@codyswann/lisa 4.71.6 → 4.71.8

package/all/copy-overwrite/scripts/lib/automation-provenance-files.mjs

@@ -0,0 +1,49 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Descriptor-backed readers reject aliases and growth before proof bytes gain authority. */
+import {
+  constants,
+  closeSync,
+  fstatSync,
+  lstatSync,
+  openSync,
+  readSync,
+} from "node:fs";
+import { requireProof } from "./github-attestation-verifier.mjs";
+
+/** Only native ENOENT establishes absence; dangling aliases and query errors refuse. */
+export function fileAbsent(file) {
+  try {
+    lstatSync(file);
+    return false;
+  } catch (error) {
+    if (error.code === "ENOENT") return true;
+    throw error;
+  }
+}
+
+/** Refuse aliases and oversize files; snapshots remain private, regular files. */
+export function privateBytes(file, maximum, privateFile = true) {
+  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = fstatSync(fd);
+    requireProof(
+      stat.isFile() &&
+        stat.size <= maximum &&
+        (!privateFile || (stat.mode & 0o077) === 0),
+      "invalid regular bounded proof file"
+    );
+    const bytes = Buffer.alloc(maximum + 1);
+    let count = 0;
+    while (count < bytes.length) {
+      const added = readSync(fd, bytes, count, bytes.length - count, null);
+      if (added === 0) break;
+      count += added;
+    }
+    requireProof(count <= maximum, "proof file grew beyond limit");
+    return bytes.subarray(0, count);
+  } finally {
+    closeSync(fd);
+  }
+}

package/all/copy-overwrite/scripts/lib/automation-provenance-local.mjs

@@ -2,14 +2,9 @@
 // Do not edit directly — durable changes belong upstream in Lisa.
 
 /** Local proof snapshots and the genuine canonical resolver preserve exact final-read authority. */
-import {
-  constants,
-  closeSync,
-  fstatSync,
-  lstatSync,
-  openSync,
-  readSync,
-} from "node:fs";
+import { lstatSync } from "node:fs";
+import { fileAbsent, privateBytes } from "./automation-provenance-files.mjs";
+export { privateBytes } from "./automation-provenance-files.mjs";
 import { dirname, resolve } from "node:path";
 import { TextDecoder } from "node:util";
 import { resolveWorkItemContext, run } from "../lisa-work-item.mjs";
@@ -18,37 +13,13 @@ import { boundedSpawnSync } from "./bounded-spawn.mjs";
 import {
   canonicalJson,
   exactKeys,
-  FILES,
+  proposalFileNames,
+  optionalLockFields,
   DESCRIPTOR_KEYS,
   HEX,
   OBJECT_ID,
 } from "./automation-provenance-contract.mjs";
 
-/** Refuse aliases and oversize files; snapshots remain private, regular files. */
-export function privateBytes(file, maximum, privateFile = true) {
-  const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
-  try {
-    const stat = fstatSync(fd);
-    requireProof(
-      stat.isFile() &&
-        stat.size <= maximum &&
-        (!privateFile || (stat.mode & 0o077) === 0),
-      "invalid regular bounded proof file"
-    );
-    const bytes = Buffer.alloc(maximum + 1);
-    let count = 0;
-    while (count < bytes.length) {
-      const added = readSync(fd, bytes, count, bytes.length - count, null);
-      if (added === 0) break;
-      count += added;
-    }
-    requireProof(count <= maximum, "proof file grew beyond limit");
-    return bytes.subarray(0, count);
-  } finally {
-    closeSync(fd);
-  }
-}
-
 /** Git reads always use the actual checkout and bounded shared runner. */
 export function git(args) {
   return run("git", args, {
@@ -59,7 +30,7 @@ export function git(args) {
 
 /** Alias and exact staged-blob checks run after descriptor metadata validation. */
 function stagedFiles(descriptor) {
-  for (const file of FILES) {
+  for (const file of proposalFileNames(descriptor)) {
     const entry = git(["ls-files", "--stage", "--", file]);
     requireProof(
       entry.startsWith("100644 ") && entry.split("\n").length === 1,
@@ -76,6 +47,47 @@ function stagedFiles(descriptor) {
   }
 }
 
+/** Bind optional lock presence to HEAD and refuse aliased working-tree counterparts. */
+function originalBun(descriptor) {
+  const original = git(["ls-tree", "HEAD", "--", "bun.lock"]);
+  if (!Object.hasOwn(descriptor, "bunLockSha256")) {
+    requireProof(original === "", "original Bun lock omitted from descriptor");
+    requireProof(
+      fileAbsent(resolve("bun.lock")),
+      "unexpected working Bun lock"
+    );
+    return;
+  }
+  requireProof(
+    /^100644 blob [a-f0-9]{40}\tbun\.lock$/.test(original),
+    "original Bun lock is not regular"
+  );
+  const bytes = run("git", ["show", "HEAD:bun.lock"], {
+    timeout: 30_000,
+    maxBuffer: 1_048_576,
+  }).stdout;
+  requireProof(
+    sha256(bytes) === descriptor.bunLockSha256,
+    "original Bun lock digest differs"
+  );
+  const path = resolve("bun.lock");
+  const before = lstatSync(path);
+  requireProof(
+    before.isFile() && before.nlink === 1,
+    "Bun lock path is aliased"
+  );
+  const current = privateBytes(path, 1_048_576, false);
+  const after = lstatSync(path);
+  requireProof(
+    after.isFile() &&
+      after.nlink === 1 &&
+      before.dev === after.dev &&
+      before.ino === after.ino &&
+      sha256(current) === descriptor.files["bun.lock"],
+    "working Bun lock identity differs"
+  );
+}
+
 /** Match complete message and Git metadata before any network/proof acceptance. */
 export function localDescriptor(descriptor, messageBytes, reference, policy) {
   // Parsing never supplies the signed digest. Reject malformed UTF8 only on
@@ -84,7 +96,11 @@ export function localDescriptor(descriptor, messageBytes, reference, policy) {
     fatal: true,
     ignoreBOM: true,
   }).decode(messageBytes);
-  exactKeys(descriptor, DESCRIPTOR_KEYS, "descriptor");
+  exactKeys(
+    descriptor,
+    [...DESCRIPTOR_KEYS, ...optionalLockFields(descriptor)],
+    "descriptor"
+  );
   requireProof(
     descriptor.version === 1 &&
       descriptor.runId === reference.runId &&
@@ -139,10 +155,10 @@ export function localDescriptor(descriptor, messageBytes, reference, policy) {
     .split("\n")
     .sort();
   requireProof(
-    changed.join("\n") === FILES.join("\n"),
+    changed.join("\n") === proposalFileNames(descriptor).join("\n"),
     "proposal changes foreign files"
   );
-  exactKeys(descriptor.files, FILES, "proposal files");
+  originalBun(descriptor);
   stagedFiles(descriptor);
 }
 

package/all/copy-overwrite/scripts/lib/npm-update-allocate.mjs

@@ -2,7 +2,12 @@
 // Do not edit directly — durable changes belong upstream in Lisa.
 
 /** Fixed-schema writer evidence and idempotent current claim. @module npm-updater */
-import { required, CLAIM, validateProposal } from "./npm-update-contract.mjs";
+import {
+  required,
+  CLAIM,
+  validateProposal,
+  proposalFileNames,
+} from "./npm-update-contract.mjs";
 import { baseline } from "./npm-update-prepare.mjs";
 import { locateCheckpoint } from "./npm-update-recovery.mjs";
 import { runProcess } from "./npm-update-process.mjs";
@@ -45,6 +50,7 @@ export async function filingEvidence(api, proposal, config, cwd) {
       "--",
       "package.json",
       "package-lock.json",
+      ...(Object.hasOwn(proposal, "bunLockSha256") ? ["bun.lock"] : []),
     ],
     {
       cwd,
@@ -63,7 +69,7 @@ export async function filingEvidence(api, proposal, config, cwd) {
   );
   return {
     history: {
-      command: `git log ${proposal.parent} --max-count=20 -- package.json package-lock.json`,
+      command: `git log ${proposal.parent} --max-count=20 -- package.json package-lock.json${proposalFileNames(proposal).includes("bun.lock") ? " bun.lock" : ""}`,
       result: history.stdout.toString() || "No matching history.",
     },
     search: { query, total: search.total_count },

package/all/copy-overwrite/scripts/lib/npm-update-bun.mjs

@@ -0,0 +1,189 @@
+// This file is managed by Lisa and IS replaced on each `lisa` run.
+// Do not edit directly — durable changes belong upstream in Lisa.
+
+/** Optional Bun coherence uses a pinned native tool and the original committed lock. */
+import { existsSync, lstatSync, realpathSync, readFileSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { required } from "./npm-update-invariants.mjs";
+import { sha256 } from "./github-attestation-verifier.mjs";
+import { runProcess, readBytes } from "./npm-update-process-core.mjs";
+import { binaryDigest } from "./npm-update-worker-lifecycle.mjs";
+import { canonicalJson } from "./automation-provenance-contract.mjs";
+
+/** An untracked, removed, aliased or changed original lock never becomes authority. */
+export async function committedBun(cwd, command, proposal) {
+  const entry = (
+    await command(["ls-tree", "HEAD", "--", "bun.lock"])
+  ).stdout.toString();
+  const path = join(cwd, "bun.lock");
+  if (!entry) {
+    required(!existsSync(path), "unexpected Bun lock path");
+    try {
+      lstatSync(path);
+      required(false, "unexpected Bun lock alias");
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    required(
+      !proposal || !Object.hasOwn(proposal, "bunLockSha256"),
+      "original Bun lock was removed"
+    );
+    return undefined;
+  }
+  required(
+    /^100644 blob [a-f0-9]{40}\tbun\.lock\n$/.test(entry),
+    "regular committed Bun lock required"
+  );
+  const stat = lstatSync(path);
+  required(
+    stat.isFile() &&
+      !stat.isSymbolicLink() &&
+      stat.nlink === 1 &&
+      realpathSync(path) === path,
+    "Bun lock path is aliased"
+  );
+  const bytes = (await command(["show", "HEAD:bun.lock"])).stdout;
+  const digest = sha256(bytes);
+  required(
+    proposal
+      ? proposal.bunLockSha256 === digest
+      : readBytes(path, 1_048_576, false).equals(bytes),
+    "original Bun lock bytes differ"
+  );
+  return bytes.toString("utf8");
+}
+
+/** Recheck the same regular executable identity and bytes around every native call. */
+function toolIdentity(path) {
+  const stat = lstatSync(path);
+  required(
+    isAbsolute(path) &&
+      stat.isFile() &&
+      !stat.isSymbolicLink() &&
+      stat.nlink === 1 &&
+      realpathSync(path) === path,
+    "Bun executable is aliased"
+  );
+  return `${stat.dev}:${stat.ino}:${stat.uid}:${stat.mode}:${binaryDigest(path)}`;
+}
+
+/** Only the original trusted PATH may select a supported native Bun installation. */
+export async function qualifiedBun(env, { executable, deadline } = {}) {
+  const path =
+    executable ??
+    (env.PATH ?? "")
+      .split(":")
+      .filter(isAbsolute)
+      .map(directory => join(directory, "bun"))
+      .find(existsSync);
+  required(typeof path === "string", "native Bun is unavailable");
+  const absolute = resolve(path);
+  const identity = toolIdentity(absolute);
+  const invoke = async (args, options = {}) => {
+    required(
+      toolIdentity(absolute) === identity,
+      "Bun executable identity changed"
+    );
+    const timeout = Math.min(
+      options.timeout ?? 120_000,
+      120_000,
+      deadline === undefined ? 120_000 : deadline - Date.now()
+    );
+    required(
+      Number.isSafeInteger(timeout) && timeout > 0,
+      "original Bun operation deadline expired"
+    );
+    const result = await runProcess(absolute, args, {
+      ...options,
+      env: { ...env, BUN_FEATURE_FLAG_DISABLE_NATIVE_DEPENDENCY_LINKER: "1" },
+      timeout,
+    });
+    required(
+      toolIdentity(absolute) === identity,
+      "Bun executable changed during execution"
+    );
+    return result;
+  };
+  const version = await invoke(["--version"]);
+  required(
+    version.stdout.toString() === "1.3.8\n" && !version.stderr.length,
+    "Bun1.3.8 is required"
+  );
+  return invoke;
+}
+
+/** Native JSONC parsing is data-only; every Bun package must match a public npm lock identity. */
+export async function verifyBunLock(bun, app, options = {}) {
+  const text = readBytes(join(app, "bun.lock"), 1_048_576, false);
+  const parsed = await bun(
+    [
+      "--eval",
+      "process.stdout.write(JSON.stringify(Bun.JSONC.parse(await Bun.stdin.text())))",
+    ],
+    { ...options, cwd: app, input: text, maximum: 1_048_576 }
+  );
+  const value = JSON.parse(parsed.stdout.toString());
+  const manifest = JSON.parse(readFileSync(join(app, "package.json"), "utf8"));
+  const npm = JSON.parse(readFileSync(join(app, "package-lock.json"), "utf8"));
+  required(
+    value.lockfileVersion === 1 &&
+      Object.keys(value.workspaces ?? {}).join() === "" &&
+      value.workspaces?.[""]?.name === manifest.name,
+    "unsupported Bun root lock"
+  );
+  for (const section of [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies",
+  ])
+    required(
+      canonicalJson(value.workspaces[""][section] ?? {}) ===
+        canonicalJson(manifest[section] ?? {}),
+      "Bun root selections differ"
+    );
+  required(
+    value.packages &&
+      typeof value.packages === "object" &&
+      !Array.isArray(value.packages),
+    "Bun packages are absent"
+  );
+  const nodes = Object.entries(npm.packages).filter(([name]) => name !== "");
+  for (const row of Object.values(value.packages)) {
+    required(
+      Array.isArray(row) && row.length === 4 && typeof row[0] === "string",
+      "unsupported Bun package record"
+    );
+    const matching = nodes.some(
+      ([path, node]) =>
+        row[0] === `${path.split("node_modules/").at(-1)}@${node.version}` &&
+        row[3] === node.integrity &&
+        (row[1] === "" || row[1] === node.resolved)
+    );
+    required(matching, "Bun package identity differs from public npm lock");
+  }
+}
+
+/** Frozen native installation must preserve every prepared manifest and lock byte. */
+export async function frozenBun(bun, app, files, options = {}) {
+  await verifyBunLock(bun, app, options);
+  const before = files.map(file =>
+    readBytes(join(app, file), 1_048_576, false)
+  );
+  await bun(
+    [
+      "install",
+      "--frozen-lockfile",
+      "--ignore-scripts",
+      "--registry",
+      "https://registry.npmjs.org/",
+    ],
+    { ...options, cwd: app }
+  );
+  required(
+    files.every((file, index) =>
+      readBytes(join(app, file), 1_048_576, false).equals(before[index])
+    ),
+    "frozen Bun rewrote manifest or lock"
+  );
+}

package/all/copy-overwrite/scripts/lib/npm-update-cancel-origin.mjs

@@ -28,7 +28,10 @@ import {
 import { sha256 } from "./github-attestation-verifier.mjs";
 import { verifyStaleOriginProvider } from "./github-attestation-provider.mjs";
 import { verifyHistoricalDescriptor } from "./github-attestation-recovery.mjs";
-import { DESCRIPTOR_KEYS } from "./automation-provenance-contract.mjs";
+import {
+  DESCRIPTOR_KEYS,
+  optionalLockFields,
+} from "./automation-provenance-contract.mjs";
 
 /** Only complete, digest-checked transport is considered; incomplete chunks grant nothing. */
 export function completeCheckpoints(comments) {
@@ -168,11 +171,11 @@ async function inspectOrigin(api, issue, payload, oldConfig, currentConfig) {
 }
 
 /** Descriptor fields preserve the complete original immutable proposal and claim. */
-function originalDescriptor(checkpoint, old, allocation, authority) {
+export function originalDescriptor(checkpoint, old, allocation, authority) {
   const preview = checkpoint.payload.preview;
   keys(preview, ["descriptor", "message", "epoch"]);
   const d = preview.descriptor;
-  keys(d, DESCRIPTOR_KEYS);
+  keys(d, [...DESCRIPTOR_KEYS, ...optionalLockFields(old)]);
   required(
     d.version === 1 &&
       d.parent === old.parent &&
@@ -183,6 +186,7 @@ function originalDescriptor(checkpoint, old, allocation, authority) {
       d.proposalKey === old.bindingKey &&
       d.policySha256 === sha256(canonicalJson(authority)) &&
       canonicalJson(d.files) === canonicalJson(old.hashes) &&
+      d.bunLockSha256 === old.bunLockSha256 &&
       canonicalJson(d.updates) === canonicalJson(old.updates) &&
       typeof preview.message === "string" &&
       sha256(preview.message) === d.messageSha256 &&

package/all/copy-overwrite/scripts/lib/npm-update-cancellation-proof.mjs

@@ -105,7 +105,12 @@ export function assertManualCancellation(
 /** The closed subject preserves one stale origin and one exact replacement, with no published destination. */
 export function validateCancellation(value, expected) {
   keys(value, RECORD_KEYS);
-  keys(value.proposalHashes, FILES);
+  keys(
+    value.proposalHashes,
+    Object.hasOwn(expected.proposalHashes, "bun.lock")
+      ? ["bun.lock", ...FILES]
+      : FILES
+  );
   keys(value.destination, ["branch", "expectedBranchHead", "prNumber"]);
   required(
     value.version === 1 &&

package/all/copy-overwrite/scripts/lib/npm-update-contract.mjs

@@ -10,6 +10,11 @@ import { required, keys } from "./npm-update-invariants.mjs";
 export { UpdaterError, required, keys } from "./npm-update-invariants.mjs";
 import { canonicalJson } from "../lisa-automation-provenance.mjs";
 import { sha256 } from "./github-attestation-verifier.mjs";
+import {
+  optionalLockFields,
+  proposalFileNames,
+} from "./automation-provenance-contract.mjs";
+export { proposalFileNames } from "./automation-provenance-contract.mjs";
 
 export const FILES = ["package-lock.json", "package.json"];
 export const SECTIONS = [
@@ -207,9 +212,17 @@ export function selectionKey(policy, updates) {
 }
 
 /** Recovery binds policy as well as versions; the hook's signed proposal key is separate. */
-export function proposalFrom(policy, parent, before, files, updates) {
+export function proposalFrom(
+  policy,
+  parent,
+  before,
+  files,
+  updates,
+  bunLockSha256
+) {
   required(OBJECT.test(parent), "unsupported Git parent or object format");
-  keys(files, FILES);
+  const optional = bunLockSha256 === undefined ? {} : { bunLockSha256 };
+  const names = proposalFileNames({ files, ...optional });
   for (const value of Object.values(files))
     required(
       typeof value === "string" && Buffer.byteLength(value) <= 1_048_576,
@@ -228,6 +241,7 @@ export function proposalFrom(policy, parent, before, files, updates) {
     parent,
     policySha256: sha256(canonicalJson(policy)),
     updates: ordered,
+    ...optional,
   };
   return {
     version: 1,
@@ -235,11 +249,16 @@ export function proposalFrom(policy, parent, before, files, updates) {
     selectionKey: selectionKey(policy, ordered),
     key: sha256(canonicalJson(identity)),
     bindingKey: sha256(
-      canonicalJson({ repository: policy.repository, parent, updates: ordered })
+      canonicalJson({
+        repository: policy.repository,
+        parent,
+        updates: ordered,
+        ...optional,
+      })
     ),
     before,
     files,
-    hashes: Object.fromEntries(FILES.map(file => [file, sha256(files[file])])),
+    hashes: Object.fromEntries(names.map(file => [file, sha256(files[file])])),
   };
 }
 
@@ -260,13 +279,15 @@ export function validateProposal(value, policy) {
     "before",
     "files",
     "hashes",
+    ...optionalLockFields(value),
   ]);
   const expected = proposalFrom(
     policy,
     value.parent,
     value.before,
     value.files,
-    value.updates
+    value.updates,
+    value.bunLockSha256
   );
   required(
     canonicalJson(value) === canonicalJson(expected),

package/all/copy-overwrite/scripts/lib/npm-update-gate.mjs

@@ -10,7 +10,7 @@ import { writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { canonicalJson } from "../lisa-automation-provenance.mjs";
 import {
-  FILES,
+  proposalFileNames,
   OBJECT,
   required,
   validateProposal,
@@ -95,7 +95,7 @@ export async function descriptorFor({
     await baseline(cwd, env, proposal);
     const staged = { ...env, GIT_INDEX_FILE: join(root, "index") };
     await git(cwd, staged, ["read-tree", proposal.parent]);
-    for (const file of FILES) {
+    for (const file of proposalFileNames(proposal)) {
       const blob = (
         await git(
           cwd,
@@ -125,6 +125,9 @@ export async function descriptorFor({
       author: identity,
       committer: identity,
       files: proposal.hashes,
+      ...(proposal.bunLockSha256 === undefined
+        ? {}
+        : { bunLockSha256: proposal.bunLockSha256 }),
       messageSha256: sha256(message),
       updates: proposal.updates,
       proposalKey: proposal.bindingKey,
@@ -161,9 +164,9 @@ async function stageProposal(context, env) {
   await withStage("gate-attach", () =>
     executeCanonicalHelper(context, "stage-read", "attach-branch")
   );
-  for (const file of FILES)
+  for (const file of proposalFileNames(context.proposal))
     writeFileSync(join(cwd, file), proposal.files[file]);
-  await command(["add", "--", ...FILES]);
+  await command(["add", "--", ...proposalFileNames(context.proposal)]);
   return branch;
 }
 
@@ -192,7 +195,7 @@ async function committedProposal(
     .split("\n")
     .sort();
   required(
-    changed.join("\n") === FILES.join("\n"),
+    changed.join("\n") === proposalFileNames(proposal).join("\n"),
     "committed diff includes foreign paths"
   );
   const ranges = (

package/all/copy-overwrite/scripts/lib/npm-update-github.mjs

@@ -7,7 +7,7 @@ import { assertPinnedVerifier } from "./github-attestation-verifier.mjs";
 import { required } from "./npm-update-contract.mjs";
 import { runProcess } from "./npm-update-process.mjs";
 import { gitObjectId } from "./npm-update-object.mjs";
-import { FILES } from "./npm-update-contract.mjs";
+import { proposalFileNames } from "./npm-update-contract.mjs";
 import { executeCanonicalHelper } from "./npm-update-controller-factory.mjs";
 /** Explicit minimum gh identity and token; no caller/candidate executable override. */
 const HOST_OPTION = "--hostname";
@@ -179,7 +179,7 @@ export class GitHub {
   async gitCommit(proposal, descriptor, commit, authorize, cwd) {
     const path = `repos/${this.policy.repository}/git`;
     const tree = [];
-    for (const file of FILES) {
+    for (const file of proposalFileNames(proposal)) {
       await authorize();
       const bytes = Buffer.from(proposal.files[file]);
       const blob = await this.request(`${path}/blobs`, "POST", {

package/all/copy-overwrite/scripts/lib/npm-update-helper-inventory.mjs

@@ -29,9 +29,8 @@ const COMMON = [
   "lib/github-attestation-provider.mjs",
   "lib/github-attestation-recovery.mjs",
   "lib/automation-provenance-contract.mjs",
+  "lib/automation-provenance-files.mjs",
   "lib/automation-provenance-local.mjs",
-];
-const RAILS = [
   "lisa-clean-git-env.sh",
   "lisa-scratch-run.sh",
   "check-threshold-ratchet.mjs",
@@ -42,6 +41,7 @@ const PRODUCER = [
   "allocate",
   "authorization",
   "broker-client",
+  "bun",
   "cancel-origin",
   "cancellation",
   "cancellation-proof",
@@ -125,7 +125,6 @@ export function managedTemplateMembers() {
       "npm-updater-gate.Dockerfile",
       ...PRODUCER.map(name => `lib/npm-update-${name}.mjs`),
     ].map(member => [member, `all/copy-overwrite/scripts/${member}`]),
-    ...RAILS.map(member => [member, `rails/copy-overwrite/scripts/${member}`]),
-    ["lisa-mutation.sh", "rails/copy-contents/scripts/lisa-mutation.sh"],
+    ["lisa-mutation.sh", "all/copy-contents/scripts/lisa-mutation.sh"],
   ]);
 }