`gjUdZddlZddlZddlZddlZddlZddlmZmZm Z m Z m Z ddl m Z mZmZmZmZmZddlmZmZddlmZddlmZddlmZmZej:eZej@d Z!d d d gd iZ"ee#ee#effe$d <de#fdZ%de#fdZ&de#fdZ'de#fdZ(dAde#de)de)fdZ*dddde#de)de#de#fdZ+dBde e,dee#e,ffdZ-de#de,de)fd Z.de#de)fd!Z/d"ee#e,fde e)e e#ffd#Z0de#de#fd$Z1d%e#de#fd&Z2de#dee#e#ffd'Z3de#d%e#dee#e#ffd(Z4d)e e e#dee#e#ffd*Z5de#d+e e#d,e e#d-e e#d.e e#dee#efde6e e#e e#e e#e)ffd/Z7de,de,fd0Z8 dBdd1de#de,d2e e9d3e e,de e e#e#ff d4Z:de#de)fd5Z;d6ed8Z?d9Z@dBd:ZAd;ZBde#de,de)fd<ZCd=ZDd>ZEd?ZFd@ZGy)Cu@ MCP Server Management CLI — ``hermes mcp`` subcommand. Implements ``hermes mcp add/remove/list/test/configure`` for interactive MCP server lifecycle management (issue #690 Phase 2). Relies on tools/mcp_tool.py for connection/discovery and keeps configuration in ~/.hermes/config.yaml under the ``mcp_servers`` key. N)AnyDictListOptionalTuple)cfg_get load_config save_config get_env_valuesave_env_valueget_hermes_home)Colorscolor)display_hermes_home)validate_mcp_server_entry)_ENV_VAR_PATTERN _env_ref_namez^[A-Za-z_][A-Za-z0-9_]*$codexz mcp-server)commandargs _MCP_PRESETStextcPttd|tjy)N )printrrDIMrs H/root/.hermes/venv/lib/python3.12/site-packages/hermes_cli/mcp_config.py_infor.s %"TF VZZ ()cPttd|tjy)Nu ✓ )rrrGREENrs r_successr#1s %& ./r cPttd|tjy)Nu ⚠ )rrrYELLOWrs r_warningr&4s %& /0r cPttd|tjy)Nu ✗ )rrrREDrs r_errorr)7s %& ,-r questiondefaultreturnc |rdnd} ttd|d|dtjj j }|s|S|dvS#t tf$rt|cYSwxYw)NzY/nzy/Nrz [z]: >yyes) inputrrr%striplowerKeyboardInterruptEOFErrorr)r*r+ default_strvals r_confirmr7;s{"%KEBxj;-s;V]]KLRRTZZ\  ,  x ( sAAA43A4F)passwordr+r9c$ddlm}||||S)Nr)prompt)r+r9)hermes_cli.cli_outputr;)r*r9r+_shared_prompts r_promptr>Gs> (Gh GGr configch| t}|jd}|rt|tsiS|S)z;Return the ``mcp_servers`` dict from config, or empty dict. mcp_servers)r get isinstancedict)r?serverss r_get_mcp_serversrFNs2 ~jj'G *Wd3 Nr name server_configct||}|r"|D] }t|td|dyt}||jdi|<t |y)aAdd or update a server entry in config.yaml. Returns False when a high-signal exfiltration-shaped stdio command is rejected. MCP stdio servers are user-chosen local commands, so this blocks shell+egress payloads rather than whitelisting command families. Server '0' was NOT saved due to suspicious configuration.FrAT)rr&r setdefaultr )rGrHissuesissuer?s r_save_mcp_serverrOXsg't] ;F  E UO 8D6!QRS ]F1>FmR(. r ct}|jdi}||vry||=|s|jddt|y)z>Remove a server from config.yaml. Returns True if it existed.rAFNT)r rBpopr )rGr?rEs r_remove_mcp_serverrRksG ]Fjj+G 7  =$' r rEc<g}|jD]F\}}t|ts|jd|d,|j t ||H|rd|fSt }|rt||d<n|jddt|dgfS)uReplace the WHOLE ``mcp_servers`` map in config.yaml. Unlike ``_save_mcp_server`` (per-key upsert), this sets the entire map so the GUI's mcp.json editor can delete servers, drop an ``enabled: false`` flag (re-enable), or remove nested fields and have those *removals* land on disk. A plain ``/api/config`` deep-merge can only add/override keys, never delete them — which is why edits appeared to succeed but the old entry survived (see MCP tab persistence bug). Every entry is validated up front; on any suspicious command/args the whole save is rejected (returns ``(False, issues)``) so a bad paste can't be partially applied. An empty map removes the key entirely. rJz': expected an objectFrANT) itemsrCrDappendextendrr rQr )rErMrGcfgr?s r_replace_mcp_serversrXxsF]]_< c#t$ MMHTF*?@ A  /c:; < f} ]F $W } =$' 8Or cvtjdd|jjd}d|dS)zDConvert server name to an env-var key like ``MCP_MYSERVER_API_KEY``.z [^A-Za-z0-9_]_MCP__API_KEY)resubupperr1)rGsuffixs r_env_key_for_serverras5 VV$c4::< 8 > >s CF & ""r tokenct|ts|S|j}|ddjdk(r|ddjS|S)u#Strip a leading ``Bearer `` from a pasted token. The header template stores ``Authorization: Bearer ${MCP_X_API_KEY}``, so if a user pastes a token that already includes the ``Bearer `` prefix the server receives ``Bearer Bearer `` → 401. Normalize on save. (#37792) Nzbearer )rCstrr1r2)rbstrippeds r_strip_bearer_prefixrgsO eS ! {{}H|y(|!!## Or c(t|}dd|diS)aBuild the persisted Authorization header for a named MCP server. The secret itself lives in the active profile's ``.env`` file. Keeping this template construction beside ``_env_key_for_server`` ensures the CLI and Dashboard produce byte-equivalent MCP configuration. Authorizationz Bearer ${})ra)rGenv_keys r_bearer_auth_headersrls""$'G z'"5 66r ct|}|r|jdk(r tdtt ||t |S)zPersist a Bearer token in the active profile and return safe headers. ``token`` is a one-time provisioning value. It is normalized and written only to ``.env``; callers persist the returned interpolation template in ``config.yaml``. bearerzBearer token is required)rgr2 ValueErrorr rarl)rGrb normalizeds r_save_bearer_auth_tokenrqsH&e,J ))+x7344&t,j9  %%r raw_envcDi}|xsgD]}t|xsdj}|s#d|vrtd|d|jdd\}}|j}|std|dtj |std|d|||<|S) z;Parse ``KEY=VALUE`` strings from CLI args into an env dict.r8=zInvalid --env value 'z' (expected KEY=VALUE)z' (missing variable name)zInvalid --env variable name '')rer1rosplit_ENV_VAR_NAME_REmatch)rrparseditemrkeyvalues r_parse_env_assignmentsr~sF 2 4:2$$&  d?4TF:PQR RZZQ' Uiik4TF:STU U%%c*> gGXu,, **U Cjj#GFJJv&,"-H " e#* i  ( f 4 ''r crddlm}ddlm}| ddlm}|||S#t $rYwxYw)u,Resolve ``${ENV}`` placeholders in a server config before connecting. Mirrors ``_load_mcp_config()`` in ``tools/mcp_tool.py``: load ``~/.hermes/.env`` into ``os.environ`` and recursively interpolate any ``${VAR}`` placeholders. The CLI builds header templates like ``Authorization: Bearer ${MCP_X_API_KEY}`` but the probe path never resolved them, so the discovery probe sent the literal placeholder and auth-requiring servers (e.g. n8n) returned 401 — while runtime tool loading worked because it interpolates. (#37792) r)_interpolate_env_vars)current_secret_scope)load_hermes_dotenv)tools.mcp_toolragent.secret_scoperhermes_cli.env_loaderr Exception)r?rrrs r_resolve_mcp_server_configrsB57%  @   ! ((   s * 66)detailsconnect_timeoutrc t}|rtdj|ddlm}m}m m}m t(jdd} tdt||g  fd } || d z  | S#ttf$rdYDwxYw#t$r} t| dd} ~ wwxYw#|wxYw) uaTemporarily connect to one MCP server, list its tools, disconnect. Returns list of ``(tool_name, description)`` tuples. Raises on connection failure. ``details``: optional dict the probe fills with extra capability counts (``prompts``, ``resources``) — an out-param so the return shape stays stable for existing CLI callers. z; r)_ensure_mcp_loop_run_on_mcp_loop_connect_server_stop_mcp_loop_if_idle_parse_boolishNrg?g>@cKtj   d{} |jD]F}t|ddxsd}t |dkDr|dddz}j |j |fH jdxsi} |jdd } |jd d }tt|d dd ddtdtffd }|rC|dr; |jjd{}t |j d<|rC|d r; |jjd{}t |j d <|j!d{y7q7}#t$rYnwxYw7I#t$rY:wxYw7*#|j!d{7wxYww)Ntimeout descriptionr8PM...toolspromptsTr+ resourcesinitialize_result capabilitiescap_attrr,c(yt|dduS)NT)getattr)radvertised_capss r _advertisesz9_probe_single_server.._probe.._advertises[s"'.#"?HdC4OOr )asynciowait_for_toolsrlenrUrGrBreboolsession list_promptsrrlist_resourcesrshutdown)servertdesc tools_filterprompts_enabledresources_enabledrresultrrrr?rrrG tools_founds @r_probez$_probe_single_server.._probe9s'' D& )?  4 $]] 3q-4:t9r>9u,D""AFFD>2  3 " &zz'28b "0 $$Y/#%3 $$[14%!#*F$7>"# P#P$P#{9'='-~~'B'B'D!D-0-@ *%[)A'-~~'D'D'F!F/263C3C/D ,//# # #o X"E$"G$ $&//# # #s"GFGCF>?FFF9 F>F-!F+"F->GF<GF F(%F>'F((F>+F-- F96F>8F99F><G>GGGG r)rrojoinrrrrrrrrBmaxfloat TypeError BaseException_unwrap_exception_group)rGr?rrrMrrr raw_timeoutrexcrrrs```` @@@r_probe_single_serverrs'tV 4F 6*++( /Fjj!2B7  #!#u['9:O)+K8$8$t!?R+?@  O:& #"O #D 5%c*45  s6B$B;$B87B8; C CCC C!c ddlm}||jS#t$r!}tj d||Yd}~yd}~wwxYw)aReturn True if an OAuth token file exists on disk for ``name``. Used after ``hermes mcp login`` to distinguish a genuine authentication from a probe that succeeded only because the server allowed initialize/tools-list without auth (so no token was ever acquired). r)HermesTokenStoragez)Could not check OAuth tokens for '%s': %sNT)tools.mcp_oauthrhas_cached_tokensrloggerdebug)rGrrs r_oauth_tokens_presentr}sB6!$'99;;  @$Ls AAArct|tr8|jr,|jd}t|tr |jr,t|tr|St t |S)aBExtract the root-cause exception from anyio TaskGroup wrappers. The MCP SDK uses anyio task groups, which wrap errors in ``BaseExceptionGroup`` / ``ExceptionGroup``. This makes error messages opaque ("unhandled errors in a TaskGroup"). We unwrap to surface the real cause (e.g. "401 Unauthorized"). r)rCBaseExceptionGroup exceptionsr RuntimeErrorre)rs rrrsV S, -#..nnQ S, -#..#y! C !!r c  |j}t|dd}t|dd}t|ddxsg}|r |ddk(r|dd}t|dd}t|d d}t|d d}t|d d}i} t|} t||||t || \}}}} |r| r t d y|s:|s8t dtdtdtdtdyt} || vrtd|dds tdy|r|| d<n|| d<|r|| d<| r| | d <||| d <t|| }|r"|D] }t|td|dy|r|dk(rttd|dd} ddlm}|j!||d}|rd| d<t#dd}n td |std"td#drntdy|rttd$|td%d}|ru|d&k(s|snt'|}t)|}|rt#|d'n7t+d(d)}|r(t-||| d*<t#d+t/d,||rt1|| d*<ttt3d-|dt4j6 t9|| }|s4td4td5drt;|| rt#d1|d6ytt#d7t=|d8|d9t|D]G\}}t=|d:kDr|dd:d;zn|}tdd=d>|It tAt3d?t=|d@t4jBjEjG}|dAvr tdBy|dCvrddDl&m'}|Dcgc]}|ddE|d}}tQtSt=|}|dF|dG||} | s tdHytU| D!cgc] }!||!d }"}!|"| jWdIidJ<t=|"}#t=|}$nt=|}#t=|}$d| d0<t;|| r6tt#d1|dKt/dL|#dM|$dN tdOyy#t $r} t t| Yd} ~ yd} ~ wwxYw#t$$r} td!| Yd} ~ gd} ~ wwxYw#t$$rS} t d.| td/dr.d| d0<t;|| rt#d1|d2td3|zYd} ~ yd} ~ wwxYw#tHtJf$rttdYywxYwcc}wcc}!w)Pz9Add a new MCP server with discovery-first tool selection.rN mcp_commandrrz--ruauthrenvr)rrrrrHzJ--env is only supported for stdio MCP servers (--command or stdio presets)zBMust specify --url , --command , or --preset z Examples:z3 hermes mcp add ink --url "https://mcp.ml.ink/mcp"zP hermes mcp add github --command npx --args @modelcontextprotocol/server-githubz+ hermes mcp add myserver --preset mypresetrJz' already exists. Overwrite?Fr Cancelled.rrKoauthStarting OAuth flow for ''... get_managerz>OAuth configured (tokens will be acquired on first connection)Tu8OAuth setup failed — MCP SDK auth module not availablez OAuth error: z"This server may not support OAuth.z Continue without authentication?zConnecting to z(Does this server require authentication?headerz: already configuredzAPI key / Bearer token)r9headersz Saved to z /.env as  Connecting to 'Failed to connect: z(Save config anyway (you can test later)?enabledzSaved 'z' to config (disabled)z%Fix the issue, then: hermes mcp test z'Server connected but reported no tools.zSave config anyway?z ' to configzConnected! Found z tool(s) from 'z':<r 40s z Enable all z tools? [Y/n/select]: >nnouCancelled — server not saved.>sselectcurses_checklist — Select tools for 'rvu'No tools selected — server not saved.rincludez' to z/config.yaml (/z tools enabled)z'Start a new session to use these tools.),rGrr~rrror)rerrFr7rr&rtools.mcp_oauth_managerrget_or_build_providerr#rrar r>rqrrlrrCYANrrOrr"r0r%r1r2r3r4hermes_cli.curses_uirsetrangesortedrL)%rrGrrr auth_typerrrraw_connect_timeoutrH explicit_env_preset_appliedrexistingrMrNoauth_okr oauth_auth needs_authrk existing_keyapi_keyr tool_namershortchoicerrlabels pre_selectedchoseni chosen_names tool_counttotals% r cmd_mcp_addr s= 99D $t $CdM40GtVT*0bHHQK4'AB<fd+I$$/KdE4(G!$(94@$&M -g6 2C #(^' 3 /Wh |[\ wST k CD `a ;< !H x(4&(DEuU ,   " e#* i $,M& ! #/M% &+> '( &t] ;F  E UO 8D6!QRS yG#  )$t45 , ;$<%&>NG3J '4 i0!9-@-B,C9WI!VW /CD/IM), G %#D6. <= $T=9 :; )4 8m474& 45 G  U OD6 DE G C 4%(Y^Sb E! U9fll3C8%ABC G M#e*-CDfmm T %'%%'  /0  9278QQqTF'!A$(885U,- ! a (     ; < -3F^<a < <;G   "-i8& E Z E  $M)m, 74&&9&;% N',M) $m474&(>?@=DE> x (  l9=sh>*S2>T UA V ;W W2 T;TT T>%T99T> V A VV $WWc|j}t}||vrHtd|dt|j }|rt ddj |ytd|dd s t d yt|td |d  d dl m }|j|tdy#t$rYywxYw)z!Remove an MCP server from config.rJ' not found in config.Available servers: , NzRemove server 'z'?Trrz Removed 'z ' from configrrzCleaned up OAuth tokens)rGrFr)rkeysrrr7rRr#rrremover)rrGrrErs rcmd_mcp_removerls 99D!H 8$567x}}'  ' '(:';< = odV2. = lt ym ,-  7 T"*+    s'C CCc $t}|sKttdttdtdtdtytttdtj tj zttddd d d d d d dd ddtddd dd dd d|jD]\}}d|vr|d}t|dkDr|dddz}|}nid|vrc|d}|jdg}t|tr#|r!|d d jd|ddD}n|}t|dkDr |dddz}nd}|jdi}t|trh|jd} |jd } | rt| trt| d!} n'| r t| trd"t| d#} nd$} nd$} |jd%d&} t| tr| jd'v} | rtd(tj ntd)tj"} td|d d |d d | dd | ty)*z List all configured MCP servers.zNo MCP servers configured.z Add one with:z( hermes mcp add --url z8 hermes mcp add --command --args Nz MCP Servers:rNamez<16r Transportz<30Toolsz<12Statusz<10u0────────────────uZ──────────────────────────────u$────────────u──────────rrrrc32K|]}t|ywN)re).0as r zcmd_mcp_list..s-Kc!f-Ks?rrexcludez selected-z excludedallrT>1r/trueu ✓ enabledu ✗ disabled)rFrrrrrBOLDrTrrBrCrrrDrer2r"r)rrErGrWr transportcmdr tools_cfgrr tools_strrstatuss r cmd_mcp_listr*su G   *+  o 89 HI  G % &++ "; <= G Bvcl!K,Agc]!HS> JK Bzl!J}fll3E.Z`ZdZdDe 4*Ai_Ai_AfXFGQ(HT Gr c\|j}t}||vrHtd|dt|j }|rt ddj |y||}tttd|dtjd|vrt d |dn |jd d }t d ||jd d}|jdi}|dk(r t dn|r|jD]\}} t| tsd|jvsd |jvszcmd_mcp_test..s$"))MRSRYRYZ[R\D]_a:br z***rz: z Auth: noneizConnection failed (z.0fzms): z Connected (zms)zTools discovered: 7r36sr)rGrFr)rrrrrrrrrBrTrCrer2rr^rtime monotonicrrr#r")rrGrE availablerWr&rrkvresolvedmaskedstartr elapsed_msrrrrs r cmd_mcp_testrAs 99D G 7$567(  K ) 456 7 $-C G %+dV4(&++ 67 | $SZL12ggi% %cU+,#Iggi$GG $% MMO ,DAq!S!u '9Vqwwy=P+//0bdefx=1$%bq\E1HRSMAF"FQCr&*+ , l NN E$T3/nn&.$6  {:c*# ./ !#e* ./  $ GOIt),TRD"I%TE Dy&,,7"z5 client_secret: ""zThen re-run `hermes mcp login z`.uAuthenticated — z tool(s) availablez(Authenticated (server reported no tools)TzAuthentication failed: )rBr)rrrrrr&rrrrorrrrrrr#r)rGrHrrr_login_connect_timeoutrs r_reauth_oauth_serverrFsm   E "C $KLM G+$CMDUDUV\D]C^^_`a OPA7 T" G %dV4 01/!.!2!23D!E )%*+A%B ""%%;U!C$ -1G %T* 3  G P  G %*FJJ7 8 %&a(&**5 6 %-u-vzz: ; %-vzz: ; %(&**5 6 %I6::V W %QSYS]S]^ _ G 2T9D@ A  )#e*5GH I ? @q A9#?@@A :& )%( " )R (./sa&IJ. I-9E'J!J< J I*I%%I*-J>JJJ J&J!!J&c|j}t}||vr/td|d|rtddj |yt |||y)aForce re-authentication for an OAuth-based MCP server. Deletes cached tokens (both on disk and in the running process's MCPOAuthManager cache) and triggers a fresh OAuth flow via the existing probe path. Use this when: - Tokens are stuck in a bad state (server revoked, refresh token consumed by an external process, etc.) - You want to re-authenticate to change scopes or account - A tool call returned ``needs_reauth: true`` rJr r r N)rGrFr)rrrF)rrGrEs r cmd_mcp_loginrHes] 99D G 7$567  ' '(:';< =wt}-r ct}t|dd}t|dd}|r|jDcgc].\}}|jddk(r|jdr||f0}}}|s t dyt t d t |d d }|D]Y\}}t t td |d tjtjzt||sU|dz }[t td|dt |dy|stdt dy||vr/td|d|rt ddj|yt|||ycc}}w)adRe-authenticate one OAuth MCP server, or all of them sequentially. ``hermes mcp reauth `` re-auths a single server (same as ``login``). ``hermes mcp reauth --all`` discovers every ``auth: oauth`` server in config and re-auths them ONE AT A TIME. Serial-by-design: a human can only complete one browser OAuth flow at a time, so re-authing all servers concurrently would open N tabs at once and N-1 would time out. This is the self-service fix for the recurring stale-client ritual in GH#36767 (and avoids the startup popup storm when several servers go stale at once). r!FrGNrrrz+No OAuth-based MCP servers found in config.zRe-authenticating z! OAuth server(s) one at a time...ru ── u ──ruzRe-authenticated rz server(s)zBSpecify a server name, or use --all to re-auth every OAuth server.z=Usage: hermes mcp reauth | hermes mcp reauth --allrJr r r )rFrrTrBrrrrrrr$rFr#r)r)rrEdo_allrGrc oauth_servers succeededs rcmd_mcp_reauthrN~s G T5% (F 4 &D &}} q!uuV}'AEE%LF   ? @   "3}#5"66WXY ! DAq G %)A3g. fkk0IJ K#Aq)Q   $YKq]1C0DJOP ST MN 7$567  ' '(:';< =wt}-; s3Fc ddl}|jjs(td|j|j d|j }t}||vrHtd|dt|j}|rtdd j|y||}tttd |d tj t!||}|s t%d y|j'di}t)|t*r#|j'd} |j'd} nd} d} |D cgc]} | d } } | r>t)| tr.t-| } t/| Dchc] \}}|| vs |}}}n]| r>t)| tr.t-| }t/| Dchc] \}}||vs |}}}nt-t1t3|}t3|}t3|}td|d|d|dtddlm}|D cgc]} | dd| d}} |d|d||}||k(r tdyt9}t;|d|i}t3||k(r|j=ddnJt?|Dcgc]}| | }}|jAdi||dd<|dj=dd||jAdi|<tC|t3|}tEd|d|dtdy#t"$r}td |Yd}~yd}~wwxYwcc} wcc}}wcc}}wcc} wcc}w)z?Reconfigure which tools are enabled for an existing MCP server.rNz?Error: 'hermes mcp configure' requires an interactive terminal.)filerurJr r,r rz' to discover tools...rzServer reports no tools.rrrz Currently rz tools enabled for 'z'.rrrrvzNo changes made.rArzUpdated config: z tools enabledz/Start a new session for changes to take effect.)#sysstdinisattyrstderrexitrGrFr)rrrrrrrrrr&rBrCrDr enumeraterrrrr rrQrrLr r#)r_sysrGrEr:rW all_toolsrr'rrr tool_names include_setrtnr exclude_set currentlyrrrrr? server_entryr new_counts rcmd_mcp_configurer`sh ::    OVZVaVab ! 99D G 7$567(  K ) 456 7 $-C G %#D6)?@&++ NO(s3 +,$I)T"-- *-- * )*1!A$*J*:gt,'l $Z0 !RB+4EA   Z.'l $Z0 !RBk4IA  5Y01 L!I  NE Jyk5')=dV2 FG G6.7 81gadV$ 8F 8  TF!$F   !]F6=$CL 6{e$'/5f~>! 1 > >,+7 Wi(W!!)T21=FmR(.F I  {!E7. AB ; Install a catalog MCPz?hermes mcp serve Run as MCP serverzEhermes mcp add --url Add a custom MCP serverz@hermes mcp add --command Add a stdio serverzEhermes mcp add --preset Add from a known presetz=hermes mcp remove Remove a serverzEhermes mcp list List configured serversz=hermes mcp test Test connectionz:hermes mcp configure Toggle toolszChermes mcp login Re-authenticate OAuthzNhermes mcp reauth | --all Re-auth one or all OAuth servers)r mcp_serverdhermes_cli.mcp_pickerrgrirkrQrUr rr*rAr`rHrNrBrrrrr) ractionrdrgrirkrWrchandlershandlers rrrsf T< .F ,wtY>?4  6 9 WT<<B C IIbM &#  Hll6"G  5  eM6;;/0 _` UV ST OP UV PQ UV MN UV MN JK ST ^_ r )Tr)H__doc__rloggingr.r]r8typingrrrrrhermes_cli.configrr r r r r hermes_cli.colorsrrhermes_constantsrhermes_cli.mcp_securityrrrr getLogger__name__rcompilerxrre__annotations__rr#r&r)rr7r>rDrFrOrRrXrargrlrqr~tuplerrrrrrrrr rr*rArFrHrNr`rr rrsb 33,0=:   8 $2::9: + d3S#X&'**030131.. s T T 05RHcHHsHCHXd^tCI3t& S T $sDy/eD$s)O6LB#c#c#   7s7tCH~7 &# &c &d38n &HT#Y$7DcN&( (#( # ( c] ( 3i (S>( 8C=(3-cD 89(H)t))2AEdcgd dd.6uodRZ[_R`d %S/dN    " "9 "$H9Z @@ J; @QsQ4QDQh.2/.h^=F>r