From c8bf4e0f89e506d63820d6dfac945bf405cc998e Mon Sep 17 00:00:00 2001
From: mateaix <57164338+mateaix@users.noreply.github.com>
Date: Sat, 4 Jul 2026 20:28:15 +0800
Subject: [PATCH] release: v1.7.0
---
.env.example | 19 +
.gitignore | 3 +
README.md | 32 +-
README_zh.md | 32 +-
docker-compose.yml | 24 +
mateclaw-desktop/.env.example | 15 +
mateclaw-desktop/.gitignore | 33 +
mateclaw-desktop/CODESIGNING.md | 275 ++
mateclaw-desktop/README.md | 432 ++
mateclaw-desktop/RELEASE_NOTES_v1.0.101.md | 67 +
mateclaw-desktop/branding.config.json | 9 +
.../build/entitlements.mac.inherit.plist | 14 +
mateclaw-desktop/build/entitlements.mac.plist | 18 +
mateclaw-desktop/build/icon.icns | Bin 0 -> 247190 bytes
mateclaw-desktop/build/icon.ico | Bin 0 -> 285478 bytes
mateclaw-desktop/build/icon.png | Bin 0 -> 247190 bytes
mateclaw-desktop/build/icon_256.png | Bin 0 -> 53511 bytes
mateclaw-desktop/electron-builder.cjs | 139 +
mateclaw-desktop/electron/main/config.ts | 87 +
mateclaw-desktop/electron/main/index.ts | 1103 +++++
mateclaw-desktop/electron/main/localBridge.ts | 205 +
.../electron/main/localToolsApproval.ts | 82 +
.../electron/main/localToolsConfig.ts | 122 +
.../electron/main/localToolsExecutor.ts | 194 +
mateclaw-desktop/electron/preload/index.ts | 55 +
mateclaw-desktop/index.html | 27 +
mateclaw-desktop/package.json | 51 +
mateclaw-desktop/pnpm-lock.yaml | 3942 +++++++++++++++++
.../public/logo/mateclaw_logo_s.png | Bin 0 -> 68958 bytes
mateclaw-desktop/src/App.vue | 1355 ++++++
mateclaw-desktop/src/env.d.ts | 67 +
mateclaw-desktop/src/main.ts | 4 +
mateclaw-desktop/tsconfig.json | 25 +
mateclaw-desktop/tsconfig.node.json | 12 +
mateclaw-desktop/tsconfig.node.tsbuildinfo | 1 +
mateclaw-desktop/vite.config.ts | 72 +
.../vip/mate/plugin/api/PluginContext.java | 14 +
.../java/vip/mate/plugin/api/PluginType.java | 5 +-
.../api/search/PluginSearchProvider.java | 53 +
.../plugin/api/search/PluginSearchQuery.java | 22 +
.../plugin/api/search/PluginSearchResult.java | 24 +
mateclaw-plugin-search-sample/pom.xml | 50 +
.../sample/search/SimpleSearchPlugin.java | 124 +
.../src/main/resources/mateclaw-plugin.json | 24 +
.../vip/mate/agent/AgentGraphBuilder.java | 283 +-
.../main/java/vip/mate/agent/BaseAgent.java | 10 +-
.../controller/AgentBindingController.java | 9 +-
.../model/AgentProviderPreference.java | 10 +
.../AgentBindingMcpRemovalListener.java | 71 +
.../binding/service/AgentBindingService.java | 24 +-
.../vip/mate/agent/context/ChatOrigin.java | 43 +-
.../context/ConversationWindowManager.java | 50 +-
.../mate/agent/context/PrefixBudgetPlan.java | 41 +
.../agent/context/PrefixBudgetPlanner.java | 120 +
.../delegation/DelegatedUsageAccumulator.java | 95 +
.../agent/delegation/SubagentRunContext.java | 75 +
.../agent/graph/NodeStreamingChatHelper.java | 143 +-
.../agent/graph/StateGraphReActAgent.java | 62 +-
.../graph/executor/ToolExecutionExecutor.java | 14 +
.../graph/executor/ToolResultStorage.java | 38 +
.../agent/graph/node/FinalAnswerNode.java | 9 +-
.../mate/agent/graph/node/ReasoningNode.java | 101 +-
.../plan/StateGraphPlanExecuteAgent.java | 45 +-
.../graph/plan/node/PlanGenerationNode.java | 69 +-
.../graph/plan/node/StepExecutionNode.java | 55 +-
.../graph/plan/state/PlanStateAccessor.java | 27 +
.../graph/state/MateClawStateAccessor.java | 6 +
.../agent/graph/state/MateClawStateKeys.java | 6 +
.../approval/ApprovalWorkflowService.java | 34 +
.../vip/mate/auth/service/AuthService.java | 8 +-
.../mate/auth/sso/SsoAutoConfiguration.java | 33 +
.../mate/auth/sso/SsoCallbackResponse.java | 43 +
.../java/vip/mate/auth/sso/SsoController.java | 72 +
.../java/vip/mate/auth/sso/SsoProperties.java | 51 +
.../java/vip/mate/auth/sso/SsoService.java | 267 ++
.../vip/mate/auth/sso/SsoStateService.java | 233 +
.../sso/model/ExternalIdentityEntity.java | 60 +
.../mate/auth/sso/model/SsoStateEntity.java | 37 +
.../auth/sso/provider/FeishuSsoProvider.java | 230 +
.../mate/auth/sso/provider/SsoProvider.java | 34 +
.../sso/provider/SsoProviderRegistry.java | 50 +
.../mate/auth/sso/provider/SsoUserInfo.java | 22 +
.../repository/ExternalIdentityMapper.java | 14 +
.../auth/sso/repository/SsoStateMapper.java | 14 +
.../channel/ChannelChatOriginFactory.java | 3 +-
.../java/vip/mate/channel/ChannelManager.java | 15 +-
.../mate/channel/ChannelMessageRouter.java | 50 +-
.../channel/feishu/FeishuChannelAdapter.java | 84 +-
.../tool_guard/ToolGuardCardHandler.java | 75 +
.../tool_guard/ToolGuardCardKindFactory.java | 15 +-
.../vip/mate/channel/web/ChatController.java | 162 +-
.../channel/webchat/WebChatController.java | 338 +-
.../channel/webchat/WebChatFileService.java | 31 +-
.../channel/wecom/WeComChannelAdapter.java | 32 +-
.../tool_guard/ToolGuardCardHandler.java | 69 +-
.../tool_guard/ToolGuardCardKindFactory.java | 11 +-
.../channel/weixin/WeixinChannelAdapter.java | 24 +-
.../main/java/vip/mate/cli/ExportCommand.java | 80 +
.../main/java/vip/mate/cli/MateClawCli.java | 178 +
.../vip/mate/common/net/SsrfAllowlist.java | 138 +
.../vip/mate/common/net/SsrfProperties.java | 28 +
.../java/vip/mate/config/JwtAuthFilter.java | 2 +
.../vip/mate/config/LoginRateLimitFilter.java | 22 +-
.../java/vip/mate/config/OpenApiConfig.java | 99 +
.../mate/config/PrefixBudgetProperties.java | 69 +
.../java/vip/mate/config/SecurityConfig.java | 63 +-
.../java/vip/mate/config/WebMvcConfig.java | 6 +
.../java/vip/mate/config/WebSocketConfig.java | 10 +
.../java/vip/mate/hook/HookActionFactory.java | 3 +
.../java/vip/mate/hook/action/HttpAction.java | 14 +-
.../vip/mate/kbopen/auth/KbApiKeyContext.java | 39 +
.../mate/kbopen/auth/KbApiKeyRateLimiter.java | 46 +
.../vip/mate/kbopen/auth/KbApiKeyService.java | 240 +
.../mate/kbopen/auth/KbOpenApiAuthFilter.java | 142 +
.../mate/kbopen/auth/KbScopeInterceptor.java | 97 +
.../vip/mate/kbopen/auth/RequireKbScope.java | 29 +
.../vip/mate/kbopen/auth/TokenHashUtil.java | 58 +
.../auth/model/KbApiKeyBindingEntity.java | 33 +
.../kbopen/auth/model/KbApiKeyEntity.java | 64 +
.../repository/KbApiKeyBindingMapper.java | 9 +
.../auth/repository/KbApiKeyMapper.java | 9 +
.../controller/KbApiKeyAdminController.java | 137 +
.../controller/KbOpenApiController.java | 331 ++
.../controller/KbOpenResearchController.java | 230 +
.../vip/mate/kbopen/dto/KbOpenApiDtos.java | 142 +
.../research/KbResearchSessionRegistry.java | 188 +
.../mate/kbopen/service/KbOpenApiService.java | 298 ++
.../mate/llm/cache/CacheUsageExtractor.java | 73 +-
.../llm/probe/ContextLimitErrorParser.java | 64 +
.../llm/probe/ContextProbeProperties.java | 25 +
.../vip/mate/llm/probe/LocalContextProbe.java | 41 +
.../vip/mate/llm/probe/LocalEndpoints.java | 85 +
.../llm/probe/ModelContextWindowResolver.java | 125 +
.../mate/llm/probe/OllamaContextProbe.java | 141 +
.../probe/OpenAiCompatibleContextProbe.java | 130 +
.../llm/routing/AgentBindingResolver.java | 8 +-
.../mate/llm/routing/ProviderModelRef.java | 18 +
.../vip/mate/llm/routing/ProviderRouter.java | 45 +-
.../llm/service/ModelCapabilityService.java | 9 +-
.../memory/search/SessionSearchService.java | 10 +-
.../mate/memory/search/SessionSearchTool.java | 23 +-
.../memory/service/MemoryRecallService.java | 19 +
.../memory/service/MemoryRecallTracker.java | 12 +-
.../vip/mate/memory/spi/MemoryManager.java | 54 +-
.../notification/NotificationController.java | 8 +
.../controller/OperationalDataController.java | 112 +
.../model/ExportInProgressException.java | 10 +
.../mate/operational/model/ExportTask.java | 72 +
.../service/OperationalDataExportService.java | 1352 ++++++
.../planning/service/PlanningService.java | 16 +-
.../java/vip/mate/plugin/LoadedPlugin.java | 3 +
.../vip/mate/plugin/PluginContextImpl.java | 36 +-
.../java/vip/mate/plugin/PluginManager.java | 81 +-
.../plugin/bridge/PluginSearchBridge.java | 112 +
.../vip/mate/plugin/model/PluginInfo.java | 3 +
.../skill/controller/SkillController.java | 9 +
.../controller/SkillInstallController.java | 13 +-
.../mate/skill/installer/SkillHubClient.java | 12 +-
.../mate/skill/installer/ZipSkillFetcher.java | 66 +-
.../lifecycle/SkillConsolidationService.java | 255 ++
.../mate/skill/lifecycle/SkillCuratorJob.java | 23 +
.../skill/lifecycle/SkillCuratorReport.java | 19 +
.../lifecycle/SkillCuratorReportStore.java | 14 +
.../lifecycle/SkillLifecycleProperties.java | 19 +
.../SkillReflectionAutoConfiguration.java | 14 +
.../reflection/SkillReflectionProperties.java | 49 +
.../reflection/SkillReflectionService.java | 352 ++
.../vip/mate/skill/service/SkillService.java | 2 +
.../controller/SystemSettingController.java | 8 +
.../model/SearchProviderCatalogEntry.java | 24 +
.../model/SearchProviderCatalogResponse.java | 17 +
.../system/service/SystemSettingService.java | 64 +-
.../mate/tool/browser/BrowserLauncher.java | 122 +-
.../mate/tool/browser/BrowserProperties.java | 62 +-
.../mate/tool/browser/UrlSafetyChecker.java | 133 +-
.../vip/mate/tool/builtin/BrowserUseTool.java | 163 +-
.../mate/tool/builtin/ChatUploadResolver.java | 74 +-
.../mate/tool/builtin/CodeExecuteTool.java | 28 +-
.../mate/tool/builtin/DelegateAgentTool.java | 238 +-
.../mate/tool/builtin/DelegationContext.java | 79 +-
.../mate/tool/builtin/MateClawDocService.java | 78 +-
.../mate/tool/builtin/SessionListTool.java | 144 +
.../mate/tool/builtin/SessionSendTool.java | 142 +
.../mate/tool/builtin/ShellExecuteTool.java | 16 +-
.../mate/tool/builtin/SkillManageTool.java | 79 +-
.../DefaultToolDisclosureService.java | 84 +-
.../disclosure/ToolDisclosureService.java | 32 +
.../disclosure/ToolUsageRecencyTracker.java | 33 +
.../tool/document/GeneratedFileCache.java | 45 +
.../document/WorkspaceArtifactSurfacer.java | 121 +
.../mate/tool/guard/WorkspacePathGuard.java | 82 +-
.../guardian/WorkspaceBoundaryGuardian.java | 49 +-
.../mate/tool/image/ImageFileDownloader.java | 10 +-
.../mate/tool/image/ImageReferenceLoader.java | 40 +-
.../tool/local/DesktopBridgeController.java | 44 +
.../tool/local/DesktopBridgeException.java | 32 +
.../DesktopBridgeHandshakeInterceptor.java | 86 +
.../tool/local/DesktopBridgeRegistry.java | 181 +
.../local/DesktopBridgeWebSocketHandler.java | 117 +
.../vip/mate/tool/local/LocalFileTools.java | 132 +
.../vip/mate/tool/local/LocalShellTool.java | 63 +
.../tool/local/LocalToolBridgeService.java | 145 +
.../vip/mate/tool/local/LocalToolFormat.java | 40 +
.../tool/mcp/event/McpServerRemovedEvent.java | 20 +
.../IdentityForwardingToolCallback.java | 112 +
.../tool/mcp/runtime/McpClientManager.java | 38 +-
.../runtime/McpIdentityForwardProperties.java | 151 +
.../runtime/McpIdentityForwardService.java | 255 ++
.../tool/mcp/service/McpServerService.java | 4 +
.../tool/model3d/Model3dFileDownloader.java | 8 +-
.../tool/music/MusicGenerationService.java | 6 +-
.../vip/mate/tool/search/SearchCache.java | 2 +-
.../tool/search/SearchProviderRegistry.java | 89 +-
.../vip/mate/tool/search/SearchQuery.java | 2 +-
.../mate/tool/video/VideoFileDownloader.java | 8 +-
.../main/java/vip/mate/tts/TtsService.java | 6 +-
.../wiki/controller/WikiAdminController.java | 39 +
.../mate/wiki/controller/WikiController.java | 3 +
.../wiki/controller/WikiEntityController.java | 39 +-
.../controller/WikiRelationController.java | 117 +-
.../vip/mate/wiki/dto/WikiFailureItem.java | 23 +
.../java/vip/mate/wiki/job/WikiKbConfig.java | 10 +
.../vip/mate/wiki/job/WikiKbConfigParser.java | 3 +
.../GlobalDefaultStepModelStrategy.java | 12 +-
.../job/strategy/KbDefaultModelStrategy.java | 14 +-
.../job/strategy/WikiLightModelStrategy.java | 92 +
.../wiki/model/WikiRawMaterialEntity.java | 36 +-
.../mate/wiki/profile/WikiPageTypeDef.java | 28 +
.../repository/WikiRawMaterialMapper.java | 32 +
.../mate/wiki/service/WikiContextService.java | 27 +-
.../mate/wiki/service/WikiPageService.java | 2 +-
.../wiki/service/WikiProcessingService.java | 164 +-
.../wiki/service/WikiRawMaterialService.java | 114 +-
.../wiki/service/WikiResearchService.java | 40 +
.../service/WikiTransformationExecutor.java | 10 +-
.../service/WikiTransformationService.java | 18 +-
.../vip/mate/wiki/sse/WikiProgressBus.java | 2 +
.../java/vip/mate/wiki/tool/WikiTool.java | 32 +
.../mode/AwaitApprovalStepAdapter.java | 71 +
.../conversation/ConversationService.java | 87 +-
.../conversation/TokenUsageService.java | 12 +
.../conversation/model/MessageEntity.java | 9 +
.../workspace/conversation/vo/MessageVO.java | 12 +
.../conversation/vo/TokenUsageSummaryVO.java | 9 +
.../config/ChatUploadAutoConfiguration.java | 48 +
.../core/config/ChatUploadProperties.java | 35 +
.../service/ChatUploadLocationResolver.java | 239 +
.../main/resources/application-kingbase.yml | 8 +
.../src/main/resources/application-mysql.yml | 8 +
.../main/resources/application-postgres.yml | 8 +
.../src/main/resources/application.yml | 56 +
.../src/main/resources/db/data-en.sql | 10 +
.../main/resources/db/data-kingbase-en.sql | 10 +
.../main/resources/db/data-kingbase-zh.sql | 10 +
.../src/main/resources/db/data-mysql-en.sql | 10 +
.../src/main/resources/db/data-mysql-zh.sql | 10 +
.../src/main/resources/db/data-zh.sql | 10 +
.../h2/V157__register_session_list_tool.sql | 10 +
.../h2/V158__register_session_send_tool.sql | 9 +
.../h2/V159__sso_external_identity.sql | 79 +
.../h2/V160__register_local_tools.sql | 17 +
.../V161__agent_provider_preference_model.sql | 21 +
.../h2/V162__wiki_raw_material_error_code.sql | 9 +
.../h2/V163__wiki_raw_material_warning.sql | 10 +
.../db/migration/h2/V164__kb_open_api_key.sql | 30 +
...iki_transformation_starter_pack_global.sql | 14 +
.../h2/V166__message_usage_detail.sql | 6 +
.../V157__register_session_list_tool.sql | 10 +
.../V158__register_session_send_tool.sql | 9 +
.../kingbase/V159__sso_external_identity.sql | 37 +
.../kingbase/V160__register_local_tools.sql | 17 +
.../V161__agent_provider_preference_model.sql | 21 +
.../V162__wiki_raw_material_error_code.sql | 17 +
.../V163__wiki_raw_material_warning.sql | 27 +
.../kingbase/V164__kb_open_api_key.sql | 30 +
...iki_transformation_starter_pack_global.sql | 14 +
.../kingbase/V166__message_usage_detail.sql | 6 +
.../V157__register_session_list_tool.sql | 10 +
.../V158__register_session_send_tool.sql | 9 +
.../mysql/V159__sso_external_identity.sql | 39 +
.../mysql/V160__register_local_tools.sql | 17 +
.../V161__agent_provider_preference_model.sql | 46 +
.../V162__wiki_raw_material_error_code.sql | 12 +
.../mysql/V163__wiki_raw_material_warning.sql | 16 +
.../migration/mysql/V164__kb_open_api_key.sql | 36 +
...iki_transformation_starter_pack_global.sql | 14 +
.../mysql/V166__message_usage_detail.sql | 15 +
.../src/main/resources/docs/en/api.md | 327 ++
.../src/main/resources/docs/en/chat.md | 17 +-
.../src/main/resources/docs/en/desktop.md | 22 +
.../main/resources/docs/en/docker-deploy.md | 2 +-
.../src/main/resources/docs/en/faq.md | 6 +-
.../src/main/resources/docs/en/index.md | 2 +-
.../src/main/resources/docs/en/mcp.md | 142 +
.../src/main/resources/docs/en/models.md | 10 +-
.../src/main/resources/docs/en/openapi.md | 80 +
.../resources/docs/en/operational-export.md | 77 +
.../src/main/resources/docs/en/quickstart.md | 4 +-
.../src/main/resources/docs/en/releases.md | 1 +
.../src/main/resources/docs/en/roadmap.md | 193 +-
.../src/main/resources/docs/en/security.md | 47 +-
.../src/main/resources/docs/en/skills.md | 4 +-
.../src/main/resources/docs/en/user-guide.md | 2 +-
.../src/main/resources/docs/en/webchat.md | 29 +-
.../main/resources/docs/en/wecom-tuning.md | 2 +-
.../src/main/resources/docs/en/wiki.md | 52 +-
.../src/main/resources/docs/en/workflow.md | 6 +
.../src/main/resources/docs/en/workspaces.md | 2 +-
.../src/main/resources/docs/zh/api.md | 327 ++
.../src/main/resources/docs/zh/chat.md | 17 +-
.../src/main/resources/docs/zh/desktop.md | 22 +
.../main/resources/docs/zh/docker-deploy.md | 2 +-
.../src/main/resources/docs/zh/faq.md | 6 +-
.../src/main/resources/docs/zh/index.md | 2 +-
.../src/main/resources/docs/zh/mcp.md | 113 +
.../src/main/resources/docs/zh/models.md | 10 +-
.../src/main/resources/docs/zh/openapi.md | 80 +
.../resources/docs/zh/operational-export.md | 77 +
.../src/main/resources/docs/zh/quickstart.md | 4 +-
.../src/main/resources/docs/zh/releases.md | 1 +
.../src/main/resources/docs/zh/roadmap.md | 191 +-
.../src/main/resources/docs/zh/security.md | 46 +-
.../src/main/resources/docs/zh/skills.md | 4 +-
.../src/main/resources/docs/zh/user-guide.md | 2 +-
.../src/main/resources/docs/zh/webchat.md | 29 +-
.../main/resources/docs/zh/wecom-tuning.md | 2 +-
.../src/main/resources/docs/zh/wiki.md | 52 +-
.../src/main/resources/docs/zh/workflow.md | 6 +
.../src/main/resources/docs/zh/workspaces.md | 2 +-
.../prompts/memory/summarize-system.txt | 2 +-
.../prompts/skill/consolidate-system.txt | 19 +
.../prompts/skill/consolidate-user.txt | 6 +
.../prompts/skill/reflect-system.txt | 21 +
.../resources/prompts/skill/reflect-user.txt | 10 +
.../vip/mate/ApplicationContextSmokeTest.java | 25 +
.../AgentGraphBuilderPreferenceTest.java | 104 +-
.../AgentBindingMcpRemovalE2ETest.java | 90 +
.../AgentBindingMcpRemovalListenerTest.java | 47 +
.../context/ChatOriginSenderFieldsTest.java | 4 +-
.../mate/agent/context/ChatOriginTest.java | 4 +-
...dowManagerSpillMarkerPreservationTest.java | 9 +-
.../InformativeClearedPlaceholderTest.java | 46 +
.../context/PrefixBudgetPlannerTest.java | 145 +
.../RuntimeContextInjectorModelTest.java | 2 +-
.../RuntimeContextInjectorSenderTest.java | 6 +-
.../delegation/SubagentRunContextTest.java | 94 +
...deStreamingChatHelperToolCallArgsTest.java | 44 +
.../node/ReasoningNodeOutputClampTest.java | 56 +
.../node/ReasoningNodePtlPromptTest.java | 7 +-
.../node/PlanGenerationDisplayGoalTest.java | 76 +
.../ApprovalReplayContinuityTest.java | 2 +-
.../WorkflowApprovalResumeBridgeTest.java | 168 +
.../mate/auth/sso/SsoStateServiceTest.java | 194 +
.../channel/ChannelManagerReconcileTest.java | 3 +-
.../cards/FeishuCardDispatcherTest.java | 2 +
.../web/ChatControllerUploadPathTest.java | 57 +
.../WebChatApprovalInteractionTest.java | 223 +
.../webchat/WebChatFileServiceTest.java | 6 +-
.../tool_guard/ToolGuardCardHandlerTest.java | 68 +-
.../mate/common/net/SsrfAllowlistTest.java | 56 +
.../mate/config/OpenApiExposedAccessTest.java | 37 +
.../config/OpenApiLockedDownAccessTest.java | 59 +
.../cron/service/CronJobRunnerPromptTest.java | 2 +-
.../action/HttpActionSsrfAllowlistTest.java | 53 +
.../kbopen/auth/KbApiKeyRateLimiterTest.java | 66 +
.../mate/kbopen/auth/KbApiKeyServiceTest.java | 234 +
.../kbopen/auth/KbOpenApiAuthFilterTest.java | 127 +
.../controller/KbOpenApiControllerTest.java | 102 +
.../KbResearchSessionRegistryTest.java | 259 ++
.../llm/cache/CacheUsageExtractorTest.java | 82 +
.../probe/ContextLimitErrorParserTest.java | 62 +
.../probe/ModelContextWindowResolverTest.java | 135 +
.../probe/OllamaContextProbeParseTest.java | 52 +
...OpenAiCompatibleContextProbeParseTest.java | 70 +
.../ProviderRouterSelectPrimaryTest.java | 113 +-
.../service/ModelCapabilityServiceTest.java | 27 +-
.../mate/memory/MemoryManagerBudgetTest.java | 96 +
.../search/SessionSearchIsolationTest.java | 98 +
.../MemoryRecallFilenameTruncationTest.java | 111 +
.../plugin/PluginContextImplSearchTest.java | 103 +
.../plugin/PluginManagerSearchLookupTest.java | 112 +
.../plugin/PluginManagerUpdateConfigTest.java | 184 +
.../plugin/bridge/PluginSearchBridgeTest.java | 167 +
.../skill/installer/ZipSkillFetcherTest.java | 34 +
.../SkillConsolidationServiceTest.java | 179 +
.../skill/lifecycle/SkillCuratorJobTest.java | 4 +-
.../SkillReflectionServiceTest.java | 173 +
.../service/SystemSettingBoolApiTest.java | 7 +-
.../SystemSettingServiceCatalogTest.java | 150 +
.../browser/BrowserLauncherManualProbe.java | 3 +-
.../tool/browser/BrowserPropertiesTest.java | 92 +
.../tool/browser/UrlSafetyCheckerTest.java | 266 ++
.../tool/builtin/CodeExecuteToolArgsTest.java | 2 +-
.../builtin/CodeExecuteToolArtifactTest.java | 51 +
.../DelegateAgentToolDenyListTest.java | 3 +-
.../tool/builtin/DelegateAgentToolTest.java | 176 +-
...elegateAsyncTaskOutputAttributionTest.java | 5 +-
.../tool/builtin/DelegateAsyncToolTest.java | 5 +-
.../builtin/DelegateEventSequenceTest.java | 29 +-
.../tool/builtin/SessionListToolTest.java | 136 +
.../tool/builtin/SessionSendToolTest.java | 147 +
.../builtin/SkillManageToolWriteFileTest.java | 115 +
.../disclosure/ToolDisclosureServiceTest.java | 104 +-
.../GeneratedFileCacheLinkifyTest.java | 98 +
.../WorkspaceArtifactSurfacerTest.java | 92 +
.../guard/WorkspacePathGuardSandboxTest.java | 56 +
.../guard/WorkspacePathGuardShellTest.java | 11 +
.../WorkspaceBoundaryGuardianTest.java | 73 +-
.../tool/image/ImageFileDownloaderTest.java | 3 +-
.../tool/image/ImageReferenceLoaderTest.java | 3 +-
.../IdentityForwardingToolCallbackTest.java | 72 +
.../runtime/McpClientManagerSnapshotTest.java | 3 +-
.../McpIdentityForwardServiceTest.java | 308 ++
.../SearchProviderRegistryPluginTest.java | 224 +
.../WikiEntityControllerIdorTest.java | 102 +
.../WikiRelationControllerIdorTest.java | 299 ++
.../strategy/WikiLightModelStrategyTest.java | 77 +
.../WikiPageTypeDefStageInstructionsTest.java | 56 +
.../WikiRawMaterialFailuresMapperE2ETest.java | 95 +
.../service/WikiContextServiceBudgetTest.java | 87 +
.../WikiProcessingServiceErrorCodeTest.java | 139 +
.../WikiProcessingServiceLazyTest.java | 6 +-
.../WikiRawMaterialFailureStateTest.java | 100 +
...ransformationStarterPackGlobalE2ETest.java | 131 +
.../runtime/AwaitApprovalNotifyTest.java | 157 +
...sationServiceCleanAttachmentFilesTest.java | 15 +
.../ChatUploadLocationResolverTest.java | 203 +
...ChatUploadLocationResolverTestSupport.java | 47 +
mateclaw-ui/package.json | 2 +-
mateclaw-ui/src/api/index.ts | 73 +-
.../src/components/agents/PlanBoard.vue | 97 +-
.../src/components/agents/PlanDetailPanel.vue | 19 +-
.../src/components/chat/ContentSegment.vue | 11 +-
.../components/chat/DelegationNodeView.vue | 12 +
.../src/components/chat/MessageBubble.vue | 297 +-
.../src/components/chat/MessageList.vue | 184 +-
.../src/components/chat/RunOverviewPanel.vue | 427 ++
.../dashboard/OperationalExport.vue | 452 ++
.../useSearchProviderCatalog.test.ts | 99 +
mateclaw-ui/src/composables/chat/useChat.ts | 88 +-
.../src/composables/chat/useMessages.ts | 1 -
.../src/composables/chat/useStickToBottom.ts | 17 +-
mateclaw-ui/src/composables/chat/useStream.ts | 2 +-
mateclaw-ui/src/composables/chat/useTyping.ts | 2 +-
.../src/composables/useNotificationCenter.ts | 3 +
.../composables/useSearchProviderCatalog.ts | 84 +
mateclaw-ui/src/i18n/locales/en-US.ts | 125 +-
mateclaw-ui/src/i18n/locales/zh-CN.ts | 125 +-
mateclaw-ui/src/stores/useGoalStore.ts | 10 +
mateclaw-ui/src/stores/useWikiStore.ts | 8 +
mateclaw-ui/src/types/index.ts | 37 +
mateclaw-ui/src/types/tokenUsage.ts | 3 +
.../__tests__/generatedFileLinks.test.ts | 56 +
mateclaw-ui/src/utils/generatedFileLinks.ts | 44 +
mateclaw-ui/src/views/Agents.vue | 95 +-
mateclaw-ui/src/views/ChatConsole.vue | 79 +-
mateclaw-ui/src/views/Dashboard.vue | 113 +-
mateclaw-ui/src/views/Docs/index.vue | 227 +-
mateclaw-ui/src/views/Login.vue | 246 +-
mateclaw-ui/src/views/Plugins.vue | 175 +-
.../Models/modals/ManageModelsModal.vue | 15 +-
.../src/views/Settings/SkillCurator/index.vue | 34 +-
.../src/views/Settings/System/index.vue | 280 +-
mateclaw-ui/src/views/TokenUsage.vue | 12 +
mateclaw-ui/src/views/Tools.vue | 8 +-
.../views/Wiki/components/GraphNodeSearch.vue | 222 +
.../Wiki/components/RawMaterialPanel.vue | 67 +-
.../Wiki/components/WikiEntityGraphView.vue | 40 +-
.../Wiki/components/WikiFailureCenter.vue | 97 +
.../views/Wiki/components/WikiGraphView.vue | 51 +-
.../views/Wiki/components/WikiWorkspace.vue | 11 +-
mateclaw-ui/src/views/Wiki/index.vue | 17 +-
mateclaw-ui/src/views/layout/MainLayout.vue | 9 +-
pom.xml | 3 +-
474 files changed, 37224 insertions(+), 1283 deletions(-)
create mode 100644 mateclaw-desktop/.env.example
create mode 100644 mateclaw-desktop/.gitignore
create mode 100644 mateclaw-desktop/CODESIGNING.md
create mode 100644 mateclaw-desktop/README.md
create mode 100644 mateclaw-desktop/RELEASE_NOTES_v1.0.101.md
create mode 100644 mateclaw-desktop/branding.config.json
create mode 100644 mateclaw-desktop/build/entitlements.mac.inherit.plist
create mode 100644 mateclaw-desktop/build/entitlements.mac.plist
create mode 100644 mateclaw-desktop/build/icon.icns
create mode 100644 mateclaw-desktop/build/icon.ico
create mode 100644 mateclaw-desktop/build/icon.png
create mode 100644 mateclaw-desktop/build/icon_256.png
create mode 100644 mateclaw-desktop/electron-builder.cjs
create mode 100644 mateclaw-desktop/electron/main/config.ts
create mode 100644 mateclaw-desktop/electron/main/index.ts
create mode 100644 mateclaw-desktop/electron/main/localBridge.ts
create mode 100644 mateclaw-desktop/electron/main/localToolsApproval.ts
create mode 100644 mateclaw-desktop/electron/main/localToolsConfig.ts
create mode 100644 mateclaw-desktop/electron/main/localToolsExecutor.ts
create mode 100644 mateclaw-desktop/electron/preload/index.ts
create mode 100644 mateclaw-desktop/index.html
create mode 100644 mateclaw-desktop/package.json
create mode 100644 mateclaw-desktop/pnpm-lock.yaml
create mode 100644 mateclaw-desktop/public/logo/mateclaw_logo_s.png
create mode 100644 mateclaw-desktop/src/App.vue
create mode 100644 mateclaw-desktop/src/env.d.ts
create mode 100644 mateclaw-desktop/src/main.ts
create mode 100644 mateclaw-desktop/tsconfig.json
create mode 100644 mateclaw-desktop/tsconfig.node.json
create mode 100644 mateclaw-desktop/tsconfig.node.tsbuildinfo
create mode 100644 mateclaw-desktop/vite.config.ts
create mode 100644 mateclaw-plugin-api/src/main/java/vip/mate/plugin/api/search/PluginSearchProvider.java
create mode 100644 mateclaw-plugin-api/src/main/java/vip/mate/plugin/api/search/PluginSearchQuery.java
create mode 100644 mateclaw-plugin-api/src/main/java/vip/mate/plugin/api/search/PluginSearchResult.java
create mode 100644 mateclaw-plugin-search-sample/pom.xml
create mode 100644 mateclaw-plugin-search-sample/src/main/java/vip/mate/plugin/sample/search/SimpleSearchPlugin.java
create mode 100644 mateclaw-plugin-search-sample/src/main/resources/mateclaw-plugin.json
create mode 100644 mateclaw-server/src/main/java/vip/mate/agent/binding/service/AgentBindingMcpRemovalListener.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/agent/context/PrefixBudgetPlan.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/agent/context/PrefixBudgetPlanner.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/agent/delegation/DelegatedUsageAccumulator.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/agent/delegation/SubagentRunContext.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/SsoAutoConfiguration.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/SsoCallbackResponse.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/SsoController.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/SsoProperties.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/SsoService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/SsoStateService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/model/ExternalIdentityEntity.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/model/SsoStateEntity.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/provider/FeishuSsoProvider.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/provider/SsoProvider.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/provider/SsoProviderRegistry.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/provider/SsoUserInfo.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/repository/ExternalIdentityMapper.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/auth/sso/repository/SsoStateMapper.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/cli/ExportCommand.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/cli/MateClawCli.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/common/net/SsrfAllowlist.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/common/net/SsrfProperties.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/config/OpenApiConfig.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/config/PrefixBudgetProperties.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/KbApiKeyContext.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/KbApiKeyRateLimiter.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/KbApiKeyService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/KbOpenApiAuthFilter.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/KbScopeInterceptor.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/RequireKbScope.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/TokenHashUtil.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/model/KbApiKeyBindingEntity.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/model/KbApiKeyEntity.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/repository/KbApiKeyBindingMapper.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/auth/repository/KbApiKeyMapper.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/controller/KbApiKeyAdminController.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/controller/KbOpenApiController.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/controller/KbOpenResearchController.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/dto/KbOpenApiDtos.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/research/KbResearchSessionRegistry.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/kbopen/service/KbOpenApiService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/llm/probe/ContextLimitErrorParser.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/llm/probe/ContextProbeProperties.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/llm/probe/LocalContextProbe.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/llm/probe/LocalEndpoints.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/llm/probe/ModelContextWindowResolver.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/llm/probe/OllamaContextProbe.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/llm/probe/OpenAiCompatibleContextProbe.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/llm/routing/ProviderModelRef.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/operational/controller/OperationalDataController.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/operational/model/ExportInProgressException.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/operational/model/ExportTask.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/operational/service/OperationalDataExportService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/plugin/bridge/PluginSearchBridge.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/skill/lifecycle/SkillConsolidationService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/skill/reflection/SkillReflectionAutoConfiguration.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/skill/reflection/SkillReflectionProperties.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/skill/reflection/SkillReflectionService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/system/model/SearchProviderCatalogEntry.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/system/model/SearchProviderCatalogResponse.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/builtin/SessionListTool.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/builtin/SessionSendTool.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/disclosure/ToolUsageRecencyTracker.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/document/WorkspaceArtifactSurfacer.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/DesktopBridgeController.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/DesktopBridgeException.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/DesktopBridgeHandshakeInterceptor.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/DesktopBridgeRegistry.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/DesktopBridgeWebSocketHandler.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/LocalFileTools.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/LocalShellTool.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/LocalToolBridgeService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/local/LocalToolFormat.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/mcp/event/McpServerRemovedEvent.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/mcp/runtime/IdentityForwardingToolCallback.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/mcp/runtime/McpIdentityForwardProperties.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/tool/mcp/runtime/McpIdentityForwardService.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/wiki/dto/WikiFailureItem.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/wiki/job/strategy/WikiLightModelStrategy.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/workspace/core/config/ChatUploadAutoConfiguration.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/workspace/core/config/ChatUploadProperties.java
create mode 100644 mateclaw-server/src/main/java/vip/mate/workspace/core/service/ChatUploadLocationResolver.java
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V157__register_session_list_tool.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V158__register_session_send_tool.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V159__sso_external_identity.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V160__register_local_tools.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V161__agent_provider_preference_model.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V162__wiki_raw_material_error_code.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V163__wiki_raw_material_warning.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V164__kb_open_api_key.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V165__wiki_transformation_starter_pack_global.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/h2/V166__message_usage_detail.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V157__register_session_list_tool.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V158__register_session_send_tool.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V159__sso_external_identity.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V160__register_local_tools.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V161__agent_provider_preference_model.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V162__wiki_raw_material_error_code.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V163__wiki_raw_material_warning.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V164__kb_open_api_key.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V165__wiki_transformation_starter_pack_global.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/kingbase/V166__message_usage_detail.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V157__register_session_list_tool.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V158__register_session_send_tool.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V159__sso_external_identity.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V160__register_local_tools.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V161__agent_provider_preference_model.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V162__wiki_raw_material_error_code.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V163__wiki_raw_material_warning.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V164__kb_open_api_key.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V165__wiki_transformation_starter_pack_global.sql
create mode 100644 mateclaw-server/src/main/resources/db/migration/mysql/V166__message_usage_detail.sql
create mode 100644 mateclaw-server/src/main/resources/docs/en/openapi.md
create mode 100644 mateclaw-server/src/main/resources/docs/en/operational-export.md
create mode 100644 mateclaw-server/src/main/resources/docs/zh/openapi.md
create mode 100644 mateclaw-server/src/main/resources/docs/zh/operational-export.md
create mode 100644 mateclaw-server/src/main/resources/prompts/skill/consolidate-system.txt
create mode 100644 mateclaw-server/src/main/resources/prompts/skill/consolidate-user.txt
create mode 100644 mateclaw-server/src/main/resources/prompts/skill/reflect-system.txt
create mode 100644 mateclaw-server/src/main/resources/prompts/skill/reflect-user.txt
create mode 100644 mateclaw-server/src/test/java/vip/mate/ApplicationContextSmokeTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/agent/binding/service/AgentBindingMcpRemovalE2ETest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/agent/binding/service/AgentBindingMcpRemovalListenerTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/agent/context/InformativeClearedPlaceholderTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/agent/context/PrefixBudgetPlannerTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/agent/delegation/SubagentRunContextTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/agent/graph/node/ReasoningNodeOutputClampTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/agent/graph/plan/node/PlanGenerationDisplayGoalTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/approval/WorkflowApprovalResumeBridgeTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/auth/sso/SsoStateServiceTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/channel/web/ChatControllerUploadPathTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/channel/webchat/WebChatApprovalInteractionTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/common/net/SsrfAllowlistTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/config/OpenApiExposedAccessTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/config/OpenApiLockedDownAccessTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/hook/action/HttpActionSsrfAllowlistTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/kbopen/auth/KbApiKeyRateLimiterTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/kbopen/auth/KbApiKeyServiceTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/kbopen/auth/KbOpenApiAuthFilterTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/kbopen/controller/KbOpenApiControllerTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/kbopen/research/KbResearchSessionRegistryTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/llm/cache/CacheUsageExtractorTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/llm/probe/ContextLimitErrorParserTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/llm/probe/ModelContextWindowResolverTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/llm/probe/OllamaContextProbeParseTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/llm/probe/OpenAiCompatibleContextProbeParseTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/memory/MemoryManagerBudgetTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/memory/search/SessionSearchIsolationTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/memory/service/MemoryRecallFilenameTruncationTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/plugin/PluginContextImplSearchTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/plugin/PluginManagerSearchLookupTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/plugin/PluginManagerUpdateConfigTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/plugin/bridge/PluginSearchBridgeTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/skill/lifecycle/SkillConsolidationServiceTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/skill/reflection/SkillReflectionServiceTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/system/service/SystemSettingServiceCatalogTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/browser/BrowserPropertiesTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/browser/UrlSafetyCheckerTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/builtin/CodeExecuteToolArtifactTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/builtin/SessionListToolTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/builtin/SessionSendToolTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/builtin/SkillManageToolWriteFileTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/document/GeneratedFileCacheLinkifyTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/document/WorkspaceArtifactSurfacerTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/mcp/runtime/IdentityForwardingToolCallbackTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/mcp/runtime/McpIdentityForwardServiceTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/tool/search/SearchProviderRegistryPluginTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/controller/WikiEntityControllerIdorTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/controller/WikiRelationControllerIdorTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/job/strategy/WikiLightModelStrategyTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/profile/WikiPageTypeDefStageInstructionsTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/repository/WikiRawMaterialFailuresMapperE2ETest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/service/WikiContextServiceBudgetTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/service/WikiProcessingServiceErrorCodeTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/service/WikiRawMaterialFailureStateTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/wiki/service/WikiTransformationStarterPackGlobalE2ETest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/workflow/runtime/AwaitApprovalNotifyTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/workspace/core/service/ChatUploadLocationResolverTest.java
create mode 100644 mateclaw-server/src/test/java/vip/mate/workspace/core/service/ChatUploadLocationResolverTestSupport.java
create mode 100644 mateclaw-ui/src/components/chat/RunOverviewPanel.vue
create mode 100644 mateclaw-ui/src/components/dashboard/OperationalExport.vue
create mode 100644 mateclaw-ui/src/composables/__tests__/useSearchProviderCatalog.test.ts
create mode 100644 mateclaw-ui/src/composables/useSearchProviderCatalog.ts
create mode 100644 mateclaw-ui/src/utils/__tests__/generatedFileLinks.test.ts
create mode 100644 mateclaw-ui/src/utils/generatedFileLinks.ts
create mode 100644 mateclaw-ui/src/views/Wiki/components/GraphNodeSearch.vue
create mode 100644 mateclaw-ui/src/views/Wiki/components/WikiFailureCenter.vue
diff --git a/.env.example b/.env.example
index 3983a0dd..1213459f 100644
--- a/.env.example
+++ b/.env.example
@@ -34,6 +34,11 @@ MATECLAW_CORS_ALLOWED_ORIGINS=
# 留空时回退到当前请求的 host，再退回相对路径。反代后部署建议显式设置。
MATECLAW_PUBLIC_BASE_URL=
+# 是否公开 Swagger UI / OpenAPI 文档（/swagger-ui.html、/v3/api-docs）。
+# 生产数据库 profile（mysql/kingbase/postgres）默认 false —— 匿名无法浏览全部
+# 端点结构，需全局管理员（ROLE_ADMIN）。仅在内网/预发临时调试时设为 true。
+MATECLAW_OPENAPI_EXPOSE_UI=
+
# SearXNG 会话密钥（容器内部用，留空会用开发默认值）。生产部署请设成 32+ 位随机串。
# openssl rand -hex 32
SEARXNG_SECRET=
@@ -55,6 +60,20 @@ MATECLAW_BROWSER_CDP_URL=
MATECLAW_BROWSER_CHROME_PATH=
MATECLAW_BROWSER_CHANNEL=
+# ==================== 局域网 部署放开（可选，默认 false 严格模式） ====================
+# 浏览器 SSRF 防护：放行本地回环和私有 IP（127.0.0.1 / 10.x / 192.168.x /
+# 172.16-31.x / IPv6 fc00::/7 等），公网部署务必保持 false，否则 SSRF 防护失效
+PLAYWRIGHT_ALLOW_PRIVATE_NETWORK=false
+# 浏览器忽略 HTTPS 证书错误（自签证书 / IP 直连 HTTPS 场景）
+# 公网部署务必保持 false，否则中间人攻击可绕过证书校验
+PLAYWRIGHT_IGNORE_HTTPS_ERRORS=false
+# Playwright 单次操作超时（秒），慢链路 / 大页面可调高
+PLAYWRIGHT_DEFAULT_TIMEOUT_SECONDS=30
+# Playwright 导航超时（秒），慢网络可调高
+PLAYWRIGHT_NAVIGATION_TIMEOUT_SECONDS=30
+# snapshot 文本截断长度，超出会返回 truncated:true 提示 LLM 用 selector 缩小范围
+PLAYWRIGHT_SNAPSHOT_MAX_LENGTH=20000
+
# ==================== OpenAI OAuth（Docker，可选） ====================
#
# OpenAI ChatGPT OAuth 使用 Codex CLI 的 public client + PKCE / device code，
diff --git a/.gitignore b/.gitignore
index f93f1342..5e5ab1e8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -105,6 +105,9 @@ CLAUDE.md
# Codex CLI local artifacts
.codex/
+# Codebase memory (local agent index / graph artifact; do not commit)
+.codebase-memory/
+
# Sync tooling local state (generated each run; report is intentionally tracked)
scripts/.*-sync-state.json
diff --git a/README.md b/README.md
index 3d338c90..524afd5c 100644
--- a/README.md
+++ b/README.md
@@ -10,14 +10,14 @@
Agent Harness · Spring Boot inside · One JAR to ship
-[](https://github.com/matevip/mateclaw)
+[](https://github.com/mateaix/mateclaw)
[](https://claw.mate.vip/docs)
[](https://claw-demo.mate.vip)
[](https://claw.mate.vip)
[](https://adoptium.net/)
[](https://spring.io/projects/spring-boot)
[](https://vuejs.org/)
-[](https://github.com/matevip/mateclaw)
+[](https://github.com/mateaix/mateclaw)
[](LICENSE)
[[Website](https://claw.mate.vip)] [[Live Demo](https://claw-demo.mate.vip)] [[Documentation](https://claw.mate.vip/docs)] [[中文](README_zh.md)]
@@ -161,7 +161,7 @@ docker compose up -d # http://localhost:18080
### Desktop
-Download from [GitHub Releases](https://github.com/matevip/mateclaw/releases). Bundles JRE 21. No Java install needed.
+Download from [GitHub Releases](https://github.com/mateaix/mateclaw/releases). Bundles JRE 21. No Java install needed.
---
@@ -193,7 +193,7 @@ mateclaw/
└── .env.example
```
-Desktop binaries ship via [GitHub Releases](https://github.com/matevip/mateclaw/releases) with a bundled JRE 21 — no Java install needed.
+Desktop binaries ship via [GitHub Releases](https://github.com/mateaix/mateclaw/releases) with a bundled JRE 21 — no Java install needed.
## Tech stack
@@ -217,25 +217,29 @@ Full docs at **[claw.mate.vip/docs](https://claw.mate.vip/docs)** — setup, arc
## Roadmap
+**v1.7.0 (shipped 2026-07-04)** — a *productionization pass*: once it's in real collaboration, close every loop you can't see, gather, reach, fit, or connect:
+
+- **All three approval paths close the loop** — workflow `await_approval` actually pushes to channels and resolves → resumes, the WebChat (API-key) channel can approve/deny and replay, and Feishu/WeCom card clicks resolve workflow approvals directly
+- **Long tasks are visible** — an always-on Run Overview rail + a per-turn token breakdown (cache hit/miss/write + reasoning split) + sub-agent cost rolled up + one-click generated-file download
+- **Fits the real model window** — local-model context-window probing, a unified token budget for prefix injection, small-context degradation, and tool-schema budget gating — no more "guess 32K" pre-flight rejections or silent truncation
+- **Opens up** — a knowledge-base + Deep Research open API (API-key + rate limit + SSE), a pluggable search Provider SPI, and MCP identity forwarding (carry the authenticated user's identity into a STDIO MCP)
+- **Reaches further** — desktop local-embedded / remote-centralized dual mode (with `mateclaw-desktop` source opened) + a LAN deployment mode for controlled intranet access
+- **One-click operational data export** — Dashboard 9-sheet Excel + a CLI for offline export
+
+Full story in the [v1.7.0 release notes](https://claw.mate.vip/docs/en/releases/1.7.0).
+
+**v1.6.0 (shipped 2026-06-22)** — make the autonomous employee *fast, sharp-eyed, and embeddable*: two-stage skill loading + prefix compression (faster first token) · `execute_code` native sandboxed code execution · vision that persists across turns + `image_analyze` · embeddable/headless webchat with per-`endUserId` memory · a Wiki you actually read (reading split from management · unified Sources tab · clickable `[[wikilinks]]`) · steadier under load (self-healing MCP · tool-call recovery · evidence-gated plans). Full story in the [v1.6.0 release notes](https://claw.mate.vip/docs/en/releases/1.6.0).
+
**v1.5.0 (shipped 2026-06-04)** — Goal checklists (fuzzy score → ticked boxes) · self-maintaining Wiki (`[[wikilinks]]` · fact/experience layers · pageType profiles & permissions · KB pipelines · local-directory ingest) · per-owner memory isolation (`owner_key` + visibility scope + `endUserId` passthrough) · per-agent primary knowledge base · provider-preference model routing. Full story in the [v1.5.0 release notes](https://claw.mate.vip/docs/en/releases/1.5.0).
**v1.4.0 (shipped 2026-05-23)** — Persistent Goals (lock a goal, self-evaluate every turn) · subagent delegation tree (3 levels deep · sync / parallel / async · one-sentence team builder) · progressive tool/skill disclosure · Workspace RBAC (Owner / Admin / Member / Viewer) · Feishu first-class (interactive / approval / streaming cards · channel-native tools). See the [v1.4.0 release notes](https://claw.mate.vip/docs/en/releases/1.4.0).
**v1.3.0 (shipped 2026-05-13)** — Workflow engine · 6-pattern trigger system · Wiki transformations · per-agent MCP binding · multimodal sidecar routing · four JVM-native document-generation tools · image edit. See the [v1.3.0 release notes](https://claw.mate.vip/docs/en/releases/1.3.0).
-**v1.6.0 (in progress)** — make the autonomous employee *fast, sharp-eyed, and embeddable*:
-
-- **Faster first token** — two-stage skill loading (base skills resident, scenario skills retrieved on demand by a relevance scorer) plus prefix compression, cutting the cold-start payload that used to blow past a million characters
-- **Native code execution** — `execute_code` lets an employee write and run sandboxed code to compute, transform data, and assemble multi-format reports, all JVM-side
-- **Vision that persists** — images stay in context across turns; `image_analyze` re-reads an attachment on demand, so "zoom into that chart" follow-ups work without re-uploading
-- **Embeddable & headless** — the webchat widget becomes a Web/API surface with multi-session support and per-end-user identity (`endUserId`), isolating memory per end user
-- **A Wiki you actually read** — reading split from management, a unified Sources tab with per-KB auto-sync, and clickable cross-KB `[[wikilinks]]`
-- **Steadier under load** — self-healing MCP connections · tool-call recovery on interleaved-thinking models · evidence-gated plan execution
-
## Contributing
```bash
-git clone https://github.com/matevip/mateclaw.git
+git clone https://github.com/mateaix/mateclaw.git
cd mateclaw
cd mateclaw-server && mvn clean compile
cd ../mateclaw-ui && pnpm install && pnpm dev
diff --git a/README_zh.md b/README_zh.md
index dae024a8..a23506d5 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -10,14 +10,14 @@
Agent Harness · Spring Boot 内核 · 一个 JAR 交付
-[](https://github.com/matevip/mateclaw)
+[](https://github.com/mateaix/mateclaw)
[](https://claw.mate.vip/docs)
[](https://claw-demo.mate.vip)
[](https://claw.mate.vip)
[](https://adoptium.net/)
[](https://spring.io/projects/spring-boot)
[](https://vuejs.org/)
-[](https://github.com/matevip/mateclaw)
+[](https://github.com/mateaix/mateclaw)
[](LICENSE)
[[官网](https://claw.mate.vip)] [[在线演示](https://claw-demo.mate.vip)] [[文档](https://claw.mate.vip/docs)] [[English](README.md)]
@@ -161,7 +161,7 @@ docker compose up -d # http://localhost:18080
### 桌面端
-从 [GitHub Releases](https://github.com/matevip/mateclaw/releases) 下载安装包。内嵌 JRE 21，无需额外装 Java。
+从 [GitHub Releases](https://github.com/mateaix/mateclaw/releases) 下载安装包。内嵌 JRE 21，无需额外装 Java。
---
@@ -193,7 +193,7 @@ mateclaw/
└── .env.example
```
-桌面端安装包通过 [GitHub Releases](https://github.com/matevip/mateclaw/releases) 分发，内嵌 JRE 21——无需安装 Java。
+桌面端安装包通过 [GitHub Releases](https://github.com/mateaix/mateclaw/releases) 分发，内嵌 JRE 21——无需安装 Java。
## 技术栈
@@ -217,25 +217,29 @@ mateclaw/
## 路线图
+**v1.7.0（2026-07-04 发布）** — 一次*生产化加固*：把它放进真正的协作里之后，那些看不见、收不拢、够不着、装不下、连不通的地方全补上：
+
+- **审批三条链路彻底闭环** — 工作流 `await_approval` 真的推到渠道并 resolve→恢复执行、WebChat（API-Key）渠道能批准/拒绝并重放、飞书/企微点卡片直接 resolve 工作流审批
+- **长任务看得见** — 常驻「运行总览」侧栏 + 本轮 Token 明细（缓存命中/未命中/写入 + 推理拆分）+ 子 Agent 成本向上滚加 + 生成文件一键下载
+- **装得下真实模型窗口** — 本地模型上下文窗口探测、prefix 注入统一 Token 预算、小上下文降级、工具 schema 预算门——不再被"猜个 32K"坑到预检拒绝或悄悄截断
+- **开放出去** — 知识库 / Deep Research 开放 API（API-Key + 限流 + SSE）、插件化搜索 Provider SPI、MCP 身份透传（把认证用户身份带给 STDIO MCP）
+- **够得着更远** — 桌面端本地内嵌 / 远程集中部署双模式（`mateclaw-desktop` 源码开放）+ 局域网部署模式放开受控内网访问
+- **运营数据一键导出** — Dashboard 9 表 Excel + CLI 命令行离线导出
+
+完整故事见 [v1.7.0 release notes](https://claw.mate.vip/docs/zh/releases/1.7.0)。
+
+**v1.6.0（2026-06-22 发布）** — 让自驱的数字员工*更快、更会看、更易嵌入*：技能两段式载入 + prefix 压缩（首字节更快）· `execute_code` 原生沙箱代码执行 · 图片跨轮次留存 + `image_analyze` · 可嵌入/无头 webchat 按 `endUserId` 隔离记忆 · 真正可读的 Wiki（阅读与管理分离 · 统一 Sources 标签 · 可点击 `[[wikilinks]]`）· 高负载更稳（MCP 自愈 · 工具调用恢复 · 计划证据闸门）。完整故事见 [v1.6.0 release notes](https://claw.mate.vip/docs/zh/releases/1.6.0)。
+
**v1.5.0（2026-06-04 发布）** — Goal 可勾选清单（模糊评分 → 逐项打勾）· Wiki 自维护（`[[wikilinks]]` · 事实层/经验层 · pageType 模板与权限 · 知识库流水线 · 本地目录接入）· 按拥有者隔离记忆（`owner_key` + 可见域 + `endUserId` 透传）· 每员工绑定主知识库 · 偏好 provider 驱动选型。完整故事见 [v1.5.0 release notes](https://claw.mate.vip/docs/zh/releases/1.5.0)。
**v1.4.0（2026-05-23 发布）** — 持续目标（锁定目标，每轮自评）· 子员工委派树（最深 3 层 · 同步 / 并行 / 异步 · 一句话组队）· 工具/技能渐进式披露 · 工作空间 RBAC（Owner / Admin / Member / Viewer）· 飞书一等公民（交互卡 / 审批卡 / 流式卡 · 渠道原生工具）。详见 [v1.4.0 release notes](https://claw.mate.vip/docs/zh/releases/1.4.0)。
**v1.3.0（2026-05-13 发布）** — 工作流引擎 · 6 种 pattern 触发器 · Wiki 加工器 · 每员工独立 MCP 绑定 · 多模态旁路路由 · 4 个 JVM 原生文档生成工具 · 图像编辑。详见 [v1.3.0 release notes](https://claw.mate.vip/docs/zh/releases/1.3.0)。
-**v1.6.0（开发中）** — 让自驱的数字员工*更快、更会看、更易嵌入*：
-
-- **首字节更快** — 技能两段式载入（基础技能常驻，场景技能由相关性评分器按需检索）+ prefix 压缩，砍掉过去单请求动辄上百万字符的冷启动负载
-- **原生代码执行** — `execute_code` 让员工自己写、自己跑沙箱代码，完成计算、数据加工与多格式报告生成，全程在 JVM 内
-- **能记住图的视觉** — 图片跨轮次保留在上下文里；`image_analyze` 按需重新解析某张附件，"放大看那张图表"这类追问无需重新上传
-- **可嵌入、可无头** — webchat 组件升级为 Web/API 接入面，支持多会话与按终端用户身份（`endUserId`）隔离记忆
-- **真正可读的 Wiki** — 阅读与管理分离、统一的 Sources 标签页（按知识库自动同步）、可点击的跨库 `[[wikilinks]]`
-- **高负载更稳** — MCP 连接自愈 · interleaved-thinking 模型的工具调用恢复 · 计划执行的证据闸门
-
## 参与贡献
```bash
-git clone https://github.com/matevip/mateclaw.git
+git clone https://github.com/mateaix/mateclaw.git
cd mateclaw
cd mateclaw-server && mvn clean compile
cd ../mateclaw-ui && pnpm install && pnpm dev
diff --git a/docker-compose.yml b/docker-compose.yml
index 36fe8052..66fbab91 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -92,6 +92,30 @@ services:
MATECLAW_BROWSER_CDP_URL: ${MATECLAW_BROWSER_CDP_URL:-}
MATECLAW_BROWSER_CHROME_PATH: ${MATECLAW_BROWSER_CHROME_PATH:-}
MATECLAW_BROWSER_CHANNEL: ${MATECLAW_BROWSER_CHANNEL:-}
+ # SSRF / TLS relaxations for isolated LAN / on-prem deployments.
+ # Both default to false (strict mode, public-internet safe).
+ # The .env file uses the PLAYWRIGHT_* prefix (component-oriented naming,
+ # not product-oriented) — here we translate to the MATECLAW_BROWSER_*
+ # container env that Spring Boot relaxed-binding maps to BrowserProperties.
+ # - PLAYWRIGHT_ALLOW_PRIVATE_NETWORK=true: allow loopback / private / link-local
+ # addresses through the browser SSRF guard. Cloud-metadata endpoints stay
+ # blocked. Turn on when the agent must drive http://192.168.x.x:port style
+ # internal services and has no path to the public internet.
+ # - PLAYWRIGHT_IGNORE_HTTPS_ERRORS=true: ignore HTTPS certificate errors.
+ # Auto-enables --ignore-certificate-errors at the Chromium command line
+ # when ALLOW_PRIVATE_NETWORK is also true (so CDP-attached external
+ # browsers benefit too). Leave false on internet-facing deployments.
+ MATECLAW_BROWSER_ALLOW_PRIVATE_NETWORK: ${PLAYWRIGHT_ALLOW_PRIVATE_NETWORK:-false}
+ MATECLAW_BROWSER_IGNORE_HTTPS_ERRORS: ${PLAYWRIGHT_IGNORE_HTTPS_ERRORS:-false}
+ # Playwright action / navigation timeouts (seconds). Increase for slow
+ # LAN or large-page scenarios. Defaults match Playwright's own (30s).
+ MATECLAW_BROWSER_DEFAULT_TIMEOUT_SECONDS: ${PLAYWRIGHT_DEFAULT_TIMEOUT_SECONDS:-30}
+ MATECLAW_BROWSER_DEFAULT_NAVIGATION_TIMEOUT_SECONDS: ${PLAYWRIGHT_NAVIGATION_TIMEOUT_SECONDS:-30}
+ # Hard cap on the textual snapshot returned by action=snapshot. Content
+ # beyond this length is dropped with a truncated:true flag and a hint to
+ # retry with selector. Results > framework spill threshold (~8000 chars)
+ # are further spilt to disk by ToolResultStorage.
+ MATECLAW_BROWSER_SNAPSHOT_MAX_LENGTH: ${PLAYWRIGHT_SNAPSHOT_MAX_LENGTH:-20000}
# OAuth 模式默认保持 auto：localhost 访问走 LOCAL，IP/域名访问走 DEVICE_CODE。
# 本机 Docker 若要强制使用 localhost:1455 回调，可在 .env 显式设为 local。
MATECLAW_OAUTH_OPENAI_DEPLOYMENT_MODE: ${MATECLAW_OAUTH_OPENAI_DEPLOYMENT_MODE:-}
diff --git a/mateclaw-desktop/.env.example b/mateclaw-desktop/.env.example
new file mode 100644
index 00000000..5ba7a3ec
--- /dev/null
+++ b/mateclaw-desktop/.env.example
@@ -0,0 +1,15 @@
+# macOS 代码签名与公证
+# 本地构建推荐不设 CSC_LINK，让 electron-builder 自动从钥匙串发现证书
+# CSC_LINK=/path/to/developer_id_application.p12 # CI/CD 专用
+# CSC_KEY_PASSWORD= # CI/CD 专用
+
+APPLE_ID=your@apple.id
+APPLE_APP_SPECIFIC_PASSWORD=xxxx-xxxx-xxxx-xxxx
+APPLE_TEAM_ID=XXXXXXXXXX
+
+# GitHub Releases 发布
+GH_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+# Windows 代码签名（可选）
+# WIN_CSC_LINK=/path/to/windows-cert.pfx
+# WIN_CSC_KEY_PASSWORD=
diff --git a/mateclaw-desktop/.gitignore b/mateclaw-desktop/.gitignore
new file mode 100644
index 00000000..2f1d662c
--- /dev/null
+++ b/mateclaw-desktop/.gitignore
@@ -0,0 +1,33 @@
+# Dependencies
+node_modules/
+
+# Build output
+dist/
+dist-electron/
+release/
+
+# Resources (downloaded/generated, not committed)
+resources/jre/
+resources/app.jar
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Logs
+*.log
+npm-debug.log*
+
+# Runtime data (H2 database created during dev testing)
+data/
+
+# Environment
+.env
+.env.local
diff --git a/mateclaw-desktop/CODESIGNING.md b/mateclaw-desktop/CODESIGNING.md
new file mode 100644
index 00000000..ced54225
--- /dev/null
+++ b/mateclaw-desktop/CODESIGNING.md
@@ -0,0 +1,275 @@
+# macOS 代码签名证书操作指南
+
+本文档详细说明如何创建、导出和配置 macOS **Developer ID Application** 证书，用于 MateClaw Desktop 的签名与公证。
+
+---
+
+## 前置条件
+
+- [Apple Developer Program](https://developer.apple.com/programs/) 会员（$99/年）
+- macOS 系统（需要钥匙串访问生成密钥对）
+
+## Step 1: 撤销旧证书（如有）
+
+如果本地证书已过期或私钥丢失，需先撤销线上旧证书：
+
+1. 登录 https://developer.apple.com/account/resources/certificates/list
+2. 找到旧的 `Developer ID Application` 证书 → 点击进入详情
+3. 点击 **Revoke** → 确认撤销
+4. 回到本地 **钥匙串访问** → 删除过期证书（右键 → 删除）
+
+## Step 2: 生成 CSR（证书签名请求）
+
+CSR 会在本地生成密钥对（私钥留在钥匙串，公钥随 CSR 提交给 Apple）。
+
+1. 打开 **钥匙串访问**
+2. 菜单栏 → 钥匙串访问 → **证书助理** → **从证书颁发机构请求证书…**
+3. 填写：
+ - **用户电子邮件地址**：你的 Apple ID 邮箱
+ - **常用名称**：与开发者账号一致（如 `ZHANFU XU`）
+ - **CA 电子邮件地址**：留空
+ - **请求是**：选择 **存储到磁盘**
+4. 保存 `CertificateSigningRequest.certSigningRequest` 到桌面
+
+## Step 3: 创建 Developer ID Application 证书
+
+1. 访问 https://developer.apple.com/account/resources/certificates/add
+2. 在 **Software** 分类下，选择 **Developer ID Application**
+3. 点击 **Continue**
+4. 上传 Step 2 保存的 CSR 文件
+5. 点击 **Continue** → **Download** 下载 `developerID_application.cer`
+6. **双击**下载的 `.cer` 文件 → 自动安装到钥匙串
+
+## Step 4: 验证安装
+
+```bash
+security find-identity -v -p codesigning | grep "Developer ID Application"
+```
+
+应输出类似：
+
+```
+"Developer ID Application: ZHANFU XU (MR97WAD978)"
+```
+
+在钥匙串访问 → 登录 → **我的证书**中，展开该证书应能看到关联的**私钥**（左侧三角展开）。
+
+## Step 5: 导出 .p12 文件
+
+`.p12` 文件包含证书 + 私钥，是 `electron-builder` 签名所需的文件。
+
+1. 钥匙串访问 → 登录 → **我的证书**
+2. 找到 `Developer ID Application: Your Name (TEAMID)`
+3. 点左侧三角**展开**，确认包含私钥
+4. **右键证书**（不是私钥）→ **导出…**
+5. 格式选择：**个人信息交换 (.p12)**
+6. 保存为 `developer_id_application.p12`
+7. 设置一个强密码（后续用作 `CSC_KEY_PASSWORD` 环境变量）
+
+> **安全提醒**：`.p12` 文件包含私钥，绝不要提交到 Git 仓库。
+
+## Step 6: 创建 App 专用密码（公证用）
+
+Apple 公证（notarization）需要通过 Apple ID 验证身份，使用 App 专用密码代替账号密码。
+
+1. 访问 https://appleid.apple.com/account/manage
+2. 登录 → **登录与安全** → **App 专用密码** → **生成**
+3. 标签填：`mateclaw-notarize`
+4. 记录生成的密码（格式如 `xxxx-xxxx-xxxx-xxxx`）
+
+## Step 7: 查找 Team ID
+
+```bash
+security find-identity -v -p codesigning | grep "Developer ID Application"
+```
+
+输出中括号内的 10 位字母数字即为 Team ID（如 `MR97WAD978`）。
+
+## Step 8: 配置环境变量并构建
+
+### 方式 A：本地钥匙串自动发现（推荐）
+
+证书已安装到本地钥匙串时，**不需要设置 `CSC_LINK` 和 `CSC_KEY_PASSWORD`**，electron-builder 会自动从钥匙串中发现 Developer ID Application 证书。
+
+```bash
+cd mateclaw-desktop
+
+# 只需设置公证相关变量
+export APPLE_ID="your@apple.id"
+export APPLE_APP_SPECIFIC_PASSWORD="xxxx-xxxx-xxxx-xxxx"
+export APPLE_TEAM_ID="XXXXXXXXXX"
+
+# 执行签名+公证构建
+bash scripts/build-all-platforms.sh --mac-only
+```
+
+> **为什么推荐这种方式？** 设置 `CSC_LINK` 时，electron-builder 会创建一个临时钥匙串来导入 `.p12` 文件，这可能导致签名过程静默卡死（无报错）。直接使用本地钥匙串可以避免此问题。
+
+### 方式 B：指定 .p12 文件（CI/CD 专用）
+
+在 CI/CD 环境或证书不在本地钥匙串时，需要通过环境变量指定 `.p12` 文件：
+
+```bash
+cd mateclaw-desktop
+
+export CSC_LINK="$HOME/developer_id_application.p12"
+export CSC_KEY_PASSWORD="你的p12密码"
+export APPLE_ID="your@apple.id"
+export APPLE_APP_SPECIFIC_PASSWORD="xxxx-xxxx-xxxx-xxxx"
+export APPLE_TEAM_ID="XXXXXXXXXX"
+
+bash scripts/build-all-platforms.sh --mac-only
+```
+
+> **注意**：`CSC_KEY_PASSWORD` 中如有特殊字符（`$`、`!`、`"`、`` ` ``），必须用**单引号**包裹，如 `export CSC_KEY_PASSWORD='pa$$w0rd!'`。
+
+### GitHub Actions Secrets
+
+将 `.p12` 文件 Base64 编码后存为 GitHub Secret：
+
+```bash
+base64 -i developer_id_application.p12 | pbcopy
+# 粘贴到 GitHub Secret: MAC_CSC_LINK
+```
+
+| GitHub Secret | 值 |
+|---|---|
+| `MAC_CSC_LINK` | `.p12` 的 Base64 内容 |
+| `MAC_CSC_KEY_PASSWORD` | `.p12` 密码 |
+| `APPLE_ID` | Apple ID 邮箱 |
+| `APPLE_APP_SPECIFIC_PASSWORD` | App 专用密码 |
+| `APPLE_TEAM_ID` | 10 位 Team ID |
+
+## Step 9: 验证签名和公证
+
+构建完成后验证：
+
+```bash
+# 验证代码签名
+codesign --verify --deep --strict release/mac-arm64/MateClaw.app
+
+# 验证 Gatekeeper 公证状态
+spctl --assess --type execute --verbose release/mac-arm64/MateClaw.app
+# 期望输出: accepted, source=Developer ID
+
+# 验证 DMG
+spctl --assess --type open --context context:primary-signature release/MateClaw-*.dmg
+```
+
+---
+
+## 故障排查
+
+### 签名卡死（无报错）
+
+**现象**：构建停在 `signing` 行不动，`ps aux | grep codesign` 无进程或进程短暂出现后消失。
+
+**原因**：设置了 `CSC_LINK` 后，electron-builder 会创建临时钥匙串导入 `.p12`，临时钥匙串的访问权限可能导致 `codesign` 静默卡死。
+
+**解决**：
+```bash
+# 方案一（推荐）：取消 CSC_LINK，使用本地钥匙串自动发现
+unset CSC_LINK
+unset CSC_KEY_PASSWORD
+
+# 方案二：授权 codesign 访问钥匙串
+security unlock-keychain -p "你的Mac登录密码" ~/Library/Keychains/login.keychain-db
+security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "你的Mac登录密码" ~/Library/Keychains/login.keychain-db
+```
+
+### `Permission denied` (classes.jsa)
+
+**现象**：`codesign` 报错 `Permission denied`，通常指向 JRE 中的 `classes.jsa` 文件。
+
+**原因**：下载的 Adoptium JRE 中部分文件是只读的，`codesign --force` 需要写权限。
+
+**解决**：`download-jre.sh` 已在解压后自动执行 `chmod -R u+w`。如果使用旧版 JRE，手动修复：
+```bash
+# 删除旧 JRE 重新下载（推荐）
+rm -rf resources/jre/mac-arm64 resources/jre/mac-x64
+npm run setup:jre
+
+# 或手动修复权限
+chmod -R u+w resources/jre/
+```
+
+### `MAC verification failed` (wrong password)
+
+**现象**：`SecKeychainItemImport: MAC verification failed during PKCS12 import (wrong password?)`
+
+**原因**：`CSC_KEY_PASSWORD` 与导出 `.p12` 时设置的密码不匹配。
+
+**解决**：
+```bash
+# 验证密码是否正确
+openssl pkcs12 -in ~/developer_id_application.p12 -nokeys -passin pass:"你的密码"
+
+# 如果报错 mac verify failure，重新导出 .p12：
+# 钥匙串访问 → 我的证书 → 右键 Developer ID Application → 导出 → 重新设置密码
+
+# 注意特殊字符需用单引号包裹
+export CSC_KEY_PASSWORD='pa$$w0rd!'
+```
+
+### 公证上传超时 (deadlineExceeded)
+
+**现象**：`HTTPClientError.deadlineExceeded`，公证上传到 Apple S3 超时。
+
+**原因**：网络到 Apple 服务器不稳定，700MB+ 的应用上传容易超时。
+
+**解决**：先跳过公证构建，再用 `xcrun notarytool` 手动公证（支持断点续传，超时容忍度更高）：
+```bash
+# 1. 去掉公证变量，仅签名
+unset APPLE_ID
+unset APPLE_APP_SPECIFIC_PASSWORD
+unset APPLE_TEAM_ID
+bash scripts/build-all-platforms.sh --mac-only
+
+# 2. 手动公证
+xcrun notarytool submit release/MateClaw_1.0.0_arm64.zip \
+ --apple-id "your@apple.id" \
+ --password "app专用密码" \
+ --team-id "XXXXXXXXXX" \
+ --wait
+
+xcrun notarytool submit release/MateClaw_1.0.0_x64.zip \
+ --apple-id "your@apple.id" \
+ --password "app专用密码" \
+ --team-id "XXXXXXXXXX" \
+ --wait
+
+# 3. 装订公证票据到 DMG
+xcrun stapler staple release/MateClaw_1.0.0_arm64.dmg
+xcrun stapler staple release/MateClaw_1.0.0_x64.dmg
+```
+
+---
+
+## 常见问题
+
+### 证书过期了怎么办？
+
+Developer ID Application 证书有效期 **5 年**。过期后需重复 Step 1 ~ Step 5 重新创建。Apple 会在自动轮换日期前通过邮件提醒。
+
+### 导出 .p12 时没有"导出"选项？
+
+说明本地钥匙串中没有该证书对应的私钥。私钥只存在于当初生成 CSR 的那台 Mac 上。解决方案：
+- **方案 A**：在原 Mac 上导出 `.p12`，再导入到当前 Mac
+- **方案 B**：撤销旧证书，在当前 Mac 重新创建（Step 1 ~ Step 5）
+
+### 签名很慢正常吗？
+
+正常。700MB+ 的应用（含 JRE + Electron Framework）签名需要 **15~30 分钟**，公证上传+审核需要额外 **5~15 分钟**。可以用以下命令监控签名进度：
+```bash
+watch -n 2 'ps aux | grep codesign | grep -v grep'
+# macOS 需先安装：brew install watch
+```
+
+### 跳过签名（开发测试用）
+
+```bash
+export CSC_IDENTITY_AUTO_DISCOVERY=false
+bash scripts/build-all-platforms.sh --mac-only
+```
+
+未签名的应用无法使用自动升级功能，macOS 用户需手动下载 DMG 安装。
diff --git a/mateclaw-desktop/README.md b/mateclaw-desktop/README.md
new file mode 100644
index 00000000..bbdd697a
--- /dev/null
+++ b/mateclaw-desktop/README.md
@@ -0,0 +1,432 @@
+# MateClaw Desktop
+
+MateClaw 的桌面客户端，基于 Electron 构建，自动集成 JRE 21 和后端服务，实现双击即用。
+
+## 架构
+
+```
+Electron Shell
+├── Splash Screen (Vue 3) ← 启动加载界面
+├── Bundled JRE 21 ← 自带 Java 运行时
+├── mateclaw-server.jar ← Spring Boot 后端 + Vue 前端
+└── BrowserWindow → localhost:18088
+```
+
+**启动流程**: Electron 启动 → 显示 Splash → 用内置 JRE 启动 JAR → 等待后端就绪 → 加载主界面
+
+## 快速开始
+
+### 前置要求
+
+- Node.js 18+
+- pnpm (前端构建)
+- Maven 3.9+ (后端构建)
+- Java 21+ (仅构建时需要，运行时使用内置 JRE)
+
+### 开发模式
+
+```bash
+# 1. 安装依赖
+npm install
+
+# 2. 构建后端 JAR（包含前端资源）
+npm run setup:jar
+
+# 3. 下载 JRE（当前平台）
+npm run setup:jre
+
+# 4. 启动开发模式
+npm run dev
+```
+
+### 打包发布
+
+```bash
+# macOS (.dmg)
+npm run package:mac
+
+# Windows (.exe)
+npm run package:win
+
+# 全平台
+npm run package:all
+```
+
+输出在 `release/` 目录。
+
+## 目录结构
+
+```
+mateclaw-desktop/
+├── electron/main/ # Electron 主进程（Java 生命周期管理）
+├── electron/preload/ # 预加载脚本（安全 IPC 桥接）
+├── src/ # Splash Screen（Vue 3 加载页面）
+├── build/ # 应用图标和 macOS entitlements
+├── scripts/ # 构建脚本
+│ ├── download-jre.sh # 下载 Adoptium JRE 21
+│ └── build.sh # 构建前端 + 后端 JAR
+└── resources/ # 运行时资源（JRE + JAR，不提交到 Git）
+```
+
+## 环境变量
+
+桌面应用**不需要任何环境变量**就能启动——LLM 供应商 Key 在 UI 里加。
+
+以下是可选的环境变量（桌面应用会继承系统环境）：
+
+| 变量 | 必须 | 说明 |
+|------|------|------|
+| `SERPER_API_KEY` | ❌ | Google Serper 搜索 API（搜索工具暂未迁到 UI） |
+| `TAVILY_API_KEY` | ❌ | Tavily 搜索 API |
+
+> 💡 DashScope / OpenAI / Anthropic / DeepSeek / Kimi / Ollama 等 LLM 供应商 Key 启动后在「设置 → 模型 → 添加供应商」里粘进去，加密存到本地 H2 数据库。
+
+## 自动升级
+
+应用内置 `electron-updater` 自动升级，更新产物托管在 [GitHub Releases](https://github.com/matevip/mateclaw/releases)。
+
+**升级流程**：启动时检查 → Splash Screen 底部通知 → 用户点击下载 → 下载完成点击重启 → 自动停止 Java 后端 → 安装新版本
+
+| 平台 | 更新包格式 | 元数据文件 | 签名要求 |
+|------|-----------|-----------|---------|
+| Windows | NSIS `.exe` | `latest.yml` | 可选（不签名会触发 SmartScreen） |
+| macOS | `.zip` | `latest-mac.yml` | **必须签名+公证**（否则只能手动 DMG 安装） |
+
+## 发布操作手册
+
+### 第一步：配置 GitHub Token
+
+`electron-builder` 使用 `github` provider，需要 GitHub Personal Access Token 来创建 Release 并上传产物。
+
+1. 前往 https://github.com/settings/tokens → **Generate new token (classic)**
+2. 勾选 `repo` 权限（需要完整 repo 访问才能创建 Release）
+3. 生成后保存 token
+
+```bash
+# 设置环境变量（建议写入 ~/.zshrc 或 CI Secret）
+export GH_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+```
+
+### 第二步：版本号管理
+
+每次发布前必须更新 `package.json` 中的 `version` 字段。`electron-updater` 客户端通过对比本地版本号和 `latest.yml` 中的版本号来判断是否有更新。
+
+```bash
+# 编辑版本号
+cd mateclaw-desktop
+vim package.json # 修改 "version": "1.0.0" → "1.1.0"
+```
+
+版本号遵循 [SemVer](https://semver.org/)：
+- 修复 bug → `1.0.0` → `1.0.1`
+- 新功能 → `1.0.0` → `1.1.0`
+- 破坏性变更 → `1.0.0` → `2.0.0`
+
+### 第三步：构建并发布
+
+```bash
+cd mateclaw-desktop
+
+# 一键构建全平台 + 自动上传到 GitHub Releases
+export GH_TOKEN=ghp_xxxxxxxxxxxx
+bash scripts/build-all-platforms.sh --all --publish=always
+```
+
+这会自动：
+1. 构建后端 JAR
+2. 下载各平台 JRE
+3. 编译前端
+4. 打包 macOS（DMG + ZIP）和 Windows（NSIS）
+5. 生成 `latest.yml` 和 `latest-mac.yml`
+6. 创建 GitHub Draft Release 并上传所有产物
+
+完成后前往 https://github.com/matevip/mateclaw/releases ，找到 Draft Release：
+- 填写 Release Notes（更新说明）
+- 点击 **Publish release** 正式发布
+
+也可以仅构建特定平台：
+
+```bash
+bash scripts/build-all-platforms.sh --mac-only --publish=always # 仅 macOS
+bash scripts/build-all-platforms.sh --win-only --publish=always # 仅 Windows
+```
+
+### 第四步（可选）：手动发布
+
+如果不想用 `--publish=always` 自动上传：
+
+```bash
+# 1. 仅构建，不上传
+bash scripts/build-all-platforms.sh --all
+
+# 2. 查看生成的产物
+ls -la release/
+# 产物包括：
+# MateClaw_1.1.0_arm64.dmg macOS ARM64 安装包
+# MateClaw_1.1.0_x64.dmg macOS x64 安装包
+# MateClaw_1.1.0_arm64.zip macOS ARM64 更新包（升级用）
+# MateClaw_1.1.0_x64.zip macOS x64 更新包（升级用）
+# MateClaw_1.1.0_x64_Setup.exe Windows x64 安装包
+# MateClaw_1.1.0_arm64_Setup.exe Windows ARM64 安装包
+# MateClaw_1.1.0_*.blockmap 差分下载支持文件
+# latest.yml Windows 更新元数据
+# latest-mac.yml macOS 更新元数据
+
+# 3. 在 GitHub 手动创建 Release
+# Tag: v1.1.0
+# 上传 release/ 目录中的所有 .exe .zip .dmg .blockmap .yml 文件
+```
+
+> **注意**：`latest.yml` 和 `latest-mac.yml` 必须上传，客户端靠它们检测新版本。
+
+---
+
+## macOS 代码签名与公证
+
+macOS 自动升级**必须**签名+公证，否则 Gatekeeper 会阻止更新后的应用启动。未签名时 macOS 用户只能手动下载 DMG 安装。
+
+> **证书创建完整指南**：首次配置或证书过期时，参见 [CODESIGNING.md](./CODESIGNING.md)（含 CSR 生成、证书创建、.p12 导出、公证配置等完整步骤）。
+
+### 本地签名构建（推荐）
+
+证书安装到本地钥匙串后，**不需要设置 `CSC_LINK`**，electron-builder 会自动发现证书：
+
+```bash
+# 只需设置公证相关变量
+export APPLE_ID=your@apple.id
+export APPLE_APP_SPECIFIC_PASSWORD=xxxx-xxxx-xxxx-xxxx # 在 appleid.apple.com 生成
+export APPLE_TEAM_ID=XXXXXXXXXX # 10 位团队 ID
+
+bash scripts/build-all-platforms.sh --mac-only --publish=always
+```
+
+`electron-builder` 会自动完成签名 → 公证 → 装订（staple）→ 上传。
+
+> **注意**：不要设置 `CSC_LINK` 环境变量，否则 electron-builder 会创建临时钥匙串，可能导致签名卡死。详见 [CODESIGNING.md](./CODESIGNING.md) 故障排查章节。
+
+### CI/CD 签名构建
+
+CI 环境无本地钥匙串，需通过 `CSC_LINK` 指定 `.p12` 文件（Base64 编码存入 GitHub Secret）：
+
+```bash
+export CSC_LINK=base64_encoded_p12_content
+export CSC_KEY_PASSWORD=your_certificate_password
+export APPLE_ID=your@apple.id
+export APPLE_APP_SPECIFIC_PASSWORD=xxxx-xxxx-xxxx-xxxx
+export APPLE_TEAM_ID=XXXXXXXXXX
+
+bash scripts/build-all-platforms.sh --mac-only --publish=always
+```
+
+### 公证超时处理
+
+如果公证上传超时（`deadlineExceeded`），可先跳过公证构建，再用 `xcrun notarytool` 手动公证：
+
+```bash
+# 1. 去掉公证变量，仅签名出包
+unset APPLE_ID APPLE_APP_SPECIFIC_PASSWORD APPLE_TEAM_ID
+bash scripts/build-all-platforms.sh --mac-only
+
+# 2. 手动公证（支持断点续传）
+xcrun notarytool submit release/MateClaw_*.zip \
+ --apple-id your@apple.id \
+ --password "app专用密码" \
+ --team-id XXXXXXXXXX \
+ --wait
+
+# 3. 装订公证票据
+xcrun stapler staple release/MateClaw_*.dmg
+```
+
+### 跳过签名（开发/测试用）
+
+```bash
+export CSC_IDENTITY_AUTO_DISCOVERY=false
+bash scripts/build-all-platforms.sh --mac-only
+```
+
+---
+
+## Windows 代码签名（可选）
+
+未签名的 Windows 安装包会触发 SmartScreen 警告（"Windows 已保护你的电脑"），用户可以点击"仍要运行"。签名可消除此警告。
+
+### EV 代码签名证书
+
+推荐使用 EV（Extended Validation）证书，可立即获得 SmartScreen 信誉，无需积累安装量。
+
+证书提供商（参考）：
+- [DigiCert](https://www.digicert.com/signing/code-signing-certificates) — 需硬件 token
+- [SSL.com](https://www.ssl.com/certificates/ev-code-signing/) — 支持云签名
+- [Certum](https://shop.certum.eu/code-signing-certificates/) — 较便宜的选项
+
+### 配置
+
+```bash
+# PFX 文件签名
+export WIN_CSC_LINK=/path/to/windows-cert.pfx
+export WIN_CSC_KEY_PASSWORD=password
+
+# 或使用 signtool（需要硬件 token 的 EV 证书）
+# 在 electron-builder.json 的 win 节中配置：
+# "signingHashAlgorithms": ["sha256"],
+# "sign": "./scripts/sign.js"
+```
+
+---
+
+## CI/CD 自动发布（GitHub Actions）
+
+以下为 GitHub Actions 完整示例，实现 Git tag 推送时自动构建全平台并发布：
+
+```yaml
+# .github/workflows/release.yml
+name: Release Desktop
+
+on:
+ push:
+ tags:
+ - 'v*' # 推送 v1.0.0 等 tag 时触发
+
+jobs:
+ release-mac:
+ runs-on: macos-latest
+ steps:
+ - uses: actions/checkout@v4
+
+ - uses: actions/setup-node@v4
+ with:
+ node-version: 20
+
+ - uses: actions/setup-java@v4
+ with:
+ distribution: temurin
+ java-version: 21
+
+ - name: Build and publish macOS
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ CSC_LINK: ${{ secrets.MAC_CSC_LINK }}
+ CSC_KEY_PASSWORD: ${{ secrets.MAC_CSC_KEY_PASSWORD }}
+ APPLE_ID: ${{ secrets.APPLE_ID }}
+ APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
+ APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
+ run: |
+ cd mateclaw-desktop
+ npm install
+ bash scripts/build-all-platforms.sh --mac-only --publish=always
+
+ release-win:
+ runs-on: windows-latest
+ steps:
+ - uses: actions/checkout@v4
+
+ - uses: actions/setup-node@v4
+ with:
+ node-version: 20
+
+ - uses: actions/setup-java@v4
+ with:
+ distribution: temurin
+ java-version: 21
+
+ - name: Build and publish Windows
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ run: |
+ cd mateclaw-desktop
+ npm install
+ bash scripts/build-all-platforms.sh --win-only --publish=always
+```
+
+### 配置 CI Secrets
+
+在 GitHub 仓库 → Settings → Secrets and variables → Actions → New repository secret：
+
+| Secret 名称 | 说明 |
+|-------------|------|
+| `MAC_CSC_LINK` | macOS 签名证书 .p12 的 Base64 编码：`base64 -i cert.p12 \| tr -d '\n'` |
+| `MAC_CSC_KEY_PASSWORD` | .p12 证书密码 |
+| `APPLE_ID` | Apple ID 邮箱 |
+| `APPLE_APP_SPECIFIC_PASSWORD` | App 专用密码 |
+| `APPLE_TEAM_ID` | 10 位开发者团队 ID |
+| `GITHUB_TOKEN` | 自动提供，无需手动配置 |
+
+### 发布流程（CI 方式）
+
+```bash
+# 1. 更新版本号
+cd mateclaw-desktop
+vim package.json # "version": "1.1.0"
+
+# 2. 提交并打 tag
+git add -A && git commit -m "release: v1.1.0"
+git tag v1.1.0
+git push origin main --tags
+
+# 3. GitHub Actions 自动构建并创建 Draft Release
+# 4. 前往 GitHub Releases 确认并发布
+```
+
+---
+
+## 本地测试自动升级
+
+### 方式一：开发模式 + dev-app-update.yml
+
+在开发模式下测试 updater 流程（不需要打包）：
+
+```bash
+# 1. 在 mateclaw-desktop/ 根目录创建 dev-app-update.yml
+cat > dev-app-update.yml << 'EOF'
+provider: generic
+url: http://localhost:8080/
+EOF
+
+# 2. 构建一个"新版本"的产物
+# 先把 package.json 的 version 改为更高版本（如 9.9.9）
+# 然后构建：
+npm run build
+npx electron-builder --mac --publish=never # 或 --win
+# 构建完成后把 version 改回原值
+
+# 3. 启动本地文件服务器
+cd release && python3 -m http.server 8080
+
+# 4. 另一个终端启动开发模式
+cd mateclaw-desktop && npm run dev
+# updater 会从 localhost:8080 检查更新并发现"新版本"
+```
+
+> 开发模式下 `quitAndInstall()` 不会真正安装，但可验证检查→发现→下载的完整流程。
+
+### 方式二：打包后端到端测试（推荐）
+
+```bash
+# 1. 打包 v1.0.0 并安装到系统
+# 2. 修改 package.json version 为 v1.1.0
+# 3. 重新构建，产物上传到 GitHub Release（或本地服务器）
+# 4. 启动已安装的 v1.0.0，观察完整升级流程：
+# 检查更新 → 发现 v1.1.0 → 下载 → 重启安装
+```
+
+---
+
+## 发布检查单
+
+- [ ] `package.json` 版本号已更新
+- [ ] 后端 JAR 已构建（`npm run setup:jar`）
+- [ ] 各平台 JRE 已下载
+- [ ] `npm run build` 编译通过
+- [ ] `GH_TOKEN` 环境变量已设置
+- [ ] macOS 签名证书环境变量已设置（若需要签名）
+- [ ] `bash scripts/build-all-platforms.sh --all --publish=always` 执行成功
+- [ ] GitHub Draft Release 已确认发布
+- [ ] 在旧版本应用上验证升级通知正常
+
+## 技术栈
+
+- **Electron** - 桌面应用框架
+- **Vite + Vue 3** - Splash Screen 构建
+- **electron-builder** + **electron-updater** - 跨平台打包与自动升级
+- **Adoptium JRE 21** - 内置 Java 运行时
diff --git a/mateclaw-desktop/RELEASE_NOTES_v1.0.101.md b/mateclaw-desktop/RELEASE_NOTES_v1.0.101.md
new file mode 100644
index 00000000..ccce4a3f
--- /dev/null
+++ b/mateclaw-desktop/RELEASE_NOTES_v1.0.101.md
@@ -0,0 +1,67 @@
+# MateClaw v1.0.101
+
+## What's New
+
+### Mobile Responsive UI
+- Sidebar transforms to slide-in drawer with hamburger menu on mobile (<=768px)
+- Conversation panel becomes a toggleable overlay on mobile
+- Welcome screen centers properly with auto text wrapping, single-column suggestion cards
+- Chat header auto-simplifies: icon-only agent badge, adaptive model selector
+- Reduced padding/gaps across all chat components for mobile screens
+
+### Drag & Drop File Upload
+- Drag-and-drop files and folders directly into the chat area
+- Electron: directory references via local path; Web: recursive file collection and upload
+
+### Multi-Agent Collaboration
+- `DelegateAgentTool` for agent-to-agent task delegation
+
+### LLM Context Awareness
+- Current datetime automatically injected into LLM context for time-aware responses
+
+### MCP Server
+- Pre-configured GitHub MCP Server in seed data (ready to use out of the box)
+
+### Ollama Auto-Discovery
+- Auto-detect local Ollama instance on startup
+- Pre-configured 6 popular local models (Qwen3, Llama, DeepSeek, Gemma, Phi, Mistral)
+- Local providers sorted first in model management UI
+
+### Model Management Enhancements
+- Provider list grouped by Local / Cloud with section headers
+- Zhipu AI models updated to GLM-5 series (GLM-5-Turbo / GLM-5V-Turbo / GLM-5 / GLM-5.1)
+- 20+ model providers supported
+
+### API Docs
+- Replaced Knife4j with SpringDoc OpenAPI 2.8.16 (`/swagger-ui.html`)
+
+## Bug Fixes
+
+- **Security**: Fixed SPA frontend route refresh returning 401
+- **i18n**: Window title dynamically set from language pack instead of hardcoded
+- **i18n**: Fixed 5 hardcoded Chinese strings in approval bar
+- **i18n**: Fixed hardcoded time formatting (locale-aware now)
+- **Guard**: Aligned tool guard rule names with runtime `@Tool` method names
+- **LLM**: Fixed Zhipu connection test 404
+- **UI**: Fixed suggestion cards grid misalignment with longer text
+- **Upload**: File upload size limit raised to 100MB
+
+## Download
+
+| Platform | File | Note |
+|----------|------|------|
+| macOS Apple Silicon | `MateClaw_1.0.101_arm64.dmg` | M1 / M2 / M3 / M4 / M5 |
+| macOS Intel | `MateClaw_1.0.101_x64.dmg` | Intel Mac |
+| Windows | `MateClaw_1.0.101_Setup.exe` | Windows 10/11 (x64+arm64) |
+| Windows x64 | `MateClaw_1.0.101_x64_Setup.exe` | Windows 10/11 x64 |
+| Windows ARM64 | `MateClaw_1.0.101_arm64_Setup.exe` | Windows ARM64 |
+
+> zip / blockmap / yml files are for auto-update support.
+
+## Links
+
+- GitHub: https://github.com/matevip/mateclaw
+- Gitee: https://gitee.com/matevip_admin/mateclaw
+- Documentation: https://mateclaw.com
+
+**Full Changelog**: https://github.com/matevip/mateclaw/compare/v1.0.0...v1.0.101
diff --git a/mateclaw-desktop/branding.config.json b/mateclaw-desktop/branding.config.json
new file mode 100644
index 00000000..f966e865
--- /dev/null
+++ b/mateclaw-desktop/branding.config.json
@@ -0,0 +1,9 @@
+{
+ "name": "MateClaw",
+ "tagline": "AI Personal Assistant",
+ "team": "MateClaw Team",
+ "copyright": "Copyright © 2026 MateClaw Team",
+ "appId": "vip.mate.mateclaw",
+ "githubUrl": "https://github.com/matevip/mateclaw",
+ "logoFile": "mateclaw_logo_s.png"
+}
diff --git a/mateclaw-desktop/build/entitlements.mac.inherit.plist b/mateclaw-desktop/build/entitlements.mac.inherit.plist
new file mode 100644
index 00000000..faf2370e
--- /dev/null
+++ b/mateclaw-desktop/build/entitlements.mac.inherit.plist
@@ -0,0 +1,14 @@
+
+
+
+
+ com.apple.security.cs.allow-jit
+
+ com.apple.security.cs.allow-unsigned-executable-memory
+
+ com.apple.security.cs.disable-library-validation
+
+ com.apple.security.inherit
+
+
+
diff --git a/mateclaw-desktop/build/entitlements.mac.plist b/mateclaw-desktop/build/entitlements.mac.plist
new file mode 100644
index 00000000..e7b78d29
--- /dev/null
+++ b/mateclaw-desktop/build/entitlements.mac.plist
@@ -0,0 +1,18 @@
+
+
+
+
+ com.apple.security.cs.allow-jit
+
+ com.apple.security.cs.allow-unsigned-executable-memory
+
+ com.apple.security.cs.disable-library-validation
+
+ com.apple.security.network.client
+
+ com.apple.security.network.server
+
+ com.apple.security.files.user-selected.read-write
+
+
+
diff --git a/mateclaw-desktop/build/icon.icns b/mateclaw-desktop/build/icon.icns
new file mode 100644
index 0000000000000000000000000000000000000000..d40845323013dc6f30436d42d12d8a0ebd82eaf4
GIT binary patch
literal 247190
zcmeFYWm6q(6E(VVcXtRD+;yYD-Q9zGaF-1PLU4C?*Wen0yR&h3g1a4ZKkqqz;e2^N
zOpR1c)l^?S-D|C0SGcmG6bd3CA^-qDk&zZx1ppwm{~hqKA5Xe0Qdd7t2;Zc2TmS$h
ztbYdtAUzZR;~|8Ls?--i^#t+J#|^ZlsDdZ}P#1&rVgmDVkLoI+?W*Qz;p$=HYz~mL
zwzN0Nu1hurK=otDh>NOwLY%(Bb(n!QNFvW&{#KRa@gMvh7M+Q-z?S0c35*SamJTH7
zfk!t+-{PP#_5Z=j-AgV)1u+1N#HwTblJ*&clN_{d#rg39&EVgohpUQmpL4$VhQ;NB
z1+3q1D{uH^KCXAA^EDe4ZEmv_4K`K37IEn`%GJwMi)54N|L?{B4Z{ELnK1F)S@k0!
zUGhg*Z2x`C>vd9B$-sMmw{UfJ=iRdI8_)5wtt0%R5zAJEia}5vQ0MW30fUO``<5hdzmCUGzf}2sp($d
z_|}K=7Or%9hZZ(JVQJ*IE3>nAD0Bv+^b+a*E4-=11-m}-E5Va4w^6!sZS
z6!k5ptX1W_XEW|i=VgCwE4Z1z-@@^%Jyh$Rd)`2e&fYDxJ9L~kp)n5@vH12fWi*&R
z;!9QnYE+Bf2r2-TA3^t{Uwp?_|BUtPwVvK9gZ^=9H*mMHdHG&2MZZB`KN
zsc3BMon&1yB)x>8Xm^bfL%nQd@*n7F{ZBMjZS0;Z
zLJhVvspjjR!!hq)kKam{pM$!3M7FCuNCTb)X=64XyMWQ_9gUoZPuIfTwpU7-WO0xk
zA4?!y{a-@d(itoo`kbxyKQDT8UU1ZSUWLOAtjQU^{J~>>X#Fk*bQcaV;a%$VvhhyK
zQSaMRJ8|*nl>eHA=%RQGZP!*R9WEjxsuBN)SsGvX;wB>d9&#j;y6S`&X{9%F-7r?Bj=wM@)kNjXZZd)xs0%L~Un%JciVx_bl1NvI4*1**-I%oL0NjI6*KtJD
z9K}W+0(O3{rJKxtS-XAk#s>&3HBo+&Q<3ZYZ8_@CEmAAf$5LRKuTSE9oKmt%e)kr;+N1rL{Kw3`>
z5lQ(BO&1N2lS?ZM>B9sd{ys0Zhn5Ag$#`j$)@fms{_rWODKcUhI*PO(sW-{!QO_@a
z5HTMJf^2~H6d;==AhO`ZpX+O@?v2Ozy7NWmK<2g9?l*t8fGsk
zoq#H@^T(wk&lc~#p5vd(9}^RDxU;O36AX}6D-J2$BDUxnab
zJl?@CKdElFY4JF}qh#@3PSP@RyXYt}aO%y|8ZHLbJ9|4D+gA}u!VobN0x$!Mwdp=8
zhl0kF0@}WmpIX--D`H1(Z!c}pCSo?->32%CLcAD*=p#3&jhgcZ~}rRq(kYzwhJ^LKD7ztSE^OeU~a+4r{d&b=={mNq@$Tgi
zdcXK~j@2SbL{LK4IT
z!=V9yN0=re{8M
zpFaN8mYV-6kQ=wwq-N(|w?$;;Wse6srS7Yth8(YHubjG)<>%91VJk?B6P&-4Hmx>8
z*)OYH-6$32znqRfNL(hMi3Mh(>wTqr=)<~z7-Ih-+nYc*NpVn?xsUJ_JAhh~PR^q3
ztn@UwWKPl~E|578q>2(-nG)``ZEHFT8D5jR;WtfvxOpCAL|>nQo&|dF`Z_Q(d2{P(
zbZc2n7%MY-P_&cBKlG|Wz7O%#Q5G){3LOO~qhFIe{MG?*kCqBtbVQ}7w)mXW?B3{eHE`@&
zy(S;gt~Na0U#(f7x(CaON7YQnDRuSPFY!N6|(L<|^f
zjKN7qGG&Q!A88ARESFqnel1LsEvQ33Ott$KZ7>U|>rRBSD<>@4CjJSj#G6i^E1q{5
zN6TExW%6nDq4Rx5(Bu91zH`gq{58kmT(yW)Nduty0dj=E^DK=Yh~_PhgN6T{FD2_e
zF-7?Pm}QB~qtomWbooeRYk+cx(7H=v#^RY;ej~UT?-g#r31=z+E7J?@Ma+i&RYYuw
zq%=3k2_f+=NXC3An}d5;Ei!^;W!`~&Kx2#Vg638V{gQCxjn^m9YLNn2Cv;i7{ody0
zRdl(*mvJa1sfPjfT*Iy>#Lc2o>w+Uaqu`IURaj0`21=lK%0&NaQ~!-Of&d-9-1F86
zp{kLF7PK#daW6|~q34QYFi#Rs6N?`N%{W%zR&C>s%A|(X=A{jm&%B*tkv$DNNsRe&
zB()-cnj$xbKmBZ3h*K<|;7n;rPp^2ly``Z2z2n>C21)nzV!(62>h;0?qH}zB*GF)q
z{!ehGZ=GmvYhITt(1h+~vm((UGP$Cev%?nfp%
z{@-UgSk34{eZkZOm8ZD3#F(D^&Od$BYO8iBZV`&sro1)3h6sS`3y9+Iz-y&BcV7O_?e?zo>SS=ERuHr1>iz
zxqo$*Zy`8R#nb{9N@Cjex>MA7fx4XK#{BvPy}NmXA5iHsG^2kdKE
z5Jzm%yL*+>b`0>F5CW29eoE^v4t_r!t?#V)W4CP+Skr5)k&d1YfqU0~%csR!_nf@Z
zJRvR}m?V^A5V6|)N2M%)9+XjRYvxx^F-wJXTrAc1=i+pY@_Gf=jFphOhwpnyWg6@$
z%Mx7=8h;!4yF^gOgt8jzK$&BE2wk?RtBtWBBz^CFl2`dzto<7WKdb?o-7T>=$urb-
zr=(cn`#q`kT^?mm6rjZ$RZl<(Vn_dL+dga(G8`1a=Rmo^wz?+z3R{MHFJ~Fo-{0sksDgM@-Qk
zFAcpruowd>Xl6^EA%)Y(4y$+c*#k!V^onWqi^Mu{3$~P9PjA0`-7aU9@Yo)iNvrkW
zPCTdC`Qw?TZ=k3Bb|&n-IPUmR#IxZwDcqGKo5ZhG{vW@3b(tTm)u;)0wKTj**Ah5j
zV964Guh1k-H*9QL)g;sgyP27kzWib>gF5W_HUX1;nbNT9lv1a3v(TF&bwSWl`-^9p
zyN%xGd*-(eqtn6BP0{0%pZX0Dq>1D8kqoj{OaX>qmp}I*$>1)Egzy5_a8wb~izQRCBqZWLl2Wm}FDG4fZb($mxeE$JY(FaqDZ^2i8ao@hh2svUy*Xz9#o+@k#l;yiC?jc
zsj6nlejFEm8_n3b;OKUL_S5@Y_xoSE{l6hocl`3yym6I}^fqp5bVu^M;O;kHaBufl
z8Pg1L>T9baYXL`X{mg_g$f+l_A!_rOJ2#ZTaz@U?7kysQ{`rSYGC69Ep;@GaQt~CWT`zKB@J`f)j|Sqskdq
z!Dq17Js+hISYlHx%Q&wH?y_uFk0@yDCK=oMsljO}8l
z%Y~L4r(||`v=On-=0;#`P)Wp8O5wmeL*jmm_ADFAq57t?SJ$7GkbhbNs2G{iPOb~-
z8C~(ra2W7mi_g1@Ey{;rGw4Z@m?mbt^_~yLFfg>Yg-VMeb50z)apTGnOt(aobQ(>t
zF%{Pju2@Q-J%eV-=4Xx)}kEJ|@ly~jz
zFoGbrRbD)`61NlMh)5e^!^Sm~ZDqToEAJhqe%1^8HGUEM0%quBle42!?Y&oC_wWC(?qw_f(D2bGD?LtDDYB
zBtF_qMMfTFbE2>SI?x7+pzQ%l$`i7I-lJFNcHf0aCIM@@SA70Nl3
z$n1T&=F=t*QDdh8xR<>AVkcO}C^aOOB4ASIV-s|KiHHJ$O5m?F2Cbl#gmDFq9=g)j
z4YK+1A$arMX6aZDy+Mx~i+4^eHjFTM&
zKu#xu@)@{WEi@vczO9u;ZO96}oA(*r!s*RmkyvZiLLYrd*;+lg-j^hlRc}2gedu_E
z8DdiD)Jnkd){Oj#;+`Y@g%%8QyebNkN=OR$GwY)CutSJ)SP+sA_VRK^jGd{82f9
zRMsxoMW`#1l--nUen7O4?iZH#v&rtu4d3_kH6|FdBz~m-lb|*9&utWhuS-P2Cv-;7
zS4z*>1|{y@FNbF*J}XmHGjvR?%r}*2*-I%)<<5J-JY3@IpEH=D+Jxa@2csps%^
z>a6WP+zLb@&bZ2ZOXG0+G#v839XfGIX}D6+Fj8geenMorp^5M^OZv$r{SAe
z5UFm+CBY?x25t~_aQ2HsX}7a8RNU5+Z-UN;FG$p=6*rw60CAh|HJ?Cc6S9+{ML0@m
z<2%O_i;5#cm02=A*75a%n4b^L7Ebr^0lR{_*kiO_k)#tjtDx~C~+
zKfvgiu}t=#ByXe1mjdA3E!j7EYZUhFTYR}`*k|$HxjK6z*r6`#sa7}8ox~D%;!B{r
zvwx9oS08W@kB}WA(8MrF9Qiv(b5_?LQ*Q{6`?Cc7DP9)%I%7&?7ZDg7zPqmbj$$#r
zG9JzK&@EF!w+o=$wuB1}j#w3*_*$I!BX>rc(laWGi(NY6wJ>YwGHJFRmwT^+RzQ^5
zcYBY$*+oS$M$7EiTH*lknn(pRGWi$GhKf14!X(HvmkzBU$a!Jb-ygTGhgrhAY-}18
zJ;@YZV2O3a?d!fj;f|L-z6?fDcw~5B4#P!!(}S+4&3Df*V#RX0Q}8-2_zSP;IU^GC
zl+Gkmsu+~Rx}KKtI?zFGPlSd&6~l;)BUBOCm%uljEsr-qQkF6%LJ7o#q81B&G^U$I
z&LsuHJY?BQ8t6MLRE&oWvOI;>_-{R)W%}Ivth)@Rk4;&Xspd4&Bma{Q8n1jrUw+nj
z9&e8t`aa4TzGhnb8TjUUgNF+eOvLZI2xo&`WMe*~moYxBfFaRx5}9(RZ#lm-GB?rh
zXVUxO9yF3eA*oKWRu!$|R~b8yf`o_ml;w~GxVa1Q`t49)PO#BSbyi|6m^;Pqh?i+AW>IvqDrv#9Z4Z%N
zpwp#KzQ2)=vK}YkpE}rNdIe?80h6#y-
z$JrWR>kAsaf*=ZPgZA`HJeziwh)#8uYpR>9eu^9=b+Lhr6m$lRPxa*w$`*!x2r%(O
zt2qhony~A1WP59=g9?IlQ#d}uC-a8I(L9FaKMT}Z)nRa5jSy#i;%B!`8ZOUE8!5EG
zjI}E?lvS<|fBR{R>c83DxpQuKeQWe?+bnl!p7ccZAHDXo(PAmlzizXI6@I#6Fnra~
z61*K$T3t14^lGcpH|Xb9%w=;+tr{%Z#fM3G`S5d=8
zQVq!(k35EnINBr15Ed!faTi!%*7H+c1S58mSZ$*~0?{*qRoR8JHk19!I)3)&csL*f
zIwZ#&%@&(I-mAmW!EqJ;ueMJv?H(g>5iIfcKJHYtzvwDO@&*)$$@$&nVD->m?`5%swiUWxVNw^tEP(9OCkm
z^GTmh8SkAOPsRqz?Xb~PCGBsqO>z2Dn?<9p;f4smo}=`|o-NWXUF
z9?W()0Te*w2q~J*(6)^fYv3PBGGHB9UsT|&pq^!9(Hy$541c+=6>>_v%UWVq-cdlp
zRLG_4DNC2#g?P9&V1Z4yk&9Nd|x}GYKvyc{pgu
zR<<5TJ03cc=IB8&Q-~ReMiP(2+$w*3=Hg5<9M~ph0BJH3))))W8^cCUzccg+M41RX
zGB9}nYOg}ftOLI=EKf4l^bFyAN4JN?hGpdFD~dzqYZcPHH?>ry(=J`Ol{r-rx0Al|yQ=CNYmTkzNz~;s4f3_H!8nZ@d4p#Q{uwrND0Fv2WWxBKJ7g
z)7Q10^j$3J+?8s0>By>yoLQn9Kf(R8?>=c+ecxrH~V;mRx;hQ*%-eiNVFO(~7H^)C+h(fABc&5@Wq4
zIwY^4*DK^ZsOCl=_`a}@`h+aW8`4t#;FlvPcE>vzKF%o*7X%3?YSg1gV79N8`_=Lp
z&)`jb3|gSG?vv^5^Af9d*U%Wi@tD$28dmdDbb<&}a3TW~8h@@XXk5Las{D<&d3j;F
z7cL;pZ8dF}G;kyk^Ht;KmxP&C_;74*sO~$KR-2kmY}!{0<7RUok=j~KIe)x%yWSp~
zP|8zd*P+QTDa8q0GNQfe&`^t0RyDN2cO329(1WieroqK*Kczs#OX3@SGe1mbBc0J{
zxGx%|EYTx&B3Q3jp?GJ5R#?A_R}9|?O&cd{zI^LKe4ZeCnMzvpUA$El(JWK?@((f0
zl_;9Twcah;o=o~X`R(y^T}jlW_~2IS8Kpl|JLf4>xXT;oI-w|x0Y0O8sV0FK!83b<
zxc*SA6VAU$OrpdFG+@r7uCw;&`2YwsnwJ}#=6pzNyWPRhgN|~jm~reB258Ro7CHpY
zabB$Hqr;jKX72na-zvvk*Hn_l{?3X=vs4XjPY5~>C)C7lMW5BT)zK5JQ4K3dQiLma
z+1jTz?r}p!ehd?N%l`2J9k_&-uT7QEoWpS
zSEdzdTOhe6$FQ_NHSC2U{2lo9ZTbC}(;vEM!uVrzWAf
zRN4!Q+{#F>bnb|WO4LC0MeAvN#LRu{UNz6H8iDbbl+;UsUN#~GJ5A2+dhcrDhIC)n
za>jZfMw;A2hoWFEf?x7HtDj2&!RS#DM}4hN4sq)ZCb-VAhOvren73+QZAFUJ9T4{0
z@7Ikh{z8R7kQ8tq^3`}fh@j1CY#lkaC!r{i=G!V-Pmlz|AzQ@(y~mFAt|%?Hi%MC#
zL$Z^`ZL(VgBYKi!$#z)ZABs4^U>4*aTC-2^TC^N~KeMmoMaM7_btoan_n-o)W3`1S
z8Bzn7>+o)-y$G`yrb#-!gRmBm?C1EKug_303uBDbY
zV%qujH<@4&4V#!dD;Qx@sTs}~d%T(}8LOhCkN|mCX3{_Uw0qar8go;Zv<6b&tqH>`%|0bZii(%izxJ6|Pgyrn2`>R^;Whn4u*SOg4_;q`pKtB%5;J
zWPHEMXFap*W`F!fv;Jt|`^QTVi66&Cim}o02qC)oGeSNW@J8<3
z0|@PE$DA@c&yu#*O6zttY8%$wscG5Ww6qge@_#2eZ}E{qtW!S5Qvat$-#%2FCWil$
zXD&8;*SIDh;{qPNx`n;ow{5wV2Dknwd`)P~pC~dP3jMnf9Ze1gONq|P=YIH@9zn()
z$;l0IVj2}$u84OxQeW0_g7-BCLT3WVo`X$E&;fxEx0;4)>{<>luTI#vX;eMb`Cb9X
zYo>Czh#|ydFLiJ>y^m8nIo_BAs-3-v^$?>GVFK(e?(>q?RQWJ*C^zd0o|i^Q2d&O*`G+#m7S
zw?0AtW*kU|=3ShbuC~w+K8j_8@k2YdWYG_PRSITeq@#bq*I*i1Kh7@2B@>L#4h*qE
zFl1nJAH6-CATpJT4WBK3`>fC5CuDAnY2toH`~3FHrG7c6FGUoSd)wgNvHRUuru@EGSup?Q_
z*IbtpAXZOX!iH_;)jJ3RYA4$6o*tlx>WJI3hYLCublQtec>8`lJ=w!|LLV{-aB^7C
zmto*|01O|}ygO$ue+}4xhgow{n@twOt<}$d}
zLISQy|2sHcj(~2ewaK4rEXEIYu@ja+Ba9aZ+;0s7v9bAkal}{
zuRmGbL}~Fv>gEwqW%auErr5(D-9X%1O_-)Xw{1-Ahn&Wdp?Brg&x?o_sEcP-
zO}JxMc@p;|`*hnd_U>dBLYg#S!ks-{R)V#pxW0FEc-!DaC+j3oIlYg9LRJleF~bIj
z2jXWi)@OhQAMvlr@}IpTMfEz<`=6Fwdi6Cq5Pqd#;*hxeH9(R#rDWfJMGZ4AJ%Xpy
zE8={oKWM+Q!Dqljkmo{^8-MnmND`f!mduk`1g@RVinDQ_WceI_;NFYro%{Cz1CK0b
zp-R;lum6BdtC2Q!_v=cIU+?+LoZDi+U6Imz5(ioQfrFi^>uBkUfa?T|?R3n|m1jZ)
z`}HT919bo=L^f4rn9z-Xxnam-R^fy@dQ0>0!kQ^!Y&agQ{=aEuG)tmKbaMrF3*W`v4P81QH)1Uh-P{gg3}IHPjkTw-
zt=>@85=+v7+``S6SxI5wL2JhP4?~h7kgB+JP|1hh?qXM;=ok7e8*WpN9fTPDxH3$n
zG=qc~L1R>A^^kaXsj0EcZUFcycQ*FSpYg@A3f5!;vs_+O!=Mia&|p597wqiqC9!;o
z9ezwNIA6@Y4>9``v+OmC|DEn49n*m%Y`JLPCX$+__9ikyxwSUSCZ$LwdjkAG#?Al`
z9GJ_UWpcK1s~W_;E~u1aAN}4LHWF;<3LERHWIH^Td|rpAnk#RE1DstKK?&k9my7QT
zd3%bLi5yUNgVy@NTN=HdsctH6(
zBP>#KmNYmq6{zj(2Nj^F4vQYc{y3-2htN^s+rNaiI(ZQfT8C=cJ~~2A0Yxhao>!&V
zANiBEZzeAe+{zhV6gtYId8h2E>6Fizs(hP-_q`~#OntZ_9b
zc$WV-@p;2(<)&o(p?Zw-Df=j%No4UkGr$-FBU(O*w2_;KcLh;;%vh+ZR0>#ou=m{m
zi4M}J!-accV9#d^{HmgYILiMfy>iJ9
zEu>i!C23%_+%?jcH4&oDhck_@BAIYQsKCDuVLoT?Qs6hM@(_jQe*yY%!5y$*PNa3uZ~{71AXiJo&-cJGt4UpmTeGxPR@FGCaO
z&W?s$j^ZG*aLTKacAsUIj+v}LwwhaZZ}fB_7ndZA^5@o$RR7eRO<)xkcPw!i3!Oo9d_
ztv@G$aMWtl#Ei9d@G`oJC$FI!bTUG1N!o)rEIDv*A3B+r{9{FAgTIX}gi4BKB1fXZ
zi+aDIVqgMF&EBVAemIClBjz95z&fUcH!|jU)&5W+_*Kmnkm}}kWg^(p;L67F8@SU@
zIXlDFEoaoA0anAe&y!cz0PcRjd(@r&ghf2*7x7#yCPgF7_mxneLlBNsUI*^NV8!3~
zoVBi%h86Y3UW0<@(g_M|MgbGVWCre7BxL*v0$(&-iir?i`;{J81^Gy4>G8u8kt6ja
zy)o=2m>8Oi+@&JDFmA`?Zfti{XJ!8FzRB;@DstQ)|A0fG|JiO1B&W;b7h<{}I$0im
zD*;~;&y89eyq_+Q@HaACO&6Vei1A9Ia{-~>N*$6ot$U|ieP8k0n2G90v{4>FRJygI
zhdLyTPd21?X05Ie$e^uMtF!ZZg0&7FUswV8UgQ~VQk=6nvx-E^S%Sbw%M0UbSMX_O
zRQxpY=e3yXh8{VZSkoK1<+^bTF;W9zN<5(>M85YC+EJT$STZ3ub{Uli%XWCn|)g_KKk?G@+k^6cweHA!79Z}(3rh_
zF~sWxw+J(H!uDhwE`@p~Eo@A~Eb23cWm@Vu8p-Z1`Rg}QKpCz``|mUq`0{ah)^yk5
z%tl-n^j`&-J@A0azDd_Hlr{{UcZqu6O*yWzEJErq)i8lC;pDQhTg%!v&_tgb)A~%j
zDtZNM*o8m=ZN&+!o>%609U>pn*auYo=kv*0`{2DBS4@+FEmys^0axknmqyHMhFVzz
zwS#qz`a7TYPxy8rOs1s_xvncWo$g5pfAh{x>i#Waw^T9{if;x@SlA>l>D58}33|+S
zju3cd;RCIyX#QMqv54$nfM775tzB+D4N^NAMc%cESbVMKK!NU&4CcOr*^+{=_$!s7
zH2Tujd9{kyty*k7E!gCmo)<5(FK%h1sEaqEIBU#-vlCdEZmvq#vnx%u5zHW?sw!AY
zaD%WA+?%7>$^~bQc}ScZPj%uJNj)G`P-M4gv%_JD~E7_vU@wcQ%XJ;({jS@ylxB
zDDXG7NHX*|XOzt2YE^&L@IGVWBcsgi%p$rrhv22J|0xj48f7sO^P@f1b?qioY+Fv=
z)DFtbOxzmU3Ixa+!42&hKYR>^F`V0BCZj
zvnvKqJt=Qd4aaolPc;^;MeL|d7ku6Y1|9=BLd@{svoTq162t|vDuX*Sik~$g1e(Ym
zL~}L5fio_H2#_d3jGw>h#Y8q7Iw~7ZL&xgXI#jV|A4!zVmbr#=t##Y8{JoX5Dok;B
z*hOMa{VSscWd5jUlK<5+OG{9&_qc6#`_4hvZINT@>fi3WrAzJB!bf{~+KCl<0&l#S
zSgvW9Hq%PcTGS5N#qs5vbb)Vt_>|lAIzFSHP3%@I#tCNoa<4ex@g>{_#!bErdd_#b|=uCPHA!p7UcGG-re?Kk>%;zC7NIdQf$
z%uau7z(^gOZzP^5h_}Nlxrm|Lwn<2=x|igTK`+S~8d$b?TBm}jj0%Y;@%24q6kgyL
z|87uzoYofx5%VS@Tf%Q9Ksc2|9IXLvb%`Y>lFBVM?j+%He(1p1a-^wQ+)>Arn@3n+@A2PX3D&WCoZgpqm?@ld_sB-z(
zyJN)it+8pEomi#$Qa_QjluEw6<+ue+zb7mbUmLlx>xDAPvx{Y%HVjYEKy?bu4)0Gv
zq)S}GfrU7#GL7?_*cbsYxVSn9Kxi@pAxf$04%zI7(}R(;C=H!ueWi|M=1tD@U^b_P
zq6Kzt5&5538E}VCU|JY>`aBd&j_+H2sgqi1ma^VG5XEvIq?y6;HaF5vvEb5Gz(SdC4g0NrC@_`uQO<<(}dI08*m2#K^w4!dn=v0lzAKgzjf
zFLP%cs+%1&Zzx!-4B}z1q`JiU#ewRxtg1;l2%hy2~s38~cs0ymX
z?aVRfW^7OEmw+Gp^FbRCM`z>MGTH0|F%-87vl}Lv+U2gV0}7D33STQQ0k*{`Jrm?v
zVUKy)=llj?b&VMb&|M4W`Tq3ONmJ9Z^@!04`jNFdZ=j!a;&^|IljLb~tQpLc`gm~oLE(utU*KeQE-|HwR8B^J8oJ=>P$ZGz=x%t*jZ
z&9lF)x{d9UvFlnpdA`vh%bzbw5KVj^xkrR%=uO@0bIoH7#l&_wd3
zn}68$Ng}x0hOS~agoGKC<{~&DOh742&ctG0#4>hBLT1PY%6K`Jr0}n9e@&f*nH~+{
zQxE^0R-@hP!D3E9%6UZAS=Nrbou!>A9@nm6_$GzkJ0%arc9?$ifH{~jzK^SX^o5fz
z-qbWuX$r$?aA(Ocj9JuC)*5^Cek3rA-OBw(+9w!|imL{BhU^gI$o%GLc_KWlDkU`?
zyh}ZP##`qTRPLLy*6hLfOcdFk0~63T@?I*3@?|~8!dU!e(J0yG!@k}l!Xx@-!Ak#RygV54^^*yB#)Vkxy}O50z}g{>2L$W!e@D%
zGQR#E8B~3x)A{`;i?6kq7heu?y}*D(J8qLw0^ms$c=mcpGIBf|Val35pvsBD0l9Wf
zVF1CCT2r;x(R*B5&mpa@^Tz{~<9>tuy@usLz7by9aSy
z)qX9Q=gpX0K^};N<(q&5751boP}AWu#Rghw>9Cf6H=#EsZfp&n4Au0=izyr`GhLq$
zC8fh2XRLm|=AKLAZSCLTlvh*OOhr0!c@rGpJCwXJTV|aiJh1uP-~@Cp^*aFwn#fmL
zZg&KIDLm54@9O18?98TlT@J$Yrc;N=Cz$Abs!>m0xXw|0XtbV|uB)q~u(chnZ);3U
ztw5MqSv59vw_Axm0V=TP1y##?eiK+q-sW131^a9?az`*!)^QMMCe$ZY3$je)^<)}HKVkFjQJmi
z(6Rk0B!wPClubTaBo9b+98C*dFwiHnULeUWjZd7&b9@>*BleRT&gzZN6LVh8Mttq>
zQ_=LQ3*#ZKuWNzyY-!_}s>!A$8TIh%X%cA>+)Mbke-E9C`d`Lo=n#;uoyRMTsO^_G
zq!tzR%mVAEdtsHEY2^65=S@jhwi(@fGt_Yr?1u0)_F*E%{{CF>PSL1cU0ZD6PSU0Y
zu{mbmAArO=__kUVCb&<%)8@be60#bt5P=6&soD6EqAtl8Mcc*UO|L?81DNy0zmB!Z
z0#$g-ki+_|Vk@sX6Xot45%z>?c|SE}@VWlx=Qkg)@;bpsSpb-9me2b#cZSm6T1y$m
z6VdLtf#pwUuZ9!q8=DZV-8u0`URKeK92s-suyT?)oz+4Dl%jp#67&d={s%Yyn;i;W?wu;#TLxV8=e%zVDm{NM;8BPk;|ixePM?~O
z3Z;>mXD3g{-h(c%%Zy?!gr7yGIpcFj<{z9=Ov=8&0%8kp#HC`OVhz-qpu;35Gc9N=
z#iJ;1hF(ltT|f8+@(~$)TgPW{ae6e)Puij210b*Q(8PM+ZU9<`6EMnxh7H;r)9sU@
z)xfbFw39<#TKW`H*_UIDRylD=NeXGXg56kqHk=5=TL~k4EfbNOdZ9E>>T&Ed_^_wl
zC|sI1eBT%4{4|#9G{Y6}EhLbDINf`gI*k%pY0a*N{3AKiY&@Eb1M7y8tONvZ%6uoa
ztInu5mlwT7wrVAQBIOBZa6Kuo-;cQ@uY=srRYa&NLS5+;4#gRR;@OTxM_|1LmE6o<
zG2#Z5Y*4Gh$=Elm1TjO
z`qE}PeSuKdumR}@ugg3pyG{z;<*?ah&p#r_d+gG20WEi8^`U?f;-8&uURPb?<5?A|
zAF7@9f8(-nCUp3ZX<63$<+;#HUjfj=|Ktd`+}|1^-L}+LonGw5%T%ZaCt2p6uEfPw
zR>)=Xr57DfzOiu7>JpAqyuen`>O5Ne;%HW-fL$c6r1?8kZa?yx{Ao2Y%2n)rWrYH@
zj5+R~`Y3h8KbYa4;cq!$@H;4!LDbd|xjlGA5;d|B-*Tj=f4(|ripC~2Dl1`8-pr+R
z%aJ
z@n6E`*nKmFB$W9p>ulv}*4N{`b&e?MW_j(J=q8TYrX5yDNr`P5%J@|tA1LJ`zjvrN
zyCP}7u|91}V-cGJ>)nS5`q+rYt{D}n0jbYNDJNHwK-?02T5ckkn1!@rW@;~{D4a;O
z3f&Qk@aM1s)rO|zq{|AiODr=;%^?MzKC4aq9mA{y+i0^%glC
zBr;0C2l{=CJR%&x&$28%sQ;n0bOTe(iRevIvU6U
z?rgqWG^0B_R^EU~q&ErKOc?VL;nl%zdUmftl1zUujhAHM;C^}P^Ij-tCL6N8yhNEX
zT8`J$62sxwqLUmdeoCd3laLtd66kg}LX<-(p~=fPthk*Ujz-BcY;=qd{1y
ztNOv*;>hMy2^J_=Y~W$D8-Z6)hxhZQ&0z7r*giMkgSf~48abZ!~$yAoloRLQ!Jq^#80>OdKXVeG<03DBP
zFHMm2E{X2XlQfGIQ8zdZCU$DAimBe*W)m9Z}!>8x~^0pLpm
zDA$whbitFKEPJlJT23vUz`uhrG?p1^GYGi{0}I_$xzpJo;XbHSMMO&|hlq!DI9L`{
z01F1|j?GGpGLr{=B!FTTnEf0eQ2@F+1}I3L(wLuF+4a!tgt0Id>Y6(ggN>wd=0ewf
zZaOkIk%^#WZ_M=W-E7EmX5Bbz&@*(^H+)P(a1>qcSPTGGu6KC}h9Gu{=+pHLIdS|^*<4Bhc>99vSlA&eOUrWnp+{sj{jGRsn3$?T
zk^o)Jbbp_2oHh_p2OCJO0Ln0t0W0QsktrqXglsn4J~Xpy;3++870zSjok@n=kj5|Q
zO;A?@V;#v-q8Y$5a8@Pm);ctG^T->y@KzUTOzP5O{OpH!cT*D)gXkRnqE6B*bCYG(tAC1)e$
zOeSxL1~CitQ<3rMB*zjsOAv=gOE-p*F@jD#_;J861cEOipr|4xE|59aNr(Zw-rD_1
zo8a|*$Auc-ig^@I+nc-9$EAKJ8j+KCKIA=0U)r7H6I(O5h(f?{$LlT$f_*?@{gM_BlS
zrL(g`lEfVSN|31fY^qtBd6&oOIGVO$x)(~V-qvvd3?YC}AffWA0;SfVQ57f&;@qMc
z!9n76Ce2)#7b#))#}n2
zSzljIVCsyF(l)klTa@L~%ks#Bj{x{7NE(e6;Hjd2OaK-=S~F{~SvKO(&JXu5*d=fh
zXY#A#z-!#!xQ_!z5s8s{6&$j%S>6Sog2_au2NBS{xX1zwKQTpqoHuCtn~kw=UHhaYFlb?^+V%yLxPIrH-5fF}KxPM2^*@Xy|sEX(00y2m;lJ-vL~4Wn{LI
z5gG7<5uO1A#ah^3DfpqXcGl}irpXvD0Fpe|PyJ^u03fNn$<%YtuEd}qiV_?$Hvh!WVn=N>72zy81SuyouTM>g!H8w3e1HPF*c2_
z&BlT)x$#kE+qdU)7$fE%Lnob%8%Sr9jm^Ybt;wlJAC;BWRRH$wiv(8pK6F%?NsCUr
z;oJbvpLU!f*haCGdp*tpIaH*?Ql5^k>NQShU?_X3ya9ORfQ1Z-25cm#ymdG7`~f9Z
zWNRU@LPiY6-3hYXV1!5bDdRB+=AGoYi9!1QLNymQ=bb+~zwv|r=|A20fMoiyRH?_X
z3cxB=>Yu;zTG##dn_uv^c^f#gIAhL;9_3bC9oRLBWb9NmKFqnnZ5E(--S8PORV1ml`{
zycqj{&bi6~aDjc%unv>knEY0q)rf5}<<&Tstzj$~0j{V{L*b?uVL8nee=chMig#
zn_{Y9@+Z7#o(%{Ln&%zun0gd~L5?l|zT*H))PUG8v&Ln^U>#lgSm4I4~|p7x++jW?Hw=IC1u-0BOsN>yQD3QX@cK23-~-
z;kNp{)Ab>yV6Y-zCx?~xdt=}s
z&jNI2=#T$M<;hMdg)Q1SDAr-gkOMCI3es|`zc=GMd7g?LfX?+zh00pxZc3l`C(lx}
zBaSfc&t^UsqquSy%`W78po1GJTG!{{0>02sPG?dD|csf~=WIe%ohcOC?)2X=~2{{!f&4(^m$c=#bhYiAsf)Ksr{Gpapd=3vF(nxK6vk|{=@a}{b>H}
zky51|<0=5FRH=Wy0#f;g?|kZkfB)*w{Dt)oEq;-#ZN>Ngx
zMazE0*?~Ux3>4?ZaZX*GSrId)BTB&&=;$&MEjtM^9_W|WcFBQJP=L|~nt~xyxr(o0
zKu*0h2+I@(YGTZbZnra}fwv0gZ{cyuO61vfj$S48Sg{GQWr}xVi#F0acEt-{EOYzz
z%kiZo38wF%W#57^+m51RrIJweTTW##fR&Tk318TX&vO9(l*)SGDxy70ddag^1GWJj
z%(tt(O@1MoZOyZkLpK4qm}Ow0n~?#WP#z8u4=%XHLJLaW;%kKnlJyssyB$
z9fKWVB)^Aqfp`otVC*A3W(M}eWJhJ`L?;Xy_X0z_q1#{vb})b)A>+UhyLNG|uB@hO
z*(6}KBFBzCBr8j6NebMCsXX`Gbr*ouaBfcO1g;qMP%)vu5)+Nh8)l%tzmI$#n#AZ3
z=Vl)aG}84$?s4vY0j-%N>9L>C#-7Xb3m4t^Pq}64$dM@YI0B2fbVOMdNXY?K)e`xo)%RJ=(GgLpA4@D4oM~-sD0U;}ejpEJ+*b-z~Sf
z+HOj{cfVZzv}?pIF3PdhQ)%IEkOU6vmx2QYLdv@6GdeOi04j`rmz*z9nWqb>3(*Ew
zoA)b9Hsp6^5dTNygh`xaNIcBXkd(~RhR6uV@JjGN*2NbM71>;40@^P21CSkejs7z4
zXEG!mWqlW5XXbkXS2itho+OViNH*9r8Uo*RGr$%!)KoL3qIFls>>bMjY%s=(z)rtg
zd&-j2aRRXISSIUZSzSFXOUF;i@nc72+qNA@UBB}~cgg9~D>6SnhXKlB=c86x6!(;;
zK}_>KAQCC*(sV6
z`}Ld51*Owv8D@&
zwxny+4fD0oNykP=Y0IJ{v`vC|+A5%ZYTKadgoR0;W4G{t=Pth#~VB(n1#888p
zvMPLOf&s(Pyk(R+O#(xJl%7YAoH9TPpF85%p%@GoGg{$em0ZFmn*nHDf;q+^ZUN7D
zy;#{}BA=;|8P?IL=e^C|x@cDKz+5ivved-+m}Eeeft4L>rinpZU6s=(PRb(>Jt%Vt
zL~Y->OCGxSA$jnDhh%=V2*5*mkAT%#?1!%hyq9{jy5Qij54aXQNXmx}-Z71bz}?Z`
z=Mf!^KE@slDfp=@=c~p1OOqi1is;K?w1Y)wSfm8@qjCoR4KVAaQFfMy6G`@+qf>2A
zr#se9-4)N>`@7G7_3!;lDW>*PpM*SkB-q5U
z2LR~U`BqhQV27MpWO+*fMQ+x)m)U}7U0T^Vj8)5IEE|POa3*n!lw_=zC9Z2#w%Gfg
zl@c&6E+?PIJoMKYSh9uIXBm!j_Go~QmQj=q&H_U<$Z&elR-5vh0?s;b>
ze4ac2CSMuD<-tDkG)Las_Pfx3_|SXPRlUa#AS*L3iZka0Q>K?mod+0ED*WmrJ{`e?^na@=dsQ^CU3HHu_G`HY*yrq
zI}NvVbnUocKuP!6UtS$QULTr(ofjOKQo^ju-Sokav-05iE7
zgGju_*$kdpEp+q=ePVhiv`sK)yrCJN;fpmH2nSkcP(3#o_C|K>n>`QmTt{hAA2+PX
z!nNsKkJmP3b8Sr?e&BvNdE%Jt+_qEZ>IJ#^=38Zbc}*76zwwGH)urbttElXic7{?>
zu8dV91Dfx0_1rm&vap;FGNO6rBIhPqI(uu9B2(Kln8l%ccEXAUfg*q(J1@9ER>teH(rm~?)7jIa@AK?JeLWrZ
zqKmMe2S+fcfNMCcY=Ivzpj5Vuy|M8q3Yco~mM0l3cao1oMv{&BQ8Rn?U1h@*yC}s3
zIWE-T63z0&nTnL<26@zrNDmOeMyCI@0B1CA1N<1^<0W)`bDKA*E!N7qad@&N3Rt88
zSu21T%iGeZj<)SgUL=rct&6lX1_zmFkzB8!!4G^8!+Ir_`cEy|SiXy9G9t=)Q^8PEx?sC!n3V(@6r$o?=`#Vl$e
zgGq$EIv4{tddpN2*Jr7TU70Zr
zY@KVn3<$$GUG~FQ%zyN6?mziOKlUT<`mjjOwkTEV6JLeFDpl(Ltng|0M}PF%E57vU
zPx;yAqobG2kLF^NR_Im}!b1Z#0W6ZTJi4N2_gZT*j=7uFkQ-by4y2MGd66L4q7m4n
zr7Dvh4E*Gx#zhG{lIwba#OzQ`!RzHJm7gktAsF0UOU5j_e-yBFFn*x}umWhHpqM-P
z0IaYca;usT)isPe@Y@$;{}V2k9sBml%5)?B*-T6S1mkw{VCWE~XXm2LKIA!Sj1{pl
z#n%0(p`p$ebJv;l=7R0NQBa`UD2oDwsJ|!9{7;#q!Ws8@U@(hdE`N`YCgh@gX+sW;
z(TRu)$N{PXCmb>ra({v3P)qEVrSI!^TflDNtV9t58a4_hPhoas0`=TXV<&lVH3KGw
zI1Z0we=T3womrNp<0s_!(POe_#}1iHI=T4+A4&i>%C_y>FcwDv
zE*tkM#zBbmp{Y5Kj9q;ki=_9ic81a?$c{aJIB*%a+WqKZRL{UsEL#o!xoXQGZrs{6
z0k2~hBBWl=^XV*04RR}60^uL*DjRTJIUAIn_Pr(`R3>q*Ns{K!g~m<&!6z(y*=%{Aj>0oAMd8Py?
z1We5437)`0dP$HA5Z7FX@bw7mP-NtS*urPIRp=OVl^J>hTl-B0Bv2rz2#%@VUc(kE
z#x2wq>j3u3BNvDrgrTyOavQNiQxjOCp+*yQ1bGpxTi44q`eba&4HKZLrQVjn)#aDS
z{EqF&yIPs7$V6x7CFuzgkXWakkqG&9K*87yl`K?t70vX3I(Dj%xs^RpYyU
zfY7Yfc_GWiQ#(`O?B#s0hJu){M>HcfI5x@c1~B3a!G}J$aU3uVV3i}FV!k9<;+sjl
z0F36LQpQjBsfC%|65o5~h!7C0PXdcgG`Eq>k>pH4z1|!}qwJotm^!?BoB-B%V@*z<
zJT9kB98av(y6oJsOYZ*YeTlg`D%%sV(jmtTVCBhh5zeLbI-Pdeky#zoFvVlepAhsQ
ze3l4m2CVGBVMg!Ba%Iyx$09jo=L3*A9y0(qB+P~Y&oRs*k1gsHTw2_OOY9|vl~)1V
z#z?31{DB3-s$ZOmc^wihA;SGO(hZJyC>MW=Nuu7Hs
z-z%)5fA<$({B`FYJ@m7K@#1`1Si-pNd=sYh#~>L}f29bv@+>@MAu0u6eG~%3C);W?
zUy1&MOhTWdgavNq)5%HWx_!3MSIir#7@NSp|0sDz9M}NeEz6Gb<`Z%q#U{44>&tc;
zMMU-jX66o239T2&QJ!i}?*K?@EcRhINZ@Kw4nFA#GT63F)+ZaXI$n{nOzk|7-C)AD
z%|Ha$WWJT}Xjaa-R9%+WWH#PKeOJg}4FnnLRQGw^v^=Gp+^OJzF$dNU;K(Rd*6F7a
z0V*YOOiKa;!8|`=JeRXPtQdOV{MNBFI>^}B)yr?1rug+n@U7nuTYiRSfXM5U%|PCc
zH5;|{{7h}UjreRJCrPJ>N0}f6F*+k~+Dv7#IhJN)MUFjkOpZSEkSxy4Y2;dBtv)Q%
zX^z1@fERnsG=
zZ1O;$tk>FktB~k!*<}gXV}gOstQ3Zu`ovD20#aa11UD4{{3*_51Z
zMiLG`eeMr_`aj?EHE(;{E$dRiRjIS23cxB=>VI9mnf>qn-!J`!3zv@kv|Ag^DM6HE
zLEm(Y9l&}L$XfM26^VUj4OO{PF=!g1t7Vd7c7Dk~&
zWH~WMGnz}tDYN4
zOyKI!6<3H`7$6;dBT0kfI7y%^ZJ?p4KL|k;n2t#HBgYdcu<%AZh2Esjg;*EmF7WIr
zpaK}OIg0^iY9U(^$w0vmrJZojLMkz@&~mauH#1xN3|I(Qai~g?ge~xh$O>#y_PMo|
zw}lZx3QEJQH6R!NT|u-BG6T%&HG?wevJXiBP+MX5r5>x!;3EKII4Q@wNbiAyG#m*C
zr{hi8+*nWGYF!?={{dNBUXlI#_RE9!J|ef>b~{qpb9bc1RX}KSg
zlNebk3rlrji;7&^KxTu7E=#Je_gn!=+xf~8DWV@VFHH<^I`dgM^|D2Dc9PLkrnT;e
zLJx9SXkxUGf#xY)YKN(UECpay(le{HQ**oBWPPvvz*oNRtv_M9Y%#Q#I%}!`tWu@^
z=Y>zg*IaYW;1AyPjGwG;-TjTy3~b(Xi0(~xq-aRC1&e3}Hi1Bba0@N)
z-ZGBbXaFeK2osa&U|hB?FU?}oFO&sI3*vC!KG}E4MN)5Hl=UQ0O~xAu9FEb|)&zFo
zx!wTAq0iBzul#N7OEjt`bdrts9AYiAvk-V05NxXF(nm9qbKjV7MXm^dNIM+GjN%4n
z;rl`hnt9q<`q-2i$$R7h>H;OlNUllQHXmwSV=#N3otuoRn6XxQ-#c+LFoFHobE?@{
ziPcL0qRvAGWB%FfMpIB25UN`Bz9t2AgG5hGwbM_5-egmjPo0vrGiT(H2Obiifb5Q)
zJLDhU`F@#9TG_TZ2Zpg84A|U&VbmXcH%E&%AVbBkg2{rF4Rd5f0=p(-q~DIQ6p>j}
zcpO2yclq&@PNPY{7*ZW$-=8__5EPiv+iTdLG2tqQ;@RqCHEfU9r)-fIqj=VxB?#?9Ln
zzjWZ|lKN4_X}9THeDv?YsxUX9hCv*&(Hw<7j1zI@k22X0cp?3~c5%jPM2^J)ZSc`Dl>icu&t&XQ+Ml5UIXbHae2JOUTZ)(TKe*V;hqQ_QLBK#rk*9$wc`W>l{cW&tw)!d^Gx
zx`mlL$<8ldA7f%XyY0Zlm^d5E@b97}m)rhD@jYvm53(|5k-%3hg$b`(Mop6Y<+#1gKo%hHLXa_>j)l0$nA$nwgXy#IZ-$eum>ERsSD$PbN$
znu*JSx*qNqURr0YQpB}mazd3)BmivQcZobd_0ZE3CwV+m_H{*oAF^-ux8CFM7V_FV
zZ?CHovx2C~ps2-gU|_Z5{6PiY+DL1*I1Ymz3VdKgS1T0tJ1-iZd2oI6tH0&D-v0l}
ztW&Unt5RoG6@XQ$)W;Xc-u&tDlnLl_?wx>U%#d$fk
zwj}G*H9TL;6z?o!3JjB{!F?zuX$B5KZiOB(bdhD|PjmpaOYB#ZmbIsc8F-NQBnpQ!;?M
zjnI)r6YBy*!v+9t1Ry6(Ra3^rzI$u@iSGJw>h%d+eakh^
zdduqV!)MonI!wF9lVj>ENx&BF$c0_D7(kF~B+e}9_A8c|m@FXKxDhtSIbotW7iGzF
z;PjszKe;>WD#K!A9fus-B4D&YA*e_N_9EK;WWSRw`I#KkeX}sm+5nJtI?|Lr+h_hg
zl5TEZwjDVv`!2o^AZ2-VNjAC-X`2ZQ%}^X6aR~qt(!Qg0*$D;55G-@ak+srUjFLTI
zV0b)O9fX|b@hl-P?CQ~K;qRjK=PX{Kvg^RT&BK|+QqeP^B-Yi(tcuo#4+qJS6PfqY
zSL+(-`saWCrkrtA%(^>JKLQ7wsIjSTNBJbmF-RyyjHzb7U|uA
zfm&bR7=j4XIK5!mjGm=TZIvgBr8|(mp4%p)1ACGzcu9gkt*opkS+LoZt_ci?#PbLZ
z^Bg{x@%-C*|WIS
zn?-|t?!;76f0seJfv}wC8M4vdX~$wC>znH$(^if@^oTrg_g!GN27_8|xZynsPz_{Z
zVI(6!kZfv#{YB08x&XIIE9p>atiXtVnARiNd1Sxr
zzUbm~)B%R}vHF2xV*!-eTgKCeNX^c=&mh@xzcNF_oGp5wlnadkDppcVwR10cC52e*nR2@d`zdCvaz-*?RY~@KK!UWbk9Sw
zd-o1Gb>fWN^uC+r;Gu&6V{J<_KCJ%Y~{2UJt?>?99}HfGE-p&s`Id|Vwspn__Ky^@`Rp4hR=
z6xRezAN>8$rclLOgY?B*(z0DW@C#SfKl>m5TlF1pdCN_i5G>%T)LCBzV3jJB!PRfP
z;`5%_T=?ecouj>jY7nMP=NpV8@eH0sq(N;=RA=33iVy0v7~~}@fpR7xn9hJ#h)1qquwI0
zT9l-GJ>WiS=8$F(%`M1|1AArv#TUsqu^(&Wby;o3>G3)@cWN^Wy@hS6(S9mS+Dfn8
z(Yw)K#
zcEI@_$Zk~#)%4!sDS2-rFTV{;79$y%IzTTMu!IS*1L5%EnDfaz?do;&Z8!-o&Zop;>>M7F;f2}<++&vhKLZjd+kg3Vi
zlh{IqB_^1Z;w&80CJ<+zi+&=XebAyC`5(j^#nYGh`sG3kGnqG2D|Gt70!7Su_)EfqpQOg~LZ=$N2{V
z@K)AO%j#r|1Ji$lap?z0*NlP4vXU;R9lOFJ7Jg$UV(f=3M`vtQO%{;DnHff^EJy`L
z!@3+Z|7G%{GAc3Tv~|Whh!I0EkM}|M*^K1K5d->qI+)sXH?hsyPc$nHHmBx4I@Q2Xx7EQxwDLAalyv3Ix^f=R>9SU5ks
zR$HWPUmHksmgHsKoB*N-`mF7F2FikLVXnyZWqMMjU2k&)bJPON@4_st;LLO7W(=pE
z7qVO`3wEInmEXQ=w7#}KzVWr+{HH&-<@Ys8sZ!@i6%SUaPt~H?DZRh{$}he2h1YJs
z$0($U0~6?RfZ)fY$4Vm%sljg
zE45DyLP(5=%+1N-;lr}?yu&bZFRz}I^(0#j(lP7!8+6!3OD0#=qI11`iGj?mfyO|<
z!x?iz1~4;57&PoTf+y13L+?^%l#K6l!5Befw=4pqGP`)?nR(?AR%yxZkjM<`M6qy8
zYag)JGldllPZzsB5uUQ3+3flV4UJKtlvP;=AR$`U8}bP_33LHA6ihoZVz}OVK-vMS
zBW9wGyJ;wGrtNDoyMn860#_@iPQq`swz4Vbop(h3_OJgQKC4|jcBJb>gT1e6oSVU5
zAa+wEU{d!IqZmsF5Z*BwgZoW6uru!!24stMm^y-6UuDpo&G7_e`~YEmDKQ&BbBs)Q
zr=gu*tNyuSlC&cvt4*rZ$Kss1*{n%KGgJh?dbPLvp`Y71xAM?%{p-KsyWaNmG9v=c
zRdBUc$N#5_Zz!c6cU2gyQlE;I-|)iQ{^;|*;;QcOn>Ozr?HJ9?he>GFKaCDK3~&iz
zz7%KKKQ@lVKA|JjQoSTK=k)bx#@G{>eFK>eU7hMJV{1$!WFVwUCml`Im?`LJruLW(
zG6P~@&;mRDe3qw7i9`&6kJ86^qU}HQ3m&9PH9Mz;Obypa6jw8JJ(5ltgl#)y`;jBE
z>+nIaFU#vovNBm_FlEbxa&)_SCeN#sr)Q(yGRPPvbptQXlGd{qZ8ieg%}m&RJb=J!
zhJz7$btqxtESl1qz`}4qnaU(afg7sk_i}uNUO{27s90L
zFtnK?WV#t661ebSA&cxZQ})VG*#KQSTZ0R=cNQo~umhPZa?A}NMKF%YTJ04LRn=Tta1(P1EKB1RS(&a``~r{wm=bi(;i(=zFM4tmk%k@s#$faumJE81kXx0b
z2<%+cZYFh#*~%yln)GBNSa5zTuCrA_U7a&;RKApfV`1>!nAtgR=645{4TtLmKB~%a
zL(Xo^;I9Wnk{w}zUb=q!1jc#}z~XhmFkCjfo4+YomVP8v){n^1d4kG&wH=bnV>)N+
zD@(F;;<()Ykvn8zv>>7B~@q29|XyUsfwM(Ot1_oQ7P`R^aO@AH4*7vB3(Id{QT&$wN8-Sg+a=NtdU
zS3LdMPyZHobp8BW|L&dJ-v1B(;QiuW*|BS{>^-pKv>c2-a_txY+#BsV#lZhKsv;4V
z`cx~tfqm%hU-X0SmhC?{*xcrZe!+E#a%p3Op~4tii_Sh>N?OPu!N$K}2_~MQ>D{w~
z3=D`j4-8(0l8Y{+Rp8ha^_W1eaiL$*us}xN2VdG>WXky2#onYqf
zwDL188-OZjWig#w0Z#`BX^?(A5I-D>Us#ZB=N*zg=U*Vx1ei7^>#{aoNx)#5_N_B7
zlxKF9fe^}jg1;eq#Vtdo@rcgS#a-6i$YZ&`*G?@gxS<@NF3^~@pq*MfJdbdT3iv7MR3sade7|p1~Ak*xB
z%DyLp3P{34-F7Zw4#et*9?Oi)Ds_%m0a&Fzl?v<1AN|+Q`r=C-J^$wi
z;{})A;FJ||Q%%lB;9`Uk8t?A9X#3erwP@yaZ|qcMiyA-O+iDtf8+%T?_OsS~F>h8*
zcn8}Od((5TP$A};%tC&b&8hKVz@jB+S?3#HU$zV~HeZwvTlg5`Y5MtsX;B-D#EnL>
z^TG>d$NmFSrLQ-ptFoHdt1d~T%78)H4CbZjnI^_ZxL$g5HfAN7XJ-Zo#Z3J~0@Azc
zoh|BQ==c!MWAuG6WsZB8MX)ljio}?)CKhplnR!^;8KqEJnmJ6@!jUyOwu0x(8VyWt
z1GtFNbCCHU0FE>kLGlSUV3B^-WEL&Dz9TP3KlBq4kqyOTtu4o^nNDTAxhZE7b9Kv&
zH_MTO=OqT~qjJ|>56JF4y9lm@LzD@nYa73m2`n@D_kpSz7`h(R5%Ag7wIE{fBhGBnCBvkgZGzT`?=R$_QoIiSHI@(J@s7=+;{(;&2A(8
z%4lYPCo4;*kO%g>Px}n{hrj-72&x)_vGVZbs+T?Mnr9A<%-#6D_uX?s`YT!LT&@DJ
zN`0ynFw-CY;Y+{ZYIokR#?$ljQVkQZ3a*1WxdpQn^K7(epsC{+5BQ2413J5o(FqC;
z+!l|J4rEr~QCaR1JuO_932M|oCDa2W6UcQz4<_Sfv$Z!#hcn-t-9a=ej?vRUQ+tBfrJ%yCG-R&mcv-vJ5M{cIrg3I6<#VXu
z4IPFZJ2P{4AYe!o8_{CHmNt~xM&a@MHnOJ=b2TXJT~8aD@j4oqHh62{qx55u?ZUOl
z`)1$=MtOh=o@=sC4jw%{{%HbM?N|-%>oBz6eB&*0{^9fF=9_PmqmP`DUAuM>#8dd7YAc4F2}!2+s*zUqM$
zI$;L%2KXny5YPn384^*dze_H8bX
zM&ang%TIXu)mOYW?i}CufmKp#ZM_;&)&9>L;~_{);=deb>;B
z!lZ2+fR*~1RD$Yqmy?e4FaxzWkc8h9W+Lh0#VI+q$Qqbo%m5J$7?{pt1fsLFZehDR
zO+^^FlRF0~Il4aT0mE_)n3(&^XewJYwOqervw_EkH1wEav>`c8P52`i+Pxd5rzCk$
zy9Lj`Q1)GLL6QjvvOXQlna$G)1Z=>x-l_x`*v-geBac)COO7{Ck_RE1Tin2mjp=b@
z{W5tK%>eC4Ul}77+3{vE4FFMY*7?WS3!WE6r-OQkPB>@m6ph=wR+zgO5PfNKX4?Fq
zf+tL+z@D12ZZ|M7z3(b(Z2|zBzqAQBcuWkrE7NhfaS&r8GoxtoZznL`X9i05eV}2p
z(?-@;SLNiYc3X463}3L*G;^N>D`Zl6jREkzGxpS?
z7&1T?j+wD!HC{VEW7n$6x-Ba|1GG6N!_UUq;J9pFAO@Q22MkYt9fDLdBW5yT?pg$M
z>rFDWA<~$~2-abanK;T)^lyZ=!2+_*(JBC|)Z@JXuKx7bU-{~*!+CEGkM7t#kU?k^*Z3Cm{Cup8x$nhJI{!7l)kuY&ZHv2YgZNtVMZw748j>R!3JuGS`N
zvN~Co>3BVz8G&Ive^e
zl?@bj8BjXQ6tjc#!2qVkC}0kw&2Ee_@27c#BUu*l2K>6%dxN;m005GsUxEL!cP%et
zu6JPBK6QOG2h$=PhFkmEVhKzp)B(kzmu<-a(We&Dxt+*#ZCxHc_K1Aswhzg92M^0T
z-uYfh7+;3NkzHdRBRx-f)}`1`Wur)9Fwo*>Ki?uIL85ium@A=Nr%en7E&;Ag?yX&A
zot%adJOLKQ840foZv*Z6GhbEZBtLwBz*Uck1>Ar7y85^(Gl>L!M9
z&NZWSN6k66I*Q-(BX4-;JLTMCuksxePd)Uj-{0K6`NPN0oLFc^ZDF_6S{jH@0D#WKsWB8G}sh{!rP>r{*VSQ+)Rs01k%44Hjj(dV%{
z%)#o^5UvcEc5N}P8{KsTe1Tny-ejg~#BM?D0!)7v4<3}gmtL3@(xHqeNv_&lmd){6
zT5zrNkSK_FB619K*R_2{6ai?K-V`;4-g_iwYzKpvS+y7~tTUJ#CA};c&Cf=uk4ABV
zQCr#rN5XhxXeyJ+GO*jqK(7!^VMC|;E{@zqSMI&zmw)d=-+cGo
zkG66Sf~(iP?(^o~`6u7|vl|~;{mwI+E0wFGl6byq8A%cIevb>();`dihhYI=J%#A3mnwGk>%ybq-ZA(v^C=77V9v
zeB%qRdco+T-{_VW_Kf^c^&79qMB@|i2AIH1Wr3C*K619qyV8*)j>B|2GkT-lKCxaH
zlkWRhYABk9s&zIgb6?7Jj^tMv6|GfvFanrx;&I&!6*
zs!xdQkpin0Pqw%UUGSZQUJ=kW$o6|MHi1G^_Cm!N`(tB#I~l(OZu=F2jfu>QVwW9d
zRm@1#|5|ns;<1(#uN!3Grr1#6*n8EmIpORt2xN|IATEpjppD#j{ufMIRKhO7?ev&N
z=$+CH>ED(XLDmjHwX(c1n>A_s6xnZp$9J|(y_Cp2OV@ug9?P+ZACg;c`k-8R(M9t1
zzj+VNnKD=KrbYHdI-fzE`xq%0Kz$1{<`8abUNGlu;J0<1f+;Z|?kt8u&xNzhw3@yu
zWu1)noLwdZnck#E1enT}W(Dm&tQa#w2F-l;Y3+hcErPM{ZjE#$(fUH#Zt2oIP|3s(6RdLcmc?Go~=J
zuzJo;ojN7YeBLuSF=2Tn0q!b&=$Xiz_hE72(8asgHG^meZLas-~0ohSl^%1EgEn*6T|WE8=cC1%ET(nk{n
zGq#6lO#oSv?FAbfa4hU3MA$~!-mvyPsFIu{E;Q}qTalfH9w4VP7L0zTF7rGly}1k^
zV+Mek4P!o-{=8`$*;reXQzwqf%^&!nTz2VY^3K0~4`k`>i`&xQk?d9O(#ytkGqE$V
z!kbJ8jcv>6v<3(J4(^GHKpe!827UTLF9GsCv-~S##~@W(=OyH4>#WSO9-BvLf~RLr
z>~GHH)CUBBIB)7SgJuyX+CM(RRIhjSs2*B}Vq#JgHFm`_FaGe4{ik<+(>cgq;iJIu
zJKprYXYO42_A|06qjX?(<6Yw#GI*{sub{WzXEJvoi|IN>2?4Z07U$<=b7fubz4rmR
z;F3#Z(oD3|)Gch=9!{KI+rGP*KKG)h96ovThmXET&OI6RQ@RR+RqF9p09SwTTc7dr
ze|6PW?^yqcf672nR9dN~v5~2E(xruM5D2csq!ScyK{O_WK!I)Pf=}~ei+Ue&sjI%F
zWpg$RGogZpb4GTPVLex7tD`}lKqO$1r5r^t$CPifLeUJ(lv1{|{yWAEAQ?VJG7-A4
z)$H)Xj5+hyNH7sy~?5oY(bBnhsL*I}VmQ@c0NkZ0Cy?NIY}
zQn7{yN|Z6jB}9(i5tkDf=;XyryV##r#zQ~?tRZ*WvW`#g_&m?k2YFPFPvx$bQ?nD{
znB_;%GYn-_u#gkrW8it|$nep_W%CySECg9g%8FUS06>*Wt9lOAOQfNv=x`GR&_oD_6-aGB6N~jsSvq-KHr7`FzRxT#%l_Tl{6>1UO<8bH+q3(}p7YELUMwPgJ4>mv
zzsiLw^>`{WSKssWi(lX``Q`Clqa$enjj^izTC<5On)J
z8D#jLljyKoaiODMh{P4U^9JbbvgbttHAOf%lc-YGK<5i4)<6=d+Hv@h47Y7h``*gR
z#W7R*`Wz>FQE@wyLwt&E8Glux-Gd!~ZkO6)aQ
zWO>YsWals^ABcHm08g!>5d(+~Jk5FZcA5o@J}_@xqB^TlQ`)CV;+c*&W#!B%`N#)9
zB9~u$sr=>J-Y#L<$+qn~q-mxYD}(#1GBBk^@qzCxW!$#(uMabR-$?4Y|DL`;HQRHZ
zq!(*Jwc*T`0xuRFqSs|WPatWKfCdjRUpRI?rq3Yr^k{*7RiHW$_^bq@dx8ur{W3}F
z30w`$Z{_SBt?byuUd!9;LuKSvo8T_I=8{|9@)tM#tey39g^|(I)V=x5U-gtrcbxZ=
z%j<2u;O7&buN>v`j_2JT8BC__IE<6`T5OE|Z2G1J{nx%jyJi2rU5UwBlF?`+3v+|S
zes0L+7oI1Z=@;+*2UZqd{`|{-^T2_fmx*k-nMI&0S&
zvVJ%Qgdg-7S{ft+j0`6TRM@TN`86T{Olo5G0NE79S-yjB#dic8N|+(j%Grt=8Q92d
zuJpBnDnBo7VL`&&yzD%5M0OlFfQK$^oRRU`3XIq2ny&`{63Xu2HPi^Np{u6HAyGU%
zP?Oq`1nx3()Pk{TF{6+Jp0mlDU~nryjWEfx1uwHvA;*nLCT7}}rm_5eOP8|ilMV1u
z`cr1AU=_@t1eVdxa>p(_XH5kJojL-xls8UXom@5T~
znsndNl}|sI1;i@*HJ8qNyE#rQ)v7F?I4(E6|7N-1f(zxZ-u}*XA2^v`mWnSq&v?QK8UfH9!7lC_Wf8@Oa7Rj@F!rZw)tb~B
z>;nNVseMoE_d;=7ZBZ5qt^lf?eh4x4H2pV-b6_>2w^Vp%rhHyB?4$bE1}arMyVmKr
zFTCu)`+o8#-?lDtPWg)5Raad#eC;b<`jd~`H$LD;bD^m!H%-8J>Nvtm*=wEm$=~b>
zY;kQtZcgRH5Vm}T>hM^6Ctd&ZE;(P8Pn}6%ekk*EBUw$qr;Bq7>D~*jnqLe{4~{Q<
z<)>f%O=3<2DRtIY@nDsDJQQe)*T4SR7rgG-SHI=VheppD)dR$h>%!P}))`30H-LhU
zlR^AKGtT(
zn@j0U`;1JRG5t2Mf>7cbRIc}gK+>?71bAyOaz^l4dTe?=^`(^&)ChnK9x=bpn5Y1~
z(dOZ0<8+W-{>(ZDJ2>e(Qzi_sQq9l|5MyVYC64p-Mu5p24o{WK%^C`#b=g@0Kb6_Q
z0om}HMFZLd#*ie1$FBRFb7orrsn+nTd6FdBzSIOXj!^}bv5#x3Ycd{BWttYoTR!kX
zIq%2?@{V`BM>f|d$bQm!hIw(d)&vVZwVSvmNYMhow@1T|*CENufUFoxXfm#KwIWs_
zr@LEB0{n6c`fE#KS2?sE%(m?r{0TG_ZIqGF7pR7K`u!>l{{~o2Clp7)E(J=L`ir9>
zySAU+LJ-&Lk6hGEkUxmRcb*>jyr0cHRzwKXt`cwYk^sW9m
z+tVk@^giyVNdgnl_KCG>Eat$|<0BRiz>Xe{Y@xZ?!zTsI5Y(vZ(NfNiInw?HA^0W<
z)}`Zj>`hcfB$d(f!rMnNNapsR2!
z8L`Qz=n|Xf%)!uQZ}%EPsiakIC}eo2vow1iKm2ErY+Q~?h&K5epho4Dmcz6G_=2%6
zF^?yfJiUfKp-A8Y5Eyv9@)DF!DWL@$89>fJ3kv|#yqjGAm$$%7-Ow<7tsqGUcjJ20
zyfm5Z>JZ710Ni+8K78AUe->
z3`}kni?<+4X#1ECuH)DsnD3o8=FwXWmt#vu{70;8$lG>ipeKt$U)Gks4KvNx)`XxE
zAAqK^U<%p>992{g2H2jSA9xsbmSM#)QQB;QMELaj37or&uR8Spzr5k*oK$`;6z)LCt
zt^WO2zvQPL`G7oU*JwU8q4AXS^ak$`oar@Q0iVu0v0Q097c=6r2{@8vqL)|SyIM#h
z7!9L~tFkPS9u}2g^bOEyt9(ZmC4%W;H~``pJee;KMy4XJ66w>jy=5D*-QANta`{84
z>%%W&Kl9dnSe1Ey#FlJbbZfE&Zjj#S)1QSy`x1L~NQUWC@pQT-OPeR9nT*o{nWZFe
z5)|4c`=|#6DzP^yE7)oH(lBWms|9e>K^DVsoQ!fTXGaW<
zLaoaAK8amlzJc^((GD?WT#Q#%MsIy>T{c!%<&N8Klf<6N%^$c;9=QJj86f*?
zy?MbZdrZ2b!^AcvHWBP3PrG@}=<&k-8uO(eTWXg(7x}wE36%1z28&iX`90CdVKgU8
zRrs%e{^xg1;T!1e9&m1NK)91|kOESWJ~d}dwD
z)*bte_qjso0yOq2bo3$XM`y2@K_AC#^b;0y0%Tog{
zRe9?ctqE++ABRyk`kyyx(FQ|94#(lwfCUxCJyqtPqV%VRcih8q#?sneFxj27o3NEZ
zWTebh9(!a!3ft8`8m)l{3Nl&4bRQ+G?w|VH%O3jMf4KMe?f3UwU|{eI{D%MVuYdmD
zo6bDVZ{LwF&cHiM(~kg~PQ=CmaZFWCvA1Rrl?81&L3Uy4Sq*qx&8CucpKNTb%Vk$w
zDl1E;v7KQ$hpVfb2qM+y2?gWYZn3u6$|VQpzx?3Ag9oG--p}eP0ISrwT3B=b_ARgc
z`st1HuUo7}YF&4Y*NB9cAPVC~sG-4tu3)OO4z%2vmWT2>^Tp)1D_!#xLIEalmjWW3D%f2QU4*rgmU<Rc=!g}48Y&-+(LPVM`dK{Fbt?^&4!rjKt4xztaVKsnw#KG~mRl9SF(QyI|F
z7XcQ>f+wj$G50BisR0{r9YXeyU>Q#0Bo83YGLynQeY35qK(?T=H&mElX*^Z{QAwQT
zVYRW(JEEvY6Sx9K4LfBxq%F)mB#c`L`Ubx+k{t+L*vQSNpZ@~Wg0X$bZ
zJ5HZFNC!4I8u<&ZK5+akfA-!t%eesvbRWCl|Mk~DXV>P!_r<}^T92;{o%C(5+L_vs
z>E-qPwmGT~Ygo&8V+=nQGSSlS
ztumwuXvOtud+AkI9=srJW>Jb4>#VH;uu7e4g-?}#_-ikH)ul%d{#iqziM0#>QP$GXN=63|RycF?B6yN6VaQ1i4$~G930(M0wiALe%6CpUxX-!~
zTN>Y^Evi1_wCq*S9b&>aS{Il|PLnrH#DGwlmC0|LFbaF*=#YsckW?Q?ts`*ik;vS<
zY&&u|NrU@wtQuH&dgWx=r>U8>88x7c9+S;m^BlDRG%;95m`Z@ySF$Cw0aNZCrA%d!
zLfhcExh)@FHkiOYGNX_{Zf7jZhj~>+HdSptD`lDtjCC35*vOb1*^tlgR$r9Qk|fu9
zWjxGV
z7s9mJbXl6l53NyvabcO-)N3?CQ-Y_dU-Bmn*ZTzd;jW(osrOm}R4VOm-?_lh*>s&o
zHFN0%+Yex0!5XGFxH{dO=eG+#@bb@i(zTNDbg8qh3cxCLE)|xP|M+t+dfGMqyr0=T
z-Y#q#jzZJ59uWvFyVGDsS6>4pJU+29#!BB6!A3zIa|nk7BZT>Gp`Q~*kCvu`6LcUQ
z9Lr2AW=fJi&&tnY1dwvBsn){4PG@cXWToh#LAteY@j~o^b?E71Mk+UWqcm(`#+$Lp
zHyQwnw{abPlO(}dr#Ix$NOq-#eP;q!>Q~wrugKEsDI8~o_eB6%$)&J%en$%7tO|7+hQv=Oc+HkRSlywfn@A|G7I*MTQoQDe=#=#
z@K0sm^tPY}Gny;Fta3{{*8HlM2MN5KNt)c4MiYRAsts;<>3vtZ$pGJmAIW@L&~^#(
zJTbAfO`E_~lfc!QoH+KdJp90evOCGKZ+q+C%I>{;(6X=55*&K$&8R-}U4cn7Ulfh+
z{2KwW#?%F4LcNX9(c;2P0OYrt{43W>naHLxgEc(Y&VV9LX2n^SVAWd6xeB&04rtIH
zf8T|eev8n=;Am#A1`eUQ-n>VepQga6*4c(NeOCh}&4O7)6hvZPhUxFoXcXsnY;WKF
zkw^Z}Zh^DiH-ulh_x;TqzTm+RJo>_I2M&hK@v6_+T0+&now^qk8N
zy}&kDSgf+O4&%b6TE$y5}Mnut33>ZYwPrD5dM0w3wvDN;I@{0=COC
z;6<$w_}uTw#E7?Hyn&`=%^0FQ>EX{}dp>0{Wg0Vslm4=RD%#E>Y3Lb@wQ0{aD6V*#*w#xe1#g)tq*m?njH?D_8Ys?@N
z7W!$-69OFqPkp3Rqo5TD@+KoHYom)3^qegoJH6&+sq0mr%w|#EsmYi{HW&b)r0r}h
zFU!djkIF+2+#`n%9FRZ#lfRZ-J9e{a0GKS=z-a^Q0CVPbGno%Ep856QWK
z#nX|o13A~y=&Ngeuq60C$P`yO^wJ&T71UrS(&t5ioziTo%DUbv1FH%gdVpd+HZyjS;>X@?y7;l%l5(zsIAs>bYs>P$ogbCGdk)CkZ+K5)9p-1FbuieN
z>{vCZg*XVVe|pR$hsfsORQjLT8JSbpEttcJ0mTgNxodh&I+KxuMNB|`vTF>c)H({$
z73rceWzl558eTm0SFs6$o-=T~I8}C+I*YTYEKqR_zVg+L
zW1Irn1^rjY&x^tQP3TI?3;-b$7R!FY_UwqmA}v`CBb&r`D{a&7m`bgWt(^h1%(WOp
zmcI^6jBgXbA(*j|I?4*D=O!^<9Xg3D%^9l_hx{^sD$p4ejP=PBmNV@o0V^4f@W=1k
zB|8rtlHtPkBwLMTErF}e#9%p_H4`-HvkQFNRdA%BF(*h1P5mU-7+ry*w@$y#&MWpY
z=J_qQsGCW=mq}t~^|(kNo!!ja9JWk=N0l{jq2c6PVMBr)o68*5mJi}KoEVAg=~x<{
zP4|&QrtQ&rQLim|KWy=6&3rFgVmJD)Xh_zPM$CG0Cf6x2uL)SH2%y`JC$h1+BKO>N
zkL=vBS8l%P4mo{tS>_UuYSFbwLpsL`0UePM!VqxjI{*c(`AF!(YvDe%Lv|brY2Adz
zV|kAK5lfGcko8<25K2PC5&F>V34-b<%m-70A$0-5!10
z^pt@ObCd{k239_20-RBS39G6hfV%?VbPVqB#e47j%Xi)N=W_N-S+F3y=|8>ps`jDv
zuNfWLEi22X90P;tvE&CO4i-ndgXgS4oDcg|!+Stw=g#wYIZrg8JZ&CJ%Z(cZ>teuRg(E9cuyLn?KIj%(sg!C$(q%XA4fuZ?B>z&YoGV@C%;-sopn_JR;jbSz@7Z|
zuUz}t=N;Ymy}ldzCIJQQ<_Ya2z4;^_YdRIPTdbt#sdW?Zg$KmM};+(^DU785?Oqs_H
zkrtI?_*ElCd+WN+&O$72ah5@r8LWH**&E**n*ORgv8>e&4c0n9)A$VvIgNA8qe
zyLK43<^oFzkT-2@kq0$oz9@OfqO;e>-Wh1pA0V#5W(#u9y-7oq2{Hc1(>NY;;=l8~
zk)HFz>G3iL96=Y&Yu0q(!1n6DF+NBrB|@gwNC*Y0odG*%sqxMjGe_T@Hq2X)(3M-G3n$UpvcQtFdk1z?prn+s&bZ~W4yedY_|MZX?S`CYo&
z)@jum>ZfO&e-_E6xXczMFn~2hDC5P-A{$hm^H~P7=KDyNNmoW1+;zojN&EL*J_3nE
zrItigkjbhovD`82G33F`&ca4Rux>HyA``J0dBGwe$dJKEuHFlk=&}b3l#4e*GZ%Pb
zjY@{YZOFhGE^e2d2lvU`&RtRuhBBV6Cvde2w$53Ef#*t2#>0yRaz@iiv&6@joxLOT
zTtQCC7a-EV#YNqE>TJ8{CJbC0$f5+Bx#$RFBmGk@cc}@J;yX)sk6WcN8y&)nMn)vK
zmc*TQQz<|Ms0suK(SlaZbL1>PimHry-*_yQdEaswcZrv2Gh=CxO3yw_<`(FQ)hZq1
zq#29KL`x@+$?+4%(qn4*yBppmhmIU!NUd(cF)|@W1B{L!5F?0kGk}X0YrvFq$L2pf
z-@cD&@Mca2Q^Ae`$(@*0uz|`|ZOQE2>|U+trJ4dXj6Na*DF&EL
zhSmE#5|?rOi<+q&=O1R@6=ytB4rJ^Zr9>SHt@qwA{cIqXg_h`@!xwKq{a5e5=coD`
z?CdSD9#IO6HHncQ68aBoRrc+6!6T>UPOypto|!$y*)LFv6{AINleN@hZ8cRYP?aY
z-$%Qg^uM;t9-~>87(hZtIZgv36#${*t`mL_0iOb}q?t6Xn~=!~Q@r7F4j`T3-UjUI
za98a(tk6`{+9;HUF$CGn9cg4`=UeP&`eg|V!Gu0A7*Yrz^i!?AQFq#nIGmT^&TX=7
z@7@Hs<`QEwl{06KN|ao<8TF~iVV2cIKzlchCw_A!}Skk3?;Ofgxb
zABZi+oaovxpg}r!pxG=J%8TCQMr>ms1Q?;_7qs0pdhbLn@S%U0x!#lSfr9U=|
z9g2j$jV@=NKo5p`i#pK#Mc!q_LD96l5ZL5nK&%Ag(M|zIHAWG;v_ZY(v`;Jt^WkZp^*7NMX#S@#4tW-$ysj_oG2b5}wCW8abSogNPX(
zimpL?B=35j9HE$zpSq*Cetuk*04o@fp|7h_S9l
z@T@rPCK9%1JCk(uV7eSWNZ{sdl#lt@XA88;I}pu09*}h<>62_V8p&|ic3IrHTk5%a
z?C<(yU8a+%A%h$NVV)WNqpkmrJ|6|206LYiAU#cGpoGZKO!&D2&VngzLZjr-KzY0h
za}LV-yc_ap_3K^9sy<7@kmjR9(MF0uZ
z5x`&^OpKOrL0~EtkpUZb$3K*LTDyKm>KVieS>jBaY!bMdjwiCYwkD4}@Q57Tb3p#)
zZ{8&b4jhnX(g45@1|u*{>boN5;0PgaY!uI|?t2t(+8dP?iJP(%N
zz~R+mV}l~QW5t*g4u7ute`Xny=fPxV6TX%0%0aDUa4m7%Q-Xr;Y)}IryUO*lHGzJ#
zcnChuM=@hNqak4EcMLX#cfM`?MOW^B&u{#{|L~jk>v*=ZS2%0G@C*Oy@~^!1rN8{(
z!%KU*Fb*T{@SB`xP}aC9S};x8k(%$rn6C@YFS`i!LrQ1By~12ZGMa22=p=hC^E*)<
zuZ1iIRt&|JG?ag;t3cUhMMBj8~CWsE^>3=C*@Gn7YLXr#CHsK12YsPiHk
z`6(Q7i85aXi0HjaZ-jNkqM@JYoiQKT+{^r{8uAYYJ%gzs00G;gV5Vm4yG!&wLK^`p
zT44-;I@
zk1jsF*E&#P9ptEd|3~1r%D_9f6>ShRQU_{W@C33dvYlRx^)s*t8883u$cRXnU+5v;SBvhWu99hb$J^^W79h_;+H
zOmzJH7v{(*!&r~zabFAu16*UL3^G6+16j5^_q@H^-9=Jl!n3AoDOKw1Du^X-{Vy;1
zl6c$PH!UV46`SZA1`J{0t!x-=ey6IF^aMG~7G?xY4k~8%*eCt~W{X352|oB{hb&37
z88##g)Ew_q%5%XITh#3Jof%Qx)=#p!;I;&Bx_qj{f_<}fHJZdorH8{U#w=C@1jjSYg4K7RA+<+X0&O|U2c@VTSZ*$y2A9RR!$nyt-
zO={LR@X8oFuxc~6H_P&`fYB7(>S?KKoF8ZN8sQhyV+^f*S{L(*&_Itp2*xG`iyF}5
zRvc1Uh^Cn53x;qpBYFkT6Vn+eUFFWa>?3L&=7l_
zy`Ia1r@3%C3+Id`>17XEwAqdW$79T_BaXoH|8iJqv|w6>*b?w_tW!lZyKY+1l}WHz
zy#Cgqpv%
zDq&W_VB7S2H<-$K3ybsH(x&IqpRttsq*r0EN}WvwW$(v-=&4V-+8y}$Fivk>W-j3e
zX8MWDzLLJS#AGvvV?p;cn}d}=rxk$%W&s8>K?lk&4A0b6MtPr#ERMG>HT{-mV?}QZ
zd4L?*r&Q_q5csi}#vXE)T4(d!LLSwk0I#;(BFC&Pla2thEN=>)82!A{R{7{C#|+YY
zWj!Zzdv+#iaHrG@3u%EL%gWl4Y^<*#D7CGa!KEEZ>U*i94fYM8R~#t^F~u8fRL)hZ
z#PXTQbTP29vynNiF2MFgfA>jePIw*A%soh}%a<2aQzuelY2
zImtHK_v~C|RxO&(rE3_YL}Jc^xy(0>WpLVFdICM$M+~}7e=42(*rtE$d1@FNkvkxV
z&c;~dpRG(cHss8sC*{F=9!QMAoczPPZo~lRwuzKl)u(0)UCy_HTo%c82J>7=9>FB^
zvw=->%2EVl>Npb;*N=medUh{{OuyPanAt=SO$~u4Zykal-HT3m9Kpbtg41YWp`g9O
zOb)b#o+@v!-vPm6lqtbJMEd(yk#E_w1LEj^igFT-GNIN-us3(zyHVO
z?3D(wUqA9A|MKAXzV7pW|B-vb)5mcmOvcN8IA6;+jOiuQN2cr2c2hiw4H*Hz#s^B{
z07osa0|Hmoqh<{T0IK$33LSx-fyFUX>lQ83;a$a&e!XDk;BYkLz~}VsX3UJgVfv7z
zEIT}l>B9`}!Fm8WayT~^$7h;@&%Av9r^{>_RH;vL6@XRhtg7p-JAeL5uDSBpmX6i?
z2lY@}&fK&Mh-K)^LB)(F5AO}VRxRG7xEOl^A(d`K0D`p8&aa>9dl}4_n%+;sPwH%|
zukopn3`#I?$DFH5a@xC)Y49@%KpPUX-UJrQu|v*FXBkM5{2X4CAMBA!g&#%Rr|jbx
zrF|IU6Lh_EyKLLHPlk(XYTuOA@k#<%r?GF^QOCJ|gnkIe)Lf@%@uIQKdu!|#&yB$r
zlMAh@QFD@f_E~u`Cw^LhYer9~XR7x>(X+*Y(JcX69ulo!s%_Dssryk|C!~@!37=5v
z6I*zMWC#X0_lfPMC`HPTdL6RADHubj&zstDd2ewVA;S@V9h@cf>!vK#AIBN!hr_)D
za4gn&DcElXU>hr|^5DJq%c1=TNr|jFa+l=dE(sH8!MY4+E&YB&>WFVx+Q;W74
zim@NK?Cm-uV+tL7mMXak*X@625$n2=M48i~weO97Fx!(st=q^ltm!!OFWHc<7to
z_O@HrfGmb9y22Oh899>rI)Xam^g%$?sdz39Jjwxyi&?iaq*N6xG;GvN;F|n!oJEWEa
zNXH6((aga6M*VN;_sUJvzxOZfc**(a@4iAxofTC8R;jb4fP234%bxmgPu=04S0&`(
zI@;R%Pw_o;m_%*;#$3+kz0}N3s%-7a5Du>K0mHzOl67O*pV*nx(!X0|j
z1R#h(?P%Jzu_~5erBY&~d4;pb9OXUa167bHB}+O&mY|O8ma8ocGLM)^8YsrNbeScB
z+>pSPG9YtvGTgaC7I*EEaW|2TpzPHO1u*sXXezh931^d%C?A9ab$s!9bIL9J9R4^@Q|%a&zWCv7eCx
zi;@Qrhis~csd`|u^m6B7HrI2T@T$S^&6ox;a5!`W&RG=7aL94BsDf^51BOf`~WxU*ZkD?IuQ-~N4X
zeXpFI>=oW)UiZ3d>R)}+zxaitcWi!sTnzE_sfQ8!s(ai0g5gO0Ir|?hau38xlS`B
zgd=#k*sx6@
zL=f;)n@Oet_5t-?YDcjj4Dc&dRb;d(#HMLz^3dxC$iw^gyhsH3sAnUC_$gJz--bz(o_q-D}k-?L0dl2|MsfCLsS3>%&?62Wq$TzY>|b12tu
z0;|fp#`+my!o{g`PWq1aimm>dhR*S=^=tvn;f;W011ycsWI}>0nt|z;b_RSHXTSl@
zN4|Xc~(9@r=9^ZWk0%J?^HI^Wu%o6
zD!xaPdxRI!TiyhHKcScV*!^lJK63UX23c2C4_Li*q2(+#&L6Z0i`v#`1>$PDx9&y_
zHBIL*bWP{CUs&J%m-pQL#Xt1p@48iHg4x+p8Dw<7^E==9+|PgMXZ+0lH=TK2*EDf_
z`cXIPDvZM7?;<~V^e#{HrUBfv-U33!CPLKscawfMDvPVYErnt3Q^aso!7xi@A^5J&Qkdun8HdnHYT!X*BrWVW5aIN1i26toA@nuC{|>yaexSe71#|X`g=YO
z?-IVRo(r=dAJ