@agentvault/grok-bridge 0.4.1 → 0.4.3

package/dist/bridge.d.ts

@@ -9,9 +9,6 @@
  * Those are Claude-shaped; Grok's gate is the pre_tool_use hook and arrives with
  * the tools-on posture.
  */
-/** `RoomSession` is declared ONCE in this package, by grok-session.ts. The Claude
- *  bridge declares its own in its bridge.ts; that declaration was NOT copied.
- *  Type-only, so this cannot create a runtime import cycle. */
 import type { RoomSession } from "./grok-session.js";
 export interface RoomMessage {
     roomId: string;
@@ -167,6 +164,12 @@ export declare function attachLifecycle(channel: LifecycleChannel, opts?: {
  */
 export declare function roomTurnPrefix(roomId: string, senderName: string, roomName?: string): string;
 export declare function wireBridge(channel: RoomChannel, session: RoomSession, target: ActiveTarget, opts?: {
+    /**
+     * #1107: this agent's own name, used to recognise its own @mention. Threaded
+     * from the bridge config. Without it the agent can only ever answer @all —
+     * `_makeOwesReply` warns once, loudly, rather than going quietly deaf.
+     */
+    agentName?: string;
     roomFilter?: string;
     log?: (msg: string) => void;
 }): void;

package/dist/index.js

@@ -1074,6 +1074,28 @@ var __toESM = (mod4, isNodeMode, target) => (target = mod4 != null ? __create(__
   isNodeMode || !mod4 || !mod4.__esModule ? __defProp2(target, "default", { value: mod4, enumerable: true }) : target,
   mod4
 ));
+function stripWrappers(s2) {
+  let start = 0;
+  let end = s2.length;
+  while (start < end && WRAPPERS.includes(s2[start])) start++;
+  while (end > start && WRAPPERS.includes(s2[end - 1])) end--;
+  return s2.slice(start, end);
+}
+function isAbstention(text) {
+  if (typeof text !== "string") return false;
+  return stripWrappers(text).toLowerCase().startsWith(SENTINEL);
+}
+var SENTINEL;
+var WRAPPERS;
+var INSTRUCTION;
+var init_abstention = __esm2({
+  "src/abstention.ts"() {
+    "use strict";
+    SENTINEL = "[[no-reply]]";
+    WRAPPERS = " 	\r\n`\"'*_";
+    INSTRUCTION = "not every message needs an answer from you: if this one is not addressed to you and asks nothing of you, reply with exactly " + SENTINEL + " and nothing else \u2014 that is discarded, not posted, and is how you stay quiet; never post a message SAYING that you are staying quiet";
+  }
+});
 function toEpoch(v2) {
   if (typeof v2 === "bigint") return v2;
   if (typeof v2 === "number") {
@@ -63752,6 +63774,39 @@ var init_mls_group = __esm2({
         const s2 = this._requireState();
         return s2.groupContext.groupId;
       }
+      /**
+       * Proof that this client actually holds the group's keys at its current
+       * epoch. Throws if not initialized.
+       *
+       * RFC 9420 §8.2's `epoch_authenticator`, derived from the epoch secret. Two
+       * properties make it the thing this codebase has been missing:
+       *
+       *   * every member at the same epoch computes the SAME value, so it is
+       *     comparable across clients and can be checked by a server;
+       *   * it cannot be computed without the key schedule, so possessing it is
+       *     evidence of membership rather than a claim about it. RFC 9420 names
+       *     this as its purpose: "to authenticate the shared group state".
+       *
+       * It is safe to publish. It is a KDF output over the epoch secret, not the
+       * secret, and the RFC intends it to be shown to out-of-band verifiers.
+       *
+       * WHY THIS EXISTS. `mls_groups.member_device_ids` records membership; the
+       * ability to decrypt lives only in one browser's localStorage. Nothing
+       * compared the two, and nothing could — so a device in the roster holding no
+       * keys was indistinguishable from a healthy one, on every signal the server
+       * has. Measured on production 2026-08-26: one owner device carried the keys
+       * for 19 of the 21 owner leaves on the platform, and one 1:1 group had been
+       * unreadable by its owner's browser for two months while every status column
+       * read healthy.
+       *
+       * `epoch` alone cannot do this job: it is a number the client reports about
+       * itself, it collides across groups, and a client that has lost its state
+       * still remembers one.
+       */
+      get epochAuthenticator() {
+        const s2 = this._requireState();
+        return s2.keySchedule.epochAuthenticator;
+      }
       /** The cipher suite name in use. */
       get ciphersuiteName() {
         return this._ciphersuiteName;
@@ -63902,11 +63957,84 @@ var init_mls_group = __esm2({
         return { commit: commitBytes, welcome: welcomeBytes };
       }
       /**
-       * Remove a member from the group by leaf index.
+       * Admit N members with TWO commits total, replacing any stale leaf they hold.
+       *
+       * `addMembers` cannot do this alone: MLS rejects an Add for an identity
+       * already in the tree, so a member that lost its local state must be removed
+       * first. Doing that pair PER MEMBER is what the fulfiller did, and it is not
+       * merely slow — it is self-defeating.
+       *
+       * Live 2026-08-28 14:02:21-28Z: the owner sweep re-admitted 7 room members
+       * sequentially, each as its own removeMember + addMembers. Room 007 ran
+       * **epoch 71 -> 85 in seven seconds**, and the Welcome minted for member n
+       * named an epoch that member n+1's commit had already replaced — so six of
+       * seven were stale before they finished joining, and one (`smartcode`) could
+       * not replay forward afterwards at all.
+       *
+       * 🎯 A REPAIR THAT MOVES THE EPOCH ONCE PER MEMBER IS RACING ITSELF.
+       *
+       * ⚠️ **Why two commits and not one.** RFC 9420 §12.3 allows Remove and Add in
+       * a single commit, and ts-mls builds it happily — but with MORE THAN ONE of
+       * each, a REMAINING member fails to process it:
        *
-       * @param memberIndex - The leaf index of the member to remove.
-       * @returns The commit message to broadcast.
+       *     OpenError  at applyUpdatePathSecret (ts-mls/src/createCommit.ts:471)
+       *                at updatePrivateKeyPath  (processMessages.ts:397)
+       *
+       * One remove + one add in a single commit is fine; 2+2 is not. That is
+       * pinned by a test in `mls-group.test.ts` so this cannot be "optimised" back
+       * into one commit without the failure showing up first. Two commits still
+       * turns 7 members from 14 epochs into 2, and every joiner lands current.
+       *
+       * @param keyPackages - Fresh KeyPackages, one per member to admit. Members
+       *   already holding a leaf are removed by the first commit; members with no
+       *   leaf are plain adds. Duplicate identities keep the first KeyPackage.
+       * @returns Every commit to broadcast IN ORDER, and the Welcome to deliver to
+       *   EVERY member in the batch (each finds its own secrets inside it).
        */
+      async reAdmitMembers(keyPackages) {
+        this._requireState();
+        await this._ensureCiphersuite();
+        const seenIdentities = [];
+        const toAdd = [];
+        const leavesToRemove = [];
+        for (const kp of keyPackages) {
+          const identity = keyPackageIdentity(kp);
+          if (identity !== null) {
+            if (seenIdentities.some((id) => bytesEqual(id, identity)))
+              continue;
+            seenIdentities.push(identity);
+            const leaf = this.memberLeafIndex(identity);
+            if (leaf !== null)
+              leavesToRemove.push(leaf);
+          }
+          toAdd.push(kp);
+        }
+        if (toAdd.length === 0) {
+          throw new Error("reAdmitMembers: no members to admit");
+        }
+        const commits = [];
+        if (leavesToRemove.length > 0) {
+          const { commit } = await this.removeMembers(leavesToRemove);
+          commits.push({ commit, epoch: this.epoch });
+        }
+        const added = await this.addMembers(toAdd);
+        commits.push({ commit: added.commit, epoch: this.epoch });
+        return { commits, welcome: added.welcome };
+      }
+      async removeMembers(memberIndices) {
+        const s2 = this._requireState();
+        const cs = await this._ensureCiphersuite();
+        if (memberIndices.length === 0) {
+          throw new Error("removeMembers: no members to remove");
+        }
+        const extraProposals = memberIndices.map((removed) => ({
+          proposalType: "remove",
+          remove: { removed }
+        }));
+        const result = await createCommit({ state: s2, cipherSuite: cs, pskIndex: this._pskIndex }, { extraProposals });
+        this.state = result.newState;
+        return { commit: encodeMlsMessage(result.commit) };
+      }
       async removeMember(memberIndex) {
         const s2 = this._requireState();
         const cs = await this._ensureCiphersuite();
@@ -64461,17 +64589,28 @@ var init_mls_kp_pool = __esm2({
   }
 });
 function ownIdentity() {
-  const v2 = true ? "0.23.27" : FALLBACK;
+  const v2 = true ? "0.23.30" : FALLBACK;
   return `${PACKAGE}@${v2}`;
 }
+function buildSha() {
+  const raw = true ? "1fff5d6" : "";
+  const cleaned = (raw ?? "").trim();
+  return !cleaned || cleaned === "unknown" ? null : cleaned;
+}
+function withBuildSha(identity) {
+  const sha = buildSha();
+  if (!sha || identity.includes("+")) return identity;
+  const stamped = `${identity}+${sha}`;
+  return stamped.length <= MAX_LEN ? stamped : identity;
+}
 function buildClientVersion(override) {
   try {
     const candidate = (override ?? "").trim();
     if (candidate) {
-      const cleaned = candidate.replace(DISALLOWED, "").slice(0, MAX_LEN);
+      const cleaned = withBuildSha(candidate.replace(DISALLOWED, "").slice(0, MAX_LEN));
       if (cleaned && !cleaned.includes("..")) return cleaned;
     }
-    return ownIdentity().replace(DISALLOWED, "").slice(0, MAX_LEN);
+    return withBuildSha(ownIdentity().replace(DISALLOWED, "").slice(0, MAX_LEN));
   } catch {
     return FALLBACK;
   }
@@ -65373,6 +65512,7 @@ var SecureChannel;
 var init_channel = __esm2({
   async "src/channel.ts"() {
     "use strict";
+    init_abstention();
     init_mls_commit_classify();
     await init_libsodium_wrappers();
     await init_dist();
@@ -65802,6 +65942,18 @@ var init_channel = __esm2({
       get ownHubAddress() {
         return this._persisted?.hubAddress ?? "";
       }
+      /** This agent's AgentVault hub_id. "" until enrolment persists it.
+       *
+       * Lives in the credential store, NOT in the channel config — which is where
+       * the memory-recall helper was reading it from. `channel.config.hubId` is
+       * unset for every agent enrolled through the normal flow, so
+       * `channel.config.hubId || ""` produced `/api/v1/agents//memory/search`, a
+       * 404 on every inbound message, swallowed by `if (!res.ok) return ""`.
+       * Memory recall was silently dead while the hub_id sat right here.
+       */
+      get ownHubId() {
+        return this._persisted?.hubId ?? "";
+      }
       /** Public best-effort trigger to (re)resolve this agent's display_name.
        * Called lazily from the 1:1 DM path when the name is still unknown, so a
        * resolve that failed at connect (or a fresh agent that hadn't registered
@@ -66190,6 +66342,7 @@ var init_channel = __esm2({
        * Each session gets the same plaintext encrypted independently.
        */
       async send(plaintext, options) {
+        if (isAbstention(plaintext)) return;
         if (this._state === "error" || this._state === "idle") {
           throw new Error("Channel is not ready");
         }
@@ -66518,7 +66671,7 @@ var init_channel = __esm2({
        */
       sendActivitySpan(spanData) {
         if (!this._ws || this._ws.readyState !== WebSocket.OPEN) return;
-        const pluginVersion = true ? "0.23.27" : "0.0.0-dev";
+        const pluginVersion = true ? "0.23.30" : "0.0.0-dev";
         const agentName = this.config.agentName ?? "Agent";
         const resource = {
           "service.name": "agentvault-agent",
@@ -66712,6 +66865,7 @@ var init_channel = __esm2({
        * Uses MLS (preferred) or pairwise fan-out as fallback.
        */
       async sendToRoom(roomId, plaintext, opts) {
+        if (isAbstention(plaintext)) return;
         if (!this._persisted?.rooms?.[roomId]) {
           throw new Error(`Room ${roomId} not found`);
         }
@@ -68455,7 +68609,7 @@ var init_channel = __esm2({
                 agentVersion: this.config.agentVersion ?? "0.0.0",
                 // __AV_VERSION__ is injected by esbuild from package.json at build time.
                 // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                pluginVersion: true ? "0.23.27" : "0.0.0-dev"
+                pluginVersion: true ? "0.23.30" : "0.0.0-dev"
               });
               this._telemetryReporter.startAutoFlush(3e4);
             }
@@ -68779,7 +68933,7 @@ var init_channel = __esm2({
                     agentVersion: this.config.agentVersion ?? "0.0.0",
                     // __AV_VERSION__ is injected by esbuild from package.json at build time.
                     // Falls back to "0.0.0-dev" in non-bundled contexts (tests).
-                    pluginVersion: true ? "0.23.27" : "0.0.0-dev"
+                    pluginVersion: true ? "0.23.30" : "0.0.0-dev"
                   });
                   this._telemetryReporter.startAutoFlush(3e4);
                 }
@@ -72923,6 +73077,58 @@ var init_gateway_send = __esm2({
     init_openclaw_compat();
   }
 });
+function parseMentions(text) {
+  const mentions = [];
+  const re2 = new RegExp(MENTION_RE.source, MENTION_RE.flags);
+  let match;
+  while ((match = re2.exec(text)) !== null) {
+    mentions.push(match[1].toLowerCase());
+  }
+  return mentions;
+}
+function resolveOwn(mention, names) {
+  if (names.has(mention)) return mention;
+  const parts = mention.split("-");
+  for (let i2 = parts.length - 1; i2 > 0; i2--) {
+    const candidate = parts.slice(0, i2).join("-");
+    if (names.has(candidate)) return candidate;
+  }
+  return null;
+}
+function owesRoomReply(plaintext, agentName, accountId, senderIsAgent, roomDisplayName, ownDisplayName, selfResolved = true) {
+  const mentions = parseMentions(plaintext);
+  if (mentions.length === 0) return false;
+  const ownNames = ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName);
+  if (mentions.some((m2) => resolveOwn(m2, ownNames) !== null)) return true;
+  if (mentions.some((m2) => resolveOwn(m2, BROADCAST_NAMES) !== null)) {
+    return senderIsAgent !== true;
+  }
+  if (!selfResolved) return true;
+  return false;
+}
+function ownRoomNames(agentName, accountId, roomDisplayName, ownDisplayName) {
+  const names = /* @__PURE__ */ new Set();
+  const add4 = (n2) => {
+    if (!n2) return;
+    const lower = n2.toLowerCase();
+    names.add(lower);
+    names.add(lower.split(/[\s(]/)[0]);
+  };
+  add4(agentName);
+  add4(accountId);
+  add4(roomDisplayName);
+  add4(ownDisplayName);
+  return names;
+}
+var MENTION_RE;
+var BROADCAST_NAMES;
+var init_room_protocol = __esm2({
+  "src/room-protocol.ts"() {
+    "use strict";
+    MENTION_RE = /@([\w-]+)/gi;
+    BROADCAST_NAMES = /* @__PURE__ */ new Set(["all", "everyone"]);
+  }
+});
 var init_llm_response_parser = __esm2({
   "src/llm-response-parser.ts"() {
     "use strict";
@@ -72956,6 +73162,7 @@ var isUsingManagedRoutes;
 var init_openclaw_entry = __esm2({
   "src/openclaw-entry.ts"() {
     "use strict";
+    init_room_protocol();
     init_account_config();
     init_fetch_interceptor();
     init_http_handlers();
@@ -99014,7 +99221,8 @@ var init_index = __esm2({
     init_skill_invoker();
     await init_skill_telemetry();
     await init_policy_enforcer();
-    VERSION = true ? "0.23.27" : "0.0.0-dev";
+    init_room_protocol();
+    VERSION = true ? "0.23.30" : "0.0.0-dev";
   }
 });
 await init_index();
@@ -99767,9 +99975,32 @@ function roomTurnPrefix(roomId, senderName, roomName) {
   const room = roomName ? `"${roomName}"` : roomId.slice(0, 8);
   return `[room ${room} | ${senderName}]`;
 }
+function _makeOwesReply(agentName, channel, log) {
+  let warnedNoIdentity = false;
+  return (e) => {
+    const own = agentName ?? "";
+    const hub = channel.ownDisplayName ?? "";
+    if (!own && !hub && !warnedNoIdentity) {
+      warnedNoIdentity = true;
+      log(
+        "WARNING: this bridge has no agentName and no hub display_name, so it cannot recognise its own @mention (#1107). It will answer @all and any @-addressed message (fail-open), but targeted replies will be unreliable. Set the agent name in the bridge config."
+      );
+    }
+    return owesRoomReply(
+      e.plaintext,
+      own,
+      own,
+      e.senderIsAgent,
+      void 0,
+      hub,
+      Boolean(own || hub)
+    );
+  };
+}
 function wireBridge(channel, session, target, opts = {}) {
   const log = opts.log ?? (() => {
   });
+  const _owesReply = _makeOwesReply(opts.agentName, channel, log);
   channel.on("error", (err) => {
     const msg = err instanceof Error ? err.message : String(err);
     log(`channel error (non-fatal, not a reconnect trigger): ${msg}`);
@@ -99808,7 +100039,7 @@ function wireBridge(channel, session, target, opts = {}) {
     target.setRoom(e.roomId);
     session.push(`${roomTurnPrefix(e.roomId, e.senderName, roomNames.get(e.roomId))}: ${e.plaintext}`, target.snapshotReply(channel, log), {
       autoReplyOnText: false,
-      replyExpected: e.senderIsAgent === false
+      replyExpected: _owesReply(e)
     });
   });
   channel.on("message", (text, metadata) => {
@@ -99917,7 +100148,7 @@ async function main() {
   const info = parseInfoFlags(process.argv.slice(2));
   if (info.showVersion || info.showHelp) {
     const version2 = buildClientVersion2(
-      true ? "0.4.1" : void 0
+      true ? "0.4.3" : void 0
     );
     if (info.showVersion) printLine(version2);
     if (info.showHelp) {
@@ -99970,7 +100201,7 @@ async function main() {
     agentName: cfg.agentName,
     platform: "node",
     clientVersion: buildClientVersion2(
-      true ? "0.4.1" : void 0
+      true ? "0.4.3" : void 0
     )
   });
   channelRef = channel;
@@ -100050,6 +100281,9 @@ async function main() {
   const target = new ActiveTarget();
   wireBridge(channel, session, target, {
     roomFilter: cfg.roomFilter,
+    // #1107: needed to recognise this agent's own @mention. Without it the
+    // agent can only answer @all.
+    agentName: cfg.agentName,
     log: (m2) => logLine("[grok-bridge] " + m2)
   });
   attachLifecycle2(channel, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentvault/grok-bridge",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "type": "module",
   "description": "AgentVault Grok Bridge — daemon bridging a Grok agent into E2E-encrypted AgentVault direct messages and rooms.",
   "main": "dist/index.js",

package/dist/service/install-on-ready.d.ts

@@ -1,57 +0,0 @@
-import { type BridgeConfig } from "../config.js";
-import type { ReapResult } from "../reap.js";
-import { type ServiceBackend } from "./backend.js";
-export interface InstallOnReadyDeps {
-    entrypoint: string;
-    env: NodeJS.ProcessEnv;
-    backend?: ServiceBackend;
-    hasCreds?: (dataDir: string) => boolean;
-    /** Contents of the installed launcher, or undefined when none is installed. */
-    readLauncher?: (path: string) => string | undefined;
-    fenceAuthExists?: (fenceHome: string) => boolean;
-    /** Resolves when no turn is in flight (GrokSession.idle). See rule 2. */
-    waitForIdle?: () => Promise<void>;
-    /** Bound on that wait. The terminal coming back is the product promise, so a
-     *  wedged turn must never hold the customer's shell open. */
-    idleTimeoutMs?: number;
-    /** The ONE teardown (src/reap.ts). Must complete before launchctl runs. */
-    reap: () => Promise<ReapResult>;
-    exit: (code: number) => void;
-    log: (msg: string) => void;
-}
-interface ReadyChannel {
-    on(ev: "ready", cb: () => void): unknown;
-}
-/**
- * One-paste install: enrol in the foreground, hand off to the supervisor, exit —
- * so the customer's terminal comes back and the agent survives a reboot.
- *
- * Four rules this module exists to enforce.
- *
- * 1. REFUSE BEFORE REAPING. Everything that can say no does so before anything is
- *    torn down. Refusing afterwards leaves the customer with an approved device,
- *    a spent invite token, and no running process — strictly worse than never
- *    having guarded at all.
- *
- * 2. REAP COMPLETELY, THEN BOOTSTRAP. `LaunchdBackend.install` runs bootout →
- *    poll-until-gone → bootstrap → kickstart synchronously, so the service is
- *    live the instant install returns. A partial teardown means two ACP sessions
- *    and two WebSockets on one device. `reap()` reports failure rather than
- *    swallowing it, and a failed reap is a refusal.
- *
- * 3. COMPARE, DON'T DETECT. `status().loaded` means only that a plist with this
- *    label exists. The old `install` subcommand never guarded its entrypoint
- *    (subcommand.ts), so a customer can hold a LOADED plist baked against a
- *    pruned npx cache; restarting that repairs nothing and reports success.
- *    Restart only when a service is loaded AND its baked entrypoint is the one we
- *    would install. Compare the ENTRYPOINT, never the whole launcher script —
- *    that embeds the install-time PATH and is volatile across shells.
- *
- * 4. VERIFY BEFORE CLAIMING. `backend.install` returns void, and launchd's
- *    implementation runs `kickstart` regardless of every `bootstrap` exit code.
- *    This log line is the customer's only feedback, so it comes after a
- *    `status()` that returned loaded:true.
- */
-export declare function installOnReady(channel: ReadyChannel, cfg: BridgeConfig, deps: InstallOnReadyDeps): void;
-export {};
-//# sourceMappingURL=install-on-ready.d.ts.map

package/dist/service/install-on-ready.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"install-on-ready.d.ts","sourceRoot":"","sources":["../../src/service/install-on-ready.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4C,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAG7C,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACxC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;IACpD,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC;iEAC6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5B;AAMD,UAAU,YAAY;IACpB,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,kBAAkB,GACvB,IAAI,CAgHN"}