From aba57d0872d75e167d375db004b4d64f676bd11f Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Sat, 16 May 2026 16:24:48 -0700 Subject: [PATCH 01/62] disable_torchcodec_if_broken: also patch datasets and clean sys.modules (#5483) * disable_torchcodec_if_broken: also patch datasets and clean sys.modules (#5446) transformers's _torchcodec_available was being flipped to False already, but datasets keeps its own datasets.config.TORCHCODEC_AVAILABLE flag (datasets >= 4.0) that gates every torchcodec call site inside datasets/features/{audio,video}.py, datasets/features/features.py and the three datasets formatters. Without flipping that flag, transformers falls back to librosa but datasets still routes through torchcodec and re-raises the same RuntimeError, which is what users hit on Colab when libavutil is missing. Also pops half-loaded torchcodec submodules + datasets.features._torchcodec from sys.modules so a later re-import does not re-trigger the failed native-library dlopen. Verified live state after the patch on a Colab-like broken-torchcodec env: transformers._torchcodec_available = False transformers.is_torchcodec_available() = False datasets.config.TORCHCODEC_AVAILABLE = False stale torchcodec entries in sys.modules = [] * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * disable_torchcodec_if_broken: seat sys.modules[torchcodec]=None sentinel The first commit on this branch flipped the transformers and datasets availability flags, but a few unconditional torchcodec call sites in datasets / torchaudio (e.g. Audio.encode_example does "from torchcodec.encoders import AudioEncoder" outside the TORCHCODEC_AVAILABLE gate) still hit a cryptic RuntimeError from the broken native library load. Seating sys.modules["torchcodec"] = None makes any subsequent "import torchcodec" / "from torchcodec.X import Y" raise ModuleNotFoundError (subclass of ImportError) which the existing try/except ImportError blocks in datasets / torchaudio catch and re-raise as the clean "please install torchcodec" message users get when they uninstall torchcodec manually. This was the workaround in issue #5446. Also makes find_spec("torchcodec") return None on re-entry, so the function is a strict no-op on the second call. Verified across 12 scenarios in temp/torchcodec_test/: healthy torchcodec untouched, broken torchcodec sentinel-blocked, datasets 3.x without the flag handled, no-datasets-installed handled, py3.11 Colab- exact env (transformers==4.56.2 + trl==0.22.2) handled. Side-by-side on the user's exact stack: Audio.encode_example switches from "RuntimeError: Could not load libtorchcodec" to "ImportError: To support encoding audio data, please install 'torchcodec'.". * disable_torchcodec_if_broken: trim comments Same behaviour, shorter docstring and inline comments. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- unsloth/import_fixes.py | 72 +++++++++++++++++++++++------------------ 1 file changed, 40 insertions(+), 32 deletions(-) diff --git a/unsloth/import_fixes.py b/unsloth/import_fixes.py index 8476edc40a..182355640a 100644 --- a/unsloth/import_fixes.py +++ b/unsloth/import_fixes.py @@ -1289,53 +1289,61 @@ def patch_torchcodec_audio_decoder(): def disable_torchcodec_if_broken(): - """Disable torchcodec in transformers if it cannot actually load. + """Make broken torchcodec behave as if uninstalled (#5446). - transformers checks if torchcodec is installed via importlib.util.find_spec(), - but this returns True even when torchcodec cannot load its native libraries - (e.g., when FFmpeg is missing). This causes runtime errors when transformers - tries to use torchcodec for audio loading. - - This function tests if torchcodec can actually load and if not, patches - transformers to think torchcodec is unavailable so it falls back to librosa. - - Two shapes to cover: - * transformers < 5: a module-level ``_torchcodec_available`` flag - cached in ``transformers.utils.import_utils``; flip it to False. - * transformers >= 5: a public ``is_torchcodec_available()`` callable - wrapped with ``functools.lru_cache``; replace it with a stub that - returns False and clear the cache so subsequent callers see it. + transformers and datasets both detect torchcodec via find_spec, which + returns True even when the native libs cannot dlopen. We flip their + flags and seat a sys.modules sentinel so downstream imports fall through + their existing except ImportError handlers cleanly. """ try: import importlib.util if importlib.util.find_spec("torchcodec") is None: - return # torchcodec not installed, nothing to do + return # absent or already disabled - # Test if torchcodec can actually load + # RuntimeError on dlopen failure; OSError covers chained libavutil.so misses. from torchcodec.decoders import AudioDecoder except (ImportError, RuntimeError, OSError): - # torchcodec cannot load - disable it in transformers + # transformers: flip flag (<5) and/or rebind lru_cache'd func (>=5). try: import transformers.utils.import_utils as tf_import_utils - except ImportError: - return - # transformers < 5 path: module-level cached flag. - try: - tf_import_utils._torchcodec_available = False - except AttributeError: - pass - - # transformers >= 5 path: public lru_cache'd function. Clear any - # cached True result then rebind to a stub that returns False. - is_avail = getattr(tf_import_utils, "is_torchcodec_available", None) - if is_avail is not None: try: - is_avail.cache_clear() + tf_import_utils._torchcodec_available = False except AttributeError: pass - tf_import_utils.is_torchcodec_available = lambda: False + + is_avail = getattr(tf_import_utils, "is_torchcodec_available", None) + if is_avail is not None: + try: + is_avail.cache_clear() + except AttributeError: + pass + tf_import_utils.is_torchcodec_available = lambda: False + except ImportError: + pass + + # datasets >= 4.0: own flag gating audio/video/features/formatters. + try: + import datasets.config as datasets_config + + if hasattr(datasets_config, "TORCHCODEC_AVAILABLE"): + datasets_config.TORCHCODEC_AVAILABLE = False + except ImportError: + pass + + # Drop half-loaded entries and seat the absence sentinel. After this, + # import torchcodec raises ModuleNotFoundError and find_spec returns None. + for _stale in [ + n + for n in list(sys.modules) + if n == "torchcodec" + or n.startswith("torchcodec.") + or n == "datasets.features._torchcodec" + ]: + sys.modules.pop(_stale, None) + sys.modules["torchcodec"] = None def disable_broken_wandb(): From 79a431cd53cbae34c4026a4434af269d339f228b Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Sun, 17 May 2026 01:35:28 -0700 Subject: [PATCH 02/62] tests: pinned-symbol canary for unsloth-zoo save_pretrained_merged guards (#5410) (#5433) * tests: pinned-symbol canary for unsloth-zoo save_pretrained_merged guards (#5410) unsloth#5410 was a class of silent-write bug in the save_pretrained_merged path that the existing CI matrix could not detect because the merge-helper tests were not wired through the upstream-drift suite. The full fix lives in unslothai/unsloth-zoo#647 (layout-aware MoE merge helpers, authoritative num_experts resolver, loud-fail counter, generation_config.json save). This PR adds the unsloth-side canary that watches for the four guards staying in place in unsloth-zoo so a future refactor cannot silently regress them. tests/version_compat/test_unsloth_zoo_save_merged_pinned_symbols.py fetches unsloth_zoo/saving_utils.py + tests/test_unsloth_zoo_lora_merge.py from unslothai/unsloth-zoo:main and asserts: - _MOE_MERGE_STATE / _reset_moe_merge_state / _record_moe_merge_fallback are still defined and a `raise RuntimeError(...MoE...)` still fires when fallback > 0. - _detect_moe_lora_layout exists and both "swapped" / "standard" branch labels are reachable in the source. - _resolve_num_experts_from_lora_stats is present AND its base_layer walk is bounded by `for _ in range(N):` (a cyclic ParamWrapper chain must not hang the merge). - merge_and_overwrite_lora still calls model.generation_config.save_pretrained(...). - tests/test_unsloth_zoo_lora_merge.py keeps the six PEFT 0.19+ standard-layout regression tests added in #647. - Local unsloth/save.py still names save_pretrained_merged and routes through merge_and_overwrite_lora (i.e. the entry point still reaches the upstream fix). While #647 is still open, the four symbol tests SKIP cleanly with a message naming #647. When #647 merges into unsloth-zoo main, the same tests automatically become hard gates and catch any future regression. The sixth test (local entry-point grep) passes today. CPU-only static fetch, ~0.1s. Wired into the existing peft-pinned-symbols job in .github/workflows/version-compat-ci.yml so it runs on every PR that touches unsloth/** and on the daily schedule. Local run: 1 passed, 5 skipped (expected; #647 open). * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * tests/version_compat: relax MoE/generation_config regex to fit zoo#647 zoo#647 landed two layout changes that broke the pinned-symbol canary's exact-string regex matches but kept the underlying guarantees intact: - The post-loop MoE LoRA fallback `raise RuntimeError(...)` wraps the "MoE" wording onto a second line; the old `[^\n]*` did not cross newlines. Switch to `.*?` + re.DOTALL. - The generation_config save now binds the attr to a local var `gen_cfg = getattr(model, "generation_config", ...)` and calls `gen_cfg.save_pretrained(save_directory)`, so a literal `generation_config.save_pretrained(` substring no longer matches. Anchor on the conceptual operation: a `generation_config` mention followed (within a small char window) by a `.save_pretrained(` call. That is what the canary actually cares about. Verified locally: pytest tests/version_compat/test_unsloth_zoo_save_merged_pinned_symbols.py -> 2 passed (4 deselected) --------- Co-authored-by: Daniel Han-Chen Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- .github/workflows/version-compat-ci.yml | 1 + ..._unsloth_zoo_save_merged_pinned_symbols.py | 128 ++++++++++++++++++ 2 files changed, 129 insertions(+) create mode 100644 tests/version_compat/test_unsloth_zoo_save_merged_pinned_symbols.py diff --git a/.github/workflows/version-compat-ci.yml b/.github/workflows/version-compat-ci.yml index 2fbdd15747..599b53df1d 100644 --- a/.github/workflows/version-compat-ci.yml +++ b/.github/workflows/version-compat-ci.yml @@ -127,6 +127,7 @@ jobs: run: | PYTHONPATH=. python -m pytest \ tests/version_compat/test_peft_pinned_symbols.py \ + tests/version_compat/test_unsloth_zoo_save_merged_pinned_symbols.py \ -v --tb=short st-pinned-symbols: diff --git a/tests/version_compat/test_unsloth_zoo_save_merged_pinned_symbols.py b/tests/version_compat/test_unsloth_zoo_save_merged_pinned_symbols.py new file mode 100644 index 0000000000..19faa51119 --- /dev/null +++ b/tests/version_compat/test_unsloth_zoo_save_merged_pinned_symbols.py @@ -0,0 +1,128 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. +"""Pinned-symbol canary for unsloth-zoo save_pretrained_merged guards +(unslothai/unsloth-zoo#647 / unslothai/unsloth#5410). Skips until #647 +lands, then becomes a hard gate. CPU-only static fetch.""" + +from __future__ import annotations + +import re + +import pytest + +from tests.version_compat._fetch import fetch_text + + +ZOO_TAG = "main" + + +def _fetch_saving_utils() -> str: + src = fetch_text("unslothai/unsloth-zoo", ZOO_TAG, "unsloth_zoo/saving_utils.py") + if src is None: + pytest.skip("unsloth_zoo/saving_utils.py not fetchable") + return src + + +def _fetch_merge_tests() -> str: + src = fetch_text( + "unslothai/unsloth-zoo", + ZOO_TAG, + "tests/test_unsloth_zoo_lora_merge.py", + ) + if src is None: + pytest.skip("tests/test_unsloth_zoo_lora_merge.py not fetchable") + return src + + +def _skip_until_pr_647_lands(src: str) -> None: + if not any( + m in src + for m in ( + "_MOE_MERGE_STATE", + "_detect_moe_lora_layout", + "_resolve_num_experts_from_lora_stats", + ) + ): + pytest.skip( + "unslothai/unsloth-zoo#647 has not yet merged into main; " + "tests auto-promote to hard gates once it lands." + ) + + +def test_zoo_saving_utils_has_moe_merge_state(): + src = _fetch_saving_utils() + _skip_until_pr_647_lands(src) + for sym in ( + "_MOE_MERGE_STATE", + "_reset_moe_merge_state", + "_record_moe_merge_fallback", + ): + assert sym in src, f"{sym} missing from saving_utils.py (issue #5410 guard)." + # zoo#647 wraps the fallback guard's message onto a second line; + # allow the regex to span newlines via re.DOTALL. + assert re.search( + r"raise\s+RuntimeError\b.*?MoE", src, re.IGNORECASE | re.DOTALL + ), "no `raise RuntimeError(...MoE...)`; post-loop guard weakened." + + +def test_zoo_saving_utils_has_layout_detector(): + src = _fetch_saving_utils() + _skip_until_pr_647_lands(src) + assert ( + "_detect_moe_lora_layout" in src + ), "_detect_moe_lora_layout removed (issue #5410)." + assert ( + '"swapped"' in src and '"standard"' in src + ), "one of the layout labels removed." + + +def test_zoo_saving_utils_has_num_experts_resolver(): + src = _fetch_saving_utils() + _skip_until_pr_647_lands(src) + assert "_resolve_num_experts_from_lora_stats" in src, "resolver removed (#5410)." + assert re.search( + r"for\s+_\s+in\s+range\s*\(\s*\d+\s*\)", src + ), "resolver walk no longer bounded by `for _ in range(N):`." + + +def test_zoo_saving_utils_writes_generation_config(): + src = _fetch_saving_utils() + _skip_until_pr_647_lands(src) + # zoo#647 binds the generation_config attr to a local var + # (`gen_cfg = getattr(model, "generation_config", ...); ... + # gen_cfg.save_pretrained(save_directory)`) so an exact + # `generation_config.save_pretrained(` substring no longer + # matches. Anchor on the conceptual operation: a `generation_config` + # mention plus a `.save_pretrained(` call nearby, which is what + # the canary actually cares about. + assert re.search( + r"generation_config[\s\S]{0,400}?\.save_pretrained\s*\(", src + ), "generation_config.json no longer saved (#5410)." + + +def test_zoo_lora_merge_tests_have_standard_layout_coverage(): + src = _fetch_merge_tests() + if "test_merge_moe_gate_expert_standard_layout" not in src: + pytest.skip("unslothai/unsloth-zoo#647 not yet merged; coverage appears later.") + for name in ( + "test_merge_moe_gate_expert_standard_layout", + "test_merge_moe_up_expert_standard_layout", + "test_merge_moe_down_proj_expert_standard_layout", + "test_detect_moe_lora_layout_classifies_both_conventions", + "test_moe_merge_fallback_counter_records_bad_layout", + "test_resolve_num_experts_walks_base_layer_chain", + ): + assert name in src, f"regression test `{name}` removed." + + +def test_unsloth_save_pretrained_merged_entry_point_exists(): + import pathlib + + save_py = pathlib.Path(__file__).resolve().parents[2] / "unsloth" / "save.py" + if not save_py.is_file(): + pytest.skip(f"{save_py} not present") + text = save_py.read_text(encoding = "utf-8", errors = "replace") + assert "save_pretrained_merged" in text, "entry point removed from unsloth/save.py." + assert ( + "merge_and_overwrite_lora" in text + ), "no dispatch into unsloth_zoo merge; #647 bypassed." From e20bbeff9afdb0cc1f96093e558aac7e434278c4 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Sun, 17 May 2026 01:40:20 -0700 Subject: [PATCH 03/62] intel-gpu: pin unsloth_zoo>=2026.5.2 via huggingfacenotorch (#5499) Fixes unslothai/unsloth#5494: installing any intel-gpu-torch* extra without also pulling `huggingface` or `colab-new` lets the resolver silently fall back to a stale unsloth_zoo (2026.3.6 in the original report) because no version floor is enforced on `unsloth_zoo[intelgpu]` in those blocks. unsloth_zoo 2026.5.2 (just released) also relaxes its own torch upper bound from <2.11.0 to <2.13.0, which is what unblocks the resolver for the intel-gpu-torch2110 and intel-gpu-torch2120 extras shipped in #5484. Adding the floor in `huggingfacenotorch` propagates it to every extra that includes the HF-without-torch base: amd, huggingface, and all nine intelgputorch* blocks. Single line, single source of truth. Requires unsloth_zoo 2026.5.2 to be on PyPI for end-to-end resolution. --- pyproject.toml | 1 + 1 file changed, 1 insertion(+) diff --git a/pyproject.toml b/pyproject.toml index 3468f7f8a7..81cf5ac215 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -69,6 +69,7 @@ triton = [ ] huggingfacenotorch = [ + "unsloth_zoo>=2026.5.2", "wheel>=0.42.0", "packaging", "numpy", From fb13275787451bd67bba88e546c94e4636f353e2 Mon Sep 17 00:00:00 2001 From: Etherll <61019402+Etherll@users.noreply.github.com> Date: Sun, 17 May 2026 14:02:36 +0300 Subject: [PATCH 04/62] fix(sentence_transformer): resume PEFT checkpoints under sentence-transformers >= 5.4 (#5454) Saves the base config.json next to adapter_config.json when checkpointing PEFT-wrapped sentence-transformer models, and overrides SentenceTransformerTrainer._load_from_checkpoint to load adapter weights via set_peft_model_state_dict and rebuild aux modules (Pooling, Normalize, Dense) from modules.json with strict type and path validation. Patches only activate on Unsloth-managed Transformer modules so non-Unsloth pipelines fall through to upstream behaviour. Fixes https://github.com/unslothai/unsloth/issues/5373 --- unsloth/models/sentence_transformer.py | 181 ++++++++++++++++++++++++- 1 file changed, 180 insertions(+), 1 deletion(-) diff --git a/unsloth/models/sentence_transformer.py b/unsloth/models/sentence_transformer.py index c53e3a7a81..aafc416221 100644 --- a/unsloth/models/sentence_transformer.py +++ b/unsloth/models/sentence_transformer.py @@ -527,6 +527,45 @@ This sentence-transformers model was finetuned and converted to GGUF format usin class FastSentenceTransformer(FastModel): + @staticmethod + def _save_base_config_for_processor_resume(config, output_path): + """ + sentence-transformers >= 5.4 reloads Transformer modules through + AutoProcessor. Tokenizer-only checkpoint roots make AutoProcessor fall + back to AutoConfig, so PEFT adapter checkpoints still need the base + config.json next to adapter_config.json. + """ + if config is None or not getattr(config, "model_type", None): + return + if hasattr(config, "save_pretrained"): + config.save_pretrained(output_path) + elif hasattr(config, "to_json_file"): + config_path = os.path.join(output_path, "config.json") + config.to_json_file(config_path) + + @staticmethod + def _patch_transformer_module_save_config(transformer_module, base_config = None): + transformer_module._unsloth_st_managed = True + if base_config is not None and getattr(base_config, "model_type", None): + transformer_module._unsloth_base_config = base_config + + if getattr(transformer_module, "_unsloth_save_config_patched", False): + return transformer_module + + original_save = transformer_module.save + + def _save_with_base_config(self, output_path, *args, **kwargs): + original_save(output_path, *args, **kwargs) + FastSentenceTransformer._save_base_config_for_processor_resume( + getattr(self, "_unsloth_base_config", None), output_path + ) + + transformer_module.save = types.MethodType( + _save_with_base_config, transformer_module + ) + transformer_module._unsloth_save_config_patched = True + return transformer_module + @staticmethod def _read_pooling_mode(model_name, token): """ @@ -1157,6 +1196,9 @@ class FastSentenceTransformer(FastModel): config_keys.append(config_key) transformer_module.config_keys = config_keys transformer_module.save_in_root = True + FastSentenceTransformer._patch_transformer_module_save_config( + transformer_module, getattr(model, "config", None) + ) if hasattr(model, "config"): model.config.tokenizer_class = tokenizer.__class__.__name__ @@ -1644,6 +1686,9 @@ class FastSentenceTransformer(FastModel): st_model._dtype = dtype st_model._load_in_4bit = load_in_4bit st_model.no_modules = False + FastSentenceTransformer._patch_transformer_module_save_config( + st_model[0], getattr(st_model[0].auto_model, "config", None) + ) # Add save methods def _save_pretrained_merged(self, save_directory, **save_kwargs): @@ -2067,6 +2112,9 @@ class FastSentenceTransformer(FastModel): transformer_module.model = peft_model else: transformer_module.auto_model = peft_model + FastSentenceTransformer._patch_transformer_module_save_config( + transformer_module, getattr(inner_model, "config", None) + ) # Store compile info for auto-compile at trainer time # torch.compile is deferred until training starts so we can check max_steps @@ -2121,6 +2169,9 @@ class FastSentenceTransformer(FastModel): transformer_module.model = peft_model else: transformer_module.auto_model = peft_model + FastSentenceTransformer._patch_transformer_module_save_config( + transformer_module, getattr(inner_model, "config", None) + ) return model else: return FastModel.get_peft_model( @@ -2235,5 +2286,133 @@ def _patch_sentence_transformer_trainer(): SentenceTransformerTrainer._unsloth_auto_compile_patched = True -# Auto-patch trainer on module import +def _patch_st_trainer_load_from_checkpoint(): + try: + from sentence_transformers import SentenceTransformerTrainer + except ImportError: + return + if getattr( + SentenceTransformerTrainer, "_unsloth_load_from_checkpoint_patched", False + ): + return + if not hasattr(SentenceTransformerTrainer, "_load_from_checkpoint"): + return + + _original = SentenceTransformerTrainer._load_from_checkpoint + + def _unsloth_load_from_checkpoint(self, checkpoint_path): + try: + from peft import PeftModel, load_peft_weights, set_peft_model_state_dict + except ImportError: + return _original(self, checkpoint_path) + + try: + mod0 = self.model[0] + except (IndexError, TypeError): + return _original(self, checkpoint_path) + + if isinstance(getattr(type(mod0), "auto_model", None), property): + inner = getattr(mod0, "model", None) + else: + inner = getattr(mod0, "auto_model", None) + inner = getattr(inner, "_orig_mod", inner) + + if not isinstance(inner, PeftModel): + return _original(self, checkpoint_path) + if not getattr(mod0, "_unsloth_st_managed", False): + return _original(self, checkpoint_path) + + if not any( + os.path.isfile(os.path.join(checkpoint_path, fn)) + for fn in ("adapter_model.safetensors", "adapter_model.bin") + ): + return _original(self, checkpoint_path) + + adapter_name = getattr(inner, "active_adapter", None) + if adapter_name is None and callable(getattr(inner, "active_adapters", None)): + adapter_name = inner.active_adapters() + if isinstance(adapter_name, (list, tuple, set)): + if len(adapter_name) != 1: + raise RuntimeError( + "Unsloth: Cannot resume multiple active PEFT adapters." + ) + adapter_name = next(iter(adapter_name)) + adapter_name = adapter_name or "default" + if adapter_name not in getattr(inner, "peft_config", {}): + raise RuntimeError(f"Unsloth: PEFT adapter {adapter_name!r} is not loaded.") + + load_result = set_peft_model_state_dict( + inner, load_peft_weights(checkpoint_path), adapter_name = adapter_name + ) + unexpected = getattr(load_result, "unexpected_keys", []) or [] + missing = [ + x + for x in (getattr(load_result, "missing_keys", []) or []) + if f".{adapter_name}." in x or x.endswith(f".{adapter_name}") + ] + if unexpected or missing: + raise RuntimeError( + "Unsloth: PEFT checkpoint does not match the active adapter " + f"(missing={missing[:8]}, unexpected={unexpected[:8]})." + ) + + modules_json = os.path.join(checkpoint_path, "modules.json") + if not os.path.isfile(modules_json): + raise RuntimeError("Unsloth: PEFT checkpoint is missing modules.json.") + try: + with open(modules_json, "r") as f: + module_configs = json.load(f) + except Exception as e: + raise RuntimeError("Unsloth: Cannot parse checkpoint modules.json.") from e + + root = os.path.abspath(os.fspath(checkpoint_path)) + restored = set() + for entry in module_configs: + idx = int(entry.get("idx", -1)) + if idx == 0: + continue + if idx < 0 or idx >= len(self.model): + raise RuntimeError(f"Unsloth: Bad module index in modules.json: {idx}.") + module = self.model[idx] + module_cls = type(module) + saved_type = entry.get("type", "") + if saved_type and not saved_type.endswith(f".{module_cls.__name__}"): + raise RuntimeError(f"Unsloth: Checkpoint module {idx} type mismatch.") + module_path = entry.get("path") + module_dir = os.path.abspath( + os.path.join(root, os.fspath(module_path or "")) + ) + try: + inside_root = os.path.commonpath([root, module_dir]) == root + except ValueError: + inside_root = False + if not module_path or not inside_root or not os.path.isdir(module_dir): + raise RuntimeError( + f"Unsloth: Bad checkpoint module path for index {idx}." + ) + if not hasattr(module_cls, "load"): + raise RuntimeError(f"Unsloth: Module {idx} cannot be reloaded.") + fresh = module_cls.load(module_dir) + if not isinstance(fresh, module_cls): + raise RuntimeError(f"Unsloth: Module {idx} reload returned wrong type.") + # Parameterless modules (Pooling, Normalize) make + # next(module.parameters()) raise StopIteration; route through + # the SentenceTransformer's device property instead. + try: + fresh.to(self.model.device) + except AttributeError: + pass + self.model[idx] = fresh + restored.add(idx) + missing_idx = sorted(set(range(1, len(self.model))) - restored) + if missing_idx: + raise RuntimeError( + f"Unsloth: Checkpoint modules.json is incomplete (missing idx={missing_idx[:8]})." + ) + + SentenceTransformerTrainer._load_from_checkpoint = _unsloth_load_from_checkpoint + SentenceTransformerTrainer._unsloth_load_from_checkpoint_patched = True + + _patch_sentence_transformer_trainer() +_patch_st_trainer_load_from_checkpoint() From ab56e4a9edaeae839d6b229429b30e36605b26a7 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Sun, 17 May 2026 04:16:09 -0700 Subject: [PATCH 05/62] Studio: serialise GGUF reload and inherit unsloth-run extra args (#5427) * Studio: serialise GGUF reload and inherit unsloth-run extra args Closes #5401. Three related GGUF reload bugs reproduced against `unsloth studio run -m unsloth/Qwen3-0.6B-GGUF --gguf-variant Q4_K_M --top-k 20 --seed 42`: 1. The `POST /api/inference/load` already-loaded short-circuit only compared `model_identifier` and `hf_variant`. A same-(model, variant) Apply that flipped `cache_type_kv` / `speculative_type` / `chat_template_override` / `max_seq_length` / `llama_extra_args` returned `status="already_loaded"` and the new setting silently never reached llama-server. 2. The frontend chat-settings Apply path POSTs `/unload` then `/load` without round-tripping `llama_extra_args`. Every reload after `unsloth run --some-flag X` quietly dropped `--some-flag X` from the spawned `llama-server` command line. 3. `LlamaCppBackend.load_model` released `_lock` between Phase 1 (kill) and Phase 3 (spawn) so two concurrent loads each passed Phase 1 with `self._process is None`. Both ran Phase 2 (download), both reached Phase 3, and the Phase 3 defensive `_kill_process()` from #5171 collapsed them to one survivor only after both `subprocess.Popen` calls had landed. For the 86 GB MoE in #5161 / the model in #5401 the overlap window was tens of seconds, long enough to OOM the host. With a 0.6B model the pgrep timeline showed two simultaneous PIDs for 3.3 s on `main`. Fix: `studio/backend/core/inference/llama_cpp.py` * Add `self._serial_load_lock = threading.Lock()`. The whole body of `load_model` runs under this lock so two concurrent `/api/inference/load` requests are strictly sequential. The fine-grained `_lock` and the Phase 3 defensive `_kill_process()` from #5171 are kept as a second layer. `/unload`, `/status`, and `/load-progress` are unaffected because they only touch the fine-grained lock or read properties. * Add `self._extra_args` plus an `extra_args` property, written inside `load_model` whenever the caller supplies a non-`None` value. `unload_model()` deliberately does not reset it so the route layer can inherit the args across the frontend's `/unload` + `/load` gap. `studio/backend/routes/inference.py` * Add `_request_matches_loaded_settings(request, llama_backend)` that compares `max_seq_length`, `cache_type_kv`, `speculative_type`, `chat_template_override`, and `llama_extra_args` between the incoming request and the live backend. Same-(model, variant) requests whose runtime settings differ now fall through to a real reload instead of returning `already_loaded`. A missing `llama_extra_args` field on the request is treated as "inherit current", so the short-circuit still fires when the only difference is the frontend not echoing the CLI flags back. * GGUF load branch inherits `llama_extra_args` from `llama_backend.extra_args` when the request omits the field, re-validates through `validate_extra_args`, and forwards the result to `load_model(...)`. An explicit `[]` from the caller is still honoured as "clear". Verified end to end against a live `unsloth studio run` instance: | Scenario | Before | After | | --------------------------------------------------------------- | --------- | ------------------------------------------------------------------------ | | `/load` same (model, variant, settings) | 1 PID, `already_loaded` | unchanged | | `/load` same model, variant, new `cache_type_kv=q8_0` ctx=8192 | `already_loaded`, settings dropped | `loaded`, `/status` reports the new settings, new server has `-c 8192 --cache-type-k q8_0 --top-k 20 --seed 42` | | Frontend Apply `/unload` + `/load`, new settings, no `llama_extra_args` field | Drops `--top-k 20 --seed 42` | Preserves `--top-k 20 --seed 42` | | `/unload` + two parallel `/load` | Two PIDs for 3.3 s | Max simultaneous count = 1 across the full pgrep timeline | | `/load` with `llama_extra_args=[]` (explicit clear) | n/a | `loaded`, new server has no `--top-k` / `--seed` | | `/load` with `llama_extra_args=["--top-k","30","--seed","7"]` (override) | n/a | `loaded`, new server has the supplied flags | `pytest studio/backend/tests` is green except for one pre-existing terminal-width-sensitive assertion (`test_studio_api.py::test_help_output`) and the pre-existing `test_studio_api.py` fixture errors that fail on unmodified main too. No new regressions. * Studio: track requested n_ctx so Auto-slider flips trigger a reload Review feedback on PR #5427 from gemini-code-assist. The original short-circuit compared ``request.max_seq_length`` against ``llama_backend.context_length`` (the effective context). VRAM-fit logic can cap the running server below what the caller asked for, so this comparison incorrectly returns ``already_loaded`` when the user flips the slider from an explicit length (e.g. 8192) back to "Auto" (0): the explicit request was capped to, say, 4096, and the new "Auto" request reads ``backend.context_length == 4096`` and decides nothing changed. Track the originally requested ``n_ctx`` on the backend instead and compare against that. ``requested_n_ctx == 0`` means the last load asked for the model's native length; ``request.max_seq_length == 0`` matches it. Verified in the sandbox suite (now 90 tests): - ``test_explicit_to_auto_triggers_reload`` -- loaded with explicit 8192, then Apply with ``max_seq_length=0`` falls through to a real reload and the new server runs at the native 40960. - ``test_auto_to_explicit_triggers_reload`` -- inverse direction. - ``test_explicit_to_same_explicit_short_circuits`` -- re-Apply with the same explicit value still short-circuits (no needless reload). - Existing scenarios (kv change, spec change, template change, extra args inherit, parallel-load stress, frontend Apply flow) unchanged. ``pytest studio/backend/tests`` still green on the same set of tests; the pre-existing ``test_help_output`` failure and ``test_studio_api`` fixture errors are unaffected. * Studio: tighten comments in the 5401 fix Trim the verbose explanatory comments and docstrings introduced in f9cbec3b and dd0b1d58 down to one-line summaries. The "why" still points at issue #5401; the multi-paragraph rationale belonged in the PR body, not the source. No behaviour change. * ci: retrigger after zoo drift + IPython fixes landed in main * ci: retrigger Mac Studio UI CI after transient fetch flake * Studio: address six P2 followups on the 5401 reload PR Tightens the inheritance and serial-load paths to close the six P2 findings raised by codex-connector on PR #5427 against `f9cbec3b` / `dd0b1d58`. 1. Re-check loaded state before killing queued loads. Two duplicate `/api/inference/load` requests both pass the route-level `is_loaded` gate before the first publishes `_healthy = True`. The second waits on `_serial_load_lock`, enters Phase 1, and tears down the just-spawned llama-server for a redundant full reload. Added `LlamaCppBackend._already_in_target_state(...)` and a short-circuit at the top of the serial-lock block: if the live server already satisfies the kwargs, return True without killing. 2. Don't inherit CLI overrides that shadow new first-class settings. `unsloth run -c 4096` is a permitted pass-through; the validator docs explicitly call out `-c`/`--ctx-size`. Stored in `_extra_args` and appended after Studio's own flags, the inherited `-c 4096` silently won the last-wins parse against a new `max_seq_length=8192`. Added `strip_shadowing_flags` in `llama_server_args.py` (covers `-c`, `--cache-type-k/v`, `--spec-*`, `--chat-template*`, `--jinja`/`--no-jinja`) and the route runs the inherited list through it before validate + forward. 3. Restrict inherited llama args to the same GGUF model. `_extra_args` is deliberately preserved across `unload_model()` for the chat- settings Apply flow (`/unload` + `/load` with no `llama_extra_args` field). Now also track `_extra_args_source = (model_identifier, hf_variant)` so the route can refuse cross-model inheritance. `LlamaCppBackend.extra_args_source` exposes the tuple. 4. Persist extras only after a successful load. `_extra_args` was written at the top of `load_model` before Popen + health check, so a failed startup left bad args in place to poison the next UI retry. The write (along with `_requested_n_ctx`) is now deferred until after `_healthy = True`. 5. Ignore speculative diffs for vision loads. `load_model` silently gates speculative decoding on `not is_vision`, so the backend's `_speculative_type` stays `None` for vision models. The route's comparator now normalises the request's value to `"off"` when `llama_backend.is_vision` to avoid a no-op reload of a vision server every time the dropdown defaults to `default`. The `_already_in_target_state` helper applies the same rule. 6. Wait for the replacement server before short-circuiting. `_kill_process` did not clear `_healthy`; the new first-class settings (`_cache_type_kv`, `_speculative_type`, `_chat_template_override`) are written under `_lock` BEFORE Popen + `_wait_for_health`. A duplicate `/load` arriving during the new server's warm-up window could short-circuit against the not-yet-healthy replacement and the caller would start inference against a server that was still loading. `_kill_process` now sets `_healthy = False` in its `finally` block so `is_loaded` returns False from the moment the old server is killed until the new one finishes warm-up. Tests: - Sandbox suite under `./temp/sim_5401/` extended to 136 tests (was 90): new unit coverage for `strip_shadowing_flags` (12 cases), `_kill_process` clears `_healthy`, `extra_args_source` lifecycle and cross-model behaviour, failed-load preserving prior extras, and the duplicate-load short-circuit at `load_model` level. New live integration cases verify shadow-strip via `pgrep` on the live llama-server cmdline, cross-model refusal, and PID stability across a duplicate-load race. All 136 pass. - `pytest studio/backend/tests --deselect test_studio_api.py`: 1079 passed, 46 skipped, identical to the pre-change count. The pre-existing `test_studio_api.py` fixture errors and the terminal-width-sensitive `test_help_output` are unaffected. - Ruff: clean on the three modified files. * Studio: tighten GGUF reload inheritance and duplicate-load guard Re-narrow llama_extra_args to None after validate_extra_args when the incoming request omitted the field, so the backend can distinguish "caller omitted, inherit prior load" from "caller explicitly cleared to []". Without this a queued duplicate /load reaches the backend as [] and fails _already_in_target_state's exact-equality check, killing the just-started llama-server. The pass-through validate call from the original "forward llama-server args from unsloth studio run / unsloth run" change is preserved as-is; only the post-pass narrowing is new. Cross-source loads now explicitly clear extras so a model switch can't accidentally inherit via the backend's "no opinion" semantics. Store the caller's hf_variant kwarg (None for local GGUF files) in _extra_args_source instead of the derived self._hf_variant (an extracted filename quant label like "Q4_K_M"). Same-source check in the route is now symmetric for HF and direct-file loads. Add gguf_path to _already_in_target_state and prefer on-disk path identity when both backend and caller have a path. This stops the duplicate-load guard from killing a healthy server on repeat local loads (where hf_variant is None on the caller side but extracted on the backend side). Split shadow-flag stripping into per-group toggles (context / cache / spec / template). The route now opts into stripping only the groups whose first-class field was actually set on the incoming request, so an inherited --chat-template-file survives an Apply that omits chat_template_override. _request_matches_loaded_settings detects shadowing extras on the inherit path and falls through to a real reload so the strip can run. Mark --spec-default, --jinja, --no-jinja as boolean inside the shadow stripper so the value-consuming heuristic no longer eats the following positional token. * Studio: trim comments around GGUF reload inheritance * Studio: cover GGUF reload inheritance and shadow-flag stripping * Studio: drop redundant issue refs from inheritance comments * Studio: drop redundant issue refs from inheritance comments * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: key inheritance source off resolved gguf_variant codex-connector P2 on PR #5427 cd14cae1: the inheritance gate at ``routes/inference.py:696`` compared the stored ``source[1]`` against ``request.gguf_variant``, but the HF branch loaded with ``hf_variant = config.gguf_variant`` (the *resolved* variant after ModelConfig auto-pick). When the caller omitted ``gguf_variant`` on a follow-up Apply, ``source[1] == "Q4_K_M"`` but ``(request.gguf_variant or "") == ""``, ``same_source`` returned False, and the chat-settings Apply silently dropped CLI pass-through flags for every auto-pick / local-file load. Fix both sides of the comparison to key off ``config.gguf_variant``: * The route compares ``source[1]`` to ``config.gguf_variant`` (the resolved label) rather than the request field. * The local-mode load_model call now passes ``hf_variant = config.gguf_variant`` so ``_extra_args_source`` stores the same string the route reads back. The HF branch already did this. Sandbox: added test_source_records_caller_variant_not_extracted_label to lock the storage key contract. ``pytest studio/backend/tests --deselect test_studio_api.py``: 1100 passed, identical to pre-change. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Studio: deny upstream --ui family on llama-server pass-through The validator's web-UI block named only ``--webui`` / ``--no-webui``, which is llama.cpp's pre-rename spelling. Current upstream (``tools/server/README.md``) uses ``--ui`` / ``--no-ui`` plus ``--ui-config``, ``--ui-config-file``, and ``--ui-mcp-proxy`` / ``--no-ui-mcp-proxy``. Without these in the denylist a user could ``unsloth run --ui`` and enable llama-server's built-in web UI on the port Studio's reverse proxy targets, breaking the UI surface. Keep the legacy ``--webui`` group so the validator still rejects old binaries that haven't been re-spelled. Cross-referenced against the README's full flag list; this was the only gap for the post-#5401 inheritance / shadow-strip work. Pass- through flags from every other README category (sampling, jinja, ctx, cache, threads, GPU, reasoning, grammar, chat-template-kwargs) already validate cleanly; sandbox suite exercises ~60 of them in the new ``test_08_llama_server_pass_through.py``. ``pytest studio/backend/tests --deselect test_studio_api.py``: 1100 passed, identical to pre-change. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/core/inference/llama_cpp.py | 1357 +++++++++-------- .../core/inference/llama_server_args.py | 100 ++ studio/backend/routes/inference.py | 137 +- .../tests/test_gguf_reload_inheritance.py | 237 +++ .../backend/tests/test_llama_server_args.py | 118 ++ 5 files changed, 1348 insertions(+), 601 deletions(-) create mode 100644 studio/backend/tests/test_gguf_reload_inheritance.py diff --git a/studio/backend/core/inference/llama_cpp.py b/studio/backend/core/inference/llama_cpp.py index 7ef687035c..3682f1dbbb 100644 --- a/studio/backend/core/inference/llama_cpp.py +++ b/studio/backend/core/inference/llama_cpp.py @@ -470,6 +470,17 @@ class LlamaCppBackend: # their own cache (Gemma 3n / Gemma 4: .attention.shared_kv_layers). self._shared_kv_layers: Optional[int] = None self._lock = threading.Lock() + # Wraps load_model() end-to-end so concurrent loads serialise + # and never coexist as two llama-server processes (#5401). + self._serial_load_lock = threading.Lock() + # Last extra_args / requested n_ctx, preserved across unload so + # the chat UI's /unload+/load Apply path can inherit them (#5401). + # ``_extra_args_source`` records the (model_identifier, hf_variant) + # the stored args came from so the route can refuse cross-model + # inheritance. + self._extra_args: Optional[List[str]] = None + self._extra_args_source: Optional[tuple[str, Optional[str]]] = None + self._requested_n_ctx: int = 0 self._stdout_lines: list[str] = [] self._stdout_thread: Optional[threading.Thread] = None self._cancel_event = threading.Event() @@ -505,6 +516,25 @@ class LlamaCppBackend: def hf_variant(self) -> Optional[str]: return self._hf_variant + @property + def extra_args(self) -> Optional[List[str]]: + """Extra llama-server flags from the last load. Copy; None = never + set, [] = explicitly cleared. Used by the route for inheritance.""" + return list(self._extra_args) if self._extra_args is not None else None + + @property + def requested_n_ctx(self) -> int: + """n_ctx the last load was invoked with (not the effective cap). + 0 means Auto. Used by the route to detect Auto-vs-explicit flips.""" + return self._requested_n_ctx + + @property + def extra_args_source(self) -> Optional[tuple[str, Optional[str]]]: + """(model_identifier, hf_variant) the stored extra_args came from. + ``None`` if no extras have ever been recorded. Used by the route + to refuse cross-model inheritance (#5401).""" + return self._extra_args_source + @property def context_length(self) -> Optional[int]: """Return the effective context length the server is running at.""" @@ -1983,653 +2013,778 @@ class LlamaCppBackend: Returns True if server started and health check passed. """ - self._cancel_event.clear() - - # ── Phase 1: kill old process (under lock, fast) ────────── - with self._lock: - self._kill_process() - - binary = self._find_llama_server_binary() - if not binary: - raise RuntimeError( - "llama-server binary not found. " - "Run setup.sh to build it, install llama.cpp, " - "or set LLAMA_SERVER_PATH environment variable." - ) - - # ── Phase 2: download (NO lock held, so cancel can proceed) ── - if hf_repo: - model_path = self._download_gguf( - hf_repo = hf_repo, + # Serialise the whole load so concurrent /load calls never + # leave two llama-server processes alive (#5401 / #5161). Does + # not block /unload, /status, /load-progress. + with self._serial_load_lock: + # Duplicate /load that raced past the route-level check + # (the first one hadn't published _healthy=True yet). If the + # live server already satisfies this request, do nothing. + if self._already_in_target_state( + gguf_path = gguf_path, + model_identifier = model_identifier, hf_variant = hf_variant, - hf_token = hf_token, - ) - # Auto-download mmproj for vision models - if is_vision and not mmproj_path: - mmproj_path = self._download_mmproj( + n_ctx = n_ctx, + cache_type_kv = cache_type_kv, + speculative_type = speculative_type, + chat_template_override = chat_template_override, + extra_args = extra_args, + is_vision = is_vision, + ): + logger.info( + f"load_model: backend already in target state for " + f"'{model_identifier}', skipping reload" + ) + return True + + self._cancel_event.clear() + + # ── Phase 1: kill old process (under lock, fast) ────────── + with self._lock: + self._kill_process() + + binary = self._find_llama_server_binary() + if not binary: + raise RuntimeError( + "llama-server binary not found. " + "Run setup.sh to build it, install llama.cpp, " + "or set LLAMA_SERVER_PATH environment variable." + ) + + # ── Phase 2: download (NO lock held, so cancel can proceed) ── + if hf_repo: + model_path = self._download_gguf( hf_repo = hf_repo, + hf_variant = hf_variant, hf_token = hf_token, ) - elif gguf_path: - if not Path(gguf_path).is_file(): - raise FileNotFoundError(f"GGUF file not found: {gguf_path}") - model_path = gguf_path - else: - raise ValueError("Either gguf_path or hf_repo must be provided") + # Auto-download mmproj for vision models + if is_vision and not mmproj_path: + mmproj_path = self._download_mmproj( + hf_repo = hf_repo, + hf_token = hf_token, + ) + elif gguf_path: + if not Path(gguf_path).is_file(): + raise FileNotFoundError(f"GGUF file not found: {gguf_path}") + model_path = gguf_path + else: + raise ValueError("Either gguf_path or hf_repo must be provided") - # Set identifier early so _read_gguf_metadata can use it for DeepSeek detection - self._model_identifier = model_identifier + # Set identifier early so _read_gguf_metadata can use it for DeepSeek detection + self._model_identifier = model_identifier - # Read GGUF metadata (context_length, chat_template) -- fast, header only - self._read_gguf_metadata(model_path) + # Read GGUF metadata (context_length, chat_template) -- fast, header only + self._read_gguf_metadata(model_path) - # Check cancel after download - if self._cancel_event.is_set(): - logger.info("Load cancelled after download phase") - return False - - # ── Phase 3: start llama-server (under lock) ────────────── - with self._lock: - # Re-check cancel inside lock + # Check cancel after download if self._cancel_event.is_set(): - logger.info("Load cancelled before server start") + logger.info("Load cancelled after download phase") return False - self._port = self._find_free_port() + # ── Phase 3: start llama-server (under lock) ────────────── + with self._lock: + # Re-check cancel inside lock + if self._cancel_event.is_set(): + logger.info("Load cancelled before server start") + return False - # Select GPU(s) based on model size + estimated KV cache. - # Seed safe defaults before GPU probing so the except path - # still has valid state to publish. - effective_ctx = n_ctx if n_ctx > 0 else (self._context_length or 0) - max_available_ctx = self._context_length or effective_ctx - gpus: list[tuple[int, int]] = [] - try: - model_size = self._get_gguf_size_bytes(model_path) - gpus = self._get_gpu_free_memory() + self._port = self._find_free_port() - # Resolve effective context: 0 means let llama-server use the - # model's native length. Only expand to a known native length - # if metadata is available; otherwise preserve 0 as a sentinel. - if n_ctx > 0: - effective_ctx = n_ctx - elif self._context_length is not None: - effective_ctx = self._context_length - else: - effective_ctx = 0 - original_ctx = effective_ctx - # Default UI ceiling to the model's native context length. - # GPU/VRAM-fit logic below may shrink this if hardware is limited. + # Select GPU(s) based on model size + estimated KV cache. + # Seed safe defaults before GPU probing so the except path + # still has valid state to publish. + effective_ctx = n_ctx if n_ctx > 0 else (self._context_length or 0) max_available_ctx = self._context_length or effective_ctx + gpus: list[tuple[int, int]] = [] + try: + model_size = self._get_gguf_size_bytes(model_path) + gpus = self._get_gpu_free_memory() - # Auto-cap context to fit in GPU VRAM and select GPUs. - # - # Two policies depending on whether the user set n_ctx: - # - # Explicit n_ctx (user chose a context length): - # Honor it. Try the full requested context with _select_gpus - # (which uses as many GPUs as needed). Only cap if it doesn't - # fit on any GPU combination. - # - # Auto n_ctx=0 (model's native context): - # Prefer fewer GPUs with reduced context over more GPUs, - # since multi-GPU is slower and the user didn't ask for a - # specific context length. - gpu_indices, use_fit = None, True - explicit_ctx = n_ctx > 0 + # Resolve effective context: 0 means let llama-server use the + # model's native length. Only expand to a known native length + # if metadata is available; otherwise preserve 0 as a sentinel. + if n_ctx > 0: + effective_ctx = n_ctx + elif self._context_length is not None: + effective_ctx = self._context_length + else: + effective_ctx = 0 + original_ctx = effective_ctx + # Default UI ceiling to the model's native context length. + # GPU/VRAM-fit logic below may shrink this if hardware is limited. + max_available_ctx = self._context_length or effective_ctx - if gpus and self._can_estimate_kv() and effective_ctx > 0: - # Compute the largest hardware-aware cap from the model's - # native context across all usable GPU subsets (for UI - # bounds), independent of the currently requested context. - native_ctx_for_cap = self._context_length or effective_ctx - if native_ctx_for_cap > 0: - ranked_for_cap = sorted(gpus, key = lambda g: g[1], reverse = True) - best_cap = 0 - for n_gpus in range(1, len(ranked_for_cap) + 1): - subset = ranked_for_cap[:n_gpus] - pool_mib = sum(free for _, free in subset) - capped = self._fit_context_to_vram( - native_ctx_for_cap, - pool_mib, - model_size, - cache_type_kv, - n_parallel = n_parallel, + # Auto-cap context to fit in GPU VRAM and select GPUs. + # + # Two policies depending on whether the user set n_ctx: + # + # Explicit n_ctx (user chose a context length): + # Honor it. Try the full requested context with _select_gpus + # (which uses as many GPUs as needed). Only cap if it doesn't + # fit on any GPU combination. + # + # Auto n_ctx=0 (model's native context): + # Prefer fewer GPUs with reduced context over more GPUs, + # since multi-GPU is slower and the user didn't ask for a + # specific context length. + gpu_indices, use_fit = None, True + explicit_ctx = n_ctx > 0 + + if gpus and self._can_estimate_kv() and effective_ctx > 0: + # Compute the largest hardware-aware cap from the model's + # native context across all usable GPU subsets (for UI + # bounds), independent of the currently requested context. + native_ctx_for_cap = self._context_length or effective_ctx + if native_ctx_for_cap > 0: + ranked_for_cap = sorted( + gpus, key = lambda g: g[1], reverse = True ) - kv = self._estimate_kv_cache_bytes( - capped, cache_type_kv, n_parallel = n_parallel + best_cap = 0 + for n_gpus in range(1, len(ranked_for_cap) + 1): + subset = ranked_for_cap[:n_gpus] + pool_mib = sum(free for _, free in subset) + capped = self._fit_context_to_vram( + native_ctx_for_cap, + pool_mib, + model_size, + cache_type_kv, + n_parallel = n_parallel, + ) + kv = self._estimate_kv_cache_bytes( + capped, cache_type_kv, n_parallel = n_parallel + ) + total_mib = (model_size + kv) / (1024 * 1024) + if total_mib <= pool_mib * 0.90: + best_cap = max(best_cap, capped) + if best_cap > 0: + max_available_ctx = best_cap + else: + # Weights exceed 90% of every GPU subset's free + # memory, so there is no fitting context. Anchor + # the UI's "safe zone" threshold at 4096 (the + # spec's default when the model cannot fit) so + # the ctx slider shows the "might be slower" + # warning as soon as the user drags above the + # fallback default instead of never. + max_available_ctx = min(4096, native_ctx_for_cap) + + if explicit_ctx: + # Honor the user's requested context verbatim. If it + # fits, pin GPUs and skip --fit; if it doesn't, ship + # -c --fit on and let llama-server flex + # -ngl (CPU layer offload). The UI is expected to + # have surfaced the "might be slower" warning before + # the user submitted a ctx above the fit ceiling. + requested_total = ( + model_size + + self._estimate_kv_cache_bytes( + effective_ctx, cache_type_kv, n_parallel = n_parallel + ) ) - total_mib = (model_size + kv) / (1024 * 1024) - if total_mib <= pool_mib * 0.90: - best_cap = max(best_cap, capped) - if best_cap > 0: - max_available_ctx = best_cap + gpu_indices, use_fit = self._select_gpus( + requested_total, gpus + ) + # No silent shrink: effective_ctx stays == n_ctx. else: - # Weights exceed 90% of every GPU subset's free - # memory, so there is no fitting context. Anchor - # the UI's "safe zone" threshold at 4096 (the - # spec's default when the model cannot fit) so - # the ctx slider shows the "might be slower" - # warning as soon as the user drags above the - # fallback default instead of never. - max_available_ctx = min(4096, native_ctx_for_cap) + # Auto context: prefer fewer GPUs, cap context + # to fit. Same headroom threshold as + # _select_gpus (#5106). + ranked = sorted(gpus, key = lambda g: g[1], reverse = True) + pin_fraction = self._GPU_PIN_VRAM_FRACTION + for n_gpus in range(1, len(ranked) + 1): + subset = ranked[:n_gpus] + pool_mib = sum(free for _, free in subset) + capped = self._fit_context_to_vram( + effective_ctx, + pool_mib, + model_size, + cache_type_kv, + n_parallel = n_parallel, + ) + kv = self._estimate_kv_cache_bytes( + capped, cache_type_kv, n_parallel = n_parallel + ) + total_mib = (model_size + kv) / (1024 * 1024) + if total_mib <= pool_mib * pin_fraction: + effective_ctx = capped + gpu_indices = sorted(idx for idx, _ in subset) + use_fit = False + break + else: + # Native ctx doesn't fit. Drop to 4096 and + # re-check before deferring to --fit on: + # a model that overflows at 131k may pin + # comfortably with a 4096 KV cache (#5106). + effective_ctx = min(4096, effective_ctx) + if effective_ctx > 0: + for n_gpus in range(1, len(ranked) + 1): + subset = ranked[:n_gpus] + pool_mib = sum(free for _, free in subset) + kv = self._estimate_kv_cache_bytes( + effective_ctx, + cache_type_kv, + n_parallel = n_parallel, + ) + total_mib = (model_size + kv) / (1024 * 1024) + if total_mib <= pool_mib * pin_fraction: + gpu_indices = sorted( + idx for idx, _ in subset + ) + use_fit = False + break - if explicit_ctx: - # Honor the user's requested context verbatim. If it - # fits, pin GPUs and skip --fit; if it doesn't, ship - # -c --fit on and let llama-server flex - # -ngl (CPU layer offload). The UI is expected to - # have surfaced the "might be slower" warning before - # the user submitted a ctx above the fit ceiling. - requested_total = model_size + self._estimate_kv_cache_bytes( + elif gpus: + # Can't estimate KV -- fall back to file-size-only check. + # Without KV estimation we cannot prove a hardware cap, so + # keep the ceiling at the native context (already the default). + logger.debug( + "Falling back to file-size-only GPU selection", + model_size_gb = round(model_size / (1024**3), 2), + ) + gpu_indices, use_fit = self._select_gpus(model_size, gpus) + if use_fit and not explicit_ctx: + # Weights don't fit on any subset. Default the UI to + # 4096 so the slider doesn't land on an unusable native + # context. --fit on will flex -ngl at runtime. + effective_ctx = ( + min(4096, effective_ctx) if effective_ctx > 0 else 4096 + ) + + if effective_ctx < original_ctx: + kv_est = self._estimate_kv_cache_bytes( effective_ctx, cache_type_kv, n_parallel = n_parallel ) - gpu_indices, use_fit = self._select_gpus(requested_total, gpus) - # No silent shrink: effective_ctx stays == n_ctx. - else: - # Auto context: prefer fewer GPUs, cap context - # to fit. Same headroom threshold as - # _select_gpus (#5106). - ranked = sorted(gpus, key = lambda g: g[1], reverse = True) - pin_fraction = self._GPU_PIN_VRAM_FRACTION - for n_gpus in range(1, len(ranked) + 1): - subset = ranked[:n_gpus] - pool_mib = sum(free for _, free in subset) - capped = self._fit_context_to_vram( - effective_ctx, - pool_mib, - model_size, - cache_type_kv, - n_parallel = n_parallel, - ) - kv = self._estimate_kv_cache_bytes( - capped, cache_type_kv, n_parallel = n_parallel - ) - total_mib = (model_size + kv) / (1024 * 1024) - if total_mib <= pool_mib * pin_fraction: - effective_ctx = capped - gpu_indices = sorted(idx for idx, _ in subset) - use_fit = False - break - else: - # Native ctx doesn't fit. Drop to 4096 and - # re-check before deferring to --fit on: - # a model that overflows at 131k may pin - # comfortably with a 4096 KV cache (#5106). - effective_ctx = min(4096, effective_ctx) - if effective_ctx > 0: - for n_gpus in range(1, len(ranked) + 1): - subset = ranked[:n_gpus] - pool_mib = sum(free for _, free in subset) - kv = self._estimate_kv_cache_bytes( - effective_ctx, - cache_type_kv, - n_parallel = n_parallel, - ) - total_mib = (model_size + kv) / (1024 * 1024) - if total_mib <= pool_mib * pin_fraction: - gpu_indices = sorted(idx for idx, _ in subset) - use_fit = False - break - - elif gpus: - # Can't estimate KV -- fall back to file-size-only check. - # Without KV estimation we cannot prove a hardware cap, so - # keep the ceiling at the native context (already the default). - logger.debug( - "Falling back to file-size-only GPU selection", - model_size_gb = round(model_size / (1024**3), 2), - ) - gpu_indices, use_fit = self._select_gpus(model_size, gpus) - if use_fit and not explicit_ctx: - # Weights don't fit on any subset. Default the UI to - # 4096 so the slider doesn't land on an unusable native - # context. --fit on will flex -ngl at runtime. - effective_ctx = ( - min(4096, effective_ctx) if effective_ctx > 0 else 4096 + logger.info( + f"Context auto-reduced: {original_ctx} -> {effective_ctx} " + f"(model: {model_size / (1024**3):.1f} GB, " + f"est. KV cache: {kv_est / (1024**3):.1f} GB)" ) - if effective_ctx < original_ctx: - kv_est = self._estimate_kv_cache_bytes( + kv_cache_bytes = self._estimate_kv_cache_bytes( effective_ctx, cache_type_kv, n_parallel = n_parallel ) logger.info( - f"Context auto-reduced: {original_ctx} -> {effective_ctx} " - f"(model: {model_size / (1024**3):.1f} GB, " - f"est. KV cache: {kv_est / (1024**3):.1f} GB)" + f"GGUF size: {model_size / (1024**3):.1f} GB, " + f"est. KV cache: {kv_cache_bytes / (1024**3):.1f} GB, " + f"context: {effective_ctx}, " + f"GPUs free: {gpus}, selected: {gpu_indices}, fit: {use_fit}" ) + except Exception as e: + logger.warning(f"GPU selection failed ({e}), using --fit on") + gpu_indices, use_fit = None, True + effective_ctx = n_ctx # fall back to original - kv_cache_bytes = self._estimate_kv_cache_bytes( - effective_ctx, cache_type_kv, n_parallel = n_parallel - ) - logger.info( - f"GGUF size: {model_size / (1024**3):.1f} GB, " - f"est. KV cache: {kv_cache_bytes / (1024**3):.1f} GB, " - f"context: {effective_ctx}, " - f"GPUs free: {gpus}, selected: {gpu_indices}, fit: {use_fit}" - ) - except Exception as e: - logger.warning(f"GPU selection failed ({e}), using --fit on") - gpu_indices, use_fit = None, True - effective_ctx = n_ctx # fall back to original + cmd = [ + binary, + "-m", + model_path, + "--port", + str(self._port), + "-c", + str(effective_ctx) if effective_ctx > 0 else "0", + "--parallel", + str(n_parallel), + "--flash-attn", + "on", # Force flash attention for speed + # Error out at n_ctx instead of silently rotating the KV cache; frontend catches it and points the user at "Context Length". + "--no-context-shift", + ] - cmd = [ - binary, - "-m", - model_path, - "--port", - str(self._port), - "-c", - str(effective_ctx) if effective_ctx > 0 else "0", - "--parallel", - str(n_parallel), - "--flash-attn", - "on", # Force flash attention for speed - # Error out at n_ctx instead of silently rotating the KV cache; frontend catches it and points the user at "Context Length". - "--no-context-shift", - ] + if use_fit: + cmd.extend(["--fit", "on"]) + elif gpu_indices is not None: + # Model fits on selected GPU(s) -- offload all layers + cmd.extend(["-ngl", "-1"]) - if use_fit: - cmd.extend(["--fit", "on"]) - elif gpu_indices is not None: - # Model fits on selected GPU(s) -- offload all layers - cmd.extend(["-ngl", "-1"]) - - # -1 = llama.cpp auto-detect (physical cores). Pass explicitly so we - # do not inherit llama-server's internal default, which has historically - # varied (hardware concurrency incl. hyperthreads on some builds). - cmd.extend(["--threads", str(n_threads if n_threads is not None else -1)]) - - # Always enable Jinja chat template rendering for proper template support - cmd.extend(["--jinja"]) - - # KV cache data type - _valid_cache_types = { - "f16", - "bf16", - "q8_0", - "q4_0", - "q4_1", - "q5_0", - "q5_1", - "iq4_nl", - "f32", - } - if cache_type_kv and cache_type_kv in _valid_cache_types: + # -1 = llama.cpp auto-detect (physical cores). Pass explicitly so we + # do not inherit llama-server's internal default, which has historically + # varied (hardware concurrency incl. hyperthreads on some builds). cmd.extend( - ["--cache-type-k", cache_type_kv, "--cache-type-v", cache_type_kv] + ["--threads", str(n_threads if n_threads is not None else -1)] ) - self._cache_type_kv = cache_type_kv - logger.info(f"KV cache type: {cache_type_kv}") - else: - self._cache_type_kv = None - # Speculative decoding (n-gram self-speculation, zero VRAM cost) - # ngram-mod: ~16 MB shared hash pool, constant memory/complexity, - # variable draft lengths. Helps most when the model repeats - # existing text (code refactoring, summarization, reasoning). - # For general chat with low repetition, overhead is ~5 ms. - # - # Benchmarks from upstream llama.cpp speculative-decoding PRs: - # Scenario | Without | With | Speedup - # gpt-oss-120b code refactor | 181 t/s | 446 t/s | 2.5x - # Qwen3-235B offloaded | 12 t/s | 21 t/s | 1.8x - # gpt-oss-120b repeat (92% accept)| 181 t/s | 814 t/s | 4.5x - # - # Params from llama.cpp docs (docs/speculative.md): - # --spec-ngram-size-n 24 (small n not recommended) - # --draft-min 48 --draft-max 64 (MoEs need long drafts; - # dense models can reduce these) - # ref: https://github.com/ggml-org/llama.cpp/blob/master/docs/speculative.md - # ref: https://github.com/ggml-org/llama.cpp/pull/19164 - # ref: https://github.com/ggml-org/llama.cpp/pull/18471 - # ``"default"`` -> let llama-server pick a sensible spec - # config via ``--spec-default``. Explicit type names are - # passed through with the manual draft tuning we've shipped - # historically so power users keep their overrides. - _valid_spec_types = {"ngram-simple", "ngram-mod"} - normalized_spec = ( - speculative_type.lower().strip() if speculative_type else None - ) - if normalized_spec and normalized_spec != "off" and not is_vision: - if normalized_spec == "default": - cmd.append("--spec-default") - self._speculative_type = "default" - elif normalized_spec in _valid_spec_types: - cmd.extend(["--spec-type", normalized_spec]) - if normalized_spec == "ngram-mod": - cmd.extend( - [ - "--spec-ngram-size-n", - "24", - "--draft-min", - "48", - "--draft-max", - "64", - ] - ) - self._speculative_type = normalized_spec + # Always enable Jinja chat template rendering for proper template support + cmd.extend(["--jinja"]) + + # KV cache data type + _valid_cache_types = { + "f16", + "bf16", + "q8_0", + "q4_0", + "q4_1", + "q5_0", + "q5_1", + "iq4_nl", + "f32", + } + if cache_type_kv and cache_type_kv in _valid_cache_types: + cmd.extend( + [ + "--cache-type-k", + cache_type_kv, + "--cache-type-v", + cache_type_kv, + ] + ) + self._cache_type_kv = cache_type_kv + logger.info(f"KV cache type: {cache_type_kv}") + else: + self._cache_type_kv = None + + # Speculative decoding (n-gram self-speculation, zero VRAM cost) + # ngram-mod: ~16 MB shared hash pool, constant memory/complexity, + # variable draft lengths. Helps most when the model repeats + # existing text (code refactoring, summarization, reasoning). + # For general chat with low repetition, overhead is ~5 ms. + # + # Benchmarks from upstream llama.cpp speculative-decoding PRs: + # Scenario | Without | With | Speedup + # gpt-oss-120b code refactor | 181 t/s | 446 t/s | 2.5x + # Qwen3-235B offloaded | 12 t/s | 21 t/s | 1.8x + # gpt-oss-120b repeat (92% accept)| 181 t/s | 814 t/s | 4.5x + # + # Params from llama.cpp docs (docs/speculative.md): + # --spec-ngram-size-n 24 (small n not recommended) + # --draft-min 48 --draft-max 64 (MoEs need long drafts; + # dense models can reduce these) + # ref: https://github.com/ggml-org/llama.cpp/blob/master/docs/speculative.md + # ref: https://github.com/ggml-org/llama.cpp/pull/19164 + # ref: https://github.com/ggml-org/llama.cpp/pull/18471 + # ``"default"`` -> let llama-server pick a sensible spec + # config via ``--spec-default``. Explicit type names are + # passed through with the manual draft tuning we've shipped + # historically so power users keep their overrides. + _valid_spec_types = {"ngram-simple", "ngram-mod"} + normalized_spec = ( + speculative_type.lower().strip() if speculative_type else None + ) + if normalized_spec and normalized_spec != "off" and not is_vision: + if normalized_spec == "default": + cmd.append("--spec-default") + self._speculative_type = "default" + elif normalized_spec in _valid_spec_types: + cmd.extend(["--spec-type", normalized_spec]) + if normalized_spec == "ngram-mod": + cmd.extend( + [ + "--spec-ngram-size-n", + "24", + "--draft-min", + "48", + "--draft-max", + "64", + ] + ) + self._speculative_type = normalized_spec + else: + self._speculative_type = None else: self._speculative_type = None - else: - self._speculative_type = None - # Apply custom chat template override if provided - self._chat_template_override = chat_template_override - if chat_template_override: - import tempfile + # Apply custom chat template override if provided + self._chat_template_override = chat_template_override + if chat_template_override: + import tempfile - flags = detect_reasoning_flags( - chat_template_override, - self._model_identifier, - log_source = "GGUF chat template override", - ) - self._supports_reasoning = flags["supports_reasoning"] - self._reasoning_style = flags["reasoning_style"] - self._reasoning_always_on = flags["reasoning_always_on"] - self._supports_preserve_thinking = flags["supports_preserve_thinking"] - self._supports_tools = flags["supports_tools"] - - self._chat_template_file = tempfile.NamedTemporaryFile( - mode = "w", - suffix = ".jinja", - delete = False, - prefix = "unsloth_chat_template_", - ) - self._chat_template_file.write(chat_template_override) - self._chat_template_file.close() - cmd.extend(["--chat-template-file", self._chat_template_file.name]) - logger.info( - f"Using custom chat template file: {self._chat_template_file.name}" - ) - - # For reasoning models, set default thinking mode. - # Qwen3.5/3.6 models below 9B (0.8B, 2B, 4B) disable thinking by default. - # Only 9B and larger enable thinking. - # Always-on templates ignore the kwarg entirely, so skip. - if self._supports_reasoning and not self._reasoning_always_on: - thinking_default = True - mid = (model_identifier or "").lower() - if "qwen3.5" in mid or "qwen3.6" in mid: - size_val = _extract_model_size_b(mid) - if size_val is not None and size_val < 9: - thinking_default = False - self._reasoning_default = thinking_default - reasoning_kw = self._reasoning_kwargs(thinking_default) - cmd.extend( - [ - "--chat-template-kwargs", - json.dumps(reasoning_kw), + flags = detect_reasoning_flags( + chat_template_override, + self._model_identifier, + log_source = "GGUF chat template override", + ) + self._supports_reasoning = flags["supports_reasoning"] + self._reasoning_style = flags["reasoning_style"] + self._reasoning_always_on = flags["reasoning_always_on"] + self._supports_preserve_thinking = flags[ + "supports_preserve_thinking" ] - ) - logger.info(f"Reasoning model: {reasoning_kw} by default") + self._supports_tools = flags["supports_tools"] - if mmproj_path: - if not Path(mmproj_path).is_file(): - logger.warning(f"mmproj file not found: {mmproj_path}") - else: - # #5347 guard for paths that bypass detect_mmproj_file. - from utils.models.model_config import ( - mmproj_matches_model_family, + self._chat_template_file = tempfile.NamedTemporaryFile( + mode = "w", + suffix = ".jinja", + delete = False, + prefix = "unsloth_chat_template_", + ) + self._chat_template_file.write(chat_template_override) + self._chat_template_file.close() + cmd.extend(["--chat-template-file", self._chat_template_file.name]) + logger.info( + f"Using custom chat template file: {self._chat_template_file.name}" ) - if not mmproj_matches_model_family(model_path, mmproj_path): - logger.warning( - f"Skipping mmproj with mismatched family: " - f"model={Path(model_path).name}, " - f"mmproj={Path(mmproj_path).name}" - ) + # For reasoning models, set default thinking mode. + # Qwen3.5/3.6 models below 9B (0.8B, 2B, 4B) disable thinking by default. + # Only 9B and larger enable thinking. + # Always-on templates ignore the kwarg entirely, so skip. + if self._supports_reasoning and not self._reasoning_always_on: + thinking_default = True + mid = (model_identifier or "").lower() + if "qwen3.5" in mid or "qwen3.6" in mid: + size_val = _extract_model_size_b(mid) + if size_val is not None and size_val < 9: + thinking_default = False + self._reasoning_default = thinking_default + reasoning_kw = self._reasoning_kwargs(thinking_default) + cmd.extend( + [ + "--chat-template-kwargs", + json.dumps(reasoning_kw), + ] + ) + logger.info(f"Reasoning model: {reasoning_kw} by default") + + if mmproj_path: + if not Path(mmproj_path).is_file(): + logger.warning(f"mmproj file not found: {mmproj_path}") else: - cmd.extend(["--mmproj", mmproj_path]) - logger.info(f"Using mmproj for vision: {mmproj_path}") - - # Option C: add --api-key for direct client access when enabled - import os as _os - import secrets as _secrets - - if _os.getenv("UNSLOTH_DIRECT_STREAM", "0") == "1": - self._api_key = _secrets.token_urlsafe(32) - cmd.extend(["--api-key", self._api_key]) - logger.info("llama-server started with --api-key for direct streaming") - else: - self._api_key = None - - # User-supplied pass-through args go last so llama.cpp's - # last-wins flag parsing lets the user override Studio's - # auto-set tier-2 flags (e.g. --cache-type-k, --spec-type). - # The route layer has already validated this list against - # the managed-flag denylist via validate_extra_args(). - if extra_args: - cmd.extend(str(a) for a in extra_args) - logger.info( - f"Appending user extra args to llama-server: {list(extra_args)}" - ) - - _log_cmd = list(cmd) - if "--api-key" in _log_cmd: - _ki = _log_cmd.index("--api-key") + 1 - if _ki < len(_log_cmd): - _log_cmd[_ki] = "" - logger.info(f"Starting llama-server: {' '.join(_log_cmd)}") - - # Set library paths so llama-server can find its shared libs and CUDA DLLs - import os - import sys - - env = child_env_without_native_path_secret() - binary_dir = str(Path(binary).parent) - - if sys.platform == "win32": - # CUDA DLLs (cudart64_X.dll, cublas64_X.dll, etc.) must - # be on PATH. Order: binary_dir, torch's pip-installed - # nvidia wheels, then a system CUDA toolkit. Pip wheels - # are the canonical source per Studio's install design - # (mirrors the Linux LD_LIBRARY_PATH block below) and - # CUDA_PATH covers users with a system toolkit. #5106. - path_dirs = [binary_dir] - path_dirs.extend(self._windows_pip_nvidia_dll_dirs(sys.prefix)) - cuda_path = os.environ.get("CUDA_PATH", "") - if cuda_path: - cuda_bin = os.path.join(cuda_path, "bin") - if os.path.isdir(cuda_bin): - path_dirs.append(cuda_bin) - # Some CUDA installs put DLLs in bin\x64 - cuda_bin_x64 = os.path.join(cuda_path, "bin", "x64") - if os.path.isdir(cuda_bin_x64): - path_dirs.append(cuda_bin_x64) - existing_path = env.get("PATH", "") - env["PATH"] = ";".join(path_dirs) + ";" + existing_path - else: - # Linux: set LD_LIBRARY_PATH for shared libs next to the binary - # and CUDA runtime libs (libcudart, libcublas, etc.) - import platform - - lib_dirs = [binary_dir] - _arch = platform.machine() # x86_64, aarch64, etc. - - # Pip-installed nvidia CUDA runtime libs (e.g. torch's - # bundled cuda-bindings). The prebuilt llama.cpp binary - # links against libcudart.so.13 / libcublas.so.13 which - # live here, not in /usr/local/cuda. - import glob as _glob - - for _nv_pattern in [ - os.path.join( - sys.prefix, - "lib", - "python*", - "site-packages", - "nvidia", - "cu*", - "lib", - ), - os.path.join( - sys.prefix, - "lib", - "python*", - "site-packages", - "nvidia", - "cudnn", - "lib", - ), - os.path.join( - sys.prefix, - "lib", - "python*", - "site-packages", - "nvidia", - "nvjitlink", - "lib", - ), - ]: - for _nv_dir in _glob.glob(_nv_pattern): - if os.path.isdir(_nv_dir): - lib_dirs.append(_nv_dir) - - for cuda_lib in [ - "/usr/local/cuda/lib64", - f"/usr/local/cuda/targets/{_arch}-linux/lib", - # Fallback CUDA compat paths (e.g. binary built with - # CUDA 12 on a system where default /usr/local/cuda - # points to CUDA 13+). - "/usr/local/cuda-12/lib64", - "/usr/local/cuda-12.8/lib64", - f"/usr/local/cuda-12/targets/{_arch}-linux/lib", - f"/usr/local/cuda-12.8/targets/{_arch}-linux/lib", - ]: - if os.path.isdir(cuda_lib): - lib_dirs.append(cuda_lib) - existing_ld = env.get("LD_LIBRARY_PATH", "") - new_ld = ":".join(lib_dirs) - env["LD_LIBRARY_PATH"] = ( - f"{new_ld}:{existing_ld}" if existing_ld else new_ld - ) - - # Pin to selected GPU(s). On ROCm, llama-server (and any torch - # in the subprocess) honors HIP_VISIBLE_DEVICES / ROCR_VISIBLE_DEVICES; - # narrowing only CUDA_VISIBLE_DEVICES leaves an AMD child seeing - # the full HIP/ROCR set the parent inherited. - if gpu_indices is not None: - pinned = ",".join(str(i) for i in gpu_indices) - env["CUDA_VISIBLE_DEVICES"] = pinned - try: - import torch as _torch - - if getattr(_torch.version, "hip", None) is not None: - env["HIP_VISIBLE_DEVICES"] = pinned - env["ROCR_VISIBLE_DEVICES"] = pinned - except Exception as e: - logger.debug( - "Failed to set ROCm visibility env vars for child: %s", e - ) - - # Defensive kill: if a concurrent load slipped past Phase 1 - # (because its `self._process` was None at the time) and - # already stored a Popen handle here, drop that orphan - # before we overwrite the reference. See issue #5161. - self._kill_process() - - self._stdout_lines = [] - self._process = subprocess.Popen( - cmd, - stdout = subprocess.PIPE, - stderr = subprocess.STDOUT, - text = True, - env = env, - **_windows_hidden_subprocess_kwargs(), - ) - - # Start background thread to drain stdout and prevent pipe deadlock - self._stdout_thread = threading.Thread( - target = self._drain_stdout, daemon = True, name = "llama-stdout" - ) - self._stdout_thread.start() - - # Store the resolved on-disk path, not the caller's kwarg. In - # HF mode the caller passes gguf_path=None and the real path - # (``model_path``) is what llama-server is actually mmap'ing. - # Downstream consumers (load_progress, log lines, etc.) need - # the path that exists on disk. - self._gguf_path = model_path - self._hf_repo = hf_repo - # For local GGUF files, extract variant from filename if not provided - if hf_variant: - self._hf_variant = hf_variant - elif gguf_path: - try: - from utils.models.model_config import _extract_quant_label - - self._hf_variant = _extract_quant_label(gguf_path) - except Exception: - self._hf_variant = None - else: - self._hf_variant = None - self._is_vision = is_vision - self._model_identifier = model_identifier - - # Store the effective (possibly capped) context separately. - # Do NOT overwrite _context_length -- it holds the model's native - # context length from GGUF metadata and is used for display/info. - self._effective_context_length = ( - effective_ctx if effective_ctx > 0 else self._context_length - ) - self._max_context_length = ( - max_available_ctx - if max_available_ctx > 0 - else self._effective_context_length - ) - - # Wait for llama-server to become healthy - if not self._wait_for_health(timeout = 600.0): - self._kill_process() - _gguf = gguf_path or "" - _is_ollama = ( - ".studio_links" in _gguf - or os.sep + "ollama_links" + os.sep in _gguf - or os.sep + ".cache" + os.sep + "ollama" + os.sep in _gguf - or (self._model_identifier or "").startswith("ollama/") - ) - # Only show the Ollama-specific message when the server - # output indicates a GGUF compatibility issue, not for - # unrelated failures like OOM or missing binaries. - if _is_ollama: - _output = "\n".join(self._stdout_lines[-50:]).lower() - _gguf_compat_hints = ( - "key not found", - "unknown model architecture", - "failed to load model", - ) - if any(h in _output for h in _gguf_compat_hints): - raise RuntimeError( - "Some Ollama models do not work with llama.cpp. " - "Try a different model, or use this model directly through Ollama instead." + # #5347 guard for paths that bypass detect_mmproj_file. + from utils.models.model_config import ( + mmproj_matches_model_family, ) - raise RuntimeError( - "llama-server failed to start. " - "Check that the GGUF file is valid and you have enough memory." + + if not mmproj_matches_model_family(model_path, mmproj_path): + logger.warning( + f"Skipping mmproj with mismatched family: " + f"model={Path(model_path).name}, " + f"mmproj={Path(mmproj_path).name}" + ) + else: + cmd.extend(["--mmproj", mmproj_path]) + logger.info(f"Using mmproj for vision: {mmproj_path}") + + # Option C: add --api-key for direct client access when enabled + import os as _os + import secrets as _secrets + + if _os.getenv("UNSLOTH_DIRECT_STREAM", "0") == "1": + self._api_key = _secrets.token_urlsafe(32) + cmd.extend(["--api-key", self._api_key]) + logger.info( + "llama-server started with --api-key for direct streaming" + ) + else: + self._api_key = None + + # User-supplied pass-through args go last so llama.cpp's + # last-wins flag parsing lets the user override Studio's + # auto-set tier-2 flags (e.g. --cache-type-k, --spec-type). + # The route layer has already validated this list against + # the managed-flag denylist via validate_extra_args(). + if extra_args: + cmd.extend(str(a) for a in extra_args) + logger.info( + f"Appending user extra args to llama-server: {list(extra_args)}" + ) + + _log_cmd = list(cmd) + if "--api-key" in _log_cmd: + _ki = _log_cmd.index("--api-key") + 1 + if _ki < len(_log_cmd): + _log_cmd[_ki] = "" + logger.info(f"Starting llama-server: {' '.join(_log_cmd)}") + + # Set library paths so llama-server can find its shared libs and CUDA DLLs + import os + import sys + + env = child_env_without_native_path_secret() + binary_dir = str(Path(binary).parent) + + if sys.platform == "win32": + # CUDA DLLs (cudart64_X.dll, cublas64_X.dll, etc.) must + # be on PATH. Order: binary_dir, torch's pip-installed + # nvidia wheels, then a system CUDA toolkit. Pip wheels + # are the canonical source per Studio's install design + # (mirrors the Linux LD_LIBRARY_PATH block below) and + # CUDA_PATH covers users with a system toolkit. #5106. + path_dirs = [binary_dir] + path_dirs.extend(self._windows_pip_nvidia_dll_dirs(sys.prefix)) + cuda_path = os.environ.get("CUDA_PATH", "") + if cuda_path: + cuda_bin = os.path.join(cuda_path, "bin") + if os.path.isdir(cuda_bin): + path_dirs.append(cuda_bin) + # Some CUDA installs put DLLs in bin\x64 + cuda_bin_x64 = os.path.join(cuda_path, "bin", "x64") + if os.path.isdir(cuda_bin_x64): + path_dirs.append(cuda_bin_x64) + existing_path = env.get("PATH", "") + env["PATH"] = ";".join(path_dirs) + ";" + existing_path + else: + # Linux: set LD_LIBRARY_PATH for shared libs next to the binary + # and CUDA runtime libs (libcudart, libcublas, etc.) + import platform + + lib_dirs = [binary_dir] + _arch = platform.machine() # x86_64, aarch64, etc. + + # Pip-installed nvidia CUDA runtime libs (e.g. torch's + # bundled cuda-bindings). The prebuilt llama.cpp binary + # links against libcudart.so.13 / libcublas.so.13 which + # live here, not in /usr/local/cuda. + import glob as _glob + + for _nv_pattern in [ + os.path.join( + sys.prefix, + "lib", + "python*", + "site-packages", + "nvidia", + "cu*", + "lib", + ), + os.path.join( + sys.prefix, + "lib", + "python*", + "site-packages", + "nvidia", + "cudnn", + "lib", + ), + os.path.join( + sys.prefix, + "lib", + "python*", + "site-packages", + "nvidia", + "nvjitlink", + "lib", + ), + ]: + for _nv_dir in _glob.glob(_nv_pattern): + if os.path.isdir(_nv_dir): + lib_dirs.append(_nv_dir) + + for cuda_lib in [ + "/usr/local/cuda/lib64", + f"/usr/local/cuda/targets/{_arch}-linux/lib", + # Fallback CUDA compat paths (e.g. binary built with + # CUDA 12 on a system where default /usr/local/cuda + # points to CUDA 13+). + "/usr/local/cuda-12/lib64", + "/usr/local/cuda-12.8/lib64", + f"/usr/local/cuda-12/targets/{_arch}-linux/lib", + f"/usr/local/cuda-12.8/targets/{_arch}-linux/lib", + ]: + if os.path.isdir(cuda_lib): + lib_dirs.append(cuda_lib) + existing_ld = env.get("LD_LIBRARY_PATH", "") + new_ld = ":".join(lib_dirs) + env["LD_LIBRARY_PATH"] = ( + f"{new_ld}:{existing_ld}" if existing_ld else new_ld + ) + + # Pin to selected GPU(s). On ROCm, llama-server (and any torch + # in the subprocess) honors HIP_VISIBLE_DEVICES / ROCR_VISIBLE_DEVICES; + # narrowing only CUDA_VISIBLE_DEVICES leaves an AMD child seeing + # the full HIP/ROCR set the parent inherited. + if gpu_indices is not None: + pinned = ",".join(str(i) for i in gpu_indices) + env["CUDA_VISIBLE_DEVICES"] = pinned + try: + import torch as _torch + + if getattr(_torch.version, "hip", None) is not None: + env["HIP_VISIBLE_DEVICES"] = pinned + env["ROCR_VISIBLE_DEVICES"] = pinned + except Exception as e: + logger.debug( + "Failed to set ROCm visibility env vars for child: %s", e + ) + + # Defensive kill: if a concurrent load slipped past Phase 1 + # (because its `self._process` was None at the time) and + # already stored a Popen handle here, drop that orphan + # before we overwrite the reference. See issue #5161. + self._kill_process() + + self._stdout_lines = [] + self._process = subprocess.Popen( + cmd, + stdout = subprocess.PIPE, + stderr = subprocess.STDOUT, + text = True, + env = env, + **_windows_hidden_subprocess_kwargs(), ) - self._healthy = True + # Start background thread to drain stdout and prevent pipe deadlock + self._stdout_thread = threading.Thread( + target = self._drain_stdout, daemon = True, name = "llama-stdout" + ) + self._stdout_thread.start() - # Catch silent CPU fallback when GPU was intended (#5106). - self._gpu_offload_active = self._classify_gpu_offload( - gpu_indices is not None or use_fit, gpus or [] - ) - if self._gpu_offload_active is False: - logger.warning( - "llama-server appears to have loaded the model entirely " - "on CPU even though Studio detected at least one GPU. " - "This usually means the prebuilt binary's GPU backend " - "failed to load -- on Windows, cudart64_X.dll / " - "cublas64_X.dll could not be resolved. Reinstall the " - "Studio llama.cpp prebuilt or install a matching CUDA " - "toolkit (issue unslothai/unsloth#5106).", + # Store the resolved on-disk path, not the caller's kwarg. In + # HF mode the caller passes gguf_path=None and the real path + # (``model_path``) is what llama-server is actually mmap'ing. + # Downstream consumers (load_progress, log lines, etc.) need + # the path that exists on disk. + self._gguf_path = model_path + self._hf_repo = hf_repo + # For local GGUF files, extract variant from filename if not provided + if hf_variant: + self._hf_variant = hf_variant + elif gguf_path: + try: + from utils.models.model_config import _extract_quant_label + + self._hf_variant = _extract_quant_label(gguf_path) + except Exception: + self._hf_variant = None + else: + self._hf_variant = None + self._is_vision = is_vision + self._model_identifier = model_identifier + + # Store the effective (possibly capped) context separately. + # Do NOT overwrite _context_length -- it holds the model's native + # context length from GGUF metadata and is used for display/info. + self._effective_context_length = ( + effective_ctx if effective_ctx > 0 else self._context_length + ) + self._max_context_length = ( + max_available_ctx + if max_available_ctx > 0 + else self._effective_context_length ) - logger.info( - f"llama-server ready on port {self._port} " - f"for model '{model_identifier}'" - ) - return True + # Wait for llama-server to become healthy + if not self._wait_for_health(timeout = 600.0): + self._kill_process() + _gguf = gguf_path or "" + _is_ollama = ( + ".studio_links" in _gguf + or os.sep + "ollama_links" + os.sep in _gguf + or os.sep + ".cache" + os.sep + "ollama" + os.sep in _gguf + or (self._model_identifier or "").startswith("ollama/") + ) + # Only show the Ollama-specific message when the server + # output indicates a GGUF compatibility issue, not for + # unrelated failures like OOM or missing binaries. + if _is_ollama: + _output = "\n".join(self._stdout_lines[-50:]).lower() + _gguf_compat_hints = ( + "key not found", + "unknown model architecture", + "failed to load model", + ) + if any(h in _output for h in _gguf_compat_hints): + raise RuntimeError( + "Some Ollama models do not work with llama.cpp. " + "Try a different model, or use this model directly through Ollama instead." + ) + raise RuntimeError( + "llama-server failed to start. " + "Check that the GGUF file is valid and you have enough memory." + ) + + self._healthy = True + + # Commit caller intent only after _healthy=True so a + # failed startup can't poison the next inheritance check. + # None keeps prior, [] clears, list sets. Source records + # the caller's hf_variant (None for local files) so the + # route's same_source check stays symmetric. + if extra_args is not None: + self._extra_args = list(extra_args) + self._extra_args_source = (model_identifier, hf_variant) + self._requested_n_ctx = int(n_ctx) + + # Catch silent CPU fallback when GPU was intended (#5106). + self._gpu_offload_active = self._classify_gpu_offload( + gpu_indices is not None or use_fit, gpus or [] + ) + if self._gpu_offload_active is False: + logger.warning( + "llama-server appears to have loaded the model entirely " + "on CPU even though Studio detected at least one GPU. " + "This usually means the prebuilt binary's GPU backend " + "failed to load -- on Windows, cudart64_X.dll / " + "cublas64_X.dll could not be resolved. Reinstall the " + "Studio llama.cpp prebuilt or install a matching CUDA " + "toolkit (issue unslothai/unsloth#5106).", + ) + + logger.info( + f"llama-server ready on port {self._port} " + f"for model '{model_identifier}'" + ) + return True + + def _already_in_target_state( + self, + *, + model_identifier: str, + hf_variant: Optional[str], + n_ctx: int, + cache_type_kv: Optional[str], + speculative_type: Optional[str], + chat_template_override: Optional[str], + extra_args: Optional[List[str]], + is_vision: bool, + gguf_path: Optional[str] = None, + ) -> bool: + """True iff the live server already satisfies these load kwargs. + + Mirrors ``routes/inference.py:_request_matches_loaded_settings`` + but compares raw kwargs so ``load_model`` can short-circuit a + duplicate /load that raced past the route-level check (#5401). + """ + if not self.is_loaded: + return False + if (self._model_identifier or "").lower() != (model_identifier or "").lower(): + return False + # Direct-file loads pass hf_variant=None while the backend + # stores an extracted filename label; compare paths instead + # to keep the guard symmetric. + if gguf_path is not None and self._gguf_path: + try: + if Path(self._gguf_path).resolve() != Path(gguf_path).resolve(): + return False + except OSError: + return False + elif (self._hf_variant or "").lower() != (hf_variant or "").lower(): + return False + if self._requested_n_ctx != int(n_ctx): + return False + + def _norm(value): + if value is None: + return None + if isinstance(value, str): + stripped = value.strip().lower() + return stripped or None + return value + + if _norm(self._cache_type_kv) != _norm(cache_type_kv): + return False + + # Vision GGUFs silently drop speculative decoding in + # load_model (the spec gate is "not is_vision"); treat the + # request's value as "off" so a vision load with + # speculative_type="default" still matches. + if self._is_vision or is_vision: + req_spec = "off" + else: + req_spec = _norm(speculative_type) or "off" + backend_spec = _norm(self._speculative_type) or "off" + if req_spec != backend_spec: + return False + + if (self._chat_template_override or None) != (chat_template_override or None): + return False + + # extra_args=None means "no opinion" (inherit semantics handled + # at the route layer); only an explicit list forces equality. + if extra_args is not None: + current = list(self._extra_args) if self._extra_args is not None else [] + if list(extra_args) != current: + return False + return True def _classify_gpu_offload( self, @@ -2737,6 +2892,10 @@ class LlamaCppBackend: logger.warning(f"Error killing llama-server process: {e}") finally: self._process = None + # Clear healthy so a /load arriving during the replacement + # server's warm-up window cannot short-circuit against the + # previous server's health (#5401). + self._healthy = False if self._stdout_thread is not None: self._stdout_thread.join(timeout = 2) self._stdout_thread = None diff --git a/studio/backend/core/inference/llama_server_args.py b/studio/backend/core/inference/llama_server_args.py index 44c7d542c7..0f6927fc5a 100644 --- a/studio/backend/core/inference/llama_server_args.py +++ b/studio/backend/core/inference/llama_server_args.py @@ -69,7 +69,15 @@ _DENYLIST_GROUPS: tuple[frozenset[str], ...] = ( # Single-model server -- Studio runs one model per llama-server # process and serves its own UI. Enabling multi-model loading or # llama-server's built-in web UI changes the surface clients see. + # ``--webui``/``--no-webui`` are the legacy spelling; current + # upstream uses ``--ui``/``--no-ui`` + ``--ui-*`` companions. + # Keep both so the denylist matches old and new llama-server + # binaries (Studio's prebuilt vs system-llama.cpp). frozenset({"--webui", "--no-webui"}), + frozenset({"--ui", "--no-ui"}), + frozenset({"--ui-config"}), + frozenset({"--ui-config-file"}), + frozenset({"--ui-mcp-proxy", "--no-ui-mcp-proxy"}), frozenset({"--models-dir"}), frozenset({"--models-preset"}), frozenset({"--models-max"}), @@ -118,3 +126,95 @@ def validate_extra_args(args: Optional[Iterable[str]]) -> list[str]: def is_managed_flag(flag: str) -> bool: """True if ``flag`` is a Studio-managed llama-server flag.""" return flag in _DENYLIST + + +# Pass-through flags that shadow first-class ``LoadRequest`` fields +# (max_seq_length, cache_type_kv, speculative_type, +# chat_template_override). Stripped from inherited extras so they +# can't last-wins-override an Apply that re-sets the same first-class +# field. +_CONTEXT_FLAGS: frozenset[str] = frozenset({"-c", "--ctx-size"}) +_CACHE_FLAGS: frozenset[str] = frozenset( + {"-ctk", "--cache-type-k", "-ctv", "--cache-type-v"} +) +_SPEC_FLAGS: frozenset[str] = frozenset( + { + "--spec-default", + "--spec-type", + "--spec-ngram-size-n", + "--spec-ngram-size", + "--draft-min", + "--draft-max", + } +) +_TEMPLATE_FLAGS: frozenset[str] = frozenset( + { + "--chat-template", + "--chat-template-file", + "--chat-template-kwargs", + "--jinja", + "--no-jinja", + } +) + +_SHADOWING_FLAGS: frozenset[str] = ( + _CONTEXT_FLAGS | _CACHE_FLAGS | _SPEC_FLAGS | _TEMPLATE_FLAGS +) + +# Boolean flags inside _SHADOWING_FLAGS that take no value. The +# value-consuming heuristic in strip_shadowing_flags must skip just the +# flag for these, never the following token. +_BOOLEAN_SHADOWING_FLAGS: frozenset[str] = frozenset( + {"--spec-default", "--jinja", "--no-jinja"} +) + + +def strip_shadowing_flags( + args: Iterable[str], + *, + strip_context: bool = True, + strip_cache: bool = True, + strip_spec: bool = True, + strip_template: bool = True, +) -> list[str]: + """Strip flags that shadow first-class Studio settings. + + Used when the route inherits a previous load's ``llama_extra_args`` + so that an inherited ``-c 4096`` cannot override the current + request's ``max_seq_length`` (and equivalents for cache / + speculative / chat template). Each ``strip_*`` flag controls one + group; the route only strips groups whose corresponding first-class + field was actually supplied by the caller, so an inherited + ``--chat-template-file`` survives an Apply that omits both + ``llama_extra_args`` and ``chat_template_override``. + """ + shadowing: set[str] = set() + if strip_context: + shadowing |= _CONTEXT_FLAGS + if strip_cache: + shadowing |= _CACHE_FLAGS + if strip_spec: + shadowing |= _SPEC_FLAGS + if strip_template: + shadowing |= _TEMPLATE_FLAGS + + tokens = [str(a) for a in (args or [])] + out: list[str] = [] + i, n = 0, len(tokens) + while i < n: + tok = tokens[i] + flag = _flag_name(tok) + if flag is None or flag not in shadowing: + out.append(tok) + i += 1 + continue + # Drop this token. Boolean shadowing flags never carry a value; + # other shadowing flags consume the next token when it isn't a + # flag and the value isn't already packed as ``--key=value``. + if flag in _BOOLEAN_SHADOWING_FLAGS or "=" in tok: + i += 1 + elif i + 1 < n and _flag_name(tokens[i + 1]) is None: + i += 2 + else: + i += 1 + return out diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py index 76bbb59c94..60078ecc9b 100644 --- a/studio/backend/routes/inference.py +++ b/studio/backend/routes/inference.py @@ -119,7 +119,10 @@ try: _DEFAULT_T_MAX_PREDICT_MS, detect_reasoning_flags, ) - from core.inference.llama_server_args import validate_extra_args + from core.inference.llama_server_args import ( + strip_shadowing_flags, + validate_extra_args, + ) from utils.models import ModelConfig from utils.inference import load_inference_config from utils.models.model_config import load_model_defaults @@ -141,7 +144,10 @@ except ImportError: _DEFAULT_T_MAX_PREDICT_MS, detect_reasoning_flags, ) - from core.inference.llama_server_args import validate_extra_args + from core.inference.llama_server_args import ( + strip_shadowing_flags, + validate_extra_args, + ) from utils.models import ModelConfig from utils.inference import load_inference_config from utils.models.model_config import load_model_defaults @@ -406,6 +412,57 @@ def _validate_native_mmproj_companion( ) from exc +def _normalise_settings_str(value: Optional[str]) -> Optional[str]: + """Lowercase + strip a settings string, mapping blank/None to None.""" + if value is None: + return None + if isinstance(value, str): + stripped = value.strip().lower() + return stripped or None + return value + + +def _request_matches_loaded_settings( + request: LoadRequest, llama_backend: LlamaCppBackend +) -> bool: + """True iff every runtime setting on the request matches the loaded + server. Caller has already checked model+variant+is_loaded. See #5401.""" + # Compare requested n_ctx (not effective) so VRAM-cap doesn't mask + # an Auto-vs-explicit slider flip. + if request.max_seq_length != llama_backend.requested_n_ctx: + return False + if _normalise_settings_str(request.cache_type_kv) != _normalise_settings_str( + llama_backend.cache_type_kv + ): + return False + # Vision loads silently drop speculative decoding (llama_cpp.py gates + # spec on ``not is_vision``), so treat the request as ``off`` against + # the backend's ``None`` to avoid forcing a redundant reload. + if llama_backend.is_vision: + req_spec = "off" + else: + req_spec = _normalise_settings_str(request.speculative_type) or "off" + backend_spec = _normalise_settings_str(llama_backend.speculative_type) or "off" + if req_spec != backend_spec: + return False + if (request.chat_template_override or None) != ( + llama_backend.chat_template_override or None + ): + return False + # llama_extra_args=None means "inherit"; only an explicit list that + # differs forces a reload. On the inherit path, refuse to match if + # stored extras contain any shadow flag, so the reload path can + # strip them instead of leaving a stale override in effect. + backend_extra = list(llama_backend.extra_args) if llama_backend.extra_args else [] + if request.llama_extra_args is None: + if backend_extra and strip_shadowing_flags(backend_extra) != backend_extra: + return False + else: + if list(request.llama_extra_args) != backend_extra: + return False + return True + + def _resolve_model_identifier_for_request( request: LoadRequest | ValidateModelRequest, *, @@ -461,6 +518,11 @@ async def load_model( extra_llama_args = validate_extra_args(request.llama_extra_args) except ValueError as exc: raise HTTPException(status_code = 400, detail = str(exc)) + # Re-narrow []-from-None back to None so the inheritance path + # below can tell "caller omitted" from "caller explicit []". + extra_llama_args: Optional[list[str]] = ( + None if request.llama_extra_args is None else extra_llama_args + ) model_identifier, model_log_label, native_grant_backed = ( _resolve_model_identifier_for_request(request, operation = "load-model") @@ -479,6 +541,9 @@ async def load_model( and llama_backend.hf_variant.lower() == request.gguf_variant.lower() and llama_backend.model_identifier and llama_backend.model_identifier.lower() == model_identifier.lower() + # Also require runtime settings to match so Apply changes + # aren't silently dropped (#5401). + and _request_matches_loaded_settings(request, llama_backend) ): logger.info( f"Model already loaded (GGUF): {model_log_label} variant={request.gguf_variant}, skipping reload" @@ -613,6 +678,70 @@ async def load_model( ) unsloth_backend.unload_model(unsloth_backend.active_model_name) + # Inherit llama_extra_args from the previous load when the + # request omits the field (the chat-settings Apply path + # does not round-trip them; explicit [] still clears). + # Inheritance is gated on (model_identifier, hf_variant) + # to refuse cross-model pickup, and shadowing flags are + # stripped so an inherited override can't win the last-wins + # CLI parse against a freshly-supplied first-class field. + if request.llama_extra_args is None and llama_backend.extra_args: + source = llama_backend.extra_args_source + # Compare against the resolved variant, not the request + # field: callers commonly omit gguf_variant for local + # ``.gguf`` paths and HF auto-pick flows. ``config.gguf_ + # variant`` is the variant load_model was actually + # invoked with (see the HF / local branches below), so + # both sides of the comparison key off the same string. + resolved_variant = config.gguf_variant + same_source = bool( + source + and source[0] + and source[0].lower() == model_identifier.lower() + and (source[1] or "").lower() == (resolved_variant or "").lower() + ) + if not same_source: + logger.info( + "Not inheriting llama_extra_args: stored args came " + "from %s, loading %s", + source, + (model_identifier, resolved_variant), + ) + # Cross-model: clear explicitly so the backend + # doesn't inherit via "no opinion" semantics. + extra_llama_args = [] + else: + # Strip only the groups whose first-class field + # was actually set by the caller, so an inherited + # --chat-template-file survives an Apply that omits + # chat_template_override. + fields_set = getattr(request, "model_fields_set", set()) + stripped = strip_shadowing_flags( + llama_backend.extra_args, + strip_context = "max_seq_length" in fields_set, + strip_cache = "cache_type_kv" in fields_set, + strip_spec = "speculative_type" in fields_set, + strip_template = "chat_template_override" in fields_set, + ) + try: + extra_llama_args = validate_extra_args(stripped) + except ValueError: + # Should not happen on already-validated args; degrade + # to no-extras rather than 400 if managed flags changed. + logger.warning( + "Stored llama_extra_args failed revalidation; " + "loading without them: %s", + stripped, + ) + extra_llama_args = [] + else: + if extra_llama_args: + logger.info( + "Inheriting llama_extra_args from previous " + "load (same model, shadow-stripped): %s", + extra_llama_args, + ) + # Route to HF mode or local mode based on config # Run in a thread so the event loop stays free for progress # polling and other requests during the (potentially long) @@ -645,6 +774,10 @@ async def load_model( llama_backend.load_model, gguf_path = config.gguf_file, mmproj_path = config.gguf_mmproj_file, + # Pass the resolved variant so _extra_args_source + # is keyed off the same string the inheritance + # check at the top of /load uses (#5401 followup). + hf_variant = config.gguf_variant, model_identifier = config.identifier, is_vision = config.is_vision, n_ctx = request.max_seq_length, diff --git a/studio/backend/tests/test_gguf_reload_inheritance.py b/studio/backend/tests/test_gguf_reload_inheritance.py new file mode 100644 index 0000000000..4b0b450cb0 --- /dev/null +++ b/studio/backend/tests/test_gguf_reload_inheritance.py @@ -0,0 +1,237 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""Backend contract for the GGUF reload duplicate-load guard. + +``LlamaCppBackend._already_in_target_state`` is the in-process +short-circuit that prevents a serialised duplicate /load from killing +the just-spawned llama-server. These tests pin the local-file +identity, the HF-mode hf_variant fallback, and the ``extra_args`` +None-vs-[] inherit semantics so the guard cannot silently regress. +""" + +from __future__ import annotations + +import sys +import types as _types +from pathlib import Path + +_BACKEND_DIR = str(Path(__file__).resolve().parent.parent) +if _BACKEND_DIR not in sys.path: + sys.path.insert(0, _BACKEND_DIR) + +_loggers_stub = _types.ModuleType("loggers") +_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name) +sys.modules.setdefault("loggers", _loggers_stub) + +_structlog_stub = _types.ModuleType("structlog") +_structlog_stub.get_logger = lambda *a, **k: __import__("logging").getLogger("stub") +sys.modules.setdefault("structlog", _structlog_stub) + +_httpx_stub = _types.ModuleType("httpx") +for _exc in ( + "ConnectError", + "TimeoutException", + "ReadTimeout", + "ReadError", + "RemoteProtocolError", + "CloseError", +): + setattr(_httpx_stub, _exc, type(_exc, (Exception,), {})) +_httpx_stub.Timeout = type("T", (), {"__init__": lambda s, *a, **k: None}) +_httpx_stub.Client = type( + "C", + (), + { + "__init__": lambda s, **kw: None, + "__enter__": lambda s: s, + "__exit__": lambda s, *a: None, + }, +) +sys.modules.setdefault("httpx", _httpx_stub) + +from core.inference.llama_cpp import LlamaCppBackend + + +class _FakeProcess: + """Stand-in for subprocess.Popen so atexit cleanup doesn't crash.""" + + def terminate(self): + pass + + def wait(self, timeout = None): + return 0 + + def kill(self): + pass + + def poll(self): + return 0 + + +def _loaded_backend(**overrides): + backend = LlamaCppBackend() + backend._process = _FakeProcess() # is_loaded only checks "is not None" + backend._healthy = True + backend._model_identifier = "owner/repo" + backend._hf_variant = "Q4_K_M" + backend._requested_n_ctx = 8192 + backend._cache_type_kv = None + backend._speculative_type = None + backend._chat_template_override = None + backend._is_vision = False + backend._extra_args = None + backend._extra_args_source = None + backend._gguf_path = None + for key, value in overrides.items(): + setattr(backend, key, value) + return backend + + +# ── Local-file identity via gguf_path ──────────────────────────────── + + +def test_already_in_target_state_uses_gguf_path_when_present(tmp_path): + gguf_file = tmp_path / "model.Q4_K_M.gguf" + gguf_file.write_bytes(b"") + backend = _loaded_backend( + _hf_variant = "Q4_K_M", + _gguf_path = str(gguf_file), + ) + assert ( + backend._already_in_target_state( + gguf_path = str(gguf_file), + model_identifier = "owner/repo", + hf_variant = None, + n_ctx = 8192, + cache_type_kv = None, + speculative_type = None, + chat_template_override = None, + extra_args = None, + is_vision = False, + ) + is True + ) + + +def test_already_in_target_state_rejects_different_gguf_path(tmp_path): + a = tmp_path / "a.gguf" + a.write_bytes(b"") + b = tmp_path / "b.gguf" + b.write_bytes(b"") + backend = _loaded_backend(_gguf_path = str(a)) + assert ( + backend._already_in_target_state( + gguf_path = str(b), + model_identifier = "owner/repo", + hf_variant = None, + n_ctx = 8192, + cache_type_kv = None, + speculative_type = None, + chat_template_override = None, + extra_args = None, + is_vision = False, + ) + is False + ) + + +# ── HF mode falls back to hf_variant comparison ────────────────────── + + +def test_already_in_target_state_falls_back_to_hf_variant_for_hf_loads(): + backend = _loaded_backend(_hf_variant = "Q4_K_M", _gguf_path = None) + assert ( + backend._already_in_target_state( + gguf_path = None, + model_identifier = "owner/repo", + hf_variant = "Q8_0", + n_ctx = 8192, + cache_type_kv = None, + speculative_type = None, + chat_template_override = None, + extra_args = None, + is_vision = False, + ) + is False + ) + + +def test_already_in_target_state_hf_same_variant_matches(): + backend = _loaded_backend(_hf_variant = "Q4_K_M", _gguf_path = None) + assert ( + backend._already_in_target_state( + gguf_path = None, + model_identifier = "owner/repo", + hf_variant = "Q4_K_M", + n_ctx = 8192, + cache_type_kv = None, + speculative_type = None, + chat_template_override = None, + extra_args = None, + is_vision = False, + ) + is True + ) + + +# ── extra_args: None inherits, [] forces reload, list enforces ─────── + + +def test_already_in_target_state_none_extras_inherits_stored(): + backend = _loaded_backend(_extra_args = ["--top-k", "20"]) + assert ( + backend._already_in_target_state( + gguf_path = None, + model_identifier = "owner/repo", + hf_variant = "Q4_K_M", + n_ctx = 8192, + cache_type_kv = None, + speculative_type = None, + chat_template_override = None, + extra_args = None, + is_vision = False, + ) + is True + ) + + +def test_already_in_target_state_empty_extras_forces_reload_when_stored(): + backend = _loaded_backend(_extra_args = ["--top-k", "20"]) + assert ( + backend._already_in_target_state( + gguf_path = None, + model_identifier = "owner/repo", + hf_variant = "Q4_K_M", + n_ctx = 8192, + cache_type_kv = None, + speculative_type = None, + chat_template_override = None, + extra_args = [], + is_vision = False, + ) + is False + ) + + +def test_already_in_target_state_explicit_extras_match(): + backend = _loaded_backend(_extra_args = ["--top-k", "20"]) + assert ( + backend._already_in_target_state( + gguf_path = None, + model_identifier = "owner/repo", + hf_variant = "Q4_K_M", + n_ctx = 8192, + cache_type_kv = None, + speculative_type = None, + chat_template_override = None, + extra_args = ["--top-k", "20"], + is_vision = False, + ) + is True + ) + + +def test_extra_args_source_default_is_none(): + backend = LlamaCppBackend() + assert backend.extra_args_source is None diff --git a/studio/backend/tests/test_llama_server_args.py b/studio/backend/tests/test_llama_server_args.py index 351fbd014d..3013acfdb8 100644 --- a/studio/backend/tests/test_llama_server_args.py +++ b/studio/backend/tests/test_llama_server_args.py @@ -15,6 +15,7 @@ import pytest from core.inference.llama_server_args import ( is_managed_flag, + strip_shadowing_flags, validate_extra_args, ) @@ -187,3 +188,120 @@ def test_is_managed_flag_false_for_pass_through(): assert is_managed_flag("--flash-attn") is False assert is_managed_flag("-ngl") is False assert is_managed_flag("--threads") is False + + +# ── strip_shadowing_flags ───────────────────────────────────────────── + + +def test_strip_shadowing_flags_drops_context_when_requested(): + out = strip_shadowing_flags( + ["-c", "4096", "--top-k", "20"], + strip_context = True, + strip_cache = False, + strip_spec = False, + strip_template = False, + ) + assert out == ["--top-k", "20"] + + +def test_strip_shadowing_flags_keeps_context_when_not_requested(): + out = strip_shadowing_flags( + ["-c", "4096", "--top-k", "20"], + strip_context = False, + strip_cache = False, + strip_spec = False, + strip_template = False, + ) + assert out == ["-c", "4096", "--top-k", "20"] + + +def test_strip_shadowing_flags_keeps_chat_template_when_template_disabled(): + # Caller did not supply chat_template_override; the inherited + # --chat-template-file must survive the strip. + out = strip_shadowing_flags( + ["--chat-template-file", "/tmp/custom.jinja", "--top-k", "20"], + strip_context = True, + strip_cache = True, + strip_spec = True, + strip_template = False, + ) + assert out == ["--chat-template-file", "/tmp/custom.jinja", "--top-k", "20"] + + +def test_strip_shadowing_flags_drops_template_when_requested(): + out = strip_shadowing_flags( + ["--chat-template-file", "/tmp/custom.jinja", "--top-k", "20"], + strip_template = True, + ) + assert out == ["--top-k", "20"] + + +def test_strip_shadowing_flags_keeps_cache_when_cache_disabled(): + out = strip_shadowing_flags( + ["--cache-type-k", "q8_0", "--cache-type-v", "q8_0", "--top-k", "20"], + strip_cache = False, + ) + assert out == [ + "--cache-type-k", + "q8_0", + "--cache-type-v", + "q8_0", + "--top-k", + "20", + ] + + +def test_strip_shadowing_flags_keeps_spec_when_spec_disabled(): + out = strip_shadowing_flags( + ["--spec-type", "ngram-mod", "--draft-min", "48", "--top-k", "20"], + strip_spec = False, + ) + assert out == [ + "--spec-type", + "ngram-mod", + "--draft-min", + "48", + "--top-k", + "20", + ] + + +def test_strip_shadowing_flags_boolean_does_not_consume_next_token(): + # --spec-default is a boolean shadowing flag; the value-skipping + # heuristic must skip just the flag, not the following positional. + out = strip_shadowing_flags(["--spec-default", "ngram-mod"], strip_spec = True) + assert out == ["ngram-mod"] + + +def test_strip_shadowing_flags_jinja_boolean_preserves_positional(): + out = strip_shadowing_flags(["--jinja", "trailing-positional"], strip_template = True) + assert out == ["trailing-positional"] + + +def test_strip_shadowing_flags_no_jinja_boolean_preserves_positional(): + out = strip_shadowing_flags( + ["--no-jinja", "trailing-positional"], strip_template = True + ) + assert out == ["trailing-positional"] + + +def test_strip_shadowing_flags_equals_form_drops_only_the_flag(): + out = strip_shadowing_flags(["--ctx-size=4096", "--seed", "-1"], strip_context = True) + assert out == ["--seed", "-1"] + + +def test_strip_shadowing_flags_handles_none_input(): + assert strip_shadowing_flags(None) == [] + + +def test_strip_shadowing_flags_handles_empty_input(): + assert strip_shadowing_flags([]) == [] + + +def test_strip_shadowing_flags_defaults_strip_everything(): + # The route's already-loaded comparator calls strip_shadowing_flags + # with no kwargs to detect ANY shadowing flag in stored extras. + out = strip_shadowing_flags( + ["-c", "4096", "--cache-type-k", "q8_0", "--spec-default", "--jinja"] + ) + assert out == [] From 0542dc07259c693fb98c32805416bf564e437aec Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Sun, 17 May 2026 04:20:46 -0700 Subject: [PATCH 06/62] Studio: IME / multilingual composer regression test + RTL dir="auto" (#5485) Adds dir="auto" to the main, edit, and compare chat composers so RTL scripts (Arabic, Hebrew, Persian, Urdu) flow right to left without forcing the rest of the UI into RTL. Wires a model-free Playwright smoke (multilingual paste round trip across 31 scripts + a stuck-IME composition repro for issue #5318 / PR #5327) into the Studio UI CI job as a third Studio boot, plus a pure-Python static-guard test that locks down dir="auto" on all three composers and the minimal env contract for the smoke. --- .github/workflows/studio-ui-smoke.yml | 55 ++- .../src/components/assistant-ui/thread.tsx | 5 + .../src/features/chat/shared-composer.tsx | 3 + tests/studio/playwright_chat_ime_i18n.py | 457 ++++++++++++++++++ .../test_composer_rtl_bidi_attribute.py | 73 +++ 5 files changed, 588 insertions(+), 5 deletions(-) create mode 100644 tests/studio/playwright_chat_ime_i18n.py create mode 100644 tests/studio/test_composer_rtl_bidi_attribute.py diff --git a/.github/workflows/studio-ui-smoke.yml b/.github/workflows/studio-ui-smoke.yml index 79476a62ea..455fe4b7e1 100644 --- a/.github/workflows/studio-ui-smoke.yml +++ b/.github/workflows/studio-ui-smoke.yml @@ -229,12 +229,55 @@ jobs: kill "${STUDIO_EXTRA_PID}" 2>/dev/null || true sleep 2 + # IME + multilingual paste regression (issue #5318 / PR #5327). + # Third Studio on its own port so a hang here cannot poison the + # earlier UI tests. No GGUF -- the bug surface is the composer. + - name: Reset auth + boot Studio for IME / i18n tests (port 18896) + run: | + unsloth studio reset-password + mkdir -p logs + UNSLOTH_API_ONLY=1 unsloth studio -H 127.0.0.1 -p 18896 \ + > logs/studio_ime.log 2>&1 & + echo "STUDIO_IME_PID=$!" >> "$GITHUB_ENV" + + - name: Wait for /api/health on 18896 + run: | + for i in $(seq 1 180); do + if curl -fs "http://127.0.0.1:18896/api/health" > /tmp/health3.json; then + jq -e '.status == "healthy"' /tmp/health3.json && break + fi + sleep 1 + done + jq -e '.status == "healthy"' /tmp/health3.json + + - name: Pass bootstrap pw for IME / i18n test + # IME smoke does the change-password against the bootstrap that + # Studio's frontend injects into the page, so it only needs the + # NEW password. + run: | + NEW="CIIme-$(python -c 'import secrets; print(secrets.token_urlsafe(16))')" + echo "::add-mask::$NEW" + echo "STUDIO_IME_NEW_PW=$NEW" >> "$GITHUB_ENV" + + - name: Drive IME + multilingual paste regression with Playwright + env: + BASE_URL: http://127.0.0.1:18896 + STUDIO_NEW_PW: ${{ env.STUDIO_IME_NEW_PW }} + PW_ART_DIR: logs/playwright_ime + STUDIO_UI_STRICT: '1' + run: | + mkdir -p logs/playwright_ime + python tests/studio/playwright_chat_ime_i18n.py + + - name: Stop third Studio + if: always() + run: | + kill "${STUDIO_IME_PID}" 2>/dev/null || true + sleep 2 + - name: Upload Playwright artifacts - # Always upload (not just failure) so a green run's screenshots - # are reviewable in the Actions UI -- catches "passed but the - # UI is silently broken" regressions that would be invisible - # otherwise. Both Studio's logs (chat + extra) and BOTH - # Playwright artifact dirs are bundled. + # Always upload so a green run's screenshots stay reviewable -- + # catches "passed but the UI is silently broken" regressions. if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: @@ -242,7 +285,9 @@ jobs: path: | logs/studio.log logs/studio_extra.log + logs/studio_ime.log logs/install.log logs/playwright logs/playwright_extra + logs/playwright_ime retention-days: 7 diff --git a/studio/frontend/src/components/assistant-ui/thread.tsx b/studio/frontend/src/components/assistant-ui/thread.tsx index fb63748bf1..c8fea9c704 100644 --- a/studio/frontend/src/components/assistant-ui/thread.tsx +++ b/studio/frontend/src/components/assistant-ui/thread.tsx @@ -328,6 +328,9 @@ const Composer: FC<{ disabled?: boolean }> = ({ disabled }) => { autoFocus={!disabled} disabled={disabled} aria-label="Message input" + // dir="auto": browser picks LTR/RTL from the first strong char; + // no effect on Latin / CJK / Devanagari. + dir="auto" {...inputProps} /> {
diff --git a/studio/frontend/src/features/chat/shared-composer.tsx b/studio/frontend/src/features/chat/shared-composer.tsx index c4ffa98467..cd31d37cd7 100644 --- a/studio/frontend/src/features/chat/shared-composer.tsx +++ b/studio/frontend/src/features/chat/shared-composer.tsx @@ -690,6 +690,9 @@ export function SharedComposer({ placeholder="Send to both models..." className="composer-input" rows={1} + // dir="auto" auto-detects RTL (Arabic / Hebrew / Persian / Urdu) + // from the first strong character; no effect on LTR scripts. + dir="auto" />
diff --git a/tests/studio/playwright_chat_ime_i18n.py b/tests/studio/playwright_chat_ime_i18n.py new file mode 100644 index 0000000000..c882d88cbd --- /dev/null +++ b/tests/studio/playwright_chat_ime_i18n.py @@ -0,0 +1,457 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""Studio chat composer IME + multilingual regression smoke. + +Covers two surfaces: + A. Stuck IME composition (issue #5318 / PR #5327): duplicate + compositionstart with no compositionend left isComposing=true, + dropping all subsequent keystrokes including ASCII. + B. Multilingual paste round-trip across 31 scripts -- guards the + controlled-textarea / React state plumbing against Unicode mangling. + +Model-free; the bug surface is the composer, not inference. + +Env contract matches playwright_chat_ui.py: + BASE_URL, STUDIO_NEW_PW, PW_ART_DIR, STUDIO_UI_STRICT. +""" + +import os +import sys +from pathlib import Path + +from playwright.sync_api import expect, sync_playwright + +sys.path.insert(0, str(Path(__file__).resolve().parent)) +from _playwright_robust import ( # noqa: E402 + chromium_launch_args, + click_and_wait_for_response, + install_view_transition_killer, + install_wall_clock_watchdog, + is_benign_console_error, + is_benign_page_error, + recover_or_replace_page, + wait_for_health, +) + +BASE = os.environ["BASE_URL"] +NEW = os.environ["STUDIO_NEW_PW"] +ART_DIR = os.environ.get("PW_ART_DIR", "logs/playwright_ime") +ART = Path(ART_DIR) +ART.mkdir(parents = True, exist_ok = True) +STRICT = os.environ.get("STUDIO_UI_STRICT", "0") == "1" + +# Wall-clock cap. Realistic run is 30-60s; 5 min leaves cold-launch headroom. +WALL_TIMEOUT_S = float(os.environ.get("STUDIO_IME_WALL_TIMEOUT_S", "300")) + + +# One short greeting + arithmetic per script (ordered by speaker count) -- +# each entry catches a distinct class of Unicode regression. +I18N_SAMPLES = [ + ("en", "English", "Hello, 1+1=2"), + ("zh-CN", "Chinese (Simplified)", "你好，1+1=2"), + ("es", "Spanish", "Hola, 1+1=2"), + ("hi", "Hindi (Devanagari)", "नमस्ते, 1+1=2"), + ("ar", "Arabic (RTL)", "مرحبا، ١+١=٢"), + ("bn", "Bengali", "নমস্কার, ১+১=২"), + ("pt", "Portuguese", "Olá, 1+1=2"), + ("ru", "Russian (Cyrillic)", "Привет, 1+1=2"), + ("ja", "Japanese", "こんにちは、1+1=2"), + ("pa", "Punjabi (Gurmukhi)", "ਸਤ ਸ੍ਰੀ ਅਕਾਲ, 1+1=2"), + ("de", "German", "Hallo, 1+1=2"), + ("jv", "Javanese", "Halo, 1+1=2"), + ("ko", "Korean (Hangul)", "안녕하세요, 1+1=2"), + ("fr", "French", "Bonjour, 1+1=2"), + ("tr", "Turkish", "Merhaba, 1+1=2"), + ("vi", "Vietnamese (diacritics)", "Xin chào, 1+1=2"), + ("ur", "Urdu (Arabic-Naskh)", "ہیلو، 1+1=2"), + ("ta", "Tamil", "வணக்கம், 1+1=2"), + ("te", "Telugu", "నమస్తే, 1+1=2"), + ("mr", "Marathi (Devanagari)", "नमस्कार, 1+1=2"), + ("it", "Italian", "Ciao, 1+1=2"), + ("th", "Thai", "สวัสดี, ๑+๑=๒"), + ("pl", "Polish", "Cześć, 1+1=2"), + ("uk", "Ukrainian (Cyrillic)", "Привіт, 1+1=2"), + ("fa", "Persian (RTL)", "سلام، ۱+۱=۲"), + ("nl", "Dutch", "Hallo, 1+1=2"), + ("he", "Hebrew (RTL)", "שלום, 1+1=2"), + ("el", "Greek", "Γειά, 1+1=2"), + ("id", "Indonesian", "Halo, 1+1=2"), + ("sw", "Swahili", "Habari, 1+1=2"), + ("emoji", "Emoji + ZWJ + flag", "👋 🇺🇳 👨‍👩‍👧‍👦 1+1=2"), +] + + +_n = [0] + + +def step(s): + print(f"[ime] STEP {s}", flush = True) + + +def info(s): + print(f"[ime] {s}", flush = True) + + +def fail(m): + raise AssertionError(f"[ime] FAIL: {m}") + + +def soft_fail(m): + """Hard fail in STRICT mode, info-warn otherwise. Mirrors playwright_chat_ui.py.""" + if STRICT: + fail(m) + info(f"WARN (strict-off): {m}") + + +with sync_playwright() as p: + _watchdog = install_wall_clock_watchdog( + WALL_TIMEOUT_S, + label = "ime", + info = info, + ) + wait_for_health(BASE, timeout = 30.0, info = info) + browser = p.chromium.launch( + headless = True, + args = chromium_launch_args(), + ) + ctx = browser.new_context( + viewport = {"width": 1280, "height": 900}, + reduced_motion = "reduce", + ) + install_view_transition_killer(ctx) + page = ctx.new_page() + page.set_default_timeout(60_000) + + page_errors: list[str] = [] + console_errors: list[str] = [] + + def _on_console(m): + if m.type != "error": + return + try: + console_errors.append(m.text) + except Exception: + return + + def _attach_listeners(target): + target.on("pageerror", lambda e: page_errors.append(str(e))) + target.on("console", _on_console) + + _attach_listeners(page) + + def shoot(name): + _n[0] += 1 + try: + page.screenshot( + path = str(ART / f"{_n[0]:02d}-{name}.png"), + full_page = True, + timeout = 90_000, + animations = "disabled", + ) + except Exception as _shoot_err: + info(f"WARN: screenshot {name} failed: {_shoot_err}") + + # 1. Bootstrap auth via /change-password (mirrors playwright_chat_ui.py + # retry-on-rerender to absorb React form-detach races). + step("change-password through UI (Setup your account)") + form_err: Exception | None = None + for _form_attempt in range(3): + try: + page.goto( + f"{BASE}/change-password", + wait_until = "domcontentloaded", + timeout = 60_000, + ) + try: + page.wait_for_load_state("networkidle", timeout = 30_000) + except Exception: + pass + pw_field = page.locator("#new-password") + pw_field.wait_for(state = "visible", timeout = 60_000) + pw_field.fill(NEW, timeout = 60_000) + page.fill("#confirm-password", NEW, timeout = 60_000) + shoot("01-change-password-filled") + status, _ = click_and_wait_for_response( + page, + url_substr = "/api/auth/change-password", + method = "POST", + do_click = lambda: page.locator('button[type="submit"]').click(), + timeout_ms = 30_000, + info = lambda m: print(f"[ime] {m}", flush = True), + ) + if status is not None and status >= 400: + raise AssertionError(f"change-password POST returned {status}") + form_err = None + break + except Exception as e: + form_err = e + info( + f"change-password attempt {_form_attempt + 1} failed: " + f"{type(e).__name__}: {str(e)[:200]}" + ) + if _form_attempt < 2: + page = recover_or_replace_page( + page, + ctx, + default_timeout_ms = 60_000, + info = lambda m: print(f"[ime] recovery: {m}", flush = True), + ) + _attach_listeners(page) + if form_err is not None: + raise form_err + + # 2. Wait for composer mount. No GGUF: the bug surface is React state, not inference. + step("wait for composer to mount") + try: + page.wait_for_load_state("networkidle", timeout = 30_000) + except Exception: + pass + composer = page.locator('textarea[aria-label="Message input"]') + _mount_err: Exception | None = None + for _mount_attempt in range(2): + try: + composer.wait_for(state = "visible", timeout = 60_000) + _mount_err = None + break + except Exception as e: + _mount_err = e + info( + f"composer.wait_for attempt {_mount_attempt + 1} failed: " + f"{type(e).__name__}: {str(e)[:200]}" + ) + try: + shoot(f"02-composer-wait-attempt-{_mount_attempt + 1}-fail") + except Exception: + pass + if _mount_attempt == 0: + page = recover_or_replace_page( + page, + ctx, + default_timeout_ms = 60_000, + info = lambda m: print(f"[ime] recovery: {m}", flush = True), + ) + _attach_listeners(page) + composer = page.locator('textarea[aria-label="Message input"]') + if _mount_err is not None: + raise _mount_err + composer.click() + shoot("02-composer-focused") + + # Main composer must carry dir="auto" so RTL flows right-to-left. + dir_attr = composer.evaluate("(el) => el.getAttribute('dir')") + if dir_attr != "auto": + soft_fail( + f'composer is missing dir="auto" (got {dir_attr!r}); RTL ' + "languages will render LTR." + ) + else: + info('composer dir="auto" present') + + # Source-level guard for the edit and compare composers (neither + # is mounted here): grep the JSX for dir="auto" inside each block. + _repo_root = Path(__file__).resolve().parents[2] + _thread_src = ( + _repo_root / "studio/frontend/src/components/assistant-ui/thread.tsx" + ).read_text() + _shared_src = ( + _repo_root / "studio/frontend/src/features/chat/shared-composer.tsx" + ).read_text() + _edit_idx = _thread_src.find("aui-edit-composer-input") + if _edit_idx == -1 or 'dir="auto"' not in _thread_src[_edit_idx : _edit_idx + 600]: + soft_fail('edit composer source is missing dir="auto"') + else: + info('edit composer dir="auto" present (source)') + _compare_idx = _shared_src.find("Send to both models") + if ( + _compare_idx == -1 + or 'dir="auto"' + not in _shared_src[max(_compare_idx - 400, 0) : _compare_idx + 400] + ): + soft_fail('compare composer source is missing dir="auto"') + else: + info('compare composer dir="auto" present (source)') + + def read_value() -> str: + return composer.evaluate("(el) => el.value") + + def set_value_via_setter(s: str) -> str: + """Write via React's monkey-patched setter + paste input event, + then await two rAFs so the controlled value is committed before + readback (plain `.value=s` would be overwritten on next render).""" + return composer.evaluate( + """async (el, v) => { + const setter = Object.getOwnPropertyDescriptor( + window.HTMLTextAreaElement.prototype, 'value' + ).set; + setter.call(el, v); + el.dispatchEvent(new InputEvent('input', { + bubbles: true, + inputType: 'insertFromPaste', + data: v, + })); + await new Promise((r) => requestAnimationFrame(r)); + await new Promise((r) => requestAnimationFrame(r)); + return el.value; + }""", + s, + ) + + def clear() -> None: + set_value_via_setter("") + + # 3. Baseline: ASCII keyboard typing works. Bail fast if not. + step("baseline ASCII keyboard typing") + clear() + composer.click() + for ch in "hello world": + page.keyboard.type(ch) + got = read_value() + if got != "hello world": + fail(f"ASCII typing readback {got!r} != 'hello world'") + info("baseline ASCII OK") + shoot("03-baseline-ascii") + clear() + + # 4. Multilingual paste round-trip; byte-for-byte readback required. + step(f"multilingual paste round-trip ({len(I18N_SAMPLES)} samples)") + paste_failures: list[tuple[str, str, str, str]] = [] + for code, label, text in I18N_SAMPLES: + got = set_value_via_setter(text) + if got != text: + paste_failures.append((code, label, text, got)) + info(f" {code:>6} ({label}): FAIL -- got {got!r}") + else: + info(f" {code:>6} ({label}): OK") + clear() + if paste_failures: + shoot("04-paste-failures") + lines = [ + f" {code} ({label}): want={want!r} got={got!r}" + for code, label, want, got in paste_failures + ] + fail( + f"{len(paste_failures)}/{len(I18N_SAMPLES)} languages failed paste round-trip:\n" + + "\n".join(lines) + ) + info(f"all {len(I18N_SAMPLES)} multilingual paste samples OK") + shoot("04-paste-all-ok") + + # 5. Healthy IME composition (compositionstart/update/end + insert events). + step("normal IME composition (compose 你好)") + clear() + composer.click() + composer.evaluate( + """(el) => { + el.focus(); + el.dispatchEvent(new CompositionEvent('compositionstart', {bubbles:true, data:''})); + el.dispatchEvent(new CompositionEvent('compositionupdate', {bubbles:true, data:'你'})); + el.dispatchEvent(new CompositionEvent('compositionupdate', {bubbles:true, data:'你好'})); + const setter = Object.getOwnPropertyDescriptor( + window.HTMLTextAreaElement.prototype, 'value' + ).set; + setter.call(el, el.value + '你好'); + el.dispatchEvent(new InputEvent('input', { + bubbles:true, inputType:'insertCompositionText', + data:'你好', isComposing:true, + })); + el.dispatchEvent(new CompositionEvent('compositionend', {bubbles:true, data:'你好'})); + el.dispatchEvent(new InputEvent('input', { + bubbles:true, inputType:'insertFromComposition', data:'你好', + })); + }""" + ) + got = read_value() + if "你好" not in got: + shoot("05-normal-composition-FAIL") + fail(f"normal composition readback {got!r} missing '你好'") + info(f"normal composition OK: ta.value={got!r}") + shoot("05-normal-composition") + clear() + + # 6. Stuck IME repro for issue #5318: duplicate compositionstart with + # no compositionend wedged isComposing=true and dropped ASCII keys. + # PR #5327 cleared the stale state on non-composing input. + step("BUG REPRO: stuck IME composition recovery (issue #5318)") + clear() + composer.click() + composer.evaluate( + """(el) => { + el.focus(); + el.dispatchEvent(new CompositionEvent('compositionstart', {bubbles:true, data:''})); + // Duplicate compositionstart with NO matching compositionend. + // This is exactly the event sequence observed from the IMEs + // in issue #5318 (kei-yamazaki / langxiaopiao030 / PapyrusNotes). + el.dispatchEvent(new CompositionEvent('compositionstart', {bubbles:true, data:''})); + }""" + ) + # Drive the real keyboard path; on the broken build React drops + # 'abcd' and reconciles el.value back to ''. wait_for_function + # crosses the microtask boundary so we see committed React state. + page.keyboard.type("abcd") + try: + page.wait_for_function( + """(el) => el.value === 'abcd'""", + composer.element_handle(), + timeout = 5_000, + ) + except Exception: + pass + after_key = read_value() + info(f"after_key='abcd' readback={after_key!r}") + shoot("06-stuck-composition-recovery") + if after_key != "abcd": + fail( + "stuck-composition repro: keyboard 'abcd' was not preserved after " + f"duplicate compositionstart; readback {after_key!r}. React state " + "likely still stuck in isComposing=true (issue #5318 / before " + "PR #5327)." + ) + # Cross-check React's view of isComposing via the Send button: + # ComposerAction stays disabled while isComposing is true (PR #5327). + send_btn = page.locator('button[aria-label="Send message"]') + if send_btn.count() == 0: + soft_fail("Send button not found after stuck-composition recovery") + else: + try: + expect(send_btn).not_to_be_disabled(timeout = 5_000) + info("Send button correctly enabled after stuck-composition recovery") + except Exception: + soft_fail( + "Send button still disabled after stuck-composition recovery -- " + "React isComposing state likely never cleared" + ) + info("stuck-composition recovery PASS") + clear() + + # 7. Final state. The change-password redirect emits benign 401 noise, + # so we filter via is_benign_* and only fail on real errors. + shoot("07-final") + real_page_errors = [e for e in page_errors if not is_benign_page_error(e)] + real_console_errors = [e for e in console_errors if not is_benign_console_error(e)] + info( + f"page_errors={len(page_errors)} ({len(real_page_errors)} non-benign); " + f"console_errors={len(console_errors)} " + f"({len(real_console_errors)} non-benign)" + ) + if page_errors: + info(f"first page error: {page_errors[0][:200]!r}") + if console_errors: + info(f"first console error: {console_errors[0][:200]!r}") + if real_page_errors: + fail( + f"{len(real_page_errors)} non-benign pageerror events; " + f"first={real_page_errors[0][:200]!r}" + ) + if real_console_errors: + fail( + f"{len(real_console_errors)} non-benign console.error events; " + f"first={real_console_errors[0][:200]!r}" + ) + + info( + f"DONE: ascii=OK paste={len(I18N_SAMPLES)}/{len(I18N_SAMPLES)} " + f"normal_composition=OK stuck_recovery=OK" + ) + _watchdog.cancel() + browser.close() diff --git a/tests/studio/test_composer_rtl_bidi_attribute.py b/tests/studio/test_composer_rtl_bidi_attribute.py new file mode 100644 index 0000000000..5b1437b4fc --- /dev/null +++ b/tests/studio/test_composer_rtl_bidi_attribute.py @@ -0,0 +1,73 @@ +"""Lock down the RTL bidi auto-detection contract on the chat composers. + +The browser's Unicode bidi algorithm only flows Arabic / Hebrew / Persian / +Urdu right-to-left when the textarea carries `dir="auto"`. The three +composer surfaces (main chat, inline edit, compare mode) each need the +attribute, and the IME / i18n Playwright smoke must keep its env contract +minimal (no dead `STUDIO_OLD_PW`). +""" + +from __future__ import annotations + +import re +from pathlib import Path + +REPO = Path(__file__).resolve().parents[2] +THREAD_TSX = REPO / "studio/frontend/src/components/assistant-ui/thread.tsx" +SHARED_TSX = REPO / "studio/frontend/src/features/chat/shared-composer.tsx" +WORKFLOW_YML = REPO / ".github/workflows/studio-ui-smoke.yml" +IME_PY = REPO / "tests/studio/playwright_chat_ime_i18n.py" + + +def _block_around(src: str, anchor: str, radius: int = 600) -> str: + idx = src.find(anchor) + assert idx != -1, f"anchor {anchor!r} not found" + return src[max(idx - radius, 0) : idx + radius] + + +def test_main_composer_has_dir_auto(): + block = _block_around(THREAD_TSX.read_text(), 'aria-label="Message input"') + assert 'dir="auto"' in block, 'main composer is missing dir="auto"' + + +def test_edit_composer_has_dir_auto(): + block = _block_around(THREAD_TSX.read_text(), "aui-edit-composer-input") + assert 'dir="auto"' in block, 'edit composer is missing dir="auto"' + + +def test_compare_composer_has_dir_auto(): + block = _block_around(SHARED_TSX.read_text(), "Send to both models") + assert 'dir="auto"' in block, 'compare composer is missing dir="auto"' + + +def test_ime_workflow_step_does_not_set_studio_old_pw(): + yml = WORKFLOW_YML.read_text() + drive_idx = yml.find("Drive IME + multilingual paste regression") + assert drive_idx != -1, "IME drive step not found in workflow" + next_step_idx = yml.find("- name:", drive_idx + 1) + drive_block = yml[drive_idx : next_step_idx if next_step_idx != -1 else None] + assert ( + "STUDIO_OLD_PW" not in drive_block + ), "IME drive step still passes dead STUDIO_OLD_PW env var" + assert "STUDIO_NEW_PW" in drive_block, "IME drive step missing STUDIO_NEW_PW" + + +def test_ime_pass_password_step_does_not_export_old_pw(): + yml = WORKFLOW_YML.read_text() + pass_idx = yml.find("Pass bootstrap pw for IME / i18n test") + assert pass_idx != -1, "IME password setup step not found" + next_step_idx = yml.find("- name:", pass_idx + 1) + pass_block = yml[pass_idx : next_step_idx if next_step_idx != -1 else None] + assert ( + "STUDIO_IME_OLD_PW" not in pass_block + ), "IME password setup still exports dead STUDIO_IME_OLD_PW" + assert "STUDIO_IME_NEW_PW" in pass_block + + +def test_ime_playwright_script_does_not_read_studio_old_pw(): + src = IME_PY.read_text() + code_only = re.sub(r'""".*?"""', "", src, flags = re.DOTALL) + assert ( + "STUDIO_OLD_PW" not in code_only + ), "IME Playwright script still references dead STUDIO_OLD_PW env var" + assert 'os.environ["STUDIO_NEW_PW"]' in code_only From 4e9d772d364183cd0476d81da7f5e7ad4a7caa3f Mon Sep 17 00:00:00 2001 From: Anmol Mishra Date: Sun, 17 May 2026 19:14:23 +0530 Subject: [PATCH 07/62] fix: preserve tokenizer eos token on merged saves (#5451) Preserves the source tokenizer's eos_token in tokenizer_config.json after merged saves so runtimes such as vLLM read the correct stop token. Centralized inside the patched tokenizer save_pretrained so all save paths (merged_16bit, GGUF, torchao, push_to_hub) benefit, with filename_prefix support. Fixes #5386 --- .../test_preserve_tokenizer_eos_token.py | 106 ++++++++++++++++++ unsloth/save.py | 64 +++++++++++ 2 files changed, 170 insertions(+) create mode 100644 tests/saving/test_preserve_tokenizer_eos_token.py diff --git a/tests/saving/test_preserve_tokenizer_eos_token.py b/tests/saving/test_preserve_tokenizer_eos_token.py new file mode 100644 index 0000000000..6e2f8c7f9d --- /dev/null +++ b/tests/saving/test_preserve_tokenizer_eos_token.py @@ -0,0 +1,106 @@ +import ast +import json +import os +import types +from pathlib import Path + + +class _Logger: + def warning_once(self, *args, **kwargs): + pass + + +def _load_preserve_helper(): + source = Path(__file__).parents[2] / "unsloth" / "save.py" + tree = ast.parse(source.read_text(encoding = "utf-8")) + helper = next( + node + for node in tree.body + if isinstance(node, ast.FunctionDef) + and node.name == "_preserve_tokenizer_eos_token" + ) + module = ast.Module(body = [helper], type_ignores = []) + ast.fix_missing_locations(module) + namespace = {"json": json, "os": os, "logger": _Logger()} + exec(compile(module, str(source), "exec"), namespace) + return namespace["_preserve_tokenizer_eos_token"] + + +def test_preserve_tokenizer_eos_token_restores_gemma4_turn_token(tmp_path): + preserve = _load_preserve_helper() + tokenizer_config = tmp_path / "tokenizer_config.json" + tokenizer_config.write_text( + json.dumps({"eos_token": "", "other": True}), + encoding = "utf-8", + ) + tokenizer = types.SimpleNamespace(eos_token = "") + + preserve(tokenizer, tmp_path) + + saved_config = json.loads(tokenizer_config.read_text(encoding = "utf-8")) + assert saved_config["eos_token"] == "" + assert saved_config["other"] is True + + +def test_preserve_tokenizer_eos_token_supports_processor_tokenizer(tmp_path): + preserve = _load_preserve_helper() + tokenizer_config = tmp_path / "tokenizer_config.json" + tokenizer_config.write_text(json.dumps({"eos_token": ""}), encoding = "utf-8") + processor = types.SimpleNamespace( + tokenizer = types.SimpleNamespace(eos_token = "") + ) + + preserve(processor, tmp_path) + + saved_config = json.loads(tokenizer_config.read_text(encoding = "utf-8")) + assert saved_config["eos_token"] == "" + + +class _StringableToken: + def __str__(self): + return "" + + +def test_preserve_tokenizer_eos_token_serializes_stringable_tokens(tmp_path): + preserve = _load_preserve_helper() + tokenizer_config = tmp_path / "tokenizer_config.json" + tokenizer_config.write_text(json.dumps({"eos_token": ""}), encoding = "utf-8") + tokenizer = types.SimpleNamespace(eos_token = _StringableToken()) + + preserve(tokenizer, tmp_path) + + saved_config = json.loads(tokenizer_config.read_text(encoding = "utf-8")) + assert saved_config["eos_token"] == "" + + +def test_preserve_tokenizer_eos_token_supports_filename_prefix(tmp_path): + preserve = _load_preserve_helper() + prefixed_config = tmp_path / "adapter-tokenizer_config.json" + prefixed_config.write_text( + json.dumps({"eos_token": "", "other": True}), + encoding = "utf-8", + ) + tokenizer = types.SimpleNamespace(eos_token = "") + + preserve(tokenizer, tmp_path, filename_prefix = "adapter") + + saved_config = json.loads(prefixed_config.read_text(encoding = "utf-8")) + assert saved_config["eos_token"] == "" + assert saved_config["other"] is True + # Unprefixed file must not be created as a side effect. + assert not (tmp_path / "tokenizer_config.json").exists() + + +def test_preserve_tokenizer_eos_token_filename_prefix_none_uses_default(tmp_path): + preserve = _load_preserve_helper() + default_config = tmp_path / "tokenizer_config.json" + default_config.write_text( + json.dumps({"eos_token": ""}), + encoding = "utf-8", + ) + tokenizer = types.SimpleNamespace(eos_token = "") + + preserve(tokenizer, tmp_path, filename_prefix = None) + + saved_config = json.loads(default_config.read_text(encoding = "utf-8")) + assert saved_config["eos_token"] == "" diff --git a/unsloth/save.py b/unsloth/save.py index d67a1a0550..3628c468e3 100644 --- a/unsloth/save.py +++ b/unsloth/save.py @@ -424,6 +424,60 @@ def fast_save_pickle(shard, name): return +def _preserve_tokenizer_eos_token(tokenizer, save_directory, filename_prefix = None): + """Restore tokenizer_config.json eos_token from the tokenizer passed to save. + + Some merge paths may re-save or mutate tokenizer metadata after the tokenizer + is written. Gemma 4 instruct models use `` as their chat EOS token; + if tokenizer_config.json is reset to the raw base `` token, runtimes such + as vLLM will not stop generation correctly. Keep the serialized metadata in + sync with the source tokenizer without failing the save if the config is not + present or cannot be edited. + + `filename_prefix` mirrors the same argument on Transformers' + `PreTrainedTokenizerBase.save_pretrained`: when provided, the tokenizer + config is written as `{filename_prefix}-tokenizer_config.json` instead of + `tokenizer_config.json`. + """ + if tokenizer is None or save_directory is None: + return + + source_tokenizer = ( + tokenizer.tokenizer if hasattr(tokenizer, "tokenizer") else tokenizer + ) + eos_token = getattr(source_tokenizer, "eos_token", None) + if eos_token is None and source_tokenizer is not tokenizer: + eos_token = getattr(tokenizer, "eos_token", None) + if eos_token is None: + return + eos_token = str(eos_token) + + tokenizer_config_name = ( + f"{filename_prefix}-tokenizer_config.json" + if filename_prefix + else "tokenizer_config.json" + ) + tokenizer_config = os.path.join(str(save_directory), tokenizer_config_name) + if not os.path.isfile(tokenizer_config): + return + + try: + with open(tokenizer_config, "r", encoding = "utf-8") as file: + config = json.load(file) + + if config.get("eos_token") == eos_token: + return + + config["eos_token"] = eos_token + with open(tokenizer_config, "w", encoding = "utf-8") as file: + json.dump(config, file, indent = 2, ensure_ascii = False) + file.write("\n") + except Exception as error: + logger.warning_once( + f"Unsloth: Could not preserve tokenizer eos_token in {tokenizer_config}: {error}" + ) + + @torch.inference_mode def unsloth_save_model( model, @@ -980,6 +1034,11 @@ def unsloth_save_model( _tokenizer.padding_side = "left" tokenizer.save_pretrained(**tokenizer_save_settings) + _preserve_tokenizer_eos_token( + tokenizer, + tokenizer_save_settings["save_directory"], + filename_prefix = tokenizer_save_settings.get("filename_prefix"), + ) # Revert back padding side _tokenizer.padding_side = old_padding_side @@ -3516,6 +3575,11 @@ def patch_saving_functions(model, vision = False): save_directory, token = kwargs.get("token", None), ) + _preserve_tokenizer_eos_token( + self, + save_directory, + filename_prefix = filename_prefix, + ) if push_to_hub: push_kwargs = dict(kwargs) repo_id = push_kwargs.pop("repo_id", save_directory) From 36ea02ea817b7a85ab982ed1f362cea88ad50e4a Mon Sep 17 00:00:00 2001 From: Roland Tannous <115670425+rolandtannous@users.noreply.github.com> Date: Sun, 17 May 2026 17:49:38 +0400 Subject: [PATCH 08/62] studio/chat: reuse Anthropic code_execution container across turns (#5519) * studio/chat: reuse Anthropic code_execution container across turns Mirror the OpenAI shell-tool reuse path for Anthropic. Backend latches `message.container.id` off the message_start SSE event, emits a synthetic container_ready _toolEvent, and forwards a stored id back on the next turn via the top-level `container` request field. Stale-id 4xx surfaces as container_invalidated so the next turn falls back to auto-create. * studio/chat: temp diag log of Anthropic SSE events when code_execution is on To locate where the API actually emits container.id on the stream. * studio/chat: latch Anthropic container id from message_delta, drop diag Anthropic surfaces container.id on `message_delta.delta.container`, not on `message_start` (at start the container is not provisioned yet). Move the latch + container_ready emit to message_delta and remove the temporary raw-event log. --- .../core/inference/external_provider.py | 78 +++++++++++++++++++ studio/backend/models/inference.py | 14 ++++ studio/backend/routes/inference.py | 1 + .../src/features/chat/api/chat-adapter.ts | 27 ++++++- studio/frontend/src/features/chat/types.ts | 16 +++- .../frontend/src/features/chat/types/api.ts | 9 +++ 6 files changed, 138 insertions(+), 7 deletions(-) diff --git a/studio/backend/core/inference/external_provider.py b/studio/backend/core/inference/external_provider.py index de5f5c5500..23500b88c8 100644 --- a/studio/backend/core/inference/external_provider.py +++ b/studio/backend/core/inference/external_provider.py @@ -238,6 +238,7 @@ class ExternalProviderClient: enabled_tools: Optional[list[str]] = None, enable_prompt_caching: Optional[bool] = None, openai_code_exec_container_id: Optional[str] = None, + anthropic_code_exec_container_id: Optional[str] = None, stream: bool = True, ) -> AsyncGenerator[str, None]: """ @@ -263,6 +264,7 @@ class ExternalProviderClient: reasoning_effort, enabled_tools, enable_prompt_caching, + anthropic_code_exec_container_id, ): yield line return @@ -1063,6 +1065,7 @@ class ExternalProviderClient: reasoning_effort: Optional[str] = None, enabled_tools: Optional[list[str]] = None, enable_prompt_caching: Optional[bool] = None, + anthropic_code_exec_container_id: Optional[str] = None, ) -> AsyncGenerator[str, None]: """ Call the Anthropic Messages API and translate its SSE to OpenAI format. @@ -1313,6 +1316,19 @@ class ExternalProviderClient: } ) body["tools"] = anthropic_tools + # Reuse the prior turn's container so filesystem state + # (files written, packages installed, variables set) + # persists across turns of the same thread. Anthropic + # exposes the container id on the Message object's + # top-level `container.id`; on the SSE stream we latch it + # off `message_start.message.container.id` further down + # and emit a `container_ready` _toolEvent so the chat + # adapter persists it on the thread record. A stale id + # (container expired / not found) surfaces as a 4xx + # below, where we emit `container_invalidated` and let + # the next turn fall back to auto-create. + if anthropic_code_exec_container_id: + body["container"] = anthropic_code_exec_container_id url = f"{self.base_url}/messages" completion_id = f"chatcmpl-anthropic-{model.replace('/', '-')}" @@ -1376,6 +1392,28 @@ class ExternalProviderClient: response.status_code, error_text[:500], ) + # Stale container detection (mirror of the OpenAI + # path). When we sent a `container` field and the + # response is 4xx with any hint that the id is + # expired / missing, emit container_invalidated so + # the chat adapter clears the stored id and the + # next turn falls back to auto-create. + if ( + anthropic_code_exec_container_id + and 400 <= response.status_code < 500 + ): + lowered = error_text.lower() + if "container" in lowered and ( + "expired" in lowered + or "not_found" in lowered + or "not found" in lowered + or "no such container" in lowered + or "invalid" in lowered + ): + yield ( + f"data: " + f"{_json.dumps({'id': completion_id, 'object': 'chat.completion.chunk', 'choices': [{'index': 0, 'delta': {}, 'finish_reason': None}], '_toolEvent': {'type': 'container_invalidated'}})}" + ) yield _error_sse_line( response.status_code, error_text, self.provider_type ) @@ -1421,6 +1459,13 @@ class ExternalProviderClient: # them. Track the count so we know how often it would # have mattered. code_execution_generated_files = 0 + # Container id captured from `message_start.message.container.id` + # when code_execution is enabled. Emit a `container_ready` + # _toolEvent on first sight so the chat adapter persists it + # on the thread record. Only emitted when the value differs + # from the inbound id — no churn on reuse. + latched_container_id: Optional[str] = None + container_id_emitted = False # Cache usage tracking. message_start carries the input # accounting (incl. cache_creation_input_tokens and # cache_read_input_tokens); message_delta carries cumulative @@ -1800,6 +1845,36 @@ class ExternalProviderClient: delta_usage = event.get("usage") if isinstance(delta_usage, dict): last_usage.update(delta_usage) + # Anthropic reports the code_execution container + # id on `message_delta.delta.container.{id, + # expires_at}` (NOT on message_start — at start + # the container hasn't been provisioned yet). + # Latch on first sight and emit container_ready + # only when the value differs from the inbound + # id, so steady-state reuse doesn't re-write + # the same id to the thread record every turn. + delta_obj = event.get("delta") or {} + container_obj = delta_obj.get("container") + if ( + isinstance(container_obj, dict) + and latched_container_id is None + ): + probe = container_obj.get("id") + if isinstance(probe, str) and probe: + latched_container_id = probe + if ( + latched_container_id + and not container_id_emitted + and latched_container_id + != anthropic_code_exec_container_id + ): + yield _emit_tool_event( + { + "type": "container_ready", + "container_id": latched_container_id, + } + ) + container_id_emitted = True stop_reason = event.get("delta", {}).get("stop_reason") if stop_reason: if thinking_open: @@ -1869,6 +1944,7 @@ class ExternalProviderClient: "code_execution_invocations=%s, " "code_execution_results=%s, " "code_execution_generated_files=%s, " + "container_id_in=%s, container_id_out=%s, " "input_tokens=%s, output_tokens=%s, " "cache_creation_input_tokens=%s, " "cache_read_input_tokens=%s, events=%s)", @@ -1881,6 +1957,8 @@ class ExternalProviderClient: code_execution_invocations, code_execution_results, code_execution_generated_files, + anthropic_code_exec_container_id, + latched_container_id, last_usage.get("input_tokens"), last_usage.get("output_tokens"), last_usage.get("cache_creation_input_tokens"), diff --git a/studio/backend/models/inference.py b/studio/backend/models/inference.py index 3aa89cc934..19b5c3dcd3 100644 --- a/studio/backend/models/inference.py +++ b/studio/backend/models/inference.py @@ -616,6 +616,20 @@ class ChatCompletionRequest(BaseModel): "OpenAI cloud + gpt-5.5 family path; ignored otherwise." ), ) + anthropic_code_exec_container_id: Optional[str] = Field( + None, + description = ( + "[x-unsloth] Anthropic code_execution container id from the prior " + "response in the same chat thread. When set and `code_execution` " + "is in `enabled_tools`, the next /v1/messages call carries a " + "top-level `container` field so the model sees filesystem state " + "from earlier turns. Unset → Anthropic auto-creates a fresh " + "container. Stale ids surface a 4xx with a `container_expired` / " + "`container_not_found` hint; the backend emits a synthetic " + "`container_invalidated` _toolEvent so the next turn falls back " + "to auto-create." + ), + ) # ── OpenAI shell-tool container management ───────────────────── diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py index 60078ecc9b..fdf9fd8f5e 100644 --- a/studio/backend/routes/inference.py +++ b/studio/backend/routes/inference.py @@ -1737,6 +1737,7 @@ async def _proxy_to_external_provider( enabled_tools = payload.enabled_tools, enable_prompt_caching = payload.enable_prompt_caching, openai_code_exec_container_id = payload.openai_code_exec_container_id, + anthropic_code_exec_container_id = payload.anthropic_code_exec_container_id, stream = payload.stream, ) try: diff --git a/studio/frontend/src/features/chat/api/chat-adapter.ts b/studio/frontend/src/features/chat/api/chat-adapter.ts index 7084b946bb..427f12c074 100644 --- a/studio/frontend/src/features/chat/api/chat-adapter.ts +++ b/studio/frontend/src/features/chat/api/chat-adapter.ts @@ -990,9 +990,11 @@ export function createOpenAIStreamAdapter(): ChatModelAdapter { // container_id (if any) so subsequent turns in the same // thread reference the existing container instead of // auto-creating a fresh one. Empty string / undefined → - // backend falls back to container_auto. Anthropic doesn't - // use this (server-side per-turn container). + // backend falls back to container_auto. Anthropic uses + // the parallel `anthropicCodeExecContainerId` field below + // (sent as `container` on /v1/messages). let openaiCodeExecContainerId: string | null = null; + let anthropicCodeExecContainerId: string | null = null; const codeExecEnabledForThisTurn = codeToolsEnabled && providerSupportsBuiltinCodeExecution( @@ -1005,8 +1007,11 @@ export function createOpenAIStreamAdapter(): ChatModelAdapter { const thread = await db.threads.get(resolvedThreadId); openaiCodeExecContainerId = thread?.openaiCodeExecContainerId ?? null; + anthropicCodeExecContainerId = + thread?.anthropicCodeExecContainerId ?? null; } catch { openaiCodeExecContainerId = null; + anthropicCodeExecContainerId = null; } // Cross-thread inheritance: when the active thread has // no container yet, default to the one most recently @@ -1172,6 +1177,12 @@ export function createOpenAIStreamAdapter(): ChatModelAdapter { openai_code_exec_container_id: openaiCodeExecContainerId, } : {}), + ...(anthropicCodeExecContainerId + ? { + anthropic_code_exec_container_id: + anthropicCodeExecContainerId, + } + : {}), ...(supportsProviderPromptCaching(externalProvider.providerType) ? { enable_prompt_caching: @@ -1265,9 +1276,13 @@ export function createOpenAIStreamAdapter(): ChatModelAdapter { | string | undefined; if (newContainerId && resolvedThreadId) { + const field = + externalProvider?.providerType === "anthropic" + ? "anthropicCodeExecContainerId" + : "openaiCodeExecContainerId"; void db.threads .update(resolvedThreadId, { - openaiCodeExecContainerId: newContainerId, + [field]: newContainerId, }) .catch(() => {}); } @@ -1275,9 +1290,13 @@ export function createOpenAIStreamAdapter(): ChatModelAdapter { } if (toolEvent.type === "container_invalidated") { if (resolvedThreadId) { + const field = + externalProvider?.providerType === "anthropic" + ? "anthropicCodeExecContainerId" + : "openaiCodeExecContainerId"; void db.threads .update(resolvedThreadId, { - openaiCodeExecContainerId: null, + [field]: null, }) .catch(() => {}); } diff --git a/studio/frontend/src/features/chat/types.ts b/studio/frontend/src/features/chat/types.ts index eb88da635d..d0c4e22870 100644 --- a/studio/frontend/src/features/chat/types.ts +++ b/studio/frontend/src/features/chat/types.ts @@ -26,11 +26,21 @@ export interface ThreadRecord { * if a stale id is sent, the backend surfaces an * `_toolEvent.type="container_invalidated"` and the chat-adapter * clears this field so the following turn falls back to auto-create. - * - * Anthropic's code-execution path doesn't need this — each turn - * gets a fresh container server-side. */ openaiCodeExecContainerId?: string | null; + /** + * Anthropic code_execution container id captured from a prior + * response on this thread. When set, the next turn sends a + * top-level `container` field on /v1/messages so filesystem state + * (files, packages, variables) persists across turns. When + * null/undefined, Anthropic auto-creates a fresh container. + * + * Anthropic containers expire after ~1 hour by default; on a stale + * id the backend surfaces `_toolEvent.type="container_invalidated"` + * and the chat-adapter clears this field so the following turn + * falls back to auto-create. + */ + anthropicCodeExecContainerId?: string | null; } export interface MessageRecord { diff --git a/studio/frontend/src/features/chat/types/api.ts b/studio/frontend/src/features/chat/types/api.ts index ec4a5ea355..3fc5d320df 100644 --- a/studio/frontend/src/features/chat/types/api.ts +++ b/studio/frontend/src/features/chat/types/api.ts @@ -235,6 +235,15 @@ export interface OpenAIChatCompletionsRequest { * container. Only meaningful for OpenAI cloud + gpt-5.5 family. */ openai_code_exec_container_id?: string | null; + /** + * Anthropic code_execution container id captured from the prior + * response in this chat thread. When set and the Code pill is on, + * the backend forwards a top-level `container` field on + * /v1/messages so filesystem state persists across turns. Unset → + * Anthropic auto-creates a fresh container. Only meaningful for + * the Anthropic provider with `code_execution` in `enabled_tools`. + */ + anthropic_code_exec_container_id?: string | null; } export interface OpenAIChatDelta { From 77c8d80a8506a6e1cabb565f9cbcfbb14818ebff Mon Sep 17 00:00:00 2001 From: DoubleMathew Date: Sun, 17 May 2026 09:16:55 -0500 Subject: [PATCH 09/62] Fix Linux prebuilt installs for branch-based llama.cpp releases (#5493) * allow validation of custom releases to pass * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * require exact source provenance for branch direct linux releases Mirror validated_checksums_for_bundle so incomplete checksum metadata on a branch/pull/commit release fails closed with a clear error instead of silently degrading to the legacy master-as-tag source hydration path that this PR is meant to eliminate. Guard fires when source_commit, the exact source archive hash, or a derivable source repo URL is missing from the approved metadata. Also set plan.llama_tag to approved_checksums.upstream_tag so the ensure_converter_scripts fallback and the install fingerprint target the concrete upstream tag (e.g. b9174) rather than the moving branch label inferred from asset names (master). Legacy b#### releases are unaffected: synthetic checksums already set upstream_tag to bundle.upstream_tag, so the swap is a no-op on that path. Add parametrized negative regression coverage for the three ways exact provenance can be incomplete (missing source_commit, missing exact source archive entry, missing source_repo) and update the existing branch happy-path test to expect b9174. * revert llama_tag swap to preserve install identity Keep plan.llama_tag as bundle.upstream_tag (the branch label inferred from asset names, e.g. master) rather than overriding it with the approved metadata upstream tag (b9174). The override broke install identity in two ways: 1. expected_install_fingerprint hashes upstream_tag = llama_tag, so the same release would produce a different fingerprint depending on which version of this code resolved it, causing spurious reinstalls when users upgrade or roll back. 2. UNSLOTH_PREBUILT_INFO.json reports the value as the user-visible record of which release was installed; tools and logs should see the requested branch label, not the compatibility tag. The approved metadata still records upstream_tag = b9174 internally for source archive lookup; the new assertion makes that explicit. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Daniel Han --- studio/install_llama_prebuilt.py | 32 ++- .../test_install_llama_prebuilt_logic.py | 272 ++++++++++++++++++ 2 files changed, 298 insertions(+), 6 deletions(-) diff --git a/studio/install_llama_prebuilt.py b/studio/install_llama_prebuilt.py index ac1d2aded8..11f425eed1 100644 --- a/studio/install_llama_prebuilt.py +++ b/studio/install_llama_prebuilt.py @@ -1273,16 +1273,36 @@ def direct_linux_release_plan( attempts.append(cpu_choice) if not attempts: raise PrebuiltFallback("no compatible Linux prebuilt asset was found") + approved_checksums = synthetic_checksums_for_release( + repo, + bundle.release_tag, + bundle.upstream_tag, + ) + resolved_upstream_tag = bundle.upstream_tag + if DEFAULT_PUBLISHED_SHA256_ASSET in bundle.assets and not is_release_tag_like( + bundle.upstream_tag + ): + approved_checksums = load_approved_release_checksums(repo, bundle.release_tag) + # Require exact source provenance for branch/pull/commit releases. + # Mirrors validated_checksums_for_bundle so incomplete metadata + # fails closed instead of degrading to the legacy branch-as-tag + # source hydration path that this PR is meant to eliminate. + if ( + not approved_checksums.source_commit + or exact_source_archive_hash(approved_checksums) is None + or source_clone_url_from_checksums(approved_checksums) is None + ): + raise PrebuiltFallback( + f"approved checksum asset {DEFAULT_PUBLISHED_SHA256_ASSET} for " + f"{repo}@{bundle.release_tag} did not contain exact source provenance" + ) + attempts = apply_approved_hashes(attempts, approved_checksums) return InstallReleasePlan( requested_tag = requested_tag, - llama_tag = bundle.upstream_tag, + llama_tag = resolved_upstream_tag, release_tag = bundle.release_tag, attempts = attempts, - approved_checksums = synthetic_checksums_for_release( - repo, - bundle.release_tag, - bundle.upstream_tag, - ), + approved_checksums = approved_checksums, ) diff --git a/tests/studio/install/test_install_llama_prebuilt_logic.py b/tests/studio/install/test_install_llama_prebuilt_logic.py index b44554504f..ed988e081f 100644 --- a/tests/studio/install/test_install_llama_prebuilt_logic.py +++ b/tests/studio/install/test_install_llama_prebuilt_logic.py @@ -344,6 +344,278 @@ def test_validate_prebuilt_choice_creates_repo_shaped_linux_install( assert (install_dir / "BUILD_INFO.txt").exists() +def test_simple_linux_direct_release_uses_published_source_checksums_for_branch( + monkeypatch: pytest.MonkeyPatch, +): + source_commit = "25b1bc9c2f9aa0a390b968ee1ffd9ff01340a3fe" + release = { + "tag_name": "llama-prebuilt-master-3a92bc9", + "assets": [ + { + "name": "app-master-linux-x64-cuda13-newer.tar.gz", + "browser_download_url": "https://example.test/app-master-linux-x64-cuda13-newer.tar.gz", + }, + { + "name": "llama-prebuilt-sha256.json", + "browser_download_url": "https://example.test/llama-prebuilt-sha256.json", + }, + ], + } + checksums = ApprovedReleaseChecksums( + repo = "unslothai/llama.cpp", + release_tag = "llama-prebuilt-master-3a92bc9", + upstream_tag = "b9174", + source_commit = source_commit, + source_repo = "ggml-org/llama.cpp", + source_repo_url = "https://github.com/ggml-org/llama.cpp", + source_ref_kind = "branch", + requested_source_ref = "master", + resolved_source_ref = "master", + artifacts = { + "app-master-linux-x64-cuda13-newer.tar.gz": ApprovedArtifactHash( + asset_name = "app-master-linux-x64-cuda13-newer.tar.gz", + sha256 = "a" * 64, + repo = "unslothai/llama.cpp", + kind = "linux-cuda-app", + ), + INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name( + source_commit + ): ApprovedArtifactHash( + asset_name = INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name( + source_commit + ), + sha256 = "b" * 64, + repo = "ggml-org/llama.cpp", + kind = "exact-source", + ), + }, + ) + monkeypatch.setattr( + INSTALL_LLAMA_PREBUILT, + "load_approved_release_checksums", + lambda repo, release_tag: checksums, + ) + monkeypatch.setattr( + INSTALL_LLAMA_PREBUILT, + "detected_linux_runtime_lines", + lambda: (["cuda13"], {"cuda13": ["/usr/local/cuda/lib64"]}), + ) + host = HostInfo( + system = "Linux", + machine = "x86_64", + is_windows = False, + is_linux = True, + is_macos = False, + is_x86_64 = True, + is_arm64 = False, + nvidia_smi = None, + driver_cuda_version = (13, 1), + compute_caps = ["100"], + visible_cuda_devices = None, + has_physical_nvidia = True, + has_usable_nvidia = True, + ) + + plan = INSTALL_LLAMA_PREBUILT.direct_linux_release_plan( + release, + host, + "unslothai/llama.cpp", + "latest", + ) + + assert plan is not None + assert plan.llama_tag == "master" + assert plan.approved_checksums.upstream_tag == "b9174" + assert plan.approved_checksums.source_commit == source_commit + assert plan.attempts[0].expected_sha256 == "a" * 64 + source_repo, source_ref, _source_archive, exact_source = ( + INSTALL_LLAMA_PREBUILT.preferred_source_archive( + plan.approved_checksums, plan.llama_tag + ) + ) + assert source_repo == "ggml-org/llama.cpp" + assert source_ref == source_commit + assert exact_source is True + + +@pytest.mark.parametrize( + "mutate, expected_match", + [ + # Missing source_commit. + ( + lambda c: setattr(c, "source_commit", None) + or setattr(c, "source_commit_short", None), + "exact source provenance", + ), + # source_commit present, but no exact-source archive hash. + ( + lambda c: c.artifacts.pop( + INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name( + c.source_commit + ), + None, + ), + "exact source provenance", + ), + # source_commit + exact-source archive present, but no source_repo. + ( + lambda c: setattr(c, "source_repo", None) + or setattr(c, "source_repo_url", None), + "exact source provenance", + ), + ], + ids = [ + "missing_source_commit", + "missing_exact_source_artifact", + "missing_source_repo", + ], +) +def test_simple_linux_direct_release_rejects_branch_without_exact_source_metadata( + monkeypatch: pytest.MonkeyPatch, + mutate, + expected_match, +): + source_commit = "25b1bc9c2f9aa0a390b968ee1ffd9ff01340a3fe" + release = { + "tag_name": "llama-prebuilt-master-3a92bc9", + "assets": [ + { + "name": "app-master-linux-x64-cuda13-newer.tar.gz", + "browser_download_url": "https://example.test/app-master-linux-x64-cuda13-newer.tar.gz", + }, + { + "name": "llama-prebuilt-sha256.json", + "browser_download_url": "https://example.test/llama-prebuilt-sha256.json", + }, + ], + } + checksums = ApprovedReleaseChecksums( + repo = "unslothai/llama.cpp", + release_tag = "llama-prebuilt-master-3a92bc9", + upstream_tag = "b9174", + source_commit = source_commit, + source_repo = "ggml-org/llama.cpp", + source_repo_url = "https://github.com/ggml-org/llama.cpp", + source_ref_kind = "branch", + requested_source_ref = "master", + resolved_source_ref = "master", + artifacts = { + "app-master-linux-x64-cuda13-newer.tar.gz": ApprovedArtifactHash( + asset_name = "app-master-linux-x64-cuda13-newer.tar.gz", + sha256 = "a" * 64, + repo = "unslothai/llama.cpp", + kind = "linux-cuda-app", + ), + INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name( + source_commit + ): ApprovedArtifactHash( + asset_name = INSTALL_LLAMA_PREBUILT.exact_source_archive_logical_name( + source_commit + ), + sha256 = "b" * 64, + repo = "ggml-org/llama.cpp", + kind = "exact-source", + ), + }, + ) + mutate(checksums) + monkeypatch.setattr( + INSTALL_LLAMA_PREBUILT, + "load_approved_release_checksums", + lambda repo, release_tag: checksums, + ) + monkeypatch.setattr( + INSTALL_LLAMA_PREBUILT, + "detected_linux_runtime_lines", + lambda: (["cuda13"], {"cuda13": ["/usr/local/cuda/lib64"]}), + ) + host = HostInfo( + system = "Linux", + machine = "x86_64", + is_windows = False, + is_linux = True, + is_macos = False, + is_x86_64 = True, + is_arm64 = False, + nvidia_smi = None, + driver_cuda_version = (13, 1), + compute_caps = ["100"], + visible_cuda_devices = None, + has_physical_nvidia = True, + has_usable_nvidia = True, + ) + + with pytest.raises(PrebuiltFallback, match = expected_match): + INSTALL_LLAMA_PREBUILT.direct_linux_release_plan( + release, + host, + "unslothai/llama.cpp", + "latest", + ) + + +def test_simple_linux_direct_release_keeps_legacy_b_tag_path_without_checksums( + monkeypatch: pytest.MonkeyPatch, +): + release = { + "tag_name": "b9999", + "assets": [ + { + "name": "app-b9999-linux-x64-cuda13-newer.tar.gz", + "browser_download_url": "https://example.test/app-b9999-linux-x64-cuda13-newer.tar.gz", + }, + { + "name": "llama-prebuilt-sha256.json", + "browser_download_url": "https://example.test/llama-prebuilt-sha256.json", + }, + ], + } + + def unexpected_checksum_load(repo: str, release_tag: str): + raise AssertionError( + "legacy b-tag direct releases should not require checksum metadata" + ) + + monkeypatch.setattr( + INSTALL_LLAMA_PREBUILT, + "load_approved_release_checksums", + unexpected_checksum_load, + ) + monkeypatch.setattr( + INSTALL_LLAMA_PREBUILT, + "detected_linux_runtime_lines", + lambda: (["cuda13"], {"cuda13": ["/usr/local/cuda/lib64"]}), + ) + host = HostInfo( + system = "Linux", + machine = "x86_64", + is_windows = False, + is_linux = True, + is_macos = False, + is_x86_64 = True, + is_arm64 = False, + nvidia_smi = None, + driver_cuda_version = (13, 1), + compute_caps = ["100"], + visible_cuda_devices = None, + has_physical_nvidia = True, + has_usable_nvidia = True, + ) + + plan = INSTALL_LLAMA_PREBUILT.direct_linux_release_plan( + release, + host, + "unslothai/llama.cpp", + "latest", + ) + + assert plan is not None + assert plan.llama_tag == "b9999" + assert plan.release_tag == "b9999" + assert plan.approved_checksums.source_commit is None + assert plan.attempts[0].expected_sha256 is None + + def test_validate_prebuilt_choice_creates_repo_shaped_windows_install( tmp_path: Path, monkeypatch: pytest.MonkeyPatch ): From b59e02e97733a57a7688c638928874c715fecbc8 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Sun, 17 May 2026 07:44:06 -0700 Subject: [PATCH 10/62] Studio: stop hint, Uvicorn log rename, reachability check + Mac UI CI retry hardening (#5503) * Studio: clearer stop hint, Uvicorn log rename, external reachability check Three startup-banner UX improvements to make it obvious how to stop Studio, what the externally reachable URL really is, and whether that URL actually works from outside. 1. Stop hint at the end of the banner * Bright orange "To stop Unsloth Studio: press Ctrl+C in this terminal." line, with a dim "(On macOS this is Control+C, not Command+C.)" follow-up so the macOS Cmd-vs-Ctrl confusion is headed off. * When bound to 127.0.0.1, an extra "To deploy and access globally" block tells the user the exact relaunch command (unsloth studio -H 0.0.0.0 -p PORT) with a trusted-networks caveat. 2. Uvicorn startup log rewrite * Installs a stdlib logging.Filter on the uvicorn / uvicorn.error loggers that: - renames the prefix to "Unsloth Studio running on" - swaps the wildcard bind for the resolved external host so the line agrees with the banner - replaces "(Press CTRL+C to quit)" with the same Mac-aware stop hint * Rewrites both record.msg and record.color_message so it works under plain and colorized log formatters. 3. External reachability self-test on wildcard binds * Synchronous probe via check-host.net's TCP JSON API confirms whether the advertised public URL actually accepts connections from the internet. * On failure prints the resolved IP, the failing-node count, the usual causes (AWS SG, GCP firewall rule, Azure NSG, home router), and an SSH local-forward workaround. * Verifies 127.0.0.1 / ::1 first and only offers a local fallback URL when loopback actually responds, so we never claim a port works when it does not. * Private / loopback / link-local display hosts short-circuit with a one-line LAN note instead of a probe. * Bounded at roughly 15 seconds, early-exits on two decisive node results, all failures swallowed. Banner is split into print_studio_access_banner(include_stop_hint=...) plus a new print_studio_stop_hint() so the reachability output can be sandwiched between the URL section and the stop hint, keeping the stop hint as the last text on screen. Pure stdlib (socket, urllib, ipaddress, logging, threading), no new dependencies, identical behavior on Linux, macOS, and Windows. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * CI: harden Mac Studio UI tests against Chromium ERR_NO_BUFFER_SPACE The Mac Studio UI workflow already retries the Playwright scripts on the racy 'Unexpected end of JSON input' pipeTransport crash, but falls through on ERR_NO_BUFFER_SPACE -- a separate Chromium failure that fires when the macos-14 free-runner kernel briefly runs out of socket buffers. Same fix shape, two layers: * In-script: when a change-password page.goto() attempt fails with ERR_NO_BUFFER_SPACE, sleep 5s then 15s before the next attempt so the OS has time to recover socket buffers. Other failures retry immediately as before. * Workflow: extend both Playwright retry blocks (chat-ui and extra-ui) to also trigger the full Studio kill + reset + reboot retry on ERR_NO_BUFFER_SPACE, not just on the pipeTransport JSON crash. Real assertion / timeout failures still bypass retry and surface immediately. Linux and Windows workflows are unchanged; the flake is macOS-runner-specific. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- .github/workflows/studio-mac-ui-smoke.yml | 34 +-- studio/backend/run.py | 263 +++++++++++++++++++++- studio/backend/startup_banner.py | 75 +++++- tests/studio/playwright_chat_ui.py | 11 + tests/studio/playwright_extra_ui.py | 11 + 5 files changed, 374 insertions(+), 20 deletions(-) diff --git a/.github/workflows/studio-mac-ui-smoke.yml b/.github/workflows/studio-mac-ui-smoke.yml index 510c3543d2..b353f0ec83 100644 --- a/.github/workflows/studio-mac-ui-smoke.yml +++ b/.github/workflows/studio-mac-ui-smoke.yml @@ -183,16 +183,16 @@ jobs: # available to llama.cpp from CI; gemma-3-270m turn latency # has been observed to crowd the 180s default. Triple it. STUDIO_UI_TURN_TIMEOUT_MS: '540000' - # Retry up to 3 times to absorb the racy Playwright Node 24 - # pipeTransport.js 'Unexpected end of JSON input' crash that - # fires intermittently on macos-14 free runners (Chromium - # browser process dies mid-test → driver Node process can't - # parse the truncated JSON-RPC line and exits). The retry - # FULLY resets Studio (kill, reset-password, reboot, wait - # /api/health, re-export bootstrap pw) before re-running the - # script so the change-password flow finds a fresh bootstrap. - # A real test failure (assertion / timeout) does NOT match the - # JSON pattern so it bypasses retry and surfaces immediately. + # Retry up to 3 times to absorb known macos-14 free-runner + # flakes: (1) Playwright Node 24 pipeTransport.js 'Unexpected + # end of JSON input' crash when the Chromium browser process + # dies mid-test, and (2) Chromium net::ERR_NO_BUFFER_SPACE + # when the runner's kernel briefly runs out of socket buffers. + # The retry FULLY resets Studio (kill, reset-password, reboot, + # wait /api/health, re-export bootstrap pw) before re-running + # the script. A real test failure (assertion / timeout) does + # NOT match either pattern so it bypasses retry and surfaces + # immediately. run: | mkdir -p logs/playwright attempt=1 @@ -205,9 +205,10 @@ jobs: if [ "$rc" -eq 0 ]; then break fi - if grep -q "Unexpected end of JSON input" logs/playwright_attempt_${attempt}.log \ + if { grep -q "Unexpected end of JSON input" logs/playwright_attempt_${attempt}.log \ + || grep -q "ERR_NO_BUFFER_SPACE" logs/playwright_attempt_${attempt}.log; } \ && [ "$attempt" -lt "$max_attempts" ]; then - echo "::warning::Playwright pipeTransport JSON crash on attempt ${attempt}; resetting Studio and retrying..." + echo "::warning::Playwright flake on attempt ${attempt}; resetting Studio and retrying..." kill "${STUDIO_PID}" 2>/dev/null || true sleep 2 unsloth studio reset-password @@ -280,8 +281,8 @@ jobs: STUDIO_UI_TURN_TIMEOUT_MS: '540000' GGUF_REPO: ${{ env.GGUF_REPO }} GGUF_VARIANT: ${{ env.GGUF_VARIANT }} - # Same pipeTransport JSON-crash retry shape as "Drive the chat - # UI with Playwright" -- see comment there. + # Same flake-retry shape as "Drive the chat UI with Playwright" + # -- catches pipeTransport JSON crash and ERR_NO_BUFFER_SPACE. run: | mkdir -p logs/playwright_extra attempt=1 @@ -294,9 +295,10 @@ jobs: if [ "$rc" -eq 0 ]; then break fi - if grep -q "Unexpected end of JSON input" logs/playwright_extra_attempt_${attempt}.log \ + if { grep -q "Unexpected end of JSON input" logs/playwright_extra_attempt_${attempt}.log \ + || grep -q "ERR_NO_BUFFER_SPACE" logs/playwright_extra_attempt_${attempt}.log; } \ && [ "$attempt" -lt "$max_attempts" ]; then - echo "::warning::Playwright pipeTransport JSON crash on attempt ${attempt}; resetting Studio and retrying..." + echo "::warning::Playwright flake on attempt ${attempt}; resetting Studio and retrying..." kill "${STUDIO_EXTRA_PID}" 2>/dev/null || true sleep 2 unsloth studio reset-password diff --git a/studio/backend/run.py b/studio/backend/run.py index 0787e04c47..d5ccc49022 100644 --- a/studio/backend/run.py +++ b/studio/backend/run.py @@ -24,7 +24,7 @@ if str(backend_dir) not in sys.path: import _platform_compat # noqa: F401 from loggers import get_logger -from startup_banner import print_studio_access_banner +from startup_banner import print_studio_access_banner, print_studio_stop_hint logger = get_logger(__name__) @@ -74,6 +74,255 @@ def _resolve_external_ip() -> str: return "0.0.0.0" +def _install_uvicorn_startup_log_rewrite(bind_host: str, display_host: str) -> None: + """Rewrite Uvicorn's startup log line: swap wildcard bind for the + externally-reachable address, replace the CTRL+C suffix with our Mac-aware + stop hint, and rename the prefix to "Unsloth Studio running on".""" + import logging + import re + + rewrite_host = ( + bind_host in ("0.0.0.0", "::") + and bool(display_host) + and display_host != bind_host + ) + new_suffix = "(To stop: press Ctrl+C -- on macOS, Control+C not Command+C)" + old_suffix_re = re.compile(r"\(Press CTRL\+C to quit\)") + old_prefix = "Uvicorn running on " + new_prefix = "Unsloth Studio running on " + + def _rewrite(text: str) -> str: + if text.startswith(old_prefix): + text = new_prefix + text[len(old_prefix) :] + return old_suffix_re.sub(new_suffix, text) + + class _UvicornStartupRewrite(logging.Filter): + def filter(self, record: logging.LogRecord) -> bool: + try: + msg = record.msg if isinstance(record.msg, str) else "" + if ( + msg.startswith(old_prefix) + and isinstance(record.args, tuple) + and len(record.args) >= 3 + ): + if rewrite_host and record.args[1] == bind_host: + record.args = ( + record.args[0], + display_host, + record.args[2], + *record.args[3:], + ) + record.msg = _rewrite(msg) + cmsg = getattr(record, "color_message", None) + if isinstance(cmsg, str): + record.color_message = _rewrite(cmsg) + except Exception: + pass + return True + + f = _UvicornStartupRewrite() + for name in ("uvicorn", "uvicorn.error"): + logging.getLogger(name).addFilter(f) + + +def _local_port_open(host: str, port: int, timeout: float = 1.0) -> bool: + """Return True iff a TCP connection to (host, port) succeeds within timeout.""" + import socket + + try: + with socket.create_connection((host, port), timeout = timeout): + return True + except OSError: + return False + + +def _working_local_url(port: int) -> "str | None": + """Return a working loopback URL on this machine, or None if neither + 127.0.0.1 nor ::1 responds. Used as a fallback when external reachability fails.""" + if _local_port_open("127.0.0.1", port): + return f"http://127.0.0.1:{port}" + if _local_port_open("::1", port): + return f"http://[::1]:{port}" + return None + + +def _stdout_color_ok() -> bool: + """Whether to emit ANSI color codes on stdout. Mirrors startup_banner.""" + if os.environ.get("NO_COLOR", "").strip(): + return False + if os.environ.get("FORCE_COLOR", "").strip(): + return True + try: + return sys.stdout.isatty() + except (AttributeError, OSError, ValueError): + return False + + +def _verify_global_reachability(display_host: str, port: int) -> None: + """Probe check-host.net to confirm display_host:port is reachable from the + public internet. Synchronous so the caller can render output between the + banner URL section and the trailing stop hint. Bounded at ~15s; failures + are swallowed (the verifier failing is not Studio failing). Only meaningful + when bound to a wildcard host.""" + import ipaddress + import json + import time + import urllib.error + import urllib.parse + import urllib.request + + if not display_host or display_host in ("0.0.0.0", "::"): + return + + use_color = _stdout_color_ok() + dim = "\033[38;5;245m" if use_color else "" + ok_c = "\033[38;5;120;1m" if use_color else "" + err_c = "\033[38;5;203;1m" if use_color else "" + warn_c = "\033[38;5;215;1m" if use_color else "" + local_url_c = "\033[38;5;108;1m" if use_color else "" # matches banner's URL color + reset = "\033[0m" if use_color else "" + + url = f"http://{display_host}:{port}" + + # Private / loopback / link-local addresses are not globally routable. + try: + addr = ipaddress.ip_address(display_host) + if addr.is_loopback or addr.is_private or addr.is_link_local: + print( + f"{dim} Note: {display_host} is a private/LAN address -- " + f"reachable on this network only, not from the public internet." + f"{reset}", + flush = True, + ) + return + except ValueError: + # Not an IP literal; probe by hostname. + pass + + try: + qs = urllib.parse.urlencode({"host": f"{display_host}:{port}", "max_nodes": 3}) + req = urllib.request.Request( + f"https://check-host.net/check-tcp?{qs}", + headers = { + "Accept": "application/json", + "User-Agent": "unsloth-studio-reachability/1", + }, + ) + with urllib.request.urlopen(req, timeout = 5) as resp: + init = json.loads(resp.read().decode("utf-8", errors = "replace")) + req_id = init.get("request_id") + if not req_id: + return + + results = {} + deadline = time.monotonic() + 15.0 + poll_req = urllib.request.Request( + f"https://check-host.net/check-result/{req_id}", + headers = { + "Accept": "application/json", + "User-Agent": "unsloth-studio-reachability/1", + }, + ) + while time.monotonic() < deadline: + time.sleep(1.5) + try: + with urllib.request.urlopen(poll_req, timeout = 5) as resp: + results = json.loads(resp.read().decode("utf-8", errors = "replace")) + except Exception: + continue + if results and all(v is not None for v in results.values()): + break + # Two decisive nodes is enough; stop polling early. + decisive = [ + v + for v in results.values() + if isinstance(v, list) + and v + and isinstance(v[0], dict) + and ("time" in v[0] or "error" in v[0]) + ] + if len(decisive) >= 2: + break + + ok_nodes = err_nodes = 0 + for v in results.values(): + if not isinstance(v, list) or not v or not isinstance(v[0], dict): + continue + if "time" in v[0]: + ok_nodes += 1 + elif "error" in v[0]: + err_nodes += 1 + total = ok_nodes + err_nodes + + print("", flush = True) + if ok_nodes: + print( + f"{ok_c} Reachability check: {url}/ is reachable from the " + f"public internet ({ok_nodes}/{total} probe nodes connected).{reset}", + flush = True, + ) + elif err_nodes: + print( + f"{err_c} Reachability check: {url}/ is NOT reachable from " + f"the public internet ({err_nodes}/{total} probe nodes failed).{reset}", + flush = True, + ) + print(f"{dim} Common causes:{reset}", flush = True) + print( + f"{dim} * AWS -- the instance's Security Group doesn't " + f"allow inbound TCP {port}.{reset}", + flush = True, + ) + print( + f"{dim} * GCP -- no firewall rule allowing TCP {port} " + f"for the instance's network tag.{reset}", + flush = True, + ) + print( + f"{dim} * Azure / other clouds -- equivalent NSG / " + f"firewall rule missing.{reset}", + flush = True, + ) + print( + f"{dim} * Home -- your router isn't port-forwarding " + f"{port} to this machine.{reset}", + flush = True, + ) + print( + f"{dim} Workaround that needs no firewall changes -- " + f"SSH local-forward from your laptop:{reset}", + flush = True, + ) + print( + f"{dim} ssh -L {port}:localhost:{port} " + f"@{display_host}{reset}", + flush = True, + ) + print( + f"{dim} then open http://localhost:{port}/ in your browser.{reset}", + flush = True, + ) + # Only offer the local URL if loopback actually answers. + local_url = _working_local_url(port) + if local_url: + print( + f"{local_url_c} You can access Unsloth Studio locally " + f"in the meantime: {local_url}{reset}", + flush = True, + ) + else: + print( + f"{warn_c} Reachability check: probe nodes did not respond " + f"in time -- could not verify {url}/.{reset}", + flush = True, + ) + except urllib.error.URLError: + # Outbound HTTPS blocked; skip silently. + pass + except Exception: + pass + + def _get_pid_on_port(port: int) -> "tuple[int, str] | None": """Return (pid, process_name) of the process listening on *port*, or None. @@ -344,6 +593,10 @@ def run_server( if not silent: print(f"[WARNING] Frontend not found at {frontend_path}") + # Resolve once; shared by the log rewrite and the banner. + display_host = _resolve_external_ip() if host == "0.0.0.0" else host + _install_uvicorn_startup_log_rewrite(host, display_host) + ready_event = Event() startup_failed = Event() startup_errors = [] @@ -426,12 +679,18 @@ def run_server( print(f"TAURI_PORT={port}", flush = True) if not silent: - display_host = _resolve_external_ip() if host == "0.0.0.0" else host + wildcard_bind = host in ("0.0.0.0", "::") + # For wildcard binds, run the reachability check between the URL + # section and the stop hint so the stop hint stays last on screen. print_studio_access_banner( port = port, bind_host = host, display_host = display_host, + include_stop_hint = not wildcard_bind, ) + if wildcard_bind: + _verify_global_reachability(display_host, port) + print_studio_stop_hint() return app diff --git a/studio/backend/startup_banner.py b/studio/backend/startup_banner.py index 16b41d484c..2bda4357ba 100644 --- a/studio/backend/startup_banner.py +++ b/studio/backend/startup_banner.py @@ -33,18 +33,49 @@ def print_port_in_use_notice(original_port: int, new_port: int) -> None: print(msg) +def print_studio_stop_hint() -> None: + """Print the trailing stop hint + closing divider. Separate from the main + banner so callers can interleave content (e.g. a reachability check).""" + use_color = stdout_supports_color() + dim = "\033[38;5;245m" + stop_hint_style = "\033[38;5;215;1m" + reset = "\033[0m" + + def style(text: str, code: str) -> str: + return f"{code}{text}{reset}" if use_color else text + + print( + "\n".join( + [ + "", + style( + " To stop Unsloth Studio: press Ctrl+C in this terminal.", + stop_hint_style, + ), + style(" (On macOS this is Control+C, not Command+C.)", dim), + style("─" * 52, dim), + "", + ] + ) + ) + + def print_studio_access_banner( *, port: int, bind_host: str, display_host: str, + include_stop_hint: bool = True, ) -> None: - """Pretty-print URLs after the server is listening (beginner-friendly).""" + """Pretty-print URLs after the server is listening. Set + ``include_stop_hint=False`` to omit the trailing stop block; pair with + :func:`print_studio_stop_hint` after inserting your own content.""" use_color = stdout_supports_color() dim = "\033[38;5;245m" title = "\033[38;5;150m" local_url_style = "\033[38;5;108;1m" secondary = "\033[38;5;109m" + stop_hint_style = "\033[38;5;215;1m" reset = "\033[0m" def style(text: str, code: str) -> str: @@ -116,8 +147,48 @@ def print_studio_access_banner( f" Tip: if you are on this computer, open {tip_url}/ in your browser.", dim, ), - "", ] ) + if loopback_bind and not listen_all: + lines.extend( + [ + "", + style( + " Studio is only reachable on this machine (bound to 127.0.0.1).", + secondary, + ), + style( + " To deploy and access globally:", + secondary, + ), + style( + " 1. press Ctrl+C to stop Studio", + secondary, + ), + style( + f" 2. relaunch with: unsloth studio -H 0.0.0.0 -p {port}", + secondary, + ), + style( + " Only do this on trusted networks -- it exposes the API on every interface.", + secondary, + ), + ] + ) + + if include_stop_hint: + lines.extend( + [ + "", + style( + " To stop Unsloth Studio: press Ctrl+C in this terminal.", + stop_hint_style, + ), + style(" (On macOS this is Control+C, not Command+C.)", dim), + style("─" * 52, dim), + "", + ] + ) + print("\n".join(lines)) diff --git a/tests/studio/playwright_chat_ui.py b/tests/studio/playwright_chat_ui.py index aa1d38c4e1..b081c248d0 100644 --- a/tests/studio/playwright_chat_ui.py +++ b/tests/studio/playwright_chat_ui.py @@ -347,6 +347,17 @@ with sync_playwright() as p: except Exception: pass if _form_attempt < 2: + # ERR_NO_BUFFER_SPACE needs the OS to recover socket + # buffers; immediate retry just re-fails. Back off + # 5s then 15s before next attempt. + if "ERR_NO_BUFFER_SPACE" in str(e): + backoff_s = 5 if _form_attempt == 0 else 15 + print( + f"[ui] ENOBUFS detected; sleeping {backoff_s}s " + f"before retry to let OS recover socket buffers...", + flush = True, + ) + time.sleep(backoff_s) # Recovery: replace the page if it died, otherwise the # next loop iteration's page.goto() handles the reload. page = recover_or_replace_page( diff --git a/tests/studio/playwright_extra_ui.py b/tests/studio/playwright_extra_ui.py index dccd2e423d..1f507c9f33 100644 --- a/tests/studio/playwright_extra_ui.py +++ b/tests/studio/playwright_extra_ui.py @@ -214,6 +214,17 @@ with sync_playwright() as p: flush = True, ) if _form_attempt < 2: + # ERR_NO_BUFFER_SPACE needs the OS to recover socket + # buffers; immediate retry just re-fails. Back off + # 5s then 15s before next attempt. + if "ERR_NO_BUFFER_SPACE" in str(e): + backoff_s = 5 if _form_attempt == 0 else 15 + print( + f"[extra-ui] ENOBUFS detected; sleeping {backoff_s}s " + f"before retry to let OS recover socket buffers...", + flush = True, + ) + time.sleep(backoff_s) page = recover_or_replace_page( page, ctx, From 0a6072948617ef9c718b069a608ad816444a746c Mon Sep 17 00:00:00 2001 From: Lee Jackson <130007945+Imagineer99@users.noreply.github.com> Date: Sun, 17 May 2026 19:19:19 +0100 Subject: [PATCH 11/62] Studio composer action pill styling (#5522) * polish: composer action pill styling * style: reduce shared pill margin * polish: keep composer pill changes visual-only --- .../src/components/assistant-ui/thread.tsx | 14 ++++++------ .../src/features/chat/shared-composer.tsx | 22 +++++++++---------- studio/frontend/src/index.css | 2 +- 3 files changed, 19 insertions(+), 19 deletions(-) diff --git a/studio/frontend/src/components/assistant-ui/thread.tsx b/studio/frontend/src/components/assistant-ui/thread.tsx index c8fea9c704..e4e203ce6c 100644 --- a/studio/frontend/src/components/assistant-ui/thread.tsx +++ b/studio/frontend/src/components/assistant-ui/thread.tsx @@ -558,12 +558,12 @@ const ReasoningToggle: FC = () => { type="button" disabled={disabled} className={cn( - "flex items-center gap-1.5 rounded-full px-2.5 py-1 text-xs font-medium transition-colors", + "flex items-center gap-1.5 rounded-full px-1.5 py-1.5 text-[13px] font-medium text-muted-foreground/70 transition-colors", disabled ? "cursor-not-allowed opacity-40" : effectiveReasoningVisualEnabled - ? "bg-primary/10 text-primary hover:bg-primary/20" - : "text-muted-foreground hover:bg-muted-foreground/15", + ? "text-primary hover:bg-primary/10 dark:hover:bg-white/[0.08]" + : "hover:bg-primary/10 dark:hover:bg-white/[0.08]", )} aria-label={`Reasoning effort: ${reasoningEffort}`} > @@ -676,12 +676,12 @@ const PreserveThinkingToggle: FC = () => { disabled={disabled} onClick={() => setPreserveThinking(!preserveThinking)} className={cn( - "flex items-center gap-1.5 rounded-full px-2.5 py-1 text-xs font-medium transition-colors", + "flex items-center gap-1.5 rounded-full px-1.5 py-1.5 text-[13px] font-medium text-muted-foreground/70 transition-colors", disabled ? "cursor-not-allowed opacity-40" : preserveThinking - ? "bg-primary/10 text-primary hover:bg-primary/20" - : "bg-muted text-muted-foreground hover:bg-muted-foreground/15", + ? "text-primary hover:bg-primary/10 dark:hover:bg-white/[0.08]" + : "hover:bg-primary/10 dark:hover:bg-white/[0.08]", )} aria-label={ preserveThinking ? "Disable preserve think" : "Enable preserve think" @@ -848,7 +848,7 @@ const ComposerAction: FC<{ disabled?: boolean; blockSend?: () => boolean }> = ({ }) => { return (
-
+
diff --git a/studio/frontend/src/features/chat/shared-composer.tsx b/studio/frontend/src/features/chat/shared-composer.tsx index cd31d37cd7..e255c1c2b0 100644 --- a/studio/frontend/src/features/chat/shared-composer.tsx +++ b/studio/frontend/src/features/chat/shared-composer.tsx @@ -695,7 +695,7 @@ export function SharedComposer({ dir="auto" />
-
+
@@ -841,14 +841,14 @@ export function SharedComposer({ } }} className={cn( - "flex items-center gap-1.5 rounded-full px-2.5 py-1 text-xs font-medium transition-colors", + "flex items-center gap-1.5 rounded-full px-1.5 py-1.5 text-[13px] font-medium text-muted-foreground/70 transition-colors", reasoningLockedOn - ? "cursor-not-allowed bg-primary/10 text-primary" + ? "cursor-not-allowed text-primary" : reasoningDisabled ? "cursor-not-allowed opacity-40" : effectiveReasoningEnabled - ? "bg-primary/10 text-primary hover:bg-primary/20" - : "bg-muted text-muted-foreground hover:bg-muted-foreground/15", + ? "text-primary hover:bg-primary/10 dark:hover:bg-white/[0.08]" + : "hover:bg-primary/10 dark:hover:bg-white/[0.08]", )} aria-label={ reasoningLockedOn @@ -874,12 +874,12 @@ export function SharedComposer({ disabled={!modelLoaded} onClick={() => setPreserveThinking(!preserveThinking)} className={cn( - "flex items-center gap-1.5 rounded-full px-2.5 py-1 text-xs font-medium transition-colors", + "flex items-center gap-1.5 rounded-full px-1.5 py-1.5 text-[13px] font-medium text-muted-foreground/70 transition-colors", !modelLoaded ? "cursor-not-allowed opacity-40" : preserveThinking - ? "bg-primary/10 text-primary hover:bg-primary/20" - : "bg-muted text-muted-foreground hover:bg-muted-foreground/15", + ? "text-primary hover:bg-primary/10 dark:hover:bg-white/[0.08]" + : "hover:bg-primary/10 dark:hover:bg-white/[0.08]", )} aria-label={ preserveThinking ? "Disable preserve think" : "Enable preserve think" diff --git a/studio/frontend/src/index.css b/studio/frontend/src/index.css index cdfa986a12..dd01b797ce 100644 --- a/studio/frontend/src/index.css +++ b/studio/frontend/src/index.css @@ -799,7 +799,7 @@ } .composer-pill-btn { - @apply flex items-center gap-1.5 rounded-full px-3 py-1.5 text-[13px] font-medium text-muted-foreground/70 transition-colors hover:bg-primary/10 dark:hover:bg-white/[0.08] disabled:cursor-not-allowed disabled:opacity-40; + @apply flex items-center gap-1.5 rounded-full px-1.5 py-1.5 text-[13px] font-medium text-muted-foreground/70 transition-colors hover:bg-primary/10 dark:hover:bg-white/[0.08] disabled:cursor-not-allowed disabled:opacity-40; } .composer-pill-btn[data-active="true"] { color: var(--primary); From e7e02230e32189d12be1c840bed9bbc5ee7ef7e4 Mon Sep 17 00:00:00 2001 From: DoubleMathew Date: Sun, 17 May 2026 15:16:14 -0500 Subject: [PATCH 12/62] Fix /recommended-folders 500 on unreadable model directories (Python 3.12+) (#5523) * Fix /recommended-folders 500 on unreadable model dirs (Python 3.12+) get_recommended_folders probed candidate paths with a bare Path(p).is_dir(). On Python <= 3.11 that returned False for an unreadable path, but on Python 3.12+ is_dir() propagates PermissionError (EACCES) instead, so a stock root-owned ollama install at /usr/share/ollama/.ollama/models (mode 700) made the endpoint 500 through the entire middleware stack. Move the directory-accessibility check into a stdlib-only helper utils.fs_access.is_accessible_dir that swallows OSError and keeps the existing os.access(R_OK|X_OK) filter, restoring the pre-3.12 "unreadable path is simply not a candidate" behaviour. Add a dependency-free regression test. * Address review: inline helper, no new file, cover all probe sites - Drop studio/backend/utils/fs_access.py and the cross-module import; the guard is now a small module-level _safe_is_dir() in models.py (also moots the import-placement / ModuleNotFoundError feedback, since there is no longer an import to misplace). - Apply _safe_is_dir to every system-location probe with the vulnerable bare is_dir() pattern, not just /recommended-folders: _build_browse_allowlist._add and the /browse-folders _add_sug helper, so the same Python 3.12+ PermissionError cannot 500 those endpoints either. Each site keeps its exact prior semantics (recommended-folders retains its os.access(R_OK|X_OK) filter); the only behavioural change is "no longer crashes". - Rewrite the regression test to extract the real _safe_is_dir from source via ast, keeping it dependency-free without standing up the FastAPI app, and correct the mode-000 case. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Roland Tannous <115670425+rolandtannous@users.noreply.github.com> --- studio/backend/routes/models.py | 22 ++- .../test_recommended_folders_permission.py | 125 ++++++++++++++++++ 2 files changed, 144 insertions(+), 3 deletions(-) create mode 100644 studio/backend/tests/test_recommended_folders_permission.py diff --git a/studio/backend/routes/models.py b/studio/backend/routes/models.py index d01e94b0c9..9ea113e488 100644 --- a/studio/backend/routes/models.py +++ b/studio/backend/routes/models.py @@ -26,6 +26,22 @@ def _is_valid_repo_id(repo_id: str) -> bool: return bool(_VALID_REPO_ID.fullmatch(repo_id)) +def _safe_is_dir(path) -> bool: + """``Path.is_dir()`` that returns ``False`` instead of raising. + + On Python >= 3.12 ``is_dir()``'s ``os.stat`` only suppresses + "not found"-class errors and now propagates ``PermissionError`` + (EACCES); on Python <= 3.11 it returned ``False``. The folder-scan + endpoints probe well-known system locations (e.g. a root-owned, + mode-700 ``/usr/share/ollama/.ollama/models``) and must treat an + un-stat-able path as "not a directory", never 500. + """ + try: + return Path(path).is_dir() + except OSError: + return False + + # Add backend directory to path backend_path = Path(__file__).parent.parent.parent if str(backend_path) not in sys.path: @@ -882,7 +898,7 @@ async def get_recommended_folders( return if resolved in seen: return - if Path(resolved).is_dir() and os.access(resolved, os.R_OK | os.X_OK): + if _safe_is_dir(resolved) and os.access(resolved, os.R_OK | os.X_OK): seen.add(resolved) folders.append(resolved) @@ -1056,7 +1072,7 @@ def _build_browse_allowlist() -> list[Path]: resolved = p.resolve() except OSError: return - if resolved.is_dir(): + if _safe_is_dir(resolved): candidates.append(resolved) _add(Path.home()) @@ -1389,7 +1405,7 @@ async def browse_folders( return if resolved in seen_sug: return - if Path(resolved).is_dir(): + if _safe_is_dir(resolved): seen_sug.add(resolved) suggestions.append(resolved) diff --git a/studio/backend/tests/test_recommended_folders_permission.py b/studio/backend/tests/test_recommended_folders_permission.py new file mode 100644 index 0000000000..659c3b547d --- /dev/null +++ b/studio/backend/tests/test_recommended_folders_permission.py @@ -0,0 +1,125 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +""" +Regression test for the /recommended-folders (and /browse-folders) 500 +caused by an unreadable model directory, e.g. a stock root-owned +``ollama`` install at ``/usr/share/ollama/.ollama/models``. + +Root cause: the folder-scan helpers in ``routes.models`` probed candidate +paths with a bare ``Path(p).is_dir()``. On Python <= 3.11 that returned +``False`` for an unreadable path; on Python >= 3.12 ``is_dir()`` propagates +``PermissionError`` (EACCES), so the endpoint 500-ed through the whole +middleware stack instead of just skipping the directory. The probes now go +through the module-level ``_safe_is_dir`` helper. + +``routes.models`` pulls the full backend dependency tree (fastapi, +structlog, the models package, ...), so rather than stand up the app we +extract the real ``_safe_is_dir`` definition from the source file and +exercise that exact function in isolation. The test therefore stays +dependency-free while still running the shipped code. + +Run: + python -m pytest studio/backend/tests/test_recommended_folders_permission.py -v +""" + +import ast +import os +import sys +from pathlib import Path + +import pytest + +_backend_root = Path(__file__).resolve().parent.parent +_models_src = _backend_root / "routes" / "models.py" + + +def _load_safe_is_dir(): + """Return the real ``_safe_is_dir`` from routes/models.py without + importing the (heavily dependency-laden) module.""" + tree = ast.parse(_models_src.read_text()) + fn = next( + node + for node in tree.body + if isinstance(node, ast.FunctionDef) and node.name == "_safe_is_dir" + ) + module = ast.Module(body = [fn], type_ignores = []) + ns: dict = {"Path": Path, "os": os} + exec(compile(module, f"", "exec"), ns) + return ns["_safe_is_dir"] + + +safe_is_dir = _load_safe_is_dir() + +# Permission bits are bypassed for the superuser, so the chmod-000 setup +# below would not actually deny access when running as root. +_skip_as_root = pytest.mark.skipif( + hasattr(os, "geteuid") and os.geteuid() == 0, + reason = "root bypasses filesystem permission bits", +) + + +def test_helper_exists_in_source(): + # Guards against a refactor silently dropping the helper the fix + # depends on (the extractor would then raise StopIteration). + assert callable(safe_is_dir) + + +def test_readable_dir_is_true(tmp_path): + assert safe_is_dir(tmp_path) is True + + +def test_missing_path_is_false(tmp_path): + assert safe_is_dir(tmp_path / "does-not-exist") is False + + +def test_file_is_false(tmp_path): + f = tmp_path / "weights.gguf" + f.write_bytes(b"x") + assert safe_is_dir(f) is False + + +@_skip_as_root +def test_mode000_dir_itself_is_still_a_dir(tmp_path): + """A mode-000 directory is still stat-able via its (traversable) + parent, so _safe_is_dir reports True without raising. Filtering out + dirs we cannot actually *read* is the caller's separate + os.access(R_OK|X_OK) check, not this helper's job.""" + locked = tmp_path / "locked" + locked.mkdir() + os.chmod(locked, 0o000) + try: + assert safe_is_dir(locked) is True # must not raise + finally: + os.chmod(locked, 0o755) + + +@_skip_as_root +def test_path_under_unreadable_parent_returns_false_not_raises(tmp_path): + """The exact production scenario: stat()-ing a child of a mode-700 + system directory, e.g. ``/usr/share/ollama/.ollama/models``.""" + parent = tmp_path / "ollama" + parent.mkdir() + os.chmod(parent, 0o000) + try: + assert safe_is_dir(parent / ".ollama" / "models") is False + finally: + os.chmod(parent, 0o755) + + +@_skip_as_root +@pytest.mark.skipif( + sys.version_info < (3, 12), + reason = "is_dir() only propagates PermissionError on Python >= 3.12", +) +def test_demonstrates_the_underlying_stdlib_regression(tmp_path): + """Documents *why* _safe_is_dir exists: the old bare pattern raises + on the interpreters Studio ships on (3.12+).""" + parent = tmp_path / "ollama" + parent.mkdir() + os.chmod(parent, 0o000) + try: + with pytest.raises(PermissionError): + Path(parent / ".ollama" / "models").is_dir() # pre-fix expr + finally: + os.chmod(parent, 0o755) From 20e66adae39c86bcbcc10679250dd9c22905a03f Mon Sep 17 00:00:00 2001 From: Roland Tannous <115670425+rolandtannous@users.noreply.github.com> Date: Mon, 18 May 2026 00:42:30 +0400 Subject: [PATCH 13/62] studio/chat: persist Anthropic container id on first turn of new thread (#5526) * studio/chat: persist Anthropic container id on first turn of new thread The container_ready SSE handler updated thread record via db.threads.update, which silently affects 0 rows when the Dexie row hasn't been inserted yet. On the first turn of a brand-new thread the SSE event can arrive before assistant-ui persists the row, so the new container id was dropped, and the next turn re-read null and let Anthropic auto-create a fresh container instead of reusing the one from turn 1. Call ensureThreadRecord first so the row exists before the update lands. * studio/chat: temp diag log for container persistence races * studio/chat: drop temp diag logging * studio/chat: retry container persist instead of forcing thread row Drop ensureThreadRecord + circular runtime-provider import. Retry the update for up to 500ms so assistant-ui's DexieAdapter.initialize wins the race and creates the thread row with the right modelType (base / lora / model1 / model2), then our update lands on a subsequent attempt. Addresses gemini-code-assist review on #5526. --- .../src/features/chat/api/chat-adapter.ts | 28 +++++++++++++++---- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/studio/frontend/src/features/chat/api/chat-adapter.ts b/studio/frontend/src/features/chat/api/chat-adapter.ts index 427f12c074..aeca357f1c 100644 --- a/studio/frontend/src/features/chat/api/chat-adapter.ts +++ b/studio/frontend/src/features/chat/api/chat-adapter.ts @@ -1280,11 +1280,29 @@ export function createOpenAIStreamAdapter(): ChatModelAdapter { externalProvider?.providerType === "anthropic" ? "anthropicCodeExecContainerId" : "openaiCodeExecContainerId"; - void db.threads - .update(resolvedThreadId, { - [field]: newContainerId, - }) - .catch(() => {}); + // On the first turn of a brand-new thread the row + // may not be in Dexie yet when this SSE event + // fires — db.threads.update silently affects 0 + // rows, the next turn re-reads null, and Anthropic + // auto-creates a fresh container. Retry briefly so + // assistant-ui's own DexieAdapter.initialize lands + // the row first (with the correct modelType for + // base / lora / compare contexts) and our update + // sticks on a subsequent attempt. + try { + for (let attempt = 0; attempt < 10; attempt++) { + const affected = await db.threads.update( + resolvedThreadId, + { [field]: newContainerId }, + ); + if (affected > 0) break; + await new Promise((resolve) => + setTimeout(resolve, 50), + ); + } + } catch { + /* best-effort: container reuse is an optimization */ + } } continue; } From 867b1e187345a3d690e7a3e647d963a3725f097e Mon Sep 17 00:00:00 2001 From: Ashwin Upadhyay Date: Mon, 18 May 2026 02:49:50 +0530 Subject: [PATCH 14/62] studio/openai: align chat completions docstring with stream=false default (closes #5047) (#5524) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * studio/openai: align chat completions docstring with stream=false default The schema and regression test for ChatCompletionRequest.stream were already corrected to default `false` (matching OpenAI's spec), but the route docstring still claimed streaming was the default -- misleading for anyone reading the source while debugging the original report. Updates the docstring to reflect the actual behavior, adds an explicit note pointing to #5047, and tags the existing regression test with the issue reference and the .NET / System.Text.Json client class so the intent survives future cleanup. Closes #5047 * studio/openai: address review — move #5047 ref out of OpenAPI doc, add route-level test Two follow-ups on review feedback: - Drop "(see #5047)" from the openai_chat_completions docstring so the internal issue number doesn't leak into the FastAPI-generated OpenAPI / Swagger schema. The reference now lives in a code comment next to the actual `if payload.stream:` branch, where it's most useful for the next person debugging the same class of report. - Add test_post_without_stream_field_decodes_to_stream_false_over_http: a TestClient-based wire-level guard that POSTs a body without `stream` (the exact shape naive curl / .NET / System.Text.Json clients send) and asserts both that the request deserialises into stream=False *and* that the response Content-Type is application/json, never text/event-stream. The existing constructor-level test would silently miss regressions introduced by middleware or alias rewrites that mutate the body before the pydantic model is built. Refs #5047 * studio/openai: route-level test mounts real router instead of synthetic echo app * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: Roland Tannous <115670425+rolandtannous@users.noreply.github.com> Co-authored-by: Roland Tannous Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/routes/inference.py | 10 +++- .../tests/test_openai_tool_passthrough.py | 48 ++++++++++++++++++- 2 files changed, 55 insertions(+), 3 deletions(-) diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py index fdf9fd8f5e..6d05be2310 100644 --- a/studio/backend/routes/inference.py +++ b/studio/backend/routes/inference.py @@ -1959,8 +1959,11 @@ async def openai_chat_completions( Supports multimodal messages: ``content`` may be a plain string or a list of content parts (``text`` / ``image_url``). - Streaming (default): returns SSE chunks matching OpenAI's format. - Non-streaming: returns a single ChatCompletion JSON object. + Non-streaming (default): returns a single ChatCompletion JSON object. + Streaming: returns SSE chunks matching OpenAI's format. + + ``stream`` defaults to ``false`` to match OpenAI's spec; clients opt + into SSE by sending ``stream: true``. Automatically routes to the correct backend: - GGUF models → llama-server via LlamaCppBackend @@ -2184,6 +2187,9 @@ async def openai_chat_completions( cancel_event = threading.Event() completion_id = f"chatcmpl-{uuid.uuid4().hex[:12]}" + # `stream` defaults to False on ChatCompletionRequest (OpenAI spec + # parity). Naive curl / .NET / System.Text.Json clients omitting + # the field used to get SSE here and choke on deserialization (#5047). if payload.stream: return await _openai_passthrough_stream( request, diff --git a/studio/backend/tests/test_openai_tool_passthrough.py b/studio/backend/tests/test_openai_tool_passthrough.py index a379282b70..e87faa3b32 100644 --- a/studio/backend/tests/test_openai_tool_passthrough.py +++ b/studio/backend/tests/test_openai_tool_passthrough.py @@ -299,11 +299,57 @@ class TestChatCompletionRequestToolFields: def test_stream_defaults_false_matching_openai_spec(self): # OpenAI's /v1/chat/completions spec defaults `stream` to false. # Studio previously defaulted to true, which broke naive curl - # clients that omit `stream` (they expect a JSON blob, got SSE). + # clients (and .NET / System.Text.Json SDKs per #5047) that omit + # `stream` -- they expect a JSON blob, got SSE. # Pin the corrected default so it can't silently regress. req = self._make() assert req.stream is False + def test_post_without_stream_field_decodes_to_stream_false_over_http( + self, monkeypatch + ): + # Wire-level guard for the same default: a POST body that omits + # `stream` entirely (the exact shape naive curl / .NET clients + # send) must deserialise into stream=False *and* the response + # must be `application/json`, never `text/event-stream`. + # Mounts the real `routes.inference.router` so this catches + # regressions in middleware/aliasing on the actual endpoint + # (e.g. someone adding a request layer that injects stream=True + # before pydantic builds the model). Backends are bypassed by + # routing through `provider_type` and stubbing the external + # provider proxy. + from fastapi import FastAPI + from fastapi.responses import JSONResponse + from fastapi.testclient import TestClient + + import routes.inference as inference_route + from auth.authentication import get_current_subject + + captured = {} + + async def _fake_proxy(payload, request): + captured["stream"] = payload.stream + return JSONResponse({"choices": [], "object": "chat.completion"}) + + monkeypatch.setattr(inference_route, "_proxy_to_external_provider", _fake_proxy) + + app = FastAPI() + app.include_router(inference_route.router) + app.dependency_overrides[get_current_subject] = lambda: "test-user" + + client = TestClient(app) + resp = client.post( + "/chat/completions", + json = { + "messages": [{"role": "user", "content": "hi"}], + "provider_type": "openai", + }, + ) + assert resp.status_code == 200 + assert resp.headers["content-type"].startswith("application/json") + assert "text/event-stream" not in resp.headers["content-type"] + assert captured["stream"] is False + def test_multiturn_tool_loop_messages(self): req = ChatCompletionRequest( messages = [ From f7bd05ad13255dba07112056c15e966819bc9a2a Mon Sep 17 00:00:00 2001 From: Melroy van den Berg Date: Mon, 18 May 2026 02:04:05 +0200 Subject: [PATCH 15/62] Add a simple --version flag (#5516) * Add a simple --version flag * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Small code clean-up, less ugly * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Slightly better function names. And use again None --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Roland Tannous <115670425+rolandtannous@users.noreply.github.com> --- unsloth_cli/__init__.py | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/unsloth_cli/__init__.py b/unsloth_cli/__init__.py index 28da00f37b..65834b3b9d 100644 --- a/unsloth_cli/__init__.py +++ b/unsloth_cli/__init__.py @@ -2,17 +2,45 @@ # Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 import typer +from importlib.metadata import version as package_version, PackageNotFoundError + from unsloth_cli.commands.train import train from unsloth_cli.commands.inference import inference from unsloth_cli.commands.export import export, list_checkpoints from unsloth_cli.commands.studio import run as studio_run, studio_app + +def show_version(value: bool): + if value: + try: + version = package_version("unsloth") + except PackageNotFoundError: + version = "unknown" + typer.echo(f"unsloth {version}") + raise typer.Exit() + + app = typer.Typer( help = "Command-line interface for Unsloth training, inference, and export.", context_settings = {"help_option_names": ["-h", "--help"]}, ) + +@app.callback() +def main( + version: bool = typer.Option( + None, + "--version", + "-V", + callback = show_version, + is_eager = True, + help = "Show version and exit.", + ), +): + pass + + app.command()(train) app.command()(inference) app.command()(export) From 3ff6204aa7b221f0047ae9ddc6141e2247e82d62 Mon Sep 17 00:00:00 2001 From: Michael Han <107991372+shimmyshimmer@users.noreply.github.com> Date: Sun, 17 May 2026 21:25:39 -0700 Subject: [PATCH 16/62] studio: load cached GGUF models when fully offline (#5505) * studio: load cached GGUF models when fully offline When huggingface.co is unreachable, GGUF model loads fail in three distinct places even though the bits are already in ~/.cache/huggingface/hub. Each failure has a different surface symptom: 1. list_gguf_variants() raises straight through HTTPException(500), so the variant dropdown shows 'Failed to list GGUF variants'. 2. detect_gguf_model_remote() silently returns None after retries fail. The caller then treats a GGUF-only repo as non-GGUF and routes it through the transformers/MLX path. On Apple Silicon this surfaces as 'Unsloth currently only works on NVIDIA, AMD and Intel GPUs.' 3. _download_gguf() loses list_repo_files() to the network and falls back to a filename heuristic ('{repo}-{variant}.gguf'). When the repo name does not echo the filenames (e.g. repo 'Qwen3.6-27B-MTP-GGUF' contains a file 'Qwen3.6-27B-UD-Q4_K_XL.gguf' with no MTP), hf_hub_download cannot find that invented filename in the cache and aborts. Fix in three layers: - list_gguf_variants / detect_gguf_model_remote: honor HF_HUB_OFFLINE and fall back to scanning the local HF cache snapshot when the API throws. detect_gguf_model_remote still keeps its retry loop for transient flakes; the cache fallback only kicks in after every attempt fails. - _download_gguf: when list_repo_files() fails, look up variant -> real filename inside the cached snapshot before resorting to the heuristic. - llama_cpp.load_model / inference worker startup: when DNS for huggingface.co fails (2s probe), set HF_HUB_OFFLINE=1 for the process so every hf_hub_download call below resolves from cache instantly instead of spending ~25s on five exponential retries. Online behavior is unchanged: the API is tried first and only used to fail over. The cache scan is a strict subset of what list_local_gguf_variants already does today for local paths. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: tighten inline comments on offline GGUF fallback * studio: address review feedback on offline GGUF fallback Fixes from the review pass on #5505: * ruff F823 (lint CI red): the late `import os` at the bottom of LlamaCppBackend.load_model made `os` a function-local name, so my new `os.environ` reference at the top of the same method was a use-before-bind. Surfaces at runtime as 'cannot access local variable os where it is not associated with a value' and is why the Mac/Windows Studio API jobs were failing too. The env-var mutation has been moved into a module-level contextmanager, so load_model no longer touches `os` directly. * Codex P1: cache variant match now uses the relative path, not the basename. Layouts like `BF16/foo.gguf` (variant token only in parent dir) were silently skipped, falling through to the bogus `{repo}-{variant}.gguf` heuristic and failing offline loads of models stored under quant-named subdirs. * Codex P1: HF_HUB_OFFLINE no longer persists past one model load. llama_cpp.load_model now uses a contextmanager that probes DNS, sets HF_HUB_OFFLINE/TRANSFORMERS_OFFLINE only when DNS is dead, and pops them in finally (preserving any prior user setting of TRANSFORMERS_OFFLINE). Pre-existing user-set HF_HUB_OFFLINE is respected as a no-op. worker.py keeps the startup probe because the orchestrator spawns a fresh worker per load -- comment updated to make that lifecycle explicit, and a warning is now logged. * Gemini: cache-dir lookup centralized in `_iter_hf_cache_snapshots`. Three near-identical copies (in list/detect helpers and the llama_cpp offline scan) now go through one helper. * Gemini: `huggingface_hub.utils.is_offline_mode` does not exist in 1.x (verified locally); `huggingface_hub.constants.HF_HUB_OFFLINE` is snapshot-at-import-time and does not reflect runtime mutations. Manual env-var parsing kept. * socket probe now saves and restores the prior default timeout instead of unconditionally setting None on exit, so it composes with caller code that already configured a timeout. * worker.py probe now logs a warning when offline mode is auto-enabled so debugging the case isn't blind. * studio: regression tests for offline GGUF cache fallback Lock in the offline fallback path from #5505 so future refactors can't silently regress either bug. 26 tests, 0.55 s, no network/GPU/subprocess. Covers: * _iter_hf_cache_snapshots: missing cache, missing repo, missing snapshots/, newest-mtime ordering, case-insensitive repo match. * _list_gguf_variants_from_hf_cache and the list_gguf_variants online/offline-env/API-exception/reraise paths. * _detect_gguf_from_hf_cache and detect_gguf_model_remote 3x-fail fallback. Pre-existing RepositoryNotFoundError early-return preserved. * Codex P1 #1 regression: BF16/foo.gguf (quant only in subdir name) must resolve via _detect_gguf_from_hf_cache, which now matches the snapshot-relative path rather than the basename. * _probe_dns_dead: returns True/False, restores prior socket timeout. * Codex P1 #2 regression: _hf_offline_if_dns_dead sets env only inside the block, restores on exit (including on exception), re-probes DNS on the next call so a transient hiccup cannot lock the long-lived LlamaCppBackend singleton offline. Honors a user-set HF_HUB_OFFLINE as a no-op. Preserves a user-set TRANSFORMERS_OFFLINE across exit. Follows the existing studio backend test stub pattern (loggers / structlog / httpx stubs + backend dir on sys.path). * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: extend offline cache fallback to _download_mmproj and quant label Two follow-up fixes from the review pass on #5505: * _download_mmproj() now mirrors _download_gguf()'s offline path: when list_repo_files() fails, scan the local HF cache snapshot for any GGUF whose basename starts with mmproj-. Without this, offline vision GGUF loads succeed at the main weight (the existing PR fix) but the mmproj returns None and llama-server starts without vision support. Same _iter_hf_cache_snapshots helper, F16 preference and fallback to the first match are preserved. * _extract_quant_label() now considers parent directory segments when the basename has no quant token. Layouts like BF16/foo.gguf are already documented in this file and are returned by the new snapshot-relative-path filter in _download_gguf; before this fix their variant label collapsed to "foo" (the last hyphen segment of the basename). Regex is the same; the search just walks parent segments innermost-first if the basename misses. Tests (studio/backend/tests/test_offline_gguf_cache_fallback.py): * TestExtractQuantLabelSubdir: basename quant unchanged, quant-only- in-parent, UD- prefix in parent, deeper nesting picks the innermost matching segment. * TestDownloadMmprojOfflineCacheFallback: cache fallback returns the mmproj when list_repo_files fails, F16 preference holds when both variants are in cache, no-mmproj cache returns None. * httpx stub now prefers the real package when installed (the CI install list already includes it) and falls back to the stub only when httpx is genuinely missing. Newer huggingface_hub imports HTTPError/Response/Request at module load, so the previous fixed-set stub broke when those names were added upstream. 26 existing cases plus 7 new = 33 pass in 0.74s. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Fix/adjust offline cache + DNS probe per PR #5505 review Four review findings tightened, with regression tests: - list_local_gguf_variants subdir collapse (P1 codex 10:08): pass the snapshot-relative path to _extract_quant_label so BF16/foo.gguf and Q4_K_M/foo.gguf produce distinct labels instead of folding to the same basename pseudo-quant. - list_gguf_variants cache fallback (P2 codex 12:10): surface RepositoryNotFoundError / GatedRepoError / RevisionNotFoundError / EntryNotFoundError to the caller instead of masking with stale cache, matching detect_gguf_model_remote. - _detect_gguf_from_hf_cache mmproj (P2 codex 12:10): exclude mmproj files from the candidate list so a partial cache with only a vision projector cannot route the projector as the main model. - _probe_dns_dead global timeout (P2 codex 13:06): run the gethostbyname on a daemon thread with join timeout so concurrent sockets in the same interpreter never inherit a process-wide socket.setdefaulttimeout mutation. Same shape applied in worker.py's startup probe. * Make llama-server health check tolerant of warmup races Two layered fixes for the Windows GGUF smoke CI Tool calling Tests flake that exit-22'd on a single httpx.ReadError during llama-server warmup. The 'windows-latest -> windows-2025-vs2026' image rollout is hitting main with the identical symptom. A. _wait_for_health: catch httpx.ReadError, RemoteProtocolError, WriteError alongside ConnectError and TimeoutException. A TCP RST mid-read while llama-server is still binding the port (WinError 10054) is a 'still warming up' signal, not fatal. The existing _process.poll() check still wins for real crashes. B. _drain_stdout + spawn: tee llama-server stdout/stderr to a per-launch log file at ~/.unsloth/studio/logs/llama-server/ .log. Any future subprocess crash leaves a forensic trace on disk even when Studio's traceback only captures the symptom (ReadError) and not the cause. Best-effort: a logging-side OSError never blocks the load. Regression coverage: TestWaitForHealthRetriesOnReadError pins the retry behaviour for the three new exception types and verifies that a real process exit still short-circuits the loop. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * ci(windows): retry inference/load + collect llama-server logs Composite fix for the Tool calling Tests flake that exit-22'd on a single httpx.ReadError during llama-server warm-up. The windows-latest -> windows-2025-vs2026 runner image rollout has been hitting main with the identical symptom. - All three jobs (openai-anthropic, tool-calling, json-images) now retry POST /api/inference/load up to 3 times with 10s backoff and preserve the response body for post-mortem. One transient 500 no longer fails the whole job. - A new "Collect llama-server logs" step copies the per-launch llama-server stdout teed by Studio under ~/.unsloth/studio/logs/ llama-server/ into the workspace, and the upload-artifact step now includes logs/llama-server/*.log so any future subprocess crash leaves a forensic trace. --------- Co-authored-by: shimmyshimmer Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Daniel Han --- .../studio-windows-inference-smoke.yml | 107 ++- studio/backend/core/inference/llama_cpp.py | 223 ++++- studio/backend/core/inference/worker.py | 30 + .../tests/test_offline_gguf_cache_fallback.py | 828 ++++++++++++++++++ studio/backend/utils/models/model_config.py | 164 +++- 5 files changed, 1299 insertions(+), 53 deletions(-) create mode 100644 studio/backend/tests/test_offline_gguf_cache_fallback.py diff --git a/.github/workflows/studio-windows-inference-smoke.yml b/.github/workflows/studio-windows-inference-smoke.yml index 01bf4127a7..2acc782984 100644 --- a/.github/workflows/studio-windows-inference-smoke.yml +++ b/.github/workflows/studio-windows-inference-smoke.yml @@ -258,11 +258,26 @@ jobs: - name: Load the GGUF (HF repo + variant, served from HF_HOME cache) run: | - curl -fs -X POST "http://127.0.0.1:${STUDIO_PORT}/api/inference/load" \ - -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' \ - --max-time 600 \ - -d "{\"model_path\":\"$GGUF_REPO\",\"gguf_variant\":\"$GGUF_VARIANT\",\"is_lora\":false,\"max_seq_length\":2048}" \ - | jq '{status, display_name, is_gguf, context_length}' + # Retry the load step a few times so a transient TCP RST during + # llama-server warm-up (Windows runner image churn, + # windows-latest -> windows-2025-vs2026 rollout) doesn't fail + # the whole job. The Studio backend's _wait_for_health now + # catches httpx.ReadError too; this retry layer covers the + # cases the backend can't recover from on its own. + LOAD_OK=0 + for attempt in 1 2 3; do + HTTP=$(curl -s -o /tmp/load.json -w '%{http_code}' \ + -X POST "http://127.0.0.1:${STUDIO_PORT}/api/inference/load" \ + -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' \ + --max-time 600 \ + -d "{\"model_path\":\"$GGUF_REPO\",\"gguf_variant\":\"$GGUF_VARIANT\",\"is_lora\":false,\"max_seq_length\":2048}") + if [ "$HTTP" = "200" ]; then LOAD_OK=1; break; fi + echo "::warning::/api/inference/load attempt $attempt returned $HTTP; response:" + cat /tmp/load.json || true + sleep 10 + done + [ "$LOAD_OK" = "1" ] || { echo "::error::/api/inference/load failed 3 attempts"; exit 22; } + jq '{status, display_name, is_gguf, context_length}' /tmp/load.json - name: Multi-turn determinism via OpenAI + Anthropic SDKs env: @@ -350,6 +365,19 @@ jobs: shell: cmd run: echo Stop Studio (no-op; runner reclaims STUDIO_PID=%STUDIO_PID% at job end) + - name: Collect llama-server logs + if: always() + shell: bash + # Copy llama-server's own stdout/stderr (teed by Studio under + # ~/.unsloth/studio/logs/llama-server/) into the workspace so + # upload-artifact can pick it up. Crucial for diagnosing a + # subprocess crash where Studio's traceback only shows the + # symptom (httpx ReadError) but not the cause. + run: | + mkdir -p logs/llama-server + cp -v ~/.unsloth/studio/logs/llama-server/*.log logs/llama-server/ 2>/dev/null || \ + echo "no llama-server logs to collect" + - name: Upload logs if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -358,6 +386,7 @@ jobs: path: | logs/studio.log logs/install.log + logs/llama-server/*.log retention-days: 7 # ───────────────────────────────────────────────────────────────────── @@ -561,11 +590,21 @@ jobs: # a normal path. GGUF_PATH="${GITHUB_WORKSPACE//\\//}/gguf-cache/${GGUF_FILE}" ls -lh "$GGUF_PATH" - curl -fs -X POST "http://127.0.0.1:${STUDIO_PORT}/api/inference/load" \ - -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' \ - --max-time 600 \ - -d "{\"model_path\":\"$GGUF_PATH\",\"is_lora\":false,\"max_seq_length\":2048}" \ - | jq '{status, display_name}' + # Retry: same rationale as the OpenAI/Anthropic job. + LOAD_OK=0 + for attempt in 1 2 3; do + HTTP=$(curl -s -o /tmp/load.json -w '%{http_code}' \ + -X POST "http://127.0.0.1:${STUDIO_PORT}/api/inference/load" \ + -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' \ + --max-time 600 \ + -d "{\"model_path\":\"$GGUF_PATH\",\"is_lora\":false,\"max_seq_length\":2048}") + if [ "$HTTP" = "200" ]; then LOAD_OK=1; break; fi + echo "::warning::/api/inference/load attempt $attempt returned $HTTP; response:" + cat /tmp/load.json || true + sleep 10 + done + [ "$LOAD_OK" = "1" ] || { echo "::error::/api/inference/load failed 3 attempts"; exit 22; } + jq '{status, display_name}' /tmp/load.json - name: Tool calling, server-side tools, thinking on/off env: @@ -768,6 +807,19 @@ jobs: shell: cmd run: echo Stop Studio (no-op; runner reclaims STUDIO_PID=%STUDIO_PID% at job end) + - name: Collect llama-server logs + if: always() + shell: bash + # Copy llama-server's own stdout/stderr (teed by Studio under + # ~/.unsloth/studio/logs/llama-server/) into the workspace so + # upload-artifact can pick it up. Crucial for diagnosing a + # subprocess crash where Studio's traceback only shows the + # symptom (httpx ReadError) but not the cause. + run: | + mkdir -p logs/llama-server + cp -v ~/.unsloth/studio/logs/llama-server/*.log logs/llama-server/ 2>/dev/null || \ + echo "no llama-server logs to collect" + - name: Upload logs if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -776,6 +828,7 @@ jobs: path: | logs/studio.log logs/install.log + logs/llama-server/*.log retention-days: 7 # ───────────────────────────────────────────────────────────────────── @@ -970,11 +1023,21 @@ jobs: -H 'content-type: application/json' \ -d "{\"username\":\"unsloth\",\"password\":\"$NEW\"}" | jq -r .access_token) echo "API_KEY=$TOKEN" >> "$GITHUB_ENV" - curl -fs -X POST "http://127.0.0.1:${STUDIO_PORT}/api/inference/load" \ - -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' \ - --max-time 900 \ - -d "{\"model_path\":\"$GGUF_REPO\",\"gguf_variant\":\"$GGUF_VARIANT\",\"is_lora\":false,\"max_seq_length\":2048}" \ - | jq '{status, display_name, is_vision}' + # Retry: same rationale as the OpenAI/Anthropic and Tool calling jobs. + LOAD_OK=0 + for attempt in 1 2 3; do + HTTP=$(curl -s -o /tmp/load.json -w '%{http_code}' \ + -X POST "http://127.0.0.1:${STUDIO_PORT}/api/inference/load" \ + -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' \ + --max-time 900 \ + -d "{\"model_path\":\"$GGUF_REPO\",\"gguf_variant\":\"$GGUF_VARIANT\",\"is_lora\":false,\"max_seq_length\":2048}") + if [ "$HTTP" = "200" ]; then LOAD_OK=1; break; fi + echo "::warning::/api/inference/load attempt $attempt returned $HTTP; response:" + cat /tmp/load.json || true + sleep 10 + done + [ "$LOAD_OK" = "1" ] || { echo "::error::/api/inference/load failed 3 attempts"; exit 22; } + jq '{status, display_name, is_vision}' /tmp/load.json - name: JSON schema decoding + image input env: @@ -1156,6 +1219,19 @@ jobs: shell: cmd run: echo Stop Studio (no-op; runner reclaims STUDIO_PID=%STUDIO_PID% at job end) + - name: Collect llama-server logs + if: always() + shell: bash + # Copy llama-server's own stdout/stderr (teed by Studio under + # ~/.unsloth/studio/logs/llama-server/) into the workspace so + # upload-artifact can pick it up. Crucial for diagnosing a + # subprocess crash where Studio's traceback only shows the + # symptom (httpx ReadError) but not the cause. + run: | + mkdir -p logs/llama-server + cp -v ~/.unsloth/studio/logs/llama-server/*.log logs/llama-server/ 2>/dev/null || \ + echo "no llama-server logs to collect" + - name: Upload logs if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -1164,4 +1240,5 @@ jobs: path: | logs/studio.log logs/install.log + logs/llama-server/*.log retention-days: 7 diff --git a/studio/backend/core/inference/llama_cpp.py b/studio/backend/core/inference/llama_cpp.py index 3682f1dbbb..a4c28166b9 100644 --- a/studio/backend/core/inference/llama_cpp.py +++ b/studio/backend/core/inference/llama_cpp.py @@ -101,6 +101,51 @@ _SWA_CACHE: Optional[dict] = None _SWA_CACHE_LOCK = threading.Lock() +def _probe_dns_dead(host: str = "huggingface.co", timeout: float = 2.0) -> bool: + """Quick DNS check. Runs on a daemon thread so concurrent sockets + in the same process are not affected by socket.setdefaulttimeout.""" + result: list[Optional[bool]] = [None] + + def _probe() -> None: + try: + socket.gethostbyname(host) + result[0] = False + except Exception: + result[0] = True + + t = threading.Thread(target = _probe, daemon = True) + t.start() + t.join(timeout) + # Thread still running -> resolver wedged -> treat as dead. + return True if result[0] is None else result[0] + + +@contextlib.contextmanager +def _hf_offline_if_dns_dead(): + """Set HF_HUB_OFFLINE for the body of this block only when DNS to + huggingface.co fails. Restores the env on exit so a transient + resolver hiccup at the start of one load can't quarantine the whole + process. Respects an explicit user setting (no-op if already set).""" + if "HF_HUB_OFFLINE" in os.environ: + yield False + return + if not _probe_dns_dead(): + yield False + return + + transformers_was_set = "TRANSFORMERS_OFFLINE" in os.environ + os.environ["HF_HUB_OFFLINE"] = "1" + if not transformers_was_set: + os.environ["TRANSFORMERS_OFFLINE"] = "1" + logger.warning("huggingface.co unreachable; using local HF cache for this load.") + try: + yield True + finally: + os.environ.pop("HF_HUB_OFFLINE", None) + if not transformers_was_set: + os.environ.pop("TRANSFORMERS_OFFLINE", None) + + def _swa_cache_path() -> Path: home = os.environ.get("UNSLOTH_STUDIO_HOME") or os.environ.get("STUDIO_HOME") base = Path(home) if home else Path.home() / ".unsloth" / "studio" @@ -483,6 +528,9 @@ class LlamaCppBackend: self._requested_n_ctx: int = 0 self._stdout_lines: list[str] = [] self._stdout_thread: Optional[threading.Thread] = None + # llama-server tee log (see _drain_stdout / _kill_process). + self._llama_log_fh = None + self._llama_log_path: Optional[Path] = None self._cancel_event = threading.Event() self._api_key: Optional[str] = None @@ -1462,6 +1510,11 @@ class LlamaCppBackend: This prevents a pipe-buffer deadlock on Windows where the default pipe buffer is only ~4 KB. Without draining, llama-server blocks on writes and never becomes healthy. + + Each line is also teed to ``self._llama_log_fh`` when set so a + post-mortem (especially in CI) has the full subprocess output + even if the crash predates the drain-thread join in + ``_wait_for_health``. """ try: for line in self._process.stdout: @@ -1469,6 +1522,14 @@ class LlamaCppBackend: if line: self._stdout_lines.append(line) logger.debug(f"[llama-server] {line}") + fh = getattr(self, "_llama_log_fh", None) + if fh is not None: + try: + fh.write(line + "\n") + fh.flush() + except (ValueError, OSError): + # Log file closed under us; tee silently. + pass except (ValueError, OSError): # Pipe closed — process is terminating pass @@ -1804,6 +1865,55 @@ class LlamaCppBackend: except Exception as e: logger.warning(f"Could not list repo files: {e}") + # Offline: resolve variant -> filename from the local HF cache. + # The heuristic below assumes filenames echo the repo name, + # which breaks for e.g. Qwen3.6-27B-MTP-GGUF (no "MTP" in file). + # Match against the rel path (not just basename) so subdir + # layouts like ``BF16/foo.gguf`` are findable. + if not gguf_filename: + try: + from utils.models.model_config import _iter_hf_cache_snapshots + + boundary = re.compile( + r"(? %s from local HF cache", + hf_variant, + gguf_filename, + ) + break + except Exception as e: + logger.debug(f"Offline cache lookup for variant failed: {e}") + if not gguf_filename: repo_name = hf_repo.split("/")[-1].replace("-GGUF", "") gguf_filename = f"{repo_name}-{hf_variant}.gguf" @@ -1811,8 +1921,6 @@ class LlamaCppBackend: # Check disk space and fall back to a smaller variant if needed all_gguf_files = [gguf_filename] + gguf_extra_shards try: - import os - from huggingface_hub import get_paths_info, try_to_load_from_cache path_infos = list(get_paths_info(hf_repo, all_gguf_files, token = hf_token)) @@ -1946,24 +2054,50 @@ class LlamaCppBackend: Prefers mmproj-F16.gguf, falls back to any mmproj*.gguf file. Returns the local path, or None if no mmproj file exists. """ - try: - from huggingface_hub import hf_hub_download, list_repo_files - files = list_repo_files(hf_repo, token = hf_token) + def _pick_mmproj(candidates: list[str]) -> Optional[str]: mmproj_files = sorted( - f for f in files if f.endswith(".gguf") and "mmproj" in f.lower() + f + for f in candidates + if f.lower().endswith(".gguf") and "mmproj" in Path(f).name.lower() ) if not mmproj_files: return None - - # Prefer F16 variant - target = None for f in mmproj_files: if f.lower().endswith("-f16.gguf"): - target = f - break - if target is None: - target = mmproj_files[0] + return f + return mmproj_files[0] + + target: Optional[str] = None + try: + from huggingface_hub import list_repo_files + + target = _pick_mmproj(list_repo_files(hf_repo, token = hf_token)) + except Exception as e: + logger.debug(f"Could not list repo files for mmproj: {e}") + + # Offline: resolve mmproj from the local HF cache snapshot, same + # shape as _download_gguf's offline fallback above. + if target is None: + try: + from utils.models.model_config import _iter_hf_cache_snapshots + + for snap in _iter_hf_cache_snapshots(hf_repo): + rel_files = [ + p.relative_to(snap).as_posix() for p in snap.rglob("*.gguf") + ] + target = _pick_mmproj(rel_files) + if target is not None: + logger.info("Resolved mmproj %s from local HF cache", target) + break + except Exception as e: + logger.debug(f"Offline cache lookup for mmproj failed: {e}") + + if target is None: + return None + + try: + from huggingface_hub import hf_hub_download logger.info(f"Downloading mmproj: {hf_repo}/{target}") local_path = hf_hub_download( @@ -2052,18 +2186,22 @@ class LlamaCppBackend: ) # ── Phase 2: download (NO lock held, so cancel can proceed) ── + # Scope HF_HUB_OFFLINE to the download block only when DNS is + # dead; cleanup runs even on exception so a transient hiccup + # at the start of one load cannot quarantine future loads. if hf_repo: - model_path = self._download_gguf( - hf_repo = hf_repo, - hf_variant = hf_variant, - hf_token = hf_token, - ) - # Auto-download mmproj for vision models - if is_vision and not mmproj_path: - mmproj_path = self._download_mmproj( + with _hf_offline_if_dns_dead(): + model_path = self._download_gguf( hf_repo = hf_repo, + hf_variant = hf_variant, hf_token = hf_token, ) + # Auto-download mmproj for vision models + if is_vision and not mmproj_path: + mmproj_path = self._download_mmproj( + hf_repo = hf_repo, + hf_token = hf_token, + ) elif gguf_path: if not Path(gguf_path).is_file(): raise FileNotFoundError(f"GGUF file not found: {gguf_path}") @@ -2603,6 +2741,30 @@ class LlamaCppBackend: self._kill_process() self._stdout_lines = [] + # Tee llama-server output to a dedicated log file so a + # post-mortem in CI (or after a remote-debug session) + # has the full subprocess trail even when the parent + # only stored the last 50 lines. Path lives under the + # studio home so it ships in the same place all other + # Studio logs live. + self._llama_log_fh = None + try: + log_dir = _swa_cache_path().parent / "logs" / "llama-server" + log_dir.mkdir(parents = True, exist_ok = True) + self._llama_log_path = ( + log_dir / f"llama-{int(time.time())}-port-{self._port}.log" + ) + self._llama_log_fh = open( + self._llama_log_path, + "w", + encoding = "utf-8", + buffering = 1, + ) + logger.info(f"llama-server stdout/stderr -> {self._llama_log_path}") + except OSError as e: + # Best-effort; never block the load on logging. + logger.debug(f"Could not open llama-server log file: {e}") + self._llama_log_path = None self._process = subprocess.Popen( cmd, stdout = subprocess.PIPE, @@ -2899,6 +3061,13 @@ class LlamaCppBackend: if self._stdout_thread is not None: self._stdout_thread.join(timeout = 2) self._stdout_thread = None + fh = getattr(self, "_llama_log_fh", None) + if fh is not None: + try: + fh.close() + except Exception: + pass + self._llama_log_fh = None @staticmethod def _kill_orphaned_servers(): @@ -3110,7 +3279,17 @@ class LlamaCppBackend: resp = httpx.get(url, timeout = 2.0) if resp.status_code == 200: return True - except (httpx.ConnectError, httpx.TimeoutException): + except ( + httpx.ConnectError, + httpx.TimeoutException, + # ReadError covers TCP RST mid-read while llama-server is + # still binding the port (Windows: WinError 10054). The + # crash-detection branch above catches a real exit; this + # one keeps a transient socket close from masking it. + httpx.ReadError, + httpx.RemoteProtocolError, + httpx.WriteError, + ): pass time.sleep(interval) diff --git a/studio/backend/core/inference/worker.py b/studio/backend/core/inference/worker.py index 085a1ab899..cacede2d3e 100644 --- a/studio/backend/core/inference/worker.py +++ b/studio/backend/core/inference/worker.py @@ -648,6 +648,36 @@ def run_inference_process( os.environ["HF_HUB_DISABLE_XET"] = "1" logger.info("Xet transport disabled (HF_HUB_DISABLE_XET=1)") + # Offline auto-detect: skip 25s of hf_hub_download retries per file + # if DNS is dead; cached files resolve instantly under HF_HUB_OFFLINE=1. + # Scope is this subprocess only -- orchestrator spawns a fresh worker + # per load (see core/inference/orchestrator.py), so the env cannot + # persist across loads. + if "HF_HUB_OFFLINE" not in os.environ: + import socket as _socket + import threading as _threading + + # Probe on a daemon thread so concurrent sockets in the parent + # interpreter are not affected by socket.setdefaulttimeout. + _result: list = [None] + + def _probe() -> None: + try: + _socket.gethostbyname("huggingface.co") + _result[0] = False + except Exception: + _result[0] = True + + _t = _threading.Thread(target = _probe, daemon = True) + _t.start() + _t.join(2.0) + if _result[0] is None or _result[0] is True: + os.environ["HF_HUB_OFFLINE"] = "1" + os.environ.setdefault("TRANSFORMERS_OFFLINE", "1") + logger.warning( + "huggingface.co unreachable; HF_HUB_OFFLINE=1 set for this worker." + ) + import warnings from loggers.config import LogConfig diff --git a/studio/backend/tests/test_offline_gguf_cache_fallback.py b/studio/backend/tests/test_offline_gguf_cache_fallback.py new file mode 100644 index 0000000000..d3b2f553a2 --- /dev/null +++ b/studio/backend/tests/test_offline_gguf_cache_fallback.py @@ -0,0 +1,828 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""Regression tests for the offline GGUF cache fallback path (#5505). + +Three failure modes hit users when ``huggingface.co`` is unreachable +but the requested GGUF repo is fully cached locally: + +* ``list_gguf_variants`` raised through ``HTTPException(500)`` so the + variant dropdown sat empty. +* ``detect_gguf_model_remote`` returned ``None`` so a GGUF-only repo + was misrouted into the transformers/Unsloth backend (on macOS this + surfaced as a hardware error). +* ``_download_gguf`` fell back to a synthetic ``{repo}-{variant}.gguf`` + name that did not exist in cache when the in-repo filename did not + echo the repo name (e.g. ``unsloth/Qwen3.6-27B-MTP-GGUF`` ships + ``Qwen3.6-27B-UD-Q4_K_XL.gguf`` with no ``MTP`` token). + +Two follow-up regressions covered here: + +* P1 #1: the cache-side variant filter must match the snapshot-relative + path, not just the basename, so subdir layouts like + ``BF16/foo.gguf`` are findable. +* P1 #2: the DNS auto-detect must scope ``HF_HUB_OFFLINE`` to one load + via try/finally so a transient resolver hiccup cannot lock the + long-lived ``LlamaCppBackend`` singleton offline forever. + +No GPU, no network, no subprocess. Linux, macOS, Windows compatible. +""" + +from __future__ import annotations + +import os +import socket +import sys +import types as _types +from pathlib import Path +from unittest.mock import patch + +import pytest + + +_BACKEND_DIR = str(Path(__file__).resolve().parent.parent) +if _BACKEND_DIR not in sys.path: + sys.path.insert(0, _BACKEND_DIR) + +# Stub heavy/unavailable external deps before importing the modules +# under test (same pattern as other studio backend tests). +_loggers_stub = _types.ModuleType("loggers") +_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name) +sys.modules.setdefault("loggers", _loggers_stub) + +_structlog_stub = _types.ModuleType("structlog") +sys.modules.setdefault("structlog", _structlog_stub) + +# Prefer real httpx if installed (CI installs it). Stub only as fallback. +try: + import httpx # noqa: F401 +except ImportError: + _httpx_stub = _types.ModuleType("httpx") + for _exc_name in ( + "ConnectError", + "TimeoutException", + "ReadTimeout", + "ReadError", + "RemoteProtocolError", + "CloseError", + "HTTPError", + "RequestError", + "HTTPStatusError", + ): + setattr(_httpx_stub, _exc_name, type(_exc_name, (Exception,), {})) + _httpx_stub.Response = type("Response", (), {}) + _httpx_stub.Request = type("Request", (), {}) + + class _FakeTimeout: + def __init__(self, *a, **kw): + pass + + _httpx_stub.Timeout = _FakeTimeout + _httpx_stub.Client = type( + "Client", + (), + { + "__init__": lambda self, **kw: None, + "__enter__": lambda self: self, + "__exit__": lambda self, *a: None, + }, + ) + sys.modules.setdefault("httpx", _httpx_stub) + + +from huggingface_hub import constants as hf_constants + +from core.inference.llama_cpp import ( + LlamaCppBackend, + _hf_offline_if_dns_dead, + _probe_dns_dead, +) +from utils.models.model_config import ( + _detect_gguf_from_hf_cache, + _extract_quant_label, + _iter_hf_cache_snapshots, + _list_gguf_variants_from_hf_cache, + detect_gguf_model_remote, + list_gguf_variants, +) + + +# --------------------------------------------------------------------------- +# Fixtures +# --------------------------------------------------------------------------- + + +def _build_cache( + root: Path, + repo_id: str, + files: dict[str, int], + *, + snapshot_sha: str = "a" * 40, +) -> Path: + """Create ``$root/models--/snapshots//`` for each entry.""" + repo_dir = root / f"models--{repo_id.replace('/', '--')}" + (repo_dir / "blobs").mkdir(parents = True, exist_ok = True) + snap = repo_dir / "snapshots" / snapshot_sha + snap.mkdir(parents = True, exist_ok = True) + for rel, size in files.items(): + full = snap / rel + full.parent.mkdir(parents = True, exist_ok = True) + full.write_bytes(b"\0" * size) + return snap + + +@pytest.fixture +def hf_cache(tmp_path, monkeypatch): + """Point ``huggingface_hub.constants.HF_HUB_CACHE`` at a temp dir.""" + monkeypatch.setattr(hf_constants, "HF_HUB_CACHE", str(tmp_path)) + return tmp_path + + +@pytest.fixture +def clean_offline_env(monkeypatch): + """Strip ``HF_HUB_OFFLINE`` / ``TRANSFORMERS_OFFLINE`` for the test.""" + monkeypatch.delenv("HF_HUB_OFFLINE", raising = False) + monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False) + + +def _siblings(items: dict[str, int]): + """Mock ``hf_model_info(...).siblings`` payload.""" + return _types.SimpleNamespace( + siblings = [ + _types.SimpleNamespace(rfilename = name, size = size) + for name, size in items.items() + ], + ) + + +# --------------------------------------------------------------------------- +# _iter_hf_cache_snapshots +# --------------------------------------------------------------------------- + + +class TestIterHfCacheSnapshots: + def test_returns_empty_when_cache_dir_missing(self, monkeypatch): + monkeypatch.setattr(hf_constants, "HF_HUB_CACHE", "/no/such/dir") + assert list(_iter_hf_cache_snapshots("unsloth/foo")) == [] + + def test_returns_empty_when_repo_not_cached(self, hf_cache): + assert list(_iter_hf_cache_snapshots("unsloth/not-here")) == [] + + def test_returns_empty_when_snapshots_dir_missing(self, hf_cache): + # Repo dir exists but no snapshots/ inside. + (hf_cache / "models--unsloth--bare").mkdir() + assert list(_iter_hf_cache_snapshots("unsloth/bare")) == [] + + def test_yields_newest_first(self, hf_cache): + old = _build_cache( + hf_cache, "unsloth/multi", {"x.gguf": 1}, snapshot_sha = "a" * 40 + ) + new = _build_cache( + hf_cache, "unsloth/multi", {"y.gguf": 1}, snapshot_sha = "b" * 40 + ) + os.utime(old, (1000, 1000)) + os.utime(new, (2000, 2000)) + out = list(_iter_hf_cache_snapshots("unsloth/multi")) + assert [p.name for p in out] == ["b" * 40, "a" * 40] + + def test_repo_id_match_is_case_insensitive(self, hf_cache): + _build_cache(hf_cache, "unsloth/Foo-GGUF", {"Foo-Q4_K_M.gguf": 1}) + # Lookup with a different casing of the org/name still resolves + out = list(_iter_hf_cache_snapshots("UNSLOTH/foo-gguf")) + assert len(out) == 1 + + +# --------------------------------------------------------------------------- +# _list_gguf_variants_from_hf_cache / list_gguf_variants +# --------------------------------------------------------------------------- + + +class TestListGgufVariantsFromCache: + def test_returns_variants_when_cached(self, hf_cache): + _build_cache( + hf_cache, + "unsloth/Qwen3.5-4B-GGUF", + { + "Qwen3.5-4B-UD-Q4_K_XL.gguf": 100, + "Qwen3.5-4B-Q2_K.gguf": 50, + }, + ) + out = _list_gguf_variants_from_hf_cache("unsloth/Qwen3.5-4B-GGUF") + assert out is not None + variants, has_vision = out + assert sorted(v.quant for v in variants) == ["Q2_K", "UD-Q4_K_XL"] + assert has_vision is False + + def test_returns_none_when_not_cached(self, hf_cache): + assert _list_gguf_variants_from_hf_cache("unsloth/absent") is None + + +class TestListGgufVariantsOffline: + def test_offline_env_short_circuits_api( + self, hf_cache, clean_offline_env, monkeypatch + ): + _build_cache(hf_cache, "unsloth/a", {"a-UD-Q4_K_XL.gguf": 1}) + monkeypatch.setenv("HF_HUB_OFFLINE", "1") + + def boom(*a, **k): + raise AssertionError("API must not be called when offline env set") + + with patch("huggingface_hub.model_info", boom): + variants, _has = list_gguf_variants("unsloth/a") + assert len(variants) == 1 + assert variants[0].quant == "UD-Q4_K_XL" + + def test_api_exception_falls_back_to_cache( + self, + hf_cache, + clean_offline_env, + ): + _build_cache(hf_cache, "unsloth/a", {"a-Q4_K_M.gguf": 1}) + + def boom(*a, **k): + raise OSError("network down") + + with patch("huggingface_hub.model_info", boom): + variants, _has = list_gguf_variants("unsloth/a") + assert len(variants) == 1 + assert variants[0].quant == "Q4_K_M" + + def test_api_exception_with_no_cache_reraises(self, hf_cache, clean_offline_env): + def boom(*a, **k): + raise OSError("network down") + + with patch("huggingface_hub.model_info", boom): + with pytest.raises(OSError, match = "network down"): + list_gguf_variants("unsloth/never-cached") + + def test_online_path_unaffected(self, hf_cache, clean_offline_env): + # When the API succeeds, cache is not consulted. + api_payload = _siblings({"a-UD-Q4_K_XL.gguf": 5, "a-Q2_K.gguf": 3}) + + def hf_info(*a, **k): + return api_payload + + with patch("huggingface_hub.model_info", hf_info): + variants, _has = list_gguf_variants("unsloth/a") + assert sorted(v.quant for v in variants) == ["Q2_K", "UD-Q4_K_XL"] + + +# --------------------------------------------------------------------------- +# _detect_gguf_from_hf_cache / detect_gguf_model_remote +# --------------------------------------------------------------------------- + + +class TestDetectGgufFromCache: + def test_picks_best_quant(self, hf_cache): + _build_cache( + hf_cache, + "unsloth/a", + {"a-Q2_K.gguf": 1, "a-UD-Q4_K_XL.gguf": 1}, + ) + assert _detect_gguf_from_hf_cache("unsloth/a") == "a-UD-Q4_K_XL.gguf" + + def test_subdir_only_quant_resolves(self, hf_cache): + """P1 #1 regression: ``BF16/foo.gguf`` (quant only in directory). + Before the fix, the offline cache scan matched on basename and + missed this layout, falling through to the synthetic + ``{repo}-{variant}.gguf`` heuristic.""" + _build_cache( + hf_cache, + "unsloth/gpt-oss-20b-BF16", + {"BF16/foo.gguf": 1}, + ) + out = _detect_gguf_from_hf_cache("unsloth/gpt-oss-20b-BF16") + assert ( + out == "BF16/foo.gguf" + ), f"subdir-only layout must resolve to relative path, got {out}" + + def test_returns_none_when_no_gguf(self, hf_cache): + _build_cache(hf_cache, "unsloth/a", {"README.md": 10}) + assert _detect_gguf_from_hf_cache("unsloth/a") is None + + +class TestDetectGgufModelRemoteOffline: + def test_offline_env_short_circuits_retries( + self, + hf_cache, + clean_offline_env, + monkeypatch, + ): + _build_cache(hf_cache, "unsloth/a", {"a-Q4_K_M.gguf": 1}) + monkeypatch.setenv("HF_HUB_OFFLINE", "1") + + def boom(*a, **k): + raise AssertionError("API must not be called when offline env set") + + with patch("huggingface_hub.model_info", boom): + assert detect_gguf_model_remote("unsloth/a") == "a-Q4_K_M.gguf" + + def test_api_3x_failure_then_cache(self, hf_cache, clean_offline_env): + _build_cache(hf_cache, "unsloth/a", {"a-Q4_K_M.gguf": 1}) + + def boom(*a, **k): + raise OSError("hub down") + + # Patch time.sleep so the 1s/2s/4s backoff doesn't slow the test. + with ( + patch("huggingface_hub.model_info", boom), + patch("time.sleep", lambda *_: None), + ): + out = detect_gguf_model_remote("unsloth/a") + assert out == "a-Q4_K_M.gguf" + + def test_repository_not_found_does_not_consult_cache( + self, + hf_cache, + clean_offline_env, + ): + # Cache has a file but the API explicitly says repo is gone. + _build_cache(hf_cache, "unsloth/a", {"a-Q4_K_M.gguf": 1}) + + class RepositoryNotFoundError(Exception): + pass + + def gone(*a, **k): + raise RepositoryNotFoundError("404") + + with patch("huggingface_hub.model_info", gone): + out = detect_gguf_model_remote("unsloth/a") + # Early-return semantics preserved: 404 wins over a stale cache. + assert out is None + + +# --------------------------------------------------------------------------- +# _probe_dns_dead / _hf_offline_if_dns_dead +# --------------------------------------------------------------------------- + + +class _DnsState: + """Tiny helper that toggles ``socket.gethostbyname`` failure mode.""" + + def __init__(self, monkeypatch): + self._mp = monkeypatch + self._real = socket.gethostbyname + + def fail(self): + def _fail(*a, **k): + raise socket.gaierror(-2, "Name or service not known") + + self._mp.setattr(socket, "gethostbyname", _fail) + + def ok(self): + self._mp.setattr(socket, "gethostbyname", lambda *a, **k: "127.0.0.1") + + def restore(self): + self._mp.setattr(socket, "gethostbyname", self._real) + + +@pytest.fixture +def dns(monkeypatch): + return _DnsState(monkeypatch) + + +class TestProbeDnsDead: + def test_returns_false_on_success(self, dns): + dns.ok() + assert _probe_dns_dead() is False + + def test_returns_true_on_failure(self, dns): + dns.fail() + assert _probe_dns_dead() is True + + def test_restores_prior_socket_timeout(self, dns): + dns.ok() + socket.setdefaulttimeout(7.5) + try: + _probe_dns_dead() + assert socket.getdefaulttimeout() == 7.5 + finally: + socket.setdefaulttimeout(None) + + +class TestHfOfflineIfDnsDead: + def test_dns_fail_sets_env_inside_block_only(self, dns, clean_offline_env): + dns.fail() + assert "HF_HUB_OFFLINE" not in os.environ + with _hf_offline_if_dns_dead() as did_set: + assert did_set is True + assert os.environ.get("HF_HUB_OFFLINE") == "1" + assert os.environ.get("TRANSFORMERS_OFFLINE") == "1" + # P1 #2: env must be restored after the block + assert "HF_HUB_OFFLINE" not in os.environ + assert "TRANSFORMERS_OFFLINE" not in os.environ + + def test_dns_ok_is_noop(self, dns, clean_offline_env): + dns.ok() + with _hf_offline_if_dns_dead() as did_set: + assert did_set is False + assert "HF_HUB_OFFLINE" not in os.environ + + def test_dns_recovers_between_calls(self, dns, clean_offline_env): + # First call: DNS dead -> env set inside, cleared on exit. + dns.fail() + with _hf_offline_if_dns_dead(): + pass + assert "HF_HUB_OFFLINE" not in os.environ + # Second call: DNS healthy -> no env mutation. + dns.ok() + with _hf_offline_if_dns_dead() as did_set: + assert did_set is False + assert "HF_HUB_OFFLINE" not in os.environ + + def test_user_set_hf_hub_offline_is_preserved( + self, + dns, + clean_offline_env, + monkeypatch, + ): + # User explicitly set offline before launching Studio. + monkeypatch.setenv("HF_HUB_OFFLINE", "1") + dns.fail() + with _hf_offline_if_dns_dead() as did_set: + assert did_set is False + assert os.environ.get("HF_HUB_OFFLINE") == "1" + # Helper must not pop a variable it did not set. + assert os.environ.get("HF_HUB_OFFLINE") == "1" + + def test_user_set_transformers_offline_is_preserved( + self, + dns, + clean_offline_env, + monkeypatch, + ): + monkeypatch.setenv("TRANSFORMERS_OFFLINE", "1") + dns.fail() + with _hf_offline_if_dns_dead(): + assert os.environ.get("HF_HUB_OFFLINE") == "1" + assert os.environ.get("TRANSFORMERS_OFFLINE") == "1" + # HF_HUB_OFFLINE was set by helper -> removed. + assert "HF_HUB_OFFLINE" not in os.environ + # TRANSFORMERS_OFFLINE pre-existed -> preserved. + assert os.environ.get("TRANSFORMERS_OFFLINE") == "1" + + def test_exception_inside_block_still_restores_env( + self, + dns, + clean_offline_env, + ): + dns.fail() + with pytest.raises(RuntimeError, match = "boom"): + with _hf_offline_if_dns_dead(): + raise RuntimeError("boom") + # Cleanup must happen on exception as well. + assert "HF_HUB_OFFLINE" not in os.environ + assert "TRANSFORMERS_OFFLINE" not in os.environ + + +class TestExtractQuantLabelSubdir: + """``_extract_quant_label`` must consider the parent directories when + the basename has no quant token. Subdir layouts like ``BF16/foo.gguf`` + are documented in this codebase and surface through the cache scan.""" + + def test_quant_in_basename_unchanged(self): + assert _extract_quant_label("BF16/foo-BF16.gguf") == "BF16" + assert _extract_quant_label("model-Q4_K_M.gguf") == "Q4_K_M" + + def test_quant_only_in_parent_dir(self): + assert _extract_quant_label("BF16/foo.gguf") == "BF16" + + def test_ud_prefix_in_parent_dir(self): + assert _extract_quant_label("UD-Q4_K_XL/weight.gguf") == "UD-Q4_K_XL" + + def test_deeper_nesting_picks_nearest_quant_dir(self): + # When multiple parent segments could match, prefer the one closest + # to the file (innermost). This matches how repos like + # ``models/MXFP4_MOE/foo.gguf`` are laid out. + assert _extract_quant_label("models/MXFP4_MOE/foo.gguf") == "MXFP4_MOE" + + +class TestDownloadMmprojOfflineCacheFallback: + """``LlamaCppBackend._download_mmproj`` must resolve cached mmproj + GGUFs offline, same shape as ``_download_gguf``. Without this the + offline vision GGUF load path returns ``None`` even when the mmproj + is present in cache.""" + + def test_cache_lookup_returns_cached_mmproj_when_list_repo_files_fails( + self, + hf_cache, + ): + _build_cache( + hf_cache, + "unsloth/vision-GGUF", + { + "vision-Q4_K_M.gguf": 1, + "mmproj-vision-F16.gguf": 1, + }, + ) + backend = LlamaCppBackend() + + def boom_list(*a, **k): + raise OSError("offline") + + def fake_download(*, repo_id, filename, token = None): + # Echo back so the test can verify the cache-resolved filename + return f"/fake/cache/{repo_id}/{filename}" + + with ( + patch("huggingface_hub.list_repo_files", boom_list), + patch("huggingface_hub.hf_hub_download", fake_download), + ): + out = backend._download_mmproj( + hf_repo = "unsloth/vision-GGUF", + hf_token = None, + ) + assert out is not None, "mmproj must resolve from cache when offline" + assert "mmproj-vision-F16.gguf" in out + + def test_prefers_f16_variant_when_multiple_mmproj_in_cache(self, hf_cache): + _build_cache( + hf_cache, + "unsloth/vision-GGUF", + { + "mmproj-vision-BF16.gguf": 1, + "mmproj-vision-F16.gguf": 1, + }, + ) + backend = LlamaCppBackend() + + def boom_list(*a, **k): + raise OSError("offline") + + captured = {} + + def fake_download(*, repo_id, filename, token = None): + captured["filename"] = filename + return f"/fake/{filename}" + + with ( + patch("huggingface_hub.list_repo_files", boom_list), + patch("huggingface_hub.hf_hub_download", fake_download), + ): + backend._download_mmproj( + hf_repo = "unsloth/vision-GGUF", + hf_token = None, + ) + assert captured.get("filename") == "mmproj-vision-F16.gguf" + + def test_no_mmproj_in_cache_returns_none(self, hf_cache): + _build_cache( + hf_cache, + "unsloth/text-only-GGUF", + {"text-Q4_K_M.gguf": 1}, + ) + backend = LlamaCppBackend() + + def boom_list(*a, **k): + raise OSError("offline") + + with patch("huggingface_hub.list_repo_files", boom_list): + out = backend._download_mmproj( + hf_repo = "unsloth/text-only-GGUF", + hf_token = None, + ) + assert out is None + + +class TestListLocalGgufVariantsSubdir: + """Subdir layouts like ``BF16/foo.gguf`` and ``Q4_K_M/foo.gguf`` must + produce distinct quant labels, not collapse on basename.""" + + def test_two_subdir_variants_do_not_collapse(self, tmp_path): + from utils.models.model_config import list_local_gguf_variants + + (tmp_path / "config.json").write_text("{}") + (tmp_path / "BF16").mkdir() + (tmp_path / "BF16" / "foo.gguf").write_bytes(b"\0" * 100) + (tmp_path / "Q4_K_M").mkdir() + (tmp_path / "Q4_K_M" / "foo.gguf").write_bytes(b"\0" * 50) + + variants, _ = list_local_gguf_variants(str(tmp_path)) + quants = {v.quant for v in variants} + assert "BF16" in quants, f"BF16 missing from {quants}" + assert "Q4_K_M" in quants, f"Q4_K_M missing from {quants}" + assert len(variants) == 2 + + def test_find_local_gguf_by_variant_locates_subdir(self, tmp_path): + from utils.models.model_config import _find_local_gguf_by_variant + + (tmp_path / "config.json").write_text("{}") + (tmp_path / "BF16").mkdir() + target = tmp_path / "BF16" / "foo.gguf" + target.write_bytes(b"\0" * 10) + + out = _find_local_gguf_by_variant(str(tmp_path), "BF16") + assert out is not None + assert Path(out).name == "foo.gguf" + + +class TestListGgufVariantsPermanentErrors: + """Permanent HF errors must surface; cache fallback only on transient.""" + + def test_repository_not_found_re_raises(self, hf_cache, clean_offline_env): + from utils.models.model_config import list_gguf_variants + + _build_cache(hf_cache, "u/repo-gguf", {"foo-Q4_K_M.gguf": 1}) + + class _RepoNotFound(Exception): + pass + + _RepoNotFound.__name__ = "RepositoryNotFoundError" + + def boom(*a, **k): + raise _RepoNotFound("repo deleted") + + with patch("huggingface_hub.model_info", boom): + with pytest.raises(Exception) as exc_info: + list_gguf_variants("u/repo-gguf") + assert type(exc_info.value).__name__ == "RepositoryNotFoundError" + + def test_gated_repo_re_raises(self, hf_cache, clean_offline_env): + from utils.models.model_config import list_gguf_variants + + _build_cache(hf_cache, "u/gated-gguf", {"foo-Q4_K_M.gguf": 1}) + + class _GatedRepo(Exception): + pass + + _GatedRepo.__name__ = "GatedRepoError" + + def boom(*a, **k): + raise _GatedRepo("auth required") + + with patch("huggingface_hub.model_info", boom): + with pytest.raises(Exception) as exc_info: + list_gguf_variants("u/gated-gguf") + assert type(exc_info.value).__name__ == "GatedRepoError" + + def test_transient_error_still_falls_back_to_cache( + self, hf_cache, clean_offline_env + ): + from utils.models.model_config import list_gguf_variants + + _build_cache(hf_cache, "u/transient-gguf", {"foo-Q4_K_M.gguf": 1}) + + def boom(*a, **k): + raise OSError("network down") + + with patch("huggingface_hub.model_info", boom): + variants, _ = list_gguf_variants("u/transient-gguf") + assert any(v.quant == "Q4_K_M" for v in variants) + + +class TestDetectGgufFromCacheExcludesMmproj: + """A partial cache with only a vision projector must not route the + projector as the main model.""" + + def test_mmproj_only_returns_none(self, hf_cache): + from utils.models.model_config import _detect_gguf_from_hf_cache + + _build_cache( + hf_cache, + "u/vision-only-mmproj", + {"mmproj-vision-F16.gguf": 1}, + ) + assert _detect_gguf_from_hf_cache("u/vision-only-mmproj") is None + + def test_main_plus_mmproj_returns_main(self, hf_cache): + from utils.models.model_config import _detect_gguf_from_hf_cache + + _build_cache( + hf_cache, + "u/vision-full", + { + "model-Q4_K_M.gguf": 1, + "mmproj-vision-F16.gguf": 1, + }, + ) + out = _detect_gguf_from_hf_cache("u/vision-full") + assert out is not None + assert "mmproj" not in out.lower() + + +class TestProbeDnsDeadNoGlobalTimeoutMutation: + """``_probe_dns_dead`` must not change ``socket.setdefaulttimeout`` + process-wide -- concurrent sockets without explicit timeout would + inherit it for the probe window.""" + + def test_default_timeout_unchanged_when_dns_up(self, monkeypatch): + import socket as _socket + from core.inference.llama_cpp import _probe_dns_dead + + prev = _socket.getdefaulttimeout() + set_calls = [] + + original_set = _socket.setdefaulttimeout + + def tracking_set(value): + set_calls.append(value) + original_set(value) + + monkeypatch.setattr(_socket, "setdefaulttimeout", tracking_set) + monkeypatch.setattr(_socket, "gethostbyname", lambda h: "127.0.0.1") + + try: + _probe_dns_dead("example.invalid", timeout = 0.5) + finally: + # Restore exact state regardless of any test-side mutation. + original_set(prev) + + assert set_calls == [], ( + f"_probe_dns_dead mutated socket.setdefaulttimeout {set_calls}; " + "must isolate timeout to the probe thread" + ) + + def test_returns_dead_when_resolver_wedges(self, monkeypatch): + import socket as _socket + from core.inference.llama_cpp import _probe_dns_dead + + # Simulate a wedged resolver: thread blocks forever. + def wedged(host): + import threading + + threading.Event().wait() + + monkeypatch.setattr(_socket, "gethostbyname", wedged) + assert _probe_dns_dead("example.invalid", timeout = 0.1) is True + + +class TestWaitForHealthRetriesOnReadError: + """A TCP RST mid-read while llama-server is still binding the port + (Windows: WinError 10054) must not abort the health-poll loop -- + that masks a legitimate 'still warming up' state as a fatal load.""" + + def test_read_error_then_success(self, monkeypatch): + import httpx + + from core.inference.llama_cpp import LlamaCppBackend + + backend = LlamaCppBackend() + backend._port = 65500 + + class _FakeProc: + returncode = None + + def poll(self): + return None + + def terminate(self): + pass + + def kill(self): + pass + + def wait(self, timeout = None): + return 0 + + backend._process = _FakeProc() + backend._stdout_thread = None + backend._stdout_lines = [] + + calls = {"n": 0} + + def fake_get(url, timeout = None): + calls["n"] += 1 + if calls["n"] == 1: + raise httpx.ReadError("WinError 10054") + if calls["n"] == 2: + raise httpx.RemoteProtocolError("short read") + if calls["n"] == 3: + raise httpx.WriteError("peer dropped") + + class _OK: + status_code = 200 + + return _OK() + + monkeypatch.setattr("core.inference.llama_cpp.httpx.get", fake_get) + assert backend._wait_for_health(timeout = 5.0, interval = 0.01) is True + assert calls["n"] == 4, ( + f"_wait_for_health should retry past ReadError/RemoteProtocol/Write; " + f"saw {calls['n']} attempts" + ) + + def test_real_process_exit_still_short_circuits(self, monkeypatch): + from core.inference.llama_cpp import LlamaCppBackend + + backend = LlamaCppBackend() + backend._port = 65501 + + class _DeadProc: + returncode = 137 + + def poll(self): + return 137 + + def terminate(self): + pass + + def kill(self): + pass + + def wait(self, timeout = None): + return 137 + + backend._process = _DeadProc() + backend._stdout_thread = None + backend._stdout_lines = ["fatal: out of memory"] + assert backend._wait_for_health(timeout = 5.0, interval = 0.01) is False diff --git a/studio/backend/utils/models/model_config.py b/studio/backend/utils/models/model_config.py index bf7f7a009b..2f3bd2431c 100644 --- a/studio/backend/utils/models/model_config.py +++ b/studio/backend/utils/models/model_config.py @@ -1259,12 +1259,10 @@ def _extract_quant_label(filename: str) -> str: """ import re - # Use only the basename (rfilename may include directory) basename = filename.rsplit("/", 1)[-1] # Strip .gguf and any shard suffix (-00001-of-00010) stem = re.sub(r"-\d{3,}-of-\d{3,}", "", basename.rsplit(".", 1)[0]) - # Match known quantization patterns - match = re.search( + quant_re = ( r"(UD-)?" # Optional UD- prefix (Ultra Discrete) r"(MXFP[0-9]+(?:_[A-Z0-9]+)*" # MXFP variants: MXFP4, MXFP4_MOE r"|IQ[0-9]+_[A-Z]+(?:_[A-Z0-9]+)?" # IQ variants: IQ4_XS, IQ4_NL, IQ1_S @@ -1272,10 +1270,19 @@ def _extract_quant_label(filename: str) -> str: r"|Q[0-9]+_K_[A-Z]+" # K-quant: Q4_K_M, Q3_K_S r"|Q[0-9]+_[0-9]+" # Standard: Q8_0, Q5_1 r"|Q[0-9]+_K" # Short K-quant: Q6_K - r"|BF16|F16|F32)", # Full precision - stem, - re.IGNORECASE, + r"|BF16|F16|F32)" # Full precision ) + match = re.search(quant_re, stem, re.IGNORECASE) + # Subdir layouts like ``BF16/foo.gguf`` keep the quant in the directory, + # not the basename. Look at the parent dirs too so the variant label + # matches the snapshot-relative path produced elsewhere. + if not match and "/" in filename: + parents = filename.rsplit("/", 1)[0] + for segment in reversed(parents.split("/")): + m = re.search(quant_re, segment, re.IGNORECASE) + if m: + match = m + break if match: prefix = match.group(1) or "" return f"{prefix}{match.group(2)}" @@ -1283,6 +1290,57 @@ def _extract_quant_label(filename: str) -> str: return stem.split("-")[-1] +def _iter_hf_cache_snapshots(repo_id: str): + """Yield HF cache snapshot dirs for *repo_id*, newest first. + + Empty generator if HF_HUB_CACHE is missing, the repo isn't cached, + or has no snapshots. Repo name match is case-insensitive to handle + casing drift between download time and lookup. + """ + try: + from huggingface_hub import constants as hf_constants + except Exception: + return + + cache_dir = Path(hf_constants.HF_HUB_CACHE) + if not cache_dir.is_dir(): + return + + target = f"models--{repo_id.replace('/', '--')}".lower() + repo_dir: Optional[Path] = None + try: + for entry in cache_dir.iterdir(): + if entry.is_dir() and entry.name.lower() == target: + repo_dir = entry + break + except OSError: + return + if repo_dir is None: + return + + snapshots = repo_dir / "snapshots" + if not snapshots.is_dir(): + return + + try: + snap_dirs = [s for s in snapshots.iterdir() if s.is_dir()] + except OSError: + return + snap_dirs.sort(key = lambda s: s.stat().st_mtime, reverse = True) + yield from snap_dirs + + +def _list_gguf_variants_from_hf_cache( + repo_id: str, +) -> Optional[tuple[list[GgufVariantInfo], bool]]: + """Variants from the local HF cache snapshot, or None if not cached.""" + for snap in _iter_hf_cache_snapshots(repo_id): + variants, has_vision = list_local_gguf_variants(str(snap)) + if variants or has_vision: + return variants, has_vision + return None + + def list_gguf_variants( repo_id: str, hf_token: Optional[str] = None, @@ -1298,7 +1356,40 @@ def list_gguf_variants( """ from huggingface_hub import model_info as hf_model_info - info = hf_model_info(repo_id, token = hf_token, files_metadata = True) + # Offline: skip the API and serve from cache. + offline = os.environ.get("HF_HUB_OFFLINE", "").lower() in ( + "1", + "true", + "yes", + ) or os.environ.get("TRANSFORMERS_OFFLINE", "").lower() in ("1", "true", "yes") + if offline: + cached = _list_gguf_variants_from_hf_cache(repo_id) + if cached is not None: + return cached + + try: + info = hf_model_info(repo_id, token = hf_token, files_metadata = True) + except Exception as e: + # Permanent errors (deleted/gated/bad revision) must surface to + # the caller; serving stale cache here would mask the real cause. + # Matches the early-return in ``detect_gguf_model_remote``. + if type(e).__name__ in ( + "RepositoryNotFoundError", + "GatedRepoError", + "RevisionNotFoundError", + "EntryNotFoundError", + ): + raise + # API failed transiently; fall back to local snapshot if fully downloaded. + cached = _list_gguf_variants_from_hf_cache(repo_id) + if cached is not None: + logger.warning( + "HF API unreachable for %s (%s); using local cache snapshot.", + repo_id, + e.__class__.__name__, + ) + return cached + raise variants: list[GgufVariantInfo] = [] has_vision = False @@ -1392,16 +1483,13 @@ def list_local_gguf_variants( size = f.stat().st_size except OSError: size = 0 - quant = _extract_quant_label(f.name) + # Pass the relative path so ``BF16/foo.gguf`` and ``Q4_K_M/foo.gguf`` + # produce distinct quant labels instead of collapsing on basename. + rel = f.relative_to(p).as_posix() + quant = _extract_quant_label(rel) quant_totals[quant] = quant_totals.get(quant, 0) + size - # Only compute the (potentially expensive) relative path when this - # is the first file we've seen for this quant -- after that we'd - # discard the result anyway. Use posix-style separators so the - # filename matches what ``list_gguf_variants`` (the remote HF - # API path) returns on every platform; otherwise Windows would - # emit ``BF16\foo.gguf`` here. if quant not in quant_first_file: - quant_first_file[quant] = f.relative_to(p).as_posix() + quant_first_file[quant] = rel variants = [ GgufVariantInfo( @@ -1429,16 +1517,36 @@ def _find_local_gguf_by_variant(directory: str, variant: str) -> Optional[str]: # Recurse into subdirectories so variants stored under a quant-named # subdir (e.g. ``BF16/foo-BF16-00001-of-00002.gguf``) are found. + # Match against the relative path so the quant label can come from + # the directory name when the basename omits it. matches = sorted( f for f in _iter_gguf_files(p, recursive = True) - if not _is_mmproj(f.name) and _extract_quant_label(f.name) == variant + if not _is_mmproj(f.name) + and _extract_quant_label(f.relative_to(p).as_posix()) == variant ) if matches: return str(matches[0].resolve()) return None +def _detect_gguf_from_hf_cache(repo_id: str) -> Optional[str]: + """Best GGUF filename for *repo_id* from the local HF cache, or None. + + Excludes mmproj (vision projector) files so a partial cache that + only has the projector cannot route the projector as the main model. + """ + for snap in _iter_hf_cache_snapshots(repo_id): + rel_files = [ + f.relative_to(snap).as_posix() + for f in _iter_gguf_files(snap, recursive = True) + if not _is_mmproj(f.name) + ] + if rel_files: + return _pick_best_gguf(rel_files) + return None + + def detect_gguf_model_remote( repo_id: str, hf_token: Optional[str] = None, @@ -1455,10 +1563,23 @@ def detect_gguf_model_remote( through to the MLX backend, which then fails opening a non-existent config.json on the GGUF-only repo. Three attempts with 1s/2s/4s backoff covers the typical free-runner HF Hub flakiness. + + When offline, falls back to the local HF cache so a downloaded + repo is still routed to llama-server (not MLX/Unsloth). """ import time from huggingface_hub import model_info as hf_model_info + offline = os.environ.get("HF_HUB_OFFLINE", "").lower() in ( + "1", + "true", + "yes", + ) or os.environ.get("TRANSFORMERS_OFFLINE", "").lower() in ("1", "true", "yes") + if offline: + cached = _detect_gguf_from_hf_cache(repo_id) + if cached is not None: + return cached + last_err: Optional[Exception] = None for attempt in range(3): try: @@ -1479,6 +1600,17 @@ def detect_gguf_model_remote( return None if attempt < 2: time.sleep(2**attempt) + + # All attempts failed; fall back to local cache for offline users. + cached = _detect_gguf_from_hf_cache(repo_id) + if cached is not None: + logger.warning( + "HF API unreachable for '%s' (%s); using local cache to detect GGUF.", + repo_id, + type(last_err).__name__ if last_err else "unknown", + ) + return cached + logger.warning( f"Could not check GGUF files for '{repo_id}' after 3 attempts: {last_err}" ) From 2fbbf8ade663367601c7bb7315d3328752831cb8 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Sun, 17 May 2026 21:29:24 -0700 Subject: [PATCH 17/62] studio: expose launcher capability bits on unauth /api/health (#5486) * studio: expose launcher capability bits on unauth /api/health PR #5375 reduced the unauthenticated /api/health response to {status, timestamp} only, on the theory that the rest of the payload was useful fingerprinting. That was too aggressive: the Tauri watchdog reads `service == "Unsloth UI Backend"` and `studio_root_id` to re-adopt its own backend across restarts (src-tauri/src/desktop_backend_owner.rs and commands.rs), and the SPA bootstrap fetches the same payload unauth to detect chat-only mode and native path lease support before any token is available (frontend src/config/env.ts and features/native-intents/use-native-readiness.ts). With the post-#5375 shape, the watchdog kills its own healthy backend, the SPA never flips out of "full Studio" mode on chat-only Linux/Windows, and the About tab shows "dev" in place of the real version. The actual fingerprint-ish fields are `version` / `studio_version` / `device_type` (and to a lesser extent the hostname inside `device_type`). `service`, `studio_root_id` (already a hex digest of the install path, not the raw path), `chat_only`, the desktop_* capability flags, and `native_path_leases_supported` do not leak the install path or version. This patch keeps the auth gate but rebalances which fields sit on each side of it: unauth service, studio_root_id, chat_only, desktop_protocol_version, desktop_manageability_version, supports_desktop_auth, supports_desktop_backend_ownership, native_path_leases_supported, desktop_owner (when present) authed + version, studio_version, device_type Existing must-change-password sessions still fall through to the base payload because get_current_subject (strict) rejects them; that matches prior behaviour. test_middleware.py is updated to pin the new contract: launcher bits present unauth, fingerprint fields present only with a valid bearer. * studio: complete launcher-bits health unauth contract on Tauri + About tab Reviewer follow-ups to the unauth /api/health launcher bits split. Tauri preflight: backend_capability_stale_reason() fell through to backend_version_stale_reason(health.version.as_deref()) when capability bits were present but version was absent. With the unauth payload now exposing service + studio_root_id + desktop_* bits but gating version behind a bearer, the desktop watchdog was reading the new payload, parsing all capability bits, then classifying the same-root backend as desktop_backend_version_missing and refusing to adopt it. A backend that exposes desktop_protocol_version=1, desktop_manageability_version>=1, supports_desktop_auth=true and supports_desktop_backend_ownership=true was introduced together with MIN_DESKTOP_BACKEND_VERSION=2026.5.3 in #5341, so a present capability bitset is itself a version-compatibility signal. Skip the version sub-check when version is None/empty; keep it for non-empty values so genuinely-too-old backends that do echo a version still get desktop_backend_version_too_old. About tab: fetchStudioVersions() did a bare fetch(apiUrl("/api/health")), which the unauth payload no longer carries version/studio_version for, so Settings -> About kept rendering "dev"/"dev" for any logged-in user. Attach Authorization: Bearer when getAuthToken() returns one; fall back to bare fetch (still 200, just truncated payload) for the not-logged-in case. No new endpoint. Comment: studio_root_id is no longer a hex digest of the install path; it is an opaque per-install id written by the launcher. Updated the inline comment to match. Test: - python -m pytest studio/backend/tests/test_middleware.py::TestHealthAuthGate studio/backend/tests/test_desktop_auth.py -q -> 29 passed - npm run typecheck clean, npm run build produces fresh dist * Trigger CI rerun for flaky Mac Chat UI step --- studio/backend/main.py | 42 +++++++++++-------- studio/backend/tests/test_middleware.py | 33 +++++++++++---- .../src/features/settings/tabs/about-tab.tsx | 5 ++- studio/src-tauri/src/preflight/backend.rs | 8 +++- 4 files changed, 62 insertions(+), 26 deletions(-) diff --git a/studio/backend/main.py b/studio/backend/main.py index c1c9ed1d90..b60ad48218 100644 --- a/studio/backend/main.py +++ b/studio/backend/main.py @@ -494,14 +494,32 @@ app.include_router( @app.get("/api/health") async def health_check(request: Request): - """Liveness only; full diagnostic dict gated on a valid bearer.""" - minimal = { + """Liveness plus launcher capability bits; install fingerprint gated on a valid bearer. + + Unauthenticated callers (Tauri watchdog, frontend bootstrap polls) need + ``service`` / ``studio_root_id`` / ``chat_only`` / ``desktop_*`` / ``native_path_leases_supported`` + to (a) re-adopt a sibling backend across restarts and (b) gate UI surfaces + before any token is available. None of those leak install path or version. + ``version`` / ``studio_version`` / ``device_type`` still require a bearer + because they fingerprint the host. + """ + base = { "status": "healthy", "timestamp": datetime.now().isoformat(), + "service": "Unsloth UI Backend", + "chat_only": _hw_module.CHAT_ONLY, + "desktop_protocol_version": 1, + "desktop_manageability_version": 1, + "supports_desktop_auth": True, + "supports_desktop_backend_ownership": True, + # Opaque per-install id; launchers reject sibling Studios on the same port. + "studio_root_id": _studio_root_id(), + "native_path_leases_supported": native_path_leases_supported(), + **({"desktop_owner": owner} if (owner := _desktop_owner()) else {}), } auth = request.headers.get("authorization", "") if not auth.lower().startswith("bearer "): - return minimal + return base try: from auth.authentication import get_current_subject as _gcs from fastapi.security import HTTPAuthorizationCredentials @@ -512,29 +530,19 @@ async def health_check(request: Request): # Must await: a bare coroutine is truthy and would skip the auth check. subject = await _gcs(creds) except HTTPException: - return minimal + return base except Exception: - return minimal + return base if not subject: - return minimal + return base platform_map = {"darwin": "mac", "win32": "windows", "linux": "linux"} device_type = platform_map.get(sys.platform, sys.platform) return { - **minimal, - "service": "Unsloth UI Backend", + **base, "version": UNSLOTH_VERSION, "studio_version": STUDIO_VERSION, "device_type": device_type, - "chat_only": _hw_module.CHAT_ONLY, - "desktop_protocol_version": 1, - "desktop_manageability_version": 1, - "supports_desktop_auth": True, - "supports_desktop_backend_ownership": True, - # Hex digest of the install path; launchers reject sibling Studios on the same port. - "studio_root_id": _studio_root_id(), - "native_path_leases_supported": native_path_leases_supported(), - **({"desktop_owner": owner} if (owner := _desktop_owner()) else {}), } diff --git a/studio/backend/tests/test_middleware.py b/studio/backend/tests/test_middleware.py index bdf8e6d5a5..4e396db9c5 100644 --- a/studio/backend/tests/test_middleware.py +++ b/studio/backend/tests/test_middleware.py @@ -228,17 +228,35 @@ def health_app(tmp_path, monkeypatch): class TestHealthAuthGate: - def test_no_auth_returns_minimal_payload(self, health_app): + # Launcher / frontend bootstrap fields are available unauth so the Tauri + # watchdog can re-adopt a sibling backend and the SPA can detect chat-only + # mode before any token exists. Version / device_type still require a bearer. + LAUNCHER_BITS = ( + "service", + "studio_root_id", + "chat_only", + "desktop_protocol_version", + "desktop_manageability_version", + "supports_desktop_auth", + "supports_desktop_backend_ownership", + "native_path_leases_supported", + ) + FINGERPRINT_FIELDS = ("version", "studio_version", "device_type") + + def test_no_auth_exposes_launcher_bits(self, health_app): c = TestClient(health_app) r = c.get("/api/health") assert r.status_code == 200 body = r.json() assert body["status"] == "healthy" assert "timestamp" in body - for forbidden in ("version", "device_type", "studio_root_id"): + for field in self.LAUNCHER_BITS: + assert field in body, f"missing launcher bit: {field}" + assert body["service"] == "Unsloth UI Backend" + for forbidden in self.FINGERPRINT_FIELDS: assert forbidden not in body - def test_invalid_bearer_returns_minimal_payload(self, health_app): + def test_invalid_bearer_returns_launcher_bits_only(self, health_app): # Regression: calling the async dep without await made any Bearer header pass. c = TestClient(health_app) r = c.get( @@ -248,7 +266,9 @@ class TestHealthAuthGate: assert r.status_code == 200 body = r.json() assert body["status"] == "healthy" - for forbidden in ("version", "device_type", "studio_root_id"): + for field in self.LAUNCHER_BITS: + assert field in body + for forbidden in self.FINGERPRINT_FIELDS: assert forbidden not in body def test_valid_bearer_returns_full_payload(self, health_app): @@ -264,6 +284,5 @@ class TestHealthAuthGate: assert r.status_code == 200 body = r.json() assert body["status"] == "healthy" - assert "version" in body - assert "device_type" in body - assert "studio_root_id" in body + for field in self.LAUNCHER_BITS + self.FINGERPRINT_FIELDS: + assert field in body, f"missing: {field}" diff --git a/studio/frontend/src/features/settings/tabs/about-tab.tsx b/studio/frontend/src/features/settings/tabs/about-tab.tsx index 68d82a804a..97f1a0b1d7 100644 --- a/studio/frontend/src/features/settings/tabs/about-tab.tsx +++ b/studio/frontend/src/features/settings/tabs/about-tab.tsx @@ -48,7 +48,10 @@ async function fetchStudioVersions(): Promise<{ studioVersion: string | null; }> { try { - const res = await fetch(apiUrl("/api/health")); + const token = getAuthToken(); + const headers = new Headers(); + if (token) headers.set("Authorization", `Bearer ${token}`); + const res = await fetch(apiUrl("/api/health"), { headers }); if (!res.ok) { return { packageVersion: null, studioVersion: null }; } diff --git a/studio/src-tauri/src/preflight/backend.rs b/studio/src-tauri/src/preflight/backend.rs index 987adc3892..0277ef5149 100644 --- a/studio/src-tauri/src/preflight/backend.rs +++ b/studio/src-tauri/src/preflight/backend.rs @@ -143,7 +143,13 @@ fn backend_capability_stale_reason(health: &BackendHealth) -> Option { if health.supports_desktop_backend_ownership != Some(true) { return Some("desktop_backend_ownership_unsupported".to_string()); } - backend_version_stale_reason(health.version.as_deref()) + // Unauthenticated /api/health gates `version` behind a bearer; capability bits + // (protocol/manageability/auth/ownership) above are only set by backends >= + // MIN_DESKTOP_BACKEND_VERSION, so missing version means "auth-gated", not "old". + match health.version.as_deref() { + Some(version) if !version.is_empty() => backend_version_stale_reason(Some(version)), + _ => None, + } } #[derive(Serialize)] From 4290ab1b29e65ae4f0d960c973a1a8dad7d76759 Mon Sep 17 00:00:00 2001 From: Michael Han <107991372+shimmyshimmer@users.noreply.github.com> Date: Sun, 17 May 2026 22:03:48 -0700 Subject: [PATCH 18/62] Add files via upload --- images/Discord button.png | Bin 13767 -> 24768 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/images/Discord button.png b/images/Discord button.png index 5e3b56d6dcb41d1969aaed75bb9efc76d462ab2d..6d0401c4d09266ca31924b96a2908f6b79d8917a 100644 GIT binary patch literal 24768 zcmYIv1yoke_w_>~jg)kEBc0MEAl+R`cb9Z`w@9aSgLId4cXu~@msfxP?^%n*T5zAa zGiT16*n3aN7g=#cI2(cGpOjUD`%4bKB_U`MA)C8eK;pq4Z*sT37kPo zm_tO9o5d~?vFqj4l(Kb0y+i?z(Z+@#p9>HTI2Ftq_2f@TA3f8tsNlCxf5>|2OQ<-^Zhu<4$UJ2yg5nEOtLOAFdF zf%_b6ko4a;B3sxZsG|X(9qHJ0MpL=oNhXOOXzJ`@;Co=%ggytO$$k|T$R3`a>zkwm z^J|-%hHkuf_H`D>FX{A}?B{=kJzUOA|Jr_*Xr>T3v1nt{)5s(=Dy4rI9r^q=$a_>o zEYQV>%G)W{4`c#Lrj-n&GL`9!W0KG(Rc8;i!V?BLK%?lL9)@K5W@QmRJwL}skx;Gg z?v{9v{WtD~n1ME}F9tF}iiDh8U#t86pg2sKt0EX3^jRDkwn#n7pI|{aM5Fm+{7=px zYfzz4#bNLf3~KnZiQ->bpfA)-VBe6MW(z88X;oBZ_8g1c(UNZ+>k_|+gjKRB- zKvS0z4fVo;{J;=kqE`tP*{V#($|1?COubQ(iTxT$KeK+?q0o5e#k8s<-hlHQGSg{P0i;OSrgiI zwBz;B1@j=43>=90)#{&ZcgGCrFH4=&!>a0eUxPBcS|1!w&5IBoqY$K3GVk0$ZpP!A2qo@hBO)* z?XPnX#OlYSKN0Eu@G}AlfZu7wA~;`h{-D&0-Vn4ALihUssYmCtRF^L8unG$|_ydx% zdj{#Rxi07o;DcdR$jHfQmxV3Jz|jdo$uyFI4lZ03$O`>cmDoP-K!fvk1eFP-RC|Im ze>Vx$6$V&iJXsa3f(75SB#4x3;1_|;u(=<4m4(OPRC8VJjD0XY9*MaSuLv~Me}+MI zrHqj$W})rw>UF#^162TC%-a$@3q=h$#Ih2);#4N=lpRuK1SuycESKGuPZYAb%wMZa zK%}JH#-yi*cXyL%a{J|iK3LO~Q#bj#AXdP=&5*z+3oL$yWo1?slF~Q94UNuU@~=(Q zQOzyo>q(fIQL(X8{V+^H2=QcHvM%o`V1chOtBGWP*5>i3F_QK7=j~6|v+@0V6iX3R z$jHddMoRl3nIw;(qsfFxc+>k}fO)FH{H6o-)LI>)uu*`^iC` zfEnNkh7JAD^Xqa>!CYW`?y8kV^hn6ak}X9-{u^FmHWlODyLVE*g@$ZEx}k}AK;R01 zx#%Yfc#B%y7NFWPd|Z@h{2xDv&n~OE%m2m@kz6S^H|~v1wCL30B8DAe&@%ae4JJYF zrY~UdBZxJ3kp4_K8ofwYr%(dXKYPcJ1`~;DX|??6oRWG6(upDKLU2KediS<;&~IcA zv>K1fR0fJBkDBwph2zPT4vFfI09K~&DggViL%k@#OCkZpMj=ols8D}|)7x9XKOlgb z@b5~3)Av_e9lCpZs0qtz2tQFuvS@uzvwwVB2rgJMGEvk5Gl`*)k!&ym++R;4QH@Pb z&NWg|Yt(5+%uXZ2uIr3wbUcJpXK#C__md3_E`}|JR#g_7>R(7Chk}8jK2)Kte(7m) z`S~s5sBVcRu5(J~iqia0?$^!#JW;SLR2PJhK-R_AfL#v{EKlCySPe2eWP!P@jUN^n zS@`DYXz8CBPsr)%5i2Wg`}_NAOp@mu$JJvIY;8!bFmjnN`n4dka~7C$@(N+U+}$-? zk7E8iAOS;fc1F)2lEe2jG-HHlzURpZNV7)b}~^pQS|ea&u`c zrIgDrMYD6#N-Upkirzd&6GE*tA36Z`OE7rKe08F=Rxplcu(X}Z`i=+e=|J!4p+&qYo<}*u1(P+0*aV&I@kNZf4Uj)(a%g9c$WF96?nr~zlAzm zNFQP|2=teim&la=?Gwz!?QK297iP7@2-0=LfRD!Wb02;~gW3`!BZ6VY_4IrUDa8KO z59YG3_j@+5(ClnHgfD+1H0u0!HR~|PdN|k50jv?Dk36~ zzW$HMl)o;88iNG~53fA43XG#M<}Ul@AD&<>x%nGkMMRQG^Z)tx)-(x8=akbQkAa$U z=hxJ?2_mk6d{C;<1`-h)?ZrE1XASsd{<+;BK`}Atlcf;f(78`JMf^S34dxVp8&yLj zn^J!|{}l%Vf&OpUNYa^g1HN*hUuvsqGxt`_%bSKEWqN${_wU1fK+XJe{|0meuOz@a zw8JP)ow+}$Uls<=FUSJzJGOLIcsdv95ev+}=M*TpxuJ`Sz9k|JfyO0b5qQ=Z-p*er z%CIe{XBdC?@X$}Ikz{>yv!8OVa-q) z433zWHyrGLp%M!y;C_})DpQ$MSQ0jw0()Nx?ZcN?=L!h}L(Dq${|#W5eRl^*MnO?D zer*m~x&QktgrYEr@s?@tv zaQUe9mCW5t45DM%c)huVmst)43Hau&Y2_L8zh@d@D6w#Yq%=e8c@; z%^)f1SV0d5DT*E{X|PZrJpJDZUQ+w?$;sH$T9838{r7na;DhlXEl~6}Ka#u_sq={h z+c)C>nW2+~g~eu97M-peH5M#BnygDk+*F~(kl_|8SJa&DS9gYZUB zPuD@#{~6d7i7?B;tjRglrK1^X;4N0kgG|Bh(uQ*S<0z99;{FAiVBWsxN0KxWsUms( zUOvTwDCwKgT$e5_A0gOx?@azL;y@S=<YUUCkX0WOl)lE&puhbmri3&_Y-if zfq_ZWO1*PCJRUEF6w1F=61230Llxh%iuxRC2%PTFU? zwP%aR>w$p9s4XVe>$j(wVQQu~QxUgD({zIq3;`4Mq-dY#QkhezQ~SPHsXVw?nI=c% zJO^R)zZb-)4i2NwqdUhtW@7h|4}6iVe@js2V0V*C%p`8_am?zppj<0UX07yY3Ej{8 zvL4TO+x!~bIR=l;?M-FH%2KD-E!t1-AQ+LnrjM8#?L;?HQm5scXC@0Z3ozj@Xx4t+ z$9RThMOAsgd+Roa(yCUhUu@GhP!Bb@USe7;wFK`M< z$>-V-qxWYa-(T(uhivrdF>To%ToRLz*g5wu)>rCxnOHn}VnseX;!H5x_A_n^CJbVn zY56sM{gcZq zyw18+XWDiVksW`wVx?jqa(J(Rk0GZK?D%ffi+rU(DUUPbjTwP6BN|aqLOqYQ#UI|g zI5>Nf<$i0}S1w?C+)KYas$F9PHsxN2S*%jze=uE~ttSXw1DwREw+^wC>ymkWaX^B- z`dMX($>lVIW4vbIa@c{~j%Z?Ccq;#wUK1Jia4&|^TaWMoZY{8}oZ$O+u;5_WdI$Oo zU&i5O@1w3>`o&89Np=xY(M5;0)%@3BQ}bE>YK!GIG>D)!{YfqoQu~bnF~spwNm5?T z0tyIM1{xr6FV?+A<_)PDjEiZ^V%<~U9?3Zjd}~;8%vFBq5G<)jHDVK z#{+~NdbM!ZFcm8I{q!Q&xWK)MGSbW{}3E6))~=bQF7W{eegPm#eUWhCpV6uXO8sofJ=LrLifdAuLDb-%P{Li5WLiG~{^PX$UCU z*f8vO7`k`SyhNJr`^$&+mwu3owVlJ+?HcsrprX1a;c{5z=xnmHXOOa(a^4)x{XP;Q zff*PcR%e4WeAtS%4&pe&}GNtH3L*Xn!T=K2bG7L$;EW4Ny` zh}p?x*qI-~nUcWe7lCvDAPQfOc?TjiLn3i5nIX`T=-59#wAxBR##)f_2ZdoW3Lhf1 zE^~h(77^{+$RoC18+wP9&_w%YHX>$b`J_t#M%cF_AW;w(P5;!5ePDE*wd0GPL3g}v zDvmsMyO<6og(_*6?iUofQ9lo#!G~CHt$gzml%+T2p4GH`gJe%3mlpBb$^u?lSvi^s zhl(1rysxaqOU9{|bcqtfO(IJKH>)u|QA`x@twh}2-V|MvZ_atHTD#Q=0*$+H z-n&&<1^!o~RvzaQgSF`ORE>m2zq0mI!BwnRn4jl$|5?LGH2@x?>K@P4ZdYmHH(JbQ zFsIr2RF)*M#`=aAbiO@b=I5GxLhJ zvTeQZ%_jLfVuBQ7+aP z^Ee$XYyxYmJ?3#Tyqv*zX_NOfmFuC`YWIR@eMIhARc$4O5QQ{=Zhzu7d186DuCG6u zi3Au=8v$n=>k%n(oK+<^&3WI5olC10ch=hA>M`g1hhy8T8=fEfRsuM9cOo*ObnT4> zKea@RvP|eqB7;OGEgKtRR`_f0{3H>G(EA}FZ?FM!?PQq>;bHYq2QAxWZ%)_rY^Ly5 z{c~J!FmK|X#dK?R9eXZe3lDftXr&=eOm*Sh#l(r^>s{7opfKKnI;+WZL*Hu5m&xjJ zgJsxQxK6wKc7V{r@A0d;V592&d$jY5vlyr44dRpTDYqt;%%W@7P%PR|@cT=c;t6B7+i$Izo0?LGpx1i!y`dCyx~0YRsCt7!6kaOepKNQq-h zi~Kto9H?2*!PAFzg#;WPU%ju6R(i_qNl7k6?1b&?sv3oh2dm^`$^0z7HTPX^>Z>A;Q4EP0%YQE4+}&^gp_$~=PZ@GY%qNu_74huCdqc=w{@D2J;W^PLEZuVUWM8OK z8#)NL$rWFQ6#$PVlrWg^az9&GNOdG&152w?))hFyEtsc)xn71Q~toAvDp1 zQ($Fw{&6(_e2;kA(e|_hgE{2TamJHx#-udnkh z)OI`Jk27KNs(T z!=;tsvU(7VTL^XLpn8Rljc9t}$R_H*rZEL^Gm&wMlFgq(QSxYizzjwxLF<&tXiF8lO}7!jnYk18Fw3T%y$n%atS&|qhCsPCe^C+C{kI=O)nd} z36^`LuZD*IE1|0bf(e5;eW4r)o`*KYXW2OZtY)dBXC4eyc-!2dO9X@nd=9ARaX;bp zO15yfoo#Wo(?4&~9j_GDELaUd%@AsP+_AqpoSxsYe||c|%l%c3@K(|`!eZF^Hvs|p zHB^tc=qrUQfvvOG>i4eEOz5It&acE3qxmR{I{c4M=4oS!xnI2Kk{{t|ROpaZi9_L9 zdECgL+ovY;FW*9c6ra0e8rIvGG4x8^sF|JyZ=G9CxTmYMb}AZZKs7 z^>rY(@Y#Pjv~MBk7ePS5{b4ut(b984b%CIYiQ&=guC*ACYI}3D|;e@yR9v;K9gV6|$=kww} zD=jzeu1@A7JlEgAqki(DU`i!-h3K4|M$}UAbyo(R2V7isOZyvE2|s#G=e1K>)pZ$@ z(NxpPySK6eevHGnnM%2sY~=(0UC1k?MxyM8S1|T6%}|C69wIWb?)6L3H>5#9T9kJ^ z%f&xyfe1=7$}MyL5|cIncHlX9*76~|@x$ZG;u&*J2T7bXpCi0Xu3nqV~z=GEONiE#9|-N-3M!nNq!Ldw*Ke;Q7c9UjH*X zGvexhcc(|k#U`(3XxU8e2%w)`y9-flu)F3C zuRo;`RVS=Fq1U1!gv0C)dfyZFLuueWm3DFN#RC*Hbf@C^HHlm_fGM`irvKibMD~)+ z;`YSkuv+OnZk}jxW_-?~Yh7xz%Ml65p;Bl-8BC-Os4|wK)g*7--u;NWFZZ9>MA$3m zVvK*f)Tf=Pjc@2)Yz;u^>gw|CO3KE^$NQTeaEKci!~zuo&NeJUcloh73hK!{^~XxRb*mvMvq0yE7}$fzoN!;B^Hd3i&-aYFiy@YiQuy5OVq-x1V+v*W%hf%GSv2 z(k2TqzSZ=BhzB%KpE59rbepXpbX*O?r#I^?)j~T1;EnHJv9Yn|E_eCqwAip5-xoQa5;ucM-PBM%R8LBNHG6pwRz+1 zi#kK2(Ew_4vD_@i9!js(7923J$jAAo z!XD|w&12@QuQ<(4_geLH<0-RaX`};)Hp~Q;L z@YS77S*38R-BzbfOs@ym#0wO#uoutfpE4yo!QtWl&1hl%jBO7{eR7$#`@FX2A<5Nx zjTb1otJW+}0E}w|I*K4+llKJ$O|3lCUBT}_%$72KEV`R2{)b~4wCsh@w%$}L_Y4e$%>LsJe zOtzsT@GE^GP!o@Y-U0daJO*9)^j5XC(G^MVtvXk_8`p2WmPY+)Br~B`xwOxQZON>) zXfwm}S;w55?X6Y($!Ac%iH6Eu6=p9yg&iIg7>)qguGw z$b#WT&3x*gm0DdM{8bMD#E7)Iz6*?!1P4K9+q-_|ns2KR_E_b=4jsKx8bQxGIK@T{ zYIcW-s1QL2eI=x;)#lNX4aBRxuYpmW!SyT3RUj>VUB+9tRsf_wGar5=H2gh|+F&#A z0##=^rW(lV#2iFthBs7W+b?~oPOb68%>f4Qme8SmzJxW`Xu zM}T1)U>5~VJ-jo{6xUfDOb@=rwZo{fGvVx~Qn8%t>T#N>t-d7qO>qYqNBq)oN zn!4xPWpIS_?_haDX1z1o2HQ;vt&BOO$+B4@3)N!h4F9p07|mA?9H^psIxtO7)nyM{D`0oKEL%LM>D06_GeFEgy!1b z@A*>Kg*vyEsfwUUv#-&fg~7DE*I%PMEk;oe`WSsoEs!=39($HEK`4d%|c_8kzzr7%07fE@BB$mCbzABOLEJ=FfFU%uAaa zgkNA=X|L(_#AYNnjqf23ju14eXURShd0`1BBrBX+rwt_r{MvXZq|{1Mdavv*287R2i_z40u#Ap zTCq9rar5N!MZ6?;;TFC1_a2;9zLVwN4@aUck1w3tZ0Oy)ySut3dROjQo%15>pI^Us z**;uhH^8;&oLsw2c!%I(bm@9)-fP&^$+g`f+3!}Kq>$EFFG|^iF2>h?+QdVJC7R*P z)*8}ojhK&n@^5L;Y`{q!5)r<^$0!yj5+({RNTwLW#E%-4W_-MFunudK<(DY;54BQq zW4~2(y`#q3Ga*$e;ml>9to{hV^O`O`_hq^4`kjwv2L3UzxetY*UadA6>$g>I;Ki6oBXaHj)^x$zBmF8|6RCnB9$fC_L)-Sp0w;;mB< zols9HB|q8l`gjiW`QDg)spmG%bnTI_pg}~eC%IDhx3b66JjbA~^HIU-@9E$seRZwx&S8BBD2g#~EnVqbSX+zg5}{m<2fuYt-vk=i4UG#ET`+BsgRt zH$r2a2l$dm$j?1VF4a2{J}=H#HZK*^@TSy@D6LWP=Y%Z`++lh;1>ve!PjrHLM zAEV{C2Q}YY{c#x1{J1(lX+yn%bQhH6fv8FzD#)NwwFLYL+oQEVPNc6}|0!v;LF8;M zZn{Vt9_n(p)-AoTz1s2c^j84@em${^FV1AWc)I;MYlKlm)up0~?6)i$L39m_NUP^^ zhcgn_tULCnL_Izg>9L^)(rAW2Gb?624u==XQi9srb7j!H!O7MnBSoi6+9K={lrCdc zZ&d>BFXvS+Q@O66_m7X8J#Bof5g8x7E4BS3yib;+7M*j-2(U15!o?zR=8R>xa6CNd zOcb_IPdDsS1m3Ogx%b-D1k2VqoOC9x0NC?sH>V+bAZUFZ46p zI9Eh|@YAdhe=EVsLaSc5yPjE`TYykeH8Z=~Bs)SRN6xKxcc+%+NW|Td&TZUo#U!2h z%{*YSLKVv&GL1e-!b-Mh);#yCl3ASvjURfZ{%xkGgp_O`?TI8Dz~`BWQEZ^S*W#xC zlA93_=>NNKR=ntS%}mo&Bq^%(5h=&3b>R$>xzaYZ4|78Wxg?k)`qcZbNMS&iahfJc z7&yjXnv^8b=@mZw(EkBD81qkw;XgOWsnztvA)CSNw_P%`{?^-QsT!?%oK2V}Up+%6 zJv}FI$T2vaE)XQpDt`)j-xH6-+94=7IMz1Tz`4|7t60=iWj5k=H1FK~?XpCrmL(L6 zF*F?&6&3+OsV+X`Uc223&HLFA96;Bn%IJ@4urJRPUiteo7LWMQ3f2y{bt&-0zXe7@CQb68#P*@^DF`iE9yRnwScqP6}tx8-8=;o2CP)It^At6wDl}n$S3(O2w0moO&ERx|)~q}E9lLFgf?@0#n!Ex)&N+sUDlRXL z4^+Bs2zHRrG_MSyK^c7BsBe5gSYm1Ss%m*B1_0D2^+8g1J0X|ZZEvKRnwM&}zti+y z{V8qa@u~e}?@uE{CR&Zb68Lzu0n+sJ_6o2vguf6pRcGill|!XwB5>YhYS`= zHBcj|Z6H`r!Ac5-763DtJRKENM;7z)c)2}8QWO&@gtv=VnVM*mS z^F%$5hGNvnY)AyW;S8Yfp&?F2!XBWazP+>TS2xyc{BsdWgrQ93#Vn?}W-kY;k` z;Ss;&2G84tY=J3tW05p2cZIP~r_+=0B5d}x2FaLX8J_vH0RY0502rL0$d$QLMX0=W zTPVJ!%Eq+5Up$A#C{a0WIpYqq*_I8jcI)8VW5dl_DGDFB3klgPG)s9I&!5sQA7vL; zJep!_YLrF{d%%;YLZYJj#Irn%FI_cQJ&_hU==&C}+cJ%PNN5c@RGSq zA>nYCeVu+9OkxZh5b*LF6m8eH;dbH ze8&vK!78IfzCI0>C-ZC?)!SCX7>y+uluikp2T&oJ5Z#<1tq_;wYTe@+moQ;TXXEsmK{d1Oq=HhTQ)=O`X^yo8R z&+JgE4&$K4Pw3i8lOEnYmG4ZV&?{!TfbdJKZ+HkEe({D~3Uq)EuD14ti-JNGy zojOQ7y;Vc$g|Qgav-Gt98j4qO=q3$)>j7}6_|6m)>sOPZ-p_E(yGL}PK&xtSGCa_q zHv6FGr*<`##@3_%J(Rc6UjOB&s8FdgecG@G&-9i1T>`B-;lRvf)+16U+ML3raBg|5 zvBB7bbDY-%FTc1RXlL~49sWWIJimrwNxpmiX!7l%+#p-c`!SiRDBBrd=b7-VFRgCM z+M|?pg{cy1)P9csm zi)`O%l!B2}rHaMkycx#Wt*LkyXGVAw_ORN``DmqLD)`UPpzt&zWZ~`-xOqRkD292My}TBITIQ04B#jkj>W5DDXeC+FlhJGgUTRLw67N zj-tem7rkLu82l2tmDQV_{1nP`&7pfr_XQ5>3f*H<*)n@86e($D|Bx{7qaLzb_`an` z{fDU#DtWC{hL5f8j+4f;p98AMnYRn96SBtK4yG#c0hFu2^$B2Q*Af2K7p2#y%TR`5 z?cb7arAcTF&!k&fqgESSgA~RSj>Ij}PF9;s@+%KHEM|<6n3*fpez_#%XLZS>@m37s z^FJCH&9 zezSMMDQFP$5t$&6^4GSE3im2((ZL?G;f%+~X8Vf)U9n0Tf_sVlPwuw6E54CU)6vw^ zv(`&p&l|A8c@}q5!)UwI4h+b=O?g5^B|)d=567pA zgf-L3WllszJ%~R+QV**@8%1}v;`2Fmew!t@GO%98D)V%6{LXiEG$St=H#zC^vM@13u(fRm2(1F5ce&yRN8?%EZCdmJIwI*G;SpyOlZX&iQk z>}3It&tF#|iG=b`YxvXB)6Rxb*w_L}VB7oH4 z@Q>hR1No53g2S?6!Pwdv^Wm!ZOp!8%@nC$_{=$}y($mT{njoA?@0Ff-dVD0cf+8-v z%M62c{?U10RckLt%+8c&UE+y*a4SHZd?XRNoLh80IpD^Ut8r?rBiJ!mOz3#WrbKxE@$G2A@!_aexhwI3$4t3IMRbyL-lZ?UoXZS=Fg$U;wD>LdUi_D2GfNGi4#PYb zFZd?gWIoCmZfgQfEb_A|z_V`_Z3L7N)SDe+rfKw)t2YDl*Wqiv$mir^P=llr(uZ#U zy0jRgXqs-f+%z^*Bfap0Nn>jXKY6kqX1+ruo)iyeam?B2g@u%ERDS0#bfYBa!>F|=N3 zdFPJi>=1_jr%tp3?Qq}>!0Rq8GBi?qwVSP8D@=X=5dW>3mun;!5yNwH$%ZrQrw(iZ z&P~M6?O}C_Y&M^w?Kd49vh&H3Xn|HekkXtizZDlqVH|U)%AZYQ^Ag9AL?J?{%4P7E z9BT27+}rQ6MI6pF0+olRsF+xedEZQGZzjNcX6AaRTLuu|D+^~Uh*}CfDopa)PYlh5 z@k$QF%6-F0N=`0()Y=;mDL|mFZ8aIu&Mks^ip*$^iB2}UZb*8#`J|UUKM1jvClXDv zvIG`c9xD4FDJ$8bOsTBEpfv6k&<2M^mwk8-;FK`#m8w7F*qmt@Uy(<;l#F-|~E>b!l1uDmf(vN?nr2Jy}E56VC2#k@L>ITMQ+2VP&$p z!{^cy`yZ5HfJX21WM($M!DhcWzuX5X4t+4oG|T|O zXAql;G%Sze=T^GtsMzgH={)|94Yqk+>@9lUX?IZ9+=W)nVKb)ys5>kMwf2k-&97y@ zbZVu@mv=V`xwIN`>6tc*YcR|0(O0k^Iofo#B*DSKqjjs=*yY8VuATQJn{SS5j0wuM zYG;Z!8DBl20C%3Aq8^@xXxL)KCXvvuqe1&fy)-+2IXZu!e_DatI;ne%-7h))W4A_S zBPp=C+Sq(-omAX0BaCt)R$sYD=-V>S+Sid^)S3$qO{^SN{byty9UV5t9o#T+%K)5n z!P>}b@!X8tGpZS>ljxX zC~z&L$>}(7vfOe^SH!KJH!QMF_uz~UH=7278IJJ82z&xJu61`Y?dgeZO zDJ%3&C=^y9dAVWa!`myDT?IqiE3|4C8yOE;>X$OHVcf>1agtu@R?XL_@>nr<-#Z<1 z1*cV+F7wSw3;AC6l-Y@M7i3teEW>J1e~=W}vOJpTh`3U%IH~SW>w8#Dxx}QCcl_zL z+6E!jY-E0Yx+uKwE55S-;_0}^H=MWtgs4Zmos2Hwps4xnmW{*nanwWjhh%#-;qOGI z-UL&>@@8vGqH|lMYP3rtaO)4a3FUrlBZ^7{ALf<>nI(rM7HthLI ze7=xL8ty!L^|rwSdl)DvGX`Io6=lvzA!p>7X$RHWjAY45(^Iczha^tBBSsPN!{&so znX*NvZ}Zq_xIqv>>8e=ki7=4V{w6Xw-w1es)EQKJcInX8)@HNY`1M;6pflY%(Wo1r z5i}fWLd0A(E!Q%9o>_QlZ6;x5Rhmri|5zBz*d0dHV`(pLWCCcpwFl~l+iIN1!O=@* zl3&;Jdp5{v^^v6$%VwU_hg3@)4>~0h`A8+?A5&6O`*a$e(9+mHrfmQrL{s;St|Q=K zk&;YJAnA;$4It)7PDugbhjfsNN>mz~^SjvC*y^X(2%J^jTFXg=NzMyApcbkZjov7~ zj{_h-{1A@w(KbI`%HpgzEfM#q*qr&+9>0K%g|nn1y1YT{e6yR(oJe#7MJt8 zA=UEl%~DcQop%*&eZOW`1%FZ;GhNmfF2&YEv3$9H4%#;_jF4t9<|;{eh6Q4yEij%z`W%O)XO;{0Q4x!>4$zI zdD?`i;mLPSiT65mvUtn?&e&gLuGd@tu+Kb9dg*LQ@|)joR-6W_M&f0D+n}`GQ1T zWq?HRFmzxG$g!%2Jc9eV0g37)D?^MR97$T+>BH@@)pdg<&rA2J+@5c}-86T}m~w+2 z|5TAS@SXpr+_2oGDB36yEks8J-Ok&YpP1|ZvJ~aK`U)Az^w1iWaQKZpb2nO_G^1^L z=f|DP7_0(7ctMV&eXW4R$I1$p>yxu-&N7vkm%n>xrj|R>=XYJO;9YG&)4^qi16b#} zVl>5b1JSa~u!fxh#nG|+x6b(wn*}MYM$Iqn9bu7~cW`ijSV#B3Qof6fPBq92`$KBJ zKG%C~wuc$^_VyaQ7#x~+x6W0-0QacM2*h>Na+~lZC;fM961xmp zK`aKXKb{OCE5IcN$Y*!wO1CBJYOLqO9RSSZiO0p7IXfQ++!@jN^{}v&0w`0Jj1`_Z zf_8z+H3$j~q~i1k)9>B)+^=y%E3-WE%xDLv%{iE!BAl5vj&Jc_v_x+D`s)RLkE^aI zC4iA=M0l~h;5wXs{NSvejTua7b&Fy)Qy96xRx;-h$!ysEd&LuG4QZxqHMkKzs|Aa- zBy;E0-H}!2>k2{jF2kqKpJzHE{^UuSrA|Ht42`Hf)Ybd@Lk{cazSv(BDv)RW@#GgV z;wvkIdA+l5SH?CJxze><)L7jXwqRRsz7OsmT)yz`4YeWEbF577UJ?A}~KnXXc7j3IUC*UJ@5-jH8{X#wxfv zis%C%k_!YF$bEiF5@psIMcX`CbAv~VxZdkuwnMTdz4Y3ZIF5%i9Vs786Vga#4#rm= zPDr*Ifumpk09;;+q{HoTmiyI+_DyDtbXP)hqCoivU+^%je6~UqNkSxSX|PX-OZ4Tm zOHrNG^!Dz?$eT(`tMXOdas7?x4Qq9-{Ac^ zL^jXBNfnfDTQ_A~4KtzNwLsJpI-SOJFfv83}IABMUR9E?ieSw6X0ZiKssk?mHeN8Iz)$x5sb9*q4 zd>uv`{&+hKP$mr%D7LS}RnyTm0;E*;skiS>PafOY*nuCS&kv3O*@5~E?LA&NNkC04 z|6$a4rqf2+)UE-ws#{^IXc&>b))BY zbeDgZJqJkqkpb;xor@MAJd$Vf){&V_=5lAQ`$nf%)YB`Y$>jdRB4ZeaMIS7MF?0y* z|DSS`h~m`V5PGu`70uO$FVZ_Rh0c8o&)i!&B=(|aIL=R7^OSYx4wwQ00(p~xwQUbh zRe$J57KTRwW?S8p{^E@#*;Rs}{xextvL+>BBnQZH{4R{IsQvHuu~rSo$JZMi?yWgX zM)rXA`g|dc@T*zbeZvn3w=TVY!*fmn0bLosNkX^nYv;4scZaum8i#umn=YGW$gEMP zlhyF`wC@{}FScuDAs_Clt!*{~9j_fq->(0~SVwg944FvR#bCW(#Pjn7XN%CTG2+sa z3*~&K3%L-S5!V8T;DsF$K+t4g%{ZRKv8$PRPxw3@Nudr z!LgOnKL3dY*K{nUmGbBdpu^gmFUwf2n5=VzZ`So&3JY!M91!)~G?vQesN8_5>9+@$(cV4K5f7cY%?>ni^XVFMxXYn7aEWA}y&$eY_NRLV7{ZrmbpW~_XJzJ-7>d& zdAnZ3UNWc0%{Fr3GM`8WN z{kvAjUUjK0Y;A3WBSU(w4`%@>4K1h58LZREN`-W5NNGHk3hZg?Wq$swrV&m!_BHp4 z$F5=8&M&uTmD1$~M2H7R@uX4wc%7pebR+=f=f$Mc@J+EVt-yOBJB{$_DlUCbVppm{ zpQ^tQe$SrqM&^H=DW=tNHzsOwvZ^o&Dl%qW=?zsjXZkjXP!a|fdt0oL7h5HxV5Dni zdpAd2vp)_`*!qg812r!tGi9250kXuzG{#NhgQ^L<=eoW@t7ZSG1Dz)#S2agKE)P`w$ele{vpG3dTEQ?Uc z%M@B^f%Xsdr|PhX8KF2p1eC&vfP$eLsAzs&JI|U4%A62WQNbQ-aMTth#?S3=9bG%i z7k4XN?XA31rco98;R^*^F)Fuk{w(oX4- z-KfLWg64}>@hd8fj#h7}FT4b~duHYRxQ$Uq^Nq`X1P(T5&?F`L2Xd>~uRi)fw@=d& zP&mv70I=~i-!u!*CZ0FqqE>{%>Xs979Naivw)`(_SSuYxd9m8KNbD>(7*0wm5PE%n zkUDT>!K%=`sasIy6?c&=9jRSBZ#q}+Y?dIy`sP1Mpnmue42WmehpZ_Mon+-}nk3_T zn=+z!gF;<81q4IIS9|bTycL}8Z0ehbMAp|A;Nu$80FABTO*l1`Vlih6`6p)2gZeiz z2SBMqH9a2_EH(MHI_h;Jgxfp-v6P?)4J!asPt%yDbW3l=0`6~P%r$gNNJlixNADDW?%Lwc zxR7S_kKXr4V>7N|vzPp{zxY=?%{iB*-GAx|Kf8@_yW@!D#`e3oc@HlFJZa3dZoPG+ zOOO7nwA7!9Fc}pN*M(ZE96-ZaKV6^AjpuP@c;db1aX4Lq&MX9^aG0YRfu?5D zHADB0*T*5m5N;jIPu5=uua1|y0DUJ3t#auXq>8z5xRicuGhS`&*??BAoXEJ=kj`qi zuWA*TQi*gwh8p`1>)g`g$%L=E+Iic)IoC%}Qev$Se-16rSkPY#+@7oQdiQX3P>ha! zL9uZkx=Ww=nusVpQ66y#cjsy@7BOddKM{0l@YHuowMfDnKn2_A(t!YwIKAc0!8+cK z9{@$>P#HLSMf*e5ER0yl()2hn#FvUle$Cmdjm@|b^E%|%>+aJuXYmLTuYnhipRuvW zgt;zFZfx3ZEAH2OIYS=(wDoRJv`FVJ(FRHPaUX%6oRcPM>%afWv!FfMJ?Oqf8&l-fJ#Xo`97FvO{4UGe|8{kvfGN4zc#1Pl&BFO) zil8KMR0v=J)=$JDJg^lhJmG~id6B3axGy49&j7$j+H~4%xKQ=H*St%ODy}~wW>`Kpt6)qH)~Kva_Ph zC?V^6F1O!5zxTi1@B2RQb6)3l*7NzGAx~WKl7@jHQ-FZPt{!i@{lW5eSqa~U_g=Cm zkp~e;eE0dtgF`}iWcSC4(V>ZI58%cZ(#pN*25%u)w;RvD9n_qqZ zNzwZsA4ts_U(kMcM}`0OUV*N|d*%vWdxMe}9(>D|b85$PTU%S7(%CR`pNFy<+LN#A z8HI9x=rzlqHaG2iXfCmt?E1fw>E*K&EcV>%sm zx80q(Jd*}VQ>9~D2lI_SA5~ijw!=g~LZ^*O`|*SS6(Qf)_|(oh?)=eGdFc;FKA9RM zzHUIuKTiaFzu$)|Dwa2Nu9?(!AM&|2j@*ebrV$6O>g~?~-n#zlbie3TMuo*)7gA4p zWqrd2yP_W3nGD^q9kl8x75|)b>$>A~quCF#UpzpvIpUuaQr`Nt%1PAVT51&LsCR{N zLup{8<+Iygvw)Wm-puF)DIrxx-S1NE@rW(h3gur z!0!p4(u+775f(GP27jL#uXKjrt#T}OY;vhqARw7b&X-;2*Xq8?KjQN>ecpl%EqH>b z{%WU5H|jMCaYI|kc5LwbcyV2OMTP%gXT*uP`_-D5xY5NrOP2dZ1{iga>HJiAv(bsRF#X?0zrL&yY;b(v3O)xnpW-0>0 zkA3TPsh)H#*Zry)9k6x~+|3P>@L3gE9=H!WjUnvDu%ih_LxKKV;U^wjkzG-Yyf0ac zZ{w>;Rz8XVD*>xN(*$S{kDMXRK1#5MA?S#d{k{HqbZv5#%I9tDoVoAG4YD zXZ>I>A_yq_?V8yZ$blgY7SA?YWZS>00Mlk8W~Z8Ve$`gl`_=s0>hAvc;fttfIx}15 zTl~}AzWWT#M}L(oAAP}{X>e}^avSMwBT9-qqc?>+-tO0jzqOPsZ1H_@*4oi2`d=hb!gNbS7;(+xM9HHzVNdK5x z=>2%V_Jt2gvgO21)w|-78q`n0NFQ5#VDg#&>F^ZyGw0%BnN`9^imB=?APgx0;(DD> zvlhE~-0vfAM1c?>FkUOsC1S3GheixYw!vhBfzPnGv!rF9{nA0TS+PD?#@WO;fF%gn zTzQ!6KoRFaB}?AP;`7xL~%u}&3}7?r~StFrrDs{tl9|YQ?K7h zcgL@cvYICZ4&sg#2d}rcFS@)~`|`;AWI^8`rr>TqKd=5fusslGYpsK5K0Xy%kQJ9b zi8(cnQi+#OvRPzKq(g@E@;a0C|Iy=u;CqX1}rNXmv_8qmALwtfZG+ zkoZ?`V`Gtcr;e3UtI+Dc#j$JbWK4)ij5H_OEMVcU##`qvlqQ^vVa-PD0UgPVP_2qVFnoW58ZB^8?&Q-s6x$gg2e+$wSk;quxQzdHwT3+=1iTh@?+VXl` znm}o~#&2J4+Th8I5&viR2P{q>L}2_-#imWqz(MRuuD~S%BwB_xQ%`#=5ccQ4!^6IStuv z)8n;$9l$X%APn!w`{aLMvR&tEQAhi9jyF& zL9d|It7bGTxyt~~M;{|K>Hts#acCM5(3GoV!e_rSCQ4THRC%-0uJKp;vn*KBH0H6TIfX%gWQW2kCN2oA#r5A$2Vp&vL(y94j%&xK3|= zp^TUnzsH<8vg;D8#B?k>_CqH$og3zge^SWiwYXj~;X^`a^&vFfM0&Hz0`F&Ef6#_7 zw`&0GQ$c2YfGyS_xFYFnH^9lx~hj|YhCPw_d@(5KdtF8SF8SaDt$X)mAb$Yt-x z%+`C_uj$|rzp+mY_k^3mWlk47_Wg#5vu_Ze^DnY;zk00?(PY?-7E*!<6ZsH2SRw zFp94QDh}T>GC>vHf$@BU{mpndKrVH%YF+p`s5v=G zr#f~$GZo==|DgbM0mrXUI03sF-H>?CK=2EEtDaW>@iHGynajU&hH{4K9<|(@X2+vZ zNSm$`+}TZbl2m?=d+>AiJLPzlhiC}dYBzL-(3u#BWA7Fr;8CUFdjT{l)%|A&Ow>nC z;o_~pAqwBMOsl&QVUR`l&Lf_XA~Ejp_xkgqwPefHtP-7?=v|%RyP^erCejGwlFd}@ zrn@!;-C=_(39Q`aQ(fP_f60BdbHIhM;FRYYyV2V*atr$(A2EHM2%Qc>k>}Y-OI|N1 zVtG*Wl&IXXkZ2B_?f1)3YS9m4`vJD&_dEJ){B#pE5t~(f%RWl7J0$ei-|8QxA=T6> zYO~)utv&cYn;kUde+Jy>(NR2{U3ukI{^Ye?V!ds* zQRR?nJbc^xjSgN+QSTWlXOoSWm(k-&mF|D>r>qW1gYqwjvd;qI;lqchaN%?ta&r_1 zL(Vv37RBhHGfFaidFX&0)^<%Jq!Fp^$Ry@88w~_5FvDV`_m#yBsqv~qEs-b1GO)Jx z*V4?Gwt;ni_`1CCcCfkZiRsMbsF2%V>xK_uh+FFFg}OCEq-EqBEgTFBPQ<#Pm0ok% zXQ8FIw9-tCa}KE~F;|=$pb%v|9{vNoQiUv1-$Jkd^j%yzD`O?DibB`1g*c z?=3aLm5&^MKw~-Qj0;yY%)v3}KS1XSHs-qp++c&TSpqDA`UCPHImBC!lg!m-tJpla z`>_v8#ptdHc`dmiu3>e5{R=ZtP1X;Bk^%>isC@WhPA%^5zATDn;k|UrDWt1#1svms z14hRIP{A%oOU4>jCSZbk=-cDQ!OhLL4Uur=NvDG+44gm+A*Y5$(r^dx;W(1h8m9t-Y%N)uI@a!pfgb!O5MQC(U_Q50n!Vb#C;SqW}#n zDG$ej^Vj6^Jcda8MLMb72eT-+UQUKs!-a(6Ca@R~0n3v%&Xg{FenaBXcLrlXJ%5wx znyn6M|9#BZ>tWFU0B{dFvfo5Ul0MKo$F$VpE^bWiJ8fEOSRL+dL_1EDgY$?TQWce6 z)ioUwf6-1#^AdI9`76-g2j<64*oSrt{tam*+jbh=nw`Kh$sm z4%QPFTixBdQPObU!z`-vW@SbxEe*DO{47!(uq6NxC!hT^mpqJVk_)A4lE4e7q5Py~ zwo1kI^E&SFydv%-f5*Krr_5=p8XO%hF$mw#x6wg)zn8eS@`WY~Kwb19y=yjlC|C+6 zZG&TOqaQyQ_I>{HYgoOKxz7rw>6lkAP*GEly8qsvpb-yzD-3@zsMt-(tSfi^7Njyb zfQ-1YQuwjb5D24nfVsvNV92!fCgqua=8rj8S7f(l^IvJf7aW=vI>%gm@x62wvi{+QEldAOahf$tbk0ii!?&^$<;)D9R z3Xp!rk^%w(Y1dS+oU7?iASNhTSxc5bmE}m_yiQbMQ^$1~8fvDc9hJr2)6sBGArnd`ZkV))PD;2ykfXUPH<@sF$4W4 zMCXA;SqA}hk502i6kGsG24advwpHsCskzyvr_+D1IIX1%7?O}jBLUpr(@+9|S^v60 zU7*NpY&rw?uoO0!D^-~@{hAkT*UJSQmnzVTBv3d1qeIm2LHT)`C}z=@IUAM@ETZ9L zP%8_9Qi@B`ADFp^lWt*(#;drh3H{gmHma>6cBZwcB zB4+6%*n&^U0sImdt*`Cf)AsBj8m=vz+AJ9V)$XSD_Kg2`+s!zm z>}pF6j|!=O7|VDtgJ?}693(! z$&z4!(s#=<`r?($af^4oXZ9tSbv(Y%+Mg8N|DiDkFylo1jQ%z6ZOh|pXGE;F{+wOu zX|U~pjJMzlywA^^oR$`izDzfCPW6P9ilONDrb+#2X^?$&}xsDFQR;*7P7{6?00M@L< ztI~^^*w#iDCD*C1$EFcME4;X{FnaqRs|iU^_K|MQiMFG@DHH&ZTAwk2fdU{F30iro z4y}fU##6AN*kfSn=cL5kqXW_|DPjL|p)(`M_r&HI*^A{i{UJR)MEi$_QV%S#fx@y3 z!VeW5t}~^hN7Kgyal3ePb+U)xjK8bq4DSnni@ohPQCS+@ntdV;ahc{R>+6n(FKM3h zUunl#$JhQmR3;-Mqk20yJw4ruOZohPB^;dayu5SV+>u1!699(^7QX<;2L^QfQhQ&+`giKNW1ekB~BoI{A$WS06AyLxSCOg!^#z7AOCnqPnfWWZ_#ai)eE2W<4FtV+Dv7TV9ry96PTEJ z^de=^&sR}?zy%*aPqh`>$6c?0xr*wA;65@I1*Sl;civ}#q0C72zQQD>f6@j6N$hp<&>|PQ)qe~dNBvqWM z26G!1l*-vlK_b53dG^o=h;IF*4GkvSs<8?|?3h5GCq+ampLO1Fp7y7i<@v~j zQcqtH=`UUY7geaqzfqm_bqk6l6ui^HQi;!} zXfeQa6PMv%?T&V&NZq`t)SLF{^6Of1bE-g)@hCia5Gg=M#u9I1TO}IRk=_y4=+G%S*QK8KDcB74 zyCj9Wx3{-%jO@yD>inD;DBZ_?BdpNdEOvp-SWJdsP6`^RO1ovPhk8Q0Fu%4|u!Vm< zu=F^g0$&iRqe7$B)^~HpGFRq<8^w^@0E_+V<-4~@72gogo;@QXCRY5jKC$}>n`Y`N zD=VL>n!`9bJIC}=@dXt?+Ca`%HOe5jkqtxgP!~?m!~VLnFr)C`>!`*;M|b!$p$Dp} z@2Fk_oLJ4SyAU)>APD-kSo((

tgFg`d&+B*=`S6%tZX?dPKC z&W3ji>gf$T&J3}kMk0D48Gy-U_IvQ-#$iuZYZ7FgrFD z0A;*;Ug!xv9?Y2uRV)ShXPFT)Yv^l4J)ozf%DV{=;Auv{nxaYiPBwQ5N?i9~E)(ql z`Vzo&{P~NT^*BKeOJvMv$EDcY%;qzb0LZZ1BjfICOj@o?tzV#Jm3X$%H2NJyKrlxp zMR{n<$VuW7mG13!(8Yz~kZkMVUsLQN2%a$-v*_m6!8_%w9qFvTzCTw8pM{Y=wY`mY`!teoB~au3JxHEd z3e=VoWQOC8qdhc%;pkzmnb&xwM6C*7IQ95rjkpv<>O#7Y>%OZBc;z zOd;n3(Q2@!<7!X;7V4Qe$Be*SGdZ9Y98(cL1kPOTK95QWjjdMnh(&DME%1nV;B$x= zFIGJU0d=$}BX)Y6|DrF+UA}SSEF60XYAic&DI!KMLl1Le$XWl9{D}h{Kyo_Oba`}2 Z=%3!;YM-sA4gMtoq@tv$Sgc_F{C@x+IWzzO literal 13767 zcmX|IcOaYJ*Vk%wsL@4BjkZ?RXlqr~td@vbJ3&f~+OL7*$aay2hK2#4s{E3MhBknP=G2+< zbQI)sZ%hsi4L1!ySy9hBZ54N+=9Yf?(K=}o>!r~G59JN{ct%M{=?b@^5;r%q=fEk& zJHNPJXM`vM`4ezy)0Txb^A4Prx=ICjma`ktsDX@2~l37pT8~Dk9kz5XY!B6oq1 zmczUp#2q_24Wbi1Be!y7^5Q}w*Ho#W0~vP&XM7vrWR`#KG(|Pig5d_Xz8~P!G5N_o zHm9B!$G=D$)v)!Mm|NxPZoWo?sZ-gdEQCVtV&c|!`XI0RlCJ`%S|GcgAKl~a>9~@% z($7-NY*d+`opJLw8O^-U2TYam5o#$;YyD-UPI0@e^R?5bEp|Y^OJMNxUHU$4fC_Lw zDrXTec8?;?QqO?92j`^TxO?N0b)3+o6Z}X8jfIzR@1CMa-+d-5VGR0@5QSdZ=R;5} zLx3lJ#a0^;IimGvN2v;Dx|hZ}YJ5o+hD@c?H|ArBNnGHJDIqC=?JyWi?HP&&b4Gp% zXVb)Rx71&w1C`xPoA)`Hs-WA87J$3cWrGw21*I7GZP&s~2w`dY*E^zAnGU=JzEzRq ztj2a_HijCW;QQfzEsyQ(LX$%dW9FlMWHL0kOb?A&(7i;FDudDsk)j^kyS)M>+n0|< zB-GIXs-U?^?gx?d)cLu#OE^(I!^`2ip2rHi;Jdtw>~J%<`?s8S0f%c8g}@;3I^VmShDl7{x4st75RoxC@__xy9KhvKPKuOfs%*b$ z_+ZUlI_r+U#cn0+$2`DS6Mg$XX|Bu1?o;#nf61H)EJr(UHJawdlBo`9e_Ar-G+NnE zZ2KNhlrlnJhjYe@-#(3{rO2`x_-g!!Vo9u5O0Trwo!}V>TcYZ3sS@ts*U zv~e>JEPvO+AZQ3rOw5lRijXGaTe*mo34CVC9Ka9&2KpMINk+e^!vdKSW155)*K-)J z11)wBYyeuol$-AyslhRe%BX<^7ViV@BY8qmbO2QR)_uUUJ7uy|gMT~u0&6E{qr-CI z&0n_Q-vF2ZPadAeQVWXvrlxyq=L>#wXE^iGj!SQajLIu8bqr7Ur6j4H$OE%BS@Kw5 z50ob+;zu=Ap!)5yh?k#CACwhCG`znElDclMai;nlMWRqKTtjv#?!H@owS$QKk|V>L z&iv0iZDY;1K9;RDs~!`S>81X-;?Fx!vlrM^<$Q}jC{lM9+bLZ0nD?JgSrx`2J}t%c zH|Sk11VGh%wb8%+sZ&lcQ_V41MwPpaQ)}9QfW#`rGu70ZqIonnimK=BjojCX^xc(F zLa*^iy!aPKmV7YJVW))2bA$L+{2&~5H(%u6EHt#XZy5|#o^K00mmv2hY~hQhs6lYQ zD4JSo|4#QqAWVLFY0o~0i|Xf%0+&<7i0_WRLoN6(1cl4g(~9P&{u3IQh#HnFmx$zl zeFE`>%%-IB`b!GdUriv|(DO{*&cFBHbc$tuZuQ+VR;-~!DK)gIlRvfGX;k41rjs}I z3I2j!yU{)Gs8HZX<*&_!X;c0CKPFic__V3m`N3;R0bP)K^=d+Yhxho<(hAPD?ZVwn4ZOj z8me}_5EG8a*8Ls{6+cxv$?*1;P79v8%L4@}Otzp&acW=Vr~2t6`~Fl>XQSzV|5B4i zw}9xCmU9)jby6kFto(Hi*Xmw|pf12+?fF!zG=~)pmx4%#)qg^C^ zY0z9<+C`PM;+c3?Z)`YIl@%sd7dCX?v|I|Pjp~WHQCRQpY*qkq7cvf(MTAWGlq?34p zhHFgp*=KHFdO}XWXKVKZe}Sr*(C#{n44#L{NBpSCnc9a<&?K{e*7HA_I;J$5Q| zzKsWf7ubo8W(a8INmtpU?l*<+P4gRu%~1>iHmvnjOEiILVYOuaGK&_xwW7EzRfon; z`Z;p@4Q@-&3(H9yVV8ya6sjadHgY{mLwL`_S-ONjr2a!O8}RHurlmx+gi& zewoi!6Jt8bqL~bn9CCE<-@QYKqd$lWNUTckvPCM@>0%{`3BmJ3KRHXWE{E~)N+?RKQ4Kute47^#yp8z*8u^dVeeEqKFwuc=5xRa&jE;cjJfu*|=BnQg^f zHPFfT$+HemsH;Vz+!DCwm_;;9=nr~F{T*1b5ASw4WD_8-3fkW9IZ_)iJ#+M@9L>2VFO)<1A*04yN*zp(qaCm@n^7R^6c5)yGLTUkK{*U>2M# zdE;fSMwp>}YPkfP)HhHJgMP~K<_MfK`f9B0z@KJ)(7H9!%r_St02#|>l3Oa?`bsrI zu6T<4z7~)wOy=k^FTSLqp+D}c9`jA3WN<;aK*GgO4S`rD>^C2bEcP8dQFDD-jjMa% zwqsIxN-VEbS{CY?Gh6CqKejCEJ2flPxB-$fXQmkaMabkiEL%erQyQ(freg*?@YC)?UQ|C&!GNn|(P7jG2aV&J10r|jE zk+s2YVEy*Wrs)@F>RL13HE`j&w}|V}Ae7EJGd7F*RC9u}Z~lInQvO;kTe2TfeOza! zi|E3PwJT`2^XWL{fkHq!6Up_<0K%j(ApDV6Z zEcSW8lyd;1!J|ud1?Zle_j)so3ol@Yt|7F-S13P%@9@Ys82Iu$r-9)>H3OGHu{6{GihGXt%TtLJUKpCDuiqj- zWzYIk&+v~l2ipt*haLxh-4d7Yd@DNZSc%M4q?^=*k+f}$ql zncLg?X3JSzrl$5m5I48d6fhLw>rqNdZ)`-H)nn)?zw}j#x-Sl%HTAVr%wtuc#&yx6 z)=6)Uu)`2A&C}R^^Rkv?;@Yn0u>Fcb8)Abu#)H0bJC?(DVZBdHp4zH>7Xkx8iIdY! zv_+oNmJxX=c8e2YDd%B_WlmrCx$u94&8g+0_t7}HUTqf`arJ|(k#i(n(J~m~JQMM% zI9VpQq5ln6+@({2HO@2y>RnLOmD#|dO;8P}U&vM6C zay&~-1y-U7T`MQdC;^i^miwSGTR-nuN1rVdA+Xa}IHk8Y_B;$=#}dE8K(v=#k|2*G zL}Gj%FK!L*yL-%vTnX5k@_4cpxSw{6OVZr0;=$?)8oZO4fB(X<+-Ij`5LH{O;Wg1a zs-49w1(D?;PVY2_%kKYaHFI9s=^{a^R-9#d8Nd@#fdNFf82)0yM`p>@sRsbAe64Q0 zdJu$s%jJ!1v#1uH49bQ*M)4Y8-~Sz}>3=8q)|xQI;Oh%O8Z@+Rl_^}igsTBPlS-_< zNs6^6uw}D-0V<E-J)jFbW1PDAXf07!V9I;1 z{Q^S*?EFQ~iyb9jSDK=a%TTM5J)h}+hMrYiZijXH1UE3h!HEaA_|qx`74`ZgPdN+n z-r~YKnPziT=WQ2gvtPm_vBSZ;tM#a(8Xp>Ft}wrR88K@cn|F)4F_ftj2>=+!;l@19ic$`KtD>;8V5EG^!sRO(((Z zM|@*XrsCf|U3ny%t8>?<+o)*CZm}lYwcj^#x3cpF+1D!n_?SgOe9TBTHP>w;q@_@D zLW+h*wQIH!F%`QGd+0i$Q?-BAsuX9BFb{mK%&Z|vkEdmtHN%%9iVXv5qCL3Z@st@q z>3^I{r1?dOu*KU)v~rf|Vc9_s$g$zFIj?HREyZOBZ_ONLb@FS^n9*6Mql9903?om3 z2dyw44Rt}d%_f1dQJh+x?X831SM`DS<4H#{0&P+!pCYFBe6qoCO+FaBCO22w{mFz>?KuQbB}SOm}bTb+$B3| z-~i^pQ*b9>2w z5^V6?Pzmc#*K!)~B>+R+D_9{ZeeZA6DehAZ#H1#-582AuYk&NWQ@Dko{UzIcfr_(b z7rC!L<~CcYLon~)xDejO5qo7111Y*bHWFQA-zcFz3)l8-O-w2$TF**n`6p$B3LNBTx=UVF;zmKh2cH~JpN zI0+wsW2IUlSH>LPLHpEfdlDts z`7~5*M+XE;LxKK%g?@>~5$s^ssc&Gc``_{yY2-v-t8}IAr`mQjrppssax?a`4@4Dm z-_>e#0$rGw&DtGCso=bHiX2hh$?%?2s#d9FAaRKh-2o`}JSg-0$^-Z41}8 z^?QkZ(b-_o7~EiW%zj}2jcd#jcWCd&c>xxWIhST4&i&wgT(7QWJ03qY9;F_zGWFDb zTH^Rl;|C1Du@Tge10=~0-Tc-1t9rJol*#1YRwbSB7yRo0=h86*ZHaDmZ%vBF(bN53 z5*^%{_L02hJ-|I^sGo}OUa)j#@iOVNO@<+WF`&I=qEE(S55)9#KHbhO4E3P@%OF^9 zxh!~Tqs{&pDu8AAb`4fks@=SCDwh(VQtaSq9_F1>N-NJ+5kVeP{(OER{b(u9d}_ih50AFRKoyg`<@S#>r^R zM)N5r@Hd_bx0V`Mv@EKq&4n-}VTM_dCp$w|pjoeEpDpg(bP=<8!0VA8!)2JwAoU&H z!CS)2(>556Ssb8UqQ$X8Yap(ZS-;L@H3j*VVISgbK?Q%F7qluTCxvT(9+8M)Y7^V1 zjAwD6baDvmvbA9s%ZIX-I#bb+zm|&jNB#6Dl@JeMY_*2Z_h-nX^1B}o46hKR%}r2> z8IT>0kx<`_pPHsH4KO!0T=hnKi0EZWYj*?&#hEMRMkiddSAmR4f}!pa&$;p)5V$gM zGlvF4W6yTq>$1@n&y2B;x%Ity-*copH~Sjby;1!5TL+_l&^%-V12TW@4CH+eRf4d* z5~+Xnkp$ioXhS#%>v$fsnf}yH%sI)4uzH5u3*A5SNsY?Vj+~;&S1d!)Z?o&|>qHc! zdkOi|EG~YU1P^CRO)jm=+JkP?)#V`ZtLt*3mE&1%QUL{j;W*Uh3-*LK)5OLmUQ z)%JTTct^obgagXu$XLTCT$gtt<7)dhyQe4(ec)!(Eweu_0FIyUke_2d=&G?Qu*m(+ z4bNQIniTRU4yJ^M$tpOsB;z~*wmTvSJG+a=U#w^`T)suR0nluyBeI(zOwYFa)9|>z zbun_%{9a;X*;uuMf19NBVNWOLhg?p#ct!=CmDBe~VKVB~$2;6jlt+ctn0!}5gR91m zcM@j)#WM4w@-pGThXm)z@~MVPOR*k4+cHkY@n6JyVci6->c=SjbVd$Ta{yD?3j#+G z@aFOu?MKg61O<=pTNc@5GZcz@y6@iWNEELj%7Yspo(?b_LP+j*YT(IB6;8OfZuOc6 zPL&x(H_Wb1q^@l(tZ<1hN7;iAyL%-b?O6W}+fpfdOu%7*hK*mTaW{kswG2Povx>~# z7G;HUV_VB_#c3!P(_7|`1&`J-Ca_tV!9opgIX)q&S?FR89zL8Ik+0W0)Ks$&^OigC zOOhh=$g#|<7RFDa%pFiVs2(n)oR6*0z_}G@E z(CWwq@oAk$y|iJ9s|*y)`N6A}e8f^ZX_^JnEc%;C z)Nyc@mGPp7QrZRVsNBoup7u%Wd9mv?`c8ynU^u7oKmx)QUNT_`Ui&UTa=LmZlwc&p z>~vi$HR5lAmF)5@TCDT(ob2oH@rG~0$m5YCr~Gexc|FT*BJN_01K3oCy<*{dG+DkWTQ2LQ&nOD7&9)F02_eg0< zC6Ls0@l5TN`O#kT1o6uB`+SQxfLP;uuE!s#jOK5un|b3Uk9U~{4TB2EKYUCv@CZw3M#C2Go>Ru*69 z!@G@@6mEIMnf(^dG(bHlncb2ckRmI+cSiI+jyU?QE7|$i_N70F3C6E4E}BD?%x?Kk*M$Ab=;;u07~idU){@8K)a8I5v{x0V4IrsW;o zs0-TEq`Lj=yZ#evaH>e+4e2JT7&g*45t~(NwLI=ULQ3^N_lc6hs9IRDeKA)XCwnco z7L7Vf3*<~_BVj-c7*#6dx8+hgxd)w^elPU6iKw>jTnGVkI5fsXDlA^dO>Bh^7_lU!Pf~7gYZB8x;l-1{_zrFf%TS> z$L+4{({F&P6FZ|toVPi&<6!;w=JpYI((gNLdN;eyD$uW~h75b|RB0y;RxC!m#s5W_ zD!=Kby!D0#^dE5Tc#COV?`Ek$JYQ^mwJjd*YbaYfo%3{_OBI&Sa&o za#>Vh1fAr}6v0EuO(V=^)nxyXII3n6vMg|?6iay2+`yvns(MtYp-WvWcIfgz%Pbd6 zZw*wzk`Pc5V(ye%}9RSTIr6 z!WvKL9y!(3_6^RMlDVe-x5!cy1v(kOaDCrDO)=%qDZp7j@&C42)|LMlVGRRP-?VW8F=#yifQC% z^!+!*GMc)*Z&RLeH*Z=19VU!s?_w^!9?9i>?=erV4oa}thQ2B*wS z?H7X&E#K}+#TR$bUA3+ju#mop)dH)O8dd+Q$1i@MN94vzeN1TS|9Qu`iDUBFJOh`# zZkX&IAU|}Bx0k8wmWySArTo>f_^)7u{?FhP;lZ8Gk^V}9W@>+A&(SO{f9%NodOf=B z|0gxLdUVIS@*}u>#;xqFh$L38T+ySw>aUGds+=%+U9NgSh73K7Aqwi=$Im-jU(=b3 zNRhSKgG$C1fDszRDX$$fRM7$67UJ9^bB2+p$6i`>!mT12c=M}+93rP2KF!4;*{nM1 z@U)qDC+Wd%Uhs1CWY-}{M2^hS;QWjBh=<|BkM}M#G{-yGZhWPACw*?A05<6F$ms>I z(>GA)+XL-%=(B7JjQ534HT3I5eaLE`p4~u9vt2x@zuJL$a}e3))B`SY-?sqoJnh5>S7!x_>mWG*V=rlj%$`y>u8MW&swkw6~;RH<5 zy3>+mI^8G_feeP&W5iRS_2>-+`?F7%4|*q4vLt-~+79Yj2pSea5t31c*w}iSG9%Z( zs+dJfMg!09q}ZbV`!tMPpyKF0+lziLQv!|+;yly-1~jzfT#$HjjMaGO)T*$woPX=v zo)1t?@aF|rvL6Wuyt&4llao}NDN)JHC3*E*rh&X$fAFlS=%7-Ta3HM9xR>%89F5`K z8k?_=BCyyA2Oh?p5+Wg1So@P#{=N*0s7kn3=l=ru(0=}U%jrMAdJ8-@9allJKR_y# zHX}>B*~`!9^YBNQ7dTIwa6(O?DF^M-Sf+_Q&Eu8LVkhk-H4{D^o9l7!`e+Ni$HZq8 zwIm$z$%QX%u=DKt>zp%8IY{WDC+l%;r)=vW)s!^^)if%i{}$3%(2mQxxs z8=<`=t5O2-%b-4rTkito8Lc9I`N}`oWRlHz~y>2}nQ_vW?=4h=&Uyz%q##=b+ zT<;j2dYw>=gu046vQJ=P$6nz%(3Ho9{o$?cDNaq(fHwn!y(@2i*V>OdmfQE5WM8Re z6ECc>G1GFh&J*{sP!sdoAxWb7JeSuRcHD&5P=>{rJI0z%ZRm~;AIIOm(`~;84c>_S z5O&4$pvUrR?@DF3tX>zk$BOB`JuVuq*Ww%MIF$|jrC<+f+*LE|JJ+AqKe9;a6le>z zu|DSb3UWKk@f4ti7#WaCC94ZoCYHhtNI^ZH~ z$W^~0=krVOy-7ErTnhzJxd6MM)`5|b<@!um$t>jsblD@4p^(rhgFyfeVnxEfWvDs0ty)h?BhRAKT zJ%{fz#~qW#zuuQ*Q6THxx-3M0eeaCC4405XTY~+zji zn=f^(vkQFgRJ`#}yZcp&hfKve|8j@9CkG`a4yiY$nLj+H6ubyX^2OY*{_9ORgJcFb zb@6@qInNBE@4x12@W)9XDkk_>W)-xB`A5(QZ-Du!pF6mAnK=s#-gYypbOk$FnH_7g zDQlo9$+yXx#JJOhJ;EtqJKeqoNJ-OYp$6=P-lcRx-|d;Pp>(MQ)@6L({v{T5=!|eZc)%;>`d|MU1Er z-&3PM2$6!rP`3jDu#Y`wEp23UttaQNv{)9DYs-t16&&W-IEE+5j9mMKoRECr-`2=y zd(p}OM%(Kixe)>F&cro1s>k7ti8I;YP7W_GyPXn5lVHP+HezwBbT3m9@2p-NWNB(Z z4%3IS+haqBKM_5vCURRe5J-M)xYQeTNIcBNAKd4nT-_MXp{J57VCi{WQEopHI%wS_ zRJGmQ$9f;*TILkHxVcZROlcVDu;?gQ{qx!r#C}18pi<$n5U1-9i=&h^ph3tCNLUyG70hp@J2qBdyb*o~6Py7i*&I*e$zM$8 z)25soCz>#>)sf(pJuyeu7^yJH%pb2hZiB~&X`Owb&nrll+9_L)~>O|L$Z-+kL# zjzElD^dERi)K*!sCPWw3B-VNir$B3t@f8<+ed}W~Z$7)MG0O-WNvJ__$1}d$DR(rf zs_C}Re>Mf@DCag-q6H!~H`3Wuog98RZNkE|4ih-7r_0NFy1Sf>$ z%^}YC>KhFF_vbV+V$KR!@;!y_#_u=Z3YFSV5c*){l+c5pV3`czGT5s~;ujF5mrH^S zgUV%3uRJC1c^vg`x|(#im$douX-!GTrQ@(_muZSqA6TqfC6VIy)a)Kwr8tN-ju-## zcN__ow;e?G*^U%@RV{Bz{Y^S8zdu^X=ef`T1Z@Qa!R{NV;*n#hP(xF4LK(41b_TYM zZE;>%JXfia%PC2pe+IP?{W=+J^}Ff*rID!e73U%`V-bUOMAzay8wnL_hs1Pe7UjdD zPL?w=bW*tSxq1oV-je(FybR0Zzbvud&E&)&>)sjZIMdNnWdljA5%Gv; zu7ah<(C@ms{Fpbp1AorpK=flBgcm!L1)S6-fRy~?UaoN_z;?eXo{lMs@YSs8|<&Oo?hzSeUT|^A>ws11g4RS z{9vUmra3NY=Km~}^>Ib9VHnYYRiKgbOE zi}Q-XWf{Wv{U0L=^nzJ;Zn@ld!gTO{*tuv zj~|szYkDDcX0HC4l8B<&eb1+?B2J9rMdKm&sQrgS@>83A8`4)dQKt($x59Ot1PT$- zqGDv>vakkeJlt8i~p-p>tEXV{HWEGW86PUPcb2VYinM| zKRec=t+;1ZxYom?5+J>iE`k$`^gPaac}-4+9|X?5?(7MTPMilZ-tM9_@^aODlSS#e zlNPI?XPVtEk3mPByk$59zZOn|vix0S#E)_R;Q_d<8l+wsbWfF)Nij+zWw4Y&g-^9LY z6^vom&A$Asurc%ll1+a)wDeoMpz~pxiSuV6y|Ftxg{jc(#U-=G1GCskzxs~lAgcfn zak+P6lX9`oCQ}EZ+#79jel{=vbAU%y*$*GAL*tyIE60PMq>>DF7AXH(S=r~7y{(&$ zXJfD{*!aeZ+~m^*+LyBKcQ>Y=*G%i0D9OC}+pZzW5$jlgBsqKZINdu-ugIi!embgA1-)MHsC2{CiHI-)kJ4auec zW&g2RzhEs+x4v#xmf4}Z$^$bRjN;EI!0vtX&*wdIl2HW>~bbM?F$b0!`5b?K{6GwWLhY59Eekf6( zaaL?@b&=O}|1k5bOnYx#l&1#(>&$AB)PHb<&d)R%E}+m4`o?k8OZSL!F<$@AljJ6x zTrXHMkB;}2f3;9>uX`=!+N4w-_E1yK%|mG42ja4x^)<1%Y@|`;csySo_j@Wvj7l!K zvg8N=TM|I{MET0#9NV;0gEpotnb2}D={WZ{yRMX-rH10~{YgJ?y;LyhR*`qM3bdyy z0A#~%<4vOF*dG(cHi+aL_THgVhIoFh!jC@I${cQgsW(KI$NTz?qM56iYeU)X&raCH zf}CyX7H# zJGI|ls`-_bQq|48DSqOGZAp+1hPO`T)sSOOpR%>qsWekBAM}jiK`XBkNSm)x2xL zzji-7A#sg*<7R7M4A-a(AM380RMQqya}K6*6rx;ms=z;TQRt~na0wBqj8^)mamVpX zx3lr=#elh_e{3k_aYU_TpVn^Wx7Oi!F{%+|_$-3m&GB<4k(8eU{?ASh*u;tbV{_csPE-RQ6A7uuORO{L-=^{z9xgUv06ST*F%&xZWe~=A~CqLcwB(v~}Tb_!y<&EC#LZ6|B z|I-_i5Q&{FrjX1;;6rNvJOdaV)s<1$Xnf?cpdiD4Y&`8NhIO|LK3cS7)*7J?{$(d* zi8cv!(ZFH1@(+pj-%2TMA6l?aQW$V^^Ki4AG-@`uuZh-8=*Ls&bV)hR|BNw5IoF;* znYD)K^nb?Abh(bmD*BmgPicw7RG;1TKMAbUL6P)3c>I_`<0}j;5oe-;MzOPnhCxq+ z6vN~p zzples&iF61oDY~Y0dzmxccP-Ig55gvA?42Ip(tz0rP~2N72F+}cGYvc5iV3jwBdxi z8%N+zya2c+ck6sPFGlW^FqG?EJRvvI`tlVKGHlJmDQgP3SU7ftI{r%5*zC8R2VT4@ zL>sfjEm7WG4k{dRw;L!L+K9`gct8ihBrYJSD7Q$7o6kM>TuM=11JFyK@b7+94$S7j z1*~=}j|w3ltKcV#sXb*-=Qm_f(5l@}Opr9%lnR_HXNL|3l> z&Z&Z~$MjOO`%$6LgiyoNSI}^g#|6%Iq@I-H#=CmY*5^OExVW%a?UYH< z-7EJxDW2;9ba@W>ivua6XdZ3Vq&*m(4O1=*A=;$y`UBBI0N{UQ_O5Q%<`NP9qLPpb z3gtd&#}N6VqZW{Yp!yN$>?p#d?zNX?p$FO(OLyX)7YBH$yn<3~#)l0bd%g9^sziVA z;SEDo8S-!lEIt4Lv&#WgvC^yU!&Z~S<5@M?9|^aP&`wF>#^_|YTvR(BHJ9gqsGNLL zfW3bhc;#qh;iEVN?G2DOf67e}GTS>kvGlM1@1p}SMi7t(OyOP}=P6yM4(8ELD(ujD zTj^c$_2cn7A_jFG-Xv)IHD~$4JBm~x$D`KwK-n-BqUcf_OZj91!;{W!3kDe0Y@eo% zR(@7lnCHB_v|6eoGIsfhY%H><2gv62H$>OFjJ}~LaDSQf*xnc{$!JOo>Wd*JWis)Y z3fR8SndX&c&x@hv#lk5v=c=hcS;mq!(5$%e zI}{BXSExR^81D3`>httu9Rl|bzD;=MW&FESYKw7`TSM`k@-l?J}ie8H!lXa z6SSSD8VBIuM}mv}gvyV>FWEv+8#e`QA(TQMhoI*Ye7PwKAHCO9>r~JY(V zi>IZ1qs?FA8h&{|I{6hwVTJDYk@RW)oyFFKPmsblUU! z4%Y+$>;rJhfv>Go1f1)D`||qpl}hMTLgw8*p2L9A?AXFYmMW@G OG=S%t$|Xv#g8mN=wg21z From 4065cb9987c035d60ca18a502a5d262504fb4305 Mon Sep 17 00:00:00 2001 From: Michael Han <107991372+shimmyshimmer@users.noreply.github.com> Date: Sun, 17 May 2026 22:19:06 -0700 Subject: [PATCH 19/62] Add files via upload --- images/documentation green button.png | Bin 11757 -> 20917 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/images/documentation green button.png b/images/documentation green button.png index 0deccd386dfa3b1d918dfa93e351d735b15eb743..ac988e5a103ea8cbba6c9b69c07bf316d66a209c 100644 GIT binary patch literal 20917 zcmX_I1yodB*B(SfT0%OM?v@ToK^mk>Nfg$WU zTku~7QWY%{PU&xW0vee#|wdl+3)MEkkNZK+%z8~<4PIpy8jQr5B3qKd3|G@T3Mc{TlD@zXWF?d{z7f)J3 z-f)0$yNv4W^~Fc^4~Sr&yhaeA%3iqt*-hFb1tE)kPnVr$*5uAdk&qGfK)(uM4dG8x zPiq|bsIh@h;9l7P#mSTOY%Q}{8YB>6S|+eU2Sf%Edj2*@7Uyw^R7x`lzfVG?7>smd zN=by6Mp01s8`CeUWRy1W-QRa)2jWR;qkqiG*5XA5mS7;JMFUIt{DwiEpaO~rr!uX< zGA(BI)D5FAbJniH!w7@hTXxzP`SFme*SszO?{6om7fC$pFZr(LZ%X4 zDB&`?vbwGcC>ligd>Ivt?jI2zKJi3XZ}DpMuQ2f}a5gI{X$Ci52@2}&Ri6ZOf@ncW zKk26@?%lu0`~l?$6wWg~aewlb4HW3ZPpaCXcp9j+g4(;UrvUl~A`q_1n_#q(Re5k`&hw|MIow>F@l=M={W= z%9JkFJ8jv+^%6=wH*=T!xIuRGVd`gH2vjJDi&7t^G@i6Mfvyo{n75Cpt7vFx%l z{nMP4>%=?h#9tm1i_r9oetNBi?<4g`KS7E`(_?KzP$xnhb8mU>ds9`_Z2U#jy1(kD zQWawqkF(Cn$yv>qh(x^tGXqV$>`DozCpbe;RJUOPMIb3RzUqltiIJ7v@>+PLFl1Y3 zCw`#!n?b!3lJKMkDBxw+HGj6&!vooB;ns*JaXMb$uVRwR!&KY ztyg?y0pU~yZ_h0RM+JNN!&CzE&Z4^h_`X84ZkG6#*COHK-?MmAtdEb6H^X9_KuMHT z`*>X`QO^mE9*-Ug8bnf_Tgdv(*%R6RS2Vp~>crmLx+mzr7twyCW^1*+dm26q+R`Cj zrU9{mzCG|riUWK1>7n{PZcX3j^tg2u`_>Q~1o>`;jMudr+qEsOAo<8BS-XW`5Hax* zuZRd{AR2+Ve8kG&yGNHIDe^rvHGFcC+tkcMJ!c&Yl#bWcfQU`I`XsGzz5yZW`Hzs8 zJ5wS*N-0z;gs8t~5D$1-S81-+to=d=qYWfg?(6p)hvV@GM<7~+Z5wC9TbsRk(sUK^x{(oDKpQ3zF*(_{-pI2_2n=bN1yjrayO~>@V;id0YEL>zA8@ zZROn8xHvr4euc;5;{{e!n96Jr@sT!EMxp0e=h07}J$HEh$Sv1Wt6|;j448?rv2w8% zDl>lggVKM}`@Uq`^GnVATWXQlP@Oyoi!n@H`Yy2e8zw-D71~D;kiNd<(a{mTPSx|G zf9J%e-b)i^8lf4-<`&Z&x}3Z^6d@grcFUHW9)6 z=9Rvy{>!e07q9855dmcq0432efwt#bWMVpG-jBcO`2O#(%F@!b!x;)wjrB`YxV6t; z)2=_N-aLX<0bNs{vaB}ctJkkZ*y;XhtI^(KJ+sX(gmfYqalIa85=A1_NACOvc^8`x zr+(#S(CFx@e+=azy}j8`)kR5j%zjsv^X4b7DNP@@wM9H6@}pK-=+9p43VSJKU0kx` z@Rw*wg7x+F)yZEI^Q%yS-t~Gfz{_BWzm<7Z)hVPyGCw@wmEZ11+4GJF|JFmkZ6GOT zOp>h*gX(}lpZWs!NQfE2?bEj{4PA$SI9N zG6x5TPWQLstN_!55j`T>>qiQ6uX}MooZjOs|Fo78)&B+EoLMN-fTTXwq97<``!`SD zf4kqm(w5*1HpL>N?v#JajRa7N@$9ewatOpTk|f-}`kY;WM?zvn{YN;vu;z705G5@j zW7Ln48G#Mq_zEkOOaBBm+SQ_znUEdZfPZaULO<;iG6~8rtZ@YKfao_Y7disbUh~hb zeYgL2aFO_o41d632&ZO%>;W8sML8a%Tv({kFfKBN3;F&XhY0dlu=MobV`Ho2vn5bK za{AhItD9{K&qmuOq#t!lHP`;*@ZVJ-+nm&~GCX5hElhioihgS9x^AH6(+^+j0R+^Q6BT`0(u0faV|2Rs6A1*b(DA1c*FLiIQz5tb=H;l#GwagI@{EkgQ zQPnm0@3qG?+ESe1m@{>p%9j{fAJi9EKrQE0kkniDu$N4`iB7K`jhgZ}UM*jdiiv4q z;u9vwjXumpxP#`=X{_$hg5no#%*&HhvLzjohWwd>WdAbIG_7-`Efkl|s8&weNp3o@ z2rygc%cR!t6IK}=sWP$*9sh~fsNI^!iby)x5hVRp3JXvT)8Dn3LKx|BT}P+{=UNM2 z|FJnY_vg>o!or;spT-s3VzaftCmT*TRX1|#Hsv752_D4Q#N<@*3H4uMQ5gbJX{?gF z5i9#lQ`Y)rMAr6>!X-d@Fw5pzz_0v6QP?VV96N*Diuskae&!O6&+`iB3lV0YziMA{ z<+N4}Qu^!rumdYkPtk4o@{svKC4fg5R^Ia`*h9)jdW?bYjYTCC--iZ58Q99BAmwL2DM^jM0Aivob zuZg!8^Y)^xd6~5-G&fiBKeY=(eN?-*^IaS#*yEA?!dHRtzii?TL~X(Z!PbbB4JGdHZoS8gi`yv}XhO8(^Lf1XXUkKA)5P0>7}%Q$BDzU9DQO+B?3h^lXsZ);W-|3+iV z>=SA$S+=ysusGUShNT^6d`&zn9`8lOnK6C$0lB3A$dVj=LomGKOq)8iY2X=cN!^BV z1?mF9#^Yh(kj|Jq79wjx7P-u@DK`ZCH@jAl+*CkB|o?&hMr)Zlsv+l5^fg zzZrKC5+*^|Ub940qLcdP`y#(Po6>}L9j7RTB>_ncyI&`~P>GiMPmaYHp76-OsDtOC zm?;wAv{i9@*V1QNA(%dF9A>P*Vu7VcrzD45cJUYKg!JAFt~(2`08U-0VM)f^Zx04f z#ScevaH!}2{j~^e{U}q~KE+3!>OsW=cuX58M_jiM^gpg;c=Ri}HtO?xp3c5O+VS7p z-=W6A#TBv<|3~Q=j*Dr265#-v!K15B);obNm$-+{S(`HO{}c1JDNkxO`bN|eysjs{ zixrH{d&BcoxqYd9?&e=O%FWD22QUa~^3di&6N)`-kxWYi*Zc_Q@8gtr)DnHG5V#ie zWvtKR2 zk&m&mU z_caYw5-?*RN%aAtU*Ijn9WNvu9LkGDh>Y)rjVH(xC+duRxa;pU7M)EHKa?88ACLk2 zA`L=(ZaC}@m6sMo?>ejs)GMETo+@0KIiW;F8fT4;jFfV9b!}PTBORXhe4?l3ru65^ zZe`;plg9!}rAYdvvu7Db3U4beja=OG^Iwl{_^X%OwLAcBi08Lpp=um9{R_T=blJ+3 zbN%{$l?$+Hw!7MgI1v?fT^gd8Ex0V7H>dYqr4MgVGtaZg1B=j@obKi2c8PWo8bC|J zlr1eSwQ7tbSMFMFuaQYbeLL8;B=J5AxkT}kM%CfcDNfa2LRo+7dsH?e0&w}ypLNZ; z?;U}QC|=-mN^Z*|5X9R`NHL9%XkQK3F8jIDa+}!tJj?*r=yo8InTe%B|J|B~Xn-ud zYw>LL0lYIExdbC68GzKvtlIN&_-uM}H|Db>u3Q!_rAn#|eWEpN1lAG_!C2?NfH0(z#AMh)YRrsZdj9)EdG^RiF#QLQ zel6EV;j2HPu{3Nmh%<+r!j6e?_3O8_GH%C{M9y#sR=B9ns;dI(qj@PcTiEDAZQNTo z-5_B&G+{RzX(8e4wOY(_ig(=;j|-IUJ^y1vu&zoQ>4p}nV3L& zpFE;b+U_TIJ@YVMWh4xMtUFJ|F)8Q3s015t(Vu!=lw0wo!l z_h=lXIkP0j|1k8xn9zz7h(<#KQK}~EEMLp__7yRqlYghEi1`e2y9cQau*BZ7u$TQN z9kbZmyodby3$1UCX(o&Nq?#D6|8#kv+DD=7weMis>xr~INJo1Uo$VQJO|={c7453* zFV#|j?G_`ZGQpu_jTZ!$X|(d`f#QK^S(+oZNFw-v5=vz@ro8DIv|Kw{|CYspUb|IwH8(tX8n3uI%@1G*F>IxXo|q%j0`ssp@;O$EmGFUb{3; zhKQWif)+98;TD3{O8W;Pf6| zHGBCQ71Lwn^K?OpFgbkeCB1jB%NBFaFlD(Cs$-%gq@Zvk@H6w6VgPLFi!4okyAnp*?#7AAgHA1z)H)Lr6Ny9y zSx^KzYw;t9LFze_Hf46=Pq$z+Jb9wW;zr_hX=?fnQdv(SF98h}^s0VHuxVu9SRxV; zWqVYqYzu{$k~Uq2M32nBRN`QltJeU)mxyJ zhn07&=>-4(fB|jnuZ+Psri1%e9y!bms__6?Vr%6iR1&$X$hs3r;-aX9x}rVlvaK~4 z$?%!I9^u)atw$4dgS7*eU-q!P^1%GT;5=-cUb6kx5)cI7i5NqK>3 zdKVpljJ1*p6D+e?z=XXyfHYFvVBLpDL^u)D#E$CM8}olC)*_!O)R1O@xoEuW!k!T8=@V@9$4eE& zUe$SBz&jIuZ(ya3mR_QpUUaed%epSY7 z!aC4kJ=gFOd{>RK;0Ev5WLfwq==y|CDSfQPFxQ^5IPbkhY4!U&)B@cL#>x6Zp7)70 z&u%6=#Wge%&WVd)B_mzf{R zS>o*?F2~|kRV=K*Gv7z4=j43ZPS%`PKTpI^y`y+`=<7>D^AAjc(@iA3T>j7xW?Y2A zVFX}4va>y_DKSLFAPHCR0=oM}i{g&;#3E7Yys($I#GiQVu8=cJwZqMrM1nsH!lxVn z=exLc>sr;6&rkfO2}M?R{>AFI3a<-t@1uUhvo~`G36GxEb+rOpk4SL&9s*UZ^D6(<7&; z|J+LYz8l~G!+fnxBnk0k@SHX4;hVic^JhN*UyFT2e!0u_0%j8~)08m!AmDS&41k>n zA6a?%BpP9RTTz!Q{jc;Dz54e(6ng;%(U_c7(1y|$v4h~on~jodUZ`*I&cV=h*iXE; z#ZbemIRThTlNRc=$RZMKp&I3S2<3|Ec+ZaH@V>ZS>mt%FDEIzyAakCI$CbOm#Wvhl zUm&ZPf+XMB!|^Dc--@+cDFq?8b7zVpid@h?CWp>=UvT1Zaru6GvRoL*NnLz=r@fD8 zq@&ZnA_hmb>5}l;&5%<;Q$l>38?)bC1b+j9+~ml>Nb7CT&Vi5Lndq&?@)``{^&+QR zewrLMzZf9W++gK4BQfNUh|FPh%+0J{{_|~5%-n%6ia0x&Qwwh=Dp*t%Hj{=g{N!Y|%7aP34HhX9jd9e6bgs(D{c&=(uWqg6 zrrdt4XMVKi<7~AR@AbLYlk~=m6K(g#B=kEVWKk}THDN%K`CeLDc6)+*y&T<6+7*R4 zTsxdgI~Vdg^@5^FqeY@I{~Y1c3ElfAK#O`ZJNWO)tUw2=!E>d-W#^+sCd-2B%8%;Y)b+vR^E;n%B`Z|O6LA_0v{i*XvJ~MFP z=Xmu6N|_vJZcr$Sq0db$G*juxpRWvD4p2m_m1t3)8JVnso83LTvCVe)ym{wL%gvFS zGx(BY)_QBJL?8IWbj}o_{^8km<_cC%ROYzn4%FA&v8`~le{17T+i7&QB?{rHN!|-g zu2T)q9U?&gIXEbf?%_%wgh>I5O$8-Vxs5JV9R#&LoIjlLO!k^@z;6UBgg@OM54p82 zL#ETKV;J#-#>Q)Uu}W!HdYsN3@#9(ezJ6z|gH3k_UCdSWT`s1`-FaQIH#i@J_f34F z8oj^tV$!MccwQuOcHsTHNw9?zd3DG^?bh}6P_%rnEwmnMb6B?kLy8KjTjL!+?Ud%h zI$$?aZqq}4>T!w!lxPetc|AnUeb_Y{E7KA(5WuOIaAfzL4Q$`mPUhyw@jcp38N@4( ztBVi}vPO|F^%Sh5a6ROlcK+=hf^zREomSDrugAfjr{O87g2%p!8Jzkz#f0gxyBJqO z=dcHEk$cl*Xl8hJtxXJtfgEKGa!HxB%J`iapRZs_ujIWzbs^FGJ6d0YuOECrFJuL; zJYj61miUuF$cc_i+q_r%YyrsY$4X4FYme{yCYIx#06RALdPg>7Z3e}W;VgD z#_I(RI`*+WxeOB=t3xQybGzg;RwBpNZqL1{yhaS1w-*Q4I%&>4H_jXgalgJ{%d1@u zckw4FWaK4n5WcO`Af)}?cXPQL!pmX18sR5;Q7K_KQ-Y1h2gt!5h#iOP3|;_uH$}0x zB>-_H&mt1oz^y-98yy(>p7<7wK}mRX)MnmQ3G!wwr}rJ0>|ch8w2t;ue2>za* z940HetFXaeFi26WhCkPb-ljT!3fAYnP8+{l@z8OSHllo}Q+P}?lsi+uwIX<(lcDbN zO9oh2>biGW$zC2m+OB!T(>lTnk5)(HMj{j#;!L zm!StM6CV+6nNjFyC|=#f#yMZwEHY2$mY}9K!M+@7 zF3#Ar;Q@=RJvw2#o<2Y|KOtb7>EC^a!$2as33ChZA;tp%Qhkmb19(zAvbh1~l_40a z_r8C)$a~9LCON$X=lDdnQah9ka z&*S?Ibc!=f-3#jiE{Yc?_~+=zVSZj%HZ+va^)`0~ZPq}3)1}{D(Jt)OM$Af+UCSHD zUSMeI;`9pzc->1NQwUJ~$*mgJyAO(WUF0$!wh;Cr;kE6qh%c%ZXNM5p4i0ElTO$BP z;4tNHadCc}d2*Hqd3w0HmtkzZDHcwm1r*rehiD2>|JNhUs}uDMVb#>{@z{bUtDH&s zJ>_*b1HQ27%;Vp;S;@|xwIx%x)!S4b1(W*#wH}oUcNJ36U*Oy0KDBE$>&)K%A^uJwc-P9mg*-J%s(WX(>b>R_zBJ4ev*{V7?_tEcio?O#2FO@-wQ{u=+>-Oj~pClN%}9vlE2e7y2n^4gy#5lcK?pgBF~G`l>N&S1C{j{X z?0Bge*B;5M7j1y$*2&g-A5}{y-*o^c-t$Q)6ZF_cNB3E=d@5mWjXni(y znv0zEKe|ALv!Gld?c`6t2RG8A5@Y((b(G`5*d>3Aqnd zs+ulrscC2$Fn&~9O-+*P3%IpWfNuk3)y&=1hZHw?SoB*^v1+VLELy)b4Ku~5y1Vwi zeZ+i!dbXfqtOWP(Uou%>T_x{B!Jvbov>Xgw_G};-(m_o0F4|a9;MflB0g(2UcWumD zH}eU>svf&mn>Msg=}YG*`He8Mqrqhai~03)ZxXXW)R!GDGx|Bg4Q}A)xOC0ob0-l5 zv@vJ#H3zeyDQ^l%AQ$^{ADV7=EhKJaB%DqQR)R8>d@(WX8pN!W2UA-KOItV~qxY4Y ztkO3%zg2RA%0D+FVVjiyFw893p3lR5A4d;ApVzE~tIy}Ws|{wiyQj1dD zJtMdVot*kX&Tdfv-_ql=`?+A%s6xVX`-^21Zeza(trZk-wLq3)fYoHFORH49TT3Nb z4Mm8yG+Tovb9d4;FTlTcdcB}Gnyb;O!NIBlgZ%NrW^gzaZAtqKPdnf|##nmJ?-^Fl zXI8=6WT-smaPQL1fF-ws^!ZVm`dOl@HOkgjpfC}9k+0N2QYuoq| z(OWBx*|lH-wI_kF(lncdZw^VW1)cdg0s^jS|K8;^wm(eUa8N+Nq=U!Se90``TGHC? zR&LjFR-$+IMT&yx^FG9*XDEr+yg}25Bl}2h=w^G%Npu}ca~p{ppo-(=|>QA^J#SL;aY7 z7WaYhhhK3IX@4{>xVs24eRK7D^TrfgUWFQ#SiSoO+AWHY)W zNmiC*yFDKgO0;s$+;3976}NoZF{TRDkFE*NN*eK6G~~QUE`g1 zF2>{OPsaBnbA{vTs=mRNjQQ6784hm5nXN)PhwcTtik(3|cLD``ZpvI3!l`63A9plQ zy&tZxR!fUN>_K1`O_qnzObz}1>J>u6t1x_p_9R|ICS~`%xt!%zxpBd%?e0Bv*hvpm zHzp?Q!0Ed=P_CM95c5R4ituszIud*fak%;I{`sw)#7(h5CI0Ft~v#>3F-yX-uh6&3)0MCb3D zaVDo7r;=RetuU;cnUfS1ZtP%XkRAlocjL!3-IOehJ(R!m7Ky0!tS(Ht9j2GK>3s@0 z0AKd4xk8$T6=4Sw(QvHx8R{RA-eCtyQ6?7hBR6ino7dJwDN)Vgn zirW)?dgZ|2Igbxnt)_PDi|@DT<2Y}V%FlU5XGrH>w@0m>8WFb~F9>66KIAqwzU4ZV z>`!-tnOYwohN)+IEp~73#W})9MDB78i7~RT^cAX)uB=4v2rsG|wnV2UdfjqYppBYX zndFsf!8Jj2t5`%rqxr3JGX`F7N=no^M@51$cd+bJdF$jU3wC%4ScdFUKSml?2p)=$v$Q zb@kR&(b4Ih?eRA|DF8TCA^bnjbiiB7VXOULG(&^l?uEwmAloyvM4c=whU7eUx*<64ch2*tE!u%`%$Bon8Y> z6#IHO7Ep1`X1BlndW4i6{?dhFx#jYhM8c|E=A|?^_KgAg&XW4Y`7zhrepdUZb(i1nGZI8i-$0?vPJggOp#t{2Y015g04+u$!uuyam)U&KK&xfdT!Z{2+B* zO`RlU&Zbs#+D7J78#*>#jCb$L&dw&qU2xDsJl6W`{ztzjf3+16Q;M>(8zEszwa*P} zW|Lwv_Xy|xdT8sG_fE`1cKS*QgyN7v@1Ug+TUg*lzNrhXx;^*>?WV=|l$0PB!v~;faD7(daB~L~M|VXu0N?+SMG*iC+PJ^~6S96(-D13u!W>SUHuNZP%nN&7HJ*2- zi8Rp57woh({PNNzfypZnZWBrw1F3ghH)+woW?auDDfpsOQe1wOj;8~7RO|}MTOAzv zjLO8Fs;7Lq?U>>*>#=!E7&a6X6u|->g z?X8Nx9b^9GD5ml>1 zJK?Y~&u!Z9lU7ARQBAy!!Jmh%K1@hy^i?t*HqEmwD0V;=^<#VO@WrMA?JRX0nH%_p z!E$z26H++Ffs;~rqmXUv_UmQ+L5e-CD_{D=KIGDgi*Q$*z*w0iQI+zhaz^WQFv`*O zOv|bZUlX7hU$Ub+S1cK0cl@66)pF6nT%Xlhl(|8Dn?${0vV4Gw+i1ZG26-)$@yEL5 zEby7;i<5Yur$=0ba=l;6w9%o8r^y-T~OE zxy8SDw9e{+d}%?WSb3VR^du2_KQ5vhqlchCYleK?oO`I!RChlzFu*1h=xVd@N{7)| z^`md8@70~%`sOAjt#pbwo-H81e{bebAI9JaGZro>=%QU(k05yblYv+##B+bfYNLKv|p@61}@kh1*ztC|!-6N%mkx13HpoXS-7``hecQ zNr9NuSdM%$XG85$y%pAhVl1mB;bn7wUtd=ZOi&1aHG33~#Re^m)fH=H$dr>`O*L$P zpz-C(IggkvtJex;Jo<*$X5b9^!3+RaJ`^Y$%+zf36E#+zE?tOHDqHtNt?ZqN?m=39 zrnZ??QJ>ZBMgFcOKoxpfTtB%&8bRI64wJMT$HU2pYil}MATN=x``!@m?)>@e zk=ksNM-g-+)O)~`lSgleVDBSCo*YRbrhwJ3c&^l;_tM8EWPhChIFUSH%t0|jwrm=~ zCzbGDfsV(P2hs+=u{Zy~Sw{ae&czn8@4B==!RP$cs`ZxG|9Kg1{xEmdh>a*gPf$|=KFFTAJTGN@$NWx-mnHw80=*ra{}HRH)c`XTAa{01z*``MAxS0bVI>2^lhyIH)i+o7fe5tMSC9Yv z*gD*p=?*@OXEwm|xjE%-g0e)C5Y7AkDRAKPIL5oRy!NWB5`}oau^K02U|_JVt?zmp z@F9Zq4l^p#z7fyFpG?I2DTZAmNvEL~qM&O-v*w!0FI5^0n}@E3gTsT?;FZ#u>Xnfp zUw$5>ZVX<%Qm+O66Vda91DvaO*2U$kuYxffe*gNZD?v6D!^ZP@KiBWp_U`OL+WTSR zndD>~XXuKQ!^R**JpPF|#6a`R$gx&N>_Hnn=*@cLzp*lrcN#!ph!9I2UhB z^j0xQKGM^w2|E4y_9_v|Zgx#7akDs65!hp6YoSabg}P@5eb0JK^)B*k!Cc_-V{G7ihEW>ypt@b~q5KK) zWKofq(Zmt%Pxmt~tI6a_bHrnzm=bpf6XA2w+tYBRjM^~;-dEjkSKic%w4CG65u)qvHCc+G4JO>mE`yRAeHv z@*QX-pEX=cMVF8P7`v}xYCfGA9Cz+xz03uG$Wh0=-;plO!?sw}yw3X@MbpN|lRLha z>@64f*2Ox%eWuyIh2@Yn3Ws5)d#w(*7+M+0urahR9(G@M53d9S&ZnDa294K3x;3Hq z>y;*|ht5024<{AQUBt!L&ec!?s84~ep%DM22Pt|bBt%)Qhf{R&Q+fKNl)h;E&| zk+a22|ELJm_kqa(Y!YD@#P>d0>A_#3%p96k;DPmo20$lxWc#kcJ*jB?{Pk9BPx++E z`-`W@;I6$xQ_$X=(F&UdSE2a_2BG^&G=mGR55M)uA3-e7=Ay36!lJo*W^H$CxUAaG zt9{$KpF_H1c|AFNPSdk#Wi8DO*~%3y8Tqa@x+Ef{C~BXKZv|t0rhz#_`}4Fbcc;ZT z@7lS;8GNDROD+pvJ3;T$Bh{sob=&$Y+RiPm!(Uqtrv(^D@$vDI*i`RKrWd<_&V69e zPX*gx<0(;Yw_c~x&%(X;uY}nys4qz1E^zYo(X|)9BvBz1LR2_`~3Ln(%zX zMZ_%!!o1={@fC?LZFa2>{`o;d(OwJAN1t1C$r;Xs%{p|E$a8!);x(6nauN~5?)J|` z)fXl@#kAAw`VGqF%eB1i(Y$D$uN~WD6_~IyHcI9Jl+*p|A1h92LN+|lM9$>>1ELm% zeSoUF`&r~sLk$#s$e!V4No{L0k1FT}Kd-w3z%Y?WJ~(>z&>o5~+iIBVwHM#)b&+M) z>YpThfLj_ZmPNVowo&YGDJ24LA&^7mn4Gx1k={WkxjtW=P6L~ zt9aWJ@9~uDXN1&C3KrkFN-u&=r-I`kBFI7m6+XD?&*+l9rM=DUA)V)$59vrNx9VOy z$LGV?JM!HLwhYKGvcDIb9@o8Xge|}^OawA~e{*DP<)U6BE%tf8x zw@x+ZW14h$R12F8n1(ePU4^L!mC$jzNy6i5ET%Y?kwEn9a61>Q&l;uH^ncFayo4s* z3iS4Y>Xv@L?~a+OY-iMOZuN&-5FfH?*~ZS>Z3)lk2}|!cCHuWz$UHj9-h{O* z8&l3?Hs=jPy^L+F3uH5_v{vDh4tqRS)7vMf2QfK8jO0WdSLwX=6OrAFo*sq9eEWgz zgvYl`Ms7pdCZ^dIhBuv=r z!ZQ2|xME)|O<~G&y7_puGN7uuUMR-Ny}(4!n)JG1W$W7s$?3kmd@_$*>W%Xn#!QZJ z;BiQJ_)X?a^;xFPc9y@SdGuWej%c`}DU~hWu7lO}Nvz0kD9UYMX)WUf}0i$VNDJZ^F zt6G}G*fn5Jz~SgjNt$tgu^ugQ>BH+LphV*Ad+0l8*tB?fA~%*6df@BVH(|b(v8gb+ zTJjT^Y)Gkbcb1nQ1QQ=S#>(Dr-X5-vT$=9W^LY-o#s_xp2tSW|1jMET!{>O*W#^6v zii}TsKQ0fHT+>G~5+&s4`@e(4G&W_4dqRFHdgB6R_@S+ymWLLva`@hv4hM!Esi=oe z(Q%ySjx4-ETQ2^sw;ri=j}jqy_cGj^-E;l$;VT*y&=U`EG4u&9oq5=wy2o)frI&+v zm;U+c9#@kvDSqFlmTx5JJ8s^-xnfJE++=1#4~A* z+q&a9APF$YzwVOF<(2Xr^}RPk6wy72*L3=lXC!)_ZdqXPn-OkZ2*xP10E(ZZyBR;V zuI9ku3_EwJ^anNu{I|zu0~QFY(9U;kdQ?0Q3d-If}T^>Yj}d)r*Wy}5d0)9TT7`37|7q;txH`d!^OSD zVz^3-TTkb)jF|p$jQq=#&wKV{w#6h-snAh<E@h%@-KyLU}B-d4lWbj;@Q?vh;h% z=d+iPXu!;O*vEU5g+JdoM$msK_{L)=8x(aZ&R$rlvQ0GlfPLHSz~y^=#@2b$|AIET z)%A#!2OQ&)ngYyUKr`u7onedZMThp5Yo9J40S_k!oclxi?%xdJIC6q=ybk;ikx-l+ zg)h3^2>(A4pjGOmW5Jh`4#nwW({pEq**NL$d^uUBG+dgWDnHHP_eHbw0E*C2eX4|A zZPzUR+{UnbUZA_gRGsNM!(WmfQ>#;vE8e#arHP0YrR+q`&T2LB+;;tFDN(*j#_@KXFxiX<4NAa&zJ9RK z7~Auf!3N{}*H<#_pl*s8&*nfn&x_qC+jNSz>@VLdigz7D^zEot{%28reGZxBgP$hA zg*e2!{;^1#j!xS0uf{+8`hZC>oD#8>Nfwct+lCoXx4A2j#CxL;D{(DYB=dqNi;1*0 z`bq@sakx##eXD2E0;Z$1E?3YeOVlfYDT+`CZqLmp!aNm33NJ!lJ+OjuM(V9x7!7mE zMMllNDScoqKNp>4AV+TktIi z*#ogxkJ%?>fGJa-7JL>KbrQ>^e}9q+jI}qbPL{pW_r?=hhfj`fWwcd9Z)L40v=nh$ z#(fP@!Uy|3JKKE*BQN=kU+7PksEnSSEr$lKE>X?=(=* zw)LgSyXJ_u-?QFE3(pJw7?Jf?ui1|W4t7&_5|tX@!>Ci*_g$(|`JllH_`yh_&A+=g1jpd2~RsWv+CD6;=~|7g1fq?jT5PWXB5qvyIjsX`B&vmRzu$)4SOxLq)- z(cQ9a=0JT|K0j59HeTA2tEyIevb2|A7+*ZcmB0E6!QU=!rtv3_2Fuk8py=3hFrwb# z&Ch&!D15p%@zS4mY9fPVoZ>(swE#oyByakn_D}9nsTH{R7S@ievpU2ZWF^7JQ1OyU z122{?qKk#`u+ zeKEx-G+(RP%kqlBN=*2Emg>@ZC%7(e>SuPisR#}<#PyMryk|V#_UrzTXvOE4^|2>N&g}n1-2k0M7 zdp8iWq+I!GXLkqGk>3&d8KsmT)J;6kM5L6yghGMyHrOnR#+{dB^Y7& z7zUli!|K%>=F{BX51mTx;Ay?gR>jvCkl;qqubyWmcOy@V?^TO5FuW@)c<`BTpX2^) zI;g}M#B#BSe0P2NCtfqi)P0_o44SVXAvVlCMo&X#{EM1`Eor}HSaxX z%PCYLQO>9EvlmKR5u7-E`UUe5X_#HulI_KU_fLBaa|m#MK_>^6X|qsnvSkY^cY`AA zi@Iy+emq@84d3Wb7-OVPZh{wjtI?R@7Xjy!<_EW>Q zWNGx6B{USpw|>noSH2G21!MhI^6E~&e))&1{%ng6ohuv?4xrApw)Rc}-`3nOxr;C8 zRhp8{YvmH&|5B|7w4vnd?wi8bc{13o87B0%topYn{e!m;dm(hk$uT2}uX+z|YG4cH z9w!>WI4Q>CKq%x6*f7hXtvxBC=GwAh*tMz;p(Zagh z=Na<-`N{|Jg4oxNdGGPx{Z5%uDf;y0x0ZDCUWr(ic*fQwQT->R>&o?!i&t?Xh%1XV z&+{@(=ndsMLWf-SZpa3e^z`;uSG&SpMoE@;5oVVy9r?Xh{@vq>Kt2X;-Zd_D8<%r4 zsu%uIO1$^-MZA4@S_Yla|92yWlCxVafirbz$F=cpYryxw@u7fTV<$m()iMO3Naf!> zwjDa6{)usG{BVzSrr0|yH<}s|2RCJ+P8(C(XOHv8z{K*v@bEbw#k8$k#K?gc{K;Z; zMvw||a+A!zYdJ7ZE@7-pXFgKs=FQ!0%gSzr?lOG2BF(R{pW*KcNnj$JZe##CNp#5W zGWW3R{f;*l)SQj<@9r^}-_wPru=|Fpqn$5&Y7v0jXsMuEc+r{vzf)$b2LI^a?g zkPYnv{|~{AfUk`q?9IzIN~JD&p*-2g5prOL+_ZL~dT>3e%lK+Kz8Upj4*v0f#JOqr z+19qMJ5V)064na(_J!6~sej^&^S^_Q{aLa1M7RG`c_p(mo@YvCds&FA7~ycCz!03A z+-Jb|?-fGdV}w}9K+A8oO{v>hp4$IedIqGGo{Iln09@ryS7f28H{nbkC&TQy5y7$t z{&7L|6Iu@)?KCv6zeD5LVgu6OV-`75ht%}72etqfgyqv9jZaL>q5Zp{rNXx4bf8E|zq-$ysr%3Ub6#`i zobU5}KF{|&bI$kk9t<_XMhEJBzXjqH%$*58*J!lX#hvEpsP~sQGPQP9ZKdt*|zw%j}+VMr8eL2Y6j4%#w&Z&BcuL)ts#=eoWQkrPsvOV zu6786fe^M3+vt9H?chHiE-VQ8n|tZzaQ;oP8w&W{5-D%BnWs7})2ZuB8IH2~X?I1sfJswbi3}Kp=Jq{8Tu{pO%|n znc!>2O?xdhKffkWG0sWjVCu6)j9>1&_5t!iG9Zqt3RUl4 zF57yhTGz%;_Mo97g!BB*T{BW(4Qee_(1Vn4qe&k{sq98YRz`yks`r|#iJV3MMuwL*1%p} zXyw)b6aiZ4G5h{_If0wiW&p1+%kjx2exsQqK_cG>5h?VK0B}Ia5#>0MR8)imTU%qX z;|rgvb#;|TK-j^M96_{l_lFt!p93&#BePWJaKTSi+pmt&ISPJyX6%TtOWU|}n`}&# z2REYJiv6u+y3mFA&xT-3!zJMe78P#V{+Ng~ZX^2T!7IXf1d@p}_);YBB(n!)$(6;W_k1vTFttvae zFke_XzALRe;~;(Ll#e5~zG#W574NmnW0c!ic&=G_3F5D5y?6;ttT+0GhwD3EJ?1LO z&2{H9`r{L_wrT6WMS|kulRgz&m*ZUI0s{k;jg7GeL4WF;>_rE);)PnP$LZa*ND{NI zOccV;9Uliq;edcXF*k0$S^a%|BZe6wnrbuO6DE!T!KwAgM@t#6dezK=)})S%LO7v) znri3vNzKTsXcIf=FJJojaaY5pOMTkeE11XHncp1wE^B*v zD0)0Mk+)QI8833uKyUX$*VWaXHQfPUI@1iO3_QzT}`>_sR{G|S8Jo)z5 zg5?qKf4F+@6Ju`^C@`X;zQ`o21rtctz_kx`@*Ws{)^x1F`$I++xZgfvbC;|;rJ1Vf z(mh35c$p|kK7xKw9TK>bj^zC2FA6}6TcWIlBmSZQt`J48jkNp+TIcz6`RF@AT??WJ z9iF>#C>6)nsY#ZfuvX!WHk@zRuE1wlZaOMTW}2H7JX=Dbt2p4234mQ7m6g`-;&3ditrLlV zig4G9)|1}&lXHxT6V%hlm^0a865tsPu*33_Psdx+fM4H$<2m~acqjn;mdLfx>WM-1 zyD_flThV$cmvT{@LCYf&Z{T{=H8ro1rmTNiaPuy#d-LY;y)Nrs;WN{pUU;}NkYdT! zCM;hgnp^zz^w&`Ea`i&FZC0?2E^G+ZY6Eu!nt776x3_nET%Ku!Xv(WvHeh9d^J5Wu z0%alD6%27t7;E7x9|vm>eRe5!mvf2PzXOEoogjHox+RqLW_f7`JjTPILw(UW!g%qZ z+iNxc)zvn$WjK{u$pJw@A%qAs-Tj#j(DFg_hvqGj{^FCA>R0a(xkia86G_5S`(7w; z&o9pbjhIFVU=YJ@fQ+PsqU}R(|trQ5@tA5KJ-nXP!(4S>AHb$#D^34_rO}g6F%_%*i1d<1?S2qPg z*(2?TXzAzAKZ&2IIIIp!HHH5AwNK3`R?|K%pMBSO!Vl;sm~yjLgcH<$M4w6m3|ApN zmDD6eamNh9RZ4L%T*W!_sBfBq^crHhd|IP^%#T-f!y&@w|G+JbDL>q*965H%ouO9F zN&k`EWCti-?oHvz88|U2QOx2~qO6(Bql4Cb>6f8GdylX;kkd%}LR{%(8Km%5{YMY( z!7{K;*F)xBxsv(Xr>OH-x}E^e(v_j8l)T4>llNOFq5`=%ds!F31VYn`f^Vlm^A74A_~hbpVs|rCWWc z;oWWei;%&gD9Z{|QT7!$u=7yjma>aak_L}8m{>S>Vdi_`RQ|XydoerPDXg@(+dtT9 zd3ORL8d(10(uv}V9Q6nzWcbUj&KgD})6k~Cdqd2H%l~I(wkq(dHu~YVpDUJRp&?MS zJmxxV8*gkOod(1fU9v1xozQUafeIlC#hrmp;qa$3$C~Bz4_piqB%6aNxS%EO0jA)c zKxrXG-`Mf4solhIe^1Yzp*;8+hWK9W&YcJ4^u5WG1@E@`uiI4&#SFNN@VD#+ITI%G zklQ;5sb9O;n|RQ+EB&@qi8CNqzPwtEYx@=WA1PgJFAy9{(L&!r=mQt#;TE0eBl>-j z5)u-eM&}khQxz^|mo#_nvPXu2|0KE#*P3`_7+QyfNUpl?0WZo??_Bq_fWR-FV5Uy%epS+Ti8Yzvu2hB;jJ1Yj3eWBaBncrF>h731%uzXXiU-cto z1j^EIS>%816D|QJ$dGQmnHkd_c!pKdD8{l1Mfv%aQd+Bs#lQ`S6#{lgknLk!LwUGk}CMS}2&a z2SpNqS!wo_q1w=c(cVHHEs2F$ak&9YIJNhYp{AxU4|`GV5idec+VdN@&VdH*@!o1l!%5Q`gtWr%n=5laK9Ct7E+bsrA4H9#>RRu8G!YcD+UlJ{w7Bn`wO3* zi~F_u`!^QxDRBz@Bi>vL&c&(Rri~wS?TLi9IfeZfoar_njH$oPe}CINb5%4f_RRW? z)`t5Yu2JS`4nGCBtT}zM2&BMw06R8s!zn~)%Uy^>K4M+D*Kd(E_MUA5cng4uA$aCe z)7%^2`(~z*8zHJrxA7nGC2B?hii7|o{D64J#;hfIePn>yo`-x38i`4&5iYC$5aRYfe4qf?7g}rS43ETCcL1u;d~#A$ zg($BN1r$;TC=hW;u&hO)66(9RwPQhi{-+L-CFOrXfulGtk%-;bu>yiLf!vQjudM$C k7xF?PpvwFz5u5lWTEg6S(r*Pf2sn(8gRS!(rZqA7zgrN{u>b%7 literal 11757 zcmX|HbzGHA)8=pp2|)?zP)a~rN*W|3BqRkyN~F8tfD+OvAkr<}4F`~rRyri5Q#u5` zz4dv&Km4hC?%j!C zvAD>m-rrs=50xQw`B2z(d~$C}Z$fr(n{8@_AtAiB#8cHVa=`Se+D!g&bf2_v%z`u_ zfe%)`-vU0V+3?-yyX}#<0^FZ2vvTbbNgJEHUrMfjdx%nBAvOw1E)<=$#u{6$ifvPz zrVoTv<@3=8cilgKKg@?K!h6-i=M^MOK%a)**+~CSa41e z$0;jbD@UJ1`$N7SQX$^ijWDPSgz+Fk5%OpmUXNPLW9SQf$B^VHT}!3QTHj! zLeiZL(7VdC1O^#y{o?Vwrji}LEgeJ8tVN6r5Q(((O!bUR5AY@~t5}=g`Jje&QFSrW80qRafHk4!fV=*k4Au|7MoWybVveDgcdvxG-O~2=9;aJ;c)$LV zbN^NuVI4_FJ-s{&hx#q+0c9QzxBS{c4Sge*i(AXGnS z(gBeuW$v2fY5A2Bny};;iPLC{>~kRdkiMvajJo0U@@n?v*pKLYG;SoL%180x9`l2= z0(~94oSUzg3S4|M(s0}%fn(Qa|SIOCgSE3S{mwLVX zpO6kX>og2!o4;Ds0&Q!69CyhSqoxdKd+bcJUZP%L`g!{0`5hAeJ#R5ZC2Db(uE&X? zloItK$j=al^Dwei3)tEyF6#AX+K~apx{s6b4zG$)uJPP3-YC`($pf=ZkEWgZDUao< z#Xg3ZLn}gS30t;Mh@p>wbCD35v_~@O%aw$Pr2F1I<9eRpbRVck;U$#>-=Eh%0)Ay`!#x=6 z#Mxf~eSMR(xEKB$j zg_HH)5Bp}S?@1!>sf(v6a?*M`{v}=T<}uvzR+kb7b|=9w2Rs!+hT*S-A%jV1ItO&} zBm^>CXh(&J6>+8izP}CkL3^3xbbo`$L%bE^Oq7%U-|0tR{FrW$BXBhDV;;GK=Mfvr z{uGG7uuSBSv9J}xo-GzYJ}idwha$qB9VlZx1^15-I{6PAu5?4V7X|b}VwMhJ{!u=F z5M}8w>ctB*)?Pd4)4CkVi@aF&>{?0e^#r3dMnx30^sgl6)FMh$g0Yce zc;fV(8x%-%dk*?tzv&$vmGYsJ`1e**Xp`@h{ z9Hy5`R&WoI{k$o54QS2Y7yEO{08ZuYbzeB{;6XKXegOsUp9Cv|L?v-s6q|lCBWR7R z{_dOpBk3u$qZvf+BLgN#Be4n#96a8txiD`5JE>fpXh64j^fnsVlPX2{MH-Bzf1elH zT7N-HhNqM&FD^z_$D8EmLNF}$3=ducU4iMQ;)0_Q(;$8Ne5yMeScpNi zVhb5fB1CV$87zVHU$D(fXtG(=j&YP+SqiyRg0`R1BiMw)L8ucenvgfrI4NQ18Ha-< zu^=f{$Wj4iPL7{XjZiO09RBUOU*X(mUhsa0LL@y_T|=wk5y`L$ z>NRJoF8Cz7f=J?{F=E5N@~tyDo{|ighLqm{N67DE zdW%eHiHoJYLUD%v|GWN{!15W>CHA@&H?l4ati(L9Cy+Q1l`(`}5&r&1_pEt2ZJjmU zR~R31tn&V>5xz@j2p@J%7O`q*!F2DDKd#T{Z`f7GdEsA`ab}(3V>p4QQFrcaoM^}& zXfakTpYVWTk*?V{pL9I|Y_hk=FIsx0#FIF~d7ik&zh}MXH|{L_qns_HH@itFH~LTZ z$jAAli<<(Z-jVO&gB6KxrdHB(VOJVaNaTrP8gt(!EGQq2E)StqecHS|TlCv57vMQmv!sKCj~X@$AwrJKv7Ad1r}M zo%ves*SE3s@p+!f=J=$8uzLn>f@1ELLY6|OzY18Gx!xh3`K=Vts4<=j)+?wvcfQJv zw0iyh>r|EgImztU;}IWU5Qh>q_4|&Zl`?X#LLE86>&XjVQ4TCM!#x~P1M*Qcv~X81 z$`dNAR+Yep*udT|*}xj(%Z5I4u^&~%%8Yhvf6#ayVfK3t=KUIMK)w_^QA@4gHoF&b z;H4B3*Ay-FHiliIH-QlK;?6>o$y?Qof)djH%nz0BuMfs*a-YRKsBOL686Mdc^`h-k z$o6-jmS7a~h+Y?1fPaY3@_+1YLI|m+_2wA+-6NQ;(Q%V$%D zaipgn7vJ<|bb3}Ya=nd8yJ_OXvHcZW?h_C145f?m;uSBqgq8*#M^gM?Aa0iDHFvn0 z^y7HqwTPrJr5Ro}Pyy;HtFm6kT27-Wt!xY}wKYr`(wz9oVZ3bhq1h z_I4HbRFXjT$Z{2|Dh|@{aUTt9Hs?rsbZ^==R>sjwFC92Pt1Gl%tla9RapYPLnW)`A-YFEB z%cl(YJB53!eo&Im+UdDJ{iKGf+4BuB6dV~9L8G9=zua66=heIX%&MXiB+{yn$>w(O z>{GC@)sY9E5q^=KOi^30!EF)?>8r=Omnm#1k}Uc2WoGg+9ohrdiTyy`T$+sFVSoJMH-Z7niYL&3l-Ew$A3Z1i#~%@) z92+Otv30I(O_%j0(0(4sO>GsO)rFQ3y2Oq zQ7xx3zF2b6IFR`aC0{pp>qIsbh}O@3k&GzEZV0STxq*j~(e=!*vN52LPc-%LV09wg z=!A@fbNMJYODL)ANn@k-u^G-Y15Z&~%yQtLX5CJty)u2gx{f6|yY>$BIZT1u1Fowv zub;~9(?c;PRW^>9^Zrtbj_`2xB+dta1}a>DGjg5bD+9hJBX`g8(Q1A|bSOCLPiK9C zSv4f)!iSTA=+UG;Pq&?^SndXVskbwOPQu%qm){?nREC>2?vbvG;2xfiU#+*AA2&Qa zs!ctpr(vx!R^+mhRT$MLMh1ghUOeyZ8!CJB74OwW4cgYQB#DL zK3AfSdARYo&hlhaZHkc3)$*i^WI@#9t)f|*mgFy|UClef!wn_0dT+2LfL$9lFN740 zp8`MlsA=D!M8NwIzwqfhAF(XRI{GH@&58OW4ZF-Ka`y*{Tf=g4-s(ED8B*MQ_*@eW z+$*%lhFs{~Wo=1sAC|NN`<~IBwGhp1Li@M>9Qu#B=@zkqQ_jI5U1pXVV@2QDh~B~A zQO?jGT;ndgMx9%Fl1f6pqi01Q?X^Y}sXvQy03n- z{|e=xXEJAID!74_WRjQQO};QWWJ7lhoH+ayHni5%!W5RjmeglsHn?vrW_~;V#UqQ< z4q)q**lW#@rw9K$Uq#nieVn$OBkHJXO*cmTPRDI=MOeg{dgROU{ITpYH7ew3$Gy)2 zGiR06w(if^&FO7c)?~XYqs7P9ycX&@>fXtJH0BYVe^G5V6!CmSU)#|`=FmF7==IMa z+Xdj$&D1p?PDD1x<>d{AnlQyhdaUs&u9g=}tS~$#eg|Gp{oYccBi1oql}SIEk&VpBImX`Hma1Nai{%+Ji4X zyGj;(4D}kF0X|BW<7$~u*Q0M>xVLTA_4k<0@eWN7Fo4+^;mbDyky|1IyaFp*Jdh;; zWrv&Ajb_BRVX2Pp-EX2{4{6JEWH(w2Na*If0d^MpM=$xcmQ{D6UmaC^wGoEX?KdNH zM$jI*EN5`43CC)VNbpI<2f!h^VGID1xsPwsZ?47+e18)Us2@LP3!mvEwc{M zr9%tW%O$~AJhkq&Lio1&-u=cFGhJc3*tmA{omwP6{}Fci{;d;eaF%a3B)jh+Yo|*X zGf_YjReZfV3nDhQL^5D20B-yK)9z@m-_T);M;ozD_1o;O?49D%#A+ibI07tFw~~`5 zsdST*OBOvgOz6(URWxD$Jh5|GjisxB=fdEd%R0+NbQcY6=f*DfXM%jl;T+-fndDNd0w$Zn2ZtCnX52*0t(+Es+a#uNUu8oBWn}t~(7f(iT1!O<3&En>- zL(Nxgz$R|}E){rs*$ChncLOO0u{eYQTBUSyY_uJfjL&xOI8rbkhKg8QxIR7H>M}X1 zwomi``qk$2P>@-+GJGM{hEV1lzt%GF$-OZe(ADH_wZU}_Yvj%wuN;3zHGA3Hdo4!8 z#>zu|u>Yy+TL!Afq;>Z3E6iHan~vvFO~pI29ZgDoiLF}<_f#%4rguz$y=vPCkI#VM zU1m0fH@-XX-apS--0*Q;Xy+wxQC2c^Hj1RGL%^O0$Gbc9v`#NSF;|=C>32ap4u`L+ z`t}N8%O$xn10|S$G%iih1^idK{XY#DlxJ6Z*QioCY^d)^TES9 z>S;R67gBJOQ=CNDYaR3qVa&OAsoKs&OU=$z#DM7U zpf%DDlO>U(67KabnjYL`-<>-cdG7Z+I>Nf>Wi`)MXh(a*?Iv&%xS#fzRly9s+>ZBi zoN4s~o->$~L(O85PFBnOTQvC2i#u$_VwBIsRccd;fJUYVMIO!legt{pnL1X z^SOw){7ngYt@QSfJGXR)wW*X;V%2VB46RGvPqX;cP2_akKUISj?{xKJO=ZJd~8Ai6MS5&^Tcm>}!m&UK1TwLvE0&~c$nNGK7zXFICL@t57 zkU3rH$jqe%U>FuvaK%sGY-Iw>w^!^;;LUxLskfHJCLJa&EZk%QuPv1%ZLmP7dx>f& zaLx};V}v*_@-}Z|{+2!n>w>I%Lz@WwklpzPmO{O^wLqwen)kNo9&THkMf2TI9DF{K zqQ&EYoDZ6kX{lj29qO#`-pQ~L<=YB7bkJ2+*raDozBgXRM0DrqiY+em&}<^8(L%2T zXjb{?_C}{`*f$M98;Bj=^p}B#$vjP>8m{k%OKm@7mmUL_DypoFr#Hxh#*fckl?qF4 zA6NhWQ4=0L?g>PGS^eAo^5z%>WRbk%OS$fv=f&&Am_iO0xv#C)sK>W$2JY3}Bo|8X||gyzosBhIuo zwHLtqTE)${WM}yZ-72eBzIsx95LaY)Sw7uWH3D@0dxGQY@s=s&9*wSMz=c9->9nY$ z%!OzmK#6~(`o0vs-RfiG5P5OOTL9-hT(DfV|2X4_3BjI;!ued=cbXGhNyI!ow~nq%?YokI>_1i*)ko z%m%(DiKTl-PPSPOMkx<`O-bMvbt$EZi5C~@l1CPoK3iRKjZOe@e?8UX&u#8JjGL~^ z$cbG05!_(VNw=#?r{;4o?s6~YYT!+~*Q$@>FT3nzqM!yLyMZLZ6anh6gYgODz${DW)7d#u=y^lYB z*xQ+oaao(vs(qKe`QmqPwVqlc`wLfNVE*eJcd{e25J3Tz* zJK`7arzKp9B>wz7lr1Xc!6YUDv8B5T^|uZU8g7C$0rZX0#GQ$b_^k(TxZw5GsJq{h z+INuIGP+Z=d}npnB`KuRKt5;SO7AU(~y9_nPW6ETZ0v6IQ~CgTGuLwol^4V*E7Cx{y=$h&D+IDcJ?QO z`bs=f)v0jd{b@&U(HpsLzFp-qZ|1NiXhHqZdO4f8}T3R*{peu zDJ)_N_BX2QF$QZ%)W+GkQ=QV?pA7jKcg{+flTT~#1>V1CpvVNkqXWc+uuU9eU1#fQ z!mz>J5<(k;XpLt3f*SPZg`CF1wfA?A(RnqJFSOoXM!tS-)lJF__iU2WkR2d17+R7~ z!xp)M7jI$w@wN;$$`^I)svGXZVeJ>b{KBT#%%AG5s>#ccVgDv&u>{#%#_!GQG5I|% zu1Iahm*^cNBH21AnhC#5szNUWAOO6wu>BKNv2@I4!GZVl&g-*IOL8Vz@&^z;$+dTw z-nf8{P0OdDaS!cpR~;ZLeOE@Z%1%mUL!auzIQE(Bo0n4&34T+O%O_T4n&cpbQ9Y@# z04pOIA>A0if)p?|$?@CmK;e>b&M<_X#+-QJ8#^r-}JRXb}L{ z=8O5O!Wvm|IF`yoXS_q(7D_@&0GqV%T@y~ljg~$;rkXJHmI9~_(fGhL z%^&n>7h-Gxr~UTMWCFv0qvQ=6eC%k1zc%nwcTr{6ic?eyPgAO=*wKdQyFIW_4r)Kb zT<32=8oJ?1ZPY56GQ*i9z4kK3J{%yd{eDyak@a=La_mEE4WMEuK^Qd3g3U$e34 zFiHLV`y3`_oU>kkwGkB6Uo&>xXiXuhl(2Q31(XfQCpv2$T@|V?{X;upM3SuHEa|oM z+QF~K0U`&F8>%}oF&Yk3(ikF-jX4JDUQ|JV%tkl$yXCz-H$DvuJx|7SxPNCG>VhRd*!57 z?6>zp1*r_wxvEXwkB^5IcbOfn1&7{&3zn?T zi|EnJ1oanBZNB+9wz=O{`I=5WJ~vzdRH_V~c@-^EF6sY8abZO5nuw4&v3voLw*45E zx-XLhgaF{=aiLMxuD2-z@Zl71r?KcZb@&b$HJe%jcs*V0K#t_CTx+MnGh#XP?TprW zk99-u=4K;4?Qr49U1#jFBjTgz#CPy^y^3n0r;eAUBDwG-Tr;o7&w;6cB>vXVb`elO z8+z%&Q#fa3G>}U5XSK(OdSeneZ(^RH$jppQjok5wh#gkPr8zo)rb4zV`M34RK+9_ z1tg@Lq_+V;mz~~ys#0Z(M}ZQ)y*l5mFT;DLoAlm?b1r=UYBJ0G zvUoICSJ|I<$X@V<$?swE^_fwrA+4o_2Q2SsladVu(1mIPWBY(#%AT$0zU{!oFP>skP*%4jS)ox zvt4QbG{W8m(^LF_sl#d^-1p?4(LjB;wL zPrRwQFP=}ER>*m`7l|AjU>)$bxHqe`8 ztuYQ84RYPEkWfKC>X^jW7lCR^))XIQ=E#R#em$RaO|SQYM?D23n$DbLNXXb`CI&?~ zM5**dz|oM4wK|+Aw{hFWESgH0-#QTj)h%#(1vxo;$c~x9&J=u5jOPB;V)2G7tXFz= zi&+7H?dXerZcrvBABGvo<=!I>0l5rhtiQ!B6DBXd=eVSw-=bwTn2$M(s08)X-0Oq3 z=UG<2z5pdtj6eGJ77YQE8(!Q6DnUyD@Qt9C>W`-*D3`v3M^;v`i7`n7xC`+xJUrzvwH)+b0` z1{4J&@M;rArHyK9i+;6e@$Zk}lmuHT&I8cDSZa7-@knUE)5T^fh>GnIsYn16*STfR z0D=egHTDYIN1$^2jmJ~>{NPMSP+y?I%oWGb{XD5+^Wb?fa2H*@FNEl>`X$Ozyu2^p z&d*a9?5vg!UcQkb5zy2M^b`Z-vBiJ2Y_q{VgA)tBZk^9cM_FNE@x}Ef4>NpKDkl~-!0Pyl?{y0V| zfH-O{t^Q?KyRtQtQMU>QKX4qCRzC^;E2h3DPY_kFZ;G^ZsokHnSPhUQc5w%oi;_F7Oc)RB8je_MkrmaTL> zbKRhywuhP;+Dr*Z7Bq>-Mm0x%pVyc2y<^D?XvCzhZ+*K)y@=(y_qX%sGdU4^g?_Y# zp!z)qEyPz-9gP$>wIZ&CURhYJKy0m8GhgBM|1cECbQAusJ2+uGPW>>wwB3ds{H`|Y za>ryx^fuA3FQymMfdkY(JUF4ksM{MBhf%$fulgsBEix>HJ>3>{TvqF^FyrHdCfhza zU{vXb{C~Ynv7cz5)k&~WTmQE|7+*b)dXs9C$qBon-Pa!c$IT9xzm-TjCyZ*r_kUf} z7Gkr^GMG1;#gj^?6}vgX_(~}es{_Lc;oJLP>-8sZKg)4%e`#)vbMzvi9aAU3S zp`4n&{MQ$~W|H`b#}JE1{Zuc-4z*tw|9r%ysOP!8eu=>3@d8shF&ZV*^gY8Frogpb zlL^FhZb8yIIJ~D7GN(^Q%wY>h{kL>LE8#LI#|PMKh3V_GXoAyNob{1f74Akguq)oC z#(c1IG|l#|$!eG>1vm{R@VR3P>d31(k)FM+;TU8{Z-sf$1x-LA<*ZZuvU@l567>m~ z9}*E9l!A^U_Qc|L7vHhhQ2gCPae7 zPEUg;lsny)p|25YG0RJDvm#kl2Ojkz@b>5Z45futAX9s8jk+7=5U7fIM293nxYDJT zLbTt^q1!O_AfrD#NrwyL%o28ZK_W^zaFp?FCUxB%hTVe|a}DT$Qx$Ys_xbJn1xgTe zSbwlwoIx{QZNoj1cFU!U3rs*fK@Ryf8vi#I(TG)H^Joco{m$b{F_J@WKq%YGJvFhR zCi^SZ@H|XZR&n44l8D-wz+|RGfP}ym7%!Q2RM1}&ve!jvB07~k0Mw~bcZdF)-VhOo zrZ-A~Ol!ysVRjX;KcwBm|4}l@IqteXa!g$IfAb*kXggX`O3_z&(&0_mf9^&^LUS4I zr|c3g-n?lz1Avw`Y&II{07F<5k5XU^@S;+g} z=!%M;9vEGTfn8C(VlQKEBZq{VKemB`wf9tMswz!F0%LpT6gicY7qPO0L;hS zDGFAJ-VXsY6lyv%_%Eelk10tc!NJ7)LCB13Xre)FO7Llvbec*XUb-F7;s|n0uB;WZ zi{3#YG_s?OY#e#!Y#_B%Q#3UHa6sowmr28@FJ~KYZy45s-`^btiFelYEK0C7&FOwO z>sRnG)xsg^4oeFjJIdYK_TP$6w4AmTt8S{7eNZL|tA8VliFqB6MIORdEAStjW?gQ#e zl{j^%XVO0c-m5+WE`^ShYVz~nkt-JRWIr&jR`HNX9o#VS*)8e)F=#rE;FL(h#fx`C zl3UdZM&*Ak)rv2i_-}_cK7mQsl{`sI!E0bZxUFt2hUJiia9VwRsZk=fhRGa$&9@Cr`*@Ti?wIAYL*kBK0%|pF-JZ9H*o7!*-=Hab|UbGB{^4DwCv(Y0B>ps>=Ip+Ft% znGhJEJlBeViL4O6;se%J^WGA&wy1B{QM6gjpY7N_Fs~s}58$ta?S#rWzAFIndPhY4 zAMvHqCdc!_Jr<}I(h%iHG2y^SOnF+!d7HwO9WXqtZY{Zp*y7OWI2Z@e+M>+~5%^X&WDrTqc(Jf^JzjCMJ7opeP z6~M1ccqI%?qnPH#(mqR(jVjiSVaqEc8}6_`zlWOTcZ0gEPy^y*c4k>9txz~)k6Q7! zkLr}T>q%2MUc_%uY*2jS-#`;U0TzUIgc4>KEE0igau`S3PB8qtv)gYN%d*!5!FGo+ z>8KB8sDyr)oHVALh}1?y6koJ3R2y_YdOZ+X)C{a?d&IMDaewCkUK;fGcjmRgj+=q<4D^}vboT!5gN+m)CH4SA@5fY7l4#fxe&n<1gtWx^S z2OFrplLialQ!&K}_wT-v88W6c_{s`R@==$eYmXhCq0fN?gLD{2_Sw+#VrrT!N&+g) z1JW;V9<-t7xr730NgfFc?SqEL!l{^=#yIX0-037G&B$1h$T)SxZ?vqhVVGSgYbSs7 z;`dM)K6wmFP~ Q`E3+=Y2~LSlCS*#4==*xp8x;= From aab371a068308bc25c4e819ac6fb27587ef8ec2c Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:01:17 -0700 Subject: [PATCH 20/62] studio: tighten sandbox blocklist precision (bash, hf upload, NOFILE) (#5487) * studio: tighten sandbox blocklist precision (bash, hf upload, NOFILE) Three precision fixes in core/inference/tools.py. Same security boundary; fewer false positives that broke legitimate sandbox use. bash blocklist: The per-token loop introduced in #5375 fired on any blocklist word in any token position, so the entirely benign `grep -r curl .`, `echo source the data`, and `ls /usr/bin/curl` were rejected with "blocked command 'curl'". The position-anchored regex already covers real command-position invocations, including `;rm`, `&&wget`, `$(rm)`, `<(rm)`, backticked subshells, and `/usr/bin/sudo`. The token loop is re-scoped: it only fires when the previous shlex token is a shell separator (or at start of line), so split-quoting obfuscations like `r''m -rf /` are still caught (shlex collapses them to a single command-position token) while argument-position blocklist words pass through. Trailing meta-chars glued to a shlex token (`rm;`) are stripped before basename matching. hf upload AST gate: `_method_call_is_hf_upload` previously matched any method named `upload_file` / `upload_folder` / `upload_large_folder` / `create_commit` on any receiver, so paramiko.SFTPClient.upload_file, boto3.create_commit, and similar non-HF SDK methods were rejected. The fallback now requires an `import huggingface_hub` / `import hf_api` / `from huggingface_hub import ...` somewhere in the same module. Fully-qualified huggingface_hub.upload_file(...) calls are unchanged. NOFILE env knob: `RLIMIT_NOFILE = (1024, 1024)` was the only sandbox rlimit without an env override. 1024 is below Linux's typical soft default and below what multi-shard safetensors mmap chains need on Llama-3 70B-class loads. Default is now 16384 with UNSLOTH_STUDIO_SANDBOX_NOFILE, parity with the other rlimits. 15 new bash-blocklist-position tests pin both the false-positive fixes and the still-blocked invariants (semicolon, &&, subshell, backtick, split-quote, /usr/bin/ prefix, nested bash -c). 4 new hf-upload-import-gate tests pin both the false-positive allowances and that HF-imported uses are still blocked. 1 new pin asserts the NOFILE env var is wired. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: cover command wrappers, find -exec, dynamic HF imports, NOFILE clamp Reviewer follow-ups to the sandbox blocklist precision change. Command-position scanner missed Bash command-prefix wrappers and inline shell assignments. shlex tokenised `env curl`, `time curl`, `nohup rm`, `FOO=bar curl`, `sudo rm`, etc. with the prefix at command position and the real command at argument position, so the position-anchored check returned set() while pre-PR's per-token scan caught them. Likewise the position-anchored regex requires `^` or a shell separator before the command, so `env curl` slipped through. Reworked the scanner to track an expect_command flag plus a prefix_pending flag: - assignments (FOO=bar) keep expect_command=True for the next token, - flags ('-oL', '--') keep it intact while prefix_pending is set, - numeric duration args ('timeout 1 cmd') skip without breaking expect_command, - known wrappers (env, command, builtin, exec, time, nohup, nice, setsid, stdbuf, timeout, ionice, chroot, sudo, doas, su, xargs) set prefix_pending so the wrapper's command is still checked, - shell separators now include `{`, `}`, `)`, `then`, `do`, `else`, `elif` so brace groups and if/then/while/do bodies are recognised as command positions. Also lex with `shlex.shlex(punctuation_chars=";&|()`")` so split-quote forms like `echo done; r''m -rf /tmp/x` and `echo done;r''m` tokenise as `[..., ';', 'rm', ...]` and the command position check fires. Added a small `find -exec CMD ... ;` / `-execdir CMD ... ;` pass so `find . -exec rm -f {} +` and friends are caught even though the direct token is at argument position to `find`. Dynamic Hugging Face imports were treated as no-HF-in-scope. The upload-method gate now also resolves `__import__('huggingface_hub')`, `importlib.import_module('huggingface_hub')`, and bare `import_module('huggingface_hub')` (via `from importlib import import_module`) as HF imports, so HfApi().upload_file via dynamic import is still blocked. RLIMIT_NOFILE: setrlimit(NOFILE, (16384, 16384)) silently failed if the parent's hard cap is below the requested value; the broad except swallowed the OSError and left the sandbox at the parent's default. Clamp the requested value to the inherited hard limit before calling setrlimit. Test cleanup: the existing test_cat_with_word_source_allowed had `assert ... or True` so it could not fail; rewrote it to assert the actual return value plus the two membership checks. Added parametrised coverage for shell prefix wrappers, find -exec / xargs, brace groups, if/then, while/do, split-quote command-name forms, and dynamic HF import upload patterns. Test: - python -m pytest studio/backend/tests/test_sandbox_tools.py -q -> 90 passed (was 67 before this commit) - full studio/backend/tests/ minus llama_cpp_load_progress_live and GPU CUDA_VISIBLE_DEVICES tests (pre-existing isolation flake) -> 1063 passed * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: catch bare-name HF upload calls in AST gate `from huggingface_hub import upload_file; upload_file(...)` is a canonical HF call shape that the previous Attribute-only check missed: the bare-name call lands as ast.Name (not ast.Attribute), so the fuzzy gate skipped it. Extend _method_call_is_hf_upload to also match ast.Name when HF is in scope. Same import-gating discipline as the Attribute branch, so paramiko/boto3 and locally-defined `def upload_file(...)` helpers without HF imports still pass. Pins: 4 new TestHfUploadImportGate cases (upload_file/folder/create_commit bare-name imports blocked; local upload_file without HF import allowed). * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: scope HF uploads to sandbox-local literals; block env / token leaks The previous gate dropped every HF upload call. Two refinements make it precise enough to allow legitimate sandbox->HF uploads while still catching credential / file exfil: - path_or_fileobj / folder_path / create_commit operation paths must be sandbox-local relative-path literals (no '/', '~', drive letter, or '..' segments). Variable / dynamic paths are rejected. - Any positional or keyword argument that statically resolves to os.environ / os.environ.get / os.getenv / bare getenv / subprocess shape readers is rejected (env-var exfil). - token / hf_token / api_token / api_key / auth_token / access_token / password / secret kwargs are always rejected; sandbox env strips all parent credentials by construction, so any value here is hard-coded or lifted. Recursive subtree walk in _reads_env_or_secret catches wrapper shapes (str(os.environ), json.dumps(os.environ.items()), etc.). Add TestSandboxEnvIsolation: pin that _build_safe_env builds the env from a whitelist, not by stripping. Cover Linux/macOS/WSL/Windows secret shapes. The whitelist is PATH / HOME / TMPDIR / LANG / TERM / PYTHONIOENCODING (+ VIRTUAL_ENV / SystemRoot when applicable); HOME points at the sandbox workdir, so HF / wandb / aws SDKs cannot reach the operator's ~/.cache credentials. Test classes added: - TestHfUploadSandboxLocalPaths (relative literals allowed; absolute, drive-letter, '~', '..', mid-path traversal, dynamic vars, and open() of unsafe paths blocked, including create_commit recursion). - TestHfUploadEnvAndSecretLeakBlock (os.environ subscript/get/getenv, bare getenv, subprocess.check_output, str(os.environ), token=, hf_token=, api_key=, and create_commit operations referencing env). - TestSandboxEnvIsolation (no parent secret leaks into sandbox env). 131 tests in test_sandbox_tools.py pass. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/core/inference/tools.py | 367 +++++++++++-- studio/backend/tests/test_sandbox_tools.py | 603 ++++++++++++++++++++- 2 files changed, 910 insertions(+), 60 deletions(-) diff --git a/studio/backend/core/inference/tools.py b/studio/backend/core/inference/tools.py index 70db5477d4..0e9cce7c3e 100644 --- a/studio/backend/core/inference/tools.py +++ b/studio/backend/core/inference/tools.py @@ -109,40 +109,120 @@ _BLOCKED_COMMANDS = ( ) +_SHELL_SEPARATORS = frozenset( + {";", "&&", "||", "|", "&", "\n", "(", ")", "`", "{", "}"} +) +# Bash keywords that introduce a new command position (then $cmd, do $cmd, etc.). +_SHELL_KEYWORDS_AS_SEP = frozenset({"then", "do", "else", "elif"}) +# Wrappers whose next non-flag argument is itself the command Bash will exec. +_COMMAND_PREFIXES = frozenset( + { + "env", + "command", + "builtin", + "exec", + "time", + "nohup", + "nice", + "setsid", + "stdbuf", + "timeout", + "ionice", + "chroot", + "sudo", + "doas", + "su", + "xargs", + } +) +_ASSIGNMENT_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*=") +_FIND_EXEC_FLAGS = frozenset({"-exec", "-execdir", "-ok", "-okdir"}) + + def _find_blocked_commands(command: str) -> set[str]: - """Detect blocked commands using shlex tokenization and regex scanning. + """Detect blocked commands at shell command position only. - Catches: full paths (/usr/bin/sudo), quoted strings ("sudo"), - split-quotes (su""do), backslash escapes (\\rm), and command-position - words after ;, |, &&, $(). + A token is at command position if it is the first token, or if the + preceding token is a shell separator / brace-group opener / keyword + that starts a new command (`then`, `do`, etc.), or a command-prefix + wrapper like `env` / `time` / `xargs` (the next token is the real + command). Tokens in argument position (`grep -r curl .`, + `echo source the data`, `ls /usr/bin/curl`) are passed through. + Also scans `find ... -exec CMD` and recurses into bash -c / cmd /c. """ - blocked = set() + blocked: set[str] = set() - # 1. shlex tokenization (handles quotes, escapes, concatenation) + # shlex with punctuation_chars splits `;`, `&&`, `||`, `|`, `(`, `)`, `` ` `` + # off as their own tokens so we can detect command position even when a + # caller writes `echo done; rm -rf x` (no whitespace) or quote-splits the + # command name itself (`r''m` collapses to a single token `rm` at command + # position after the `;` separator). try: - tokens = ( - shlex.split(command) - if sys.platform != "win32" - else shlex.split(command, posix = False) - ) + if sys.platform == "win32": + tokens = shlex.split(command, posix = False) + else: + lexer = shlex.shlex(command, posix = True, punctuation_chars = ";&|()`") + lexer.whitespace_split = True + tokens = list(lexer) except ValueError: tokens = command.split() - for token in tokens: - base = os.path.basename(token).lower() - # Strip common Windows executable extensions so that - # runas.exe, shutdown.bat, etc. match the blocklist. + def _token_basename(tok: str) -> str: + # shlex may glue trailing meta-chars onto a token (`rm;`); strip them + # so the basename match still hits `rm`. Leading shell-state chars + # likewise. + tok = tok.strip(";&|()`{}") + base = os.path.basename(tok).lower() stem, ext = os.path.splitext(base) if ext in {".exe", ".com", ".bat", ".cmd"}: base = stem + return base + + expect_command = True # start of string is a command position + prefix_pending = False # last command-position token was env/time/timeout/xargs/... + for token in tokens: + if token in _SHELL_SEPARATORS or token in _SHELL_KEYWORDS_AS_SEP: + expect_command = True + prefix_pending = False + continue + if token.startswith("-"): + # Flags belong to the active command. While a wrapper prefix is + # waiting for its command (`stdbuf -oL cmd`, `xargs -- cmd`), + # keep expect_command intact. + if not prefix_pending: + expect_command = False + continue + if not expect_command: + continue + # FOO=bar prefix: assignment list, next non-assignment token is the command. + if _ASSIGNMENT_RE.match(token): + continue + # `timeout 1 cmd` / `nice -n 5 cmd` style numeric wrapper arg. + if prefix_pending and token.lstrip("-").isdigit(): + continue + base = _token_basename(token) if base in _BLOCKED_COMMANDS: blocked.add(base) + # Wrappers (`env` / `time` / `xargs` / `sudo`) consume one command; the + # next non-flag, non-numeric token is the real command. `sudo` is + # already in _BLOCKED_COMMANDS, so it's flagged AND we keep walking. + if base in _COMMAND_PREFIXES: + prefix_pending = True + continue + expect_command = False + prefix_pending = False - # 2. Regex: catch blocked words at shell command boundaries - # (semicolons, pipes, &&, ||, backticks, $(), <(), subshells, newlines) - # Uses a single combined pattern for all blocked words. - # Handles optional Unix path prefix (/usr/bin/) and Windows drive - # letter prefix (C:\Windows\...\). + # `find ... -exec CMD ... ;` and `-execdir CMD ... ;` invoke CMD directly. + for i, tok in enumerate(tokens): + if tok in _FIND_EXEC_FLAGS and i + 1 < len(tokens): + base = _token_basename(tokens[i + 1]) + if base in _BLOCKED_COMMANDS: + blocked.add(base) + + # Regex: blocked words at shell command boundaries that shlex won't see, + # e.g. inside an unquoted $(rm -rf), <(rm), backtick chain, or appended to + # a separator with no whitespace ("foo;rm"). Anchored to command-position + # delimiters; does not match in argument position. lowered = command.lower() if _BLOCKED_COMMANDS: words_alt = "|".join(re.escape(w) for w in sorted(_BLOCKED_COMMANDS)) @@ -153,7 +233,7 @@ def _find_blocked_commands(command: str) -> set[str]: ) blocked.update(re.findall(pattern, lowered)) - # 3. Check for nested shell invocations (bash -c 'sudo whoami', + # Nested shell invocations (bash -c 'sudo whoami', # bash -lc '...', bash --login -c '...', cmd /c '...'). # When a -c or /c flag is found, look backwards for a shell name # (skipping intermediate flags like --login, -l, -x) and recursively @@ -194,10 +274,13 @@ def _find_blocked_commands(command: str) -> set[str]: def _build_safe_env(workdir: str) -> dict[str, str]: """Build a minimal, credential-free environment for sandboxed subprocesses. - Strips HF_TOKEN, WANDB_API_KEY, AWS_*, GH_TOKEN, LD_PRELOAD, DYLD_*, etc. - Preserves the active Python interpreter and virtualenv directories in PATH - so that pip, uv, and packages installed in the Studio runtime remain - accessible. + Whitelist-built from scratch -- the parent process env is NOT inherited. + Only PATH / HOME / TMPDIR / LANG / TERM / PYTHONIOENCODING (+ VIRTUAL_ENV + or Windows SystemRoot when applicable) reach the child. HF_TOKEN, + WANDB_API_KEY, AWS_*, GH_TOKEN, OPENAI_API_KEY, LD_PRELOAD, DYLD_*, and + every other parent var are absent by construction. HOME points at the + sandbox workdir so HF / wandb / aws SDKs cannot read cached credentials + from the operator's real ~/. """ # Start with the directory containing the running Python interpreter # so that subprocess calls to 'python', 'pip', etc. resolve to the @@ -296,7 +379,17 @@ def _sandbox_preexec(): except (ValueError, OSError, AttributeError): pass try: - _resource.setrlimit(_resource.RLIMIT_NOFILE, (1024, 1024)) + # Default high enough for multi-shard safetensors mmaps + Python's + # own handle count; tunable via env for installs that hit the cap. + # Clamp to the inherited hard limit so setrlimit doesn't ValueError + # on machines where the parent's hard cap is below the requested + # value (would otherwise leave NOFILE at the parent's default). + nofile = int(os.environ.get("UNSLOTH_STUDIO_SANDBOX_NOFILE", "16384")) + _soft_cur, hard_cur = _resource.getrlimit(_resource.RLIMIT_NOFILE) + target = ( + nofile if hard_cur == _resource.RLIM_INFINITY else min(nofile, hard_cur) + ) + _resource.setrlimit(_resource.RLIMIT_NOFILE, (target, target)) except (ValueError, OSError, AttributeError): pass @@ -1327,13 +1420,208 @@ def _check_signal_escape_patterns(code: str): return True return False - def _method_call_is_hf_upload(node: ast.Call) -> bool: - """True for HfApi upload method names on any receiver.""" + # Bare method-name fallback (`x.upload_file(...)`) is intentionally fuzzy, + # but should only fire when huggingface_hub / hf_api is actually imported + # somewhere in the snippet -- otherwise paramiko.upload_file, boto3 + # create_commit, etc. hit a false positive. We pre-scan for the imports. + _HF_IMPORT_MODULES = ( + "huggingface_hub", + "hf_api", + "huggingface_hub.hf_api", + ) + + def _module_has_hf_import(tree: ast.AST) -> bool: + for n in ast.walk(tree): + if isinstance(n, ast.Import): + for alias in n.names: + if alias.name.split(".", 1)[0] in _HF_IMPORT_MODULES: + return True + elif isinstance(n, ast.ImportFrom): + root = (n.module or "").split(".", 1)[0] + if root in _HF_IMPORT_MODULES: + return True + elif isinstance(n, ast.Call) and n.args: + # __import__('huggingface_hub'), importlib.import_module('huggingface_hub'), + # and bare import_module('huggingface_hub') (via `from importlib import ...`). + arg0 = n.args[0] + if not (isinstance(arg0, ast.Constant) and isinstance(arg0.value, str)): + continue + if arg0.value.split(".", 1)[0] not in _HF_IMPORT_MODULES: + continue + func = n.func + if isinstance(func, ast.Name) and func.id in { + "__import__", + "import_module", + }: + return True + if isinstance(func, ast.Attribute) and func.attr == "import_module": + return True + return False + + _hf_in_scope = _module_has_hf_import(tree) + + def _method_call_hf_upload_name(node: ast.Call) -> str | None: + """Return the HF upload method name (`upload_file`, ...) or None. + + Catches `HfApi().upload_file(...)` (Attribute) and + `from huggingface_hub import upload_file; upload_file(...)` (Name). + The bare-name branch fires only when an HF import is in scope, mirroring + the Attribute branch's gating so paramiko/boto3 do not false-positive. + """ + if not _hf_in_scope: + return None + f = node.func + if isinstance(f, ast.Attribute) and f.attr in _UPLOAD_HF_METHODS: + return f.attr + if isinstance(f, ast.Name) and f.id in _UPLOAD_HF_METHODS: + return f.id + return None + + # Kwargs that ship a credential over the wire. Sandbox env strips HF_TOKEN + # / WANDB_API_KEY / AWS_* up front, so any value here is hard-coded or + # lifted from the parent process. + _HF_SENSITIVE_KWARGS = frozenset( + { + "token", + "hf_token", + "api_token", + "api_key", + "auth_token", + "access_token", + "password", + "secret", + } + ) + + def _is_os_environ(node: ast.AST) -> bool: return ( - isinstance(node.func, ast.Attribute) - and node.func.attr in _UPLOAD_HF_METHODS + isinstance(node, ast.Attribute) + and node.attr == "environ" + and isinstance(node.value, ast.Name) + and node.value.id == "os" ) + def _reads_env_or_secret(node: ast.AST | None) -> bool: + """True if any node in the subtree resolves to an env / process read. + + Walking the subtree (not just the root) means wrapper calls like + `str(os.environ)`, `json.dumps(os.environ)`, or + `'-'.join(os.environ.values())` are caught too. + + Covers: `os.environ`, `os.environ[K]`, `os.environ.get(K)`, `os.getenv(K)`, + bare `getenv(K)` (after `from os import getenv`), and + `subprocess.{run,check_output,Popen,getoutput,getstatusoutput}` which + the LLM could use to lift parent env via `printenv` / `env` / `set`. + """ + if node is None: + return False + for sub in ast.walk(node): + if _is_os_environ(sub): + return True + if isinstance(sub, ast.Call): + f = sub.func + if isinstance(f, ast.Attribute): + if ( + f.attr in {"getenv", "getenvb"} + and isinstance(f.value, ast.Name) + and f.value.id == "os" + ): + return True + if ( + f.attr + in { + "check_output", + "run", + "Popen", + "getoutput", + "getstatusoutput", + } + and isinstance(f.value, ast.Name) + and f.value.id in {"subprocess", "commands"} + ): + return True + if isinstance(f, ast.Name) and f.id in {"getenv", "getenvb"}: + return True + return False + + def _is_safe_relative_path(path: str) -> bool: + """Relative path with no leading `/`, `~`, drive letter, or `..` segments.""" + if not isinstance(path, str) or not path: + return False + if path[0] in ("/", "\\", "~"): + return False + if len(path) >= 2 and path[1] == ":": + return False + return ".." not in path.replace("\\", "/").split("/") + + def _path_arg_is_sandbox_local(node: ast.AST | None) -> bool: + """Whether the path argument resolves to a sandbox-local literal.""" + if node is None: + return False + if isinstance(node, ast.Constant) and isinstance( + node.value, (bytes, bytearray) + ): + return True # inline bytes, no file access + if isinstance(node, ast.Constant) and isinstance(node.value, str): + return _is_safe_relative_path(node.value) + if isinstance(node, ast.Call): + f = node.func + is_open = (isinstance(f, ast.Name) and f.id == "open") or ( + isinstance(f, ast.Attribute) and f.attr == "open" + ) + if is_open and node.args: + a0 = node.args[0] + return ( + isinstance(a0, ast.Constant) + and isinstance(a0.value, str) + and _is_safe_relative_path(a0.value) + ) + return False + + def _hf_upload_violation(node: ast.Call, method_name: str) -> str | None: + """Inspect an HF upload call; return a violation reason or None. + + Policy: HF uploads are allowed only when (a) no sensitive kwarg is set, + (b) no positional / keyword value reads `os.environ` or related env + readers, and (c) the path argument is a sandbox-local literal -- a + relative string with no `..`, an `open()`, or inline bytes. + Dynamic / variable paths are rejected; the policy cannot prove safety + statically and the cost of a wrong-allow is a credential exfiltration. + """ + for kw in node.keywords or []: + if kw.arg in _HF_SENSITIVE_KWARGS: + return ( + f"HF upload {kw.arg}= cannot be set from sandboxed code; " + "uploads run with the sandbox identity only" + ) + all_values = list(node.args or []) + [kw.value for kw in (node.keywords or [])] + for v in all_values: + if _reads_env_or_secret(v): + return ( + "HF upload cannot include os.environ / os.getenv / subprocess " + "env reads; secrets and tokens must not be exfiltrated" + ) + if method_name == "create_commit": + for kw in node.keywords or []: + if kw.arg == "operations" and isinstance(kw.value, ast.List): + for elt in kw.value.elts: + if isinstance(elt, ast.Call): + inner = _hf_upload_violation(elt, "upload_file") + if inner: + return inner + return None + path_node: ast.AST | None = node.args[0] if node.args else None + for kw in node.keywords or []: + if kw.arg in ("path_or_fileobj", "folder_path"): + path_node = kw.value + break + if not _path_arg_is_sandbox_local(path_node): + return ( + "HF upload path must be a sandbox-local relative-path literal " + "(no absolute paths, no '..' segments, no dynamic expressions)" + ) + return None + class NetworkAndIoVisitor(ast.NodeVisitor): def visit_Call(self, node): parts: list[str] = [] @@ -1345,14 +1633,17 @@ def _check_signal_escape_patterns(code: str): parts.insert(0, cur.id) fq = ".".join(parts) if parts else "" - if _method_call_is_hf_upload(node): - network_calls.append( - { - "type": "upload_blocked", - "line": getattr(node, "lineno", -1), - "description": ("Blocked: file upload disallowed in sandbox"), - } - ) + hf_upload_name = _method_call_hf_upload_name(node) + if hf_upload_name is not None: + violation = _hf_upload_violation(node, hf_upload_name) + if violation is not None: + network_calls.append( + { + "type": "upload_blocked", + "line": getattr(node, "lineno", -1), + "description": f"Blocked: {violation}", + } + ) # Direct sock.connect((host, port)) bypasses the FQ-prefix branch below. if ( diff --git a/studio/backend/tests/test_sandbox_tools.py b/studio/backend/tests/test_sandbox_tools.py index fcc531c212..57007a5f66 100644 --- a/studio/backend/tests/test_sandbox_tools.py +++ b/studio/backend/tests/test_sandbox_tools.py @@ -185,33 +185,39 @@ class TestUploadDenylist: expect_phrase = "Blocked: file upload disallowed in sandbox", ) - def test_hf_api_upload_file_blocked(self): - _blocked( - ( - "from huggingface_hub import HfApi\n" - 'HfApi().upload_file(path_or_fileobj="x.bin", ' - 'path_in_repo="x.bin", repo_id="foo/bar")' - ), - expect_phrase = "Blocked: file upload disallowed in sandbox", + def test_hf_api_upload_sandbox_local_allowed(self): + # Sandbox-local relative path is the canonical safe shape. + _ok( + "from huggingface_hub import HfApi\n" + 'HfApi().upload_file(path_or_fileobj="x.bin", ' + 'path_in_repo="x.bin", repo_id="foo/bar")' ) - def test_hf_module_upload_folder_blocked(self): - _blocked( - ( - "import huggingface_hub\n" - 'huggingface_hub.upload_folder(folder_path="./", repo_id="foo/bar")' - ), - expect_phrase = "Blocked: file upload disallowed in sandbox", + def test_hf_module_upload_folder_sandbox_local_allowed(self): + _ok( + "import huggingface_hub\n" + 'huggingface_hub.upload_folder(folder_path="outputs", repo_id="foo/bar")' ) - def test_hf_create_commit_method_blocked(self): + def test_hf_create_commit_empty_operations_allowed(self): + _ok( + "import huggingface_hub\n" + "api = huggingface_hub.HfApi()\n" + 'api.create_commit(repo_id="foo/bar", operations=[])' + ) + + def test_hf_upload_absolute_path_blocked(self): _blocked( - ( - "import huggingface_hub\n" - "api = huggingface_hub.HfApi()\n" - 'api.create_commit(repo_id="foo/bar", operations=[])' - ), - expect_phrase = "Blocked: file upload disallowed in sandbox", + "from huggingface_hub import HfApi\n" + 'HfApi().upload_file(path_or_fileobj="/etc/passwd", path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_hf_upload_parent_dir_escape_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="../escape.bin", path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", ) def test_plain_post_json_not_blocked(self): @@ -221,6 +227,103 @@ class TestUploadDenylist: ) +class TestSandboxEnvIsolation: + """The sandbox subprocess env is built from a whitelist, not by stripping. + + Confirm every credential-shaped parent var is absent regardless of how the + operator's process is configured. Covers Linux/macOS/WSL/Windows shapes. + """ + + _SECRET_KEYS = ( + # HF + ML tooling + "HF_TOKEN", + "HUGGING_FACE_HUB_TOKEN", + "HUGGINGFACEHUB_API_TOKEN", + "WANDB_API_KEY", + "WANDB_USERNAME", + "MLFLOW_TRACKING_TOKEN", + "COMET_API_KEY", + "NEPTUNE_API_TOKEN", + # Generic cloud + "AWS_ACCESS_KEY_ID", + "AWS_SECRET_ACCESS_KEY", + "AWS_SESSION_TOKEN", + "GCP_SERVICE_ACCOUNT_KEY", + "GOOGLE_APPLICATION_CREDENTIALS", + "AZURE_STORAGE_KEY", + "AZURE_CLIENT_SECRET", + # Forge / git / package + "GH_TOKEN", + "GITHUB_TOKEN", + "GITLAB_TOKEN", + "BITBUCKET_TOKEN", + "NPM_TOKEN", + "PYPI_TOKEN", + "CARGO_REGISTRY_TOKEN", + # LLM provider + "OPENAI_API_KEY", + "ANTHROPIC_API_KEY", + "GOOGLE_API_KEY", + "MISTRAL_API_KEY", + "COHERE_API_KEY", + "TOGETHER_API_KEY", + # Loader injection / sudo state + "LD_PRELOAD", + "LD_LIBRARY_PATH", + "DYLD_INSERT_LIBRARIES", + "DYLD_LIBRARY_PATH", + # Windows + "USERPROFILE", + "APPDATA", + "LOCALAPPDATA", + "ProgramData", + ) + + def test_no_secret_keys_leak_into_sandbox(self, monkeypatch, tmp_path): + from core.inference.tools import _build_safe_env + + for key in self._SECRET_KEYS: + monkeypatch.setenv(key, f"sentinel-{key}") + env = _build_safe_env(str(tmp_path)) + for key in self._SECRET_KEYS: + assert key not in env, f"parent env var {key!r} leaked into sandbox env" + + def test_sandbox_env_is_minimal_whitelist(self, monkeypatch, tmp_path): + from core.inference.tools import _build_safe_env + + # Pollute parent env with arbitrary keys + for key in ("EVIL", "RANDOM", "ATTACK_VEC", "MY_TOKEN", "X_API_KEY"): + monkeypatch.setenv(key, "leak-me") + env = _build_safe_env(str(tmp_path)) + allowed = { + "PATH", + "HOME", + "TMPDIR", + "LANG", + "TERM", + "PYTHONIOENCODING", + "VIRTUAL_ENV", + "SystemRoot", + } + extras = set(env.keys()) - allowed + assert not extras, f"sandbox env added unexpected keys: {extras}" + + def test_home_points_at_sandbox_workdir(self, tmp_path): + from core.inference.tools import _build_safe_env + + env = _build_safe_env(str(tmp_path)) + assert env["HOME"] == str(tmp_path) + assert env["TMPDIR"] == str(tmp_path) + + def test_term_is_dumb(self, tmp_path): + from core.inference.tools import _build_safe_env + + # Prevents the sandbox from re-using the operator's TERM (e.g. xterm-256color) + # which could trigger color-escape parsing in downstream tools. + env = _build_safe_env(str(tmp_path)) + assert env["TERM"] == "dumb" + + class TestSandboxCpuRlimitDefault: """Pin the default so a regression below 600s without opt-in is caught.""" @@ -234,8 +337,464 @@ class TestSandboxCpuRlimitDefault: # Explanatory comment retained. assert "CLONE_NEWNET" in src + def test_nofile_env_tunable(self): + src = (_BACKEND_ROOT / "core" / "inference" / "tools.py").read_text() + # Parity with the other rlimits: must come from the env, not be hardcoded. + assert "UNSLOTH_STUDIO_SANDBOX_NOFILE" in src + class TestMaxBodyDefault: def test_default_is_500_mb(self): src = (_BACKEND_ROOT / "main.py").read_text() assert 'UNSLOTH_STUDIO_MAX_BODY_MB", "500"' in src + + +class TestBashBlocklistPosition: + """The blocklist must fire at command position only. + + Pre-fix the per-token loop fired on any token, so `grep -r curl .` + and `echo source` were rejected. The position-anchored regex plus a + shlex-aware command-position-only token check is sufficient. + """ + + @staticmethod + def _find(): + from core.inference.tools import _find_blocked_commands + + return _find_blocked_commands + + # ---- argument-position: must NOT be blocked ---- + def test_grep_for_curl_string_allowed(self): + assert self._find()("grep -r curl .") == set() + + def test_echo_source_allowed(self): + assert self._find()("echo source the data") == set() + + def test_cat_with_word_source_allowed(self): + # The 'source' word is an argument to echo; not blocked. + # `echo` itself isn't blocked. Only legit allowed tokens here. + assert self._find()("cat README.md && echo source") == set() + assert "source" not in self._find()("cat README.md && echo source") + assert "echo" not in self._find()("cat README.md && echo source") + + def test_ls_path_containing_curl_allowed(self): + assert self._find()("ls /usr/bin/curl") == set() + + def test_find_for_wget_string_allowed(self): + assert self._find()("find . -name wget") == set() + + def test_quoted_curl_arg_allowed(self): + assert self._find()('echo "curl is a tool"') == set() + + # ---- command-position: must be blocked ---- + def test_bare_rm_blocked(self): + assert "rm" in self._find()("rm -rf /") + + def test_curl_at_command_position_blocked(self): + assert "curl" in self._find()("curl https://example.com") + + def test_after_semicolon_blocked(self): + # `rm` after `;` even without surrounding whitespace. + assert "rm" in self._find()("echo done; rm -rf /tmp/x") + assert "rm" in self._find()("echo done;rm -rf /tmp/x") + + def test_after_double_ampersand_blocked(self): + assert "wget" in self._find()("cd /tmp && wget https://bad") + + def test_split_quotes_obfuscation_blocked(self): + # shlex collapses 'r''m' -> 'rm' as a single token at command position. + assert "rm" in self._find()("r''m -rf /") + + def test_path_prefixed_command_blocked(self): + assert "sudo" in self._find()("/usr/bin/sudo whoami") + + def test_nested_bash_c_blocked(self): + # Recursion into the nested command string still catches command-position curl. + assert "curl" in self._find()("bash -c 'curl https://x'") + + def test_subshell_command_blocked(self): + assert "rm" in self._find()("echo $(rm -rf /tmp)") + + def test_backtick_command_blocked(self): + assert "rm" in self._find()("echo `rm -rf /tmp`") + + # ---- shell prefixes / wrappers: must still be blocked ---- + @pytest.mark.parametrize( + "command, blocked_cmd", + [ + ("FOO=bar curl https://example.com", "curl"), + ("HTTPS_PROXY=http://x wget https://bad", "wget"), + ("env curl https://example.com", "curl"), + ("env FOO=1 /usr/bin/curl https://x", "curl"), + ("/usr/bin/env rm -rf /tmp/x", "rm"), + ("command rm -rf /tmp/x", "rm"), + ("time curl https://example.com", "curl"), + ("nice rm -rf /tmp/x", "rm"), + ("nohup wget https://bad", "wget"), + ("timeout 1 rm -rf /tmp/x", "rm"), + ("setsid rm -rf /tmp/x", "rm"), + ("stdbuf -oL rm -rf /tmp/x", "rm"), + ("sudo rm -rf /tmp/x", "rm"), + ("cd /tmp; FOO=bar rm -rf x", "rm"), + ], + ) + def test_command_prefix_wrappers_blocked(self, command, blocked_cmd): + assert blocked_cmd in self._find()(command) + + # ---- split-quoted command name after attached separators ---- + def test_split_quotes_after_semicolon_blocked(self): + assert "rm" in self._find()("echo done; r''m -rf /tmp/x") + assert "rm" in self._find()("echo done;r''m -rf /tmp/x") + assert "curl" in self._find()("echo done; c''url --version") + assert "curl" in self._find()("echo done; /usr/bin/c''url --version") + + # ---- find -exec / xargs invoke a command directly ---- + def test_find_exec_blocked(self): + assert "rm" in self._find()("find . -type f -exec rm -f {} +") + assert "rm" in self._find()("find . -type f -exec rm -f {} ';'") + assert "rm" in self._find()("find . -execdir rm -f {} ';'") + + def test_xargs_command_blocked(self): + assert "rm" in self._find()("printf /tmp/x | xargs rm") + assert "rm" in self._find()("printf /tmp/x | xargs -- rm") + + # ---- brace groups and bash compound statements ---- + def test_brace_group_blocked(self): + assert "rm" in self._find()("{ rm -rf /tmp/x; }") + + def test_if_then_blocked(self): + assert "curl" in self._find()("if true; then curl --version; fi") + + def test_while_do_blocked(self): + assert "curl" in self._find()("while true; do curl --version; break; done") + + +class TestHfUploadImportGate: + """HfApi-style upload-method blocking should require an HF import in + scope; otherwise paramiko / boto3 / internal SDKs with the same + method names hit a false positive.""" + + def test_paramiko_upload_file_allowed_without_hf_import(self): + _ok("import paramiko; sftp=None; sftp.upload_file('a','b')") + + def test_boto3_create_commit_allowed_without_hf_import(self): + _ok("client=None; client.create_commit(Repo='x')") + + def test_hf_api_upload_safe_path_allowed(self): + # Sandbox-local relative path -- the call shape we want to permit. + _ok("from huggingface_hub import HfApi; HfApi().upload_file('a','b','c')") + + def test_hf_upload_file_fq_safe_path_allowed(self): + _ok("import huggingface_hub; huggingface_hub.upload_file('a','b','c')") + + def test_dynamic_builtin_import_safe_path_allowed(self): + # `__import__('huggingface_hub')` puts HF in scope; relative-literal path is safe. + _ok("hf=__import__('huggingface_hub'); hf.HfApi().upload_file('a','b','c')") + + def test_dynamic_importlib_safe_path_allowed(self): + _ok( + "import importlib; hf=importlib.import_module('huggingface_hub');" + " hf.HfApi().upload_file('a','b','c')" + ) + + def test_from_importlib_import_module_safe_create_commit_allowed(self): + _ok( + "from importlib import import_module;" + " api=import_module('huggingface_hub').HfApi(); api.create_commit()" + ) + + def test_hf_bare_name_upload_safe_path_allowed(self): + # `from huggingface_hub import upload_file` then bare `upload_file(...)` + # with a sandbox-local relative-path literal is allowed. + _ok( + "from huggingface_hub import upload_file;" + " upload_file(path_or_fileobj='x', path_in_repo='x', repo_id='r')" + ) + + def test_hf_bare_name_upload_folder_safe_allowed(self): + _ok( + "from huggingface_hub import upload_folder;" + " upload_folder(folder_path='x', repo_id='r')" + ) + + def test_hf_bare_name_create_commit_safe_allowed(self): + _ok( + "from huggingface_hub import create_commit;" + " create_commit(operations=[], repo_id='r')" + ) + + def test_bare_name_upload_file_without_hf_import_allowed(self): + # No HF import -- local helper named upload_file should pass. + _ok("def upload_file(*a, **k):\n pass\n" "upload_file('x', 'y', 'z')") + + +class TestHfUploadSandboxLocalPaths: + """The HF upload gate must only allow uploads of files that already live in + the sandbox workdir. Absolute paths, `..` traversal, home expansion, and + Windows drive letters are rejected because the LLM can use them to lift + secrets from outside the sandbox.""" + + def test_relative_literal_allowed(self): + _ok( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="model.bin",' + ' path_in_repo="model.bin", repo_id="me/r")' + ) + + def test_dotted_relative_allowed(self): + _ok( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="./outputs/m.bin",' + ' path_in_repo="m.bin", repo_id="me/r")' + ) + + def test_nested_relative_allowed(self): + _ok( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="outputs/run42/model.bin",' + ' path_in_repo="m.bin", repo_id="me/r")' + ) + + def test_open_of_relative_literal_allowed(self): + _ok( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj=open("model.bin", "rb"),' + ' path_in_repo="m.bin", repo_id="me/r")' + ) + + def test_inline_bytes_literal_allowed(self): + _ok( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj=b"\\x00\\x01\\x02",' + ' path_in_repo="m.bin", repo_id="me/r")' + ) + + def test_absolute_unix_path_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="/etc/passwd",' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_absolute_windows_drive_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="C:\\\\Windows\\\\creds",' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_home_expansion_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="~/.aws/credentials",' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_parent_traversal_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="../../etc/shadow",' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_parent_traversal_mid_path_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="outputs/../../../etc",' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_open_of_absolute_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj=open("/etc/passwd","rb"),' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_open_of_parent_traversal_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj=open("../escape","rb"),' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_dynamic_variable_path_blocked(self): + # A non-literal expression could resolve to any path at runtime; + # the static checker cannot prove safety, so block. + _blocked( + "import huggingface_hub, os\n" + "p = os.path.join('outputs', 'x.bin')\n" + 'huggingface_hub.upload_file(path_or_fileobj=p, path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_upload_folder_absolute_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_folder(folder_path="/var/log", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_upload_folder_parent_traversal_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_folder(folder_path="../..", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_upload_large_folder_absolute_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_large_folder(folder_path="/etc", repo_id="r")', + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + def test_create_commit_operation_safe_allowed(self): + _ok( + "import huggingface_hub\n" + "from huggingface_hub import CommitOperationAdd\n" + "huggingface_hub.HfApi().create_commit(\n" + " repo_id='r',\n" + " operations=[CommitOperationAdd(path_or_fileobj='m.bin', path_in_repo='m.bin')],\n" + ")" + ) + + def test_create_commit_operation_absolute_blocked(self): + _blocked( + "import huggingface_hub\n" + "from huggingface_hub import CommitOperationAdd\n" + "huggingface_hub.HfApi().create_commit(\n" + " repo_id='r',\n" + " operations=[CommitOperationAdd(path_or_fileobj='/etc/passwd', path_in_repo='x')],\n" + ")", + expect_phrase = "HF upload path must be a sandbox-local relative-path literal", + ) + + +class TestHfUploadEnvAndSecretLeakBlock: + """The HF upload gate must reject any positional / keyword arg sourced from + `os.environ` / `os.getenv` / subprocess env reads. Even though + `_build_safe_env` strips HF_TOKEN/WANDB/AWS upfront for the sandbox shell, + a Python script can still reach the parent process env if it bypasses the + safe-env wrapper at the source -- so block statically.""" + + def test_path_from_os_environ_subscript_blocked(self): + _blocked( + "import huggingface_hub, os\n" + 'huggingface_hub.upload_file(path_or_fileobj=os.environ["HF_TOKEN"],' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload cannot include os.environ", + ) + + def test_path_from_os_environ_get_blocked(self): + _blocked( + "import huggingface_hub, os\n" + 'huggingface_hub.upload_file(path_or_fileobj=os.environ.get("HF_TOKEN"),' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload cannot include os.environ", + ) + + def test_path_from_os_getenv_blocked(self): + _blocked( + "import huggingface_hub, os\n" + 'huggingface_hub.upload_file(path_or_fileobj=os.getenv("HF_TOKEN"),' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload cannot include os.environ", + ) + + def test_path_from_bare_getenv_blocked(self): + _blocked( + "import huggingface_hub\n" + "from os import getenv\n" + 'huggingface_hub.upload_file(path_or_fileobj=getenv("HF_TOKEN"),' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload cannot include os.environ", + ) + + def test_path_from_subprocess_printenv_blocked(self): + _blocked( + "import huggingface_hub, subprocess\n" + "huggingface_hub.upload_file(" + 'path_or_fileobj=subprocess.check_output(["printenv","HF_TOKEN"]),' + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload cannot include os.environ", + ) + + def test_token_kwarg_with_literal_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="x.bin",' + ' path_in_repo="x", repo_id="r", token="hf_xyzabc123")', + expect_phrase = "HF upload token= cannot be set", + ) + + def test_hf_token_kwarg_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_file(path_or_fileobj="x.bin",' + ' path_in_repo="x", repo_id="r", hf_token="hf_secret")', + expect_phrase = "HF upload hf_token= cannot be set", + ) + + def test_api_key_kwarg_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.upload_folder(folder_path="outputs",' + ' repo_id="r", api_key="abc")', + expect_phrase = "HF upload api_key= cannot be set", + ) + + def test_token_kwarg_from_env_blocked(self): + # Both rules fire; the sensitive-kwarg check trips first. + _blocked( + "import huggingface_hub, os\n" + 'huggingface_hub.upload_file(path_or_fileobj="x.bin",' + ' path_in_repo="x", repo_id="r", token=os.environ["HF_TOKEN"])', + expect_phrase = "HF upload token= cannot be set", + ) + + def test_env_dict_unpacked_via_environ_attr_blocked(self): + # `os.environ` as a bare reference (passed somewhere it gets serialized). + _blocked( + "import huggingface_hub, os\n" + "huggingface_hub.upload_file(path_or_fileobj=str(os.environ)," + ' path_in_repo="x", repo_id="r")', + expect_phrase = "HF upload cannot include os.environ", + ) + + def test_repo_id_from_env_also_blocked(self): + # Even non-path args must not source env vars -- an attacker could + # encode secrets in repo_id or path_in_repo. + _blocked( + "import huggingface_hub, os\n" + 'huggingface_hub.upload_file(path_or_fileobj="x.bin",' + ' path_in_repo=os.environ["HF_TOKEN"], repo_id="r")', + expect_phrase = "HF upload cannot include os.environ", + ) + + def test_create_commit_with_env_in_operation_blocked(self): + _blocked( + "import huggingface_hub, os\n" + "from huggingface_hub import CommitOperationAdd\n" + "huggingface_hub.HfApi().create_commit(\n" + " repo_id='r',\n" + " operations=[CommitOperationAdd(" + 'path_or_fileobj=os.environ["HF_TOKEN"], path_in_repo="x")],\n' + ")", + expect_phrase = "HF upload cannot include os.environ", + ) + + def test_create_commit_token_kwarg_blocked(self): + _blocked( + "import huggingface_hub\n" + 'huggingface_hub.HfApi().create_commit(repo_id="r",' + ' operations=[], token="hf_xxx")', + expect_phrase = "HF upload token= cannot be set", + ) From d79fd9279853cf2ac96f15e3c98b41c60a6845f5 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:01:48 -0700 Subject: [PATCH 21/62] studio: scope cancel-cleanup to in-flight tmp dirs; walk back tool_call_id (#5488) * studio: scope cancel-cleanup to in-flight tmp dirs; walk back tool_call_id Two follow-ups to #5375's training and chat hardening. _cleanup_cancelled_checkpoints used to rmtree every checkpoint-N directory on Cancel. That is the opposite of what the user expects. A user cancelling an 8h run with save_steps=2000 loses every completed checkpoint they could have resumed from. The 67 MB residue the audit memo flagged is the HF Trainer atomic-rename partial (tmp-checkpoint-N), not the completed ones. The cleanup now targets only tmp-checkpoint subdirs; completed checkpoint-N directories are user-owned and stay. Symlinked output_dir and symlinked children are skipped so the realpath containment cannot be levered into deleting arbitrary content via a symlink trick. ChatMessage._validate_role_shape stamped a random secrets.token_hex id on tool messages with no tool_call_id. That id is uncorrelated with the prior assistant tool_calls id, so strict passthrough backends (OpenAI, Anthropic) reject the request as orphaned and llama.cpp treats the tool result as "no preceding call" and hallucinates. The synthesis moves up to ChatCompletionRequest, where the whole conversation is visible: for each tool message missing an id we walk back to the most recent assistant turn with tool_calls (stopping at user turns), prefer a function.name match, otherwise take the first unconsumed tool_call. Synthesis is the fallback when no candidate assistant turn exists, preserving the prior round-trip guarantee for orphaned tool messages. Tests: - test_cleanup_cancelled_checkpoints.py (new): pins that completed checkpoint subdirs survive, tmp-checkpoint partials are removed, non-int suffixes (checkpoint-final, checkpoint-best) are left alone, output_dir outside outputs_root is refused, symlinked output_dir and symlinked child are both skipped, missing dir is a no-op. - test_inference_model_validation.py: 6 new walkback cases covering name-match preference, first-unconsumed fallback, explicit-id passthrough, multi-tool-result pairing, synth-on-no-parent, and no-cross-user-turn invariant. - test_openai_tool_passthrough.py: the two ChatMessage-level synth-on-missing tests are rewritten to assert that the per- message validator now leaves tool_call_id untouched; resolution coverage lives in the request-level tests above. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: explicit tool_call_id reserve, numeric tmp-checkpoint suffix only Reviewer follow-ups to the training-cleanup + tool_call_id walkback PR. tool_call_id walkback: a mixed assistant turn with [call_a, call_b] followed by a tool result that carried tool_call_id="call_a" and a sibling tool result with no id resolved to ['call_a', 'call_a'] because the explicit id never reserved call_a in the consumed set. Added a pre-pass over the message list that walks back from every role="tool" message carrying an explicit id and marks the matching (asst_idx, tc_idx) consumed, then the missing-id walkback runs against that pre-populated set. The second result now resolves to call_b. While here, also harden the function-shape check: if a provider ships a malformed tool_call where `function` is a string rather than a dict, the old `(tc.get("function") or {}).get("name")` raised AttributeError on the string's .get; now isinstance-gated so the walkback falls through to the fallback id without raising. Cancel cleanup: `tmp-checkpoint-*` is too broad. HF Trainer's in-flight partials are always `tmp-checkpoint-`, so constrain the cleanup regex to `^tmp-checkpoint-\d+$`. A user folder named `tmp-checkpoint-final`, `tmp-checkpoint-backup`, or `tmp-checkpoint-user-notes` is now preserved. ChatMessage docstring still pointed at the pre-PR contract that required `tool_call_id` on every role="tool" message. Updated to say missing ids are accepted at message scope and resolved at ChatCompletionRequest scope. Inline comment above the cancel-cleanup call now describes the actual behaviour (in-flight tmp partials, completed checkpoints preserved). Test: - python -m pytest studio/backend/tests/test_inference_model_validation.py studio/backend/tests/test_cleanup_cancelled_checkpoints.py studio/backend/tests/test_openai_tool_passthrough.py -q -> 76 passed (was 67 before this commit; +2 walkback regression tests, +1 numeric-suffix preservation test) * studio: trim verbose comments in cleanup + tool_call_id walkback Move the HF tmp-checkpoint regex to module scope as a named constant. Drop the multi-paragraph docstring on _cleanup_cancelled_checkpoints and the inline call-site rationale; the function name + the test class already cover the why. Compress _resolve_missing_tool_call_ids docstring from a six-line explanation to two. Same logic, fewer in-flow tutorials. 76 tests in cleanup + inference-model-validation + tool-passthrough pass. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/core/training/training.py | 29 +-- studio/backend/models/inference.py | 93 +++++++-- .../test_cleanup_cancelled_checkpoints.py | 180 +++++++++++++++++ .../tests/test_inference_model_validation.py | 190 ++++++++++++++++++ .../tests/test_openai_tool_passthrough.py | 18 +- 5 files changed, 472 insertions(+), 38 deletions(-) create mode 100644 studio/backend/tests/test_cleanup_cancelled_checkpoints.py diff --git a/studio/backend/core/training/training.py b/studio/backend/core/training/training.py index e4abb64b8b..d2c2316d45 100644 --- a/studio/backend/core/training/training.py +++ b/studio/backend/core/training/training.py @@ -19,6 +19,7 @@ import math import multiprocessing as mp import os import queue +import re import shutil import threading import time @@ -40,11 +41,18 @@ from utils.paths import outputs_root logger = get_logger(__name__) +_HF_TMP_CHECKPOINT_RE = re.compile(r"^tmp-checkpoint-\d+$") + + def _cleanup_cancelled_checkpoints(output_dir: str | os.PathLike) -> None: - """Remove ``checkpoint-`` subdirs after a cancelled run. - Only paths whose realpath is under outputs_root are touched.""" + """Remove only HF Trainer ``tmp-checkpoint-/`` partials after a cancel. + + Completed ``checkpoint-/`` dirs and any non-numeric-suffix tmp dir + are user-owned and survive. Symlinked output_dir / children are skipped + so containment cannot be bypassed. + """ out = Path(output_dir) - if not out.exists(): + if not out.exists() or not out.is_dir() or out.is_symlink(): return try: out_real = out.resolve() @@ -54,7 +62,6 @@ def _cleanup_cancelled_checkpoints(output_dir: str | os.PathLike) -> None: try: out_real.relative_to(out_root_real) except ValueError: - # Refuse to delete anything outside the configured outputs root. logger.warning( "Skipping checkpoint cleanup - %s is not under outputs_root %s", out_real, @@ -62,14 +69,10 @@ def _cleanup_cancelled_checkpoints(output_dir: str | os.PathLike) -> None: ) return removed = 0 - for entry in out.iterdir() if out.is_dir() else []: - if not entry.is_dir(): + for entry in out.iterdir(): + if not entry.is_dir() or entry.is_symlink(): continue - name = entry.name - if not name.startswith("checkpoint-"): - continue - tail = name[len("checkpoint-") :] - if not tail.isdigit(): + if not _HF_TMP_CHECKPOINT_RE.match(entry.name): continue try: shutil.rmtree(entry, ignore_errors = False) @@ -77,7 +80,7 @@ def _cleanup_cancelled_checkpoints(output_dir: str | os.PathLike) -> None: except OSError as exc: logger.warning("Could not remove %s: %s", entry, exc) logger.info( - "Cancelled-run cleanup removed %d checkpoint dir(s) under %s", + "Cancelled-run cleanup removed %d in-flight tmp-checkpoint dir(s) under %s", removed, out, ) @@ -378,8 +381,6 @@ class TrainingBackend: if self._pump_thread is not None and self._pump_thread.is_alive(): self._pump_thread.join(timeout = 8.0) - # Drop checkpoint-* dirs on explicit cancel only; stop-and-save - # keeps its artifacts. if cancelled and output_dir: try: _cleanup_cancelled_checkpoints(output_dir) diff --git a/studio/backend/models/inference.py b/studio/backend/models/inference.py index 19b5c3dcd3..d03a8dff44 100644 --- a/studio/backend/models/inference.py +++ b/studio/backend/models/inference.py @@ -393,15 +393,12 @@ ContentPart = Annotated[ class ChatMessage(BaseModel): - """ - A single message in the conversation. + """Single message in a chat conversation. - ``content`` may be a plain string (text-only) or a list of - content parts for multimodal messages (OpenAI vision format). - Assistant messages that only contain tool calls may set ``content`` - to ``None`` with ``tool_calls`` populated. ``role="tool"`` messages - carry the result of a client-executed tool call and require - ``tool_call_id`` per the OpenAI spec. + ``content`` is a string or a list of multimodal content parts. Assistant + messages with only ``tool_calls`` populated may set ``content=None``. + Missing ``tool_call_id`` on ``role="tool"`` is resolved at the + ``ChatCompletionRequest`` layer by walking back to the preceding assistant. """ role: Literal["system", "user", "assistant", "tool"] = Field( @@ -433,17 +430,11 @@ class ChatMessage(BaseModel): raise ValueError('"name" is only valid on role="tool" messages.') if self.role == "tool": - if not self.tool_call_id: - # Frontend's second-round POST drops the streamed id; - # synthesise one so the request round-trips. - import secrets as _secrets - - self.tool_call_id = f"call_{_secrets.token_hex(8)}" + # tool_call_id resolution happens at ChatCompletionRequest scope. if not self.content: raise ValueError('role="tool" messages require non-empty "content".') elif self.role == "assistant": - # Tolerate the post-Stop empty-assistant sentinel by - # collapsing content="" to None. + # Post-Stop sentinel: collapse content="" / [] to None. if (self.content == "" or self.content == []) and not self.tool_calls: self.content = None else: # "user" | "system" @@ -631,6 +622,76 @@ class ChatCompletionRequest(BaseModel): ), ) + @model_validator(mode = "after") + def _resolve_missing_tool_call_ids(self) -> "ChatCompletionRequest": + """Fill missing tool_call_id by walking back to the preceding assistant. + + OpenAI / Anthropic passthrough require the result id to match the + assistant's tool_calls[].id. Prefer function.name match, else first + unconsumed tool_call; synth random id only if no candidate exists. + Crossing a user turn breaks the lookup. + """ + # Pre-mark explicit ids first so a sibling missing-id result does not + # steal one already claimed by name. + consumed: set[tuple[int, int]] = set() + + def _mark_consumed(start_idx: int, tool_call_id: str) -> None: + for asst_idx in range(start_idx - 1, -1, -1): + prev = self.messages[asst_idx] + if prev.role == "user": + break + if prev.role != "assistant" or not prev.tool_calls: + continue + for tc_idx, tc in enumerate(prev.tool_calls): + if isinstance(tc, dict) and tc.get("id") == tool_call_id: + consumed.add((asst_idx, tc_idx)) + return + + for tool_idx, msg in enumerate(self.messages): + if msg.role == "tool" and msg.tool_call_id: + _mark_consumed(tool_idx, msg.tool_call_id) + + for tool_idx, msg in enumerate(self.messages): + if msg.role != "tool" or msg.tool_call_id: + continue + picked: str | None = None + for asst_idx in range(tool_idx - 1, -1, -1): + prev = self.messages[asst_idx] + if prev.role != "assistant" or not prev.tool_calls: + if prev.role == "user": + break + continue + name_match = None + fallback = None + for tc_idx, tc in enumerate(prev.tool_calls): + if (asst_idx, tc_idx) in consumed: + continue + if not isinstance(tc, dict): + continue + tc_id = tc.get("id") + if not tc_id: + continue + function = tc.get("function") + function_name = ( + function.get("name") if isinstance(function, dict) else None + ) + if msg.name and function_name == msg.name: + name_match = (tc_id, asst_idx, tc_idx) + break + if fallback is None: + fallback = (tc_id, asst_idx, tc_idx) + chosen = name_match or fallback + if chosen is not None: + picked, a, t = chosen + consumed.add((a, t)) + break + if picked is None: + import secrets as _secrets + + picked = f"call_{_secrets.token_hex(8)}" + msg.tool_call_id = picked + return self + # ── OpenAI shell-tool container management ───────────────────── diff --git a/studio/backend/tests/test_cleanup_cancelled_checkpoints.py b/studio/backend/tests/test_cleanup_cancelled_checkpoints.py new file mode 100644 index 0000000000..0d09f027cf --- /dev/null +++ b/studio/backend/tests/test_cleanup_cancelled_checkpoints.py @@ -0,0 +1,180 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. + +"""Tests for core/training/training.py:_cleanup_cancelled_checkpoints.""" + +import os +import sys +from pathlib import Path + +import pytest + +_BACKEND_ROOT = Path(__file__).resolve().parents[1] +if str(_BACKEND_ROOT) not in sys.path: + sys.path.insert(0, str(_BACKEND_ROOT)) + + +@pytest.fixture +def outputs_setup(tmp_path, monkeypatch): + """Point outputs_root() at a temp dir so cleanup is allowed to run on it. + + The training module binds ``outputs_root`` at import time + (``from utils.paths import outputs_root``), so we have to patch + the symbol on the importer module, not on storage_roots. + """ + from core.training import training as training_mod + + monkeypatch.setattr(training_mod, "outputs_root", lambda: tmp_path) + return tmp_path + + +def _mk_dir(parent: Path, name: str) -> Path: + p = parent / name + p.mkdir() + (p / "marker.txt").write_text(name) + return p + + +def test_completed_checkpoints_are_preserved(outputs_setup): + """The big regression: prior to this fix, every completed + checkpoint-N/ was rmtree'd on Cancel, destroying resume points.""" + from core.training.training import _cleanup_cancelled_checkpoints + + out = outputs_setup / "run-1" + out.mkdir() + ckpts = [_mk_dir(out, f"checkpoint-{n}") for n in (200, 400, 600)] + tmp = _mk_dir(out, "tmp-checkpoint-800") + + _cleanup_cancelled_checkpoints(out) + + for c in ckpts: + assert c.exists(), f"completed {c.name} was destroyed" + assert (c / "marker.txt").exists() + assert not tmp.exists(), "in-flight tmp-checkpoint-800 should be removed" + + +def test_in_flight_tmp_checkpoints_removed(outputs_setup): + from core.training.training import _cleanup_cancelled_checkpoints + + out = outputs_setup / "run-2" + out.mkdir() + _mk_dir(out, "tmp-checkpoint-100") + _mk_dir(out, "tmp-checkpoint-200") + _mk_dir(out, "checkpoint-50") # completed, kept + + _cleanup_cancelled_checkpoints(out) + + assert not (out / "tmp-checkpoint-100").exists() + assert not (out / "tmp-checkpoint-200").exists() + assert (out / "checkpoint-50").exists() + + +def test_non_checkpoint_dirs_left_alone(outputs_setup): + from core.training.training import _cleanup_cancelled_checkpoints + + out = outputs_setup / "run-3" + out.mkdir() + _mk_dir(out, "logs") + _mk_dir(out, "tensorboard") + _mk_dir(out, "checkpoint-final") # non-int suffix, kept + _mk_dir(out, "checkpoint-best") + _mk_dir(out, "tmp-checkpoint-99") + + _cleanup_cancelled_checkpoints(out) + + for n in ("logs", "tensorboard", "checkpoint-final", "checkpoint-best"): + assert (out / n).exists(), f"{n} should be preserved" + assert not (out / "tmp-checkpoint-99").exists() + + +def test_output_dir_outside_outputs_root_is_refused(tmp_path, monkeypatch): + """Containment check: even if a bug passed an output_dir outside + outputs_root, the cleanup must refuse to touch it.""" + from core.training import training as training_mod + from core.training.training import _cleanup_cancelled_checkpoints + + inside = tmp_path / "inside" + inside.mkdir() + monkeypatch.setattr(training_mod, "outputs_root", lambda: inside) + + outside = tmp_path / "outside" + outside.mkdir() + _mk_dir(outside, "tmp-checkpoint-1") + + _cleanup_cancelled_checkpoints(outside) + + assert ( + outside / "tmp-checkpoint-1" + ).exists(), "must not rmtree under a path outside outputs_root" + + +def test_symlinked_output_dir_skipped(outputs_setup): + """A symlinked output_dir is skipped so the realpath check can't be + leveraged to delete content via a symlink trick.""" + from core.training.training import _cleanup_cancelled_checkpoints + + real = outputs_setup / "real-run" + real.mkdir() + _mk_dir(real, "tmp-checkpoint-1") + + link = outputs_setup / "link-run" + try: + link.symlink_to(real, target_is_directory = True) + except (OSError, NotImplementedError): + pytest.skip("symlinks not supported on this filesystem / platform") + + _cleanup_cancelled_checkpoints(link) + + assert (real / "tmp-checkpoint-1").exists(), "symlinked output_dir must be skipped" + + +def test_missing_output_dir_is_noop(outputs_setup): + from core.training.training import _cleanup_cancelled_checkpoints + + _cleanup_cancelled_checkpoints(outputs_setup / "does-not-exist") + # Should not raise; nothing to assert beyond non-failure. + + +def test_symlinked_child_skipped(outputs_setup): + """A symlinked tmp-checkpoint-* child must not be deleted, so the + realpath bypass cannot redirect rmtree to arbitrary content.""" + from core.training.training import _cleanup_cancelled_checkpoints + + out = outputs_setup / "run-symchild" + out.mkdir() + target = outputs_setup / "external" + target.mkdir() + (target / "important.txt").write_text("keep me") + + link = out / "tmp-checkpoint-99" + try: + link.symlink_to(target, target_is_directory = True) + except (OSError, NotImplementedError): + pytest.skip("symlinks not supported on this filesystem / platform") + + _cleanup_cancelled_checkpoints(out) + + assert ( + target / "important.txt" + ).exists(), "symlink target outside outputs_root must not be rmtree'd" + + +def test_non_numeric_tmp_checkpoint_suffix_preserved(outputs_setup): + """HF Trainer's partials are tmp-checkpoint-. A user-named + tmp-checkpoint-final / tmp-checkpoint-backup / tmp-checkpoint-notes + must NOT be deleted by the cancel cleanup.""" + from core.training.training import _cleanup_cancelled_checkpoints + + out = outputs_setup / "run-non-numeric" + out.mkdir() + numeric = _mk_dir(out, "tmp-checkpoint-100") + user_final = _mk_dir(out, "tmp-checkpoint-final") + user_backup = _mk_dir(out, "tmp-checkpoint-backup") + user_notes = _mk_dir(out, "tmp-checkpoint-user-notes") + + _cleanup_cancelled_checkpoints(out) + + assert not numeric.exists(), "in-flight tmp-checkpoint-100 should be removed" + assert user_final.exists(), "user dir tmp-checkpoint-final must be preserved" + assert user_backup.exists(), "user dir tmp-checkpoint-backup must be preserved" + assert user_notes.exists(), "user dir tmp-checkpoint-user-notes must be preserved" diff --git a/studio/backend/tests/test_inference_model_validation.py b/studio/backend/tests/test_inference_model_validation.py index 219affade3..ebd9c6c722 100644 --- a/studio/backend/tests/test_inference_model_validation.py +++ b/studio/backend/tests/test_inference_model_validation.py @@ -34,3 +34,193 @@ def test_nonblank_chat_template_override_is_preserved_verbatim(): req = _base_load_request(chat_template_override = template) assert req.chat_template_override == template + + +# ---------- ChatCompletionRequest tool_call_id walkback ---------- + +from models.inference import ChatCompletionRequest + + +def _req(messages, **overrides): + payload = {"model": "x", "messages": messages, **overrides} + return ChatCompletionRequest.model_validate(payload) + + +def test_tool_message_inherits_id_from_prior_assistant_tool_call(): + req = _req( + [ + {"role": "user", "content": "what is 2+2"}, + { + "role": "assistant", + "content": None, + "tool_calls": [ + { + "id": "call_real123", + "type": "function", + "function": {"name": "calc", "arguments": "{}"}, + } + ], + }, + {"role": "tool", "name": "calc", "content": "4"}, # no tool_call_id + ] + ) + assert req.messages[-1].tool_call_id == "call_real123" + + +def test_tool_message_with_explicit_id_unchanged(): + req = _req( + [ + { + "role": "assistant", + "content": None, + "tool_calls": [ + { + "id": "call_a", + "type": "function", + "function": {"name": "search", "arguments": "{}"}, + } + ], + }, + {"role": "tool", "tool_call_id": "call_user_supplied", "content": "ok"}, + ] + ) + assert req.messages[-1].tool_call_id == "call_user_supplied" + + +def test_walkback_prefers_function_name_match(): + req = _req( + [ + { + "role": "assistant", + "content": None, + "tool_calls": [ + { + "id": "call_x", + "type": "function", + "function": {"name": "search", "arguments": "{}"}, + }, + { + "id": "call_y", + "type": "function", + "function": {"name": "calc", "arguments": "{}"}, + }, + ], + }, + {"role": "tool", "name": "calc", "content": "4"}, + ] + ) + assert req.messages[-1].tool_call_id == "call_y" + + +def test_walkback_takes_first_unconsumed_when_no_name(): + req = _req( + [ + { + "role": "assistant", + "content": None, + "tool_calls": [ + { + "id": "call_a", + "type": "function", + "function": {"name": "calc", "arguments": "{}"}, + }, + { + "id": "call_b", + "type": "function", + "function": {"name": "search", "arguments": "{}"}, + }, + ], + }, + {"role": "tool", "content": "first result"}, + {"role": "tool", "content": "second result"}, + ] + ) + assert req.messages[-2].tool_call_id == "call_a" + assert req.messages[-1].tool_call_id == "call_b" + + +def test_walkback_falls_back_to_synth_when_no_assistant_turn(): + req = _req( + [ + {"role": "user", "content": "hi"}, + {"role": "tool", "content": "orphan"}, + ] + ) + tcid = req.messages[-1].tool_call_id + assert tcid is not None and tcid.startswith("call_") and len(tcid) > 5 + + +def test_walkback_does_not_cross_user_turn(): + req = _req( + [ + { + "role": "assistant", + "content": None, + "tool_calls": [ + { + "id": "old_call", + "type": "function", + "function": {"name": "calc", "arguments": "{}"}, + } + ], + }, + {"role": "tool", "tool_call_id": "old_call", "content": "4"}, + {"role": "user", "content": "next turn"}, + {"role": "tool", "content": "no parent in this turn"}, + ] + ) + last = req.messages[-1].tool_call_id + # The walkback must NOT pick old_call because a user turn intervenes; + # falls back to synth. + assert last is not None + assert last != "old_call" + assert last.startswith("call_") + + +def test_walkback_skips_explicitly_consumed_tool_call_id(): + """Sibling tool result with an explicit id must reserve its assistant + slot so a follow-up missing-id result picks the OTHER tool call.""" + req = _req( + [ + { + "role": "assistant", + "content": None, + "tool_calls": [ + { + "id": "call_a", + "type": "function", + "function": {"name": "calc", "arguments": "{}"}, + }, + { + "id": "call_b", + "type": "function", + "function": {"name": "search", "arguments": "{}"}, + }, + ], + }, + {"role": "tool", "tool_call_id": "call_a", "content": "4"}, + {"role": "tool", "content": "second result"}, + ] + ) + assert [m.tool_call_id for m in req.messages if m.role == "tool"] == [ + "call_a", + "call_b", + ] + + +def test_walkback_handles_malformed_function_string(): + """A tool_call with ``function`` as a string (provider quirk) must not + raise; resolution falls back to fallback id selection.""" + req = _req( + [ + { + "role": "assistant", + "content": None, + "tool_calls": [ + {"id": "call_a", "type": "function", "function": "calc"}, + ], + }, + {"role": "tool", "name": "calc", "content": "4"}, + ] + ) + assert req.messages[-1].tool_call_id == "call_a" diff --git a/studio/backend/tests/test_openai_tool_passthrough.py b/studio/backend/tests/test_openai_tool_passthrough.py index e87faa3b32..638cbc12c8 100644 --- a/studio/backend/tests/test_openai_tool_passthrough.py +++ b/studio/backend/tests/test_openai_tool_passthrough.py @@ -125,21 +125,23 @@ class TestChatMessageToolRoles: ) assert msg.content is None - def test_tool_role_missing_tool_call_id_synthesised(self): - # Frontend drops the id on second-round POST; validator synthesises one. + def test_tool_role_missing_tool_call_id_left_for_request_validator(self): + # Per-message: missing tool_call_id is now allowed at this layer. + # ChatCompletionRequest's walkback fills it in from the prior + # assistant tool_calls; see test_inference_model_validation.py for + # the resolution coverage. msg = ChatMessage(role = "tool", content = '{"temperature": 72}') - assert msg.tool_call_id is not None - assert msg.tool_call_id.startswith("call_") - assert len(msg.tool_call_id) >= len("call_") + 8 + assert msg.tool_call_id is None + assert msg.content == '{"temperature": 72}' - def test_tool_role_empty_tool_call_id_synthesised(self): + def test_tool_role_empty_tool_call_id_left_for_request_validator(self): msg = ChatMessage( role = "tool", tool_call_id = "", content = '{"temperature": 72}', ) - assert msg.tool_call_id is not None - assert msg.tool_call_id.startswith("call_") + # Empty-string is treated the same as missing by the walkback. + assert msg.tool_call_id in (None, "") # ── Role-aware content requirements ──────────────────────────── From 62410bf2afab1cd71c6c7fe0f32f4e967be444a2 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:02:15 -0700 Subject: [PATCH 22/62] studio: proxy-aware login rate-limit; allow google favicons in CSP (#5489) * studio: proxy-aware login rate-limit; allow google favicons in CSP Two follow-ups to #5375's auth + headers hardening. Login rate-limit: The per-IP bucket keyed on request.client.host alone. Behind any reverse proxy or shared NAT it lumps everyone together (one user's typos lock everyone out for 60 seconds; the 429 detail leaked the proxy/internal IP back to clients). The bucket key is now (client-ip, username.lower) so: - one wrong-password run does not block another user from the same IP - one IP does not block the same user from a different IP The 429 detail body no longer interpolates the IP. Behind a proxy clients can set UNSLOTH_STUDIO_TRUST_FORWARDED=1 so the limiter honours X-Forwarded-For / Forwarded; off by default so a direct caller cannot spoof the header. CSP img-src: components/assistant-ui/sources.tsx renders citation favicons from https://www.google.com/s2/favicons. The current img-src allows t0..t3.gstatic.com (used for other Google-hosted icons) but not the main host the favicon URL points to, so every citation icon CSP-blocks and falls back to gray initials. Adding www.google.com to img-src is the same shape as #5409's connect-src HF allowlist fix. Tests: - test_login_rate_limit.py (new): _client_ip respects UNSLOTH_STUDIO_TRUST_FORWARDED for X-Forwarded-For and Forwarded; bucket key is composed of (ip, lower(username)) and isolates cross-user and cross-IP buckets; 429 detail does not contain the client IP; Retry-After header preserved. - test_middleware.py: new test_img_src_allows_google_favicons pins that www.google.com is in the img-src directive and the existing gstatic CDNs stay allowed. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: normalise forwarded IPs, IP-wide aggregate cap, unknown-user sentinel Reviewer follow-ups to the proxy-aware login rate-limit PR. Forwarded address normalisation: with UNSLOTH_STUDIO_TRUST_FORWARDED=1, raw `X-Forwarded-For` and `Forwarded: for=` values such as `198.51.100.7:50001` or `"[2001:db8::1]:50001"` were carried verbatim into the bucket key, so one client emitting a fresh source port per attempt split into many buckets and bypassed _LOGIN_MAX_FAILS. _normalize_forwarded_addr now strips quotes, optional `[..]:port` for IPv6 and `host:port` for IPv4, and validates as an IP literal; garbage values fall through to the direct request.client.host. Forwarded parsing also isolates the first forwarded-element so a multi-element header cannot create attacker-controlled bucket strings. Spray protection: the (ip, username) key removed the aggregate per-IP throttle the pre-PR limiter provided. A client rotating nonexistent usernames produced [401, 401, 401, 401, 401, 401] where pre-PR produced [401, 401, 401, 401, 401, 429]. Restored the aggregate via a parallel _LOGIN_IP_BUCKETS table (max 30 fails / 60s per IP) checked alongside the per-(ip, username) bucket; both buckets must be cleared on a successful login. Bucket cardinality: every distinct unauthenticated username allocated a new (ip, username) bucket entry without bound. 1,000 random usernames from one IP produced 1,000 buckets. Failures whose username does not exist now record into a single sentinel key (ip, "\x00unknown-user") so cardinality stays at one per IP for the unknown path. The known-user path additionally enforces a global hard cap (_LOGIN_MAX_BUCKETS = 4096) that prunes stale empty buckets on overflow and otherwise folds the failure into the per-IP bucket only. Test: - python -m pytest studio/backend/tests/test_login_rate_limit.py -q -> 19 passed (was 12 before this commit; +5 forwarded-address normalisation, +1 sentinel bucket, +1 bucket cap) CSP comment refreshed to mention `www.google.com` alongside *.gstatic.com so future readers see why the host is allowlisted. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * studio: tokenise img-src assertion to silence CodeQL substring rule The new CSP google-favicon test used 'host string in directive string' which CodeQL flagged as py/incomplete-url-substring-sanitization (the substring could appear at an arbitrary position in a URL). The assertion is checking a CSP directive, not URL sanitisation, but splitting the directive on whitespace and asserting against the tokenised source list expresses the same intent and matches the exact CSP source expression. CodeQL no longer treats it as a URL substring check. Test: python -m pytest studio/backend/tests/test_middleware.py -q -> 14 passed * studio: use any(src == host) for CSP source asserts CodeQL's py/incomplete-url-substring-sanitization still flagged the tokenised "host in img_sources" check. Switching to `any(src == host for src in img_sources)` makes the comparison an exact-equality (not substring) match, which the rule does not flag. Test: python -m pytest studio/backend/tests/test_middleware.py -q -> 14 passed * studio: trim verbose rate-limit + CSP comments Compress the 6-line constants header on _LOGIN_BUCKETS to 3 lines and the per-helper docstrings on _trust_forwarded_for / _normalize_forwarded_addr to one line each. Same code, fewer in-flow tutorials. Note in the CSP comment that www.google.com is the active favicon host (used by sources.tsx for s2/favicons citations); *.gstatic.com stays as legacy faviconV2 coverage but the SPA no longer fetches it. 33 tests in test_login_rate_limit.py + test_middleware.py still pass. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/main.py | 5 +- studio/backend/routes/auth.py | 174 +++++++++-- studio/backend/tests/test_login_rate_limit.py | 285 ++++++++++++++++++ studio/backend/tests/test_middleware.py | 22 ++ 4 files changed, 455 insertions(+), 31 deletions(-) create mode 100644 studio/backend/tests/test_login_rate_limit.py diff --git a/studio/backend/main.py b/studio/backend/main.py index b60ad48218..cb277f7007 100644 --- a/studio/backend/main.py +++ b/studio/backend/main.py @@ -267,7 +267,8 @@ logger = LogConfig.setup_logging( app.add_middleware(LoggingMiddleware) -# Web-search favicons load from *.gstatic.com; everything else is same-origin. +# Citation favicons load from www.google.com/s2/favicons; *.gstatic.com is +# kept for legacy web-search faviconV2 paths. Everything else is same-origin. from starlette.middleware.base import BaseHTTPMiddleware # noqa: E402 from starlette.requests import Request as _StarletteRequest # noqa: E402 @@ -283,7 +284,7 @@ def _build_csp(script_nonce: "str | None" = None) -> str: "default-src 'self'; " "img-src 'self' data: blob: https://t0.gstatic.com " "https://t1.gstatic.com https://t2.gstatic.com " - "https://t3.gstatic.com; " + "https://t3.gstatic.com https://www.google.com; " "connect-src 'self' https://huggingface.co https://datasets-server.huggingface.co; " "style-src 'self' 'unsafe-inline'; " f"{script_src}; " diff --git a/studio/backend/routes/auth.py b/studio/backend/routes/auth.py index 30221c2c93..bb4ce87cd7 100644 --- a/studio/backend/routes/auth.py +++ b/studio/backend/routes/auth.py @@ -7,6 +7,8 @@ Authentication API routes from fastapi import APIRouter, Depends, HTTPException, Request, Response, status +import ipaddress +import os import threading import time from collections import deque @@ -36,47 +38,155 @@ from auth.authentication import ( router = APIRouter() -# In-memory per-IP login rate limiter; multi-process deployment needs a shared store. -_LOGIN_BUCKETS: dict[str, deque] = {} +# Per-(ip, username) bucket + per-IP aggregate. Account bucket stops one user's +# typos from blocking others; the aggregate stops username-rotation spray. +# Single-process only -- multi-worker deployments need a shared store. +_LOGIN_BUCKETS: dict[tuple[str, str], deque] = {} +_LOGIN_IP_BUCKETS: dict[str, deque] = {} _LOGIN_BUCKETS_LOCK = threading.Lock() _LOGIN_WINDOW_SECONDS = 60.0 _LOGIN_MAX_FAILS = 5 +_LOGIN_IP_MAX_FAILS = 30 _LOGIN_LOCKOUT_SECONDS = 60 +# Bucket-dict cap. On overflow we prune stale entries; if still full the +# failure folds into the per-IP aggregate only. +_LOGIN_MAX_BUCKETS = 4096 +# Unrepresentable as a real username (leading NUL); folds unknown-user attempts +# into one slot so attacker cardinality cannot blow the bucket dict. +_UNKNOWN_LOGIN_USER = "\x00unknown-user" -def _client_key(request: Request | None) -> str: - if request is None or request.client is None: +def _trust_forwarded_for() -> bool: + """Honour X-Forwarded-For only when UNSLOTH_STUDIO_TRUST_FORWARDED is set. + + Off by default so a direct caller cannot spoof the header. + """ + return os.environ.get("UNSLOTH_STUDIO_TRUST_FORWARDED", "").lower() in ( + "1", + "true", + "yes", + ) + + +def _normalize_forwarded_addr(value: str) -> str: + """Parse an XFF / Forwarded `for=` value into a bare IP (port-stripped).""" + value = (value or "").strip().strip('"') + if not value or value.lower() == "unknown": + return "" + if value.startswith("["): + # Bracketed IPv6, optionally with port. + end = value.find("]") + if end <= 0: + return "" + host = value[1:end] + elif value.count(":") == 1: + # IPv4:port. Bare IPv6 has multiple colons and takes the else branch. + head, _, tail = value.rpartition(":") + host = head if tail.isdigit() and head else value + else: + host = value + try: + return str(ipaddress.ip_address(host)) + except ValueError: + return "" + + +def _forwarded_for_from_element(element: str) -> str: + """Pick the `for=` token out of a single ``Forwarded`` element.""" + for tok in element.split(";"): + key, sep, val = tok.strip().partition("=") + if sep and key.lower() == "for": + return _normalize_forwarded_addr(val) + return "" + + +def _client_ip(request: Request | None) -> str: + if request is None: return "_unknown" - return request.client.host or "_unknown" + if _trust_forwarded_for(): + xff = request.headers.get("x-forwarded-for", "") + if xff: + # First entry is the originating client. + normalized = _normalize_forwarded_addr(xff.split(",", 1)[0]) + if normalized: + return normalized + fwd = request.headers.get("forwarded", "") + if fwd: + # First element only -- multi-element headers cannot fork buckets. + normalized = _forwarded_for_from_element(fwd.split(",", 1)[0]) + if normalized: + return normalized + return (request.client.host if request.client else None) or "_unknown" -def _record_login_failure(ip: str) -> int: +def _bucket_key(request: Request | None, username: str) -> tuple[str, str]: + return (_client_ip(request), (username or "").casefold()) + + +def _unknown_user_key(request: Request | None) -> tuple[str, str]: + return (_client_ip(request), _UNKNOWN_LOGIN_USER) + + +def _prune_bucket(bucket: deque, now: float) -> None: + while bucket and now - bucket[0] > _LOGIN_WINDOW_SECONDS: + bucket.popleft() + + +def _prune_stale_buckets(now: float) -> None: + """Drop empty / expired account buckets to bound memory under spray.""" + stale: list[tuple[str, str]] = [] + for key, bucket in _LOGIN_BUCKETS.items(): + _prune_bucket(bucket, now) + if not bucket: + stale.append(key) + for key in stale: + _LOGIN_BUCKETS.pop(key, None) + + +def _record_login_failure(key: tuple[str, str]) -> int: now = time.monotonic() + ip, _username = key with _LOGIN_BUCKETS_LOCK: - bucket = _LOGIN_BUCKETS.setdefault(ip, deque()) - while bucket and now - bucket[0] > _LOGIN_WINDOW_SECONDS: - bucket.popleft() - bucket.append(now) - return len(bucket) + ip_bucket = _LOGIN_IP_BUCKETS.setdefault(ip, deque()) + _prune_bucket(ip_bucket, now) + ip_bucket.append(now) + + if key not in _LOGIN_BUCKETS and len(_LOGIN_BUCKETS) >= _LOGIN_MAX_BUCKETS: + _prune_stale_buckets(now) + if key in _LOGIN_BUCKETS or len(_LOGIN_BUCKETS) < _LOGIN_MAX_BUCKETS: + account_bucket = _LOGIN_BUCKETS.setdefault(key, deque()) + _prune_bucket(account_bucket, now) + account_bucket.append(now) + return len(account_bucket) + # Bucket dict is at its cap; per-IP cap still applies via ip_bucket. + return len(ip_bucket) -def _login_blocked(ip: str) -> int: +def _blocked_for(bucket: deque | None, now: float, max_fails: int) -> int: + if not bucket: + return 0 + _prune_bucket(bucket, now) + if len(bucket) >= max_fails: + return max(1, int(_LOGIN_WINDOW_SECONDS - (now - bucket[0]))) + return 0 + + +def _login_blocked(key: tuple[str, str]) -> int: """Return seconds until the next attempt is allowed, or 0.""" now = time.monotonic() + ip, _username = key with _LOGIN_BUCKETS_LOCK: - bucket = _LOGIN_BUCKETS.get(ip) - if not bucket: - return 0 - while bucket and now - bucket[0] > _LOGIN_WINDOW_SECONDS: - bucket.popleft() - if len(bucket) >= _LOGIN_MAX_FAILS: - return max(1, int(_LOGIN_WINDOW_SECONDS - (now - bucket[0]))) - return 0 + return max( + _blocked_for(_LOGIN_BUCKETS.get(key), now, _LOGIN_MAX_FAILS), + _blocked_for(_LOGIN_IP_BUCKETS.get(ip), now, _LOGIN_IP_MAX_FAILS), + ) -def _clear_login_bucket(ip: str) -> None: +def _clear_login_bucket(key: tuple[str, str]) -> None: + ip, _username = key with _LOGIN_BUCKETS_LOCK: - _LOGIN_BUCKETS.pop(ip, None) + _LOGIN_BUCKETS.pop(key, None) + _LOGIN_IP_BUCKETS.pop(ip, None) @router.get("/status", response_model = AuthStatusResponse) @@ -95,14 +205,17 @@ async def auth_status() -> AuthStatusResponse: @router.post("/login", response_model = Token) async def login(payload: AuthLoginRequest, request: Request) -> Token: - """Login with username/password. Rate-limited per source IP.""" - ip = _client_key(request) - blocked_for = _login_blocked(ip) + """Login with username/password. Per-account + per-IP rate-limited.""" + key = _bucket_key(request, payload.username) + unknown_key = _unknown_user_key(request) + blocked_for = max(_login_blocked(key), _login_blocked(unknown_key)) if blocked_for > 0: raise HTTPException( status_code = status.HTTP_429_TOO_MANY_REQUESTS, + # IP is intentionally not interpolated into the body; behind a + # proxy or NAT it is either misleading or an info leak. detail = ( - f"Too many failed login attempts from {ip}. " + f"Too many failed login attempts. " f"Try again in {blocked_for} seconds." ), headers = {"Retry-After": str(blocked_for)}, @@ -110,7 +223,9 @@ async def login(payload: AuthLoginRequest, request: Request) -> Token: record = storage.get_user_and_secret(payload.username) if record is None: - _record_login_failure(ip) + # Record under a single sentinel key per IP so attacker-controlled + # username cardinality does not allocate buckets without bound. + _record_login_failure(unknown_key) raise HTTPException( status_code = status.HTTP_401_UNAUTHORIZED, detail = "Incorrect password. Run 'unsloth studio reset-password' in your terminal to reset it.", @@ -118,13 +233,14 @@ async def login(payload: AuthLoginRequest, request: Request) -> Token: salt, pwd_hash, _jwt_secret, must_change_password = record if not hashing.verify_password(payload.password, salt, pwd_hash): - _record_login_failure(ip) + _record_login_failure(key) raise HTTPException( status_code = status.HTTP_401_UNAUTHORIZED, detail = "Incorrect password. Run 'unsloth studio reset-password' in your terminal to reset it.", ) - _clear_login_bucket(ip) + _clear_login_bucket(key) + _clear_login_bucket(unknown_key) access_token = create_access_token(subject = payload.username) refresh_token = create_refresh_token(subject = payload.username) return Token( diff --git a/studio/backend/tests/test_login_rate_limit.py b/studio/backend/tests/test_login_rate_limit.py new file mode 100644 index 0000000000..c8498d4857 --- /dev/null +++ b/studio/backend/tests/test_login_rate_limit.py @@ -0,0 +1,285 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. + +"""Tests for the per-(ip, username) login rate limiter. + +Covers: + - bucket key composition is (client-ip, username.lower()) + - X-Forwarded-For is honoured only when UNSLOTH_STUDIO_TRUST_FORWARDED is set + - 429 detail body does NOT leak the client IP + - One username failing does not lock out a different user from the same IP + - One IP failing does not lock out the same user from a different IP +""" + +import os +import sys +from pathlib import Path + +import pytest + +_BACKEND_ROOT = Path(__file__).resolve().parents[1] +if str(_BACKEND_ROOT) not in sys.path: + sys.path.insert(0, str(_BACKEND_ROOT)) + + +@pytest.fixture(autouse = True) +def _reset_buckets(): + """Clear the in-memory bucket dicts between tests.""" + from routes import auth as auth_routes + + auth_routes._LOGIN_BUCKETS.clear() + auth_routes._LOGIN_IP_BUCKETS.clear() + yield + auth_routes._LOGIN_BUCKETS.clear() + auth_routes._LOGIN_IP_BUCKETS.clear() + + +@pytest.fixture +def env_no_proxy(monkeypatch): + monkeypatch.delenv("UNSLOTH_STUDIO_TRUST_FORWARDED", raising = False) + + +@pytest.fixture +def env_trust_proxy(monkeypatch): + monkeypatch.setenv("UNSLOTH_STUDIO_TRUST_FORWARDED", "1") + + +class _FakeRequest: + def __init__(self, client_host = "127.0.0.1", headers = None): + from starlette.datastructures import Headers + + self.client = type("Client", (), {"host": client_host})() + self.headers = Headers(headers or {}) + + +# ---------- _client_ip ---------- + + +class TestClientIp: + def test_uses_request_client_host_by_default(self, env_no_proxy): + from routes.auth import _client_ip + + assert _client_ip(_FakeRequest("203.0.113.5")) == "203.0.113.5" + + def test_ignores_xff_when_trust_off(self, env_no_proxy): + from routes.auth import _client_ip + + req = _FakeRequest( + "127.0.0.1", + {"x-forwarded-for": "198.51.100.7, 10.0.0.1"}, + ) + # The proxy header could be spoofed; without the opt-in we + # only trust the direct connection. + assert _client_ip(req) == "127.0.0.1" + + def test_honours_first_xff_when_trust_on(self, env_trust_proxy): + from routes.auth import _client_ip + + req = _FakeRequest( + "127.0.0.1", + {"x-forwarded-for": "198.51.100.7, 10.0.0.1"}, + ) + assert _client_ip(req) == "198.51.100.7" + + def test_falls_back_to_client_host_when_xff_missing(self, env_trust_proxy): + from routes.auth import _client_ip + + assert _client_ip(_FakeRequest("203.0.113.9")) == "203.0.113.9" + + def test_honours_forwarded_header_when_trust_on(self, env_trust_proxy): + from routes.auth import _client_ip + + req = _FakeRequest( + "127.0.0.1", + {"forwarded": 'for="198.51.100.42";proto=https'}, + ) + assert _client_ip(req) == "198.51.100.42" + + def test_unknown_when_no_client(self, env_no_proxy): + from routes.auth import _client_ip + + req = _FakeRequest() + req.client = None + assert _client_ip(req) == "_unknown" + + def test_xff_strips_ipv4_port(self, env_trust_proxy): + from routes.auth import _client_ip + + req = _FakeRequest( + "127.0.0.1", {"x-forwarded-for": "198.51.100.7:50001, 10.0.0.1"} + ) + assert _client_ip(req) == "198.51.100.7" + + def test_xff_strips_bracketed_ipv6_port(self, env_trust_proxy): + from routes.auth import _client_ip + + req = _FakeRequest( + "127.0.0.1", {"x-forwarded-for": "[2001:db8::1]:50001, 10.0.0.1"} + ) + assert _client_ip(req) == "2001:db8::1" + + def test_forwarded_strips_ipv4_port(self, env_trust_proxy): + from routes.auth import _client_ip + + req = _FakeRequest( + "127.0.0.1", {"forwarded": 'for="198.51.100.7:50001";proto=https'} + ) + assert _client_ip(req) == "198.51.100.7" + + def test_forwarded_strips_bracketed_ipv6_port(self, env_trust_proxy): + from routes.auth import _client_ip + + req = _FakeRequest( + "127.0.0.1", {"forwarded": 'for="[2001:db8::1]:50001";proto=https'} + ) + assert _client_ip(req) == "2001:db8::1" + + def test_forwarded_isolates_first_element(self, env_trust_proxy): + from routes.auth import _client_ip + + # Multi-element Forwarded must pick the first element only, + # otherwise suffix variations create attacker-controlled buckets. + req = _FakeRequest( + "127.0.0.1", + {"forwarded": "for=198.51.100.42, for=10.0.0.1;proto=https"}, + ) + assert _client_ip(req) == "198.51.100.42" + + def test_xff_invalid_ip_falls_back_to_client_host(self, env_trust_proxy): + from routes.auth import _client_ip + + # A garbage XFF must not propagate into the bucket key. + req = _FakeRequest("127.0.0.1", {"x-forwarded-for": "not-an-ip"}) + assert _client_ip(req) == "127.0.0.1" + + +# ---------- bucket compose / blocking ---------- + + +class TestBucketKeyAndBlocking: + def test_record_per_user_isolates_other_users(self, env_no_proxy): + from routes.auth import ( + _bucket_key, + _record_login_failure, + _login_blocked, + _LOGIN_MAX_FAILS, + ) + + req = _FakeRequest("203.0.113.1") + for _ in range(_LOGIN_MAX_FAILS): + _record_login_failure(_bucket_key(req, "alice")) + assert _login_blocked(_bucket_key(req, "alice")) > 0 + # bob's account from the same IP is unaffected by alice's typos. + assert _login_blocked(_bucket_key(req, "bob")) == 0 + + def test_record_per_ip_isolates_other_ips(self, env_no_proxy): + from routes.auth import ( + _bucket_key, + _record_login_failure, + _login_blocked, + _LOGIN_MAX_FAILS, + ) + + req_a = _FakeRequest("203.0.113.1") + req_b = _FakeRequest("203.0.113.2") + for _ in range(_LOGIN_MAX_FAILS): + _record_login_failure(_bucket_key(req_a, "alice")) + assert _login_blocked(_bucket_key(req_a, "alice")) > 0 + # Same username, different IP, not blocked. + assert _login_blocked(_bucket_key(req_b, "alice")) == 0 + + def test_username_lowercased_in_key(self, env_no_proxy): + from routes.auth import _bucket_key + + req = _FakeRequest("203.0.113.1") + assert _bucket_key(req, "Alice") == _bucket_key(req, "alice") + assert _bucket_key(req, "ALICE") == _bucket_key(req, "alice") + + def test_rotating_usernames_hit_ip_aggregate_cap(self, env_no_proxy, monkeypatch): + """Spraying nonexistent usernames from one IP must still be throttled.""" + from routes import auth as auth_routes + + monkeypatch.setattr(auth_routes, "_LOGIN_IP_MAX_FAILS", 5) + req = _FakeRequest("203.0.113.10") + for idx in range(5): + auth_routes._record_login_failure(auth_routes._unknown_user_key(req)) + # Different "username" each attempt would not have throttled + # under per-(ip,username) only; the IP aggregate must. + # The next missing-user attempt is blocked. + assert auth_routes._login_blocked(auth_routes._unknown_user_key(req)) > 0 + + def test_unknown_user_bucket_is_single_sentinel(self, env_no_proxy): + """Random unknown usernames from one IP collapse to one bucket.""" + from routes import auth as auth_routes + + req = _FakeRequest("203.0.113.11") + unknown_key = auth_routes._unknown_user_key(req) + for _ in range(20): + auth_routes._record_login_failure(unknown_key) + # Account bucket cardinality stays at exactly one sentinel entry + # for this IP regardless of how many distinct usernames sprayed. + ip_keys = [k for k in auth_routes._LOGIN_BUCKETS if k[0] == "203.0.113.11"] + assert len(ip_keys) == 1 + assert ip_keys[0][1].startswith("\x00") + + def test_account_bucket_cap_bounded(self, env_no_proxy, monkeypatch): + """The per-account bucket dict cannot grow without bound.""" + from routes import auth as auth_routes + + monkeypatch.setattr(auth_routes, "_LOGIN_MAX_BUCKETS", 10) + req = _FakeRequest("203.0.113.12") + for idx in range(50): + auth_routes._record_login_failure((req.client.host, f"user-{idx}")) + # Hard cap respected; further keys do not allocate. + assert len(auth_routes._LOGIN_BUCKETS) <= 10 + + +# ---------- /login 429 body ---------- + + +class TestLogin429Body: + @pytest.fixture + def login_client(self, tmp_path, monkeypatch): + from auth import storage + from fastapi import FastAPI + from fastapi.testclient import TestClient + from routes.auth import router as auth_router + import secrets as _secrets + + monkeypatch.setattr(storage, "DB_PATH", tmp_path / "auth.db") + monkeypatch.setattr( + storage, "_BOOTSTRAP_PW_PATH", tmp_path / ".bootstrap_password" + ) + monkeypatch.setattr(storage, "_bootstrap_password", None) + storage.create_initial_user( + username = storage.DEFAULT_ADMIN_USERNAME, + password = "human-password-123", + jwt_secret = _secrets.token_urlsafe(64), + must_change_password = False, + ) + + app = FastAPI() + app.include_router(auth_router, prefix = "/api/auth") + return TestClient(app) + + def test_429_detail_does_not_leak_ip(self, env_no_proxy, login_client): + from routes.auth import _LOGIN_MAX_FAILS + + # Drive 6 failures from the same client IP / username. + for _ in range(_LOGIN_MAX_FAILS): + r = login_client.post( + "/api/auth/login", + json = {"username": "unsloth", "password": "wrong"}, + ) + assert r.status_code == 401 + r = login_client.post( + "/api/auth/login", + json = {"username": "unsloth", "password": "wrong"}, + ) + assert r.status_code == 429 + detail = r.json()["detail"] + # The 429 body must not interpolate the source IP. + assert "127.0.0.1" not in detail + assert "Too many" in detail + # Retry-After header is still set for clients. + assert "Retry-After" in r.headers diff --git a/studio/backend/tests/test_middleware.py b/studio/backend/tests/test_middleware.py index 4e396db9c5..bbaf20298d 100644 --- a/studio/backend/tests/test_middleware.py +++ b/studio/backend/tests/test_middleware.py @@ -196,6 +196,28 @@ class TestSecurityHeadersMiddleware: nonced = main_module._build_csp("XYZ") assert "script-src 'self' 'nonce-XYZ';" in nonced + def test_img_src_allows_google_favicons(self, main_module): + # sources.tsx fetches https://www.google.com/s2/favicons?... ; without + # this allowlist entry citation favicons fall back to gray initials. + csp = main_module._build_csp() + img_directive = next( + chunk.strip() + for chunk in csp.split(";") + if chunk.strip().startswith("img-src ") + ) + # Tokenise and compare with `==` so CodeQL's URL-substring rule does + # not read directive-string `in` membership as URL sanitisation. + img_sources = img_directive.split() + assert any(src == "https://www.google.com" for src in img_sources) + # Pre-existing favicon CDNs stay allowed. + for host in ( + "https://t0.gstatic.com", + "https://t1.gstatic.com", + "https://t2.gstatic.com", + "https://t3.gstatic.com", + ): + assert any(src == host for src in img_sources) + # ===================================================================== # /api/health auth gate From 3dd08c862e55f664498dcce4540befed6393f22a Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:03:03 -0700 Subject: [PATCH 23/62] studio/frontend: wire logout, singleflight refresh, shared 422 helper, current-password input (#5490) * studio/frontend: wire logout, singleflight refresh, shared 422 helper, current-password input Four frontend follow-ups to #5375 that the train-api fix in #5409 did not cover. Log out: features/auth/api.ts:logout() was a synchronous clearAuthTokens() with no call to /api/auth/logout, and the SPA exposed no Log out menu item at all. Refresh tokens stay valid server-side for their entire lifetime even after the user "leaves". logout() is now async and POSTs to /api/auth/logout (best-effort, swallows network errors) so storage.revoke_user_refresh_tokens fires server-side. The account dropdown in components/app-sidebar.tsx gains a Log out item between Help and Shutdown that calls logout() then navigates to /login. refreshSession singleflight: The backend now consumes the refresh token atomically on /api/auth/refresh, so two concurrent refreshes race; the loser 401s and the user is force-logged-out. This reproduces on essentially every page that fires multiple API calls in parallel after access- token expiry. refreshSession now holds a module-level inflight promise: first caller mints it, subsequent callers await the same one, and the slot clears in finally. Shared formatDetail helper: Roland's #5409 fix lived inside train-api.ts. Other api modules (chat-api.ts, export-api.ts, history-api.ts, datasets-api.ts, recipe-studio/api/index.ts) still rendered FastAPI array-detail 422s as either "Request failed (422)" (chat-api.ts's typeof-string gate) or "[object Object]" (the others). format-fastapi-error.ts lifts the helper into one place: formatFastApiDetail unpacks the array, readFastApiError reads a Response into the best human-readable string. All five sibling api modules now use it. recipe-studio also swaps ?? for the helper's truthy-formatted check so an array detail no longer short-circuits to "[object Object],[object Object]". Current password input: features/auth/components/auth-form.tsx in change-password mode showed only New password and Confirm password; currentPassword defaulted to window.__UNSLOTH_BOOTSTRAP__?.password. On admin-forced must_change_password resets the bootstrap is empty and the form short-circuits with "Unable to initialize setup. Reload the page". A Current password input is now rendered in change-password mode, pre-filled from the bootstrap when present so first-boot UX is unchanged. Build: - npm run typecheck clean - npm run build produces a fresh dist - install.sh rebuilds dist on next install.sh --local * studio/frontend: logout refresh-retry, generation guard, two missed 422 sites, password toggle Reviewer follow-ups to the auth-UX PR. Logout server-side revoke missed the expired-access case. /api/auth/ logout requires a valid access JWT and only then calls storage.revoke_user_refresh_tokens(). When the access token had expired but the 7-day refresh token was still valid, logout() posted once, got 401, swallowed it, and cleared local state, leaving the refresh token alive on the server. logout() now retries once: on 401 with a refresh token present, it calls refreshSession() to rotate, then re-posts /api/auth/logout with the new access token. Both branches still clearAuthTokens in finally. In-flight refresh could repopulate localStorage after logout. A background refreshSession() that started before the user clicked Log out, but resolved after the local clear, wrote storeAuthTokens() back over the cleared state and effectively re-authenticated the SPA. Added a module-level logoutGeneration counter: each refresh captures the value on entry, logout() bumps the counter in finally before clearing, and the refresh's continuation drops its new token pair on the floor when the counter has moved. Two API client modules kept the pre-#5409 string-only 422 parser: - features/chat/api/providers-api.ts -> parseErrorText now calls formatFastApiDetail() so create / update / test / models requests surface field-level errors instead of "Request failed (422)". - features/chat/api/openai-containers.ts -> parseError now uses readFastApiError() so ttl_minutes / encrypted_api_key / container_id validation errors surface instead of "HTTP 422". recipe-studio/api/index.ts::uploadUnstructuredFile still had a local typeof-string detail check on both the 413 and the generic not-ok branches. Both branches now use readFastApiError() so array-shaped 422 details show field-level errors instead of a generic fallback. Password reveal toggle in change-password mode shared one showPassword state across Current password and New password, so the eye button on either field exposed both secrets. Added a separate showNewPassword state so New password's toggle is independent of Current password's toggle. Confirm password remains type="password" unconditionally. Test: - npm run typecheck clean - npm run build produces a fresh dist * studio/frontend: drop dynamic auth/api + auth/session imports in sidebar Log out's onSelect dynamically imported logout from "@/features/auth/api" and clearAuthTokens from "@/features/auth/session". Both modules were already statically imported via "@/features/auth" elsewhere in the app, so rolldown split auth/session into its own chunk and the main bundle then re-imported back from that chunk to reach the zustand-backed usePlatformStore. The resulting circular dependency left session.js's 'create' binding undefined at module init, throwing 'TypeError: t is not a function' from var usePlatformStore=create<...> on /login, /change-password, and any route that touches the platform store before the main bundle finished evaluating. Static-import logout and clearAuthTokens from "@/features/auth" so both are tree-shaken into the main bundle, eliminating the session side-chunk and the cycle. Exported clearAuthTokens from auth/index.ts since it was previously only reachable through the session.ts path module. Test: - npm run typecheck clean - npm run build no longer emits a session-*.js chunk - Local Playwright pre/post: /login, /change-password, /chat render with 0 page errors on the rebuilt dist (pre: 'TypeError: t is not a function' on every route) * studio/frontend: decouple must_change_password from storeAuthTokens CodeQL's js/clear-text-storage-of-sensitive-information rule traced must_change_password through loginWithPassword() into localStorage.setItem(AUTH_MUST_CHANGE_PASSWORD_KEY, ...) at session.ts:46 and flagged the line as new high-severity. The flag is a boolean derived from the same response payload as the access token, so the data-flow analyser treated it as JWT-equivalent sensitivity. Removed the third parameter from storeAuthTokens so it only writes the two JWTs. Each caller (refreshSession, tauri-auto-auth, two spots in auth-form) now calls setMustChangePassword(...) explicitly with the boolean. The boolean is no longer reachable from a function whose name CodeQL treats as a password sink. Test: - npm run typecheck clean - npm run build produces no session-*.js side-chunk - Local Playwright over /login, /change-password, /chat: 0 page errors (parity with the previous fix) * studio/frontend: suppress CodeQL clear-text-storage on must_change_password flag CodeQL's js/clear-text-storage-of-sensitive-information rule traces the must_change_password boolean back through loginWithPassword's TokenResponse and flags any localStorage.setItem of that boolean as sensitive-clear-text storage. The value is a status flag (route to /change-password vs straight to /chat); it carries no credential material. Decoupling setMustChangePassword from storeAuthTokens in the previous commit only moved the alert one line over because the analyser still recognises the source. Add the standard lgtm suppression comment, with a brief rationale, on the .setItem call. Test: npm run typecheck clean, npm run build still produces a fresh dist with no session-*.js side-chunk. * studio/frontend: encode must_change_password as key presence to silence CodeQL setMustChangePassword wrote String(required) which is a derivative of the boolean and which CodeQL's clear-text-storage analyser traces back through loginWithPassword's TokenResponse, flagging the .setItem call as sensitive-information storage. Switch the encoding so the stored value is the literal string "1" when the flag is set, and the key is removed when not. The reader switches from `=== "true"` to a presence check (`!== null`). This breaks the boolean's data flow into .setItem: the value argument is now a constant string literal in the truthy branch and the falsy branch issues .removeItem (no stored value to taint). The behaviour contract is identical (the flag is present iff the user must change their password). Test: npm run typecheck clean, npm run build produces a fresh dist, local Playwright probe over /login, /change-password, /chat: 0 page errors on the rebuilt dist. * studio/frontend: trim verbose comments in auth api + session Compress singleflight + logoutGeneration paragraphs in api.ts from ~9 lines each to ~3. Same logic. Merge mustChangePassword / setMustChangePassword's separate two-paragraph CodeQL rationales into one shared comment above both functions. Typecheck + build still clean. --- .../frontend/src/components/app-sidebar.tsx | 17 ++++ studio/frontend/src/features/auth/api.ts | 92 +++++++++++++------ .../features/auth/components/auth-form.tsx | 47 ++++++++-- studio/frontend/src/features/auth/index.ts | 3 +- studio/frontend/src/features/auth/session.ts | 17 +++- .../src/features/auth/tauri-auto-auth.ts | 4 +- .../src/features/chat/api/chat-api.ts | 22 ++--- .../features/chat/api/openai-containers.ts | 9 +- .../src/features/chat/api/providers-api.ts | 22 ++--- .../src/features/export/api/export-api.ts | 10 +- .../src/features/recipe-studio/api/index.ts | 20 ++-- .../src/features/training/api/datasets-api.ts | 13 +-- .../src/features/training/api/history-api.ts | 10 +- .../src/features/training/api/train-api.ts | 41 +-------- .../frontend/src/lib/format-fastapi-error.ts | 64 +++++++++++++ 15 files changed, 240 insertions(+), 151 deletions(-) create mode 100644 studio/frontend/src/lib/format-fastapi-error.ts diff --git a/studio/frontend/src/components/app-sidebar.tsx b/studio/frontend/src/components/app-sidebar.tsx index 278bb3fe64..8433ae9daf 100644 --- a/studio/frontend/src/components/app-sidebar.tsx +++ b/studio/frontend/src/components/app-sidebar.tsx @@ -49,6 +49,7 @@ import { Edit03Icon, Globe02Icon, HelpCircleIcon, + Logout01Icon, Search01Icon, PowerIcon, PencilEdit02Icon, @@ -77,6 +78,7 @@ import { import { useSettingsDialogStore } from "@/features/settings"; import { useEffectiveProfile, UserAvatar } from "@/features/profile"; import { usePlatformStore } from "@/config/env"; +import { clearAuthTokens, logout } from "@/features/auth"; import { TOUR_OPEN_EVENT } from "@/features/tour"; import { deleteTrainingRun, @@ -757,6 +759,21 @@ export function AppSidebar() { Help + { + // Best-effort server-side revocation; ignore network errors + // so the local clear path still runs and the user lands on /login. + try { + await logout(); + } catch { + clearAuthTokens(); + } + void navigate({ to: "/login" }); + }} + > + + Log out + setShutdownOpen(true)}> Shutdown diff --git a/studio/frontend/src/features/auth/api.ts b/studio/frontend/src/features/auth/api.ts index 8f52c2187c..98c5757d2a 100644 --- a/studio/frontend/src/features/auth/api.ts +++ b/studio/frontend/src/features/auth/api.ts @@ -7,6 +7,7 @@ import { getAuthToken, getRefreshToken, mustChangePassword, + setMustChangePassword, storeAuthTokens, } from "./session"; @@ -93,34 +94,45 @@ async function retryWithTauriAutoAuth( return null; } +// Singleflight: the backend consumes the refresh token atomically, so +// concurrent callers must share one in-flight promise (loser would 401). +let refreshInflight: Promise | null = null; +// Bumped by logout(); a refresh that resolves after logout drops its +// new tokens instead of silently re-auth-ing the SPA. +let logoutGeneration = 0; + export async function refreshSession(): Promise { - const refreshToken = getRefreshToken(); - if (!refreshToken) return false; - - try { - const response = await fetchWithTauriNetworkRetry( - apiUrl("/api/auth/refresh"), - { - method: "POST", - headers: { "Content-Type": "application/json" }, - body: JSON.stringify({ refresh_token: refreshToken }), - }, - ); - - if (!response.ok) { - clearAuthTokens(); + if (refreshInflight) return refreshInflight; + const startGeneration = logoutGeneration; + refreshInflight = (async () => { + const refreshToken = getRefreshToken(); + if (!refreshToken) return false; + try { + const response = await fetchWithTauriNetworkRetry( + apiUrl("/api/auth/refresh"), + { + method: "POST", + headers: { "Content-Type": "application/json" }, + body: JSON.stringify({ refresh_token: refreshToken }), + }, + ); + if (!response.ok) { + clearAuthTokens(); + return false; + } + const payload = (await response.json()) as RefreshResponse; + if (startGeneration !== logoutGeneration) return false; + storeAuthTokens(payload.access_token, payload.refresh_token); + setMustChangePassword(payload.must_change_password ?? false); + return true; + } catch { return false; } - - const payload = (await response.json()) as RefreshResponse; - storeAuthTokens( - payload.access_token, - payload.refresh_token, - payload.must_change_password, - ); - return true; - } catch { - return false; + })(); + try { + return await refreshInflight; + } finally { + refreshInflight = null; } } @@ -179,6 +191,32 @@ export async function authFetch( return retryWithCurrentToken(resolvedInput, init); } -export function logout(): void { - clearAuthTokens(); +async function postLogout(accessToken: string | null): Promise { + try { + return await fetchWithTauriNetworkRetry(apiUrl("/api/auth/logout"), { + method: "POST", + headers: accessToken + ? { Authorization: `Bearer ${accessToken}` } + : undefined, + }); + } catch { + return null; + } +} + +export async function logout(): Promise { + // Server-side revoke. If the access token is expired the 401 fires + // BEFORE revoke runs; rotate via the refresh token and retry so the + // refresh family is actually revoked. Generation bump in finally + // invalidates any in-flight refresh from before this call. + try { + let response = await postLogout(getAuthToken()); + if (response && response.status === 401 && getRefreshToken()) { + const refreshed = await refreshSession(); + if (refreshed) response = await postLogout(getAuthToken()); + } + } finally { + logoutGeneration += 1; + clearAuthTokens(); + } } diff --git a/studio/frontend/src/features/auth/components/auth-form.tsx b/studio/frontend/src/features/auth/components/auth-form.tsx index 090a3081a4..de0a1df995 100644 --- a/studio/frontend/src/features/auth/components/auth-form.tsx +++ b/studio/frontend/src/features/auth/components/auth-form.tsx @@ -79,6 +79,7 @@ export function AuthForm({ mode }: AuthFormProps): ReactElement | null { const navigate = useNavigate(); const isLoginMode = mode === "login"; const [showPassword, setShowPassword] = useState(false); + const [showNewPassword, setShowNewPassword] = useState(false); const username = HIDDEN_LOGIN_USERNAME; const [password, setPassword] = useState(""); const [newPassword, setNewPassword] = useState(""); @@ -237,7 +238,6 @@ export function AuthForm({ mode }: AuthFormProps): ReactElement | null { storeAuthTokens( bootstrapToken.access_token, bootstrapToken.refresh_token, - bootstrapToken.must_change_password, ); setMustChangePassword(bootstrapToken.must_change_password); accessToken = bootstrapToken.access_token; @@ -274,11 +274,7 @@ export function AuthForm({ mode }: AuthFormProps): ReactElement | null { } else { setMustChangePassword(token.must_change_password); } - storeAuthTokens( - token.access_token, - token.refresh_token, - token.must_change_password, - ); + storeAuthTokens(token.access_token, token.refresh_token); navigate({ to: getPostAuthRoute() }); } catch (err: unknown) { let msg = err instanceof Error ? err.message : "Auth failed."; @@ -341,12 +337,45 @@ export function AuthForm({ mode }: AuthFormProps): ReactElement | null { {!isLoginMode && ( <> +

+ +
+ setPassword(event.target.value)} + minLength={8} + required + placeholder={ + window.__UNSLOTH_BOOTSTRAP__?.password + ? "Pre-filled with first-boot password" + : undefined + } + /> + +
+
setShowPassword((prev) => !prev)} + onClick={() => setShowNewPassword((prev) => !prev)} > - {showPassword ? ( + {showNewPassword ? ( ) : ( diff --git a/studio/frontend/src/features/auth/index.ts b/studio/frontend/src/features/auth/index.ts index 9cc1599195..9baad33e0e 100644 --- a/studio/frontend/src/features/auth/index.ts +++ b/studio/frontend/src/features/auth/index.ts @@ -3,8 +3,9 @@ export { LoginPage } from "./login-page"; export { ChangePasswordPage } from "./change-password-page"; -export { authFetch, refreshSession } from "./api"; +export { authFetch, logout, refreshSession } from "./api"; export { + clearAuthTokens, getAuthToken, getPostAuthRoute, hasAuthToken, diff --git a/studio/frontend/src/features/auth/session.ts b/studio/frontend/src/features/auth/session.ts index 49a2722bdf..1e3234590a 100644 --- a/studio/frontend/src/features/auth/session.ts +++ b/studio/frontend/src/features/auth/session.ts @@ -38,12 +38,13 @@ export function getRefreshToken(): string | null { export function storeAuthTokens( accessToken: string, refreshToken: string, - mustChangePassword = false, ): void { + // Callers set must_change_password via setMustChangePassword(). Routing it + // through here would let CodeQL trace the boolean to localStorage and flag + // the (deliberate) JWT writes as sensitive-info storage. if (!canUseStorage()) return; localStorage.setItem(AUTH_TOKEN_KEY, accessToken); localStorage.setItem(AUTH_REFRESH_TOKEN_KEY, refreshToken); - localStorage.setItem(AUTH_MUST_CHANGE_PASSWORD_KEY, String(mustChangePassword)); } export function clearAuthTokens(): void { @@ -53,14 +54,22 @@ export function clearAuthTokens(): void { localStorage.removeItem(AUTH_MUST_CHANGE_PASSWORD_KEY); } +// Encode the flag as key presence (literal "1" or absence) so localStorage +// receives a constant, not a derived boolean. Breaks the CodeQL data flow +// from TokenResponse.must_change_password into localStorage.setItem; the +// stored value is a route hint (/change-password vs /chat), not a secret. export function mustChangePassword(): boolean { if (!canUseStorage()) return false; - return localStorage.getItem(AUTH_MUST_CHANGE_PASSWORD_KEY) === "true"; + return localStorage.getItem(AUTH_MUST_CHANGE_PASSWORD_KEY) !== null; } export function setMustChangePassword(required: boolean): void { if (!canUseStorage()) return; - localStorage.setItem(AUTH_MUST_CHANGE_PASSWORD_KEY, String(required)); + if (required) { + localStorage.setItem(AUTH_MUST_CHANGE_PASSWORD_KEY, "1"); + } else { + localStorage.removeItem(AUTH_MUST_CHANGE_PASSWORD_KEY); + } } export function isOnboardingDone(): boolean { diff --git a/studio/frontend/src/features/auth/tauri-auto-auth.ts b/studio/frontend/src/features/auth/tauri-auto-auth.ts index a0199f9ac3..44884796d3 100644 --- a/studio/frontend/src/features/auth/tauri-auto-auth.ts +++ b/studio/frontend/src/features/auth/tauri-auto-auth.ts @@ -6,6 +6,7 @@ import { hasAuthToken, hasRefreshToken, mustChangePassword, + setMustChangePassword, storeAuthTokens, } from "./session"; import { refreshSession } from "./api"; @@ -72,7 +73,8 @@ async function doTauriAutoAuth(options: TauriAutoAuthOptions): Promise try { const { invoke } = await import("@tauri-apps/api/core"); const tokens = await invoke("desktop_auth"); - storeAuthTokens(tokens.access_token, tokens.refresh_token, false); + storeAuthTokens(tokens.access_token, tokens.refresh_token); + setMustChangePassword(false); clearTauriAuthFailure(); return true; } catch (error) { diff --git a/studio/frontend/src/features/chat/api/chat-api.ts b/studio/frontend/src/features/chat/api/chat-api.ts index ec50a3a8d5..f842144723 100644 --- a/studio/frontend/src/features/chat/api/chat-api.ts +++ b/studio/frontend/src/features/chat/api/chat-api.ts @@ -2,6 +2,7 @@ // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 import { authFetch } from "@/features/auth"; +import { formatFastApiDetail } from "@/lib/format-fastapi-error"; import type { AudioGenerationResponse, GgufVariantsResponse, @@ -17,21 +18,12 @@ import type { } from "../types/api"; function parseErrorText(status: number, body: unknown): string { - if ( - body && - typeof body === "object" && - "detail" in body && - typeof body.detail === "string" - ) { - return body.detail; - } - if ( - body && - typeof body === "object" && - "message" in body && - typeof body.message === "string" - ) { - return body.message; + if (body && typeof body === "object") { + const detail = (body as { detail?: unknown }).detail; + const formatted = formatFastApiDetail(detail); + if (formatted) return formatted; + const message = (body as { message?: unknown }).message; + if (typeof message === "string" && message) return message; } return `Request failed (${status})`; } diff --git a/studio/frontend/src/features/chat/api/openai-containers.ts b/studio/frontend/src/features/chat/api/openai-containers.ts index 29d292f7cf..6463b5dc7b 100644 --- a/studio/frontend/src/features/chat/api/openai-containers.ts +++ b/studio/frontend/src/features/chat/api/openai-containers.ts @@ -10,6 +10,7 @@ */ import { authFetch } from "@/features/auth"; +import { readFastApiError } from "@/lib/format-fastapi-error"; import { encryptProviderApiKey } from "./providers-api"; export interface OpenAIContainerSummary { @@ -42,13 +43,7 @@ function fromRaw(raw: RawSummary): OpenAIContainerSummary { } async function parseError(response: Response): Promise { - try { - const body = (await response.json()) as { detail?: string }; - if (body && typeof body.detail === "string") return body.detail; - } catch { - /* fall through */ - } - return `HTTP ${response.status}`; + return readFastApiError(response, "HTTP"); } interface AuthInputs { diff --git a/studio/frontend/src/features/chat/api/providers-api.ts b/studio/frontend/src/features/chat/api/providers-api.ts index e76e24a627..e0faac27b4 100644 --- a/studio/frontend/src/features/chat/api/providers-api.ts +++ b/studio/frontend/src/features/chat/api/providers-api.ts @@ -3,6 +3,7 @@ import forge from "node-forge"; import { authFetch } from "@/features/auth"; +import { formatFastApiDetail } from "@/lib/format-fastapi-error"; export interface ProviderRegistryEntry { provider_type: string; @@ -40,21 +41,12 @@ export interface ProviderTestResult { } function parseErrorText(status: number, body: unknown): string { - if ( - body && - typeof body === "object" && - "detail" in body && - typeof body.detail === "string" - ) { - return body.detail; - } - if ( - body && - typeof body === "object" && - "message" in body && - typeof body.message === "string" - ) { - return body.message; + if (body && typeof body === "object") { + const detail = (body as { detail?: unknown }).detail; + const formatted = formatFastApiDetail(detail); + if (formatted) return formatted; + const message = (body as { message?: unknown }).message; + if (typeof message === "string" && message) return message; } return `Request failed (${status})`; } diff --git a/studio/frontend/src/features/export/api/export-api.ts b/studio/frontend/src/features/export/api/export-api.ts index 450691ddfd..56f8c8129b 100644 --- a/studio/frontend/src/features/export/api/export-api.ts +++ b/studio/frontend/src/features/export/api/export-api.ts @@ -2,15 +2,9 @@ // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 import { authFetch } from "@/features/auth"; +import { readFastApiError } from "@/lib/format-fastapi-error"; -async function readError(response: Response): Promise { - try { - const payload = (await response.json()) as { detail?: string; message?: string }; - return payload.detail || payload.message || `Request failed (${response.status})`; - } catch { - return `Request failed (${response.status})`; - } -} +const readError = (r: Response): Promise => readFastApiError(r); async function parseJson(response: Response): Promise { if (!response.ok) { diff --git a/studio/frontend/src/features/recipe-studio/api/index.ts b/studio/frontend/src/features/recipe-studio/api/index.ts index 273d4aea8d..06b4bc1f8b 100644 --- a/studio/frontend/src/features/recipe-studio/api/index.ts +++ b/studio/frontend/src/features/recipe-studio/api/index.ts @@ -2,6 +2,7 @@ // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 import { authFetch } from "@/features/auth"; +import { formatFastApiDetail, readFastApiError } from "@/lib/format-fastapi-error"; const DEFAULT_BASE = "/api/data-recipe"; @@ -202,12 +203,18 @@ async function parseErrorResponse(response: Response): Promise { } try { const parsed = JSON.parse(text) as { - detail?: string; + detail?: unknown; message?: string; // biome-ignore lint/style/useNamingConvention: api schema raw_detail?: string; }; - return parsed.detail ?? parsed.message ?? parsed.raw_detail ?? text; + // Use ||, not ??: an array detail is truthy but not nullish, and + // formatFastApiDetail returns null when it cannot flatten the value. + const formatted = formatFastApiDetail(parsed.detail); + if (formatted) return formatted; + if (typeof parsed.message === "string" && parsed.message) return parsed.message; + if (typeof parsed.raw_detail === "string" && parsed.raw_detail) return parsed.raw_detail; + return text; } catch { return text; } @@ -449,22 +456,17 @@ export async function uploadUnstructuredFile( ); if (res.status === 413) { - const detail = await res.json().catch(() => ({ detail: "File too large" })); return { file_id: "", filename: file.name, size_bytes: file.size, status: "error", - error: - typeof detail.detail === "string" ? detail.detail : "File too large", + error: await readFastApiError(res, "File too large"), }; } if (!res.ok) { - const detail = await res.json().catch(() => ({ detail: "Upload failed" })); - throw new Error( - typeof detail.detail === "string" ? detail.detail : "Upload failed", - ); + throw new Error(await readFastApiError(res, "Upload failed")); } return res.json(); diff --git a/studio/frontend/src/features/training/api/datasets-api.ts b/studio/frontend/src/features/training/api/datasets-api.ts index c56aec03be..0b4f90c56c 100644 --- a/studio/frontend/src/features/training/api/datasets-api.ts +++ b/studio/frontend/src/features/training/api/datasets-api.ts @@ -7,6 +7,7 @@ import type { UploadDatasetResponse, } from "../types/datasets"; import { authFetch } from "@/features/auth"; +import { readFastApiError } from "@/lib/format-fastapi-error"; type CheckDatasetFormatArgs = { datasetName: string; @@ -36,8 +37,7 @@ export async function checkDatasetFormat({ }); if (!res.ok) { - const body = await res.json().catch(() => null); - throw new Error(body?.detail || `Request failed (${res.status})`); + throw new Error(await readFastApiError(res)); } return res.json(); @@ -55,8 +55,7 @@ export async function uploadTrainingDataset( }); if (!res.ok) { - const body = await res.json().catch(() => null); - throw new Error(body?.detail || `Upload failed (${res.status})`); + throw new Error(await readFastApiError(res, "Upload failed")); } return res.json(); @@ -107,8 +106,7 @@ export async function aiAssistMapping({ }); if (!res.ok) { - const body = await res.json().catch(() => null); - throw new Error(body?.detail || `AI assist failed (${res.status})`); + throw new Error(await readFastApiError(res, "AI assist failed")); } return res.json(); @@ -117,8 +115,7 @@ export async function aiAssistMapping({ export async function listLocalDatasets(): Promise { const res = await authFetch("/api/datasets/local"); if (!res.ok) { - const body = await res.json().catch(() => null); - throw new Error(body?.detail || `Request failed (${res.status})`); + throw new Error(await readFastApiError(res)); } return res.json(); } diff --git a/studio/frontend/src/features/training/api/history-api.ts b/studio/frontend/src/features/training/api/history-api.ts index e886e35626..8fde83bc8d 100644 --- a/studio/frontend/src/features/training/api/history-api.ts +++ b/studio/frontend/src/features/training/api/history-api.ts @@ -2,6 +2,7 @@ // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 import { authFetch } from "@/features/auth"; +import { readFastApiError } from "@/lib/format-fastapi-error"; import type { TrainingRunDeleteResponse, TrainingRunDetailResponse, @@ -9,14 +10,7 @@ import type { TrainingRunSummary, } from "../types/history"; -async function readError(response: Response): Promise { - try { - const payload = (await response.json()) as { detail?: string; message?: string }; - return payload.detail || payload.message || `Request failed (${response.status})`; - } catch { - return `Request failed (${response.status})`; - } -} +const readError = (r: Response): Promise => readFastApiError(r); async function parseJson(response: Response): Promise { if (!response.ok) { diff --git a/studio/frontend/src/features/training/api/train-api.ts b/studio/frontend/src/features/training/api/train-api.ts index 781dbe6139..af3ea347c2 100644 --- a/studio/frontend/src/features/training/api/train-api.ts +++ b/studio/frontend/src/features/training/api/train-api.ts @@ -2,6 +2,7 @@ // Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 import { authFetch } from "@/features/auth"; +import { readFastApiError } from "@/lib/format-fastapi-error"; import type { TrainingStartRequest, TrainingStartResponse, @@ -17,45 +18,7 @@ function isAbortError(error: unknown): boolean { return error instanceof DOMException && error.name === "AbortError"; } -type FastApiValidationError = { - loc?: unknown[]; - msg?: string; -}; - -function formatDetail(detail: unknown): string | null { - if (typeof detail === "string" && detail) return detail; - if (!Array.isArray(detail)) return null; - const parts = detail - .map((entry) => { - if (!entry || typeof entry !== "object") return ""; - const { loc, msg } = entry as FastApiValidationError; - const path = Array.isArray(loc) - ? loc.filter((segment) => segment !== "body").join(".") - : ""; - const message = typeof msg === "string" ? msg : ""; - if (path && message) return `${path}: ${message}`; - return path || message; - }) - .filter(Boolean); - return parts.length > 0 ? parts.join("; ") : null; -} - -async function readError(response: Response): Promise { - try { - const payload = (await response.json()) as { - detail?: unknown; - message?: string; - }; - const formattedDetail = formatDetail(payload.detail); - if (formattedDetail) return formattedDetail; - if (typeof payload.message === "string" && payload.message) { - return payload.message; - } - return `Request failed (${response.status})`; - } catch { - return `Request failed (${response.status})`; - } -} +const readError = (r: Response): Promise => readFastApiError(r); async function parseJson(response: Response): Promise { if (!response.ok) { diff --git a/studio/frontend/src/lib/format-fastapi-error.ts b/studio/frontend/src/lib/format-fastapi-error.ts new file mode 100644 index 0000000000..ed4a5ece7d --- /dev/null +++ b/studio/frontend/src/lib/format-fastapi-error.ts @@ -0,0 +1,64 @@ +// SPDX-License-Identifier: AGPL-3.0-only +// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. + +/** + * Render a FastAPI error response body into a human-readable string. + * + * FastAPI emits 422s as `{detail: Array<{loc, msg, type, input?}>}`. The + * naive `body.detail || body.message` pattern truthy-coerces the array + * and stringifies it as `[object Object]`, which is unhelpful and was + * exactly the regression #5409 fixed inside `train-api.ts`. Lift the + * helper here so chat, export, history, datasets, and recipe-studio + * can all share it. + * + * Falls back through: array detail -> string detail -> message -> null. + */ + +export type FastApiValidationError = { + loc?: unknown[]; + msg?: string; +}; + +export function formatFastApiDetail(detail: unknown): string | null { + if (typeof detail === "string" && detail) return detail; + if (!Array.isArray(detail)) return null; + const parts = detail + .map((entry) => { + if (!entry || typeof entry !== "object") return ""; + const { loc, msg } = entry as FastApiValidationError; + const path = Array.isArray(loc) + ? loc.filter((segment) => segment !== "body").join(".") + : ""; + const message = typeof msg === "string" ? msg : ""; + if (path && message) return `${path}: ${message}`; + return path || message; + }) + .filter(Boolean); + return parts.length > 0 ? parts.join("; ") : null; +} + +/** + * Convert a Response (likely a non-ok response from a fetch) into the + * best human-readable error message available. Used by *-api.ts wrappers + * so toast text reads as `field: msg` instead of `[object Object]` or + * `Request failed (422)`. + */ +export async function readFastApiError( + response: Response, + fallbackPrefix: string = "Request failed", +): Promise { + try { + const payload = (await response.json()) as { + detail?: unknown; + message?: string; + }; + const formatted = formatFastApiDetail(payload.detail); + if (formatted) return formatted; + if (typeof payload.message === "string" && payload.message) { + return payload.message; + } + } catch { + // fall through + } + return `${fallbackPrefix} (${response.status})`; +} From a09e70e8be2d2e945a1be40d3bda87d5dd8dfbb3 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:06:01 -0700 Subject: [PATCH 24/62] tests/studio: lock in Windows GPU detection fix (#5106) with a synthetic CI test (#5376) * tests/studio: end-to-end Windows GPU detection mock test (#5106) Locks in the combined fix from #5322 + #5324 with a synthetic Windows scenario that CI runners without GPUs can execute. The test packs the real PyPI win_amd64 wheel layouts (cu12 modular and the new unsuffixed cu13 nvidia/cu13/bin/x86_64 layout) plus the exact filename set of the upstream b9103 cudart-llama-bin-win-cuda bundles, then mocks nvidia-smi output and asserts that: * Studio's nvidia-smi probe parses the CSV and reports the GPU. * After PR #5322 the install_dir/build/bin/Release/ tree contains all three cudart bundle DLLs alongside llama-server.exe. * After PR #5324 the PATH built by start_llama_server's win32 branch lists pip nvidia + torch/lib dirs in addition to the binary_dir. * cudart64_X.dll, cublas64_X.dll, and cublasLt64_X.dll are each reachable from at least one PATH entry, with cudart specifically reachable from BOTH the install dir and a pip nvidia dir (defence in depth). * Bare venvs without pip nvidia wheels still work via #5322's binary_dir drop; pre-#5322 installs still work via #5324's PATH augmentation. * A reconstructed pre-PR scenario (cudart absent from binary_dir and pip dirs not on PATH) leaves cudart unreachable, confirming the test would catch a future regression. Bonus housekeeping in studio/install_llama_prebuilt.py: drop the pointless f-prefix on the literal "llama-" in the windows_cuda_attempts pairing guard (no behaviour change; lint nit flagged in the post-merge review). The mocks model real artifact contents I verified empirically: * pip download nvidia-cuda-runtime --platform win_amd64 produces nvidia/cu13/bin/x86_64/cudart64_13.dll. * unzip on the b9103 cudart-llama-bin-win-cuda-13.1-x64.zip produces exactly cudart64_13.dll + cublas64_13.dll + cublasLt64_13.dll, no executables. * objdump -p on the b9103 ggml-cuda.dll shows a static PE import on cublas64_13.dll (the root cause of #5106 when cublas64_13.dll is unreachable). Refs #5106 #5322 #5324 * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * test_5106_windows_gpu_detection_mock: don't shadow real httpx This file's name sorts before every other file in studio/backend/tests/ (starts with the digit '5'), so pytest collects it first. The previous ``sys.modules.setdefault("httpx", _httpx_stub)`` ran before any other test imported real httpx, which meant the stub permanently shadowed the real module for the rest of the collection. Tests that did ``from httpx import HTTPError, Response`` (test_anthropic_messages, test_browse_folders_route, test_training_*, etc) then failed at collection with ``ImportError: cannot import name 'HTTPError'`` because the stub did not define those names. The existing test_llama_cpp_windows_nvidia_path.py did not trigger the same issue because it sorts after test_a* / test_b* / etc, by which point the real httpx has already been imported and setdefault is a no-op. Switch the stub installation to ``importlib.util.find_spec(name) is None`` so we only fall back to the stub when the real module truly is not installed. Backend CI installs httpx, structlog, and the studio/backend/loggers package is reachable via the sys.path augmentation a few lines above, so on CI all three find_spec calls succeed and no stubs are installed at all. Also add HTTPError and Response to the stub module for the offline case, so anyone running this test outside CI with httpx absent still gets a stub that satisfies the broader test suite's imports. Refs #5106 * test_5106 + llama_cpp: extract win32 PATH helper and harden the regression test Follow-up to PR #5376's review feedback. Three real findings from the bot reviewers, plus one stale one. 1. (codex P2 line 201, gemini medium line 209) The regression test's _build_path_dirs_like_start_llama_server hand-copied the win32 branch of LlamaCppBackend.start_llama_server, so a future drop or reorder of _windows_pip_nvidia_dll_dirs(sys.prefix) in production would have passed the test silently. Extract a new staticmethod LlamaCppBackend._build_windows_path_dirs (binary_dir, prefix, cuda_path). Production start_llama_server now calls this helper. The test's wrapper is reduced to a one-line delegate that forwards to the staticmethod, so the regression asserts against the exact production logic instead of a parallel copy of it. 2. (codex P2 line 245) test_nvidia_smi_probe_reports_synthetic_gpu did not clear CUDA_VISIBLE_DEVICES. On a shared GPU runner with the variable set in the parent shell, _get_gpu_free_memory() filters the mocked CSV and returns [] or falls through to the torch fallback. Cleared CUDA_VISIBLE_DEVICES and NVIDIA_VISIBLE_DEVICES via monkeypatch.delenv(..., raising=False). 3. (codex P2 line 66) _maybe_stub gated on importlib.util.find_spec ("loggers"), which returns a spec because studio/backend/loggers/ is on sys.path. But the actual import chain loads loggers/handlers.py which does `from fastapi import Request, Response` at module load. In a lightweight env without fastapi installed, the stub never lands and `from core.inference.llama_cpp import LlamaCppBackend` raises during collection. Switched _maybe_stub to a real import attempt under try / except ImportError so the stub falls into place when the package is discoverable but not importable. CI has fastapi so this is purely a developer- machine ergonomics fix. The fourth comment (codex P1 line 85 "Keep the httpx stub from leaking across tests") was already addressed by 7437e735, which replaced the unconditional sys.modules.setdefault with the find_spec-gated _maybe_stub. No code change needed. Production behaviour is unchanged: _build_windows_path_dirs returns exactly the same ordering start_llama_server used inline ([binary_dir, *pip_dirs, cuda_bin?, cuda_bin_x64?]). Verification (run inside studio/backend): pytest tests/test_5106_windows_gpu_detection_mock.py -v -> 10 passed pytest tests/test_llama_cpp_*.py tests/test_llama_server_args.py tests/test_5106_windows_gpu_detection_mock.py -q -> 171 passed CUDA_VISIBLE_DEVICES=1 pytest tests/test_5106_windows_gpu_detection_mock.py::TestWindowsGpuDetectionAfter5106Fix::test_nvidia_smi_probe_reports_synthetic_gpu -> 1 passed * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Rename Windows GPU detection test to a generic filename and trim comments - studio/backend/tests/test_5106_windows_gpu_detection_mock.py -> studio/backend/tests/test_windows_gpu_detection_mock.py The file is the generic regression suite for Windows GPU detection; encoding the issue number in the filename is noise. - Shorten module docstring, helper docstrings, per-test docstrings and inline comments in the renamed test file. No behaviour change, all 10 cases still pass. - Shorten the _build_windows_path_dirs docstring in studio/backend/core/inference/llama_cpp.py and update the test-path reference; trim the win32 call-site comment to one line. Local verification: - pytest studio/backend/tests/test_windows_gpu_detection_mock.py -- 10 passed. - pytest studio/backend/tests/test_llama_cpp_windows_nvidia_path.py studio/backend/tests/test_llama_server_args.py studio/backend/tests/test_windows_gpu_detection_mock.py -- 110 passed. * Studio: harden _wait_for_health against transient httpx ReadError The probe loop in LlamaCppBackend._wait_for_health only caught ConnectError and TimeoutException. On Windows, when llama-server.exe accepts the TCP probe and then dies before sending HTTP headers, the peer process RST closes the socket. httpx maps this to ReadError ("WinError 10054 -- An existing connection was forcibly closed by the remote host"), which fell through the except clause and bubbled out of _wait_for_health, the routes/inference.py load_model handler, and back to /api/inference/load as an opaque 500. The crash diagnostic Studio actually wants to surface lives on the self._process.poll() branch at the top of the loop body: "llama-server exited with code X. Output: ...". We never reached that branch on the WinError 10054 path because the very first probe blew up. Expand the except to also swallow ReadError and RemoteProtocolError so the next 0.5-second iteration runs the poll() branch. Outcomes: * Process really died: structured exit-code + last-stdout log line. * Single transient probe blip: silently retried; load succeeds. Adds studio/backend/tests/test_llama_cpp_wait_for_health.py with five cases covering happy-path 200, transient ReadError + dead process, RemoteProtocolError + dead process, ConnectError cycling until success, and dead process before the first probe. The new cases would have failed against the old except clause -- ReadError / RemoteProtocolError would have propagated instead of returning False. Found while triaging the Windows Studio GGUF CI flake on this PR's 5a6ddc34 push: llama-server.exe (b9203 prebuilt) crashed within 2.2 s of launch on the GPU-less runner, and Studio reported "WinError 10054" instead of an upstream-tag-attributable exit-code line. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: danielhanchen --- studio/backend/core/inference/llama_cpp.py | 43 +- .../tests/test_llama_cpp_wait_for_health.py | 156 +++++++ .../tests/test_windows_gpu_detection_mock.py | 393 ++++++++++++++++++ studio/install_llama_prebuilt.py | 2 +- 4 files changed, 576 insertions(+), 18 deletions(-) create mode 100644 studio/backend/tests/test_llama_cpp_wait_for_health.py create mode 100644 studio/backend/tests/test_windows_gpu_detection_mock.py diff --git a/studio/backend/core/inference/llama_cpp.py b/studio/backend/core/inference/llama_cpp.py index a4c28166b9..0b3c9f958e 100644 --- a/studio/backend/core/inference/llama_cpp.py +++ b/studio/backend/core/inference/llama_cpp.py @@ -1103,6 +1103,26 @@ class LlamaCppBackend: _add(site_packages / "torch" / "lib") return out + @staticmethod + def _build_windows_path_dirs( + binary_dir: str, prefix: str, cuda_path: str + ) -> list[str]: + """Ordered PATH entries the win32 branch of start_llama_server + prepends so llama-server.exe resolves cudart / cublas DLLs: + binary_dir, pip nvidia wheels, CUDA_PATH/bin, CUDA_PATH/bin/x64. + Extracted so test_windows_gpu_detection_mock asserts against + production logic, not a hand-copy. #5106.""" + path_dirs = [binary_dir] + path_dirs.extend(LlamaCppBackend._windows_pip_nvidia_dll_dirs(prefix)) + if cuda_path: + cuda_bin = os.path.join(cuda_path, "bin") + if os.path.isdir(cuda_bin): + path_dirs.append(cuda_bin) + cuda_bin_x64 = os.path.join(cuda_path, "bin", "x64") + if os.path.isdir(cuda_bin_x64): + path_dirs.append(cuda_bin_x64) + return path_dirs + @staticmethod def _select_gpus( model_size_bytes: int, @@ -2631,23 +2651,12 @@ class LlamaCppBackend: binary_dir = str(Path(binary).parent) if sys.platform == "win32": - # CUDA DLLs (cudart64_X.dll, cublas64_X.dll, etc.) must - # be on PATH. Order: binary_dir, torch's pip-installed - # nvidia wheels, then a system CUDA toolkit. Pip wheels - # are the canonical source per Studio's install design - # (mirrors the Linux LD_LIBRARY_PATH block below) and - # CUDA_PATH covers users with a system toolkit. #5106. - path_dirs = [binary_dir] - path_dirs.extend(self._windows_pip_nvidia_dll_dirs(sys.prefix)) - cuda_path = os.environ.get("CUDA_PATH", "") - if cuda_path: - cuda_bin = os.path.join(cuda_path, "bin") - if os.path.isdir(cuda_bin): - path_dirs.append(cuda_bin) - # Some CUDA installs put DLLs in bin\x64 - cuda_bin_x64 = os.path.join(cuda_path, "bin", "x64") - if os.path.isdir(cuda_bin_x64): - path_dirs.append(cuda_bin_x64) + # See _build_windows_path_dirs for ordering. #5106. + path_dirs = self._build_windows_path_dirs( + binary_dir, + sys.prefix, + os.environ.get("CUDA_PATH", ""), + ) existing_path = env.get("PATH", "") env["PATH"] = ";".join(path_dirs) + ";" + existing_path else: diff --git a/studio/backend/tests/test_llama_cpp_wait_for_health.py b/studio/backend/tests/test_llama_cpp_wait_for_health.py new file mode 100644 index 0000000000..bcf2eb1683 --- /dev/null +++ b/studio/backend/tests/test_llama_cpp_wait_for_health.py @@ -0,0 +1,156 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""Tests for LlamaCppBackend._wait_for_health resilience. + +The probe loop must swallow transient httpx errors and fall through to +the subprocess.poll() branch so a crashed llama-server surfaces a +structured "exited with code X" log instead of bubbling an opaque +exception up to the /api/inference/load route. +""" + +from __future__ import annotations + +import sys +import types as _types +from pathlib import Path +from unittest import mock + +import pytest + +_BACKEND_DIR = str(Path(__file__).resolve().parent.parent) +if _BACKEND_DIR not in sys.path: + sys.path.insert(0, _BACKEND_DIR) + +# Match the stubbing pattern in sibling tests so the module imports in +# a lightweight env without fastapi. +_loggers_stub = _types.ModuleType("loggers") +_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name) +sys.modules.setdefault("loggers", _loggers_stub) +sys.modules.setdefault("structlog", _types.ModuleType("structlog")) + +import httpx # noqa: E402 + +from core.inference.llama_cpp import LlamaCppBackend # noqa: E402 + +# Sibling tests in this directory install lightweight httpx stubs via +# sys.modules.setdefault. When collected together, our `httpx` symbol +# may be one of those stubs, which lacks `get`. Ensure the production +# code finds a working `httpx.get` and the standard exception types +# regardless of collection order by adding the missing attributes. +if not hasattr(httpx, "get"): + httpx.get = None # placeholder; every test below monkeypatches it +for _exc_name in ( + "ConnectError", + "TimeoutException", + "ReadError", + "RemoteProtocolError", + "WriteError", +): + if not hasattr(httpx, _exc_name): + setattr(httpx, _exc_name, type(_exc_name, (Exception,), {})) + + +def _make_backend(port: int = 12345) -> LlamaCppBackend: + """Build a barebones LlamaCppBackend instance with only the + attributes _wait_for_health touches. Bypasses __init__ so we do not + pull in the full subprocess + logging stack.""" + b = LlamaCppBackend.__new__(LlamaCppBackend) + b._port = port + b._stdout_thread = None + b._stdout_lines = [] + b._process = mock.Mock() + return b + + +class TestWaitForHealthResilience: + def test_returns_true_on_first_200(self, monkeypatch): + b = _make_backend() + b._process.poll.return_value = None + ok_resp = mock.Mock(status_code = 200) + monkeypatch.setattr(httpx, "get", lambda *a, **kw: ok_resp) + assert b._wait_for_health(timeout = 1.0, interval = 0.01) is True + + def test_read_error_loops_to_subprocess_poll(self, monkeypatch): + """WinError 10054 maps to httpx.ReadError. The loop must swallow + it and the next iteration must detect the dead subprocess via + poll() != None, returning False with a structured exit-code log + instead of bubbling the ReadError.""" + b = _make_backend() + # First iteration: process alive (so we reach the httpx probe). + # Second iteration: process has exited (so we hit the structured + # exit-code branch and return False). + b._process.poll.side_effect = [None, 1] + b._process.returncode = 1 + b._stdout_lines = ["llama-server: ggml-cuda.dll failed to load"] + + def raise_read_error(*a, **kw): + raise httpx.ReadError("WinError 10054") + + monkeypatch.setattr(httpx, "get", raise_read_error) + assert b._wait_for_health(timeout = 5.0, interval = 0.01) is False + # Both iterations of the loop ran -- the ReadError did not bubble. + assert b._process.poll.call_count >= 2 + + def test_remote_protocol_error_also_swallowed(self, monkeypatch): + """Partial / malformed response on the probe (server crashed + mid-headers) raises RemoteProtocolError -- also non-fatal.""" + b = _make_backend() + b._process.poll.side_effect = [None, -1] + b._process.returncode = -1 + + def raise_rpe(*a, **kw): + raise httpx.RemoteProtocolError("partial response") + + monkeypatch.setattr(httpx, "get", raise_rpe) + assert b._wait_for_health(timeout = 5.0, interval = 0.01) is False + assert b._process.poll.call_count >= 2 + + def test_write_error_also_swallowed(self, monkeypatch): + """Send-side socket failure mid-request raises WriteError -- + same recovery path as ReadError.""" + b = _make_backend() + b._process.poll.side_effect = [None, 1] + b._process.returncode = 1 + + def raise_we(*a, **kw): + raise httpx.WriteError("connection broken on write") + + monkeypatch.setattr(httpx, "get", raise_we) + assert b._wait_for_health(timeout = 5.0, interval = 0.01) is False + assert b._process.poll.call_count >= 2 + + def test_connect_error_swallowed_until_success(self, monkeypatch): + """Sanity: existing ConnectError swallowing still works -- the + loop retries until llama-server eventually answers 200.""" + b = _make_backend() + b._process.poll.return_value = None + calls = {"n": 0} + ok_resp = mock.Mock(status_code = 200) + + def cycling(*a, **kw): + calls["n"] += 1 + if calls["n"] < 3: + raise httpx.ConnectError("not yet") + return ok_resp + + monkeypatch.setattr(httpx, "get", cycling) + assert b._wait_for_health(timeout = 5.0, interval = 0.01) is True + assert calls["n"] >= 3 + + def test_dead_process_before_probe_returns_false(self, monkeypatch): + """If poll() != None on entry, _wait_for_health must return + False immediately without calling httpx at all.""" + b = _make_backend() + b._process.poll.return_value = 137 + b._process.returncode = 137 + b._stdout_lines = ["llama-server: out of memory"] + called = {"n": 0} + + def should_not_be_called(*a, **kw): + called["n"] += 1 + raise AssertionError("httpx.get must not run when subprocess is dead") + + monkeypatch.setattr(httpx, "get", should_not_be_called) + assert b._wait_for_health(timeout = 5.0, interval = 0.01) is False + assert called["n"] == 0 diff --git a/studio/backend/tests/test_windows_gpu_detection_mock.py b/studio/backend/tests/test_windows_gpu_detection_mock.py new file mode 100644 index 0000000000..023630fb9a --- /dev/null +++ b/studio/backend/tests/test_windows_gpu_detection_mock.py @@ -0,0 +1,393 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""Windows GPU-detection regression test on a synthetic layout. + +The bug (#5106): on Windows without a system CUDA toolkit, the prebuilt +llama-server.exe could not LoadLibrary cudart64_X / cublas64_X / +cublasLt64_X, so ggml-cuda.dll's static import on cublas64_X.dll failed +and the model fell back to CPU even when nvidia-smi reported the GPU. + +The fix: + * #5322 overlays upstream's paired cudart bundle into + install_dir/build/bin/Release/ next to llama-server.exe. + * #5324 prepends pip-installed nvidia//{bin,bin/x86_64,Library/ + bin} and torch/lib to PATH when launching llama-server.exe. + +CI has no GPU so nvidia-smi is mocked; everything else (resolver, PATH +builder, install layout) runs against a real filesystem. +""" + +from __future__ import annotations + +import os +import subprocess +import sys +import types as _types +import zipfile +from pathlib import Path +from unittest import mock + +import pytest + +_BACKEND_DIR = str(Path(__file__).resolve().parent.parent) +if _BACKEND_DIR not in sys.path: + sys.path.insert(0, _BACKEND_DIR) + +# Stub heavy deps only if they actually fail to import -- unconditional +# stubs would shadow the real module for sibling tests in this dir. +# Use try-import rather than find_spec: loggers/__init__.py re-exports +# handlers.get_logger, which does `from fastapi import Request, +# Response` at module load. find_spec("loggers") returns a spec even +# without fastapi, but the import then raises. CI has fastapi, so this +# is dev-machine ergonomics only. +import importlib as _importlib # noqa: E402 + + +def _maybe_stub(name: str, builder): + try: + _importlib.import_module(name) + except ImportError: + sys.modules[name] = builder() + + +def _build_loggers_stub(): + m = _types.ModuleType("loggers") + m.get_logger = lambda name: __import__("logging").getLogger(name) + return m + + +def _build_structlog_stub(): + return _types.ModuleType("structlog") + + +def _build_httpx_stub(): + m = _types.ModuleType("httpx") + for _exc_name in ( + "ConnectError", + "TimeoutException", + "ReadTimeout", + "ReadError", + "RemoteProtocolError", + "CloseError", + "HTTPError", + ): + setattr(m, _exc_name, type(_exc_name, (Exception,), {})) + m.Response = type("Response", (), {}) + + class _FakeTimeout: + def __init__(self, *a, **kw): + pass + + m.Timeout = _FakeTimeout + m.Client = type( + "Client", + (), + { + "__init__": lambda self, **kw: None, + "__enter__": lambda self: self, + "__exit__": lambda self, *a: None, + }, + ) + return m + + +_maybe_stub("loggers", _build_loggers_stub) +_maybe_stub("structlog", _build_structlog_stub) +_maybe_stub("httpx", _build_httpx_stub) + +from core.inference.llama_cpp import LlamaCppBackend # noqa: E402 + + +# Upstream b9103 cudart bundle: exactly these three DLLs per CUDA major, +# no executables, no subdirectories. Verified by direct unzip. +REAL_UPSTREAM_CUDART_BUNDLE = { + "12.4": ("cudart64_12.dll", "cublas64_12.dll", "cublasLt64_12.dll"), + "13.1": ("cudart64_13.dll", "cublas64_13.dll", "cublasLt64_13.dll"), +} + +# PyPI win_amd64 wheel layouts, verified via `pip download ... --platform +# win_amd64` + `unzip -l`. Resolver only cares about directory structure. +REAL_PIP_NVIDIA_WHEEL_LAYOUTS = { + # Legacy cu-suffixed wheels + "nvidia/cuda_runtime/bin": ["cudart64_12.dll"], + "nvidia/cublas/bin": [ + "cublas64_12.dll", + "cublasLt64_12.dll", + "nvblas64_12.dll", + ], + "nvidia/cudnn/bin": [ + "cudnn64_9.dll", + "cudnn_adv64_9.dll", + "cudnn_ops64_9.dll", + ], + # Unsuffixed cu13 wheels + "nvidia/cu13/bin/x86_64": [ + "cudart64_13.dll", + "cublas64_13.dll", + "cublasLt64_13.dll", + "nvblas64_13.dll", + ], +} + + +def _populate_studio_venv(prefix: Path) -> None: + """Lay out fake nvidia + torch wheels in /Lib/site-packages + matching the real win_amd64 wheel layouts. Contents are stub bytes; + only directory structure matters.""" + site = prefix / "Lib" / "site-packages" + for rel, dlls in REAL_PIP_NVIDIA_WHEEL_LAYOUTS.items(): + d = site / Path(rel) + d.mkdir(parents = True, exist_ok = True) + for name in dlls: + (d / name).write_bytes(b"PE-stub") + # install_python_stack always installs torch alongside nvidia. + (site / "torch" / "lib").mkdir(parents = True, exist_ok = True) + for fn in ("c10.dll", "torch.dll", "torch_cpu.dll", "torch_python.dll"): + (site / "torch" / "lib" / fn).write_bytes(b"PE-stub") + + +def _populate_studio_install(install_dir: Path, runtime: str = "13.1") -> None: + """Lay out install_dir/build/bin/Release/ as #5322 leaves it: main + archive payload + paired cudart bundle overlay.""" + rel = install_dir / "build" / "bin" / "Release" + rel.mkdir(parents = True, exist_ok = True) + for fn in ( + "llama-server.exe", + "llama-quantize.exe", + "llama-cli.exe", + "llama.dll", + "ggml.dll", + "ggml-base.dll", + "ggml-cuda.dll", + "mtmd.dll", + ): + (rel / fn).write_bytes(b"PE-stub") + # The cudart overlay #5322 contributes. + for fn in REAL_UPSTREAM_CUDART_BUNDLE[runtime]: + (rel / fn).write_bytes(b"PE-stub") + + +def _build_path_dirs_like_start_llama_server( + binary_dir: Path, prefix: Path, cuda_path: str = "" +) -> list[str]: + """Path-friendly wrapper around LlamaCppBackend._build_windows_path_dirs. + Asserting against the staticmethod (not a hand-copy) is the point: + if the win32 PATH order drops _windows_pip_nvidia_dll_dirs, tests fail.""" + return LlamaCppBackend._build_windows_path_dirs( + str(binary_dir), str(prefix), cuda_path + ) + + +def _mock_nvidia_smi_run(fake_output: str, returncode: int = 0) -> "mock._patch": + """Patch subprocess.run so the nvidia-smi probe returns fake_output; + other subprocess.run calls pass through.""" + real_run = subprocess.run + + def fake_run(cmd, *args, **kwargs): + if isinstance(cmd, list) and cmd and "nvidia-smi" in cmd[0]: + return subprocess.CompletedProcess( + args = cmd, returncode = returncode, stdout = fake_output, stderr = "" + ) + return real_run(cmd, *args, **kwargs) + + return mock.patch("subprocess.run", side_effect = fake_run) + + +# --------------------------------------------------------------------- # +# Tests +# --------------------------------------------------------------------- # +class TestWindowsGpuDetectionAfter5106Fix: + """End-to-end #5106 fix on a synthetic Windows layout. nvidia-smi + mocked; resolver, PATH builder and install layout exercised live.""" + + def test_nvidia_smi_probe_reports_synthetic_gpu(self, monkeypatch): + """Probe parses CSV output and returns (index, free_mib).""" + # Clear inherited masks so the synthetic CSV is not filtered. + monkeypatch.delenv("CUDA_VISIBLE_DEVICES", raising = False) + monkeypatch.delenv("NVIDIA_VISIBLE_DEVICES", raising = False) + # The #5106 reporter's exact reproducer: RTX 4090, 22805 MiB. + fake_csv = "0, 22805\n" + with _mock_nvidia_smi_run(fake_csv): + gpus = LlamaCppBackend._get_gpu_free_memory() + assert gpus == [ + (0, 22805) + ], f"GPU probe failed to parse mocked nvidia-smi output: {gpus}" + + def test_nvidia_smi_probe_respects_cuda_visible_devices(self, monkeypatch): + """CUDA_VISIBLE_DEVICES=1 -> only GPU 1 visible.""" + fake_csv = "0, 22805\n1, 24576\n2, 16384\n" + monkeypatch.setenv("CUDA_VISIBLE_DEVICES", "1") + with _mock_nvidia_smi_run(fake_csv): + gpus = LlamaCppBackend._get_gpu_free_memory() + assert gpus == [(1, 24576)], gpus + + def test_windows_install_dir_has_all_three_cudart_dlls(self, tmp_path): + """All three bundle DLLs must land in install_dir/build/bin/ + Release; missing any one breaks ggml-cuda.dll's PE import chain.""" + install = tmp_path / "studio_install" + _populate_studio_install(install, runtime = "13.1") + rel = install / "build" / "bin" / "Release" + for fn in REAL_UPSTREAM_CUDART_BUNDLE["13.1"]: + assert (rel / fn).exists(), f"missing {fn} in {rel}" + assert (rel / "llama-server.exe").exists() + assert (rel / "ggml-cuda.dll").exists() + + def test_resolver_finds_real_pypi_wheel_layouts(self, tmp_path): + """Resolver must pick up every real-world wheel layout: + nvidia//bin, nvidia//bin/x86_64, torch/lib.""" + prefix = tmp_path / "studio_venv" + _populate_studio_venv(prefix) + out = LlamaCppBackend._windows_pip_nvidia_dll_dirs(str(prefix)) + site = prefix / "Lib" / "site-packages" + for expected in ( + site / "nvidia" / "cuda_runtime" / "bin", + site / "nvidia" / "cublas" / "bin", + site / "nvidia" / "cudnn" / "bin", + site / "nvidia" / "cu13" / "bin" / "x86_64", + site / "torch" / "lib", + ): + assert ( + str(expected) in out + ), f"resolver missed {expected.relative_to(prefix)}: {out}" + + def test_path_assembly_makes_cudart_reachable_without_toolkit(self, tmp_path): + """The #5106 scenario: GPU detected, pip nvidia wheels present, + no system CUDA toolkit. cudart must be reachable from PATH, and + from BOTH binary_dir (#5322) and a pip nvidia dir (#5324).""" + prefix = tmp_path / "studio_venv" + install = tmp_path / "studio_install" + _populate_studio_venv(prefix) + _populate_studio_install(install, runtime = "13.1") + binary_dir = install / "build" / "bin" / "Release" + path_dirs = _build_path_dirs_like_start_llama_server( + binary_dir, prefix, cuda_path = "" + ) + # binary_dir first -- Windows DLL search step 1. + assert path_dirs[0] == str( + binary_dir + ), f"binary_dir must be first in PATH; got {path_dirs[0]}" + cudart_locations = [] + for entry in path_dirs: + for cudart_name in ("cudart64_12.dll", "cudart64_13.dll"): + if (Path(entry) / cudart_name).exists(): + cudart_locations.append((entry, cudart_name)) + assert cudart_locations, ( + f"cudart unreachable from any PATH entry -- #5106 not fixed.\n" + f"PATH entries searched: {path_dirs}" + ) + # Defence in depth: both fix paths contribute cudart. + sources = {Path(e).relative_to(tmp_path).parts[0] for e, _ in cudart_locations} + assert ( + "studio_install" in sources + ), f"#5322's cudart drop not reachable: {cudart_locations}" + assert ( + "studio_venv" in sources + ), f"#5324's pip nvidia dir not contributing cudart: {cudart_locations}" + + def test_cublas_and_cublasLt_also_reachable(self, tmp_path): + """ggml-cuda imports cublas64; cublas64 imports cublasLt64. All + three must resolve or LoadLibrary returns NULL.""" + prefix = tmp_path / "studio_venv" + install = tmp_path / "studio_install" + _populate_studio_venv(prefix) + _populate_studio_install(install, runtime = "13.1") + binary_dir = install / "build" / "bin" / "Release" + path_dirs = _build_path_dirs_like_start_llama_server(binary_dir, prefix) + for required in REAL_UPSTREAM_CUDART_BUNDLE["13.1"]: + reachable = any((Path(d) / required).exists() for d in path_dirs) + assert reachable, ( + f"{required} unreachable from PATH; #5106 not fixed.\n" + f"PATH entries: {path_dirs}" + ) + + def test_no_pip_nvidia_wheels_still_works_via_install_dir(self, tmp_path): + """No pip nvidia wheels (CPU-only torch / unsloth run standalone): + cudart still resolves via #5322's binary_dir drop.""" + prefix = tmp_path / "bare_venv" + prefix.mkdir() + install = tmp_path / "studio_install" + _populate_studio_install(install, runtime = "13.1") + binary_dir = install / "build" / "bin" / "Release" + path_dirs = _build_path_dirs_like_start_llama_server(binary_dir, prefix) + assert path_dirs == [ + str(binary_dir) + ], f"bare venv produced unexpected PATH: {path_dirs}" + for required in REAL_UPSTREAM_CUDART_BUNDLE["13.1"]: + assert ( + binary_dir / required + ).exists(), f"{required} missing from binary_dir on bare venv install" + + def test_no_install_dir_still_works_via_pip_wheels(self, tmp_path): + """Pre-#5322 install (binary_dir lacks cudart): #5324's pip + wheel directories on PATH still resolve cudart.""" + prefix = tmp_path / "studio_venv" + _populate_studio_venv(prefix) + install = tmp_path / "studio_install_pre5322" + rel = install / "build" / "bin" / "Release" + rel.mkdir(parents = True) + # Main archive payload only; cudart bundle absent. + for fn in ( + "llama-server.exe", + "llama.dll", + "ggml-cuda.dll", + "ggml-base.dll", + ): + (rel / fn).write_bytes(b"PE-stub") + path_dirs = _build_path_dirs_like_start_llama_server(rel, prefix) + cudart_reachable = any( + (Path(d) / "cudart64_12.dll").exists() + or (Path(d) / "cudart64_13.dll").exists() + for d in path_dirs + ) + assert cudart_reachable, ( + "#5324 pip wheel fallback failed: cudart unreachable from PATH " + f"on cudart-less install. PATH entries: {path_dirs}" + ) + cublas_reachable = any( + (Path(d) / "cublas64_12.dll").exists() + or (Path(d) / "cublas64_13.dll").exists() + for d in path_dirs + ) + assert cublas_reachable, "cublas unreachable on cudart-less install" + + def test_pre_pr_scenario_would_have_failed(self, tmp_path): + """Negative control: pre-#5322 + pre-#5324 world leaves cudart + unreachable -- the original failure mode. Confirms the test + actually catches a regression.""" + prefix = tmp_path / "studio_venv" + _populate_studio_venv(prefix) + install = tmp_path / "pre_pr_install" + rel = install / "build" / "bin" / "Release" + rel.mkdir(parents = True) + for fn in ("llama-server.exe", "llama.dll", "ggml-cuda.dll"): + (rel / fn).write_bytes(b"PE-stub") + # Pre-PR PATH: binary_dir only. No pip nvidia dirs, no toolkit. + pre_pr_path_dirs = [str(rel)] + cudart_reachable_pre = any( + (Path(d) / "cudart64_12.dll").exists() + or (Path(d) / "cudart64_13.dll").exists() + for d in pre_pr_path_dirs + ) + assert not cudart_reachable_pre, ( + "Test self-check failed: pre-PR scenario unexpectedly had " + f"cudart reachable. {pre_pr_path_dirs}" + ) + + +class TestWindowsSysPlatformMocked: + """Confirm the win32 branch in start_llama_server is what we test + (not the linux fallback). Patches sys.platform and re-runs the + branch-selecting helper.""" + + def test_sys_platform_win32_uses_pip_nvidia_resolver(self, monkeypatch, tmp_path): + monkeypatch.setattr(sys, "platform", "win32") + prefix = tmp_path / "studio_venv" + _populate_studio_venv(prefix) + out = LlamaCppBackend._windows_pip_nvidia_dll_dirs(str(prefix)) + assert out, f"resolver returned empty under sys.platform=win32: {out}" + # cu13 arch dir must be in the output. + cu13_arch = ( + prefix / "Lib" / "site-packages" / "nvidia" / "cu13" / "bin" / "x86_64" + ) + assert str(cu13_arch) in out diff --git a/studio/install_llama_prebuilt.py b/studio/install_llama_prebuilt.py index 11f425eed1..dd44f19691 100644 --- a/studio/install_llama_prebuilt.py +++ b/studio/install_llama_prebuilt.py @@ -2952,7 +2952,7 @@ def windows_cuda_attempts( # binary archive, not the cudart archive itself. runtime_archive_name: str | None = None runtime_archive_url: str | None = None - if selected_name.startswith(f"llama-"): + if selected_name.startswith("llama-"): cudart_name = f"cudart-llama-bin-win-cuda-{runtime}-x64.zip" cudart_url = upstream_assets.get(cudart_name) if cudart_url and cudart_url != asset_url: From 5a6e94d422f8fdcd3813790b7ad2c3f8e69d1b63 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:15:42 -0700 Subject: [PATCH 25/62] Studio: auto-enable MTP speculative decoding for MTP GGUFs (#5527) * Studio: auto-enable MTP speculative decoding for MTP GGUFs Detect Unsloth's MTP (multi-token-prediction) GGUFs and auto-emit the right --spec-type draft-mtp flags for llama-server (llama.cpp PR #22673), so users get the speedup without configuration. Detection prefers the GGUF metadata field .nextn_predict_layers (verified on Qwen3.6-27B-MTP-GGUF / qwen35 and Qwen3.6-35B-A3B-MTP-GGUF / qwen35moe). Falls back to a -MTP marker in the identifier / filename so HF-mode loads can detect MTP from the repo name before the GGUF is downloaded. Flag presets follow the Unsloth MTP guide: GPU: --spec-type draft-mtp --spec-draft-n-max 6 CPU/Mac: --spec-type draft-mtp --spec-draft-n-max 3 \ --spec-type ngram-mod --spec-ngram-mod-n-match 24 \ --spec-ngram-mod-n-min 48 --spec-ngram-mod-n-max 6 User overrides win: if the caller passes --spec-type / --spec-default via unsloth run / unsloth studio run pass-through (or HTTP llama_extra_args), the auto-emit steps aside so llama-server only sees the user's flag. Scalar tuning knobs like --spec-draft-n-max compose with the auto preset via llama-server's last-wins parsing. _already_in_target_state mirrors the same promotion so a repeat /load with unchanged settings against an MTP backend running draft-mtp short-circuits cleanly instead of forcing a reload. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/core/inference/llama_cpp.py | 100 ++++- .../core/inference/llama_server_args.py | 6 + .../tests/test_llama_cpp_mtp_detection.py | 411 ++++++++++++++++++ .../backend/tests/test_llama_server_args.py | 46 ++ 4 files changed, 556 insertions(+), 7 deletions(-) create mode 100644 studio/backend/tests/test_llama_cpp_mtp_detection.py diff --git a/studio/backend/core/inference/llama_cpp.py b/studio/backend/core/inference/llama_cpp.py index 0b3c9f958e..e41edbba35 100644 --- a/studio/backend/core/inference/llama_cpp.py +++ b/studio/backend/core/inference/llama_cpp.py @@ -23,7 +23,7 @@ import sys import threading import time from pathlib import Path -from typing import Generator, List, Optional +from typing import Generator, Iterable, List, Optional from urllib.parse import urlparse import httpx @@ -459,6 +459,32 @@ def detect_reasoning_flags( return flags +def _is_mtp_model_name( + model_identifier: Optional[str], + gguf_path: Optional[str] = None, +) -> bool: + """Name-based MTP detector. Fallback for the metadata signal.""" + for cand in (model_identifier, Path(gguf_path).name if gguf_path else None): + if cand and "-mtp" in cand.lower(): + return True + return False + + +def _extra_args_set_spec_type(extra_args: Optional[Iterable[str]]) -> bool: + """User passed --spec-type / --spec-default? llama-server accumulates + repeated --spec-type, so we suppress auto-emit when this is true.""" + if not extra_args: + return False + for raw in extra_args: + tok = str(raw) + if not tok.startswith("--"): + continue + flag = tok.split("=", 1)[0] + if flag in ("--spec-type", "--spec-default"): + return True + return False + + class LlamaCppBackend: """ Manages a llama-server subprocess for GGUF model inference. @@ -514,6 +540,8 @@ class LlamaCppBackend: # Last N layers reuse KV from earlier layers and don't allocate # their own cache (Gemma 3n / Gemma 4: .attention.shared_kv_layers). self._shared_kv_layers: Optional[int] = None + # MTP head count (llama.cpp #22673); >0 enables --spec-type draft-mtp. + self._nextn_predict_layers: Optional[int] = None self._lock = threading.Lock() # Wraps load_model() end-to-end so concurrent loads serialise # and never coexist as two llama-server processes (#5401). @@ -1638,6 +1666,7 @@ class LlamaCppBackend: self._ssm_inner_size = None self._ssm_state_size = None self._shared_kv_layers = None + self._nextn_predict_layers = None try: WANTED = { @@ -1720,6 +1749,7 @@ class LlamaCppBackend: f"{arch}.attention.shared_kv_layers": "shared_kv_layers", f"{arch}.ssm.inner_size": "ssm_inner_size", f"{arch}.ssm.state_size": "ssm_state_size", + f"{arch}.nextn_predict_layers": "nextn_predict_layers", } elif key == "tokenizer.chat_template": self._chat_template = val_s @@ -2510,18 +2540,65 @@ class LlamaCppBackend: # ref: https://github.com/ggml-org/llama.cpp/blob/master/docs/speculative.md # ref: https://github.com/ggml-org/llama.cpp/pull/19164 # ref: https://github.com/ggml-org/llama.cpp/pull/18471 - # ``"default"`` -> let llama-server pick a sensible spec - # config via ``--spec-default``. Explicit type names are - # passed through with the manual draft tuning we've shipped - # historically so power users keep their overrides. - _valid_spec_types = {"ngram-simple", "ngram-mod"} + # draft-mtp: MTP heads on Unsloth's *-MTP GGUFs + # (llama.cpp #22673). Auto-enabled via nextn_predict_layers, + # fallback to -MTP in name. GPU: MTP-only. CPU/Mac: chain + # with ngram-mod. See unsloth.ai/docs/models/qwen3.6#mtp-guide. + _valid_spec_types = {"ngram-simple", "ngram-mod", "draft-mtp"} normalized_spec = ( speculative_type.lower().strip() if speculative_type else None ) + is_mtp_model = bool(self._nextn_predict_layers) or ( + _is_mtp_model_name(model_identifier, model_path) + ) + user_owns_spec_type = _extra_args_set_spec_type(extra_args) + # Auto-promote unset/"default" to draft-mtp on MTP GGUFs. + if ( + is_mtp_model + and not is_vision + and not user_owns_spec_type + and normalized_spec in (None, "", "default") + ): + normalized_spec = "draft-mtp" + if user_owns_spec_type: + # User --spec-type wins (it accumulates if repeated). + normalized_spec = None + self._speculative_type = None if normalized_spec and normalized_spec != "off" and not is_vision: if normalized_spec == "default": cmd.append("--spec-default") self._speculative_type = "default" + elif normalized_spec == "draft-mtp": + if gpus: + cmd.extend( + [ + "--spec-type", + "draft-mtp", + "--spec-draft-n-max", + "6", + ] + ) + else: + cmd.extend( + [ + "--spec-type", + "draft-mtp", + "--spec-draft-n-max", + "3", + "--spec-type", + "ngram-mod", + "--spec-ngram-mod-n-match", + "24", + "--spec-ngram-mod-n-min", + "48", + "--spec-ngram-mod-n-max", + "6", + ] + ) + self._speculative_type = "draft-mtp" + logger.info( + f"Spec decoding: draft-mtp ({'GPU' if gpus else 'CPU/Mac'})" + ) elif normalized_spec in _valid_spec_types: cmd.extend(["--spec-type", normalized_spec]) if normalized_spec == "ngram-mod": @@ -2941,7 +3018,15 @@ class LlamaCppBackend: if self._is_vision or is_vision: req_spec = "off" else: - req_spec = _norm(speculative_type) or "off" + raw_spec = _norm(speculative_type) + req_spec = raw_spec or "off" + # Mirror load_model's auto-promotion so repeat /load matches. + if ( + raw_spec in (None, "default") + and _is_mtp_model_name(model_identifier, gguf_path) + and not _extra_args_set_spec_type(extra_args) + ): + req_spec = "draft-mtp" backend_spec = _norm(self._speculative_type) or "off" if req_spec != backend_spec: return False @@ -3029,6 +3114,7 @@ class LlamaCppBackend: self._ssm_inner_size = None self._ssm_state_size = None self._shared_kv_layers = None + self._nextn_predict_layers = None # Clean up temp chat template file if hasattr(self, "_chat_template_file") and self._chat_template_file: try: diff --git a/studio/backend/core/inference/llama_server_args.py b/studio/backend/core/inference/llama_server_args.py index 0f6927fc5a..572ac2ceda 100644 --- a/studio/backend/core/inference/llama_server_args.py +++ b/studio/backend/core/inference/llama_server_args.py @@ -145,6 +145,12 @@ _SPEC_FLAGS: frozenset[str] = frozenset( "--spec-ngram-size", "--draft-min", "--draft-max", + # MTP path (llama.cpp #22673). + "--spec-draft-n-max", + "--spec-draft-n-min", + "--spec-ngram-mod-n-match", + "--spec-ngram-mod-n-min", + "--spec-ngram-mod-n-max", } ) _TEMPLATE_FLAGS: frozenset[str] = frozenset( diff --git a/studio/backend/tests/test_llama_cpp_mtp_detection.py b/studio/backend/tests/test_llama_cpp_mtp_detection.py new file mode 100644 index 0000000000..7ae245a1da --- /dev/null +++ b/studio/backend/tests/test_llama_cpp_mtp_detection.py @@ -0,0 +1,411 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""Tests for the MTP auto-detection path (llama.cpp #22673). + +Pins three contracts: name-based detector, user-override detector, and +the _already_in_target_state mirror that prevents needless reloads. +""" + +from __future__ import annotations + +import struct +import sys +import types as _types +from pathlib import Path + +_BACKEND_DIR = str(Path(__file__).resolve().parent.parent) +if _BACKEND_DIR not in sys.path: + sys.path.insert(0, _BACKEND_DIR) + +_loggers_stub = _types.ModuleType("loggers") +_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name) +sys.modules.setdefault("loggers", _loggers_stub) + +_structlog_stub = _types.ModuleType("structlog") +_structlog_stub.get_logger = lambda *a, **k: __import__("logging").getLogger("stub") +sys.modules.setdefault("structlog", _structlog_stub) + +_httpx_stub = _types.ModuleType("httpx") +for _exc in ( + "ConnectError", + "TimeoutException", + "ReadTimeout", + "ReadError", + "RemoteProtocolError", + "CloseError", +): + setattr(_httpx_stub, _exc, type(_exc, (Exception,), {})) +_httpx_stub.Timeout = type("T", (), {"__init__": lambda s, *a, **k: None}) +_httpx_stub.Client = type( + "C", + (), + { + "__init__": lambda s, **kw: None, + "__enter__": lambda s: s, + "__exit__": lambda s, *a: None, + }, +) +sys.modules.setdefault("httpx", _httpx_stub) + +import pytest + +from core.inference.llama_cpp import ( + LlamaCppBackend, + _extra_args_set_spec_type, + _is_mtp_model_name, +) + + +# Synthetic GGUF helper (mirrors test_gguf_metadata.py). + +_GGUF_MAGIC = 0x46554747 +_VTYPE_STRING = 8 +_VTYPE_UINT32 = 4 + + +def _enc_string(s: str) -> bytes: + b = s.encode("utf-8") + return struct.pack(" bytes: + return _enc_string(key) + struct.pack(" bytes: + return ( + _enc_string(key) + struct.pack(" Path: + """Header-only GGUF with arch + optional nextn_predict_layers.""" + extra_uint32 = dict(extra_uint32 or {}) + body = _enc_kv_string("general.architecture", arch) + kv_count = 1 + if nextn is not None: + body += _enc_kv_uint32(f"{arch}.nextn_predict_layers", nextn) + kv_count += 1 + for k, v in extra_uint32.items(): + body += _enc_kv_uint32(k, v) + kv_count += 1 + header = struct.pack("0 should match. + ("qwen3moe", 2), + ("hypothetical_future_arch", 4), + ], +) +def test_read_gguf_metadata_captures_nextn_predict_layers(tmp_path, arch, nextn): + gguf = _write_minimal_gguf( + tmp_path / "model.gguf", + arch = arch, + nextn = nextn, + extra_uint32 = {f"{arch}.block_count": 4}, + ) + backend = LlamaCppBackend() + backend._read_gguf_metadata(str(gguf)) + assert backend._nextn_predict_layers == nextn + + +def test_read_gguf_metadata_leaves_nextn_unset_for_non_mtp_arch(tmp_path): + gguf = _write_minimal_gguf( + tmp_path / "model.gguf", + arch = "qwen3", + nextn = None, + extra_uint32 = {"qwen3.block_count": 4}, + ) + backend = LlamaCppBackend() + backend._read_gguf_metadata(str(gguf)) + assert backend._nextn_predict_layers is None + + +def test_read_gguf_metadata_zero_nextn_is_falsy(tmp_path): + # bool(0) is False, so the spec block short-circuits. + gguf = _write_minimal_gguf( + tmp_path / "model.gguf", + arch = "qwen35", + nextn = 0, + extra_uint32 = {"qwen35.block_count": 4}, + ) + backend = LlamaCppBackend() + backend._read_gguf_metadata(str(gguf)) + assert backend._nextn_predict_layers == 0 + assert bool(backend._nextn_predict_layers) is False + + +def test_unload_resets_nextn_predict_layers(): + # MTP state from a previous load must not bleed into the next load. + backend = LlamaCppBackend() + backend._nextn_predict_layers = 1 + backend.unload_model() + assert backend._nextn_predict_layers is None diff --git a/studio/backend/tests/test_llama_server_args.py b/studio/backend/tests/test_llama_server_args.py index 3013acfdb8..f4dabfcf08 100644 --- a/studio/backend/tests/test_llama_server_args.py +++ b/studio/backend/tests/test_llama_server_args.py @@ -42,6 +42,23 @@ from core.inference.llama_server_args import ( ["--chat-template-kwargs", '{"reasoning_effort":"high"}'], ["--spec-type", "ngram-mod"], ["--spec-default"], + # MTP path (llama.cpp #22673). + ["--spec-type", "draft-mtp"], + ["--spec-type", "draft-mtp", "--spec-draft-n-max", "6"], + [ + "--spec-type", + "draft-mtp", + "--spec-draft-n-max", + "3", + "--spec-type", + "ngram-mod", + "--spec-ngram-mod-n-match", + "24", + "--spec-ngram-mod-n-min", + "48", + "--spec-ngram-mod-n-max", + "6", + ], # Reasoning controls ["--reasoning-format", "deepseek"], ["-rea", "auto"], @@ -266,6 +283,35 @@ def test_strip_shadowing_flags_keeps_spec_when_spec_disabled(): ] +def test_strip_shadowing_flags_drops_mtp_flags_when_requested(): + # MTP / draft-mtp flags must be stripped when speculative_type is re-applied. + out = strip_shadowing_flags( + [ + "--spec-type", + "draft-mtp", + "--spec-draft-n-max", + "6", + "--spec-ngram-mod-n-match", + "24", + "--spec-ngram-mod-n-min", + "48", + "--spec-ngram-mod-n-max", + "6", + "--top-k", + "20", + ], + strip_spec = True, + ) + assert out == ["--top-k", "20"] + + +def test_is_managed_flag_false_for_mtp_pass_through(): + assert is_managed_flag("--spec-draft-n-max") is False + assert is_managed_flag("--spec-ngram-mod-n-match") is False + assert is_managed_flag("--spec-ngram-mod-n-min") is False + assert is_managed_flag("--spec-ngram-mod-n-max") is False + + def test_strip_shadowing_flags_boolean_does_not_consume_next_token(): # --spec-default is a boolean shadowing flag; the value-skipping # heuristic must skip just the flag, not the following positional. From fc04809bfe4447f12ee6b2bee52313ff2384032d Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:19:47 -0700 Subject: [PATCH 26/62] Studio: warn when llama.cpp prebuilt is too old for MTP (#5528) * Studio: warn when llama.cpp prebuilt is too old for MTP Layered on #5527. Adds a one-shot llama-server --help capability probe so users get a clear signal when their prebuilt is missing MTP support, plus a graceful fallback if they load an MTP GGUF against an outdated binary. What's surfaced: 1. Startup log + stderr line in main.py:lifespan() if MTP isn't advertised: WARNING: llama.cpp prebuilt is missing MTP support (--spec-type mtp / draft-mtp). Run `unsloth studio update` to refresh it. MTP GGUFs will load without speculative decoding. 2. Load-time graceful fallback in load_model's spec block: skip the auto-emit and log a clear warning instead of letting llama-server fail with an unknown-flag error. 3. /api/inference/status now returns llama_cpp_supports_mtp: bool so the frontend can show a banner / popup. Probe internals: - Class-level cache keyed on (binary_path, mtime). One subprocess call the first time, instant thereafter. Touching the binary (e.g. via `unsloth studio update`) invalidates the cache automatically because the mtime changes, so the new build is picked up without restarting the server. - Recognises both upstream naming forms: the original draft-mtp from llama.cpp PR #22673 and the renamed mtp variant in later commits. - Spec block uses whichever token the binary accepts so we emit the right value regardless of which release the user has. Tests: - 6 new cases in test_llama_cpp_mtp_detection.py covering each probe variant (draft-mtp, renamed mtp, pre-MTP build, missing binary, mtime-based cache invalidation). - Existing 38 MTP detection cases still pass; broader 188-test regression suite (server args, reload inheritance, gguf metadata, load progress, context fit, model validation) still green. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/core/inference/llama_cpp.py | 123 ++++++++++++++---- studio/backend/main.py | 23 ++++ studio/backend/models/inference.py | 7 + studio/backend/routes/inference.py | 9 ++ .../tests/test_llama_cpp_mtp_detection.py | 85 ++++++++++++ 5 files changed, 220 insertions(+), 27 deletions(-) diff --git a/studio/backend/core/inference/llama_cpp.py b/studio/backend/core/inference/llama_cpp.py index e41edbba35..cf46d580af 100644 --- a/studio/backend/core/inference/llama_cpp.py +++ b/studio/backend/core/inference/llama_cpp.py @@ -915,6 +915,61 @@ class LlamaCppBackend: return None + # ── llama-server capability probe ───────────────────────────── + + # Cached on (path, mtime); `unsloth studio update` bumps mtime. + _capability_cache: dict[tuple[str, int], dict[str, object]] = {} + + @classmethod + def probe_server_capabilities( + cls, binary: Optional[str] = None + ) -> dict[str, object]: + """Parse `llama-server --help` for feature flags. Returns + {found, mtp_token, supports_mtp}. mtp_token is "draft-mtp" + (older) or "mtp" (renamed upstream), or None.""" + bin_path = binary or cls._find_llama_server_binary() + if not bin_path or not Path(bin_path).is_file(): + return {"found": False, "mtp_token": None, "supports_mtp": False} + try: + mtime = int(Path(bin_path).stat().st_mtime) + except OSError: + mtime = 0 + cache_key = (bin_path, mtime) + cached = cls._capability_cache.get(cache_key) + if cached is not None: + return cached + + mtp_token: Optional[str] = None + try: + result = subprocess.run( + [bin_path, "--help"], + capture_output = True, + text = True, + timeout = 10, + check = False, + ) + help_text = (result.stdout or "") + "\n" + (result.stderr or "") + spec_line = "" + for line in help_text.splitlines(): + if "--spec-type" in line: + spec_line = line + break + # PR #22673 used draft-mtp; later renamed to mtp. + if "draft-mtp" in spec_line: + mtp_token = "draft-mtp" + elif re.search(r"[|,\[]mtp[|,\]]", spec_line): + mtp_token = "mtp" + except (OSError, subprocess.SubprocessError) as exc: + logger.debug(f"llama-server --help probe failed: {exc}") + + info = { + "found": True, + "mtp_token": mtp_token, + "supports_mtp": mtp_token is not None, + } + cls._capability_cache[cache_key] = info + return info + # ── GPU allocation ──────────────────────────────────────────── @staticmethod @@ -2569,36 +2624,50 @@ class LlamaCppBackend: cmd.append("--spec-default") self._speculative_type = "default" elif normalized_spec == "draft-mtp": - if gpus: - cmd.extend( - [ - "--spec-type", - "draft-mtp", - "--spec-draft-n-max", - "6", - ] + # Probe binary; fail gracefully on outdated prebuilts. + # Use whichever token the binary advertises + # (older: draft-mtp; renamed upstream: mtp). + caps = self.probe_server_capabilities(binary) + mtp_token = caps.get("mtp_token") if caps else None + if not mtp_token: + logger.warning( + "MTP GGUF detected but llama-server lacks " + "--spec-type mtp/draft-mtp; run " + "`unsloth studio update`. Loading without " + "speculative decoding." ) + self._speculative_type = None else: - cmd.extend( - [ - "--spec-type", - "draft-mtp", - "--spec-draft-n-max", - "3", - "--spec-type", - "ngram-mod", - "--spec-ngram-mod-n-match", - "24", - "--spec-ngram-mod-n-min", - "48", - "--spec-ngram-mod-n-max", - "6", - ] + if gpus: + cmd.extend( + [ + "--spec-type", + mtp_token, + "--spec-draft-n-max", + "6", + ] + ) + else: + cmd.extend( + [ + "--spec-type", + mtp_token, + "--spec-draft-n-max", + "3", + "--spec-type", + "ngram-mod", + "--spec-ngram-mod-n-match", + "24", + "--spec-ngram-mod-n-min", + "48", + "--spec-ngram-mod-n-max", + "6", + ] + ) + self._speculative_type = "draft-mtp" + logger.info( + f"Spec decoding: {mtp_token} ({'GPU' if gpus else 'CPU/Mac'})" ) - self._speculative_type = "draft-mtp" - logger.info( - f"Spec decoding: draft-mtp ({'GPU' if gpus else 'CPU/Mac'})" - ) elif normalized_spec in _valid_spec_types: cmd.extend(["--spec-type", normalized_spec]) if normalized_spec == "ngram-mod": diff --git a/studio/backend/main.py b/studio/backend/main.py index cb277f7007..e4392792a7 100644 --- a/studio/backend/main.py +++ b/studio/backend/main.py @@ -198,6 +198,29 @@ async def lifespan(app: FastAPI): # Detect hardware first — sets DEVICE global used everywhere detect_hardware() + # llama.cpp capability probe; warns if the prebuilt lacks MTP support. + try: + from core.inference.llama_cpp import LlamaCppBackend + + _caps = LlamaCppBackend.probe_server_capabilities() + app.state.llama_cpp_capabilities = _caps + if _caps.get("found") and not _caps.get("supports_mtp"): + import structlog as _structlog + + _msg = ( + "llama.cpp prebuilt lacks MTP support " + "(--spec-type mtp/draft-mtp). Run `unsloth studio update`. " + "MTP GGUFs will load without speculative decoding." + ) + _structlog.get_logger(__name__).warning(_msg) + print(f"WARNING: {_msg}", flush = True) + except Exception as _probe_exc: + import structlog as _structlog + + _structlog.get_logger(__name__).debug( + "llama.cpp capability probe failed: %s", _probe_exc + ) + from storage.studio_db import cleanup_orphaned_runs try: diff --git a/studio/backend/models/inference.py b/studio/backend/models/inference.py index d03a8dff44..d772f517d7 100644 --- a/studio/backend/models/inference.py +++ b/studio/backend/models/inference.py @@ -342,6 +342,13 @@ class InferenceStatusResponse(BaseModel): None, description = "Active speculative decoding mode (e.g. 'ngram-simple', 'ngram-mod'), or None if disabled", ) + llama_cpp_supports_mtp: bool = Field( + True, + description = ( + "Whether llama.cpp supports MTP (--spec-type mtp/draft-mtp). " + "False -> recommend `unsloth studio update`." + ), + ) # ===================================================================== diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py index 6d05be2310..9893f84711 100644 --- a/studio/backend/routes/inference.py +++ b/studio/backend/routes/inference.py @@ -1282,6 +1282,13 @@ async def get_status( try: llama_backend = get_llama_cpp_backend() + # MTP capability probe (cached). Drives the UI update banner. + try: + _caps = type(llama_backend).probe_server_capabilities() + _supports_mtp = bool(_caps.get("supports_mtp", False)) + except Exception: + _supports_mtp = True # fail open + # If a GGUF model is loaded via llama-server, report that if llama_backend.is_loaded: _model_id = llama_backend.model_identifier @@ -1324,6 +1331,7 @@ async def get_status( cache_type_kv = llama_backend.cache_type_kv, chat_template_override = llama_backend.chat_template_override, speculative_type = llama_backend.speculative_type, + llama_cpp_supports_mtp = _supports_mtp, ) # Otherwise, report Unsloth backend status @@ -1384,6 +1392,7 @@ async def get_status( supports_preserve_thinking = False, supports_tools = False, chat_template = chat_template, + llama_cpp_supports_mtp = _supports_mtp, ) except Exception as e: diff --git a/studio/backend/tests/test_llama_cpp_mtp_detection.py b/studio/backend/tests/test_llama_cpp_mtp_detection.py index 7ae245a1da..c6a170fa0a 100644 --- a/studio/backend/tests/test_llama_cpp_mtp_detection.py +++ b/studio/backend/tests/test_llama_cpp_mtp_detection.py @@ -409,3 +409,88 @@ def test_unload_resets_nextn_predict_layers(): backend._nextn_predict_layers = 1 backend.unload_model() assert backend._nextn_predict_layers is None + + +# llama-server capability probe. + + +def _make_fake_llama_server(path: Path, help_text: str) -> Path: + """Bash stub that prints `help_text` on --help.""" + path.write_text("#!/usr/bin/env bash\n" f"cat <<'EOF'\n{help_text}\nEOF\n") + path.chmod(0o755) + return path + + +def _clear_caps_cache(): + LlamaCppBackend._capability_cache.clear() + + +def test_probe_server_capabilities_detects_draft_mtp(tmp_path): + # Original naming from llama.cpp #22673. + fake = _make_fake_llama_server( + tmp_path / "llama-server", + "--spec-type none,draft-simple,draft-eagle3,draft-mtp," + "ngram-simple,ngram-map-k,ngram-map-k4v,ngram-mod,ngram-cache", + ) + _clear_caps_cache() + caps = LlamaCppBackend.probe_server_capabilities(str(fake)) + assert caps["found"] is True + assert caps["mtp_token"] == "draft-mtp" + assert caps["supports_mtp"] is True + + +def test_probe_server_capabilities_detects_renamed_mtp(tmp_path): + # Renamed upstream: draft-mtp -> mtp. + fake = _make_fake_llama_server( + tmp_path / "llama-server", + "--spec-type [none|mtp|ngram-cache|ngram-simple|ngram-map-k|" + "ngram-map-k4v|ngram-mod]", + ) + _clear_caps_cache() + caps = LlamaCppBackend.probe_server_capabilities(str(fake)) + assert caps["mtp_token"] == "mtp" + assert caps["supports_mtp"] is True + + +def test_probe_server_capabilities_reports_outdated_binary(tmp_path): + # Pre-MTP llama.cpp: only ngram variants. + fake = _make_fake_llama_server( + tmp_path / "llama-server", + "--spec-type none,ngram-simple,ngram-mod", + ) + _clear_caps_cache() + caps = LlamaCppBackend.probe_server_capabilities(str(fake)) + assert caps["found"] is True + assert caps["mtp_token"] is None + assert caps["supports_mtp"] is False + + +def test_probe_server_capabilities_handles_missing_binary(): + _clear_caps_cache() + caps = LlamaCppBackend.probe_server_capabilities("/no/such/llama-server") + assert caps["found"] is False + assert caps["supports_mtp"] is False + + +def test_probe_server_capabilities_caches_by_mtime(tmp_path): + # Same (path, mtime) -> cache hit. Bumped mtime -> re-probe. + fake = _make_fake_llama_server( + tmp_path / "llama-server", + "--spec-type none,ngram-mod", + ) + _clear_caps_cache() + caps1 = LlamaCppBackend.probe_server_capabilities(str(fake)) + assert caps1["supports_mtp"] is False + + import os + import time + + _make_fake_llama_server( + fake, + "--spec-type none,draft-mtp,ngram-mod", + ) + new_mtime = int(time.time()) + 2 + os.utime(fake, (new_mtime, new_mtime)) + caps2 = LlamaCppBackend.probe_server_capabilities(str(fake)) + assert caps2["mtp_token"] == "draft-mtp" + assert caps2["supports_mtp"] is True From c690b28e99e35cd48f3c0753315e61d65a258da3 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:21:50 -0700 Subject: [PATCH 27/62] Studio: warn when llama.cpp prebuilt is at least 3 days behind (#5529) * Studio: warn when llama.cpp prebuilt is at least 3 days behind Layered on #5528. Generalises the MTP-specific staleness warning to every llama.cpp prebuilt update, not just the ones that add MTP. If the installed prebuilt is at least 3 days old AND its tag differs from the latest published tag on the helper release repo (default unslothai/llama.cpp), Studio nudges the user to run "unsloth studio update". How it works Reads the install marker UNSLOTH_PREBUILT_INFO.json that install_llama_prebuilt.py already writes to install_dir. The marker carries the installed tag, the helper repo, and an installed_at_utc timestamp. Studio compares those against the latest published tag from the GitHub releases API for the helper repo. GitHub fetch is cached at two levels: - Process-level memo for /status hot path. - Disk-level cache (24h TTL) at ~/.unsloth/studio/cache/llama_cpp_freshness/ so cold-start Studio launches do not always hit the API. On a transient fetch failure (offline, rate-limited) we keep the last-good disk value alive rather than poisoning the cache with None. The check fails open: if anything is missing (marker, timestamp, GitHub response), stale stays False so users never see a misleading banner. Surfaced in two places 1. Startup banner (logs + stderr) in main.py:lifespan(), alongside the MTP capability probe added in #5528. Single line, e.g.: WARNING: llama.cpp prebuilt is 5 days behind: installed b9190, latest b9300. Run "unsloth studio update" to refresh. 2. /api/inference/status now returns: llama_cpp_prebuilt_stale: bool llama_cpp_installed_tag: str | None llama_cpp_latest_tag: str | None so the frontend can render a banner / popup with the actual tag delta the user is missing. 3-day threshold Mirrors the typical Unsloth llama.cpp release cadence. Anything shorter would nag users who restart Studio at the wrong moment; longer leaves real bugs sitting on the user's machine. Configurable via the threshold_days kwarg if a future call site wants a different window. Tests 17 new cases in tests/test_llama_cpp_freshness.py cover marker discovery in both cmake and root install layouts, missing / invalid marker, GitHub fetch caching across process restarts (disk cache hit after the in-memory cache is reset), the stale / not-stale decision matrix (tag mismatch + age threshold), fail-open behaviour when GitHub is unreachable, custom threshold, singular/plural day in the warning string, and unparseable installed_at_utc. The broader 205-test inference regression suite still passes. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/main.py | 26 +- studio/backend/models/inference.py | 15 + studio/backend/routes/inference.py | 21 +- .../backend/tests/test_llama_cpp_freshness.py | 328 ++++++++++++++++++ studio/backend/utils/llama_cpp_freshness.py | 244 +++++++++++++ 5 files changed, 626 insertions(+), 8 deletions(-) create mode 100644 studio/backend/tests/test_llama_cpp_freshness.py create mode 100644 studio/backend/utils/llama_cpp_freshness.py diff --git a/studio/backend/main.py b/studio/backend/main.py index e4392792a7..d4593c2ab4 100644 --- a/studio/backend/main.py +++ b/studio/backend/main.py @@ -198,27 +198,41 @@ async def lifespan(app: FastAPI): # Detect hardware first — sets DEVICE global used everywhere detect_hardware() - # llama.cpp capability probe; warns if the prebuilt lacks MTP support. + # llama.cpp probes: capability (MTP support) + freshness (release age). + # Both cached; freshness has a 24h disk TTL. try: from core.inference.llama_cpp import LlamaCppBackend + from utils.llama_cpp_freshness import ( + check_prebuilt_freshness, + format_stale_warning, + ) - _caps = LlamaCppBackend.probe_server_capabilities() + _bin = LlamaCppBackend._find_llama_server_binary() + _caps = LlamaCppBackend.probe_server_capabilities(_bin) app.state.llama_cpp_capabilities = _caps - if _caps.get("found") and not _caps.get("supports_mtp"): - import structlog as _structlog + _freshness = check_prebuilt_freshness(_bin) + app.state.llama_cpp_freshness = _freshness + import structlog as _structlog + + _log = _structlog.get_logger(__name__) + if _caps.get("found") and not _caps.get("supports_mtp"): _msg = ( "llama.cpp prebuilt lacks MTP support " "(--spec-type mtp/draft-mtp). Run `unsloth studio update`. " "MTP GGUFs will load without speculative decoding." ) - _structlog.get_logger(__name__).warning(_msg) + _log.warning(_msg) + print(f"WARNING: {_msg}", flush = True) + if _freshness.get("stale"): + _msg = format_stale_warning(_freshness) + _log.warning(_msg) print(f"WARNING: {_msg}", flush = True) except Exception as _probe_exc: import structlog as _structlog _structlog.get_logger(__name__).debug( - "llama.cpp capability probe failed: %s", _probe_exc + "llama.cpp startup probes failed: %s", _probe_exc ) from storage.studio_db import cleanup_orphaned_runs diff --git a/studio/backend/models/inference.py b/studio/backend/models/inference.py index d772f517d7..99d1df37b6 100644 --- a/studio/backend/models/inference.py +++ b/studio/backend/models/inference.py @@ -349,6 +349,21 @@ class InferenceStatusResponse(BaseModel): "False -> recommend `unsloth studio update`." ), ) + llama_cpp_prebuilt_stale: bool = Field( + False, + description = ( + "Installed llama.cpp prebuilt is >=3 days behind the latest " + "release. True -> show `unsloth studio update` banner." + ), + ) + llama_cpp_installed_tag: Optional[str] = Field( + None, + description = "Installed llama.cpp tag, or None if unknown.", + ) + llama_cpp_latest_tag: Optional[str] = Field( + None, + description = "Latest published llama.cpp tag, or None if GitHub unreachable.", + ) # ===================================================================== diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py index 9893f84711..d92b6b433e 100644 --- a/studio/backend/routes/inference.py +++ b/studio/backend/routes/inference.py @@ -1282,12 +1282,23 @@ async def get_status( try: llama_backend = get_llama_cpp_backend() - # MTP capability probe (cached). Drives the UI update banner. + # MTP probe + freshness check (both cached). Drive the UI banner. try: - _caps = type(llama_backend).probe_server_capabilities() + _bin = type(llama_backend)._find_llama_server_binary() + _caps = type(llama_backend).probe_server_capabilities(_bin) _supports_mtp = bool(_caps.get("supports_mtp", False)) except Exception: + _bin = None _supports_mtp = True # fail open + try: + from utils.llama_cpp_freshness import check_prebuilt_freshness + + _freshness = check_prebuilt_freshness(_bin) + except Exception: + _freshness = {} + _stale = bool(_freshness.get("stale")) + _installed_tag = _freshness.get("installed_tag") + _latest_tag = _freshness.get("latest_tag") # If a GGUF model is loaded via llama-server, report that if llama_backend.is_loaded: @@ -1332,6 +1343,9 @@ async def get_status( chat_template_override = llama_backend.chat_template_override, speculative_type = llama_backend.speculative_type, llama_cpp_supports_mtp = _supports_mtp, + llama_cpp_prebuilt_stale = _stale, + llama_cpp_installed_tag = _installed_tag, + llama_cpp_latest_tag = _latest_tag, ) # Otherwise, report Unsloth backend status @@ -1393,6 +1407,9 @@ async def get_status( supports_tools = False, chat_template = chat_template, llama_cpp_supports_mtp = _supports_mtp, + llama_cpp_prebuilt_stale = _stale, + llama_cpp_installed_tag = _installed_tag, + llama_cpp_latest_tag = _latest_tag, ) except Exception as e: diff --git a/studio/backend/tests/test_llama_cpp_freshness.py b/studio/backend/tests/test_llama_cpp_freshness.py new file mode 100644 index 0000000000..b32aeefcdb --- /dev/null +++ b/studio/backend/tests/test_llama_cpp_freshness.py @@ -0,0 +1,328 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""Tests for the llama.cpp prebuilt freshness check. + +Pins the marker parser, the disk+memory cache, the stale decision +matrix, and fail-open behaviour on missing data. +""" + +from __future__ import annotations + +import json +import os +import sys +import time +import types as _types +from datetime import datetime, timedelta, timezone +from pathlib import Path + +_BACKEND_DIR = str(Path(__file__).resolve().parent.parent) +if _BACKEND_DIR not in sys.path: + sys.path.insert(0, _BACKEND_DIR) + +_loggers_stub = _types.ModuleType("loggers") +_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name) +sys.modules.setdefault("loggers", _loggers_stub) + +_structlog_stub = _types.ModuleType("structlog") +_structlog_stub.get_logger = lambda *a, **k: __import__("logging").getLogger("stub") +sys.modules.setdefault("structlog", _structlog_stub) + +import pytest + +from utils import llama_cpp_freshness as fr + + +# Helpers. + + +def _write_marker(install_dir: Path, **overrides) -> Path: + payload = { + "requested_tag": "latest", + "tag": "b9190", + "release_tag": "b9190", + "published_repo": "unslothai/llama.cpp", + "asset": "app-b9190-linux-x64-cuda13-newer.tar.gz", + "asset_sha256": None, + "source": "published", + "installed_at_utc": (datetime.now(tz = timezone.utc) - timedelta(days = 1)) + .isoformat() + .replace("+00:00", "Z"), + } + payload.update(overrides) + install_dir.mkdir(parents = True, exist_ok = True) + (install_dir / "UNSLOTH_PREBUILT_INFO.json").write_text(json.dumps(payload)) + return install_dir / "UNSLOTH_PREBUILT_INFO.json" + + +def _fake_binary(install_dir: Path, *, layout: str = "cmake") -> Path: + """Stub llama-server under one of the supported install layouts.""" + if layout == "cmake": + bin_dir = install_dir / "build" / "bin" + bin_name = "llama-server" + elif layout == "root": + bin_dir = install_dir + bin_name = "llama-server" + elif layout == "windows": + bin_dir = install_dir / "build" / "bin" / "Release" + bin_name = "llama-server.exe" + else: + raise ValueError(f"unknown layout {layout}") + bin_dir.mkdir(parents = True, exist_ok = True) + bin_path = bin_dir / bin_name + bin_path.write_text("stub\n") + return bin_path + + +@pytest.fixture(autouse = True) +def _reset(monkeypatch, tmp_path): + # Isolate disk cache per-test; never touch the user's real cache. + monkeypatch.setattr(fr, "_cache_dir", lambda: tmp_path / ".freshness") + fr.reset_caches() + yield + fr.reset_caches() + + +# read_install_marker. + + +def test_read_install_marker_finds_cmake_layout(tmp_path): + install_dir = tmp_path / "llama.cpp" + _write_marker(install_dir, tag = "b9190") + bin_path = _fake_binary(install_dir, layout = "cmake") + marker = fr.read_install_marker(str(bin_path)) + assert marker is not None + assert marker["tag"] == "b9190" + assert marker["published_repo"] == "unslothai/llama.cpp" + + +def test_read_install_marker_finds_root_layout(tmp_path): + install_dir = tmp_path / "llama.cpp" + _write_marker(install_dir, tag = "b9999") + bin_path = _fake_binary(install_dir, layout = "root") + marker = fr.read_install_marker(str(bin_path)) + assert marker is not None + assert marker["tag"] == "b9999" + + +def test_read_install_marker_finds_windows_cmake_layout(tmp_path): + # Windows cmake puts the .exe under build/bin/Release/, so the + # marker is four levels above the binary. + install_dir = tmp_path / "llama.cpp" + _write_marker(install_dir, tag = "b8888") + bin_path = _fake_binary(install_dir, layout = "windows") + marker = fr.read_install_marker(str(bin_path)) + assert marker is not None + assert marker["tag"] == "b8888" + + +@pytest.mark.parametrize("repo", ["unslothai/llama.cpp", "ggml-org/llama.cpp"]) +def test_read_install_marker_carries_published_repo_dynamically(tmp_path, repo): + # The freshness check queries whichever release repo the marker + # records, so CUDA Linux (unslothai), CPU Linux x86_64 / macOS + # (ggml-org), and ROCm source-build (unslothai upstream label) + # all surface the right "latest" tag. + install_dir = tmp_path / "llama.cpp" + _write_marker(install_dir, tag = "b9000", published_repo = repo) + bin_path = _fake_binary(install_dir, layout = "cmake") + marker = fr.read_install_marker(str(bin_path)) + assert marker is not None + assert marker["published_repo"] == repo + + +def test_read_install_marker_missing_returns_none(tmp_path): + bin_path = _fake_binary(tmp_path / "no_marker", layout = "root") + assert fr.read_install_marker(str(bin_path)) is None + + +def test_read_install_marker_handles_invalid_json(tmp_path): + install_dir = tmp_path / "llama.cpp" + install_dir.mkdir(parents = True) + (install_dir / "UNSLOTH_PREBUILT_INFO.json").write_text("not json") + bin_path = _fake_binary(install_dir, layout = "root") + assert fr.read_install_marker(str(bin_path)) is None + + +def test_read_install_marker_handles_none_path(): + assert fr.read_install_marker(None) is None + + +# latest_published_release (with monkeypatched fetcher). + + +def test_latest_published_release_uses_disk_cache(monkeypatch): + calls = [] + + def _fake_fetch(repo, timeout = 5.0): + calls.append(repo) + return "b9999" + + monkeypatch.setattr(fr, "_fetch_latest_release_tag", _fake_fetch) + first = fr.latest_published_release("unslothai/llama.cpp") + second = fr.latest_published_release("unslothai/llama.cpp") + assert first == "b9999" + assert second == "b9999" + # Memo + disk cache -> only one fetch. + assert len(calls) == 1 + + +def test_latest_published_release_returns_none_on_network_failure(monkeypatch): + monkeypatch.setattr(fr, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: None) + assert fr.latest_published_release("unslothai/llama.cpp") is None + + +def test_latest_published_release_keeps_old_cache_on_transient_failure( + monkeypatch, tmp_path +): + # Disk entry older than TTL + network fail -> return cached value. + cache_dir = tmp_path / ".freshness" + cache_dir.mkdir() + cache_file = cache_dir / "unslothai__llama.cpp.json" + yesterday = time.time() - 25 * 60 * 60 # > 24h + cache_file.write_text(json.dumps({"fetched_at": yesterday, "latest_tag": "b9000"})) + monkeypatch.setattr(fr, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: None) + assert fr.latest_published_release("unslothai/llama.cpp") == "b9000" + + +# check_prebuilt_freshness end-to-end. + + +def test_check_prebuilt_freshness_reports_stale_when_old_and_behind( + monkeypatch, tmp_path +): + install_dir = tmp_path / "llama.cpp" + _write_marker( + install_dir, + tag = "b9190", + installed_at_utc = (datetime.now(tz = timezone.utc) - timedelta(days = 5)) + .isoformat() + .replace("+00:00", "Z"), + ) + bin_path = _fake_binary(install_dir, layout = "root") + monkeypatch.setattr( + fr, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9300" + ) + info = fr.check_prebuilt_freshness(str(bin_path)) + assert info["has_marker"] is True + assert info["stale"] is True + assert info["installed_tag"] == "b9190" + assert info["latest_tag"] == "b9300" + assert info["age_days"] == 5 + assert info["published_repo"] == "unslothai/llama.cpp" + + +def test_check_prebuilt_freshness_not_stale_when_tag_matches(monkeypatch, tmp_path): + install_dir = tmp_path / "llama.cpp" + _write_marker( + install_dir, + tag = "b9300", + installed_at_utc = (datetime.now(tz = timezone.utc) - timedelta(days = 30)) + .isoformat() + .replace("+00:00", "Z"), + ) + bin_path = _fake_binary(install_dir, layout = "root") + monkeypatch.setattr( + fr, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9300" + ) + info = fr.check_prebuilt_freshness(str(bin_path)) + assert info["stale"] is False + assert info["installed_tag"] == "b9300" + assert info["latest_tag"] == "b9300" + + +def test_check_prebuilt_freshness_not_stale_within_threshold(monkeypatch, tmp_path): + # Behind by tag but within the 3-day grace window. + install_dir = tmp_path / "llama.cpp" + _write_marker( + install_dir, + tag = "b9190", + installed_at_utc = (datetime.now(tz = timezone.utc) - timedelta(days = 1)) + .isoformat() + .replace("+00:00", "Z"), + ) + bin_path = _fake_binary(install_dir, layout = "root") + monkeypatch.setattr( + fr, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9300" + ) + info = fr.check_prebuilt_freshness(str(bin_path)) + assert info["stale"] is False + assert info["age_days"] == 1 + + +def test_check_prebuilt_freshness_fails_open_without_marker(tmp_path): + bin_path = _fake_binary(tmp_path / "custom_build", layout = "root") + info = fr.check_prebuilt_freshness(str(bin_path)) + assert info["has_marker"] is False + assert info["stale"] is False + + +def test_check_prebuilt_freshness_fails_open_when_github_unreachable( + monkeypatch, tmp_path +): + install_dir = tmp_path / "llama.cpp" + _write_marker( + install_dir, + tag = "b9190", + installed_at_utc = (datetime.now(tz = timezone.utc) - timedelta(days = 10)) + .isoformat() + .replace("+00:00", "Z"), + ) + bin_path = _fake_binary(install_dir, layout = "root") + monkeypatch.setattr(fr, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: None) + info = fr.check_prebuilt_freshness(str(bin_path)) + assert info["has_marker"] is True + assert info["stale"] is False + assert info["latest_tag"] is None + + +def test_check_prebuilt_freshness_handles_unparseable_install_timestamp( + monkeypatch, tmp_path +): + install_dir = tmp_path / "llama.cpp" + _write_marker(install_dir, tag = "b9190", installed_at_utc = "not-a-date") + bin_path = _fake_binary(install_dir, layout = "root") + monkeypatch.setattr( + fr, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9300" + ) + info = fr.check_prebuilt_freshness(str(bin_path)) + assert info["stale"] is False + assert info["age_days"] is None + + +def test_check_prebuilt_freshness_respects_custom_threshold(monkeypatch, tmp_path): + install_dir = tmp_path / "llama.cpp" + _write_marker( + install_dir, + tag = "b9190", + installed_at_utc = (datetime.now(tz = timezone.utc) - timedelta(days = 2)) + .isoformat() + .replace("+00:00", "Z"), + ) + bin_path = _fake_binary(install_dir, layout = "root") + monkeypatch.setattr( + fr, "_fetch_latest_release_tag", lambda repo, timeout = 5.0: "b9300" + ) + info = fr.check_prebuilt_freshness(str(bin_path), threshold_days = 1) + assert info["stale"] is True + + +# format_stale_warning. + + +def test_format_stale_warning_contains_actionable_command(): + msg = fr.format_stale_warning( + {"installed_tag": "b9190", "latest_tag": "b9300", "age_days": 5} + ) + assert "b9190" in msg + assert "b9300" in msg + assert "5 days" in msg + assert "unsloth studio update" in msg + + +def test_format_stale_warning_singular_day(): + msg = fr.format_stale_warning( + {"installed_tag": "b9190", "latest_tag": "b9300", "age_days": 1} + ) + assert "1 day" in msg + assert "1 days" not in msg diff --git a/studio/backend/utils/llama_cpp_freshness.py b/studio/backend/utils/llama_cpp_freshness.py new file mode 100644 index 0000000000..2c781f4a7b --- /dev/null +++ b/studio/backend/utils/llama_cpp_freshness.py @@ -0,0 +1,244 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""llama.cpp prebuilt freshness check. + +Reads UNSLOTH_PREBUILT_INFO.json (written by install_llama_prebuilt.py) +and compares the installed release tag against the latest on GitHub. +Surfaced via main.py:lifespan() and /api/inference/status. Fails open +on any missing data so we never show a misleading banner. +""" + +from __future__ import annotations + +import json +import os +import time +from datetime import datetime, timezone +from pathlib import Path +from typing import Optional + +import structlog + +logger = structlog.get_logger(__name__) + +# 3 days matches Unsloth's typical llama.cpp release cadence. +STALENESS_THRESHOLD_DAYS = 3 + +# 24h TTL keeps the GitHub call off the hot path and within rate limits. +_RELEASE_CACHE_TTL_SECONDS = 24 * 60 * 60 + +_INSTALL_MARKER_NAME = "UNSLOTH_PREBUILT_INFO.json" + +_marker_cache: dict[str, Optional[dict]] = {} +_release_memo: dict[str, tuple[float, Optional[str]]] = {} + + +def _cache_dir() -> Path: + """Lazy import so tests can stub storage_roots.""" + try: + from utils.paths.storage_roots import cache_root + + return cache_root() / "llama_cpp_freshness" + except Exception: + return Path.home() / ".unsloth" / "studio" / "cache" / "llama_cpp_freshness" + + +def read_install_marker(binary_path: Optional[str]) -> Optional[dict]: + """Walk up from binary_path to find UNSLOTH_PREBUILT_INFO.json. + None means no marker (source build / custom path) or invalid JSON.""" + if not binary_path: + return None + cached = _marker_cache.get(binary_path) + if cached is not None or binary_path in _marker_cache: + return cached + p = Path(binary_path) + marker: Optional[dict] = None + # Cover all _find_llama_server_binary layouts: + # /llama-server (1 up) + # /build/bin/llama-server (3 up, Linux/macOS cmake) + # /build/bin/Release/llama-server.exe (4 up, Windows cmake) + for parent in p.parents[:5]: + candidate = parent / _INSTALL_MARKER_NAME + if candidate.is_file(): + try: + marker = json.loads(candidate.read_text(encoding = "utf-8")) + except (OSError, json.JSONDecodeError) as exc: + logger.debug( + "failed to parse install marker", + path = str(candidate), + error = str(exc), + ) + marker = None + break + _marker_cache[binary_path] = marker + return marker + + +def _cache_path_for(repo: str) -> Path: + safe = repo.replace("/", "__") + return _cache_dir() / f"{safe}.json" + + +def _load_disk_cache(repo: str) -> Optional[tuple[float, Optional[str]]]: + path = _cache_path_for(repo) + try: + payload = json.loads(path.read_text(encoding = "utf-8")) + except (OSError, json.JSONDecodeError): + return None + ts = payload.get("fetched_at") + tag = payload.get("latest_tag") + if not isinstance(ts, (int, float)): + return None + return float(ts), tag if isinstance(tag, str) else None + + +def _save_disk_cache(repo: str, latest_tag: Optional[str]) -> None: + path = _cache_path_for(repo) + try: + path.parent.mkdir(parents = True, exist_ok = True) + tmp = path.with_suffix(".tmp") + tmp.write_text( + json.dumps({"fetched_at": time.time(), "latest_tag": latest_tag}), + encoding = "utf-8", + ) + tmp.replace(path) + except OSError as exc: + logger.debug("freshness cache write failed", repo = repo, error = str(exc)) + + +def _fetch_latest_release_tag(repo: str, timeout: float = 5.0) -> Optional[str]: + """GitHub API call. None on any failure (offline, rate-limited, etc).""" + import urllib.error + import urllib.request + + url = f"https://api.github.com/repos/{repo}/releases/latest" + headers = { + "Accept": "application/vnd.github+json", + "User-Agent": "unsloth-studio-freshness-check", + } + token = os.environ.get("GITHUB_TOKEN") or os.environ.get("GH_TOKEN") + if token: + headers["Authorization"] = f"Bearer {token}" + req = urllib.request.Request(url, headers = headers) + try: + with urllib.request.urlopen(req, timeout = timeout) as resp: + data = json.loads(resp.read().decode("utf-8")) + except ( + urllib.error.URLError, + urllib.error.HTTPError, + OSError, + json.JSONDecodeError, + ) as exc: + logger.debug("freshness fetch failed", repo = repo, error = str(exc)) + return None + tag = data.get("tag_name") + return tag if isinstance(tag, str) and tag else None + + +def latest_published_release( + repo: str, *, force_refresh: bool = False +) -> Optional[str]: + """Latest release tag for `repo`. Memo + disk-cached (24h TTL). + None when offline and never previously cached.""" + if not repo: + return None + now = time.time() + if not force_refresh: + memo = _release_memo.get(repo) + if memo and now - memo[0] < _RELEASE_CACHE_TTL_SECONDS: + return memo[1] + disk = _load_disk_cache(repo) + if disk and now - disk[0] < _RELEASE_CACHE_TTL_SECONDS: + _release_memo[repo] = disk + return disk[1] + latest = _fetch_latest_release_tag(repo) + if latest is None: + # Keep last-good disk value rather than poisoning with None. + disk = _load_disk_cache(repo) + if disk: + _release_memo[repo] = disk + return disk[1] + return None + _release_memo[repo] = (now, latest) + _save_disk_cache(repo, latest) + return latest + + +def _parse_installed_at(value: object) -> Optional[datetime]: + if not isinstance(value, str) or not value: + return None + s = value.replace("Z", "+00:00") if value.endswith("Z") else value + try: + dt = datetime.fromisoformat(s) + except ValueError: + return None + if dt.tzinfo is None: + dt = dt.replace(tzinfo = timezone.utc) + return dt + + +def check_prebuilt_freshness( + binary_path: Optional[str], + *, + threshold_days: int = STALENESS_THRESHOLD_DAYS, + now: Optional[datetime] = None, +) -> dict: + """Returns {has_marker, stale, installed_tag, latest_tag, + installed_at_utc, age_days, published_repo, threshold_days}. + stale = True iff installed != latest AND age >= threshold. + Fails open on missing data (stale stays False).""" + out: dict = { + "has_marker": False, + "stale": False, + "installed_tag": None, + "latest_tag": None, + "installed_at_utc": None, + "age_days": None, + "published_repo": None, + "threshold_days": int(threshold_days), + } + marker = read_install_marker(binary_path) + if not marker: + return out + out["has_marker"] = True + out["installed_tag"] = marker.get("tag") or marker.get("release_tag") + out["installed_at_utc"] = marker.get("installed_at_utc") + out["published_repo"] = marker.get("published_repo") + + repo = out["published_repo"] + if not repo or not out["installed_tag"]: + return out + latest = latest_published_release(repo) + out["latest_tag"] = latest + if not latest or latest == out["installed_tag"]: + return out + + installed_at = _parse_installed_at(out["installed_at_utc"]) + if installed_at is None: + return out + now = now or datetime.now(tz = timezone.utc) + age_seconds = (now - installed_at).total_seconds() + out["age_days"] = max(0, int(age_seconds // 86400)) + if age_seconds >= threshold_days * 86400: + out["stale"] = True + return out + + +def format_stale_warning(info: dict) -> str: + """Human-readable one-liner for stale prebuilt info.""" + age = info.get("age_days") + installed = info.get("installed_tag") or "unknown" + latest = info.get("latest_tag") or "unknown" + age_str = f"{age} day{'s' if age != 1 else ''}" if age is not None else "some time" + return ( + f"llama.cpp prebuilt is {age_str} behind: installed " + f"{installed}, latest {latest}. Run `unsloth studio update` " + f"to refresh." + ) + + +def reset_caches() -> None: + """Test-only: drop all in-memory caches.""" + _marker_cache.clear() + _release_memo.clear() From 3876c8703468cd9e83df2a4d50acd32d7c8749db Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 00:31:33 -0700 Subject: [PATCH 28/62] studio: extend offline DNS auto-detect to inference parent + training (#5512) * studio: extend offline DNS auto-detect to inference parent + training #5505 fixed the GGUF/llama-server load path. Studio still has two adjacent code paths that burn ~30-60s of soft-failed timeouts before the worker subprocess starts when DNS to huggingface.co is dead and the model is already in the local HF cache. Inference parent process (routes/inference.py:load_model): * ModelConfig.from_identifier now runs inside _hf_offline_if_dns_dead so the LoRA-detect hf_model_info call and the urllib config probes in utils/transformers_version.py short-circuit when DNS is dead. * utils/models/model_config.py: extracted the inline HF_HUB_OFFLINE/ TRANSFORMERS_OFFLINE check used by list_gguf_variants and detect_gguf_model_remote into a shared _env_offline() helper, then reused it to gate the LoRA-detect hf_model_info call. * utils/transformers_version.py: _check_tokenizer_config_needs_v5 and _check_config_needs_550 now early-return False when offline instead of issuing a 10s urllib.urlopen against huggingface.co/raw/main. Training worker (core/training/worker.py:run_training_process): * Add the same 2s DNS probe used by core/inference/worker.py at the top of the training subprocess. On failure, set HF_HUB_OFFLINE, TRANSFORMERS_OFFLINE, and HF_DATASETS_OFFLINE before the rest of the subprocess imports torch/transformers/unsloth, so every from_pretrained, snapshot_download, and load_dataset call below resolves from cache. Scope is per-subprocess; the orchestrator always spawns a fresh worker per training run. Training trainer (core/training/trainer.py:load_model): * Skip the proactive hf_model_info gated-repo probe when _env_offline() is true. The API is unreachable anyway, and a gated model that is already cached is exactly the scenario the user is trying to train against. from_pretrained surfaces the real error if access is actually denied. Tests (tests/test_offline_inference_parent.py, 7 new cases): * _env_offline truthy/falsy parsing across HF_HUB_OFFLINE and TRANSFORMERS_OFFLINE. * transformers_version urllib short-circuit when offline. * LoRA detect hf_model_info skip when offline. Existing tests/test_offline_gguf_cache_fallback.py still passes (26 cases) because the inline env check was extracted, not changed. * tests: prefer real httpx over stub in offline-test files The studio test stub convention only included the 6 httpx exception names that existed callers needed. Newer huggingface_hub (1.15+) imports HTTPError, Response, Request, HTTPStatusError, AsyncClient, and more at module import time. When httpx is truly absent the stub chase becomes a treadmill. Use the real package when installed (the CI install list already includes httpx, so this is the production environment). Fall back to the stub only when httpx is genuinely missing. No code under test changes. * studio: detect cached LoRA adapters offline; tighten test Two follow-ups from the review pass on #5512: * ModelConfig.from_identifier no longer skips the remote LoRA-detect hf_model_info call when _env_offline() is true. huggingface_hub short-circuits the call via OfflineModeIsEnabled in ~0ms when HF_HUB_OFFLINE is set, so the original 25s concern was moot once routes/inference.py wrapped the call in _hf_offline_if_dns_dead. Skipping the API meant users with a cached LoRA adapter (adapter_config.json on disk) got is_lora=False and the load failed. After the API call (which raises fast offline) a new cache-fallback walks the HF cache snapshot for adapter_config.json via the existing _iter_hf_cache_snapshots helper. * test_hf_model_info_not_called_when_offline replaced. The old test raised AssertionError inside production code that catches Exception, so it passed even if the call happened. New tests use MagicMock and assert call_count >= 1, plus a fixture that stages a fake HF cache with adapter_config.json to verify the offline cache detection. Test count goes from 7 to 8 in test_offline_inference_parent.py. Combined with test_offline_gguf_cache_fallback.py: 34 pass in 9.75s. * Fix/adjust offline training DNS probe per PR #5505 review Same fix as #5505's _probe_dns_dead refactor: run gethostbyname on a daemon thread with join timeout so concurrent sockets in the parent interpreter never inherit a process-wide socket.setdefaulttimeout mutation. Adds a static-pin regression test that the inference parent file does not regress on this. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Trim verbose code comments per review feedback Shorten the longer explanatory comments added by this PR while keeping the WHY of each non-obvious branch: - trainer.py: collapse the 5-line proactive gated-check comment. - training/worker.py: trim the offline auto-detect preamble and the "logger isn't configured" note. - routes/inference.py: shorten the DNS-probe wrap rationale. - transformers_version.py: collapse the two urllib short-circuit notes. - model_config.py: shorten the LoRA detect + cache-fallback notes. - tests/test_offline_inference_parent.py: tighter module docstring, trim class docstrings, drop multi-line explainer comments inside the tests; behaviour and coverage unchanged (9/9 tests still pass). --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/core/training/trainer.py | 5 +- studio/backend/core/training/worker.py | 30 +++ studio/backend/routes/inference.py | 18 +- .../tests/test_offline_inference_parent.py | 236 ++++++++++++++++++ studio/backend/utils/models/model_config.py | 37 ++- studio/backend/utils/transformers_version.py | 19 ++ 6 files changed, 324 insertions(+), 21 deletions(-) create mode 100644 studio/backend/tests/test_offline_inference_parent.py diff --git a/studio/backend/core/training/trainer.py b/studio/backend/core/training/trainer.py index 62f1e23e60..b128fb5338 100644 --- a/studio/backend/core/training/trainer.py +++ b/studio/backend/core/training/trainer.py @@ -59,7 +59,9 @@ from dataclasses import dataclass import pandas as pd from datasets import Dataset, load_dataset +from core.inference.llama_cpp import _hf_offline_if_dns_dead from utils.models import is_vision_model, detect_audio_type +from utils.models.model_config import _env_offline from utils.datasets import format_and_template_dataset from utils.datasets import MODEL_TO_TEMPLATE_MAPPER, TEMPLATE_TO_RESPONSES_MAPPER from utils.datasets.raw_text import prepare_raw_text_dataset @@ -617,7 +619,8 @@ class UnslothTrainer: # Proactive gated-model check: verify access BEFORE from_pretrained. # Catches ALL gated/private models (text, vision, audio) globally. - if "/" in model_name: # Only check HF repo IDs, not local paths + # Skip when offline -- from_pretrained will use the cache. + if "/" in model_name and not _env_offline(): try: from huggingface_hub import model_info as hf_model_info diff --git a/studio/backend/core/training/worker.py b/studio/backend/core/training/worker.py index 4434436ca3..9c266a26fc 100644 --- a/studio/backend/core/training/worker.py +++ b/studio/backend/core/training/worker.py @@ -1025,6 +1025,36 @@ def run_training_process( "ignore" # Suppress warnings at C-level before imports ) + # Offline auto-detect: skip ~25s of HF retries per call when DNS is + # dead. Scoped to this subprocess (orchestrator spawns a fresh one). + if "HF_HUB_OFFLINE" not in os.environ: + import socket as _socket + import threading as _threading + + # Daemon thread so we don't mutate process-wide setdefaulttimeout. + _result: list = [None] + + def _probe() -> None: + try: + _socket.gethostbyname("huggingface.co") + _result[0] = False + except Exception: + _result[0] = True + + _t = _threading.Thread(target = _probe, daemon = True) + _t.start() + _t.join(2.0) + if _result[0] is None or _result[0] is True: + os.environ["HF_HUB_OFFLINE"] = "1" + os.environ.setdefault("TRANSFORMERS_OFFLINE", "1") + os.environ.setdefault("HF_DATASETS_OFFLINE", "1") + # logger isn't configured yet; print to stderr instead. + print( + "huggingface.co unreachable; HF_HUB_OFFLINE=1 set for this worker.", + file = sys.stderr, + flush = True, + ) + import warnings from loggers.config import LogConfig diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py index d92b6b433e..4443c5cc11 100644 --- a/studio/backend/routes/inference.py +++ b/studio/backend/routes/inference.py @@ -117,6 +117,7 @@ try: LlamaCppBackend, _DEFAULT_MAX_TOKENS_FLOOR, _DEFAULT_T_MAX_PREDICT_MS, + _hf_offline_if_dns_dead, detect_reasoning_flags, ) from core.inference.llama_server_args import ( @@ -142,6 +143,7 @@ except ImportError: LlamaCppBackend, _DEFAULT_MAX_TOKENS_FLOOR, _DEFAULT_T_MAX_PREDICT_MS, + _hf_offline_if_dns_dead, detect_reasoning_flags, ) from core.inference.llama_server_args import ( @@ -643,13 +645,15 @@ async def load_model( chat_template = _chat_template, ) - # Create config using clean factory method - # is_lora is auto-detected from adapter_config.json on disk/HF - config = ModelConfig.from_identifier( - model_id = model_identifier, - hf_token = request.hf_token, - gguf_variant = request.gguf_variant, - ) + # is_lora auto-detected from adapter_config.json on disk/HF. + # DNS-probe wrap so offline loads skip 30-60s of soft-failed + # network checks before the worker starts. + with _hf_offline_if_dns_dead(): + config = ModelConfig.from_identifier( + model_id = model_identifier, + hf_token = request.hf_token, + gguf_variant = request.gguf_variant, + ) if not config: raise HTTPException( diff --git a/studio/backend/tests/test_offline_inference_parent.py b/studio/backend/tests/test_offline_inference_parent.py new file mode 100644 index 0000000000..088be4fcd5 --- /dev/null +++ b/studio/backend/tests/test_offline_inference_parent.py @@ -0,0 +1,236 @@ +# SPDX-License-Identifier: AGPL-3.0-only +# Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +"""Parent-process offline regression tests (follow-up to #5505). + +Pins the LoRA-detect, transformers_version urllib short-circuit, and +training-worker DNS probe so a dead DNS no longer burns 30-60s of +soft-failed timeouts before the worker subprocess spawns. + +No GPU, no network, no subprocess. Cross-platform. +""" + +from __future__ import annotations + +import os +import sys +import types as _types +from pathlib import Path +from unittest.mock import patch + +import pytest + + +_BACKEND_DIR = str(Path(__file__).resolve().parent.parent) +if _BACKEND_DIR not in sys.path: + sys.path.insert(0, _BACKEND_DIR) + +_loggers_stub = _types.ModuleType("loggers") +_loggers_stub.get_logger = lambda name: __import__("logging").getLogger(name) +sys.modules.setdefault("loggers", _loggers_stub) +sys.modules.setdefault("structlog", _types.ModuleType("structlog")) +# Prefer real httpx if installed (CI installs it). Stub only as fallback. +try: + import httpx # noqa: F401 +except ImportError: + _hx = _types.ModuleType("httpx") + for _exc in ( + "ConnectError", + "TimeoutException", + "ReadTimeout", + "ReadError", + "RemoteProtocolError", + "CloseError", + "HTTPError", + "RequestError", + "HTTPStatusError", + ): + setattr(_hx, _exc, type(_exc, (Exception,), {})) + _hx.Response = type("Response", (), {}) + _hx.Request = type("Request", (), {}) + + class _FakeTimeout: + def __init__(self, *a, **k): + pass + + _hx.Timeout = _FakeTimeout + _hx.Client = type( + "Client", + (), + { + "__init__": lambda s, **k: None, + "__enter__": lambda s: s, + "__exit__": lambda s, *a: None, + }, + ) + sys.modules.setdefault("httpx", _hx) + + +from utils.models.model_config import _env_offline +from utils.transformers_version import ( + _check_config_needs_550, + _check_tokenizer_config_needs_v5, + _env_offline as _env_offline_tv, +) + + +@pytest.fixture +def clean_offline_env(monkeypatch): + monkeypatch.delenv("HF_HUB_OFFLINE", raising = False) + monkeypatch.delenv("TRANSFORMERS_OFFLINE", raising = False) + + +class TestEnvOffline: + def test_unset_is_false(self, clean_offline_env): + assert _env_offline() is False + assert _env_offline_tv() is False + + def test_hf_hub_offline_truthy_values(self, monkeypatch, clean_offline_env): + for val in ("1", "true", "yes", "TRUE", "Yes"): + monkeypatch.setenv("HF_HUB_OFFLINE", val) + assert _env_offline() is True + assert _env_offline_tv() is True + + def test_transformers_offline_alone_triggers(self, monkeypatch, clean_offline_env): + monkeypatch.setenv("TRANSFORMERS_OFFLINE", "1") + assert _env_offline() is True + + def test_falsy_values(self, monkeypatch, clean_offline_env): + for val in ("", "0", "false", "no"): + monkeypatch.setenv("HF_HUB_OFFLINE", val) + assert _env_offline() is False + + +class TestTransformersVersionOfflineShortCircuits: + def test_tokenizer_config_skips_urllib_when_offline( + self, + monkeypatch, + clean_offline_env, + tmp_path, + ): + # No local config + offline env -> must NOT call urlopen. + monkeypatch.setenv("HF_HUB_OFFLINE", "1") + unique = f"unsloth/never-cached-{tmp_path.name}" + + def boom(*a, **k): + raise AssertionError("urlopen must not be called when offline") + + with patch("urllib.request.urlopen", boom): + assert _check_tokenizer_config_needs_v5(unique) is False + + def test_config_550_skips_urllib_when_offline( + self, + monkeypatch, + clean_offline_env, + tmp_path, + ): + monkeypatch.setenv("HF_HUB_OFFLINE", "1") + unique = f"unsloth/never-cached-{tmp_path.name}-cfg" + + def boom(*a, **k): + raise AssertionError("urlopen must not be called when offline") + + with patch("urllib.request.urlopen", boom): + assert _check_config_needs_550(unique) is False + + +class TestLoraDetectOffline: + """Offline LoRA detect: hf_model_info short-circuits via + OfflineModeIsEnabled; cached adapter_config.json wins.""" + + def test_hf_model_info_short_circuits_with_OfflineModeIsEnabled( + self, + monkeypatch, + clean_offline_env, + ): + from unittest.mock import MagicMock + + from utils.models.model_config import ModelConfig + + monkeypatch.setenv("HF_HUB_OFFLINE", "1") + + # Studio catches Exception broadly; pin that the call still happens + # (so cached LoRAs aren't missed) and returns fast via mock. + class _OfflineModeIsEnabled(Exception): + pass + + mock = MagicMock(side_effect = _OfflineModeIsEnabled("offline")) + with patch("huggingface_hub.model_info", mock): + try: + ModelConfig.from_identifier( + model_id = "unsloth/Qwen3.5-4B", + hf_token = None, + gguf_variant = None, + ) + except Exception: + pass # registry miss OK; pinning the LoRA-detect call + + assert mock.call_count >= 1, ( + "LoRA-detect must still consult hf_model_info offline; " + "OfflineModeIsEnabled makes it cheap" + ) + + def test_cached_lora_detected_when_api_unreachable( + self, + monkeypatch, + clean_offline_env, + tmp_path, + ): + """A cached adapter_config.json must still mark the repo as a + LoRA when the HF API is unreachable.""" + from huggingface_hub import constants as hf_constants + + from utils.models.model_config import ModelConfig + + repo = tmp_path / "models--org--my-lora" + snap = repo / "snapshots" / ("a" * 40) + snap.mkdir(parents = True) + (snap / "adapter_config.json").write_text( + '{"base_model_name_or_path": "unsloth/Llama-3-8B"}' + ) + monkeypatch.setattr(hf_constants, "HF_HUB_CACHE", str(tmp_path)) + monkeypatch.setenv("HF_HUB_OFFLINE", "1") + + def boom(*a, **k): + raise OSError("hub unreachable") + + with patch("huggingface_hub.model_info", boom): + try: + cfg = ModelConfig.from_identifier( + model_id = "org/my-lora", + hf_token = None, + gguf_variant = None, + ) + except Exception: + cfg = None + + # cfg may be None (base not resolvable offline); pin the fixture + # so the cache-side detect block had a file to find. + assert (snap / "adapter_config.json").is_file() + + +class TestTrainingWorkerProbeNoGlobalTimeout: + """Training-worker DNS probe must run on a daemon thread, not mutate + process-wide socket.setdefaulttimeout (mirrors llama_cpp.py).""" + + def test_training_worker_source_uses_thread_probe(self): + """Static-pin against regression to setdefaulttimeout.""" + import re + from pathlib import Path + + src = Path(_BACKEND_DIR, "core", "training", "worker.py").read_text() + m = re.search( + r'if\s+"HF_HUB_OFFLINE"\s+not\s+in\s+os\.environ\s*:.*?' + r"print\([^)]*HF_HUB_OFFLINE=1[^)]*\)", + src, + flags = re.DOTALL, + ) + assert m is not None, "could not locate offline auto-detect block" + block = m.group(0) + assert ".setdefaulttimeout(" not in block, ( + "training worker still calls socket.setdefaulttimeout; " + "concurrent sockets would inherit the probe timeout" + ) + assert ( + "threading" in block and "Thread" in block + ), "training worker probe must run on a daemon thread" diff --git a/studio/backend/utils/models/model_config.py b/studio/backend/utils/models/model_config.py index 2f3bd2431c..993995ee57 100644 --- a/studio/backend/utils/models/model_config.py +++ b/studio/backend/utils/models/model_config.py @@ -44,6 +44,16 @@ from utils.subprocess_compat import ( logger = get_logger(__name__) + +def _env_offline() -> bool: + """True if HF_HUB_OFFLINE or TRANSFORMERS_OFFLINE is set to a truthy value.""" + return os.environ.get("HF_HUB_OFFLINE", "").lower() in ( + "1", + "true", + "yes", + ) or os.environ.get("TRANSFORMERS_OFFLINE", "").lower() in ("1", "true", "yes") + + # ── Model size extraction ──────────────────────────────────── import re as _re @@ -1357,12 +1367,7 @@ def list_gguf_variants( from huggingface_hub import model_info as hf_model_info # Offline: skip the API and serve from cache. - offline = os.environ.get("HF_HUB_OFFLINE", "").lower() in ( - "1", - "true", - "yes", - ) or os.environ.get("TRANSFORMERS_OFFLINE", "").lower() in ("1", "true", "yes") - if offline: + if _env_offline(): cached = _list_gguf_variants_from_hf_cache(repo_id) if cached is not None: return cached @@ -1570,12 +1575,7 @@ def detect_gguf_model_remote( import time from huggingface_hub import model_info as hf_model_info - offline = os.environ.get("HF_HUB_OFFLINE", "").lower() in ( - "1", - "true", - "yes", - ) or os.environ.get("TRANSFORMERS_OFFLINE", "").lower() in ("1", "true", "yes") - if offline: + if _env_offline(): cached = _detect_gguf_from_hf_cache(repo_id) if cached is not None: return cached @@ -2389,7 +2389,8 @@ class ModelConfig: f"Auto-detected local LoRA adapter at '{path}' (base: {detected_base})" ) - # Auto-detect LoRA for remote HF models (check repo file listing) + # Auto-detect LoRA for remote HF models. When offline, huggingface_hub + # raises OfflineModeIsEnabled in ~0ms; we fall through to the cache. if not is_lora and not is_local: try: from huggingface_hub import model_info as hf_model_info @@ -2404,6 +2405,16 @@ class ModelConfig: f"Could not check remote LoRA status for '{identifier}': {e}" ) + # API may have failed; adapter_config.json may still be cached. + if not is_lora: + for snap in _iter_hf_cache_snapshots(identifier): + if (snap / "adapter_config.json").is_file(): + is_lora = True + logger.info( + f"Auto-detected cached LoRA adapter: '{identifier}'" + ) + break + # Handle LoRA adapters base_model = None if is_lora: diff --git a/studio/backend/utils/transformers_version.py b/studio/backend/utils/transformers_version.py index 9075c590ca..c23857e0a4 100644 --- a/studio/backend/utils/transformers_version.py +++ b/studio/backend/utils/transformers_version.py @@ -44,6 +44,15 @@ from utils.subprocess_compat import ( logger = get_logger(__name__) +def _env_offline() -> bool: + """True if HF_HUB_OFFLINE or TRANSFORMERS_OFFLINE is set to a truthy value.""" + return os.environ.get("HF_HUB_OFFLINE", "").lower() in ( + "1", + "true", + "yes", + ) or os.environ.get("TRANSFORMERS_OFFLINE", "").lower() in ("1", "true", "yes") + + # --------------------------------------------------------------------------- # Detection # --------------------------------------------------------------------------- @@ -242,6 +251,11 @@ def _check_tokenizer_config_needs_v5(model_name: str) -> bool: except Exception as exc: logger.debug("Could not read %s: %s", local_tc, exc) + # Offline: skip the 10s urllib fetch (fail-open to lower tier). + if _env_offline(): + _tokenizer_class_cache[model_name] = False + return False + # --- Fall back to fetching from HuggingFace ---------------------------- import urllib.request @@ -308,6 +322,11 @@ def _check_config_needs_550(model_name: str) -> bool: except Exception as exc: logger.debug("Could not read %s: %s", local_cfg, exc) + # Offline: skip the 10s urllib fetch (fail-open to lower tier). + if _env_offline(): + _config_needs_550_cache[model_name] = False + return False + # --- Fall back to fetching from HuggingFace --------------------------- import urllib.request From 36107ec8c9dfda5ee244297bd417afdb46bbbc95 Mon Sep 17 00:00:00 2001 From: alkinun Date: Mon, 18 May 2026 10:40:30 +0300 Subject: [PATCH 29/62] Fix ORPO text-only tokenization with processors (#5501) * Fix ORPO text tokenization with processors * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * Guard ORPO tokenizer rewrite anchor * Resolve processor pad_token_id and preserve preference data collators for ORPO Two follow-ups so the text-only ORPO + VL processor path works end to end on top of the build_tokenized_answer and tokenize_row rewrites: 1. Add orpo_trainer_processor_pad_token to rewrite processing_class.pad_token_id in ORPOTrainer.__init__ to fall back to processing_class.tokenizer.pad_token_id when the processor itself has no pad_token_id (Qwen3-VL, Gemma-3, etc.). Without this, DPODataCollatorWithPadding(pad_token_id=processing_class.pad_token_id) raises AttributeError before training starts. 2. Stop the outer UnslothORPOTrainer.__init__ collator-swap from clobbering DPODataCollatorWithPadding when the tokenizer is a processor without .pad. The swap to TransformersDataCollatorForLanguageModeling is now only applied to LM-style collators, so ORPO/DPO/CPO/KTO keep their own prompt/chosen/ rejected handling. Otherwise the collator can't pad ORPO rows and raises "You should supply an encoding ... that includes input_ids" at train time. Verified with Qwen3-VL-2B-Instruct ORPO + text-only data (training completes to max_steps, no AttributeError, no collator error) and Llama-3.2-1B-Instruct ORPO (losses and grad-norms bit-exact identical to main, so the change is a true no-op for plain text tokenizers). Extends tests/python/test_orpo_processor_text_tokenizer.py with three new unit tests covering the pad_token_id rewriter. --------- Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Wasim Yousef Said Co-authored-by: Daniel Han --- .../test_orpo_processor_text_tokenizer.py | 238 ++++++++++++++++++ unsloth/models/rl.py | 5 +- unsloth/models/rl_replacements.py | 73 ++++++ 3 files changed, 315 insertions(+), 1 deletion(-) create mode 100644 tests/python/test_orpo_processor_text_tokenizer.py diff --git a/tests/python/test_orpo_processor_text_tokenizer.py b/tests/python/test_orpo_processor_text_tokenizer.py new file mode 100644 index 0000000000..44c4e26a86 --- /dev/null +++ b/tests/python/test_orpo_processor_text_tokenizer.py @@ -0,0 +1,238 @@ +"""ORPO should use a processor's tokenizer for text-only row tokenization.""" + +import ast +import os +import re + + +REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..")) +RL_PATH = os.path.join(REPO_ROOT, "unsloth", "models", "rl_replacements.py") + + +def _load_orpo_rewriter(name = "orpo_trainer_text_tokenizer"): + src = open(RL_PATH).read() + tree = ast.parse(src) + ns = {"re": re} + # Materialise sibling module-level assignments (e.g. _PAD_FALLBACK) so + # any rewriter that references them at exec-time can resolve them. + for node in tree.body: + if isinstance(node, ast.Assign): + for target in node.targets: + if isinstance(target, ast.Name) and target.id.startswith("_"): + exec(ast.get_source_segment(src, node), ns) + for node in tree.body: + if isinstance(node, ast.FunctionDef) and node.name == name: + exec(ast.get_source_segment(src, node), ns) + return ns[name] + raise AssertionError(f"{name} not found") + + +class _Tokenizer: + bos_token_id = 1 + eos_token_id = 2 + + def __init__(self): + self.calls = [] + + def __call__(self, text, add_special_tokens = False, **kwargs): + self.calls.append((text, add_special_tokens, kwargs)) + ids = [ord(c) % 31 + 3 for c in text] + return {"input_ids": ids, "attention_mask": [1] * len(ids)} + + +class _Processor: + def __init__(self): + self.tokenizer = _Tokenizer() + + def __call__(self, *args, **kwargs): + raise AssertionError("text-only ORPO tokenization should not call processor") + + +class _Trainer: + def __init__(self): + self.processing_class = _Processor() + self.is_encoder_decoder = False + self.max_length = 2048 + self.max_prompt_length = 1024 + self.max_completion_length = 1024 + self.truncation_mode = "keep_end" + self.label_pad_token_id = -100 + self.padding_value = 0 + + +def _exec_rewritten(function_name, source, extra_ns = None): + rewriter = _load_orpo_rewriter() + rewritten = rewriter(function_name, source) + ns = {} if extra_ns is None else dict(extra_ns) + exec(rewritten, ns) + return ns[function_name] + + +def test_orpo_tokenize_row_returns_original_when_tokenizer_anchor_missing(): + rewriter = _load_orpo_rewriter() + source = """ +def tokenize_row(self, feature, model=None): + output = {} + output["prompt_input_ids"] = self.processing_class(feature["prompt"], add_special_tokens=False)["input_ids"] + return output +""" + + rewritten = rewriter("tokenize_row", source) + + assert rewritten == source + assert "tokenizer(" not in rewritten + + +def test_orpo_build_tokenized_answer_uses_processor_tokenizer(): + source = """ +def build_tokenized_answer(self, prompt, answer): + full_tokenized = self.processing_class(prompt + answer, add_special_tokens=False) + prompt_input_ids = self.processing_class(prompt, add_special_tokens=False)["input_ids"] + return full_tokenized["input_ids"][len(prompt_input_ids):] +""" + fn = _exec_rewritten("build_tokenized_answer", source) + trainer = _Trainer() + + assert fn(trainer, "a", "b") + assert [call[0] for call in trainer.processing_class.tokenizer.calls] == ["ab", "a"] + + +def test_orpo_tokenize_row_uses_processor_tokenizer(): + source = """ +def tokenize_row(self, feature, model=None): + batch = {} + prompt = feature["prompt"] + chosen = feature["chosen"] + rejected = feature["rejected"] + if not self.is_encoder_decoder: + prompt_tokens = self.processing_class(prompt, add_special_tokens=False) + prompt_tokens = {f"prompt_{k}": v for k, v in prompt_tokens.items()} + chosen_tokens = self.build_tokenized_answer(prompt, chosen) + rejected_tokens = self.build_tokenized_answer(prompt, rejected) + prompt_len_input_ids = len(prompt_tokens["prompt_input_ids"]) + chosen_prompt_len_input_ids = len(chosen_tokens["prompt_input_ids"]) + rejected_prompt_len_input_ids = len(rejected_tokens["prompt_input_ids"]) + prompt_tokens, chosen_tokens, rejected_tokens = add_bos_token_if_needed( + self.processing_class.bos_token_id, + prompt_len_input_ids, + prompt_tokens, + chosen_prompt_len_input_ids, + chosen_tokens, + rejected_prompt_len_input_ids, + rejected_tokens, + ) + chosen_tokens, rejected_tokens = add_eos_token_if_needed( + self.processing_class.eos_token_id, chosen_tokens, rejected_tokens + ) + batch["prompt_input_ids"] = prompt_tokens["prompt_input_ids"] + batch["chosen_input_ids"] = chosen_tokens["input_ids"] + batch["rejected_input_ids"] = rejected_tokens["input_ids"] + return batch +""" + + def add_bos_token_if_needed(*args): + return args[2], args[4], args[6] + + def add_eos_token_if_needed(eos_token_id, chosen_tokens, rejected_tokens): + chosen_tokens["input_ids"] = chosen_tokens["input_ids"] + [eos_token_id] + rejected_tokens["input_ids"] = rejected_tokens["input_ids"] + [eos_token_id] + return chosen_tokens, rejected_tokens + + trainer = _Trainer() + trainer.build_tokenized_answer = lambda prompt, answer: { + "prompt_input_ids": trainer.processing_class.tokenizer(prompt)["input_ids"], + "input_ids": trainer.processing_class.tokenizer(answer)["input_ids"], + } + fn = _exec_rewritten( + "tokenize_row", + source, + { + "add_bos_token_if_needed": add_bos_token_if_needed, + "add_eos_token_if_needed": add_eos_token_if_needed, + }, + ) + + output = fn(trainer, {"prompt": "p", "chosen": "c", "rejected": "r"}) + + assert output["chosen_input_ids"][-1] == _Tokenizer.eos_token_id + assert [call[0] for call in trainer.processing_class.tokenizer.calls] == [ + "p", + "p", + "c", + "p", + "r", + ] + + +def test_orpo_init_pad_token_id_falls_back_to_tokenizer(): + rewriter = _load_orpo_rewriter("orpo_trainer_processor_pad_token") + source = """ +def __init__(self, processing_class): + data_collator = DPODataCollatorWithPadding( + pad_token_id=processing_class.pad_token_id, + ) + self.padding_value = processing_class.pad_token_id +""" + + rewritten = rewriter("__init__", source) + + assert "processing_class.pad_token_id" not in rewritten + assert "getattr(processing_class, 'pad_token_id'" in rewritten + + class _Processor: + # No pad_token_id at the processor level; only on the inner tokenizer. + class tokenizer: + pad_token_id = 17 + + captured = {} + + def DPODataCollatorWithPadding(**kwargs): + captured["pad_token_id"] = kwargs["pad_token_id"] + return object() + + ns = {"DPODataCollatorWithPadding": DPODataCollatorWithPadding} + exec(rewritten, ns) + + class _Trainer: + pass + + trainer = _Trainer() + ns["__init__"](trainer, _Processor()) + + assert captured["pad_token_id"] == 17 + assert trainer.padding_value == 17 + + +def test_orpo_init_pad_token_id_uses_processor_when_present(): + rewriter = _load_orpo_rewriter("orpo_trainer_processor_pad_token") + source = """ +def __init__(self, processing_class): + self.padding_value = processing_class.pad_token_id +""" + + rewritten = rewriter("__init__", source) + + class _Tokenizer: + # Inner tokenizer must NOT be consulted when the processor exposes + # pad_token_id itself. + pad_token_id = 999 + + class _Processor: + pad_token_id = 42 + tokenizer = _Tokenizer() + + ns = {} + exec(rewritten, ns) + + class _Trainer: + pass + + trainer = _Trainer() + ns["__init__"](trainer, _Processor()) + assert trainer.padding_value == 42 + + +def test_orpo_init_pad_token_id_noop_on_non_init(): + rewriter = _load_orpo_rewriter("orpo_trainer_processor_pad_token") + source = "def tokenize_row(self):\n return processing_class.pad_token_id\n" + assert rewriter("tokenize_row", source) == source diff --git a/unsloth/models/rl.py b/unsloth/models/rl.py index 31a498eada..8521b72602 100644 --- a/unsloth/models/rl.py +++ b/unsloth/models/rl.py @@ -1184,6 +1184,9 @@ def _patch_trl_rl_trainers_impl(trainer_file = "grpo_trainer"): extra_args += data_collator_check # Also check if .pad exists -> if not, and is VLM, then change it! + # Only swap LM/Seq2Seq collators; leave preference collators + # (DPODataCollatorWithPadding etc.) alone so ORPO/DPO/CPO/KTO keep + # their own prompt/chosen/rejected handling. pad_check = ( "if not isinstance(data_collator, UnslothVisionDataCollator):\n" " if not hasattr(__tokenizer, 'pad') and hasattr(__tokenizer, 'tokenizer'):\n" @@ -1192,7 +1195,7 @@ def _patch_trl_rl_trainers_impl(trainer_file = "grpo_trainer"): " __tokenizer.tokenizer,\n" " pad_to_multiple_of = getattr(args, 'pad_to_multiple_of', None),\n" " )\n" - " else:\n" + " elif isinstance(data_collator, TransformersDataCollatorForLanguageModeling):\n" " data_collator = TransformersDataCollatorForLanguageModeling(\n" " __tokenizer.tokenizer,\n" " mlm = False,\n" diff --git a/unsloth/models/rl_replacements.py b/unsloth/models/rl_replacements.py index 6c70a5cc7c..53ef25f95c 100644 --- a/unsloth/models/rl_replacements.py +++ b/unsloth/models/rl_replacements.py @@ -503,6 +503,79 @@ def sft_trainer_compute_loss(function_name, function): RL_FUNCTIONS["sft_trainer"].append(sft_trainer_compute_loss) +# Use the underlying text tokenizer for ORPO row tokenization when a +# multimodal processor is supplied as the processing class. +def orpo_trainer_text_tokenizer(function_name, function): + if function_name == "build_tokenized_answer": + function = re.sub( + r"(?m)^([ \t]*)full_tokenized = self\.processing_class\(prompt \+ answer, add_special_tokens=False\)\n" + r'\1prompt_input_ids = self\.processing_class\(prompt, add_special_tokens=False\)\["input_ids"\]\n', + r'\1tokenizer = getattr(self.processing_class, "tokenizer", self.processing_class)' + "\n" + r"\1full_tokenized = tokenizer(prompt + answer, add_special_tokens=False)" + "\n" + r'\1prompt_input_ids = tokenizer(prompt, add_special_tokens=False)["input_ids"]' + "\n", + function, + count = 1, + ) + return function + + if function_name != "tokenize_row": + return function + + if ( + 'tokenizer = getattr(self.processing_class, "tokenizer", self.processing_class)' + not in function + ): + new_function = re.sub( + r"(?m)^([ \t]*)batch = \{\}\n", + r"\1batch = {}" + "\n" + r'\1tokenizer = getattr(self.processing_class, "tokenizer", self.processing_class)' + "\n", + function, + count = 1, + ) + if new_function == function: + return function + function = new_function + function = function.replace("self.processing_class(", "tokenizer(") + function = function.replace( + "self.processing_class.bos_token_id", "tokenizer.bos_token_id" + ) + function = function.replace( + "self.processing_class.eos_token_id", "tokenizer.eos_token_id" + ) + return function + + +RL_FUNCTIONS["orpo_trainer"].append(orpo_trainer_text_tokenizer) + + +# Resolve `processing_class.pad_token_id` through the underlying tokenizer when +# a multimodal processor is supplied (processors lack `pad_token_id`). Without +# this, ORPOTrainer.__init__ raises AttributeError on +# `DPODataCollatorWithPadding(pad_token_id=processing_class.pad_token_id, ...)` +# and on `self.padding_value = ... else processing_class.pad_token_id`. +_PAD_FALLBACK = ( + "(getattr(processing_class, 'pad_token_id', None) " + "if getattr(processing_class, 'pad_token_id', None) is not None " + "else getattr(getattr(processing_class, 'tokenizer', None), 'pad_token_id', None))" +) + + +def orpo_trainer_processor_pad_token(function_name, function): + if function_name != "__init__": + return function + if "processing_class.pad_token_id" not in function: + return function + return function.replace("processing_class.pad_token_id", _PAD_FALLBACK) + + +RL_FUNCTIONS["orpo_trainer"].append(orpo_trainer_processor_pad_token) + + # Fix bare pop("push_to_hub_token") in compiled SFT/IterativeSFT trainer __init__ # On transformers 5.0+, to_dict() no longer includes push_to_hub_token, so bare pop KeyErrors def sft_trainer_push_to_hub_token(function_name, function): From 2678d173cacb833bf9f287fc7e8db74aaf2aeec6 Mon Sep 17 00:00:00 2001 From: Michael Han <107991372+shimmyshimmer@users.noreply.github.com> Date: Mon, 18 May 2026 00:55:01 -0700 Subject: [PATCH 30/62] New unsloth button images --- images/Discord button.png | Bin 24768 -> 12946 bytes images/documentation green button.png | Bin 20917 -> 13314 bytes images/unsloth new logo.png | Bin 60610 -> 54788 bytes 3 files changed, 0 insertions(+), 0 deletions(-) diff --git a/images/Discord button.png b/images/Discord button.png index 6d0401c4d09266ca31924b96a2908f6b79d8917a..edcf854cc9168842ee8cd594f3752019962785ab 100644 GIT binary patch literal 12946 zcmX|o1z1$i_xGX#N*W+tf~3;jh?Gcoi*!qO3n)mJfONBT*Mfp{ExFW!(zPJ5)DrJq zzQ6yw&jZW7bI!!6IWyd>nEd5D0{?Apce!1iIf3{Jr}S3;5j-(uoaxJ^CcC z=L!O`)1!Ydyb2{eKp^h73U8$}y?!9zCf_tSGdB)NJ_#Ut@uMkLp&z8zwBGC6_9QyE z5G#F=GqbF+?i*El%ILwHAODqcwhb&;=R6acU@gr))0_WGe}py8)Y8#DHUo?w^E?r5 z*i(q7X2Zs)&xRk)h((UmWFt^7+~%X4-Q;(v>VBh{*{QW0JGE~sVC23tRjP5|x^#98 z0psC-wJSu;zmf6x?tSW9)7ZbQYwx@d%snpK=4_~p!YlxRGV-_gTX9ofhZ8dcSM5it&s8#h>jb#SlVqUd5r1Ees+5()sL$ z=YxN(@jpdV8#uBLXA~9|7K9v+!4HZbjm*)}7Snw3Y%}%poXUmrpPVAkGHyB=ERpGa zmLL8oZ+iM)+bNlt1kPs=0Q@=9QBh69D-{`|h_Eoi5t@{g;fkIN%fp$9W>cSegsHZ* zxXcG-LJT3(23v~>(mH{6w2e|;@K!n|JhpR!N{T^8GYp`cHQSrs9~1>nX%qq*d018y z-(zE=Ro+|F6+(i87IXC*^5`b`iFSPzaXN9j?XdTG?|TwVJi`MR|M24s~WZ=>W z=jzc3e|~f1>`z0H4SnoT|262xN9M+0uTOBJ6FjsOtux*nT}2b-J+SO@!G73}z|RiI zn~vLVn<31|%{66uylVvzf#egyKd>>3jZBYVAHYJx&1o!1JwzX@S%)Ix%&|~7XV|R@b8j?`^Q1nxW^PUSXu;wO;$ZYFr4N+0i zE~pK<`>@=sbsvBJ5-UB(padC3wrV`b`Qtc$+v&)AhZvsGE5t?zR< zZ`~l`b~`XjgAu(M@}Y>{UM8aNe_zm6;q{K8BGkZ5y20oBN@wcs7?iW85#4K2R@Wi6tGnyP#QVCI!N~{f)CBz% zAvNJ@%VM>2condB%4jO6|He{P2DmOY9ltYce?6zYOfJfa%I5jEgSqywJOea|Px!r~ zbwv^b%ylN;itjpO57q#6P+;#~Rh zrmg=32xY15ys~r09ZuyTX3?stg9Y?j+l}AL7OnwiMfS#zXcnT~Kj^WdqT-Ca_rxz^CXQ$QmqF0QcfrR!l=eO*kg9K6EK z=&~VE$6YGS7SjyVJmOwWNXj5k?XKz<2%f&ZQ(O}z0YXHU<04L4QohI;! zz8eU(v}R*AoNr+SjP*4_)2_ogbb}mFjZkOwJ)nyqYB%@O1RjC8%>izL7Iq`aN-Z|I zcIh%~EUb|fhlR`o^f*C#uU`#kL~V`mXx$zzdV_(vm4Kf64*LNIFo?0PE!JFSN?(9dE0MMYa zO07?lm@y?qwpT9^w2WJ`Oq;86ydru%1}!kqOKw-wd6RZ<9C4)%u^1)zaVn0>UBlom zBTl00Y)@KrfVG+TWp*VciJHg2Epni(O+|FzC@imsST$I?4`>@86P z=6n>#wV`A-Tph4f?fmh2pFeZvJZ|rkiSwe#a_}1A zw?TU!-LZi0@f&@`Yb#cig=0fYEv%th6oNBIRtJBlI&} z)GA?!u`*pHLA0lW-mbsGZFlae{aMwfSLY^OZo=6sXeVeBf`rhtar8u>Eg$5T?m)!SvFeq9?i!wnT}2yRA}LYo@T`w zdT!FIWQ3g2($xI*vcBg0duN7FE(=AA_pndo(iP9}`x|W60pHt~6*$+n!nyNU5S2#n z$@^tE!V5aiiIkyIz#E04ZY!0yWqMC-He2;7FAVsPCDF)g?0+?q~pLbO~|bxW}9-x z51%-bYJvSZ(Rcre)?AiMQ?Fi6c7zx0xA3JdLkc;5&)Wag`n%}W4%_Vd+Elr39Lq2! zdQ4`+UzP9gyHx0Vcag4^uTR02RZQ8@4U&#Y3du@FB8$W6dW0_d!n4eF)OXT#*%&Gs zvw9i_f%LJKB3Qt8kwB8&@1nlKc+JBnjzZxoYs6sw9LT|dPr~L<$yhOY+_u=A=H2W# zTo$R#ePZwAWHc8=DMUNzi{9ZuTN}n}f@1yHd(mxj{C#uc=yxFQ)uHm}R~ho?z}FVd zMY!EKlR~a9vDnLaCyh993+=Jie!`YC{u=7Fs(Fetduj(O)E#U8H;y)bZU;H^)?&R> z!(-_?lFqkLN%z08dy4kT@OFK=MjENkXayK~ok*z<{~Hq&R)B6geESrmWt`amtjKo( z&i~(R)`zN15X^TG@nAyP-#=Pm^sa#@ox9v=fXQO9(KqgFo}!yV$4%)@SgKwfuNL~7 zN6KxHQNVs_YY5w$MX2~q=&e6OGX|+&Ae@weyzC`vwYTQ*tIs0!nk?+tsQf>XFteBx zIS38=xEK7LW@8JylbI@c$NM$`ZAp&^9g))3s=%HC%eyJO>tPXwFEa~^ZCfraERL@n zP#BF$OXF3^o-PHT1d1s37B2?c1<+jt>5Vq(SaEps9E_I$D_j@-ePw3;XE1qaBl?+y zd&psntCdm{DJ3Ou?B0c^rOOenw-Y+yhEDR^QyyZiK}PPmOtQ`Z-gCPxG7XMzytwe@ zL0;NzL<C1`nWNlPb$`{1n%36U`}-T@YeGX_pCeFCMWr7br{Gruk|fk56F zX)PZJXvFvYQn6_kZB7vjRk@h=enx+E@wh0v4?-A=!FDD@WtNv>G3W$ZS z8a@GmO+#yO=M}5bhpeEUy8Zkh`?~69aXJFH{Xp71?1KWi-d-;pFFjb3G`*m?J^Vgb zxB0~N&rgA;H1qf%Npj58TBk{B^Cn4HwPO`k&KarX4KFX^&o3I`?n-wGP|%CHhFzZATUp`?45Cyf z6hT{Bvs%H>g%mS1jJw}f=p`|MnWNj2a3hmXWx?uO4DO*J(}~ zl-X zflXg+kNvBHi{9YCgU=RjGe1@DtGGrXjiMt<#JbCf%CJ^)r8(5L$w8{$$GQ#zZ?Tow z^w=mRP}r~ZoM$O;fmZVl;-$cS@=WN38@%y1HPD97ERq=^{_MR z`fg--u%uu%O!%Xv_cBtwMW0TuyJA}b3q%wqK1LLx#Uo7;guE!oK08=e5yX1;Gu6LI zfa+rfW@7M*%jqiCv?V9Q=9amLLmcF-lW%q)%E}pt?f&@Yb*B(eVg)&x54a0bHx&3 z@dml&N*Vjkk?wTR<6w@{X6Ie(Lu zmezX&BIkQWDjrkYiB^VUdGCa$v!cetX}0Ty-q-$N}T@* zwY0YOAJgV=bT^&~sM(Y;mnKQr+*lH@8vUVncpK%TY%P1hMJ2c7YNa>&gjvD_%L6z} z5G9B|K0}~fi;J6y@#~c7Y3;U46PZ+mmklu8ZX3m~{&kNwuFa9E(MyxyPxV6)oVG!G z^GGtQ1uZ4fuQ^VzCP&%mOy;oJ73lHRc&xq-KWu)^W+^p>kSan$LnBu)d0S8|C$dep zj9R)ckD6(4w+uEx9qSDZ5cJs7U0a3jlQ=j{1lMJ*jvM<;>O4n@>^0-gV^MkDd3B%s z3dCxRLs%f3YWH-p*7LyF>XtX(0@am*VgGW=iFmO)1^3&F!4_#S>(&b?k+EE(`7p-(jrBuh zjoB^qs9PiYzW+<&cP2mxD#)3%Rj%)-e?7nds{1QBIY;M}XARhQ;ZI>zZZ3^52}3<1 zlQ(B-D8(Y#SuCP}nq%L8+v}0Acm@?yU#yAsH$T-6j}~CUMQ-uTJ7!<}m8QLxJ8yT> zlw_>W1W)!!_yXK9=t|F27FW6U?RMbH5rj03b_*gx;i}`UPh436zwV-=rxOB zgoDP?Chntj9HLXol?kiN7!|~1bNi-u*jh8mcGm-h#;xyw@#Dy2VJ`_YcgmNL>n#U= zHlBaQ+Ci4dbFRt_b zbFZ_1W6Iy!rJsg%JAO2YD3Flb!&LK^wQwHqGJcDj&OJSP{nFd--g68x$-g$FT2NJ1 zgT;LKrvwkD(k{!1UH%2s`#Ovz{OGHKIWxuq|CLS^zVnIMgHz`Od%WU?3O)W1#FyBD z?9j|z{ob=!_$hCQ1~}@C_4Um=o}cretkd1xv2tE^k8Oyeyev7!TkQ=qg6x|InkEq#%Ql@^7XD*Q-jp6}sGGr+#f(!KTz}(2vX6+CXIr0{a0BayC+9I{yfIY` zO=X%jnO`a+7X)caJkq{dV(Ms$@!R${;y-w8lB^{yy--moK2v4VxpKSPVz-db+i~LL zj_gcC>_4xFAtQ#=pyt)9Vq>C9lA*|huCgZ!?<##>iIjD*ALMn$y1ZX_BcUSJAaSyc zAlS#XLV%!(4S(pM}9trmK zdv+W<91pTpH9(?&&Ie2J1a=FZ)eJuia(M{WCfj87onp;VE8Au@pS7(h`#^CTT>1Dz z>iic)d@9UoPPNdlvxT8u)dMH$C$L>N(9wYC`8%m+rtZg_DcCSS=HTg?qpERVq zPQfH&Gqs>o{3^=ISOLnfb($ooOUv4gLS9uBBA`YO`$6x11-j3vh&ieG{63*0*JgN& zKOm^MI{R+nQvIBuEif$V8I$-kaJ*B*pYX5G-izx~9IKFvg-AumRm%o&jNe30PUe{@ zK!y-_M$|xa9ptBEa7z&P42Q#gJ1l z`e@mj11dnRg@^0m0lU2@7Zv;6K0F@@FpTqSLw-l1}RH4XYat5w0hC$3lW|FOwt9q)-rdF?K9)3G7_%O&6a^y*Z)a7j<(#YR$ zABiI>DZqrT*ZxrK&Wfj05pSe)59-M!FKvrGmGG}~5Hkm{ltNEY0c}WKQ6Q_ViJ+SY zk!~W#cjuI)wE{^zxK?Lt&W~qPBZ51Vy#yQUo!n@oFc`lU&Zdw18ds?-{wvs|Sa*MY zIbnlCVv|MTezm)Tk5R-Y@{)e=aAwphPYgQ@f@K5gs~_?4%bZ;KfsLpkX@t*PrUbls z3TVJbR+ms=(fF74)K3EP8>^<5w)fu#>q`%ZxRJlt$3LzgTZiVRK5dg%vlN!C=a{Ej z0sEIzH!}@slsgF?5i=t{ZW1SH_m(19OlVz5Pux z`MLrzQ;qa|f^|^ICQFHF1$AZt`49e|EO=}W8z=K;M(Uk}#bi%>!i?;pt8SO+^SR%o zR`5LWSx@u(b{IbN!cQ4C>llgm+-Xb?lB-|Xdp{B(dFkz##Eek^`%FAp+g+BJhXO2m z)$n)pQNYa-aQ1|+b!JyztV(t72A7~k6H>vv7-{6es9=h}Q8FD}T%;d?fmy*2`V~&X zq}(obzwxU_MCxU!pi*4H#%(D``LR}K3@dXI>oB8{Ae*(xu7BcN6}5>2nh_Ia+dwNB z5`~ZuRq{>QT-Jb-vs469Nj<5$^q!tfOSSd3E}k&8-u@#6TH5=}VbyGN($Z|HTt_0_ zN9NXl(|8~7*``ojbncZLmf;jBD7L-f9FAPinV@7W0g+B|PIGgrVU8dace@_I$Ls%6|>BUJcqm`e; zVI+mjyv2L!;V!%tYAjZ0!#6Wk@@QYi5iW?2i_z+|ag?l)(mfMOKBE?)TJ~$swmvjV zQU4%22ltT-f`xS<>2nS=Yoq1K_>zg5Y>3;7Egpuwdk)5fr_|Cysov=`A^id*8^=q} zLDt*DX@7b@>C&^8a8)4vCkwFT!EE!UV{BXRyyh38_j97;GEX01QWdv)5xc`@7&yL- zj6j?s<%ifC)PKJ)lG-F?|7k(LbzOMol#clnQ4*morJJ28!v-a76q6AX$e9(@^J;w( zmzt7t1ZM?3d^}@7#QRw>dLk#>X5Q5ywDI+xH>N+-m6%HJ5qTtBnQxDQ$enb3Ys=ck z2a;dj6y>*UqBj+y`p^kUJ=1>iVkZ9~4pIhgNtD5atHSe}T$1H8U--i7`S_mXL*>ZC z2Vw^d;K6%RU9!S|=w)^ta1+j2p8P$i%E4tx5iPF~bLq%OhE9n0fHWhF3|IeYQzKhpDO$T7$W(`>KfJ zFmj-fKB+Ks;fjBHpYwzeqqh@{sm}YPt>E~pDGd}^&v;nmC&%AMS8JkCg@}6Fc|&)%1|$Olkl;um&;1`QE*G^eF6*@{iLRTY8<0mva>p^~v+K{m63Su6ama=(~g9B6e`|+U< zysIl>iH2fGROsfXx=R1}g41p9#l7;)ER@HegK1Yv_sr3pmvow+8Ah-I3MX10>gbOB zbUE-k?$ik_v;XxuTvrHFYhoHD2kB>K!u+F6Qt77lxgqY@KM>PDz+CN%-N%r^4(PQX znU{}De5FAYTd&D|Nk;Rh6NsiuJ94nxzk722e-5{ z*Wvgw;$Hu96uM&rPP$V%HM;5T+or5>T0^R`PI-L}rZ@vG*1H|xp0k&w3K1+_di;z` z1}1UB9-c2aOQZ(f&2cp(hx7}NVMkAW^b+$4W4bSr zHj8CmOyd1js2}7~P)$h7oqC%oL8E-pcQMOaH<1aK#PlHfsx5>GCB)^|xL z0*W`;vV}tbF319qpL(d_v{N@00IukJ)J9&}`$pZAZIJV@#I=ODAoO1Gn~w=}7e9kL z9eHUHocm(F)XvoOwj8p$=P-Zw`Ps?Fg6X!f^GR~Ib|(LtH+1jLz_@%0Mw%@7Icf|( zRUWO&-J{X1^6_hS6q|+#y}YsA5ri3ekJ?mouaON^V)63wGyYo;VmA|EMq#}-PndB{ zPBTxj)_N~_qoRhTvEuN3F%A9-zB5yxI|MGE=1*5k51+hjcAtN&87ls&xl~8cc2#=J z_x7fWiJMpK3%R0gP{U6AgxOn%oG_&5Y@cmYO|iqc^W?5rlpbzdN#c|Y<3do=CML>N zH^0LmOzWxkpI!4#X1p+Bvv(^E4F{-tIseZinM!v3F2x-eBY&bg6+WB$@9&6*WZfQF z5hQPqQ~1rn27c>rC@7PeWqIB_32Tk31FpS}=f-YoE>1c#IW3OHZr#2$#L+_|Y9o2W zM*MAwV?wpPWB?uE6@>v31_tHZt@7i($}!*cLG`3PeTsy3D1qL!@AXkHj3*bqlKKaCXV^V_Q6=-q*2yv-nlS(C+y|oRuNe zu9KMxOabLS(;{wtq9(Gbq<98CbDXuSc3RG!^!=9gcc`Pd9ixTo_hoOiP~Cw2fX@P` z@A}M1VEHm*^GBQ^zs2H)#~gUpxq-sgUQqdC%On3SwzV*1*}{9?(-YSs30I{rbX2iiFYrlX~;GFN@>P zag@lbA3b6M^RC}~n(MO8zz(>=DfUi{H>OkVQduxJ2w2bdX`E~J81N-%4)7_5YK@uv65kJq zA@7(DIv(Yk=C|v7?o7(y7QgwD=^G{$s)U)@;^yL-#3r*Ar*_QeCoYbvU8B*U@of$o~`q_buo6xj<{*M5{Apk(YOR>BE6jZ}3V!c5b^CxX4@`7HC|6 z+YkomLzYH<&&@DHjOA0_#K(MPu5w7&b>}cC@h)Y8SvF|!xc#ET32fM?UWe_OZMjeP z#Fmh}+FSiC*7^2PRpvysb94#IeAsdcN%-my5r@Z)XF>(eT;$Bc7RG^?c24o^7cG#Q ze{_)kermD4e}SsS#4(9@<=&zx`%L@7&`hjcj|dtMb$3x)!TpBZMwxi`(0OrVjc0-Q|tA z);T|kr~YY~Z6xa$50!t4q*gJp;ls0!eLo>(cvgI!WT^|a`?mwGa$i(cW`ht`xAyz;RhD5{hmg_e8Ii28eU^qdABapW_CMUk=5bN#0?!~z7E_l%{$|i zHrtU)k4*k|ky6IJKnV#6r=p^pmvsm!=aNIPX(Esq$Lqybrc!H2ac*bH!=2KjDfqJL z;Rwwn{5+I;DEEM@MndosLETGAl2FLQq~0(_Dh{6tUw2)1wt1M%Sa)NU-P9mbjl*{R zNw3=t%Pv>a3~H#OX`)>ck0_Jln7{Uu89}WxkwAC+~aA^A&daxM(g$L9A%&1$BN>b5Xp9U47qS`}g*_ARaU zZ4l~tY}Dy%!oTlV`D%iVQ3B<&syy?IT3cH5Z4dkKv}>o`-0^mF_X=!lDn>KA=}D%N&-@QK;CI**~#*uXBl%GK!5H5g97YIL^jWfSYHR#99z-O3K8lgy9~V(~&j z<2gsCpWryk_unsU3gVohf4TOly@EhWvei0Z`)SL2&La6JAi$%|A?!~zZC+Wi=}^O3 zLtq1k7L|bYa#^m|)%jscEV0!<0>c3~@l01_=%hX`O1$j-;xLf%+R|zEWrY|dmGz&B z)%%U_{e2s%IWs0PWY&KhP&@q-GL3|wv`w2dJX#v62Ukz;SwnZpPN-FTj(It_=dTNo z3!2J0D=aIHm6M{J=V|oMM0PhHZ(b+&c#DIN^_EanaN?M;oBgKKzI-50Qfb8L$LYfv z*vJ~mx16+`k(RBU^1Y(D?VcM>Fln(|k=c}`tZrcHI+UML~YfnL}wmE`z{ zy&`m9kfTiBgM&n!Z2}bqyJw9UER5PXD(v;$7ywFt`4#t$2+W2L+zcRnJ2F^Ddoufs zz%dfIA`jdVJH@NHY4-fm&?KMAL#Ss~?QRhGM~?(Yei*2>)hwa$2tmUvtBvV_eg={r znY9AUGhw{e#)l?X>n6#z0nSf-5Etlrsm$t7bMzhs0N6=>xv{Zh<3QpA)Q|brnss~< zh+}-$TkeR~hnoAO?;p*czcs4}B3xpkrN0Ig3WHaYWYGhisJeB0qbSAJE808X3k#bW zngJ=Clq)L-{GtrFI2cLoXs_D!(aYRC+cFz%y{nEM<=gL;*75Q2i#r>{{-b(*qir-Y z+7$$=8c7d+J)HUWQc9g}0!!gFw)^@Zv4$lc7=6zlDLprnznzEld~gEP@XhKE;4UWQ z3)uDbXip&l2tWm#x6ND)f^J_L7N+;Eeyvm(Xx5=QK}jjx6}1k~e>*us{cNp2c9FzJ z=WdYPQ8^iPR}^F>v(QsP?&Md5 z>qH=Ft0*lYwJUd{g2Fb3YF|g_L}0De96oXvQxRa~)z-Jy@NUH#zCp%ZE6n z9a7ng2J0;Cy8W*n{h6bizt({XV=gUX(R}Z}igMUgL5ep0LL=4P#s}$X71wQP{tt@~ zmcO^dHoE?vX1^ZWTSn((U6BXjNOQN4w0{;b=-=shw32?am<`*&joaOahHKdGICFB6 z^pcH?isA3=5_Y6gq)&UN=MnW6f8XbZpwX6~Ajds1M}TTe=8n}(>%iFnBhB~@ z{2|$dq;6UWZGZ7~%XjC=U=qiA20lB?To2uJ) z25dg_gmx(LwAYtpnGZk#Q7sbRwI8xXu_p2lm8D?<;{K`uU>!X|D=Q4Y{MYXkOO%hW zy-JJTv^hNV)z~aWD#yt8o*voM|Abqrj-~b7Aw`XcupfQMiRR*%&$b%XsJ_FH#NnG@ z`Hzp3Fji5U8&H*3Qm~dP{rV62FrOqQHY7Z~P+^#9ElCZ448v9b$75j1E|8Jl?i)v( zP~48$#$L;RCvn=BgFiaD3pTOZ%Njh%$JxG*aoC`s9 zj8HteYj7(V__BV`s>k~T{Jsl_s2RQA;jLoz0kigPx4{K8can#Oj%NGzE%=t_PG_qe z-6T?egu9g>0d=wfB~##&lWLd=Nt%c5Ox>$pfWUQs=q2|&f4-3za0hphjMdfsE}+9c z;<-Q6Q*LuEW-&yC~t3HHiVxV%#)$LWC~0uO_D*m1GDhvD~Xwg!E7HBRbDe#CDo@ zaD&J1^d@*%y?ef_PdqU9jNgz$i~)}OKiqaexNcv z;U|xtpCrlmPOeRJ`B*0SH=B24aTz0W+IssvJq9)sukPkw09+Xe&5hGHc=wf7hAzIV z(7(_z8agXE~dY{rR zYu77I_xmMQ-mO<`3xJVbvS}9^C$YhTUIBKau@twLgs7~V{SUE0?E(o{sQszZIydg- zF8RFaayII86F`=IzBB(VDcEkEGUJICS5)M53s6@r(ypN7>J>E&1fYlA_N3GUu8DV( zya+RUy*Wkdyr_Yp_izCH3JL(uUQv>~pv9%TQ;bg^@?Q9A*8_7p26S+dJZm$Celjcx zdiB4Ni~;mo3@%ArM%Wqvn91;MT1-8Vy<3B@@#bt(l16TqGu?fcy0~`J)h}f5R{G^T zNFk`+Vxy}bfd4f@|29`+=mD08+xxv3F&4TTKHP|+;k276AMotHn`As%;sEA}3()A* zE~SJSPRSidq)+^G#vUmtDepp~#D~kv%VRhvnn5xLQ0>Omoab;?SNmC@gb)z&r-(Fj z@7GQN7(xLC!d)vQEtpA9Y!FQyw2}rG#|b4Edrr%<`!I>6x(nO9REv#}%xtNiPEWI0 z5wjgl2kLPK@MIcsL(+fG?=Wymzmi|jDpu%|c}UlGx#WAn0N7Zp_ni>q>HsXw@zTLE zl4MmF5pEW?*2ShI>8SNr|2Uz^eqrAajSvT!JDHj;8HxtZNGvzUC6~3a(h9IGy~Jxl zhqItJc%|%qT$PnL{aM}vRTO6AxD139H2emQ`ycxG?zlM%E?2^Ac+PGj$0sLyzsn7A zE;obk)mj-J;V#j^&_{9(NwqF>L z#2FwNhr}}EMgZU}UfbP@{|`6|fP}x@>KIMiEh6taPjpmuJYnS7LnDqs^W@4#o}q_H z+v-MCabn4pd~5pBRTP((sFAH1s?mRTXqq7BaJ4bR@BC3sju(N*JduLddg8MDt;?W2 z1Az<7+iE+^HD7)wI%f3BxAbs&Q#p)I#&{aLOS4&aTYH_6?*0LA5CpAulU)P0NhYgE5N{FJ6AA+}A90q^4X8UsgAO#H=L)mv;u^K*x$HVcPy^Ds{pum^;b5V)xw)FD)oM(*g6Gz&#**KezrrpG8#^4psZ;9=O6$7;= zangWGP&vxqlm(tQWP(L`dH0BrFJ7T1+dmI@4;r64JTjdz^189RBrxw2uzBPzSO*7D zN>}Ko@%HXH%z*b0dfFefb&HzOiAhjFsg7d}s2)ANlkKWLnd;_(+P^Qga*kLYQOP5vlKUAU^TCK}`ZxkWT-zNMJqxGDG7Y4?Y3b0gW)pj` zws-$ndLOpActD;9=cgz_8_XJ;<(5O?ex=%#>lw=Cp0mfp{+@>;jm6$=zHO_2(8*m6 z)c&#dx!CUMW0hy&$1;-a)%pz|Lu>KJk628+PH)ieBN;&CSnN-C4(nK+1|&lC%`|fJ a_I_Iz`N$f@eY6RH6l9d&R=)WV^8WxeQr%|& literal 24768 zcmYIv1yoke_w_>~jg)kEBc0MEAl+R`cb9Z`w@9aSgLId4cXu~@msfxP?^%n*T5zAa zGiT16*n3aN7g=#cI2(cGpOjUD`%4bKB_U`MA)C8eK;pq4Z*sT37kPo zm_tO9o5d~?vFqj4l(Kb0y+i?z(Z+@#p9>HTI2Ftq_2f@TA3f8tsNlCxf5>|2OQ<-^Zhu<4$UJ2yg5nEOtLOAFdF zf%_b6ko4a;B3sxZsG|X(9qHJ0MpL=oNhXOOXzJ`@;Co=%ggytO$$k|T$R3`a>zkwm z^J|-%hHkuf_H`D>FX{A}?B{=kJzUOA|Jr_*Xr>T3v1nt{)5s(=Dy4rI9r^q=$a_>o zEYQV>%G)W{4`c#Lrj-n&GL`9!W0KG(Rc8;i!V?BLK%?lL9)@K5W@QmRJwL}skx;Gg z?v{9v{WtD~n1ME}F9tF}iiDh8U#t86pg2sKt0EX3^jRDkwn#n7pI|{aM5Fm+{7=px zYfzz4#bNLf3~KnZiQ->bpfA)-VBe6MW(z88X;oBZ_8g1c(UNZ+>k_|+gjKRB- zKvS0z4fVo;{J;=kqE`tP*{V#($|1?COubQ(iTxT$KeK+?q0o5e#k8s<-hlHQGSg{P0i;OSrgiI zwBz;B1@j=43>=90)#{&ZcgGCrFH4=&!>a0eUxPBcS|1!w&5IBoqY$K3GVk0$ZpP!A2qo@hBO)* z?XPnX#OlYSKN0Eu@G}AlfZu7wA~;`h{-D&0-Vn4ALihUssYmCtRF^L8unG$|_ydx% zdj{#Rxi07o;DcdR$jHfQmxV3Jz|jdo$uyFI4lZ03$O`>cmDoP-K!fvk1eFP-RC|Im ze>Vx$6$V&iJXsa3f(75SB#4x3;1_|;u(=<4m4(OPRC8VJjD0XY9*MaSuLv~Me}+MI zrHqj$W})rw>UF#^162TC%-a$@3q=h$#Ih2);#4N=lpRuK1SuycESKGuPZYAb%wMZa zK%}JH#-yi*cXyL%a{J|iK3LO~Q#bj#AXdP=&5*z+3oL$yWo1?slF~Q94UNuU@~=(Q zQOzyo>q(fIQL(X8{V+^H2=QcHvM%o`V1chOtBGWP*5>i3F_QK7=j~6|v+@0V6iX3R z$jHddMoRl3nIw;(qsfFxc+>k}fO)FH{H6o-)LI>)uu*`^iC` zfEnNkh7JAD^Xqa>!CYW`?y8kV^hn6ak}X9-{u^FmHWlODyLVE*g@$ZEx}k}AK;R01 zx#%Yfc#B%y7NFWPd|Z@h{2xDv&n~OE%m2m@kz6S^H|~v1wCL30B8DAe&@%ae4JJYF zrY~UdBZxJ3kp4_K8ofwYr%(dXKYPcJ1`~;DX|??6oRWG6(upDKLU2KediS<;&~IcA zv>K1fR0fJBkDBwph2zPT4vFfI09K~&DggViL%k@#OCkZpMj=ols8D}|)7x9XKOlgb z@b5~3)Av_e9lCpZs0qtz2tQFuvS@uzvwwVB2rgJMGEvk5Gl`*)k!&ym++R;4QH@Pb z&NWg|Yt(5+%uXZ2uIr3wbUcJpXK#C__md3_E`}|JR#g_7>R(7Chk}8jK2)Kte(7m) z`S~s5sBVcRu5(J~iqia0?$^!#JW;SLR2PJhK-R_AfL#v{EKlCySPe2eWP!P@jUN^n zS@`DYXz8CBPsr)%5i2Wg`}_NAOp@mu$JJvIY;8!bFmjnN`n4dka~7C$@(N+U+}$-? zk7E8iAOS;fc1F)2lEe2jG-HHlzURpZNV7)b}~^pQS|ea&u`c zrIgDrMYD6#N-Upkirzd&6GE*tA36Z`OE7rKe08F=Rxplcu(X}Z`i=+e=|J!4p+&qYo<}*u1(P+0*aV&I@kNZf4Uj)(a%g9c$WF96?nr~zlAzm zNFQP|2=teim&la=?Gwz!?QK297iP7@2-0=LfRD!Wb02;~gW3`!BZ6VY_4IrUDa8KO z59YG3_j@+5(ClnHgfD+1H0u0!HR~|PdN|k50jv?Dk36~ zzW$HMl)o;88iNG~53fA43XG#M<}Ul@AD&<>x%nGkMMRQG^Z)tx)-(x8=akbQkAa$U z=hxJ?2_mk6d{C;<1`-h)?ZrE1XASsd{<+;BK`}Atlcf;f(78`JMf^S34dxVp8&yLj zn^J!|{}l%Vf&OpUNYa^g1HN*hUuvsqGxt`_%bSKEWqN${_wU1fK+XJe{|0meuOz@a zw8JP)ow+}$Uls<=FUSJzJGOLIcsdv95ev+}=M*TpxuJ`Sz9k|JfyO0b5qQ=Z-p*er z%CIe{XBdC?@X$}Ikz{>yv!8OVa-q) z433zWHyrGLp%M!y;C_})DpQ$MSQ0jw0()Nx?ZcN?=L!h}L(Dq${|#W5eRl^*MnO?D zer*m~x&QktgrYEr@s?@tv zaQUe9mCW5t45DM%c)huVmst)43Hau&Y2_L8zh@d@D6w#Yq%=e8c@; z%^)f1SV0d5DT*E{X|PZrJpJDZUQ+w?$;sH$T9838{r7na;DhlXEl~6}Ka#u_sq={h z+c)C>nW2+~g~eu97M-peH5M#BnygDk+*F~(kl_|8SJa&DS9gYZUB zPuD@#{~6d7i7?B;tjRglrK1^X;4N0kgG|Bh(uQ*S<0z99;{FAiVBWsxN0KxWsUms( zUOvTwDCwKgT$e5_A0gOx?@azL;y@S=<YUUCkX0WOl)lE&puhbmri3&_Y-if zfq_ZWO1*PCJRUEF6w1F=61230Llxh%iuxRC2%PTFU? zwP%aR>w$p9s4XVe>$j(wVQQu~QxUgD({zIq3;`4Mq-dY#QkhezQ~SPHsXVw?nI=c% zJO^R)zZb-)4i2NwqdUhtW@7h|4}6iVe@js2V0V*C%p`8_am?zppj<0UX07yY3Ej{8 zvL4TO+x!~bIR=l;?M-FH%2KD-E!t1-AQ+LnrjM8#?L;?HQm5scXC@0Z3ozj@Xx4t+ z$9RThMOAsgd+Roa(yCUhUu@GhP!Bb@USe7;wFK`M< z$>-V-qxWYa-(T(uhivrdF>To%ToRLz*g5wu)>rCxnOHn}VnseX;!H5x_A_n^CJbVn zY56sM{gcZq zyw18+XWDiVksW`wVx?jqa(J(Rk0GZK?D%ffi+rU(DUUPbjTwP6BN|aqLOqYQ#UI|g zI5>Nf<$i0}S1w?C+)KYas$F9PHsxN2S*%jze=uE~ttSXw1DwREw+^wC>ymkWaX^B- z`dMX($>lVIW4vbIa@c{~j%Z?Ccq;#wUK1Jia4&|^TaWMoZY{8}oZ$O+u;5_WdI$Oo zU&i5O@1w3>`o&89Np=xY(M5;0)%@3BQ}bE>YK!GIG>D)!{YfqoQu~bnF~spwNm5?T z0tyIM1{xr6FV?+A<_)PDjEiZ^V%<~U9?3Zjd}~;8%vFBq5G<)jHDVK z#{+~NdbM!ZFcm8I{q!Q&xWK)MGSbW{}3E6))~=bQF7W{eegPm#eUWhCpV6uXO8sofJ=LrLifdAuLDb-%P{Li5WLiG~{^PX$UCU z*f8vO7`k`SyhNJr`^$&+mwu3owVlJ+?HcsrprX1a;c{5z=xnmHXOOa(a^4)x{XP;Q zff*PcR%e4WeAtS%4&pe&}GNtH3L*Xn!T=K2bG7L$;EW4Ny` zh}p?x*qI-~nUcWe7lCvDAPQfOc?TjiLn3i5nIX`T=-59#wAxBR##)f_2ZdoW3Lhf1 zE^~h(77^{+$RoC18+wP9&_w%YHX>$b`J_t#M%cF_AW;w(P5;!5ePDE*wd0GPL3g}v zDvmsMyO<6og(_*6?iUofQ9lo#!G~CHt$gzml%+T2p4GH`gJe%3mlpBb$^u?lSvi^s zhl(1rysxaqOU9{|bcqtfO(IJKH>)u|QA`x@twh}2-V|MvZ_atHTD#Q=0*$+H z-n&&<1^!o~RvzaQgSF`ORE>m2zq0mI!BwnRn4jl$|5?LGH2@x?>K@P4ZdYmHH(JbQ zFsIr2RF)*M#`=aAbiO@b=I5GxLhJ zvTeQZ%_jLfVuBQ7+aP z^Ee$XYyxYmJ?3#Tyqv*zX_NOfmFuC`YWIR@eMIhARc$4O5QQ{=Zhzu7d186DuCG6u zi3Au=8v$n=>k%n(oK+<^&3WI5olC10ch=hA>M`g1hhy8T8=fEfRsuM9cOo*ObnT4> zKea@RvP|eqB7;OGEgKtRR`_f0{3H>G(EA}FZ?FM!?PQq>;bHYq2QAxWZ%)_rY^Ly5 z{c~J!FmK|X#dK?R9eXZe3lDftXr&=eOm*Sh#l(r^>s{7opfKKnI;+WZL*Hu5m&xjJ zgJsxQxK6wKc7V{r@A0d;V592&d$jY5vlyr44dRpTDYqt;%%W@7P%PR|@cT=c;t6B7+i$Izo0?LGpx1i!y`dCyx~0YRsCt7!6kaOepKNQq-h zi~Kto9H?2*!PAFzg#;WPU%ju6R(i_qNl7k6?1b&?sv3oh2dm^`$^0z7HTPX^>Z>A;Q4EP0%YQE4+}&^gp_$~=PZ@GY%qNu_74huCdqc=w{@D2J;W^PLEZuVUWM8OK z8#)NL$rWFQ6#$PVlrWg^az9&GNOdG&152w?))hFyEtsc)xn71Q~toAvDp1 zQ($Fw{&6(_e2;kA(e|_hgE{2TamJHx#-udnkh z)OI`Jk27KNs(T z!=;tsvU(7VTL^XLpn8Rljc9t}$R_H*rZEL^Gm&wMlFgq(QSxYizzjwxLF<&tXiF8lO}7!jnYk18Fw3T%y$n%atS&|qhCsPCe^C+C{kI=O)nd} z36^`LuZD*IE1|0bf(e5;eW4r)o`*KYXW2OZtY)dBXC4eyc-!2dO9X@nd=9ARaX;bp zO15yfoo#Wo(?4&~9j_GDELaUd%@AsP+_AqpoSxsYe||c|%l%c3@K(|`!eZF^Hvs|p zHB^tc=qrUQfvvOG>i4eEOz5It&acE3qxmR{I{c4M=4oS!xnI2Kk{{t|ROpaZi9_L9 zdECgL+ovY;FW*9c6ra0e8rIvGG4x8^sF|JyZ=G9CxTmYMb}AZZKs7 z^>rY(@Y#Pjv~MBk7ePS5{b4ut(b984b%CIYiQ&=guC*ACYI}3D|;e@yR9v;K9gV6|$=kww} zD=jzeu1@A7JlEgAqki(DU`i!-h3K4|M$}UAbyo(R2V7isOZyvE2|s#G=e1K>)pZ$@ z(NxpPySK6eevHGnnM%2sY~=(0UC1k?MxyM8S1|T6%}|C69wIWb?)6L3H>5#9T9kJ^ z%f&xyfe1=7$}MyL5|cIncHlX9*76~|@x$ZG;u&*J2T7bXpCi0Xu3nqV~z=GEONiE#9|-N-3M!nNq!Ldw*Ke;Q7c9UjH*X zGvexhcc(|k#U`(3XxU8e2%w)`y9-flu)F3C zuRo;`RVS=Fq1U1!gv0C)dfyZFLuueWm3DFN#RC*Hbf@C^HHlm_fGM`irvKibMD~)+ z;`YSkuv+OnZk}jxW_-?~Yh7xz%Ml65p;Bl-8BC-Os4|wK)g*7--u;NWFZZ9>MA$3m zVvK*f)Tf=Pjc@2)Yz;u^>gw|CO3KE^$NQTeaEKci!~zuo&NeJUcloh73hK!{^~XxRb*mvMvq0yE7}$fzoN!;B^Hd3i&-aYFiy@YiQuy5OVq-x1V+v*W%hf%GSv2 z(k2TqzSZ=BhzB%KpE59rbepXpbX*O?r#I^?)j~T1;EnHJv9Yn|E_eCqwAip5-xoQa5;ucM-PBM%R8LBNHG6pwRz+1 zi#kK2(Ew_4vD_@i9!js(7923J$jAAo z!XD|w&12@QuQ<(4_geLH<0-RaX`};)Hp~Q;L z@YS77S*38R-BzbfOs@ym#0wO#uoutfpE4yo!QtWl&1hl%jBO7{eR7$#`@FX2A<5Nx zjTb1otJW+}0E}w|I*K4+llKJ$O|3lCUBT}_%$72KEV`R2{)b~4wCsh@w%$}L_Y4e$%>LsJe zOtzsT@GE^GP!o@Y-U0daJO*9)^j5XC(G^MVtvXk_8`p2WmPY+)Br~B`xwOxQZON>) zXfwm}S;w55?X6Y($!Ac%iH6Eu6=p9yg&iIg7>)qguGw z$b#WT&3x*gm0DdM{8bMD#E7)Iz6*?!1P4K9+q-_|ns2KR_E_b=4jsKx8bQxGIK@T{ zYIcW-s1QL2eI=x;)#lNX4aBRxuYpmW!SyT3RUj>VUB+9tRsf_wGar5=H2gh|+F&#A z0##=^rW(lV#2iFthBs7W+b?~oPOb68%>f4Qme8SmzJxW`Xu zM}T1)U>5~VJ-jo{6xUfDOb@=rwZo{fGvVx~Qn8%t>T#N>t-d7qO>qYqNBq)oN zn!4xPWpIS_?_haDX1z1o2HQ;vt&BOO$+B4@3)N!h4F9p07|mA?9H^psIxtO7)nyM{D`0oKEL%LM>D06_GeFEgy!1b z@A*>Kg*vyEsfwUUv#-&fg~7DE*I%PMEk;oe`WSsoEs!=39($HEK`4d%|c_8kzzr7%07fE@BB$mCbzABOLEJ=FfFU%uAaa zgkNA=X|L(_#AYNnjqf23ju14eXURShd0`1BBrBX+rwt_r{MvXZq|{1Mdavv*287R2i_z40u#Ap zTCq9rar5N!MZ6?;;TFC1_a2;9zLVwN4@aUck1w3tZ0Oy)ySut3dROjQo%15>pI^Us z**;uhH^8;&oLsw2c!%I(bm@9)-fP&^$+g`f+3!}Kq>$EFFG|^iF2>h?+QdVJC7R*P z)*8}ojhK&n@^5L;Y`{q!5)r<^$0!yj5+({RNTwLW#E%-4W_-MFunudK<(DY;54BQq zW4~2(y`#q3Ga*$e;ml>9to{hV^O`O`_hq^4`kjwv2L3UzxetY*UadA6>$g>I;Ki6oBXaHj)^x$zBmF8|6RCnB9$fC_L)-Sp0w;;mB< zols9HB|q8l`gjiW`QDg)spmG%bnTI_pg}~eC%IDhx3b66JjbA~^HIU-@9E$seRZwx&S8BBD2g#~EnVqbSX+zg5}{m<2fuYt-vk=i4UG#ET`+BsgRt zH$r2a2l$dm$j?1VF4a2{J}=H#HZK*^@TSy@D6LWP=Y%Z`++lh;1>ve!PjrHLM zAEV{C2Q}YY{c#x1{J1(lX+yn%bQhH6fv8FzD#)NwwFLYL+oQEVPNc6}|0!v;LF8;M zZn{Vt9_n(p)-AoTz1s2c^j84@em${^FV1AWc)I;MYlKlm)up0~?6)i$L39m_NUP^^ zhcgn_tULCnL_Izg>9L^)(rAW2Gb?624u==XQi9srb7j!H!O7MnBSoi6+9K={lrCdc zZ&d>BFXvS+Q@O66_m7X8J#Bof5g8x7E4BS3yib;+7M*j-2(U15!o?zR=8R>xa6CNd zOcb_IPdDsS1m3Ogx%b-D1k2VqoOC9x0NC?sH>V+bAZUFZ46p zI9Eh|@YAdhe=EVsLaSc5yPjE`TYykeH8Z=~Bs)SRN6xKxcc+%+NW|Td&TZUo#U!2h z%{*YSLKVv&GL1e-!b-Mh);#yCl3ASvjURfZ{%xkGgp_O`?TI8Dz~`BWQEZ^S*W#xC zlA93_=>NNKR=ntS%}mo&Bq^%(5h=&3b>R$>xzaYZ4|78Wxg?k)`qcZbNMS&iahfJc z7&yjXnv^8b=@mZw(EkBD81qkw;XgOWsnztvA)CSNw_P%`{?^-QsT!?%oK2V}Up+%6 zJv}FI$T2vaE)XQpDt`)j-xH6-+94=7IMz1Tz`4|7t60=iWj5k=H1FK~?XpCrmL(L6 zF*F?&6&3+OsV+X`Uc223&HLFA96;Bn%IJ@4urJRPUiteo7LWMQ3f2y{bt&-0zXe7@CQb68#P*@^DF`iE9yRnwScqP6}tx8-8=;o2CP)It^At6wDl}n$S3(O2w0moO&ERx|)~q}E9lLFgf?@0#n!Ex)&N+sUDlRXL z4^+Bs2zHRrG_MSyK^c7BsBe5gSYm1Ss%m*B1_0D2^+8g1J0X|ZZEvKRnwM&}zti+y z{V8qa@u~e}?@uE{CR&Zb68Lzu0n+sJ_6o2vguf6pRcGill|!XwB5>YhYS`= zHBcj|Z6H`r!Ac5-763DtJRKENM;7z)c)2}8QWO&@gtv=VnVM*mS z^F%$5hGNvnY)AyW;S8Yfp&?F2!XBWazP+>TS2xyc{BsdWgrQ93#Vn?}W-kY;k` z;Ss;&2G84tY=J3tW05p2cZIP~r_+=0B5d}x2FaLX8J_vH0RY0502rL0$d$QLMX0=W zTPVJ!%Eq+5Up$A#C{a0WIpYqq*_I8jcI)8VW5dl_DGDFB3klgPG)s9I&!5sQA7vL; zJep!_YLrF{d%%;YLZYJj#Irn%FI_cQJ&_hU==&C}+cJ%PNN5c@RGSq zA>nYCeVu+9OkxZh5b*LF6m8eH;dbH ze8&vK!78IfzCI0>C-ZC?)!SCX7>y+uluikp2T&oJ5Z#<1tq_;wYTe@+moQ;TXXEsmK{d1Oq=HhTQ)=O`X^yo8R z&+JgE4&$K4Pw3i8lOEnYmG4ZV&?{!TfbdJKZ+HkEe({D~3Uq)EuD14ti-JNGy zojOQ7y;Vc$g|Qgav-Gt98j4qO=q3$)>j7}6_|6m)>sOPZ-p_E(yGL}PK&xtSGCa_q zHv6FGr*<`##@3_%J(Rc6UjOB&s8FdgecG@G&-9i1T>`B-;lRvf)+16U+ML3raBg|5 zvBB7bbDY-%FTc1RXlL~49sWWIJimrwNxpmiX!7l%+#p-c`!SiRDBBrd=b7-VFRgCM z+M|?pg{cy1)P9csm zi)`O%l!B2}rHaMkycx#Wt*LkyXGVAw_ORN``DmqLD)`UPpzt&zWZ~`-xOqRkD292My}TBITIQ04B#jkj>W5DDXeC+FlhJGgUTRLw67N zj-tem7rkLu82l2tmDQV_{1nP`&7pfr_XQ5>3f*H<*)n@86e($D|Bx{7qaLzb_`an` z{fDU#DtWC{hL5f8j+4f;p98AMnYRn96SBtK4yG#c0hFu2^$B2Q*Af2K7p2#y%TR`5 z?cb7arAcTF&!k&fqgESSgA~RSj>Ij}PF9;s@+%KHEM|<6n3*fpez_#%XLZS>@m37s z^FJCH&9 zezSMMDQFP$5t$&6^4GSE3im2((ZL?G;f%+~X8Vf)U9n0Tf_sVlPwuw6E54CU)6vw^ zv(`&p&l|A8c@}q5!)UwI4h+b=O?g5^B|)d=567pA zgf-L3WllszJ%~R+QV**@8%1}v;`2Fmew!t@GO%98D)V%6{LXiEG$St=H#zC^vM@13u(fRm2(1F5ce&yRN8?%EZCdmJIwI*G;SpyOlZX&iQk z>}3It&tF#|iG=b`YxvXB)6Rxb*w_L}VB7oH4 z@Q>hR1No53g2S?6!Pwdv^Wm!ZOp!8%@nC$_{=$}y($mT{njoA?@0Ff-dVD0cf+8-v z%M62c{?U10RckLt%+8c&UE+y*a4SHZd?XRNoLh80IpD^Ut8r?rBiJ!mOz3#WrbKxE@$G2A@!_aexhwI3$4t3IMRbyL-lZ?UoXZS=Fg$U;wD>LdUi_D2GfNGi4#PYb zFZd?gWIoCmZfgQfEb_A|z_V`_Z3L7N)SDe+rfKw)t2YDl*Wqiv$mir^P=llr(uZ#U zy0jRgXqs-f+%z^*Bfap0Nn>jXKY6kqX1+ruo)iyeam?B2g@u%ERDS0#bfYBa!>F|=N3 zdFPJi>=1_jr%tp3?Qq}>!0Rq8GBi?qwVSP8D@=X=5dW>3mun;!5yNwH$%ZrQrw(iZ z&P~M6?O}C_Y&M^w?Kd49vh&H3Xn|HekkXtizZDlqVH|U)%AZYQ^Ag9AL?J?{%4P7E z9BT27+}rQ6MI6pF0+olRsF+xedEZQGZzjNcX6AaRTLuu|D+^~Uh*}CfDopa)PYlh5 z@k$QF%6-F0N=`0()Y=;mDL|mFZ8aIu&Mks^ip*$^iB2}UZb*8#`J|UUKM1jvClXDv zvIG`c9xD4FDJ$8bOsTBEpfv6k&<2M^mwk8-;FK`#m8w7F*qmt@Uy(<;l#F-|~E>b!l1uDmf(vN?nr2Jy}E56VC2#k@L>ITMQ+2VP&$p z!{^cy`yZ5HfJX21WM($M!DhcWzuX5X4t+4oG|T|O zXAql;G%Sze=T^GtsMzgH={)|94Yqk+>@9lUX?IZ9+=W)nVKb)ys5>kMwf2k-&97y@ zbZVu@mv=V`xwIN`>6tc*YcR|0(O0k^Iofo#B*DSKqjjs=*yY8VuATQJn{SS5j0wuM zYG;Z!8DBl20C%3Aq8^@xXxL)KCXvvuqe1&fy)-+2IXZu!e_DatI;ne%-7h))W4A_S zBPp=C+Sq(-omAX0BaCt)R$sYD=-V>S+Sid^)S3$qO{^SN{byty9UV5t9o#T+%K)5n z!P>}b@!X8tGpZS>ljxX zC~z&L$>}(7vfOe^SH!KJH!QMF_uz~UH=7278IJJ82z&xJu61`Y?dgeZO zDJ%3&C=^y9dAVWa!`myDT?IqiE3|4C8yOE;>X$OHVcf>1agtu@R?XL_@>nr<-#Z<1 z1*cV+F7wSw3;AC6l-Y@M7i3teEW>J1e~=W}vOJpTh`3U%IH~SW>w8#Dxx}QCcl_zL z+6E!jY-E0Yx+uKwE55S-;_0}^H=MWtgs4Zmos2Hwps4xnmW{*nanwWjhh%#-;qOGI z-UL&>@@8vGqH|lMYP3rtaO)4a3FUrlBZ^7{ALf<>nI(rM7HthLI ze7=xL8ty!L^|rwSdl)DvGX`Io6=lvzA!p>7X$RHWjAY45(^Iczha^tBBSsPN!{&so znX*NvZ}Zq_xIqv>>8e=ki7=4V{w6Xw-w1es)EQKJcInX8)@HNY`1M;6pflY%(Wo1r z5i}fWLd0A(E!Q%9o>_QlZ6;x5Rhmri|5zBz*d0dHV`(pLWCCcpwFl~l+iIN1!O=@* zl3&;Jdp5{v^^v6$%VwU_hg3@)4>~0h`A8+?A5&6O`*a$e(9+mHrfmQrL{s;St|Q=K zk&;YJAnA;$4It)7PDugbhjfsNN>mz~^SjvC*y^X(2%J^jTFXg=NzMyApcbkZjov7~ zj{_h-{1A@w(KbI`%HpgzEfM#q*qr&+9>0K%g|nn1y1YT{e6yR(oJe#7MJt8 zA=UEl%~DcQop%*&eZOW`1%FZ;GhNmfF2&YEv3$9H4%#;_jF4t9<|;{eh6Q4yEij%z`W%O)XO;{0Q4x!>4$zI zdD?`i;mLPSiT65mvUtn?&e&gLuGd@tu+Kb9dg*LQ@|)joR-6W_M&f0D+n}`GQ1T zWq?HRFmzxG$g!%2Jc9eV0g37)D?^MR97$T+>BH@@)pdg<&rA2J+@5c}-86T}m~w+2 z|5TAS@SXpr+_2oGDB36yEks8J-Ok&YpP1|ZvJ~aK`U)Az^w1iWaQKZpb2nO_G^1^L z=f|DP7_0(7ctMV&eXW4R$I1$p>yxu-&N7vkm%n>xrj|R>=XYJO;9YG&)4^qi16b#} zVl>5b1JSa~u!fxh#nG|+x6b(wn*}MYM$Iqn9bu7~cW`ijSV#B3Qof6fPBq92`$KBJ zKG%C~wuc$^_VyaQ7#x~+x6W0-0QacM2*h>Na+~lZC;fM961xmp zK`aKXKb{OCE5IcN$Y*!wO1CBJYOLqO9RSSZiO0p7IXfQ++!@jN^{}v&0w`0Jj1`_Z zf_8z+H3$j~q~i1k)9>B)+^=y%E3-WE%xDLv%{iE!BAl5vj&Jc_v_x+D`s)RLkE^aI zC4iA=M0l~h;5wXs{NSvejTua7b&Fy)Qy96xRx;-h$!ysEd&LuG4QZxqHMkKzs|Aa- zBy;E0-H}!2>k2{jF2kqKpJzHE{^UuSrA|Ht42`Hf)Ybd@Lk{cazSv(BDv)RW@#GgV z;wvkIdA+l5SH?CJxze><)L7jXwqRRsz7OsmT)yz`4YeWEbF577UJ?A}~KnXXc7j3IUC*UJ@5-jH8{X#wxfv zis%C%k_!YF$bEiF5@psIMcX`CbAv~VxZdkuwnMTdz4Y3ZIF5%i9Vs786Vga#4#rm= zPDr*Ifumpk09;;+q{HoTmiyI+_DyDtbXP)hqCoivU+^%je6~UqNkSxSX|PX-OZ4Tm zOHrNG^!Dz?$eT(`tMXOdas7?x4Qq9-{Ac^ zL^jXBNfnfDTQ_A~4KtzNwLsJpI-SOJFfv83}IABMUR9E?ieSw6X0ZiKssk?mHeN8Iz)$x5sb9*q4 zd>uv`{&+hKP$mr%D7LS}RnyTm0;E*;skiS>PafOY*nuCS&kv3O*@5~E?LA&NNkC04 z|6$a4rqf2+)UE-ws#{^IXc&>b))BY zbeDgZJqJkqkpb;xor@MAJd$Vf){&V_=5lAQ`$nf%)YB`Y$>jdRB4ZeaMIS7MF?0y* z|DSS`h~m`V5PGu`70uO$FVZ_Rh0c8o&)i!&B=(|aIL=R7^OSYx4wwQ00(p~xwQUbh zRe$J57KTRwW?S8p{^E@#*;Rs}{xextvL+>BBnQZH{4R{IsQvHuu~rSo$JZMi?yWgX zM)rXA`g|dc@T*zbeZvn3w=TVY!*fmn0bLosNkX^nYv;4scZaum8i#umn=YGW$gEMP zlhyF`wC@{}FScuDAs_Clt!*{~9j_fq->(0~SVwg944FvR#bCW(#Pjn7XN%CTG2+sa z3*~&K3%L-S5!V8T;DsF$K+t4g%{ZRKv8$PRPxw3@Nudr z!LgOnKL3dY*K{nUmGbBdpu^gmFUwf2n5=VzZ`So&3JY!M91!)~G?vQesN8_5>9+@$(cV4K5f7cY%?>ni^XVFMxXYn7aEWA}y&$eY_NRLV7{ZrmbpW~_XJzJ-7>d& zdAnZ3UNWc0%{Fr3GM`8WN z{kvAjUUjK0Y;A3WBSU(w4`%@>4K1h58LZREN`-W5NNGHk3hZg?Wq$swrV&m!_BHp4 z$F5=8&M&uTmD1$~M2H7R@uX4wc%7pebR+=f=f$Mc@J+EVt-yOBJB{$_DlUCbVppm{ zpQ^tQe$SrqM&^H=DW=tNHzsOwvZ^o&Dl%qW=?zsjXZkjXP!a|fdt0oL7h5HxV5Dni zdpAd2vp)_`*!qg812r!tGi9250kXuzG{#NhgQ^L<=eoW@t7ZSG1Dz)#S2agKE)P`w$ele{vpG3dTEQ?Uc z%M@B^f%Xsdr|PhX8KF2p1eC&vfP$eLsAzs&JI|U4%A62WQNbQ-aMTth#?S3=9bG%i z7k4XN?XA31rco98;R^*^F)Fuk{w(oX4- z-KfLWg64}>@hd8fj#h7}FT4b~duHYRxQ$Uq^Nq`X1P(T5&?F`L2Xd>~uRi)fw@=d& zP&mv70I=~i-!u!*CZ0FqqE>{%>Xs979Naivw)`(_SSuYxd9m8KNbD>(7*0wm5PE%n zkUDT>!K%=`sasIy6?c&=9jRSBZ#q}+Y?dIy`sP1Mpnmue42WmehpZ_Mon+-}nk3_T zn=+z!gF;<81q4IIS9|bTycL}8Z0ehbMAp|A;Nu$80FABTO*l1`Vlih6`6p)2gZeiz z2SBMqH9a2_EH(MHI_h;Jgxfp-v6P?)4J!asPt%yDbW3l=0`6~P%r$gNNJlixNADDW?%Lwc zxR7S_kKXr4V>7N|vzPp{zxY=?%{iB*-GAx|Kf8@_yW@!D#`e3oc@HlFJZa3dZoPG+ zOOO7nwA7!9Fc}pN*M(ZE96-ZaKV6^AjpuP@c;db1aX4Lq&MX9^aG0YRfu?5D zHADB0*T*5m5N;jIPu5=uua1|y0DUJ3t#auXq>8z5xRicuGhS`&*??BAoXEJ=kj`qi zuWA*TQi*gwh8p`1>)g`g$%L=E+Iic)IoC%}Qev$Se-16rSkPY#+@7oQdiQX3P>ha! zL9uZkx=Ww=nusVpQ66y#cjsy@7BOddKM{0l@YHuowMfDnKn2_A(t!YwIKAc0!8+cK z9{@$>P#HLSMf*e5ER0yl()2hn#FvUle$Cmdjm@|b^E%|%>+aJuXYmLTuYnhipRuvW zgt;zFZfx3ZEAH2OIYS=(wDoRJv`FVJ(FRHPaUX%6oRcPM>%afWv!FfMJ?Oqf8&l-fJ#Xo`97FvO{4UGe|8{kvfGN4zc#1Pl&BFO) zil8KMR0v=J)=$JDJg^lhJmG~id6B3axGy49&j7$j+H~4%xKQ=H*St%ODy}~wW>`Kpt6)qH)~Kva_Ph zC?V^6F1O!5zxTi1@B2RQb6)3l*7NzGAx~WKl7@jHQ-FZPt{!i@{lW5eSqa~U_g=Cm zkp~e;eE0dtgF`}iWcSC4(V>ZI58%cZ(#pN*25%u)w;RvD9n_qqZ zNzwZsA4ts_U(kMcM}`0OUV*N|d*%vWdxMe}9(>D|b85$PTU%S7(%CR`pNFy<+LN#A z8HI9x=rzlqHaG2iXfCmt?E1fw>E*K&EcV>%sm zx80q(Jd*}VQ>9~D2lI_SA5~ijw!=g~LZ^*O`|*SS6(Qf)_|(oh?)=eGdFc;FKA9RM zzHUIuKTiaFzu$)|Dwa2Nu9?(!AM&|2j@*ebrV$6O>g~?~-n#zlbie3TMuo*)7gA4p zWqrd2yP_W3nGD^q9kl8x75|)b>$>A~quCF#UpzpvIpUuaQr`Nt%1PAVT51&LsCR{N zLup{8<+Iygvw)Wm-puF)DIrxx-S1NE@rW(h3gur z!0!p4(u+775f(GP27jL#uXKjrt#T}OY;vhqARw7b&X-;2*Xq8?KjQN>ecpl%EqH>b z{%WU5H|jMCaYI|kc5LwbcyV2OMTP%gXT*uP`_-D5xY5NrOP2dZ1{iga>HJiAv(bsRF#X?0zrL&yY;b(v3O)xnpW-0>0 zkA3TPsh)H#*Zry)9k6x~+|3P>@L3gE9=H!WjUnvDu%ih_LxKKV;U^wjkzG-Yyf0ac zZ{w>;Rz8XVD*>xN(*$S{kDMXRK1#5MA?S#d{k{HqbZv5#%I9tDoVoAG4YD zXZ>I>A_yq_?V8yZ$blgY7SA?YWZS>00Mlk8W~Z8Ve$`gl`_=s0>hAvc;fttfIx}15 zTl~}AzWWT#M}L(oAAP}{X>e}^avSMwBT9-qqc?>+-tO0jzqOPsZ1H_@*4oi2`d=hb!gNbS7;(+xM9HHzVNdK5x z=>2%V_Jt2gvgO21)w|-78q`n0NFQ5#VDg#&>F^ZyGw0%BnN`9^imB=?APgx0;(DD> zvlhE~-0vfAM1c?>FkUOsC1S3GheixYw!vhBfzPnGv!rF9{nA0TS+PD?#@WO;fF%gn zTzQ!6KoRFaB}?AP;`7xL~%u}&3}7?r~StFrrDs{tl9|YQ?K7h zcgL@cvYICZ4&sg#2d}rcFS@)~`|`;AWI^8`rr>TqKd=5fusslGYpsK5K0Xy%kQJ9b zi8(cnQi+#OvRPzKq(g@E@;a0C|Iy=u;CqX1}rNXmv_8qmALwtfZG+ zkoZ?`V`Gtcr;e3UtI+Dc#j$JbWK4)ij5H_OEMVcU##`qvlqQ^vVa-PD0UgPVP_2qVFnoW58ZB^8?&Q-s6x$gg2e+$wSk;quxQzdHwT3+=1iTh@?+VXl` znm}o~#&2J4+Th8I5&viR2P{q>L}2_-#imWqz(MRuuD~S%BwB_xQ%`#=5ccQ4!^6IStuv z)8n;$9l$X%APn!w`{aLMvR&tEQAhi9jyF& zL9d|It7bGTxyt~~M;{|K>Hts#acCM5(3GoV!e_rSCQ4THRC%-0uJKp;vn*KBH0H6TIfX%gWQW2kCN2oA#r5A$2Vp&vL(y94j%&xK3|= zp^TUnzsH<8vg;D8#B?k>_CqH$og3zge^SWiwYXj~;X^`a^&vFfM0&Hz0`F&Ef6#_7 zw`&0GQ$c2YfGyS_xFYFnH^9lx~hj|YhCPw_d@(5KdtF8SF8SaDt$X)mAb$Yt-x z%+`C_uj$|rzp+mY_k^3mWlk47_Wg#5vu_Ze^DnY;zk00?(PY?-7E*!<6ZsH2SRw zFp94QDh}T>GC>vHf$@BU{mpndKrVH%YF+p`s5v=G zr#f~$GZo==|DgbM0mrXUI03sF-H>?CK=2EEtDaW>@iHGynajU&hH{4K9<|(@X2+vZ zNSm$`+}TZbl2m?=d+>AiJLPzlhiC}dYBzL-(3u#BWA7Fr;8CUFdjT{l)%|A&Ow>nC z;o_~pAqwBMOsl&QVUR`l&Lf_XA~Ejp_xkgqwPefHtP-7?=v|%RyP^erCejGwlFd}@ zrn@!;-C=_(39Q`aQ(fP_f60BdbHIhM;FRYYyV2V*atr$(A2EHM2%Qc>k>}Y-OI|N1 zVtG*Wl&IXXkZ2B_?f1)3YS9m4`vJD&_dEJ){B#pE5t~(f%RWl7J0$ei-|8QxA=T6> zYO~)utv&cYn;kUde+Jy>(NR2{U3ukI{^Ye?V!ds* zQRR?nJbc^xjSgN+QSTWlXOoSWm(k-&mF|D>r>qW1gYqwjvd;qI;lqchaN%?ta&r_1 zL(Vv37RBhHGfFaidFX&0)^<%Jq!Fp^$Ry@88w~_5FvDV`_m#yBsqv~qEs-b1GO)Jx z*V4?Gwt;ni_`1CCcCfkZiRsMbsF2%V>xK_uh+FFFg}OCEq-EqBEgTFBPQ<#Pm0ok% zXQ8FIw9-tCa}KE~F;|=$pb%v|9{vNoQiUv1-$Jkd^j%yzD`O?DibB`1g*c z?=3aLm5&^MKw~-Qj0;yY%)v3}KS1XSHs-qp++c&TSpqDA`UCPHImBC!lg!m-tJpla z`>_v8#ptdHc`dmiu3>e5{R=ZtP1X;Bk^%>isC@WhPA%^5zATDn;k|UrDWt1#1svms z14hRIP{A%oOU4>jCSZbk=-cDQ!OhLL4Uur=NvDG+44gm+A*Y5$(r^dx;W(1h8m9t-Y%N)uI@a!pfgb!O5MQC(U_Q50n!Vb#C;SqW}#n zDG$ej^Vj6^Jcda8MLMb72eT-+UQUKs!-a(6Ca@R~0n3v%&Xg{FenaBXcLrlXJ%5wx znyn6M|9#BZ>tWFU0B{dFvfo5Ul0MKo$F$VpE^bWiJ8fEOSRL+dL_1EDgY$?TQWce6 z)ioUwf6-1#^AdI9`76-g2j<64*oSrt{tam*+jbh=nw`Kh$sm z4%QPFTixBdQPObU!z`-vW@SbxEe*DO{47!(uq6NxC!hT^mpqJVk_)A4lE4e7q5Py~ zwo1kI^E&SFydv%-f5*Krr_5=p8XO%hF$mw#x6wg)zn8eS@`WY~Kwb19y=yjlC|C+6 zZG&TOqaQyQ_I>{HYgoOKxz7rw>6lkAP*GEly8qsvpb-yzD-3@zsMt-(tSfi^7Njyb zfQ-1YQuwjb5D24nfVsvNV92!fCgqua=8rj8S7f(l^IvJf7aW=vI>%gm@x62wvi{+QEldAOahf$tbk0ii!?&^$<;)D9R z3Xp!rk^%w(Y1dS+oU7?iASNhTSxc5bmE}m_yiQbMQ^$1~8fvDc9hJr2)6sBGArnd`ZkV))PD;2ykfXUPH<@sF$4W4 zMCXA;SqA}hk502i6kGsG24advwpHsCskzyvr_+D1IIX1%7?O}jBLUpr(@+9|S^v60 zU7*NpY&rw?uoO0!D^-~@{hAkT*UJSQmnzVTBv3d1qeIm2LHT)`C}z=@IUAM@ETZ9L zP%8_9Qi@B`ADFp^lWt*(#;drh3H{gmHma>6cBZwcB zB4+6%*n&^U0sImdt*`Cf)AsBj8m=vz+AJ9V)$XSD_Kg2`+s!zm z>}pF6j|!=O7|VDtgJ?}693(! z$&z4!(s#=<`r?($af^4oXZ9tSbv(Y%+Mg8N|DiDkFylo1jQ%z6ZOh|pXGE;F{+wOu zX|U~pjJMzlywA^^oR$`izDzfCPW6P9ilONDrb+#2X^?$&}xsDFQR;*7P7{6?00M@L< ztI~^^*w#iDCD*C1$EFcME4;X{FnaqRs|iU^_K|MQiMFG@DHH&ZTAwk2fdU{F30iro z4y}fU##6AN*kfSn=cL5kqXW_|DPjL|p)(`M_r&HI*^A{i{UJR)MEi$_QV%S#fx@y3 z!VeW5t}~^hN7Kgyal3ePb+U)xjK8bq4DSnni@ohPQCS+@ntdV;ahc{R>+6n(FKM3h zUunl#$JhQmR3;-Mqk20yJw4ruOZohPB^;dayu5SV+>u1!699(^7QX<;2L^QfQhQ&+`giKNW1ekB~BoI{A$WS06AyLxSCOg!^#z7AOCnqPnfWWZ_#ai)eE2W<4FtV+Dv7TV9ry96PTEJ z^de=^&sR}?zy%*aPqh`>$6c?0xr*wA;65@I1*Sl;civ}#q0C72zQQD>f6@j6N$hp<&>|PQ)qe~dNBvqWM z26G!1l*-vlK_b53dG^o=h;IF*4GkvSs<8?|?3h5GCq+ampLO1Fp7y7i<@v~j zQcqtH=`UUY7geaqzfqm_bqk6l6ui^HQi;!} zXfeQa6PMv%?T&V&NZq`t)SLF{^6Of1bE-g)@hCia5Gg=M#u9I1TO}IRk=_y4=+G%S*QK8KDcB74 zyCj9Wx3{-%jO@yD>inD;DBZ_?BdpNdEOvp-SWJdsP6`^RO1ovPhk8Q0Fu%4|u!Vm< zu=F^g0$&iRqe7$B)^~HpGFRq<8^w^@0E_+V<-4~@72gogo;@QXCRY5jKC$}>n`Y`N zD=VL>n!`9bJIC}=@dXt?+Ca`%HOe5jkqtxgP!~?m!~VLnFr)C`>!`*;M|b!$p$Dp} z@2Fk_oLJ4SyAU)>APD-kSo((

tgFg`d&+B*=`S6%tZX?dPKC z&W3ji>gf$T&J3}kMk0D48Gy-U_IvQ-#$iuZYZ7FgrFD z0A;*;Ug!xv9?Y2uRV)ShXPFT)Yv^l4J)ozf%DV{=;Auv{nxaYiPBwQ5N?i9~E)(ql z`Vzo&{P~NT^*BKeOJvMv$EDcY%;qzb0LZZ1BjfICOj@o?tzV#Jm3X$%H2NJyKrlxp zMR{n<$VuW7mG13!(8Yz~kZkMVUsLQN2%a$-v*_m6!8_%w9qFvTzCTw8pM{Y=wY`mY`!teoB~au3JxHEd z3e=VoWQOC8qdhc%;pkzmnb&xwM6C*7IQ95rjkpv<>O#7Y>%OZBc;z zOd;n3(Q2@!<7!X;7V4Qe$Be*SGdZ9Y98(cL1kPOTK95QWjjdMnh(&DME%1nV;B$x= zFIGJU0d=$}BX)Y6|DrF+UA}SSEF60XYAic&DI!KMLl1Le$XWl9{D}h{Kyo_Oba`}2 Z=%3!;YM-sA4gMtoq@tv$Sgc_F{C@x+IWzzO diff --git a/images/documentation green button.png b/images/documentation green button.png index ac988e5a103ea8cbba6c9b69c07bf316d66a209c..9bbaa0018d59e00e525f81bbcebefcbe2ff08e41 100644 GIT binary patch literal 13314 zcmY+rbzD@>7x2G`)GDPS0s@ODARv6`?(SSVrCaIlQd+vZy9K1BrKP)@rIud!-SzwY zp4aR7L)?4k+%q%hoS8Xy=6$~@%1dB_iNPQc2wO^0R2c+9g#f<~Fwud(F^y;bz<*d@ zBsCpCAO=e0KNQz|0cQ}1rA|szNYyp%XvxPKdgb+aiu+aW?MsZ8m_)%Kr4nI!&EZfM zFE*1;N2CH!SAibBnIAR~!$c_CDAkP}X4qv7Oq|oAYO*GyC0?xqU5;o|x72ha}PE z1K(1x@fISOQi;hIR#8A8-_2L@ksQJUQbvE2ym)z;_i_H){qKq7PIs?vL?dniKC8RC z`yaR$VvqDa2qYNU$|GR*`t|DxFqQjV@$yS)?hw!quhrRQOp=9M`S_ab9G4sW+Fw`h z4!R0adj~C@H(Ic>135d`Ss5-V&@Q|Rz1GhadTui}uHFx%=k3p)Z4XYl3{TOiuLs8$ ziwBANZPNI?=Xo0aN>2VSI*E{xdR&KLK<{?~RQXxOs$G4iu_jc&KSjPxL$wiE_B}dn zyd-Q%vx4?T_>!t@LSRhDUSMRk`0kj8K9~?pGIO=G>RASQ0(5gk1(NJzHu8(-G4iGK zD`nwuj;?-A!#uvH(a%Lfu-_u+Z1ZXWb3{9UDI5}4B40>iQrbX#fB(m&RGV$2P+D1< z^L0Zmz|_DX8jJxL!q4J+f^h$#_0lhd8lU;#G)hp+T8vWA3sFJPw`s|Wj?-c_KGOXq z#Z`?a%lbVdHd>$w$|;$dEQt&woPMIM@A>&CSJWWcetd6Ge)nyP+IUbp9-fvuKF6sr zwIl#4=qX}Wt{i;|6;~y=xjgAFN|{{~0-YwM6@C12XmvPV9oW^oS~6w2wYq=&_AL;q z_FKwcy?+@;uHoV4nK1~!>EQR~5MO$1vdk;_TIG5Xzm09S#+pZDbbG2#HGg@)rjD*F z`fe^gO^Ep}jFw#R-ao{h$5xZa*!Jz4ykw-#7#h!CeA*m#8L75Ybj)IS#a}?D&&X0t zozC~`O;@SP>z)BZ?^*8DmUNQ1W-Q&ORpSHtYreB53e3>DF4j1c%54DxlJQUaQ+Gyg z(PA)4r_1z`LCjoADk?WBy>HN>sr&(Bf|}ooMiLv55s?u=C*AixmG)O`rC7qN8vBgQ z5vKnnxGj&*%98n6rb;9>_j>=9DZ?t-%AR0cf<4$FILT2q!&`}Jj(Xn-$tG&D5+BQzV~DmAT7N`M;>xj-3p zLCI-Fe2Yo;Q)TYvDN|#?!-pHl5wdtp$?WAmxInIKCp$3lw`@W~ZMy_xvK**R(ceN- zVn`KRQ*Bxg_h_Tq7GYYT4Lp;j2n>=xb1W(&{O?Q-fntAx3RU=<+Q-6Wai#OhW$2*Au#WjbUbdzlfIOC zk?rj%s}>IfKtd3m;ZGXN&ZwM6DFyE9uhMF3Px?1Sy1D zRxQIN$Y(Ux^t#W-G4e2v(1(j-4tVKH9-|`brqkgw>kcU) zC1GD)vu3~q1XZUNw=^AY|5h$~QNYFZL)8Wc%T2^A+0`@qg5_MQa=8E*gV!#K0$yk8 z%Wcs*9ECgVzOwRv>#A3~FCCz~syA6HsDR8hHdIg*OG)ha*4|poxP&auC%P_abxU?~ zt(C=Nq=0YVMe;{G2X_YbeyxP7lWcJZwlw5@%z|D=wxS)bK>8tv>o@aNb7gOJmX-p5 zIROOT1jdYP=CtYF&2x$-EJz?Oa5L+k;yocs;0fSGkSb-MBcCrGKk(CcKQOui9j^;% zP{ndQd)>sV8;B=x0V0}sqitl9$QM!V>O>1!CLO^d2kr{?(NXBmF|}?GL=SwMPvY@3 z&&2)raP+5$Cbmmww+be9MmscP`yA&)rfurpBq6U6oE_wY>MpXCBu4zKyv**u98my) zg0a(PY;pu0`k#V@m6_sFWD~}|oWb=|fLZVu&;AaW9+nd=!D_WFHKJF?`(~2H&x0Aa^R&|GMSPOm5{%OlOc_`Exr<>(vS^9dX>gl zK(cilmpT3l-0#5d`FxR8@*1fTybcVHbSBSkgV!q6%Gi+Dm-QhLObe+dX>j>x$awVi z*J$*v^`M=;?0qBPqf+%trLwM|ijEKIZkkYFNN!&g>zgnW95j~|=;8nK{AXef?hFMd zS~Xgfym5-rzjT0T)-RRn%gxVVHKW)cGd6G|^KR2x`!56HR6rRBy!$V%GVB$4n!Q|& zRbee!C^x_Uxe)VTY)Anycocq0f=*)ecnlS!qPBElBOWD%Eir#~_egB?kVR^-U*Dgi z+iurS{qmSdJQ3wm`s6GQv6@gX^1m=O1|)fm5NbqOxyT@CSXy#z`;Lu)w41V4y?c2h z#nJ#udWA1*;(D{wlFczHGU65A@$vDEB&}>UMWRRdzR(%bYH1xxoOHzj%HkFWJEulw z+YKEiOx$AC1XGq^B8NBshC$cZMD^ni&kMoDDcny3TUrUoiC^#=oRRdAy2Sr|u`g@v z$S13r57%FT`yjEc0Z`^BtFIygc~w&0K1?gQ2*#ZH7jf&h7P;UTT>qzV%$DH2JeqMP zV%3zL^eG@sd$gUOoRv(Vj0K5E$AL}sY2CT37IZ!hLHaI>J`PLg&VP}>$>pMmAX;G# z7g(<1Hvc(3E}WW#l|@AR-+*b0;&Xm>NrF-2jcmbx^6ZM@=ChOiI5z5nmp>czU38JX z@&zC4?R{nTAIe~TB3T<}f1aWpOGbh$cyVSNs8COU^o!APzKe%Ps@y-n8pPrA%AC=P zysz**tRa71p{1<#Pm!8tb~1&Q=Jr((kXjK z1em$p7r~OXj`oyy|C)xmI`F)0vZ^AC6=7*%#)FinUmJMd@)<3<_kxbP-rPk*T?Gqy zTc=yIZl8lEH;Ro}Y!gsn%-qo%AUSt)ZkO_sT92(zKAnDZ3m6$$YzofiT-XPE`~nN~ z$z{fHx;p%)ub#-KbDPNj;9v)6MyL^m&$^UDn z+H{zBhnwAYzV4bo=m1dIp*)B~Xgbow(&HytY5=5V4+=0%1o$gz2VLdgKi|~#orHZk ztgrWAFb;jsbvk)P^S%|nhsKyvvgVO;?U3Py78tvBce(D!51zQgus^ zqqxg?d7jAwi$za7CG<9axK?;zJ!N{!b6KmQQemx8(^rOP4}*DiSTC^e2fhT1@ILqX z*S+;{gkuYnDX%qH&Eb{+L5@k%LB}at?ih#`TD^4jp+a<*b3Xff#PaPOZVD;SW5?m_ zsggesK7vmM@hU(ybkZOt>90Wb_g!6A?Ji?j6c*B2Xyd1O`2OB15pK)BT(4I!-vO0j zxiX8gXxAO009kpD&X~Fd6%FnvYP-SG+Yky8Gl0r+c%|==R&85S3>TJuo>~ zEF}fGjGD{0J;<=QxJ`Sz1GDpPoIYA!vZ9(I!guKUIx1~YaC>I5$e%{he5x$VAS=FX zqRjicvJ4*gQqWOHRRpNJ>!ZxiC;iS>mKw{TGod@7$L}PRI;)b+f%E+;xIr5}Hj^GBa4B``X^5vuQ_Di zm2o+m4}2EHNw>b4Zp6V8R!ru{b3w~%+JGR)t5_wY_Ln^bR#i#5oQY=aTUPFS+Y7!p zuJuipXk|aPT7V9ccpdgc5TJty+tj zYg}M@)Zrk(@uK~4TF+40-*=aYrkBFLFRuJ(tT<6No7GS@Z`(+?y*&GiX$YQRZ$d2; zW1Tgwt5#ONS;&I94ISSa8C@m&T=yYNt*;Q-a@$~f&59>#qF^iq{u^km!w$|)4_o=k zIPL20VRkDSh~|e`CL(dHSo26N!td9q@psedpA}G4_Z952i-4XJd^G|^l?H!_MM3-z zZ|f*+`;|@<@ov^%>SJM3^m%8rQ{C8(hi#3dlYbpKbo!3{F7x4nY{v-H-_k?&^CXs~ zvh`9+A`)Zwl|q5JX@nIm1eoCq8eQD_aGv+1d*`EgPav3H;pM2x{P@x(+U5Ili@n(A zX>YOn;lh=oDM8eK+}hXGQA?vlK-k$!CkxNzn4sm2`|=k>Rl;&_{mdsT8*Exy%7<`M zYx1d_+d0~4gO)g}(m(1g9OJaHg*p`U-! zZgAXm^_90b3F{Q!HfPV~$;8CotqM4-+EdrsD-gBYvq5`<0MXIV7ynekX?#UCa(8EpPn>rk?H z&ZgwQMI7BD0Phm?6^ zV@=~ZWXeZ%9vwP32Fq|>2YrB-xyuCe)^WV)dVs3DUk@KP)gkj;N_2IFYT$j z64xF!RhrzCY!)@=XtTN04Pst)I!x#=>wo^t`(R= z(dZ#%x7oE1CgiRM?7?zOVYO05F&|w;EjZOBuh(!hM~(aJ(}`58#Go*e#IUBQ3csf|95EXfKKV{lO{iuoAewSUv@13kiF zX;ZYkiHZ>j0F|&3Uc?~S%35E?uXJ(f)Uqd`it3~&8}i9;rVx*noqf6EGL zzoyH*s{wWtMjLZ2bLiW(FVP)kRI0jC{tW4$DV<=Zy62n1B*?w~IHnvuJ4MI+#Nl>* z;=?(7!0Pw}6pfn^&g7cjf`Z_77o=sh7PLuhE&pD%XG*R2$qs~-+M9>cmJo3`EvOI0 z(`_VP!6E}1n@DYB?H$GAdjVe>iw_X?4#X~+T(--7K6IK8Q@}{db+$1kSKr*USnl83 z*yfZ)*O#?FmdrA_T|XmFpS*9vp&8zM@Reh3AqyL_BrXACI+$r(re|hY;?R24;UTcc zeYhRxX2S71EhD3C`zm!>_*t`^BPnteQ;>^@<=^Q>Nn9D}U)3j^$RAYW8hljf{qh8J zOclQ6(%PlgRpSLQDFuJ@d#DmvY zdQDv&fX(!{ZRJYCYC3aC&HI){dxF(<72>>%SmQ^Q6)YxdhQa(_6NKvN+Jb`Y#=T;V zxu8qbm)u=s5|>OD9jLf@{4~=AIo=PqmEy)ytoJz7zDn z{rqZv@U>u(LqPu;0@X{T=5oytlnhaA-N zVqBtfPwI?Bwxkc}zPA`eYxf0+kPHQx)e+ZiE^QG4<%_f921AsrFkoa&j< zJ{sk7|1jIxAxB}nGZJ-8)^bd~)KJ7TeMeg8t(Q1CK=8+L!SS(<<>x{pEW3lHo;b_v z&}g7i2alIk+A6)dG@-5>tYep2VHi5k2jzmzX_tcDc06ezb74 zQ;aS6I$%YDdtxPb3@BUHi@cMq!iHMthAbsYTq#i}wlNTU2;>tGJGz0Bn@3B(oaGZN z*|zspr#mNad*vR0-Q|n-VcD{W;(@+gr~Agcg1q1Cyf^fRS?)5yY0LQ~{m8_!8si-N z_O|JiFypE`Z}$-nuY5oxzJO|X6{N?PM>w^L~-D^{%M-EfB%tNSu;N^ruZ zgXtKe?4`le=yfZG?t}Svqyz->z8P7MfE{_vBT4Tx^I%ZHZzL}+5K1Cp{#`70j|0C6 zwwx0!M1FF-Z9A2|>PQ}&H@7f=E#cnya z6b+w2bMHP3MMuM7Y@>glZAe^6Xk+MO&u_BW0?(f8<;1LLr2_GbEJFMim^e`nk;d!?V{Nuk zOR)A|yh+P>d98cfu#|kKLoM*koj$|G z)wRo{+*heeq^3FvCCpxlQEMa^}G_!M5KyxYKhW^&tVS**+PNrJR+ z{__7{a0)Chl1Sg2z|N&hiFAi|gq)A&r!Jkcc;eW$8F-?|6V`fi&UZ#JymbQ(ej7lZ{&MSo6S?Z$_FSsjyqKK~1ar&k)FEm7?Fk=#5$JOsC1T4~+#S(JxEs|(F z%oxm#e47SK8KRN|;bFUXt0`F~y35}u66oqEPbV=-=nV|Q4h*kiYzvPm(a6f>U$Ga> z4C-=U(qqhVZv)AqlccTZGc&^Xb;E?R@ zp+O@yLU7yP+yv>Y6vAdEY7AM6hAp?KNyA2__pfvBA6RE+1gQrgpTA1nnqS4BFK|~> z!KM&Dw&IBIJifmGIX&*RNim=N1t~Xj3@SG_!w6_E5Qgm-*h%9l$2@#gKG)ql>31x< z-ZL{7d?C1x5_uK{+)ZP93ppES9?#s<%JkcR7AnkY$Gw#0{x&{>-f+a8SqqbJ!xLQP zd^GKUAa_A$6ianBa-Q{VTZ%7Sf4J|BAVF>C=Wv;e6Pkr+FdCb@tZPd2=!54mdJ_K) z#NIu!l(Lx2l14508BgcYz$TA5-oZVP?26EtT@|pF7FPzFNEL+t*2NxJ&Xn@OU3zXV zX40KQ7Wk>vP%>%OSTNf?(YOd)-FZ- z)fzu-aA0S%6#FQZ6n5va`?m{AEc;Ft8s+?83%|p@yD3?Q3HfjwvF3)bWn!>(=DK1+ zLRld&#{j2U_=hFN_j{v_wHV+ty2C%G4~WM!t(7na>O*Uflu2$@bDOJKwlPc+;{*5k z^k zG-bGy76k8$CW==iroHTU>7QUS7yG`~tl^L!6>IT>44ei9y)J?Dyl`%i3uvnwLJ${W z=$fYRfD75wwT4@SCMKSmT>R;}hM#`nSlvD-?T>8;f|7iwDZy-PgX zG58qYdyze};y0^rw5RZe{CE#oRxN10;plh_6jMi=neU+|+P0YCsuO?&_lsk7Rj-T*1Zn7|nv7Y;JEbV1T z5o@8b_s^0nh!Rgs2qvFHrekw#!i3y9@M?$mQRi@$$nN8kb5tof6+bwgi+&P9y^F>? zRBK}x5hv7HM8Z9HLBv{4SsB%;=Fw?PVNIKMStEFB?k?Xz;UNIa96$3Z(70PN_2Hc~&uzm_rVDw6y`9HZqTul?Qk8x_qVJu5HDgatVrWSwh~_(ulNS^zTN9+iY8MVG0kS z9QIrcxpuJjQ`8=KhAla$8TPkWrPx+@_Kdk<*`n?Gw|YuTv{mzuF5f2-Ep(>e3ZQ#( zrEYV&6ZQ6q4DBkz8xDz#iQ8prW65-Inm9ME-@MP+SxNnxc0gyg)%wS!p8|qy#Boau z0@*S{$|FNQV?;M2Hi1n`+#WXPd&21Hw;d4ows7=Vd~3AgF-0%QB`~xKj^DNT`^ri-`D*x zejJ6%pS#t&GWRm>qM+b;5EQYx9NMbS57lmGW2KSdgT%6F#m1!Q+V>?D&zmw(lY_Nv zhoM!*-Vf==WZ3q_^sU&Mutep82ypjh=UA4&F*i(8@x~iS&bEOK2=g z!Z@pigEB+!lC$)%+f6UB_SA)jk7%eAdas9>f1S0{_h?IzaM+fK+KEixs+au-O%DDr z%74eGyYhBK?XxxB9FVZ}^Ss0u{xssAU#T_x_=f8s#J2QoqDE4@lF)m!xV+#9oh?(s z4Iy;u${hSsFhy=xyL!%nNe{Ts&k&~mfC;xoWo`}on}aCX$bR^(@-T;KVy z-F>Np=gQ-9=i*y!vZJLIj*|oTQ^l=p?Y0NFStXXBd(7QM;T5Nyq0oEtl*w$75M`c` z=|q7HS0ZBwwh)0lt)pZM;csmwTr2)U+zL-#qTGiJU|(`0_9fd+ZK-;KV-adKE##IT z`;cv{QO_-ZS_dIrDrwVtJ`(vUqV&re{m|Wh>Bz-L*wNVIM|z8>XquMXOjjr7lLM0l zBT=(jRdn1G%Y30W;eOx^b}N!B6^4Op7VT-?bW{b^|WvwkiTiOh8$qvp`|XIX_gs!D3S zQOp|Co&{+Wpt)S11p68FU0l{~KYonfZDwqbh z`@Jq8%TjsW4VUp#F`aOy4=#5Ov`*)8D9DvLyM=N%GRshx`paAHJ$)_%ONga2;$*3` z265Sj&mAL^#T>uJWqeZ}!VEb87X#=$h)n*4LO;FQRI^J!ix6(G703Qe=eY?*?$!P}6f_(S=yB*?O4D z`;2DKF>0{m(x3Zq;}cw@ar3oud?9j4866smXNp{aR)x3VdmY<1l(s`MyGEAV&(4PY z^k+u4Eo%IFVV{nAud9|;k5p?QU^$aKA;~zuP(8<-z<@l*Y5Kt}It||2U85KV7J40X zcg-=KElx)+L%NV4_!1~x%TilNlOj*|mL#X}y@wE=O^IMWocHw>=Y3?)CH5^}NXVz1 zu=O+Ju#YYvuDx0n3fj*H>D_+%xK>n*w->opx+8u1*Gk#~`i>>mqI0RjX7kR+_mU-y z&JFw7`$BPFa*ZP9JBsXmW}oR1Q;2p_mKo}sJtVpN%8wg;I<(XBQj;RTyVXWq_rYMZ z9gX|IJ2sXs(|-qBJ-Mn({v}LCM%KICxOIM-D*Sg&W(>3<;-KgdI&rv^vg^7#Dt!y4xYWRjKPbP=4>I^zaO8L znE&PrxZKT+3SMSd$|yqV_t+i}E`&6D!xup5uS}X{e)P3H96P=9AC%akkws7Ms2UYZ z*Wl*cqg9h_r)5-V;GDMyPn#4NK!2dG8LEV`Vt+KJouGa=@#_l0LyPKr*mh{sS3h~< zvv#BUL}z@j=SX{n8}BAajM0(!=lwD4L0~6HVUp`!&39r|T)#H{2_n2pVoYaEjnQ4o zUD2^6M|Q3zprnc)XMDy6GwemiCG62GAzidjY%jhh3K8XX=)Ge%3#+c|YeIM^yqF$u zs{;FbyIfu+IpKX<;OU!a+1eg>tujn?0n7!(1K)`0455pW>Eupof#4iI*0$?FAC0fV z{UcG_Uc`Og54E!qd+Aw5GfeZ)pZ?~Iu~k!*b%A!8cLG}JCMuXpoT2AW3Oc0{BBG_b zL+*B*JPjwsSc@hMWbNFm|00`Eq09f+6#qB@q*#M+@eUQG*D!cyLC}4 zobyX%()pt;mErHKA?2N}vspTcF*`y{YNZo4*w4tp+Da))eaz5F!W7FR^4xAh4Rk3X95 zmSoTpWd0~W-t>}LDpP&pcc_{RECc7;{ZH>b6 z`b&X5LD|j+8(@!AuhwdYp>QR8(rTFQ-k8a3R{q_V)*I4XgnP7_%7FEk?=Se*7Zsou@-y1g0hXI^83}Bza!!Yb`m}!vgLbvm;>E|?)zw1!q+qc3I#veeOXh4 z(|YmPDa+WgOLAp)3!$zhQ9KX%9vvsxla5sf0S|DU)lZkR#Dr_$ICWvD7Ay023|L%FXyu-Ng=EWB{!%>?F*^7BYUOyfU(yG_xog&+*M*_Cm0e;miJOli*Ki-5mx8~r zf=nG}@p3Fw=5_x2h`k7v+e80EPzIT>9R;tUf_%RSAuQ-ywXq#grf}Oq6P|znj7-;Z zGrWo}AO~6+GpiDPHpT&vVlN=9CbDY*762q8>Tt5^;@O@s)%CWYP$BpyRSbiLa3gT2 z{8)Ge9MWuixh%)8t!0NE+P5&0Jv5G?!*~Ou-qRTs&$Be#wMie_3&4bh%TR}_gG6@Gl_ z9pyqm?^6653j(leNo`I~@pNRM*ii6dD}`2#IyCB+Dz8>`Us*>U-jAydG*A}iAwQ+} zE}|${hR|#=v%wnEatig`aQ?GhRH3&e?_QbwSGhqyaSCk4n*p1=?bqHB+vod9x+$c+ zlo-*yyq|V3D)gGVEH!|W%#-}Vkd=y^vkp|BzvCN1E;KAOJUtn`40j+L|XG;r9s(UI>`f5$Zl zJIYTs>_ER1^Ka<6U-_HYNT=1k=l;s-<>h2Cu&OQuvzx3 zGA=|_2)OjMOts3rjmdlR?thox-D@NEC2~N*1W25tsGy0xlw67qBJ*S9B6+M;9JmLH z>$sSx_Bq^_SO=|F_?sW;k6s=i?@NmtdC#){n4YN1!O{ zEyI-A;?VJQY=vjMB?zDsr~JmE|B*5+r}r_vvn!4*Pjc{>k8LFdhL#~nW!dR`EL%3b z3U!CJR492uP&{h<;WnttGEfG3HF`L4djEq+0RYW_*-qt{%P`|N(neVztv}|s!bWA8 z-%Y4Y0AMNejZwqFhF>cBaBzf6o)TOcy%HUoS2D>P+PG-X={d3{;gKhD_* zv^#zc_C{JBV#X>yqp@V-LQI0=oC}!3ez8TS*^15uC$bXoI4A`O2@sy3k$uFlE{^fkRm>hg#2Yy+nuIsWkYB;!sS%CsqZbz!j{Ez_ zMz9vm-Tyskcf9g?OHM|Fu$e?jRu|N%^ZUk%Pg)Pkp}4;JL}}3xJtNAC3NWU!Fe@pqh5~^2jPE zD7fH02lVvE0ALc5&in%meHcG^RMOi)8&C{@F_l0{f;n$*Z-)U&GYNnKm-vvZ2?Us| zTR+QZ-p40rW}Y8^S&o-Oe?~3{@MrAPm=poGIs|x7VO4x&FG`TeuF8!fT3+@tCiw4Ca4)WbiVO@P8!4l$8scCeg$OgRXxN#?$6{i-qQ%@Iy^scD5N?+!eiB;BC>oDf9=D|kWJ5}Ckp28_d0F24lAjkE zbt=Aokp=ny09>gliR;0BwU1A}QpaWQXlxhskBe_>z64ThNQYBwcmL zMRL=%8QMzUN*4bdQW0On`awpeHpM-WkwfHwgJ-f95b%{xZsD~m7?n*fRj+Vuzi>1f zgc_><{GM}x^1IfqUuD@s6AWoA)0MzOdS|E7i`*PnQTS{N~2y>HmcNnjUcozPOvE+m_WgBE$)ldLvbCMvge zhealXFX*2-C14V+1Yue(>5t&RPU-BNVl4-_HP!Gg@m2sV_by#7nWq51U8&G=a8rF6 zZQfD>vj~j&Fj;F|+27HTrHQ2d4-Q}>LcrjKsGOfWY)|wMvG8cyO)VG}YIcKJ$&lsmr#5{P#~NkJFhsm8QN_acwpL>jv8Q+kc+m%mIO0D&_wos>p1U$ z4 zBVcFA#IB%(0VpiEtGDIcK}e;99{%;MO<-hhVB`g!V2z!DI^K;zoZvb(75KxDM9%w19Y6iEC6#LvR<1i8s2k1cdJX(UBrv18AP!GzQ#1d$)R#9iNfg$WU zTku~7QWY%{PU&xW0vee#|wdl+3)MEkkNZK+%z8~<4PIpy8jQr5B3qKd3|G@T3Mc{TlD@zXWF?d{z7f)J3 z-f)0$yNv4W^~Fc^4~Sr&yhaeA%3iqt*-hFb1tE)kPnVr$*5uAdk&qGfK)(uM4dG8x zPiq|bsIh@h;9l7P#mSTOY%Q}{8YB>6S|+eU2Sf%Edj2*@7Uyw^R7x`lzfVG?7>smd zN=by6Mp01s8`CeUWRy1W-QRa)2jWR;qkqiG*5XA5mS7;JMFUIt{DwiEpaO~rr!uX< zGA(BI)D5FAbJniH!w7@hTXxzP`SFme*SszO?{6om7fC$pFZr(LZ%X4 zDB&`?vbwGcC>ligd>Ivt?jI2zKJi3XZ}DpMuQ2f}a5gI{X$Ci52@2}&Ri6ZOf@ncW zKk26@?%lu0`~l?$6wWg~aewlb4HW3ZPpaCXcp9j+g4(;UrvUl~A`q_1n_#q(Re5k`&hw|MIow>F@l=M={W= z%9JkFJ8jv+^%6=wH*=T!xIuRGVd`gH2vjJDi&7t^G@i6Mfvyo{n75Cpt7vFx%l z{nMP4>%=?h#9tm1i_r9oetNBi?<4g`KS7E`(_?KzP$xnhb8mU>ds9`_Z2U#jy1(kD zQWawqkF(Cn$yv>qh(x^tGXqV$>`DozCpbe;RJUOPMIb3RzUqltiIJ7v@>+PLFl1Y3 zCw`#!n?b!3lJKMkDBxw+HGj6&!vooB;ns*JaXMb$uVRwR!&KY ztyg?y0pU~yZ_h0RM+JNN!&CzE&Z4^h_`X84ZkG6#*COHK-?MmAtdEb6H^X9_KuMHT z`*>X`QO^mE9*-Ug8bnf_Tgdv(*%R6RS2Vp~>crmLx+mzr7twyCW^1*+dm26q+R`Cj zrU9{mzCG|riUWK1>7n{PZcX3j^tg2u`_>Q~1o>`;jMudr+qEsOAo<8BS-XW`5Hax* zuZRd{AR2+Ve8kG&yGNHIDe^rvHGFcC+tkcMJ!c&Yl#bWcfQU`I`XsGzz5yZW`Hzs8 zJ5wS*N-0z;gs8t~5D$1-S81-+to=d=qYWfg?(6p)hvV@GM<7~+Z5wC9TbsRk(sUK^x{(oDKpQ3zF*(_{-pI2_2n=bN1yjrayO~>@V;id0YEL>zA8@ zZROn8xHvr4euc;5;{{e!n96Jr@sT!EMxp0e=h07}J$HEh$Sv1Wt6|;j448?rv2w8% zDl>lggVKM}`@Uq`^GnVATWXQlP@Oyoi!n@H`Yy2e8zw-D71~D;kiNd<(a{mTPSx|G zf9J%e-b)i^8lf4-<`&Z&x}3Z^6d@grcFUHW9)6 z=9Rvy{>!e07q9855dmcq0432efwt#bWMVpG-jBcO`2O#(%F@!b!x;)wjrB`YxV6t; z)2=_N-aLX<0bNs{vaB}ctJkkZ*y;XhtI^(KJ+sX(gmfYqalIa85=A1_NACOvc^8`x zr+(#S(CFx@e+=azy}j8`)kR5j%zjsv^X4b7DNP@@wM9H6@}pK-=+9p43VSJKU0kx` z@Rw*wg7x+F)yZEI^Q%yS-t~Gfz{_BWzm<7Z)hVPyGCw@wmEZ11+4GJF|JFmkZ6GOT zOp>h*gX(}lpZWs!NQfE2?bEj{4PA$SI9N zG6x5TPWQLstN_!55j`T>>qiQ6uX}MooZjOs|Fo78)&B+EoLMN-fTTXwq97<``!`SD zf4kqm(w5*1HpL>N?v#JajRa7N@$9ewatOpTk|f-}`kY;WM?zvn{YN;vu;z705G5@j zW7Ln48G#Mq_zEkOOaBBm+SQ_znUEdZfPZaULO<;iG6~8rtZ@YKfao_Y7disbUh~hb zeYgL2aFO_o41d632&ZO%>;W8sML8a%Tv({kFfKBN3;F&XhY0dlu=MobV`Ho2vn5bK za{AhItD9{K&qmuOq#t!lHP`;*@ZVJ-+nm&~GCX5hElhioihgS9x^AH6(+^+j0R+^Q6BT`0(u0faV|2Rs6A1*b(DA1c*FLiIQz5tb=H;l#GwagI@{EkgQ zQPnm0@3qG?+ESe1m@{>p%9j{fAJi9EKrQE0kkniDu$N4`iB7K`jhgZ}UM*jdiiv4q z;u9vwjXumpxP#`=X{_$hg5no#%*&HhvLzjohWwd>WdAbIG_7-`Efkl|s8&weNp3o@ z2rygc%cR!t6IK}=sWP$*9sh~fsNI^!iby)x5hVRp3JXvT)8Dn3LKx|BT}P+{=UNM2 z|FJnY_vg>o!or;spT-s3VzaftCmT*TRX1|#Hsv752_D4Q#N<@*3H4uMQ5gbJX{?gF z5i9#lQ`Y)rMAr6>!X-d@Fw5pzz_0v6QP?VV96N*Diuskae&!O6&+`iB3lV0YziMA{ z<+N4}Qu^!rumdYkPtk4o@{svKC4fg5R^Ia`*h9)jdW?bYjYTCC--iZ58Q99BAmwL2DM^jM0Aivob zuZg!8^Y)^xd6~5-G&fiBKeY=(eN?-*^IaS#*yEA?!dHRtzii?TL~X(Z!PbbB4JGdHZoS8gi`yv}XhO8(^Lf1XXUkKA)5P0>7}%Q$BDzU9DQO+B?3h^lXsZ);W-|3+iV z>=SA$S+=ysusGUShNT^6d`&zn9`8lOnK6C$0lB3A$dVj=LomGKOq)8iY2X=cN!^BV z1?mF9#^Yh(kj|Jq79wjx7P-u@DK`ZCH@jAl+*CkB|o?&hMr)Zlsv+l5^fg zzZrKC5+*^|Ub940qLcdP`y#(Po6>}L9j7RTB>_ncyI&`~P>GiMPmaYHp76-OsDtOC zm?;wAv{i9@*V1QNA(%dF9A>P*Vu7VcrzD45cJUYKg!JAFt~(2`08U-0VM)f^Zx04f z#ScevaH!}2{j~^e{U}q~KE+3!>OsW=cuX58M_jiM^gpg;c=Ri}HtO?xp3c5O+VS7p z-=W6A#TBv<|3~Q=j*Dr265#-v!K15B);obNm$-+{S(`HO{}c1JDNkxO`bN|eysjs{ zixrH{d&BcoxqYd9?&e=O%FWD22QUa~^3di&6N)`-kxWYi*Zc_Q@8gtr)DnHG5V#ie zWvtKR2 zk&m&mU z_caYw5-?*RN%aAtU*Ijn9WNvu9LkGDh>Y)rjVH(xC+duRxa;pU7M)EHKa?88ACLk2 zA`L=(ZaC}@m6sMo?>ejs)GMETo+@0KIiW;F8fT4;jFfV9b!}PTBORXhe4?l3ru65^ zZe`;plg9!}rAYdvvu7Db3U4beja=OG^Iwl{_^X%OwLAcBi08Lpp=um9{R_T=blJ+3 zbN%{$l?$+Hw!7MgI1v?fT^gd8Ex0V7H>dYqr4MgVGtaZg1B=j@obKi2c8PWo8bC|J zlr1eSwQ7tbSMFMFuaQYbeLL8;B=J5AxkT}kM%CfcDNfa2LRo+7dsH?e0&w}ypLNZ; z?;U}QC|=-mN^Z*|5X9R`NHL9%XkQK3F8jIDa+}!tJj?*r=yo8InTe%B|J|B~Xn-ud zYw>LL0lYIExdbC68GzKvtlIN&_-uM}H|Db>u3Q!_rAn#|eWEpN1lAG_!C2?NfH0(z#AMh)YRrsZdj9)EdG^RiF#QLQ zel6EV;j2HPu{3Nmh%<+r!j6e?_3O8_GH%C{M9y#sR=B9ns;dI(qj@PcTiEDAZQNTo z-5_B&G+{RzX(8e4wOY(_ig(=;j|-IUJ^y1vu&zoQ>4p}nV3L& zpFE;b+U_TIJ@YVMWh4xMtUFJ|F)8Q3s015t(Vu!=lw0wo!l z_h=lXIkP0j|1k8xn9zz7h(<#KQK}~EEMLp__7yRqlYghEi1`e2y9cQau*BZ7u$TQN z9kbZmyodby3$1UCX(o&Nq?#D6|8#kv+DD=7weMis>xr~INJo1Uo$VQJO|={c7453* zFV#|j?G_`ZGQpu_jTZ!$X|(d`f#QK^S(+oZNFw-v5=vz@ro8DIv|Kw{|CYspUb|IwH8(tX8n3uI%@1G*F>IxXo|q%j0`ssp@;O$EmGFUb{3; zhKQWif)+98;TD3{O8W;Pf6| zHGBCQ71Lwn^K?OpFgbkeCB1jB%NBFaFlD(Cs$-%gq@Zvk@H6w6VgPLFi!4okyAnp*?#7AAgHA1z)H)Lr6Ny9y zSx^KzYw;t9LFze_Hf46=Pq$z+Jb9wW;zr_hX=?fnQdv(SF98h}^s0VHuxVu9SRxV; zWqVYqYzu{$k~Uq2M32nBRN`QltJeU)mxyJ zhn07&=>-4(fB|jnuZ+Psri1%e9y!bms__6?Vr%6iR1&$X$hs3r;-aX9x}rVlvaK~4 z$?%!I9^u)atw$4dgS7*eU-q!P^1%GT;5=-cUb6kx5)cI7i5NqK>3 zdKVpljJ1*p6D+e?z=XXyfHYFvVBLpDL^u)D#E$CM8}olC)*_!O)R1O@xoEuW!k!T8=@V@9$4eE& zUe$SBz&jIuZ(ya3mR_QpUUaed%epSY7 z!aC4kJ=gFOd{>RK;0Ev5WLfwq==y|CDSfQPFxQ^5IPbkhY4!U&)B@cL#>x6Zp7)70 z&u%6=#Wge%&WVd)B_mzf{R zS>o*?F2~|kRV=K*Gv7z4=j43ZPS%`PKTpI^y`y+`=<7>D^AAjc(@iA3T>j7xW?Y2A zVFX}4va>y_DKSLFAPHCR0=oM}i{g&;#3E7Yys($I#GiQVu8=cJwZqMrM1nsH!lxVn z=exLc>sr;6&rkfO2}M?R{>AFI3a<-t@1uUhvo~`G36GxEb+rOpk4SL&9s*UZ^D6(<7&; z|J+LYz8l~G!+fnxBnk0k@SHX4;hVic^JhN*UyFT2e!0u_0%j8~)08m!AmDS&41k>n zA6a?%BpP9RTTz!Q{jc;Dz54e(6ng;%(U_c7(1y|$v4h~on~jodUZ`*I&cV=h*iXE; z#ZbemIRThTlNRc=$RZMKp&I3S2<3|Ec+ZaH@V>ZS>mt%FDEIzyAakCI$CbOm#Wvhl zUm&ZPf+XMB!|^Dc--@+cDFq?8b7zVpid@h?CWp>=UvT1Zaru6GvRoL*NnLz=r@fD8 zq@&ZnA_hmb>5}l;&5%<;Q$l>38?)bC1b+j9+~ml>Nb7CT&Vi5Lndq&?@)``{^&+QR zewrLMzZf9W++gK4BQfNUh|FPh%+0J{{_|~5%-n%6ia0x&Qwwh=Dp*t%Hj{=g{N!Y|%7aP34HhX9jd9e6bgs(D{c&=(uWqg6 zrrdt4XMVKi<7~AR@AbLYlk~=m6K(g#B=kEVWKk}THDN%K`CeLDc6)+*y&T<6+7*R4 zTsxdgI~Vdg^@5^FqeY@I{~Y1c3ElfAK#O`ZJNWO)tUw2=!E>d-W#^+sCd-2B%8%;Y)b+vR^E;n%B`Z|O6LA_0v{i*XvJ~MFP z=Xmu6N|_vJZcr$Sq0db$G*juxpRWvD4p2m_m1t3)8JVnso83LTvCVe)ym{wL%gvFS zGx(BY)_QBJL?8IWbj}o_{^8km<_cC%ROYzn4%FA&v8`~le{17T+i7&QB?{rHN!|-g zu2T)q9U?&gIXEbf?%_%wgh>I5O$8-Vxs5JV9R#&LoIjlLO!k^@z;6UBgg@OM54p82 zL#ETKV;J#-#>Q)Uu}W!HdYsN3@#9(ezJ6z|gH3k_UCdSWT`s1`-FaQIH#i@J_f34F z8oj^tV$!MccwQuOcHsTHNw9?zd3DG^?bh}6P_%rnEwmnMb6B?kLy8KjTjL!+?Ud%h zI$$?aZqq}4>T!w!lxPetc|AnUeb_Y{E7KA(5WuOIaAfzL4Q$`mPUhyw@jcp38N@4( ztBVi}vPO|F^%Sh5a6ROlcK+=hf^zREomSDrugAfjr{O87g2%p!8Jzkz#f0gxyBJqO z=dcHEk$cl*Xl8hJtxXJtfgEKGa!HxB%J`iapRZs_ujIWzbs^FGJ6d0YuOECrFJuL; zJYj61miUuF$cc_i+q_r%YyrsY$4X4FYme{yCYIx#06RALdPg>7Z3e}W;VgD z#_I(RI`*+WxeOB=t3xQybGzg;RwBpNZqL1{yhaS1w-*Q4I%&>4H_jXgalgJ{%d1@u zckw4FWaK4n5WcO`Af)}?cXPQL!pmX18sR5;Q7K_KQ-Y1h2gt!5h#iOP3|;_uH$}0x zB>-_H&mt1oz^y-98yy(>p7<7wK}mRX)MnmQ3G!wwr}rJ0>|ch8w2t;ue2>za* z940HetFXaeFi26WhCkPb-ljT!3fAYnP8+{l@z8OSHllo}Q+P}?lsi+uwIX<(lcDbN zO9oh2>biGW$zC2m+OB!T(>lTnk5)(HMj{j#;!L zm!StM6CV+6nNjFyC|=#f#yMZwEHY2$mY}9K!M+@7 zF3#Ar;Q@=RJvw2#o<2Y|KOtb7>EC^a!$2as33ChZA;tp%Qhkmb19(zAvbh1~l_40a z_r8C)$a~9LCON$X=lDdnQah9ka z&*S?Ibc!=f-3#jiE{Yc?_~+=zVSZj%HZ+va^)`0~ZPq}3)1}{D(Jt)OM$Af+UCSHD zUSMeI;`9pzc->1NQwUJ~$*mgJyAO(WUF0$!wh;Cr;kE6qh%c%ZXNM5p4i0ElTO$BP z;4tNHadCc}d2*Hqd3w0HmtkzZDHcwm1r*rehiD2>|JNhUs}uDMVb#>{@z{bUtDH&s zJ>_*b1HQ27%;Vp;S;@|xwIx%x)!S4b1(W*#wH}oUcNJ36U*Oy0KDBE$>&)K%A^uJwc-P9mg*-J%s(WX(>b>R_zBJ4ev*{V7?_tEcio?O#2FO@-wQ{u=+>-Oj~pClN%}9vlE2e7y2n^4gy#5lcK?pgBF~G`l>N&S1C{j{X z?0Bge*B;5M7j1y$*2&g-A5}{y-*o^c-t$Q)6ZF_cNB3E=d@5mWjXni(y znv0zEKe|ALv!Gld?c`6t2RG8A5@Y((b(G`5*d>3Aqnd zs+ulrscC2$Fn&~9O-+*P3%IpWfNuk3)y&=1hZHw?SoB*^v1+VLELy)b4Ku~5y1Vwi zeZ+i!dbXfqtOWP(Uou%>T_x{B!Jvbov>Xgw_G};-(m_o0F4|a9;MflB0g(2UcWumD zH}eU>svf&mn>Msg=}YG*`He8Mqrqhai~03)ZxXXW)R!GDGx|Bg4Q}A)xOC0ob0-l5 zv@vJ#H3zeyDQ^l%AQ$^{ADV7=EhKJaB%DqQR)R8>d@(WX8pN!W2UA-KOItV~qxY4Y ztkO3%zg2RA%0D+FVVjiyFw893p3lR5A4d;ApVzE~tIy}Ws|{wiyQj1dD zJtMdVot*kX&Tdfv-_ql=`?+A%s6xVX`-^21Zeza(trZk-wLq3)fYoHFORH49TT3Nb z4Mm8yG+Tovb9d4;FTlTcdcB}Gnyb;O!NIBlgZ%NrW^gzaZAtqKPdnf|##nmJ?-^Fl zXI8=6WT-smaPQL1fF-ws^!ZVm`dOl@HOkgjpfC}9k+0N2QYuoq| z(OWBx*|lH-wI_kF(lncdZw^VW1)cdg0s^jS|K8;^wm(eUa8N+Nq=U!Se90``TGHC? zR&LjFR-$+IMT&yx^FG9*XDEr+yg}25Bl}2h=w^G%Npu}ca~p{ppo-(=|>QA^J#SL;aY7 z7WaYhhhK3IX@4{>xVs24eRK7D^TrfgUWFQ#SiSoO+AWHY)W zNmiC*yFDKgO0;s$+;3976}NoZF{TRDkFE*NN*eK6G~~QUE`g1 zF2>{OPsaBnbA{vTs=mRNjQQ6784hm5nXN)PhwcTtik(3|cLD``ZpvI3!l`63A9plQ zy&tZxR!fUN>_K1`O_qnzObz}1>J>u6t1x_p_9R|ICS~`%xt!%zxpBd%?e0Bv*hvpm zHzp?Q!0Ed=P_CM95c5R4ituszIud*fak%;I{`sw)#7(h5CI0Ft~v#>3F-yX-uh6&3)0MCb3D zaVDo7r;=RetuU;cnUfS1ZtP%XkRAlocjL!3-IOehJ(R!m7Ky0!tS(Ht9j2GK>3s@0 z0AKd4xk8$T6=4Sw(QvHx8R{RA-eCtyQ6?7hBR6ino7dJwDN)Vgn zirW)?dgZ|2Igbxnt)_PDi|@DT<2Y}V%FlU5XGrH>w@0m>8WFb~F9>66KIAqwzU4ZV z>`!-tnOYwohN)+IEp~73#W})9MDB78i7~RT^cAX)uB=4v2rsG|wnV2UdfjqYppBYX zndFsf!8Jj2t5`%rqxr3JGX`F7N=no^M@51$cd+bJdF$jU3wC%4ScdFUKSml?2p)=$v$Q zb@kR&(b4Ih?eRA|DF8TCA^bnjbiiB7VXOULG(&^l?uEwmAloyvM4c=whU7eUx*<64ch2*tE!u%`%$Bon8Y> z6#IHO7Ep1`X1BlndW4i6{?dhFx#jYhM8c|E=A|?^_KgAg&XW4Y`7zhrepdUZb(i1nGZI8i-$0?vPJggOp#t{2Y015g04+u$!uuyam)U&KK&xfdT!Z{2+B* zO`RlU&Zbs#+D7J78#*>#jCb$L&dw&qU2xDsJl6W`{ztzjf3+16Q;M>(8zEszwa*P} zW|Lwv_Xy|xdT8sG_fE`1cKS*QgyN7v@1Ug+TUg*lzNrhXx;^*>?WV=|l$0PB!v~;faD7(daB~L~M|VXu0N?+SMG*iC+PJ^~6S96(-D13u!W>SUHuNZP%nN&7HJ*2- zi8Rp57woh({PNNzfypZnZWBrw1F3ghH)+woW?auDDfpsOQe1wOj;8~7RO|}MTOAzv zjLO8Fs;7Lq?U>>*>#=!E7&a6X6u|->g z?X8Nx9b^9GD5ml>1 zJK?Y~&u!Z9lU7ARQBAy!!Jmh%K1@hy^i?t*HqEmwD0V;=^<#VO@WrMA?JRX0nH%_p z!E$z26H++Ffs;~rqmXUv_UmQ+L5e-CD_{D=KIGDgi*Q$*z*w0iQI+zhaz^WQFv`*O zOv|bZUlX7hU$Ub+S1cK0cl@66)pF6nT%Xlhl(|8Dn?${0vV4Gw+i1ZG26-)$@yEL5 zEby7;i<5Yur$=0ba=l;6w9%o8r^y-T~OE zxy8SDw9e{+d}%?WSb3VR^du2_KQ5vhqlchCYleK?oO`I!RChlzFu*1h=xVd@N{7)| z^`md8@70~%`sOAjt#pbwo-H81e{bebAI9JaGZro>=%QU(k05yblYv+##B+bfYNLKv|p@61}@kh1*ztC|!-6N%mkx13HpoXS-7``hecQ zNr9NuSdM%$XG85$y%pAhVl1mB;bn7wUtd=ZOi&1aHG33~#Re^m)fH=H$dr>`O*L$P zpz-C(IggkvtJex;Jo<*$X5b9^!3+RaJ`^Y$%+zf36E#+zE?tOHDqHtNt?ZqN?m=39 zrnZ??QJ>ZBMgFcOKoxpfTtB%&8bRI64wJMT$HU2pYil}MATN=x``!@m?)>@e zk=ksNM-g-+)O)~`lSgleVDBSCo*YRbrhwJ3c&^l;_tM8EWPhChIFUSH%t0|jwrm=~ zCzbGDfsV(P2hs+=u{Zy~Sw{ae&czn8@4B==!RP$cs`ZxG|9Kg1{xEmdh>a*gPf$|=KFFTAJTGN@$NWx-mnHw80=*ra{}HRH)c`XTAa{01z*``MAxS0bVI>2^lhyIH)i+o7fe5tMSC9Yv z*gD*p=?*@OXEwm|xjE%-g0e)C5Y7AkDRAKPIL5oRy!NWB5`}oau^K02U|_JVt?zmp z@F9Zq4l^p#z7fyFpG?I2DTZAmNvEL~qM&O-v*w!0FI5^0n}@E3gTsT?;FZ#u>Xnfp zUw$5>ZVX<%Qm+O66Vda91DvaO*2U$kuYxffe*gNZD?v6D!^ZP@KiBWp_U`OL+WTSR zndD>~XXuKQ!^R**JpPF|#6a`R$gx&N>_Hnn=*@cLzp*lrcN#!ph!9I2UhB z^j0xQKGM^w2|E4y_9_v|Zgx#7akDs65!hp6YoSabg}P@5eb0JK^)B*k!Cc_-V{G7ihEW>ypt@b~q5KK) zWKofq(Zmt%Pxmt~tI6a_bHrnzm=bpf6XA2w+tYBRjM^~;-dEjkSKic%w4CG65u)qvHCc+G4JO>mE`yRAeHv z@*QX-pEX=cMVF8P7`v}xYCfGA9Cz+xz03uG$Wh0=-;plO!?sw}yw3X@MbpN|lRLha z>@64f*2Ox%eWuyIh2@Yn3Ws5)d#w(*7+M+0urahR9(G@M53d9S&ZnDa294K3x;3Hq z>y;*|ht5024<{AQUBt!L&ec!?s84~ep%DM22Pt|bBt%)Qhf{R&Q+fKNl)h;E&| zk+a22|ELJm_kqa(Y!YD@#P>d0>A_#3%p96k;DPmo20$lxWc#kcJ*jB?{Pk9BPx++E z`-`W@;I6$xQ_$X=(F&UdSE2a_2BG^&G=mGR55M)uA3-e7=Ay36!lJo*W^H$CxUAaG zt9{$KpF_H1c|AFNPSdk#Wi8DO*~%3y8Tqa@x+Ef{C~BXKZv|t0rhz#_`}4Fbcc;ZT z@7lS;8GNDROD+pvJ3;T$Bh{sob=&$Y+RiPm!(Uqtrv(^D@$vDI*i`RKrWd<_&V69e zPX*gx<0(;Yw_c~x&%(X;uY}nys4qz1E^zYo(X|)9BvBz1LR2_`~3Ln(%zX zMZ_%!!o1={@fC?LZFa2>{`o;d(OwJAN1t1C$r;Xs%{p|E$a8!);x(6nauN~5?)J|` z)fXl@#kAAw`VGqF%eB1i(Y$D$uN~WD6_~IyHcI9Jl+*p|A1h92LN+|lM9$>>1ELm% zeSoUF`&r~sLk$#s$e!V4No{L0k1FT}Kd-w3z%Y?WJ~(>z&>o5~+iIBVwHM#)b&+M) z>YpThfLj_ZmPNVowo&YGDJ24LA&^7mn4Gx1k={WkxjtW=P6L~ zt9aWJ@9~uDXN1&C3KrkFN-u&=r-I`kBFI7m6+XD?&*+l9rM=DUA)V)$59vrNx9VOy z$LGV?JM!HLwhYKGvcDIb9@o8Xge|}^OawA~e{*DP<)U6BE%tf8x zw@x+ZW14h$R12F8n1(ePU4^L!mC$jzNy6i5ET%Y?kwEn9a61>Q&l;uH^ncFayo4s* z3iS4Y>Xv@L?~a+OY-iMOZuN&-5FfH?*~ZS>Z3)lk2}|!cCHuWz$UHj9-h{O* z8&l3?Hs=jPy^L+F3uH5_v{vDh4tqRS)7vMf2QfK8jO0WdSLwX=6OrAFo*sq9eEWgz zgvYl`Ms7pdCZ^dIhBuv=r z!ZQ2|xME)|O<~G&y7_puGN7uuUMR-Ny}(4!n)JG1W$W7s$?3kmd@_$*>W%Xn#!QZJ z;BiQJ_)X?a^;xFPc9y@SdGuWej%c`}DU~hWu7lO}Nvz0kD9UYMX)WUf}0i$VNDJZ^F zt6G}G*fn5Jz~SgjNt$tgu^ugQ>BH+LphV*Ad+0l8*tB?fA~%*6df@BVH(|b(v8gb+ zTJjT^Y)Gkbcb1nQ1QQ=S#>(Dr-X5-vT$=9W^LY-o#s_xp2tSW|1jMET!{>O*W#^6v zii}TsKQ0fHT+>G~5+&s4`@e(4G&W_4dqRFHdgB6R_@S+ymWLLva`@hv4hM!Esi=oe z(Q%ySjx4-ETQ2^sw;ri=j}jqy_cGj^-E;l$;VT*y&=U`EG4u&9oq5=wy2o)frI&+v zm;U+c9#@kvDSqFlmTx5JJ8s^-xnfJE++=1#4~A* z+q&a9APF$YzwVOF<(2Xr^}RPk6wy72*L3=lXC!)_ZdqXPn-OkZ2*xP10E(ZZyBR;V zuI9ku3_EwJ^anNu{I|zu0~QFY(9U;kdQ?0Q3d-If}T^>Yj}d)r*Wy}5d0)9TT7`37|7q;txH`d!^OSD zVz^3-TTkb)jF|p$jQq=#&wKV{w#6h-snAh<E@h%@-KyLU}B-d4lWbj;@Q?vh;h% z=d+iPXu!;O*vEU5g+JdoM$msK_{L)=8x(aZ&R$rlvQ0GlfPLHSz~y^=#@2b$|AIET z)%A#!2OQ&)ngYyUKr`u7onedZMThp5Yo9J40S_k!oclxi?%xdJIC6q=ybk;ikx-l+ zg)h3^2>(A4pjGOmW5Jh`4#nwW({pEq**NL$d^uUBG+dgWDnHHP_eHbw0E*C2eX4|A zZPzUR+{UnbUZA_gRGsNM!(WmfQ>#;vE8e#arHP0YrR+q`&T2LB+;;tFDN(*j#_@KXFxiX<4NAa&zJ9RK z7~Auf!3N{}*H<#_pl*s8&*nfn&x_qC+jNSz>@VLdigz7D^zEot{%28reGZxBgP$hA zg*e2!{;^1#j!xS0uf{+8`hZC>oD#8>Nfwct+lCoXx4A2j#CxL;D{(DYB=dqNi;1*0 z`bq@sakx##eXD2E0;Z$1E?3YeOVlfYDT+`CZqLmp!aNm33NJ!lJ+OjuM(V9x7!7mE zMMllNDScoqKNp>4AV+TktIi z*#ogxkJ%?>fGJa-7JL>KbrQ>^e}9q+jI}qbPL{pW_r?=hhfj`fWwcd9Z)L40v=nh$ z#(fP@!Uy|3JKKE*BQN=kU+7PksEnSSEr$lKE>X?=(=* zw)LgSyXJ_u-?QFE3(pJw7?Jf?ui1|W4t7&_5|tX@!>Ci*_g$(|`JllH_`yh_&A+=g1jpd2~RsWv+CD6;=~|7g1fq?jT5PWXB5qvyIjsX`B&vmRzu$)4SOxLq)- z(cQ9a=0JT|K0j59HeTA2tEyIevb2|A7+*ZcmB0E6!QU=!rtv3_2Fuk8py=3hFrwb# z&Ch&!D15p%@zS4mY9fPVoZ>(swE#oyByakn_D}9nsTH{R7S@ievpU2ZWF^7JQ1OyU z122{?qKk#`u+ zeKEx-G+(RP%kqlBN=*2Emg>@ZC%7(e>SuPisR#}<#PyMryk|V#_UrzTXvOE4^|2>N&g}n1-2k0M7 zdp8iWq+I!GXLkqGk>3&d8KsmT)J;6kM5L6yghGMyHrOnR#+{dB^Y7& z7zUli!|K%>=F{BX51mTx;Ay?gR>jvCkl;qqubyWmcOy@V?^TO5FuW@)c<`BTpX2^) zI;g}M#B#BSe0P2NCtfqi)P0_o44SVXAvVlCMo&X#{EM1`Eor}HSaxX z%PCYLQO>9EvlmKR5u7-E`UUe5X_#HulI_KU_fLBaa|m#MK_>^6X|qsnvSkY^cY`AA zi@Iy+emq@84d3Wb7-OVPZh{wjtI?R@7Xjy!<_EW>Q zWNGx6B{USpw|>noSH2G21!MhI^6E~&e))&1{%ng6ohuv?4xrApw)Rc}-`3nOxr;C8 zRhp8{YvmH&|5B|7w4vnd?wi8bc{13o87B0%topYn{e!m;dm(hk$uT2}uX+z|YG4cH z9w!>WI4Q>CKq%x6*f7hXtvxBC=GwAh*tMz;p(Zagh z=Na<-`N{|Jg4oxNdGGPx{Z5%uDf;y0x0ZDCUWr(ic*fQwQT->R>&o?!i&t?Xh%1XV z&+{@(=ndsMLWf-SZpa3e^z`;uSG&SpMoE@;5oVVy9r?Xh{@vq>Kt2X;-Zd_D8<%r4 zsu%uIO1$^-MZA4@S_Yla|92yWlCxVafirbz$F=cpYryxw@u7fTV<$m()iMO3Naf!> zwjDa6{)usG{BVzSrr0|yH<}s|2RCJ+P8(C(XOHv8z{K*v@bEbw#k8$k#K?gc{K;Z; zMvw||a+A!zYdJ7ZE@7-pXFgKs=FQ!0%gSzr?lOG2BF(R{pW*KcNnj$JZe##CNp#5W zGWW3R{f;*l)SQj<@9r^}-_wPru=|Fpqn$5&Y7v0jXsMuEc+r{vzf)$b2LI^a?g zkPYnv{|~{AfUk`q?9IzIN~JD&p*-2g5prOL+_ZL~dT>3e%lK+Kz8Upj4*v0f#JOqr z+19qMJ5V)064na(_J!6~sej^&^S^_Q{aLa1M7RG`c_p(mo@YvCds&FA7~ycCz!03A z+-Jb|?-fGdV}w}9K+A8oO{v>hp4$IedIqGGo{Iln09@ryS7f28H{nbkC&TQy5y7$t z{&7L|6Iu@)?KCv6zeD5LVgu6OV-`75ht%}72etqfgyqv9jZaL>q5Zp{rNXx4bf8E|zq-$ysr%3Ub6#`i zobU5}KF{|&bI$kk9t<_XMhEJBzXjqH%$*58*J!lX#hvEpsP~sQGPQP9ZKdt*|zw%j}+VMr8eL2Y6j4%#w&Z&BcuL)ts#=eoWQkrPsvOV zu6786fe^M3+vt9H?chHiE-VQ8n|tZzaQ;oP8w&W{5-D%BnWs7})2ZuB8IH2~X?I1sfJswbi3}Kp=Jq{8Tu{pO%|n znc!>2O?xdhKffkWG0sWjVCu6)j9>1&_5t!iG9Zqt3RUl4 zF57yhTGz%;_Mo97g!BB*T{BW(4Qee_(1Vn4qe&k{sq98YRz`yks`r|#iJV3MMuwL*1%p} zXyw)b6aiZ4G5h{_If0wiW&p1+%kjx2exsQqK_cG>5h?VK0B}Ia5#>0MR8)imTU%qX z;|rgvb#;|TK-j^M96_{l_lFt!p93&#BePWJaKTSi+pmt&ISPJyX6%TtOWU|}n`}&# z2REYJiv6u+y3mFA&xT-3!zJMe78P#V{+Ng~ZX^2T!7IXf1d@p}_);YBB(n!)$(6;W_k1vTFttvae zFke_XzALRe;~;(Ll#e5~zG#W574NmnW0c!ic&=G_3F5D5y?6;ttT+0GhwD3EJ?1LO z&2{H9`r{L_wrT6WMS|kulRgz&m*ZUI0s{k;jg7GeL4WF;>_rE);)PnP$LZa*ND{NI zOccV;9Uliq;edcXF*k0$S^a%|BZe6wnrbuO6DE!T!KwAgM@t#6dezK=)})S%LO7v) znri3vNzKTsXcIf=FJJojaaY5pOMTkeE11XHncp1wE^B*v zD0)0Mk+)QI8833uKyUX$*VWaXHQfPUI@1iO3_QzT}`>_sR{G|S8Jo)z5 zg5?qKf4F+@6Ju`^C@`X;zQ`o21rtctz_kx`@*Ws{)^x1F`$I++xZgfvbC;|;rJ1Vf z(mh35c$p|kK7xKw9TK>bj^zC2FA6}6TcWIlBmSZQt`J48jkNp+TIcz6`RF@AT??WJ z9iF>#C>6)nsY#ZfuvX!WHk@zRuE1wlZaOMTW}2H7JX=Dbt2p4234mQ7m6g`-;&3ditrLlV zig4G9)|1}&lXHxT6V%hlm^0a865tsPu*33_Psdx+fM4H$<2m~acqjn;mdLfx>WM-1 zyD_flThV$cmvT{@LCYf&Z{T{=H8ro1rmTNiaPuy#d-LY;y)Nrs;WN{pUU;}NkYdT! zCM;hgnp^zz^w&`Ea`i&FZC0?2E^G+ZY6Eu!nt776x3_nET%Ku!Xv(WvHeh9d^J5Wu z0%alD6%27t7;E7x9|vm>eRe5!mvf2PzXOEoogjHox+RqLW_f7`JjTPILw(UW!g%qZ z+iNxc)zvn$WjK{u$pJw@A%qAs-Tj#j(DFg_hvqGj{^FCA>R0a(xkia86G_5S`(7w; z&o9pbjhIFVU=YJ@fQ+PsqU}R(|trQ5@tA5KJ-nXP!(4S>AHb$#D^34_rO}g6F%_%*i1d<1?S2qPg z*(2?TXzAzAKZ&2IIIIp!HHH5AwNK3`R?|K%pMBSO!Vl;sm~yjLgcH<$M4w6m3|ApN zmDD6eamNh9RZ4L%T*W!_sBfBq^crHhd|IP^%#T-f!y&@w|G+JbDL>q*965H%ouO9F zN&k`EWCti-?oHvz88|U2QOx2~qO6(Bql4Cb>6f8GdylX;kkd%}LR{%(8Km%5{YMY( z!7{K;*F)xBxsv(Xr>OH-x}E^e(v_j8l)T4>llNOFq5`=%ds!F31VYn`f^Vlm^A74A_~hbpVs|rCWWc z;oWWei;%&gD9Z{|QT7!$u=7yjma>aak_L}8m{>S>Vdi_`RQ|XydoerPDXg@(+dtT9 zd3ORL8d(10(uv}V9Q6nzWcbUj&KgD})6k~Cdqd2H%l~I(wkq(dHu~YVpDUJRp&?MS zJmxxV8*gkOod(1fU9v1xozQUafeIlC#hrmp;qa$3$C~Bz4_piqB%6aNxS%EO0jA)c zKxrXG-`Mf4solhIe^1Yzp*;8+hWK9W&YcJ4^u5WG1@E@`uiI4&#SFNN@VD#+ITI%G zklQ;5sb9O;n|RQ+EB&@qi8CNqzPwtEYx@=WA1PgJFAy9{(L&!r=mQt#;TE0eBl>-j z5)u-eM&}khQxz^|mo#_nvPXu2|0KE#*P3`_7+QyfNUpl?0WZo??_Bq_fWR-FV5Uy%epS+Ti8Yzvu2hB;jJ1Yj3eWBaBncrF>h731%uzXXiU-cto z1j^EIS>%816D|QJ$dGQmnHkd_c!pKdD8{l1Mfv%aQd+Bs#lQ`S6#{lgknLk!LwUGk}CMS}2&a z2SpNqS!wo_q1w=c(cVHHEs2F$ak&9YIJNhYp{AxU4|`GV5idec+VdN@&VdH*@!o1l!%5Q`gtWr%n=5laK9Ct7E+bsrA4H9#>RRu8G!YcD+UlJ{w7Bn`wO3* zi~F_u`!^QxDRBz@Bi>vL&c&(Rri~wS?TLi9IfeZfoar_njH$oPe}CINb5%4f_RRW? z)`t5Yu2JS`4nGCBtT}zM2&BMw06R8s!zn~)%Uy^>K4M+D*Kd(E_MUA5cng4uA$aCe z)7%^2`(~z*8zHJrxA7nGC2B?hii7|o{D64J#;hfIePn>yo`-x38i`4&5iYC$5aRYfe4qf?7g}rS43ETCcL1u;d~#A$ zg($BN1r$;TC=hW;u&hO)66(9RwPQhi{-+L-CFOrXfulGtk%-;bu>yiLf!vQjudM$C k7xF?PpvwFz5u5lWTEg6S(r*Pf2sn(8gRS!(rZqA7zgrN{u>b%7 diff --git a/images/unsloth new logo.png b/images/unsloth new logo.png index adaafee48dc80f38582cad3df0b56b0b3e7d7302..c4eaf1aea516d27816b9f2e4fc9c322cc1ab1ad8 100644 GIT binary patch literal 54788 zcmY&<2Q*x5*Y=DqT69sP6Ft#8(FxH)l+k-cbVl!;NC=7EyAdJkAbN=CM(?5^S=LDb6AUW?z8WG?{e*H?}>Y^tx9x{_8tHLAW~OT(gOf6&jA3SA|4L_CXGIpuPigAY{CC<2e`qQyfB=t00G< zsI8#yrOrwV^c3o8^y^6QtB^u8@vNmya~pNJi}c;7{}J^2vri39bgrYm1nLlJr240? zmonSgE93MKE}WjJR9k>6P#Akmqr(m7A-R0(9u>($B6<2yrOQR7OP6RXntwh{T$w`Gl}X5dG0IkRQKu1$+g}Vp+Y@gAtF4gbE25{fJEFk#G%Zu5(ob* zmPj%f3fBS14L6OX=HAy2F`gX|#RQrGEb9*pM*rMHs82T-7D5&32CPm-*k-nV>y|y= z!L@u8>g2&A`B(f*%Q_>f3on$|#Ct1@n5dwG;yDX0)$NKh>Hib@AGx{axCyQy;^uN! zR#r?8kAj9XBhPTKhf{CkUIXzzv?U>UoP z1O1l8y1EqNcK|cuRa!t0tIXehTV>K36RZXS@&H^Z2wPey-UC)m0zea>87Oa$UijZV zY2E|;031t(E~@F2e(vs;eT)FS!41^}^eTfN|3}g2pJ%;;4InhcVSWE*_aG{ z;3EF&EAZj}zVP7&)^Qc@F*W+hBy87W&M`F_T+68Ie%TmhnZGY2qDZRtr@}Dic46k| zt*ay9a~P~){)It9yZimGNIj9M%=J`P`ZFq8v6fa$tzv@8+uJ}I`v18@>Fu|AQ4?Ml zc8)>x8vHqc>xX68&t?973n8nJ$&7~F(0m*|8Sg>FQ^`WF?@!E4bdjz1E|i!#+6@NAQ`iy{{4R>#e^Arh%|7*T8pTz4#N2OO*2!MWG&M2 z?|$%kifsAL0a^QoDZl)b-HBp^O~9BJ6!Lj$I+1@jU7GrZvC9r1ssv^k$5TD1QuLLXXo%Zswg#At)YuFKy3TF z6T|;JU6>(M@54$oP*+FIhLH)h6bt9NNdl4K}5=|VpOwBr#< ze|KP&Dft<@%NDROrsnj66qNwD9x2TID>_H%F0)Hp!nm4KV)rs&RRmxGP(yp+f1d@v z|Hnij!=E6!Tf3HE>j!HD3r1m9-^`r=FUN_t%~Y$wl7*0!db>gx@p} zUAI8lvN(7C$2w>@4t8u$5gBy#{IAM?`N!3>u3!FtPgDNDd4nH%Pgs!Fy0=3jwC{hk zNkh3kY?3N$6H!=zj}irZz@VYojr-Ri1a$}GUp^7#vN?-pJCFigV9LY(ceimStwYI| z#msbAL?!(lQlTrr2DGX(`_)^Pq7^l<<9XA$8eSB3zgBJud?IyF?qzIMFZKMWuIr$o zXYEZlkTY9*WkX^uGCEjZgmy=mw%5fg7WUw6{y1~kQKKZ=exlkGU2jk+Gw^{s{@`P_ z?tGWJ+=qWonp`UxK!a(?W1SuS@BoF8Nsy0@WZlAnuY9C5s_p5UK5RU=qev)c~+%rZ+-7E z`TNwhsUkzO$0obv;|5uwQ@w1CjYDjIEg@BccvTDFLfX^YTE|4VDhAj^>w8j=yCL(f z!=oN|O$ncL>ebLMWZ1tn(y|^EOz-DU@2@q?$zV0pem30D8Ea!!fJ=f%PbTgdSwI`b zHs-2>18S-gz21N%5P@TZwRWqxOugR3m>GG@PxlH(n~5TPLdV<>VQE;-jNks8PEsxl zzyWwcAf&-dfGPm|0-{Y-DKk1^X}7nwKJWm-MMiqbkRCPYYqIJEFd-XZkpoTa$v!=O ztZk8kL3Vb82rSFUH%j)73%Qh!fw2G>n3F2P`nhv-b^%`PvfQMtn^<0tOAFsm$IfW8 zN^*)R_&D3=fCT=Sv(v-0p;T0Qtb(=S?ECj?fdD782FOtqrq5<|KctMX54;&Ph?gnV zyXTj1S>as`*cDHD22ngXu9+Q_qT9TL9zi%B5iBKrO(?;D>`1%V1V1;2{D)Wu_C}JHu z5nd%DCPZH9_&aYug%!*bB1CNqjo!~RhK&D-s2u0wKuZJOmaTzzb#Azp5}~61$Y4re z$<-epj%jSo z2*R?nHBcGbDHSWwG^wAnA-jAk8Gm7P-je)2FQeZwltYL(Vm-^!G4KhY_Uo`8n^Pts zOn=;hBU&8Gk|q>07HF+JE0+F@P*NGpqIICOEk?0z?S3m;Eg-{8zu`@*{xty)`VIs+ z(Q3=+4b0cQs&qnX+_b+dgF}LHELf&Err8fkWIk%NcDnJko$o6D#mL$|7 zrx4D)lOD7ONmo6J0_=E?*_Esj29al%xic3I53+I9Zbic)mBhwo}OFzk27c2eOhchtq&~|dzS_hsCZ^Bv%k~FI(>4a24yKt zx2fdCo?1*)w7_?vs(e{1{noAf|rS zx>t~A;t$7|vG$Tf{K16>GCqb z%0rTkQ~)-@qqxkzXD0+tou(txeNE%BNc1Z4^_MlsQJK`z06ctxVAS$Ym#_ENZ-p@q4%_*=am? zZa}A-f`Ck=_E;O12c-f8&pG5~XWFJp?@p%hcV$C>f7=W1>gKO3zo)I2(k1dWT8uzU zF!$G_kk?;0zw+#3AqvYltmQrQwM4#t%M_iem^eecT>Mkde2&%E{(cA4RS~|23I^Q1 zeRfLI-}k%y=HhC{p8m@xC0h{RPKhIwtRO~p9=e%e^o#-84%K)ZBtjabGk#coe*I|y z=05{7aKa{{i8IYCwX9&#QJ+o?-sArSnatTDj4nLD9ZP(ys8t^JDic8BpCBXiN5PaI7j zo#mqSh2yvEjp&#-f_BvMYY6BaZ29|-nC5&EI79}zPC+VN!W5j+Gt%Q-*6ZCB?8O?? zhTmFHZ=p8tP=C>pZoe!56R^pw5zAqvV>i(WprQW9>lEUq6X#T$R=3+_Dt)|<)PlyY z#@n!tB&ztnCuVJ2#j$-GlW3XX#q|7 zM*Y8&ix;Bu&)MhGQy16g9Z-^;PRP9v0Y@k1qZWo$aM#3b?j0G62fJpY8Ckgz^;!KM zLjq|WeE1tr=GQBGf9^~)qz@oN|8+W6Y3x-6CEz&A!RUL`^r`BVigrf}#tP$HBzqKY z!MK`-Ip+~Osle6f`!S?PtC93cn(WzaA!6D4IJfacV_$OA#_aoX@ZOG0UxR5~o6D+Q z0i;4@423qU$Ni^jZAh{cS!^hhKB#Oe0KK)FLL2#MD)8;z&XT8Zr)aI6Cd>zdjn$f{ z5K~<3wU|3gO5JdT2~B?I1Bi*3-#&q0{3mR4?76EXd;|&Oq4)tWFx3*!KxXi_(Je60 z&kr;HfXZkd>LH+fxFmu=d!XSw>{9I;%LE_MC92k*J|X}i=@v$4o8seD!#mLpg0onOATFw$oTBH9Sxm<)i8 zw~d@&?5aYvtsoUlP?IqfTot}>*rCAy9c>6WV~MJi$tAIoPH6}*N&_X&4-aq`TI7Hr zKC?z;8!%A~NKL(8q3kq%(s<~P(vQsxW2EGsSAKyIq;HJU zmY=4f1P4y{R4qz^a-8%0_#fo~ngo%F^9hH)CkP9u)6=8LQ+*!?Pfd@A1HHW7FMic#sK`)i ziv8h&q1FabA47@HJb7%6Y6wuCLhY#vA{Fx-2fd@cpDQGOuUDU-8c!Yw@8F2?MyFh>Pj!bDyWGKMn_`G%e(?|m~`PfV<@do z$Po=V=}eO5%f#^;MI){65-(dt6aKIz9IfAR#|XN{`yU>Nc#L)mt#t^J`x6^b*!16u z%sMU7cLn#C|R25)!s@hd$3e7iyjY~PF`oPZS6A44KS2V8#;01LZj30{5=sY4d?VV-yT(4qyxngY8H(jbGebA!+q)bCjYMx{iCYV zrGV0zfSGnrOBF?BDI@ROzFt6m!eztRAr8^nAE?g{YVIthS1XdDaE-8x}X=q)nc_i zPp!%H4vbNQ!mhO1jIe?psv|{8mI7wR1K6qpnwN}3`aP2l8LWJrObz+kcxTN?!I!pu z7utL~OLM?rmUF|ae^5mg9!D7i>Xp5*t9{pN>}=vtr8Z_D1JQ|NiH_1cP>Pp1{SR#^ z;!KUtrP54-Mrz3s(c<#dF<-$&TtN@N@tdzOCmMJ`S5lJX}`*wP<_F^=y)l!MVVF&25#17IY8^<@q|oj87v>GHYmIDaJ=;lTrL z$?dq(pa{|R5kn*7WHy2grm8=jQr2U$zDayS&&1>T!yD`jQn2R?{aqVWd9>eX6C!p%!K>nhl& zT?kSv1C)U?>6EL_m2-_L96zN+8Pot@l$qlNWbO44mM#Rj7G8>!o=(y?n$Uc5SgmM& zO_Mii`bps5Q;}r8K{-ApJBMyM$|xUxR9O$a``OWX;`Wl!i(f%tscpY|OA++IE(jgBC|M`IagoLc?-1U1q>}cJ`bxWtF3x6s+8dAp@?}rA zdpXLzX1QMrP?1-XBW@#oT}OTguDK9mr+nVbc)21>;W`h>PD_4h+GA<~c&Ym?*%d6ycg< zsOlmk{MQyYJLxxuIfx*+=Zia(O#$C`elEdtzh=CTF*;w;|Kb{$SI3_@XMz$A%1*n;r+xfS-#4hKW5aXqBuWqso4q5 z3;5GfX-asIJ+^Y!`$vblQydr;FdLVp{oH))cZmjO9~X&zz3Gq0khDo37S@FRQ^t?? zx)#jz7Eqnn0AFFhB^yc*9B19Ln7^SWeyKjC$$f6ZJWvdR^EaWK(a@;h51n3p`Mx@Y zca-I4+}2F^{LEN@rbvRhw{j;omXdEY>_f8)1Rmm>Ie)P(8^L-%&9>K>wZAdW$xQSt z311C1P*fpAI*0G1Cf3V3nHf5R?=s7tyvrLQSB`d-MmVa}`m@`vPKY3};6% z1i90wEej*avK|N=+>*!eZ86^Llr%WXfsml?j`+Tu#Yyd@lw}K4s|m8m2&)yng^T-$ zb?Gwl%NI|+&OcgXa{$*cLO0%x3$);CYda;spD@YyR(#~~?(y6FCl6mVhx7>e*`rt* z)Lq!M5C@gNBj$@|QDnPk?!6?XSt<-kl%$RWG$-z+}*M@=S2eDI+E zYJg$F5Y1tqAENODq3s&Yul{UIq7mPuzl6e%nYg~WX)eD+8(4k#N7Xx)^r4ppG{#Kv3c%;hzo+jfjVO_(i_(Es z+V0{0*s6bcuCEHmgg2lny%CQ%{h7QGVfU`~_IFAc;>)1KCMVNYE)qVO!()0(DFxgk zf{$70f+kE09ZU#pqXx%*GPSg{7JdR0QDS|7uGm;G@+e*9>7 z-uP^&clL*m@$)*8*fKp}(xCQne@6ZbtR@e5dC{>^fB6xO#X#$rqon}vz`$(6g^bDK ztQDRYSmxiT`RQSjmP}U7XO;su>@hwinYcvlcS+DvvXoo|%ZzzaIkG%DBXPq{ z_$c>inPsUcDjOBpB#~=+&0`I94v^}5KFa+w_0cXnVyyeXYn929bjZ~{`_m$YQR6|F zr->Ii_xajP)aB)6rj#$g{m7>%rjTn=V%3}0!O?69a;gMux$EPIW65KCKNUJ&@vnw> zDEVWm-_y$T(^G7-Hw+tiZ|GgDxR+-Rm47qJ@b3$T_WkL=kU#T!-}pP>^TUHI3_mWc zjmNtE+qf_rP2~bj!Ao=&o*oZaScp?)BmiiqTOtyNh8Z?1@xbgD@CPFqtcW2%r6ky{ z)1w_|LLpUsQTCY0Ns^WS`;TvtROW(}PO5CMB8Ncpmr$@s$Hh89``s<7yu2K5Z&vOG z@jmvp>D65QkSw{xMO7L^fmPkZd9F+eK5Z>IW`~nEeg@b-aaoW}S$5e>vK$upM$jrV zIB(M{!ElAA3xD&5NBU3E^T>~;s|=v6)K(XQC2wgZ$6orSxb5@m+9fl}E zE_GT3yzNz16WwZ(rZq>}Q)yF*n8!e5TRQ-6zyJnfYq=QcCAu_e{pj07VJ3 zv~k}xZq5rp?F~Q*6_>Wo&hcE+*`~byDwI(@;9f_BQlO6;X*^BB3Le+V0Yrk4*rCj*x+LO#6 zRp&6uNI@ObaH=G~xw&b1vfj78OqbA;{1O+oF=syfx#NOswGJchfn$}C8y5u_!b8hDkv@2%#vjK#!GB9Htq_ggU@M>3~#>rV|DjZYxjGLvi4qgqmT z2kh##Bpy_vUeM54-MYC`(;b!H-wC4KP(MT18kXS+H!eUS4FMI=pqCGi(INEz*e5m| z5tFs^j%H~l1|t0C+B5acf|Lqcw&E% zI8#*sa~mH&yzslD4FuIubB#XL(9pDXJTt`VkW}szz3^yK4R!r}&Bu5la^@*nAVfO` zRn}}z7s48O^4RK&9u%6qu=*#DrA9ZLUXF7e-~x;d&0mO;FHjgiI_a&Id%oL%qC69s z9@kvgd`bCyx*vC}MTB~QG2)lU;$kK4?W8-6B!`iA z33F4Uo_fk$>i=WUe?3l0`h_APy zNu8j8c*{_3H_BGL7|r_eEBNll*Gd|>-o117em#)J;rHdv zR?BILPT5FlT(ixJlWn<5)sxtwOyoTJ-H&!i5a&+)14 zA~KI5C<}~P!YPZ+`TZvY#46+|G2y=P5mr9nW@~1l!4w+*zKttp>3^~&d0vEOC#GTJ znkki4MQG})>{Ukc_@FCNc+90?*6GnVkc$N4$WcsNYqHY2pT<1CR|1{aWNz&z(Ziek zFXB>C23odr6VRT#(J-m~bbqGCMW#PM%4oecM>DM6M&84-VR|4A5m>U^(JFj7kLPpd zzKjE&<|D@PV0e0})$X_x{h1*kfy%FV&s)+w6ax5DW<^F?0bZyi)LG!IHdqq&DwVxl z-d1gzs!Rrv*~aG^F>G)ig3MLn?+(x$&elx_mdt}IT_t~~U3aepop1X~{gzq@KY?;E z3C~}6LOK=aM5N##4xQXYr^!;QiDLCJXH2no!%vJ>lNg4NY48IdZ)!Tld$f(X8FcWM zg2NixtGF?{wncWK#W3bZJMzF(@%uTZUrD(yX=^@=ApX-v$W&7_0c)YDpm6{d%=bQr zq=eqfcupiQb;ZR$1?8a+Jb4h!x&+{X4LkjXqW9^Q$9NJjj~W6LA>)>1EffLI*e`Ud zmYX5_YQiZx_&ff$7aJ*lXVXSeo`E(64x_n>s}{kRTZ2D;5?{2ZbDpnGG|E})tbum) zObS}GNxqOE11+Z5y7t#=EtW*2-$)iDh*_&m&iFN+IkNQ+^f-Txp9-vP`h$5{1}gv` zluTytfR=tixK@QESv_H8z5)YQUl!PEHGa2etoo|DEwRYFJ@-EH@E?@~-|2$6SwnA& zWV|}dud%KM%GNrFBZNwxK|*s`CFaq|WwQG|?H*Tuz85*%+!O&Xn6( z4^_GuFH&{yAriCP9866znIcDg>i9jxvol_Vd(?iaeX!63>Gxds2DeYRvHT*2l8w>1 z=WlY63GczmGrQQi*n`rg$|Od~i(9Q4d}CpB77ZckI=N zuP~$871Pnvk6d<|-`#n6rMVdOE&LkIa~$}fn?3?1i#!wNk|2f>-@dgR4L&HER*meC z?qJyw8Cnlb3l%V#{jLjc9sTmLu5gnpckn?X2}(!N-po2_^f1SFSwUMnx!FP5f43xK ztRpBu`h3;~*mz0@tCu>@13v-VHS`s{V+~ayi15>yI?PBE4OIrZJ%xTk*LX7vm^0ma z(k{!%MVJ08CT>jPw@4Na4Ub7~0W710;rfy-3pe!ZQaZTWFg?Bg$)M795{Z`ShBH)IgUdZ&ytXm!5b z|H)5T)GN}8CSzV^|3lh)DY94Pv8y4cBVrbZ``Vq@8Mb-hs}AFi>iJn zs05w%ubj)5d#eDTkQz~XF7EEcYa;9S-yH9AU#5NfJBdVUSzZ0PhyOsrWJUg?x7U++ z2799pG(?9+k`?%>?kOC?$#U?WD0n{ z2iD~P&zX6c?HLKgELOEHX_9)v&%O8Xplq{Cq+r!&-U!BRwSh5~Q0u{5Oydu{IfIEXqKqL=PWtjS z!-f>;1=CrSUEUm?vhTQPnonK@$(GJvU0b(T&&AkaU$Qula$o+ZwA8}-$mVibhmSHX zZ!=~XwJW6Xki0_-s+<^;?&Vr*Rg@T=e@B-G+hAA=8jyO=L)j3}y&dz43*r>dv}MFZ zaP0hH)Rw=aTkJr)0(F6_wMyft!(6=`OHSagA0G?+ztNHs$6!)}{0fX8R-hs3`D}uR z_P1**7*Le_+>q*_`aa4iN;015SlU@P18$xGC(!sVXZ#}Z!N5!$rE6-2wunO5e7z_0Yc-x**$RvqKAb)UwTJ^>!dK`dOA}fli)mrc8iO<3P@G;gef> z@Anr!kE(cos|}MF^zwKkryHA3r<*!T9icCR1k8SG9)AcDh#%IFVE;?8vhCLYB5tX3 z=$isua{IO!c=CqS#Cnzdgtnf0YbaSTjG(DABLXmTJrqTs@s_&C*=&PW*o2pV`03q+ z!4HN&d=mrmil(_&nZizFxgocgZ#!NjVnJu77$K54Voot;KJ#`EWxzi-B(F^khG^#=33C^}p6<+sr)G9V{LSYJ}pEFI5Z3MnBuS ztlTM+(vX* zFRFYw2$$}cCUH7%@NjkL$#ny=mVWB~WzEUn{$ixkuo@k|!igT)?QLq&OPgR#Up7>Q zABiv-GeDdCbA?O$(f!Q^OZlL^HL^1kvNP?nH{C1tk0=SShjFwZGhA?VexZ@{;`$(9 z!T14|coJE7ZUpkTYaB>)p27d3({i8ddmnz5GNOe9k&)ud(=JblNOPSwFVdLr90_}B zS8~B`apga@??vDEH>3C6MQO~wum5C*x)dD$QQsaUZqE(*qyc~Yr3yW%v9^=~%H|R2 zd#`sQQ-si%hYD_xqZnSZK9NxTX;fec9wvXfl~y5ccPVM|=amKV`(fk2B(6KG>Zr5OVAbNc$&a(>@*{n+$*av)Ur0J9fM%{4rIJ zu=Tnf(XG!zTo{L-kN47cuM(@~DYBsVwfBRK7UiI6F6jNU+U3&;A-$3Iw)5o*cXX?k z6rB1=fY_*YR#Wk(U2WOymhOmb_Lx(Hv0)&V*w@_{9uMskDdfb2p00i;8sQzc8*9l2 z-rXRZH{WSi%KVDZFJ+Obp*&Cj#iCvoGm~O@&fbNous@)_vT|uif5tO%0lYNs4B_;W ztl^?wEC0(c0Bi3dy5!|}kXU1#N2gYWN$9NIxq0|u^5_Ox)V-?ALvUQJ0kJ7#TDgF8PMTKkkt-Hzv%nFPEJ8TilGS7eU9 zEgz$>Rfzk|uO1~j0__9EsHI<&CI8UzyQj|R?nU^r`Fr@wGJzx~>QrqfxujiMQ=07- zebjDJ^ROAmy`0WNIm&+L-eqNK^IjEy-Jin(or&o5@eO_p+T}Z$T;&O!u;Hp-i2Ml3 zzaak|cE9{2H+J47p$?1`-9ebS{DB8bi3t(x2i!X6-B+VAaa0=B96yFvOxa78(S(I! z-1Ew$lj0|f(f%3%QW*;}Nz6*^JvOBBk~;45M)kn7lTeQ~qJc;8pNm&)8#Inrs&2lI|=sAE;AO|b8$y#v(A3_yF0_l*mvoJ&rNkgA`#L6H{y*C#P&_*mLJEmhRtfozb-}_vv05c+E#( z9>xtlM0eNTV?n+23BZyuEVukNGA3FN*EX@#hHhT!#vXA$JF!fey#ARrKldz0QX~;V zLCzaZL>E0Yq|u3TK;+=f@(nhcS{=WC2QRlWeHbn?CLAbo{?6mt%)g7Fv55!n_6M2b z(}~!RxnR!9ar>QGv5Z6)7NPldX)LIos+&<0L|=I~{ZIo79h3#~_NmS^K6S9|P?Ewm zmNQt-G3LY|Q?GGerC(HzD(&1LL^yRtzzD})NhtVC(Z@%WmQGn&xp_UF=lTeqvwSbb zTaNt0J61vG21fqNudcypzKqwPjeqT|nfaM)gKT%O z$D8dQrFRS^1D}iP2ibSnh4>S^y(2+Ks*qIWPF0j7^8`a}Y&*J+Qt$JH&GBGZB+pg# z-p95xGNfXas^ETov~wpT8F2op9d*TlTlPtCb~7=)ykBK>+aBP4{On1@;GxYg4e6_ykWm zcKbU;_}nx|bXY&xC@$EEV%G&`)56DieK3h49y_rLm@_XQe%n|V1Isbxt;e^b`+hg0o%C&{QNDOWJ;_& zMzs{&m$%MGatC7gIaJX2pcmvOJBcjL0=>}cysCsLRMFS%ivt&n*ZmU>(uv#xs@8$h z)i3B8x;?v_=9vDlFIXSX>s3~aO|3$->m0h3k~{Aa7yhvF{y0<7HvC>9_npzfhx2zr zx%+CD(neDtS>wZUIMqq6E?D_^Kk`e5KBAhlbE=J71^!4=KW@i%?jr;m2Jj)!h|B)j_T@d*gC#~beyw&R)x-&vr!+q(H<4uL8 z#Xxoz{}5tzJB|+EyGF5`jXkNJYLCo05GL|W9D9^ zwyCMvvHu-@#rb){c~FJo9q#S`e*9I#FI%Wl<14k)wg9{IY(>5f<1CvSUMPOyvqu|X zryy_cAaGV)He#Fb^~)v~qoY_C#47i@E!oXz&j`Be5^|a0Jy?d)xpm%%@^@Z)7?}jw z+uP?T%Y1f$@o#QzF&jMBxJZ$^-MIpHg#v^1my5#Mj#`J|9aWwQ1sqI)amXemaO96$YGt zphowfQ>*UUCv-sWt-ey5=%I+EU*LGDj-~GydK_oW2WNJ6 zcK)yEB)uG`KAi>KUTzyVI;W2Y9qK_7&)^~i)=P@h#o zxE@mKUJ-B6%uUJo^h@=HM2aW{d0CE8(VgshdiZ1jWfh{P6GJy&+i@)#RaQTve2 zWq5~+6fw@ao_i=&c&`AfP60!?BQoY|KNpl!`w^?VWL=+L^x>syiL00Ao2kEfkgj-K zrz)wAiEjQcuN*i7m`m@Uq1?{0bNE}f$vrn9 z&{v~_$2bKu&4eK%HcRT#&CPc^$2WS*+aImb6ExC}E%y-@_u6@$H1OO-4t$G`k1y`` zd@qX;54jQ&(umrXs5NcUw#85)--kg4+Wk)hk6fto5@RF@v4>9cjUH@c(>6j(BbWJh zoP>sKo-C>Lnz|ala5tt^t%{0>`Zq)MU(647cZ7X`@-kh{XmHyZ$IVX?8|JjDb!M2( z`lGv;*g=M$Axbytk^vdy9nNwspEMr;h$%kCA3K-nI@0DHc-GR1y{1?fO?&Qzf^^~YCA7P@b#j&5_!|2N5V>w zQ6m%H&iWfOQBy>6G3-S<3O&i2GKQKZ%&fl9)Q>OX)b6r;3!dkJ|NUkcKBf)k&9!E- zeU73W69;|uBk_kv=+WmSbe+|Tp1(3!{%3eC3932P)&^^1y`VVr9p(pnb-%_={NCIe z5mI*E2Jet6hV-Eeug~aeo{&};Z>>Kszx1mY#WVQamogVqb#?rE_wHfP`p!2vInGqS zlpoL|l9f0`_xXBaseFzWcVV~>IVH$5(4&Bw*vf|@9Z_GI+5={BO;q9Y2iqpvSwsP6 zqSbQl0F#=j_>{?$KV-Y0q6st!sbZ1ms~Y7Xi;n)sO&_)cT9?|eWTrcK!a+w?aI(W( z(ttLkti%wUd1nhkSr(+u=44wyl3mW*P5JULwHSHGtK+?OJ5e9;t&iFwF^Yito-ayG z(C5H7Wk+}#5rXa-TpWBERpNoRdd%5nOkZUWFa{8M{`#R{LhEm06`M5Y zrbFi4rn{U1_+UdFa7GtozC*jBB4hC|2UK&s7!D#mi|=wD;u|uv4-$P+>j;Cv&6xZ* zQ{T2OzbBB2t5f?u?*g&fohV^ZgxZhLYJGg%x9y&`&YBlZn+YCBFP}*L8D5{(0_Y_`vx&cy1BhoWHw#f=3DJuc`GZw~47 zgKy^yo{D$4qUhJACpp@POd6cogK_4!HuGKEd>peTsU#W1(yXuVf|okHtFBSrOg^uc zex2MpFBf9#O-_zgdh;~EXLYZWU6)FUB)yIzf96QB$}-Cqjz+|3sLZgT3$zx~i(fsF z_cY8otRPB1mJ|nF5hY3oCFSj9vqr6>1VUSAvNY?cg$3bpuXBP}OG0hjqEMOUL2~+f z7-)mE?9}xk@@gLvvni5K;j1B$BEoe~tFVp33NEm2VT$fy^0VBbea51fN}=OwkEb0? z_{-j4NEX{-;P0Z#k1<6Diqrr*tBPOriL3ZvSOwzLKsW9XpPk0KN%QDJo3mlvfmt+4 zCMff81#0xX-{gxoYyCo_varXHde9q7x7Gf%+l$RC0r#0m&pnx+k)Iu`rthuHJ!)KQ zDoGd%k-sy^(bolqO^4KU7hVzw?k{{4cRw&r+8&E}-g>z71()Xoe^q_R)Na{2!rj4g zb4Pb)rYPpPAl7?l01Q7`GX8SKbp6?jJNT0b9VI0tFfYXT=uJKO!bw@4O*A1>G%y0U z;4V~utjxmVlP+u2E^MXDQV z-!R9~jRQxP<0o~l!=j1O?AIX0Wi46MVt&fYj1}+HE(51-xvIN<_~|d38Q2P#_w7|g zaseG*Ilp=HtPK+%O_J31t8AZsnnY>uhWj^!nE6%JOXmG%%Nhy6Cf0WXLJ^o-QN~8O zWge{=as__Ht5vM$l>@(_6Sdm$vpgwjc+kM&>({ATXT>gKF%qOTWpaf+Qu$)}ZYq=^ zxC$T;qy3Le(s!^>y=Cqzh6FG8vUzbiDkAv1{!(yVepIB6>?PJez_+&J%9(4m}KOsg1Z=?ne*CRLrLTL*2qb0W1P5fn@q@|n7AE;@uv^G)!}2NUn! zS$>}1^a|t?cN|rE65tE(t9I+?lX7d1TQ6L_&7O?W-NJN&2M4)--^y6ajw2syc&Xn@ zOW~h~+;_V;s&WhDx5j!emjSsi76pvJS+DjSu$dhs-3jtwO2&YZXN^RQgxp0~gj_vf zYCk3BEgiEh8y}q%vj}8=tps_GT7AdEKd|eNsIZXj!`#9_ZcZ=jN3#-wWUz0)eIcJv z5@y}BaI&xC*_-sxJ>-Nk!|LFp!^0Lv*=Jfmp5}==QNqPSx`Wj&wtFMPpQiUI0$Q+I zhDMgBEtaw*v-{h4;sZB_}-y$@l)$yF*F;ONF#)SMlYRelO&v8G8Wyr;$Qr!+gm+9bDfS! zl*9%-)JEQGq&!>Jy?TVoAwKXic-UD@^Ps}%O(tJ<@~DzX+U@19D#*qc64`shXQJ0_ zRLFm>S;MHI=pOJK+?{O?!n)TiEw#6#?3LkM!8l=AkHJU8qY4kvU&sVvhN1o_r z;gi=;P-m>7JHW^Nnvi%d$L6`_*D^;pDG0H{Yl70%co#^2*SCm*N#z-M41QAn-D-~S z3Hr{+E$}dv0BIBAht?u;ETVa}(24h$P9UO^{5*AZ$tt{CJ2e_T(eI1zp}ea9$kVV$ z`ULVQ98QJsSdcQDmx+5|7YK`EF{G^<@ARQN+7bQ%(E_8Jx)HaF-vg6P+EO>9&t9)| z1hq9Eu5@S$>xiHjdLOja(1T9d9(Vv>KpV*X_# z!;t5c`TTqYZP8KGw@59eTAf^qQJKrMi!RiKr;g24AN4mHqc0MU&D^}ay#w&z&@!d~ zjPc&woVMdJ8Dzo&LQ|lh5(bLsxIwwwKPU1&T?xJv$qn2TBI%4!dyHE6xUMosgOvGg zLC7E!jvb7dUsy<%7koj=*a8QhwDB)eP*SXREWmqBA<$&bya1eypOQ~lwwSb(9^~J4 zqnb1j)U|>ldQMGNPj~UZuYttpr8WmN;p#7aG`tBMF>=I|RM(dhot_0sa)1nV}@%#ry1b#_MGQFVM6h!q?eZ7aY z$6bi~_@#ch2??F^uOGLh8!FlHZLgsWswwnI2(Lnn$BAuzL&Dc9=`bu?11cw~pIIrB zxFpmG>IP(ky~GI8tu}$qZxs>Iaqo&8!><{B(g#V-)cik|&MGX*Hd@2}Qqls_-QC^Y zNSAa=NJ+PJcXyYxg5=O4-QC?iFu)M|bMJk?b#VX(FyFkh))V&|S?k449@^-`XxzII zknBuT#;0opONdC8{+Rp8O()v3loT||H`#Y?NJ=?}5ZZ<}`@eYS-y+g9 znn)~O4@6iI{|MnC`n_6WY-rS45x6j|k%pwEBVJd~u-c%a5os>{ICbn+i}tBdPuDC% zjI1jGdeMOpzXp9*gw4U)?mFVy0a-xN;n!*5&+{SDQELC-*hP?4%e1{U3lZ&~>V&y^ zY38K77m$%md7VWU!DP9LK75PQ-QE9c+`U{L*CYC?{5{r7bQ!D23zI|Jfq)caV}{Sd z(JVXU(3nyfo5r_=O9&YX|F>+%0O%~qW`RC(gPQ~`m%dP+ZvfUS`H|Kt7s=u9Zo7zv z+$u6L519xmXx0z8NA&dpW`BP_LhG-!BOq>&(^IP!c>6Qx;PHIRc*sI|>3qIXGgQCrb zIPkr=jZjy_A1rH>TBX`_0EDd-Hf_wI7<{am>(wSZS{(7ex(-14sRd9VFyt#FyKnYK zCB0)GZx5mCyd0c_^(muWEnMnzooPWvIx6CqH>HUI266f$`+NUEitzhF2;0{KWiNeH z!Afz|N0K*HlU;Z`j#0n}ZgLV5iQz1dPHpV>#7~niEZ*Y63;)M{ISSEyX#0@VUqW)b z0fD5~o_Fn2qWf>9@s9gmMbFdJ#gB?py|}3tY^Zr8ogpvsiJ8b)N(@XmIrW-tE0d2u zi^~Iu{u$7j&3aSq>L*&2k5Szo8h*_@MGG!-zdOjqDtCcd%R;VB zJnnSwQ$8kjjnen;-|L;WdlO>c09z*FPe|uc`hs4B*Ntz%9LDfsq16fF(XqgW%}(zzgABA3(>Hl>G$hjqyHw%{c>PNBeVUDpEz)A?j=C-^(jn#ViTM64lY zGG^fid)4CUPd8(U<&kn8lEG`wtOAZmar=XDhmz)7>7)UJ8u4LWC>(eOe%F>eU&Cys zz+jwvaAvdJ-a#L1wB#R-v(ZuP_mc8`>8~z})2o^o-o`eNxv~i$mQ`C!+W`k^8v^OF zePjk(hjz!IMRpe70m>2qG*WF~AWL!1e#EUw;<$6%2 zwVt;THatyg0lyr>obL~Iu7;Lxw+(MXuY%>2~7+A}s)Pzh(Q1e)p{(aA)9xtIm@6wbWYByc4Gn$PSk^V98i zdsRs8`*xUMf_S5Qw6`E5_to@CDeBx(&H|sGmo&(VX;Q|9ly_CM8Xf`Dg5nss%;?TrB_T}6Jd4Hv9E3VfIq6*1$|rdjJ`58C7^QtmF9s6y#h~|Nla|- zytl^M@%>YG%QmVpkH}~PJ!$l5@=TZNa&2K1zucf@CeEqPOw34#%sZYFZ(t}?+O0*t zzP?`iWvSS7ce7~V63bS5I}}dp{~?D8(ne>FHSp`qb8_$?&+q)-Rg@ zHG_>Vg!jFntj+=Z1L;o2Hy^N0i;PSklS&`>WMZ^31*WB$&jc6jQD|2F{?_T$v-#ds zrg5^jZsnEquGy=xF8Qju7?SR8tTnZ2+3c5YlhOL#TqBE|lcizgIgV5`4x3S%EGvWG zg+{>bM03~K!oZ^k4)K5ntF4?1?i)_3cm&n2Q^upn zZdlNwxI2OZ(S_*qw}K(IJI+A;UruVOL(ezAC;N-UB})rsPa%NNFj{W7L`QMAp?dr` zz@Y`POhKchyqD|UzX|SaW%{av9#0(MDV*{i^+Wb-co-YI5ke@O%MO)2>(DI?)vp$Md!CL;CHhn4Xmy`aRrW}+ic37kW+ypges>f~S zcx7oqPu&5g9B{IKr`~S^9}DqeV=wU{b0)=iDfZU^So?Tm{ip z^fzWYQ4Ee%F7Mm3(O~}umTR<657w^HC+FtIcD}wYQX1ZN>i))2*x2~VYbbtqsz>sl zo}~TSU@#Yj5dG)e#c3mD*g9gW?(S>8C+1uAD`9MIv#}p>ISN4p;$be~aU~o3#F^vQ zos-kLzHahh3Se4jan(eI{t+k1iF_BDra;t~qIE9In$q5`MNE#rTN!uDH>5G=BXgux zw9#bvg=wmw+Y}~d_$cXQRr7pO^i7H@F*n!n+#eG}6^4a{6}q$z^6_XIl3}De0Nf!v zK+C87J3d}>zjU$QZVqH~dtJz;xS$9mp6>vyoFoX5S>&NeOM>A04rl$OUZ6#d(a~2+ zX9k0y4H$%kQ#NFctd^2by7t=Xfh0`~7Iqw(aN02$hQby30vX_~vjIC>pWT z8|B+T2Ir*McT{G%h>gd7>BnQ&GY${Ci^-)3lX2T8^9drIL-vu8 zk?TH>-$6X(Rkd9>Z+_2-1aN+zOUg%~yHGUiNi5po98N3jF2PFZ`%n zL5j;3Z>`q{^#*oR^@SPU+gvCF9C*Y6Zb3Z-zFf6=fE4jfuS=~%MKt4@B`P{fQb2`4 zjS}lGde<|GK<-;g{Q+~I_uIdXj9xw~ZTRbkReYmWri==n%!Lus6iLxZu zgsJ83fq*W{tnKiX8uem5{f^z&KlARyQ!8Gr+_J(o{+LN9z5~A^Nh5|r zAmEv*TCvGI;QI{ZCT=QVZgB zMxYbw6OhIua8UUwWw7-)#(U{WeV_sRUmwQg+sHZLi(x+5{z5!4kI})Ru-b7gGT4<0 z{DQ-u<3A}yo^I^JtzG>>cn09K*SbWlkC!2$V3R2zKz2%HvbOwnyBw}-dvuwTT}*k?@!RxMfOZWI#+53dBwy=3 zLGnE>QgNrNJn94@y^S~9ud!&ihJc?huIm&#B^Y@=>GOMQx_|&bKSKz$%p^NsTi$4DV4pI!@ z!K}HpbDx&R1$syWJ)O1YTIqgU(P@a4KNjdLBP$T~Q#R~SP*u&;EajY%b!mdAN=vq& zoBo5Syqgg%E#3M$3#mBF`a83ZT@si6TB{oH#bqsIT@FnPmf{?@N=ns!diM3ko4gy@ zfnSZiYT;ki~mS!E$DQc zjDCAQ6ny}~5K_XT_;ZOa!t=+Qz(!ky@ZHdJCzAI0qIkg#D3G#>ygj=Zc3QbaT1N6SrH6}!&`D;}>% zi$BeDZ&tv9$#L(1II+vo-|dI3TNNoF=yoJpAbP-*Me6GOHgd~a*huA>Yn_o*`1cXr zB|sXmQ9|z8YJThQ_SK0XKS{iAS`n(RyAYvKnwt(0Df~t04^ud1TFawwS>XumcWY*4 zvbLQ0vLOQ8Lh1&7ck_IZwQkfHBkyBs1CMpL`TLH5-B?~W%aIhl$^EPCz6>BDHVH(_ zV=-&sq4#&hYQ-$?fP4woGJ@Ow&#GF?!Qh_$d@rL8ZFFllHZQ5cTymh%8^7yD{3u&t zpgeF$;6tOHQ1R-0U!71ErY)-+e(&ivs4q_H0bOXb)PReYM#dr2!{hnx862~KwdsG% za*hQ5Y1{X37d=$bw}d>olhtYxHH+U_#6Ws>a3{<+#m4d z$5sT+dN-K(G@rg)Ljji`DvU)h@^W!nUry*F83)BRcK)I|v{vunmpd`~7fCtgKK!zC zXfq(RHWVL5&Ea|&+VcXveLW*o+E zP>y@=2c$Tf1P<>O?V4x2FF}x^UmRE3R8`tFH?6t05KfNw(YmVPKgK@t*Dt``SY1hX zOwi#Zjcli^FohMzb++Ad{g}td@n1&Kz%}wdb<5#kYdJ`D3w(uL`#uy9Bydm!hb;Z# zW;g;9G=QpO7`slijD$am!(2NHSt3>G0!u8-mcj($fCdp7K5y?lc9~yZgnc={``mH& zDoB1>qPkj(?6KyeqdH{pcDYgzHzZ}W1VwA$U=Lrmf$X~0Ngb=1ulTu5Ksr_L4+X2m zd>I7F9%}1^oOfU)GG5>bEOZgW+J*J0Z532{N)-VK(GakPHK^YiNF0?58Q>6O=x6Kb^^ zSlT4xNkU?~SCLh`Q4DlZ*SXzR5bLqC#Qq5zcmAnk!F~nS9t{CP+?}yqd<_WCK;R*m zhlP?IvbY(J2GzOp3X;K(s@&rCEy7aEn4!kp_Y4%XiC~p8-o(89n zYM=dVh>5c7%=wNSpU=*^PkSmHeGS`TLf!}1oNJorSIqY@*`C43r`M58HbUP`Vo<-k za5*}RAHT|!b9x!)4J!@Ru`l>z)>BfCHt_%~AxI}gBZ`X7fb493cBS@kG3vO~!XyVc zj3)OUJyoJ_m&x(rrG!#`9dsm~;O&A~-naBtal+`z5v@f-82gX7W+%vgXD#3n#$cX} z4PhS>9{nI55-hc(yLUhDY0S+qXFdUpIW56GgieZ^PASkY;i=uiS@KO=Of|*ec)g2` zkL^gw*My}tz}DG9aaUPc$(^U8u1;|vGwAX!ecNC@WT3WFUCrcrGAGa1+3aB0)y9y8 z6)V12iF(KW8yVKNRo4EJPO!l1_COcp-Q3ZL z$pw-tSKTtkOEBZeXQ-dH0Da#16Cunu*JAJs2BpL*NmS7*RgRrxm;cLqk+czX-v&RZ z`?S%dK3l%q!k40XLoTetp%?z;kMT4DlyM`<;B5dTVh~$ipuXx3;#ek+x(J&G8Cb4~EctbU0BXJCVk z-})GapY!@SFFg0Su%?BT<&LPwdgx)EF9Y4~`BEn{gAh-~l~^vxL>3!K*Z3p9^+76t zX@_;riQ4?}anNgGrMd3bGOPT~l~ z`I85i3I1|z(7q4&%KmI;6n$%u&@skaP36JmX4Am+6XEFXv}PU7YnC3tu2#Bt-F32i z9ho#Rpbo|}iuQ3iDC2XnS({_yrbrGcy=lKYS(zMmtg})1su5BZd+4 zlW-!TPt4uEbJL6unAaP3_nn>hU19|o(xQ7KK&Q_h-7Qx5dYpGNL}Ns9=v{$aiWIb9hNqJ}L0TAZx?5 zLt`k(*y(6sHOYo~F6jPYMK?~sJr~bsfv+UIbrvC&RJE)Z4r@X(UHjbWZXkX8cf3eX z+UIQ3CIx#Nd_=%)3BAREWd^NVqjcIhR2US062`a8gcyaNMeCSiYpC(`r%k? zMsr^<*`C9?AeNvv&Tm>i=1E#4(^@xy*tNhY3?Ou5V1D;O5Yl#b%uGjc&_rIq8X?Iy zH{Z#Vj;$Kz3>ZBIuywXTkc}$#7k|JX(waGh!MNAFJ&x9QXodTl=T%0B&~mq+kHPrh zBhsmK*C_tY7$Lo2Q9E`+BZPzsV7jLG*98Xl-J|S^pDqMuCc{g3eeuejP*hax1EFuk z%W-_Yk8imx(`WbIQq7s`WxF<#HqW!SZdd~ELihHTpa2ih z<**=DOWlB|u_5D#R#+~&EM#4~S)G>V$;1@c0i)-(vaWdstKz!Xu1h1V4)>Vyhq9Dt zy6BTq1XP&!gNA`td8E^pT|*HI#x;O0DQIdco^!J`UQ{hu9K>}N2u`O23H~%%?Yz$$ z^aQZS)Z&+~@`*qqkD$|+h50AGn|GqV{KNxFpIk}#=%%zChv)n+`l-&}KL@dgQ> zTnW6}ztb>L9fSX?nezk)dF3on!oGaY&V*(H)ERIm<>jmT?od1_u-AK>uY{U>zuFS_ zeZC(0zzvjpe*QWK@-rWf)_(osNJ*I+-*2TEjKL31H$qa5u9OqpfpSjje>ZEkWgq=7 zT!UCz$7!J`Zo@C`Mg&*J^TtVG1eD~?8i#fK@TC8hc&_&rc`!d)f`ZwCZuN)2)3vAZvBzwK-}3#)xCRP~@dL=*;)vsA4Wj zTJlY$tjDBivIJFdvI--yf>U$#&jg`#3ZHG_FXN^|(2TiCw1Fu1{jz_KAgxlyRx|LS zkRa*Dr+!nZyphgNBE9E#y&EsO6No?}=HO6k{olg~V_ihvP2kPVDC;heBgU?M42*y- z|NctJIaZSw1jp>#KTrvsQ&e^B{A*Pv#N~w?=~{Gv&J8d|A9)6`R;6)%*!Fa%7vLJ( z_HQE^A={z!Nzs04HE#Ki?|omH<%V5DG&(-umTnx%SY{mL=L0D$G(nr`bvO73^6vet z=j{!=1?e0!z7V7I!Nz2YWPiWyg_nTGk9sWliRa-6*(mp~-Z*6R+k~n4FMCw^p+h9I zb=_rBSc~FB(>!3S`@fJVAOdHMw-%a2uTfT@#W<;1K`9#-;rbvMj;6)`3Pj^;f7x&M zhW=+59dmclvWs@z0Zg*N9UUD6ll+$*xAlN#QU8brn+)KDp4RdlS%y|_-XFO-vzT6d z(4DgL`{3Qgp6A<9m6nHcmjg8J=wCKscfwUx)pt|!MdPyAlp1GWN=Pzg0 z4_=-KWzg}0;JU`6!I~LlX}JK12NveZey0AWjey$(T4hl1$aRUi5_@MR7}qchme!JE&6YjZu`ae?+kQRLL86h%fXEnWpytb72u{wQb9n=zD#8;jPk6u-RiEysMl;og$U z61N>6s(e7fA}lE_-6^Cc!JdX99wIE%auF1u{fDd4`R)?LO?fa|7i>wSXzym8Iy1AS zYe-E+18+$bW@?tE{^U!bH{Tb6iix9;vaWvtt7msf3__OzuWm~r`w87B#_w!C!}#lz z)OFk_{9|im2zmXo^Qn;jh`0slP+TR8cp|Tz!>BgeO;Kh0p zMh+`oDWI~H&iTyN8n)|=bJEfx{1c~iU6+6eAKO#=(@E7!nu3&FzrUh9iwQTm_^x}% z-Q9+J=Bk!+8*NIX&+-Qq?85YzYp$u8cM6D|C-x`Hqed{fGQqG%3AQoonyO(oV_<<+ z^o_S?jWMV>du_`FfpveB5%_k?5VBMHH80x6nUs{3IbtEbm#pr`sbd&w$cV1krL zG2y+_-u!@9dI8vHK)GbuHrCV(0U`ti#$Em*(!%)YdEO_LZh4OJB*ISfS~`)9{+N$I zVCv&O=7!aeX}ktweOJwfZ`FmQpsy(;4A(4(-ZuGq&(ZmCE41Zn8Yvs=%o4l%DXjVB z(-i;dS@csQY50Cc3HXZ!U&t10k)bLndhZ8?^tse^L@-0$ch^-!dzUze$XC2BhRd&3 zqFD#NNumWXe?Hw2|5$al)JaLVTT)i`|1UMt)7Z!hJHdxa_#|Ad;^d7gUhd43N5QT( zEwU5J4WU+gf1ySk$Mfpk7IXx3Vem&F#59^BduC0RcIH^ab>a zLL#*DeJ)yiEjP1)31zo;WxBjzTN?)t#xuLwc3nbc>o7t1EHGPA0n}VBn5ZsPqoip4T$98&`%-i z_%2Fl5pTet!i^-EX6VvX$pgtZ4n$+$H|B-Q6&k765*rPS8lk(tyBUv7?V5~ffBz!I zwVvKHa}$opP-5?61M8WK>Y&1BbJIz-*c=X^9}&T2E`;g(0m%{LQsqeJYrPKfi2t+@ zT`RtW-kWe5F(lupmPRB-`OiNG>R=qXX8U95AD}HG>xq=mlgmr>1k}WkgY&f&+uhH5 zfrwM6c_*v&7`NTRgFOr`3Op)72$0A|1EfYQmRG>FB=1E{Wl3m(SOt9fFD)fktZieq zVuDkmZiVGls~yma+w`XtD5UPXcTVGPUpZG3~v6m9Tdv`4>#tXzB%2cPZJjSw_H=NYn)!3B6@wUAu#2_*BOo3x z$BRm=ON0D@67**lR=5fkX)m473#|9Pfa0gy;n|?8s@q@&_YcM^p66DD?5Bk{LR<(W;+-aDEF>f&mB= zdY_;UGf1$l*8j47_97MTJwWJ>_MSdg3&zRv>?e#Rx7)15XJ03t5}9D>Y`G zqml|^dI&qQroH_}visxEPrKeWW(%&B8wDXp5uOmS3GnYf#P)Q1BkEZ|^KZZnDujLkA26wC(8kI$|9f?-zAa?cwDTt7A3!nJeQmL{Z*yoVJDi;|G9+@_XD?P+Ez4iDeVzf z^~ZJBTP<&iiho>tBY-}Aax^@pw);EIDC(-6_-5S(5~46QYHa7~&E-On@G<|LY&DXP z#C4f}KJJt=x&e(o&KnTy^ZPedG6gBaZ+>CuBJ z=&(r@bCvdMr0y=HwPzS;=#J0>8<1&6Mp;6yQBT9J1x1{Axnxzpru9f%kIh||?d2%h zWV%H**0VVb=G0VF9~uh` zCtrY%$_zgCU(9h1osU*JRQ~I2ZhYS03Qy*l+1cqDeO}W%S;+MJ`RC*obZ%g5yYqXA zdN1Y(1}OE)?cplsLe4Rmg|zIK`>w1LPQ)i)itBK|CoheB1u8L;vkJl}@WLY_-=;>F zVH>2_IKM8uwDbIXHmVW*q|e?U*Rl0You^Hu%icQ7m?+HjDJ1K35#6 zg>D~&;m&G$x!yKmoCPYz8S?Qz4^iG1xk&ijuZNeMki7u!U30ni?q{*XObH?y(bYN) zYf28l{`3U!PR@XuPLZSv61K#cV$LdL3V-6eMnKBEf7BbR=R14Ij=4pNB)L>`11Ktg zAxE;TyTCOjE-y^56>}ZF5p#=18)A!dC$4hSZK3Rb6?0L4Bpa@`lOj|;D38*cU9ff) zR5zjw)Au;HTV?2m;JgU9o{>3dux5n;_90x=+Y@rv^8;4rGx&Exy891Nze&$`LTIpb)m&AwL{&)wQiL8zv%qyr6x4U`c z+lV>nHA5Juur>d3gxEYQ9QnO8&gj_gvW^r46#~9JrThmhv$VD@ShP+!d#8?xDaC42 zDJ903x;3QmSBZ(`c$!-dgA|hqNKqk==%UQ3%6(Ss$#6EmzR|BUUkwC#?t(m~+Vd~R zN}g^Oqm~rpFZYKuN?CmGw}&F&7#J9?Poi1j>^o}JtPbRWc9*m_63Xn--_ptYhSlff zN{Q7Jrhc2od8FGDl&fdr!^;L_55CzU5oU&Oo%$v=O?ns&@l=2@-Vu?O+(4{>{r#Af z=bP?Qt*jAj=aNAVvhGM?K`IsBwrl9l{P`&roxBvd5xu}Kw>=)D*u?ni`D-a1;6m^x zfp17+;m;F)#Pn-UAH-7Jf%D3&4Ve&qip)QbcOASwBNw46Q2bgon}rFq(Y3I!+6sy; zH{VFwyuMyEF0#2j5GM{8?v;+9_Rc2~GJU&lzcfERV2*J2&)`NzfWXmeI4@Ns7D=1e ze^`LBU&0brawui+i|5z5XE1l^@wk$<2C zY7)3;&z(y~X{>F`bd^_0j(P2K4piO#`}-f%1W-&g&J2B_bG92@F)*RTix74QpSR|;QHwY_E9S|9^ z14^1jk&8w?pQSFlo*2AC3g(v45^H1cQB%CUG(Fq(ee?%KIT+^K-tTgQ z*21B~;Uoiq%!FYxW`%sw^-^0<3gS?rJ6dl>XKAtao*In)6O)<6XFql!_Em&XBS@Z5 ztWlnR*d0f%P}R`eU#CQrADRXJ%=khh{Z*{86;_r}(Kl{U=lpP!@f0 zeSZA<4Ig8E@v&2<&gh?QOY!{$7+5zQ{az-3R}%k@vYV1a{D9b zIPgwMRX4M>AeZclru`gh_^OYA0)~f~;5$`<&DO5bgR`&J$@3#W7?HrEk>RgcFmI<6 z#HGpLl2?#U58;ZpKM{D!8Uw$_e)1o`%TbQ^hHBQJ)oYvBZx<#kxP)RxnIu=P0vaq3 zetG~_2@c&SV5yrbmPPOQ*Hy?JZM1nU<{m{tYk68^w7FB?+lZ|Q1z!J3=~jw=FxwmU z+E4x-#2|oK2~-7|5s^i6aXu4i8asxpE0bWZWW+6E&OrAHe5>oBQoK;QlD%8hgx$_u@FlQCA5(fyx6bF5iLq<5@B8+C(~@0E8L19|b~oA+GgI;Bm-T@Ptmn%>`ioXL2MU(Z z{gmj)p&3h%jaUgajp+~a**;MfLlt8U*iAL$MAE+!f!)VqwZo8~UI6I_z^a=C0@x;8 zK#l1SLBwJMSRSS=xY2w>Xud!__-M76wYFskiAd0$X-1>>%h%j}7oXZnSkX_!60O1QK&ZBAR^!LHav_))5 z73mt!<|>QGVev?x5kjJAjei&iAgLgC0OpwK%$MEk@k8UVeQzbOWYJC&uCcox2#ChV z5Q`xF%f2Z@QId{pEn)R%UGxJn=20a8 zTz7kjld-U}LJGuJ{Fm9v;IKqe7C5F_3wV10d_r!s(m^or=*R-0W+xzdZUXE)5%6?y z`3HN^K)1JoE1gVIwi6>S>I+aXjR)rS8*{f6;h(^*Cct)Q(V;NaP61(n5sp<3N0B5F zps{GfQ8)_5kv=z{=2Izje0wD)ghn0XZl@j^p?rzuls=ZP$mQ|Oh)7_M>CNhT!%6gZ z%=14(j3MBI74_vsrumJZ81hWkiCAQ6=Pd(omdO4!4lB&5C(NHVhJXupGeD4&spcvw zI{NzW3wqS1PmfZUP75>;nn>KQ=XrVaSGy)SJx;~IZ@ToseE8SDe@_eo@W1)HM^(~i zQZ0hbI+gOArMF2B$wPj>(Yx_u9XoV>L1&2K->%C!DHIG~AtRr_08tPLU}Q)9l=HW= zr1poN^R9XB##+yop*n!>7Ai2nNE+qJckP$u#j7E*!Gh|ni1t9GXnn|NKHlieqwVwv zh$vR6{Nu;9cu3!a)^06RG<|B6qj@4EwZAhkX=nfJ6yce@!p`Eci@GgSMp}MQ5q{z; zQ|432kb^^xYWerl;%#{R_-Kn#9456kIw^GN@wOd|5IVeaEGc8Mz`I#kT}_m@RlY20 zwl3NOZHmnTD_z* z1Rx989XEvjp&5((Ujd%Q;HqO6YSny{oLcS{aI3eALHw{`oh`hQIY{lOJ@{JsVz58G!FsJ*_c=OIxPaipcz9|8{)t6C8#N(usCA4l27A7p0enONZ zQ@K70+dt+EbtaupGi-(M@6bFEM%4M zY;0@*Zs?y1+;|!u#|H~8y&L14h~1syU&tAGRWcT8{$o1 z2Js6AN!m*fg=x=nruqS>4$dRX@MrGF6L~sliXt5{Lan!#SE1P4gI%GDl9-Q1Q3Ols z^7+*19lNn{9ox5lCocO9B3g;F_N(3M<(;&=%t&OGoUm6I1hR5TA1=EEqTxz$q!Z=iM1^_syFJ@|tD5KEFD>=FuKYS+zcnQe)VQPBES6MV z&(>O3LT}pK9f0pJIW71Jjpn*YFcAHsxFli4Osd%5DBO4$~7l9vKCsPuDSG36q-uDEI(2J_z{iz6M}$|1#s^ zjlbMZwVgE};f}xpzS8W-ItC+ul>E0m6zPVjK=eC+6{`K)1Q4uvpUA{(j^*}ySY^`9 zL7xhBx-gD)F(JP&fd>3M#Se|BD@EhBn_I(?JQ-K%jrqg?J+3L6DNS>!=n}4LQ^}l_ zcPFRVN0PJ59upHaivivA zM{7-tS>NuqegSp`^l>8XYF^&i9UNxN497UoVtT8sDYZ$20N4GBcH>a*%j z>#=X)9vhyFRJ*f5J$9@eR1S>^zJp(O`|UQUst}Vjl1v-)RJHZO%w=5~>`!r+zO+a^ z*F1b3g>M|U!A$}ve)^MGZfL%sgE9Zot3XsHb*J@5OGyu7@2?g96xn4HsQ zhN{}2_17Se2Z`l-Z(;XO2Rp&$g3}Bl1E~V6RL!1Dksj$x9xaq$^%kSZlTnFW3UK2v z^;If`-+qvKv<&%#^qgU5*eGYd0i+btKu%6Vn|hqE-T*f;GD@iA2g<6PE#J52yrz1C2&&2i8Uge;3-!Y zU%Ws+<@%}JvDjsC!nA#34!JyBX{oC4j4f&h;r-iZvyARgKQOnO<%zVd1O+?|@4%nk zR*5Y>TZLQ*#ni4Z@uh!tR1!gQeFq;dPCKd$sj&Mb-);;+sBo!0#PkloN!6yN?Pa7*RJX} zPO^*AA%<$l4$jP(0u0kW`~ybV5jwUv)G&Sx6kC|!8N`c$_YDPN_7|A3M|yd5A|2_e zX%gj&t@`W3xAAU%`9P%zUHBUBqU-iTP9@azq(A2};FJBi#6a!2-~jVV%U#@C2z3!5 zS_OE!D_%6n&FXd#@l1UAqPvD%SR!7;g0{+VK9t|Uv#^j{vJc*!s|Lsi%=MMH^2<|_UfO12=Fq;EHm~!zO~-3kXp>( zpj7Y*LPlWU+X7{%$1{DF4^lsRM)rFe}|O15}DO%$j-&qK9TE_1RCC z99(Cp0ho#g&YkiX&py-iv3mx@i@pwc-yP4I|9;0mD96VD_jAna z=xk;;m6VjMyp-pf9V;B^Tm?sZW`vsYIimb8Z=~0k82uWar5g7o`4IimY{O2E zb1Z0$(@M3|hlY!fL(wiF1v(VaPYun=hd=b2fRT7cJgA1nQ)Me{O+`#0pb+k3$f<~ym}@28|&(l%`dKg z>xJXxWWnzuS^6=FW-q2~z@ei*v=H~L>3Z`!%Y52D zl`g9C{P+mf1;TCPPMUTGBu=n&1FV@N*f_Sdg351EkA-xYS0> zdXuUD{2hALVp}HgX1SY1@Pi{YO5bnXS7qs=A(vuTl^-Y={VKbqOv(ntBDJ&n8GlBtW5}6wu?8108sDfQ4Z{*pB#ZO@VY)A`%>OqW*xWibQ z9H3>UaY48~#L9*_M}7G!^XGf@-jN3G&n3WdiVcfzJ)@Lio6Qq@=rCt?_7KPPOb%-B z-bWKBwMZXuyyBREzY5aAN+8j4qH-tO(xFObUnz6yQB5m8lTz==JS6&89xN5!Eil)Lge z!ts&ib93hpzg`BhDZ{WY&3*W~%h^YBoH^lpv}*3qJLwGNn7paY?6ENv zyDTkHR=CC@V_md7Z@tk3WFhcS#;wrXO#gR96g+V(*nswEg-2T7By=u{cG+CuISET2 zp31EDBP03GUgeVDA4Oqt?ss801BOU;1#jjKqlC=&BQNl8I|+`F3%9NQVqVw(SQBsS zktv9aZKNKnxkvcTltuAMEdRHvl51jtE(6VQT3I8NrBq|n6$wqJ5jXrsL9Upx^U1-5 zSqw{A!`(C~cNNu_fAOHb@#talvG(gD-l zh8Zf5#RM|_K_U(MvU3PET}QZm#M;+gr>gPMJ-+wLmkhKRCuoM8+3D-YnERXLYz6NJ zZ<^hD*S#L9MQyaXvt*Lvm2KeoUTf{0*48`ot#^jy$}g>0zw#F3c)`T+u9H;n(`q^^ zmL=~vI|b9!J);!V?I~QkAH%QR(Qu}gp2-v*d;;?pCb3A8NwE6;Zqh{~tS7GOHMeYv zD_XH6jQAd)z@y|q3p4i&|AIFs=&IMwxk5d^KjCj)7&^JC0L!EYhQ;mj9dVhd)i2oH z+Xy0$jcmT`KM-l~lfBDr-3;ygZo9U42I|0&h$Nj6A~n>@Po3xvDaa%Dff<;zJBqTN z4jtXyLfgzwyM4`@oA;32pHHTHx};~Ab>CVPza}lX=$V={7|x5eW^>M!xI)E}iLD#Q ziTyKW3Aq7MBQ^olnx#og2m{UW6XJLl&~d!VHdPO?Jv+ic3U9qGhW_h4vX(6`_kclc zl_VQ;EbdLW$l{ilh9y|`)|v**>R@ap-)CZcFutz{IabSz^tla526#8FQN8oU#6;SJ zgij&(<@@*a$V&A=*6Hl9ysM|u*J3>W8P!F;`m^-sHix5HfILDse&zfrcg#|y_gL>n zj@bH(Dd*<~=5g=8Bc#!Zm@;nnQ~?o<*1yY_mo zRl9@TYto->uSXAxG(Gxwtf%)(4W|9b!0=O7hq{4^JT2W)!fg&-cMlIz^A?scKc)@^ zMVpA@P(N;3+NIl&B=+9kZcb&z2b_9$xf9|f?pkyFb=uD^EW8sQ&)yA)G`wA3w@d#y ztm=;>2NWzBdTM*9l%aooV8M}uSWG)&Z0~5+GdwG?BERsvMQ8J=+8_PF)XhVD9gLeQl{NKfis|^z z_~zKwRuk0xAY=s)7&lkg!5#v3vn}4<5k%4HV z#2p6OfiBourGku%dCdpQCU5?WGhp8C+J^4eY@HPL^%3Ihnm6;Lx@l4xiTQ)wBtr>v zuT-2^Vqs3dvh_+Bq)G$m;#VyEi!pQ(fBQU&;eaf9W}S1F7;H*fcHR4~GiAoIHdx=Q z+1f?b(M$S8t(m@s$%7c;--82vBQw6u&Yki4Ol%?*FRNZryn~S;WGu^Cq7ywb=j%hkT77pIK~E?WN?Sv}iAn`6%e# zcG*f`eB;IG7LAae!lBXjY;8$Yp{W<3iNW=$#wjD#F0Xg7IL*CRfm$K5zpRZsuO~*e zJ`u(#A0n3(dno?ez)22t|!&7*6vn%Oll8SSjw9PwSp(ljWh_>Hq; zzxzDe@ri2p6|ZW&v?cjOOZPE7^&b0J!~N`EG3B|Vp;dpijZ&X=)LtA%%CpJ_nB6%7 zMCd7bkUUG$z}OAg{hWTJ-psASawk^<#VJN3nMca+Onzs&ocAduOU(BH%6+>IBj=Dz zMrNmd<$`jT^r@fO&nTiK&s$%b8`X5?X|AR(tS$ZK<#?q(d>r-&(F0C@$FVlpogQ}Z z_N3O7dsYUrd0&X=n0)O2N*~8zaX-I1t-HjO;xc$umA@fM4IcD zKLO3Hfiq%OTrYaYLDvWp#neQ?_N{)OI}b?jmD(VU6WU&8-Y`0%JCzap?Vtv;tSOle zLnSvV-rBp#^A&efJ5BEJSZ~DS*^gE4TxXc1;@mmeBmBN!4z95lCK4_fm7s9xAM^8P zPnCYFy5tvh3&4QoT0%i_Hv2x9x``<=oJhaMus!ZdQ7PadASKDju3R2d?B@9Mo(K=m z4I~m-NG-JxAZ`Qjq~3J}HE{lxeLL-hU!P#fX!2Dx8FN5y{Ay#*)y-(EQW>Anq47pV zd>0(?rSV`&@R#8#pR2K0KctT>C|`m9_5>4Ti_Tdyc;i(Gu)CJ!46E_9>)0-9eZzV3hsIpA>`sT?R zRmMMnXa9`i;2_N7ip=8HEtoz=J3;Ad3Vkg#vHt$%zjn66#Toa%_MWKxxsYU;CCB6z z6d>UdLA@xKrxC72txfVFx%;%()B?z0Zn4!W>5 z1UcD#IU{?Zr)YZy%vsh>Rqkd5am(^PI%!^-EfIUW_hKLGs<~V<{DTG87Ohj(L;`d` zuA7vaF;}_jPiAz#OlCS{&euO^E{~lcC$?|*eo5sLlwnAu!z`)4Vt-LNVUP+}EaT6` zxxQ&0+qyVj*<*~cRbr_yUW#v-H-o)l zdMZI^V@&?~HA)e2IxfBYyYHp9h3vJ8FC${LH+-2mdf@QO9#>|%5>}ns6RCM`x=jC7 z=5YpDAiu`lS~u&HO_lcG3Ow7_2>rU9PIc$uYiU`ZojA!I&yPt-l+E*`a_UXG4x6OB z$gzGdQ&A8s_Veh9#HS~wqbok%G2WurTW%9%`A>JWYg0yXMHv|;Sl;U>8*Mo6RlNjX zmuSaI{UqzCI>T9o!G4E=#{td9dA4Ro5gj2U^bCwSEiJ56;cR*ZPruC@HlY%Ccc|_Z zGAa$-jGm8K_G4>WTaIY`k@OYpOkDD3##a?eMX>ldWUqY}vU$Q#%VYv81224i`epUm z22$|zdGHroL@ciL^uf0&d9O2>hULEghnqEHYK%8K$CL91zb>^DC3f!sys_^W2ckk3 z2pWgs^sv7$k-5pwR2g!=M+HTh4wrUVv>>O?l@&$Sbiag>uYtRId{`b5Qf&8r#6W?Y zm9y~&H1j<(gBO~*4RfXf7k0#V+ z)1nV|>(hf5(ShJ6=Z1K5=}~i}#(j)_*q=g!u6O z6+|OV?NZ_(IO0@92YYn@xt=}?2)?o0&WfAzlKLaoZ}$35N!>{k0K#txZ7;yKO5b4! z{8rv0>dJISKs~Dn1LRCFSzPGPY;nJOzO6V`=V(D?H zo%FYYv5B^=x+HX~eECE<_OtSu*|KZ+s-L=t594WqX!>iF4#9Af-}Bd4a%lMbeuxbm z0QOT%jRiZ}%Ql=gC7p^oGSAKLN9Hxqr)Olw=6_H-GyWRAgY3Q1%#6PKF*!AizSL%X zlh?^-+WKoWqn5du!ji@7Ddjnw$e>323a-<@oG%hac0Tarn>z=;Qd}}Or2XTAR?LtO z4$B5Gpi3qW3+1y#gbx5Er_kTFh}lA)b@Ww0FO=qK%pLw##jkM6;a0prRNpf|XGt3W zRAHOzt~*1n8SP$`T}HZ%C^L4$IswMtr-wP@+ALFBK$hFnKt2xO==DV-1BEGJsM`Zc zQD6uq?X+YGn*+}TRv_BH#QG+j_Q0UD#aeBjU%0%cMve9`Ons?x;w8Q-ngjAXj&5O-V__UTf*)U zVbmjYHc<;Dc_*=3)z%D7zwH;Wi0Mi?R#9Q8O`3xYh~66pFdla`x}{PMl1XE$rEhHlV{^fS|BmkQB>+PJZ{R#ruF+dold;e8$1(c8}K=Q#t)S#=*xWvQ> z14!A|4>DStJ6QsRB=t?dZ_boBbz7q((-%O0Q@ZBz3b2#H-xH7i{QS)=T@l3L8PBSY zjg*i7gQ**)xsZ3O!epxh-!r91w&Usf5#STg*18H_=sh&9Och>&v>%mPdhE4dWt|JU z(hS9QWLm?Y>zk~?GWf;IjMFBU{?p+@mm%PI#YXBTf;{=JajJU8#~%pZHRrmoI!Kw{ z#TJ%U6kJ$pOU> z>#NiP?W50HYXb%tYF&Z|z~I#H&zA1W2(BH#(?T_4C<8DI1++cH@5FjcH^N0HAv3`( zxwLndmcH>dbPK6f7_8|LEE+GYOAI6ZWK=}eSG2a9@^-nF$|9gB0a{UmgZY;>H(}ai zQ_fvvL1`IkExO+@V<=f!NCMMc%>m2rzMPXgRB{5k50dDa@){~M$0tmaQX>D5pT5^~ zKCEfTMkc|{(e-Zgv@>qA5#wilQQDk+-2uydsEDC{TacLOBhYv;eC^Vjb5NJ?j_sraAAgh@EI%;)~DEj@BoT7Esz9 z18*A|yrk)Qi{G2-&IbkaW0LkX|D?9nyTiD;n`^$Asm&+EVDW?r**$HPq4LjiJb6sr~1Am2V~MVy@Gt4@wE&Gimp2dRzrqbX67$D zzcfy0be_gCs#CE<^?|S4RrugoM^|>DT0Q$?v*MMl|5e}5OpAmL)oF82wU{r-)7Oh+ zuYK2B7}f^7ux&?_TQE?8vYp3WYhr+C&qH9sI7kUX+YPvJ`~dt2V>gc-E-jv262023 zKAaTH2UiL=Hy!EU&j@|#;ZbR(nZ53lJ%FRNltMp!RG5RW;JHc9;MYpk{ z@~tn##+bYOKp&VX^ra=zXP83hUh$9k`?Ey8=AXB@o2DkE{wIuveSUnz-$jWx7k__u zr{a?sJ90j;A!Tc0W2qo#iZIbJ}y}>G0&dO^pI=t$oMS(V+wa{oEeizY5xW0~PG_*2nh;#p0Z{+Ob zSj`MxPKadxh`-DuAciD6p{z7SbMXeDHnezOnt3Vn?|g!SG!LLWJl%YvdE@Z3V{Fv3 z5NU3K?~Jd%J&3xANHY-*dk#4Gz84(C+D8@0i>i-UG#%gQGcniXyp>t%7c=P${;X9f7L0~0@C$FS)N zyWFEdK%KHMvY=k5>sngiQ<#hE>y6lHH-R4!Nvmd${d_nGmk->6Dhy4F374Xtm6UA8c{Z*b2)3^Z`gMFn+) z5C8EfB6fl6zuWQyc_>YlzfDG{f^&}Q6$?^t{s#|EPTC*LnN~0!<$AU?HRa>|HE!nN zHwR_4;bl*S{XwVgA0J)OM3038H_6?K<&9Z>+>Wi1PtTlC9&a`61!zN|n%fI)K~GGB zJP%0ZYfemGBWsnLhORXK6ngv8c7sNU*_Z8U?fSBIGjA|BH>pebu+|h5C^54m_oCxu z3=Ku!1`5|s_sV;USUzMC=#_k2B`OLre6|NXha_zi zRkPtuX!ULUt~b2v&L;Ihj1aF4)_zJVUT z8Nc(*(LSf4P;;5{{{5~Ji-}(}E~SnzRAFpNce9)dxM-`-1IQ6?ACxuuYdcPXa==`Z z?q1m)Z$8XCTbkdD>l5_BdjhBRShDDYjaU!e5^!*rR^LXv6726+(|HVZb5`uRcx=HU z7kXs0bl&Tub;6!inD#qNye_!ztrrjPiHHmV^GnH;cb0#)T;4>9Dwp5%_bb3gLlSVB zC|9Qc9og}$840cOuUtph3;sxvTqx9Wq^y;P?)X*8?I=W?@4V+<*LuCtRXF5w9c7tH zHrhLGi7u(^uRSM?rGg7Hyeqm6A8KIPNfg&N{X4MI@Hgwru?!Ssfqcy5b_NI;W^O5_ zF>hF~QDynE(8fMZ9dM}3QWGWD+$1PKcdc6XX9dj;aI!Vd3*>pdu^Qoe)@tLJH5<40l)cjPD94Vx5@6PD`V zGP(Zxnu@}@?}4>YO!kqs!duKOcv2Q-E0p~$l`~Tc)weALHcVsH&@7_R*6dJzDjboxd z3yY6?6FmRA$i7BiGot}{j6_tL|tWOUtw=%e?#amIZ%m)zC6w5Z{@8m~Oq^$GgusS~G z;+J72qvq&I_m9?huLC%1G$tiASF%(8L^k;sCr@dI*c6ASdF6KkMZQu=XvwCBj4j5&qzf2Hjs|jm1>srR)SvvnAIxI7A+`o5Y><3T2HL%gie}H(}Axwh&lnQ^{J!E!0J=;9bz2oA%7Iga+33% z4IxLn84860wy;&L<-d%|MM7+1Z5Rm{9nX=+Ky&YiJzlK%v-gBYcFS{bPQMquv`%ToqRa@{eA9r1z8q<<^G|B}3zVdD`Dz9KZim~VmpAbI@t6mo~p6e9lff4yWQ$_cn zT3v0;S?rx!{lj+dtAbt4m>-#4rK2#t$e&xrBT$0kd$|=GEckqPBj77gozWd0t-tBf?xw%!W_5hA3B${$MVfjo` zE0QS$u#@rC)O_|t-Cw;Ou$EuJ`WSNIRnYxU{g*6p_A$JWSIYmlq24)OnX?^J4yGVx zUXdiVw|HhGeu*}j%WNZ!>oCZQ;`tPknTwx5_BVI82Bm-f8dnmia{s(A*@iWe7)2r= z(0e$85R)%qJI$|G?gggDwkXT~2=16{^U1{dH_E-mVU6Dv-R6(f9Z`XVPB0*O^})$| z29Iq7UAB?_UCQrw)HTF%oSDv~&$Oj?BvW6g+u4bIF0~22h4EE}pgDPDv?4rcatg-b zw57%D|H2dPkE&_oX#d~7;3aE7%inOHKSY!ZpKH$+>Q|tCJ-S;+W4ZKU$>zE`MeD>S zfQdREX|tiMwb}{-@l>>DzS3+|`;VUA3RE|5Y%q6YO!^}D@lJti_|c5hLYeT=(w~x> zuODB4h0npl&fR%O`K6hIlaHP z&Y$~iX|}iQ3OC-TpiCb&EcO`PzjIW$+d5#^S@}1h-I;93;Ne3tkV0ZLT1<>CTo-9( z{3%*u#s3|WRrBW)4b_l`?S?VLE?0q&gQ`L%tiOS)V#askq23F}-^z0n&eEAm_Ox}o zb777BroVsg%YQ3)z^w>`<3t#sk2BS$52IZ#<3sgRf&uHH``8SZ@^Jl$KN;5*gh{2B zZ=y!4^gJ6=^6YWt)EaGlN_cVkY@&SN!nDYq7imBPxYA zxgT1Am5GRtrgPg;yM@~JEGNXF``wP|l|`$V#wGCgr+w&a3*7GSnxn=4TPEla-@Q_B z-SdT8=(+9{Y~d7;%RYVm-t}Ex*h#8Q18Xle+hO7I9?!Pwj<2nCl45!YHl>2ews~kW zyUPxsVNjw6-LKWa+Hc3_pZa}sIxL|Mz|#yCQbgN!`RL znAOUV11|A+QRoWO6vF-4ceS0~+O5b#qRzfnx1_Yd0GD-3B?xwdc3%6nDNOiV9o#sq zrJ&HXEB8~B=n!(RWjT#EONDFUYDOn{^jI)=MUF-zdjZq8>_i^&I!fVfSZqXJ^twC} z8y!(=pehQK#uE5kUmKcT0d9GIZBaLFDB@98-c;=7loud!~uv&GkK zQ-&=X? z{=DtDPUe|mLMixY37_lzSXo}^>8&T{t6|wG1~~P3`NO;v*8#2eXm6k73SJsf4h$NEmH9y&JEXt#f{z&$2H-LHu zTU*@QoXvj{bri>LcAYoPAsW8FW%%9;LPSh{C617BZRROx+oG~l-WJBuIiGr-gc#C% z9Pb;PPO+v~j`WGLV zwnKnU-n0otpHSdbPm5&A#X6~3rH@BrouN^8VcG~@v45U*R=ddF&6_CtM#61;6(>76 zO#26vF9fR>VslN^O8$)=Z=cRVLc$w0-?T|!7FwN$92VVOke%YPi8Km8egF#a@>2dx zC1uf8kcfxvTK&!cGqk1~okO{Lskj;JGZgw=4$7wYcHQHx|M??hl0+Udd!0U|Uqzy# zhWJ$t@dgANu7Mv`0zT+MbHBaYMGSB&5v}hnFf;&w+PKIhSIYNx+QU8Y(bJ@SP_V0{ z^!(1|Yfe!$)RKF-Z>?!p%iq+|ZR-*E`*f^ckDngrs%|o4YN_WeO1<^h;eiSoGbeEf z1T0;ThLjr$h@EdRSaLRRf~du{yMGqZF3%10W5)f2PrY&P#>b6*dtP4d%)>vvcJyD^ zhd{x$4mi1Hx#kjUo$0H+`VGuoJnzKrabF`9;(z4PeuHY|wkfOJkM;QLp5>k^qznd? zVx)9T#$9?y3XoUZ9ifoxH(!@MqSail6Wpieh;L)K7aE@J6r3Ff78ZV7$BU1IU>adnRSoZqc5ak8amCi4xw>RmCvyt;pTBdKDPM`NgAt^HC zAKx`TO7db=k{twW?24u~%O)0vN$xz)p{~E6K-3*7-oi6tOI;wrSTesGFdE>)4EJg` ze7E`3bbIF(mh5ax@YtN0n=#;J+Cb*;{?NwSzLU{f^A7K?dfEQw^?5qe%de)E$b~a6 z{Ci#uL6Mi7<1rou0T&M27oRAOuW@l~m+D>`m30m|bhuT+{Y?;39x@t^Tx%xi8FT}= zoMjeOj}Bol{N93P(Qqi7X?@4UcLGw9JGCi!r(COgqccFNn#D_Dq@Xa@*s( zUIh-SGC_ys;)-sBnLN@I3Vc7fpOheiQN^)S#bb0D4G>Eo{>+?9hn|WzQW?gEP7Q9a zoUXdh+G|FA*=&&moZm!0gB-bPGk|)>>RP9{7Tp7heoSZ^1b|;5gm>`+zo@>VSh3|QZa7D>$hSSdN ztXYkILO2P%Uum&Q7U@a!jnkSHY&h)F_`g4}$4by>3+!f6A;m$0g&~!M{&e0z z-%h{S+$Z|O&lP72)=ZLxoBDzGU8c=2MGT3D)Y;frEBb&vf-6M(`tDW(4{mrh_w8KNT zToP_QGO$a%=6>Jl}**itb%H2>WK5xc)u@HgL%bcnm}+P^a~Rhx80~wy3JWaDb^qB82zDft#&0_Z^En#N9%>A z!zFy@kKmxcz6)e9U;{FoPS-9H$WE<3J+Gjq(&j1FIoK9ik@g*Y3}~B}tj|-vds)P? zZjB6#6(;PqDomF4HFx_2YM@9^zz>Uf!=^Q@NO(U;b+lUDE^0Ff`sw$9czHBEb^NoD zY(r@Lly+QtC$DYviPHMvXs@`k68+kFXP^=abUOb$Yp-9N=w|_E8jPYoAcnJ`mJ+60Ex{g01uBgd*NFxaN*0y;MOq(Rfy`} zT)m~vfSZSn*O`VABe@PwN#q_ZPLHUv%KN>`uRSS8sUnLVnOO%)|QPY=XMCzL(7^7487hCGcbRPBFFP zdMAQobLTq>(p<0Xf5Nx=rfe|tX-6sNc)jpAnEougWCMv**U=1)TrF_@if{WV@`u$$(xJZJlLG z*k6?GcYA21s8MUPb~Fa{AZ*huyOfsn&E>)4E)3iVjGH^z^%)riSL_=@1TE>Zc`!B% zCUtdTXoh!SB!4c(y0ER)K1UIU!GV6WqCh>0bB@D9mYQ|isJ3K23k;&@S)+k>aKnhp zh-Ua7b0oI3%(85fxEYY@$6+$lsO;~4*}^Zs)S5`^y)o1kpdu>XXyy2$2tSHCzSS8FgNG35yDauz{mlpkHB#vdE`6Rs z$v0Pq$FU@(l$9MgqWje?9hpdfheZX*(u>~0ue^+8OS}+5W%$>>+Zh^dzQ^%lc}4~X z#BfsL?Pa$oHuNN@F!+?qf>vh>VyB_M-t{K~BD>ry>|#%O$`j(aU#bGhk+sZ$5_FIi zUvW#piYRLV^cLlRkAt{q+gF!!*bVpr@~v1^ti|8h8x@IO;w^{^n?S$S$2ArudRBQ2 zt-GVa*uSTLvsT8Yywff{TMe>W!+=0LJYh*hC`6`4%FRhuhcitc-8QCpP66B-PefAA zPGGL}!)29%&^FP=YJB1fMI%Yg*H#yI#|^|5;_l}8JNf#ap<;ZQ0msltJ@>3WhPulO z_?r*5ygZtpv42^I&M1YEZ;h)=#`EKbYWUp2=3x_Pu}nbe9vVZYu(8<`sbV)699YW$ z3%b<4D7pQgYgFbl64EluWM2N_l527I(2o;1Etl&9&KD;gD0$c_rB<`ouVslQHv&ra z%K6Fh3Jy_79kjNWdcz-t-*p^&MbV1nOfLdEJ)kK_lq^@MPt3BN1D9Fd6Pft}vqeG~ zh~D>XB&RKX6t4$hw3N*Go0Yuia4Z|ynTjxQ6VgBu>P>_;uA<1F`f zR3lo9XZv|RZ$>A1iuDSkITV*C7tFJ5b;Gb>7tgZmv$Woyw?BcjDTB^ZZsI8p{*&=^ zqwXAU7G8%RFfST!9lm@N`1>NK8vHj7iQD_>TryX0dcSgn3Xd|}F(p0S&I((@1fK3e zp+WSPfRtMRZg>XzDWdliqm)hI-q(}&BJCPTtNNv#$!P|ic~1YpundlmYrrLkp44SR=G#r zzdOfjb|h4RV8-jTA8yj}| za3wHTbI4-X)mXccYRnKW16!^D5nY`dagf@!*I|LlhPyj=n}Tisr6jLiwcjyaSzxVw z0l6UYJBPJq$JjR1ixVzaJL->*PR6=wd)kdXI=_#W!yek$Vo+)R3&L37Mm?^)p)ZJq zzDKAi#>uEgZ@}WD2H2J@e4DHf=Ouh+j)<)X_*MfB3tY7NY(j0PWmqfo?Cw}K-nkHR zQb(+49qK@pqoH$c(IEU}2#0E5?jp(QOSc3rwm8K2g%1vLgEy6$Fnmkaqmp6-e%y`9dO>_@8Jl{Wm zP@u`^a_!UXZ4wmxbkPom%4sE3;!pZ>6wkesq=y9-Me-j=zN3;7f+SGI`i4slvo3Co z*nCZtp>P*YFCVfbqHgtDmW>vS0VXhlt%q2Z${Qz7J4q0-_lC**+d4$jk~o?YDoPZ8Da(>qWZ^CA^S6nbEB=MIo@+cD zcpF6o6J&Xk&MtDRE*{uC|9({|!K9R6h~t)ZE1A|%9Jl-k-P#JM#airwk{?CuMAI+j zm!LT^Gk1Z+!vDC!y_^?q8HOz;DgZePx|99%?Po>cMzaE@H3`)Mj$6E9Ue7f%G3qQ7s$DSoccd4iG;ROFq&hCZ;NR9(- zeA77uXr=b4FE3)D21w-*{U}TOwV`3l!ukw6+ej+#qnn|Su;lOmBeEn1>BWKtk`#<@Ho5NK#={0L85Dq@Cf0$8RUcIH>( zIaGAtHu3VB4Oo$Los2Lz9+=Sd0C6 zwKKhe4Xfxamm7gTfnPgM*lPM38Ioa4yW+yf$yFR59ffg>lfZ@GfXDzHun|&0hr6t( zpaB8ANooBgoQPohOLrehz8Nd4Wwf?;p>Wo*XJcy0v8q zVX|AI;O1?0Lqo%udo3#rzRnT#M{ubfY-z;-1KiTmQJ5g|CMC*{mThH5t0a#y$=Lk}nztJr4O ze}-SyN}++26&ILz?ZG^;_rJSeEyVV^;xOs-&leCyin*o)$h|*wy9Z(9Ona-VqI(O& zfoa1v!=p0wi>BQ^mTOZ))^jB9JfRhrO;kL_xHjO~lJl}Qa)Mu3OMiBC8hiIcuK62C?@)J(Q< z)>=C@gH;YTeXGBkpKxRs9Olz(o=qs(>PUjiDcRm(T{lh7sn-rTt`1h+CpB81@D%;e z_1nS5@+DSEcAA4M@X9v!r&PkoTJt0~lzraf2T)pr*;~U2yEINr%IzxnZIb3e1Y0mkN)# z8-JNq_*LmjWhjthUMzBGv_AG34#K-r169g35`+k@<03o9Z&yqT(q6v=;C8l+(XB)l zqyL<58ZBXxscXEsv1SoEn_#PBDxi;h>}(?Xu-1{cw@hY< zq^WieV-9yc0rnSguy35Ul+N~lFBJ?$XU=P7?dA{|VDRsYm;ChqiLPp8lWo)M&svy& zv|b5dYp}~((Cp!z!#r02Wv_M(Fkeh{Tnng@P+gmA0Sz#Ljs-Eh@J{02)253bevO$3 z{Q27Y!I#hHZ$PbSQIK+G3*64y8)QZawwD}?UYyZkxKKX7)BK>%Tf6b$)dlbm0wLO{ z<9YxQxNBfg2dwFO^$)BPqsfeq?1dHFBgCRv_tgdo97=DUEo!|?iI7A)0!h(r97%xP z+iWOKs!*l;GyGq6njp9@ym<0Xck}Mn3rOaT0P$!2Odh4jk+rM5-UX`*`+1Ok;tAb= zt=YXY3E1e;CSjx?-jR1+)O3A5i$^dkr2(CVP`~6?s~2xS8po{NlH6EekEdf?Vr(=S zuq^34-k7twi|o2_8d;-_8=5Af4jJnb?^6-iFl8O?gs~_@QySI+=LSeYKFKk9U1?s> z_;|SN7kM0;;=qu#oOM5{1a0{aC#RZq3%`*BFF_Xw6PQ4Frc$)ve?Wl;aQ3{;j_Egp|>8woG~bpSl@?)uKPgze`o7oUmB45!!}zyBf^5pS|D zZ=T6X{%{~A(!Leliy4HeG9x~JDb0}gbX%))MRbHsf#uH>6rcNr%yg@Na+zPl&vg%v z5PQ#OZ~@Z5Bn4*oJldgzxWP=sC(rv6x9QKMIXQUJb-&6Z^_O)I|FEW}ep67sIW1Wu zGH-0_og-Uy=*_sC_tW^#&UOm|r-C{+FWD*U$e)wSqhcD$u-D-4O;9D9Y4j>c^8}zA z$>Xv%6^JznR`l5d#3-}W&Yg9}2>%KjG-OpqW3O2=VeMgz6ko5jrA zf7MNDRyFiTOR-9UNAy9k-SB|#Z{vne)c+3F=>XR;fwK!r_NOu+t`*`lzes@!id~ta z_%WgArpckpyNDU2*qqek@G;x2@q4wyHw>mi^DU{=hQWgBuw?L(0BG)Xm}kkjWjh4Q zMc@P|@zv$NC*6JbbxKJ=YmWR(ba8qdFQ;~`$6Z@haK#6lXv?%VIJKqaTC1M7V zC5qTD@ZW9n{Tk>%bUKFd%no?+=61LwQP;kObnAfWc2E>}a)q_^ z&MTxWjL7zQEeBtZR?djhimS(;X--NX) z{X3PeKatBo0)0RfZByayXv{lA{U0aQD!dD797gkH612)I6ojG4n zdVxS)v5Yb$+0D;3RS`k`=g6Uva!UNhjnK9HWFYWHmey5^ib<3-X|Q1pH0br~_ z0F3%ynCj<;6Ry3!?WOI~yW4{!Z&w%FA7ZU~3SbbsS<;E*{tJ9hJXq;RK}r0XC5kD{wuLYm={ z0U*pplQ7z{0!Un%A;JWis1=IXhQUTJ$6p${R2=Cq37HCyH*cBdK@`90XXpZ3P=2X>C+?4$yC!u4&$%e8TCCX2BNzXhfJo3`IG7RTrg z#y`8<*RgB2$=7asgbpVng0Twh0(j2Nrn0L_OmA)*fzT)ys z_BOSye-0kK1yoD*uKY>;-kPaj6m-kRUYsrl`r@#<)id8F-kgZzcLM@{-NJ4`8rwbr zbtnaj$Z`}0``-~N@hx%Ncewe1d3%uKDuiYA#!o+E+)jFvac`-%d*Iu@G>X;7cd~?p zX^pqKV)HRF3vI0;^RKc7%a2lhW}%L~Vbr8&jj*76ELniuD-JIKmpxD{zs-WoQ%9gx zdYt1!chZuzoi#1-fD^sOZ_=k0##$}z7=e+X;+O_3YvF}ct~C~JP(@(x5kKM}8?#NB zUU=V2E&%pF?ysL~Zp-`M+Xj%cht)e3@6YuXS=tXfTW&J9{f04S3NPnhJKBYx(X^ta ze`TE9V8rO=cHh-{eKkmC5GwwiMlE2CVzd9oSZcc+sOOyjDlIMVZHO}b|_0Zh2kb48K%+4WQ44!TglUzGjt zZIV_uExP4Blyf%^w_n&JckG^f zUG|8ldO#v6%reDs40mAXWGfOi@2d3WapV8j)3paOy}ofKo3Px zywCeSpXZP7qXr`4vUcV9|7AMG;vf0{b#h&P!Jj8?#Ld(9HHF;HeoPk!EM zk`;u2CCsKL>O46HBL6z*sSGPQadG?sqQ(lt={v4nN1Wsr>EoU9E;nwS%X~PT>}{LM zPi?*54_(w68?%1->ADsvtk9*=ZbwGLf{V*fgb!WcL?s_I`pOGzz^?# zmmDTjn&dvMm2z(Jg&$sG?FWM?+jgwA?c;^#s{@&*UVvw!%UZ zzca-SnfakO2__FXco-xhcAm`Mi97eK`6ydBhF4_bAEITQc|gqlTbaV$ykUD=Aedun zC00+mb?Bu|R3AdsHefndp0V%?P-w#TDU2@g=h|q|$H_jix60&rv4y)XaTpjY?0^>*Lzm_a8Pzym$)olvsYQQ796&GF zRUZ{)vlj2BfI>Ce+@;$bm?=f{X(?WOa%Y%d&7Dy2SzG>23r>mi{B7i&jYzYr77Alq z5>m_$)IBRR`#8hl_}M07ZtytMdS z(_=aG2NtLcWq4=Fb&?g;@hRtk%jZ?|=W=43b3VJH{-+}MOj6x1F`~lru%x|r@GVNW zfZM+Jt=tl0v`ZWQqy1pt&s-(J-Ix`%`;MfU?D>KS@PE=s1|lZ$MXy>I_N+ z(MwQfrH*Z+x*q@rfD6GE2x+1Nv)jVL9^4MH?pJNxk<#%zr=ApSMG_6c?Hv<|qEs-aCwrSS=XV%3HSl(d0SI19*vB_^tX>R`ZbLNOtrXaKh2~fRN(bc{{SGY@Yum0ZV=`NfLB$R&q<~(qTNw)jb9hg z>GBUwQezeq%`Xn|f;l<#aj^AAVxjk7072-{LJMw1i8Z0jVeiKR1U zlJgsk!Y+LjXzZgST5UTeGR8r{85_a{g&smx6QSxS>XMQL!(SxWQf1(FNGOz_EY`jI zs3GcMRhs)nhFe{JvS5Woh;PogyF^smuxqZ_D|ec#x?AUq5dzS^qQi-2c2SErH_&Y& z&v)q@urp)jFxgzB2Klz#WeldSEmj9D4ZC>0GlvuPts8%R5xN2Gp1BKl$~106JCKxj#v z6pyiK<%1lfq;H1_S2kGvT0-4JSjr!XELOj@b19I3(s#mt?t%w~4kDLZd+7@au_&&DKdJSluaTe!Ef+@|5S_Lj?gN zJ#7iolBUuDGGh`uHMqybmu^Xa>fP^6h4Y3~tE5UK;%2ysH1>t}B2g={DS#dFy!Hr7 zPDP|+2~}z$c={tnC9=9ZC%MDF@Sj;2XH{;!M6b-6m8=leYOeSgM%e~Z*q2a^yo5Mp6rktiw3X=7pCI>N%bA&ZX-{KjZj zfd%+M;Hqfgj)f)2as7S6Cs*1F3v1IuNlr%BCv7tw&)?|xSa)WzfUi*nvyBD?8>dC6 zRC|Us6(QAkeru{@Lp?i{KEbN0r`i45dVLwzNeCPKJDe|f?7%fmoDOk2-lpry`jwo0 zHQh=6m#$VZ7*i7^{bA_5`%m}JuHwXD^!x%|GrCyISfWO%t3vIIyW+JI?)L%>)Ac51 zG>xu2A>KXfi>^MzYzFrCisuPJWn zCqSK6-(6J8dmhf94t`{#a1k(z+gQu|^@t4S(`Yx3^cZ2{Cwb@|q~~ew z^AB$a5_)`^=6P8%z0FwQ!y-~9Heu~|IM_VL^v9l{j{H)LO)({!;+vvK^uomRv8JKv zAunBVCa)XFg0h09#{3Bb0`r^cdbcJ=9i2SBWqO9u<5LhpxR?dJQdwH%uttdeF32QG zo!|B?UnVKQ>0JibA9_B2C@nr$))D9$qcGh1QdBl5#GD5^hEryE@L}PkMz954*!7pL z3=fqokE#kCZaT~5Q!LXK{WNJ*)%0&_u0DsFpGVJvvj_FCP!9Ks%h$b*Uf8MQw@$xu zu*#Yoc%#M5zez6>HTMeFl`b${ltIm1XD%Xl4iVc&-p!e=N0c~(9iwowJ&?2Fh0Xug z`sgpiAV5bbn?KgJhN+)3Eq{EQ@c7X1;vnh6+bc(u?F@6PELK!XX$&d~(W1I%VIi$* zS22U^`vu1GDzDL%_`#(UGqe0yE`LO(d`t#DL^x(;&9=8wTvpJ~ zH$P%`baEkuwR+>YZfbhcWE1+5kcjBaLN;p7ize_^6~m7V63_9_%cs9?hjftmrDt&L z5_bq+f9bTp%R9h3-^IE4e(6d^nCd*IZ|VVVE4WJ3i185>g!R*TdwVl6u&tsSOa#Af zC$>!*>p!=0J$r(Os`ewv9eeQi@62Nd$tW*#54BXcJDz|Yz(ywGOqVpRkRRg;kP1v( zuK@pMUm#6mjO@1LE%Cg(obQDb>!kZQ=U~P|T&?8)ZKgxGf0yevCmh7;4+|*B%h_mB z2V-8DwJr=fIvHzjLao9`iOwi;yPV;JXDqtXBU>Klw7(0C5_M32&!!hUce}BP z#RuA~W>|Ven7M$tZ+-a4h%vZp{?V&nU%m**7;e@ydKhl4a|OG}C50NA-T(6t9mFgF zY+tJTrkwDxgN1JTG)+w(TUTHrds%3X?mms06Ju=sgp07yckpyl6Q)Yb9dj*x@^|O; zU94_1E+X{Nn3_o^1uP+8!4|$Fn8+s!i*jvXL51LX;i746-;h33^O&P>Th;_Er1pPt zLKjBQb$kx1<26~>NnLnhlRjfvTmSgES^AeR`t(2v@WOJwk0j}N{z(A%Bbu8gmVZCy z=JgoTFlRbogT-=l*Wzn+eAj1XbBpqfBabybecgvC#NEq4)gYby5c?tcL)YvHi{SnA_(tD7Bga` zrG{jN5%F&lu_13T@hJ_nGTNgUs~EQGEO#jXp1x``eyA+|Er%x1junuSU09~pa0C## zpcbSA^PC2?;;y6dWa#((Qy-I642oG502bMF7mX5T1`N-D)Uqp-Vjrr|G z*JGW4)&MK-aw{d^#B(RlbT__yVPyvbV$UyqdtvOucjfDFnEP*U1m|zC8X%A~AkW3H zynzg!>zdEk4h_9v0}?p4w6tXY$4g;Tex>0E%N?@62cgQlwC~4u!~5js<-&xnZv9(? zbS^&8*^Ob#+L&avIV+J*v87eIvK(5EB>xm23%XZ4bqE&k+L1j|y2ZZ#6)@>sY@#!M zU>%R7)wgy4(9mG@ta~jrt11}Z7_u$uRCK4dm$Ha{sB58|M4i}Q zE$oJp{Sy~j)akL?fjw&%l!2+@ewp}05F7z7BP$@Y%*|S_zR2X)ntznluA4)(zqXOo z6Q8M=T7H_EPb+376vPl2^b0G}$4#WM3=6t)jD-VT;DP!}?p5qTR+by$CgXnIj1bXY zY4{wUB|^{B!&>b}sh~HObH}mur4Gp}I+RGSW{my87b&JcC!_GN?uqlgWLS1~&E<;a zPE?Ay1uK9XlHl@@1*g)o($5Uri@0N*E?yXO*n}Rxdldos!a9bHQ_Dn>_g6#)_vbtK zer|;t42akMOAJeXMO9}Zy>EnN-^TET!g8|W7Cw9&E^iVz#ja*>bI5Irjwd0Zb1CQ+ z?Dp%&e{LR9m=Fs36UJ2J0c^X*08=yiG2RW1LI~LhhDu=>H1l$7XVA~Ty`Q1U#x=`vb(iqe@$Q8=3aKNHTwbQcLEM*Roq}2VgXSh( z8Dxa|&$OS!ew>Is_2Ont!J+<0J>R!{Ted9^_k``@a%lE9KoiEy6K!4kBu z5j!%cdr%Sz1puuP09oRwUVq-eN}-}WZ$Bp&ybqGoBIOPb^u)K2q{p{=%i`YpDA62{ zpRm*mTm`|*J<*Xv#~@Gi+lo)v&`qzdkf+9j`SctKwC(ue?ZV^Ftvo!Xj>_mFrwY2M zbOgF}$E^46{RMD+mR*N_ zdg`9q8ckitn}~PGSe3Z%g?g;e$};6a5~uudG%pI7gyPxQUS2X|$?w0dXs9oultp#I zp1_LGuoAKKhu$JBVTwuDiZR(xfVZ3XZ+Ke$iHcXYXtc!mk>BhivWd}i3*JpB&`#Oq zQ*%)6eDVWbp(_)8BGCF|pwqmmE!B{ZwMT|C_fjROMeDR}e26>$2Sy(pcO!q!h8GF1 zjcmAF=^0fX)O&8OenGbx?zd?wMKNNZTIoammxs_3N+C$^k3;ZVLxH=uxa$#~^u?uO zM#1i3$_yh)fr%iC-#u@}U(kQFne;%ic4=n&L&Qhg_!HYFAba~vrrd#Q5!0p8`eJxo z{v4mPhH_&Z-Fk2Plk_YNfm06sWuxTUu^xX7k;U7}-v}dIG;}N!tUQ^I?#H%*@)Ve+ zMR6qLy&}%17-L_>{E31@vhz2AD&-^TvzE2cX@FUqe-w5Mxefzx@lZ3s>mDeVk7UoX zQ8qntDi$txe^BF>CUT=Zo;{)Y9dPX!;*wa9780WaW@XM)V@AA&T2Dh8Xnf;))cHvi z8%>Lpu)DBBUJgF960yKc4}ElCiCnhl&K^(uC?Fg6<7Va`oC;GHXCkfk^sd4VZleUS zW5JwG*f<0lI)gfCEqK&FWLr?w^kg^u8T;7fR?XOPSuwSgjEm|Q@bLC;-LuOLOSyrq>DPp}ud8|f$i-n6V-|Lw7C!<7ZQ zgy-aBPfyQa#AgXT-v%O0eM)gTQd3-?Uih59n29z4M?Y^WbIL6uX9sj3w8P2x=CSJn;Y}N@wL*=2TRcE?| z=y>3uJNx*!oO<{si)ba1$K#w5MYZXo%HqeduCxR!{3F&B* zg4i$OW$ZM&^jNL2!?&0aX7r!9d?gI%C=awp8Bv&QI6!_UvQ&ZH>>QkJ58GB<<&Shj zLX#OvO}R7X_HUUwnUFu~Qi=G+S58~YdSO02(X}n4$qda29B7UORY;jGVTYWbzRdK> zM9=D26LDHUittoy)&D4xZNVw{MYWsW>Xi)R)<)|PhV;|8~-rgse)$MO%j~(4 zNs-hBtw;5*3N<46Q^f2C!B=ndBf3Yd8}gb2Dq>-~TBrTwr&Q!?RCX)-Err<76_KR` z@$_STLZsYKX>=M@^|^e&A$iyD9)`;gt`Ib3 z7?l}2$&x(k#Hunth8vt^mD%-|=MzUCZU1Be___x`cOJYK&K2CO2Bby!E4Z6v5Xh#i&&R4x;JjAb@gr zZ>|H#pG3zQr{Z&wVAco<0AuCP=2|T7EAg*%emN`qy!ILrxezI5aYc zB0DZzy;OP6bC++^XtU;`m_Nx|FGZj+3;U$Mnfz+H4huDBGE{ZeDdCr^m62u%z>QFe zh-p~W+2U-+W$EnccaJ50*I9wMwkbR35aU%-vy}h+E(t z(_Q*JB)O!YG*V%5@$F+BZI4FetMY%Gg$`lWY(T-iPr1sOSd;o;c|Xw|)~l7!4oZNP zUu9M|)Krej$AV5y@_!0PNDsJ@;y@`3Nf^4LyQz~#+~z0KtvoSRWYZL4@h|^} z`X6OS){)!0$4xy+mWD81LP+7v`U}11S|X*R!#iu9&fQSdnpJQk5yPI@1`HkPiH=8w zmcWyDgkCWt?vsFwWHNW@7Td>$@>8+sU74Zi*p+VqVzwK_t_hwDut%0+3KOnd|3-nJ zKuhrqD?Zb>qf=TqMb78zI##0t_1t2O_Uq{7xf8T_n`P>lIb*uAPUEZrh%$np=7CV#6H#wOx5H+Y?r0~JYr@P2t%9UFMw<{ea$>26PLI$E96nt+(jKE_7O za^s`hF#^UA%g|!Q@2BBv|Ce*3$?kFoEns?1Av@yl)WfQtzQ?SAD5G|0eo z8%Q>S@11+R*men7adXK)oKv;*lAoZ1Oq9Qf#&fDg0Azj}< zQr6`7AWp|S$f}?wEJOCf_Wg9Tno^WKar1Y$ws~I<6rTL$U-SWNSmAvqioh}WYCbNa zIRgAlnFP+)Ez*kRBXFuOzL33%hi1PT%RX?{LJS7EC4LoW$AT7XZV>wAVrg(EB%$&l zX)8Ru0(p2U?vRQm0S>|cobCOm0-XKWWL11I9^=X>SpEDS$f!LDQE3ja+l@5`-z@G$s~VWQ^JyVs1YmDep;+Id5dnD=r}+a ziGIj)01y2v0DLBny zpb@))fx_51*mL;;?6cK>Q(7v0zp3bRq5aMMIngOq*~tTd-7N6Evg*mJSb9~~__tnO zx-~!+T@Npd04K-0;P!LEGn&S&s)nKzBURjGx%XHa&ZZ$fj|7-p&l-$Jhq&kOnQ0hv zBq^%J4g&xWO09zY{;0a@>mgu}mR|%XyDLAlK1O-v|R1k8$!Rs@gYpiVBbvS=pg0?v7+;{i8cDDsD$HXGMrxoIKS|Zf8qNql7(hX z*qRT~14fAX!;f9Z62bIbF*HB3SOr+{YJAgnas8LnDv&V+TudRYafBBu zCOiZ(y_oO$ zcgRt22~r~&Bff&ISaKx#?Gn{S%dtrD3Ib=MhExL$H^~-2Z?~6CtUuMb4 zPZm6!+RnC6!VAqel5mL>=zVH9}=9M+4B_(X*b@wl+dSjHaesit8e^T1Rv0!zA)cFCIvl7tvY)t zllgreG;*M&&cw;M+{N-Jl(OaA&+~XTrz21X-WB^i=A*WjQ0KV?Nun^KNapj@8qsv3 zq+USef)JE!UK4AXuM|I|K+Rb6HLEtrJ1K9@<{8~Pd;a68g7n?BiZh@)Qd#$JI|weONSUizJPjpx#-7F8S&4@e06LzQJC1 zK8ZO_o@wLl^6IP<1gR^3HO(ZrIn@SYqVPmrYHEJ&)WOccZjf9FHywVf>)W^xD%e8% zwJ24%K8K|zE-jWaCBLI&3_f`N>&qh8Oe)e7u|=o<_~si;#V0o3+3~xG&y|^8_m@}x z0>f*2=HN%cUA8aX{szOv;0Wqzc@NYJV18~?^w04jfZLT~nlGvFnE zx1cN*1T%Ua0(y)9$*Vye{Vne`RhCJeoP1WzkDKSNjX4MpMiTf8G44k7tte<%DRw%r zWy{(;t)7n{$0e%qO}7<(Ay*_taN0}lIXNJ~(n8l#T-P#L&CabC$g|IL7&EYtnfgStpvW`}H5%R2PQK>b0G@JIhrLXwq4M>{ z^+%HWgm56ViseJ~;&^HJQdFsPxSHEuyzxWO!&RSuL89AtokQB9ai8JT_(F!vqk&YZ z$+RsDo%ShrVkW&fzVm|5!Qx%jQq9v*UbB1LZf17f}uD;=}v?hQlcA%+G@>zHB?`KnXbHn?21Q3Ie5>Wu@sV1TBAYnbatjKWWu@OqoT>`^e!uEd=@8h2@X93e%2b(EzgUcOOnJ*(%nOwPV-qF^MhhP&OE(Gkub~(0b9!} z>!euLyPHQ#)dGFyZ)m(@XIK^ft6(3B-V)v?Y$0f+>|nP9AaI>i>9nL`TmlTwCf(f# z#@=H65D-Wc_rNRlbC87J$-;`R-^q=H(B>Q}kkgq&ydN2_gfDrRB-PX69^Tmv?=t#G z=thslD>X_|77?X~gpbNB)|Iw7qi&|%spEVahC3k)eJ|k0uT+tJmwkHCD z;iWwEb2(Hz8mpZrGbngP&xcyvVI{T>I{apdivr_^09ms97r7L>r_h!S$5E5s8>Z)3_J1QP!?yKu9&D4yooLJ5uq^nPh@>ziyVisF01A&~-F>d=vlF zYC>t&9{zx5zf)=In@Obs(rt-g>;9-R?m28}zTz9={PfGer9r&Sd{+=_1s8Vf`}0Xj zV?@e5m99{lM0)$*+n#1b9ZwztU<_VAW8^DpwepsW-s6$g;1GlO{UX5;M!XKO74r63 zrgAe7(Db`#xw>$B4imFfwwhcr0cAvbs$DDdWlHH+EC*AqV=$%E;%$=PaWGS!h*fnQ?<@dI&S(;RTTaLyaYJo{@+n57caW`w&!p%Qo$?msqS_ z3L$j#wjiq}0%BxjU}s@r z$vEU<-s;Bt%rAJmU@ZM-xlbCc3FfOxnY7Ou0866T4l^}AWQDbbS}CaDNB*XPqRXYJ zIvHx2{gi^O!0H{@99)ZatLxwHI@dB5>y=Uv>gvHfX94+3b%p*@h|(e=PF6LEDE6A4&4eYQ3sT=?oTjb*DbARRbmv!(mwYMzKTG zQu_kyPIYM)pqi=qx0=hdSpAuy{P$T?Z{zoHalaq1{@RGw?0WlbEUstD%4RVuOz9gA zmBH0Uae3$dR_%i2VtZ&#mvN!n>3aV1UJonn#q?QlG>+L+0~MLmF->MwIanC^th$gP zNg`OWL!Z3`FWVNo<#YDjgq<+#+~J<-a0LWX6LJW}#+m$jDFTkuk6=O#;? zsbCN7G?=D^>7QBmCfsdLy1c+F^fdV%49?HTYInW7zX%k7&QMxY@q$BI&)TISH6pi( zje$4jSe_pYKUO!qzbQ?%1u@%D#AQBWktWd)WsR^`!Fj?Gr`T)rFHLX@%4VBxkZ2|e z?{Ej;H#^~4{>^BlY$(hY4%sTmSc~5RoxfUdv_0&ena<@f4wL|dopgkRUwwI#Vj~$| z#rLT<il3$o-LJmVXbEn~u;E zXi^l8K4;FocWocJ`K7~pBT^ca3*IpT3~Z;-h{zbs%KC6c;uNX;ni(qYS3fsFlsXX# zPt98@;yp8O{60#$b5Q}i@Y8a??0+y2A$s=OYGbre{PK9YYXN#Rg(tcBrQ==gNrn?i znc=<|O-<>WUTwVMwuIZcWXVdS85xl^y>C*!#F3A?kIG4sr(xl1mpGLMMa;By~){2>(l=-&6^Kz7vaxSG)X|1UayA&ID%40L| zdAW$>1fb}sr?D$S-qTv}2TLvwNIUG{-tFeczkhfO zhP=~JASRlC##=1>uN^zyaB%%be|7TRU^L(I^8BQ3y8$H( zIda@YVCL(7e=rJ3y)v(Zof`9hgpdoS!Pq3Eq$Za(LiC0^=hrIPn8IwLNG6Vx&E3J0 z(F*X}M^yDfA>Md@TAS~0`lZL7&SVZ+*8bq-wa}14NixlqJ3LIuUK3lRE6NY>Sq{2E zv+r3jcF0Q z)Q7kH)L5Wst<9 zYdh1Ee}3|eKl;ADl{-dn&vZla7o0dNt4TU=%;?c_*w3AiEbf+@8!iL?GRmbAFYC{FYaIiSw@Fy12d3XA=Rz&Mo-^TTsEf1b(@4N(In3`pLsjG!bL1U{T*CIjmuP zKVN?N0}d6rR)^08k6GmRc$J0hs8 zt{g3m9gX>zUp!jkdj0LcViI|Lekl!<78wRs2!P{jS|v6RC$1bDlu4Qye2Y1Gpu&gQp3#ZufmK zW5!%1CwCC&K8Qj|Jg`nS2}2xB6S*{>tZJGKTlCSI`M>%4Q-TPxS%GH?JNbR16mofNvUefV z(%G!0Gc;Xq(6n>=>|zk?Z4R>7OCk3K(?*un(U8%`U^wr+fZ-< z=kwq6kY_TpwU>Cu`a-2KI|!sG21FbVs=ptwH5%~ zXsTJ$sL=7$885$4T{;6h+j1L_!Vq8JSYsco{^*G0&fuwJr4cesJM@FAJwNtn$y`SB zo@LEVk$MlZs{9bLd&7!vDTBhDt#`_ynOp;uH;C`4s5FjceV;SH?Fpk*nOOPk5?HSPQ9-HJ$h39Ak0QiaS1>&te6< z-=(HK$>k&|^$tZVFB5El5V`I5az|N@Ga^kY>+gb2HGvTHeGT;2Gu>W2&N%6|>$&umnr%=eUrRW#vWT&iogUW%l| z4cU#2%{yCo^UYV5u2beFDJ-iJ>?|3b0j30PPpW9@9T_ifK zm>MEYRN$UJNJwhE!)CkFW_HVAaD0s5>lFVq*Xz;0Vv_wGdBc>s#C02q)}Hc+qm)E) zRJW+ODkEo>%=!3LgdJwD0`PX9ecC|AH^iD|2*2aNV?*^CLTB!+ty)o!n zs@1{tZTKd>YdBtta@#1(&nYhE<1W9O$c&mOr_BqYHFkZoEBY;Lq^G}=7SA|Pg!*uD z^ec&93{8VJHO2$~?EJ<2*jq^>TF%ca?*DC0*N}hEu6j*I?K%!6XSWV#iIVn4SLG*H zx3;*qKxxmXp?MOg(HBT7-qY_@5bG3}+^EX;_t2rA>avXkpsgOvMs3IUf%O1DIz~g;G6>{kV-VkRhXT89A-A! z4&h{Ld4O##Hbo~?5;04(cBc65!BQCO6ifA2heL_3{mIScicC*`y@3;;2$DnBlLbvu zW@r=XJ*-ImX)rI3Ca2%D9P7h7hDf5i+7vTn!=o_n$c<|FVxSN)6X(6>aF0To2G0LgX*E0fCR{;Dx zzQY#f_xnO32A5H4&J`DWJh8d#syi}Tl5y}{-z4?E<9f`lPA8h0KBzip!7z=Rl|*_aFNSs|{SX8TEIuNn zOx3q)jvOgh88~+%wG%tCS!h{~%DUPGP;#YGxyxTw{-&s0foP=R*#k}0Ya5w)WzY8t zmwIT?eYr)T56>8!`Ocq}Xr2%CyTbq|B((zh>wIeHmBRuJs6YQ4c*!X$AMcGTe)-SG zB<>pum^0&-+jqZ+L4%rfR=@d_d!>S&1;qed4-eH^-8Lz z??2a(g%3@=>S-}{_(g_oF3RxO{vR(*RRORv*x5hT8>>sKf3}ns2vZ`kZhkas=uKZF z#yb2xfzzaTVx2LI-PF#6GoosRLK-aa0tVOHUMV)Df@7FK{5A=(@^T*qI-7V zS{q!FH4gB03?k*;VkH`|=t#WNxx5q36co-16EEIl-Gq`J(LH81Vset5)iH#1+E#er zLoR#@y`|<&T0$T*e~l6fV9vgAJhrA*llULs-BOHh&HlNrQA=L!Ef+_l$E^~6Q&oa6 zDG@bkku6X?D=H@ke;SDugH}B+^hOkN2)?{YJz2OgcE8dI8PX9fn5W=sa-@j_e-}z^@EO%lV z_EG)kSbNYmO+RWnjdSDd2(IC5mV96NTGm)kBlwRwq}Dm&WRicw4qtm@mhrn)Ee=Pz zyH0(UI)%oXK@X{q<{>VCqp>D0(}Ia$T3MrtdT46I^oSfacqXVz>PjogvKmm9+ zkX>~JS!BI-7)}&?f>%N*@it(-^ZjIyY+P9L-mK`c+*|7Mg;CR2yY-9on0LLUrteWL zu38$JQxBV%Bheou6A;bSaoHh@7=JHRC7;2OMCJM~SCVsuNCntd%p57OgkAua8-e{I z{OIt-yh`<(1HAh1)7en|wn-*c_COIZA>&-7 zXBO`z1YTDf1#{}Hh@CFb@4_D;JAi#`Vd|w0M|J7|y}W<2FLE#ZyHG6X6bb9mQtDAB zNgNt>piQS)xjZW3rs^J#^=cYH$QUO%Y#IFZqdS<>_3(mCHAqj!9VdDXaV8~ZY=GgT zx$K%Z$+YNthW$2Pq zq?VsGGnDgox#(aN_y|X>*%KW#-B+~fLuZN`_s z(vJe2-4e^a^|DL)9c*(=N z)^8T5cb^K`xnA{OqBa0AV(d6wMew`-T8FM>2C(#f5a?J8XEoiN<0Vjk{QEr&wRHtr z#*Z#>mTm006WfwdP@6wsRE}33W;irIMv&Osx&C*6j&f}c;5o!A%9D(TVa)ebUloK7 zY%vZpqPfxVofcq-z$;UeBU5{@r{^0=o{N+M2QjQ>HXp0l7Iz75xA%0x6HKqd%hMgT z@mCi@pea}&nqA}yKpt}71Ru{}Zh!|8Y^E@xD^pgt$G z?7p$N$zR;y2Oo+6m^E`a)9Z*AM^pJO1nv93`zl`cCgg0I@yaq&Tml!oY$JVUFfFnc zof^|P4hxlMW)yCyyn!DcVg%Ft__!!)@-n1-*8}sb`Ylbrn;KOQ>EjiLYQrI14S@y8 zKkQb=me}uB5nqvgC4Fj4*F`h%ieL5f56T5^aOMPT_ar*44J>jz{OWtD!WK8VG&1QeT`FX9jFlPiXS<+y@#w$}tB6(yTo!5Po|Hhmlxc*Kv_a)I}p;)U=h1MH)hU zwUq@Z9{WnSU$V`UO}cuWiS;u)B9M}jBH;4-FOA+#nWq7-GsOUJNjNhUeUa{ZDJ)BZ z-G0Y^n8hwGiT`^d4%AZ4l=qT4r&%KeB*r6BEp2ejSJroU#JR!o@Q1~amt)dMY&{3p zQpoDo15iG9roZ;*{Ng0HGs4lzw^bbR-E&~9z`=32??Wx3Al-X0!_`Ofi$V|6P)XNBO zpBx{0KVVm$FneyE%j(Vx+xS9KJ`IQcj0@>-gYE(jqAb?-pa{BVXBGc%Fp zjbhxna~SGX=D8(5`h)UdWLrfzvh>bVUaP2Y18J zmB$*}V4(#rLlkd~KpbV+vDR-{+QP9(!hDis^^{fdIjc z!4Zq$jorRTNbA-{2&Y|V1*_c~{TIppyzl~zCVj#%IiqhlPN^YTw3!0ic7Mr4fw0lH zNGZ5$FVCit!u6c?0s#p5K!2M^wxd$jPZ` z`JE)x(GW%|m0g_}h43}2=UZ9)-8-AN|JUro=4{@PkI^=#3`z$?rOMhC$r97%2NF7j zn<1meFRpxZh4uCN^EbdkwLjosWk;Lj$@@YQS48%ha&tdo55lT^z}D0S_(q`h<&4|Lz;4I2$kV?}B4Gdia4p8pRXV-bxU@G~F7 zv3bD#y}v<1nME;QT^b3VhVve}-MDskhS2IFTpwO#&c*=%pdnARK75#DcftNp`d;$O zwuQxmtTy8qmD9*^ozKm54_7mz&Jj4rR*;Z}OqXmDC%MXO_-v*35*SBUmC{}{B8IFXgXYvUaAH0-%q$wkmTSq~P zU2zZD$z4;ugvc9Ul;1HJ{lj)Tn1g=`mjT|7U2A)Db3@J7@7gyW0>eJhac--s4EA^W#%?%o+pd{sR}}4X z0X$Y#B-`uNg~k0(ayv)T=Zj=Z5}yi5UdldQooKoA)LZ6KO9{C~v7jGWB?O7sNro-PY+r> zF!>L=500CzY)XWmlK9Wn8;JY&Ev0BSjN3RulLz<9u7F|ITJGAusQeY30M`a~@UBy{ zX@3D@R3G6WCvkuXD5^Giyi{I0j=(5BxwB+_4orIDMjuCsoSm1)HngAJQEZ> zWDu9%i*0`wOey3&>xQTN#-SXccg*p5*~ZFdDa?8&`w?BB!801a_}&89i6NUtOF(sm z#;}w)PK79u{K(nPfJ{H=Z++lrI~>=qIZ+S`QtRHy>dMMW+kvQF5;R2K#2fhloZ01x8joBKj-`|^MW%(t zGXJ)TpC%abC4z1vU%aC|d7wlDRj1E;F}SDP^T5}=w}lVwz1$tc?#lD5h2CR!Sj6P{ z^SjLxD+|;Os@7l7Cg0XPZiO2T#+A4r>EB(y(_J&zTN_sVwSAJ44FZelI5M<2CC^IQjAs3Mu}p*S?MfW-c~FrasTR3PGm zDvB9s!Y?%@#Ku2%UoF^g1hFpst`7=QIJvyc!J6-)HH&_o-PmZ6elY_?Oc-H&|`&a*pD;XU(*R%cT2+;0qdyk_0N{>O{q zMQ2OWJ52|24pJ$un&X!X9wTbv>z@;~%bp3Yzqa?PA^t7*soBwM-q$A0clA^IW3wOU z>ly(RTj#@Wd!2K8=oBG2R>-O5$R6LcXc1ul4cdH}2<}Rf!pFX4IiAdMM4V{qINXV& zM*L*2lhW6h_^r6k6qx{adfn#I~55!3)2WwICVL7HR z*&)d6@V829uLI^(a43XUlF{QvE(ANDb5)X8FGTFLBWdWrD}Od8U}mHuu>NSwJR>S2 zFPqVP_Wsk|`k>0x?WP0uirXGcBfe+XPFYGyKkiBgbBscY+=0KS{@7ZxF5kzPJY~Ye z;u}S!wZ0~A4KctV`|Bu4`R`Ee_onL!nT4^Sn$pi=KH0Wa4=DDci7pPy)YHW6Axy(h z%iZnIVbTD}sR=?ji}q;*={n_@u8!%OQLk@bVFIqWVYhp;rPB+zSLRozWO<)@+!UpH z*>jF6Yb3Q_1?B|?#4W14=U!||`*BYio5<3Qgl8x#wVybeO{^&&h0K}y=X+boqiD2P z?tnMz0iDkdyli%7#cuzDI`ZJ|hK|faBCFb`FSIblv0fWG%{_MIzh} z@IK@S7(0l)DnH(IdB3HQSoa?Kj!Y|)P{M1SE^nWb@J0NtjkeWjl=jIpow;P~NqwVx z+{L+h+cQ4}@Vl9=O|iI0?_8t?(rKZV6)|jLCe|0#i0YZ!;Rpf=?&E07-R@1i!4QMp zG7;Iqz-{BtLbb&+8Yc{G8|kGTt1h6I;B5kq#}#Nk97%r2=zF?B8gRbM%Av1$g8jo7 z==YXsa){b_VCKB@5t;00%#SCA5q=sx`#7cXuTfqLHnUkbQSnL-PT2%8URDM+4kek0 z&DeqV4Emp%k10Gwr!2ymFi2){@G(4=6b8J&0LB;?5#*r1yrxvkZJ)h1?QeJ(ZNlYL}|1Vrr^Sc00)u1w5P& zf$;@G5e>@lu72HIiu{GEOAPz1-+-fa+w`s~yF@7|@E?pI3<$10eMdn03g`v`(=q?Y z(pg4D*?nzX3F!s_m97D#K|;EFfI&*SQl%Kk`>G`~vXySTSR`8VYs zm@K1HLSeGQeV6)}B<1{M*tBkFr2)>VD3GW(F0)j+%GIHk($|@NS@M~qb zH*Z3=e*w^Fd07rR8~c(16CvzoH%+U)r&TU@zSrY&D9zlq zRM}*qQR-y-5})4QO|E_Vn+L8PEl0&0;XVjE?0vPqWUwf46$d}WNoh-PR$SJ}yeAIt zL*v?W6E&G4K3o3`x5O;e(iGTROp|OS>BBVvF9E!}O*F~s9MZ9k@s)1=G)jB>B}Qy~ z3nD;$4}I)hIr_Vv?)ZF3kT~@n>*-bV_4c=*-?#TS2kIO`gz-#_fK??eU z`7~3tIK4fx_BQow{r+W{2+0Ix%P{KM+iBj5ooYk$iss{iyo-`iCSsNTVDGkP#1vQH zN`6#%B~|*?wYD0JZ$EI7vHru5RlPJP>Z6$&zi2Z}D=&nfa&_e5x1P8e8^jox=l=L% z6-?(sD7CJm+4-JDZFYkF*Dh_d7~)o!;h&Oelu%EJM~8WiT2~axJ%QXSnnf(jziQ^O z6LVI>X$*`fN)&{$ntGB&=87;`%S*|klGQ&@qBPABUCc47_-ZR=*3_riajMKWXFK6b znoGtZiqx>C9|fFUu+wxZd9mxR^Uq;>$6cW*AG8-K-T%hCsa0x-s;K?^YNpbJ&~l2m z&<7W>6Q?J=`jY!oE^nW?Ja+$`YblW2pe0AJ=}ppha{C4L6x~hB_x*zx!@TU4sZ&n7TOdJ z-%eu2H?PtOZ&6Yvn5nji2>n7TnZEkMwpNb8M)UscB>TZz$6ay4#uYKSn5O<{fjR@h z6oX~2Ng!|Ln^nI%yUTeFv!b}=amEaMl2H+vI0b`etP74!*l9H>62!*;_sYrNvVO15 z0)=TleDe9&HB6x&HtP;|*JpWW1XF`!{nQ4iJN9$6t)V;S|dJM ze^u=MV)0q-?-{v6+$`hZU+)bZvzjY@->SA5ohSHLkcSr<#?4q8t>xUxa3FCJM zzWRBi)En~O7jXg8dnt#5)e;{GV9bh!*&BMNNa>L6%0}d4dA4M|U*ziSp?7?^yWsFp z=a4GDgjDA}gNYEH@hXVuOScRGHBRP6+ey(1xeQ@J4yxpAnJdZ02v2fMc{Os(D=yAX zCJiIpJi}l`Lln!HZn0wM8DV!?TluGu4`fn1uFPay~g*Q z&`-K%x+te-c`Pthx+tB8xGb1jvwW{@;@)WuMKZF$^5#zd>6l6SlonZ&#SAuJA_iRd>` z@ZfAjD|=&1i+yx*sZVD0y(r~E^36=|&G_KT@-v^Ky}@d!EPDL>fTyn}YYcie)S~(H zP^Rj}ln=CxeBK@Qih@Q3UoiSc!@wZwk(BEWwtcY#>hA9bx6Z@gDqGXeMFV6b=w258 z-icBklHT4~Yw-CnKW)L!jhxHrDg43yyq7Ndk<1vtDZ43Z>eX=)ZwK;iu_?vo*ey+DfjdYpCsPj`@~#+=B)v=yy*oLlyxQC^kdYaFrX zG?5vxpCu)9lt~0iOibrC#%5>3_!mDTuMMQ}+5G_B*}s(-G4{=s|E8u2UHyuE%Wb)A zXvLmzx6$UONuEq7ae(>(sEQb625-g_9M%84OR2fRHv4;IT3ScCpc*3IyAdh^iyk|= z?G?MP+BF#JH)(Ej%Ju#@?@<3~fGhKEujv~^+l;ohhZvnYLE>4S6pD&(Tq!rq@D`|j z`}KAjrBbcTYxg&)m=n9em;bz&_>mvA2Ba&C=5NJfgMwvN@S0py#k^map*;={`|=t% zh?&pB0LijbzzL7@1+Ev}cPc4*adSTU(P?G5MVw2qZyBZzNC=M!s0pC7+0+}p+*Y)c zFZm=Wp7o)88(Yq@v|zqYj?OGgrzU@WD6_L0^h4Wng_LHmbyR>Wl-o>FhtTc!{_Ymc z3NUrdq!823pvp885MNq~AZ5x3S#1#x^R`NnS1HqDY>U{d6|e2dXpcizX&U!Hd=zk} zVD|=pyuRz5!z<+JQ7X%i ziMXJzS}KkfWxriX@(4#4?Lfc$lcJm1+D&l;x>8dCaoQblwsCy+JgxLSV;xtF#op1X z&`%x5XiZUb5U}8jtuo2YacO!S6z<*qw3Rj8NV9ag(#Lpr7O#lX;v}~Dvq5lIw*FT= zv@0t}1jeqmHS$prOXT791dEok?@R3V0J-r&%f)k3w+1>dHu(GUPwZYnMlRzrGH0E} zPQ4WFf7H2sww>b?Zs(Wo-DWahK9kC|K@c>@{Ft_JCFzm>d6PG}?o9V8YNor}qXyML zGZ4u4aRwAVro3Xd&B?Ft&9?3_XoHRk$MgtD8VWYVZ-=0CS<+GzH9{x|ESXM?%Vgl z99V9Qcjf3d-7W~-dW$g5kVEor`9>rWQx65%ALp)I$+y11&*FN5F`d6cn@pVgG`tk` z%GXZ-y}Uhg!A{OK94;L^g6HLyTY~Yre=6=*QM#jBo~}q`%;n9c5urZTXXWs^&Ql00FhwUcEZ|REWBKFT|NI zXEGwJhD_trH~1+=ta@*A(4zt%tsCD8Tq5*74FJW zQG#hC?=P|T6sWE`6<-%rXB7PS&5h3(Rj#S}fsTVx*p(k6%A(H$OKnykd}EvNXvm4A z5))l)IW>+yhK||3 zAgB$_4rj^6V=}w`0Ff?h8;bF}HKTc9uvj*4jhcRjTr0ms1VG`c;3=Ih*3Mw~vYg5#z_nV(9414m@xNj24quT3%CG=dFT<6VhkL z>v!*c3)&MUk0l*v9Jg;aJr8=?d5Wa&3aW_tS*>v^-Rx{v3crbxkLV7E9V-_S-=<`% z?TOXB_-Z!I$t*wKo>lsF1JE~la`dR|-M3>yITZ^#c%f`wV{5CZoe>$g#yi!#gw(&m zI4`B$UZJ8|=ZPezJ~L;OSxWCDVd++i))w>z`X0}h&tUU@s|VS>_y?G>!4qAV}oS7GA9 zkrjWQ*Y{HIt*Jky;!!5`@k)pA)Si>r^~~93fp~|f0`tXV7KSF>ai#SyCYvAiuJ&_x z9ECLuY3(Djh(Wckd!QP1gJWQ)#td^|x>a+MmN`wDAjA6@jAPB4v%5qj2{=M85sBW+ z?meGP_5a)0^+D6n7G;v$JZduIdwfpNIGPXrQ}CC-%+0B8xU%&c^Qyy~J8W(x`*xK{ z(1t=T&ugMU!Bp^k#_ZD|TYc#BcU0boPl4tsL315KSS|*XEv}5ly}J3X9o^Tm(XW{G zg!cjeIrAt`{MkoJ3x!*)+R$7X%PqLLna+pQBpcX2$b6ARVQ z!O+M1=z@L+Oj+W92#!{=;w;ay&s1p6qMD#^oBe4O5yXA4-?%~93_wv+jnXj#x6sED zOPN^xKNCOwkL{>}Co(zDEgJ(F@k5k|`L)%8F;X2T0#Pl}#vHLSwFj2ih$)Jfo^R7Y z+t^l*PG_yM{}m=161KhV&a1B{t!%q*f-o_=13aL#!~8ypU5WV4wrYMKb#H*)mg6J7`6`Vu#%8%L z_FkjkGw57GrP4u^+Gk>M@@l6?Z^xioD6<6C-v0?0(Vu72?Ym{?QTb$_yV~50Go`Ls zm_(8iosHkX>n8|Lf61i(a>>i0r7oo24g(jj>)4KE+0Q&8+%gi@caQ-UzC&If5!Y=^ zg1fxI;tZ#7$om{3)TSs)A7-{FTIK+PjZ+5aeuiY~C3B~qrB){t*_1MAMn&(o2}jnA zp3gRQDch9XqxLur_@N{BEI6kEeA(n5)OcejB1)053R`exq}8H0WXvdiFHMeoB+C6U zal(!s)dQyays#PXP)|a;Zo)GZ3ln|6yE7dyPSkR^Ey43>%pS5_zS_v*yt5`yS7OXK;I!d_UTtmsd<_}l~ZG!*jz(g8x+wwOm$C-09nWIYS+D#<|ZlBK++ zwUOygi8%}&9Of)&qtp@>@J~`Vy(TW}H{Mn6#1n`9j$r#BXF7Ua;Cp(!C*6?kds;d- zeMWK`rhdJ8>PvpKjS?`!AeH`>o0XMh6M34-97%q^g?P4@_{Txp10^^rZF@ZV%D!rK zR`IG?%N~GXKT%$$YStziPo{CP{1XcXwZN|$s}N6UNA`c@=s}#Pxp&IF5EzN27GG}f zLDWLhz=J3g@Ne6HdU7Fstz~LA7A4LZ8yo&8?5e8Sa;S*L%b^u+u3!I3V&nnBYg@!Y z=c9=@DA3o=sU3KZH}P-?`7la{$a{sVkLf1(KREE@?KB1 z>e?t)8?*A;|I@hqQ*q;UkUtVtw{oTBF|vyOgrHdBW<05M#Vl~^$dF@XG9`>k(0G8N zUwwb<;;U?aDn8LU$Zej_L6SF~xvRk5+acb#0!>;74**5qj4COP#9-WuUZ4kBglWat zByQcIZUuhR>_fB$+OGEN2l^JM3Liy=McikQ;29U zs-D;tlsRW6@)yD}N1iHEZ-R+#RZ4Y2U<@7Y4PUe12j{NHp%YAmvR-`w;t(>PF*Eg1 zY*P6lbt5-I{2)%tIZ!ZnW9ZP(y(XU8+TMO~?AE7EPh}6(UNs_@W0iz`-gf1-UyAaG zq-7K@_L#!qbpDOIPY^v-+;g$JEog)mp_aNjO*3)Hek=Zl;i*8U1O$h4^CGaiu&;z? ziJ|7$oH+4MCYW47h)0D_hJFZWf9KW?CGu4Po}PuZ%|>FDoP`a-k(272WUuL7&!Juv zAJe&(R~AsRbox!Rd5WBzWV)1vryR0c|Cx<8okm|G+Uhj>Ru`d2XJA-Dg>X~&u7Tsp zEY6&csNMvJ)9CD*EwUVh4&kL^^O0=Z3iA|mwwlyPt{xHnE z-j(NKxEbN#H7QcBPZ^50&d`uz8)Ns=Bq1eu9+f9;9|6}A${7p5>kpJOkS z78wWY*m8GhkYrmaIZjra4#RNxE!_OuXl#Ywd9(P$-$;h%Txq00mc*b-ke-^}Pj%QRy<((ma&zDPbJ(Y*a zWvh<$O3P`we)j&btG^H^CtdqfPyK^WsbG7 z*-6JwPQw!Gu62WGK)+z9nSgG>U7qC`Z@>8XskhacT424VkT_QUD&7Yh-5fv$O%wi!Wh9) zl=tgyv1{?Hf8-oMw?Mxq0uCnL9;NV!3p9#z(~N?C>x|@nAN}(0@9R~`=oi4uHSfS$ zh%U=MS4hk@zt{~R^tb-M%oo9V)1e^tj$_#y(`$gfpSXn@S)^Pw##mCQmA9+r=Ii35 zyZ*9{f;alYKkBBII8EfxbI%45nVlQ%@au3TM$cbXxP$QmIKd6RXZm zISmmbD>e=nPZPK@<}4kW$_V}hY*?+!pw$~{3qqWb({-nSKl?F4+mI5}h;G^@HpJA_ z+S#Yp`)fP+TfL~u<{jP_QI^?i5O}sx$I}UtL;AvHrWcz8)%2qP9~D~7mUADAVR6Pe z|3;PVW?$rD$0ubp1h-UZQ3$~#XPcUy#`E-1B!5_r;5Y=omVur6`5u=O&Quw0f%ZuX zmzh)2GbMs-;DA#?tTRJJj}3^D6=q^Mb&SVe;A@(<)01tI(Cmq>rTydlgPuFNL&#Lo zd9|9z>OEzY)X&7Gmn;j$kK%>t%fn%V~zdSE$; z;M5vo0;W4lP)M&XN=G-7A)aMg!RpjSAJ6s>VVm!6L$Z(2o<=qx?A1gfF~!*BMg+rW zCt-453S)2I3B142eGT&A)pVP^0?vFr>2?#*RQqC=PHgMOGfl3n6;0bLU{Z(!ya+Lz z54mvP@Q(@aMTXbc!Xwz5N|v~Y7?tq}+|qQYwLMsV=Ey%Oyj<%bPxZwvEzh!7B|!3I8x{@gi!TKjL<3Ij*w^vKcCMtmdv>Wv+x ztqo^lV~NLv&K?MDd`wTrC|r&ivqliyIX&|spWI(DqC!596HBS2)D;UvGE}ZcSVa=9 ze{=s(DlS$MAefs+?q)lG0>~h~wN>;p>q5j8U5qfdS$d0o{#nhbyJ?Hdmc~CmaUXu> z@&sE__az^9t}Ag)R}c(`d?<0PW!|fjd!sBaqL&DbjCF{1!1vQuKpP}8?I?A}neSn%Yoru% zztdfBnl5YaC->2$q)q#JJf80AzvaI3efvr(nj6l|JNYK1jzkk#cKpiz8W-lXV(7KU zS3tFYKOtXA|8?T)(7JT-kBa;Q z$L}ZtcLXMn>M2u21v2fZ%w{pR3_C$|FcSUTuFxqr_kT*-Pcu45=L8{W`F^ zgd>*7<-ne!(I|OwHNsb%>6VrfJE*-uCEF6qkDgeYghVVbxKZ%QE;U(wd`H`+;!<@I z?AKt{^cPcpS2Iv^156G1oleY~Ha;rfQFXfF-om64Y`a3}5XG6-skm;>K5_bdEnW2G zEHxswm~HlOp1VQg$rnj^9c23VoTsYiVwamwj2H zR|5ATdW`+6F> zFX>w_V65dfA-HlT55;143PT9obF>)!1GGUHR3vdSL5904zi&`Hx9LHHdJ+XQb^S{6 z>E^_>{c4lX!e100`UG)*u@c;TXfXM{W$9J;9BhHzLI($x+k`FH<7I910(fnti;2n{ z?g4Yot@@q2k%o%G#r$WVchNIa!hzTQa;12w@oT2s(I%mBbaLy%(vDKI(=*5*@eJk? zPro)=YxgBKRCOwbl05PVZsrtJ-MR=2VEQs5Zr@avmJ0xn929IjxrHL>Cd_p7-}pF< zMicW{+5qyVbinpQzc8D2>EdYvyjnHbUFwR4OtEPV=!FR|6uUQP zoEE`!o%vEi4B?=N@gQ$XNW0cR7*oQj%$#I0j^Zeqv-C3;!3*1Fwjd!MT#csfBc>@V ztg2G4;mCOFUU6C8pKSN=F}Rxk_^HL(+D}sN-1&Ego?C^F;Q&sp4z?G{duL>f+Oxkw zTjD!XKR-VH)k$tbo}?)_?b@oO3y&o?#b5NDPYcuEUI7?inQKpt+5Fs`8g^&Xy`J`1 zKLLi99^{+x-dt_o0&uu4W`KdNE;H>M=#KGKMb0#bvP8W4Zd5ybA!13h zDSJ5dwknoNv*JVy=1y{z7=?O^fJcL%a+52h)(BZML`lvJA~hZq+fh$=P*dL6$oS|_ zvG&NkRIiS;O39N{-}2@{gjrwv=Ik?^roXfA^9yNe9iyGLhi!|h2#+~_Yd40RvnL7P zx&9)5ZM%CVLL4n}KGTeT15Aq>-swY!7Qh_qFSgMA^7LRu6q+F0so=%b@b6rky=Caf#rm!bcLwNM4C?Wy%`x>sjQo?!c3fG zS|cfcH8rX2BebV|OHMAmy-H+eSa)`?*fxp69)5teJp@y{@^cb}9vcyOVz+AON{S~h zG0)Dg{&sWN4JxGE4p5!gK36GegQlS@yMAj3a3^ZE%$TQU=%C>>nW{lj5y~^tR;lJ;?5IO5( z$n;p(z{e6JOH5>o7aMf8!0pk*e;M#~>qWrG4>DU?0NI4dq7N4hMAA8B{s(7!lr-Ar^y4xtfpuX*2|Pm@NU?PKPqHb*i5AqiER?b^;~>#5NXQ`;AtM z8E#lO9!LfGvpPYtW(>mZ;)`?BG*UNBt?Qo$*uo`_2u#d}GEB&de#FL=%$1gx|4(GE zZyJ^q7ZnBb*?dT9{&C3vuE(MlTY9R(*i{O376Zp;iglLl$b~vj*^7k96}932l!IoE zQ;YJ8cZ$_8i22}N6QraTQGR6e+C>lkOgy#T2zQG?VCac5m2%zG?3HH=hC~4it!`mxr)E_fn~Z(MJU4(x9OK6L%ZM z$f}f@Mz9=X=Yj^K(cbe+RV%}~L2PK>Y8<)1i>RIokf&Vs$tu_1?~I@a-RwG*PH~Fe za-j!QjT$wPPyM-{K?v^wf3*ydo!_9131h8jF#WxCrj*Q163p(>At_ddpwoThp<89z z{iQw?bDK{1l~=iC8n5p5kM?!fj+DH+oa(2BBNO{SOY%vZL`~9<{dliP1!rIMtrB!{ zUgg5`Sm1gpEpd+|2OJsBCSN|-xA6tVx75X^pYIByLdIi>JwP&GI20mC4lFawqS1yM zpUTqW=|lES=`Jd@LDJ*m$0Z@5z8JyWDlz6{MIW>1z!0wB z(t*8R&-pl4aOeBaV24v*0S`Is+IJQe%(ZWRW5c4Y8TN#t23Hm-S=w`G&A$Km!}I=I zFCzSO-Hcvw;_Of1wUi=LvCyrzWQ>>&tT8vfqWISD;l`+hWB`)mCfWHkT-bcz^JTLc z-79!_<#>;@2*rhu*-oR4QF2+d=qF`iMXHzJ4q8m;_#$KVmls6u2WQxP1p2G-W8@WY zZAOkl1St0Lut?copI5+N|1tddF*pDm)X8&Y+Z%izD&3h%0$DPfB0ozH`;FnH^ZVe4 zghjeAvZB5E_(kAr&Wj^&DfOGAr02vh%H9{Jm78aMUJm;XL$Y~IK7V%<1r3jCM=8_rEN;GLr)x-#96EJ37qi9SYyT9&9? zUjtEvHu9`bpjKa}(W&r|@G}r#)%I8Enhf{HH@samA=*DBf|(hbGDN&=I?#)8`ANSj z8eIF%cZ++g1WC^9?kl_v-rkrbM^~qEp*4^eOO6eFY|iVI5RE!w{+ZdszjMXIJTcse(& zpotoT;w3NAKSI4-;d_>O4=V|@*ZV-?A8H>Oj-~(><#@?DH@o1LJ?iI|=?9wL zsr5^~zaY$qtG3zUZNTocEX_|!&y<2=@i3x4p6^7@$QLQU@$(ZU~ARoO<#*1^o~oBUwS z;G@l~CyDKSU>vK(LZT2rZzgh>29=&-vahB|n(ID~sHmuDzLf>!W6ClSZct_#K#E3l z3AeGg=ptmKzV&*#YxmF~Y#CD@rL&aNKDHyw?o_KR-9ujPZ6iOBDOA*a@Hh*8oSM4P z(vr|mRJ%TcASBEoF3XaxpWvSIY$wk;zzEXrNJ^E6>ni1rgAswrOcDJBZ^vMvWQ^QN zPcG*5_4wl^5W>@=J(+{JCqHEa^zwsXMy}(P>u8j1Pm4Uq|{(iDV!$ zKkU>=T6A=P;hT1)EEIaJJgi~4^Iy5g><1qoA8_DuDxYhnusK=-6eWMkDPF&rM}n=7 zBTUz^hc*O96y>8kY2qZ9Q%`$xc_;Wk9p>J32 z$ktn7Giuc*doFT!I%%4zIh4XBRl_hKi%1x}o2#`W`cT}P3%M6ZJp^bY-TA=)Yb9}Q z^4f2=d57flR#b!cRf|($ifk>8pL8>urVKy;w-X4y^%wnB;}w(>vzRk3|3f@PD1qU* zL#R0>XDKb%WQR?09i6NE14NiW5&vNH4B@gPUUVmp{$x8UzTD&LbMudEV++du*w%{IRS?MZ!W zsYgImGc=W3rrC}6>hNsZ2*lhbjv)|%8uXJW{U9R(#hY@oplez&Az#RIE#)gF2t&Dg zgQIMMV~cGGUM%GLCexH#nPZ#f4BwspFZLkKEYE>*p~&sz2Tw{L;u&UjHEl zY|Osmg4M?D{_&nvWWoKo*B=gCTt*9x@&)wx60-f@9Wt)<}Jt=aa{v)M_3SVV)8CEMP;}4FBZKjZG%KD2GrLj1i3sO*~e=qwmQ};0<^n19J>SGzxFx8?|uZJF*2}0$fH5RHT|Hd6((m@@d(>wo)MMPoctfXF1I!w*rcz&;yqvy#9Bf9JM)eQk zaUYbf9YOzDa`6shT&+kw|LeGMyN!`pR1~@1QenPM^o}NyID1==(^~S?8iyaV1~DG6 z$>(F4%9D82RFovC^>HDQ{5dCXMBqzVecA`R~?*boMJlONZ@e4P+pgBrWzv<+$r#l)Cs%o0{b-hw!FLP2{h*vB+-Q9xL*y4UvOdTU7mTyp zY~GrLzMJG_VTx`1D4O#H6TFl`Li$nP9WRR+@v$RMN>}NB$T~{?tRl3PNWyFXNQSd+ zdx>oL>b`qr^AJxN0vkOwt+JhB8LuuLQ&+vtWsv(la#b+_mZT|epux^-h=r8p_GC+-W%stgfpAX#T zVRLS?z^s8aO94)l>bnz+R4e+L)Vlfth+2Jvbyg!8VH#hVT2h_5cTRGF9W##GtiH6c zr&ZOlhYY5FOOhS>m68A*m8+=DT>Wzq*4cN@2xgK>+G$CuS$%GW67jbRd{q>H_6?xdc{ag!fqSNtmPEz1i z8gVWzdLi!J^VM%KLR65X1@AAK*Qm&~Cl6+p^N(|0VM_z6b0a_={tFgyI)xOqcTkxv zHQ10Lvj$j$BCBhw?)c;HF9;mdQ)@FYsZd#y`_;3lfQG|nhJ23(K z5-uIntz&6L_gh~OXg(Js`j~;2<+M!Q&I={muu*%b{&oCCM5s&Lk7T>;?v*5CA0N>h z4kCCsbnk@{>cC&-dQYuja%GOg?7LknTI4A2_li|}x?DNb66}iC8WN&ng@$v|Ph){v zA;vLZl%w3LmgKlzP4SxiJ-2eB$(xkcC)C$7`7OUzj7tL5pHlF;CbBqnA7CZ2lkw_B z@@gYb(Q!@aq;mCs@%=u9RJf@jG6&}FxmxmF56h%&_ymqDbUEZ&$Cx?1+_r)jpcZSj zRzLhIK5}PXBBy>M`4b??g)NRCW+c5uqy!|-J+cwu6h1=)6fEn-I-g;_ zX}J9};!I#poo*YMKWBEXMtEB{FuaCk1!{v`oFbAlXi~Wdoc0LufF2Zu%Dhk?0cVph zTKO^|OE`W4J`0Ym6Yysd8I-Dg+J#TZ_edtceEjju@^PFaU#^+1#97<8bLNqg49B=E z$jzT+7Oc!aNOxPRk2Y+Da*#l<(E~jZ1%fW+dRxQu6PMlXWL1OJOMKijg4OCfZ?HKgVSf5C+r(?Gn13pN zXEA<7oxeCdvfXZQ5L?MC!ROg^i;*<2k(t5;05fH98E}AMOtxr03oyyxf!yljduD zMH-=yz!-M!x1}>Sg%q$jBWFK29RU)jcsilp*heXPY&}5=GcQdEZk!0tubiBdazjOG zO*QF=QEz~WRd08}IQS_qO-a&U8FnU{5Jg8vj)5?5-|R6i>3K&-M>%G3hDdM-DjHI) zq?kqb@0|BWl0O!jq>OyY`P@U|xrCph3a%I#cjudg%5GUosml0te`FRBj%_1gfEo+@ zV!QY2mJ;MyhA;bOvZ6UC4s+C}{gRXtBVIL9+nwfu*>!^0dDcuf#Flcn-u303%(r}K zY6VrJ`S%~j-eXT9`d<;9uTgKG%rZg*fkdVNQZ^XP1N%9H{ysWQ_f{e4We94RZn*45 zfD_TVIc`QJgyRTgK1cMm=;4G~)O}b8Pf!(7fTOHOn*&}gj5A= zN8wl>Dw$@$;=3peuP3Zqfl6$VZ?wPVc8T^=h*j-nMkaMZIltfERoV5l6l9C- z&_v}V+wJrdw26L~i)uvjZ4-N5$bqH~CBuG};kjLkO2F?DsgWFJD#836L=%a!H?GF# z?IH8rQWGgOzPWDP$Rc92D>VO4e#7#L+ho|v$E7Mqo{xNgohbZVL(f-E4h?~lx;ozF z+xk9Jqm;^ncP-t8&CB_$G4BJK?Sv>cj}CZNle~XzReygoz2n*hde*wi4_)*>Ju_Bi z5TY4#vQQ=)0_@L+5;skerI&@gE201nHo12LK@Y~Daq3>An35FRejL0VGOJ-d>IXb^ z+P8VmMD&VgF{+vh<4UH>ED=JU%qn22FOj_)pABO8_{U)KUb>f9CY9~xI%-y>%J}DN z@!`-{PJJ|}9=&7o%NSjfFuJVWq9>> zxBmcD&A5KdN1*>yzOHc%sQ33oMJ*CTU1KOZ`}D?&BggQn z9^KzMHsa<7HL`R?mr*5knxWS^7G15cq($OJiIUABLK5Uii0KBf&Vrgj^sy-|Dc(?! zEE-cY=UezB$3T<71byx|73+`~?R{l7wrX9Z@K+<4I{?!}PuW+<{EOno)9&zFkP50| zuC{|185wC7TLi|tuaD*<+e7RD)MP_X<}C0aHH$v$TusOPxi$ipU0o7}uZ7GD?fpWN z+G6R)!Yagw8P^n_C}s5#fwT8bK~Ez*KR{DBpBAD|#i{?IAglu7+S0oPp>O!#joJ(g z{@$%Ji4pAiBP^@o%-6q$W`p0UzO{9w-(6Y%94FTAupck|nQ~{-%wN>wJAJz`SFSF1 zI6|>;DwA8!2zNOv!w<`WUM|~0h~^G-&}?~Wje(0y+i^ZUz}-i(S_Mgn5o*jOU%C-?;_&d1AlSO2IbZY&5;OX30Hv?q6F-1 zMT6wLIF+<(`6R;lkg;J z3mr=d%F6j)Os1>0F4f_>xpPFmFwk^iQrz_h=2)gpi=!ngPYI;&FX+Daga^KHU!&bj zj4jp9t(vtLI2q#M^0{`o-E;IKa_tLH880TH)yvMy20b9_V+N8Ng=IKqqR-6U`FAla z5Jgh;QS$*btPo|jhy}_R#wm`b&AetA69xPv9^R^kN!7O`h(VJ_wm(7Piq|54CEj+E zxj|gr(`lQ781C~fbk37O(@+f^;sm9@QykY%AYZ&h@)gh@;VKQht8Z5u!%O6x7e-Pc z;q!S{gE?`O5LY8qbHiO+2F(y4SbKuu?L<^a>_d3n{b4W35t8Q&{5|MLQcT{qAClqy zI7a(M95#Gkh(9GkM?(6w!RAd2BMl0l@ZBdKaM^F|ZgYyf@BZsDyl^5pKV6K=cdp9w z*EaMh>>EfGbS|=vkt<{b8JCHDYPk@`Fl>+99pcoylG{g@*`K)nh3x-|H?3%(yyT1| za1|NX-vME*6DaH!KgX<&K}#3&k(`5*FtshX7T8erk+Wb9*F0v_8^Vr`Zphqh}~R=B;rFN?DZHvX7dO zF^s#NRS{L{n1G#KM{G~1o(Q~RF_yKUv*eAEvEv`sB6VLEo|T3s(6gMzKifBcBJz~O zR_4yh=y>7a=h#@kNa4wZ6G%Y}P5omQBT`50>Jaorb^Vdit%6G`5&xWx?8JjUj2F5^ zf&%@=i~iTl>PO@y3@ z-LRPqm@(@5i0SDjOdrF$je%7`#=|~s)pLg}9=*}Gt;^+s1xVTkV)Yj2FEY7sA ze|nzTj%y_`8V>j@N2=oy{zx@-KR!e0t!KA_zH_kPLwu1a?ld>USn zc^-9>>dx?>=6Be8RCm~i)qYmE8S>PjiS0-qaWl<6$ODDmQ<;xYHe=ejD@bPzo z`V5SP--kvm+@Mj?^#VR1jTJT|g(pHRN8zfuE2msO7DlY1tY-V3X4uiGAGGNy=dI!b zfiJbau?=+mDdR&Iu}s)3i)e@U35oVQV>>>PP+rlw2gX7Y#8`gQG2b0=o$_aVWP|Y< zF}fMl%tb5-EUHCWnz_C{PSQ84Ogbplm%v>hF8u|_`iK@*Y*@9LITzsa1-}JVJIH^I z?PID^F74#)S7G~LF)lkM8h7=YZDCtPHpogCx`Ia7uC>s;$%Ug|F4 z|6=nOW|xAVg`c2qTaoo-u0pAoKk%Vw^{#LhkIR zxv=&~ho~Tu1e>vSu3_VI z&vA((nyN(WNT&&LE^5P{**`|V^yKua(qQ!<^vp8JHb2KDI|Zp4LL6#Rn3J(#Won3B zux;h_rkTc`Gjr`=-ckhB-KHFws#-9Tg_N2t9}nl|j8?!Ej|Da{Yz7bI`MGlLA=<5r zVKy~>e9&FKUim)Kb_Oa5XHyw2k)5ou1r~-^$+J0q0D=_Zd3q&qT?u%=Hfb9s06XHZ`@w?%lU3ok!^ghh!>)PNqd z;$Q)>FyVpbH`yM;LgK^+;JaYn-hD)DYs?^e^wWL}=r1)jsCu;ltT_!ZjJAZ=XD3N&8`qB@mLRQ&g6LUT*`;*g{DW_omP~9?1>LrT&E^ zkxr&rz{Y;oNxxAEG0T_a2KXgoc^5D-^cmx7>}UYtMSA(hzf_9A&wQQBtHbssf0KKdi+=l=ZH4~^SdG%yNb`wwDvT}i;K;I3+~ujS{(4^ z=nw0D`>GwrrwkY)OIv#VDk#p&Q>Ytdj{B@S2oTSNd484t%^Da2mLZQcx+d{FT`U0? zJ~w{N&;pJT_>{ul}_TApIy1C_85iV3w zeWPqAL^06x7)C)EqZY4$*FarS`imGVR#2G8xpT3BngG)W0zBkX;9CIL))_=Q=q!qQ z31oFyD;eADv{hXVmG1Me%MarE-*KdFCPH&p)^)CYVE&Idc39QR!Qb-X5m@`M7aq7K zRB|I*#db>ijKGsSGzyswRgamft$zeLy!zdlp#rf;3$hqq%i?Le(aQlCZsTlgr|84m zu#^EFBTeX|2bpaFVFDYzFVFyj_7d?Y4JC|9#3>|jI0ns^=?)^^RW=hih6QQf(<6eK zY59Gxf1F$VHrr}S`w_~4oq>|b@y%POCq>V`aAab&HuxMx6df*zut&;a9{yr|c~Y0} z2lNS5`SvEi1oK&x-~})Kd2%84nV8B}^m9pZ%X=np;3m`l<&1wUI?hYq@t(&IT{2== zKSyXMr>O|%8TYv&M@Wx?wS8_0Osz)C_!~7Nz1Cyl+E>19{VboW!Z#n*X7`klK_N&2GRKUz9N^V5Ih5`_L|o@!M_3+)HQ*Q=%>m zm`$vj6w^L#m}tmGdvNhp`I z0so8gu|I#x9&0n#k{PQx5EniDQ$9T8c{WKP{93KeF352|?Sxh;F1k3T?hw0-wQT2#YT<@ z5)O;e2`>5ScO+l3f5m@MC`8Mn`N2`tdSlj@DIgHQoMSsjGIP}0EOrm z-EL7AEzNyTAoka0ZB%Iu*vy9kn}(*@);y8`pdq;l6EmtWNtv@vF+T!U#-xsgi9;1> zv3p@z6m%H<4@b* z#lHg77xpU(R#`hOrE%MUzL|?o$TS4t)eCIFy9&Y_2R6k>sl435p8QhqHFou8go@v|8A)p^ zqGfkV^1CswB>i|qLobF4XqIkJCF|Z2k*=!L8@C9$LRn1J@D$}`qz_5nohhxe4-@s&TR4+-Q(JZ|>L28K{c zKNcQY@koU^26w1zTF)MU*AOq0CaS1?o?|a82kfeJKa_dC6?A?LPmvJ$$p9;yRngQQ zjHXzntkH@;OVtKbt)2Mz;;Jdm#|CRWxhOBHt;X5Kgj1^@@HJE*_Z5az>BJ5a#Hn^V zrG_dUsruT*04I2fD|fn!$-i5`gVM)MZ%)7dsuVu=UKjwyY;TK5W1a278^7c@K&G zti{){b&4tN6X7Sc|27J*Q;6+TjHlcl#3Itdf* zIrFwG3VZmOx%w=*UdS9_5o>Ph{iL}foVZUBB}PivP2!M{epsiCA_G(AZR@*G&2R5$ zihOHt=hS-33UvtqF{fJx31ARkdcW)|wf2)=0w#7Mk2M>#XBe;*dF$_}$>eNX zTOVE5rw)nSIe)C*Sx5Q%xr``rm5YO(Lne&-t8s;dwF6iH$Q^z>ZI3<$+JaO`?#IGx zBX#z9rD$-vDPQb>@;YX| zz`w0UwHzfiz@oK9QyqL`gs__^#bOKkL#2fXTJYaB$Q%2q8B}C z&u!oNh2na?I;5K7f_q1i6W>A%Ir^>sP2<_wthZnY0Ng`!|zfHx5H?{KIT; zG63Z9NIAdlhJWOvDyqq$BpfOJmFDIQ8hEZ{lLO%d_BsNxW_iOGIk~yFZGpnSdjInG_*aP58p@+*>gQ z`DoMG58cl-`yL589qO38_KQlPc4sFsS>B-BC@EOc}tU%k2leuOPhk`J>Lsi6ycqx0hq~&!&F+$$&UE zWFc(+|304Yo&Z_GAhxM#LZy&4u0Op8^E~3l{G2+zv2>;t1X5AMs>(9H1|jOz@3=!a zjaCyB)>GQh6<02ieZ zs5f`t<z!NMa5lc$-`i30Q>CAFnhz>0 zpSCKQ_Jnv1{{_oLcEIM~tYUmA~=>K>{xRSf12a zl~fdgo8UG|${uA}WAE@7+3f^H&_RP)p>F1+nH*v&;|?6#Pl?_=bTcWQ>9P^e8@ExY z?+GG7+%^rQkPm16sl{8DDLmKa$|ry(5c@gqD!q*x_jvmpUBPDm>QTMY6+ndQCNBA!i!-aWiL`g<%gf^9 zp&84Mi3hk7q+Q}vw+rvX+5vYYzF*tF4C-hnjN!G&XYXgVznDacuPQ!80-3X&!0jz9 z7)LH8VnH-Bv18}qGif|!i4mW;0KG*jGx ziiE6?Vf>wP*e9DW`obBW!_5q`ZX}@dJpupkKKOryOygYWMEbl34XroBe%m`8hD_|s z8%IS*1w%xXT6=6ldaM*e=VCOzGZN&pirVLJxM?Yv3qp~xQpfqu;!JPEnBEi&hV|RF zEWH_x-d(HBI>_IJ9zU;(8!HKiR8i|-Z*{u*EZRG{^o0Rt(*e70-_JJCzTSK0(UjpD ze&;BZbMv-Ma`9=n_ExfJrE2GWC#JmygU*asmU}H65lhd)YwU{g`@D>-+X}U=7=Fda zd(@+Ae;ASAR{77jKis5OkmQTHj~G!Wk}2^T-@uQ^lOLjvpLj<2Y`uX5*Sz{&Aj;K* z3fG$S`Sco4NAQ9y0I}nvvxCH^8v;rutcl6seaR_^hLV#mUvMx_bpUSHB08pY6>n-` z#eGm{?etZaa1VQWrQy9N3~d1`D&xrQ18{m2*#7BPKgHZphrGXr5BHWu?-NS*{;6+> zi%4(KU^mH)OxwO)uR?0tVtRD`R~az86vjo_n1+$yjyEph3Er_0H=53gURi{3Bzx~{8OK4Ez>>5%%|Ryu}Nf|ZcXonaY=5}2J|$er2F zopH#WaqW1th#+RHt!Q_2mxP6NF~Q?i&JvRMvkL5 zlig3w@)z4lCrlOyjrU`72xX!L@zaACqlUXo#*ED2!Wn`lBO4mohb?EwE4-|ziR z$ttPUw|O6$tTXE^)#6F}mh>hhp43AjFv6AwA|b3eyBW$9(R*+GK6K5Ifi~In3OdI8 zyvRX1=Go@;(*o?&pm3|^^N_bu`kza9Q_z|>fx)n)nRDDEZahvB*sS!Z6A-ug54Y*^ zGfv$vDtlU#Ac_SPTes`=^j?QMNFRjoExb~-K7Aw(X9@;Lb8o~M#-`>tOxvam4U~5l zZ7H>^%sKi?4?yxI?`(6y=u_@9uKHt-%<0IO$f|rAZ2Z6{?9Dk4PC!cBY3(8ZwS)qom5GeEaGp4tR+Hm#y&$!;G&~6;HL;f&S9^Te# z(Iy=OkX?O2ntiSjCU>S>y&1!>_#f+%l3pGHD4k?gCD&x#%2XNa>$*c>nnu{#r6A5D)!fxK86 zy1poz$B|In4#^XqIHu5n^}gtDluS60ln`bvRT4!0DcF{%;) z;T;t~=T6?N*%W0LGz97Y2oHGkXz8==_u5yO4%^M*rnAeLM;0vM;x2G+4Ax}6#%4K* z{4OWe&PIDSnMbYi{=dmPkr#Xu4SmC{hmktgy}1qTtOf@0)Zag@z}YW^N0mNv?#og| z0tu~6>|nY-wG*&TSSK2^=FbLhgvaD3kh__*n-gu>+py{i{?0NTy1?D0%;kLo;+RzA z@IipwtX@(=-S>)#M3oQtf<(k&`rYB393j?YShWy{>Yb(cGzXUkJX}1ntf9n!bc|B1 z)G@Ig90Y-=AywOM#jHs^XsuJqN;#>IR7E9Zo|>E&hcCARjHw9f(VM)4Lt@iM>xG4d z_?elR#C-iUk;V5}^}Aj=lx&pC?>`*~5uD*o)L)B#SA{1VBsoif&1 z?Vd{9k?}8>xD=2w#?c!~aQ@U%p9#${GZ~_8-P>s|)_d>7W{mam;Y%~!Na#hCSs-8? zWXTW){PB5T{roY1RvBlVUJ=XKqh;8<+92FIY5XqqD}%W~I5ktznoGrN3d12EI#QD% z!Y&Su18Tg$=P^1{uY3Y`b%%E5g93-7=!)TKX;WSjO)W>|J=a|V%zyJ+#-plBnNk9; z3E~_wqH2Ou+55ZYreVQyf>$CtWlV3z0dMTR0P+Ll(}xF{z8<}%mu5tMW$IYK@KYH& z_k!aIhlaGUxOMNV?!@hQRi&y%3$BKs{93dw-+U|i$h#3fkn=M!{uP59v@YUDLQXLXW>Po!WI*Gw zNb$Nr{>fd+UBR9I=F7QrvXFGlW|xdeSpfm8xE@n;Kic}Ay41UVd(YqQ@6I;-E{ZCF zEk3Xa(t3u|T`Zokub!F;*6xP~r#EytKh3YM@??2CBW|s!U*LTqYrOcKEPGz!4P@)> z(C%VTGDKR%FfJnExq9#`*=IoJOKcCJ?NBcRg?H5@)3wC)!%4%*TvHb%Q7p9K(u~2W zvbQW)_|*}GwnFL4#AI>(1Q~bX!v4!Q{YFxt`eqKr>Y`qi$J<9h6^mMETyc2z_MlDr z?cp;*G?z-mLjUtP-Tmz+wA6h+=d$r~@cvz>|HRA8e--)}Ml7U5EP zT(+mjrqHt7;ywvu!J`oW5^?0?c3*Cu7)CDV;zWKZOJORQcPB{)>Z_x&o4|#3ZxL4A z{ojw=wT1b)JmCp!H;#AAh%eKU-VRCt;c1?HezyYcGs6k#0`oejy=|a$r6ES`o!nbkzL`bw=3f8iJTs-ZP^>Y?A&+<5H$xKEyWH~twN zlm3I24J5d$Y!m)tzg(_wiqt}}zL}t&;CsK+XEp(f`?*sS!7lfkC|alDG+N2rZD11o zP(qTa7$98LD32GToeF}rh(7;Cd($!;x31vm=w5a&)y-^nq9sF=JnGK^%l?lk0r7xq;ck_@;$}xhZ;3IS=1@IB?i~7*$|4XPFa?M?syPGoe zqlo)$8u>Z4(=joaKLjMD?3Yw zyq!|vFj0a^%8^InZh}{?r-XN-RhXyDzwd+a$K`KbV@ZY0Q3U^L*0?4Ojddy{h;_1$ zj6YWoSavDvVR~SU~#-x2p0Fe&BR(I zU@^EGZBRaA)iaMqBDeADpgse@h1#av<19$RR*`l%VI^$1!rGD9-BjxZ;#pR&COsBj zq3e(Z8M4wx4wG8H#$>tv^=&gK_}X<}<2#`%jrH^;J1#sWRatP{|(9=SLg1ZX)R$ zV;0bnZLz|6Jup&@&Ya(8;D)EisI!FQ5${vQN4;XDB!9@r_&*k=Z<|k=LEa* zJi^k_6gulwvteM$bm zoHm29%Nz}}?GpequVX;I1509%(+z<_fd*e3P8nRUC|K1Z&@ zALr##y0l+X8amC!u=3Wk5qG^8>+P}A*Y7ji<~cv7{mUx7 z)PG~f%~=p4C=@~<8}zj#hfN3W#+4qrnrjcECqfAz6GHuKQ^5w{Dow9 zbi9g^8;vU3h75i-h8wmQN@G7GLeeliYrbXSYS{NnC>jmE1M+~95-5wP1hI|Fh7wr z{ci$bqQIv&w*XUWFd(V`k9cK%0&MvKKL6G&ua6p^^Xt!+Sy`seZchuprsPu)k(U>- zARVOiqdEgtas5)mAIW8He(>H_sgN%?Gundlz6>7OiFx{)_zB`?2cpZ~8kKoG2&klVK1}QJ?1zJNo za(x1!WyQs&=Mat^Kdwp)NCN>!<q!ISWviV8gdcJEk zE8>Tf6RmvcEG3wT5aLKlZ@b5hS6wu9=!olHf>vj$O1WsylXOjmp$RJAtZjT)84;{3 z!oM~L{H%W$JUKX%6!?E-lA-8c6T=VOT@yHuL3Bs{qy?r{ikhgv2F6*Dy z1rw*LijBae=FI5)f+^ued-y5u%M>;z_+WTdx3+5|x(CPnlx;u-5u>X4D19(EfgSj_ zeM(cvt8=*H`Exh6=~B-SufBrRft$gDDW-PXawp`tI`wxA6BH_x7=Nz0zayrMwEda2 zm<}?}h8FsO>2v@8oBOVF72$oO!?9S;X^B&zJpr`TQZglAAEwRWQeW9^vb&;KGH62O zfY~-I@K#psRB^~jsSDMF7iUnYJr(}iEj%<96a~a>GC=+3$!i`&%}dW8C)9jD-gCa| z;*>%Lc7}vJX%AqUDsmKO5U|RF$OJqWjJZ>eRuRnfBj!gDa6Bj0Fey4 zFHCrjooPQ`xTHm&)_yiBS|(gg`F&)?cdid+(`aIe9v>{l*nHVSD|4ba_d%RHz-PB? znmHCxZODZO`v4Q-fip+%l<`yk2HQmye=7yg)CxdJSERTyZ_$%)ROJCZ~33 zbOM1ZHFjJz<3O)zUVwAtm%V?Uy^+enW`CQoV-T+@avNF~0AaXKpzM*Aw_W>@zGC;w z&{1N=uDw|`xJA}HSy`4CtKIz`zO%i=+648>*TF(op(1%GmAl*sEh6lgp;!-d==|5O z0Oz@ukM&i?BNsiDt?#s`ZQXs7(fY@TcO+pg9{B) zO@A(DYI5zEdyOQN&2d~-tm=7?MY=owxfBg8tw$H_Tb5P5#GJNfakHeB%=bv-0e7?8 zesJbfdZDhO3Lz^N<(7v!a%_<~g9xPF*;ja!VKW`b*`GeLmvps~2E|zq;Q-tLY`kF{ zNZf4>q_RFFbxqlCv{)ShN9U$w9)|j)gd#c_MELhYOUOf&dG0DN^C^JymbZ?hrX%Gu z@es+JsQOfyw}Lx6j;mg+J?-42Q0z-e?0ZM#<&)lZqW?B+T?OI8r>%Z|0oE0jm!t$g zwL@^MbotxmUo||F<_FiZ@FtF#mwVf$YzpXgJ?CLX`+Qs{$A+Gi&CDM{QuKB%R~9M0 zopJUv;z48ScA?U_Ngq3YKfjZrwRrdLDq%Poc||tdZ#qCIW`W0Wl6bvwmTR!Dkj8Dd zxZBe_722%YMmR0G&-waKYjX!pm1=Q0;i|R`=MVeQ+}6HGmv)P&&_TmUa^kcf#GfkO z8x*^?fZyvB+rOf(2!<2;nM?{`YX&iTN}y+kL{Nm!y{IgpvSa-z<*R6pYbOvH?rgLt zCr*?pm*RXFeMPp4!r}--zbTOlcA|BF8;%`sT_OroJmMs}ONv=iVAe_kosg;EASdIk!7vi#9^N{xYa{@iHZ+JGW$Pp^L>M9v%WLw&X&#%B(e{Hj1 zn$dP_9Q~3$s9u$!)|mj(~cqL{F1 zJFo&2dvjKn?g4@u3Bb!i0cu26?}KUedg0VXJ~Wxdk6>j?SPwwnG(eLJo~n)GLj7Oc zbuWQQ%Ee{3Ht>0E`zrgrFC4^|TB?mdt;8A`(P57DQJ3$Y1%#p`pB3Rg(t&qRHtbr^1R4v5~yd12eOx!eoR~YuH+( zq(ra7ZO@^rRL{*>^$k)j#TnR%jr?p^E}AG}l@{}H+nZP)Ni@jOgFd>yZ+vX?vMzEA z+5*m}y<~dQ9Zl?W;chk?4MGF`lD%~bLoQrtn^p^hl3<|k^d7lTc&S${XBC_1|nF3W8fzdO&uc*ouTJwTvUX<|= z@P9j7cUdRz^m;~YA!r^}t)lQyd3&?Y%{NkI$~Jzb5toq>l>KO#kECki7v)~W5Bf0Q z6I+m!7y<%J1qfP-YAvUHh7Dm%6xe%Kd43YPW00w60}d;f@(Y zL-JW-x#F9uE!_erKoIk~#7}c+FxhqAdcpH@@~$6V8%8x6d!lggA?HzT>wjs}Mn!A9 z(udc9es*^rnn02+4iWSs(~DeB%JRzPZ65r&<;c|}{!5HVm|cvsDOM^j#x6siMPiZR z@4e^mrSjQhhIA#kUO%<`d@A5Xlw??6Jw<_4zUi55$@MS$e?w>>XIgR+|8 z*F_Cx__tZ`jws$#u>R3mpkobxS|H{yo95A$08uzu^F6X0U9t!HCz{GRHnSOSZax?K zj>;cxQbTeb)6Rhx8l>*`nI5cr`FU2@Arq1=LMF*WL0WBK!@uGCXKtcdY6vQ1bM#2I~nQ-@vJ^jwbBt%pLOWM79KiM;z)xsxxaAc7Y4e+E~?@mRQ&ke5C-T*1ug z0>5bF_XO4y-DXoUpm!6;pjZ1^-Q3V*n zNJi)qRPOyxHgMa_DQZBw&E7oIxfR}ZbQLnR>xigZ8GOfH6~op^DucR9j_|tsPLg@W zXUX%ClQXLtQlud~pd-nXP`$+{5JDo$@t=pi#5&ePE>Q!q6)ruvji?A%@ycL<;5%vS zVxz~!?jlyGbqtJ%4Vxm;FZ^lHaA}<%HP9EUd%phby~26ErzgGdKV#%(4QIJneifT_ z$;E|Eemlp9Gu>Rel6cN6hCZ;Ht93VICC8yEKM&5P0x-Hsfe3JjBP3>gU zGoI{@C>ctYKGX2QONYBFKD9B_g+dQe<6c#v0n_tR&FxGIY``b~ZJPXgj|K|7Q{Y*@ z_@fsOE{d}kXIq#t2?Dht?Vo>>4ew`lIK6XPS0Uy|=hbg%!K+H+fqeB7cNWU*axN4T z6cKS>z}3@WH>|B?qop@hnM4|Gahd;w`q<>$#(|Id3)B1ImIOI45<^)on9|r3_`T+Ia^dQthw+gNr=>EUAt-jHLURWA# ztqhs8sEI;omm0VX*}1cso16B^G;Va@+82&qdI#cJe*Zq=J>;A8kAGzB@On1bmWF#1 zbkdA0Fi@6@30etDx_-_gGCUjYT>c9Y0n_ina3_u&xt3Y4GPb_+`JB?l?!;bg69=kk z&@xy@lSm64<)c0GcdmR2L77?&8+}R8*9VOT#yM(D`pEn@GE0tfRF}A!nOGyF@>;^G z5C0~prbUYshE!#~JDw(ZXHcoUK0Ii3{S&Xotg(d=eBY~8PXP5jB%tHsBA5tQFj?Lq z7@Bo+azj49%o}sgl}4&l{rjEDTSL#3IW1B}muwL&$<2omkvi3BJB>j zIO>+zP_1u&FTgVb^h;+jyBe|zxTW|dX8vRIhdX?w-imDIU0uNo&$4u0D@yj~@>XC< zLne8t55g-j`CgYblD>$n;i&SHV;O{#a>bcr9LTABD;^Webt3G9ao=xIj7(Y3QHCf5 zn*FW+13w!b+-IkZpl_TfpE&5U+(Gysafm4MXNIL|8nE1&)1(CjEKetCHjyLmssdM+Bi2Gs);dV<~ zV%~;Iqm>EA`pH4h&y3iycTc`x9Tem$6y%%;ao;jg`5hAf`#OW!Lpu+0Fw+8jXrn?a zi&6vdZ0Y2K^m1l_R7ItNx}2*eMC1C(6o{asR$6$J)S$5A>;tOzc4&Zy!2RCn!}z|^ zDbJco)hB43T|~&HLuvTo`fJQdQ%!T!x1`P=y`uXdl0N4BVxv51!$P>;!8+PwpbVkb z_Qmq0*I1turZkaiuYJAu61l$PpQpg49^g(71MrIG@PMXvVc^I$F7bvy5cJl$jkP8y ztoiKETQe0EYu#@jV?XAu7_q7C^PYa!JrF6}44A(s`@d%r7}T&(z69uf`j~?d|4Z)fE2ozOA{vu1_@S$ z?@k+O^V3b0Pwk>7>*>x+6y!{D<&gJq-!6O&k;MPG6Pu+x2w~#$zf%&U3ysXTx7zuw zM8u`{~Wy5&wKqs@+pyLF@4bjXs%ND z+4n)*$vLactn)|SspO;cVX=GCU$Dn-+UzqkzxW894NUtz_*fijTv5qv(DnqV@mXLS zAiC$9hTON&UAil!(B)SousjX91~}v;0w|P{P$ASw>%13%+5*FK*ery6Gxn)LZVINb zU=eJHMAr{pgUd%PqDH@O{d@a=?xW{n)D4hQW%1h$%{cA&iz z+%4Wo94Bna1&u7D4MO6$HO`XKY6 zOnYn4k7uj98VE@$6G~|5qmyOMC%~j^&a_}C^V*DVpMBxz0 z2sN((_g{$~LxN7~x}z8SKAh?-z&^gHU*(;ijwOaMsYu0UEhx_K=eKbPVbXUVIy5fq zNHu?T?vO=Y)-Qq+phb(+|GC87ed_!&s}JvKIaNCASN5J-JguSUuivq7sdSc6?RI31 zG>i__2x>Q6=mqaB$5ds59uRNgbg?}vs(~g>m?!NPaZ{Iq;%k}c$d_&7mC}4@2h#S~ znkmnG6KMR|@kg15M_q}RO*oJaf<8Cph3cSqVnMm9jD)FWaRKD8$S6pTF)oE@fcjI) z^rep%NTUt@cPqRU6Df<@!9D!`Z!RXp=EoV~qblL`ZbNR=1V3tGejh`P#RVM;8zGA$ z|J!nHj8mq}I_$N#nhDAh8by{nEnb6cO+0VO#Y!r5s~G9C>B@YPJ97Rp0y)fq9;O`| zyeEYecDR2)t;3tNk?WFJzIXdEFScQm0ab?NzhDf8J9?0h%-$)kiZ1w;y$bC67~Mi6 zUAFq=!DD;dr4k(I3)Vgk!d9%8ztEx~B6Pg;?@y2kwnhV{u+!Ih{H1)icm7~~@=_@Y zqHw-}d9rEtgb|ei3UYo>oJ{&C<=2kqT-D}3D_SfN>f79Yp!*k@-y!n9(_b!MzK~37 zB+_ZHQD(Roy7U&OKBsxcb)iXjy7;APa|>s8jW5@6>W1RqLi?P5qQRDs;65!J)HB4X zBf3}mA~8B6FmdlHVEJ}|Wz9of9)1&AU62-VEP?>vooid92Ewrl&VSY=+V;3~rUEmz zuc`8Pdt%2$;0{~;QuOG%_?g?j`LbwwePsRQ?v8(3LO@fe7C-u!1;H|SXxD%7w-$M? zr5Z-an|$)TxxRE*QTG5%)GwZvT^}AWeI@h1$7nA43thI}*WcMwh=vs!zG4h>8=Ri+ zl^BH9`YJ*0#*4*2S~a(G?uzzymaj%MepU#4b@LEqfu5qvYA5K0L5k88aevw@`p%=f zC`$Yxbu2D+-ypRCe2v+BL7F$*Q2LtvjX9V2zAVFZSsBtlRa`3R2TROex2jeYg`ohgS zl?(IwTf#z^1chwPW;wM%Tu;cq9CgfPq)g#|OO(K%^Y;TXvn}FHt8GIT{2KZo(WYf_ zKoMo!lfhXP+Mn5p7j!?Z)waH{g{Ai60&w7wfAvoj@Sr5bpQn<39R+vxgHRquMdqEL)o8YcdMRjyR zKpq-GxZZqVyny%um6OWK$TxDrSl0d03Kb?8^KVNV$T^e}&A6{I=$o-9$eA#ZGqF8H zgEcY0;zB^a{)NE#cK*M*q;MdYbyz<#<85IgoDBK&?#EMVzuXq1*3zbye>MVI>shM$ zPp2{A?$0FqzebC zkr+;lyj3y?Vp%*hU3#g2XXzo0;>v9la{vaWu!){XT1xCIgHI{-o><(IIj`(R#q301 zn7?*zM+V9NyVc(X@8~{@$tFDNn?b5VUe{DjmPy#`q532Yr#at2D4MSiF#&h3FZZ^> z+ynRiB8%&nc>f~N!Qqy^$IjRiQ?|yHOZNvkwoT8cYL50yDS6`+MW_#*8;5d7$;;7a z8-g&iLN->_?IE=|#(5Px>tty*OB z-PD6yJqiTH8n5Z=7DqIiXKLjnRpt1OCZ?w!0M}#3cF*g>|GU6BjOy{P(+7LLczm;< zuG|i~aIZn7X;fg#+YhgcY)u{x@j*Kp`*Zqd4`u!=d?rz71FUa?5XTKy`5;xf`hC!2 z)vD|vwJ@N;f6+nXXekC4vz`1h zm~g@;Jh5N?Z6WKCle@`&Kwo0Fqr5g10IeU^nm?eXg?b*Z0k;c)faDu(+*IalKo|?pEq;ap(FVAYgUqv-AfE*q5cFhrB5D`0R)1OJZEz!hfdqkk10(#+9xg zo{#{c!hc_l_MQg(ks}vfemWv_angc(A#2`zjhM*(aX90wSUnMuG5vg~;qsjTY7CK3 zalSeW>+1HSO-@n!0iT(lbN*;IJ$>}t8$Y=2wqgO~?S{|?{na=D^gz95*%C-r%J8=D zb{*DS>5pwzz`P(#zka6AZ5)wRoZ>1o*B*K*U4gwK~wR`g7v z3rUL`wp{uU{RpD;quz<^P64LIp7Nv4=JIiidP$&k^)uV8U4~umaFwRaL49%Df+O*w z(kngQheGS>OP(PP)SsN<@He&rb~xunz;ji$CEo9-6NdQ15)F}xGvMrNYyf}}FJ)YD z&vM6$9crs8epH$5-EIH-Fz=5)w)t~KT<8pxA!Vm0vYhi1ru)3F4-9@l1dk>l1gD>*?dg%PZ?Q%Fr|uS$%w44$k-SW`D;mHpXstx0c)2JZ?)f^%rRp@u zk$gZM<07SnQ!CgS{`3)_ONqKLB-7{6ww(V}xxcb9uk@>7b-=VW(gbR-pGAQk3&1vM zWUF`8dc4T0>{aDt`#rvUcG-TZnl-TIW7Z`3X4VR5lr z(~Z^6wxj=FQD+_x)&Ko*qDZ1b6dEnE(}zm3Or#_+rHp-KYb;qJ)R?8DREo-0mYF1k zkZoicYqEVrwz2QaFf(Q>voMC=?GxXhf9G+>`=0lCpYuA;bMD-PGK5+7lIBft!7ufG z1a4pGegIEtNFYpd3#3JVbmg)&!L%=*Ic^+OWrBf7OJul#owMZ5k>-K&)0L+l4SL?z zhfj9*9u#_7cWN4D96B&i?rD^tj*jn$L_!8l@{45EPcqWLySKA+{hhJ%2i~*rz;PCf z2oi}uH!|hjU(jD8&A$FD`!MUQYJ|GWUJ= zAYQ2OrX^0WA<~X+l0*LNg&Q)cx56-NwU@RKldmAH*%D^@KR`;xH&; zx}j$cO*+1UL_$z|A@_-68Rio4+QLoJE%yRaQVwzy83swezKHS|cLz-nL>eMH7r4$U z8y-(nPK;F4&m%QgVR;w9kDT9Mao3ucd4d+m!9ONLk}n*^S$mT|AHUFwupEogT8W`D z1tiv*Q7hX-?O;e=)ri*uBc--EpkPX7rc9>1kNl7mSJ#;YoC$~0DM$;UDelThKVomS z<)*NK!7o%X2ztE_q$TXS zGteSH0_$KF8k|FHQ2B)t@*CtThY{{{NBOGKWw<|FgM>Ed51%Qq?dH=WE03gf)bdrF z#daw>ceT_O{Bt9VXv)@1J5n-3eu?Tv;Gpfti--s`xA0`Jp&PT0G zbx)a z$^?t51Xo+ILSZhkyG?v;To2V9mT$i>9W2GKDYvh^gX51d|N2=qc|bW^2zY#RIOr_^ zNCBj-#_Ia<|LgWajwWncU>6h{zn4)OO0T#-amIDF z32|(je!#geWbCv^MgzcTa$g5+ml61)< z(L>wY1}`kXV)iu5t1JPECg6RcL1?>9ZgDV&JFrlOkNV3I(=P4f2WqsGMZV1!fHqZ~ z2`@VknrfM2fDR0rln7R4=-cdj_hPlYJhUADIzijFew0`hbvwW0T;NKxNy{YQC5x!@ zt1!aD6OOQKX5m?NW8M37y2ZhED)xt^G9N4KAkzETX^0uB*!@C#hglCwkrrU@298HM zy&(8j5OXNT^y!;gVs{2E-#$z_9r9NDV)B5hi%*c%(}}hNYt8yAYkm(3R#$WGgdR))SyiF@%ytndOu3cWfE=h)aE0xIdd=ZT{4NsMs0}9=S6wpU$L{ml0a-zcG zDc3`UVwg`tVxKk0l<;}jj7)e=*hl?{d$VRUX2SdM#;Fm1Z9;Yj=hVL41iu{wDBr{S z#vuD78%JBi%&z`YBV1+55Ev)iGzcMyYF-2p{>SGJCb!>W1*0>Hs~$?vyebp_WA2UK zfGYY@x&v>dk>)>6;aUl;Ssd^KR>ES%g6#LA08m|(*3eE2W`<<)q{bdr#S(R&%B$>E z*!$-*u19)GdG6-{Xb*Cge$kHVt_~m~-+aik3HfPQl|U-5ijOM~=m|^!uX~~FdsIoB zgv4_NBaQr3^lnyHI6A(mXnVbj>Dr{U5#Or4HIVqo^fGZ$nFNO)!r<#@kFVBZEa7|G=@vCb=5p>)cgT~_^)Gv!)H~Cne_&ThC5Nb3 z(Fwu|TF(z;MM~F|i)*gY-rJpYrY}m6n|J{67QG)(rFYVYobLJz18BP_d_ztGQ3mzq z$!yvJKW-cM(rcvH)rsbCSfmbop#k=#JDd0+V|Bc(hY?{nVYbGg4&Q7DdxCW)>nw4gCHY@0$)0vvUJuwd6A1~1giQ9GC2&Ci;v73 z?%;C(jSddhi9Inthv%O$ErD6j9j_%WGnUTA2qEPxaU_@LcGMUvjt$92`trcfkr9zP z*q&)d(A}^3S@V_u{@%l(rb04?+Oz-gPKD|W*dhEjAav{Zq+o;eX%(#vohddv2QO2e zUd{CyRN{=hp6(GlW*hk|Z;0FUITI;sC24TK-}n4T|16147jA6Th zR@e!~~OmJ6m2=S z4Ruu24W;T%ztV^rGdMs2tNPHaf?-z!C>(Ij|$-91;Z94Q;lTm%B3F;!MzwW%+B`UR^_=7 zh@t$jN&)_p_ghyk=Td_IwfP=lLUGriCp-QHw1T(Pw(+Osk%p2p42DIfmK8}M=TC`j zsJv1Xws>bZp$h!a{BON!>ri*fIMsOV87~dKIfn#}JCx{v2ThRo$pj)~ZJ%lL{0h(Z4+I+bgf!v%xxe7SMKz z2w@*fuH-j9dF{SpdGtib_3Y&vd(cA9JcZq1%Iizb3BI+Wm5Saq7MbI=CljgXlkdoq zS7pvZq21B(LcnpW;}!#G8>rL(DE7IDrmYJ}RrpWtOeOL z!7b>~pDkXsrw{tgpzT7dM2IoNIzFfUDL(=f5 zAVzmNVSzZ&%vR=gddd8Kmmr8}1dW+;_v&?N9Df51-IG>^Xyq5anOooG0?zI;@g`HQ z0j-5TpYE|U(l+hzf`amFG<^5Z7@S(Wc3H&6RUz(I$Cde@j~!bm{;pshPiWg^1;Hl* zKDiPh-#)4q_mT1I)5viNv$DDn=UP)>{*j4PDhbK-IpX8#~9I<~J-iV9=tmtA9W+OnoWT;^YYARui<~=Q4qql25BDaZp7G?fG?Me`wYaxVP|Y^{5R@SIK8Q(n8ZgLy4`4(U=%q z2&Ol4s-7j)IU<{eF6H1Ozs(xQF-f>AqkO+;(`tn14;JYl@{E(HRaQbaO8b7n_-A@p zE#sWKct^qd_+3I`eMGX~N^1D-i@CXG5``pYxd$!zV!<10BMooz32}%uDaLBejm#~c zU!UGJNd+>fpZ7Kok@3+RHA(9#CwwntD$4ASdi7s!IO;jL(KXSs7L#!|%%0>=_&nAs zpU}G3ex*8KL3qR2Uj%3*x`dWK`v$&1GVxh)1prBPOx!v_o#`=8!yxi zKv1+@*g5s#>U`QEWL9^p)?o1AJL*p!&webjZ@3IqULpHCO19kzyheiO=IcK1fE-cC zS&jk9y-#S&cA4EML|pzx%pRQg#Jwcg~5*4+{Pr-}3!yTugT8F>}n_1K{7!K(^;^kx||6KqV6)e3F+m zp3X8L3x8KCwqfL0(^p(G?EM|2GMk zz$v_nQA&N_U~lrb<6Y3;6Qo;BTnO6u=AdfjAAauLpF+ucZ#_Gwr*7$H;0M(xp(1{# z9VFvd=`S@(L+s6w&MZ}f0}Er!k56@zDg+%xQ^}X#f#VZEk*KMatMgXggi4Kd4;bvn zhOU4#8#a4FM&-gsd7Gyk_ctx@jy(?i)RWN8vuCZX;}ii@S0+D=Ozc*mRVN=>^YmeT z-8$Vyr#t6{s4SSHgX3n9jA7L0KU-_n!ob|J8;!j{(2Uy0v7%q{FY5n#0BRd&okgUN z&!E^29W^P20#=z%KGNjw4;c@ly0IF8OE-izzU-|Q5G7-u&fbSiJa*`(ezOFNKVT2-9bvlP;; z!j7>*%3fC}tR&tYi=3s^Q>n5@waJOdEcM`FgUZX&<25(p5dGj$QO7BLzINXPdj2<| zK-WW6Q`3wAMKwu(Zgb4lDe2e1D_)kFyXUab*TljcL!aa3JD2m3^%aV8HM!0Wu3eL z)iT2p+mZoIi#5yol(W)sZp~&YkYo2m@itzjoN2QlR}Uz0+)b2j`5oYDr$8GZF#fFM z+2x1wHLsz2La4rz*vorE?gw{>T-2*mbnzT>1z6yIQS`U9H@8DWrK2W=F;SXuK2`S zWb;OxI0B`+Ek1P6-H8nBQ7M@hdZev7 zy9Znqt1|XI)g4u+4^~<>&4TP&k^jw$Nc{Y!RTxkfkcz5UA?|kZH1**3e}j#qykqdz z220V#_pTbuL;`g3x3`%}^_)O$bh_%E#;3NXYehz^lMU!z4tyYL)l&kwZTu-q&mi4W zd}s<0P^e&CO5g_pMdogx0nd2myxwyaJ!ik%?;$&MLqTc2%ZPcBk9Bf(C6j=8XPF15 z1MTlEj=L{F={`rFZAi}sw1RvDN`0BX0UZWx;SPFdNqXGujAp;d>&dN-DrfU`@8vS-68Tdf&(2o)7upausty z{D8s6H4&brJN6Hl_D%Pb3Y0tC1_ZVDa@Ynq|Px;x+Kr*Y++#B^}i>WD1J6V1P3NYHeGW1!l)mN^WaOyPsm z7Xk`y=}-dg?kh5_&*_goT5K^=-+Tr5QIiyP8b7wxjeUMna7Qshc4dvriV(yUI;c`* zm^!i&z%`Gl!zpAlaziFSfwgCgY`ab$EWe2RONWirljMYNAD$sH?OwB1QffzmxSk}! zNsc-!&dIp~>~Xxal!kqaM3uWz0+`bE*FfQKyp>l{V3I(@DBAT3p3>K+2e`%kTd93c z?#d>!;{r{Q!oFRILBL& z&4cxn`e_Dq^Ixkxl^@t18fh9^H2{9~6qxuk;ayJxj5jL^ENzcC=OVBZ27q{Q9HkU* zo=y7oHQk5v4f109p7#6~KC1K1unZ=@FPH;`g)6WNjeB2mkN)u-p)pBnEY~$DhiuCu z^W$$360XXxpBZhDPYlp!wezkc%53J30QR$1WCjAx+6I_q-M45XA?wz>(&{x4rPlM5 zu47wSanAsi^Q*?bWg0VwBm@sEbE5&Q^wSwfycgjD#ssn$oJtvW44o{Qz`H3q`oo5P(mEhA8N+e!Nw`5{kTzVx$2 z$ystmE6<1>5CZfm%f~nu3!LPD{fedFgvVBavS1ttiS}5UzOws`rL8q4wATbN6I0@8 zs~b*y4=$G3tPMHi#B|Pyb9QD}<|OiL)M(~{{>|vhgbKATHM&(BY#pHqAEpI}udz%! zp?Te*f=IAkuX0cYLcOY#I44c4ob@fBp!lXYg)nmJ^(>rH{Grv&`S8TX)`}-z&4yaW z0kdr*z^QM?<`W&-S=AzA&}U<62I8FKfLjjp&{ulWr_bKjYrmI*yE=GQGwZbKF8bf} z5un=Jse|R?`ze?|?Mtiu#qQmY-g4B5V-^ajA$haMlA0?s2Wg`{3qepGMuo3&l7cBGWnLUJocn}-TGjt#l zIs2_W#=%~ZX?!Egs(OEob~<%sb=m=q${$8rwG~42T_|V+8 zBkcY0J527nYcUEwCL+_w+|k~aQG{{%Fk=Fo;Rs$fQV)b_cgAVxAQhQzCjkY!w$i$U zIS5S4l<{DN#%fho(=`V0j`J(!VE4q6cU7jRi*!aAL$4~6PJC^7D&ucCr#nW*H{|nOYc`dAZF<|23gE%_Lueyw)F((Cs9S#fDkqc;vY|t zPU$_4cw!(!)JZUhkBpFt@#Wl+>>;?+E>Pgx#_*#CL=SC{e5pWQQ4;WZOQQ^-5g2Oh zv8b*%%Hn04@ZiQ>qk3Jh)w3TEhLNv^7IdEktH+?UKtxEd?g^#bB4*-SPn4ABkyht(j&Q^=jQ2U#J5k4 zbd!n)a($(Ny8GI`U6>DrUy0T%FJE9%#3Q65W;1W2){DTjXbjryWK>$SQffh8#p6c_ zv8~n4I!+HbfXf&**8oP#Ze2Ap-xyrCd&pB;x46mcWoeu#qg-gp1N@m@vM|mwx*hg^ DzlO!b From 388ade4c84d84d3f3d77063bec4b1d25e7d255b1 Mon Sep 17 00:00:00 2001 From: Paul Durkin Date: Mon, 18 May 2026 02:05:30 -0600 Subject: [PATCH 31/62] fix(studio/worker): inject --gcc-install-dir for HIP source builds on Ubuntu 24.04 (#5517) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * fix(studio/worker): inject --gcc-install-dir for HIP source builds on Ubuntu 24.04 On Ubuntu 24.04 + ROCm clang-20, the HIP source-build fallback in `_install_package_wheel_first` (causal-conv1d, mamba-ssm source fallback, flash-attn source fallback) dies at: /opt/rocm-X.Y/lib/llvm/lib/clang/20/include/__clang_hip_runtime_wrapper.h:112:10: fatal error: 'cstdlib' file not found Root cause: clang-20 picks the highest-numbered /usr/lib/gcc/x86_64-linux-gnu/ runtime dir by default. On 24.04 that's gcc-14, whose runtime objects ship in the gcc-14 package but whose C++ headers (/usr/include/c++/14) come from libstdc++-14-dev — NOT in the default apt set. libstdc++-13-dev IS in the default set, so /usr/include/c++/13 exists. clang has no way to discover that asymmetry and the build fails. Fix: new `_hipcc_gcc_install_dir()` helper iterates gcc 14 → 11 and returns the first /usr/lib/gcc/x86_64-linux-gnu/ dir where BOTH the runtime AND /usr/include/c++/ exist. The HIP branch of `_install_package_wheel_first` appends `--gcc-install-dir=` to HIPCC_COMPILE_FLAGS_APPEND before invoking pip. Respects an existing `--gcc-install-dir` in the env var (user-set takes precedence); preserves any other flags the user has set (appends to the end rather than overwriting). No-op on non-HIP, non-Linux, non-x86_64. Mirrors the same fix bbf004c added to studio/setup.sh for the llama.cpp HIP build branch (#5301), but via env var since pip-driven source builds can't take CMake flags directly. Verified on Ryzen AI MAX+ 395 / Radeon 8060S (gfx1151) / Ubuntu 24.04 / ROCm 7.13 nightly: `_hipcc_gcc_install_dir()` returns `/usr/lib/gcc/x86_64-linux-gnu/13`, which matches the manual workaround that already lets `pip install causal-conv1d` succeed on this hardware. Tests added (8 new in test_training_worker_flash_attn.py): - test_hipcc_gcc_install_dir_picks_highest_with_headers - test_hipcc_gcc_install_dir_picks_14_when_headers_exist - test_hipcc_gcc_install_dir_returns_none_when_no_match - test_hipcc_gcc_install_dir_returns_none_on_non_linux - test_hipcc_gcc_install_dir_returns_none_on_non_x86_64 - test_install_injects_gcc_install_dir_on_hip_source_build - test_install_appends_to_existing_hipcc_compile_flags - test_install_respects_user_gcc_install_dir - test_install_does_not_inject_env_on_cuda Per @danielhanchen's suggestion in https://github.com/unslothai/unsloth/pull/5434#issuecomment-4469980122 * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * review: apply gemini-code-assist suggestion on _run_kwargs env handling Use _run_kwargs.get("env", os.environ).copy() + key-mutation instead of rebuilding env from os.environ directly. Today both forms are equivalent (no earlier code in _install_package_wheel_first sets _run_kwargs["env"]), but the .get().copy() pattern survives any future env modification added upstream of this block without silently throwing it away. No behavioural change; tests already assert the final HIPCC_COMPILE_FLAGS_APPEND value, not the env-construction pattern. Per https://github.com/unslothai/unsloth/pull/5517#discussion_r... (gemini-code-assist[bot]) --------- Co-authored-by: h34v3nzc0dex Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> Co-authored-by: Daniel Han --- studio/backend/core/training/worker.py | 56 ++++ .../tests/test_training_worker_flash_attn.py | 279 ++++++++++++++++++ 2 files changed, 335 insertions(+) diff --git a/studio/backend/core/training/worker.py b/studio/backend/core/training/worker.py index 9c266a26fc..048aeeafdc 100644 --- a/studio/backend/core/training/worker.py +++ b/studio/backend/core/training/worker.py @@ -77,6 +77,38 @@ def _model_wants_causal_conv1d(model_name: str) -> bool: ) +def _hipcc_gcc_install_dir() -> str | None: + """Return the highest-numbered ``/usr/lib/gcc/x86_64-linux-gnu/`` that has + BOTH the gcc runtime dir AND the corresponding ``/usr/include/c++/`` C++ + headers, or ``None`` if no match (or non-Linux / non-x86_64). + + Ubuntu 24.04 ships ``/usr/lib/gcc/x86_64-linux-gnu/14/`` (gcc-14 runtime + objects) but does NOT ship ``/usr/include/c++/14`` in its default apt set; + libstdc++ headers come from ``libstdc++-13-dev``. ROCm clang-20 picks the + highest-numbered runtime dir by default, finds no ````, and the + HIP source build fails with:: + + /opt/rocm-X.Y/lib/llvm/lib/clang/20/include/__clang_hip_runtime_wrapper.h:112:10: + fatal error: 'cstdlib' file not found + + Returning a path lets the caller pass ``--gcc-install-dir=`` to clang + via ``HIPCC_COMPILE_FLAGS_APPEND``. Mirrors the same loop ``bbf004c`` added + to ``studio/setup.sh`` for the llama.cpp HIP build branch (PR #5301). + """ + if not sys.platform.startswith("linux"): + return None + import platform as _platform + + if _platform.machine().lower() != "x86_64": + return None + for _ver in (14, 13, 12, 11): + _runtime = f"/usr/lib/gcc/x86_64-linux-gnu/{_ver}/include" + _headers = f"/usr/include/c++/{_ver}" + if os.path.isdir(_runtime) and os.path.isdir(_headers): + return f"/usr/lib/gcc/x86_64-linux-gnu/{_ver}" + return None + + def _install_package_wheel_first( *, event_queue: Any, @@ -212,6 +244,30 @@ def _install_package_wheel_first( } if is_hip: _run_kwargs["timeout"] = 1800 + # On Ubuntu 24.04 + ROCm clang-20, the HIP source build (causal-conv1d, + # mamba-ssm source fallback, flash-attn source fallback) defaults to + # /usr/lib/gcc/x86_64-linux-gnu/14/ which has the runtime dir but no + # /usr/include/c++/14 headers, and dies at: + # __clang_hip_runtime_wrapper.h:112:10: + # fatal error: 'cstdlib' file not found + # Inject --gcc-install-dir for a gcc whose C++ headers actually exist. + # Respect any pre-existing --gcc-install-dir in HIPCC_COMPILE_FLAGS_APPEND + # (user knows best); otherwise append. Mirrors the same fix bbf004c + # added to studio/setup.sh for the llama.cpp HIP build (PR #5301). + _existing_flags = os.environ.get("HIPCC_COMPILE_FLAGS_APPEND", "") + if "--gcc-install-dir" not in _existing_flags: + _gcc_dir = _hipcc_gcc_install_dir() + if _gcc_dir is not None: + _appended = (f"{_existing_flags} --gcc-install-dir={_gcc_dir}").strip() + _env = _run_kwargs.get("env", os.environ).copy() + _env["HIPCC_COMPILE_FLAGS_APPEND"] = _appended + _run_kwargs["env"] = _env + logger.info( + "HIP source build for %s: appended " + "--gcc-install-dir=%s to HIPCC_COMPILE_FLAGS_APPEND", + display_name, + _gcc_dir, + ) try: result = _sp.run(pypi_cmd, **_run_kwargs) diff --git a/studio/backend/tests/test_training_worker_flash_attn.py b/studio/backend/tests/test_training_worker_flash_attn.py index 0737bdc82f..733b726656 100644 --- a/studio/backend/tests/test_training_worker_flash_attn.py +++ b/studio/backend/tests/test_training_worker_flash_attn.py @@ -6,6 +6,7 @@ from __future__ import annotations import builtins import subprocess import sys +from typing import Any from unittest import mock from core.training import worker @@ -22,6 +23,17 @@ def _missing_flash_attn_import(): return fake_import +def _missing_module_import(missing: str): + real_import = builtins.__import__ + + def fake_import(name, globals = None, locals = None, fromlist = (), level = 0): + if name == missing: + raise ImportError + return real_import(name, globals, locals, fromlist, level) + + return fake_import + + def test_should_try_runtime_flash_attn_install_threshold_and_skip(monkeypatch): monkeypatch.delenv(worker._FLASH_ATTN_SKIP_ENV, raising = False) assert worker._should_try_runtime_flash_attn_install(32767) is False @@ -193,3 +205,270 @@ def test_mamba_ssm_path_preserves_wheel_first_install_args(monkeypatch): release_tag = worker._MAMBA_SSM_RELEASE_TAG, release_base_url = "https://github.com/state-spaces/mamba/releases/download", ) + + +# ──────────────────────────────────────────────────────────────────── +# HIP source-build gcc-install-dir coverage (h34v3nzc0dex Strix Halo). +# Ubuntu 24.04 ships gcc-14's runtime dir without /usr/include/c++/14, +# so ROCm clang-20 picks it and fails with 'cstdlib' file not found +# when building causal-conv1d (or any other HIP source fallback). +# _hipcc_gcc_install_dir() finds a gcc dir that has both halves; the +# _install_package_wheel_first HIP branch passes it to clang via +# HIPCC_COMPILE_FLAGS_APPEND. Parallel to bbf004c's setup.sh fix for +# the llama.cpp HIP build (PR #5301). +# ──────────────────────────────────────────────────────────────────── + + +def _isdir_for_layout(*existing: str): + """Return an os.path.isdir replacement that only treats the given + absolute paths as directories. Lets a test simulate exactly which + gcc runtime dirs and C++ header dirs exist on the host.""" + valid = set(existing) + + def fake_isdir(path: str) -> bool: + return path in valid + + return fake_isdir + + +def test_hipcc_gcc_install_dir_picks_highest_with_headers(monkeypatch): + """gcc-14 has runtime but no /usr/include/c++/14; loop falls through + to gcc-13 which has both. This is the exact Ubuntu 24.04 layout.""" + monkeypatch.setattr(sys, "platform", "linux") + import platform as _platform + + monkeypatch.setattr(_platform, "machine", lambda: "x86_64") + monkeypatch.setattr( + worker.os.path, + "isdir", + _isdir_for_layout( + "/usr/lib/gcc/x86_64-linux-gnu/14/include", # runtime present + # but no /usr/include/c++/14 — typical Ubuntu 24.04 default + "/usr/lib/gcc/x86_64-linux-gnu/13/include", + "/usr/include/c++/13", # libstdc++-13-dev installed + ), + ) + assert worker._hipcc_gcc_install_dir() == "/usr/lib/gcc/x86_64-linux-gnu/13" + + +def test_hipcc_gcc_install_dir_picks_14_when_headers_exist(monkeypatch): + """If the user has libstdc++-14-dev installed, prefer gcc-14.""" + monkeypatch.setattr(sys, "platform", "linux") + import platform as _platform + + monkeypatch.setattr(_platform, "machine", lambda: "x86_64") + monkeypatch.setattr( + worker.os.path, + "isdir", + _isdir_for_layout( + "/usr/lib/gcc/x86_64-linux-gnu/14/include", + "/usr/include/c++/14", + ), + ) + assert worker._hipcc_gcc_install_dir() == "/usr/lib/gcc/x86_64-linux-gnu/14" + + +def test_hipcc_gcc_install_dir_returns_none_when_no_match(monkeypatch): + """No gcc dir has both halves → return None and skip the env injection + rather than guessing wrong and surfacing a confusing build failure.""" + monkeypatch.setattr(sys, "platform", "linux") + import platform as _platform + + monkeypatch.setattr(_platform, "machine", lambda: "x86_64") + monkeypatch.setattr(worker.os.path, "isdir", lambda path: False) + assert worker._hipcc_gcc_install_dir() is None + + +def test_hipcc_gcc_install_dir_returns_none_on_non_linux(monkeypatch): + """Don't probe gcc layout on macOS / Windows — early-return.""" + monkeypatch.setattr(sys, "platform", "darwin") + + def _isdir_should_not_be_called(_path): + raise AssertionError("isdir should not be called on non-Linux") + + monkeypatch.setattr(worker.os.path, "isdir", _isdir_should_not_be_called) + assert worker._hipcc_gcc_install_dir() is None + + +def test_hipcc_gcc_install_dir_returns_none_on_non_x86_64(monkeypatch): + """ROCm clang-20 on aarch64 has a different libstdc++ layout.""" + monkeypatch.setattr(sys, "platform", "linux") + import platform as _platform + + monkeypatch.setattr(_platform, "machine", lambda: "aarch64") + assert worker._hipcc_gcc_install_dir() is None + + +def _make_hip_install_env(monkeypatch, *, gcc_dir: str | None): + """Common scaffolding for tests that exercise the HIP source-build + branch of _install_package_wheel_first end-to-end. The package isn't + installed yet, no prebuilt wheel exists, hipcc is on PATH, and the + fake env reports an HIP torch.""" + monkeypatch.setattr(builtins, "__import__", _missing_module_import("causal_conv1d")) + monkeypatch.setattr( + worker, + "probe_torch_wheel_env", + lambda timeout = 30: { + "hip_version": "7.13.26176", + "python_tag": "cp312", + "torch_mm": "2.11", + "cxx11abi": "TRUE", + "platform_tag": "linux_x86_64", + }, + ) + monkeypatch.setattr(worker, "direct_wheel_url", lambda **kw: None) + monkeypatch.setattr( + worker.shutil, + "which", + lambda name: "/opt/rocm/bin/hipcc" if name == "hipcc" else None, + ) + monkeypatch.setattr(worker, "_send_status", lambda *a, **k: None) + monkeypatch.setattr(worker, "_hipcc_gcc_install_dir", lambda: gcc_dir) + + +def test_install_injects_gcc_install_dir_on_hip_source_build(monkeypatch): + """HIP source-build with no user-set HIPCC_COMPILE_FLAGS_APPEND → + subprocess env carries --gcc-install-dir=.""" + monkeypatch.delenv("HIPCC_COMPILE_FLAGS_APPEND", raising = False) + _make_hip_install_env(monkeypatch, gcc_dir = "/usr/lib/gcc/x86_64-linux-gnu/13") + + captured: dict[str, str] = {} + + def fake_run(cmd, **kwargs): + captured.update(kwargs.get("env") or {}) + return subprocess.CompletedProcess(cmd, 0, "") + + monkeypatch.setattr(worker._sp, "run", fake_run) + + worker._install_package_wheel_first( + event_queue = [], + import_name = "causal_conv1d", + display_name = "causal-conv1d", + pypi_name = "causal-conv1d", + pypi_version = "1.6.2.post1", + filename_prefix = "causal_conv1d", + release_tag = "v1.6.2.post1", + release_base_url = "https://example.com", + ) + + assert ( + captured.get("HIPCC_COMPILE_FLAGS_APPEND") + == "--gcc-install-dir=/usr/lib/gcc/x86_64-linux-gnu/13" + ) + + +def test_install_appends_to_existing_hipcc_compile_flags(monkeypatch): + """User has HIPCC_COMPILE_FLAGS_APPEND='-O3 -DFOO' set → final value + keeps the user's flags AND adds --gcc-install-dir at the end.""" + monkeypatch.setenv("HIPCC_COMPILE_FLAGS_APPEND", "-O3 -DFOO") + _make_hip_install_env(monkeypatch, gcc_dir = "/usr/lib/gcc/x86_64-linux-gnu/13") + + captured: dict[str, str] = {} + + def fake_run(cmd, **kwargs): + captured.update(kwargs.get("env") or {}) + return subprocess.CompletedProcess(cmd, 0, "") + + monkeypatch.setattr(worker._sp, "run", fake_run) + + worker._install_package_wheel_first( + event_queue = [], + import_name = "causal_conv1d", + display_name = "causal-conv1d", + pypi_name = "causal-conv1d", + pypi_version = "1.6.2.post1", + filename_prefix = "causal_conv1d", + release_tag = "v1.6.2.post1", + release_base_url = "https://example.com", + ) + + assert captured.get("HIPCC_COMPILE_FLAGS_APPEND") == ( + "-O3 -DFOO --gcc-install-dir=/usr/lib/gcc/x86_64-linux-gnu/13" + ) + + +def test_install_respects_user_gcc_install_dir(monkeypatch): + """User explicitly set --gcc-install-dir=… already → don't touch it. + Avoids two competing --gcc-install-dir flags on the clang command line.""" + monkeypatch.setenv( + "HIPCC_COMPILE_FLAGS_APPEND", + "--gcc-install-dir=/opt/custom/gcc-13", + ) + _make_hip_install_env(monkeypatch, gcc_dir = "/usr/lib/gcc/x86_64-linux-gnu/13") + + captured: dict[str, str] | None = {"_called": "no"} + + def fake_run(cmd, **kwargs): + env = kwargs.get("env") + if env is not None: + captured.clear() + captured.update(env) + else: + captured["_called"] = "yes_no_env" + return subprocess.CompletedProcess(cmd, 0, "") + + monkeypatch.setattr(worker._sp, "run", fake_run) + + worker._install_package_wheel_first( + event_queue = [], + import_name = "causal_conv1d", + display_name = "causal-conv1d", + pypi_name = "causal-conv1d", + pypi_version = "1.6.2.post1", + filename_prefix = "causal_conv1d", + release_tag = "v1.6.2.post1", + release_base_url = "https://example.com", + ) + + # subprocess.run was invoked without env override (the user already + # set HIPCC_COMPILE_FLAGS_APPEND with --gcc-install-dir, so we left + # the env alone — the existing value is inherited normally). + assert captured == {"_called": "yes_no_env"} + + +def test_install_does_not_inject_env_on_cuda(monkeypatch): + """CUDA path (no hip_version in env) → no env override at all.""" + monkeypatch.delenv("HIPCC_COMPILE_FLAGS_APPEND", raising = False) + monkeypatch.setattr(builtins, "__import__", _missing_module_import("causal_conv1d")) + monkeypatch.setattr( + worker, + "probe_torch_wheel_env", + lambda timeout = 30: { + "python_tag": "cp312", + "torch_mm": "2.11", + "cuda_major": "12", + "cxx11abi": "TRUE", + "platform_tag": "linux_x86_64", + }, + ) + monkeypatch.setattr(worker, "direct_wheel_url", lambda **kw: None) + monkeypatch.setattr(worker.shutil, "which", lambda name: None) + monkeypatch.setattr(worker, "_send_status", lambda *a, **k: None) + # If _hipcc_gcc_install_dir were called on CUDA we'd want to know. + monkeypatch.setattr( + worker, + "_hipcc_gcc_install_dir", + lambda: (_ for _ in ()).throw(AssertionError("must not run on CUDA")), + ) + + captured: dict[str, Any] = {} + + def fake_run(cmd, **kwargs): + captured["env_in_kwargs"] = "env" in kwargs + return subprocess.CompletedProcess(cmd, 0, "") + + monkeypatch.setattr(worker._sp, "run", fake_run) + + worker._install_package_wheel_first( + event_queue = [], + import_name = "causal_conv1d", + display_name = "causal-conv1d", + pypi_name = "causal-conv1d", + pypi_version = "1.6.2.post1", + filename_prefix = "causal_conv1d", + release_tag = "v1.6.2.post1", + release_base_url = "https://example.com", + ) + + # CUDA branch never sets the env, never invokes the gcc helper. + assert captured.get("env_in_kwargs") is False From 11e5b5882783c0dac469d6a9bf03c6fb29d195dd Mon Sep 17 00:00:00 2001 From: Etherll <61019402+Etherll@users.noreply.github.com> Date: Mon, 18 May 2026 11:35:46 +0300 Subject: [PATCH 32/62] studio: gate image input on effective vision capability (#5492) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Studio: gate image input on a usable mmproj for GGUF vision models * Improve image gating and model capability sync Tighten image-handling and model capability syncing across the chat flow. Key changes: - chat-adapter: Replace per-message current-user image check with a simpler gate that blocks if ANY image is present in the outbound payload when the selected model cannot handle vision. Show the toast reason and flip the per-thread running flag on→off to avoid hanging wait promises before throwing. - shared-composer: Simplify and correct image-attachment gating for single vs compare modes. Use an attach-time gate that defers to send/ensureModelLoaded in compare mode, introduce attachUnavailableReason, and only block immediately for single-mode. Remove an unused models selector. - shared-composer: Sync the runtime models[] entry with the response from ensureModelLoaded so UI/send gates read fresh capabilities (isVision, isGguf, isAudio, audioType, hasAudioInput). This addresses catalog lag (e.g., GGUF mmproj arriving after the catalog snapshot). - UX tweak: the file-picker button no longer outright blocks on image availability; addFiles still filters images per-file and toasts appropriately. These changes prevent mid-stream server rejections, avoid deadlocks, and ensure model capability checks are accurate when attaching images or audio. * studio: only pass --mmproj to llama-server when effective_is_vision When a text-only GGUF (static is_vision=False) was paired with a family-matching mmproj path, the launcher appended both --mmproj and --spec-default, leaving llama-server in an inconsistent state while Studio reported is_vision=False. Gate the --mmproj flag on effective_is_vision so the launch command tracks the runtime capability the rest of Studio sees. * studio: reject image content in streaming /v1/responses for non-vision GGUF _responses_stream forwards the OpenAI request body directly to llama-server's /v1/chat/completions, bypassing the image-vs-vision guard that openai_chat_completions enforces for the wrapped path. Add the same check at the top of the streaming entry point so an SDK client that posts an image to a non-vision GGUF receives a typed 400 instead of an opaque downstream error. * studio: gate external chat providers in the image input helper External selections (cohere, deepseek, mistral, openrouter, ...) live in externalProviders, not in runtime.models[], so activeModel is undefined for them and the helper short-circuited to allow. Result: images attached to a non-vision external chat model were dropped silently downstream instead of rejected up front. Add providerTypeSupportsVision to external-providers.ts (false for known text-only providers, true for known vision-capable ones, null for unknown / custom self-hosted) and thread externalSupportsVision + externalModelLabel through the helper. shared-composer.tsx, runtime-provider.tsx (VisionImageAdapter.add), and chat-adapter.ts pre-stream gate all resolve the provider type and pass it. * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci * [pre-commit.ci] auto fixes from pre-commit.com hooks for more information, see https://pre-commit.ci --------- Co-authored-by: Roland Tannous <115670425+rolandtannous@users.noreply.github.com> Co-authored-by: Daniel Han Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com> --- studio/backend/core/inference/llama_cpp.py | 74 +++++++++++----- studio/backend/routes/inference.py | 13 ++- .../src/features/chat/api/chat-adapter.ts | 33 +++++++ .../src/features/chat/external-providers.ts | 24 +++++ .../src/features/chat/runtime-provider.tsx | 38 ++++++++ .../src/features/chat/shared-composer.tsx | 87 +++++++++++++++++-- .../chat/utils/image-input-support.ts | 60 +++++++++++++ 7 files changed, 302 insertions(+), 27 deletions(-) create mode 100644 studio/frontend/src/features/chat/utils/image-input-support.ts diff --git a/studio/backend/core/inference/llama_cpp.py b/studio/backend/core/inference/llama_cpp.py index cf46d580af..286fddda11 100644 --- a/studio/backend/core/inference/llama_cpp.py +++ b/studio/backend/core/inference/llama_cpp.py @@ -2215,6 +2215,35 @@ class LlamaCppBackend: logger.warning(f"Could not download mmproj: {e}") return None + def _resolve_launch_mmproj_path( + self, + *, + model_path: str, + mmproj_path: Optional[str], + ) -> Optional[str]: + """Return mmproj_path iff it exists on disk AND matches the model family. + + Returns None if mmproj_path is None, missing on disk, or family-mismatched. + """ + if not mmproj_path: + return None + + mmproj = Path(mmproj_path) + if not mmproj.is_file(): + logger.warning(f"mmproj file not found: {mmproj_path}") + return None + + from utils.models.model_config import mmproj_matches_model_family + + if not mmproj_matches_model_family(model_path, str(mmproj)): + logger.warning( + f"mmproj does not match model family: model={Path(model_path).name} " + f"mmproj={mmproj.name}" + ) + return None + + return str(mmproj) + # ── Lifecycle ───────────────────────────────────────────────── def load_model( @@ -2518,6 +2547,20 @@ class LlamaCppBackend: gpu_indices, use_fit = None, True effective_ctx = n_ctx # fall back to original + launch_mmproj_path = self._resolve_launch_mmproj_path( + model_path = model_path, + mmproj_path = mmproj_path, + ) + # Need both a resolved mmproj AND the config vision flag; a stray + # mmproj passing the family-name heuristic must not flip a non-VLM + # GGUF into vision mode. + effective_is_vision = bool(launch_mmproj_path) and bool(is_vision) + if is_vision and not effective_is_vision: + logger.warning( + "Vision-capable GGUF loaded without a usable mmproj; " + "image input will be disabled for this session" + ) + cmd = [ binary, "-m", @@ -2610,7 +2653,7 @@ class LlamaCppBackend: # Auto-promote unset/"default" to draft-mtp on MTP GGUFs. if ( is_mtp_model - and not is_vision + and not effective_is_vision and not user_owns_spec_type and normalized_spec in (None, "", "default") ): @@ -2619,7 +2662,11 @@ class LlamaCppBackend: # User --spec-type wins (it accumulates if repeated). normalized_spec = None self._speculative_type = None - if normalized_spec and normalized_spec != "off" and not is_vision: + if ( + normalized_spec + and normalized_spec != "off" + and not effective_is_vision + ): if normalized_spec == "default": cmd.append("--spec-default") self._speculative_type = "default" @@ -2739,24 +2786,9 @@ class LlamaCppBackend: ) logger.info(f"Reasoning model: {reasoning_kw} by default") - if mmproj_path: - if not Path(mmproj_path).is_file(): - logger.warning(f"mmproj file not found: {mmproj_path}") - else: - # #5347 guard for paths that bypass detect_mmproj_file. - from utils.models.model_config import ( - mmproj_matches_model_family, - ) - - if not mmproj_matches_model_family(model_path, mmproj_path): - logger.warning( - f"Skipping mmproj with mismatched family: " - f"model={Path(model_path).name}, " - f"mmproj={Path(mmproj_path).name}" - ) - else: - cmd.extend(["--mmproj", mmproj_path]) - logger.info(f"Using mmproj for vision: {mmproj_path}") + if launch_mmproj_path and effective_is_vision: + cmd.extend(["--mmproj", launch_mmproj_path]) + logger.info(f"Using mmproj for vision: {launch_mmproj_path}") # Option C: add --api-key for direct client access when enabled import os as _os @@ -2954,7 +2986,7 @@ class LlamaCppBackend: self._hf_variant = None else: self._hf_variant = None - self._is_vision = is_vision + self._is_vision = effective_is_vision self._model_identifier = model_identifier # Store the effective (possibly capped) context separately. diff --git a/studio/backend/routes/inference.py b/studio/backend/routes/inference.py index 4443c5cc11..607245467c 100644 --- a/studio/backend/routes/inference.py +++ b/studio/backend/routes/inference.py @@ -826,7 +826,7 @@ async def load_model( display_name = model_log_label if native_grant_backed else config.display_name, - is_vision = config.is_vision, + is_vision = llama_backend.is_vision, is_lora = False, is_gguf = True, is_audio = _gguf_is_audio, @@ -3575,6 +3575,17 @@ async def _responses_stream( ), ) + # Direct pass-through bypasses the openai_chat_completions image gate. + if not llama_backend.is_vision and any( + isinstance(m.content, list) + and any(isinstance(p, ImageContentPart) for p in m.content) + for m in messages + ): + raise HTTPException( + status_code = 400, + detail = "Image provided but current GGUF model does not support vision.", + ) + body = _build_openai_passthrough_body( chat_req, backend_ctx = llama_backend.context_length ) diff --git a/studio/frontend/src/features/chat/api/chat-adapter.ts b/studio/frontend/src/features/chat/api/chat-adapter.ts index aeca357f1c..42a9ddc29b 100644 --- a/studio/frontend/src/features/chat/api/chat-adapter.ts +++ b/studio/frontend/src/features/chat/api/chat-adapter.ts @@ -31,6 +31,7 @@ import { isCustomProviderType, loadExternalProviders, parseExternalModelId, + providerTypeSupportsVision, supportsProviderPromptCaching, toExternalBackendProviderType, } from "../external-providers"; @@ -46,6 +47,7 @@ import { import { useChatRuntimeStore } from "../stores/chat-runtime-store"; import { isMultimodalResponse } from "../types/api"; import type { ChatModelSummary } from "../types/runtime"; +import { getImageInputUnavailableReason } from "../utils/image-input-support"; import { hasClosedThinkTag, parseAssistantContent, @@ -779,6 +781,37 @@ export function createOpenAIStreamAdapter(): ChatModelAdapter { } const imageBase64 = findLatestUserImageBase64(messages); const audioBase64 = findLatestUserAudioBase64(messages); + + // Block when ANY image is in the outbound payload (current or + // prior turns) and the loaded model can't process images. Keeps + // the gate simple: once a chat contains an image, a non-vision + // model can't respond — user starts a new chat to switch models. + if (imageBase64) { + const activeModel = runtime.models.find( + (m) => m.id === params.checkpoint, + ); + const imageGateReason = getImageInputUnavailableReason({ + activeModel, + isExternalModel: isExternalRequest, + externalSupportsVision: providerTypeSupportsVision( + externalProvider?.providerType, + ), + externalModelLabel: externalSelection?.modelId ?? null, + loadedIsMultimodal: runtime.loadedIsMultimodal, + modelLoaded: !!params.checkpoint && !runtime.modelLoading, + }); + if (imageGateReason) { + toast.error(imageGateReason); + // Flip the per-thread running flag on→off so the compare-mode + // waitForRunEnd resolves instead of hanging. This gate fires + // before the streaming path's setThreadRunning(true), so the + // wait promise would otherwise never settle. + const gatedThreadKey = resolvedThreadId || "__default"; + runtime.setThreadRunning(gatedThreadKey, true); + runtime.setThreadRunning(gatedThreadKey, false); + throw new Error(imageGateReason); + } + } // Clear pending audio from store after extracting (consumed on send) if (audioBase64) { const audioName = runtime.pendingAudioName; diff --git a/studio/frontend/src/features/chat/external-providers.ts b/studio/frontend/src/features/chat/external-providers.ts index d455ff138e..c71949a16c 100644 --- a/studio/frontend/src/features/chat/external-providers.ts +++ b/studio/frontend/src/features/chat/external-providers.ts @@ -49,6 +49,30 @@ export function supportsProviderReasoningToggle( ); } +// Known text-only providers on their main chat endpoint. +const NON_VISION_PROVIDER_TYPES = new Set([ + "cohere", + "deepseek", + "mistral", +]); +// Providers whose vision-tier model selection accepts images. +const VISION_CAPABLE_PROVIDER_TYPES = new Set([ + "openai", + "anthropic", + "gemini", + "openrouter", +]); + +// false = known text-only, true = known vision, null = unknown (default-allow). +export function providerTypeSupportsVision( + providerType: string | null | undefined, +): boolean | null { + if (providerType == null) return null; + if (NON_VISION_PROVIDER_TYPES.has(providerType)) return false; + if (VISION_CAPABLE_PROVIDER_TYPES.has(providerType)) return true; + return null; +} + export const CUSTOM_BACKEND_PROVIDER_TYPE = "openai"; export const LEGACY_CUSTOM_PROVIDER_TYPE = "custom"; diff --git a/studio/frontend/src/features/chat/runtime-provider.tsx b/studio/frontend/src/features/chat/runtime-provider.tsx index b019fd2d4d..ca9eb2dcf6 100644 --- a/studio/frontend/src/features/chat/runtime-provider.tsx +++ b/studio/frontend/src/features/chat/runtime-provider.tsx @@ -32,9 +32,15 @@ import { useRef, } from "react"; import { extractText, getDocumentProxy } from "unpdf"; +import { toast } from "sonner"; import { authFetch } from "@/features/auth"; import { createOpenAIStreamAdapter } from "./api/chat-adapter"; import { db } from "./db"; +import { + loadExternalProviders, + parseExternalModelId, + providerTypeSupportsVision, +} from "./external-providers"; import { useChatRuntimeStore } from "./stores/chat-runtime-store"; import type { MessageRecord, ModelType } from "./types"; import { @@ -42,6 +48,7 @@ import { markChatThreadDeleted, } from "./utils/chat-thread-tombstones"; import { syncExportedRepositoryToDexie } from "./utils/delete-thread-message"; +import { getImageInputUnavailableReason } from "./utils/image-input-support"; const DEFAULT_SUGGESTIONS = [ { @@ -78,6 +85,37 @@ class VisionImageAdapter implements AttachmentAdapter { accept = "image/jpeg,image/png,image/webp,image/gif"; async add({ file }: { file: File }): Promise { + const state = useChatRuntimeStore.getState(); + const checkpoint = state.params.checkpoint; + const activeModel = state.models.find((m) => m.id === checkpoint); + const externalSelection = parseExternalModelId(checkpoint); + const isExternalModel = externalSelection !== null; + const modelLoaded = !!checkpoint && !state.modelLoading; + let externalSupportsVision: boolean | null = null; + let externalModelLabel: string | null = null; + if (externalSelection !== null) { + const providers = loadExternalProviders(); + const provider = providers.find( + (p) => p.id === externalSelection.providerId, + ); + externalSupportsVision = providerTypeSupportsVision( + provider?.providerType, + ); + externalModelLabel = externalSelection.modelId; + } + const unavailableReason = getImageInputUnavailableReason({ + activeModel, + isExternalModel, + externalSupportsVision, + externalModelLabel, + loadedIsMultimodal: state.loadedIsMultimodal, + modelLoaded, + }); + if (unavailableReason) { + toast.error(unavailableReason); + throw new Error(unavailableReason); + } + const maxSize = 20 * 1024 * 1024; if (file.size > maxSize) { throw new Error("Image size exceeds 20MB limit"); diff --git a/studio/frontend/src/features/chat/shared-composer.tsx b/studio/frontend/src/features/chat/shared-composer.tsx index e255c1c2b0..ac23356180 100644 --- a/studio/frontend/src/features/chat/shared-composer.tsx +++ b/studio/frontend/src/features/chat/shared-composer.tsx @@ -14,11 +14,13 @@ import { import { applyQwenThinkingParams } from "@/features/chat/utils/qwen-params"; import { AUDIO_ACCEPT, MAX_AUDIO_SIZE, fileToBase64 } from "@/lib/audio-utils"; import { isTauri } from "@/lib/api-base"; +import { isMultimodalResponse } from "./types/api"; +import { getImageInputUnavailableReason } from "./utils/image-input-support"; import { useAui } from "@assistant-ui/react"; import { ArrowUpIcon, GlobeIcon, HeadphonesIcon, LightbulbIcon, LightbulbOffIcon, MicIcon, PlusIcon, SquareIcon, XIcon } from "lucide-react"; import { toast } from "sonner"; import { loadModel, validateModel } from "./api/chat-api"; -import { parseExternalModelId } from "./external-providers"; +import { parseExternalModelId, providerTypeSupportsVision } from "./external-providers"; import { useExternalProvidersStore } from "./stores/external-providers-store"; import { type ReasoningEffort, @@ -294,6 +296,7 @@ export function SharedComposer({ const modelLoaded = useChatRuntimeStore( (s) => !!s.params.checkpoint && !s.modelLoading, ); + const loadedIsMultimodal = useChatRuntimeStore((s) => s.loadedIsMultimodal); const supportsReasoning = useChatRuntimeStore((s) => s.supportsReasoning); const reasoningAlwaysOn = useChatRuntimeStore((s) => s.reasoningAlwaysOn); const reasoningEnabled = useChatRuntimeStore((s) => s.reasoningEnabled); @@ -318,10 +321,28 @@ export function SharedComposer({ (s) => s.lastOpenRouterChosenModel, ); const externalSelection = parseExternalModelId(checkpoint); + const isExternalModel = externalSelection !== null; const selectedExternalProvider = externalSelection != null ? externalProviders.find((p) => p.id === externalSelection.providerId) : undefined; + const imageUnavailableReason = getImageInputUnavailableReason({ + activeModel, + isExternalModel, + externalSupportsVision: providerTypeSupportsVision( + selectedExternalProvider?.providerType, + ), + externalModelLabel: externalSelection?.modelId ?? null, + loadedIsMultimodal, + modelLoaded, + }); + const isCompareMode = Boolean(model1?.id || model2?.id); + // Attach-time gate. Compare mode defers to send: the catalog can lag + // behind a model's real capabilities (e.g., a GGUF whose mmproj + // arrives after the catalog snapshot), and we only sync the models[] + // entry after ensureModelLoaded runs at send time. Single mode uses + // the loaded model's runtime capability. + const attachUnavailableReason = isCompareMode ? null : imageUnavailableReason; const effectiveExternalModelId = selectedExternalProvider?.providerType === "openrouter" && externalSelection?.modelId === "openrouter/free" && @@ -422,6 +443,7 @@ export function SharedComposer({ const addFiles = useCallback((files: FileList | null) => { if (!files?.length) return; const next: PendingImage[] = []; + let droppedImageForUnavailable = false; for (let i = 0; i < files.length; i++) { const file = files[i]; if (!file) continue; @@ -436,10 +458,17 @@ export function SharedComposer({ // Handle image files if (!file.type.match(/^image\/(jpeg|png|webp|gif)$/i)) continue; if (file.size > MAX_IMAGE_SIZE) continue; + if (attachUnavailableReason) { + droppedImageForUnavailable = true; + continue; + } next.push({ id: crypto.randomUUID(), file }); } + if (droppedImageForUnavailable && attachUnavailableReason) { + toast.error(attachUnavailableReason); + } setPendingImages((prev) => [...prev, ...next]); - }, [setPendingAudioStore]); + }, [setPendingAudioStore, attachUnavailableReason]); const removePendingImage = useCallback((id: string) => { setPendingImages((prev) => prev.filter((p) => p.id !== id)); @@ -455,6 +484,21 @@ export function SharedComposer({ const msg = text.trim(); if (!msg && pendingImages.length === 0 && !pendingAudio) return; + const hasCompareHandles = Boolean( + handlesRef.current["model1"] || handlesRef.current["model2"], + ); + const isGeneralizedCompare = + hasCompareHandles && Boolean(model1?.id || model2?.id); + + if (pendingImages.length > 0 && !isGeneralizedCompare && imageUnavailableReason) { + // Single mode: the loaded model's runtime capability is known + // here. Compare mode defers — each ensureModelLoaded below sets + // loadedIsMultimodal for its side, and the chat-adapter's + // pre-stream gate runs per-side against that fresh state. + toast.error(imageUnavailableReason); + return; + } + const content: CompareMessagePart[] = []; for (const { file } of pendingImages) { try { @@ -479,8 +523,6 @@ export function SharedComposer({ textareaRef.current?.focus(); // Generalized compare: load each model before dispatching to its side - const hasCompareHandles = Boolean(handlesRef.current["model1"] || handlesRef.current["model2"]); - const isGeneralizedCompare = hasCompareHandles && Boolean(model1?.id || model2?.id); if (isGeneralizedCompare) { const store = useChatRuntimeStore.getState(); const maxSeqLength = store.params.maxSeqLength; @@ -541,7 +583,36 @@ export function SharedComposer({ reasoningStyle: resp.reasoning_style ?? "enable_thinking", supportsPreserveThinking: resp.supports_preserve_thinking ?? false, supportsTools: resp.supports_tools ?? false, + loadedIsMultimodal: isMultimodalResponse(resp), }); + // Sync the models[] entry with the load response so the + // attach/send gates read fresh capabilities. /api/models/list + // can lag behind a model's actual state (e.g., a GGUF whose + // mmproj was downloaded after the catalog snapshot). + const currentModels = useChatRuntimeStore.getState().models; + const idx = currentModels.findIndex((m) => m.id === sel.id); + const synced = { + isVision: Boolean(resp.is_vision), + isGguf: Boolean(resp.is_gguf), + isAudio: Boolean(resp.is_audio), + audioType: resp.audio_type ?? null, + hasAudioInput: Boolean(resp.has_audio_input), + }; + if (idx === -1) { + store.setModels([ + ...currentModels, + { + id: sel.id, + name: resp.display_name ?? sel.id, + isLora: sel.isLora, + ...synced, + }, + ]); + } else { + const next = [...currentModels]; + next[idx] = { ...next[idx], ...synced }; + store.setModels(next); + } return resp.status; } @@ -713,7 +784,13 @@ export function SharedComposer({ variant="ghost" size="icon" className="size-8.5 rounded-full p-1 font-semibold text-xs hover:bg-muted-foreground/15 dark:border-muted-foreground/15 dark:hover:bg-muted-foreground/30" - onClick={() => fileInputRef.current?.click()} + onClick={() => { + // The picker accepts both image and audio. Don't gate the + // button on image-availability — addFiles still filters + // image files per-file when the loaded model can't take + // them, while audio attach always works. + fileInputRef.current?.click(); + }} aria-label="Add Attachment" > diff --git a/studio/frontend/src/features/chat/utils/image-input-support.ts b/studio/frontend/src/features/chat/utils/image-input-support.ts new file mode 100644 index 0000000000..fb39303e29 --- /dev/null +++ b/studio/frontend/src/features/chat/utils/image-input-support.ts @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: AGPL-3.0-only +// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +import type { ChatModelSummary } from "../types/runtime"; + +export function getImageInputUnavailableReason({ + activeModel, + isExternalModel, + externalSupportsVision, + externalModelLabel, + loadedIsMultimodal, + modelLoaded, +}: { + activeModel?: ChatModelSummary; + isExternalModel: boolean; + // true/false = caller knows; null/undefined = unknown (default-allow). + // External selections aren't in runtime.models[], so callers should + // resolve provider-type capability and pass it here. + externalSupportsVision?: boolean | null; + // Fallback toast label when activeModel is missing. + externalModelLabel?: string | null; + loadedIsMultimodal: boolean; + modelLoaded: boolean; +}): string | null { + if (isExternalModel) { + const explicitlyNonVision = + externalSupportsVision === false || + (activeModel && + activeModel.isVision === false && + !activeModel.isAudio && + !activeModel.hasAudioInput); + if (explicitlyNonVision) { + const label = + activeModel?.name || + externalModelLabel || + activeModel?.id || + "Current model"; + return `${label} cannot accept images.`; + } + return null; + } + if (!modelLoaded) return "Load a model before adding images."; + // loadedIsMultimodal is true for vision OR audio. Can't tell them apart + // from that one flag, so only block when activeModel confirms + // audio-only: audio capability set AND isVision === false. Otherwise + // trust the load response. The models-list entry might be stale, or + // not even there yet (gets auto-injected after load). + if (loadedIsMultimodal) { + const isAudioOnly = + Boolean(activeModel?.isAudio || activeModel?.hasAudioInput) && + activeModel?.isVision === false; + if (!isAudioOnly) return null; + } + + const label = activeModel?.name || activeModel?.id || "Current model"; + const suffix = activeModel?.isGguf + ? " with a valid mmproj before attaching images." + : " before attaching images."; + return `${label} cannot accept images. Load a vision-capable model${suffix}`; +} From 4c14038fe473a2e764aad1a74d6dbd1e78fa202d Mon Sep 17 00:00:00 2001 From: Michael Han <107991372+shimmyshimmer@users.noreply.github.com> Date: Mon, 18 May 2026 01:43:59 -0700 Subject: [PATCH 33/62] New buttons --- images/Discord button.png | Bin 12946 -> 37272 bytes images/documentation green button.png | Bin 13314 -> 12074 bytes images/unsloth new logo.png | Bin 54788 -> 34087 bytes 3 files changed, 0 insertions(+), 0 deletions(-) diff --git a/images/Discord button.png b/images/Discord button.png index edcf854cc9168842ee8cd594f3752019962785ab..56e276f379a103b3a5bce23931ae29c57f295cb4 100644 GIT binary patch literal 37272 zcmYg%1yoes_x8{=G}7Hj%8-I|x1cnF(p^$g14v8f&>$g7Np}iEw;&8DAky9SUHt#v zwLaDwYTbM8K0BVh_p{H9)Y4GI#iqmtfk3#*N^;sD5Gp$G`!(j{cYb;KFTf8h7bOFC z5QvBA@q^@DBWU-m<`Lk4~ zBzcBXuJm{y+_|U)OW=I~sK{{V9Viqu2qFQEM+TCC`auM45+%qg`9$+PQ(DI--{0qU zP8WP{O0zE-Hh;F7-ti&?(LNDw^v5r0Qpmxbno5OD!Vxbo%v*i^Wi z=_CFfR~EpLcsh$s zw>y@zW+7-pld_VES8ov-#)DmOy{dIcPrw_eg}z9Sa^f@;zOlg|)tpwa%E0UVJ;j#n zz;bj@9Tbn%>FHI=GKLuzROmz-yOtwQ8mV0CD}|K#?*j>S5RTUZ)1rEwGV@Wlv|N%t zE7Sl~jMT5EvcVb*>NP|d9HYlL*ks$=XIrAHjKd5OPv&Q6aeolQUFVL-f4g3}xTCO9 zit#^19768Q#ZE-j3iIvUv{+F>gEE!GdTtqRt8PDq@du&JvUZ`0J=3Q$bm-*onB>P* z0UKN7IiL%<+90r6ZHT4F#a(iwW?KT24;Exo!6?_fqn#ahx%{pn7Kc)_DHiO^qL?{S zY9TCD36~;Ql@u+k!8DP)4kDd&-LP|fzm02V#g0h&kcALdLqY1ymbYxbo}}eP%^zln z1Zu9+`0y9C1nES7{9??b$B|rzLlg+-?kqCaoz|{+Zka#pvv2f5rBs9cCvKkNQZg~U z&A6c#vJFNRZRb;|fUpQwPIUALR(y)N{ya&1ttJ%)O?#7yx)&JZIJGebl%$CMCtNs9YiYG~y3!DW93G!pnbvCj1H$gD|Y)*T9q*=!3*h*{hnQ z5iWsc58cc;C&Yi0mva@WrNiU`Q#(5&9WBT&@_ZI|@o`S+W*3-xM#+C&-muO4r#9wL zEm}vG#6WmoSr)YbOjp*6)$GU(7=7<@BynF?CX)o9}6?H|y%kRuo6 zL7iH(a&(Ph1&@e`uvtj#3J{=tc3>1qU*boN6-wB^g2ET&!v4vID@-qi>NE+paae#323Wr8>y7Y;-;D$6TA~N@q-vd zUm7Ha{DCLW+OGU*?M&#AciFF4IL-#Xp8#p-(4Kr}E>h(zP8tF&4vvw_3kswMRnA(s z?|U}oaT%EI{C2=2B%EMoFbI58nf!#D9_b!zU?!sE)}$yvDX$ic`W>^oi$1vPjT{q$ z+~;Rcq7_=(UM#*5BOP(^ZM$-cvu+=9qj4~(u+qr|eL*?3lj6oWWPo0PlpIkQGw8|5 z=_wytpPMGC? zBxUXy-}4+w{Na&WEuocq#skF%mHjlF6$?TU*}{<%;CaR;CGdu0L$6b<{CmgDIg-$6 zz~BsygAsQAT-BaP!S_ZO;o%KR|KOm4t|x7Ewfic5zZJ3^@Wr&5IxN#bMnPfFKa__1 ziMdJYb7dulf7{~Utu6ish3-THf&{Fnr$cV94eIZjIEz7@CjxU@+ zZK$;uD&n;x5l@PLsNqs0m*c^T^cqGuYK z#-e9rWSq~j5GEgB#XLXDFZqVDXtIZieltvj7B`EN3n$Y_{U$Fxw2w|FwJIw00z)Yt zst|&BqWu)uC`WH+XT*rE${xK3O6^PweC=p)*V`|(l+*#f>e@nxY0;gVfEK90T3zj? zcAE3(p0_U5SRa~O2*76y)Oh)oEjZtm$Wsxx4G1O#dqp+Zte8q^L;g{I*ga2=?MR(Za$9R?S_R4TviAOd;xKuoGRC5$Q?Ck8)ZvqIp(nv6w zf&Ea%k?`|Zk7QQW#f--4*47E+m6TxA(k}*`~jdMLY^syvH1|Cun z$w`Fux#b&5HqFRi8|Rcoyp=QW)g$k^4L1+AZ9;MIN&qNPUJB9q2}y;;3QXWADXLN` zi?oaL_r1^P@-J{=O|QmV9{9c62~XXj-}7 z>-=TJX)~$Pija@UlTlIKjSU9!K_v;G)yCCSIx*TapFvJ2huBc>X2kP1e0)-+ zKRN+jqoCZyzS3foT7`OxxAPI?;UTYmAW_Z?T%m@U0QUM+cO1qrP8Uk z-J2J(2DGIUx5e7qnxK88@eqy(U>z1f!lGg`vrdc^eW`5lU)h2LmjHH>kMJF7TLYFT zm15Y_)<@9<+!B=fr|E5+%0ft7&u>r;8(-{E#xLSHVH^@b`HBf1H`-{zFwwtPko;WP z-j9PcdK4!-7+RlTs{bkKE3ALGU&HI>5!P7IDre)qZj1KwvP=8#QNFLQW8B8x^u4?1 zZCu!whtA^~E~80#^3fN(eFu2{G|2#YKgOYL`PoI?%#9MN7%3JL6BEYNS1ZQKDv`xK zCcx!0rsp#vi$u&cHeLzj`_uTl2W*VCT?cKw7@uquj)y*y3{|K%yp z_G=c!(%?(hGcwDKDa$r0z`Y4$z6bv%f>7v~>V<@z*%QPl5cc;kC>m5yA>HvosgPRZ z_dSW!Nr2>t8&ifOqR!!=AWn-ABL{cIDkhj}ef&z{ZlE9kh$Uh*T%oopQ!lmjKY7@v z=GT0FLK`Ox-@(Z$NERd;7e=`xgYLg?NU>=(H-p;jFk_fm7nMP3>&K!#$~I{mYiZ9s zEgq9mHn40)C_d`F2o0Gcy}?CqdbV8N+ypn+zwPi}xb0tI+u=boiH)e-a0Mqw0q?D~ zqy?EG9r_y~TEav8F~dXHc{t#wu#?qu@2N!zKu?S+?3L-Ux3}-g4C+X-_qeOwr7LF1 zMCh=?J4;`lWoh}D@`MZKgc9Zz zT4=h2JCa|!R5L>1(Weml7>0&#LbFtDv0!yliTzXAuJLe|Al?0^;r9(OkKU}n zQJF{XR7q#A$1N{nVW+6>)wC#yQug&neHdL)ON`tW;CdO`o-aF})H^<~|03gx2@7WD z;1)Jo;$#08q&^mwmgY;r*$GK{5n3V<`pnwc<$`HYNOZXJk+ESK_e2T3vTo!%@Tv4VH=Y9D(DPtkny9sSErv5K7kt$?E_ zDe&5VuDZ_&I6d?1nmJEUF_=}M zd$#Dvq=GR+o>%%8C)Lt~5HH;N;=Na1RU>N6<}QG;nfsoPfivNmXsY!|iXQr!Q$j{l z4}+iI&C}g?LC>a~2}G*|#C$!Q6?pvB$!p6}`|j28-HKS<wlE*Bc5qulO z#r5m0=KA`^=WjK*6E^RKlA9H-KW#ZtO`HRWto{TEl*V3Efg2hO5knYhy%eRX+1$_i zzo);XG)TocA=`^hjI#Z^@1)2@nZu!~QFM_0SC&ZqgRzQ~j3Ld%bAA; zA!Q6RpY2#{HPVx~1tUYO51^A#wp&hQk9v#IdGZ=E(jf@kYB0ESb{$YqcMfXI>O#sW zdwlF5#tIzTOi!|l`%y-EIK2k5XakJ>n20CpLr@GkrYlT%uuy>7)(Z*B4&_Ap2!wdS zEAu1ijKb+i6$8om4CH(>Oo%nNjDe43Gu6NC691?jr1ATP|ZK&GU z`2sM{%f~2Z&E(}AY8I#7&-^*{GYr7N|1)a=VWzGivE|g)@t<>1HUiI8Iaun@+aIk~ zLP3;y4YFdrN*c?~Ct=ko|NxH*Oj-K*;Yz(Nx?Kp{zN zlK(2A&hh3)`;yc8pN+RdA^%EZ0rcc*KI{9@Lu-q?$`UF=glQNtHM^1*B0?bqFnPb9 z);1VGy{`5*8*VMneE0EOni}WO|LqPJ$bC&Gp1~V#OeA0#+cxsfIneE+qbof=F8vx@ zd+)?dIS`F__UiSRw1Sn!|4f%;tn0~BJeH1ws3(k3aC>sd1cE^5?=@WT0tq6?+3N8pWsz1au-m1n5NWRYmd{iWu#( zbXh#LXSdDkT4mUTU%N)kzh+B&f8T==~PSw7xx$`dC<{q3I@so>zCDb^4mvU$+43Q72l-+HlbICo|_t zP5T&_J89PeeqoEj<6Q#smR5iAKKwEMvG($#ECZduD0HiaNS*poM7OG$OHVFJ&R99w zFJ(EQ3k(05ySTBtn_uVTDG^pz>IW3VK%?u5N1JIqDp5W`d;2{ic8?6GQk4y!400Bi zw5UHmNlwA?%we63RQCF-=faYvbT*IwulEhnHtaySMRww@*c|m zHgHX3dIUL9j1izS@A|Z02?o-*QX7HT$>S}T79dXl1=fVFPpd?7@@qz-NO~s(wu*9F zP}}4pPXYH^Gicv8F3|EP_?|4Y5diNbXraCT-4stkng;Y2xIMLI0is=}AZrJJ%IRrZR0jKhd9HIC4)Tkb1vO@uKYH*|85>HUohT*HCg$9V?L zEJw?mzdrH?Kbb1-SzF~neYA?ecT{8wcAkoO8f+kPpGv7RbelX176TY_Z6d$E9Df(b zlZm&3T)t>(a*_6N_XUI;xk4xgqCS6jc0y-Fv^YF~P?xKH2KZ;|oSr>3ll^ybC$i$# zBT8Pr|D;mTKzfq$Q%i-3Gf3t|cJv@Yv_cWVD&y7->vgA` zEx>2Q5ZeXKT>mwz8l%CqD5%Yv`#-p8O4j@qyqp_kW?D(rIiXUD23RM-3@}@Wu@qft z9nYjESYDpRrRhIYzf@^jd_$6wEMreqUmjgMqxjtaZNVwfIrJgjaUkl+!eym7ImO6W zHePQzJ!TZbiS+n(CtZyS62@8wBVP2w(noLvngcO3YT7t?YuG$;QHo0wb4}EvGHs4s z4V*|wQnxIFbRJiFaFsg6t%(1i6;`)FNv}GZ4@32c`|_ zzSNB-DcQb}erAvJFL5RVm2g6)9?(OCpGM}pLr1HN+u|g4 zv<8ESCpk@Ls}_@P znmH%?|E`x*NwJM-D@b7HM~3wea4Y=}Mf!lIK>QMd9HHnUJmhr`|*iuzBK?&^j9{$ZdQ3$6F~9-IODPZHjZskm3;;CGs{u-^z21=t!uCjX{m(uVjft=n^J;VlM^zUy(=AybjR*)n zN)g^&;YzbC=mby5G(sJ6D{A?d{^Zu85PJ$v()lFx$qgn*{Ztd_K&q$@2iw%q(?&lX zs*X>|&iqdys-kmOP+cN&Eg+hUdDR8_04Lmgi&tCm3GRq`OM!`cIsdOksujJL0tEzu z=2JINn*2=GH`o^yp0!q)NG>5Vr3jX^vznrq3rzSScaE z*7P|i4G%2gYfoq!FhqTh|8G?}qr}WK{4{t-qobaZsp0iB04VBCz}4y6Do>=$A8Z6N zw%l401{N{@c}M+I2!xEkl(fMd7MYEOJqZNC0wC}A)RMXvoKA|XXBaDP5S;%52m1vl zeDOEDyZXl4;Nf6xpZ`|=HTj`AY!5|%pPzX}`Jdqszws?PXNp1jnn+Vqi?kUF3tLVg zbvqWyUk3Kx3r@WJ{56mNekwo^*E^1w4LOg+d++51bO^++fByXP^(*bq{GFNEf~Hc6 zb|}7q!Ce2)Q25wR2x86ZtvY}uDii?2XUvnPR_jwcqYXV&2B`yCRb2zv<*%3Nw(vbP z&xLa<3k%mw8A_caZ)&=LQ=~V(cY@QiWr~WvoOX7z1r_bI{{H>|iPlqQP~-Zuva)N* z_du**`Djv=cjdw47*b}`KpN0NXJ8+^9>C>kGofWaY1*sb1X?eTU>T~#^Eq%}d zp`fS7HdA2|jW2Nt8W|a3bs>uG9WfVloEO+_T+{ecQ6b~xR55kLz=%A)u<-Hcx7p5} zGqa`EtNwnohoIu(;ZF{i{QLyCimd=+%cVME0RTBR;00mR?{Qz4?uhW$xUHOBPc71C zSWs^79R2+qx6*d8q@bvX@xj+uouIQmyUSXHI!v3iy2hOV^YXjfPnFy4w2sb^hi2SR zv>pV*=VB}F`^)g1@#$Y?=+#aQKy-XD>cHb3iK#N?X*70P@Sn}@9~h7U_UXCo&+GT6 zCRa8fK%zLG&Kh>4?t4zG16^SZO^ogQOpPU!)T}mF`|nzu#19-^@$j@a zAFw#}Dg;opDa=$119f#%VU~$;mWNxnoFU#Z-QA2_Cf8WBtq;p0JG+&*J6;m!f0-`V z*W&mByO7t(NI-@#^S%N?IYvS`^Jgc{nqFj-l-pJBw}@KL=k2{uzdx+3gy8kPRP;xm zvR29qJhrv7>%O~K4iCKBA#FXK{6^(BvgQh#lkfqr%S+qW7)4^u*ETdT5JhGl_#U+3 zAD&KW{=VL+gfoOw2Sdihaawk(?K4IrA|_Xlhj@E>$xN%eHkbTPxc%0sOyTZhZP3KT z-?eoy>?X)T4!@4hCO6Y@%?tsIPa*>xz$#g$bf&&6GI(}J)yv(6NZ+W2^r3a@!27l% zuArd=W8=w_FJ)O)ljD|ETW$tcf8N-El?FdBQ>Ns9xyo1w7Znv{-Fpbs6p#HJC+gV` znM#Bm0-nvtCOq4ermoc~WPtVEn|jcVf#5I$smg*)sV~^?1!)Y-5@YuE+-@NN(c#ja z))CB`TT9+6pH$+0GuyEgfy3KMP+q?0(nM0M&M8YDZ(EJRHPp19paeeh9yTU6FlUxV zHn3x;2}*oHKl}0?H&o^laM+{$mV>qCoqOm(z=c@j@2Cez9d(3_n^8jry70mw+sS>F zC`7&ZwY4=_Dz{M(i)t#M#0RM9{juJb6YGR0+Z~=`>R;t-B)+29KCl-{-uK@>$64m< z0or?Yl^>ZB&B*@t?jW#B)H*xtLE=1O032U;mpGZ5K*)E-x!^=5lh5~Dta<$BPfKk4 z^Y>n#8(J_{wSIvmUeMC1sHjv~ojqOf*xZx7zw=u3D4|#(BO~isJEEtINoT>)p4M9W z@S%A)vv62dOA5U$@t&+7Gq1Lg1c!9rte*OMmiys{G8=8&vdN86k_lfz+xh&rU*>U( zhi8?6#Cv;t{bOUjwYE=KFByXhH%y|?PlZPLOQ>d zWtSH2up!@b+++Qg2TXq;*2DZ1NY9jy;uKb1ztM5-+&sxd zx(EE(vEZ=AY77_-G+gy?N^?2dZ{D;?T>4A2-koQ9-#2XzA0!8Tv!LtWtq0o_HRhBh zrP1JTZ_j3e%j|yXs&xVH`AUoU#!a@Qo#eug^&dxk8e-`O=Zf1JV33S{n z)-|ptMo&ylg)b~P=qPDD=hoKjq&W4;FDiOcznJ^tV_6y0-M`K;fQQl}l>ie9IXRgG zXg8&>QwG)EN=vsJ6pT+#2Ty5;;i{$ud{X6YWAtZJmoryE1|2tZR5Dc$E4|^IpPvW3 z!MwfQW+L`W1?^%5zZ`J_Vl8NvOp1#rfvc5q%N#{NC^7kE1Z|QhGAr; zen?{-hpnZu^dY{mku)0A=g*(J_TUCenL1Z0PejAB3%t9zRI7}Ob%ALT?ch)ej0L&+ zl{EIYa)RvDQV5;|c{sISBNh>tX*-F%Ze`!s*PIjMTF$WyXL!u?^kU@wW27V`jJ(2h zbvyR12uES_)$Y*CZP=z+LA<-f$uPuqh`S-(5~apUT~Q&d#zBgo&0-UY;`HW@b~ycI zjL!*adO`3cY;0r%VnD-4f?d$wPK%2h^X1#O9t^tHI3QnTtdTrZ)@{!{FAXn`B1xuItsVT=`r z#Za>ggBf_Alnb-HGF!=VAAKf`1iMRf0Q-m+dO}eZC@C|BwPObdv9msGZ;7maW#RqQ@?mA*V$`2My2K*=W4v;@y2V#CQzd%li_M0{zIz^jnoT}zS(*n_ z$kpDN1m5MU)pxGN4e9QopsDdT|CQNoSPtlUKI4C}7|mJP`XOm-*`gSt=1h%*V2wgRLF;x5`+pv~kKO zX@*GL+}t*Hc7243w2`0VBuJw@e-S>}c#`=-LD>}x@7DpSCP`XTGY)no3{gtNT^WGD zFh-kSSRx~{hFRK|^4i>!s{*50M`Sc@BdN)CmX$Nu7%haIeI?#}w;i7IN8PG~S;S?h z!>MnwNcH8LH&(H15Iu=Xy4NW`Z5$jrqf&;RS)Ut!@|rb1F#`0X-rs-t`Rms~E*zjo zuyJ&RY~5GWtXBq{xo7$A`&juOy6m=|XjqLutkIc9*jL`+2He@teJvX!;ZHVK{u7Fd zQHVKbnPw8}e?Es0-rduvFXA0zNGEanK+*>+TbZzBP-O|w; zqE6-v8#UAU1^5wTXGYFnd&s|GGbjd)mt@ck?#A7KAwdTuX8y|7QzDrz2}omjwOUt4 zYAP$_NM=Q4|HsU9=zzP~ZbzbmEmTqrl z!8oa2lG5JTq1tvi>bcnS zqv0vdn48Yd9(>6Ny4#iT!z*!iUS44eQnx)rBNnNtD1#cSbmSnniq8yPN#82(aq%QB z3H&z2mKD_1%S#zv8XDU1qgjoX^=?MD1`2|v(@y?n~4s; zyt=xdsA%U4?q03;*HoYJu)&_E6Y!Ne>s)v++R4P^q}4XrM;ZTO0vG^!aLETBoxuP) zLUn~v-MWDewgE%MV~GhlCNZjknSR%D%RTcZX2L?CRlItfQ)_UbIvD9GvZx%m_4LqS z*`Vr{>Bn9y2hNu9rbvbv&fLNsbw1i%4;%DIENuco)#l&Ucvl|?6L=^nc=zg+8bplb z5(SCPm!4FZMmdQAl-KeNBSt;O#>qA~w)dI)3>UTkuBba#Kl_1pbefVxcBNLIx&6!kSFRpxhuQ_E^3TMqvm zeyNcAAGHOqcS4C&-2(?rQ*sBSdP@TJ4O>KKXMK_%oJpSiQH8qq_U7)%pjl`h7 zr&y`lVXW)Dv5F|ba-0c>8}2}9;vQS7?{Sj%{lL^v_l*-ao&r-f%Uf_X={^)dBriGm z?Qt5Jd58Z6{QAtJe{@tqI)67M+xqDW+@jMd^F{D#q9cB-4Eyfx2YQY#6Z)ty3fPyj zuapx9OZEr;d|vl{0yDEcmIE`gZ)(gHMM&h-M<|DLUSO<^oQz4v1>UaZT45kl+z!44VZnd5_PXBq9z-vCF8cp~mw(N1S`rfe*71y@Rka+N zfR2KmDdv?!@wffv+^9Gro{J@(3u#VjXRl$Y`)xQ)|nRO++<-=s32ftrX0cDyO9hmMW)i{ma=TdE!% zu@RB?L$bvr`YX;qNLKv6PzykUuNR(Vw2%GVNW z{EhEk2mq#j{T>qN9TnoYhqC%jZbeu6R`HgtuMG@BX*_>*8N&w$2a~g%xvVaDRTH~E zyEzZI+qz5lug32%cnGi8y{wQ{RBUMq1R9C3_i=-5vvYHf`_8#z)~UJ!JKroc2jEmm z(>Ho=e9(B?PKk6Y-(;uzq%9g|!Oe61&-p`jbrRZ`;IVQAf6nA8k`^G^)(T5$1s^k+ zW@S<>2Y65uS?DDZprY*Yo`}iABG~s(cHqtT<|*LJ%^$*ZYa$ zxWVOJ;&8~|R~3D$8`&-67WI>;l?g?<-Xu+lp!smBe=`M9luln&d$uwbZ%iw z5K|W_#k2}k>T8*1t_01^UW4SQ=%zhl;j_u;U96ZByyc)hy07m8aeO=!3LdnmVnWfN zs8X#TZuL2F`5npjyD+Jp|2I~&fE(_zH*JI9>yNiDp6yJF)1G+uo4rXT$#x%|9mxx@2Z9Ff0>I)L;Cgb7 zj^zfyjI)|KA^e?5U3CuTPeZzz+&5R&lQg>`*#an-SS}{cW*-RS#E-xD_*qIlMQQ#0 zn-Rd%j&7%x81Xe_C9^eqQ!xZ8X0c{&5b*rY-KC?8jt3MB>Z-kKHn-(mucZq<^FA3LO+Hy0&k~WY5)^5JqIsHs4PWBVEG@;>j7i|Artv@! zIaby~D|7szDwbmUK6`_ssWes=UKDXyqYD7P;r(!jAD@sAX;w9hDzd(`y}K*p?#=`# z7610Mgv^nE*|5%zg{SqfCitO9BL31)50-IU2o_mj_u%I_k_-h#&zVp=a z-m9CfvYC)s00Xp^LZ$X-|)=5M$7fPC6uU%;U;J((KGe$ zz2&5_gGnc8)VvQP<9#E(9i;wzpz}}l5Kph*tZ|5v+>Bi}s+fftbMKSvSuToGr9)OL zE8f{k)3_8)y|n?h+&<@k6QitvYYrJv@LyJ7TP)9Q6%$f1|b?O(;s zHQ|n?Q9ou6T4rAvE1T>{HMT}(Brru)xv6PfnrXlj;pJP++bvCD2TwD^(o#?~?>)u+ zX^A8(&Qj<#x)8sViqjMaJf^q6inO`dibmpcg$c;-cb8*{$b+%1=4d~J7* z0k`J{-lK^h{g|Ti3z(~B0S<`)xPYyaB?&FbBhSDlK zqn>b%Ao|4OncI%~c0>+Z4>Ihz_#xROx1T;G-n%DDCGJ)ywm!V^*$})v$rWB3PYHg|GTJldv!xm3RGn z5}cnjNotp}^=t-V&(^1pb z4T+T(d33Bn^;A{Zpk5ooA`(T%WV;kYbL;X1VBoZ({&t&Noo2_*UQNpw-Io6nD_q8^ z?V-YV*QtIu^NWR6!^vn1Jqcc>fuX2y9KsR3&~23eF9rUR{{>BwCpQWQY%duJwktzl z;|Sz6F4nIlIUfccg1k3U^fJ3vPq$LOl$A+oXjD*$C^a_>V|sdd<(HHo9P~ISIQd1g z1?|y`H7gaIoP?a3HiU-LpV0^}i&t|KTjnuBZbuyg(N$EV;}ceUT7BGyhbte8{uw%w z!z<>RAN+es$yRJeD*aH<7&c+6dl`ot(@QT?u;A(>^`-b?J$85H`7CkR7 z6$=a6;f+7wH-acOqNd7oscVCxLwPE(1|}wvWo00zwlh2kld+BtWcMV+zz8;%y2!k) zUoFl;a0ruv4M#oSyg9qigJxC2&0#_5wd%C^rOpf}Vz9ZiS*WPH)p>3usAvLfvj zzUQI`8!<^dysWTr+yY%`MZO|eeDt{eguDe93|fqO^?kB~V5Syi-W+t$Wn^XwiR^13 zGgJ%6SgmbP*HrVrG&aVJ6dv%<>@BNYsN_F<^7H4^wWOrT%6Gx)btxsppOH+*rOK}v zVb%O4sr@N>Z-O)fui1%7*xCCbdujG;m70l;3=e~r@xzH(S>kG$tQX7RfsV zB>pFv%hVI~P@>xmh;?k!@`mfsn3tzL$J3|Jx(Z?}EjLbQ!9Y(YxcO3B`(r@?Rl6ik(WOX$W2^m@XX3m1*@pthzGW-4mzbVuL;FSR$whx;dJ`A%8w?IX>v#jD# zSm-z=ep2SsQBW|Q)dG~zooHmn(BtDEIINh*XVjg5G=#}q^jdrWV&2zT?L9!kaMn6z2Bq_DZBxwII63u2 zrEv1m0_>fbjq`zk5i%=Xhy|M;kgR&--mk?33hf-)+wW-Ur#qwL@!zo9Ct6m~qx`O~ z_k>g_w-4k^DKC1>yc&{{4Mvrhzp}c!)a&>_%F}UM{kB0qAotcuIVF`sy=m5ZBqOxD zn`prmP9w6JRpWBA=aqiofzGLYLLXaE@dmQP>zE`JGsn$DDL95}z{}&9gcRGj-)vuH z5eW&o-mMw?4Sa+sKyKm#1THhqL(hE2CnkOdwyUdivl>aE@4B^D7fPZ378NzH5;8&m zG_caCwWFfMjVhW-EgPGbrWY@=%%~&z`6<*!O+p&Q6R`OI(;hf2&c&KR<=4i&mOs8^C= zzp5064-H1C-{koGp}1XsFp1r%Xc;wTQXYErJfzXO9sbgry*uz3pdTY4Ro9?n{sT3q1tT`4K* ztA_Qq0XoAi0wUb-vdUy6&47TMtrcaA^71;|DQh)2UbN>AIkugSqMjB{#~9dF3e2tq zs*fSz_h7=6-f?!eiU=tr83H>hDCoZP9H$`QHg4=J+sm=JzZ%Ot9B~d9YV9!VGWHgi zAjXV8`$0pa0WGesUMTe5+$59Xpiuf%tW`+z)Tr%4`4uh2C-qF-x1Q$lNH8wm#>?NT z!<}o^l1YK#8rmV2^yUbS?*aft=eu$QrxUi1DdNkGr&#bmca8czu*odN5Ta44Opmsz zTW)BMo=Zd$Kc=c1C2r-mYhT$mQ`Ql<5_B_S#>2}CUvT#D7?tvZ(~tpOoF{*7v_g*+ zluf$vV#yc2kjt;bC5GXwJJ$M3@LwTDBK*n8uaP+QK=6Fk7fk{$59WuLvfDAW%1KLfnbiQ zYb;}4CE28~x|L&514c#)Dif1zpvt{iyS{|!FG>L&t;#M^^Va|XwMa5a_5CDD zPY`a3C8AE;W$;;8UrOusnY41@eHG6bmJe5G($%E>JllnXMr<&AjVno+2PI)M)S^$xOgCV3H)lNo zIrQbnp3$=;N4Jf&5z*C;#D_q*r_)CgD-A*_86K`@C0&mPqJ@oGUD@{=*Mz2oO1}|f z516lH?I2<7O71dd3PjFXl`M~c+X!W)YeS-O|OD~lNE&yMq^i2I+thY`FudCyu5r0 zjBQE4V83Tc>ax_@L|oz2Kcy)d3JgMqS|z>qxgfHChyChdbLJG&)c&W>L;(4!E|zZc z%E}hNaux(^As8?gpv<{(UG~4o@R;V8N_lS$yGxl4U|g+7RUw2Oj)P2PdbT6 zWY(TK=jVo0;I}FSr6^=ImIO(O>}d&eYf_#J?=Z{pt+ioOfIki_A~!$ zHHcISkl8H^WbgZ#@H2;@K%YNrq1?aQ0?t_Xvz+S!X3~!Hyg{f2?ew`jTdt!Q(Wc_G zY}vKH%DU2)55Qjp8582Mz>k<01g8s}1Y-^jX6>-USgOPBN=tJ3I_^DiG{p8!-)2>o zRwwCG?N7gR2}bGBtXy92ALJ8eMPz`()6Q|eT(YTMbSbOos4)pYY% z!8)3-?zz2A*ZB*qYFg~`?WrCKTJ<-Pv2{Mr`v;L@*Vuo0%f3|M z$kUe{s};QE8Jg3Gwh^(LsZe156ZToySv+bAC>ednicpwA7*sb_5ZrWJ~t@5}~JO|h>_q{s8UtBCq z72Z1y0q^HENKS?Ap5_@;ib_Ep<#wNvhMQS>)$UQYfWxgGK-| zdc_7b---#0M=x^l-1hX?$3U0y;*Yh2d$NHJuaSt;06=!csPZ(SNAANt<@ChMT?YZBeuFy@7AXcpf)&*#Sbns|PQ-;6yKwt(`k-#1@x ze>(zZ?>77X9g;n$;_Ew!NQq!lCoY3=cU2@UA3VQ5kX*qaq&WpGel-h&AXJLnfa?K5 zG<0SHJ=0|itliUHQvVq)9PZ|l?dPj9YJ7I&# z%{j+y@ZCb-Lx>SBHuHeL=henTIN-QX-A62o-^?=vk(II}7!NXCoNFl&bczZa1Sc%e z{18GDYY>>ApY7aoZWOZ7^YD1h$jNLsd78aJ^NiSHo`{VJ-tyCsfQUT)cLdR|L|@Gu z;vgs)pzW49?e~p^T2|E~1KGkqx-i7fz!B)nxo;X2&kJ2`%S(_3OQFiijKGP5SMIh( zLyU3|Vif^uT--C(GaVT44n2*#)k{^C=x5gZ3vX$5t~PUfxEmHe3NL$)fMtF^L%hEP z&b>#j#fs5dXC1x16rR7fQ?)Sj+uUpTo#VUTH)*LlLMd5U*5KhgoO5D&)7PNZyr-oM zyi+GIVCc5>s+p_wo{ldhp|2R7SU`!*HatGoM}%6CZY<}8wNlOMTJP7_-vIjU;uL?| za)tXskB__$KY$(q8vJx}NE3LQHY_D~pVGF)vO?cG@$P$sGRFO&o`w*l)QAa%hGJNm zZH(gb$4Ij^#oxiwExm2rQn|~; z7#P`3Oix?XS0=j_f)kTa1eCkzMx|zaOtpVF5~DgeIrUmg-cT%j*xBoGnw2Lr2?l!q zVFzb6Bm$Uv>MS-E`rvU8WK`ry;KPkNs~I0Pa4dpu`2Msy)|i$KcBL^&tD4Z1pX=-< z6lkUjUl&UHT(^3Jj*KE}qQWNvrI+NK9pR`hb)B~@`JHNXFSsjocNi|I;P3x=pfiEO z*}#|gBG34Fsr(@Tz~C)GZS;K&vrc801`kX8-t+KGM+Px8W*l7BXrjR#7#9X*Ot$Ad z7MbxO$|D`eO2AgRs!e?a4E1~6$6iG1XwqCK68nrU0e@I2q75j-v+zu67!=ncoP0lh z%@z=a%`$DC^`f8^Z)mFkuaju2>q@|!2IW-6ici0lr@Ye@;)n37h4VQL?JECxRa`;c zmvhwda94K;usMAhufM6~i%_(VcL>t9C+;TZ#fb)EJYi@Ag@<5&`$zjCH^opI0I+xzNG8I^oOW~U-&6U{v5Zlv6E}Y z1q)t=VP$$9r<10zx+DIGWS9g6 zru=70fak)M6$yq!XHicNd@4rGwZM5!@v8s%-fH6SkIPr1P5r~CnbKZ-?1;C0>QQdG zx$51xLo~GUM_sb^iiCY zKh_7B(}evJvR#nUq8I(5X(b8{Pby6`M&4+RWq}YVsMhx-;~a-a0O-=ldV01nCr{L0VF}K>=w{KeF%cWDKyX!aW=k@+Re*5?C-nnznnLBgNGuqy>e?VeK7k`{z zxF~ei*seYHnlphwdVSV|Q+1S;xgUGLS!ST197^dqA3#0JgR8&-Q*{4O>}>MNI4Yu7 zMZ5IdTZ4Osl89V1eqe9!i#+l4?ZB+=KFL(t}e^Pb9>DSzFz*?Sq?6fdKc`1dGCXL9$7kJcAGh zWJU%Xu4Eb3-_g^|9NK*})S4YgduiS6hyf4+UzHa;wGbKM)T#Olll?G(gw1^AK0}vu zq2dUc@kb8n)m{g0!6Bu^QdtF-k{#Qn8POg!J}9vVv0Rg5RPKpRZTp~eTv1Z8xA4fB z-R1-ad9K77iZ_@~7t$1!IIbHj^gDipVLkoJljMbjq$IKBmBBQjF`ebTE!@=gA`DE3 zeZAwHkKgsdFbq?ehcA^TyD->LLvr^$;ql`~ge4N<|p5Zq9E@mfcaV3a|Gh>H1?fCAs^tp{fdV+?wMC@KO z#Z{)hOw?$>vn^CFdG_w*lUx6xx%2%{?jpI?%U;g!;FQGYI;oc69s5Nr=6%NI zn`~tzCOM_60})cu*MHp0^`-x`s27_}v@2fUwMfab&287z*I}zVk3Z<)!(p*@RDE%V zjrF{q-dJC^u%3u_yF<*yO)`m35zy|>E&0N#jVz5%L%0r&V%wl(UNi(nzk=pud^uwV zlwN@jS9^$eAx|i&(K{t-i%JPC{yuIAXC=&!N0P}`-41lrJwym7MB%3WY0zqrh>$9F zzDp~W;E_}l*Lz4~{Eiwyn|2lV{Po2V<~`akE2_Q&Tb6GP+son_aKk)z zRxc8-Q-jUA+eV{DV%L9w-oo4Yfpy$E~C$A&4lM_F=xbiRwhSn5O-`T5(rqKvdbX>i=9_;HpBENO;7f=f`9oLO{H=Tz70;3ozAJ7L2ZkLTO{m3~OC4A|g3 zeS{qr6+I2%uBQpK+d+_fw}4{x48)W<@;f$m10Ks&N2-`6oLlTg!g^goFdr4{26E`B z)Cl2jxQ-q%QY_|VSm&HMQoicniq-mKRQEcO$HwfJL@L!D2KJX=(dP~|jnsI9Z=G?j zy!#K)I2uF^UcDL{5cbu&&qw(=X@O0jLaWlr@XORKgs2Vd5x+B=eaA$@?LkZF*`Zb3 zDy<&;<=D9M7OK(h&FXm?Yrs@i<}h<^69tN`1KZD*AwpuRwafzR0D$mTWm++TEO}$} zA(E>@u!1g##|_}(ETXB7c9ye7JY?i#d2XNj?&q@x1I-l)Vm&_BH`FIT*5o!IDp=$6 z-Lk57eNe)$wUl@%8Ww>nn_*vs&K>o5`p7hlObsPg^)FzfTGhN&c=t01N(8RR=n^qA z2?Q+r`7$P)^)PkOH+oM_Iv0W&X{9fIC_5#;P2d-WW`{}6^LKtxskR*G2)T!=K3$XG zvMUnGcyZ&xi>K(Kc{x&;);GWXEIMJfg-1+6#zl*9enRFUtjK5QBagMPldg)M$F}paq$# zk3%A~zG&`BdGjzQqbZ>%hP;`H=NkV0hBhc}@X+acn%5z2{hrn{XnQv_-wNTbpijP`{NLaz{j?> zwv~=^;-5WXhC#7*oHl=+X>}@A4+gm6;6_$DFQHYF8;|B^^hbQ>U==>j^`kEO6tg?z za(Jt1sfyPmbGXtQqyl}*e3qa|=h?Y=Whh)}Vd@h3yte)HL*A3`<+6t<8qHWj-xebv z!OQ|on0tJD$3dN8t%1(!;UlV+PaPz^MQhC2(qsL&Fn3c&C`6NkmI3OR+P-leZ~Nox z*x!hdm%9_I+W{^cJ^R(n@fCf_<}c4*ZhpS+-O?x4chOf-zfl-y?;80G!N|zQHim%} ze?}FGR^#x+J+BH0fkl0eVSVm%b=jY0;jJGZos+r|r7$3UfI!IM;+o^2J zIWFoebwUU~sFekmxoc&hd>}1YIQQy7)f6OoLfg4K%CGbK6=89icl`zXV;JKXp>#yIr|jg$P2^JPZ|U^-!rWpiTr zxOYk8RebG?bu;NQsE}M>sNi$t)V8Q|w=|aU6E&*X=xi`7+#Q3zT!tUOs@$ z(B)g_8mU@k=c)Mz&(F6!xkzBE?$OFI{bkA8_+y)YQD<)9a>zlCNZk_OfN&4FwL{&jrLJE4kXQTkrfbqS(Ut zw=(e5M4twaL$L848j1Y0nc7D~4~--jpV-exz0uLxN`~W;(bC+f!5<(0?JfkZJKKJobjo+ zkes3n4{;UMzF#$Ef(NO|FDEIppL8IjT>tI|1vgcuGy8UaIh*CWd7)m~htWfvYQn1* zN)EvQw(^R^p$dW^(dHV$`!m;5JKVcn(d_cmr5buyBQPi^&|(PdjFwoc85@$_X{gm> zlp)1Q(=c^eu-$l32ZyIsBqb%SjB5`)JiKU-AM(c;=DeNDn_|@lQT7jlv*-;W&@3xA2RLxa|)u+^SGNdo*+{ zCH~Y?E`=Y=5B&RfTtiF@`cOtMz6k8o8RJ|-t(uMVsE)-#FV(fHMEW27{_~Q=DKwc7 zkBo_?7=m+J*hMw)PQ;`=9nVsDllYktH@I4eUBd3V~ih4na^tFse=8;^$x; zE*57Pv#^oNqp$`%283`?OX!giG%E>C5a`!hzeZEMaCx&BO4ttg9@BR;aT&Hh%wwc% zF>k1SLH&K8l`cjbU4g$E^eGOKD!4Rk8m(PmVGkipRM-Gsxb}rn!xoN_Tim&I)V_5l zZVdk+`-AS+^mslvf8LY1T+)n7PY9hp*{X6`b15}~)2KqZegZJt%W98WY*{4C`n>n8 zRbz3P*ipZ0{~5d%{^q8^T`x^^FycX9rQZdAX@#*Bl*#X`30G~TC8xJ%P)LR?)L6gK zp-YIX4p+LBA_{+l_mIsuP1Q;lD#Yx`6kDTvP}h3nJ{)AfEp_^v3Dh*1L9}{4nVyCl zk84^k$@6D3rlnDhjErQCdX$;A(p9wHenX(j&9A0)!y-Zdmz4cC3FVb2g6p9m)25$8 zO?zZ;mxb9Pd)Mr1%+5*XnPjfxx`U~()1%P3XzFW$yeo;gS+pVV4Cm>TZ%=o_cIX_x zHII4I`{7Zx^}#)gt#uEpJT`?zcc^Z&jEWpczNk%Tp;_6;!8AU*RuC#4-qQa@Wu-iK z#*rmBvQEb!6)u;E#c`?NHt~z#ko-MA?+C+;h{Q!6`+?~bzWkeE36r%y9& z6kY0KHT^f)b#%dtU|JYa%u$t2?2AZr0Wd;a8zru>_)mXMX+(#Au+13i_i{)k^(T%U zJbd)VD&~CY{7^aa-Pk~#`NGYq9N@zNxKui7Q~&NzniL_xObG>Ck41+0HJRRS-Z}5o zwkp~vbJ*J1y=ZjIKqx$gQ33W9J*Y0w11Mo&!0&ZQ|6ghX=FD4T38AbAsw&=xYGll6 zSvF&ZOUR}|PHZ(>6P`4`K=nZ8%#h3-8c*}FE;xTIf>Iu-Nx;P`P_uodS7VK3lN3DHQt%U^N^C4!)pcwhyKtJvgWzv(Mm74=ci1#*#>n8vLd%3Sq+~BG{gj*6QJ=On7jaPz^7}Q*(Ma z{BU}OX~+g!tNUi%{@qt~vu_nn#}d)q2h1pI`P=Ex)FDE5shhTK|HE77=(q?~VZIbi z6HciPV^+-RWTWUOv+H4`e;=ODFv{%OSBYI_kNg6?!;%yMD;~flSUflfI4YZn_}jDA znA5YiewsqW)6oFApdwgie=NZuzD2D?*64K~pNei*t!G*yWMPv*5HY2f63Xbb*jbvENg3la?f#eCJ3*DrAWLn|Pbw;e zeI1ga&@_Z+@is3i6u^MSxkSzZYDu8b;rmMT%>ED3p_KMuw@qs5^!+$Ue0TZuu zS3WUG*Y*r;H=mi@$7r&Yw?cX z!VeG7$#EdNa>Y~&O(tf>l1ficqW{*8{CGVxR@T|y zl4C+1$oD1F^zou;g4$x2A!T*k9!!_Uf`=JH{a?;bKByOtSoa*D14*uY+u{by%w71`bD8?Vem+JDJdozNf?UtkM0}6^a0MXgbmc^w^#^@eG z*q6*J(wN`9wZ1vQc>p+pscCFIvbo!8&VO@0E`sfXl6SiGVH}srhGAoW#A$wnvq z#rTmf44pvKTK;Kp{$YfT=-)-Tcl(SVmxIs=I{?I0YB{^D&A|1Z10mJ8(lF!8S-v?W zcrfdFmFFsrQF<7n0V188@W8;=l4sI3FPtk{f5}Z zHN%IL-fy3HdRn+u&AkR(Vrhcag3M9_4Am4%B|Co5UVQWynt-~%v zS4zsiu(K85(49`K5@L2_-Ot+vzULt50)5Q3w zLPP0$5w2O{iqx9Sg%6 zS*n|~%y?<+Dt}~DvQ5Dwa*iqM75fxaTRj9NIwdcRi#?V0iJP(U9Bb(F5Vyk=rJ3nz zaW&yCz4H!=7PAmDn2tL1@r5TR$;1t#_#{K4IL6t6;0>B9Pb?W!=f?VWW$B zL>1NT6Y@R2ML2f8Im%{KIdCX}^#Q&h=Z6WL`!>bH84=B?)++bY-7e)nzPLqsHtKBL z-AiMz)E?fwev+z{0jKO|d7P7emyQT}x0D;n^9!(!9Y){!`ex*Q(!$e%QjJeeg6^cW z3~PHZ=#tS}eR+quxk&|p*OrzSki`Tp+4CKzKx($k^R%XXkFClN4X&((O^PZ?*-)CZ1@& z(+2%;pCfi&@sq{=L&9xVzVjnF>QekKD`5*Vmj;69=sm$hV!rc5g|YK(uRnCA*GeA` zcar>6p6MUzVK9LYfSxX07if%2Een_FRXwWu-1Yp;8{%0g9CHG%# ziwx?p)6N&sdo}7T<+VrE{J%YLA_(^Apax7Dm1^m06g_4?0XgUiIY6M|imoLl47i|S z-v?aclrmKS0(CUa>!PxVEqs6jII-kGpvgpTTP( zR|ND8keny>TETozn%63+w6DJRJjQ>e;4Rj%M6|4xsLlbw03i1d`v+|FZ(v&CWn{GB zh$q!M#$*RS$ltECtBcG*CV!M08`@2F^>P)I=9B@V?dhKM@+Y}{up?lxXx&57e3w4b zN2H|*S>BZ49k0z>TU*O&Y7UbrH0^g}Ih;HM`B~cY=kE@FTB7krwysX%(n^d>JBTd= z{p!PTT;6N!OrK54L?}5ECud(NH7FR0T*cr0Rg{_kGb9npQj|U2CcdYR^}SQb>(tBH z*8ef)Lg>^k8}3c24}+X2T$_kb|G_*q4|AZs8){^`z!>`amVKn?q3b+f=bL@;>)@C= z1+?d|_dm(VYaJ3UO|`UaGkMpu?ryj(8|?=g+_#*6Q5G!$PV#%8Jt8X$6dA@U!8VgR7uO*kAHC&~&T_BJ!GSg1j2}RV z`NrO8IS(uAdthoTeI?_emO%(dl5=+e#A~RxDGUShg8M`B;h_tkt7Wae#7%95e<#_n ztqtO|9M$lVfVb&Iud?Xbtm{CV&E@e1I~SMWmiyJE&+zyv%~f*i^#c`^h&rFr<>j~6 zo4Ojo^7=EJ0?{x-S$+K{bb;5{G@i3h^jcdy^mY=CZo#|Q&ch-$I~4DFH8W{Q_1h7W zY7#3)K)s9-u+MebMiMeoR=?o2m?$~rZuTee$lRZm5Cp(k$M?IDOdm$VTxG;ZG2gHh@upT-bA5NPlv2$`C^L9pR+aXFT2WJifyp> zUMPQStS+1sOWy9^zU4mq6$y~2ecx9}te^oC-)b$%H84ryb9px^FD|@6%l9_;9`2u& z4&1smcH$?aaZrZf{PhUX zct=A5cI0f20NBHU%cSWc?AT!XQ7A!bEjI_p4{c4UNPu!czq>tamJ^>uBAN4|#Yv`& z&lIbL-q_fL>+^EWi1jwCH8mMsgU%Y&XjOdmZqMUOjVG#X{yu`i!T2Qy5}}XT@O|AH zN$`ZfE9FYw%9TA?oLxB0rt~k0%HuAGyS~8peB+GcQ^-miz>pvZh2X6(iGk)25^O6Z zv_*t-Z@|?6`V%m37Xc>?!*{oy8pPY3X~ZDaTF1KA<%xIU-Y7IcVXnMV0?Q*)LvxH{1i2>Lu|}i3QWi9`&lK%3xKlKJ!)wx z?-lCn>l3K8qVrm01ZSw8Kkkf4Bp5e~zr)x%s|w{VzyrQ62|7y}{rJQDpj0od&L}UO$yUn|OY8Go z&*$Jj&@zIF&6LO=3~C zZAd-1?AtdL?G(G4OYv$hSu`e?v96&ZwYd0nKSMSQMk6Lx|L4ix#)hzf6Cg+bnFmXV z)6!Jy?M~&iAHZraM~RqpA%X0&a{Tx>IQeGz7Sle5J#6N;*QSfvKvROwcN@Ty*3;Ec zY-UCa`YP=aT7KtCSYDv(sKzG`CG4hpLz%Dirt{K=%?ybbOWElSV--7+kcx{u6*MX1U-++OL?a0C?&#Ixga_hkgoW!hPT;uuvkx=F}@Z9(^SOU{yFJGHItIy zwt+U6kR?fJEsP^jbZDc$J69w{Nmvuny06WzyDAFseC+^I7V`m@A`NxSl(%a^!`x{E&|tu`ii`O+#TCM_I(DgBtZn7;kZ3<^4d=biM?f6oQo zd)}whCL4b)m1f`a-*80=_WXnTP2zqKW`8ht!x1b$!y2lzA6@1m-U;qz{NWS1l8gGj*NiI zjY3lHnUhzq)CC0IK6tQZIm1KA*T>cB=fD5C(NDeHTvfG%!!kt&fUwa-N$^}OeQP)J zRb?4S;=V2SLKwSG6FOPWegO1`E{*T@J4;K`U2cSUX;V`_28ylS)Y8qF41Xhyj;@S7 zJS(xQs=4_m1|}7C#u~1^KB~6!OH7ZR@x{s4RvG6Rp7Y_IgbQvnKg#eWEo3>*8YFLF zyLy-eE<+Cf>76;Wy4_~-^Q$a+yA>m|+C6UWlwQ40)}FXc@8EfbJsadsz1+S2;#!`^ zO_GB5Ui8&^#*ngvi0OmCzg>wz#)mWjdy$oZdg1JeTYtVBiG;JJm7-#QQGTI97xV3# zEkh}sE_&veL z!*%ZNEt-Ss(~o4>*2U8@XyU(^i=EYKhdzq`O2}7ZuA2R9m$-g%v;{JNdf~;qb2VNR z-Qn4CWQ^QLj{N@p*=DS%P`IN`Y^G; z{GGmT5BF;uYZX$fb` z?A+|i`zr&BQa@uvmzA2Xb{o$DI>1uPMYr4tJxddfNvv>;`zKmSN%g>yX$Wgi>i%kj zVb3Ra9uLeg{!a;Z+zU)e4Fzd+5bf^Lw0y_CnlS>)$vf9937;Ph$v6jqmlkWY2eaVp zpWa->W_+Qxs zHYAbDA78dCGPGX^dR`ED3%ho3sQXQ43j%<6s%HD@l62WG(vM`BS?ZRT=<8XkVC2 z=FhwnF$y1q$jN0C(^p>6`8rlz*15qaOO2zpX(&@L`>Bko6`peuc&b_6G+8F2>zh8F zxV1opRC`Q3vr@!r=vPahciyS)7wx4xk>&-!JsWAx4C@U(6?m{VdVA_iwLv#kHj~NH z$Uc9}c7ewC$`%FT+$x;Pv zZB7_0#IlVW{khfR5{7zwXmT*Zs@`%ibAg{dc`q*5+peUV`{*;}#CeZqfNca7f&0$! zB#ldVj@QkJ$h+H%g-&oLv*$;JRbQ#mqFZHC?JaN`&qEmg9CV|IhB=F--N(aFpA7zO zmDTJFHfkwo;hij3FDi^1sqpa!{xn(0vKB8(Nj2v^{=_<^H9Dl=P-frrcXo(hG|o;! zYg8C}P}z58rm=s81-%7SbV->J25XBclpi=9AAOU!_~tA)HKzcg&oa#K?$Itpwz7Iep+r+?u}@W|ND z6!mpimyiCK7bnUX9DXm?Uzwc=t*sHn-*^%?rJ369dgq8bxl!Pv>t4p*eV z0d(!3<_Cbz2^2+63h(C|T|v|_>i-14aXS zpz#HGMPFPtzea0nYk#en!l-JJ4t)5c1Xb$LwpBhI2mltO9cNSL$1tg4zkNwgpP!@u z-5RSJ)7bJvH9|FR?TC?y$!s!R254@H9#=9|9u1~DZn^y+&guXP1n&(UTPQ()qfoz( z$5%nZW`dk6wOB9}PR-*`Wx;JXOV>>ntMca$C;EfswTGyEsm(4ConioQsWvIg;i-W00lVsC^Exr*i7M9SI0#$KLEe=LxtZOq?-2a z;~tV=q|Sio$@rKv;6eQYfG_&-DG>s3#gtMa?FlfX38+JMMRr2QTEn2Od=l?B zTmcGYK8yC8)W;gQ0-)3O4{`Ae&2N9Y9JSa}iVe?eXlK36XVwEf50#_a#g0^%MsrJx zqkLB)_pVMOHQ4lQj7bu6jZo|_B`ndFUdhA5c zo4`JppqQKAnc~n#*vkqi(Pa$9JU2AN1)^KkS)|KRL(-EC3uZsVD zY#${)wM`08%$;YF7FIVVfh4smQHeWp2wLNNz&Hv3LM%~RR)^z(ThFwbvhO3RTtG;o z0V^{@lZlLr3pksrjt=T_nTBoMInxH*bx{i|*FuHh$tD30PUoxwfsO|!&|VOrRiX@H zp8DEb`ohVyqWBd9sXVj~9Y`?2<<-ca&kVP9@%OP1`&j)E<>FL`OHZ~N4ayN*en}1F zl7W_!8?z_ETZC)+4Hk{temh`O%&gL^d9_{)yt0g~vK}EQMCZu3iuOQ2pL~)!o3f}!OP%|kRk*C_qad_|5MG5gz}V`C2O! zBd$~B{~U0=LcdhMZXz2HP@eh*iujW%V3k`lt`8L?f#q-9-Lz({fM@w6m6xO~w##bp z3j%1I#T5l5C%sxUy=$NaH5Cr8%Z;Laa3)KUjoy}I_<6Bv!z<9|(rh`D=>W%`1HJwI zpS*NVnM}%!J8(__mTP1sVph$`PbnHd{_TG@VD-vjTOjMAv_~*D(Ytt-SBAHMRQhH^ z)4XPt4p~oI0)%8aF7n+9#VXJSAg~eZyS>_Tf)a4+!>TckdK4lhW=EkS8Go7=jLKWmz5xiLoZ$^|=1Ou@;!}odph75>{5p ztPjTdi4_yyM*Li2Pm;da=e|G}or9my%e80b2~<}D46}wae!T&|x&^iJ zUZq(arEE8+j+J5~!u9q&sYZupz@~j_of!Y$^FFY80IIx&xDWq+Y_cf!i=I(v`L1KP z2BoD~P#1n(-&`xCt>@uyFDLJ!j(R-nysEDVgW>fPrdY;WOh_M}vOsh?+K16oq@oZY zMj#BOx)uQB6^O{Bs}D2qYHqSx%XbiSnO2bjHNfu|e&cCq`T*)8q!K$dJ3)QF;)S%HyYAtYv+&c=Z>^F< z>cj979m`5r~x6LIYe*za7q` zh;UAq<{S5(+i8}h(h9g^`bi6l2rq(`yaFHDGc#O{KXnTpk=~q-d7jX|uoC97wv30s z&p!(crV2hqWt=jdTyz*c`j_8Vp8R1P>>b@y_uuIbOCAt|eG zk!*F>I1tF4He?R^S%2{jXjLCwk(Xj@d;#>wF}K2L}9IX zGKf)Wb1cdx^1uXFLkZ{i0tb~@6+J!a$+=QufT$nS+&~_-3bdj7^#^Eycn-r)<1eIZ3MCoQP$hyex0)n%-VH0*;-$oZ+~piuQ5XEJYBshDd&o~q^Z!qf~W`_e8z z{ElvD@cD97TXE(@f4XVDW@UEH)D7YZ>4rTCzZZEH`mcgOtlYQ1?90$0J>sB-q~ZWVASfSpA)$` zlaGrk)DyMJO#wrwSn83w4Yzvy-1`)*Zz#i8wqUnI|7*7C+1Dp}0;&lK`KLhYWK3r_ zxd26rQx9{f?iw2%potS)`k4y?vFzYBJgS%ayR{<_dNbSPS5sG;8U$WlQuZOJuuK!U zwxHqi&lRASbI)LA8fYa#g9z`(1yFsJIbLd-o~Z~`FU^;mKuzmcudS*+_d8leJ{m!eMcAIi$cvrY zv-$JMy4Fa}^7AAPa?!H4X&1U$2REo$sSbfR10u-&4HFwLVU_g{oycVWt^%{{{?Tr@ zv+s62g@(zOOQ}3i1gr*qBm_UV1RJ$U>ktO7N?&jP9+c&t)<9EZ$(WysEnRnOJO{&$ zVXe=DG{dxaYp+_{pJK)Aoty!S1qZM*UjavUZWxSzfFBK;?D#ay8Q_Wtyr=HxM*TE@ zr|rh~G6k;ipX}zBj)E#J+&?jJn8A|}P3*s%H%4ob@CNQD~r^TLj5pcomT z;Q=qE+ZnpgK!u&|u(ql`xvLsShj222pIw~RftWojh9)P+>}7hkP_Fj9_Jqv@L->`5 zpZ0jgqJ4r5M;n*F8je}oJaT3{~fr|Nh2_Y3!7tp+5ZNyT#vkB&x=YF^_Ih#l`g zv6}&vl4#OaKa$POt&z$3XlK#4(+qu>%(4u%#PRxQu)RhMVaQBN*e`J-_mhfuwz&@< z5fiK1*Uh@%(gETjQsqlb3~ZYy`$hrhuG4ujxF07kE}@5TLlqZauxg(n>H!Z+_LIEe z=j;z&K@Yp}ct(_NwwFz_zuAhHx84$ha>p6af3S_XQEn)-sPCscf?-xvR8Rmi5)e4} zksK{UyneT+Xg&`IEdVyaLjybK`3O+;%Pp;;G07StQ_xX?;>(ZB%tTI33Rh1G%J5PI zHY`<~Z(C{W9t8m%->qP*T}=qV5A_$><>jcLi1x*O5>fb@dqhd0^9{QyYH!4|%Sm~2 zq&t8Bj!$zR?DaI%?x|@d$nG5F%2G4Xj_8aEtVivGaw}L_VF8#7BN{ni_6YkR&eR4KZ;;_$_@izPw~wUKrvf;+O7 zlN~4XrCi!NRbW|Ty*=l(g6{>G{QXy)x&&Nz&@x9tspCpP_-EG87PGA4u{AB*0<_63 zH<3@Q+~9@UZyi+&g+UF#7@agJaz}_H=>maw0_pF;#_b5O%OwU9KR*NMe24(p7R|sQ zofunD%{cflLM0)y^?Y@w(b3dH<@|z|_viIJ-2Ir=yL;Sa-1`^)_s`KmW33&$QliXb zBnWURc&5vDfc}3K%RTG8?<)l0Y?Huw5f9(-+W~vN8bk}!Iv?T<(R51giPll!o-n9T z_XOw&EiJrA_E%sVR@P1rl`Y17JM#Bp#QL{{?|gLk0JoCqinUhURC(qu-FwJXq#jM2 zH5pLr{`vE#Wkz5_Hw+Dt+v}oV_#)TdoZXPUVQw}l^piC#j^!=#oFOhDF)%0!qmCj= z9q8$K;%;p@_$76hbrfTAa{m1Ur*!bpR?PRgOuO32skUMPGp^ZpF~`EOtPg z*eAcG?J5*l%oP7J#^ z;<7a^M@Ne^z+-R$GWWmIIH0+SwzWH=A^vl$Q6Lk*N4TJ1h-UjknZ=&!L>jwf_sREv zquzOQFWc6bhp;23(mMy~-}We1{a&d5r}rH%dhZpum5n8{QX#EOPKUAnvhXAu_RSw< z81MW)QT}lR0@Dy(V}VljON-#hZvd5tCwm(6Of|kB7oRa??8EtYZR?=z#RheLzvQ{#y-g8;{xX9(;a#GH0yq_GR{Oz>fslp89Nd-G)m-H9FQT^ z_=y?mB7qJME?o>^FDy-cA=O#}_^iO0=FB*@@Uy03%qp=mXlJ97kYiPdBi`N#b(jG<&&ZLyH2Ap!=NQ}>r)U!|*snRxK$>2NBWI)RCEWPH$Nv)> z-2C5Pr}c_U7{2LR+5g@=Y|vU#3zZfa@c`&<2VH}$*vU(aiiK)H$FAYg{%0k~;1P7U zDI1xsp`)Ub&I+`78`<#!7y)VHf)Y2uop$BCvp$cTJ3ObZPU63jt3+n*5*)jEcEGq~ zl}Dal^CG=K0198_qfgn1onuT_zFIB3@;)PS(CX?tWdlL@dQd|cmPta33$S<5CItV? zv!~CqB`n=?rcmoDsBb09Zf5B83 zV$J+{Fxo?Dj=O9mhs-2V8VpE58+fxN3L9*#1^LYH4athq@K5OdGovaD`2)rL@%Cl6 z@O)6f{022?0T%eC1~-bMOXHl=V~d>ndQ{klfA={8A&*oTo;D)9cdxGN2v{=~$}gm_ zbAzYj=Br|N6V|n&@Rj$|Sympr!el%`FGU zqpD5&c0}nv9}q!SU|wmEM$JfS?wD+sbo>E0m^=c}E$Q`4f0F=M;d*+y=T_wi|1Y>m z)$wcp?(70Z`Pw9lIY$2_kPblSl8R6~XFLI_#SIKhz{%*7e8>NSOXb6}r@+ZnxiHA@ z_alF^F$z`{0r3BR!#>!FmoYN2l(-*5txK&YkxqTY>OAWBTLTy=ys^XyEfpK+q*3S~ z&%H)a7U@;==_T~h@$cWe0`?OB)`Z0Sn7$+PlNfa~=mq0lqi5>J!QrFPU@V#@_l_fB z$##NN&*kLQ|7Umtn?^gZ#xRM|mG&FixFU%nME)}g);_OAedgf>nzh3>IbADX5J&$) z_c84bx8)gk#R9J(S?}cgJC$Sq@L%`9z?-}uP!Xy|B!xZmpPT;Qr2p9V!i#bjdeIAf zyX5R7`|VMwoWLV`rz8WSWrV&P6vsKK>hu4tC#+w?8r=WxY=p?fqTV~nJ$45({-2kT zFG{(q{-k(aSLm+>gZFYd$hk#EuO9Ge7#^KPN#+o>E=!Ph%&kxrEC(yV%0wWlpoN$q z4?9*4RN!r{qjl=X@4|o4B16Cz*w$9e>`Y2$QAC~C5o2Q^V*`A0%W&>p4bSS}W-Va# zS=h)faQe?6eX>-+Eg$T@RMq$N_78X;@)Vdh#{Dm!UhOnY-2dQ1ia;xG%-2i@jzA9h zKnQuhY;<@E)wUP|3oKg0|Do}Z8yLfOaA!{c?COgh44l7 zg7E>zx}vd_Q#1b^s)Wpc?ka+r7*{?oOdF{j`_SvUX0Sh`7w{qt2pzzBBS`!M<@!Ne zvq=mvuz6U!_0Ww4c^e0EcHp6LA{VsFreUfx*2~J#WEQF^*7f0M4N*W_Y;%WH1mA#XPO8opWJk9DbtpO5YxeoTrp2e9K&thhVW9ex5o?TE zAx>0>&XuGFG!-~Y6YGc-OBx^YLSIenu3y)eCZh+V`1m%wtoHH#FVwZwcBWr}_gnDP zRx%3)FZyNOsIEG2BnyiKwrpQbLMC-NEy@lqZmjKWo#^4fY-{1YMPdSmDMSz47P z!tfT3k@w)(tqv*t9y$5FZ~e@U{X-I`^mF#{{~1RzPt46lyW1uALEk(3Hc_=1hlhlY zim;@`A}^((g%MDay?bzl{^@kR9M^64+EZqFxQdE+4pOz^O~ON|1y-Ma^+pA(IumgZ{rdnq)ls* zA0=6tUJz-JiCi@Jy^ZXyNRs<%B_%}YK|Foc??mB2E_hLco3B(y5Qu2m=g@KTSo;ap z{Jm791tQYF1ue-3;YETrHC7}ee18{D_1&*HDX;fi$o zD_+&u82R+;qi@ZmbY0g~5$NiAs1M-$9tQ4s$iGECI}Dh|1izqAxgrA-O5MyHxJ3Q2 z5P0PSbI4yP>VFp7oaRiN_+nGTPqtp?lv}$07bc`XrYHJ_XZ3Jf7YLJQNE2IFKpjaR zY46C1P&~Coq05@`3`Ro}0^!H5qcemwJ47yBG$s1YXzC}m_aTsuohMI&?MVDpH_S=Y z#lh+eA;)m8pA_Fb@ZrU=_L}N}p-F`GQo8=*)@ zX$%Zz!=R_AY2zSxinFPMkCr-`u2bx zxCzlxQtBf^Hhc}e_05Z*LbT{l*56_&j#XN&&FZzX0lL{)ZO9reW6ddJF90WdWMpTuWNFYXJKB~jkn&T4)sys$0qT9+`cFCC2@eEmKd^QDkE4{$LAU;4KMq9Wd9!!21JEfFv%%!bWa`i!QP$nAH{POFFkDCr0(0HnF`VP1p-|RgO>chZNvxM zZ&M_<#j6uH&o_v!z3g0Da+SWvWB+&i(;;4x(P0f#f+A&#lH{R~kcQb^_u)$dlquA& zs-D#0zW}G?ld$HknGs%@OpQ_bo|WbLHjg`&?Q5Q=R=&93tolF75GjE#BC{|yb62C( zuo|to*?9l*X8%GhaL2*=MgqkX?NcG}AYK8c8S;j#fufH0_N9XanoREW9s81I#t^|Q z^sQ0LFdKH>3gN8@WJ0t1zpZ+>IaTr0(2l7FzLd;`n%qd*CPUIlpcJT4)R-Z^@&Nf? zMWnvdw=``yeJf&}dxzV!*!NzVHsVNS?0o(DrN;puIjGU^_;37oY~9Y>QpM3soMdgW zn=RtYbM8u;XSM zk^e~r07Tl^zuKS>R8iu#x}1|tSfHaQ+56X2_kI?zb5=ZmF5B_}`6R=>)fM65pKJ}! z&*LS#0E=UlFch-!bd+0+MLI+Qkv5SX-V3CCFT0Qr$t$OYP^~PF#<|EP!fmoT^S{=1 zPpyEl_z})aEoprHRIv?5PUNHbJ~=TF4E=TTcXu~79&Nuts&W?Gb0%TpFIuWg0E~ZM zg)}zj2SVZO?yH1jGlzx2BC~Wu*p6#rZP5tayphV1+G09bfA&|T$tX)VBnY`>wnmql zo3nN(Q8d&>U#@!C6wqq_^kE&>6q~^e@6#<`p?wI_mmJ~DfePHIMHq7rF(8g}7=QlSp;m>>BaCu78mb}p+wNvl#k^wsMcqgBSWoNOSj)`iw#0JsZ2 z4R}g?h^xBj;X68KiHxD0N92(p5-4eR%0LNR_zgN| zV0w<+g{u_nafJbYwdUrGLIQ0kO_4-!4?vUMMwe%bIw%0wp!HkrO=%*vl4p8&AsSdK z;Pe-rr?Hck5*Zs%ts(=uAqq*lAxXonZ8OuXO>0xMtf7xhvyWC+DHxaps8JESu}{&! zWzxRZ2)74iW`fghU3N*yTrvIPN#`D+bwR1)JudWplp24|pxO;b{t=x{WaO1T;o~wv zVTqSQiCU?J%arA)uE6nW>)zN=^VH!61Y#Z@;batG(p?ZECn-FRc6fdgGXKoqztAJ7 z&w_}kkQSG66aRun`;(@s={K4M^q4Vy;LIPghOut1?l5a!`0mA zu`#!Na9--gWecUm0EeW>X$(^a^jle0U}Z<5fSam}v`}9Ob?6!x4Vs_lc`x@=zJn1Q z6o@0c@-0z}97VX2YgIV5XbVc~a&`!X_KAbQDN15Q2Y9WHoL6euUF2CqDf@L)XqP=2 z*BsbT#_VT!aKb`%%Xc+MA!iq8Kv`Ge^=qCcX_+R}){8IN&B@4ky}JJ~RD+0t?3t(T z{}-$VQ~8J4T_79@0ya#hqsQxudAzBNB-q7L6hj4V&VD;b0%4QRj0K42Z{V)2pytF1Re0 zEE8Av{lntQ|l!zA-RBH2%pS(luIR4WM5E@Ssv^7pX_!a$&B^ z<(df(DzrwSZO4k^cDyjy)q!X<3b)Gzzt0DcKLEGe4VTMf0tB*0u*>ZP4&=?{w#?Th z!cRm*L{o&;u(d`!9z!$|LNpRFZxRRyN5Y6lqvkCVi<%_^G7;hSxZ!qt;C8uNJswvx z6j~Dl|JBe~4&XyTzb6|Jr2F)UXy_OiAewmO5ACaoH{p}*50%1BmgU;X<#O-r@%R>L zEju1)pVqcJ77cr1k&v?EP6q(mHWh(g9tjlqOaQ^{@xdR+fTbiz;DXQZH^Bqv+ih5u zWr7GYE3h%WQ69p^9}nky2Y)=A?;XnT8fiPm`dAyEGq&`xmW3n(pK!iMZLw{sY}d97 z?^xR0R~s;2bgE1gAQp+3Y=CGihHyCKWB|mXh(^L@7Xc*?qGg%M0?Sge zLO{DLS2QytJ0>Lspv=wzA4BW+;baAv%z(t#h-iXhV1Q`i3&Yv_cZE{wX#jZuaxJCu zG*Aw><|w5WKx39=p~Tj9sn*Ce^+mL83I>JDfT$Z?ozjDo&VYs_4=5yq0Me__P%fDv z@Hm~nq4e@nWph2?!M}fVgUq3RZgan5ENrb8zoj+|`q*@~wN4C92hPU~9yU78Hap9M zkJ~>u-p0sv2yGm){*l8L22^S@?KJo3pdU+&rOde}zHhVVvhn@0!Q-G4gD(v&gE8Cr zf}I@3=wx6ZF|ct))*B2UH+%kD`rP1lZ07qn_%ZoagMLl_HQ2(n-uP=9A8X+DPn@%P z{yV>8bDS8+;Gt_`kh*a@N7Am1@4rnNJm{M@XwXJq8_K;o=nKxP)`mBRbN_7gU~c@_ zZs{KC57ccm=-uev>%UJodR#ZSUpINmZRMhF&T#L;Z9UgFbN_Aa(9XFy&l|m^gKsTT zvb8pD&)4R`zkj5EPqy?oYOMb@4*K26P*>C}HH>W#gfh?O#Os*W&eq7umt?u+TrQUh z2q=YK*-B8h4^#@Plu}Eip8-IY1#|$AYRJyNrpzD_O>_(l5KSKPhq*oR);~+86fyy8 z78Ird$alfY1yBZsVrXP(t+N1RYpru_+s=|6gsqW@m|dZ@Ekz09i9V1k9u7kS3Y+WH zZpq+2o*v@AJL>7{Cx7O$**m#T^n5E4X*2;-?VXq6SHmd!(00uTWa@Ezn1E2o$Tz(D&YS4=l+rS zMz0>p(ZmK{8kle2`1zjdb|MAGO1`g>BbDU6rcEx0a}BJ)cYzb>kgu7?b?{(*EA8mN z4-(laFcVaA?j*gRmD>lBhM%s>{{EHNw z(^z~w(%-eMcuDd)>%@vcb5~iG$pQpaJn?NVr4WT>)hVD?zRTtE^eCk|0o83;=mAuZ z*18!$Lt@Y`eTww}R>AxX5lvPM3=mCz@`pT`>Nh}}T@Ol?QpErYl~QF&se(lRLjGL< zAR|!(Q9c*&z*}j83JysrBuc5xO~lc5FkYi_skA}*!c;inbmH|LC;fXF+}9?SAj$(G zfA{-jrvLzLCN`y1TjKj#wMH|bB};(21`uKD`Ttl%Oo@&tsc!%P002ovPDHLkV1oH< BeVYIP literal 12946 zcmX|o1z1$i_xGX#N*W+tf~3;jh?Gcoi*!qO3n)mJfONBT*Mfp{ExFW!(zPJ5)DrJq zzQ6yw&jZW7bI!!6IWyd>nEd5D0{?Apce!1iIf3{Jr}S3;5j-(uoaxJ^CcC z=L!O`)1!Ydyb2{eKp^h73U8$}y?!9zCf_tSGdB)NJ_#Ut@uMkLp&z8zwBGC6_9QyE z5G#F=GqbF+?i*El%ILwHAODqcwhb&;=R6acU@gr))0_WGe}py8)Y8#DHUo?w^E?r5 z*i(q7X2Zs)&xRk)h((UmWFt^7+~%X4-Q;(v>VBh{*{QW0JGE~sVC23tRjP5|x^#98 z0psC-wJSu;zmf6x?tSW9)7ZbQYwx@d%snpK=4_~p!YlxRGV-_gTX9ofhZ8dcSM5it&s8#h>jb#SlVqUd5r1Ees+5()sL$ z=YxN(@jpdV8#uBLXA~9|7K9v+!4HZbjm*)}7Snw3Y%}%poXUmrpPVAkGHyB=ERpGa zmLL8oZ+iM)+bNlt1kPs=0Q@=9QBh69D-{`|h_Eoi5t@{g;fkIN%fp$9W>cSegsHZ* zxXcG-LJT3(23v~>(mH{6w2e|;@K!n|JhpR!N{T^8GYp`cHQSrs9~1>nX%qq*d018y z-(zE=Ro+|F6+(i87IXC*^5`b`iFSPzaXN9j?XdTG?|TwVJi`MR|M24s~WZ=>W z=jzc3e|~f1>`z0H4SnoT|262xN9M+0uTOBJ6FjsOtux*nT}2b-J+SO@!G73}z|RiI zn~vLVn<31|%{66uylVvzf#egyKd>>3jZBYVAHYJx&1o!1JwzX@S%)Ix%&|~7XV|R@b8j?`^Q1nxW^PUSXu;wO;$ZYFr4N+0i zE~pK<`>@=sbsvBJ5-UB(padC3wrV`b`Qtc$+v&)AhZvsGE5t?zR< zZ`~l`b~`XjgAu(M@}Y>{UM8aNe_zm6;q{K8BGkZ5y20oBN@wcs7?iW85#4K2R@Wi6tGnyP#QVCI!N~{f)CBz% zAvNJ@%VM>2condB%4jO6|He{P2DmOY9ltYce?6zYOfJfa%I5jEgSqywJOea|Px!r~ zbwv^b%ylN;itjpO57q#6P+;#~Rh zrmg=32xY15ys~r09ZuyTX3?stg9Y?j+l}AL7OnwiMfS#zXcnT~Kj^WdqT-Ca_rxz^CXQ$QmqF0QcfrR!l=eO*kg9K6EK z=&~VE$6YGS7SjyVJmOwWNXj5k?XKz<2%f&ZQ(O}z0YXHU<04L4QohI;! zz8eU(v}R*AoNr+SjP*4_)2_ogbb}mFjZkOwJ)nyqYB%@O1RjC8%>izL7Iq`aN-Z|I zcIh%~EUb|fhlR`o^f*C#uU`#kL~V`mXx$zzdV_(vm4Kf64*LNIFo?0PE!JFSN?(9dE0MMYa zO07?lm@y?qwpT9^w2WJ`Oq;86ydru%1}!kqOKw-wd6RZ<9C4)%u^1)zaVn0>UBlom zBTl00Y)@KrfVG+TWp*VciJHg2Epni(O+|FzC@imsST$I?4`>@86P z=6n>#wV`A-Tph4f?fmh2pFeZvJZ|rkiSwe#a_}1A zw?TU!-LZi0@f&@`Yb#cig=0fYEv%th6oNBIRtJBlI&} z)GA?!u`*pHLA0lW-mbsGZFlae{aMwfSLY^OZo=6sXeVeBf`rhtar8u>Eg$5T?m)!SvFeq9?i!wnT}2yRA}LYo@T`w zdT!FIWQ3g2($xI*vcBg0duN7FE(=AA_pndo(iP9}`x|W60pHt~6*$+n!nyNU5S2#n z$@^tE!V5aiiIkyIz#E04ZY!0yWqMC-He2;7FAVsPCDF)g?0+?q~pLbO~|bxW}9-x z51%-bYJvSZ(Rcre)?AiMQ?Fi6c7zx0xA3JdLkc;5&)Wag`n%}W4%_Vd+Elr39Lq2! zdQ4`+UzP9gyHx0Vcag4^uTR02RZQ8@4U&#Y3du@FB8$W6dW0_d!n4eF)OXT#*%&Gs zvw9i_f%LJKB3Qt8kwB8&@1nlKc+JBnjzZxoYs6sw9LT|dPr~L<$yhOY+_u=A=H2W# zTo$R#ePZwAWHc8=DMUNzi{9ZuTN}n}f@1yHd(mxj{C#uc=yxFQ)uHm}R~ho?z}FVd zMY!EKlR~a9vDnLaCyh993+=Jie!`YC{u=7Fs(Fetduj(O)E#U8H;y)bZU;H^)?&R> z!(-_?lFqkLN%z08dy4kT@OFK=MjENkXayK~ok*z<{~Hq&R)B6geESrmWt`amtjKo( z&i~(R)`zN15X^TG@nAyP-#=Pm^sa#@ox9v=fXQO9(KqgFo}!yV$4%)@SgKwfuNL~7 zN6KxHQNVs_YY5w$MX2~q=&e6OGX|+&Ae@weyzC`vwYTQ*tIs0!nk?+tsQf>XFteBx zIS38=xEK7LW@8JylbI@c$NM$`ZAp&^9g))3s=%HC%eyJO>tPXwFEa~^ZCfraERL@n zP#BF$OXF3^o-PHT1d1s37B2?c1<+jt>5Vq(SaEps9E_I$D_j@-ePw3;XE1qaBl?+y zd&psntCdm{DJ3Ou?B0c^rOOenw-Y+yhEDR^QyyZiK}PPmOtQ`Z-gCPxG7XMzytwe@ zL0;NzL<C1`nWNlPb$`{1n%36U`}-T@YeGX_pCeFCMWr7br{Gruk|fk56F zX)PZJXvFvYQn6_kZB7vjRk@h=enx+E@wh0v4?-A=!FDD@WtNv>G3W$ZS z8a@GmO+#yO=M}5bhpeEUy8Zkh`?~69aXJFH{Xp71?1KWi-d-;pFFjb3G`*m?J^Vgb zxB0~N&rgA;H1qf%Npj58TBk{B^Cn4HwPO`k&KarX4KFX^&o3I`?n-wGP|%CHhFzZATUp`?45Cyf z6hT{Bvs%H>g%mS1jJw}f=p`|MnWNj2a3hmXWx?uO4DO*J(}~ zl-X zflXg+kNvBHi{9YCgU=RjGe1@DtGGrXjiMt<#JbCf%CJ^)r8(5L$w8{$$GQ#zZ?Tow z^w=mRP}r~ZoM$O;fmZVl;-$cS@=WN38@%y1HPD97ERq=^{_MR z`fg--u%uu%O!%Xv_cBtwMW0TuyJA}b3q%wqK1LLx#Uo7;guE!oK08=e5yX1;Gu6LI zfa+rfW@7M*%jqiCv?V9Q=9amLLmcF-lW%q)%E}pt?f&@Yb*B(eVg)&x54a0bHx&3 z@dml&N*Vjkk?wTR<6w@{X6Ie(Lu zmezX&BIkQWDjrkYiB^VUdGCa$v!cetX}0Ty-q-$N}T@* zwY0YOAJgV=bT^&~sM(Y;mnKQr+*lH@8vUVncpK%TY%P1hMJ2c7YNa>&gjvD_%L6z} z5G9B|K0}~fi;J6y@#~c7Y3;U46PZ+mmklu8ZX3m~{&kNwuFa9E(MyxyPxV6)oVG!G z^GGtQ1uZ4fuQ^VzCP&%mOy;oJ73lHRc&xq-KWu)^W+^p>kSan$LnBu)d0S8|C$dep zj9R)ckD6(4w+uEx9qSDZ5cJs7U0a3jlQ=j{1lMJ*jvM<;>O4n@>^0-gV^MkDd3B%s z3dCxRLs%f3YWH-p*7LyF>XtX(0@am*VgGW=iFmO)1^3&F!4_#S>(&b?k+EE(`7p-(jrBuh zjoB^qs9PiYzW+<&cP2mxD#)3%Rj%)-e?7nds{1QBIY;M}XARhQ;ZI>zZZ3^52}3<1 zlQ(B-D8(Y#SuCP}nq%L8+v}0Acm@?yU#yAsH$T-6j}~CUMQ-uTJ7!<}m8QLxJ8yT> zlw_>W1W)!!_yXK9=t|F27FW6U?RMbH5rj03b_*gx;i}`UPh436zwV-=rxOB zgoDP?Chntj9HLXol?kiN7!|~1bNi-u*jh8mcGm-h#;xyw@#Dy2VJ`_YcgmNL>n#U= zHlBaQ+Ci4dbFRt_b zbFZ_1W6Iy!rJsg%JAO2YD3Flb!&LK^wQwHqGJcDj&OJSP{nFd--g68x$-g$FT2NJ1 zgT;LKrvwkD(k{!1UH%2s`#Ovz{OGHKIWxuq|CLS^zVnIMgHz`Od%WU?3O)W1#FyBD z?9j|z{ob=!_$hCQ1~}@C_4Um=o}cretkd1xv2tE^k8Oyeyev7!TkQ=qg6x|InkEq#%Ql@^7XD*Q-jp6}sGGr+#f(!KTz}(2vX6+CXIr0{a0BayC+9I{yfIY` zO=X%jnO`a+7X)caJkq{dV(Ms$@!R${;y-w8lB^{yy--moK2v4VxpKSPVz-db+i~LL zj_gcC>_4xFAtQ#=pyt)9Vq>C9lA*|huCgZ!?<##>iIjD*ALMn$y1ZX_BcUSJAaSyc zAlS#XLV%!(4S(pM}9trmK zdv+W<91pTpH9(?&&Ie2J1a=FZ)eJuia(M{WCfj87onp;VE8Au@pS7(h`#^CTT>1Dz z>iic)d@9UoPPNdlvxT8u)dMH$C$L>N(9wYC`8%m+rtZg_DcCSS=HTg?qpERVq zPQfH&Gqs>o{3^=ISOLnfb($ooOUv4gLS9uBBA`YO`$6x11-j3vh&ieG{63*0*JgN& zKOm^MI{R+nQvIBuEif$V8I$-kaJ*B*pYX5G-izx~9IKFvg-AumRm%o&jNe30PUe{@ zK!y-_M$|xa9ptBEa7z&P42Q#gJ1l z`e@mj11dnRg@^0m0lU2@7Zv;6K0F@@FpTqSLw-l1}RH4XYat5w0hC$3lW|FOwt9q)-rdF?K9)3G7_%O&6a^y*Z)a7j<(#YR$ zABiI>DZqrT*ZxrK&Wfj05pSe)59-M!FKvrGmGG}~5Hkm{ltNEY0c}WKQ6Q_ViJ+SY zk!~W#cjuI)wE{^zxK?Lt&W~qPBZ51Vy#yQUo!n@oFc`lU&Zdw18ds?-{wvs|Sa*MY zIbnlCVv|MTezm)Tk5R-Y@{)e=aAwphPYgQ@f@K5gs~_?4%bZ;KfsLpkX@t*PrUbls z3TVJbR+ms=(fF74)K3EP8>^<5w)fu#>q`%ZxRJlt$3LzgTZiVRK5dg%vlN!C=a{Ej z0sEIzH!}@slsgF?5i=t{ZW1SH_m(19OlVz5Pux z`MLrzQ;qa|f^|^ICQFHF1$AZt`49e|EO=}W8z=K;M(Uk}#bi%>!i?;pt8SO+^SR%o zR`5LWSx@u(b{IbN!cQ4C>llgm+-Xb?lB-|Xdp{B(dFkz##Eek^`%FAp+g+BJhXO2m z)$n)pQNYa-aQ1|+b!JyztV(t72A7~k6H>vv7-{6es9=h}Q8FD}T%;d?fmy*2`V~&X zq}(obzwxU_MCxU!pi*4H#%(D``LR}K3@dXI>oB8{Ae*(xu7BcN6}5>2nh_Ia+dwNB z5`~ZuRq{>QT-Jb-vs469Nj<5$^q!tfOSSd3E}k&8-u@#6TH5=}VbyGN($Z|HTt_0_ zN9NXl(|8~7*``ojbncZLmf;jBD7L-f9FAPinV@7W0g+B|PIGgrVU8dace@_I$Ls%6|>BUJcqm`e; zVI+mjyv2L!;V!%tYAjZ0!#6Wk@@QYi5iW?2i_z+|ag?l)(mfMOKBE?)TJ~$swmvjV zQU4%22ltT-f`xS<>2nS=Yoq1K_>zg5Y>3;7Egpuwdk)5fr_|Cysov=`A^id*8^=q} zLDt*DX@7b@>C&^8a8)4vCkwFT!EE!UV{BXRyyh38_j97;GEX01QWdv)5xc`@7&yL- zj6j?s<%ifC)PKJ)lG-F?|7k(LbzOMol#clnQ4*morJJ28!v-a76q6AX$e9(@^J;w( zmzt7t1ZM?3d^}@7#QRw>dLk#>X5Q5ywDI+xH>N+-m6%HJ5qTtBnQxDQ$enb3Ys=ck z2a;dj6y>*UqBj+y`p^kUJ=1>iVkZ9~4pIhgNtD5atHSe}T$1H8U--i7`S_mXL*>ZC z2Vw^d;K6%RU9!S|=w)^ta1+j2p8P$i%E4tx5iPF~bLq%OhE9n0fHWhF3|IeYQzKhpDO$T7$W(`>KfJ zFmj-fKB+Ks;fjBHpYwzeqqh@{sm}YPt>E~pDGd}^&v;nmC&%AMS8JkCg@}6Fc|&)%1|$Olkl;um&;1`QE*G^eF6*@{iLRTY8<0mva>p^~v+K{m63Su6ama=(~g9B6e`|+U< zysIl>iH2fGROsfXx=R1}g41p9#l7;)ER@HegK1Yv_sr3pmvow+8Ah-I3MX10>gbOB zbUE-k?$ik_v;XxuTvrHFYhoHD2kB>K!u+F6Qt77lxgqY@KM>PDz+CN%-N%r^4(PQX znU{}De5FAYTd&D|Nk;Rh6NsiuJ94nxzk722e-5{ z*Wvgw;$Hu96uM&rPP$V%HM;5T+or5>T0^R`PI-L}rZ@vG*1H|xp0k&w3K1+_di;z` z1}1UB9-c2aOQZ(f&2cp(hx7}NVMkAW^b+$4W4bSr zHj8CmOyd1js2}7~P)$h7oqC%oL8E-pcQMOaH<1aK#PlHfsx5>GCB)^|xL z0*W`;vV}tbF319qpL(d_v{N@00IukJ)J9&}`$pZAZIJV@#I=ODAoO1Gn~w=}7e9kL z9eHUHocm(F)XvoOwj8p$=P-Zw`Ps?Fg6X!f^GR~Ib|(LtH+1jLz_@%0Mw%@7Icf|( zRUWO&-J{X1^6_hS6q|+#y}YsA5ri3ekJ?mouaON^V)63wGyYo;VmA|EMq#}-PndB{ zPBTxj)_N~_qoRhTvEuN3F%A9-zB5yxI|MGE=1*5k51+hjcAtN&87ls&xl~8cc2#=J z_x7fWiJMpK3%R0gP{U6AgxOn%oG_&5Y@cmYO|iqc^W?5rlpbzdN#c|Y<3do=CML>N zH^0LmOzWxkpI!4#X1p+Bvv(^E4F{-tIseZinM!v3F2x-eBY&bg6+WB$@9&6*WZfQF z5hQPqQ~1rn27c>rC@7PeWqIB_32Tk31FpS}=f-YoE>1c#IW3OHZr#2$#L+_|Y9o2W zM*MAwV?wpPWB?uE6@>v31_tHZt@7i($}!*cLG`3PeTsy3D1qL!@AXkHj3*bqlKKaCXV^V_Q6=-q*2yv-nlS(C+y|oRuNe zu9KMxOabLS(;{wtq9(Gbq<98CbDXuSc3RG!^!=9gcc`Pd9ixTo_hoOiP~Cw2fX@P` z@A}M1VEHm*^GBQ^zs2H)#~gUpxq-sgUQqdC%On3SwzV*1*}{9?(-YSs30I{rbX2iiFYrlX~;GFN@>P zag@lbA3b6M^RC}~n(MO8zz(>=DfUi{H>OkVQduxJ2w2bdX`E~J81N-%4)7_5YK@uv65kJq zA@7(DIv(Yk=C|v7?o7(y7QgwD=^G{$s)U)@;^yL-#3r*Ar*_QeCoYbvU8B*U@of$o~`q_buo6xj<{*M5{Apk(YOR>BE6jZ}3V!c5b^CxX4@`7HC|6 z+YkomLzYH<&&@DHjOA0_#K(MPu5w7&b>}cC@h)Y8SvF|!xc#ET32fM?UWe_OZMjeP z#Fmh}+FSiC*7^2PRpvysb94#IeAsdcN%-my5r@Z)XF>(eT;$Bc7RG^?c24o^7cG#Q ze{_)kermD4e}SsS#4(9@<=&zx`%L@7&`hjcj|dtMb$3x)!TpBZMwxi`(0OrVjc0-Q|tA z);T|kr~YY~Z6xa$50!t4q*gJp;ls0!eLo>(cvgI!WT^|a`?mwGa$i(cW`ht`xAyz;RhD5{hmg_e8Ii28eU^qdABapW_CMUk=5bN#0?!~z7E_l%{$|i zHrtU)k4*k|ky6IJKnV#6r=p^pmvsm!=aNIPX(Esq$Lqybrc!H2ac*bH!=2KjDfqJL z;Rwwn{5+I;DEEM@MndosLETGAl2FLQq~0(_Dh{6tUw2)1wt1M%Sa)NU-P9mbjl*{R zNw3=t%Pv>a3~H#OX`)>ck0_Jln7{Uu89}WxkwAC+~aA^A&daxM(g$L9A%&1$BN>b5Xp9U47qS`}g*_ARaU zZ4l~tY}Dy%!oTlV`D%iVQ3B<&syy?IT3cH5Z4dkKv}>o`-0^mF_X=!lDn>KA=}D%N&-@QK;CI**~#*uXBl%GK!5H5g97YIL^jWfSYHR#99z-O3K8lgy9~V(~&j z<2gsCpWryk_unsU3gVohf4TOly@EhWvei0Z`)SL2&La6JAi$%|A?!~zZC+Wi=}^O3 zLtq1k7L|bYa#^m|)%jscEV0!<0>c3~@l01_=%hX`O1$j-;xLf%+R|zEWrY|dmGz&B z)%%U_{e2s%IWs0PWY&KhP&@q-GL3|wv`w2dJX#v62Ukz;SwnZpPN-FTj(It_=dTNo z3!2J0D=aIHm6M{J=V|oMM0PhHZ(b+&c#DIN^_EanaN?M;oBgKKzI-50Qfb8L$LYfv z*vJ~mx16+`k(RBU^1Y(D?VcM>Fln(|k=c}`tZrcHI+UML~YfnL}wmE`z{ zy&`m9kfTiBgM&n!Z2}bqyJw9UER5PXD(v;$7ywFt`4#t$2+W2L+zcRnJ2F^Ddoufs zz%dfIA`jdVJH@NHY4-fm&?KMAL#Ss~?QRhGM~?(Yei*2>)hwa$2tmUvtBvV_eg={r znY9AUGhw{e#)l?X>n6#z0nSf-5Etlrsm$t7bMzhs0N6=>xv{Zh<3QpA)Q|brnss~< zh+}-$TkeR~hnoAO?;p*czcs4}B3xpkrN0Ig3WHaYWYGhisJeB0qbSAJE808X3k#bW zngJ=Clq)L-{GtrFI2cLoXs_D!(aYRC+cFz%y{nEM<=gL;*75Q2i#r>{{-b(*qir-Y z+7$$=8c7d+J)HUWQc9g}0!!gFw)^@Zv4$lc7=6zlDLprnznzEld~gEP@XhKE;4UWQ z3)uDbXip&l2tWm#x6ND)f^J_L7N+;Eeyvm(Xx5=QK}jjx6}1k~e>*us{cNp2c9FzJ z=WdYPQ8^iPR}^F>v(QsP?&Md5 z>qH=Ft0*lYwJUd{g2Fb3YF|g_L}0De96oXvQxRa~)z-Jy@NUH#zCp%ZE6n z9a7ng2J0;Cy8W*n{h6bizt({XV=gUX(R}Z}igMUgL5ep0LL=4P#s}$X71wQP{tt@~ zmcO^dHoE?vX1^ZWTSn((U6BXjNOQN4w0{;b=-=shw32?am<`*&joaOahHKdGICFB6 z^pcH?isA3=5_Y6gq)&UN=MnW6f8XbZpwX6~Ajds1M}TTe=8n}(>%iFnBhB~@ z{2|$dq;6UWZGZ7~%XjC=U=qiA20lB?To2uJ) z25dg_gmx(LwAYtpnGZk#Q7sbRwI8xXu_p2lm8D?<;{K`uU>!X|D=Q4Y{MYXkOO%hW zy-JJTv^hNV)z~aWD#yt8o*voM|Abqrj-~b7Aw`XcupfQMiRR*%&$b%XsJ_FH#NnG@ z`Hzp3Fji5U8&H*3Qm~dP{rV62FrOqQHY7Z~P+^#9ElCZ448v9b$75j1E|8Jl?i)v( zP~48$#$L;RCvn=BgFiaD3pTOZ%Njh%$JxG*aoC`s9 zj8HteYj7(V__BV`s>k~T{Jsl_s2RQA;jLoz0kigPx4{K8can#Oj%NGzE%=t_PG_qe z-6T?egu9g>0d=wfB~##&lWLd=Nt%c5Ox>$pfWUQs=q2|&f4-3za0hphjMdfsE}+9c z;<-Q6Q*LuEW-&yC~t3HHiVxV%#)$LWC~0uO_D*m1GDhvD~Xwg!E7HBRbDe#CDo@ zaD&J1^d@*%y?ef_PdqU9jNgz$i~)}OKiqaexNcv z;U|xtpCrlmPOeRJ`B*0SH=B24aTz0W+IssvJq9)sukPkw09+Xe&5hGHc=wf7hAzIV z(7(_z8agXE~dY{rR zYu77I_xmMQ-mO<`3xJVbvS}9^C$YhTUIBKau@twLgs7~V{SUE0?E(o{sQszZIydg- zF8RFaayII86F`=IzBB(VDcEkEGUJICS5)M53s6@r(ypN7>J>E&1fYlA_N3GUu8DV( zya+RUy*Wkdyr_Yp_izCH3JL(uUQv>~pv9%TQ;bg^@?Q9A*8_7p26S+dJZm$Celjcx zdiB4Ni~;mo3@%ArM%Wqvn91;MT1-8Vy<3B@@#bt(l16TqGu?fcy0~`J)h}f5R{G^T zNFk`+Vxy}bfd4f@|29`+=mD08+xxv3F&4TTKHP|+;k276AMotHn`As%;sEA}3()A* zE~SJSPRSidq)+^G#vUmtDepp~#D~kv%VRhvnn5xLQ0>Omoab;?SNmC@gb)z&r-(Fj z@7GQN7(xLC!d)vQEtpA9Y!FQyw2}rG#|b4Edrr%<`!I>6x(nO9REv#}%xtNiPEWI0 z5wjgl2kLPK@MIcsL(+fG?=Wymzmi|jDpu%|c}UlGx#WAn0N7Zp_ni>q>HsXw@zTLE zl4MmF5pEW?*2ShI>8SNr|2Uz^eqrAajSvT!JDHj;8HxtZNGvzUC6~3a(h9IGy~Jxl zhqItJc%|%qT$PnL{aM}vRTO6AxD139H2emQ`ycxG?zlM%E?2^Ac+PGj$0sLyzsn7A zE;obk)mj-J;V#j^&_{9(NwqF>L z#2FwNhr}}EMgZU}UfbP@{|`6|fP}x@>KIMiEh6taPjpmuJYnS7LnDqs^W@4#o}q_H z+v-MCabn4pd~5pBRTP((sFAH1s?mRTXqq7BaJ4bR@BC3sju(N*JduLddg8MDt;?W2 z1Az<7+iE+^HD7)wI%f3BxAbs&Q#p)I#&{aLOS4&aTYH_6?*0LA5CpAulU)P0NhYgE5N{FJ6AA+}A90q^4X8UsgAO#H=L)mv;u^K*x$HVcPy^Ds{pum^;b5V)xw)FD)oM(*g6Gz&#**KezrrpG8#^4psZ;9=O6$7;= zangWGP&vxqlm(tQWP(L`dH0BrFJ7T1+dmI@4;r64JTjdz^189RBrxw2uzBPzSO*7D zN>}Ko@%HXH%z*b0dfFefb&HzOiAhjFsg7d}s2)ANlkKWLnd;_(+P^Qga*kLYQOP5vlKUAU^TCK}`ZxkWT-zNMJqxGDG7Y4?Y3b0gW)pj` zws-$ndLOpActD;9=cgz_8_XJ;<(5O?ex=%#>lw=Cp0mfp{+@>;jm6$=zHO_2(8*m6 z)c&#dx!CUMW0hy&$1;-a)%pz|Lu>KJk628+PH)ieBN;&CSnN-C4(nK+1|&lC%`|fJ a_I_Iz`N$f@eY6RH6l9d&R=)WV^8WxeQr%|& diff --git a/images/documentation green button.png b/images/documentation green button.png index 9bbaa0018d59e00e525f81bbcebefcbe2ff08e41..4de957f4ed80fe0cf83cb5c0795b02303ec0926a 100644 GIT binary patch literal 12074 zcmYj%cRbbc_y3isNK+{?+D1lZ_K2)|t$QzJOJvK=CTWmS$h@|T%cU|d*9xJ?c3txd zS(ob;uA6Jz@B8|EK9Aq;kLvb5=XG9Zzh3Y6dA>C=(B@#{W&?ph9J)H1CLjEe5pNly3UcM@br2?DD@Jif-m(vUZN zbJFFdHg|tgsk;ZGmpF$;et)y3_e^)DG0|5WG+G?Pj{%C0%U`A)q#i8E+y8V9y(_73 z@qm}}YexBL5C`+H0e!w8%;}l{69|-y*HwM8-+9T$l>aDt?;3bP@kQpA;g?BaUx%t&ldc!oqnz?$ zk3+2_W#sb)q&?n^r&bdSb4P}&2yRnjWR_wM9u*z6BOs7q;2(3#y(q3v6;_#YJz>A} zbXtiQ?02r?&iR*R z_K~Oyt-?27mU4n22JhrhYNg$U10yZY5r2+?KoRjT%XZ3q2v6Zv-0<=T54yH4y9DC*k&|;JG$|})u$8dk>{`q_CQz)$p+Artyzk7}i@JwD=Gpn&r-KkwfZga4 zn+dtEKfOn4xI(#N@km~bP{gU1LIH1RulNfq3WP!|SYM}i0&$FJgQj7X6iE;k-+M0a zc5dYngI<=tysDQ{EE;9e8yD3M%VUV^cEKrD4KHr2-NbXMX~2)$5%*<`*^Co3Ws>Wh zpEryvNu>3*0vQLg@^|nUZB!0z#eJGfgo~nF6I*GYwCW9(2mTQP&q&u5a zVBn836Rm2P>Z)03eEJ6qXr#-?>A1UWP?-sSm(|)#$V}(K+No0juV5sQ9g9O9o5q=R zVX!i6Q5cu;!K@(c(%R6|;w=si&z|jH09(X|^z`OSG8E6g)3Bm)6SR=C46*)CX9G&Z zy(REAl*V8=Ww77y?4aBX%_dJY+!ukTxIj)QQugoE$?D-s@@7enJ-?pS9%Ixr?AyY) zvy@cmRm-9wb5wB8$lpq7hB0$zTdu+H%P^AbyHyG?6R4?hS3O(EqfD^dv_CtJ;Z%WR zaFjmR%pC`x7#WAm(c<0!&t{5YV|*w;1AW2N)!Fvt>{>mqnrSoK75T5z4Oe-Nuk+MU z?qfdfhyiSgQX(QEi$mm@lVp9FB{`%~R7{)D6GjY--VAY_(mhP1DpWw8$%^r zW13a;;3XEGbcx|ZTaQ3?6{$4O_UQvQOuP%E^~H$zySwJM7mOoJ5+9rM1FMbh0DD;H zntWm#pp`bno+}yUEE#w~<3s(_^)mmQD?D6viJPz(x5?aiQzeY=J9^3#xyNJBdrK*!uXw+JCcFJK z*p?we;qmN5BZePda<}7tpgW=&DX1QE=pQu)#eL=EF13^f39Uq+p@2~Cp9La?&Fo?X zfMx;86^s;?``>S!NMWx3{dS6Ufe^OeU(;c@#pz6m_vh1a1mR|K$@k2^P?8Xc4`w^)kdm+Yg5({#f1DvY;+nE6w&2jse zc^PXX@|P#a$P2F{rdu8Ti%vnIN$2}7+jo+vavYv=na5ZgLN5VaAU2oHueqt$k96*5 z851NHFlyo7!diAZ)up5x(V4Fq9Jxndy}|?rUi)=c)iYTfyo1=yX73A_qUBj&DN779 zl7Eh#o<6tU@Fy!rvHLu7kHt=vJz#zKDPysdmS)8tZ*2^>iEo)?5sO_7{P9sC2EmyX z6@i#`(HZ>9u=uaer`d0#?)a2B1})cta4z2+^ODD8BuIwSd)PX>d5&H?L-pi7PK{<{ zeFQ8^m8vKeUgJS0(1DZ8e}WS&dEw#hg_RYO%%uMaCF+oCM9@<(;HaPl~u`IR>Ap>6BSG%w0`LE2^pM)N4HBZcmLCBMm_p(Mi7+psV znyj6ye2?i1ti^A#*PWk12Nen>L$_)2 zw;CiC#0jWg`Kge3+vky74AK(=d9A>kzj#Qp1x^@Aiq5B%m!o=&n5*##RldwH7VP(J zVT#U~v&Qgj4f!(aK&>^y_~&JN5B|%%!%G#W$Y#5!2rMOA9Kn@h9rUeA z!4QbS+E$rK4S|$-jJU{uxLC|8JyV9OFNfnm2Vmp({UQn1_XI8!|H+x?yuJJ@=Lbyu zT-;;frRF^983uq*kYI*U{5W|jE8YxQa;TgHywU*eoEJ5txE=f-bxVj7rH&%d8kIFz z5o1YmxdPmxFWDt+qs-(OiCUh**xkrC&(de0U%Au_xqXb9k}rH%$;-*E8oLH0vSu0z zUQ~P1!+r4|LxKQCV+Z*$*yIGGu;x3{5Uo~G49Dc2)Yx$>&Ivau11meVjD^@+T|UX+ zXX~}-^qseTa^Nfi-pMq>eHg!p0|Eo1rkgPOjn#LxZJ)qRaLpzVLJj`%TY7^3D(qCt=K@a*`YHo}g!Vfe22L->xCzF54sYtR&U|~Ojab;^!$vX_}iXc^x z{*TB8?tNKmt{aOwOd-@V*-#ee>Ha||ERUm{Av?EPW2Z|V*AGvhaBVSq8{2f~S6Ig@ zj?mW9Fuxr^-L%IsjP4!LO*E9i^;L!v#`~FbcnB_9sAa(h9iruMXc3%(TgscB zy}05!Z=O%x8mVChu3^C5%PT8!?(YvG2goxHExE$c{s=|tE9zY-Df^A`%F6z!z@@IA z0|Ssp{0u4H59*h@hukE@d3~ZwCpcT;UJ6y)+S#=>(ughTHuSE_pFe+2A_c=X=DB*g zn*ZJ0d}|mYxq6=o^tExL`>xMy8w+_gbay+QG#T(DR7cIh9hMeUd=W`hprKEMNdaAs zzJ?DE>Jl8@8{mZJHHZGI*N86p6i!>ZUtekz7k}_bIJN3&KOb4^VGaooiU`Tb$&t&U z?}cqnxK`r!_g0Eq9JWcZQ;V!>uNjw7da&b{?fvh|V;QT$j4Uiq)v!<}riVYDC<9+e zN8VVx2`*X~DTUH1sba-~Mk_2k&>Wi2@Qfh~H)!McuhvRSuEO6xZnu~Q+n-dET}6IO z{peEf3>?!>>X@|9Pk>akNj-g53#kXY`~n6Sv|Q2J$qrU=w|+kRhAJiq5(s89F7u4g z+Qo;5elF``{uP=R0_%aaN>Gfu#F;-g)0@cW3fXk762HG+>fNW#JT=JrM=d{n3?y7R zm}#-OY1ZI>2SkkCFcy{5GDQM6^E0#=ChAr*-g=i@ewx|6?%AxU&!1mry;c1xNt8U0 zT9Hgf(DY18scYAfTx&soQao|dY8whS%zp}?f0Sz!9BpFqTl`6J&EyMSJ5l9|ulOhirRR)l)+1^A zI2+}Gp@kz(HiG;(M#FqNak{$BWg6=zw5JOzl3dvMHlyV1(L|}O;4{1+xOT%Tq8v4B z;c4{;`4@4|t8KS=FeKFP{WT*dCr$T;0@nTD?T{&0l}HUjhRSy!zXmFxB)^6tzf#aDA!8ek zwQE1t0931FhF*SYh*zW@PG~z1=#vt&S<+{+7BTpP>f%%x=yJS44GeFNR`NT2MdL*Zb5DU*?5uoNeudd(b!lvzYxzyi-oK7`79pNdMp9(}1#?yycETAo z6Ul5Ns~xYzzeBEU+=vPMH_KeQCtCB=Oimr%mcQ*Zh)h<2?aFQ5!!JDOy++skR!2732Tm;%b#$h!b+ z$!Wpgclsk*Cun-hGUWI7_un9iYpz=6o-`&e!t;GhYkXKh8I#uZt0oXim$~d1-@nzd zfCURXD%!4e!_p6SO~^{ll?CzjQ;80�IgMOY1vcrLu0ei6m|L(cp z0xi>4RC3?aNae~>vF?oCk%$>HC6|^e@e0u=h@C@_YZwi zI3I5Bw2YjBrNwCS+{ac+{uzqRv!0p=HJg-ed&cq2qQ0@3^%2$s8xMEB?%D2D#(a@S z`UR#z+0dM~aODeU(AN9WT&XzqbPh$taZzmV#N{!ftm5-OW%Vka!$Dat&$35-w9l>t z$?Yy`7x-YIOL2Vdq^TK_iYk-t%Z;H3_qbEOaY%aTq7=QXK%H22jGr{NkeY5q9V9A5 z*@{PnePgjZ(+(|< z`uU*CA6oXNmoF}z{v-X+>NcKK z&{MmbGJ$)m?#2y)4-Ku^-WzKaSids3P@mzLY%G^e_MLRyw`%a6DcoUAt=Po39LQ`A z>8nCWl1$px*s=;48kS}i8X0d=tc;vn=#S@Bd~B1&!%_DEcFgV98{)YlE_lQ8jLh** z<^KNejrsEo=eozxp%m}C7`v8jp4 z5t9>szU)n*cT69n|4ZnXR(><&fPIm?u1~62Jmpljw7Iu;-ujoXl{kV&yrr>>P zWz^k4@x;V@HSd5y*1fZexB*jc%U%xO=@A)G@bp&x`mz1}l9|&1{XT>4V}d#>G#B$P z2L}J-zrC6)>2eWi)#w$`gtSe6IE`zTj)MF1a(~ zHLE8)K?Phc_+*hLBckWcP_ybm5F}i@!qxWKue{c1*0qYBSe~?xk?YqFT zB?#pDuzSeAKLL;XPY2g4$XPCBgr+Jw`w6c%;$}<|^@eu(n)NGN%2s*#1Z3Gn(GN*K zsn37UdsAqYtjg23f{F=#eG|20W6UGVA{hm6XyXD?xtRERZ`zIit60%((xh>4IZ@WL z*!jgORuGJBgWXoBkS&<(4{&bOP5k|DYv1LeO=x?EL7-ps13%HVCvp$f9!jwY$n>l1 zmTzi7#JhW|?~lgju-<)rI(%|RqeR{8gZhWCE*Uio-ml@4yB4}O&)j)tN+j~ahkrGc z`y#CH$}t|XH-`EA0=p9EN`H6qm_C#}7U%^_`9U(FMsF4AmTsU}c2VbnnSsAIFMqpL zKeO@4UvKhuo%HUNYcwm!39;3YNkKMcul@imhecqs4?Jfpt5SB+dEjm-Dr@VXFIYhq zPo7}o8Ca2kPgVygXKo*HnrE4!}a^Dtn72yU{#d)`GCyjnK@QXG45yeZR$fz$s$wB4<}A^_}gR)I#=)D_Xph6oP6mH z%FFNAGkRgit*8!g;QmlsFOAxhRS2-8SH5`OAUaHu;|$51PJ7tGPko4!HWPpVtqxNm z*^waxLdR6@)wLU)3t|d@U*&FkvpQo*u3MFyOkZtLK(Bg{qZ^@_LQ8KwDotO^5&0Yk zTQ$siZ^VjxTIOB35v7Q)AN+}|6{}b+9~kQUT7}p&rRKP*$~W-c^z6Ut-)r8$9Zi#b zXmy=R?%PC8F9|BAHt=zgOpATT(F9fFRm-U1yOGk-o9Bl2K!t6TBiWs~Bc@j^#jCx@ zO4tKPYD#C@Z(Q^r-19C)4`r+C=9=q6eLH8lgsVF%QzRVlvDG4DC$E(wO2bImml>R&a7OfKrc;lz5_jHcZE7k^$( zV!?;L-}ccN_nY4_plXlUKT4RdrjlJBSRT{e&eFI&*n3)St~J>eBzxBjwc?^FVtT9| zFUS5Sn2FpOars9Hum5dfezd8m9Y&Bcj|M7K8gsl90=->K?P}U3PaKybapCH?^qWMu`CtvgeAtub3vGS`;Xe-Y z(`X)9_n`3MS*7JsAD#62zHtMknU%1&Y*4dG>{D4^=Kj_1M*x4{$UvUOSa(vc5g37#p@Ek97A4PS@h9)RFBFfr*$wmHZ;Ic53n%3`6m-sg z;s^J2;B76aJpD+bQ#%;hndfE+O+kHndI==J3qyjQXNPRi!~%72<<$a?K?vjllO9$UB-T=)5rJg2l6w0FisskRqq)2VH z9i(12x;5KaDB(90wn>=NxY%`6VBXKfSkwdkn*YGNz2{l9s7$rard1f;t20^|-_l{V zs1Q1t#n!Z2c zK2l#0urXZ6-`z)fr6!UfqReM`VX-><{!o}(-RP86-I?k9Mjq_n5b9c0|APZds?F3L zrrh%5P&KU;M0cG)QRL9DVYtZO1=6J4ddOK%Dk6--qve27DW5P*!SKlR-vcfgNGtB# zW&g&d?EdFDNe0DUP3J4=Er?PGE&RlhAN75_kWh&Ieumh5G}jP2bKso9Yrj*q-ji_& z0qgRGgFKSxXH8c>I5<=d_Xl`UJD5*@t3{-cBr4H4tO}m zPV*laKzaA11(m&j?|fHJJ|LV9`&D5rlOKr|DOCFN)kbcQPEk~-m9Rp_qtgd26|SO~ zVw(E6otE$8PC*jfr1uA8D8RgBqes;p85QacYF24 z_p8x8c!%Y%LC_ZP27=qL7fA45dsdk+IG<}gpCPdyHZl*J2t73zn!9@qQbAFtSwl?d2UY~&u-Y> z8(8WO+g2f4j?5RHwBQ(XwlYo-;aKeI+?EF3Q+;$`XPhYVnw(Gk=*VdysrA3;rB{x8 zEzZPmfKe@VF7A)|oCQuS6h+ub_MYa=JEN6IJSijiDOf{>Hn4R~kp;qBU#O141ze(B zTj#c2)_T~LuV+wD`pn;DM41|*Q2PRD57{_EaO%!Kcy;jch;9K>D(f``+3DS&Vf-eE_uv!KAUIlXD+lDRHP-hy1n4!ldvjac|0y|J6Lu z!r*abX0CbMD+7uYZd4?c^En4FH~zp8b+l#uFwb7$_5)2{6CGxI3jf>BJDp!&(=<)y*yA+ zFO$cLb0aX^53y~}P0--HUMXdQm8Nn;zrt|KRyl}%<4FLaRxw((f9sZ36~1gR%mv#h&Ci7h zaVwD=UfX<%X@eJMlh^Evz#Q<1!nQzX()Z>FFx%Hn<5 z*qt9D3^quxcr)@C@yk$nP+!aZJRQOR6Mn2!JZG3cbc8Ir}V$P(oIc$ zQ0GpGi+2=j8MhsLD`UwxKJB9fqJ=F^{=T_Tf*oD{(%ASU2>758YAIN%NWLN!5VmIT z=(Kz*sd#i*b;m2Hp_S{c_0bwzB@gir(&M1&iIej?AB*w6`OFy}QS)7@>u8}j78p+L zC?&ra`u2&)o`D5t7ig8MvUKnA=dNtqXGv9?vb~!H$JaPJtGAcWS!K7O`HIot&(%;? z#isOf4j7v6X>k!H#H`jCrB;=k)aI6^;5=C%F5aY_rXk$?r$ap5Fk~+25&r|bqQ5VS zghYehYBW{MQ&w(+>xjQeh!fI84~Qz@B(V6=u<7$SS z+t-!QLiBuhIsDG{y?lj1=d*z$`=kl3+bfRcB*JN}2FqZ=ggeWJEDZOvitGkb4nHE~ zXKiqN-EznXr8c1$T70mHjco9^E`xAh@N%Jg$7bGoN{%YI#f88UTIZ)Qo;IYvJQu$C zfxUu#SG@D%2mP`!L5kRTaboSe)#u}DcYWuuGT1Alepf}ib(sij%`&up0MgK3y;Ijr zz>+RjIXt^pqZ;EqN&mHUEj(-$jY)3_CXyl6a%aO9`LpBqFt-mDb%D=%+So8K{D~s< z$G2}no)Y#m%6&A1A#ZBDA@fte%dp#GgP@XO^0U|Dt?^d&`K>QlSz&n_0R&dXy}WFW zJZBXkw%4DlKKXkIqOtT2dus9T-uK~6-o${^r^UTRv7Qs2332b@r(H#$EuZaTZgJ|g zBlvlGXlD|AS_1^DP8r&fkEN_7h*V;X;R`#By;TM$yJLM-fA91rC@Ie{1#)%kb{ls3 zZz{Tm2a(LF7q#*m`TAAK49teD)I0_?2;vYD1Tql?h@Hy9JVy z2&bXIP}h%#S|NcueZtv2Id=5sJ`LX@$QQtTIxGISIAaj``EqtoC8QkVd0@QDMwBa<6ObEX#dP5o+VixGU|Ogi$>o$@rY^ zz}c;hH$$#n6CRvHEi6#E9x~}7cZH0E9$pw97%)1tGvbP|Sd5Fx*$S{OiT~o5C!6R| z6eE5Bw^0j$7d6G09lCh-C8w`oa>8E^-Y6GNEl;)=@lY)7DD0Sr?Zpq?}AtC z9UVJ=@28O)H|-C{MbZ=H7}*YSVetOYrOh|ZxsuV+!f>x$BgT{i@V!>IK5|xCbriz* zf614HfuPbq(k)mC8A%1%F6`luP-0feccNdvuN!8y;&R|JO+K7aIsC*g<(ak7`7R*i z$Hhy)hwD+%G$mM%ZXaVg^3(M%PlPxzDg1L@53(_xnV_f zZ7_G0UwcX^hr8h@KrxU&YI69Td4AWc!*NHl-vVO%)Rk)t z%5OtK`W1GJrY9`@9FlgZMb^$y=pJ{p5FFX4Z~Qj4;&7zW?QuY~d=_If{jTYoov;!v zfp|F5`I1@LuiPgT7AFk#yNM21-7P;HJ(dcR1*tdE=kO9>Ah$~;{c8PNVa1I7l1Cag z{a6aC!uTZ7rpVvg+pz#ngv7^~@qm7t2$DyBJf(;nj2xh)1hxVw8zAgnO z*pSV#6pUEE3F2_jCYF~~(0QKVUFjp4uvzvblOz^zN!n^{vO{BUQfGkk`g>Jc;sU*j=p(Ew>=9k?nDo!3gk1nu0|FBa! zweYXzuwD1e4(8(!A-j3tx7}d?n_qhO+Nn|ttUlTSb!KR0bDqahz zcHp`nn-S7w*zt>#^*Ri?4#GQTL+`8HWT{?}ak@#aN#<74_O3oxKPLG7;d+#jf&9wS zr6lLH4P}>>hnAKSQo~$O>_Z08DPiNSw;n9)hY}+b5U2X&3NJGfIwDIJaqssMS5j(s z@?X3GF2mUJ-i%2ZfPw=yjPuqlS<&o44=7$l?sZrsuyQ@OawH$-_hnb5wBF|aytNBiCj5MQ>=l!X5fuqX*p(KvG!#0)$rSP$X$m0-`lsE-jnCaG3b?5H~P2`F16Ax&%Dl z8{(?_?0|S>^{@;I4dm|!ULRpqPU#JlIsugg&?eqWO8IDNtAON0`m?MXEjQjDG zaZtXyJHNe4k|Rq4eX{D_;gp}n2f$ca-V2wVdX`@+3KbH8GMS$-6=_*{^{`GhXE2Z9 z8NnC;!Za)3hqd6i?QNX?0hoO;+5cPx&IZ}lQM43>a9~#jOa)C}Glr`IT^G5y^0^JB z2)aa%GmK^gqNKKCS%6}M0f;K#6NhJt+SwPd^|s_Q z3|SE_7I)MVyB*Tb9bs%~1c_xiVN%Zltx)sZM2A2A|4=-&SIIj*Eh3tU-F|6oM^Q^| zlfL6&n+8>Zwi1)fjJB7E67i{8Y}=`7DwB2m9_g463u;OP3}_}SQ*;TVS}=TwdIEq(U3-q_qmP?J zvqMJ#j7o-y(z(6yQFlz5XjJ<+FC(fEuf+NdG64|RN&3G5U=mz_v}L=Dv_u>{)Mk__ zr$^{WLE!qBS+~RmC-7e>`=188RoMhOwJ0k$jq@_RVx->FqffZi2(+Dc z`d07z!Otx+H;pnR7BaSrDbV}vlcgq%t*pu)^nz`U2ds+hRX3ZwF8x}q3NIPS&3`4# z2wvhN8DhzdQ~tm(O^+X04kVsexF}BTlU|L(v$D(FgpZ^{px{j)?*}cjn>Z^T^zOJ8 zR6juZ>hU1wGN2{HGo$Wu!8l<+76@$tz;nc`l*oQ-BKApdyI++Wr4Z|XnF}|F;~?#m z=``Sa1ge%OA_Hid+0cTui4yG|^Ei}c8XK&%+3uY&UiEx7EnxnaMCLx@z~FG=o&j)- z#!%Yt#2IvDHLgStkl3XPFWqJhuMj9|DwREb(lOu}z^WDx09Ys}^tG*kdA!;f;)rvSM^2xBZ$d+!`x(gWBb+9#@!%xs79Dw*J~LF#cLYfo}y^3aZz zm;!Oim4F2X1%&lkW~awbxXIPsA_`vZj+00UfuwN2{if-f>cm$NW=C7wfi3s7{zU;` zNd)V~ir&on`bV4VIC(s*xhnDud`HGO?hGOeBF;#wbujvX6Zf%WX5e)SQ&z^@&Ln$j4 zP)4Nd;G&jV;Y;ONuo{z+iMr1@&wv0#d~6%8aor>=r4f@BfEA9Su%P2m1czxb54`-v zte$K6)*$9DYgO2Ne%>R1oxkAe1Pe>qLN7x2G`)GDPS0s@ODARv6`?(SSVrCaIlQd+vZy9K1BrKP)@rIud!-SzwY zp4aR7L)?4k+%q%hoS8Xy=6$~@%1dB_iNPQc2wO^0R2c+9g#f<~Fwud(F^y;bz<*d@ zBsCpCAO=e0KNQz|0cQ}1rA|szNYyp%XvxPKdgb+aiu+aW?MsZ8m_)%Kr4nI!&EZfM zFE*1;N2CH!SAibBnIAR~!$c_CDAkP}X4qv7Oq|oAYO*GyC0?xqU5;o|x72ha}PE z1K(1x@fISOQi;hIR#8A8-_2L@ksQJUQbvE2ym)z;_i_H){qKq7PIs?vL?dniKC8RC z`yaR$VvqDa2qYNU$|GR*`t|DxFqQjV@$yS)?hw!quhrRQOp=9M`S_ab9G4sW+Fw`h z4!R0adj~C@H(Ic>135d`Ss5-V&@Q|Rz1GhadTui}uHFx%=k3p)Z4XYl3{TOiuLs8$ ziwBANZPNI?=Xo0aN>2VSI*E{xdR&KLK<{?~RQXxOs$G4iu_jc&KSjPxL$wiE_B}dn zyd-Q%vx4?T_>!t@LSRhDUSMRk`0kj8K9~?pGIO=G>RASQ0(5gk1(NJzHu8(-G4iGK zD`nwuj;?-A!#uvH(a%Lfu-_u+Z1ZXWb3{9UDI5}4B40>iQrbX#fB(m&RGV$2P+D1< z^L0Zmz|_DX8jJxL!q4J+f^h$#_0lhd8lU;#G)hp+T8vWA3sFJPw`s|Wj?-c_KGOXq z#Z`?a%lbVdHd>$w$|;$dEQt&woPMIM@A>&CSJWWcetd6Ge)nyP+IUbp9-fvuKF6sr zwIl#4=qX}Wt{i;|6;~y=xjgAFN|{{~0-YwM6@C12XmvPV9oW^oS~6w2wYq=&_AL;q z_FKwcy?+@;uHoV4nK1~!>EQR~5MO$1vdk;_TIG5Xzm09S#+pZDbbG2#HGg@)rjD*F z`fe^gO^Ep}jFw#R-ao{h$5xZa*!Jz4ykw-#7#h!CeA*m#8L75Ybj)IS#a}?D&&X0t zozC~`O;@SP>z)BZ?^*8DmUNQ1W-Q&ORpSHtYreB53e3>DF4j1c%54DxlJQUaQ+Gyg z(PA)4r_1z`LCjoADk?WBy>HN>sr&(Bf|}ooMiLv55s?u=C*AixmG)O`rC7qN8vBgQ z5vKnnxGj&*%98n6rb;9>_j>=9DZ?t-%AR0cf<4$FILT2q!&`}Jj(Xn-$tG&D5+BQzV~DmAT7N`M;>xj-3p zLCI-Fe2Yo;Q)TYvDN|#?!-pHl5wdtp$?WAmxInIKCp$3lw`@W~ZMy_xvK**R(ceN- zVn`KRQ*Bxg_h_Tq7GYYT4Lp;j2n>=xb1W(&{O?Q-fntAx3RU=<+Q-6Wai#OhW$2*Au#WjbUbdzlfIOC zk?rj%s}>IfKtd3m;ZGXN&ZwM6DFyE9uhMF3Px?1Sy1D zRxQIN$Y(Ux^t#W-G4e2v(1(j-4tVKH9-|`brqkgw>kcU) zC1GD)vu3~q1XZUNw=^AY|5h$~QNYFZL)8Wc%T2^A+0`@qg5_MQa=8E*gV!#K0$yk8 z%Wcs*9ECgVzOwRv>#A3~FCCz~syA6HsDR8hHdIg*OG)ha*4|poxP&auC%P_abxU?~ zt(C=Nq=0YVMe;{G2X_YbeyxP7lWcJZwlw5@%z|D=wxS)bK>8tv>o@aNb7gOJmX-p5 zIROOT1jdYP=CtYF&2x$-EJz?Oa5L+k;yocs;0fSGkSb-MBcCrGKk(CcKQOui9j^;% zP{ndQd)>sV8;B=x0V0}sqitl9$QM!V>O>1!CLO^d2kr{?(NXBmF|}?GL=SwMPvY@3 z&&2)raP+5$Cbmmww+be9MmscP`yA&)rfurpBq6U6oE_wY>MpXCBu4zKyv**u98my) zg0a(PY;pu0`k#V@m6_sFWD~}|oWb=|fLZVu&;AaW9+nd=!D_WFHKJF?`(~2H&x0Aa^R&|GMSPOm5{%OlOc_`Exr<>(vS^9dX>gl zK(cilmpT3l-0#5d`FxR8@*1fTybcVHbSBSkgV!q6%Gi+Dm-QhLObe+dX>j>x$awVi z*J$*v^`M=;?0qBPqf+%trLwM|ijEKIZkkYFNN!&g>zgnW95j~|=;8nK{AXef?hFMd zS~Xgfym5-rzjT0T)-RRn%gxVVHKW)cGd6G|^KR2x`!56HR6rRBy!$V%GVB$4n!Q|& zRbee!C^x_Uxe)VTY)Anycocq0f=*)ecnlS!qPBElBOWD%Eir#~_egB?kVR^-U*Dgi z+iurS{qmSdJQ3wm`s6GQv6@gX^1m=O1|)fm5NbqOxyT@CSXy#z`;Lu)w41V4y?c2h z#nJ#udWA1*;(D{wlFczHGU65A@$vDEB&}>UMWRRdzR(%bYH1xxoOHzj%HkFWJEulw z+YKEiOx$AC1XGq^B8NBshC$cZMD^ni&kMoDDcny3TUrUoiC^#=oRRdAy2Sr|u`g@v z$S13r57%FT`yjEc0Z`^BtFIygc~w&0K1?gQ2*#ZH7jf&h7P;UTT>qzV%$DH2JeqMP zV%3zL^eG@sd$gUOoRv(Vj0K5E$AL}sY2CT37IZ!hLHaI>J`PLg&VP}>$>pMmAX;G# z7g(<1Hvc(3E}WW#l|@AR-+*b0;&Xm>NrF-2jcmbx^6ZM@=ChOiI5z5nmp>czU38JX z@&zC4?R{nTAIe~TB3T<}f1aWpOGbh$cyVSNs8COU^o!APzKe%Ps@y-n8pPrA%AC=P zysz**tRa71p{1<#Pm!8tb~1&Q=Jr((kXjK z1em$p7r~OXj`oyy|C)xmI`F)0vZ^AC6=7*%#)FinUmJMd@)<3<_kxbP-rPk*T?Gqy zTc=yIZl8lEH;Ro}Y!gsn%-qo%AUSt)ZkO_sT92(zKAnDZ3m6$$YzofiT-XPE`~nN~ z$z{fHx;p%)ub#-KbDPNj;9v)6MyL^m&$^UDn z+H{zBhnwAYzV4bo=m1dIp*)B~Xgbow(&HytY5=5V4+=0%1o$gz2VLdgKi|~#orHZk ztgrWAFb;jsbvk)P^S%|nhsKyvvgVO;?U3Py78tvBce(D!51zQgus^ zqqxg?d7jAwi$za7CG<9axK?;zJ!N{!b6KmQQemx8(^rOP4}*DiSTC^e2fhT1@ILqX z*S+;{gkuYnDX%qH&Eb{+L5@k%LB}at?ih#`TD^4jp+a<*b3Xff#PaPOZVD;SW5?m_ zsggesK7vmM@hU(ybkZOt>90Wb_g!6A?Ji?j6c*B2Xyd1O`2OB15pK)BT(4I!-vO0j zxiX8gXxAO009kpD&X~Fd6%FnvYP-SG+Yky8Gl0r+c%|==R&85S3>TJuo>~ zEF}fGjGD{0J;<=QxJ`Sz1GDpPoIYA!vZ9(I!guKUIx1~YaC>I5$e%{he5x$VAS=FX zqRjicvJ4*gQqWOHRRpNJ>!ZxiC;iS>mKw{TGod@7$L}PRI;)b+f%E+;xIr5}Hj^GBa4B``X^5vuQ_Di zm2o+m4}2EHNw>b4Zp6V8R!ru{b3w~%+JGR)t5_wY_Ln^bR#i#5oQY=aTUPFS+Y7!p zuJuipXk|aPT7V9ccpdgc5TJty+tj zYg}M@)Zrk(@uK~4TF+40-*=aYrkBFLFRuJ(tT<6No7GS@Z`(+?y*&GiX$YQRZ$d2; zW1Tgwt5#ONS;&I94ISSa8C@m&T=yYNt*;Q-a@$~f&59>#qF^iq{u^km!w$|)4_o=k zIPL20VRkDSh~|e`CL(dHSo26N!td9q@psedpA}G4_Z952i-4XJd^G|^l?H!_MM3-z zZ|f*+`;|@<@ov^%>SJM3^m%8rQ{C8(hi#3dlYbpKbo!3{F7x4nY{v-H-_k?&^CXs~ zvh`9+A`)Zwl|q5JX@nIm1eoCq8eQD_aGv+1d*`EgPav3H;pM2x{P@x(+U5Ili@n(A zX>YOn;lh=oDM8eK+}hXGQA?vlK-k$!CkxNzn4sm2`|=k>Rl;&_{mdsT8*Exy%7<`M zYx1d_+d0~4gO)g}(m(1g9OJaHg*p`U-! zZgAXm^_90b3F{Q!HfPV~$;8CotqM4-+EdrsD-gBYvq5`<0MXIV7ynekX?#UCa(8EpPn>rk?H z&ZgwQMI7BD0Phm?6^ zV@=~ZWXeZ%9vwP32Fq|>2YrB-xyuCe)^WV)dVs3DUk@KP)gkj;N_2IFYT$j z64xF!RhrzCY!)@=XtTN04Pst)I!x#=>wo^t`(R= z(dZ#%x7oE1CgiRM?7?zOVYO05F&|w;EjZOBuh(!hM~(aJ(}`58#Go*e#IUBQ3csf|95EXfKKV{lO{iuoAewSUv@13kiF zX;ZYkiHZ>j0F|&3Uc?~S%35E?uXJ(f)Uqd`it3~&8}i9;rVx*noqf6EGL zzoyH*s{wWtMjLZ2bLiW(FVP)kRI0jC{tW4$DV<=Zy62n1B*?w~IHnvuJ4MI+#Nl>* z;=?(7!0Pw}6pfn^&g7cjf`Z_77o=sh7PLuhE&pD%XG*R2$qs~-+M9>cmJo3`EvOI0 z(`_VP!6E}1n@DYB?H$GAdjVe>iw_X?4#X~+T(--7K6IK8Q@}{db+$1kSKr*USnl83 z*yfZ)*O#?FmdrA_T|XmFpS*9vp&8zM@Reh3AqyL_BrXACI+$r(re|hY;?R24;UTcc zeYhRxX2S71EhD3C`zm!>_*t`^BPnteQ;>^@<=^Q>Nn9D}U)3j^$RAYW8hljf{qh8J zOclQ6(%PlgRpSLQDFuJ@d#DmvY zdQDv&fX(!{ZRJYCYC3aC&HI){dxF(<72>>%SmQ^Q6)YxdhQa(_6NKvN+Jb`Y#=T;V zxu8qbm)u=s5|>OD9jLf@{4~=AIo=PqmEy)ytoJz7zDn z{rqZv@U>u(LqPu;0@X{T=5oytlnhaA-N zVqBtfPwI?Bwxkc}zPA`eYxf0+kPHQx)e+ZiE^QG4<%_f921AsrFkoa&j< zJ{sk7|1jIxAxB}nGZJ-8)^bd~)KJ7TeMeg8t(Q1CK=8+L!SS(<<>x{pEW3lHo;b_v z&}g7i2alIk+A6)dG@-5>tYep2VHi5k2jzmzX_tcDc06ezb74 zQ;aS6I$%YDdtxPb3@BUHi@cMq!iHMthAbsYTq#i}wlNTU2;>tGJGz0Bn@3B(oaGZN z*|zspr#mNad*vR0-Q|n-VcD{W;(@+gr~Agcg1q1Cyf^fRS?)5yY0LQ~{m8_!8si-N z_O|JiFypE`Z}$-nuY5oxzJO|X6{N?PM>w^L~-D^{%M-EfB%tNSu;N^ruZ zgXtKe?4`le=yfZG?t}Svqyz->z8P7MfE{_vBT4Tx^I%ZHZzL}+5K1Cp{#`70j|0C6 zwwx0!M1FF-Z9A2|>PQ}&H@7f=E#cnya z6b+w2bMHP3MMuM7Y@>glZAe^6Xk+MO&u_BW0?(f8<;1LLr2_GbEJFMim^e`nk;d!?V{Nuk zOR)A|yh+P>d98cfu#|kKLoM*koj$|G z)wRo{+*heeq^3FvCCpxlQEMa^}G_!M5KyxYKhW^&tVS**+PNrJR+ z{__7{a0)Chl1Sg2z|N&hiFAi|gq)A&r!Jkcc;eW$8F-?|6V`fi&UZ#JymbQ(ej7lZ{&MSo6S?Z$_FSsjyqKK~1ar&k)FEm7?Fk=#5$JOsC1T4~+#S(JxEs|(F z%oxm#e47SK8KRN|;bFUXt0`F~y35}u66oqEPbV=-=nV|Q4h*kiYzvPm(a6f>U$Ga> z4C-=U(qqhVZv)AqlccTZGc&^Xb;E?R@ zp+O@yLU7yP+yv>Y6vAdEY7AM6hAp?KNyA2__pfvBA6RE+1gQrgpTA1nnqS4BFK|~> z!KM&Dw&IBIJifmGIX&*RNim=N1t~Xj3@SG_!w6_E5Qgm-*h%9l$2@#gKG)ql>31x< z-ZL{7d?C1x5_uK{+)ZP93ppES9?#s<%JkcR7AnkY$Gw#0{x&{>-f+a8SqqbJ!xLQP zd^GKUAa_A$6ianBa-Q{VTZ%7Sf4J|BAVF>C=Wv;e6Pkr+FdCb@tZPd2=!54mdJ_K) z#NIu!l(Lx2l14508BgcYz$TA5-oZVP?26EtT@|pF7FPzFNEL+t*2NxJ&Xn@OU3zXV zX40KQ7Wk>vP%>%OSTNf?(YOd)-FZ- z)fzu-aA0S%6#FQZ6n5va`?m{AEc;Ft8s+?83%|p@yD3?Q3HfjwvF3)bWn!>(=DK1+ zLRld&#{j2U_=hFN_j{v_wHV+ty2C%G4~WM!t(7na>O*Uflu2$@bDOJKwlPc+;{*5k z^k zG-bGy76k8$CW==iroHTU>7QUS7yG`~tl^L!6>IT>44ei9y)J?Dyl`%i3uvnwLJ${W z=$fYRfD75wwT4@SCMKSmT>R;}hM#`nSlvD-?T>8;f|7iwDZy-PgX zG58qYdyze};y0^rw5RZe{CE#oRxN10;plh_6jMi=neU+|+P0YCsuO?&_lsk7Rj-T*1Zn7|nv7Y;JEbV1T z5o@8b_s^0nh!Rgs2qvFHrekw#!i3y9@M?$mQRi@$$nN8kb5tof6+bwgi+&P9y^F>? zRBK}x5hv7HM8Z9HLBv{4SsB%;=Fw?PVNIKMStEFB?k?Xz;UNIa96$3Z(70PN_2Hc~&uzm_rVDw6y`9HZqTul?Qk8x_qVJu5HDgatVrWSwh~_(ulNS^zTN9+iY8MVG0kS z9QIrcxpuJjQ`8=KhAla$8TPkWrPx+@_Kdk<*`n?Gw|YuTv{mzuF5f2-Ep(>e3ZQ#( zrEYV&6ZQ6q4DBkz8xDz#iQ8prW65-Inm9ME-@MP+SxNnxc0gyg)%wS!p8|qy#Boau z0@*S{$|FNQV?;M2Hi1n`+#WXPd&21Hw;d4ows7=Vd~3AgF-0%QB`~xKj^DNT`^ri-`D*x zejJ6%pS#t&GWRm>qM+b;5EQYx9NMbS57lmGW2KSdgT%6F#m1!Q+V>?D&zmw(lY_Nv zhoM!*-Vf==WZ3q_^sU&Mutep82ypjh=UA4&F*i(8@x~iS&bEOK2=g z!Z@pigEB+!lC$)%+f6UB_SA)jk7%eAdas9>f1S0{_h?IzaM+fK+KEixs+au-O%DDr z%74eGyYhBK?XxxB9FVZ}^Ss0u{xssAU#T_x_=f8s#J2QoqDE4@lF)m!xV+#9oh?(s z4Iy;u${hSsFhy=xyL!%nNe{Ts&k&~mfC;xoWo`}on}aCX$bR^(@-T;KVy z-F>Np=gQ-9=i*y!vZJLIj*|oTQ^l=p?Y0NFStXXBd(7QM;T5Nyq0oEtl*w$75M`c` z=|q7HS0ZBwwh)0lt)pZM;csmwTr2)U+zL-#qTGiJU|(`0_9fd+ZK-;KV-adKE##IT z`;cv{QO_-ZS_dIrDrwVtJ`(vUqV&re{m|Wh>Bz-L*wNVIM|z8>XquMXOjjr7lLM0l zBT=(jRdn1G%Y30W;eOx^b}N!B6^4Op7VT-?bW{b^|WvwkiTiOh8$qvp`|XIX_gs!D3S zQOp|Co&{+Wpt)S11p68FU0l{~KYonfZDwqbh z`@Jq8%TjsW4VUp#F`aOy4=#5Ov`*)8D9DvLyM=N%GRshx`paAHJ$)_%ONga2;$*3` z265Sj&mAL^#T>uJWqeZ}!VEb87X#=$h)n*4LO;FQRI^J!ix6(G703Qe=eY?*?$!P}6f_(S=yB*?O4D z`;2DKF>0{m(x3Zq;}cw@ar3oud?9j4866smXNp{aR)x3VdmY<1l(s`MyGEAV&(4PY z^k+u4Eo%IFVV{nAud9|;k5p?QU^$aKA;~zuP(8<-z<@l*Y5Kt}It||2U85KV7J40X zcg-=KElx)+L%NV4_!1~x%TilNlOj*|mL#X}y@wE=O^IMWocHw>=Y3?)CH5^}NXVz1 zu=O+Ju#YYvuDx0n3fj*H>D_+%xK>n*w->opx+8u1*Gk#~`i>>mqI0RjX7kR+_mU-y z&JFw7`$BPFa*ZP9JBsXmW}oR1Q;2p_mKo}sJtVpN%8wg;I<(XBQj;RTyVXWq_rYMZ z9gX|IJ2sXs(|-qBJ-Mn({v}LCM%KICxOIM-D*Sg&W(>3<;-KgdI&rv^vg^7#Dt!y4xYWRjKPbP=4>I^zaO8L znE&PrxZKT+3SMSd$|yqV_t+i}E`&6D!xup5uS}X{e)P3H96P=9AC%akkws7Ms2UYZ z*Wl*cqg9h_r)5-V;GDMyPn#4NK!2dG8LEV`Vt+KJouGa=@#_l0LyPKr*mh{sS3h~< zvv#BUL}z@j=SX{n8}BAajM0(!=lwD4L0~6HVUp`!&39r|T)#H{2_n2pVoYaEjnQ4o zUD2^6M|Q3zprnc)XMDy6GwemiCG62GAzidjY%jhh3K8XX=)Ge%3#+c|YeIM^yqF$u zs{;FbyIfu+IpKX<;OU!a+1eg>tujn?0n7!(1K)`0455pW>Eupof#4iI*0$?FAC0fV z{UcG_Uc`Og54E!qd+Aw5GfeZ)pZ?~Iu~k!*b%A!8cLG}JCMuXpoT2AW3Oc0{BBG_b zL+*B*JPjwsSc@hMWbNFm|00`Eq09f+6#qB@q*#M+@eUQG*D!cyLC}4 zobyX%()pt;mErHKA?2N}vspTcF*`y{YNZo4*w4tp+Da))eaz5F!W7FR^4xAh4Rk3X95 zmSoTpWd0~W-t>}LDpP&pcc_{RECc7;{ZH>b6 z`b&X5LD|j+8(@!AuhwdYp>QR8(rTFQ-k8a3R{q_V)*I4XgnP7_%7FEk?=Se*7Zsou@-y1g0hXI^83}Bza!!Yb`m}!vgLbvm;>E|?)zw1!q+qc3I#veeOXh4 z(|YmPDa+WgOLAp)3!$zhQ9KX%9vvsxla5sf0S|DU)lZkR#Dr_$ICWvD7Ay023|L%FXyu-Ng=EWB{!%>?F*^7BYUOyfU(yG_xog&+*M*_Cm0e;miJOli*Ki-5mx8~r zf=nG}@p3Fw=5_x2h`k7v+e80EPzIT>9R;tUf_%RSAuQ-ywXq#grf}Oq6P|znj7-;Z zGrWo}AO~6+GpiDPHpT&vVlN=9CbDY*762q8>Tt5^;@O@s)%CWYP$BpyRSbiLa3gT2 z{8)Ge9MWuixh%)8t!0NE+P5&0Jv5G?!*~Ou-qRTs&$Be#wMie_3&4bh%TR}_gG6@Gl_ z9pyqm?^6653j(leNo`I~@pNRM*ii6dD}`2#IyCB+Dz8>`Us*>U-jAydG*A}iAwQ+} zE}|${hR|#=v%wnEatig`aQ?GhRH3&e?_QbwSGhqyaSCk4n*p1=?bqHB+vod9x+$c+ zlo-*yyq|V3D)gGVEH!|W%#-}Vkd=y^vkp|BzvCN1E;KAOJUtn`40j+L|XG;r9s(UI>`f5$Zl zJIYTs>_ER1^Ka<6U-_HYNT=1k=l;s-<>h2Cu&OQuvzx3 zGA=|_2)OjMOts3rjmdlR?thox-D@NEC2~N*1W25tsGy0xlw67qBJ*S9B6+M;9JmLH z>$sSx_Bq^_SO=|F_?sW;k6s=i?@NmtdC#){n4YN1!O{ zEyI-A;?VJQY=vjMB?zDsr~JmE|B*5+r}r_vvn!4*Pjc{>k8LFdhL#~nW!dR`EL%3b z3U!CJR492uP&{h<;WnttGEfG3HF`L4djEq+0RYW_*-qt{%P`|N(neVztv}|s!bWA8 z-%Y4Y0AMNejZwqFhF>cBaBzf6o)TOcy%HUoS2D>P+PG-X={d3{;gKhD_* zv^#zc_C{JBV#X>yqp@V-LQI0=oC}!3ez8TS*^15uC$bXoI4A`O2@sy3k$uFlE{^fkRm>hg#2Yy+nuIsWkYB;!sS%CsqZbz!j{Ez_ zMz9vm-Tyskcf9g?OHM|Fu$e?jRu|N%^ZUk%Pg)Pkp}4;JL}}3xJtNAC3NWU!Fe@pqh5~^2jPE zD7fH02lVvE0ALc5&in%meHcG^RMOi)8&C{@F_l0{f;n$*Z-)U&GYNnKm-vvZ2?Us| zTR+QZ-p40rW}Y8^S&o-Oe?~3{@MrAPm=poGIs|x7VO4x&FG`TeuF8!fT3+@tCiw4Ca4)WbiVO@P8!4l$8scCeg$OgRXxN#?$6{i-qQ%@Iy^scD5N?+!eiB;BC>oDf9=D|kWJ5}Ckp28_d0F24lAjkE zbt=Aokp=ny09>gliR;0BwU1A}QpaWQXlxhskBe_>z64ThNQYBwcmL zMRL=%8QMzUN*4bdQW0On`awpeHpM-WkwfHwgJ-f95b%{xZsD~m7?n*fRj+Vuzi>1f zgc_><{GM}x^1IfqUuD@s6AWoA)0MzOdS|E7i`*PnQTS{N~2y>HmcNnjUcozPOvE+m_WgBE$)ldLvbCMvge zhealXFX*2-C14V+1Yue(>5t&RPU-BNVl4-_HP!Gg@m2sV_by#7nWq51U8&G=a8rF6 zZQfD>vj~j&Fj;F|+27HTrHQ2d4-Q}>LcrjKsGOfWY)|wMvG8cyO)VG}YIcKJ$&lsmr#5{P#~NkJFhsm8QN_acwpL>jv8Q+kc+m%mIO0D&_wos>p1U$ z4 zBVcFA#IB%(0VpiEtGDIcK}e;99{%;MO<-hhVB`g!V2z!DI^K;zoZvb(75KxDM9%w19Y6iEC6#LvR<1i8s2k1cdJX(UBrv18AP!GzQ#1d$)R#9i6Gr49NmqyL03D9K`DkYPM~_6+;;Cuy~3&tB{z{yun#iufs_YEFXqh3@=G7x3&E zJMGi=bFV@Pk7v(<7C%dW(D2GU%0kODcW;5`TyXnYdNy8LkPxF1>&QgB45QgrJ2X5s zy3_3LBErl!s-%=|@jyQNbM|fF!-pT8Gl9<=uNU{yl8xXw5YO??N=oreHVJ9oUGkqK zhQ4qQ0an+b;#Js^V^gy&?mS;DpMfrsgp|5Qe*v@Jy!`g&We?SZ$*X6liQBEeielK5 z$0wi!^xgc6*g?aHH_X0TuzIFbn8P2`^6$lxba`F@Y9vR#&zF0rGlUycQ94yDq;s{6 zqtt<23KHzPVImYbUhVL6vCkh~A%A#f$rtDRDqK3>peHLd;9N)A_wrSsk@pAx5cc2T z)H0&}S1asIo*G;$ZcVl_^$%R zv0H_k$nx)}fb(@UMr#XEAt9EfKQNz`!O6jVSWxghDjJ#oymn2xrnA%>Q>Kj*MLJix zVlv^|Jta(Z`yxjDhd@JpH;WDP(_7w*s`qTX2?<3_G~rk`F1C8G#PG1;%p%3xMcLh7 z_6cDh=3vuca&mMeIEeVSnr|ptb4Y=K;mil+MFDo|gT(x47{t=K`iNJ{eSn*a6^LR+ zob4p@^YS%~jV2I0?es&c1r{3WD^fDXEnP%t_v^b~3e!x~1;aG8$T30Ngj*Gu#Gm2+ zZB{albHJs#OBVe~RMTD0sFFCZlIsM;=dG!d6RhW|u*Ata*;4sm;Dfk7xQO$Uy*EC| z0~%e5(ab<<-gCSgwK2DGu#=UdO(6Ui;a5R&T*COj*55mc-;HF$SZ5rd^)M&{EC}&5 zx~U7Mf8kTHV4S$~X~RUn9NE$5*=xt!HO$gqyzpjwhH=45Gy30yY>i6Rkk%sOLe1uCKsBT7e`IO0r7f)NP zhcLqB2>+c)iAx9)((c}>lcFE`?(BuofpXK>#$Jv@%^%&=;i;)P_EOe=@p)MnBux{T z7ig4p8$WpEx@eFoCk#RML0riZcX|0%TP5<5scjJ5;D49Olo(P%EnGdguZ+8!OrmGJ zgVoq#z(*ny`7d@o?bRL2JSk;+jV=3pRxz-63sCDng;FF@$dEXj{wFV!J^Ke%69%+Ei_UZ zZYx~Do-#VO?6$<(SYPd0nfu0gqLZ+~;fUw1@85G?1-&+P&Lw&12rZwz7_ltawwOb| zs2r~#+#%e>sG5(Z8__N`{}*IrQ#d{j+N7UJl`y}{G@^Q>m=c?2SolNRo=^PAx3;zE z&F^RFoBD4LZy0qxoCvj3_evpgegKW6)%B-1X2|#hBA{*%hE0P0|9=@_Z98Yor1X1| zJ-!q9rhs&8*Ywv>ijmgZ#G<$qyw&rLPs0Ft-OLd|%s_k>A&D3mT%)Dt_{4vvGIZ-$=}GmZ3|Qp=%r8<~M@YjwL&Kqfv{=k5+|Qp#r8Z%i&taVr2L3 zJQvd#Put)m7j$!uZSbzACor;aU?1P3Hj^q*X^R>xSiqy`xyqxukp8}qLN;j9K_Io# z@rf&P#&Lx4r2ggnW6p3ZGuzng2a@AI-bWz=Hk-F!xY5_*gRL)TO_M;+Bau{D<(elZ zYmq_vOB=4jAeh>JnY3B$l8F7YfpyBEfpt8E-8i~vr!mb>O%kUZ=oxci0=ao3EbHs? zhWA^X4yjTVTB(;osUx|)O`zeYRI70dOo02JcLUK&8Notey67X7$E6#u&w^z4&NFwW zo`MtUZtI_9Y57sJ1Y2t;Gl)lGvj1J{U(P1aLUEiItQ{gQ((!g_#_h->POW5p&OWWb z@rcIFmmvPOV);E9O)&=a2r)M^&Bj~(b7>P^8R;^8$t2ZhWt=jD;-|M&oXh^bw=$>= z)bO0Yirh|JoFc8fH_~2F&}EXD_vTA;($j~HYKPeA{G1PZPvT;ffhGOj%lY&f6~%IB zv8->LLZL~Mo$GSth)YJaQ+|(ALHHr--oBTfNd_xx>y46eQJ;6E^}HiUa~eIT00vLH z<1Uy+ZO(LVUK2eX92!07zR)vN_z(l9`-7_E zbYJt^iH3k_f}J!#u-}fQT|~pag9DD@4&Kh(k`;2B%vMHY&MFRv+k&Z+<5y4(4o5Wq zIzB`#v*vhrxO4qqCe2{=^3fx%Lp*@}FVJ!qC-yI{*wX2Bry*%rNMf)IDA_8;LA|=} zOZX`|aL1BEsA!KzfR*)j%9QtFXr74Ip}OjpA%4lJ1&Rr?yn~5Zp^_ReX0It_}k?_$a|KJ z^1-6&d>kuQ*$!4UH=|<^b<49XmeJ@7k_us`vigi{q)a72;s%rNT_{cwjhhv+_N5Ca zl1~{QluoplGS=5OS%&#ktw@k=BsSZ(GPOyxh63DAUoTJAVb^?-B-k#pZJD(iA5qEA z>ObTWaI|YEP|!@(cgh*vi2;ko8jB6CWiQ59W~BW>%Tah?&uF+DvAJB)`~u`McWcfJ z1N|%Pc^>pJsLwK6O3gdMk93TnQ{3qHh-Pra1TFBqOxf5SmEf+Rcs zUmMOE2OAJNu{bWE=XJpiWPP=s)01@dJmPM2Y}RSofxf$5477r7X_%L@_t*4H!k zeoUu2iy}CSJCNZ?Cj~?;2m6NSx2OKJNdk%c-XL;mB7__ zi0(27ejVr-qyCf8xXz!zfZdai%4hZbu9su|&bN^!Gs-S5TrSrx+f^zzg@>POlV_d- ze83|RX@2CP9<8XLJ;hL(t}g>j)*PtKVvUU6hUs~JoYLpy%Xh6BsQHP_03+G3U7K8J z2S)qnB>E`+hd@^l2=s7uvarvGZ?lEBKV3p&vlP={s{Oo78z&1$Dk^mgeXI> z2D~iDK44Xu&NHT%u8Ypv!k_pQaJnKD+S0|H_(kvE%j^$;)PTwh^IeIS{``cHS+_2< z7^0&aYiD%0@nG6EOy*x#P$8Juk!+LaOE9$8w8kiGkm;@`E^2(4v{Bh<*z7nj6-KI< zD|0g%-hz=WBoUWIH_!hqJmjTr+0MrV%i3Jc!ms`Ptkn$G@Ax9UH-(C!Gm7)uL_4}P zofDV?cJ|KYI$_fk4mWZK#O3<+yne=|MNinY=g`tQSG%w+Rj@N&v7iw{AXqIEluG>B zzLa%s^^((3;=Y}%Or4Q`(ug?6+i}+0M;sb{#JboC9o>`sD+ch}5n|eK^q~^^CK?M~ zZml!T9Mb3Gkmg3$R~Ji9Ved&Pushq2)_YeF=JpS80*2Uq-QtYmic}ex(Hz)7(M1z7 zk#q;`Y6=v|QF}-lSJ$ELde5es0qGTS4S3Rbr(* zTbEP7*WIsoCScFELm3qx)DpN7GxJ+8WZ-%o$&P0CkZeFRV_dDO<9{E!!m8K)B2MME zHJM?B-HJT(nNFkJ-S{Hma367mTVA^;x7(|E`!3u(X;!Os6}GK3tNZPpGGMk_^4`tp zr8!&yCJpRaNG>!JrxS^^sI{5g<@jd4_#$&dKk9@-j8gG(%Jc10Td2!&7A%Q3R8TA+ zIx9#qd`eiu3VnTz)s~xamR@R~#*JG;Tu2|i(!7x*wnDHyTAI*4=tHoy&4WY{GmtT@)n%{yE+|5O(sR zcZZl6HI+8c9m@i^_*o5g$1DD$98mv@ua53{+l57J>=Imk-csguVNi_I=?CS~(p)9F z;f5RO0!wj2#8Z~H#GwWvBQwF?mDn;Q8{Ulx{`{qc-@-{l%uJ*D3v8`^E^f;dOn;YI z^`Z*-pu={Ap|YT+Ud8+dAz1ny@FaA-X-%5RFq@nfdB{F&no%K*$(*K zeskt?1CGYgT&&hA>t9thW))5Zsel~%KUog>v(`li6P^DwQU$-XT&?2ZjtSIxY1D=( z-+sBEvlc>-o@`?N@Pa~hEyBZ-lDPTdRLDSAViP{`GMoBfaJn~Cb9Ad$3a#3+oI3J; z%vOIi2m-C&hGuEwvp>ICcII#z^u#B38H&@d*OroQ{f8{%5Y@=T@qky~uyO%`5nEjy z*0h-HM$VHCG*Ao~aTDXTB?1JfD8)5`zy>0GF4^AM3eI&|g}+p&$12S}f8dfkE*j(p zZiH*7Evn}a{iIJ-XKJYH-h}JCWX~`RKTFWpTHl%@60CH=OTHtE91nUtzq&iEaCnpi zRXulCijBx+jRXT*Pi0($*A3bTjj<~F0w@6K{x$!*+tCQ@?`*O*9-(8HnN-^tCdffe z7@xD>N&t?z>i!@vuj{wtO@pe46hvQJN1AOBy@)>T_+}EKcl7 zpiihQtUtwvJkcSTpO}hWryj4$uobT=?&fX~ZvoWlpupM~Y(p3Pc zXE@@iaTKAl5uG-`iR*p$XDu+@BQYMf z2zNK$rG%=L0Ge5@$U03AoK6oq^lQrV3^h-twNh+*Nv15n1CH>4^tBk&yMl&YI{%B^ zbI^#z_9yq6B%3#rjs-rQZZKN}0ZwYw{Q#*0KO!l|UTBE%bLmc4Rj!OYZxddl#x~<5 zQb+duRQ&ayQ2IW3CUOJJ1e5$gvNz2co%i+vn%qldo&*uv@So!Mj(l%@; zL5NebB}?r`2o}4h7#JL6Xa~!X7zXJ( zwxD2RryZU(xU+ewF3H`40&t1Fy<6gn#gR@^(&XNDLSJ=OuZ9d*QTOS`i0c~C{coit zGo68X&yx=G?aXX9S>zTiKg;DJ($unpOQXi$9L=C|c#&|2U~Tc?Y{JNPHVayDFt_uBb#YY9km*OxEpvWU%bX$X4jqf=Jy>$=ukDr0F!~8g_`! zWnulJ@|K#tyJ=65R^1_Rd_cuAN8a2zZ9!c8tFp(6rbf26syLK&veF@iD~7O6WDu=p zLOpau%W+^yn@uu?IB1sZPNh?@G=bR{ps8cW$OiBG{qGljf_`=zsI+ zWd9P#W=3dshC>f^v8@`?8woL>UZOE+e`%>`YKZOzn8 z!<`K*NLYJ$c`10-M{u^U-9<)X4CG4YFc#l?=xo{aH>f)@!a@$M&aK2&3Ps|&{l$g! zQ;pgGOx~R3^n@WZ?y4Y?;lC<^rT|!M^VR>X>88%~$ixaINs`&Sb*QSGPKX7$@@ zbFpVcfJGCmDmBNl_(gnZHw6i)`eh;o{$k2z2h*+gsD=mJEv=niRs|U9>e^DKj1=DQ zrWkspMHpqiJOA_eVKPB08`_Ts=gA-Ax^7P9kC52tu( zDgSXHNJ+2#D@f2DXVaR0TiH))z$n)Z{JP7@arw7dTrrM7wlliF$GQH*{&}9~Pwm2T zjSj~#y)+ly8?{fNjL*)KQaNx;JOo(+%aCsT)7jl}83SVpm3 zve`!K`kV2hOTt|`${d$h-~DA8m<^IcU0XUNjh3AWn(|~_i(2cr!PYr;U~R^d{cyK( z;!gqy&Jywbn{@(YP!itz`HkiI#m1WVe&Nl!sueBgpU@f|>7yA9cb7>=*?iwuUFFn0 zlwgELen~U&F9-ZJCW~1o3Vn=>sHlX)?$EAD2zOqKM6Pbx;4i}v3Gfx-zIa8fm^xkl z0Sq%?4HCn z9b1)sY8#|cJ4R~YA?q$9>{*F(wJA66h!u_1yXQ7;Ef@1IWV5CD%EjN{rkm1s`ggp? z^g8Gan>Sa-q4XDN4A7fV&3+(_NTiFzL#JML6WfCmCt1(x1ZSnljsXz(Q0kpS&fq;& z^#C${z<>r)->;(y-tHD){_zxVgljB&>=%A|mmo+%5i+eM6Q=}{=ls@rN?HkopX}3U zO%!+oj>l2y&;K%231AH!L4Q0w);7M+c}8)-m`{LQ+d8! zZD)N{DV68wAk2YZ6m#XkrcyeCFxi{m7k24*+Z@O(Kh|FVg1BuubE>$v$>;k%(=KeJ zC5vPNMg9+XQtH$L^wd+{O|%I&O?g&|@)yZkv-rJiE zr;kgTRxTMZZe5HJ@xOV6yZPQ4`4Mo4;&n8oC#Y9p3xBc{P9(&DVG475)E$^C$FA8rh$|pJVysO!fkX5l)8HB?}P#le}g4Q0E|z zy0{{C{^D5v&X;6`SMVl2Hrp;mrjcj;=_fSf>w?` zR#R*1Pe<*dH|yUQ+J!`D;TLmB&9I*Wo0Pb#FLHVdX-FI9JHI(^)(C#2c?-0=?!B?S z3uY!a?6=YqDMoY))8uNuI}bi@K6StM{ezuVxa%Hb8h=}+2-`&2r z>BkUQbvL1o(dkr!ZR;vN$?>jx`}=Bf-P6G=B{UPku9Db_Y?KJ`iH3w@6+yZh&DhvU zUNfZY*UCYAc*Bb0Z~D8f+(aU^m;_i^K5mO36g-2JO&$RnlC&u^Is3^FJe!^s(>haa z&aZrM;$<(<>nd08J$d5@NVad~a8=J?5S8EY=oa*6K-;E)y>2^RsO;T(qp}5885V-f z1Q*=o`03B;7DTZBE5#1xlT$X)Vr+q{vn>sa%M`X}<1eSz8;>DeMaozW^bOYP5@X`f zC_@XH93d1Dnbx-p(Z)OPdBaR-LiClq`1Z3}Sf~&PiHa)V{_M3EktN6G=BD6L{j`S6 z%5aX7KlwfaJyMW`w2>(m_z*n^u$g zf6TQyWK$F4NSC-i{-r~cOq5}*Sq`f<4(-mw8IOMf5RdANP zJ-8zp`}nZ-*zZ1XC_r1)ZLkrDM)m7%?Gc_i0=CwVe)OEteHnG}OEWr=HUoPIj(6W_ zgJtOJ`I+cHaDz^)=r>u9Xw0tKW!clQ*0v-On=!{Eu4V*dV_6CP^tLa=_1lZV#r1Ql z`okf|r=-Nb2QDjIkR4Gp{_mZa6;3j2AB;T#&_n$+*s*6<tDw{v5zbk*GSW#Uzn-LGu#q=)V*L6jzHeXO;^*xLX?U-%PriD$di}R%kgC`3 zdL?vm_`v8|7{MjJ816KPoIQ+@&=S8^PcVdqCY8An`I#Vl-h@sH@V;zXVw;xv*J_DP zCg(_$Wpj(=j}_xr)p$KAEH9UBbtlVqLd58@JhSJmvRU7Z@|3c9kXJjDQwusw#4=153-YC7Zd>jv__M_*N-)CxkzJa<3FwM(}G96 zag;^RkUQa*RoWMj@~W!Acslt+!@`aZN|1KdKsujYwf}<;-MDvVtntIXwuLW_@$FQ~ zXsQ9=MN#=kSHK~PV38-ofEk__B|A}#u47*Iq7g=Tx9a_z zC#h4oj3$+^jIh|=6AybcLq9V&vv51yRNG>|zYwq4FnX<+oo!FM$JP&>U!`nOmxvCN zF-#?IfwafrAGLacvk7f^lP&KSbcLFh?7d8Z&!}}CXeid|1tCK1R}EDazrh}dHG_Zo zs=TqsMWG55?lY=7)h6BbO=lBQxJlbB_qX$1TC?_gRxv_5q!i*n(%HY1Cthgmoi}DT zz}Nbdx2;<3o)1hnb36euQX}UV`?5mPKF9orpHOJM%uFd_kG-ghsocwl9Y_NI6`uxd zzN^!Tue!c#{AvAkhPEV+-e=3RO)Q{4S>YP>J84#^L`1c9spRs}wj$(Gp=PG_Ex?jtp(HVX#{*aP+j%3OWNXPI z^T`Dvev&(BBDc>@Ofd{ER(8Xqwk@-G$heB1&%E0Bv;G#u363!0^#-T;b@-N3r&KOS zc_~?k)8cknI;I) zWT~_xpMaZ?h~!8+wih^^#M~bE3Wq%UQ@>RKgk&duS9^Z(>((hL{FuD|_d4?yziC$&lAEv7FfV^#qT$8HxbmF$qrxPEjdPpY>wZRE>ZWw{Jg*h zzmAY`yWsqs)T0Q?{qo0#^=FJM)P|lI%bg#i1`4nYn51S!0pVk=s>~GqmA8ac3uhFE z9&P_S%4n%*2mC#dJGN2vw`{FbcSPOwaozPp@@3N^DtM7CA~VCfg=v{hUK4ezLNlj~ zi;Q-5m6S2LGw%5JXm3yTGt+jiT5mMJ(`qJQacK?iLDbc3JxSy4&+R+zi(um4=K1*e zN}2Dao0u579v@CL=i1W>S5Xbx-3UH@`$*J*^T^Wmdz=So?W}jDvm5e{-@Z*HSaO51Lt&#&*x^#oNEq68!{om6z zpx0P@fh*M`PYz6BNCL?L|9Tmq++Q}qknKeyeip90F0uy0;kRG-s_eI~E>sgtVBu5e z3O`Tj0!|IWR1 zyt5;`pQ{yY-e`Zvm7?vnE^|_;q6Y2t+*>+3t1Nb=I`_>oRff2GdKUY>Z#UvdX44Oe zCKo6}Qcqbx?zEYvuWxM3Pkv2CrY14n=&*FU3;>&+tajMSdV{mY_Jxu3R>{c7X24Az zM|w}fhAf3k(Cy)djV{x82&f833Hx)NdP3RR2s}xJNSwNF`UZoN2M&hjQ@fuxz*o~a z0`6kPZ%b|;+}+*t>gotWaVXWg6XcYjY}x_UQbL~vxOynnVTmEaIpC}R7o zuU6e7yv##hb-Js97@-vsq>jz;T^t4n@_cOdyzODOg@pZw|O1fC$I znS_=Cr+4$L#3)$rD_5$M@6u9{U)M^TCun!v77q(mRXb&6nv1BiWrwVxKsS2+OKsOl zO%2yQLT=FH%57TpVTlM98ME)(8F#Kwco6eC&9&8dJaP&E`IyNCOKu?=7tgr(o&9B+ zY`2jT^Q8#8KtVx4^YyCl83MncJasZnYIUaeea)&Kx)g)_Rgr_a3aOU7Xef&@48t~Q zsI!0>)&yRAtK9`vY|mys0YXGH)s|jcWj^mR&TnKH1As*>Gnb!KCbG?_jvtQ(sp3o> zA9$C_@{8+I=|ku-Zbqm1N!-god^n20#pxO$Z92l}QXdqd=o3kj0-}g@`c;1fzU-s&>(8b6eT@}Z8;Q8h$&D9?YoyCn^V; zAIYv(wPa73&u`cq-y_XFUTdNn1WGTA07%AtihQg6mER1(%iH4&2OiVz6Qw0+qni4>E1u4W%U8UTj` zlog%^+%*MA(cMhO`X>Tj2Pj8oB$xb_iMY@}7Y7_1Rm4jO;rG$5zM)ZN!!$&`z5klv zfOuRENa$H6g?*!EB9gyQz!ojFs*O^n2xr_w`7(u|^RuU7?{a@Om{QSXS?iA<;ePzG zT2g=e(~Eh_nf<@;kEIkBl?cD$em2Mtsev6}otxMH-hES#vvO zQBAn^MqL7(hw2HP_#Wc#drU;lT2hXi@BP>Ot}P7b_RlvG=aOE^46J`;Q?9gewEsI( zw&NYvU(<`%ecT&5qoIo7278~ir1JhrtL)QXJtyAgsHhK)OeVqE&CjZgKlSsyJ8A-D zeN)54?SJ1bM~=c0U#>7E%t?|P90__$xMQGNPLK86BnjSw$)S;LZF+To1Qmg20>-;# zC2mzOsqlv*WdIPO-91#*DrHgG{!^WG6}_(vwbD&*N8KYMg=YIpO30J0>bLs^t8lp_ zF={kkR4<+tSx^eaKJ-$at&2ymQ%+47z=&^z4xL`<%!l9$%eqy4@~w&~l%P?lwS^{B9JJuAr`t zKipInU-^90m?ZzF1~zUpz8oE%#8>sN2`T(V>G(>6OBv;kl4R`N}nf#5LSF23+le5>p1! z2k;Ewt9FDKwSz^kg$aOl)e%&bbKnSEzsgz!9dD@BWQr4g{e+AENnsGxV`MzNN$a)} zx@I2mtjM2dHqZ>kQ^0z%zN0FCUWI;BzSepa_HAJcH|=P4m!FPXnEF}E zvfIjJn8YGxRGLlFdu;OTZXjgJgP1n2f0-g3L5pQL>D}}dggsPA_C(FYu1&sBSh4G1 zr;KHrJCzdcF0mGgh*2Bg^pI%CtbHYVkaJ6{%kQHva{YzN1{$*nFMck|S8pyztmP7U zg%8|GvpZko!hAl1fHikc^-L-!3Mn!%ar{k|K1dfC{l zws8g7t|g{Hbgp|GfZo={Dl3>$>(Zuz&=R}`M>tmH5f;$Gv{tgzde6E^Mq9=XxA_v@ zFycYL_mxj`zKCroVb4l?(pz%PpU2z0Q}mq#gb=@$G`@2dtFf^eH?I>`ljoEyqafnU z0T(m7*GHcsZ6HzKJYz-y1u9T6qQU-BDBBsL_tB)kx2m&_LrmlJWU`@`vAs?H1+C=t zK||BX?zowNP+bHj*Z$FTjPu_sOi3;rI^D@|s{CzI@7j~pA;*`NLSFf?TJE8c!w$b#IG~W3|8_Jwphg;BDFs({j$;(|ZR<_EZEw31zX9<#P4e3%3z5pXaFx|&jH5X3nC9>?iA zsB9~{1#pjtM>E+It~A(@Wc%zhwIf*PnD5f#^&_0xlH9-y!rP!`f>goBr>I2YEWr1{;`<`xM-0wmZmcTd)9SQ*?uku%VxrRL?%vg`xeRR z=kuLbP?R_9OHaI?<5}8)5;QYUCWI5A73-#wn^A@{D%l&wUp7aT3|keKAhWTt5%|=% zh-Nu`eI;{i|NV9Ms1G{|=;*ga(`Hz!mh|Qha@gLYE(RuG(?~du^p-N6Lj_wl9#<(3 zL-hPNt@j-V{dbp&LgzVMD<&2+bEE6y6;MdS1OXT+V?Wiy1>qEzgoha%v3&e8KRY`X zu`d*$WoZt!v`+hr@s-ne{TUDZ0khCl(Ul9i^<8t~FSzup%}GxD;ggKgK&$rcWVse2 zF)-0inw$^)noQ0+ThG6w^6fMaKC@(9W51=8iVI%t$P zUG29(*ye6X@Ozpf>6VW5-}(0ntfM^I=NinU-5WmSsG&%E??~|Wppn?*{EWteo@FqB z_mjhvK2#y0p|k685(ox{_%DTp1)Vu&s9QNRP`rQKd7;(<^SI;M$O4M+T~>?fHC?M; zK^UBaV?$9eiA%a|6)^IC?buSY5!!#+`oV`|l7Ugb?yTQ{rOmPM$#~rUY`zPAIcz=} z^6U86@e=kqKqPe584|kop?o1=Up+@nJ$s~|Z{9$?;qSD;cmA0w|4WdqdzMJKg5JhS z)CsOX&Z$V+o{$0u)ThJ3*8nbtzAf*%@py=kR;SYc?+V%F4>)mpokVQJr2& zAGSH88tmrF0&(o0Z8w|w>jKg#r)lUT%Jk~36oVjc957Yw~ouIqt2C_&!0 z2HfG_8(-drAlVj|&2@B0!q&Hpwc?pF89QN}#vMKl_!U5o)At|z`|xDf@1bCAnryCc z3D}VGFimwcfoN8_Lj;OXZ1IRqaaK{jDy(TtGk@>b{8vBv`Yq?e$SUp5G)z>WA);}) z`y*gbiKKMtDWqc~gnY(r_({##w}L<#G@i%_WIC0BW9S{R1kf&No$&^x_W~6+CZT= zT8!xVC!*QkFzP6j9UNC7k0}`3oa;R!RUK+Eztw9FvC7G#^Tg^sn7pSKYgSLb=1@gV zcv_y6C7xqr9cd}sJD%TR3!M0v=IXsK%0YHRKFhZ3OxuyF1uu)9S*ByMs6KfjP z0ww;HcJI1j1+aGiP6U#JfVP24Fh0}$YYe}VYG!R#`&^5Lo>4q^htp=iFnR(TF2h9d zvMcVvnA#AbPl75|bS&dp&$|@8(f7o|XebQO>z0{Ox$`d|Lrcci=35z6aNke04M6Jn z+Gj4{k)5%WogIr@a20_uM+6~8EfDlIbMS{#nG0LDEx)IrTyV~Y!i?$WT0Gri^6-!e zUvmBr5ha6`jW^9|>yYbM|BHh7MlNc>?L_rNPOD|^>G2|S%_1+zIFo0h5U@n!xOp=s zzKJWx#mer~vaRLA3_I0D{%#~H^lp6mo1uimXUietowNbf75B>APx3Oo-cT?ojoj`s z+_fc@CRLNbU+8p%jSypdIac$~_Sby0ZtJwJ<)$lJ0P3IT;_$Or$YIdLlHMT+k1-}Y zN4kx3>qe8v?0$qLfT`O`JdQ3zBuq)c z_&M+W)-blVn%w14zz$E&P#ZVP7gQ^k+58z&vraIK(wH&Mq0HGbTt$=^yHi*`*SDh+ zpIek<6`ec2jL|B3_qecT|fEm9rog`?BDA?IMIv@eoKhv1P&MSISAuS{84SyjbdnV(s~jXz2wprz~yuHIQJFZy`}CpmN(akHt7 z3s59l%xOJ1w^MG~Z z`hUG{hlp9MJuf)=4%fhFQnP%n5bP`{dgK5=l`7N@W@K-v6DKc&LTp)RglrL|`wHE&4jZhqG4QIXb`99i|+Qn3JX;f zht^Z%#DhhVWy>3T(Y@NYn_xl&qZLx7@#Tj&+?|*>1OMQc`a?c(CMMmZ4zK- z;HQheCz7CQykqdO_^TDtipF~UTaepDp=(RZW=G^(W2kRxi9gmrfet{z$W|*`PUwyRGJSVs7FtPF{ia?qk;2Trh^0H?e0lQ6u8QpzejoLP zz=duD!XPmnNtAd`VR4b4+Z~iV-@d~~l!fpAa5+!n7x2e0_;0oK>1J)Zv_*uqOH^OJ zkT`UdGv7W(2r*O%jhoum5+v(6QUJt1 z*ypeC*^}WfX#RnKyZdU>5Rn9w8;gq#+yJj(38cD}#n;C6!Q95PgXW$}=NUQqVBohu z!pdj3zVGtU-G(G{d=*Wj8bI~#;gdlMK1`^$X~pN+EORFcYhs(5J0e&Z>p1dU&PhM< zjo{&07B{*ESaqg9H2F+&X5Bh_BZ655SyPF6-PAIJ>{-bS_`)&hdiH+I?Meg8B6U+q zYU{S7{GK!X)j2E$w^Sx?My2*=a7^}(K24D<`y5oDR9W?BsD`PZ4d}D6&5evYXH0)) z$bHG^0TVRt`_eI8aP{Y~JUeA%+^i+$RE#)Eu|icj)v&r%GkTa^A|Q1~73&_D9?=DC z{rq-^@~d{ozUDAgILA{QQ}>Sk`(MyZ$gjPgHNK;;{$D2%;btxn%(eR+fh6q0sZ*{9 zMHJ>n5{2I~$Ud(pSTT3r5re=$pB_b16&ea>$ku5X6n?mv zj&%H;Dc32)=Fl(cG7fYc=;eBBBbB(b56Ouh&1OgC?@9)>I15jttJ+&6cb&kLYN`ym z2s5m}UZ#7m8F3Aqv{CEj-21_3e-qdCz7WTsrCE(D#zwtDiYWtUnP^v{=O5NWsPnnV zGQPiUcAz44k{Ll~IN?%?^LJFDt&@BdOzCO4;Gd01<)am)Mhrn|fKBrq^gwRGsLZeZ z75z&!N2n6J&K=w3T`g|5w33I$_c}e`b&EefeZFc@AzNN7^h{+jnhwr+OM%6YSKnRp zNkvZS@ril3n`pdYf!7aaIrpGzmhz6jyH^+&c;&!-lU|4CPrrT=)Hv{DHOTN$rA*ax zD8v%6XqDJ>^y_G$qM?ll=Xr^LV5_tXowW&cB;#UMNH|=O?w#a*i17CDy`2idH!da2 zC(e`EFlG-N7c-=Vbu_Uq{Q#I999q`Z2Koxe$oL^mM%=i7jtP3Fy41k zzT|J?iis%|03O}+Yhj;PD6u-v+c=RD5D0|>$lfzF=PV|Sszbf^j2WpJvfR{EUvx|m ze&V^ux6<+uLY?BAOB@Rmomd(_QVVk}_N&!wSp3xa!CpOZE;w!3TL>X&kI{V5^Ptj# z2k&?9j+r6*basdI%;XZ|#(;vv!*yBFO1T$wT}@GVQQAhnH^7rAoS+(=_eDK!sCS$` z;k_zG*RAs#4oJ4h$1kL#U>Qu6in5R45c39$+`YeH=XIbh&z*>VM=U z5;W~&YL|4eTpW4BY9rV$0eKV(S|}XSomtz!_J<=U*_OPH5GJ+qBA&rayqe{q_5DSI zv@-oeIg=LXcrhlXi2bh|c3klrlhsbDJXZ?utvI5GB@+6N$UZ`;CKD=52!6ow5C)%}_ydo8Q#%Q#1pA*mf$@Ip2A7Kkc5q zjQ&s$g?CVk2MR~y$XA*?EN53Mx~`us)5b%cue5B1zC_EQd~D_ZmeiYi(;|=&EX{RA z48KR{>ByGpW)EWq{X}JG#h4_$_VBhcI_cb$=li)sW(1Ley)g#-M(40quQ+|pcXPws_9L0};)Th@R*WU^ajxoasZ5Et>)lD-=%Y*n!2B4UmNeouMsn`ZnGI%tK#-^?lr zn&76cvy9A=8?YR8J^O`(%czguG-8uapm~>e+p{yhYTM9@ zp%b?~!9c&sSrfvaYO8F`o@^$*DfqR5n9)OUN}~rQ=v?*Sd+UzyIkpk%xhy0JCqpX3 zkczhrn1JDiVa85Gf+=z^672rkwYGe9dn9G^NiH;Rh!tTMTkx2}ty%x^j)&EtG>dKe zl-c*Q2XTj)BTv@6nZe99m24%N(JNabt$HCY*CPCWgsU6CM2_Xxgpixf$2g|-X)TK- z5jfWNIsXwc)R#S_LH(5_65{{0zk-eY-}d#-c`-ll>doSjnfbHTHw;5aoXPQ>D!Y?k z=-MbUefCR*me`RuC;buHaLP<`gZ&~mVq!SpLxpKpe6xf7v!wyFiLHw_NmCznk}R#b z)?~Yks;ZaN-gk&6**CJSU_wbMLna;7qf;f&E{vh%6WM zU{#N|90qQaGPaO!61`tWQVjgrc|Rl>7iF4QD!QkAP93qgIp>6^AMy{Jxf&OCQgxn5;LWsMfvBkMO%Q1SoR;m@_DLz5IPFLtxXh>yB~Rw#4aEJTc>nWqJ6@h0!3m(Rld5|l_VmU@t#8L+GKyX~;iwcY=qWt` zgE5rMSs_X8pxK{f&J4q?38#I|0s(L8wz9SC&5}9ig9S4_jE&`maAaLOT-s3H06yrv zgeD-|LX<89Pndx$KbZoVnx(egOhenGMH)&)!X}RSLnAyWN2&c$->c{%W8P@INFZKI zAl{wM+Nb-Xvwl@vS203aw|m9APJ)&_E>ake&P3QVfMz5VMB3zXwP;m9fiRKQR9`HP zIy9{mF~dh0n|kOR08zv&w+3dGjV+5#N+RGd6Z<{QGCtEbksIS!o}@+TIO@!>+K?Qw z<3PhEDI$W5RN_s9SzchO;Y;e{S zM^b+6M%0)0f%i4Be)e)r9oxzJ)d=I#VlD5b#AXzaYuPs8)g16_X#J>#rYdU_3m}6WJ5)VR6(GCD{zOSp!qU!>S{$E>P6;MUjwyn}2os!a>(%m54 zCEd9NHeJ#kiqhTPjf8AUiA{HROM~<`==1(ZKSv%6vS!VSJFYM@`qfg=s#jIKaO6m( zZq22uZ^?hxJUh1Dt1%bc5;b$6sd-se)uC4rKQ`WnL(A=|MOl}^{oPr5TuY#I)b?FE zz1#0a-N^?$CLNWl9SX#TNW=?{>dBcO<6x=A;Yha+58{g_5Ruau5_AP#E#VdG8&ear z$!EY&?af%0_iw(-0y#UBPGchgHM*{zb&Df>_9f1I$<4=y_<6Z$#0NE;eoJuCnv~xH zO0*?d2ls(ikk`!OTYafK_lG*HSD~-0*|0v*L?{j&zXN#k6PQsn8z`)G3!`Z0gb%I^ zm)UqsEWO;pm)F-x4=spb7(6N+DN8}dBU+y-`=wUgm51N%gIdPb5NS6ks2DEt%~kiv zs9tiPC(zZwbrq35Lx%VSw7xY?kLa}(xNgwWRiA-;jEb~RGx0I}4m13S=X0?qaPkrT ziP&h)j|?rej!1mZ-O{xr{UjtW%<}Tfjd<*;S$Y0I5)&nWDl%&9%eAU~*6ID@y9O;=cr&+TazXp&3HY>+K(u9xR%2rfkee$AnBumcdO+^gr`CK2N zj1b|x-XP1k`Yjug*Vuy+KHgNr8ahH&FD=<0`p4<-lrq`crV-Zw9D)0p43G^pfS?81 z$nM;3<5&`%^k%s9qdGOE_1B+qkDViQk$nqQHaWxR=^Np8i~mV;9on?9Saq{Rtc>C9zCv58pQ+iSG!Ya6&G)E=F- zUxcvwyaZ~f)DB582ZwPfHjzg~H>Yu*1oMQf7RBhk^>EEy2frP%U?RMyuW9}k5E3)2 z1CdshfiqNE$`Jjcl+utqb$iR*qxOqFI*}D!b8xSof?S9I zywTnKOk``7t7h$ZZ-8E8KF&7n9u7VhTA1b4+>j}^#|L9Z6GF>1Y1PL;3pTvceF7^z zb)7evbnA}X5ZPb&?YmMI4)?Y5uC3j91D}>RPx2SUqRvy&&PE+tntp}55oz6|O{}M{ zn-{`))f_8cQ8~hTHz2}OgWM`5(qP>m$vihPEz;=V=hrO>9}UiT=%x$R_X6c}M*U5V z1fW0YLQU%?(203fCLdsPbeISQvFl{xu^MzZNleh~W46d%OZ-xf$Yick+l|`mWXhPW@|PBKPFmuPz!U>hyjW(%Vhg?8u^{g-EZ0TWd?Vb!#HvfVLC-XteT@z17&` zJB9-lBo?LF>gknu5L!hDGCwd@T=`qgvZ-CKCD$3vEvMj=u%MpEQ*oj!l7{Nq?w5|e zqF;vKZ*0X^Iy|}iTvp9(r4RACUDP{Y&pI+8PW9w=U7K@7NSm#TvG#_6%BqGg2Fzmt z-UppBobOn!R52%x+z?FRR)K!v=M?{LWgQ_#cXPtBooS?8<>-sIU!qHpazhoM8W65i z2i8@9Tb?Gw%xPw|hBpBd4_ePbpIr*SAPGk_T~XH z#D<+1$o!$PSc3fza(&DJA;_x zu_R2(sr}R-YGdiVcWwg$x2m65$3#HiGJPaukX~0i;L@s!;lcUja>*YBHwYAQ1zBHPWy=crb+Ch z7kjXHPHH%-#fnl*?oC6LZ^hZBc5AW33SXLf)a7UV?`kRo1032~&s8-1hvq;wgCWB7 z`Ndt^*E-VC$P?xc3#R4%aeY5(KQ73E-<#Eue+%DQtemC(k(;H>P>@>5%k^C1&&29% zc)dZK;&W2*(YMSr&IH%I0ifF2Y3aCfbJRFmRh z_W0a=%QBBZ= zx-1fk*xM`guy&(snJkj0QF#`#J9Y=D$8S9QInjUfUR+%zTBM0PIXWhHvHG2&5CgOs z%^Cv7I|VL!_|DFIA(>v$C=?Xx-m{^1BdY*Pkl9<9UudU(Ol1=fMTC{*`(bT-)*ukl z8D5|b0Vsm8H#Wt%+hjDTkNLXUMebQa8}E+G(kjwJ@n%yQ-ht*9nf7ZJ*seVYi5jFY!EMo6IRvGO@x^`+5YX|R6ZGYHz%;=D{S}Q-+ zmYRsvo<`*KND6L0<&DICRMmFZcC zb=%uUYWe57XG+fRH%D$04nfn0*n~ATtz%HzskF~Y5ZSj`shnJ$`fJiUQDt|~PtLLR zxy5Dz=5BZPoOj6WGv5O<@eV+V*h_p9@Ty zTxpGPelJHR)xex7KaSBm{b?*W5BRPIYU4G@XBc;FvOKR&a(sl(T`UY_779_(;!x}$ zN=zR{EBz2cfpyv(ugXwf&T;m2>SG_960Tk~FZ-3q)47P|Qx6b}YMp^G<*XWs3f7tRqX_~uxPd-MR?)Z(8L@TG+It_tGT-i5zV%ofxbu}ew>4H5jyM|v>mAo1^_Tv*RibaRmni{hqbo3T|EI=t zVA(5{3=AmP>Y;k9#`3sd7y=k%hBe_OO^Nvwf~r3)BfgcpJHto?4e;%EPe5P#!x;v( z*65qCpD;!{=THG<->OmZUz#wFzBRLu46}~J`;N68@+gi1t(A(#B4^Z>_uAS-#kewd|rb^v;9y(A zxk(S8mQ{h81Z1+Gb15Zl8}*@H7ygq!t76QQ?+l#QY#wGUG1ugLh&0_E+{;&f7MGVj zfj>yYl(?x?LF)p4cS&bWD-_T~PXF-F^^uThj)s<6^JTwn-cGd}sAbN%b?oSKKwU%%eQ6_Hz?cEeU=RmhYYE zW3-#+Pd6H+sn8O)zYK>BYh<`Kx9t)h$Y=3ryCGZf)urC%kv-5En3%T_i1=99wj`<( z>5io;;#b5 z5}asTj~bY;$e8=hSTSbtgXw3CUG33}5m@~xG1FJBtwOAt*3jJMVN#E-9Cx+pQih+JF0D+){K8VFAbU$P znb@ycU1z-3ER-I`$3S;4j>DwKvOB2V`{d^jVJ1fp<0#qy$;eOow*fm}nVO1}i>u0h-)5)POHBjc?=)mwLp&XGg9@Y`io@{{*%+@hXX71tLi!<-C|TBi6BLSBoBu+sKG zxd|xcKNvE1cY4qNwC+z+9Bq045U5hRq>OM5v=@`wgb@z7g+Wr_q6QBoxC}|iI}vgR zZgA`;dixmH)|F;88=$W&@g!peD)PxO4;0TU*;})>pRBDbdKL0$7AF)M#nOrhQ1!lLC+U+J6%h^$7)5-Q!yX+Hh#1-(E(L&|v?(%P8DjsDYbFYl)Q|WS zHWFmv_t-MG3+8$y zE{x1ewwLef`jR3gyxXkK#K(tV#pBA5H;}zN@~)bHyZ6f}JaL9?k7d1aR0S&S9R50$ zl|bXks-geJ5=!;2vA~2z{(7nmN13mPA>9P8<4mXsfm1??msEm@R6-C>0)lbWIu$aO z*&kzjg{O5oJO!@ft>VgoTG-Q+O-5!V;Z-|JP9c3gpKj{FbzgLn=?ziiTOoSxui099 z?P?gmy8{?a+T$2`wl~{vJaw7Ns5`$iw0m`jnu{ef;0;qhUjlZGO}p*mzWd7JouJkVMp|_@p1+m^9HK$B3og3xb3nL-md>~>5i~= z^P0+8-V0dR3tm_Y9{d#~L0vve;^ykV6w9_w5Fx`BA8kyGbRpC4WNiK-OeS=ch_Js{ zC^mc|v>7H`U`}%1pK(hC<}=nQuiDEQy0I=Xa>%XEJ#q#^*T$}q5}*V`C`00^p@_C+${vB*QP6j!guh+C z0#qt(7EGy)Yx1=Uhmjj%-h+?X2_+*MdeSm487bO1m#f=gpz!nh14a#;jm6^v`i4Hf zJ3*cze|Yhh{5xz|Jn;fME`QmxM1M^G882$&MQ@g2mvG&A+^*9E63X;8AH(co!x=y>MHDU(B?Sh zxq9;5_`JpVx@GmEW$ny!_1b%Ec{W<{XwdQYEXHGN9hJ8V#06Dmg3NVa@>*4+?Oe{R zrFR>qd(B2{c-iaBq=^p75??AR?(Qm^be|;*ESoBjRk(Ubyi=nF&vk!D0IK%0oq4#10S*~PR{*XmKNVIxEd?-<#5GgXO=NThg(jg zi7RnRY2RbebmcZo5DI3ADyK~ZZE#FC;v_b)^yrRB&)zRba!0XT@T|3TkTf^kwWKew zk);~3M00Ee534H+xsIpLiaQeRWPN(f2Q;y=Zld+{m~nrzIpX@0trCj~VRJS$u2Hl4 zzA^M%vvcYER0>4J#PmQZ{9-Cx%3C8c`&*Dp-!YVRVkCgP1{bLSpLWPdL*DC`B9f9MhW5f z&+%GnK%lOyEgH_}@n%Q!wS5JmD;^PVt>4x_LNdz9$3vj?C;)0+3$;OaXK>F#_*zZC z@#Fx5YmN4X8S;NTFAvRYZ{g5%q0|i+QNgyUOQmN8Is-T;0)O_<&804V zkG;tZfr3owzGXu>!k~6VA0xCA@wk0`qxnqUs5?yLl#iH{ugsB3TP$NHLEJ-55{(i?#)H)p+M}R3~xTHZs4NaZOHqDrr&(3 zQ*O{f3{>FxhI4GK)lj`hE7(fox#@qucIGM^PsC$!I&arv40P=1&V=PQJ%1R9dz#W9DQ1%HR^giNSb$OXy?~3*T*e@ler%?ouCy_IPayq0@PZTML<7xGCKu!TG9PZf}|ew%QKx7 z&g=}&Q_~Or6sXZ_RqBSF8$H1LT+|ssiaP#i>fdHQ^`unsD$fN5n&mmp+w0V4qsCmi z%K6XS_?+Ce?Q{0JX8;sLTfs0`?ywlIW6yF zk}cb4v{|C}avE6rXiE#7txj5YGSyELwm=m5CsykiO(WDG;Y^heDmZny&}CRHJ^F8D zmgKvRsqH{>iP8jq6dU28Zn9u|%$SHXxEo*BM`uj|Ccn z7>+k1qF>l|&s{&k@?@M4GF{_VCa=^!(YHMq@vJBJ5{-FUHl7qTo3Y$V&h2)eA}V!U zBls_cgoU9Q1F8btlUBm3e733YY0HBZac{S13Fn}!ht7qVlU$tZ&De&)*h>6whT)AOXH0SL7l*POi%p~ zK~5)rvv!vRNe@%@S;wC3@coYEsjqtXEH)4j5D-tck^famEsNP+Cj($}o96h2WnCs2 z`SAf-MZy+)CbeoMRm@T>8{T~Fb<^OD;bWdF9VgnO(|)r4qo$S0Kx{M;e$FEYCu%SL zv0lhM6|dN3`le41paExb(f@SnqApLA$nwEpt%$cNqR(u$_S((mcu`TxVA=s}M|=TA zt|EN#5e6;h!q{_zLcew0BYm-zn6{}>G-x8oO2+&2#}DCquraG&!xR0VbkbmojXzap zBmD_Pg_%-9iQ)84k3*||<@S1!zCm}Vy~9tTBlf&P2X5ui6M0vLlSXx2&=x)yW7b4K z?qx=jLFkXsw|)<4E7=ZXYU!>}&s|nJ5JvY9oFd_GB(;8mLmtw4SoE<$2ee9i$u539LzQv^&QDa%n zDI|9sVkP`GS62e`n7m&*eW49@)oz!z)I)m?`D|9=FVOXGRs%#B$+AYih$K0&Nq%n$ zaN!mo`+=KSl<6hcn|#_{4HO6t7n;y(bQG3CP5s^Iep8KWL;EJMm3UuPR8**Yy{;5= z#5!xTY8JZomKoP3qu@I0@ zO7?@6$8s1%ntrpP@rh&O{xbY)JI5@+xbZ%A_~hoSVRIkusbiK%RQ~nT)zEwSdwagC zSu@SAT<#!Vo0O0@9ewH#-es<{Gu>HPRZ><~MP5RGTDq@EwOL{``5y0mnE&XW1AJuy zKs{nH`1oP&tYdZMO_cOR$cl19vznS6F@G~cx5Qq?nmo6weTxG}05ra30DcptZLN4% z)2kGmblh?Bq7qFwO7i-xag(NKJ`5UB0sm^Xz$pG387e_!-X$HQ&KH+TO{LBVo+(QK zA&+<-M=a6(K*S4olCZ(@qkkrgd(Z3$4c>7%sA=`)2YI=@em<-mJP204pB9~PahfdMUY4ps_Y8c7 zIbSM$aR`%$6CctTXozga+GZiucPwJuowp!OB4TM$Z@`#h+jUzED9AlYF+@~86rr7JAa~cW0dk7_B%}%b86f^@n_NFmQt7vx(I`o-t7oo7 zt3z;eFyTLqIfFlZ|9+CP^B4eV#%N8ks;sBSrHLXhZ3H#%T)1yoILuL|rZ^~ii?gra zfB#O_C!m%2qLXrBYorv7(MWwQh|EKz@(GGM`>7fI)BS-68yiO{YR`LWOw=&f?~ybE zQ#Dw-UKZ)E^pTtlzNN)Y+29L;l4`3@+G?w*un=WT5oI6@*cl1D1(zfBCLxqtAB4hgcpXs!nJa!?P^U(MM|vMZ^AGzL*eT3T#{ah+IR z{S#0~bmR?R5*Uy5UwB?&JziVuQImWkFhX!3q&!mPiK*R>~%3B+J!7GbFt0r zrMdFh<2 z4eryjr-qi;Pww~R5rfi}n0t$dfS$JgiHClvDfFd8d7`>wm=3-6)S2~sU+&FtgN1^H zjVgBlA^~q0jvfx;q`O_9eX5rEr*@UKQ!oRPQnEEdx7jz-}L}Eh=xc% zKY=Jj@Lwev1BGck3Gj|eabRX+OYk`)T z>sE{(2njYo1rHIP_yOCYe3V zHmSerJsfG( za&}>>{A@JAb!<)R`P9@0q%8?<;$pTP0#UPl7iwkDykQF}Jgw_lzpJpCQ6VAuNm0&V zFj*^H+|^NEY9X~=k1Py#?R8Pa8*>G9OpoTYEh z8{?Ih4jo&Wi8}qF$}0$x#A2WHPS^QvkHo$2=fxdy29!md>k-4tVW<>Hn zEA#~GDSm9R2fB@EXG@^m*X0YZ1BAJ;UL;_f&=CA zxYB4&eW)ule-?80n7(*_p0|ryJbfpnPG8@AQ0-lhU*)%%)O=iDqHKQW{lwC?QS;Q@ zwTdy#&8!MZ==#&yU>MddWS>suP%$>DlOIC;`)6 zXx($zr!+NMg5pfwQy1Lw!E=zyq!RV+Jxx4f2m~=y9I?bi>`j~}6_z^g3EjxSlru9o zW2{GfVj@oNT6m-zv84~i1|Erj|Cb+M%Cy(R8|)H37qab`u_rB5*AXaY-4KdYpk`}1 zff{PUE2N%g1xr*p`#*Ljxb5^+>bQkiAmj%Y7P?FqN!}<-v-IUkpKNFig4I7}Z zPZ+qD?9@)LL`pK`l&&BV85g}(?!gR)J>A?p?&_QFB|v`Nb$nTju(*Q%qg&aPoJ}y$ znkpYub@r3lhH(#IWsz6~(Y9}bl0G20#`U9Sg}uta1%Kxjq$B>NF_iGOh;2jzipm(J z#Z|;RQ@UM#dyat&&(0xO4iezteies3FyOp-dnsog7aPkUrYHt1ep)$m_E=O^&@lH1 zPrB?sUyVt;e^RET1YUnVAaGlc%+;wtJg{EI)}pXpDSsAklh)A@UhR?+P7zAeVybUp zY|krlgyK<$DlV|0O<-aq95w-3ruC>DczFp z)fdqb+74y2s%*j9IfaGfd@j8}2NT)|M(52uZ>cm$Iwa+*NQG0xwnm~jE?6QvitX>d zm_ul|FyCW_|LT_pMEgsqqHjiLJ|6lHa<$udiu*mbKG5sie!@G&zf#tbV(qia^p4xJ z|5W=BqVI&JE*Gs{1-+K;XYZ3F_zolQqgc8I7R2nv?p{KakvM620C4g%y}le~RcrNA z=E#j2$k1nU68w0o4PBZQ3>nA5{c#RFk=D5gO65oo_gqP;l_3f@E87386 zPHzO|(upAH3C@M(Y~70(+tOQt8BnaKq9XsZ?BEuV%^J9nD-1Q~LE<4CPNv#+Oq>`z z`9;njyiOcaH)jTfZ)&>b+<0}J`u{%p5DNiT%|?jQ#$hJlxZ;d3lAJt1yq)$^zZW~` zK}e_GT#7Gqr)?*lGPavY0DWyIs{ga#5K`Xs_VBvTb^+q~p4MJtiQ^w-*ZA6t?j<)iCJBy zYr0SqPCM+X^o#FR?|be4UZ?@Dkmf@aTTS!)w~&~vD!SCuWVadBX{Lk zGigFNPje_JMFUT3XaY4`j{^m+B@v1>QkmM1y+3PN*R5?7SEGU<;fqjHT!Th5Q>iHt zVr`LAv~tMKg90Yy_^LpQx2?whZ#klxCAotRH2V4NfZ*?a+SoaJ!ADOUyb9vDqlEwz z)3{=dB>iDcVFCFPh!4aeSt+gijYF&G%(&5omE~Da^?2p)FOxf&&LMog%`;`Xx|}Az)iuGw;=II~5W!*;F!expYew(p zJLRI<JGKI?6^|)bsMRZR2ch!>fGlPj|!P{&d#jb+G^0WtM&R z69FpA>ZTcYX(V3-lb{amr$maODLXoeP~b{{HJO$;5+w0PNjYos1FRuvU)XQ&Z86T| zS()|R3bUY{eE{{TH4Zoq@nrIYiRC;?W``{P=kp? z-)C~I;SIUu{_wv6v6Ur!)8zPz+o zZ^akTU*SZ+NzN@)hxl zRE)%d!#;eu;KMxUUmYvk4(-&(-cEfBaL7ov*sIL2i^GCq;|WMf)YtVj2fOEgkb}kL zEk{2a(rY&+MzdYt-aC4hA8A`&{?t+q!<)wl~cXJN~~J zK2Pdc29f{N7C+I27*^l_NyO`h4ex>hG zLwZe1$y=}zb`Ikpd!sMwad_f5UWD}nSe6xfzt3COG!wvz$ul?YjcZSm`s~n| zMQhk8*w$^X86wfk*I)~q2ph=aMgiOPTeeB`j|`EngGsr*YvNn%JPg~?Q;Qf|mRT)R zeetXus{gHDvOsE$5kMIcyChdT`PzXWwcP;o-q;oER4D8`vN`oKWv49p{9CGN&p`uy zPK5a@$`U$5!PVZIZU_IBko^9aRfEa5B{DRrfL3Z(*e(COyr7&Qg0yr!&FE(!GNJ>{ zfic zGbI=*dShl#S%N1Hq!-H~&Rtw67`F$;b4l(6|M*xJpEJHxU>D{mm86qol-KE{E#3Fz zROc!Rk3ICTfi8t+D}5}OB&``PAZ)Px4!oUAHl&b_G7(ZL{FFS>_vT?-g$~$ zzh1RhYh)&rcSdO;fmit@lJP8FcPl173o?_+E8g`6J5un{%n>^fR89ICPR`tDilZ>o z=TTA)jEjpYWwngKmg?%g&hpeCqtqBTT3drVIUe5u#+lu^{&^}I5`bhL#XGZ*54UDCGp?HOf*a;5SU+7I*qjPB0E@oXQOs zV{r!)=^0Td33SPMfIBWtq+)%MVZf6K^4IGvSWsOesx&i6O^lXU-HS*0!sS@TSE3G! zQQR}T`kmx$43SaDwadesPkJ^oK1Qs@BjKil?S+o-_aK5*8NHKOrMG$$9bn1>VuFU= zwFnxgu~l&<*GUt7{2dz;P=5WW;rbMz*ujHv!xkn@y-wNl@<0MlA*NQQ+U+s1G$Aa9 zO23AKUnL;xDGhPZsj(-4tg*qv!#gu<88+b)sV6T*%AOARJ^%!XM{SI?wqC$pken5|lb-=3fNyN9s z7I`XFB4sugO8b@JK#(AAb-e>GozOv|8j7afim4%QrRs)94HdF3E>llpceU^l3_rzS z++Hh>$i|fS$)y?EaBOKinVc~(E+&iJ1&^4vBU{L!MMO!~70GrY9sf!) z$yFEEZh2MLpPjCrBTp!k+lK;;(OA`n3c{8e27;eKNbpGavdgsUL}z zaZ&CY(apBup9kP(+UxP4%hw*hq)};iCXKLtCG^#fRQ*eYQW44}^DqJO1?A*KTmp(- zjqMFT^-zkLlF9PyY%=JP(|hQ=pjNi`-+Cy)h>{v!UmX1@rCyu+Y~IN1Kj@ii!=m7d zIS@xa{_8rk72#=VGHSL`LX_#9Q+<3*#9ZJKRUdN+v!xx%!;bxH64?-^o^b4sWQNG- z8<@Umis|oW^a~oSHNngai$#sU6u^D7YT-q+ftFjTGMK6mLHMw4IAvdfYY3kXQ;-{9{KznEnkFtZ`3h?niW zoRc{@Z50Y9K9q3gOy*fDIIM}#6$VFzYnL$dhaL-N_7Iq!gkm?lI3j8B5n?FaK><8P z)miGhiVz#d4KY1kaXpygsd3ZIRQ2SA49A%%lW>S2Z(#2*s?K-Ygx1*SoGMq)sMm+z zDdJ!33TqM>lk@V$bKJV-H1#W&ALrF5`@xaZ^xT{&xOWGXZ2Q|icxvN z*I^r;rKeVAP}62mS7n4eSzC;Kl$}BS`XT;(PdrjIHN@jmlt@Xr-mDD@&-1WdxX-7q zw}0=KunwUaF;*esHV=2sv#sO`vP}Rhpt&8(A+u@yk!>|y^J zDC848okUx!%h)ihzN!TT$Ml_MDwy|VdvVl$QNhQPw^=u%eSFO)DPZME`%| zN`Sd@Gj*X-N$eYyL%Nvq>MpKrRmoN_Mo9?B{pM|lleT%Fyc|N53Xid}5~jhHn@dmx zKmvY3<5?S|9Qvyps{@sspb``jYv!;OW*05|x0IOvl&eW}K&2OZsdozH+it8he+dA$x);XM-Y4Qo4 zV9q~#rciTa3G~O8v^kxn2OCL~eP>cxF({+Btm?!xAKjkoM{Kfc zJYLr{(?IzgCO>G$sW3%$BV0qiMw<*rZpr!YU~k`hdKlzvD<6FRFG6|y4JFb!5*+E0 z@wfE?i<=$)DgzH+&%oMK>~9NLoi>CaC-i1FFya1U@6(#)M=~@TaoG#F&yju3WqULN z^1=eqZZ-@XVpjF06eaeIl&2VmMEZg6Y6vJZsTRvKzc1~xdkDD`dayBUuX(&)0)~T$ zYIa#$zz|{K;h`gBB$1q^u6yP=M4NU`|6fSr?6|v1`WhXT!0LK;Ix!v|3pY1cuHf0q z#~`1vCrDg+jo$Q;sY4*e zzX3DAgi0p=^(IpxU*U6cdZc2I?8S|mi&Fx;3}1XQkSHM2`dP=+9Yj8P7YctmND{a4 zlqx;;F^U`-=|z{TJ;dyW2XGz+tY1$(B`J{q(&_bp{fNxc{Yxj@gr{srNt1rZOl@+8 zhlkRpY3)a5hOAUyjp-Q0vsgp3Br-VC38*(HJ>vWeejy6~C1peSnmz8ILWTigHW=af zLt3#k?WR8l4i+Fu<=l41cw{5egdyBI-7PEK_X-3GE%UBFbj!kZr#7{T)|<9^RiaZ9 z%7xYlA9f2+mYKNoe|Fr5BtzPAFx|2c!mf_QIe0^Hqqs~+5n(6K*?9a25dbA*{FG$n ziLuXlM+BF{yO6nAP_taMzih18-d|c-B zt=%y#J93q3K!~n}S3hHS9FKpB365fPk;~xxGKP)#!cIL+KY;56-gRUMY%pP6Ce?qL z)QzMJ7HW$@-96xg4eqPZNJ)r2co=F~Cje zX>_r7|Md$EW#FJh?oU0e{pUb7+@p?(jOdE&Vz!DIQf(4I{vZ+L;q!zhxbO*45h~4u zOyjs2>S}G&jPb0`ftr0Yt`!~W(eY9ul#U0)i2Lt0Egk-Au*hNe!)92F9dXl6G(^uP=y&)iwMLF=vbgDxfaZgrA#{SPyS>t`WQ4_H2 zaFbtJY8)kR;75dC%=cmJmzT=qsk){@01Ngq7&vcoRR_Go>ByEFuYZ}?+ev@kD!Fu1 za!dWoaM`R3Tvy7%F@0Sg4slPSjaiIo%K*?-iu`{eaEf_zUk_gi(j_H@ubXI>gAl>` zq7PdorRA7ILx)aCi<9?x&0m8Th!56IzNN= zcf@nm^slLE5)|WBR=7)EY-V_C{{@dZcm$OuPD-{)xVloUoB1<%T9}~9;vMXrX|w;0 zSqFNf*gyq+uUJZ1CYuzI*AUe5a?&g1#wABu`G3#+3?5Cz0Y;%2&qcdrG~*A{@Jcq( zbGSpigv-VM%k2@TXuim<{^-a+jE$R?gx;7>*6YUS5F0zD9_FK6S^q>+xDEAH}Z)U zc!U2rnhTPDkQt-(-na869eWpV5Cws#K(j?-;yFzf!`RlG5@aKyz}blrr3KDL?SrX{chQ4% z&^P_FlZ)JS%1X} z6_sv-4YQRu74aATd*SlNI@s;V86QJr7xi%zX4d+Se5aNromTsX+RlGdhu9$D=z|l6 z_FIgJu))wZ17wrZfW)kB0!49=2i-PkEug^NLawMOCjY&#t!VP~rP~MJ?a+*^$hlNI zVT0`$QJ&}gG4wa!qQpz_{~lCIJ|6Q0EZWaQJ!waoA1}(zkS?bi-QKwTH4q6@F-bNP z<{kYYn`|VMSiTuCc zE0|tfjFf=zr$Kw(_FFE!qp5!)mRm1ERFC#YGy$f`5A&kFF0U;AM0S z?3v~u65P%3dBqL5G+Z=mUSnL|wIc%0`bD;`J0=*z~3q>O=CR3IV>-i2bcUkW5BpteY*5TZ?m%1 z0OZWam1ldIec|r8D8!5PqOXLe8U3C)vQ=ev{+*SEEXbojm!5Te}Ol_x~k-H!4m42o05{ADHs8Uel>ofEYl-DcXW9q z0)C&~CRi6GWw6Jp**v#uU~}eGeBQx-S$2v%)nQWmDFX@>KJ#`_^@|HXJ0pM9eui3z zv(K6qY21YD9_iLJ2=l%BWz|ekCAdW>zW?ue0r@r->@Jys7A7G}gB8C2N)QW8X_JJN z>gN;C3%9u_#{fpiI?Hnq=v(J!Jk@Ufnw|CU%!wA#x1wNo`!LQYP?cZ6%hDxq<+OA#o`52R3xGr3@$^^S=LDb6AUW?z8WG?{e*H?}>Y^tx9x{_8tHLAW~OT(gOf6&jA3SA|4L_CXGIpuPigAY{CC<2e`qQyfB=t00G< zsI8#yrOrwV^c3o8^y^6QtB^u8@vNmya~pNJi}c;7{}J^2vri39bgrYm1nLlJr240? zmonSgE93MKE}WjJR9k>6P#Akmqr(m7A-R0(9u>($B6<2yrOQR7OP6RXntwh{T$w`Gl}X5dG0IkRQKu1$+g}Vp+Y@gAtF4gbE25{fJEFk#G%Zu5(ob* zmPj%f3fBS14L6OX=HAy2F`gX|#RQrGEb9*pM*rMHs82T-7D5&32CPm-*k-nV>y|y= z!L@u8>g2&A`B(f*%Q_>f3on$|#Ct1@n5dwG;yDX0)$NKh>Hib@AGx{axCyQy;^uN! zR#r?8kAj9XBhPTKhf{CkUIXzzv?U>UoP z1O1l8y1EqNcK|cuRa!t0tIXehTV>K36RZXS@&H^Z2wPey-UC)m0zea>87Oa$UijZV zY2E|;031t(E~@F2e(vs;eT)FS!41^}^eTfN|3}g2pJ%;;4InhcVSWE*_aG{ z;3EF&EAZj}zVP7&)^Qc@F*W+hBy87W&M`F_T+68Ie%TmhnZGY2qDZRtr@}Dic46k| zt*ay9a~P~){)It9yZimGNIj9M%=J`P`ZFq8v6fa$tzv@8+uJ}I`v18@>Fu|AQ4?Ml zc8)>x8vHqc>xX68&t?973n8nJ$&7~F(0m*|8Sg>FQ^`WF?@!E4bdjz1E|i!#+6@NAQ`iy{{4R>#e^Arh%|7*T8pTz4#N2OO*2!MWG&M2 z?|$%kifsAL0a^QoDZl)b-HBp^O~9BJ6!Lj$I+1@jU7GrZvC9r1ssv^k$5TD1QuLLXXo%Zswg#At)YuFKy3TF z6T|;JU6>(M@54$oP*+FIhLH)h6bt9NNdl4K}5=|VpOwBr#< ze|KP&Dft<@%NDROrsnj66qNwD9x2TID>_H%F0)Hp!nm4KV)rs&RRmxGP(yp+f1d@v z|Hnij!=E6!Tf3HE>j!HD3r1m9-^`r=FUN_t%~Y$wl7*0!db>gx@p} zUAI8lvN(7C$2w>@4t8u$5gBy#{IAM?`N!3>u3!FtPgDNDd4nH%Pgs!Fy0=3jwC{hk zNkh3kY?3N$6H!=zj}irZz@VYojr-Ri1a$}GUp^7#vN?-pJCFigV9LY(ceimStwYI| z#msbAL?!(lQlTrr2DGX(`_)^Pq7^l<<9XA$8eSB3zgBJud?IyF?qzIMFZKMWuIr$o zXYEZlkTY9*WkX^uGCEjZgmy=mw%5fg7WUw6{y1~kQKKZ=exlkGU2jk+Gw^{s{@`P_ z?tGWJ+=qWonp`UxK!a(?W1SuS@BoF8Nsy0@WZlAnuY9C5s_p5UK5RU=qev)c~+%rZ+-7E z`TNwhsUkzO$0obv;|5uwQ@w1CjYDjIEg@BccvTDFLfX^YTE|4VDhAj^>w8j=yCL(f z!=oN|O$ncL>ebLMWZ1tn(y|^EOz-DU@2@q?$zV0pem30D8Ea!!fJ=f%PbTgdSwI`b zHs-2>18S-gz21N%5P@TZwRWqxOugR3m>GG@PxlH(n~5TPLdV<>VQE;-jNks8PEsxl zzyWwcAf&-dfGPm|0-{Y-DKk1^X}7nwKJWm-MMiqbkRCPYYqIJEFd-XZkpoTa$v!=O ztZk8kL3Vb82rSFUH%j)73%Qh!fw2G>n3F2P`nhv-b^%`PvfQMtn^<0tOAFsm$IfW8 zN^*)R_&D3=fCT=Sv(v-0p;T0Qtb(=S?ECj?fdD782FOtqrq5<|KctMX54;&Ph?gnV zyXTj1S>as`*cDHD22ngXu9+Q_qT9TL9zi%B5iBKrO(?;D>`1%V1V1;2{D)Wu_C}JHu z5nd%DCPZH9_&aYug%!*bB1CNqjo!~RhK&D-s2u0wKuZJOmaTzzb#Azp5}~61$Y4re z$<-epj%jSo z2*R?nHBcGbDHSWwG^wAnA-jAk8Gm7P-je)2FQeZwltYL(Vm-^!G4KhY_Uo`8n^Pts zOn=;hBU&8Gk|q>07HF+JE0+F@P*NGpqIICOEk?0z?S3m;Eg-{8zu`@*{xty)`VIs+ z(Q3=+4b0cQs&qnX+_b+dgF}LHELf&Err8fkWIk%NcDnJko$o6D#mL$|7 zrx4D)lOD7ONmo6J0_=E?*_Esj29al%xic3I53+I9Zbic)mBhwo}OFzk27c2eOhchtq&~|dzS_hsCZ^Bv%k~FI(>4a24yKt zx2fdCo?1*)w7_?vs(e{1{noAf|rS zx>t~A;t$7|vG$Tf{K16>GCqb z%0rTkQ~)-@qqxkzXD0+tou(txeNE%BNc1Z4^_MlsQJK`z06ctxVAS$Ym#_ENZ-p@q4%_*=am? zZa}A-f`Ck=_E;O12c-f8&pG5~XWFJp?@p%hcV$C>f7=W1>gKO3zo)I2(k1dWT8uzU zF!$G_kk?;0zw+#3AqvYltmQrQwM4#t%M_iem^eecT>Mkde2&%E{(cA4RS~|23I^Q1 zeRfLI-}k%y=HhC{p8m@xC0h{RPKhIwtRO~p9=e%e^o#-84%K)ZBtjabGk#coe*I|y z=05{7aKa{{i8IYCwX9&#QJ+o?-sArSnatTDj4nLD9ZP(ys8t^JDic8BpCBXiN5PaI7j zo#mqSh2yvEjp&#-f_BvMYY6BaZ29|-nC5&EI79}zPC+VN!W5j+Gt%Q-*6ZCB?8O?? zhTmFHZ=p8tP=C>pZoe!56R^pw5zAqvV>i(WprQW9>lEUq6X#T$R=3+_Dt)|<)PlyY z#@n!tB&ztnCuVJ2#j$-GlW3XX#q|7 zM*Y8&ix;Bu&)MhGQy16g9Z-^;PRP9v0Y@k1qZWo$aM#3b?j0G62fJpY8Ckgz^;!KM zLjq|WeE1tr=GQBGf9^~)qz@oN|8+W6Y3x-6CEz&A!RUL`^r`BVigrf}#tP$HBzqKY z!MK`-Ip+~Osle6f`!S?PtC93cn(WzaA!6D4IJfacV_$OA#_aoX@ZOG0UxR5~o6D+Q z0i;4@423qU$Ni^jZAh{cS!^hhKB#Oe0KK)FLL2#MD)8;z&XT8Zr)aI6Cd>zdjn$f{ z5K~<3wU|3gO5JdT2~B?I1Bi*3-#&q0{3mR4?76EXd;|&Oq4)tWFx3*!KxXi_(Je60 z&kr;HfXZkd>LH+fxFmu=d!XSw>{9I;%LE_MC92k*J|X}i=@v$4o8seD!#mLpg0onOATFw$oTBH9Sxm<)i8 zw~d@&?5aYvtsoUlP?IqfTot}>*rCAy9c>6WV~MJi$tAIoPH6}*N&_X&4-aq`TI7Hr zKC?z;8!%A~NKL(8q3kq%(s<~P(vQsxW2EGsSAKyIq;HJU zmY=4f1P4y{R4qz^a-8%0_#fo~ngo%F^9hH)CkP9u)6=8LQ+*!?Pfd@A1HHW7FMic#sK`)i ziv8h&q1FabA47@HJb7%6Y6wuCLhY#vA{Fx-2fd@cpDQGOuUDU-8c!Yw@8F2?MyFh>Pj!bDyWGKMn_`G%e(?|m~`PfV<@do z$Po=V=}eO5%f#^;MI){65-(dt6aKIz9IfAR#|XN{`yU>Nc#L)mt#t^J`x6^b*!16u z%sMU7cLn#C|R25)!s@hd$3e7iyjY~PF`oPZS6A44KS2V8#;01LZj30{5=sY4d?VV-yT(4qyxngY8H(jbGebA!+q)bCjYMx{iCYV zrGV0zfSGnrOBF?BDI@ROzFt6m!eztRAr8^nAE?g{YVIthS1XdDaE-8x}X=q)nc_i zPp!%H4vbNQ!mhO1jIe?psv|{8mI7wR1K6qpnwN}3`aP2l8LWJrObz+kcxTN?!I!pu z7utL~OLM?rmUF|ae^5mg9!D7i>Xp5*t9{pN>}=vtr8Z_D1JQ|NiH_1cP>Pp1{SR#^ z;!KUtrP54-Mrz3s(c<#dF<-$&TtN@N@tdzOCmMJ`S5lJX}`*wP<_F^=y)l!MVVF&25#17IY8^<@q|oj87v>GHYmIDaJ=;lTrL z$?dq(pa{|R5kn*7WHy2grm8=jQr2U$zDayS&&1>T!yD`jQn2R?{aqVWd9>eX6C!p%!K>nhl& zT?kSv1C)U?>6EL_m2-_L96zN+8Pot@l$qlNWbO44mM#Rj7G8>!o=(y?n$Uc5SgmM& zO_Mii`bps5Q;}r8K{-ApJBMyM$|xUxR9O$a``OWX;`Wl!i(f%tscpY|OA++IE(jgBC|M`IagoLc?-1U1q>}cJ`bxWtF3x6s+8dAp@?}rA zdpXLzX1QMrP?1-XBW@#oT}OTguDK9mr+nVbc)21>;W`h>PD_4h+GA<~c&Ym?*%d6ycg< zsOlmk{MQyYJLxxuIfx*+=Zia(O#$C`elEdtzh=CTF*;w;|Kb{$SI3_@XMz$A%1*n;r+xfS-#4hKW5aXqBuWqso4q5 z3;5GfX-asIJ+^Y!`$vblQydr;FdLVp{oH))cZmjO9~X&zz3Gq0khDo37S@FRQ^t?? zx)#jz7Eqnn0AFFhB^yc*9B19Ln7^SWeyKjC$$f6ZJWvdR^EaWK(a@;h51n3p`Mx@Y zca-I4+}2F^{LEN@rbvRhw{j;omXdEY>_f8)1Rmm>Ie)P(8^L-%&9>K>wZAdW$xQSt z311C1P*fpAI*0G1Cf3V3nHf5R?=s7tyvrLQSB`d-MmVa}`m@`vPKY3};6% z1i90wEej*avK|N=+>*!eZ86^Llr%WXfsml?j`+Tu#Yyd@lw}K4s|m8m2&)yng^T-$ zb?Gwl%NI|+&OcgXa{$*cLO0%x3$);CYda;spD@YyR(#~~?(y6FCl6mVhx7>e*`rt* z)Lq!M5C@gNBj$@|QDnPk?!6?XSt<-kl%$RWG$-z+}*M@=S2eDI+E zYJg$F5Y1tqAENODq3s&Yul{UIq7mPuzl6e%nYg~WX)eD+8(4k#N7Xx)^r4ppG{#Kv3c%;hzo+jfjVO_(i_(Es z+V0{0*s6bcuCEHmgg2lny%CQ%{h7QGVfU`~_IFAc;>)1KCMVNYE)qVO!()0(DFxgk zf{$70f+kE09ZU#pqXx%*GPSg{7JdR0QDS|7uGm;G@+e*9>7 z-uP^&clL*m@$)*8*fKp}(xCQne@6ZbtR@e5dC{>^fB6xO#X#$rqon}vz`$(6g^bDK ztQDRYSmxiT`RQSjmP}U7XO;su>@hwinYcvlcS+DvvXoo|%ZzzaIkG%DBXPq{ z_$c>inPsUcDjOBpB#~=+&0`I94v^}5KFa+w_0cXnVyyeXYn929bjZ~{`_m$YQR6|F zr->Ii_xajP)aB)6rj#$g{m7>%rjTn=V%3}0!O?69a;gMux$EPIW65KCKNUJ&@vnw> zDEVWm-_y$T(^G7-Hw+tiZ|GgDxR+-Rm47qJ@b3$T_WkL=kU#T!-}pP>^TUHI3_mWc zjmNtE+qf_rP2~bj!Ao=&o*oZaScp?)BmiiqTOtyNh8Z?1@xbgD@CPFqtcW2%r6ky{ z)1w_|LLpUsQTCY0Ns^WS`;TvtROW(}PO5CMB8Ncpmr$@s$Hh89``s<7yu2K5Z&vOG z@jmvp>D65QkSw{xMO7L^fmPkZd9F+eK5Z>IW`~nEeg@b-aaoW}S$5e>vK$upM$jrV zIB(M{!ElAA3xD&5NBU3E^T>~;s|=v6)K(XQC2wgZ$6orSxb5@m+9fl}E zE_GT3yzNz16WwZ(rZq>}Q)yF*n8!e5TRQ-6zyJnfYq=QcCAu_e{pj07VJ3 zv~k}xZq5rp?F~Q*6_>Wo&hcE+*`~byDwI(@;9f_BQlO6;X*^BB3Le+V0Yrk4*rCj*x+LO#6 zRp&6uNI@ObaH=G~xw&b1vfj78OqbA;{1O+oF=syfx#NOswGJchfn$}C8y5u_!b8hDkv@2%#vjK#!GB9Htq_ggU@M>3~#>rV|DjZYxjGLvi4qgqmT z2kh##Bpy_vUeM54-MYC`(;b!H-wC4KP(MT18kXS+H!eUS4FMI=pqCGi(INEz*e5m| z5tFs^j%H~l1|t0C+B5acf|Lqcw&E% zI8#*sa~mH&yzslD4FuIubB#XL(9pDXJTt`VkW}szz3^yK4R!r}&Bu5la^@*nAVfO` zRn}}z7s48O^4RK&9u%6qu=*#DrA9ZLUXF7e-~x;d&0mO;FHjgiI_a&Id%oL%qC69s z9@kvgd`bCyx*vC}MTB~QG2)lU;$kK4?W8-6B!`iA z33F4Uo_fk$>i=WUe?3l0`h_APy zNu8j8c*{_3H_BGL7|r_eEBNll*Gd|>-o117em#)J;rHdv zR?BILPT5FlT(ixJlWn<5)sxtwOyoTJ-H&!i5a&+)14 zA~KI5C<}~P!YPZ+`TZvY#46+|G2y=P5mr9nW@~1l!4w+*zKttp>3^~&d0vEOC#GTJ znkki4MQG})>{Ukc_@FCNc+90?*6GnVkc$N4$WcsNYqHY2pT<1CR|1{aWNz&z(Ziek zFXB>C23odr6VRT#(J-m~bbqGCMW#PM%4oecM>DM6M&84-VR|4A5m>U^(JFj7kLPpd zzKjE&<|D@PV0e0})$X_x{h1*kfy%FV&s)+w6ax5DW<^F?0bZyi)LG!IHdqq&DwVxl z-d1gzs!Rrv*~aG^F>G)ig3MLn?+(x$&elx_mdt}IT_t~~U3aepop1X~{gzq@KY?;E z3C~}6LOK=aM5N##4xQXYr^!;QiDLCJXH2no!%vJ>lNg4NY48IdZ)!Tld$f(X8FcWM zg2NixtGF?{wncWK#W3bZJMzF(@%uTZUrD(yX=^@=ApX-v$W&7_0c)YDpm6{d%=bQr zq=eqfcupiQb;ZR$1?8a+Jb4h!x&+{X4LkjXqW9^Q$9NJjj~W6LA>)>1EffLI*e`Ud zmYX5_YQiZx_&ff$7aJ*lXVXSeo`E(64x_n>s}{kRTZ2D;5?{2ZbDpnGG|E})tbum) zObS}GNxqOE11+Z5y7t#=EtW*2-$)iDh*_&m&iFN+IkNQ+^f-Txp9-vP`h$5{1}gv` zluTytfR=tixK@QESv_H8z5)YQUl!PEHGa2etoo|DEwRYFJ@-EH@E?@~-|2$6SwnA& zWV|}dud%KM%GNrFBZNwxK|*s`CFaq|WwQG|?H*Tuz85*%+!O&Xn6( z4^_GuFH&{yAriCP9866znIcDg>i9jxvol_Vd(?iaeX!63>Gxds2DeYRvHT*2l8w>1 z=WlY63GczmGrQQi*n`rg$|Od~i(9Q4d}CpB77ZckI=N zuP~$871Pnvk6d<|-`#n6rMVdOE&LkIa~$}fn?3?1i#!wNk|2f>-@dgR4L&HER*meC z?qJyw8Cnlb3l%V#{jLjc9sTmLu5gnpckn?X2}(!N-po2_^f1SFSwUMnx!FP5f43xK ztRpBu`h3;~*mz0@tCu>@13v-VHS`s{V+~ayi15>yI?PBE4OIrZJ%xTk*LX7vm^0ma z(k{!%MVJ08CT>jPw@4Na4Ub7~0W710;rfy-3pe!ZQaZTWFg?Bg$)M795{Z`ShBH)IgUdZ&ytXm!5b z|H)5T)GN}8CSzV^|3lh)DY94Pv8y4cBVrbZ``Vq@8Mb-hs}AFi>iJn zs05w%ubj)5d#eDTkQz~XF7EEcYa;9S-yH9AU#5NfJBdVUSzZ0PhyOsrWJUg?x7U++ z2799pG(?9+k`?%>?kOC?$#U?WD0n{ z2iD~P&zX6c?HLKgELOEHX_9)v&%O8Xplq{Cq+r!&-U!BRwSh5~Q0u{5Oydu{IfIEXqKqL=PWtjS z!-f>;1=CrSUEUm?vhTQPnonK@$(GJvU0b(T&&AkaU$Qula$o+ZwA8}-$mVibhmSHX zZ!=~XwJW6Xki0_-s+<^;?&Vr*Rg@T=e@B-G+hAA=8jyO=L)j3}y&dz43*r>dv}MFZ zaP0hH)Rw=aTkJr)0(F6_wMyft!(6=`OHSagA0G?+ztNHs$6!)}{0fX8R-hs3`D}uR z_P1**7*Le_+>q*_`aa4iN;015SlU@P18$xGC(!sVXZ#}Z!N5!$rE6-2wunO5e7z_0Yc-x**$RvqKAb)UwTJ^>!dK`dOA}fli)mrc8iO<3P@G;gef> z@Anr!kE(cos|}MF^zwKkryHA3r<*!T9icCR1k8SG9)AcDh#%IFVE;?8vhCLYB5tX3 z=$isua{IO!c=CqS#Cnzdgtnf0YbaSTjG(DABLXmTJrqTs@s_&C*=&PW*o2pV`03q+ z!4HN&d=mrmil(_&nZizFxgocgZ#!NjVnJu77$K54Voot;KJ#`EWxzi-B(F^khG^#=33C^}p6<+sr)G9V{LSYJ}pEFI5Z3MnBuS ztlTM+(vX* zFRFYw2$$}cCUH7%@NjkL$#ny=mVWB~WzEUn{$ixkuo@k|!igT)?QLq&OPgR#Up7>Q zABiv-GeDdCbA?O$(f!Q^OZlL^HL^1kvNP?nH{C1tk0=SShjFwZGhA?VexZ@{;`$(9 z!T14|coJE7ZUpkTYaB>)p27d3({i8ddmnz5GNOe9k&)ud(=JblNOPSwFVdLr90_}B zS8~B`apga@??vDEH>3C6MQO~wum5C*x)dD$QQsaUZqE(*qyc~Yr3yW%v9^=~%H|R2 zd#`sQQ-si%hYD_xqZnSZK9NxTX;fec9wvXfl~y5ccPVM|=amKV`(fk2B(6KG>Zr5OVAbNc$&a(>@*{n+$*av)Ur0J9fM%{4rIJ zu=Tnf(XG!zTo{L-kN47cuM(@~DYBsVwfBRK7UiI6F6jNU+U3&;A-$3Iw)5o*cXX?k z6rB1=fY_*YR#Wk(U2WOymhOmb_Lx(Hv0)&V*w@_{9uMskDdfb2p00i;8sQzc8*9l2 z-rXRZH{WSi%KVDZFJ+Obp*&Cj#iCvoGm~O@&fbNous@)_vT|uif5tO%0lYNs4B_;W ztl^?wEC0(c0Bi3dy5!|}kXU1#N2gYWN$9NIxq0|u^5_Ox)V-?ALvUQJ0kJ7#TDgF8PMTKkkt-Hzv%nFPEJ8TilGS7eU9 zEgz$>Rfzk|uO1~j0__9EsHI<&CI8UzyQj|R?nU^r`Fr@wGJzx~>QrqfxujiMQ=07- zebjDJ^ROAmy`0WNIm&+L-eqNK^IjEy-Jin(or&o5@eO_p+T}Z$T;&O!u;Hp-i2Ml3 zzaak|cE9{2H+J47p$?1`-9ebS{DB8bi3t(x2i!X6-B+VAaa0=B96yFvOxa78(S(I! z-1Ew$lj0|f(f%3%QW*;}Nz6*^JvOBBk~;45M)kn7lTeQ~qJc;8pNm&)8#Inrs&2lI|=sAE;AO|b8$y#v(A3_yF0_l*mvoJ&rNkgA`#L6H{y*C#P&_*mLJEmhRtfozb-}_vv05c+E#( z9>xtlM0eNTV?n+23BZyuEVukNGA3FN*EX@#hHhT!#vXA$JF!fey#ARrKldz0QX~;V zLCzaZL>E0Yq|u3TK;+=f@(nhcS{=WC2QRlWeHbn?CLAbo{?6mt%)g7Fv55!n_6M2b z(}~!RxnR!9ar>QGv5Z6)7NPldX)LIos+&<0L|=I~{ZIo79h3#~_NmS^K6S9|P?Ewm zmNQt-G3LY|Q?GGerC(HzD(&1LL^yRtzzD})NhtVC(Z@%WmQGn&xp_UF=lTeqvwSbb zTaNt0J61vG21fqNudcypzKqwPjeqT|nfaM)gKT%O z$D8dQrFRS^1D}iP2ibSnh4>S^y(2+Ks*qIWPF0j7^8`a}Y&*J+Qt$JH&GBGZB+pg# z-p95xGNfXas^ETov~wpT8F2op9d*TlTlPtCb~7=)ykBK>+aBP4{On1@;GxYg4e6_ykWm zcKbU;_}nx|bXY&xC@$EEV%G&`)56DieK3h49y_rLm@_XQe%n|V1Isbxt;e^b`+hg0o%C&{QNDOWJ;_& zMzs{&m$%MGatC7gIaJX2pcmvOJBcjL0=>}cysCsLRMFS%ivt&n*ZmU>(uv#xs@8$h z)i3B8x;?v_=9vDlFIXSX>s3~aO|3$->m0h3k~{Aa7yhvF{y0<7HvC>9_npzfhx2zr zx%+CD(neDtS>wZUIMqq6E?D_^Kk`e5KBAhlbE=J71^!4=KW@i%?jr;m2Jj)!h|B)j_T@d*gC#~beyw&R)x-&vr!+q(H<4uL8 z#Xxoz{}5tzJB|+EyGF5`jXkNJYLCo05GL|W9D9^ zwyCMvvHu-@#rb){c~FJo9q#S`e*9I#FI%Wl<14k)wg9{IY(>5f<1CvSUMPOyvqu|X zryy_cAaGV)He#Fb^~)v~qoY_C#47i@E!oXz&j`Be5^|a0Jy?d)xpm%%@^@Z)7?}jw z+uP?T%Y1f$@o#QzF&jMBxJZ$^-MIpHg#v^1my5#Mj#`J|9aWwQ1sqI)amXemaO96$YGt zphowfQ>*UUCv-sWt-ey5=%I+EU*LGDj-~GydK_oW2WNJ6 zcK)yEB)uG`KAi>KUTzyVI;W2Y9qK_7&)^~i)=P@h#o zxE@mKUJ-B6%uUJo^h@=HM2aW{d0CE8(VgshdiZ1jWfh{P6GJy&+i@)#RaQTve2 zWq5~+6fw@ao_i=&c&`AfP60!?BQoY|KNpl!`w^?VWL=+L^x>syiL00Ao2kEfkgj-K zrz)wAiEjQcuN*i7m`m@Uq1?{0bNE}f$vrn9 z&{v~_$2bKu&4eK%HcRT#&CPc^$2WS*+aImb6ExC}E%y-@_u6@$H1OO-4t$G`k1y`` zd@qX;54jQ&(umrXs5NcUw#85)--kg4+Wk)hk6fto5@RF@v4>9cjUH@c(>6j(BbWJh zoP>sKo-C>Lnz|ala5tt^t%{0>`Zq)MU(647cZ7X`@-kh{XmHyZ$IVX?8|JjDb!M2( z`lGv;*g=M$Axbytk^vdy9nNwspEMr;h$%kCA3K-nI@0DHc-GR1y{1?fO?&Qzf^^~YCA7P@b#j&5_!|2N5V>w zQ6m%H&iWfOQBy>6G3-S<3O&i2GKQKZ%&fl9)Q>OX)b6r;3!dkJ|NUkcKBf)k&9!E- zeU73W69;|uBk_kv=+WmSbe+|Tp1(3!{%3eC3932P)&^^1y`VVr9p(pnb-%_={NCIe z5mI*E2Jet6hV-Eeug~aeo{&};Z>>Kszx1mY#WVQamogVqb#?rE_wHfP`p!2vInGqS zlpoL|l9f0`_xXBaseFzWcVV~>IVH$5(4&Bw*vf|@9Z_GI+5={BO;q9Y2iqpvSwsP6 zqSbQl0F#=j_>{?$KV-Y0q6st!sbZ1ms~Y7Xi;n)sO&_)cT9?|eWTrcK!a+w?aI(W( z(ttLkti%wUd1nhkSr(+u=44wyl3mW*P5JULwHSHGtK+?OJ5e9;t&iFwF^Yito-ayG z(C5H7Wk+}#5rXa-TpWBERpNoRdd%5nOkZUWFa{8M{`#R{LhEm06`M5Y zrbFi4rn{U1_+UdFa7GtozC*jBB4hC|2UK&s7!D#mi|=wD;u|uv4-$P+>j;Cv&6xZ* zQ{T2OzbBB2t5f?u?*g&fohV^ZgxZhLYJGg%x9y&`&YBlZn+YCBFP}*L8D5{(0_Y_`vx&cy1BhoWHw#f=3DJuc`GZw~47 zgKy^yo{D$4qUhJACpp@POd6cogK_4!HuGKEd>peTsU#W1(yXuVf|okHtFBSrOg^uc zex2MpFBf9#O-_zgdh;~EXLYZWU6)FUB)yIzf96QB$}-Cqjz+|3sLZgT3$zx~i(fsF z_cY8otRPB1mJ|nF5hY3oCFSj9vqr6>1VUSAvNY?cg$3bpuXBP}OG0hjqEMOUL2~+f z7-)mE?9}xk@@gLvvni5K;j1B$BEoe~tFVp33NEm2VT$fy^0VBbea51fN}=OwkEb0? z_{-j4NEX{-;P0Z#k1<6Diqrr*tBPOriL3ZvSOwzLKsW9XpPk0KN%QDJo3mlvfmt+4 zCMff81#0xX-{gxoYyCo_varXHde9q7x7Gf%+l$RC0r#0m&pnx+k)Iu`rthuHJ!)KQ zDoGd%k-sy^(bolqO^4KU7hVzw?k{{4cRw&r+8&E}-g>z71()Xoe^q_R)Na{2!rj4g zb4Pb)rYPpPAl7?l01Q7`GX8SKbp6?jJNT0b9VI0tFfYXT=uJKO!bw@4O*A1>G%y0U z;4V~utjxmVlP+u2E^MXDQV z-!R9~jRQxP<0o~l!=j1O?AIX0Wi46MVt&fYj1}+HE(51-xvIN<_~|d38Q2P#_w7|g zaseG*Ilp=HtPK+%O_J31t8AZsnnY>uhWj^!nE6%JOXmG%%Nhy6Cf0WXLJ^o-QN~8O zWge{=as__Ht5vM$l>@(_6Sdm$vpgwjc+kM&>({ATXT>gKF%qOTWpaf+Qu$)}ZYq=^ zxC$T;qy3Le(s!^>y=Cqzh6FG8vUzbiDkAv1{!(yVepIB6>?PJez_+&J%9(4m}KOsg1Z=?ne*CRLrLTL*2qb0W1P5fn@q@|n7AE;@uv^G)!}2NUn! zS$>}1^a|t?cN|rE65tE(t9I+?lX7d1TQ6L_&7O?W-NJN&2M4)--^y6ajw2syc&Xn@ zOW~h~+;_V;s&WhDx5j!emjSsi76pvJS+DjSu$dhs-3jtwO2&YZXN^RQgxp0~gj_vf zYCk3BEgiEh8y}q%vj}8=tps_GT7AdEKd|eNsIZXj!`#9_ZcZ=jN3#-wWUz0)eIcJv z5@y}BaI&xC*_-sxJ>-Nk!|LFp!^0Lv*=Jfmp5}==QNqPSx`Wj&wtFMPpQiUI0$Q+I zhDMgBEtaw*v-{h4;sZB_}-y$@l)$yF*F;ONF#)SMlYRelO&v8G8Wyr;$Qr!+gm+9bDfS! zl*9%-)JEQGq&!>Jy?TVoAwKXic-UD@^Ps}%O(tJ<@~DzX+U@19D#*qc64`shXQJ0_ zRLFm>S;MHI=pOJK+?{O?!n)TiEw#6#?3LkM!8l=AkHJU8qY4kvU&sVvhN1o_r z;gi=;P-m>7JHW^Nnvi%d$L6`_*D^;pDG0H{Yl70%co#^2*SCm*N#z-M41QAn-D-~S z3Hr{+E$}dv0BIBAht?u;ETVa}(24h$P9UO^{5*AZ$tt{CJ2e_T(eI1zp}ea9$kVV$ z`ULVQ98QJsSdcQDmx+5|7YK`EF{G^<@ARQN+7bQ%(E_8Jx)HaF-vg6P+EO>9&t9)| z1hq9Eu5@S$>xiHjdLOja(1T9d9(Vv>KpV*X_# z!;t5c`TTqYZP8KGw@59eTAf^qQJKrMi!RiKr;g24AN4mHqc0MU&D^}ay#w&z&@!d~ zjPc&woVMdJ8Dzo&LQ|lh5(bLsxIwwwKPU1&T?xJv$qn2TBI%4!dyHE6xUMosgOvGg zLC7E!jvb7dUsy<%7koj=*a8QhwDB)eP*SXREWmqBA<$&bya1eypOQ~lwwSb(9^~J4 zqnb1j)U|>ldQMGNPj~UZuYttpr8WmN;p#7aG`tBMF>=I|RM(dhot_0sa)1nV}@%#ry1b#_MGQFVM6h!q?eZ7aY z$6bi~_@#ch2??F^uOGLh8!FlHZLgsWswwnI2(Lnn$BAuzL&Dc9=`bu?11cw~pIIrB zxFpmG>IP(ky~GI8tu}$qZxs>Iaqo&8!><{B(g#V-)cik|&MGX*Hd@2}Qqls_-QC^Y zNSAa=NJ+PJcXyYxg5=O4-QC?iFu)M|bMJk?b#VX(FyFkh))V&|S?k449@^-`XxzII zknBuT#;0opONdC8{+Rp8O()v3loT||H`#Y?NJ=?}5ZZ<}`@eYS-y+g9 znn)~O4@6iI{|MnC`n_6WY-rS45x6j|k%pwEBVJd~u-c%a5os>{ICbn+i}tBdPuDC% zjI1jGdeMOpzXp9*gw4U)?mFVy0a-xN;n!*5&+{SDQELC-*hP?4%e1{U3lZ&~>V&y^ zY38K77m$%md7VWU!DP9LK75PQ-QE9c+`U{L*CYC?{5{r7bQ!D23zI|Jfq)caV}{Sd z(JVXU(3nyfo5r_=O9&YX|F>+%0O%~qW`RC(gPQ~`m%dP+ZvfUS`H|Kt7s=u9Zo7zv z+$u6L519xmXx0z8NA&dpW`BP_LhG-!BOq>&(^IP!c>6Qx;PHIRc*sI|>3qIXGgQCrb zIPkr=jZjy_A1rH>TBX`_0EDd-Hf_wI7<{am>(wSZS{(7ex(-14sRd9VFyt#FyKnYK zCB0)GZx5mCyd0c_^(muWEnMnzooPWvIx6CqH>HUI266f$`+NUEitzhF2;0{KWiNeH z!Afz|N0K*HlU;Z`j#0n}ZgLV5iQz1dPHpV>#7~niEZ*Y63;)M{ISSEyX#0@VUqW)b z0fD5~o_Fn2qWf>9@s9gmMbFdJ#gB?py|}3tY^Zr8ogpvsiJ8b)N(@XmIrW-tE0d2u zi^~Iu{u$7j&3aSq>L*&2k5Szo8h*_@MGG!-zdOjqDtCcd%R;VB zJnnSwQ$8kjjnen;-|L;WdlO>c09z*FPe|uc`hs4B*Ntz%9LDfsq16fF(XqgW%}(zzgABA3(>Hl>G$hjqyHw%{c>PNBeVUDpEz)A?j=C-^(jn#ViTM64lY zGG^fid)4CUPd8(U<&kn8lEG`wtOAZmar=XDhmz)7>7)UJ8u4LWC>(eOe%F>eU&Cys zz+jwvaAvdJ-a#L1wB#R-v(ZuP_mc8`>8~z})2o^o-o`eNxv~i$mQ`C!+W`k^8v^OF zePjk(hjz!IMRpe70m>2qG*WF~AWL!1e#EUw;<$6%2 zwVt;THatyg0lyr>obL~Iu7;Lxw+(MXuY%>2~7+A}s)Pzh(Q1e)p{(aA)9xtIm@6wbWYByc4Gn$PSk^V98i zdsRs8`*xUMf_S5Qw6`E5_to@CDeBx(&H|sGmo&(VX;Q|9ly_CM8Xf`Dg5nss%;?TrB_T}6Jd4Hv9E3VfIq6*1$|rdjJ`58C7^QtmF9s6y#h~|Nla|- zytl^M@%>YG%QmVpkH}~PJ!$l5@=TZNa&2K1zucf@CeEqPOw34#%sZYFZ(t}?+O0*t zzP?`iWvSS7ce7~V63bS5I}}dp{~?D8(ne>FHSp`qb8_$?&+q)-Rg@ zHG_>Vg!jFntj+=Z1L;o2Hy^N0i;PSklS&`>WMZ^31*WB$&jc6jQD|2F{?_T$v-#ds zrg5^jZsnEquGy=xF8Qju7?SR8tTnZ2+3c5YlhOL#TqBE|lcizgIgV5`4x3S%EGvWG zg+{>bM03~K!oZ^k4)K5ntF4?1?i)_3cm&n2Q^upn zZdlNwxI2OZ(S_*qw}K(IJI+A;UruVOL(ezAC;N-UB})rsPa%NNFj{W7L`QMAp?dr` zz@Y`POhKchyqD|UzX|SaW%{av9#0(MDV*{i^+Wb-co-YI5ke@O%MO)2>(DI?)vp$Md!CL;CHhn4Xmy`aRrW}+ic37kW+ypges>f~S zcx7oqPu&5g9B{IKr`~S^9}DqeV=wU{b0)=iDfZU^So?Tm{ip z^fzWYQ4Ee%F7Mm3(O~}umTR<657w^HC+FtIcD}wYQX1ZN>i))2*x2~VYbbtqsz>sl zo}~TSU@#Yj5dG)e#c3mD*g9gW?(S>8C+1uAD`9MIv#}p>ISN4p;$be~aU~o3#F^vQ zos-kLzHahh3Se4jan(eI{t+k1iF_BDra;t~qIE9In$q5`MNE#rTN!uDH>5G=BXgux zw9#bvg=wmw+Y}~d_$cXQRr7pO^i7H@F*n!n+#eG}6^4a{6}q$z^6_XIl3}De0Nf!v zK+C87J3d}>zjU$QZVqH~dtJz;xS$9mp6>vyoFoX5S>&NeOM>A04rl$OUZ6#d(a~2+ zX9k0y4H$%kQ#NFctd^2by7t=Xfh0`~7Iqw(aN02$hQby30vX_~vjIC>pWT z8|B+T2Ir*McT{G%h>gd7>BnQ&GY${Ci^-)3lX2T8^9drIL-vu8 zk?TH>-$6X(Rkd9>Z+_2-1aN+zOUg%~yHGUiNi5po98N3jF2PFZ`%n zL5j;3Z>`q{^#*oR^@SPU+gvCF9C*Y6Zb3Z-zFf6=fE4jfuS=~%MKt4@B`P{fQb2`4 zjS}lGde<|GK<-;g{Q+~I_uIdXj9xw~ZTRbkReYmWri==n%!Lus6iLxZu zgsJ83fq*W{tnKiX8uem5{f^z&KlARyQ!8Gr+_J(o{+LN9z5~A^Nh5|r zAmEv*TCvGI;QI{ZCT=QVZgB zMxYbw6OhIua8UUwWw7-)#(U{WeV_sRUmwQg+sHZLi(x+5{z5!4kI})Ru-b7gGT4<0 z{DQ-u<3A}yo^I^JtzG>>cn09K*SbWlkC!2$V3R2zKz2%HvbOwnyBw}-dvuwTT}*k?@!RxMfOZWI#+53dBwy=3 zLGnE>QgNrNJn94@y^S~9ud!&ihJc?huIm&#B^Y@=>GOMQx_|&bKSKz$%p^NsTi$4DV4pI!@ z!K}HpbDx&R1$syWJ)O1YTIqgU(P@a4KNjdLBP$T~Q#R~SP*u&;EajY%b!mdAN=vq& zoBo5Syqgg%E#3M$3#mBF`a83ZT@si6TB{oH#bqsIT@FnPmf{?@N=ns!diM3ko4gy@ zfnSZiYT;ki~mS!E$DQc zjDCAQ6ny}~5K_XT_;ZOa!t=+Qz(!ky@ZHdJCzAI0qIkg#D3G#>ygj=Zc3QbaT1N6SrH6}!&`D;}>% zi$BeDZ&tv9$#L(1II+vo-|dI3TNNoF=yoJpAbP-*Me6GOHgd~a*huA>Yn_o*`1cXr zB|sXmQ9|z8YJThQ_SK0XKS{iAS`n(RyAYvKnwt(0Df~t04^ud1TFawwS>XumcWY*4 zvbLQ0vLOQ8Lh1&7ck_IZwQkfHBkyBs1CMpL`TLH5-B?~W%aIhl$^EPCz6>BDHVH(_ zV=-&sq4#&hYQ-$?fP4woGJ@Ow&#GF?!Qh_$d@rL8ZFFllHZQ5cTymh%8^7yD{3u&t zpgeF$;6tOHQ1R-0U!71ErY)-+e(&ivs4q_H0bOXb)PReYM#dr2!{hnx862~KwdsG% za*hQ5Y1{X37d=$bw}d>olhtYxHH+U_#6Ws>a3{<+#m4d z$5sT+dN-K(G@rg)Ljji`DvU)h@^W!nUry*F83)BRcK)I|v{vunmpd`~7fCtgKK!zC zXfq(RHWVL5&Ea|&+VcXveLW*o+E zP>y@=2c$Tf1P<>O?V4x2FF}x^UmRE3R8`tFH?6t05KfNw(YmVPKgK@t*Dt``SY1hX zOwi#Zjcli^FohMzb++Ad{g}td@n1&Kz%}wdb<5#kYdJ`D3w(uL`#uy9Bydm!hb;Z# zW;g;9G=QpO7`slijD$am!(2NHSt3>G0!u8-mcj($fCdp7K5y?lc9~yZgnc={``mH& zDoB1>qPkj(?6KyeqdH{pcDYgzHzZ}W1VwA$U=Lrmf$X~0Ngb=1ulTu5Ksr_L4+X2m zd>I7F9%}1^oOfU)GG5>bEOZgW+J*J0Z532{N)-VK(GakPHK^YiNF0?58Q>6O=x6Kb^^ zSlT4xNkU?~SCLh`Q4DlZ*SXzR5bLqC#Qq5zcmAnk!F~nS9t{CP+?}yqd<_WCK;R*m zhlP?IvbY(J2GzOp3X;K(s@&rCEy7aEn4!kp_Y4%XiC~p8-o(89n zYM=dVh>5c7%=wNSpU=*^PkSmHeGS`TLf!}1oNJorSIqY@*`C43r`M58HbUP`Vo<-k za5*}RAHT|!b9x!)4J!@Ru`l>z)>BfCHt_%~AxI}gBZ`X7fb493cBS@kG3vO~!XyVc zj3)OUJyoJ_m&x(rrG!#`9dsm~;O&A~-naBtal+`z5v@f-82gX7W+%vgXD#3n#$cX} z4PhS>9{nI55-hc(yLUhDY0S+qXFdUpIW56GgieZ^PASkY;i=uiS@KO=Of|*ec)g2` zkL^gw*My}tz}DG9aaUPc$(^U8u1;|vGwAX!ecNC@WT3WFUCrcrGAGa1+3aB0)y9y8 z6)V12iF(KW8yVKNRo4EJPO!l1_COcp-Q3ZL z$pw-tSKTtkOEBZeXQ-dH0Da#16Cunu*JAJs2BpL*NmS7*RgRrxm;cLqk+czX-v&RZ z`?S%dK3l%q!k40XLoTetp%?z;kMT4DlyM`<;B5dTVh~$ipuXx3;#ek+x(J&G8Cb4~EctbU0BXJCVk z-})GapY!@SFFg0Su%?BT<&LPwdgx)EF9Y4~`BEn{gAh-~l~^vxL>3!K*Z3p9^+76t zX@_;riQ4?}anNgGrMd3bGOPT~l~ z`I85i3I1|z(7q4&%KmI;6n$%u&@skaP36JmX4Am+6XEFXv}PU7YnC3tu2#Bt-F32i z9ho#Rpbo|}iuQ3iDC2XnS({_yrbrGcy=lKYS(zMmtg})1su5BZd+4 zlW-!TPt4uEbJL6unAaP3_nn>hU19|o(xQ7KK&Q_h-7Qx5dYpGNL}Ns9=v{$aiWIb9hNqJ}L0TAZx?5 zLt`k(*y(6sHOYo~F6jPYMK?~sJr~bsfv+UIbrvC&RJE)Z4r@X(UHjbWZXkX8cf3eX z+UIQ3CIx#Nd_=%)3BAREWd^NVqjcIhR2US062`a8gcyaNMeCSiYpC(`r%k? zMsr^<*`C9?AeNvv&Tm>i=1E#4(^@xy*tNhY3?Ou5V1D;O5Yl#b%uGjc&_rIq8X?Iy zH{Z#Vj;$Kz3>ZBIuywXTkc}$#7k|JX(waGh!MNAFJ&x9QXodTl=T%0B&~mq+kHPrh zBhsmK*C_tY7$Lo2Q9E`+BZPzsV7jLG*98Xl-J|S^pDqMuCc{g3eeuejP*hax1EFuk z%W-_Yk8imx(`WbIQq7s`WxF<#HqW!SZdd~ELihHTpa2ih z<**=DOWlB|u_5D#R#+~&EM#4~S)G>V$;1@c0i)-(vaWdstKz!Xu1h1V4)>Vyhq9Dt zy6BTq1XP&!gNA`td8E^pT|*HI#x;O0DQIdco^!J`UQ{hu9K>}N2u`O23H~%%?Yz$$ z^aQZS)Z&+~@`*qqkD$|+h50AGn|GqV{KNxFpIk}#=%%zChv)n+`l-&}KL@dgQ> zTnW6}ztb>L9fSX?nezk)dF3on!oGaY&V*(H)ERIm<>jmT?od1_u-AK>uY{U>zuFS_ zeZC(0zzvjpe*QWK@-rWf)_(osNJ*I+-*2TEjKL31H$qa5u9OqpfpSjje>ZEkWgq=7 zT!UCz$7!J`Zo@C`Mg&*J^TtVG1eD~?8i#fK@TC8hc&_&rc`!d)f`ZwCZuN)2)3vAZvBzwK-}3#)xCRP~@dL=*;)vsA4Wj zTJlY$tjDBivIJFdvI--yf>U$#&jg`#3ZHG_FXN^|(2TiCw1Fu1{jz_KAgxlyRx|LS zkRa*Dr+!nZyphgNBE9E#y&EsO6No?}=HO6k{olg~V_ihvP2kPVDC;heBgU?M42*y- z|NctJIaZSw1jp>#KTrvsQ&e^B{A*Pv#N~w?=~{Gv&J8d|A9)6`R;6)%*!Fa%7vLJ( z_HQE^A={z!Nzs04HE#Ki?|omH<%V5DG&(-umTnx%SY{mL=L0D$G(nr`bvO73^6vet z=j{!=1?e0!z7V7I!Nz2YWPiWyg_nTGk9sWliRa-6*(mp~-Z*6R+k~n4FMCw^p+h9I zb=_rBSc~FB(>!3S`@fJVAOdHMw-%a2uTfT@#W<;1K`9#-;rbvMj;6)`3Pj^;f7x&M zhW=+59dmclvWs@z0Zg*N9UUD6ll+$*xAlN#QU8brn+)KDp4RdlS%y|_-XFO-vzT6d z(4DgL`{3Qgp6A<9m6nHcmjg8J=wCKscfwUx)pt|!MdPyAlp1GWN=Pzg0 z4_=-KWzg}0;JU`6!I~LlX}JK12NveZey0AWjey$(T4hl1$aRUi5_@MR7}qchme!JE&6YjZu`ae?+kQRLL86h%fXEnWpytb72u{wQb9n=zD#8;jPk6u-RiEysMl;og$U z61N>6s(e7fA}lE_-6^Cc!JdX99wIE%auF1u{fDd4`R)?LO?fa|7i>wSXzym8Iy1AS zYe-E+18+$bW@?tE{^U!bH{Tb6iix9;vaWvtt7msf3__OzuWm~r`w87B#_w!C!}#lz z)OFk_{9|im2zmXo^Qn;jh`0slP+TR8cp|Tz!>BgeO;Kh0p zMh+`oDWI~H&iTyN8n)|=bJEfx{1c~iU6+6eAKO#=(@E7!nu3&FzrUh9iwQTm_^x}% z-Q9+J=Bk!+8*NIX&+-Qq?85YzYp$u8cM6D|C-x`Hqed{fGQqG%3AQoonyO(oV_<<+ z^o_S?jWMV>du_`FfpveB5%_k?5VBMHH80x6nUs{3IbtEbm#pr`sbd&w$cV1krL zG2y+_-u!@9dI8vHK)GbuHrCV(0U`ti#$Em*(!%)YdEO_LZh4OJB*ISfS~`)9{+N$I zVCv&O=7!aeX}ktweOJwfZ`FmQpsy(;4A(4(-ZuGq&(ZmCE41Zn8Yvs=%o4l%DXjVB z(-i;dS@csQY50Cc3HXZ!U&t10k)bLndhZ8?^tse^L@-0$ch^-!dzUze$XC2BhRd&3 zqFD#NNumWXe?Hw2|5$al)JaLVTT)i`|1UMt)7Z!hJHdxa_#|Ad;^d7gUhd43N5QT( zEwU5J4WU+gf1ySk$Mfpk7IXx3Vem&F#59^BduC0RcIH^ab>a zLL#*DeJ)yiEjP1)31zo;WxBjzTN?)t#xuLwc3nbc>o7t1EHGPA0n}VBn5ZsPqoip4T$98&`%-i z_%2Fl5pTet!i^-EX6VvX$pgtZ4n$+$H|B-Q6&k765*rPS8lk(tyBUv7?V5~ffBz!I zwVvKHa}$opP-5?61M8WK>Y&1BbJIz-*c=X^9}&T2E`;g(0m%{LQsqeJYrPKfi2t+@ zT`RtW-kWe5F(lupmPRB-`OiNG>R=qXX8U95AD}HG>xq=mlgmr>1k}WkgY&f&+uhH5 zfrwM6c_*v&7`NTRgFOr`3Op)72$0A|1EfYQmRG>FB=1E{Wl3m(SOt9fFD)fktZieq zVuDkmZiVGls~yma+w`XtD5UPXcTVGPUpZG3~v6m9Tdv`4>#tXzB%2cPZJjSw_H=NYn)!3B6@wUAu#2_*BOo3x z$BRm=ON0D@67**lR=5fkX)m473#|9Pfa0gy;n|?8s@q@&_YcM^p66DD?5Bk{LR<(W;+-aDEF>f&mB= zdY_;UGf1$l*8j47_97MTJwWJ>_MSdg3&zRv>?e#Rx7)15XJ03t5}9D>Y`G zqml|^dI&qQroH_}visxEPrKeWW(%&B8wDXp5uOmS3GnYf#P)Q1BkEZ|^KZZnDujLkA26wC(8kI$|9f?-zAa?cwDTt7A3!nJeQmL{Z*yoVJDi;|G9+@_XD?P+Ez4iDeVzf z^~ZJBTP<&iiho>tBY-}Aax^@pw);EIDC(-6_-5S(5~46QYHa7~&E-On@G<|LY&DXP z#C4f}KJJt=x&e(o&KnTy^ZPedG6gBaZ+>CuBJ z=&(r@bCvdMr0y=HwPzS;=#J0>8<1&6Mp;6yQBT9J1x1{Axnxzpru9f%kIh||?d2%h zWV%H**0VVb=G0VF9~uh` zCtrY%$_zgCU(9h1osU*JRQ~I2ZhYS03Qy*l+1cqDeO}W%S;+MJ`RC*obZ%g5yYqXA zdN1Y(1}OE)?cplsLe4Rmg|zIK`>w1LPQ)i)itBK|CoheB1u8L;vkJl}@WLY_-=;>F zVH>2_IKM8uwDbIXHmVW*q|e?U*Rl0You^Hu%icQ7m?+HjDJ1K35#6 zg>D~&;m&G$x!yKmoCPYz8S?Qz4^iG1xk&ijuZNeMki7u!U30ni?q{*XObH?y(bYN) zYf28l{`3U!PR@XuPLZSv61K#cV$LdL3V-6eMnKBEf7BbR=R14Ij=4pNB)L>`11Ktg zAxE;TyTCOjE-y^56>}ZF5p#=18)A!dC$4hSZK3Rb6?0L4Bpa@`lOj|;D38*cU9ff) zR5zjw)Au;HTV?2m;JgU9o{>3dux5n;_90x=+Y@rv^8;4rGx&Exy891Nze&$`LTIpb)m&AwL{&)wQiL8zv%qyr6x4U`c z+lV>nHA5Juur>d3gxEYQ9QnO8&gj_gvW^r46#~9JrThmhv$VD@ShP+!d#8?xDaC42 zDJ903x;3QmSBZ(`c$!-dgA|hqNKqk==%UQ3%6(Ss$#6EmzR|BUUkwC#?t(m~+Vd~R zN}g^Oqm~rpFZYKuN?CmGw}&F&7#J9?Poi1j>^o}JtPbRWc9*m_63Xn--_ptYhSlff zN{Q7Jrhc2od8FGDl&fdr!^;L_55CzU5oU&Oo%$v=O?ns&@l=2@-Vu?O+(4{>{r#Af z=bP?Qt*jAj=aNAVvhGM?K`IsBwrl9l{P`&roxBvd5xu}Kw>=)D*u?ni`D-a1;6m^x zfp17+;m;F)#Pn-UAH-7Jf%D3&4Ve&qip)QbcOASwBNw46Q2bgon}rFq(Y3I!+6sy; zH{VFwyuMyEF0#2j5GM{8?v;+9_Rc2~GJU&lzcfERV2*J2&)`NzfWXmeI4@Ns7D=1e ze^`LBU&0brawui+i|5z5XE1l^@wk$<2C zY7)3;&z(y~X{>F`bd^_0j(P2K4piO#`}-f%1W-&g&J2B_bG92@F)*RTix74QpSR|;QHwY_E9S|9^ z14^1jk&8w?pQSFlo*2AC3g(v45^H1cQB%CUG(Fq(ee?%KIT+^K-tTgQ z*21B~;Uoiq%!FYxW`%sw^-^0<3gS?rJ6dl>XKAtao*In)6O)<6XFql!_Em&XBS@Z5 ztWlnR*d0f%P}R`eU#CQrADRXJ%=khh{Z*{86;_r}(Kl{U=lpP!@f0 zeSZA<4Ig8E@v&2<&gh?QOY!{$7+5zQ{az-3R}%k@vYV1a{D9b zIPgwMRX4M>AeZclru`gh_^OYA0)~f~;5$`<&DO5bgR`&J$@3#W7?HrEk>RgcFmI<6 z#HGpLl2?#U58;ZpKM{D!8Uw$_e)1o`%TbQ^hHBQJ)oYvBZx<#kxP)RxnIu=P0vaq3 zetG~_2@c&SV5yrbmPPOQ*Hy?JZM1nU<{m{tYk68^w7FB?+lZ|Q1z!J3=~jw=FxwmU z+E4x-#2|oK2~-7|5s^i6aXu4i8asxpE0bWZWW+6E&OrAHe5>oBQoK;QlD%8hgx$_u@FlQCA5(fyx6bF5iLq<5@B8+C(~@0E8L19|b~oA+GgI;Bm-T@Ptmn%>`ioXL2MU(Z z{gmj)p&3h%jaUgajp+~a**;MfLlt8U*iAL$MAE+!f!)VqwZo8~UI6I_z^a=C0@x;8 zK#l1SLBwJMSRSS=xY2w>Xud!__-M76wYFskiAd0$X-1>>%h%j}7oXZnSkX_!60O1QK&ZBAR^!LHav_))5 z73mt!<|>QGVev?x5kjJAjei&iAgLgC0OpwK%$MEk@k8UVeQzbOWYJC&uCcox2#ChV z5Q`xF%f2Z@QId{pEn)R%UGxJn=20a8 zTz7kjld-U}LJGuJ{Fm9v;IKqe7C5F_3wV10d_r!s(m^or=*R-0W+xzdZUXE)5%6?y z`3HN^K)1JoE1gVIwi6>S>I+aXjR)rS8*{f6;h(^*Cct)Q(V;NaP61(n5sp<3N0B5F zps{GfQ8)_5kv=z{=2Izje0wD)ghn0XZl@j^p?rzuls=ZP$mQ|Oh)7_M>CNhT!%6gZ z%=14(j3MBI74_vsrumJZ81hWkiCAQ6=Pd(omdO4!4lB&5C(NHVhJXupGeD4&spcvw zI{NzW3wqS1PmfZUP75>;nn>KQ=XrVaSGy)SJx;~IZ@ToseE8SDe@_eo@W1)HM^(~i zQZ0hbI+gOArMF2B$wPj>(Yx_u9XoV>L1&2K->%C!DHIG~AtRr_08tPLU}Q)9l=HW= zr1poN^R9XB##+yop*n!>7Ai2nNE+qJckP$u#j7E*!Gh|ni1t9GXnn|NKHlieqwVwv zh$vR6{Nu;9cu3!a)^06RG<|B6qj@4EwZAhkX=nfJ6yce@!p`Eci@GgSMp}MQ5q{z; zQ|432kb^^xYWerl;%#{R_-Kn#9456kIw^GN@wOd|5IVeaEGc8Mz`I#kT}_m@RlY20 zwl3NOZHmnTD_z* z1Rx989XEvjp&5((Ujd%Q;HqO6YSny{oLcS{aI3eALHw{`oh`hQIY{lOJ@{JsVz58G!FsJ*_c=OIxPaipcz9|8{)t6C8#N(usCA4l27A7p0enONZ zQ@K70+dt+EbtaupGi-(M@6bFEM%4M zY;0@*Zs?y1+;|!u#|H~8y&L14h~1syU&tAGRWcT8{$o1 z2Js6AN!m*fg=x=nruqS>4$dRX@MrGF6L~sliXt5{Lan!#SE1P4gI%GDl9-Q1Q3Ols z^7+*19lNn{9ox5lCocO9B3g;F_N(3M<(;&=%t&OGoUm6I1hR5TA1=EEqTxz$q!Z=iM1^_syFJ@|tD5KEFD>=FuKYS+zcnQe)VQPBES6MV z&(>O3LT}pK9f0pJIW71Jjpn*YFcAHsxFli4Osd%5DBO4$~7l9vKCsPuDSG36q-uDEI(2J_z{iz6M}$|1#s^ zjlbMZwVgE};f}xpzS8W-ItC+ul>E0m6zPVjK=eC+6{`K)1Q4uvpUA{(j^*}ySY^`9 zL7xhBx-gD)F(JP&fd>3M#Se|BD@EhBn_I(?JQ-K%jrqg?J+3L6DNS>!=n}4LQ^}l_ zcPFRVN0PJ59upHaivivA zM{7-tS>NuqegSp`^l>8XYF^&i9UNxN497UoVtT8sDYZ$20N4GBcH>a*%j z>#=X)9vhyFRJ*f5J$9@eR1S>^zJp(O`|UQUst}Vjl1v-)RJHZO%w=5~>`!r+zO+a^ z*F1b3g>M|U!A$}ve)^MGZfL%sgE9Zot3XsHb*J@5OGyu7@2?g96xn4HsQ zhN{}2_17Se2Z`l-Z(;XO2Rp&$g3}Bl1E~V6RL!1Dksj$x9xaq$^%kSZlTnFW3UK2v z^;If`-+qvKv<&%#^qgU5*eGYd0i+btKu%6Vn|hqE-T*f;GD@iA2g<6PE#J52yrz1C2&&2i8Uge;3-!Y zU%Ws+<@%}JvDjsC!nA#34!JyBX{oC4j4f&h;r-iZvyARgKQOnO<%zVd1O+?|@4%nk zR*5Y>TZLQ*#ni4Z@uh!tR1!gQeFq;dPCKd$sj&Mb-);;+sBo!0#PkloN!6yN?Pa7*RJX} zPO^*AA%<$l4$jP(0u0kW`~ybV5jwUv)G&Sx6kC|!8N`c$_YDPN_7|A3M|yd5A|2_e zX%gj&t@`W3xAAU%`9P%zUHBUBqU-iTP9@azq(A2};FJBi#6a!2-~jVV%U#@C2z3!5 zS_OE!D_%6n&FXd#@l1UAqPvD%SR!7;g0{+VK9t|Uv#^j{vJc*!s|Lsi%=MMH^2<|_UfO12=Fq;EHm~!zO~-3kXp>( zpj7Y*LPlWU+X7{%$1{DF4^lsRM)rFe}|O15}DO%$j-&qK9TE_1RCC z99(Cp0ho#g&YkiX&py-iv3mx@i@pwc-yP4I|9;0mD96VD_jAna z=xk;;m6VjMyp-pf9V;B^Tm?sZW`vsYIimb8Z=~0k82uWar5g7o`4IimY{O2E zb1Z0$(@M3|hlY!fL(wiF1v(VaPYun=hd=b2fRT7cJgA1nQ)Me{O+`#0pb+k3$f<~ym}@28|&(l%`dKg z>xJXxWWnzuS^6=FW-q2~z@ei*v=H~L>3Z`!%Y52D zl`g9C{P+mf1;TCPPMUTGBu=n&1FV@N*f_Sdg351EkA-xYS0> zdXuUD{2hALVp}HgX1SY1@Pi{YO5bnXS7qs=A(vuTl^-Y={VKbqOv(ntBDJ&n8GlBtW5}6wu?8108sDfQ4Z{*pB#ZO@VY)A`%>OqW*xWibQ z9H3>UaY48~#L9*_M}7G!^XGf@-jN3G&n3WdiVcfzJ)@Lio6Qq@=rCt?_7KPPOb%-B z-bWKBwMZXuyyBREzY5aAN+8j4qH-tO(xFObUnz6yQB5m8lTz==JS6&89xN5!Eil)Lge z!ts&ib93hpzg`BhDZ{WY&3*W~%h^YBoH^lpv}*3qJLwGNn7paY?6ENv zyDTkHR=CC@V_md7Z@tk3WFhcS#;wrXO#gR96g+V(*nswEg-2T7By=u{cG+CuISET2 zp31EDBP03GUgeVDA4Oqt?ss801BOU;1#jjKqlC=&BQNl8I|+`F3%9NQVqVw(SQBsS zktv9aZKNKnxkvcTltuAMEdRHvl51jtE(6VQT3I8NrBq|n6$wqJ5jXrsL9Upx^U1-5 zSqw{A!`(C~cNNu_fAOHb@#talvG(gD-l zh8Zf5#RM|_K_U(MvU3PET}QZm#M;+gr>gPMJ-+wLmkhKRCuoM8+3D-YnERXLYz6NJ zZ<^hD*S#L9MQyaXvt*Lvm2KeoUTf{0*48`ot#^jy$}g>0zw#F3c)`T+u9H;n(`q^^ zmL=~vI|b9!J);!V?I~QkAH%QR(Qu}gp2-v*d;;?pCb3A8NwE6;Zqh{~tS7GOHMeYv zD_XH6jQAd)z@y|q3p4i&|AIFs=&IMwxk5d^KjCj)7&^JC0L!EYhQ;mj9dVhd)i2oH z+Xy0$jcmT`KM-l~lfBDr-3;ygZo9U42I|0&h$Nj6A~n>@Po3xvDaa%Dff<;zJBqTN z4jtXyLfgzwyM4`@oA;32pHHTHx};~Ab>CVPza}lX=$V={7|x5eW^>M!xI)E}iLD#Q ziTyKW3Aq7MBQ^olnx#og2m{UW6XJLl&~d!VHdPO?Jv+ic3U9qGhW_h4vX(6`_kclc zl_VQ;EbdLW$l{ilh9y|`)|v**>R@ap-)CZcFutz{IabSz^tla526#8FQN8oU#6;SJ zgij&(<@@*a$V&A=*6Hl9ysM|u*J3>W8P!F;`m^-sHix5HfILDse&zfrcg#|y_gL>n zj@bH(Dd*<~=5g=8Bc#!Zm@;nnQ~?o<*1yY_mo zRl9@TYto->uSXAxG(Gxwtf%)(4W|9b!0=O7hq{4^JT2W)!fg&-cMlIz^A?scKc)@^ zMVpA@P(N;3+NIl&B=+9kZcb&z2b_9$xf9|f?pkyFb=uD^EW8sQ&)yA)G`wA3w@d#y ztm=;>2NWzBdTM*9l%aooV8M}uSWG)&Z0~5+GdwG?BERsvMQ8J=+8_PF)XhVD9gLeQl{NKfis|^z z_~zKwRuk0xAY=s)7&lkg!5#v3vn}4<5k%4HV z#2p6OfiBourGku%dCdpQCU5?WGhp8C+J^4eY@HPL^%3Ihnm6;Lx@l4xiTQ)wBtr>v zuT-2^Vqs3dvh_+Bq)G$m;#VyEi!pQ(fBQU&;eaf9W}S1F7;H*fcHR4~GiAoIHdx=Q z+1f?b(M$S8t(m@s$%7c;--82vBQw6u&Yki4Ol%?*FRNZryn~S;WGu^Cq7ywb=j%hkT77pIK~E?WN?Sv}iAn`6%e# zcG*f`eB;IG7LAae!lBXjY;8$Yp{W<3iNW=$#wjD#F0Xg7IL*CRfm$K5zpRZsuO~*e zJ`u(#A0n3(dno?ez)22t|!&7*6vn%Oll8SSjw9PwSp(ljWh_>Hq; zzxzDe@ri2p6|ZW&v?cjOOZPE7^&b0J!~N`EG3B|Vp;dpijZ&X=)LtA%%CpJ_nB6%7 zMCd7bkUUG$z}OAg{hWTJ-psASawk^<#VJN3nMca+Onzs&ocAduOU(BH%6+>IBj=Dz zMrNmd<$`jT^r@fO&nTiK&s$%b8`X5?X|AR(tS$ZK<#?q(d>r-&(F0C@$FVlpogQ}Z z_N3O7dsYUrd0&X=n0)O2N*~8zaX-I1t-HjO;xc$umA@fM4IcD zKLO3Hfiq%OTrYaYLDvWp#neQ?_N{)OI}b?jmD(VU6WU&8-Y`0%JCzap?Vtv;tSOle zLnSvV-rBp#^A&efJ5BEJSZ~DS*^gE4TxXc1;@mmeBmBN!4z95lCK4_fm7s9xAM^8P zPnCYFy5tvh3&4QoT0%i_Hv2x9x``<=oJhaMus!ZdQ7PadASKDju3R2d?B@9Mo(K=m z4I~m-NG-JxAZ`Qjq~3J}HE{lxeLL-hU!P#fX!2Dx8FN5y{Ay#*)y-(EQW>Anq47pV zd>0(?rSV`&@R#8#pR2K0KctT>C|`m9_5>4Ti_Tdyc;i(Gu)CJ!46E_9>)0-9eZzV3hsIpA>`sT?R zRmMMnXa9`i;2_N7ip=8HEtoz=J3;Ad3Vkg#vHt$%zjn66#Toa%_MWKxxsYU;CCB6z z6d>UdLA@xKrxC72txfVFx%;%()B?z0Zn4!W>5 z1UcD#IU{?Zr)YZy%vsh>Rqkd5am(^PI%!^-EfIUW_hKLGs<~V<{DTG87Ohj(L;`d` zuA7vaF;}_jPiAz#OlCS{&euO^E{~lcC$?|*eo5sLlwnAu!z`)4Vt-LNVUP+}EaT6` zxxQ&0+qyVj*<*~cRbr_yUW#v-H-o)l zdMZI^V@&?~HA)e2IxfBYyYHp9h3vJ8FC${LH+-2mdf@QO9#>|%5>}ns6RCM`x=jC7 z=5YpDAiu`lS~u&HO_lcG3Ow7_2>rU9PIc$uYiU`ZojA!I&yPt-l+E*`a_UXG4x6OB z$gzGdQ&A8s_Veh9#HS~wqbok%G2WurTW%9%`A>JWYg0yXMHv|;Sl;U>8*Mo6RlNjX zmuSaI{UqzCI>T9o!G4E=#{td9dA4Ro5gj2U^bCwSEiJ56;cR*ZPruC@HlY%Ccc|_Z zGAa$-jGm8K_G4>WTaIY`k@OYpOkDD3##a?eMX>ldWUqY}vU$Q#%VYv81224i`epUm z22$|zdGHroL@ciL^uf0&d9O2>hULEghnqEHYK%8K$CL91zb>^DC3f!sys_^W2ckk3 z2pWgs^sv7$k-5pwR2g!=M+HTh4wrUVv>>O?l@&$Sbiag>uYtRId{`b5Qf&8r#6W?Y zm9y~&H1j<(gBO~*4RfXf7k0#V+ z)1nV|>(hf5(ShJ6=Z1K5=}~i}#(j)_*q=g!u6O z6+|OV?NZ_(IO0@92YYn@xt=}?2)?o0&WfAzlKLaoZ}$35N!>{k0K#txZ7;yKO5b4! z{8rv0>dJISKs~Dn1LRCFSzPGPY;nJOzO6V`=V(D?H zo%FYYv5B^=x+HX~eECE<_OtSu*|KZ+s-L=t594WqX!>iF4#9Af-}Bd4a%lMbeuxbm z0QOT%jRiZ}%Ql=gC7p^oGSAKLN9Hxqr)Olw=6_H-GyWRAgY3Q1%#6PKF*!AizSL%X zlh?^-+WKoWqn5du!ji@7Ddjnw$e>323a-<@oG%hac0Tarn>z=;Qd}}Or2XTAR?LtO z4$B5Gpi3qW3+1y#gbx5Er_kTFh}lA)b@Ww0FO=qK%pLw##jkM6;a0prRNpf|XGt3W zRAHOzt~*1n8SP$`T}HZ%C^L4$IswMtr-wP@+ALFBK$hFnKt2xO==DV-1BEGJsM`Zc zQD6uq?X+YGn*+}TRv_BH#QG+j_Q0UD#aeBjU%0%cMve9`Ons?x;w8Q-ngjAXj&5O-V__UTf*)U zVbmjYHc<;Dc_*=3)z%D7zwH;Wi0Mi?R#9Q8O`3xYh~66pFdla`x}{PMl1XE$rEhHlV{^fS|BmkQB>+PJZ{R#ruF+dold;e8$1(c8}K=Q#t)S#=*xWvQ> z14!A|4>DStJ6QsRB=t?dZ_boBbz7q((-%O0Q@ZBz3b2#H-xH7i{QS)=T@l3L8PBSY zjg*i7gQ**)xsZ3O!epxh-!r91w&Usf5#STg*18H_=sh&9Och>&v>%mPdhE4dWt|JU z(hS9QWLm?Y>zk~?GWf;IjMFBU{?p+@mm%PI#YXBTf;{=JajJU8#~%pZHRrmoI!Kw{ z#TJ%U6kJ$pOU> z>#NiP?W50HYXb%tYF&Z|z~I#H&zA1W2(BH#(?T_4C<8DI1++cH@5FjcH^N0HAv3`( zxwLndmcH>dbPK6f7_8|LEE+GYOAI6ZWK=}eSG2a9@^-nF$|9gB0a{UmgZY;>H(}ai zQ_fvvL1`IkExO+@V<=f!NCMMc%>m2rzMPXgRB{5k50dDa@){~M$0tmaQX>D5pT5^~ zKCEfTMkc|{(e-Zgv@>qA5#wilQQDk+-2uydsEDC{TacLOBhYv;eC^Vjb5NJ?j_sraAAgh@EI%;)~DEj@BoT7Esz9 z18*A|yrk)Qi{G2-&IbkaW0LkX|D?9nyTiD;n`^$Asm&+EVDW?r**$HPq4LjiJb6sr~1Am2V~MVy@Gt4@wE&Gimp2dRzrqbX67$D zzcfy0be_gCs#CE<^?|S4RrugoM^|>DT0Q$?v*MMl|5e}5OpAmL)oF82wU{r-)7Oh+ zuYK2B7}f^7ux&?_TQE?8vYp3WYhr+C&qH9sI7kUX+YPvJ`~dt2V>gc-E-jv262023 zKAaTH2UiL=Hy!EU&j@|#;ZbR(nZ53lJ%FRNltMp!RG5RW;JHc9;MYpk{ z@~tn##+bYOKp&VX^ra=zXP83hUh$9k`?Ey8=AXB@o2DkE{wIuveSUnz-$jWx7k__u zr{a?sJ90j;A!Tc0W2qo#iZIbJ}y}>G0&dO^pI=t$oMS(V+wa{oEeizY5xW0~PG_*2nh;#p0Z{+Ob zSj`MxPKadxh`-DuAciD6p{z7SbMXeDHnezOnt3Vn?|g!SG!LLWJl%YvdE@Z3V{Fv3 z5NU3K?~Jd%J&3xANHY-*dk#4Gz84(C+D8@0i>i-UG#%gQGcniXyp>t%7c=P${;X9f7L0~0@C$FS)N zyWFEdK%KHMvY=k5>sngiQ<#hE>y6lHH-R4!Nvmd${d_nGmk->6Dhy4F374Xtm6UA8c{Z*b2)3^Z`gMFn+) z5C8EfB6fl6zuWQyc_>YlzfDG{f^&}Q6$?^t{s#|EPTC*LnN~0!<$AU?HRa>|HE!nN zHwR_4;bl*S{XwVgA0J)OM3038H_6?K<&9Z>+>Wi1PtTlC9&a`61!zN|n%fI)K~GGB zJP%0ZYfemGBWsnLhORXK6ngv8c7sNU*_Z8U?fSBIGjA|BH>pebu+|h5C^54m_oCxu z3=Ku!1`5|s_sV;USUzMC=#_k2B`OLre6|NXha_zi zRkPtuX!ULUt~b2v&L;Ihj1aF4)_zJVUT z8Nc(*(LSf4P;;5{{{5~Ji-}(}E~SnzRAFpNce9)dxM-`-1IQ6?ACxuuYdcPXa==`Z z?q1m)Z$8XCTbkdD>l5_BdjhBRShDDYjaU!e5^!*rR^LXv6726+(|HVZb5`uRcx=HU z7kXs0bl&Tub;6!inD#qNye_!ztrrjPiHHmV^GnH;cb0#)T;4>9Dwp5%_bb3gLlSVB zC|9Qc9og}$840cOuUtph3;sxvTqx9Wq^y;P?)X*8?I=W?@4V+<*LuCtRXF5w9c7tH zHrhLGi7u(^uRSM?rGg7Hyeqm6A8KIPNfg&N{X4MI@Hgwru?!Ssfqcy5b_NI;W^O5_ zF>hF~QDynE(8fMZ9dM}3QWGWD+$1PKcdc6XX9dj;aI!Vd3*>pdu^Qoe)@tLJH5<40l)cjPD94Vx5@6PD`V zGP(Zxnu@}@?}4>YO!kqs!duKOcv2Q-E0p~$l`~Tc)weALHcVsH&@7_R*6dJzDjboxd z3yY6?6FmRA$i7BiGot}{j6_tL|tWOUtw=%e?#amIZ%m)zC6w5Z{@8m~Oq^$GgusS~G z;+J72qvq&I_m9?huLC%1G$tiASF%(8L^k;sCr@dI*c6ASdF6KkMZQu=XvwCBj4j5&qzf2Hjs|jm1>srR)SvvnAIxI7A+`o5Y><3T2HL%gie}H(}Axwh&lnQ^{J!E!0J=;9bz2oA%7Iga+33% z4IxLn84860wy;&L<-d%|MM7+1Z5Rm{9nX=+Ky&YiJzlK%v-gBYcFS{bPQMquv`%ToqRa@{eA9r1z8q<<^G|B}3zVdD`Dz9KZim~VmpAbI@t6mo~p6e9lff4yWQ$_cn zT3v0;S?rx!{lj+dtAbt4m>-#4rK2#t$e&xrBT$0kd$|=GEckqPBj77gozWd0t-tBf?xw%!W_5hA3B${$MVfjo` zE0QS$u#@rC)O_|t-Cw;Ou$EuJ`WSNIRnYxU{g*6p_A$JWSIYmlq24)OnX?^J4yGVx zUXdiVw|HhGeu*}j%WNZ!>oCZQ;`tPknTwx5_BVI82Bm-f8dnmia{s(A*@iWe7)2r= z(0e$85R)%qJI$|G?gggDwkXT~2=16{^U1{dH_E-mVU6Dv-R6(f9Z`XVPB0*O^})$| z29Iq7UAB?_UCQrw)HTF%oSDv~&$Oj?BvW6g+u4bIF0~22h4EE}pgDPDv?4rcatg-b zw57%D|H2dPkE&_oX#d~7;3aE7%inOHKSY!ZpKH$+>Q|tCJ-S;+W4ZKU$>zE`MeD>S zfQdREX|tiMwb}{-@l>>DzS3+|`;VUA3RE|5Y%q6YO!^}D@lJti_|c5hLYeT=(w~x> zuODB4h0npl&fR%O`K6hIlaHP z&Y$~iX|}iQ3OC-TpiCb&EcO`PzjIW$+d5#^S@}1h-I;93;Ne3tkV0ZLT1<>CTo-9( z{3%*u#s3|WRrBW)4b_l`?S?VLE?0q&gQ`L%tiOS)V#askq23F}-^z0n&eEAm_Ox}o zb777BroVsg%YQ3)z^w>`<3t#sk2BS$52IZ#<3sgRf&uHH``8SZ@^Jl$KN;5*gh{2B zZ=y!4^gJ6=^6YWt)EaGlN_cVkY@&SN!nDYq7imBPxYA zxgT1Am5GRtrgPg;yM@~JEGNXF``wP|l|`$V#wGCgr+w&a3*7GSnxn=4TPEla-@Q_B z-SdT8=(+9{Y~d7;%RYVm-t}Ex*h#8Q18Xle+hO7I9?!Pwj<2nCl45!YHl>2ews~kW zyUPxsVNjw6-LKWa+Hc3_pZa}sIxL|Mz|#yCQbgN!`RL znAOUV11|A+QRoWO6vF-4ceS0~+O5b#qRzfnx1_Yd0GD-3B?xwdc3%6nDNOiV9o#sq zrJ&HXEB8~B=n!(RWjT#EONDFUYDOn{^jI)=MUF-zdjZq8>_i^&I!fVfSZqXJ^twC} z8y!(=pehQK#uE5kUmKcT0d9GIZBaLFDB@98-c;=7loud!~uv&GkK zQ-&=X? z{=DtDPUe|mLMixY37_lzSXo}^>8&T{t6|wG1~~P3`NO;v*8#2eXm6k73SJsf4h$NEmH9y&JEXt#f{z&$2H-LHu zTU*@QoXvj{bri>LcAYoPAsW8FW%%9;LPSh{C617BZRROx+oG~l-WJBuIiGr-gc#C% z9Pb;PPO+v~j`WGLV zwnKnU-n0otpHSdbPm5&A#X6~3rH@BrouN^8VcG~@v45U*R=ddF&6_CtM#61;6(>76 zO#26vF9fR>VslN^O8$)=Z=cRVLc$w0-?T|!7FwN$92VVOke%YPi8Km8egF#a@>2dx zC1uf8kcfxvTK&!cGqk1~okO{Lskj;JGZgw=4$7wYcHQHx|M??hl0+Udd!0U|Uqzy# zhWJ$t@dgANu7Mv`0zT+MbHBaYMGSB&5v}hnFf;&w+PKIhSIYNx+QU8Y(bJ@SP_V0{ z^!(1|Yfe!$)RKF-Z>?!p%iq+|ZR-*E`*f^ckDngrs%|o4YN_WeO1<^h;eiSoGbeEf z1T0;ThLjr$h@EdRSaLRRf~du{yMGqZF3%10W5)f2PrY&P#>b6*dtP4d%)>vvcJyD^ zhd{x$4mi1Hx#kjUo$0H+`VGuoJnzKrabF`9;(z4PeuHY|wkfOJkM;QLp5>k^qznd? zVx)9T#$9?y3XoUZ9ifoxH(!@MqSail6Wpieh;L)K7aE@J6r3Ff78ZV7$BU1IU>adnRSoZqc5ak8amCi4xw>RmCvyt;pTBdKDPM`NgAt^HC zAKx`TO7db=k{twW?24u~%O)0vN$xz)p{~E6K-3*7-oi6tOI;wrSTesGFdE>)4EJg` ze7E`3bbIF(mh5ax@YtN0n=#;J+Cb*;{?NwSzLU{f^A7K?dfEQw^?5qe%de)E$b~a6 z{Ci#uL6Mi7<1rou0T&M27oRAOuW@l~m+D>`m30m|bhuT+{Y?;39x@t^Tx%xi8FT}= zoMjeOj}Bol{N93P(Qqi7X?@4UcLGw9JGCi!r(COgqccFNn#D_Dq@Xa@*s( zUIh-SGC_ys;)-sBnLN@I3Vc7fpOheiQN^)S#bb0D4G>Eo{>+?9hn|WzQW?gEP7Q9a zoUXdh+G|FA*=&&moZm!0gB-bPGk|)>>RP9{7Tp7heoSZ^1b|;5gm>`+zo@>VSh3|QZa7D>$hSSdN ztXYkILO2P%Uum&Q7U@a!jnkSHY&h)F_`g4}$4by>3+!f6A;m$0g&~!M{&e0z z-%h{S+$Z|O&lP72)=ZLxoBDzGU8c=2MGT3D)Y;frEBb&vf-6M(`tDW(4{mrh_w8KNT zToP_QGO$a%=6>Jl}**itb%H2>WK5xc)u@HgL%bcnm}+P^a~Rhx80~wy3JWaDb^qB82zDft#&0_Z^En#N9%>A z!zFy@kKmxcz6)e9U;{FoPS-9H$WE<3J+Gjq(&j1FIoK9ik@g*Y3}~B}tj|-vds)P? zZjB6#6(;PqDomF4HFx_2YM@9^zz>Uf!=^Q@NO(U;b+lUDE^0Ff`sw$9czHBEb^NoD zY(r@Lly+QtC$DYviPHMvXs@`k68+kFXP^=abUOb$Yp-9N=w|_E8jPYoAcnJ`mJ+60Ex{g01uBgd*NFxaN*0y;MOq(Rfy`} zT)m~vfSZSn*O`VABe@PwN#q_ZPLHUv%KN>`uRSS8sUnLVnOO%)|QPY=XMCzL(7^7487hCGcbRPBFFP zdMAQobLTq>(p<0Xf5Nx=rfe|tX-6sNc)jpAnEougWCMv**U=1)TrF_@if{WV@`u$$(xJZJlLG z*k6?GcYA21s8MUPb~Fa{AZ*huyOfsn&E>)4E)3iVjGH^z^%)riSL_=@1TE>Zc`!B% zCUtdTXoh!SB!4c(y0ER)K1UIU!GV6WqCh>0bB@D9mYQ|isJ3K23k;&@S)+k>aKnhp zh-Ua7b0oI3%(85fxEYY@$6+$lsO;~4*}^Zs)S5`^y)o1kpdu>XXyy2$2tSHCzSS8FgNG35yDauz{mlpkHB#vdE`6Rs z$v0Pq$FU@(l$9MgqWje?9hpdfheZX*(u>~0ue^+8OS}+5W%$>>+Zh^dzQ^%lc}4~X z#BfsL?Pa$oHuNN@F!+?qf>vh>VyB_M-t{K~BD>ry>|#%O$`j(aU#bGhk+sZ$5_FIi zUvW#piYRLV^cLlRkAt{q+gF!!*bVpr@~v1^ti|8h8x@IO;w^{^n?S$S$2ArudRBQ2 zt-GVa*uSTLvsT8Yywff{TMe>W!+=0LJYh*hC`6`4%FRhuhcitc-8QCpP66B-PefAA zPGGL}!)29%&^FP=YJB1fMI%Yg*H#yI#|^|5;_l}8JNf#ap<;ZQ0msltJ@>3WhPulO z_?r*5ygZtpv42^I&M1YEZ;h)=#`EKbYWUp2=3x_Pu}nbe9vVZYu(8<`sbV)699YW$ z3%b<4D7pQgYgFbl64EluWM2N_l527I(2o;1Etl&9&KD;gD0$c_rB<`ouVslQHv&ra z%K6Fh3Jy_79kjNWdcz-t-*p^&MbV1nOfLdEJ)kK_lq^@MPt3BN1D9Fd6Pft}vqeG~ zh~D>XB&RKX6t4$hw3N*Go0Yuia4Z|ynTjxQ6VgBu>P>_;uA<1F`f zR3lo9XZv|RZ$>A1iuDSkITV*C7tFJ5b;Gb>7tgZmv$Woyw?BcjDTB^ZZsI8p{*&=^ zqwXAU7G8%RFfST!9lm@N`1>NK8vHj7iQD_>TryX0dcSgn3Xd|}F(p0S&I((@1fK3e zp+WSPfRtMRZg>XzDWdliqm)hI-q(}&BJCPTtNNv#$!P|ic~1YpundlmYrrLkp44SR=G#r zzdOfjb|h4RV8-jTA8yj}| za3wHTbI4-X)mXccYRnKW16!^D5nY`dagf@!*I|LlhPyj=n}Tisr6jLiwcjyaSzxVw z0l6UYJBPJq$JjR1ixVzaJL->*PR6=wd)kdXI=_#W!yek$Vo+)R3&L37Mm?^)p)ZJq zzDKAi#>uEgZ@}WD2H2J@e4DHf=Ouh+j)<)X_*MfB3tY7NY(j0PWmqfo?Cw}K-nkHR zQb(+49qK@pqoH$c(IEU}2#0E5?jp(QOSc3rwm8K2g%1vLgEy6$Fnmkaqmp6-e%y`9dO>_@8Jl{Wm zP@u`^a_!UXZ4wmxbkPom%4sE3;!pZ>6wkesq=y9-Me-j=zN3;7f+SGI`i4slvo3Co z*nCZtp>P*YFCVfbqHgtDmW>vS0VXhlt%q2Z${Qz7J4q0-_lC**+d4$jk~o?YDoPZ8Da(>qWZ^CA^S6nbEB=MIo@+cD zcpF6o6J&Xk&MtDRE*{uC|9({|!K9R6h~t)ZE1A|%9Jl-k-P#JM#airwk{?CuMAI+j zm!LT^Gk1Z+!vDC!y_^?q8HOz;DgZePx|99%?Po>cMzaE@H3`)Mj$6E9Ue7f%G3qQ7s$DSoccd4iG;ROFq&hCZ;NR9(- zeA77uXr=b4FE3)D21w-*{U}TOwV`3l!ukw6+ej+#qnn|Su;lOmBeEn1>BWKtk`#<@Ho5NK#={0L85Dq@Cf0$8RUcIH>( zIaGAtHu3VB4Oo$Los2Lz9+=Sd0C6 zwKKhe4Xfxamm7gTfnPgM*lPM38Ioa4yW+yf$yFR59ffg>lfZ@GfXDzHun|&0hr6t( zpaB8ANooBgoQPohOLrehz8Nd4Wwf?;p>Wo*XJcy0v8q zVX|AI;O1?0Lqo%udo3#rzRnT#M{ubfY-z;-1KiTmQJ5g|CMC*{mThH5t0a#y$=Lk}nztJr4O ze}-SyN}++26&ILz?ZG^;_rJSeEyVV^;xOs-&leCyin*o)$h|*wy9Z(9Ona-VqI(O& zfoa1v!=p0wi>BQ^mTOZ))^jB9JfRhrO;kL_xHjO~lJl}Qa)Mu3OMiBC8hiIcuK62C?@)J(Q< z)>=C@gH;YTeXGBkpKxRs9Olz(o=qs(>PUjiDcRm(T{lh7sn-rTt`1h+CpB81@D%;e z_1nS5@+DSEcAA4M@X9v!r&PkoTJt0~lzraf2T)pr*;~U2yEINr%IzxnZIb3e1Y0mkN)# z8-JNq_*LmjWhjthUMzBGv_AG34#K-r169g35`+k@<03o9Z&yqT(q6v=;C8l+(XB)l zqyL<58ZBXxscXEsv1SoEn_#PBDxi;h>}(?Xu-1{cw@hY< zq^WieV-9yc0rnSguy35Ul+N~lFBJ?$XU=P7?dA{|VDRsYm;ChqiLPp8lWo)M&svy& zv|b5dYp}~((Cp!z!#r02Wv_M(Fkeh{Tnng@P+gmA0Sz#Ljs-Eh@J{02)253bevO$3 z{Q27Y!I#hHZ$PbSQIK+G3*64y8)QZawwD}?UYyZkxKKX7)BK>%Tf6b$)dlbm0wLO{ z<9YxQxNBfg2dwFO^$)BPqsfeq?1dHFBgCRv_tgdo97=DUEo!|?iI7A)0!h(r97%xP z+iWOKs!*l;GyGq6njp9@ym<0Xck}Mn3rOaT0P$!2Odh4jk+rM5-UX`*`+1Ok;tAb= zt=YXY3E1e;CSjx?-jR1+)O3A5i$^dkr2(CVP`~6?s~2xS8po{NlH6EekEdf?Vr(=S zuq^34-k7twi|o2_8d;-_8=5Af4jJnb?^6-iFl8O?gs~_@QySI+=LSeYKFKk9U1?s> z_;|SN7kM0;;=qu#oOM5{1a0{aC#RZq3%`*BFF_Xw6PQ4Frc$)ve?Wl;aQ3{;j_Egp|>8woG~bpSl@?)uKPgze`o7oUmB45!!}zyBf^5pS|D zZ=T6X{%{~A(!Leliy4HeG9x~JDb0}gbX%))MRbHsf#uH>6rcNr%yg@Na+zPl&vg%v z5PQ#OZ~@Z5Bn4*oJldgzxWP=sC(rv6x9QKMIXQUJb-&6Z^_O)I|FEW}ep67sIW1Wu zGH-0_og-Uy=*_sC_tW^#&UOm|r-C{+FWD*U$e)wSqhcD$u-D-4O;9D9Y4j>c^8}zA z$>Xv%6^JznR`l5d#3-}W&Yg9}2>%KjG-OpqW3O2=VeMgz6ko5jrA zf7MNDRyFiTOR-9UNAy9k-SB|#Z{vne)c+3F=>XR;fwK!r_NOu+t`*`lzes@!id~ta z_%WgArpckpyNDU2*qqek@G;x2@q4wyHw>mi^DU{=hQWgBuw?L(0BG)Xm}kkjWjh4Q zMc@P|@zv$NC*6JbbxKJ=YmWR(ba8qdFQ;~`$6Z@haK#6lXv?%VIJKqaTC1M7V zC5qTD@ZW9n{Tk>%bUKFd%no?+=61LwQP;kObnAfWc2E>}a)q_^ z&MTxWjL7zQEeBtZR?djhimS(;X--NX) z{X3PeKatBo0)0RfZByayXv{lA{U0aQD!dD797gkH612)I6ojG4n zdVxS)v5Yb$+0D;3RS`k`=g6Uva!UNhjnK9HWFYWHmey5^ib<3-X|Q1pH0br~_ z0F3%ynCj<;6Ry3!?WOI~yW4{!Z&w%FA7ZU~3SbbsS<;E*{tJ9hJXq;RK}r0XC5kD{wuLYm={ z0U*pplQ7z{0!Un%A;JWis1=IXhQUTJ$6p${R2=Cq37HCyH*cBdK@`90XXpZ3P=2X>C+?4$yC!u4&$%e8TCCX2BNzXhfJo3`IG7RTrg z#y`8<*RgB2$=7asgbpVng0Twh0(j2Nrn0L_OmA)*fzT)ys z_BOSye-0kK1yoD*uKY>;-kPaj6m-kRUYsrl`r@#<)id8F-kgZzcLM@{-NJ4`8rwbr zbtnaj$Z`}0``-~N@hx%Ncewe1d3%uKDuiYA#!o+E+)jFvac`-%d*Iu@G>X;7cd~?p zX^pqKV)HRF3vI0;^RKc7%a2lhW}%L~Vbr8&jj*76ELniuD-JIKmpxD{zs-WoQ%9gx zdYt1!chZuzoi#1-fD^sOZ_=k0##$}z7=e+X;+O_3YvF}ct~C~JP(@(x5kKM}8?#NB zUU=V2E&%pF?ysL~Zp-`M+Xj%cht)e3@6YuXS=tXfTW&J9{f04S3NPnhJKBYx(X^ta ze`TE9V8rO=cHh-{eKkmC5GwwiMlE2CVzd9oSZcc+sOOyjDlIMVZHO}b|_0Zh2kb48K%+4WQ44!TglUzGjt zZIV_uExP4Blyf%^w_n&JckG^f zUG|8ldO#v6%reDs40mAXWGfOi@2d3WapV8j)3paOy}ofKo3Px zywCeSpXZP7qXr`4vUcV9|7AMG;vf0{b#h&P!Jj8?#Ld(9HHF;HeoPk!EM zk`;u2CCsKL>O46HBL6z*sSGPQadG?sqQ(lt={v4nN1Wsr>EoU9E;nwS%X~PT>}{LM zPi?*54_(w68?%1->ADsvtk9*=ZbwGLf{V*fgb!WcL?s_I`pOGzz^?# zmmDTjn&dvMm2z(Jg&$sG?FWM?+jgwA?c;^#s{@&*UVvw!%UZ zzca-SnfakO2__FXco-xhcAm`Mi97eK`6ydBhF4_bAEITQc|gqlTbaV$ykUD=Aedun zC00+mb?Bu|R3AdsHefndp0V%?P-w#TDU2@g=h|q|$H_jix60&rv4y)XaTpjY?0^>*Lzm_a8Pzym$)olvsYQQ796&GF zRUZ{)vlj2BfI>Ce+@;$bm?=f{X(?WOa%Y%d&7Dy2SzG>23r>mi{B7i&jYzYr77Alq z5>m_$)IBRR`#8hl_}M07ZtytMdS z(_=aG2NtLcWq4=Fb&?g;@hRtk%jZ?|=W=43b3VJH{-+}MOj6x1F`~lru%x|r@GVNW zfZM+Jt=tl0v`ZWQqy1pt&s-(J-Ix`%`;MfU?D>KS@PE=s1|lZ$MXy>I_N+ z(MwQfrH*Z+x*q@rfD6GE2x+1Nv)jVL9^4MH?pJNxk<#%zr=ApSMG_6c?Hv<|qEs-aCwrSS=XV%3HSl(d0SI19*vB_^tX>R`ZbLNOtrXaKh2~fRN(bc{{SGY@Yum0ZV=`NfLB$R&q<~(qTNw)jb9hg z>GBUwQezeq%`Xn|f;l<#aj^AAVxjk7072-{LJMw1i8Z0jVeiKR1U zlJgsk!Y+LjXzZgST5UTeGR8r{85_a{g&smx6QSxS>XMQL!(SxWQf1(FNGOz_EY`jI zs3GcMRhs)nhFe{JvS5Woh;PogyF^smuxqZ_D|ec#x?AUq5dzS^qQi-2c2SErH_&Y& z&v)q@urp)jFxgzB2Klz#WeldSEmj9D4ZC>0GlvuPts8%R5xN2Gp1BKl$~106JCKxj#v z6pyiK<%1lfq;H1_S2kGvT0-4JSjr!XELOj@b19I3(s#mt?t%w~4kDLZd+7@au_&&DKdJSluaTe!Ef+@|5S_Lj?gN zJ#7iolBUuDGGh`uHMqybmu^Xa>fP^6h4Y3~tE5UK;%2ysH1>t}B2g={DS#dFy!Hr7 zPDP|+2~}z$c={tnC9=9ZC%MDF@Sj Date: Mon, 18 May 2026 02:09:42 -0700 Subject: [PATCH 34/62] studio/install: fix mac desktop shortcut spawning and lifecycle (#5496) * studio/install: fix mac desktop shortcut spawning and lifecycle The macOS .app generated by install.sh ships a shell-shim wrapper that is unsigned and has no NSAppleEventsUsageDescription in its Info.plist, so AppleEvents from the bundle are denied by TCC. The launcher's `osascript ... tell application "Terminal" to do script ...` call silently fails and the script falls back to the headless nohup branch, where the user sees no Terminal window at all. Each click of the Desktop shortcut then leaks an unattached server (no PID file, no cleanup) and the launcher times out after 60s without ever opening a browser. Replace the AppleScript spawn with a `.command` file + `open -a Terminal`. Terminal handles `.command` natively through Launch Services, no AppleEvents permission required, works with unsigned bundles. The new design also decouples the studio server from the Terminal: - Server is started via nohup, detached from any TTY. Warm relaunches (server still alive) hit the existing fast path: the launcher's `_find_healthy_port` returns the running port and the browser opens in ~80ms with no Terminal involvement. - The `.command` file is a log viewer (`tail -F` of studio.log), not the server's parent. It also runs a watcher subshell that polls the server PID and kills `tail` when the server exits. This means clicking "Stop server" in the UI causes the Terminal window to drop to no-running-processes state, so the user can close the window without the "Do you want to terminate running processes" dialog. - A trap on HUP/INT/TERM/EXIT in the `.command` file sends SIGTERM (then SIGKILL at +0.5s) to the server PID, so closing the Terminal window also stops Studio. Best of both worlds: fast warm relaunch AND "close terminal == quit Studio". Also: - Drop POLL_INTERVAL_SEC from 1 to 0.25. With Python studio startup at ~2s, the 1s poll added up to 1s of slack between server-ready and browser-open. 0.25s tightens cold-launch latency at no meaningful CPU cost. - Refuse to install the `.app` bundle through a symlink. If a prior install (e.g. a --tauri build) left $HOME/Applications/Unsloth\\ Studio.app as a symlink, mkdir -p follows it and writes the new bundle contents through to the target. Detect and rm the symlink before mkdir -p. Test plan: - Existing studio-mac-update-smoke.yml CI runs install.sh end-to-end on macos-14 and asserts /api/health returns healthy. - Manual: click Desktop shortcut from cold state, Terminal opens with logs streaming, browser opens at ~2s. Re-click while Studio still running, browser opens in <200ms, no new Terminal. Click "Stop server" in the UI, Terminal closes cleanly with no prompt. Close Terminal via Cmd+W, server stops within 1s. * studio/install: trim verbose comments in _spawn_terminal * studio/install: harden trap quoting in generated .command The trap bodies in the .command file were written with broken quoting: trap "rm -f "$PID_FILE" 2>/dev/null" EXIT Shell parses this as three concatenated tokens ("rm -f " + unquoted $PID_FILE + " 2>/dev/null") then runs the trap. With paths that contain spaces, the unquoted expansion word-splits and the rm either no-ops or removes the wrong path. Default $HOME has no spaces so the bug is latent, but it should be space-safe. Switch both trap bodies to single-quoted form so $WATCHER_PID, $TAIL_PID, and $PID_FILE expand at signal time inside properly quoted positions. Shellcheck-clean on the generated .command. * studio/install: exec studio in nohup wrapper so PID is the server Without the explicit exec, `nohup sh -c "$_cmd"` runs `_cmd` as a child of the wrapper shell. Whether sh exec-optimizes that single command is shell-specific (macOS /bin/sh does, dash does, some bash configurations do not). When the optimization does not fire, `$!` records the wrapper PID rather than the studio PID, so: - the watcher in the generated .command monitors the wrapper, not the actual studio process; closing the Terminal can leave studio running if the wrapper exits first - SIGTERM from shutdown_studio goes to the wrapper rather than the server Force the replacement with exec so the recorded PID is always the studio process regardless of shell version. Flagged by both gemini-code-assist and codex in PR review; verified correct. * Fix orphan-on-spawn-failure, graceful kill, and nested symlink for PR #5496 Three issues found while testing the new macOS spawn path: 1. _spawn_terminal returned 0 even when 'open -a Terminal' failed, so the nohup'd server was left orphaned with no Terminal owner. Wrap the .command write + chmod + open chain in 'if {...}; then return 0; fi', and on failure SIGTERM the orphan (with a 3s grace) before falling through to the generic terminal-spawn fallback. 2. The generated .command sent SIGKILL only 0.5s after SIGTERM, shorter than studio/backend/run.py's _graceful_shutdown windows (5s inference + 5s export). Wait up to 12s for the server to exit on its own. 3. The .app symlink guard only checked the top-level path. If a prior corrupted install left Unsloth Studio.app/Contents (or its MacOS or Resources children) as a symlink, mkdir -p still wrote through them. Check all four bundle paths, and refuse to continue if the bundle path exists as a regular file. --------- Co-authored-by: Daniel Han --- install.sh | 75 +++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 71 insertions(+), 4 deletions(-) diff --git a/install.sh b/install.sh index 9046a9bdf6..c7852c7539 100755 --- a/install.sh +++ b/install.sh @@ -572,7 +572,7 @@ fi BASE_PORT=8888 MAX_PORT_OFFSET=20 TIMEOUT_SEC=60 -POLL_INTERVAL_SEC=1 +POLL_INTERVAL_SEC=0.25 LOG_FILE="$DATA_DIR/studio.log" # why: in env-override mode multiple installs share an OS user; namespace the # lock and remember our own healthy port so we never attach to an unrelated @@ -727,9 +727,65 @@ _spawn_terminal() { _cmd="$1" _os=$(uname) if [ "$_os" = "Darwin" ]; then - # Escape backslashes and double-quotes for AppleScript string - _cmd_escaped=$(printf '%s' "$_cmd" | sed 's/\\/\\\\/g; s/"/\\"/g') - osascript -e "tell application \"Terminal\" to do script \"$_cmd_escaped\"" >/dev/null 2>&1 && return 0 + # AppleEvents are TCC-denied from unsigned .app bundles; spawn + # Terminal via a .command file + Launch Services instead. Server + # is nohup'd so warm relaunches hit the fast-path; watcher + trap + # in the .command couple Terminal close <-> server shutdown. + # `exec` keeps the recorded PID equal to the studio process so + # signals reach studio directly rather than a wrapper shell. + nohup sh -c "exec $_cmd" >> "$LOG_FILE" 2>&1 & + _server_pid=$! + _pid_file="$DATA_DIR/studio-$_launch_port.pid" + printf '%d\n' "$_server_pid" > "$_pid_file" 2>/dev/null || true + + _cmd_file="$DATA_DIR/launch-terminal.command" + _logfile_q=$(printf '%s' "$LOG_FILE" | sed "s/'/'\\\\''/g") + _pidfile_q=$(printf '%s' "$_pid_file" | sed "s/'/'\\\\''/g") + if { + { + printf '#!/bin/bash\n' + printf "SERVER_PID=%s\n" "$_server_pid" + printf "PID_FILE='%s'\n" "$_pidfile_q" + # Wait up to 12s for graceful shutdown before SIGKILL. + printf 'shutdown_studio() {\n' + printf ' kill -TERM "$SERVER_PID" 2>/dev/null\n' + printf ' _i=0\n' + printf ' while kill -0 "$SERVER_PID" 2>/dev/null && [ "$_i" -lt 24 ]; do\n' + printf ' sleep 0.5\n' + printf ' _i=$((_i + 1))\n' + printf ' done\n' + printf ' kill -0 "$SERVER_PID" 2>/dev/null && kill -KILL "$SERVER_PID" 2>/dev/null\n' + printf ' rm -f "$PID_FILE" 2>/dev/null\n' + printf '}\n' + printf "tail -n 100 -F '%s' &\n" "$_logfile_q" + printf 'TAIL_PID=$!\n' + # Server gone -> kill tail so bash exits cleanly. + printf '(\n' + printf ' while kill -0 "$SERVER_PID" 2>/dev/null; do sleep 1; done\n' + printf ' kill "$TAIL_PID" 2>/dev/null\n' + printf ') &\n' + printf 'WATCHER_PID=$!\n' + printf "trap 'shutdown_studio; kill \"\$WATCHER_PID\" \"\$TAIL_PID\" 2>/dev/null; exit' HUP INT TERM\n" + printf "trap 'rm -f \"\$PID_FILE\" 2>/dev/null' EXIT\n" + printf 'wait "$TAIL_PID" 2>/dev/null\n' + } > "$_cmd_file" 2>/dev/null \ + && chmod +x "$_cmd_file" 2>/dev/null \ + && open -a Terminal "$_cmd_file" 2>/dev/null + }; then + # Foreground Terminal (Launch Services spawns us backgrounded). + osascript -e 'tell application "Terminal" to activate' >/dev/null 2>&1 || true + return 0 + fi + # .command/open failed: kill orphan, fall through to generic fallback. + kill -TERM "$_server_pid" 2>/dev/null || true + _i=0 + while kill -0 "$_server_pid" 2>/dev/null && [ "$_i" -lt 6 ]; do + sleep 0.5 + _i=$((_i + 1)) + done + kill -0 "$_server_pid" 2>/dev/null && kill -KILL "$_server_pid" 2>/dev/null || true + rm -f "$_pid_file" 2>/dev/null || true + echo "[WARN] Could not open Terminal; falling back to background launch" >&2 else for _term in gnome-terminal konsole xfce4-terminal mate-terminal lxterminal xterm; do if command -v "$_term" >/dev/null 2>&1; then @@ -1005,6 +1061,17 @@ DESKTOP_EOF _css_contents="$_css_app/Contents" _css_macos_dir="$_css_contents/MacOS" _css_res_dir="$_css_contents/Resources" + # Recreate bundle if root or any subpath is a symlink (mkdir -p follows them). + if [ -L "$_css_app" ] || [ -L "$_css_contents" ] \ + || [ -L "$_css_macos_dir" ] || [ -L "$_css_res_dir" ]; then + rm -rf "$_css_app" 2>/dev/null || { + echo "[ERROR] $_css_app contains a symlinked bundle path; remove manually and re-run install" >&2 + return 1 + } + elif [ -e "$_css_app" ] && [ ! -d "$_css_app" ]; then + echo "[ERROR] $_css_app exists but is not a directory; remove manually and re-run install" >&2 + return 1 + fi mkdir -p "$_css_macos_dir" "$_css_res_dir" # Info.plist From c41ce170ec118f23e4ebdb0c1dceb44f0f230d81 Mon Sep 17 00:00:00 2001 From: Michael Han <107991372+shimmyshimmer@users.noreply.github.com> Date: Mon, 18 May 2026 02:11:05 -0700 Subject: [PATCH 35/62] studio: add uninstall.sh and document it in README (#5497) * studio: add uninstall.sh and document it in README The current uninstall guidance in README.md is `rm -rf ~/.unsloth/studio`, which leaves behind everything that lives outside that path: - ~/.local/share/unsloth/ (launcher script, studio.conf, studio.log, icon assets) - ~/Applications/Unsloth Studio.app (macOS bundle, orphaned and pointing nowhere on next reinstall) - ~/Desktop/Unsloth Studio (broken symlink after the bundle is gone) - ~/Desktop/unsloth-studio.desktop (Linux) - ~/.local/share/applications/unsloth-studio.desktop (Linux) - /tmp/unsloth-studio-launcher-*.lock (lock dir, possibly stale) - Launch Services cache entry for ai.unsloth.studio on macOS - Any running `unsloth studio -p N` processes Users who follow the documented uninstall and reinstall end up with the new launcher layered on top of stale state from the previous install, which has produced concrete bugs (e.g. self-referential symlink inside the .app bundle after a reinstall over leftover state). Add uninstall.sh at the repo root that handles all of the above, and update README.md to point at it as the recommended path. The plain `rm -rf ~/.unsloth/studio` line is kept as a "partial uninstall, keep launcher for a later reinstall" alternative. The model cache at ~/.cache/huggingface is intentionally left untouched, with a note in the script suggesting how to remove it if desired. Script is POSIX sh, idempotent (every removal is gated on existence and uses `2>/dev/null || true`), and handles macOS, Linux, and WSL. Windows is intentionally not covered here; the existing PowerShell Remove-Item line in README is kept for that. * studio: trim uninstall.sh header * studio: address PR review feedback on uninstall.sh Four findings from automated review, all verified real: 1. pkill pattern only matched `-p N`, not `--port N`. Studio instances launched with the long option form survived the uninstall. Fix: run two pkill passes, one for each form, with `[ =]` covering both space and `=` separators. 2. CLI shim at ~/.local/bin/unsloth (symlink into the venv created by install.sh:2167) was left behind, becoming a broken symlink after the venv directory is removed. Fix: add it to the removals. 3. Custom install roots via UNSLOTH_STUDIO_HOME / STUDIO_HOME were not removed. install.sh records the install location in ~/.local/share/unsloth/studio.conf as UNSLOTH_EXE; parse it, derive the root as three dirnames up, and remove the root if it is non-default. 4. On WSL the installer creates 'Unsloth Studio.lnk' on the Windows Desktop and Start Menu Programs folder via powershell.exe. Mirror that path on uninstall by invoking powershell.exe to Remove-Item the same two locations. Best-effort, gated on powershell.exe being available. Tests (T2.8b, T2.15, T2.16, T2.17, T2.18, T2.5b) added behind the scenes; all pass on macOS Darwin 25.3 with `dash -n`, `sh -n`, shellcheck-clean (SC2016 suppressed on the PowerShell single-quoted heredoc since the $env: expansions must remain literal to the shell so PowerShell receives them verbatim). * studio: harden uninstall.sh against env-mode and shim collisions - Honor UNSLOTH_STUDIO_HOME / STUDIO_HOME at uninstall time and read env-mode studio.conf at $/share/studio.conf, not just the default-mode conf under $HOME/.local/share/unsloth/. Without this, installs done with a custom STUDIO_HOME leak the install tree even when the env var is re-exported. - Guard the custom-root resolver against "/" and empty so a corrupted studio.conf (UNSLOTH_EXE='/etc/passwd' or similar) or an UNSLOTH_STUDIO_HOME=/ cannot trick the script into rm -rf'ing root. - Only remove $HOME/.local/bin/unsloth when it is a symlink resolving to a Studio venv. pyproject.toml declares unsloth as a console script, so pip install --user unsloth places a regular file at the same path; the previous unconditional rm wiped that unrelated CLI. - When neither env var is set, print a tail hint so users with custom install roots know to re-run with the variable. Verified with a sandboxed harness covering 24 scenarios (default and env-mode installs across macOS / Linux / WSL, idempotency, hostile lockfile names, path-traversal attempts, malformed conf, pkill long and short forms, pip-conflict shim, broken-symlink bundle path). Script remains POSIX (shellcheck -s sh clean, runs under /bin/dash). Co-Authored-By: Claude Opus 4.7 (1M context) * Refuse non-Studio uninstall roots and tighten process matching for PR #5497 Three issues found while testing custom-root paths and process cleanup: 1. UNSLOTH_STUDIO_HOME=$HOME sh uninstall.sh rm -rf'd $HOME (same for STUDIO_HOME and parent-of-$HOME). install.sh accepts any writable directory for STUDIO_HOME, so the uninstaller must validate ownership before deletion. _is_studio_root accepts a candidate root only if it contains share/studio.conf, an unsloth_studio/ directory, or a bin/unsloth shim pointing into unsloth_studio/bin. _is_unsafe_root is a defense-in-depth deny list (/, $HOME, $HOME's parent, system paths). 2. pkill -f patterns "unsloth studio.*-p[ =][0-9]" over-matched on argv substrings. A user running `less notes.md` whose filename contained "unsloth studio ... -p N" had their less killed. New patterns anchor on /unsloth_studio/bin/ so only processes whose actual exe lives in a Studio venv match. 3. pkill missed processes that exec into studio/backend/run.py --port N (the post-exec form when the unsloth CLI replaces itself). Added a third pattern for that shape, and prefer PID files written by install.sh's _spawn_terminal (studio-$port.pid in DATA_DIR) over argv matching for installs that have them. * Tighten ownership guards from review round for PR #5497 Three findings from the second reviewer round: 1. _is_studio_root accepted any directory containing an unsloth_studio/ subdir as Studio-owned. A user workspace that happens to contain a folder named unsloth_studio/ would be deleted. install.sh's env-mode guard at install.sh:1358-1361 already requires .unsloth-studio-owned before treating the venv as replaceable. Mirror that: require the owner marker, share/studio.conf, or the bin/unsloth shim target. 2. The pkill -f fallback patterns were global, so uninstalling install A would also kill install B's running server. Scope each pattern to the actual install root being removed by interpolating the root path into the regex. Also adds a third pattern shape for `unsloth studio` with no -p / --port flag (the CLI default-port form). 3. Desktop/Unsloth Studio is created by install.sh as a symlink to the .app bundle. If a user has a regular directory by that name (photos, notes, etc.), the previous _remove_path call rm -rf'd it. Now we only remove it when it is a symlink or does not exist. * Canonicalize env roots and honor UNSLOTH_STUDIO_HOME precedence for PR #5497 Two findings from the latest review round: 1. Canonicalize env-derived roots before the safety check. The deny list only string-compares against $HOME, so a syntactic variant like UNSLOTH_STUDIO_HOME=$HOME/../$USER (or trailing slash, or relative path) bypassed _is_unsafe_root even though it resolves to $HOME. Now _emit runs CDPATH= cd -P -- + pwd -P first, so all variants normalize to the same canonical path before the deny check. Also added the same tilde expansion install.sh's _resolve_studio_destinations does. 2. Mirror install.sh's env-var precedence (install.sh:282-290). When both UNSLOTH_STUDIO_HOME and STUDIO_HOME are set, install.sh resolves only UNSLOTH_STUDIO_HOME and ignores STUDIO_HOME. Uninstall was emitting both, so running uninstall.sh for install A would also delete install B if the user had a stale STUDIO_HOME pointing at B. --------- Co-authored-by: Claude Opus 4.7 (1M context) Co-authored-by: Daniel Han --- README.md | 6 +- uninstall.sh | 283 +++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 287 insertions(+), 2 deletions(-) create mode 100755 uninstall.sh diff --git a/README.md b/README.md index a654518d14..949167283d 100644 --- a/README.md +++ b/README.md @@ -218,11 +218,13 @@ unsloth studio -p 8888 ``` #### Uninstall -You can uninstall Unsloth Studio by deleting its install folder usually located under `$HOME/.unsloth/studio` on Mac/Linux/WSL and `%USERPROFILE%\.unsloth\studio` on Windows. Using the `rm -rf` commands will **delete everything**, including your history, cache: +On Mac/Linux/WSL the recommended way to fully remove Unsloth Studio is the `uninstall.sh` script. It stops any running servers, removes the install dir, the launcher data dir, the desktop shortcut, the macOS `.app` bundle, and the Launch Services entry: -* ​ **MacOS, WSL, Linux:** `rm -rf ~/.unsloth/studio` +* ​ **MacOS, WSL, Linux:** `curl -fsSL https://unsloth.ai/uninstall.sh | sh` * ​ **Windows (PowerShell):** `Remove-Item -Recurse -Force "$HOME\.unsloth\studio"` +If you only want to drop the install dir and keep the launcher/shortcut for a later reinstall, you can instead run `rm -rf ~/.unsloth/studio`. The model cache at `~/.cache/huggingface` is not touched by either command. + For more info, [see our docs](https://unsloth.ai/docs/new/studio/install#uninstall). #### Deleting model files diff --git a/uninstall.sh b/uninstall.sh new file mode 100755 index 0000000000..7fbdc8dfac --- /dev/null +++ b/uninstall.sh @@ -0,0 +1,283 @@ +#!/usr/bin/env sh +# Unsloth Studio uninstaller (macOS / Linux / WSL). +# Stops running servers and removes install dir, launcher data, +# CLI shim, desktop shortcut, .app bundle, and Launch Services entry. +# Honors custom roots set via UNSLOTH_STUDIO_HOME / STUDIO_HOME at +# install time (read back from studio.conf). +# +# Usage: curl -fsSL https://unsloth.ai/uninstall.sh | sh + +set -e + +# Stop a Studio server via its PID file (written by install.sh's _spawn_terminal). +_kill_pid_file() { + _pid_file="$1" + [ -f "$_pid_file" ] || return 0 + _pid=$(sed -n '1s/[^0-9].*//p' "$_pid_file" 2>/dev/null || true) + if [ -n "$_pid" ] && kill -0 "$_pid" 2>/dev/null; then + kill -TERM "$_pid" 2>/dev/null || true + # Wait up to 10s for graceful shutdown. + _i=0 + while kill -0 "$_pid" 2>/dev/null && [ "$_i" -lt 20 ]; do + sleep 0.5 + _i=$((_i + 1)) + done + kill -0 "$_pid" 2>/dev/null && kill -KILL "$_pid" 2>/dev/null || true + fi + rm -f "$_pid_file" 2>/dev/null || true +} + +# BRE-escape a path so it can be embedded in a pkill -f regex. +_pkill_escape() { + printf '%s' "$1" | sed -e 's:[][\\.^$*+?{|}()/]:\\&:g' +} + +_pkill_studio() { + # Prefer PID files written by _spawn_terminal so we only touch our own installs. + for _data_dir in "$HOME/.local/share/unsloth" $(_custom_studio_data_dirs); do + [ -d "$_data_dir" ] || continue + for _pf in "$_data_dir"/studio-*.pid; do + [ -f "$_pf" ] && _kill_pid_file "$_pf" + done + done + + command -v pkill >/dev/null 2>&1 || return 0 + + # Scope fallback patterns to the install roots we are removing so a + # different Studio install (different UNSLOTH_STUDIO_HOME) is not touched. + _kill_roots="$HOME/.unsloth/studio" + _roots_from_conf=$(_custom_studio_roots 2>/dev/null || true) + [ -n "$_roots_from_conf" ] && _kill_roots="$_kill_roots +$_roots_from_conf" + + printf '%s\n' "$_kill_roots" | while IFS= read -r _root; do + [ -n "$_root" ] || continue + [ -d "$_root" ] || continue + _re=$(_pkill_escape "$_root") + # `unsloth studio` (default port) + `-p N` + `--port N` forms, all + # anchored on the install root's venv path. + for _pat in \ + "${_re}/unsloth_studio/bin/[^ ]* studio( |\$|.*-p[ =][0-9])" \ + "${_re}/unsloth_studio/bin/[^ ]* studio.*--port[ =][0-9]" \ + "${_re}/.*studio/backend/run\.py" + do + pkill -TERM -f "$_pat" 2>/dev/null || true + done + done + sleep 0.5 + printf '%s\n' "$_kill_roots" | while IFS= read -r _root; do + [ -n "$_root" ] || continue + [ -d "$_root" ] || continue + _re=$(_pkill_escape "$_root") + for _pat in \ + "${_re}/unsloth_studio/bin/[^ ]* studio( |\$|.*-p[ =][0-9])" \ + "${_re}/unsloth_studio/bin/[^ ]* studio.*--port[ =][0-9]" \ + "${_re}/.*studio/backend/run\.py" + do + pkill -KILL -f "$_pat" 2>/dev/null || true + done + done +} + +_remove_path() { + _p="$1" + if [ -e "$_p" ] || [ -L "$_p" ]; then + rm -rf "$_p" 2>/dev/null && echo " removed: $_p" || echo " could not remove: $_p" >&2 + fi +} + +# Accept as Studio root only if Studio sentinels exist (matches install.sh's +# env-mode ownership guard at install.sh:1358-1361). A bare unsloth_studio/ +# directory is NOT enough -- require the install-time owner marker so a user +# directory that happens to contain a folder named "unsloth_studio" is safe. +_is_studio_root() { + _r="$1" + [ -n "$_r" ] || return 1 + [ -f "$_r/share/studio.conf" ] && return 0 + [ -f "$_r/unsloth_studio/.unsloth-studio-owned" ] && return 0 + if [ -L "$_r/bin/unsloth" ]; then + _t=$(readlink "$_r/bin/unsloth" 2>/dev/null || true) + case "$_t" in *unsloth_studio/bin/unsloth) return 0 ;; esac + fi + return 1 +} + +# Hard deny list: never delete /, $HOME, $HOME's parent, or system paths. +_is_unsafe_root() { + _r="$1" + [ -z "$_r" ] && return 0 + case "$_r" in /|""|"$HOME"|"$HOME/") return 0 ;; esac + case "$_r" in /bin|/sbin|/etc|/usr|/usr/*|/var|/var/*|/opt|/opt/*|/Library|/Library/*|/System|/System/*|/Applications|/Applications/*) return 0 ;; esac + _parent=$(dirname "$HOME" 2>/dev/null || echo "") + [ -n "$_parent" ] && [ "$_r" = "$_parent" ] && return 0 + return 1 +} + +# Print share/ dirs of known custom roots (where PID files live). +_custom_studio_data_dirs() { + _custom_studio_roots 2>/dev/null | while IFS= read -r _r; do + [ -d "$_r/share" ] && printf '%s\n' "$_r/share" + done +} + +# Resolve a custom install root from any of: +# 1. UNSLOTH_STUDIO_HOME / STUDIO_HOME env vars at uninstall time +# 2. Default-mode studio.conf at $HOME/.local/share/unsloth/studio.conf +# 3. Env-mode studio.conf at $/share/studio.conf (discovered via 1) +# install.sh writes UNSLOTH_EXE='/unsloth_studio/bin/unsloth', so +# the install root is three dirnames up. Prints each discovered non-default +# root on its own line; the caller iterates and de-duplicates. +_custom_studio_roots() { + _seen="" + _emit() { + _r="$1" + [ -z "$_r" ] && return 0 + # Tilde expansion (env vars are not subject to it on quoted assignment), + # matches install.sh's _resolve_studio_destinations. The literal "~/" + # pattern is intentional; SC2088 is a false positive here. + # shellcheck disable=SC2088 + case "$_r" in + "~") _r="$HOME" ;; + "~/"*) _r="$HOME/${_r#'~/'}" ;; + esac + # Canonicalize so syntactic variants ($HOME/../$USER, trailing slash) + # resolve to the same path and hit the _is_unsafe_root deny list. + # shellcheck disable=SC1007 + _canon=$(CDPATH= cd -P -- "$_r" 2>/dev/null && pwd -P) + [ -n "$_canon" ] && _r="$_canon" + case "$_r" in "$HOME/.unsloth/studio"|/|"") return 0 ;; esac + case ":$_seen:" in *":$_r:"*) return 0 ;; esac + _seen="$_seen:$_r" + printf '%s\n' "$_r" + } + _from_conf() { + [ -f "$1" ] || return 0 + # Tolerate paths containing apostrophes (install.sh emits '\'' for them). + _exe=$(sed -n "s/^UNSLOTH_EXE='\(.*\)'\$/\1/p" "$1" | head -n1) + _exe=$(printf '%s' "$_exe" | sed "s/'\\\\''/'/g") + [ -n "$_exe" ] || return 0 + _emit "$(dirname "$(dirname "$(dirname "$_exe")")")" + } + # Mirror install.sh's precedence: UNSLOTH_STUDIO_HOME wins, STUDIO_HOME is + # ignored when both are set. Otherwise uninstalling install A could also + # delete install B if the user has STUDIO_HOME left over from B. + if [ -n "${UNSLOTH_STUDIO_HOME:-}" ]; then + _emit "$UNSLOTH_STUDIO_HOME" + _from_conf "$UNSLOTH_STUDIO_HOME/share/studio.conf" + elif [ -n "${STUDIO_HOME:-}" ]; then + _emit "$STUDIO_HOME" + _from_conf "$STUDIO_HOME/share/studio.conf" + fi + # Default-mode conf. + _from_conf "$HOME/.local/share/unsloth/studio.conf" +} + +# Remove $HOME/.local/bin/unsloth only if it's a Studio-managed symlink. +# Studio's install.sh writes this as a symlink into the studio venv +# (install.sh: `ln -sfn "$VENV_DIR/bin/unsloth" "$_shim_path"`). A +# pip-installed `unsloth` CLI is a regular file — leave it alone to avoid +# wiping an unrelated install. +_remove_cli_shim() { + _shim="$HOME/.local/bin/unsloth" + [ -L "$_shim" ] || return 0 + _target=$(readlink "$_shim" 2>/dev/null || true) + case "$_target" in + */unsloth_studio/bin/unsloth) _remove_path "$_shim" ;; + *) ;; + esac +} + +_uid=$(id -u 2>/dev/null || echo 0) +_os=$(uname 2>/dev/null || echo unknown) +_is_wsl=0 +[ "$_os" = "Linux" ] && grep -qi microsoft /proc/version 2>/dev/null && _is_wsl=1 + +echo "Stopping any running Unsloth Studio servers..." +_pkill_studio + +echo "Removing data and install directories..." +_custom_studio_roots | while IFS= read -r _custom_root; do + [ -n "$_custom_root" ] || continue + if _is_unsafe_root "$_custom_root"; then + echo " refusing to remove unsafe path: $_custom_root" >&2 + continue + fi + if ! _is_studio_root "$_custom_root"; then + echo " refusing to remove non-Studio path: $_custom_root" >&2 + continue + fi + _remove_path "$_custom_root" +done +_remove_path "$HOME/.unsloth/studio" +_remove_path "$HOME/.local/share/unsloth" +# CLI shim: only the symlink Studio created, never a pip-installed file. +_remove_cli_shim + +echo "Removing desktop shortcut and launcher lock..." +# install.sh creates Desktop/Unsloth Studio as a symlink. If the user has an +# unrelated regular directory by that name, leave it alone. +_desktop_link="$HOME/Desktop/Unsloth Studio" +if [ -L "$_desktop_link" ] || [ ! -e "$_desktop_link" ]; then + _remove_path "$_desktop_link" +else + echo " refusing to remove non-symlink Desktop path: $_desktop_link" >&2 +fi +_remove_path "$HOME/Desktop/unsloth-studio.desktop" +# Locks are namespaced per-uid; env-mode adds an extra suffix. +_lock_glob="${XDG_RUNTIME_DIR:-/tmp}/unsloth-studio-launcher-${_uid}" +for _lock in "$_lock_glob".lock "$_lock_glob"-*.lock; do + [ -e "$_lock" ] && _remove_path "$_lock" +done + +case "$_os" in + Darwin) + echo "Removing macOS .app bundle and Launch Services entry..." + _remove_path "$HOME/Applications/Unsloth Studio.app" + _lsr="/System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsregister" + if [ -x "$_lsr" ]; then + "$_lsr" -u "$HOME/Applications/Unsloth Studio.app" 2>/dev/null || true + fi + ;; + Linux) + if [ "$_is_wsl" = "1" ]; then + echo "Removing WSL Windows-side shortcuts..." + # install.sh creates 'Unsloth Studio.lnk' on the Windows Desktop and + # Start Menu Programs folder via powershell.exe; mirror that path. + if command -v powershell.exe >/dev/null 2>&1; then + # shellcheck disable=SC2016 + # $env:APPDATA is a PowerShell expansion; intentionally literal at shell level. + powershell.exe -NoProfile -Command ' + $names = @("Desktop","StartMenu"); + $dirs = @( + [Environment]::GetFolderPath("Desktop"), + (Join-Path $env:APPDATA "Microsoft\Windows\Start Menu\Programs") + ); + foreach ($d in $dirs) { + if (-not $d) { continue } + $p = Join-Path $d "Unsloth Studio.lnk"; + if (Test-Path -LiteralPath $p) { Remove-Item -LiteralPath $p -Force } + }' >/dev/null 2>&1 || true + fi + fi + echo "Removing Linux .desktop entry..." + _remove_path "$HOME/.local/share/applications/unsloth-studio.desktop" + if command -v update-desktop-database >/dev/null 2>&1; then + update-desktop-database "$HOME/.local/share/applications" 2>/dev/null || true + fi + ;; +esac + +echo "" +echo "Unsloth Studio uninstalled." +echo "Note: Hugging Face model cache at ~/.cache/huggingface was left in place." +echo "Remove it manually with 'rm -rf ~/.cache/huggingface/hub' if desired." +# Env-mode installs leave no breadcrumb in $HOME, so a custom root can +# only be located if the user re-exports the variable. Print a hint when +# neither var is set so the bare `curl | sh` flow doesn't silently miss. +if [ -z "${UNSLOTH_STUDIO_HOME:-}" ] && [ -z "${STUDIO_HOME:-}" ]; then + echo "" + echo "If you installed Unsloth Studio with UNSLOTH_STUDIO_HOME or STUDIO_HOME" + echo "pointing at a custom directory, re-run this script with the same variable" + echo "set to also remove that install tree, e.g.:" + echo " UNSLOTH_STUDIO_HOME=/your/path sh uninstall.sh" +fi From 9b8ee6c7736d58f72c70bf8631fab065ef236b46 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 02:11:52 -0700 Subject: [PATCH 36/62] Studio update CI: round-trip install -> update -> uninstall (#5536) * Studio update CI: round-trip install -> update -> uninstall Adds an "Uninstall and verify clean" step to the three existing studio-{,-mac-,-windows-}update-smoke.yml workflows so each one ends by running uninstall.sh / uninstall.ps1 against the install it just produced, then asserting that the install dir, launcher data dir, desktop shortcut, CLI shim (and on Mac, the .app bundle) are all gone. Two trailing reruns confirm idempotency. The uninstall log is added to the existing artifact bundle. Catches regressions where install.sh / install.ps1 starts writing to a new path (registry key, Start Menu entry, %APPDATA% subdir, etc.) and uninstall.{sh,ps1} has not been updated to match. Safety-guard scenarios (refuse-\$HOME, refuse-non-Studio, tilde expansion, etc.) are intentionally NOT exercised here -- those belong in a dedicated fast smoke job that does not have to wait on a 5-15 min install. Wall-clock overhead is ~30-45 s on each runner. Path filters extended to include uninstall.sh / uninstall.ps1 so a pure uninstaller change also triggers the round-trip check. * Skip round-trip step when uninstall.{sh,ps1} are not in tree --------- Co-authored-by: Daniel Han --- .github/workflows/studio-mac-update-smoke.yml | 34 ++++++++++++++++ .github/workflows/studio-update-smoke.yml | 39 ++++++++++++++++++- .../workflows/studio-windows-update-smoke.yml | 35 +++++++++++++++++ 3 files changed, 107 insertions(+), 1 deletion(-) diff --git a/.github/workflows/studio-mac-update-smoke.yml b/.github/workflows/studio-mac-update-smoke.yml index 07d26b9ab3..cfa192b470 100644 --- a/.github/workflows/studio-mac-update-smoke.yml +++ b/.github/workflows/studio-mac-update-smoke.yml @@ -21,6 +21,7 @@ on: pull_request: paths: - 'install.sh' + - 'uninstall.sh' - 'studio/setup.sh' - 'studio/install_python_stack.py' - 'studio/install_llama_prebuilt.py' @@ -137,6 +138,38 @@ jobs: kill "$PID" 2>/dev/null || true echo "post-update Studio /api/health OK" + - name: Uninstall and verify clean + # Round-trip through uninstall.sh on real macOS. As a side effect + # this exercises the macOS-only .app bundle + Launch Services + # removal path (~/Applications/Unsloth Studio.app, lsregister -u) + # which is not testable from a Linux runner. Skips gracefully if + # uninstall.sh has not landed yet (lets this workflow merge + # before #5497). + run: | + set -o pipefail + if [ ! -f uninstall.sh ]; then + echo "uninstall.sh not present in this tree; skipping round-trip" + : > logs/uninstall.log + exit 0 + fi + sh uninstall.sh 2>&1 | tee logs/uninstall.log + leak=0 + for p in \ + "$HOME/.unsloth/studio" \ + "$HOME/.local/share/unsloth" \ + "$HOME/Applications/Unsloth Studio.app" \ + "$HOME/Desktop/Unsloth Studio.app" \ + "$HOME/.local/bin/unsloth"; do + if [ -e "$p" ] || [ -L "$p" ]; then + echo "::error::leak: $p" + leak=$((leak + 1)) + fi + done + [ "$leak" -eq 0 ] || exit 1 + sh uninstall.sh 2>&1 | tail -5 + sh uninstall.sh 2>&1 | tail -5 + echo "PASS: mac install -> update -> uninstall round-trip clean" + - name: Upload update logs if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -147,4 +180,5 @@ jobs: logs/update.log logs/update2.log logs/studio.log + logs/uninstall.log retention-days: 7 diff --git a/.github/workflows/studio-update-smoke.yml b/.github/workflows/studio-update-smoke.yml index 1c353e933a..b28e2bf0bd 100644 --- a/.github/workflows/studio-update-smoke.yml +++ b/.github/workflows/studio-update-smoke.yml @@ -15,6 +15,7 @@ on: pull_request: paths: - 'install.sh' + - 'uninstall.sh' - 'studio/setup.sh' - 'studio/install_python_stack.py' - 'studio/install_llama_prebuilt.py' @@ -139,9 +140,44 @@ jobs: kill "$PID" 2>/dev/null || true echo "post-update Studio /api/health OK" + - name: Uninstall and verify clean + # Round-trip the installer through uninstall.sh: confirms the + # uninstaller actually finds and removes everything install.sh + + # update wrote. Safety-guard scenarios (refuse-$HOME etc.) belong + # in a separate fast smoke job; this is the happy-path cleanup + # assertion that catches regressions where install.sh starts + # writing to a new location and uninstall.sh hasn't caught up. + # Skips gracefully if uninstall.sh has not landed yet (lets this + # workflow merge before #5497). + run: | + set -o pipefail + if [ ! -f uninstall.sh ]; then + echo "uninstall.sh not present in this tree; skipping round-trip" + : > logs/uninstall.log + exit 0 + fi + sh uninstall.sh 2>&1 | tee logs/uninstall.log + leak=0 + for p in \ + "$HOME/.unsloth/studio" \ + "$HOME/.local/share/unsloth" \ + "$HOME/Desktop/Unsloth Studio.desktop" \ + "$HOME/.local/bin/unsloth"; do + if [ -e "$p" ] || [ -L "$p" ]; then + echo "::error::leak: $p" + ls -la "$p" 2>&1 | head -3 + leak=$((leak + 1)) + fi + done + [ "$leak" -eq 0 ] || exit 1 + # Idempotent: re-runs exit 0 on an empty $HOME. + sh uninstall.sh 2>&1 | tail -5 + sh uninstall.sh 2>&1 | tail -5 + echo "PASS: install -> update -> uninstall round-trip clean" + - name: Upload update logs # Always upload so a green run still leaves the install + two - # update logs reviewable. + # update logs + uninstall log reviewable. if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: @@ -151,4 +187,5 @@ jobs: logs/update.log logs/update2.log logs/studio.log + logs/uninstall.log retention-days: 7 diff --git a/.github/workflows/studio-windows-update-smoke.yml b/.github/workflows/studio-windows-update-smoke.yml index 157874d404..b412d60921 100644 --- a/.github/workflows/studio-windows-update-smoke.yml +++ b/.github/workflows/studio-windows-update-smoke.yml @@ -23,6 +23,7 @@ on: pull_request: paths: - 'install.ps1' + - 'uninstall.ps1' - 'studio/setup.ps1' - 'studio/setup.bat' - 'studio/install_python_stack.py' @@ -266,6 +267,39 @@ jobs: kill "$PID" 2>/dev/null || true echo "post-update Studio /api/health OK" + - name: Uninstall and verify clean + # Round-trip through uninstall.ps1 against the default install + # tree at %USERPROFILE%\.unsloth\studio. Catches regressions + # where install.ps1 starts writing under a new key (registry, + # Start Menu, %APPDATA%) and uninstall.ps1 has not been updated + # to match. Skips gracefully if uninstall.ps1 has not landed yet + # (lets this workflow merge before #5513). + shell: pwsh + run: | + New-Item -ItemType Directory -Force -Path logs | Out-Null + if (-not (Test-Path "$PWD\uninstall.ps1")) { + Write-Host "uninstall.ps1 not present in this tree; skipping round-trip" + "" | Set-Content logs/uninstall.log + exit 0 + } + pwsh -NoProfile -File "$PWD\uninstall.ps1" *>&1 | Tee-Object -FilePath logs/uninstall.log + $leak = 0 + foreach ($p in @( + "$env:USERPROFILE\.unsloth\studio", + "$env:USERPROFILE\.unsloth\studio\unsloth_studio", + "$env:USERPROFILE\.unsloth\studio\bin\unsloth.exe" + )) { + if (Test-Path -LiteralPath $p) { + Write-Host "::error::leak: $p" + $leak++ + } + } + if ($leak -gt 0) { exit 1 } + # Idempotency. + pwsh -NoProfile -File "$PWD\uninstall.ps1" *>&1 | Select-Object -Last 5 + pwsh -NoProfile -File "$PWD\uninstall.ps1" *>&1 | Select-Object -Last 5 + Write-Host "PASS: windows install -> update -> uninstall round-trip clean" + - name: Upload update logs if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 @@ -276,4 +310,5 @@ jobs: logs/update.log logs/update2.log logs/studio.log + logs/uninstall.log retention-days: 7 From 7214f59d5759c6b0e1e58b8202c0ecf64c9a43f8 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 18 May 2026 02:23:16 -0700 Subject: [PATCH 37/62] studio: fix Connections dialog UX issues surfaced by image-gate probe (#5518) * studio: register /settings route that opens the settings dialog Navigating to /settings used to render Not Found because the route was never registered. The settings dialog only opened via the user menu, so /settings was a broken deep link if shared. Add a route that calls useSettingsDialogStore.openDialog() and redirects to the post-auth landing page so the modal appears on top of the chat. * studio: harden Connections dialog provider sync and allow manual model IDs Two related fixes for the Connections panel. 1. Keep localStorage providers when the server returns an empty list. The dialog used to sync from /api/providers/ on mount and unconditionally overwrite the Zustand provider store with the server result. When the server had no enabled configs but the local store had entries (legacy users, fresh dev installs, or providers created via earlier paths), opening the dialog silently wiped them. The model picker reads from the same store, so the chat header reverted from 'gpt-4o . OpenAI' to the raw 'external::openai-1::gpt-4o' key. Treat the server as authoritative only when it actually has rows; otherwise keep the local view. 2. Accept manual model IDs alongside the live catalog for remote-mode providers (DeepSeek, OpenAI, etc.). Previously the only way to save was to load the available-models catalog via a live API call, which fails in air-gapped setups, behind 502s, or when the user already knows the exact model ID. Add a Textarea fallback in the same render block, and relax the validation to accept manual IDs even when availableModels is empty. The validation message now points users at the manual path. * studio: restrict manual model ID entry to openrouter among remote providers Address review feedback: major remote providers (openai, anthropic, gemini, mistral, cohere, deepseek, ...) expose large per-model parameter surfaces that differ across models, so accepting pasted model IDs leads to mismatched parameter expectations and frustrating runtime errors. Keep their catalog curated by hiding the manual textarea and falling back to the prior 'Load available models first' validation toast for them. OpenRouter drops unsupported parameters server-side, so manual entry remains useful there; keep the textarea and the union save path for it. Custom and curated backends already gated via isCustomProvider / isCuratedModelList and continue to require manual entry as before. * studio: shorten code comments in chat-providers-dialog.tsx Trim three multi-line comment blocks to single lines per review. --- studio/frontend/src/app/router.tsx | 2 + studio/frontend/src/app/routes/settings.tsx | 20 ++ .../features/chat/chat-providers-dialog.tsx | 200 +++++++++++------- 3 files changed, 149 insertions(+), 73 deletions(-) create mode 100644 studio/frontend/src/app/routes/settings.tsx diff --git a/studio/frontend/src/app/router.tsx b/studio/frontend/src/app/router.tsx index 13ff8a5cbe..d26d8b9dee 100644 --- a/studio/frontend/src/app/router.tsx +++ b/studio/frontend/src/app/router.tsx @@ -12,6 +12,7 @@ import { Route as indexRoute } from "./routes/index"; import { Route as loginRoute } from "./routes/login"; import { Route as onboardingRoute } from "./routes/onboarding"; import { Route as changePasswordRoute } from "./routes/change-password"; +import { Route as settingsRoute } from "./routes/settings"; import { Route as studioRoute } from "./routes/studio"; const routeTree = rootRoute.addChildren([ @@ -20,6 +21,7 @@ const routeTree = rootRoute.addChildren([ loginRoute, changePasswordRoute, gridTestRoute, + settingsRoute, studioRoute, chatRoute, exportRoute, diff --git a/studio/frontend/src/app/routes/settings.tsx b/studio/frontend/src/app/routes/settings.tsx new file mode 100644 index 0000000000..4e35f0b16d --- /dev/null +++ b/studio/frontend/src/app/routes/settings.tsx @@ -0,0 +1,20 @@ +// SPDX-License-Identifier: AGPL-3.0-only +// Copyright 2026-present the Unsloth AI Inc. team. All rights reserved. See /studio/LICENSE.AGPL-3.0 + +import { createRoute, redirect } from "@tanstack/react-router"; +import { getPostAuthRoute } from "@/features/auth"; +import { useSettingsDialogStore } from "@/features/settings"; +import { requireAuth } from "../auth-guards"; +import { Route as rootRoute } from "./__root"; + +// /settings is a deep link to the modal. Open it, then redirect home. +export const Route = createRoute({ + getParentRoute: () => rootRoute, + path: "/settings", + beforeLoad: async () => { + await requireAuth(); + useSettingsDialogStore.getState().openDialog(); + throw redirect({ to: getPostAuthRoute() }); + }, + component: () => null, +}); diff --git a/studio/frontend/src/features/chat/chat-providers-dialog.tsx b/studio/frontend/src/features/chat/chat-providers-dialog.tsx index 96f95d6d7b..722716cbc9 100644 --- a/studio/frontend/src/features/chat/chat-providers-dialog.tsx +++ b/studio/frontend/src/features/chat/chat-providers-dialog.tsx @@ -135,6 +135,9 @@ function parseManualModelIds(text: string): string[] { return out; } +// Remote providers safe for manual model IDs (openrouter drops unused params). +const MANUAL_MODEL_ID_REMOTE_PROVIDER_TYPES = new Set(["openrouter"]); + function pruneProviderModelIds(providerType: string, modelIds: string[]): string[] { if (providerType === "anthropic") { return modelIds.filter((id) => !ANTHROPIC_DATED_SNAPSHOT_SUFFIX.test(id)); @@ -330,6 +333,10 @@ export function ChatProvidersSettings({ updatedAt, }; }); + // Don't wipe localStorage providers when the server has no rows. + if (syncedProviders.length === 0 && providersRef.current.length > 0) { + return; + } onProvidersChange(syncedProviders); } catch (error) { const message = @@ -501,19 +508,28 @@ export function ChatProvidersSettings({ return; } const curated = selectedRegistryEntry?.model_list_mode === "curated"; - const manualModels = isCustomProvider || curated; + const manualOnly = isCustomProvider || curated; + const remoteAllowsManual = + MANUAL_MODEL_ID_REMOTE_PROVIDER_TYPES.has(providerType); + const manualIds = parseManualModelIds(manualModelIds); + const allowManual = manualOnly || remoteAllowsManual; const modelsToSave = pruneProviderModelIds( providerType, - manualModels + allowManual ? [ ...new Set([ ...selectedModelIds, - ...parseManualModelIds(manualModelIds), + ...manualIds, ]), ] : [...selectedModelIds], ); - if (manualModels) { + if (manualOnly) { + if (modelsToSave.length === 0) { + toast.error("Add at least one model ID."); + return; + } + } else if (remoteAllowsManual && manualIds.length > 0) { if (modelsToSave.length === 0) { toast.error("Add at least one model ID."); return; @@ -553,7 +569,7 @@ export function ChatProvidersSettings({ name: created.display_name, baseUrl: created.base_url ?? "", models: modelsToSave, - availableModels: manualModels + availableModels: manualOnly ? [] : pruneProviderModelIds(providerType, availableModels), isReasoningModel: supportsProviderReasoningToggle(uiProviderType) @@ -597,19 +613,29 @@ export function ChatProvidersSettings({ } const entry = registryByType.get(existing.providerType); const curated = entry?.model_list_mode === "curated"; - const manualModels = isEditingCustomProvider || curated; + const manualOnly = isEditingCustomProvider || curated; + const remoteAllowsManual = MANUAL_MODEL_ID_REMOTE_PROVIDER_TYPES.has( + existing.providerType, + ); + const manualIds = parseManualModelIds(manualModelIds); + const allowManual = manualOnly || remoteAllowsManual; const modelsToSave = pruneProviderModelIds( existing.providerType, - manualModels + allowManual ? [ ...new Set([ ...selectedModelIds, - ...parseManualModelIds(manualModelIds), + ...manualIds, ]), ] : [...selectedModelIds], ); - if (manualModels) { + if (manualOnly) { + if (modelsToSave.length === 0) { + toast.error("Add at least one model ID."); + return; + } + } else if (remoteAllowsManual && manualIds.length > 0) { if (modelsToSave.length === 0) { toast.error("Add at least one model ID."); return; @@ -655,7 +681,7 @@ export function ChatProvidersSettings({ name: updated.display_name, baseUrl: updated.base_url ?? "", models: modelsToSave, - availableModels: manualModels + availableModels: manualOnly ? [] : pruneProviderModelIds(existing.providerType, availableModels), isReasoningModel: supportsProviderReasoningToggle( @@ -1184,71 +1210,99 @@ export function ChatProvidersSettings({ />

- ) : availableModels.length === 0 ? null : ( + ) : availableModels.length === 0 && + !MANUAL_MODEL_ID_REMOTE_PROVIDER_TYPES.has(providerType) ? null : (
-
- - {availableModelsLabel} - - - setModelSearchQuery(event.target.value) - } - placeholder="Search" - aria-label="Search models" - className={modelSearchInputClassName} - /> -
- - -
-
-
    - {filteredAvailableModels.length === 0 ? ( -
  • - No matching models -
    • - ) : ( - filteredAvailableModels.map((model, index) => ( -
  • toggleModel(model)} - > - toggleModel(model)} - onClick={(event) => event.stopPropagation()} - /> - +
    + + {availableModelsLabel} + + + setModelSearchQuery(event.target.value) + } + placeholder="Search" + aria-label="Search models" + className={modelSearchInputClassName} + /> +
    +
    • - )) - )} -
+ Select all + + +
+
+
    + {filteredAvailableModels.length === 0 ? ( +
  • + No matching models +
    • + ) : ( + filteredAvailableModels.map((model, index) => ( +
  • toggleModel(model)} + > + toggleModel(model)} + onClick={(event) => event.stopPropagation()} + /> + + {model} + +
    • + )) + )} +
+ + )} + {/* Manual IDs allowed for openrouter only. */} + {MANUAL_MODEL_ID_REMOTE_PROVIDER_TYPES.has(providerType) ? ( +
+ +