߲j <dZddlZddlZddlZddlZddlZddlZddlZddlmZm Z ddl m Z ddl m Z mZmZmZddlmZmZmZddlmZddlmZdd lmZdd lmZdd lmZ dd lm!Z"d ee#e fdee$fdZ%ddd ee#e fdee$de&fdZ'de#ddfdZ(dDdZ)dZ*ejVde#fdZ,dddde#de&de&ddfdZ-dZ.d e#d!e#ddfd"Z/d#e#d$e#de&fd%Z0d&e1d e#d!e#de&fd'Z2d e#dee$fd(Z3d$e#dee1fd)Z4d e#d!e#deee1ee&ffd*Z5d&e1d!e#de&fd+Z6d e#d!e#d,e7de&fd-Z8d.Z9d/Z:d0Z;d1ZdEd4Z?d5e1de&fd6Z@d7e d8e#d9e$de#ddf d:ZAdFd;ZBdGd<ZCde#ddfd=ZDdHdee#ddfd>ZEd e#d!e#de&fd?ZFde#d ee#e fddfd@ZGde#ddfdAZHde#ddfdBZIdDdCZJy)IuBrowser session lifecycle: inactivity janitor, orphan reaper, per-session teardown, atexit cleanup. Split out of ``tools/browser_tool.py``. Facade-owned state is read through ``_bt`` (``tools.browser_tool``, resolved per call) — no import cycle. N)datetimetimezone)Path)AnyDictOptionalTuple)get_hermes_homereset_hermes_home_overrideset_hermes_home_override)origin)browser_tool_cdp)browser_tool_cloud)browser_tool_session)browser_tool_install)browser_tool_real_profile session_inforeturnc|jd}t|ttfrt|ts t|St|t r|j sy|j }|jdr|ddd} tj|}|j |jt j"}|j%S#t$r"tjjdYywxYw)zProvider-authoritative session expiry as epoch seconds; None when absent or malformed (cloud providers may omit ``expires_at``; local browsers never have one). expires_atN)Zzz+00:00z7Ignoring invalid cloud browser session expiry timestamp)tzinfo)get isinstanceintfloatboolstrstripendswithr fromisoformat ValueError_btloggerwarningrreplacerutc timestamp)rvalue normalizedparseds A/home/ubuntu/.hermes/hermes-agent/tools/browser_tool_lifecycle.py_session_expiry_timestampr/s   \ *E%#u&z%/FU| eS !J:&"3B(/ '' 3}}x||4      TUsC(D  D )nowr0cZt|}|y|tj|k\S||k\S)z?Whether a cached browser session crossed its provider deadline.F)r/time)rr0rs r._session_has_expiredr30s6+<8J;DIIKJ >>CJ >>labelc |y#t$r+}tjjd||Yd}~yd}~wwxYw)uRRun ``fn()``; log (debug) and swallow any exception — teardown must never abort.z %s failed: %sN) Exceptionr%r&debug)r5fnes r. _best_effortr;:s54  4 %334s >!9>cddlm}|y)Nrstop_all_lightpanda)tools.browser_lightpandar>r=s r._stop_all_lightpandar@Bs <r4c tjrydt_tdtj tj rtjjdttj  ttj5tj jtjjtjjtj jtj"jdddtdt$tdt&y#t$rYywxYw#t$r+}tjjd|Yd}~d}~wwxYw#1swYpxYw#tj5tj jtjjtjjtj jtj"jdddw#1swYwxYwxYw)uatexit: close this process's sessions, then sweep orphans left by crashed hermes processes — every clean exit reaps accumulated orphans, not only processes that used the browser tool.NTz#Real-profile chrome cleanup on exitz2Emergency cleanup: closing %s active session(s)...zEmergency cleanup error: %szLightpanda cleanup on exitzOrphan reap on exit)r% _cleanup_doner7r; _real_profile_terminate_real_profile_chrome_active_sessionsr&infolencleanup_all_browserserror _cleanup_lockclear_session_last_activity_session_owner_homes_cleanup_failures_recording_sessionsr@_reap_orphaned_browser_sessions)r:s r._emergency_cleanup_all_sessionsrQGs     6 8d8de  LcRURfRfNgh 0 """ 0$$**,**002((..0%%++-''--/  0-/CD&(GH5   ? JJ  :A > > ? 0 0"" 0$$**,**002((..0%%++-''--/  0 0 0sfE E E)BF  E&%E&) F2 FF,FF, F),I)=BI I)I& "I)task_idc#LKtjj|}|dyddlm}m}m}ddlm}t|} |t|||t|} d|| t|y#||wxYw#t|wxYww)aRun under the Hermes home + secret scope owning ``task_id``'s session (no-op if unrecorded). The janitor thread is process-global, so each teardown must re-enter its OWN profile's scope rather than inherit the spawning profile's; never falls through to ``os.environ``. Nr)build_profile_secret_scopereset_secret_scopeset_secret_scope)hydrate_profile_secret_sources) r%rMragent.secret_scoperTrUrVhermes_cli.env_loaderrWr rr )rR owner_homerTrUrVrW home_token secret_tokens r._session_owner_scoper]ls))--g6J ccD)*5J/&tJ'78'(B4 CS(TU  -  | ,":. | ,":.s6AB$(B.B2B; B$ BB B!!B$TF)activitysessionr^r_cVtj5|r tjj|d|r tjj|dtj j|dtj j|ddddy#1swYyxYw)zRDrop the janitor's bookkeeping (and optionally the session entry) for ``task_id``.N)r%rJrEpoprLrMrN)rRr^r_s r._forget_session_trackingrbs~  1   $ $Wd 3   & & * *7D 9   $$Wd3 !!'40 111s BBB(c tj}tj5ttjj Dcgc]\}}||z tj kDr|}}}dddD]z}t|tjj||z }tjjd|| t|5t|dddt||ycc}}w#1swYxYw#1swY)xYw#t$rX}tj5tjj|ddzx}tj|<dddn #1swYnxYwtj kr7tjj#d||tj |Yd}~Ltjj%d||| t|5t'|dddn #1swYnxYwn7#t$r+}tjj%d||Yd}~nd}~wwxYwt|d n#t|d wxYwYd}~d}~wwxYw) a;Close sessions inactive longer than the timeout (cleanup thread). Each teardown runs under its owner profile's scope. A session whose cleanup keeps failing is force-reaped after MAX_INACTIVITY_CLEANUP_FAILURES attempts; only a successful cleanup clears its failure count. See #100738, #86402. Nz :A I8 "I8. H9 H HH HI  I$!I I  II I8 I//I88I= socket_dir session_namecX tjj||d}t|dd5}|j t tj dddy#1swYyxYw#t$r+}tjjd||Yd}~yd}~wwxYw)zRecord this hermes PID in ``/.owner_pid`` so the orphan reaper can tell live-owner daemons from crashed-owner ones. Best-effort: an OSError falls back to the legacy ``tracked_names`` heuristic. .owner_pidwutf-8encodingNz)Could not write owner_pid file for %s: %s) ospathjoinopenwriter getpidOSErrorr%r&r8)rrrsr{fexcs r._write_owner_pidrsYww||J<. (CD $g . &! GGC $ % & & & Y DlTWXXYs41A5-A) A5)A2.A52A55 B)>!B$$B)tokenr{c.tjj|j}|j drd|vr|j dddn|}t |xr0tjj|j|k(S)zKTrue when ``token`` (or its ``--flag=VALUE`` value) names exactly ``path``.-=rd)rzr{normpathlower startswithsplitr)rr{want candidates r._argv_token_is_pathrsv 77  D ! ' ' )D*/*:*:3*?C5L C#A&V[I  ? Jrww// :@@BdJJr4 daemon_pidcTdtdtffd } ddl} |j }|j xsdj }t|jxsg}dj|j }d |vr d |vr |d |Stfd |D} | sq |jxsijdd} t| xr?t j"j%| t j"j%k(} | s |dSy#t$r |dcYSwxYw#|j$rYy |jtf$r} |d | cYd} ~ Sd} ~ wwxYw#|j|jtf$rd } YwxYw)uConfirm a live PID is genuinely *this* session's agent-browser daemon (fail-closed). The ``.pid`` file sits in a world-writable temp dir: a planted or recycled PID would turn the tree-kill into an arbitrary-process DoS. Both must pass: (1) identity — ``agent-browser`` in name/cmdline; (2) binding — the socket dir in the cmdline or ``AGENT_BROWSER_SOCKET_DIR`` in its environ (the real spoof defense). reasonrcPtjjd|zg|y)Nz5Refusing to reap browser daemon PID %d (session %s): F)r%r&r')rargsrrss r.refusez/_verify_reapable_browser_daemon..refuses. RU[[%| <6: <r4rNz,psutil unavailable for identity verification Fz$could not read process identity (%s)z agent-browserz¬ an agent-browser process (name=%r)c36K|]}t|ywN)r).0tokrrs r. z2_verify_reapable_browser_daemon..sE#C4EsAGENT_BROWSER_SOCKET_DIRzNnot bound to session socket dir %s (possible recycled PID or planted pid file)T)r rpsutil ImportErrorProcessnamerrecmdliner| NoSuchProcess AccessDeniedranyenvironrrzr{r) rrrrsrrprocrargvrrboundenv_dirs ``` r._verify_reapable_browser_daemonrssd FC~~j) !r((*DLLN(b)((4.&&( d"g'E>EE EE EE  ||~+001KRPGM_bgg&6&6w&?277CSCST^C_&_E fhrss 9 FDEEF       )C`` there — a restart-proof activity marker — and rewriting doesn't touch the dir mtime, so entries are scanned too.N) rzr{getmtimerscandirmaxstatst_mtimer2)rrlatestentriesentrys r._socket_dir_idle_secondsrs!!*- ZZ # w   )>)>?F   sDIIK&( ))        s\BB8B,$B"B,%B8 BB B)&B,(B))B,,B51B88 CCc tt|jdjS#tt f$rYywxYw)z8Integer PID from ``path``; None when missing or corrupt.rwrxN)rr read_textr!r$r)r{s r._read_pid_filersD4:'''9??ABB  s14AActtjj||d}|yddlm}|||fS)z`Read ``.owner_pid`` and report ``(pid, alive)``; ``(None, None)`` when missing/corrupt.ru)NNr _pid_exists)rrzr{r|gateway.statusr)rrrs owner_pidrs r._owner_pid_alivers>rww||J<. 8STUI* k), ,,r4cjddlm}ddlm}||}| |d||y|j ||y)zTree-kill ``daemon_pid`` if it has a start-time fingerprint (so a PID swapped between check and kill is refused); False (logged via ``log``) when no fingerprint. Raises on OS errors.r)get_process_start_time)ProcessRegistryzXRefusing to reap browser daemon PID %d (session %s): no start-time fingerprint availableFT)rrtools.process_registryr_terminate_host_pid)rrslogrr daemon_starts r._terminate_verified_daemonr%s@66)*5L f   &'' LA r4 tracked_namescnt||\}}|dura||vryt|}||tjkrytjj d||t |tjn|||vrytjj||d}tjj|s9t|}||tjkrytj|dyt|}ddlm}|||stj|dyt!|||syd} t#||tjj sytjj%d||d} tj|d| S#t&t(t*f$rY/wxYw) uReap one ``agent-browser-`` dir if orphaned; True when a daemon was killed. A live ``owner_pid`` means another hermes process owns it — leave it UNLESS untracked here and idle past ``BROWSER_ORPHAN_GRACE_SECONDS`` (owner-alive alone made leaked daemons immortal); no owner_pid (legacy) falls back to this process's tracking. A pidless dir is only stale after the grace period (deleting it immediately races the creator's first stdout open). The PID is identity-verified before any tree-kill. TFu}Browser session %s has a live owner (PID %s) but is untracked and idle for %ds (grace %ds) — treating as leaked and reaping.pid ignore_errorsrrz2Reaped orphaned browser daemon PID %d (session %s))rrr%BROWSER_ORPHAN_GRACE_SECONDSr&r'rrzr{r|isfileshutilrmtreerrrrrrFProcessLookupErrorPermissionErrorr) rrrsrr owner_aliveidle_spid_filerrreapeds r._reap_socket_dirr4s.j,GI{d = ()*5 >Vc&F&FF  N )S[  , ,  .  !>ww||J<.(=>H 77>>( #)*5 >Vc&F&FF j5)J*Z!8 j5 *:z< PF )*lCJJDVDVW LjZfg MM*D1 M  9   s;%F!#FF43F4cddl}d}td|tj}g}ddddtjfD]4}||jt j j||z }6|sytj5tjjDchc]%}|jd s|jd '}}dddjtjd}|D]F}t j j|jd} | s4t|| |sB|d z }H|r!tj j#d |yycc}w#1swYxYw) zKill agent-browser daemons whose owning hermes process is gone (an unclean exit loses ``_active_sessions`` but node + Chromium keep running). Scans the tmp dir for ``agent-browser-*`` socket dirs; safe from any context.rNcddlm}|y)Nrreap_orphaned_lightpanda)r?rrs r._reap_lpz1_reap_orphaned_browser_sessions.._reap_lprs E "r4zLightpanda orphan reapzagent-browser-h_*zagent-browser-cdp_*zagent-browser-hermes_*agent-browser-rsrdz:Reaped %d orphaned browser session(s) from previous run(s))globr;r%_socket_safe_tmpdir_REAL_PROFILE_SESSIONrzr{r|rJrEvaluesraddbasename removeprefixrr&rF) rrtmpdir socket_dirsprefixrFrrrrrss r.rPrPjsd#)84  $ $ &FK&(=?W#C$=$=#>?A?tyyff!=>> ?   y>A>R>R>Y>Y>[xd_c_g_ghv_w.1x xy c//0 F! ww'' 3@@AQR ,Z}U aKF  TV\]yyys$ !E5,E0E0E50E55E>c$tdttjdz }d}tjrl||zdk(r t |dz } ttdD])}tjsntjd+tjrkyy#t $r*}tjjd|Yd}~d}~wwxYw#t $r*}tjjd|Yd}~d}~wwxYw)zEvery 30s: close sessions idle past BROWSER_SESSION_INACTIVITY_TIMEOUT; reap orphans on startup AND every BROWSER_ORPHAN_REAP_INTERVAL seconds.rdrzOrphan reap error: %sNzCleanup thread error: %s) rroundr%BROWSER_ORPHAN_REAP_INTERVAL_cleanup_runningrPr7r&r'rqranger2sleep)reap_every_cyclescycler:_s r._browser_cleanup_thread_workerrsAuS%E%E%JKL E   $ $ ) ?/1   > . 0r A'' JJqM     ? ""#:A>> ?  > JJ  91 = = >s0 B& C& C/ CC D% D  Dctj5tjtjjs|dt_t j tddt_tjjtjjdtjdddy#1swYyxYw)z;Start the background cleanup thread if not already running.NTzbrowser-cleanup)targetdaemonrz0Started inactivity cleanup thread (timeout: %ss)) r%rJ_cleanup_threadis_aliver threadingThreadrstartr&rFrgr4r._start_browser_cleanup_threadrs  x    &c.A.A.J.J.L#'C "+"2"2:Xae8I#KC     % % ' JJOONPSPvPv w xxxs B+CCc dt_tj}| |j dyy#t$rYywxYw#t t f$rYywxYw)z#Stop the background cleanup thread.FNtimeout)r%rrr7r| SystemExitKeyboardInterrupt)threads r._stop_browser_cleanup_threadrsi$$$   KKK "   -.   s4A AAAActj5tjtj|<tjj |t tdddy#1swYyxYw)zTouch the activity timestamp and record the owning Hermes home on first sight (the janitor tears down under the owner's scope). Does NOT reset ``_cleanup_failures``. See #86402. N)r%rJr2rLrM setdefaultr r )rRs r._update_session_activityrsZ  M.2iik""7+   ++GS9J5KLMMMs AA11A:cj ddlm}||jy#t$rt |YywxYw)uBest-effort kill of *proc* and every descendant; never raises. ``Popen.kill()`` only signals the direct child; npm/npx helpers and the detached daemon grandchild keep a capture pipe open so ``communicate()`` never sees EOF, so the whole tree must go (no grace: the caller already burned its timeout). Delegates to :func:`agent.deadline.kill_process_tree`, falling back to the legacy kill. ``Popen.kill()`` only signals the direct child PID. npm/npx routinely fork further processes (registry-fetch helpers, npm's own lifecycle runner, agent-browser's own detached daemon grandchild) that can survive a plain ``kill()`` of the top-level PID and keep a ``capture_output``-style pipe open, hanging the caller's ``communicate()`` past the nominal timeout — the same orphaned-pipe hazard already hit in production on POSIX (see ``tools/process_registry.py``'s ``_reader_loop``, issue 68915: a backgrounded grandchild inheriting a pipe's write end kept it from ever reaching EOF). That hazard is cross-platform, not Windows-specific; what *is* Windows-specific is the lack of a remedy other than killing the tree — anonymous pipes there don't support overlapped I/O, so there's no ``select()``-style non-blocking read to poll around a stuck grandchild the way POSIX can. Killing the whole process group/tree the child was launched into reaches those descendants on both platforms. See #68915. r)kill_process_treeN)agent.deadlinerpidr7_legacy_kill_process_tree)r_deadline_kill_trees r._kill_process_treer s-&(KDHH% (!$'(s 22cNtjdk(rA tjddt |j ddgddtj y ttd d }| |jy tj|j }tjttd tjfD] } |||y #t$rYy wxYw#t$rYy wxYw#ttf$rYy wxYw#tttf$rYy wxYw) uLocal tree-kill (SIGTERM then SIGKILL to the process group) — fallback when agent.deadline is unavailable; tests pin this signal sequence.nttaskkillz/PIDz/Tz/FFT)checkcapture_outputstdinNkillpgSIGKILL)rzr subprocessrunr r DEVNULLr7getattrkillgetpgidrrsignalSIGTERMr)rrpgidsigs r.r r s ww$  NNJDHH tTJ!&t:CUCU W R4 (F ~  IIK zz$((# 6>> JK  4 !        ( #OW=   sG?C)C(;C7 D  C%$C%( C43C47D D  D$#D$r c*|dkryddlm}||S)z[Best-effort 'is this PID alive' (cross-platform via gateway.status; zombies count as dead).rFr)rr)r _gateway_pid_existss r.rr s axA s ##r4 directorypattern max_age_hoursc tj|dzz }|j|D]0} |jj|kr|j 2y#t $r,}t jjd|||Yd}~dd}~wwxYw#t $r9}t jjd|j|Yd}~yd}~wwxYw)zNDelete ``directory/pattern`` files older than ``max_age_hours``; never raises.zFailed to clean old %s %s: %sNz#%s cleanup error (non-critical): %s) r2rrrunlinkr7r%r&r8 capitalize)r"r#r$r5cutoffrr:s r._unlink_older_thanr*s W  45( OA O668$$v-HHJ O O   !@%ANN O W >@P@P@RTUVVWs@.B-A!B! B*"B BBB C"/CCct|}tj}|tjj |dz dkry|tj|<t |d|dy)zHPrune old browser screenshots; throttled to once per hour per directory.rr&Nzbrowser_screenshot_*.png screenshot)r r2r%_last_screenshot_cleanup_by_dirrr*)screenshots_dirr$keyr0s r._cleanup_old_screenshotsr0!sZ o C ))+C S 0 0 4 4S# >>E/2C'',(BMS_`r4c tdz }|j rt |d|dyy#t$r*}tjj d|Yd}~yd}~wwxYw)zPrune old browser recordings.browser_recordingsz*Recording cleanup error (non-critical): %sNzsession_*.webm recording)r r7r%r&r8existsr*)r$recordings_dirr:s r._cleanup_old_recordingsr6+sa(*-AA>+;]KX  EqIs / A" AA"ctj|}||k(s"tjj||k(r!tjj |dyy)zDrop stale last-active ownership after cleaning ``task_id``: a bare task always, a sidecar only if it was still the recorded owner (a later click must not resurrect a cleaned sidecar while a primary-session binding is preserved).N)r%_bare_task_id_for_session_key_last_active_session_keyrra)rR bare_task_ids r._drop_last_active_bindingr;6sQ44W=Lw#">">"B"B<"PT["[ $$((t<#\r4c.|d}|g}|tj}tj5tj|s#|tjvr|j |ddd|D] }t |t|y#1swY'xYw)zClean up browser session(s) for a task: a bare task id reaps BOTH the primary session and any hybrid local sidecar; a ``::local`` key reaps only that one.Ndefault)r% _LOCAL_SUFFIXrJ_is_local_sidecar_keyrEappend_cleanup_single_browser_sessionr;)rR session_keys sidecar_key session_keys r.rhrh?s9LIc//01K  -((1kSEYEY6Y    ,-$5 ' 45g& --s 9B  Bc6tjj|d}tjj|sy t t |j djt|s"tjjdytfdsytjjdy#tttt f$r#tjjd YywxYw) zyTree-kill the daemon in ``/.pid`` if verifiably ours; True when a kill was issued. Never raises.rFrwrxz?Skipped daemon kill for %s: pid %s failed identity verificationcFtjjdS)Nz@Skipped daemon kill for %s: no start-time fingerprint for pid %s)r%r&r8)_arrss r.z'_kill_verified_daemon..Zs$PSPZPZP`P`RT`blQnr4zKilled daemon pid %s for %sTz?Could not kill daemon pid for %s (already dead or inaccessible))rzr{r|rrrrr!rr%r&r8rrr$rr)rrrsrrs ` @r._kill_verified_daemonrIOsww||J<.(=>H 77>>( # h1171CIIKL .z:|T JJ  ^`lnx y)*lEno 6 LQ  OW E Z\hisA C(C:!C9DDc|jdd}t|d|r(tj}| |j ||jdd}|rytjjt jd |}tjj|r$t||tj |d yyy#t $r*}t jjd|Yd}~d}~wwxYw) uUntrack ``task_id``, close its cloud provider session, kill its daemon — the unconditional tail of a teardown, and the whole of the janitor's force-reap path. The unconditional tail of ``_cleanup_single_browser_session``; also the whole of the janitor's force-reap path (#100738), which skips the polite agent-browser/Camofox ``close`` that kept failing but must still release the cloud session and the local Chromium. bb_session_idunknownT)r_Nz)Could not close cloud browser session: %srsrrr)rrb_cloud_get_cloud_provider close_sessionr7r%r&r'rzr{r|rr4rIrr)rRrrKproviderr:rsrrs r._release_session_resourcesrQds!$$_i@MWd3--/   S&&}5 ##NB7LWW\\#"9"9";~l^=\] 77>>* % !*l ; MM*D 9 &  S ""#NPQRR SsC D ! DD cftj|tj5tjj |}tj j|dtjj|dddr t||t|y#1swY#xYw)zJanitor last resort: skip the failing ``close`` round-trips, release resources directly. Janitor last resort after repeated cleanup failures (#100738). N) _cdp_stop_cdp_supervisorr%rJrErrLrarOdiscardrQr;)rRrs r.rjrjs  g&  1++//8  ""&&w5 ''01"7L9g& 11s AB''B0c.tjtjrfd}t d|tj j dtj j dttjjtj5tjj}ddds!tj j dytj j d|jdd tj|jd xsijd r d d l m}||jddnft#|r!tj j dn: t%j&dgdtj j dt)|tj j dy#1swYJxYw#t$r+}tj j!d|Yd}~id}~wwxYw#t$r+}tj j!d|Yd}~d}~wwxYw)z7Reap a single browser session by its exact session key.c8ddlm}m}|s |yy)Nr) camofox_closecamofox_soft_cleanup)tools.browser_camofoxrXrY)rXrYrRs r._camofox_cleanupz9_cleanup_single_browser_session.._camofox_cleanups Q'0g&1r4zCamofox cleanup for task z&cleanup_browser called for task_id: %szActive sessions: %sNz'No active session found for task_id: %sz+Found session for task %s: bb_session_id=%srKrLfeatures lightpandar)stop_lightpandarsrz&lightpanda stop failed for task %s: %sz3Skipping agent-browser close for expired session %sclose rz1agent-browser close command completed for task %sz*agent-browser close failed for task %s: %sz$Removed task %s from active sessions)rSrTr%_is_camofox_moder;r&r8rerEkeysrJr_maybe_stop_recordingr?r^r7r'r3_session_run_browser_commandrQ)rRr[rr^r:s` r.rArAs g&  ' 0 : C  C )rN)rzsubprocess.PopenrN))Hr)K__doc__ contextlibrzrrrrr2rrpathlibrtypingrrrr hermes_constantsr r r tools.browser_tool_originr r%toolsrrSrrMrrdrrtrrCr rr/rr3r;r@rQcontextmanagerr]rbrqrrrrrrrrsetrrPrrrrr r rr*r0r6r;rhrIrQrjrArHrr4r.rs   '--bb3*.22<DcNx.=A?sCx.?*25/? ?44D4 "IJ /#//6@DUZ1c11d1_c1%BP Y YC YD YKsK#K$K,,,25,:>,^**%*,#--C-E(3-QYZ^Q_B_<`- 3 c 4 33C33PT3l$^N2x$McM(6<$S$T$ W$ W WU WSV W[_ WaY=s=t= 'Xc] 'd ' c*::4S>:d:6 ' ' '-FS-FT-F`"r4