs{t`uwjUyV=&Iim-PHrPUZ@i&o913XZo z)U`z9Dt5zKZ)d8s1(JBBZ2>V5 zeb=32D*OT4vl)`Os>{ODC(-mYHf&6eE5poAf>P%0<$|zCXo{B527cQ&e&1YZxxPbZyrGZXn;0nt+^(sweAiUs^qJch z_4G!D-Wpn;+UI}em`g15hkVBt859H+07@wfzMaa9$6l25v@3vDU1sC5(p~O%LGxP) zPwJDbV3abpzd*G#Sq%+W27O`@X3i#${JgaKrtv}njjb>zMAj090z@@SB&5TK`cc(I zIkIPss5}1U&M+autZKrpC}r`&Nh<=-@0Xc$c*g8&i!66`shnl&;1++|1`NB6%3S=6 zJb-CC(Z4upsVV!ZT=3AxVSXhj>mnyPl}DM(3>O89{0KuA_24-~oS@M&Q+WC|b8<_%cGxvNz>RZiI@kR=;{-Ylxh3qIIp!6T%K!-bP{ zH)}OR3ny2tY3d?iZ-ov8qmBA^~$dLGIUBQn^D^ zpN}>p$thUj6&|GrHVi)VY%S3Ti@WOS*e1WD@ITcFyg_U9iew;a$UGic6C^(KS?2a}^H!E=)jK1Ne2CxeJlmt#NCJ87y1e zi%Dw>aSJ7q?4y$fs)Siw>}-wC)*?!A8o-6lS|bGx2c=WT`8wEGwc$D;z<2@$%?V7_ z=9IbCNE1!DNCs%-1;}DbQzw(lsd~L{6xyq zhx-+2$#L9wvMfK;8b_nh)Y)pC|1~6;YABHX5(T`g4fumc(DEL9GtN};erYsYxOm(U}d9fh}1AE;6B{9Y}KTz?%tZ*5{_yIWA zz+!HcEj`F*ET6tPj;)v6C}%h~b$`EymUItqZlhTLRHpqitX9@7F%sM`8K7Ug z7+K9R-_EF_t&M1>k!YERC3fK$xnrBH302Zf1?6?jB>Sl+%r52gkY0EUIJm~DsPVD* zSkD$aJ%4A)*f55SFX322gb)BRXE?H_qXNmC2$;TC23!OK!I!1s$`fD@Lu7OFDKlDjo^Lbbu{kZEc+98K7Tj zkSm14o$Re~)JH=rmj25aN?(&Egjjt34J9I8Cs64-7KR?2w@kPt##JNFSst~T%@Ataisw?EU0ohy!|02zdT6>OObLnjBDzZK;+c<`;hzadaomb$XM zL8n18!M9S3PZv(5_2FnHC_J(@UB(0nzhxo}m5x}^wH#DnuoT28;0!V5_7|mAOC$;z z2LefYXh7jQnQoRNT6dE>oWKVi6=0>+{5FeZqLU2dw}>DA=F2Yu(qJvE{@O(XP#+c8 zmsgIYpWn6LU7H_$$C*0VA|NWEE(9VTfO7O3ZU3FIfoJ!72bXF!Is@>kR2vx;JXSn)`cPR?_;RA%f}+X{iToD{##I`XmYA5ymTJJry%{3 z`N{>Oc=v=TVSK;ZDAV`o7CXgL%;0diG)(RWTR-I*cCsa5do4C~O45bR=se`7L!~fR zi#=u>YiW&P%TSfeEnNPI4r=r4@Y3+9Gj>QcipT6PCAC0;Ec-6^neIn8zV0mvxymh9 zo+veCGoGC(**STREFtN{(CS!qC1J2a;pA0+MA!iDLT1cVgg*kj>0|4oun=1ioPi2l zA~V<%UBMcST#RtAzH?ql(L3Lk9lZqs$q}YN&wstEq0Em2hg;`!Vu&YR5-}hT@ohBX zQG$k3QsETP!||xpjS)g)EbVxsIK0Hpr>sY@8A2A{PLW`mJ9F|6(b8taDt1I4MU#4G z`jP=MiTCSXl*R|6E!8-U(8YeK7%x>PEeHbDN&{_=`?>T7qp~4%lv=ozDWeVzy29JA zys`@!2PPcAOo|X<*;o6;iEvT}z_+^SveZGp3p1k~bjfJ0kUOIDsv}}%f4>t1-2VL9 z$pt2FH$uBOc)&Od4YXEKCf~Ig^O`yVsAZwz4sv~|zCb#b%Yjg@_JC===kP-M z-8R(slsM@_s7%Mg^~}ZiEY`g2G4q8UNN^d&zwHe(E!3xj7g64sxao4dquDKQKgDvz z2Q7bYG8(eXwdbxxGWjg}>wR4f0pC;xVz5b@K4J9zR}uqe*IZC+dwUVb*Yt{le8Jy8 zz6-$@85FhJ+PB+cAZ;NrtCkS__QZR$^u6(^a7QZS!*j^9tQnH(J>r2v z8-11kPTLE=N9Q|_YY;)L2Xz%{Q(5cV#-b-Y5JKGhFQ+{_C_;q3s^!A`Ub5RT&R6$zAl%{}=kvc6iesi5Ebd5HSo>Nhd#( z?(q1&;N-~m6*VpbP1kI=MT4HkOuvjSRWFpkwv5XO$F`B6klpP0adk!P5sOKAZH`jR zqR*}nNZ(!`U;oW*XzP@QA)HxLf$0;ykc}3M-B6q>nt2Uz}hQo3+17*1}f_`jm3ati!!h@L7jl%~=OxOZet*45>gr zb~FctUjx51KpGcJGqkz3%EoN~;Ghe}hKnlWFOLOF1!_6om)`QJ2%9B(=eqt1I%nSdk zqe@I5qG1ckb2*_xqX`kuzOG5V^#S(@DZ~=P8I<)nB7cWeI~-bc`RJC?o`^I+YZ@rC zw%jb?ptyWT5M3rIguvb>I?R?eK28I{$eq%PYK0Q?H8HE2TfO!AK0)FZq$WOK9%DHZ zNogF%nQQ5S9TqB&3}z+buMT^oI%F{V-mjIm3PhXTu~@h~1NBy8gD3OswW|JY@)h%| zFgNn{K?IS|{E?9|>lcthKr9bRVG+4;jK2OTt{C>5?N979ITpvVs+ z22mFIOu{2N6V$kyHG#S5Lvi76L?_0~YFeNLMeUyTlUuIP&iHAhezBlZ1YS=fcm()! zmcHH@SPMxVKZQ$=p!3hsC#bqMdjsCJgV+aO2Axg4>ok!W0LRUmEC>uo5TRmd>@CP+ zp##Q1kDPt~E!Gb5{uzOw;9}VhG*pxjlp8WFNJhoUtPH+WraUK}Ev_|^u2s%WHEpjI zPZ#v%@GCUy>zQu&N={rWU=;&^a&nxnzP7rUF^q}3yogRqrBCilmTI; zB3Ga-Nr-!Ad!Ez6z+0cc#N5dqR=v+tg-WRcs=Y+Xo%h9kJd7qiZF5XK=93xIOk+me z`@25-<~-auLi((1zAYK%ndxZ#Y`gfGu;WhH&fu!0m%y~s*%6Aaq=?a9K+ji#X3DLp zR?hS-k;YmvMfW|1Hit(=l(6`mRl~8Ya>)nqL-a2Ae4qtx!OG;SjIdxOUdvKquqiRk z*AF3lXnNI0YfvE&jA%}P_U*~!MY1Gfs{XW9c4FjF)2N?6bHU`aABDqYZ=w2!VSbpCy<8>Mfv*TsMyxPRli` z_^G6Ga9IKv*%Ze3YX>}QIT>+2Eeu55%H=mwYg!N| ze)IA)6LhP$G(`QvlaAIy*dl8FxgfKwv)yGmSs(JN1u?Q(o6AZsvvfri@`l}SGT~Bu zNr;cXLI8~rrY_e*Pt-4I1>x+XMnKSn3&wZf>6BNlOQj>`NBSW3gvv+kM<(TPe9*x5 z(`(cJ4>|9PCNwsV0n17LyUdG2f(_4&3m#N=grb$iRC_%nQ~hME(26rCNbR{ zNJnw(J1aSSYT*0Q$!4J+68=Xy5hxNz=elP&jmcikj41kyC-V1!hmMv`duijt%1mMW zxrZ$i3;YQ&N)=DUFk^IU?S5=AN?p}&UJ7b6Tt)p9hx42;&rCjxKBB&0>k5Aw$r^k$ ziJi~KAlwxF$N_a4GJG+19zjcSYL!{HAm{(n-d9Dn)&1L|ZIDtzgBDu6xI@w6?oN=Sa1#Q7Tk-|7N;!^#i4Nc{^yJ{?j85_K7RXg?={xL9&@iX_xjB_ ze|C|Pi*K-M0<95*VzmkxXOkhae#YxX;|$#UEV40DvV39gn@Q>kskMEnND}tM7jvc{ z!b7JM2t|=Xks0`(V|SaB0}j`L+LpQR`8cadiMkc|!i5@5e8)@k9R|uL#BNW49%27T zFjrE_-*}xjnowa*2b^>QkI<3IXg_nsimc1Y zlemM!GdA6$sp_)OntKXvtAEMIewNed? zep+_fb2LL%F^0`+99xiEP+osZ2_&4n-N_B66+jo8orbZZWfWY{kkc;h8Y*+wk{AO zAmWRdN_!f$UqAu4o{V)nM(>U^1Q#g?@x= z*C(|MVqFFWc{l5Cd})bI<;|B5?j##oKD|{~no)y<9E+g9%{nwUCXzdhzbvl(`*V!| z{eR3V`rwib^zUM^yy3ch)$#6wtF7?7WYU#v(Xt(+dB4tMYadD0?$UyF8C5*jw)q6e z9nYdBjF(%P!*Mv~bx41!Lm@_q7U@C9FSZXZ16&x9ICjUC1)f=|kJp}Ojq=Hp>o&hK zkVs626egg~}CU{jqE>q8riTGhrBly*o<*Q}acal{yol zm!iO2kmq5}K)#b&DNqEdNO~SZ(BBQ86g4tbX!Xn8Dju==UGtW2cXqt|mHeX-cHJ4( zNl*)o%!g(vfG}kUBG0|58Lv&ll(7xt8^`?K5rL&FEc7SX!p)Eiyl}qfp%TU=-@Ctu zfK@j@i|xo{C}i9zWideL$#Nyr#&$-jedb-fT0W+J+7VES&Bx=$A48uL0ADy7XBtpb zg?La6$#ZK-#8(b}bp3au+dgQz|7mQ#8Ygqm?Ru2f%g1ZdtMN-aeDo9Caepydz=Y}vcIT_ONaaJXSm~9y%g4}YNmlohz5eDhZVC|$Ef*vnA#0O9hq7f%0Pg! z11M3B35#u^N3Jfx{jW;mh!wa1x|?vYu2a9I$VO^KR6Q+gB77|gdUM{Un5dEWIE!S6@m)gB63h$Lg z%`6ok)I&dk!0Oc=!>z$^bC+Sy_t$dHbK8t~I1fi|*!e%`PK0`1F^ebvoPEg8s&||} z%B2&t=d;P^4rxR9aH$DC^g%41uXSngSZhPM41Ot|d|TlOusmp@4dhbf8!;0?D`S{H zD~$`qPq8bM(t(3)_WuOKH@ZuWz*X-WB^WlnPcap&5kUF;La*9~ZNtxg44~`>^OlQ> z=UJ+t)6g%DJ9sESV=7pMLo$0l)1ErLill$Xh#MBL;(rl}A%$aIhSGvp(>Fg!4JGe5 z3Ka(7<`1$5KbVubijYPCk4Hh(`Y*4CLjHq52hqwhkz$Q<>o_gJ%(pp??FbO_icHBv z3b(vzp{|=Ardk}2G3h%bODPp`2?i@QRm&PD9h&OOCq%Tkg$_hDr^kd@EQp^6c|sDL zw~?-w$QH#WCNuQx6>@=PTISsoi&_SAb>3N!G#@w+BUWsIgESJ(JHi|nzTVAP^(uef zAiYxR@I}uLDJ`r}z&wXCn`8JY3#H#`>pVK&)A1W+i(LhPnYf^fyP^VU^<)A|WItRv zNH7u7{>DjfQhm+!757S#$=37N&H!N?IV%H`{wtEU7uhh?Pok6(oq__S{mS$fp@A4? zSeH0fc_zZN%Z64*Z!gGl`0wN1Kgb{Aqf80Osn;hW_n%ffi7E_hU zXEirKf)JxRR>og0&t+9$tW1zYne#gq_Wl@-47-Ko(K$M)k|iHw0$d);B^oNvcSE< zYc!}TVt6|xR(STA+)f3qvZX~LNJPft#WAUZz?+S{WNyM)wVGT!F*n?{9;Cec6Xm?; z2(e)3aICr7jod=}(GjW(c;kbm_t51Alcs^Q*mNPGe0qP;Hs%`94sL;wYDTahz9C)a zA7@}TSEJlcT7jxvCG7@B#xQz$7TCK@wJnJ3`6l8&QcOO8^2YvJAG84TtEx=^ySzcJ zFKN&U)3#@k;ziWSRCf+tbd;b}0D_Y43i-NSS!qK2hCj5&`Dt+^VtEPZse7aW!5CR3 z*5vz-vV**iFLypu=kYS8XXz}#t8Z~Tgc8nrWa?9HgUN(8gFyp^5p8LcGr3~Ko7|HH<1~NsSpo!q?!%5QS7A#fHxPq@0ndJBUcC(*h zh*^1>gm+i1U0;8YFiEqQnk)wR@d{VlP7%kRvHo-$RtUW(7 zN;<%6?Zx9G92!`K=JZITU-gU@0*6-N%r5GjK?*Z% ziz`axwQLd62e)hl=?n^ef#(=Is){Eff+L`c2RE=*QtaHbAS3QzChJI1U3&88ZfcwAitCh(gJ+-t|R?dTz^-c;{yL(~&;wa{UPEcj(=ne1_C z{jyeVPf*x;=Xg3LTH>3}!GG_1z|n%@38=7%P)WZu9;B4dR0q)T}?i(QmPo&INJ|abDBOcQnw&vA^cSY1Do0$ zn=PQC1r~{Mp7TNB14~)Oe5IK#7C)%9kgd*#+bH2K=0;Jzt&*c1jqTr));jYbbps6znP^kzEY-`Cl)@6 z{UIJB_<(;0hcER&V})ZRw2|NUqtSxT3DvxvR#PdO8{@gcwH1Ju3}-_ynw5f0cuR>n zDdbaJN!CTUwSgz#fOwM|)GIJT&;vv%m~H|M5Ew<5ct%t`Sj0vcu+M&rlnTrIU3Cin zur6Bz!oIpN;fEX?t~X~KtHi5-Zo}gY64E9fFA~it)}}O)A}=8sLi8xPd>rA8fr~F- z`f0fT2L@R)2xA0q<%G5U+|Qn*{u57%Kid-Cj+`I4mD=f0*RGR}8Z|ti*L(m>T{@VG zxX-KhSLEq|JV*Ov>{|>7+}eETr^!upQVOC?55tp!LowIgtZS?FR~T-8x|W!5x!dVc z@6(O&Zf81HLS86mUt(i<)P(gMTzkQ@qp`lCuuZIUk(KAl_#GeFAnUmej%6K5fgSX- zZj7#9=TF+|dZx*}R8EXI$#*$rL$VXq-w9swQQgUW5q{zUy=d_ljgE(cN9V#RIu@;9 zxid$#OUE&9U^CDZ}8Zj zx2Hs2@6gLB9z|zq%OIU~97KnVem+hlO)~8rx}Y^GjLXH&Q1r!jP(HQ&IPR z4|F#?fQ$dR58t(U`PohVul_oL8aH9fWd(T)ySTYkVBq4kG*r=rPN3SvoKCw4@N8=7 zdD|B>rF1r-F64(EPNyreEP)(wdk$-0rJv7OPfE|kvZIaRNlhN59Su3^y95}s@7q)zxN1|@lhudA|k(&5^PN= zV(B=qsN84BEka7-7q6G5Z+pO_p19&EJYw%y9iR(x#KQLzrK8Nj7N2lir(oFHENd>$ zDaXQ&3F~L~jR3x3*I1)(j{lmAjXBddLgi!B8`b!d0|1kH2n%YCVi1~ zO(-$rD@W9`QZhq+D5tJp#7kx^67NH&)uZhEFV7TC`cm1{O~_|F1%qYKjj>3cp)$hM zZ#5Q!KwbqSqp5yg(9XNMQ)NH&%G)m&744=(t45LpsuBh?=Ww7`Nc)9lf3m z7qM}~pFGS@HnA)SB6xMD@0a1LeEd6y#{@ihMlH7pi$&6_JiOGgq%Obe#^+2-GLi1Q zxC-iT8=t?`csT4FwdtOzd-d|4wQW-Q>R{EM2lFTURF@axwPQV9@*<%vWp90 zU~Hqy9Wg$5g7!>4$U^auO@}s#ZHtz{yP3E||DET9fw2Ei_Jw%+Kv2(EIlOQW_T-Z; zdA3!NuoeC+wzlO?nATliZ~0}RtW=dovsr1|FDh?xQcOR-&7kjkNE%W;9ey+# zKVxAScPt#-A*G^FTt|#-V2dJa-geL1dcQvLtaRRv&P~M-I~2c!e%QHLTT9;8)Gm6k|q@GE=j z*P2dFF2ZXJokkaEbg-K{2p5`TESlHNa6Gf*3)wh4yr(6qq&Kuv$*)B$PViAoj?D?eV<5kAUNjNA%yY5dj1 z7<~D$I3NBOgKsf3g0=&YHtg5+syWam=5Jhus%Q{(0kaJ)Llaqs`%DqQisyCciub9c zY;FE992atmS6;12ey6>_JN2%jH6T0mQ5GPJW@;(M6=leK#TUg&5u(*>5Hw4vlx`Eb zf-^`P?#*WmJWoqxNES~dC-ugoH+uGp)F=o|Rni!(wYC(-E6;%nkspkuYgzzdm^)Ej z*J5YGcsrr3h6YMoraA5XTN426?L`9zuLvyK{K<&4FSK1<;1!fe(g;;FL z?-zUZ(C?}x62B?G;k_YY;e0B`=YV60tdy;D)BI2Re5wqwM-f|J$1pu25F=13uzEVI7 zOn)Mkjmu?Z!uegWpa;aP+zbfB?Uf;o9%E29U(mAm$3=pS*U65;Q*Joe|s)<(_SBM5=v0-SnGH6PZX@dY} z>MvYPNL8qJk%_oaE{v=~#0wI?=bFm}+|CO{CFp6JgjVle^GsxcB^0IR2=VH;Oh*iB zaDnAUkFo~xtes^YqBl4gOyE54>FT%qD85qs9HfU|KXLgGe5B`6hOMJf@)&^DVIjN) z6q&4hCc$V}b!<^!#~>tyoLWuET1pm2-)e?0-J*Qr7C?oH_ucX5xH;4}5?!}xrn2n# zPu`A}y7pnFs~B^LX9YY9wsQs#meP3E9UkEF!~Y+gsv=OU0CL;#GQ&?qm<(jT+1F$d zBq#^WLyPb4&>wkv_0Otrlu$Q+{Wa>_b!GP>N-;<`*N2h?bGY*6@V?Q@CBk#FKP|Lq z`fvHwL{(?+3hvv_wECqDPqZN)loTJWhlQ#^GtCNXUoY}DHm2+;g1E0fO1mMh3~JmI zIFcqv7A?5p9^E$qp|>c8u7tH};u!Mh-=nS3B{eAJvD2Puj*j%gqXbtHk-bcF`n{0! zLRun&SPiChdD_9ADelJ~38r%S@`2|R;S-~|_Gz(_kMmezd^+?E%V`yiUv9%TtHTa# z2~yCmsn@j4Y(~dnDjd@NyYU2=yi=<-1bayhQWBR0eBA7$eyRqkF%*RpsVX)WkNp|m zD>*kCfienL1$|+#?=4F{{%k}I3w({DSUxW(ru@>vtX`776w%vfSkc8^)O5TdO4AV< zbI*E;J&uo(V$$ZTuILbGIJ8wVEV6St7yC>q{lGJWWi^k~YoXtg>Vkfpj~I`a;`v=f z^YYj0o1`ym@|S$C#NdKSe2kJrO|bLpQzpStePcQ7P~TEm#JQIArkF~^Lkgdr_zRsQ zGaR_w3+zXTYE8jHj{doW;rV@2W+lw1?uBYMcoe^?ezO@)!hmV$-rJChV~Wcu)t9RY z@m_9FMI)%{WLZR5GRkH@eQ;HlGYkBdiyQditvpFdd~0J@;w7nVO=ymuK-zFjN;&!onup)!gN3KKacs&`B#YamiVt(6*B_DrzV~aZQactQGDcH! zLg>K!!War}6q#e{-{qCNu(%Bk1?s(y$NDCcsF%A%yoKX7KXJ1Ffg??wL5qRq^QV>C zT!VD3&i1j>vA^QfE%VqMPkD@P$fM#q*%9v`^ezsCE%j=*v#t;UN8l!hU$IShNE)^r zSwF;kvY*DQFQt9MO5(3Jp@wa5iPuFLO#ee%5 zZG57|gAy~L>aG~f*txzTDc1k%e{oRe&Rq}}59=Y=3q5t#73H3z|KR&~=-};r&DM!O z-!9KtyIYg6ZTpp2Fb+8L{-r<;5X78vY%O(mSe$5_Rr+4$ubt8+m%w#^BT~ z12(bTb`*lcVa*Jsz zTf`4n0wV0VAQPJE7~LY;_$A?8D{Id9M4Ak;TEjpEPl&U6%~j;3A_JEghg1xyHSb?6 zPWWSM9?fG#EedZ#Ebcg7@>V2a_xB|t%KaXpth=UwVSM3hJl}D2U6&wy?`Lg&JYJ=B z6DgSL4ZWYqxB2|7sWYx(xh#i27*Pr?)uvK$_^Efrv>%iT`k!d_?mGcUA}k0}DPPdl zQ)VmFK6Kj_rClb_Q>WZ3lDv{Ng0>@wUR8^3@5?60`>{!g#V|YjKuD)b78VitryeiNDz1C|;jJas?W2?B0{Z*I z#`|B>Ick>eV(k7davq=qJuIlDCUue>brT0(80$dZ*BnC7MGl>)bjP#J#6c0FdTZcM z`Om6#DApBke=qj%F&*qnQ&*!BsHJ}E)8HkfEVaq5T%F4;6^9<4p;80LxJSr-3hw++voHZx=DVWkQaanK5M(KO$r= z366e_yW!rKE5UYZ=#y^4mCiF_^ihUGwoepaa2W}lc3rRg2#)Uo8xG;+$x|~9ir!q&X{<4y=DO~rTZFqn*ykIm#n;_C6TY`q*zGB@I|88=7_`<$==qKk8wZVs&& zk!%N}dZhBUNFqmasL5<@IL;Rc+&4M>sLHe?(?)6xpL!Wa3HBTCZj>(@a9Uqi=t28e zjcB&07^noqMVb~_*=rB!2f0|ul^3hYBP}Kg!%h3ypdvSBDI-aAGt~R(ysEJTOyriw zDdT4^iNGJg;j7EIjY&PF>N@bwg!B1Y)cg#If7vgBTCi&WR|N)(_t_93lLXo_Ov@FZ z>{fV90)We{?_E~f^_2#4Wr1pud%JNqfHR;_Mfz|nkMiwuU)Z#M*I&xj3CZ7jgV_x2 z9bi9msSGYwZ*MbA3B}JxRhnN6&ddYiKI-RsO%piroaFh?c^Qa0wAcO6!5Sm{NZ1F# zsru{m?JlmpKe5#IQ&!u~yB{LN0R}s9=(5bj_H@IBRD#Pa-jUz7%vl@JW3M}_M#hD6 z@5C{Ay~@SLlJ^CEa*b5&N*2$7#gF$bG0t_s*766-)yQ4!4CM1bhf5^ zfqh9^Ci3^kDBgD3=&gD$7;b^3EaZn~nuJ6!TBPTsg{sYzvgsrXhS*tjXDPB|ZY@9# z_F6^ibo*wKNr&F?OzJy=?^ts+xV*vI6gWU8+h!8!gsJt7_W)UZi(vCS?}=7p=1AU%j9Y zc{cGk8+IF3SGD|?ws@{u)8U%EPN0@n`|x4lj;VGQbVr~hEuwoG$J)Ko^so>!vi<{J) zR{l3p^Y8U2{T>x5!c;gxmYOrswyfnj%NLrxaonmMBPX_%(T!^Lc;hz8KgH5wW)qSH zd~5emw$1vw(-aNKepCz)r@d7K?F`V4%!9>))%{i}1))fHdxXe=#EOp?b(x zZ-?_?vC3FznSkm9UM+%Y&+Jk3lZk5UnCvjQdiZC%@7qp&iA`%B{3#3xMT!&@{=K0?Dr zUEd>7GXo!*N2!oPBW}E78vG~^8xA<@v8`*vHh-)np+=Nvj0YA8<9CbZy;i|31JMNg zL6antS~vQazF1p?fL78^VO5H;;_W8DZ;_p=&Ugd!EwIs#27Ha_-B;Xdkio5$vO+wJ|EA4Eu3Wuu%SyURR#s}xF7#f0Sa5R?t&ngz9%i??Y;Jm4j>eMf?Z;}-Ey4#d-?V3 z8UG!uafIDI0(n77P04k7vzd9gKE2OYUJ(5nxyeKn!`hJ~@aV~30bQ=|ZKm@1X{(}F zqjxgI-W?tZyAFOjhsO&o6!)o00>Czcj~1w-s-62^#vh|cKj2oUMFrwC`VHYgoVG`@ z!+ub-iNvl4KY}R5=ZL``Q47C9G`u%KT-!fg;<9*YJ%E@2U74PQs zBFG#;NHxELK7Fc~>k8XgNnpBsHFBrE7;2+tlxhFbKY853r5bd#pouaO8oq(uTo^7_ zJn+Gj_cpM}GS9QtTD^wcMuP@0)%Df1=7tZx#i~|47c2<{j!esvgL8~?jJ0gN*>Waj zICRSuSZK=TL!^&=B)o&2T#(x~N~t=i&zJcs0P_f1fLRb1sJ{^k9=F2IoJzH;}PAkK$N z6L4GfGACP4YZ@R&ivb^UvtfrLTU=4|9j?t9(?$R8T>od1R&MY&nNdU82()u{&)TT7YzS` l;a@QP%NhQE@~f_UY^LRJ*7L2-k1!rCWqA#`N*N3Ie*tM1H$MOX diff --git a/cmd/picoclaw-launcher-tui/internal/ui/app.go b/cmd/picoclaw-launcher-tui/internal/ui/app.go index a2ccddf70..f26b6125c 100644 --- a/cmd/picoclaw-launcher-tui/internal/ui/app.go +++ b/cmd/picoclaw-launcher-tui/internal/ui/app.go @@ -325,7 +325,7 @@ func (s *appState) viewGatewayLog() { } func (s *appState) selectedModelName() string { - modelName := strings.TrimSpace(s.config.Agents.Defaults.Model) + modelName := strings.TrimSpace(s.config.Agents.Defaults.GetModelName()) if modelName == "" { return "" } @@ -413,7 +413,7 @@ func (s *appState) isGatewayRunning() bool { } func (s *appState) validateAgentModel() error { - modelName := strings.TrimSpace(s.config.Agents.Defaults.Model) + modelName := strings.TrimSpace(s.config.Agents.Defaults.GetModelName()) if modelName == "" { return nil } @@ -422,7 +422,7 @@ func (s *appState) validateAgentModel() error { } func (s *appState) isActiveModelValid() bool { - modelName := strings.TrimSpace(s.config.Agents.Defaults.Model) + modelName := strings.TrimSpace(s.config.Agents.Defaults.GetModelName()) if modelName == "" { return false } diff --git a/cmd/picoclaw-launcher-tui/internal/ui/model.go b/cmd/picoclaw-launcher-tui/internal/ui/model.go index 47ca5a355..93069ac7b 100644 --- a/cmd/picoclaw-launcher-tui/internal/ui/model.go +++ b/cmd/picoclaw-launcher-tui/internal/ui/model.go @@ -15,7 +15,7 @@ import ( func (s *appState) modelMenu() tview.Primitive { items := make([]MenuItem, 0, 1+len(s.config.ModelList)) - currentModel := strings.TrimSpace(s.config.Agents.Defaults.Model) + currentModel := strings.TrimSpace(s.config.Agents.Defaults.ModelName) for i := range s.config.ModelList { index := i model := s.config.ModelList[i] @@ -77,9 +77,9 @@ func (s *appState) modelMenu() tview.Primitive { ) return nil } - s.config.Agents.Defaults.Model = model.ModelName + s.config.Agents.Defaults.ModelName = model.ModelName s.dirty = true - refreshModelMenu(menu, s.config.Agents.Defaults.Model, s.config.ModelList) + refreshModelMenu(menu, s.config.Agents.Defaults.GetModelName(), s.config.ModelList) refreshMainMenuIfPresent(s) } return nil @@ -105,8 +105,8 @@ func (s *appState) modelForm(index int) tview.Primitive { } oldName := model.ModelName model.ModelName = value - if s.config.Agents.Defaults.Model == oldName { - s.config.Agents.Defaults.Model = value + if s.config.Agents.Defaults.ModelName == oldName { + s.config.Agents.Defaults.ModelName = value } s.dirty = true form.SetTitle(fmt.Sprintf("Model: %s", model.ModelName)) @@ -258,7 +258,7 @@ func refreshModelMenu(menu *Menu, currentModel string, models []picoclawconfig.M func refreshModelMenuFromState(menu *Menu, s *appState) { items := make([]MenuItem, 0, 1+len(s.config.ModelList)) - currentModel := strings.TrimSpace(s.config.Agents.Defaults.Model) + currentModel := strings.TrimSpace(s.config.Agents.Defaults.ModelName) for i := range s.config.ModelList { index := i model := s.config.ModelList[i] diff --git a/cmd/picoclaw/internal/auth/helpers.go b/cmd/picoclaw/internal/auth/helpers.go index a0a229167..02c78cf4e 100644 --- a/cmd/picoclaw/internal/auth/helpers.go +++ b/cmd/picoclaw/internal/auth/helpers.go @@ -56,9 +56,6 @@ func authLoginOpenAI(useDeviceCode bool) error { appCfg, err := internal.LoadConfig() if err == nil { - // Update Providers (legacy format) - appCfg.Providers.OpenAI.AuthMethod = "oauth" - // Update or add openai in ModelList foundOpenAI := false for i := range appCfg.ModelList { @@ -130,9 +127,6 @@ func authLoginGoogleAntigravity() error { appCfg, err := internal.LoadConfig() if err == nil { - // Update Providers (legacy format, for backward compatibility) - appCfg.Providers.Antigravity.AuthMethod = "oauth" - // Update or add antigravity in ModelList foundAntigravity := false for i := range appCfg.ModelList { @@ -210,8 +204,6 @@ func authLoginAnthropicSetupToken() error { appCfg, err := internal.LoadConfig() if err == nil { - appCfg.Providers.Anthropic.AuthMethod = "oauth" - found := false for i := range appCfg.ModelList { if isAnthropicModel(appCfg.ModelList[i].Model) { @@ -287,7 +279,6 @@ func authLoginPasteToken(provider string) error { if err == nil { switch provider { case "anthropic": - appCfg.Providers.Anthropic.AuthMethod = "token" // Update ModelList found := false for i := range appCfg.ModelList { @@ -306,7 +297,6 @@ func authLoginPasteToken(provider string) error { appCfg.Agents.Defaults.ModelName = defaultAnthropicModel } case "openai": - appCfg.Providers.OpenAI.AuthMethod = "token" // Update ModelList found := false for i := range appCfg.ModelList { @@ -365,15 +355,6 @@ func authLogoutCmd(provider string) error { } } } - // Clear AuthMethod in Providers (legacy) - switch provider { - case "openai": - appCfg.Providers.OpenAI.AuthMethod = "" - case "anthropic": - appCfg.Providers.Anthropic.AuthMethod = "" - case "google-antigravity", "antigravity": - appCfg.Providers.Antigravity.AuthMethod = "" - } config.SaveConfig(internal.GetConfigPath(), appCfg) } @@ -392,10 +373,6 @@ func authLogoutCmd(provider string) error { for i := range appCfg.ModelList { appCfg.ModelList[i].AuthMethod = "" } - // Clear all AuthMethods in Providers (legacy) - appCfg.Providers.OpenAI.AuthMethod = "" - appCfg.Providers.Anthropic.AuthMethod = "" - appCfg.Providers.Antigravity.AuthMethod = "" config.SaveConfig(internal.GetConfigPath(), appCfg) } diff --git a/cmd/picoclaw/internal/helpers.go b/cmd/picoclaw/internal/helpers.go index e04bccffb..120b740d8 100644 --- a/cmd/picoclaw/internal/helpers.go +++ b/cmd/picoclaw/internal/helpers.go @@ -4,19 +4,20 @@ import ( "os" "path/filepath" + "github.com/sipeed/picoclaw/pkg" "github.com/sipeed/picoclaw/pkg/config" ) -const Logo = "🦞" +const Logo = pkg.Logo // GetPicoclawHome returns the picoclaw home directory. // Priority: $PICOCLAW_HOME > ~/.picoclaw func GetPicoclawHome() string { - if home := os.Getenv("PICOCLAW_HOME"); home != "" { + if home := os.Getenv(pkg.PicoClawHome); home != "" { return home } home, _ := os.UserHomeDir() - return filepath.Join(home, ".picoclaw") + return filepath.Join(home, pkg.DefaultPicoClawHome) } func GetConfigPath() string { diff --git a/cmd/picoclaw/internal/helpers_test.go b/cmd/picoclaw/internal/helpers_test.go index 583751781..6e5123152 100644 --- a/cmd/picoclaw/internal/helpers_test.go +++ b/cmd/picoclaw/internal/helpers_test.go @@ -8,6 +8,8 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" + + "github.com/sipeed/picoclaw/pkg" ) func TestGetConfigPath(t *testing.T) { @@ -20,7 +22,7 @@ func TestGetConfigPath(t *testing.T) { } func TestGetConfigPath_WithPICOCLAW_HOME(t *testing.T) { - t.Setenv("PICOCLAW_HOME", "/custom/picoclaw") + t.Setenv(pkg.PicoClawHome, "/custom/picoclaw") t.Setenv("HOME", "/tmp/home") got := GetConfigPath() @@ -31,7 +33,7 @@ func TestGetConfigPath_WithPICOCLAW_HOME(t *testing.T) { func TestGetConfigPath_WithPICOCLAW_CONFIG(t *testing.T) { t.Setenv("PICOCLAW_CONFIG", "/custom/config.json") - t.Setenv("PICOCLAW_HOME", "/custom/picoclaw") + t.Setenv(pkg.PicoClawHome, "/custom/picoclaw") t.Setenv("HOME", "/tmp/home") got := GetConfigPath() diff --git a/cmd/picoclaw/internal/status/helpers.go b/cmd/picoclaw/internal/status/helpers.go index dd7063fe6..43c5786a8 100644 --- a/cmd/picoclaw/internal/status/helpers.go +++ b/cmd/picoclaw/internal/status/helpers.go @@ -42,48 +42,6 @@ func statusCmd() { if _, err := os.Stat(configPath); err == nil { fmt.Printf("Model: %s\n", cfg.Agents.Defaults.GetModelName()) - hasOpenRouter := cfg.Providers.OpenRouter.APIKey != "" - hasAnthropic := cfg.Providers.Anthropic.APIKey != "" - hasOpenAI := cfg.Providers.OpenAI.APIKey != "" - hasGemini := cfg.Providers.Gemini.APIKey != "" - hasZhipu := cfg.Providers.Zhipu.APIKey != "" - hasQwen := cfg.Providers.Qwen.APIKey != "" - hasGroq := cfg.Providers.Groq.APIKey != "" - hasVLLM := cfg.Providers.VLLM.APIBase != "" - hasMoonshot := cfg.Providers.Moonshot.APIKey != "" - hasDeepSeek := cfg.Providers.DeepSeek.APIKey != "" - hasVolcEngine := cfg.Providers.VolcEngine.APIKey != "" - hasNvidia := cfg.Providers.Nvidia.APIKey != "" - hasOllama := cfg.Providers.Ollama.APIBase != "" - - status := func(enabled bool) string { - if enabled { - return "✓" - } - return "not set" - } - fmt.Println("OpenRouter API:", status(hasOpenRouter)) - fmt.Println("Anthropic API:", status(hasAnthropic)) - fmt.Println("OpenAI API:", status(hasOpenAI)) - fmt.Println("Gemini API:", status(hasGemini)) - fmt.Println("Zhipu API:", status(hasZhipu)) - fmt.Println("Qwen API:", status(hasQwen)) - fmt.Println("Groq API:", status(hasGroq)) - fmt.Println("Moonshot API:", status(hasMoonshot)) - fmt.Println("DeepSeek API:", status(hasDeepSeek)) - fmt.Println("VolcEngine API:", status(hasVolcEngine)) - fmt.Println("Nvidia API:", status(hasNvidia)) - if hasVLLM { - fmt.Printf("vLLM/Local: ✓ %s\n", cfg.Providers.VLLM.APIBase) - } else { - fmt.Println("vLLM/Local: not set") - } - if hasOllama { - fmt.Printf("Ollama: ✓ %s\n", cfg.Providers.Ollama.APIBase) - } else { - fmt.Println("Ollama: not set") - } - store, _ := auth.LoadStore() if store != nil && len(store.Credentials) > 0 { fmt.Println("\nOAuth/Token Auth:") diff --git a/config/config.example.json b/config/config.example.json index 49658b9f2..1eea37683 100644 --- a/config/config.example.json +++ b/config/config.example.json @@ -35,6 +35,11 @@ "model": "deepseek/deepseek-chat", "api_key": "sk-your-deepseek-key" }, + { + "model_name": "longcat", + "model": "longcat/LongCat-Flash-Thinking", + "api_key": "your-longcat-api-key" + }, { "model_name": "loadbalanced-gpt4", "model": "openai/gpt-5.2", @@ -274,6 +279,10 @@ "avian": { "api_key": "", "api_base": "https://api.avian.io/v1" + }, + "longcat": { + "api_key": "", + "api_base": "https://api.longcat.chat/openai" } }, "tools": { @@ -477,6 +486,9 @@ "enabled": false, "monitor_usb": true }, + "voice": { + "echo_transcription": false + }, "gateway": { "host": "127.0.0.1", "port": 18790 diff --git a/docs/channels/matrix/README.md b/docs/channels/matrix/README.md index c213aa80b..233f5c0a3 100644 --- a/docs/channels/matrix/README.md +++ b/docs/channels/matrix/README.md @@ -22,7 +22,8 @@ Add this to `config.json`: "enabled": true, "text": "Thinking..." }, - "reasoning_channel_id": "" + "reasoning_channel_id": "", + "message_format": "richtext" } } } @@ -42,10 +43,12 @@ Add this to `config.json`: | group_trigger | object | No | Group trigger strategy (`mention_only` / `prefixes`) | | placeholder | object | No | Placeholder message config | | reasoning_channel_id | string | No | Target channel for reasoning output | +| message_format | string | No | Output format: `"richtext"` (default) renders markdown as HTML; `"plain"` sends plain text only | ## 3. Currently Supported -- Text message send/receive +- Text message send/receive with markdown rendering (bold, italic, headers, code blocks, etc.) +- Configurable message format (`richtext` / `plain`) - Incoming image/audio/video/file download (MediaStore first, local path fallback) - Incoming audio normalization into existing transcription flow (`[audio: ...]`) - Outgoing image/audio/video/file upload and send diff --git a/docs/config-versioning.md b/docs/config-versioning.md new file mode 100644 index 000000000..36d7fdd25 --- /dev/null +++ b/docs/config-versioning.md @@ -0,0 +1,230 @@ +# Config Schema Versioning Guide + +## Overview + +PicoClaw uses a schema versioning system for `config.json` to ensure smooth upgrades as the configuration format evolves. + +## Version History + +### Version 1 +- **Introduction**: Initial version with version field support +- **Changes**: Added `version` field to Config struct +- **Migration**: No structural changes needed for existing configs + +## How It Works + +### Automatic Migration +When you load a config file: +1. The system first reads the `version` field from the JSON +2. Based on the detected version, it loads the appropriate config struct (`ConfigV0`, `ConfigV1`, etc.) +3. If the loaded version is less than the latest, migrations are applied incrementally +4. The version number is updated automatically +5. The migrated config is automatically saved back to disk + +### Version Field +The `version` field in `config.json` indicates the schema version: +- `0` or missing: Legacy config (no version field) +- `1`: Current version with versioning support + +```json +{ + "version": 1, + "agents": {...}, + ... +} +``` + +## Adding a New Migration + +When making breaking changes to the config schema: + +### Step 1: Define the New Version Struct + +Create a new struct for the new version if the structure changes significantly: + +```go +// ConfigV2 represents version 2 config structure +type ConfigV2 struct { + Version int `json:"version"` + Agents AgentsConfig `json:"agents"` + // ... other fields with new structure +} +``` + +### Step 2: Update Current Config Version + +```go +const CurrentConfigVersion = 2 // Increment this +``` + +### Step 3: Add a Loader Function + +```go +// loadConfigV2 loads a version 2 config +func loadConfigV2(data []byte) (*Config, error) { + cfg := DefaultConfig() + + // Parse to ConfigV2 struct + var v2 ConfigV2 + if err := json.Unmarshal(data, &v2); err != nil { + return nil, err + } + + // Convert to current Config + cfg.Version = v2.Version + cfg.Agents = v2.Agents + // ... map other fields + + return cfg, nil +} +``` + +### Step 4: Add Migration Logic + +```go +// applyMigration applies a single migration step from fromVersion to toVersion +func applyMigration(cfg *Config, fromVersion, toVersion int) (*Config, error) { + switch toVersion { + case 1: + // Migration from version 0 to 1 + return &Config{ + Version: 1, + Agents: cfg.Agents, + // ... copy all fields + }, nil + case 2: + // Migration from version 1 to 2 + // Example: Move or rename fields + migrated := *cfg + migrated.Version = 2 + // Apply structural changes + if cfg.SomeOldField != "" { + migrated.SomeNewField = cfg.SomeOldField + } + return &migrated, nil + default: + return nil, fmt.Errorf("unsupported migration target version: %d", toVersion) + } +} +``` + +### Step 5: Update LoadConfig Switch + +```go +func LoadConfig(path string) (*Config, error) { + // ... read file ... + + switch versionInfo.Version { + case 0: + cfg, err = loadConfigV0(data) + case 1: + cfg, err = loadConfigV1(data) + case 2: + cfg, err = loadConfigV2(data) + default: + return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version) + } + + // ... migrate and validate ... +} +``` + +### Step 6: Test Your Migration + +Create a test in `config_migration_test.go`: + +```go +func TestMigrateV1ToV2(t *testing.T) { + // Create a version 1 config + v1Config := Config{ + Version: 1, + // ... set up test data + } + + // Apply migration + migrated, err := applyMigration(&v1Config, 1, 2) + if err != nil { + t.Fatalf("Migration failed: %v", err) + } + + // Verify version is updated + if migrated.Version != 2 { + t.Errorf("Expected version 2, got %d", migrated.Version) + } + + // Verify data is preserved/transformed correctly + // ... +} +``` + +## Migration Best Practices + +1. **Version-Specific Structs**: Define a separate struct for each version that has structural changes +2. **Backward Compatibility**: Ensure old configs can still be loaded with their specific structs +3. **No Data Loss**: Migrations should preserve all user settings +4. **Idempotent**: Running the same migration multiple times should be safe +5. **Auto-Save**: Migrated configs are automatically saved to update the user's file +6. **Test Thoroughly**: Test with real user config files +7. **Update Defaults**: Keep `defaults.go` in sync with the latest schema + +## Example Migration + +### Scenario: Adding a new field with default value + +Old config (version 1): +```json +{ + "version": 1, + "agents": { + "defaults": { + "max_tokens": 32768 + } + } +} +``` + +Migration to version 2: +```go +case 2: + migrated := *cfg + migrated.Version = 2 + + // Add new field with default value if not set + if migrated.Agents.Defaults.NewFeatureEnabled == false { + // Use default value + } + + return &migrated, nil +``` + +New config (version 2): +```json +{ + "version": 2, + "agents": { + "defaults": { + "max_tokens": 32768, + "new_feature_enabled": false + } + } +} +``` + +## Troubleshooting + +### Config Not Upgrading +- Check that `CurrentConfigVersion` is incremented +- Verify migration logic in `applyMigration()` handles the target version +- Ensure `migrateConfig()` is called in `LoadConfig()` + +### Migration Errors +- Check error messages for specific migration failures +- Review migration logic for edge cases +- Ensure all required fields are properly initialized +- Verify the loader function for the source version + +### Data Loss After Migration +- Ensure all fields are copied during migration +- Check that the migration doesn't overwrite values with defaults unnecessarily +- Review the conversion logic in the loader functions + diff --git a/go.mod b/go.mod index f60be046f..3762015e9 100644 --- a/go.mod +++ b/go.mod @@ -11,6 +11,7 @@ require ( github.com/ergochat/irc-go v0.5.0 github.com/gdamore/tcell/v2 v2.13.8 github.com/google/uuid v1.6.0 + github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab github.com/gorilla/websocket v1.5.3 github.com/h2non/filetype v1.1.3 github.com/larksuite/oapi-sdk-go/v3 v3.5.3 @@ -20,6 +21,7 @@ require ( github.com/open-dingtalk/dingtalk-stream-sdk-go v0.9.1 github.com/openai/openai-go/v3 v3.22.0 github.com/rivo/tview v0.42.0 + github.com/rs/zerolog v1.34.0 github.com/slack-go/slack v0.17.3 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.11.1 @@ -49,7 +51,6 @@ require ( github.com/pmezard/go-difflib v1.0.0 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect github.com/rivo/uniseg v0.4.7 // indirect - github.com/rs/zerolog v1.34.0 // indirect github.com/segmentio/asm v1.1.3 // indirect github.com/segmentio/encoding v0.5.3 // indirect github.com/spf13/pflag v1.0.10 // indirect diff --git a/go.sum b/go.sum index 4060997f8..2e2b1a1ec 100644 --- a/go.sum +++ b/go.sum @@ -79,6 +79,8 @@ github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvq github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI= github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk= github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY= +github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab h1:VYNivV7P8IRHUam2swVUNkhIdp0LRRFKe4hXNnoZKTc= +github.com/gomarkdown/markdown v0.0.0-20260217112301-37c66b85d6ab/go.mod h1:JDGcbDT52eL4fju3sZ4TeHGsQwhG9nbDV21aMyhwPoA= github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= diff --git a/pkg/agent/context.go b/pkg/agent/context.go index 5a84c45e2..dd030d1b1 100644 --- a/pkg/agent/context.go +++ b/pkg/agent/context.go @@ -12,6 +12,7 @@ import ( "sync" "time" + "github.com/sipeed/picoclaw/pkg" "github.com/sipeed/picoclaw/pkg/config" "github.com/sipeed/picoclaw/pkg/logger" "github.com/sipeed/picoclaw/pkg/providers" @@ -52,14 +53,14 @@ func (cb *ContextBuilder) WithToolDiscovery(useBM25, useRegex bool) *ContextBuil } func getGlobalConfigDir() string { - if home := os.Getenv("PICOCLAW_HOME"); home != "" { + if home := os.Getenv(pkg.PicoClawHome); home != "" { return home } home, err := os.UserHomeDir() if err != nil { return "" } - return filepath.Join(home, ".picoclaw") + return filepath.Join(home, pkg.DefaultPicoClawHome) } func NewContextBuilder(workspace string) *ContextBuilder { diff --git a/pkg/agent/instance_test.go b/pkg/agent/instance_test.go index 4f41ecd1c..335e236a0 100644 --- a/pkg/agent/instance_test.go +++ b/pkg/agent/instance_test.go @@ -18,7 +18,7 @@ func TestNewAgentInstance_UsesDefaultsTemperatureAndMaxTokens(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 1234, MaxToolIterations: 5, }, @@ -50,7 +50,7 @@ func TestNewAgentInstance_DefaultsTemperatureWhenZero(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 1234, MaxToolIterations: 5, }, @@ -79,7 +79,7 @@ func TestNewAgentInstance_DefaultsTemperatureWhenUnset(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 1234, MaxToolIterations: 5, }, @@ -133,7 +133,7 @@ func TestNewAgentInstance_ResolveCandidatesFromModelListAlias(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: tt.aliasName, + ModelName: tt.aliasName, }, }, ModelList: []config.ModelConfig{ diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 235d42fcc..28e549ce0 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -25,7 +25,6 @@ import ( "github.com/sipeed/picoclaw/pkg/config" "github.com/sipeed/picoclaw/pkg/constants" "github.com/sipeed/picoclaw/pkg/logger" - "github.com/sipeed/picoclaw/pkg/mcp" "github.com/sipeed/picoclaw/pkg/media" "github.com/sipeed/picoclaw/pkg/providers" "github.com/sipeed/picoclaw/pkg/routing" @@ -48,6 +47,7 @@ type AgentLoop struct { mediaStore media.MediaStore transcriber voice.Transcriber cmdRegistry *commands.Registry + mcp mcpRuntime } // processOptions configures how a message is processed @@ -239,119 +239,8 @@ func registerSharedTools( func (al *AgentLoop) Run(ctx context.Context) error { al.running.Store(true) - - // Initialize MCP servers for all agents - if al.cfg.Tools.IsToolEnabled("mcp") { - mcpManager := mcp.NewManager() - // Ensure MCP connections are cleaned up on exit, regardless of initialization success - // This fixes resource leak when LoadFromMCPConfig partially succeeds then fails - defer func() { - if err := mcpManager.Close(); err != nil { - logger.ErrorCF("agent", "Failed to close MCP manager", - map[string]any{ - "error": err.Error(), - }) - } - }() - - defaultAgent := al.registry.GetDefaultAgent() - var workspacePath string - if defaultAgent != nil && defaultAgent.Workspace != "" { - workspacePath = defaultAgent.Workspace - } else { - workspacePath = al.cfg.WorkspacePath() - } - - if err := mcpManager.LoadFromMCPConfig(ctx, al.cfg.Tools.MCP, workspacePath); err != nil { - logger.WarnCF("agent", "Failed to load MCP servers, MCP tools will not be available", - map[string]any{ - "error": err.Error(), - }) - } else { - // Register MCP tools for all agents - servers := mcpManager.GetServers() - uniqueTools := 0 - totalRegistrations := 0 - agentIDs := al.registry.ListAgentIDs() - agentCount := len(agentIDs) - - for serverName, conn := range servers { - uniqueTools += len(conn.Tools) - for _, tool := range conn.Tools { - for _, agentID := range agentIDs { - agent, ok := al.registry.GetAgent(agentID) - if !ok { - continue - } - - mcpTool := tools.NewMCPTool(mcpManager, serverName, tool) - - if al.cfg.Tools.MCP.Discovery.Enabled { - agent.Tools.RegisterHidden(mcpTool) - } else { - agent.Tools.Register(mcpTool) - } - - totalRegistrations++ - logger.DebugCF("agent", "Registered MCP tool", - map[string]any{ - "agent_id": agentID, - "server": serverName, - "tool": tool.Name, - "name": mcpTool.Name(), - }) - } - } - } - logger.InfoCF("agent", "MCP tools registered successfully", - map[string]any{ - "server_count": len(servers), - "unique_tools": uniqueTools, - "total_registrations": totalRegistrations, - "agent_count": agentCount, - }) - - // Initializes Discovery Tools only if enabled by configuration - if al.cfg.Tools.MCP.Enabled && al.cfg.Tools.MCP.Discovery.Enabled { - useBM25 := al.cfg.Tools.MCP.Discovery.UseBM25 - useRegex := al.cfg.Tools.MCP.Discovery.UseRegex - - // Fail fast: If discovery is enabled but no search method is turned on - if !useBM25 && !useRegex { - return fmt.Errorf( - "tool discovery is enabled but neither 'use_bm25' nor 'use_regex' is set to true in the configuration", - ) - } - - ttl := al.cfg.Tools.MCP.Discovery.TTL - if ttl <= 0 { - ttl = 5 // Default value - } - - maxSearchResults := al.cfg.Tools.MCP.Discovery.MaxSearchResults - if maxSearchResults <= 0 { - maxSearchResults = 5 // Default value - } - - logger.InfoCF("agent", "Initializing tool discovery", map[string]any{ - "bm25": useBM25, "regex": useRegex, "ttl": ttl, "max_results": maxSearchResults, - }) - - for _, agentID := range agentIDs { - agent, ok := al.registry.GetAgent(agentID) - if !ok { - continue - } - - if useRegex { - agent.Tools.Register(tools.NewRegexSearchTool(agent.Tools, ttl, maxSearchResults)) - } - if useBM25 { - agent.Tools.Register(tools.NewBM25SearchTool(agent.Tools, ttl, maxSearchResults)) - } - } - } - } + if err := al.ensureMCPInitialized(ctx); err != nil { + return err } for al.running.Load() { @@ -431,6 +320,17 @@ func (al *AgentLoop) Stop() { // Close releases resources held by agent session stores. Call after Stop. func (al *AgentLoop) Close() { + mcpManager := al.mcp.takeManager() + + if mcpManager != nil { + if err := mcpManager.Close(); err != nil { + logger.ErrorCF("agent", "Failed to close MCP manager", + map[string]any{ + "error": err.Error(), + }) + } + } + al.registry.Close() } @@ -467,9 +367,10 @@ var audioAnnotationRe = regexp.MustCompile(`\[(voice|audio)(?::[^\]]*)?\]`) // transcribeAudioInMessage resolves audio media refs, transcribes them, and // replaces audio annotations in msg.Content with the transcribed text. -func (al *AgentLoop) transcribeAudioInMessage(ctx context.Context, msg bus.InboundMessage) bus.InboundMessage { +// Returns the (possibly modified) message and true if audio was transcribed. +func (al *AgentLoop) transcribeAudioInMessage(ctx context.Context, msg bus.InboundMessage) (bus.InboundMessage, bool) { if al.transcriber == nil || al.mediaStore == nil || len(msg.Media) == 0 { - return msg + return msg, false } // Transcribe each audio media ref in order. @@ -493,9 +394,11 @@ func (al *AgentLoop) transcribeAudioInMessage(ctx context.Context, msg bus.Inbou } if len(transcriptions) == 0 { - return msg + return msg, false } + al.sendTranscriptionFeedback(ctx, msg.Channel, msg.ChatID, msg.MessageID, transcriptions) + // Replace audio annotations sequentially with transcriptions. idx := 0 newContent := audioAnnotationRe.ReplaceAllStringFunc(msg.Content, func(match string) string { @@ -513,7 +416,48 @@ func (al *AgentLoop) transcribeAudioInMessage(ctx context.Context, msg bus.Inbou } msg.Content = newContent - return msg + return msg, true +} + +// sendTranscriptionFeedback sends feedback to the user with the result of +// audio transcription if the option is enabled. It uses Manager.SendMessage +// which executes synchronously (rate limiting, splitting, retry) so that +// ordering with the subsequent placeholder is guaranteed. +func (al *AgentLoop) sendTranscriptionFeedback( + ctx context.Context, + channel, chatID, messageID string, + validTexts []string, +) { + if !al.cfg.Voice.EchoTranscription { + return + } + if al.channelManager == nil { + return + } + + var nonEmpty []string + for _, t := range validTexts { + if t != "" { + nonEmpty = append(nonEmpty, t) + } + } + + var feedbackMsg string + if len(nonEmpty) > 0 { + feedbackMsg = "Transcript: " + strings.Join(nonEmpty, "\n") + } else { + feedbackMsg = "No voice detected in the audio" + } + + err := al.channelManager.SendMessage(ctx, bus.OutboundMessage{ + Channel: channel, + ChatID: chatID, + Content: feedbackMsg, + ReplyToMessageID: messageID, + }) + if err != nil { + logger.WarnCF("voice", "Failed to send transcription feedback", map[string]any{"error": err.Error()}) + } } // inferMediaType determines the media type ("image", "audio", "video", "file") @@ -575,6 +519,10 @@ func (al *AgentLoop) ProcessDirectWithChannel( ctx context.Context, content, sessionKey, channel, chatID string, ) (string, error) { + if err := al.ensureMCPInitialized(ctx); err != nil { + return "", err + } + msg := bus.InboundMessage{ Channel: channel, SenderID: "cron", @@ -627,7 +575,14 @@ func (al *AgentLoop) processMessage(ctx context.Context, msg bus.InboundMessage) }, ) - msg = al.transcribeAudioInMessage(ctx, msg) + var hadAudio bool + msg, hadAudio = al.transcribeAudioInMessage(ctx, msg) + + // For audio messages the placeholder was deferred by the channel. + // Now that transcription (and optional feedback) is done, send it. + if hadAudio && al.channelManager != nil { + al.channelManager.SendPlaceholder(ctx, msg.Channel, msg.ChatID) + } // Route system messages to processSystemMessage if msg.Channel == "system" { diff --git a/pkg/agent/loop_mcp.go b/pkg/agent/loop_mcp.go new file mode 100644 index 000000000..2795db52a --- /dev/null +++ b/pkg/agent/loop_mcp.go @@ -0,0 +1,184 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// Inspired by and based on nanobot: https://github.com/HKUDS/nanobot +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package agent + +import ( + "context" + "fmt" + "sync" + + "github.com/sipeed/picoclaw/pkg/logger" + "github.com/sipeed/picoclaw/pkg/mcp" + "github.com/sipeed/picoclaw/pkg/tools" +) + +type mcpRuntime struct { + initOnce sync.Once + mu sync.Mutex + manager *mcp.Manager + initErr error +} + +func (r *mcpRuntime) setManager(manager *mcp.Manager) { + r.mu.Lock() + r.manager = manager + r.initErr = nil + r.mu.Unlock() +} + +func (r *mcpRuntime) setInitErr(err error) { + r.mu.Lock() + r.initErr = err + r.mu.Unlock() +} + +func (r *mcpRuntime) getInitErr() error { + r.mu.Lock() + defer r.mu.Unlock() + return r.initErr +} + +func (r *mcpRuntime) takeManager() *mcp.Manager { + r.mu.Lock() + defer r.mu.Unlock() + manager := r.manager + r.manager = nil + return manager +} + +func (r *mcpRuntime) hasManager() bool { + r.mu.Lock() + defer r.mu.Unlock() + return r.manager != nil +} + +// ensureMCPInitialized loads MCP servers/tools once so both Run() and direct +// agent mode share the same initialization path. +func (al *AgentLoop) ensureMCPInitialized(ctx context.Context) error { + if !al.cfg.Tools.IsToolEnabled("mcp") { + return nil + } + + al.mcp.initOnce.Do(func() { + mcpManager := mcp.NewManager() + + defaultAgent := al.registry.GetDefaultAgent() + workspacePath := al.cfg.WorkspacePath() + if defaultAgent != nil && defaultAgent.Workspace != "" { + workspacePath = defaultAgent.Workspace + } + + if err := mcpManager.LoadFromMCPConfig(ctx, al.cfg.Tools.MCP, workspacePath); err != nil { + logger.WarnCF("agent", "Failed to load MCP servers, MCP tools will not be available", + map[string]any{ + "error": err.Error(), + }) + if closeErr := mcpManager.Close(); closeErr != nil { + logger.ErrorCF("agent", "Failed to close MCP manager", + map[string]any{ + "error": closeErr.Error(), + }) + } + return + } + + // Register MCP tools for all agents + servers := mcpManager.GetServers() + uniqueTools := 0 + totalRegistrations := 0 + agentIDs := al.registry.ListAgentIDs() + agentCount := len(agentIDs) + + for serverName, conn := range servers { + uniqueTools += len(conn.Tools) + for _, tool := range conn.Tools { + for _, agentID := range agentIDs { + agent, ok := al.registry.GetAgent(agentID) + if !ok { + continue + } + + mcpTool := tools.NewMCPTool(mcpManager, serverName, tool) + + if al.cfg.Tools.MCP.Discovery.Enabled { + agent.Tools.RegisterHidden(mcpTool) + } else { + agent.Tools.Register(mcpTool) + } + + totalRegistrations++ + logger.DebugCF("agent", "Registered MCP tool", + map[string]any{ + "agent_id": agentID, + "server": serverName, + "tool": tool.Name, + "name": mcpTool.Name(), + }) + } + } + } + logger.InfoCF("agent", "MCP tools registered successfully", + map[string]any{ + "server_count": len(servers), + "unique_tools": uniqueTools, + "total_registrations": totalRegistrations, + "agent_count": agentCount, + }) + + // Initializes Discovery Tools only if enabled by configuration + if al.cfg.Tools.MCP.Enabled && al.cfg.Tools.MCP.Discovery.Enabled { + useBM25 := al.cfg.Tools.MCP.Discovery.UseBM25 + useRegex := al.cfg.Tools.MCP.Discovery.UseRegex + + // Fail fast: If discovery is enabled but no search method is turned on + if !useBM25 && !useRegex { + al.mcp.setInitErr(fmt.Errorf( + "tool discovery is enabled but neither 'use_bm25' nor 'use_regex' is set to true in the configuration", + )) + if closeErr := mcpManager.Close(); closeErr != nil { + logger.ErrorCF("agent", "Failed to close MCP manager", + map[string]any{ + "error": closeErr.Error(), + }) + } + return + } + + ttl := al.cfg.Tools.MCP.Discovery.TTL + if ttl <= 0 { + ttl = 5 // Default value + } + + maxSearchResults := al.cfg.Tools.MCP.Discovery.MaxSearchResults + if maxSearchResults <= 0 { + maxSearchResults = 5 // Default value + } + + logger.InfoCF("agent", "Initializing tool discovery", map[string]any{ + "bm25": useBM25, "regex": useRegex, "ttl": ttl, "max_results": maxSearchResults, + }) + + for _, agentID := range agentIDs { + agent, ok := al.registry.GetAgent(agentID) + if !ok { + continue + } + + if useRegex { + agent.Tools.Register(tools.NewRegexSearchTool(agent.Tools, ttl, maxSearchResults)) + } + if useBM25 { + agent.Tools.Register(tools.NewBM25SearchTool(agent.Tools, ttl, maxSearchResults)) + } + } + } + + al.mcp.setManager(mcpManager) + }) + + return al.mcp.getInitErr() +} diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index 2e456fa60..6f90c6155 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -42,7 +42,7 @@ func newTestAgentLoop( Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -101,7 +101,7 @@ func TestNewAgentLoop_StateInitialized(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -137,7 +137,7 @@ func TestToolRegistry_ToolRegistration(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -194,7 +194,7 @@ func TestToolRegistry_GetDefinitions(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -230,7 +230,7 @@ func TestAgentLoop_GetStartupInfo(t *testing.T) { cfg := config.DefaultConfig() cfg.Agents.Defaults.Workspace = tmpDir - cfg.Agents.Defaults.Model = "test-model" + cfg.Agents.Defaults.ModelName = "test-model" cfg.Agents.Defaults.MaxTokens = 4096 cfg.Agents.Defaults.MaxToolIterations = 10 @@ -274,7 +274,7 @@ func TestAgentLoop_Stop(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -394,7 +394,7 @@ func TestProcessMessage_UsesRouteSessionKey(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -450,7 +450,7 @@ func TestProcessMessage_CommandOutcomes(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -530,7 +530,7 @@ func TestProcessMessage_SwitchModelShowModelConsistency(t *testing.T) { Defaults: config.AgentDefaults{ Workspace: tmpDir, Provider: "openai", - Model: "before-switch", + ModelName: "before-switch", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -587,7 +587,7 @@ func TestToolResult_SilentToolDoesNotSendUserMessage(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -629,7 +629,7 @@ func TestToolResult_UserFacingToolDoesSendMessage(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -700,7 +700,7 @@ func TestAgentLoop_ContextExhaustionRetry(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -770,6 +770,56 @@ func TestAgentLoop_ContextExhaustionRetry(t *testing.T) { } } +func TestProcessDirectWithChannel_InitializesMCPInAgentMode(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "agent-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + ModelName: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + Tools: config.ToolsConfig{ + MCP: config.MCPConfig{ + ToolConfig: config.ToolConfig{ + Enabled: true, + }, + }, + }, + } + + msgBus := bus.NewMessageBus() + provider := &mockProvider{} + al := NewAgentLoop(cfg, msgBus, provider) + defer al.Close() + + if al.mcp.hasManager() { + t.Fatal("expected MCP manager to be nil before first direct processing") + } + + _, err = al.ProcessDirectWithChannel( + context.Background(), + "hello", + "session-1", + "cli", + "direct", + ) + if err != nil { + t.Fatalf("ProcessDirectWithChannel failed: %v", err) + } + + if !al.mcp.hasManager() { + t.Fatal("expected MCP manager to be initialized in direct agent mode") + } +} + func TestTargetReasoningChannelID_AllChannels(t *testing.T) { tmpDir, err := os.MkdirTemp("", "agent-test-*") if err != nil { @@ -781,7 +831,7 @@ func TestTargetReasoningChannelID_AllChannels(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, @@ -851,7 +901,7 @@ func TestHandleReasoning(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: tmpDir, - Model: "test-model", + ModelName: "test-model", MaxTokens: 4096, MaxToolIterations: 10, }, diff --git a/pkg/agent/registry_test.go b/pkg/agent/registry_test.go index 518bb441f..b173ef967 100644 --- a/pkg/agent/registry_test.go +++ b/pkg/agent/registry_test.go @@ -29,7 +29,7 @@ func testCfg(agents []config.AgentConfig) *config.Config { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: "/tmp/picoclaw-test-registry", - Model: "gpt-4", + ModelName: "gpt-4", MaxTokens: 8192, MaxToolIterations: 10, }, diff --git a/pkg/auth/store.go b/pkg/auth/store.go index 2e55d4877..dff011ee2 100644 --- a/pkg/auth/store.go +++ b/pkg/auth/store.go @@ -6,6 +6,7 @@ import ( "path/filepath" "time" + "github.com/sipeed/picoclaw/pkg" "github.com/sipeed/picoclaw/pkg/fileutil" ) @@ -39,11 +40,11 @@ func (c *AuthCredential) NeedsRefresh() bool { } func authFilePath() string { - if home := os.Getenv("PICOCLAW_HOME"); home != "" { + if home := os.Getenv(pkg.PicoClawHome); home != "" { return filepath.Join(home, "auth.json") } home, _ := os.UserHomeDir() - return filepath.Join(home, ".picoclaw", "auth.json") + return filepath.Join(home, pkg.DefaultPicoClawHome, "auth.json") } func LoadStore() (*AuthStore, error) { diff --git a/pkg/bus/types.go b/pkg/bus/types.go index 7ad8f0417..12da3f1dd 100644 --- a/pkg/bus/types.go +++ b/pkg/bus/types.go @@ -30,9 +30,10 @@ type InboundMessage struct { } type OutboundMessage struct { - Channel string `json:"channel"` - ChatID string `json:"chat_id"` - Content string `json:"content"` + Channel string `json:"channel"` + ChatID string `json:"chat_id"` + Content string `json:"content"` + ReplyToMessageID string `json:"reply_to_message_id,omitempty"` } // MediaPart describes a single media attachment to send. diff --git a/pkg/channels/base.go b/pkg/channels/base.go index 063a66523..edb5b6f08 100644 --- a/pkg/channels/base.go +++ b/pkg/channels/base.go @@ -5,6 +5,7 @@ import ( "crypto/rand" "encoding/binary" "encoding/hex" + "regexp" "strconv" "strings" "sync/atomic" @@ -32,6 +33,9 @@ func init() { uniqueIDPrefix = hex.EncodeToString(b[:]) } +// audioAnnotationRe matches audio/voice annotations injected by channels (e.g. [voice], [audio: file.ogg]). +var audioAnnotationRe = regexp.MustCompile(`\[(voice|audio)(?::[^\]]*)?\]`) + // uniqueID generates a process-unique ID using a random prefix and an atomic counter. // This ID is intended for internal correlation (e.g. media scope keys) and is NOT // cryptographically secure — it must not be used in contexts where unpredictability matters. @@ -284,10 +288,15 @@ func (c *BaseChannel) HandleMessage( c.placeholderRecorder.RecordReactionUndo(c.name, chatID, undo) } } - // Placeholder — independent pipeline - if pc, ok := c.owner.(PlaceholderCapable); ok { - if phID, err := pc.SendPlaceholder(ctx, chatID); err == nil && phID != "" { - c.placeholderRecorder.RecordPlaceholder(c.name, chatID, phID) + // Placeholder — independent pipeline. + // Skip when the message contains audio: the agent will send the + // placeholder after transcription completes, so the user sees + // "Thinking…" only once the voice has been processed. + if !audioAnnotationRe.MatchString(content) { + if pc, ok := c.owner.(PlaceholderCapable); ok { + if phID, err := pc.SendPlaceholder(ctx, chatID); err == nil && phID != "" { + c.placeholderRecorder.RecordPlaceholder(c.name, chatID, phID) + } } } } diff --git a/pkg/channels/dingtalk/dingtalk.go b/pkg/channels/dingtalk/dingtalk.go index 8642ad362..c03122892 100644 --- a/pkg/channels/dingtalk/dingtalk.go +++ b/pkg/channels/dingtalk/dingtalk.go @@ -10,6 +10,7 @@ import ( "github.com/open-dingtalk/dingtalk-stream-sdk-go/chatbot" "github.com/open-dingtalk/dingtalk-stream-sdk-go/client" + dinglog "github.com/open-dingtalk/dingtalk-stream-sdk-go/logger" "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/channels" @@ -39,6 +40,9 @@ func NewDingTalkChannel(cfg config.DingTalkConfig, messageBus *bus.MessageBus) ( return nil, fmt.Errorf("dingtalk client_id and client_secret are required") } + // Set the logger for the Stream SDK + dinglog.SetLogger(logger.NewLogger("dingtalk")) + base := channels.NewBaseChannel("dingtalk", cfg, messageBus, cfg.AllowFrom, channels.WithMaxMessageLength(20000), channels.WithGroupTrigger(cfg.GroupTrigger), diff --git a/pkg/channels/discord/discord.go b/pkg/channels/discord/discord.go index c3bcbff8d..83a04907c 100644 --- a/pkg/channels/discord/discord.go +++ b/pkg/channels/discord/discord.go @@ -45,6 +45,14 @@ type DiscordChannel struct { } func NewDiscordChannel(cfg config.DiscordConfig, bus *bus.MessageBus) (*DiscordChannel, error) { + discordgo.Logger = logger.NewLogger("discord"). + WithLevels(map[int]logger.LogLevel{ + discordgo.LogError: logger.ERROR, + discordgo.LogWarning: logger.WARN, + discordgo.LogInformational: logger.INFO, + discordgo.LogDebug: logger.DEBUG, + }).Log + session, err := discordgo.New("Bot " + cfg.Token) if err != nil { return nil, fmt.Errorf("failed to create discord session: %w", err) @@ -134,7 +142,7 @@ func (c *DiscordChannel) Send(ctx context.Context, msg bus.OutboundMessage) erro return nil } - return c.sendChunk(ctx, channelID, msg.Content) + return c.sendChunk(ctx, channelID, msg.Content, msg.ReplyToMessageID) } // SendMedia implements the channels.MediaSender interface. @@ -259,14 +267,29 @@ func (c *DiscordChannel) SendPlaceholder(ctx context.Context, chatID string) (st return msg.ID, nil } -func (c *DiscordChannel) sendChunk(ctx context.Context, channelID, content string) error { +func (c *DiscordChannel) sendChunk(ctx context.Context, channelID, content, replyToID string) error { // Use the passed ctx for timeout control sendCtx, cancel := context.WithTimeout(ctx, sendTimeout) defer cancel() done := make(chan error, 1) go func() { - _, err := c.session.ChannelMessageSend(channelID, content) + var err error + + // If we have an ID, we send the message as "Reply" + if replyToID != "" { + _, err = c.session.ChannelMessageSendComplex(channelID, &discordgo.MessageSend{ + Content: content, + Reference: &discordgo.MessageReference{ + MessageID: replyToID, + ChannelID: channelID, + }, + }) + } else { + // Otherwise, we send a normal message + _, err = c.session.ChannelMessageSend(channelID, content) + } + done <- err }() diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go index 1a24bb980..472895a7a 100644 --- a/pkg/channels/manager.go +++ b/pkg/channels/manager.go @@ -102,6 +102,27 @@ func (m *Manager) RecordPlaceholder(channel, chatID, placeholderID string) { m.placeholders.Store(key, placeholderEntry{id: placeholderID, createdAt: time.Now()}) } +// SendPlaceholder sends a "Thinking…" placeholder for the given channel/chatID +// and records it for later editing. Returns true if a placeholder was sent. +func (m *Manager) SendPlaceholder(ctx context.Context, channel, chatID string) bool { + m.mu.RLock() + ch, ok := m.channels[channel] + m.mu.RUnlock() + if !ok { + return false + } + pc, ok := ch.(PlaceholderCapable) + if !ok { + return false + } + phID, err := pc.SendPlaceholder(ctx, chatID) + if err != nil || phID == "" { + return false + } + m.RecordPlaceholder(channel, chatID, phID) + return true +} + // RecordTypingStop registers a typing stop function for later invocation. // Implements PlaceholderRecorder. func (m *Manager) RecordTypingStop(channel, chatID string, stop func()) { @@ -813,6 +834,39 @@ func (m *Manager) UnregisterChannel(name string) { delete(m.channels, name) } +// SendMessage sends an outbound message synchronously through the channel +// worker's rate limiter and retry logic. It blocks until the message is +// delivered (or all retries are exhausted), which preserves ordering when +// a subsequent operation depends on the message having been sent. +func (m *Manager) SendMessage(ctx context.Context, msg bus.OutboundMessage) error { + m.mu.RLock() + _, exists := m.channels[msg.Channel] + w, wExists := m.workers[msg.Channel] + m.mu.RUnlock() + + if !exists { + return fmt.Errorf("channel %s not found", msg.Channel) + } + if !wExists || w == nil { + return fmt.Errorf("channel %s has no active worker", msg.Channel) + } + + maxLen := 0 + if mlp, ok := w.ch.(MessageLengthProvider); ok { + maxLen = mlp.MaxMessageLength() + } + if maxLen > 0 && len([]rune(msg.Content)) > maxLen { + for _, chunk := range SplitMessage(msg.Content, maxLen) { + chunkMsg := msg + chunkMsg.Content = chunk + m.sendWithRetry(ctx, msg.Channel, w, chunkMsg) + } + } else { + m.sendWithRetry(ctx, msg.Channel, w, msg) + } + return nil +} + func (m *Manager) SendToChannel(ctx context.Context, channelName, chatID, content string) error { m.mu.RLock() _, exists := m.channels[channelName] diff --git a/pkg/channels/manager_test.go b/pkg/channels/manager_test.go index f09ecfe2f..1f3a628c2 100644 --- a/pkg/channels/manager_test.go +++ b/pkg/channels/manager_test.go @@ -17,16 +17,32 @@ import ( // mockChannel is a test double that delegates Send to a configurable function. type mockChannel struct { BaseChannel - sendFn func(ctx context.Context, msg bus.OutboundMessage) error + sendFn func(ctx context.Context, msg bus.OutboundMessage) error + sentMessages []bus.OutboundMessage + placeholdersSent int + editedMessages int + lastPlaceholderID string } func (m *mockChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { + m.sentMessages = append(m.sentMessages, msg) return m.sendFn(ctx, msg) } func (m *mockChannel) Start(ctx context.Context) error { return nil } func (m *mockChannel) Stop(ctx context.Context) error { return nil } +func (m *mockChannel) SendPlaceholder(ctx context.Context, chatID string) (string, error) { + m.placeholdersSent++ + m.lastPlaceholderID = "mock-ph-123" + return m.lastPlaceholderID, nil +} + +func (m *mockChannel) EditMessage(ctx context.Context, chatID, messageID, content string) error { + m.editedMessages++ + return nil +} + // newTestManager creates a minimal Manager suitable for unit tests. func newTestManager() *Manager { return &Manager{ @@ -860,3 +876,286 @@ func TestBuildMediaScope_WithMessageID(t *testing.T) { t.Fatalf("expected %s, got %s", expected, scope) } } + +func TestManager_PlaceholderConsumedByResponse(t *testing.T) { + mgr := &Manager{ + channels: make(map[string]Channel), + workers: make(map[string]*channelWorker), + placeholders: sync.Map{}, + } + + mockCh := &mockChannel{ + sendFn: func(ctx context.Context, msg bus.OutboundMessage) error { + return nil + }, + } + worker := newChannelWorker("mock", mockCh) + mgr.channels["mock"] = mockCh + mgr.workers["mock"] = worker + + ctx := context.Background() + key := "mock:chat-1" + + // Simulate a placeholder recorded by base.go HandleMessage + mgr.RecordPlaceholder("mock", "chat-1", "ph-123") + + if _, ok := mgr.placeholders.Load(key); !ok { + t.Fatal("expected placeholder to be recorded") + } + + // Transcription feedback arrives first — it should consume the placeholder + // and be delivered via EditMessage, not Send. + msgTranscript := bus.OutboundMessage{ + Channel: "mock", + ChatID: "chat-1", + Content: "Transcript: hello", + } + mgr.sendWithRetry(ctx, "mock", worker, msgTranscript) + + if mockCh.editedMessages != 1 { + t.Errorf("expected 1 edited message (placeholder consumed by transcript), got %d", mockCh.editedMessages) + } + if len(mockCh.sentMessages) != 0 { + t.Errorf("expected 0 normal messages (transcript used edit), got %d", len(mockCh.sentMessages)) + } + + // Placeholder should be gone now + if _, ok := mgr.placeholders.Load(key); ok { + t.Error("expected placeholder to be removed after being consumed") + } + + // Final LLM response arrives — no placeholder left, so it goes through Send + msgFinal := bus.OutboundMessage{ + Channel: "mock", + ChatID: "chat-1", + Content: "Final Answer", + } + mgr.sendWithRetry(ctx, "mock", worker, msgFinal) + + if len(mockCh.sentMessages) != 1 { + t.Errorf("expected 1 normal message sent, got %d", len(mockCh.sentMessages)) + } +} + +func TestSendMessage_Synchronous(t *testing.T) { + m := newTestManager() + + var received []bus.OutboundMessage + ch := &mockChannel{ + sendFn: func(_ context.Context, msg bus.OutboundMessage) error { + received = append(received, msg) + return nil + }, + } + + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + msg := bus.OutboundMessage{ + Channel: "test", + ChatID: "123", + Content: "hello world", + ReplyToMessageID: "msg-456", + } + + err := m.SendMessage(context.Background(), msg) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + // SendMessage is synchronous — message should already be delivered + if len(received) != 1 { + t.Fatalf("expected 1 message sent, got %d", len(received)) + } + if received[0].ReplyToMessageID != "msg-456" { + t.Fatalf("expected ReplyToMessageID msg-456, got %s", received[0].ReplyToMessageID) + } + if received[0].Content != "hello world" { + t.Fatalf("expected content 'hello world', got %s", received[0].Content) + } +} + +func TestSendMessage_UnknownChannel(t *testing.T) { + m := newTestManager() + + msg := bus.OutboundMessage{ + Channel: "nonexistent", + ChatID: "123", + Content: "hello", + } + + err := m.SendMessage(context.Background(), msg) + if err == nil { + t.Fatal("expected error for unknown channel") + } +} + +func TestSendMessage_NoWorker(t *testing.T) { + m := newTestManager() + + ch := &mockChannel{ + sendFn: func(_ context.Context, _ bus.OutboundMessage) error { return nil }, + } + m.channels["test"] = ch + // No worker registered + + msg := bus.OutboundMessage{ + Channel: "test", + ChatID: "123", + Content: "hello", + } + + err := m.SendMessage(context.Background(), msg) + if err == nil { + t.Fatal("expected error when no worker exists") + } +} + +func TestSendMessage_WithRetry(t *testing.T) { + m := newTestManager() + + var callCount int + ch := &mockChannel{ + sendFn: func(_ context.Context, _ bus.OutboundMessage) error { + callCount++ + if callCount == 1 { + return fmt.Errorf("transient: %w", ErrTemporary) + } + return nil + }, + } + + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + msg := bus.OutboundMessage{ + Channel: "test", + ChatID: "123", + Content: "retry me", + } + + err := m.SendMessage(context.Background(), msg) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + if callCount != 2 { + t.Fatalf("expected 2 Send calls (1 failure + 1 success), got %d", callCount) + } +} + +func TestSendMessage_WithSplitting(t *testing.T) { + m := newTestManager() + + var received []string + ch := &mockChannelWithLength{ + mockChannel: mockChannel{ + sendFn: func(_ context.Context, msg bus.OutboundMessage) error { + received = append(received, msg.Content) + return nil + }, + }, + maxLen: 5, + } + + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + msg := bus.OutboundMessage{ + Channel: "test", + ChatID: "123", + Content: "hello world", + } + + err := m.SendMessage(context.Background(), msg) + if err != nil { + t.Fatalf("expected no error, got %v", err) + } + + if len(received) < 2 { + t.Fatalf("expected message to be split into at least 2 chunks, got %d", len(received)) + } +} + +func TestSendMessage_PreservesOrdering(t *testing.T) { + m := newTestManager() + + var order []string + ch := &mockChannel{ + sendFn: func(_ context.Context, msg bus.OutboundMessage) error { + order = append(order, msg.Content) + return nil + }, + } + + w := &channelWorker{ + ch: ch, + limiter: rate.NewLimiter(rate.Inf, 1), + } + m.channels["test"] = ch + m.workers["test"] = w + + // Send two messages sequentially — they must arrive in order + _ = m.SendMessage(context.Background(), bus.OutboundMessage{ + Channel: "test", ChatID: "1", Content: "first", + }) + _ = m.SendMessage(context.Background(), bus.OutboundMessage{ + Channel: "test", ChatID: "1", Content: "second", + }) + + if len(order) != 2 { + t.Fatalf("expected 2 messages, got %d", len(order)) + } + if order[0] != "first" || order[1] != "second" { + t.Fatalf("expected [first, second], got %v", order) + } +} + +func TestManager_SendPlaceholder(t *testing.T) { + mgr := &Manager{ + channels: make(map[string]Channel), + workers: make(map[string]*channelWorker), + placeholders: sync.Map{}, + } + + mockCh := &mockChannel{ + sendFn: func(ctx context.Context, msg bus.OutboundMessage) error { + return nil + }, + } + mgr.channels["mock"] = mockCh + + ctx := context.Background() + + // SendPlaceholder should send a placeholder and record it + ok := mgr.SendPlaceholder(ctx, "mock", "chat-1") + if !ok { + t.Fatal("expected SendPlaceholder to succeed") + } + if mockCh.placeholdersSent != 1 { + t.Errorf("expected 1 placeholder sent, got %d", mockCh.placeholdersSent) + } + + key := "mock:chat-1" + if _, loaded := mgr.placeholders.Load(key); !loaded { + t.Error("expected placeholder to be recorded in manager") + } + + // SendPlaceholder on unknown channel should return false + ok = mgr.SendPlaceholder(ctx, "unknown", "chat-1") + if ok { + t.Error("expected SendPlaceholder to fail for unknown channel") + } +} diff --git a/pkg/channels/matrix/matrix.go b/pkg/channels/matrix/matrix.go index d51eee8fb..a45207f12 100644 --- a/pkg/channels/matrix/matrix.go +++ b/pkg/channels/matrix/matrix.go @@ -13,6 +13,9 @@ import ( "sync" "time" + "github.com/gomarkdown/markdown" + mdhtml "github.com/gomarkdown/markdown/html" + "github.com/gomarkdown/markdown/parser" "maunium.net/go/mautrix" "maunium.net/go/mautrix/event" "maunium.net/go/mautrix/id" @@ -268,6 +271,12 @@ func (c *MatrixChannel) Stop(ctx context.Context) error { return nil } +func markdownToHTML(md string) string { + p := parser.NewWithExtensions(parser.CommonExtensions | parser.AutoHeadingIDs) + renderer := mdhtml.NewRenderer(mdhtml.RendererOptions{Flags: mdhtml.CommonFlags}) + return strings.TrimSpace(string(markdown.ToHTML([]byte(md), p, renderer))) +} + func (c *MatrixChannel) Send(ctx context.Context, msg bus.OutboundMessage) error { if !c.IsRunning() { return channels.ErrNotRunning @@ -283,16 +292,22 @@ func (c *MatrixChannel) Send(ctx context.Context, msg bus.OutboundMessage) error return nil } - _, err := c.client.SendMessageEvent(ctx, roomID, event.EventMessage, &event.MessageEventContent{ - MsgType: event.MsgText, - Body: content, - }) + _, err := c.client.SendMessageEvent(ctx, roomID, event.EventMessage, c.messageContent(content)) if err != nil { return fmt.Errorf("matrix send: %w", channels.ErrTemporary) } return nil } +func (c *MatrixChannel) messageContent(text string) *event.MessageEventContent { + mc := &event.MessageEventContent{MsgType: event.MsgText, Body: text} + if c.config.MessageFormat != "plain" { + mc.Format = event.FormatHTML + mc.FormattedBody = markdownToHTML(text) + } + return mc +} + // SendMedia implements channels.MediaSender. func (c *MatrixChannel) SendMedia(ctx context.Context, msg bus.OutboundMediaMessage) error { if !c.IsRunning() { @@ -482,10 +497,7 @@ func (c *MatrixChannel) EditMessage(ctx context.Context, chatID string, messageI return fmt.Errorf("matrix message ID is empty") } - editContent := &event.MessageEventContent{ - MsgType: event.MsgText, - Body: content, - } + editContent := c.messageContent(content) editContent.SetEdit(id.EventID(messageID)) _, err := c.client.SendMessageEvent(ctx, roomID, event.EventMessage, editContent) diff --git a/pkg/channels/matrix/matrix_test.go b/pkg/channels/matrix/matrix_test.go index e76db0d3e..806a98739 100644 --- a/pkg/channels/matrix/matrix_test.go +++ b/pkg/channels/matrix/matrix_test.go @@ -4,12 +4,15 @@ import ( "context" "os" "path/filepath" + "strings" "testing" "time" "maunium.net/go/mautrix" "maunium.net/go/mautrix/event" "maunium.net/go/mautrix/id" + + "github.com/sipeed/picoclaw/pkg/config" ) func TestMatrixLocalpartMentionRegexp(t *testing.T) { @@ -289,3 +292,50 @@ func TestMatrixOutboundContent(t *testing.T) { t.Fatalf("unexpected fallback body: %q", noCaption.Body) } } + +func TestMarkdownToHTML(t *testing.T) { + tests := []struct { + name string + input string + contains string + }{ + {"bold", "**hello**", "hello"}, + {"italic", "_world_", "world"}, + {"header", "### Title", ""}, + {"inline code", "`x`", "x"}, + {"plain text", "just text", "just text"}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := markdownToHTML(tt.input) + if !strings.Contains(got, tt.contains) { + t.Fatalf("markdownToHTML(%q) = %q, want it to contain %q", tt.input, got, tt.contains) + } + }) + } +} + +func TestMessageContent(t *testing.T) { + richtext := &MatrixChannel{config: config.MatrixConfig{MessageFormat: "richtext"}} + plain := &MatrixChannel{config: config.MatrixConfig{MessageFormat: "plain"}} + defaultt := &MatrixChannel{config: config.MatrixConfig{}} + + for _, c := range []*MatrixChannel{richtext, defaultt} { + mc := c.messageContent("**hi**") + if mc.Format != event.FormatHTML { + t.Errorf("format %q: expected FormatHTML, got %q", c.config.MessageFormat, mc.Format) + } + if !strings.Contains(mc.FormattedBody, "hi") { + t.Errorf("format %q: FormattedBody %q missing ", c.config.MessageFormat, mc.FormattedBody) + } + if mc.Body != "**hi**" { + t.Errorf("format %q: Body should remain plain, got %q", c.config.MessageFormat, mc.Body) + } + } + + mc := plain.messageContent("**hi**") + if mc.Format != "" || mc.FormattedBody != "" { + t.Errorf("plain: expected no formatting, got format=%q formattedBody=%q", mc.Format, mc.FormattedBody) + } +} diff --git a/pkg/channels/qq/qq.go b/pkg/channels/qq/qq.go index 540e3b7af..73200f64e 100644 --- a/pkg/channels/qq/qq.go +++ b/pkg/channels/qq/qq.go @@ -78,6 +78,7 @@ func (c *QQChannel) Start(ctx context.Context) error { return fmt.Errorf("QQ app_id and app_secret not configured") } + botgo.SetLogger(logger.NewLogger("botgo")) logger.InfoC("qq", "Starting QQ bot (WebSocket mode)") // Reinitialize shutdown signal for clean restart. diff --git a/pkg/channels/slack/slack.go b/pkg/channels/slack/slack.go index 024b1b023..3ee849621 100644 --- a/pkg/channels/slack/slack.go +++ b/pkg/channels/slack/slack.go @@ -122,7 +122,11 @@ func (c *SlackChannel) Send(ctx context.Context, msg bus.OutboundMessage) error slack.MsgOptionText(msg.Content, false), } - if threadTS != "" { + if msg.ReplyToMessageID != "" && threadTS == "" { + // Answer to the message by creating a Thread under it + opts = append(opts, slack.MsgOptionTS(msg.ReplyToMessageID)) + } else if threadTS != "" { + // If we are already in a thread, continue in the thread opts = append(opts, slack.MsgOptionTS(threadTS)) } diff --git a/pkg/channels/telegram/telegram.go b/pkg/channels/telegram/telegram.go index b04beeb6e..34ee46b7b 100644 --- a/pkg/channels/telegram/telegram.go +++ b/pkg/channels/telegram/telegram.go @@ -77,6 +77,7 @@ func NewTelegramChannel(cfg *config.Config, bus *bus.MessageBus) (*TelegramChann if baseURL := strings.TrimRight(strings.TrimSpace(telegramCfg.BaseURL), "/"); baseURL != "" { opts = append(opts, telego.WithAPIServer(baseURL)) } + opts = append(opts, telego.WithLogger(logger.NewLogger("telego"))) bot, err := telego.NewBot(telegramCfg.Token, opts...) if err != nil { @@ -180,6 +181,7 @@ func (c *TelegramChannel) Send(ctx context.Context, msg bus.OutboundMessage) err // The Manager already splits messages to ≤4000 chars (WithMaxMessageLength), // so msg.Content is guaranteed to be within that limit. We still need to // check if HTML expansion pushes it beyond Telegram's 4096-char API limit. + replyToID := msg.ReplyToMessageID queue := []string{msg.Content} for len(queue) > 0 { chunk := queue[0] @@ -200,9 +202,11 @@ func (c *TelegramChannel) Send(ctx context.Context, msg bus.OutboundMessage) err continue } - if err := c.sendHTMLChunk(ctx, chatID, threadID, htmlContent, chunk); err != nil { + if err := c.sendHTMLChunk(ctx, chatID, threadID, htmlContent, chunk, replyToID); err != nil { return err } + // Only the first chunk should be a reply; subsequent chunks are normal messages. + replyToID = "" } return nil @@ -211,12 +215,20 @@ func (c *TelegramChannel) Send(ctx context.Context, msg bus.OutboundMessage) err // sendHTMLChunk sends a single HTML message, falling back to the original // markdown as plain text on parse failure so users never see raw HTML tags. func (c *TelegramChannel) sendHTMLChunk( - ctx context.Context, chatID int64, threadID int, htmlContent, mdFallback string, + ctx context.Context, chatID int64, threadID int, htmlContent, mdFallback string, replyToID string, ) error { tgMsg := tu.Message(tu.ID(chatID), htmlContent) tgMsg.ParseMode = telego.ModeHTML tgMsg.MessageThreadID = threadID + if replyToID != "" { + if mid, parseErr := strconv.Atoi(replyToID); parseErr == nil { + tgMsg.ReplyParameters = &telego.ReplyParameters{ + MessageID: mid, + } + } + } + if _, err := c.bot.SendMessage(ctx, tgMsg); err != nil { logger.ErrorCF("telegram", "HTML parse failed, falling back to plain text", map[string]any{ "error": err.Error(), diff --git a/pkg/channels/wecom/app_test.go b/pkg/channels/wecom/app_test.go index 7f230494f..7d07041ad 100644 --- a/pkg/channels/wecom/app_test.go +++ b/pkg/channels/wecom/app_test.go @@ -209,7 +209,7 @@ func TestWeComAppVerifySignature(t *testing.T) { } }) - t.Run("empty token skips verification", func(t *testing.T) { + t.Run("empty token rejects verification (fail-closed)", func(t *testing.T) { cfgEmpty := config.WeComAppConfig{ CorpID: "test_corp_id", CorpSecret: "test_secret", @@ -218,8 +218,8 @@ func TestWeComAppVerifySignature(t *testing.T) { } chEmpty, _ := NewWeComAppChannel(cfgEmpty, msgBus) - if !verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { - t.Error("empty token should skip verification and return true") + if verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { + t.Error("empty token should reject verification (fail-closed)") } }) } diff --git a/pkg/channels/wecom/bot_test.go b/pkg/channels/wecom/bot_test.go index c053578b1..d223bb6b6 100644 --- a/pkg/channels/wecom/bot_test.go +++ b/pkg/channels/wecom/bot_test.go @@ -189,8 +189,7 @@ func TestWeComBotVerifySignature(t *testing.T) { } }) - t.Run("empty token skips verification", func(t *testing.T) { - // Create a channel manually with empty token to test the behavior + t.Run("empty token rejects verification (fail-closed)", func(t *testing.T) { cfgEmpty := config.WeComConfig{ Token: "", WebhookURL: "https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=test", @@ -199,8 +198,8 @@ func TestWeComBotVerifySignature(t *testing.T) { config: cfgEmpty, } - if !verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { - t.Error("empty token should skip verification and return true") + if verifySignature(chEmpty.config.Token, "any_sig", "any_ts", "any_nonce", "any_msg") { + t.Error("empty token should reject verification (fail-closed)") } }) } diff --git a/pkg/channels/wecom/common.go b/pkg/channels/wecom/common.go index 6510e6f81..9a622a2fc 100644 --- a/pkg/channels/wecom/common.go +++ b/pkg/channels/wecom/common.go @@ -31,7 +31,7 @@ func computeSignature(token, timestamp, nonce, encrypt string) string { // This is a common function used by both WeCom Bot and WeCom App func verifySignature(token, msgSignature, timestamp, nonce, msgEncrypt string) bool { if token == "" { - return true // Skip verification if token is not set + return false } return computeSignature(token, timestamp, nonce, msgEncrypt) == msgSignature } diff --git a/pkg/config/config.go b/pkg/config/config.go index 13d5a7306..8bc46dfc4 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -4,12 +4,15 @@ import ( "encoding/json" "fmt" "os" + "path/filepath" "strings" "sync/atomic" "github.com/caarlos0/env/v11" + "github.com/sipeed/picoclaw/pkg" "github.com/sipeed/picoclaw/pkg/fileutil" + "github.com/sipeed/picoclaw/pkg/logger" ) // rrCounter is a global counter for round-robin load balancing across models. @@ -17,6 +20,8 @@ var rrCounter atomic.Uint64 // FlexibleStringSlice is a []string that also accepts JSON numbers, // so allow_from can contain both "123" and 123. +// It also supports parsing comma-separated strings from environment variables, +// including both English (,) and Chinese (，) commas. type FlexibleStringSlice []string func (f *FlexibleStringSlice) UnmarshalJSON(data []byte) error { @@ -48,17 +53,46 @@ func (f *FlexibleStringSlice) UnmarshalJSON(data []byte) error { return nil } +// UnmarshalText implements encoding.TextUnmarshaler to support env variable parsing. +// It handles comma-separated values with both English (,) and Chinese (，) commas. +func (f *FlexibleStringSlice) UnmarshalText(text []byte) error { + if len(text) == 0 { + *f = nil + return nil + } + + s := string(text) + // Replace Chinese comma with English comma, then split + s = strings.ReplaceAll(s, "，", ",") + parts := strings.Split(s, ",") + + result := make([]string, 0, len(parts)) + for _, part := range parts { + part = strings.TrimSpace(part) + if part != "" { + result = append(result, part) + } + } + *f = result + return nil +} + +// CurrentVersion is the latest config schema version +const CurrentVersion = 1 + +// Config is the current config structure with version support type Config struct { + Version int `json:"version"` // Config schema version for migration Agents AgentsConfig `json:"agents"` Bindings []AgentBinding `json:"bindings,omitempty"` Session SessionConfig `json:"session,omitempty"` Channels ChannelsConfig `json:"channels"` - Providers ProvidersConfig `json:"providers,omitempty"` ModelList []ModelConfig `json:"model_list"` // New model-centric provider configuration Gateway GatewayConfig `json:"gateway"` Tools ToolsConfig `json:"tools"` Heartbeat HeartbeatConfig `json:"heartbeat"` Devices DevicesConfig `json:"devices"` + Voice VoiceConfig `json:"voice"` // BuildInfo contains build-time version information BuildInfo BuildInfo `json:"build_info,omitempty"` } @@ -73,19 +107,14 @@ type BuildInfo struct { // MarshalJSON implements custom JSON marshaling for Config // to omit providers section when empty and session when empty -func (c Config) MarshalJSON() ([]byte, error) { +func (c *Config) MarshalJSON() ([]byte, error) { type Alias Config aux := &struct { Providers *ProvidersConfig `json:"providers,omitempty"` Session *SessionConfig `json:"session,omitempty"` *Alias }{ - Alias: (*Alias)(&c), - } - - // Only include providers if not empty - if !c.Providers.IsEmpty() { - aux.Providers = &c.Providers + Alias: (*Alias)(c), } // Only include session if not empty @@ -196,7 +225,6 @@ type AgentDefaults struct { AllowReadOutsideWorkspace bool `json:"allow_read_outside_workspace" env:"PICOCLAW_AGENTS_DEFAULTS_ALLOW_READ_OUTSIDE_WORKSPACE"` Provider string `json:"provider" env:"PICOCLAW_AGENTS_DEFAULTS_PROVIDER"` ModelName string `json:"model_name,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_MODEL_NAME"` - Model string `json:"model" env:"PICOCLAW_AGENTS_DEFAULTS_MODEL"` // Deprecated: use model_name instead ModelFallbacks []string `json:"model_fallbacks,omitempty"` ImageModel string `json:"image_model,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_IMAGE_MODEL"` ImageModelFallbacks []string `json:"image_model_fallbacks,omitempty"` @@ -221,10 +249,7 @@ func (d *AgentDefaults) GetMaxMediaSize() int { // GetModelName returns the effective model name for the agent defaults. // It prefers the new "model_name" field but falls back to "model" for backward compatibility. func (d *AgentDefaults) GetModelName() string { - if d.ModelName != "" { - return d.ModelName - } - return d.Model + return d.ModelName } type ChannelsConfig struct { @@ -349,16 +374,17 @@ type SlackConfig struct { } type MatrixConfig struct { - Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_MATRIX_ENABLED"` - Homeserver string `json:"homeserver" env:"PICOCLAW_CHANNELS_MATRIX_HOMESERVER"` - UserID string `json:"user_id" env:"PICOCLAW_CHANNELS_MATRIX_USER_ID"` - AccessToken string `json:"access_token" env:"PICOCLAW_CHANNELS_MATRIX_ACCESS_TOKEN"` - DeviceID string `json:"device_id,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_DEVICE_ID"` - JoinOnInvite bool `json:"join_on_invite" env:"PICOCLAW_CHANNELS_MATRIX_JOIN_ON_INVITE"` - AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_MATRIX_ALLOW_FROM"` + Enabled bool `json:"enabled" env:"PICOCLAW_CHANNELS_MATRIX_ENABLED"` + Homeserver string `json:"homeserver" env:"PICOCLAW_CHANNELS_MATRIX_HOMESERVER"` + UserID string `json:"user_id" env:"PICOCLAW_CHANNELS_MATRIX_USER_ID"` + AccessToken string `json:"access_token" env:"PICOCLAW_CHANNELS_MATRIX_ACCESS_TOKEN"` + DeviceID string `json:"device_id,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_DEVICE_ID"` + JoinOnInvite bool `json:"join_on_invite" env:"PICOCLAW_CHANNELS_MATRIX_JOIN_ON_INVITE"` + MessageFormat string `json:"message_format,omitempty" env:"PICOCLAW_CHANNELS_MATRIX_MESSAGE_FORMAT"` + AllowFrom FlexibleStringSlice `json:"allow_from" env:"PICOCLAW_CHANNELS_MATRIX_ALLOW_FROM"` GroupTrigger GroupTriggerConfig `json:"group_trigger,omitempty"` Placeholder PlaceholderConfig `json:"placeholder,omitempty"` - ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_MATRIX_REASONING_CHANNEL_ID"` + ReasoningChannelID string `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_MATRIX_REASONING_CHANNEL_ID"` } type LINEConfig struct { @@ -472,6 +498,10 @@ type DevicesConfig struct { MonitorUSB bool `json:"monitor_usb" env:"PICOCLAW_DEVICES_MONITOR_USB"` } +type VoiceConfig struct { + EchoTranscription bool `json:"echo_transcription" env:"PICOCLAW_VOICE_ECHO_TRANSCRIPTION"` +} + type ProvidersConfig struct { Anthropic ProviderConfig `json:"anthropic"` OpenAI OpenAIProviderConfig `json:"openai"` @@ -495,6 +525,7 @@ type ProvidersConfig struct { Mistral ProviderConfig `json:"mistral"` Avian ProviderConfig `json:"avian"` Minimax ProviderConfig `json:"minimax"` + LongCat ProviderConfig `json:"longcat"` } // IsEmpty checks if all provider configs are empty (no API keys or API bases set) @@ -521,7 +552,8 @@ func (p ProvidersConfig) IsEmpty() bool { p.Qwen.APIKey == "" && p.Qwen.APIBase == "" && p.Mistral.APIKey == "" && p.Mistral.APIBase == "" && p.Avian.APIKey == "" && p.Avian.APIBase == "" && - p.Minimax.APIKey == "" && p.Minimax.APIBase == "" + p.Minimax.APIKey == "" && p.Minimax.APIBase == "" && + p.LongCat.APIKey == "" && p.LongCat.APIBase == "" } // MarshalJSON implements custom JSON marshaling for ProvidersConfig @@ -668,6 +700,7 @@ type CronToolsConfig struct { type ExecConfig struct { ToolConfig ` envPrefix:"PICOCLAW_TOOLS_EXEC_"` EnableDenyPatterns bool ` env:"PICOCLAW_TOOLS_EXEC_ENABLE_DENY_PATTERNS" json:"enable_deny_patterns"` + AllowRemote bool ` env:"PICOCLAW_TOOLS_EXEC_ALLOW_REMOTE" json:"allow_remote"` CustomDenyPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_DENY_PATTERNS" json:"custom_deny_patterns"` CustomAllowPatterns []string ` env:"PICOCLAW_TOOLS_EXEC_CUSTOM_ALLOW_PATTERNS" json:"custom_allow_patterns"` TimeoutSeconds int ` env:"PICOCLAW_TOOLS_EXEC_TIMEOUT_SECONDS" json:"timeout_seconds"` // 0 means use default (60s) @@ -766,44 +799,53 @@ type MCPConfig struct { } func LoadConfig(path string) (*Config, error) { - cfg := DefaultConfig() - data, err := os.ReadFile(path) if err != nil { if os.IsNotExist(err) { - return cfg, nil + return DefaultConfig(), nil } return nil, err } - // Pre-scan the JSON to check how many model_list entries the user provided. - // Go's JSON decoder reuses existing slice backing-array elements rather than - // zero-initializing them, so fields absent from the user's JSON (e.g. api_base) - // would silently inherit values from the DefaultConfig template at the same - // index position. We only reset cfg.ModelList when the user actually provides - // entries; when count is 0 we keep DefaultConfig's built-in list as fallback. - var tmp Config - if err := json.Unmarshal(data, &tmp); err != nil { - return nil, err + // First, try to detect config version by reading the version field + var versionInfo struct { + Version int `json:"version"` } - if len(tmp.ModelList) > 0 { - cfg.ModelList = nil + if e := json.Unmarshal(data, &versionInfo); e != nil { + return nil, fmt.Errorf("failed to detect config version: %w", e) } - if err := json.Unmarshal(data, cfg); err != nil { - return nil, err + // Load config based on detected version + var cfg *Config + switch versionInfo.Version { + case 0: + // Legacy config (no version field) + v, e := loadConfigV0(data) + if e != nil { + return nil, e + } + cfg, e = v.Migrate() + if e != nil { + logger.DebugF("config migrate fail", map[string]any{"from": versionInfo.Version, "to": CurrentVersion}) + return nil, e + } + logger.DebugF("config migrate success", map[string]any{"from": versionInfo.Version, "to": CurrentVersion}) + defer func() { + _ = SaveConfig(path, cfg) + }() + case CurrentVersion: + // Current version + cfg, err = loadConfig(data) + if err != nil { + return nil, err + } + default: + return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version) } - if err := env.Parse(cfg); err != nil { - return nil, err - } - - // Migrate legacy channel config fields to new unified structures - cfg.migrateChannelConfigs() - - // Auto-migrate: if only legacy providers config exists, convert to model_list - if len(cfg.ModelList) == 0 && cfg.HasProvidersConfig() { - cfg.ModelList = ConvertProvidersToModelList(cfg) + // Apply environment variables + if e := env.Parse(cfg); e != nil { + return nil, e } // Validate model_list for uniqueness and required fields @@ -811,23 +853,26 @@ func LoadConfig(path string) (*Config, error) { return nil, err } + // Ensure Workspace has a default if not set + if cfg.Agents.Defaults.Workspace == "" { + homePath, _ := os.UserHomeDir() + if picoclawHome := os.Getenv(pkg.PicoClawHome); picoclawHome != "" { + homePath = picoclawHome + } else if homePath != "" { + homePath = filepath.Join(homePath, pkg.DefaultPicoClawHome) + } + cfg.Agents.Defaults.Workspace = filepath.Join(homePath, pkg.WorkspaceName) + } + return cfg, nil } -func (c *Config) migrateChannelConfigs() { - // Discord: mention_only -> group_trigger.mention_only - if c.Channels.Discord.MentionOnly && !c.Channels.Discord.GroupTrigger.MentionOnly { - c.Channels.Discord.GroupTrigger.MentionOnly = true - } - - // OneBot: group_trigger_prefix -> group_trigger.prefixes - if len(c.Channels.OneBot.GroupTriggerPrefix) > 0 && - len(c.Channels.OneBot.GroupTrigger.Prefixes) == 0 { - c.Channels.OneBot.GroupTrigger.Prefixes = c.Channels.OneBot.GroupTriggerPrefix - } -} - func SaveConfig(path string, cfg *Config) error { + // Ensure version is always set when saving + if cfg.Version == 0 { + cfg.Version = CurrentVersion + } + data, err := json.MarshalIndent(cfg, "", " ") if err != nil { return err @@ -841,53 +886,6 @@ func (c *Config) WorkspacePath() string { return expandHome(c.Agents.Defaults.Workspace) } -func (c *Config) GetAPIKey() string { - if c.Providers.OpenRouter.APIKey != "" { - return c.Providers.OpenRouter.APIKey - } - if c.Providers.Anthropic.APIKey != "" { - return c.Providers.Anthropic.APIKey - } - if c.Providers.OpenAI.APIKey != "" { - return c.Providers.OpenAI.APIKey - } - if c.Providers.Gemini.APIKey != "" { - return c.Providers.Gemini.APIKey - } - if c.Providers.Zhipu.APIKey != "" { - return c.Providers.Zhipu.APIKey - } - if c.Providers.Groq.APIKey != "" { - return c.Providers.Groq.APIKey - } - if c.Providers.VLLM.APIKey != "" { - return c.Providers.VLLM.APIKey - } - if c.Providers.ShengSuanYun.APIKey != "" { - return c.Providers.ShengSuanYun.APIKey - } - if c.Providers.Cerebras.APIKey != "" { - return c.Providers.Cerebras.APIKey - } - return "" -} - -func (c *Config) GetAPIBase() string { - if c.Providers.OpenRouter.APIKey != "" { - if c.Providers.OpenRouter.APIBase != "" { - return c.Providers.OpenRouter.APIBase - } - return "https://openrouter.ai/api/v1" - } - if c.Providers.Zhipu.APIKey != "" { - return c.Providers.Zhipu.APIBase - } - if c.Providers.VLLM.APIKey != "" && c.Providers.VLLM.APIBase != "" { - return c.Providers.VLLM.APIBase - } - return "" -} - func expandHome(path string) string { if path == "" { return path @@ -930,11 +928,6 @@ func (c *Config) findMatches(modelName string) []ModelConfig { return matches } -// HasProvidersConfig checks if any provider in the old providers config has configuration. -func (c *Config) HasProvidersConfig() bool { - return !c.Providers.IsEmpty() -} - // ValidateModelList validates all ModelConfig entries in the model_list. // It checks that each model config is valid. // Note: Multiple entries with the same model_name are allowed for load balancing. diff --git a/pkg/config/config_old.go b/pkg/config/config_old.go new file mode 100644 index 000000000..782c3dc44 --- /dev/null +++ b/pkg/config/config_old.go @@ -0,0 +1,108 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package config + +type agentDefaultsV0 struct { + Workspace string `json:"workspace" env:"PICOCLAW_AGENTS_DEFAULTS_WORKSPACE"` + RestrictToWorkspace bool `json:"restrict_to_workspace" env:"PICOCLAW_AGENTS_DEFAULTS_RESTRICT_TO_WORKSPACE"` + AllowReadOutsideWorkspace bool `json:"allow_read_outside_workspace" env:"PICOCLAW_AGENTS_DEFAULTS_ALLOW_READ_OUTSIDE_WORKSPACE"` + Provider string `json:"provider" env:"PICOCLAW_AGENTS_DEFAULTS_PROVIDER"` + ModelName string `json:"model_name,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_MODEL_NAME"` + Model string `json:"model" env:"PICOCLAW_AGENTS_DEFAULTS_MODEL"` // Deprecated: use model_name instead + ModelFallbacks []string `json:"model_fallbacks,omitempty"` + ImageModel string `json:"image_model,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_IMAGE_MODEL"` + ImageModelFallbacks []string `json:"image_model_fallbacks,omitempty"` + MaxTokens int `json:"max_tokens" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_TOKENS"` + Temperature *float64 `json:"temperature,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_TEMPERATURE"` + MaxToolIterations int `json:"max_tool_iterations" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_TOOL_ITERATIONS"` + SummarizeMessageThreshold int `json:"summarize_message_threshold" env:"PICOCLAW_AGENTS_DEFAULTS_SUMMARIZE_MESSAGE_THRESHOLD"` + SummarizeTokenPercent int `json:"summarize_token_percent" env:"PICOCLAW_AGENTS_DEFAULTS_SUMMARIZE_TOKEN_PERCENT"` + MaxMediaSize int `json:"max_media_size,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_MEDIA_SIZE"` + Routing *RoutingConfig `json:"routing,omitempty"` +} + +// GetModelName returns the effective model name for the agent defaults. +// It prefers the new "model_name" field but falls back to "model" for backward compatibility. +func (d *agentDefaultsV0) GetModelName() string { + if d.ModelName != "" { + return d.ModelName + } + return d.Model +} + +type agentsConfigV0 struct { + Defaults agentDefaultsV0 `json:"defaults"` + List []AgentConfig `json:"list,omitempty"` +} + +// configV0 represents the config structure before versioning was introduced. +// This struct is used for loading legacy config files (version 0). +// It is unexported since it's only used internally for migration. +type configV0 struct { + Agents agentsConfigV0 `json:"agents"` + Bindings []AgentBinding `json:"bindings,omitempty"` + Session SessionConfig `json:"session,omitempty"` + Channels ChannelsConfig `json:"channels"` + Providers ProvidersConfig `json:"providers,omitempty"` + ModelList []ModelConfig `json:"model_list"` + Gateway GatewayConfig `json:"gateway"` + Tools ToolsConfig `json:"tools"` + Heartbeat HeartbeatConfig `json:"heartbeat"` + Devices DevicesConfig `json:"devices"` +} + +func (c *configV0) migrateChannelConfigs() { + // Discord: mention_only -> group_trigger.mention_only + if c.Channels.Discord.MentionOnly && !c.Channels.Discord.GroupTrigger.MentionOnly { + c.Channels.Discord.GroupTrigger.MentionOnly = true + } + + // OneBot: group_trigger_prefix -> group_trigger.prefixes + if len(c.Channels.OneBot.GroupTriggerPrefix) > 0 && + len(c.Channels.OneBot.GroupTrigger.Prefixes) == 0 { + c.Channels.OneBot.GroupTrigger.Prefixes = c.Channels.OneBot.GroupTriggerPrefix + } +} + +func (c *configV0) Migrate() (*Config, error) { + // Migrate legacy channel config fields to new unified structures + cfg := DefaultConfig() + + // Always copy user's Agents config to preserve settings like Provider, Model, MaxTokens + cfg.Agents.List = c.Agents.List + cfg.Agents.Defaults.Workspace = c.Agents.Defaults.Workspace + cfg.Agents.Defaults.RestrictToWorkspace = c.Agents.Defaults.RestrictToWorkspace + cfg.Agents.Defaults.AllowReadOutsideWorkspace = c.Agents.Defaults.AllowReadOutsideWorkspace + cfg.Agents.Defaults.Provider = c.Agents.Defaults.Provider + cfg.Agents.Defaults.ModelName = c.Agents.Defaults.GetModelName() + cfg.Agents.Defaults.ModelFallbacks = c.Agents.Defaults.ModelFallbacks + cfg.Agents.Defaults.ImageModel = c.Agents.Defaults.ImageModel + cfg.Agents.Defaults.ImageModelFallbacks = c.Agents.Defaults.ImageModelFallbacks + cfg.Agents.Defaults.MaxTokens = c.Agents.Defaults.MaxTokens + cfg.Agents.Defaults.Temperature = c.Agents.Defaults.Temperature + cfg.Agents.Defaults.MaxToolIterations = c.Agents.Defaults.MaxToolIterations + cfg.Agents.Defaults.SummarizeMessageThreshold = c.Agents.Defaults.SummarizeMessageThreshold + cfg.Agents.Defaults.SummarizeTokenPercent = c.Agents.Defaults.SummarizeTokenPercent + cfg.Agents.Defaults.MaxMediaSize = c.Agents.Defaults.MaxMediaSize + cfg.Agents.Defaults.Routing = c.Agents.Defaults.Routing + + // Copy other top-level fields + cfg.Bindings = c.Bindings + cfg.Session = c.Session + cfg.Channels = c.Channels + cfg.Gateway = c.Gateway + cfg.Tools = c.Tools + cfg.Heartbeat = c.Heartbeat + cfg.Devices = c.Devices + + // Only override ModelList if user provided values + if len(c.ModelList) > 0 { + cfg.ModelList = c.ModelList + } + + cfg.Version = CurrentVersion + return cfg, nil +} diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 8baf3e6fd..8f495d5ec 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -5,7 +5,6 @@ import ( "os" "path/filepath" "runtime" - "strings" "testing" ) @@ -207,15 +206,6 @@ func TestDefaultConfig_WorkspacePath(t *testing.T) { } } -// TestDefaultConfig_Model verifies model is set -func TestDefaultConfig_Model(t *testing.T) { - cfg := DefaultConfig() - - if cfg.Agents.Defaults.Model != "" { - t.Error("Model should be empty") - } -} - // TestDefaultConfig_MaxTokens verifies max tokens has default value func TestDefaultConfig_MaxTokens(t *testing.T) { cfg := DefaultConfig() @@ -255,21 +245,6 @@ func TestDefaultConfig_Gateway(t *testing.T) { } } -// TestDefaultConfig_Providers verifies provider structure -func TestDefaultConfig_Providers(t *testing.T) { - cfg := DefaultConfig() - - if cfg.Providers.Anthropic.APIKey != "" { - t.Error("Anthropic API key should be empty by default") - } - if cfg.Providers.OpenAI.APIKey != "" { - t.Error("OpenAI API key should be empty by default") - } - if cfg.Providers.OpenRouter.APIKey != "" { - t.Error("OpenRouter API key should be empty by default") - } -} - // TestDefaultConfig_Channels verifies channels are disabled by default func TestDefaultConfig_Channels(t *testing.T) { cfg := DefaultConfig() @@ -328,25 +303,6 @@ func TestSaveConfig_FilePermissions(t *testing.T) { } } -func TestSaveConfig_IncludesEmptyLegacyModelField(t *testing.T) { - tmpDir := t.TempDir() - path := filepath.Join(tmpDir, "config.json") - - cfg := DefaultConfig() - if err := SaveConfig(path, cfg); err != nil { - t.Fatalf("SaveConfig failed: %v", err) - } - - data, err := os.ReadFile(path) - if err != nil { - t.Fatalf("ReadFile failed: %v", err) - } - - if !strings.Contains(string(data), `"model": ""`) { - t.Fatalf("saved config should include empty legacy model field, got: %s", string(data)) - } -} - // TestConfig_Complete verifies all config fields are set func TestConfig_Complete(t *testing.T) { cfg := DefaultConfig() @@ -354,9 +310,6 @@ func TestConfig_Complete(t *testing.T) { if cfg.Agents.Defaults.Workspace == "" { t.Error("Workspace should not be empty") } - if cfg.Agents.Defaults.Model != "" { - t.Error("Model should be empty") - } if cfg.Agents.Defaults.Temperature != nil { t.Error("Temperature should be nil when not provided") } @@ -375,19 +328,23 @@ func TestConfig_Complete(t *testing.T) { if !cfg.Heartbeat.Enabled { t.Error("Heartbeat should be enabled by default") } + if !cfg.Tools.Exec.AllowRemote { + t.Error("Exec.AllowRemote should be true by default") + } } -func TestDefaultConfig_OpenAIWebSearchEnabled(t *testing.T) { +func TestDefaultConfig_ExecAllowRemoteEnabled(t *testing.T) { cfg := DefaultConfig() - if !cfg.Providers.OpenAI.WebSearch { - t.Fatal("DefaultConfig().Providers.OpenAI.WebSearch should be true") + if !cfg.Tools.Exec.AllowRemote { + t.Fatal("DefaultConfig().Tools.Exec.AllowRemote should be true") } } -func TestLoadConfig_OpenAIWebSearchDefaultsTrueWhenUnset(t *testing.T) { +func TestLoadConfig_ExecAllowRemoteDefaultsTrueWhenUnset(t *testing.T) { dir := t.TempDir() configPath := filepath.Join(dir, "config.json") - if err := os.WriteFile(configPath, []byte(`{"providers":{"openai":{"api_base":""}}}`), 0o600); err != nil { + if err := os.WriteFile(configPath, []byte(`{"version":1,"tools":{"exec":{"enable_deny_patterns":true}}}`), + 0o600); err != nil { t.Fatalf("WriteFile() error: %v", err) } @@ -395,24 +352,8 @@ func TestLoadConfig_OpenAIWebSearchDefaultsTrueWhenUnset(t *testing.T) { if err != nil { t.Fatalf("LoadConfig() error: %v", err) } - if !cfg.Providers.OpenAI.WebSearch { - t.Fatal("OpenAI codex web search should remain true when unset in config file") - } -} - -func TestLoadConfig_OpenAIWebSearchCanBeDisabled(t *testing.T) { - dir := t.TempDir() - configPath := filepath.Join(dir, "config.json") - if err := os.WriteFile(configPath, []byte(`{"providers":{"openai":{"web_search":false}}}`), 0o600); err != nil { - t.Fatalf("WriteFile() error: %v", err) - } - - cfg, err := LoadConfig(configPath) - if err != nil { - t.Fatalf("LoadConfig() error: %v", err) - } - if cfg.Providers.OpenAI.WebSearch { - t.Fatal("OpenAI codex web search should be false when disabled in config file") + if !cfg.Tools.Exec.AllowRemote { + t.Fatal("tools.exec.allow_remote should remain true when unset in config file") } } @@ -482,3 +423,119 @@ func TestDefaultConfig_WorkspacePath_WithPicoclawHome(t *testing.T) { t.Errorf("Workspace path with PICOCLAW_HOME = %q, want %q", cfg.Agents.Defaults.Workspace, want) } } + +// TestFlexibleStringSlice_UnmarshalText tests UnmarshalText with various comma separators +func TestFlexibleStringSlice_UnmarshalText(t *testing.T) { + tests := []struct { + name string + input string + expected []string + }{ + { + name: "English commas only", + input: "123,456,789", + expected: []string{"123", "456", "789"}, + }, + { + name: "Chinese commas only", + input: "123，456，789", + expected: []string{"123", "456", "789"}, + }, + { + name: "Mixed English and Chinese commas", + input: "123,456，789", + expected: []string{"123", "456", "789"}, + }, + { + name: "Single value", + input: "123", + expected: []string{"123"}, + }, + { + name: "Values with whitespace", + input: " 123 , 456 , 789 ", + expected: []string{"123", "456", "789"}, + }, + { + name: "Empty string", + input: "", + expected: nil, + }, + { + name: "Only commas - English", + input: ",,", + expected: []string{}, + }, + { + name: "Only commas - Chinese", + input: "，，", + expected: []string{}, + }, + { + name: "Mixed commas with empty parts", + input: "123,,456，，789", + expected: []string{"123", "456", "789"}, + }, + { + name: "Complex mixed values", + input: "user1@example.com，user2@test.com, admin@domain.org", + expected: []string{"user1@example.com", "user2@test.com", "admin@domain.org"}, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + var f FlexibleStringSlice + err := f.UnmarshalText([]byte(tt.input)) + if err != nil { + t.Fatalf("UnmarshalText(%q) error = %v", tt.input, err) + } + + if tt.expected == nil { + if f != nil { + t.Errorf("UnmarshalText(%q) = %v, want nil", tt.input, f) + } + return + } + + if len(f) != len(tt.expected) { + t.Errorf("UnmarshalText(%q) length = %d, want %d", tt.input, len(f), len(tt.expected)) + return + } + + for i, v := range tt.expected { + if f[i] != v { + t.Errorf("UnmarshalText(%q)[%d] = %q, want %q", tt.input, i, f[i], v) + } + } + }) + } +} + +// TestFlexibleStringSlice_UnmarshalText_EmptySliceConsistency tests nil vs empty slice behavior +func TestFlexibleStringSlice_UnmarshalText_EmptySliceConsistency(t *testing.T) { + t.Run("Empty string returns nil", func(t *testing.T) { + var f FlexibleStringSlice + err := f.UnmarshalText([]byte("")) + if err != nil { + t.Fatalf("UnmarshalText error = %v", err) + } + if f != nil { + t.Errorf("Empty string should return nil, got %v", f) + } + }) + + t.Run("Commas only returns empty slice", func(t *testing.T) { + var f FlexibleStringSlice + err := f.UnmarshalText([]byte(",,,")) + if err != nil { + t.Fatalf("UnmarshalText error = %v", err) + } + if f == nil { + t.Error("Commas only should return empty slice, not nil") + } + if len(f) != 0 { + t.Errorf("Expected empty slice, got %v", f) + } + }) +} diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 5bb3bd1d6..938f74e73 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -8,6 +8,8 @@ package config import ( "os" "path/filepath" + + "github.com/sipeed/picoclaw/pkg" ) // DefaultConfig returns the default configuration for PicoClaw. @@ -15,21 +17,21 @@ func DefaultConfig() *Config { // Determine the base path for the workspace. // Priority: $PICOCLAW_HOME > ~/.picoclaw var homePath string - if picoclawHome := os.Getenv("PICOCLAW_HOME"); picoclawHome != "" { + if picoclawHome := os.Getenv(pkg.PicoClawHome); picoclawHome != "" { homePath = picoclawHome } else { userHome, _ := os.UserHomeDir() - homePath = filepath.Join(userHome, ".picoclaw") + homePath = filepath.Join(userHome, pkg.DefaultPicoClawHome) } - workspacePath := filepath.Join(homePath, "workspace") + workspacePath := filepath.Join(homePath, pkg.WorkspaceName) return &Config{ + Version: CurrentVersion, Agents: AgentsConfig{ Defaults: AgentDefaults{ Workspace: workspacePath, RestrictToWorkspace: true, Provider: "", - Model: "", MaxTokens: 32768, Temperature: nil, // nil means use provider default MaxToolIterations: 50, @@ -176,9 +178,6 @@ func DefaultConfig() *Config { AllowFrom: FlexibleStringSlice{}, }, }, - Providers: ProvidersConfig{ - OpenAI: OpenAIProviderConfig{WebSearch: true}, - }, ModelList: []ModelConfig{ // ============================================ // Add your API key to the model you want to use @@ -355,6 +354,14 @@ func DefaultConfig() *Config { APIKey: "", }, + // LongCat - https://longcat.chat/platform + { + ModelName: "LongCat-Flash-Thinking", + Model: "longcat/LongCat-Flash-Thinking", + APIBase: "https://api.longcat.chat/openai", + APIKey: "", + }, + // VLLM (local) - http://localhost:8000 { ModelName: "local-model", @@ -427,6 +434,7 @@ func DefaultConfig() *Config { Enabled: true, }, EnableDenyPatterns: true, + AllowRemote: true, TimeoutSeconds: 60, }, Skills: SkillsToolsConfig{ @@ -510,6 +518,9 @@ func DefaultConfig() *Config { Enabled: false, MonitorUSB: true, }, + Voice: VoiceConfig{ + EchoTranscription: false, + }, BuildInfo: BuildInfo{ Version: Version, GitCommit: GitCommit, diff --git a/pkg/config/migration.go b/pkg/config/migration.go index 51f21e4f4..4ce02d401 100644 --- a/pkg/config/migration.go +++ b/pkg/config/migration.go @@ -6,10 +6,15 @@ package config import ( + "encoding/json" "slices" "strings" ) +type migratable interface { + Migrate() (*Config, error) +} + // buildModelWithProtocol constructs a model string with protocol prefix. // If the model already contains a "/" (indicating it has a protocol prefix), it is returned as-is. // Otherwise, the protocol prefix is added. @@ -21,24 +26,24 @@ func buildModelWithProtocol(protocol, model string) string { return protocol + "/" + model } -// providerMigrationConfig defines how to migrate a provider from old config to new format. -type providerMigrationConfig struct { - // providerNames are the possible names used in agents.defaults.provider - providerNames []string - // protocol is the protocol prefix for the model field - protocol string - // buildConfig creates the ModelConfig from ProviderConfig - buildConfig func(p ProvidersConfig) (ModelConfig, bool) -} - -// ConvertProvidersToModelList converts the old ProvidersConfig to a slice of ModelConfig. +// v0ConvertProvidersToModelList converts the old ProvidersConfig to a slice of ModelConfig. // This enables backward compatibility with existing configurations. // It preserves the user's configured model from agents.defaults.model when possible. -func ConvertProvidersToModelList(cfg *Config) []ModelConfig { +func v0ConvertProvidersToModelList(cfg *configV0) []ModelConfig { if cfg == nil { return nil } + // providerMigrationConfig defines how to migrate a provider from old config to new format. + type providerMigrationConfig struct { + // providerNames are the possible names used in agents.defaults.provider + providerNames []string + // protocol is the protocol prefix for the model field + protocol string + // buildConfig creates the ModelConfig from ProviderConfig + buildConfig func(p ProvidersConfig) (ModelConfig, bool) + } + // Get user's configured provider and model userProvider := strings.ToLower(cfg.Agents.Defaults.Provider) userModel := cfg.Agents.Defaults.GetModelName() @@ -407,6 +412,23 @@ func ConvertProvidersToModelList(cfg *Config) []ModelConfig { }, true }, }, + { + providerNames: []string{"longcat"}, + protocol: "longcat", + buildConfig: func(p ProvidersConfig) (ModelConfig, bool) { + if p.LongCat.APIKey == "" && p.LongCat.APIBase == "" { + return ModelConfig{}, false + } + return ModelConfig{ + ModelName: "longcat", + Model: "longcat/LongCat-Flash-Thinking", + APIKey: p.LongCat.APIKey, + APIBase: p.LongCat.APIBase, + Proxy: p.LongCat.Proxy, + RequestTimeout: p.LongCat.RequestTimeout, + }, true + }, + }, } // Process each provider migration @@ -434,3 +456,44 @@ func ConvertProvidersToModelList(cfg *Config) []ModelConfig { return result } + +// loadConfigV0 loads a legacy config (no version field) +func loadConfigV0(data []byte) (migratable, error) { + var v0 configV0 + if err := json.Unmarshal(data, &v0); err != nil { + return nil, err + } + + v0.migrateChannelConfigs() + + // Auto-migrate: if only legacy providers config exists, convert to model_list + if len(v0.ModelList) == 0 && !v0.Providers.IsEmpty() { + v0.ModelList = v0ConvertProvidersToModelList(&v0) + } + + return &v0, nil +} + +// loadConfigV1 loads a version 1 config (current schema) +func loadConfig(data []byte) (*Config, error) { + cfg := DefaultConfig() + + // Pre-scan the JSON to check how many model_list entries the user provided. + // Go's JSON decoder reuses existing slice backing-array elements rather than + // zero-initializing them, so fields absent from the user's JSON (e.g. api_base) + // would silently inherit values from the DefaultConfig template at the same + // index position. We only reset cfg.ModelList when the user actually provides + // entries; when count is 0 we keep DefaultConfig's built-in list as fallback. + var tmp Config + if err := json.Unmarshal(data, &tmp); err != nil { + return nil, err + } + if len(tmp.ModelList) > 0 { + cfg.ModelList = nil + } + + if err := json.Unmarshal(data, cfg); err != nil { + return nil, err + } + return cfg, nil +} diff --git a/pkg/config/migration_test.go b/pkg/config/migration_test.go index d3019aab0..edf873b35 100644 --- a/pkg/config/migration_test.go +++ b/pkg/config/migration_test.go @@ -11,7 +11,7 @@ import ( ) func TestConvertProvidersToModelList_OpenAI(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ ProviderConfig: ProviderConfig{ @@ -22,7 +22,7 @@ func TestConvertProvidersToModelList_OpenAI(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -40,7 +40,7 @@ func TestConvertProvidersToModelList_OpenAI(t *testing.T) { } func TestConvertProvidersToModelList_Anthropic(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ Anthropic: ProviderConfig{ APIKey: "ant-key", @@ -49,7 +49,7 @@ func TestConvertProvidersToModelList_Anthropic(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -64,7 +64,7 @@ func TestConvertProvidersToModelList_Anthropic(t *testing.T) { } func TestConvertProvidersToModelList_LiteLLM(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ LiteLLM: ProviderConfig{ APIKey: "litellm-key", @@ -73,7 +73,7 @@ func TestConvertProvidersToModelList_LiteLLM(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -91,7 +91,7 @@ func TestConvertProvidersToModelList_LiteLLM(t *testing.T) { } func TestConvertProvidersToModelList_Multiple(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "openai-key"}}, Groq: ProviderConfig{APIKey: "groq-key"}, @@ -99,7 +99,7 @@ func TestConvertProvidersToModelList_Multiple(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 3 { t.Fatalf("len(result) = %d, want 3", len(result)) @@ -119,11 +119,11 @@ func TestConvertProvidersToModelList_Multiple(t *testing.T) { } func TestConvertProvidersToModelList_Empty(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{}, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 0 { t.Errorf("len(result) = %d, want 0", len(result)) @@ -131,7 +131,7 @@ func TestConvertProvidersToModelList_Empty(t *testing.T) { } func TestConvertProvidersToModelList_Nil(t *testing.T) { - result := ConvertProvidersToModelList(nil) + result := v0ConvertProvidersToModelList(nil) if result != nil { t.Errorf("result = %v, want nil", result) @@ -139,7 +139,7 @@ func TestConvertProvidersToModelList_Nil(t *testing.T) { } func TestConvertProvidersToModelList_AllProviders(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ProviderConfig: ProviderConfig{APIKey: "key1"}}, LiteLLM: ProviderConfig{APIKey: "key-litellm", APIBase: "http://localhost:4000/v1"}, @@ -162,19 +162,20 @@ func TestConvertProvidersToModelList_AllProviders(t *testing.T) { Qwen: ProviderConfig{APIKey: "key17"}, Mistral: ProviderConfig{APIKey: "key18"}, Avian: ProviderConfig{APIKey: "key19"}, + LongCat: ProviderConfig{APIKey: "key-longcat"}, }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) - // All 21 providers should be converted - if len(result) != 21 { - t.Errorf("len(result) = %d, want 21", len(result)) + // All 22 providers should be converted + if len(result) != 22 { + t.Errorf("len(result) = %d, want 22", len(result)) } } func TestConvertProvidersToModelList_Proxy(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ ProviderConfig: ProviderConfig{ @@ -185,7 +186,7 @@ func TestConvertProvidersToModelList_Proxy(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -197,7 +198,7 @@ func TestConvertProvidersToModelList_Proxy(t *testing.T) { } func TestConvertProvidersToModelList_RequestTimeout(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ Ollama: ProviderConfig{ APIKey: "ollama-key", @@ -206,7 +207,7 @@ func TestConvertProvidersToModelList_RequestTimeout(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -218,7 +219,7 @@ func TestConvertProvidersToModelList_RequestTimeout(t *testing.T) { } func TestConvertProvidersToModelList_AuthMethod(t *testing.T) { - cfg := &Config{ + cfg := &configV0{ Providers: ProvidersConfig{ OpenAI: OpenAIProviderConfig{ ProviderConfig: ProviderConfig{ @@ -228,7 +229,7 @@ func TestConvertProvidersToModelList_AuthMethod(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 0 { t.Errorf("len(result) = %d, want 0 (AuthMethod alone should not create entry)", len(result)) @@ -238,9 +239,9 @@ func TestConvertProvidersToModelList_AuthMethod(t *testing.T) { // Tests for preserving user's configured model during migration func TestConvertProvidersToModelList_PreservesUserModel_DeepSeek(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "deepseek", Model: "deepseek-reasoner", }, @@ -250,7 +251,7 @@ func TestConvertProvidersToModelList_PreservesUserModel_DeepSeek(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -263,9 +264,9 @@ func TestConvertProvidersToModelList_PreservesUserModel_DeepSeek(t *testing.T) { } func TestConvertProvidersToModelList_PreservesUserModel_OpenAI(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "openai", Model: "gpt-4-turbo", }, @@ -275,7 +276,7 @@ func TestConvertProvidersToModelList_PreservesUserModel_OpenAI(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -287,9 +288,9 @@ func TestConvertProvidersToModelList_PreservesUserModel_OpenAI(t *testing.T) { } func TestConvertProvidersToModelList_PreservesUserModel_Anthropic(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "claude", // alternative name Model: "claude-opus-4-20250514", }, @@ -299,7 +300,7 @@ func TestConvertProvidersToModelList_PreservesUserModel_Anthropic(t *testing.T) }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -311,9 +312,9 @@ func TestConvertProvidersToModelList_PreservesUserModel_Anthropic(t *testing.T) } func TestConvertProvidersToModelList_PreservesUserModel_Qwen(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "qwen", Model: "qwen-plus", }, @@ -323,7 +324,7 @@ func TestConvertProvidersToModelList_PreservesUserModel_Qwen(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -335,9 +336,9 @@ func TestConvertProvidersToModelList_PreservesUserModel_Qwen(t *testing.T) { } func TestConvertProvidersToModelList_UsesDefaultWhenNoUserModel(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "deepseek", Model: "", // no model specified }, @@ -347,7 +348,7 @@ func TestConvertProvidersToModelList_UsesDefaultWhenNoUserModel(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -360,9 +361,9 @@ func TestConvertProvidersToModelList_UsesDefaultWhenNoUserModel(t *testing.T) { } func TestConvertProvidersToModelList_MultipleProviders_PreservesUserModel(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "deepseek", Model: "deepseek-reasoner", }, @@ -373,7 +374,7 @@ func TestConvertProvidersToModelList_MultipleProviders_PreservesUserModel(t *tes }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 2 { t.Fatalf("len(result) = %d, want 2", len(result)) @@ -409,9 +410,9 @@ func TestConvertProvidersToModelList_ProviderNameAliases(t *testing.T) { for _, tt := range tests { t.Run(tt.providerAlias, func(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: tt.providerAlias, Model: strings.TrimPrefix( tt.expectedModel, @@ -442,7 +443,7 @@ func TestConvertProvidersToModelList_ProviderNameAliases(t *testing.T) { tt.expectedModel[:strings.Index(tt.expectedModel, "/")+1], ) - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) } @@ -464,9 +465,9 @@ func TestConvertProvidersToModelList_NoProviderField_SingleProvider(t *testing.T // - No provider field set // - model = "glm-4.7" // - Only zhipu has API key configured - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "", // Not set Model: "glm-4.7", }, @@ -476,7 +477,7 @@ func TestConvertProvidersToModelList_NoProviderField_SingleProvider(t *testing.T }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -497,9 +498,9 @@ func TestConvertProvidersToModelList_NoProviderField_MultipleProviders(t *testin // When multiple providers are configured but no provider field is set, // the FIRST provider (in migration order) will use userModel as ModelName // for backward compatibility with legacy implicit provider selection - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "", // Not set Model: "some-model", }, @@ -510,7 +511,7 @@ func TestConvertProvidersToModelList_NoProviderField_MultipleProviders(t *testin }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 2 { t.Fatalf("len(result) = %d, want 2", len(result)) @@ -530,9 +531,9 @@ func TestConvertProvidersToModelList_NoProviderField_MultipleProviders(t *testin func TestConvertProvidersToModelList_NoProviderField_NoModel(t *testing.T) { // Edge case: no provider, no model - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "", Model: "", }, @@ -542,7 +543,7 @@ func TestConvertProvidersToModelList_NoProviderField_NoModel(t *testing.T) { }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) != 1 { t.Fatalf("len(result) = %d, want 1", len(result)) @@ -583,9 +584,9 @@ func TestBuildModelWithProtocol_DifferentPrefix(t *testing.T) { // Test for legacy config with protocol prefix in model name func TestConvertProvidersToModelList_LegacyModelWithProtocolPrefix(t *testing.T) { - cfg := &Config{ - Agents: AgentsConfig{ - Defaults: AgentDefaults{ + cfg := &configV0{ + Agents: agentsConfigV0{ + Defaults: agentDefaultsV0{ Provider: "", // No explicit provider Model: "openrouter/auto", // Model already has protocol prefix }, @@ -595,7 +596,7 @@ func TestConvertProvidersToModelList_LegacyModelWithProtocolPrefix(t *testing.T) }, } - result := ConvertProvidersToModelList(cfg) + result := v0ConvertProvidersToModelList(cfg) if len(result) < 1 { t.Fatalf("len(result) = %d, want at least 1", len(result)) diff --git a/pkg/config/model_config_test.go b/pkg/config/model_config_test.go index da6e506f8..db0344311 100644 --- a/pkg/config/model_config_test.go +++ b/pkg/config/model_config_test.go @@ -113,39 +113,7 @@ func TestGetModelConfig_Concurrent(t *testing.T) { } } -func TestAgentDefaults_GetModelName_BackwardCompat(t *testing.T) { - tests := []struct { - name string - defaults AgentDefaults - wantName string - }{ - { - name: "new model_name field only", - defaults: AgentDefaults{ModelName: "new-model"}, - wantName: "new-model", - }, - { - name: "old model field only", - defaults: AgentDefaults{Model: "legacy-model"}, - wantName: "legacy-model", - }, - { - name: "both fields - model_name takes precedence", - defaults: AgentDefaults{ModelName: "new-model", Model: "old-model"}, - wantName: "new-model", - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - if got := tt.defaults.GetModelName(); got != tt.wantName { - t.Errorf("GetModelName() = %q, want %q", got, tt.wantName) - } - }) - } -} - -func TestAgentDefaults_JSON_BackwardCompat(t *testing.T) { +func TestAgentDefaultsV0_JSON_BackwardCompat(t *testing.T) { tests := []struct { name string json string @@ -170,7 +138,7 @@ func TestAgentDefaults_JSON_BackwardCompat(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - var defaults AgentDefaults + var defaults agentDefaultsV0 if err := json.Unmarshal([]byte(tt.json), &defaults); err != nil { t.Fatalf("Unmarshal error: %v", err) } @@ -181,69 +149,6 @@ func TestAgentDefaults_JSON_BackwardCompat(t *testing.T) { } } -func TestFullConfig_JSON_BackwardCompat(t *testing.T) { - // Test complete config with both old and new formats - oldFormat := `{ - "agents": { - "defaults": { - "workspace": "~/.picoclaw/workspace", - "model": "gpt4", - "max_tokens": 4096 - } - }, - "model_list": [ - { - "model_name": "gpt4", - "model": "openai/gpt-4o", - "api_key": "test-key" - } - ] - }` - - newFormat := `{ - "agents": { - "defaults": { - "workspace": "~/.picoclaw/workspace", - "model_name": "gpt4", - "max_tokens": 4096 - } - }, - "model_list": [ - { - "model_name": "gpt4", - "model": "openai/gpt-4o", - "api_key": "test-key" - } - ] - }` - - for name, jsonStr := range map[string]string{ - "old format (model)": oldFormat, - "new format (model_name)": newFormat, - } { - t.Run(name, func(t *testing.T) { - cfg := &Config{} - if err := json.Unmarshal([]byte(jsonStr), cfg); err != nil { - t.Fatalf("Unmarshal error: %v", err) - } - - // Check that GetModelName returns correct value - if got := cfg.Agents.Defaults.GetModelName(); got != "gpt4" { - t.Errorf("GetModelName() = %q, want %q", got, "gpt4") - } - - // Check that GetModelConfig works - modelCfg, err := cfg.GetModelConfig("gpt4") - if err != nil { - t.Fatalf("GetModelConfig error: %v", err) - } - if modelCfg.Model != "openai/gpt-4o" { - t.Errorf("Model = %q, want %q", modelCfg.Model, "openai/gpt-4o") - } - }) - } -} - func TestModelConfig_Validate(t *testing.T) { tests := []struct { name string diff --git a/pkg/env.go b/pkg/env.go new file mode 100644 index 000000000..47f219434 --- /dev/null +++ b/pkg/env.go @@ -0,0 +1,13 @@ +// all environment variables including default values put here + +package pkg + +const ( + Logo = "🦞" + // AppName is the name of the app + AppName = "PicoClaw" + + PicoClawHome = "PICOCLAW_HOME" + DefaultPicoClawHome = ".picoclaw" + WorkspaceName = "workspace" +) diff --git a/pkg/logger/logger.go b/pkg/logger/logger.go index 56dc87a53..80adcf86c 100644 --- a/pkg/logger/logger.go +++ b/pkg/logger/logger.go @@ -1,24 +1,24 @@ package logger import ( - "encoding/json" "fmt" - "log" "os" + "path/filepath" "runtime" "strings" "sync" - "time" + + "github.com/rs/zerolog" ) -type LogLevel int +type LogLevel = zerolog.Level const ( - DEBUG LogLevel = iota - INFO - WARN - ERROR - FATAL + DEBUG = zerolog.DebugLevel + INFO = zerolog.InfoLevel + WARN = zerolog.WarnLevel + ERROR = zerolog.ErrorLevel + FATAL = zerolog.FatalLevel ) var ( @@ -31,27 +31,24 @@ var ( } currentLevel = INFO - logger *Logger + logger zerolog.Logger + fileLogger zerolog.Logger + logFile *os.File once sync.Once mu sync.RWMutex ) -type Logger struct { - file *os.File -} - -type LogEntry struct { - Level string `json:"level"` - Timestamp string `json:"timestamp"` - Component string `json:"component,omitempty"` - Message string `json:"message"` - Fields map[string]any `json:"fields,omitempty"` - Caller string `json:"caller,omitempty"` -} - func init() { once.Do(func() { - logger = &Logger{} + zerolog.SetGlobalLevel(zerolog.InfoLevel) + + consoleWriter := zerolog.ConsoleWriter{ + Out: os.Stdout, + TimeFormat: "15:04:05", // TODO: make it configurable??? + } + + logger = zerolog.New(consoleWriter).With().Timestamp().Logger() + fileLogger = zerolog.Logger{} }) } @@ -59,6 +56,7 @@ func SetLevel(level LogLevel) { mu.Lock() defer mu.Unlock() currentLevel = level + zerolog.SetGlobalLevel(level) } func GetLevel() LogLevel { @@ -71,17 +69,22 @@ func EnableFileLogging(filePath string) error { mu.Lock() defer mu.Unlock() - file, err := os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644) + if err := os.MkdirAll(filepath.Dir(filePath), 0o755); err != nil { + return fmt.Errorf("failed to create log directory: %w", err) + } + + newFile, err := os.OpenFile(filePath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o644) if err != nil { return fmt.Errorf("failed to open log file: %w", err) } - if logger.file != nil { - logger.file.Close() + // Close old file if exists + if logFile != nil { + logFile.Close() } - logger.file = file - log.Println("File logging enabled:", filePath) + logFile = newFile + fileLogger = zerolog.New(logFile).With().Timestamp().Caller().Logger() return nil } @@ -89,10 +92,57 @@ func DisableFileLogging() { mu.Lock() defer mu.Unlock() - if logger.file != nil { - logger.file.Close() - logger.file = nil - log.Println("File logging disabled") + if logFile != nil { + logFile.Close() + logFile = nil + } + fileLogger = zerolog.Logger{} +} + +func getCallerInfo() (string, int, string) { + for i := 2; i < 15; i++ { + pc, file, line, ok := runtime.Caller(i) + if !ok { + continue + } + + fn := runtime.FuncForPC(pc) + if fn == nil { + continue + } + + // bypass common loggers + if strings.HasSuffix(file, "/logger.go") || + strings.HasSuffix(file, "/log.go") { + continue + } + + funcName := fn.Name() + if strings.HasPrefix(funcName, "runtime.") { + continue + } + + return filepath.Base(file), line, filepath.Base(funcName) + } + + return "???", 0, "???" +} + +//nolint:zerologlint +func getEvent(logger zerolog.Logger, level LogLevel) *zerolog.Event { + switch level { + case zerolog.DebugLevel: + return logger.Debug() + case zerolog.InfoLevel: + return logger.Info() + case zerolog.WarnLevel: + return logger.Warn() + case zerolog.ErrorLevel: + return logger.Error() + case zerolog.FatalLevel: + return logger.Fatal() + default: + return logger.Info() } } @@ -101,65 +151,41 @@ func logMessage(level LogLevel, component string, message string, fields map[str return } - entry := LogEntry{ - Level: logLevelNames[level], - Timestamp: time.Now().UTC().Format(time.RFC3339), - Component: component, - Message: message, - Fields: fields, - } + callerFile, callerLine, callerFunc := getCallerInfo() - if pc, file, line, ok := runtime.Caller(2); ok { - fn := runtime.FuncForPC(pc) - if fn != nil { - entry.Caller = fmt.Sprintf("%s:%d (%s)", file, line, fn.Name()) - } - } + event := getEvent(logger, level) - if logger.file != nil { - jsonData, err := json.Marshal(entry) - if err == nil { - logger.file.Write(append(jsonData, '\n')) - } - } - - var fieldStr string - if len(fields) > 0 { - fieldStr = " " + formatFields(fields) + // Build combined field with component and caller + if component != "" { + event.Str("caller", fmt.Sprintf("%-6s %s:%d (%s)", component, callerFile, callerLine, callerFunc)) } else { - fieldStr = "" + event.Str("caller", fmt.Sprintf(" %s:%d (%s)", callerFile, callerLine, callerFunc)) } - logLine := fmt.Sprintf("[%s] [%s]%s %s%s", - entry.Timestamp, - logLevelNames[level], - formatComponent(component), - message, - fieldStr, - ) + for k, v := range fields { + event.Interface(k, v) + } - log.Println(logLine) + event.Msg(message) + + // Also log to file if enabled + if fileLogger.GetLevel() != zerolog.NoLevel { + fileEvent := getEvent(fileLogger, level) + + if component != "" { + fileEvent.Str("component", component) + } + for k, v := range fields { + fileEvent.Interface(k, v) + } + fileEvent.Msg(message) + } if level == FATAL { os.Exit(1) } } -func formatComponent(component string) string { - if component == "" { - return "" - } - return fmt.Sprintf(" %s:", component) -} - -func formatFields(fields map[string]any) string { - parts := make([]string, 0, len(fields)) - for k, v := range fields { - parts = append(parts, fmt.Sprintf("%s=%v", k, v)) - } - return fmt.Sprintf("{%s}", strings.Join(parts, ", ")) -} - func Debug(message string) { logMessage(DEBUG, "", message, nil) } @@ -232,6 +258,10 @@ func FatalC(component string, message string) { logMessage(FATAL, component, message, nil) } +func Fatalf(message string, ss ...any) { + logMessage(FATAL, "", fmt.Sprintf(message, ss...), nil) +} + func FatalF(message string, fields map[string]any) { logMessage(FATAL, "", message, fields) } diff --git a/pkg/logger/logger_3rd_party.go b/pkg/logger/logger_3rd_party.go new file mode 100644 index 000000000..da50d686a --- /dev/null +++ b/pkg/logger/logger_3rd_party.go @@ -0,0 +1,95 @@ +// this file is for compatible with 3rd party loggers, should not be called in PicoClaw project + +package logger + +import "fmt" + +// Logger implements common Logger interface +type Logger struct { + component string + levels map[int]LogLevel +} + +// Debug logs debug messages +func (b *Logger) Debug(v ...any) { + logMessage(DEBUG, b.component, fmt.Sprint(v...), nil) +} + +// Info logs info messages +func (b *Logger) Info(v ...any) { + logMessage(INFO, b.component, fmt.Sprint(v...), nil) +} + +// Warn logs warning messages +func (b *Logger) Warn(v ...any) { + logMessage(WARN, b.component, fmt.Sprint(v...), nil) +} + +// Error logs error messages +func (b *Logger) Error(v ...any) { + logMessage(ERROR, b.component, fmt.Sprint(v...), nil) +} + +// Debugf logs formatted debug messages +func (b *Logger) Debugf(format string, v ...any) { + logMessage(DEBUG, b.component, fmt.Sprintf(format, v...), nil) +} + +// Infof logs formatted info messages +func (b *Logger) Infof(format string, v ...any) { + logMessage(INFO, b.component, fmt.Sprintf(format, v...), nil) +} + +// Warnf logs formatted warning messages +func (b *Logger) Warnf(format string, v ...any) { + logMessage(WARN, b.component, fmt.Sprintf(format, v...), nil) +} + +// Warningf logs formatted warning messages +func (b *Logger) Warningf(format string, v ...any) { + logMessage(WARN, b.component, fmt.Sprintf(format, v...), nil) +} + +// Errorf logs formatted error messages +func (b *Logger) Errorf(format string, v ...any) { + logMessage(ERROR, b.component, fmt.Sprintf(format, v...), nil) +} + +// Fatalf logs formatted fatal messages and exits +func (b *Logger) Fatalf(format string, v ...any) { + logMessage(FATAL, b.component, fmt.Sprintf(format, v...), nil) +} + +// Log logs a message at a given level with caller information +// the func name must be this because 3rd party loggers expect this +// msgL: message level (DEBUG, INFO, WARN, ERROR, FATAL) +// caller: unused parameter reserved for compatibility +// format: format string +// a: format arguments +// +//nolint:goprintffuncname +func (b *Logger) Log(msgL, caller int, format string, a ...any) { + level := LogLevel(msgL) + if b.levels != nil { + if lvl, ok := b.levels[msgL]; ok { + level = lvl + } + } + logMessage(level, b.component, fmt.Sprintf(format, a...), nil) +} + +// Sync flushes log buffer (no-op for this implementation) +func (b *Logger) Sync() error { + return nil +} + +// WithLevels sets log levels mapping for this logger +func (b *Logger) WithLevels(levels map[int]LogLevel) *Logger { + b.levels = levels + return b +} + +// NewLogger creates a new logger instance with optional component name +func NewLogger(component string) *Logger { + return &Logger{component: component} +} diff --git a/pkg/memory/migration.go b/pkg/memory/migration.go index c9d5176ab..b64c62a9f 100644 --- a/pkg/memory/migration.go +++ b/pkg/memory/migration.go @@ -48,6 +48,12 @@ func MigrateFromJSON( if !strings.HasSuffix(name, ".json") { continue } + // Skip JSONL metadata files. They are part of the new storage format, + // not legacy session snapshots, and re-importing them would overwrite + // the paired .jsonl history with an empty message list. + if strings.HasSuffix(name, ".meta.json") { + continue + } // Skip already-migrated files. if strings.HasSuffix(name, ".migrated") { continue diff --git a/pkg/memory/migration_test.go b/pkg/memory/migration_test.go index 3170758b7..4466c96f9 100644 --- a/pkg/memory/migration_test.go +++ b/pkg/memory/migration_test.go @@ -382,3 +382,55 @@ func TestMigrateFromJSON_NonexistentDir(t *testing.T) { t.Errorf("expected 0, got %d", count) } } + +func TestMigrateFromJSON_SkipsMetaJSONFiles(t *testing.T) { + sessionsDir := t.TempDir() + store, err := NewJSONLStore(sessionsDir) + if err != nil { + t.Fatalf("NewJSONLStore: %v", err) + } + ctx := context.Background() + + if addErr := store.AddMessage(ctx, "agent:main:pico:direct:pico:test", "user", "keep me"); addErr != nil { + t.Fatalf("AddMessage: %v", addErr) + } + if summaryErr := store.SetSummary(ctx, "agent:main:pico:direct:pico:test", "keep summary"); summaryErr != nil { + t.Fatalf("SetSummary: %v", summaryErr) + } + + metaPath := filepath.Join(sessionsDir, "agent_main_pico_direct_pico_test.meta.json") + if _, statErr := os.Stat(metaPath); statErr != nil { + t.Fatalf("meta file missing before migration: %v", statErr) + } + + count, err := MigrateFromJSON(ctx, sessionsDir, store) + if err != nil { + t.Fatalf("MigrateFromJSON: %v", err) + } + if count != 0 { + t.Fatalf("expected 0 migrated, got %d", count) + } + + history, err := store.GetHistory(ctx, "agent:main:pico:direct:pico:test") + if err != nil { + t.Fatalf("GetHistory: %v", err) + } + if len(history) != 1 || history[0].Content != "keep me" { + t.Fatalf("history = %+v, want preserved single message", history) + } + + summary, err := store.GetSummary(ctx, "agent:main:pico:direct:pico:test") + if err != nil { + t.Fatalf("GetSummary: %v", err) + } + if summary != "keep summary" { + t.Fatalf("summary = %q, want %q", summary, "keep summary") + } + + if _, statErr := os.Stat(metaPath); statErr != nil { + t.Fatalf("meta file should remain in place: %v", statErr) + } + if _, statErr := os.Stat(metaPath + ".migrated"); !os.IsNotExist(statErr) { + t.Fatalf("meta file should not be renamed, stat err = %v", statErr) + } +} diff --git a/pkg/migrate/internal/common.go b/pkg/migrate/internal/common.go index c77ab9f26..32c6ac83b 100644 --- a/pkg/migrate/internal/common.go +++ b/pkg/migrate/internal/common.go @@ -5,20 +5,22 @@ import ( "io" "os" "path/filepath" + + "github.com/sipeed/picoclaw/pkg" ) func ResolveTargetHome(override string) (string, error) { if override != "" { return ExpandHome(override), nil } - if envHome := os.Getenv("PICOCLAW_HOME"); envHome != "" { + if envHome := os.Getenv(pkg.PicoClawHome); envHome != "" { return ExpandHome(envHome), nil } home, err := os.UserHomeDir() if err != nil { return "", fmt.Errorf("resolving home directory: %w", err) } - return filepath.Join(home, ".picoclaw"), nil + return filepath.Join(home, pkg.DefaultPicoClawHome), nil } func ExpandHome(path string) string { diff --git a/pkg/migrate/sources/openclaw/common.go b/pkg/migrate/sources/openclaw/common.go index d57dbe34f..337c950d0 100644 --- a/pkg/migrate/sources/openclaw/common.go +++ b/pkg/migrate/sources/openclaw/common.go @@ -4,7 +4,6 @@ var migrateableFiles = []string{ "AGENTS.md", "SOUL.md", "USER.md", - "TOOLS.md", "HEARTBEAT.md", } diff --git a/pkg/migrate/sources/openclaw/openclaw_config.go b/pkg/migrate/sources/openclaw/openclaw_config.go index e272d17a9..e95c2f3ec 100644 --- a/pkg/migrate/sources/openclaw/openclaw_config.go +++ b/pkg/migrate/sources/openclaw/openclaw_config.go @@ -1111,6 +1111,7 @@ func (c ToolsConfig) ToStandardTools() config.ToolsConfig { Exec: config.ExecConfig{ EnableDenyPatterns: c.Exec.EnableDenyPatterns, CustomDenyPatterns: c.Exec.CustomDenyPatterns, + AllowRemote: config.DefaultConfig().Tools.Exec.AllowRemote, }, } } diff --git a/pkg/migrate/sources/openclaw/openclaw_config_test.go b/pkg/migrate/sources/openclaw/openclaw_config_test.go index 3a7d0c686..802693825 100644 --- a/pkg/migrate/sources/openclaw/openclaw_config_test.go +++ b/pkg/migrate/sources/openclaw/openclaw_config_test.go @@ -290,6 +290,20 @@ func TestConvertToPicoClaw(t *testing.T) { } } +func TestToStandardConfig_ExecAllowRemoteDefaultsTrue(t *testing.T) { + cfg := (&PicoClawConfig{ + Tools: ToolsConfig{ + Exec: ExecConfig{ + EnableDenyPatterns: true, + }, + }, + }).ToStandardConfig() + + if !cfg.Tools.Exec.AllowRemote { + t.Fatal("ToStandardConfig() should preserve the default tools.exec.allow_remote=true") + } +} + func TestConvertToPicoClawWithQQAndDingTalk(t *testing.T) { tmpDir := t.TempDir() configPath := filepath.Join(tmpDir, "openclaw.json") diff --git a/pkg/providers/claude_cli_provider_test.go b/pkg/providers/claude_cli_provider_test.go index d4d648f5a..228cad9c9 100644 --- a/pkg/providers/claude_cli_provider_test.go +++ b/pkg/providers/claude_cli_provider_test.go @@ -416,7 +416,7 @@ func TestCreateProvider_ClaudeCli(t *testing.T) { cfg.ModelList = []config.ModelConfig{ {ModelName: "claude-sonnet-4.6", Model: "claude-cli/claude-sonnet-4.6", Workspace: "/test/ws"}, } - cfg.Agents.Defaults.Model = "claude-sonnet-4.6" + cfg.Agents.Defaults.ModelName = "claude-sonnet-4.6" provider, _, err := CreateProvider(cfg) if err != nil { @@ -437,7 +437,7 @@ func TestCreateProvider_ClaudeCode(t *testing.T) { cfg.ModelList = []config.ModelConfig{ {ModelName: "claude-code", Model: "claude-cli/claude-code"}, } - cfg.Agents.Defaults.Model = "claude-code" + cfg.Agents.Defaults.ModelName = "claude-code" provider, _, err := CreateProvider(cfg) if err != nil { @@ -453,7 +453,7 @@ func TestCreateProvider_ClaudeCodec(t *testing.T) { cfg.ModelList = []config.ModelConfig{ {ModelName: "claudecode", Model: "claude-cli/claudecode"}, } - cfg.Agents.Defaults.Model = "claudecode" + cfg.Agents.Defaults.ModelName = "claudecode" provider, _, err := CreateProvider(cfg) if err != nil { @@ -469,7 +469,7 @@ func TestCreateProvider_ClaudeCliDefaultWorkspace(t *testing.T) { cfg.ModelList = []config.ModelConfig{ {ModelName: "claude-cli", Model: "claude-cli/claude-sonnet"}, } - cfg.Agents.Defaults.Model = "claude-cli" + cfg.Agents.Defaults.ModelName = "claude-cli" cfg.Agents.Defaults.Workspace = "" provider, _, err := CreateProvider(cfg) diff --git a/pkg/providers/factory.go b/pkg/providers/factory.go index ee9c11899..354acafcb 100644 --- a/pkg/providers/factory.go +++ b/pkg/providers/factory.go @@ -1,384 +1,7 @@ package providers import ( - "fmt" - "strings" - "github.com/sipeed/picoclaw/pkg/auth" - "github.com/sipeed/picoclaw/pkg/config" ) -const defaultAnthropicAPIBase = "https://api.anthropic.com/v1" - var getCredential = auth.GetCredential - -type providerType int - -const ( - providerTypeHTTPCompat providerType = iota - providerTypeClaudeAuth - providerTypeCodexAuth - providerTypeCodexCLIToken - providerTypeClaudeCLI - providerTypeCodexCLI - providerTypeGitHubCopilot -) - -type providerSelection struct { - providerType providerType - apiKey string - apiBase string - proxy string - model string - workspace string - connectMode string - enableWebSearch bool -} - -func resolveProviderSelection(cfg *config.Config) (providerSelection, error) { - model := cfg.Agents.Defaults.GetModelName() - providerName := strings.ToLower(cfg.Agents.Defaults.Provider) - lowerModel := strings.ToLower(model) - - if providerName == "" && model == "" { - return providerSelection{}, fmt.Errorf("no model configured: agents.defaults.model is empty") - } - - sel := providerSelection{ - providerType: providerTypeHTTPCompat, - model: model, - } - - // First, prefer explicit provider configuration. - if providerName != "" { - switch providerName { - case "groq": - if cfg.Providers.Groq.APIKey != "" { - sel.apiKey = cfg.Providers.Groq.APIKey - sel.apiBase = cfg.Providers.Groq.APIBase - sel.proxy = cfg.Providers.Groq.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.groq.com/openai/v1" - } - } - case "openai", "gpt": - if cfg.Providers.OpenAI.APIKey != "" || cfg.Providers.OpenAI.AuthMethod != "" { - sel.enableWebSearch = cfg.Providers.OpenAI.WebSearch - if cfg.Providers.OpenAI.AuthMethod == "codex-cli" { - sel.providerType = providerTypeCodexCLIToken - return sel, nil - } - if cfg.Providers.OpenAI.AuthMethod == "oauth" || cfg.Providers.OpenAI.AuthMethod == "token" { - sel.providerType = providerTypeCodexAuth - return sel, nil - } - sel.apiKey = cfg.Providers.OpenAI.APIKey - sel.apiBase = cfg.Providers.OpenAI.APIBase - sel.proxy = cfg.Providers.OpenAI.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.openai.com/v1" - } - } - case "anthropic", "claude": - if cfg.Providers.Anthropic.APIKey != "" || cfg.Providers.Anthropic.AuthMethod != "" { - if cfg.Providers.Anthropic.AuthMethod == "oauth" || cfg.Providers.Anthropic.AuthMethod == "token" { - sel.apiBase = cfg.Providers.Anthropic.APIBase - if sel.apiBase == "" { - sel.apiBase = defaultAnthropicAPIBase - } - sel.providerType = providerTypeClaudeAuth - return sel, nil - } - sel.apiKey = cfg.Providers.Anthropic.APIKey - sel.apiBase = cfg.Providers.Anthropic.APIBase - sel.proxy = cfg.Providers.Anthropic.Proxy - if sel.apiBase == "" { - sel.apiBase = defaultAnthropicAPIBase - } - } - case "openrouter": - if cfg.Providers.OpenRouter.APIKey != "" { - sel.apiKey = cfg.Providers.OpenRouter.APIKey - sel.proxy = cfg.Providers.OpenRouter.Proxy - if cfg.Providers.OpenRouter.APIBase != "" { - sel.apiBase = cfg.Providers.OpenRouter.APIBase - } else { - sel.apiBase = "https://openrouter.ai/api/v1" - } - } - case "litellm": - if cfg.Providers.LiteLLM.APIKey != "" || cfg.Providers.LiteLLM.APIBase != "" { - sel.apiKey = cfg.Providers.LiteLLM.APIKey - sel.apiBase = cfg.Providers.LiteLLM.APIBase - sel.proxy = cfg.Providers.LiteLLM.Proxy - if sel.apiBase == "" { - sel.apiBase = "http://localhost:4000/v1" - } - } - case "zhipu", "glm": - if cfg.Providers.Zhipu.APIKey != "" { - sel.apiKey = cfg.Providers.Zhipu.APIKey - sel.apiBase = cfg.Providers.Zhipu.APIBase - sel.proxy = cfg.Providers.Zhipu.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://open.bigmodel.cn/api/paas/v4" - } - } - case "gemini", "google": - if cfg.Providers.Gemini.APIKey != "" { - sel.apiKey = cfg.Providers.Gemini.APIKey - sel.apiBase = cfg.Providers.Gemini.APIBase - sel.proxy = cfg.Providers.Gemini.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://generativelanguage.googleapis.com/v1beta" - } - } - case "vllm": - if cfg.Providers.VLLM.APIBase != "" { - sel.apiKey = cfg.Providers.VLLM.APIKey - sel.apiBase = cfg.Providers.VLLM.APIBase - sel.proxy = cfg.Providers.VLLM.Proxy - } - case "shengsuanyun": - if cfg.Providers.ShengSuanYun.APIKey != "" { - sel.apiKey = cfg.Providers.ShengSuanYun.APIKey - sel.apiBase = cfg.Providers.ShengSuanYun.APIBase - sel.proxy = cfg.Providers.ShengSuanYun.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://router.shengsuanyun.com/api/v1" - } - } - case "nvidia": - if cfg.Providers.Nvidia.APIKey != "" { - sel.apiKey = cfg.Providers.Nvidia.APIKey - sel.apiBase = cfg.Providers.Nvidia.APIBase - sel.proxy = cfg.Providers.Nvidia.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://integrate.api.nvidia.com/v1" - } - } - case "vivgrid": - if cfg.Providers.Vivgrid.APIKey != "" { - sel.apiKey = cfg.Providers.Vivgrid.APIKey - sel.apiBase = cfg.Providers.Vivgrid.APIBase - sel.proxy = cfg.Providers.Vivgrid.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.vivgrid.com/v1" - } - } - case "claude-cli", "claude-code", "claudecode": - workspace := cfg.WorkspacePath() - if workspace == "" { - workspace = "." - } - sel.providerType = providerTypeClaudeCLI - sel.workspace = workspace - return sel, nil - case "codex-cli", "codex-code": - workspace := cfg.WorkspacePath() - if workspace == "" { - workspace = "." - } - sel.providerType = providerTypeCodexCLI - sel.workspace = workspace - return sel, nil - case "deepseek": - if cfg.Providers.DeepSeek.APIKey != "" { - sel.apiKey = cfg.Providers.DeepSeek.APIKey - sel.apiBase = cfg.Providers.DeepSeek.APIBase - sel.proxy = cfg.Providers.DeepSeek.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.deepseek.com/v1" - } - if model != "deepseek-chat" && model != "deepseek-reasoner" { - sel.model = "deepseek-chat" - } - } - case "avian": - if cfg.Providers.Avian.APIKey != "" { - sel.apiKey = cfg.Providers.Avian.APIKey - sel.apiBase = cfg.Providers.Avian.APIBase - sel.proxy = cfg.Providers.Avian.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.avian.io/v1" - } - } - case "mistral": - if cfg.Providers.Mistral.APIKey != "" { - sel.apiKey = cfg.Providers.Mistral.APIKey - sel.apiBase = cfg.Providers.Mistral.APIBase - sel.proxy = cfg.Providers.Mistral.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.mistral.ai/v1" - } - } - case "minimax": - if cfg.Providers.Minimax.APIKey != "" { - sel.apiKey = cfg.Providers.Minimax.APIKey - sel.apiBase = cfg.Providers.Minimax.APIBase - sel.proxy = cfg.Providers.Minimax.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.minimaxi.com/v1" - } - } - case "github_copilot", "copilot": - sel.providerType = providerTypeGitHubCopilot - if cfg.Providers.GitHubCopilot.APIBase != "" { - sel.apiBase = cfg.Providers.GitHubCopilot.APIBase - } else { - sel.apiBase = "localhost:4321" - } - sel.connectMode = cfg.Providers.GitHubCopilot.ConnectMode - return sel, nil - } - } - - // Fallback: infer provider from model and configured keys. - if sel.apiKey == "" && sel.apiBase == "" { - switch { - case (strings.Contains(lowerModel, "kimi") || strings.Contains(lowerModel, "moonshot") || strings.HasPrefix(model, "moonshot/")) && cfg.Providers.Moonshot.APIKey != "": - sel.apiKey = cfg.Providers.Moonshot.APIKey - sel.apiBase = cfg.Providers.Moonshot.APIBase - sel.proxy = cfg.Providers.Moonshot.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.moonshot.cn/v1" - } - case strings.HasPrefix(model, "openrouter/") || - strings.HasPrefix(model, "anthropic/") || - strings.HasPrefix(model, "openai/") || - strings.HasPrefix(model, "meta-llama/") || - strings.HasPrefix(model, "deepseek/") || - strings.HasPrefix(model, "google/"): - sel.apiKey = cfg.Providers.OpenRouter.APIKey - sel.proxy = cfg.Providers.OpenRouter.Proxy - if cfg.Providers.OpenRouter.APIBase != "" { - sel.apiBase = cfg.Providers.OpenRouter.APIBase - } else { - sel.apiBase = "https://openrouter.ai/api/v1" - } - case (strings.Contains(lowerModel, "claude") || strings.HasPrefix(model, "anthropic/")) && - (cfg.Providers.Anthropic.APIKey != "" || cfg.Providers.Anthropic.AuthMethod != ""): - if cfg.Providers.Anthropic.AuthMethod == "oauth" || cfg.Providers.Anthropic.AuthMethod == "token" { - sel.apiBase = cfg.Providers.Anthropic.APIBase - if sel.apiBase == "" { - sel.apiBase = defaultAnthropicAPIBase - } - sel.providerType = providerTypeClaudeAuth - return sel, nil - } - sel.apiKey = cfg.Providers.Anthropic.APIKey - sel.apiBase = cfg.Providers.Anthropic.APIBase - sel.proxy = cfg.Providers.Anthropic.Proxy - if sel.apiBase == "" { - sel.apiBase = defaultAnthropicAPIBase - } - case (strings.Contains(lowerModel, "gpt") || strings.HasPrefix(model, "openai/")) && - (cfg.Providers.OpenAI.APIKey != "" || cfg.Providers.OpenAI.AuthMethod != ""): - sel.enableWebSearch = cfg.Providers.OpenAI.WebSearch - if cfg.Providers.OpenAI.AuthMethod == "codex-cli" { - sel.providerType = providerTypeCodexCLIToken - return sel, nil - } - if cfg.Providers.OpenAI.AuthMethod == "oauth" || cfg.Providers.OpenAI.AuthMethod == "token" { - sel.providerType = providerTypeCodexAuth - return sel, nil - } - sel.apiKey = cfg.Providers.OpenAI.APIKey - sel.apiBase = cfg.Providers.OpenAI.APIBase - sel.proxy = cfg.Providers.OpenAI.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.openai.com/v1" - } - case (strings.Contains(lowerModel, "gemini") || strings.HasPrefix(model, "google/")) && cfg.Providers.Gemini.APIKey != "": - sel.apiKey = cfg.Providers.Gemini.APIKey - sel.apiBase = cfg.Providers.Gemini.APIBase - sel.proxy = cfg.Providers.Gemini.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://generativelanguage.googleapis.com/v1beta" - } - case (strings.Contains(lowerModel, "glm") || strings.Contains(lowerModel, "zhipu") || strings.Contains(lowerModel, "zai")) && cfg.Providers.Zhipu.APIKey != "": - sel.apiKey = cfg.Providers.Zhipu.APIKey - sel.apiBase = cfg.Providers.Zhipu.APIBase - sel.proxy = cfg.Providers.Zhipu.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://open.bigmodel.cn/api/paas/v4" - } - case (strings.Contains(lowerModel, "groq") || strings.HasPrefix(model, "groq/")) && cfg.Providers.Groq.APIKey != "": - sel.apiKey = cfg.Providers.Groq.APIKey - sel.apiBase = cfg.Providers.Groq.APIBase - sel.proxy = cfg.Providers.Groq.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.groq.com/openai/v1" - } - case (strings.Contains(lowerModel, "nvidia") || strings.HasPrefix(model, "nvidia/")) && cfg.Providers.Nvidia.APIKey != "": - sel.apiKey = cfg.Providers.Nvidia.APIKey - sel.apiBase = cfg.Providers.Nvidia.APIBase - sel.proxy = cfg.Providers.Nvidia.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://integrate.api.nvidia.com/v1" - } - case strings.HasPrefix(model, "vivgrid/") && cfg.Providers.Vivgrid.APIKey != "": - sel.apiKey = cfg.Providers.Vivgrid.APIKey - sel.apiBase = cfg.Providers.Vivgrid.APIBase - sel.proxy = cfg.Providers.Vivgrid.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.vivgrid.com/v1" - } - case (strings.Contains(lowerModel, "ollama") || strings.HasPrefix(model, "ollama/")) && cfg.Providers.Ollama.APIKey != "": - sel.apiKey = cfg.Providers.Ollama.APIKey - sel.apiBase = cfg.Providers.Ollama.APIBase - sel.proxy = cfg.Providers.Ollama.Proxy - if sel.apiBase == "" { - sel.apiBase = "http://localhost:11434/v1" - } - case (strings.Contains(lowerModel, "mistral") || strings.HasPrefix(model, "mistral/")) && cfg.Providers.Mistral.APIKey != "": - sel.apiKey = cfg.Providers.Mistral.APIKey - sel.apiBase = cfg.Providers.Mistral.APIBase - sel.proxy = cfg.Providers.Mistral.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.mistral.ai/v1" - } - case (strings.Contains(lowerModel, "minimax") || strings.HasPrefix(model, "minimax/")) && cfg.Providers.Minimax.APIKey != "": - sel.apiKey = cfg.Providers.Minimax.APIKey - sel.apiBase = cfg.Providers.Minimax.APIBase - sel.proxy = cfg.Providers.Minimax.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.minimaxi.com/v1" - } - case strings.HasPrefix(model, "avian/") && cfg.Providers.Avian.APIKey != "": - sel.apiKey = cfg.Providers.Avian.APIKey - sel.apiBase = cfg.Providers.Avian.APIBase - sel.proxy = cfg.Providers.Avian.Proxy - if sel.apiBase == "" { - sel.apiBase = "https://api.avian.io/v1" - } - case cfg.Providers.VLLM.APIBase != "": - sel.apiKey = cfg.Providers.VLLM.APIKey - sel.apiBase = cfg.Providers.VLLM.APIBase - sel.proxy = cfg.Providers.VLLM.Proxy - default: - if cfg.Providers.OpenRouter.APIKey != "" { - sel.apiKey = cfg.Providers.OpenRouter.APIKey - sel.proxy = cfg.Providers.OpenRouter.Proxy - if cfg.Providers.OpenRouter.APIBase != "" { - sel.apiBase = cfg.Providers.OpenRouter.APIBase - } else { - sel.apiBase = "https://openrouter.ai/api/v1" - } - } else { - return providerSelection{}, fmt.Errorf("no API key configured for model: %s", model) - } - } - } - - if sel.providerType == providerTypeHTTPCompat { - if sel.apiKey == "" && !strings.HasPrefix(model, "bedrock/") { - return providerSelection{}, fmt.Errorf("no API key configured for provider (model: %s)", model) - } - if sel.apiBase == "" { - return providerSelection{}, fmt.Errorf("no API base configured for provider (model: %s)", model) - } - } - - return sel, nil -} diff --git a/pkg/providers/factory_provider.go b/pkg/providers/factory_provider.go index a798154cb..9749e7a15 100644 --- a/pkg/providers/factory_provider.go +++ b/pkg/providers/factory_provider.go @@ -95,7 +95,7 @@ func CreateProviderFromConfig(cfg *config.ModelConfig) (LLMProvider, string, err case "litellm", "openrouter", "groq", "zhipu", "gemini", "nvidia", "ollama", "moonshot", "shengsuanyun", "deepseek", "cerebras", "vivgrid", "volcengine", "vllm", "qwen", "mistral", "avian", - "minimax": + "minimax", "longcat": // All other OpenAI-compatible HTTP providers if cfg.APIKey == "" && cfg.APIBase == "" { return nil, "", fmt.Errorf("api_key or api_base is required for HTTP-based protocol %q", protocol) @@ -215,6 +215,8 @@ func getDefaultAPIBase(protocol string) string { return "https://api.avian.io/v1" case "minimax": return "https://api.minimaxi.com/v1" + case "longcat": + return "https://api.longcat.chat/openai" default: return "" } diff --git a/pkg/providers/factory_provider_test.go b/pkg/providers/factory_provider_test.go index 17bc55d25..6c7bb4795 100644 --- a/pkg/providers/factory_provider_test.go +++ b/pkg/providers/factory_provider_test.go @@ -113,6 +113,7 @@ func TestCreateProviderFromConfig_DefaultAPIBase(t *testing.T) { {"vllm", "vllm"}, {"deepseek", "deepseek"}, {"ollama", "ollama"}, + {"longcat", "longcat"}, } for _, tt := range tests { @@ -162,6 +163,29 @@ func TestCreateProviderFromConfig_LiteLLM(t *testing.T) { } } +func TestCreateProviderFromConfig_LongCat(t *testing.T) { + cfg := &config.ModelConfig{ + ModelName: "test-longcat", + Model: "longcat/LongCat-Flash-Thinking", + APIKey: "test-key", + APIBase: "https://api.longcat.chat/openai", + } + + provider, modelID, err := CreateProviderFromConfig(cfg) + if err != nil { + t.Fatalf("CreateProviderFromConfig() error = %v", err) + } + if provider == nil { + t.Fatal("CreateProviderFromConfig() returned nil provider") + } + if modelID != "LongCat-Flash-Thinking" { + t.Errorf("modelID = %q, want %q", modelID, "LongCat-Flash-Thinking") + } + if _, ok := provider.(*HTTPProvider); !ok { + t.Fatalf("expected *HTTPProvider, got %T", provider) + } +} + func TestCreateProviderFromConfig_Anthropic(t *testing.T) { cfg := &config.ModelConfig{ ModelName: "test-anthropic", diff --git a/pkg/providers/factory_test.go b/pkg/providers/factory_test.go index 36ccda4a1..bd8fbd1c4 100644 --- a/pkg/providers/factory_test.go +++ b/pkg/providers/factory_test.go @@ -1,234 +1,15 @@ package providers import ( - "strings" "testing" "github.com/sipeed/picoclaw/pkg/auth" "github.com/sipeed/picoclaw/pkg/config" ) -func TestResolveProviderSelection(t *testing.T) { - tests := []struct { - name string - setup func(*config.Config) - wantType providerType - wantAPIBase string - wantProxy string - wantErrSubstr string - }{ - { - name: "explicit litellm provider uses configured base", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "litellm" - cfg.Providers.LiteLLM.APIKey = "litellm-key" - cfg.Providers.LiteLLM.APIBase = "http://localhost:4000/v1" - cfg.Providers.LiteLLM.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "http://localhost:4000/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "explicit litellm provider defaults base when only key is configured", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "litellm" - cfg.Providers.LiteLLM.APIKey = "litellm-key" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "http://localhost:4000/v1", - }, - { - name: "explicit claude-cli provider routes to cli provider type", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "claude-cli" - cfg.Agents.Defaults.Workspace = "/tmp/ws" - }, - wantType: providerTypeClaudeCLI, - }, - { - name: "explicit copilot provider routes to github copilot type", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "copilot" - }, - wantType: providerTypeGitHubCopilot, - wantAPIBase: "localhost:4321", - }, - { - name: "explicit deepseek provider uses deepseek defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "deepseek" - cfg.Agents.Defaults.Model = "deepseek/deepseek-chat" - cfg.Providers.DeepSeek.APIKey = "deepseek-key" - cfg.Providers.DeepSeek.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://api.deepseek.com/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "explicit shengsuanyun provider uses defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "shengsuanyun" - cfg.Providers.ShengSuanYun.APIKey = "ssy-key" - cfg.Providers.ShengSuanYun.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://router.shengsuanyun.com/api/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "explicit nvidia provider uses defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "nvidia" - cfg.Providers.Nvidia.APIKey = "nvapi-test" - cfg.Providers.Nvidia.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://integrate.api.nvidia.com/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "explicit vivgrid provider uses defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "vivgrid" - cfg.Providers.Vivgrid.APIKey = "vivgrid-key" - cfg.Providers.Vivgrid.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://api.vivgrid.com/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "openrouter model uses openrouter defaults", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "openrouter/auto" - cfg.Providers.OpenRouter.APIKey = "sk-or-test" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://openrouter.ai/api/v1", - }, - { - name: "anthropic oauth routes to claude auth provider", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "claude-sonnet-4.6" - cfg.Providers.Anthropic.AuthMethod = "oauth" - }, - wantType: providerTypeClaudeAuth, - }, - { - name: "openai oauth routes to codex auth provider", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "gpt-4o" - cfg.Providers.OpenAI.AuthMethod = "oauth" - }, - wantType: providerTypeCodexAuth, - }, - { - name: "openai codex-cli auth routes to codex cli token provider", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "gpt-4o" - cfg.Providers.OpenAI.AuthMethod = "codex-cli" - }, - wantType: providerTypeCodexCLIToken, - }, - { - name: "explicit codex-code provider routes to codex cli provider type", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Provider = "codex-code" - cfg.Agents.Defaults.Workspace = "/tmp/ws" - }, - wantType: providerTypeCodexCLI, - }, - { - name: "zhipu model uses zhipu base default", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "glm-4.7" - cfg.Providers.Zhipu.APIKey = "zhipu-key" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://open.bigmodel.cn/api/paas/v4", - }, - { - name: "groq model uses groq base default", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "groq/llama-3.3-70b" - cfg.Providers.Groq.APIKey = "gsk-key" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://api.groq.com/openai/v1", - }, - { - name: "ollama model uses ollama base default", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "ollama/qwen2.5:14b" - cfg.Providers.Ollama.APIKey = "ollama-key" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "http://localhost:11434/v1", - }, - { - name: "moonshot model keeps proxy and default base", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "moonshot/kimi-k2.5" - cfg.Providers.Moonshot.APIKey = "moonshot-key" - cfg.Providers.Moonshot.Proxy = "http://127.0.0.1:7890" - }, - wantType: providerTypeHTTPCompat, - wantAPIBase: "https://api.moonshot.cn/v1", - wantProxy: "http://127.0.0.1:7890", - }, - { - name: "missing keys returns model config error", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "custom-model" - }, - wantErrSubstr: "no API key configured for model", - }, - { - name: "openrouter prefix without key returns provider key error", - setup: func(cfg *config.Config) { - cfg.Agents.Defaults.Model = "openrouter/auto" - }, - wantErrSubstr: "no API key configured for provider", - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - cfg := config.DefaultConfig() - tt.setup(cfg) - - got, err := resolveProviderSelection(cfg) - if tt.wantErrSubstr != "" { - if err == nil { - t.Fatalf("expected error containing %q, got nil", tt.wantErrSubstr) - } - if !strings.Contains(err.Error(), tt.wantErrSubstr) { - t.Fatalf("error = %q, want substring %q", err.Error(), tt.wantErrSubstr) - } - return - } - - if err != nil { - t.Fatalf("resolveProviderSelection() error = %v", err) - } - if got.providerType != tt.wantType { - t.Fatalf("providerType = %v, want %v", got.providerType, tt.wantType) - } - if tt.wantAPIBase != "" && got.apiBase != tt.wantAPIBase { - t.Fatalf("apiBase = %q, want %q", got.apiBase, tt.wantAPIBase) - } - if tt.wantProxy != "" && got.proxy != tt.wantProxy { - t.Fatalf("proxy = %q, want %q", got.proxy, tt.wantProxy) - } - }) - } -} - func TestCreateProviderReturnsHTTPProviderForOpenRouter(t *testing.T) { cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "test-openrouter" + cfg.Agents.Defaults.ModelName = "test-openrouter" cfg.ModelList = []config.ModelConfig{ { ModelName: "test-openrouter", @@ -250,7 +31,7 @@ func TestCreateProviderReturnsHTTPProviderForOpenRouter(t *testing.T) { func TestCreateProviderReturnsCodexCliProviderForCodexCode(t *testing.T) { cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "test-codex" + cfg.Agents.Defaults.ModelName = "test-codex" cfg.ModelList = []config.ModelConfig{ { ModelName: "test-codex", @@ -271,7 +52,7 @@ func TestCreateProviderReturnsCodexCliProviderForCodexCode(t *testing.T) { func TestCreateProviderReturnsClaudeCliProviderForClaudeCli(t *testing.T) { cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "test-claude-cli" + cfg.Agents.Defaults.ModelName = "test-claude-cli" cfg.ModelList = []config.ModelConfig{ { ModelName: "test-claude-cli", @@ -304,7 +85,7 @@ func TestCreateProviderReturnsClaudeProviderForAnthropicOAuth(t *testing.T) { } cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "test-claude-oauth" + cfg.Agents.Defaults.ModelName = "test-claude-oauth" cfg.ModelList = []config.ModelConfig{ { ModelName: "test-claude-oauth", diff --git a/pkg/providers/legacy_provider.go b/pkg/providers/legacy_provider.go index 26905159f..4b0815dd4 100644 --- a/pkg/providers/legacy_provider.go +++ b/pkg/providers/legacy_provider.go @@ -18,23 +18,6 @@ import ( func CreateProvider(cfg *config.Config) (LLMProvider, string, error) { model := cfg.Agents.Defaults.GetModelName() - // Ensure model_list is populated from providers config if needed - // This handles two cases: - // 1. ModelList is empty - convert all providers - // 2. ModelList has some entries but not all providers - merge missing ones - if cfg.HasProvidersConfig() { - providerModels := config.ConvertProvidersToModelList(cfg) - existingModelNames := make(map[string]bool) - for _, m := range cfg.ModelList { - existingModelNames[m.ModelName] = true - } - for _, pm := range providerModels { - if !existingModelNames[pm.ModelName] { - cfg.ModelList = append(cfg.ModelList, pm) - } - } - } - // Must have model_list at this point if len(cfg.ModelList) == 0 { return nil, "", fmt.Errorf("no providers configured. Please add entries to model_list in your config") diff --git a/pkg/providers/openai_compat/provider.go b/pkg/providers/openai_compat/provider.go index 0e8db7409..f97bf3acd 100644 --- a/pkg/providers/openai_compat/provider.go +++ b/pkg/providers/openai_compat/provider.go @@ -156,9 +156,10 @@ func (p *Provider) Chat( // The key is typically the agent ID — stable per agent, shared across requests. // See: https://platform.openai.com/docs/guides/prompt-caching // Prompt caching is only supported by OpenAI-native endpoints. - // Gemini and other providers reject unknown fields, so skip for non-OpenAI APIs. + // Non-OpenAI providers (Mistral, Gemini, DeepSeek, etc.) reject unknown + // fields with 422 errors, so only include it for OpenAI APIs. if cacheKey, ok := options["prompt_cache_key"].(string); ok && cacheKey != "" { - if !strings.Contains(p.apiBase, "generativelanguage.googleapis.com") { + if supportsPromptCacheKey(p.apiBase) { requestBody["prompt_cache_key"] = cacheKey } } @@ -283,8 +284,8 @@ func parseResponse(body io.Reader) (*LLMResponse, error) { ID string `json:"id"` Type string `json:"type"` Function *struct { - Name string `json:"name"` - Arguments string `json:"arguments"` + Name string `json:"name"` + Arguments json.RawMessage `json:"arguments"` } `json:"function"` ExtraContent *struct { Google *struct { @@ -323,12 +324,7 @@ func parseResponse(body io.Reader) (*LLMResponse, error) { if tc.Function != nil { name = tc.Function.Name - if tc.Function.Arguments != "" { - if err := json.Unmarshal([]byte(tc.Function.Arguments), &arguments); err != nil { - log.Printf("openai_compat: failed to decode tool call arguments for %q: %v", name, err) - arguments["raw"] = tc.Function.Arguments - } - } + arguments = decodeToolCallArguments(tc.Function.Arguments, name) } // Build ToolCall with ExtraContent for Gemini 3 thought_signature persistence @@ -361,6 +357,39 @@ func parseResponse(body io.Reader) (*LLMResponse, error) { }, nil } +func decodeToolCallArguments(raw json.RawMessage, name string) map[string]any { + arguments := make(map[string]any) + raw = bytes.TrimSpace(raw) + if len(raw) == 0 || bytes.Equal(raw, []byte("null")) { + return arguments + } + + var decoded any + if err := json.Unmarshal(raw, &decoded); err != nil { + log.Printf("openai_compat: failed to decode tool call arguments payload for %q: %v", name, err) + arguments["raw"] = string(raw) + return arguments + } + + switch v := decoded.(type) { + case string: + if strings.TrimSpace(v) == "" { + return arguments + } + if err := json.Unmarshal([]byte(v), &arguments); err != nil { + log.Printf("openai_compat: failed to decode tool call arguments for %q: %v", name, err) + arguments["raw"] = v + } + return arguments + case map[string]any: + return v + default: + log.Printf("openai_compat: unsupported tool call arguments type for %q: %T", name, decoded) + arguments["raw"] = string(raw) + return arguments + } +} + // openaiMessage is the wire-format message for OpenAI-compatible APIs. // It mirrors protocoltypes.Message but omits SystemParts, which is an // internal field that would be unknown to third-party endpoints. @@ -476,3 +505,16 @@ func asFloat(v any) (float64, bool) { return 0, false } } + +// supportsPromptCacheKey reports whether the given API base is known to +// support the prompt_cache_key request field. Currently only OpenAI's own +// API and Azure OpenAI support this. All other OpenAI-compatible providers +// (Mistral, Gemini, DeepSeek, Groq, etc.) reject unknown fields with 422 errors. +func supportsPromptCacheKey(apiBase string) bool { + u, err := url.Parse(apiBase) + if err != nil { + return false + } + host := u.Hostname() + return host == "api.openai.com" || strings.HasSuffix(host, ".openai.azure.com") +} diff --git a/pkg/providers/openai_compat/provider_test.go b/pkg/providers/openai_compat/provider_test.go index 9a3a7acc5..41f278a1b 100644 --- a/pkg/providers/openai_compat/provider_test.go +++ b/pkg/providers/openai_compat/provider_test.go @@ -108,6 +108,55 @@ func TestProviderChat_ParsesToolCalls(t *testing.T) { } } +func TestProviderChat_ParsesToolCallsWithObjectArguments(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{ + "content": "", + "tool_calls": []map[string]any{ + { + "id": "call_1", + "type": "function", + "function": map[string]any{ + "name": "get_weather", + "arguments": map[string]any{ + "city": "SF", + "metric": true, + }, + }, + }, + }, + }, + "finish_reason": "tool_calls", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + p := NewProvider("key", server.URL, "") + out, err := p.Chat(t.Context(), []Message{{Role: "user", Content: "hi"}}, nil, "gpt-4o", nil) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + if len(out.ToolCalls) != 1 { + t.Fatalf("len(ToolCalls) = %d, want 1", len(out.ToolCalls)) + } + if out.ToolCalls[0].Name != "get_weather" { + t.Fatalf("ToolCalls[0].Name = %q, want %q", out.ToolCalls[0].Name, "get_weather") + } + if out.ToolCalls[0].Arguments["city"] != "SF" { + t.Fatalf("ToolCalls[0].Arguments[city] = %v, want SF", out.ToolCalls[0].Arguments["city"]) + } + if out.ToolCalls[0].Arguments["metric"] != true { + t.Fatalf("ToolCalls[0].Arguments[metric] = %v, want true", out.ToolCalls[0].Arguments["metric"]) + } +} + func TestProviderChat_ParsesReasoningContent(t *testing.T) { server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { resp := map[string]any{ @@ -669,6 +718,111 @@ func TestSerializeMessages_MediaWithToolCallID(t *testing.T) { } } +// chatWithCacheKey sets up a test server, sends a Chat request with prompt_cache_key, +// and returns the decoded request body for assertion. +func chatWithCacheKey(t *testing.T, apiBase string) map[string]any { + t.Helper() + var requestBody map[string]any + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if err := json.NewDecoder(r.Body).Decode(&requestBody); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + resp := map[string]any{ + "choices": []map[string]any{ + { + "message": map[string]any{"content": "ok"}, + "finish_reason": "stop", + }, + }, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(resp) + })) + defer server.Close() + + p := NewProvider("key", server.URL, "") + p.apiBase = apiBase + p.httpClient = &http.Client{ + Transport: roundTripperFunc(func(r *http.Request) (*http.Response, error) { + r.URL, _ = url.Parse(server.URL + r.URL.Path) + return http.DefaultTransport.RoundTrip(r) + }), + } + + _, err := p.Chat( + t.Context(), + []Message{{Role: "user", Content: "hi"}}, + nil, + "test-model", + map[string]any{"prompt_cache_key": "agent-main"}, + ) + if err != nil { + t.Fatalf("Chat() error = %v", err) + } + return requestBody +} + +func TestProviderChat_PromptCacheKeySentToOpenAI(t *testing.T) { + body := chatWithCacheKey(t, "https://api.openai.com/v1") + if body["prompt_cache_key"] != "agent-main" { + t.Fatalf("prompt_cache_key = %v, want %q", body["prompt_cache_key"], "agent-main") + } +} + +func TestProviderChat_PromptCacheKeyOmittedForNonOpenAI(t *testing.T) { + tests := []struct { + name string + apiBase string + }{ + {"mistral", "https://api.mistral.ai/v1"}, + {"gemini", "https://generativelanguage.googleapis.com/v1beta"}, + {"deepseek", "https://api.deepseek.com/v1"}, + {"groq", "https://api.groq.com/openai/v1"}, + {"minimax", "https://api.minimaxi.com/v1"}, + {"ollama_local", "http://localhost:11434/v1"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + body := chatWithCacheKey(t, tt.apiBase) + if _, exists := body["prompt_cache_key"]; exists { + t.Fatalf("prompt_cache_key should NOT be sent to %s, but was included in request", tt.name) + } + }) + } +} + +func TestSupportsPromptCacheKey(t *testing.T) { + tests := []struct { + apiBase string + want bool + }{ + {"https://api.openai.com/v1", true}, + {"https://api.openai.com/v1/", true}, + {"https://myresource.openai.azure.com/openai/deployments/gpt-4", true}, + {"https://eastus.openai.azure.com/v1", true}, + {"https://api.mistral.ai/v1", false}, + {"https://generativelanguage.googleapis.com/v1beta", false}, + {"https://api.deepseek.com/v1", false}, + {"https://api.groq.com/openai/v1", false}, + {"http://localhost:11434/v1", false}, + {"https://openrouter.ai/api/v1", false}, + // Edge cases: proxy URLs with openai.com in path should NOT match + {"https://my-proxy.com/api.openai.com/v1", false}, + {"https://proxy.example.com/openai.azure.com/v1", false}, + // Malformed or empty + {"", false}, + {"not-a-url", false}, + } + for _, tt := range tests { + if got := supportsPromptCacheKey(tt.apiBase); got != tt.want { + t.Errorf("supportsPromptCacheKey(%q) = %v, want %v", tt.apiBase, got, tt.want) + } + } +} + func TestSerializeMessages_StripsSystemParts(t *testing.T) { messages := []protocoltypes.Message{ { diff --git a/pkg/routing/route_test.go b/pkg/routing/route_test.go index 8255db5f9..fdfc899f9 100644 --- a/pkg/routing/route_test.go +++ b/pkg/routing/route_test.go @@ -11,7 +11,7 @@ func testConfig(agents []config.AgentConfig, bindings []config.AgentBinding) *co Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: "/tmp/picoclaw-test", - Model: "gpt-4", + ModelName: "gpt-4", }, List: agents, }, diff --git a/pkg/session/manager.go b/pkg/session/manager.go index a31dbd55c..ef720b7c5 100644 --- a/pkg/session/manager.go +++ b/pkg/session/manager.go @@ -32,7 +32,7 @@ func NewSessionManager(storage string) *SessionManager { } if storage != "" { - os.MkdirAll(storage, 0o755) + os.MkdirAll(storage, 0o700) sm.loadSessions() } @@ -216,7 +216,7 @@ func (sm *SessionManager) Save(key string) error { _ = tmpFile.Close() return err } - if err := tmpFile.Chmod(0o644); err != nil { + if err := tmpFile.Chmod(0o600); err != nil { _ = tmpFile.Close() return err } diff --git a/pkg/skills/loader.go b/pkg/skills/loader.go index 30d84635a..f5985a662 100644 --- a/pkg/skills/loader.go +++ b/pkg/skills/loader.go @@ -10,14 +10,15 @@ import ( "regexp" "strings" + "github.com/gomarkdown/markdown" + "github.com/gomarkdown/markdown/ast" + "github.com/gomarkdown/markdown/parser" + "gopkg.in/yaml.v3" + "github.com/sipeed/picoclaw/pkg/logger" ) -var ( - namePattern = regexp.MustCompile(`^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$`) - reFrontmatter = regexp.MustCompile(`(?s)^---(?:\r\n|\n|\r)(.*?)(?:\r\n|\n|\r)---`) - reStripFrontmatter = regexp.MustCompile(`(?s)^---(?:\r\n|\n|\r)(.*?)(?:\r\n|\n|\r)---(?:\r\n|\n|\r)*`) -) +var namePattern = regexp.MustCompile(`^[a-zA-Z0-9]+(-[a-zA-Z0-9]+)*$`) const ( MaxNameLength = 64 @@ -226,11 +227,20 @@ func (sl *SkillsLoader) getSkillMetadata(skillPath string) *SkillMetadata { return nil } - frontmatter := sl.extractFrontmatter(string(content)) + frontmatter, bodyContent := splitFrontmatter(string(content)) + dirName := filepath.Base(filepath.Dir(skillPath)) + title, bodyDescription := extractMarkdownMetadata(bodyContent) + + metadata := &SkillMetadata{ + Name: dirName, + Description: bodyDescription, + } + if title != "" && namePattern.MatchString(title) && len(title) <= MaxNameLength { + metadata.Name = title + } + if frontmatter == "" { - return &SkillMetadata{ - Name: filepath.Base(filepath.Dir(skillPath)), - } + return metadata } // Try JSON first (for backward compatibility) @@ -239,60 +249,133 @@ func (sl *SkillsLoader) getSkillMetadata(skillPath string) *SkillMetadata { Description string `json:"description"` } if err := json.Unmarshal([]byte(frontmatter), &jsonMeta); err == nil { - return &SkillMetadata{ - Name: jsonMeta.Name, - Description: jsonMeta.Description, + if jsonMeta.Name != "" { + metadata.Name = jsonMeta.Name } + if jsonMeta.Description != "" { + metadata.Description = jsonMeta.Description + } + return metadata } // Fall back to simple YAML parsing yamlMeta := sl.parseSimpleYAML(frontmatter) - return &SkillMetadata{ - Name: yamlMeta["name"], - Description: yamlMeta["description"], + if name := yamlMeta["name"]; name != "" { + metadata.Name = name } + if description := yamlMeta["description"]; description != "" { + metadata.Description = description + } + return metadata } -// parseSimpleYAML parses simple key: value YAML format -// Example: name: github\n description: "..." -// Normalizes line endings to handle \n (Unix), \r\n (Windows), and \r (classic Mac) +func extractMarkdownMetadata(content string) (title, description string) { + p := parser.NewWithExtensions(parser.CommonExtensions) + doc := markdown.Parse([]byte(content), p) + if doc == nil { + return "", "" + } + + ast.WalkFunc(doc, func(node ast.Node, entering bool) ast.WalkStatus { + if !entering { + return ast.GoToNext + } + + switch n := node.(type) { + case *ast.Heading: + if title == "" && n.Level == 1 { + title = nodeText(n) + if title != "" && description != "" { + return ast.Terminate + } + } + case *ast.Paragraph: + if description == "" { + description = nodeText(n) + if title != "" && description != "" { + return ast.Terminate + } + } + } + return ast.GoToNext + }) + + return title, description +} + +func nodeText(n ast.Node) string { + var b strings.Builder + ast.WalkFunc(n, func(node ast.Node, entering bool) ast.WalkStatus { + if !entering { + return ast.GoToNext + } + + switch t := node.(type) { + case *ast.Text: + b.Write(t.Literal) + case *ast.Code: + b.Write(t.Literal) + case *ast.Softbreak, *ast.Hardbreak, *ast.NonBlockingSpace: + b.WriteByte(' ') + } + return ast.GoToNext + }) + return strings.Join(strings.Fields(b.String()), " ") +} + +// parseSimpleYAML parses YAML frontmatter and extracts known metadata fields. func (sl *SkillsLoader) parseSimpleYAML(content string) map[string]string { result := make(map[string]string) - // Normalize line endings: convert \r\n and \r to \n - normalized := strings.ReplaceAll(content, "\r\n", "\n") - normalized = strings.ReplaceAll(normalized, "\r", "\n") - - for line := range strings.SplitSeq(normalized, "\n") { - line = strings.TrimSpace(line) - if line == "" || strings.HasPrefix(line, "#") { - continue - } - - parts := strings.SplitN(line, ":", 2) - if len(parts) == 2 { - key := strings.TrimSpace(parts[0]) - value := strings.TrimSpace(parts[1]) - // Remove quotes if present - value = strings.Trim(value, "\"'") - result[key] = value - } + var meta struct { + Name string `yaml:"name"` + Description string `yaml:"description"` + } + if err := yaml.Unmarshal([]byte(content), &meta); err != nil { + return result + } + if meta.Name != "" { + result["name"] = meta.Name + } + if meta.Description != "" { + result["description"] = meta.Description } return result } func (sl *SkillsLoader) extractFrontmatter(content string) string { - // Support \n (Unix), \r\n (Windows), and \r (classic Mac) line endings for frontmatter blocks - match := reFrontmatter.FindStringSubmatch(content) - if len(match) > 1 { - return match[1] - } - return "" + frontmatter, _ := splitFrontmatter(content) + return frontmatter } func (sl *SkillsLoader) stripFrontmatter(content string) string { - return reStripFrontmatter.ReplaceAllString(content, "") + _, body := splitFrontmatter(content) + return body +} + +func splitFrontmatter(content string) (frontmatter, body string) { + normalized := string(parser.NormalizeNewlines([]byte(content))) + lines := strings.Split(normalized, "\n") + if len(lines) == 0 || lines[0] != "---" { + return "", content + } + + end := -1 + for i := 1; i < len(lines); i++ { + if lines[i] == "---" { + end = i + break + } + } + if end == -1 { + return "", content + } + + frontmatter = strings.Join(lines[1:end], "\n") + body = strings.Join(lines[end+1:], "\n") + body = strings.TrimLeft(body, "\n") + return frontmatter, body } func escapeXML(s string) string { diff --git a/pkg/skills/loader_test.go b/pkg/skills/loader_test.go index 31619f9c2..645d8b7ac 100644 --- a/pkg/skills/loader_test.go +++ b/pkg/skills/loader_test.go @@ -342,3 +342,78 @@ func TestSkillRootsTrimsWhitespaceAndDedups(t *testing.T) { builtin, }, roots) } + +func TestGetSkillMetadata_UsesMarkdownParagraphWhenNoFrontmatter(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "plain-skill") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "# Plain Skill\n\nThis is parsed from markdown paragraph.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "plain-skill", meta.Name) + assert.Equal(t, "This is parsed from markdown paragraph.", meta.Description) +} + +func TestGetSkillMetadata_FrontmatterOverridesMarkdown(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "plain-skill") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "---\nname: frontmatter-skill\ndescription: frontmatter description\n---\n\n# Plain Skill\n\nBody description.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "frontmatter-skill", meta.Name) + assert.Equal(t, "frontmatter description", meta.Description) +} + +func TestGetSkillMetadata_YAMLMultilineDescription(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "plain-skill") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "---\nname: frontmatter-skill\ndescription: |\n line 1: with colon\n line 2\n---\n\n# Plain Skill\n\nBody description.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "frontmatter-skill", meta.Name) + assert.Equal(t, "line 1: with colon\nline 2", meta.Description) +} + +func TestGetSkillMetadata_InvalidHeadingNameFallsBackToDirName(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "valid-name") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "# Invalid Heading Name\n\nBody description.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "valid-name", meta.Name) + assert.Equal(t, "Body description.", meta.Description) +} + +func TestGetSkillMetadata_IgnoresHTMLCommentBlocks(t *testing.T) { + tmp := t.TempDir() + skillDir := filepath.Join(tmp, "workspace", "skills", "biomed-skill") + require.NoError(t, os.MkdirAll(skillDir, 0o755)) + + content := "\n\n# Biomed Skill\n\nSummarize biomedical papers.\n" + require.NoError(t, os.WriteFile(filepath.Join(skillDir, "SKILL.md"), []byte(content), 0o644)) + + sl := &SkillsLoader{} + meta := sl.getSkillMetadata(filepath.Join(skillDir, "SKILL.md")) + require.NotNil(t, meta) + assert.Equal(t, "biomed-skill", meta.Name) + assert.Equal(t, "Summarize biomedical papers.", meta.Description) +} diff --git a/pkg/state/state.go b/pkg/state/state.go index 57f371f12..5da7bbde1 100644 --- a/pkg/state/state.go +++ b/pkg/state/state.go @@ -40,8 +40,8 @@ func NewManager(workspace string) *Manager { oldStateFile := filepath.Join(workspace, "state.json") // Create state directory if it doesn't exist - if err := os.MkdirAll(stateDir, 0o755); err != nil { - log.Fatalf("[FATAL] state: failed to create state directory: %v", err) + if err := os.MkdirAll(stateDir, 0o700); err != nil { + log.Printf("[WARN] state: failed to create state directory %s: %v", stateDir, err) } sm := &Manager{ diff --git a/pkg/state/state_test.go b/pkg/state/state_test.go index e5e116ef6..3924e5533 100644 --- a/pkg/state/state_test.go +++ b/pkg/state/state_test.go @@ -2,7 +2,6 @@ package state import ( "encoding/json" - "errors" "fmt" "os" "os/exec" @@ -217,10 +216,7 @@ func TestNewManager_EmptyWorkspace(t *testing.T) { } } -func TestNewManager_MkdirFailureCrashes(t *testing.T) { - // Since log.Fatalf calls os.Exit(1), we cannot test it normally - // Otherwise, the test suite would stop altogether. - // We use the standard pattern of Go: rerun this test in a subprocess. +func TestNewManager_MkdirFailureDoesNotCrash(t *testing.T) { if os.Getenv("BE_CRASHER") == "1" { tmpDir := os.Getenv("CRASH_DIR") @@ -240,15 +236,11 @@ func TestNewManager_MkdirFailureCrashes(t *testing.T) { } defer os.RemoveAll(tmpDir) - cmd := exec.Command(os.Args[0], "-test.run=TestNewManager_MkdirFailureCrashes") + cmd := exec.Command(os.Args[0], "-test.run=TestNewManager_MkdirFailureDoesNotCrash") cmd.Env = append(os.Environ(), "BE_CRASHER=1", "CRASH_DIR="+tmpDir) err = cmd.Run() - - var e *exec.ExitError - if errors.As(err, &e) && !e.Success() { - return + if err != nil { + t.Fatalf("NewManager should not crash when state dir creation fails, got: %v", err) } - - t.Fatalf("The process ended without error, a crash was expected via os.Exit(1). Err: %v", err) } diff --git a/pkg/tools/cron.go b/pkg/tools/cron.go index 6af0aa9e1..648cc3c6c 100644 --- a/pkg/tools/cron.go +++ b/pkg/tools/cron.go @@ -8,6 +8,7 @@ import ( "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/constants" "github.com/sipeed/picoclaw/pkg/cron" "github.com/sipeed/picoclaw/pkg/utils" ) @@ -73,6 +74,10 @@ func (t *CronTool) Parameters() map[string]any { "type": "string", "description": "Optional: Shell command to execute directly (e.g., 'df -h'). If set, the agent will run this command and report output instead of just showing the message. 'deliver' will be forced to false for commands.", }, + "command_confirm": map[string]any{ + "type": "boolean", + "description": "Required when using command=true. Must be true to explicitly confirm scheduling a shell command.", + }, "at_seconds": map[string]any{ "type": "integer", "description": "One-time reminder: seconds from now when to trigger (e.g., 600 for 10 minutes later). Use this for one-time reminders like 'remind me in 10 minutes'.", @@ -175,12 +180,17 @@ func (t *CronTool) addJob(ctx context.Context, args map[string]any) *ToolResult deliver = d } + // GHSA-pv8c-p6jf-3fpp: command scheduling requires internal channel + explicit confirm. + // Non-command reminders (plain messages) remain open to all channels. command, _ := args["command"].(string) + commandConfirm, _ := args["command_confirm"].(bool) if command != "" { - // Commands must be processed by agent/exec tool, so deliver must be false (or handled specifically) - // Actually, let's keep deliver=false to let the system know it's not a simple chat message - // But for our new logic in ExecuteJob, we can handle it regardless of deliver flag if Payload.Command is set. - // However, logically, it's not "delivered" to chat directly as is. + if !constants.IsInternalChannel(channel) { + return ErrorResult("scheduling command execution is restricted to internal channels") + } + if !commandConfirm { + return ErrorResult("command_confirm=true is required to schedule command execution") + } deliver = false } @@ -281,7 +291,9 @@ func (t *CronTool) ExecuteJob(ctx context.Context, job *cron.CronJob) string { // Execute command if present if job.Payload.Command != "" { args := map[string]any{ - "command": job.Payload.Command, + "command": job.Payload.Command, + "__channel": channel, + "__chat_id": chatID, } result := t.execTool.Execute(ctx, args) diff --git a/pkg/tools/cron_test.go b/pkg/tools/cron_test.go new file mode 100644 index 000000000..1776abc65 --- /dev/null +++ b/pkg/tools/cron_test.go @@ -0,0 +1,116 @@ +package tools + +import ( + "context" + "path/filepath" + "strings" + "testing" + + "github.com/sipeed/picoclaw/pkg/bus" + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/cron" +) + +func newTestCronTool(t *testing.T) *CronTool { + t.Helper() + storePath := filepath.Join(t.TempDir(), "cron.json") + cronService := cron.NewCronService(storePath, nil) + msgBus := bus.NewMessageBus() + cfg := config.DefaultConfig() + tool, err := NewCronTool(cronService, nil, msgBus, t.TempDir(), true, 0, cfg) + if err != nil { + t.Fatalf("NewCronTool() error: %v", err) + } + return tool +} + +// TestCronTool_CommandBlockedFromRemoteChannel verifies command scheduling is restricted to internal channels +func TestCronTool_CommandBlockedFromRemoteChannel(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "command_confirm": true, + "at_seconds": float64(60), + }) + + if !result.IsError { + t.Fatal("expected command scheduling to be blocked from remote channel") + } + if !strings.Contains(result.ForLLM, "restricted to internal channels") { + t.Errorf("expected 'restricted to internal channels', got: %s", result.ForLLM) + } +} + +// TestCronTool_CommandRequiresConfirm verifies command_confirm=true is required +func TestCronTool_CommandRequiresConfirm(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "at_seconds": float64(60), + }) + + if !result.IsError { + t.Fatal("expected error when command_confirm is missing") + } + if !strings.Contains(result.ForLLM, "command_confirm=true") { + t.Errorf("expected 'command_confirm=true' message, got: %s", result.ForLLM) + } +} + +// TestCronTool_CommandAllowedFromInternalChannel verifies command scheduling works from internal channels +func TestCronTool_CommandAllowedFromInternalChannel(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "command_confirm": true, + "at_seconds": float64(60), + }) + + if result.IsError { + t.Fatalf("expected command scheduling to succeed from internal channel, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "Cron job added") { + t.Errorf("expected 'Cron job added', got: %s", result.ForLLM) + } +} + +// TestCronTool_AddJobRequiresSessionContext verifies fail-closed when channel/chatID missing +func TestCronTool_AddJobRequiresSessionContext(t *testing.T) { + tool := newTestCronTool(t) + result := tool.Execute(context.Background(), map[string]any{ + "action": "add", + "message": "reminder", + "at_seconds": float64(60), + }) + + if !result.IsError { + t.Fatal("expected error when session context is missing") + } + if !strings.Contains(result.ForLLM, "no session context") { + t.Errorf("expected 'no session context' message, got: %s", result.ForLLM) + } +} + +// TestCronTool_NonCommandJobAllowedFromRemoteChannel verifies regular reminders work from any channel +func TestCronTool_NonCommandJobAllowedFromRemoteChannel(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "time to stretch", + "at_seconds": float64(600), + }) + + if result.IsError { + t.Fatalf("expected non-command reminder to succeed from remote channel, got: %s", result.ForLLM) + } +} diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go index b8a811d03..67e2ad257 100644 --- a/pkg/tools/shell.go +++ b/pkg/tools/shell.go @@ -14,6 +14,7 @@ import ( "time" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/constants" ) type ExecTool struct { @@ -23,6 +24,7 @@ type ExecTool struct { allowPatterns []*regexp.Regexp customAllowPatterns []*regexp.Regexp restrictToWorkspace bool + allowRemote bool } var ( @@ -100,10 +102,12 @@ func NewExecTool(workingDir string, restrict bool) (*ExecTool, error) { func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Config) (*ExecTool, error) { denyPatterns := make([]*regexp.Regexp, 0) customAllowPatterns := make([]*regexp.Regexp, 0) + allowRemote := true if config != nil { execConfig := config.Tools.Exec enableDenyPatterns := execConfig.EnableDenyPatterns + allowRemote = execConfig.AllowRemote if enableDenyPatterns { denyPatterns = append(denyPatterns, defaultDenyPatterns...) if len(execConfig.CustomDenyPatterns) > 0 { @@ -143,6 +147,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf allowPatterns: nil, customAllowPatterns: customAllowPatterns, restrictToWorkspace: restrict, + allowRemote: allowRemote, }, nil } @@ -177,6 +182,19 @@ func (t *ExecTool) Execute(ctx context.Context, args map[string]any) *ToolResult return ErrorResult("command is required") } + // GHSA-pv8c-p6jf-3fpp: block exec from remote channels (e.g. Telegram webhooks) + // unless explicitly opted-in via config. Fail-closed: empty channel = blocked. + if !t.allowRemote { + channel := ToolChannel(ctx) + if channel == "" { + channel, _ = args["__channel"].(string) + } + channel = strings.TrimSpace(channel) + if channel == "" || !constants.IsInternalChannel(channel) { + return ErrorResult("exec is restricted to internal channels") + } + } + cwd := t.workingDir if wd, ok := args["working_dir"].(string); ok && wd != "" { if t.restrictToWorkspace && t.workingDir != "" { @@ -201,6 +219,25 @@ func (t *ExecTool) Execute(ctx context.Context, args map[string]any) *ToolResult return ErrorResult(guardError) } + // Re-resolve symlinks immediately before execution to shrink the TOCTOU window + // between validation and cmd.Dir assignment. + if t.restrictToWorkspace && t.workingDir != "" && cwd != t.workingDir { + resolved, err := filepath.EvalSymlinks(cwd) + if err != nil { + return ErrorResult(fmt.Sprintf("Command blocked by safety guard (path resolution failed: %v)", err)) + } + absWorkspace, _ := filepath.Abs(t.workingDir) + wsResolved, _ := filepath.EvalSymlinks(absWorkspace) + if wsResolved == "" { + wsResolved = absWorkspace + } + rel, err := filepath.Rel(wsResolved, resolved) + if err != nil || !filepath.IsLocal(rel) { + return ErrorResult("Command blocked by safety guard (working directory escaped workspace)") + } + cwd = resolved + } + // timeout == 0 means no timeout var cmdCtx context.Context var cancel context.CancelFunc diff --git a/pkg/tools/shell_test.go b/pkg/tools/shell_test.go index ff9ea4a15..90265e5bd 100644 --- a/pkg/tools/shell_test.go +++ b/pkg/tools/shell_test.go @@ -301,6 +301,85 @@ func TestShellTool_WorkingDir_SymlinkEscape(t *testing.T) { } } +// TestShellTool_RemoteChannelBlockedByDefault verifies exec is blocked for remote channels +func TestShellTool_RemoteChannelBlockedByDefault(t *testing.T) { + cfg := &config.Config{} + cfg.Tools.Exec.EnableDenyPatterns = true + cfg.Tools.Exec.AllowRemote = false + + tool, err := NewExecToolWithConfig("", false, cfg) + if err != nil { + t.Fatalf("NewExecToolWithConfig() error: %v", err) + } + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{"command": "echo hi"}) + + if !result.IsError { + t.Fatal("expected remote-channel exec to be blocked") + } + if !strings.Contains(result.ForLLM, "restricted to internal channels") { + t.Errorf("expected 'restricted to internal channels' message, got: %s", result.ForLLM) + } +} + +// TestShellTool_InternalChannelAllowed verifies exec is allowed for internal channels +func TestShellTool_InternalChannelAllowed(t *testing.T) { + cfg := &config.Config{} + cfg.Tools.Exec.EnableDenyPatterns = true + cfg.Tools.Exec.AllowRemote = false + + tool, err := NewExecToolWithConfig("", false, cfg) + if err != nil { + t.Fatalf("NewExecToolWithConfig() error: %v", err) + } + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{"command": "echo hi"}) + + if result.IsError { + t.Fatalf("expected internal channel exec to succeed, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "hi") { + t.Errorf("expected output to contain 'hi', got: %s", result.ForLLM) + } +} + +// TestShellTool_EmptyChannelBlockedWhenNotAllowRemote verifies fail-closed when no channel context +func TestShellTool_EmptyChannelBlockedWhenNotAllowRemote(t *testing.T) { + cfg := &config.Config{} + cfg.Tools.Exec.EnableDenyPatterns = true + cfg.Tools.Exec.AllowRemote = false + + tool, err := NewExecToolWithConfig("", false, cfg) + if err != nil { + t.Fatalf("NewExecToolWithConfig() error: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "command": "echo hi", + }) + + if !result.IsError { + t.Fatal("expected exec with empty channel to be blocked when allowRemote=false") + } +} + +// TestShellTool_AllowRemoteBypassesChannelCheck verifies allowRemote=true permits any channel +func TestShellTool_AllowRemoteBypassesChannelCheck(t *testing.T) { + cfg := &config.Config{} + cfg.Tools.Exec.EnableDenyPatterns = true + cfg.Tools.Exec.AllowRemote = true + + tool, err := NewExecToolWithConfig("", false, cfg) + if err != nil { + t.Fatalf("NewExecToolWithConfig() error: %v", err) + } + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{"command": "echo hi"}) + + if result.IsError { + t.Fatalf("expected allowRemote=true to permit remote channel, got: %s", result.ForLLM) + } +} + // TestShellTool_RestrictToWorkspace verifies workspace restriction func TestShellTool_RestrictToWorkspace(t *testing.T) { tmpDir := t.TempDir() diff --git a/pkg/tools/web.go b/pkg/tools/web.go index e248ea966..003cd860c 100644 --- a/pkg/tools/web.go +++ b/pkg/tools/web.go @@ -7,6 +7,7 @@ import ( "errors" "fmt" "io" + "net" "net/http" "net/url" "regexp" @@ -818,6 +819,10 @@ func NewWebFetchTool(maxChars int, fetchLimitBytes int64) (*WebFetchTool, error) return NewWebFetchToolWithProxy(maxChars, "", fetchLimitBytes) } +// allowPrivateWebFetchHosts controls whether loopback/private hosts are allowed. +// This is false in normal runtime to reduce SSRF exposure, and tests can override it temporarily. +var allowPrivateWebFetchHosts atomic.Bool + func NewWebFetchToolWithProxy(maxChars int, proxy string, fetchLimitBytes int64) (*WebFetchTool, error) { if maxChars <= 0 { maxChars = defaultMaxChars @@ -826,10 +831,20 @@ func NewWebFetchToolWithProxy(maxChars int, proxy string, fetchLimitBytes int64) if err != nil { return nil, fmt.Errorf("failed to create HTTP client for web fetch: %w", err) } + if transport, ok := client.Transport.(*http.Transport); ok { + dialer := &net.Dialer{ + Timeout: 15 * time.Second, + KeepAlive: 30 * time.Second, + } + transport.DialContext = newSafeDialContext(dialer) + } client.CheckRedirect = func(req *http.Request, via []*http.Request) error { if len(via) >= maxRedirects { return fmt.Errorf("stopped after %d redirects", maxRedirects) } + if isObviousPrivateHost(req.URL.Hostname()) { + return fmt.Errorf("redirect target is private or local network host") + } return nil } if fetchLimitBytes <= 0 { @@ -888,6 +903,13 @@ func (t *WebFetchTool) Execute(ctx context.Context, args map[string]any) *ToolRe return ErrorResult("missing domain in URL") } + // Lightweight pre-flight: block obvious localhost/literal-IP without DNS resolution. + // The real SSRF guard is newSafeDialContext at connect time. + hostname := parsedURL.Hostname() + if isObviousPrivateHost(hostname) { + return ErrorResult("fetching private or local network hosts is not allowed") + } + maxChars := t.maxChars if mc, ok := args["maxChars"].(float64); ok { if int(mc) > 100 { @@ -901,7 +923,6 @@ func (t *WebFetchTool) Execute(ctx context.Context, args map[string]any) *ToolRe } req.Header.Set("User-Agent", userAgent) - resp, err := t.client.Do(req) if err != nil { return ErrorResult(fmt.Sprintf("request failed: %v", err)) @@ -992,3 +1013,127 @@ func (t *WebFetchTool) extractText(htmlContent string) string { return strings.Join(cleanLines, "\n") } + +// newSafeDialContext re-resolves DNS at connect time to mitigate DNS rebinding (TOCTOU) +// where a hostname resolves to a public IP during pre-flight but a private IP at connect time. +func newSafeDialContext(dialer *net.Dialer) func(context.Context, string, string) (net.Conn, error) { + return func(ctx context.Context, network, address string) (net.Conn, error) { + if allowPrivateWebFetchHosts.Load() { + return dialer.DialContext(ctx, network, address) + } + + host, port, err := net.SplitHostPort(address) + if err != nil { + return nil, fmt.Errorf("invalid target address %q: %w", address, err) + } + if host == "" { + return nil, fmt.Errorf("empty target host") + } + + if ip := net.ParseIP(host); ip != nil { + if isPrivateOrRestrictedIP(ip) { + return nil, fmt.Errorf("blocked private or local target: %s", host) + } + return dialer.DialContext(ctx, network, net.JoinHostPort(ip.String(), port)) + } + + ipAddrs, err := net.DefaultResolver.LookupIPAddr(ctx, host) + if err != nil { + return nil, fmt.Errorf("failed to resolve %s: %w", host, err) + } + + attempted := 0 + var lastErr error + for _, ipAddr := range ipAddrs { + if isPrivateOrRestrictedIP(ipAddr.IP) { + continue + } + attempted++ + conn, err := dialer.DialContext(ctx, network, net.JoinHostPort(ipAddr.IP.String(), port)) + if err == nil { + return conn, nil + } + lastErr = err + } + + if attempted == 0 { + return nil, fmt.Errorf("all resolved addresses for %s are private or restricted", host) + } + if lastErr != nil { + return nil, fmt.Errorf("failed connecting to public addresses for %s: %w", host, lastErr) + } + return nil, fmt.Errorf("failed connecting to public addresses for %s", host) + } +} + +// isObviousPrivateHost performs a lightweight, no-DNS check for obviously private hosts. +// It catches localhost, literal private IPs, and empty hosts. It does NOT resolve DNS — +// the real SSRF guard is newSafeDialContext which checks IPs at connect time. +func isObviousPrivateHost(host string) bool { + if allowPrivateWebFetchHosts.Load() { + return false + } + + h := strings.ToLower(strings.TrimSpace(host)) + h = strings.TrimSuffix(h, ".") + if h == "" { + return true + } + + if h == "localhost" || strings.HasSuffix(h, ".localhost") { + return true + } + + if ip := net.ParseIP(h); ip != nil { + return isPrivateOrRestrictedIP(ip) + } + + return false +} + +// isPrivateOrRestrictedIP returns true for IPs that should never be reached via web_fetch: +// RFC 1918, loopback, link-local (incl. cloud metadata 169.254.x.x), carrier-grade NAT, +// IPv6 unique-local (fc00::/7), 6to4 (2002::/16), and Teredo (2001:0000::/32). +func isPrivateOrRestrictedIP(ip net.IP) bool { + if ip == nil { + return true + } + + if ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() || + ip.IsMulticast() || ip.IsUnspecified() { + return true + } + + if ip4 := ip.To4(); ip4 != nil { + // IPv4 private, loopback, link-local, and carrier-grade NAT ranges. + if ip4[0] == 10 || + ip4[0] == 127 || + ip4[0] == 0 || + (ip4[0] == 172 && ip4[1] >= 16 && ip4[1] <= 31) || + (ip4[0] == 192 && ip4[1] == 168) || + (ip4[0] == 169 && ip4[1] == 254) || + (ip4[0] == 100 && ip4[1] >= 64 && ip4[1] <= 127) { + return true + } + return false + } + + if len(ip) == net.IPv6len { + // IPv6 unique local addresses (fc00::/7) + if (ip[0] & 0xfe) == 0xfc { + return true + } + // 6to4 addresses (2002::/16): check the embedded IPv4 at bytes [2:6]. + if ip[0] == 0x20 && ip[1] == 0x02 { + embedded := net.IPv4(ip[2], ip[3], ip[4], ip[5]) + return isPrivateOrRestrictedIP(embedded) + } + // Teredo (2001:0000::/32): client IPv4 is at bytes [12:16], XOR-inverted. + if ip[0] == 0x20 && ip[1] == 0x01 && ip[2] == 0x00 && ip[3] == 0x00 { + client := net.IPv4(ip[12]^0xff, ip[13]^0xff, ip[14]^0xff, ip[15]^0xff) + return isPrivateOrRestrictedIP(client) + } + } + + return false +} diff --git a/pkg/tools/web_test.go b/pkg/tools/web_test.go index 188fb8adb..0737d2087 100644 --- a/pkg/tools/web_test.go +++ b/pkg/tools/web_test.go @@ -5,6 +5,7 @@ import ( "context" "encoding/json" "fmt" + "net" "net/http" "net/http/httptest" "strings" @@ -18,6 +19,8 @@ const testFetchLimit = int64(10 * 1024 * 1024) // TestWebTool_WebFetch_Success verifies successful URL fetching func TestWebTool_WebFetch_Success(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html") w.WriteHeader(http.StatusOK) @@ -55,6 +58,8 @@ func TestWebTool_WebFetch_Success(t *testing.T) { // TestWebTool_WebFetch_JSON verifies JSON content handling func TestWebTool_WebFetch_JSON(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + testData := map[string]string{"key": "value", "number": "123"} expectedJSON, _ := json.MarshalIndent(testData, "", " ") @@ -163,6 +168,8 @@ func TestWebTool_WebFetch_MissingURL(t *testing.T) { // TestWebTool_WebFetch_Truncation verifies content truncation func TestWebTool_WebFetch_Truncation(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + longContent := strings.Repeat("x", 20000) server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { @@ -205,6 +212,8 @@ func TestWebTool_WebFetch_Truncation(t *testing.T) { } func TestWebFetchTool_PayloadTooLarge(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + // Create a mock HTTP server ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html") @@ -290,6 +299,8 @@ func TestWebTool_WebSearch_MissingQuery(t *testing.T) { // TestWebTool_WebFetch_HTMLExtraction verifies HTML text extraction func TestWebTool_WebFetch_HTMLExtraction(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/html") w.WriteHeader(http.StatusOK) @@ -404,6 +415,205 @@ func TestWebFetchTool_extractText(t *testing.T) { } } +func withPrivateWebFetchHostsAllowed(t *testing.T) { + t.Helper() + previous := allowPrivateWebFetchHosts.Load() + allowPrivateWebFetchHosts.Store(true) + t.Cleanup(func() { + allowPrivateWebFetchHosts.Store(previous) + }) +} + +func TestWebTool_WebFetch_PrivateHostBlocked(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://127.0.0.1:0", + }) + + if !result.IsError { + t.Errorf("expected error for private host URL, got success") + } + if !strings.Contains(result.ForLLM, "private or local network") && + !strings.Contains(result.ForUser, "private or local network") { + t.Errorf("expected private host block message, got %q", result.ForLLM) + } +} + +func TestWebTool_WebFetch_PrivateHostAllowedForTests(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "text/plain") + w.WriteHeader(http.StatusOK) + w.Write([]byte("ok")) + })) + defer server.Close() + + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": server.URL, + }) + + if result.IsError { + t.Errorf("expected success when private host access is allowed in tests, got %q", result.ForLLM) + } +} + +// TestWebFetch_BlocksIPv4MappedIPv6Loopback verifies ::ffff:127.0.0.1 is blocked +func TestWebFetch_BlocksIPv4MappedIPv6Loopback(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://[::ffff:127.0.0.1]:0", + }) + + if !result.IsError { + t.Error("expected error for IPv4-mapped IPv6 loopback URL, got success") + } +} + +// TestWebFetch_BlocksMetadataIP verifies 169.254.169.254 is blocked +func TestWebFetch_BlocksMetadataIP(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://169.254.169.254/latest/meta-data", + }) + + if !result.IsError { + t.Error("expected error for cloud metadata IP, got success") + } +} + +// TestWebFetch_BlocksIPv6UniqueLocal verifies fc00::/7 addresses are blocked +func TestWebFetch_BlocksIPv6UniqueLocal(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://[fd00::1]:0", + }) + + if !result.IsError { + t.Error("expected error for IPv6 unique local address, got success") + } +} + +// TestWebFetch_Blocks6to4WithPrivateEmbed verifies 6to4 with private embedded IPv4 is blocked +func TestWebFetch_Blocks6to4WithPrivateEmbed(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + // 2002:7f00:0001::1 embeds 127.0.0.1 + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://[2002:7f00:0001::1]:0", + }) + + if !result.IsError { + t.Error("expected error for 6to4 with private embedded IPv4, got success") + } +} + +// TestWebFetch_Allows6to4WithPublicEmbed verifies 6to4 with public embedded IPv4 is NOT blocked +func TestWebFetch_Allows6to4WithPublicEmbed(t *testing.T) { + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + // 2002:0801:0101::1 embeds 8.1.1.1 (public) — pre-flight should pass, + // connection will fail (no listener) but that's after the SSRF check. + result := tool.Execute(context.Background(), map[string]any{ + "url": "http://[2002:0801:0101::1]:0", + }) + + // Should NOT be blocked by SSRF check — error should be connection failure, not "private" + if result.IsError && strings.Contains(result.ForLLM, "private") { + t.Error("6to4 with public embedded IPv4 should not be blocked as private") + } +} + +// TestWebFetch_RedirectToPrivateBlocked verifies redirects to private IPs are blocked +func TestWebFetch_RedirectToPrivateBlocked(t *testing.T) { + withPrivateWebFetchHostsAllowed(t) + + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Redirect to a private IP + http.Redirect(w, r, "http://10.0.0.1/secret", http.StatusFound) + })) + defer server.Close() + + // Temporarily disable private host allowance for the redirect check + allowPrivateWebFetchHosts.Store(false) + defer allowPrivateWebFetchHosts.Store(true) + + tool, err := NewWebFetchTool(50000, testFetchLimit) + if err != nil { + t.Fatalf("Failed to create web fetch tool: %v", err) + } + result := tool.Execute(context.Background(), map[string]any{ + "url": server.URL, + }) + + if !result.IsError { + t.Error("expected error when redirecting to private IP, got success") + } +} + +// TestIsPrivateOrRestrictedIP_Table tests IP classification logic +func TestIsPrivateOrRestrictedIP_Table(t *testing.T) { + tests := []struct { + ip string + blocked bool + desc string + }{ + {"127.0.0.1", true, "IPv4 loopback"}, + {"10.0.0.1", true, "IPv4 private class A"}, + {"172.16.0.1", true, "IPv4 private class B"}, + {"192.168.1.1", true, "IPv4 private class C"}, + {"169.254.169.254", true, "link-local / cloud metadata"}, + {"100.64.0.1", true, "carrier-grade NAT"}, + {"0.0.0.0", true, "unspecified"}, + {"8.8.8.8", false, "public DNS"}, + {"1.1.1.1", false, "public DNS"}, + {"::1", true, "IPv6 loopback"}, + {"::ffff:127.0.0.1", true, "IPv4-mapped IPv6 loopback"}, + {"::ffff:10.0.0.1", true, "IPv4-mapped IPv6 private"}, + {"fc00::1", true, "IPv6 unique local"}, + {"fd00::1", true, "IPv6 unique local"}, + {"2002:7f00:0001::1", true, "6to4 with embedded 127.x (private)"}, + {"2002:0a00:0001::1", true, "6to4 with embedded 10.0.0.1 (private)"}, + {"2002:0801:0101::1", false, "6to4 with embedded 8.1.1.1 (public)"}, + {"2001:0000:4136:e378:8000:63bf:f5ff:fffe", true, "Teredo with client 10.0.0.1 (private)"}, + {"2001:0000:4136:e378:8000:63bf:f7f6:fefe", false, "Teredo with client 8.9.1.1 (public)"}, + {"2607:f8b0:4004:800::200e", false, "public IPv6 (Google)"}, + } + + for _, tt := range tests { + t.Run(tt.desc, func(t *testing.T) { + ip := net.ParseIP(tt.ip) + if ip == nil { + t.Fatalf("failed to parse IP: %s", tt.ip) + } + got := isPrivateOrRestrictedIP(ip) + if got != tt.blocked { + t.Errorf("isPrivateOrRestrictedIP(%s) = %v, want %v", tt.ip, got, tt.blocked) + } + }) + } +} + // TestWebTool_WebFetch_MissingDomain verifies error handling for URL without domain func TestWebTool_WebFetch_MissingDomain(t *testing.T) { tool, err := NewWebFetchTool(50000, testFetchLimit) diff --git a/pkg/voice/transcriber.go b/pkg/voice/transcriber.go index e949d7a22..5b18612b1 100644 --- a/pkg/voice/transcriber.go +++ b/pkg/voice/transcriber.go @@ -166,11 +166,7 @@ func (t *GroqTranscriber) Name() string { // DetectTranscriber inspects cfg and returns the appropriate Transcriber, or // nil if no supported transcription provider is configured. func DetectTranscriber(cfg *config.Config) Transcriber { - // Direct Groq provider config takes priority. - if key := cfg.Providers.Groq.APIKey; key != "" { - return NewGroqTranscriber(key) - } - // Fall back to any model-list entry that uses the groq/ protocol. + // return any model-list entry that uses the groq/ protocol. for _, mc := range cfg.ModelList { if strings.HasPrefix(mc.Model, "groq/") && mc.APIKey != "" { return NewGroqTranscriber(mc.APIKey) diff --git a/pkg/voice/transcriber_test.go b/pkg/voice/transcriber_test.go index 9b6add333..e7d10c40f 100644 --- a/pkg/voice/transcriber_test.go +++ b/pkg/voice/transcriber_test.go @@ -34,15 +34,6 @@ func TestDetectTranscriber(t *testing.T) { cfg: &config.Config{}, wantNil: true, }, - { - name: "groq provider key", - cfg: &config.Config{ - Providers: config.ProvidersConfig{ - Groq: config.ProviderConfig{APIKey: "sk-groq-direct"}, - }, - }, - wantName: "groq", - }, { name: "groq via model list", cfg: &config.Config{ @@ -65,9 +56,6 @@ func TestDetectTranscriber(t *testing.T) { { name: "provider key takes priority over model list", cfg: &config.Config{ - Providers: config.ProvidersConfig{ - Groq: config.ProviderConfig{APIKey: "sk-groq-direct"}, - }, ModelList: []config.ModelConfig{ {Model: "groq/llama-3.3-70b", APIKey: "sk-groq-model"}, }, diff --git a/web/backend/api/config.go b/web/backend/api/config.go index f160b42b6..091e3fbae 100644 --- a/web/backend/api/config.go +++ b/web/backend/api/config.go @@ -5,7 +5,6 @@ import ( "fmt" "io" "net/http" - "os" "github.com/sipeed/picoclaw/pkg/config" ) @@ -17,36 +16,11 @@ func (h *Handler) registerConfigRoutes(mux *http.ServeMux) { mux.HandleFunc("PATCH /api/config", h.handlePatchConfig) } -// loadFilteredConfig loads the configuration and filters out default placeholder credentials -// (like API limits/keys) if the configuration file has not been created yet by the user. -func (h *Handler) loadFilteredConfig() (*config.Config, error) { - cfg, err := config.LoadConfig(h.configPath) - if err != nil { - return nil, err - } - - configExists := false - if h.configPath != "" { - if _, err := os.Stat(h.configPath); err == nil { - configExists = true - } - } - - if !configExists { - for i := range cfg.ModelList { - cfg.ModelList[i].APIKey = "" - cfg.ModelList[i].AuthMethod = "" - } - } - - return cfg, nil -} - // handleGetConfig returns the complete system configuration. // // GET /api/config func (h *Handler) handleGetConfig(w http.ResponseWriter, r *http.Request) { - cfg, err := h.loadFilteredConfig() + cfg, err := config.LoadConfig(h.configPath) if err != nil { http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) return @@ -74,6 +48,9 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) { http.Error(w, fmt.Sprintf("Invalid JSON: %v", err), http.StatusBadRequest) return } + if execAllowRemoteOmitted(body) { + cfg.Tools.Exec.AllowRemote = config.DefaultConfig().Tools.Exec.AllowRemote + } if errs := validateConfig(&cfg); len(errs) > 0 { w.Header().Set("Content-Type", "application/json") @@ -94,6 +71,20 @@ func (h *Handler) handleUpdateConfig(w http.ResponseWriter, r *http.Request) { json.NewEncoder(w).Encode(map[string]string{"status": "ok"}) } +func execAllowRemoteOmitted(body []byte) bool { + var raw struct { + Tools *struct { + Exec *struct { + AllowRemote *bool `json:"allow_remote"` + } `json:"exec"` + } `json:"tools"` + } + if err := json.Unmarshal(body, &raw); err != nil { + return false + } + return raw.Tools == nil || raw.Tools.Exec == nil || raw.Tools.Exec.AllowRemote == nil +} + // handlePatchConfig partially updates the system configuration using JSON Merge Patch (RFC 7396). // Only the fields present in the request body will be updated; all other fields remain unchanged. // diff --git a/web/backend/api/config_test.go b/web/backend/api/config_test.go new file mode 100644 index 000000000..29811e37e --- /dev/null +++ b/web/backend/api/config_test.go @@ -0,0 +1,88 @@ +package api + +import ( + "bytes" + "net/http" + "net/http/httptest" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestHandleUpdateConfig_PreservesExecAllowRemoteDefaultWhenOmitted(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + req := httptest.NewRequest(http.MethodPut, "/api/config", bytes.NewBufferString(`{ + "agents": { + "defaults": { + "workspace": "~/.picoclaw/workspace" + } + }, + "model_list": [ + { + "model_name": "custom-default", + "model": "openai/gpt-4o", + "api_key": "sk-default" + } + ] + }`)) + req.Header.Set("Content-Type", "application/json") + + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + if !cfg.Tools.Exec.AllowRemote { + t.Fatal("tools.exec.allow_remote should remain true when omitted from PUT /api/config") + } +} + +func TestHandleUpdateConfig_DoesNotInheritDefaultModelFields(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + req := httptest.NewRequest(http.MethodPut, "/api/config", bytes.NewBufferString(`{ + "agents": { + "defaults": { + "workspace": "~/.picoclaw/workspace" + } + }, + "model_list": [ + { + "model_name": "custom-default", + "model": "openai/gpt-4o", + "api_key": "sk-default" + } + ] + }`)) + req.Header.Set("Content-Type", "application/json") + + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + if got := cfg.ModelList[0].APIBase; got != "" { + t.Fatalf("model_list[0].api_base = %q, want empty string", got) + } +} diff --git a/web/backend/api/gateway.go b/web/backend/api/gateway.go index 8f86dd73d..41f702e32 100644 --- a/web/backend/api/gateway.go +++ b/web/backend/api/gateway.go @@ -10,7 +10,6 @@ import ( "net/http" "os" "os/exec" - "path/filepath" "runtime" "strconv" "strings" @@ -19,6 +18,7 @@ import ( "time" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/web/backend/utils" ) // gateway holds the state for the managed gateway process. @@ -36,6 +36,7 @@ var gateway = struct { func (h *Handler) registerGatewayRoutes(mux *http.ServeMux) { mux.HandleFunc("GET /api/gateway/status", h.handleGatewayStatus) mux.HandleFunc("GET /api/gateway/events", h.handleGatewayEvents) + mux.HandleFunc("POST /api/gateway/logs/clear", h.handleGatewayClearLogs) mux.HandleFunc("POST /api/gateway/start", h.handleGatewayStart) mux.HandleFunc("POST /api/gateway/stop", h.handleGatewayStop) mux.HandleFunc("POST /api/gateway/restart", h.handleGatewayRestart) @@ -89,11 +90,12 @@ func (h *Handler) gatewayStartReady() (bool, string, error) { return false, fmt.Sprintf("default model %q is invalid", modelName), nil } - hasCredential := strings.TrimSpace(modelCfg.APIKey) != "" || - strings.TrimSpace(modelCfg.AuthMethod) != "" - if !hasCredential { + if !hasModelConfiguration(*modelCfg) { return false, fmt.Sprintf("default model %q has no credentials configured", modelName), nil } + if requiresRuntimeProbe(*modelCfg) && !probeLocalModelAvailability(*modelCfg) { + return false, fmt.Sprintf("default model %q is not reachable", modelName), nil + } return true, "", nil } @@ -131,14 +133,18 @@ func isCmdProcessAliveLocked(cmd *exec.Cmd) bool { func (h *Handler) startGatewayLocked() (int, error) { // Locate the picoclaw executable - execPath := findPicoclawBinary() + execPath := utils.FindPicoclawBinary() cmd := exec.Command(execPath, "gateway") + cmd.Env = os.Environ() // Forward the launcher's config path via the environment variable that // GetConfigPath() already reads, so the gateway sub-process uses the same // config file without requiring a --config flag on the gateway subcommand. if h.configPath != "" { - cmd.Env = append(os.Environ(), "PICOCLAW_CONFIG="+h.configPath) + cmd.Env = append(cmd.Env, "PICOCLAW_CONFIG="+h.configPath) + } + if host := h.gatewayHostOverride(); host != "" { + cmd.Env = append(cmd.Env, "PICOCLAW_GATEWAY_HOST="+host) } stdoutPipe, err := cmd.StdoutPipe() @@ -207,10 +213,7 @@ func (h *Handler) startGatewayLocked() (int, error) { if err != nil { continue } - healthHost := "127.0.0.1" - if cfg.Gateway.Host != "" && cfg.Gateway.Host != "0.0.0.0" { - healthHost = cfg.Gateway.Host - } + healthHost := gatewayProbeHost(h.effectiveGatewayBindHost(cfg)) healthPort := cfg.Gateway.Port if healthPort == 0 { healthPort = 18790 @@ -353,6 +356,20 @@ func (h *Handler) handleGatewayRestart(w http.ResponseWriter, r *http.Request) { h.handleGatewayStart(w, r) } +// handleGatewayClearLogs clears the in-memory gateway log buffer. +// +// POST /api/gateway/logs/clear +func (h *Handler) handleGatewayClearLogs(w http.ResponseWriter, r *http.Request) { + gateway.logs.Clear() + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]any{ + "status": "cleared", + "log_total": 0, + "log_run_id": gateway.logs.RunID(), + }) +} + // handleGatewayStatus returns the gateway run status, health info, and logs. // // GET /api/gateway/status @@ -375,9 +392,7 @@ func (h *Handler) handleGatewayStatus(w http.ResponseWriter, r *http.Request) { host := "127.0.0.1" port := 18790 if err == nil && cfg != nil { - if cfg.Gateway.Host != "" && cfg.Gateway.Host != "0.0.0.0" { - host = cfg.Gateway.Host - } + host = gatewayProbeHost(h.effectiveGatewayBindHost(cfg)) if cfg.Gateway.Port != 0 { port = cfg.Gateway.Port } @@ -535,36 +550,6 @@ func (h *Handler) currentGatewayStatus() string { return string(encoded) } -// findPicoclawBinary locates the picoclaw executable. -// Search order: -// 1. PICOCLAW_BINARY environment variable (explicit override) -// 2. Same directory as the current executable -// 3. Falls back to "picoclaw" and relies on $PATH -func findPicoclawBinary() string { - binaryName := "picoclaw" - if runtime.GOOS == "windows" { - binaryName = "picoclaw.exe" - } - - // 1. Explicit override via environment variable - if p := os.Getenv("PICOCLAW_BINARY"); p != "" { - if info, _ := os.Stat(p); info != nil && !info.IsDir() { - return p - } - } - - // 2. Same directory as the launcher executable - if exe, err := os.Executable(); err == nil { - candidate := filepath.Join(filepath.Dir(exe), binaryName) - if info, err := os.Stat(candidate); err == nil && !info.IsDir() { - return candidate - } - } - - // 3. Fall back to PATH lookup - return "picoclaw" -} - // scanPipe reads lines from r and appends them to buf. Returns when r reaches EOF. func scanPipe(r io.Reader, buf *LogBuffer) { scanner := bufio.NewScanner(r) diff --git a/web/backend/api/gateway_host.go b/web/backend/api/gateway_host.go new file mode 100644 index 000000000..a499c1ea2 --- /dev/null +++ b/web/backend/api/gateway_host.go @@ -0,0 +1,66 @@ +package api + +import ( + "net" + "net/http" + "strconv" + "strings" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func (h *Handler) effectiveLauncherPublic() bool { + if h.serverPublicExplicit { + return h.serverPublic + } + + cfg, err := h.loadLauncherConfig() + if err == nil { + return cfg.Public + } + + return h.serverPublic +} + +func (h *Handler) gatewayHostOverride() string { + if h.effectiveLauncherPublic() { + return "0.0.0.0" + } + return "" +} + +func (h *Handler) effectiveGatewayBindHost(cfg *config.Config) string { + if override := h.gatewayHostOverride(); override != "" { + return override + } + if cfg == nil { + return "" + } + return strings.TrimSpace(cfg.Gateway.Host) +} + +func gatewayProbeHost(bindHost string) string { + if bindHost == "" || bindHost == "0.0.0.0" { + return "127.0.0.1" + } + return bindHost +} + +func requestHostName(r *http.Request) string { + reqHost, _, err := net.SplitHostPort(r.Host) + if err == nil { + return reqHost + } + if strings.TrimSpace(r.Host) != "" { + return r.Host + } + return "127.0.0.1" +} + +func (h *Handler) buildWsURL(r *http.Request, cfg *config.Config) string { + host := h.effectiveGatewayBindHost(cfg) + if host == "" || host == "0.0.0.0" { + host = requestHostName(r) + } + return "ws://" + net.JoinHostPort(host, strconv.Itoa(cfg.Gateway.Port)) + "/pico/ws" +} diff --git a/web/backend/api/gateway_host_test.go b/web/backend/api/gateway_host_test.go new file mode 100644 index 000000000..afd600359 --- /dev/null +++ b/web/backend/api/gateway_host_test.go @@ -0,0 +1,59 @@ +package api + +import ( + "net/http/httptest" + "path/filepath" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/web/backend/launcherconfig" +) + +func TestGatewayHostOverrideUsesExplicitRuntimePublic(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + launcherPath := launcherconfig.PathForAppConfig(configPath) + if err := launcherconfig.Save(launcherPath, launcherconfig.Config{ + Port: 18800, + Public: false, + }); err != nil { + t.Fatalf("launcherconfig.Save() error = %v", err) + } + + h := NewHandler(configPath) + h.SetServerOptions(18800, true, true, nil) + + if got := h.gatewayHostOverride(); got != "0.0.0.0" { + t.Fatalf("gatewayHostOverride() = %q, want %q", got, "0.0.0.0") + } +} + +func TestBuildWsURLUsesRequestHostWhenLauncherPublicSaved(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + launcherPath := launcherconfig.PathForAppConfig(configPath) + if err := launcherconfig.Save(launcherPath, launcherconfig.Config{ + Port: 18800, + Public: true, + }); err != nil { + t.Fatalf("launcherconfig.Save() error = %v", err) + } + + h := NewHandler(configPath) + h.SetServerOptions(18800, false, false, nil) + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "127.0.0.1" + cfg.Gateway.Port = 18790 + + req := httptest.NewRequest("GET", "http://launcher.local/api/pico/token", nil) + req.Host = "192.168.1.9:18800" + + if got := h.buildWsURL(req, cfg); got != "ws://192.168.1.9:18790/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "ws://192.168.1.9:18790/pico/ws") + } +} + +func TestGatewayProbeHostUsesLoopbackForWildcardBind(t *testing.T) { + if got := gatewayProbeHost("0.0.0.0"); got != "127.0.0.1" { + t.Fatalf("gatewayProbeHost() = %q, want %q", got, "127.0.0.1") + } +} diff --git a/web/backend/api/gateway_test.go b/web/backend/api/gateway_test.go index 998c133b5..c7fb4dbc8 100644 --- a/web/backend/api/gateway_test.go +++ b/web/backend/api/gateway_test.go @@ -6,10 +6,13 @@ import ( "net/http/httptest" "os" "path/filepath" + "strconv" "strings" "testing" + "github.com/sipeed/picoclaw/pkg/auth" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/web/backend/utils" ) func TestGatewayStartReady_NoDefaultModel(t *testing.T) { @@ -31,8 +34,9 @@ func TestGatewayStartReady_NoDefaultModel(t *testing.T) { func TestGatewayStartReady_InvalidDefaultModel(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() - cfg.Agents.Defaults.Model = "missing-model" - if err := config.SaveConfig(configPath, cfg); err != nil { + cfg.Agents.Defaults.ModelName = "missing-model" + err := config.SaveConfig(configPath, cfg) + if err != nil { t.Fatalf("SaveConfig() error = %v", err) } @@ -54,7 +58,8 @@ func TestGatewayStartReady_ValidDefaultModel(t *testing.T) { cfg := config.DefaultConfig() cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName cfg.ModelList[0].APIKey = "test-key" - if err := config.SaveConfig(configPath, cfg); err != nil { + err := config.SaveConfig(configPath, cfg) + if err != nil { t.Fatalf("SaveConfig() error = %v", err) } @@ -74,7 +79,8 @@ func TestGatewayStartReady_DefaultModelWithoutCredential(t *testing.T) { cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName cfg.ModelList[0].APIKey = "" cfg.ModelList[0].AuthMethod = "" - if err := config.SaveConfig(configPath, cfg); err != nil { + err := config.SaveConfig(configPath, cfg) + if err != nil { t.Fatalf("SaveConfig() error = %v", err) } @@ -91,6 +97,195 @@ func TestGatewayStartReady_DefaultModelWithoutCredential(t *testing.T) { } } +func TestGatewayStartReady_LocalModelWithoutAPIKey(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetModelProbeHooks(t) + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + return false + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "local-vllm", + Model: "vllm/custom-model", + APIBase: "http://localhost:8000/v1", + }} + cfg.Agents.Defaults.ModelName = "local-vllm" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if ready { + t.Fatalf("gatewayStartReady() ready = true, want false without a running local service") + } + if !strings.Contains(reason, "not reachable") { + t.Fatalf("gatewayStartReady() reason = %q, want contains %q", reason, "not reachable") + } +} + +func TestGatewayStartReady_LocalModelWithRunningService(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetModelProbeHooks(t) + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "local-vllm", + Model: "vllm/custom-model", + APIBase: "http://127.0.0.1:8000/v1", + }} + cfg.Agents.Defaults.ModelName = "local-vllm" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if !ready { + t.Fatalf("gatewayStartReady() ready = false, want true with a running local service (reason=%q)", reason) + } +} + +func TestGatewayStartReady_RemoteVLLMWithAPIKeyDoesNotProbe(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetModelProbeHooks(t) + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + t.Fatalf("unexpected OpenAI-compatible probe for %q (%q)", apiBase, modelID) + return false + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "remote-vllm", + Model: "vllm/custom-model", + APIBase: "https://models.example.com/v1", + APIKey: "remote-key", + }} + cfg.Agents.Defaults.ModelName = "remote-vllm" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if !ready { + t.Fatalf("gatewayStartReady() ready = false, want true for remote vllm with api key (reason=%q)", reason) + } +} + +func TestGatewayStartReady_LocalOllamaUsesDefaultProbeBase(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetModelProbeHooks(t) + + probeOllamaModelFunc = func(apiBase, modelID string) bool { + return apiBase == "http://localhost:11434/v1" && modelID == "llama3" + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "local-ollama", + Model: "ollama/llama3", + }} + cfg.Agents.Defaults.ModelName = "local-ollama" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if !ready { + t.Fatalf("gatewayStartReady() ready = false, want true with default Ollama probe base (reason=%q)", reason) + } +} + +func TestGatewayStartReady_OAuthModelRequiresStoredCredential(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "openai-oauth", + Model: "openai/gpt-5.2", + AuthMethod: "oauth", + }} + cfg.Agents.Defaults.ModelName = "openai-oauth" + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + ready, reason, err := h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if ready { + t.Fatalf("gatewayStartReady() ready = true, want false without stored credential") + } + if !strings.Contains(reason, "no credentials configured") { + t.Fatalf("gatewayStartReady() reason = %q, want contains %q", reason, "no credentials configured") + } + + err = auth.SetCredential(oauthProviderOpenAI, &auth.AuthCredential{ + AccessToken: "openai-token", + Provider: oauthProviderOpenAI, + AuthMethod: "oauth", + }) + if err != nil { + t.Fatalf("SetCredential() error = %v", err) + } + + ready, reason, err = h.gatewayStartReady() + if err != nil { + t.Fatalf("gatewayStartReady() error = %v", err) + } + if !ready { + t.Fatalf("gatewayStartReady() ready = false, want true with stored credential (reason=%q)", reason) + } +} + func TestGatewayStatusIncludesStartConditionWhenNotReady(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") h := NewHandler(configPath) @@ -122,6 +317,71 @@ func TestGatewayStatusIncludesStartConditionWhenNotReady(t *testing.T) { } } +func TestGatewayClearLogsResetsBufferedHistory(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + gateway.logs.Clear() + gateway.logs.Append("first line") + gateway.logs.Append("second line") + previousRunID := gateway.logs.RunID() + + clearRec := httptest.NewRecorder() + clearReq := httptest.NewRequest(http.MethodPost, "/api/gateway/logs/clear", nil) + mux.ServeHTTP(clearRec, clearReq) + + if clearRec.Code != http.StatusOK { + t.Fatalf("clear status = %d, want %d", clearRec.Code, http.StatusOK) + } + + var clearBody map[string]any + if err := json.Unmarshal(clearRec.Body.Bytes(), &clearBody); err != nil { + t.Fatalf("unmarshal clear response: %v", err) + } + + if got := clearBody["status"]; got != "cleared" { + t.Fatalf("clear status body = %#v, want %q", got, "cleared") + } + + clearRunID, ok := clearBody["log_run_id"].(float64) + if !ok { + t.Fatalf("log_run_id missing or not number: %#v", clearBody["log_run_id"]) + } + if int(clearRunID) <= previousRunID { + t.Fatalf("log_run_id = %d, want > %d", int(clearRunID), previousRunID) + } + + statusRec := httptest.NewRecorder() + statusReq := httptest.NewRequest( + http.MethodGet, + "/api/gateway/status?log_offset=0&log_run_id="+strconv.Itoa(previousRunID), + nil, + ) + mux.ServeHTTP(statusRec, statusReq) + + if statusRec.Code != http.StatusOK { + t.Fatalf("status code = %d, want %d", statusRec.Code, http.StatusOK) + } + + var statusBody map[string]any + if err := json.Unmarshal(statusRec.Body.Bytes(), &statusBody); err != nil { + t.Fatalf("unmarshal status response: %v", err) + } + + logs, ok := statusBody["logs"].([]any) + if !ok { + t.Fatalf("logs missing or not array: %#v", statusBody["logs"]) + } + if len(logs) != 0 { + t.Fatalf("logs len = %d, want 0", len(logs)) + } + if got := statusBody["log_total"]; got != float64(0) { + t.Fatalf("log_total = %#v, want 0", got) + } +} + func TestFindPicoclawBinary_EnvOverride(t *testing.T) { // Create a temporary file to act as the mock binary tmpDir := t.TempDir() @@ -132,9 +392,9 @@ func TestFindPicoclawBinary_EnvOverride(t *testing.T) { t.Setenv("PICOCLAW_BINARY", mockBinary) - got := findPicoclawBinary() + got := utils.FindPicoclawBinary() if got != mockBinary { - t.Errorf("findPicoclawBinary() = %q, want %q", got, mockBinary) + t.Errorf("FindPicoclawBinary() = %q, want %q", got, mockBinary) } } @@ -142,9 +402,9 @@ func TestFindPicoclawBinary_EnvOverride_InvalidPath(t *testing.T) { // When PICOCLAW_BINARY points to a non-existent path, fall through to next strategy t.Setenv("PICOCLAW_BINARY", "/nonexistent/picoclaw-binary") - got := findPicoclawBinary() + got := utils.FindPicoclawBinary() // Should not return the invalid path; falls back to "picoclaw" or another found path if got == "/nonexistent/picoclaw-binary" { - t.Errorf("findPicoclawBinary() returned invalid env path %q, expected fallback", got) + t.Errorf("FindPicoclawBinary() returned invalid env path %q, expected fallback", got) } } diff --git a/web/backend/api/launcher_config_test.go b/web/backend/api/launcher_config_test.go index 5049dd88f..0d6af823c 100644 --- a/web/backend/api/launcher_config_test.go +++ b/web/backend/api/launcher_config_test.go @@ -14,7 +14,7 @@ import ( func TestGetLauncherConfigUsesRuntimeFallback(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") h := NewHandler(configPath) - h.SetServerOptions(19999, true, []string{"192.168.1.0/24"}) + h.SetServerOptions(19999, true, false, []string{"192.168.1.0/24"}) mux := http.NewServeMux() h.RegisterRoutes(mux) diff --git a/web/backend/api/log.go b/web/backend/api/log.go index ecf7d422f..f83f6f34c 100644 --- a/web/backend/api/log.go +++ b/web/backend/api/log.go @@ -4,7 +4,7 @@ import "sync" // LogBuffer is a thread-safe ring buffer that stores the most recent N log lines. // It supports incremental reads via LinesSince and tracks a runID that increments -// on each Reset (used to detect gateway restarts). +// whenever the buffer is reset or cleared so clients can detect log history resets. type LogBuffer struct { mu sync.RWMutex lines []string @@ -45,6 +45,12 @@ func (b *LogBuffer) Reset() { b.runID++ } +// Clear removes all buffered lines and increments the runID so clients treat +// subsequent reads as a new log stream. +func (b *LogBuffer) Clear() { + b.Reset() +} + // LinesSince returns lines appended after the given offset, the current total count, and the runID. // If offset >= total, no lines are returned. If offset is too old (evicted), all buffered lines are returned. func (b *LogBuffer) LinesSince(offset int) (lines []string, total int, runID int) { diff --git a/web/backend/api/model_status.go b/web/backend/api/model_status.go new file mode 100644 index 000000000..22bf5c15b --- /dev/null +++ b/web/backend/api/model_status.go @@ -0,0 +1,324 @@ +package api + +import ( + "encoding/json" + "fmt" + "net" + "net/http" + "net/url" + "strings" + "time" + + "github.com/sipeed/picoclaw/pkg/config" +) + +const modelProbeTimeout = 800 * time.Millisecond + +var ( + probeTCPServiceFunc = probeTCPService + probeOllamaModelFunc = probeOllamaModel + probeOpenAICompatibleModelFunc = probeOpenAICompatibleModel +) + +func hasModelConfiguration(m config.ModelConfig) bool { + authMethod := strings.ToLower(strings.TrimSpace(m.AuthMethod)) + apiKey := strings.TrimSpace(m.APIKey) + + if authMethod == "oauth" || authMethod == "token" { + if provider, ok := oauthProviderForModel(m.Model); ok { + cred, err := oauthGetCredential(provider) + if err != nil || cred == nil { + return false + } + return strings.TrimSpace(cred.AccessToken) != "" || strings.TrimSpace(cred.RefreshToken) != "" + } + return true + } + + if requiresRuntimeProbe(m) { + return true + } + + return apiKey != "" +} + +// isModelConfigured reports whether a model is currently available to use. +// Local models must be reachable; remote/API-key models only need saved config. +func isModelConfigured(m config.ModelConfig) bool { + if !hasModelConfiguration(m) { + return false + } + if requiresRuntimeProbe(m) { + return probeLocalModelAvailability(m) + } + return true +} + +func requiresRuntimeProbe(m config.ModelConfig) bool { + authMethod := strings.ToLower(strings.TrimSpace(m.AuthMethod)) + if authMethod == "local" { + return true + } + + switch modelProtocol(m.Model) { + case "claude-cli", "claudecli", "codex-cli", "codexcli", "github-copilot", "copilot": + return true + case "ollama", "vllm": + apiBase := strings.TrimSpace(m.APIBase) + return apiBase == "" || hasLocalAPIBase(apiBase) + } + + if hasLocalAPIBase(m.APIBase) { + return true + } + + return false +} + +func probeLocalModelAvailability(m config.ModelConfig) bool { + apiBase := modelProbeAPIBase(m) + protocol, modelID := splitModel(m.Model) + switch protocol { + case "ollama": + return probeOllamaModelFunc(apiBase, modelID) + case "vllm": + return probeOpenAICompatibleModelFunc(apiBase, modelID) + case "github-copilot", "copilot": + return probeTCPServiceFunc(apiBase) + case "claude-cli", "claudecli", "codex-cli", "codexcli": + return true + default: + if hasLocalAPIBase(apiBase) { + return probeOpenAICompatibleModelFunc(apiBase, modelID) + } + return false + } +} + +func modelProbeAPIBase(m config.ModelConfig) string { + if apiBase := strings.TrimSpace(m.APIBase); apiBase != "" { + return normalizeModelProbeAPIBase(apiBase) + } + + switch modelProtocol(m.Model) { + case "ollama": + return "http://localhost:11434/v1" + case "vllm": + return "http://localhost:8000/v1" + case "github-copilot", "copilot": + return "localhost:4321" + default: + return "" + } +} + +func normalizeModelProbeAPIBase(raw string) string { + u, err := parseAPIBase(raw) + if err != nil { + return strings.TrimSpace(raw) + } + + switch strings.ToLower(u.Hostname()) { + case "0.0.0.0": + u.Host = net.JoinHostPort("127.0.0.1", u.Port()) + case "::": + u.Host = net.JoinHostPort("::1", u.Port()) + default: + return strings.TrimSpace(raw) + } + + if u.Port() == "" { + u.Host = u.Hostname() + } + + return u.String() +} + +func oauthProviderForModel(model string) (string, bool) { + switch modelProtocol(model) { + case "openai": + return oauthProviderOpenAI, true + case "anthropic": + return oauthProviderAnthropic, true + case "antigravity", "google-antigravity": + return oauthProviderGoogleAntigravity, true + default: + return "", false + } +} + +func modelProtocol(model string) string { + protocol, _ := splitModel(model) + return protocol +} + +func splitModel(model string) (protocol, modelID string) { + model = strings.ToLower(strings.TrimSpace(model)) + protocol, _, found := strings.Cut(model, "/") + if !found { + return "openai", model + } + return protocol, strings.TrimSpace(model[strings.Index(model, "/")+1:]) +} + +func hasLocalAPIBase(raw string) bool { + raw = strings.TrimSpace(raw) + if raw == "" { + return false + } + + u, err := url.Parse(raw) + if err != nil || u.Hostname() == "" { + u, err = url.Parse("//" + raw) + if err != nil { + return false + } + } + + switch strings.ToLower(u.Hostname()) { + case "localhost", "127.0.0.1", "::1", "0.0.0.0": + return true + default: + return false + } +} + +func probeTCPService(raw string) bool { + hostPort, err := hostPortFromAPIBase(raw) + if err != nil { + return false + } + + conn, err := net.DialTimeout("tcp", hostPort, modelProbeTimeout) + if err != nil { + return false + } + _ = conn.Close() + return true +} + +func probeOllamaModel(apiBase, modelID string) bool { + root, err := apiRootFromAPIBase(apiBase) + if err != nil { + return false + } + + var resp struct { + Models []struct { + Name string `json:"name"` + Model string `json:"model"` + } `json:"models"` + } + if err := getJSON(root+"/api/tags", &resp); err != nil { + return false + } + + for _, model := range resp.Models { + if ollamaModelMatches(model.Name, modelID) || ollamaModelMatches(model.Model, modelID) { + return true + } + } + return false +} + +func probeOpenAICompatibleModel(apiBase, modelID string) bool { + if strings.TrimSpace(apiBase) == "" { + return false + } + + var resp struct { + Data []struct { + ID string `json:"id"` + } `json:"data"` + } + if err := getJSON(strings.TrimRight(strings.TrimSpace(apiBase), "/")+"/models", &resp); err != nil { + return false + } + + for _, model := range resp.Data { + if strings.EqualFold(strings.TrimSpace(model.ID), modelID) { + return true + } + } + return false +} + +func getJSON(rawURL string, out any) error { + req, err := http.NewRequest(http.MethodGet, rawURL, nil) + if err != nil { + return err + } + + client := &http.Client{Timeout: modelProbeTimeout} + resp, err := client.Do(req) + if err != nil { + return err + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + return fmt.Errorf("unexpected status %d", resp.StatusCode) + } + + return json.NewDecoder(resp.Body).Decode(out) +} + +func apiRootFromAPIBase(raw string) (string, error) { + u, err := parseAPIBase(raw) + if err != nil { + return "", err + } + return (&url.URL{Scheme: u.Scheme, Host: u.Host}).String(), nil +} + +func hostPortFromAPIBase(raw string) (string, error) { + u, err := parseAPIBase(raw) + if err != nil { + return "", err + } + + if port := u.Port(); port != "" { + return u.Host, nil + } + switch strings.ToLower(u.Scheme) { + case "https": + return net.JoinHostPort(u.Hostname(), "443"), nil + default: + return net.JoinHostPort(u.Hostname(), "80"), nil + } +} + +func parseAPIBase(raw string) (*url.URL, error) { + raw = strings.TrimSpace(raw) + if raw == "" { + return nil, fmt.Errorf("empty api base") + } + + u, err := url.Parse(raw) + if err == nil && u.Hostname() != "" { + return u, nil + } + + u, err = url.Parse("//" + raw) + if err != nil || u.Hostname() == "" { + return nil, fmt.Errorf("invalid api base %q", raw) + } + if u.Scheme == "" { + u.Scheme = "http" + } + return u, nil +} + +func ollamaModelMatches(candidate, want string) bool { + candidate = strings.TrimSpace(candidate) + want = strings.TrimSpace(want) + if candidate == "" || want == "" { + return false + } + if strings.EqualFold(candidate, want) { + return true + } + + base, _, _ := strings.Cut(candidate, ":") + return strings.EqualFold(base, want) +} diff --git a/web/backend/api/models.go b/web/backend/api/models.go index cb57d6f2e..2e3f3dd55 100644 --- a/web/backend/api/models.go +++ b/web/backend/api/models.go @@ -6,6 +6,7 @@ import ( "io" "net/http" "strconv" + "sync" "github.com/sipeed/picoclaw/pkg/config" ) @@ -45,13 +46,24 @@ type modelResponse struct { // // GET /api/models func (h *Handler) handleListModels(w http.ResponseWriter, r *http.Request) { - cfg, err := h.loadFilteredConfig() + cfg, err := config.LoadConfig(h.configPath) if err != nil { http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) return } defaultModel := cfg.Agents.Defaults.GetModelName() + configured := make([]bool, len(cfg.ModelList)) + + var wg sync.WaitGroup + wg.Add(len(cfg.ModelList)) + for i, m := range cfg.ModelList { + go func(i int, m config.ModelConfig) { + defer wg.Done() + configured[i] = isModelConfigured(m) + }(i, m) + } + wg.Wait() models := make([]modelResponse, 0, len(cfg.ModelList)) for i, m := range cfg.ModelList { @@ -69,7 +81,7 @@ func (h *Handler) handleListModels(w http.ResponseWriter, r *http.Request) { MaxTokensField: m.MaxTokensField, RequestTimeout: m.RequestTimeout, ThinkingLevel: m.ThinkingLevel, - Configured: m.APIKey != "" || m.AuthMethod != "", + Configured: configured[i], IsDefault: m.ModelName == defaultModel, }) } @@ -212,9 +224,6 @@ func (h *Handler) handleDeleteModel(w http.ResponseWriter, r *http.Request) { if cfg.Agents.Defaults.ModelName == deletedModelName { cfg.Agents.Defaults.ModelName = "" } - if cfg.Agents.Defaults.Model == deletedModelName { - cfg.Agents.Defaults.Model = "" - } if err := config.SaveConfig(h.configPath, cfg); err != nil { http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) diff --git a/web/backend/api/models_test.go b/web/backend/api/models_test.go new file mode 100644 index 000000000..7061eb3f7 --- /dev/null +++ b/web/backend/api/models_test.go @@ -0,0 +1,313 @@ +package api + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "sync" + "testing" + "time" + + "github.com/sipeed/picoclaw/pkg/auth" + "github.com/sipeed/picoclaw/pkg/config" +) + +func resetModelProbeHooks(t *testing.T) { + t.Helper() + + origTCPProbe := probeTCPServiceFunc + origOllamaProbe := probeOllamaModelFunc + origOpenAIProbe := probeOpenAICompatibleModelFunc + t.Cleanup(func() { + probeTCPServiceFunc = origTCPProbe + probeOllamaModelFunc = origOllamaProbe + probeOpenAICompatibleModelFunc = origOpenAIProbe + }) +} + +func TestHandleListModels_ConfiguredStatusUsesRuntimeProbesForLocalModels(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetOAuthHooks(t) + resetModelProbeHooks(t) + + var mu sync.Mutex + var openAIProbes []string + var ollamaProbes []string + var tcpProbes []string + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + mu.Lock() + openAIProbes = append(openAIProbes, apiBase+"|"+modelID) + mu.Unlock() + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + } + probeOllamaModelFunc = func(apiBase, modelID string) bool { + mu.Lock() + ollamaProbes = append(ollamaProbes, apiBase+"|"+modelID) + mu.Unlock() + return apiBase == "http://localhost:11434/v1" && modelID == "llama3" + } + probeTCPServiceFunc = func(apiBase string) bool { + mu.Lock() + tcpProbes = append(tcpProbes, apiBase) + mu.Unlock() + return apiBase == "http://127.0.0.1:4321" + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{ + { + ModelName: "openai-oauth", + Model: "openai/gpt-5.2", + AuthMethod: "oauth", + }, + { + ModelName: "vllm-local", + Model: "vllm/custom-model", + APIBase: "http://127.0.0.1:8000/v1", + }, + { + ModelName: "ollama-default", + Model: "ollama/llama3", + }, + { + ModelName: "vllm-remote", + Model: "vllm/custom-model", + APIBase: "https://models.example.com/v1", + APIKey: "remote-key", + }, + { + ModelName: "copilot-gpt-5.2", + Model: "github-copilot/gpt-5.2", + APIBase: "http://127.0.0.1:4321", + AuthMethod: "oauth", + }, + } + cfg.Agents.Defaults.ModelName = "openai-oauth" + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/models", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp struct { + Models []modelResponse `json:"models"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + + got := make(map[string]bool, len(resp.Models)) + for _, model := range resp.Models { + got[model.ModelName] = model.Configured + } + + if got["openai-oauth"] { + t.Fatalf("openai oauth model configured = true, want false without stored credential") + } + if !got["vllm-local"] { + t.Fatalf("vllm local model configured = false, want true when local probe succeeds") + } + if !got["ollama-default"] { + t.Fatalf("ollama default model configured = false, want true when default local probe succeeds") + } + if !got["vllm-remote"] { + t.Fatalf("remote vllm model configured = false, want true with api_key") + } + if !got["copilot-gpt-5.2"] { + t.Fatalf("copilot model configured = false, want true when local bridge probe succeeds") + } + if len(openAIProbes) != 1 || openAIProbes[0] != "http://127.0.0.1:8000/v1|custom-model" { + t.Fatalf("openAI probes = %#v, want only local vllm probe", openAIProbes) + } + if len(ollamaProbes) != 1 || ollamaProbes[0] != "http://localhost:11434/v1|llama3" { + t.Fatalf("ollama probes = %#v, want default local probe", ollamaProbes) + } + if len(tcpProbes) != 1 || tcpProbes[0] != "http://127.0.0.1:4321" { + t.Fatalf("tcp probes = %#v, want only local copilot probe", tcpProbes) + } +} + +func TestHandleListModels_ConfiguredStatusForOAuthModelWithCredential(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetOAuthHooks(t) + resetModelProbeHooks(t) + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "claude-oauth", + Model: "anthropic/claude-sonnet-4.6", + AuthMethod: "oauth", + }} + cfg.Agents.Defaults.ModelName = "claude-oauth" + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + if err := auth.SetCredential(oauthProviderAnthropic, &auth.AuthCredential{ + AccessToken: "anthropic-token", + Provider: oauthProviderAnthropic, + AuthMethod: "oauth", + }); err != nil { + t.Fatalf("SetCredential() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/models", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp struct { + Models []modelResponse `json:"models"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(resp.Models) != 1 { + t.Fatalf("len(models) = %d, want 1", len(resp.Models)) + } + if !resp.Models[0].Configured { + t.Fatalf("oauth model configured = false, want true with stored credential") + } +} + +func TestHandleListModels_ProbesLocalModelsConcurrently(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetOAuthHooks(t) + resetModelProbeHooks(t) + + started := make(chan string, 2) + release := make(chan struct{}) + + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + started <- apiBase + "|" + modelID + <-release + return true + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{ + { + ModelName: "local-vllm-a", + Model: "vllm/custom-a", + APIBase: "http://127.0.0.1:8000/v1", + }, + { + ModelName: "local-vllm-b", + Model: "vllm/custom-b", + APIBase: "http://127.0.0.1:8001/v1", + }, + } + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + recCh := make(chan *httptest.ResponseRecorder, 1) + go func() { + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/models", nil) + mux.ServeHTTP(rec, req) + recCh <- rec + }() + + for i := 0; i < 2; i++ { + select { + case <-started: + case <-time.After(200 * time.Millisecond): + t.Fatal("expected both local probes to start before the first one completed") + } + } + close(release) + + rec := <-recCh + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } +} + +func TestHandleListModels_NormalizesWildcardLocalAPIBaseForProbe(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + resetOAuthHooks(t) + resetModelProbeHooks(t) + + var gotProbe string + probeOpenAICompatibleModelFunc = func(apiBase, modelID string) bool { + gotProbe = apiBase + "|" + modelID + return apiBase == "http://127.0.0.1:8000/v1" && modelID == "custom-model" + } + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.ModelList = []config.ModelConfig{{ + ModelName: "vllm-local", + Model: "vllm/custom-model", + APIBase: "http://0.0.0.0:8000/v1", + }} + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/models", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp struct { + Models []modelResponse `json:"models"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(resp.Models) != 1 { + t.Fatalf("len(models) = %d, want 1", len(resp.Models)) + } + if !resp.Models[0].Configured { + t.Fatal("wildcard-bound local model configured = false, want true after probe host normalization") + } + if gotProbe != "http://127.0.0.1:8000/v1|custom-model" { + t.Fatalf("probe api base = %q, want %q", gotProbe, "http://127.0.0.1:8000/v1|custom-model") + } +} diff --git a/web/backend/api/oauth.go b/web/backend/api/oauth.go index 04cd595f2..e264c2900 100644 --- a/web/backend/api/oauth.go +++ b/web/backend/api/oauth.go @@ -744,17 +744,6 @@ func (h *Handler) syncProviderAuthMethod(provider, authMethod string) error { return err } - switch provider { - case oauthProviderOpenAI: - cfg.Providers.OpenAI.AuthMethod = authMethod - case oauthProviderAnthropic: - cfg.Providers.Anthropic.AuthMethod = authMethod - case oauthProviderGoogleAntigravity: - cfg.Providers.Antigravity.AuthMethod = authMethod - default: - return fmt.Errorf("unsupported provider %q", provider) - } - found := false for i := range cfg.ModelList { if modelBelongsToProvider(provider, cfg.ModelList[i].Model) { diff --git a/web/backend/api/oauth_test.go b/web/backend/api/oauth_test.go index 2103e1efc..78249be40 100644 --- a/web/backend/api/oauth_test.go +++ b/web/backend/api/oauth_test.go @@ -166,7 +166,6 @@ func TestOAuthLogoutClearsCredentialAndConfig(t *testing.T) { if err != nil { t.Fatalf("LoadConfig error: %v", err) } - cfg.Providers.OpenAI.AuthMethod = "oauth" cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ ModelName: "gpt-5.2", Model: "openai/gpt-5.2", @@ -208,9 +207,6 @@ func TestOAuthLogoutClearsCredentialAndConfig(t *testing.T) { if err != nil { t.Fatalf("LoadConfig error: %v", err) } - if updated.Providers.OpenAI.AuthMethod != "" { - t.Fatalf("providers.openai.auth_method = %q, want empty", updated.Providers.OpenAI.AuthMethod) - } for _, m := range updated.ModelList { if strings.HasPrefix(m.Model, "openai/") && m.AuthMethod != "" { t.Fatalf("openai model auth_method = %q, want empty", m.AuthMethod) diff --git a/web/backend/api/pico.go b/web/backend/api/pico.go index fc942d51c..a4590dcde 100644 --- a/web/backend/api/pico.go +++ b/web/backend/api/pico.go @@ -5,9 +5,7 @@ import ( "encoding/hex" "encoding/json" "fmt" - "net" "net/http" - "strconv" "time" "github.com/sipeed/picoclaw/pkg/config" @@ -30,7 +28,7 @@ func (h *Handler) handleGetPicoToken(w http.ResponseWriter, r *http.Request) { return } - wsURL := buildWsURL(r, cfg) + wsURL := h.buildWsURL(r, cfg) w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ @@ -58,7 +56,7 @@ func (h *Handler) handleRegenPicoToken(w http.ResponseWriter, r *http.Request) { return } - wsURL := fmt.Sprintf("ws://%s/pico/ws", net.JoinHostPort(cfg.Gateway.Host, strconv.Itoa(cfg.Gateway.Port))) + wsURL := h.buildWsURL(r, cfg) w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ @@ -123,7 +121,7 @@ func (h *Handler) handlePicoSetup(w http.ResponseWriter, r *http.Request) { return } - wsURL := buildWsURL(r, cfg) + wsURL := h.buildWsURL(r, cfg) w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(map[string]any{ @@ -134,22 +132,6 @@ func (h *Handler) handlePicoSetup(w http.ResponseWriter, r *http.Request) { }) } -// buildWsURL creates a WebSocket URL for the Pico Channel. -// When the gateway host is "0.0.0.0" or empty, it uses the hostname from the -// incoming HTTP request so the browser gets a connectable address. -func buildWsURL(r *http.Request, cfg *config.Config) string { - host := cfg.Gateway.Host - if host == "" || host == "0.0.0.0" { - // Use the hostname the browser used to reach this backend - reqHost, _, err := net.SplitHostPort(r.Host) - if err != nil { - reqHost = r.Host // r.Host might not have a port - } - host = reqHost - } - return "ws://" + net.JoinHostPort(host, strconv.Itoa(cfg.Gateway.Port)) + "/pico/ws" -} - // generateSecureToken creates a random 32-character hex string. func generateSecureToken() string { b := make([]byte, 16) diff --git a/web/backend/api/router.go b/web/backend/api/router.go index c250724d1..5f081dee9 100644 --- a/web/backend/api/router.go +++ b/web/backend/api/router.go @@ -9,13 +9,14 @@ import ( // Handler serves HTTP API requests. type Handler struct { - configPath string - serverPort int - serverPublic bool - serverCIDRs []string - oauthMu sync.Mutex - oauthFlows map[string]*oauthFlow - oauthState map[string]string + configPath string + serverPort int + serverPublic bool + serverPublicExplicit bool + serverCIDRs []string + oauthMu sync.Mutex + oauthFlows map[string]*oauthFlow + oauthState map[string]string } // NewHandler creates an instance of the API handler. @@ -29,9 +30,10 @@ func NewHandler(configPath string) *Handler { } // SetServerOptions stores current backend listen options for fallback behavior. -func (h *Handler) SetServerOptions(port int, public bool, allowedCIDRs []string) { +func (h *Handler) SetServerOptions(port int, public bool, publicExplicit bool, allowedCIDRs []string) { h.serverPort = port h.serverPublic = public + h.serverPublicExplicit = publicExplicit h.serverCIDRs = append([]string(nil), allowedCIDRs...) } @@ -58,6 +60,10 @@ func (h *Handler) RegisterRoutes(mux *http.ServeMux) { // Channel catalog (for frontend navigation/config pages) h.registerChannelRoutes(mux) + // Skills and tools support/actions + h.registerSkillRoutes(mux) + h.registerToolRoutes(mux) + // OS startup / launch-at-login h.registerStartupRoutes(mux) diff --git a/web/backend/api/session.go b/web/backend/api/session.go index e3cf674fc..42d451a05 100644 --- a/web/backend/api/session.go +++ b/web/backend/api/session.go @@ -1,7 +1,9 @@ package api import ( + "bufio" "encoding/json" + "errors" "net/http" "os" "path/filepath" @@ -33,12 +35,22 @@ type sessionFile struct { // sessionListItem is a lightweight summary returned by GET /api/sessions. type sessionListItem struct { ID string `json:"id"` + Title string `json:"title"` Preview string `json:"preview"` MessageCount int `json:"message_count"` Created string `json:"created"` Updated string `json:"updated"` } +type sessionMetaFile struct { + Key string `json:"key"` + Summary string `json:"summary"` + Skip int `json:"skip"` + Count int `json:"count"` + CreatedAt time.Time `json:"created_at"` + UpdatedAt time.Time `json:"updated_at"` +} + // picoSessionPrefix is the key prefix used by the gateway's routing for Pico // channel sessions. The full key format is: // @@ -47,7 +59,12 @@ type sessionListItem struct { // The sanitized filename replaces ':' with '_', so on disk it becomes: // // agent_main_pico_direct_pico_.json -const picoSessionPrefix = "agent:main:pico:direct:pico:" +const ( + picoSessionPrefix = "agent:main:pico:direct:pico:" + sanitizedPicoSessionPrefix = "agent_main_pico_direct_pico_" + maxSessionJSONLLineSize = 10 * 1024 * 1024 // 10 MB + maxSessionTitleRunes = 60 +) // extractPicoSessionID extracts the session UUID from a full session key. // Returns the UUID and true if the key matches the Pico session pattern. @@ -58,6 +75,178 @@ func extractPicoSessionID(key string) (string, bool) { return "", false } +func extractPicoSessionIDFromSanitizedKey(key string) (string, bool) { + if strings.HasPrefix(key, sanitizedPicoSessionPrefix) { + return strings.TrimPrefix(key, sanitizedPicoSessionPrefix), true + } + return "", false +} + +func sanitizeSessionKey(key string) string { + return strings.ReplaceAll(key, ":", "_") +} + +func (h *Handler) readLegacySession(dir, sessionID string) (sessionFile, error) { + path := filepath.Join(dir, sanitizeSessionKey(picoSessionPrefix+sessionID)+".json") + data, err := os.ReadFile(path) + if err != nil { + return sessionFile{}, err + } + + var sess sessionFile + if err := json.Unmarshal(data, &sess); err != nil { + return sessionFile{}, err + } + return sess, nil +} + +func (h *Handler) readSessionMeta(path, sessionKey string) (sessionMetaFile, error) { + data, err := os.ReadFile(path) + if os.IsNotExist(err) { + return sessionMetaFile{Key: sessionKey}, nil + } + if err != nil { + return sessionMetaFile{}, err + } + + var meta sessionMetaFile + if err := json.Unmarshal(data, &meta); err != nil { + return sessionMetaFile{}, err + } + if meta.Key == "" { + meta.Key = sessionKey + } + return meta, nil +} + +func (h *Handler) readSessionMessages(path string, skip int) ([]providers.Message, error) { + f, err := os.Open(path) + if err != nil { + return nil, err + } + defer f.Close() + + msgs := make([]providers.Message, 0) + scanner := bufio.NewScanner(f) + scanner.Buffer(make([]byte, 0, 64*1024), maxSessionJSONLLineSize) + + seen := 0 + for scanner.Scan() { + line := scanner.Bytes() + if len(line) == 0 { + continue + } + + seen++ + if seen <= skip { + continue + } + + var msg providers.Message + if err := json.Unmarshal(line, &msg); err != nil { + continue + } + msgs = append(msgs, msg) + } + if err := scanner.Err(); err != nil { + return nil, err + } + return msgs, nil +} + +func (h *Handler) readJSONLSession(dir, sessionID string) (sessionFile, error) { + sessionKey := picoSessionPrefix + sessionID + base := filepath.Join(dir, sanitizeSessionKey(sessionKey)) + jsonlPath := base + ".jsonl" + metaPath := base + ".meta.json" + + meta, err := h.readSessionMeta(metaPath, sessionKey) + if err != nil { + return sessionFile{}, err + } + + messages, err := h.readSessionMessages(jsonlPath, meta.Skip) + if err != nil { + return sessionFile{}, err + } + + updated := meta.UpdatedAt + created := meta.CreatedAt + if created.IsZero() || updated.IsZero() { + if info, statErr := os.Stat(jsonlPath); statErr == nil { + if created.IsZero() { + created = info.ModTime() + } + if updated.IsZero() { + updated = info.ModTime() + } + } + } + + return sessionFile{ + Key: meta.Key, + Messages: messages, + Summary: meta.Summary, + Created: created, + Updated: updated, + }, nil +} + +func buildSessionListItem(sessionID string, sess sessionFile) sessionListItem { + preview := "" + for _, msg := range sess.Messages { + if msg.Role == "user" && strings.TrimSpace(msg.Content) != "" { + preview = msg.Content + break + } + } + title := strings.TrimSpace(sess.Summary) + if title == "" { + title = preview + } + + title = truncateRunes(title, maxSessionTitleRunes) + preview = truncateRunes(preview, maxSessionTitleRunes) + + if preview == "" { + preview = "(empty)" + } + if title == "" { + title = preview + } + + validMessageCount := 0 + for _, msg := range sess.Messages { + if (msg.Role == "user" || msg.Role == "assistant") && strings.TrimSpace(msg.Content) != "" { + validMessageCount++ + } + } + + return sessionListItem{ + ID: sessionID, + Title: title, + Preview: preview, + MessageCount: validMessageCount, + Created: sess.Created.Format(time.RFC3339), + Updated: sess.Updated.Format(time.RFC3339), + } +} + +func isEmptySession(sess sessionFile) bool { + return len(sess.Messages) == 0 && strings.TrimSpace(sess.Summary) == "" +} + +func truncateRunes(s string, maxLen int) string { + if maxLen <= 0 { + return "" + } + runes := []rune(strings.TrimSpace(s)) + if len(runes) <= maxLen { + return string(runes) + } + return string(runes[:maxLen]) + "..." +} + // sessionsDir resolves the path to the gateway's session storage directory. // It reads the workspace from config, falling back to ~/.picoclaw/workspace. func (h *Handler) sessionsDir() (string, error) { @@ -104,58 +293,76 @@ func (h *Handler) handleListSessions(w http.ResponseWriter, r *http.Request) { } items := []sessionListItem{} + seen := make(map[string]struct{}) for _, entry := range entries { - if entry.IsDir() || filepath.Ext(entry.Name()) != ".json" { + if entry.IsDir() { continue } - data, err := os.ReadFile(filepath.Join(dir, entry.Name())) - if err != nil { - continue - } + name := entry.Name() + var ( + sessionID string + sess sessionFile + loadErr error + ok bool + ) - var sess sessionFile - if err := json.Unmarshal(data, &sess); err != nil { - continue - } - - // Only include Pico channel sessions - sessionID, ok := extractPicoSessionID(sess.Key) - if !ok { - continue - } - - // Build a preview from the first user message - preview := "" - for _, msg := range sess.Messages { - if msg.Role == "user" && strings.TrimSpace(msg.Content) != "" { - preview = msg.Content - break + switch { + case strings.HasSuffix(name, ".jsonl"): + sessionID, ok = extractPicoSessionIDFromSanitizedKey(strings.TrimSuffix(name, ".jsonl")) + if !ok { + continue } - } - if len([]rune(preview)) > 60 { - preview = string([]rune(preview)[:60]) + "..." - } - if preview == "" { - preview = "(empty)" - } - - // Only count non-empty user and assistant messages - validMessageCount := 0 - for _, msg := range sess.Messages { - if (msg.Role == "user" || msg.Role == "assistant") && strings.TrimSpace(msg.Content) != "" { - validMessageCount++ + sess, loadErr = h.readJSONLSession(dir, sessionID) + if loadErr == nil && isEmptySession(sess) { + continue } + case strings.HasSuffix(name, ".meta.json"): + continue + case filepath.Ext(name) == ".json": + base := strings.TrimSuffix(name, ".json") + if _, statErr := os.Stat(filepath.Join(dir, base+".jsonl")); statErr == nil { + if jsonlSessionID, found := extractPicoSessionIDFromSanitizedKey(base); found { + if jsonlSess, jsonlErr := h.readJSONLSession( + dir, + jsonlSessionID, + ); jsonlErr == nil && + !isEmptySession(jsonlSess) { + continue + } + } + } + data, err := os.ReadFile(filepath.Join(dir, name)) + if err != nil { + continue + } + if err := json.Unmarshal(data, &sess); err != nil { + continue + } + if isEmptySession(sess) { + continue + } + sessionID, ok = extractPicoSessionID(sess.Key) + if !ok { + continue + } + if _, exists := seen[sessionID]; exists { + continue + } + default: + continue } - items = append(items, sessionListItem{ - ID: sessionID, - Preview: preview, - MessageCount: validMessageCount, - Created: sess.Created.Format(time.RFC3339), - Updated: sess.Updated.Format(time.RFC3339), - }) + if loadErr != nil { + continue + } + if _, exists := seen[sessionID]; exists { + continue + } + + seen[sessionID] = struct{}{} + items = append(items, buildSessionListItem(sessionID, sess)) } // Sort by updated descending (most recent first) @@ -209,20 +416,25 @@ func (h *Handler) handleGetSession(w http.ResponseWriter, r *http.Request) { return } - // The sanitized filename replaces ':' with '_': - // agent:main:pico:direct:pico: -> agent_main_pico_direct_pico_.json - filename := strings.ReplaceAll(picoSessionPrefix+sessionID, ":", "_") + ".json" - - data, err := os.ReadFile(filepath.Join(dir, filename)) - if err != nil { - http.Error(w, "session not found", http.StatusNotFound) - return + sess, err := h.readJSONLSession(dir, sessionID) + if err == nil && isEmptySession(sess) { + err = os.ErrNotExist } - - var sess sessionFile - if err := json.Unmarshal(data, &sess); err != nil { - http.Error(w, "failed to parse session", http.StatusInternalServerError) - return + if err != nil { + if errors.Is(err, os.ErrNotExist) { + sess, err = h.readLegacySession(dir, sessionID) + if err == nil && isEmptySession(sess) { + err = os.ErrNotExist + } + } + if err != nil { + if errors.Is(err, os.ErrNotExist) { + http.Error(w, "session not found", http.StatusNotFound) + } else { + http.Error(w, "failed to parse session", http.StatusInternalServerError) + } + return + } } // Convert to a simpler format for the frontend @@ -268,17 +480,25 @@ func (h *Handler) handleDeleteSession(w http.ResponseWriter, r *http.Request) { return } - // The sanitized filename replaces ':' with '_': - // agent:main:pico:direct:pico: -> agent_main_pico_direct_pico_.json - filename := strings.ReplaceAll(picoSessionPrefix+sessionID, ":", "_") + ".json" - filePath := filepath.Join(dir, filename) + base := filepath.Join(dir, sanitizeSessionKey(picoSessionPrefix+sessionID)) + jsonlPath := base + ".jsonl" + metaPath := base + ".meta.json" + legacyPath := base + ".json" - if err := os.Remove(filePath); err != nil { - if os.IsNotExist(err) { - http.Error(w, "session not found", http.StatusNotFound) - } else { + removed := false + for _, path := range []string{jsonlPath, metaPath, legacyPath} { + if err := os.Remove(path); err != nil { + if os.IsNotExist(err) { + continue + } http.Error(w, "failed to delete session", http.StatusInternalServerError) + return } + removed = true + } + + if !removed { + http.Error(w, "session not found", http.StatusNotFound) return } diff --git a/web/backend/api/session_test.go b/web/backend/api/session_test.go new file mode 100644 index 000000000..21ef5b5b8 --- /dev/null +++ b/web/backend/api/session_test.go @@ -0,0 +1,322 @@ +package api + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/memory" + "github.com/sipeed/picoclaw/pkg/providers" + "github.com/sipeed/picoclaw/pkg/session" +) + +func sessionsTestDir(t *testing.T, configPath string) string { + t.Helper() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + + dir := filepath.Join(cfg.Agents.Defaults.Workspace, "sessions") + if err := os.MkdirAll(dir, 0o755); err != nil { + t.Fatalf("MkdirAll() error = %v", err) + } + return dir +} + +func TestHandleListSessions_JSONLStorage(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + store, err := memory.NewJSONLStore(dir) + if err != nil { + t.Fatalf("NewJSONLStore() error = %v", err) + } + + sessionKey := picoSessionPrefix + "history-jsonl" + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "user", + Content: "Explain why the history API is empty after migration.", + }); err != nil { + t.Fatalf("AddFullMessage(user) error = %v", err) + } + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "assistant", + Content: "Because the API still reads only legacy JSON session files.", + }); err != nil { + t.Fatalf("AddFullMessage(assistant) error = %v", err) + } + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "tool", + Content: "ignored", + }); err != nil { + t.Fatalf("AddFullMessage(tool) error = %v", err) + } + if err := store.SetSummary(nil, sessionKey, "JSONL-backed session"); err != nil { + t.Fatalf("SetSummary() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/sessions", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var items []sessionListItem + if err := json.Unmarshal(rec.Body.Bytes(), &items); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(items) != 1 { + t.Fatalf("len(items) = %d, want 1", len(items)) + } + if items[0].ID != "history-jsonl" { + t.Fatalf("items[0].ID = %q, want %q", items[0].ID, "history-jsonl") + } + if items[0].MessageCount != 2 { + t.Fatalf("items[0].MessageCount = %d, want 2", items[0].MessageCount) + } + if items[0].Title != "JSONL-backed session" { + t.Fatalf("items[0].Title = %q, want %q", items[0].Title, "JSONL-backed session") + } + if items[0].Preview != "Explain why the history API is empty after migration." { + t.Fatalf("items[0].Preview = %q", items[0].Preview) + } +} + +func TestHandleListSessions_TitleUsesTrimmedSummary(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + store, err := memory.NewJSONLStore(dir) + if err != nil { + t.Fatalf("NewJSONLStore() error = %v", err) + } + + sessionKey := picoSessionPrefix + "summary-title" + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "user", + Content: "fallback preview", + }); err != nil { + t.Fatalf("AddFullMessage() error = %v", err) + } + if err := store.SetSummary( + nil, + sessionKey, + " This summary is intentionally longer than sixty characters so it must be truncated in the history menu. ", + ); err != nil { + t.Fatalf("SetSummary() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/sessions", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var items []sessionListItem + if err := json.Unmarshal(rec.Body.Bytes(), &items); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(items) != 1 { + t.Fatalf("len(items) = %d, want 1", len(items)) + } + expectedTitle := truncateRunes( + "This summary is intentionally longer than sixty characters so it must be truncated in the history menu.", + maxSessionTitleRunes, + ) + if items[0].Title != expectedTitle { + t.Fatalf("items[0].Title = %q", items[0].Title) + } + if items[0].Preview != "fallback preview" { + t.Fatalf("items[0].Preview = %q, want %q", items[0].Preview, "fallback preview") + } +} + +func TestHandleGetSession_JSONLStorage(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + store, err := memory.NewJSONLStore(dir) + if err != nil { + t.Fatalf("NewJSONLStore() error = %v", err) + } + + sessionKey := picoSessionPrefix + "detail-jsonl" + for _, msg := range []providers.Message{ + {Role: "user", Content: "first"}, + {Role: "assistant", Content: "second"}, + {Role: "tool", Content: "ignored"}, + } { + if err := store.AddFullMessage(nil, sessionKey, msg); err != nil { + t.Fatalf("AddFullMessage() error = %v", err) + } + } + if err := store.SetSummary(nil, sessionKey, "detail summary"); err != nil { + t.Fatalf("SetSummary() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/sessions/detail-jsonl", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp struct { + ID string `json:"id"` + Summary string `json:"summary"` + Messages []struct { + Role string `json:"role"` + Content string `json:"content"` + } `json:"messages"` + } + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if resp.ID != "detail-jsonl" { + t.Fatalf("resp.ID = %q, want %q", resp.ID, "detail-jsonl") + } + if resp.Summary != "detail summary" { + t.Fatalf("resp.Summary = %q, want %q", resp.Summary, "detail summary") + } + if len(resp.Messages) != 2 { + t.Fatalf("len(resp.Messages) = %d, want 2", len(resp.Messages)) + } + if resp.Messages[0].Role != "user" || resp.Messages[0].Content != "first" { + t.Fatalf("first message = %#v, want user/first", resp.Messages[0]) + } + if resp.Messages[1].Role != "assistant" || resp.Messages[1].Content != "second" { + t.Fatalf("second message = %#v, want assistant/second", resp.Messages[1]) + } +} + +func TestHandleDeleteSession_JSONLStorage(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + store, err := memory.NewJSONLStore(dir) + if err != nil { + t.Fatalf("NewJSONLStore() error = %v", err) + } + + sessionKey := picoSessionPrefix + "delete-jsonl" + if err := store.AddFullMessage(nil, sessionKey, providers.Message{ + Role: "user", + Content: "delete me", + }); err != nil { + t.Fatalf("AddFullMessage() error = %v", err) + } + if err := store.SetSummary(nil, sessionKey, "delete summary"); err != nil { + t.Fatalf("SetSummary() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodDelete, "/api/sessions/delete-jsonl", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusNoContent { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusNoContent, rec.Body.String()) + } + + base := filepath.Join(dir, sanitizeSessionKey(sessionKey)) + for _, path := range []string{base + ".jsonl", base + ".meta.json"} { + if _, err := os.Stat(path); !os.IsNotExist(err) { + t.Fatalf("expected %s to be removed, stat err = %v", path, err) + } + } +} + +func TestHandleGetSession_LegacyJSONFallback(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + manager := session.NewSessionManager(dir) + sessionKey := picoSessionPrefix + "legacy-json" + manager.AddMessage(sessionKey, "user", "legacy user") + manager.AddMessage(sessionKey, "assistant", "legacy assistant") + if err := manager.Save(sessionKey); err != nil { + t.Fatalf("Save() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/sessions/legacy-json", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } +} + +func TestHandleSessions_FiltersEmptyJSONLFiles(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + dir := sessionsTestDir(t, configPath) + base := filepath.Join(dir, sanitizeSessionKey(picoSessionPrefix+"empty-jsonl")) + if err := os.WriteFile(base+".jsonl", []byte{}, 0o644); err != nil { + t.Fatalf("WriteFile(jsonl) error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + listRec := httptest.NewRecorder() + listReq := httptest.NewRequest(http.MethodGet, "/api/sessions", nil) + mux.ServeHTTP(listRec, listReq) + + if listRec.Code != http.StatusOK { + t.Fatalf("list status = %d, want %d, body=%s", listRec.Code, http.StatusOK, listRec.Body.String()) + } + + var items []sessionListItem + if err := json.Unmarshal(listRec.Body.Bytes(), &items); err != nil { + t.Fatalf("Unmarshal(list) error = %v", err) + } + if len(items) != 0 { + t.Fatalf("len(items) = %d, want 0", len(items)) + } + + detailRec := httptest.NewRecorder() + detailReq := httptest.NewRequest(http.MethodGet, "/api/sessions/empty-jsonl", nil) + mux.ServeHTTP(detailRec, detailReq) + + if detailRec.Code != http.StatusNotFound { + t.Fatalf("detail status = %d, want %d, body=%s", detailRec.Code, http.StatusNotFound, detailRec.Body.String()) + } +} diff --git a/web/backend/api/skills.go b/web/backend/api/skills.go new file mode 100644 index 000000000..936074fee --- /dev/null +++ b/web/backend/api/skills.go @@ -0,0 +1,331 @@ +package api + +import ( + "encoding/json" + "fmt" + "io" + "net/http" + "os" + "path/filepath" + "regexp" + "strings" + + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/skills" +) + +type skillSupportResponse struct { + Skills []skills.SkillInfo `json:"skills"` +} + +type skillDetailResponse struct { + Name string `json:"name"` + Path string `json:"path"` + Source string `json:"source"` + Description string `json:"description"` + Content string `json:"content"` +} + +var ( + skillNameSanitizer = regexp.MustCompile(`[^a-z0-9-]+`) + importedSkillFrontmatter = regexp.MustCompile(`(?s)^---(?:\r\n|\n|\r)(.*?)(?:\r\n|\n|\r)---(?:\r\n|\n|\r)*`) + skillFrontmatterStripper = regexp.MustCompile(`(?s)^---(?:\r\n|\n|\r)(.*?)(?:\r\n|\n|\r)---(?:\r\n|\n|\r)*`) +) + +func (h *Handler) registerSkillRoutes(mux *http.ServeMux) { + mux.HandleFunc("GET /api/skills", h.handleListSkills) + mux.HandleFunc("GET /api/skills/{name}", h.handleGetSkill) + mux.HandleFunc("POST /api/skills/import", h.handleImportSkill) + mux.HandleFunc("DELETE /api/skills/{name}", h.handleDeleteSkill) +} + +func (h *Handler) handleListSkills(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + loader := newSkillsLoader(cfg.WorkspacePath()) + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(skillSupportResponse{ + Skills: loader.ListSkills(), + }) +} + +func (h *Handler) handleGetSkill(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + loader := newSkillsLoader(cfg.WorkspacePath()) + name := r.PathValue("name") + allSkills := loader.ListSkills() + + for _, skill := range allSkills { + if skill.Name != name { + continue + } + + content, err := loadSkillContent(skill.Path) + if err != nil { + http.Error(w, "Skill content not found", http.StatusNotFound) + return + } + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(skillDetailResponse{ + Name: skill.Name, + Path: skill.Path, + Source: skill.Source, + Description: skill.Description, + Content: content, + }) + return + } + + http.Error(w, "Skill not found", http.StatusNotFound) +} + +func (h *Handler) handleImportSkill(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + err = r.ParseMultipartForm(2 << 20) + if err != nil { + http.Error(w, fmt.Sprintf("Invalid multipart form: %v", err), http.StatusBadRequest) + return + } + + uploadedFile, fileHeader, err := r.FormFile("file") + if err != nil { + http.Error(w, "file is required", http.StatusBadRequest) + return + } + defer uploadedFile.Close() + + content, err := io.ReadAll(io.LimitReader(uploadedFile, (1<<20)+1)) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to read file: %v", err), http.StatusBadRequest) + return + } + if len(content) > 1<<20 { + http.Error(w, "file exceeds 1MB limit", http.StatusBadRequest) + return + } + + skillName, err := normalizeImportedSkillName(fileHeader.Filename, content) + if err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + content = normalizeImportedSkillContent(content, skillName) + + workspace := cfg.WorkspacePath() + skillDir := filepath.Join(workspace, "skills", skillName) + skillFile := filepath.Join(skillDir, "SKILL.md") + if _, err := os.Stat(skillDir); err == nil { + http.Error(w, "skill already exists", http.StatusConflict) + return + } + + if err := os.MkdirAll(skillDir, 0o755); err != nil { + http.Error(w, fmt.Sprintf("Failed to create skill directory: %v", err), http.StatusInternalServerError) + return + } + if err := os.WriteFile(skillFile, content, 0o644); err != nil { + http.Error(w, fmt.Sprintf("Failed to save skill: %v", err), http.StatusInternalServerError) + return + } + + loader := newSkillsLoader(workspace) + for _, skill := range loader.ListSkills() { + if skill.Path == skillFile || (skill.Name == skillName && skill.Source == "workspace") { + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(skill) + return + } + } + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]string{ + "name": skillName, + "path": skillFile, + }) +} + +func (h *Handler) handleDeleteSkill(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + loader := newSkillsLoader(cfg.WorkspacePath()) + name := r.PathValue("name") + for _, skill := range loader.ListSkills() { + if skill.Name != name { + continue + } + if skill.Source != "workspace" { + http.Error(w, "only workspace skills can be deleted", http.StatusBadRequest) + return + } + if err := os.RemoveAll(filepath.Dir(skill.Path)); err != nil { + http.Error(w, fmt.Sprintf("Failed to delete skill: %v", err), http.StatusInternalServerError) + return + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]string{"status": "ok"}) + return + } + + http.Error(w, "Skill not found", http.StatusNotFound) +} + +func newSkillsLoader(workspace string) *skills.SkillsLoader { + return skills.NewSkillsLoader( + workspace, + filepath.Join(globalConfigDir(), "skills"), + builtinSkillsDir(), + ) +} + +func normalizeImportedSkillName(filename string, content []byte) (string, error) { + rawContent := strings.ReplaceAll(string(content), "\r\n", "\n") + rawContent = strings.ReplaceAll(rawContent, "\r", "\n") + metadata, _ := extractImportedSkillMetadata(rawContent) + + raw := strings.TrimSpace(metadata["name"]) + if raw == "" { + raw = strings.TrimSpace(strings.TrimSuffix(filepath.Base(filename), filepath.Ext(filename))) + } + raw = strings.ToLower(raw) + raw = strings.ReplaceAll(raw, "_", "-") + raw = strings.ReplaceAll(raw, " ", "-") + raw = skillNameSanitizer.ReplaceAllString(raw, "-") + raw = strings.Trim(raw, "-") + raw = strings.Join(strings.FieldsFunc(raw, func(r rune) bool { return r == '-' }), "-") + + if raw == "" { + return "", fmt.Errorf("skill name is required in frontmatter or filename") + } + if len(raw) > 64 { + return "", fmt.Errorf("skill name exceeds 64 characters") + } + matched, err := regexp.MatchString(`^[a-z0-9]+(-[a-z0-9]+)*$`, raw) + if err != nil || !matched { + return "", fmt.Errorf("skill name must be alphanumeric with hyphens") + } + return raw, nil +} + +func normalizeImportedSkillContent(content []byte, skillName string) []byte { + raw := strings.ReplaceAll(string(content), "\r\n", "\n") + raw = strings.ReplaceAll(raw, "\r", "\n") + + metadata, body := extractImportedSkillMetadata(raw) + description := strings.TrimSpace(metadata["description"]) + if description == "" { + description = inferImportedSkillDescription(body) + } + if description == "" { + description = "Imported skill" + } + if len(description) > 1024 { + description = strings.TrimSpace(description[:1024]) + } + + body = strings.TrimLeft(body, "\n") + var builder strings.Builder + builder.WriteString("---\n") + builder.WriteString("name: ") + builder.WriteString(skillName) + builder.WriteString("\n") + builder.WriteString("description: ") + builder.WriteString(description) + builder.WriteString("\n") + builder.WriteString("---\n\n") + builder.WriteString(body) + if !strings.HasSuffix(builder.String(), "\n") { + builder.WriteString("\n") + } + return []byte(builder.String()) +} + +func extractImportedSkillMetadata(raw string) (map[string]string, string) { + matches := importedSkillFrontmatter.FindStringSubmatch(raw) + if len(matches) != 2 { + return map[string]string{}, raw + } + meta := parseImportedSkillYAML(matches[1]) + body := importedSkillFrontmatter.ReplaceAllString(raw, "") + return meta, body +} + +func parseImportedSkillYAML(frontmatter string) map[string]string { + result := make(map[string]string) + for _, line := range strings.Split(frontmatter, "\n") { + line = strings.TrimSpace(line) + if line == "" || strings.HasPrefix(line, "#") { + continue + } + key, value, ok := strings.Cut(line, ":") + if !ok { + continue + } + result[strings.TrimSpace(key)] = strings.Trim(strings.TrimSpace(value), `"'`) + } + return result +} + +func inferImportedSkillDescription(body string) string { + for _, line := range strings.Split(body, "\n") { + line = strings.TrimSpace(line) + if line == "" { + continue + } + line = strings.TrimLeft(line, "#-*0123456789. ") + line = strings.TrimSpace(line) + if line != "" { + return line + } + } + return "" +} + +func loadSkillContent(path string) (string, error) { + content, err := os.ReadFile(path) + if err != nil { + return "", err + } + return skillFrontmatterStripper.ReplaceAllString(string(content), ""), nil +} + +func globalConfigDir() string { + if home := os.Getenv("PICOCLAW_HOME"); home != "" { + return home + } + home, err := os.UserHomeDir() + if err != nil { + return "" + } + return filepath.Join(home, ".picoclaw") +} + +func builtinSkillsDir() string { + if path := os.Getenv("PICOCLAW_BUILTIN_SKILLS"); path != "" { + return path + } + wd, err := os.Getwd() + if err != nil { + return "" + } + return filepath.Join(wd, "skills") +} diff --git a/web/backend/api/skills_test.go b/web/backend/api/skills_test.go new file mode 100644 index 000000000..3289d5b33 --- /dev/null +++ b/web/backend/api/skills_test.go @@ -0,0 +1,336 @@ +package api + +import ( + "bytes" + "encoding/json" + "io" + "mime/multipart" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestHandleListSkills(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + if err := os.MkdirAll(filepath.Join(workspace, "skills", "workspace-skill"), 0o755); err != nil { + t.Fatalf("MkdirAll(workspace skill) error = %v", err) + } + if err := os.WriteFile( + filepath.Join(workspace, "skills", "workspace-skill", "SKILL.md"), + []byte("---\nname: workspace-skill\ndescription: Workspace skill\n---\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile(workspace skill) error = %v", err) + } + + globalSkillDir := filepath.Join(globalConfigDir(), "skills", "global-skill") + if err := os.MkdirAll(globalSkillDir, 0o755); err != nil { + t.Fatalf("MkdirAll(global skill) error = %v", err) + } + if err := os.WriteFile( + filepath.Join(globalSkillDir, "SKILL.md"), + []byte("---\nname: global-skill\ndescription: Global skill\n---\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile(global skill) error = %v", err) + } + + builtinRoot := filepath.Join(t.TempDir(), "builtin-skills") + oldBuiltin := os.Getenv("PICOCLAW_BUILTIN_SKILLS") + if err := os.Setenv("PICOCLAW_BUILTIN_SKILLS", builtinRoot); err != nil { + t.Fatalf("Setenv(PICOCLAW_BUILTIN_SKILLS) error = %v", err) + } + defer func() { + if oldBuiltin == "" { + _ = os.Unsetenv("PICOCLAW_BUILTIN_SKILLS") + } else { + _ = os.Setenv("PICOCLAW_BUILTIN_SKILLS", oldBuiltin) + } + }() + + builtinSkillDir := filepath.Join(builtinRoot, "builtin-skill") + if err := os.MkdirAll(builtinSkillDir, 0o755); err != nil { + t.Fatalf("MkdirAll(builtin skill) error = %v", err) + } + if err := os.WriteFile( + filepath.Join(builtinSkillDir, "SKILL.md"), + []byte("---\nname: builtin-skill\ndescription: Builtin skill\n---\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile(builtin skill) error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/skills", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp skillSupportResponse + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if len(resp.Skills) != 3 { + t.Fatalf("skills count = %d, want 3", len(resp.Skills)) + } + + gotSkills := make(map[string]string, len(resp.Skills)) + for _, skill := range resp.Skills { + gotSkills[skill.Name] = skill.Source + } + if gotSkills["workspace-skill"] != "workspace" { + t.Fatalf("workspace-skill source = %q, want workspace", gotSkills["workspace-skill"]) + } + if gotSkills["global-skill"] != "global" { + t.Fatalf("global-skill source = %q, want global", gotSkills["global-skill"]) + } + if gotSkills["builtin-skill"] != "builtin" { + t.Fatalf("builtin-skill source = %q, want builtin", gotSkills["builtin-skill"]) + } +} + +func TestHandleGetSkill(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + skillDir := filepath.Join(workspace, "skills", "viewer-skill") + if err := os.MkdirAll(skillDir, 0o755); err != nil { + t.Fatalf("MkdirAll() error = %v", err) + } + if err := os.WriteFile( + filepath.Join(skillDir, "SKILL.md"), + []byte( + "---\nname: viewer-skill\ndescription: Viewable skill\n---\n# Viewer Skill\n\nThis is visible content.\n", + ), + 0o644, + ); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/skills/viewer-skill", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp skillDetailResponse + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if resp.Name != "viewer-skill" || resp.Source != "workspace" || resp.Description != "Viewable skill" { + t.Fatalf("unexpected response: %#v", resp) + } + if resp.Content != "# Viewer Skill\n\nThis is visible content.\n" { + t.Fatalf("content = %q", resp.Content) + } +} + +func TestHandleGetSkillUsesResolvedPath(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + skillDir := filepath.Join(workspace, "skills", "folder-name") + if err := os.MkdirAll(skillDir, 0o755); err != nil { + t.Fatalf("MkdirAll() error = %v", err) + } + if err := os.WriteFile( + filepath.Join(skillDir, "SKILL.md"), + []byte("---\nname: display-name\ndescription: Mismatched path skill\n---\n# Display Name\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/skills/display-name", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp skillDetailResponse + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + if resp.Name != "display-name" { + t.Fatalf("resp.Name = %q, want display-name", resp.Name) + } + if resp.Content != "# Display Name\n" { + t.Fatalf("content = %q", resp.Content) + } +} + +func TestHandleImportSkill(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + var body bytes.Buffer + writer := multipart.NewWriter(&body) + part, err := writer.CreateFormFile("file", "Plain Skill.md") + if err != nil { + t.Fatalf("CreateFormFile() error = %v", err) + } + _, err = io.WriteString(part, "# Plain Skill\n\nUse this skill to test imports.\n") + if err != nil { + t.Fatalf("WriteString() error = %v", err) + } + err = writer.Close() + if err != nil { + t.Fatalf("Close() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodPost, "/api/skills/import", &body) + req.Header.Set("Content-Type", writer.FormDataContentType()) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + skillFile := filepath.Join(workspace, "skills", "plain-skill", "SKILL.md") + content, err := os.ReadFile(skillFile) + if err != nil { + t.Fatalf("ReadFile() error = %v", err) + } + expected := "---\nname: plain-skill\ndescription: Plain Skill\n---\n\n# Plain Skill\n\nUse this skill to test imports.\n" + if string(content) != expected { + t.Fatalf("saved skill content mismatch:\n%s", string(content)) + } + + rec2 := httptest.NewRecorder() + req2 := httptest.NewRequest(http.MethodGet, "/api/skills", nil) + mux.ServeHTTP(rec2, req2) + if rec2.Code != http.StatusOK { + t.Fatalf("list status = %d, want %d, body=%s", rec2.Code, http.StatusOK, rec2.Body.String()) + } + var listResp skillSupportResponse + if err := json.Unmarshal(rec2.Body.Bytes(), &listResp); err != nil { + t.Fatalf("Unmarshal list response error = %v", err) + } + found := false + for _, skill := range listResp.Skills { + if skill.Name == "plain-skill" && skill.Source == "workspace" && skill.Description == "Plain Skill" { + found = true + } + } + if !found { + t.Fatalf("plain-skill should be listed after import, got %#v", listResp.Skills) + } +} + +func TestHandleDeleteSkill(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + workspace := filepath.Join(t.TempDir(), "workspace") + cfg.Agents.Defaults.Workspace = workspace + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + skillDir := filepath.Join(workspace, "skills", "delete-me") + if err := os.MkdirAll(skillDir, 0o755); err != nil { + t.Fatalf("MkdirAll() error = %v", err) + } + if err := os.WriteFile( + filepath.Join(skillDir, "SKILL.md"), + []byte("---\nname: delete-me\ndescription: delete me\n---\n"), + 0o644, + ); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodDelete, "/api/skills/delete-me", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + if _, err := os.Stat(skillDir); !os.IsNotExist(err) { + t.Fatalf("skill directory should be removed, stat err=%v", err) + } +} diff --git a/web/backend/api/tools.go b/web/backend/api/tools.go new file mode 100644 index 000000000..373a3be12 --- /dev/null +++ b/web/backend/api/tools.go @@ -0,0 +1,323 @@ +package api + +import ( + "encoding/json" + "fmt" + "net/http" + "runtime" + + "github.com/sipeed/picoclaw/pkg/config" +) + +type toolCatalogEntry struct { + Name string + Description string + Category string + ConfigKey string +} + +type toolSupportItem struct { + Name string `json:"name"` + Description string `json:"description"` + Category string `json:"category"` + ConfigKey string `json:"config_key"` + Status string `json:"status"` + ReasonCode string `json:"reason_code,omitempty"` +} + +type toolSupportResponse struct { + Tools []toolSupportItem `json:"tools"` +} + +type toolStateRequest struct { + Enabled bool `json:"enabled"` +} + +var toolCatalog = []toolCatalogEntry{ + { + Name: "read_file", + Description: "Read file content from the workspace or explicitly allowed paths.", + Category: "filesystem", + ConfigKey: "read_file", + }, + { + Name: "write_file", + Description: "Create or overwrite files within the writable workspace scope.", + Category: "filesystem", + ConfigKey: "write_file", + }, + { + Name: "list_dir", + Description: "Inspect directories and enumerate files available to the agent.", + Category: "filesystem", + ConfigKey: "list_dir", + }, + { + Name: "edit_file", + Description: "Apply targeted edits to existing files without rewriting everything.", + Category: "filesystem", + ConfigKey: "edit_file", + }, + { + Name: "append_file", + Description: "Append content to the end of an existing file.", + Category: "filesystem", + ConfigKey: "append_file", + }, + { + Name: "exec", + Description: "Run shell commands inside the configured workspace sandbox.", + Category: "filesystem", + ConfigKey: "exec", + }, + { + Name: "cron", + Description: "Schedule one-time or recurring reminders, jobs, and shell commands.", + Category: "automation", + ConfigKey: "cron", + }, + { + Name: "web_search", + Description: "Search the web using the configured providers.", + Category: "web", + ConfigKey: "web", + }, + { + Name: "web_fetch", + Description: "Fetch and summarize the contents of a webpage.", + Category: "web", + ConfigKey: "web_fetch", + }, + { + Name: "message", + Description: "Send a follow-up message back to the active user or chat.", + Category: "communication", + ConfigKey: "message", + }, + { + Name: "send_file", + Description: "Send an outbound file or media attachment to the active chat.", + Category: "communication", + ConfigKey: "send_file", + }, + { + Name: "find_skills", + Description: "Search external skill registries for installable skills.", + Category: "skills", + ConfigKey: "find_skills", + }, + { + Name: "install_skill", + Description: "Install a skill into the current workspace from a registry.", + Category: "skills", + ConfigKey: "install_skill", + }, + { + Name: "spawn", + Description: "Launch a background subagent for long-running or delegated work.", + Category: "agents", + ConfigKey: "spawn", + }, + { + Name: "i2c", + Description: "Interact with I2C hardware devices exposed on the host.", + Category: "hardware", + ConfigKey: "i2c", + }, + { + Name: "spi", + Description: "Interact with SPI hardware devices exposed on the host.", + Category: "hardware", + ConfigKey: "spi", + }, + { + Name: "tool_search_tool_regex", + Description: "Discover hidden MCP tools by regex search when tool discovery is enabled.", + Category: "discovery", + ConfigKey: "mcp.discovery.use_regex", + }, + { + Name: "tool_search_tool_bm25", + Description: "Discover hidden MCP tools by semantic ranking when tool discovery is enabled.", + Category: "discovery", + ConfigKey: "mcp.discovery.use_bm25", + }, +} + +func (h *Handler) registerToolRoutes(mux *http.ServeMux) { + mux.HandleFunc("GET /api/tools", h.handleListTools) + mux.HandleFunc("PUT /api/tools/{name}/state", h.handleUpdateToolState) +} + +func (h *Handler) handleListTools(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(toolSupportResponse{ + Tools: buildToolSupport(cfg), + }) +} + +func (h *Handler) handleUpdateToolState(w http.ResponseWriter, r *http.Request) { + cfg, err := config.LoadConfig(h.configPath) + if err != nil { + http.Error(w, fmt.Sprintf("Failed to load config: %v", err), http.StatusInternalServerError) + return + } + + var req toolStateRequest + if err := json.NewDecoder(r.Body).Decode(&req); err != nil { + http.Error(w, fmt.Sprintf("Invalid JSON: %v", err), http.StatusBadRequest) + return + } + + if err := applyToolState(cfg, r.PathValue("name"), req.Enabled); err != nil { + http.Error(w, err.Error(), http.StatusBadRequest) + return + } + + if err := config.SaveConfig(h.configPath, cfg); err != nil { + http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError) + return + } + + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(map[string]string{"status": "ok"}) +} + +func buildToolSupport(cfg *config.Config) []toolSupportItem { + items := make([]toolSupportItem, 0, len(toolCatalog)) + for _, entry := range toolCatalog { + status := "disabled" + reasonCode := "" + + switch entry.Name { + case "find_skills", "install_skill": + if cfg.Tools.IsToolEnabled(entry.ConfigKey) { + if cfg.Tools.IsToolEnabled("skills") { + status = "enabled" + } else { + status = "blocked" + reasonCode = "requires_skills" + } + } + case "spawn": + if cfg.Tools.IsToolEnabled(entry.ConfigKey) { + if cfg.Tools.IsToolEnabled("subagent") { + status = "enabled" + } else { + status = "blocked" + reasonCode = "requires_subagent" + } + } + case "tool_search_tool_regex": + status, reasonCode = resolveDiscoveryToolSupport(cfg, cfg.Tools.MCP.Discovery.UseRegex) + case "tool_search_tool_bm25": + status, reasonCode = resolveDiscoveryToolSupport(cfg, cfg.Tools.MCP.Discovery.UseBM25) + case "i2c", "spi": + status, reasonCode = resolveHardwareToolSupport(cfg.Tools.IsToolEnabled(entry.ConfigKey)) + default: + if cfg.Tools.IsToolEnabled(entry.ConfigKey) { + status = "enabled" + } + } + + items = append(items, toolSupportItem{ + Name: entry.Name, + Description: entry.Description, + Category: entry.Category, + ConfigKey: entry.ConfigKey, + Status: status, + ReasonCode: reasonCode, + }) + } + return items +} + +func resolveHardwareToolSupport(enabled bool) (string, string) { + if !enabled { + return "disabled", "" + } + if runtime.GOOS != "linux" { + return "blocked", "requires_linux" + } + return "enabled", "" +} + +func resolveDiscoveryToolSupport(cfg *config.Config, methodEnabled bool) (string, string) { + if !cfg.Tools.IsToolEnabled("mcp") { + return "disabled", "" + } + if !cfg.Tools.MCP.Discovery.Enabled { + return "blocked", "requires_mcp_discovery" + } + if !methodEnabled { + return "disabled", "" + } + return "enabled", "" +} + +func applyToolState(cfg *config.Config, toolName string, enabled bool) error { + switch toolName { + case "read_file": + cfg.Tools.ReadFile.Enabled = enabled + case "write_file": + cfg.Tools.WriteFile.Enabled = enabled + case "list_dir": + cfg.Tools.ListDir.Enabled = enabled + case "edit_file": + cfg.Tools.EditFile.Enabled = enabled + case "append_file": + cfg.Tools.AppendFile.Enabled = enabled + case "exec": + cfg.Tools.Exec.Enabled = enabled + case "cron": + cfg.Tools.Cron.Enabled = enabled + case "web_search": + cfg.Tools.Web.Enabled = enabled + case "web_fetch": + cfg.Tools.WebFetch.Enabled = enabled + case "message": + cfg.Tools.Message.Enabled = enabled + case "send_file": + cfg.Tools.SendFile.Enabled = enabled + case "find_skills": + cfg.Tools.FindSkills.Enabled = enabled + if enabled { + cfg.Tools.Skills.Enabled = true + } + case "install_skill": + cfg.Tools.InstallSkill.Enabled = enabled + if enabled { + cfg.Tools.Skills.Enabled = true + } + case "spawn": + cfg.Tools.Spawn.Enabled = enabled + if enabled { + cfg.Tools.Subagent.Enabled = true + } + case "i2c": + cfg.Tools.I2C.Enabled = enabled + case "spi": + cfg.Tools.SPI.Enabled = enabled + case "tool_search_tool_regex": + cfg.Tools.MCP.Discovery.UseRegex = enabled + if enabled { + cfg.Tools.MCP.Enabled = true + cfg.Tools.MCP.Discovery.Enabled = true + } + case "tool_search_tool_bm25": + cfg.Tools.MCP.Discovery.UseBM25 = enabled + if enabled { + cfg.Tools.MCP.Enabled = true + cfg.Tools.MCP.Discovery.Enabled = true + } + default: + return fmt.Errorf("tool %q cannot be updated", toolName) + } + return nil +} diff --git a/web/backend/api/tools_test.go b/web/backend/api/tools_test.go new file mode 100644 index 000000000..646cefbe2 --- /dev/null +++ b/web/backend/api/tools_test.go @@ -0,0 +1,198 @@ +package api + +import ( + "bytes" + "encoding/json" + "net/http" + "net/http/httptest" + "runtime" + "testing" + + "github.com/sipeed/picoclaw/pkg/config" +) + +func TestHandleListTools(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.Tools.ReadFile.Enabled = true + cfg.Tools.WriteFile.Enabled = false + cfg.Tools.Cron.Enabled = true + cfg.Tools.FindSkills.Enabled = true + cfg.Tools.Skills.Enabled = true + cfg.Tools.Spawn.Enabled = true + cfg.Tools.Subagent.Enabled = false + cfg.Tools.MCP.Enabled = true + cfg.Tools.MCP.Discovery.Enabled = true + cfg.Tools.MCP.Discovery.UseRegex = true + cfg.Tools.MCP.Discovery.UseBM25 = false + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/tools", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + var resp toolSupportResponse + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + gotTools := make(map[string]toolSupportItem, len(resp.Tools)) + for _, tool := range resp.Tools { + gotTools[tool.Name] = tool + } + if gotTools["read_file"].Status != "enabled" { + t.Fatalf("read_file status = %q, want enabled", gotTools["read_file"].Status) + } + if gotTools["write_file"].Status != "disabled" { + t.Fatalf("write_file status = %q, want disabled", gotTools["write_file"].Status) + } + if gotTools["cron"].Status != "enabled" { + t.Fatalf("cron status = %q, want enabled", gotTools["cron"].Status) + } + if gotTools["spawn"].Status != "blocked" || gotTools["spawn"].ReasonCode != "requires_subagent" { + t.Fatalf("spawn = %#v, want blocked/requires_subagent", gotTools["spawn"]) + } + if gotTools["find_skills"].Status != "enabled" { + t.Fatalf("find_skills status = %q, want enabled", gotTools["find_skills"].Status) + } + if gotTools["tool_search_tool_regex"].Status != "enabled" { + t.Fatalf("tool_search_tool_regex status = %q, want enabled", gotTools["tool_search_tool_regex"].Status) + } + if gotTools["tool_search_tool_regex"].ConfigKey != "mcp.discovery.use_regex" { + t.Fatalf( + "tool_search_tool_regex config_key = %q, want mcp.discovery.use_regex", + gotTools["tool_search_tool_regex"].ConfigKey, + ) + } + if gotTools["tool_search_tool_bm25"].Status != "disabled" { + t.Fatalf("tool_search_tool_bm25 status = %q, want disabled", gotTools["tool_search_tool_bm25"].Status) + } + if gotTools["tool_search_tool_bm25"].ConfigKey != "mcp.discovery.use_bm25" { + t.Fatalf( + "tool_search_tool_bm25 config_key = %q, want mcp.discovery.use_bm25", + gotTools["tool_search_tool_bm25"].ConfigKey, + ) + } + if runtime.GOOS == "linux" { + if gotTools["i2c"].Status != "disabled" { + t.Fatalf("i2c status = %q, want disabled on linux when config is off", gotTools["i2c"].Status) + } + } else { + cfg.Tools.I2C.Enabled = true + cfg.Tools.SPI.Enabled = true + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + rec = httptest.NewRecorder() + req = httptest.NewRequest(http.MethodGet, "/api/tools", nil) + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil { + t.Fatalf("Unmarshal() error = %v", err) + } + gotTools = make(map[string]toolSupportItem, len(resp.Tools)) + for _, tool := range resp.Tools { + gotTools[tool.Name] = tool + } + + if gotTools["i2c"].Status != "blocked" || gotTools["i2c"].ReasonCode != "requires_linux" { + t.Fatalf("i2c = %#v, want blocked/requires_linux", gotTools["i2c"]) + } + if gotTools["spi"].Status != "blocked" || gotTools["spi"].ReasonCode != "requires_linux" { + t.Fatalf("spi = %#v, want blocked/requires_linux", gotTools["spi"]) + } + } +} + +func TestHandleUpdateToolState(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + cfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + cfg.Tools.Spawn.Enabled = false + cfg.Tools.Subagent.Enabled = false + cfg.Tools.Cron.Enabled = false + cfg.Tools.MCP.Enabled = false + cfg.Tools.MCP.Discovery.Enabled = false + cfg.Tools.MCP.Discovery.UseRegex = false + err = config.SaveConfig(configPath, cfg) + if err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + rec := httptest.NewRecorder() + req := httptest.NewRequest( + http.MethodPut, + "/api/tools/spawn/state", + bytes.NewBufferString(`{"enabled":true}`), + ) + req.Header.Set("Content-Type", "application/json") + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("spawn status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } + + rec2 := httptest.NewRecorder() + req2 := httptest.NewRequest( + http.MethodPut, + "/api/tools/tool_search_tool_regex/state", + bytes.NewBufferString(`{"enabled":true}`), + ) + req2.Header.Set("Content-Type", "application/json") + mux.ServeHTTP(rec2, req2) + if rec2.Code != http.StatusOK { + t.Fatalf("regex status = %d, want %d, body=%s", rec2.Code, http.StatusOK, rec2.Body.String()) + } + + rec3 := httptest.NewRecorder() + req3 := httptest.NewRequest( + http.MethodPut, + "/api/tools/cron/state", + bytes.NewBufferString(`{"enabled":true}`), + ) + req3.Header.Set("Content-Type", "application/json") + mux.ServeHTTP(rec3, req3) + if rec3.Code != http.StatusOK { + t.Fatalf("cron status = %d, want %d, body=%s", rec3.Code, http.StatusOK, rec3.Body.String()) + } + + updated, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig(updated) error = %v", err) + } + if !updated.Tools.Spawn.Enabled || !updated.Tools.Subagent.Enabled { + t.Fatalf("spawn/subagent should both be enabled: %#v", updated.Tools) + } + if !updated.Tools.MCP.Enabled || !updated.Tools.MCP.Discovery.Enabled || !updated.Tools.MCP.Discovery.UseRegex { + t.Fatalf("mcp regex discovery should be enabled: %#v", updated.Tools.MCP) + } + if !updated.Tools.Cron.Enabled { + t.Fatalf("cron should be enabled: %#v", updated.Tools.Cron) + } +} diff --git a/web/backend/dist/.gitkeep b/web/backend/dist/.gitkeep index e69de29bb..4b533f03a 100644 --- a/web/backend/dist/.gitkeep +++ b/web/backend/dist/.gitkeep @@ -0,0 +1 @@ +# Keep the embedded web backend dist directory in version control. diff --git a/web/backend/main.go b/web/backend/main.go index b8c4dc2bb..650540ea8 100644 --- a/web/backend/main.go +++ b/web/backend/main.go @@ -25,6 +25,7 @@ import ( "github.com/sipeed/picoclaw/web/backend/api" "github.com/sipeed/picoclaw/web/backend/launcherconfig" "github.com/sipeed/picoclaw/web/backend/middleware" + "github.com/sipeed/picoclaw/web/backend/utils" ) func main() { @@ -51,7 +52,7 @@ func main() { flag.Parse() // Resolve config path - configPath := getDefaultConfigPath() + configPath := utils.GetDefaultConfigPath() if flag.NArg() > 0 { configPath = flag.Arg(0) } @@ -60,6 +61,10 @@ func main() { if err != nil { log.Fatalf("Failed to resolve config path: %v", err) } + err = utils.EnsureOnboarded(absPath) + if err != nil { + log.Printf("Warning: Failed to initialize PicoClaw config automatically: %v", err) + } var explicitPort bool var explicitPublic bool @@ -109,7 +114,7 @@ func main() { // API Routes (e.g. /api/status) apiHandler := api.NewHandler(absPath) - apiHandler.SetServerOptions(portNum, effectivePublic, launcherCfg.AllowedCIDRs) + apiHandler.SetServerOptions(portNum, effectivePublic, explicitPublic, launcherCfg.AllowedCIDRs) apiHandler.RegisterRoutes(mux) // Frontend Embedded Assets @@ -128,13 +133,13 @@ func main() { ) // Print startup banner - fmt.Print(banner) + fmt.Print(utils.Banner) fmt.Println() fmt.Println(" Open the following URL in your browser:") fmt.Println() fmt.Printf(" >> http://localhost:%s <<\n", effectivePort) if effectivePublic { - if ip := getLocalIP(); ip != "" { + if ip := utils.GetLocalIP(); ip != "" { fmt.Printf(" >> http://%s:%s <<\n", ip, effectivePort) } } @@ -145,7 +150,7 @@ func main() { go func() { time.Sleep(500 * time.Millisecond) url := "http://localhost:" + effectivePort - if err := openBrowser(url); err != nil { + if err := utils.OpenBrowser(url); err != nil { log.Printf("Warning: Failed to auto-open browser: %v", err) } }() diff --git a/web/backend/utils.go b/web/backend/utils/banner.go similarity index 54% rename from web/backend/utils.go rename to web/backend/utils/banner.go index 6fa734aeb..a64ea6390 100644 --- a/web/backend/utils.go +++ b/web/backend/utils/banner.go @@ -1,19 +1,10 @@ -package main - -import ( - "fmt" - "net" - "os" - "os/exec" - "path/filepath" - "runtime" -) +package utils const ( colorBlue = "\x1b[38;2;62;93;185m" colorRed = "\x1b[38;2;213;70;70m" colorReset = "\x1b[0m" - banner = "\r\n" + + Banner = "\r\n" + colorBlue + "██████╗ ██╗ ██████╗ ██████╗ " + colorRed + " ██████╗██╗ █████╗ ██╗ ██╗\n" + colorBlue + "██╔══██╗██║██╔════╝██╔═══██╗" + colorRed + "██╔════╝██║ ██╔══██╗██║ ██║\n" + colorBlue + "██████╔╝██║██║ ██║ ██║" + colorRed + "██║ ██║ ███████║██║ █╗ ██║\n" + @@ -22,40 +13,3 @@ const ( colorBlue + "╚═╝ ╚═╝ ╚═════╝ ╚═════╝ " + colorRed + " ╚═════╝╚══════╝╚═╝ ╚═╝ ╚══╝╚══╝\n" + colorReset ) - -// getDefaultConfigPath returns the default path to the picoclaw config file. -func getDefaultConfigPath() string { - home, err := os.UserHomeDir() - if err != nil { - return "config.json" - } - return filepath.Join(home, ".picoclaw", "config.json") -} - -// getLocalIP returns the local IP address of the machine. -func getLocalIP() string { - addrs, err := net.InterfaceAddrs() - if err != nil { - return "" - } - for _, a := range addrs { - if ipnet, ok := a.(*net.IPNet); ok && !ipnet.IP.IsLoopback() && ipnet.IP.To4() != nil { - return ipnet.IP.String() - } - } - return "" -} - -// openBrowser automatically opens the given URL in the default browser. -func openBrowser(url string) error { - switch runtime.GOOS { - case "linux": - return exec.Command("xdg-open", url).Start() - case "windows": - return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start() - case "darwin": - return exec.Command("open", url).Start() - default: - return fmt.Errorf("unsupported platform") - } -} diff --git a/web/backend/utils/onboard.go b/web/backend/utils/onboard.go new file mode 100644 index 000000000..fbe34f220 --- /dev/null +++ b/web/backend/utils/onboard.go @@ -0,0 +1,42 @@ +package utils + +import ( + "fmt" + "os" + "os/exec" + "strings" +) + +var execCommand = exec.Command + +func EnsureOnboarded(configPath string) error { + _, err := os.Stat(configPath) + if err == nil { + return nil + } + if !os.IsNotExist(err) { + return fmt.Errorf("stat config: %w", err) + } + + cmd := execCommand(FindPicoclawBinary(), "onboard") + cmd.Env = append(os.Environ(), "PICOCLAW_CONFIG="+configPath) + cmd.Stdin = strings.NewReader("n\n") + + output, err := cmd.CombinedOutput() + if err != nil { + trimmed := strings.TrimSpace(string(output)) + if trimmed == "" { + return fmt.Errorf("run onboard: %w", err) + } + return fmt.Errorf("run onboard: %w: %s", err, trimmed) + } + + if _, err := os.Stat(configPath); err != nil { + if os.IsNotExist(err) { + return fmt.Errorf("onboard completed but did not create config %s", configPath) + } + return fmt.Errorf("verify config after onboard: %w", err) + } + + return nil +} diff --git a/web/backend/utils/onboard_test.go b/web/backend/utils/onboard_test.go new file mode 100644 index 000000000..06f967e76 --- /dev/null +++ b/web/backend/utils/onboard_test.go @@ -0,0 +1,101 @@ +package utils + +import ( + "os" + "os/exec" + "path/filepath" + "strings" + "testing" +) + +func TestEnsureOnboardedSkipsWhenConfigExists(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + if err := os.WriteFile(configPath, []byte(`{}`), 0o644); err != nil { + t.Fatalf("WriteFile() error = %v", err) + } + + origExecCommand := execCommand + defer func() { execCommand = origExecCommand }() + + called := false + execCommand = func(name string, args ...string) *exec.Cmd { + called = true + return exec.Command("sh", "-c", "exit 1") + } + + if err := EnsureOnboarded(configPath); err != nil { + t.Fatalf("EnsureOnboarded() error = %v", err) + } + if called { + t.Fatal("expected onboard command not to run when config already exists") + } +} + +func TestEnsureOnboardedRunsOnboardWhenConfigMissing(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + t.Setenv("EXPECTED_CONFIG_PATH", configPath) + + origExecCommand := execCommand + defer func() { execCommand = origExecCommand }() + + var gotName string + var gotArgs []string + execCommand = func(name string, args ...string) *exec.Cmd { + gotName = name + gotArgs = append([]string(nil), args...) + return exec.Command( + "sh", + "-c", + `test "$PICOCLAW_CONFIG" = "$EXPECTED_CONFIG_PATH" && +mkdir -p "$(dirname "$PICOCLAW_CONFIG")" && +printf '{}' > "$PICOCLAW_CONFIG"`, + ) + } + + if err := EnsureOnboarded(configPath); err != nil { + t.Fatalf("EnsureOnboarded() error = %v", err) + } + if gotName == "" { + t.Fatal("expected onboard command to run") + } + if len(gotArgs) != 1 || gotArgs[0] != "onboard" { + t.Fatalf("command args = %#v, want []string{\"onboard\"}", gotArgs) + } + if _, err := os.Stat(configPath); err != nil { + t.Fatalf("expected config to be created: %v", err) + } +} + +func TestEnsureOnboardedFailsWhenOnboardDoesNotCreateConfig(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + + origExecCommand := execCommand + defer func() { execCommand = origExecCommand }() + + execCommand = func(name string, args ...string) *exec.Cmd { + return exec.Command("sh", "-c", "exit 0") + } + + if err := EnsureOnboarded(configPath); err == nil { + t.Fatal("EnsureOnboarded() error = nil, want failure when onboard does not create config") + } +} + +func TestEnsureOnboardedIncludesOnboardOutputOnFailure(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + + origExecCommand := execCommand + defer func() { execCommand = origExecCommand }() + + execCommand = func(name string, args ...string) *exec.Cmd { + return exec.Command("sh", "-c", "echo onboarding failed >&2; exit 2") + } + + err := EnsureOnboarded(configPath) + if err == nil { + t.Fatal("EnsureOnboarded() error = nil, want failure") + } + if !strings.Contains(err.Error(), "onboarding failed") { + t.Fatalf("error = %q, want onboard output included", err) + } +} diff --git a/web/backend/utils/runtime.go b/web/backend/utils/runtime.go new file mode 100644 index 000000000..4e6c32c56 --- /dev/null +++ b/web/backend/utils/runtime.go @@ -0,0 +1,80 @@ +package utils + +import ( + "fmt" + "net" + "os" + "os/exec" + "path/filepath" + "runtime" +) + +// GetDefaultConfigPath returns the default path to the picoclaw config file. +func GetDefaultConfigPath() string { + if configPath := os.Getenv("PICOCLAW_CONFIG"); configPath != "" { + return configPath + } + if picoclawHome := os.Getenv("PICOCLAW_HOME"); picoclawHome != "" { + return filepath.Join(picoclawHome, "config.json") + } + home, err := os.UserHomeDir() + if err != nil { + return "config.json" + } + return filepath.Join(home, ".picoclaw", "config.json") +} + +// FindPicoclawBinary locates the picoclaw executable. +// Search order: +// 1. PICOCLAW_BINARY environment variable (explicit override) +// 2. Same directory as the current executable +// 3. Falls back to "picoclaw" and relies on $PATH +func FindPicoclawBinary() string { + binaryName := "picoclaw" + if runtime.GOOS == "windows" { + binaryName = "picoclaw.exe" + } + + if p := os.Getenv("PICOCLAW_BINARY"); p != "" { + if info, _ := os.Stat(p); info != nil && !info.IsDir() { + return p + } + } + + if exe, err := os.Executable(); err == nil { + candidate := filepath.Join(filepath.Dir(exe), binaryName) + if info, err := os.Stat(candidate); err == nil && !info.IsDir() { + return candidate + } + } + + return "picoclaw" +} + +// GetLocalIP returns the local IP address of the machine. +func GetLocalIP() string { + addrs, err := net.InterfaceAddrs() + if err != nil { + return "" + } + for _, a := range addrs { + if ipnet, ok := a.(*net.IPNet); ok && !ipnet.IP.IsLoopback() && ipnet.IP.To4() != nil { + return ipnet.IP.String() + } + } + return "" +} + +// OpenBrowser automatically opens the given URL in the default browser. +func OpenBrowser(url string) error { + switch runtime.GOOS { + case "linux": + return exec.Command("xdg-open", url).Start() + case "windows": + return exec.Command("rundll32", "url.dll,FileProtocolHandler", url).Start() + case "darwin": + return exec.Command("open", url).Start() + default: + return fmt.Errorf("unsupported platform") + } +} diff --git a/web/frontend/package.json b/web/frontend/package.json index ee46cdcda..687fd5771 100644 --- a/web/frontend/package.json +++ b/web/frontend/package.json @@ -32,7 +32,7 @@ "react-markdown": "^10.1.0", "react-textarea-autosize": "^8.5.9", "remark-gfm": "^4.0.1", - "shadcn": "^3.8.5", + "shadcn": "^4.0.5", "sonner": "^2.0.7", "tailwind-merge": "^3.5.0", "tailwindcss": "^4.2.1", diff --git a/web/frontend/pnpm-lock.yaml b/web/frontend/pnpm-lock.yaml index 8e89cbbe5..9de3354a1 100644 --- a/web/frontend/pnpm-lock.yaml +++ b/web/frontend/pnpm-lock.yaml @@ -66,8 +66,8 @@ importers: specifier: ^4.0.1 version: 4.0.1 shadcn: - specifier: ^3.8.5 - version: 3.8.5(@types/node@24.11.0)(typescript@5.9.3) + specifier: ^4.0.5 + version: 4.0.5(@types/node@24.11.0)(typescript@5.9.3) sonner: specifier: ^2.0.7 version: 2.0.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4) @@ -512,8 +512,8 @@ packages: '@fontsource-variable/inter@5.2.8': resolution: {integrity: sha512-kOfP2D+ykbcX/P3IFnokOhVRNoTozo5/JxhAIVYLpea/UBmCQ/YWPBfWIDuBImXX/15KH+eKh4xpEUyS2sQQGQ==} - '@hono/node-server@1.19.9': - resolution: {integrity: sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==} + '@hono/node-server@1.19.11': + resolution: {integrity: sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==} engines: {node: '>=18.14.1'} peerDependencies: hono: ^4 @@ -1359,79 +1359,66 @@ packages: resolution: {integrity: sha512-t4ONHboXi/3E0rT6OZl1pKbl2Vgxf9vJfWgmUoCEVQVxhW6Cw/c8I6hbbu7DAvgp82RKiH7TpLwxnJeKv2pbsw==} cpu: [arm] os: [linux] - libc: [glibc] '@rollup/rollup-linux-arm-musleabihf@4.59.0': resolution: {integrity: sha512-CikFT7aYPA2ufMD086cVORBYGHffBo4K8MQ4uPS/ZnY54GKj36i196u8U+aDVT2LX4eSMbyHtyOh7D7Zvk2VvA==} cpu: [arm] os: [linux] - libc: [musl] '@rollup/rollup-linux-arm64-gnu@4.59.0': resolution: {integrity: sha512-jYgUGk5aLd1nUb1CtQ8E+t5JhLc9x5WdBKew9ZgAXg7DBk0ZHErLHdXM24rfX+bKrFe+Xp5YuJo54I5HFjGDAA==} cpu: [arm64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-arm64-musl@4.59.0': resolution: {integrity: sha512-peZRVEdnFWZ5Bh2KeumKG9ty7aCXzzEsHShOZEFiCQlDEepP1dpUl/SrUNXNg13UmZl+gzVDPsiCwnV1uI0RUA==} cpu: [arm64] os: [linux] - libc: [musl] '@rollup/rollup-linux-loong64-gnu@4.59.0': resolution: {integrity: sha512-gbUSW/97f7+r4gHy3Jlup8zDG190AuodsWnNiXErp9mT90iCy9NKKU0Xwx5k8VlRAIV2uU9CsMnEFg/xXaOfXg==} cpu: [loong64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-loong64-musl@4.59.0': resolution: {integrity: sha512-yTRONe79E+o0FWFijasoTjtzG9EBedFXJMl888NBEDCDV9I2wGbFFfJQQe63OijbFCUZqxpHz1GzpbtSFikJ4Q==} cpu: [loong64] os: [linux] - libc: [musl] '@rollup/rollup-linux-ppc64-gnu@4.59.0': resolution: {integrity: sha512-sw1o3tfyk12k3OEpRddF68a1unZ5VCN7zoTNtSn2KndUE+ea3m3ROOKRCZxEpmT9nsGnogpFP9x6mnLTCaoLkA==} cpu: [ppc64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-ppc64-musl@4.59.0': resolution: {integrity: sha512-+2kLtQ4xT3AiIxkzFVFXfsmlZiG5FXYW7ZyIIvGA7Bdeuh9Z0aN4hVyXS/G1E9bTP/vqszNIN/pUKCk/BTHsKA==} cpu: [ppc64] os: [linux] - libc: [musl] '@rollup/rollup-linux-riscv64-gnu@4.59.0': resolution: {integrity: sha512-NDYMpsXYJJaj+I7UdwIuHHNxXZ/b/N2hR15NyH3m2qAtb/hHPA4g4SuuvrdxetTdndfj9b1WOmy73kcPRoERUg==} cpu: [riscv64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-riscv64-musl@4.59.0': resolution: {integrity: sha512-nLckB8WOqHIf1bhymk+oHxvM9D3tyPndZH8i8+35p/1YiVoVswPid2yLzgX7ZJP0KQvnkhM4H6QZ5m0LzbyIAg==} cpu: [riscv64] os: [linux] - libc: [musl] '@rollup/rollup-linux-s390x-gnu@4.59.0': resolution: {integrity: sha512-oF87Ie3uAIvORFBpwnCvUzdeYUqi2wY6jRFWJAy1qus/udHFYIkplYRW+wo+GRUP4sKzYdmE1Y3+rY5Gc4ZO+w==} cpu: [s390x] os: [linux] - libc: [glibc] '@rollup/rollup-linux-x64-gnu@4.59.0': resolution: {integrity: sha512-3AHmtQq/ppNuUspKAlvA8HtLybkDflkMuLK4DPo77DfthRb71V84/c4MlWJXixZz4uruIH4uaa07IqoAkG64fg==} cpu: [x64] os: [linux] - libc: [glibc] '@rollup/rollup-linux-x64-musl@4.59.0': resolution: {integrity: sha512-2UdiwS/9cTAx7qIUZB/fWtToJwvt0Vbo0zmnYt7ED35KPg13Q0ym1g442THLC7VyI6JfYTP4PiSOWyoMdV2/xg==} cpu: [x64] os: [linux] - libc: [musl] '@rollup/rollup-openbsd-x64@4.59.0': resolution: {integrity: sha512-M3bLRAVk6GOwFlPTIxVBSYKUaqfLrn8l0psKinkCFxl4lQvOSz8ZrKDz2gxcBwHFpci0B6rttydI4IpS4IS/jQ==} @@ -1516,28 +1503,24 @@ packages: engines: {node: '>= 20'} cpu: [arm64] os: [linux] - libc: [glibc] '@tailwindcss/oxide-linux-arm64-musl@4.2.1': resolution: {integrity: sha512-WZA0CHRL/SP1TRbA5mp9htsppSEkWuQ4KsSUumYQnyl8ZdT39ntwqmz4IUHGN6p4XdSlYfJwM4rRzZLShHsGAQ==} engines: {node: '>= 20'} cpu: [arm64] os: [linux] - libc: [musl] '@tailwindcss/oxide-linux-x64-gnu@4.2.1': resolution: {integrity: sha512-qMFzxI2YlBOLW5PhblzuSWlWfwLHaneBE0xHzLrBgNtqN6mWfs+qYbhryGSXQjFYB1Dzf5w+LN5qbUTPhW7Y5g==} engines: {node: '>= 20'} cpu: [x64] os: [linux] - libc: [glibc] '@tailwindcss/oxide-linux-x64-musl@4.2.1': resolution: {integrity: sha512-5r1X2FKnCMUPlXTWRYpHdPYUY6a1Ar/t7P24OuiEdEOmms5lyqjDRvVY1yy9Rmioh+AunQ0rWiOTPE8F9A3v5g==} engines: {node: '>= 20'} cpu: [x64] os: [linux] - libc: [musl] '@tailwindcss/oxide-wasm32-wasi@4.2.1': resolution: {integrity: sha512-MGFB5cVPvshR85MTJkEvqDUnuNoysrsRxd6vnk1Lf2tbiqNlXpHYZqkqOQalydienEWOHHFyyuTSYRsLfxFJ2Q==} @@ -2296,8 +2279,8 @@ packages: resolution: {integrity: sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==} engines: {node: ^18.19.0 || >=20.5.0} - express-rate-limit@8.2.1: - resolution: {integrity: sha512-PCZEIEIxqwhzw4KF0n7QF4QqruVTcF73O5kFKUnGOyjbCCgizBBiFaYpd/fnBLUMPw/BWw9OsiN7GgrNYr7j6g==} + express-rate-limit@8.3.1: + resolution: {integrity: sha512-D1dKN+cmyPWuvB+G2SREQDzPY1agpBIcTa9sJxOPMCNeH3gwzhqJRDWCXW3gg0y//+LQ/8j52JbMROWyrKdMdw==} engines: {node: '>= 16'} peerDependencies: express: '>= 4.11' @@ -2496,8 +2479,8 @@ packages: hermes-parser@0.25.1: resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==} - hono@4.12.3: - resolution: {integrity: sha512-SFsVSjp8sj5UumXOOFlkZOG6XS9SJDKw0TbwFeV+AJ8xlST8kxK5Z/5EYa111UY8732lK2S/xB653ceuaoGwpg==} + hono@4.12.7: + resolution: {integrity: sha512-jq9l1DM0zVIvsm3lv9Nw9nlJnMNPOcAtsbsgiUhWcFzPE99Gvo6yRTlszSLLYacMeQ6quHD6hMfId8crVHvexw==} engines: {node: '>=16.9.0'} html-parse-stringify@3.0.1: @@ -2559,8 +2542,8 @@ packages: inline-style-parser@0.2.7: resolution: {integrity: sha512-Nb2ctOyNR8DqQoR0OwRG95uNWIC0C1lCgf5Naz5H6Ji72KZ8OcFZLz2P5sNgwlyoJ8Yif11oMuYs5pBQa86csA==} - ip-address@10.0.1: - resolution: {integrity: sha512-NWv9YLW4PoW2B7xtzaS3NCot75m6nK7Icdv0o3lfMceJVRfSoQwqD4wEH5rLwoKJwUiZ/rfpiVBhnaF0FK4HoA==} + ip-address@10.1.0: + resolution: {integrity: sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==} engines: {node: '>= 12'} ipaddr.js@1.9.1: @@ -2785,28 +2768,24 @@ packages: engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] - libc: [glibc] lightningcss-linux-arm64-musl@1.31.1: resolution: {integrity: sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==} engines: {node: '>= 12.0.0'} cpu: [arm64] os: [linux] - libc: [musl] lightningcss-linux-x64-gnu@1.31.1: resolution: {integrity: sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] - libc: [glibc] lightningcss-linux-x64-musl@1.31.1: resolution: {integrity: sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==} engines: {node: '>= 12.0.0'} cpu: [x64] os: [linux] - libc: [musl] lightningcss-win32-arm64-msvc@1.31.1: resolution: {integrity: sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==} @@ -3501,8 +3480,8 @@ packages: setprototypeof@1.2.0: resolution: {integrity: sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==} - shadcn@3.8.5: - resolution: {integrity: sha512-jPRx44e+eyeV7xwY3BLJXcfrks00+M0h5BGB9l6DdcBW4BpAj4x3lVmVy0TXPEs2iHEisxejr62sZAAw6B1EVA==} + shadcn@4.0.5: + resolution: {integrity: sha512-z0SOHEU1+ADam1UJHrgxJhUsOb0/jBoYc+u9mhWs071KrnORq48X7uCwG3mD2ysQEBtOfeK/MxMGsmzL5Jt+Jg==} hasBin: true shebang-command@2.0.0: @@ -4332,9 +4311,9 @@ snapshots: '@fontsource-variable/inter@5.2.8': {} - '@hono/node-server@1.19.9(hono@4.12.3)': + '@hono/node-server@1.19.11(hono@4.12.7)': dependencies: - hono: 4.12.3 + hono: 4.12.7 '@humanfs/core@0.19.1': {} @@ -4396,7 +4375,7 @@ snapshots: '@modelcontextprotocol/sdk@1.27.1(zod@3.25.76)': dependencies: - '@hono/node-server': 1.19.9(hono@4.12.3) + '@hono/node-server': 1.19.11(hono@4.12.7) ajv: 8.18.0 ajv-formats: 3.0.1(ajv@8.18.0) content-type: 1.0.5 @@ -4405,8 +4384,8 @@ snapshots: eventsource: 3.0.7 eventsource-parser: 3.0.6 express: 5.2.1 - express-rate-limit: 8.2.1(express@5.2.1) - hono: 4.12.3 + express-rate-limit: 8.3.1(express@5.2.1) + hono: 4.12.7 jose: 6.1.3 json-schema-typed: 8.0.2 pkce-challenge: 5.0.1 @@ -6146,10 +6125,10 @@ snapshots: strip-final-newline: 4.0.0 yoctocolors: 2.1.2 - express-rate-limit@8.2.1(express@5.2.1): + express-rate-limit@8.3.1(express@5.2.1): dependencies: express: 5.2.1 - ip-address: 10.0.1 + ip-address: 10.1.0 express@5.2.1: dependencies: @@ -6374,7 +6353,7 @@ snapshots: dependencies: hermes-estree: 0.25.1 - hono@4.12.3: {} + hono@4.12.7: {} html-parse-stringify@3.0.1: dependencies: @@ -6430,7 +6409,7 @@ snapshots: inline-style-parser@0.2.7: {} - ip-address@10.0.1: {} + ip-address@10.1.0: {} ipaddr.js@1.9.1: {} @@ -7534,7 +7513,7 @@ snapshots: setprototypeof@1.2.0: {} - shadcn@3.8.5(@types/node@24.11.0)(typescript@5.9.3): + shadcn@4.0.5(@types/node@24.11.0)(typescript@5.9.3): dependencies: '@antfu/ni': 25.0.0 '@babel/core': 7.29.0 diff --git a/web/frontend/src/api/gateway.ts b/web/frontend/src/api/gateway.ts index 5a58d48f0..020e92e3a 100644 --- a/web/frontend/src/api/gateway.ts +++ b/web/frontend/src/api/gateway.ts @@ -14,6 +14,8 @@ interface GatewayStatusResponse { interface GatewayActionResponse { status: string pid?: number + log_total?: number + log_run_id?: number } const BASE_URL = "" @@ -59,4 +61,10 @@ export async function restartGateway(): Promise { }) } +export async function clearGatewayLogs(): Promise { + return request("/api/gateway/logs/clear", { + method: "POST", + }) +} + export type { GatewayStatusResponse, GatewayActionResponse } diff --git a/web/frontend/src/api/sessions.ts b/web/frontend/src/api/sessions.ts index 56ef148db..10b0d28fd 100644 --- a/web/frontend/src/api/sessions.ts +++ b/web/frontend/src/api/sessions.ts @@ -2,6 +2,7 @@ export interface SessionSummary { id: string + title: string preview: string message_count: number created: string diff --git a/web/frontend/src/api/skills.ts b/web/frontend/src/api/skills.ts new file mode 100644 index 000000000..307cbd788 --- /dev/null +++ b/web/frontend/src/api/skills.ts @@ -0,0 +1,79 @@ +export interface SkillSupportItem { + name: string + path: string + source: "workspace" | "global" | "builtin" | string + description: string +} + +export interface SkillDetailResponse extends SkillSupportItem { + content: string +} + +interface SkillsResponse { + skills: SkillSupportItem[] +} + +interface SkillActionResponse { + status?: string + name?: string + path?: string + source?: string + description?: string +} + +async function request(path: string, options?: RequestInit): Promise { + const res = await fetch(path, options) + if (!res.ok) { + throw new Error(await extractErrorMessage(res)) + } + return res.json() as Promise +} + +export async function getSkills(): Promise { + return request("/api/skills") +} + +export async function getSkill(name: string): Promise { + return request(`/api/skills/${encodeURIComponent(name)}`) +} + +export async function importSkill(file: File): Promise { + const formData = new FormData() + formData.set("file", file) + + const res = await fetch("/api/skills/import", { + method: "POST", + body: formData, + }) + if (!res.ok) { + throw new Error(await extractErrorMessage(res)) + } + return res.json() as Promise +} + +export async function deleteSkill(name: string): Promise { + return request( + `/api/skills/${encodeURIComponent(name)}`, + { + method: "DELETE", + }, + ) +} + +async function extractErrorMessage(res: Response): Promise { + try { + const body = (await res.json()) as { + error?: string + errors?: string[] + } + if (Array.isArray(body.errors) && body.errors.length > 0) { + return body.errors.join("; ") + } + if (typeof body.error === "string" && body.error.trim() !== "") { + return body.error + } + } catch { + // ignore invalid body + } + return `API error: ${res.status} ${res.statusText}` +} diff --git a/web/frontend/src/api/tools.ts b/web/frontend/src/api/tools.ts new file mode 100644 index 000000000..9f09efbfd --- /dev/null +++ b/web/frontend/src/api/tools.ts @@ -0,0 +1,56 @@ +export interface ToolSupportItem { + name: string + description: string + category: string + config_key: string + status: "enabled" | "disabled" | "blocked" + reason_code?: string +} + +interface ToolsResponse { + tools: ToolSupportItem[] +} + +interface ToolActionResponse { + status: string +} + +async function request(path: string, options?: RequestInit): Promise { + const res = await fetch(path, options) + if (!res.ok) { + let message = `API error: ${res.status} ${res.statusText}` + try { + const body = (await res.json()) as { + error?: string + errors?: string[] + } + if (Array.isArray(body.errors) && body.errors.length > 0) { + message = body.errors.join("; ") + } else if (typeof body.error === "string" && body.error.trim() !== "") { + message = body.error + } + } catch { + // ignore invalid body + } + throw new Error(message) + } + return res.json() as Promise +} + +export async function getTools(): Promise { + return request("/api/tools") +} + +export async function setToolEnabled( + name: string, + enabled: boolean, +): Promise { + return request( + `/api/tools/${encodeURIComponent(name)}/state`, + { + method: "PUT", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ enabled }), + }, + ) +} diff --git a/web/frontend/src/components/app-sidebar.tsx b/web/frontend/src/components/app-sidebar.tsx index dc24f8781..702212857 100644 --- a/web/frontend/src/components/app-sidebar.tsx +++ b/web/frontend/src/components/app-sidebar.tsx @@ -7,6 +7,8 @@ import { IconListDetails, IconMessageCircle, IconSettings, + IconSparkles, + IconTools, } from "@tabler/icons-react" import { Link, useRouterState } from "@tanstack/react-router" import * as React from "react" @@ -53,6 +55,10 @@ const baseNavGroups: Omit[] = [ label: "navigation.model_group", defaultOpen: true, }, + { + label: "navigation.agent_group", + defaultOpen: true, + }, { label: "navigation.services", defaultOpen: true, @@ -113,6 +119,23 @@ export function AppSidebar({ ...props }: React.ComponentProps) { }, { ...baseNavGroups[2], + items: [ + { + title: "navigation.skills", + url: "/agent/skills", + icon: IconSparkles, + translateTitle: true, + }, + { + title: "navigation.tools", + url: "/agent/tools", + icon: IconTools, + translateTitle: true, + }, + ], + }, + { + ...baseNavGroups[3], items: [ { title: "navigation.config", diff --git a/web/frontend/src/components/chat/chat-page.tsx b/web/frontend/src/components/chat/chat-page.tsx index 0fd23a6a5..a3ab843b4 100644 --- a/web/frontend/src/components/chat/chat-page.tsx +++ b/web/frontend/src/components/chat/chat-page.tsx @@ -43,11 +43,18 @@ export function ChatPage() { handleSetDefault, } = useChatModels({ isConnected }) - const { sessions, hasMore, observerRef, loadSessions, handleDeleteSession } = - useSessionHistory({ - activeSessionId, - onDeletedActiveSession: newChat, - }) + const { + sessions, + hasMore, + loadError, + loadErrorMessage, + observerRef, + loadSessions, + handleDeleteSession, + } = useSessionHistory({ + activeSessionId, + onDeletedActiveSession: newChat, + }) const handleScroll = (e: React.UIEvent) => { const { scrollTop, scrollHeight, clientHeight } = e.currentTarget @@ -96,6 +103,8 @@ export function ChatPage() { sessions={sessions} activeSessionId={activeSessionId} hasMore={hasMore} + loadError={loadError} + loadErrorMessage={loadErrorMessage} observerRef={observerRef} onOpenChange={(open) => { if (open) { diff --git a/web/frontend/src/components/chat/session-history-menu.tsx b/web/frontend/src/components/chat/session-history-menu.tsx index f2e93295c..3f293e353 100644 --- a/web/frontend/src/components/chat/session-history-menu.tsx +++ b/web/frontend/src/components/chat/session-history-menu.tsx @@ -17,6 +17,8 @@ interface SessionHistoryMenuProps { sessions: SessionSummary[] activeSessionId: string hasMore: boolean + loadError: boolean + loadErrorMessage: string observerRef: RefObject onOpenChange: (open: boolean) => void onSwitchSession: (sessionId: string) => void @@ -27,6 +29,8 @@ export function SessionHistoryMenu({ sessions, activeSessionId, hasMore, + loadError, + loadErrorMessage, observerRef, onOpenChange, onSwitchSession, @@ -44,7 +48,14 @@ export function SessionHistoryMenu({ - {sessions.length === 0 ? ( + {loadError && ( + + + {loadErrorMessage} + + + )} + {sessions.length === 0 && !loadError ? ( {t("chat.noHistory")} @@ -60,7 +71,7 @@ export function SessionHistoryMenu({ onClick={() => onSwitchSession(session.id)} > - {session.preview} + {session.title || session.preview} {t("chat.messagesCount", { diff --git a/web/frontend/src/components/config/config-page.tsx b/web/frontend/src/components/config/config-page.tsx index c2d502079..d7e1aa1b5 100644 --- a/web/frontend/src/components/config/config-page.tsx +++ b/web/frontend/src/components/config/config-page.tsx @@ -189,6 +189,11 @@ export function ConfigPage() { session: { dm_scope: dmScope, }, + tools: { + exec: { + allow_remote: form.allowRemote, + }, + }, heartbeat: { enabled: form.heartbeatEnabled, interval: heartbeatInterval, diff --git a/web/frontend/src/components/config/config-sections.tsx b/web/frontend/src/components/config/config-sections.tsx index 340ece333..90813be2a 100644 --- a/web/frontend/src/components/config/config-sections.tsx +++ b/web/frontend/src/components/config/config-sections.tsx @@ -63,6 +63,13 @@ export function AgentDefaultsSection({ } /> + onFieldChange("allowRemote", checked)} + /> + export interface CoreConfigForm { workspace: string restrictToWorkspace: boolean + allowRemote: boolean maxTokens: string maxToolIterations: string summarizeMessageThreshold: string @@ -54,6 +55,7 @@ export const DM_SCOPE_OPTIONS = [ export const EMPTY_FORM: CoreConfigForm = { workspace: "", restrictToWorkspace: true, + allowRemote: true, maxTokens: "32768", maxToolIterations: "50", summarizeMessageThreshold: "20", @@ -103,6 +105,8 @@ export function buildFormFromConfig(config: unknown): CoreConfigForm { const session = asRecord(root.session) const heartbeat = asRecord(root.heartbeat) const devices = asRecord(root.devices) + const tools = asRecord(root.tools) + const exec = asRecord(tools.exec) return { workspace: asString(defaults.workspace) || EMPTY_FORM.workspace, @@ -110,6 +114,10 @@ export function buildFormFromConfig(config: unknown): CoreConfigForm { defaults.restrict_to_workspace === undefined ? EMPTY_FORM.restrictToWorkspace : asBool(defaults.restrict_to_workspace), + allowRemote: + exec.allow_remote === undefined + ? EMPTY_FORM.allowRemote + : asBool(exec.allow_remote), maxTokens: asNumberString(defaults.max_tokens, EMPTY_FORM.maxTokens), maxToolIterations: asNumberString( defaults.max_tool_iterations, diff --git a/web/frontend/src/components/skills/skills-page.tsx b/web/frontend/src/components/skills/skills-page.tsx new file mode 100644 index 000000000..3b5c5acb4 --- /dev/null +++ b/web/frontend/src/components/skills/skills-page.tsx @@ -0,0 +1,314 @@ +import { + IconFileInfo, + IconLoader2, + IconPlus, + IconTrash, +} from "@tabler/icons-react" +import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query" +import { type ChangeEvent, useRef, useState } from "react" +import { useTranslation } from "react-i18next" +import ReactMarkdown from "react-markdown" +import remarkGfm from "remark-gfm" +import { toast } from "sonner" + +import { + type SkillSupportItem, + deleteSkill, + getSkill, + getSkills, + importSkill, +} from "@/api/skills" +import { PageHeader } from "@/components/page-header" +import { + AlertDialog, + AlertDialogAction, + AlertDialogCancel, + AlertDialogContent, + AlertDialogDescription, + AlertDialogFooter, + AlertDialogHeader, + AlertDialogTitle, +} from "@/components/ui/alert-dialog" +import { Button } from "@/components/ui/button" +import { + Card, + CardContent, + CardDescription, + CardHeader, + CardTitle, +} from "@/components/ui/card" +import { + Sheet, + SheetContent, + SheetDescription, + SheetHeader, + SheetTitle, +} from "@/components/ui/sheet" + +export function SkillsPage() { + const { t } = useTranslation() + const queryClient = useQueryClient() + const importInputRef = useRef(null) + const [selectedSkill, setSelectedSkill] = useState( + null, + ) + const [skillPendingDelete, setSkillPendingDelete] = + useState(null) + + const { data, isLoading, error } = useQuery({ + queryKey: ["skills"], + queryFn: getSkills, + }) + const { + data: selectedSkillDetail, + isLoading: isSkillDetailLoading, + error: skillDetailError, + } = useQuery({ + queryKey: ["skills", selectedSkill?.name], + queryFn: () => getSkill(selectedSkill!.name), + enabled: selectedSkill !== null, + }) + + const importMutation = useMutation({ + mutationFn: async (file: File) => importSkill(file), + onSuccess: () => { + toast.success(t("pages.agent.skills.import_success")) + void queryClient.invalidateQueries({ queryKey: ["skills"] }) + }, + onError: (err) => { + toast.error( + err instanceof Error + ? err.message + : t("pages.agent.skills.import_error"), + ) + }, + }) + + const deleteMutation = useMutation({ + mutationFn: async (name: string) => deleteSkill(name), + onSuccess: (_, deletedName) => { + toast.success(t("pages.agent.skills.delete_success")) + setSkillPendingDelete(null) + if ( + selectedSkill?.name === deletedName && + selectedSkill.source === "workspace" + ) { + setSelectedSkill(null) + } + void queryClient.invalidateQueries({ queryKey: ["skills"] }) + }, + onError: (err) => { + toast.error( + err instanceof Error + ? err.message + : t("pages.agent.skills.delete_error"), + ) + }, + }) + + const handleImportClick = () => { + importInputRef.current?.click() + } + + const handleImportFileChange = (event: ChangeEvent) => { + const file = event.target.files?.[0] + if (!file) return + importMutation.mutate(file) + event.target.value = "" + } + + return ( +
+ + + + + } + /> + +
+
+ {isLoading ? ( +
+ {t("labels.loading")} +
+ ) : error ? ( +
+ {t("pages.agent.load_error")} +
+ ) : ( +
+

+ {t("pages.agent.skills.description")} +

+ + {data?.skills.length ? ( +
+ {data.skills.map((skill) => ( + + +
+
+ + {skill.name} + + + {skill.description || + t("pages.agent.skills.no_description")} + +
+
+ + {skill.source === "workspace" ? ( + + ) : null} +
+
+ + +
+ {t("pages.agent.skills.path")} +
+
+ {skill.path} +
+ + + ))} +
+ ) : ( + + + {t("pages.agent.skills.empty")} + + + )} +
+ )} +
+
+ + { + if (!open) setSelectedSkill(null) + }} + > + + + + {selectedSkill?.name || t("pages.agent.skills.viewer_title")} + + + {selectedSkill?.description || + t("pages.agent.skills.viewer_description")} + + + +
+ {isSkillDetailLoading ? ( +
+ {t("pages.agent.skills.loading_detail")} +
+ ) : skillDetailError ? ( +
+ {t("pages.agent.skills.load_detail_error")} +
+ ) : selectedSkillDetail ? ( +
+
+ + {selectedSkillDetail.content} + +
+
+ ) : null} +
+ + + + { + if (!open) setSkillPendingDelete(null) + }} + > + + + + {t("pages.agent.skills.delete_title")} + + + {t("pages.agent.skills.delete_description", { + name: skillPendingDelete?.name, + })} + + + + + {t("common.cancel")} + + { + if (skillPendingDelete) + deleteMutation.mutate(skillPendingDelete.name) + }} + > + {deleteMutation.isPending ? ( + + ) : ( + + )} + {t("pages.agent.skills.delete_confirm")} + + + + +
+ ) +} diff --git a/web/frontend/src/components/tools/tools-page.tsx b/web/frontend/src/components/tools/tools-page.tsx new file mode 100644 index 000000000..05aa42122 --- /dev/null +++ b/web/frontend/src/components/tools/tools-page.tsx @@ -0,0 +1,190 @@ +import { IconLoader2 } from "@tabler/icons-react" +import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query" +import { useTranslation } from "react-i18next" +import { toast } from "sonner" + +import { type ToolSupportItem, getTools, setToolEnabled } from "@/api/tools" +import { PageHeader } from "@/components/page-header" +import { Button } from "@/components/ui/button" +import { + Card, + CardContent, + CardDescription, + CardHeader, + CardTitle, +} from "@/components/ui/card" +import { cn } from "@/lib/utils" + +export function ToolsPage() { + const { t } = useTranslation() + const queryClient = useQueryClient() + const { data, isLoading, error } = useQuery({ + queryKey: ["tools"], + queryFn: getTools, + }) + + const toggleMutation = useMutation({ + mutationFn: async ({ name, enabled }: { name: string; enabled: boolean }) => + setToolEnabled(name, enabled), + onSuccess: (_, variables) => { + toast.success( + variables.enabled + ? t("pages.agent.tools.enable_success") + : t("pages.agent.tools.disable_success"), + ) + void queryClient.invalidateQueries({ queryKey: ["tools"] }) + }, + onError: (err) => { + toast.error( + err instanceof Error + ? err.message + : t("pages.agent.tools.toggle_error"), + ) + }, + }) + + const groupedTools = (() => { + if (!data) return [] as Array<[string, ToolSupportItem[]]> + const buckets = new Map() + for (const item of data.tools) { + const list = buckets.get(item.category) ?? [] + list.push(item) + buckets.set(item.category, list) + } + return Array.from(buckets.entries()) + })() + + return ( +
+ + +
+
+ {isLoading ? ( +
+ {t("labels.loading")} +
+ ) : error ? ( +
+ {t("pages.agent.load_error")} +
+ ) : ( +
+

+ {t("pages.agent.tools.description")} +

+ + {data?.tools.length ? ( + groupedTools.map(([category, items]) => ( +
+
+ {t(`pages.agent.tools.categories.${category}`)} +
+
+ {items.map((tool) => { + const reasonText = tool.reason_code + ? t(`pages.agent.tools.reasons.${tool.reason_code}`) + : "" + const isPending = + toggleMutation.isPending && + toggleMutation.variables?.name === tool.name + const nextEnabled = tool.status !== "enabled" + + return ( + + +
+
+ + {tool.name} + + + {tool.description} + +
+
+ + +
+
+ + +
+ {t("pages.agent.tools.config_key", { + key: tool.config_key, + })} +
+ {reasonText ? ( +
+ {reasonText} +
+ ) : null} + + + ) + })} +
+
+ )) + ) : ( + + + {t("pages.agent.tools.empty")} + + + )} +
+ )} +
+
+
+ ) +} + +function ToolStatusBadge({ status }: { status: ToolSupportItem["status"] }) { + const { t } = useTranslation() + + return ( + + {t(`pages.agent.tools.status.${status}`)} + + ) +} diff --git a/web/frontend/src/hooks/use-pico-chat.ts b/web/frontend/src/hooks/use-pico-chat.ts index 7735ad928..4ce615dcf 100644 --- a/web/frontend/src/hooks/use-pico-chat.ts +++ b/web/frontend/src/hooks/use-pico-chat.ts @@ -1,6 +1,8 @@ import dayjs from "dayjs" import { useAtomValue } from "jotai" import { useCallback, useEffect, useRef, useState } from "react" +import { useTranslation } from "react-i18next" +import { toast } from "sonner" import { getPicoToken } from "@/api/pico" import { getSessionHistory } from "@/api/sessions" @@ -100,6 +102,7 @@ export function formatMessageTime(dateRaw: number | string | Date): string { } export function usePicoChat() { + const { t } = useTranslation() const { status: gatewayState } = useAtomValue(gatewayAtom) const [messages, setMessages] = useState([]) const [connectionState, setConnectionState] = @@ -317,43 +320,38 @@ export function usePicoChat() { // Switch to a historical session const switchSession = useCallback( async (sessionId: string) => { - // Disconnect current WebSocket - disconnect() - - // Set new session ID - setActiveSessionId(sessionId) - setIsTyping(false) - - // Load history from backend - try { - const detail = await getSessionHistory(sessionId) - // Set all history messages timestamp from the session updated time as fallback, - // since currently the backend doesn't return per-message timestamp in the history API. - // We'll use the session's updated time for now. - const fallbackTime = detail.updated - - setMessages( - detail.messages.map((m, i) => ({ - id: `hist-${i}-${Date.now()}`, - role: m.role as "user" | "assistant", - content: m.content, - timestamp: fallbackTime, - })), - ) - } catch (err) { - console.error("Failed to load session history:", err) - setMessages([]) + if (sessionId === activeSessionIdRef.current) { + return + } + + try { + const detail = await getSessionHistory(sessionId) + const fallbackTime = detail.updated + const historyMessages = detail.messages.map((m, i) => ({ + id: `hist-${i}-${Date.now()}`, + role: m.role as "user" | "assistant", + content: m.content, + timestamp: fallbackTime, + })) + + // Only switch the active websocket session after history has loaded successfully. + disconnect() + setActiveSessionId(sessionId) + setIsTyping(false) + setMessages(historyMessages) + } catch (err) { + console.error("Failed to load session history:", err) + toast.error(t("chat.historyOpenFailed")) + return } - // Reconnect with new session ID (will use the updated ref) - // Small delay to ensure state has settled setTimeout(() => { if (gatewayState === "running") { connect() } }, 100) }, - [disconnect, connect, gatewayState], + [connect, disconnect, gatewayState, t], ) // Start a new empty chat diff --git a/web/frontend/src/hooks/use-session-history.ts b/web/frontend/src/hooks/use-session-history.ts index 1a6d5c956..790339dba 100644 --- a/web/frontend/src/hooks/use-session-history.ts +++ b/web/frontend/src/hooks/use-session-history.ts @@ -1,4 +1,5 @@ import { useCallback, useEffect, useRef, useState } from "react" +import { useTranslation } from "react-i18next" import { type SessionSummary, deleteSession, getSessions } from "@/api/sessions" @@ -13,22 +14,26 @@ export function useSessionHistory({ activeSessionId, onDeletedActiveSession, }: UseSessionHistoryOptions) { + const { t } = useTranslation() const observerRef = useRef(null) const [sessions, setSessions] = useState([]) const [offset, setOffset] = useState(0) const [hasMore, setHasMore] = useState(true) const [isLoadingMore, setIsLoadingMore] = useState(false) + const [loadError, setLoadError] = useState(false) const loadSessions = useCallback( async (reset = true) => { try { const currentOffset = reset ? 0 : offset if (reset) { + setLoadError(false) setHasMore(true) setOffset(0) } const data = await getSessions(currentOffset, LIMIT) + setLoadError(false) if (data.length < LIMIT) { setHasMore(false) @@ -45,8 +50,12 @@ export function useSessionHistory({ } setOffset(currentOffset + data.length) - } catch { - // silently fail + } catch (err) { + console.error("Failed to fetch session history:", err) + setLoadError(true) + if (!reset) { + setHasMore(false) + } } finally { setIsLoadingMore(false) } @@ -55,11 +64,16 @@ export function useSessionHistory({ ) useEffect(() => { - if (!observerRef.current || !hasMore || isLoadingMore) return + if (!observerRef.current || !hasMore || isLoadingMore || loadError) return const observer = new IntersectionObserver( (entries) => { - if (entries[0].isIntersecting && hasMore && !isLoadingMore) { + if ( + entries[0].isIntersecting && + hasMore && + !isLoadingMore && + !loadError + ) { setIsLoadingMore(true) void loadSessions(false) } @@ -69,7 +83,7 @@ export function useSessionHistory({ observer.observe(observerRef.current) return () => observer.disconnect() - }, [hasMore, isLoadingMore, loadSessions]) + }, [hasMore, isLoadingMore, loadError, loadSessions]) const handleDeleteSession = useCallback( async (id: string) => { @@ -89,6 +103,8 @@ export function useSessionHistory({ return { sessions, hasMore, + loadError, + loadErrorMessage: t("chat.historyLoadFailed"), observerRef, loadSessions, handleDeleteSession, diff --git a/web/frontend/src/hooks/use-sidebar-channels.ts b/web/frontend/src/hooks/use-sidebar-channels.ts index 0848af468..5579a955b 100644 --- a/web/frontend/src/hooks/use-sidebar-channels.ts +++ b/web/frontend/src/hooks/use-sidebar-channels.ts @@ -27,7 +27,7 @@ import { import { getChannelDisplayName } from "@/components/channels/channel-display-name" import { gatewayAtom } from "@/store/gateway" -const DEFAULT_VISIBLE_CHANNELS = 5 +const DEFAULT_VISIBLE_CHANNELS = 4 const CHANNEL_IMPORTANCE_ORDER = [ "discord", "feishu", diff --git a/web/frontend/src/i18n/locales/en.json b/web/frontend/src/i18n/locales/en.json index f1ed0ac16..b88b5c924 100644 --- a/web/frontend/src/i18n/locales/en.json +++ b/web/frontend/src/i18n/locales/en.json @@ -4,6 +4,9 @@ "model_group": "Models", "models": "Models", "credentials": "Credentials", + "agent_group": "Agent", + "skills": "Skills", + "tools": "Tools", "services": "Services", "channels_group": "Channels", "show_more_channels": "More", @@ -25,6 +28,8 @@ }, "history": "History", "noHistory": "No chat history yet", + "historyLoadFailed": "Failed to load chat history", + "historyOpenFailed": "Failed to open this chat history", "loadingMore": "Loading more...", "deleteSession": "Delete session", "messagesCount": "{{count}} messages", @@ -324,12 +329,108 @@ } }, "pages": { + "agent": { + "load_error": "Failed to load agent support information.", + "stats": { + "workspace": "Workspace", + "workspace_hint": "The default agent workspace used for runtime files and workspace skills.", + "skills": "Available Skills", + "skills_hint": "Skills discovered from workspace, global, and builtin roots.", + "tools": "Enabled Tools", + "tools_hint": "{{blocked}} blocked by missing dependencies." + }, + "skills": { + "title": "Skills", + "description": "Skills are loaded from the workspace, global PicoClaw home, and builtin directories.", + "hero_title": "Skill Library", + "hero_description": "Browse every capability package the agent can load, then drill straight into the effective SKILL.md without leaving the page.", + "stats": { + "total": "Total Skills", + "workspace": "Workspace", + "shared": "Shared" + }, + "empty": "No skills are currently available.", + "import": "Import Skill", + "import_title": "Import Skill", + "import_description": "Create a workspace skill by uploading a markdown file as the new SKILL.md.", + "import_name": "Skill Name", + "import_name_placeholder": "e.g. my-workflow", + "import_file": "Markdown File", + "import_file_hint": "Upload a .md file. The backend stores it as workspace/skills//SKILL.md.", + "import_confirm": "Import Skill", + "import_success": "Skill imported.", + "import_error": "Failed to import skill.", + "view": "View", + "delete": "Delete", + "delete_title": "Delete Skill?", + "delete_description": "\"{{name}}\" will be removed from workspace skills.", + "delete_confirm": "Delete", + "delete_success": "Skill deleted.", + "delete_error": "Failed to delete skill.", + "viewer_title": "Skill Content", + "viewer_description": "Read the current effective SKILL.md content here.", + "loading_detail": "Loading skill content...", + "load_detail_error": "Failed to load skill content.", + "source": "Source", + "path": "Skill Path", + "no_description": "No description provided.", + "sources": { + "workspace": "Workspace", + "global": "Global", + "builtin": "Builtin" + }, + "errors": { + "file_required": "Please choose a markdown file to import." + } + }, + "tools": { + "title": "Tools", + "description": "This view reflects whether each agent tool is enabled, disabled, or blocked by a missing prerequisite.", + "hero_title": "Tool Surface", + "hero_description": "Inspect what the agent can actually call right now, which capabilities are blocked, and where each tool is controlled in config.", + "stats": { + "enabled": "Enabled", + "blocked": "Blocked", + "categories": "Categories" + }, + "empty": "No tools are available.", + "enable": "Enable", + "disable": "Disable", + "enable_success": "Tool enabled.", + "disable_success": "Tool disabled.", + "toggle_error": "Failed to update tool state.", + "config_key": "Controlled by tools.{{key}}", + "status": { + "enabled": "Enabled", + "disabled": "Disabled", + "blocked": "Blocked" + }, + "categories": { + "automation": "Automation", + "filesystem": "Filesystem", + "web": "Web", + "communication": "Communication", + "skills": "Skills", + "agents": "Agents", + "hardware": "Hardware", + "discovery": "Discovery" + }, + "reasons": { + "requires_linux": "This tool only works on Linux hosts with the required device files exposed.", + "requires_skills": "Enable `tools.skills` before this skill-registry tool can be used.", + "requires_subagent": "Enable `tools.subagent` before the spawn tool can delegate work.", + "requires_mcp_discovery": "Enable `tools.mcp.discovery` before MCP discovery tools become available." + } + } + }, "config": { "load_error": "Failed to load configuration. Please refresh and try again.", "workspace": "Workspace Directory", "workspace_hint": "Base directory for agent file operations.", "restrict_workspace": "Restrict to Workspace", "restrict_workspace_hint": "Only allow file operations inside workspace.", + "allow_remote": "Allow Remote Shell Execution", + "allow_remote_hint": "When enabled, shell commands can also run for remote sessions or non-local contexts. When disabled, shell execution stays limited to local safe contexts.", "max_tokens": "Max Tokens", "max_tokens_hint": "Upper token limit per model response.", "max_tool_iterations": "Max Tool Iterations", @@ -387,7 +488,9 @@ "unsaved_changes": "You have unsaved changes." }, "logs": { - "description": "System logs and monitoring." + "description": "System logs and monitoring.", + "clear": "Clear logs", + "empty": "Waiting for logs..." } } } diff --git a/web/frontend/src/i18n/locales/zh.json b/web/frontend/src/i18n/locales/zh.json index b66f0f03d..12833cbf5 100644 --- a/web/frontend/src/i18n/locales/zh.json +++ b/web/frontend/src/i18n/locales/zh.json @@ -4,6 +4,9 @@ "model_group": "模型", "models": "模型", "credentials": "凭据", + "agent_group": "智能体", + "skills": "技能", + "tools": "工具", "services": "服务", "channels_group": "频道", "show_more_channels": "更多", @@ -25,6 +28,8 @@ }, "history": "历史记录", "noHistory": "暂无对话历史", + "historyLoadFailed": "加载历史记录失败", + "historyOpenFailed": "打开该历史会话失败", "loadingMore": "加载更多...", "deleteSession": "删除会话", "messagesCount": "{{count}} 条消息", @@ -324,12 +329,108 @@ } }, "pages": { + "agent": { + "load_error": "加载 Agent 支持信息失败。", + "stats": { + "workspace": "工作目录", + "workspace_hint": "默认 Agent 运行时使用的工作目录，也用于加载工作区技能。", + "skills": "可用技能数", + "skills_hint": "从工作区、全局目录和内置目录发现的技能。", + "tools": "已启用工具", + "tools_hint": "其中 {{blocked}} 个因依赖未满足而不可用。" + }, + "skills": { + "title": "技能", + "description": "技能会从工作区、PicoClaw 全局目录和内置目录中加载。", + "hero_title": "技能库", + "hero_description": "在这里查看 Agent 当前可加载的能力包，并且不离开页面就能直接阅读生效后的 SKILL.md。", + "stats": { + "total": "技能总数", + "workspace": "工作区技能", + "shared": "共享技能" + }, + "empty": "当前没有可用技能。", + "import": "导入技能", + "import_title": "导入技能", + "import_description": "通过上传 Markdown 文件创建工作区技能，文件会保存为新的 SKILL.md。", + "import_name": "技能名称", + "import_name_placeholder": "例如 my-workflow", + "import_file": "Markdown 文件", + "import_file_hint": "上传一个 .md 文件。后端会保存到 workspace/skills//SKILL.md。", + "import_confirm": "导入技能", + "import_success": "技能导入成功。", + "import_error": "导入技能失败。", + "view": "查看", + "delete": "删除", + "delete_title": "删除技能？", + "delete_description": "将从工作区技能中移除「{{name}}」。", + "delete_confirm": "删除", + "delete_success": "技能已删除。", + "delete_error": "删除技能失败。", + "viewer_title": "技能内容", + "viewer_description": "这里展示当前生效的 SKILL.md 内容。", + "loading_detail": "正在加载技能内容...", + "load_detail_error": "加载技能内容失败。", + "source": "来源", + "path": "技能路径", + "no_description": "未提供描述。", + "sources": { + "workspace": "工作区", + "global": "全局", + "builtin": "内置" + }, + "errors": { + "file_required": "请先选择要导入的 Markdown 文件。" + } + }, + "tools": { + "title": "工具", + "description": "这里展示每个 Agent 工具当前是已启用、已禁用，还是被依赖条件阻塞。", + "hero_title": "工具面板", + "hero_description": "集中查看 Agent 现在真正可调用的工具、被阻塞的能力，以及它们分别受哪项配置控制。", + "stats": { + "enabled": "已启用", + "blocked": "被阻塞", + "categories": "分类数" + }, + "empty": "当前没有可用工具。", + "enable": "启用", + "disable": "禁用", + "enable_success": "工具已启用。", + "disable_success": "工具已禁用。", + "toggle_error": "更新工具状态失败。", + "config_key": "由 tools.{{key}} 控制", + "status": { + "enabled": "已启用", + "disabled": "已禁用", + "blocked": "被阻塞" + }, + "categories": { + "automation": "自动化", + "filesystem": "文件系统", + "web": "网页", + "communication": "通信", + "skills": "技能", + "agents": "Agent", + "hardware": "硬件", + "discovery": "发现" + }, + "reasons": { + "requires_linux": "该工具仅在 Linux 主机上可用，并且需要暴露对应的设备文件。", + "requires_skills": "需要先启用 `tools.skills`，该技能注册表工具才能使用。", + "requires_subagent": "需要先启用 `tools.subagent`，`spawn` 才能委派任务。", + "requires_mcp_discovery": "需要先启用 `tools.mcp.discovery`，MCP 发现工具才会可用。" + } + } + }, "config": { "load_error": "加载配置失败，请刷新后重试。", "workspace": "工作目录", "workspace_hint": "智能体执行文件读写操作时使用的基础目录。", "restrict_workspace": "限制工作目录访问", "restrict_workspace_hint": "仅允许在工作目录内执行文件操作。", + "allow_remote": "允许远程执行 Shell 命令", + "allow_remote_hint": "开启后，来自远程会话或非本地上下文的请求也可以执行 shell 命令；关闭后，仅允许本地安全上下文执行。", "max_tokens": "最大 Token 数", "max_tokens_hint": "单次模型响应允许的最大 Token 数。", "max_tool_iterations": "最大工具迭代次数", @@ -387,7 +488,9 @@ "unsaved_changes": "您有未保存的更改。" }, "logs": { - "description": "系统日志和监控。" + "description": "系统日志和监控。", + "clear": "清空日志", + "empty": "等待日志中..." } } } diff --git a/web/frontend/src/routeTree.gen.ts b/web/frontend/src/routeTree.gen.ts index 336504075..60f19ab53 100644 --- a/web/frontend/src/routeTree.gen.ts +++ b/web/frontend/src/routeTree.gen.ts @@ -13,10 +13,13 @@ import { Route as ModelsRouteImport } from './routes/models' import { Route as LogsRouteImport } from './routes/logs' import { Route as CredentialsRouteImport } from './routes/credentials' import { Route as ConfigRouteImport } from './routes/config' +import { Route as AgentRouteImport } from './routes/agent' import { Route as ChannelsRouteRouteImport } from './routes/channels/route' import { Route as IndexRouteImport } from './routes/index' import { Route as ConfigRawRouteImport } from './routes/config.raw' import { Route as ChannelsNameRouteImport } from './routes/channels/$name' +import { Route as AgentToolsRouteImport } from './routes/agent/tools' +import { Route as AgentSkillsRouteImport } from './routes/agent/skills' const ModelsRoute = ModelsRouteImport.update({ id: '/models', @@ -38,6 +41,11 @@ const ConfigRoute = ConfigRouteImport.update({ path: '/config', getParentRoute: () => rootRouteImport, } as any) +const AgentRoute = AgentRouteImport.update({ + id: '/agent', + path: '/agent', + getParentRoute: () => rootRouteImport, +} as any) const ChannelsRouteRoute = ChannelsRouteRouteImport.update({ id: '/channels', path: '/channels', @@ -58,24 +66,40 @@ const ChannelsNameRoute = ChannelsNameRouteImport.update({ path: '/$name', getParentRoute: () => ChannelsRouteRoute, } as any) +const AgentToolsRoute = AgentToolsRouteImport.update({ + id: '/tools', + path: '/tools', + getParentRoute: () => AgentRoute, +} as any) +const AgentSkillsRoute = AgentSkillsRouteImport.update({ + id: '/skills', + path: '/skills', + getParentRoute: () => AgentRoute, +} as any) export interface FileRoutesByFullPath { '/': typeof IndexRoute '/channels': typeof ChannelsRouteRouteWithChildren + '/agent': typeof AgentRouteWithChildren '/config': typeof ConfigRouteWithChildren '/credentials': typeof CredentialsRoute '/logs': typeof LogsRoute '/models': typeof ModelsRoute + '/agent/skills': typeof AgentSkillsRoute + '/agent/tools': typeof AgentToolsRoute '/channels/$name': typeof ChannelsNameRoute '/config/raw': typeof ConfigRawRoute } export interface FileRoutesByTo { '/': typeof IndexRoute '/channels': typeof ChannelsRouteRouteWithChildren + '/agent': typeof AgentRouteWithChildren '/config': typeof ConfigRouteWithChildren '/credentials': typeof CredentialsRoute '/logs': typeof LogsRoute '/models': typeof ModelsRoute + '/agent/skills': typeof AgentSkillsRoute + '/agent/tools': typeof AgentToolsRoute '/channels/$name': typeof ChannelsNameRoute '/config/raw': typeof ConfigRawRoute } @@ -83,10 +107,13 @@ export interface FileRoutesById { __root__: typeof rootRouteImport '/': typeof IndexRoute '/channels': typeof ChannelsRouteRouteWithChildren + '/agent': typeof AgentRouteWithChildren '/config': typeof ConfigRouteWithChildren '/credentials': typeof CredentialsRoute '/logs': typeof LogsRoute '/models': typeof ModelsRoute + '/agent/skills': typeof AgentSkillsRoute + '/agent/tools': typeof AgentToolsRoute '/channels/$name': typeof ChannelsNameRoute '/config/raw': typeof ConfigRawRoute } @@ -95,30 +122,39 @@ export interface FileRouteTypes { fullPaths: | '/' | '/channels' + | '/agent' | '/config' | '/credentials' | '/logs' | '/models' + | '/agent/skills' + | '/agent/tools' | '/channels/$name' | '/config/raw' fileRoutesByTo: FileRoutesByTo to: | '/' | '/channels' + | '/agent' | '/config' | '/credentials' | '/logs' | '/models' + | '/agent/skills' + | '/agent/tools' | '/channels/$name' | '/config/raw' id: | '__root__' | '/' | '/channels' + | '/agent' | '/config' | '/credentials' | '/logs' | '/models' + | '/agent/skills' + | '/agent/tools' | '/channels/$name' | '/config/raw' fileRoutesById: FileRoutesById @@ -126,6 +162,7 @@ export interface FileRouteTypes { export interface RootRouteChildren { IndexRoute: typeof IndexRoute ChannelsRouteRoute: typeof ChannelsRouteRouteWithChildren + AgentRoute: typeof AgentRouteWithChildren ConfigRoute: typeof ConfigRouteWithChildren CredentialsRoute: typeof CredentialsRoute LogsRoute: typeof LogsRoute @@ -162,6 +199,13 @@ declare module '@tanstack/react-router' { preLoaderRoute: typeof ConfigRouteImport parentRoute: typeof rootRouteImport } + '/agent': { + id: '/agent' + path: '/agent' + fullPath: '/agent' + preLoaderRoute: typeof AgentRouteImport + parentRoute: typeof rootRouteImport + } '/channels': { id: '/channels' path: '/channels' @@ -190,6 +234,20 @@ declare module '@tanstack/react-router' { preLoaderRoute: typeof ChannelsNameRouteImport parentRoute: typeof ChannelsRouteRoute } + '/agent/tools': { + id: '/agent/tools' + path: '/tools' + fullPath: '/agent/tools' + preLoaderRoute: typeof AgentToolsRouteImport + parentRoute: typeof AgentRoute + } + '/agent/skills': { + id: '/agent/skills' + path: '/skills' + fullPath: '/agent/skills' + preLoaderRoute: typeof AgentSkillsRouteImport + parentRoute: typeof AgentRoute + } } } @@ -205,6 +263,18 @@ const ChannelsRouteRouteWithChildren = ChannelsRouteRoute._addFileChildren( ChannelsRouteRouteChildren, ) +interface AgentRouteChildren { + AgentSkillsRoute: typeof AgentSkillsRoute + AgentToolsRoute: typeof AgentToolsRoute +} + +const AgentRouteChildren: AgentRouteChildren = { + AgentSkillsRoute: AgentSkillsRoute, + AgentToolsRoute: AgentToolsRoute, +} + +const AgentRouteWithChildren = AgentRoute._addFileChildren(AgentRouteChildren) + interface ConfigRouteChildren { ConfigRawRoute: typeof ConfigRawRoute } @@ -219,6 +289,7 @@ const ConfigRouteWithChildren = const rootRouteChildren: RootRouteChildren = { IndexRoute: IndexRoute, ChannelsRouteRoute: ChannelsRouteRouteWithChildren, + AgentRoute: AgentRouteWithChildren, ConfigRoute: ConfigRouteWithChildren, CredentialsRoute: CredentialsRoute, LogsRoute: LogsRoute, diff --git a/web/frontend/src/routes/agent.tsx b/web/frontend/src/routes/agent.tsx new file mode 100644 index 000000000..78104de5b --- /dev/null +++ b/web/frontend/src/routes/agent.tsx @@ -0,0 +1,22 @@ +import { + Navigate, + Outlet, + createFileRoute, + useRouterState, +} from "@tanstack/react-router" + +export const Route = createFileRoute("/agent")({ + component: AgentLayout, +}) + +function AgentLayout() { + const pathname = useRouterState({ + select: (state) => state.location.pathname, + }) + + if (pathname === "/agent") { + return + } + + return +} diff --git a/web/frontend/src/routes/agent/skills.tsx b/web/frontend/src/routes/agent/skills.tsx new file mode 100644 index 000000000..bbe396bdb --- /dev/null +++ b/web/frontend/src/routes/agent/skills.tsx @@ -0,0 +1,11 @@ +import { createFileRoute } from "@tanstack/react-router" + +import { SkillsPage } from "@/components/skills/skills-page" + +export const Route = createFileRoute("/agent/skills")({ + component: AgentSkillsRoute, +}) + +function AgentSkillsRoute() { + return +} diff --git a/web/frontend/src/routes/agent/tools.tsx b/web/frontend/src/routes/agent/tools.tsx new file mode 100644 index 000000000..ac8738a8f --- /dev/null +++ b/web/frontend/src/routes/agent/tools.tsx @@ -0,0 +1,11 @@ +import { createFileRoute } from "@tanstack/react-router" + +import { ToolsPage } from "@/components/tools/tools-page" + +export const Route = createFileRoute("/agent/tools")({ + component: AgentToolsRoute, +}) + +function AgentToolsRoute() { + return +} diff --git a/web/frontend/src/routes/logs.tsx b/web/frontend/src/routes/logs.tsx index 39688bd84..ef39e0bdf 100644 --- a/web/frontend/src/routes/logs.tsx +++ b/web/frontend/src/routes/logs.tsx @@ -1,10 +1,12 @@ +import { IconTrash } from "@tabler/icons-react" import { createFileRoute } from "@tanstack/react-router" import { useAtomValue } from "jotai" import { useEffect, useRef, useState } from "react" import { useTranslation } from "react-i18next" -import { getGatewayStatus } from "@/api/gateway" +import { clearGatewayLogs, getGatewayStatus } from "@/api/gateway" import { PageHeader } from "@/components/page-header" +import { Button } from "@/components/ui/button" import { ScrollArea } from "@/components/ui/scroll-area" import { gatewayAtom } from "@/store/gateway" @@ -15,12 +17,31 @@ export const Route = createFileRoute("/logs")({ function LogsPage() { const { t } = useTranslation() const [logs, setLogs] = useState([]) + const [clearing, setClearing] = useState(false) const logOffsetRef = useRef(0) const logRunIdRef = useRef(-1) + const syncTokenRef = useRef(0) const scrollRef = useRef(null) const gateway = useAtomValue(gatewayAtom) + const handleClearLogs = async () => { + setClearing(true) + try { + const data = await clearGatewayLogs() + syncTokenRef.current += 1 + setLogs([]) + logOffsetRef.current = data.log_total ?? 0 + if (data.log_run_id !== undefined) { + logRunIdRef.current = data.log_run_id + } + } catch { + // Ignore clear failures silently to avoid noisy transient errors. + } finally { + setClearing(false) + } + } + useEffect(() => { let mounted = true let timeout: ReturnType @@ -40,17 +61,17 @@ function LogsPage() { } try { + const requestToken = syncTokenRef.current + const requestOffset = logOffsetRef.current + const requestRunId = logRunIdRef.current const data = await getGatewayStatus({ - log_offset: logOffsetRef.current, - log_run_id: logRunIdRef.current, + log_offset: requestOffset, + log_run_id: requestRunId, }) - if (!mounted) return + if (!mounted || requestToken !== syncTokenRef.current) return - if ( - data.log_run_id !== undefined && - data.log_run_id !== logRunIdRef.current - ) { + if (data.log_run_id !== undefined && data.log_run_id !== requestRunId) { logRunIdRef.current = data.log_run_id logOffsetRef.current = 0 if (data.logs) { @@ -90,13 +111,25 @@ function LogsPage() {
-
-

- {t("navigation.logs")} -

-

- {t("pages.logs.description")} -

+
+
+

+ {t("navigation.logs")} +

+

+ {t("pages.logs.description")} +

+
+ +
@@ -104,7 +137,7 @@ function LogsPage() {
{logs.length === 0 ? (
- Waiting for logs... + {t("pages.logs.empty")}
) : ( logs.map((log, i) => ( From 7359b2c86c27108377b74bff5be960d54370f85f Mon Sep 17 00:00:00 2001 From: Cytown Date: Thu, 12 Mar 2026 14:09:31 +0800 Subject: [PATCH 003/234] add testcase for migrate from v0 to v1 --- pkg/config/migration_integration_test.go | 568 +++++++++++++++++++++++ 1 file changed, 568 insertions(+) create mode 100644 pkg/config/migration_integration_test.go diff --git a/pkg/config/migration_integration_test.go b/pkg/config/migration_integration_test.go new file mode 100644 index 000000000..4459c1316 --- /dev/null +++ b/pkg/config/migration_integration_test.go @@ -0,0 +1,568 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package config + +import ( + "encoding/json" + "os" + "path/filepath" + "testing" +) + +// TestMigration_Integration_LegacyConfigWithoutWorkspace tests the issue reported: +// User configured Model and Provider but no Workspace - settings should not be lost +func TestMigration_Integration_LegacyConfigWithoutWorkspace(t *testing.T) { + // Create a temporary directory for test config files + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + // Create a legacy config (version 0) with Model and Provider but NO Workspace + // This simulates the real-world scenario where user settings would be lost + legacyConfig := `{ + "agents": { + "defaults": { + "provider": "openai", + "model": "gpt-4o", + "max_tokens": 8192, + "temperature": 0.7 + } + }, + "channels": { + "telegram": { + "enabled": true, + "token": "test-token" + } + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": { + "enabled": true + } + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + // Load the config - this should trigger migration + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Verify version is updated + if cfg.Version != CurrentVersion { + t.Errorf("Version = %d, want %d", cfg.Version, CurrentVersion) + } + + // CRITICAL: Verify that user's settings are preserved + // This was the bug - these settings were lost when Workspace was empty + if cfg.Agents.Defaults.Provider != "openai" { + t.Errorf("Provider = %q, want %q (user's setting should be preserved)", cfg.Agents.Defaults.Provider, "openai") + } + // Old "model" field is migrated to "model_name" field + if cfg.Agents.Defaults.ModelName != "gpt-4o" { + t.Errorf( + "ModelName = %q, want %q (user's setting should be preserved)", + cfg.Agents.Defaults.ModelName, "gpt-4o", + ) + } + // GetModelName() should also return the migrated value + if cfg.Agents.Defaults.GetModelName() != "gpt-4o" { + t.Errorf("GetModelName() = %q, want %q", cfg.Agents.Defaults.GetModelName(), "gpt-4o") + } + if cfg.Agents.Defaults.MaxTokens != 8192 { + t.Errorf("MaxTokens = %d, want %d", cfg.Agents.Defaults.MaxTokens, 8192) + } + if cfg.Agents.Defaults.Temperature == nil { + t.Error("Temperature should not be nil") + } else if *cfg.Agents.Defaults.Temperature != 0.7 { + t.Errorf("Temperature = %v, want %v", *cfg.Agents.Defaults.Temperature, 0.7) + } + + // Verify Workspace has a default value (should not be empty) + if cfg.Agents.Defaults.Workspace == "" { + t.Error("Workspace should have a default value, not be empty") + } + + // Verify other config sections are preserved + if !cfg.Channels.Telegram.Enabled { + t.Error("Telegram.Enabled should be true") + } + if cfg.Channels.Telegram.Token != "test-token" { + t.Errorf("Telegram.Token = %q, want %q", cfg.Channels.Telegram.Token, "test-token") + } + if cfg.Gateway.Port != 18790 { + t.Errorf("Gateway.Port = %d, want %d", cfg.Gateway.Port, 18790) + } +} + +// TestMigration_Integration_LegacyConfigWithWorkspace tests migration with Workspace set +func TestMigration_Integration_LegacyConfigWithWorkspace(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + legacyConfig := `{ + "agents": { + "defaults": { + "workspace": "/custom/workspace", + "provider": "deepseek", + "model": "deepseek-chat", + "max_tokens": 16384 + } + }, + "channels": { + "telegram": { + "enabled": false + } + }, + "gateway": { + "host": "0.0.0.0", + "port": 8080 + }, + "tools": { + "web": { + "enabled": false + } + }, + "heartbeat": { + "enabled": false + }, + "devices": { + "enabled": true + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // All user settings should be preserved + if cfg.Agents.Defaults.Workspace != "/custom/workspace" { + t.Errorf("Workspace = %q, want %q", cfg.Agents.Defaults.Workspace, "/custom/workspace") + } + if cfg.Agents.Defaults.Provider != "deepseek" { + t.Errorf("Provider = %q, want %q", cfg.Agents.Defaults.Provider, "deepseek") + } + if cfg.Agents.Defaults.ModelName != "deepseek-chat" { + t.Errorf("ModelName = %q, want %q", cfg.Agents.Defaults.ModelName, "deepseek-chat") + } + if cfg.Agents.Defaults.MaxTokens != 16384 { + t.Errorf("MaxTokens = %d, want %d", cfg.Agents.Defaults.MaxTokens, 16384) + } + + // Verify other settings + if cfg.Gateway.Port != 8080 { + t.Errorf("Gateway.Port = %d, want %d", cfg.Gateway.Port, 8080) + } + if !cfg.Devices.Enabled { + t.Error("Devices.Enabled should be true") + } +} + +// TestMigration_Integration_PreservesAllAgentsFields tests that ALL Agents fields are preserved +func TestMigration_Integration_PreservesAllAgentsFields(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + legacyConfig := `{ + "agents": { + "defaults": { + "workspace": "", + "restrict_to_workspace": false, + "allow_read_outside_workspace": true, + "provider": "anthropic", + "model": "claude-opus-4", + "model_fallbacks": ["claude-sonnet-4", "claude-haiku-4"], + "image_model": "claude-opus-4-vision", + "image_model_fallbacks": ["claude-sonnet-4-vision"], + "max_tokens": 4096, + "temperature": 0.5, + "max_tool_iterations": 100, + "summarize_message_threshold": 30, + "summarize_token_percent": 80, + "max_media_size": 10485760 + }, + "list": [ + { + "id": "special-agent", + "default": false, + "name": "Special Agent", + "workspace": "/special/workspace" + } + ] + }, + "channels": { + "telegram": {"enabled": false} + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Verify ALL defaults fields are preserved + d := cfg.Agents.Defaults + + if d.RestrictToWorkspace != false { + t.Errorf("RestrictToWorkspace = %v, want false", d.RestrictToWorkspace) + } + if d.AllowReadOutsideWorkspace != true { + t.Errorf("AllowReadOutsideWorkspace = %v, want true", d.AllowReadOutsideWorkspace) + } + if d.Provider != "anthropic" { + t.Errorf("Provider = %q, want %q", d.Provider, "anthropic") + } + if d.ModelName != "claude-opus-4" { + t.Errorf("ModelName = %q, want %q", d.ModelName, "claude-opus-4") + } + if len(d.ModelFallbacks) != 2 { + t.Errorf("len(ModelFallbacks) = %d, want 2", len(d.ModelFallbacks)) + } else { + if d.ModelFallbacks[0] != "claude-sonnet-4" { + t.Errorf("ModelFallbacks[0] = %q, want %q", d.ModelFallbacks[0], "claude-sonnet-4") + } + if d.ModelFallbacks[1] != "claude-haiku-4" { + t.Errorf("ModelFallbacks[1] = %q, want %q", d.ModelFallbacks[1], "claude-haiku-4") + } + } + if d.ImageModel != "claude-opus-4-vision" { + t.Errorf("ImageModel = %q, want %q", d.ImageModel, "claude-opus-4-vision") + } + if len(d.ImageModelFallbacks) != 1 { + t.Errorf("len(ImageModelFallbacks) = %d, want 1", len(d.ImageModelFallbacks)) + } else if d.ImageModelFallbacks[0] != "claude-sonnet-4-vision" { + t.Errorf("ImageModelFallbacks[0] = %q, want %q", d.ImageModelFallbacks[0], "claude-sonnet-4-vision") + } + if d.MaxTokens != 4096 { + t.Errorf("MaxTokens = %d, want %d", d.MaxTokens, 4096) + } + if d.Temperature == nil || *d.Temperature != 0.5 { + t.Errorf("Temperature = %v, want 0.5", d.Temperature) + } + if d.MaxToolIterations != 100 { + t.Errorf("MaxToolIterations = %d, want %d", d.MaxToolIterations, 100) + } + if d.SummarizeMessageThreshold != 30 { + t.Errorf("SummarizeMessageThreshold = %d, want %d", d.SummarizeMessageThreshold, 30) + } + if d.SummarizeTokenPercent != 80 { + t.Errorf("SummarizeTokenPercent = %d, want %d", d.SummarizeTokenPercent, 80) + } + if d.MaxMediaSize != 10485760 { + t.Errorf("MaxMediaSize = %d, want %d", d.MaxMediaSize, 10485760) + } + + // Verify agent list is preserved + if len(cfg.Agents.List) != 1 { + t.Fatalf("len(Agents.List) = %d, want 1", len(cfg.Agents.List)) + } + if cfg.Agents.List[0].ID != "special-agent" { + t.Errorf("Agent.ID = %q, want %q", cfg.Agents.List[0].ID, "special-agent") + } + if cfg.Agents.List[0].Workspace != "/special/workspace" { + t.Errorf("Agent.Workspace = %q, want %q", cfg.Agents.List[0].Workspace, "/special/workspace") + } + + // Workspace should have default since it was empty in legacy config + if d.Workspace == "" { + t.Error("Workspace should have a default value, not be empty") + } +} + +// TestMigration_Integration_ChannelsConfigMigrated tests channel config migration +func TestMigration_Integration_ChannelsConfigMigrated(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + // Legacy config with old channel field formats + legacyConfig := `{ + "agents": { + "defaults": {} + }, + "channels": { + "discord": { + "enabled": true, + "token": "discord-token", + "mention_only": true + }, + "onebot": { + "enabled": true, + "ws_url": "ws://127.0.0.1:3001", + "group_trigger_prefix": ["/", "!"] + } + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Discord: mention_only should be migrated to group_trigger.mention_only + if cfg.Channels.Discord.GroupTrigger.MentionOnly != true { + t.Error("Discord.GroupTrigger.MentionOnly should be true after migration") + } + + // OneBot: group_trigger_prefix should be migrated to group_trigger.prefixes + if len(cfg.Channels.OneBot.GroupTrigger.Prefixes) != 2 { + t.Errorf("len(OneBot.GroupTrigger.Prefixes) = %d, want 2", len(cfg.Channels.OneBot.GroupTrigger.Prefixes)) + } else { + if cfg.Channels.OneBot.GroupTrigger.Prefixes[0] != "/" { + t.Errorf("Prefixes[0] = %q, want %q", cfg.Channels.OneBot.GroupTrigger.Prefixes[0], "/") + } + if cfg.Channels.OneBot.GroupTrigger.Prefixes[1] != "!" { + t.Errorf("Prefixes[1] = %q, want %q", cfg.Channels.OneBot.GroupTrigger.Prefixes[1], "!") + } + } +} + +// TestMigration_Integration_RoundTrip_SerializeAndLoad tests that migrated config can be saved and reloaded +func TestMigration_Integration_RoundTrip_SerializeAndLoad(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + legacyConfig := `{ + "agents": { + "defaults": { + "provider": "openai", + "model": "gpt-4o", + "max_tokens": 8192 + } + }, + "channels": { + "telegram": { + "enabled": true, + "token": "test-token" + } + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + // First load - triggers migration and saves + cfg1, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("First LoadConfig failed: %v", err) + } + + // Read the migrated config from disk + migratedData, err := os.ReadFile(configPath) + if err != nil { + t.Fatalf("Failed to read migrated config: %v", err) + } + + // Verify it has the current version + var versionCheck struct { + Version int `json:"version"` + } + if err = json.Unmarshal(migratedData, &versionCheck); err != nil { + t.Fatalf("Failed to parse migrated config version: %v", err) + } + if versionCheck.Version != CurrentVersion { + t.Errorf("Migrated config version = %d, want %d", versionCheck.Version, CurrentVersion) + } + + // Second load - should load the migrated config without changes + cfg2, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("Second LoadConfig failed: %v", err) + } + + // Verify configs are identical + if cfg2.Agents.Defaults.Provider != cfg1.Agents.Defaults.Provider { + t.Errorf("Provider changed from %q to %q", cfg1.Agents.Defaults.Provider, cfg2.Agents.Defaults.Provider) + } + if cfg2.Agents.Defaults.ModelName != cfg1.Agents.Defaults.ModelName { + t.Errorf("ModelName changed from %q to %q", cfg1.Agents.Defaults.ModelName, cfg2.Agents.Defaults.ModelName) + } + if cfg2.Agents.Defaults.MaxTokens != cfg1.Agents.Defaults.MaxTokens { + t.Errorf("MaxTokens changed from %d to %d", cfg1.Agents.Defaults.MaxTokens, cfg2.Agents.Defaults.MaxTokens) + } +} + +// TestMigration_Integration_EmptyAgentsDefaults tests migration with completely empty agents config +func TestMigration_Integration_EmptyAgentsDefaults(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + // Legacy config with empty agents defaults + legacyConfig := `{ + "agents": { + "defaults": {} + }, + "channels": { + "telegram": {"enabled": false} + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // Workspace should have default value + if cfg.Agents.Defaults.Workspace == "" { + t.Error("Workspace should have a default value") + } + + // Note: When fields are explicitly set in config (even to zero values), + // they override defaults. This is correct JSON unmarshaling behavior. + // Users should set values they want; defaults are for unspecified fields. + if cfg.Agents.Defaults.MaxTokens == 0 { + // This is expected when users don't set max_tokens in their config + // The zero value (0) from the legacy config is preserved + } + if cfg.Agents.Defaults.MaxToolIterations == 0 { + // Same as above - zero value is preserved if it was in the config + } +} + +// TestMigration_Integration_ModelNameField tests migration using new model_name field +func TestMigration_Integration_ModelNameField(t *testing.T) { + tmpDir := t.TempDir() + configPath := filepath.Join(tmpDir, "config.json") + + // Legacy config using the new model_name field + legacyConfig := `{ + "agents": { + "defaults": { + "provider": "deepseek", + "model_name": "deepseek-reasoner", + "model_fallbacks": ["deepseek-chat"] + } + }, + "channels": { + "telegram": {"enabled": false} + }, + "gateway": { + "host": "127.0.0.1", + "port": 18790 + }, + "tools": { + "web": {"enabled": true} + }, + "heartbeat": { + "enabled": true, + "interval": 30 + }, + "devices": { + "enabled": false + } + }` + + if err := os.WriteFile(configPath, []byte(legacyConfig), 0o600); err != nil { + t.Fatalf("Failed to write legacy config: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig failed: %v", err) + } + + // model_name field should be preserved + if cfg.Agents.Defaults.ModelName != "deepseek-reasoner" { + t.Errorf("ModelName = %q, want %q", cfg.Agents.Defaults.ModelName, "deepseek-reasoner") + } + + // GetModelName() should return model_name, not model (deprecated) + if cfg.Agents.Defaults.GetModelName() != "deepseek-reasoner" { + t.Errorf("GetModelName() = %q, want %q", cfg.Agents.Defaults.GetModelName(), "deepseek-reasoner") + } + + if len(cfg.Agents.Defaults.ModelFallbacks) != 1 { + t.Errorf("len(ModelFallbacks) = %d, want 1", len(cfg.Agents.Defaults.ModelFallbacks)) + } else if cfg.Agents.Defaults.ModelFallbacks[0] != "deepseek-chat" { + t.Errorf("ModelFallbacks[0] = %q, want %q", cfg.Agents.Defaults.ModelFallbacks[0], "deepseek-chat") + } +} From 56fb0dc4e3bbe0801490503e40992cc8cbd0c770 Mon Sep 17 00:00:00 2001 From: Eric Jacksch Date: Thu, 12 Mar 2026 21:42:34 -0400 Subject: [PATCH 004/234] fix(claude_cli): surface stdout in error when CLI exits non-zero When the claude CLI exits with a non-zero status, the previous error handler only checked stderr. However, the CLI writes its output (including error details) to stdout, especially when invoked with --output-format json. This left the caller with only "exit status 1" and no actionable information. Now includes both stderr and stdout in the error message so the actual failure reason is visible in logs. Co-Authored-By: Claude Sonnet 4.6 --- pkg/providers/claude_cli_provider.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/pkg/providers/claude_cli_provider.go b/pkg/providers/claude_cli_provider.go index 6c4f6a767..40b581490 100644 --- a/pkg/providers/claude_cli_provider.go +++ b/pkg/providers/claude_cli_provider.go @@ -50,10 +50,18 @@ func (p *ClaudeCliProvider) Chat( cmd.Stderr = &stderr if err := cmd.Run(); err != nil { - if stderrStr := stderr.String(); stderrStr != "" { + stderrStr := strings.TrimSpace(stderr.String()) + stdoutStr := strings.TrimSpace(stdout.String()) + switch { + case stderrStr != "" && stdoutStr != "": + return nil, fmt.Errorf("claude cli error: %w\nstderr: %s\nstdout: %s", err, stderrStr, stdoutStr) + case stderrStr != "": return nil, fmt.Errorf("claude cli error: %s", stderrStr) + case stdoutStr != "": + return nil, fmt.Errorf("claude cli error: %w\noutput: %s", err, stdoutStr) + default: + return nil, fmt.Errorf("claude cli error: %w", err) } - return nil, fmt.Errorf("claude cli error: %w", err) } return p.parseClaudeCliResponse(stdout.String()) From b9aaad95cd1770deeb7a78d9d137fc807c12a365 Mon Sep 17 00:00:00 2001 From: Hoshina Date: Sat, 14 Mar 2026 12:01:47 +0800 Subject: [PATCH 005/234] refactor(media): centralize temp media dir path --- pkg/channels/feishu/feishu_64.go | 2 +- pkg/channels/matrix/matrix.go | 4 +--- pkg/channels/matrix/matrix_test.go | 3 ++- pkg/media/tempdir.go | 13 +++++++++++++ pkg/utils/media.go | 3 ++- 5 files changed, 19 insertions(+), 6 deletions(-) create mode 100644 pkg/media/tempdir.go diff --git a/pkg/channels/feishu/feishu_64.go b/pkg/channels/feishu/feishu_64.go index 5dbbcf0af..9c462e41e 100644 --- a/pkg/channels/feishu/feishu_64.go +++ b/pkg/channels/feishu/feishu_64.go @@ -618,7 +618,7 @@ func (c *FeishuChannel) downloadResource( } // Write to the shared picoclaw_media directory using a unique name to avoid collisions. - mediaDir := filepath.Join(os.TempDir(), "picoclaw_media") + mediaDir := media.TempDir() if mkdirErr := os.MkdirAll(mediaDir, 0o700); mkdirErr != nil { logger.ErrorCF("feishu", "Failed to create media directory", map[string]any{ "error": mkdirErr.Error(), diff --git a/pkg/channels/matrix/matrix.go b/pkg/channels/matrix/matrix.go index bec5dfdac..4cbe95c5c 100644 --- a/pkg/channels/matrix/matrix.go +++ b/pkg/channels/matrix/matrix.go @@ -35,8 +35,6 @@ const ( roomKindCacheTTL = 5 * time.Minute roomKindCacheCleanupPeriod = 1 * time.Minute roomKindCacheMaxEntries = 2048 - - matrixMediaTempDirName = "picoclaw_media" ) var matrixMentionHrefRegexp = regexp.MustCompile(`(?i)]+href=["']([^"']+)["']`) @@ -1105,7 +1103,7 @@ func (c *MatrixChannel) stripSelfMention(text string) string { } func matrixMediaTempDir() (string, error) { - mediaDir := filepath.Join(os.TempDir(), matrixMediaTempDirName) + mediaDir := media.TempDir() if err := os.MkdirAll(mediaDir, 0o700); err != nil { return "", err } diff --git a/pkg/channels/matrix/matrix_test.go b/pkg/channels/matrix/matrix_test.go index 07a35c021..7484c8d87 100644 --- a/pkg/channels/matrix/matrix_test.go +++ b/pkg/channels/matrix/matrix_test.go @@ -15,6 +15,7 @@ import ( "maunium.net/go/mautrix/id" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/media" ) func TestMatrixLocalpartMentionRegexp(t *testing.T) { @@ -165,7 +166,7 @@ func TestMatrixMediaTempDir(t *testing.T) { if err != nil { t.Fatalf("matrixMediaTempDir failed: %v", err) } - if filepath.Base(dir) != matrixMediaTempDirName { + if filepath.Base(dir) != media.TempDirName { t.Fatalf("unexpected media dir base: %q", filepath.Base(dir)) } diff --git a/pkg/media/tempdir.go b/pkg/media/tempdir.go new file mode 100644 index 000000000..45942b34f --- /dev/null +++ b/pkg/media/tempdir.go @@ -0,0 +1,13 @@ +package media + +import ( + "os" + "path/filepath" +) + +const TempDirName = "picoclaw_media" + +// TempDir returns the shared temporary directory used for downloaded media. +func TempDir() string { + return filepath.Join(os.TempDir(), TempDirName) +} diff --git a/pkg/utils/media.go b/pkg/utils/media.go index 3e1c5d88e..82e9f5f45 100644 --- a/pkg/utils/media.go +++ b/pkg/utils/media.go @@ -12,6 +12,7 @@ import ( "github.com/google/uuid" "github.com/sipeed/picoclaw/pkg/logger" + "github.com/sipeed/picoclaw/pkg/media" ) // IsAudioFile checks if a file is an audio file based on its filename extension and content type. @@ -67,7 +68,7 @@ func DownloadFile(urlStr, filename string, opts DownloadOptions) string { opts.LoggerPrefix = "utils" } - mediaDir := filepath.Join(os.TempDir(), "picoclaw_media") + mediaDir := media.TempDir() if err := os.MkdirAll(mediaDir, 0o700); err != nil { logger.ErrorCF(opts.LoggerPrefix, "Failed to create media directory", map[string]any{ "error": err.Error(), From 1bc05e83927ad0f914e96d6546a016f6fb9fbc6f Mon Sep 17 00:00:00 2001 From: Hoshina Date: Sat, 14 Mar 2026 12:02:06 +0800 Subject: [PATCH 006/234] fix(tools): allow sandbox access to temp media files --- pkg/agent/instance.go | 27 +++++++++++- pkg/agent/instance_test.go | 86 +++++++++++++++++++++++++++++++++++++ pkg/agent/loop.go | 3 ++ pkg/tools/filesystem.go | 48 ++++++++++++++++++--- pkg/tools/send_file.go | 17 +++++++- pkg/tools/send_file_test.go | 39 +++++++++++++++++ pkg/tools/shell.go | 44 +++++++++++++------ 7 files changed, 241 insertions(+), 23 deletions(-) diff --git a/pkg/agent/instance.go b/pkg/agent/instance.go index 0c7baa1ee..1c3635322 100644 --- a/pkg/agent/instance.go +++ b/pkg/agent/instance.go @@ -10,6 +10,7 @@ import ( "strings" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/media" "github.com/sipeed/picoclaw/pkg/memory" "github.com/sipeed/picoclaw/pkg/providers" "github.com/sipeed/picoclaw/pkg/routing" @@ -66,7 +67,7 @@ func NewAgentInstance( readRestrict := restrict && !defaults.AllowReadOutsideWorkspace // Compile path whitelist patterns from config. - allowReadPaths := compilePatterns(cfg.Tools.AllowReadPaths) + allowReadPaths := buildAllowReadPatterns(cfg) allowWritePaths := compilePatterns(cfg.Tools.AllowWritePaths) toolsRegistry := tools.NewToolRegistry() @@ -82,7 +83,7 @@ func NewAgentInstance( toolsRegistry.Register(tools.NewListDirTool(workspace, readRestrict, allowReadPaths)) } if cfg.Tools.IsToolEnabled("exec") { - execTool, err := tools.NewExecToolWithConfig(workspace, restrict, cfg) + execTool, err := tools.NewExecToolWithConfig(workspace, restrict, cfg, allowReadPaths) if err != nil { log.Fatalf("Critical error: unable to initialize exec tool: %v", err) } @@ -282,6 +283,28 @@ func compilePatterns(patterns []string) []*regexp.Regexp { return compiled } +func buildAllowReadPatterns(cfg *config.Config) []*regexp.Regexp { + var configured []string + if cfg != nil { + configured = cfg.Tools.AllowReadPaths + } + + compiled := compilePatterns(configured) + mediaDirPattern := regexp.MustCompile(mediaTempDirPattern()) + for _, pattern := range compiled { + if pattern.String() == mediaDirPattern.String() { + return compiled + } + } + + return append(compiled, mediaDirPattern) +} + +func mediaTempDirPattern() string { + sep := regexp.QuoteMeta(string(os.PathSeparator)) + return "^" + regexp.QuoteMeta(filepath.Clean(media.TempDir())) + "(?:" + sep + "|$)" +} + // Close releases resources held by the agent's session store. func (a *AgentInstance) Close() error { if a.Sessions != nil { diff --git a/pkg/agent/instance_test.go b/pkg/agent/instance_test.go index 4f41ecd1c..f8057bb2f 100644 --- a/pkg/agent/instance_test.go +++ b/pkg/agent/instance_test.go @@ -1,10 +1,14 @@ package agent import ( + "context" "os" + "path/filepath" + "strings" "testing" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/media" ) func TestNewAgentInstance_UsesDefaultsTemperatureAndMaxTokens(t *testing.T) { @@ -160,3 +164,85 @@ func TestNewAgentInstance_ResolveCandidatesFromModelListAlias(t *testing.T) { }) } } + +func TestNewAgentInstance_AllowsMediaTempDirForReadListAndExec(t *testing.T) { + workspace := t.TempDir() + mediaDir := media.TempDir() + if err := os.MkdirAll(mediaDir, 0o700); err != nil { + t.Fatalf("MkdirAll(mediaDir) error = %v", err) + } + + mediaFile, err := os.CreateTemp(mediaDir, "instance-tool-*.txt") + if err != nil { + t.Fatalf("CreateTemp(mediaDir) error = %v", err) + } + mediaPath := mediaFile.Name() + if _, err := mediaFile.WriteString("attachment content"); err != nil { + mediaFile.Close() + t.Fatalf("WriteString(mediaFile) error = %v", err) + } + if err := mediaFile.Close(); err != nil { + t.Fatalf("Close(mediaFile) error = %v", err) + } + t.Cleanup(func() { _ = os.Remove(mediaPath) }) + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: workspace, + Model: "test-model", + RestrictToWorkspace: true, + }, + }, + Tools: config.ToolsConfig{ + ReadFile: config.ReadFileToolConfig{Enabled: true}, + ListDir: config.ToolConfig{Enabled: true}, + Exec: config.ExecConfig{ + ToolConfig: config.ToolConfig{Enabled: true}, + EnableDenyPatterns: true, + AllowRemote: true, + }, + }, + } + + agent := NewAgentInstance(nil, &cfg.Agents.Defaults, cfg, &mockProvider{}) + + readTool, ok := agent.Tools.Get("read_file") + if !ok { + t.Fatal("read_file tool not registered") + } + readResult := readTool.Execute(context.Background(), map[string]any{"path": mediaPath}) + if readResult.IsError { + t.Fatalf("read_file should allow media temp dir, got: %s", readResult.ForLLM) + } + if !strings.Contains(readResult.ForLLM, "attachment content") { + t.Fatalf("read_file output missing media content: %s", readResult.ForLLM) + } + + listTool, ok := agent.Tools.Get("list_dir") + if !ok { + t.Fatal("list_dir tool not registered") + } + listResult := listTool.Execute(context.Background(), map[string]any{"path": mediaDir}) + if listResult.IsError { + t.Fatalf("list_dir should allow media temp dir, got: %s", listResult.ForLLM) + } + if !strings.Contains(listResult.ForLLM, filepath.Base(mediaPath)) { + t.Fatalf("list_dir output missing media file: %s", listResult.ForLLM) + } + + execTool, ok := agent.Tools.Get("exec") + if !ok { + t.Fatal("exec tool not registered") + } + execResult := execTool.Execute(context.Background(), map[string]any{ + "command": "cat " + filepath.Base(mediaPath), + "working_dir": mediaDir, + }) + if execResult.IsError { + t.Fatalf("exec should allow media temp dir, got: %s", execResult.ForLLM) + } + if !strings.Contains(execResult.ForLLM, "attachment content") { + t.Fatalf("exec output missing media content: %s", execResult.ForLLM) + } +} diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index dfa339dee..8a0303b50 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -117,6 +117,8 @@ func registerSharedTools( registry *AgentRegistry, provider providers.LLMProvider, ) { + allowReadPaths := buildAllowReadPatterns(cfg) + for _, agentID := range registry.ListAgentIDs() { agent, ok := registry.GetAgent(agentID) if !ok { @@ -195,6 +197,7 @@ func registerSharedTools( cfg.Agents.Defaults.RestrictToWorkspace, cfg.Agents.Defaults.GetMaxMediaSize(), nil, + allowReadPaths, ) agent.Tools.Register(sendFileTool) } diff --git a/pkg/tools/filesystem.go b/pkg/tools/filesystem.go index 6b1cb1475..21385b01b 100644 --- a/pkg/tools/filesystem.go +++ b/pkg/tools/filesystem.go @@ -22,6 +22,10 @@ const MaxReadFileSize = 64 * 1024 // 64KB limit to avoid context overflow // validatePath ensures the given path is within the workspace if restrict is true. func validatePath(path, workspace string, restrict bool) (string, error) { + return validatePathWithAllowPaths(path, workspace, restrict, nil) +} + +func validatePathWithAllowPaths(path, workspace string, restrict bool, patterns []*regexp.Regexp) (string, error) { if workspace == "" { return path, fmt.Errorf("workspace is not defined") } @@ -42,6 +46,10 @@ func validatePath(path, workspace string, restrict bool) (string, error) { } if restrict { + if isAllowedPath(absPath, patterns) { + return absPath, nil + } + if !isWithinWorkspace(absPath, absWorkspace) { return "", fmt.Errorf("access denied: path is outside the workspace") } @@ -73,6 +81,39 @@ func validatePath(path, workspace string, restrict bool) (string, error) { return absPath, nil } +func isAllowedPath(path string, patterns []*regexp.Regexp) bool { + if len(patterns) == 0 { + return false + } + + cleaned := filepath.Clean(path) + if !matchesAllowedPath(cleaned, patterns) { + return false + } + + resolved, err := filepath.EvalSymlinks(cleaned) + if err == nil { + return matchesAllowedPath(resolved, patterns) + } + if os.IsNotExist(err) { + parentResolved, parentErr := resolveExistingAncestor(filepath.Dir(cleaned)) + if parentErr == nil { + return matchesAllowedPath(parentResolved, patterns) + } + } + + return false +} + +func matchesAllowedPath(path string, patterns []*regexp.Regexp) bool { + for _, pattern := range patterns { + if pattern.MatchString(path) { + return true + } + } + return false +} + func resolveExistingAncestor(path string) (string, error) { for current := filepath.Clean(path); ; current = filepath.Dir(current) { if resolved, err := filepath.EvalSymlinks(current); err == nil { @@ -625,12 +666,7 @@ type whitelistFs struct { } func (w *whitelistFs) matches(path string) bool { - for _, p := range w.patterns { - if p.MatchString(path) { - return true - } - } - return false + return matchesAllowedPath(path, w.patterns) } func (w *whitelistFs) ReadFile(path string) ([]byte, error) { diff --git a/pkg/tools/send_file.go b/pkg/tools/send_file.go index 1a03e58ed..a67bd4210 100644 --- a/pkg/tools/send_file.go +++ b/pkg/tools/send_file.go @@ -6,6 +6,7 @@ import ( "mime" "os" "path/filepath" + "regexp" "strings" "github.com/h2non/filetype" @@ -21,20 +22,32 @@ type SendFileTool struct { restrict bool maxFileSize int mediaStore media.MediaStore + allowPaths []*regexp.Regexp defaultChannel string defaultChatID string } -func NewSendFileTool(workspace string, restrict bool, maxFileSize int, store media.MediaStore) *SendFileTool { +func NewSendFileTool( + workspace string, + restrict bool, + maxFileSize int, + store media.MediaStore, + allowPaths ...[]*regexp.Regexp, +) *SendFileTool { if maxFileSize <= 0 { maxFileSize = config.DefaultMaxMediaSize } + var patterns []*regexp.Regexp + if len(allowPaths) > 0 { + patterns = allowPaths[0] + } return &SendFileTool{ workspace: workspace, restrict: restrict, maxFileSize: maxFileSize, mediaStore: store, + allowPaths: patterns, } } @@ -92,7 +105,7 @@ func (t *SendFileTool) Execute(ctx context.Context, args map[string]any) *ToolRe return ErrorResult("media store not configured") } - resolved, err := validatePath(path, t.workspace, t.restrict) + resolved, err := validatePathWithAllowPaths(path, t.workspace, t.restrict, t.allowPaths) if err != nil { return ErrorResult(fmt.Sprintf("invalid path: %v", err)) } diff --git a/pkg/tools/send_file_test.go b/pkg/tools/send_file_test.go index 08d129674..6daaab31c 100644 --- a/pkg/tools/send_file_test.go +++ b/pkg/tools/send_file_test.go @@ -4,6 +4,7 @@ import ( "context" "os" "path/filepath" + "regexp" "strings" "testing" @@ -128,6 +129,44 @@ func TestSendFileTool_CustomFilename(t *testing.T) { } } +func TestSendFileTool_AllowsWhitelistedMediaTempPath(t *testing.T) { + workspace := t.TempDir() + mediaDir := media.TempDir() + if err := os.MkdirAll(mediaDir, 0o700); err != nil { + t.Fatalf("MkdirAll(mediaDir) error = %v", err) + } + + testFile, err := os.CreateTemp(mediaDir, "send-file-*.txt") + if err != nil { + t.Fatalf("CreateTemp(mediaDir) error = %v", err) + } + testPath := testFile.Name() + if _, err := testFile.WriteString("forward me"); err != nil { + testFile.Close() + t.Fatalf("WriteString(testFile) error = %v", err) + } + if err := testFile.Close(); err != nil { + t.Fatalf("Close(testFile) error = %v", err) + } + t.Cleanup(func() { _ = os.Remove(testPath) }) + + pattern := regexp.MustCompile( + "^" + regexp.QuoteMeta(filepath.Clean(mediaDir)) + "(?:" + regexp.QuoteMeta(string(os.PathSeparator)) + "|$)", + ) + + store := media.NewFileMediaStore() + tool := NewSendFileTool(workspace, true, 0, store, []*regexp.Regexp{pattern}) + tool.SetContext("feishu", "chat123") + + result := tool.Execute(context.Background(), map[string]any{"path": testPath}) + if result.IsError { + t.Fatalf("expected whitelisted temp media file to be sendable, got: %s", result.ForLLM) + } + if len(result.Media) != 1 { + t.Fatalf("expected 1 media ref, got %d", len(result.Media)) + } +} + func TestDetectMediaType_MagicBytes(t *testing.T) { dir := t.TempDir() diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go index 9ea05bb12..0dc85ae21 100644 --- a/pkg/tools/shell.go +++ b/pkg/tools/shell.go @@ -23,6 +23,7 @@ type ExecTool struct { denyPatterns []*regexp.Regexp allowPatterns []*regexp.Regexp customAllowPatterns []*regexp.Regexp + allowedPathPatterns []*regexp.Regexp restrictToWorkspace bool allowRemote bool } @@ -95,14 +96,23 @@ var ( } ) -func NewExecTool(workingDir string, restrict bool) (*ExecTool, error) { - return NewExecToolWithConfig(workingDir, restrict, nil) +func NewExecTool(workingDir string, restrict bool, allowPaths ...[]*regexp.Regexp) (*ExecTool, error) { + return NewExecToolWithConfig(workingDir, restrict, nil, allowPaths...) } -func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Config) (*ExecTool, error) { +func NewExecToolWithConfig( + workingDir string, + restrict bool, + config *config.Config, + allowPaths ...[]*regexp.Regexp, +) (*ExecTool, error) { denyPatterns := make([]*regexp.Regexp, 0) customAllowPatterns := make([]*regexp.Regexp, 0) + var allowedPathPatterns []*regexp.Regexp allowRemote := true + if len(allowPaths) > 0 { + allowedPathPatterns = allowPaths[0] + } if config != nil { execConfig := config.Tools.Exec @@ -146,6 +156,7 @@ func NewExecToolWithConfig(workingDir string, restrict bool, config *config.Conf denyPatterns: denyPatterns, allowPatterns: nil, customAllowPatterns: customAllowPatterns, + allowedPathPatterns: allowedPathPatterns, restrictToWorkspace: restrict, allowRemote: allowRemote, }, nil @@ -198,7 +209,7 @@ func (t *ExecTool) Execute(ctx context.Context, args map[string]any) *ToolResult cwd := t.workingDir if wd, ok := args["working_dir"].(string); ok && wd != "" { if t.restrictToWorkspace && t.workingDir != "" { - resolvedWD, err := validatePath(wd, t.workingDir, true) + resolvedWD, err := validatePathWithAllowPaths(wd, t.workingDir, true, t.allowedPathPatterns) if err != nil { return ErrorResult("Command blocked by safety guard (" + err.Error() + ")") } @@ -226,16 +237,20 @@ func (t *ExecTool) Execute(ctx context.Context, args map[string]any) *ToolResult if err != nil { return ErrorResult(fmt.Sprintf("Command blocked by safety guard (path resolution failed: %v)", err)) } - absWorkspace, _ := filepath.Abs(t.workingDir) - wsResolved, _ := filepath.EvalSymlinks(absWorkspace) - if wsResolved == "" { - wsResolved = absWorkspace + if isAllowedPath(resolved, t.allowedPathPatterns) { + cwd = resolved + } else { + absWorkspace, _ := filepath.Abs(t.workingDir) + wsResolved, _ := filepath.EvalSymlinks(absWorkspace) + if wsResolved == "" { + wsResolved = absWorkspace + } + rel, err := filepath.Rel(wsResolved, resolved) + if err != nil || !filepath.IsLocal(rel) { + return ErrorResult("Command blocked by safety guard (working directory escaped workspace)") + } + cwd = resolved } - rel, err := filepath.Rel(wsResolved, resolved) - if err != nil || !filepath.IsLocal(rel) { - return ErrorResult("Command blocked by safety guard (working directory escaped workspace)") - } - cwd = resolved } // timeout == 0 means no timeout @@ -412,6 +427,9 @@ func (t *ExecTool) guardCommand(command, cwd string) string { if safePaths[p] { continue } + if isAllowedPath(p, t.allowedPathPatterns) { + continue + } rel, err := filepath.Rel(cwdPath, p) if err != nil { From 345452fba840d1839e82bab58f9e8894c4844abe Mon Sep 17 00:00:00 2001 From: Hoshina Date: Sat, 14 Mar 2026 12:08:11 +0800 Subject: [PATCH 007/234] refactor(tools): remove unused validatePath wrapper --- pkg/tools/filesystem.go | 5 ----- 1 file changed, 5 deletions(-) diff --git a/pkg/tools/filesystem.go b/pkg/tools/filesystem.go index 21385b01b..d25ec1254 100644 --- a/pkg/tools/filesystem.go +++ b/pkg/tools/filesystem.go @@ -20,11 +20,6 @@ import ( const MaxReadFileSize = 64 * 1024 // 64KB limit to avoid context overflow -// validatePath ensures the given path is within the workspace if restrict is true. -func validatePath(path, workspace string, restrict bool) (string, error) { - return validatePathWithAllowPaths(path, workspace, restrict, nil) -} - func validatePathWithAllowPaths(path, workspace string, restrict bool, patterns []*regexp.Regexp) (string, error) { if workspace == "" { return path, fmt.Errorf("workspace is not defined") From bb1a4145274c78e1b8267af89a1816cd7b0107f5 Mon Sep 17 00:00:00 2001 From: Hoshina Date: Sat, 14 Mar 2026 19:58:23 +0800 Subject: [PATCH 008/234] fix(tools): harden whitelist path resolution --- pkg/tools/filesystem.go | 42 +++++++++++++++++++++++-------- pkg/tools/filesystem_test.go | 49 ++++++++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+), 11 deletions(-) diff --git a/pkg/tools/filesystem.go b/pkg/tools/filesystem.go index d25ec1254..92946ef98 100644 --- a/pkg/tools/filesystem.go +++ b/pkg/tools/filesystem.go @@ -82,22 +82,19 @@ func isAllowedPath(path string, patterns []*regexp.Regexp) bool { } cleaned := filepath.Clean(path) + if !filepath.IsAbs(cleaned) { + return false + } if !matchesAllowedPath(cleaned, patterns) { return false } - resolved, err := filepath.EvalSymlinks(cleaned) - if err == nil { - return matchesAllowedPath(resolved, patterns) - } - if os.IsNotExist(err) { - parentResolved, parentErr := resolveExistingAncestor(filepath.Dir(cleaned)) - if parentErr == nil { - return matchesAllowedPath(parentResolved, patterns) - } + resolved, err := resolvePathAgainstExistingAncestor(cleaned) + if err != nil { + return false } - return false + return matchesAllowedPath(resolved, patterns) } func matchesAllowedPath(path string, patterns []*regexp.Regexp) bool { @@ -122,6 +119,29 @@ func resolveExistingAncestor(path string) (string, error) { } } +func resolvePathAgainstExistingAncestor(path string) (string, error) { + cleaned := filepath.Clean(path) + for current := cleaned; ; current = filepath.Dir(current) { + resolved, err := filepath.EvalSymlinks(current) + if err == nil { + suffix, relErr := filepath.Rel(current, cleaned) + if relErr != nil { + return "", relErr + } + if suffix == "." { + return filepath.Clean(resolved), nil + } + return filepath.Clean(filepath.Join(resolved, suffix)), nil + } + if !os.IsNotExist(err) { + return "", err + } + if filepath.Dir(current) == current { + return "", os.ErrNotExist + } + } +} + func isWithinWorkspace(candidate, workspace string) bool { rel, err := filepath.Rel(filepath.Clean(workspace), filepath.Clean(candidate)) return err == nil && filepath.IsLocal(rel) @@ -661,7 +681,7 @@ type whitelistFs struct { } func (w *whitelistFs) matches(path string) bool { - return matchesAllowedPath(path, w.patterns) + return isAllowedPath(path, w.patterns) } func (w *whitelistFs) ReadFile(path string) ([]byte, error) { diff --git a/pkg/tools/filesystem_test.go b/pkg/tools/filesystem_test.go index 0bbf6caf0..78d69273f 100644 --- a/pkg/tools/filesystem_test.go +++ b/pkg/tools/filesystem_test.go @@ -521,6 +521,55 @@ func TestWhitelistFs_AllowsMatchingPaths(t *testing.T) { } } +func TestWhitelistFs_BlocksSymlinkEscapeInAllowedDir(t *testing.T) { + workspace := t.TempDir() + allowedDir := t.TempDir() + secretDir := t.TempDir() + secretFile := filepath.Join(secretDir, "secret.txt") + if err := os.WriteFile(secretFile, []byte("top secret"), 0o644); err != nil { + t.Fatalf("WriteFile(secretFile) error = %v", err) + } + + linkPath := filepath.Join(allowedDir, "link_out") + if err := os.Symlink(secretDir, linkPath); err != nil { + t.Skipf("symlink not supported in this environment: %v", err) + } + + patterns := []*regexp.Regexp{regexp.MustCompile(`^` + regexp.QuoteMeta(allowedDir))} + tool := NewReadFileTool(workspace, true, MaxReadFileSize, patterns) + + result := tool.Execute(context.Background(), map[string]any{"path": filepath.Join(linkPath, "secret.txt")}) + if !result.IsError { + t.Fatalf("expected symlink escape from allowed dir to be blocked, got: %s", result.ForLLM) + } +} + +func TestWhitelistFs_WriteAllowsNewFileUnderAllowedDir(t *testing.T) { + workspace := t.TempDir() + rootDir := t.TempDir() + allowedDir := filepath.Join(rootDir, "allowed") + targetFile := filepath.Join(allowedDir, "nested", "file.txt") + + patterns := []*regexp.Regexp{regexp.MustCompile(`^` + regexp.QuoteMeta(allowedDir))} + tool := NewWriteFileTool(workspace, true, patterns) + + result := tool.Execute(context.Background(), map[string]any{ + "path": targetFile, + "content": "outside write", + }) + if result.IsError { + t.Fatalf("expected whitelisted write to succeed, got: %s", result.ForLLM) + } + + data, err := os.ReadFile(targetFile) + if err != nil { + t.Fatalf("ReadFile(targetFile) error = %v", err) + } + if string(data) != "outside write" { + t.Fatalf("target file content = %q, want %q", string(data), "outside write") + } +} + // TestReadFileTool_ChunkedReading verifies the pagination logic of the tool // by reading a file in multiple chunks using 'offset' and 'length'. func TestReadFileTool_ChunkedReading(t *testing.T) { From f71eaaf7f8d8189319453314c157d3ab969798a4 Mon Sep 17 00:00:00 2001 From: Hoshina Date: Sat, 14 Mar 2026 21:03:23 +0800 Subject: [PATCH 009/234] fix(cron): default scheduled jobs to agent execution --- pkg/tools/cron.go | 6 +++--- pkg/tools/cron_test.go | 22 ++++++++++++++++++++++ 2 files changed, 25 insertions(+), 3 deletions(-) diff --git a/pkg/tools/cron.go b/pkg/tools/cron.go index 648cc3c6c..25608a54c 100644 --- a/pkg/tools/cron.go +++ b/pkg/tools/cron.go @@ -96,7 +96,7 @@ func (t *CronTool) Parameters() map[string]any { }, "deliver": map[string]any{ "type": "boolean", - "description": "If true, send message directly to channel. If false, let agent process message (for complex tasks). Default: true", + "description": "If true, send message directly to channel. If false, let agent process message (for complex tasks). Default: false", }, }, "required": []string{"action"}, @@ -174,8 +174,8 @@ func (t *CronTool) addJob(ctx context.Context, args map[string]any) *ToolResult return ErrorResult("one of at_seconds, every_seconds, or cron_expr is required") } - // Read deliver parameter, default to true - deliver := true + // Read deliver parameter, default to false so scheduled tasks execute through the agent + deliver := false if d, ok := args["deliver"].(bool); ok { deliver = d } diff --git a/pkg/tools/cron_test.go b/pkg/tools/cron_test.go index 1776abc65..f1e857949 100644 --- a/pkg/tools/cron_test.go +++ b/pkg/tools/cron_test.go @@ -114,3 +114,25 @@ func TestCronTool_NonCommandJobAllowedFromRemoteChannel(t *testing.T) { t.Fatalf("expected non-command reminder to succeed from remote channel, got: %s", result.ForLLM) } } + +func TestCronTool_NonCommandJobDefaultsDeliverToFalse(t *testing.T) { + tool := newTestCronTool(t) + ctx := WithToolContext(context.Background(), "telegram", "chat-1") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "send me a poem", + "at_seconds": float64(600), + }) + + if result.IsError { + t.Fatalf("expected non-command reminder to succeed, got: %s", result.ForLLM) + } + + jobs := tool.cronService.ListJobs(false) + if len(jobs) != 1 { + t.Fatalf("expected 1 job, got %d", len(jobs)) + } + if jobs[0].Payload.Deliver { + t.Fatal("expected deliver=false by default for non-command jobs") + } +} From 5660b8f24b0bad7085b718e1c36868a534ca143c Mon Sep 17 00:00:00 2001 From: duomi Date: Sun, 15 Mar 2026 21:58:12 +0800 Subject: [PATCH 010/234] fix(heartbeat): ignore untouched default template --- pkg/heartbeat/service.go | 29 +++++++++++++++++++++- pkg/heartbeat/service_test.go | 45 +++++++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+), 1 deletion(-) diff --git a/pkg/heartbeat/service.go b/pkg/heartbeat/service.go index 09c93fc6b..5dda78ea9 100644 --- a/pkg/heartbeat/service.go +++ b/pkg/heartbeat/service.go @@ -26,6 +26,7 @@ import ( const ( minIntervalMinutes = 5 defaultIntervalMinutes = 30 + userTasksMarker = "Add your heartbeat tasks below this line:" ) // HeartbeatHandler is the function type for handling heartbeat. @@ -232,7 +233,7 @@ func (hs *HeartbeatService) buildPrompt() string { } content := string(data) - if len(content) == 0 { + if !heartbeatHasUserTasks(content) { return "" } @@ -284,6 +285,32 @@ Add your heartbeat tasks below this line: } } +func heartbeatHasUserTasks(content string) bool { + trimmed := strings.TrimSpace(content) + if trimmed == "" { + return false + } + + markerIdx := strings.Index(content, userTasksMarker) + if markerIdx < 0 { + return true + } + + tasksSection := content[markerIdx+len(userTasksMarker):] + for _, line := range strings.Split(tasksSection, "\n") { + trimmedLine := strings.TrimSpace(line) + if trimmedLine == "" { + continue + } + if strings.HasPrefix(trimmedLine, "#") { + continue + } + return true + } + + return false +} + // sendResponse sends the heartbeat response to the last channel func (hs *HeartbeatService) sendResponse(response string) { hs.mu.RLock() diff --git a/pkg/heartbeat/service_test.go b/pkg/heartbeat/service_test.go index 3b7eeeefb..309b4378f 100644 --- a/pkg/heartbeat/service_test.go +++ b/pkg/heartbeat/service_test.go @@ -3,6 +3,7 @@ package heartbeat import ( "os" "path/filepath" + "strings" "testing" "time" @@ -203,3 +204,47 @@ func TestHeartbeatFilePath(t *testing.T) { t.Errorf("Expected HEARTBEAT.md at %s, but it doesn't exist", expectedPath) } } + +func TestBuildPrompt_DefaultTemplateStaysIdle(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "heartbeat-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + hs := NewHeartbeatService(tmpDir, 30, true) + hs.createDefaultHeartbeatTemplate() + + if prompt := hs.buildPrompt(); prompt != "" { + t.Fatalf("buildPrompt() = %q, want empty prompt for untouched default template", prompt) + } +} + +func TestBuildPrompt_UserTasksAfterMarkerProducePrompt(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "heartbeat-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + hs := NewHeartbeatService(tmpDir, 30, true) + hs.createDefaultHeartbeatTemplate() + + path := filepath.Join(tmpDir, "HEARTBEAT.md") + data, err := os.ReadFile(path) + if err != nil { + t.Fatalf("Failed to read HEARTBEAT.md: %v", err) + } + updated := string(data) + "\n- Check unread Feishu messages\n" + if err := os.WriteFile(path, []byte(updated), 0o644); err != nil { + t.Fatalf("Failed to update HEARTBEAT.md: %v", err) + } + + prompt := hs.buildPrompt() + if prompt == "" { + t.Fatal("buildPrompt() = empty, want non-empty prompt when user tasks are present") + } + if !strings.Contains(prompt, "Check unread Feishu messages") { + t.Fatalf("prompt = %q, want user task content", prompt) + } +} From 021aa7d6d534f18572c94671c019a62e4ec1ceb0 Mon Sep 17 00:00:00 2001 From: Mauro Date: Sun, 15 Mar 2026 17:08:16 +0100 Subject: [PATCH 011/234] feat(agent): steering (#1517) * feat(agent): steering * fix loop * fix lint * fix lint --- docs/design/steering-spec.md | 306 ++++++++++++++ docs/steering.md | 166 ++++++++ pkg/agent/loop.go | 285 +++++++++----- pkg/agent/steering.go | 188 +++++++++ pkg/agent/steering_test.go | 744 +++++++++++++++++++++++++++++++++++ pkg/config/config.go | 1 + pkg/config/defaults.go | 1 + 7 files changed, 1589 insertions(+), 102 deletions(-) create mode 100644 docs/design/steering-spec.md create mode 100644 docs/steering.md create mode 100644 pkg/agent/steering.go create mode 100644 pkg/agent/steering_test.go diff --git a/docs/design/steering-spec.md b/docs/design/steering-spec.md new file mode 100644 index 000000000..0951bf864 --- /dev/null +++ b/docs/design/steering-spec.md @@ -0,0 +1,306 @@ +# Steering — Implementation Specification + +## Problem + +When the agent is running (executing a chain of tool calls), the user has no way to redirect it. They must wait for the full cycle to complete before sending a new message. This creates a poor experience when the agent takes a wrong direction — the user watches it waste time on tools that are no longer relevant. + +## Solution + +Steering introduces a **message queue** that external callers can push into at any time. The agent loop polls this queue at well-defined checkpoints. When a steering message is found, the agent: + +1. Stops executing further tools in the current batch +2. Injects the user's message into the conversation context +3. Calls the LLM again with the updated context + +The user's intent reaches the model **as soon as the current tool finishes**, not after the entire turn completes. + +## Architecture Overview + +```mermaid +graph TD + subgraph External Callers + TG[Telegram] + DC[Discord] + SL[Slack] + end + + subgraph AgentLoop + BUS[MessageBus] + DRAIN[drainBusToSteering goroutine] + SQ[steeringQueue] + RLI[runLLMIteration] + TE[Tool Execution Loop] + LLM[LLM Call] + end + + TG -->|PublishInbound| BUS + DC -->|PublishInbound| BUS + SL -->|PublishInbound| BUS + + BUS -->|ConsumeInbound while busy| DRAIN + DRAIN -->|Steer| SQ + + RLI -->|1. initial poll| SQ + TE -->|2. poll after each tool| SQ + + SQ -->|pendingMessages| RLI + RLI -->|inject into context| LLM +``` + +### Bus drain mechanism + +Channels (Telegram, Discord, etc.) publish messages to the `MessageBus` via `PublishInbound`. Without additional wiring, these messages would sit in the bus buffer until the current `processMessage` finishes — meaning steering would never work for real users. + +The solution: when `Run()` starts processing a message, it spawns a **drain goroutine** (`drainBusToSteering`) that keeps consuming from the bus and calling `Steer()`. When `processMessage` returns, the drain is canceled and normal consumption resumes. + +```mermaid +sequenceDiagram + participant Bus + participant Run + participant Drain + participant AgentLoop + + Run->>Bus: ConsumeInbound() → msg + Run->>Drain: spawn drainBusToSteering(ctx) + Run->>Run: processMessage(msg) + + Note over Drain: running concurrently + + Bus-->>Drain: ConsumeInbound() → newMsg + Drain->>AgentLoop: al.transcribeAudioInMessage(ctx, newMsg) + Drain->>AgentLoop: Steer(providers.Message{Content: newMsg.Content}) + + Run->>Run: processMessage returns + Run->>Drain: cancel context + Note over Drain: exits +``` + +## Data Structures + +### steeringQueue + +A thread-safe FIFO queue, private to the `agent` package. + +| Field | Type | Description | +|-------|------|-------------| +| `mu` | `sync.Mutex` | Protects all access to `queue` and `mode` | +| `queue` | `[]providers.Message` | Pending steering messages | +| `mode` | `SteeringMode` | Dequeue strategy | + +**Methods:** + +| Method | Description | +|--------|-------------| +| `push(msg) error` | Appends a message to the queue. Returns an error if the queue is full (`MaxQueueSize`) | +| `dequeue() []Message` | Removes and returns messages according to `mode`. Returns `nil` if empty | +| `len() int` | Returns the current queue length | +| `setMode(mode)` | Updates the dequeue strategy | +| `getMode() SteeringMode` | Returns the current mode | + +### SteeringMode + +| Value | Constant | Behavior | +|-------|----------|----------| +| `"one-at-a-time"` | `SteeringOneAtATime` | `dequeue()` returns only the **first** message. Remaining messages stay in the queue for subsequent polls. | +| `"all"` | `SteeringAll` | `dequeue()` drains the **entire** queue and returns all messages at once. | + +Default: `"one-at-a-time"`. + +### processOptions extension + +A new field was added to `processOptions`: + +| Field | Type | Description | +|-------|------|-------------| +| `SkipInitialSteeringPoll` | `bool` | When `true`, the initial steering poll at loop start is skipped. Used by `Continue()` to avoid double-dequeuing. | + +## Public API on AgentLoop + +| Method | Signature | Description | +|--------|-----------|-------------| +| `Steer` | `Steer(msg providers.Message) error` | Enqueues a steering message. Returns an error if the queue is full or not initialized. Thread-safe, can be called from any goroutine. | +| `SteeringMode` | `SteeringMode() SteeringMode` | Returns the current dequeue mode. | +| `SetSteeringMode` | `SetSteeringMode(mode SteeringMode)` | Changes the dequeue mode at runtime. | +| `Continue` | `Continue(ctx, sessionKey, channel, chatID) (string, error)` | Resumes an idle agent using pending steering messages. Returns `""` if queue is empty. | + +## Integration into the Agent Loop + +### Where steering is wired + +The steering queue lives as a field on `AgentLoop`: + +``` +AgentLoop + ├── bus + ├── cfg + ├── registry + ├── steering *steeringQueue ← new + ├── ... +``` + +It is initialized in `NewAgentLoop` from `cfg.Agents.Defaults.SteeringMode`. + +### Detailed flow through runLLMIteration + +```mermaid +sequenceDiagram + participant User + participant AgentLoop + participant runLLMIteration + participant ToolExecution + participant LLM + + User->>AgentLoop: Steer(message) + Note over AgentLoop: steeringQueue.push(message) + + Note over runLLMIteration: ── iteration starts ── + + runLLMIteration->>AgentLoop: dequeueSteeringMessages()
[initial poll] + AgentLoop-->>runLLMIteration: [] (empty, or messages) + + alt pendingMessages not empty + runLLMIteration->>runLLMIteration: inject into messages[]
save to session + end + + runLLMIteration->>LLM: Chat(messages, tools) + LLM-->>runLLMIteration: response with toolCalls[0..N] + + loop for each tool call (sequential) + ToolExecution->>ToolExecution: execute tool[i] + ToolExecution->>ToolExecution: process result,
append to messages[] + + ToolExecution->>AgentLoop: dequeueSteeringMessages() + AgentLoop-->>ToolExecution: steeringMessages + + alt steering found + opt remaining tools > 0 + Note over ToolExecution: Mark tool[i+1..N-1] as
"Skipped due to queued user message." + end + Note over ToolExecution: steeringAfterTools = steeringMessages + Note over ToolExecution: break out of tool loop + end + end + + alt steeringAfterTools not empty + ToolExecution-->>runLLMIteration: pendingMessages = steeringAfterTools + Note over runLLMIteration: next iteration will inject
these before calling LLM + end + + Note over runLLMIteration: ── loop back to iteration start ── +``` + +### Polling checkpoints + +| # | Location | When | Purpose | +|---|----------|------|---------| +| 1 | Top of `runLLMIteration`, before first LLM call | Once, at loop entry | Catch messages enqueued while the agent was still setting up context | +| 2 | After every tool completes (including the first and the last) | Immediately after each tool's result is processed | Interrupt the batch as early as possible — if steering is found and there are remaining tools, they are all skipped | + +### What happens to skipped tools + +When steering interrupts a tool batch after tool `[i]` completes, all tools from `[i+1]` to `[N-1]` are **not executed**. Instead, a tool result message is generated for each: + +```json +{ + "role": "tool", + "content": "Skipped due to queued user message.", + "tool_call_id": "" +} +``` + +These results are: +- Appended to the conversation `messages[]` +- Saved to the session via `AddFullMessage` + +This ensures the LLM knows which of its requested actions were not performed. + +### Loop condition change + +The iteration loop condition was changed from: + +```go +for iteration < agent.MaxIterations +``` + +to: + +```go +for iteration < agent.MaxIterations || len(pendingMessages) > 0 +``` + +This allows **one extra iteration** when steering arrives right at the max iteration boundary, ensuring the steering message is always processed. + +### Tool execution: parallel → sequential + +**Before steering:** all tool calls in a batch were executed in parallel using `sync.WaitGroup`. + +**After steering:** tool calls execute **sequentially**. This is required because steering must be polled between individual tool completions. A parallel execution model would not allow interrupting mid-batch. + +> **Trade-off:** This introduces latency when the LLM requests multiple independent tools in a single turn. In practice, most batches contain 1-2 tools, so the impact is minimal. The benefit of being able to interrupt outweighs the cost. + +### Why skip remaining tools (instead of letting them finish) + +Two strategies were considered when a steering message is detected mid-batch: + +1. **Skip remaining tools** (chosen) — stop executing, mark the rest as skipped, inject steering +2. **Finish all tools, then inject** — let everything run, append steering afterwards + +Strategy 2 was rejected for three reasons: + +**Irreversible side effects.** Tools can send emails, write files, spawn subagents, or call external APIs. If the user says "stop" or "change direction", those actions have already happened and cannot be undone. + +| Tool batch | Steering | Skip (1) | Finish (2) | +|---|---|---|---| +| `[search, send_email]` | "don't send it" | Email not sent | Email sent | +| `[query, write_file, spawn]` | "wrong database" | Only query runs | File + subagent wasted | +| `[fetch₁, fetch₂, fetch₃, write]` | topic change | 1 fetch | 3 fetches + write, all discarded | + +**Wasted latency.** Tools like web fetches and API calls take seconds each. In a 3-tool batch averaging 3-4s per tool, the user would wait 10+ seconds for work that gets thrown away. + +**The LLM retains full awareness.** Skipped tools receive an explicit `"Skipped due to queued user message."` result, so the model knows what was not done and can decide whether to re-execute with the new context or take a different path. + +## The Continue() method + +`Continue` handles the case where the agent is **idle** (its last message was from the assistant) and the user has enqueued steering messages in the meantime. + +```mermaid +flowchart TD + A[Continue called] --> B{dequeueSteeringMessages} + B -->|empty| C["return ('', nil)"] + B -->|messages found| D[Combine message contents] + D --> E["runAgentLoop with
SkipInitialSteeringPoll: true"] + E --> F[Return response] +``` + +**Why `SkipInitialSteeringPoll: true`?** Because `Continue` already dequeued the messages itself. Without this flag, `runLLMIteration` would poll again at the start and find nothing (the queue is already empty), or worse, double-process if new messages arrived in the meantime. + +## Configuration + +```json +{ + "agents": { + "defaults": { + "steering_mode": "one-at-a-time" + } + } +} +``` + +| Field | Type | Default | Env var | +|-------|------|---------|---------| +| `steering_mode` | `string` | `"one-at-a-time"` | `PICOCLAW_AGENTS_DEFAULTS_STEERING_MODE` | + + +## Design decisions and trade-offs + +| Decision | Rationale | +|----------|-----------| +| Sequential tool execution | Required for per-tool steering polls. Parallel execution cannot be interrupted mid-batch. | +| Polling-based (not channel/signal) | Keeps the implementation simple. No need for `select` or signal channels. The polling cost is negligible (mutex lock + slice length check). | +| `one-at-a-time` as default | Gives the model a chance to react to each steering message individually. More predictable behavior than dumping all messages at once. | +| Skipped tools get explicit error results | The LLM protocol requires a tool result for every tool call in the assistant message. Omitting them would cause API errors. The skip message also informs the model about what was not done. | +| `Continue()` uses `SkipInitialSteeringPoll` | Prevents race conditions and double-dequeuing when resuming an idle agent. | +| Queue stored on `AgentLoop`, not `AgentInstance` | Steering is a loop-level concern (it affects the iteration flow), not a per-agent concern. All agents share the same steering queue since `processMessage` is sequential. | +| Bus drain goroutine in `Run()` | Channels (Telegram, Discord, etc.) publish to the bus via `PublishInbound`. Without the drain, messages would queue in the bus channel buffer and only be consumed after `processMessage` returns — defeating the purpose of steering. The drain goroutine bridges the gap by consuming new bus messages and calling `Steer()` while the agent is busy. | +| Audio transcription before steering | The drain goroutine calls `al.transcribeAudioInMessage(ctx, msg)` before steering, so voice messages are converted to text before the agent sees them. If transcription fails, the error is silently discarded and the original message is steered as-is. | +| `MaxQueueSize = 10` | Prevents unbounded memory growth if a user sends many messages while the agent is busy. Excess messages are dropped with a warning. | diff --git a/docs/steering.md b/docs/steering.md new file mode 100644 index 000000000..ad08f8425 --- /dev/null +++ b/docs/steering.md @@ -0,0 +1,166 @@ +# Steering + +Steering allows injecting messages into an already-running agent loop, interrupting it between tool calls without waiting for the entire cycle to complete. + +## How it works + +When the agent is executing a sequence of tool calls (e.g. the model requested 3 tools in a single turn), steering checks the queue **after each tool** completes. If it finds queued messages: + +1. The remaining tools are **skipped** and receive `"Skipped due to queued user message."` as their result +2. The steering messages are **injected into the conversation context** +3. The model is called again with the updated context, including the user's steering message + +``` +User ──► Steer("change approach") + │ +Agent Loop ▼ + ├─ tool[0] ✔ (executed) + ├─ [polling] → steering found! + ├─ tool[1] ✘ (skipped) + ├─ tool[2] ✘ (skipped) + └─ new LLM turn with steering message +``` + +## Configuration + +In `config.json`, under `agents.defaults`: + +```json +{ + "agents": { + "defaults": { + "steering_mode": "one-at-a-time" + } + } +} +``` + +### Modes + +| Value | Behavior | +|-------|----------| +| `"one-at-a-time"` | **(default)** Dequeues only one message per polling cycle. If there are 3 messages in the queue, they are processed one at a time across 3 successive iterations. | +| `"all"` | Drains the entire queue in a single poll. All pending messages are injected into the context together. | + +The environment variable `PICOCLAW_AGENTS_DEFAULTS_STEERING_MODE` can be used as an alternative. + +## Go API + +### Steer — Send a steering message + +```go +err := agentLoop.Steer(providers.Message{ + Role: "user", + Content: "change direction, focus on X instead", +}) +if err != nil { + // Queue is full (MaxQueueSize=10) or not initialized +} +``` + +The message is enqueued in a thread-safe manner. Returns an error if the queue is full or not initialized. It will be picked up at the next polling point (after the current tool finishes). + +### SteeringMode / SetSteeringMode + +```go +// Read the current mode +mode := agentLoop.SteeringMode() // SteeringOneAtATime | SteeringAll + +// Change it at runtime +agentLoop.SetSteeringMode(agent.SteeringAll) +``` + +### Continue — Resume an idle agent + +When the agent is idle (it has finished processing and its last message was from the assistant), `Continue` checks if there are steering messages in the queue and uses them to start a new cycle: + +```go +response, err := agentLoop.Continue(ctx, sessionKey, channel, chatID) +if err != nil { + // Error (e.g. "no default agent available") +} +if response == "" { + // No steering messages in queue, the agent stays idle +} +``` + +`Continue` internally uses `SkipInitialSteeringPoll: true` to avoid double-dequeuing the same messages (since it already extracted them and passes them directly as input). + +## Polling points in the loop + +Steering is checked at **two points** in the agent cycle: + +1. **At loop start** — before the first LLM call, to catch messages enqueued during setup +2. **After every tool completes** — including the first and the last. If steering is found and there are remaining tools, they are all skipped immediately + +## Why remaining tools are skipped + +When a steering message is detected, all remaining tools in the batch are skipped rather than executed. The alternative — let all tools finish and inject the steering message afterwards — was considered and rejected. Here is why. + +### Preventing unwanted side effects + +Tools can have **irreversible side effects**. If the user says "no, wait" while the agent is mid-batch, executing the remaining tools means those side effects happen anyway: + +| Tool batch | Steering message | With skip | Without skip | +|---|---|---|---| +| `[web_search, send_email]` | "don't send it" | Email **not** sent | Email sent, damage done | +| `[query_db, write_file, spawn_agent]` | "use another database" | Only the query runs | File written + subagent spawned, all wasted | +| `[search₁, search₂, search₃, write_file]` | user changes topic entirely | 1 search | 3 searches + file write, all irrelevant | + +### Avoiding wasted time + +Tools that take seconds (web fetches, API calls, database queries) would all run to completion before the agent sees the user's correction. In a batch of 3 tools each taking 3-4 seconds, that's 10+ seconds of work that will be discarded. + +With skipping, the agent reacts as soon as the current tool finishes — typically within a few seconds instead of waiting for the entire batch. + +### The LLM gets full context + +Skipped tools receive an explicit error result (`"Skipped due to queued user message."`), so the model knows exactly which actions were not performed. It can then decide whether to re-execute them with the new context, or take a different path entirely. + +### Trade-off: sequential execution + +Skipping requires tools to run **sequentially** (the previous implementation ran them in parallel). This introduces latency when the LLM requests multiple independent tools in a single turn. In practice, most batches contain 1-2 tools, so the impact is minimal compared to the benefit of being able to stop unwanted actions. + +## Skipped tool result format + +When steering interrupts a batch, each tool that was not executed receives a `tool` result with: + +``` +Content: "Skipped due to queued user message." +``` + +This is saved to the session via `AddFullMessage` and sent to the model, so it is aware that some requested actions were not performed. + +## Full flow example + +``` +1. User: "search for info on X, write a file, and send me a message" + +2. LLM responds with 3 tool calls: [web_search, write_file, message] + +3. web_search is executed → result saved + +4. [polling] → User called Steer("no, search for Y instead") + +5. write_file is skipped → "Skipped due to queued user message." + message is skipped → "Skipped due to queued user message." + +6. Message "search for Y instead" injected into context + +7. LLM receives the full updated context and responds accordingly +``` + +## Automatic bus drain + +When the agent loop (`Run()`) starts processing a message, it spawns a background goroutine that keeps consuming new inbound messages from the bus. These messages are automatically redirected into the steering queue via `Steer()`. This means: + +- Users on any channel (Telegram, Discord, etc.) don't need to do anything special — their messages are automatically captured as steering when the agent is busy +- Audio messages are transcribed before being steered, so the agent receives text. If transcription fails, the original (non-transcribed) message is steered as-is +- When `processMessage` finishes, the drain goroutine is canceled and normal message consumption resumes + +## Notes + +- Steering **does not interrupt** a tool that is currently executing. It waits for the current tool to finish, then checks the queue. +- With `one-at-a-time` mode, if multiple messages are enqueued rapidly, they will be processed one per iteration. This gives the model the opportunity to react to each message individually. +- With `all` mode, all pending messages are combined into a single injection. Useful when you want the agent to receive all the context at once. +- The steering queue has a maximum capacity of 10 messages (`MaxQueueSize`). `Steer()` returns an error when the queue is full. In the bus drain path, the error is logged as a warning and the message is effectively dropped. diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index f20a56b9c..21516e7de 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -48,6 +48,7 @@ type AgentLoop struct { transcriber voice.Transcriber cmdRegistry *commands.Registry mcp mcpRuntime + steering *steeringQueue mu sync.RWMutex // Track active requests for safe provider cleanup activeRequests sync.WaitGroup @@ -55,15 +56,16 @@ type AgentLoop struct { // processOptions configures how a message is processed type processOptions struct { - SessionKey string // Session identifier for history/context - Channel string // Target channel for tool execution - ChatID string // Target chat ID for tool execution - UserMessage string // User message content (may include prefix) - Media []string // media:// refs from inbound message - DefaultResponse string // Response when LLM returns empty - EnableSummary bool // Whether to trigger summarization - SendResponse bool // Whether to send response via bus - NoHistory bool // If true, don't load session history (for heartbeat) + SessionKey string // Session identifier for history/context + Channel string // Target channel for tool execution + ChatID string // Target chat ID for tool execution + UserMessage string // User message content (may include prefix) + Media []string // media:// refs from inbound message + DefaultResponse string // Response when LLM returns empty + EnableSummary bool // Whether to trigger summarization + SendResponse bool // Whether to send response via bus + NoHistory bool // If true, don't load session history (for heartbeat) + SkipInitialSteeringPoll bool // If true, skip the steering poll at loop start (used by Continue) } const ( @@ -105,6 +107,7 @@ func NewAgentLoop( summarizing: sync.Map{}, fallback: fallbackChain, cmdRegistry: commands.NewRegistry(commands.BuiltinDefinitions()), + steering: newSteeringQueue(parseSteeringMode(cfg.Agents.Defaults.SteeringMode)), } return al @@ -257,6 +260,13 @@ func (al *AgentLoop) Run(ctx context.Context) error { continue } + // Start a goroutine that drains the bus while processMessage is + // running. Any inbound messages that arrive during processing are + // redirected into the steering queue so the agent loop can pick + // them up between tool calls. + drainCtx, drainCancel := context.WithCancel(ctx) + go al.drainBusToSteering(drainCtx) + // Process message func() { // TODO: Re-enable media cleanup after inbound media is properly consumed by the agent. @@ -272,6 +282,8 @@ func (al *AgentLoop) Run(ctx context.Context) error { // } // }() + defer drainCancel() + response, err := al.processMessage(ctx, msg) if err != nil { response = fmt.Sprintf("Error processing message: %v", err) @@ -318,6 +330,39 @@ func (al *AgentLoop) Run(ctx context.Context) error { return nil } +// drainBusToSteering continuously consumes inbound messages and redirects +// them into the steering queue. It runs in a goroutine while processMessage +// is active and stops when drainCtx is canceled (i.e., processMessage returns). +func (al *AgentLoop) drainBusToSteering(ctx context.Context) { + for { + msg, ok := al.bus.ConsumeInbound(ctx) + if !ok { + return + } + + // Transcribe audio if needed before steering, so the agent sees text. + msg, _ = al.transcribeAudioInMessage(ctx, msg) + + logger.InfoCF("agent", "Redirecting inbound message to steering queue", + map[string]any{ + "channel": msg.Channel, + "sender_id": msg.SenderID, + "content_len": len(msg.Content), + }) + + if err := al.Steer(providers.Message{ + Role: "user", + Content: msg.Content, + }); err != nil { + logger.WarnCF("agent", "Failed to steer message, will be lost", + map[string]any{ + "error": err.Error(), + "channel": msg.Channel, + }) + } + } +} + func (al *AgentLoop) Stop() { al.running.Store(false) } @@ -999,6 +1044,16 @@ func (al *AgentLoop) runLLMIteration( ) (string, int, error) { iteration := 0 var finalContent string + var pendingMessages []providers.Message + + // Poll for steering messages at loop start (in case the user typed while + // the agent was setting up), unless the caller already provided initial + // steering messages (e.g. Continue). + if !opts.SkipInitialSteeringPoll { + if msgs := al.dequeueSteeringMessages(); len(msgs) > 0 { + pendingMessages = msgs + } + } // Determine effective model tier for this conversation turn. // selectCandidates evaluates routing once and the decision is sticky for @@ -1006,9 +1061,25 @@ func (al *AgentLoop) runLLMIteration( // tool chain doesn't switch models mid-way through. activeCandidates, activeModel := al.selectCandidates(agent, opts.UserMessage, messages) - for iteration < agent.MaxIterations { + for iteration < agent.MaxIterations || len(pendingMessages) > 0 { iteration++ + // Inject pending steering messages into the conversation context + // before the next LLM call. + if len(pendingMessages) > 0 { + for _, pm := range pendingMessages { + messages = append(messages, pm) + agent.Sessions.AddMessage(opts.SessionKey, pm.Role, pm.Content) + logger.InfoCF("agent", "Injected steering message into context", + map[string]any{ + "agent_id": agent.ID, + "iteration": iteration, + "content_len": len(pm.Content), + }) + } + pendingMessages = nil + } + logger.DebugCF("agent", "LLM iteration", map[string]any{ "agent_id": agent.ID, @@ -1251,107 +1322,83 @@ func (al *AgentLoop) runLLMIteration( // Save assistant message with tool calls to session agent.Sessions.AddFullMessage(opts.SessionKey, assistantMsg) - // Execute tool calls in parallel - type indexedAgentResult struct { - result *tools.ToolResult - tc providers.ToolCall - } - - agentResults := make([]indexedAgentResult, len(normalizedToolCalls)) - var wg sync.WaitGroup + // Execute tool calls sequentially. After each tool completes, check + // for steering messages. If any are found, skip remaining tools. + var steeringAfterTools []providers.Message for i, tc := range normalizedToolCalls { - agentResults[i].tc = tc + argsJSON, _ := json.Marshal(tc.Arguments) + argsPreview := utils.Truncate(string(argsJSON), 200) + logger.InfoCF("agent", fmt.Sprintf("Tool call: %s(%s)", tc.Name, argsPreview), + map[string]any{ + "agent_id": agent.ID, + "tool": tc.Name, + "iteration": iteration, + }) - wg.Add(1) - go func(idx int, tc providers.ToolCall) { - defer wg.Done() - - argsJSON, _ := json.Marshal(tc.Arguments) - argsPreview := utils.Truncate(string(argsJSON), 200) - logger.InfoCF("agent", fmt.Sprintf("Tool call: %s(%s)", tc.Name, argsPreview), - map[string]any{ - "agent_id": agent.ID, - "tool": tc.Name, - "iteration": iteration, - }) - - // Create async callback for tools that implement AsyncExecutor. - // When the background work completes, this publishes the result - // as an inbound system message so processSystemMessage routes it - // back to the user via the normal agent loop. - asyncCallback := func(_ context.Context, result *tools.ToolResult) { - // Send ForUser content directly to the user (immediate feedback), - // mirroring the synchronous tool execution path. - if !result.Silent && result.ForUser != "" { - outCtx, outCancel := context.WithTimeout(context.Background(), 5*time.Second) - defer outCancel() - _ = al.bus.PublishOutbound(outCtx, bus.OutboundMessage{ - Channel: opts.Channel, - ChatID: opts.ChatID, - Content: result.ForUser, - }) - } - - // Determine content for the agent loop (ForLLM or error). - content := result.ForLLM - if content == "" && result.Err != nil { - content = result.Err.Error() - } - if content == "" { - return - } - - logger.InfoCF("agent", "Async tool completed, publishing result", - map[string]any{ - "tool": tc.Name, - "content_len": len(content), - "channel": opts.Channel, - }) - - pubCtx, pubCancel := context.WithTimeout(context.Background(), 5*time.Second) - defer pubCancel() - _ = al.bus.PublishInbound(pubCtx, bus.InboundMessage{ - Channel: "system", - SenderID: fmt.Sprintf("async:%s", tc.Name), - ChatID: fmt.Sprintf("%s:%s", opts.Channel, opts.ChatID), - Content: content, + // Create async callback for tools that implement AsyncExecutor. + asyncCallback := func(_ context.Context, result *tools.ToolResult) { + if !result.Silent && result.ForUser != "" { + outCtx, outCancel := context.WithTimeout(context.Background(), 5*time.Second) + defer outCancel() + _ = al.bus.PublishOutbound(outCtx, bus.OutboundMessage{ + Channel: opts.Channel, + ChatID: opts.ChatID, + Content: result.ForUser, }) } - toolResult := agent.Tools.ExecuteWithContext( - ctx, - tc.Name, - tc.Arguments, - opts.Channel, - opts.ChatID, - asyncCallback, - ) - agentResults[idx].result = toolResult - }(i, tc) - } - wg.Wait() + content := result.ForLLM + if content == "" && result.Err != nil { + content = result.Err.Error() + } + if content == "" { + return + } - // Process results in original order (send to user, save to session) - for _, r := range agentResults { - // Send ForUser content to user immediately if not Silent - if !r.result.Silent && r.result.ForUser != "" && opts.SendResponse { + logger.InfoCF("agent", "Async tool completed, publishing result", + map[string]any{ + "tool": tc.Name, + "content_len": len(content), + "channel": opts.Channel, + }) + + pubCtx, pubCancel := context.WithTimeout(context.Background(), 5*time.Second) + defer pubCancel() + _ = al.bus.PublishInbound(pubCtx, bus.InboundMessage{ + Channel: "system", + SenderID: fmt.Sprintf("async:%s", tc.Name), + ChatID: fmt.Sprintf("%s:%s", opts.Channel, opts.ChatID), + Content: content, + }) + } + + toolResult := agent.Tools.ExecuteWithContext( + ctx, + tc.Name, + tc.Arguments, + opts.Channel, + opts.ChatID, + asyncCallback, + ) + + // Process tool result + if !toolResult.Silent && toolResult.ForUser != "" && opts.SendResponse { al.bus.PublishOutbound(ctx, bus.OutboundMessage{ Channel: opts.Channel, ChatID: opts.ChatID, - Content: r.result.ForUser, + Content: toolResult.ForUser, }) logger.DebugCF("agent", "Sent tool result to user", map[string]any{ - "tool": r.tc.Name, - "content_len": len(r.result.ForUser), + "tool": tc.Name, + "content_len": len(toolResult.ForUser), }) } - // If tool returned media refs, publish them as outbound media - if len(r.result.Media) > 0 { - parts := make([]bus.MediaPart, 0, len(r.result.Media)) - for _, ref := range r.result.Media { + if len(toolResult.Media) > 0 { + parts := make([]bus.MediaPart, 0, len(toolResult.Media)) + for _, ref := range toolResult.Media { part := bus.MediaPart{Ref: ref} if al.mediaStore != nil { if _, meta, err := al.mediaStore.ResolveWithMeta(ref); err == nil { @@ -1369,21 +1416,55 @@ func (al *AgentLoop) runLLMIteration( }) } - // Determine content for LLM based on tool result - contentForLLM := r.result.ForLLM - if contentForLLM == "" && r.result.Err != nil { - contentForLLM = r.result.Err.Error() + contentForLLM := toolResult.ForLLM + if contentForLLM == "" && toolResult.Err != nil { + contentForLLM = toolResult.Err.Error() } toolResultMsg := providers.Message{ Role: "tool", Content: contentForLLM, - ToolCallID: r.tc.ID, + ToolCallID: tc.ID, } messages = append(messages, toolResultMsg) - - // Save tool result message to session agent.Sessions.AddFullMessage(opts.SessionKey, toolResultMsg) + + // After EVERY tool (including the first and last), check for + // steering messages. If found and there are remaining tools, + // skip them all. + if steerMsgs := al.dequeueSteeringMessages(); len(steerMsgs) > 0 { + remaining := len(normalizedToolCalls) - i - 1 + if remaining > 0 { + logger.InfoCF("agent", "Steering interrupt: skipping remaining tools", + map[string]any{ + "agent_id": agent.ID, + "completed": i + 1, + "skipped": remaining, + "total_tools": len(normalizedToolCalls), + "steering_count": len(steerMsgs), + }) + + // Mark remaining tool calls as skipped + for j := i + 1; j < len(normalizedToolCalls); j++ { + skippedTC := normalizedToolCalls[j] + toolResultMsg := providers.Message{ + Role: "tool", + Content: "Skipped due to queued user message.", + ToolCallID: skippedTC.ID, + } + messages = append(messages, toolResultMsg) + agent.Sessions.AddFullMessage(opts.SessionKey, toolResultMsg) + } + } + steeringAfterTools = steerMsgs + break + } + } + + // If steering messages were captured during tool execution, they + // become pendingMessages for the next iteration of the inner loop. + if len(steeringAfterTools) > 0 { + pendingMessages = steeringAfterTools } // Tick down TTL of discovered tools after processing tool results. diff --git a/pkg/agent/steering.go b/pkg/agent/steering.go new file mode 100644 index 000000000..8c7c79c16 --- /dev/null +++ b/pkg/agent/steering.go @@ -0,0 +1,188 @@ +package agent + +import ( + "context" + "fmt" + "strings" + "sync" + + "github.com/sipeed/picoclaw/pkg/logger" + "github.com/sipeed/picoclaw/pkg/providers" +) + +// SteeringMode controls how queued steering messages are dequeued. +type SteeringMode string + +const ( + // SteeringOneAtATime dequeues only the first queued message per poll. + SteeringOneAtATime SteeringMode = "one-at-a-time" + // SteeringAll drains the entire queue in a single poll. + SteeringAll SteeringMode = "all" + // MaxQueueSize number of possible messages in the Steering Queue + MaxQueueSize = 10 +) + +// parseSteeringMode normalizes a config string into a SteeringMode. +func parseSteeringMode(s string) SteeringMode { + switch s { + case "all": + return SteeringAll + default: + return SteeringOneAtATime + } +} + +// steeringQueue is a thread-safe queue of user messages that can be injected +// into a running agent loop to interrupt it between tool calls. +type steeringQueue struct { + mu sync.Mutex + queue []providers.Message + mode SteeringMode +} + +func newSteeringQueue(mode SteeringMode) *steeringQueue { + return &steeringQueue{ + mode: mode, + } +} + +// push enqueues a steering message. +func (sq *steeringQueue) push(msg providers.Message) error { + sq.mu.Lock() + defer sq.mu.Unlock() + if len(sq.queue) >= MaxQueueSize { + return fmt.Errorf("steering queue is full") + } + sq.queue = append(sq.queue, msg) + return nil +} + +// dequeue removes and returns pending steering messages according to the +// configured mode. Returns nil when the queue is empty. +func (sq *steeringQueue) dequeue() []providers.Message { + sq.mu.Lock() + defer sq.mu.Unlock() + + if len(sq.queue) == 0 { + return nil + } + + switch sq.mode { + case SteeringAll: + msgs := sq.queue + sq.queue = nil + return msgs + default: // one-at-a-time + msg := sq.queue[0] + sq.queue[0] = providers.Message{} // Clear reference for GC + sq.queue = sq.queue[1:] + return []providers.Message{msg} + } +} + +// len returns the number of queued messages. +func (sq *steeringQueue) len() int { + sq.mu.Lock() + defer sq.mu.Unlock() + return len(sq.queue) +} + +// setMode updates the steering mode. +func (sq *steeringQueue) setMode(mode SteeringMode) { + sq.mu.Lock() + defer sq.mu.Unlock() + sq.mode = mode +} + +// getMode returns the current steering mode. +func (sq *steeringQueue) getMode() SteeringMode { + sq.mu.Lock() + defer sq.mu.Unlock() + return sq.mode +} + +// --- AgentLoop steering API --- + +// Steer enqueues a user message to be injected into the currently running +// agent loop. The message will be picked up after the current tool finishes +// executing, causing any remaining tool calls in the batch to be skipped. +func (al *AgentLoop) Steer(msg providers.Message) error { + if al.steering == nil { + return fmt.Errorf("steering queue is not initialized") + } + if err := al.steering.push(msg); err != nil { + logger.WarnCF("agent", "Failed to enqueue steering message", map[string]any{ + "error": err.Error(), + "role": msg.Role, + }) + return err + } + logger.DebugCF("agent", "Steering message enqueued", map[string]any{ + "role": msg.Role, + "content_len": len(msg.Content), + "queue_len": al.steering.len(), + }) + + return nil +} + +// SteeringMode returns the current steering mode. +func (al *AgentLoop) SteeringMode() SteeringMode { + if al.steering == nil { + return SteeringOneAtATime + } + return al.steering.getMode() +} + +// SetSteeringMode updates the steering mode. +func (al *AgentLoop) SetSteeringMode(mode SteeringMode) { + if al.steering == nil { + return + } + al.steering.setMode(mode) +} + +// dequeueSteeringMessages is the internal method called by the agent loop +// to poll for steering messages. Returns nil when no messages are pending. +func (al *AgentLoop) dequeueSteeringMessages() []providers.Message { + if al.steering == nil { + return nil + } + return al.steering.dequeue() +} + +// Continue resumes an idle agent by dequeuing any pending steering messages +// and running them through the agent loop. This is used when the agent's last +// message was from the assistant (i.e., it has stopped processing) and the +// user has since enqueued steering messages. +// +// If no steering messages are pending, it returns an empty string. +func (al *AgentLoop) Continue(ctx context.Context, sessionKey, channel, chatID string) (string, error) { + steeringMsgs := al.dequeueSteeringMessages() + if len(steeringMsgs) == 0 { + return "", nil + } + + agent := al.GetRegistry().GetDefaultAgent() + if agent == nil { + return "", fmt.Errorf("no default agent available") + } + + // Build a combined user message from the steering messages. + var contents []string + for _, msg := range steeringMsgs { + contents = append(contents, msg.Content) + } + combinedContent := strings.Join(contents, "\n") + + return al.runAgentLoop(ctx, agent, processOptions{ + SessionKey: sessionKey, + Channel: channel, + ChatID: chatID, + UserMessage: combinedContent, + DefaultResponse: defaultResponse, + EnableSummary: true, + SendResponse: false, + SkipInitialSteeringPoll: true, + }) +} diff --git a/pkg/agent/steering_test.go b/pkg/agent/steering_test.go new file mode 100644 index 000000000..e8cdb2344 --- /dev/null +++ b/pkg/agent/steering_test.go @@ -0,0 +1,744 @@ +package agent + +import ( + "context" + "encoding/json" + "fmt" + "os" + "sync" + "testing" + "time" + + "github.com/sipeed/picoclaw/pkg/bus" + "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/providers" + "github.com/sipeed/picoclaw/pkg/tools" +) + +// --- steeringQueue unit tests --- + +func TestSteeringQueue_PushDequeue_OneAtATime(t *testing.T) { + sq := newSteeringQueue(SteeringOneAtATime) + + sq.push(providers.Message{Role: "user", Content: "msg1"}) + sq.push(providers.Message{Role: "user", Content: "msg2"}) + sq.push(providers.Message{Role: "user", Content: "msg3"}) + + if sq.len() != 3 { + t.Fatalf("expected 3 messages, got %d", sq.len()) + } + + msgs := sq.dequeue() + if len(msgs) != 1 { + t.Fatalf("expected 1 message in one-at-a-time mode, got %d", len(msgs)) + } + if msgs[0].Content != "msg1" { + t.Fatalf("expected 'msg1', got %q", msgs[0].Content) + } + if sq.len() != 2 { + t.Fatalf("expected 2 remaining, got %d", sq.len()) + } + + msgs = sq.dequeue() + if len(msgs) != 1 || msgs[0].Content != "msg2" { + t.Fatalf("expected 'msg2', got %v", msgs) + } + + msgs = sq.dequeue() + if len(msgs) != 1 || msgs[0].Content != "msg3" { + t.Fatalf("expected 'msg3', got %v", msgs) + } + + msgs = sq.dequeue() + if msgs != nil { + t.Fatalf("expected nil from empty queue, got %v", msgs) + } +} + +func TestSteeringQueue_PushDequeue_All(t *testing.T) { + sq := newSteeringQueue(SteeringAll) + + sq.push(providers.Message{Role: "user", Content: "msg1"}) + sq.push(providers.Message{Role: "user", Content: "msg2"}) + sq.push(providers.Message{Role: "user", Content: "msg3"}) + + msgs := sq.dequeue() + if len(msgs) != 3 { + t.Fatalf("expected 3 messages in all mode, got %d", len(msgs)) + } + if msgs[0].Content != "msg1" || msgs[1].Content != "msg2" || msgs[2].Content != "msg3" { + t.Fatalf("unexpected messages: %v", msgs) + } + + if sq.len() != 0 { + t.Fatalf("expected 0 remaining, got %d", sq.len()) + } + + msgs = sq.dequeue() + if msgs != nil { + t.Fatalf("expected nil from empty queue, got %v", msgs) + } +} + +func TestSteeringQueue_EmptyDequeue(t *testing.T) { + sq := newSteeringQueue(SteeringOneAtATime) + if msgs := sq.dequeue(); msgs != nil { + t.Fatalf("expected nil, got %v", msgs) + } +} + +func TestSteeringQueue_SetMode(t *testing.T) { + sq := newSteeringQueue(SteeringOneAtATime) + if sq.getMode() != SteeringOneAtATime { + t.Fatalf("expected one-at-a-time, got %v", sq.getMode()) + } + + sq.setMode(SteeringAll) + if sq.getMode() != SteeringAll { + t.Fatalf("expected all, got %v", sq.getMode()) + } + + // Push two messages and verify all-mode drains them + sq.push(providers.Message{Role: "user", Content: "a"}) + sq.push(providers.Message{Role: "user", Content: "b"}) + + msgs := sq.dequeue() + if len(msgs) != 2 { + t.Fatalf("expected 2 messages after mode switch, got %d", len(msgs)) + } +} + +func TestSteeringQueue_ConcurrentAccess(t *testing.T) { + sq := newSteeringQueue(SteeringOneAtATime) + + var wg sync.WaitGroup + const n = MaxQueueSize + + // Push from multiple goroutines + for i := 0; i < n; i++ { + wg.Add(1) + go func(i int) { + defer wg.Done() + sq.push(providers.Message{Role: "user", Content: fmt.Sprintf("msg%d", i)}) + }(i) + } + wg.Wait() + + if sq.len() != n { + t.Fatalf("expected %d messages, got %d", n, sq.len()) + } + + // Drain from multiple goroutines + var drained int + var mu sync.Mutex + for i := 0; i < n; i++ { + wg.Add(1) + go func() { + defer wg.Done() + if msgs := sq.dequeue(); len(msgs) > 0 { + mu.Lock() + drained += len(msgs) + mu.Unlock() + } + }() + } + wg.Wait() + + if drained != n { + t.Fatalf("expected to drain %d messages, got %d", n, drained) + } +} + +func TestSteeringQueue_Overflow(t *testing.T) { + sq := newSteeringQueue(SteeringOneAtATime) + + // Fill the queue up to its maximum capacity + for i := 0; i < MaxQueueSize; i++ { + err := sq.push(providers.Message{Role: "user", Content: fmt.Sprintf("msg%d", i)}) + if err != nil { + t.Fatalf("unexpected error pushing message %d: %v", i, err) + } + } + + // Sanity check: ensure the queue is actually full + if sq.len() != MaxQueueSize { + t.Fatalf("expected queue length %d, got %d", MaxQueueSize, sq.len()) + } + + // Attempt to push one more message, which MUST fail + err := sq.push(providers.Message{Role: "user", Content: "overflow_msg"}) + + // Assert the error happened and is the exact one we expect + if err == nil { + t.Fatal("expected an error when pushing to a full queue, but got nil") + } + + expectedErr := "steering queue is full" + if err.Error() != expectedErr { + t.Errorf("expected error message %q, got %q", expectedErr, err.Error()) + } +} + +func TestParseSteeringMode(t *testing.T) { + tests := []struct { + input string + expected SteeringMode + }{ + {"", SteeringOneAtATime}, + {"one-at-a-time", SteeringOneAtATime}, + {"all", SteeringAll}, + {"unknown", SteeringOneAtATime}, + } + + for _, tt := range tests { + t.Run(tt.input, func(t *testing.T) { + if got := parseSteeringMode(tt.input); got != tt.expected { + t.Fatalf("parseSteeringMode(%q) = %v, want %v", tt.input, got, tt.expected) + } + }) + } +} + +// --- AgentLoop steering integration tests --- + +func TestAgentLoop_Steer_Enqueues(t *testing.T) { + al, cfg, msgBus, provider, cleanup := newTestAgentLoop(t) + defer cleanup() + + if cfg == nil { + t.Fatal("expected config to be initialized") + } + if msgBus == nil { + t.Fatal("expected message bus to be initialized") + } + if provider == nil { + t.Fatal("expected provider to be initialized") + } + + al.Steer(providers.Message{Role: "user", Content: "interrupt me"}) + + if al.steering.len() != 1 { + t.Fatalf("expected 1 steering message, got %d", al.steering.len()) + } + + msgs := al.dequeueSteeringMessages() + if len(msgs) != 1 || msgs[0].Content != "interrupt me" { + t.Fatalf("unexpected dequeued message: %v", msgs) + } +} + +func TestAgentLoop_SteeringMode_GetSet(t *testing.T) { + al, cfg, msgBus, provider, cleanup := newTestAgentLoop(t) + defer cleanup() + + if cfg == nil { + t.Fatal("expected config to be initialized") + } + if msgBus == nil { + t.Fatal("expected message bus to be initialized") + } + if provider == nil { + t.Fatal("expected provider to be initialized") + } + + if al.SteeringMode() != SteeringOneAtATime { + t.Fatalf("expected default mode one-at-a-time, got %v", al.SteeringMode()) + } + + al.SetSteeringMode(SteeringAll) + if al.SteeringMode() != SteeringAll { + t.Fatalf("expected all mode, got %v", al.SteeringMode()) + } +} + +func TestAgentLoop_SteeringMode_ConfiguredFromConfig(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "agent-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + SteeringMode: "all", + }, + }, + } + + msgBus := bus.NewMessageBus() + provider := &mockProvider{} + al := NewAgentLoop(cfg, msgBus, provider) + + if al.SteeringMode() != SteeringAll { + t.Fatalf("expected 'all' mode from config, got %v", al.SteeringMode()) + } +} + +func TestAgentLoop_Continue_NoMessages(t *testing.T) { + al, cfg, msgBus, provider, cleanup := newTestAgentLoop(t) + defer cleanup() + + if cfg == nil { + t.Fatal("expected config to be initialized") + } + if msgBus == nil { + t.Fatal("expected message bus to be initialized") + } + if provider == nil { + t.Fatal("expected provider to be initialized") + } + + resp, err := al.Continue(context.Background(), "test-session", "test", "chat1") + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + if resp != "" { + t.Fatalf("expected empty response for no steering messages, got %q", resp) + } +} + +func TestAgentLoop_Continue_WithMessages(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "agent-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + + msgBus := bus.NewMessageBus() + provider := &simpleMockProvider{response: "continued response"} + al := NewAgentLoop(cfg, msgBus, provider) + + al.Steer(providers.Message{Role: "user", Content: "new direction"}) + + resp, err := al.Continue(context.Background(), "test-session", "test", "chat1") + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + if resp != "continued response" { + t.Fatalf("expected 'continued response', got %q", resp) + } +} + +// slowTool simulates a tool that takes some time to execute. +type slowTool struct { + name string + duration time.Duration + execCh chan struct{} // closed when Execute starts +} + +func (t *slowTool) Name() string { return t.name } +func (t *slowTool) Description() string { return "slow tool for testing" } +func (t *slowTool) Parameters() map[string]any { + return map[string]any{ + "type": "object", + "properties": map[string]any{}, + } +} + +func (t *slowTool) Execute(ctx context.Context, args map[string]any) *tools.ToolResult { + if t.execCh != nil { + close(t.execCh) + } + time.Sleep(t.duration) + return tools.SilentResult(fmt.Sprintf("executed %s", t.name)) +} + +// toolCallProvider returns an LLM response with tool calls on the first call, +// then a direct response on subsequent calls. +type toolCallProvider struct { + mu sync.Mutex + calls int + toolCalls []providers.ToolCall + finalResp string +} + +func (m *toolCallProvider) Chat( + ctx context.Context, + messages []providers.Message, + tools []providers.ToolDefinition, + model string, + opts map[string]any, +) (*providers.LLMResponse, error) { + m.mu.Lock() + defer m.mu.Unlock() + m.calls++ + + if m.calls == 1 && len(m.toolCalls) > 0 { + return &providers.LLMResponse{ + Content: "", + ToolCalls: m.toolCalls, + }, nil + } + + return &providers.LLMResponse{ + Content: m.finalResp, + ToolCalls: []providers.ToolCall{}, + }, nil +} + +func (m *toolCallProvider) GetDefaultModel() string { + return "tool-call-mock" +} + +func TestAgentLoop_Steering_SkipsRemainingTools(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "agent-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + + tool1ExecCh := make(chan struct{}) + tool1 := &slowTool{name: "tool_one", duration: 50 * time.Millisecond, execCh: tool1ExecCh} + tool2 := &slowTool{name: "tool_two", duration: 50 * time.Millisecond} + + provider := &toolCallProvider{ + toolCalls: []providers.ToolCall{ + { + ID: "call_1", + Type: "function", + Name: "tool_one", + Function: &providers.FunctionCall{ + Name: "tool_one", + Arguments: "{}", + }, + Arguments: map[string]any{}, + }, + { + ID: "call_2", + Type: "function", + Name: "tool_two", + Function: &providers.FunctionCall{ + Name: "tool_two", + Arguments: "{}", + }, + Arguments: map[string]any{}, + }, + }, + finalResp: "steered response", + } + + msgBus := bus.NewMessageBus() + al := NewAgentLoop(cfg, msgBus, provider) + al.RegisterTool(tool1) + al.RegisterTool(tool2) + + // Start processing in a goroutine + type result struct { + resp string + err error + } + resultCh := make(chan result, 1) + + go func() { + resp, err := al.ProcessDirectWithChannel( + context.Background(), + "do something", + "test-session", + "test", + "chat1", + ) + resultCh <- result{resp, err} + }() + + // Wait for tool_one to start executing, then enqueue a steering message + select { + case <-tool1ExecCh: + // tool_one has started executing + case <-time.After(2 * time.Second): + t.Fatal("timeout waiting for tool_one to start") + } + + al.Steer(providers.Message{Role: "user", Content: "change course"}) + + // Get the result + select { + case r := <-resultCh: + if r.err != nil { + t.Fatalf("unexpected error: %v", r.err) + } + if r.resp != "steered response" { + t.Fatalf("expected 'steered response', got %q", r.resp) + } + case <-time.After(5 * time.Second): + t.Fatal("timeout waiting for agent loop to complete") + } + + // The provider should have been called twice: + // 1. first call returned tool calls + // 2. second call (after steering) returned the final response + provider.mu.Lock() + calls := provider.calls + provider.mu.Unlock() + if calls != 2 { + t.Fatalf("expected 2 provider calls, got %d", calls) + } +} + +func TestAgentLoop_Steering_InitialPoll(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "agent-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + + // Provider that captures messages it receives + var capturedMessages []providers.Message + var capMu sync.Mutex + provider := &capturingMockProvider{ + response: "ack", + captureFn: func(msgs []providers.Message) { + capMu.Lock() + capturedMessages = make([]providers.Message, len(msgs)) + copy(capturedMessages, msgs) + capMu.Unlock() + }, + } + + msgBus := bus.NewMessageBus() + al := NewAgentLoop(cfg, msgBus, provider) + + // Enqueue a steering message before processing starts + al.Steer(providers.Message{Role: "user", Content: "pre-enqueued steering"}) + + // Process a normal message - the initial steering poll should inject the steering message + _, err = al.ProcessDirectWithChannel( + context.Background(), + "initial message", + "test-session", + "test", + "chat1", + ) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + + // The steering message should have been injected into the conversation + capMu.Lock() + msgs := capturedMessages + capMu.Unlock() + + // Look for the steering message in the captured messages + found := false + for _, m := range msgs { + if m.Content == "pre-enqueued steering" { + found = true + break + } + } + if !found { + t.Fatal("expected steering message to be injected into conversation context") + } +} + +// capturingMockProvider captures messages sent to Chat for inspection. +type capturingMockProvider struct { + response string + calls int + captureFn func([]providers.Message) +} + +func (m *capturingMockProvider) Chat( + ctx context.Context, + messages []providers.Message, + tools []providers.ToolDefinition, + model string, + opts map[string]any, +) (*providers.LLMResponse, error) { + m.calls++ + if m.captureFn != nil { + m.captureFn(messages) + } + return &providers.LLMResponse{ + Content: m.response, + ToolCalls: []providers.ToolCall{}, + }, nil +} + +func (m *capturingMockProvider) GetDefaultModel() string { + return "capturing-mock" +} + +func TestAgentLoop_Steering_SkippedToolsHaveErrorResults(t *testing.T) { + tmpDir, err := os.MkdirTemp("", "agent-test-*") + if err != nil { + t.Fatalf("Failed to create temp dir: %v", err) + } + defer os.RemoveAll(tmpDir) + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: tmpDir, + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + + execCh := make(chan struct{}) + tool1 := &slowTool{name: "slow_tool", duration: 50 * time.Millisecond, execCh: execCh} + tool2 := &slowTool{name: "skipped_tool", duration: 50 * time.Millisecond} + + // Provider that captures messages on the second call (after tools) + var secondCallMessages []providers.Message + var capMu sync.Mutex + callCount := 0 + + provider := &toolCallProvider{ + toolCalls: []providers.ToolCall{ + { + ID: "call_1", + Type: "function", + Name: "slow_tool", + Function: &providers.FunctionCall{ + Name: "slow_tool", + Arguments: "{}", + }, + Arguments: map[string]any{}, + }, + { + ID: "call_2", + Type: "function", + Name: "skipped_tool", + Function: &providers.FunctionCall{ + Name: "skipped_tool", + Arguments: "{}", + }, + Arguments: map[string]any{}, + }, + }, + finalResp: "done", + } + + // Wrap provider to capture messages on second call + wrappedProvider := &wrappingProvider{ + inner: provider, + onChat: func(msgs []providers.Message) { + capMu.Lock() + callCount++ + if callCount >= 2 { + secondCallMessages = make([]providers.Message, len(msgs)) + copy(secondCallMessages, msgs) + } + capMu.Unlock() + }, + } + + msgBus := bus.NewMessageBus() + al := NewAgentLoop(cfg, msgBus, wrappedProvider) + al.RegisterTool(tool1) + al.RegisterTool(tool2) + + resultCh := make(chan string, 1) + go func() { + resp, _ := al.ProcessDirectWithChannel( + context.Background(), "go", "test-session", "test", "chat1", + ) + resultCh <- resp + }() + + <-execCh + al.Steer(providers.Message{Role: "user", Content: "interrupt!"}) + + select { + case <-resultCh: + case <-time.After(5 * time.Second): + t.Fatal("timeout") + } + + // Check that the skipped tool result message is in the conversation + capMu.Lock() + msgs := secondCallMessages + capMu.Unlock() + + foundSkipped := false + for _, m := range msgs { + if m.Role == "tool" && m.ToolCallID == "call_2" && m.Content == "Skipped due to queued user message." { + foundSkipped = true + break + } + } + if !foundSkipped { + // Log what we actually got + for i, m := range msgs { + t.Logf("msg[%d]: role=%s toolCallID=%s content=%s", i, m.Role, m.ToolCallID, truncate(m.Content, 80)) + } + t.Fatal("expected skipped tool result for call_2") + } +} + +func truncate(s string, n int) string { + if len(s) <= n { + return s + } + return s[:n] + "..." +} + +// wrappingProvider wraps another provider to hook into Chat calls. +type wrappingProvider struct { + inner providers.LLMProvider + onChat func([]providers.Message) +} + +func (w *wrappingProvider) Chat( + ctx context.Context, + messages []providers.Message, + tools []providers.ToolDefinition, + model string, + opts map[string]any, +) (*providers.LLMResponse, error) { + if w.onChat != nil { + w.onChat(messages) + } + return w.inner.Chat(ctx, messages, tools, model, opts) +} + +func (w *wrappingProvider) GetDefaultModel() string { + return w.inner.GetDefaultModel() +} + +// Ensure NormalizeToolCall handles our test tool calls. +func init() { + // This is a no-op init; we just need the tool call tests to work + // with the proper argument serialization. + _ = json.Marshal +} diff --git a/pkg/config/config.go b/pkg/config/config.go index 190341224..a8b8f337f 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -234,6 +234,7 @@ type AgentDefaults struct { SummarizeTokenPercent int `json:"summarize_token_percent" env:"PICOCLAW_AGENTS_DEFAULTS_SUMMARIZE_TOKEN_PERCENT"` MaxMediaSize int `json:"max_media_size,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_MEDIA_SIZE"` Routing *RoutingConfig `json:"routing,omitempty"` + SteeringMode string `json:"steering_mode,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_STEERING_MODE"` // "one-at-a-time" (default) or "all" } const DefaultMaxMediaSize = 20 * 1024 * 1024 // 20 MB diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 189af0a84..5e6b89a4c 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -35,6 +35,7 @@ func DefaultConfig() *Config { MaxToolIterations: 50, SummarizeMessageThreshold: 20, SummarizeTokenPercent: 75, + SteeringMode: "one-at-a-time", }, }, Bindings: []AgentBinding{}, From d5c2bc538a60dbaaccc5a644757575caa644677c Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 15 Mar 2026 22:12:03 +0100 Subject: [PATCH 012/234] feat(tool): markdown format in output web_fetch tool --- README.fr.md | 3 + README.ja.md | 3 + README.md | 3 + README.pt-br.md | 3 + README.zh.md | 3 + config/config.example.json | 5 +- docs/tools_configuration.md | 9 + pkg/agent/loop.go | 6 +- pkg/config/config.go | 1 + pkg/config/defaults.go | 1 + pkg/tools/web.go | 71 +++++-- pkg/tools/web_test.go | 42 ++-- pkg/utils/markdown.go | 413 ++++++++++++++++++++++++++++++++++++ pkg/utils/markdown_test.go | 245 +++++++++++++++++++++ 14 files changed, 769 insertions(+), 39 deletions(-) create mode 100644 pkg/utils/markdown.go create mode 100644 pkg/utils/markdown_test.go diff --git a/README.fr.md b/README.fr.md index 49a02fb77..ac6bdcbd6 100644 --- a/README.fr.md +++ b/README.fr.md @@ -251,6 +251,9 @@ picoclaw onboard }, "tools": { "web": { + "enabled": true, + "fetch_limit_bytes": 10485760, + "format": "plaintext", "brave": { "enabled": false, "api_key": "VOTRE_CLE_API_BRAVE", diff --git a/README.ja.md b/README.ja.md index c0d27de4f..61b35a91b 100644 --- a/README.ja.md +++ b/README.ja.md @@ -216,6 +216,9 @@ picoclaw onboard }, "tools": { "web": { + "enabled": true, + "fetch_limit_bytes": 10485760, + "format": "plaintext", "search": { "api_key": "YOUR_BRAVE_API_KEY", "max_results": 5 diff --git a/README.md b/README.md index 159ac706f..39c8d14b0 100644 --- a/README.md +++ b/README.md @@ -270,6 +270,9 @@ picoclaw onboard ], "tools": { "web": { + "enabled": true, + "fetch_limit_bytes": 10485760, + "format": "plaintext", "brave": { "enabled": false, "api_key": "YOUR_BRAVE_API_KEY", diff --git a/README.pt-br.md b/README.pt-br.md index 56946139b..0b0620b16 100644 --- a/README.pt-br.md +++ b/README.pt-br.md @@ -245,6 +245,9 @@ picoclaw onboard }, "tools": { "web": { + "enabled": true, + "fetch_limit_bytes": 10485760, + "format": "plaintext", "brave": { "enabled": false, "api_key": "YOUR_BRAVE_API_KEY", diff --git a/README.zh.md b/README.zh.md index 9877ef9f4..4d15060a5 100644 --- a/README.zh.md +++ b/README.zh.md @@ -255,6 +255,9 @@ picoclaw onboard ], "tools": { "web": { + "enabled": true, + "fetch_limit_bytes": 10485760, + "format": "plaintext", "brave": { "enabled": false, "api_key": "YOUR_BRAVE_API_KEY", diff --git a/config/config.example.json b/config/config.example.json index 1c11cd42a..f08989c4d 100644 --- a/config/config.example.json +++ b/config/config.example.json @@ -313,6 +313,8 @@ "allow_write_paths": null, "web": { "enabled": true, + "fetch_limit_bytes": 10485760, + "format": "plaintext", "brave": { "enabled": false, "api_key": "YOUR_BRAVE_API_KEY", @@ -350,8 +352,7 @@ "base_url": "https://open.bigmodel.cn/api/paas/v4/web_search", "search_engine": "search_std", "max_results": 5 - }, - "fetch_limit_bytes": 10485760 + } }, "cron": { "enabled": true, diff --git a/docs/tools_configuration.md b/docs/tools_configuration.md index 8c8eb31f0..ae3252e7c 100644 --- a/docs/tools_configuration.md +++ b/docs/tools_configuration.md @@ -30,6 +30,15 @@ PicoClaw's tools configuration is located in the `tools` field of `config.json`. Web tools are used for web search and fetching. +### Web Fetcher +General settings for fetching and processing webpage content. + +| Config | Type | Default | Description | +|---------------------|--------|---------------|-----------------------------------------------------------------------------------------------| +| `enabled` | bool | true | Enable the webpage fetching capability. | +| `fetch_limit_bytes` | int | 10485760 | Maximum size of the webpage payload to fetch, in bytes (default is 10MB). | +| `format` | string | "plaintext" | Output format of the fetched content. Options: `plaintext` or `markdown` (recommended). | + ### Brave | Config | Type | Default | Description | diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index f20a56b9c..5700a67b4 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -157,7 +157,11 @@ func registerSharedTools( } } if cfg.Tools.IsToolEnabled("web_fetch") { - fetchTool, err := tools.NewWebFetchToolWithProxy(50000, cfg.Tools.Web.Proxy, cfg.Tools.Web.FetchLimitBytes) + fetchTool, err := tools.NewWebFetchToolWithProxy( + 50000, + cfg.Tools.Web.Proxy, + cfg.Tools.Web.Format, + cfg.Tools.Web.FetchLimitBytes) if err != nil { logger.ErrorCF("agent", "Failed to create web fetch tool", map[string]any{"error": err.Error()}) } else { diff --git a/pkg/config/config.go b/pkg/config/config.go index 190341224..9f6253cdc 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -694,6 +694,7 @@ type WebToolsConfig struct { // For authenticated proxies, prefer HTTP_PROXY/HTTPS_PROXY env vars instead of embedding credentials in config. Proxy string `json:"proxy,omitempty" env:"PICOCLAW_TOOLS_WEB_PROXY"` FetchLimitBytes int64 `json:"fetch_limit_bytes,omitempty" env:"PICOCLAW_TOOLS_WEB_FETCH_LIMIT_BYTES"` + Format string `json:"format,omitempty" env:"PICOCLAW_TOOLS_WEB_FORMAT"` } type CronToolsConfig struct { diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index dc534d852..d0e528e12 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -412,6 +412,7 @@ func DefaultConfig() *Config { }, Proxy: "", FetchLimitBytes: 10 * 1024 * 1024, // 10MB by default + Format: "plaintext", Brave: BraveConfig{ Enabled: false, APIKey: "", diff --git a/pkg/tools/web.go b/pkg/tools/web.go index e5036d3a8..64df27780 100644 --- a/pkg/tools/web.go +++ b/pkg/tools/web.go @@ -7,6 +7,7 @@ import ( "errors" "fmt" "io" + "mime" "net" "net/http" "net/url" @@ -28,6 +29,7 @@ const ( defaultMaxChars = 50000 maxRedirects = 5 + format = "plaintext" ) // Pre-compiled regexes for HTML text extraction @@ -776,19 +778,20 @@ type WebFetchTool struct { maxChars int proxy string client *http.Client + format string fetchLimitBytes int64 } -func NewWebFetchTool(maxChars int, fetchLimitBytes int64) (*WebFetchTool, error) { +func NewWebFetchTool(maxChars int, format string, fetchLimitBytes int64) (*WebFetchTool, error) { // createHTTPClient cannot fail with an empty proxy string. - return NewWebFetchToolWithProxy(maxChars, "", fetchLimitBytes) + return NewWebFetchToolWithProxy(maxChars, "", format, fetchLimitBytes) } // allowPrivateWebFetchHosts controls whether loopback/private hosts are allowed. // This is false in normal runtime to reduce SSRF exposure, and tests can override it temporarily. var allowPrivateWebFetchHosts atomic.Bool -func NewWebFetchToolWithProxy(maxChars int, proxy string, fetchLimitBytes int64) (*WebFetchTool, error) { +func NewWebFetchToolWithProxy(maxChars int, proxy string, format string, fetchLimitBytes int64) (*WebFetchTool, error) { if maxChars <= 0 { maxChars = defaultMaxChars } @@ -819,6 +822,7 @@ func NewWebFetchToolWithProxy(maxChars int, proxy string, fetchLimitBytes int64) maxChars: maxChars, proxy: proxy, client: client, + format: format, fetchLimitBytes: fetchLimitBytes, }, nil } @@ -906,26 +910,50 @@ func (t *WebFetchTool) Execute(ctx context.Context, args map[string]any) *ToolRe return ErrorResult(fmt.Sprintf("failed to read response: %v", err)) } + bodyStr := string(body) contentType := resp.Header.Get("Content-Type") + mediaType, _, _ := mime.ParseMediaType(contentType) + var text, extractor string - if strings.Contains(contentType, "application/json") { + switch { + case mediaType == "application/json": var jsonData any - if err := json.Unmarshal(body, &jsonData); err == nil { - formatted, _ := json.MarshalIndent(jsonData, "", " ") - text = string(formatted) - extractor = "json" - } else { - text = string(body) + if err := json.Unmarshal(body, &jsonData); err != nil { + text = bodyStr extractor = "raw" + break } - } else if strings.Contains(contentType, "text/html") || len(body) > 0 && - (strings.HasPrefix(string(body), "]*>\)\]\(<[^>]*>\)`) + reEmptyHeader = regexp.MustCompile(`(?m)^#{1,6}\s*$`) + reLeadingLineSpace = regexp.MustCompile(`(?m)^([ \t])([^ \t\n])`) +) + +var skipTags = map[string]bool{ + "script": true, "style": true, "head": true, + "noscript": true, "template": true, + "nav": true, "footer": true, "aside": true, "header": true, "form": true, "dialog": true, +} + +func isSafeHref(href string) bool { + lower := strings.ToLower(strings.TrimSpace(href)) + if strings.HasPrefix(lower, "javascript:") || strings.HasPrefix(lower, "vbscript:") || + strings.HasPrefix(lower, "data:") { + return false + } + u, err := url.Parse(strings.TrimSpace(href)) + if err != nil { + return false + } + scheme := strings.ToLower(u.Scheme) + return scheme == "" || scheme == "http" || scheme == "https" || scheme == "mailto" +} + +func isSafeImageSrc(src string) bool { + lower := strings.ToLower(strings.TrimSpace(src)) + if strings.HasPrefix(lower, "data:image/") { + return true + } + return isSafeHref(src) +} + +func escapeMdAlt(s string) string { + s = strings.ReplaceAll(s, `\`, `\\`) + s = strings.ReplaceAll(s, `[`, `\[`) + s = strings.ReplaceAll(s, `]`, `\]`) + return s +} + +func getAttr(n *html.Node, key string) string { + for _, a := range n.Attr { + if a.Key == key { + return a.Val + } + } + return "" +} + +func normalizeAttr(val string) string { + val = strings.ReplaceAll(val, "\n", "") + val = strings.ReplaceAll(val, "\r", "") + val = strings.ReplaceAll(val, "\t", "") + return strings.TrimSpace(val) +} + +func isUnlikelyNode(n *html.Node) bool { + if n.Type != html.ElementNode { + return false + } + classId := strings.ToLower(getAttr(n, "class") + " " + getAttr(n, "id")) + if classId == " " { + return false + } + if strings.Contains(classId, "article") || strings.Contains(classId, "main") || + strings.Contains(classId, "content") { + return false + } + unlikelyKeywords := []string{ + "menu", + "nav", + "footer", + "sidebar", + "cookie", + "banner", + "sponsor", + "advert", + "popup", + "modal", + "newsletter", + "share", + "social", + } + for _, keyword := range unlikelyKeywords { + if strings.Contains(classId, keyword) { + return true + } + } + return false +} + +type converter struct { + stack []*bytes.Buffer + linkHrefs []string + linkStates []bool + emphStack []string // Tracks "**", "*", "~~" for buffered emphasis + olCounters []int + inPre bool + listDepth int +} + +func newConverter() *converter { + return &converter{ + stack: []*bytes.Buffer{{}}, + } +} + +func (c *converter) write(s string) { + c.stack[len(c.stack)-1].WriteString(s) +} + +func (c *converter) pushBuf() { + c.stack = append(c.stack, &bytes.Buffer{}) +} + +func (c *converter) popBuf() string { + top := c.stack[len(c.stack)-1] + c.stack = c.stack[:len(c.stack)-1] + return top.String() +} + +func (c *converter) walk(n *html.Node) { + if n.Type == html.ElementNode { + if skipTags[n.Data] { + return + } + if isUnlikelyNode(n) { + return + } + } + + if n.Type == html.TextNode { + text := n.Data + if !c.inPre { + text = strings.ReplaceAll(text, "\n", " ") + text = reSpaces.ReplaceAllString(text, " ") + } + if text != "" { + c.write(text) + } + return + } + + if n.Type != html.ElementNode { + for ch := n.FirstChild; ch != nil; ch = ch.NextSibling { + c.walk(ch) + } + return + } + + // Opening Tags + switch n.Data { + + // Buffer emphasis content so we can TrimSpace the inner text, + // avoiding the regex-across-boundaries bug. + case "b", "strong": + c.emphStack = append(c.emphStack, "**") + c.pushBuf() + case "i", "em": + c.emphStack = append(c.emphStack, "*") + c.pushBuf() + case "del", "s": + c.emphStack = append(c.emphStack, "~~") + c.pushBuf() + + case "a": + href := normalizeAttr(getAttr(n, "href")) + if href != "" && !isSafeHref(href) { + href = "#" + } + hasHref := href != "" + c.linkStates = append(c.linkStates, hasHref) + if hasHref { + c.linkHrefs = append(c.linkHrefs, href) + c.pushBuf() + } + + case "h1": + c.write("\n\n# ") + case "h2": + c.write("\n\n## ") + case "h3": + c.write("\n\n### ") + case "h4": + c.write("\n\n#### ") + case "h5": + c.write("\n\n##### ") + case "h6": + c.write("\n\n###### ") + + case "p": + c.write("\n\n") + case "br": + c.write("\n") + case "hr": + c.write("\n\n---\n\n") + + case "ol": + c.olCounters = append(c.olCounters, 1) + // Only write leading newline for top-level list. + if c.listDepth == 0 { + c.write("\n") + } + c.listDepth++ + case "ul": + if c.listDepth == 0 { + c.write("\n") + } + c.listDepth++ + case "li": + c.write("\n") + if c.listDepth > 1 { + c.write(strings.Repeat(" ", c.listDepth-1)) + } + if n.Parent != nil && n.Parent.Data == "ol" && len(c.olCounters) > 0 { + idx := c.olCounters[len(c.olCounters)-1] + c.write(strconv.Itoa(idx) + ". ") + c.olCounters[len(c.olCounters)-1]++ + } else { + c.write("- ") + } + + case "pre": + c.inPre = true + c.write("\n\n```\n") + case "code": + if !c.inPre { + c.write("`") + } + + case "blockquote": + c.pushBuf() + for ch := n.FirstChild; ch != nil; ch = ch.NextSibling { + c.walk(ch) + } + inner := strings.TrimSpace(c.popBuf()) + lines := strings.Split(inner, "\n") + var quoted []string + for _, l := range lines { + if strings.TrimSpace(l) == "" { + quoted = append(quoted, ">") + } else { + quoted = append(quoted, "> "+l) + } + } + var deduped []string + for i, line := range quoted { + if line == ">" && i > 0 && deduped[len(deduped)-1] == ">" { + continue + } + deduped = append(deduped, line) + } + c.write("\n\n" + strings.Join(deduped, "\n") + "\n\n") + return + + case "img": + src := normalizeAttr(getAttr(n, "src")) + if src == "" { + src = normalizeAttr(getAttr(n, "data-src")) + } + if src == "" { + return + } + alt := escapeMdAlt(normalizeAttr(getAttr(n, "alt"))) + if isSafeImageSrc(src) { + c.write("![" + alt + "](" + src + ")") + } + return + } + + // Traverse Children + for ch := n.FirstChild; ch != nil; ch = ch.NextSibling { + c.walk(ch) + } + + // Closing Tags + switch n.Data { + + // Pop buffer, trim, wrap with the correct marker. + case "b", "strong", "i", "em", "del", "s": + if len(c.emphStack) == 0 { + break + } + marker := c.emphStack[len(c.emphStack)-1] + c.emphStack = c.emphStack[:len(c.emphStack)-1] + inner := strings.TrimSpace(c.popBuf()) + if inner != "" { + c.write(marker + inner + marker) + } + + case "a": + if len(c.linkStates) == 0 { + break + } + hasHref := c.linkStates[len(c.linkStates)-1] + c.linkStates = c.linkStates[:len(c.linkStates)-1] + if !hasHref { + break + } + href := c.linkHrefs[len(c.linkHrefs)-1] + c.linkHrefs = c.linkHrefs[:len(c.linkHrefs)-1] + inner := strings.TrimSpace(c.popBuf()) + if strings.Contains(inner, "\n") { + lines := strings.Split(inner, "\n") + linked := false + for i, l := range lines { + cleanLine := strings.TrimSpace(l) + if cleanLine != "" && !strings.HasPrefix(cleanLine, "![") && !linked { + lines[i] = "[" + cleanLine + "](" + href + ")" + linked = true + } + } + c.write(strings.Join(lines, "\n")) + } else { + c.write("[" + inner + "](" + href + ")") + } + + case "h1", + "h2", + "h3", + "h4", + "h5", + "h6", + "p", + "div", + "section", + "article", + "header", + "footer", + "aside", + "nav", + "figure": + c.write("\n") + + case "ol": + c.listDepth-- + if len(c.olCounters) > 0 { + c.olCounters = c.olCounters[:len(c.olCounters)-1] + } + if c.listDepth == 0 { + c.write("\n") + } + case "ul": + c.listDepth-- + if c.listDepth == 0 { + c.write("\n") + } + + case "pre": + c.inPre = false + c.write("\n```\n\n") + case "code": + if !c.inPre { + c.write("`") + } + } +} + +func HtmlToMarkdown(htmlStr string) (string, error) { + doc, err := html.Parse(strings.NewReader(htmlStr)) + if err != nil { + return "", err + } + + c := newConverter() + c.walk(doc) + + res := c.stack[0].String() + + // Post-processing + res = reImageOnlyLink.ReplaceAllString(res, "") + res = reEmptyListItem.ReplaceAllString(res, "") + res = reEmptyHeader.ReplaceAllString(res, "") + + lines := strings.Split(res, "\n") + var cleanLines []string + for _, line := range lines { + line = strings.TrimRight(line, " \t") + cleanTest := strings.TrimSpace(line) + if cleanTest == "[]()" || cleanTest == "[](#)" || cleanTest == "-" { + cleanLines = append(cleanLines, "") + continue + } + cleanLines = append(cleanLines, line) + } + res = strings.Join(cleanLines, "\n") + + res = strings.TrimSpace(res) + res = reNewlines.ReplaceAllString(res, "\n\n") + + // Strip a single leading space from lines that are NOT list indentation. + // "(?m)^([ \t])([^ \t\n])" matches exactly one space/tab at line start followed + // by a non-whitespace char, so " - nested" (4 spaces) is left untouched. + res = reLeadingLineSpace.ReplaceAllString(res, "$2") + + return res, nil +} diff --git a/pkg/utils/markdown_test.go b/pkg/utils/markdown_test.go new file mode 100644 index 000000000..72277fb91 --- /dev/null +++ b/pkg/utils/markdown_test.go @@ -0,0 +1,245 @@ +package utils + +import ( + "testing" + + "github.com/sipeed/picoclaw/pkg/logger" +) + +func TestHtmlToMarkdown(t *testing.T) { + // Define our test cases + tests := []struct { + name string + input string + expected string + }{ + { + name: "Removes scripts and styles", + input: `

Clean text

`, + expected: "Clean text", + }, + { + name: "Extracts links correctly", + input: `Visit my website for info.`, + expected: "Visit my [website](https://example.com) for info.", + }, + { + name: "Converts headers (H1, H2, H3)", + input: `

Main Title

Subtitle

Section

`, + expected: "# Main Title\n\n## Subtitle\n\n### Section", + }, + { + name: "Handles bold and italics", + input: `Text bold and strong, then italic and em.`, + expected: "Text **bold** and **strong**, then *italic* and *em*.", + }, + { + name: "Converts lists", + input: `
  • First element
  • Second element
`, + expected: "- First element\n- Second element", + }, + { + name: "Handles paragraphs and line breaks (
)", + input: `

First paragraph

Second paragraph with
a line break.

`, + expected: "First paragraph\n\nSecond paragraph with\na line break.", + }, + { + name: "Decodes HTML entities", + input: `Math: 5 > 3 & 2 < 4. A "quote".`, + expected: "Math: 5 > 3 & 2 < 4. A \"quote\".", + }, + { + name: "Cleans up residual HTML tags", + input: `
Text inside div and span
`, + expected: "Text inside div and span", + }, + { + name: "Removes multiple spaces and excessive empty lines", + input: `This text has too many spaces.



And too many newlines.`, + expected: "This text has too many spaces.\n\nAnd too many newlines.", + }, + { + name: "Nested lists with indentation", + input: "
  • One
    • Two
", + // Expect the sub-element to have 4 spaces of indentation + expected: "- One\n - Two", + }, + { + name: "Image support", + input: `alternative text`, + // Correct Markdown syntax for images + expected: "![alternative text](image.jpg)", + }, + { + name: "Image support without alt-text", + input: ``, + // If alt is missing, square brackets remain empty + expected: "![](image.jpg)", + }, + { + name: "XSS Bypass on Links (Obfuscated HTML entities)", + // The Go HTML parser resolves entities, so this becomes "javascript:alert(1)" + input: `Click here`, + // Our isSafeHref (if updated with net/url) should neutralize it to "#" + expected: "[Click here](#)", + }, + { + name: "Empty link or used as anchor", + input: ``, + // With no text or href, it shouldn't print anything (not even empty brackets) + expected: "", + }, + { + name: "Link without href but with text (Textual anchor)", + input: `Back to top`, + // Should extract only plain text, without generating a broken Markdown link like [Back to top](#) or [Back to top]() + expected: "Back to top", + }, + { + name: "Badly spaced bold and italics (Edge Case)", + input: ` Text `, + // In Markdown `** Text **` is often not formatted correctly. The ideal is `**Text**` + expected: "**Text**", + }, + { + name: "Complex Test - Real Article", + input: ` +

Article Title

+

This is an introductory text with a link.

+

Subtitle

+
    +
  • Point one
    • +
  • Point two
    • +
+ + `, + // Note: The indentation of the real HTML test will generate spaces that + // regex will clean up. + expected: "# Article Title\n\nThis is an **introductory text** with a [link](http://link.com).\n\n## Subtitle\n\n- Point one\n- Point two", + }, + { + name: "Ordered list (OL)", + input: `
  1. First
  2. Second
  3. Third
`, + expected: "1. First\n2. Second\n3. Third", + }, + { + name: "Ordered list nested in unordered list", + input: `
  • Fruits
    1. Apples
    2. Pears
  • Vegetables
`, + expected: "- Fruits\n 1. Apples\n 2. Pears\n- Vegetables", + }, + { + name: "Code block (pre/code)", + input: "
func main() {\n    fmt.Println(\"hello\")\n}
", + expected: "```\nfunc main() {\n fmt.Println(\"hello\")\n}\n```", + }, + { + name: "Inline code", + input: `

Use the command go test ./... to run the tests.

`, + expected: "Use the command `go test ./...` to run the tests.", + }, + { + name: "Simple blockquote", + input: `

An important quote.

`, + expected: "> An important quote.", + }, + { + name: "Multiline blockquote", + input: `

First line of the quote.

Second line of the quote.

`, + expected: "> First line of the quote.\n>\n> Second line of the quote.", + }, + { + name: "Strikethrough text (del/s)", + input: `This text is deleted and this is crossed out.`, + expected: "This text is ~~deleted~~ and this is ~~crossed out~~.", + }, + { + name: "Horizontal separator (HR)", + input: `

Above the line

Below the line

`, + expected: "Above the line\n\n---\n\nBelow the line", + }, + { + name: "Bold nested in link", + input: `Linked bold text`, + expected: "[**Linked bold text**](https://example.com)", + }, + { + name: "data-src Image (lazy loading)", + input: `Lazy image`, + expected: "![Lazy image](lazy.jpg)", + }, + { + name: "Image with javascript: src blocked", + input: `XSS`, + // src is not safe, so the image is not emitted + expected: "", + }, + { + name: "Link with data: href blocked", + input: `Click`, + expected: "[Click](#)", + }, + { + name: "Deeply nested divs", + input: `

Deeply nested text

`, + expected: "Deeply nested text", + }, + { + name: "Non-consecutive headers (H1, H3, H5)", + input: `

Title

Subsection

Sub-subsection
`, + expected: "# Title\n\n### Subsection\n\n##### Sub-subsection", + }, + { + name: "Paragraph with mixed multiple emphasis", + input: `

Important: read the critical instructions carefully.

`, + expected: "**Important:** read the ***critical instructions*** *carefully*.", + }, + { + name: "Article with nav and aside sections (noise to filter)", + input: ` + +
+

Article title

+

This is the body of the article.

+
+ + `, + expected: "## Article title\n\nThis is the body of the article.", + }, + { + name: "Text with mixed special HTML entities", + input: `Copyright © 2024 — All rights reserved ®`, + expected: "Copyright © 2024 — All rights reserved ®", + }, + { + name: "Mailto link", + input: `Write to us at info@example.com`, + expected: "Write to us at [info@example.com](mailto:info@example.com)", + }, + { + name: "Image inside a link (clickable figure)", + input: `Photo`, + // The image-link without text must not generate broken markup + expected: "[![Photo](photo.jpg)](https://example.com)", + }, + { + name: "Empty content or only whitespace", + input: `

`, + expected: "", + }, + } + + // Iterate over all test cases + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, err := HtmlToMarkdown(tt.input) + if err != nil { + logger.ErrorCF("tool", "Failed to parse html to markdown: %s", map[string]any{"error": err.Error()}) + } + + if got != tt.expected { + t.Errorf("\nTest case failed: %s\nInput: %q\nGot: %q\nExpected: %q", + tt.name, tt.input, got, tt.expected) + } + }) + } +} From de68688c75dfb5d1cf50ad011bfbc1554b8b9d34 Mon Sep 17 00:00:00 2001 From: afjcjsbx Date: Sun, 15 Mar 2026 22:30:02 +0100 Subject: [PATCH 013/234] fix lint --- pkg/tools/web.go | 1 - pkg/utils/markdown.go | 2 -- 2 files changed, 3 deletions(-) diff --git a/pkg/tools/web.go b/pkg/tools/web.go index 64df27780..176b1628d 100644 --- a/pkg/tools/web.go +++ b/pkg/tools/web.go @@ -938,7 +938,6 @@ func (t *WebFetchTool) Execute(ctx context.Context, args map[string]any) *ToolRe case mediaType == "text/html" || looksLikeHTML(bodyStr): switch strings.ToLower(t.format) { - case "markdown": var err error text, err = utils.HtmlToMarkdown(bodyStr) diff --git a/pkg/utils/markdown.go b/pkg/utils/markdown.go index db66b04ad..c7873252a 100644 --- a/pkg/utils/markdown.go +++ b/pkg/utils/markdown.go @@ -166,7 +166,6 @@ func (c *converter) walk(n *html.Node) { // Opening Tags switch n.Data { - // Buffer emphasis content so we can TrimSpace the inner text, // avoiding the regex-across-boundaries bug. case "b", "strong": @@ -291,7 +290,6 @@ func (c *converter) walk(n *html.Node) { // Closing Tags switch n.Data { - // Pop buffer, trim, wrap with the correct marker. case "b", "strong", "i", "em", "del", "s": if len(c.emphStack) == 0 { From c8065989b0f04336d94ed8aa815a5280778c7462 Mon Sep 17 00:00:00 2001 From: wenjie Date: Mon, 16 Mar 2026 11:58:06 +0800 Subject: [PATCH 014/234] chore(web): upgrade eslint deps to resolve flatted vulnerability (#1629) --- web/frontend/package.json | 4 ++-- web/frontend/pnpm-lock.yaml | 28 ++++++++++++++-------------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/web/frontend/package.json b/web/frontend/package.json index f3bae6d6a..973586519 100644 --- a/web/frontend/package.json +++ b/web/frontend/package.json @@ -40,7 +40,7 @@ "wrap-ansi": "^10.0.0" }, "devDependencies": { - "@eslint/js": "^9.39.1", + "@eslint/js": "^9.39.3", "@tailwindcss/typography": "^0.5.19", "@tanstack/router-plugin": "^1.164.0", "@trivago/prettier-plugin-sort-imports": "^6.0.2", @@ -49,7 +49,7 @@ "@types/react-dom": "^19.2.3", "@typescript-eslint/eslint-plugin": "^8.56.1", "@vitejs/plugin-react": "^5.2.0", - "eslint": "^9.39.1", + "eslint": "^9.39.3", "eslint-config-prettier": "^10.1.8", "eslint-plugin-react-hooks": "^7.0.1", "eslint-plugin-react-refresh": "^0.4.24", diff --git a/web/frontend/pnpm-lock.yaml b/web/frontend/pnpm-lock.yaml index ac2168798..20f0a7342 100644 --- a/web/frontend/pnpm-lock.yaml +++ b/web/frontend/pnpm-lock.yaml @@ -85,7 +85,7 @@ importers: version: 10.0.0 devDependencies: '@eslint/js': - specifier: ^9.39.1 + specifier: ^9.39.3 version: 9.39.3 '@tailwindcss/typography': specifier: ^0.5.19 @@ -112,7 +112,7 @@ importers: specifier: ^5.2.0 version: 5.2.0(vite@7.3.1(@types/node@24.11.0)(jiti@2.6.1)(lightningcss@1.31.1)(tsx@4.21.0)) eslint: - specifier: ^9.39.1 + specifier: ^9.39.3 version: 9.39.3(jiti@2.6.1) eslint-config-prettier: specifier: ^10.1.8 @@ -469,8 +469,8 @@ packages: resolution: {integrity: sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==} engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0} - '@eslint/config-array@0.21.1': - resolution: {integrity: sha512-aw1gNayWpdI/jSYVgzN5pL0cfzU02GT3NBpeT/DXbx1/1x7ZKxFPd9bwrzygx/qiwIQiJ1sw/zD8qY/kRvlGHA==} + '@eslint/config-array@0.21.2': + resolution: {integrity: sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} '@eslint/config-helpers@0.4.2': @@ -481,8 +481,8 @@ packages: resolution: {integrity: sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} - '@eslint/eslintrc@3.3.4': - resolution: {integrity: sha512-4h4MVF8pmBsncB60r0wSJiIeUKTSD4m7FmTFThG8RHlsg9ajqckLm9OraguFGZE4vVdpiI1Q4+hFnisopmG6gQ==} + '@eslint/eslintrc@3.3.5': + resolution: {integrity: sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==} engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0} '@eslint/js@9.39.3': @@ -2362,8 +2362,8 @@ packages: resolution: {integrity: sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==} engines: {node: '>=16'} - flatted@3.3.3: - resolution: {integrity: sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==} + flatted@3.4.1: + resolution: {integrity: sha512-IxfVbRFVlV8V/yRaGzk0UVIcsKKHMSfYw66T/u4nTwlWteQePsxe//LjudR1AMX4tZW3WFCh3Zqa/sjlqpbURQ==} formdata-polyfill@4.0.10: resolution: {integrity: sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==} @@ -4285,7 +4285,7 @@ snapshots: '@eslint-community/regexpp@4.12.2': {} - '@eslint/config-array@0.21.1': + '@eslint/config-array@0.21.2': dependencies: '@eslint/object-schema': 2.1.7 debug: 4.4.3 @@ -4301,7 +4301,7 @@ snapshots: dependencies: '@types/json-schema': 7.0.15 - '@eslint/eslintrc@3.3.4': + '@eslint/eslintrc@3.3.5': dependencies: ajv: 6.14.0 debug: 4.4.3 @@ -6077,10 +6077,10 @@ snapshots: dependencies: '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.3(jiti@2.6.1)) '@eslint-community/regexpp': 4.12.2 - '@eslint/config-array': 0.21.1 + '@eslint/config-array': 0.21.2 '@eslint/config-helpers': 0.4.2 '@eslint/core': 0.17.0 - '@eslint/eslintrc': 3.3.4 + '@eslint/eslintrc': 3.3.5 '@eslint/js': 9.39.3 '@eslint/plugin-kit': 0.4.1 '@humanfs/node': 0.16.7 @@ -6270,10 +6270,10 @@ snapshots: flat-cache@4.0.1: dependencies: - flatted: 3.3.3 + flatted: 3.4.1 keyv: 4.5.4 - flatted@3.3.3: {} + flatted@3.4.1: {} formdata-polyfill@4.0.10: dependencies: From 2f10b47f59f01a34ef989fd919d84c6212b5f0ad Mon Sep 17 00:00:00 2001 From: sky5454 Date: Mon, 16 Mar 2026 14:06:32 +0800 Subject: [PATCH 015/234] =?UTF-8?q?feat(credential):=20part1=20add=20AES-G?= =?UTF-8?q?CM=20encryption,=20SecureStore,=20and=20onboard=20ke=E2=80=A6?= =?UTF-8?q?=20(#1521)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat(credential): add AES-GCM encryption, SecureStore, and onboard keygen - pkg/credential: new package with AES-256-GCM enc:// credential format, HKDF-SHA256 key derivation (passphrase + optional SSH key binding), ErrPassphraseRequired / ErrDecryptionFailed sentinel errors, and PassphraseProvider hook for runtime passphrase injection - pkg/credential/store: lock-free SecureStore via atomic.Pointer[string]; passphrase never written to disk or os.Environ - pkg/credential/keygen: ed25519 SSH key generation helper used by onboard - pkg/config: replace os.Getenv(PassphraseEnvVar) with credential.PassphraseProvider() at all three call sites so that LoadConfig and SaveConfig use whatever passphrase source is active - cmd/picoclaw/onboard: prompt for passphrase with echo-off, generate picoclaw-specific SSH key, re-encrypt existing config on re-onboard - docs/credential_encryption.md: design doc for the enc:// format * fix(credential): address Copilot review comments on PR #1521 - credential.go: decouple ErrPassphraseRequired from env var name; message is now 'enc:// passphrase required' since PassphraseProvider may come from any source, not just os.Environ - credential.go: Resolver resolves symlinks via EvalSymlinks before the isWithinDir containment check, preventing symlink-based path traversal for file:// credential references - store.go: tighten comment to describe only what SecureStore guarantees (in-memory only); remove claims about how callers transport the value - store_test.go: replace the meaningless GetReturnsCopy test (Go strings are immutable, equality across two calls proves nothing) with TestSecureStore_ConcurrentSetGet that exercises atomic.Pointer under 10-goroutine concurrent Set/Get load - config_test.go: update error-message assertion to match new sentinel text - docs/credential_encryption.md: remove reference to non-existent 'picoclaw encrypt' subcommand; describe the onboard flow instead * fix(config): encryptPlaintextAPIKeys: struct-based encryption, fail-fast, remove raw []byte * fix(credential): require SSH private key for encryption/decryption, remove passphrase-only mode * lint: fix credential keygen lint, fix test keygen * onboard: make encryption opt-in via --enc flag Encryption (passphrase prompt + SSH key generation) is now only triggered when the user passes --enc to 'picoclaw onboard'. Without the flag, onboard skips the credential-encryption setup and writes a plain config + workspace templates directly. - Add --enc BoolFlag in NewOnboardCommand() - Pass encrypt bool into onboard() - Guard passphrase prompt, SSH key generation, and related env-var setup behind the encrypt branch - Adjust 'Next steps' output so the passphrase reminder only appears when --enc was used --- cmd/picoclaw/internal/onboard/command.go | 7 +- cmd/picoclaw/internal/onboard/command_test.go | 5 +- cmd/picoclaw/internal/onboard/helpers.go | 133 ++++++- docs/credential_encryption.md | 168 ++++++++ pkg/config/config.go | 72 +++- pkg/config/config_test.go | 365 +++++++++++++++++- pkg/credential/credential.go | 335 ++++++++++++++++ pkg/credential/credential_test.go | 283 ++++++++++++++ pkg/credential/keygen.go | 62 +++ pkg/credential/keygen_test.go | 115 ++++++ pkg/credential/store.go | 44 +++ pkg/credential/store_test.go | 81 ++++ 12 files changed, 1649 insertions(+), 21 deletions(-) create mode 100644 docs/credential_encryption.md create mode 100644 pkg/credential/credential.go create mode 100644 pkg/credential/credential_test.go create mode 100644 pkg/credential/keygen.go create mode 100644 pkg/credential/keygen_test.go create mode 100644 pkg/credential/store.go create mode 100644 pkg/credential/store_test.go diff --git a/cmd/picoclaw/internal/onboard/command.go b/cmd/picoclaw/internal/onboard/command.go index ec1012959..9f8b288c6 100644 --- a/cmd/picoclaw/internal/onboard/command.go +++ b/cmd/picoclaw/internal/onboard/command.go @@ -11,14 +11,19 @@ import ( var embeddedFiles embed.FS func NewOnboardCommand() *cobra.Command { + var encrypt bool + cmd := &cobra.Command{ Use: "onboard", Aliases: []string{"o"}, Short: "Initialize picoclaw configuration and workspace", Run: func(cmd *cobra.Command, args []string) { - onboard() + onboard(encrypt) }, } + cmd.Flags().BoolVar(&encrypt, "enc", false, + "Enable credential encryption (generates SSH key and prompts for passphrase)") + return cmd } diff --git a/cmd/picoclaw/internal/onboard/command_test.go b/cmd/picoclaw/internal/onboard/command_test.go index bc799a079..56936190b 100644 --- a/cmd/picoclaw/internal/onboard/command_test.go +++ b/cmd/picoclaw/internal/onboard/command_test.go @@ -24,6 +24,9 @@ func TestNewOnboardCommand(t *testing.T) { assert.Nil(t, cmd.PersistentPreRun) assert.Nil(t, cmd.PersistentPostRun) - assert.False(t, cmd.HasFlags()) + assert.True(t, cmd.HasFlags()) + encFlag := cmd.Flags().Lookup("enc") + require.NotNil(t, encFlag, "expected --enc flag to be registered") + assert.Equal(t, "false", encFlag.DefValue, "--enc should default to false") assert.False(t, cmd.HasSubCommands()) } diff --git a/cmd/picoclaw/internal/onboard/helpers.go b/cmd/picoclaw/internal/onboard/helpers.go index 4db8bdc8b..6f1d4bdd7 100644 --- a/cmd/picoclaw/internal/onboard/helpers.go +++ b/cmd/picoclaw/internal/onboard/helpers.go @@ -6,25 +6,71 @@ import ( "os" "path/filepath" + "golang.org/x/term" + "github.com/sipeed/picoclaw/cmd/picoclaw/internal" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/credential" ) -func onboard() { +func onboard(encrypt bool) { configPath := internal.GetConfigPath() + configExists := false if _, err := os.Stat(configPath); err == nil { - fmt.Printf("Config already exists at %s\n", configPath) - fmt.Print("Overwrite? (y/n): ") - var response string - fmt.Scanln(&response) - if response != "y" { - fmt.Println("Aborted.") - return + configExists = true + if encrypt { + // Only ask for confirmation when *both* config and SSH key already exist, + // indicating a full re-onboard that would reset the config to defaults. + sshKeyPath, _ := credential.DefaultSSHKeyPath() + if _, err := os.Stat(sshKeyPath); err == nil { + // Both exist — confirm a full reset. + fmt.Printf("Config already exists at %s\n", configPath) + fmt.Print("Overwrite config with defaults? (y/n): ") + var response string + fmt.Scanln(&response) + if response != "y" { + fmt.Println("Aborted.") + return + } + configExists = false // user agreed to reset; treat as fresh + } + // Config exists but SSH key is missing — keep existing config, only add SSH key. } } - cfg := config.DefaultConfig() + var err error + if encrypt { + fmt.Println("\nSet up credential encryption") + fmt.Println("-----------------------------") + passphrase, pErr := promptPassphrase() + if pErr != nil { + fmt.Printf("Error: %v\n", pErr) + os.Exit(1) + } + // Expose the passphrase to credential.PassphraseProvider (which calls + // os.Getenv by default) so that SaveConfig can encrypt api_keys. + // This process is a one-shot CLI tool; the env var is never exposed outside + // the current process and disappears when it exits. + os.Setenv(credential.PassphraseEnvVar, passphrase) + + if err = setupSSHKey(); err != nil { + fmt.Printf("Error generating SSH key: %v\n", err) + os.Exit(1) + } + } + + var cfg *config.Config + if configExists { + // Preserve the existing config; SaveConfig will re-encrypt api_keys with the new passphrase. + cfg, err = config.LoadConfig(configPath) + if err != nil { + fmt.Printf("Error loading existing config: %v\n", err) + os.Exit(1) + } + } else { + cfg = config.DefaultConfig() + } if err := config.SaveConfig(configPath, cfg); err != nil { fmt.Printf("Error saving config: %v\n", err) os.Exit(1) @@ -33,9 +79,17 @@ func onboard() { workspace := cfg.WorkspacePath() createWorkspaceTemplates(workspace) - fmt.Printf("%s picoclaw is ready!\n", internal.Logo) + fmt.Printf("\n%s picoclaw is ready!\n", internal.Logo) fmt.Println("\nNext steps:") - fmt.Println(" 1. Add your API key to", configPath) + if encrypt { + fmt.Println(" 1. Set your encryption passphrase before starting picoclaw:") + fmt.Println(" export PICOCLAW_KEY_PASSPHRASE= # Linux/macOS") + fmt.Println(" set PICOCLAW_KEY_PASSPHRASE= # Windows cmd") + fmt.Println("") + fmt.Println(" 2. Add your API key to", configPath) + } else { + fmt.Println(" 1. Add your API key to", configPath) + } fmt.Println("") fmt.Println(" Recommended:") fmt.Println(" - OpenRouter: https://openrouter.ai/keys (access 100+ models)") @@ -43,7 +97,62 @@ func onboard() { fmt.Println("") fmt.Println(" See README.md for 17+ supported providers.") fmt.Println("") - fmt.Println(" 2. Chat: picoclaw agent -m \"Hello!\"") + fmt.Println(" 3. Chat: picoclaw agent -m \"Hello!\"") +} + +// promptPassphrase reads the encryption passphrase twice from the terminal +// (with echo disabled) and returns it. Returns an error if the passphrase is +// empty or if the two inputs do not match. +func promptPassphrase() (string, error) { + fmt.Print("Enter passphrase for credential encryption: ") + p1, err := term.ReadPassword(int(os.Stdin.Fd())) + fmt.Println() + if err != nil { + return "", fmt.Errorf("reading passphrase: %w", err) + } + if len(p1) == 0 { + return "", fmt.Errorf("passphrase must not be empty") + } + + fmt.Print("Confirm passphrase: ") + p2, err := term.ReadPassword(int(os.Stdin.Fd())) + fmt.Println() + if err != nil { + return "", fmt.Errorf("reading passphrase confirmation: %w", err) + } + + if string(p1) != string(p2) { + return "", fmt.Errorf("passphrases do not match") + } + return string(p1), nil +} + +// setupSSHKey generates the picoclaw-specific SSH key at ~/.ssh/picoclaw_ed25519.key. +// If the key already exists the user is warned and asked to confirm overwrite. +// Answering anything other than "y" keeps the existing key (not an error). +func setupSSHKey() error { + keyPath, err := credential.DefaultSSHKeyPath() + if err != nil { + return fmt.Errorf("cannot determine SSH key path: %w", err) + } + + if _, err := os.Stat(keyPath); err == nil { + fmt.Printf("\n⚠️ WARNING: %s already exists.\n", keyPath) + fmt.Println(" Overwriting will invalidate any credentials previously encrypted with this key.") + fmt.Print(" Overwrite? (y/n): ") + var response string + fmt.Scanln(&response) + if response != "y" { + fmt.Println("Keeping existing SSH key.") + return nil + } + } + + if err := credential.GenerateSSHKey(keyPath); err != nil { + return err + } + fmt.Printf("SSH key generated: %s\n", keyPath) + return nil } func createWorkspaceTemplates(workspace string) { diff --git a/docs/credential_encryption.md b/docs/credential_encryption.md new file mode 100644 index 000000000..448eaaa10 --- /dev/null +++ b/docs/credential_encryption.md @@ -0,0 +1,168 @@ +# Credential Encryption + +PicoClaw supports encrypting `api_key` values in `model_list` configuration entries. +Encrypted keys are stored as `enc://` strings and decrypted automatically at startup. + +--- + +## Quick Start + +**1. Set your passphrase** + +```bash +export PICOCLAW_KEY_PASSPHRASE="your-passphrase" +``` + +**2. Encrypt an API key** + +Run `picoclaw onboard` — it prompts for your passphrase and generates the SSH key, +then automatically re-encrypts any plaintext `api_key` entries in your config on +the next `SaveConfig` call. The resulting `enc://` value will look like: + +``` +enc://AAAA...base64... +``` + +**3. Paste the output into your config** + +```json +{ + "model_list": [ + { + "model_name": "gpt-4o", + "api_key": "enc://AAAA...base64...", + "base_url": "https://api.openai.com/v1" + } + ] +} +``` + +--- + +## Supported `api_key` Formats + +| Format | Example | Behaviour | +|--------|---------|-----------| +| Plaintext | `sk-abc123` | Used as-is | +| File reference | `file://openai.key` | Content read from the same directory as the config file | +| Encrypted | `enc://` | Decrypted at startup using `PICOCLAW_KEY_PASSPHRASE` | +| Empty | `""` | Passed through unchanged (used with `auth_method: oauth`) | + +--- + +## Cryptographic Design + +### Key Derivation + +Encryption uses **HKDF-SHA256** with an optional SSH private key as a second factor. + +``` +Without SSH key (passphrase only): + + ikm = SHA256(passphrase) + aes_key = HKDF-SHA256(ikm, salt, info="picoclaw-credential-v1", 32 bytes) + + +With SSH key (recommended): + + sshHash = SHA256(ssh_private_key_file_bytes) + ikm = HMAC-SHA256(key=sshHash, message=passphrase) + aes_key = HKDF-SHA256(ikm, salt, info="picoclaw-credential-v1", 32 bytes) +``` + +### Encryption + +``` +AES-256-GCM(key=aes_key, nonce=random[12], plaintext=api_key) +``` + +### Wire Format + +``` +enc:// +``` + +| Field | Size | Description | +|-------|------|-------------| +| `salt` | 16 bytes | Random per encryption; fed into HKDF | +| `nonce` | 12 bytes | Random per encryption; AES-GCM IV | +| `ciphertext` | variable | AES-256-GCM ciphertext + 16-byte authentication tag | + +The GCM authentication tag is appended to the ciphertext automatically. Any tampering causes decryption to fail with an error rather than returning corrupt plaintext. + +### Performance + +| Operation | Time (ARM Cortex-A) | +|-----------|---------------------| +| Key derivation (HKDF) | < 1 ms | +| AES-256-GCM decrypt | < 1 ms | +| **Total startup overhead** | **< 2 ms per key** | + +--- + +## Two-Factor Security with SSH Key + +When a SSH private key is provided, breaking the encryption requires **both**: + +1. The **passphrase** (`PICOCLAW_KEY_PASSPHRASE`) +2. The **SSH private key file** + +This means a leaked config file alone is not sufficient to recover the API key, even if the passphrase is weak. The SSH key contributes 256 bits of entropy (Ed25519) regardless of passphrase strength. + +### Threat Model + +| Attacker Has | Can Decrypt? | +|---|---| +| Config file only | No — needs passphrase + SSH key | +| SSH key only | No — needs passphrase | +| Passphrase only | No — needs SSH key | +| Config file + SSH key + passphrase | Yes — full compromise | + +--- + +## Environment Variables + +| Variable | Required | Description | +|----------|----------|-------------| +| `PICOCLAW_KEY_PASSPHRASE` | Yes (for `enc://`) | Passphrase used for key derivation | +| `PICOCLAW_SSH_KEY_PATH` | No | Path to SSH private key. Set to `""` to disable auto-detection and use passphrase-only mode | + +### SSH Key Auto-Detection + +If `PICOCLAW_SSH_KEY_PATH` is not set, PicoClaw looks for the picoclaw-specific key: + +``` +~/.ssh/picoclaw_ed25519.key +``` + +This dedicated file avoids conflicts with the user's existing SSH keys. +Run `picoclaw onboard` to generate it automatically. + +`os.UserHomeDir()` is used for cross-platform home directory resolution (reads `USERPROFILE` on Windows, `HOME` on Unix/macOS). + +To explicitly disable SSH key usage and use passphrase-only mode: + +```bash +export PICOCLAW_SSH_KEY_PATH="" +``` + +--- + +## Migration + +Because the only secret material is `PICOCLAW_KEY_PASSPHRASE` and the SSH private key file, migration is straightforward: + +1. Copy the config file to the new machine. +2. Set `PICOCLAW_KEY_PASSPHRASE` to the same value. +3. Copy the SSH private key file to the same path (or set `PICOCLAW_SSH_KEY_PATH` to its new location). + +No re-encryption is needed. + +--- + +## Security Considerations + +- **Passphrase strength matters in passphrase-only mode.** Without an SSH key, a weak passphrase can be brute-forced offline. Use `PICOCLAW_SSH_KEY_PATH=""` only in environments where no SSH key is available and the passphrase is sufficiently strong (≥ 32 random characters). +- **The SSH key is read-only at runtime.** PicoClaw never writes to or modifies the SSH key file. +- **Plaintext keys remain supported.** Existing configs without `enc://` are unaffected. +- **The `enc://` format is versioned** via the HKDF `info` field (`picoclaw-credential-v1`), allowing future algorithm upgrades without breaking existing encrypted values. diff --git a/pkg/config/config.go b/pkg/config/config.go index 190341224..2937c36e4 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -4,11 +4,13 @@ import ( "encoding/json" "fmt" "os" + "path/filepath" "strings" "sync/atomic" "github.com/caarlos0/env/v11" + "github.com/sipeed/picoclaw/pkg/credential" "github.com/sipeed/picoclaw/pkg/fileutil" ) @@ -837,10 +839,24 @@ func LoadConfig(path string) (*Config, error) { return nil, err } + if passphrase := credential.PassphraseProvider(); passphrase != "" { + for _, m := range cfg.ModelList { + if m.APIKey != "" && !strings.HasPrefix(m.APIKey, "enc://") && !strings.HasPrefix(m.APIKey, "file://") { + fmt.Fprintf(os.Stderr, + "picoclaw: warning: model %q has a plaintext api_key; call SaveConfig to encrypt it\n", + m.ModelName) + } + } + } + if err := env.Parse(cfg); err != nil { return nil, err } + if err := resolveAPIKeys(cfg.ModelList, filepath.Dir(path)); err != nil { + return nil, err + } + // Migrate legacy channel config fields to new unified structures cfg.migrateChannelConfigs() @@ -857,6 +873,48 @@ func LoadConfig(path string) (*Config, error) { return cfg, nil } +// encryptPlaintextAPIKeys returns a copy of models with plaintext api_key values +// encrypted. Returns (nil, nil) when nothing changed (all keys already sealed or +// empty). Returns (nil, error) if any key fails to encrypt — callers must treat +// this as a hard failure to prevent a mixed plaintext/ciphertext state on disk. +// Symmetric counterpart of resolveAPIKeys: both operate purely on []ModelConfig +// and leave JSON marshaling to the caller. +func encryptPlaintextAPIKeys(models []ModelConfig, passphrase string) ([]ModelConfig, error) { + sealed := make([]ModelConfig, len(models)) + copy(sealed, models) + changed := false + for i := range sealed { + m := &sealed[i] + if m.APIKey == "" || strings.HasPrefix(m.APIKey, "enc://") || strings.HasPrefix(m.APIKey, "file://") { + continue + } + encrypted, err := credential.Encrypt(passphrase, "", m.APIKey) + if err != nil { + return nil, fmt.Errorf("cannot seal api_key for model %q: %w", m.ModelName, err) + } + m.APIKey = encrypted + changed = true + } + if !changed { + return nil, nil + } + return sealed, nil +} + +// resolveAPIKeys decrypts or dereferences each api_key in models in-place. +// Supports plaintext (no-op), file:// (read from configDir), and enc:// (AES-GCM decrypt). +func resolveAPIKeys(models []ModelConfig, configDir string) error { + cr := credential.NewResolver(configDir) + for i := range models { + resolved, err := cr.Resolve(models[i].APIKey) + if err != nil { + return fmt.Errorf("model_list[%d] (%s): %w", i, models[i].ModelName, err) + } + models[i].APIKey = resolved + } + return nil +} + func (c *Config) migrateChannelConfigs() { // Discord: mention_only -> group_trigger.mention_only if c.Channels.Discord.MentionOnly && !c.Channels.Discord.GroupTrigger.MentionOnly { @@ -871,12 +929,22 @@ func (c *Config) migrateChannelConfigs() { } func SaveConfig(path string, cfg *Config) error { + if passphrase := credential.PassphraseProvider(); passphrase != "" { + sealed, err := encryptPlaintextAPIKeys(cfg.ModelList, passphrase) + if err != nil { + return err + } + if sealed != nil { + tmp := *cfg + tmp.ModelList = sealed + cfg = &tmp + } + } + data, err := json.MarshalIndent(cfg, "", " ") if err != nil { return err } - - // Use unified atomic write utility with explicit sync for flash storage reliability. return fileutil.WriteFileAtomic(path, data, 0o600) } diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index c5bdbf3c3..4c4dd9421 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -7,8 +7,22 @@ import ( "runtime" "strings" "testing" + + "github.com/sipeed/picoclaw/pkg/credential" ) +// mustSetupSSHKey generates a temporary Ed25519 SSH key in t.TempDir() and sets +// PICOCLAW_SSH_KEY_PATH to its path for the duration of the test. This is required +// whenever a test exercises encryption/decryption via credential.Encrypt or SaveConfig. +func mustSetupSSHKey(t *testing.T) { + t.Helper() + keyPath := filepath.Join(t.TempDir(), "picoclaw_ed25519.key") + if err := credential.GenerateSSHKey(keyPath); err != nil { + t.Fatalf("mustSetupSSHKey: %v", err) + } + t.Setenv("PICOCLAW_SSH_KEY_PATH", keyPath) +} + func TestAgentModelConfig_UnmarshalString(t *testing.T) { var m AgentModelConfig if err := json.Unmarshal([]byte(`"gpt-4"`), &m); err != nil { @@ -482,13 +496,19 @@ func TestDefaultConfig_DMScope(t *testing.T) { } func TestDefaultConfig_WorkspacePath_Default(t *testing.T) { - // Unset to ensure we test the default t.Setenv("PICOCLAW_HOME", "") - // Set a known home for consistent test results - t.Setenv("HOME", "/tmp/home") + + var fakeHome string + if runtime.GOOS == "windows" { + fakeHome = `C:\tmp\home` + t.Setenv("USERPROFILE", fakeHome) + } else { + fakeHome = "/tmp/home" + t.Setenv("HOME", fakeHome) + } cfg := DefaultConfig() - want := filepath.Join("/tmp/home", ".picoclaw", "workspace") + want := filepath.Join(fakeHome, ".picoclaw", "workspace") if cfg.Agents.Defaults.Workspace != want { t.Errorf("Default workspace path = %q, want %q", cfg.Agents.Defaults.Workspace, want) @@ -499,7 +519,7 @@ func TestDefaultConfig_WorkspacePath_WithPicoclawHome(t *testing.T) { t.Setenv("PICOCLAW_HOME", "/custom/picoclaw/home") cfg := DefaultConfig() - want := "/custom/picoclaw/home/workspace" + want := filepath.Join("/custom/picoclaw/home", "workspace") if cfg.Agents.Defaults.Workspace != want { t.Errorf("Workspace path with PICOCLAW_HOME = %q, want %q", cfg.Agents.Defaults.Workspace, want) @@ -621,3 +641,338 @@ func TestFlexibleStringSlice_UnmarshalText_EmptySliceConsistency(t *testing.T) { } }) } + +// TestLoadConfig_WarnsForPlaintextAPIKey verifies that LoadConfig resolves a plaintext +// api_key into memory but does NOT rewrite the config file. File writes are the sole +// responsibility of SaveConfig. +func TestLoadConfig_WarnsForPlaintextAPIKey(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + const original = `{"model_list":[{"model_name":"test","model":"openai/gpt-4","api_key":"sk-plaintext"}]}` + if err := os.WriteFile(cfgPath, []byte(original), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "test-passphrase") + t.Setenv("PICOCLAW_SSH_KEY_PATH", "") + + cfg, err := LoadConfig(cfgPath) + if err != nil { + t.Fatalf("LoadConfig: %v", err) + } + // In-memory value must be the resolved plaintext. + if cfg.ModelList[0].APIKey != "sk-plaintext" { + t.Errorf("in-memory api_key = %q, want %q", cfg.ModelList[0].APIKey, "sk-plaintext") + } + // The file on disk must remain unchanged — LoadConfig must not write anything. + raw, _ := os.ReadFile(cfgPath) + if string(raw) != original { + t.Errorf("LoadConfig must not modify the config file; got:\n%s", string(raw)) + } +} + +// TestSaveConfig_EncryptsPlaintextAPIKey verifies that SaveConfig writes enc:// ciphertext +// to disk and that a subsequent LoadConfig decrypts it back to the original plaintext. +func TestSaveConfig_EncryptsPlaintextAPIKey(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "test-passphrase") + mustSetupSSHKey(t) + + cfg := DefaultConfig() + cfg.ModelList = []ModelConfig{ + {ModelName: "test", Model: "openai/gpt-4", APIKey: "sk-plaintext"}, + } + if err := SaveConfig(cfgPath, cfg); err != nil { + t.Fatalf("SaveConfig: %v", err) + } + + // Disk must contain enc://, not the raw key. + raw, _ := os.ReadFile(cfgPath) + if !strings.Contains(string(raw), "enc://") { + t.Errorf("saved file should contain enc://, got:\n%s", string(raw)) + } + if strings.Contains(string(raw), "sk-plaintext") { + t.Errorf("saved file must not contain the plaintext key") + } + + // A fresh load must decrypt back to the original plaintext. + cfg2, err := LoadConfig(cfgPath) + if err != nil { + t.Fatalf("LoadConfig after SaveConfig: %v", err) + } + if cfg2.ModelList[0].APIKey != "sk-plaintext" { + t.Errorf("loaded api_key = %q, want %q", cfg2.ModelList[0].APIKey, "sk-plaintext") + } +} + +// TestLoadConfig_NoSealWithoutPassphrase verifies that api_key values are left +// unchanged when PICOCLAW_KEY_PASSPHRASE is not set. +func TestLoadConfig_NoSealWithoutPassphrase(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + data := `{"model_list":[{"model_name":"test","model":"openai/gpt-4","api_key":"sk-plaintext"}]}` + if err := os.WriteFile(cfgPath, []byte(data), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "") + t.Setenv("PICOCLAW_SSH_KEY_PATH", "") + + if _, err := LoadConfig(cfgPath); err != nil { + t.Fatalf("LoadConfig: %v", err) + } + + raw, _ := os.ReadFile(cfgPath) + if strings.Contains(string(raw), "enc://") { + t.Error("config file must not be modified when no passphrase is set") + } +} + +// TestLoadConfig_FileRefNotSealed verifies that file:// api_key references are not +// converted to enc:// values (they are resolved at runtime by the Resolver). +func TestLoadConfig_FileRefNotSealed(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + keyFile := filepath.Join(dir, "openai.key") + if err := os.WriteFile(keyFile, []byte("sk-from-file"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + data := `{"model_list":[{"model_name":"test","model":"openai/gpt-4","api_key":"file://openai.key"}]}` + if err := os.WriteFile(cfgPath, []byte(data), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "test-passphrase") + t.Setenv("PICOCLAW_SSH_KEY_PATH", "") + + if _, err := LoadConfig(cfgPath); err != nil { + t.Fatalf("LoadConfig: %v", err) + } + + raw, _ := os.ReadFile(cfgPath) + if !strings.Contains(string(raw), "file://openai.key") { + t.Error("file:// reference should be preserved unchanged in the config file") + } + if strings.Contains(string(raw), "enc://") { + t.Error("file:// reference must not be converted to enc://") + } +} + +// TestSaveConfig_MixedKeys verifies that SaveConfig encrypts only plaintext api_keys +// and leaves already-encrypted (enc://) and file:// entries unchanged. +func TestSaveConfig_MixedKeys(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "test-passphrase") + mustSetupSSHKey(t) + + // Pre-encrypt one key so we have a genuine enc:// value to put in the config. + if err := SaveConfig(cfgPath, &Config{ + ModelList: []ModelConfig{ + {ModelName: "pre", Model: "openai/gpt-4", APIKey: "sk-already-plain"}, + }, + }); err != nil { + t.Fatalf("setup SaveConfig: %v", err) + } + raw, _ := os.ReadFile(cfgPath) + // Extract the enc:// value from the saved file. + var tmp struct { + ModelList []struct { + APIKey string `json:"api_key"` + } `json:"model_list"` + } + if err := json.Unmarshal(raw, &tmp); err != nil || len(tmp.ModelList) == 0 { + t.Fatalf("setup: could not parse saved config: %v", err) + } + alreadyEncrypted := tmp.ModelList[0].APIKey + if !strings.HasPrefix(alreadyEncrypted, "enc://") { + t.Fatalf("setup: expected enc:// key, got %q", alreadyEncrypted) + } + + // Build a config with three models: + // 1. plaintext → must be encrypted by SaveConfig + // 2. enc:// → must be left unchanged (already encrypted) + // 3. file:// → must be left unchanged (file reference) + keyFile := filepath.Join(dir, "api.key") + if err := os.WriteFile(keyFile, []byte("sk-from-file"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + cfg := &Config{ + ModelList: []ModelConfig{ + {ModelName: "plain", Model: "openai/gpt-4", APIKey: "sk-new-plaintext"}, + {ModelName: "enc", Model: "openai/gpt-4", APIKey: alreadyEncrypted}, + {ModelName: "file", Model: "openai/gpt-4", APIKey: "file://api.key"}, + }, + } + if err := SaveConfig(cfgPath, cfg); err != nil { + t.Fatalf("SaveConfig: %v", err) + } + + raw, _ = os.ReadFile(cfgPath) + s := string(raw) + + // 1. Plaintext must be encrypted. + if strings.Contains(s, "sk-new-plaintext") { + t.Error("plaintext key must not appear in saved file") + } + // 2. The pre-existing enc:// value must still be present (byte-for-byte unchanged). + if !strings.Contains(s, alreadyEncrypted) { + t.Error("pre-existing enc:// entry must be preserved unchanged") + } + // 3. file:// must be preserved. + if !strings.Contains(s, "file://api.key") { + t.Error("file:// reference must be preserved unchanged") + } + + // Now load and verify all three decrypt/resolve correctly. + cfg2, err := LoadConfig(cfgPath) + if err != nil { + t.Fatalf("LoadConfig after SaveConfig: %v", err) + } + byName := make(map[string]string) + for _, m := range cfg2.ModelList { + byName[m.ModelName] = m.APIKey + } + if byName["plain"] != "sk-new-plaintext" { + t.Errorf("plain model api_key = %q, want %q", byName["plain"], "sk-new-plaintext") + } + if byName["enc"] != "sk-already-plain" { + t.Errorf("enc model api_key = %q, want %q", byName["enc"], "sk-already-plain") + } + if byName["file"] != "sk-from-file" { + t.Errorf("file model api_key = %q, want %q", byName["file"], "sk-from-file") + } +} + +// TestLoadConfig_MixedKeys_NoPassphrase verifies that when PICOCLAW_KEY_PASSPHRASE +// is not set, enc:// entries cause LoadConfig to return an error, while plaintext +// and file:// entries in the same config are not affected. +func TestLoadConfig_MixedKeys_NoPassphrase(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + + // First encrypt a key so we have a real enc:// value. + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "test-passphrase") + mustSetupSSHKey(t) + if err := SaveConfig(cfgPath, &Config{ + ModelList: []ModelConfig{ + {ModelName: "m", Model: "openai/gpt-4", APIKey: "sk-secret"}, + }, + }); err != nil { + t.Fatalf("setup SaveConfig: %v", err) + } + raw, _ := os.ReadFile(cfgPath) + var tmp struct { + ModelList []struct { + APIKey string `json:"api_key"` + } `json:"model_list"` + } + if err := json.Unmarshal(raw, &tmp); err != nil { + t.Fatalf("setup parse: %v", err) + } + encValue := tmp.ModelList[0].APIKey + + // Write a mixed config: enc:// + plaintext + file:// + keyFile := filepath.Join(dir, "api.key") + if err := os.WriteFile(keyFile, []byte("sk-from-file"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + mixed, _ := json.Marshal(map[string]any{ + "model_list": []map[string]any{ + {"model_name": "enc", "model": "openai/gpt-4", "api_key": encValue}, + {"model_name": "plain", "model": "openai/gpt-4", "api_key": "sk-plain"}, + {"model_name": "file", "model": "openai/gpt-4", "api_key": "file://api.key"}, + }, + }) + if err := os.WriteFile(cfgPath, mixed, 0o600); err != nil { + t.Fatalf("setup write: %v", err) + } + + // Now clear the passphrase — LoadConfig must fail because enc:// cannot be decrypted. + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "") + + _, err := LoadConfig(cfgPath) + if err == nil { + t.Fatal("LoadConfig should fail when enc:// key is present and no passphrase is set") + } + if !strings.Contains(err.Error(), "passphrase required") { + t.Errorf("error should mention passphrase required, got: %v", err) + } +} + +// TestSaveConfig_UsesPassphraseProvider verifies that SaveConfig encrypts plaintext +// api_keys using credential.PassphraseProvider() rather than os.Getenv directly. +// This matters for the launcher, which clears the environment variable and redirects +// PassphraseProvider to an in-memory SecureStore. +func TestSaveConfig_UsesPassphraseProvider(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + + // Ensure the env var is empty — passphrase must come from PassphraseProvider only. + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "") + mustSetupSSHKey(t) + + // Replace PassphraseProvider with an in-memory function (simulating SecureStore). + const testPassphrase = "provider-passphrase" + orig := credential.PassphraseProvider + credential.PassphraseProvider = func() string { return testPassphrase } + t.Cleanup(func() { credential.PassphraseProvider = orig }) + + cfg := DefaultConfig() + cfg.ModelList = []ModelConfig{ + {ModelName: "test", Model: "openai/gpt-4", APIKey: "sk-plaintext"}, + } + if err := SaveConfig(cfgPath, cfg); err != nil { + t.Fatalf("SaveConfig: %v", err) + } + + raw, _ := os.ReadFile(cfgPath) + if !strings.Contains(string(raw), "enc://") { + t.Errorf("SaveConfig should have encrypted plaintext key via PassphraseProvider; got:\n%s", raw) + } +} + +// TestLoadConfig_UsesPassphraseProvider verifies that LoadConfig decrypts enc:// keys +// using credential.PassphraseProvider() rather than os.Getenv directly. +func TestLoadConfig_UsesPassphraseProvider(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + + // Ensure the env var is empty throughout. + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "") + mustSetupSSHKey(t) + + const testPassphrase = "provider-passphrase" + const plainKey = "sk-secret" + + // First, encrypt the key using the same passphrase. + encrypted, err := credential.Encrypt(testPassphrase, "", plainKey) + if err != nil { + t.Fatalf("Encrypt: %v", err) + } + + raw, _ := json.Marshal(map[string]any{ + "model_list": []map[string]any{ + {"model_name": "test", "model": "openai/gpt-4", "api_key": encrypted}, + }, + }) + if err = os.WriteFile(cfgPath, raw, 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + // Redirect PassphraseProvider — env var is empty, so without this the load would fail. + orig := credential.PassphraseProvider + credential.PassphraseProvider = func() string { return testPassphrase } + t.Cleanup(func() { credential.PassphraseProvider = orig }) + + cfg, err := LoadConfig(cfgPath) + if err != nil { + t.Fatalf("LoadConfig: %v", err) + } + if cfg.ModelList[0].APIKey != plainKey { + t.Errorf("api_key = %q, want %q", cfg.ModelList[0].APIKey, plainKey) + } +} diff --git a/pkg/credential/credential.go b/pkg/credential/credential.go new file mode 100644 index 000000000..83af3fc9f --- /dev/null +++ b/pkg/credential/credential.go @@ -0,0 +1,335 @@ +// Package credential resolves API credential values for model_list entries. +// +// An API key is a form of authorization credential. This package centralizes +// how raw credential strings—plaintext or file references—are resolved into +// their actual values, keeping that logic out of the config loader. +// +// Supported formats for the api_key field: +// +// - Plaintext: "sk-abc123" → returned as-is +// - File ref: "file://filename.key" → content read from configDir/filename.key +// - Encrypted: "enc://" → AES-256-GCM decrypt via PICOCLAW_KEY_PASSPHRASE +// - Empty: "" → returned as-is (auth_method=oauth etc.) +// +// Encryption uses AES-256-GCM with HKDF-SHA256 key derivation (< 1ms, safe for embedded Linux). +// An SSH private key is required for both encryption and decryption. +// Key derivation: +// +// HKDF-SHA256(ikm=HMAC-SHA256(SHA256(sshKeyBytes), passphrase), salt, info) +// +// SSH key path resolution priority: +// +// 1. sshKeyPath argument to Encrypt (explicit) +// 2. PICOCLAW_SSH_KEY_PATH env var +// 3. ~/.ssh/picoclaw_ed25519.key (os.UserHomeDir is cross-platform) +package credential + +import ( + "crypto/aes" + "crypto/cipher" + "crypto/hkdf" + "crypto/hmac" + "crypto/rand" + "crypto/sha256" + "encoding/base64" + "errors" + "fmt" + "io" + "os" + "path/filepath" + "strings" +) + +// PassphraseEnvVar is the environment variable that holds the encryption passphrase. +// Other packages (e.g. config) reference this constant to avoid duplicating the string. +const PassphraseEnvVar = "PICOCLAW_KEY_PASSPHRASE" + +// PassphraseProvider is the function used to retrieve the passphrase for enc:// +// credential decryption. It defaults to reading PICOCLAW_KEY_PASSPHRASE from the +// process environment. Replace it at startup to use a different source, such as +// an in-memory SecureStore, so that all LoadConfig() calls everywhere share the +// same passphrase source without needing os.Environ. +// +// Example (launcher main.go): +// +// credential.PassphraseProvider = apiHandler.passphraseStore.Get +var PassphraseProvider func() string = func() string { + return os.Getenv(PassphraseEnvVar) +} + +// ErrPassphraseRequired is returned when an enc:// credential is encountered but +// no passphrase is available from PassphraseProvider. Callers can detect this +// with errors.Is to distinguish a missing-passphrase condition from other errors. +var ErrPassphraseRequired = errors.New("credential: enc:// passphrase required") + +// ErrDecryptionFailed is returned when an enc:// credential cannot be decrypted, +// indicating a wrong passphrase or SSH key. Callers can detect this with errors.Is. +var ErrDecryptionFailed = errors.New("credential: enc:// decryption failed (wrong passphrase or SSH key?)") + +const ( + fileScheme = "file://" + encScheme = "enc://" + hkdfInfo = "picoclaw-credential-v1" + saltLen = 16 + nonceLen = 12 + keyLen = 32 + sshKeyEnv = "PICOCLAW_SSH_KEY_PATH" +) + +// Resolver resolves raw credential strings for model_list api_key fields. +// File references are resolved relative to the directory of the config file. +type Resolver struct { + configDir string + resolvedConfigDir string // symlink-resolved form of configDir +} + +// NewResolver returns a Resolver that resolves file:// references relative to +// configDir (typically filepath.Dir of the config file path). +func NewResolver(configDir string) *Resolver { + resolved := configDir + if configDir != "" { + if linkedPath, err := filepath.EvalSymlinks(configDir); err == nil { + resolved = linkedPath + } + } + return &Resolver{configDir: configDir, resolvedConfigDir: resolved} +} + +// Resolve returns the actual credential value for raw: +// +// - "" → "" (no error; auth_method=oauth needs no key) +// - "file://name.key" → trimmed content of configDir/name.key +// - anything else → raw unchanged (plaintext credential) +func (r *Resolver) Resolve(raw string) (string, error) { + if raw == "" { + return "", nil + } + + if strings.HasPrefix(raw, fileScheme) { + fileName := strings.TrimSpace(strings.TrimPrefix(raw, fileScheme)) + if fileName == "" { + return "", fmt.Errorf("credential: file:// reference has no filename") + } + + baseDir := r.resolvedConfigDir + if baseDir == "" { + baseDir = r.configDir + } + keyPath := filepath.Join(baseDir, fileName) + // Resolve symlinks before enforcing containment to prevent escaping via symlinks. + realKeyPath, err := filepath.EvalSymlinks(keyPath) + if err != nil { + return "", fmt.Errorf("credential: failed to resolve credential file path %q: %w", keyPath, err) + } + if !isWithinDir(realKeyPath, baseDir) { + return "", fmt.Errorf("credential: file:// path escapes config directory") + } + data, err := os.ReadFile(realKeyPath) + if err != nil { + return "", fmt.Errorf("credential: failed to read credential file %q: %w", realKeyPath, err) + } + + value := strings.TrimSpace(string(data)) + if value == "" { + return "", fmt.Errorf("credential: credential file %q is empty", realKeyPath) + } + + return value, nil + } + + if strings.HasPrefix(raw, encScheme) { + return resolveEncrypted(raw) + } + + // Plaintext credential — return unchanged. + return raw, nil +} + +// resolveEncrypted decrypts an enc:// credential using PassphraseProvider. +func resolveEncrypted(raw string) (string, error) { + passphrase := PassphraseProvider() + if passphrase == "" { + return "", ErrPassphraseRequired + } + + sshKeyPath := pickSSHKeyPath("") // override="": consult env then auto-detect + + b64 := strings.TrimPrefix(raw, encScheme) + blob, err := base64.StdEncoding.DecodeString(b64) + if err != nil { + return "", fmt.Errorf("credential: enc:// invalid base64: %w", err) + } + if len(blob) < saltLen+nonceLen+1 { + return "", fmt.Errorf("credential: enc:// payload too short") + } + + salt := blob[:saltLen] + nonce := blob[saltLen : saltLen+nonceLen] + ciphertext := blob[saltLen+nonceLen:] + + key, err := deriveKey(passphrase, sshKeyPath, salt) + if err != nil { + return "", err + } + block, err := aes.NewCipher(key) + if err != nil { + return "", fmt.Errorf("credential: enc:// cipher init: %w", err) + } + gcm, err := cipher.NewGCM(block) + if err != nil { + return "", fmt.Errorf("credential: enc:// gcm init: %w", err) + } + + plaintext, err := gcm.Open(nil, nonce, ciphertext, nil) + if err != nil { + return "", fmt.Errorf("%w: %w", ErrDecryptionFailed, err) + } + return string(plaintext), nil +} + +// Encrypt encrypts plaintext and returns an enc:// credential string. +// +// passphrase is required (PICOCLAW_KEY_PASSPHRASE value). +// sshKeyPath is the SSH private key file to use; pass "" to auto-detect via +// PICOCLAW_SSH_KEY_PATH env var or ~/.ssh/picoclaw_ed25519.key. +// An SSH private key must be resolvable or Encrypt returns an error. +func Encrypt(passphrase, sshKeyPath, plaintext string) (string, error) { + if passphrase == "" { + return "", fmt.Errorf("credential: passphrase must not be empty") + } + sshKeyPath = pickSSHKeyPath(sshKeyPath) + + salt := make([]byte, saltLen) + if _, err := io.ReadFull(rand.Reader, salt); err != nil { + return "", fmt.Errorf("credential: failed to generate salt: %w", err) + } + + key, err := deriveKey(passphrase, sshKeyPath, salt) + if err != nil { + return "", err + } + block, err := aes.NewCipher(key) + if err != nil { + return "", fmt.Errorf("credential: cipher init: %w", err) + } + gcm, err := cipher.NewGCM(block) + if err != nil { + return "", fmt.Errorf("credential: gcm init: %w", err) + } + + nonce := make([]byte, nonceLen) + if _, err := io.ReadFull(rand.Reader, nonce); err != nil { + return "", fmt.Errorf("credential: failed to generate nonce: %w", err) + } + + ciphertext := gcm.Seal(nil, nonce, []byte(plaintext), nil) + blob := make([]byte, 0, saltLen+nonceLen+len(ciphertext)) + blob = append(blob, salt...) + blob = append(blob, nonce...) + blob = append(blob, ciphertext...) + return encScheme + base64.StdEncoding.EncodeToString(blob), nil +} + +// isWithinDir reports whether path is contained within (or equal to) dir. +// Uses filepath.IsLocal on the relative path for robust cross-platform traversal detection. +func isWithinDir(path, dir string) bool { + rel, err := filepath.Rel(filepath.Clean(dir), filepath.Clean(path)) + return err == nil && filepath.IsLocal(rel) +} + +// allowedSSHKeyPath reports whether path is in a permitted location for SSH key files: +// - exact match with PICOCLAW_SSH_KEY_PATH env var +// - within the PICOCLAW_HOME env var directory +// - within ~/.ssh/ +func allowedSSHKeyPath(path string) bool { + if path == "" { + return true // passphrase-only mode; no file will be read + } + clean := filepath.Clean(path) + + // Exact match with PICOCLAW_SSH_KEY_PATH. + if envPath, ok := os.LookupEnv(sshKeyEnv); ok && envPath != "" { + if clean == filepath.Clean(envPath) { + return true + } + } + + // Within PICOCLAW_HOME. + if picoHome := os.Getenv("PICOCLAW_HOME"); picoHome != "" { + if isWithinDir(clean, picoHome) { + return true + } + } + + // Within ~/.ssh/. + if userHome, err := os.UserHomeDir(); err == nil { + if isWithinDir(clean, filepath.Join(userHome, ".ssh")) { + return true + } + } + + return false +} + +// deriveKey derives a 32-byte AES-256 key from passphrase and SSH private key. +// +// ikm = HMAC-SHA256(key=SHA256(sshKeyBytes), msg=passphrase) +// Final key: HKDF-SHA256(ikm, salt, info="picoclaw-credential-v1", 32 bytes) +// sshKeyPath must be non-empty; returns an error otherwise. +func deriveKey(passphrase, sshKeyPath string, salt []byte) ([]byte, error) { + if sshKeyPath == "" { + return nil, fmt.Errorf( + "credential: SSH private key is required but not found" + + " (set PICOCLAW_SSH_KEY_PATH or place key at ~/.ssh/picoclaw_ed25519.key)") + } + if !allowedSSHKeyPath(sshKeyPath) { + return nil, fmt.Errorf( + "credential: SSH key path %q is not in an allowed location (PICOCLAW_SSH_KEY_PATH, PICOCLAW_HOME, or ~/.ssh/)", + sshKeyPath, + ) + } + sshBytes, err := os.ReadFile(sshKeyPath) + if err != nil { + return nil, fmt.Errorf("credential: cannot read SSH key %q: %w", sshKeyPath, err) + } + sshHash := sha256.Sum256(sshBytes) + mac := hmac.New(sha256.New, sshHash[:]) + mac.Write([]byte(passphrase)) + ikm := mac.Sum(nil) + + key, err := hkdf.Key(sha256.New, ikm, salt, hkdfInfo, keyLen) + if err != nil { + return nil, fmt.Errorf("credential: HKDF expand failed: %w", err) + } + return key, nil +} + +// pickSSHKeyPath returns the SSH private key path to use for encryption/decryption. +// +// Priority: +// 1. override (non-empty explicit argument) +// 2. PICOCLAW_SSH_KEY_PATH env var +// 3. ~/.ssh/picoclaw_ed25519.key (auto-detection) +// +// Returns "" when no key is found; deriveKey will return an error in that case. +func pickSSHKeyPath(override string) string { + if override != "" { + return override + } + if p, ok := os.LookupEnv(sshKeyEnv); ok { + return p // respect explicit setting, even if "" + } + return findDefaultSSHKey() +} + +// findDefaultSSHKey returns the picoclaw-specific SSH key path if it exists. +func findDefaultSSHKey() string { + p, err := DefaultSSHKeyPath() + if err != nil { + return "" + } + if _, err := os.Stat(p); err == nil { + return p + } + return "" +} diff --git a/pkg/credential/credential_test.go b/pkg/credential/credential_test.go new file mode 100644 index 000000000..138af3134 --- /dev/null +++ b/pkg/credential/credential_test.go @@ -0,0 +1,283 @@ +package credential_test + +import ( + "os" + "path/filepath" + "testing" + + "github.com/sipeed/picoclaw/pkg/credential" +) + +func TestResolve_PlainKey(t *testing.T) { + r := credential.NewResolver(t.TempDir()) + got, err := r.Resolve("sk-plaintext-key") + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + if got != "sk-plaintext-key" { + t.Fatalf("got %q, want %q", got, "sk-plaintext-key") + } +} + +func TestResolve_FileKey_Success(t *testing.T) { + dir := t.TempDir() + keyFile := "openai_plain.key" + if err := os.WriteFile(filepath.Join(dir, keyFile), []byte("sk-from-file\n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + r := credential.NewResolver(dir) + got, err := r.Resolve("file://" + keyFile) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + if got != "sk-from-file" { + t.Fatalf("got %q, want %q", got, "sk-from-file") + } +} + +func TestResolve_FileKey_NotFound(t *testing.T) { + r := credential.NewResolver(t.TempDir()) + _, err := r.Resolve("file://missing.key") + if err == nil { + t.Fatal("expected error for missing file, got nil") + } +} + +func TestResolve_FileKey_Empty(t *testing.T) { + dir := t.TempDir() + keyFile := "empty.key" + if err := os.WriteFile(filepath.Join(dir, keyFile), []byte(" \n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + r := credential.NewResolver(dir) + _, err := r.Resolve("file://" + keyFile) + if err == nil { + t.Fatal("expected error for empty credential file, got nil") + } +} + +// TestResolve_EncKey_RoundTrip tests basic encryption/decryption round-trip with an SSH key. +func TestResolve_EncKey_RoundTrip(t *testing.T) { + dir := t.TempDir() + sshKeyPath := filepath.Join(dir, "picoclaw_ed25519.key") + if err := os.WriteFile(sshKeyPath, []byte("fake-ssh-key-material\n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + const passphrase = "test-passphrase-32bytes-long-ok!" + const plaintext = "sk-encrypted-secret" + + t.Setenv("PICOCLAW_SSH_KEY_PATH", sshKeyPath) + + enc, err := credential.Encrypt(passphrase, "", plaintext) + if err != nil { + t.Fatalf("Encrypt: %v", err) + } + + t.Setenv("PICOCLAW_KEY_PASSPHRASE", passphrase) + + r := credential.NewResolver(t.TempDir()) + got, err := r.Resolve(enc) + if err != nil { + t.Fatalf("Resolve: %v", err) + } + if got != plaintext { + t.Fatalf("got %q, want %q", got, plaintext) + } +} + +// TestResolve_EncKey_WithSSHKey tests that the SSH key file is incorporated into key derivation. +func TestResolve_EncKey_WithSSHKey(t *testing.T) { + dir := t.TempDir() + sshKeyPath := filepath.Join(dir, "picoclaw_ed25519.key") + if err := os.WriteFile(sshKeyPath, []byte("fake-ssh-private-key-material\n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + const passphrase = "test-passphrase" + const plaintext = "sk-ssh-protected-secret" + + // Set PICOCLAW_SSH_KEY_PATH before Encrypt so the path passes allowedSSHKeyPath validation. + t.Setenv("PICOCLAW_KEY_PASSPHRASE", passphrase) + t.Setenv("PICOCLAW_SSH_KEY_PATH", sshKeyPath) + + enc, err := credential.Encrypt(passphrase, sshKeyPath, plaintext) + if err != nil { + t.Fatalf("Encrypt: %v", err) + } + + r := credential.NewResolver(t.TempDir()) + got, err := r.Resolve(enc) + if err != nil { + t.Fatalf("Resolve: %v", err) + } + if got != plaintext { + t.Fatalf("got %q, want %q", got, plaintext) + } +} + +func TestResolve_EncKey_NoPassphrase(t *testing.T) { + dir := t.TempDir() + sshKeyPath := filepath.Join(dir, "picoclaw_ed25519.key") + if err := os.WriteFile(sshKeyPath, []byte("fake-ssh-key\n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + t.Setenv("PICOCLAW_SSH_KEY_PATH", sshKeyPath) + + enc, err := credential.Encrypt("some-passphrase", "", "sk-secret") + if err != nil { + t.Fatalf("Encrypt: %v", err) + } + + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "") + + r := credential.NewResolver(t.TempDir()) + _, err = r.Resolve(enc) + if err == nil { + t.Fatal("expected error when PICOCLAW_KEY_PASSPHRASE is unset, got nil") + } +} + +func TestResolve_EncKey_BadCiphertext(t *testing.T) { + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "some-passphrase") + t.Setenv("PICOCLAW_SSH_KEY_PATH", "") + + r := credential.NewResolver(t.TempDir()) + _, err := r.Resolve("enc://!!not-valid-base64!!") + if err == nil { + t.Fatal("expected error for invalid enc:// payload, got nil") + } +} + +func TestResolve_EncKey_PayloadTooShort(t *testing.T) { + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "some-passphrase") + t.Setenv("PICOCLAW_SSH_KEY_PATH", "") + + // Valid base64 but fewer bytes than salt(16)+nonce(12)+1 minimum. + import64 := "dG9vc2hvcnQ=" // "tooshort" = 8 bytes + r := credential.NewResolver(t.TempDir()) + _, err := r.Resolve("enc://" + import64) + if err == nil { + t.Fatal("expected error for too-short enc:// payload, got nil") + } +} + +func TestResolve_EncKey_WrongPassphrase(t *testing.T) { + dir := t.TempDir() + sshKeyPath := filepath.Join(dir, "picoclaw_ed25519.key") + if err := os.WriteFile(sshKeyPath, []byte("fake-ssh-key\n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + t.Setenv("PICOCLAW_SSH_KEY_PATH", sshKeyPath) + + enc, err := credential.Encrypt("correct-passphrase", "", "sk-secret") + if err != nil { + t.Fatalf("Encrypt: %v", err) + } + + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "wrong-passphrase") + + r := credential.NewResolver(t.TempDir()) + _, err = r.Resolve(enc) + if err == nil { + t.Fatal("expected decryption error for wrong passphrase, got nil") + } +} + +func TestEncrypt_EmptyPassphrase(t *testing.T) { + _, err := credential.Encrypt("", "", "sk-secret") + if err == nil { + t.Fatal("expected error for empty passphrase, got nil") + } +} + +func TestDeriveKey_SSHKeyNotFound(t *testing.T) { + // Encrypt with a real SSH key path, then try to decrypt with a missing path. + dir := t.TempDir() + sshKeyPath := filepath.Join(dir, "picoclaw_ed25519.key") + if err := os.WriteFile(sshKeyPath, []byte("fake-key\n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + // Register the real key path so allowedSSHKeyPath validation passes for Encrypt. + t.Setenv("PICOCLAW_SSH_KEY_PATH", sshKeyPath) + + enc, err := credential.Encrypt("passphrase", sshKeyPath, "sk-secret") + if err != nil { + t.Fatalf("Encrypt: %v", err) + } + + // Point to a non-existent SSH key so deriveKey's ReadFile fails. + // The path is still under the same dir, so allowedSSHKeyPath passes (exact env match). + t.Setenv("PICOCLAW_KEY_PASSPHRASE", "passphrase") + t.Setenv("PICOCLAW_SSH_KEY_PATH", filepath.Join(dir, "nonexistent_key")) + + r := credential.NewResolver(t.TempDir()) + _, err = r.Resolve(enc) + if err == nil { + t.Fatal("expected error when SSH key file is missing, got nil") + } +} + +// TestResolve_FileRef_PathTraversal verifies that file:// references cannot escape configDir +// via relative traversal ("../../etc/passwd") or absolute paths ("/abs/path"). +func TestResolve_FileRef_PathTraversal(t *testing.T) { + dir := t.TempDir() + cfgPath := filepath.Join(dir, "config.json") + // Create a file outside configDir that the traversal would point to. + outsideFile := filepath.Join(t.TempDir(), "secret.key") + if err := os.WriteFile(outsideFile, []byte("stolen"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + r := credential.NewResolver(filepath.Dir(cfgPath)) + + cases := []string{ + "file://../../secret.key", + "file://../secret.key", + "file://" + outsideFile, // absolute path + } + for _, raw := range cases { + _, err := r.Resolve(raw) + if err == nil { + t.Errorf("Resolve(%q): expected path traversal error, got nil", raw) + } + } +} + +// TestResolve_FileRef_withinConfigDir verifies that a legitimate relative file:// ref works. +func TestResolve_FileRef_withinConfigDir(t *testing.T) { + dir := t.TempDir() + if err := os.WriteFile(filepath.Join(dir, "my.key"), []byte("sk-valid\n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + r := credential.NewResolver(dir) + got, err := r.Resolve("file://my.key") + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + if got != "sk-valid" { + t.Fatalf("got %q, want %q", got, "sk-valid") + } +} + +// TestEncrypt_SSHKeyOutsideAllowedDirs verifies that Encrypt rejects SSH key paths +// that are not under PICOCLAW_SSH_KEY_PATH, PICOCLAW_HOME, or ~/.ssh/. +func TestEncrypt_SSHKeyOutsideAllowedDirs(t *testing.T) { + dir := t.TempDir() + sshKeyPath := filepath.Join(dir, "picoclaw_ed25519.key") + if err := os.WriteFile(sshKeyPath, []byte("fake-key\n"), 0o600); err != nil { + t.Fatalf("setup: %v", err) + } + + // Make sure none of the allowed env vars point here. + t.Setenv("PICOCLAW_SSH_KEY_PATH", "") + t.Setenv("PICOCLAW_HOME", "") + + _, err := credential.Encrypt("passphrase", sshKeyPath, "sk-secret") + if err == nil { + t.Fatal("expected error for SSH key outside allowed directories, got nil") + } +} diff --git a/pkg/credential/keygen.go b/pkg/credential/keygen.go new file mode 100644 index 000000000..c57564a76 --- /dev/null +++ b/pkg/credential/keygen.go @@ -0,0 +1,62 @@ +package credential + +import ( + "crypto/ed25519" + "crypto/rand" + "encoding/pem" + "fmt" + "os" + "path/filepath" + + "golang.org/x/crypto/ssh" +) + +// DefaultSSHKeyPath returns the canonical path for the picoclaw-specific SSH key. +// The path is always ~/.ssh/picoclaw_ed25519.key (os.UserHomeDir is cross-platform). +func DefaultSSHKeyPath() (string, error) { + home, err := os.UserHomeDir() + if err != nil { + return "", fmt.Errorf("credential: cannot determine home directory: %w", err) + } + return filepath.Join(home, ".ssh", "picoclaw_ed25519.key"), nil +} + +// GenerateSSHKey generates an Ed25519 SSH key pair and writes the private key +// to path (permissions 0600) and the public key to path+".pub" (permissions 0644). +// The ~/.ssh/ directory is created with 0700 if it does not exist. +// If the files already exist they are overwritten. +func GenerateSSHKey(path string) error { + if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil { + return fmt.Errorf("credential: keygen: cannot create directory %q: %w", filepath.Dir(path), err) + } + + pubRaw, privRaw, err := ed25519.GenerateKey(rand.Reader) + if err != nil { + return fmt.Errorf("credential: keygen: ed25519 key generation failed: %w", err) + } + + // Marshal private key as OpenSSH PEM. + block, err := ssh.MarshalPrivateKey(privRaw, "") + if err != nil { + return fmt.Errorf("credential: keygen: marshal private key: %w", err) + } + privPEM := pem.EncodeToMemory(block) + + if err = os.WriteFile(path, privPEM, 0o600); err != nil { + return fmt.Errorf("credential: keygen: write private key %q: %w", path, err) + } + + // Marshal public key as authorized_keys line. + sshPub, err := ssh.NewPublicKey(pubRaw) + if err != nil { + return fmt.Errorf("credential: keygen: marshal public key: %w", err) + } + pubLine := ssh.MarshalAuthorizedKey(sshPub) + + pubPath := path + ".pub" + if err := os.WriteFile(pubPath, pubLine, 0o644); err != nil { + return fmt.Errorf("credential: keygen: write public key %q: %w", pubPath, err) + } + + return nil +} diff --git a/pkg/credential/keygen_test.go b/pkg/credential/keygen_test.go new file mode 100644 index 000000000..1e21ea0b9 --- /dev/null +++ b/pkg/credential/keygen_test.go @@ -0,0 +1,115 @@ +package credential + +import ( + "crypto/ed25519" + "os" + "path/filepath" + "runtime" + "testing" + + "golang.org/x/crypto/ssh" +) + +func TestGenerateSSHKey_CreatesFiles(t *testing.T) { + dir := t.TempDir() + keyPath := filepath.Join(dir, "test_ed25519.key") + + if err := GenerateSSHKey(keyPath); err != nil { + t.Fatalf("GenerateSSHKey() error = %v", err) + } + + // Private key must exist. + privInfo, err := os.Stat(keyPath) + if err != nil { + t.Fatalf("private key file missing: %v", err) + } + + // Check permissions on non-Windows (Windows does not support Unix permission bits). + if runtime.GOOS != "windows" { + if got := privInfo.Mode().Perm(); got != 0o600 { + t.Errorf("private key permissions = %04o, want 0600", got) + } + } + + // Public key must exist. + pubPath := keyPath + ".pub" + pubInfo, err := os.Stat(pubPath) + if err != nil { + t.Fatalf("public key file missing: %v", err) + } + if runtime.GOOS != "windows" { + if got := pubInfo.Mode().Perm(); got != 0o644 { + t.Errorf("public key permissions = %04o, want 0644", got) + } + } + + // Private key must be parseable as an OpenSSH ed25519 key. + privPEM, err := os.ReadFile(keyPath) + if err != nil { + t.Fatalf("read private key: %v", err) + } + privKey, err := ssh.ParseRawPrivateKey(privPEM) + if err != nil { + t.Fatalf("parse private key: %v", err) + } + if _, ok := privKey.(*ed25519.PrivateKey); !ok { + t.Errorf("private key type = %T, want *ed25519.PrivateKey", privKey) + } + + // Public key must be parseable as authorized_keys line. + pubBytes, err := os.ReadFile(pubPath) + if err != nil { + t.Fatalf("read public key: %v", err) + } + pubKey, _, _, rest, err := ssh.ParseAuthorizedKey(pubBytes) + if err != nil { + t.Fatalf("parse public key: %v", err) + } + if pubKey == nil { + t.Fatal("expected non-nil public key") + } + if len(rest) > 0 { + t.Errorf("unexpected trailing bytes after public key: %d bytes", len(rest)) + } +} + +func TestGenerateSSHKey_OverwritesExisting(t *testing.T) { + dir := t.TempDir() + keyPath := filepath.Join(dir, "test_ed25519.key") + + // Generate twice; second call must not error and must produce a different key. + if err := GenerateSSHKey(keyPath); err != nil { + t.Fatalf("first GenerateSSHKey() error = %v", err) + } + first, err := os.ReadFile(keyPath) + if err != nil { + t.Fatalf("read first key: %v", err) + } + + if err = GenerateSSHKey(keyPath); err != nil { + t.Fatalf("second GenerateSSHKey() error = %v", err) + } + second, err := os.ReadFile(keyPath) + if err != nil { + t.Fatalf("read second key: %v", err) + } + + // Two independently generated Ed25519 keys must differ. + if string(first) == string(second) { + t.Error("expected overwritten key to differ from original") + } +} + +func TestGenerateSSHKey_CreatesDirectory(t *testing.T) { + dir := t.TempDir() + // Nested directory that does not yet exist. + keyPath := filepath.Join(dir, "subdir", ".ssh", "picoclaw_ed25519.key") + + if err := GenerateSSHKey(keyPath); err != nil { + t.Fatalf("GenerateSSHKey() error = %v", err) + } + + if _, err := os.Stat(keyPath); err != nil { + t.Fatalf("private key not created: %v", err) + } +} diff --git a/pkg/credential/store.go b/pkg/credential/store.go new file mode 100644 index 000000000..9c72974b0 --- /dev/null +++ b/pkg/credential/store.go @@ -0,0 +1,44 @@ +package credential + +import "sync/atomic" + +// SecureStore holds a passphrase in memory. +// +// Uses atomic.Pointer so reads and writes are lock-free. +// The passphrase is never written to disk; callers decide how to +// transport it outside this store (e.g., via cmd.Env or os.Environ). +type SecureStore struct { + val atomic.Pointer[string] +} + +// NewSecureStore creates an empty SecureStore. +func NewSecureStore() *SecureStore { + return &SecureStore{} +} + +// SetString stores the passphrase. An empty string clears the store. +func (s *SecureStore) SetString(passphrase string) { + if passphrase == "" { + s.val.Store(nil) + return + } + s.val.Store(&passphrase) +} + +// Get returns the stored passphrase, or "" if not set. +func (s *SecureStore) Get() string { + if p := s.val.Load(); p != nil { + return *p + } + return "" +} + +// IsSet reports whether a passphrase is currently stored. +func (s *SecureStore) IsSet() bool { + return s.val.Load() != nil +} + +// Clear removes the stored passphrase. +func (s *SecureStore) Clear() { + s.val.Store(nil) +} diff --git a/pkg/credential/store_test.go b/pkg/credential/store_test.go new file mode 100644 index 000000000..63299743a --- /dev/null +++ b/pkg/credential/store_test.go @@ -0,0 +1,81 @@ +package credential + +import ( + "sync" + "testing" +) + +func TestSecureStore_SetGet(t *testing.T) { + s := NewSecureStore() + if s.IsSet() { + t.Error("expected empty store") + } + + s.SetString("hunter2") + if !s.IsSet() { + t.Error("expected store to be set") + } + if got := s.Get(); got != "hunter2" { + t.Errorf("Get() = %q, want %q", got, "hunter2") + } +} + +func TestSecureStore_Clear(t *testing.T) { + s := NewSecureStore() + s.SetString("secret") + s.Clear() + + if s.IsSet() { + t.Error("expected store to be empty after Clear()") + } + if got := s.Get(); got != "" { + t.Errorf("Get() after Clear() = %q, want empty", got) + } +} + +func TestSecureStore_SetOverwrites(t *testing.T) { + s := NewSecureStore() + s.SetString("first") + s.SetString("second") + + if got := s.Get(); got != "second" { + t.Errorf("Get() = %q, want %q", got, "second") + } +} + +func TestSecureStore_EmptyPassphrase(t *testing.T) { + s := NewSecureStore() + s.SetString("") // empty → should not mark as set + + if s.IsSet() { + t.Error("empty passphrase should not mark store as set") + } +} + +func TestSecureStore_ConcurrentSetGet(t *testing.T) { + s := NewSecureStore() + const goroutines = 10 + const iterations = 1000 + + var wg sync.WaitGroup + wg.Add(goroutines) + for i := 0; i < goroutines; i++ { + go func(id int) { + defer wg.Done() + for j := 0; j < iterations; j++ { + if id%2 == 0 { + s.SetString("even") + } else { + s.SetString("odd") + } + _ = s.Get() + } + }(i) + } + wg.Wait() + + final := s.Get() + if final != "" && final != "even" && final != "odd" { + t.Errorf("Get() returned unexpected value %q after concurrent Set/Get", final) + } +} From 4d4243b919accb4969f2cfe71011e4a9989b80d5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 14:08:29 +0800 Subject: [PATCH 016/234] chore(deps): bump docker/setup-buildx-action from 3 to 4 (#1595) Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/docker-build.yml | 2 +- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index dadbed212..c03c6346f 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -31,7 +31,7 @@ jobs: # ── Docker Buildx ───────────────────────── - name: 🔧 Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 # ── Login to GHCR ───────────────────────── - name: 🔑 Login to GitHub Container Registry diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 0103fcff1..375e2e211 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -59,7 +59,7 @@ jobs: uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Login to GitHub Container Registry uses: docker/login-action@v3 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4a584773d..56d2f2b23 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -77,7 +77,7 @@ jobs: uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Login to GitHub Container Registry uses: docker/login-action@v3 From 44ac304e5b122bac7fbc9c9b6699ff335f0da0e2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 14:09:01 +0800 Subject: [PATCH 017/234] chore(deps): bump actions/setup-node from 4 to 6 (#1597) Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6. - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/v4...v6) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/nightly.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 375e2e211..b29881d6c 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -48,7 +48,7 @@ jobs: go-version-file: go.mod - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version: 22 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 56d2f2b23..84aade578 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -66,7 +66,7 @@ jobs: go-version-file: go.mod - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: node-version: 22 From f247c3bc00cb8bba874712535ce07de8c6b1b613 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 14:09:36 +0800 Subject: [PATCH 018/234] chore(deps): bump actions/setup-go from 5 to 6 (#1600) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5 to 6. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/v5...v6) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/pr.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 1e9a7919a..902d4d4eb 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -34,7 +34,7 @@ jobs: persist-credentials: false - name: Setup Go - uses: actions/setup-go@v5 + uses: actions/setup-go@v6 with: go-version-file: go.mod From b7b8d1eeca7a750f3c42820727135dca8f080ced Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 14:10:19 +0800 Subject: [PATCH 019/234] chore(deps): bump docker/build-push-action from 6 to 7 (#1602) Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6...v7) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/docker-build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index c03c6346f..8b4c033c2 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -62,7 +62,7 @@ jobs: # ── Build & Push ────────────────────────── - name: 🚀 Build and push Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . push: true From 0c94e6f7b3d2a19d4e0f85bb1b5647dda14355e0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 14:11:22 +0800 Subject: [PATCH 020/234] chore(deps): bump docker/login-action from 3 to 4 (#1604) Bumps [docker/login-action](https://github.com/docker/login-action) from 3 to 4. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v4) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/docker-build.yml | 4 ++-- .github/workflows/nightly.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index 8b4c033c2..784c404a6 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -35,7 +35,7 @@ jobs: # ── Login to GHCR ───────────────────────── - name: 🔑 Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ env.GHCR_REGISTRY }} username: ${{ github.actor }} @@ -43,7 +43,7 @@ jobs: # ── Login to Docker Hub ──────────────────── - name: 🔑 Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ${{ env.DOCKERHUB_REGISTRY }} username: ${{ secrets.DOCKERHUB_USERNAME }} diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index b29881d6c..e001dc3e9 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -62,14 +62,14 @@ jobs: uses: docker/setup-buildx-action@v4 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: docker.io username: ${{ secrets.DOCKERHUB_USERNAME }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 84aade578..19c8e5404 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -80,14 +80,14 @@ jobs: uses: docker/setup-buildx-action@v4 - name: Login to GitHub Container Registry - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: registry: docker.io username: ${{ secrets.DOCKERHUB_USERNAME }} From ae23193295cd267856bc14de508baf86c11d736b Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Mon, 16 Mar 2026 14:31:32 +0800 Subject: [PATCH 021/234] feat(agent): port subturn PoC to refactor/agent branch - Replace duplicate types (ToolResult/Session/Message) with real project types - Implement ephemeralSessionStore satisfying session.SessionStore interface - Connect runTurn to real AgentLoop via runAgentLoop + AgentInstance - Fix subturn_test.go to match updated signatures and types Co-Authored-By: Claude Sonnet 4 --- pkg/agent/eventbus_mock.go | 12 ++ pkg/agent/subturn.go | 309 +++++++++++++++++++++++++++++++++++++ pkg/agent/subturn_test.go | 255 ++++++++++++++++++++++++++++++ 3 files changed, 576 insertions(+) create mode 100644 pkg/agent/eventbus_mock.go create mode 100644 pkg/agent/subturn.go create mode 100644 pkg/agent/subturn_test.go diff --git a/pkg/agent/eventbus_mock.go b/pkg/agent/eventbus_mock.go new file mode 100644 index 000000000..c9641092b --- /dev/null +++ b/pkg/agent/eventbus_mock.go @@ -0,0 +1,12 @@ +package agent + +import "fmt" + +// MockEventBus - for POC +var MockEventBus = struct { + Emit func(event any) +}{ + Emit: func(event any) { + fmt.Printf("[Mock EventBus] %T %+v\n", event, event) + }, +} diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go new file mode 100644 index 000000000..ab7d60957 --- /dev/null +++ b/pkg/agent/subturn.go @@ -0,0 +1,309 @@ +package agent + +import ( + "context" + "errors" + "fmt" + "sync" + "sync/atomic" + + "github.com/sipeed/picoclaw/pkg/providers" + "github.com/sipeed/picoclaw/pkg/session" + "github.com/sipeed/picoclaw/pkg/tools" +) + +// ====================== Config & Constants ====================== +const maxSubTurnDepth = 3 + +var ( + ErrDepthLimitExceeded = errors.New("sub-turn depth limit exceeded") + ErrInvalidSubTurnConfig = errors.New("invalid sub-turn config") +) + +// ====================== SubTurn Config ====================== +type SubTurnConfig struct { + Model string + Tools []tools.Tool + SystemPrompt string + MaxTokens int + // Can be extended with temperature, topP, etc. +} + +// ====================== Sub-turn Events (Aligned with EventBus) ====================== +type SubTurnSpawnEvent struct { + ParentID string + ChildID string + Config SubTurnConfig +} + +type SubTurnEndEvent struct { + ChildID string + Result *tools.ToolResult + Err error +} + +type SubTurnResultDeliveredEvent struct { + ParentID string + ChildID string + Result *tools.ToolResult +} + +type SubTurnOrphanResultEvent struct { + ParentID string + ChildID string + Result *tools.ToolResult +} + +// ====================== turnState (Simplified, reusable with existing structs) ====================== +type turnState struct { + ctx context.Context + cancelFunc context.CancelFunc // Used to cancel all children when this turn finishes + turnID string + parentTurnID string + depth int + childTurnIDs []string + pendingResults chan *tools.ToolResult + session session.SessionStore + mu sync.Mutex + isFinished bool // Marks if the parent Turn has ended +} + +// ====================== Helper Functions ====================== +var globalTurnCounter int64 + +func generateTurnID() string { + return fmt.Sprintf("subturn-%d", atomic.AddInt64(&globalTurnCounter, 1)) +} + +func newTurnState(ctx context.Context, id string, parent *turnState) *turnState { + turnCtx, cancel := context.WithCancel(ctx) + return &turnState{ + ctx: turnCtx, + cancelFunc: cancel, + turnID: id, + parentTurnID: parent.turnID, + depth: parent.depth + 1, + session: newEphemeralSession(parent.session), + // NOTE: In this PoC, I use a fixed-size channel (16). + // Under high concurrency or long-running sub-turns, this might fill up and cause + // intermediate results to be discarded in deliverSubTurnResult. + // For production, consider an unbounded queue or a blocking strategy with backpressure. + pendingResults: make(chan *tools.ToolResult, 16), + } +} + +// Finish marks the turn as finished and cancels its context, aborting any running sub-turns. +func (ts *turnState) Finish() { + ts.mu.Lock() + defer ts.mu.Unlock() + ts.isFinished = true + if ts.cancelFunc != nil { + ts.cancelFunc() + } +} + +// ephemeralSessionStore is a pure in-memory SessionStore for SubTurns. +// It never writes to disk, keeping sub-turn history isolated from the parent session. +type ephemeralSessionStore struct { + mu sync.Mutex + history []providers.Message + summary string +} + +func (e *ephemeralSessionStore) AddMessage(sessionKey, role, content string) { + e.mu.Lock() + defer e.mu.Unlock() + e.history = append(e.history, providers.Message{Role: role, Content: content}) +} + +func (e *ephemeralSessionStore) AddFullMessage(sessionKey string, msg providers.Message) { + e.mu.Lock() + defer e.mu.Unlock() + e.history = append(e.history, msg) +} + +func (e *ephemeralSessionStore) GetHistory(key string) []providers.Message { + e.mu.Lock() + defer e.mu.Unlock() + out := make([]providers.Message, len(e.history)) + copy(out, e.history) + return out +} + +func (e *ephemeralSessionStore) GetSummary(key string) string { + e.mu.Lock() + defer e.mu.Unlock() + return e.summary +} + +func (e *ephemeralSessionStore) SetSummary(key, summary string) { + e.mu.Lock() + defer e.mu.Unlock() + e.summary = summary +} + +func (e *ephemeralSessionStore) SetHistory(key string, history []providers.Message) { + e.mu.Lock() + defer e.mu.Unlock() + e.history = make([]providers.Message, len(history)) + copy(e.history, history) +} + +func (e *ephemeralSessionStore) TruncateHistory(key string, keepLast int) { + e.mu.Lock() + defer e.mu.Unlock() + if len(e.history) > keepLast { + e.history = e.history[len(e.history)-keepLast:] + } +} + +func (e *ephemeralSessionStore) Save(key string) error { return nil } +func (e *ephemeralSessionStore) Close() error { return nil } + +func newEphemeralSession(_ session.SessionStore) session.SessionStore { + return &ephemeralSessionStore{} +} + +// ====================== Core Function: spawnSubTurn ====================== +func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg SubTurnConfig) (result *tools.ToolResult, err error) { + // 1. Depth limit check + if parentTS.depth >= maxSubTurnDepth { + return nil, ErrDepthLimitExceeded + } + + // 2. Config validation + if cfg.Model == "" { + return nil, ErrInvalidSubTurnConfig + } + + // Create a sub-context for the child turn to support cancellation + childCtx, cancel := context.WithCancel(ctx) + defer cancel() + + // 3. Create child Turn state + childID := generateTurnID() + childTS := newTurnState(childCtx, childID, parentTS) + + // 4. Establish parent-child relationship (thread-safe) + parentTS.mu.Lock() + parentTS.childTurnIDs = append(parentTS.childTurnIDs, childID) + parentTS.mu.Unlock() + + // 5. Emit Spawn event (currently using Mock, will be replaced by real EventBus) + MockEventBus.Emit(SubTurnSpawnEvent{ + ParentID: parentTS.turnID, + ChildID: childID, + Config: cfg, + }) + + // 6. Defer emitting End event, and recover from panics to ensure it's always fired + defer func() { + if r := recover(); r != nil { + err = fmt.Errorf("subturn panicked: %v", r) + } + + MockEventBus.Emit(SubTurnEndEvent{ + ChildID: childID, + Result: result, + Err: err, + }) + }() + + // 7. Execute sub-turn via the real agent loop. + // Build a child AgentInstance from SubTurnConfig, inheriting defaults from the parent agent. + result, err = runTurn(childCtx, al, childTS, cfg) + + // 8. Deliver result back to parent Turn + deliverSubTurnResult(parentTS, childID, result) + + return result, err +} + +// ====================== Result Delivery ====================== +func deliverSubTurnResult(parentTS *turnState, childID string, result *tools.ToolResult) { + parentTS.mu.Lock() + defer parentTS.mu.Unlock() + + // Emit ResultDelivered event + MockEventBus.Emit(SubTurnResultDeliveredEvent{ + ParentID: parentTS.turnID, + ChildID: childID, + Result: result, + }) + + if !parentTS.isFinished { + // Parent Turn is still running → Place in pending queue (handled automatically by parent loop in next round) + select { + case parentTS.pendingResults <- result: + default: + fmt.Println("[SubTurn] warning: pendingResults channel full") + } + return + } + + // Parent Turn has ended + // emit an OrphanResultEvent so the system/UI can handle this late arrival. + if result != nil { + MockEventBus.Emit(SubTurnOrphanResultEvent{ + ParentID: parentTS.turnID, + ChildID: childID, + Result: result, + }) + } +} + +// runTurn builds a temporary AgentInstance from SubTurnConfig and delegates to +// the real agent loop. The child's ephemeral session is used for history so it +// never pollutes the parent session. +func runTurn(ctx context.Context, al *AgentLoop, ts *turnState, cfg SubTurnConfig) (*tools.ToolResult, error) { + // Derive candidates from the requested model using the parent loop's provider. + defaultProvider := al.GetConfig().Agents.Defaults.Provider + candidates := providers.ResolveCandidates( + providers.ModelConfig{Primary: cfg.Model}, + defaultProvider, + ) + + // Build a minimal AgentInstance for this sub-turn. + // It reuses the parent loop's provider and config, but gets its own + // ephemeral session store and tool registry. + toolRegistry := tools.NewToolRegistry() + for _, t := range cfg.Tools { + toolRegistry.Register(t) + } + + parentAgent := al.GetRegistry().GetDefaultAgent() + childAgent := &AgentInstance{ + ID: ts.turnID, + Model: cfg.Model, + MaxIterations: parentAgent.MaxIterations, + MaxTokens: cfg.MaxTokens, + Temperature: parentAgent.Temperature, + ThinkingLevel: parentAgent.ThinkingLevel, + ContextWindow: cfg.MaxTokens, + SummarizeMessageThreshold: parentAgent.SummarizeMessageThreshold, + SummarizeTokenPercent: parentAgent.SummarizeTokenPercent, + Provider: parentAgent.Provider, + Sessions: ts.session, + ContextBuilder: parentAgent.ContextBuilder, + Tools: toolRegistry, + Candidates: candidates, + } + if childAgent.MaxTokens == 0 { + childAgent.MaxTokens = parentAgent.MaxTokens + childAgent.ContextWindow = parentAgent.ContextWindow + } + + finalContent, err := al.runAgentLoop(ctx, childAgent, processOptions{ + SessionKey: ts.turnID, + UserMessage: cfg.SystemPrompt, + DefaultResponse: "", + EnableSummary: false, + SendResponse: false, + }) + if err != nil { + return nil, err + } + return &tools.ToolResult{ForLLM: finalContent}, nil +} + +// ====================== Other Types ====================== diff --git a/pkg/agent/subturn_test.go b/pkg/agent/subturn_test.go new file mode 100644 index 000000000..943c46015 --- /dev/null +++ b/pkg/agent/subturn_test.go @@ -0,0 +1,255 @@ +package agent + +import ( + "context" + "reflect" + "testing" + + "github.com/sipeed/picoclaw/pkg/tools" +) + +// ====================== Test Helper: Event Collector ====================== +type eventCollector struct { + events []any +} + +func (c *eventCollector) collect(e any) { + c.events = append(c.events, e) +} + +func (c *eventCollector) hasEventOfType(typ any) bool { + targetType := reflect.TypeOf(typ) + for _, e := range c.events { + if reflect.TypeOf(e) == targetType { + return true + } + } + return false +} + +func (c *eventCollector) countOfType(typ any) int { + targetType := reflect.TypeOf(typ) + count := 0 + for _, e := range c.events { + if reflect.TypeOf(e) == targetType { + count++ + } + } + return count +} + +// ====================== Main Test Function ====================== +func TestSpawnSubTurn(t *testing.T) { + tests := []struct { + name string + parentDepth int + config SubTurnConfig + wantErr error + wantSpawn bool + wantEnd bool + wantDepthFail bool + }{ + { + name: "Basic success path - Single layer sub-turn", + parentDepth: 0, + config: SubTurnConfig{ + Model: "gpt-4o-mini", + Tools: []tools.Tool{}, // At least one tool + }, + wantErr: nil, + wantSpawn: true, + wantEnd: true, + }, + { + name: "Nested 2 layers - Normal", + parentDepth: 1, + config: SubTurnConfig{ + Model: "gpt-4o-mini", + Tools: []tools.Tool{}, + }, + wantErr: nil, + wantSpawn: true, + wantEnd: true, + }, + { + name: "Depth limit triggered - 4th layer fails", + parentDepth: 3, + config: SubTurnConfig{ + Model: "gpt-4o-mini", + Tools: []tools.Tool{}, + }, + wantErr: ErrDepthLimitExceeded, + wantSpawn: false, + wantEnd: false, + wantDepthFail: true, + }, + { + name: "Invalid config - Empty Model", + parentDepth: 0, + config: SubTurnConfig{ + Model: "", + Tools: []tools.Tool{}, + }, + wantErr: ErrInvalidSubTurnConfig, + wantSpawn: false, + wantEnd: false, + }, + } + + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + // Prepare parent Turn + parent := &turnState{ + ctx: context.Background(), + turnID: "parent-1", + depth: tt.parentDepth, + childTurnIDs: []string{}, + pendingResults: make(chan *tools.ToolResult, 10), + session: &ephemeralSessionStore{}, + } + + // Replace mock with test collector + collector := &eventCollector{} + originalEmit := MockEventBus.Emit + MockEventBus.Emit = collector.collect + defer func() { MockEventBus.Emit = originalEmit }() + + // Execute spawnSubTurn + result, err := spawnSubTurn(context.Background(), al, parent, tt.config) + + // Assert errors + if tt.wantErr != nil { + if err == nil || err != tt.wantErr { + t.Errorf("expected error %v, got %v", tt.wantErr, err) + } + return + } + if err != nil { + t.Errorf("unexpected error: %v", err) + return + } + + // Verify result + if result == nil { + t.Error("expected non-nil result") + } + + // Verify event emission + if tt.wantSpawn { + if !collector.hasEventOfType(SubTurnSpawnEvent{}) { + t.Error("SubTurnSpawnEvent not emitted") + } + } + if tt.wantEnd { + if !collector.hasEventOfType(SubTurnEndEvent{}) { + t.Error("SubTurnEndEvent not emitted") + } + } + + // Verify turn tree + if len(parent.childTurnIDs) == 0 && !tt.wantDepthFail { + t.Error("child Turn not added to parent.childTurnIDs") + } + + // Verify result delivery (pendingResults or history) + if len(parent.pendingResults) > 0 || len(parent.session.GetHistory("")) > 0 { + // Result delivered via at least one path + } else { + t.Error("child result not delivered") + } + }) + } +} + +// ====================== Extra Independent Test: Ephemeral Session Isolation ====================== +func TestSpawnSubTurn_EphemeralSessionIsolation(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + parentSession := &ephemeralSessionStore{} + parentSession.AddMessage("", "user", "parent msg") + parent := &turnState{ + ctx: context.Background(), + turnID: "parent-1", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 1), + session: parentSession, + } + + cfg := SubTurnConfig{Model: "gpt-4o-mini", Tools: []tools.Tool{}} + + // Record main session length before execution + originalLen := len(parent.session.GetHistory("")) + + _, _ = spawnSubTurn(context.Background(), al, parent, cfg) + + // After sub-turn ends, main session must remain unchanged + if len(parent.session.GetHistory("")) != originalLen { + t.Error("ephemeral session polluted the main session") + } +} + +// ====================== Extra Independent Test: Result Delivery Path ====================== +func TestSpawnSubTurn_ResultDelivery(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + parent := &turnState{ + ctx: context.Background(), + turnID: "parent-1", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 1), + session: &ephemeralSessionStore{}, + } + + cfg := SubTurnConfig{Model: "gpt-4o-mini", Tools: []tools.Tool{}} + + _, _ = spawnSubTurn(context.Background(), al, parent, cfg) + + // Check if pendingResults received the result + select { + case res := <-parent.pendingResults: + if res == nil { + t.Error("received nil result in pendingResults") + } + default: + t.Error("result did not enter pendingResults") + } +} + +// ====================== Extra Independent Test: Orphan Result Routing ====================== +func TestSpawnSubTurn_OrphanResultRouting(t *testing.T) { + parentCtx, cancelParent := context.WithCancel(context.Background()) + parent := &turnState{ + ctx: parentCtx, + cancelFunc: cancelParent, + turnID: "parent-1", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 1), + session: &ephemeralSessionStore{}, + } + + collector := &eventCollector{} + originalEmit := MockEventBus.Emit + MockEventBus.Emit = collector.collect + defer func() { MockEventBus.Emit = originalEmit }() + + // Simulate parent finishing before child delivers result + parent.Finish() + + // Call deliverSubTurnResult directly to simulate a delayed child + deliverSubTurnResult(parent, "delayed-child", &tools.ToolResult{ForLLM: "late result"}) + + // Verify Orphan event is emitted + if !collector.hasEventOfType(SubTurnOrphanResultEvent{}) { + t.Error("SubTurnOrphanResultEvent not emitted for finished parent") + } + + // Verify history is NOT polluted + if len(parent.session.GetHistory("")) != 0 { + t.Error("Parent history was polluted by orphan result") + } +} From 9c82b0baa224d419cb63ba986bdbb27e3c115785 Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 14:20:24 +0800 Subject: [PATCH 022/234] refactor(agent): context boundary detection, proactive budget check, and safe compression MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Separate context_window from max_tokens — they serve different purposes (input capacity vs output generation limit). The previous conflation caused premature summarization or missed compression triggers. Changes: - Add context_window field to AgentDefaults config (default: 4x max_tokens) - Extract boundary-safe truncation helpers (isSafeBoundary, findSafeBoundary) into context_budget.go — pure functions with no AgentLoop dependency - forceCompression: align split to safe boundary so tool-call sequences (assistant+ToolCalls → tool results) are never torn apart - summarizeSession: use findSafeBoundary instead of hardcoded keep-last-4 - estimateTokens: count ToolCalls arguments and ToolCallID metadata, not just Content — fixes systematic undercounting in tool-heavy sessions - Add proactive context budget check before LLM call in runAgentLoop, preventing 400 context-length errors instead of reacting to them - Add estimateToolDefsTokens for tool definition token cost Closes #556, closes #665 Ref #1439 --- pkg/agent/context_budget.go | 133 ++++++++ pkg/agent/context_budget_test.go | 545 +++++++++++++++++++++++++++++++ pkg/agent/instance.go | 13 +- pkg/agent/loop.go | 49 ++- pkg/config/config.go | 1 + 5 files changed, 727 insertions(+), 14 deletions(-) create mode 100644 pkg/agent/context_budget.go create mode 100644 pkg/agent/context_budget_test.go diff --git a/pkg/agent/context_budget.go b/pkg/agent/context_budget.go new file mode 100644 index 000000000..2eec9c267 --- /dev/null +++ b/pkg/agent/context_budget.go @@ -0,0 +1,133 @@ +// PicoClaw - Ultra-lightweight personal AI agent +// License: MIT +// +// Copyright (c) 2026 PicoClaw contributors + +package agent + +import ( + "encoding/json" + "unicode/utf8" + + "github.com/sipeed/picoclaw/pkg/providers" +) + +// isSafeBoundary reports whether index is a valid position to split a message +// history for truncation or compression. Splitting at index means: +// - history[:index] is dropped or summarized +// - history[index:] is kept +// +// A boundary is safe when the kept portion begins at a "user" message, +// ensuring no tool-call sequence (assistant+ToolCalls → tool results) +// is torn apart across the split. +func isSafeBoundary(history []providers.Message, index int) bool { + if index <= 0 || index >= len(history) { + return true + } + return history[index].Role == "user" +} + +// findSafeBoundary locates the nearest safe split point to targetIndex. +// It scans backward first (preserving more context), then forward. +// Returns targetIndex unchanged only when no safe boundary exists. +func findSafeBoundary(history []providers.Message, targetIndex int) int { + if len(history) == 0 { + return 0 + } + if targetIndex <= 0 { + return 0 + } + if targetIndex >= len(history) { + return len(history) + } + + if isSafeBoundary(history, targetIndex) { + return targetIndex + } + + // Backward scan: prefer keeping more messages. + for i := targetIndex - 1; i > 0; i-- { + if isSafeBoundary(history, i) { + return i + } + } + + // Forward scan: fall back to keeping fewer messages. + for i := targetIndex + 1; i < len(history); i++ { + if isSafeBoundary(history, i) { + return i + } + } + + return targetIndex +} + +// estimateMessageTokens estimates the token count for a single message, +// including Content, ToolCalls arguments, and ToolCallID metadata. +// Uses a heuristic of 2.5 characters per token. +func estimateMessageTokens(msg providers.Message) int { + chars := utf8.RuneCountInString(msg.Content) + + for _, tc := range msg.ToolCalls { + // Count tool call metadata: ID, type, function name + chars += len(tc.ID) + len(tc.Type) + len(tc.Name) + if tc.Function != nil { + chars += len(tc.Function.Name) + len(tc.Function.Arguments) + } + } + + if msg.ToolCallID != "" { + chars += len(msg.ToolCallID) + } + + // Per-message overhead for role label, JSON structure, separators. + const messageOverhead = 12 + chars += messageOverhead + + return chars * 2 / 5 +} + +// estimateToolDefsTokens estimates the total token cost of tool definitions +// as they appear in the LLM request. Each tool's name, description, and +// JSON schema parameters contribute to the context window budget. +func estimateToolDefsTokens(defs []providers.ToolDefinition) int { + if len(defs) == 0 { + return 0 + } + + totalChars := 0 + for _, d := range defs { + totalChars += len(d.Function.Name) + len(d.Function.Description) + + if d.Function.Parameters != nil { + if paramJSON, err := json.Marshal(d.Function.Parameters); err == nil { + totalChars += len(paramJSON) + } + } + + // Per-tool overhead: type field, JSON structure, separators. + totalChars += 20 + } + + return totalChars * 2 / 5 +} + +// isOverContextBudget checks whether the assembled messages plus tool definitions +// and output reserve would exceed the model's context window. This enables +// proactive compression before calling the LLM, rather than reacting to 400 errors. +func isOverContextBudget( + contextWindow int, + messages []providers.Message, + toolDefs []providers.ToolDefinition, + maxTokens int, +) bool { + msgTokens := 0 + for _, m := range messages { + msgTokens += estimateMessageTokens(m) + } + + toolTokens := estimateToolDefsTokens(toolDefs) + total := msgTokens + toolTokens + maxTokens + + return total > contextWindow +} diff --git a/pkg/agent/context_budget_test.go b/pkg/agent/context_budget_test.go new file mode 100644 index 000000000..c8a6b19c5 --- /dev/null +++ b/pkg/agent/context_budget_test.go @@ -0,0 +1,545 @@ +package agent + +import ( + "fmt" + "strings" + "testing" + + "github.com/sipeed/picoclaw/pkg/providers" +) + +// msgUser creates a user message. +func msgUser(content string) providers.Message { + return providers.Message{Role: "user", Content: content} +} + +// msgAssistant creates a plain assistant message (no tool calls). +func msgAssistant(content string) providers.Message { + return providers.Message{Role: "assistant", Content: content} +} + +// msgAssistantTC creates an assistant message with tool calls. +func msgAssistantTC(toolIDs ...string) providers.Message { + tcs := make([]providers.ToolCall, len(toolIDs)) + for i, id := range toolIDs { + tcs[i] = providers.ToolCall{ + ID: id, + Type: "function", + Name: "tool_" + id, + Function: &providers.FunctionCall{ + Name: "tool_" + id, + Arguments: `{"key":"value"}`, + }, + } + } + return providers.Message{Role: "assistant", ToolCalls: tcs} +} + +// msgTool creates a tool result message. +func msgTool(callID, content string) providers.Message { + return providers.Message{Role: "tool", ToolCallID: callID, Content: content} +} + +func TestIsSafeBoundary(t *testing.T) { + tests := []struct { + name string + history []providers.Message + index int + want bool + }{ + { + name: "empty history, index 0", + history: nil, + index: 0, + want: true, + }, + { + name: "single user message, index 0", + history: []providers.Message{msgUser("hi")}, + index: 0, + want: true, + }, + { + name: "single user message, index 1 (end)", + history: []providers.Message{msgUser("hi")}, + index: 1, + want: true, + }, + { + name: "at user message", + history: []providers.Message{ + msgAssistant("hello"), + msgUser("how are you"), + msgAssistant("fine"), + }, + index: 1, + want: true, + }, + { + name: "at assistant without tool calls", + history: []providers.Message{ + msgUser("hello"), + msgAssistant("response"), + msgUser("follow up"), + }, + index: 1, + want: false, + }, + { + name: "at assistant with tool calls", + history: []providers.Message{ + msgUser("search something"), + msgAssistantTC("tc1"), + msgTool("tc1", "result"), + msgAssistant("here is what I found"), + }, + index: 1, + want: false, + }, + { + name: "at tool result", + history: []providers.Message{ + msgUser("do something"), + msgAssistantTC("tc1"), + msgTool("tc1", "done"), + msgAssistant("completed"), + }, + index: 2, + want: false, + }, + { + name: "negative index", + history: []providers.Message{ + msgUser("hello"), + }, + index: -1, + want: true, + }, + { + name: "index beyond length", + history: []providers.Message{ + msgUser("hello"), + }, + index: 5, + want: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := isSafeBoundary(tt.history, tt.index) + if got != tt.want { + t.Errorf("isSafeBoundary(history, %d) = %v, want %v", tt.index, got, tt.want) + } + }) + } +} + +func TestFindSafeBoundary(t *testing.T) { + tests := []struct { + name string + history []providers.Message + targetIndex int + want int + }{ + { + name: "empty history", + history: nil, + targetIndex: 0, + want: 0, + }, + { + name: "target at 0", + history: []providers.Message{msgUser("hi")}, + targetIndex: 0, + want: 0, + }, + { + name: "target beyond length", + history: []providers.Message{msgUser("hi")}, + targetIndex: 5, + want: 1, + }, + { + name: "target already at user message", + history: []providers.Message{ + msgUser("q1"), + msgAssistant("a1"), + msgUser("q2"), + msgAssistant("a2"), + }, + targetIndex: 2, + want: 2, + }, + { + name: "target at assistant, scan backward finds user", + history: []providers.Message{ + msgUser("q1"), + msgAssistant("a1"), + msgUser("q2"), + msgAssistant("a2"), + msgUser("q3"), + }, + targetIndex: 3, // assistant "a2" + want: 2, // backward to user "q2" + }, + { + name: "target inside tool sequence, scan backward finds user", + history: []providers.Message{ + msgUser("q1"), + msgAssistant("a1"), + msgUser("q2"), + msgAssistantTC("tc1", "tc2"), + msgTool("tc1", "r1"), + msgTool("tc2", "r2"), + msgAssistant("summary"), + msgUser("q3"), + }, + targetIndex: 4, // tool result "r1" + want: 2, // backward: 3=assistant+TC (not safe), 2=user → safe + }, + { + name: "target inside tool sequence, backward finds user before chain", + history: []providers.Message{ + msgUser("q1"), + msgAssistant("a1"), + msgUser("q2"), + msgAssistantTC("tc1", "tc2"), + msgTool("tc1", "r1"), + msgTool("tc2", "r2"), + msgAssistant("summary"), + msgUser("q3"), + }, + targetIndex: 5, // tool result "r2" + want: 2, // backward: 4=tool, 3=assistant+TC, 2=user → safe + }, + { + name: "no backward user, scan forward finds one", + history: []providers.Message{ + msgAssistantTC("tc1"), + msgTool("tc1", "r1"), + msgAssistant("a1"), + msgUser("q1"), + }, + targetIndex: 1, // tool result + want: 3, // forward to user "q1" + }, + { + name: "multi-step tool chain preserves atomicity", + history: []providers.Message{ + msgUser("q1"), + msgAssistant("a1"), + msgUser("q2"), + msgAssistantTC("tc1"), + msgTool("tc1", "r1"), + msgAssistantTC("tc2"), + msgTool("tc2", "r2"), + msgAssistant("final"), + msgUser("q3"), + msgAssistant("a3"), + }, + targetIndex: 5, // second assistant+TC + want: 2, // backward: 4=tool, 3=assistant+TC, 2=user → safe + }, + { + name: "all non-user messages returns target unchanged", + history: []providers.Message{ + msgAssistant("a1"), + msgAssistant("a2"), + msgAssistant("a3"), + }, + targetIndex: 1, + want: 1, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := findSafeBoundary(tt.history, tt.targetIndex) + if got != tt.want { + t.Errorf("findSafeBoundary(history, %d) = %d, want %d", + tt.targetIndex, got, tt.want) + } + }) + } +} + +func TestFindSafeBoundary_BackwardScanSkipsToolSequence(t *testing.T) { + // A long tool-call chain: user → assistant+TC → tool → tool → ... → assistant → user + // Target is inside the chain; boundary should skip the entire chain backward. + history := []providers.Message{ + msgUser("start"), // 0 + msgAssistant("before chain"), // 1 + msgUser("trigger"), // 2 ← expected safe boundary + msgAssistantTC("t1", "t2", "t3"), // 3 + msgTool("t1", "r1"), // 4 + msgTool("t2", "r2"), // 5 + msgTool("t3", "r3"), // 6 + msgAssistantTC("t4"), // 7 + msgTool("t4", "r4"), // 8 + msgAssistant("chain done"), // 9 + msgUser("next"), // 10 + } + + // Target at index 6 (middle of tool results) + got := findSafeBoundary(history, 6) + if got != 2 { + t.Errorf("findSafeBoundary(history, 6) = %d, want 2 (user before chain)", got) + } +} + +func TestEstimateMessageTokens(t *testing.T) { + tests := []struct { + name string + msg providers.Message + want int // minimum expected tokens (exact value depends on overhead) + }{ + { + name: "plain user message", + msg: msgUser("Hello, world!"), + want: 1, // at least some tokens + }, + { + name: "empty message still has overhead", + msg: providers.Message{Role: "user"}, + want: 1, // message overhead alone + }, + { + name: "assistant with tool calls", + msg: msgAssistantTC("tc_123"), + want: 1, + }, + { + name: "tool result with ID", + msg: msgTool("call_abc", "Here is the search result with lots of content"), + want: 1, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := estimateMessageTokens(tt.msg) + if got < tt.want { + t.Errorf("estimateMessageTokens() = %d, want >= %d", got, tt.want) + } + }) + } +} + +func TestEstimateMessageTokens_ToolCallsContribute(t *testing.T) { + plain := msgAssistant("thinking") + withTC := providers.Message{ + Role: "assistant", + Content: "thinking", + ToolCalls: []providers.ToolCall{ + { + ID: "call_1", + Type: "function", + Name: "web_search", + Function: &providers.FunctionCall{ + Name: "web_search", + Arguments: `{"query":"picoclaw agent framework","max_results":5}`, + }, + }, + }, + } + + plainTokens := estimateMessageTokens(plain) + withTCTokens := estimateMessageTokens(withTC) + + if withTCTokens <= plainTokens { + t.Errorf("message with ToolCalls (%d tokens) should exceed plain message (%d tokens)", + withTCTokens, plainTokens) + } +} + +func TestEstimateMessageTokens_MultibyteContent(t *testing.T) { + // Multi-byte characters (e.g. emoji, accented letters) are single runes + // but may map to different token counts. The heuristic should still produce + // reasonable estimates via RuneCountInString. + msg := msgUser("caf\u00e9 na\u00efve r\u00e9sum\u00e9 \u00fcber stra\u00dfe") + tokens := estimateMessageTokens(msg) + if tokens <= 0 { + t.Errorf("multibyte message should produce positive token count, got %d", tokens) + } +} + +func TestEstimateMessageTokens_LargeArguments(t *testing.T) { + // Simulate a tool call with large JSON arguments. + largeArgs := fmt.Sprintf(`{"content":"%s"}`, strings.Repeat("x", 5000)) + msg := providers.Message{ + Role: "assistant", + ToolCalls: []providers.ToolCall{ + { + ID: "call_large", + Type: "function", + Name: "write_file", + Function: &providers.FunctionCall{ + Name: "write_file", + Arguments: largeArgs, + }, + }, + }, + } + + tokens := estimateMessageTokens(msg) + // 5000+ chars → at least 2000 tokens with the 2.5 char/token heuristic + if tokens < 2000 { + t.Errorf("large tool call arguments should produce significant token count, got %d", tokens) + } +} + +// --- estimateToolDefsTokens tests --- + +func TestEstimateToolDefsTokens(t *testing.T) { + tests := []struct { + name string + defs []providers.ToolDefinition + want int // minimum expected tokens + }{ + { + name: "empty tool list", + defs: nil, + want: 0, + }, + { + name: "single tool with params", + defs: []providers.ToolDefinition{ + { + Type: "function", + Function: providers.ToolFunctionDefinition{ + Name: "web_search", + Description: "Search the web for information", + Parameters: map[string]any{ + "type": "object", + "properties": map[string]any{ + "query": map[string]any{"type": "string"}, + }, + "required": []any{"query"}, + }, + }, + }, + }, + want: 1, + }, + { + name: "tool without params", + defs: []providers.ToolDefinition{ + { + Type: "function", + Function: providers.ToolFunctionDefinition{ + Name: "list_dir", + Description: "List directory contents", + }, + }, + }, + want: 1, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := estimateToolDefsTokens(tt.defs) + if got < tt.want { + t.Errorf("estimateToolDefsTokens() = %d, want >= %d", got, tt.want) + } + }) + } +} + +func TestEstimateToolDefsTokens_ScalesWithCount(t *testing.T) { + makeTool := func(name string) providers.ToolDefinition { + return providers.ToolDefinition{ + Type: "function", + Function: providers.ToolFunctionDefinition{ + Name: name, + Description: "A test tool that does something useful", + Parameters: map[string]any{ + "type": "object", + "properties": map[string]any{ + "input": map[string]any{"type": "string", "description": "Input value"}, + }, + }, + }, + } + } + + one := estimateToolDefsTokens([]providers.ToolDefinition{makeTool("tool_a")}) + three := estimateToolDefsTokens([]providers.ToolDefinition{ + makeTool("tool_a"), makeTool("tool_b"), makeTool("tool_c"), + }) + + if three <= one { + t.Errorf("3 tools (%d tokens) should exceed 1 tool (%d tokens)", three, one) + } +} + +// --- isOverContextBudget tests --- + +func TestIsOverContextBudget(t *testing.T) { + systemMsg := providers.Message{Role: "system", Content: strings.Repeat("x", 1000)} + userMsg := msgUser("hello") + smallHistory := []providers.Message{systemMsg, msgUser("q1"), msgAssistant("a1"), userMsg} + + tools := []providers.ToolDefinition{ + { + Type: "function", + Function: providers.ToolFunctionDefinition{ + Name: "test_tool", + Description: "A test tool", + Parameters: map[string]any{"type": "object"}, + }, + }, + } + + tests := []struct { + name string + contextWindow int + messages []providers.Message + toolDefs []providers.ToolDefinition + maxTokens int + want bool + }{ + { + name: "within budget", + contextWindow: 100000, + messages: smallHistory, + toolDefs: tools, + maxTokens: 4096, + want: false, + }, + { + name: "over budget with small window", + contextWindow: 100, // very small window + messages: smallHistory, + toolDefs: tools, + maxTokens: 4096, + want: true, + }, + { + name: "large max_tokens eats budget", + contextWindow: 2000, + messages: smallHistory, + toolDefs: tools, + maxTokens: 1800, // leaves almost no room + want: true, + }, + { + name: "empty messages within budget", + contextWindow: 10000, + messages: nil, + toolDefs: nil, + maxTokens: 4096, + want: false, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := isOverContextBudget(tt.contextWindow, tt.messages, tt.toolDefs, tt.maxTokens) + if got != tt.want { + t.Errorf("isOverContextBudget() = %v, want %v", got, tt.want) + } + }) + } +} diff --git a/pkg/agent/instance.go b/pkg/agent/instance.go index 0c7baa1ee..c34f9b4a4 100644 --- a/pkg/agent/instance.go +++ b/pkg/agent/instance.go @@ -127,6 +127,17 @@ func NewAgentInstance( maxTokens = 8192 } + contextWindow := defaults.ContextWindow + if contextWindow == 0 { + // Default heuristic: 4x the output token limit. + // Most models have context windows well above their output limits + // (e.g., GPT-4o 128k ctx / 16k out, Claude 200k ctx / 8k out). + // 4x is a conservative lower bound that avoids premature + // summarization while remaining safe — the reactive + // forceCompression handles any overshoot. + contextWindow = maxTokens * 4 + } + temperature := 0.7 if defaults.Temperature != nil { temperature = *defaults.Temperature @@ -224,7 +235,7 @@ func NewAgentInstance( MaxTokens: maxTokens, Temperature: temperature, ThinkingLevel: thinkingLevel, - ContextWindow: maxTokens, + ContextWindow: contextWindow, SummarizeMessageThreshold: summarizeMessageThreshold, SummarizeTokenPercent: summarizeTokenPercent, Provider: provider, diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 21516e7de..f20f2c938 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -17,7 +17,6 @@ import ( "sync" "sync/atomic" "time" - "unicode/utf8" "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/channels" @@ -931,6 +930,24 @@ func (al *AgentLoop) runAgentLoop( maxMediaSize := cfg.Agents.Defaults.GetMaxMediaSize() messages = resolveMediaRefs(messages, al.mediaStore, maxMediaSize) + // 1.5. Proactive context budget check: compress before LLM call + // rather than waiting for a 400 context-length error. + if !opts.NoHistory { + toolDefs := agent.Tools.ToProviderDefs() + if isOverContextBudget(agent.ContextWindow, messages, toolDefs, agent.MaxTokens) { + logger.WarnCF("agent", "Proactive compression: context budget exceeded before LLM call", + map[string]any{"session_key": opts.SessionKey}) + al.forceCompression(agent, opts.SessionKey) + newHistory := agent.Sessions.GetHistory(opts.SessionKey) + newSummary := agent.Sessions.GetSummary(opts.SessionKey) + messages = agent.ContextBuilder.BuildMessages( + newHistory, newSummary, opts.UserMessage, + opts.Media, opts.Channel, opts.ChatID, + ) + messages = resolveMediaRefs(messages, al.mediaStore, maxMediaSize) + } + } + // 2. Save user message to session agent.Sessions.AddMessage(opts.SessionKey, "user", opts.UserMessage) @@ -1539,7 +1556,8 @@ func (al *AgentLoop) maybeSummarize(agent *AgentInstance, sessionKey, channel, c } // forceCompression aggressively reduces context when the limit is hit. -// It drops the oldest 50% of messages (keeping system prompt and last user message). +// It drops the oldest ~50% of messages (keeping system prompt and last user message), +// aligning the split to a safe boundary so tool-call sequences stay intact. func (al *AgentLoop) forceCompression(agent *AgentInstance, sessionKey string) { history := agent.Sessions.GetHistory(sessionKey) if len(history) <= 4 { @@ -1554,8 +1572,8 @@ func (al *AgentLoop) forceCompression(agent *AgentInstance, sessionKey string) { return } - // Helper to find the mid-point of the conversation - mid := len(conversation) / 2 + // Find a safe mid-point that does not split a tool-call sequence. + mid := findSafeBoundary(conversation, len(conversation)/2) // New history structure: // 1. System Prompt (with compression note appended) @@ -1687,12 +1705,18 @@ func (al *AgentLoop) summarizeSession(agent *AgentInstance, sessionKey string) { history := agent.Sessions.GetHistory(sessionKey) summary := agent.Sessions.GetSummary(sessionKey) - // Keep last 4 messages for continuity + // Keep last few messages for continuity, aligned to a safe boundary + // so that no tool-call sequence is split. if len(history) <= 4 { return } - toSummarize := history[:len(history)-4] + safeCut := findSafeBoundary(history, len(history)-4) + if safeCut <= 0 { + return + } + keepCount := len(history) - safeCut + toSummarize := history[:safeCut] // Oversized Message Guard maxMessageTokens := agent.ContextWindow / 2 @@ -1757,7 +1781,7 @@ func (al *AgentLoop) summarizeSession(agent *AgentInstance, sessionKey string) { if finalSummary != "" { agent.Sessions.SetSummary(sessionKey, finalSummary) - agent.Sessions.TruncateHistory(sessionKey, 4) + agent.Sessions.TruncateHistory(sessionKey, keepCount) agent.Sessions.Save(sessionKey) } } @@ -1895,15 +1919,14 @@ func (al *AgentLoop) summarizeBatch( } // estimateTokens estimates the number of tokens in a message list. -// Uses a safe heuristic of 2.5 characters per token to account for CJK and other -// overheads better than the previous 3 chars/token. +// Counts Content, ToolCalls arguments, and ToolCallID metadata so that +// tool-heavy conversations are not systematically undercounted. func (al *AgentLoop) estimateTokens(messages []providers.Message) int { - totalChars := 0 + total := 0 for _, m := range messages { - totalChars += utf8.RuneCountInString(m.Content) + total += estimateMessageTokens(m) } - // 2.5 chars per token = totalChars * 2 / 5 - return totalChars * 2 / 5 + return total } func (al *AgentLoop) handleCommand( diff --git a/pkg/config/config.go b/pkg/config/config.go index a8b8f337f..a3720b656 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -228,6 +228,7 @@ type AgentDefaults struct { ImageModel string `json:"image_model,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_IMAGE_MODEL"` ImageModelFallbacks []string `json:"image_model_fallbacks,omitempty"` MaxTokens int `json:"max_tokens" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_TOKENS"` + ContextWindow int `json:"context_window,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_CONTEXT_WINDOW"` Temperature *float64 `json:"temperature,omitempty" env:"PICOCLAW_AGENTS_DEFAULTS_TEMPERATURE"` MaxToolIterations int `json:"max_tool_iterations" env:"PICOCLAW_AGENTS_DEFAULTS_MAX_TOOL_ITERATIONS"` SummarizeMessageThreshold int `json:"summarize_message_threshold" env:"PICOCLAW_AGENTS_DEFAULTS_SUMMARIZE_MESSAGE_THRESHOLD"` From 9c65d78b07ca82b556dac227b57c76a58013527d Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 15:13:04 +0800 Subject: [PATCH 023/234] fix(agent): forceCompression must not assume history[0] is system prompt Session history (GetHistory) contains only user/assistant/tool messages. The system prompt is built dynamically by BuildMessages and is never stored in session. The previous code incorrectly treated history[0] as a system prompt, skipping the first user message and appending a compression note to it. Fix: operate on the full history slice, and record the compression note in the session summary (which BuildMessages already injects into the system prompt) rather than modifying any history message. --- pkg/agent/loop.go | 55 ++++++++++++++++++++--------------------------- 1 file changed, 23 insertions(+), 32 deletions(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index f20f2c938..14dc8c5ca 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -1556,56 +1556,47 @@ func (al *AgentLoop) maybeSummarize(agent *AgentInstance, sessionKey, channel, c } // forceCompression aggressively reduces context when the limit is hit. -// It drops the oldest ~50% of messages (keeping system prompt and last user message), -// aligning the split to a safe boundary so tool-call sequences stay intact. +// It drops the oldest ~50% of messages, aligning the split to a safe +// boundary so tool-call sequences stay intact. +// +// Session history contains only user/assistant/tool messages — the system +// prompt is built dynamically by BuildMessages and is NOT stored here. +// The compression note is recorded in the session summary so that +// BuildMessages can include it in the next system prompt. func (al *AgentLoop) forceCompression(agent *AgentInstance, sessionKey string) { history := agent.Sessions.GetHistory(sessionKey) - if len(history) <= 4 { - return - } - - // Keep system prompt (usually [0]) and the very last message (user's trigger) - // We want to drop the oldest half of the *conversation* - // Assuming [0] is system, [1:] is conversation - conversation := history[1 : len(history)-1] - if len(conversation) == 0 { + if len(history) <= 2 { return } // Find a safe mid-point that does not split a tool-call sequence. - mid := findSafeBoundary(conversation, len(conversation)/2) - - // New history structure: - // 1. System Prompt (with compression note appended) - // 2. Second half of conversation - // 3. Last message + mid := findSafeBoundary(history, len(history)/2) + if mid <= 0 { + return + } droppedCount := mid - keptConversation := conversation[mid:] + keptHistory := history[mid:] - newHistory := make([]providers.Message, 0, 1+len(keptConversation)+1) - - // Append compression note to the original system prompt instead of adding a new system message - // This avoids having two consecutive system messages which some APIs (like Zhipu) reject + // Record compression in the session summary so BuildMessages includes it + // in the system prompt. We do not modify history messages themselves. + existingSummary := agent.Sessions.GetSummary(sessionKey) compressionNote := fmt.Sprintf( - "\n\n[System Note: Emergency compression dropped %d oldest messages due to context limit]", + "[Emergency compression dropped %d oldest messages due to context limit]", droppedCount, ) - enhancedSystemPrompt := history[0] - enhancedSystemPrompt.Content = enhancedSystemPrompt.Content + compressionNote - newHistory = append(newHistory, enhancedSystemPrompt) + if existingSummary != "" { + compressionNote = existingSummary + "\n\n" + compressionNote + } + agent.Sessions.SetSummary(sessionKey, compressionNote) - newHistory = append(newHistory, keptConversation...) - newHistory = append(newHistory, history[len(history)-1]) // Last message - - // Update session - agent.Sessions.SetHistory(sessionKey, newHistory) + agent.Sessions.SetHistory(sessionKey, keptHistory) agent.Sessions.Save(sessionKey) logger.WarnCF("agent", "Forced compression executed", map[string]any{ "session_key": sessionKey, "dropped_msgs": droppedCount, - "new_count": len(newHistory), + "new_count": len(keptHistory), }) } From d5fdd5ebd2644408d45a5525ead50b16938a5012 Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 15:14:00 +0800 Subject: [PATCH 024/234] fix(agent): include ReasoningContent and Media in token estimation estimateMessageTokens now counts ReasoningContent (extended thinking / chain-of-thought) which can be substantial and is persisted in session history. Media items get a fixed per-item overhead (256 tokens) since actual cost depends on provider-specific image tokenization. --- pkg/agent/context_budget.go | 16 +++++++++++++-- pkg/agent/context_budget_test.go | 34 ++++++++++++++++++++++++++++++++ 2 files changed, 48 insertions(+), 2 deletions(-) diff --git a/pkg/agent/context_budget.go b/pkg/agent/context_budget.go index 2eec9c267..71da5d8f7 100644 --- a/pkg/agent/context_budget.go +++ b/pkg/agent/context_budget.go @@ -63,11 +63,17 @@ func findSafeBoundary(history []providers.Message, targetIndex int) int { } // estimateMessageTokens estimates the token count for a single message, -// including Content, ToolCalls arguments, and ToolCallID metadata. -// Uses a heuristic of 2.5 characters per token. +// including Content, ReasoningContent, ToolCalls arguments, ToolCallID +// metadata, and Media items. Uses a heuristic of 2.5 characters per token. func estimateMessageTokens(msg providers.Message) int { chars := utf8.RuneCountInString(msg.Content) + // ReasoningContent (extended thinking / chain-of-thought) can be + // substantial and is stored in session history via AddFullMessage. + if msg.ReasoningContent != "" { + chars += utf8.RuneCountInString(msg.ReasoningContent) + } + for _, tc := range msg.ToolCalls { // Count tool call metadata: ID, type, function name chars += len(tc.ID) + len(tc.Type) + len(tc.Name) @@ -80,6 +86,12 @@ func estimateMessageTokens(msg providers.Message) int { chars += len(msg.ToolCallID) } + // Media items (images, files) are serialized by provider adapters into + // multipart or image_url payloads. Use a fixed per-item estimate since + // actual token cost depends on resolution and provider tokenization. + const mediaTokensPerItem = 256 + chars += len(msg.Media) * mediaTokensPerItem + // Per-message overhead for role label, JSON structure, separators. const messageOverhead = 12 chars += messageOverhead diff --git a/pkg/agent/context_budget_test.go b/pkg/agent/context_budget_test.go index c8a6b19c5..03ace82e2 100644 --- a/pkg/agent/context_budget_test.go +++ b/pkg/agent/context_budget_test.go @@ -389,6 +389,40 @@ func TestEstimateMessageTokens_LargeArguments(t *testing.T) { } } +func TestEstimateMessageTokens_ReasoningContent(t *testing.T) { + plain := msgAssistant("result") + withReasoning := providers.Message{ + Role: "assistant", + Content: "result", + ReasoningContent: strings.Repeat("thinking step ", 200), + } + + plainTokens := estimateMessageTokens(plain) + reasoningTokens := estimateMessageTokens(withReasoning) + + if reasoningTokens <= plainTokens { + t.Errorf("message with ReasoningContent (%d tokens) should exceed plain message (%d tokens)", + reasoningTokens, plainTokens) + } +} + +func TestEstimateMessageTokens_MediaItems(t *testing.T) { + plain := msgUser("describe this") + withMedia := providers.Message{ + Role: "user", + Content: "describe this", + Media: []string{"media://img1.png", "media://img2.png"}, + } + + plainTokens := estimateMessageTokens(plain) + mediaTokens := estimateMessageTokens(withMedia) + + if mediaTokens <= plainTokens { + t.Errorf("message with Media (%d tokens) should exceed plain message (%d tokens)", + mediaTokens, plainTokens) + } +} + // --- estimateToolDefsTokens tests --- func TestEstimateToolDefsTokens(t *testing.T) { From e35906bb1447b60b4836587d824b488698e12b14 Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 15:16:57 +0800 Subject: [PATCH 025/234] feat(config): expose context_window in example config and web UI MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add context_window to config.example.json, the web configuration page (form model, input field, save handler), and i18n strings (en/zh). The field is optional — leaving it empty falls back to the 4x max_tokens heuristic. --- config/config.example.json | 1 + web/frontend/src/components/config/config-page.tsx | 4 ++++ .../src/components/config/config-sections.tsx | 14 ++++++++++++++ web/frontend/src/components/config/form-model.ts | 3 +++ web/frontend/src/i18n/locales/en.json | 2 ++ web/frontend/src/i18n/locales/zh.json | 2 ++ 6 files changed, 26 insertions(+) diff --git a/config/config.example.json b/config/config.example.json index 094aa46df..20c10e60d 100644 --- a/config/config.example.json +++ b/config/config.example.json @@ -5,6 +5,7 @@ "restrict_to_workspace": true, "model_name": "gpt-5.4", "max_tokens": 8192, + "context_window": 131072, "temperature": 0.7, "max_tool_iterations": 20, "summarize_message_threshold": 20, diff --git a/web/frontend/src/components/config/config-page.tsx b/web/frontend/src/components/config/config-page.tsx index cbce7d27e..dc6797749 100644 --- a/web/frontend/src/components/config/config-page.tsx +++ b/web/frontend/src/components/config/config-page.tsx @@ -144,6 +144,9 @@ export function ConfigPage() { const maxTokens = parseIntField(form.maxTokens, "Max tokens", { min: 1, }) + const contextWindow = form.contextWindow.trim() + ? parseIntField(form.contextWindow, "Context window", { min: 1 }) + : undefined const maxToolIterations = parseIntField( form.maxToolIterations, "Max tool iterations", @@ -171,6 +174,7 @@ export function ConfigPage() { workspace, restrict_to_workspace: form.restrictToWorkspace, max_tokens: maxTokens, + context_window: contextWindow, max_tool_iterations: maxToolIterations, summarize_message_threshold: summarizeMessageThreshold, summarize_token_percent: summarizeTokenPercent, diff --git a/web/frontend/src/components/config/config-sections.tsx b/web/frontend/src/components/config/config-sections.tsx index dfbe22fc3..825d882b7 100644 --- a/web/frontend/src/components/config/config-sections.tsx +++ b/web/frontend/src/components/config/config-sections.tsx @@ -114,6 +114,20 @@ export function AgentDefaultsSection({ /> + + onFieldChange("contextWindow", e.target.value)} + placeholder="131072" + /> + + Date: Fri, 13 Mar 2026 15:18:07 +0800 Subject: [PATCH 026/234] test(agent): add realistic session-shaped tests for context budget Add tests that reflect actual session data shape: history starts with user messages (no system prompt), includes chained tool-call sequences, reasoning content, and media items. Exercises the proactive budget check path with BuildMessages-style assembled messages. --- pkg/agent/context_budget_test.go | 140 +++++++++++++++++++++++++++++++ 1 file changed, 140 insertions(+) diff --git a/pkg/agent/context_budget_test.go b/pkg/agent/context_budget_test.go index 03ace82e2..6b51a8cb7 100644 --- a/pkg/agent/context_budget_test.go +++ b/pkg/agent/context_budget_test.go @@ -577,3 +577,143 @@ func TestIsOverContextBudget(t *testing.T) { }) } } + +// --- Tests reflecting actual session data shape --- +// Session history never contains system messages. The system prompt is +// built dynamically by BuildMessages. These tests use realistic history +// shapes: user/assistant/tool only, with tool chains and reasoning content. + +func TestFindSafeBoundary_SessionHistoryNoSystem(t *testing.T) { + // Real session history starts with a user message, not a system message. + history := []providers.Message{ + msgUser("hello"), // 0 + msgAssistant("hi there"), // 1 + msgUser("search for X"), // 2 + msgAssistantTC("tc1"), // 3 + msgTool("tc1", "found X"), // 4 + msgAssistant("here is X"), // 5 + msgUser("thanks"), // 6 + msgAssistant("you're welcome"), // 7 + } + + // Mid-point is 4 (tool result). Should snap backward to 2 (user). + got := findSafeBoundary(history, 4) + if got != 2 { + t.Errorf("findSafeBoundary(session_history, 4) = %d, want 2", got) + } +} + +func TestFindSafeBoundary_SessionWithChainedTools(t *testing.T) { + // Session with chained tool calls (save then notify). + history := []providers.Message{ + msgUser("save and notify"), // 0 + msgAssistantTC("tc_save"), // 1 + msgTool("tc_save", "saved"), // 2 + msgAssistantTC("tc_notify"), // 3 + msgTool("tc_notify", "notified"), // 4 + msgAssistant("done"), // 5 + msgUser("check status"), // 6 + msgAssistant("all good"), // 7 + } + + // Target at 3 (inside chain). Should find user at 0, but backward + // scan stops at i>0, so forward scan finds user at 6. + // Actually: backward from 3: 2=tool (no), 1=assistantTC (no). Forward: 4=tool, 5=asst, 6=user ✓ + got := findSafeBoundary(history, 3) + if got != 6 { + t.Errorf("findSafeBoundary(chained_tools, 3) = %d, want 6", got) + } +} + +func TestEstimateMessageTokens_WithReasoningAndMedia(t *testing.T) { + // Message with all fields populated — mirrors what AddFullMessage stores. + msg := providers.Message{ + Role: "assistant", + Content: "Here is the analysis.", + ReasoningContent: strings.Repeat("Let me think about this carefully. ", 50), + ToolCalls: []providers.ToolCall{ + { + ID: "call_1", + Type: "function", + Name: "analyze", + Function: &providers.FunctionCall{ + Name: "analyze", + Arguments: `{"data":"sample","depth":3}`, + }, + }, + }, + } + + tokens := estimateMessageTokens(msg) + + // ReasoningContent alone is ~1700 chars → ~680 tokens. + // Content + TC + overhead adds more. Should be well above 500. + if tokens < 500 { + t.Errorf("message with reasoning+toolcalls should have significant tokens, got %d", tokens) + } + + // Compare without reasoning to ensure it's counted. + msgNoReasoning := msg + msgNoReasoning.ReasoningContent = "" + tokensNoReasoning := estimateMessageTokens(msgNoReasoning) + + if tokens <= tokensNoReasoning { + t.Errorf("reasoning content should add tokens: with=%d, without=%d", tokens, tokensNoReasoning) + } +} + +func TestIsOverContextBudget_RealisticSession(t *testing.T) { + // Simulate what BuildMessages produces: system + session history + current user. + // System message is built by BuildMessages, not stored in session. + systemMsg := providers.Message{ + Role: "system", + Content: strings.Repeat("system prompt content ", 100), + } + sessionHistory := []providers.Message{ + msgUser("first question"), + msgAssistant("first answer"), + msgUser("use tool X"), + { + Role: "assistant", + Content: "I'll use tool X", + ToolCalls: []providers.ToolCall{ + { + ID: "tc1", Type: "function", Name: "tool_x", + Function: &providers.FunctionCall{ + Name: "tool_x", + Arguments: `{"query":"test","verbose":true}`, + }, + }, + }, + }, + {Role: "tool", Content: strings.Repeat("result data ", 200), ToolCallID: "tc1"}, + msgAssistant("Here are the results from tool X."), + } + currentUser := msgUser("follow up question") + + // Assemble as BuildMessages would. + messages := []providers.Message{systemMsg} + messages = append(messages, sessionHistory...) + messages = append(messages, currentUser) + + tools := []providers.ToolDefinition{ + { + Type: "function", + Function: providers.ToolFunctionDefinition{ + Name: "tool_x", + Description: "A useful tool", + Parameters: map[string]any{"type": "object"}, + }, + }, + } + + // With a large context window, should be within budget. + if isOverContextBudget(131072, messages, tools, 32768) { + t.Error("realistic session should be within 131072 context window") + } + + // With a tiny context window, should exceed budget. + if !isOverContextBudget(500, messages, tools, 32768) { + t.Error("realistic session should exceed 500 context window") + } +} From efd403242e8633dfbdf6b3a2c02840adfae338d1 Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 15:50:51 +0800 Subject: [PATCH 027/234] fix(agent): preallocate messages slice in budget test Fixes prealloc lint warning by using make() with capacity hint. --- pkg/agent/context_budget_test.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/agent/context_budget_test.go b/pkg/agent/context_budget_test.go index 6b51a8cb7..4073506cf 100644 --- a/pkg/agent/context_budget_test.go +++ b/pkg/agent/context_budget_test.go @@ -692,7 +692,8 @@ func TestIsOverContextBudget_RealisticSession(t *testing.T) { currentUser := msgUser("follow up question") // Assemble as BuildMessages would. - messages := []providers.Message{systemMsg} + messages := make([]providers.Message, 0, 1+len(sessionHistory)+1) + messages = append(messages, systemMsg) messages = append(messages, sessionHistory...) messages = append(messages, currentUser) From 639739cb8512e7b3610015265f30197dbe421096 Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 15:54:50 +0800 Subject: [PATCH 028/234] refactor(agent): use Turn as the atomic unit for compression cut-off MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Introduce parseTurnBoundaries() which identifies each Turn start index in the session history. A Turn is a complete "user input → LLM iterations → final response" cycle (as defined in the agent refactor design #1316). findSafeBoundary now uses Turn boundaries instead of raw role-scanning, making the intent explicit: "find the nearest Turn boundary." forceCompression drops the oldest half of Turns (not arbitrary messages), which is simpler and more intuitive. The Turn-based approach naturally prevents splitting tool-call sequences since each Turn is atomic. --- pkg/agent/context_budget.go | 58 ++++++++++++++-------- pkg/agent/context_budget_test.go | 82 ++++++++++++++++++++++++++++++++ pkg/agent/loop.go | 20 ++++++-- 3 files changed, 136 insertions(+), 24 deletions(-) diff --git a/pkg/agent/context_budget.go b/pkg/agent/context_budget.go index 71da5d8f7..05e27e18a 100644 --- a/pkg/agent/context_budget.go +++ b/pkg/agent/context_budget.go @@ -12,14 +12,26 @@ import ( "github.com/sipeed/picoclaw/pkg/providers" ) -// isSafeBoundary reports whether index is a valid position to split a message -// history for truncation or compression. Splitting at index means: -// - history[:index] is dropped or summarized -// - history[index:] is kept +// parseTurnBoundaries returns the starting index of each Turn in the history. +// A Turn is a complete "user input → LLM iterations → final response" cycle +// (as defined in #1316). Each Turn begins at a user message and extends +// through all subsequent assistant/tool messages until the next user message. // -// A boundary is safe when the kept portion begins at a "user" message, -// ensuring no tool-call sequence (assistant+ToolCalls → tool results) -// is torn apart across the split. +// Cutting at a Turn boundary guarantees that no tool-call sequence +// (assistant+ToolCalls → tool results) is split across the cut. +func parseTurnBoundaries(history []providers.Message) []int { + var starts []int + for i, msg := range history { + if msg.Role == "user" { + starts = append(starts, i) + } + } + return starts +} + +// isSafeBoundary reports whether index is a valid Turn boundary — i.e., +// a position where the kept portion (history[index:]) begins at a user +// message, so no tool-call sequence is torn apart. func isSafeBoundary(history []providers.Message, index int) bool { if index <= 0 || index >= len(history) { return true @@ -27,9 +39,10 @@ func isSafeBoundary(history []providers.Message, index int) bool { return history[index].Role == "user" } -// findSafeBoundary locates the nearest safe split point to targetIndex. -// It scans backward first (preserving more context), then forward. -// Returns targetIndex unchanged only when no safe boundary exists. +// findSafeBoundary locates the nearest Turn boundary to targetIndex. +// It prefers the boundary at or before targetIndex (preserving more recent +// context). Falls back to the nearest boundary after targetIndex, and +// returns targetIndex unchanged only when no Turn boundary exists at all. func findSafeBoundary(history []providers.Message, targetIndex int) int { if len(history) == 0 { return 0 @@ -41,21 +54,28 @@ func findSafeBoundary(history []providers.Message, targetIndex int) int { return len(history) } - if isSafeBoundary(history, targetIndex) { + turns := parseTurnBoundaries(history) + if len(turns) == 0 { return targetIndex } - // Backward scan: prefer keeping more messages. - for i := targetIndex - 1; i > 0; i-- { - if isSafeBoundary(history, i) { - return i + // Find the last Turn boundary at or before targetIndex. + // Prefer backward: keeps more recent messages. + backward := -1 + for _, t := range turns { + if t <= targetIndex { + backward = t } } + if backward > 0 { + return backward + } - // Forward scan: fall back to keeping fewer messages. - for i := targetIndex + 1; i < len(history); i++ { - if isSafeBoundary(history, i) { - return i + // No valid Turn boundary before target (or only at index 0 which + // would keep everything). Use the first Turn after targetIndex. + for _, t := range turns { + if t > targetIndex { + return t } } diff --git a/pkg/agent/context_budget_test.go b/pkg/agent/context_budget_test.go index 4073506cf..15198d03b 100644 --- a/pkg/agent/context_budget_test.go +++ b/pkg/agent/context_budget_test.go @@ -40,6 +40,88 @@ func msgTool(callID, content string) providers.Message { return providers.Message{Role: "tool", ToolCallID: callID, Content: content} } +func TestParseTurnBoundaries(t *testing.T) { + tests := []struct { + name string + history []providers.Message + want []int + }{ + { + name: "empty history", + history: nil, + want: nil, + }, + { + name: "simple exchange", + history: []providers.Message{ + msgUser("q1"), + msgAssistant("a1"), + msgUser("q2"), + msgAssistant("a2"), + }, + want: []int{0, 2}, + }, + { + name: "tool-call Turn", + history: []providers.Message{ + msgUser("search"), + msgAssistantTC("tc1"), + msgTool("tc1", "result"), + msgAssistant("found it"), + msgUser("thanks"), + msgAssistant("welcome"), + }, + want: []int{0, 4}, + }, + { + name: "chained tool calls in single Turn", + history: []providers.Message{ + msgUser("save and notify"), + msgAssistantTC("tc_save"), + msgTool("tc_save", "saved"), + msgAssistantTC("tc_notify"), + msgTool("tc_notify", "notified"), + msgAssistant("done"), + }, + want: []int{0}, + }, + { + name: "no user messages", + history: []providers.Message{ + msgAssistant("a1"), + msgAssistant("a2"), + }, + want: nil, + }, + { + name: "leading non-user messages", + history: []providers.Message{ + msgAssistantTC("tc1"), + msgTool("tc1", "r1"), + msgAssistant("greeting"), + msgUser("hello"), + msgAssistant("hi"), + }, + want: []int{3}, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got := parseTurnBoundaries(tt.history) + if len(got) != len(tt.want) { + t.Errorf("parseTurnBoundaries() = %v, want %v", got, tt.want) + return + } + for i := range got { + if got[i] != tt.want[i] { + t.Errorf("parseTurnBoundaries()[%d] = %d, want %d", i, got[i], tt.want[i]) + } + } + }) + } +} + func TestIsSafeBoundary(t *testing.T) { tests := []struct { name string diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 14dc8c5ca..688d0ed1d 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -1556,8 +1556,8 @@ func (al *AgentLoop) maybeSummarize(agent *AgentInstance, sessionKey, channel, c } // forceCompression aggressively reduces context when the limit is hit. -// It drops the oldest ~50% of messages, aligning the split to a safe -// boundary so tool-call sequences stay intact. +// It drops the oldest ~50% of Turns (a Turn is a complete user→LLM→response +// cycle, as defined in #1316), so tool-call sequences are never split. // // Session history contains only user/assistant/tool messages — the system // prompt is built dynamically by BuildMessages and is NOT stored here. @@ -1569,8 +1569,18 @@ func (al *AgentLoop) forceCompression(agent *AgentInstance, sessionKey string) { return } - // Find a safe mid-point that does not split a tool-call sequence. - mid := findSafeBoundary(history, len(history)/2) + // Split at a Turn boundary so no tool-call sequence is torn apart. + // parseTurnBoundaries gives us the start of each Turn; we drop the + // oldest half of Turns and keep the most recent ones. + turns := parseTurnBoundaries(history) + var mid int + if len(turns) >= 2 { + mid = turns[len(turns)/2] + } else { + // Fewer than 2 Turns — fall back to message-level midpoint + // aligned to the nearest Turn boundary. + mid = findSafeBoundary(history, len(history)/2) + } if mid <= 0 { return } @@ -1696,7 +1706,7 @@ func (al *AgentLoop) summarizeSession(agent *AgentInstance, sessionKey string) { history := agent.Sessions.GetHistory(sessionKey) summary := agent.Sessions.GetSummary(sessionKey) - // Keep last few messages for continuity, aligned to a safe boundary + // Keep the most recent Turns for continuity, aligned to a Turn boundary // so that no tool-call sequence is split. if len(history) <= 4 { return From 8034ee7be13f891dd1e578390cad9bf09dbfa5e2 Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 16:02:04 +0800 Subject: [PATCH 029/234] fix(agent): correct media token arithmetic and tool call double-counting MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two estimation bugs fixed: 1. Media tokens were added to the chars accumulator before the chars*2/5 conversion, resulting in 256*2/5=102 tokens per item instead of 256. Fix: add media tokens directly to the final token count, bypassing the character-based heuristic. 2. estimateMessageTokens counted both tc.Name and tc.Function.Name for tool calls, but providers only send one (OpenAI-compat uses function.name, Anthropic uses tc.Name). Fix: count tc.Function.Name when Function is present, fall back to tc.Name only otherwise. Also fix i18n hint text: "auto-detect" was misleading — the backend uses a 4x max_tokens heuristic, not actual model detection. --- pkg/agent/context_budget.go | 25 ++++++++++++++++--------- pkg/agent/context_budget_test.go | 7 +++++++ web/frontend/src/i18n/locales/en.json | 2 +- web/frontend/src/i18n/locales/zh.json | 2 +- 4 files changed, 25 insertions(+), 11 deletions(-) diff --git a/pkg/agent/context_budget.go b/pkg/agent/context_budget.go index 05e27e18a..0b7f443e6 100644 --- a/pkg/agent/context_budget.go +++ b/pkg/agent/context_budget.go @@ -95,10 +95,14 @@ func estimateMessageTokens(msg providers.Message) int { } for _, tc := range msg.ToolCalls { - // Count tool call metadata: ID, type, function name - chars += len(tc.ID) + len(tc.Type) + len(tc.Name) + chars += len(tc.ID) + len(tc.Type) if tc.Function != nil { + // Count function name + arguments (the wire format for most providers). + // tc.Name mirrors tc.Function.Name — count only once to avoid double-counting. chars += len(tc.Function.Name) + len(tc.Function.Arguments) + } else { + // Fallback: some provider formats use top-level Name without Function. + chars += len(tc.Name) } } @@ -106,17 +110,20 @@ func estimateMessageTokens(msg providers.Message) int { chars += len(msg.ToolCallID) } - // Media items (images, files) are serialized by provider adapters into - // multipart or image_url payloads. Use a fixed per-item estimate since - // actual token cost depends on resolution and provider tokenization. - const mediaTokensPerItem = 256 - chars += len(msg.Media) * mediaTokensPerItem - // Per-message overhead for role label, JSON structure, separators. const messageOverhead = 12 chars += messageOverhead - return chars * 2 / 5 + tokens := chars * 2 / 5 + + // Media items (images, files) are serialized by provider adapters into + // multipart or image_url payloads. Add a fixed per-item token estimate + // directly (not through the chars heuristic) since actual cost depends + // on resolution and provider-specific image tokenization. + const mediaTokensPerItem = 256 + tokens += len(msg.Media) * mediaTokensPerItem + + return tokens } // estimateToolDefsTokens estimates the total token cost of tool definitions diff --git a/pkg/agent/context_budget_test.go b/pkg/agent/context_budget_test.go index 15198d03b..175e04885 100644 --- a/pkg/agent/context_budget_test.go +++ b/pkg/agent/context_budget_test.go @@ -503,6 +503,13 @@ func TestEstimateMessageTokens_MediaItems(t *testing.T) { t.Errorf("message with Media (%d tokens) should exceed plain message (%d tokens)", mediaTokens, plainTokens) } + + // Each media item should add exactly 256 tokens (not run through chars*2/5). + expectedDelta := 256 * 2 + actualDelta := mediaTokens - plainTokens + if actualDelta != expectedDelta { + t.Errorf("2 media items should add %d tokens, got delta %d", expectedDelta, actualDelta) + } } // --- estimateToolDefsTokens tests --- diff --git a/web/frontend/src/i18n/locales/en.json b/web/frontend/src/i18n/locales/en.json index 116ee4441..09852e0c7 100644 --- a/web/frontend/src/i18n/locales/en.json +++ b/web/frontend/src/i18n/locales/en.json @@ -397,7 +397,7 @@ "max_tokens": "Max Tokens", "max_tokens_hint": "Upper token limit per model response.", "context_window": "Context Window", - "context_window_hint": "Model input context capacity in tokens. Leave empty to auto-detect (default: 4x max tokens).", + "context_window_hint": "Model input context capacity in tokens. Leave empty to use the default (4x max tokens).", "max_tool_iterations": "Max Tool Iterations", "max_tool_iterations_hint": "Maximum tool-call loops in a single task.", "summarize_threshold": "Summarize Message Threshold", diff --git a/web/frontend/src/i18n/locales/zh.json b/web/frontend/src/i18n/locales/zh.json index e68c46085..c92ea0032 100644 --- a/web/frontend/src/i18n/locales/zh.json +++ b/web/frontend/src/i18n/locales/zh.json @@ -397,7 +397,7 @@ "max_tokens": "最大 Token 数", "max_tokens_hint": "单次模型响应允许的最大 Token 数。", "context_window": "上下文窗口", - "context_window_hint": "模型输入上下文容量（Token 数）。留空则自动推算（默认为最大 Token 数的 4 倍）。", + "context_window_hint": "模型输入上下文容量（Token 数）。留空使用默认值（最大 Token 数的 4 倍）。", "max_tool_iterations": "最大工具迭代次数", "max_tool_iterations_hint": "单个任务中允许的工具调用循环上限。", "summarize_threshold": "触发摘要的消息阈值", From edbdc3bcf106a60540348f01baa45d39a6627e00 Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 16:25:27 +0800 Subject: [PATCH 030/234] fix(agent): findSafeBoundary returns 0 for single-Turn history MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the entire history is a single Turn (one user message followed by tool calls and responses, no subsequent user message), the only Turn boundary is at index 0. Previously the fallback returned targetIndex, which could land on a tool or assistant message — splitting the Turn. Return 0 instead, so callers (forceCompression, summarizeSession) see mid <= 0 and skip compression rather than cutting inside the Turn. --- pkg/agent/context_budget.go | 6 +++++- pkg/agent/context_budget_test.go | 17 +++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/pkg/agent/context_budget.go b/pkg/agent/context_budget.go index 0b7f443e6..c87695c7a 100644 --- a/pkg/agent/context_budget.go +++ b/pkg/agent/context_budget.go @@ -79,7 +79,11 @@ func findSafeBoundary(history []providers.Message, targetIndex int) int { } } - return targetIndex + // No Turn boundary after targetIndex either. The only boundary is at + // index 0, meaning the entire history is a single Turn. Return 0 to + // signal that safe compression is not possible — callers check for + // mid <= 0 and skip compression in that case. + return 0 } // estimateMessageTokens estimates the token count for a single message, diff --git a/pkg/agent/context_budget_test.go b/pkg/agent/context_budget_test.go index 175e04885..30b3fe6a2 100644 --- a/pkg/agent/context_budget_test.go +++ b/pkg/agent/context_budget_test.go @@ -346,6 +346,23 @@ func TestFindSafeBoundary(t *testing.T) { } } +func TestFindSafeBoundary_SingleTurnReturnsZero(t *testing.T) { + // A single Turn with no subsequent user message. The only Turn boundary + // is at index 0; cutting anywhere else would split the Turn's tool + // sequence. findSafeBoundary must return 0 so callers skip compression. + history := []providers.Message{ + msgUser("do everything"), // 0 ← only Turn boundary + msgAssistantTC("tc1"), // 1 + msgTool("tc1", "result"), // 2 + msgAssistant("all done"), // 3 + } + + got := findSafeBoundary(history, 2) + if got != 0 { + t.Errorf("findSafeBoundary(single_turn, 2) = %d, want 0 (cannot split single Turn)", got) + } +} + func TestFindSafeBoundary_BackwardScanSkipsToolSequence(t *testing.T) { // A long tool-call chain: user → assistant+TC → tool → tool → ... → assistant → user // Target is inside the chain; boundary should skip the entire chain backward. From 7c1a1c2c1a8554d29c11903103d231962ffdac4f Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 16:30:26 +0800 Subject: [PATCH 031/234] style(agent): fix gci comment alignment in test --- pkg/agent/context_budget_test.go | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkg/agent/context_budget_test.go b/pkg/agent/context_budget_test.go index 30b3fe6a2..870f0fbe6 100644 --- a/pkg/agent/context_budget_test.go +++ b/pkg/agent/context_budget_test.go @@ -351,10 +351,10 @@ func TestFindSafeBoundary_SingleTurnReturnsZero(t *testing.T) { // is at index 0; cutting anywhere else would split the Turn's tool // sequence. findSafeBoundary must return 0 so callers skip compression. history := []providers.Message{ - msgUser("do everything"), // 0 ← only Turn boundary - msgAssistantTC("tc1"), // 1 - msgTool("tc1", "result"), // 2 - msgAssistant("all done"), // 3 + msgUser("do everything"), // 0 ← only Turn boundary + msgAssistantTC("tc1"), // 1 + msgTool("tc1", "result"), // 2 + msgAssistant("all done"), // 3 } got := findSafeBoundary(history, 2) From b768dab822bee2affa417d7318e68b8e9eec31b3 Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Fri, 13 Mar 2026 17:04:34 +0800 Subject: [PATCH 032/234] test(agent): use realistic session data in context retry test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Session history only stores user/assistant/tool messages — the system prompt is built dynamically by BuildMessages. Remove the incorrect system message from TestAgentLoop_ContextExhaustionRetry test data to match the real data model that forceCompression operates on. --- pkg/agent/loop_test.go | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/pkg/agent/loop_test.go b/pkg/agent/loop_test.go index a6604e87f..b65c0e21c 100644 --- a/pkg/agent/loop_test.go +++ b/pkg/agent/loop_test.go @@ -719,11 +719,11 @@ func TestAgentLoop_ContextExhaustionRetry(t *testing.T) { al := NewAgentLoop(cfg, msgBus, provider) - // Inject some history to simulate a full context + // Inject some history to simulate a full context. + // Session history only stores user/assistant/tool messages — the system + // prompt is built dynamically by BuildMessages and is NOT stored here. sessionKey := "test-session-context" - // Create dummy history history := []providers.Message{ - {Role: "system", Content: "System prompt"}, {Role: "user", Content: "Old message 1"}, {Role: "assistant", Content: "Old response 1"}, {Role: "user", Content: "Old message 2"}, @@ -761,12 +761,11 @@ func TestAgentLoop_ContextExhaustionRetry(t *testing.T) { // Check final history length finalHistory := defaultAgent.Sessions.GetHistory(sessionKey) // We verify that the history has been modified (compressed) - // Original length: 6 - // Expected behavior: compression drops ~50% of history (mid slice) - // We can assert that the length is NOT what it would be without compression. - // Without compression: 6 + 1 (new user msg) + 1 (assistant msg) = 8 - if len(finalHistory) >= 8 { - t.Errorf("Expected history to be compressed (len < 8), got %d", len(finalHistory)) + // Original length: 5 + // Expected behavior: compression drops ~50% of Turns + // Without compression: 5 + 1 (new user msg) + 1 (assistant msg) = 7 + if len(finalHistory) >= 7 { + t.Errorf("Expected history to be compressed (len < 7), got %d", len(finalHistory)) } } From 08259d7e9a1bf7675e52c0344f8570faad628d0d Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Sat, 14 Mar 2026 10:46:32 +0800 Subject: [PATCH 033/234] docs(agent-refactor): add context.md for Track 6 boundary clarification Document the semantic boundaries of context management as called for in the agent-refactor README (suggested document split, item 5): - context window region definitions and history budget formula - ContextWindow vs MaxTokens distinction - session history contents (no system prompt stored) - Turn as the atomic compression unit (#1316) - three compression paths and their ordering - token estimation approach and its limitations - interface boundaries between budget functions and BuildMessages Also documents known gaps: summarization trigger not using the full budget formula, heuristic-only token estimation, and reactive retry not preserving media references. Ref #1439 --- docs/agent-refactor/context.md | 162 +++++++++++++++++++++++++++++++++ 1 file changed, 162 insertions(+) create mode 100644 docs/agent-refactor/context.md diff --git a/docs/agent-refactor/context.md b/docs/agent-refactor/context.md new file mode 100644 index 000000000..785fae2be --- /dev/null +++ b/docs/agent-refactor/context.md @@ -0,0 +1,162 @@ +# Context + +## What this document covers + +This document makes explicit the boundaries of context management in the agent loop: + +- what fills the context window and how space is divided +- what is stored in session history vs. built at request time +- when and how context compression happens +- how token budgets are estimated + +These are existing concepts. This document clarifies their boundaries rather than introducing new ones. + +--- + +## Context window regions + +The context window is the model's total input capacity. Four regions fill it: + +| Region | Assembled by | Stored in session? | +|---|---|---| +| System prompt | `BuildMessages()` — static + dynamic parts | No | +| Summary | `SetSummary()` stores it; `BuildMessages()` injects it | Separate from history | +| Session history | User / assistant / tool messages | Yes | +| Tool definitions | Provider adapter injects at call time | No | + +`MaxTokens` (the output generation limit) must also be reserved from the total budget. + +The available space for history is therefore: + +``` +history_budget = ContextWindow - system_prompt - summary - tool_definitions - MaxTokens +``` + +--- + +## ContextWindow vs MaxTokens + +These serve different purposes: + +- **MaxTokens** — maximum tokens the LLM may generate in one response. Sent as the `max_tokens` request parameter. +- **ContextWindow** — the model's total input context capacity. + +These were previously set to the same value, which caused the summarization threshold to fire either far too early (at the default 32K) or not at all (when a user raised `max_tokens`). + +Current default when not explicitly configured: `ContextWindow = MaxTokens * 4`. + +--- + +## Session history + +Session history stores only conversation messages: + +- `user` — user input +- `assistant` — LLM response (may include `ToolCalls`) +- `tool` — tool execution results + +Session history does **not** contain: + +- System prompts — assembled at request time by `BuildMessages` +- Summary content — stored separately via `SetSummary`, injected by `BuildMessages` + +This distinction matters: any code that operates on session history — compression, boundary detection, token estimation — must not assume a system message is present. + +--- + +## Turn + +A **Turn** is one complete cycle: + +> user message -> LLM iterations (possibly including tool calls) -> final assistant response + +This definition comes from the agent loop design (#1316). In session history, Turn boundaries are identified by `user`-role messages. + +Turn is the atomic unit for compression. Cutting inside a Turn can orphan tool-call sequences — an assistant message with `ToolCalls` separated from its corresponding `tool` results. Compressing at Turn boundaries avoids this by construction. + +`parseTurnBoundaries(history)` returns the starting index of each Turn. +`findSafeBoundary(history, targetIndex)` snaps a target cut point to the nearest Turn boundary. + +--- + +## Compression paths + +Three compression paths exist, in order of preference: + +### 1. Async summarization + +`maybeSummarize` runs after each Turn completes. + +Triggers when message count exceeds a threshold, or when estimated history tokens exceed a percentage of `ContextWindow`. If triggered, a background goroutine calls the LLM to produce a summary of the oldest messages. The summary is stored via `SetSummary`; `BuildMessages` injects it into the system prompt on the next call. + +Cut point uses `findSafeBoundary` so no Turn is split. + +### 2. Proactive budget check + +`isOverContextBudget` runs before each LLM call. + +Uses the full budget formula: `message_tokens + tool_def_tokens + MaxTokens > ContextWindow`. If over budget, triggers `forceCompression` and rebuilds messages before calling the LLM. + +This prevents wasted (and billed) LLM calls that would otherwise fail with a context-window error. + +### 3. Emergency compression (reactive) + +`forceCompression` runs when the LLM returns a context-window error despite the proactive check. + +Drops the oldest ~50% of Turns. Stores a compression note in the session summary (not in history messages) so `BuildMessages` can include it in the next system prompt. + +This is the fallback for when the token estimate undershoots reality. + +--- + +## Token estimation + +Estimation uses a heuristic of ~2.5 characters per token (`chars * 2 / 5`). + +`estimateMessageTokens` counts: + +- `Content` (rune count, for multibyte correctness) +- `ReasoningContent` (extended thinking / chain-of-thought) +- `ToolCalls` — ID, type, function name, arguments +- `ToolCallID` (tool result metadata) +- Per-message overhead (role label, JSON structure) +- `Media` items — flat per-item token estimate, added directly to the final count (not through the character heuristic, since actual cost depends on resolution and provider-specific image tokenization) + +`estimateToolDefsTokens` counts tool definition overhead: name, description, JSON schema of parameters. + +These are deliberately heuristic. The proactive check handles the common case; the reactive path catches estimation errors. + +--- + +## Interface boundaries + +Context budget functions (`parseTurnBoundaries`, `findSafeBoundary`, `estimateMessageTokens`, `isOverContextBudget`) are **pure functions**. They take `[]providers.Message` and integer parameters. They have no dependency on `AgentLoop` or any other runtime struct. + +`BuildMessages` is the sole assembler of the final message array sent to the LLM. Budget functions inform compression decisions but do not construct messages. + +`forceCompression` and `summarizeSession` mutate session state (history and summary). `BuildMessages` reads that state to construct context. The flow is: + +``` +budget check --> compression decision --> mutate session --> BuildMessages reads session --> LLM call +``` + +--- + +## Known gaps + +These are recognized limitations in the current implementation, documented here for visibility: + +- **Summarization trigger does not use the full budget formula.** `maybeSummarize` compares estimated history tokens against a percentage of `ContextWindow`. It does not account for system prompt size, tool definition overhead, or `MaxTokens` reserve. The proactive check covers the critical path (preventing 400 errors), but the summarization trigger could be aligned with the same budget model for more accurate early compression. + +- **Token estimation is heuristic.** It does not account for provider-specific tokenization, exact system prompt size (assembled separately), or variable image token costs. The two-path design (proactive + reactive) is intended to tolerate this imprecision. + +- **Reactive retry does not preserve media.** When the reactive path rebuilds context after compression, it currently passes empty values for media references. This is a pre-existing issue in the main loop, not introduced by the budget system. + +--- + +## What this document does not cover + +- How `AGENT.md` frontmatter configures context parameters — that is part of the Agent definition work +- How the context builder assembles context in the new architecture — that is upcoming work +- How compression events surface through the event system — that is part of the event model (#1316) +- Subagent context isolation — that is a separate track From c513ad22d73a579bb3fb30efc5b012b07c71a32c Mon Sep 17 00:00:00 2001 From: wenjie Date: Mon, 16 Mar 2026 16:25:16 +0800 Subject: [PATCH 034/234] fix(web): refactor pico chat flow and fix proxied websocket URLs (#1639) - move chat controller, state, protocol, history, and websocket logic into a dedicated chat feature module - improve chat reconnection, session hydration, and send gating based on actual websocket state - preserve gateway status during transient SSE disconnects and update stop state immediately - generate wss websocket URLs behind HTTPS proxies and add backend tests for forwarded proto handling --- web/backend/api/gateway_host.go | 20 +- web/backend/api/gateway_host_test.go | 53 +++ .../src/components/chat/chat-composer.tsx | 4 +- .../src/components/chat/chat-empty-state.tsx | 2 +- .../src/components/chat/chat-page.tsx | 23 +- .../chat/controller.ts} | 337 ++++++++++-------- web/frontend/src/features/chat/history.ts | 68 ++++ web/frontend/src/features/chat/protocol.ts | 81 +++++ .../chat/state.ts} | 0 web/frontend/src/features/chat/websocket.ts | 57 +++ web/frontend/src/hooks/use-gateway.ts | 12 +- web/frontend/src/hooks/use-pico-chat.ts | 4 +- web/frontend/src/hooks/use-websocket.ts | 47 --- web/frontend/src/routes/__root.tsx | 2 +- web/frontend/src/store/chat.ts | 2 +- web/frontend/src/store/gateway.ts | 12 +- 16 files changed, 509 insertions(+), 215 deletions(-) rename web/frontend/src/{lib/pico-chat-controller.ts => features/chat/controller.ts} (53%) create mode 100644 web/frontend/src/features/chat/history.ts create mode 100644 web/frontend/src/features/chat/protocol.ts rename web/frontend/src/{lib/pico-chat-state.ts => features/chat/state.ts} (100%) create mode 100644 web/frontend/src/features/chat/websocket.ts delete mode 100644 web/frontend/src/hooks/use-websocket.ts diff --git a/web/backend/api/gateway_host.go b/web/backend/api/gateway_host.go index a499c1ea2..5ef3ba2c5 100644 --- a/web/backend/api/gateway_host.go +++ b/web/backend/api/gateway_host.go @@ -57,10 +57,28 @@ func requestHostName(r *http.Request) string { return "127.0.0.1" } +func requestWSScheme(r *http.Request) string { + if forwarded := strings.TrimSpace(r.Header.Get("X-Forwarded-Proto")); forwarded != "" { + proto := strings.ToLower(strings.TrimSpace(strings.Split(forwarded, ",")[0])) + if proto == "https" || proto == "wss" { + return "wss" + } + if proto == "http" || proto == "ws" { + return "ws" + } + } + + if r.TLS != nil { + return "wss" + } + + return "ws" +} + func (h *Handler) buildWsURL(r *http.Request, cfg *config.Config) string { host := h.effectiveGatewayBindHost(cfg) if host == "" || host == "0.0.0.0" { host = requestHostName(r) } - return "ws://" + net.JoinHostPort(host, strconv.Itoa(cfg.Gateway.Port)) + "/pico/ws" + return requestWSScheme(r) + "://" + net.JoinHostPort(host, strconv.Itoa(cfg.Gateway.Port)) + "/pico/ws" } diff --git a/web/backend/api/gateway_host_test.go b/web/backend/api/gateway_host_test.go index afd600359..43e84ff0e 100644 --- a/web/backend/api/gateway_host_test.go +++ b/web/backend/api/gateway_host_test.go @@ -1,6 +1,7 @@ package api import ( + "crypto/tls" "net/http/httptest" "path/filepath" "testing" @@ -57,3 +58,55 @@ func TestGatewayProbeHostUsesLoopbackForWildcardBind(t *testing.T) { t.Fatalf("gatewayProbeHost() = %q, want %q", got, "127.0.0.1") } } + +func TestBuildWsURLUsesWSSWhenForwardedProtoIsHTTPS(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "0.0.0.0" + cfg.Gateway.Port = 18790 + + req := httptest.NewRequest("GET", "http://launcher.local/api/pico/token", nil) + req.Host = "chat.example.com" + req.Header.Set("X-Forwarded-Proto", "https") + + if got := h.buildWsURL(req, cfg); got != "wss://chat.example.com:18790/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "wss://chat.example.com:18790/pico/ws") + } +} + +func TestBuildWsURLUsesWSSWhenRequestIsTLS(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "0.0.0.0" + cfg.Gateway.Port = 18790 + + req := httptest.NewRequest("GET", "https://launcher.local/api/pico/token", nil) + req.Host = "secure.example.com" + req.TLS = &tls.ConnectionState{} + + if got := h.buildWsURL(req, cfg); got != "wss://secure.example.com:18790/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "wss://secure.example.com:18790/pico/ws") + } +} + +func TestBuildWsURLPrefersForwardedHTTPOverTLS(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "0.0.0.0" + cfg.Gateway.Port = 18790 + + req := httptest.NewRequest("GET", "https://launcher.local/api/pico/token", nil) + req.Host = "chat.example.com" + req.TLS = &tls.ConnectionState{} + req.Header.Set("X-Forwarded-Proto", "http") + + if got := h.buildWsURL(req, cfg); got != "ws://chat.example.com:18790/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "ws://chat.example.com:18790/pico/ws") + } +} diff --git a/web/frontend/src/components/chat/chat-composer.tsx b/web/frontend/src/components/chat/chat-composer.tsx index e8bae89b8..7d696b898 100644 --- a/web/frontend/src/components/chat/chat-composer.tsx +++ b/web/frontend/src/components/chat/chat-composer.tsx @@ -42,7 +42,7 @@ export function ChatComposer({ placeholder={t("chat.placeholder")} disabled={!canInput} className={cn( - "max-h-[200px] min-h-[60px] resize-none border-0 bg-transparent px-2 py-1 text-[15px] shadow-none transition-colors focus-visible:ring-0 focus-visible:outline-none dark:bg-transparent", + "placeholder:text-muted-foreground max-h-[200px] min-h-[60px] resize-none border-0 bg-transparent px-2 py-1 text-[15px] shadow-none transition-colors focus-visible:ring-0 focus-visible:outline-none dark:bg-transparent", !canInput && "cursor-not-allowed", )} minRows={1} @@ -56,7 +56,7 @@ export function ChatComposer({ size="icon" className="size-8 rounded-full bg-violet-500 text-white transition-transform hover:bg-violet-600 active:scale-95" onClick={onSend} - disabled={!input.trim() || !isConnected} + disabled={!input.trim() || !canInput} > diff --git a/web/frontend/src/components/chat/chat-empty-state.tsx b/web/frontend/src/components/chat/chat-empty-state.tsx index 624ff9c59..0574c44d1 100644 --- a/web/frontend/src/components/chat/chat-empty-state.tsx +++ b/web/frontend/src/components/chat/chat-empty-state.tsx @@ -34,7 +34,7 @@ export function ChatEmptyState({

{t("chat.empty.noConfiguredModelDescription")}

-
diff --git a/web/frontend/src/components/chat/chat-page.tsx b/web/frontend/src/components/chat/chat-page.tsx index 1906a0367..ebcde8981 100644 --- a/web/frontend/src/components/chat/chat-page.tsx +++ b/web/frontend/src/components/chat/chat-page.tsx @@ -15,7 +15,6 @@ import { useChatModels } from "@/hooks/use-chat-models" import { useGateway } from "@/hooks/use-gateway" import { usePicoChat } from "@/hooks/use-pico-chat" import { useSessionHistory } from "@/hooks/use-session-history" -import { hydrateActiveSession } from "@/lib/pico-chat-controller" export function ChatPage() { const { t } = useTranslation() @@ -26,6 +25,7 @@ export function ChatPage() { const { messages, + connectionState, isTyping, activeSessionId, sendMessage, @@ -34,7 +34,8 @@ export function ChatPage() { } = usePicoChat() const { state: gwState } = useGateway() - const isConnected = gwState === "running" + const isGatewayRunning = gwState === "running" + const isChatConnected = connectionState === "connected" const { defaultModelName, @@ -43,7 +44,8 @@ export function ChatPage() { oauthModels, localModels, handleSetDefault, - } = useChatModels({ isConnected }) + } = useChatModels({ isConnected: isGatewayRunning }) + const canSend = isChatConnected && Boolean(defaultModelName) const { sessions, @@ -68,10 +70,6 @@ export function ChatPage() { syncScrollState(e.currentTarget) } - useEffect(() => { - void hydrateActiveSession() - }, []) - useEffect(() => { if (scrollRef.current) { if (isAtBottom) { @@ -82,9 +80,10 @@ export function ChatPage() { }, [messages, isTyping, isAtBottom]) const handleSend = () => { - if (!input.trim() || !isConnected) return - sendMessage(input.trim()) - setInput("") + if (!input.trim() || !canSend) return + if (sendMessage(input.trim())) { + setInput("") + } } return ( @@ -143,7 +142,7 @@ export function ChatPage() { )} @@ -168,7 +167,7 @@ export function ChatPage() { input={input} onInputChange={setInput} onSend={handleSend} - isConnected={isConnected} + isConnected={isChatConnected} hasDefaultModel={Boolean(defaultModelName)} />
diff --git a/web/frontend/src/lib/pico-chat-controller.ts b/web/frontend/src/features/chat/controller.ts similarity index 53% rename from web/frontend/src/lib/pico-chat-controller.ts rename to web/frontend/src/features/chat/controller.ts index 0e77d1ad0..5e6eb2229 100644 --- a/web/frontend/src/lib/pico-chat-controller.ts +++ b/web/frontend/src/features/chat/controller.ts @@ -2,24 +2,24 @@ import { getDefaultStore } from "jotai" import { toast } from "sonner" import { getPicoToken } from "@/api/pico" -import { getSessionHistory } from "@/api/sessions" -import i18n from "@/i18n" +import { + loadSessionMessages, + mergeHistoryMessages, +} from "@/features/chat/history" +import { type PicoMessage, handlePicoMessage } from "@/features/chat/protocol" import { clearStoredSessionId, generateSessionId, - normalizeUnixTimestamp, readStoredSessionId, -} from "@/lib/pico-chat-state" -import { type ChatMessage, getChatState, updateChatStore } from "@/store/chat" -import { gatewayAtom } from "@/store/gateway" - -interface PicoMessage { - type: string - id?: string - session_id?: string - timestamp?: number | string - payload?: Record -} +} from "@/features/chat/state" +import { + invalidateSocket, + isCurrentSocket, + normalizeWsUrlForBrowser, +} from "@/features/chat/websocket" +import i18n from "@/i18n" +import { getChatState, updateChatStore } from "@/store/chat" +import { type GatewayState, gatewayAtom } from "@/store/gateway" const store = getDefaultStore() @@ -31,81 +31,51 @@ let initialized = false let unsubscribeGateway: (() => void) | null = null let hydratePromise: Promise | null = null let connectionGeneration = 0 +let reconnectTimer: number | null = null +let reconnectAttempts = 0 +let shouldMaintainConnection = false -async function loadSessionMessages(sessionId: string): Promise { - const detail = await getSessionHistory(sessionId) - const fallbackTime = detail.updated - - return detail.messages.map((message, index) => ({ - id: `hist-${index}-${Date.now()}`, - role: message.role, - content: message.content, - timestamp: fallbackTime, - })) +function clearReconnectTimer() { + if (reconnectTimer !== null) { + window.clearTimeout(reconnectTimer) + reconnectTimer = null + } } -function handlePicoMessage(message: PicoMessage) { - const payload = message.payload || {} +function shouldReconnectFor(generation: number, sessionId: string): boolean { + return ( + shouldMaintainConnection && + generation === connectionGeneration && + sessionId === activeSessionIdRef && + store.get(gatewayAtom).status === "running" + ) +} - switch (message.type) { - case "message.create": { - const content = (payload.content as string) || "" - const messageId = (payload.message_id as string) || `pico-${Date.now()}` - const timestamp = - message.timestamp !== undefined && - Number.isFinite(Number(message.timestamp)) - ? normalizeUnixTimestamp(Number(message.timestamp)) - : Date.now() - - updateChatStore((prev) => ({ - messages: [ - ...prev.messages, - { - id: messageId, - role: "assistant", - content, - timestamp, - }, - ], - isTyping: false, - })) - break - } - - case "message.update": { - const content = (payload.content as string) || "" - const messageId = payload.message_id as string - if (!messageId) { - break - } - - updateChatStore((prev) => ({ - messages: prev.messages.map((msg) => - msg.id === messageId ? { ...msg, content } : msg, - ), - })) - break - } - - case "typing.start": - updateChatStore({ isTyping: true }) - break - - case "typing.stop": - updateChatStore({ isTyping: false }) - break - - case "error": - console.error("Pico error:", payload) - updateChatStore({ isTyping: false }) - break - - case "pong": - break - - default: - console.log("Unknown pico message type:", message.type) +function scheduleReconnect(generation: number, sessionId: string) { + if (!shouldReconnectFor(generation, sessionId) || reconnectTimer !== null) { + return } + + const delay = Math.min(1000 * 2 ** reconnectAttempts, 5000) + reconnectAttempts += 1 + reconnectTimer = window.setTimeout(() => { + reconnectTimer = null + if (!shouldReconnectFor(generation, sessionId)) { + return + } + void connectChat() + }, delay) +} + +function needsActiveSessionHydration(): boolean { + const state = getChatState() + const storedSessionId = readStoredSessionId() + + return Boolean( + storedSessionId && + storedSessionId === state.activeSessionId && + !state.hasHydratedActiveSession, + ) } function setActiveSessionId(sessionId: string) { @@ -113,8 +83,35 @@ function setActiveSessionId(sessionId: string) { updateChatStore({ activeSessionId: sessionId }) } +function disconnectChatInternal({ + clearDesiredConnection, +}: { + clearDesiredConnection: boolean +}) { + connectionGeneration += 1 + clearReconnectTimer() + + if (clearDesiredConnection) { + shouldMaintainConnection = false + } + + const socket = wsRef + wsRef = null + isConnecting = false + + invalidateSocket(socket) + + updateChatStore({ + connectionState: "disconnected", + isTyping: false, + }) +} + export async function connectChat() { - if (store.get(gatewayAtom).status !== "running") { + if ( + store.get(gatewayAtom).status !== "running" || + needsActiveSessionHydration() + ) { return } @@ -130,12 +127,15 @@ export async function connectChat() { const generation = connectionGeneration + 1 connectionGeneration = generation isConnecting = true + clearReconnectTimer() updateChatStore({ connectionState: "connecting" }) try { const { token, ws_url } = await getPicoToken() + const sessionId = activeSessionIdRef if (generation !== connectionGeneration) { + isConnecting = false return } @@ -143,56 +143,71 @@ export async function connectChat() { console.error("No pico token available") updateChatStore({ connectionState: "error" }) isConnecting = false + scheduleReconnect(generation, sessionId) return } - let finalWsUrl = ws_url - try { - const parsedUrl = new URL(ws_url) - const isLocalHost = - parsedUrl.hostname === "localhost" || - parsedUrl.hostname === "127.0.0.1" || - parsedUrl.hostname === "0.0.0.0" - const isBrowserLocal = - window.location.hostname === "localhost" || - window.location.hostname === "127.0.0.1" - - if (isLocalHost && !isBrowserLocal) { - parsedUrl.hostname = window.location.hostname - finalWsUrl = parsedUrl.toString() - } - } catch (error) { - console.warn("Could not parse ws_url:", error) - } - - const url = `${finalWsUrl}?session_id=${encodeURIComponent(activeSessionIdRef)}` - // Send token as a subprotocol so it doesn't end up in the URL. + const finalWsUrl = normalizeWsUrlForBrowser(ws_url) + const url = `${finalWsUrl}?session_id=${encodeURIComponent(sessionId)}` const socket = new WebSocket(url, [`token.${token}`]) if (generation !== connectionGeneration) { - socket.close() + isConnecting = false + invalidateSocket(socket) return } socket.onopen = () => { - if (wsRef !== socket) { + if ( + !isCurrentSocket({ + socket, + currentSocket: wsRef, + generation, + currentGeneration: connectionGeneration, + sessionId, + currentSessionId: activeSessionIdRef, + }) + ) { return } updateChatStore({ connectionState: "connected" }) isConnecting = false + reconnectAttempts = 0 } socket.onmessage = (event) => { + if ( + !isCurrentSocket({ + socket, + currentSocket: wsRef, + generation, + currentGeneration: connectionGeneration, + sessionId, + currentSessionId: activeSessionIdRef, + }) + ) { + return + } + try { - const message: PicoMessage = JSON.parse(event.data) - handlePicoMessage(message) + const message = JSON.parse(event.data) as PicoMessage + handlePicoMessage(message, sessionId) } catch { console.warn("Non-JSON message from pico:", event.data) } } socket.onclose = () => { - if (wsRef !== socket) { + if ( + !isCurrentSocket({ + socket, + currentSocket: wsRef, + generation, + currentGeneration: connectionGeneration, + sessionId, + currentSessionId: activeSessionIdRef, + }) + ) { return } wsRef = null @@ -201,42 +216,42 @@ export async function connectChat() { connectionState: "disconnected", isTyping: false, }) + scheduleReconnect(generation, sessionId) } socket.onerror = () => { - if (wsRef !== socket) { + if ( + !isCurrentSocket({ + socket, + currentSocket: wsRef, + generation, + currentGeneration: connectionGeneration, + sessionId, + currentSessionId: activeSessionIdRef, + }) + ) { return } isConnecting = false updateChatStore({ connectionState: "error" }) + scheduleReconnect(generation, sessionId) } wsRef = socket } catch (error) { if (generation !== connectionGeneration) { + isConnecting = false return } console.error("Failed to connect to pico:", error) updateChatStore({ connectionState: "error" }) isConnecting = false + scheduleReconnect(generation, activeSessionIdRef) } } export function disconnectChat() { - connectionGeneration += 1 - - const socket = wsRef - wsRef = null - isConnecting = false - - if (socket) { - socket.close() - } - - updateChatStore({ - connectionState: "disconnected", - isTyping: false, - }) + disconnectChatInternal({ clearDesiredConnection: true }) } export async function hydrateActiveSession() { @@ -250,7 +265,6 @@ export async function hydrateActiveSession() { if ( !storedSessionId || state.hasHydratedActiveSession || - state.messages.length > 0 || storedSessionId !== state.activeSessionId ) { if (!state.hasHydratedActiveSession) { @@ -267,7 +281,13 @@ export async function hydrateActiveSession() { } if (currentState.messages.length > 0) { - updateChatStore({ hasHydratedActiveSession: true }) + updateChatStore({ + messages: mergeHistoryMessages( + historyMessages, + currentState.messages, + ), + hasHydratedActiveSession: true, + }) return } @@ -307,9 +327,10 @@ export async function hydrateActiveSession() { export function sendChatMessage(content: string) { if (!wsRef || wsRef.readyState !== WebSocket.OPEN) { console.warn("WebSocket not connected") - return + return false } + const socket = wsRef const id = `msg-${++msgIdCounter}-${Date.now()}` updateChatStore((prev) => ({ @@ -320,13 +341,23 @@ export function sendChatMessage(content: string) { isTyping: true, })) - wsRef.send( - JSON.stringify({ - type: "message.send", - id, - payload: { content }, - }), - ) + try { + socket.send( + JSON.stringify({ + type: "message.send", + id, + payload: { content }, + }), + ) + return true + } catch (error) { + console.error("Failed to send pico message:", error) + updateChatStore((prev) => ({ + messages: prev.messages.filter((message) => message.id !== id), + isTyping: false, + })) + return false + } } export async function switchChatSession(sessionId: string) { @@ -337,7 +368,7 @@ export async function switchChatSession(sessionId: string) { try { const historyMessages = await loadSessionMessages(sessionId) - disconnectChat() + disconnectChatInternal({ clearDesiredConnection: false }) setActiveSessionId(sessionId) updateChatStore({ messages: historyMessages, @@ -346,6 +377,7 @@ export async function switchChatSession(sessionId: string) { }) if (store.get(gatewayAtom).status === "running") { + shouldMaintainConnection = true await connectChat() } } catch (error) { @@ -359,7 +391,7 @@ export async function newChatSession() { return } - disconnectChat() + disconnectChatInternal({ clearDesiredConnection: false }) setActiveSessionId(generateSessionId()) updateChatStore({ messages: [], @@ -368,6 +400,7 @@ export async function newChatSession() { }) if (store.get(gatewayAtom).status === "running") { + shouldMaintainConnection = true await connectChat() } } @@ -379,23 +412,43 @@ export function initializeChatStore() { initialized = true activeSessionIdRef = getChatState().activeSessionId + let lastGatewayStatus: GatewayState | null = null - const syncConnectionWithGateway = () => { - if (store.get(gatewayAtom).status === "running") { + const syncConnectionWithGateway = (force: boolean = false) => { + const gatewayStatus = store.get(gatewayAtom).status + if (!force && gatewayStatus === lastGatewayStatus) { + return + } + lastGatewayStatus = gatewayStatus + + if (gatewayStatus === "running") { + shouldMaintainConnection = true + if (needsActiveSessionHydration()) { + return + } void connectChat() return } - disconnectChat() + if (gatewayStatus === "stopped" || gatewayStatus === "error") { + disconnectChatInternal({ clearDesiredConnection: true }) + } } unsubscribeGateway = store.sub(gatewayAtom, syncConnectionWithGateway) if (!readStoredSessionId()) { updateChatStore({ hasHydratedActiveSession: true }) + syncConnectionWithGateway(true) + return } - syncConnectionWithGateway() + void hydrateActiveSession().finally(() => { + if (!initialized) { + return + } + syncConnectionWithGateway(true) + }) } export function teardownChatStore() { diff --git a/web/frontend/src/features/chat/history.ts b/web/frontend/src/features/chat/history.ts new file mode 100644 index 000000000..886148184 --- /dev/null +++ b/web/frontend/src/features/chat/history.ts @@ -0,0 +1,68 @@ +import { getSessionHistory } from "@/api/sessions" +import { normalizeUnixTimestamp } from "@/features/chat/state" +import type { ChatMessage } from "@/store/chat" + +export async function loadSessionMessages( + sessionId: string, +): Promise { + const detail = await getSessionHistory(sessionId) + const fallbackTime = detail.updated + + return detail.messages.map((message, index) => ({ + id: `hist-${index}-${Date.now()}`, + role: message.role, + content: message.content, + timestamp: fallbackTime, + })) +} + +function normalizeMessageTimestamp(timestamp: number | string): string { + if (typeof timestamp === "number") { + return String(normalizeUnixTimestamp(timestamp)) + } + + const trimmed = timestamp.trim() + if (/^-?\d+(\.\d+)?$/.test(trimmed)) { + return String(normalizeUnixTimestamp(Number(trimmed))) + } + + const parsed = Date.parse(trimmed) + return Number.isNaN(parsed) ? trimmed : String(parsed) +} + +function messageSignature(message: ChatMessage): string { + return `${message.role}\u0000${message.content}\u0000${normalizeMessageTimestamp( + message.timestamp, + )}` +} + +function comparableTimestamp(timestamp: number | string): number { + const normalized = normalizeMessageTimestamp(timestamp) + const numeric = Number(normalized) + return Number.isFinite(numeric) ? numeric : 0 +} + +export function mergeHistoryMessages( + historyMessages: ChatMessage[], + currentMessages: ChatMessage[], +): ChatMessage[] { + const currentIds = new Set(currentMessages.map((message) => message.id)) + const currentSignatures = new Set( + currentMessages.map((message) => messageSignature(message)), + ) + + const merged = [ + ...historyMessages.filter( + (message) => + !currentIds.has(message.id) && + !currentSignatures.has(messageSignature(message)), + ), + ...currentMessages, + ] + + return merged.sort( + (left, right) => + comparableTimestamp(left.timestamp) - + comparableTimestamp(right.timestamp), + ) +} diff --git a/web/frontend/src/features/chat/protocol.ts b/web/frontend/src/features/chat/protocol.ts new file mode 100644 index 000000000..5e5220c77 --- /dev/null +++ b/web/frontend/src/features/chat/protocol.ts @@ -0,0 +1,81 @@ +import { normalizeUnixTimestamp } from "@/features/chat/state" +import { updateChatStore } from "@/store/chat" + +export interface PicoMessage { + type: string + id?: string + session_id?: string + timestamp?: number | string + payload?: Record +} + +export function handlePicoMessage( + message: PicoMessage, + expectedSessionId: string, +) { + if (message.session_id && message.session_id !== expectedSessionId) { + return + } + + const payload = message.payload || {} + + switch (message.type) { + case "message.create": { + const content = (payload.content as string) || "" + const messageId = (payload.message_id as string) || `pico-${Date.now()}` + const timestamp = + message.timestamp !== undefined && + Number.isFinite(Number(message.timestamp)) + ? normalizeUnixTimestamp(Number(message.timestamp)) + : Date.now() + + updateChatStore((prev) => ({ + messages: [ + ...prev.messages, + { + id: messageId, + role: "assistant", + content, + timestamp, + }, + ], + isTyping: false, + })) + break + } + + case "message.update": { + const content = (payload.content as string) || "" + const messageId = payload.message_id as string + if (!messageId) { + break + } + + updateChatStore((prev) => ({ + messages: prev.messages.map((msg) => + msg.id === messageId ? { ...msg, content } : msg, + ), + })) + break + } + + case "typing.start": + updateChatStore({ isTyping: true }) + break + + case "typing.stop": + updateChatStore({ isTyping: false }) + break + + case "error": + console.error("Pico error:", payload) + updateChatStore({ isTyping: false }) + break + + case "pong": + break + + default: + console.log("Unknown pico message type:", message.type) + } +} diff --git a/web/frontend/src/lib/pico-chat-state.ts b/web/frontend/src/features/chat/state.ts similarity index 100% rename from web/frontend/src/lib/pico-chat-state.ts rename to web/frontend/src/features/chat/state.ts diff --git a/web/frontend/src/features/chat/websocket.ts b/web/frontend/src/features/chat/websocket.ts new file mode 100644 index 000000000..6b132e9a6 --- /dev/null +++ b/web/frontend/src/features/chat/websocket.ts @@ -0,0 +1,57 @@ +export function normalizeWsUrlForBrowser(wsUrl: string): string { + let finalWsUrl = wsUrl + + try { + const parsedUrl = new URL(wsUrl) + const isLocalHost = + parsedUrl.hostname === "localhost" || + parsedUrl.hostname === "127.0.0.1" || + parsedUrl.hostname === "0.0.0.0" + const isBrowserLocal = + window.location.hostname === "localhost" || + window.location.hostname === "127.0.0.1" + + if (isLocalHost && !isBrowserLocal) { + parsedUrl.hostname = window.location.hostname + finalWsUrl = parsedUrl.toString() + } + } catch (error) { + console.warn("Could not parse ws_url:", error) + } + + return finalWsUrl +} + +export function invalidateSocket(socket: WebSocket | null) { + if (!socket) { + return + } + + socket.onopen = null + socket.onmessage = null + socket.onclose = null + socket.onerror = null + socket.close() +} + +export function isCurrentSocket({ + socket, + currentSocket, + generation, + currentGeneration, + sessionId, + currentSessionId, +}: { + socket: WebSocket + currentSocket: WebSocket | null + generation: number + currentGeneration: number + sessionId: string + currentSessionId: string +}): boolean { + return ( + currentSocket === socket && + generation === currentGeneration && + sessionId === currentSessionId + ) +} diff --git a/web/frontend/src/hooks/use-gateway.ts b/web/frontend/src/hooks/use-gateway.ts index 848f4d59c..65ec2b776 100644 --- a/web/frontend/src/hooks/use-gateway.ts +++ b/web/frontend/src/hooks/use-gateway.ts @@ -67,10 +67,9 @@ export function useGateway() { } es.onerror = () => { - // EventSource will auto-reconnect - updateGatewayStore((prev) => - prev.status === "restarting" ? {} : { status: "unknown" }, - ) + // EventSource will auto-reconnect. Preserve the last known gateway + // status so transient SSE disconnects do not suppress chat websocket + // reconnects while polling catches up. } return () => { @@ -105,6 +104,11 @@ export function useGateway() { setLoading(true) try { await stopGateway() + updateGatewayStore({ + status: "stopped", + canStart: true, + restartRequired: false, + }) } catch (err) { console.error("Failed to stop gateway:", err) } finally { diff --git a/web/frontend/src/hooks/use-pico-chat.ts b/web/frontend/src/hooks/use-pico-chat.ts index 1b97a2a9c..3ac2e1613 100644 --- a/web/frontend/src/hooks/use-pico-chat.ts +++ b/web/frontend/src/hooks/use-pico-chat.ts @@ -5,7 +5,7 @@ import { newChatSession, sendChatMessage, switchChatSession, -} from "@/lib/pico-chat-controller" +} from "@/features/chat/controller" import { chatAtom } from "@/store/chat" const UNIX_MS_THRESHOLD = 1e12 @@ -33,7 +33,6 @@ function parseTimestamp(dateRaw: number | string | Date) { return dayjs(dateRaw) } -// Helper to format message timestamps export function formatMessageTime(dateRaw: number | string | Date): string { const date = parseTimestamp(dateRaw) if (!date.isValid()) { @@ -48,7 +47,6 @@ export function formatMessageTime(dateRaw: number | string | Date): string { return date.format("LT") } - // Cross-day formatting if (isThisYear) { return date.format("MMM D LT") } diff --git a/web/frontend/src/hooks/use-websocket.ts b/web/frontend/src/hooks/use-websocket.ts deleted file mode 100644 index c41b5ed34..000000000 --- a/web/frontend/src/hooks/use-websocket.ts +++ /dev/null @@ -1,47 +0,0 @@ -import { useCallback, useEffect, useRef, useState } from "react" - -export function useWebSocket(path: string) { - const [message, setMessage] = useState("No messages yet") - const [connected, setConnected] = useState(false) - const wsRef = useRef(null) - - const connect = useCallback(() => { - if (wsRef.current) { - wsRef.current.close() - } - - const protocol = window.location.protocol === "https:" ? "wss:" : "ws:" - const url = `${protocol}//${window.location.host}${path}` - const socket = new WebSocket(url) - - socket.onopen = () => { - setConnected(true) - setMessage("Connected to WebSocket server.") - } - - socket.onmessage = (event) => { - setMessage(event.data) - } - - socket.onclose = () => { - setConnected(false) - setMessage("WebSocket connection closed.") - } - - socket.onerror = (error) => { - setConnected(false) - setMessage("WebSocket error occurred.") - console.error("WebSocket Error:", error) - } - - wsRef.current = socket - }, [path]) - - useEffect(() => { - return () => { - wsRef.current?.close() - } - }, []) - - return { message, connected, connect } -} diff --git a/web/frontend/src/routes/__root.tsx b/web/frontend/src/routes/__root.tsx index 6431d9490..31fdb7804 100644 --- a/web/frontend/src/routes/__root.tsx +++ b/web/frontend/src/routes/__root.tsx @@ -3,7 +3,7 @@ import { TanStackRouterDevtools } from "@tanstack/react-router-devtools" import { useEffect } from "react" import { AppLayout } from "@/components/app-layout" -import { initializeChatStore } from "@/lib/pico-chat-controller" +import { initializeChatStore } from "@/features/chat/controller" const RootLayout = () => { useEffect(() => { diff --git a/web/frontend/src/store/chat.ts b/web/frontend/src/store/chat.ts index d79a1a93b..da5fa6670 100644 --- a/web/frontend/src/store/chat.ts +++ b/web/frontend/src/store/chat.ts @@ -3,7 +3,7 @@ import { atom, getDefaultStore } from "jotai" import { getInitialActiveSessionId, writeStoredSessionId, -} from "@/lib/pico-chat-state" +} from "@/features/chat/state" export interface ChatMessage { id: string diff --git a/web/frontend/src/store/gateway.ts b/web/frontend/src/store/gateway.ts index b7655839c..c5eee8451 100644 --- a/web/frontend/src/store/gateway.ts +++ b/web/frontend/src/store/gateway.ts @@ -31,7 +31,17 @@ function normalizeGatewayStoreState( prev: GatewayStoreState, patch: GatewayStorePatch, ) { - return { ...prev, ...patch } + const next = { ...prev, ...patch } + + if ( + next.status === prev.status && + next.canStart === prev.canStart && + next.restartRequired === prev.restartRequired + ) { + return prev + } + + return next } export function updateGatewayStore( From 0459deca03a31ed08f778bffa78a17c5ae3a0491 Mon Sep 17 00:00:00 2001 From: Argobell Date: Mon, 16 Mar 2026 16:45:39 +0800 Subject: [PATCH 035/234] Initial plan From 1ace296b9128e6e8bc383d1db4670d95611b2189 Mon Sep 17 00:00:00 2001 From: Argobell Date: Mon, 16 Mar 2026 16:46:13 +0800 Subject: [PATCH 036/234] fix: use fileEvent instead of event when appending fields for file logger Co-authored-by: argobell <183611258+argobell@users.noreply.github.com> --- go.mod | 4 ++-- pkg/logger/logger.go | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 130db73ff..52130c71b 100644 --- a/go.mod +++ b/go.mod @@ -28,6 +28,7 @@ require ( github.com/tencent-connect/botgo v0.2.1 go.mau.fi/whatsmeow v0.0.0-20260219150138-7ae702b1eed4 golang.org/x/oauth2 v0.36.0 + golang.org/x/term v0.40.0 golang.org/x/time v0.14.0 google.golang.org/protobuf v1.36.11 gopkg.in/yaml.v3 v3.0.1 @@ -59,7 +60,6 @@ require ( go.mau.fi/libsignal v0.2.1 // indirect go.mau.fi/util v0.9.6 // indirect golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect - golang.org/x/term v0.40.0 // indirect golang.org/x/text v0.34.0 // indirect modernc.org/libc v1.67.6 // indirect modernc.org/mathutil v1.7.1 // indirect @@ -90,7 +90,7 @@ require ( github.com/valyala/fastjson v1.6.10 // indirect github.com/yosida95/uritemplate/v3 v3.0.2 // indirect golang.org/x/arch v0.24.0 // indirect - golang.org/x/crypto v0.48.0 // indirect + golang.org/x/crypto v0.48.0 golang.org/x/net v0.51.0 // indirect golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.41.0 // indirect diff --git a/pkg/logger/logger.go b/pkg/logger/logger.go index 4204cc192..95af83ef1 100644 --- a/pkg/logger/logger.go +++ b/pkg/logger/logger.go @@ -209,7 +209,7 @@ func logMessage(level LogLevel, component string, message string, fields map[str fileEvent.Str("component", component) } - appendFields(event, fields) + appendFields(fileEvent, fields) fileEvent.Msg(message) } From 8fc36a4f9bdd4ea1c9784d2570102a5a1d16dd57 Mon Sep 17 00:00:00 2001 From: Dmitrii Balabanov Date: Fri, 13 Mar 2026 12:06:48 +0200 Subject: [PATCH 037/234] fix(logger): mask bot tokens in 3rd-party logger output --- pkg/logger/logger_3rd_party.go | 36 ++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/pkg/logger/logger_3rd_party.go b/pkg/logger/logger_3rd_party.go index da50d686a..3c311520c 100644 --- a/pkg/logger/logger_3rd_party.go +++ b/pkg/logger/logger_3rd_party.go @@ -2,7 +2,19 @@ package logger -import "fmt" +import ( + "fmt" + "regexp" +) + +// botTokenRe matches the secret part of a Telegram bot token embedded in a URL +// or log message: /bot:/ → /bot:****/ +var botTokenRe = regexp.MustCompile(`(bot\d+:)[A-Za-z0-9_-]{20,}`) + +// maskSecrets replaces any embedded bot tokens in s with a redacted placeholder. +func maskSecrets(s string) string { + return botTokenRe.ReplaceAllString(s, "${1}****") +} // Logger implements common Logger interface type Logger struct { @@ -12,52 +24,52 @@ type Logger struct { // Debug logs debug messages func (b *Logger) Debug(v ...any) { - logMessage(DEBUG, b.component, fmt.Sprint(v...), nil) + logMessage(DEBUG, b.component, maskSecrets(fmt.Sprint(v...)), nil) } // Info logs info messages func (b *Logger) Info(v ...any) { - logMessage(INFO, b.component, fmt.Sprint(v...), nil) + logMessage(INFO, b.component, maskSecrets(fmt.Sprint(v...)), nil) } // Warn logs warning messages func (b *Logger) Warn(v ...any) { - logMessage(WARN, b.component, fmt.Sprint(v...), nil) + logMessage(WARN, b.component, maskSecrets(fmt.Sprint(v...)), nil) } // Error logs error messages func (b *Logger) Error(v ...any) { - logMessage(ERROR, b.component, fmt.Sprint(v...), nil) + logMessage(ERROR, b.component, maskSecrets(fmt.Sprint(v...)), nil) } // Debugf logs formatted debug messages func (b *Logger) Debugf(format string, v ...any) { - logMessage(DEBUG, b.component, fmt.Sprintf(format, v...), nil) + logMessage(DEBUG, b.component, maskSecrets(fmt.Sprintf(format, v...)), nil) } // Infof logs formatted info messages func (b *Logger) Infof(format string, v ...any) { - logMessage(INFO, b.component, fmt.Sprintf(format, v...), nil) + logMessage(INFO, b.component, maskSecrets(fmt.Sprintf(format, v...)), nil) } // Warnf logs formatted warning messages func (b *Logger) Warnf(format string, v ...any) { - logMessage(WARN, b.component, fmt.Sprintf(format, v...), nil) + logMessage(WARN, b.component, maskSecrets(fmt.Sprintf(format, v...)), nil) } // Warningf logs formatted warning messages func (b *Logger) Warningf(format string, v ...any) { - logMessage(WARN, b.component, fmt.Sprintf(format, v...), nil) + logMessage(WARN, b.component, maskSecrets(fmt.Sprintf(format, v...)), nil) } // Errorf logs formatted error messages func (b *Logger) Errorf(format string, v ...any) { - logMessage(ERROR, b.component, fmt.Sprintf(format, v...), nil) + logMessage(ERROR, b.component, maskSecrets(fmt.Sprintf(format, v...)), nil) } // Fatalf logs formatted fatal messages and exits func (b *Logger) Fatalf(format string, v ...any) { - logMessage(FATAL, b.component, fmt.Sprintf(format, v...), nil) + logMessage(FATAL, b.component, maskSecrets(fmt.Sprintf(format, v...)), nil) } // Log logs a message at a given level with caller information @@ -75,7 +87,7 @@ func (b *Logger) Log(msgL, caller int, format string, a ...any) { level = lvl } } - logMessage(level, b.component, fmt.Sprintf(format, a...), nil) + logMessage(level, b.component, maskSecrets(fmt.Sprintf(format, a...)), nil) } // Sync flushes log buffer (no-op for this implementation) From 64ceb5ab760703b0b27e933f1a022f7b64de64aa Mon Sep 17 00:00:00 2001 From: Dmitrii Balabanov Date: Fri, 13 Mar 2026 12:09:03 +0200 Subject: [PATCH 038/234] fix(logger): show first/last 4 chars of bot token for identification --- pkg/logger/logger_3rd_party.go | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/pkg/logger/logger_3rd_party.go b/pkg/logger/logger_3rd_party.go index 3c311520c..d0cb178c5 100644 --- a/pkg/logger/logger_3rd_party.go +++ b/pkg/logger/logger_3rd_party.go @@ -7,13 +7,14 @@ import ( "regexp" ) -// botTokenRe matches the secret part of a Telegram bot token embedded in a URL -// or log message: /bot:/ → /bot:****/ -var botTokenRe = regexp.MustCompile(`(bot\d+:)[A-Za-z0-9_-]{20,}`) +// botTokenRe matches the bot ID prefix and the secret part of a Telegram bot token. +// Groups: 1 = "bot:", 2 = first 4 chars of secret, 3 = middle, 4 = last 4 chars. +var botTokenRe = regexp.MustCompile(`(bot\d+:)([A-Za-z0-9_-]{4})[A-Za-z0-9_-]{12,}([A-Za-z0-9_-]{4})`) -// maskSecrets replaces any embedded bot tokens in s with a redacted placeholder. +// maskSecrets replaces any embedded bot tokens in s with a redacted placeholder +// that keeps the first and last 4 characters of the secret for identification. func maskSecrets(s string) string { - return botTokenRe.ReplaceAllString(s, "${1}****") + return botTokenRe.ReplaceAllString(s, "${1}${2}****${3}") } // Logger implements common Logger interface From ceeae15d8ad670b3f03ca430ef2811d98760f2b9 Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Mon, 16 Mar 2026 17:27:04 +0800 Subject: [PATCH 039/234] feat(agent): wire SubTurn into AgentLoop and Spawn Tool - Add subTurnResults sync.Map to AgentLoop for per-session channel tracking - Add register/unregister/dequeue methods in steering.go - Poll SubTurn results in runLLMIteration at loop start and after each tool, injecting results as [SubTurn Result] messages into parent conversation - Initialize root turnState in runAgentLoop, propagate via context (withTurnState/turnStateFromContext), call rootTS.Finish() on completion - Wire Spawn Tool to spawnSubTurn via SetSpawner in registerSharedTools, recovering parentTS from context for proper turn hierarchy - Refactor subagent.go to use SetSpawner pattern - Add TestSubTurnResultChannelRegistration and TestDequeuePendingSubTurnResults --- pkg/agent/loop.go | 108 ++++++++++++++++++++++- pkg/agent/steering.go | 41 +++++++++ pkg/agent/subturn.go | 27 ++++-- pkg/agent/subturn_test.go | 70 +++++++++++++++ pkg/tools/subagent.go | 175 ++++++++++++++++++++++++-------------- 5 files changed, 348 insertions(+), 73 deletions(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 21516e7de..510e247e3 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -49,6 +49,7 @@ type AgentLoop struct { cmdRegistry *commands.Registry mcp mcpRuntime steering *steeringQueue + subTurnResults sync.Map mu sync.RWMutex // Track active requests for safe provider cleanup activeRequests sync.WaitGroup @@ -85,9 +86,6 @@ func NewAgentLoop( ) *AgentLoop { registry := NewAgentRegistry(cfg, provider) - // Register shared tools to all agents - registerSharedTools(cfg, msgBus, registry, provider) - // Set up shared fallback chain cooldown := providers.NewCooldownTracker() fallbackChain := providers.NewFallbackChain(cooldown) @@ -110,11 +108,15 @@ func NewAgentLoop( steering: newSteeringQueue(parseSteeringMode(cfg.Agents.Defaults.SteeringMode)), } + // Register shared tools to all agents (now that al is created) + registerSharedTools(al, cfg, msgBus, registry, provider) + return al } // registerSharedTools registers tools that are shared across all agents (web, message, spawn). func registerSharedTools( + al *AgentLoop, cfg *config.Config, msgBus *bus.MessageBus, registry *AgentRegistry, @@ -230,12 +232,76 @@ func registerSharedTools( if cfg.Tools.IsToolEnabled("subagent") { subagentManager := tools.NewSubagentManager(provider, agent.Model, agent.Workspace) subagentManager.SetLLMOptions(agent.MaxTokens, agent.Temperature) + + // Set the spawner that links into AgentLoop's turnState + subagentManager.SetSpawner(func( + ctx context.Context, + task, label, targetAgentID string, + tls *tools.ToolRegistry, + maxTokens int, + temperature float64, + hasMaxTokens, hasTemperature bool, + ) (*tools.ToolResult, error) { + // 1. Recover parent Turn State from Context + parentTS := turnStateFromContext(ctx) + if parentTS == nil { + // Fallback: If no turnState exists in context, create an isolated ad-hoc root turn state + // so that the tool can still function outside of an agent loop (e.g. tests, raw invocations). + parentTS = &turnState{ + ctx: ctx, + turnID: "adhoc-root", + depth: 0, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + } + } + + // 2. Build Tools slice from registry + var tlSlice []tools.Tool + for _, name := range tls.List() { + if t, ok := tls.Get(name); ok { + tlSlice = append(tlSlice, t) + } + } + + // 3. System Prompt + systemPrompt := "You are a subagent. Complete the given task independently and report the result.\n" + + "You have access to tools - use them as needed to complete your task.\n" + + "After completing the task, provide a clear summary of what was done.\n\n" + + "Task: " + task + + // 4. Resolve Model + modelToUse := agent.Model + if targetAgentID != "" { + if targetAgent, ok := al.GetRegistry().GetAgent(targetAgentID); ok { + modelToUse = targetAgent.Model + } + } + + // 5. Build SubTurnConfig + cfg := SubTurnConfig{ + Model: modelToUse, + Tools: tlSlice, + SystemPrompt: systemPrompt, + } + if hasMaxTokens { + cfg.MaxTokens = maxTokens + } + + // 6. Spawn SubTurn + return spawnSubTurn(ctx, al, parentTS, cfg) + }) + spawnTool := tools.NewSpawnTool(subagentManager) currentAgentID := agentID spawnTool.SetAllowlistChecker(func(targetAgentID string) bool { return registry.CanSpawnSubagent(currentAgentID, targetAgentID) }) agent.Tools.Register(spawnTool) + + // Also register the synchronous subagent tool + subagentTool := tools.NewSubagentTool(subagentManager) + agent.Tools.Register(subagentTool) } else { logger.WarnCF("agent", "spawn tool requires subagent to be enabled", nil) } @@ -450,7 +516,7 @@ func (al *AgentLoop) ReloadProviderAndConfig( } // Ensure shared tools are re-registered on the new registry - registerSharedTools(cfg, al.bus, registry, provider) + registerSharedTools(al, cfg, al.bus, registry, provider) // Atomically swap the config and registry under write lock // This ensures readers see a consistent pair @@ -896,6 +962,20 @@ func (al *AgentLoop) runAgentLoop( agent *AgentInstance, opts processOptions, ) (string, error) { + // Initialize a root TurnState for this iteration, allowing sub-turns to be spawned. + rootTS := &turnState{ + ctx: ctx, + turnID: opts.SessionKey, // Associate this turn graph with the current session key + depth: 0, + session: agent.Sessions, + pendingResults: make(chan *tools.ToolResult, 16), + } + ctx = withTurnState(ctx, rootTS) + + // Ensure the parent's pending results channel is cleaned up when this root turn finishes + defer al.unregisterSubTurnResultChannel(rootTS.turnID) + al.registerSubTurnResultChannel(rootTS.turnID, rootTS.pendingResults) + // 0. Record last channel for heartbeat notifications (skip internal channels and cli) if opts.Channel != "" && opts.ChatID != "" { if !constants.IsInternalChannel(opts.Channel) { @@ -940,6 +1020,9 @@ func (al *AgentLoop) runAgentLoop( return "", err } + // Signal completion to rootTS so it knows it is finished, terminating any active sub-turns + rootTS.Finish() + // If last tool had ForUser content and we already sent it, we might not need to send final response // This is controlled by the tool's Silent flag and ForUser content @@ -1055,6 +1138,14 @@ func (al *AgentLoop) runLLMIteration( } } + // Poll for any pending SubTurn results and inject them as assistant context. + if subResults := al.dequeuePendingSubTurnResults(opts.SessionKey); len(subResults) > 0 { + for _, r := range subResults { + msg := providers.Message{Role: "user", Content: fmt.Sprintf("[SubTurn Result] %s", r.ForLLM)} + pendingMessages = append(pendingMessages, msg) + } + } + // Determine effective model tier for this conversation turn. // selectCandidates evaluates routing once and the decision is sticky for // all tool-follow-up iterations within the same turn so that a multi-step @@ -1459,6 +1550,15 @@ func (al *AgentLoop) runLLMIteration( steeringAfterTools = steerMsgs break } + + // Also poll for any SubTurn results that arrived during tool execution. + if subResults := al.dequeuePendingSubTurnResults(opts.SessionKey); len(subResults) > 0 { + for _, r := range subResults { + msg := providers.Message{Role: "user", Content: fmt.Sprintf("[SubTurn Result] %s", r.ForLLM)} + messages = append(messages, msg) + agent.Sessions.AddFullMessage(opts.SessionKey, msg) + } + } } // If steering messages were captured during tool execution, they diff --git a/pkg/agent/steering.go b/pkg/agent/steering.go index 8c7c79c16..c09b97581 100644 --- a/pkg/agent/steering.go +++ b/pkg/agent/steering.go @@ -8,6 +8,7 @@ import ( "github.com/sipeed/picoclaw/pkg/logger" "github.com/sipeed/picoclaw/pkg/providers" + "github.com/sipeed/picoclaw/pkg/tools" ) // SteeringMode controls how queued steering messages are dequeued. @@ -186,3 +187,43 @@ func (al *AgentLoop) Continue(ctx context.Context, sessionKey, channel, chatID s SkipInitialSteeringPoll: true, }) } + +// ====================== SubTurn Result Polling ====================== + +// dequeuePendingSubTurnResults polls the SubTurn result channel for the given +// session and returns all available results without blocking. +// Returns nil if no channel is registered for this session. +func (al *AgentLoop) dequeuePendingSubTurnResults(sessionKey string) []*tools.ToolResult { + chInterface, ok := al.subTurnResults.Load(sessionKey) + if !ok { + return nil + } + + ch, ok := chInterface.(chan *tools.ToolResult) + if !ok { + return nil + } + + var results []*tools.ToolResult + for { + select { + case result := <-ch: + if result != nil { + results = append(results, result) + } + default: + return results + } + } +} + +// registerSubTurnResultChannel registers a SubTurn result channel for the given session. +// This allows the parent loop to poll for results from child SubTurns. +func (al *AgentLoop) registerSubTurnResultChannel(sessionKey string, ch chan *tools.ToolResult) { + al.subTurnResults.Store(sessionKey, ch) +} + +// unregisterSubTurnResultChannel removes the SubTurn result channel for the given session. +func (al *AgentLoop) unregisterSubTurnResultChannel(sessionKey string) { + al.subTurnResults.Delete(sessionKey) +} diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go index ab7d60957..89b254c69 100644 --- a/pkg/agent/subturn.go +++ b/pkg/agent/subturn.go @@ -54,7 +54,20 @@ type SubTurnOrphanResultEvent struct { Result *tools.ToolResult } -// ====================== turnState (Simplified, reusable with existing structs) ====================== +// ====================== turnState ====================== +type turnStateKeyType struct{} + +var turnStateKey = turnStateKeyType{} + +func withTurnState(ctx context.Context, ts *turnState) context.Context { + return context.WithValue(ctx, turnStateKey, ts) +} + +func turnStateFromContext(ctx context.Context) *turnState { + ts, _ := ctx.Value(turnStateKey).(*turnState) + return ts +} + type turnState struct { ctx context.Context cancelFunc context.CancelFunc // Used to cancel all children when this turn finishes @@ -189,14 +202,18 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S parentTS.childTurnIDs = append(parentTS.childTurnIDs, childID) parentTS.mu.Unlock() - // 5. Emit Spawn event (currently using Mock, will be replaced by real EventBus) + // 5. Register the parent's pendingResults channel so the parent loop can poll it + al.registerSubTurnResultChannel(parentTS.turnID, parentTS.pendingResults) + defer al.unregisterSubTurnResultChannel(parentTS.turnID) + + // 6. Emit Spawn event (currently using Mock, will be replaced by real EventBus) MockEventBus.Emit(SubTurnSpawnEvent{ ParentID: parentTS.turnID, ChildID: childID, Config: cfg, }) - // 6. Defer emitting End event, and recover from panics to ensure it's always fired + // 7. Defer emitting End event, and recover from panics to ensure it's always fired defer func() { if r := recover(); r != nil { err = fmt.Errorf("subturn panicked: %v", r) @@ -209,11 +226,11 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S }) }() - // 7. Execute sub-turn via the real agent loop. + // 8. Execute sub-turn via the real agent loop. // Build a child AgentInstance from SubTurnConfig, inheriting defaults from the parent agent. result, err = runTurn(childCtx, al, childTS, cfg) - // 8. Deliver result back to parent Turn + // 9. Deliver result back to parent Turn deliverSubTurnResult(parentTS, childID, result) return result, err diff --git a/pkg/agent/subturn_test.go b/pkg/agent/subturn_test.go index 943c46015..b7012e63d 100644 --- a/pkg/agent/subturn_test.go +++ b/pkg/agent/subturn_test.go @@ -253,3 +253,73 @@ func TestSpawnSubTurn_OrphanResultRouting(t *testing.T) { t.Error("Parent history was polluted by orphan result") } } + +// ====================== Extra Independent Test: Result Channel Registration ====================== +func TestSubTurnResultChannelRegistration(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + parent := &turnState{ + ctx: context.Background(), + turnID: "parent-reg-1", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 4), + session: &ephemeralSessionStore{}, + } + + cfg := SubTurnConfig{Model: "gpt-4o-mini", Tools: []tools.Tool{}} + + // Before spawn: channel should not be registered + if results := al.dequeuePendingSubTurnResults(parent.turnID); results != nil { + t.Error("expected no channel before spawnSubTurn") + } + + _, _ = spawnSubTurn(context.Background(), al, parent, cfg) + + // After spawn completes: channel should be unregistered (defer cleanup in spawnSubTurn) + if _, ok := al.subTurnResults.Load(parent.turnID); ok { + t.Error("channel should be unregistered after spawnSubTurn completes") + } +} + +// ====================== Extra Independent Test: Dequeue Pending SubTurn Results ====================== +func TestDequeuePendingSubTurnResults(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + sessionKey := "test-session-dequeue" + ch := make(chan *tools.ToolResult, 4) + + // Register channel manually + al.registerSubTurnResultChannel(sessionKey, ch) + defer al.unregisterSubTurnResultChannel(sessionKey) + + // Empty channel returns nil + if results := al.dequeuePendingSubTurnResults(sessionKey); len(results) != 0 { + t.Errorf("expected empty results, got %d", len(results)) + } + + // Put 3 results in + ch <- &tools.ToolResult{ForLLM: "result-1"} + ch <- &tools.ToolResult{ForLLM: "result-2"} + ch <- &tools.ToolResult{ForLLM: "result-3"} + + results := al.dequeuePendingSubTurnResults(sessionKey) + if len(results) != 3 { + t.Errorf("expected 3 results, got %d", len(results)) + } + if results[0].ForLLM != "result-1" || results[2].ForLLM != "result-3" { + t.Error("results order or content mismatch") + } + + // Channel should be drained now + if results := al.dequeuePendingSubTurnResults(sessionKey); len(results) != 0 { + t.Errorf("expected empty after drain, got %d", len(results)) + } + + // Unregistered session returns nil + al.unregisterSubTurnResultChannel(sessionKey) + if results := al.dequeuePendingSubTurnResults(sessionKey); results != nil { + t.Error("expected nil for unregistered session") + } +} diff --git a/pkg/tools/subagent.go b/pkg/tools/subagent.go index e51cbaafa..7a4290746 100644 --- a/pkg/tools/subagent.go +++ b/pkg/tools/subagent.go @@ -21,6 +21,15 @@ type SubagentTask struct { Created int64 } +type SpawnSubTurnFunc func( + ctx context.Context, + task, label, agentID string, + tools *ToolRegistry, + maxTokens int, + temperature float64, + hasMaxTokens, hasTemperature bool, +) (*ToolResult, error) + type SubagentManager struct { tasks map[string]*SubagentTask mu sync.RWMutex @@ -34,6 +43,7 @@ type SubagentManager struct { hasMaxTokens bool hasTemperature bool nextID int + spawner SpawnSubTurnFunc } func NewSubagentManager( @@ -51,6 +61,12 @@ func NewSubagentManager( } } +func (sm *SubagentManager) SetSpawner(spawner SpawnSubTurnFunc) { + sm.mu.Lock() + defer sm.mu.Unlock() + sm.spawner = spawner +} + // SetLLMOptions sets max tokens and temperature for subagent LLM calls. func (sm *SubagentManager) SetLLMOptions(maxTokens int, temperature float64) { sm.mu.Lock() @@ -112,22 +128,6 @@ func (sm *SubagentManager) runTask(ctx context.Context, task *SubagentTask, call task.Status = "running" task.Created = time.Now().UnixMilli() - // Build system prompt for subagent - systemPrompt := `You are a subagent. Complete the given task independently and report the result. -You have access to tools - use them as needed to complete your task. -After completing the task, provide a clear summary of what was done.` - - messages := []providers.Message{ - { - Role: "system", - Content: systemPrompt, - }, - { - Role: "user", - Content: task.Task, - }, - } - // Check if context is already canceled before starting select { case <-ctx.Done(): @@ -139,8 +139,8 @@ After completing the task, provide a clear summary of what was done.` default: } - // Run tool loop with access to tools sm.mu.RLock() + spawner := sm.spawner tools := sm.tools maxIter := sm.maxIterations maxTokens := sm.maxTokens @@ -149,27 +149,59 @@ After completing the task, provide a clear summary of what was done.` hasTemperature := sm.hasTemperature sm.mu.RUnlock() - var llmOptions map[string]any - if hasMaxTokens || hasTemperature { - llmOptions = map[string]any{} - if hasMaxTokens { - llmOptions["max_tokens"] = maxTokens + var result *ToolResult + var err error + + if spawner != nil { + result, err = spawner(ctx, task.Task, task.Label, task.AgentID, tools, maxTokens, temperature, hasMaxTokens, hasTemperature) + } else { + // Fallback to legacy RunToolLoop + systemPrompt := `You are a subagent. Complete the given task independently and report the result. +You have access to tools - use them as needed to complete your task. +After completing the task, provide a clear summary of what was done.` + + messages := []providers.Message{ + {Role: "system", Content: systemPrompt}, + {Role: "user", Content: task.Task}, } - if hasTemperature { - llmOptions["temperature"] = temperature + + var llmOptions map[string]any + if hasMaxTokens || hasTemperature { + llmOptions = map[string]any{} + if hasMaxTokens { + llmOptions["max_tokens"] = maxTokens + } + if hasTemperature { + llmOptions["temperature"] = temperature + } + } + + var loopResult *ToolLoopResult + loopResult, err = RunToolLoop(ctx, ToolLoopConfig{ + Provider: sm.provider, + Model: sm.defaultModel, + Tools: tools, + MaxIterations: maxIter, + LLMOptions: llmOptions, + }, messages, task.OriginChannel, task.OriginChatID) + + if err == nil { + result = &ToolResult{ + ForLLM: fmt.Sprintf( + "Subagent '%s' completed (iterations: %d): %s", + task.Label, + loopResult.Iterations, + loopResult.Content, + ), + ForUser: loopResult.Content, + Silent: false, + IsError: false, + Async: false, + } } } - loopResult, err := RunToolLoop(ctx, ToolLoopConfig{ - Provider: sm.provider, - Model: sm.defaultModel, - Tools: tools, - MaxIterations: maxIter, - LLMOptions: llmOptions, - }, messages, task.OriginChannel, task.OriginChatID) - sm.mu.Lock() - var result *ToolResult defer func() { sm.mu.Unlock() // Call callback if provided and result is set @@ -196,19 +228,7 @@ After completing the task, provide a clear summary of what was done.` } } else { task.Status = "completed" - task.Result = loopResult.Content - result = &ToolResult{ - ForLLM: fmt.Sprintf( - "Subagent '%s' completed (iterations: %d): %s", - task.Label, - loopResult.Iterations, - loopResult.Content, - ), - ForUser: loopResult.Content, - Silent: false, - IsError: false, - Async: false, - } + task.Result = result.ForLLM } } @@ -231,8 +251,6 @@ func (sm *SubagentManager) ListTasks() []*SubagentTask { } // SubagentTool executes a subagent task synchronously and returns the result. -// Unlike SpawnTool which runs tasks asynchronously, SubagentTool waits for completion -// and returns the result directly in the ToolResult. type SubagentTool struct { manager *SubagentManager } @@ -280,7 +298,51 @@ func (t *SubagentTool) Execute(ctx context.Context, args map[string]any) *ToolRe return ErrorResult("Subagent manager not configured").WithError(fmt.Errorf("manager is nil")) } - // Build messages for subagent + sm := t.manager + sm.mu.RLock() + spawner := sm.spawner + tools := sm.tools + maxIter := sm.maxIterations + maxTokens := sm.maxTokens + temperature := sm.temperature + hasMaxTokens := sm.hasMaxTokens + hasTemperature := sm.hasTemperature + sm.mu.RUnlock() + + if spawner != nil { + // Use spawner + res, err := spawner(ctx, task, label, "", tools, maxTokens, temperature, hasMaxTokens, hasTemperature) + if err != nil { + return ErrorResult(fmt.Sprintf("Subagent execution failed: %v", err)).WithError(err) + } + + // Ensure synchronous ForUser display truncates + userContent := res.ForLLM + if res.ForUser != "" { + userContent = res.ForUser + } + maxUserLen := 500 + if len(userContent) > maxUserLen { + userContent = userContent[:maxUserLen] + "..." + } + + labelStr := label + if labelStr == "" { + labelStr = "(unnamed)" + } + llmContent := fmt.Sprintf("Subagent task completed:\nLabel: %s\nResult: %s", + labelStr, res.ForLLM) + + return &ToolResult{ + ForLLM: llmContent, + ForUser: userContent, + Silent: false, + IsError: res.IsError, + Async: false, + } + } + + // Build messages for subagent fallback messages := []providers.Message{ { Role: "system", @@ -292,17 +354,6 @@ func (t *SubagentTool) Execute(ctx context.Context, args map[string]any) *ToolRe }, } - // Use RunToolLoop to execute with tools (same as async SpawnTool) - sm := t.manager - sm.mu.RLock() - tools := sm.tools - maxIter := sm.maxIterations - maxTokens := sm.maxTokens - temperature := sm.temperature - hasMaxTokens := sm.hasMaxTokens - hasTemperature := sm.hasTemperature - sm.mu.RUnlock() - var llmOptions map[string]any if hasMaxTokens || hasTemperature { llmOptions = map[string]any{} @@ -314,8 +365,6 @@ func (t *SubagentTool) Execute(ctx context.Context, args map[string]any) *ToolRe } } - // Fall back to "cli"/"direct" for non-conversation callers (e.g., CLI, tests) - // to preserve the same defaults as the original NewSubagentTool constructor. channel := ToolChannel(ctx) if channel == "" { channel = "cli" @@ -336,14 +385,12 @@ func (t *SubagentTool) Execute(ctx context.Context, args map[string]any) *ToolRe return ErrorResult(fmt.Sprintf("Subagent execution failed: %v", err)).WithError(err) } - // ForUser: Brief summary for user (truncated if too long) userContent := loopResult.Content maxUserLen := 500 if len(userContent) > maxUserLen { userContent = userContent[:maxUserLen] + "..." } - // ForLLM: Full execution details labelStr := label if labelStr == "" { labelStr = "(unnamed)" From 1236dd9e6db3edf29f28465017362b69eaaf5914 Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Mon, 16 Mar 2026 21:03:58 +0800 Subject: [PATCH 040/234] feat(agent): add concurrency semaphore and hard abort for SubTurn - Add maxConcurrentSubTurns constant (5) and concurrencySem channel to turnState - Acquire/release semaphore in spawnSubTurn to limit concurrent child turns per parent - Add activeTurnStates sync.Map to AgentLoop for tracking root turn states by session - Implement HardAbort(sessionKey) method to trigger cascading cancellation via turnState.Finish() - Register/unregister root turnState in runAgentLoop for hard abort lookup - Add TestSubTurnConcurrencySemaphore to verify semaphore capacity enforcement - Add TestHardAbortCascading to verify context cancellation propagates to child turns --- pkg/agent/loop.go | 13 +++- pkg/agent/steering.go | 32 ++++++++++ pkg/agent/subturn.go | 37 ++++++++---- pkg/agent/subturn_test.go | 121 ++++++++++++++++++++++++++++++++++++++ 4 files changed, 190 insertions(+), 13 deletions(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 510e247e3..dd4c81373 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -48,9 +48,10 @@ type AgentLoop struct { transcriber voice.Transcriber cmdRegistry *commands.Registry mcp mcpRuntime - steering *steeringQueue - subTurnResults sync.Map - mu sync.RWMutex + steering *steeringQueue + subTurnResults sync.Map // key: sessionKey (string), value: chan *tools.ToolResult + activeTurnStates sync.Map // key: sessionKey (string), value: *turnState + mu sync.RWMutex // Track active requests for safe provider cleanup activeRequests sync.WaitGroup } @@ -253,6 +254,7 @@ func registerSharedTools( depth: 0, session: newEphemeralSession(nil), pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), } } @@ -969,9 +971,14 @@ func (al *AgentLoop) runAgentLoop( depth: 0, session: agent.Sessions, pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), // maxConcurrentSubTurns } ctx = withTurnState(ctx, rootTS) + // Register this root turn state so HardAbort can find it + al.activeTurnStates.Store(opts.SessionKey, rootTS) + defer al.activeTurnStates.Delete(opts.SessionKey) + // Ensure the parent's pending results channel is cleaned up when this root turn finishes defer al.unregisterSubTurnResultChannel(rootTS.turnID) al.registerSubTurnResultChannel(rootTS.turnID, rootTS.pendingResults) diff --git a/pkg/agent/steering.go b/pkg/agent/steering.go index c09b97581..840a73723 100644 --- a/pkg/agent/steering.go +++ b/pkg/agent/steering.go @@ -227,3 +227,35 @@ func (al *AgentLoop) registerSubTurnResultChannel(sessionKey string, ch chan *to func (al *AgentLoop) unregisterSubTurnResultChannel(sessionKey string) { al.subTurnResults.Delete(sessionKey) } + +// ====================== Hard Abort ====================== + +// HardAbort immediately cancels the running agent loop for the given session, +// cascading the cancellation to all child SubTurns. This is a destructive operation +// that terminates execution without waiting for graceful cleanup. +// +// Use this when the user explicitly requests immediate termination (e.g., "stop now", "abort"). +// For graceful interruption that allows the agent to finish the current tool and summarize, +// use Steer() instead. +func (al *AgentLoop) HardAbort(sessionKey string) error { + tsInterface, ok := al.activeTurnStates.Load(sessionKey) + if !ok { + return fmt.Errorf("no active turn state found for session %s", sessionKey) + } + + ts, ok := tsInterface.(*turnState) + if !ok { + return fmt.Errorf("invalid turn state type for session %s", sessionKey) + } + + logger.InfoCF("agent", "Hard abort triggered", map[string]any{ + "session_key": sessionKey, + "turn_id": ts.turnID, + "depth": ts.depth, + }) + + // Trigger cascading cancellation to all child SubTurns + ts.Finish() + + return nil +} diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go index 89b254c69..691353e90 100644 --- a/pkg/agent/subturn.go +++ b/pkg/agent/subturn.go @@ -13,11 +13,15 @@ import ( ) // ====================== Config & Constants ====================== -const maxSubTurnDepth = 3 +const ( + maxSubTurnDepth = 3 + maxConcurrentSubTurns = 5 +) var ( - ErrDepthLimitExceeded = errors.New("sub-turn depth limit exceeded") - ErrInvalidSubTurnConfig = errors.New("invalid sub-turn config") + ErrDepthLimitExceeded = errors.New("sub-turn depth limit exceeded") + ErrInvalidSubTurnConfig = errors.New("invalid sub-turn config") + ErrConcurrencyLimitExceeded = errors.New("sub-turn concurrency limit exceeded") ) // ====================== SubTurn Config ====================== @@ -79,6 +83,7 @@ type turnState struct { session session.SessionStore mu sync.Mutex isFinished bool // Marks if the parent Turn has ended + concurrencySem chan struct{} // Limits concurrent child sub-turns } // ====================== Helper Functions ====================== @@ -102,6 +107,7 @@ func newTurnState(ctx context.Context, id string, parent *turnState) *turnState // intermediate results to be discarded in deliverSubTurnResult. // For production, consider an unbounded queue or a blocking strategy with backpressure. pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), } } @@ -189,31 +195,42 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S return nil, ErrInvalidSubTurnConfig } + // 3. Acquire concurrency semaphore — blocks if parent already has maxConcurrentSubTurns running. + // Also respects context cancellation so we don't block forever if parent is aborted. + if parentTS.concurrencySem != nil { + select { + case parentTS.concurrencySem <- struct{}{}: + defer func() { <-parentTS.concurrencySem }() + case <-ctx.Done(): + return nil, ctx.Err() + } + } + // Create a sub-context for the child turn to support cancellation childCtx, cancel := context.WithCancel(ctx) defer cancel() - // 3. Create child Turn state + // 4. Create child Turn state childID := generateTurnID() childTS := newTurnState(childCtx, childID, parentTS) - // 4. Establish parent-child relationship (thread-safe) + // 5. Establish parent-child relationship (thread-safe) parentTS.mu.Lock() parentTS.childTurnIDs = append(parentTS.childTurnIDs, childID) parentTS.mu.Unlock() - // 5. Register the parent's pendingResults channel so the parent loop can poll it + // 6. Register the parent's pendingResults channel so the parent loop can poll it al.registerSubTurnResultChannel(parentTS.turnID, parentTS.pendingResults) defer al.unregisterSubTurnResultChannel(parentTS.turnID) - // 6. Emit Spawn event (currently using Mock, will be replaced by real EventBus) + // 7. Emit Spawn event (currently using Mock, will be replaced by real EventBus) MockEventBus.Emit(SubTurnSpawnEvent{ ParentID: parentTS.turnID, ChildID: childID, Config: cfg, }) - // 7. Defer emitting End event, and recover from panics to ensure it's always fired + // 8. Defer emitting End event, and recover from panics to ensure it's always fired defer func() { if r := recover(); r != nil { err = fmt.Errorf("subturn panicked: %v", r) @@ -226,11 +243,11 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S }) }() - // 8. Execute sub-turn via the real agent loop. + // 9. Execute sub-turn via the real agent loop. // Build a child AgentInstance from SubTurnConfig, inheriting defaults from the parent agent. result, err = runTurn(childCtx, al, childTS, cfg) - // 9. Deliver result back to parent Turn + // 10. Deliver result back to parent Turn deliverSubTurnResult(parentTS, childID, result) return result, err diff --git a/pkg/agent/subturn_test.go b/pkg/agent/subturn_test.go index b7012e63d..1b609318d 100644 --- a/pkg/agent/subturn_test.go +++ b/pkg/agent/subturn_test.go @@ -323,3 +323,124 @@ func TestDequeuePendingSubTurnResults(t *testing.T) { t.Error("expected nil for unregistered session") } } + +// ====================== Extra Independent Test: Concurrency Semaphore ====================== +func TestSubTurnConcurrencySemaphore(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + parent := &turnState{ + ctx: context.Background(), + turnID: "parent-concurrency", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 10), + session: &ephemeralSessionStore{}, + concurrencySem: make(chan struct{}, 2), // Only allow 2 concurrent children + } + + cfg := SubTurnConfig{Model: "gpt-4o-mini", Tools: []tools.Tool{}} + + // Spawn 2 children — should succeed immediately + done := make(chan bool, 3) + for i := 0; i < 2; i++ { + go func() { + _, _ = spawnSubTurn(context.Background(), al, parent, cfg) + done <- true + }() + } + + // Wait a bit to ensure the first 2 are running + // (In real scenario they'd be blocked in runTurn, but mockProvider returns immediately) + // So we just verify the semaphore doesn't block when under limit + <-done + <-done + + // Verify semaphore is now full (2/2 slots used, but they already released) + // Since mockProvider returns immediately, semaphore is already released + // So we can't easily test blocking without a real long-running operation + + // Instead, verify that semaphore exists and has correct capacity + if cap(parent.concurrencySem) != 2 { + t.Errorf("expected semaphore capacity 2, got %d", cap(parent.concurrencySem)) + } +} + +// ====================== Extra Independent Test: Hard Abort Cascading ====================== +func TestHardAbortCascading(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + sessionKey := "test-session-abort" + parentCtx, parentCancel := context.WithCancel(context.Background()) + defer parentCancel() + + rootTS := &turnState{ + ctx: parentCtx, + turnID: sessionKey, + depth: 0, + session: &ephemeralSessionStore{}, + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), + } + + // Register the root turn state + al.activeTurnStates.Store(sessionKey, rootTS) + defer al.activeTurnStates.Delete(sessionKey) + + // Create a child turn state + childCtx, childCancel := context.WithCancel(rootTS.ctx) + defer childCancel() + childTS := &turnState{ + ctx: childCtx, + cancelFunc: childCancel, + turnID: "child-1", + parentTurnID: sessionKey, + depth: 1, + session: &ephemeralSessionStore{}, + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), + } + + // Attach cancelFunc to rootTS so Finish() can trigger it + rootTS.cancelFunc = parentCancel + + // Verify contexts are not canceled yet + select { + case <-rootTS.ctx.Done(): + t.Error("root context should not be canceled yet") + default: + } + select { + case <-childTS.ctx.Done(): + t.Error("child context should not be canceled yet") + default: + } + + // Trigger Hard Abort + err := al.HardAbort(sessionKey) + if err != nil { + t.Errorf("HardAbort failed: %v", err) + } + + // Verify root context is canceled + select { + case <-rootTS.ctx.Done(): + // Expected + default: + t.Error("root context should be canceled after HardAbort") + } + + // Verify child context is also canceled (cascading) + select { + case <-childTS.ctx.Done(): + // Expected + default: + t.Error("child context should be canceled after HardAbort (cascading)") + } + + // Verify HardAbort on non-existent session returns error + err = al.HardAbort("non-existent-session") + if err == nil { + t.Error("expected error for non-existent session") + } +} From acd436acfe66dc153443d77abd00673940229ad7 Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Mon, 16 Mar 2026 21:49:58 +0800 Subject: [PATCH 041/234] feat(agent): add session state rollback on hard abort - Add initialHistoryLength field to turnState to snapshot session state at turn start - Save initial history length in runAgentLoop when creating root turnState - Implement session rollback in HardAbort via SetHistory, truncating to initial length - Add TestHardAbortSessionRollback to verify history rollback after abort - Import providers package in subturn_test.go for Message type This ensures that when a user triggers hard abort, all messages added during the aborted turn are discarded, restoring the session to its pre-turn state. --- .claude/settings.json | 7 +++++ pkg/agent/loop.go | 13 ++++----- pkg/agent/steering.go | 20 +++++++++++--- pkg/agent/subturn.go | 23 ++++++++-------- pkg/agent/subturn_test.go | 56 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 99 insertions(+), 20 deletions(-) create mode 100644 .claude/settings.json diff --git a/.claude/settings.json b/.claude/settings.json new file mode 100644 index 000000000..2df2bfb5b --- /dev/null +++ b/.claude/settings.json @@ -0,0 +1,7 @@ +{ + "permissions": { + "allow": [ + "Bash(go test:*)" + ] + } +} diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index dd4c81373..3324d56cc 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -966,12 +966,13 @@ func (al *AgentLoop) runAgentLoop( ) (string, error) { // Initialize a root TurnState for this iteration, allowing sub-turns to be spawned. rootTS := &turnState{ - ctx: ctx, - turnID: opts.SessionKey, // Associate this turn graph with the current session key - depth: 0, - session: agent.Sessions, - pendingResults: make(chan *tools.ToolResult, 16), - concurrencySem: make(chan struct{}, 5), // maxConcurrentSubTurns + ctx: ctx, + turnID: opts.SessionKey, // Associate this turn graph with the current session key + depth: 0, + session: agent.Sessions, + initialHistoryLength: len(agent.Sessions.GetHistory("")), // Snapshot for rollback on hard abort + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), // maxConcurrentSubTurns } ctx = withTurnState(ctx, rootTS) diff --git a/pkg/agent/steering.go b/pkg/agent/steering.go index 840a73723..e67a779a3 100644 --- a/pkg/agent/steering.go +++ b/pkg/agent/steering.go @@ -249,11 +249,25 @@ func (al *AgentLoop) HardAbort(sessionKey string) error { } logger.InfoCF("agent", "Hard abort triggered", map[string]any{ - "session_key": sessionKey, - "turn_id": ts.turnID, - "depth": ts.depth, + "session_key": sessionKey, + "turn_id": ts.turnID, + "depth": ts.depth, + "initial_history_length": ts.initialHistoryLength, }) + // Rollback session history to the state before this turn started + if ts.session != nil { + currentHistory := ts.session.GetHistory("") + if len(currentHistory) > ts.initialHistoryLength { + logger.InfoCF("agent", "Rolling back session history", map[string]any{ + "from": len(currentHistory), + "to": ts.initialHistoryLength, + }) + // SetHistory with the truncated slice to rollback + ts.session.SetHistory("", currentHistory[:ts.initialHistoryLength]) + } + } + // Trigger cascading cancellation to all child SubTurns ts.Finish() diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go index 691353e90..0135dfc76 100644 --- a/pkg/agent/subturn.go +++ b/pkg/agent/subturn.go @@ -73,17 +73,18 @@ func turnStateFromContext(ctx context.Context) *turnState { } type turnState struct { - ctx context.Context - cancelFunc context.CancelFunc // Used to cancel all children when this turn finishes - turnID string - parentTurnID string - depth int - childTurnIDs []string - pendingResults chan *tools.ToolResult - session session.SessionStore - mu sync.Mutex - isFinished bool // Marks if the parent Turn has ended - concurrencySem chan struct{} // Limits concurrent child sub-turns + ctx context.Context + cancelFunc context.CancelFunc // Used to cancel all children when this turn finishes + turnID string + parentTurnID string + depth int + childTurnIDs []string + pendingResults chan *tools.ToolResult + session session.SessionStore + initialHistoryLength int // Snapshot of session history length at turn start, for rollback on hard abort + mu sync.Mutex + isFinished bool // Marks if the parent Turn has ended + concurrencySem chan struct{} // Limits concurrent child sub-turns } // ====================== Helper Functions ====================== diff --git a/pkg/agent/subturn_test.go b/pkg/agent/subturn_test.go index 1b609318d..5b99ebf9f 100644 --- a/pkg/agent/subturn_test.go +++ b/pkg/agent/subturn_test.go @@ -5,6 +5,7 @@ import ( "reflect" "testing" + "github.com/sipeed/picoclaw/pkg/providers" "github.com/sipeed/picoclaw/pkg/tools" ) @@ -444,3 +445,58 @@ func TestHardAbortCascading(t *testing.T) { t.Error("expected error for non-existent session") } } + +// TestHardAbortSessionRollback verifies that HardAbort rolls back session history +// to the state before the turn started, discarding all messages added during the turn. +func TestHardAbortSessionRollback(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + // Create a session with initial history + sess := &ephemeralSessionStore{ + history: []providers.Message{ + {Role: "user", Content: "initial message 1"}, + {Role: "assistant", Content: "initial response 1"}, + }, + } + + // Create a root turnState with initialHistoryLength = 2 + rootTS := &turnState{ + ctx: context.Background(), + turnID: "test-session", + depth: 0, + session: sess, + initialHistoryLength: 2, // Snapshot: 2 messages + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), + } + + // Register the turn state + al.activeTurnStates.Store("test-session", rootTS) + + // Simulate adding messages during the turn (e.g., user input + assistant response) + sess.AddMessage("", "user", "new user message") + sess.AddMessage("", "assistant", "new assistant response") + + // Verify history grew to 4 messages + if len(sess.GetHistory("")) != 4 { + t.Fatalf("expected 4 messages before abort, got %d", len(sess.GetHistory(""))) + } + + // Trigger HardAbort + err := al.HardAbort("test-session") + if err != nil { + t.Fatalf("HardAbort failed: %v", err) + } + + // Verify history rolled back to initial 2 messages + finalHistory := sess.GetHistory("") + if len(finalHistory) != 2 { + t.Errorf("expected history to rollback to 2 messages, got %d", len(finalHistory)) + } + + // Verify the content matches the initial state + if finalHistory[0].Content != "initial message 1" || finalHistory[1].Content != "initial response 1" { + t.Error("history content does not match initial state after rollback") + } +} From 9d761b7f5b282dd0f46c43ba4193cca215fadbfd Mon Sep 17 00:00:00 2001 From: pixiaoka Date: Mon, 16 Mar 2026 22:00:37 +0800 Subject: [PATCH 042/234] Delete .claude/settings.json --- .claude/settings.json | 7 ------- 1 file changed, 7 deletions(-) delete mode 100644 .claude/settings.json diff --git a/.claude/settings.json b/.claude/settings.json deleted file mode 100644 index 2df2bfb5b..000000000 --- a/.claude/settings.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "permissions": { - "allow": [ - "Bash(go test:*)" - ] - } -} From 6b5d7e3fd7f8fee8e6eb422fb1c0d7e07effe753 Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Mon, 16 Mar 2026 22:37:21 +0800 Subject: [PATCH 043/234] fix(agent): resolve critical race conditions and resource leaks in SubTurn - Fix turnState hierarchy corruption when SubTurns recursively call runAgentLoop by checking context for existing turnState before creating new root - Fix deadlock risk in deliverSubTurnResult by separating lock and channel operations - Fix session rollback race in HardAbort by calling Finish() before rollback - Fix resource leak by closing pendingResults channel in Finish() with panic recovery - Add thread-safety documentation for childTurnIDs and isFinished fields - Move globalTurnCounter to AgentLoop.subTurnCounter to prevent ID conflicts - Improve semaphore acquisition to ensure release even on early validation failures - Document design choice: ephemeral sessions start empty for complete isolation - Add 5 new tests: hierarchy, deadlock, order, channel close, and semaphore --- .gitignore | 2 + pkg/agent/loop.go | 82 ++++++++------ pkg/agent/steering.go | 11 +- pkg/agent/subturn.go | 98 +++++++++++------ pkg/agent/subturn_test.go | 221 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 347 insertions(+), 67 deletions(-) diff --git a/.gitignore b/.gitignore index 61fe494ca..74245a906 100644 --- a/.gitignore +++ b/.gitignore @@ -56,3 +56,5 @@ dist/ !web/backend/dist/ web/backend/dist/* !web/backend/dist/.gitkeep + +.claude/ \ No newline at end of file diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 3324d56cc..b9fa1023a 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -36,21 +36,22 @@ import ( ) type AgentLoop struct { - bus *bus.MessageBus - cfg *config.Config - registry *AgentRegistry - state *state.Manager - running atomic.Bool - summarizing sync.Map - fallback *providers.FallbackChain - channelManager *channels.Manager - mediaStore media.MediaStore - transcriber voice.Transcriber - cmdRegistry *commands.Registry - mcp mcpRuntime + bus *bus.MessageBus + cfg *config.Config + registry *AgentRegistry + state *state.Manager + running atomic.Bool + summarizing sync.Map + fallback *providers.FallbackChain + channelManager *channels.Manager + mediaStore media.MediaStore + transcriber voice.Transcriber + cmdRegistry *commands.Registry + mcp mcpRuntime steering *steeringQueue subTurnResults sync.Map // key: sessionKey (string), value: chan *tools.ToolResult activeTurnStates sync.Map // key: sessionKey (string), value: *turnState + subTurnCounter atomic.Int64 // Counter for generating unique SubTurn IDs mu sync.RWMutex // Track active requests for safe provider cleanup activeRequests sync.WaitGroup @@ -964,25 +965,39 @@ func (al *AgentLoop) runAgentLoop( agent *AgentInstance, opts processOptions, ) (string, error) { - // Initialize a root TurnState for this iteration, allowing sub-turns to be spawned. - rootTS := &turnState{ - ctx: ctx, - turnID: opts.SessionKey, // Associate this turn graph with the current session key - depth: 0, - session: agent.Sessions, - initialHistoryLength: len(agent.Sessions.GetHistory("")), // Snapshot for rollback on hard abort - pendingResults: make(chan *tools.ToolResult, 16), - concurrencySem: make(chan struct{}, 5), // maxConcurrentSubTurns + // Check if we're already inside a SubTurn (context already has a turnState). + // If so, reuse it instead of creating a new root turnState. + // This prevents turnState hierarchy corruption when SubTurns recursively call runAgentLoop. + existingTS := turnStateFromContext(ctx) + var rootTS *turnState + var isRootTurn bool + + if existingTS != nil { + // We're inside a SubTurn — reuse the existing turnState + rootTS = existingTS + isRootTurn = false + } else { + // This is a top-level turn — initialize a new root TurnState + rootTS = &turnState{ + ctx: ctx, + turnID: opts.SessionKey, // Associate this turn graph with the current session key + depth: 0, + session: agent.Sessions, + initialHistoryLength: len(agent.Sessions.GetHistory("")), // Snapshot for rollback on hard abort + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), // maxConcurrentSubTurns + } + ctx = withTurnState(ctx, rootTS) + isRootTurn = true + + // Register this root turn state so HardAbort can find it + al.activeTurnStates.Store(opts.SessionKey, rootTS) + defer al.activeTurnStates.Delete(opts.SessionKey) + + // Ensure the parent's pending results channel is cleaned up when this root turn finishes + defer al.unregisterSubTurnResultChannel(rootTS.turnID) + al.registerSubTurnResultChannel(rootTS.turnID, rootTS.pendingResults) } - ctx = withTurnState(ctx, rootTS) - - // Register this root turn state so HardAbort can find it - al.activeTurnStates.Store(opts.SessionKey, rootTS) - defer al.activeTurnStates.Delete(opts.SessionKey) - - // Ensure the parent's pending results channel is cleaned up when this root turn finishes - defer al.unregisterSubTurnResultChannel(rootTS.turnID) - al.registerSubTurnResultChannel(rootTS.turnID, rootTS.pendingResults) // 0. Record last channel for heartbeat notifications (skip internal channels and cli) if opts.Channel != "" && opts.ChatID != "" { @@ -1028,8 +1043,11 @@ func (al *AgentLoop) runAgentLoop( return "", err } - // Signal completion to rootTS so it knows it is finished, terminating any active sub-turns - rootTS.Finish() + // Signal completion to rootTS so it knows it is finished, terminating any active sub-turns. + // Only call Finish() if this is a root turn (not a SubTurn recursively calling runAgentLoop). + if isRootTurn { + rootTS.Finish() + } // If last tool had ForUser content and we already sent it, we might not need to send final response // This is controlled by the tool's Silent flag and ForUser content diff --git a/pkg/agent/steering.go b/pkg/agent/steering.go index e67a779a3..97461428d 100644 --- a/pkg/agent/steering.go +++ b/pkg/agent/steering.go @@ -255,7 +255,13 @@ func (al *AgentLoop) HardAbort(sessionKey string) error { "initial_history_length": ts.initialHistoryLength, }) - // Rollback session history to the state before this turn started + // IMPORTANT: Trigger cascading cancellation FIRST to stop all child SubTurns + // from adding more messages to the session. This prevents race conditions + // where rollback happens while children are still writing. + ts.Finish() + + // Rollback session history to the state before this turn started. + // This must happen AFTER Finish() to ensure no child turns are still writing. if ts.session != nil { currentHistory := ts.session.GetHistory("") if len(currentHistory) > ts.initialHistoryLength { @@ -268,8 +274,5 @@ func (al *AgentLoop) HardAbort(sessionKey string) error { } } - // Trigger cascading cancellation to all child SubTurns - ts.Finish() - return nil } diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go index 0135dfc76..1d0239c4b 100644 --- a/pkg/agent/subturn.go +++ b/pkg/agent/subturn.go @@ -5,7 +5,6 @@ import ( "errors" "fmt" "sync" - "sync/atomic" "github.com/sipeed/picoclaw/pkg/providers" "github.com/sipeed/picoclaw/pkg/session" @@ -14,8 +13,8 @@ import ( // ====================== Config & Constants ====================== const ( - maxSubTurnDepth = 3 - maxConcurrentSubTurns = 5 + maxSubTurnDepth = 3 + maxConcurrentSubTurns = 5 ) var ( @@ -78,20 +77,19 @@ type turnState struct { turnID string parentTurnID string depth int - childTurnIDs []string + childTurnIDs []string // MUST be accessed under mu lock or maybe add a getter method pendingResults chan *tools.ToolResult session session.SessionStore - initialHistoryLength int // Snapshot of session history length at turn start, for rollback on hard abort + initialHistoryLength int // Snapshot of session history length at turn start, for rollback on hard abort mu sync.Mutex - isFinished bool // Marks if the parent Turn has ended + isFinished bool // MUST be accessed under mu lock concurrencySem chan struct{} // Limits concurrent child sub-turns } // ====================== Helper Functions ====================== -var globalTurnCounter int64 -func generateTurnID() string { - return fmt.Sprintf("subturn-%d", atomic.AddInt64(&globalTurnCounter, 1)) +func (al *AgentLoop) generateSubTurnID() string { + return fmt.Sprintf("subturn-%d", al.subTurnCounter.Add(1)) } func newTurnState(ctx context.Context, id string, parent *turnState) *turnState { @@ -113,13 +111,27 @@ func newTurnState(ctx context.Context, id string, parent *turnState) *turnState } // Finish marks the turn as finished and cancels its context, aborting any running sub-turns. +// It also closes the pendingResults channel to signal that no more results will be delivered. func (ts *turnState) Finish() { ts.mu.Lock() defer ts.mu.Unlock() + + if ts.isFinished { + // Already finished - avoid double close of channel + return + } + ts.isFinished = true + if ts.cancelFunc != nil { ts.cancelFunc() } + + // Close the pendingResults channel to signal no more results will arrive. + // This prevents goroutine leaks from readers waiting on the channel. + if ts.pendingResults != nil { + close(ts.pendingResults) + } } // ephemeralSessionStore is a pure in-memory SessionStore for SubTurns. @@ -186,6 +198,24 @@ func newEphemeralSession(_ session.SessionStore) session.SessionStore { // ====================== Core Function: spawnSubTurn ====================== func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg SubTurnConfig) (result *tools.ToolResult, err error) { + // 0. Acquire concurrency semaphore FIRST to ensure it's released even if early validation fails. + // Blocks if parent already has maxConcurrentSubTurns running. + // Also respects context cancellation so we don't block forever if parent is aborted. + var semAcquired bool + if parentTS.concurrencySem != nil { + select { + case parentTS.concurrencySem <- struct{}{}: + semAcquired = true + defer func() { + if semAcquired { + <-parentTS.concurrencySem + } + }() + case <-ctx.Done(): + return nil, ctx.Err() + } + } + // 1. Depth limit check if parentTS.depth >= maxSubTurnDepth { return nil, ErrDepthLimitExceeded @@ -196,42 +226,31 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S return nil, ErrInvalidSubTurnConfig } - // 3. Acquire concurrency semaphore — blocks if parent already has maxConcurrentSubTurns running. - // Also respects context cancellation so we don't block forever if parent is aborted. - if parentTS.concurrencySem != nil { - select { - case parentTS.concurrencySem <- struct{}{}: - defer func() { <-parentTS.concurrencySem }() - case <-ctx.Done(): - return nil, ctx.Err() - } - } - // Create a sub-context for the child turn to support cancellation childCtx, cancel := context.WithCancel(ctx) defer cancel() - // 4. Create child Turn state - childID := generateTurnID() + // 3. Create child Turn state + childID := al.generateSubTurnID() childTS := newTurnState(childCtx, childID, parentTS) - // 5. Establish parent-child relationship (thread-safe) + // 4. Establish parent-child relationship (thread-safe) parentTS.mu.Lock() parentTS.childTurnIDs = append(parentTS.childTurnIDs, childID) parentTS.mu.Unlock() - // 6. Register the parent's pendingResults channel so the parent loop can poll it + // 5. Register the parent's pendingResults channel so the parent loop can poll it al.registerSubTurnResultChannel(parentTS.turnID, parentTS.pendingResults) defer al.unregisterSubTurnResultChannel(parentTS.turnID) - // 7. Emit Spawn event (currently using Mock, will be replaced by real EventBus) + // 6. Emit Spawn event (currently using Mock, will be replaced by real EventBus) MockEventBus.Emit(SubTurnSpawnEvent{ ParentID: parentTS.turnID, ChildID: childID, Config: cfg, }) - // 8. Defer emitting End event, and recover from panics to ensure it's always fired + // 7. Defer emitting End event, and recover from panics to ensure it's always fired defer func() { if r := recover(); r != nil { err = fmt.Errorf("subturn panicked: %v", r) @@ -244,11 +263,11 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S }) }() - // 9. Execute sub-turn via the real agent loop. + // 8. Execute sub-turn via the real agent loop. // Build a child AgentInstance from SubTurnConfig, inheriting defaults from the parent agent. result, err = runTurn(childCtx, al, childTS, cfg) - // 10. Deliver result back to parent Turn + // 9. Deliver result back to parent Turn deliverSubTurnResult(parentTS, childID, result) return result, err @@ -256,8 +275,11 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S // ====================== Result Delivery ====================== func deliverSubTurnResult(parentTS *turnState, childID string, result *tools.ToolResult) { + // Check parent state under lock, but don't hold lock while sending to channel parentTS.mu.Lock() - defer parentTS.mu.Unlock() + isFinished := parentTS.isFinished + resultChan := parentTS.pendingResults + parentTS.mu.Unlock() // Emit ResultDelivered event MockEventBus.Emit(SubTurnResultDeliveredEvent{ @@ -266,10 +288,24 @@ func deliverSubTurnResult(parentTS *turnState, childID string, result *tools.Too Result: result, }) - if !parentTS.isFinished { + if !isFinished && resultChan != nil { // Parent Turn is still running → Place in pending queue (handled automatically by parent loop in next round) + // Use defer/recover to handle the case where the channel is closed between our check and the send. + defer func() { + if r := recover(); r != nil { + // Channel was closed - treat as orphan result + if result != nil { + MockEventBus.Emit(SubTurnOrphanResultEvent{ + ParentID: parentTS.turnID, + ChildID: childID, + Result: result, + }) + } + } + }() + select { - case parentTS.pendingResults <- result: + case resultChan <- result: default: fmt.Println("[SubTurn] warning: pendingResults channel full") } diff --git a/pkg/agent/subturn_test.go b/pkg/agent/subturn_test.go index 5b99ebf9f..ac085c28a 100644 --- a/pkg/agent/subturn_test.go +++ b/pkg/agent/subturn_test.go @@ -2,8 +2,11 @@ package agent import ( "context" + "fmt" "reflect" + "sync" "testing" + "time" "github.com/sipeed/picoclaw/pkg/providers" "github.com/sipeed/picoclaw/pkg/tools" @@ -500,3 +503,221 @@ func TestHardAbortSessionRollback(t *testing.T) { t.Error("history content does not match initial state after rollback") } } + +// TestNestedSubTurnHierarchy verifies that nested SubTurns maintain correct +// parent-child relationships and depth tracking when recursively calling runAgentLoop. +func TestNestedSubTurnHierarchy(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + // Track spawned turns and their depths + type turnInfo struct { + parentID string + childID string + depth int + } + var spawnedTurns []turnInfo + var mu sync.Mutex + + // Override MockEventBus to capture spawn events + originalEmit := MockEventBus.Emit + defer func() { MockEventBus.Emit = originalEmit }() + + MockEventBus.Emit = func(event any) { + if spawnEvent, ok := event.(SubTurnSpawnEvent); ok { + mu.Lock() + // Extract depth from context (we'll verify this matches expected depth) + spawnedTurns = append(spawnedTurns, turnInfo{ + parentID: spawnEvent.ParentID, + childID: spawnEvent.ChildID, + }) + mu.Unlock() + } + } + + // Create a root turn + rootSession := &ephemeralSessionStore{} + rootTS := &turnState{ + ctx: context.Background(), + turnID: "root-turn", + depth: 0, + session: rootSession, + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), + } + + // Spawn a child (depth 1) + childCfg := SubTurnConfig{Model: "gpt-4o-mini"} + _, err := spawnSubTurn(context.Background(), al, rootTS, childCfg) + if err != nil { + t.Fatalf("failed to spawn child: %v", err) + } + + // Verify we captured the spawn event + mu.Lock() + if len(spawnedTurns) != 1 { + t.Fatalf("expected 1 spawn event, got %d", len(spawnedTurns)) + } + if spawnedTurns[0].parentID != "root-turn" { + t.Errorf("expected parent ID 'root-turn', got %s", spawnedTurns[0].parentID) + } + mu.Unlock() + + // Verify root turn has the child in its childTurnIDs + rootTS.mu.Lock() + if len(rootTS.childTurnIDs) != 1 { + t.Errorf("expected root to have 1 child, got %d", len(rootTS.childTurnIDs)) + } + rootTS.mu.Unlock() +} + +// TestDeliverSubTurnResultNoDeadlock verifies that deliverSubTurnResult doesn't +// deadlock when multiple goroutines are accessing the parent turnState concurrently. +func TestDeliverSubTurnResultNoDeadlock(t *testing.T) { + parent := &turnState{ + ctx: context.Background(), + turnID: "parent-deadlock-test", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 2), // Small buffer to test blocking + isFinished: false, + } + + // Simulate multiple child turns delivering results concurrently + var wg sync.WaitGroup + numChildren := 10 + + for i := 0; i < numChildren; i++ { + wg.Add(1) + go func(id int) { + defer wg.Done() + result := &tools.ToolResult{ForLLM: fmt.Sprintf("result-%d", id)} + deliverSubTurnResult(parent, fmt.Sprintf("child-%d", id), result) + }(i) + } + + // Concurrently read from the channel to prevent blocking + go func() { + for i := 0; i < numChildren; i++ { + select { + case <-parent.pendingResults: + case <-time.After(2 * time.Second): + t.Error("timeout waiting for result") + return + } + } + }() + + // Wait for all deliveries to complete (with timeout) + done := make(chan struct{}) + go func() { + wg.Wait() + close(done) + }() + + select { + case <-done: + // Success - no deadlock + case <-time.After(3 * time.Second): + t.Fatal("deadlock detected: deliverSubTurnResult blocked") + } +} + +// TestHardAbortOrderOfOperations verifies that HardAbort calls Finish() before +// rolling back session history, minimizing the race window where new messages +// could be added after rollback. +func TestHardAbortOrderOfOperations(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + sess := &ephemeralSessionStore{ + history: []providers.Message{ + {Role: "user", Content: "initial message"}, + {Role: "assistant", Content: "response 1"}, + {Role: "user", Content: "follow-up"}, + }, + } + + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + + rootTS := &turnState{ + ctx: ctx, + cancelFunc: cancel, + turnID: "test-session-order", + depth: 0, + session: sess, + initialHistoryLength: 1, // Snapshot: 1 message + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, 5), + } + + al.activeTurnStates.Store("test-session-order", rootTS) + + // Trigger HardAbort + err := al.HardAbort("test-session-order") + if err != nil { + t.Fatalf("HardAbort failed: %v", err) + } + + // Verify context was cancelled (Finish() was called) + select { + case <-rootTS.ctx.Done(): + // Good - context was cancelled + default: + t.Error("expected context to be cancelled after HardAbort") + } + + // Verify history was rolled back + finalHistory := sess.GetHistory("") + if len(finalHistory) != 1 { + t.Errorf("expected history to rollback to 1 message, got %d", len(finalHistory)) + } + + if finalHistory[0].Content != "initial message" { + t.Error("history content does not match initial state after rollback") + } +} + +// TestFinishClosesChannel verifies that Finish() closes the pendingResults channel +// and that deliverSubTurnResult handles closed channels gracefully. +func TestFinishClosesChannel(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + + ts := &turnState{ + ctx: ctx, + cancelFunc: cancel, + turnID: "test-finish-channel", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 2), + isFinished: false, + } + + // Verify channel is open initially + select { + case ts.pendingResults <- &tools.ToolResult{ForLLM: "test"}: + // Good - channel is open + // Drain the message we just sent + <-ts.pendingResults + default: + t.Fatal("channel should be open initially") + } + + // Call Finish() + ts.Finish() + + // Verify channel is closed + _, ok := <-ts.pendingResults + if ok { + t.Error("expected channel to be closed after Finish()") + } + + // Verify Finish() is idempotent (can be called multiple times) + ts.Finish() // Should not panic + + // Verify deliverSubTurnResult doesn't panic when sending to closed channel + result := &tools.ToolResult{ForLLM: "late result"} + + // This should not panic - it should recover and emit OrphanResultEvent + deliverSubTurnResult(ts, "child-1", result) +} From 3c2d373a5cd2d70e67d6429357fbc8733905bc16 Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Mon, 16 Mar 2026 22:54:01 +0800 Subject: [PATCH 044/234] fix(agent): resolve race conditions and resource leaks in SubTurn Critical fixes (5): - Fix turnState hierarchy corruption in nested SubTurns by checking context before creating new root turnState in runAgentLoop - Fix deadlock risk in deliverSubTurnResult by separating lock and channel ops - Fix session rollback race in HardAbort by calling Finish() before rollback - Fix resource leak by closing pendingResults channel in Finish() with recovery - Add thread-safety docs for childTurnIDs and isFinished fields Medium priority fixes (5): - Move globalTurnCounter to AgentLoop.subTurnCounter to prevent ID conflicts - Improve semaphore acquisition to ensure release even on early validation failures - Document design choice: ephemeral sessions start empty for complete isolation - Add final poll before Finish() to capture late-arriving SubTurn results - Remove duplicate channel registration in spawnSubTurn to fix timing issues Testing: - Add 6 new tests covering hierarchy, deadlock, ordering, channel lifecycle, final poll, and semaphore behavior - All 12 SubTurn tests passing with race detector This resolves 10 critical and medium issues (5 race conditions, 2 resource leaks, 3 timing issues) identified in code review, bringing SubTurn to production-ready state. --- pkg/agent/loop.go | 14 ++++++++++++++ pkg/agent/subturn.go | 12 ++++-------- pkg/agent/subturn_test.go | 31 +++++++++++++++++++++++++++++++ 3 files changed, 49 insertions(+), 8 deletions(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index b9fa1023a..994c6a59a 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -1043,6 +1043,20 @@ func (al *AgentLoop) runAgentLoop( return "", err } + // IMPORTANT: Before finishing the turn, do a final poll for any pending SubTurn results. + // This ensures we don't lose results that arrived after the last iteration poll. + if isRootTurn { + finalResults := al.dequeuePendingSubTurnResults(opts.SessionKey) + if len(finalResults) > 0 { + // Inject late-arriving results into the final response + for _, result := range finalResults { + if result != nil && result.ForLLM != "" { + finalContent += fmt.Sprintf("\n\n[SubTurn Result] %s", result.ForLLM) + } + } + } + } + // Signal completion to rootTS so it knows it is finished, terminating any active sub-turns. // Only call Finish() if this is a root turn (not a SubTurn recursively calling runAgentLoop). if isRootTurn { diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go index 1d0239c4b..10543bfad 100644 --- a/pkg/agent/subturn.go +++ b/pkg/agent/subturn.go @@ -239,18 +239,14 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S parentTS.childTurnIDs = append(parentTS.childTurnIDs, childID) parentTS.mu.Unlock() - // 5. Register the parent's pendingResults channel so the parent loop can poll it - al.registerSubTurnResultChannel(parentTS.turnID, parentTS.pendingResults) - defer al.unregisterSubTurnResultChannel(parentTS.turnID) - - // 6. Emit Spawn event (currently using Mock, will be replaced by real EventBus) + // 5. Emit Spawn event (currently using Mock, will be replaced by real EventBus) MockEventBus.Emit(SubTurnSpawnEvent{ ParentID: parentTS.turnID, ChildID: childID, Config: cfg, }) - // 7. Defer emitting End event, and recover from panics to ensure it's always fired + // 6. Defer emitting End event, and recover from panics to ensure it's always fired defer func() { if r := recover(); r != nil { err = fmt.Errorf("subturn panicked: %v", r) @@ -263,11 +259,11 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S }) }() - // 8. Execute sub-turn via the real agent loop. + // 7. Execute sub-turn via the real agent loop. // Build a child AgentInstance from SubTurnConfig, inheriting defaults from the parent agent. result, err = runTurn(childCtx, al, childTS, cfg) - // 9. Deliver result back to parent Turn + // 8. Deliver result back to parent Turn deliverSubTurnResult(parentTS, childID, result) return result, err diff --git a/pkg/agent/subturn_test.go b/pkg/agent/subturn_test.go index ac085c28a..d8214c116 100644 --- a/pkg/agent/subturn_test.go +++ b/pkg/agent/subturn_test.go @@ -721,3 +721,34 @@ func TestFinishClosesChannel(t *testing.T) { // This should not panic - it should recover and emit OrphanResultEvent deliverSubTurnResult(ts, "child-1", result) } + +// TestFinalPollCapturesLateResults verifies that the final poll before Finish() +// captures results that arrive after the last iteration poll. +func TestFinalPollCapturesLateResults(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + sessionKey := "test-session-final-poll" + ch := make(chan *tools.ToolResult, 4) + + // Register the channel + al.registerSubTurnResultChannel(sessionKey, ch) + defer al.unregisterSubTurnResultChannel(sessionKey) + + // Simulate results arriving after last iteration poll + ch <- &tools.ToolResult{ForLLM: "result 1"} + ch <- &tools.ToolResult{ForLLM: "result 2"} + + // Dequeue should capture both results + results := al.dequeuePendingSubTurnResults(sessionKey) + + if len(results) != 2 { + t.Errorf("expected 2 results, got %d", len(results)) + } + + // Verify channel is now empty + results = al.dequeuePendingSubTurnResults(sessionKey) + if len(results) != 0 { + t.Errorf("expected 0 results on second poll, got %d", len(results)) + } +} From 672d11c7d4939976e0741575069cd7cabf5e73f9 Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Mon, 16 Mar 2026 23:48:51 +0800 Subject: [PATCH 045/234] fix(agent): prevent double result delivery and panic bypass in SubTurn - Fix synchronous SubTurn calls placing results in pendingResults channel, causing double delivery. Now only async calls (Async=true) use the channel. - Move deliverSubTurnResult into defer to ensure result delivery even when runTurn panics. Add TestSpawnSubTurn_PanicRecovery to verify. - Fix ContextWindow incorrectly set to MaxTokens; now inherits from parentAgent.ContextWindow. - Add TestSpawnSubTurn_ResultDeliverySync to verify sync behavior. --- pkg/agent/subturn.go | 25 ++++++-- pkg/agent/subturn_test.go | 131 +++++++++++++++++++++++++++++++++++--- 2 files changed, 140 insertions(+), 16 deletions(-) diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go index 10543bfad..3589a3c7d 100644 --- a/pkg/agent/subturn.go +++ b/pkg/agent/subturn.go @@ -29,6 +29,10 @@ type SubTurnConfig struct { Tools []tools.Tool SystemPrompt string MaxTokens int + // Async indicates whether this is an async SubTurn call. + // If true, the result will be delivered via pendingResults channel. + // If false (synchronous), the result is only returned directly to avoid double delivery. + Async bool // Can be extended with temperature, topP, etc. } @@ -234,6 +238,9 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S childID := al.generateSubTurnID() childTS := newTurnState(childCtx, childID, parentTS) + // IMPORTANT: Put childTS into childCtx so that code inside runTurn can retrieve it + childCtx = withTurnState(childCtx, childTS) + // 4. Establish parent-child relationship (thread-safe) parentTS.mu.Lock() parentTS.childTurnIDs = append(parentTS.childTurnIDs, childID) @@ -246,12 +253,22 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S Config: cfg, }) - // 6. Defer emitting End event, and recover from panics to ensure it's always fired + // 6. Defer cleanup: deliver result (for async), emit End event, and recover from panics + // IMPORTANT: deliverSubTurnResult must be in defer to ensure it runs even if runTurn panics. defer func() { if r := recover(); r != nil { err = fmt.Errorf("subturn panicked: %v", r) } + // 8. Deliver result back to parent Turn (only for async calls) + // For synchronous calls (Async=false), the result is returned directly to avoid double delivery. + // For async calls (Async=true), the result is delivered via pendingResults channel + // so the parent turn can process it in a later iteration. + // This must be in defer to ensure delivery even if runTurn panics. + if cfg.Async { + deliverSubTurnResult(parentTS, childID, result) + } + MockEventBus.Emit(SubTurnEndEvent{ ChildID: childID, Result: result, @@ -263,9 +280,6 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S // Build a child AgentInstance from SubTurnConfig, inheriting defaults from the parent agent. result, err = runTurn(childCtx, al, childTS, cfg) - // 8. Deliver result back to parent Turn - deliverSubTurnResult(parentTS, childID, result) - return result, err } @@ -346,7 +360,7 @@ func runTurn(ctx context.Context, al *AgentLoop, ts *turnState, cfg SubTurnConfi MaxTokens: cfg.MaxTokens, Temperature: parentAgent.Temperature, ThinkingLevel: parentAgent.ThinkingLevel, - ContextWindow: cfg.MaxTokens, + ContextWindow: parentAgent.ContextWindow, // Inherit from parent agent SummarizeMessageThreshold: parentAgent.SummarizeMessageThreshold, SummarizeTokenPercent: parentAgent.SummarizeTokenPercent, Provider: parentAgent.Provider, @@ -357,7 +371,6 @@ func runTurn(ctx context.Context, al *AgentLoop, ts *turnState, cfg SubTurnConfi } if childAgent.MaxTokens == 0 { childAgent.MaxTokens = parentAgent.MaxTokens - childAgent.ContextWindow = parentAgent.ContextWindow } finalContent, err := al.runAgentLoop(ctx, childAgent, processOptions{ diff --git a/pkg/agent/subturn_test.go b/pkg/agent/subturn_test.go index d8214c116..32029960d 100644 --- a/pkg/agent/subturn_test.go +++ b/pkg/agent/subturn_test.go @@ -8,6 +8,8 @@ import ( "testing" "time" + "github.com/sipeed/picoclaw/pkg/bus" + "github.com/sipeed/picoclaw/pkg/config" "github.com/sipeed/picoclaw/pkg/providers" "github.com/sipeed/picoclaw/pkg/tools" ) @@ -158,12 +160,9 @@ func TestSpawnSubTurn(t *testing.T) { t.Error("child Turn not added to parent.childTurnIDs") } - // Verify result delivery (pendingResults or history) - if len(parent.pendingResults) > 0 || len(parent.session.GetHistory("")) > 0 { - // Result delivered via at least one path - } else { - t.Error("child result not delivered") - } + // For synchronous calls (Async=false, the default), result is returned directly + // and should NOT be in pendingResults. The result was already verified above. + // Only async calls (Async=true) would place results in pendingResults. }) } } @@ -196,7 +195,7 @@ func TestSpawnSubTurn_EphemeralSessionIsolation(t *testing.T) { } } -// ====================== Extra Independent Test: Result Delivery Path ====================== +// ====================== Extra Independent Test: Result Delivery Path (Async) ====================== func TestSpawnSubTurn_ResultDelivery(t *testing.T) { al, _, _, _, cleanup := newTestAgentLoop(t) defer cleanup() @@ -209,18 +208,54 @@ func TestSpawnSubTurn_ResultDelivery(t *testing.T) { session: &ephemeralSessionStore{}, } - cfg := SubTurnConfig{Model: "gpt-4o-mini", Tools: []tools.Tool{}} + // Set Async=true to test async result delivery via pendingResults channel + cfg := SubTurnConfig{Model: "gpt-4o-mini", Tools: []tools.Tool{}, Async: true} _, _ = spawnSubTurn(context.Background(), al, parent, cfg) - // Check if pendingResults received the result + // Check if pendingResults received the result (only for async calls) select { case res := <-parent.pendingResults: if res == nil { t.Error("received nil result in pendingResults") } default: - t.Error("result did not enter pendingResults") + t.Error("result did not enter pendingResults for async call") + } +} + +// ====================== Extra Independent Test: Result Delivery Path (Sync) ====================== +func TestSpawnSubTurn_ResultDeliverySync(t *testing.T) { + al, _, _, _, cleanup := newTestAgentLoop(t) + defer cleanup() + + parent := &turnState{ + ctx: context.Background(), + turnID: "parent-sync-1", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 1), + session: &ephemeralSessionStore{}, + } + + // Sync call (Async=false, the default) - result should be returned directly + cfg := SubTurnConfig{Model: "gpt-4o-mini", Tools: []tools.Tool{}, Async: false} + + result, err := spawnSubTurn(context.Background(), al, parent, cfg) + if err != nil { + t.Fatalf("unexpected error: %v", err) + } + + // Result should be returned directly + if result == nil { + t.Error("expected non-nil result from sync call") + } + + // pendingResults should NOT contain the result (no double delivery) + select { + case <-parent.pendingResults: + t.Error("sync call should not place result in pendingResults (double delivery)") + default: + // Expected - channel should be empty } } @@ -752,3 +787,79 @@ func TestFinalPollCapturesLateResults(t *testing.T) { t.Errorf("expected 0 results on second poll, got %d", len(results)) } } + +// TestSpawnSubTurn_PanicRecovery verifies that even if runTurn panics, +// the result is still delivered for async calls and SubTurnEndEvent is emitted. +func TestSpawnSubTurn_PanicRecovery(t *testing.T) { + // Create a panic provider + panicProvider := &panicMockProvider{} + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Workspace: t.TempDir(), + Model: "test-model", + MaxTokens: 4096, + MaxToolIterations: 10, + }, + }, + } + al := NewAgentLoop(cfg, bus.NewMessageBus(), panicProvider) + + parent := &turnState{ + ctx: context.Background(), + turnID: "parent-panic", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 1), + session: &ephemeralSessionStore{}, + } + + collector := &eventCollector{} + originalEmit := MockEventBus.Emit + MockEventBus.Emit = collector.collect + defer func() { MockEventBus.Emit = originalEmit }() + + // Test async call - result should still be delivered via channel + asyncCfg := SubTurnConfig{Model: "gpt-4o-mini", Tools: []tools.Tool{}, Async: true} + result, err := spawnSubTurn(context.Background(), al, parent, asyncCfg) + + // Should return error from panic recovery + if err == nil { + t.Error("expected error from panic recovery") + } + + // Result should be nil because panic occurred before runTurn could return + if result != nil { + t.Error("expected nil result after panic") + } + + // SubTurnEndEvent should still be emitted + if !collector.hasEventOfType(SubTurnEndEvent{}) { + t.Error("SubTurnEndEvent not emitted after panic") + } + + // For async call, result should still be delivered to channel (even if nil) + select { + case res := <-parent.pendingResults: + // Result was delivered (nil due to panic) + _ = res + default: + t.Error("async result should be delivered to channel even after panic") + } +} + +// panicMockProvider is a mock provider that always panics +type panicMockProvider struct{} + +func (m *panicMockProvider) Chat( + ctx context.Context, + messages []providers.Message, + tools []providers.ToolDefinition, + model string, + opts map[string]any, +) (*providers.LLMResponse, error) { + panic("intentional panic for testing") +} + +func (m *panicMockProvider) GetDefaultModel() string { + return "panic-model" +} From be4a33cc150c6ea0f41b3bd939b15dc526f84603 Mon Sep 17 00:00:00 2001 From: Cytown Date: Tue, 17 Mar 2026 09:35:52 +0800 Subject: [PATCH 046/234] refactor gateway/helpers and add server.pid to health (#1646) --- cmd/picoclaw/internal/gateway/helpers.go | 121 ++++++++++------------- pkg/health/server.go | 3 + 2 files changed, 55 insertions(+), 69 deletions(-) diff --git a/cmd/picoclaw/internal/gateway/helpers.go b/cmd/picoclaw/internal/gateway/helpers.go index 3562f03ef..85e93bcf9 100644 --- a/cmd/picoclaw/internal/gateway/helpers.go +++ b/cmd/picoclaw/internal/gateway/helpers.go @@ -7,6 +7,7 @@ import ( "os/signal" "path/filepath" "sync" + "syscall" "time" "github.com/sipeed/picoclaw/cmd/picoclaw/internal" @@ -43,7 +44,6 @@ import ( // Timeout constants for service operations const ( - serviceRestartTimeout = 30 * time.Second serviceShutdownTimeout = 30 * time.Second providerReloadTimeout = 30 * time.Second gracefulShutdownTimeout = 15 * time.Second @@ -121,7 +121,7 @@ func gatewayCmd(debug bool) error { defer stopWatch() sigChan := make(chan os.Signal, 1) - signal.Notify(sigChan, os.Interrupt) + signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM) // Main event loop - wait for signals or config changes for { @@ -150,7 +150,8 @@ func setupAndStartServices( // Setup cron tool and service execTimeout := time.Duration(cfg.Tools.Cron.ExecTimeoutMinutes) * time.Minute - services.CronService = setupCronTool( + var err error + services.CronService, err = setupCronTool( agentLoop, msgBus, cfg.WorkspacePath(), @@ -158,7 +159,10 @@ func setupAndStartServices( execTimeout, cfg, ) - if err := services.CronService.Start(); err != nil { + if err != nil { + return nil, fmt.Errorf("error setting up cron service: %w", err) + } + if err = services.CronService.Start(); err != nil { return nil, fmt.Errorf("error starting cron service: %w", err) } fmt.Println("✓ Cron service started") @@ -170,26 +174,8 @@ func setupAndStartServices( cfg.Heartbeat.Enabled, ) services.HeartbeatService.SetBus(msgBus) - services.HeartbeatService.SetHandler(func(prompt, channel, chatID string) *tools.ToolResult { - // Use cli:direct as fallback if no valid channel - if channel == "" || chatID == "" { - channel, chatID = "cli", "direct" - } - // Use ProcessHeartbeat - no session history, each heartbeat is independent - var response string - var err error - response, err = agentLoop.ProcessHeartbeat(context.Background(), prompt, channel, chatID) - if err != nil { - return tools.ErrorResult(fmt.Sprintf("Heartbeat error: %v", err)) - } - if response == "HEARTBEAT_OK" { - return tools.SilentResult("Heartbeat OK") - } - // For heartbeat, always return silent - the subagent result will be - // sent to user via processSystemMessage when the async task completes - return tools.SilentResult(response) - }) - if err := services.HeartbeatService.Start(); err != nil { + services.HeartbeatService.SetHandler(createHeartbeatHandler(agentLoop)) + if err = services.HeartbeatService.Start(); err != nil { return nil, fmt.Errorf("error starting heartbeat service: %w", err) } fmt.Println("✓ Heartbeat service started") @@ -206,7 +192,6 @@ func setupAndStartServices( } // Create channel manager - var err error services.ChannelManager, err = channels.NewManager(cfg, msgBus, services.MediaStore) if err != nil { // Stop the media store if it's a FileMediaStore with cleanup @@ -238,7 +223,7 @@ func setupAndStartServices( services.HealthServer = health.NewServer(cfg.Gateway.Host, cfg.Gateway.Port) services.ChannelManager.SetupHTTPServer(addr, services.HealthServer) - if err := services.ChannelManager.StartAll(context.Background()); err != nil { + if err = services.ChannelManager.StartAll(context.Background()); err != nil { return nil, fmt.Errorf("error starting channels: %w", err) } @@ -251,7 +236,7 @@ func setupAndStartServices( MonitorUSB: cfg.Devices.MonitorUSB, }, stateManager) services.DeviceService.SetBus(msgBus) - if err := services.DeviceService.Start(context.Background()); err != nil { + if err = services.DeviceService.Start(context.Background()); err != nil { logger.ErrorCF("device", "Error starting device service", map[string]any{"error": err.Error()}) } else if cfg.Devices.Enabled { fmt.Println("✓ Device event service started") @@ -386,17 +371,13 @@ func restartServices( services *gatewayServices, msgBus *bus.MessageBus, ) error { - // Create an independent context with timeout for service restart - // This prevents cancellation from the main loop context during reload - ctx, cancel := context.WithTimeout(context.Background(), serviceRestartTimeout) - defer cancel() - // Get current config from agent loop (which has been updated if this is a reload) cfg := al.GetConfig() // Re-create and start cron service with new config execTimeout := time.Duration(cfg.Tools.Cron.ExecTimeoutMinutes) * time.Minute - services.CronService = setupCronTool( + var err error + services.CronService, err = setupCronTool( al, msgBus, cfg.WorkspacePath(), @@ -404,7 +385,10 @@ func restartServices( execTimeout, cfg, ) - if err := services.CronService.Start(); err != nil { + if err != nil { + return fmt.Errorf("error restarting cron service: %w", err) + } + if err = services.CronService.Start(); err != nil { return fmt.Errorf("error restarting cron service: %w", err) } fmt.Println(" ✓ Cron service restarted") @@ -416,31 +400,12 @@ func restartServices( cfg.Heartbeat.Enabled, ) services.HeartbeatService.SetBus(msgBus) - services.HeartbeatService.SetHandler(func(prompt, channel, chatID string) *tools.ToolResult { - if channel == "" || chatID == "" { - channel, chatID = "cli", "direct" - } - var response string - var err error - response, err = al.ProcessHeartbeat(context.Background(), prompt, channel, chatID) - if err != nil { - return tools.ErrorResult(fmt.Sprintf("Heartbeat error: %v", err)) - } - if response == "HEARTBEAT_OK" { - return tools.SilentResult("Heartbeat OK") - } - return tools.SilentResult(response) - }) - if err := services.HeartbeatService.Start(); err != nil { + services.HeartbeatService.SetHandler(createHeartbeatHandler(al)) + if err = services.HeartbeatService.Start(); err != nil { return fmt.Errorf("error restarting heartbeat service: %w", err) } fmt.Println(" ✓ Heartbeat service restarted") - // Stop the old media store before creating a new one - if fms, ok := services.MediaStore.(*media.FileMediaStore); ok { - fms.Stop() - } - // Re-create media store with new config services.MediaStore = media.NewFileMediaStoreWithCleanup(media.MediaCleanerConfig{ Enabled: cfg.Tools.MediaCleanup.Enabled, @@ -454,13 +419,8 @@ func restartServices( al.SetMediaStore(services.MediaStore) // Re-create channel manager with new config - var err error services.ChannelManager, err = channels.NewManager(cfg, msgBus, services.MediaStore) if err != nil { - // Stop the media store if it's a FileMediaStore with cleanup - if fms, ok := services.MediaStore.(*media.FileMediaStore); ok { - fms.Stop() - } return fmt.Errorf("error recreating channel manager: %w", err) } al.SetChannelManager(services.ChannelManager) @@ -477,7 +437,8 @@ func restartServices( services.HealthServer = health.NewServer(cfg.Gateway.Host, cfg.Gateway.Port) services.ChannelManager.SetupHTTPServer(addr, services.HealthServer) - if err := services.ChannelManager.StartAll(ctx); err != nil { + // Use background context for lifecycle to ensure services persist after restartServices returns + if err = services.ChannelManager.StartAll(context.Background()); err != nil { return fmt.Errorf("error restarting channels: %w", err) } fmt.Printf( @@ -493,7 +454,7 @@ func restartServices( MonitorUSB: cfg.Devices.MonitorUSB, }, stateManager) services.DeviceService.SetBus(msgBus) - if err := services.DeviceService.Start(ctx); err != nil { + if err := services.DeviceService.Start(context.Background()); err != nil { logger.WarnCF("device", "Failed to restart device service", map[string]any{"error": err.Error()}) } else if cfg.Devices.Enabled { fmt.Println(" ✓ Device event service restarted") @@ -544,6 +505,10 @@ func setupConfigWatcherPolling(configPath string, debug bool) (chan *config.Conf // Debounce - wait a bit to ensure file write is complete time.Sleep(500 * time.Millisecond) + // Update last known state to prevent repeated reload attempts on failure + lastModTime = currentModTime + lastSize = currentSize + // Validate and load new config newCfg, err := config.LoadConfig(configPath) if err != nil { @@ -561,10 +526,6 @@ func setupConfigWatcherPolling(configPath string, debug bool) (chan *config.Conf logger.Info("✓ Config file validated and loaded") - // Update last known state - lastModTime = currentModTime - lastSize = currentSize - // Send new config to main loop (non-blocking) select { case configChan <- newCfg: @@ -613,7 +574,7 @@ func setupCronTool( restrict bool, execTimeout time.Duration, cfg *config.Config, -) *cron.CronService { +) (*cron.CronService, error) { cronStorePath := filepath.Join(workspace, "cron", "jobs.json") // Create cron service @@ -625,7 +586,7 @@ func setupCronTool( var err error cronTool, err = tools.NewCronTool(cronService, agentLoop, msgBus, workspace, restrict, execTimeout, cfg) if err != nil { - logger.Fatalf("Critical error during CronTool initialization: %v", err) + return nil, fmt.Errorf("critical error during CronTool initialization: %w", err) } agentLoop.RegisterTool(cronTool) @@ -639,5 +600,27 @@ func setupCronTool( }) } - return cronService + return cronService, nil +} + +func createHeartbeatHandler(agentLoop *agent.AgentLoop) func(prompt, channel, chatID string) *tools.ToolResult { + return func(prompt, channel, chatID string) *tools.ToolResult { + // Use cli:direct as fallback if no valid channel + if channel == "" || chatID == "" { + channel, chatID = "cli", "direct" + } + // Use ProcessHeartbeat - no session history, each heartbeat is independent + var response string + var err error + response, err = agentLoop.ProcessHeartbeat(context.Background(), prompt, channel, chatID) + if err != nil { + return tools.ErrorResult(fmt.Sprintf("Heartbeat error: %v", err)) + } + if response == "HEARTBEAT_OK" { + return tools.SilentResult("Heartbeat OK") + } + // For heartbeat, always return silent - the subagent result will be + // sent to user via processSystemMessage when the async task completes + return tools.SilentResult(response) + } } diff --git a/pkg/health/server.go b/pkg/health/server.go index 5609ebdf6..b9ee9f496 100644 --- a/pkg/health/server.go +++ b/pkg/health/server.go @@ -6,6 +6,7 @@ import ( "fmt" "maps" "net/http" + "os" "sync" "time" ) @@ -29,6 +30,7 @@ type StatusResponse struct { Status string `json:"status"` Uptime string `json:"uptime"` Checks map[string]Check `json:"checks,omitempty"` + Pid int `json:"pid"` } func NewServer(host string, port int) *Server { @@ -112,6 +114,7 @@ func (s *Server) healthHandler(w http.ResponseWriter, r *http.Request) { resp := StatusResponse{ Status: "ok", Uptime: uptime.String(), + Pid: os.Getpid(), } json.NewEncoder(w).Encode(resp) From fcb69860c4807bbe1da4ef9144fc38fbcaf49fd9 Mon Sep 17 00:00:00 2001 From: wenjie Date: Tue, 17 Mar 2026 09:44:32 +0800 Subject: [PATCH 047/234] feat(web): add configurable cron command execution settings (#1647) - add tools.cron.allow_command config with a default value of true - require command_confirm only when cron command execution is disabled - expose cron command permission and timeout settings in the config UI - add backend tests and update i18n strings --- pkg/config/config.go | 5 +- pkg/config/config_test.go | 23 +++++++ pkg/config/defaults.go | 1 + pkg/tools/cron.go | 34 +++++++---- pkg/tools/cron_test.go | 61 +++++++++++++++++-- .../src/components/config/config-page.tsx | 12 ++++ .../src/components/config/config-sections.tsx | 36 +++++++++++ .../src/components/config/form-model.ts | 13 ++++ web/frontend/src/i18n/locales/en.json | 5 ++ web/frontend/src/i18n/locales/zh.json | 5 ++ 10 files changed, 174 insertions(+), 21 deletions(-) diff --git a/pkg/config/config.go b/pkg/config/config.go index 2937c36e4..ad5618907 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -699,8 +699,9 @@ type WebToolsConfig struct { } type CronToolsConfig struct { - ToolConfig ` envPrefix:"PICOCLAW_TOOLS_CRON_"` - ExecTimeoutMinutes int ` env:"PICOCLAW_TOOLS_CRON_EXEC_TIMEOUT_MINUTES" json:"exec_timeout_minutes"` // 0 means no timeout + ToolConfig ` envPrefix:"PICOCLAW_TOOLS_CRON_"` + ExecTimeoutMinutes int ` env:"PICOCLAW_TOOLS_CRON_EXEC_TIMEOUT_MINUTES" json:"exec_timeout_minutes"` // 0 means no timeout + AllowCommand bool ` env:"PICOCLAW_TOOLS_CRON_ALLOW_COMMAND" json:"allow_command"` } type ExecConfig struct { diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index 4c4dd9421..fc835f78f 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -405,6 +405,13 @@ func TestDefaultConfig_ExecAllowRemoteEnabled(t *testing.T) { } } +func TestDefaultConfig_CronAllowCommandEnabled(t *testing.T) { + cfg := DefaultConfig() + if !cfg.Tools.Cron.AllowCommand { + t.Fatal("DefaultConfig().Tools.Cron.AllowCommand should be true") + } +} + func TestLoadConfig_OpenAIWebSearchDefaultsTrueWhenUnset(t *testing.T) { dir := t.TempDir() configPath := filepath.Join(dir, "config.json") @@ -437,6 +444,22 @@ func TestLoadConfig_ExecAllowRemoteDefaultsTrueWhenUnset(t *testing.T) { } } +func TestLoadConfig_CronAllowCommandDefaultsTrueWhenUnset(t *testing.T) { + dir := t.TempDir() + configPath := filepath.Join(dir, "config.json") + if err := os.WriteFile(configPath, []byte(`{"tools":{"cron":{"exec_timeout_minutes":5}}}`), 0o600); err != nil { + t.Fatalf("WriteFile() error: %v", err) + } + + cfg, err := LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error: %v", err) + } + if !cfg.Tools.Cron.AllowCommand { + t.Fatal("tools.cron.allow_command should remain true when unset in config file") + } +} + func TestLoadConfig_OpenAIWebSearchCanBeDisabled(t *testing.T) { dir := t.TempDir() configPath := filepath.Join(dir, "config.json") diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index dc534d852..a029eeb59 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -452,6 +452,7 @@ func DefaultConfig() *Config { Enabled: true, }, ExecTimeoutMinutes: 5, + AllowCommand: true, }, Exec: ExecConfig{ ToolConfig: ToolConfig{ diff --git a/pkg/tools/cron.go b/pkg/tools/cron.go index 25608a54c..aa22f9aa6 100644 --- a/pkg/tools/cron.go +++ b/pkg/tools/cron.go @@ -20,10 +20,11 @@ type JobExecutor interface { // CronTool provides scheduling capabilities for the agent type CronTool struct { - cronService *cron.CronService - executor JobExecutor - msgBus *bus.MessageBus - execTool *ExecTool + cronService *cron.CronService + executor JobExecutor + msgBus *bus.MessageBus + execTool *ExecTool + allowCommand bool } // NewCronTool creates a new CronTool @@ -37,12 +38,18 @@ func NewCronTool( return nil, fmt.Errorf("unable to configure exec tool: %w", err) } + allowCommand := true + if config != nil { + allowCommand = config.Tools.Cron.AllowCommand + } + execTool.SetTimeout(execTimeout) return &CronTool{ - cronService: cronService, - executor: executor, - msgBus: msgBus, - execTool: execTool, + cronService: cronService, + executor: executor, + msgBus: msgBus, + execTool: execTool, + allowCommand: allowCommand, }, nil } @@ -76,7 +83,7 @@ func (t *CronTool) Parameters() map[string]any { }, "command_confirm": map[string]any{ "type": "boolean", - "description": "Required when using command=true. Must be true to explicitly confirm scheduling a shell command.", + "description": "Optional explicit confirmation flag for scheduling a shell command. Command execution must also be enabled via tools.cron.allow_command.", }, "at_seconds": map[string]any{ "type": "integer", @@ -180,16 +187,17 @@ func (t *CronTool) addJob(ctx context.Context, args map[string]any) *ToolResult deliver = d } - // GHSA-pv8c-p6jf-3fpp: command scheduling requires internal channel + explicit confirm. - // Non-command reminders (plain messages) remain open to all channels. + // GHSA-pv8c-p6jf-3fpp: command scheduling requires internal channel. When + // allow_command is disabled, explicit confirmation is required as an override. + // Non-command reminders remain open to all channels. command, _ := args["command"].(string) commandConfirm, _ := args["command_confirm"].(bool) if command != "" { if !constants.IsInternalChannel(channel) { return ErrorResult("scheduling command execution is restricted to internal channels") } - if !commandConfirm { - return ErrorResult("command_confirm=true is required to schedule command execution") + if !t.allowCommand && !commandConfirm { + return ErrorResult("command_confirm=true is required when allow_command is disabled") } deliver = false } diff --git a/pkg/tools/cron_test.go b/pkg/tools/cron_test.go index f1e857949..e46b13b13 100644 --- a/pkg/tools/cron_test.go +++ b/pkg/tools/cron_test.go @@ -11,12 +11,11 @@ import ( "github.com/sipeed/picoclaw/pkg/cron" ) -func newTestCronTool(t *testing.T) *CronTool { +func newTestCronToolWithConfig(t *testing.T, cfg *config.Config) *CronTool { t.Helper() storePath := filepath.Join(t.TempDir(), "cron.json") cronService := cron.NewCronService(storePath, nil) msgBus := bus.NewMessageBus() - cfg := config.DefaultConfig() tool, err := NewCronTool(cronService, nil, msgBus, t.TempDir(), true, 0, cfg) if err != nil { t.Fatalf("NewCronTool() error: %v", err) @@ -24,6 +23,11 @@ func newTestCronTool(t *testing.T) *CronTool { return tool } +func newTestCronTool(t *testing.T) *CronTool { + t.Helper() + return newTestCronToolWithConfig(t, config.DefaultConfig()) +} + // TestCronTool_CommandBlockedFromRemoteChannel verifies command scheduling is restricted to internal channels func TestCronTool_CommandBlockedFromRemoteChannel(t *testing.T) { tool := newTestCronTool(t) @@ -44,8 +48,7 @@ func TestCronTool_CommandBlockedFromRemoteChannel(t *testing.T) { } } -// TestCronTool_CommandRequiresConfirm verifies command_confirm=true is required -func TestCronTool_CommandRequiresConfirm(t *testing.T) { +func TestCronTool_CommandDoesNotRequireConfirmByDefault(t *testing.T) { tool := newTestCronTool(t) ctx := WithToolContext(context.Background(), "cli", "direct") result := tool.Execute(ctx, map[string]any{ @@ -55,11 +58,57 @@ func TestCronTool_CommandRequiresConfirm(t *testing.T) { "at_seconds": float64(60), }) + if result.IsError { + t.Fatalf("expected command scheduling without confirm to succeed by default, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "Cron job added") { + t.Errorf("expected 'Cron job added', got: %s", result.ForLLM) + } +} + +func TestCronTool_CommandRequiresConfirmWhenAllowCommandDisabled(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Tools.Cron.AllowCommand = false + + tool := newTestCronToolWithConfig(t, cfg) + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "at_seconds": float64(60), + }) + if !result.IsError { - t.Fatal("expected error when command_confirm is missing") + t.Fatal("expected command scheduling to require confirm when allow_command is disabled") } if !strings.Contains(result.ForLLM, "command_confirm=true") { - t.Errorf("expected 'command_confirm=true' message, got: %s", result.ForLLM) + t.Errorf("expected command_confirm requirement message, got: %s", result.ForLLM) + } +} + +func TestCronTool_CommandAllowedWithConfirmWhenAllowCommandDisabled(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Tools.Cron.AllowCommand = false + + tool := newTestCronToolWithConfig(t, cfg) + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "command_confirm": true, + "at_seconds": float64(60), + }) + + if result.IsError { + t.Fatalf( + "expected command scheduling with confirm to succeed when allow_command is disabled, got: %s", + result.ForLLM, + ) + } + if !strings.Contains(result.ForLLM, "Cron job added") { + t.Errorf("expected 'Cron job added', got: %s", result.ForLLM) } } diff --git a/web/frontend/src/components/config/config-page.tsx b/web/frontend/src/components/config/config-page.tsx index cbce7d27e..130498ba4 100644 --- a/web/frontend/src/components/config/config-page.tsx +++ b/web/frontend/src/components/config/config-page.tsx @@ -14,6 +14,7 @@ import { } from "@/api/system" import { AgentDefaultsSection, + CronSection, DevicesSection, LauncherSection, RuntimeSection, @@ -164,6 +165,11 @@ export function ConfigPage() { "Heartbeat interval", { min: 1 }, ) + const cronExecTimeoutMinutes = parseIntField( + form.cronExecTimeoutMinutes, + "Cron exec timeout", + { min: 0 }, + ) await patchAppConfig({ agents: { @@ -180,6 +186,10 @@ export function ConfigPage() { dm_scope: dmScope, }, tools: { + cron: { + allow_command: form.allowCommand, + exec_timeout_minutes: cronExecTimeoutMinutes, + }, exec: { allow_remote: form.allowRemote, }, @@ -279,6 +289,8 @@ export function ConfigPage() { + + + onFieldChange("allowCommand", checked)} + /> + + + + onFieldChange("cronExecTimeoutMinutes", e.target.value) + } + /> + + + ) +} + interface LauncherSectionProps { launcherForm: LauncherForm onFieldChange: UpdateLauncherField diff --git a/web/frontend/src/components/config/form-model.ts b/web/frontend/src/components/config/form-model.ts index d868c4bb4..8c850b2c4 100644 --- a/web/frontend/src/components/config/form-model.ts +++ b/web/frontend/src/components/config/form-model.ts @@ -4,6 +4,8 @@ export interface CoreConfigForm { workspace: string restrictToWorkspace: boolean allowRemote: boolean + allowCommand: boolean + cronExecTimeoutMinutes: string maxTokens: string maxToolIterations: string summarizeMessageThreshold: string @@ -56,6 +58,8 @@ export const EMPTY_FORM: CoreConfigForm = { workspace: "", restrictToWorkspace: true, allowRemote: true, + allowCommand: true, + cronExecTimeoutMinutes: "5", maxTokens: "32768", maxToolIterations: "50", summarizeMessageThreshold: "20", @@ -106,6 +110,7 @@ export function buildFormFromConfig(config: unknown): CoreConfigForm { const heartbeat = asRecord(root.heartbeat) const devices = asRecord(root.devices) const tools = asRecord(root.tools) + const cron = asRecord(tools.cron) const exec = asRecord(tools.exec) return { @@ -118,6 +123,14 @@ export function buildFormFromConfig(config: unknown): CoreConfigForm { exec.allow_remote === undefined ? EMPTY_FORM.allowRemote : asBool(exec.allow_remote), + allowCommand: + cron.allow_command === undefined + ? EMPTY_FORM.allowCommand + : asBool(cron.allow_command), + cronExecTimeoutMinutes: asNumberString( + cron.exec_timeout_minutes, + EMPTY_FORM.cronExecTimeoutMinutes, + ), maxTokens: asNumberString(defaults.max_tokens, EMPTY_FORM.maxTokens), maxToolIterations: asNumberString( defaults.max_tool_iterations, diff --git a/web/frontend/src/i18n/locales/en.json b/web/frontend/src/i18n/locales/en.json index b099dec13..2fa32ebb5 100644 --- a/web/frontend/src/i18n/locales/en.json +++ b/web/frontend/src/i18n/locales/en.json @@ -394,6 +394,10 @@ "restrict_workspace_hint": "Only allow file operations inside workspace.", "allow_remote": "Allow Remote Shell Execution", "allow_remote_hint": "When enabled, shell commands can also run for remote sessions or non-local contexts. When disabled, shell execution stays limited to local safe contexts.", + "allow_shell_execution": "Allow Shell Execution", + "allow_shell_execution_hint": "Enable scheduled shell commands for cron jobs by default. When disabled, users must pass command_confirm=true to schedule a cron command.", + "cron_exec_timeout": "Cron Command Timeout (minutes)", + "cron_exec_timeout_hint": "Maximum runtime for scheduled shell commands. Set to 0 to disable the timeout.", "max_tokens": "Max Tokens", "max_tokens_hint": "Upper token limit per model response.", "max_tool_iterations": "Max Tool Iterations", @@ -434,6 +438,7 @@ "sections": { "agent": "Agent", "runtime": "Runtime", + "cron": "Cron Tasks", "launcher": "Service", "devices": "Devices" }, diff --git a/web/frontend/src/i18n/locales/zh.json b/web/frontend/src/i18n/locales/zh.json index 78093e5c7..badf5bb3d 100644 --- a/web/frontend/src/i18n/locales/zh.json +++ b/web/frontend/src/i18n/locales/zh.json @@ -394,6 +394,10 @@ "restrict_workspace_hint": "仅允许在工作目录内执行文件操作。", "allow_remote": "允许远程执行 Shell 命令", "allow_remote_hint": "开启后，来自远程会话或非本地上下文的请求也可以执行 shell 命令；关闭后，仅允许本地安全上下文执行。", + "allow_shell_execution": "允许 Shell 执行", + "allow_shell_execution_hint": "开启后，cron 定时任务默认允许执行 shell 命令。关闭后，必须显式传入 command_confirm=true 才能创建 cron 命令任务。", + "cron_exec_timeout": "定时命令超时（分钟）", + "cron_exec_timeout_hint": "定时 shell 命令的最长执行时间。设置为 0 表示不限制超时。", "max_tokens": "最大 Token 数", "max_tokens_hint": "单次模型响应允许的最大 Token 数。", "max_tool_iterations": "最大工具迭代次数", @@ -434,6 +438,7 @@ "sections": { "agent": "智能体", "runtime": "运行时", + "cron": "定时任务", "launcher": "服务参数", "devices": "设备" }, From c63c6449b4a3a9fbe15fb2a269eddddc8817084f Mon Sep 17 00:00:00 2001 From: xiaoen <2768753269@qq.com> Date: Tue, 17 Mar 2026 10:23:16 +0800 Subject: [PATCH 048/234] fix(agent): forceCompression recovers from single oversized Turn MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When the entire session history is a single Turn (e.g. one user message followed by a massive tool response), findSafeBoundary returns 0 and forceCompression previously did nothing — leaving the agent stuck in a context-exceeded retry loop. Now falls back to keeping only the most recent user message when no safe Turn boundary exists. This breaks Turn atomicity as a last resort but guarantees the agent can recover. Also updates docs/agent-refactor/context.md to document this behavior. Ref #1490 --- docs/agent-refactor/context.md | 4 +++- pkg/agent/loop.go | 22 +++++++++++++++++++--- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/docs/agent-refactor/context.md b/docs/agent-refactor/context.md index 785fae2be..2269d9258 100644 --- a/docs/agent-refactor/context.md +++ b/docs/agent-refactor/context.md @@ -103,7 +103,9 @@ This prevents wasted (and billed) LLM calls that would otherwise fail with a con `forceCompression` runs when the LLM returns a context-window error despite the proactive check. -Drops the oldest ~50% of Turns. Stores a compression note in the session summary (not in history messages) so `BuildMessages` can include it in the next system prompt. +Drops the oldest ~50% of Turns. If the history is a single Turn with no safe split point (e.g. one user message followed by a massive tool response), falls back to keeping only the most recent user message — breaking Turn atomicity as a last resort to avoid a context-exceeded loop. + +Stores a compression note in the session summary (not in history messages) so `BuildMessages` can include it in the next system prompt. This is the fallback for when the token estimate undershoots reality. diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 688d0ed1d..c583f5ca5 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -1559,6 +1559,10 @@ func (al *AgentLoop) maybeSummarize(agent *AgentInstance, sessionKey, channel, c // It drops the oldest ~50% of Turns (a Turn is a complete user→LLM→response // cycle, as defined in #1316), so tool-call sequences are never split. // +// If the history is a single Turn with no safe split point, the function +// falls back to keeping only the most recent user message. This breaks +// Turn atomicity as a last resort to avoid a context-exceeded loop. +// // Session history contains only user/assistant/tool messages — the system // prompt is built dynamically by BuildMessages and is NOT stored here. // The compression note is recorded in the session summary so that @@ -1581,12 +1585,24 @@ func (al *AgentLoop) forceCompression(agent *AgentInstance, sessionKey string) { // aligned to the nearest Turn boundary. mid = findSafeBoundary(history, len(history)/2) } + var keptHistory []providers.Message if mid <= 0 { - return + // No safe Turn boundary — the entire history is a single Turn + // (e.g. one user message followed by a massive tool response). + // Keeping everything would leave the agent stuck in a context- + // exceeded loop, so fall back to keeping only the most recent + // user message. This breaks Turn atomicity as a last resort. + for i := len(history) - 1; i >= 0; i-- { + if history[i].Role == "user" { + keptHistory = []providers.Message{history[i]} + break + } + } + } else { + keptHistory = history[mid:] } - droppedCount := mid - keptHistory := history[mid:] + droppedCount := len(history) - len(keptHistory) // Record compression in the session summary so BuildMessages includes it // in the system prompt. We do not modify history messages themselves. From 8d97896a0dfc485b6a8400d80b2859f852421aa3 Mon Sep 17 00:00:00 2001 From: Zane Tung Date: Tue, 17 Mar 2026 11:52:58 +0800 Subject: [PATCH 049/234] fix(providers): handle nil input in GLM series tool_use blocks - add defensive nil check for tool call Arguments field - replace nil input with empty object to comply with Anthropic spec - prevent API errors when GLM models return null input in tool_use blocks Zhipu AI's GLM series models may return tool_use blocks with null input field, which causes their API to reject subsequent requests with error: "ClaudeContentBlockToolResult object has no attribute id" This fix ensures compatibility by converting nil inputs to empty objects {}, matching the Anthropic Messages API specification while maintaining backward compatibility with other providers. --- pkg/providers/anthropic_messages/provider.go | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/pkg/providers/anthropic_messages/provider.go b/pkg/providers/anthropic_messages/provider.go index 8a83a7058..c201dfe00 100644 --- a/pkg/providers/anthropic_messages/provider.go +++ b/pkg/providers/anthropic_messages/provider.go @@ -221,11 +221,17 @@ func buildRequestBody( // Add tool_use blocks for _, tc := range msg.ToolCalls { + // Handle nil Arguments (GLM-4 may return null input) + input := tc.Arguments + if input == nil { + input = map[string]any{} + } + toolUse := map[string]any{ "type": "tool_use", "id": tc.ID, "name": tc.Name, - "input": tc.Arguments, + "input": input, } content = append(content, toolUse) } From 12a8590adab73ca9ea61d7a309d972f59f17dc30 Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Tue, 17 Mar 2026 12:50:32 +0800 Subject: [PATCH 050/234] fix(agent): enhance SubTurn robustness and fix race conditions Major improvements to SubTurn implementation: **Fixes:** - Channel close race condition (sync.Once) - Semaphore blocking timeout (30s) - Redundant context wrapping - Memory accumulation (auto-truncate at 50 msgs) - Channel draining on Finish() - Missing depth limit logging - Model validation **Enhancements:** - Comprehensive documentation (150+ lines) - 11 new tests covering edge cases - Improved error messages All tests pass. Production-ready. Related: #1316 --- pkg/agent/loop.go | 9 +- pkg/agent/steering.go | 44 ++ pkg/agent/subturn.go | 394 +++++++++++++--- pkg/agent/subturn_test.go | 950 ++++++++++++++++++++++++++++++++++++++ pkg/tools/registry.go | 20 + pkg/tools/spawn.go | 73 ++- pkg/tools/subagent.go | 154 +++--- 7 files changed, 1466 insertions(+), 178 deletions(-) diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 994c6a59a..72656a2a6 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -300,10 +300,16 @@ func registerSharedTools( spawnTool.SetAllowlistChecker(func(targetAgentID string) bool { return registry.CanSpawnSubagent(currentAgentID, targetAgentID) }) + + // Set SubTurnSpawner for direct sub-turn execution + spawner := NewSubTurnSpawner(al) + spawnTool.SetSpawner(spawner) + agent.Tools.Register(spawnTool) - + // Also register the synchronous subagent tool subagentTool := tools.NewSubagentTool(subagentManager) + subagentTool.SetSpawner(spawner) agent.Tools.Register(subagentTool) } else { logger.WarnCF("agent", "spawn tool requires subagent to be enabled", nil) @@ -988,6 +994,7 @@ func (al *AgentLoop) runAgentLoop( concurrencySem: make(chan struct{}, 5), // maxConcurrentSubTurns } ctx = withTurnState(ctx, rootTS) + ctx = WithAgentLoop(ctx, al) // Inject AgentLoop for tool access isRootTurn = true // Register this root turn state so HardAbort can find it diff --git a/pkg/agent/steering.go b/pkg/agent/steering.go index 97461428d..c8be7ef4a 100644 --- a/pkg/agent/steering.go +++ b/pkg/agent/steering.go @@ -276,3 +276,47 @@ func (al *AgentLoop) HardAbort(sessionKey string) error { return nil } + +// ====================== Follow-Up Injection ====================== + +// InjectFollowUp enqueues a message to be automatically processed after the current +// turn completes. Unlike Steer(), which interrupts the current execution, InjectFollowUp +// waits for the current turn to finish naturally before processing the message. +// +// This is useful for: +// - Automated workflows that need to chain multiple turns +// - Background tasks that should run after the main task completes +// - Scheduled follow-up actions +// +// The message will be processed via Continue() when the agent becomes idle. +func (al *AgentLoop) InjectFollowUp(msg providers.Message) error { + // InjectFollowUp uses the same steering queue mechanism as Steer(), + // but the semantic difference is in when it's called: + // - Steer() is called during active execution to interrupt + // - InjectFollowUp() is called when planning future work + // + // Both end up in the same queue and are processed by Continue() + // when the agent is idle. + return al.Steer(msg) +} + +// ====================== API Aliases for Design Document Compatibility ====================== + +// InterruptGraceful is an alias for Steer() to match the design document naming. +// It gracefully interrupts the current execution by injecting a user message +// that will be processed after the current tool finishes. +func (al *AgentLoop) InterruptGraceful(msg providers.Message) error { + return al.Steer(msg) +} + +// InterruptHard is an alias for HardAbort() to match the design document naming. +// It immediately terminates execution and rolls back the session state. +func (al *AgentLoop) InterruptHard(sessionKey string) error { + return al.HardAbort(sessionKey) +} + +// InjectSteering is an alias for Steer() to match the design document naming. +// It injects a steering message into the currently running agent loop. +func (al *AgentLoop) InjectSteering(msg providers.Message) error { + return al.Steer(msg) +} diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go index 3589a3c7d..d6b9ec90c 100644 --- a/pkg/agent/subturn.go +++ b/pkg/agent/subturn.go @@ -5,7 +5,9 @@ import ( "errors" "fmt" "sync" + "time" + "github.com/sipeed/picoclaw/pkg/logger" "github.com/sipeed/picoclaw/pkg/providers" "github.com/sipeed/picoclaw/pkg/session" "github.com/sipeed/picoclaw/pkg/tools" @@ -15,24 +17,78 @@ import ( const ( maxSubTurnDepth = 3 maxConcurrentSubTurns = 5 + // concurrencyTimeout is the maximum time to wait for a concurrency slot. + // This prevents indefinite blocking when all slots are occupied by slow sub-turns. + concurrencyTimeout = 30 * time.Second + // maxEphemeralHistorySize limits the number of messages stored in ephemeral sessions. + // This prevents memory accumulation in long-running sub-turns. + maxEphemeralHistorySize = 50 ) var ( ErrDepthLimitExceeded = errors.New("sub-turn depth limit exceeded") ErrInvalidSubTurnConfig = errors.New("invalid sub-turn config") ErrConcurrencyLimitExceeded = errors.New("sub-turn concurrency limit exceeded") + ErrConcurrencyTimeout = errors.New("timeout waiting for concurrency slot") ) // ====================== SubTurn Config ====================== + +// SubTurnConfig configures the execution of a child sub-turn. +// +// Usage Examples: +// +// Synchronous sub-turn (Async=false): +// +// cfg := SubTurnConfig{ +// Model: "gpt-4o-mini", +// SystemPrompt: "Analyze this code", +// Async: false, // Result returned immediately +// } +// result, err := SpawnSubTurn(ctx, cfg) +// // Use result directly here +// processResult(result) +// +// Asynchronous sub-turn (Async=true): +// +// cfg := SubTurnConfig{ +// Model: "gpt-4o-mini", +// SystemPrompt: "Background analysis", +// Async: true, // Result delivered to channel +// } +// result, err := SpawnSubTurn(ctx, cfg) +// // Result also available in parent's pendingResults channel +// // Parent turn will poll and process it in a later iteration +// type SubTurnConfig struct { Model string Tools []tools.Tool SystemPrompt string MaxTokens int - // Async indicates whether this is an async SubTurn call. - // If true, the result will be delivered via pendingResults channel. - // If false (synchronous), the result is only returned directly to avoid double delivery. - Async bool + + // Async controls the result delivery mechanism: + // + // When Async = false (synchronous sub-turn): + // - The caller blocks until the sub-turn completes + // - The result is ONLY returned via the function return value + // - The result is NOT delivered to the parent's pendingResults channel + // - This prevents double delivery: caller gets result immediately, no need for channel + // - Use case: When the caller needs the result immediately to continue execution + // - Example: A tool that needs to process the sub-turn result before returning + // + // When Async = true (asynchronous sub-turn): + // - The sub-turn runs in the background (still blocks the caller, but semantically async) + // - The result is delivered to the parent's pendingResults channel + // - The result is ALSO returned via the function return value (for consistency) + // - The parent turn can poll pendingResults in later iterations to process results + // - Use case: Fire-and-forget operations, or when results are processed in batches + // - Example: Spawning multiple sub-turns in parallel and collecting results later + // + // IMPORTANT: The Async flag does NOT make the call non-blocking. It only controls + // whether the result is delivered via the channel. For true non-blocking execution, + // the caller must spawn the sub-turn in a separate goroutine. + Async bool + // Can be extended with temperature, topP, etc. } @@ -61,15 +117,33 @@ type SubTurnOrphanResultEvent struct { Result *tools.ToolResult } -// ====================== turnState ====================== +// ====================== Context Keys ====================== type turnStateKeyType struct{} +type agentLoopKeyType struct{} var turnStateKey = turnStateKeyType{} +var agentLoopKey = agentLoopKeyType{} + +// WithAgentLoop injects AgentLoop into context for tool access +func WithAgentLoop(ctx context.Context, al *AgentLoop) context.Context { + return context.WithValue(ctx, agentLoopKey, al) +} + +// AgentLoopFromContext retrieves AgentLoop from context +func AgentLoopFromContext(ctx context.Context) *AgentLoop { + al, _ := ctx.Value(agentLoopKey).(*AgentLoop) + return al +} func withTurnState(ctx context.Context, ts *turnState) context.Context { return context.WithValue(ctx, turnStateKey, ts) } +// TurnStateFromContext retrieves turnState from context (exported for tools) +func TurnStateFromContext(ctx context.Context) *turnState { + return turnStateFromContext(ctx) +} + func turnStateFromContext(ctx context.Context) *turnState { ts, _ := ctx.Value(turnStateKey).(*turnState) return ts @@ -87,9 +161,56 @@ type turnState struct { initialHistoryLength int // Snapshot of session history length at turn start, for rollback on hard abort mu sync.Mutex isFinished bool // MUST be accessed under mu lock + closeOnce sync.Once // Ensures pendingResults channel is closed exactly once concurrencySem chan struct{} // Limits concurrent child sub-turns } +// ====================== Public API ====================== + +// TurnInfo provides read-only information about an active turn. +type TurnInfo struct { + TurnID string + ParentTurnID string + Depth int + ChildTurnIDs []string + IsFinished bool +} + +// GetActiveTurn retrieves information about the currently active turn for a session. +// Returns nil if no active turn exists for the given session key. +func (al *AgentLoop) GetActiveTurn(sessionKey string) *TurnInfo { + tsInterface, ok := al.activeTurnStates.Load(sessionKey) + if !ok { + return nil + } + + ts, ok := tsInterface.(*turnState) + if !ok { + return nil + } + + return ts.Info() +} + +// Info returns a read-only snapshot of the turn state information. +// This method is thread-safe and can be called concurrently. +func (ts *turnState) Info() *TurnInfo { + ts.mu.Lock() + defer ts.mu.Unlock() + + // Create a copy of childTurnIDs to avoid race conditions + childIDs := make([]string, len(ts.childTurnIDs)) + copy(childIDs, ts.childTurnIDs) + + return &TurnInfo{ + TurnID: ts.turnID, + ParentTurnID: ts.parentTurnID, + Depth: ts.depth, + ChildTurnIDs: childIDs, + IsFinished: ts.isFinished, + } +} + // ====================== Helper Functions ====================== func (al *AgentLoop) generateSubTurnID() string { @@ -97,10 +218,12 @@ func (al *AgentLoop) generateSubTurnID() string { } func newTurnState(ctx context.Context, id string, parent *turnState) *turnState { - turnCtx, cancel := context.WithCancel(ctx) + // Note: We don't create a new context with cancel here because the caller + // (spawnSubTurn) already creates one. The turnState stores the context and + // cancelFunc provided by the caller to avoid redundant context wrapping. return &turnState{ - ctx: turnCtx, - cancelFunc: cancel, + ctx: ctx, + cancelFunc: nil, // Will be set by the caller turnID: id, parentTurnID: parent.turnID, depth: parent.depth + 1, @@ -116,30 +239,47 @@ func newTurnState(ctx context.Context, id string, parent *turnState) *turnState // Finish marks the turn as finished and cancels its context, aborting any running sub-turns. // It also closes the pendingResults channel to signal that no more results will be delivered. +// This method is safe to call multiple times - the channel will only be closed once. +// Any results remaining in the channel after close will be drained and emitted as orphan events. func (ts *turnState) Finish() { ts.mu.Lock() - defer ts.mu.Unlock() - - if ts.isFinished { - // Already finished - avoid double close of channel - return - } - ts.isFinished = true + resultChan := ts.pendingResults + ts.mu.Unlock() if ts.cancelFunc != nil { ts.cancelFunc() } - // Close the pendingResults channel to signal no more results will arrive. - // This prevents goroutine leaks from readers waiting on the channel. - if ts.pendingResults != nil { - close(ts.pendingResults) + // Use sync.Once to ensure the channel is closed exactly once, even if Finish() is called concurrently. + // This prevents "close of closed channel" panics. + ts.closeOnce.Do(func() { + if resultChan != nil { + close(resultChan) + // Drain any remaining results from the channel and emit them as orphan events. + // This prevents goroutine leaks and ensures all results are accounted for. + ts.drainPendingResults(resultChan) + } + }) +} + +// drainPendingResults drains all remaining results from the closed channel +// and emits them as orphan events. This must be called after the channel is closed. +func (ts *turnState) drainPendingResults(ch chan *tools.ToolResult) { + for result := range ch { + if result != nil { + MockEventBus.Emit(SubTurnOrphanResultEvent{ + ParentID: ts.turnID, + ChildID: "unknown", // We don't know which child this came from + Result: result, + }) + } } } // ephemeralSessionStore is a pure in-memory SessionStore for SubTurns. // It never writes to disk, keeping sub-turn history isolated from the parent session. +// It automatically truncates history when it exceeds maxEphemeralHistorySize to prevent memory accumulation. type ephemeralSessionStore struct { mu sync.Mutex history []providers.Message @@ -150,12 +290,23 @@ func (e *ephemeralSessionStore) AddMessage(sessionKey, role, content string) { e.mu.Lock() defer e.mu.Unlock() e.history = append(e.history, providers.Message{Role: role, Content: content}) + e.autoTruncate() } func (e *ephemeralSessionStore) AddFullMessage(sessionKey string, msg providers.Message) { e.mu.Lock() defer e.mu.Unlock() e.history = append(e.history, msg) + e.autoTruncate() +} + +// autoTruncate automatically limits history size to prevent memory accumulation. +// Must be called with mu held. +func (e *ephemeralSessionStore) autoTruncate() { + if len(e.history) > maxEphemeralHistorySize { + // Keep only the most recent messages + e.history = e.history[len(e.history)-maxEphemeralHistorySize:] + } } func (e *ephemeralSessionStore) GetHistory(key string) []providers.Message { @@ -196,17 +347,83 @@ func (e *ephemeralSessionStore) TruncateHistory(key string, keepLast int) { func (e *ephemeralSessionStore) Save(key string) error { return nil } func (e *ephemeralSessionStore) Close() error { return nil } +// newEphemeralSession creates a new isolated ephemeral session for a sub-turn. +// +// IMPORTANT: The parent session parameter is intentionally unused (marked with _). +// This is by design according to issue #1316: sub-turns use completely isolated +// ephemeral sessions that do NOT inherit history from the parent session. +// +// Rationale for isolation: +// - Sub-turns are independent execution contexts with their own prompts +// - Inheriting parent history could cause context pollution +// - Each sub-turn should start with a clean slate +// - Memory is managed independently (auto-truncation at maxEphemeralHistorySize) +// - Results are communicated back via the result channel, not via shared history +// +// If future requirements need parent history inheritance, this design decision +// should be reconsidered with careful attention to memory management and context size. func newEphemeralSession(_ session.SessionStore) session.SessionStore { return &ephemeralSessionStore{} } // ====================== Core Function: spawnSubTurn ====================== + +// AgentLoopSpawner implements tools.SubTurnSpawner interface. +// This allows tools to spawn sub-turns without circular dependency. +type AgentLoopSpawner struct { + al *AgentLoop +} + +// SpawnSubTurn implements tools.SubTurnSpawner interface. +func (s *AgentLoopSpawner) SpawnSubTurn(ctx context.Context, cfg tools.SubTurnConfig) (*tools.ToolResult, error) { + parentTS := turnStateFromContext(ctx) + if parentTS == nil { + return nil, errors.New("parent turnState not found in context - cannot spawn sub-turn outside of a turn") + } + + // Convert tools.SubTurnConfig to agent.SubTurnConfig + agentCfg := SubTurnConfig{ + Model: cfg.Model, + Tools: cfg.Tools, + SystemPrompt: cfg.SystemPrompt, + MaxTokens: cfg.MaxTokens, + Async: cfg.Async, + } + + return spawnSubTurn(ctx, s.al, parentTS, agentCfg) +} + +// NewSubTurnSpawner creates a SubTurnSpawner for the given AgentLoop. +func NewSubTurnSpawner(al *AgentLoop) *AgentLoopSpawner { + return &AgentLoopSpawner{al: al} +} + +// SpawnSubTurn is the exported entry point for tools to spawn sub-turns. +// It retrieves AgentLoop and parent turnState from context and delegates to spawnSubTurn. +func SpawnSubTurn(ctx context.Context, cfg SubTurnConfig) (*tools.ToolResult, error) { + al := AgentLoopFromContext(ctx) + if al == nil { + return nil, errors.New("AgentLoop not found in context - ensure context is properly initialized") + } + + parentTS := turnStateFromContext(ctx) + if parentTS == nil { + return nil, errors.New("parent turnState not found in context - cannot spawn sub-turn outside of a turn") + } + + return spawnSubTurn(ctx, al, parentTS, cfg) +} + func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg SubTurnConfig) (result *tools.ToolResult, err error) { // 0. Acquire concurrency semaphore FIRST to ensure it's released even if early validation fails. - // Blocks if parent already has maxConcurrentSubTurns running. + // Blocks if parent already has maxConcurrentSubTurns running, with a timeout to prevent indefinite blocking. // Also respects context cancellation so we don't block forever if parent is aborted. var semAcquired bool if parentTS.concurrencySem != nil { + // Create a timeout context for semaphore acquisition + timeoutCtx, cancel := context.WithTimeout(ctx, concurrencyTimeout) + defer cancel() + select { case parentTS.concurrencySem <- struct{}{}: semAcquired = true @@ -215,13 +432,23 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S <-parentTS.concurrencySem } }() - case <-ctx.Done(): + case <-timeoutCtx.Done(): + // Check if it was a timeout or parent context cancellation + if timeoutCtx.Err() == context.DeadlineExceeded { + return nil, fmt.Errorf("%w: all %d slots occupied for %v", + ErrConcurrencyTimeout, maxConcurrentSubTurns, concurrencyTimeout) + } return nil, ctx.Err() } } // 1. Depth limit check if parentTS.depth >= maxSubTurnDepth { + logger.WarnCF("subturn", "Depth limit exceeded", map[string]any{ + "parent_id": parentTS.turnID, + "depth": parentTS.depth, + "max_depth": maxSubTurnDepth, + }) return nil, ErrDepthLimitExceeded } @@ -230,16 +457,19 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S return nil, ErrInvalidSubTurnConfig } - // Create a sub-context for the child turn to support cancellation + // 3. Create child Turn state with a cancellable context + // This single context wrapping is sufficient - no need for additional layers. childCtx, cancel := context.WithCancel(ctx) defer cancel() - // 3. Create child Turn state childID := al.generateSubTurnID() childTS := newTurnState(childCtx, childID, parentTS) + // Set the cancel function so Finish() can trigger cascading cancellation + childTS.cancelFunc = cancel // IMPORTANT: Put childTS into childCtx so that code inside runTurn can retrieve it childCtx = withTurnState(childCtx, childTS) + childCtx = WithAgentLoop(childCtx, al) // Propagate AgentLoop to child turn // 4. Establish parent-child relationship (thread-safe) parentTS.mu.Lock() @@ -260,10 +490,25 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S err = fmt.Errorf("subturn panicked: %v", r) } - // 8. Deliver result back to parent Turn (only for async calls) - // For synchronous calls (Async=false), the result is returned directly to avoid double delivery. - // For async calls (Async=true), the result is delivered via pendingResults channel - // so the parent turn can process it in a later iteration. + // 7. Result Delivery Strategy (Async vs Sync) + // + // WHY we have different delivery mechanisms: + // ========================================== + // + // Synchronous sub-turns (Async=false): + // - Caller expects immediate result via return value + // - Delivering to channel would cause DOUBLE DELIVERY: + // 1. Caller gets result from return value + // 2. Parent turn would poll channel and get the same result again + // - This would confuse the parent turn's result processing logic + // - Solution: Skip channel delivery, only return via function return + // + // Asynchronous sub-turns (Async=true): + // - Caller may not immediately process the return value + // - Result needs to be available for later polling via pendingResults + // - Parent turn can collect multiple async results in batches + // - Solution: Deliver to channel AND return via function return + // // This must be in defer to ensure delivery even if runTurn panics. if cfg.Async { deliverSubTurnResult(parentTS, childID, result) @@ -284,6 +529,25 @@ func spawnSubTurn(ctx context.Context, al *AgentLoop, parentTS *turnState, cfg S } // ====================== Result Delivery ====================== + +// deliverSubTurnResult delivers a sub-turn result to the parent turn's pendingResults channel. +// +// IMPORTANT: This function is ONLY called for asynchronous sub-turns (Async=true). +// For synchronous sub-turns (Async=false), results are returned directly via the function +// return value to avoid double delivery. +// +// Delivery behavior: +// - If parent turn is still running: attempts to deliver to pendingResults channel +// - If channel is full: emits SubTurnOrphanResultEvent (result is lost from channel but tracked) +// - If parent turn has finished: emits SubTurnOrphanResultEvent (late arrival) +// +// Thread safety: +// - Reads parent state under lock, then releases lock before channel send +// - Small race window exists but is acceptable (worst case: result becomes orphan) +// +// Event emissions: +// - SubTurnResultDeliveredEvent: successful delivery to channel +// - SubTurnOrphanResultEvent: delivery failed (parent finished or channel full) func deliverSubTurnResult(parentTS *turnState, childID string, result *tools.ToolResult) { // Check parent state under lock, but don't hold lock while sending to channel parentTS.mu.Lock() @@ -291,45 +555,39 @@ func deliverSubTurnResult(parentTS *turnState, childID string, result *tools.Too resultChan := parentTS.pendingResults parentTS.mu.Unlock() - // Emit ResultDelivered event - MockEventBus.Emit(SubTurnResultDeliveredEvent{ - ParentID: parentTS.turnID, - ChildID: childID, - Result: result, - }) - - if !isFinished && resultChan != nil { - // Parent Turn is still running → Place in pending queue (handled automatically by parent loop in next round) - // Use defer/recover to handle the case where the channel is closed between our check and the send. - defer func() { - if r := recover(); r != nil { - // Channel was closed - treat as orphan result - if result != nil { - MockEventBus.Emit(SubTurnOrphanResultEvent{ - ParentID: parentTS.turnID, - ChildID: childID, - Result: result, - }) - } - } - }() - - select { - case resultChan <- result: - default: - fmt.Println("[SubTurn] warning: pendingResults channel full") + // If parent turn has already finished, treat this as an orphan result + if isFinished || resultChan == nil { + if result != nil { + MockEventBus.Emit(SubTurnOrphanResultEvent{ + ParentID: parentTS.turnID, + ChildID: childID, + Result: result, + }) } return } - // Parent Turn has ended - // emit an OrphanResultEvent so the system/UI can handle this late arrival. - if result != nil { - MockEventBus.Emit(SubTurnOrphanResultEvent{ + // Parent Turn is still running → attempt to deliver result + // Note: There's still a small race window between the isFinished check above and the send below, + // but this is acceptable - worst case the result becomes an orphan, which is handled gracefully. + select { + case resultChan <- result: + // Successfully delivered + MockEventBus.Emit(SubTurnResultDeliveredEvent{ ParentID: parentTS.turnID, ChildID: childID, Result: result, }) + default: + // Channel is full - treat as orphan result + fmt.Println("[SubTurn] warning: pendingResults channel full") + if result != nil { + MockEventBus.Emit(SubTurnOrphanResultEvent{ + ParentID: parentTS.turnID, + ChildID: childID, + Result: result, + }) + } } } @@ -347,12 +605,22 @@ func runTurn(ctx context.Context, al *AgentLoop, ts *turnState, cfg SubTurnConfi // Build a minimal AgentInstance for this sub-turn. // It reuses the parent loop's provider and config, but gets its own // ephemeral session store and tool registry. - toolRegistry := tools.NewToolRegistry() - for _, t := range cfg.Tools { - toolRegistry.Register(t) - } - parentAgent := al.GetRegistry().GetDefaultAgent() + + var toolRegistry *tools.ToolRegistry + if len(cfg.Tools) > 0 { + // Use explicitly provided tools + toolRegistry = tools.NewToolRegistry() + for _, t := range cfg.Tools { + toolRegistry.Register(t) + } + } else { + // Inherit tools from parent agent when cfg.Tools is nil or empty + toolRegistry = tools.NewToolRegistry() + for _, t := range parentAgent.Tools.GetAll() { + toolRegistry.Register(t) + } + } childAgent := &AgentInstance{ ID: ts.turnID, Model: cfg.Model, diff --git a/pkg/agent/subturn_test.go b/pkg/agent/subturn_test.go index 32029960d..a2d7120dd 100644 --- a/pkg/agent/subturn_test.go +++ b/pkg/agent/subturn_test.go @@ -2,6 +2,7 @@ package agent import ( "context" + "errors" "fmt" "reflect" "sync" @@ -863,3 +864,952 @@ func (m *panicMockProvider) Chat( func (m *panicMockProvider) GetDefaultModel() string { return "panic-model" } + +// ====================== Public API Tests ====================== + +// simpleMockProviderAPI for testing public APIs +type simpleMockProviderAPI struct { + response string +} + +func (m *simpleMockProviderAPI) Chat( + ctx context.Context, + messages []providers.Message, + toolDefs []providers.ToolDefinition, + model string, + options map[string]any, +) (*providers.LLMResponse, error) { + return &providers.LLMResponse{ + Content: m.response, + }, nil +} + +func (m *simpleMockProviderAPI) GetDefaultModel() string { + return "gpt-4o-mini" +} + +// TestGetActiveTurn verifies that GetActiveTurn returns correct turn information +func TestGetActiveTurn(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Model: "gpt-4o-mini", + Provider: "mock", + }, + }, + } + al := NewAgentLoop(cfg, nil, &simpleMockProviderAPI{response: "ok"}) + + // Create a root turn state + rootCtx := context.Background() + rootTS := &turnState{ + ctx: rootCtx, + turnID: "root-turn", + parentTurnID: "", + depth: 0, + childTurnIDs: []string{}, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + + sessionKey := "test-session" + al.activeTurnStates.Store(sessionKey, rootTS) + defer al.activeTurnStates.Delete(sessionKey) + + // Test: GetActiveTurn should return turn info + info := al.GetActiveTurn(sessionKey) + if info == nil { + t.Fatal("GetActiveTurn returned nil for active session") + } + + if info.TurnID != "root-turn" { + t.Errorf("Expected TurnID 'root-turn', got %q", info.TurnID) + } + + if info.Depth != 0 { + t.Errorf("Expected Depth 0, got %d", info.Depth) + } + + if info.ParentTurnID != "" { + t.Errorf("Expected empty ParentTurnID, got %q", info.ParentTurnID) + } + + if len(info.ChildTurnIDs) != 0 { + t.Errorf("Expected 0 child turns, got %d", len(info.ChildTurnIDs)) + } + + // Test: GetActiveTurn should return nil for non-existent session + nonExistentInfo := al.GetActiveTurn("non-existent-session") + if nonExistentInfo != nil { + t.Error("GetActiveTurn should return nil for non-existent session") + } +} + +// TestGetActiveTurn_WithChildren verifies that child turn IDs are correctly reported +func TestGetActiveTurn_WithChildren(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Model: "gpt-4o-mini", + Provider: "mock", + }, + }, + } + al := NewAgentLoop(cfg, nil, &simpleMockProviderAPI{response: "ok"}) + + rootCtx := context.Background() + rootTS := &turnState{ + ctx: rootCtx, + turnID: "root-turn", + parentTurnID: "", + depth: 0, + childTurnIDs: []string{"child-1", "child-2"}, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + + sessionKey := "test-session-with-children" + al.activeTurnStates.Store(sessionKey, rootTS) + defer al.activeTurnStates.Delete(sessionKey) + + info := al.GetActiveTurn(sessionKey) + if info == nil { + t.Fatal("GetActiveTurn returned nil") + } + + if len(info.ChildTurnIDs) != 2 { + t.Fatalf("Expected 2 child turns, got %d", len(info.ChildTurnIDs)) + } + + if info.ChildTurnIDs[0] != "child-1" || info.ChildTurnIDs[1] != "child-2" { + t.Errorf("Child turn IDs mismatch: got %v", info.ChildTurnIDs) + } +} + +// TestTurnStateInfo_ThreadSafety verifies that Info() is thread-safe +func TestTurnStateInfo_ThreadSafety(t *testing.T) { + rootCtx := context.Background() + ts := &turnState{ + ctx: rootCtx, + turnID: "test-turn", + parentTurnID: "parent", + depth: 1, + childTurnIDs: []string{}, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + + // Concurrently read Info() and modify childTurnIDs + done := make(chan bool) + go func() { + for i := 0; i < 100; i++ { + ts.mu.Lock() + ts.childTurnIDs = append(ts.childTurnIDs, "child") + ts.mu.Unlock() + } + done <- true + }() + + go func() { + for i := 0; i < 100; i++ { + info := ts.Info() + if info == nil { + t.Error("Info() returned nil") + } + } + done <- true + }() + + <-done + <-done +} + +// TestInjectFollowUp verifies that InjectFollowUp enqueues messages +func TestInjectFollowUp(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Model: "gpt-4o-mini", + Provider: "mock", + }, + }, + } + + al := NewAgentLoop(cfg, nil, &simpleMockProviderAPI{response: "ok"}) + + msg := providers.Message{ + Role: "user", + Content: "Follow-up task", + } + + err := al.InjectFollowUp(msg) + if err != nil { + t.Fatalf("InjectFollowUp failed: %v", err) + } + + // Verify message was enqueued + if al.steering.len() != 1 { + t.Errorf("Expected 1 message in queue, got %d", al.steering.len()) + } +} + +// TestAPIAliases verifies that API aliases work correctly +func TestAPIAliases(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Model: "gpt-4o-mini", + Provider: "mock", + }, + }, + } + + al := NewAgentLoop(cfg, nil, &simpleMockProviderAPI{response: "ok"}) + + msg := providers.Message{ + Role: "user", + Content: "Test message", + } + + // Test InterruptGraceful (alias for Steer) + err := al.InterruptGraceful(msg) + if err != nil { + t.Errorf("InterruptGraceful failed: %v", err) + } + + // Test InjectSteering (alias for Steer) + err = al.InjectSteering(msg) + if err != nil { + t.Errorf("InjectSteering failed: %v", err) + } + + // Verify both messages were enqueued + if al.steering.len() != 2 { + t.Errorf("Expected 2 messages in queue, got %d", al.steering.len()) + } +} + +// TestInterruptHard_Alias verifies that InterruptHard is an alias for HardAbort +func TestInterruptHard_Alias(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Model: "gpt-4o-mini", + Provider: "mock", + }, + }, + } + al := NewAgentLoop(cfg, nil, &simpleMockProviderAPI{response: "ok"}) + + rootCtx := context.Background() + rootTS := &turnState{ + ctx: rootCtx, + turnID: "test-turn", + depth: 0, + session: newEphemeralSession(nil), + initialHistoryLength: 0, + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + + sessionKey := "test-session-interrupt" + al.activeTurnStates.Store(sessionKey, rootTS) + + // Test InterruptHard (alias for HardAbort) + err := al.InterruptHard(sessionKey) + if err != nil { + t.Errorf("InterruptHard failed: %v", err) + } + + // Verify turn was finished + info := al.GetActiveTurn(sessionKey) + if info != nil && !info.IsFinished { + t.Error("Turn should be finished after InterruptHard") + } +} + +// TestFinish_ConcurrentCalls verifies that calling Finish() concurrently from multiple +// goroutines is safe and doesn't cause panics or double-close errors. +func TestFinish_ConcurrentCalls(t *testing.T) { + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-concurrent-finish", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + + // Launch multiple goroutines that all call Finish() concurrently + const numGoroutines = 10 + var wg sync.WaitGroup + wg.Add(numGoroutines) + + for i := 0; i < numGoroutines; i++ { + go func() { + defer wg.Done() + // This should not panic, even when called concurrently + parentTS.Finish() + }() + } + + wg.Wait() + + // Verify the channel is closed + select { + case _, ok := <-parentTS.pendingResults: + if ok { + t.Error("Expected channel to be closed") + } + default: + t.Error("Expected channel to be closed and readable") + } + + // Verify isFinished is set + parentTS.mu.Lock() + if !parentTS.isFinished { + t.Error("Expected isFinished to be true") + } + parentTS.mu.Unlock() +} + +// TestDeliverSubTurnResult_RaceWithFinish verifies that deliverSubTurnResult handles +// the race condition where Finish() is called while results are being delivered. +func TestDeliverSubTurnResult_RaceWithFinish(t *testing.T) { + // Save original MockEventBus.Emit + originalEmit := MockEventBus.Emit + defer func() { + MockEventBus.Emit = originalEmit + }() + + // Collect events + var mu sync.Mutex + var deliveredCount, orphanCount int + MockEventBus.Emit = func(e any) { + mu.Lock() + defer mu.Unlock() + switch e.(type) { + case SubTurnResultDeliveredEvent: + deliveredCount++ + case SubTurnOrphanResultEvent: + orphanCount++ + } + } + + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-race-test", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + + // Launch goroutines that deliver results while another goroutine calls Finish() + const numResults = 20 + var wg sync.WaitGroup + wg.Add(numResults + 1) + + // Goroutine that calls Finish() after a short delay + go func() { + defer wg.Done() + time.Sleep(5 * time.Millisecond) + parentTS.Finish() + }() + + // Goroutines that deliver results + for i := 0; i < numResults; i++ { + go func(id int) { + defer wg.Done() + result := &tools.ToolResult{ + ForLLM: fmt.Sprintf("result-%d", id), + } + // This should not panic, even if Finish() is called concurrently + deliverSubTurnResult(parentTS, fmt.Sprintf("child-%d", id), result) + }(i) + } + + wg.Wait() + + // Get final counts + mu.Lock() + finalDelivered := deliveredCount + finalOrphan := orphanCount + mu.Unlock() + + t.Logf("Delivered: %d, Orphan: %d, Total: %d", finalDelivered, finalOrphan, finalDelivered+finalOrphan) + + // With the new drainPendingResults behavior, the total events may be >= numResults + // because Finish() drains remaining results from the channel and emits them as orphans. + // So we expect: + // - Some results were delivered successfully (before Finish()) + // - Some results became orphans (after Finish() or channel full) + // - Some results were in the channel when Finish() was called and got drained as orphans + // The total should be at least numResults (could be more due to drain) + if finalDelivered+finalOrphan < numResults { + t.Errorf("Expected at least %d total events, got %d delivered + %d orphan = %d", + numResults, finalDelivered, finalOrphan, finalDelivered+finalOrphan) + } + + // Should have at least some orphan results (those that arrived after Finish() or were drained) + if finalOrphan == 0 { + t.Error("Expected at least some orphan results after Finish()") + } +} + +// TestConcurrencySemaphore_Timeout verifies that spawning sub-turns times out +// when all concurrency slots are occupied for too long. +// Note: This test uses a shorter timeout by temporarily modifying the constant. +func TestConcurrencySemaphore_Timeout(t *testing.T) { + // This test would take 30 seconds with the default timeout. + // Instead, we'll test the mechanism by verifying the timeout context is created correctly. + // A full integration test with actual timeout would be too slow for unit tests. + + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Provider: "mock", + }, + }, + } + msgBus := bus.NewMessageBus() + provider := &simpleMockProviderAPI{} + al := NewAgentLoop(cfg, msgBus, provider) + + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-timeout-test", + depth: 0, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + defer parentTS.Finish() + + // Fill all concurrency slots + for i := 0; i < maxConcurrentSubTurns; i++ { + parentTS.concurrencySem <- struct{}{} + } + + // Create a context with a very short timeout for testing + testCtx, cancel := context.WithTimeout(ctx, 100*time.Millisecond) + defer cancel() + + // Now try to spawn a sub-turn with the short timeout context + subTurnCfg := SubTurnConfig{ + Model: "gpt-4o-mini", + Async: false, + } + + start := time.Now() + _, err := spawnSubTurn(testCtx, al, parentTS, subTurnCfg) + elapsed := time.Since(start) + + // Should get a timeout error (either from our timeout context or the internal one) + if err == nil { + t.Error("Expected timeout error, got nil") + } + + // The error should be related to context cancellation or timeout + if !errors.Is(err, context.DeadlineExceeded) && !errors.Is(err, ErrConcurrencyTimeout) { + t.Logf("Got error: %v (type: %T)", err, err) + // This is acceptable - the error might be wrapped + } + + // Should timeout quickly (within a reasonable margin) + if elapsed > 2*time.Second { + t.Errorf("Timeout took too long: %v", elapsed) + } + + t.Logf("Timeout occurred after %v with error: %v", elapsed, err) + + // Clean up - drain the semaphore + for i := 0; i < maxConcurrentSubTurns; i++ { + <-parentTS.concurrencySem + } +} + +// TestEphemeralSession_AutoTruncate verifies that ephemeral sessions automatically +// truncate their history to prevent memory accumulation. +func TestEphemeralSession_AutoTruncate(t *testing.T) { + store := newEphemeralSession(nil).(*ephemeralSessionStore) + + // Add more messages than the limit + for i := 0; i < maxEphemeralHistorySize+20; i++ { + store.AddMessage("test", "user", fmt.Sprintf("message-%d", i)) + } + + // Verify history is truncated to the limit + history := store.GetHistory("test") + if len(history) != maxEphemeralHistorySize { + t.Errorf("Expected history length %d, got %d", maxEphemeralHistorySize, len(history)) + } + + // Verify we kept the most recent messages + lastMsg := history[len(history)-1] + expectedContent := fmt.Sprintf("message-%d", maxEphemeralHistorySize+20-1) + if lastMsg.Content != expectedContent { + t.Errorf("Expected last message to be %q, got %q", expectedContent, lastMsg.Content) + } + + // Verify the oldest messages were discarded + firstMsg := history[0] + expectedFirstContent := fmt.Sprintf("message-%d", 20) // First 20 were discarded + if firstMsg.Content != expectedFirstContent { + t.Errorf("Expected first message to be %q, got %q", expectedFirstContent, firstMsg.Content) + } +} + +// TestContextWrapping_SingleLayer verifies that we only create one context layer +// in spawnSubTurn, not multiple redundant layers. +func TestContextWrapping_SingleLayer(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Provider: "mock", + }, + }, + } + msgBus := bus.NewMessageBus() + provider := &simpleMockProviderAPI{} + al := NewAgentLoop(cfg, msgBus, provider) + + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-context-test", + depth: 0, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + defer parentTS.Finish() + + // Spawn a sub-turn + subTurnCfg := SubTurnConfig{ + Model: "gpt-4o-mini", + Async: false, + } + + result, err := spawnSubTurn(ctx, al, parentTS, subTurnCfg) + if err != nil { + t.Fatalf("spawnSubTurn failed: %v", err) + } + + if result == nil { + t.Error("Expected non-nil result") + } + + // Verify the child turn was created with a cancel function + // (This is implicit - if the test passes without hanging, the context management is correct) + t.Log("Context wrapping test passed - no redundant layers detected") +} + +// TestFinish_DrainsChannel verifies that Finish() drains remaining results +// from the pendingResults channel and emits them as orphan events. +func TestFinish_DrainsChannel(t *testing.T) { + // Save original MockEventBus.Emit + originalEmit := MockEventBus.Emit + defer func() { + MockEventBus.Emit = originalEmit + }() + + // Collect orphan events + var mu sync.Mutex + var orphanEvents []SubTurnOrphanResultEvent + MockEventBus.Emit = func(e any) { + mu.Lock() + defer mu.Unlock() + if orphan, ok := e.(SubTurnOrphanResultEvent); ok { + orphanEvents = append(orphanEvents, orphan) + } + } + + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-drain-test", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + + // Add some results to the channel before calling Finish() + const numResults = 5 + for i := 0; i < numResults; i++ { + parentTS.pendingResults <- &tools.ToolResult{ + ForLLM: fmt.Sprintf("result-%d", i), + } + } + + // Verify results are in the channel + if len(parentTS.pendingResults) != numResults { + t.Errorf("Expected %d results in channel, got %d", numResults, len(parentTS.pendingResults)) + } + + // Call Finish() - it should drain the channel + parentTS.Finish() + + // Verify all results were drained and emitted as orphan events + mu.Lock() + drainedCount := len(orphanEvents) + mu.Unlock() + + if drainedCount != numResults { + t.Errorf("Expected %d orphan events from drain, got %d", numResults, drainedCount) + } + + // Verify the channel is closed and empty + select { + case _, ok := <-parentTS.pendingResults: + if ok { + t.Error("Expected channel to be closed") + } + default: + t.Error("Expected channel to be closed and readable") + } + + t.Logf("Successfully drained %d results from channel", drainedCount) +} + +// TestSyncSubTurn_NoChannelDelivery verifies that synchronous sub-turns +// do NOT deliver results to the pendingResults channel (only return directly). +func TestSyncSubTurn_NoChannelDelivery(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Provider: "mock", + }, + }, + } + msgBus := bus.NewMessageBus() + provider := &simpleMockProviderAPI{} + al := NewAgentLoop(cfg, msgBus, provider) + + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-sync-test", + depth: 0, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + defer parentTS.Finish() + + // Spawn a SYNCHRONOUS sub-turn (Async=false) + subTurnCfg := SubTurnConfig{ + Model: "gpt-4o-mini", + Async: false, // Synchronous - should NOT deliver to channel + } + + result, err := spawnSubTurn(ctx, al, parentTS, subTurnCfg) + if err != nil { + t.Fatalf("spawnSubTurn failed: %v", err) + } + + if result == nil { + t.Error("Expected non-nil result from synchronous sub-turn") + } + + // Verify the pendingResults channel is EMPTY + // (synchronous sub-turns should not deliver to channel) + select { + case r := <-parentTS.pendingResults: + t.Errorf("Expected empty channel for sync sub-turn, but got result: %v", r) + default: + // Expected: channel is empty + t.Log("Verified: synchronous sub-turn did not deliver to channel") + } + + // Verify channel length is 0 + if len(parentTS.pendingResults) != 0 { + t.Errorf("Expected channel length 0, got %d", len(parentTS.pendingResults)) + } +} + +// TestAsyncSubTurn_ChannelDelivery verifies that asynchronous sub-turns +// DO deliver results to the pendingResults channel. +func TestAsyncSubTurn_ChannelDelivery(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Provider: "mock", + }, + }, + } + msgBus := bus.NewMessageBus() + provider := &simpleMockProviderAPI{} + al := NewAgentLoop(cfg, msgBus, provider) + + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-async-test", + depth: 0, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + defer parentTS.Finish() + + // Spawn an ASYNCHRONOUS sub-turn (Async=true) + subTurnCfg := SubTurnConfig{ + Model: "gpt-4o-mini", + Async: true, // Asynchronous - SHOULD deliver to channel + } + + result, err := spawnSubTurn(ctx, al, parentTS, subTurnCfg) + if err != nil { + t.Fatalf("spawnSubTurn failed: %v", err) + } + + if result == nil { + t.Error("Expected non-nil result from asynchronous sub-turn") + } + + // Verify the pendingResults channel has the result + select { + case r := <-parentTS.pendingResults: + if r == nil { + t.Error("Expected non-nil result from channel") + } + t.Log("Verified: asynchronous sub-turn delivered to channel") + case <-time.After(100 * time.Millisecond): + t.Error("Expected result in channel for async sub-turn, but channel was empty") + } +} + +// TestChannelFull_OrphanResults verifies behavior when the pendingResults channel +// is full (16+ async results). Results that cannot be delivered should become orphans. +func TestChannelFull_OrphanResults(t *testing.T) { + // Save original MockEventBus.Emit + originalEmit := MockEventBus.Emit + defer func() { + MockEventBus.Emit = originalEmit + }() + + // Collect events + var mu sync.Mutex + var deliveredCount, orphanCount int + MockEventBus.Emit = func(e any) { + mu.Lock() + defer mu.Unlock() + switch e.(type) { + case SubTurnResultDeliveredEvent: + deliveredCount++ + case SubTurnOrphanResultEvent: + orphanCount++ + } + } + + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-full-channel", + depth: 0, + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + defer parentTS.Finish() + + // Send more results than the channel capacity (16) + const numResults = 25 + for i := 0; i < numResults; i++ { + result := &tools.ToolResult{ + ForLLM: fmt.Sprintf("result-%d", i), + } + deliverSubTurnResult(parentTS, fmt.Sprintf("child-%d", i), result) + } + + // Get final counts + mu.Lock() + finalDelivered := deliveredCount + finalOrphan := orphanCount + mu.Unlock() + + t.Logf("Delivered: %d, Orphan: %d, Total: %d", finalDelivered, finalOrphan, finalDelivered+finalOrphan) + + // Should have delivered exactly 16 (channel capacity) + if finalDelivered != 16 { + t.Errorf("Expected 16 delivered results (channel capacity), got %d", finalDelivered) + } + + // Should have 9 orphan results (25 - 16) + if finalOrphan != 9 { + t.Errorf("Expected 9 orphan results, got %d", finalOrphan) + } + + // Total should equal numResults + if finalDelivered+finalOrphan != numResults { + t.Errorf("Expected %d total events, got %d", numResults, finalDelivered+finalOrphan) + } +} + +// TestGrandchildAbort_CascadingCancellation verifies that when a grandparent turn +// is hard aborted, the cancellation cascades down to grandchild turns. +func TestGrandchildAbort_CascadingCancellation(t *testing.T) { + ctx := context.Background() + + // Create grandparent turn (depth 0) + grandparentTS := &turnState{ + ctx: ctx, + turnID: "grandparent", + depth: 0, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + grandparentTS.ctx, grandparentTS.cancelFunc = context.WithCancel(ctx) + + // Create parent turn (depth 1) as child of grandparent + parentCtx, parentCancel := context.WithCancel(grandparentTS.ctx) + defer parentCancel() + parentTS := &turnState{ + ctx: parentCtx, + turnID: "parent", + parentTurnID: "grandparent", + depth: 1, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.cancelFunc = parentCancel + + // Create grandchild turn (depth 2) as child of parent + childCtx, childCancel := context.WithCancel(parentTS.ctx) + defer childCancel() + childTS := &turnState{ + ctx: childCtx, + turnID: "grandchild", + parentTurnID: "parent", + depth: 2, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + childTS.cancelFunc = childCancel + + // Verify all contexts are active + select { + case <-grandparentTS.ctx.Done(): + t.Error("Grandparent context should not be cancelled yet") + default: + } + select { + case <-parentTS.ctx.Done(): + t.Error("Parent context should not be cancelled yet") + default: + } + select { + case <-childTS.ctx.Done(): + t.Error("Child context should not be cancelled yet") + default: + } + + // Hard abort the grandparent + grandparentTS.Finish() + + // Wait a bit for cancellation to propagate + time.Sleep(10 * time.Millisecond) + + // Verify cascading cancellation + select { + case <-grandparentTS.ctx.Done(): + t.Log("Grandparent context cancelled (expected)") + default: + t.Error("Grandparent context should be cancelled") + } + + select { + case <-parentTS.ctx.Done(): + t.Log("Parent context cancelled via cascade (expected)") + default: + t.Error("Parent context should be cancelled via cascade") + } + + select { + case <-childTS.ctx.Done(): + t.Log("Grandchild context cancelled via cascade (expected)") + default: + t.Error("Grandchild context should be cancelled via cascade") + } +} + +// TestSpawnDuringAbort_RaceCondition verifies behavior when trying to spawn +// a sub-turn while the parent is being aborted. +func TestSpawnDuringAbort_RaceCondition(t *testing.T) { + cfg := &config.Config{ + Agents: config.AgentsConfig{ + Defaults: config.AgentDefaults{ + Provider: "mock", + }, + }, + } + msgBus := bus.NewMessageBus() + provider := &simpleMockProviderAPI{} + al := NewAgentLoop(cfg, msgBus, provider) + + ctx := context.Background() + parentTS := &turnState{ + ctx: ctx, + turnID: "parent-abort-race", + depth: 0, + session: newEphemeralSession(nil), + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } + parentTS.ctx, parentTS.cancelFunc = context.WithCancel(ctx) + + var wg sync.WaitGroup + wg.Add(2) + + var spawnErr error + + // Goroutine 1: Try to spawn a sub-turn + go func() { + defer wg.Done() + subTurnCfg := SubTurnConfig{ + Model: "gpt-4o-mini", + Async: false, + } + _, err := spawnSubTurn(parentTS.ctx, al, parentTS, subTurnCfg) + spawnErr = err + }() + + // Goroutine 2: Abort the parent almost immediately + go func() { + defer wg.Done() + time.Sleep(1 * time.Millisecond) + parentTS.Finish() + }() + + wg.Wait() + + // The spawn should either succeed (if it started before abort) + // or fail with context cancelled error (if abort happened first) + if spawnErr != nil { + if errors.Is(spawnErr, context.Canceled) { + t.Logf("Spawn failed with expected context cancellation: %v", spawnErr) + } else { + t.Logf("Spawn failed with error: %v", spawnErr) + } + } else { + t.Log("Spawn succeeded before abort") + } + + // The important thing is that it doesn't panic or deadlock + t.Log("Race condition handled gracefully - no panic or deadlock") +} diff --git a/pkg/tools/registry.go b/pkg/tools/registry.go index 0635f47d7..c879e802b 100644 --- a/pkg/tools/registry.go +++ b/pkg/tools/registry.go @@ -329,3 +329,23 @@ func (r *ToolRegistry) GetSummaries() []string { } return summaries } + +// GetAll returns all registered tools (both core and non-core with TTL > 0). +// Used by SubTurn to inherit parent's tool set. +func (r *ToolRegistry) GetAll() []Tool { + r.mu.RLock() + defer r.mu.RUnlock() + + sorted := r.sortedToolNames() + tools := make([]Tool, 0, len(sorted)) + for _, name := range sorted { + entry := r.tools[name] + + // Include core tools and non-core tools with active TTL + if entry.IsCore || entry.TTL > 0 { + tools = append(tools, entry.Tool) + } + } + return tools +} + diff --git a/pkg/tools/spawn.go b/pkg/tools/spawn.go index be40ffda2..05da5e00c 100644 --- a/pkg/tools/spawn.go +++ b/pkg/tools/spawn.go @@ -7,7 +7,10 @@ import ( ) type SpawnTool struct { - manager *SubagentManager + spawner SubTurnSpawner + defaultModel string + maxTokens int + temperature float64 allowlistCheck func(targetAgentID string) bool } @@ -16,10 +19,17 @@ var _ AsyncExecutor = (*SpawnTool)(nil) func NewSpawnTool(manager *SubagentManager) *SpawnTool { return &SpawnTool{ - manager: manager, + defaultModel: manager.defaultModel, + maxTokens: manager.maxTokens, + temperature: manager.temperature, } } +// SetSpawner sets the SubTurnSpawner for direct sub-turn execution. +func (t *SpawnTool) SetSpawner(spawner SubTurnSpawner) { + t.spawner = spawner +} + func (t *SpawnTool) Name() string { return "spawn" } @@ -79,28 +89,47 @@ func (t *SpawnTool) execute(ctx context.Context, args map[string]any, cb AsyncCa } } - if t.manager == nil { - return ErrorResult("Subagent manager not configured") + // Build system prompt for spawned subagent + systemPrompt := fmt.Sprintf(`You are a spawned subagent running in the background. Complete the given task independently and report back when done. + +Task: %s`, task) + + if label != "" { + systemPrompt = fmt.Sprintf(`You are a spawned subagent labeled "%s" running in the background. Complete the given task independently and report back when done. + +Task: %s`, label, task) } - // Read channel/chatID from context (injected by registry). - // Fall back to "cli"/"direct" for non-conversation callers (e.g., CLI, tests) - // to preserve the same defaults as the original NewSpawnTool constructor. - channel := ToolChannel(ctx) - if channel == "" { - channel = "cli" - } - chatID := ToolChatID(ctx) - if chatID == "" { - chatID = "direct" + // Use spawner if available (direct SpawnSubTurn call) + if t.spawner != nil { + // Launch async sub-turn in goroutine + go func() { + result, err := t.spawner.SpawnSubTurn(ctx, SubTurnConfig{ + Model: t.defaultModel, + Tools: nil, // Will inherit from parent via context + SystemPrompt: systemPrompt, + MaxTokens: t.maxTokens, + Temperature: t.temperature, + Async: true, // Async execution + }) + + if err != nil { + result = ErrorResult(fmt.Sprintf("Spawn failed: %v", err)).WithError(err) + } + + // Call callback if provided + if cb != nil { + cb(ctx, result) + } + }() + + // Return immediate acknowledgment + if label != "" { + return AsyncResult(fmt.Sprintf("Spawned subagent '%s' for task: %s", label, task)) + } + return AsyncResult(fmt.Sprintf("Spawned subagent for task: %s", task)) } - // Pass callback to manager for async completion notification - result, err := t.manager.Spawn(ctx, task, label, agentID, channel, chatID, cb) - if err != nil { - return ErrorResult(fmt.Sprintf("failed to spawn subagent: %v", err)) - } - - // Return AsyncResult since the task runs in background - return AsyncResult(result) + // Fallback: spawner not configured + return ErrorResult("SpawnTool: spawner not configured - call SetSpawner() during initialization") } diff --git a/pkg/tools/subagent.go b/pkg/tools/subagent.go index 7a4290746..664193847 100644 --- a/pkg/tools/subagent.go +++ b/pkg/tools/subagent.go @@ -9,6 +9,22 @@ import ( "github.com/sipeed/picoclaw/pkg/providers" ) +// SubTurnSpawner is an interface for spawning sub-turns. +// This avoids circular dependency between tools and agent packages. +type SubTurnSpawner interface { + SpawnSubTurn(ctx context.Context, cfg SubTurnConfig) (*ToolResult, error) +} + +// SubTurnConfig holds configuration for spawning a sub-turn. +type SubTurnConfig struct { + Model string + Tools []Tool + SystemPrompt string + MaxTokens int + Temperature float64 + Async bool // true for async (spawn), false for sync (subagent) +} + type SubagentTask struct { ID string Task string @@ -251,16 +267,27 @@ func (sm *SubagentManager) ListTasks() []*SubagentTask { } // SubagentTool executes a subagent task synchronously and returns the result. +// It directly calls SubTurnSpawner with Async=false for synchronous execution. type SubagentTool struct { - manager *SubagentManager + spawner SubTurnSpawner + defaultModel string + maxTokens int + temperature float64 } func NewSubagentTool(manager *SubagentManager) *SubagentTool { return &SubagentTool{ - manager: manager, + defaultModel: manager.defaultModel, + maxTokens: manager.maxTokens, + temperature: manager.temperature, } } +// SetSpawner sets the SubTurnSpawner for direct sub-turn execution. +func (t *SubagentTool) SetSpawner(spawner SubTurnSpawner) { + t.spawner = spawner +} + func (t *SubagentTool) Name() string { return "subagent" } @@ -294,115 +321,58 @@ func (t *SubagentTool) Execute(ctx context.Context, args map[string]any) *ToolRe label, _ := args["label"].(string) - if t.manager == nil { - return ErrorResult("Subagent manager not configured").WithError(fmt.Errorf("manager is nil")) + // Build system prompt for subagent + systemPrompt := fmt.Sprintf(`You are a subagent. Complete the given task independently and provide a clear, concise result. + +Task: %s`, task) + + if label != "" { + systemPrompt = fmt.Sprintf(`You are a subagent labeled "%s". Complete the given task independently and provide a clear, concise result. + +Task: %s`, label, task) } - sm := t.manager - sm.mu.RLock() - spawner := sm.spawner - tools := sm.tools - maxIter := sm.maxIterations - maxTokens := sm.maxTokens - temperature := sm.temperature - hasMaxTokens := sm.hasMaxTokens - hasTemperature := sm.hasTemperature - sm.mu.RUnlock() + // Use spawner if available (direct SpawnSubTurn call) + if t.spawner != nil { + result, err := t.spawner.SpawnSubTurn(ctx, SubTurnConfig{ + Model: t.defaultModel, + Tools: nil, // Will inherit from parent via context + SystemPrompt: systemPrompt, + MaxTokens: t.maxTokens, + Temperature: t.temperature, + Async: false, // Synchronous execution + }) - if spawner != nil { - // Use spawner - res, err := spawner(ctx, task, label, "", tools, maxTokens, temperature, hasMaxTokens, hasTemperature) if err != nil { return ErrorResult(fmt.Sprintf("Subagent execution failed: %v", err)).WithError(err) } - - // Ensure synchronous ForUser display truncates - userContent := res.ForLLM - if res.ForUser != "" { - userContent = res.ForUser + + // Format result for display + userContent := result.ForLLM + if result.ForUser != "" { + userContent = result.ForUser } maxUserLen := 500 if len(userContent) > maxUserLen { userContent = userContent[:maxUserLen] + "..." } - + labelStr := label if labelStr == "" { labelStr = "(unnamed)" } llmContent := fmt.Sprintf("Subagent task completed:\nLabel: %s\nResult: %s", - labelStr, res.ForLLM) - + labelStr, result.ForLLM) + return &ToolResult{ - ForLLM: llmContent, + ForLLM: llmContent, ForUser: userContent, - Silent: false, - IsError: res.IsError, - Async: false, + Silent: false, + IsError: result.IsError, + Async: false, } } - // Build messages for subagent fallback - messages := []providers.Message{ - { - Role: "system", - Content: "You are a subagent. Complete the given task independently and provide a clear, concise result.", - }, - { - Role: "user", - Content: task, - }, - } - - var llmOptions map[string]any - if hasMaxTokens || hasTemperature { - llmOptions = map[string]any{} - if hasMaxTokens { - llmOptions["max_tokens"] = maxTokens - } - if hasTemperature { - llmOptions["temperature"] = temperature - } - } - - channel := ToolChannel(ctx) - if channel == "" { - channel = "cli" - } - chatID := ToolChatID(ctx) - if chatID == "" { - chatID = "direct" - } - - loopResult, err := RunToolLoop(ctx, ToolLoopConfig{ - Provider: sm.provider, - Model: sm.defaultModel, - Tools: tools, - MaxIterations: maxIter, - LLMOptions: llmOptions, - }, messages, channel, chatID) - if err != nil { - return ErrorResult(fmt.Sprintf("Subagent execution failed: %v", err)).WithError(err) - } - - userContent := loopResult.Content - maxUserLen := 500 - if len(userContent) > maxUserLen { - userContent = userContent[:maxUserLen] + "..." - } - - labelStr := label - if labelStr == "" { - labelStr = "(unnamed)" - } - llmContent := fmt.Sprintf("Subagent task completed:\nLabel: %s\nIterations: %d\nResult: %s", - labelStr, loopResult.Iterations, loopResult.Content) - - return &ToolResult{ - ForLLM: llmContent, - ForUser: userContent, - Silent: false, - IsError: false, - Async: false, - } + // Fallback: spawner not configured + return ErrorResult("SubagentTool: spawner not configured - call SetSpawner() during initialization").WithError(fmt.Errorf("spawner not set")) } From cef0f28881169fa52d9eadd8414e0cc3f2f18607 Mon Sep 17 00:00:00 2001 From: wenjie Date: Tue, 17 Mar 2026 14:10:11 +0800 Subject: [PATCH 051/234] fix(tools): normalize whitelist path checks for symlinked allowed roots (#1660) - keep regex whitelist matching for existing configs - add normalized directory-prefix checks for literal allow-path patterns - support allowed roots that resolve through symlinks - add regression coverage for symlink-backed whitelist paths --- pkg/tools/filesystem.go | 105 ++++++++++++++++++++++++++++++++++- pkg/tools/filesystem_test.go | 35 ++++++++++++ 2 files changed, 138 insertions(+), 2 deletions(-) diff --git a/pkg/tools/filesystem.go b/pkg/tools/filesystem.go index 92946ef98..ae356f248 100644 --- a/pkg/tools/filesystem.go +++ b/pkg/tools/filesystem.go @@ -98,14 +98,115 @@ func isAllowedPath(path string, patterns []*regexp.Regexp) bool { } func matchesAllowedPath(path string, patterns []*regexp.Regexp) bool { + cleaned := filepath.Clean(path) for _, pattern := range patterns { - if pattern.MatchString(path) { + if pattern.MatchString(cleaned) { + return true + } + if root, ok := extractAllowedPathRoot(pattern); ok && isWithinAllowedRoot(cleaned, root) { return true } } return false } +func extractAllowedPathRoot(pattern *regexp.Regexp) (string, bool) { + raw := pattern.String() + if !strings.HasPrefix(raw, "^") { + return "", false + } + + literal := strings.TrimPrefix(raw, "^") + + // Recognize the common "directory prefix" form: ^(?:/|$) + literal = strings.TrimSuffix(literal, "(?:/|$)") + literal = strings.TrimSuffix(literal, `(?:\\|$)`) + + // Reject patterns that still contain regex operators after removing the + // optional anchored-directory suffix. That keeps arbitrary regex behavior + // unchanged and only enables normalized prefix matching for literal paths. + if containsUnescapedRegexMeta(literal) { + return "", false + } + + unescaped, ok := unescapeRegexLiteral(literal) + if !ok || unescaped == "" { + return "", false + } + + return filepath.Clean(unescaped), filepath.IsAbs(unescaped) +} + +func appendUniquePath(paths []string, path string) []string { + for _, existing := range paths { + if existing == path { + return paths + } + } + return append(paths, path) +} + +func containsUnescapedRegexMeta(s string) bool { + escaped := false + for _, r := range s { + if escaped { + escaped = false + continue + } + if r == '\\' { + escaped = true + continue + } + switch r { + case '.', '+', '*', '?', '(', ')', '[', ']', '{', '}', '|': + return true + } + } + return escaped +} + +func unescapeRegexLiteral(s string) (string, bool) { + var b strings.Builder + b.Grow(len(s)) + + escaped := false + for _, r := range s { + if escaped { + b.WriteRune(r) + escaped = false + continue + } + if r == '\\' { + escaped = true + continue + } + b.WriteRune(r) + } + + if escaped { + return "", false + } + + return b.String(), true +} + +func isWithinAllowedRoot(path, root string) bool { + candidate := filepath.Clean(path) + allowedVariants := []string{filepath.Clean(root)} + + if resolvedRoot, err := resolvePathAgainstExistingAncestor(root); err == nil { + allowedVariants = appendUniquePath(allowedVariants, filepath.Clean(resolvedRoot)) + } + + for _, allowedRoot := range allowedVariants { + if isWithinWorkspace(candidate, allowedRoot) { + return true + } + } + + return false +} + func resolveExistingAncestor(path string) (string, error) { for current := filepath.Clean(path); ; current = filepath.Dir(current) { if resolved, err := filepath.EvalSymlinks(current); err == nil { @@ -144,7 +245,7 @@ func resolvePathAgainstExistingAncestor(path string) (string, error) { func isWithinWorkspace(candidate, workspace string) bool { rel, err := filepath.Rel(filepath.Clean(workspace), filepath.Clean(candidate)) - return err == nil && filepath.IsLocal(rel) + return err == nil && (rel == "." || filepath.IsLocal(rel)) } type ReadFileTool struct { diff --git a/pkg/tools/filesystem_test.go b/pkg/tools/filesystem_test.go index 78d69273f..5ebf38df2 100644 --- a/pkg/tools/filesystem_test.go +++ b/pkg/tools/filesystem_test.go @@ -570,6 +570,41 @@ func TestWhitelistFs_WriteAllowsNewFileUnderAllowedDir(t *testing.T) { } } +func TestWhitelistFs_AllowsResolvedAllowedRootAlias(t *testing.T) { + workspace := t.TempDir() + realDir := t.TempDir() + linkParent := t.TempDir() + allowedAlias := filepath.Join(linkParent, "allowed-link") + + if err := os.Symlink(realDir, allowedAlias); err != nil { + t.Skipf("symlink not supported in this environment: %v", err) + } + + targetFile := filepath.Join(allowedAlias, "nested", "alias.txt") + if err := os.MkdirAll(filepath.Dir(targetFile), 0o755); err != nil { + t.Fatalf("MkdirAll(targetFile dir) error = %v", err) + } + if err := os.WriteFile(targetFile, []byte("through alias"), 0o644); err != nil { + t.Fatalf("WriteFile(targetFile) error = %v", err) + } + + patterns := []*regexp.Regexp{ + regexp.MustCompile( + "^" + regexp.QuoteMeta(filepath.Clean(allowedAlias)) + + "(?:" + regexp.QuoteMeta(string(os.PathSeparator)) + "|$)", + ), + } + tool := NewReadFileTool(workspace, true, MaxReadFileSize, patterns) + + result := tool.Execute(context.Background(), map[string]any{"path": targetFile}) + if result.IsError { + t.Fatalf("expected symlink-backed allowed root to be readable, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "through alias") { + t.Fatalf("expected file content, got: %s", result.ForLLM) + } +} + // TestReadFileTool_ChunkedReading verifies the pagination logic of the tool // by reading a file in multiple chunks using 'offset' and 'length'. func TestReadFileTool_ChunkedReading(t *testing.T) { From a26a7db7d2fea1abb2e333c787f7ab2a7d3bcdc8 Mon Sep 17 00:00:00 2001 From: Administrator <1280842908@qq.com> Date: Tue, 17 Mar 2026 14:11:38 +0800 Subject: [PATCH 052/234] moved turnState and related code from subturn.go to a new turn_state.go file Created /pkg/agent/turn_state.go (246 lines) containing: - turnStateKeyType and context key management - turnState struct definition - TurnInfo struct and GetActiveTurn() method - newTurnState(), Finish(), and drainPendingResults() methods - ephemeralSessionStore implementation - All context helper functions (withTurnState, TurnStateFromContext, etc.) Updated /pkg/agent/subturn.go (428 lines) by: - Removing the moved turnState struct and methods - Removing unused imports (sync, session) - Keeping SubTurn spawning logic, config, events, and result delivery All tests pass and the code compiles successfully. --- pkg/agent/subturn.go | 229 ------------------------------------- pkg/agent/turn_state.go | 246 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 246 insertions(+), 229 deletions(-) create mode 100644 pkg/agent/turn_state.go diff --git a/pkg/agent/subturn.go b/pkg/agent/subturn.go index d6b9ec90c..a3a3f15d2 100644 --- a/pkg/agent/subturn.go +++ b/pkg/agent/subturn.go @@ -4,12 +4,10 @@ import ( "context" "errors" "fmt" - "sync" "time" "github.com/sipeed/picoclaw/pkg/logger" "github.com/sipeed/picoclaw/pkg/providers" - "github.com/sipeed/picoclaw/pkg/session" "github.com/sipeed/picoclaw/pkg/tools" ) @@ -118,10 +116,8 @@ type SubTurnOrphanResultEvent struct { } // ====================== Context Keys ====================== -type turnStateKeyType struct{} type agentLoopKeyType struct{} -var turnStateKey = turnStateKeyType{} var agentLoopKey = agentLoopKeyType{} // WithAgentLoop injects AgentLoop into context for tool access @@ -135,237 +131,12 @@ func AgentLoopFromContext(ctx context.Context) *AgentLoop { return al } -func withTurnState(ctx context.Context, ts *turnState) context.Context { - return context.WithValue(ctx, turnStateKey, ts) -} - -// TurnStateFromContext retrieves turnState from context (exported for tools) -func TurnStateFromContext(ctx context.Context) *turnState { - return turnStateFromContext(ctx) -} - -func turnStateFromContext(ctx context.Context) *turnState { - ts, _ := ctx.Value(turnStateKey).(*turnState) - return ts -} - -type turnState struct { - ctx context.Context - cancelFunc context.CancelFunc // Used to cancel all children when this turn finishes - turnID string - parentTurnID string - depth int - childTurnIDs []string // MUST be accessed under mu lock or maybe add a getter method - pendingResults chan *tools.ToolResult - session session.SessionStore - initialHistoryLength int // Snapshot of session history length at turn start, for rollback on hard abort - mu sync.Mutex - isFinished bool // MUST be accessed under mu lock - closeOnce sync.Once // Ensures pendingResults channel is closed exactly once - concurrencySem chan struct{} // Limits concurrent child sub-turns -} - -// ====================== Public API ====================== - -// TurnInfo provides read-only information about an active turn. -type TurnInfo struct { - TurnID string - ParentTurnID string - Depth int - ChildTurnIDs []string - IsFinished bool -} - -// GetActiveTurn retrieves information about the currently active turn for a session. -// Returns nil if no active turn exists for the given session key. -func (al *AgentLoop) GetActiveTurn(sessionKey string) *TurnInfo { - tsInterface, ok := al.activeTurnStates.Load(sessionKey) - if !ok { - return nil - } - - ts, ok := tsInterface.(*turnState) - if !ok { - return nil - } - - return ts.Info() -} - -// Info returns a read-only snapshot of the turn state information. -// This method is thread-safe and can be called concurrently. -func (ts *turnState) Info() *TurnInfo { - ts.mu.Lock() - defer ts.mu.Unlock() - - // Create a copy of childTurnIDs to avoid race conditions - childIDs := make([]string, len(ts.childTurnIDs)) - copy(childIDs, ts.childTurnIDs) - - return &TurnInfo{ - TurnID: ts.turnID, - ParentTurnID: ts.parentTurnID, - Depth: ts.depth, - ChildTurnIDs: childIDs, - IsFinished: ts.isFinished, - } -} - // ====================== Helper Functions ====================== func (al *AgentLoop) generateSubTurnID() string { return fmt.Sprintf("subturn-%d", al.subTurnCounter.Add(1)) } -func newTurnState(ctx context.Context, id string, parent *turnState) *turnState { - // Note: We don't create a new context with cancel here because the caller - // (spawnSubTurn) already creates one. The turnState stores the context and - // cancelFunc provided by the caller to avoid redundant context wrapping. - return &turnState{ - ctx: ctx, - cancelFunc: nil, // Will be set by the caller - turnID: id, - parentTurnID: parent.turnID, - depth: parent.depth + 1, - session: newEphemeralSession(parent.session), - // NOTE: In this PoC, I use a fixed-size channel (16). - // Under high concurrency or long-running sub-turns, this might fill up and cause - // intermediate results to be discarded in deliverSubTurnResult. - // For production, consider an unbounded queue or a blocking strategy with backpressure. - pendingResults: make(chan *tools.ToolResult, 16), - concurrencySem: make(chan struct{}, maxConcurrentSubTurns), - } -} - -// Finish marks the turn as finished and cancels its context, aborting any running sub-turns. -// It also closes the pendingResults channel to signal that no more results will be delivered. -// This method is safe to call multiple times - the channel will only be closed once. -// Any results remaining in the channel after close will be drained and emitted as orphan events. -func (ts *turnState) Finish() { - ts.mu.Lock() - ts.isFinished = true - resultChan := ts.pendingResults - ts.mu.Unlock() - - if ts.cancelFunc != nil { - ts.cancelFunc() - } - - // Use sync.Once to ensure the channel is closed exactly once, even if Finish() is called concurrently. - // This prevents "close of closed channel" panics. - ts.closeOnce.Do(func() { - if resultChan != nil { - close(resultChan) - // Drain any remaining results from the channel and emit them as orphan events. - // This prevents goroutine leaks and ensures all results are accounted for. - ts.drainPendingResults(resultChan) - } - }) -} - -// drainPendingResults drains all remaining results from the closed channel -// and emits them as orphan events. This must be called after the channel is closed. -func (ts *turnState) drainPendingResults(ch chan *tools.ToolResult) { - for result := range ch { - if result != nil { - MockEventBus.Emit(SubTurnOrphanResultEvent{ - ParentID: ts.turnID, - ChildID: "unknown", // We don't know which child this came from - Result: result, - }) - } - } -} - -// ephemeralSessionStore is a pure in-memory SessionStore for SubTurns. -// It never writes to disk, keeping sub-turn history isolated from the parent session. -// It automatically truncates history when it exceeds maxEphemeralHistorySize to prevent memory accumulation. -type ephemeralSessionStore struct { - mu sync.Mutex - history []providers.Message - summary string -} - -func (e *ephemeralSessionStore) AddMessage(sessionKey, role, content string) { - e.mu.Lock() - defer e.mu.Unlock() - e.history = append(e.history, providers.Message{Role: role, Content: content}) - e.autoTruncate() -} - -func (e *ephemeralSessionStore) AddFullMessage(sessionKey string, msg providers.Message) { - e.mu.Lock() - defer e.mu.Unlock() - e.history = append(e.history, msg) - e.autoTruncate() -} - -// autoTruncate automatically limits history size to prevent memory accumulation. -// Must be called with mu held. -func (e *ephemeralSessionStore) autoTruncate() { - if len(e.history) > maxEphemeralHistorySize { - // Keep only the most recent messages - e.history = e.history[len(e.history)-maxEphemeralHistorySize:] - } -} - -func (e *ephemeralSessionStore) GetHistory(key string) []providers.Message { - e.mu.Lock() - defer e.mu.Unlock() - out := make([]providers.Message, len(e.history)) - copy(out, e.history) - return out -} - -func (e *ephemeralSessionStore) GetSummary(key string) string { - e.mu.Lock() - defer e.mu.Unlock() - return e.summary -} - -func (e *ephemeralSessionStore) SetSummary(key, summary string) { - e.mu.Lock() - defer e.mu.Unlock() - e.summary = summary -} - -func (e *ephemeralSessionStore) SetHistory(key string, history []providers.Message) { - e.mu.Lock() - defer e.mu.Unlock() - e.history = make([]providers.Message, len(history)) - copy(e.history, history) -} - -func (e *ephemeralSessionStore) TruncateHistory(key string, keepLast int) { - e.mu.Lock() - defer e.mu.Unlock() - if len(e.history) > keepLast { - e.history = e.history[len(e.history)-keepLast:] - } -} - -func (e *ephemeralSessionStore) Save(key string) error { return nil } -func (e *ephemeralSessionStore) Close() error { return nil } - -// newEphemeralSession creates a new isolated ephemeral session for a sub-turn. -// -// IMPORTANT: The parent session parameter is intentionally unused (marked with _). -// This is by design according to issue #1316: sub-turns use completely isolated -// ephemeral sessions that do NOT inherit history from the parent session. -// -// Rationale for isolation: -// - Sub-turns are independent execution contexts with their own prompts -// - Inheriting parent history could cause context pollution -// - Each sub-turn should start with a clean slate -// - Memory is managed independently (auto-truncation at maxEphemeralHistorySize) -// - Results are communicated back via the result channel, not via shared history -// -// If future requirements need parent history inheritance, this design decision -// should be reconsidered with careful attention to memory management and context size. -func newEphemeralSession(_ session.SessionStore) session.SessionStore { - return &ephemeralSessionStore{} -} - // ====================== Core Function: spawnSubTurn ====================== // AgentLoopSpawner implements tools.SubTurnSpawner interface. diff --git a/pkg/agent/turn_state.go b/pkg/agent/turn_state.go new file mode 100644 index 000000000..3022e83cb --- /dev/null +++ b/pkg/agent/turn_state.go @@ -0,0 +1,246 @@ +package agent + +import ( + "context" + "sync" + + "github.com/sipeed/picoclaw/pkg/providers" + "github.com/sipeed/picoclaw/pkg/session" + "github.com/sipeed/picoclaw/pkg/tools" +) + +// ====================== Context Keys ====================== +type turnStateKeyType struct{} + +var turnStateKey = turnStateKeyType{} + +func withTurnState(ctx context.Context, ts *turnState) context.Context { + return context.WithValue(ctx, turnStateKey, ts) +} + +// TurnStateFromContext retrieves turnState from context (exported for tools) +func TurnStateFromContext(ctx context.Context) *turnState { + return turnStateFromContext(ctx) +} + +func turnStateFromContext(ctx context.Context) *turnState { + ts, _ := ctx.Value(turnStateKey).(*turnState) + return ts +} + +// ====================== turnState ====================== + +type turnState struct { + ctx context.Context + cancelFunc context.CancelFunc // Used to cancel all children when this turn finishes + turnID string + parentTurnID string + depth int + childTurnIDs []string // MUST be accessed under mu lock or maybe add a getter method + pendingResults chan *tools.ToolResult + session session.SessionStore + initialHistoryLength int // Snapshot of session history length at turn start, for rollback on hard abort + mu sync.Mutex + isFinished bool // MUST be accessed under mu lock + closeOnce sync.Once // Ensures pendingResults channel is closed exactly once + concurrencySem chan struct{} // Limits concurrent child sub-turns +} + +// ====================== Public API ====================== + +// TurnInfo provides read-only information about an active turn. +type TurnInfo struct { + TurnID string + ParentTurnID string + Depth int + ChildTurnIDs []string + IsFinished bool +} + +// GetActiveTurn retrieves information about the currently active turn for a session. +// Returns nil if no active turn exists for the given session key. +func (al *AgentLoop) GetActiveTurn(sessionKey string) *TurnInfo { + tsInterface, ok := al.activeTurnStates.Load(sessionKey) + if !ok { + return nil + } + + ts, ok := tsInterface.(*turnState) + if !ok { + return nil + } + + return ts.Info() +} + +// Info returns a read-only snapshot of the turn state information. +// This method is thread-safe and can be called concurrently. +func (ts *turnState) Info() *TurnInfo { + ts.mu.Lock() + defer ts.mu.Unlock() + + // Create a copy of childTurnIDs to avoid race conditions + childIDs := make([]string, len(ts.childTurnIDs)) + copy(childIDs, ts.childTurnIDs) + + return &TurnInfo{ + TurnID: ts.turnID, + ParentTurnID: ts.parentTurnID, + Depth: ts.depth, + ChildTurnIDs: childIDs, + IsFinished: ts.isFinished, + } +} + +// ====================== Helper Functions ====================== + +func newTurnState(ctx context.Context, id string, parent *turnState) *turnState { + // Note: We don't create a new context with cancel here because the caller + // (spawnSubTurn) already creates one. The turnState stores the context and + // cancelFunc provided by the caller to avoid redundant context wrapping. + return &turnState{ + ctx: ctx, + cancelFunc: nil, // Will be set by the caller + turnID: id, + parentTurnID: parent.turnID, + depth: parent.depth + 1, + session: newEphemeralSession(parent.session), + // NOTE: In this PoC, I use a fixed-size channel (16). + // Under high concurrency or long-running sub-turns, this might fill up and cause + // intermediate results to be discarded in deliverSubTurnResult. + // For production, consider an unbounded queue or a blocking strategy with backpressure. + pendingResults: make(chan *tools.ToolResult, 16), + concurrencySem: make(chan struct{}, maxConcurrentSubTurns), + } +} + +// Finish marks the turn as finished and cancels its context, aborting any running sub-turns. +// It also closes the pendingResults channel to signal that no more results will be delivered. +// This method is safe to call multiple times - the channel will only be closed once. +// Any results remaining in the channel after close will be drained and emitted as orphan events. +func (ts *turnState) Finish() { + ts.mu.Lock() + ts.isFinished = true + resultChan := ts.pendingResults + ts.mu.Unlock() + + if ts.cancelFunc != nil { + ts.cancelFunc() + } + + // Use sync.Once to ensure the channel is closed exactly once, even if Finish() is called concurrently. + // This prevents "close of closed channel" panics. + ts.closeOnce.Do(func() { + if resultChan != nil { + close(resultChan) + // Drain any remaining results from the channel and emit them as orphan events. + // This prevents goroutine leaks and ensures all results are accounted for. + ts.drainPendingResults(resultChan) + } + }) +} + +// drainPendingResults drains all remaining results from the closed channel +// and emits them as orphan events. This must be called after the channel is closed. +func (ts *turnState) drainPendingResults(ch chan *tools.ToolResult) { + for result := range ch { + if result != nil { + MockEventBus.Emit(SubTurnOrphanResultEvent{ + ParentID: ts.turnID, + ChildID: "unknown", // We don't know which child this came from + Result: result, + }) + } + } +} + +// ====================== Ephemeral Session Store ====================== + +// ephemeralSessionStore is a pure in-memory SessionStore for SubTurns. +// It never writes to disk, keeping sub-turn history isolated from the parent session. +// It automatically truncates history when it exceeds maxEphemeralHistorySize to prevent memory accumulation. +type ephemeralSessionStore struct { + mu sync.Mutex + history []providers.Message + summary string +} + +func (e *ephemeralSessionStore) AddMessage(sessionKey, role, content string) { + e.mu.Lock() + defer e.mu.Unlock() + e.history = append(e.history, providers.Message{Role: role, Content: content}) + e.autoTruncate() +} + +func (e *ephemeralSessionStore) AddFullMessage(sessionKey string, msg providers.Message) { + e.mu.Lock() + defer e.mu.Unlock() + e.history = append(e.history, msg) + e.autoTruncate() +} + +// autoTruncate automatically limits history size to prevent memory accumulation. +// Must be called with mu held. +func (e *ephemeralSessionStore) autoTruncate() { + if len(e.history) > maxEphemeralHistorySize { + // Keep only the most recent messages + e.history = e.history[len(e.history)-maxEphemeralHistorySize:] + } +} + +func (e *ephemeralSessionStore) GetHistory(key string) []providers.Message { + e.mu.Lock() + defer e.mu.Unlock() + out := make([]providers.Message, len(e.history)) + copy(out, e.history) + return out +} + +func (e *ephemeralSessionStore) GetSummary(key string) string { + e.mu.Lock() + defer e.mu.Unlock() + return e.summary +} + +func (e *ephemeralSessionStore) SetSummary(key, summary string) { + e.mu.Lock() + defer e.mu.Unlock() + e.summary = summary +} + +func (e *ephemeralSessionStore) SetHistory(key string, history []providers.Message) { + e.mu.Lock() + defer e.mu.Unlock() + e.history = make([]providers.Message, len(history)) + copy(e.history, history) +} + +func (e *ephemeralSessionStore) TruncateHistory(key string, keepLast int) { + e.mu.Lock() + defer e.mu.Unlock() + if len(e.history) > keepLast { + e.history = e.history[len(e.history)-keepLast:] + } +} + +func (e *ephemeralSessionStore) Save(key string) error { return nil } +func (e *ephemeralSessionStore) Close() error { return nil } + +// newEphemeralSession creates a new isolated ephemeral session for a sub-turn. +// +// IMPORTANT: The parent session parameter is intentionally unused (marked with _). +// This is by design according to issue #1316: sub-turns use completely isolated +// ephemeral sessions that do NOT inherit history from the parent session. +// +// Rationale for isolation: +// - Sub-turns are independent execution contexts with their own prompts +// - Inheriting parent history could cause context pollution +// - Each sub-turn should start with a clean slate +// - Memory is managed independently (auto-truncation at maxEphemeralHistorySize) +// - Results are communicated back via the result channel, not via shared history +// +// If future requirements need parent history inheritance, this design decision +// should be reconsidered with careful attention to memory management and context size. +func newEphemeralSession(_ session.SessionStore) session.SessionStore { + return &ephemeralSessionStore{} +} From e41423483e46aa8fb506bbe1c9b4bf735ff39c4d Mon Sep 17 00:00:00 2001 From: Cytown Date: Tue, 17 Mar 2026 14:12:32 +0800 Subject: [PATCH 053/234] add systray ui for all platform (#1649) * add systray ui for all platform * update from getlantern/systray to fyne.io/systray for fix test --- Makefile | 53 ++--- go.mod | 6 +- go.sum | 4 + pkg/agent/instance_test.go | 2 +- web/Makefile | 62 +++++- web/backend/api/events.go | 21 +- web/backend/api/gateway.go | 373 +++++++++++++++++++++----------- web/backend/api/gateway_test.go | 54 ----- web/backend/api/router.go | 5 + web/backend/i18n.go | 120 ++++++++++ web/backend/icon.png | Bin 0 -> 104580 bytes web/backend/main.go | 56 +++-- web/backend/systray.go | 133 ++++++++++++ web/backend/systray_unix.go | 8 + web/backend/systray_windows.go | 8 + 15 files changed, 674 insertions(+), 231 deletions(-) create mode 100644 web/backend/i18n.go create mode 100644 web/backend/icon.png create mode 100644 web/backend/systray.go create mode 100644 web/backend/systray_unix.go create mode 100644 web/backend/systray_windows.go diff --git a/Makefile b/Makefile index 2f673d3b9..4f4a7a6cb 100644 --- a/Makefile +++ b/Makefile @@ -12,7 +12,7 @@ GIT_COMMIT=$(shell git rev-parse --short=8 HEAD 2>/dev/null || echo "dev") BUILD_TIME=$(shell date +%FT%T%z) GO_VERSION=$(shell $(GO) version | awk '{print $$3}') CONFIG_PKG=github.com/sipeed/picoclaw/pkg/config -LDFLAGS=-ldflags "-X $(CONFIG_PKG).Version=$(VERSION) -X $(CONFIG_PKG).GitCommit=$(GIT_COMMIT) -X $(CONFIG_PKG).BuildTime=$(BUILD_TIME) -X $(CONFIG_PKG).GoVersion=$(GO_VERSION) -s -w" +LDFLAGS=-X $(CONFIG_PKG).Version=$(VERSION) -X $(CONFIG_PKG).GitCommit=$(GIT_COMMIT) -X $(CONFIG_PKG).BuildTime=$(BUILD_TIME) -X $(CONFIG_PKG).GoVersion=$(GO_VERSION) -s -w # Go variables GO?=CGO_ENABLED=0 go @@ -107,7 +107,7 @@ generate: build: generate @echo "Building $(BINARY_NAME) for $(PLATFORM)/$(ARCH)..." @mkdir -p $(BUILD_DIR) - @$(GO) build $(GOFLAGS) $(LDFLAGS) -o $(BINARY_PATH) ./$(CMD_DIR) + @$(GO) build $(GOFLAGS) -ldflags "$(LDFLAGS)" -o $(BINARY_PATH) ./$(CMD_DIR) @echo "Build complete: $(BINARY_PATH)" @ln -sf $(BINARY_NAME)-$(PLATFORM)-$(ARCH) $(BUILD_DIR)/$(BINARY_NAME) @@ -128,16 +128,16 @@ build-whatsapp-native: generate ## @echo "Building $(BINARY_NAME) with WhatsApp native for $(PLATFORM)/$(ARCH)..." @echo "Building for multiple platforms..." @mkdir -p $(BUILD_DIR) - GOOS=linux GOARCH=amd64 $(GO) build -tags whatsapp_native $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 ./$(CMD_DIR) - GOOS=linux GOARCH=arm GOARM=7 $(GO) build -tags whatsapp_native $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm ./$(CMD_DIR) - GOOS=linux GOARCH=arm64 $(GO) build -tags whatsapp_native $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64 ./$(CMD_DIR) - GOOS=linux GOARCH=loong64 $(GO) build -tags whatsapp_native $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-loong64 ./$(CMD_DIR) - GOOS=linux GOARCH=riscv64 $(GO) build -tags whatsapp_native $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-riscv64 ./$(CMD_DIR) - GOOS=linux GOARCH=mipsle GOMIPS=softfloat $(GO) build -tags whatsapp_native $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle ./$(CMD_DIR) + GOOS=linux GOARCH=amd64 $(GO) build -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 ./$(CMD_DIR) + GOOS=linux GOARCH=arm GOARM=7 $(GO) build -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm ./$(CMD_DIR) + GOOS=linux GOARCH=arm64 $(GO) build -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64 ./$(CMD_DIR) + GOOS=linux GOARCH=loong64 $(GO) build -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-loong64 ./$(CMD_DIR) + GOOS=linux GOARCH=riscv64 $(GO) build -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-riscv64 ./$(CMD_DIR) + GOOS=linux GOARCH=mipsle GOMIPS=softfloat $(GO) build -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle ./$(CMD_DIR) $(call PATCH_MIPS_FLAGS,$(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle) - GOOS=darwin GOARCH=arm64 $(GO) build -tags whatsapp_native $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-arm64 ./$(CMD_DIR) - GOOS=windows GOARCH=amd64 $(GO) build -tags whatsapp_native $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-windows-amd64.exe ./$(CMD_DIR) -## @$(GO) build $(GOFLAGS) -tags whatsapp_native $(LDFLAGS) -o $(BINARY_PATH) ./$(CMD_DIR) + GOOS=darwin GOARCH=arm64 $(GO) build -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-arm64 ./$(CMD_DIR) + GOOS=windows GOARCH=amd64 $(GO) build -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-windows-amd64.exe ./$(CMD_DIR) +## @$(GO) build $(GOFLAGS) -tags whatsapp_native -ldflags "$(LDFLAGS)" -o $(BINARY_PATH) ./$(CMD_DIR) @echo "Build complete" ## @ln -sf $(BINARY_NAME)-$(PLATFORM)-$(ARCH) $(BUILD_DIR)/$(BINARY_NAME) @@ -145,21 +145,21 @@ build-whatsapp-native: generate build-linux-arm: generate @echo "Building for linux/arm (GOARM=7)..." @mkdir -p $(BUILD_DIR) - GOOS=linux GOARCH=arm GOARM=7 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm ./$(CMD_DIR) + GOOS=linux GOARCH=arm GOARM=7 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm ./$(CMD_DIR) @echo "Build complete: $(BUILD_DIR)/$(BINARY_NAME)-linux-arm" ## build-linux-arm64: Build for Linux ARM64 (e.g. Raspberry Pi Zero 2 W 64-bit) build-linux-arm64: generate @echo "Building for linux/arm64..." @mkdir -p $(BUILD_DIR) - GOOS=linux GOARCH=arm64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64 ./$(CMD_DIR) + GOOS=linux GOARCH=arm64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64 ./$(CMD_DIR) @echo "Build complete: $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64" ## build-linux-mipsle: Build for Linux MIPS32 LE build-linux-mipsle: generate @echo "Building for linux/mipsle (softfloat)..." @mkdir -p $(BUILD_DIR) - GOOS=linux GOARCH=mipsle GOMIPS=softfloat $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle ./$(CMD_DIR) + GOOS=linux GOARCH=mipsle GOMIPS=softfloat $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle ./$(CMD_DIR) $(call PATCH_MIPS_FLAGS,$(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle) @echo "Build complete: $(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle" @@ -171,18 +171,18 @@ build-pi-zero: build-linux-arm build-linux-arm64 build-all: generate @echo "Building for multiple platforms..." @mkdir -p $(BUILD_DIR) - GOOS=linux GOARCH=amd64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 ./$(CMD_DIR) - GOOS=linux GOARCH=arm GOARM=7 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm ./$(CMD_DIR) - GOOS=linux GOARCH=arm64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64 ./$(CMD_DIR) - GOOS=linux GOARCH=loong64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-loong64 ./$(CMD_DIR) - GOOS=linux GOARCH=riscv64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-riscv64 ./$(CMD_DIR) - GOOS=linux GOARCH=mipsle GOMIPS=softfloat $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle ./$(CMD_DIR) + GOOS=linux GOARCH=amd64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 ./$(CMD_DIR) + GOOS=linux GOARCH=arm GOARM=7 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm ./$(CMD_DIR) + GOOS=linux GOARCH=arm64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-arm64 ./$(CMD_DIR) + GOOS=linux GOARCH=loong64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-loong64 ./$(CMD_DIR) + GOOS=linux GOARCH=riscv64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-riscv64 ./$(CMD_DIR) + GOOS=linux GOARCH=mipsle GOMIPS=softfloat $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle ./$(CMD_DIR) $(call PATCH_MIPS_FLAGS,$(BUILD_DIR)/$(BINARY_NAME)-linux-mipsle) - GOOS=linux GOARCH=arm GOARM=7 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-armv7 ./$(CMD_DIR) - GOOS=darwin GOARCH=arm64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-arm64 ./$(CMD_DIR) - GOOS=windows GOARCH=amd64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-windows-amd64.exe ./$(CMD_DIR) - GOOS=netbsd GOARCH=amd64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-netbsd-amd64 ./$(CMD_DIR) - GOOS=netbsd GOARCH=arm64 $(GO) build $(LDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-netbsd-arm64 ./$(CMD_DIR) + GOOS=linux GOARCH=arm GOARM=7 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-linux-armv7 ./$(CMD_DIR) + GOOS=darwin GOARCH=arm64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-arm64 ./$(CMD_DIR) + GOOS=windows GOARCH=amd64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-windows-amd64.exe ./$(CMD_DIR) + GOOS=netbsd GOARCH=amd64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-netbsd-amd64 ./$(CMD_DIR) + GOOS=netbsd GOARCH=arm64 $(GO) build -ldflags "$(LDFLAGS)" -o $(BUILD_DIR)/$(BINARY_NAME)-netbsd-arm64 ./$(CMD_DIR) @echo "All builds complete" ## install: Install picoclaw to system and copy builtin skills @@ -223,7 +223,8 @@ vet: generate ## test: Test Go code test: generate - @$(GO) test ./... + @$(GO) test $$(go list ./... | grep -v github.com/sipeed/picoclaw/web/) + @cd web && make test ## fmt: Format Go code fmt: diff --git a/go.mod b/go.mod index 130db73ff..4442b28fe 100644 --- a/go.mod +++ b/go.mod @@ -3,6 +3,7 @@ module github.com/sipeed/picoclaw go 1.25.7 require ( + fyne.io/systray v1.12.0 github.com/adhocore/gronx v1.19.6 github.com/anthropics/anthropic-sdk-go v1.26.0 github.com/bwmarrin/discordgo v0.29.0 @@ -28,6 +29,7 @@ require ( github.com/tencent-connect/botgo v0.2.1 go.mau.fi/whatsmeow v0.0.0-20260219150138-7ae702b1eed4 golang.org/x/oauth2 v0.36.0 + golang.org/x/term v0.40.0 golang.org/x/time v0.14.0 google.golang.org/protobuf v1.36.11 gopkg.in/yaml.v3 v3.0.1 @@ -43,6 +45,7 @@ require ( github.com/dustin/go-humanize v1.0.1 // indirect github.com/elliotchance/orderedmap/v3 v3.1.0 // indirect github.com/gdamore/encoding v1.0.1 // indirect + github.com/godbus/dbus/v5 v5.1.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/lucasb-eyer/go-colorful v1.3.0 // indirect github.com/mattn/go-colorable v0.1.14 // indirect @@ -59,7 +62,6 @@ require ( go.mau.fi/libsignal v0.2.1 // indirect go.mau.fi/util v0.9.6 // indirect golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect - golang.org/x/term v0.40.0 // indirect golang.org/x/text v0.34.0 // indirect modernc.org/libc v1.67.6 // indirect modernc.org/mathutil v1.7.1 // indirect @@ -90,7 +92,7 @@ require ( github.com/valyala/fastjson v1.6.10 // indirect github.com/yosida95/uritemplate/v3 v3.0.2 // indirect golang.org/x/arch v0.24.0 // indirect - golang.org/x/crypto v0.48.0 // indirect + golang.org/x/crypto v0.48.0 golang.org/x/net v0.51.0 // indirect golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.41.0 // indirect diff --git a/go.sum b/go.sum index a4d8ed3d0..f0e3fc132 100644 --- a/go.sum +++ b/go.sum @@ -1,6 +1,8 @@ cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k= filippo.io/edwards25519 v1.1.1 h1:YpjwWWlNmGIDyXOn8zLzqiD+9TyIlPhGFG96P39uBpw= filippo.io/edwards25519 v1.1.1/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4= +fyne.io/systray v1.12.0 h1:CA1Kk0e2zwFlxtc02L3QFSiIbxJ/P0n582YrZHT7aTM= +fyne.io/systray v1.12.0/go.mod h1:RVwqP9nYMo7h5zViCBHri2FgjXF7H2cub7MAq4NSoLs= github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU= github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU= github.com/adhocore/gronx v1.19.6 h1:5KNVcoR9ACgL9HhEqCm5QXsab/gI4QDIybTAWcXDKDc= @@ -64,6 +66,8 @@ github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg78 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U= github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= +github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk= +github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8= diff --git a/pkg/agent/instance_test.go b/pkg/agent/instance_test.go index f8057bb2f..5a13c8f1b 100644 --- a/pkg/agent/instance_test.go +++ b/pkg/agent/instance_test.go @@ -190,7 +190,7 @@ func TestNewAgentInstance_AllowsMediaTempDirForReadListAndExec(t *testing.T) { Agents: config.AgentsConfig{ Defaults: config.AgentDefaults{ Workspace: workspace, - Model: "test-model", + ModelName: "test-model", RestrictToWorkspace: true, }, }, diff --git a/web/Makefile b/web/Makefile index 559005956..653dd77e1 100644 --- a/web/Makefile +++ b/web/Makefile @@ -1,5 +1,59 @@ .PHONY: dev dev-frontend dev-backend build test lint clean +# Version +VERSION?=$(shell git describe --tags --always --dirty 2>/dev/null || echo "dev") +GIT_COMMIT=$(shell git rev-parse --short=8 HEAD 2>/dev/null || echo "dev") +BUILD_TIME=$(shell date +%FT%T%z) +GO_VERSION=$(shell $(GO) version | awk '{print $$3}') +CONFIG_PKG=github.com/sipeed/picoclaw/pkg/config +LDFLAGS=-X $(CONFIG_PKG).Version=$(VERSION) -X $(CONFIG_PKG).GitCommit=$(GIT_COMMIT) -X $(CONFIG_PKG).BuildTime=$(BUILD_TIME) -X $(CONFIG_PKG).GoVersion=$(GO_VERSION) -s -w + +# Go variables +GO?=CGO_ENABLED=0 go +GOFLAGS?=-v -tags stdjson + + +# OS detection +UNAME_S:=$(shell uname -s) +UNAME_M:=$(shell uname -m) + +# Platform-specific settings +ifeq ($(UNAME_S),Linux) + PLATFORM=linux + ifeq ($(UNAME_M),x86_64) + ARCH=amd64 + else ifeq ($(UNAME_M),aarch64) + ARCH=arm64 + else ifeq ($(UNAME_M),armv81) + ARCH=arm64 + else ifeq ($(UNAME_M),loongarch64) + ARCH=loong64 + else ifeq ($(UNAME_M),riscv64) + ARCH=riscv64 + else ifeq ($(UNAME_M),mipsel) + ARCH=mipsle + else + ARCH=$(UNAME_M) + endif +else ifeq ($(UNAME_S),Darwin) + PLATFORM=darwin + GO=CGO_ENABLED=1 go + ifeq ($(UNAME_M),x86_64) + ARCH=amd64 + else ifeq ($(UNAME_M),arm64) + ARCH=arm64 + else + ARCH=$(UNAME_M) + endif +else ifeq ($(UNAME_S),Windows) + PLATFORM=windows + ARCH=$(UNAME_M) + LDFLAGS=-H=windowsgui $(LDFLAGS) +else + PLATFORM=$(UNAME_S) + ARCH=$(UNAME_M) +endif + # Run both frontend and backend dev servers dev: @if [ ! -f backend/picoclaw-web ] || [ ! -d backend/dist ]; then \ @@ -15,21 +69,21 @@ dev-frontend: # Start backend dev server dev-backend: - cd backend && go run . + cd backend && ${GO} run -ldflags "$(LDFLAGS)" . # Build frontend and embed into Go binary build: cd frontend && pnpm build:backend - cd backend && go build -o picoclaw-web . + cd backend && ${GO} build $(GOFLAGS) -ldflags "$(LDFLAGS)" -o picoclaw-web . # Run all tests test: - cd backend && go test ./... + cd backend && ${GO} test ./... cd frontend && pnpm lint # Lint and format lint: - cd backend && go vet ./... + cd backend && ${GO} vet ./... cd frontend && pnpm check # Clean build artifacts diff --git a/web/backend/api/events.go b/web/backend/api/events.go index af44d1824..5c85b149a 100644 --- a/web/backend/api/events.go +++ b/web/backend/api/events.go @@ -40,9 +40,13 @@ func (b *EventBroadcaster) Subscribe() chan string { // Unsubscribe removes a listener channel and closes it. func (b *EventBroadcaster) Unsubscribe(ch chan string) { b.mu.Lock() - delete(b.clients, ch) - b.mu.Unlock() - close(ch) + defer b.mu.Unlock() + + // Check if the channel is still registered before closing + if _, exists := b.clients[ch]; exists { + delete(b.clients, ch) + close(ch) + } } // Broadcast sends a GatewayEvent to all connected SSE clients. @@ -63,3 +67,14 @@ func (b *EventBroadcaster) Broadcast(event GatewayEvent) { } } } + +// Shutdown closes all subscriber channels, notifying all SSE clients to disconnect. +// This should be called when the server is shutting down. +func (b *EventBroadcaster) Shutdown() { + // Close all channels to notify listeners + for ch := range b.clients { + b.Unsubscribe(ch) + } + // Clear the map + b.clients = make(map[chan string]struct{}) +} diff --git a/web/backend/api/gateway.go b/web/backend/api/gateway.go index f50f7609a..424b21e96 100644 --- a/web/backend/api/gateway.go +++ b/web/backend/api/gateway.go @@ -3,10 +3,10 @@ package api import ( "bufio" "encoding/json" + "errors" "fmt" "io" "log" - "net" "net/http" "os" "os/exec" @@ -18,6 +18,7 @@ import ( "time" "github.com/sipeed/picoclaw/pkg/config" + "github.com/sipeed/picoclaw/pkg/health" "github.com/sipeed/picoclaw/web/backend/utils" ) @@ -48,6 +49,27 @@ var gatewayHealthGet = func(url string, timeout time.Duration) (*http.Response, return client.Get(url) } +// getGatewayHealth checks the gateway health endpoint and returns the status response +// Returns (*health.StatusResponse, statusCode, error). If error is not nil, the other values are not valid. +func getGatewayHealth(port int, timeout time.Duration) (*health.StatusResponse, int, error) { + if port == 0 { + port = 18790 + } + url := fmt.Sprintf("http://127.0.0.1:%d/health", port) + resp, err := gatewayHealthGet(url, timeout) + if err != nil { + return nil, 0, err + } + defer resp.Body.Close() + + var healthResponse health.StatusResponse + if decErr := json.NewDecoder(resp.Body).Decode(&healthResponse); decErr != nil { + return nil, resp.StatusCode, decErr + } + + return &healthResponse, resp.StatusCode, nil +} + // registerGatewayRoutes binds gateway lifecycle endpoints to the ServeMux. func (h *Handler) registerGatewayRoutes(mux *http.ServeMux) { mux.HandleFunc("GET /api/gateway/status", h.handleGatewayStatus) @@ -62,12 +84,35 @@ func (h *Handler) registerGatewayRoutes(mux *http.ServeMux) { // TryAutoStartGateway checks whether gateway start preconditions are met and // starts it when possible. Intended to be called by the backend at startup. func (h *Handler) TryAutoStartGateway() { + // Check if gateway is already running via health endpoint + cfg, cfgErr := config.LoadConfig(h.configPath) + if cfgErr == nil && cfg != nil { + healthResp, statusCode, err := getGatewayHealth(cfg.Gateway.Port, 2*time.Second) + if err == nil && statusCode == http.StatusOK { + // Gateway is already running, attach to the existing process + pid := healthResp.Pid + gateway.mu.Lock() + defer gateway.mu.Unlock() + ready, reason, err := h.gatewayStartReady() + if err != nil { + log.Printf("Skip auto-starting gateway: %v", err) + return + } + if !ready { + log.Printf("Skip auto-starting gateway: %s", reason) + return + } + _, err = h.startGatewayLocked("starting", pid) + if err != nil { + log.Printf("Failed to attach to running gateway (PID: %d): %v", pid, err) + } + return + } + } + gateway.mu.Lock() defer gateway.mu.Unlock() - if isGatewayProcessAliveLocked() { - return - } if gateway.cmd != nil && gateway.cmd.Process != nil { gateway.cmd = nil } @@ -82,7 +127,7 @@ func (h *Handler) TryAutoStartGateway() { return } - pid, err := h.startGatewayLocked("starting") + pid, err := h.startGatewayLocked("starting", 0) if err != nil { log.Printf("Failed to auto-start gateway: %v", err) return @@ -125,10 +170,6 @@ func lookupModelConfig(cfg *config.Config, modelName string) *config.ModelConfig return modelCfg } -func isGatewayProcessAliveLocked() bool { - return isCmdProcessAliveLocked(gateway.cmd) -} - func isCmdProcessAliveLocked(cmd *exec.Cmd) bool { if cmd == nil || cmd.Process == nil { return false @@ -157,6 +198,28 @@ func setGatewayRuntimeStatusLocked(status string) { gateway.startupDeadline = time.Time{} } +// attachToGatewayProcess attaches to an existing gateway process by PID +// and updates the gateway state accordingly. +// Assumes gateway.mu is held by the caller. +func attachToGatewayProcessLocked(pid int, cfg *config.Config) error { + process, err := os.FindProcess(pid) + if err != nil { + return fmt.Errorf("failed to find process for PID %d: %w", pid, err) + } + + gateway.cmd = &exec.Cmd{Process: process} + setGatewayRuntimeStatusLocked("running") + + // Update bootDefaultModel from config + if cfg != nil { + defaultModelName := strings.TrimSpace(cfg.Agents.Defaults.GetModelName()) + gateway.bootDefaultModel = defaultModelName + } + + log.Printf("Attached to gateway process (PID: %d)", pid) + return nil +} + func gatewayStatusOnHealthFailureLocked() string { if gateway.runtimeStatus == "starting" || gateway.runtimeStatus == "restarting" { if gateway.startupDeadline.IsZero() || time.Now().Before(gateway.startupDeadline) { @@ -238,24 +301,41 @@ func stopGatewayProcessForRestart(cmd *exec.Cmd) error { return fmt.Errorf("existing gateway did not exit before restart") } -func gatewayRestartRequired(status, bootDefaultModel, configDefaultModel string) bool { - return status == "running" && - bootDefaultModel != "" && - configDefaultModel != "" && - bootDefaultModel != configDefaultModel -} - -func (h *Handler) startGatewayLocked(initialStatus string) (int, error) { +func (h *Handler) startGatewayLocked(initialStatus string, existingPid int) (int, error) { cfg, err := config.LoadConfig(h.configPath) if err != nil { return 0, fmt.Errorf("failed to load config: %w", err) } defaultModelName := strings.TrimSpace(cfg.Agents.Defaults.GetModelName()) + var cmd *exec.Cmd + var pid int + + if existingPid > 0 { + // Attach to existing process + pid = existingPid + gateway.cmd = nil // Clear first to ensure clean state + if err = attachToGatewayProcessLocked(pid, cfg); err != nil { + return 0, err + } + + // Broadcast the attached state + gateway.events.Broadcast(GatewayEvent{ + Status: initialStatus, + PID: pid, + BootDefaultModel: defaultModelName, + ConfigDefaultModel: defaultModelName, + RestartRequired: false, + }) + + return pid, nil + } + + // Start new process // Locate the picoclaw executable execPath := utils.FindPicoclawBinary() - cmd := exec.Command(execPath, "gateway") + cmd = exec.Command(execPath, "gateway") cmd.Env = os.Environ() // Forward the launcher's config path via the environment variable that // GetConfigPath() already reads, so the gateway sub-process uses the same @@ -293,7 +373,7 @@ func (h *Handler) startGatewayLocked(initialStatus string) (int, error) { gateway.cmd = cmd gateway.bootDefaultModel = defaultModelName setGatewayRuntimeStatusLocked(initialStatus) - pid := cmd.Process.Pid + pid = cmd.Process.Pid log.Printf("Started picoclaw gateway (PID: %d) from %s", pid, execPath) // Broadcast the launch state immediately so clients can reflect it without polling. @@ -351,30 +431,22 @@ func (h *Handler) startGatewayLocked(initialStatus string) (int, error) { if err != nil { continue } - healthHost := gatewayProbeHost(h.effectiveGatewayBindHost(cfg)) - healthPort := cfg.Gateway.Port - if healthPort == 0 { - healthPort = 18790 - } - healthURL := fmt.Sprintf("http://%s/health", net.JoinHostPort(healthHost, strconv.Itoa(healthPort))) - resp, err := gatewayHealthGet(healthURL, 1*time.Second) - if err == nil { - resp.Body.Close() - if resp.StatusCode == http.StatusOK { - gateway.mu.Lock() - if gateway.cmd == cmd { - setGatewayRuntimeStatusLocked("running") - } - gateway.mu.Unlock() - gateway.events.Broadcast(GatewayEvent{ - Status: "running", - PID: pid, - BootDefaultModel: defaultModelName, - ConfigDefaultModel: defaultModelName, - RestartRequired: false, - }) - return + healthResp, statusCode, err := getGatewayHealth(cfg.Gateway.Port, 1*time.Second) + if err == nil && statusCode == http.StatusOK && healthResp.Pid == pid { + // Verify the health endpoint returns the expected pid + gateway.mu.Lock() + if gateway.cmd == cmd { + setGatewayRuntimeStatusLocked("running") } + gateway.mu.Unlock() + gateway.events.Broadcast(GatewayEvent{ + Status: "running", + PID: pid, + BootDefaultModel: defaultModelName, + ConfigDefaultModel: defaultModelName, + RestartRequired: false, + }) + return } } }() @@ -386,19 +458,54 @@ func (h *Handler) startGatewayLocked(initialStatus string) (int, error) { // // POST /api/gateway/start func (h *Handler) handleGatewayStart(w http.ResponseWriter, r *http.Request) { + // Prevent duplicate starts by checking health endpoint + cfg, cfgErr := config.LoadConfig(h.configPath) + if cfgErr == nil && cfg != nil { + healthResp, statusCode, err := getGatewayHealth(cfg.Gateway.Port, 2*time.Second) + if err == nil && statusCode == http.StatusOK { + // Gateway is already running, attach to the existing process + pid := healthResp.Pid + gateway.mu.Lock() + ready, reason, err := h.gatewayStartReady() + if err != nil { + gateway.mu.Unlock() + http.Error( + w, + fmt.Sprintf("Failed to validate gateway start conditions: %v", err), + http.StatusInternalServerError, + ) + return + } + if !ready { + gateway.mu.Unlock() + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(http.StatusBadRequest) + json.NewEncoder(w).Encode(map[string]any{ + "status": "precondition_failed", + "message": reason, + }) + return + } + _, err = h.startGatewayLocked("starting", pid) + gateway.mu.Unlock() + if err != nil { + log.Printf("Failed to attach to running gateway (PID: %d): %v", pid, err) + http.Error(w, fmt.Sprintf("Failed to attach to gateway: %v", err), http.StatusInternalServerError) + return + } + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(http.StatusOK) + json.NewEncoder(w).Encode(map[string]any{ + "status": "ok", + "pid": pid, + }) + return + } + } + gateway.mu.Lock() defer gateway.mu.Unlock() - // Prevent duplicate starts - if isGatewayProcessAliveLocked() { - w.Header().Set("Content-Type", "application/json") - w.WriteHeader(http.StatusConflict) - json.NewEncoder(w).Encode(map[string]any{ - "status": "already_running", - "pid": gateway.cmd.Process.Pid, - }) - return - } if gateway.cmd != nil && gateway.cmd.Process != nil { gateway.cmd = nil setGatewayRuntimeStatusLocked("stopped") @@ -423,7 +530,7 @@ func (h *Handler) handleGatewayStart(w http.ResponseWriter, r *http.Request) { return } - pid, err := h.startGatewayLocked("starting") + pid, err := h.startGatewayLocked("starting", 0) if err != nil { http.Error(w, fmt.Sprintf("Failed to start gateway: %v", err), http.StatusInternalServerError) return @@ -475,27 +582,16 @@ func (h *Handler) handleGatewayStop(w http.ResponseWriter, r *http.Request) { }) } -// handleGatewayRestart stops the gateway (if running) and starts a new instance. -// -// POST /api/gateway/restart -func (h *Handler) handleGatewayRestart(w http.ResponseWriter, r *http.Request) { +// RestartGateway restarts the gateway process. This is a non-blocking operation +// that stops the current gateway (if running) and starts a new one. +// Returns the PID of the new gateway process or an error. +func (h *Handler) RestartGateway() (int, error) { ready, reason, err := h.gatewayStartReady() if err != nil { - http.Error( - w, - fmt.Sprintf("Failed to validate gateway start conditions: %v", err), - http.StatusInternalServerError, - ) - return + return 0, fmt.Errorf("failed to validate gateway start conditions: %w", err) } if !ready { - w.Header().Set("Content-Type", "application/json") - w.WriteHeader(http.StatusBadRequest) - json.NewEncoder(w).Encode(map[string]any{ - "status": "precondition_failed", - "message": reason, - }) - return + return 0, &preconditionFailedError{reason: reason} } gateway.mu.Lock() @@ -519,8 +615,7 @@ func (h *Handler) handleGatewayRestart(w http.ResponseWriter, r *http.Request) { } } gateway.mu.Unlock() - http.Error(w, fmt.Sprintf("Failed to restart gateway: %v", err), http.StatusInternalServerError) - return + return 0, fmt.Errorf("failed to stop gateway: %w", err) } gateway.mu.Lock() @@ -528,7 +623,7 @@ func (h *Handler) handleGatewayRestart(w http.ResponseWriter, r *http.Request) { gateway.cmd = nil gateway.bootDefaultModel = "" } - pid, err := h.startGatewayLocked("restarting") + pid, err := h.startGatewayLocked("restarting", 0) if err != nil { gateway.cmd = nil gateway.bootDefaultModel = "" @@ -536,6 +631,43 @@ func (h *Handler) handleGatewayRestart(w http.ResponseWriter, r *http.Request) { } gateway.mu.Unlock() if err != nil { + return 0, fmt.Errorf("failed to start gateway: %w", err) + } + + return pid, nil +} + +// preconditionFailedError is returned when gateway restart preconditions are not met +type preconditionFailedError struct { + reason string +} + +func (e *preconditionFailedError) Error() string { + return e.reason +} + +// IsBadRequest returns true if the error should result in a 400 Bad Request status +func (e *preconditionFailedError) IsBadRequest() bool { + return true +} + +// handleGatewayRestart stops the gateway (if running) and starts a new instance. +// +// POST /api/gateway/restart +func (h *Handler) handleGatewayRestart(w http.ResponseWriter, r *http.Request) { + pid, err := h.RestartGateway() + if err != nil { + // Check if it's a precondition failed error + var precondErr *preconditionFailedError + if errors.As(err, &precondErr) { + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(http.StatusBadRequest) + json.NewEncoder(w).Encode(map[string]any{ + "status": "precondition_failed", + "message": precondErr.reason, + }) + return + } http.Error(w, fmt.Sprintf("Failed to restart gateway: %v", err), http.StatusInternalServerError) return } @@ -573,83 +705,74 @@ func (h *Handler) handleGatewayStatus(w http.ResponseWriter, r *http.Request) { func (h *Handler) gatewayStatusData() map[string]any { data := map[string]any{} cfg, cfgErr := config.LoadConfig(h.configPath) - configDefaultModel := "" if cfgErr == nil && cfg != nil { - configDefaultModel = strings.TrimSpace(cfg.Agents.Defaults.GetModelName()) + configDefaultModel := strings.TrimSpace(cfg.Agents.Defaults.GetModelName()) if configDefaultModel != "" { data["config_default_model"] = configDefaultModel } } - // Check process state - gateway.mu.Lock() - processAlive := isGatewayProcessAliveLocked() - bootDefaultModel := "" - if processAlive { - data["pid"] = gateway.cmd.Process.Pid - if gateway.bootDefaultModel != "" { - data["boot_default_model"] = gateway.bootDefaultModel - bootDefaultModel = gateway.bootDefaultModel - } + // Probe health endpoint to get pid and status + port := 0 + if cfgErr == nil && cfg != nil { + port = cfg.Gateway.Port } - gateway.mu.Unlock() - if !processAlive { + healthResp, statusCode, err := getGatewayHealth(port, 2*time.Second) + if err != nil { gateway.mu.Lock() - data["gateway_status"] = currentGatewayStatusLocked(false) + data["gateway_status"] = currentGatewayStatusLocked(true) gateway.mu.Unlock() + log.Printf("Gateway health check failed: %v", err) } else { - // Process is alive — probe its health endpoint - host := "127.0.0.1" - port := 18790 - if cfgErr == nil && cfg != nil { - host = gatewayProbeHost(h.effectiveGatewayBindHost(cfg)) - if cfg.Gateway.Port != 0 { - port = cfg.Gateway.Port - } - } - - url := fmt.Sprintf("http://%s/health", net.JoinHostPort(host, strconv.Itoa(port))) - resp, err := gatewayHealthGet(url, 2*time.Second) - - if err != nil { + log.Printf("Gateway health status: %d", statusCode) + if statusCode != http.StatusOK { gateway.mu.Lock() - data["gateway_status"] = currentGatewayStatusLocked(true) + setGatewayRuntimeStatusLocked("error") gateway.mu.Unlock() + data["gateway_status"] = "error" + data["status_code"] = statusCode } else { - defer resp.Body.Close() - if resp.StatusCode != http.StatusOK { - gateway.mu.Lock() - setGatewayRuntimeStatusLocked("error") - gateway.mu.Unlock() - data["gateway_status"] = "error" - data["status_code"] = resp.StatusCode + gateway.mu.Lock() + // Check if this pid matches our tracked process + if gateway.cmd != nil && gateway.cmd.Process != nil && gateway.cmd.Process.Pid == healthResp.Pid { + setGatewayRuntimeStatusLocked("running") + bootDefaultModel := gateway.bootDefaultModel + if bootDefaultModel != "" { + data["boot_default_model"] = bootDefaultModel + } + data["gateway_status"] = "running" + data["pid"] = healthResp.Pid } else { - var healthData map[string]any - if decErr := json.NewDecoder(resp.Body).Decode(&healthData); decErr != nil { - gateway.mu.Lock() + // Health endpoint responded with a different pid + // This could be a manual restart, try to attach to the new process + oldPid := "none" + if gateway.cmd != nil && gateway.cmd.Process != nil { + oldPid = fmt.Sprintf("%d", gateway.cmd.Process.Pid) + } + log.Printf("Detected new gateway PID (old: %s, new: %d), attempting to attach", oldPid, healthResp.Pid) + + if err := attachToGatewayProcessLocked(healthResp.Pid, cfg); err != nil { + // Failed to find the process, treat as error setGatewayRuntimeStatusLocked("error") - gateway.mu.Unlock() data["gateway_status"] = "error" + data["pid"] = healthResp.Pid + log.Printf("Failed to attach to new gateway process (PID: %d): %v", healthResp.Pid, err) } else { - gateway.mu.Lock() - setGatewayRuntimeStatusLocked("running") - gateway.mu.Unlock() - for k, v := range healthData { - data[k] = v + // Successfully attached, update response data + bootDefaultModel := gateway.bootDefaultModel + if bootDefaultModel != "" { + data["boot_default_model"] = bootDefaultModel } data["gateway_status"] = "running" + data["pid"] = healthResp.Pid } } + gateway.mu.Unlock() } } - status, _ := data["gateway_status"].(string) - data["gateway_restart_required"] = gatewayRestartRequired( - status, - bootDefaultModel, - configDefaultModel, - ) + data["gateway_restart_required"] = false ready, reason, readyErr := h.gatewayStartReady() if readyErr != nil { diff --git a/web/backend/api/gateway_test.go b/web/backend/api/gateway_test.go index 06803722d..fb4f7d943 100644 --- a/web/backend/api/gateway_test.go +++ b/web/backend/api/gateway_test.go @@ -494,60 +494,6 @@ func TestGatewayStatusReturnsRestartingDuringRestartGap(t *testing.T) { } } -func TestGatewayStatusIncludesRestartRequiredWhenModelsDiffer(t *testing.T) { - resetGatewayTestState(t) - - configPath := filepath.Join(t.TempDir(), "config.json") - cfg := config.DefaultConfig() - cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName - cfg.ModelList[0].APIKey = "test-key" - if err := config.SaveConfig(configPath, cfg); err != nil { - t.Fatalf("SaveConfig() error = %v", err) - } - - h := NewHandler(configPath) - mux := http.NewServeMux() - h.RegisterRoutes(mux) - - cmd := startLongRunningProcess(t) - t.Cleanup(func() { - if cmd.Process != nil { - _ = cmd.Process.Kill() - } - _ = cmd.Wait() - }) - - gateway.mu.Lock() - gateway.cmd = cmd - gateway.bootDefaultModel = "previous-model" - setGatewayRuntimeStatusLocked("running") - gateway.mu.Unlock() - - gatewayHealthGet = func(string, time.Duration) (*http.Response, error) { - rec := httptest.NewRecorder() - rec.WriteHeader(http.StatusOK) - _, _ = rec.WriteString(`{"ok":true}`) - return rec.Result(), nil - } - - rec := httptest.NewRecorder() - req := httptest.NewRequest(http.MethodGet, "/api/gateway/status", nil) - mux.ServeHTTP(rec, req) - - if rec.Code != http.StatusOK { - t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK) - } - - var body map[string]any - if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil { - t.Fatalf("unmarshal response: %v", err) - } - - if got := body["gateway_restart_required"]; got != true { - t.Fatalf("gateway_restart_required = %#v, want true", got) - } -} - func TestGatewayRestartKeepsRunningProcessWhenPreconditionsFail(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") cfg := config.DefaultConfig() diff --git a/web/backend/api/router.go b/web/backend/api/router.go index 5f081dee9..b56438784 100644 --- a/web/backend/api/router.go +++ b/web/backend/api/router.go @@ -70,3 +70,8 @@ func (h *Handler) RegisterRoutes(mux *http.ServeMux) { // Launcher service parameters (port/public) h.registerLauncherConfigRoutes(mux) } + +// Shutdown gracefully shuts down the handler, closing all SSE connections. +func (h *Handler) Shutdown() { + gateway.events.Shutdown() +} diff --git a/web/backend/i18n.go b/web/backend/i18n.go new file mode 100644 index 000000000..9cda9e5d5 --- /dev/null +++ b/web/backend/i18n.go @@ -0,0 +1,120 @@ +package main + +import ( + "fmt" + "os" + "strings" +) + +// Language represents the supported languages +type Language string + +const ( + LanguageEnglish Language = "en" + LanguageChinese Language = "zh" +) + +// current language (default: English) +var currentLang Language = LanguageEnglish + +// TranslationKey represents a translation key used for i18n +type TranslationKey string + +const ( + AppTooltip TranslationKey = "AppTooltip" + MenuOpen TranslationKey = "MenuOpen" + MenuOpenTooltip TranslationKey = "MenuOpenTooltip" + MenuAbout TranslationKey = "MenuAbout" + MenuAboutTooltip TranslationKey = "MenuAboutTooltip" + MenuVersion TranslationKey = "MenuVersion" + MenuVersionTooltip TranslationKey = "MenuVersionTooltip" + MenuGitHub TranslationKey = "MenuGitHub" + MenuDocs TranslationKey = "MenuDocs" + MenuRestart TranslationKey = "MenuRestart" + MenuRestartTooltip TranslationKey = "MenuRestartTooltip" + MenuQuit TranslationKey = "MenuQuit" + MenuQuitTooltip TranslationKey = "MenuQuitTooltip" + Exiting TranslationKey = "Exiting" + DocUrl TranslationKey = "DocUrl" +) + +// Translation tables +// Chinese translations intentionally contain Han script +// +//nolint:gosmopolitan +var translations = map[Language]map[TranslationKey]string{ + LanguageEnglish: { + AppTooltip: "%s - Web Console", + MenuOpen: "Open Console", + MenuOpenTooltip: "Open PicoClaw console in browser", + MenuAbout: "About", + MenuAboutTooltip: "About PicoClaw", + MenuVersion: "Version: %s", + MenuVersionTooltip: "Current version number", + MenuGitHub: "GitHub", + MenuDocs: "Documentation", + MenuRestart: "Restart Service", + MenuRestartTooltip: "Restart Gateway service", + MenuQuit: "Quit", + MenuQuitTooltip: "Exit PicoClaw", + Exiting: "Exiting PicoClaw...", + DocUrl: "https://docs.picoclaw.io/docs/", + }, + LanguageChinese: { + AppTooltip: "%s - Web Console", + MenuOpen: "打开控制台", + MenuOpenTooltip: "在浏览器中打开 PicoClaw 控制台", + MenuAbout: "关于", + MenuAboutTooltip: "关于 PicoClaw", + MenuVersion: "版本: %s", + MenuVersionTooltip: "当前版本号", + MenuGitHub: "GitHub", + MenuDocs: "文档", + MenuRestart: "重启服务", + MenuRestartTooltip: "重启核心服务", + MenuQuit: "退出", + MenuQuitTooltip: "退出 PicoClaw", + Exiting: "正在退出 PicoClaw...", + DocUrl: "https://docs.picoclaw.io/zh-Hans/docs/", + }, +} + +// SetLanguage sets the current language +func SetLanguage(lang string) { + lang = strings.ToLower(strings.TrimSpace(lang)) + + // Extract language code before first underscore or dot + // e.g., "en_US.UTF-8" -> "en", "zh_CN" -> "zh" + if idx := strings.IndexAny(lang, "_."); idx > 0 { + lang = lang[:idx] + } + + if lang == "zh" || lang == "zh-cn" || lang == "chinese" { + currentLang = LanguageChinese + } else { + currentLang = LanguageEnglish + } +} + +// GetLanguage returns the current language +func GetLanguage() Language { + return currentLang +} + +// T translates a key to the current language +func T(key TranslationKey, args ...any) string { + if trans, ok := translations[currentLang][key]; ok { + if len(args) > 0 { + return fmt.Sprintf(trans, args...) + } + return trans + } + return string(key) +} + +// Initialize i18n from environment variable +func init() { + if lang := os.Getenv("LANG"); lang != "" { + SetLanguage(lang) + } +} diff --git a/web/backend/icon.png b/web/backend/icon.png new file mode 100644 index 0000000000000000000000000000000000000000..e0b4aab9c42f1b84b3ff7ffb145a965bcd67e925 GIT binary patch literal 104580 zcmYgXb9`L=(vOn{jm?IQZQD*`JB`)Yjcwa)jK*qgHfU@&cC!2KKJRmH??2gm&d#3S z%$)CdPNa&GGzuaCA_N2kimZ%;8UzFs=wB!Z1US>>?ls1Oys{tc0kBC*+wQyfM+> z9pJ(8;m-oqc-KQPN?C>>ak~v?LQ}L#u=9 zP2k`E(f{uiV|0irNaI?lf4(+GuR}lfQgz-q{uh>*8`FF{84CW!SCK!~5XtxoCwKNGzw(gkh6 zMF?xDpF{uU08b1-8`>Bl*KYOGzii;0AlO~>a6HM(w{Zon+TY<9gbC{|KZIZ zECLR?kKJEM1HqE^%Kk8D`YY)RKo7b=keX}o9|eI`!Y=@|2(i4aTz_8hAGNu|{Csvq z31rc*%lh|{Hp~|%kap`r@{Lyo|BCwcVUqx2yLDOPzYpPT2CR{Ap{^gUe?=Wx0EucY zHdOXkRCphN0&oXGIwvi@K068_;%p!$dUU+#{oKpH+m{*dkXU)2$#LE1u` z1=9TbGWstoVSG@zU}1C3%;o<95*U`o;o{(9*JzuG|L0gOu{th2y5&|Dn@*0pE|@V*D>1{6BOvqfG|?L$~w~otcIFzo-E7 zCknpbL}e54|Im4W&;3(iG5(hh{vW!L$fouGmEQpN>y>RX_#e85f9T9CZU5?Jh5`h5(Evny_O=eISl{ca zqyIsH7ubMY&+HWcixy;EutTv{&c$B)i-N9W5cs@9@~UnBix$x+kfFgHM>d-Ns{ydD z@BoAF;|MIWJS-{cg`r#N0v zsK%N)-Hw@Mp5LJm`*izTQ>XSyxdCyPD3Lo-O2Bs zy%{+O8^kxAzYTR@o{551`b12xbYpz2hh z;aN7)n@}Gf!nch7koG;A4;@BV(5E8A!r+B$4{0N7O-$r_oZPbi(KoiNVK5V?fC`$+ zSEwCbV87t`skjX_$LX}7D7Gs{+onjQNVM;b-X_=NtINRzzsHWIPf_Fmb9)}+I4`#@ zR=fpQ`w@7Jf3aom$|RltmMV6@j{jxc3&xw7>|%a{y`BghY6?So*P=YptxkLvykHMM zI@efDJ7SkIoB1-3@vHizh;Bi>N*)r9XFGpHEs}N(P>#s?`S|&q;{BCl@X@$sF1oPg zvkkYhex0#1jJR|0s=vVcqxw|0t0PUMD|xq1EQYrV6ox4?DQ2I4VBY%?Ck$-fB9_BG zw5C2rxPpvjf}BIdJr3RB(_*ZUl|A(Z~A4O>lO3hD|zf zFfMJHPsZ;z9@YGGT>S4s61*zUpP4SdQPh)EFC_L`^~bfOuCfoQr0Oo-SS)S1pqa2o z(06vJKVH!7Z_n@^uJNpSLq8vSUv#FPr5uGv)A9%FGJ(93h%iO3`ysy7Mtw4UqB32n zqw(oW@$9eo8pk3XE=4(~^0>w)-9Ow3NtF2u)o6H7f#W(SM5xb90D%R zC@1>&?@|f)6D3G{y~4x?6mkN3A4yBJAgdhM-uwRX;FKt+ZwYMFI6A$FdX)sbJY=4b zKXf7bbXJS2#k1e~v2sqA%cCV0>=0seYu?Ffi;Bx5-`na~@E*I*jh6t?ceP|3T?4Rf z=xHTQF#`Be(Sy#0Z(O_PT>4_JG6we}KU^bA9d02@MA|i1HVlqjgQMLSG#H+ne4(jT zY&j!kST{N!&ft(9mMOGg9e?QN(HDkWhFzM9j2=-%e|Cf6bn--f{mfn}ydTGET{iRO zgczT2%Wa(!@6~XhZ1npYJgkiZlwTfc0|Tt9wd%Tb%aXCx`4Dmn5nI$ml$?p$=!?t_ zC!LHk+0ABKCNMAX7*-eN9SMjNkKPd_IO6nO4Rqz;p-sK_F}`HYOKl!Fv0!|jZi32# z*n<}Ue5-xqZ@$74{`L-H8`g^sWrU+*xme^_;|7DF90}bpfXynGm-7ITxsda)xO_r!Tg@)+vUH{ zyrY*6d~_wPdUSprw1^)HXs}E3omJ-a)h+LuM%bgr+O^V90h+iH;uF?Fd9cGnPGU2< zLIAyaT&Tvl&iG$~nXwzg5?pu@x^T<}BXg-$mZFTAA#!Ooe`{7)wzU-A6aUxvfRX& z=DGujodHZ&r8GkU;Q}Wk(cx=IC_@M$yfBA0S_W0&v1=;?kcA?5&ZhUvprq1ATUQAu zNHo5;$#n;_`Ba~RJep?)*L~&#-G?sOmuDTiSjWfT9iN}*e9Z=nTe|8@N7Lzocy9PB z*170O9u&JQgu73LF9f__*0Y1g=ej+xt*Raxk8X6$a^d(mU?hyiB1LkGQ`-mS7f3k| za|p*pUgc^&)2=L03;ns3cX|Wn9X=3mZ&w~y+yd>HcKEc z-A6_TlBc9i8q_`hkr^uDq9_L?7$QpfB=k9w1wgb6mmO>ixn1%IzIO?6DFInyJANnv zfBHK}vbp^N2F>#Q;N^F1%q=jxo@PCNjSXKsuU==mH12L=ps!Kr_6%^f)J0AV!Nx)y zWOJVO!?aTEODg4cGVl`cTEoPYJMU0-HKwFRfBf#%SX6w)BU#!L<$6g2!f~W|uwmL` z@rBTR+d~?|lczLdzLOi)4xl4`v(sUv_)6N1?THrU4I4#ZnBagn2$@G6Q51c8)JB*0 z(BT`v>G}N~4jg~}_=oHUceg%^M&faBem7zQGr=&$i1$T+3>U!-pNC4~F>Rrjusf}m zX6`x^JAUJ?C{r~IcT()LK%W2U)#LaDrD2D-4`5I~#Q$qU7py38n>rRC42F&dXV4ej z-EY7{Is5AU(0)=9f!{r6s27KlM5VHt?@b_;J;a}8q_Z$76qFj^=c}GvrQP=ZcwXfU z3v8Up<$wcse!RSKlI~sj$|jG}`zzP#`Y;7Pwv(vTBX)x;CvlzEWw1pAW~|@ILv3hK!shF zj_}ExRG<(_8&zTjU}}tX__!$krD~o#2)EBiKg>qvlcBip1)Mo=U@!M-a z6Gyia?}j-vu>fwtQC~u15#2>W8@BU{H(4J6gD47)Xmt)aQs$G98T$2+2j!577>40g zz}MxB9o=}T-IS-3b}#x)(1_0hWVul58TDeP%Toi0^?a4Y=M~?d(2+F1bAz67=;H~} zKN+4YR|1ks)kP#c3o7t38`5=mCnYfzKoD=geF*JXRe%0IP8!#Pc)MMdj}i(?0C_i# zS-T-`*Mm4hSb`I>QIfYa&zuoU8dKNw#fn?j8vd8 zlsdC$Ucg*a)Tw;yW=~|`YN=Wo>qmmHPFwz}}G*jM4`)`!F_GRgyYN{X|;`a&2BSwn|)Rc$_!HqD9 zP-`_QeLfdvP4mF6~4uUf?d>~h}tL#wDhvv8cFSW1WA2~0sFu)< z@}q^9yzTev5s=+s=;$=CX8R>uEs?&)L+dU*{{|{0elvo+1roST2qwQAWTBOYBLwZ9Q9^0&i3OkJhCfSU1lO zO&mh8fk5z!tm{#`(I^0mHF^@~UFR+iDGx|UYc!8pM)WIM!Su)pnB2aLji z-Qu_}QyD7gq&T{i(UFJ%d=8l*Xg=r-@2>kdpCpu0<`2aac$eqv(n2pdzWMT4p1D6S zueTjL$jr7+DRNntiw)8gM`%HHaDsYyKcX4>5j;%HDt{0y2gG|EGGAo0jHOo+O|!7t zezMiYHCN?aB`)98u`lnIO4tQj&^#eyc7&;zcSw;!WJ&K_$0D!TBBob_#YhD>hH&=v zcX$Ae-_!IzZAzP($J%q0=9NtJ6yI;6O{FX&-lOA6bG=0$T$*w<6C&Iy&R%BsIR0+X z2dCylBE~~E+2nDa!_HC!r-EIP42_}TGq5Pwz%*wiq ze-b6GpxxCUUwm6%#T`+KqU$Y0!)F#bIwK9<=g{=OS%m)szhYDG*w)!inRn|eAXdDe zZ$~TnnUrG;hNrGzgdMns@MT;PtcC2uK{*TbBX*b~$$kp*6K!-EZHk7Z3O)Dl z$$CoAMRsA&xzLLcS5V?^&|gTQSNrDAzjl8EmCfB^i`UHvd*o1V?lh(-W;`MnNvZ;| z``t=Ft4YC@B`b#ckeE>`KZmNQA)(T30f-SRvXkUBVAA(>qba<2M+N?y#V(Pjgl5HC zAKP3lqDSG9B0qez-(1!`HYuv_Nb!GpNjp(9jqEHw`UWwOjpJ1sph3nmyghWn>8vub zr(>ouT+PY8PQe3YRS17d{F>=UI56}-zMNRn)t1a&bOigK&4M2&Ixuh~L2b2tzx+3R zQE100V<7^Z$u}&`)iRC%mO|)+SD5gK3#PN)MA$|`fdWHRXqk|GPjWfZl#Z?%MaBINo8vGpBu@COD?qNach4*3i{UOT9W$ELw-7R^qyd-I=^R{Eul}!Z4 z<60R(Bl5WP&G{TbrMKi*Zf{3G_^qGTYO@_Rz7b>bmCrE!es9=rm)YDJ5KUJ6<-^b` zG&zPKSN51(|7NJ~&9b9Z^=gS$FxNYPWQd*LY0eqRq|kQzPG-H<^k_JsRP97H=*D`i zpSe8W`Lt4mxjO_c{^dBuo1j;o0O1ab#gPH!JM4TeFm|^ag%{lQb~*d1?aTn>7bzmj zhyro+l=&NtF}rzdlGCv`Bmj_9`Q_kNrlj}R4z9IK#kR?3!~!xlg}~673t!vk<12AR zZ!YW7hu`o*uQVK&q}OHxn?FR&gGGqBe);*4G&I#SH*&gB#^grS%qO&{9lw67d$lW3 ztY~H1q@U2MXl@smnD8P+s;Hl7=y1tlo)EwuE+``3kTN^8gSNro8D-0GJUd8Ig!}0N&B=Wb%ip-A;&@eA(+2>$Z{GKC<$)b zp9te$I9BsYS#J`=RP;k9&J!lSj|NT*-yUY^-0xqXrVPyJ9Ees-Mwu)fUVo+A z&du~-FitnfwKhNvMX15s*XRxIBc`2vifBZ_Q^Ls{TAA$r^10G?vH>aDLU^yd*wV%f zjyHU?mt$pR_Rp{4^rgKFLKwMPwWj%d#cft{;)C571@G=mE4%{ z8$OnA=@VSYy_b%hEI&)wl=sXz`jp!IX`!%Y0@HFp-_D@mwRZ+QUTV4F9D!qKbKmJC zdZKL2X%@}@V3`z-t9D_xplv&f}B}G&;x+tlxTtXB0-$GL5Ey?=XBlN1kli74&BSVbfv{1f@QHh!DilyZQ>DT-y;H{Ms;V zMSa>C`N}FWVN-FP3Ee0CpcizA;5-NU0~^K)cxyN^bIiS$%iM&VDylBd$^y-o6Xx!F z(!~Uo{y5^2K$i@Nm*7Y@OPiID{IQT+@>XIryueQKL_MBi&<7_tQHMpRzR2M6JHG8z&k6ha5v`8 z_^X<{SHDC=zt~rU=1*iD*aciBaei;6d5BzOo;{kyA4{V@Cl>HFRb&wNA07o&s3<^2 z@&|{oVAXq%oNr1>BMFYls~=__-hpN|J~8%4I6*n0fr!J!a0s7dq-3gnY1UO%ZK-TM z-GiERaAX$vm{nIc#;>>8T?!Gg6{PFAv&Yo5YnDXqD}6T~t{9s9g<~?USy2Zk-34wB z?l={Zj5${k2DAN`9{ljxx0}cEXxCZ##ODm#5A!riYW^^yTu4i>4QxRsZzJSDhjU}y zY2%z%?4O2!*9CFN`5Q8=AbB3&HL*B7d`xK$- z)D>8v4kt46QylcQs&v{!U|WasqI35Qq@2rp)89K7{8k2j64$h}lQuj2txcK6+S3^G z{Omqs3MfqUiY_s*$?JEy5&#Vx#i<1fh1I-JZ>8CPpnzvs1?bxCXx$gGobaY*Fkho6 zdRwhA9IP!jsXjXw>-iq_sGWud1jsG#h=fH+1F#WRtBXF_z)Z_`RRl`~xD@Ap# zP?Asnc5Wm4)-EI97V{Y*Z?Qpy)}!1xde?Hako`;7m@*exH7A=l1P7(^shbeC+cXQ; zG^Dj7qw{KDf+88L?kVf;A{jH~Ds{71LBM;EaSQXTYBE6a1_oNo7QH91Ov9l=g+I5{%FvpGvV+>rj-(^_!X$=znuqvG>g_eopQ4ysHS`2 zk5}sPLEBQMF7{rOMGZ!J|5H%_NgSq|r=esULDx!?Z8tC4XNVcJs08;+^-#8DMjEuE zOVg2e@2b(j*1CxH5i%*KuuF-8%&p)M*}m%HJFnlHv95M_)5VN9N-^cn2GKV0rMcPY z^N{8Oy*2LqdV}Pk*eB~bec5svtC0&H-VE&i*Wu33fl}{v9h)q9;J){#M0ZUJpWEbS zuNNEJNSoSQT^I z|I-V2`;}l19^&G8!W?ZVzYs8gPP|9$Ru!0%x`8>VgKB9)du#ioq4GjwlYcb#K5Koi zhW)uT1Y>;?5v$2Nmj>zqqv(@@86gFq68ynNrR#!U~IV<#N8JbPb;Pr59G10OmS znAJzQ3t5x`4cMKFu3894jzS^bJbpcMPT642ZFQ~KPD*sf zWveLIq`J|nC=g%2we$Lla~A2jb`I6?MRLRM_2$%XggH}H_A~C$y;Fq?sxyaD#-E9k zE8Su@JJXuLFhlD+MP#(29#YUS zlXUS1RdjDJMcv-6KSyH0&l{uhk1@tsnt*y&YAQMQv{4tS5+)rw6?jp!Z|0m$_Z)_~ zKP)oh865Wq3AyQS&Y%E!aa7zKjx2~ctZgFG#wWG6=Vk=^+DJAZlZ}-}9aAtTlcrcm*oj7*_ zzxCd<$VeRZtrVIQQbWSj73iNrDeFq7b^QF3NQNQ9vbUm zJ5#R{UBD02M#NptzwgN7D`gs@8ketkz@Q{miq|;R^Y}^YX zqZ+mL&zDC8@g%Wu1XzXBwlmCVCj7AWrz^YX2)BoMoDk2L_N!@#vo~73=s*QQ#)6fJ?OUsfMxC@c<-G9bRr3fvN~!iBTV{$??Vh~X zG3xRr_lSVoft)~?C~wC@XJTt@(gyQ#yp=V=SD+b*$%VwdS`kx}+(tck7G&xpcA}c0 z;%os}Y)5?vJ~WW(-{JX@y)A%v$Cjt?%Y-V;SD*=av~xd~#wb+#9V_(Uv)GFqc@ZA@ zxvSln2zV7FNM!wo4LY6-%#QOWv)jgY)#VZahR{|t4-{{Zu$6+dVg9lfYPn*?qi*+o zT{(i1iBI7l8?n@~#+@bGp}XILikjOWQore4M0bjR$~az$P}|`o?eb*WIj73ko9q@U zXnx`=_&Sw9Yw%T@NTgjs060NgK5PZgJ~+HTC>LL@>e?KU16L8#=svhxgC}T_Z+HQJ?Uvi2Zt~&}iuLY?a*KsvVl8gpTn-})Lr1piE zUcZ|2lOBI1k5*_()X@#`u(0cwjaS(&RsZv4_P*Bg8`Dqxw0*oO#x!FXWq7^^)#yh4 zA)fk;y7^x}$#-w`4sC{$&2wX17qZwtOWdAdb6totl!m>s@|zm+BO6VjWgL>-W2mM} zVhI(GhZD2k#5{7a7h4_DQU|QUvyOAlPxpB3#9Z-koNTExxP)Nv2C=60OldHS>X3Z* zkT=vPh%eXqu_T(Z8-1X2%1JX`Pz&y(8&TLj>A|?52YIf=Q=13{-tY{v*ZQ-5Cgh-r z|J)heK5{dcpTRn`S}OalnQ{5ttoW54^Sh-D=^?^xy?KHSgPcvDBXw1nPW}?Zl9uR8 zFsJS~|29fQ|LwMn3EVD8c&hv^ifRdIVR>ICc3ol&+nuZ^OKj#Loob6(zF{UVqoCjK z%obufGvgNC@*%59p1ZVT_33ttd+>C9z2sCeTUnaz8h^1v@tqJw!urT29%hVK$P?R^ z+QC|*gSWll?nd~MA$$8~A@a9}i7=9Iz@K_S*|*qM`)Tq73IuScLxF0}1L=~SgKYv( z;V(%ovWM}}U6Mi5d%>V)^F>s@GhEpdZ|GL zo}%FmrkfZq{;XC=$)TQU@s<;6`&`6lJmz)9>Po+pxp=7OMdT7-xWSJEks@*u3Mj~hb%MUV@FOD1mCK?i$*j`ws|QK< zouaJICPgicEO8h9%yLwOYDKYE9qO?eT3dn}>*xTDcpbM5N94Yn)ph26KG53J$S}`) z_hLm2kb-n7EmrUBs;Kflc`j~(6DP{CBT1a85Xf(b5(pSx`(X{PddD{OUkK@b_*6u+ z0&=$td!?v|u`AXkw{@q8E?m^Lb0VI@C;6C#tQL>2&^ZvUvq*4C-UqIj_XQ6ouHgDs zdQRC~(UQj8pt|@yV5*#ap_^xy&|qD)W3nA_R-}{^rDHK8Uv$lNRZDqF}4RM~zG{xqpC<3pr}*R*iiAmOnI^7jk2bM#R0I>oEdaky-ax z#J}n)&-K57)H{sfU6WtTKjD3rqq?RlU2rFFfd7SS6%nTOF^_iak`DXV(uV&L4gpo6 zMMFMb{0o|037aAIkUq33dd#nVS#QRla&G*J%mHUL0raRwR2Zm@>n$UNK`D14D_%-> zx{!HaFNU=QzPwB~^4>V&v~n1v)D|LnRmqrqkcAG)%dM*_%;iGsns!Tq6T?|81GQ&a zL=fycf#bgnt6zmlpQW+34d{xIr(sxHXb~vmJ6!SeM}ziU$)DlJ`qp<^H}9~!$5&n+ zV8#T@da2;rkjZ@@kDTlY60lGbTPo|iyL{8037@@gntu=Y`=TvYiSXZQr|_xblcsI< zbG+T}UU7daM!$5gzT&?3Gtj!ckn`EwPyR9Im~QPJj*7&bFxXblL(5e6eth@#|!^tVk*CCo}vhkkS$r zHHJ$6QTIC4r7Ud!jyhJVcjz7aWx?XcWMFsvd5?&$be?`K?jM)h@xGLFtmy0(WPo(> z&Tuykw?y)FTT7bny+PT7j!M1tyV!K(`~)0Ef;+@xMnCG_0t*3_V2}MWBD_(%@8Hb0 zhoTNNwET2@y4xdO>Wq6#Tm6PYG&AqVfRHUFXfO;6x$vXtdVYH`^gbpp?tN}uxj!3> z)KFXXmyyKYuoCUo{Ot0Q)upTh^89U-mud#3zHw_cGjJejo!TWmaUIp@Remyg?=I7dp%18kSD zy3pIXVC&&T_^sin`v@SQLptn#ktZ}F;O%$3&aMVbeR!P@T$3)nrVFG?Qss$hz#Uno zurKj>qgC@=u{#8$%9EBHe(shdWYT;)ce2+gbmGWJon68_MDc#ea9e~(#`XI zE3=3nNC)?qUhF3gBv8r^NaN}hMT+I<+!;QDCPG{6D&dO|cpvxdJ3#FVY2zn~D~sjM z(xgHkAr_bkk*SgmH?oXDg27uj?4kJ16#b_u3J-t-*&4`kT+InSl&mN> zA}5%n(XrC$Hdcw&>n)yzyn)KV2XJ5zKsKDj+k_GW-6bXtS6}g z(f$zp+S%<7;<^^2B-|f1@(u9uk{^+(on=>GjQJ4zc6=mKrma zz-yjtut_-VDwqcG^$7bJmg7h7!(@4`&On$Y3>@2gUR7w?ID2rX7mon}4;C^*FiCg^>5d?65pnO03bIUqYu(y^<5u-^1K%OB9Rv;7!76qlOxQGz+%$smiC4Jfv^Lt++TFN6h#%J*qM??eNca zNpL^1KO1MaRR6Q_8MG!=fKl&l#E*{xfzsN2fjZ4t39p&8LbHG!WqlJ=l318zy+YpI z*>SeI$u%AJ6{kM(Ek5uBNNpbt@@Am^s|Wfr3o6P?yRNOuQcJozgcj|)fVnQes}G4u zAL%lbTB(sFLftb&YUVFD-;EQF*+8#9%p`Nph^^fJvt8N?LB1tkVkmL))4YJq)tV?J zY#-$phxF^pfGuJH6*9ExkHrTy$FKV|n`F^iV7o!a;E6^kYy_ z5=Qj?40YC$IENwY$HfTI5);;K;HP@rI?{C{iW^(jy z9JcSDW+k|Fg*KyGipBu_RfbGOm*Upe1J86-tR3h#y@?&@1s&L)=Tj}7l^66d$7i|( z)Z0zMlm^wXk@Lo(;H_krcaX3a0C^KO4eDxa81#csS^;X*+`6Pc0aOj_T~viYh={R( z;za=A1$JkP^HITEYTkhqek!47 z4uQ71hMQ_1=FoNlj!Q;N$(|BUnHOWg-xlw$zUm)$gGM;}3fjEj@dBvFSn3!5^D8st z3}-=eoJ4dOstszO7MCwqb%_DQy8tS+x}cgQt?+$N?(=0_7CgF4E+0g+0D&Hv63T{k z`l$~Ove4A&q&7(vdHsr=M62fd9`|U4k_MTwj2U`wlX=}W(H&U4pT_?p{s1+V>uO8| z-l}tX4|&3n>ngS%Bci?;6$7&%6!;Z*Ln;~^m$amo)Km-n;K6MRvG=E~KIxx*>mbk? zjHsz&JJ17%OjtvN@jKad{)46@_tyi|?E(Fhc92NNcG@~%k=8^-$TC9{Kb(?+t7ajh z=7ePhnoyHH+oL6cS!NR(fk`&5y^m0I()$gj|9@{tagjdfWzR=(e~mZYgqrU^6Eqy+ z^qL6kbwnnO##;SmSb%a*!ehg$b$Wy_E~hgD5N+;4RUBZ*F_CS3EDUCs67jK-r~q!` zmT+76%GCLl5>u9vlf-^JL@;HK7DW6-3UjDP3P2hs>FUa|umf!&i76YuAGehRzqIfL z83qf7$&IyzJc{;kAC|*R6&VS~b&;5R7sGv`*L^|R>%a)mzKt={hw?an5{}9XZTu~o zH&7_BHHIuS6mHg&HAxc)*$Us$EJ3z(KN*{5%ckQ6Rs`|8ARg>zNL;LR63@OS6Zjkt zl_$ur1%R_PZ3eTn<O&&L`c0%^C#<+T`MHL?F*@FCD7!1DrgUw3ng_6|2i(?eues@e$~K7V|< zSsv!3C@@7|qUWVlg zh4oiM2ODD&6iC4PL>5~H%Lq+UbgE)DH(uDj9)bOy2rAMCwiNuIqisv>8zF5pDXAmi z=#Yb;uv|;tCdXj zc`9xb)*-veXd#t|QxCqWaI4uecK_bm`duKa)9o?n@B-Q!8v^0k7!wv(goKvi@wc>} zwp7|277jy1FGJ)+s{ow%YPwXzf&}-*Zf%ld=%RG4TW z#6_hjSt<4`*s|?ma2TUdR)J@^wxve`&U@6Qx9%ESxCnbr-;Od7gmCHK_foidVW#cj zQ5_iET&-=Q%1x0OlzwPQ6E~7Y?FSSe<{OL%sHdrF20!jdkI;rdirg_*nE7)B$K>d# zYP3Jll+E=!lcfs^X?6p>aMKPad+e5vShZ5)tGXPPkA8n2H#=5FUA^d1P9t^d8R%}M1zJ|{ZdxAh9RoEDS@~C^;<0~!LbKTc^71!%fjXpA1 z?BC|;QopN74USKQ2m_y109Fc2--+IwVIRC<+oI?ISlh@XBIvR*E6C_U3Rtm{G0er` z+Xotn?X9nYu7_~!2USg2xUv*sI z*n_axX9J>@AZ1YVdn9Z$j66{ z#+4?*77X&s3s)E?5B>%9_8>u$rYc1U_YUfF!idcv_=P7I&rj9-pCCt?%{Tj}xC$MID1 zy<5xj*;%=cF&_Ty(#U;4J*GHXr2+O+Q{={2I(`gZQ2K2Ih=wFQpsxQ8O8n6y*J6h*5o84y} zj?7a~Iv537<8jY=qr@hZ|0pxI0-8YVJ7tZTtW;Tp*?doKY?)aTJ`d}Xioq)f!LDwx z;BKOWiasoA$PpaeX)W?pk5E(tJ!Ll=!blzL$NK_|!R#BfIJUVF+5ZJCl)=(KNq&h` zdAo*u*9NntWjSJ-tiO%C`GCnUTXiXB#LMkm_KF|Gry?=YAOF6g{vB2zThNAlflwib zgHp$aWdDO;z(t;EU>T!eksbF~r;M9ZT(+8?1c6NiApE}bkeeZL>BmTY2P4|ZF9X-@ zy>E7!OkiBMpe4+8P3L`cyCss|Q;RrLy1JIhg_C|Khj`6m|0;9VG495|XDp<|YwDQe zH38r`d<=1#a)#foGD97xls=E%McsggzhEWgS0oOo$N)M;q=88l-7Te#QOR7%o zxR-$ZHu5ZRO*^$lD~q&%X?>-?;AO%Oju)iE*N^Q?{9d1vUq4t)R69?H& z@xSNx-6?LpN+un=!_5mkW#S=OGVm05h)11sG<|l*%?VV_cgA88xI!a<=`c&j$5d6z zfNwzd^th!Uw_Ja9)5?hscdT4N(HJ03bD;{ zE8p=51ZA{0#5wwDu0qfPJkSb4S+1TQP&N#h7BFKc;$o;jl{08yVmUv+ZU<4IJ* z)TTh7+e602#Wt4kdRI1Myc}&9oE*Ofua)D&;LvtNsqeKo%X41wR(GhR4qYmPKQpR1 zz=r*MHlIQMk>CArSJW#hzZ|wS^U?OGsrFZy!jlEkG`%>7dlrHN1#zzn$H&L)4?J=v z+Rl)ciUc8Vhts{Y@MlrUsH>Re#9gFQJO>atKdgmwTpkU1?hDqPX8ts?q%X&Qq?h_S zPIcrNEm}vPdfQC!2ewZ-g^#I+(PPYODNa*2m$8V()#k&3)2wbS%&Ra*iLIvHcWVzg zY$)Q5fsk)Bn%W?67bv5#G_F`{D4{1dRw__8B*yH9WtJ-8aUx6q>0lQcTmdv6l7`R6 z^F!QNDoLoagwVjV9esAH+@p>o4l={}6Lfk+)ta^uqW*r9kewz@ieu-?P?-!Fsd~{A zLE5_>OcJynjT9L}RR! zNeDd=Bt}>Sc%U*x#JAL19|s~rrU(cPt0Yf;ww{(D#Zyc}Lw=eew_2@%I~lz}6NVOAbNwztA&6`@!-Ql9v7uF->5!w&@47d(pHVCSkY-nylz4$q&BU6riQJU`A5>=$MRPIvx( zSlVj_Xti*pU?koGif$Qa$^?Jl{p_teyx{a85c0YfTbn42WpAZq^ZD($cQ{BkCrYY& ziGe;)gszaugGfVK?{T^I)$7Mj!MatyG5S#GCoHmlSQmWL%H0s)&xrfgqsCg=m|ouS z{V$fFSH3Vx2)cpvshYs;-vMkTfr`JwL>w+Ii$?4rtKC3?_V$vYwKhuT4lh1XTIdgR zjR6y2U7ctRmZRVQCbpoGWY}owbHShX4@uYHHALh$h-dGA@ zRFZ(m9s*gQj%L?8*V zl*K1T!3l$TM)F|QetGB7O6e_7c;o7(%YY=nVbmg*mQL;9=dnel=dz$G((PoMNKN=*s{KcPqVq0-K5-`pR1k9Z9S;25bAGcVXO@^**yze~rx3K<4QO#1@LYagQs&x==GhM{GIh*da!Wy* zwavP>7&xl$H=x3uC1z=$t^Q}?ME1YcP|O6HtLDFKI+6D6CxGH5|0N7E{iyk{^-aMpwpXRjZeXjJ z&I*a#v3x;kE912NFafwcQKa2iY}`H8am%-Ri1?%B~& z2I9(BUIOp)TS6WKE_?&S%-eVGUcbzdsZ{Y#WD#s~j zs9rrK&ePQ}=Yl&8I70?Yk=Wv=i3Gnzm#M9dujw$#7zCKp!dl8j;?NwZtEpyJ1O2|_ z#mOrPWAu;9LE-Bia9 zOT4%2%a&1iFKUAVsO8pxX*md5d*p;VCift%ft|ME_bU0)r-~TPkP#ApCdlk*P;C%| z^A07FaznoxQP_89x^Pxe7(!Oy}YKyVAe z-5r9vyE_E8;0%&rL4vzGL4)hy1a}DT?hZ3B^UZUr-a3C_*RH<1SFgTS)Ie1;>CK(E zXaZ>uDL*?)EPs`KqvkZ((<~38{eU=kZTsfY* zeHr|5$*;ed5E$@sm{lS4)F65IFD6jKfqBEcn^f@cRJHXUw(qGb=#u6fp9~PqIdbTj zi)9Mf@uEf+*Pq|dw&#OfW^-$+A^(m^5dUpIx+d}#LPm=zWu_`Nc=xo_mdD>+#kuW z_zP!iO~>&{xpZH)ZK^fJgVLM)>8R&h&%3{J(p2`q7lcZMs(m3A{c{gKkyHWl&7P0{ zTDJF6td`rgBwN4e=@bjcDy)34qL#C*2ut|tInlHMkWoU5kmB6jY_dBQu%1d*0c zewlvGbqzt&?jPbJH2#}8EP5u|MD5n{B&_4}Z)=yc@)Dg#YkZ=9_^m=Wg(?k)Z@<@h z_lS~op?=?@4sR9L_4seLp+(49))U#8XnXZ(SXtiC6FC~D#Ih4{aXDzq)%HH1PJHd> zPWk4dQyUP*fMy~>h{v*j4miqupSaxj9$KkQ!mj=Tcxn*eO@Iaxpi$W2GZVUV`mFkr z1@{J?5{+tCE1l4U`89s-3ry}62~4j{%2(}IqYHOxIgW}lcuz^YkcpduLVOWCNE_zB zz7zYAx5_Jt;YmFT(@`%L&8lq^FnohT!%lKJDjz^$>USm@xDyHNt!u~p)7%l?yc!u@ zJnjy2-J6%6ykGf1=WJFo@Zk=MguUvC{g}Zm*pwrYqwQ=Gy42+SMNxf?-hN-?(AW3d z#(-H37NceI7rc*T(O=!797_Ka0y^U0>>e=)x5y1}ft}{9%oGf34`Yo=VuEB7u89jEOUjJr}q& za+b3qcK;i=cV)cw3ysqj=kH}Yb zZ&4vwE{dw(L#>e6Z80IA%`@Dldi>cHR&*tc{&UKUMgy;uipG9(V)G{QJoIKzp3!q5 zXa1ujU%SU5a$s~L#LnRp?oyE5Rx7g1l|ZYD%eNTR2v5e{h2qCjy)Qp>Re5>f zc8;PR&yD;EqxLLsM_`IVaX}t$M_Wg!s0v@mm>8*T zs{Biq>N0?3U}EV5m)dVA$Q9aWX68%YGyCmx1LD|E*{l@r0Gk!b=2(MsjBlB|#D_rK zLm8T#1BUc6yaK`ZIP5cGsX7ud(dJnm>&2FI2f_rgAAfdP6z>qG_D2tz$A+Scl8ns4 zxtWxUzAsx?rgxi865j*50x4M#IT)=z@^)bkL=xCdTq(-JI_SfE<~T|XLc{f(t0vAb z|Ju{u*_S<bz}9TWtk#uT}#xS&1=s-umXeVFfjf+vcDNwdqSpGB?w!c?9tJGAviz z^QuB`#C3)DPxGVp%>&Whtx_;v++bd`v=z{kCXt=_AcuNvMJgrbXHpbu2|;IBxU~vF zs`0bFE7N)V9Z$xC|B`FftPoct)D8;fgS@UYS2){yHMFwLLgb|jw7*3bi7<6<94hxk zVW-$_zbn8CaVFKtJK1m9;}f2cg)_3E#tUU2axsOs96I<*$%*}PV5Kf*`N8t#rNU93 z`r>7fy8^Y*foY}O%pVZ|IAPUZTF5TJR`|ZshqFh4j2HSMv=`brIq{b|SH9&Tpd`bs zPWN)F=1iQ{DO`-U(`Ta~a^M^6h-?7$c-R1va!2uZ?dAPb{Hjgh!{%uJUzwBLF3Prs zf0TEY@6;;w@8wh%x|Q3fLKQ1#X?CL|zAqR|zj~2SZ1k;e)z%v>ahknl^V*Q5DoBp+ z>w-!7^>)naSO$bCs~uA}XC=cLr*Zh5PAcSE@1&80r!ztl$v?tnjcv{F9U>r|-)@?r*JtOZ}XUY8$j^$(A&ZtKVwzs5;kj{|$6yt6wW$;rcy z(#Eo`Wu-J#NU2Bvj{h{D&MlYf=gK^!cYt%cdyQJ^Z44H=*}jczNL=Cb!U*lt`bPp6 zeq?N*5Xppa)0Wi_ySmnUb(?ObUoh4bG8R3?90zBU#z98oq=7OvfELZEKs+59gcC;P z!$JWoq!2A22SxFil7%gFRvx)kh`GDRlGoIvg(>6ZwqB{QtQH;`bl0uAvBR24ER$Zc zW4@bq!unLMN)~rJM}wQ3HoEr6OOW^2?aX~Y`~Y=c*%9{Y`fk^xT2qn@Rf8J9nuI6e zoTnH1>+LJk-l_+qn@jN7_1LY>J@zLfy}xevB;!5Zw*$^xwhV;(%S%gE8z9!c;5848 z<)QP+J={1XN{C}N7JK(wvoe+|ZQ)CGRh8d#2V_mMS&HsI`jSv?3%4*T0@st)O;Nkv zCbw%p+H$Voh02kzj1a8W)oo9!@;qYE@9GM~XAKeC6*6!d>2_SuO)%T%fNi$YN~JdB!7S>x+hZktv@dwQ z%!KYj@vlH`1*}|g~ zU6>`UCr|i9sO?e?rMO#em+els@wqEcF^?K_*yYG*2y5HjKQ9hd{;rVYje#TFWayN^VZ-kUC>*#lC zX>-*7h(pQgIHuh*-o8n@H6H;hwMK>Y7O%dVzRX{Y{rk>F#nBey6?lME+oSKmiqIY> zVf_1q2mn}M%ZKc6cAA2(k1%AV0egh9fXhJ|AEpt(h#2##s1$@Gxvi$`s^5eMvbd}) zwwg=yulB9P7Yl6e0bh6sLp``~h@-7Z4nxH@5(ye|O*%#I4tmR>cZ6&`cVg==-TB*< zfS!KdyJla&Br+RLSDdTnXl~HJQ~f?Wdr?adywO+EUyod8jF!>%Ea)Sgs>$CbdFh%e z)et2Dc;M!+yFM$HlRfjmg`DRi<~h0vqBJD!l;HJ=eaZoHlAYo!bX|iK18+jNwyU#y zB9m*Mg;cvAjoNOqp^@Sq(FIAeVbfvokIo(63A5$P_`G72BwFcTK?nM`Hy1caO%;wl zJ|ak5Ta&`3X3hyL2ygNKQHs2#2)6S7j1xTN3Iaieoj;XgAlrur8%GR720iEH1;ZF6 z(jg2#*1n0Cot>FeXnI=t;f`47x*&~ZYTyzuuudy6!@rRLaHTUde(q#3aWysmRx~4Gt7Ogp?aeWH* zB9xod2D`a?jV++uSq%Z*ts0<5ZBr+T3v6Wja-J=E$}u5A1sQV%8+dEPbA^kKITJqv}PDqhg|X%~)to>xOZQq%GzTAXa^~QoEG=BX`c8 zXcflgMsoj8Lioa&1rypiDmtrjCA47!H#@)l@=?!rzZ#*}?dz_^3t ze4?R$JEiK>vfnF{3wE>>>J$V#P4x84j9}L2$fLCda=iZ_by0SUkCi~YUyL^>w}-~x zp4jf{I-v8kWtTVVpVEMX-X?pi(2A%D>P(+o!J+WXDW3}JH!t+c4nu|!cr27h8TlZ} z6s4hgNi7|1icxLbD>ruwim@1sUk=DI6i%`u4tMW0eO~RECNLXKwARZTG)e#Fya>Y2 z=BQY&wPmC9ZFCqW&Sw*_Qwx378r24msrBaG#Ca&9XuL zV0OY>WnSx0%;bL3fz@h6BZJSK=W_!2ELXeQqY2Yx(BZUnFiTbnr1Hp_X*P&q2mEwv{Hw6&co)kF4`|JCzywuG* zH6lwGxplaUeEj)n|BED+yqU`g$v-Lt# zQVrD3d7MSQmUOt*`v^S^FfDsfY~KZt5+( z-l5@lNnz04kN%5kVJ~fN5_b!TW5ElGv@Outz|-Y-)!FqrV9OzU(Tl~PAnBqScPy1=8mSUvZ+aIP0pqva%D?_4|JO&b%MhHzI z`sf!=6&9YPMICwmg@GL>X2Ff)K??@yfA}OE6bQgEi)w-jknUaH-r{#F~;BIQ$$+9xneE&c5(LXXI&Ee-2 zTkcaP%43#zDdbPl>tFs2{rjKsdx4sQr*2HacSr!iH8+JI5>2nS@-smUAF_-U;C%sa zafUZXqZ+Nwbf##kzbHZA#jr{R?V{^SjI<6x5^uBoBJa%FuaJ=ki~KRk#=Q51b7>Q- zKp2of|8dhW0|#P_?+TNf$O5h}1?-PaNd7kHf!7Ik*=pxX2wA zP6E1LvGaob3_3-Udk+JnUY)GM9XH`P6w>@ddd+L_gHf=SHuc+C5lp1bU0$P)r_#j* zf*_0HLN#qX&|3M0w?D->%qd9;=+-#cF;;NV2)OqHwkf(rUoi+gL_e57`zEx7Tvr$F zD%(iyo|^3|s=sG$klL8Z4QSDrm5nJ$;nLRVRPVH3!h$#FqLDwHz+VgAIr6~ur@9qf z#|eukZhJ_wp0=v*xUQ2i1U2SYRDGtLx)cOI;VV2F>(21t_NN5t6Uhj2n8M)^q>(c$ z0HI)&t}jpih%b?ZmPPKg39&#&XieIs8#waW9Gxx^ak14ntwx;Ge0&YJ(1|Zq0lEjG~ zsSYVn8if3w5<_k^4a8@A{#VGM#9BJ^uCR!NjL)UAUk&;!V(NRbF*9EWZy4rVH21Kq z{{&!&HBlz(8tT8g?OUT{ZkH(_N9aQg%7^q#Y*dx!m=@gb;T>#BzCALc#%mQFM*roA z`tG>?Z5{NP+Q4L#*q<&?CymxmFh81q_FkBAL0s+C71R3S$ae>O{SfyS{lx;_{`Fd2o{#YtN)48e*$kJ4WY_t4b8mV zUF;7J?f^VPo#S%E@JYGHjL`A+LH9j+wZV(@Kuj1hE9{xBeEV>Seg~Zi+6a>c|8CyF zmZPZB$5?+qW%;S!;iy4z#KGej95}8KDct3k8!5gC7AJ_0cR*@5tRJ6Xa?X!N5oxdh z?D#Ns0(cr4M4Mc0N;t{frA2n+uW`yU2d|B=C-Vt?XA5p`FTjE6wk8w-M;b45g!ct$ z`GhpKzx+?#S{H#W&^^MeRb|JK1jY6f&Z*6boXjomL_DM1$ML44y({+aXdv(!88)1v zG5=w$Y2%;_xD+8L%JZ<_{!=Ru=sJ-jAasrTw?(tYhbA8JPGN1J@;EjdjNZ|az1%Lt zwfMzcw$=JiwED`n}aJOCg+(jQyq#vmS~x#7}$<|zQx>*8m;L)XyA(RyEgpbg2ka!V$jWs%^bWCu zJJRU#QX5et{kBvwNx6V(-7|pV-CBJug&i7$Zue*-o+AYGAFG^|hs4E`wksHWCl)W@ zA!JU#^T;NJ_Q`13@h7Rh%X2XVx>i*0lRyX;T=WyXEWuL$#7veQ(l{d|01U4j$`j@G zlggR868hg}^7Sg*@}CF9Z-D$;Qb`m)XTnsXX~O!$L?*I?*nGdfttU`~DXEFaxLnAz zf!3|ud6%E!`hl=Qd!yiwp(nVtGYyCDMK+Hbb8K*O@ce@sLPudp*iRilbx*It(4T7$3d?xn^mJB{8jC2WRdb^Vz z4W{`jfP~01$Ild4+&drrDM{sOYk5A^3|KmwyQOY`#XZk|20h#n-=8TXBkB_`)yUl8 zR)l6kyT}=G^)~%+Dpg}c4lmoadtfy#gUjN>w_NUb;B%q(;G}Q){8-#D%+|F9-LZX8 zXQrBGm&=~6$m{R&n>9N~B&!!dYn0cnIi~#{kzO}sSdB&LcUP!b2EX5jLuHC+n18HQ zno|vwZ2&dP3wXB`bdKYjf!up`Rf|TkglSRo&Yyb&VQVYw50FFrz4pW(3kIr!h%fZc zl(0FsY>*O$Z;GN9uRDLQL7#D9h9j3tS9B;duKCqGxijq?SXtOU)0Gz@=EpvL!yPy!4tVrXvK<*q;>0T zO|G$Zyk~q?CqUBy9KbD6Aoxan`v?$(M#(X098S$LLC_*2MWNF1jF$)Y50WR&UQj_o z4!8-X{DdNGt_um3G4D?`8{c{v13!}K?y%kTKiI0fl8f7^7W&&pQ}Bb4a8H3-vu3bMj{NxF;eaK5 zVEs3r{#3R7E02e8jEK$w7#L|bTVM?+$>`0Mo<=YAX)gb5*Brh0esaV|)7#s=qN=EW zi$opK4s{~pAQ9?7IK9H-JbwfNgc3{g=U+f(x;(l z2=eVWNImfCJYUQa-PFhd5?n=Ig+C4jPbUGl`|_b!IB&bIvFW>!JYGG^CD*{m;;r56 zgjX@QCvoU0I$OZP4arzYWkh@1QbXp*d=f-=(evpC0G~t3J9`}uAzYk&cfd>nFOVnZ&#rr$=vAm>4fpqD6+Fn{h=4Gcre190lj*AUM4~69S zHal;sJ&6F7TCfUnY#)Z--XK|6&tQzYJvrbjY0u-#)pgKRyqQVE=e@|_ENWalfreLe z;(;A}I1gtl`gttx`w#BKQQ*nl(&$9@BhtO$Kz~2xxEw<^#1fG^IDls*w&kP&P`32( zLA*`qftCLNur~E7-1|GyK=?~Dgjn7Osle0k&S79uMsey%*~4NiuKzmarazM zQyqaj`*H%6!vvi(x9Bbv z!PXzmpY9$yu(FvfD9*WE2}B-V9rbS`kHTzzux~suGePNZS^>c5uW7tTf18q{r9Y`d zX8ScWY%s4s3btgf0MiTLf9-TaML)E{&$v3yiW45Qrw+e@`MR#RS1E4)EW)xTKsFK^ zeVk1j;|K`l17Mwws-5Q z4wV6p5{C{Do;di)73WChjzou5Zs`4w`Sr)<*jxSuF*^yZ9QhA;OxpZ)sJm?@Nu|`8 z{cA86hZ^)2f#CV-x;-E`6#BGX*FN=zvi>v=+@&T#J=}PZ1Ar5@b$U>OA3yX!0f7Ex zN)W3UbinLaF!4t`_U;!`Ih^+9B$?w!pIdZXMy4Mz!*C~e<0uZI?$W6)-^dhaELD9~Sk&oD0%-`4yFD#;@Mltp$aDxSrQ*{Sts`*4r#**>oYl z`pg^?@v|K_TEv4#bS!EqIOJ+IpS`7o;1O=c#8aSWu5NOgckK=NKEtGaYWQ z#)pHR)$E!-X4)EA;%VX6{V{y-<7e5I-}0DA#bfz)lz9f=a(Mek3pQ`5wSdfB7p%${ zZ56H?-QhE|NyVB6X52R)iQr+-Rxtsdt9m7AD;e+0<|#n*o-d8%q)-RG(;F|8yflLs z?pq4C;9n5u(-=5HW}HS&c&vTJebJfb6fS;;GjWO5Lbp?9ayNj&q)q|J?2udSCVK_4 zR5iRJma3t$OUWILN>d%F*lFYS3&UNOxmjK(wh*)J z66K^^QyUA_UMcR$z*z;NK}XU-xt2WrNyCvKAsudfe~tXUiD?yZhYZRIgY4#Ph^uxU zTbPaG$eh*vtlP`0t5xJ{({qaH0hdlri#~%p$|+xPZ`!s}AHj9X#xSrf48oSkh_UDQ z{;`t_05h|`D^3vUbldM&BWNy}y_;qu^LgD3LnAO7=bwg$g->9eA|P}=5F>QmgJN54 zobXWPLR_FxF%#a#?FuPEcrA@I@p;*&dY^cPb0wo=r0=LKyWWkX)Jr(0n58$gv=haGJio63`ZhLd*e$l?d4CkKM%bk)kJgiH^^ zz_I=0%T$p+Kd}MV1(*$wPv`Rv**&n>BFd=)??S3TD^9AZLL#9ZhPvDg$xIXR~iWNuSb0Gf^#(V#EgC z&F866mY@nSQwHtx{;*;a6Zh~KGSMp6S#KX7)LVr2FJVzUE1D0yFg`EOCEeb=qq$Xa zU%=TO>yEDoD16v3oD;{T6EB#1q1XnbTkl>;R$ehKzx8-v^x$Yr5cvx&1R4GgAYXo| zt;?zF%zOXjy?-jdAP8hI3{%RPF~+puygq0Epqs-&v&XIrnzi-u z&Fb62^*X#+-**%hzziw4qS1ck?ATUH)DuGJn}h2{l-2mTH$!+lq%O5-Yg@OD8taZ% z*pR5lhu`oA&&|>gx0K@}pXWvC*>8uyxwdht`Y6>ovu0hIMHp#VsxnxyjEmd=k3B2! z_Gno3ML+Pd#Nx8&g^q4S&I^>><>mTBwdEsCf#*)4tr%qVNq@{};#r#MA-ur4CrY`r z)hZ{wnzYZc1M~h-14JWntKb*m8?-NX`}1e6elXgd5_~LS-zN>OaBx6$g;e2!gW5vz@)QPG!uZ_HwBEyy zHtJMVnz-bQ*xwFR*j7^XJ+--F#BIb@wG5&SVR9=EFkQKj)+SqpxT9YwKpQUiBTZQ> zg#^2d9tcl2BAhpNE`fy3M3GL#ib_)-J#siiV^cQz=iZkOaR{YUMQ}Sdz51A$Jjo+m zWz{<}Lm~1OoR)M0iTq9#!wAm=;ih?T!+mq3u#(3Uv(kcigND|T{YLRXLqk_4} zbSJ7sS0%@GDGIlu7q`2gRC85d$1Tm{VWt%%d2Q)2d2ad0=!zk?1)`L_O-h0%$&n}E zp<_GE)=2bT_wrMgmq%dM4Q@s$I#sQCt23%TM~kF|4+t^z-OsCULnHd36Jxpo9R@d^ z!)8ElM~*!;ZQX&Z$nuwfIg|@JhXm`qH`2T;*)Z%hcp)~svBOVj)Af73aR&pwh_?}O zCASol24DuJTaU8T{)5%-0q+3*0tBYeFPfaGL1?i_3A4U`*(u{*EsFh&DL&$n?NieT zt{lXF=Q`pt(HpwE^wyr(uPJtJBYtab0jiv+iQJ?)q~?)r+aCo|fuLm46h!Vr&EQPs8l#U4xiVzzlpf=HYI8WAV2yT}p8eQwHqC5$YVPJf(qTn|6VyBoqGj}=1L z{eI^c3;LM11MYsGND~o*FL!Y{vv{4;2h5>1N@j9Z8*$9xaB~U{ZI=&Sx&pPN6mwx` z=BtbH%h_j1$^NE|( zu*nG~$Zq@#;yf^>4PMmHGVQCrq2CY)94;ESa*~&qV*B_j!noWy5(PU{-t^7Q{a%#} zB{xq=a!BpTmnrdk=FM_#`EDH_qEmU}?>zp@(yT1r)^+Ndc`yui(B}4A&sz$r%{%EYsR?Po<7QT3-x4*dTo}Gyc;&GvQ*CfA$c;I?hMCFE5vzJdkOlZOt2(vn3 z?0-hcT6U~z!553`nWFnpBeUrm^}O-`H@Fw02sD2kU5-;Da1mUH6Uz4~K5ZRy?}6oQ zNQWw#3C|4#a5b4}gKQtKO5Yc*?7BVXk9Y$PmZ8T2|I-4#A3j;obShkh6nvloGaYPF z)!qSIO!qfI^0#551B+~j#He>HNH(~0*yON4I;s54p39uHx7t@jNbER}z)C51i^WSA zq)toak3R0hY+ti8>+SL(coOsgTa*-0Oui8VI#oT)7fNawytkD8BvgK5aq6d%>@{wT zCV7q)%5&MMoLNv-D7Eo^Sn8@$#qcSGfq!N5gH(2omvcsEGd#ZzGIp2^zKI`HsA;~a zSO?^8HJUh-s}MVbCRc#@WA*!zKc(Cs>x%rGzheI_bR#WGA){98sZIrn%l+=G($W`r zD|wdR_AUST)@+L5OL{#g+T959bJbiM-o)gga!oTF~MDe_$zhJBwrGWGn z#K@iT*`PS!LBB5o{!1@IkCzEAmTm_mZlrwN<2W_%S(FnF2?Hkj=LU{w14=q*NXEf* zWZsbscJWaaZ2b8@!d53B;q=f+-nG0!hIe-h;vl{1$1pEOnV)b!zF)(+ue%Cy9uYB* zEx!8?6CLW?W#)d7)F#T%B;{3v^46jQ+bn)(&i}jh^0KPd(Qw=AJn+6syL;oYOH}CJJ~Gv-mM%nnHioJ$IbUox z|89q8##gAz#(^7N9DKiPMX#3GCNS*|pmr0(NLLui*f`#g{=UdADG5M-;Zvr z00gXuaV5m0FX(DPwjX`~v!Ans$^$jJK6SlrE9ivFX)~Wl&~QL^uM$Xh7Pg4pXq_agmwb+xBzpQDO;mt3l@r%=M6J<`xBalLLQN{*2Pyb`>h%KO>p)<}lIxWes4SB!SGYe;!=;9V zjqG-3|C({en~YjS=Ej%HD10<8czM8>C`wl0N!&LIFY~y^@fB<7@Euy?X&0_YO;^+!R#UER;7%()>zcZHY^8E9 zLq8amt}D8H-A~=Hyoa{d3KBXMN~1|-?`igJ-CWmmvbi?A8H$974a?S$ut&0ki92G_){l`!PhWKLbG(5T*+0HBV?(h1fW*n;+>^<=xIq2-v_Dg@Kd=3@S1au*3t|b31XFjp)O-MjB|i}ZVj}YFOkd6Wt~ zfqu{-p6h#SqKEant;dVQTLtU0MNRcvWbc1C(N5Ec-b@#sTbfY@UaE^vxKn2` z8DbqKy5ryF-TmN|uu!C9la%T4`=o-svn$DxZR3orI9$ur#5VFPS6Q_|j+L+cG%7Z@ z6OSirGVB{95v|1L0poTYRyn`_I5Gi>pS8SGMMOnA;#Eoy6uTyH;MnwyId*&R5*91> zTVJ(Lze?DCL9ohtqCgIuAC^COpftY9RhUPlZR1W0%HE>(!ISKX%BnT?_H1DDw_ZnU zojCmQ>-|xw)M#dD$K= zv%Kf!typU#uFNt#mK6KFsC{XBt)}ZNfw=KHyy3bep(6B0VCKbG@jCe)L4Acs@@uiN zM92~B=$7B0G1DqoF8OJqUlR=O(oU1n<{5;W;o9x>w8dgq-at*PyX_D{xQ>Kh9i3YfoB{VBy~fM)cAX!%=Sc~^waKs6oRW*VX769RK)}hlz15}&p%5~ zlDgK`<@dShEMYQaN%3JN=m(L8c4;^Ec&RZkq!BU)nl!Tb+jUqjcXFLf~WXHZ${E? zgPBgeCxzX|J;8qhCMU6v-MdIhFXX8;291UF-{uc@MpsE@ZI`Ay%ZqQ@vqpM6MDt_v z&%mQqD%VNgGhToqO3?1|7qSwErw7CiWBe2 zB`u3yGQJ$~=-uOT-730H#N^F|H(%-1KvBZxMB6&T`)2)6Wg5zvC|pguYrYKpz*d zAQ;T)gUhvsw-5djQOL-PO9zs{>JMY+Yph6zfWw}ZS^YkK=}N1UuVllCWk$@? zZv}-<>Q@jp$!*Bf{`M(vUUMMo{)vdmAKUr}zpCUpVdsi0VVd7KDZ5u(mqvnIpcP)N z;E4^p!#NZQku@M31aPx%rricju@GN&1Jd?RJEiZV_k|<&lRWsIVKUSxp!i=WQ%M;; zvxym^mYf|5u$FJ*%|rIWv0DZVdg{sVF$9A&dD?JlH0rv#4sV`^OO^J>FgvFC^uBsI z7EBWq){q%UNx*_lpvDAofhuI)-z5|U)_z@j5Ycf)pUR^=ASn{#NKzwDmbL3e8_TFe`mQ)&R=`7wMM9c0iK7viF;h&D; z&ezaYJ*v_!B2Solq`efk-*`q5OYP(~!=pGGr*cQ~*yd%snf2F#R-&;p+t)PswogZ7cVT`9SD_!nYNkh&eu2v=JMn0|Nmd%OJo3|SM%Ea{psj@lAgJ)fJg zgQg#2Wr2mZz>mBHA$&$@0oE4bPO(vcZNm4ay8>eHSYyBA#{qGk4ixZ$XOes)=R{po zI@)VRIvyr@)5>-nFGIC2bRUB-CPWjfS3in8XH~3*q_m5_UaE!hu5rmW?>Mf`tK8mO zBy^5t6&=^~TtO8ap|&^>mH782w-EL{*J}OSQbnpupHz)94 zVjSaO&@4)i|3p8hnzpvrq0HpqpOF(-Y5=EKc$+26X2+IYety}}z|Ke)`K4q4Ceijx=<88h=Lp=Un_xwou0_^p)jDna;oFP(s^%Yxt1yAbFz_8nnxkDOE zUOI%AcGhHhU_|IpO92%BJ?!ZvE;=YifCUWInLx6ZBg^`}*4lZ#k%Z4OtZZi$9`%20 zm31$V)2v%r|5BOFZ;0t^omDv5MZ`zzFt(^eV`7F?SBUIDA~7t$@fzDFp;Xksyz#oo zLxu_bkiMLiu8k?K^3plV#5}a(5?A+T7dY!fQ{(z2=mHko_*_?`?}11l?(bFHkksYZ z2R}4EE#Pu^+NdgEx!68p`UkW@1k7Q1x{4NPTlQXemAK~@(E~VoOlB!T+U@h(fkr&V zTf+*e1p6$>lHn5XQlaZN&7Bn@M~#Zs)Tw|vJ5mIbl9cR3H3BAb`>p-XcJ!2d)pv-- ze{3;O+6^-#--{AQNmHqQP;G*9kwl~UF@Vd;83)e4W5+L9CcZR{W3%covc4)l#*8mGp(w@DBCYZ8jRYV-<>NQ#-u+3klsYqC^` zI!4o8G@b3DAA`$qhTG&dE~R;Gs`v0Q4(y$#n;N?VDK8q5K?D*2tpJaoN4_{fU^X=W z2>>2qmFQaIhWJbyWjyuyjZ6kYbF9QVKl+bG?uU0x*7r&&oIairXA@Fh&-2U5PAKj(iBg9`reH3nk`GGYr=g2v3Zxx+PE zvx>O%Tv*hfXLs?U2yx^}>_5`Hvnj!6dfSy{VmNeXyc@%_=|RVYKhf1%!*I06p0Pzf znD<@Db9wsnBcvTWmWbgRna;8D>D8%Wb4sqj92FKqoUIWfYd``E;0jaItfa3LAWa47 zmN+1lRL)F#Cr*_th@J|wc@mpO%v3Kl7R(4=N&2GEM!MD>S)0tD%+p(8W>J-!?DAeX^=d?yTC z^;tZ6#cOCh#>>D(`2ey%;~ozBRA;j$g+!?N;#x)4ncOy2Q?!tXFe=5~>O~U`Q-pc6 zb%^}Dc@M*|5029b(Na)*l}Otg-#NZvEpmjHk2I@t&lkp;d{C!~$KbDv8tWpP-My7) z&$i-E!=c9yx9nj+i7N@yZ^sju?J6)WsmD}hkA<5I70wVPUUB&ArQv2&je%;v>tH)D z%yA#SQZY+lQt@wD#&?R8z(!QW9}vhS=Xu_$aeBBaQNU5D3oS);#{|=344Ef>mgkYAG~ds{~pPvb)joJ;~G7Ys-27=^T;q z1x~h)kiAOwHRuthm-HY<2TG=N;M3T}RM5(IMw^Sg5Zth|#r{}eW1v%Ki5g}dwr6s{ zdtax!+P!mJ{3y7OBR9ovZMYOZCL}k`afGY?F`+ZNihf#Mb<^8z-~QwvOWYT+jD)1( z`NX5T@}OE!=L?Pn9`1CYr~?y#FV^^9Q^ZIgx6Kl-pw+FwKYQ$I6MPkb=49j?|$^mzB$Yk3OiL3e$#$|l_pyx%re`@ zoT{4dob?@n&OF@p?%!~?gTBUkBs^8!e9ZtaenhBTt-02G;5brfRDL3Pk7Edw0#S=x z-8uL|?I^B|Ud+1+dGjCTw0Cd64)qu5*pauML4G{s?{k1;qCC@SPdzj&ZC_A4;5f#z zt*EsFursw{@u=p$p8t(BXOqq^OYyYIH1b^n#;-dTB~o*zUmkfW{k?2#P$jc&maSSLg>dj-BC=BpP`U>vbvbb`Cu;59KhvzL~H@t#iR%auHY`+b? zffC0<$BmWtIUTb4iTO9P$NA{19)8OQ?%!#Hq~g5`l5%;5Z8Ii-O-?J_T+i288<`*c zy+cQWB*t`#xqV+zqW^xPIC3|W-@vZMkz>qgQ?aoqGGG&sE)c8P_-ivw>9nmB) zY1P^8J<2xFG~pG2d0LcOg-zr_J|g3QZ&o?bhjHA_l?%OcyIC_uktTvjjjwpN=kMn} zIkvcQX`&@4@!A@&58|39nO2HIsprz^E};A2W`W-XFGtTW`R97td?l?XiAR+4cuTKS zKCBz1BpD%{($J0hYSt3Q3Y2MprX~2;2hME6Opy?HWMnY@-ocQ`%sg!(Y#E3D^to%iMYe#aw zT2T>w|J+5>$0Wv{t|QJZfLzbv>s%4+Cy)^U6e+90Q3@i`5l@pjRv^cVqpxsEaoj%_ z?NicGg|6hOt`xFm1|I@*E_s< zN#LL2n3vIIX%t!GU|0jcEBz$XAsq;&Pp?p#MpKG2e~(6h!Ei`pGDtgb&Re5bfD@G3 ztw`2x;XPly*-NK>#hc-4$)xx2nqS@e_DlC%l<^@yT~XnzKL4W=OY-VYcEq95m+PqN z&k|9)0%F$n1%0$RN82s)N*E5 ziLMUrq8yl6zgtiS^B%uhqZd)^vXBNW7y(}QeSJ4AsYfWqicAKTF>pM(Mh*GC$D%fb zA)vXOWxPU0@tb8Kqde%L3M*>U1``4tpXe3PG=x_s>#HA1HdK8rmDEqJ`E`6FyFn)! zf7=8m%3G%&KVns3?Gd~#u5^^TPDIWi&6CErrKC-jtRE^RV0&HSOL+?b*_%GqPsOx< zVsDH9GqAvJI}QR17T;Y^6fNFI9CfiMwF`SDq#gyM@Do+lRQ{Y%rZ{uvm6wr`V6@g^ zmKoZ$7p-3DvuaXnkV!@kSe^V%@(Vq++2 zyJXS=ph3Uu(Kvp^*ZS^+pZxB+`jQu^{OdCH>Vt}k{59t++N~&p3kA*%O34MHWH&$x z(T|%l;}5ADP3E!q9xQ)x)Jvbx)8znb01&|)B~bZC5{2$uIPNES5g#BxkI%1B{teYs z{?$|>^a6B-kpLsLuSZ~E+-X~OC8kjEYxCc0xPH(!H~YuI08h8Bar^t`VJ;5(9kn9L z;jBNOGk&i1=a;~V#2~^RbyO*fdD_g>JCu>ah|CbBr)>E9gUgVPJVbluey#Oe;g$pa z1XTQ~`YIR&XAFWYiaTgo8JxXjec%x?GyiP9;%Cga!9;`hBz7P;@i*hl^Sm#<<3!X0 zRZH((jtu{;kGGqwJnN{jZeiVVy#KF;!sS%L2a$a#ssC<%HfDl|fbDm4+>xk2b_LX8 z(dwvYE4u$+pn~0Y3zYyiX6B!)u7&nOCz)Z4OGT+s zBTDMpKb^WX?m{WR-u29Sdle9lNU zHF|Sec&sP*N==(Pw<5CXxgV_Y9a$pKk8#jjm7zS(T?)nsND~j!MtHd$Kh&lU0o+~p%!%=L_Wsx(tNN-0U;IoDT$Ldun*m8O#?Ae z*iDpL9IcUqo?5ujMK?BU0CWSa94;z5Z5=zB^VXA~qsQ$q#P zW#tbIF|VqOjr#ea&jDx;<|%gL1?Z7nombNEQi(?8Pxr3&(;Zh4f#OWxJm43}FU9t? ze)R9gsfaODjFRf8Vd7iD!C}h!;ls=_i{8BS-qqTZpNN)UvtA7;G-!GP(lh{q884SY zhSEB>HrUbwWR`+bwUubbKzC|vg+du5>fpEehi4=hvRlT@d70vtW!vs&s?##PZJn0K zEz4!vZ(rW@$xx;mxt^}IuIH)#vp~KQsgC?^>(U3eQs&Suy?fq?Wv*ZR5e4T8CF)av zEFk4!fHx6=qu2w+==LTBtg?>}EH27V?81%+dd!s=UJ>>Kr99 zx~IZ!Q~q@OYmb*xHyH7XW7B$qa%D_NH7$-`&vf%&wHReN@a{LtKN#Qx<=?U4B8sXTj5 zgrPoRZkQV8hRi+}lNzJJ^{X}4_vMf5#g_{t{q&lb?%{F!F7Wn}Rc9`m5Y_3El)^PE zaSClW^L7-g@~9~cWTYsV^jw-^h#U;a`7a!~SMwNw&NgcRbcRrl=g+wOcd?Y0zd#&0 zSCq3;PsR1P&Yx&n^EV2kCww$ylIu9*!t46=bXjNL0N|Y+D1XlIf+zhuQEtQtPOOm1 zzbuH&ak#wwlNzi;cWs%4LxUc#eKl#DWG~&5N_h?cCGJ0A+6GeQK%CN4{^tK4r0ELx zIWx{&cyQ)uo_o_TkIFt(w-x3CG3f>>etJQ&*CU<=7;3|jNxBmXs%f9d38uZK-9ZrPdiLiJzUO^$L*bg|S1x@p^mD#XnAiKxJ!Yng zxaWw-)gm|;B89ouLC&Bk*7kGJ1Nla1k>j*-PWfLK|95~j0D6FO&Qz&*!YOpu&!FLW z8Wq_=ymWeWKD|Ks*UAgCpQuFB6HnTi0 zS;r}i-yu8U`o5c2OyzG}{#-EONYG)0KF;(xBQ>v|Y2C5MqFD?PHQEtrg>U6Ek8SmR zd4^E@od9$)erwK*lfjHQW&Q_3vYy_DjxlR)JC|ea`@!;$M`fR)A(*V$%%vb+%YowW z1d=XxtdR@vu(suyqz!>T=6dRYH1jmeg%b17MGEE9)w-Y=PEj?9yDfTS5*iP6W0dQ^ z310Jm_5Ji0H*cx^H=cabd@G}!%$jTB`{gI*L7a;<3rL1_at!FElt4s!BZH|t zQAC|ykNo}PK&Sek(*nJb#@6jy1a=yq7^NL$zVH80UN^Cxv_|WhGo@N2Dyy=f45W-V z*`x`WSK3yVv`%qE)*E@#>b7}3IwqrS%0E@#sqPae0ynP&Zb31WYaUmS9yOcIN`A5d zIvxIPh46NC8Pms(+%PhqadXhF6I~&`|0E!r(1lIY@JQEJAz8f%DS89ER03x9+=Z$+ zQ$+Lpo7eX|8Zl}1!FVj$ zD>x+Xn<{O|@M)}T%CJsYebx=inaXU|M9tKk-Z>9;hJ3(^8r%#YMvbA>L1R)5{!;D~ zPyaJM^yfEis{b!uUlRIo@v9XT(GSMw?XKW|hPw4Ec6$Oua<-GgYel5j;<*r+qa5dg zV~*U*JlNRb8MFpKhw$WX=G;$xw5AIu0-2 zscs6B+N49=RIP^Yl7ebmx81RxtjY%f01yC4L_t*6!Hmxg`W`(1;BmV$EfRzZKT=Qv zH@^sqhCqv~0oyfr2TK-I#@!Gi&lf$)L(&)m+p29?`n_5x^%62(hUzo0$&tb@(FmDIxGhhx1k`7c|p0B?YH1#^1wVD)CGb%;6}0d z+Y}lPbkkAJMH)UWseeQJcWvHS^I}KJzpSuk4=3VY#Xg_RzK&#H8av0GurSbRisvO8 z0+L4&1P5vrJ>}Jkxn{PLv1`2YGUnNgTt$Gce>bmSXXU7mL&?0Ji0K>UUss3vEmZ#9 zeBdurdyUtxOw$oDUmxUkxV>a_OS(pjUe61&mt%{Dmrl@)y(KULK&7y~m9~2VGuw}t zcl+~<@^_Idn^C?#`=NEWT=0%)J;L|38O&OCMMop4_c`nRD-%Q4L7AQ*5Kk_jq>MM9 zc1z$oHwso8!=yuOGqB5YvZf4179*3H?WgFuNYQ9XR&PYAt`Y{vj<12<2^4m*>fp*2 zm{<#A)l5xF+i8jw<6z$jl(|vBz9n5O1%qgZk2rhabqm@}^Bg zK|LNf#hPi_w9!N`G1!qH?j1(`SX*-pd0T7$3meDOJeNuNn}6a{T2#Bc($3WaIfh+q zWia=nyxnR_cn(FRTXn(;^O_Y68N<_iYJE*nb+Z03DUrJqEqW(#BL zIju7nWsY(q!Fs=I-tSiqQ*t9{D*be#7TQmDTObiNEUNu>9-r0a^;@-;{}Pe+y3Ldo zj7(mlj>|!tV2pt@6|GUYM#1X-GzPRLEpznREKr_xzV^Sesc7x*u_WB> zZ@%Y0COLYZ`084S97QVWn!p2JN<=6wW4*@kFZ+ zm}p)JWYohzTsJ2>STZ8t^vPo0TevYJdd%|OqHbjMMX622_l?vBsB#CnTjYgnd z7mazUF{Uy$irY7Jo5<|9EaQI>NdV z$iTWx^G$v7)|_b?qJn^-=Ci2TE#&5=xm9!QxPNo1_VG*){Kex?@5ZWUXy3V7i8>4- z#ktv?aH$OZA_57|?sh7bdnuV66{*qYlfj|&Stc~yCgv~#(d6a^y27d;lI)h49B|El z^Q+%N<)2J-t7=yZ^ZMn;hdG`jv)k6ua4I?2tZtj$m1CnIlC@L>iFy_%7yf1n;<%jo zm%zO4r&R9D{EfVt=fJGD>mJPh8|$M)Lk~0iZ7BtJgND4Ik)8j!V3fUir7l^siL>tw zRK^=&&Vexq(wv1Gg>5_pemd1?7*LVxfP5Hb-AEqyn}|x@l=ag|n7SSf4X>dNW-UL( z8Gf>A0}_?%+0G^|MO4#3O|Y)twwrx^O#EP|v7zn5u?}{Hc_d!wMv-gAexOvT;2i}g z62b71!!Tv)1WcPg5o5-VM6AF#?3$G@%Qcs$;trI#!#t+>%7IYv7nKxY+=S7XI&C5* zP8x^OVWn_l5%}aEln=_159|BQ`-}s5$ivNxVfd(W$}m3Q(JX_h-(23v9h9g197hlk zT5b{?Y{wxu9H<|TbLz=NQvM&FTSC`gxEL3%IBsmrbv{j)7C}&kZfvPEMQmaroc4HNL{Dx?~xm89M4vb4q9Ae0msk|112K@U*_V zT0q>it4$nGqY+>fs!^mquQkOP_r%F#aq{sCan9+BaL#E*dh+2gJkC1xC>-{Yy)bs%C>Z`w9MefbJ(h2d&5YkrBrl37 zlgHtNMF-*R(~rT~l%e9J!?5f8S%}gw2xM)luX!sgN@ce&mc%S9 z*{0<*0!!m*-pG}_P|PPUyCkZ|wf;nP4U#prT`J$3LK-qc1H06v(E6i59yV*}m9#~e z-L)2c%H60;synS9qTuEi!_Bb={?N3U*}qw5H%0)^WeA#TH%B^;DzXp@7gEVCVIhf4Gv($`3b57sKnnMLP`dU6)_4fzgVS7ddMygt2p ze^<))wu}Idi0rIghigyUhZ9d@D-_-p(Op`92xgs}^_$rvI@?6xaJ}EnD~94gh+N!! zAL-!XKMqwrluv7kh(^H_OmV|lDD785%WGkIHf=is92mDB1bf2Ymc&C7wk0+0XkKSp zai&c2MFmO}RQ_hYeZqt>7&m4lYnif)nnGbg9(I~F1<|~GfQlL{ACN;E&QVM=|x;4`SqJUl?na0ToYUj5eF_*bpOz_SiA84+5`sT8sM8O`|J+nTdTIQ002~ zUUez&s#MyWMA;-$*};%5B4Eg_sKyJRaa2?#C%0wHE3a*mJsu1QXh&5-u)Z@{jSZbn zB+#&RE6sS`9-URlQa&%@nQU#(5hq+<)XZ{C-fIbX{#we^x!hEi9@qPmH5t8r&1{2M zxiLfvN})Jd1_?R#!#-2_*TKwuc_Ml&od7Nse5@9=ZWxoggj3~f|1GU)9)=aLY2bC) z0tF(<8>vOYwq4CEQ&#h0)+}RUn0=B@GD;Lm0g8%TxhN{kXEqh8<{557#l`f*^4e^y zW6B#+O?4e;D)aop0z|3AjQ~70-*z^WZ4es;=Q9qEJ#) z2ysojjpUnhOxKDsoBoghVKB#l*+r|3c}>UcUK<>nGO`z?D8}RTCjw=faqXoNco*U1W+AX2=IM6Rw_b4*-oOfx6beHPfby7EC*r&(K;J&-fx)?P z0Bj*RQEG8yc1^x!vLS#fsBuJwHnEam#%~mGGl7b?dEXZ*UKkbBp1`_k$AL%kjp7Z+ zp+Z+M&kqFY#z4r#gEDzdJdCjrP*dB6pWzYkH+(?@q@5gqFssqSjvS~+x7%D(<-Oe2O9OfexKary!+csyx68xPb@hY8fO9$Jn^4Qd!W&P z?rphMIyeO)*%wOSLS%M2Qp{!9?d+`qupNs*wU=`BRuTD-H;Nx7xLNm4*4Dv%>NhOE zf6`r@8MlO&flc!>6$AiLxr*bnoAR1Ejb+&f8UjAkjBye4jmJ9ZH`}AkMs7o3T`g#{ZBL-cZSs12 z=xNdKyD9k^mM%?a;_}}U7nb@^*ZGjKEE5Qlq5>5#{RHxTna5?(kFDN6hL*p~dQ z0nieSL9}1AHQk`KZ8Yoqwg)`8g|*0N65|)BNMoSpl-qd01yC4L_t)mg+ClZ4q-Yp& z_KANqZl+)6`}HPnOzHKnPg6b>U09qt3@BI#1I_dxzh%9)`^Jc%>>L6@IM5(4sVrk;@S0@TO>LV#nSIk|pZzp_ zX*Pf$Gz7%RMPe{)C{7S%_eauH=yRRd@FCMQ!4cvUv<+BlaGa3|F6Q!;AwX=MfDW@V5|d#ThG-qx*VdcnGX zbv0+vU2~yl;GNB6b2;znxX#B%oN!&SVNA`no;T|YByEnh=1rSQ1n-cuKPIVDa`Q`| zB6;8ija=O{JD5(?L8o~xxSu6CQv|JkUEM~)7|zl4q6r1Hflab#c$uM`syV)Db5(-s zhOtqs0Vzc#?!c!~^r-LyWyshlMo`&mDosNsKh6C#%fTpr6Z06t`b0d;{mx`)aR5^; zDBogValeU7xlHvz`C#fRmZy?Nz{hRDlf$_vX!a|NhtG7hs28}A$j>L~7Q9UVJRWab z7NAk2n@O55;{~LJKW&0;bKIRnt^F z_^nej9SzC!eE5-%H20iWO!Kada|MC<*L>?5DZSuEkOYk;C&Ng~zeHh*P;qYyW?MU$1$y>U1hl{<@2w#|>Qn#sE+p2+1&K z1N&w^exuE3oIN3FO`rzL_Q|*e5Ot990UC$s&3K$Wi3f<&_Rh;T2^y7_ITo0G4emE7 zH=hdDr-JmU{2CP^uP<|r83jp2Z(Qzy``nGdD9>%m-;@!D{EYGiG+S#=Y=?ZoHekvJ z`_23r2gj^0lq*AhEgY^*-AqIoz%uRICPNd1GMKvT4@`TEO+QlXn@`fs#tzd>{|ycX z6U{oBa%k<2lQU@qU%~#?~YWqpuW?2&r zvYDgJd(<=3qZ%o?{u`>QIRf$YHW$i)*j&>hvXdz1^ob|M=dD`u^#(uDu+mF5yp^ii zjE1TW@RCNabxqjdsecYqT`N6sr93nHr)PsFBzr<=UCVR66^K*EhqJABk%IQC=pxOn z3n5(G{!0ypJT}MJ0He)NOXY8roJS>R$S6Id{J>-I8Z%1Yr^5G0sV4Fw5i}})&b}3i zKB`zpOEpj zKLC>U{7VS&DE3hyWHSbU&rFsH$!(o96pwiN9MS%~XAV5D%=AALM3Z4@U=Wy4@wI%{ zagI?+=8ICLP%_;cJ#j>sG_kx$r7!XUIFsgb0Fre5`^jWj(OgK2a?ChTIqH(pM_x0s zu3^*aMAe3;Q*~8Zn+N2m)w&|26Dx#@()cH{u9P3BGTQf%s;{IX$f&1#B$|k9QI6i& zQDry1#bd)Ypap;-x@}hg+m%v~CY-er6K#^IP>o^>$f05*!D&>Eno8cu&%^N1BQS5? zOdPQ9t~l&~J#fVSyW`0HcEb@oK4PC;aKv8oaKwV0aM&KRFmH0^uh5PzE5gCMOvmAS z%qGpj;jDASg2wo86El6E*^@D>D4)``4@G%V>@s;Q4&R;i7Z}>9i3j67$cMCW*BO{I zVO0CdOc4>37Z*}a*4=Xs<(`Wp_SqRn?lT`p?#I6EzZ>@2eJ;jL8V9$q06H20=n*i6 zfH84X&se$XcyZ6lsR42u+{=9vbR`LUEc2$W44b|9ek(vTvaEczAo z?1DVE-6tH4#4i`EsMp$G<9q&wG+qDZbH64%7fJgbyoTD+MCFEK{Q4~yrZ%PObt?Hh zpsA?3D6uF+3Q8d=_b*#7Q460-8_4pewchA?D&rcdX)czS;AwH|q4{SLECB*;jmjUw z1CnkcpVyO_-8L$J2PzuH*zu!rg{zB4A^pq-}Rpt(~6I&ki^AUrH|4kSU|qA%`uoqCgqdT9H}+HW&T2sd!7v&Z2U5<1*lx4zrY{G~ zpN#`|+X+YPw;N79=3rDDyAX3`Pe-JHh5$VT0WJn3Mk(HDd{rF?7inL`9t44FbyiSjr6q=6>qCMT)b3 z2nenC)wS2IBGd=PDjI)64bA+PZfW)iuzZb>>D-wo73Yf11kB{0F#X^=9Rz z>L+N?=j0XPEO9{Z1-ks*dh^b|a-$F-I@_DbxjmmV5PCK^0-Mv5Rq?1BWUc6w!7U@> zyt1^fv`%ou^fDIOfirYS--5K@vN1*giPw-(W`?#Yf8`)brMJ^g({aq9`(gf^=@>q& zH28-)Q5pr&NCfT4MbvF1M^QntA@j&bTM`jOn#x7p#`00ObxhA6012LAZ(Cn8-7)gD zsS|Zu^Dt%F)@?pEyrXW5@@@KK{`pWzQ4yw29D}15?u~=?+Z`q59}uw)9L`0QYI;3T zpoRPF6AZx|qs0~g4c#K8lil_3{am{H}3L|vHj#*s3V$f2??E-Jw8JI};kd(4CRFNa_n zh?6mx3L>(<6a|E*Oyl6-sw9GA4-qg^ptgqXU zP9)!?W~FuwEz$3ZzWJa}eKnHRo8U3_y%fdM+vE^{R=iAy$SK_4_DagO0wFu*wLdWr zCWYkXQj+#PG|v9F_cv?u3D!b;%QruttnHBJieVg|-4yX1QXYWTi1W&72@(%AsPGL5 z4@d-wdPf0NY;YWm9Xk@c&7FY}!%88-8Ln=;Y-vbgD3b9A%qJdGrc6MD#u1d$h?NkV zCgrcuh$&1gXt8ZS&`dSNs9n&|n^^LxjsLhm<5FP$iWM>6*JtodaolLfqFsXV00h>r zIce>3Z2}QcJRg(tN7NS+Qy$td;0P3zPufE%cQ1jIwiJfr6mK`oQ{v8Hx{z9hW&5B; zD_NeoCw^!A{Nc< z%hmKhc6Wuk;jCQCY1?BWeAA1DX37FhG@YCZ~f1wp>q4@lrs=?AWV z;Wfqmg2Dn!o;Vic#*BpGadY*d9v9^2VHYlml#~{u884s8-xon(Kr!Zx$^Ay8w86J= zm%rw~5O*2OIcO#x(z=2f9M+1jm-1MX+6B#}&+?Hm^T67kEWnf1u1LEC8Vg8s8IHqI zyS&DPA^$51Qr6&=j8;P)iW~r7VLa}-u5%=SSrE|7MypL6HA#z_H*N9VC9N{dK|Icp zo-Sc6Zx{t+k_Lh_XTIr%nn3w`T=UmP33hr1n$ZI^1UitIMFQoY!?S;O(?GBNbW*1q zs=4ozz@N6nXkJge zmk^Lq^no%{C>>UYabrgz%5`z#9GsQ5vClhgN2a#@HOC-;<3^1@`S4+I&6@!RGpY}R zpHD17GMECym;2zR1H8GjEwoE8Y@tQd{jcAWg4D8YMceGW_SzFJn>?0c6t&6f@G$N9 z!OhoUp`o4W`VmaA20#v61Y0V{&4#G`1Q;GBj@FV7CA*XqM`wlQN1@l!oc=Ec=(R6D zouu2l5^3`t|5O9A`7ol;?HCvULUb@Nn>KTAnAwU>a<>LrZy>#+wf_?7uYmV6?WG^{ zQ;8q=p7&My*FFpJ?_k-Rw~@vzl-{I$4x+xw-h594KjOglQ}X(Q*4n%g!KEC0$bIuv zbb@*GWCpEsSKa~Sg_-!ST1pi)9{@tP@-!o+#<$o0-pW_I6oA|h1 zYx%S`A35>UpM>a(eXXx1@6WT$y;|^F4gIr}$n#jzx%+>{he198*cO|8Dk-D*b+FH&kFifh2G>Q5uI{|NsIl@|QHt7U&E`t{?d7-e;#({6 z(wpy+R*;tCr8h{gFT+c(z0))5Rb96EI;m~jufBtSzxH-3+9sbVZ^+1P=uP(HEki5u z-0LgwzZI(yC{9A?w;&BcNpTUJXcU?TIUHhVuw-oT)7%HK+!hP-%`uE|Kt?{4beI2w$ zI#GvI-Bx(URW&~yxpMXI-*aF4+sgloKmXoOZ~M>tOX9Du{(1cEb$|ToyPKEZyK3Xp zk9@fPFZZrn`}6}FYFf~Sr4O#%`1Cy=nlfvbKDctj()*Te`un|atbgYI|808uz85w= zGv)6a>tcV*OV<3tQ~slX`+bh1UsfJ&NvGw(%38ImE2p(#>ssaeDyp?sT`51<%Cx?~ zWxM!hm!!cT0;f%mi49TF`y|~&U<@iVZOCyThJ-U(R^m0mOQO*ekftknYfU}YZrY04 zy81?{twU{19qMXo(LhR&%;&carD|%>NVUNyxlLMk$?$7S?RnHR@~^E$$`EBpHBqvf zX|1RRDaw^3H88!Nq89NaeOq)qF zJs_rYJfat%`8){s&B@qKY$By0tJ8V%*7nradrLQLi16k-gr_sVbx!9;=Dhhd-gpnR zDV*bnx_{(jGv?%sRsGYPZ6y-|k^F-FMPw(4Z&k7C@f7E{ZJD&D$ z;IQ`@cI!r+PJT6=uDjpaq<{YY&+yj|ej0yq$@k!PLJ{V-rEPV#@gko<1`iI?S`lS(T9A>^$mFI{h_Gyg zG8);1^zXeh5@|qr6cy{ypHNNuzfGu z&}m`D<=={lat>#Y$CJ!CVU!^-mzTzzblTf%^x4-Gwk_3=$X}4s{g>#N|W*i>IAe+n$3IQuVvFh(yo;^yQ9S~`< z+bH|f#E>^c)1FZbehN*1HyEpP=na)v%K^L@icbGmok}rPzG=xRQQI3%H7DP7&}Ze@*6T~ zL0Qu`@}>iT{Y3~7Z{p}v>6_02o7i9o9-G*w2gMKa)plc`l_5YtL1T<;f<3_&UX-ul ziHgvB%sl;{AE_Tnk>;E7J)x8_+{mD1-CW-{;+pHPALJAT8Ls-FA=^X-1Y(iGIih4& zffQ#b(kj_YrAm`kHG4)Hip*;NRJ)P!7t=}q-a@5+z3Qj8{cGhf;wv{l z8Lz_9c)CXo_Ec1wWE7U?xbR8l7_850hL=p^W!=0VC`8RRjDn;>S53-aQHd&}V2z?R#B?yf z6*bifn8GkId>A(~?`cdn+k)W{2uVF^+HY>t>>IgE9LVOu7y<#&2-s!_G?yU{b6GS} zYYa>i8U|Abns}v2p6kN=(;&@d0T543@|%f9fx+B(TpEdW4Ze&(K3WI{4FK1bH()l+ z6ce|g*Is+V)eb$Q&?8zTcWXDz^W(8!-KsQn3Jb@AGHU<~+zA&Y&Y^%z;ypp18amv3 z-o)wp29>I>o9~Kqz>Gzg$68g0$9*NTN(0ZdO3%^(6(@q3KWG1bI@LHrWQliMHX;Hi zRsh9;1l`;?fTc*nEe5c$&0{`@CGZH%P*EVFOLFU217O z*1VCl*;mvsGysee3dk{vi?8D*6KGR{YF_zUrgTd4%SKXF0Q%FK(ssi$0 z;&#eDP`)h7`n*Ac-|at*GO`K4$k-b~XB%apyn*3Cc|p01?Azq!u}L$1FcjnkX;cYh z&Dz0@(JH3+nm9Ep`!umk6F-Bc=6-X!IX1ZZ#MO6*Y16qd_?mue!w2GN$figv?|s~H z2UFN+o3LTSsHhfaPe6LS2AE3w@J#>Fyybq(dy@wXN3avF0qnqvAI+ ze{Gb1Fg$cxt;Yp~gNG9>=uUm!F}jL3&p)-VzpMX0d*1;d$5E{PRnP41CFLwx!P%Cx z1%r8*_{bP1Fwr6#EMshtgDl%v;3y|qIfu))ai;tK zYIgUuce;FgC)wOw*L13`uCD3ss_vehb2jM$TxY}d57*b@&b7b0>e*HIe7UK3Zr>le zFLPXRTkpQDt#Qc@*6dhv<9$^@>(9c#e8a)%ta~*dDT!WwXYgg@guT7U zt^<{RQK>pAbE^<3C@OyTClFjQ9(t<$eUubelqV(cMbUxO%4#j47+9mq?R-oaP=A}D@DiJX+$Yl`Wn}C&39D%Rzdkx z&~}hVZ8wxhL6-iOF?ACflek8!-3|QOKovg?fZekCoS^RjSQ-HA<9#l(rx7W3C=3T5 zeAYGWHN#QWNFALe5KmMc&Eb3y)2j$QI;*SyOcr5Q7p?jkT^wuRozZz0VC&sqNpTj_ z4+8zGM}qyxbX5L9rj=*@EpXiS#87unP7o#*hw019f7E20t+w+l@ovsvUqcvvA;<<_ zUnlmL>wbUray`qh^wz#h!aTijVSL-dg>~!S`-btW-|@ydYc4$d&@Gp|>4*&%opbVr zi_Sh{?FDDOe%*yC1)MI`P~cVGHw4=?|ki)e_b+v z>_ZDru6Fb1`wrkti=nvO27S5kp_|t3y#JQJjjpM=NrK$<5SxUvUlx%+IAAR&%czqL z1p}3#*^PKKnV?F>sud)Dr*sKcfd)uOKUBXQjEDBL@^Cp$S=bWCGOn~W>=<{XixP+-YvhCX z^4=tc#zbw2_-9+x*ETVcK^;)&(0)rA3MyA&o#Ocr%1|O1#!!%F4Epbr+hywc0C}-R za7KWlOdJFv(q@d=c-UccbI;6OB+$#bg3qu6#OAYgfSZd!T>9LiUjsN&90Z-=EUG*Y z6T6hR#I>gkXZuF#iX@Pv{*Jvy#7u$kFG}nF7UpsYboEbbRkTT^;k}Y72Xf@#HFqT;+S-m7XzIa#C&wPrNH(ysLP8bCnVQYB>LD-*{Ii z5;a#(cB4K!t9JayHqWa2(3XqOxp3np=bXFo;`2`3c)@uGue|Wg$(t@cx5kklPGiz1 z=KFxOa`Csb+n4=x<&OJq{Zr5u`;HTPoptV7h}=XQZ#hZ4Jaz@xPaJ4U6QJQDSo*pe ztsOlYv-h2i!wx?LM;vh|jyn8c95eSI9COHlIOgE}am+#c;iv;=W5&dBFj~g3pf986~)V1TK`@YuRq z96D<{<+X1CRCX#u%JRs$2jhsMd=ICL4>)LljGH(CM!%{k22Ob>f{KapR`JZnantrw z>PUW0Q(0HhEtx;x^L&{?F;6Kb4cLob1mx;qzyyZ5pkt#8f*<;d`P>s`=&Kp2p|b?` z|F0<%Ma+pD6CJ+$-x*KimP$XbtA82+8ZUsv1v1Y!@iV8No2)6M74BmvZE9d>85~y8 zAGl*j46><$@*jq6{}Q9ZNzCi+%AX@Dwle$lboGf62LrY`FNG*Pc?7J|7d@W${Gyr=4%E;)Hai81q>J`3#@kCm^_7 z#C%YUTr4nehsb{b@XD{DWleuK$#b=+j@!jVfyW#u=`#imHew`XA82sfLmfz5{ zW68~r)tgm64kWx@48A}?eg|-s)8Uk{)A(2+`OZ3{IN&k#G?<#Nk`7b$wwZ7lMX)!C(S(&CmymtW>1+&@l#om zl+x`0jF3D;ea9Pd+8yge5j-lqapT8P`Hjce2?Q#^F%u?W4E?baH9j8W7$3**IHrvw z&iKASgkPXLE((t){RymR0t$2|U=-`E8dV3xG*V5O1Zrxkjx$DPGbv8!(S=m}0Sy4hV}K5bBGa9b*GiSq?*gJPu+Z2pUO zbHfkU|Mu#~wl7MyBAS{}xcYc!i{vq`@Hb!b#yRURIA{K}?6eC^P5dJ<=RR#j6|h|C zAfGU*@Sq~Edb;`3g$_FZT1_uP9<9p#b{J+d-Dw`57s zxa8I~+m_t)`<$Qu8U$aY5%4X-T@G%eLu3fh8zB8k784~V*u@MJC?pV^7#Oag_d9Su z9Lm+{)TvW2ipsIJrW)-~U4^;`5~!_8AnyASElWjM4va?WT3b7?4q#V(U|ftrqP7Od zQu(O@JYE$c72*l=j=)J&h9@0!I8LVVaWa)<0p>E^A2^Ko9pNO>Q#g_IPoQyg3~3*z ztM5q@;AjXq8q;V88aL!qd5r+OUn)z5^7fa)o-wFN#8F3C)m0~;va6;1YHO-?$+V^h zwUogG8Yu@JbN~+EE3=lf zycu#4rHZxxrH8+S%9~?tcq$g;&G6JTQcJr8l1al!{WWkhzCEp*fMdrExb+{>2Xgvel7qt&;l!;U|B(V6 zPQG+VIoL;>b>Bglzc$FaZ?FIDwU2FB_Kh^L`o$cPWgAz{FI{xjK^rbQ_l?uXyZ2ed zK5l%uN`zqKf4E9NA0qP^Kaenvb*Pf3H~dZtRmSL#B~SZ`;3Np%A|n3Fk2)MP zX72-2RR!mHfCBl05r7U6&kU%K^2_ltbI3DE+c_AB(O8%`aU#Z!8;htu@Y4E39BWS1 zB>aX0a3B-s6N=7h7GSbA#(up&Q-v@nr^;VJ+cGFZ!&I2_T=WcvqdJN^M>!8iRU>tj zByi-GDHFwb^JoZ1goQT990k8OD=Rjb1wX1+m@Cuulwz_OE=w- zOc9|w#+bFcdwSu*_{MjiIdkKM=bn+TuDc`-^D!~*8W^LB|56co4JWC6S+b768I$+D z*YS}fMxMus;2_THuQNv8>xub{IP-a~^R6_$cloU9i2#*AYQGn)z3A-MuD{^C1N69H zpv~E_^yZfOB{x32Bj5U6gzgKZ^KHUks47Z30*vlOjzUpxd~QAap3k5}6RKm683>R- zm4J^%?pEOBhHUl_*1QsOLS589fRI)7Y4I17e;#3vs!%aR5hbZnFE0$9ty zfT;{mLAIH~A)m_h&{wGyjTit!FXxUm*y{MvVq_mqB!0)7jxp^FK{ksp-{WG-kj^38 z0snvd;>ZKaDP;4p?GEmD&bdDC0yy1qNVg))P{+D{*$w4Y4=l_H$#^k{7t@LxXnovc zo&84Wf@|0PI{D`vORw*C!sx0(_HNn!p7TbnzvQeV#?_|&12%CPJX}rLU+H=BZmynB zWI1l-qsQk!oR@=Bqh%Cm5J1dXobW%)o!_Kyyrk#bE5=lhdiT1E&pA_fKAyPn%vzOA zzZ{Zs?{R+m0%?3toc%ks#Wse+e$yL*0%{ovnN!kPj-8g~7Uc5*S!8cw zBKf5L>1UXQ=vcbUNmLV{zL?0T%wZYU>J@)af=9z=>g0(y;;@4;e$qr(#vMBZ$X|iy zBLAQ-1n{CC@yuH#+F&`C=>JP-ZRH6aX|jfb;02)pQq_~Er&dD0S+*p~D&2@GG2|1D z$6=+k!TLd9q5KS%&Ty1>6h37z994mjKh0->k!#o_;KVcD>8x%Xp*Zpw>cZI|M8LCu z^}EP!Pa=_8F>gdWvXshfy_ z7fYzM^CAc9PlF)$`Sq(e{7ApS&pP@xCJKn6KhN86;aMl-tv%m3^GShx0Y*N|&i*Qh zOabJTp!Ctr#i<-|K&CQq3dH=U@#OO!6Jn3wai7 zIY@d0(%@KObI=ZIjXF(KHbrkm&~Oo`tfkqVG{44{8KVnJ@u|9DD!_k3*bc z?^obB1C((9!rc+Dtps&!ez^$SWuR@L=%_?ppFoYSojV(_cI`Se*3*_(s!E)`IA(XO$_3Cxx5JIDCiOlqPhJjDsAi){lFhV9h3wP ze$UNyV&nus>d?cbogiBM=lc4^J(zINWFKa3SgyPDkSZ5*+`Vtg&3N2fat zdhYLd1kfYmkYsAlM+=O%)Q0w3*)aUV#@}7Ltgrw4Mp@!aB5U7u_PC7~opX`|@rymr zTm_iVi81ehnEeGvP)76=``-q%y&i94#mGEkd9yD!t*P!n&DOJHel8IO?YX;X1ug<3trl^m9Pz~w(P);mNpI*$0igMqKl~U z)~(Z;3*f{Ql)u@fP)p_aq#ujNFmu{e?gC7pf#QLR7ZCDX0`Sr>n8u*G?)Ys@XR&U3 z176y^9WQO#Mxg9ehAPVqn<&?fSWWq^p`2H)T#YB6cp9r;T8$hRG5Rc2GF1L5+(4|$ zOy74>fEBFqK0>*BW})OIR%1aUpgesL;ebb|(R%>eF9tzpsEexX?eOvF#Gz@#02u10 zT1MZibq7GaeL38?LMzMY6m;A^3o;qlAn26SZPXKyLj>~fZ96v~g=8{%t}7Q`md$zD zC!7m^&8e;1iP=)=2dO65Fv|+G8`2v-7qZW9wl4ewXNNCNUc2E(TYs0_*4OIEt-N^t zg3;^GKleBjlM6-6=P8S;A!Y#tlS#)TjJSdXsG=~|895ok9TAalIM2Jb#&_@AT$6t7 zx{DX=uirjUnHJD{zqdU4lbt&sxaE$(*e_UTzv-NdemcmK!@i9qj+_%Xu|dN@K99Al z*5DtHJcgx9AHf659>bDHmSf33{)HuvJ%J_vd>Tt0e+KtI`5abm+=}R|m?Uf`V3f@% zIuTHIh%SazsZyRa0E7ybh5(T}m)}!y2SIgJ0<&gJ=P>{c0K;iPfqbI`Y=~o%=)v(u z@u4ezw>CE8k>_8+k|$PR$>UE`c25;#_>ada(|=+KW&6NGk7DVAkKkd-`o-s7K&quR zdJg(56i6Nr1WqJV+m?0X_RF|u=FZn@QM#VNGoH0(tiV*ELRZKJDRii)LbNMM#&X_Q z`B#!=_q0?RuF-UlFp^Vg3HWjEWHB`%CDnB4fM z>+fB@{02?yQ|&Ku3w!g0XCG4Kn}uEspZARUym;~&5sU>e(zhvuZk<4l#z`XbM$eaP zVdR@eypOr@c+-Z9&O73zg|8dqk_AH&y~E>wiw+RO z0fOSCVS>gqO;~ZHa5$lYkfSl(*4%>Dre^4S0nH3IQ#nP@+J@$~Hl%rEpq424MrR;7 zB~4K3^wdc)Okb;}QUf&1NaylWb9LcVQ;R3WYH=|8~@@=J`Nv9AkUW&w`XQ4z2V7b$u8#N{Epr4zDO=JBxK(vhR7H;aN8+EJ^DB?OQ3K{gH#)$&?PxGFMmsaJEDG zP)FF&bA;!~(+#ARG3doG>*Lhs+Ck$As)P*txX>Wbcmc>3)1ok(Qi$#v>I?;(2xZreGpI(| zl`12h%XN;ck)hwH&xaNrA>`G} z`eeV`_H )&V7Xv2G}k7nQ00KLM37G(W;~q)KooJPUwvusocE2(gmkqDx)_Vj;RV zq|;<7^brX)N~*{$A6V!vKt+fR5s~P5s!WH7emPkRS!>#E$`ePzLnna)rfwN8B1f=e z_qes?XsHIdEYu$eH{vi2Fc-Rb)jMaM{Uw_I!1hJSwv=c81cy6FvwekaZHRod_1~Vv z?4frY?RvKH5}f;?NY(fCH|Kq=RX>Znv#jxb000mGNklr9++? zT2olNy&h|}?jUT#nk|IQTd^jBE%XVSI>BbfqkQ6RQP{@w_?_6^)Pjue6q0Utbt;D( zBM>n(01P6%s=OD$p}@1^DLCG`q6N*+TNjyzd4}miP+6*$CmDK<)D;+u^1wK(^<1!J zYNr%Z6f%OId4wtcDUQV9Xs;5?6;kB&ycdyfoe-z z|4bN0=Y%$igZxIU{CNA4@3r=&ZU@M!cb+#TOxriY$5+_Ck3nQVCUf-)j9e9zfCwKE z>R`+n5c5SE17EF;xr^3UwH>qeU1yKGy)Qcg%a`Yy9=PRSCZ4|DS^HJ$jz`I1Gl7qi z_aS$ks?nLX1X10k{Gv}!v!kp|H)eH6=^QU*YI=7xN;ofW-WI)caPL2##J!I_fqNhQ zCt*4M_V8o4m*?pB@*I74_(viCk>$kw7w-KB%RTlamOk?W4S{-URPJPyD(K`ZKMEWx zaKgPof`;4C^hp;Z%0GCcE2i}B6^i%0glOfV?l^T#yQ*rG;cmrf<_e)=PT%hcx$DCD zuVOSSNl5v!G*Hy9B;D?5IcKcdG-3dBFQJO&aJ71ZKx%p->YRnX{crpJ@?Ur449D4i zo^L+kjQ7@A@8V7Xj{@T3y=ScruXoOEv0*-1{i`9+9g!hQ&vHU~RIIse$I_cy`cj9x z^wQXdOU^kU7Iz=?Jo8-nX`Jsz;6!M{E6o|Xa zQ8r9tQ6`Zt?_D}(QO1U-Uh9^1jO~uqn9Yl`*4sU2a49N_fChm2gQGNbr7eZ8vLCt{ z$|yUbxnVc-Hh{}Yj06WPfrYnwFy3+O_&q8uUHRKw4jcdjuBxn{#}Rgb_;Mw3!39&^ zlAOHe)?_wg+#Rgv#vs$$tmpq__`?un_jYbQVDH@V;E!}$xW_ssVrm&yWB`IWz2L>h@?LV<_VzFX<>gD^hz3|rX+%C{Xn3SRumqK(`-OyY({qk(_G0oZkY?sFtui2C_J#7LqLtL#1Ck*6xz%2KTiHO`C}<{gSq zkRLGsD)abyrlRNnGK|ofG|@e!mC~4q0*nc`7hY|51_aiB>WRv*EpO7?(GRH~KzqU>nXMensC5 zCcP2Y9|`aw5WS9l`E1`aUysB8Oso;7>W7zle^D@Lx8Hy3i&?mDI)^V?xMxXg@b3i( zsn9tT0*;=OqQapMLP zv#IU4E{X_1IVn>2{1ZpzBxN#-Wa&W-fP!o}-IQ>Y9>E!wqeJ^89z|8vQe7>WS4d3a znnHm0Am(#ziVTAlce(=*a@|{T!WAH>I}-}70<`)-!a>lIZmX{6)9eHK2+E)&P$M<^ zM!ufK_bBg>tADEldr-A?Dl8CQQ^lB%#bWOI88fFJ=GNuYZMpE%fc+b>2R{juNM9TW z{#H&_4>c~iwZ{(=xn$B@vhod6B=9cg{P81ka)`E~n>t34hg$;dP<)nC*tOmlGv0TQ zi(R_5Ds|B6OXgQOK+wb0`oJyQ<0=0q*2<@;Y#xJi12aNd3+pP>#IV+?iXXyA85lo? zcvTguYHLwdSBq-;1*k!F4WXJ)RgJxJxKHz-un=}rNZ5LsjNraQ<`S#l}6gAZpB zDQ_xqk7M1ZZwRW?g>l^#i1N9@hXV7|*F2Bm7;y|i(_l$Um*_p!OSY9KK)Gbw=o1~~ zS1Dfb1&ZGpJSzLDM1nG_CQxQ7J3>uu4QlFYDcd?EYU}9NBEfV|{|A7fLBMBW2`B=& z@L6~DrpIz#!>TITzG4!Sm{N54M9f(MEt_IO1-+0MKc@q_Ym`Bya+K9_5WZDh{^p=2 zSm5P@Y&OId>~xP1a)Tn?m%^-s?SBad_Yu7?*D%o8F+*NhzGQqD%7?}HU*Nnk79wQ7 zGv-Kqk4iwFh(y;Ro+nqvJab*l)xLJ!yUreadoM2uZd!grs$pvLUoG4x_`Ltd>8JwV z3y2tk0~MGQz@zdXKY23d9(g2=Klvn_a?(jS?S$iT`f>Ac+OfwHj>M@)AC8lcn2UX< zO@(lEOO=Yw;K~GDsAX3|6lVjd>e#*AZe=^uinJ>gw@2{95QZRJ#YYNV!vsw$fwb=! zgaGmM=XRd6G&n5dlpyP7sQY@!Jl!sa%R*7QHlUd1AkgWjD|!>gj>54AAAnPjJRGMU zbp%d3<|v#t?`WK+vONBHoO zjH`7n__#p+$w8spZe+1?^>v^ml48@J8(Y2ksSfF#B1`7aPqez=6LL;97&6tj3sF)5t;&9BKH4FMhyjjzyVHTDB?5UG6o5sPM$&)a9(gcj-DprK_ z95@tq0kxJo>~>L;ln{ksLxAJF>UO6QWfkdyieHtxDu1Cu2jeAB<-R+FkTM*_)wqf3 z()t|A>3134jrpz;C_^Tb%`WNH#1oh?ejMgZo`^Y9D6=V)-;^nsHI+bls$6GM-ZN+J zgM$w_1oKWj5pxba5MIoOJ`Sfh0Wa|==9-;5Q(e9f)zUJ`!iCL5bwnPlbCie9YpX=$ z1|#wT9$npOog3cYJ@=s%`dx>iTKw%^Jv)!XOO&xSyJwE1421+TO)bA^{^ zix>BJ9A&M0Q!XDQvMLkDk`>}%gv?M%z!~b?{dxPO5${VI(wk3Nzi?qSpC0F# zZt7jMC~R0Vb4A|TtEqB-POJeK0W4K?tP4(99i8X!@ma5*RYR98D|tc5nRkUG$N!1nAkf?pHf7xy#Q9Dl;=?)H7}p90a3Qw@}E#mlM8 zc{~B_I~6D1H9^kv_Ib@RdK-bEm%z$fF54akxu398Zf9-ucrUsz2w-^x;MnhrNfq}j zC!8R?YiEt~q!E$noH0HM$hY7m4$i`aA#fbo4(mMNUp*10Pz-XpN%UW%gP|prA$yE< zUuYy}?~_2C5%V9Ohp(HO^gC9bzd%3gBHgo@v`r7*yqeGZS{i;g6Hixc^!nktpkAeC z`!%%?<8flefWfi*DHOOVMxumb7%tLPs;>-{xn|K0=(0XN=LN^OZvPuaEP|F5r9&vx z19Z_OpqLuvIkaC&rn@>Vu{57vM<=AB&@mO=(qVo5$ zEnI}`$|{ALW^S`F&u;;w$AtpAzsPCy65(UM*vl!~kDRi2+5N}eu{K zK7%l~``jwgh4CUdlAuOF<=Jp1!>+x`h1*y5MEveEkF3roVn-8qmf{7JNn1M0IfE&h zFaj?Z33w1Wmhgq@nE%NQ7o9VmPf(}-?)Z20_usO?WbAd;x*rj#!}wslXGh|l5!9&G zRTaB_=d6Cmm3+j!21=zhti&U&XdzTB3YuI(Y4?d2(8%AgaTB&~+JqpV1DqukunYHg zZ0aUvF{-;6C7>)(0?UD_=}{bNI-vWD#996B`I@LumZMRHvZO%;Eyu5p;Z8(E9BP6f zKcVn}$d0-5rY{fkL9QOor8?&HDHalI3+aE&<#XqsbmGImIOQ+P>X}9<@J^RT=1Cf; z&q18xGG)&@H4JG04;Ld&AnB@@c|j{2F#uEw!vxRY{K=MlKL34)Y+#j9r*s@~fo^qk zurO^%T(tVn=m+3DihtJj;X4y<0N{90G=YLY}5dtQqbt` zFp{!YOF+28#0UA`o|x;lod2dndtugX|HrLcGin65@J9BTeoxTC3b^8nw5R? zBb~{Bs&-J&VbpNEq68&X9mQD-jR3`EsJ*_Bc{>{#u=J5fu=Js&XxzCIPG9U(L?OpT zaP+MhSe~P_gT@IwT!CXg=M5-m*qK7vC=9gMS6+81tW^;O5#Ldu`U>#ox$w zYkQ-5l`v(YHPfpJvu^U1S^7EPC7M(Ku-ldV000mGNklGW_8kn-wB!h@6m71U@L_cj}|Ut9OCvtE@MdCb-oT`TKd{`lj#=e{Law{{K3V6H%v z6v(*VfudqpC2u{0kVh5~@C-%cj%k_)8U_lM=^?=qPvazjQl0JWu>STiSS6u%=g2+_ z60yB3qouIQNM%(HnpOanYY}MN=({`XR!@#^AgSjFY$5M^(2;%Q zgAi69;_&bhipXJs zdIPM$57RYmaT+cgz7FnmvJrE7J$WeoFn5qt( zbx)S+VlONONBrTEz|+$=ueL$>LpZlC$mX5n%4A6D<|JT)Ji=^$chf4$4Xtszp{aK4 zrkf4<*+6Oy)m zR?}va%YB;K<37i0H(bu%Qc7f4gTnsKF-6_sSj<6{PngT0rM@29Hmt{{wQI3~uzvk| zY}mK~8#ZmkMxM!U+_D9Y%`MRFdX}P^!Y&|9O;h@XM2#shg?WYgxC6kj3j=IqJxi(h zpIZJHQcX?Z)&mg>^eh#BXbdcutCq^#6#?`k#qUuhW#AZgz7O>+!+{?|K;J2T(J*jA zdZeoybq89na-i}uY=rs|Q^i|*oCI_sN{?7tVi&ZfGuX0y8#Zpa5P=0Ld`t|Fu ze%(53q+Bnq%Ov+z))GEcITAZD-ZqwGpq`BL*I!$heQR$XE zU{*)0990O%4elg%TeA4(#@2w~**a+E-fM!=Dt@jt%btlIN? z{Cx1DMd9|uhBZ6_`Uo4UyJhscaITOhC7)3$0^VK02;dmd{_m)q5dpVbg8){6@vbR+OFk3MxYa2%@s3@0hOgj);($6c_+mKypyc~;ittUTaMFxn9tFQm?!CX->Zw;D|p25?~+en(Fh{zqd7$YWr?JoqCKNJvxu+8gt;O z&W3w>^{>otaiLkwfFpG2m?0Us(GYV~mk3OxjL_1Sh8@1a!dgdMr6s^;9TUM}G2>mn zu`2Vf9*uw{OM-@->E|r)QL3M<-SHxkb|Gat)nG#HqM+dts3J04Z5d}F1hfMS5g!EY zW4qPC>|JSP5#mSbC7(Pv8zP@!Pi8$}BNbZ}zcpNU6Lh7ot9MoMA(ePQC7+MQk)v|Y zsUJ@u8;?hjqpxXsrUwK|0P!R6xJkyH06&pHO-&8rK6efxX1cj4Bg!X12%WJ?#*?Ni zs`|TumTLzK4n(NTlwKrPwpqiabY@b{4*G1`!L?I0%pV(Oa{ELn*IctJhY2k$qjC;* z1t7bfjdDV563C~k;r-vMPPu>M8SEn%z!m1~^VYd%*`yv9CIcYd=OWtQ@_8DcWTMZ7 z28XEfTstlmZy!s15QC#QQo4Hy9Qf|9ojrcR`}RSy%NL*Av}d=yqTz949!dAN~pUSpP1v?6!nH)Bq^PclY$`e_nvu%+dduK(A|;=L#dGKbdr{YlM;1 zmxTn_*JIQShlwvA-CUD?N009WtXPz*$+tXUL;D#vu9eV(BjsXlq>M_@lCOC>*_Psw zueSndmfDx)5asAi%a%Y9OJViP<3iQOG)DtK6~E>77pVM&3cGgnXiT0m6;q~8$K+`< zFljnr+Vq02;RyC&T!DEr2uz!-K)lHcEI)b56ilOk(Cj%lV8%Wq@1dOM&f$nXwn1g0 z%3ghFq5^r{cus>ocI9>VNgvqo zaFCx~lGxofBA%5IVReOOipRwPlI5?x!3)YeAbC z6}lX^;&l6;BeX&k`%lI>!O`=I zc*o#`qmIT2M;?U}jyMu09CkS79eOAZnmH47)iqu6tU9Ftj``%73j$UAMhB5HUi8%< z(5QkYQO3mYLJo@10g7!^uS0rSgn6vFETKbi3~X?4hm>MOi2YxG=Bw;Q^aq=@CN$*`XP133fx4^e3rTQFh(6a`Un zFX@c$#|}%>)V;MTll#D!)83^Wjk51p)7HDc+UDoeKj+~5J)G6A1a?FiP|T53fH0RH zQ0WR5YT+Q;)Ur9<(i2VJ1-0VrA=phiyO#=iR@<7+KnKt6xg#n4kpPt`EN6Z7OVFS4 zgT>|Jjyu7T#&{oH|E}{+?}=XhBR^|)LGGInxsNR8JK~a3lu+_@hGSTju>uNV$1o3n z0s8F#%|moW3X`Eo36}dEv>5TVOaw$KcckltQ!F8%5g^>Q-*>dNRMRg)qKc;hF+^=554-VPOrxxz&lXfRk@BY@zyu12jnYgww!{&; z;54Z#S_O=N(w@Tl@HMG01#5gu8YMBbfP5vLgfBS?^%(EVx4Yt8j_7xoxfxWj{rK7?Nqea=!**%Oya!sR)IMKK#Z_QT#noSp?13Ashvu}wK@s@ zSzetfkBo#XCxJO@ZjBqyOsyI}X{<5we&4Hp=lB!PAJtV2tN-}LZMj_bht9ft;9QT& zva9l)(;NqTs6Q{{nPlg@;f!-WsOM1Kh!u-EP1qf|5EHKvBL@L2f!?olCWmY;4^>{h zV~=2TCjs4l+|kquh5F_;G_|Fo9Tt7rGT;u9Dh`G2%2y&?AXS`%j`L#fVR1wgN0XhvSIEI~eCj~=AL|@}p3{**jK7>d`aP*bnZa|Gi zrzCd)i$S53!m=pQGY0ymzh702!{#1|gAY6eW57nlpbsM|iN5HLfD*7pc9zdcwVr)-%qc81VJjym>Khnk-;5-b~ge z4w%p&3+lMa1v-bRbO%YSZ^c6=Zey;g`K5Anj=l2eNVrlGs2La52xLm4Zj6alRZlY_ zA2qS~*;CHEuy*%4#BFN!UxI|+Wk-L2u=_WAcQ4d!ilgGUdw%t={Otfle`?e1piKfM z2RGV5qR;=L_bXETt*I<5C$&DHkDzoT0rp9xvw5`9plZovX#iwV-AWC z7d5tYrJ|EoH>3uaEK(yzPV+tUu}$whw}(kNX&dHDe~fzU|D2%3m1-44%0}akvw8`@ za0ygNse)1;R9FyBeF~*8sIW*++t>j#jlgW)SrPB;P8cr(rLA=cmHnY}568?|v$*1~ z0f^IqCKc~+#X~Cp)|O@neKi8Oz@V@wDe?fl)Mr$K3Q?4|-T7lNwnN(jm01~Ro7L#C zLgPx)>BAIc<5)&P%SFCcQUD@jd?v^pR)}`IOEPI2y>J7m{I9X{^;1rKXf?yGBUb-o zQxBVVoWOf41bY0yPJlgfQN+;)fK<-I#6Z?K{Og{j&$pG=x5orf&crJ*?9%z^5UKWJ zo>WhmEaG|liIGp|)Bb`kjesS|K8bd5I* zsbpn)AU%I_^ZzZJ>x*#{;4q;-Eaf<%rPCuuK!0S`8P{;K_PNihJ1Lf1ks%GLfJZF3 zAVek?M210ATN>M&+Gq^4K#hT1K7itPrZvbo)r5>DjW^hsyX>KbCs#AvwY%k-Y_>Xf zJJt1{0qJ+4*l)iBu;0G> zW8c|xFn-*40HjJ4!+zVYCn*+oP4HqKetOF%000mGNklE6IqpP8j`*zIgtEeQ21xO^i8JAYC3k^pE1e zu>+2=kYi2dJa8)gDCv-Pp?NTgj&d9^0Qw=r{-ByfVg@@m;`KuU!c|%#9_zM*D*A#!5Fo{! z0yPG9Hn*aYy9DW64%Sv~`_jP~h)fb=-aa!i;Xl}Sq&vo1Pno*I`2Kfbuo7I`BDxe^ zl{9^JCenf`p;?C=f&Gs<7OMPbA8;_{?0+Ek<+=R6bN0i2RQ&tRnvH$;nThc{pN|wc zY3ax*fwqvmFtw8_)}i%8P&5E)$BxG=()Q!=Xr?XE*%N-2&uH70O=#Y}4f<0(J}^%I zYz^lKP7nac5Tyl5EovO2P@|zMUTbS=FmviO?8{w^{btXm?DoZeZ0EjeK<$43<$4fi z(Xg6z@LcSB&)D@?l^a*hwX$-3at&iSTu!brR_ z65y(KUs4hRym%F=#!rIrJdb1HC}Z#`xYUC2C!RlA^UGoDZ69xwZ2Ink5n%ttC#U1F z9HqywqvBTsphu+P$;^nuj-72T`kx2gRoND#5)d<$`5vKPPL)$DcLBoT8%X`)Z*ND| z&RG?UK{U_{vyR$9<*hpdEj)gyZ%&~>4FMVkwsMAm_JKLZmk+GHXu;7vvE=VR?Fljd z%?@DyVgu-)08Vub2nX3DDyT`b_CxL1@kmtHB2iV1M4|*$NF)gH1QG<#^Hm>0yHZD> ziXu&Qj&#+B3QPg4Pz=DZDmP0S(`L>_qPnIFIvBPzwY;;rJXijku;In$VKbTN9RQRm zemL-oZuIH+d^Hv_qhtFEd<)wdkHt|%StU51B~*416y>S1t*T+$Yf(LVEGBRVWYX;Y zP&H~aiL0Cl3~3!sg9S(cZjPVH>0HU&p>tlo?p2(8|ARHm;S)9V_n4!oksF$wwC>uJ z1LTDX{?2vibnQ_=bmHX|6&2%6V}m033MZqQiId?cY5);mAV)jreT-*?Zys~n2gae( zweHXV+Ys8!pI|L_0_@`)G+`%{Zldhk-0HJ?!S+8HY-L-w;mQ3wZqqWO+=Y3s3gV_P zO$fcY-SV?kK$&c1SEIXC@(NCFV~ zOZBIqNBhSA$m&bxkL?OAiED7s^jGKN<3|6MV{0jKI`%OEd@85W6DCt3MPm+*NCO5f zNSY)8C&hq9G)&N)1IsZkT=h?!qPDC+i|h%|XVbBkV3BZeC#}%^2 z)v^A(ueZ9i&sr+sP=V*bVHpGrtAfb$XiFi-t>P@V@=K86nSLgnhC-UYLMlbsx3*yW zwyjvR@_D@Y)Z^GhzpZ`;^yNQL*?@IHcK{;ak?9hE_BWy{O5v?H{`;CQo)1Hah<9@n zC*$~lPsaOi@Vh}7RPwfk3+s%DzttG?8WI{!*rQJ8s0^QJ$gwj_j5v;gCQgqJbX6Z^ z-&OKR+Mp$1xUKEbE?*Hr4Ob-bx-k%Az)8+$9Y@grZyVT4C!cche(3aH(zY!6%=WDK zf3P!EU=CU6$x3G0)ze%48Ah z1aoWnxxl~-5`hv1QTJ*d;fFQ zf}^^^(tjdTH+7bqI(zm*#xr*T(u}eygIpHrwpIk(sjxtF9zRgu73n%M1+qqRyBy=3 zU||he_Bo`*>$R>Ojg5G5?HW9{@&!D{E&69)coxq-zXH#4#s2KGPh-WiPvO}W3QywM zXP(50r%UhzR#3S=^Yr6TSn<@qu;R&o;#tD;gjG*JflV(yhlY*ok!x=1sQfuL^d-RP zXMoCmsZkm(f}^i6P&t*C3rRndYD0#G2^c16I;BoeT`4H8mf3U1u6%MjWm`&Bj6p*Z zFxjfqna;Sk@G;FGK_To>rv`u;bxw`3;o(Ge#u^(lPjywD=_+v~ZIBY6B4>x22H{^B zDW5BZy2;bwC#nG=0Pwh3cnBcx4P)L%CT^}d8VeTiTnz1(8UZ1X1Jnp`&h_{cK}Q3? z?j;5Q1oa%vy&3>9CqD58ZJDdm$?!P9a-wS&-bkQN5~zw(arFtadn8WcP(!ShhFD`; z8m&Bc4s_+&eUV;rcvL2Gs5SnF)_49@z%|#f%K+mVGVa*7AJ<%4SN$vYx0gsT02xsw zXSvGSzIHX5c5EYG0d&DNU?Aa=(~6yr-6Ck%GHk`b5h5i>q@L<(qEg(nb#w7Q>aD}Z z^=q+l-5SDbY+Adj9X6ByE$dce>-qw0V|d$!HQ2FXEq1WXPWttP28J6qtV7$jEy%0l zr|}~^3M{PrLqv+745?g%yg{MVpmLw-ec_*^dX%RcgsnV!s3%Y9=0=pBiLfrMUx7iU zM|W;NxoKiECr7ag-rjTJ*>lB{cNj5;k!*~x$DNK5-Qi(39Tr~rNZTm)NA&B7T~#<@ z0CXjlL8i^AJuC*1i5zH@eHk%M6p7JeQ9XV#jQ(SfC`*J$vp6W;0popQVrt5nW9MJe z;p|h71H8~JwxRn!XYF4|cejrP(KvvOw*PxQDTrzv;+vy^+YrR;j^66Yxt!0o*Y<`7 zphpzTSt*syBA*XA->}>Fh&_^7E`bDBu10%ddEx-W`W*CFpozNy3Rx;*H}Ki6irV39 zuXf@ax?^WldLK9IgkzuaJ+qh^r6E#s>k zn>S#~mQC2q{LNIFTefe7D&>IX^aZ+dU=oKLYo~l%5f}r1z!u?o4Z zUjXi0MwDUPr$YA`_vpu1&ZkWMd=5T+Pa(*| zm4k3F(mVm#17%bMdUP&o69bw{1Z{6ueCsc6w$<;1%1h<8W$Px&aAQH1l&Q*g8;y~z z>sDbScQe*=mqLvbOMXS4e+eRKI@ab`sRF?9Kc4U!%)2y(3SAp6dhG-%{&yOf(@3(8 zu*aRYHlw>^DvROa#&Ln!0Bi5zqt)tnt98Tx*i9sZPLO!j=n3r5wcz0DOwDkzjqw;j zUkDUw7r*eDB#?8&c^`{~xN!1m@7b^XNMOzHla0C7s(VB0{?9u5TWYzEKd*_xD-AL=0@AuOqlx_|&tV}G*`GeJ<-#*3N5zFBi-E&dEOakyZgE>$vu@h{`({Rs z9s37?JWmCe6DmAad?6KPlPde?pTWjwpTq_l1M6rEta)JtR=@Zx*1YsQ)~tFFYq;v( zLFE>(-)PS%hmdu#e%=etK>*nWj^Xk&RiNeNy9ztjqX0`|U4c6#LQo~{vk%8Ojum_= zbd5*pWnqnb#8-uH=nKa_+JQB){a_uSFO)mE#jcAn^4#7AW;gMV>nyLO%2p#0ts_94k|x z*X~4Wn0NH3YFCk813Y%=ycneVY%y{!n^WjF?Un7hK*(p6)gvkGB*Vi-o{xV`)@$wX z`QP%Y+ci*m;z)Qf5^(UV#!Ui*TltQ|3cFn#m+-3UVB%GP4n`C&RfK|5oiQH@ja)Wy zOWkP`Pkqm*VlKAc{qeTy^tgv;GJo4S`xED!ZhPu@<#-QagIo!9kNRwMMj#DMTN+Zm zF%q|wk?X_vxO*eSe4SU)w6HT&I3q>?1=2?+B8ZLw==ZTmpV0Ifq%t|^uLRm?41{6S zRr^%749R0(IysQUTW;skS}9#$1l0Ec#_<@Swk_-SJNl>>J>UB)C$xGh6R5&5R6dRh zHLqvU4Lgyp-+>GvMQCf>iPpw?v^F&m8j($>VL4lN2JKS{QN5Ip6Pg&{x{3*!?wDo? zV48xab*9ld&T$Jw3Y+qvQiznlDtLlNh?IIUU5KYp*v=<%1h(jsRArgoxg82A^(osN@tm&w$)`R8 zp%3MWKn}?HFU^9i*@SZO|Ju!3q#ybCJ#E`55^O zD?qQ0B$@^C;OT#Us-Zi4(_O|$`T!-6{G9lLnGkf@@pSN84kqKr5vv{zFGf3ogAcnd zo$wA4;6jM`1U&byN%P-(Kxuny<>Je->u|{9Vb1=LX8QLyfc`$eYTkBs1a8h3-T|I~0_ws2qzR#8rseqhS)%xX@R+g*_Y+r)%fhxpCs; z^^@i=9MpFGwoA^MYK3zr%GltiVHkYF*>JH7g9gVz*{Qlc6>YY#jX=`&#sGDL&UKVVkC^?+%u)HP z5fG@H`&IJa7dh_xFsdAeKmH{(#RI{>P540jz=5fv1dg-}^}>=!=y(UmqB2jkFj$zEtlyaQ+& zfuj!KptJ-hfQx*AW;rl{PSY$?I+O>{IUX4RDikVs<$xzJu$DRJ(Q%WxhZv9?tM6R@=xX^5oJ%8>lVOI3q>J zbb*0jvh(Ckj^Sd+$xc>v?}?8*vfB&e zOmBClJv0)ihym`^QwN)#KWDkcpy2_K`1dLzf<$x-&}Fx+m@M=~yVguD`o}_gCd$6rXWAli zI6QOa`Hw7!MTM@pChFsdEnL`c1WbO_Q7a6vj7q0bIN{Pqq>Lg36> zgmGQn5*=MZR0%sYMBoUj_`{-aIes-AP`L>#NM3=3x}v3Nst}+JR{#--UvQ*Bx+sBR zOB6J&evjY*s?4d>5dk+!yfWYpk7L~WFBs3Wd25?FY<=hcpyC-4pdy0$9pUdd<2HV{mr|3KW1-iIJ0avb@YD#%)9C6f^G>M$ z_EDh(s$$fu8en)RT}b87mdTf0` zGrrs{7!sGt>8Q7eR0{R|p{zX0%use32IVG9lPJxW$<`rK_*y0c5+yY$czQ2_ zEBYvk!ucXHEAHHRJU%2t=+pJYg=f|xk$5``yapnp`c!C`khEXv>VH^wA|0Ao?<2C^ zt?I3rlv!^mBl&%jfO9f;QrjdW@?XT)6+69-jt>Qv$_Q>($1hSi)nOkl+X)Jt2MZC`QkR zVZ5rE3vlv6X>^c*@~=CW!d1Vn@I@0SD_gUD+zZ+TS|>*baN%y{d)3W5s=Q;05vy~gRhqeqdB@)!=L*mz6WXq{br-16nU z&cbFmnEE%UL*{+zhS9NFv(O066Jb~ErqPzG(r!Bg3;Ky_#ApO~GzP?Q3$GhG0(i`t z!jX0si+##ieBSrnhjTUIdE$FhLeJdeZ1_c3{E$QKL4qn-dMq{6PS}2*lITM{zKdlY zOs`)I>;tJTQB>AxZaHW44O~uGT_TMnMiMZ_Am$s02!`XboD_9+)ZCUvu8WP&J6W)O|2^;uL^84;|VMwuR3rmrg-~JcO%%P<~LOis`~|N!hCpO;dpvePMY%1K!J> z)=-FRej(I;&x*y`>Fv>;1Mj`y4f}Dv`!9Cc0|D`|mt86DbOoUuHm)eyHYe`MSeXAu zUn(_yK^np7NdiuezWkOkA*#<7F&_m?b+_0Y6jle24v=n<1Rhr$vDz{4t4G23ae%!W z-CiOBj3v&=06q-k{ug4d_H1~ugEtFs_XFkz=KY4%KTd_%%rN^2??dD`<8uCu43u7L z$Ro&dg4jgFu6bg{V4YgwIuQG_(j07^FURsirW5*q0q75xD;NQJ=m&#xx;xf~ij60) zbwPTzTewh-V6gAI2*8cwYv68QxX?o4OR12!1?qxGEwl4S%85SHAyi=Pii}&?VX76m zwl+j|fkV5`Abcw3iB!rn4m<+W4>|(lX$-JFL;$^1atgc3b*57uCkre@d{Y2x3<3gb zM`6rHzv3>_>Z+nU7fbz+=HpA&}`y;u9h!j7SzhPsf2nG4FX;EDLBG4;1 zM^Aws9b3YKh4Dl+caF9 zQMhgsoZL025%*8e$4_T`9jSUqs>pnJt3zAm%C-`8q^C?!+F(^rrxKA0W@M`eyP% z4?}XXt{5keSYL>HUYOyOvw_UmzTgiOM^~6>TH|@{zzmeeE4`eE6kY_RKb&nX7y-FH z8v*QJlj0`!+O1VhRUP;gaqRC-m^jx?SW83nUrcF;6cYzsq^Q_24WXdG9Ki7?G|KZW zO-MKFK%lz;#I+p&a8%HSTks~HfZ^6TtLW&oQi68kj%6J>$5|^tT&SE0O51XhkFlzp1we>%w8C6qBm+IzE1?0fbpnPSxGO&G+X&d078RA&KBU~j>n`BIg^uMj^Re; z^{InkU{}mo7w=2ay1JGO7ZsZXt}BbbFC_YmqsIVg8UX=UG<`1gZ-yB6J$QyaW|-S; zsXS7gF!h~)UX3(I9dG39T)t`yJMr$!(hykk_iI7}`yiXKfs-P;JVQiQMFn;^_RnY) z3o0;$Fx7_C_ASUXH!|v=I;|_v@vCG=4RGzDD5^JYM_1*_(+Z`?wvJ_E00oZ*K79-6 zw(fEo!xav=>Tlk(1|fF?w!HrvOSmgLK+b1qSJ)2=qER5&(8O z$nWCm*dLhb2tB%Wb*%@Bm=9BgdRjms_J}_0nL5X$vRQVKUYk-W-W>b+W@qJ|yZ^Rq zb6<(>b%N_F<9i5C4*2l55=UQt%j|I}DpTM4l<~Z)*b%8{q5Zo@wj2izA5xDvyJfP6 z>ybd5MnGf;wC@J=T3tISV)}$}gt_GMR1Q)-8ep^?rP6_ff$O+B>!yZZFIo{;=WVB4 zI{t5iZtw?_tdny(n?r_R^;ryt*ekTGXAELA0z`(gd!WlppO60kfR!|K5>8*=OahF%u} zt1o%;Sl@adWFI&V5H57ES6!CYSt^}Hs0P#UamGF_&%ovXlH`->Yqh4Yi2v4j3vc(R z_(vc6(cAW~N{oITXUNN)_}>s?&PVjK6K=9|0?`$IPjYg)eHIOtp0K*k6K)Us+zp7= zjfY=78YUKpaNDqJ>>g5O*VO~opt2lXbx7z7k=+Rq4*&oV07*naR3tlVOu{Bk7y5q< zIu;p%SionXE6r>!51q(|po*6@N%oH7F~FW_hCY*)R2FIo=(`);bK%DD=}e8&~6L$sP@p8yq_&7_dpxE9T8UO=v;86l60IG2Mo zI)IipYCy0|lu=~BF~bp=E=umsFQ8K`iUMQwIFCSqT=iJCJDQbDR|S^Oq|v%%0~%j^ z1_4+9P-VvUM)IPsMnJ?U+pJETfG)1?(o3ig$P-p@2K`~t_n2gW+jquQoCIt=6~K#Ke5xc;>&2$bOtrBnn1=A0^=tjW^a3pQZ0f$zm((Pw{h*W0y=y4T^a+%)b|0@2*~&K z&GP}*^ztm2i1}du-eb&%oH_NSKz&A*%BD+3M1%_9HDkrrcA2k4{0IWl-g;2u_l{s{E8-@tln$bc7pyBx^c_gq2IV!(=HiLkDC7_WX83kbgk7d;e zV4vkQ;8+`hj^q&1?+I)H8)O90#il@X43oPa%Bu0I%B6d-2*_8rb(6UcWoh69Wsv8J zU*GmmH||8!+85FA+~WwEXghI^Qv*OKA8m8N2yhUUA%OyjT-27bo0NsS3_4iu8f;+R zFY9H^-|6@2rsk#`CLXSUfqv?@*D87?SYZS;T6G62q^v7Ux?6I51X&tkPq5C#6o~5< zv5O4tbzLO?n?dwJB)0Fqrv^d%omS#k88J6{p8s8AybHwh zW>S%Rx;+-8Q^++nA+vKk{YK!_ulOgL*RDj{mUU>`x`D6}xrUvQ0pO92r^W+)*1Ri~h=voU3ER}0G$ zcMCdzJAdx4*;fB2Sh6J84WU!Q`h{;8FHSxIkwaOp-zj^KN7)|a*k3a|VjM#lRx_P>VrRV)2Mk@{BYt?AN}!+!#{rO z{zo+4!mX*FVWUeX$x0r!e?)a;BoxwDpwUAm;A8Y z(aWq~g{G(ff%@eSpy9Fm(fH2?(e~og&?5sar#k@}Rs(=a2_)GoX!Sr*ZK|ihxTaf> zGy|RKxV7NZ`jcbE}mYvFfKLz+r^kSQC#uf@b^T1NLlIXpIvJ>tIrt0W4X|~GYM$-=~vw^ ze*=Ju9Xz9-o4h@K@<(s4p8LV?)*XHMEn`pk^p7XZ{rD|YkNWJ7XUzTRP5U3wH2bi8 zZTzIP8TW>&(0gZI5|@jI>wPh|8sGfR_q;_CGvA`Z|1UA}DiN7MU`MlJIRS+nfVv&1 z|4%%#V;h3j)=1%ZmUhS;fNXOkEIUKzJa+cok_MYV%a3(&pbnN$CCdxqG`U7inUJRZ zdM7MPmIOIxwm2uN+p&is5OU(z57A_3v0K;YiE9`*+p|@$-=mr*t)7U!m+`!VTgSe; zl@qW2kBL@tmjm3e7zSBxQL7OUbTyvHsBdrr`RRTOZ21j&fly=17Vr_%XdpVMd%z|* z2>XD7DmFud!(%;$bqWF8>Q@lm0;fWBMF3aQYA8hI*l!F03M8q{@zxVCyUYp03iOJu z+p;{SaOA~tf#JwQ0rGH~Rs;}7$?Qgh3654pR94%;`OM|B0Ou<&n}tvCNY{{#aK4LH z{`3vypo(8XC@YYLu&oN(=G{5h+It4F60+*&%c;J?Q^^DEO#5umUs_htod6D& z>-(|K8sC4HG2UskDrZya*K$5FG;5_4NodX|VJ5C<1*K zAmCPj7-zm}z91 z?%rre)Ky4DJ9>&cHBGH)sKLhiIylyQY^F8jaZ`un4v_%f3MOoh1}-^cKV#I9ZO0_E z8v(*GZ`25&67>|q5QZQGlz{0V9vqvgKB1rtL0S%$Lg@_({fu?92n+G9VMl$4Zp*t; zeaZ*xZ0DzFq-b2{ELB83)eq%Aq7gvY_kD(Aq+zJ+g#f03ac#3#l!YOVXq{ate`TF5 zD0h4&<P zT2qpvY*VHJEQT4cuU)> zU64IL2ofL3BHzB=aJ2Kn1A>YyrwVa_M->qO538a;6q_L1= zhhVsb;mX3Lw88m&{2ZK)R{P-SRJgRjP*h_~V8)=27bo5pC-NxKIkSS^@Hw^G)d(1Q zDR7s}<1yb)c>cJW+W4AN7eDm3lkZ%5Nfv<$(ha%KfeQeVK+te${H z6tw`3UOR9+Gu&NSr}d};w`@k_Q>^NfM`#)qH^^I;JVe!SXhk?dyYlxL7Xr$_ke;^N zkhYLs0UXrOX_pu26`QOff+K+PL@$@nP;?I%!Hrw*zOAhnWNf|g%$j)I{-+puEphiQ zeMN@Ug_M(i&f4mO(}dxH&^h;{6Z_i}?|pRVKÐ(DO2QQ;r?v9Hw5{pgM358g3j zwrd)0a65tzw#!MT^2SmMm#K;qLp_AOEKZ9zA*S(qEmjc-gfZN6ok-muXxe z24@;^@1#-iX=8Asf&7hOJx1UWf@|WqOp#8WKDAMSZeQ-IUK(0b$mRoBc9K#V2N`b? zX6Es=+jZBel-$8@Tr#KG!LFk6YHZJNph5$Oql^4Vxsk3=$wt7*+*k`Cs6td_=xLas zX&iVg%lxQJfsT$x%OKTqWbt(8D~=-`Se8T>(inm9Zp$#w(Fg&Rb5CH&pVHrr4#`Jy zqp}jx@FSoh5Gj6QGp^~X_)G09wO?4b@=E!UU00Y`9ocSog$SQ(drDUUN3(-GJVE|$ z+Is(uy&m_uOD~NDCVrBLxq|dO!d~atp6ERyoj-<|xow`{FX>eE1B0p845sja$|jR$ zZu0i{+z;MfcjRS1n~|@Hoi1+DM`K?6)|#5Czxr|iu9z45zVTz18{aH2#y?Puj2Dr( zK#YhCsMbEeM*z!^)Hgt@%kD&n3(MHuKG5f!2SGC;TSMvQ=h?0nzMb%@s$ zVm;sA78wRBT2H<6p|vy!?mOkKWjD|`_@B|E8s22`_BAmvZ{f(jf~&@xL}V%bbp#$A zxReNTq~7a01)+7QZ%$GFQDL!wIx3}@5$p$ytNLXgoS4X&&QGq}@{T-# zbC)V=!*TBwLFiK`&^!>wl2TXoGYi7G$RqeHqv5C=Wv+kw&oc#^w%|TT@Oa_3Hg}2}C=?i*CHBUbv*3$O&cy;CnrrO=-C*ptc zVzFyI-#b@~*&kwRAmWKYdXq!%`Hp>;zz(h}@gS2yj@$VeZtb^i*@X1g&B!%1LRb2Z z9lm#Z{m01hC?U+G3w$^Z7P|gZ>AHmDAl~b?|BI|T$T&`hlZw&4crK`M&76=2WzqJf zqV8}kC%kkfhqhD}8txA7-yvN@;2H0rM3o(@lQ9NxaR9r+7p=&hbnhcuPg=b6VHyQD zoqE?pm&Lbb&a4j8r^XE4>Kl_J-XFPZp#P&nSLj(*r5fJR-_2#YTi2-X15imtnIh~m zazKr56H&aIo3+6zah3)EwPR--)%SR}&qNb!vpWeXBnU8)j~Y59O#>JAdW=93Zpi=NG@R8R7Pwrc`rFv3iLKvYw2d* z?#d>DANS=ae{0q}K00vzM-Aiz@ENyPv=;?}z@oXe4f@Q6jV*Q_CvF9w$8S%%=i%oD zTdx@`fu74dK{Dwddg%>QpMSXJ&9U0rADCG6U%goTW)t(yH^%J8hwJxDqwl$t4dr5C z*`b464!O2AWE%@F@U>Clr>O9=^*a&0pvQsGcglmnWUtRQ)Whbv$YFR8ly)oXxEk2& zUH~j|$w_gn2*wwqee+sIwc5}<2sjF>Z$&DN6>{=RWwJ;Uv_Dmv{>zD;?|Ea8$DGZ} zmseGi@8gy)&ma5Oe{DK(@k4(*@y?}R*-$s*9dSSR>bQ01c)(}4qQ8TEN8f5zV?g!j zE=@y5TGCl=yXIi|tQh4KBKw6d=$S{G&=(f<=Vqj*y)n*hK0z2RDQ=CIz%bo$+I72? z2YI&eIcFFGBCrtRYZ(QxE{dyxqcVsTJ~e(M6NgUMt_02Rl-W6INo$z|_)*KfKk4|TK*1q1 z0Q5_Gb3gi{xkt3j`BY+T&7FQc@l#`B?-DVy$myVzzD~>vB}Jc4QPDRwBE54vQd>5o zZSw}C2pMke=b9Q2rc;Pk$~r1o`EWbS;|4WE96L?L>SkLU2eGq3#Yk3^kdx6|Kup5i zg>m%pn!jX8HWa8;+wTur^s$OQp#^+S`aVD=o8!DY=rPu(I`>8-PB0v<-eIY+*}9?R zPmd3dyJPu|6YgI2&`Eba^o?vfzAz{Glj6p`*%$d1mC@6zKU4lN>RVIM5<-(+b)ow{2f`)4#ewX;0Sw^5=!M z2N=&>3z43Uy7p4T8?cm_{!bBoDRp>jM#yLMci-R_$KA8MsS=l zG%q%1zyD3ds{as+#q>*hM*&hrTdptt1)VSLxVnX(=T>@FxA3`&PjNLLDf%rNk*1>0 zHgIL%+5-I@e)M4;cIwV__GDal9c(ts=cfZ`@SHdu=sE%HW$kQlnVIQinv3KeOwFO24wT z5Aa+wn1AO#wjO`Nvb#@A$39L4JfBAdZ=_=SI`g07;|O%8rh!I)PR1NmQ(#SX66kh5 z+j{qHDFbf{aa*MWM>-x$&>;h=_zJiV1)uq>ygke)=|y>}K((Jx*?|k`oHm$75Yv8Xc5A& zmR04ib!#|k2lwl>0>O|l189nKo`PIBTmp#)dZ@|%R2TZ>yCX;6FM{hVR z){?r`_p5*5dEN*35cegWcwZl+3bz0jp>E-~wjf=<1F5Z>xT4>P43&PC@qBADLU!~> z(d$59$7MZxy%QR6(EzIer;hD*I*=Iff6*duB*?0J>@%XMQJ1Sp7)U$$weau%T|B2b;{e&x-F}7Z-OC zj|u*k$>me6sjLo#8o03fnuQCcD_X@g2iPru=z9j7k{ALaAMF=WBCV%>F_A&hApIyy z!zGC39cIuk;J65dDLwjyOk!CJRlurWVU6m~UxZgzHyAxXYkr3S0iHUwJPAv{ntX-j2>O zs(?sdQCrdbMc#8P^;d5F-?n|p_j>(x&-VA6H!2sedXv$A^aE5*H}%eHpD-wzXhG22 z#^+?&vObln2$DX`tu!tdIm!P;09z5NBvKI}AA0!@rybq8-(`t-&5upY|8FiF_9t!K zzUh@dI|)>gg|u+y-s%wFJE)_XmL!hTB`W|D$#Y`>9NVGt;7I-)_)jfSk=g1-KXcSY*i1w7=;N zKucSi3oOg7H>`tx$lBE(!hDD`jSZ&ge_`uSxk}=a2dBpbXDwcwJ^4?|Hr0-5`i)l= zyp2li-7V?NqkKkQ4j9d4k=Ikb&bY1IijE9`ay-)SLa~)S>$0HgNOlAW2ep>dcob%w zeYQYW@p}R-r1%8GaqLk+D;O$vyJ0ngl}{nuz6mbX3fr_3`4^u=u;w|q40R}RRe>uA zjR3>l04b$0ju={h3K!T{_KG2T z+7NUhAM|#ypgc@X^^@&yn5jp4jCWt;>4gj9sk}YPz6$ zoi+N(USmB{+qQ6(zXj1Yej7VIjRD=NavU5w*gAGdQXf9Y=k9W1%uc_iw!Uh@q@ZT< zR3yfZgYi9R8+u~JX=#FW24N8#dv{M|`kEKXMhAXh3+w?r_JxUjcKtE{1aPBkY8oh~ z#SFSVz;=f!opZ?K^3j%`9bT)y10Q=ZQsZFuAJ;HW$Mqg$qfoW>kHZ(O$esARN4Zx# z?hht(7pF40Kj!ked~NOap68ta+r^>Bvs2P9RJ7aOL3i&opETGtiNL;52%umPuzzTh zLm{_Xz9F7R@CjbA zY^2O-2pEEX&CfMAAph)R$UnRoxrY`b|HOlEG$=Gr%SXVnT7PMNjoQS)TJYI`$Y~3} zcBB87bE}1L{V%XcRFbL7AM}nLShLtyg_Nu=* zXMVP^ZpIq+KZ>hz9P~I~daCA_4}WV?FzS@cyhQBl#>hEjY$EZw?aO-?j-3IP7F4A4 zd0wB|wi%fn+lnjvEFAM3J7v@%yC^?gNtCYsil)gq`6rC|d3^NPUsq3=wvEca&Pycx zAf1*Bk0FA#qBY(FW2D8s8l%ICSd`Gfh7!x}?o?Km6UXj3dsB*|0pMm};Xic1v1EY9VtMTE{fUkxX#Ja=a0wGc_WDwAI+NpEKCHEK>aqW#3Gm|yvh^Rj3s&jc2V?*o ze)*3MbyZ_OXMF#15i^%eRYUm4Kxb#!;R0^qXPX+3-o6c)9owN>{kF8qXMQwDIu{(? zxMg>5ptK*d&VF4y|BC7f6MtJfb)V^6?Z3hJvHinLHkPg5A^NKV%K_@F?U6%Af|jd( zbS)MP{$d5g-5vYOw8I!SfBKZBs;d4JJ#5j6eAZ^4wbuQ!KjnrJm%Jd8%|nj^tW((! zWo>&AZO+PYa(L+5F?$hL?X2je_|oWoRKJOg_aTPioS(m ze-xHA3XzdeFa{!pPkKtn(>#LWiPoiM2+E7D`h`5h>1`K8X}h9*4TTVMFG>A!=NtCh z%t8$E-i=$oaA9?g^G@P|AKKH0A)rrZ4g2dY@v6jM z4_v%5I}~-2em}@2ljevkZhe)PsJhm8=4~R-f6mb5L3p&<=NXo+mLsLFAH<;{uxq8? zk9vmymAz8u@kR%?%v$>u8`?{}SoNoBCQV&aJ7dP1W1~i0YGU4rVLlj7<0YPH*e-#- zc*ud+d7yN~p6e>Hi?lGGMnG#nv7oCwzjo7L5dI(w@1f5*mZtXgQHzr062EfA{hEQEPDeGAyU?= zkQoMj1y#cFVZYDy=FK}d% z*o#;jGFGSz$Iu8kTa5Xl@#DAEPWHaB?xJ(vzUIO+_tlrThOFWW6W;pd{%OwSDYmCq z1EA}wqk&f#)qM6+1WwdY#cDW5IL?0sEKV0B(p8vq5Il};A%IGoJVAY>p-`^0jdc-i zO&6_CRz?=A9Cj;#g)Hq{fCrm1*Fqw5_}vjd@MhO zF~3+jcKTNKS0?qjc)t*Jg6_QlSN=!MPM>FD{>O~q6f#uDLiBhqI!lF>qoT}E>2t-5 zAf1B#cHgn%6;bw_=Xf^gu$q1UHVb!|3*7tjg0Dzo)B|<1X3eOXJo$h8c;ZTU=4?*t z`-YiJZMLyqa!rj;1?>jZh7RKCvF%FVg?WVe4CU5>T+2>mnzzxfkK#7SL2*h%v^O~R zkWzfF_MJ?z@aFW&Vw39j~9RA8{FSUItY`(h8g!0lB`DaRt<(M;QQ| zNE8Z+ml;&Ps=$$ML%8w@*i4EzEXJ&8n0E4o_=a&)+3mKtxMV8cAr@CY-l$Z=Vurh@LAUwK=w5vr#LZ}c)q#buS(p!u{!nn^%tD=#uXR5VcOnn445oL@)+o) zV~(J!X7=l7i(RO&BPFgoom*ItfcLq)BiX-XHw z6{ZPsK_41tSmiT<|l;!ZInXeNQ`!JRNJP4}W8Da+uvRUMs8X_pH_&Kha-i|ZO0aon*$@BIi zoW0S8_A=|-Cp^#IJa+8H2iM}@b+HMvr$u`y_-`oUM zzK(+u1Grc>tQac&1ggi4MeU>ssF^Shi7}&KJWzxdo+sd>2@xPN06fmA8bSHxK)&F( zvtsjE9t*S~pK9W+zz*b^cOcZ?1hco4m)IM_d?sTAGHdi-){pIhzb>=%r7jbTJ>{G% zp)g#RNP93bpz+(5%0LYP=k_}GhFUVh3gYax6GY@72Xlro-usO2eR+(R`0mD<%%|30 zaL)Ya-#LFGC1Z%YS2!zHSO2u2duK-*SdJxZh{g-b({Yhj0K>UL2;f+iYzEl58FuBr zU}+5K_;oB)4w12-_(c%*9qFu~nZ`bkLS2aJ0>^t42bfMEQRPYbEP!J=fn_6_<$ift z2PMT@xzoh*ct64pD~Y|xwfT==#Uhn2qg^}JB2zO{_NC!?fxsLCV6W*Ls{GqBh4CB? zv-0Ny(H)dO`Qmk8P<*{{$>AuhA9*YV8e!-C*?E*t;2<}f_@!Y`6LT1L$qbHwb-+Y?o> z>qPwjX1_a`gK1J2IOVl!rMgV%aw2?M|9tY@Afek719?D$u%~j z)pzz5i0qXO4%lDx_rd?BMnLJ2iU_!sg~=jvxCq`T1|Rf1`O2vHsBdk&@a&JSx!~+m z*1qfPaW0uOr9ykccUE4av8MlTg3|*BRlk|gQLcsPTL&Q+g6RAgLC7Tt7ed?tu&bX& zxb9gvj(ye%>fjYFSpdj+tZdhU5_|T_2SK#upGxNt@_7s^ zH_qkxT<>6)_^$P`kDan?S$eqY?{+XA{=u7PnnacU%Z{b2gDrrI6*ZMZTq($~lXHuKJ@Ei05LX#-MuqcqHoT;3pCgV^A=bNM9!b zDvJo0Hz^tcUfe^hx)xr%3M_y=U5hmyk( ziG}$G1afugaFv7n8V;*jZI;l3bM1MeA&nALQ41Bff}zq-fR1qmDimqu)U^IZ*q0s$ zS{ioEFFJOKFC}1H$^cQgP*Hn*8m&065k;C>k3uopS1$zIU#(|<*N8bASZEhPMmoFI zm(1s}zno}{TqKamo%8oZ+)>uqTplfLndm=E4!iOPvK%je6wiFek7ph^?vCZD;go~v zs&<}lQ_LxcLKTSM-729$?1$~$ZYHg4gRriSp}Qfrx;UBaMX^;&r3p#SbOme`Sbn$wvGMItsOtRk#hbK%W`SO`(EfuMu6@H=%lh2vbZN$()p!^eR`IN zIZ2H9e`4f+JkR@b4Ugc~Uv&1n*Ijt_;hWAqw`RDQ+xpOL+qO?>UK-?aTWIrN2%Y=5 zweD+tX7>SZCpc_-<0V>=6Os5_nL7x_wkZSQQVu$&s3DN%M#GjhurL0L)HfC88scgh z;m(2KWF`bo7$oPSs@do1J4C)?u!GZt-k?K)vPkE0i0X*yLH{qx>`B1h?#F_su_W2! zu}U%t6GP1*l->Cvau_QfXtk)+MgEbY^4Bq&;V!o2bEy>VzR=-g&rlA(=A`&7k@Ta( zt^Aco9iZx$0jFv=@jrM_z0inEAcO4BHd18m3R63HS&88aQef=CZij>Wbr=Sp3LL&5 zZRQuNeu;l>Sd^^CqD7(dvd>4qUVYRRx1E`&8FQsE<}&uQSFzJg%aG1BqafH% zL|#oe-!tYD+?D$ZCb(-BjQ3z)zm4_w1jYXTC26 zS908b#tClbc%@=PE5*eq@8ym&P!y#v1ola&0vFCBB_lwn_=RW4>VskEfAQPC0d6IY zfDJDKnG}TiMt2WbE-KGCqC_vEsg)>w^&`-TLKLAG(E-rmQoOF9fTXia2?{9#xw|b+ z7Cni@qyzfD$EB)waeyMb11PuRpbAV^1i56~7Kj_1ocy|GwdH@%;CRnAscNBqm5Yh8s-#K=N{*|U?Bc2Run*y*0Hnj0kPptPfve=e&DeX7EE9%41MNQ@rG9f2x{NT15R zERdXwJGhw%ANviEUw8WAf9l?(aoLDSJ_dsa8!pmsK_SnWT zB62W0Iu(Mv+wgdfx>*#It1Y4rlG3wlA5p zt+(=9Ern>4sjgg}%6)MdDxt69#`P)Eu)%n=V3k-3XOL1*_l4$E z>SwC>x8D6#wL04wI^e_KN*w*MTjnQX=2POC4{<^{g%ive2#swjVr_@6{B;L_9e2Q- zvqCjCxK-$Gk5yIOTs3~e{>F-`4iv!Um%n|j35Pi?sP?6X(CFfAsGO)`CU=ll}@L4OU5m0~-UeO3p-{aiiHP^#5 zH^8Vt5aF}MEUVo+0){CIbi9begx%AbIP8v60G2ty?e%qaFO@I8x?)9t4w^OI(Gc&Q z6qvpTw8xsEoa=eN?$GJm{%QzN++DFfRB768C^Pph!25yOntf)t-uCaVLFEPj4d9wH z#dzmZD0O-+u5ZUj=l$%s?D*Z$7@BkkHO*dtv)|@U+2_QiZd|=6`RI;6>dXBdxjFJ< z-=ADlHReL`yiXb9y&jC{5jE$hEaV&-_`xCiNRAfB1=N_;G@tfERryz#|gV8uB@s` zT)Sab-A6aP``p*88IErZ@H~6V1GjA7dEc#%?KJlGF!aA+MLx%=;|o;9zu?$@mU7Q9 zPCdvJI$gzUk5mJo1cnNJ7lddJ(wV7+)slbvmAZ++TZ$`);XSd{{fNH*&ZHu^S%e1j=@wW2Q|vm+3c{7Nj^oc zVeu%9ysrhu-LkfJ+DpUnJOAE9ZAu7pKX}U&&v^eSkZDx@CfCx;t@0KyTtXQx-*SM} zTW5dI(RFRs`rlf0d-C2@i@w~n8w1YCk(b?gxRIKV7~@?I@#c%jScvYfg~+$I7PkCT zZG&z{^Z6F_j-YxE5MlE@P{Iw zj|IBT-xj@_lZNg9ST(qYqOz`OIykiPLEpiC@#R<|{)?0Uv~1Jc78TxC>$=GBr53b_ zbK+IWTa7U%x-g8Z^3S)b@(+iPlc*+_;{$t!&*xj>!v9@m-J%VPuH4A1-G+s3`5*Z| zx4uED;-BEE`F$cdl$|U=T!gtCk1m=CO_4%&oQO4j5D>8JDnWQdXxz<-u`_dCEcR|s z%u!5-(}(cm+o5fCH9;l~mY=&pb<9>7N9Wpa^KF6uB7 zo_F+MSU%-1%jyBSk$q$vpSQ(ce(7YBj#eINpQ<-Aew$5r-?V}+lAkY# zey76WF^+v*q%av!LqL_e@Oc*ioEs1+_$W@TQ1DSmkKzn>aIQma4@W`~caIqRn?^gc z%Q?B6KX>V+v4jgwFrF+F5qrbOCo#pro`G|&9rjCzw10V2> zu(&>zNi06*_e&Znh+$=-CrL*Jz}%1AFw^tRMPznVzO6-uU-|1$KockRzgXw4H!kzN zmlj>S9MRADc4vRi<+qHji;a4x@%>Ly3I9KKFkLC=Z|@LfGLhoXx3s|05a1Kvoj^ZQ z_@qL@YCg%EvXEPArtQ=0C)~N9Rm)NCIV%4klZ`%s42ChtOO2Jt0I(f(8`}s~`ko(y zABz)c3~*;a<1~O+E4vl%d$*J6&fr+gyEGQ@Ilx;k=9X}Ry~_c#xCTgM7>lt_Bh5ad zzctS0qQ&Ac*8YmBN{0cDkYqMQ&NL$L2Mmw>x%e$*(^Ukhk&~odCci44ZS5@2*vU2I*`* zdKYKd7${VfXFqt@!hSt;_M2-*&3N>TB}+1eti9*1N>gI7*joj1SU%O_=ehM?T73=& zo9ryyX0RLi(0|C^R(U-P&SNAa=x^ecHnE5a9{Er*YoW_ZuT5%l}X5qZQ zkw+J;aQZu3%@`bzH@w9DbaM>uHt&$x^_~|ymV^BgV=$gPN4pIHxBeZ^^#)f}p|lOy zZ@5xypCAg!9qu9qhQ|S3WB??fM+6$yG|lUPycb3Itj9XY+_8z)>4RbGv_CFw@gO(z zx#&czyEB6!H!NkzD<`5{v>M59RiZls!&31px)Q0PMQ|YD95(aAo-dy^G4t7~n(B{i zUcLM+YcD?cu$}tBp=2^z=n$u}PQ>BP59hYs`@>Z`C%*Pi;iL)Qz zVc1;Ac{o+vackwOUkw5BK5X^#c{>NU70&(~kS_(z=BAVGdU);I_L41sbh^yJAHI2- z@%{6|Y_=-b+zcD$JE06|GzaHiu+IGmLH--77Jcr)ZeJ|nAU^VAHy)1K*kxP^Uk*NC4SDCcm(>=GVf>Px4}a^86v#GP=Re_CzieV~$YT zmWo=p{#9vfe6XM$HRP^^wQ6_tPK^@`3@s7k`S6Ro0-hQLUJPP95)i`P60w(a+zFy*NaFrT6g7)ga#o2b}iIF^aC^URuNp` z1Xsm?Pi1`Xzc#K~e%6MI&N}Gnh4bs!Q51I&Rdp(=Mu5WY3vI*g|J%Id-XH#J{s&)s zt8uaGtZ`q2m2V1gyFi|Rb4||bHX*qHflj>$+R2s@0l}WXsLXQYi09YAAGSWU|Bl`` zdhx>x5;b1zG(i4?FyQxn(9g?qEM>UT*O&ZS+S16-2+*{Ck{K{MpB2S~l!Gi4>;5km z*e@P`;)8!aZRygMV%~sh4`o3UkK=3`*tyx}M$hJR)OkZ$-7eY=$WY-u&6Mvull$SS z-+bXkhP!sjqqi9K;?FIbQi(VsNhaWzt|TcM+8HquSWuY zJV93DFfIs9i1}a3>%W{nxR8 zD;D;(p|0}ZhrWnFWVDDJB}U#UVm`rPa25TJkEyA9&$0tv`LAd#k6^eGB4W%jExs;07ANf1$!(O-R!qAPdZCce|pMW2~L{ z00Pd5lYa>0Cp$)sSqmh&DC(X}GMO~-W^=f6=Kry+`mPUc^zQL1k;92Pda+Me`>Oc$ ztUnr4l_1_%8V-3rxfl67f64}5m#}T$I_9sByeLWZD6hVfA4)v(E3ePBG{wUVk5io+ z%DUQVvli|Ak8|StuK4c9tABCb*7nR!fjO7lQgwLC>@(oUJ}bt12Si2zwC{=R3nLbFTM7D_FH!jTG%3Xpqq()lGpt+KZP$}j-?mMNxHq_b5TZ4m zK^sBC`uz6>zFtW@a3FgSOn}GysPuZ{SU^v^EY37*6ADH{id0#FPUFe zv39EwP=af&aT{*`dS=JpzW2h8`7>@0#?)QsjQt$7>eu1$a|b-kdO7zwZo4wZh&s{R zUH}fVF0}ThAnrZU?api&pYL7u*fbC3Eh0EWAeED8SskUI<)BwXI>qtRlFFc!tNtt( zgTp+I^!Rb31OCKC+t)0@YmZyJ^sb}sezL8^=ics{Fqi*l(AuJBJi}wHIAq1zrx3dD zw>7r@YUR(8&D{t|^nVhJ8D|&7JpW4Z{5L`nFW@=^*(`D`jnPMnTxHJt3#5U1T5^kR zD7Qqr63L_)Gd@2Hp0`kpQL7fZqmpFX2{Bi+(l|Devxbs{5)yM+O>BQ79JPMBp5l(H|G7~na?@# zuHnReSu7m2aQ%g6ofv&%;L-|yeXwK*sGm&Q#@~ITY3JW>d2}ac{s4)pt1aXUoJ4-W zZv1B&1kVy$#KB^(xST4nUl}KVX}G8N|MIu#(sOILyYV{CJLf`V%1|{y6?`rqAjR{2 zUGXi1wA^nZd>wC@x$>T@ubJIzSAK9RDQWyApZIVfC*!%-- zqyHGrZFd;*&ZlP#&+=K_#OL?x;@AAT5RQ`rKK!jwMkbymvDj4*bGisb5uLLLGMVW2 z{krw9t8q=Q2spG@=ax7}<-h1^J)Xc3nFGf_Vy_V~=dlj%I)}(}w?vgS;}vsiR78f1 z<5Q>vRV7m?T9x3ZjD|p_0q*oEM_yQ4mOP-~;Y*gZBET&MSk4LbWpxyw4Q78sI+H~! zS1}px0CB~o$s;g?65!CF5sGOdat1^$6HmS<#=9o&$3CznKkZFxE;#4dl^32l`LRkG z1KJ)n1laMhBpK}Z>vuLa+<)WZs(j0rt#zMuF1(%!^fvBo-p^sXj%d2QNLIDrutNxk z`$NHPJ7TN!Q@=g(ar?rBp3BNHl;uJZb11ou=4$#CbCyEMafM$}{4H%Mq*d|T9$Bkc z{Yr>6>56{~pVR$(J~w#QCG(B;8zPL96(n`3IKMxPDwuQuWxEdo(oMFex8G@?GOpJ`JKg%v=MWv2pn?}GuEh3#IY*Q?qwKQ0 z5864GCZ&LM=wXMzYsjEl=Yys>oCL^o^bbi| z+A>Jd7zlVgz%DVIEd0CHB_fCuW*Q?49Ly&z!D?P@;m;Okh4)D8-MquozC;W4C{W$_*S;q(yyQs_9<+Gvwz6t z+J4dHSN)>eob30>8%BrTxU-Gnw!fIesQUQ~*sYx7%0CTN{*eM^JStLw8{4Z&<5?Ko zmdUukW6|3*F7X+&r;9P?ikK4xPQoBh!=qxqGHB=AS&L`~fPQ;o1p;hW1*njOK;L9t z%TS6icqcFpGRt}HwU|GjTeBF{#SY>|$K?-V-5q>R`lhlQ6u~`II3EPjPCy&C$26=4 z?;c|1-?CZ}8UqmhrO$Z=a;3n0)$`=D62>pulxTa+stewD@JsrQfgv&m8t%EFso{Z} zmhSLoeIpFKPjb?{);Zit_#1$ggcdk1Q5YC1$3EBS;BL;l^h0W#^j6RI_nbE>9{0}y z#+|WdD*fixG&0#dRn%||ZKvQ8+k^lB5CBO;K~!wCQWi9Z z+}(hDPeS|IpwWJbEB*&x?usA9%M^XA{>5jv+HCGil(6muY^0b~36`=4=R2#*^(8ix z+t&Z_`b}LEqw>G>hS9aQ`b^LBJ}Zzzg*U}@-1g6>Q^+>#gw19&sgl5^Vm$}e?Xhh7 zj?&J=+z)=YmeawhFrNObC}F9bL)KmCt$%Gu$Xx};4zJ;gfwqb>M`h@l8p`K!4u)sx zSHuY5vzA|1r&ue?6{C67f z`Ou!sBNUw@_b0Lt2IL$YrF~yl`+6j%{lBp#1zq)LdFHSA10vkNLXPMvSN(RwKNP*gAM9ROO%AaSXU6mbVS_75ZpPaS7evUgK z5v_%{dnPgJ5IFCxa5Bp|2UYw5&;BWw2&Gat){9DS|L@|>?FtSm}Ecr6@hBdjr(}r*ziBzyXu_dR=(rRnd=uWtmfE|LD$!r z!15bX`uX7<_uqJ9&d+}gMm|YCe&FE#N_gHu8d#(fi!}$hXT-Q~)MKA5;GRBuxQHwV zOt0IQyu1sL;{bSsemU*ay0FsSE?wQL;oHQOzAAp*1q&*@DC(L!PHo7+VJGGJ9C^Bz zrwc!_BA@ZnnJZ4XbLmYd-udVYXDsRcD5Puhdv|IF13+2T``BI7Y;nSNY8V|1*Bd=9nY!LAHA%lvq(pjO>jM_#?F(m=&11Z{EMz;+V0CqbJ~`c2SH+%Z-_CG{tCh!HOD))7?#FD)Ro2-Lty|mhg_G`F`q$%@EZ@P0$Yf%?Lfvi# zfVQ*#XUXPqFKzse3xh8^>y|lZn<)jWdHn<1CgScvXn(tXQL?qGvIl(lTZvpv)lr^! zR~X};D6&iW>xw&9KV-^3WKFbq@r##U+VCiOV-tb73vZA6vDk5*n70Bl%5e);SO2>G zk4j(8arK{tu2g{l41P_7RgtRZ}!5N3pKi3hvj&$ZZ!HFG{ z2Oc|X@ye_Z?r4f8R}uVr|<#9ys$~97A7W)?yC% zXX)>t-=7_@EXT_)!{+c0Joo2sahou#)Mn**mw-aN(Zx0VHAcgA$BW6w*+TW1c z0~}0g`h#*Jm_~T(^m*sj42n=$;bRv+u-zE>A(QSWylmeGAn%c5H;KM>*39kEHW~xE zWvYEA${e}v4H7VF3>afhHsXEC8S@k8neSNNzJFt8>S^mPUa>6(>g|r=H5O zylMFzsfGt`d~)aHmhWX+(;sk7F0;=@*oK zuT{0v?PEX*TDDh>AKeYvLEWV?cm_`HBaNTYQ2IPu{C;GE_qJu?pF3gk!*?8a&(d}O zPD-D0Xm=eRUVCaOkWAV&zq$4iFNG_p%)icu`wt3~OLB0FNL&f63qQwBxPrpIO?H^S z16|-IlcuR9LVLlq5nAx!q(r=W4kN@P?S6 zC3NoR+%{W5LSZ-PT_x|H<}g|Wr{+gZI(GNWfu|h*=ZBsNti6H#^)b%4L-PO!&fb7Z z>ZIC|%0SOabtN_Og5ZF}IMjtWr^1o-gm7l%90r>UW(r>&5dI zjMf+EP|0i2qOfK8FLvy_|Hi-VG^?(%X?s4b{S>FL-*OC40XqE$YdQ`%WZNrtoTE2U zVJDkv)~^SW-5UzUA}lO1_{TZ8ItRO+3&VAs7q(h!>+?a_lFj8aZJA7-eKe%9xAl!J zu94gO`ulz6gLILk}6d0a@kDcUQReaVc&e7WYyB5_wshyZ!*~&jes_^(HN+}r26s}$ll7mjupU& zU;=le7VwDRdf$uvD(-t0a%aBz z13V(QfaCpo&SUp+@au}W1(1N@HV6B?o%JpE_vQEg;3b?Gy&CzQCBV4e4zj6Z8gUq4Fzm=4%GkAyC-c;B*~)4+GQ5`kewzavfAGPEx6w!A-NL#u1GbMA3#-H)xaS9mQAKdE1w)Gejm=+3$1mV}YmDPsH&i^w=dVA*J; zoo#G@rDD{yA%ZOy@~bxImX=$*M{J!u2F5!Bg4eK<8)qHV2(bZAJ%)f0$1O6)?J-ze zaq1i(d?ekHwai}&Cpyr&Md~htWygzir@`dMTI2nSbSOvY%A&g>yVAQ2xiOA%Z_b%x zxziXUbvOqO=|n?707yuWfI(Z+Bt- zeQ@^291~B9!`(YGx$k1dqJB+s({H#VHT~yzuHENniyxl(<2!#d=Vy0*_rPD@d(F}F z&UpXo)eQ@+3(xTbIY+F#nf>>nb~<*$=^mpD@l{&CdG2o^@Y04&P!EzTXk#dk*gZ z$lKQ}+!u&@rC9q>CwM>MqA>5?%1wrIvtrKK;kLhJ?c!zcJ#q0vR~~=ovLBxK=VgC6 zY4IZ~baj9Dq7^v-9BGfZ9wgB3&bES`Wz`?9eQNculV1(D;q93qb(YNrZ^~w~Z?fs^ zIjdjVc*UwkpL=lS;%|4Y6q5RFeRHVq;XlQg!f*YlRVcu-jmS!%yO zNIrY__VSk!$&*)8eVjn_gBD{zexlVs&;B($s5-kS>`33{a&Xpmkz1K0hpuT05Q@0< z5NsYuO`OEU2wvq|yMO)PUwq!e{gK1$MQEc2LNF>rs*oAt%lk0DqPqal-|d=M;zz7u z5v$^Ag2HFumEct5dY0PQ+!nn-ozDkg|9&Mj?UmaGc0@pY5i{E}=6oaOMicXXQ&Zzz zXR2Gz+qmk{16E)1=CRxrh_k11xS~>*!{fI$?tJhk_iVra=F8CLpX1uH|BXj}*5x9t zzm<|vC&{GMvvexq=41c5bkp&7Eq(r!zbt$7gu9mAd*WToes|(s5C8bM#SeY|gvHCg zdfZ(Pec`ypORwPy{nMS`Gbi5pQ1bZ2ORqa=@v?8S>?#VZ;r9N<-(J5#4TAN*yY6ZIjzHN9 zb>*n-;X@mzO@ZgmrSe}O0#PF^3(SL2xcTF)(eDDVU-XFEugv4_ShB+g-uD5ygY9o2ae8>g zT>36RYdQ=4DV2UVK;w=N_!ZN@S8_uHF%dbC@Ln;oTOj5)z70RWu_pEUP478#A3Y+d z{L6#lb}YYP^N!^|9nd1+mHasV-P$%N1E9ac;?{qaZ{nvJ@!lh1Vp`q?Ar*fs@~u3U z(uAP`2mLAIFMWfDkWB7c9xuGzi;b!})flsYb7u4|f~7$cWVwOCgrQ)^26^s=@kn}z z=qu0NDgfOYaBd@yZ1klWMI8W0l@XjI@b+na;Fj&A^(R@PI?Dh65CBO;K~$cYJTbUk z00?x86!PDgw{SEne4Tjr{i_k;n*jdo;L`M8QBI#X&s@>SBLRi%$Zo*P>-mbX|D&4o z(BYoJe~Xw!a8-ZIn^YpR#PFVR{=YKzZH+%qJCSDk zUAw-eRsrtB@wKD=AJK(SQFp>$mafRV@LK};D}fK8qU84qV%ooS7oef375cNmfCjdv z?G?<8Fwr*&NOV<;;Al_G6=KY9a`1i^N8P73R=1q6`jYu$TynmjOkz0aZ;V{8JP8b2 z2Rh;d-y7>Z?+nA0HaoWHq!i>b$Tc-U4S}H&E%mvB!)oi?Z&!`mpkIC3Rn@|U9-Mm> zL|zYpuNk^J56KtPHClO~;P}t!$Rq3!U$@RKA*22N zCB&d=AI8FZ4A7cNV@Fdn+EN)<_B$PO!^px&Rh5tc2Lwb$8}YI;?hL3Qpy?y{noQ5^xxtuc3PI4tP!!pr<*(vMYDy;=-jB`9pA=}+@QZvA(oJW+`& z$YwCq1^^Ws9aY=z3{xVmEhqjqF<#T|+5Jlq=Z^A_)#Du5`s8hGPQv?WVLaYHD!XHg zxLPOX&Ern3J!SXY!KWkv+nTEWJC88FMnmW!Qrz`U2qUjFM}rEvd>FkXxU;DR`j3Vz z6Nj>&ztUv5m$gSYv-tv3JQ1m4V1^iTuJ3vO7pwArx&Q3i zvoLavNT3%947mYt%!g-9FrGOHMh;hALQXn)edFH_?anLbIy$?=z<*%f&p)MKmO|;8 zpZvRTd@~>7PUR5tG~I?_bR6O6YkVjmjDA@#w0ee(=7ioY_n|=6VblvbxUj8TtUhKq zpjKcG99M;j;MH)?4b41i<{3MlWpuDEE^w!hs|#K?SVG;E*WWCsvNiWQabKa(?kC>R zc1l*TH#ju}GPykJo7xC1$YgV{+Hv*<=0lF+Sx{jGnI>; zC|u5l@))(rV~m!RDT4!Y;vl1Goqf2{9|tPuhC2b7umSg4$d@>A-ow1X@=X#i4`(?* zviUsp`vE%}o1y<`NM9bL5_x$vV1&zZ3FvtKyG3}pZ}UGnY|)ZI8~EkKN5Zd62@I(L zFz?bI*1&T|^IZ5CNBM=B4Dzk5+-=nu6NbofUegNh;@Q}vD;8bTaUd*Q=o!y{wTPSm z0riWr@`mn$-(+~23(c6S@c&d9@i z#Xj=NH7uI6D@U#)rEIl1Kp^^cz1nE&Kivk$bMTH>Ll6@*T7%zZg1S`z7n0a@9Wm>y z1C7C{N~-3R-8wU8ofcQSl<=u7`8BVl=xYq{F`3dL-{)U(~XBF^m@ z0I$gJ1av0=_Jzn0(9a3Cq%u4jXoVUCSsoRrfuNnGyRswc!!H4S9-*_@Fbp5%^SRmy zzPQhR%_|Q4_Tqo5emneQSV&oXkEGEpR5vGU!18khg931WtYaidR z=zlUD9#=AHjF?wL{}}jpagGhO+!4qJA@pCkHZ-?FA(hD@;1ZK^A;yT?QxdQ|N~BTd zT2q3l}7;0|rsXQmkMWI$%3cqvad$iZ@QD<)Oc(+M;BuE21# zy~w%idI!J?u(P2d6MX_$yqFc?6DpP&xF;lw+2Xv(B^u3dnAs>I&p2RhDQytGu!2!W z@Bz#}!y5#hJ{3K1@#1XVnEIz+>9q;|b4@bR%l!5Rx zfS{n^6_AHR3qk_vBtYmS{Ypaf5C}qI-gF+_>36-)-fRA=`jP6cO48{*)v2mp)qB@D zXP1=VwqbrF0NElU#D+gRBRz8#WP6fO$oSFfO)0M}@s4Lgzcs`+ z!2sC-uw2M8i&?f@yQ1*rIRWtmboRtDUV)xioG=@4m4TH3t}3844D(W zkhyGTZSA1(Mg{!LYHm(%oATZrA>TX0_eBLbbS7UR5vndks#wu(i z$Iq{>wo5Op-^(fgNpj{|GUj=-Q%78Y$FS~Xlq$~($P_^o27o9mF$TJOW0|)NilHFW z2*|D>i-53`=rAZsrF@FUlO*gg%7^lgWww)W`GYOGCigBFF7b@H%1b04ec^?=Eiz4& zB~DkBz^Dlnq$54|egAYklX*Wz*3+#hKwRjfuHi@zG}L1aJzWuxLE#L2@_*)K4@~kZ zLKmR}Kbs8x`en+&=z^j6oftppECUsM2w^PkK$&@VOATTsO>buQz4@lG zCOj##9>5n9O=3f*O-tDm2F2CZ`kvu!Fv{K;OdI2hA$o5pT=C_ZwcE$V3n0~vM95XW zu%SKGL(f@fuSa_xVWwW$r?HO!1IR&RAeB*IVg!gn>%w$FFN_0GXx2L5W4TKE4xB*W z1B~Flr-jwL@OedURMe(0&jG2+W4+aW3 z8^nX~*;4z~<%Y-f2eGw%3FGjcDKozTV9}ZEWsYNN1Qls*1qzyqwO|6X2mYr`G8HFf z3k-W^7tAd&0D^)bQx@~PojH{VCP#K*1zd;W!57un_ncx*YIJ08Glp+Raq`AB#!^ET z0o;oj1tyA26k0ry%qX}nD7?;|-poUU;w?xd)8ymcz~~m2CJ)9eQ6;x3_g{7t28m<} z?N4OdE#8sNo+$Oe#UBNiL@GsM5Xgg;!lAFh;=|+3j_5AjI}3oQx@LLZ7I|S+-+uj8 z0>Kd|hyeiS^2u!7DK3>T-f?fas5CBO;K~zm$9t~@Vk6$QV)G}Ux#$4eu5M1_%(_|`ZDyi7`A-k zp`{)D9z*67^33$?BU_q(7e|4+m`vuUhuQl^yKW3sLIHoJEoEi8!HibUXph54%s>B` z`dt;1j(ePazSfX=0XN9>(&`m`b@h7VBE}sTEB-=2vf$fz82ux~2pICg24uFCz}O z=J76_I>EuB&ml}6xSG>+(npL5eHb0}6zc!T&FyTu&j9F83vway zW%Mu0Amtub7J3lQ@6Es-(`!A~JaGIuXLVq}ZibB32lkD6$uuKmG6sM-D8q0V%HI%g zKbSW5H8g0>ah2xdbk4lNmpP4H>c}Oaf&9s*YCB`81A0BX-#@dF2>6R%Ar`%k33|1f%!9a-;o*Nfd@jjHGPY-;2C47%+0I$PsxNWseJj z(Y6r;ANR&vhWV}#@wFAkTe9nfzj^JF+D+oA8=;61l%iRbz##|}!~n3?PQwUT;vtF+ zE*bY)E9~p%D(SecT&ZlrVKaveeE<>t_CO9MhmHYt97qUuiAu@Ck5CA~$~}xU=|~wv zh}-QT5qF@tZ7(n65 z{JALVXe%}rtM*nDD zl)M-UqU6OB;9J-4#^=$r76>EUd7 zX|ioh4$}Y>;M0}{r_}s|XU!QfIOM^=>>|f?-9#d8PR;svC;3w!^POGD#P_2D`*H0v zmKq8`fN|eu-11@|;9mA&B#2TL-dGAC4P^m~Ia99EbF#!BzDg*^s@QxXsZIa17 z<4>I`uWQY@PtD|t4>Oswh|DC)`Zx=l8}o8mNrA2&tI+?rSf6byY3#@&Udbxj&_ZUd5j zRALN<{hwI1D!OZB(~IFSEi#5~AVZBvPac&Z&0MYoaC=aXVOm4Xi;U$P;I({c&WiP~ zUr^nc^TyJ0g`n*!J^}?X09-om*!SHyGGD&!4S$h8sQu{(eh zupj$_3>AjVr8Zh24<4Ez1&>zNd?I`P(#9>l(T;l!yaAB&FuWo#emL*R!F~gA967k>Wm$+5kf&okz<@~wqN!o3oIG5pXFRw)4HV(hmwi z&-$SFkyKXg)y9-4fr1zSJ(H(ywASA0h;Jft_dz|ah9cSuMp4`ufn5BMnef?PF{$@J z-rtx{p~Fm}M63@92E@4N#4t1Jl!T%8nn!$}W4fM9>ZUnW4a?>(UB6GB7r}lF zN}y;66vP17_xm43cRX?JD>J6IJeZ2p4c78?xHoP={4G28B$oBKQ_vYw8J zb>qagqD(B15L|$B!TgU(n}U~zO>km^lQe5tb8Jpc!*eO(TMWBJ#3Y_EnGUhRm73YKUuYW<6aY?gZCdYX;1>iLZBc9z(C`g7cWllS{iBD z{>Mn|RzBw*o8;?!PF`c#UW<9*o1wRUMb6y=P4x(~dy1J?u;VrCTpiZyB|7GM=iFMv z=h^Yo$p5&5SHW5Sbu3NoD2owuLMUwh8xl`K91Sun+zlweSxpf?I>=r=5FR;G7mMt%^Y5Ij_|C%)ORes$6nM=~ow#{gH ztYul`kp6bh3!Me0^aAJVJJ`s6Iyan5;7d*G^kC9c|pMar& z<&Hl^R`003wsB{5WYdmi*KHF+g5X_%NZfz;9v+wtd*=O2JPkJ|*>sxH@dPD%d&y5E zNtE^QL&mZ#WpEl!UU(PABIjt2m2w@seC-h~?UuP#7-!2(#HLkxWd6IsCp$feb=0TQ zxpa;J(00O}lryFqBcx;yM7-55+q=Dc;dZ=~w~^6ZdkE6=5bTqkk-e6ni9D z=!no3nMxko9&E`-dzbP3rlB&}guDbs$}$BobWadlhD;bGgmPp}o926-i5j9r&b|N= zAopX=3(ur^$L7_*qiF)_%pY5|cGsLaUs&Q9dkqxJubJIyVs0U(oR?aSrVKqM5CV*I z6~#TZ8Os_d{ofeNSDSEhLDllc6`y-ygZ#u5y8|gpg(!h>B~X?Iz;V{Egwl`4+dKSN zdj}=Dx-s&H;O-4dpo*N^{QfttSnc@(DtAp=HRE z;pacw^j0j^au>0=hRFPmnd^vnA5oBRPlPlLBO(Ark4rVfzKxh)A*LrVU9-qD?x$0x zb}gz})z}~pcaBJyW>Nx0OrR_cfSr&2q!R`}eL9}p55+Txzi-75JI)vZ#B!harH=L+ zoi*7M-2ZtL@n~g^}BXgMH*hCROZ8on=fe5w*7 z^eThT@O?pS8zu~%avcC7+c^U(i3&5`hNKh3Ap#TVx@K%@#K5oKgKcg6a;M3;Ai zCB6!m=z}=d8`Tgf*y&?PPJ!`$Fn)~K$mvHRwRal}bd}rw?8LOanN}gd0D5$I-1rIQ!_P{qY^3Nu5RcyPVNKx-i4i zk=1rL-q$g#F(#CBQ;AL0u=LN$~)-ov#{v%djT*MW_SW%0gU?eGCYPZ z1)T;%VAMiJbs%HzABG3Y&psR)!J;Z#jiu+2j!k?Igo`5~_A39z81tclq@b55+Zsmc zc?6q~k-8P^;Wj8ojQq{HGYfu7Z zPoQiK06BBJx3|1y9Lrk=TV;EAbT9zM;ss#m$jZxqh6^s}HfNN-b2g_GbZqUgYns|V zf9B@lJ5NdPoa`BQ0Xn?O;roKxHblN9C!K7LNaI9Nao&A7nMacV%LX0#C&=2eG5`ip z$Y^x#s=DUT{^ZS`<9{b(7UEn!1EWjcBhW^~DddHY!?&P&7$*P#5CBO;K~#nT0=OLr z7COlb!?xo3Yy_uAjq$Fj@cnN`W0gOK(yu;mb;FKJYHJI3Z4T5%mr9_>2$Zz}K+TKO z?5CD9^Bd?Hb8m1YGL$&M5IEZN0-5B}X=0lz_Go1tO@4IvBz0!dr`ZRJT|o3#H0c?N zM20;4C)rGen`%7sS?EdhgOU<_L~rYiM>%B&U(z8Z{$0qK88mNR{s$2bd06S}nAO~z zK7VE7ma66T_f^DWmm7B9XXeFdK^@|D#7@M5d0HU5*n?QcF))#-uy>ef9gNQDv_tTfb^t#eHeh78i zfVdNR#26@Z&p^f!7De8Hdtx`@>)`MVI<`faj=J21{jc{XDt}z{Y}1pUTG6y!pW?@r zp+O1s6Tp4azgDJ;P1V&YYg4PxJn;g^=m4u(0b0XZM|?C!0EXdmj7v-3nkB2it0+h12!12!JTtyfvfIEMcH}u2SO=3 zHB;sU{E{hxxi#x|SJgBvn?0xg#})DDm)Ou($niDS*=k~HM%+cr2Mi1XAcDch&Ja?u zQA7ckHOW7;lF@xP>eU8CzZ2Db6?I=q9xWnrmme1nUAjMvOx zSP`}dP0*kOiiXw>2lkl9cf)afby^70MFH!0&o&fYR`Sxe0F=L!5Pyc5p z7I>XeF9!pF(U2iUF}il*w~R4Q?{2&;_jmT^%&UNN<1DoMQ$vm`zy=e?0arTg9O)ny zMyFhO*Sv9OgpcD%ITe_I2_`~LrU~XOuYaj(MZ;b3c+w4*|6e8iE)^1M7G;o>6=$Yi?C!v|z8?i` zcaC2+%uf@$+fjq>d*r^v$NB%@?N9#iInOpM6eH&o%hqnYbXl`1d;rs+1df)#1TX;l zkW34?jbt+J(2l;8q2KHXBkU3MapGUKHMjyl?ws-wUG?FW4^-1{!9_yvOss!W$X`1(wkA zl3McTys+WG+*RwFF(1C9s;2&mXuRQn`j#(*hwKY5;J$@(v;ZdM1BPh@PG~cc*^D&I zty3!z!9d_HoNM_{lTmDop%6ztG5Ur^Lz#WZBi94+vKSVf%p||P-|v`rK@JQL-hgsz zaD6T@>=weQ_PvmC|0|r1U9_`{FJ4~L@U^O%#%oa5|D0XZ_{y9=Z8$IsQy!43K?x{< zF%pEL|9v09cLD4$&Md;Fo?Hky1aKYPg9R2sz3CiEX;6U#= zP!Cx$86TB>**N+mZK{@0lq6@xh?gY$UXS@p@DP}+9R*m0$}rTM4uz%T&ygPryD%Fn z_{bc*PJqXwBBuhHke7fM1#p|U&syI2`kb1^r>bh|e>rjOe`wa~0+pzCOLlhxn{sZUb z`|z@T6AFHwCH_aU{w32KU*zpeetyT)_kDSGO~b!et!TV)?uv##%v#>G{=Da2X_?>H z7>~d%C;cb^B~TCoUO}W5kh_z2GeFfxsY0l-l9jItbD z{?<z_8=w8|F#N_R>ZKwCXHf&#JbNWT^Ob=1`Gf=!|WfBVc1r2~2^-NAU8S&+m zb|$9+nlNGlfXAk~+J0fxs_1z&ue5&pg$?h(NZ2s9reRgp%BIKX ztf;?lc1`{5P}*?A*IzSxdEJjO2miyWXB)4OhdNI4daYtT)E%(;`;af zdOe@<{;cQuKHt|9Ir&~E(fJNdQ$u=R>Kg2pfVMiqnHM!ZL-i5%k%^Hvc4T|KykJx_ zfU+p;I7m1>L;WUE{6HRqRG0qm@u}Gd*aZ)s?sIVUp`2!YsZKuEl!8jZXaC@IVy9P? z--XS#XaQ+f8SO?Bt1+s8Z^9@Gs5dQ=r`HJo=0N0x6lrM1%<~mTAOG5eda8Uvms>Um zRZ(7pO~XVtafi*Ne6f^c`Tx&4;(DOG-Y0eU3$K((N)mFs%Y_o;`~NP|<>h3RZ;Uh0Zf7LuLih_{KGBIl`9v@^c3ixixASS;!{ z8}R{k1VIQPvQDWf3$LCuP}G(o&G95%Q*=?c}1df&t6 zp ziuiuY{zGsM4;F&K3v&d19xrWC5&4;2Af)Ofgy(7~Q}s44h4XU*hC7_a12@38-+x@v zf?Ac}L;PMzu^*2lp!3PX9_Aku zgGzeH3Q{+(4t|W16wrM!7W=yi3MBYler{^+M;i_zYjh8f$z8c2%|(p90x>bnvy5w* ztG~-RdA%duyH^J%R3oQ_{S#1KcGI)Wk^T|U>Pa`}@7RXJ&|BI=)K8(Ms8;Z=ZIsYg zUr)WKcYQbh%jmHnXoe?x3hhG}M&5pcUKK;?CmUDJZ0@vu8uvkdUz3DR)Sdwj$n@%^Q>7dMtwE&s{pywqJ3|en)Ds z{qpj*qUTdleYS8UM0zVj4dXeQQcQ^(`4$&)QoE?R(tNv|p8i-!91>d#ZJQCw{ctE= z?W=bXKi~-TQAvJ;9_&x;^R#er^HqGFWG>ivj#q1RQ7zuMd-<0{G{0h0L$cF8}C+E($Oi8PmYHRJ{=AERO7RUH%hYb93 z=(bG#&_?2y@NYq>d7k&IJtta&S4NxXMcpPH8zp=?t(9fX|bJfaWQY+iRUU7I9!!z`+EU?;US%>vdla?@oTqVw2P@(VYE2@`}u^bE7rKS(}i6Xtf z`eDRX4L6(i75y@BnGDFBR4u1mG}fl|*@jmsS`XiFT5OKE=1?cF_656HxPavlR(;r} zb$Iam^sQ~dxlJxxZV~K|ZKA=aOZO)G-#7%TOZy>I9xa`vvx34EisPYxc~8Z4B1OOv zC@~vf;5HpBCd4xh<@=V#phDej-@IM3K5lcc-hq%sQ8%KIQyWKO-c)7`Ah-h&wj@W| zbV=Tj@s>EA2Oc`Krdu}e{DqMcDJQag7KDUgQwTaU1oVt2|*4$X@y!c>@S z&Z704riPBWZTR)mxG6`B^zWWI>oiJXou!RSAt-kwJJ>X4n7gHOVX+@QxPl zdNn%Y8K1UH7Tg^fK7VbvTr@i**G-U`~zW$K6T%-+c9R^_8>};*~yb#^_v|`&r4jA#x*+0K zdiuuQZ2d+1O_K@F6i1(VR|Y+H;ua9SP^?t9*D4P%fp-AI?&ZlpmcW~jYnAb7wXYGQ z6+322|Atf-X_@v5*T+2kW**2~>zviGPCwi5&- zyLZOV)%hD2hAlFi=`V4)?XU|5=Mb9uJAa-@kLtjS^k_N4d}~Ao-cK6!RZ@3d#H)e) zVROD*(RBap#Im4%@PH2a)JfP+U_NaOdVsbHr8t;3|z3EC{K zW~1V|m+h(y`Bx*>A?`0>IgvtuWH_W|dpC=~&ZUPp<%}Fwx^U0(PZI$*gg&5Eaz1aH zYtQepECqgPkOQQaxBe?RMrR!~UVsk_pJ9v{_dk1!utb)=HUPB<$Jf~GK{t-GmonWr zUh0v_(3LEYd!Py=%j=wQ+?5QLE)Q6`5*FFk_IpU%ID6VFCb`<~`C-N~DH%|i)c4FW z|6TQM(NfqEXj`=QO=94#IarAE5j?a_VES7DV-Y4D&2bngPB=fmx5vOtkHfLd)8qNf z<+$A(1V8LcW2>NTuTn=KyGa3#78t0j@2iWu)ozH;9EoY@cp(7kl}EPPa}3Y23d1rV zLGYO|5GFFH0bb!3{D1fYlLo)Zo`z?_h90aj{A*(p7>#28?&=l> z0y%>9g`xp3YZwEO(xf~8OA-(48ssF-gOX=<63-L&ddYBO8VuM$O{?_M-Q5%h|CJ*x zjS2fhsV0gc1`|yWyl-K376XZrz@CPpQwFT}8XBHON`&+QR*5Wqc<10Zfs5_XG+ zo_JmsQm+mqlIGFA5ipg%1FX)=Le5Y zNRZ~VVZyr-1|o12C$0(@5;+I{oUQ(76sC8ZcKv?!z0)seK9RPZeHun+*>e&#mEaD+DlWSSNFZ1yjJ z#EB~d39$6hz0E=zdW$}=LI;a$^%+@zhl976Np6B 0 { @@ -113,7 +136,7 @@ func main() { mux := http.NewServeMux() // API Routes (e.g. /api/status) - apiHandler := api.NewHandler(absPath) + apiHandler = api.NewHandler(absPath) apiHandler.SetServerOptions(portNum, effectivePublic, explicitPublic, launcherCfg.AllowedCIDRs) apiHandler.RegisterRoutes(mux) @@ -145,16 +168,10 @@ func main() { } fmt.Println() - // Auto-open browser - if !*noBrowser { - go func() { - time.Sleep(500 * time.Millisecond) - url := "http://localhost:" + effectivePort - if err := utils.OpenBrowser(url); err != nil { - log.Printf("Warning: Failed to auto-open browser: %v", err) - } - }() - } + // Set server address for systray + serverAddr = fmt.Sprintf("http://localhost:%s", effectivePort) + + // Auto-open browser will be handled by systray onReady // Auto-start gateway after backend starts listening. go func() { @@ -162,8 +179,15 @@ func main() { apiHandler.TryAutoStartGateway() }() - // Start the Server - if err := http.ListenAndServe(addr, handler); err != nil { - log.Fatalf("Server failed to start: %v", err) - } + // Start the Server in a goroutine + server = &http.Server{Addr: addr, Handler: handler} + go func() { + log.Printf("Server listening on %s", addr) + if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed { + log.Fatalf("Server failed to start: %v", err) + } + }() + + // Start system tray + systray.Run(onReady, onExit) } diff --git a/web/backend/systray.go b/web/backend/systray.go new file mode 100644 index 000000000..58ce4984f --- /dev/null +++ b/web/backend/systray.go @@ -0,0 +1,133 @@ +package main + +import ( + "context" + _ "embed" + "fmt" + "time" + + "fyne.io/systray" + + "github.com/sipeed/picoclaw/pkg/logger" + "github.com/sipeed/picoclaw/web/backend/utils" +) + +const ( + browserDelay = 500 * time.Millisecond + shutdownTimeout = 15 * time.Second +) + +// onReady is called when the system tray is ready +func onReady() { + // Set icon and tooltip + systray.SetIcon(getIcon()) + systray.SetTooltip(fmt.Sprintf(T(AppTooltip), appName)) + + // Create menu items + mOpen := systray.AddMenuItem(T(MenuOpen), T(MenuOpenTooltip)) + mAbout := systray.AddMenuItem(T(MenuAbout), T(MenuAboutTooltip)) + + // Add version info under About menu + mVersion := mAbout.AddSubMenuItem(fmt.Sprintf(T(MenuVersion), appVersion), T(MenuVersionTooltip)) + mVersion.Disable() + mRepo := mAbout.AddSubMenuItem(T(MenuGitHub), "") + mDocs := mAbout.AddSubMenuItem(T(MenuDocs), "") + + systray.AddSeparator() + + // Add restart option + mRestart := systray.AddMenuItem(T(MenuRestart), T(MenuRestartTooltip)) + + systray.AddSeparator() + + // Quit option + mQuit := systray.AddMenuItem(T(MenuQuit), T(MenuQuitTooltip)) + + // Handle menu clicks + go func() { + for { + select { + case <-mOpen.ClickedCh: + if err := openBrowser(); err != nil { + logger.Errorf("Failed to open browser: %v", err) + } + + case <-mVersion.ClickedCh: + // Version info - do nothing, just shows current version + + case <-mRepo.ClickedCh: + if err := utils.OpenBrowser("https://github.com/sipeed/picoclaw"); err != nil { + logger.Errorf("Failed to open GitHub: %v", err) + } + + case <-mDocs.ClickedCh: + if err := utils.OpenBrowser(T(DocUrl)); err != nil { + logger.Errorf("Failed to open docs: %v", err) + } + + case <-mRestart.ClickedCh: + fmt.Println("Restart request received...") + if apiHandler != nil { + if pid, err := apiHandler.RestartGateway(); err != nil { + logger.Errorf("Failed to restart gateway: %v", err) + } else { + logger.Infof("Gateway restarted (PID: %d)", pid) + } + } + + case <-mQuit.ClickedCh: + systray.Quit() + } + } + }() + + if !*noBrowser { + // Auto-open browser after systray is ready (if not disabled) + // Check no-browser flag via environment or pass as parameter if needed + if err := openBrowser(); err != nil { + logger.Errorf("Warning: Failed to auto-open browser: %v", err) + } + } +} + +// onExit is called when the system tray is exiting +func onExit() { + fmt.Println(T(Exiting)) + + // First, shutdown API handler to close all SSE connections + if apiHandler != nil { + apiHandler.Shutdown() + } + + if server != nil { + // Disable keep-alive to allow graceful shutdown + server.SetKeepAlivesEnabled(false) + + ctx, cancel := context.WithTimeout(context.Background(), shutdownTimeout) + defer cancel() + if err := server.Shutdown(ctx); err != nil { + // Context deadline exceeded is expected if there are active connections + // This is not necessarily an error, so log it at info level + if err == context.DeadlineExceeded { + logger.Infof("Server shutdown timeout after %v, forcing close", shutdownTimeout) + } else { + logger.Errorf("Server shutdown error: %v", err) + } + } else { + logger.Infof("Server shutdown completed successfully") + } + } +} + +// openBrowser opens the PicoClaw web console in the default browser +func openBrowser() error { + if serverAddr == "" { + return fmt.Errorf("server address not set") + } + return utils.OpenBrowser(serverAddr) +} + +// getIcon returns the system tray icon +func getIcon() []byte { + return iconData +} diff --git a/web/backend/systray_unix.go b/web/backend/systray_unix.go new file mode 100644 index 000000000..0f9d2bb51 --- /dev/null +++ b/web/backend/systray_unix.go @@ -0,0 +1,8 @@ +//go:build !windows + +package main + +import _ "embed" + +//go:embed icon.png +var iconData []byte diff --git a/web/backend/systray_windows.go b/web/backend/systray_windows.go new file mode 100644 index 000000000..cc1885155 --- /dev/null +++ b/web/backend/systray_windows.go @@ -0,0 +1,8 @@ +//go:build windows + +package main + +import _ "embed" + +//go:embed icon.ico +var iconData []byte From b402888bfacd559852d2c245d33b578d4d8e2e5a Mon Sep 17 00:00:00 2001 From: Desmond Foo <102380796+SHINE-six@users.noreply.github.com> Date: Tue, 17 Mar 2026 14:41:43 +0800 Subject: [PATCH 054/234] feat(tools): add SpawnStatusTool for reporting subagent statuses (#1540) * feat(tools): add SpawnStatusTool for reporting subagent statuses * feat(tools): enhance SpawnStatusTool to restrict task visibility by conversation context * feat(tests): add Unicode result truncation and channel filtering tests for SpawnStatusTool * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * feat(tools): enhance SpawnStatusTool with task ID validation and sorting by creation timestamp * feat(tools): update SpawnStatusTool description and parameter documentation for clarity * refactor(tests): improve comments for clarity in ChannelFiltering test case * fix(tools): update no subagents message for clarity and remove unnecessary locking in runTask * fix(tools): improve description clarity for SpawnStatusTool regarding task context * feat(tools): add spawn_status tool configuration and registration * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix(agent): improve subagent management for spawn and spawn_status tools * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix(tests): update ResultTruncation_Unicode test to use valid CJK character --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: lxowalle <83055338+lxowalle@users.noreply.github.com> --- pkg/agent/loop.go | 20 +- pkg/config/config.go | 3 + pkg/config/defaults.go | 3 + pkg/tools/spawn_status.go | 178 +++++++++++++++ pkg/tools/spawn_status_test.go | 406 +++++++++++++++++++++++++++++++++ pkg/tools/subagent.go | 28 ++- web/backend/api/tools.go | 14 +- 7 files changed, 641 insertions(+), 11 deletions(-) create mode 100644 pkg/tools/spawn_status.go create mode 100644 pkg/tools/spawn_status_test.go diff --git a/pkg/agent/loop.go b/pkg/agent/loop.go index 182bc0495..8328c691e 100644 --- a/pkg/agent/loop.go +++ b/pkg/agent/loop.go @@ -225,20 +225,26 @@ func registerSharedTools( } } - // Spawn tool with allowlist checker - if cfg.Tools.IsToolEnabled("spawn") { - if cfg.Tools.IsToolEnabled("subagent") { - subagentManager := tools.NewSubagentManager(provider, agent.Model, agent.Workspace) - subagentManager.SetLLMOptions(agent.MaxTokens, agent.Temperature) + // Spawn and spawn_status tools share a SubagentManager. + // Construct it when either tool is enabled (both require subagent). + spawnEnabled := cfg.Tools.IsToolEnabled("spawn") + spawnStatusEnabled := cfg.Tools.IsToolEnabled("spawn_status") + if (spawnEnabled || spawnStatusEnabled) && cfg.Tools.IsToolEnabled("subagent") { + subagentManager := tools.NewSubagentManager(provider, agent.Model, agent.Workspace) + subagentManager.SetLLMOptions(agent.MaxTokens, agent.Temperature) + if spawnEnabled { spawnTool := tools.NewSpawnTool(subagentManager) currentAgentID := agentID spawnTool.SetAllowlistChecker(func(targetAgentID string) bool { return registry.CanSpawnSubagent(currentAgentID, targetAgentID) }) agent.Tools.Register(spawnTool) - } else { - logger.WarnCF("agent", "spawn tool requires subagent to be enabled", nil) } + if spawnStatusEnabled { + agent.Tools.Register(tools.NewSpawnStatusTool(subagentManager)) + } + } else if (spawnEnabled || spawnStatusEnabled) && !cfg.Tools.IsToolEnabled("subagent") { + logger.WarnCF("agent", "spawn/spawn_status tools require subagent to be enabled", nil) } } } diff --git a/pkg/config/config.go b/pkg/config/config.go index ad5618907..35de48f23 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -751,6 +751,7 @@ type ToolsConfig struct { ReadFile ReadFileToolConfig `json:"read_file" envPrefix:"PICOCLAW_TOOLS_READ_FILE_"` SendFile ToolConfig `json:"send_file" envPrefix:"PICOCLAW_TOOLS_SEND_FILE_"` Spawn ToolConfig `json:"spawn" envPrefix:"PICOCLAW_TOOLS_SPAWN_"` + SpawnStatus ToolConfig `json:"spawn_status" envPrefix:"PICOCLAW_TOOLS_SPAWN_STATUS_"` SPI ToolConfig `json:"spi" envPrefix:"PICOCLAW_TOOLS_SPI_"` Subagent ToolConfig `json:"subagent" envPrefix:"PICOCLAW_TOOLS_SUBAGENT_"` WebFetch ToolConfig `json:"web_fetch" envPrefix:"PICOCLAW_TOOLS_WEB_FETCH_"` @@ -1112,6 +1113,8 @@ func (t *ToolsConfig) IsToolEnabled(name string) bool { return t.ReadFile.Enabled case "spawn": return t.Spawn.Enabled + case "spawn_status": + return t.SpawnStatus.Enabled case "spi": return t.SPI.Enabled case "subagent": diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index a029eeb59..2b177d5de 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -522,6 +522,9 @@ func DefaultConfig() *Config { Spawn: ToolConfig{ Enabled: true, }, + SpawnStatus: ToolConfig{ + Enabled: false, + }, SPI: ToolConfig{ Enabled: false, // Hardware tool - Linux only }, diff --git a/pkg/tools/spawn_status.go b/pkg/tools/spawn_status.go new file mode 100644 index 000000000..416fd2226 --- /dev/null +++ b/pkg/tools/spawn_status.go @@ -0,0 +1,178 @@ +package tools + +import ( + "context" + "fmt" + "sort" + "strings" + "time" +) + +// SpawnStatusTool reports the status of subagents that were spawned via the +// spawn tool. It can query a specific task by ID, or list every known task with +// a summary count broken-down by status. +type SpawnStatusTool struct { + manager *SubagentManager +} + +// NewSpawnStatusTool creates a SpawnStatusTool backed by the given manager. +func NewSpawnStatusTool(manager *SubagentManager) *SpawnStatusTool { + return &SpawnStatusTool{manager: manager} +} + +func (t *SpawnStatusTool) Name() string { + return "spawn_status" +} + +func (t *SpawnStatusTool) Description() string { + return "Get the status of spawned subagents. " + + "Returns a list of all subagents and their current state " + + "(running, completed, failed, or canceled), or retrieves details " + + "for a specific subagent task when task_id is provided. " + + "Results are scoped to the current conversation's channel and chat ID; " + + "all tasks are listed only when no channel/chat context is injected " + + "(e.g. direct programmatic calls via Execute)." +} + +func (t *SpawnStatusTool) Parameters() map[string]any { + return map[string]any{ + "type": "object", + "properties": map[string]any{ + "task_id": map[string]any{ + "type": "string", + "description": "Optional task ID (e.g. \"subagent-1\") to inspect a specific " + + "subagent. When omitted, all visible subagents are listed.", + }, + }, + "required": []string{}, + } +} + +func (t *SpawnStatusTool) Execute(ctx context.Context, args map[string]any) *ToolResult { + if t.manager == nil { + return ErrorResult("Subagent manager not configured") + } + + // Derive the calling conversation's identity so we can scope results to the + // current chat only — preventing cross-conversation task leakage in + // multi-user deployments. + callerChannel := ToolChannel(ctx) + callerChatID := ToolChatID(ctx) + + var taskID string + if rawTaskID, ok := args["task_id"]; ok && rawTaskID != nil { + taskIDStr, ok := rawTaskID.(string) + if !ok { + return ErrorResult("task_id must be a string") + } + taskID = strings.TrimSpace(taskIDStr) + } + + if taskID != "" { + // GetTaskCopy returns a consistent snapshot under the manager lock, + // eliminating any data race with the concurrent subagent goroutine. + taskCopy, ok := t.manager.GetTaskCopy(taskID) + if !ok { + return ErrorResult(fmt.Sprintf("No subagent found with task ID: %s", taskID)) + } + + // Restrict lookup to tasks that belong to this conversation. + if callerChannel != "" && taskCopy.OriginChannel != "" && taskCopy.OriginChannel != callerChannel { + return ErrorResult(fmt.Sprintf("No subagent found with task ID: %s", taskID)) + } + if callerChatID != "" && taskCopy.OriginChatID != "" && taskCopy.OriginChatID != callerChatID { + return ErrorResult(fmt.Sprintf("No subagent found with task ID: %s", taskID)) + } + + return NewToolResult(spawnStatusFormatTask(&taskCopy)) + } + + // ListTaskCopies returns consistent snapshots under the manager lock. + origTasks := t.manager.ListTaskCopies() + if len(origTasks) == 0 { + return NewToolResult("No subagents have been spawned yet.") + } + + tasks := make([]*SubagentTask, 0, len(origTasks)) + for i := range origTasks { + cpy := &origTasks[i] + + // Filter to tasks that originate from the current conversation only. + if callerChannel != "" && cpy.OriginChannel != "" && cpy.OriginChannel != callerChannel { + continue + } + if callerChatID != "" && cpy.OriginChatID != "" && cpy.OriginChatID != callerChatID { + continue + } + + tasks = append(tasks, cpy) + } + + if len(tasks) == 0 { + return NewToolResult("No subagents found for this conversation.") + } + + // Order by creation time (ascending) so spawning order is preserved. + // Fall back to ID string for tasks created in the same millisecond. + sort.Slice(tasks, func(i, j int) bool { + if tasks[i].Created != tasks[j].Created { + return tasks[i].Created < tasks[j].Created + } + return tasks[i].ID < tasks[j].ID + }) + + counts := map[string]int{} + for _, task := range tasks { + counts[task.Status]++ + } + + var sb strings.Builder + sb.WriteString(fmt.Sprintf("Subagent status report (%d total):\n", len(tasks))) + for _, status := range []string{"running", "completed", "failed", "canceled"} { + if n := counts[status]; n > 0 { + label := strings.ToUpper(status[:1]) + status[1:] + ":" + sb.WriteString(fmt.Sprintf(" %-10s %d\n", label, n)) + } + } + sb.WriteString("\n") + + for _, task := range tasks { + sb.WriteString(spawnStatusFormatTask(task)) + sb.WriteString("\n\n") + } + + return NewToolResult(strings.TrimRight(sb.String(), "\n")) +} + +// spawnStatusFormatTask renders a single SubagentTask as a human-readable block. +func spawnStatusFormatTask(task *SubagentTask) string { + var sb strings.Builder + + header := fmt.Sprintf("[%s] status=%s", task.ID, task.Status) + if task.Label != "" { + header += fmt.Sprintf(" label=%q", task.Label) + } + if task.AgentID != "" { + header += fmt.Sprintf(" agent=%s", task.AgentID) + } + if task.Created > 0 { + created := time.UnixMilli(task.Created).UTC().Format("2006-01-02 15:04:05 UTC") + header += fmt.Sprintf(" created=%s", created) + } + sb.WriteString(header) + + if task.Task != "" { + sb.WriteString(fmt.Sprintf("\n task: %s", task.Task)) + } + if task.Result != "" { + result := task.Result + const maxResultLen = 300 + runes := []rune(result) + if len(runes) > maxResultLen { + result = string(runes[:maxResultLen]) + "…" + } + sb.WriteString(fmt.Sprintf("\n result: %s", result)) + } + + return sb.String() +} diff --git a/pkg/tools/spawn_status_test.go b/pkg/tools/spawn_status_test.go new file mode 100644 index 000000000..9c772d61a --- /dev/null +++ b/pkg/tools/spawn_status_test.go @@ -0,0 +1,406 @@ +package tools + +import ( + "context" + "fmt" + "strings" + "testing" + "time" +) + +func TestSpawnStatusTool_Name(t *testing.T) { + provider := &MockLLMProvider{} + workspace := t.TempDir() + manager := NewSubagentManager(provider, "test-model", workspace) + tool := NewSpawnStatusTool(manager) + + if tool.Name() != "spawn_status" { + t.Errorf("Expected name 'spawn_status', got '%s'", tool.Name()) + } +} + +func TestSpawnStatusTool_Description(t *testing.T) { + provider := &MockLLMProvider{} + workspace := t.TempDir() + manager := NewSubagentManager(provider, "test-model", workspace) + tool := NewSpawnStatusTool(manager) + + desc := tool.Description() + if desc == "" { + t.Error("Description should not be empty") + } + if !strings.Contains(strings.ToLower(desc), "subagent") { + t.Errorf("Description should mention 'subagent', got: %s", desc) + } +} + +func TestSpawnStatusTool_Parameters(t *testing.T) { + provider := &MockLLMProvider{} + workspace := t.TempDir() + manager := NewSubagentManager(provider, "test-model", workspace) + tool := NewSpawnStatusTool(manager) + + params := tool.Parameters() + if params["type"] != "object" { + t.Errorf("Expected type 'object', got: %v", params["type"]) + } + props, ok := params["properties"].(map[string]any) + if !ok { + t.Fatal("Expected 'properties' to be a map") + } + if _, hasTaskID := props["task_id"]; !hasTaskID { + t.Error("Expected 'task_id' parameter in properties") + } +} + +func TestSpawnStatusTool_NilManager(t *testing.T) { + tool := &SpawnStatusTool{manager: nil} + result := tool.Execute(context.Background(), map[string]any{}) + if !result.IsError { + t.Error("Expected error result when manager is nil") + } +} + +func TestSpawnStatusTool_Empty(t *testing.T) { + provider := &MockLLMProvider{} + workspace := t.TempDir() + manager := NewSubagentManager(provider, "test-model", workspace) + tool := NewSpawnStatusTool(manager) + + result := tool.Execute(context.Background(), map[string]any{}) + if result.IsError { + t.Fatalf("Expected success, got error: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "No subagents") { + t.Errorf("Expected 'No subagents' message, got: %s", result.ForLLM) + } +} + +func TestSpawnStatusTool_ListAll(t *testing.T) { + provider := &MockLLMProvider{} + workspace := t.TempDir() + manager := NewSubagentManager(provider, "test-model", workspace) + + now := time.Now().UnixMilli() + manager.mu.Lock() + manager.tasks["subagent-1"] = &SubagentTask{ + ID: "subagent-1", + Task: "Do task A", + Label: "task-a", + Status: "running", + Created: now, + } + manager.tasks["subagent-2"] = &SubagentTask{ + ID: "subagent-2", + Task: "Do task B", + Label: "task-b", + Status: "completed", + Result: "Done successfully", + Created: now, + } + manager.tasks["subagent-3"] = &SubagentTask{ + ID: "subagent-3", + Task: "Do task C", + Status: "failed", + Result: "Error: something went wrong", + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + result := tool.Execute(context.Background(), map[string]any{}) + + if result.IsError { + t.Fatalf("Expected success, got error: %s", result.ForLLM) + } + + // Summary header + if !strings.Contains(result.ForLLM, "3 total") { + t.Errorf("Expected total count in header, got: %s", result.ForLLM) + } + + // Individual task IDs + for _, id := range []string{"subagent-1", "subagent-2", "subagent-3"} { + if !strings.Contains(result.ForLLM, id) { + t.Errorf("Expected task %s in output, got:\n%s", id, result.ForLLM) + } + } + + // Status values + for _, status := range []string{"running", "completed", "failed"} { + if !strings.Contains(result.ForLLM, status) { + t.Errorf("Expected status '%s' in output, got:\n%s", status, result.ForLLM) + } + } + + // Result content + if !strings.Contains(result.ForLLM, "Done successfully") { + t.Errorf("Expected result text in output, got:\n%s", result.ForLLM) + } +} + +func TestSpawnStatusTool_GetByID(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + + manager.mu.Lock() + manager.tasks["subagent-42"] = &SubagentTask{ + ID: "subagent-42", + Task: "Specific task", + Label: "my-task", + Status: "failed", + Result: "Something went wrong", + Created: time.Now().UnixMilli(), + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + result := tool.Execute(context.Background(), map[string]any{"task_id": "subagent-42"}) + + if result.IsError { + t.Fatalf("Expected success, got error: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "subagent-42") { + t.Errorf("Expected task ID in output, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "failed") { + t.Errorf("Expected status 'failed' in output, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "Something went wrong") { + t.Errorf("Expected result text in output, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "my-task") { + t.Errorf("Expected label in output, got: %s", result.ForLLM) + } +} + +func TestSpawnStatusTool_GetByID_NotFound(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + tool := NewSpawnStatusTool(manager) + + result := tool.Execute(context.Background(), map[string]any{"task_id": "nonexistent-999"}) + if !result.IsError { + t.Errorf("Expected error for nonexistent task, got: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "nonexistent-999") { + t.Errorf("Expected task ID in error message, got: %s", result.ForLLM) + } +} + +func TestSpawnStatusTool_TaskID_NonString(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + tool := NewSpawnStatusTool(manager) + + for _, badVal := range []any{42, 3.14, true, map[string]any{"x": 1}, []string{"a"}} { + result := tool.Execute(context.Background(), map[string]any{"task_id": badVal}) + if !result.IsError { + t.Errorf("Expected error for task_id=%T(%v), got success: %s", badVal, badVal, result.ForLLM) + } + if !strings.Contains(result.ForLLM, "task_id must be a string") { + t.Errorf("Expected type-error message, got: %s", result.ForLLM) + } + } +} + +func TestSpawnStatusTool_ResultTruncation(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + + longResult := strings.Repeat("X", 500) + manager.mu.Lock() + manager.tasks["subagent-1"] = &SubagentTask{ + ID: "subagent-1", + Task: "Long task", + Status: "completed", + Result: longResult, + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + result := tool.Execute(context.Background(), map[string]any{"task_id": "subagent-1"}) + + if result.IsError { + t.Fatalf("Unexpected error: %s", result.ForLLM) + } + // Output should be shorter than the raw result due to truncation + if len(result.ForLLM) >= len(longResult) { + t.Errorf("Expected result to be truncated, but ForLLM is %d chars", len(result.ForLLM)) + } + if !strings.Contains(result.ForLLM, "…") { + t.Errorf("Expected truncation indicator '…' in output, got: %s", result.ForLLM) + } +} + +func TestSpawnStatusTool_ResultTruncation_Unicode(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + + // Each CJK rune is 3 bytes; 400 runes = 1200 bytes — well over the 300-rune limit. + cjkChar := string(rune(0x5b57)) + longResult := strings.Repeat(cjkChar, 400) + manager.mu.Lock() + manager.tasks["subagent-1"] = &SubagentTask{ + ID: "subagent-1", + Task: "Unicode task", + Status: "completed", + Result: longResult, + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + result := tool.Execute(context.Background(), map[string]any{"task_id": "subagent-1"}) + + if result.IsError { + t.Fatalf("Unexpected error: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "…") { + t.Errorf("Expected truncation indicator in output") + } + // The truncated result must be valid UTF-8 (no split rune boundaries). + if !strings.Contains(result.ForLLM, cjkChar) { + t.Errorf("Expected CJK runes to appear intact in output") + } +} + +func TestSpawnStatusTool_StatusCounts(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + + manager.mu.Lock() + for i, status := range []string{"running", "running", "completed", "failed", "canceled"} { + id := fmt.Sprintf("subagent-%d", i+1) + manager.tasks[id] = &SubagentTask{ID: id, Task: "t", Status: status} + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + result := tool.Execute(context.Background(), map[string]any{}) + + if result.IsError { + t.Fatalf("Unexpected error: %s", result.ForLLM) + } + // The summary line should mention all statuses that have counts + for _, want := range []string{"Running:", "Completed:", "Failed:", "Canceled:"} { + if !strings.Contains(result.ForLLM, want) { + t.Errorf("Expected %q in summary, got:\n%s", want, result.ForLLM) + } + } +} + +func TestSpawnStatusTool_SortByCreatedTimestamp(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + + now := time.Now().UnixMilli() + manager.mu.Lock() + // Intentionally insert with out-of-order IDs and timestamps that reflect + // true spawn order: subagent-2 was spawned first, subagent-10 second. + manager.tasks["subagent-10"] = &SubagentTask{ + ID: "subagent-10", Task: "second", Status: "running", + Created: now + 1, + } + manager.tasks["subagent-2"] = &SubagentTask{ + ID: "subagent-2", Task: "first", Status: "running", + Created: now, + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + result := tool.Execute(context.Background(), map[string]any{}) + + if result.IsError { + t.Fatalf("Unexpected error: %s", result.ForLLM) + } + + pos2 := strings.Index(result.ForLLM, "subagent-2") + pos10 := strings.Index(result.ForLLM, "subagent-10") + if pos2 < 0 || pos10 < 0 { + t.Fatalf("Both task IDs should appear in output:\n%s", result.ForLLM) + } + if pos2 > pos10 { + t.Errorf("Expected subagent-2 (created first) to appear before subagent-10, but got:\n%s", result.ForLLM) + } +} + +func TestSpawnStatusTool_ChannelFiltering_ListAll(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + + manager.mu.Lock() + manager.tasks["subagent-1"] = &SubagentTask{ + ID: "subagent-1", Task: "mine", Status: "running", + OriginChannel: "telegram", OriginChatID: "chat-A", + } + manager.tasks["subagent-2"] = &SubagentTask{ + ID: "subagent-2", Task: "other user", Status: "running", + OriginChannel: "telegram", OriginChatID: "chat-B", + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + + // Caller is chat-A — should only see subagent-1. + ctx := WithToolContext(context.Background(), "telegram", "chat-A") + result := tool.Execute(ctx, map[string]any{}) + + if result.IsError { + t.Fatalf("Unexpected error: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "subagent-1") { + t.Errorf("Expected own task in output, got:\n%s", result.ForLLM) + } + if strings.Contains(result.ForLLM, "subagent-2") { + t.Errorf("Should NOT see other chat's task, got:\n%s", result.ForLLM) + } +} + +func TestSpawnStatusTool_ChannelFiltering_GetByID(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + + manager.mu.Lock() + manager.tasks["subagent-99"] = &SubagentTask{ + ID: "subagent-99", Task: "secret", Status: "completed", Result: "private data", + OriginChannel: "slack", OriginChatID: "room-Z", + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + + // Different chat trying to look up subagent-99 by ID. + ctx := WithToolContext(context.Background(), "slack", "room-OTHER") + result := tool.Execute(ctx, map[string]any{"task_id": "subagent-99"}) + + if !result.IsError { + t.Errorf("Expected error (cross-chat lookup blocked), got: %s", result.ForLLM) + } +} + +func TestSpawnStatusTool_ChannelFiltering_NoContext(t *testing.T) { + provider := &MockLLMProvider{} + manager := NewSubagentManager(provider, "test-model", "/tmp/test") + + manager.mu.Lock() + manager.tasks["subagent-1"] = &SubagentTask{ + ID: "subagent-1", Task: "t", Status: "completed", + OriginChannel: "telegram", OriginChatID: "chat-A", + } + manager.mu.Unlock() + + tool := NewSpawnStatusTool(manager) + + // No ToolContext injected (e.g. a direct programmatic call that bypasses + // WithToolContext entirely) — callerChannel and callerChatID are both "". + // Note: the normal CLI path uses ProcessDirectWithChannel("cli", "direct"), + // which *does* inject a non-empty context; this test covers the case where + // no context injection happens at all. + // The filter conditions require a non-empty caller value, so all tasks pass through. + result := tool.Execute(context.Background(), map[string]any{}) + if result.IsError { + t.Fatalf("Unexpected error: %s", result.ForLLM) + } + if !strings.Contains(result.ForLLM, "subagent-1") { + t.Errorf("Expected task visible from no-context caller, got:\n%s", result.ForLLM) + } +} diff --git a/pkg/tools/subagent.go b/pkg/tools/subagent.go index e51cbaafa..c37a5ee0f 100644 --- a/pkg/tools/subagent.go +++ b/pkg/tools/subagent.go @@ -109,9 +109,6 @@ func (sm *SubagentManager) Spawn( } func (sm *SubagentManager) runTask(ctx context.Context, task *SubagentTask, callback AsyncCallback) { - task.Status = "running" - task.Created = time.Now().UnixMilli() - // Build system prompt for subagent systemPrompt := `You are a subagent. Complete the given task independently and report the result. You have access to tools - use them as needed to complete your task. @@ -219,6 +216,18 @@ func (sm *SubagentManager) GetTask(taskID string) (*SubagentTask, bool) { return task, ok } +// GetTaskCopy returns a copy of the task with the given ID, taken under the +// read lock, so the caller receives a consistent snapshot with no data race. +func (sm *SubagentManager) GetTaskCopy(taskID string) (SubagentTask, bool) { + sm.mu.RLock() + defer sm.mu.RUnlock() + task, ok := sm.tasks[taskID] + if !ok { + return SubagentTask{}, false + } + return *task, true +} + func (sm *SubagentManager) ListTasks() []*SubagentTask { sm.mu.RLock() defer sm.mu.RUnlock() @@ -230,6 +239,19 @@ func (sm *SubagentManager) ListTasks() []*SubagentTask { return tasks } +// ListTaskCopies returns value copies of all tasks, taken under the read lock, +// so callers receive consistent snapshots with no data race. +func (sm *SubagentManager) ListTaskCopies() []SubagentTask { + sm.mu.RLock() + defer sm.mu.RUnlock() + + copies := make([]SubagentTask, 0, len(sm.tasks)) + for _, task := range sm.tasks { + copies = append(copies, *task) + } + return copies +} + // SubagentTool executes a subagent task synchronously and returns the result. // Unlike SpawnTool which runs tasks asynchronously, SubagentTool waits for completion // and returns the result directly in the ToolResult. diff --git a/web/backend/api/tools.go b/web/backend/api/tools.go index 373a3be12..9df4a7091 100644 --- a/web/backend/api/tools.go +++ b/web/backend/api/tools.go @@ -118,6 +118,12 @@ var toolCatalog = []toolCatalogEntry{ Category: "agents", ConfigKey: "spawn", }, + { + Name: "spawn_status", + Description: "Query the status of spawned subagents.", + Category: "agents", + ConfigKey: "spawn_status", + }, { Name: "i2c", Description: "Interact with I2C hardware devices exposed on the host.", @@ -205,7 +211,7 @@ func buildToolSupport(cfg *config.Config) []toolSupportItem { reasonCode = "requires_skills" } } - case "spawn": + case "spawn", "spawn_status": if cfg.Tools.IsToolEnabled(entry.ConfigKey) { if cfg.Tools.IsToolEnabled("subagent") { status = "enabled" @@ -300,6 +306,12 @@ func applyToolState(cfg *config.Config, toolName string, enabled bool) error { if enabled { cfg.Tools.Subagent.Enabled = true } + case "spawn_status": + cfg.Tools.SpawnStatus.Enabled = enabled + if enabled { + cfg.Tools.Spawn.Enabled = true + cfg.Tools.Subagent.Enabled = true + } case "i2c": cfg.Tools.I2C.Enabled = enabled case "spi": From 0499cdab72ea13f74100b9bcf57d9cf88a4ba1d4 Mon Sep 17 00:00:00 2001 From: wenjie Date: Tue, 17 Mar 2026 15:23:49 +0800 Subject: [PATCH 055/234] build: use WEB_GO for web targets and preserve backend dist directory (#1671) Separate web Go commands from the default Go toolchain so web builds, tests, and vet can enable CGO on Darwin without affecting the rest of the project. Also ensure frontend backend builds recreate backend/dist with a .gitkeep file so the embedded output directory remains tracked. --- Makefile | 8 +++++-- web/Makefile | 21 ++++++++++--------- web/frontend/package.json | 2 +- .../scripts/ensure-backend-gitkeep.cjs | 9 ++++++++ 4 files changed, 27 insertions(+), 13 deletions(-) create mode 100644 web/frontend/scripts/ensure-backend-gitkeep.cjs diff --git a/Makefile b/Makefile index 4f4a7a6cb..1c6b73591 100644 --- a/Makefile +++ b/Makefile @@ -16,6 +16,7 @@ LDFLAGS=-X $(CONFIG_PKG).Version=$(VERSION) -X $(CONFIG_PKG).GitCommit=$(GIT_COM # Go variables GO?=CGO_ENABLED=0 go +WEB_GO?=$(GO) GOFLAGS?=-v -tags stdjson # Patch MIPS LE ELF e_flags (offset 36) for NaN2008-only kernels (e.g. Ingenic X2600). @@ -79,6 +80,7 @@ ifeq ($(UNAME_S),Linux) endif else ifeq ($(UNAME_S),Darwin) PLATFORM=darwin + WEB_GO=CGO_ENABLED=1 go ifeq ($(UNAME_M),x86_64) ARCH=amd64 else ifeq ($(UNAME_M),arm64) @@ -119,7 +121,7 @@ build-launcher: echo "Building frontend..."; \ cd web/frontend && pnpm install && pnpm build:backend; \ fi - @$(GO) build $(GOFLAGS) -o $(BUILD_DIR)/picoclaw-launcher-$(PLATFORM)-$(ARCH) ./web/backend + @$(WEB_GO) build $(GOFLAGS) -o $(BUILD_DIR)/picoclaw-launcher-$(PLATFORM)-$(ARCH) ./web/backend @ln -sf picoclaw-launcher-$(PLATFORM)-$(ARCH) $(BUILD_DIR)/picoclaw-launcher @echo "Build complete: $(BUILD_DIR)/picoclaw-launcher" @@ -219,7 +221,9 @@ clean: ## vet: Run go vet for static analysis vet: generate - @$(GO) vet ./... + @packages="$$(go list ./...)" && \ + $(GO) vet $$(printf '%s\n' "$$packages" | grep -v '^github.com/sipeed/picoclaw/web/') + @cd web/backend && $(WEB_GO) vet ./... ## test: Test Go code test: generate diff --git a/web/Makefile b/web/Makefile index 653dd77e1..5943924f2 100644 --- a/web/Makefile +++ b/web/Makefile @@ -1,17 +1,18 @@ .PHONY: dev dev-frontend dev-backend build test lint clean +# Go variables +GO?=CGO_ENABLED=0 go +WEB_GO?=$(GO) +GOFLAGS?=-v -tags stdjson + # Version VERSION?=$(shell git describe --tags --always --dirty 2>/dev/null || echo "dev") GIT_COMMIT=$(shell git rev-parse --short=8 HEAD 2>/dev/null || echo "dev") BUILD_TIME=$(shell date +%FT%T%z) -GO_VERSION=$(shell $(GO) version | awk '{print $$3}') +GO_VERSION=$(shell $(WEB_GO) version | awk '{print $$3}') CONFIG_PKG=github.com/sipeed/picoclaw/pkg/config LDFLAGS=-X $(CONFIG_PKG).Version=$(VERSION) -X $(CONFIG_PKG).GitCommit=$(GIT_COMMIT) -X $(CONFIG_PKG).BuildTime=$(BUILD_TIME) -X $(CONFIG_PKG).GoVersion=$(GO_VERSION) -s -w -# Go variables -GO?=CGO_ENABLED=0 go -GOFLAGS?=-v -tags stdjson - # OS detection UNAME_S:=$(shell uname -s) @@ -37,7 +38,7 @@ ifeq ($(UNAME_S),Linux) endif else ifeq ($(UNAME_S),Darwin) PLATFORM=darwin - GO=CGO_ENABLED=1 go + WEB_GO=CGO_ENABLED=1 go ifeq ($(UNAME_M),x86_64) ARCH=amd64 else ifeq ($(UNAME_M),arm64) @@ -69,21 +70,21 @@ dev-frontend: # Start backend dev server dev-backend: - cd backend && ${GO} run -ldflags "$(LDFLAGS)" . + cd backend && ${WEB_GO} run -ldflags "$(LDFLAGS)" . # Build frontend and embed into Go binary build: cd frontend && pnpm build:backend - cd backend && ${GO} build $(GOFLAGS) -ldflags "$(LDFLAGS)" -o picoclaw-web . + cd backend && ${WEB_GO} build $(GOFLAGS) -ldflags "$(LDFLAGS)" -o picoclaw-web . # Run all tests test: - cd backend && ${GO} test ./... + cd backend && ${WEB_GO} test ./... cd frontend && pnpm lint # Lint and format lint: - cd backend && ${GO} vet ./... + cd backend && ${WEB_GO} vet ./... cd frontend && pnpm check # Clean build artifacts diff --git a/web/frontend/package.json b/web/frontend/package.json index 973586519..2e0e37117 100644 --- a/web/frontend/package.json +++ b/web/frontend/package.json @@ -6,7 +6,7 @@ "scripts": { "dev": "vite", "build": "tsc -b && vite build", - "build:backend": "tsc -b && vite build --outDir ../backend/dist --emptyOutDir", + "build:backend": "tsc -b && vite build --outDir ../backend/dist --emptyOutDir && node ./scripts/ensure-backend-gitkeep.cjs", "lint": "eslint .", "preview": "vite preview", "format": "prettier --check .", diff --git a/web/frontend/scripts/ensure-backend-gitkeep.cjs b/web/frontend/scripts/ensure-backend-gitkeep.cjs new file mode 100644 index 000000000..db9782ab4 --- /dev/null +++ b/web/frontend/scripts/ensure-backend-gitkeep.cjs @@ -0,0 +1,9 @@ +const fs = require("node:fs") +const path = require("node:path") + +const gitkeepPath = path.resolve(__dirname, "../../backend/dist/.gitkeep") +const gitkeepContents = + "# Keep the embedded web backend dist directory in version control.\n" + +fs.mkdirSync(path.dirname(gitkeepPath), { recursive: true }) +fs.writeFileSync(gitkeepPath, gitkeepContents) From 11207186c8d99e4286ad8fb8a6e3c7dee0974c05 Mon Sep 17 00:00:00 2001 From: Liu Yuan Date: Tue, 17 Mar 2026 17:36:06 +0800 Subject: [PATCH 056/234] fix: proxy WebSocket through web server port (#1665) - Modify buildWsURL to use web server port (18800) instead of gateway port (18790) - Add WebSocket proxy handler to forward /pico/ws to gateway - Gateway port is read from config (cfg.Gateway.Port), defaults to 18790 - This allows WebSocket connections through the same port as the web UI, avoiding the need to expose extra ports for Tailscale/Docker --- web/backend/api/gateway_host.go | 8 ++++++- web/backend/api/gateway_host_test.go | 16 ++++++------- web/backend/api/pico.go | 35 ++++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 9 deletions(-) diff --git a/web/backend/api/gateway_host.go b/web/backend/api/gateway_host.go index 5ef3ba2c5..8dde29b76 100644 --- a/web/backend/api/gateway_host.go +++ b/web/backend/api/gateway_host.go @@ -80,5 +80,11 @@ func (h *Handler) buildWsURL(r *http.Request, cfg *config.Config) string { if host == "" || host == "0.0.0.0" { host = requestHostName(r) } - return requestWSScheme(r) + "://" + net.JoinHostPort(host, strconv.Itoa(cfg.Gateway.Port)) + "/pico/ws" + // Use web server port instead of gateway port to avoid exposing extra ports + // The WebSocket connection will be proxied by the backend to the gateway + wsPort := h.serverPort + if wsPort == 0 { + wsPort = 18800 // default web server port + } + return requestWSScheme(r) + "://" + net.JoinHostPort(host, strconv.Itoa(wsPort)) + "/pico/ws" } diff --git a/web/backend/api/gateway_host_test.go b/web/backend/api/gateway_host_test.go index 43e84ff0e..3fffeb893 100644 --- a/web/backend/api/gateway_host_test.go +++ b/web/backend/api/gateway_host_test.go @@ -48,8 +48,8 @@ func TestBuildWsURLUsesRequestHostWhenLauncherPublicSaved(t *testing.T) { req := httptest.NewRequest("GET", "http://launcher.local/api/pico/token", nil) req.Host = "192.168.1.9:18800" - if got := h.buildWsURL(req, cfg); got != "ws://192.168.1.9:18790/pico/ws" { - t.Fatalf("buildWsURL() = %q, want %q", got, "ws://192.168.1.9:18790/pico/ws") + if got := h.buildWsURL(req, cfg); got != "ws://192.168.1.9:18800/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "ws://192.168.1.9:18800/pico/ws") } } @@ -71,8 +71,8 @@ func TestBuildWsURLUsesWSSWhenForwardedProtoIsHTTPS(t *testing.T) { req.Host = "chat.example.com" req.Header.Set("X-Forwarded-Proto", "https") - if got := h.buildWsURL(req, cfg); got != "wss://chat.example.com:18790/pico/ws" { - t.Fatalf("buildWsURL() = %q, want %q", got, "wss://chat.example.com:18790/pico/ws") + if got := h.buildWsURL(req, cfg); got != "wss://chat.example.com:18800/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "wss://chat.example.com:18800/pico/ws") } } @@ -88,8 +88,8 @@ func TestBuildWsURLUsesWSSWhenRequestIsTLS(t *testing.T) { req.Host = "secure.example.com" req.TLS = &tls.ConnectionState{} - if got := h.buildWsURL(req, cfg); got != "wss://secure.example.com:18790/pico/ws" { - t.Fatalf("buildWsURL() = %q, want %q", got, "wss://secure.example.com:18790/pico/ws") + if got := h.buildWsURL(req, cfg); got != "wss://secure.example.com:18800/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "wss://secure.example.com:18800/pico/ws") } } @@ -106,7 +106,7 @@ func TestBuildWsURLPrefersForwardedHTTPOverTLS(t *testing.T) { req.TLS = &tls.ConnectionState{} req.Header.Set("X-Forwarded-Proto", "http") - if got := h.buildWsURL(req, cfg); got != "ws://chat.example.com:18790/pico/ws" { - t.Fatalf("buildWsURL() = %q, want %q", got, "ws://chat.example.com:18790/pico/ws") + if got := h.buildWsURL(req, cfg); got != "ws://chat.example.com:18800/pico/ws" { + t.Fatalf("buildWsURL() = %q, want %q", got, "ws://chat.example.com:18800/pico/ws") } } diff --git a/web/backend/api/pico.go b/web/backend/api/pico.go index 2d2201e16..d11f7bc5e 100644 --- a/web/backend/api/pico.go +++ b/web/backend/api/pico.go @@ -6,6 +6,8 @@ import ( "encoding/json" "fmt" "net/http" + "net/http/httputil" + "net/url" "time" "github.com/sipeed/picoclaw/pkg/config" @@ -16,6 +18,39 @@ func (h *Handler) registerPicoRoutes(mux *http.ServeMux) { mux.HandleFunc("GET /api/pico/token", h.handleGetPicoToken) mux.HandleFunc("POST /api/pico/token", h.handleRegenPicoToken) mux.HandleFunc("POST /api/pico/setup", h.handlePicoSetup) + + // WebSocket proxy: forward /pico/ws to gateway + // This allows the frontend to connect via the same port as the web UI, + // avoiding the need to expose extra ports for WebSocket communication. + wsProxy := h.createWsProxy() + mux.HandleFunc("GET /pico/ws", h.handleWebSocketProxy(wsProxy)) +} + +// createWsProxy creates a reverse proxy to the gateway WebSocket endpoint. +// The gateway port is read from the configuration. +func (h *Handler) createWsProxy() *httputil.ReverseProxy { + cfg, err := config.LoadConfig(h.configPath) + gatewayPort := 18790 // default + if err == nil && cfg.Gateway.Port != 0 { + gatewayPort = cfg.Gateway.Port + } + gatewayURL, _ := url.Parse(fmt.Sprintf("http://127.0.0.1:%d", gatewayPort)) + wsProxy := httputil.NewSingleHostReverseProxy(gatewayURL) + wsProxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) { + http.Error(w, "Gateway unavailable: "+err.Error(), http.StatusBadGateway) + } + return wsProxy +} + +// handleWebSocketProxy wraps a reverse proxy to handle WebSocket connections. +// It ensures the Connection and Upgrade headers are properly forwarded. +func (h *Handler) handleWebSocketProxy(proxy *httputil.ReverseProxy) http.HandlerFunc { + return func(w http.ResponseWriter, r *http.Request) { + // Set headers for WebSocket upgrade + r.Header.Set("Connection", "upgrade") + r.Header.Set("Upgrade", "websocket") + proxy.ServeHTTP(w, r) + } } // handleGetPicoToken returns the current WS token and URL for the frontend. From 8a44410e378b8a4e7789e2b3941001f4bddd5ad3 Mon Sep 17 00:00:00 2001 From: wenjie Date: Tue, 17 Mar 2026 18:46:00 +0800 Subject: [PATCH 057/234] feat: add web gateway hot reload and polling state sync (#1684) * feat(gateway): support hot reload and empty startup - extract gateway runtime into pkg/gateway - add gateway.hot_reload config with default and example values - allow starting the gateway without a default model via --allow-empty - stop treating missing enabled channels as a startup error - update related tests * feat: replace gateway SSE updates with polling-based state sync - remove gateway SSE broadcasting and event endpoint - add polling-based gateway status refresh with stopping state handling - detect when gateway restart is required after default model changes - resolve gateway health and websocket proxy targets from configured host - update gateway UI labels and add backend/frontend test coverage --- cmd/picoclaw/internal/gateway/command.go | 12 +- cmd/picoclaw/internal/gateway/command_test.go | 1 + config/config.example.json | 3 +- pkg/channels/manager.go | 1 - pkg/config/config.go | 5 +- pkg/config/config_test.go | 3 + pkg/config/defaults.go | 5 +- .../helpers.go => pkg/gateway/gateway.go | 262 ++++++++---------- web/backend/api/events.go | 80 ------ web/backend/api/gateway.go | 209 ++++---------- web/backend/api/gateway_host.go | 18 ++ web/backend/api/gateway_host_test.go | 76 +++++ web/backend/api/gateway_test.go | 129 +++++++++ web/backend/api/pico.go | 24 +- web/backend/api/pico_test.go | 77 +++++ web/backend/api/router.go | 5 +- web/backend/middleware/middleware.go | 5 +- web/backend/systray.go | 2 +- web/frontend/src/components/app-header.tsx | 34 ++- web/frontend/src/hooks/use-gateway-logs.ts | 4 +- web/frontend/src/hooks/use-gateway.ts | 138 ++------- web/frontend/src/i18n/locales/en.json | 3 +- web/frontend/src/i18n/locales/zh.json | 3 +- web/frontend/src/store/gateway.ts | 144 +++++++++- 24 files changed, 700 insertions(+), 543 deletions(-) rename cmd/picoclaw/internal/gateway/helpers.go => pkg/gateway/gateway.go (61%) delete mode 100644 web/backend/api/events.go diff --git a/cmd/picoclaw/internal/gateway/command.go b/cmd/picoclaw/internal/gateway/command.go index bfa69f072..4812f1bee 100644 --- a/cmd/picoclaw/internal/gateway/command.go +++ b/cmd/picoclaw/internal/gateway/command.go @@ -5,6 +5,8 @@ import ( "github.com/spf13/cobra" + "github.com/sipeed/picoclaw/cmd/picoclaw/internal" + "github.com/sipeed/picoclaw/pkg/gateway" "github.com/sipeed/picoclaw/pkg/logger" "github.com/sipeed/picoclaw/pkg/utils" ) @@ -12,6 +14,7 @@ import ( func NewGatewayCommand() *cobra.Command { var debug bool var noTruncate bool + var allowEmpty bool cmd := &cobra.Command{ Use: "gateway", @@ -31,12 +34,19 @@ func NewGatewayCommand() *cobra.Command { return nil }, RunE: func(_ *cobra.Command, _ []string) error { - return gatewayCmd(debug) + return gateway.Run(debug, internal.GetConfigPath(), allowEmpty) }, } cmd.Flags().BoolVarP(&debug, "debug", "d", false, "Enable debug logging") cmd.Flags().BoolVarP(&noTruncate, "no-truncate", "T", false, "Disable string truncation in debug logs") + cmd.Flags().BoolVarP( + &allowEmpty, + "allow-empty", + "E", + false, + "Continue starting even when no default model is configured", + ) return cmd } diff --git a/cmd/picoclaw/internal/gateway/command_test.go b/cmd/picoclaw/internal/gateway/command_test.go index 4d591ea67..839a7315a 100644 --- a/cmd/picoclaw/internal/gateway/command_test.go +++ b/cmd/picoclaw/internal/gateway/command_test.go @@ -28,4 +28,5 @@ func TestNewGatewayCommand(t *testing.T) { assert.True(t, cmd.HasFlags()) assert.NotNil(t, cmd.Flags().Lookup("debug")) + assert.NotNil(t, cmd.Flags().Lookup("allow-empty")) } diff --git a/config/config.example.json b/config/config.example.json index 1c11cd42a..14e209259 100644 --- a/config/config.example.json +++ b/config/config.example.json @@ -518,6 +518,7 @@ }, "gateway": { "host": "127.0.0.1", - "port": 18790 + "port": 18790, + "hot_reload": false } } diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go index df430e4d3..8121525ab 100644 --- a/pkg/channels/manager.go +++ b/pkg/channels/manager.go @@ -357,7 +357,6 @@ func (m *Manager) StartAll(ctx context.Context) error { if len(m.channels) == 0 { logger.WarnC("channels", "No channels enabled") - return errors.New("no channels enabled") } logger.InfoC("channels", "Starting all channels") diff --git a/pkg/config/config.go b/pkg/config/config.go index 35de48f23..6694ef3a1 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -625,8 +625,9 @@ func (c *ModelConfig) Validate() error { } type GatewayConfig struct { - Host string `json:"host" env:"PICOCLAW_GATEWAY_HOST"` - Port int `json:"port" env:"PICOCLAW_GATEWAY_PORT"` + Host string `json:"host" env:"PICOCLAW_GATEWAY_HOST"` + Port int `json:"port" env:"PICOCLAW_GATEWAY_PORT"` + HotReload bool `json:"hot_reload" env:"PICOCLAW_GATEWAY_HOT_RELOAD"` } type ToolDiscoveryConfig struct { diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go index fc835f78f..f4f8979e1 100644 --- a/pkg/config/config_test.go +++ b/pkg/config/config_test.go @@ -267,6 +267,9 @@ func TestDefaultConfig_Gateway(t *testing.T) { if cfg.Gateway.Port == 0 { t.Error("Gateway port should have default value") } + if cfg.Gateway.HotReload { + t.Error("Gateway hot reload should be disabled by default") + } } // TestDefaultConfig_Providers verifies provider structure diff --git a/pkg/config/defaults.go b/pkg/config/defaults.go index 2b177d5de..90a99408e 100644 --- a/pkg/config/defaults.go +++ b/pkg/config/defaults.go @@ -395,8 +395,9 @@ func DefaultConfig() *Config { }, }, Gateway: GatewayConfig{ - Host: "127.0.0.1", - Port: 18790, + Host: "127.0.0.1", + Port: 18790, + HotReload: false, }, Tools: ToolsConfig{ MediaCleanup: MediaCleanupConfig{ diff --git a/cmd/picoclaw/internal/gateway/helpers.go b/pkg/gateway/gateway.go similarity index 61% rename from cmd/picoclaw/internal/gateway/helpers.go rename to pkg/gateway/gateway.go index 85e93bcf9..6745d1748 100644 --- a/cmd/picoclaw/internal/gateway/helpers.go +++ b/pkg/gateway/gateway.go @@ -10,7 +10,6 @@ import ( "syscall" "time" - "github.com/sipeed/picoclaw/cmd/picoclaw/internal" "github.com/sipeed/picoclaw/pkg/agent" "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/channels" @@ -42,15 +41,13 @@ import ( "github.com/sipeed/picoclaw/pkg/voice" ) -// Timeout constants for service operations const ( serviceShutdownTimeout = 30 * time.Second providerReloadTimeout = 30 * time.Second gracefulShutdownTimeout = 15 * time.Second ) -// gatewayServices holds references to all running services -type gatewayServices struct { +type services struct { CronService *cron.CronService HeartbeatService *heartbeat.HeartbeatService MediaStore media.MediaStore @@ -59,24 +56,41 @@ type gatewayServices struct { HealthServer *health.Server } -func gatewayCmd(debug bool) error { +type startupBlockedProvider struct { + reason string +} + +func (p *startupBlockedProvider) Chat( + _ context.Context, + _ []providers.Message, + _ []providers.ToolDefinition, + _ string, + _ map[string]any, +) (*providers.LLMResponse, error) { + return nil, fmt.Errorf("%s", p.reason) +} + +func (p *startupBlockedProvider) GetDefaultModel() string { + return "" +} + +// Run starts the gateway runtime using the configuration loaded from configPath. +func Run(debug bool, configPath string, allowEmptyStartup bool) error { if debug { logger.SetLevel(logger.DEBUG) fmt.Println("🔍 Debug mode enabled") } - configPath := internal.GetConfigPath() - cfg, err := internal.LoadConfig() + cfg, err := config.LoadConfig(configPath) if err != nil { return fmt.Errorf("error loading config: %w", err) } - provider, modelID, err := providers.CreateProvider(cfg) + provider, modelID, err := createStartupProvider(cfg, allowEmptyStartup) if err != nil { return fmt.Errorf("error creating provider: %w", err) } - // Use the resolved model ID from provider creation if modelID != "" { cfg.Agents.Defaults.ModelName = modelID } @@ -84,17 +98,13 @@ func gatewayCmd(debug bool) error { msgBus := bus.NewMessageBus() agentLoop := agent.NewAgentLoop(cfg, msgBus, provider) - // Print agent startup info fmt.Println("\n📦 Agent Status:") startupInfo := agentLoop.GetStartupInfo() toolsInfo := startupInfo["tools"].(map[string]any) skillsInfo := startupInfo["skills"].(map[string]any) fmt.Printf(" • Tools: %d loaded\n", toolsInfo["count"]) - fmt.Printf(" • Skills: %d/%d available\n", - skillsInfo["available"], - skillsInfo["total"]) + fmt.Printf(" • Skills: %d/%d available\n", skillsInfo["available"], skillsInfo["total"]) - // Log to file as well logger.InfoCF("agent", "Agent initialized", map[string]any{ "tools_count": toolsInfo["count"], @@ -102,8 +112,7 @@ func gatewayCmd(debug bool) error { "skills_available": skillsInfo["available"], }) - // Setup and start all services - services, err := setupAndStartServices(cfg, agentLoop, msgBus) + runningServices, err := setupAndStartServices(cfg, agentLoop, msgBus) if err != nil { return err } @@ -116,23 +125,25 @@ func gatewayCmd(debug bool) error { go agentLoop.Run(ctx) - // Setup config file watcher for hot reload - configReloadChan, stopWatch := setupConfigWatcherPolling(configPath, debug) + var configReloadChan <-chan *config.Config + stopWatch := func() {} + if cfg.Gateway.HotReload { + configReloadChan, stopWatch = setupConfigWatcherPolling(configPath, debug) + logger.Info("Config hot reload enabled") + } defer stopWatch() sigChan := make(chan os.Signal, 1) signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM) - // Main event loop - wait for signals or config changes for { select { case <-sigChan: logger.Info("Shutting down...") - shutdownGateway(services, agentLoop, provider, true) + shutdownGateway(runningServices, agentLoop, provider, true) return nil - case newCfg := <-configReloadChan: - err := handleConfigReload(ctx, agentLoop, newCfg, &provider, services, msgBus) + err := handleConfigReload(ctx, agentLoop, newCfg, &provider, runningServices, msgBus, allowEmptyStartup) if err != nil { logger.Errorf("Config reload failed: %v", err) } @@ -140,18 +151,33 @@ func gatewayCmd(debug bool) error { } } -// setupAndStartServices initializes and starts all services +func createStartupProvider( + cfg *config.Config, + allowEmptyStartup bool, +) (providers.LLMProvider, string, error) { + modelName := cfg.Agents.Defaults.GetModelName() + if modelName == "" && allowEmptyStartup { + reason := "no default model configured; gateway started in limited mode" + fmt.Printf("⚠ Warning: %s\n", reason) + logger.WarnCF("gateway", "Gateway started without default model", map[string]any{ + "limited_mode": true, + }) + return &startupBlockedProvider{reason: reason}, "", nil + } + + return providers.CreateProvider(cfg) +} + func setupAndStartServices( cfg *config.Config, agentLoop *agent.AgentLoop, msgBus *bus.MessageBus, -) (*gatewayServices, error) { - services := &gatewayServices{} +) (*services, error) { + runningServices := &services{} - // Setup cron tool and service execTimeout := time.Duration(cfg.Tools.Cron.ExecTimeoutMinutes) * time.Minute var err error - services.CronService, err = setupCronTool( + runningServices.CronService, err = setupCronTool( agentLoop, msgBus, cfg.WorkspacePath(), @@ -162,120 +188,105 @@ func setupAndStartServices( if err != nil { return nil, fmt.Errorf("error setting up cron service: %w", err) } - if err = services.CronService.Start(); err != nil { + if err = runningServices.CronService.Start(); err != nil { return nil, fmt.Errorf("error starting cron service: %w", err) } fmt.Println("✓ Cron service started") - // Setup heartbeat service - services.HeartbeatService = heartbeat.NewHeartbeatService( + runningServices.HeartbeatService = heartbeat.NewHeartbeatService( cfg.WorkspacePath(), cfg.Heartbeat.Interval, cfg.Heartbeat.Enabled, ) - services.HeartbeatService.SetBus(msgBus) - services.HeartbeatService.SetHandler(createHeartbeatHandler(agentLoop)) - if err = services.HeartbeatService.Start(); err != nil { + runningServices.HeartbeatService.SetBus(msgBus) + runningServices.HeartbeatService.SetHandler(createHeartbeatHandler(agentLoop)) + if err = runningServices.HeartbeatService.Start(); err != nil { return nil, fmt.Errorf("error starting heartbeat service: %w", err) } fmt.Println("✓ Heartbeat service started") - // Create media store for file lifecycle management with TTL cleanup - services.MediaStore = media.NewFileMediaStoreWithCleanup(media.MediaCleanerConfig{ + runningServices.MediaStore = media.NewFileMediaStoreWithCleanup(media.MediaCleanerConfig{ Enabled: cfg.Tools.MediaCleanup.Enabled, MaxAge: time.Duration(cfg.Tools.MediaCleanup.MaxAge) * time.Minute, Interval: time.Duration(cfg.Tools.MediaCleanup.Interval) * time.Minute, }) - // Start the media store if it's a FileMediaStore with cleanup - if fms, ok := services.MediaStore.(*media.FileMediaStore); ok { + if fms, ok := runningServices.MediaStore.(*media.FileMediaStore); ok { fms.Start() } - // Create channel manager - services.ChannelManager, err = channels.NewManager(cfg, msgBus, services.MediaStore) + runningServices.ChannelManager, err = channels.NewManager(cfg, msgBus, runningServices.MediaStore) if err != nil { - // Stop the media store if it's a FileMediaStore with cleanup - if fms, ok := services.MediaStore.(*media.FileMediaStore); ok { + if fms, ok := runningServices.MediaStore.(*media.FileMediaStore); ok { fms.Stop() } return nil, fmt.Errorf("error creating channel manager: %w", err) } - // Inject channel manager and media store into agent loop - agentLoop.SetChannelManager(services.ChannelManager) - agentLoop.SetMediaStore(services.MediaStore) + agentLoop.SetChannelManager(runningServices.ChannelManager) + agentLoop.SetMediaStore(runningServices.MediaStore) - // Wire up voice transcription if a supported provider is configured. if transcriber := voice.DetectTranscriber(cfg); transcriber != nil { agentLoop.SetTranscriber(transcriber) logger.InfoCF("voice", "Transcription enabled (agent-level)", map[string]any{"provider": transcriber.Name()}) } - enabledChannels := services.ChannelManager.GetEnabledChannels() + enabledChannels := runningServices.ChannelManager.GetEnabledChannels() if len(enabledChannels) > 0 { fmt.Printf("✓ Channels enabled: %s\n", enabledChannels) } else { fmt.Println("⚠ Warning: No channels enabled") } - // Setup shared HTTP server with health endpoints and webhook handlers addr := fmt.Sprintf("%s:%d", cfg.Gateway.Host, cfg.Gateway.Port) - services.HealthServer = health.NewServer(cfg.Gateway.Host, cfg.Gateway.Port) - services.ChannelManager.SetupHTTPServer(addr, services.HealthServer) + runningServices.HealthServer = health.NewServer(cfg.Gateway.Host, cfg.Gateway.Port) + runningServices.ChannelManager.SetupHTTPServer(addr, runningServices.HealthServer) - if err = services.ChannelManager.StartAll(context.Background()); err != nil { + if err = runningServices.ChannelManager.StartAll(context.Background()); err != nil { return nil, fmt.Errorf("error starting channels: %w", err) } fmt.Printf("✓ Health endpoints available at http://%s:%d/health and /ready\n", cfg.Gateway.Host, cfg.Gateway.Port) - // Setup state manager and device service stateManager := state.NewManager(cfg.WorkspacePath()) - services.DeviceService = devices.NewService(devices.Config{ + runningServices.DeviceService = devices.NewService(devices.Config{ Enabled: cfg.Devices.Enabled, MonitorUSB: cfg.Devices.MonitorUSB, }, stateManager) - services.DeviceService.SetBus(msgBus) - if err = services.DeviceService.Start(context.Background()); err != nil { + runningServices.DeviceService.SetBus(msgBus) + if err = runningServices.DeviceService.Start(context.Background()); err != nil { logger.ErrorCF("device", "Error starting device service", map[string]any{"error": err.Error()}) } else if cfg.Devices.Enabled { fmt.Println("✓ Device event service started") } - return services, nil + return runningServices, nil } -// stopAndCleanupServices stops all services and cleans up resources -func stopAndCleanupServices( - services *gatewayServices, - shutdownTimeout time.Duration, -) { +func stopAndCleanupServices(runningServices *services, shutdownTimeout time.Duration) { shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), shutdownTimeout) defer shutdownCancel() - if services.ChannelManager != nil { - services.ChannelManager.StopAll(shutdownCtx) + if runningServices.ChannelManager != nil { + runningServices.ChannelManager.StopAll(shutdownCtx) } - if services.DeviceService != nil { - services.DeviceService.Stop() + if runningServices.DeviceService != nil { + runningServices.DeviceService.Stop() } - if services.HeartbeatService != nil { - services.HeartbeatService.Stop() + if runningServices.HeartbeatService != nil { + runningServices.HeartbeatService.Stop() } - if services.CronService != nil { - services.CronService.Stop() + if runningServices.CronService != nil { + runningServices.CronService.Stop() } - if services.MediaStore != nil { - // Stop the media store if it's a FileMediaStore with cleanup - if fms, ok := services.MediaStore.(*media.FileMediaStore); ok { + if runningServices.MediaStore != nil { + if fms, ok := runningServices.MediaStore.(*media.FileMediaStore); ok { fms.Stop() } } } -// shutdownGateway performs a complete gateway shutdown func shutdownGateway( - services *gatewayServices, + runningServices *services, agentLoop *agent.AgentLoop, provider providers.LLMProvider, fullShutdown bool, @@ -284,7 +295,7 @@ func shutdownGateway( cp.Close() } - stopAndCleanupServices(services, gracefulShutdownTimeout) + stopAndCleanupServices(runningServices, gracefulShutdownTimeout) agentLoop.Stop() agentLoop.Close() @@ -292,15 +303,14 @@ func shutdownGateway( logger.Info("✓ Gateway stopped") } -// handleConfigReload handles config file reload by stopping all services, -// reloading the provider and config, and restarting services with the new config. func handleConfigReload( ctx context.Context, al *agent.AgentLoop, newCfg *config.Config, providerRef *providers.LLMProvider, - services *gatewayServices, + runningServices *services, msgBus *bus.MessageBus, + allowEmptyStartup bool, ) error { logger.Info("🔄 Config file changed, reloading...") @@ -311,18 +321,14 @@ func handleConfigReload( logger.Infof(" New model is '%s', recreating provider...", newModel) - // Stop all services before reloading logger.Info(" Stopping all services...") - stopAndCleanupServices(services, serviceShutdownTimeout) + stopAndCleanupServices(runningServices, serviceShutdownTimeout) - // Create new provider from updated config first to ensure validity - // This will use the correct API key and settings from newCfg.ModelList - newProvider, newModelID, err := providers.CreateProvider(newCfg) + newProvider, newModelID, err := createStartupProvider(newCfg, allowEmptyStartup) if err != nil { logger.Errorf(" ⚠ Error creating new provider: %v", err) logger.Warn(" Attempting to restart services with old provider and config...") - // Try to restart services with old configuration - if restartErr := restartServices(al, services, msgBus); restartErr != nil { + if restartErr := restartServices(al, runningServices, msgBus); restartErr != nil { logger.Errorf(" ⚠ Failed to restart services: %v", restartErr) } return fmt.Errorf("error creating new provider: %w", err) @@ -332,31 +338,25 @@ func handleConfigReload( newCfg.Agents.Defaults.ModelName = newModelID } - // Use the atomic reload method on AgentLoop to safely swap provider and config. - // This handles locking internally to prevent races with in-flight LLM calls - // and concurrent reads of registry/config while the swap occurs. reloadCtx, reloadCancel := context.WithTimeout(context.Background(), providerReloadTimeout) defer reloadCancel() if err := al.ReloadProviderAndConfig(reloadCtx, newProvider, newCfg); err != nil { logger.Errorf(" ⚠ Error reloading agent loop: %v", err) - // Close the newly created provider since it wasn't adopted if cp, ok := newProvider.(providers.StatefulProvider); ok { cp.Close() } logger.Warn(" Attempting to restart services with old provider and config...") - if restartErr := restartServices(al, services, msgBus); restartErr != nil { + if restartErr := restartServices(al, runningServices, msgBus); restartErr != nil { logger.Errorf(" ⚠ Failed to restart services: %v", restartErr) } return fmt.Errorf("error reloading agent loop: %w", err) } - // Update local provider reference only after successful atomic reload *providerRef = newProvider - // Restart all services with new config logger.Info(" Restarting all services with new configuration...") - if err := restartServices(al, services, msgBus); err != nil { + if err := restartServices(al, runningServices, msgBus); err != nil { logger.Errorf(" ⚠ Error restarting services: %v", err) return fmt.Errorf("error restarting services: %w", err) } @@ -365,19 +365,16 @@ func handleConfigReload( return nil } -// restartServices restarts all services after a config reload func restartServices( al *agent.AgentLoop, - services *gatewayServices, + runningServices *services, msgBus *bus.MessageBus, ) error { - // Get current config from agent loop (which has been updated if this is a reload) cfg := al.GetConfig() - // Re-create and start cron service with new config execTimeout := time.Duration(cfg.Tools.Cron.ExecTimeoutMinutes) * time.Minute var err error - services.CronService, err = setupCronTool( + runningServices.CronService, err = setupCronTool( al, msgBus, cfg.WorkspacePath(), @@ -388,57 +385,51 @@ func restartServices( if err != nil { return fmt.Errorf("error restarting cron service: %w", err) } - if err = services.CronService.Start(); err != nil { + if err = runningServices.CronService.Start(); err != nil { return fmt.Errorf("error restarting cron service: %w", err) } fmt.Println(" ✓ Cron service restarted") - // Re-create and start heartbeat service with new config - services.HeartbeatService = heartbeat.NewHeartbeatService( + runningServices.HeartbeatService = heartbeat.NewHeartbeatService( cfg.WorkspacePath(), cfg.Heartbeat.Interval, cfg.Heartbeat.Enabled, ) - services.HeartbeatService.SetBus(msgBus) - services.HeartbeatService.SetHandler(createHeartbeatHandler(al)) - if err = services.HeartbeatService.Start(); err != nil { + runningServices.HeartbeatService.SetBus(msgBus) + runningServices.HeartbeatService.SetHandler(createHeartbeatHandler(al)) + if err = runningServices.HeartbeatService.Start(); err != nil { return fmt.Errorf("error restarting heartbeat service: %w", err) } fmt.Println(" ✓ Heartbeat service restarted") - // Re-create media store with new config - services.MediaStore = media.NewFileMediaStoreWithCleanup(media.MediaCleanerConfig{ + runningServices.MediaStore = media.NewFileMediaStoreWithCleanup(media.MediaCleanerConfig{ Enabled: cfg.Tools.MediaCleanup.Enabled, MaxAge: time.Duration(cfg.Tools.MediaCleanup.MaxAge) * time.Minute, Interval: time.Duration(cfg.Tools.MediaCleanup.Interval) * time.Minute, }) - // Start the media store if it's a FileMediaStore with cleanup - if fms, ok := services.MediaStore.(*media.FileMediaStore); ok { + if fms, ok := runningServices.MediaStore.(*media.FileMediaStore); ok { fms.Start() } - al.SetMediaStore(services.MediaStore) + al.SetMediaStore(runningServices.MediaStore) - // Re-create channel manager with new config - services.ChannelManager, err = channels.NewManager(cfg, msgBus, services.MediaStore) + runningServices.ChannelManager, err = channels.NewManager(cfg, msgBus, runningServices.MediaStore) if err != nil { return fmt.Errorf("error recreating channel manager: %w", err) } - al.SetChannelManager(services.ChannelManager) + al.SetChannelManager(runningServices.ChannelManager) - enabledChannels := services.ChannelManager.GetEnabledChannels() + enabledChannels := runningServices.ChannelManager.GetEnabledChannels() if len(enabledChannels) > 0 { fmt.Printf(" ✓ Channels enabled: %s\n", enabledChannels) } else { fmt.Println(" ⚠ Warning: No channels enabled") } - // Setup HTTP server with new config addr := fmt.Sprintf("%s:%d", cfg.Gateway.Host, cfg.Gateway.Port) - services.HealthServer = health.NewServer(cfg.Gateway.Host, cfg.Gateway.Port) - services.ChannelManager.SetupHTTPServer(addr, services.HealthServer) + runningServices.HealthServer = health.NewServer(cfg.Gateway.Host, cfg.Gateway.Port) + runningServices.ChannelManager.SetupHTTPServer(addr, runningServices.HealthServer) - // Use background context for lifecycle to ensure services persist after restartServices returns - if err = services.ChannelManager.StartAll(context.Background()); err != nil { + if err = runningServices.ChannelManager.StartAll(context.Background()); err != nil { return fmt.Errorf("error restarting channels: %w", err) } fmt.Printf( @@ -447,22 +438,20 @@ func restartServices( cfg.Gateway.Port, ) - // Re-create device service with new config stateManager := state.NewManager(cfg.WorkspacePath()) - services.DeviceService = devices.NewService(devices.Config{ + runningServices.DeviceService = devices.NewService(devices.Config{ Enabled: cfg.Devices.Enabled, MonitorUSB: cfg.Devices.MonitorUSB, }, stateManager) - services.DeviceService.SetBus(msgBus) - if err := services.DeviceService.Start(context.Background()); err != nil { + runningServices.DeviceService.SetBus(msgBus) + if err := runningServices.DeviceService.Start(context.Background()); err != nil { logger.WarnCF("device", "Failed to restart device service", map[string]any{"error": err.Error()}) } else if cfg.Devices.Enabled { fmt.Println(" ✓ Device event service restarted") } - // Wire up voice transcription with new config transcriber := voice.DetectTranscriber(cfg) - al.SetTranscriber(transcriber) // This will set it to nil if disabled + al.SetTranscriber(transcriber) if transcriber != nil { logger.InfoCF("voice", "Transcription re-enabled (agent-level)", map[string]any{"provider": transcriber.Name()}) } else { @@ -472,8 +461,6 @@ func restartServices( return nil } -// setupConfigWatcherPolling sets up a simple polling-based config file watcher -// Returns a channel for config updates and a stop function func setupConfigWatcherPolling(configPath string, debug bool) (chan *config.Config, func()) { configChan := make(chan *config.Config, 1) stop := make(chan struct{}) @@ -483,11 +470,10 @@ func setupConfigWatcherPolling(configPath string, debug bool) (chan *config.Conf go func() { defer wg.Done() - // Get initial file info lastModTime := getFileModTime(configPath) lastSize := getFileSize(configPath) - ticker := time.NewTicker(2 * time.Second) // Check every 2 seconds + ticker := time.NewTicker(2 * time.Second) defer ticker.Stop() for { @@ -496,20 +482,16 @@ func setupConfigWatcherPolling(configPath string, debug bool) (chan *config.Conf currentModTime := getFileModTime(configPath) currentSize := getFileSize(configPath) - // Check if file changed (modification time or size changed) if currentModTime.After(lastModTime) || currentSize != lastSize { if debug { logger.Debugf("🔍 Config file change detected") } - // Debounce - wait a bit to ensure file write is complete time.Sleep(500 * time.Millisecond) - // Update last known state to prevent repeated reload attempts on failure lastModTime = currentModTime lastSize = currentSize - // Validate and load new config newCfg, err := config.LoadConfig(configPath) if err != nil { logger.Errorf("⚠ Error loading new config: %v", err) @@ -517,7 +499,6 @@ func setupConfigWatcherPolling(configPath string, debug bool) (chan *config.Conf continue } - // Validate the new config if err := newCfg.ValidateModelList(); err != nil { logger.Errorf(" ⚠ New config validation failed: %v", err) logger.Warn(" Using previous valid config") @@ -526,15 +507,12 @@ func setupConfigWatcherPolling(configPath string, debug bool) (chan *config.Conf logger.Info("✓ Config file validated and loaded") - // Send new config to main loop (non-blocking) select { case configChan <- newCfg: default: - // Channel full, skip this update logger.Warn("⚠ Previous config reload still in progress, skipping") } } - case <-stop: return } @@ -549,7 +527,6 @@ func setupConfigWatcherPolling(configPath string, debug bool) (chan *config.Conf return configChan, stopFunc } -// getFileModTime returns the modification time of a file, or zero time if file doesn't exist func getFileModTime(path string) time.Time { info, err := os.Stat(path) if err != nil { @@ -558,7 +535,6 @@ func getFileModTime(path string) time.Time { return info.ModTime() } -// getFileSize returns the size of a file, or 0 if file doesn't exist func getFileSize(path string) int64 { info, err := os.Stat(path) if err != nil { @@ -577,10 +553,8 @@ func setupCronTool( ) (*cron.CronService, error) { cronStorePath := filepath.Join(workspace, "cron", "jobs.json") - // Create cron service cronService := cron.NewCronService(cronStorePath, nil) - // Create and register CronTool if enabled var cronTool *tools.CronTool if cfg.Tools.IsToolEnabled("cron") { var err error @@ -592,7 +566,6 @@ func setupCronTool( agentLoop.RegisterTool(cronTool) } - // Set onJob handler if cronTool != nil { cronService.SetOnJob(func(job *cron.CronJob) (string, error) { result := cronTool.ExecuteJob(context.Background(), job) @@ -605,22 +578,17 @@ func setupCronTool( func createHeartbeatHandler(agentLoop *agent.AgentLoop) func(prompt, channel, chatID string) *tools.ToolResult { return func(prompt, channel, chatID string) *tools.ToolResult { - // Use cli:direct as fallback if no valid channel if channel == "" || chatID == "" { channel, chatID = "cli", "direct" } - // Use ProcessHeartbeat - no session history, each heartbeat is independent - var response string - var err error - response, err = agentLoop.ProcessHeartbeat(context.Background(), prompt, channel, chatID) + + response, err := agentLoop.ProcessHeartbeat(context.Background(), prompt, channel, chatID) if err != nil { return tools.ErrorResult(fmt.Sprintf("Heartbeat error: %v", err)) } if response == "HEARTBEAT_OK" { return tools.SilentResult("Heartbeat OK") } - // For heartbeat, always return silent - the subagent result will be - // sent to user via processSystemMessage when the async task completes return tools.SilentResult(response) } } diff --git a/web/backend/api/events.go b/web/backend/api/events.go deleted file mode 100644 index 5c85b149a..000000000 --- a/web/backend/api/events.go +++ /dev/null @@ -1,80 +0,0 @@ -package api - -import ( - "encoding/json" - "sync" -) - -// GatewayEvent represents a state change event for the gateway process. -type GatewayEvent struct { - Status string `json:"gateway_status"` // "running", "starting", "restarting", "stopped", "error" - PID int `json:"pid,omitempty"` - BootDefaultModel string `json:"boot_default_model,omitempty"` - ConfigDefaultModel string `json:"config_default_model,omitempty"` - RestartRequired bool `json:"gateway_restart_required,omitempty"` -} - -// EventBroadcaster manages SSE client subscriptions and broadcasts events. -type EventBroadcaster struct { - mu sync.RWMutex - clients map[chan string]struct{} -} - -// NewEventBroadcaster creates a new broadcaster. -func NewEventBroadcaster() *EventBroadcaster { - return &EventBroadcaster{ - clients: make(map[chan string]struct{}), - } -} - -// Subscribe adds a new listener channel and returns it. -// The caller must call Unsubscribe when done. -func (b *EventBroadcaster) Subscribe() chan string { - ch := make(chan string, 8) - b.mu.Lock() - b.clients[ch] = struct{}{} - b.mu.Unlock() - return ch -} - -// Unsubscribe removes a listener channel and closes it. -func (b *EventBroadcaster) Unsubscribe(ch chan string) { - b.mu.Lock() - defer b.mu.Unlock() - - // Check if the channel is still registered before closing - if _, exists := b.clients[ch]; exists { - delete(b.clients, ch) - close(ch) - } -} - -// Broadcast sends a GatewayEvent to all connected SSE clients. -func (b *EventBroadcaster) Broadcast(event GatewayEvent) { - data, err := json.Marshal(event) - if err != nil { - return - } - - b.mu.RLock() - defer b.mu.RUnlock() - - for ch := range b.clients { - // Non-blocking send; drop event if client is slow - select { - case ch <- string(data): - default: - } - } -} - -// Shutdown closes all subscriber channels, notifying all SSE clients to disconnect. -// This should be called when the server is shutting down. -func (b *EventBroadcaster) Shutdown() { - // Close all channels to notify listeners - for ch := range b.clients { - b.Unsubscribe(ch) - } - // Clear the map - b.clients = make(map[chan string]struct{}) -} diff --git a/web/backend/api/gateway.go b/web/backend/api/gateway.go index 424b21e96..16b793427 100644 --- a/web/backend/api/gateway.go +++ b/web/backend/api/gateway.go @@ -7,6 +7,7 @@ import ( "fmt" "io" "log" + "net" "net/http" "os" "os/exec" @@ -30,11 +31,9 @@ var gateway = struct { runtimeStatus string startupDeadline time.Time logs *LogBuffer - events *EventBroadcaster }{ runtimeStatus: "stopped", logs: NewLogBuffer(200), - events: NewEventBroadcaster(), } var ( @@ -51,11 +50,19 @@ var gatewayHealthGet = func(url string, timeout time.Duration) (*http.Response, // getGatewayHealth checks the gateway health endpoint and returns the status response // Returns (*health.StatusResponse, statusCode, error). If error is not nil, the other values are not valid. -func getGatewayHealth(port int, timeout time.Duration) (*health.StatusResponse, int, error) { - if port == 0 { - port = 18790 +func (h *Handler) getGatewayHealth(cfg *config.Config, timeout time.Duration) (*health.StatusResponse, int, error) { + port := 18790 + if cfg != nil && cfg.Gateway.Port != 0 { + port = cfg.Gateway.Port } - url := fmt.Sprintf("http://127.0.0.1:%d/health", port) + + probeHost := gatewayProbeHost(h.effectiveGatewayBindHost(cfg)) + url := "http://" + net.JoinHostPort(probeHost, strconv.Itoa(port)) + "/health" + + return getGatewayHealthByURL(url, timeout) +} + +func getGatewayHealthByURL(url string, timeout time.Duration) (*health.StatusResponse, int, error) { resp, err := gatewayHealthGet(url, timeout) if err != nil { return nil, 0, err @@ -73,7 +80,6 @@ func getGatewayHealth(port int, timeout time.Duration) (*health.StatusResponse, // registerGatewayRoutes binds gateway lifecycle endpoints to the ServeMux. func (h *Handler) registerGatewayRoutes(mux *http.ServeMux) { mux.HandleFunc("GET /api/gateway/status", h.handleGatewayStatus) - mux.HandleFunc("GET /api/gateway/events", h.handleGatewayEvents) mux.HandleFunc("GET /api/gateway/logs", h.handleGatewayLogs) mux.HandleFunc("POST /api/gateway/logs/clear", h.handleGatewayClearLogs) mux.HandleFunc("POST /api/gateway/start", h.handleGatewayStart) @@ -87,7 +93,7 @@ func (h *Handler) TryAutoStartGateway() { // Check if gateway is already running via health endpoint cfg, cfgErr := config.LoadConfig(h.configPath) if cfgErr == nil && cfg != nil { - healthResp, statusCode, err := getGatewayHealth(cfg.Gateway.Port, 2*time.Second) + healthResp, statusCode, err := h.getGatewayHealth(cfg, 2*time.Second) if err == nil && statusCode == http.StatusOK { // Gateway is already running, attach to the existing process pid := healthResp.Pid @@ -170,6 +176,16 @@ func lookupModelConfig(cfg *config.Config, modelName string) *config.ModelConfig return modelCfg } +func gatewayRestartRequired(configDefaultModel, bootDefaultModel, gatewayStatus string) bool { + if gatewayStatus != "running" { + return false + } + if strings.TrimSpace(configDefaultModel) == "" || strings.TrimSpace(bootDefaultModel) == "" { + return false + } + return configDefaultModel != bootDefaultModel +} + func isCmdProcessAliveLocked(cmd *exec.Cmd) bool { if cmd == nil || cmd.Process == nil { return false @@ -220,7 +236,7 @@ func attachToGatewayProcessLocked(pid int, cfg *config.Config) error { return nil } -func gatewayStatusOnHealthFailureLocked() string { +func gatewayStatusWithoutHealthLocked() string { if gateway.runtimeStatus == "starting" || gateway.runtimeStatus == "restarting" { if gateway.startupDeadline.IsZero() || time.Now().Before(gateway.startupDeadline) { return gateway.runtimeStatus @@ -233,23 +249,7 @@ func gatewayStatusOnHealthFailureLocked() string { if gateway.runtimeStatus == "error" { return "error" } - return "error" -} - -func currentGatewayStatusLocked(processAlive bool) string { - if !processAlive { - if gateway.runtimeStatus == "restarting" { - if gateway.startupDeadline.IsZero() || time.Now().Before(gateway.startupDeadline) { - return "restarting" - } - return "error" - } - if gateway.runtimeStatus == "error" { - return "error" - } - return "stopped" - } - return gatewayStatusOnHealthFailureLocked() + return "stopped" } func waitForGatewayProcessExit(cmd *exec.Cmd, timeout time.Duration) bool { @@ -319,15 +319,6 @@ func (h *Handler) startGatewayLocked(initialStatus string, existingPid int) (int return 0, err } - // Broadcast the attached state - gateway.events.Broadcast(GatewayEvent{ - Status: initialStatus, - PID: pid, - BootDefaultModel: defaultModelName, - ConfigDefaultModel: defaultModelName, - RestartRequired: false, - }) - return pid, nil } @@ -335,7 +326,7 @@ func (h *Handler) startGatewayLocked(initialStatus string, existingPid int) (int // Locate the picoclaw executable execPath := utils.FindPicoclawBinary() - cmd = exec.Command(execPath, "gateway") + cmd = exec.Command(execPath, "gateway", "-E") cmd.Env = os.Environ() // Forward the launcher's config path via the environment variable that // GetConfigPath() already reads, so the gateway sub-process uses the same @@ -376,15 +367,6 @@ func (h *Handler) startGatewayLocked(initialStatus string, existingPid int) (int pid = cmd.Process.Pid log.Printf("Started picoclaw gateway (PID: %d) from %s", pid, execPath) - // Broadcast the launch state immediately so clients can reflect it without polling. - gateway.events.Broadcast(GatewayEvent{ - Status: initialStatus, - PID: pid, - BootDefaultModel: defaultModelName, - ConfigDefaultModel: defaultModelName, - RestartRequired: false, - }) - // Capture stdout/stderr in background go scanPipe(stdoutPipe, gateway.logs) go scanPipe(stderrPipe, gateway.logs) @@ -398,26 +380,17 @@ func (h *Handler) startGatewayLocked(initialStatus string, existingPid int) (int } gateway.mu.Lock() - shouldBroadcastStopped := false if gateway.cmd == cmd { gateway.cmd = nil gateway.bootDefaultModel = "" if gateway.runtimeStatus != "restarting" { setGatewayRuntimeStatusLocked("stopped") - shouldBroadcastStopped = true } } gateway.mu.Unlock() - - if shouldBroadcastStopped { - gateway.events.Broadcast(GatewayEvent{ - Status: "stopped", - RestartRequired: false, - }) - } }() - // Start a goroutine to probe health and broadcast "running" once ready + // Start a goroutine to probe health and update the runtime state once ready. go func() { for i := 0; i < 30; i++ { // try for up to 15 seconds time.Sleep(500 * time.Millisecond) @@ -431,7 +404,7 @@ func (h *Handler) startGatewayLocked(initialStatus string, existingPid int) (int if err != nil { continue } - healthResp, statusCode, err := getGatewayHealth(cfg.Gateway.Port, 1*time.Second) + healthResp, statusCode, err := h.getGatewayHealth(cfg, 1*time.Second) if err == nil && statusCode == http.StatusOK && healthResp.Pid == pid { // Verify the health endpoint returns the expected pid gateway.mu.Lock() @@ -439,13 +412,6 @@ func (h *Handler) startGatewayLocked(initialStatus string, existingPid int) (int setGatewayRuntimeStatusLocked("running") } gateway.mu.Unlock() - gateway.events.Broadcast(GatewayEvent{ - Status: "running", - PID: pid, - BootDefaultModel: defaultModelName, - ConfigDefaultModel: defaultModelName, - RestartRequired: false, - }) return } } @@ -461,7 +427,7 @@ func (h *Handler) handleGatewayStart(w http.ResponseWriter, r *http.Request) { // Prevent duplicate starts by checking health endpoint cfg, cfgErr := config.LoadConfig(h.configPath) if cfgErr == nil && cfg != nil { - healthResp, statusCode, err := getGatewayHealth(cfg.Gateway.Port, 2*time.Second) + healthResp, statusCode, err := h.getGatewayHealth(cfg, 2*time.Second) if err == nil && statusCode == http.StatusOK { // Gateway is already running, attach to the existing process pid := healthResp.Pid @@ -597,10 +563,6 @@ func (h *Handler) RestartGateway() (int, error) { gateway.mu.Lock() previousCmd := gateway.cmd setGatewayRuntimeStatusLocked("restarting") - gateway.events.Broadcast(GatewayEvent{ - Status: "restarting", - RestartRequired: false, - }) gateway.mu.Unlock() if err = stopGatewayProcessForRestart(previousCmd); err != nil { @@ -704,24 +666,20 @@ func (h *Handler) handleGatewayStatus(w http.ResponseWriter, r *http.Request) { func (h *Handler) gatewayStatusData() map[string]any { data := map[string]any{} + configDefaultModel := "" cfg, cfgErr := config.LoadConfig(h.configPath) if cfgErr == nil && cfg != nil { - configDefaultModel := strings.TrimSpace(cfg.Agents.Defaults.GetModelName()) + configDefaultModel = strings.TrimSpace(cfg.Agents.Defaults.GetModelName()) if configDefaultModel != "" { data["config_default_model"] = configDefaultModel } } // Probe health endpoint to get pid and status - port := 0 - if cfgErr == nil && cfg != nil { - port = cfg.Gateway.Port - } - - healthResp, statusCode, err := getGatewayHealth(port, 2*time.Second) + healthResp, statusCode, err := h.getGatewayHealth(cfg, 2*time.Second) if err != nil { gateway.mu.Lock() - data["gateway_status"] = currentGatewayStatusLocked(true) + data["gateway_status"] = gatewayStatusWithoutHealthLocked() gateway.mu.Unlock() log.Printf("Gateway health check failed: %v", err) } else { @@ -734,45 +692,43 @@ func (h *Handler) gatewayStatusData() map[string]any { data["status_code"] = statusCode } else { gateway.mu.Lock() - // Check if this pid matches our tracked process - if gateway.cmd != nil && gateway.cmd.Process != nil && gateway.cmd.Process.Pid == healthResp.Pid { - setGatewayRuntimeStatusLocked("running") - bootDefaultModel := gateway.bootDefaultModel - if bootDefaultModel != "" { - data["boot_default_model"] = bootDefaultModel - } - data["gateway_status"] = "running" - data["pid"] = healthResp.Pid - } else { - // Health endpoint responded with a different pid - // This could be a manual restart, try to attach to the new process + setGatewayRuntimeStatusLocked("running") + if gateway.cmd == nil || gateway.cmd.Process == nil || gateway.cmd.Process.Pid != healthResp.Pid { oldPid := "none" if gateway.cmd != nil && gateway.cmd.Process != nil { oldPid = fmt.Sprintf("%d", gateway.cmd.Process.Pid) } - log.Printf("Detected new gateway PID (old: %s, new: %d), attempting to attach", oldPid, healthResp.Pid) - + log.Printf( + "Detected gateway PID from health (old: %s, new: %d), attempting to attach", + oldPid, + healthResp.Pid, + ) if err := attachToGatewayProcessLocked(healthResp.Pid, cfg); err != nil { - // Failed to find the process, treat as error - setGatewayRuntimeStatusLocked("error") - data["gateway_status"] = "error" - data["pid"] = healthResp.Pid - log.Printf("Failed to attach to new gateway process (PID: %d): %v", healthResp.Pid, err) - } else { - // Successfully attached, update response data - bootDefaultModel := gateway.bootDefaultModel - if bootDefaultModel != "" { - data["boot_default_model"] = bootDefaultModel - } - data["gateway_status"] = "running" - data["pid"] = healthResp.Pid + log.Printf( + "Failed to attach to gateway process reported by health (PID: %d): %v", + healthResp.Pid, + err, + ) } } + + bootDefaultModel := gateway.bootDefaultModel + if bootDefaultModel != "" { + data["boot_default_model"] = bootDefaultModel + } + data["gateway_status"] = "running" + data["pid"] = healthResp.Pid gateway.mu.Unlock() } } - data["gateway_restart_required"] = false + bootDefaultModel, _ := data["boot_default_model"].(string) + gatewayStatus, _ := data["gateway_status"].(string) + data["gateway_restart_required"] = gatewayRestartRequired( + configDefaultModel, + bootDefaultModel, + gatewayStatus, + ) ready, reason, readyErr := h.gatewayStartReady() if readyErr != nil { @@ -842,51 +798,6 @@ func gatewayLogsData(r *http.Request) map[string]any { return data } -// handleGatewayEvents serves an SSE stream of gateway state change events. -// -// GET /api/gateway/events -func (h *Handler) handleGatewayEvents(w http.ResponseWriter, r *http.Request) { - flusher, ok := w.(http.Flusher) - if !ok { - http.Error(w, "SSE not supported", http.StatusInternalServerError) - return - } - - w.Header().Set("Content-Type", "text/event-stream") - w.Header().Set("Cache-Control", "no-cache") - w.Header().Set("Connection", "keep-alive") - w.Header().Set("Access-Control-Allow-Origin", "*") - - // Subscribe to gateway events - ch := gateway.events.Subscribe() - defer gateway.events.Unsubscribe(ch) - - // Send initial status so the client doesn't start blank - initial := h.currentGatewayStatus() - fmt.Fprintf(w, "data: %s\n\n", initial) - flusher.Flush() - - for { - select { - case <-r.Context().Done(): - return - case data, ok := <-ch: - if !ok { - return - } - fmt.Fprintf(w, "data: %s\n\n", data) - flusher.Flush() - } - } -} - -// currentGatewayStatus returns the current gateway status as a JSON string. -func (h *Handler) currentGatewayStatus() string { - data := h.gatewayStatusData() - encoded, _ := json.Marshal(data) - return string(encoded) -} - // scanPipe reads lines from r and appends them to buf. Returns when r reaches EOF. func scanPipe(r io.Reader, buf *LogBuffer) { scanner := bufio.NewScanner(r) diff --git a/web/backend/api/gateway_host.go b/web/backend/api/gateway_host.go index 8dde29b76..592571a28 100644 --- a/web/backend/api/gateway_host.go +++ b/web/backend/api/gateway_host.go @@ -3,6 +3,7 @@ package api import ( "net" "net/http" + "net/url" "strconv" "strings" @@ -46,6 +47,23 @@ func gatewayProbeHost(bindHost string) string { return bindHost } +func (h *Handler) gatewayProxyURL() *url.URL { + cfg, err := config.LoadConfig(h.configPath) + port := 18790 + bindHost := "" + if err == nil && cfg != nil { + if cfg.Gateway.Port != 0 { + port = cfg.Gateway.Port + } + bindHost = h.effectiveGatewayBindHost(cfg) + } + + return &url.URL{ + Scheme: "http", + Host: net.JoinHostPort(gatewayProbeHost(bindHost), strconv.Itoa(port)), + } +} + func requestHostName(r *http.Request) string { reqHost, _, err := net.SplitHostPort(r.Host) if err == nil { diff --git a/web/backend/api/gateway_host_test.go b/web/backend/api/gateway_host_test.go index 3fffeb893..ae3434862 100644 --- a/web/backend/api/gateway_host_test.go +++ b/web/backend/api/gateway_host_test.go @@ -2,9 +2,12 @@ package api import ( "crypto/tls" + "errors" + "net/http" "net/http/httptest" "path/filepath" "testing" + "time" "github.com/sipeed/picoclaw/pkg/config" "github.com/sipeed/picoclaw/web/backend/launcherconfig" @@ -59,6 +62,79 @@ func TestGatewayProbeHostUsesLoopbackForWildcardBind(t *testing.T) { } } +func TestGatewayProxyURLUsesConfiguredHost(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "192.168.1.10" + cfg.Gateway.Port = 18791 + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + if got := h.gatewayProxyURL().String(); got != "http://192.168.1.10:18791" { + t.Fatalf("gatewayProxyURL() = %q, want %q", got, "http://192.168.1.10:18791") + } +} + +func TestGetGatewayHealthUsesConfiguredHost(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "192.168.1.10" + cfg.Gateway.Port = 18791 + + originalHealthGet := gatewayHealthGet + t.Cleanup(func() { + gatewayHealthGet = originalHealthGet + }) + + var requestedURL string + gatewayHealthGet = func(url string, timeout time.Duration) (*http.Response, error) { + requestedURL = url + return nil, errors.New("probe failed") + } + + _, statusCode, err := h.getGatewayHealth(cfg, time.Second) + _ = statusCode + _ = err + + if requestedURL != "http://192.168.1.10:18791/health" { + t.Fatalf("health url = %q, want %q", requestedURL, "http://192.168.1.10:18791/health") + } +} + +func TestGetGatewayHealthUsesProbeHostForPublicLauncher(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + h.SetServerOptions(18800, true, true, nil) + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "127.0.0.1" + cfg.Gateway.Port = 18791 + + originalHealthGet := gatewayHealthGet + t.Cleanup(func() { + gatewayHealthGet = originalHealthGet + }) + + var requestedURL string + gatewayHealthGet = func(url string, timeout time.Duration) (*http.Response, error) { + requestedURL = url + return nil, errors.New("probe failed") + } + + _, statusCode, err := h.getGatewayHealth(cfg, time.Second) + _ = statusCode + _ = err + + if requestedURL != "http://127.0.0.1:18791/health" { + t.Fatalf("health url = %q, want %q", requestedURL, "http://127.0.0.1:18791/health") + } +} + func TestBuildWsURLUsesWSSWhenForwardedProtoIsHTTPS(t *testing.T) { configPath := filepath.Join(t.TempDir(), "config.json") h := NewHandler(configPath) diff --git a/web/backend/api/gateway_test.go b/web/backend/api/gateway_test.go index fb4f7d943..5c94f0b89 100644 --- a/web/backend/api/gateway_test.go +++ b/web/backend/api/gateway_test.go @@ -3,6 +3,7 @@ package api import ( "encoding/json" "errors" + "io" "net/http" "net/http/httptest" "os" @@ -36,6 +37,15 @@ func startLongRunningProcess(t *testing.T) *exec.Cmd { return cmd } +func mockGatewayHealthResponse(statusCode, pid int) *http.Response { + return &http.Response{ + StatusCode: statusCode, + Body: io.NopCloser(strings.NewReader( + `{"status":"ok","uptime":"1s","pid":` + strconv.Itoa(pid) + `}`, + )), + } +} + func startIgnoringTermProcess(t *testing.T) *exec.Cmd { t.Helper() @@ -419,6 +429,125 @@ func TestGatewayStatusKeepsRunningWhenHealthProbeFailsAfterRunning(t *testing.T) } } +func TestGatewayStatusReportsRunningFromHealthProbe(t *testing.T) { + resetGatewayTestState(t) + + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + cmd := startLongRunningProcess(t) + t.Cleanup(func() { + if cmd.Process != nil { + _ = cmd.Process.Kill() + } + _ = cmd.Wait() + }) + + gateway.mu.Lock() + setGatewayRuntimeStatusLocked("stopped") + gateway.mu.Unlock() + + gatewayHealthGet = func(string, time.Duration) (*http.Response, error) { + return mockGatewayHealthResponse(http.StatusOK, cmd.Process.Pid), nil + } + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/gateway/status", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK) + } + + var body map[string]any + if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil { + t.Fatalf("unmarshal response: %v", err) + } + + if got := body["gateway_status"]; got != "running" { + t.Fatalf("gateway_status = %#v, want %q", got, "running") + } + if got := body["pid"]; got != float64(cmd.Process.Pid) { + t.Fatalf("pid = %#v, want %d", got, cmd.Process.Pid) + } + if got := body["gateway_restart_required"]; got != false { + t.Fatalf("gateway_restart_required = %#v, want false", got) + } +} + +func TestGatewayStatusRequiresRestartAfterDefaultModelChange(t *testing.T) { + resetGatewayTestState(t) + + configPath := filepath.Join(t.TempDir(), "config.json") + cfg := config.DefaultConfig() + cfg.Agents.Defaults.ModelName = cfg.ModelList[0].ModelName + cfg.ModelList[0].APIKey = "test-key" + cfg.ModelList = append(cfg.ModelList, config.ModelConfig{ + ModelName: "second-model", + Model: "openai/gpt-4.1", + APIKey: "second-key", + }) + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + process, err := os.FindProcess(os.Getpid()) + if err != nil { + t.Fatalf("FindProcess() error = %v", err) + } + + gateway.mu.Lock() + gateway.cmd = &exec.Cmd{Process: process} + gateway.bootDefaultModel = cfg.ModelList[0].ModelName + setGatewayRuntimeStatusLocked("running") + gateway.mu.Unlock() + + updatedCfg, err := config.LoadConfig(configPath) + if err != nil { + t.Fatalf("LoadConfig() error = %v", err) + } + updatedCfg.Agents.Defaults.ModelName = "second-model" + if err := config.SaveConfig(configPath, updatedCfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + gatewayHealthGet = func(string, time.Duration) (*http.Response, error) { + return mockGatewayHealthResponse(http.StatusOK, os.Getpid()), nil + } + + rec := httptest.NewRecorder() + req := httptest.NewRequest(http.MethodGet, "/api/gateway/status", nil) + mux.ServeHTTP(rec, req) + + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK) + } + + var body map[string]any + if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil { + t.Fatalf("unmarshal response: %v", err) + } + + if got := body["gateway_status"]; got != "running" { + t.Fatalf("gateway_status = %#v, want %q", got, "running") + } + if got := body["boot_default_model"]; got != cfg.ModelList[0].ModelName { + t.Fatalf("boot_default_model = %#v, want %q", got, cfg.ModelList[0].ModelName) + } + if got := body["config_default_model"]; got != "second-model" { + t.Fatalf("config_default_model = %#v, want %q", got, "second-model") + } + if got := body["gateway_restart_required"]; got != true { + t.Fatalf("gateway_restart_required = %#v, want true", got) + } +} + func TestGatewayStatusReturnsErrorAfterStartupWindowExpires(t *testing.T) { resetGatewayTestState(t) diff --git a/web/backend/api/pico.go b/web/backend/api/pico.go index d11f7bc5e..a880f2f0c 100644 --- a/web/backend/api/pico.go +++ b/web/backend/api/pico.go @@ -7,7 +7,6 @@ import ( "fmt" "net/http" "net/http/httputil" - "net/url" "time" "github.com/sipeed/picoclaw/pkg/config" @@ -22,20 +21,13 @@ func (h *Handler) registerPicoRoutes(mux *http.ServeMux) { // WebSocket proxy: forward /pico/ws to gateway // This allows the frontend to connect via the same port as the web UI, // avoiding the need to expose extra ports for WebSocket communication. - wsProxy := h.createWsProxy() - mux.HandleFunc("GET /pico/ws", h.handleWebSocketProxy(wsProxy)) + mux.HandleFunc("GET /pico/ws", h.handleWebSocketProxy()) } -// createWsProxy creates a reverse proxy to the gateway WebSocket endpoint. -// The gateway port is read from the configuration. +// createWsProxy creates a reverse proxy to the current gateway WebSocket endpoint. +// The gateway bind host and port are resolved from the latest configuration. func (h *Handler) createWsProxy() *httputil.ReverseProxy { - cfg, err := config.LoadConfig(h.configPath) - gatewayPort := 18790 // default - if err == nil && cfg.Gateway.Port != 0 { - gatewayPort = cfg.Gateway.Port - } - gatewayURL, _ := url.Parse(fmt.Sprintf("http://127.0.0.1:%d", gatewayPort)) - wsProxy := httputil.NewSingleHostReverseProxy(gatewayURL) + wsProxy := httputil.NewSingleHostReverseProxy(h.gatewayProxyURL()) wsProxy.ErrorHandler = func(w http.ResponseWriter, r *http.Request, err error) { http.Error(w, "Gateway unavailable: "+err.Error(), http.StatusBadGateway) } @@ -43,12 +35,10 @@ func (h *Handler) createWsProxy() *httputil.ReverseProxy { } // handleWebSocketProxy wraps a reverse proxy to handle WebSocket connections. -// It ensures the Connection and Upgrade headers are properly forwarded. -func (h *Handler) handleWebSocketProxy(proxy *httputil.ReverseProxy) http.HandlerFunc { +// The reverse proxy forwards the incoming upgrade handshake as-is. +func (h *Handler) handleWebSocketProxy() http.HandlerFunc { return func(w http.ResponseWriter, r *http.Request) { - // Set headers for WebSocket upgrade - r.Header.Set("Connection", "upgrade") - r.Header.Set("Upgrade", "websocket") + proxy := h.createWsProxy() proxy.ServeHTTP(w, r) } } diff --git a/web/backend/api/pico_test.go b/web/backend/api/pico_test.go index 46149fa09..075da4ddc 100644 --- a/web/backend/api/pico_test.go +++ b/web/backend/api/pico_test.go @@ -2,9 +2,12 @@ package api import ( "encoding/json" + "io" "net/http" "net/http/httptest" + "net/url" "path/filepath" + "strconv" "testing" "github.com/sipeed/picoclaw/pkg/config" @@ -235,3 +238,77 @@ func TestHandlePicoSetup_Response(t *testing.T) { t.Error("response should have changed=true on first setup") } } + +func TestHandleWebSocketProxyReloadsGatewayTargetFromConfig(t *testing.T) { + configPath := filepath.Join(t.TempDir(), "config.json") + h := NewHandler(configPath) + handler := h.handleWebSocketProxy() + + server1 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/pico/ws" { + t.Fatalf("server1 path = %q, want %q", r.URL.Path, "/pico/ws") + } + w.WriteHeader(http.StatusOK) + _, _ = io.WriteString(w, "server1") + })) + defer server1.Close() + + server2 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/pico/ws" { + t.Fatalf("server2 path = %q, want %q", r.URL.Path, "/pico/ws") + } + w.WriteHeader(http.StatusOK) + _, _ = io.WriteString(w, "server2") + })) + defer server2.Close() + + cfg := config.DefaultConfig() + cfg.Gateway.Host = "127.0.0.1" + cfg.Gateway.Port = mustGatewayTestPort(t, server1.URL) + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + req1 := httptest.NewRequest(http.MethodGet, "/pico/ws", nil) + rec1 := httptest.NewRecorder() + handler(rec1, req1) + + if rec1.Code != http.StatusOK { + t.Fatalf("first status = %d, want %d", rec1.Code, http.StatusOK) + } + if body := rec1.Body.String(); body != "server1" { + t.Fatalf("first body = %q, want %q", body, "server1") + } + + cfg.Gateway.Port = mustGatewayTestPort(t, server2.URL) + if err := config.SaveConfig(configPath, cfg); err != nil { + t.Fatalf("SaveConfig() error = %v", err) + } + + req2 := httptest.NewRequest(http.MethodGet, "/pico/ws", nil) + rec2 := httptest.NewRecorder() + handler(rec2, req2) + + if rec2.Code != http.StatusOK { + t.Fatalf("second status = %d, want %d", rec2.Code, http.StatusOK) + } + if body := rec2.Body.String(); body != "server2" { + t.Fatalf("second body = %q, want %q", body, "server2") + } +} + +func mustGatewayTestPort(t *testing.T, rawURL string) int { + t.Helper() + + parsed, err := url.Parse(rawURL) + if err != nil { + t.Fatalf("url.Parse() error = %v", err) + } + + port, err := strconv.Atoi(parsed.Port()) + if err != nil { + t.Fatalf("Atoi(%q) error = %v", parsed.Port(), err) + } + + return port +} diff --git a/web/backend/api/router.go b/web/backend/api/router.go index b56438784..028a476f2 100644 --- a/web/backend/api/router.go +++ b/web/backend/api/router.go @@ -71,7 +71,4 @@ func (h *Handler) RegisterRoutes(mux *http.ServeMux) { h.registerLauncherConfigRoutes(mux) } -// Shutdown gracefully shuts down the handler, closing all SSE connections. -func (h *Handler) Shutdown() { - gateway.events.Shutdown() -} +func (h *Handler) Shutdown() {} diff --git a/web/backend/middleware/middleware.go b/web/backend/middleware/middleware.go index de9e6d870..e15da577b 100644 --- a/web/backend/middleware/middleware.go +++ b/web/backend/middleware/middleware.go @@ -4,16 +4,14 @@ import ( "log" "net/http" "runtime/debug" - "strings" "time" ) // JSONContentType sets the Content-Type header to application/json for // API requests handled by the wrapped handler. -// SSE endpoints (text/event-stream) are excluded. func JSONContentType(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if strings.HasPrefix(r.URL.Path, "/api/") && !strings.HasSuffix(r.URL.Path, "/events") { + if len(r.URL.Path) >= 5 && r.URL.Path[:5] == "/api/" { w.Header().Set("Content-Type", "application/json") } next.ServeHTTP(w, r) @@ -32,7 +30,6 @@ func (rr *responseRecorder) WriteHeader(code int) { } // Flush delegates to the underlying ResponseWriter if it implements http.Flusher. -// This is required for SSE (Server-Sent Events) to work through the middleware. func (rr *responseRecorder) Flush() { if f, ok := rr.ResponseWriter.(http.Flusher); ok { f.Flush() diff --git a/web/backend/systray.go b/web/backend/systray.go index 58ce4984f..1ff98c71b 100644 --- a/web/backend/systray.go +++ b/web/backend/systray.go @@ -94,7 +94,7 @@ func onReady() { func onExit() { fmt.Println(T(Exiting)) - // First, shutdown API handler to close all SSE connections + // First, shutdown API handler if apiHandler != nil { apiHandler.Shutdown() } diff --git a/web/frontend/src/components/app-header.tsx b/web/frontend/src/components/app-header.tsx index fe0c84e69..4f0688008 100644 --- a/web/frontend/src/components/app-header.tsx +++ b/web/frontend/src/components/app-header.tsx @@ -56,14 +56,20 @@ export function AppHeader() { const isRunning = gwState === "running" const isStarting = gwState === "starting" const isRestarting = gwState === "restarting" + const isStopping = gwState === "stopping" const isStopped = gwState === "stopped" || gwState === "unknown" const showNotConnectedHint = - !isRestarting && canStart && (gwState === "stopped" || gwState === "error") + !isRestarting && + !isStopping && + canStart && + (gwState === "stopped" || gwState === "error") const [showStopDialog, setShowStopDialog] = React.useState(false) const handleGatewayToggle = () => { - if (gwLoading || isRestarting || (!isRunning && !canStart)) return + if (gwLoading || isRestarting || isStopping || (!isRunning && !canStart)) { + return + } if (isRunning) { setShowStopDialog(true) } else { @@ -137,7 +143,7 @@ export function AppHeader() { size="icon-sm" className="bg-amber-500/15 text-amber-700 hover:bg-amber-500/25 hover:text-amber-800 dark:text-amber-300 dark:hover:bg-amber-500/25" onClick={handleGatewayRestart} - disabled={gwLoading || isRestarting || !canStart} + disabled={gwLoading || isRestarting || isStopping || !canStart} aria-label={t("header.gateway.action.restart")} > @@ -168,25 +174,31 @@ export function AppHeader() { ) : ( )} diff --git a/web/frontend/src/hooks/use-gateway-logs.ts b/web/frontend/src/hooks/use-gateway-logs.ts index 15cbca4ae..1de361124 100644 --- a/web/frontend/src/hooks/use-gateway-logs.ts +++ b/web/frontend/src/hooks/use-gateway-logs.ts @@ -37,7 +37,9 @@ export function useGatewayLogs() { const fetchLogs = async () => { if ( !mounted || - !["running", "starting", "restarting"].includes(gateway.status) + !["running", "starting", "restarting", "stopping"].includes( + gateway.status, + ) ) { if (mounted) { timeout = setTimeout(fetchLogs, 1000) diff --git a/web/frontend/src/hooks/use-gateway.ts b/web/frontend/src/hooks/use-gateway.ts index 65ec2b776..b118b43da 100644 --- a/web/frontend/src/hooks/use-gateway.ts +++ b/web/frontend/src/hooks/use-gateway.ts @@ -1,83 +1,24 @@ import { useAtomValue } from "jotai" import { useCallback, useEffect, useState } from "react" +import { restartGateway, startGateway, stopGateway } from "@/api/gateway" import { - type GatewayStatusResponse, - getGatewayStatus, - restartGateway, - startGateway, - stopGateway, -} from "@/api/gateway" -import { - applyGatewayStatusToStore, + beginGatewayStoppingTransition, + cancelGatewayStoppingTransition, gatewayAtom, + refreshGatewayState, + subscribeGatewayPolling, updateGatewayStore, } from "@/store" -// Global variable to ensure we only have one SSE connection -let sseInitialized = false - export function useGateway() { const gateway = useAtomValue(gatewayAtom) const { status: state, canStart, restartRequired } = gateway const [loading, setLoading] = useState(false) - const applyGatewayStatus = useCallback((data: GatewayStatusResponse) => { - applyGatewayStatusToStore(data) - }, []) - - // Initialize global SSE connection once useEffect(() => { - if (sseInitialized) return - sseInitialized = true - - getGatewayStatus() - .then((data) => applyGatewayStatus(data)) - .catch(() => { - updateGatewayStore({ - status: "unknown", - canStart: true, - restartRequired: false, - }) - }) - - const statusPoll = window.setInterval(() => { - getGatewayStatus() - .then((data) => applyGatewayStatus(data)) - .catch(() => { - // ignore polling errors - }) - }, 5000) - - // Subscribe to SSE for real-time updates globally - const es = new EventSource("/api/gateway/events") - - es.onmessage = (event) => { - try { - const data = JSON.parse(event.data) - if ( - data.gateway_status || - typeof data.gateway_start_allowed === "boolean" - ) { - applyGatewayStatus(data) - } - } catch { - // ignore - } - } - - es.onerror = () => { - // EventSource will auto-reconnect. Preserve the last known gateway - // status so transient SSE disconnects do not suppress chat websocket - // reconnects while polling catches up. - } - - return () => { - window.clearInterval(statusPoll) - es.close() - sseInitialized = false - } - }, [applyGatewayStatus]) + return subscribeGatewayPolling() + }, []) const start = useCallback(async () => { if (!canStart) return @@ -85,33 +26,28 @@ export function useGateway() { setLoading(true) try { await startGateway() - // SSE will push the real state changes, but set optimistic state - updateGatewayStore({ status: "starting" }) - } catch (err) { - console.error("Failed to start gateway:", err) - try { - const status = await getGatewayStatus() - applyGatewayStatus(status) - } catch { - updateGatewayStore({ status: "unknown" }) - } - } finally { - setLoading(false) - } - }, [applyGatewayStatus, canStart]) - - const stop = useCallback(async () => { - setLoading(true) - try { - await stopGateway() updateGatewayStore({ - status: "stopped", - canStart: true, + status: "starting", restartRequired: false, }) } catch (err) { - console.error("Failed to stop gateway:", err) + console.error("Failed to start gateway:", err) } finally { + await refreshGatewayState({ force: true }) + setLoading(false) + } + }, [canStart]) + + const stop = useCallback(async () => { + setLoading(true) + beginGatewayStoppingTransition() + try { + await stopGateway() + } catch (err) { + console.error("Failed to stop gateway:", err) + cancelGatewayStoppingTransition() + } finally { + await refreshGatewayState({ force: true }) setLoading(false) } }, []) @@ -119,34 +55,20 @@ export function useGateway() { const restart = useCallback(async () => { if (state !== "running") return - const previousState = state - const previousCanStart = canStart - const previousRestartRequired = restartRequired - setLoading(true) - updateGatewayStore({ - status: "restarting", - restartRequired: false, - }) - try { await restartGateway() + updateGatewayStore({ + status: "restarting", + restartRequired: false, + }) } catch (err) { console.error("Failed to restart gateway:", err) - try { - const status = await getGatewayStatus() - applyGatewayStatus(status) - } catch { - updateGatewayStore({ - status: previousState, - canStart: previousCanStart, - restartRequired: previousRestartRequired, - }) - } } finally { + await refreshGatewayState({ force: true }) setLoading(false) } - }, [applyGatewayStatus, canStart, restartRequired, state]) + }, [state]) return { state, loading, canStart, restartRequired, start, stop, restart } } diff --git a/web/frontend/src/i18n/locales/en.json b/web/frontend/src/i18n/locales/en.json index 2fa32ebb5..327b4c646 100644 --- a/web/frontend/src/i18n/locales/en.json +++ b/web/frontend/src/i18n/locales/en.json @@ -63,7 +63,8 @@ }, "status": { "starting": "Starting Gateway...", - "restarting": "Restarting Gateway..." + "restarting": "Restarting Gateway...", + "stopping": "Stopping Gateway..." }, "restartRequired": "Model changes require a gateway restart to take effect." } diff --git a/web/frontend/src/i18n/locales/zh.json b/web/frontend/src/i18n/locales/zh.json index badf5bb3d..cd674ddc1 100644 --- a/web/frontend/src/i18n/locales/zh.json +++ b/web/frontend/src/i18n/locales/zh.json @@ -63,7 +63,8 @@ }, "status": { "starting": "服务启动中...", - "restarting": "服务重启中..." + "restarting": "服务重启中...", + "stopping": "服务停止中..." }, "restartRequired": "切换默认模型后需要重启服务才能生效。" } diff --git a/web/frontend/src/store/gateway.ts b/web/frontend/src/store/gateway.ts index c5eee8451..1bdec6220 100644 --- a/web/frontend/src/store/gateway.ts +++ b/web/frontend/src/store/gateway.ts @@ -6,6 +6,7 @@ export type GatewayState = | "running" | "starting" | "restarting" + | "stopping" | "stopped" | "error" | "unknown" @@ -24,9 +25,29 @@ const DEFAULT_GATEWAY_STATE: GatewayStoreState = { restartRequired: false, } +const GATEWAY_POLL_INTERVAL_MS = 2000 +const GATEWAY_TRANSIENT_POLL_INTERVAL_MS = 1000 +const GATEWAY_STOPPING_TIMEOUT_MS = 5000 + +interface RefreshGatewayStateOptions { + force?: boolean +} + // Global atom for gateway state export const gatewayAtom = atom(DEFAULT_GATEWAY_STATE) +let gatewayPollingSubscribers = 0 +let gatewayPollingTimer: ReturnType | null = null +let gatewayPollingRequest: Promise | null = null +let gatewayStoppingTimer: ReturnType | null = null + +function clearGatewayStoppingTimeout() { + if (gatewayStoppingTimer !== null) { + clearTimeout(gatewayStoppingTimer) + gatewayStoppingTimer = null + } +} + function normalizeGatewayStoreState( prev: GatewayStoreState, patch: GatewayStorePatch, @@ -49,10 +70,38 @@ export function updateGatewayStore( | GatewayStorePatch | ((prev: GatewayStoreState) => GatewayStorePatch | GatewayStoreState), ) { - getDefaultStore().set(gatewayAtom, (prev) => { + const store = getDefaultStore() + store.set(gatewayAtom, (prev) => { const nextPatch = typeof patch === "function" ? patch(prev) : patch return normalizeGatewayStoreState(prev, nextPatch) }) + const nextState = store.get(gatewayAtom) + if (nextState?.status !== "stopping") { + clearGatewayStoppingTimeout() + } +} + +export function beginGatewayStoppingTransition() { + clearGatewayStoppingTimeout() + updateGatewayStore({ + status: "stopping", + canStart: false, + restartRequired: false, + }) + gatewayStoppingTimer = setTimeout(() => { + gatewayStoppingTimer = null + updateGatewayStore((prev) => + prev.status === "stopping" ? { status: "running" } : prev, + ) + void refreshGatewayState({ force: true }) + }, GATEWAY_STOPPING_TIMEOUT_MS) +} + +export function cancelGatewayStoppingTransition() { + clearGatewayStoppingTimeout() + updateGatewayStore((prev) => + prev.status === "stopping" ? { status: "running" } : prev, + ) } export function applyGatewayStatusToStore( @@ -64,21 +113,92 @@ export function applyGatewayStatusToStore( >, ) { updateGatewayStore((prev) => ({ - status: data.gateway_status ?? prev.status, - canStart: data.gateway_start_allowed ?? prev.canStart, - restartRequired: - data.gateway_restart_required ?? - (data.gateway_status && data.gateway_status !== "running" + status: + prev.status === "stopping" && data.gateway_status === "running" + ? "stopping" + : (data.gateway_status ?? prev.status), + canStart: + prev.status === "stopping" && data.gateway_status === "running" ? false - : prev.restartRequired), + : (data.gateway_start_allowed ?? prev.canStart), + restartRequired: + prev.status === "stopping" && data.gateway_status === "running" + ? false + : (data.gateway_restart_required ?? prev.restartRequired), })) } -export async function refreshGatewayState() { +function nextGatewayPollInterval() { + const status = getDefaultStore().get(gatewayAtom).status + if ( + status === "starting" || + status === "restarting" || + status === "stopping" + ) { + return GATEWAY_TRANSIENT_POLL_INTERVAL_MS + } + return GATEWAY_POLL_INTERVAL_MS +} + +function scheduleGatewayPoll(delay = nextGatewayPollInterval()) { + if (gatewayPollingSubscribers === 0) { + return + } + + if (gatewayPollingTimer !== null) { + clearTimeout(gatewayPollingTimer) + } + + gatewayPollingTimer = setTimeout(() => { + gatewayPollingTimer = null + void refreshGatewayState() + }, delay) +} + +export async function refreshGatewayState( + options: RefreshGatewayStateOptions = {}, +) { + if (gatewayPollingRequest) { + await gatewayPollingRequest + if (options.force) { + return refreshGatewayState() + } + return + } + + gatewayPollingRequest = (async () => { + try { + const status = await getGatewayStatus() + applyGatewayStatusToStore(status) + } catch { + // Preserve the last known state when a poll fails. + } finally { + gatewayPollingRequest = null + scheduleGatewayPoll() + } + })() + try { - const status = await getGatewayStatus() - applyGatewayStatusToStore(status) - } catch { - updateGatewayStore(DEFAULT_GATEWAY_STATE) + await gatewayPollingRequest + } finally { + if (gatewayPollingSubscribers === 0 && gatewayPollingTimer !== null) { + clearTimeout(gatewayPollingTimer) + gatewayPollingTimer = null + } + } +} + +export function subscribeGatewayPolling() { + gatewayPollingSubscribers += 1 + if (gatewayPollingSubscribers === 1) { + void refreshGatewayState() + } + + return () => { + gatewayPollingSubscribers = Math.max(0, gatewayPollingSubscribers - 1) + if (gatewayPollingSubscribers === 0 && gatewayPollingTimer !== null) { + clearTimeout(gatewayPollingTimer) + gatewayPollingTimer = null + } } } From 7b9fdaec3229422fa9d81d3100eaea0ec8878acb Mon Sep 17 00:00:00 2001 From: wenjie Date: Tue, 17 Mar 2026 18:56:52 +0800 Subject: [PATCH 058/234] feat(config): add exec controls and gate cron commands on exec settings (#1685) - add a dedicated exec settings section in the config page - support timeout and custom allow/deny regex patterns for exec - validate custom exec regex patterns in the config API - block cron command scheduling and execution when exec is disabled - update tests and i18n strings for the new command settings --- pkg/tools/cron.go | 37 +++++-- pkg/tools/cron_test.go | 49 +++++++++ web/backend/api/config.go | 22 ++++ web/backend/api/config_test.go | 79 ++++++++++++++ .../src/components/config/config-page.tsx | 30 +++++- .../src/components/config/config-sections.tsx | 102 ++++++++++++++++-- .../src/components/config/form-model.ts | 42 ++++++++ web/frontend/src/i18n/locales/en.json | 24 +++-- web/frontend/src/i18n/locales/zh.json | 22 +++- 9 files changed, 379 insertions(+), 28 deletions(-) diff --git a/pkg/tools/cron.go b/pkg/tools/cron.go index aa22f9aa6..154ec75f0 100644 --- a/pkg/tools/cron.go +++ b/pkg/tools/cron.go @@ -25,6 +25,7 @@ type CronTool struct { msgBus *bus.MessageBus execTool *ExecTool allowCommand bool + execEnabled bool } // NewCronTool creates a new CronTool @@ -33,23 +34,32 @@ func NewCronTool( cronService *cron.CronService, executor JobExecutor, msgBus *bus.MessageBus, workspace string, restrict bool, execTimeout time.Duration, config *config.Config, ) (*CronTool, error) { - execTool, err := NewExecToolWithConfig(workspace, restrict, config) - if err != nil { - return nil, fmt.Errorf("unable to configure exec tool: %w", err) - } - allowCommand := true + execEnabled := true if config != nil { allowCommand = config.Tools.Cron.AllowCommand + execEnabled = config.Tools.Exec.Enabled } - execTool.SetTimeout(execTimeout) + var execTool *ExecTool + if execEnabled { + var err error + execTool, err = NewExecToolWithConfig(workspace, restrict, config) + if err != nil { + return nil, fmt.Errorf("unable to configure exec tool: %w", err) + } + } + + if execTool != nil { + execTool.SetTimeout(execTimeout) + } return &CronTool{ cronService: cronService, executor: executor, msgBus: msgBus, execTool: execTool, allowCommand: allowCommand, + execEnabled: execEnabled, }, nil } @@ -193,6 +203,9 @@ func (t *CronTool) addJob(ctx context.Context, args map[string]any) *ToolResult command, _ := args["command"].(string) commandConfirm, _ := args["command_confirm"].(bool) if command != "" { + if !t.execEnabled { + return ErrorResult("command execution is disabled") + } if !constants.IsInternalChannel(channel) { return ErrorResult("scheduling command execution is restricted to internal channels") } @@ -298,6 +311,18 @@ func (t *CronTool) ExecuteJob(ctx context.Context, job *cron.CronJob) string { // Execute command if present if job.Payload.Command != "" { + if !t.execEnabled || t.execTool == nil { + output := "Error executing scheduled command: command execution is disabled" + pubCtx, pubCancel := context.WithTimeout(context.Background(), 5*time.Second) + defer pubCancel() + t.msgBus.PublishOutbound(pubCtx, bus.OutboundMessage{ + Channel: channel, + ChatID: chatID, + Content: output, + }) + return "ok" + } + args := map[string]any{ "command": job.Payload.Command, "__channel": channel, diff --git a/pkg/tools/cron_test.go b/pkg/tools/cron_test.go index e46b13b13..09d29b6fa 100644 --- a/pkg/tools/cron_test.go +++ b/pkg/tools/cron_test.go @@ -5,6 +5,7 @@ import ( "path/filepath" "strings" "testing" + "time" "github.com/sipeed/picoclaw/pkg/bus" "github.com/sipeed/picoclaw/pkg/config" @@ -112,6 +113,28 @@ func TestCronTool_CommandAllowedWithConfirmWhenAllowCommandDisabled(t *testing.T } } +func TestCronTool_CommandBlockedWhenExecDisabled(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Tools.Exec.Enabled = false + + tool := newTestCronToolWithConfig(t, cfg) + ctx := WithToolContext(context.Background(), "cli", "direct") + result := tool.Execute(ctx, map[string]any{ + "action": "add", + "message": "check disk", + "command": "df -h", + "command_confirm": true, + "at_seconds": float64(60), + }) + + if !result.IsError { + t.Fatal("expected command scheduling to be blocked when exec is disabled") + } + if !strings.Contains(result.ForLLM, "command execution is disabled") { + t.Errorf("expected exec disabled message, got: %s", result.ForLLM) + } +} + // TestCronTool_CommandAllowedFromInternalChannel verifies command scheduling works from internal channels func TestCronTool_CommandAllowedFromInternalChannel(t *testing.T) { tool := newTestCronTool(t) @@ -185,3 +208,29 @@ func TestCronTool_NonCommandJobDefaultsDeliverToFalse(t *testing.T) { t.Fatal("expected deliver=false by default for non-command jobs") } } + +func TestCronTool_ExecuteJobPublishesErrorWhenExecDisabled(t *testing.T) { + cfg := config.DefaultConfig() + cfg.Tools.Exec.Enabled = false + + tool := newTestCronToolWithConfig(t, cfg) + job := &cron.CronJob{} + job.Payload.Channel = "cli" + job.Payload.To = "direct" + job.Payload.Command = "df -h" + + if got := tool.ExecuteJob(context.Background(), job); got != "ok" { + t.Fatalf("ExecuteJob() = %q, want ok", got) + } + + ctx, cancel := context.WithTimeout(context.Background(), time.Second) + defer cancel() + + msg, ok := tool.msgBus.SubscribeOutbound(ctx) + if !ok { + t.Fatal("expected outbound message") + } + if !strings.Contains(msg.Content, "command execution is disabled") { + t.Fatalf("expected exec disabled message, got: %s", msg.Content) + } +} diff --git a/web/backend/api/config.go b/web/backend/api/config.go index 091e3fbae..a7d5b3c5d 100644 --- a/web/backend/api/config.go +++ b/web/backend/api/config.go @@ -5,6 +5,7 @@ import ( "fmt" "io" "net/http" + "regexp" "github.com/sipeed/picoclaw/pkg/config" ) @@ -188,6 +189,27 @@ func validateConfig(cfg *config.Config) []string { errs = append(errs, "channels.discord.token is required when discord channel is enabled") } + if cfg.Tools.Exec.Enabled { + if cfg.Tools.Exec.EnableDenyPatterns { + errs = append( + errs, + validateRegexPatterns("tools.exec.custom_deny_patterns", cfg.Tools.Exec.CustomDenyPatterns)...) + } + errs = append( + errs, + validateRegexPatterns("tools.exec.custom_allow_patterns", cfg.Tools.Exec.CustomAllowPatterns)...) + } + + return errs +} + +func validateRegexPatterns(field string, patterns []string) []string { + var errs []string + for index, pattern := range patterns { + if _, err := regexp.Compile(pattern); err != nil { + errs = append(errs, fmt.Sprintf("%s[%d] is not a valid regular expression: %v", field, index, err)) + } + } return errs } diff --git a/web/backend/api/config_test.go b/web/backend/api/config_test.go index 29811e37e..54ec8e857 100644 --- a/web/backend/api/config_test.go +++ b/web/backend/api/config_test.go @@ -86,3 +86,82 @@ func TestHandleUpdateConfig_DoesNotInheritDefaultModelFields(t *testing.T) { t.Fatalf("model_list[0].api_base = %q, want empty string", got) } } + +func TestHandlePatchConfig_RejectsInvalidExecRegexPatterns(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + req := httptest.NewRequest(http.MethodPatch, "/api/config", bytes.NewBufferString(`{ + "tools": { + "exec": { + "custom_deny_patterns": ["("] + } + } + }`)) + req.Header.Set("Content-Type", "application/json") + + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusBadRequest { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusBadRequest, rec.Body.String()) + } + if !bytes.Contains(rec.Body.Bytes(), []byte("custom_deny_patterns")) { + t.Fatalf("expected validation error mentioning custom_deny_patterns, body=%s", rec.Body.String()) + } +} + +func TestHandlePatchConfig_AllowsInvalidExecRegexPatternsWhenExecDisabled(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + req := httptest.NewRequest(http.MethodPatch, "/api/config", bytes.NewBufferString(`{ + "tools": { + "exec": { + "enabled": false, + "custom_deny_patterns": ["("], + "custom_allow_patterns": ["("] + } + } + }`)) + req.Header.Set("Content-Type", "application/json") + + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } +} + +func TestHandlePatchConfig_AllowsInvalidDenyRegexPatternsWhenDenyPatternsDisabled(t *testing.T) { + configPath, cleanup := setupOAuthTestEnv(t) + defer cleanup() + + h := NewHandler(configPath) + mux := http.NewServeMux() + h.RegisterRoutes(mux) + + req := httptest.NewRequest(http.MethodPatch, "/api/config", bytes.NewBufferString(`{ + "tools": { + "exec": { + "enabled": true, + "enable_deny_patterns": false, + "custom_deny_patterns": ["("] + } + } + }`)) + req.Header.Set("Content-Type", "application/json") + + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + if rec.Code != http.StatusOK { + t.Fatalf("status = %d, want %d, body=%s", rec.Code, http.StatusOK, rec.Body.String()) + } +} diff --git a/web/frontend/src/components/config/config-page.tsx b/web/frontend/src/components/config/config-page.tsx index 130498ba4..e533b956f 100644 --- a/web/frontend/src/components/config/config-page.tsx +++ b/web/frontend/src/components/config/config-page.tsx @@ -16,6 +16,7 @@ import { AgentDefaultsSection, CronSection, DevicesSection, + ExecSection, LauncherSection, RuntimeSection, } from "@/components/config/config-sections" @@ -27,6 +28,7 @@ import { buildFormFromConfig, parseCIDRText, parseIntField, + parseMultilineList, } from "@/components/config/form-model" import { PageHeader } from "@/components/page-header" import { Button } from "@/components/ui/button" @@ -170,6 +172,28 @@ export function ConfigPage() { "Cron exec timeout", { min: 0 }, ) + const execConfigPatch: Record = { + enabled: form.execEnabled, + } + + if (form.execEnabled) { + execConfigPatch.allow_remote = form.allowRemote + execConfigPatch.enable_deny_patterns = form.enableDenyPatterns + execConfigPatch.custom_allow_patterns = parseMultilineList( + form.customAllowPatternsText, + ) + execConfigPatch.timeout_seconds = parseIntField( + form.execTimeoutSeconds, + "Exec timeout", + { min: 0 }, + ) + + if (form.enableDenyPatterns) { + execConfigPatch.custom_deny_patterns = parseMultilineList( + form.customDenyPatternsText, + ) + } + } await patchAppConfig({ agents: { @@ -190,9 +214,7 @@ export function ConfigPage() { allow_command: form.allowCommand, exec_timeout_minutes: cronExecTimeoutMinutes, }, - exec: { - allow_remote: form.allowRemote, - }, + exec: execConfigPatch, }, heartbeat: { enabled: form.heartbeatEnabled, @@ -289,6 +311,8 @@ export function ConfigPage() { + + - onFieldChange("allowRemote", checked)} - /> - + onFieldChange("execEnabled", checked)} + /> + + {form.execEnabled && ( + <> + onFieldChange("allowRemote", checked)} + /> + + + onFieldChange("enableDenyPatterns", checked) + } + /> + + {form.enableDenyPatterns && ( + +