@harness-mix/cli 0.1.5 → 0.1.6

package/src/main/adapters/zcode.js

@@ -5,3 +5,6 @@ module.exports = nativeAcp({
   id: 'zcode', name: 'ZCode', args: [],
   capabilities: { questions: false, thinkingLevels: false, usage: true, contextUsage: true, attachments: false, fork: false, compaction: false },
 });
+// ZCode scans, per scope: .zcode/skills then .agents/skills (deeper workspace levels win).
+// https://zcode.z.ai/en/docs/skill
+module.exports.manifest.integrations.skills = { global: ['.zcode/skills', '.agents/skills'], project: ['.zcode/skills', '.agents/skills'] };

package/src/main/host/collaboration.js

@@ -8,6 +8,22 @@ const { createWorkspace, reviewWorkspace, applyWorkspace, discardWorkspace, push
 const validators = new Map(tools.map(tool => [tool.name, z.fromJSONSchema(tool.inputSchema)]));
 const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
 
+function defaultWorkerPermissionMode(agent) {
+  switch (agent) {
+    case 'claude':
+    case 'claude-code':
+      return 'bypassPermissions';
+    case 'antigravity':
+    case 'agy':
+      return 'skip';
+    case 'pi':
+    case 'omp':
+      return 'no-approve';
+    default:
+      return undefined;
+  }
+}
+
 // A session-scoped local bridge. Native models/credentials and approvals stay in adapters.
 class Collaboration {
   constructor(runtime) {
@@ -134,6 +150,13 @@ class Collaboration {
     if (name === 'delegate_to_agent') {
       const agent = rt.resolveHarnessId(args.agent_type);
       if (!agent || !rt.status[agent]?.available) throw new Error('Target Harness unavailable');
+      // Server-side enforcement: multi-agent collaboration can ONLY start when the user explicitly selected/mentioned agents.
+      if (!parent.activeMentions || !parent.activeMentions.length) {
+        throw new Error('跨 Harness 协作仅在用户显式使用 #agent 或 @agent（如 #pi、#claude）指定时允许启动。用户本轮未显式委派，不能由大模型自行决定启动跨 Harness 协作。请直接使用当前 Harness 的原生工具完成任务。');
+      }
+      if (!parent.activeMentions.includes(agent)) {
+        throw new Error(`用户仅显式指定了 [${parent.activeMentions.join(', ')}]，不能委派给未指定的 "${agent}"。请向用户确认是否需要委派给其他 Harness。`);
+      }
       const jobs = [...this.jobs.values()].filter(j => j.owner === owner);
       if (jobs.filter(j => j.status === 'running').length >= 4) throw new Error('At most four concurrent subtasks; collect existing results first');
       if (jobs.filter(j => j.turnId === rt.execution.lastTurn(owner)?.id).length >= 16) throw new Error('At most sixteen subtasks per lead turn');
@@ -146,7 +169,7 @@ class Collaboration {
     if (name === 'get_delegation_status') {
       const jobs = args.task_ids.map(id => this.owned(owner, id));
       const until = Date.now() + (args.wait_ms ?? 0);
-      while (jobs.every(j => j.status === 'running') && Date.now() < until && !this.closing) await delay(Math.min(100, until - Date.now()));
+      while (jobs.every(j => j.status === 'running') && Date.now() < until && !this.closing && !this.cancelling.has(owner) && rt.execution.isRunning(owner)) await delay(Math.min(100, until - Date.now()));
       return jobs.map(j => this.view(j));
     }
     const job = this.owned(owner, args.task_id);
@@ -184,9 +207,12 @@ class Collaboration {
         job.workspace = await createWorkspace(parent.cwd, job.id, job.isolation);
         await this.save();
       }
-      if (job.status !== 'running' || this.closing) return;
-      const child = job.childId ? rt.threads.find(t => t.id === job.childId) : await rt.createThread({ harnessId: job.agent, cwd: job.workspace.cwd, title: `${parent.title} › ${task.slice(0, 40)}`, parentThreadId: parent.id,
-        onCreated: async thread => { job.childId = thread.id; await this.save(); } });
+      const workerPermMode = defaultWorkerPermissionMode(job.agent);
+      const child = job.childId ? rt.threads.find(t => t.id === job.childId) : await rt.createThread({
+        harnessId: job.agent, cwd: job.workspace.cwd, title: `${parent.title} › ${task.slice(0, 40)}`, parentThreadId: parent.id,
+        options: { ...(workerPermMode ? { permissionMode: workerPermMode } : {}) },
+        onCreated: async thread => { job.childId = thread.id; await this.save(); }
+      });
       if (!child) throw new Error('Native child history is missing; no replacement session was created');
       job.childId = child.id;
       await this.save();
@@ -198,7 +224,15 @@ class Collaboration {
       void sending.then(() => { sendDone = true; }, error => { sendDone = true; sendError = error; });
       const until = Date.now() + 30 * 60 * 1000;
       let displayedStatus = 'running';
-      while (job.status === 'running' && (!sendDone || rt.execution.isRunning(child.id) || child.reviewPending)) {
+      let turnInactiveSince = null;
+      while (job.status === 'running' && !this.closing && !this.cancelling.has(parent.id) && rt.execution.isRunning(parent.id)) {
+        const childRunning = rt.execution.isRunning(child.id) || child.reviewPending;
+        if (!childRunning) {
+          if (!turnInactiveSince) turnInactiveSince = Date.now();
+          if (sendDone || Date.now() - turnInactiveSince > 2000) break;
+        } else {
+          turnInactiveSince = null;
+        }
         const current = this.view(job).display_status;
         if (current !== displayedStatus) { displayedStatus = current; emit({ kind: 'tool', toolCallId, state: 'running', output: JSON.stringify(this.view(job)) }); }
         if (Date.now() > until) { await rt.cancel(child.id); throw new Error('Subtask timed out after 30 minutes'); }
@@ -227,16 +261,26 @@ class Collaboration {
     if (job.status !== 'running') return;
     job.status = this.closing ? 'interrupted' : 'cancelled';
     job.cancelling = true;
-    try { if (job.childId) await this.runtime.cancel(job.childId); }
-    finally { job.cancelling = false; await this.save(); }
+    try {
+      if (job.childId) {
+        await Promise.race([
+          this.runtime.cancel(job.childId),
+          new Promise(r => setTimeout(r, 3_000)),
+        ]).catch(() => {});
+      }
+    } finally { job.cancelling = false; await this.save(); }
   }
 
   async cancelOwner(owner) {
     const jobs = [...this.jobs.values()].filter(j => j.owner === owner && j.status === 'running');
     if (!jobs.length) return;
     this.cancelling.add(owner);
-    try { await Promise.all(jobs.map(j => this.cancel(j))); }
-    finally { this.cancelling.delete(owner); }
+    try {
+      await Promise.race([
+        Promise.all(jobs.map(j => this.cancel(j))),
+        new Promise(r => setTimeout(r, 5_000)),
+      ]).catch(() => {});
+    } finally { this.cancelling.delete(owner); }
   }
   isParticipant(thread, owner) { return thread.id === owner || [...this.jobs.values()].some(j => j.owner === owner && j.childId === thread.id); }
   async close() {
@@ -254,11 +298,13 @@ function mentionedAgents(text, runtime) {
   // Ignore code and email/package addresses; explicit links survive draft copy/paste.
   const prose = text.replace(/```[\s\S]*?```|`[^`\n]*`/g, '');
   const ids = new Set();
-  for (const match of prose.matchAll(/\[[^\]\n]+\]\(harness-mix:\/\/agent\/([\w-]+)\)|(?:^|[\s，。；：])@([\w-]+)(?=$|[\s，。；：])/g)) {
+  // CJK ideographs (\u4e00-\u9fff) and fullwidth/halfwidth forms are valid word boundaries,
+  // so #agent works in Chinese prose (for example 帮我#pi做这个). @ remains native Codex syntax.
+  for (const match of prose.matchAll(/\[[^\]\n]+\]\(harness-mix:\/\/agent\/([\w-]+)\)|(?:^|[\s\u4e00-\u9fff\u3400-\u4dbf\uf900-\ufaff，。；：、！？""''（）【】])#([\w-]+)(?=$|[\s\u4e00-\u9fff\u3400-\u4dbf\uf900-\ufaff，。；：、！？""''（）【】])/g)) {
     const id = runtime.resolveHarnessId(match[1] || match[2]);
     if (id) ids.add(id);
   }
   return [...ids];
 }
 
-module.exports = { Collaboration, mentionedAgents };
+module.exports = { Collaboration, mentionedAgents, defaultWorkerPermissionMode };

package/src/main/host/integrations.js

@@ -7,6 +7,15 @@ const slug = value => typeof value === 'string' && /^[a-z0-9][a-z0-9_-]{0,63}$/i
 const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
 const within = (root, file) => { const rel = path.relative(root, file); return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel)); };
 async function exists(file) { try { await fs.lstat(file); return true; } catch (e) { if (e.code === 'ENOENT') return false; throw e; } }
+async function robustRename(from, to) {
+  for (let attempt = 0; ; attempt++) {
+    try { await fs.rename(from, to); break; }
+    catch (error) {
+      if (!['EPERM', 'EACCES', 'EBUSY'].includes(error.code) || attempt >= 9) throw error;
+      await new Promise(resolve => setTimeout(resolve, 50));
+    }
+  }
+}
 
 // This store contains only user-managed launch declarations. Native account,
 // authentication and MCP configuration files are never read or rewritten.
@@ -76,14 +85,77 @@ class Integrations {
       const adapter = this.adapter(input.harnessId), scope = await this.scope(input);
       if (!adapter.manifest.integrations?.mcp) throw new Error('This Harness has no supported native MCP injection interface');
       const s = input.server;
-      if (!s || !slug(s.name) || s.name === 'harness-mix' || typeof s.command !== 'string' || !s.command.trim() || s.command.length > 2048 || /[\r\n\0]/.test(s.command)) throw new Error('Invalid MCP name or executable');
-      if (!Array.isArray(s.args) || s.args.length > 100 || s.args.some(a => typeof a !== 'string' || a.length > 4096 || /[\r\n\0]/.test(a))) throw new Error('Arguments must be a JSON array of strings');
-      if (Object.keys(s).some(k => !['name', 'command', 'args', 'enabled'].includes(k))) throw new Error('Only executable and arguments are supported; configure credentials in the native environment');
+      if (!s || !slug(s.name) || s.name === 'harness-mix') throw new Error('Invalid MCP name');
+      const isHttp = s.transportType === 'streamable_http' || (typeof s.url === 'string' && s.url.trim().length > 0);
+      const allowedKeys = [
+        'id', 'name', 'transportType', 'enabled',
+        'command', 'args', 'env', 'env_vars', 'cwd',
+        'url', 'bearer_token_env_var', 'http_headers', 'env_http_headers'
+      ];
+      if (Object.keys(s).some(k => !allowedKeys.includes(k))) throw new Error('Unsupported MCP configuration properties');
       if (typeof s.enabled !== 'boolean') throw new Error('enabled must be boolean');
-      if (/(?:api[_-]?key|token|password|secret|authorization)(?:=|\s)|:\/\/[^/\s]+@/i.test([s.command, ...s.args].join(' '))) throw new Error('Use the native environment for credentials, not MCP arguments');
+
+      let validated;
+      if (isHttp) {
+        if (typeof s.url !== 'string' || !s.url.trim() || s.url.length > 2048 || /[\r\n\0]/.test(s.url)) throw new Error('Invalid MCP URL');
+        try {
+          const parsed = new URL(s.url.trim());
+          if (!['http:', 'https:'].includes(parsed.protocol)) throw new Error('Invalid MCP URL protocol');
+        } catch { throw new Error('Invalid MCP URL'); }
+        if (s.bearer_token_env_var !== undefined && s.bearer_token_env_var !== null && s.bearer_token_env_var !== '') {
+          if (typeof s.bearer_token_env_var !== 'string' || !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(s.bearer_token_env_var.trim())) {
+            throw new Error('Invalid bearer token environment variable name');
+          }
+        }
+        if (s.http_headers !== undefined && s.http_headers !== null) {
+          if (typeof s.http_headers !== 'object' || Array.isArray(s.http_headers)) throw new Error('Headers must be an object');
+          for (const [k, v] of Object.entries(s.http_headers)) {
+            if (typeof k !== 'string' || !k.trim() || typeof v !== 'string' || /[\r\n\0]/.test(k) || /[\r\n\0]/.test(v)) throw new Error('Invalid HTTP headers');
+          }
+        }
+        if (s.env_http_headers !== undefined && s.env_http_headers !== null) {
+          if (typeof s.env_http_headers !== 'object' || Array.isArray(s.env_http_headers)) throw new Error('Env HTTP headers must be an object');
+          for (const [k, v] of Object.entries(s.env_http_headers)) {
+            if (typeof k !== 'string' || !k.trim() || typeof v !== 'string' || !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(v.trim())) throw new Error('Invalid env HTTP headers');
+          }
+        }
+        validated = {
+          transportType: 'streamable_http',
+          url: s.url.trim(),
+          ...(s.bearer_token_env_var && s.bearer_token_env_var.trim() ? { bearer_token_env_var: s.bearer_token_env_var.trim() } : {}),
+          ...(s.http_headers && Object.keys(s.http_headers).length ? { http_headers: s.http_headers } : {}),
+          ...(s.env_http_headers && Object.keys(s.env_http_headers).length ? { env_http_headers: s.env_http_headers } : {}),
+        };
+      } else {
+        if (typeof s.command !== 'string' || !s.command.trim() || s.command.length > 2048 || /[\r\n\0]/.test(s.command)) throw new Error('Invalid MCP name or executable');
+        const args = s.args || [];
+        if (!Array.isArray(args) || args.length > 100 || args.some(a => typeof a !== 'string' || a.length > 4096 || /[\r\n\0]/.test(a))) throw new Error('Arguments must be a JSON array of strings');
+        if (/(?:api[_-]?key|token|password|secret|authorization)(?:=|\s)|:\/\/[^/\s]+@/i.test([s.command, ...args].join(' '))) throw new Error('Use the native environment for credentials, not MCP arguments');
+        if (s.env !== undefined && s.env !== null) {
+          if (typeof s.env !== 'object' || Array.isArray(s.env)) throw new Error('Environment variables must be an object');
+          for (const [k, v] of Object.entries(s.env)) {
+            if (typeof k !== 'string' || !k.trim() || typeof v !== 'string' || /[\0]/.test(k) || /[\0]/.test(v)) throw new Error('Invalid environment variables');
+          }
+        }
+        if (s.env_vars !== undefined && s.env_vars !== null) {
+          if (!Array.isArray(s.env_vars) || s.env_vars.some(v => typeof v !== 'string' || !/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(v.trim()))) throw new Error('Invalid environment variable passthrough');
+        }
+        if (s.cwd !== undefined && s.cwd !== null && s.cwd !== '') {
+          if (typeof s.cwd !== 'string' || s.cwd.length > 2048 || /[\r\n\0]/.test(s.cwd)) throw new Error('Invalid working directory');
+        }
+        validated = {
+          transportType: 'stdio',
+          command: s.command.trim(),
+          args,
+          ...(s.env && Object.keys(s.env).length ? { env: s.env } : {}),
+          ...(s.env_vars && s.env_vars.length ? { env_vars: s.env_vars.map(v => v.trim()).filter(Boolean) } : {}),
+          ...(s.cwd && s.cwd.trim() ? { cwd: s.cwd.trim() } : {}),
+        };
+      }
+
       const data = await this.read();
       const index = data.servers.findIndex(r => r.harnessId === adapter.manifest.id && r.scope === scope.scope && r.cwd === scope.cwd && r.name === s.name);
-      const row = { id: index < 0 ? randomUUID() : data.servers[index].id, harnessId: adapter.manifest.id, ...scope, name: s.name, command: s.command.trim(), args: s.args, enabled: s.enabled };
+      const row = { id: index < 0 ? randomUUID() : data.servers[index].id, harnessId: adapter.manifest.id, ...scope, name: s.name, enabled: s.enabled, ...validated };
       if (index < 0) data.servers.push(row); else data.servers[index] = row;
       await this.write(data);
       return { saved: true };
@@ -100,7 +172,7 @@ class Integrations {
   async write(data) {
     await fs.mkdir(path.dirname(this.file), { recursive: true });
     const temp = `${this.file}.${randomUUID()}.tmp`;
-    try { await fs.writeFile(temp, JSON.stringify(data, null, 2), { mode: 0o600, flag: 'wx' }); await fs.rename(temp, this.file); }
+    try { await fs.writeFile(temp, JSON.stringify(data, null, 2), { mode: 0o600, flag: 'wx' }); await robustRename(temp, this.file); }
     finally { await fs.rm(temp, { force: true }); }
   }
   async forSession(thread, adapter) {
@@ -111,7 +183,31 @@ class Integrations {
       if (s.harnessId === adapter.manifest.id && s.scope === scope && (scope === 'global' || s.cwd === cwd)) selected.set(s.name, s);
     }
     const rows = [...selected.values()].filter(s => s.enabled);
-    return { servers: rows.map(s => ({ name: `hm-user-${s.name}`, command: s.command, args: s.args, env: {} })), records: rows.map(s => ({ id: s.id, digest: digest(s) })), cwd };
+    return {
+      servers: rows.map(s => {
+        if (s.transportType === 'streamable_http' || s.url) {
+          return {
+            name: `hm-user-${s.name}`,
+            transportType: 'streamable_http',
+            url: s.url,
+            ...(s.bearer_token_env_var ? { bearer_token_env_var: s.bearer_token_env_var } : {}),
+            ...(s.http_headers ? { http_headers: s.http_headers } : {}),
+            ...(s.env_http_headers ? { env_http_headers: s.env_http_headers } : {}),
+          };
+        }
+        return {
+          name: `hm-user-${s.name}`,
+          transportType: 'stdio',
+          command: s.command,
+          args: s.args || [],
+          env: s.env || {},
+          ...(s.env_vars ? { env_vars: s.env_vars } : {}),
+          ...(s.cwd ? { cwd: s.cwd } : {}),
+        };
+      }),
+      records: rows.map(s => ({ id: s.id, digest: digest(s) })),
+      cwd,
+    };
   }
   roots(adapter, scope) {
     const spec = adapter.manifest.integrations?.skills;
@@ -131,6 +227,31 @@ class Integrations {
       catch (e) { if (e.code !== 'ENOENT') throw e; }
     }
   }
+  /**
+   * Launch-time guarantee: every declared native skill root exists before the harness starts.
+   * A harness that is installed but has never run has no skill directory yet, and some
+   * harnesses only scan a directory that already exists, so the root is created here instead
+   * of asking the user to prepare it by hand.
+   * Best-effort by design: a root that cannot be created is reported and skipped, never fatal,
+   * because a missing skill directory must not stop a native session from opening.
+   */
+  async ensureSkillRoots(thread, adapter, { onError } = {}) {
+    const spec = adapter.manifest.integrations?.skills;
+    if (!spec) return [];
+    let project = null;
+    try { project = await this.scope({ scope: 'project', cwd: thread.cwd }); }
+    catch (error) { onError?.(`project scope unavailable (${error.message})`); }
+    const roots = [...new Set([
+      ...this.roots(adapter, { scope: 'global', cwd: null }),
+      ...(project ? this.roots(adapter, project) : []),
+    ])];
+    const ensured = [];
+    for (const root of roots) {
+      try { await this.safeRoot(root); await fs.mkdir(root, { recursive: true }); ensured.push(root); }
+      catch (error) { onError?.(`${root} (${error.message})`); }
+    }
+    return ensured;
+  }
   async skills(adapter, scope) {
     const result = [];
     for (const root of this.roots(adapter, scope)) for (const enabled of [true, false]) {
@@ -159,23 +280,39 @@ class Integrations {
       const active = path.join(root, input.name), inactive = path.join(`${root}.harness-mix-disabled`, input.name);
       if (input.action === 'install') {
         if (await exists(active) || await exists(inactive)) throw new Error('Skill already exists; existing files were preserved');
-        if (typeof input.source !== 'string' || !path.isAbsolute(input.source)) throw new Error('Choose an absolute local skill directory');
-        await this.safeRoot(input.source);
-        const source = await fs.realpath(input.source);
-        if (within(source, active)) throw new Error('Skill source must not contain the destination');
-        const files = []; let bytes = 0;
-        const walk = async dir => {
-          for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
-            const file = path.join(dir, entry.name);
-            if (entry.isSymbolicLink()) throw new Error('Skill installation does not follow symbolic links');
-            if (entry.isDirectory()) await walk(file);
-            else if (entry.isFile()) {
-              bytes += (await fs.stat(file)).size; files.push(path.relative(source, file));
-              if (bytes > 10 * 1024 * 1024 || files.length > 500) throw new Error('Skill exceeds 10 MB or 500 files');
-            } else throw new Error('Unsupported skill file type');
+        let source = null, files = [], dropped = null, bytes = 0;
+        if (Array.isArray(input.files)) {
+          if (!input.files.length || input.files.length > 500) throw new Error('Skill must contain between 1 and 500 files');
+          dropped = new Map();
+          for (const item of input.files) {
+            if (!item || typeof item.path !== 'string' || typeof item.contentBase64 !== 'string') throw new Error('Invalid dropped skill file');
+            const relative = item.path.replaceAll('\\', '/');
+            if (!relative || relative.length > 512 || relative.startsWith('/') || relative.split('/').some(part => !part || part === '.' || part === '..')) throw new Error('Dropped skill contains an invalid path');
+            if (!/^[A-Za-z0-9+/]*={0,2}$/.test(item.contentBase64)) throw new Error('Dropped skill contains invalid file data');
+            const content = Buffer.from(item.contentBase64, 'base64');
+            if (content.toString('base64') !== item.contentBase64) throw new Error('Dropped skill contains invalid file data');
+            bytes += content.length;
+            if (bytes > 10 * 1024 * 1024 || dropped.has(relative)) throw new Error('Skill exceeds 10 MB or contains duplicate files');
+            dropped.set(relative, content); files.push(relative);
           }
-        };
-        await walk(source);
+        } else {
+          if (typeof input.source !== 'string' || !path.isAbsolute(input.source)) throw new Error('Choose an absolute local skill directory');
+          await this.safeRoot(input.source);
+          source = await fs.realpath(input.source);
+          if (within(source, active)) throw new Error('Skill source must not contain the destination');
+          const walk = async dir => {
+            for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+              const file = path.join(dir, entry.name);
+              if (entry.isSymbolicLink()) throw new Error('Skill installation does not follow symbolic links');
+              if (entry.isDirectory()) await walk(file);
+              else if (entry.isFile()) {
+                bytes += (await fs.stat(file)).size; files.push(path.relative(source, file));
+                if (bytes > 10 * 1024 * 1024 || files.length > 500) throw new Error('Skill exceeds 10 MB or 500 files');
+              } else throw new Error('Unsupported skill file type');
+            }
+          };
+          await walk(source);
+        }
         if (!files.includes('SKILL.md')) throw new Error('Source must contain SKILL.md');
         const staging = path.join(path.dirname(root), `.hm-skill-${randomUUID()}`);
         try {
@@ -183,16 +320,17 @@ class Integrations {
           for (const relative of files) {
             const target = path.join(staging, relative);
             await fs.mkdir(path.dirname(target), { recursive: true });
-            await fs.copyFile(path.join(source, relative), target);
+            if (dropped) await fs.writeFile(target, dropped.get(relative));
+            else await fs.copyFile(path.join(source, relative), target);
           }
-          await fs.mkdir(root, { recursive: true }); await fs.rename(staging, active);
+          await fs.mkdir(root, { recursive: true }); await robustRename(staging, active);
         } finally { if (within(path.dirname(root), staging)) await fs.rm(staging, { recursive: true, force: true }); }
       } else if (input.action === 'enable' || input.action === 'disable') {
         const from = input.action === 'enable' ? inactive : active, to = input.action === 'enable' ? active : inactive;
         await this.safeRoot(from);
         if (!await exists(path.join(from, 'SKILL.md'))) throw new Error('Skill no longer exists');
         if (await exists(to)) throw new Error('Destination already exists; existing files were preserved');
-        await fs.mkdir(path.dirname(to), { recursive: true }); await fs.rename(from, to);
+        await fs.mkdir(path.dirname(to), { recursive: true }); await robustRename(from, to);
       } else throw new Error('Unknown skill action');
       return { saved: true, effective: 'next-session' };
     });