@askexenow/exe-os 0.9.30 → 0.9.32

package/dist/hooks/session-end.js

@@ -1621,8 +1621,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync10 } = __require("child_process");
-      const vmstat = execSync10("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync11 } = __require("child_process");
+      const vmstat = execSync11("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -6722,6 +6722,7 @@ var init_task_scope = __esm({
 // src/lib/keychain.ts
 import { readFile as readFile4, writeFile as writeFile5, unlink, mkdir as mkdir4, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync16 } from "fs";
+import { execSync as execSync8 } from "child_process";
 import path20 from "path";
 import os12 from "os";
 function getKeyDir() {
@@ -6730,6 +6731,59 @@ function getKeyDir() {
 function getKeyPath() {
   return path20.join(getKeyDir(), "master.key");
 }
+function macKeychainGet() {
+  if (process.platform !== "darwin") return null;
+  try {
+    return execSync8(
+      `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function macKeychainSet(value) {
+  if (process.platform !== "darwin") return false;
+  try {
+    try {
+      execSync8(
+        `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+        { timeout: 5e3 }
+      );
+    } catch {
+    }
+    execSync8(
+      `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretGet() {
+  if (process.platform !== "linux") return null;
+  try {
+    return execSync8(
+      `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function linuxSecretSet(value) {
+  if (process.platform !== "linux") return false;
+  try {
+    execSync8(
+      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function tryKeytar() {
   try {
     return await import("keytar");
@@ -6737,13 +6791,63 @@ async function tryKeytar() {
     return null;
   }
 }
+function deriveMachineKey() {
+  try {
+    const crypto7 = __require("crypto");
+    const material = [
+      os12.hostname(),
+      os12.userInfo().username,
+      os12.arch(),
+      os12.platform(),
+      // Machine ID on Linux (stable across reboots)
+      process.platform === "linux" ? readMachineId() : ""
+    ].join("|");
+    return crypto7.createHash("sha256").update(material).digest();
+  } catch {
+    return null;
+  }
+}
+function readMachineId() {
+  try {
+    const { readFileSync: readFileSync16 } = __require("fs");
+    return readFileSync16("/etc/machine-id", "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function decryptWithMachineKey(encrypted, machineKey) {
+  if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
+  try {
+    const crypto7 = __require("crypto");
+    const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
+    if (parts.length !== 3) return null;
+    const [ivB64, tagB64, cipherB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const authTag = Buffer.from(tagB64, "base64");
+    const decipher = crypto7.createDecipheriv("aes-256-gcm", machineKey, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(cipherB64, "base64", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return decrypted;
+  } catch {
+    return null;
+  }
+}
 async function getMasterKey() {
+  const nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (nativeValue) {
+    return Buffer.from(nativeValue, "base64");
+  }
   const keytar = await tryKeytar();
   if (keytar) {
     try {
-      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (stored) {
-        return Buffer.from(stored, "base64");
+      const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (keytarValue) {
+        const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
+        if (migrated) {
+          process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+        }
+        return Buffer.from(keytarValue, "base64");
       }
     } catch {
     }
@@ -6757,8 +6861,31 @@ async function getMasterKey() {
     return null;
   }
   try {
-    const content = await readFile4(keyPath, "utf-8");
-    return Buffer.from(content.trim(), "base64");
+    const content = (await readFile4(keyPath, "utf-8")).trim();
+    let b64Value;
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      const machineKey = deriveMachineKey();
+      if (!machineKey) {
+        process.stderr.write("[keychain] Cannot derive machine key to decrypt stored key.\n");
+        return null;
+      }
+      const decrypted = decryptWithMachineKey(content, machineKey);
+      if (!decrypted) {
+        process.stderr.write(
+          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase: exe-os link import\n"
+        );
+        return null;
+      }
+      b64Value = decrypted;
+    } else {
+      b64Value = content;
+    }
+    const key = Buffer.from(b64Value, "base64");
+    const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
+    if (migrated) {
+      process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
+    }
+    return key;
   } catch (err) {
     process.stderr.write(
       `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
@@ -6767,12 +6894,13 @@ async function getMasterKey() {
     return null;
   }
 }
-var SERVICE, ACCOUNT;
+var SERVICE, ACCOUNT, ENCRYPTED_PREFIX;
 var init_keychain = __esm({
   "src/lib/keychain.ts"() {
     "use strict";
     SERVICE = "exe-mem";
     ACCOUNT = "master-key";
+    ENCRYPTED_PREFIX = "enc:";
   }
 });
 
@@ -8099,11 +8227,11 @@ __export(git_staleness_exports, {
   detectStaleFiles: () => detectStaleFiles,
   recordFileRead: () => recordFileRead
 });
-import { execSync as execSync8 } from "child_process";
+import { execSync as execSync9 } from "child_process";
 import path23 from "path";
 function getHeadCommit(cwd) {
   try {
-    return execSync8("git rev-parse --short HEAD", {
+    return execSync9("git rev-parse --short HEAD", {
       cwd,
       timeout: GIT_TIMEOUT_MS,
       encoding: "utf-8"
@@ -8166,7 +8294,7 @@ async function detectStaleFiles(agentId, cwd) {
     const readAt = String(record.read_at ?? "");
     if (!filePath || !readAt) continue;
     try {
-      const gitSummary = execSync8(
+      const gitSummary = execSync9(
         `git log -1 --oneline --after=${JSON.stringify(readAt)} --format="%h %an: %s" -- ${JSON.stringify(filePath)}`,
         {
           cwd,
@@ -8210,7 +8338,7 @@ __export(git_task_sweep_exports, {
   matchScore: () => matchScore,
   sweepTasks: () => sweepTasks
 });
-import { execSync as execSync9 } from "child_process";
+import { execSync as execSync10 } from "child_process";
 function extractKeywords(text) {
   return text.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").split(/\s+/).filter((w) => w.length >= 3 && !STOP_WORDS.has(w));
 }
@@ -8239,7 +8367,7 @@ function matchScore(task, commitMessage, changedFiles) {
 function getRecentCommits(limit = DEFAULT_COMMIT_LIMIT) {
   try {
     const SEPARATOR = "<<SEP>>";
-    const output = execSync9(
+    const output = execSync10(
       `git log --format="%h${SEPARATOR}%s${SEPARATOR}%aI" --name-only -n ${limit} -z`,
       { encoding: "utf8", timeout: 1e4 }
     );

package/dist/hooks/session-start.js

@@ -1439,8 +1439,8 @@ function findPackageRoot() {
 function getAvailableMemoryGB() {
   if (process.platform === "darwin") {
     try {
-      const { execSync: execSync9 } = __require("child_process");
-      const vmstat = execSync9("vm_stat", { encoding: "utf8" });
+      const { execSync: execSync10 } = __require("child_process");
+      const vmstat = execSync10("vm_stat", { encoding: "utf8" });
       const pageSize = 16384;
       const pageSizeMatch = vmstat.match(/page size of (\d+) bytes/);
       const actualPageSize = pageSizeMatch ? parseInt(pageSizeMatch[1], 10) : pageSize;
@@ -3179,6 +3179,7 @@ var init_database = __esm({
 // src/lib/keychain.ts
 import { readFile as readFile3, writeFile as writeFile3, unlink, mkdir as mkdir3, chmod as chmod2 } from "fs/promises";
 import { existsSync as existsSync7 } from "fs";
+import { execSync as execSync2 } from "child_process";
 import path7 from "path";
 import os5 from "os";
 function getKeyDir() {
@@ -3187,6 +3188,59 @@ function getKeyDir() {
 function getKeyPath() {
   return path7.join(getKeyDir(), "master.key");
 }
+function macKeychainGet() {
+  if (process.platform !== "darwin") return null;
+  try {
+    return execSync2(
+      `security find-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function macKeychainSet(value) {
+  if (process.platform !== "darwin") return false;
+  try {
+    try {
+      execSync2(
+        `security delete-generic-password -s "${SERVICE}" -a "${ACCOUNT}" 2>/dev/null`,
+        { timeout: 5e3 }
+      );
+    } catch {
+    }
+    execSync2(
+      `security add-generic-password -s "${SERVICE}" -a "${ACCOUNT}" -w "${value}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretGet() {
+  if (process.platform !== "linux") return null;
+  try {
+    return execSync2(
+      `secret-tool lookup service "${SERVICE}" account "${ACCOUNT}" 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function linuxSecretSet(value) {
+  if (process.platform !== "linux") return false;
+  try {
+    execSync2(
+      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${SERVICE}" account "${ACCOUNT}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function tryKeytar() {
   try {
     return await import("keytar");
@@ -3194,13 +3248,63 @@ async function tryKeytar() {
     return null;
   }
 }
+function deriveMachineKey() {
+  try {
+    const crypto3 = __require("crypto");
+    const material = [
+      os5.hostname(),
+      os5.userInfo().username,
+      os5.arch(),
+      os5.platform(),
+      // Machine ID on Linux (stable across reboots)
+      process.platform === "linux" ? readMachineId() : ""
+    ].join("|");
+    return crypto3.createHash("sha256").update(material).digest();
+  } catch {
+    return null;
+  }
+}
+function readMachineId() {
+  try {
+    const { readFileSync: readFileSync13 } = __require("fs");
+    return readFileSync13("/etc/machine-id", "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function decryptWithMachineKey(encrypted, machineKey) {
+  if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
+  try {
+    const crypto3 = __require("crypto");
+    const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
+    if (parts.length !== 3) return null;
+    const [ivB64, tagB64, cipherB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const authTag = Buffer.from(tagB64, "base64");
+    const decipher = crypto3.createDecipheriv("aes-256-gcm", machineKey, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(cipherB64, "base64", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return decrypted;
+  } catch {
+    return null;
+  }
+}
 async function getMasterKey() {
+  const nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (nativeValue) {
+    return Buffer.from(nativeValue, "base64");
+  }
   const keytar = await tryKeytar();
   if (keytar) {
     try {
-      const stored = await keytar.getPassword(SERVICE, ACCOUNT);
-      if (stored) {
-        return Buffer.from(stored, "base64");
+      const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
+      if (keytarValue) {
+        const migrated = macKeychainSet(keytarValue) || linuxSecretSet(keytarValue);
+        if (migrated) {
+          process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+        }
+        return Buffer.from(keytarValue, "base64");
       }
     } catch {
     }
@@ -3214,8 +3318,31 @@ async function getMasterKey() {
     return null;
   }
   try {
-    const content = await readFile3(keyPath, "utf-8");
-    return Buffer.from(content.trim(), "base64");
+    const content = (await readFile3(keyPath, "utf-8")).trim();
+    let b64Value;
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      const machineKey = deriveMachineKey();
+      if (!machineKey) {
+        process.stderr.write("[keychain] Cannot derive machine key to decrypt stored key.\n");
+        return null;
+      }
+      const decrypted = decryptWithMachineKey(content, machineKey);
+      if (!decrypted) {
+        process.stderr.write(
+          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase: exe-os link import\n"
+        );
+        return null;
+      }
+      b64Value = decrypted;
+    } else {
+      b64Value = content;
+    }
+    const key = Buffer.from(b64Value, "base64");
+    const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
+    if (migrated) {
+      process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
+    }
+    return key;
   } catch (err) {
     process.stderr.write(
       `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
@@ -3224,12 +3351,13 @@ async function getMasterKey() {
     return null;
   }
 }
-var SERVICE, ACCOUNT;
+var SERVICE, ACCOUNT, ENCRYPTED_PREFIX;
 var init_keychain = __esm({
   "src/lib/keychain.ts"() {
     "use strict";
     SERVICE = "exe-mem";
     ACCOUNT = "master-key";
+    ENCRYPTED_PREFIX = "enc:";
   }
 });
 
@@ -4752,7 +4880,7 @@ __export(project_name_exports, {
   _resetCache: () => _resetCache,
   getProjectName: () => getProjectName
 });
-import { execSync as execSync2 } from "child_process";
+import { execSync as execSync3 } from "child_process";
 import path10 from "path";
 function getProjectName(cwd) {
   const dir = cwd ?? process.cwd();
@@ -4760,7 +4888,7 @@ function getProjectName(cwd) {
   try {
     let repoRoot;
     try {
-      const gitCommonDir = execSync2("git rev-parse --path-format=absolute --git-common-dir", {
+      const gitCommonDir = execSync3("git rev-parse --path-format=absolute --git-common-dir", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -4768,7 +4896,7 @@ function getProjectName(cwd) {
       }).trim();
       repoRoot = path10.dirname(gitCommonDir);
     } catch {
-      repoRoot = execSync2("git rev-parse --show-toplevel", {
+      repoRoot = execSync3("git rev-parse --show-toplevel", {
         cwd: dir,
         encoding: "utf8",
         timeout: 2e3,
@@ -4802,14 +4930,14 @@ var file_grep_exports = {};
 __export(file_grep_exports, {
   grepProjectFiles: () => grepProjectFiles
 });
-import { execSync as execSync3 } from "child_process";
+import { execSync as execSync4 } from "child_process";
 import { readFileSync as readFileSync6, readdirSync as readdirSync2, statSync as statSync2, existsSync as existsSync10 } from "fs";
 import path11 from "path";
 import crypto2 from "crypto";
 function hasRipgrep() {
   if (_hasRg === null) {
     try {
-      execSync3("rg --version", { stdio: "ignore", timeout: 2e3 });
+      execSync4("rg --version", { stdio: "ignore", timeout: 2e3 });
       _hasRg = true;
     } catch {
       _hasRg = false;
@@ -4875,7 +5003,7 @@ function grepWithRipgrep(pattern, projectRoot, patterns) {
   const globs = (patterns ?? DEFAULT_PATTERNS).map((p) => `--glob '${p}'`).join(" ");
   const excludes = EXCLUDE_DIRS.map((d) => `--glob '!${d}'`).join(" ");
   const cmd = `rg -i -c --hidden --no-config --no-ignore '${pattern.replace(/'/g, "\\'")}' . ${globs} ${excludes} --max-filesize ${MAX_FILE_SIZE} 2>/dev/null || true`;
-  const output = execSync3(cmd, {
+  const output = execSync4(cmd, {
     cwd: projectRoot,
     encoding: "utf8",
     timeout: 3e3,
@@ -4890,12 +5018,12 @@ function grepWithRipgrep(pattern, projectRoot, patterns) {
     const matchCount = parseInt(line.slice(colonIdx + 1));
     if (isNaN(matchCount) || matchCount === 0) continue;
     try {
-      const firstMatch = execSync3(
+      const firstMatch = execSync4(
         `rg -i -n --hidden '${pattern.replace(/'/g, "\\'")}' '${filePath}' --max-count 1 2>/dev/null | head -1`,
         { cwd: projectRoot, encoding: "utf8", timeout: 1e3 }
       ).trim();
       const lineNum = parseInt(firstMatch.split(":")[0] ?? "1");
-      const totalLines = execSync3(`wc -l < '${filePath}'`, {
+      const totalLines = execSync4(`wc -l < '${filePath}'`, {
         cwd: projectRoot,
         encoding: "utf8",
         timeout: 1e3
@@ -5524,10 +5652,17 @@ async function applyEntityBoost(results, query, client) {
   if (ENTITY_BOOST_WEIGHT === 0 || results.length === 0) {
     return emptyResult;
   }
-  console.time("entity-boost");
+  const debugStart = process.env.EXE_DEBUG_HOOKS ? performance.now() : 0;
+  const debugEnd = () => {
+    if (!process.env.EXE_DEBUG_HOOKS) return;
+    process.stderr.write(
+      `[entity-boost] ${(performance.now() - debugStart).toFixed(3)}ms
+`
+    );
+  };
   const entities = await matchEntities(query, client);
   if (entities.length === 0) {
-    console.timeEnd("entity-boost");
+    debugEnd();
     return emptyResult;
   }
   const boostMap = /* @__PURE__ */ new Map();
@@ -5549,7 +5684,7 @@ async function applyEntityBoost(results, query, client) {
   await traverseAndScore(entities, client, boostMap, resultIds, graphContextMap);
   await applyHyperedgeBoost(entities, client, boostMap, resultIds);
   if (boostMap.size === 0) {
-    console.timeEnd("entity-boost");
+    debugEnd();
     return emptyResult;
   }
   const scored = results.map((r, i) => ({
@@ -5560,7 +5695,7 @@ async function applyEntityBoost(results, query, client) {
   scored.sort(
     (a, b) => b.baseScore + b.entityBoost - (a.baseScore + a.entityBoost)
   );
-  console.timeEnd("entity-boost");
+  debugEnd();
   return {
     results: scored.map((s) => s.record),
     graphContext: graphContextMap
@@ -6205,7 +6340,7 @@ var init_hybrid_search = __esm({
 });
 
 // src/lib/session-key.ts
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 function normalizeCommand(command) {
   const trimmed = command.trim().toLowerCase();
   const parts = trimmed.split(/[\\/]/);
@@ -6224,7 +6359,7 @@ function resolveRuntimeProcess() {
   let pid = process.ppid;
   for (let i = 0; i < 10; i++) {
     try {
-      const info = execSync4(`ps -p ${pid} -o ppid=,comm=`, {
+      const info = execSync5(`ps -p ${pid} -o ppid=,comm=`, {
         encoding: "utf8",
         timeout: 2e3
       }).trim();
@@ -6274,7 +6409,7 @@ var init_session_key = __esm({
 
 // src/lib/active-agent.ts
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, unlinkSync as unlinkSync3, readdirSync as readdirSync3 } from "fs";
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 import path12 from "path";
 function isNameWithOptionalInstance(candidate, baseName) {
   if (candidate === baseName) return true;
@@ -6366,7 +6501,7 @@ function getActiveAgent() {
   } catch {
   }
   try {
-    const sessionName = execSync5(
+    const sessionName = execSync6(
       "tmux display-message -p '#{session_name}' 2>/dev/null",
       { encoding: "utf8", timeout: 2e3 }
     ).trim();
@@ -6584,7 +6719,7 @@ var init_transport = __esm({
 });
 
 // src/lib/cc-agent-support.ts
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 var init_cc_agent_support = __esm({
   "src/lib/cc-agent-support.ts"() {
     "use strict";
@@ -6843,7 +6978,7 @@ var catchup_brief_exports = {};
 __export(catchup_brief_exports, {
   buildCatchupBrief: () => buildCatchupBrief
 });
-import { execSync as execSync7 } from "child_process";
+import { execSync as execSync8 } from "child_process";
 function clipText(text, maxChars) {
   if (text.length <= maxChars) return text;
   if (maxChars <= 1) return "\u2026";
@@ -6889,7 +7024,7 @@ ${clipText(checkpoint.raw_text, MAX_CHECKPOINT_CHARS)}`
   } catch {
   }
   try {
-    const gitLog = execSync7(
+    const gitLog = execSync8(
       `git log --oneline --since=${JSON.stringify(lastTimestamp)} --format="%h %an: %s" | head -10`,
       { cwd, timeout: 3e3, encoding: "utf-8" }
     ).trim();
@@ -6967,11 +7102,11 @@ __export(git_staleness_exports, {
   detectStaleFiles: () => detectStaleFiles,
   recordFileRead: () => recordFileRead
 });
-import { execSync as execSync8 } from "child_process";
+import { execSync as execSync9 } from "child_process";
 import path18 from "path";
 function getHeadCommit(cwd) {
   try {
-    return execSync8("git rev-parse --short HEAD", {
+    return execSync9("git rev-parse --short HEAD", {
       cwd,
       timeout: GIT_TIMEOUT_MS,
       encoding: "utf-8"
@@ -7034,7 +7169,7 @@ async function detectStaleFiles(agentId, cwd) {
     const readAt = String(record.read_at ?? "");
     if (!filePath || !readAt) continue;
     try {
-      const gitSummary = execSync8(
+      const gitSummary = execSync9(
         `git log -1 --oneline --after=${JSON.stringify(readAt)} --format="%h %an: %s" -- ${JSON.stringify(filePath)}`,
         {
           cwd,