@haus-tech/haus-workflow 0.32.0 → 0.32.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [0.32.1](https://github.com/WeAreHausTech/haus-workflow/compare/v0.32.0...v0.32.1) (2026-06-30)
+
+### Bug Fixes
+
+- **security:** audit hardening — fail-closed, recommender gates, CI hardening ([#157](https://github.com/WeAreHausTech/haus-workflow/issues/157)) ([e545194](https://github.com/WeAreHausTech/haus-workflow/commit/e545194fd3d3eb553bc2955a7ca17574bd98be71))
+
 ## [0.32.0](https://github.com/WeAreHausTech/haus-workflow/compare/v0.31.1...v0.32.0) (2026-06-24)
 
 ### Features

package/dist/cli.js

@@ -650,48 +650,103 @@ function parseManifest(json) {
 }
 
 // src/catalog/remote-catalog.ts
+function isTestMode() {
+  return process.env["HAUS_TEST_MODE"] === "1" || process.env["NODE_ENV"] === "test";
+}
 function getCacheDir() {
   return process.env["HAUS_CATALOG_CACHE_DIR_OVERRIDE"] ?? path3.join(os2.homedir(), CATALOG_CACHE_SUBDIR);
 }
 var cachedCatalogRef;
 var cachedBlobPaths;
+function getBundledCatalogRef() {
+  try {
+    const manifestPath2 = path3.join(packageRoot(), "library/catalog/manifest.json");
+    const raw = fs2.readFileSync(manifestPath2, "utf8");
+    const data = JSON.parse(raw);
+    if (typeof data.version === "string" && data.version) {
+      return data.version.startsWith("v") ? data.version : `v${data.version}`;
+    }
+  } catch {
+  }
+  return void 0;
+}
 function getResolvedCatalogRef() {
-  return cachedCatalogRef ?? process.env["HAUS_CATALOG_REF"] ?? "main";
+  const resolved = cachedCatalogRef ?? process.env["HAUS_CATALOG_REF"] ?? getBundledCatalogRef();
+  if (!resolved) {
+    warn(
+      "Could not determine catalog ref from cache, env, or bundled snapshot \u2014 falling back to main (moving target)."
+    );
+    return "main";
+  }
+  return resolved;
 }
 function isCatalogRefResolved() {
   return cachedCatalogRef !== void 0 || process.env["HAUS_CATALOG_REF"] !== void 0;
 }
 async function resolveCatalogRef(opts) {
   const env = opts?.env ?? process.env;
-  if (env["HAUS_CATALOG_REF"]) return env["HAUS_CATALOG_REF"];
+  if (env["HAUS_CATALOG_REF"]) {
+    if (env["HAUS_CATALOG_REF"] === "main") {
+      warn(
+        "HAUS_CATALOG_REF=main is set \u2014 fetching from the moving main branch. Pin to a release tag for reproducible installs."
+      );
+    }
+    return env["HAUS_CATALOG_REF"];
+  }
   const fetchLatest = opts?.fetchLatestTag ?? fetchLatestCatalogTag;
   const tag = await fetchLatest();
-  return tag ?? "main";
+  if (tag !== null) return tag;
+  const fallback = opts?.fallbackRef;
+  if (fallback) {
+    warn(
+      `Tag resolution failed \u2014 using cached ref ${fallback}. To use latest, retry or set HAUS_CATALOG_REF explicitly.`
+    );
+    return fallback;
+  }
+  const bundled = getBundledCatalogRef();
+  if (bundled) {
+    warn(
+      `Tag resolution failed \u2014 using bundled snapshot ref ${bundled}. To use latest, retry or set HAUS_CATALOG_REF explicitly.`
+    );
+    return bundled;
+  }
+  warn(
+    "Tag resolution failed and no fallback ref is available. Set HAUS_CATALOG_REF explicitly to avoid fetching from main."
+  );
+  return "main";
 }
 async function remoteBase() {
-  if (process.env["HAUS_CATALOG_REMOTE_BASE"]) {
+  if (isTestMode() && process.env["HAUS_CATALOG_REMOTE_BASE"]) {
     return process.env["HAUS_CATALOG_REMOTE_BASE"];
   }
   if (cachedCatalogRef === void 0) {
-    cachedCatalogRef = await resolveCatalogRef();
+    cachedCatalogRef = await resolveCatalogRef({ fallbackRef: getBundledCatalogRef() });
   }
   return `${CATALOG_REPO_URL}/${cachedCatalogRef}`;
 }
 async function fetchText(url) {
   try {
     const res = await fetch(url, { signal: AbortSignal.timeout(1e4) });
-    if (!res.ok) return null;
+    if (!res.ok) {
+      warn(`Catalog fetch HTTP ${res.status}: ${url}`);
+      return null;
+    }
     return await res.text();
-  } catch {
+  } catch (e) {
+    warn(`Catalog fetch failed (${e instanceof Error ? e.constructor.name : String(e)}): ${url}`);
     return null;
   }
 }
 async function fetchBytes(url) {
   try {
     const res = await fetch(url, { signal: AbortSignal.timeout(1e4) });
-    if (!res.ok) return null;
+    if (!res.ok) {
+      warn(`Catalog fetch HTTP ${res.status}: ${url}`);
+      return null;
+    }
     return Buffer.from(await res.arrayBuffer());
-  } catch {
+  } catch (e) {
+    warn(`Catalog fetch failed (${e instanceof Error ? e.constructor.name : String(e)}): ${url}`);
     return null;
   }
 }
@@ -828,7 +883,7 @@ async function fetchGitHubRecursiveBlobPaths(ref) {
 }
 async function fetchCatalogBlobPaths(_base) {
   if (cachedBlobPaths) return cachedBlobPaths;
-  if (process.env["HAUS_CATALOG_REMOTE_BASE"]) return null;
+  if (isTestMode() && process.env["HAUS_CATALOG_REMOTE_BASE"]) return null;
   const ref = getResolvedCatalogRef();
   const paths = await fetchGitHubRecursiveBlobPaths(ref);
   if (paths) cachedBlobPaths = paths;
@@ -838,7 +893,7 @@ async function listFilesUnderCatalogPrefix(prefix, base) {
   const normalized = prefix.replace(/\\/g, "/").replace(/\/+$/, "");
   const prefixSlash = `${normalized}/`;
   let relFiles;
-  if (process.env["HAUS_CATALOG_REMOTE_BASE"]) {
+  if (isTestMode() && process.env["HAUS_CATALOG_REMOTE_BASE"]) {
     relFiles = await listMockPrefixFiles(base, normalized);
   } else {
     const blobs = await fetchCatalogBlobPaths(base);
@@ -985,7 +1040,7 @@ async function syncConfigItem(item, base) {
   if (relFiles && relFiles.length > 0) {
     try {
       return await syncDirectoryFromPrefix(item, item.path, dest, base, {
-        validateMarkdown: false,
+        validateMarkdown: true,
         requireSkillMd: false,
         relFiles
       });
@@ -1125,7 +1180,7 @@ function compareSemver(a, b) {
   return 0;
 }
 async function fetchLatestCatalogTag() {
-  if (process.env["HAUS_CATALOG_REMOTE_BASE"]) return null;
+  if (isTestMode() && process.env["HAUS_CATALOG_REMOTE_BASE"]) return null;
   try {
     const res = await fetch(CATALOG_TAGS_API_URL, {
       signal: AbortSignal.timeout(5e3),
@@ -2290,15 +2345,32 @@ ${templateContent}`;
       return null;
     }
     const existingContent = existing.slice(firstLine.length + 1);
-    if (!parsed.hash && !force) {
-      warn(
-        `${printable}: managed header missing hash \u2014 cannot verify tamper status, skipping. Use --force to overwrite.`
-      );
-      return null;
-    }
-    if (parsed.hash && hashText(normaliseLF(existingContent)) !== parsed.hash && !force) {
-      warn(`${printable}: content modified by user \u2014 skipping. Use --force to overwrite.`);
-      return null;
+    const bodyMatchesTemplate = hashText(normaliseLF(existingContent)) === contentHash;
+    if (parsed.hash) {
+      const bodyIntact = hashText(normaliseLF(existingContent)) === parsed.hash;
+      if (!bodyIntact && !force) {
+        warn(`${printable}: content modified by user \u2014 skipping. Use --force to overwrite.`);
+        return null;
+      }
+    } else {
+      if (!bodyMatchesTemplate && !force) {
+        const migratedHeader = makeWorkflowHeader(
+          pkgVersion,
+          hashText(normaliseLF(existingContent))
+        );
+        const migrated = `${migratedHeader}
+${existingContent}`;
+        if (hasTextChanged(existing, migrated)) {
+          if (dryRun) {
+            log(`${printable}: migrating legacy hash header (body preserved)`);
+          } else {
+            await writeText(destPath, migrated);
+          }
+        } else if (dryRun) {
+          log(`${printable}: unchanged`);
+        }
+        return destPath;
+      }
     }
     if (!hasTextChanged(existing, next)) {
       if (dryRun) log(`${printable}: unchanged`);
@@ -2491,11 +2563,50 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
           `${displayPath(root, destination)}: ${exists ? "would overwrite" : "would create"} (${item.id})`
         );
       } else if (item.type === "skill") {
+        const skillFiles = (await fs14.readdir(sourcePath, { recursive: true })).filter(
+          (f) => typeof f === "string" && f.endsWith(".md")
+        );
+        let skillValid = true;
+        for (const relFile of skillFiles) {
+          const mdPath = path14.join(sourcePath, relFile);
+          const mdContent = await fs14.readFile(mdPath, "utf8");
+          const mdValidation = validateCatalogItem(
+            {
+              id: manifestItem.id,
+              type: "skill",
+              path: manifestItem.path,
+              source: manifestItem.source
+            },
+            mdContent
+          );
+          if (!mdValidation.ok) {
+            warn(
+              `Skipping ${item.id}: pre-copy validation failed (${relFile}) \u2014 ${mdValidation.reason}`
+            );
+            skillValid = false;
+            break;
+          }
+        }
+        if (!skillValid) continue;
         await installCatalogSkill(sourcePath, destination, {
           originSourceId: manifestItem.originSourceId,
           dryRun: false
         });
       } else {
+        const fileContent = await fs14.readFile(sourcePath, "utf8");
+        const validation = validateCatalogItem(
+          {
+            id: manifestItem.id,
+            type: manifestItem.type,
+            path: manifestItem.path,
+            source: manifestItem.source
+          },
+          fileContent
+        );
+        if (!validation.ok) {
+          warn(`Skipping ${item.id}: pre-copy validation failed \u2014 ${validation.reason}`);
+          continue;
+        }
         await fs14.ensureDir(path14.dirname(destination));
         await fs14.copy(sourcePath, destination, { overwrite: true, errorOnExist: false });
       }
@@ -3705,7 +3816,7 @@ function buildSourcesReport(items) {
   }
   return {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    items: [...statusBySource.entries()].map(([id, status]) => ({ id, status })).sort((a, b) => a.id.localeCompare(b.id))
+    items: [...statusBySource.entries()].map(([source, status]) => ({ source, status })).sort((a, b) => a.source.localeCompare(b.source))
   };
 }
 async function writeSourcesReport(root) {
@@ -4417,9 +4528,7 @@ function mergeRecommendationWarnings(context) {
 // src/recommender/recommend.ts
 async function recommend(root, context, opts = {}) {
   const items = await loadCatalog(root);
-  const sources = await readJson(
-    hausPath(root, "sources-report.json")
-  ) ?? {};
+  const sources = buildSourcesReport(items);
   const deep = await readJson(hausPath(root, "deep-context.json")) ?? {};
   const scannerStacks = buildStackSet(context);
   const scannerRoles = new Set(context.repoRoles.map((r) => r.toLowerCase()));
@@ -4437,7 +4546,7 @@ async function recommend(root, context, opts = {}) {
   const depSet = scannerDeps;
   const recommended = [];
   const skipped = [];
-  const sourceTrust = new Map((sources.items ?? []).map((x) => [x.id, x.status ?? "candidate"]));
+  const sourceTrust = new Map(sources.items.map((x) => [x.source, x.status]));
   const changedFiles = await readChangedFiles(root);
   const skip = (id, code, message, signal) => {
     skipped.push({ id, reason: message, skipReasons: [{ code, message, signal }] });
@@ -4445,8 +4554,13 @@ async function recommend(root, context, opts = {}) {
   const roleSignal = (name) => scannerRoles.has(name.toLowerCase()) ? `role:${name}` : `deep:role:${name}`;
   const stackSignal = (name) => scannerStacks.has(name.toLowerCase()) ? `tag:${name}` : `deep:tag:${name}`;
   for (const item of items) {
-    const itemSearchText = `${item.id} ${item.tags.join(" ")}`.toLowerCase();
-    if (UNSUPPORTED.some((x) => itemSearchText.includes(x))) {
+    const normSource = typeof item.source === "string" ? item.source.trim() : "";
+    if (!normSource) {
+      skip(item.id, "invalid-source", "Item source is missing or empty");
+      continue;
+    }
+    const itemTags = item.tags.map((t) => t.toLowerCase());
+    if (UNSUPPORTED.some((x) => itemTags.includes(x))) {
       skip(item.id, "unsupported-policy", "Unsupported stack policy");
       continue;
     }
@@ -4454,7 +4568,7 @@ async function recommend(root, context, opts = {}) {
       skip(item.id, "deprecated", "Catalog item is deprecated", "reviewStatus:deprecated");
       continue;
     }
-    if (item.source === "curated") {
+    if (normSource === "curated") {
       const rs = item.reviewStatus;
       if (!rs || rs !== "approved") {
         skip(
@@ -4475,17 +4589,19 @@ async function recommend(root, context, opts = {}) {
         continue;
       }
     }
-    if (SENSITIVE_ITEM_KEYWORDS.some((x) => itemSearchText.includes(x))) {
+    const sensitiveInId = SENSITIVE_ITEM_KEYWORDS.some((x) => item.id.toLowerCase().includes(x));
+    const sensitiveInTags = SENSITIVE_ITEM_KEYWORDS.some((x) => itemTags.includes(x));
+    if (sensitiveInId || sensitiveInTags) {
       skip(item.id, "sensitive-policy", "Sensitive content policy block");
       continue;
     }
-    const trust = sourceTrust.get(item.source);
+    const trust = sourceTrust.get(normSource);
     if (trust === "candidate" || trust === "rejected") {
       skip(item.id, "source-trust", "Source trust policy block", `trust:${trust}`);
       continue;
     }
-    if (item.source && item.source !== "haus" && trust !== "approved") {
-      skip(item.id, "source-approval", "Source not approved", `source:${item.source}`);
+    if (normSource !== "haus" && trust !== "approved") {
+      skip(item.id, "source-approval", "Source not approved", `source:${normSource}`);
       continue;
     }
     if (item.id === "haus.nx21-monorepo-patterns" && !roleSet.has("nx-monorepo")) {
@@ -4510,15 +4626,6 @@ async function recommend(root, context, opts = {}) {
       skip(item.id, "required-role-missing", "Required role missing: database", "role:database");
       continue;
     }
-    if (item.id === "haus.ecc-typescript-reviewer" && (stackSet.has("react") || stackSet.has("react19") || stackSet.has("nextjs") || stackSet.has("next") || roleSet.has("react-app") || roleSet.has("next-app"))) {
-      skip(
-        item.id,
-        "co-install-react-reviewer",
-        "Skip typescript-reviewer on React/Next stacks (use react-reviewer)",
-        "stack:react|nextjs|role:react-app|next-app"
-      );
-      continue;
-    }
     const isDefaultBaseline = item.default === true;
     const reasons = [];
     const push = (code, message, signal) => reasons.push({ code, message, signal });
@@ -4536,9 +4643,11 @@ async function recommend(root, context, opts = {}) {
         `packageManager:${context.packageManager}`
       );
     }
-    const configSignal = item.tags.find(
-      (t) => context.warnings.join(" ").toLowerCase().includes(t.toLowerCase())
-    );
+    const configSignal = item.tags.find((t) => {
+      const escaped = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const re = new RegExp(`(?:^|\\W)${escaped}(?:\\W|$)`, "i");
+      return context.warnings.some((w) => re.test(w));
+    });
     if (configSignal) push("config-signal-match", "config signal match", `warning:${configSignal}`);
     const idSegment = item.id.split(".").pop() ?? "";
     const changedMatch = idSegment ? changedFiles.find((f) => f.includes(idSegment)) : void 0;
@@ -4671,6 +4780,13 @@ function applyCoInstallSuppression(recommended, skipped) {
       code: "co-install-redis-official",
       message: "Skip ecc-redis-patterns when official redis-connections skill is selected",
       signal: "co-install:redis-connections"
+    },
+    {
+      suppress: "haus.ecc-typescript-reviewer",
+      whenAnyRecommended: ["haus.ecc-react-reviewer"],
+      code: "co-install-react-reviewer",
+      message: "Skip typescript-reviewer on React/Next stacks (use react-reviewer)",
+      signal: "co-install:react-reviewer"
     }
   ];
   for (const rule of rules) {
@@ -4951,7 +5067,7 @@ ${content2}`;
 // src/install/apply.ts
 var SCHEMA_VERSION2 = "1";
 function hashContent(content2) {
-  return `sha256-${crypto2.createHash("sha256").update(content2).digest("hex")}`;
+  return `sha256-${crypto2.createHash("sha256").update(normaliseLF(content2)).digest("hex")}`;
 }
 function sourceVersion() {
   try {
@@ -5838,7 +5954,6 @@ import path37 from "node:path";
 import fs29 from "node:fs";
 import path36 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
-var MANIFEST_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/;
 function isSafeCatalogPath2(itemPath) {
   if (!itemPath || path36.isAbsolute(itemPath) || itemPath.includes("\\")) return false;
   const normalized = path36.normalize(itemPath);
@@ -5892,10 +6007,8 @@ function auditManifestStructure(manifestVersion, items) {
   const failures = [];
   const seenIds = /* @__PURE__ */ new Map();
   const seenPaths = /* @__PURE__ */ new Map();
-  if (typeof manifestVersion !== "string" || !MANIFEST_SEMVER_RE.test(manifestVersion)) {
-    failures.push(
-      'manifest.json: top-level "version" is not valid semver (expected X.Y.Z or X.Y.Z-pre)'
-    );
+  if (typeof manifestVersion !== "string" || !ITEM_SEMVER_RE.test(manifestVersion)) {
+    failures.push('manifest.json: top-level "version" is not valid semver (expected X.Y.Z)');
   }
   for (let i = 0; i < items.length; i++) {
     const item = items[i];

package/library/catalog/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "3.2.0",
+  "version": "3.2.1",
   "items": [
     {
       "id": "haus.agentic-workflow-standard",
@@ -1754,7 +1754,7 @@
     },
     {
       "id": "haus.sentry-sentry-nestjs-sdk",
-      "version": "1.0.0",
+      "version": "1.0.1",
       "source": "curated",
       "type": "skill",
       "path": "skills/sentry/sentry-nestjs-sdk",
@@ -1773,8 +1773,8 @@
       "license": "MIT",
       "licenseConfidence": "high",
       "originSourceId": "getsentry-sentry-for-ai",
-      "originUrl": "https://github.com/getsentry/sentry-for-ai/blob/9ab3551758913a4144517d4fafb71476a48c64f8/skills/sentry-nestjs-sdk/SKILL.md",
-      "pinnedRef": "9ab3551758913a4144517d4fafb71476a48c64f8",
+      "originUrl": "https://github.com/getsentry/sentry-for-ai/blob/cc302403ebf647fd21c3ca736e1ec7ef6e4ed5a3/skills/sentry-nestjs-sdk/SKILL.md",
+      "pinnedRef": "cc302403ebf647fd21c3ca736e1ec7ef6e4ed5a3",
       "ecosystem": "sentry",
       "requiresAny": [
         {
@@ -1787,7 +1787,7 @@
     },
     {
       "id": "haus.sentry-sentry-nextjs-sdk",
-      "version": "1.0.1",
+      "version": "1.0.2",
       "source": "curated",
       "type": "skill",
       "path": "skills/sentry/sentry-nextjs-sdk",
@@ -1806,8 +1806,8 @@
       "license": "MIT",
       "licenseConfidence": "high",
       "originSourceId": "getsentry-sentry-for-ai",
-      "originUrl": "https://github.com/getsentry/sentry-for-ai/blob/bd84576db74e3e1d13361c7eda3bb303ae017b90/skills/sentry-nextjs-sdk/SKILL.md",
-      "pinnedRef": "bd84576db74e3e1d13361c7eda3bb303ae017b90",
+      "originUrl": "https://github.com/getsentry/sentry-for-ai/blob/cc302403ebf647fd21c3ca736e1ec7ef6e4ed5a3/skills/sentry-nextjs-sdk/SKILL.md",
+      "pinnedRef": "cc302403ebf647fd21c3ca736e1ec7ef6e4ed5a3",
       "ecosystem": "sentry",
       "requiresAny": [
         {
@@ -1820,7 +1820,7 @@
     },
     {
       "id": "haus.sentry-sentry-node-sdk",
-      "version": "1.0.1",
+      "version": "1.0.2",
       "source": "curated",
       "type": "skill",
       "path": "skills/sentry/sentry-node-sdk",
@@ -1839,8 +1839,8 @@
       "license": "MIT",
       "licenseConfidence": "high",
       "originSourceId": "getsentry-sentry-for-ai",
-      "originUrl": "https://github.com/getsentry/sentry-for-ai/blob/bd84576db74e3e1d13361c7eda3bb303ae017b90/skills/sentry-node-sdk/SKILL.md",
-      "pinnedRef": "bd84576db74e3e1d13361c7eda3bb303ae017b90",
+      "originUrl": "https://github.com/getsentry/sentry-for-ai/blob/cc302403ebf647fd21c3ca736e1ec7ef6e4ed5a3/skills/sentry-node-sdk/SKILL.md",
+      "pinnedRef": "cc302403ebf647fd21c3ca736e1ec7ef6e4ed5a3",
       "ecosystem": "sentry",
       "requiresAny": [
         {
@@ -1978,7 +1978,7 @@
     },
     {
       "id": "haus.stripe-stripe-best-practices",
-      "version": "1.0.2",
+      "version": "1.0.3",
       "source": "curated",
       "type": "skill",
       "path": "skills/stripe/stripe-best-practices",
@@ -1988,7 +1988,7 @@
       "whenNotToUse": "Do not use when a more specific skill or command applies.",
       "tags": ["workflow", "stripe", "payments"],
       "repoRoles": [],
-      "tokenEstimate": 7509,
+      "tokenEstimate": 1018,
       "installMode": "copy-selected",
       "default": false,
       "reviewStatus": "approved",
@@ -1997,8 +1997,8 @@
       "license": "MIT",
       "licenseConfidence": "medium",
       "originSourceId": "stripe-ai",
-      "originUrl": "https://github.com/stripe/ai/blob/7e7f72eb42e06f79e7bc75f86e9395f4c8232c00/skills/stripe-best-practices/SKILL.md",
-      "pinnedRef": "7e7f72eb42e06f79e7bc75f86e9395f4c8232c00",
+      "originUrl": "https://github.com/stripe/ai/blob/f54c9e6c0e8b6cfe4e648745eec68ecab3ddc994/skills/stripe-best-practices/SKILL.md",
+      "pinnedRef": "f54c9e6c0e8b6cfe4e648745eec68ecab3ddc994",
       "ecosystem": "stripe",
       "requiresAny": [
         {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haus-tech/haus-workflow",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "description": "Haus AI workflow CLI for Claude Code.",
   "type": "module",
   "bin": {
@@ -47,13 +47,13 @@
     "execa": "9.6.1",
     "fast-glob": "3.3.3",
     "fs-extra": "11.3.5",
-    "semver": "7.8.0",
+    "semver": "7.8.5",
     "yaml": "2.9.0"
   },
   "devDependencies": {
     "@release-it/conventional-changelog": "11.0.1",
     "@types/fs-extra": "11.0.4",
-    "@types/node": "22.19.17",
+    "@types/node": "22.20.0",
     "@types/semver": "7.7.1",
     "@typescript-eslint/eslint-plugin": "8.59.3",
     "@typescript-eslint/parser": "8.59.3",