@mmerterden/multi-agent-pipeline 17.0.0 → 17.3.0

package/pipeline/scripts/capture-evidence.sh

@@ -38,20 +38,24 @@ MODE="${1:-}"; shift 2>/dev/null || true
 EVIDENCE_DIR="${EVIDENCE_DIR:-$PWD/.pipeline/evidence}"
 PREFS="$HOME/.claude/multi-agent-preferences.json"
 
-# Reads visualEvidence.enabled, visualEvidence.maxAttachmentMb and
-# visualEvidence.maxVideoSeconds. One node call: three separate ones cost three
-# process starts on every phase boundary.
+# Reads visualEvidence.enabled, .maxAttachmentMb, .maxVideoSeconds and
+# .webBaseUrl. One node call: separate ones cost a process start each on every
+# phase boundary. webBaseUrl is shell-quoted because it is the only value here
+# that is free text a user typed.
 prefs_visual() {
   node -e '
     const fs=require("fs");
     let v={};
     try{v=((JSON.parse(fs.readFileSync(process.argv[1],"utf8")).global||{}).visualEvidence)||{}}catch{}
     const num=(x,d)=>Number.isFinite(x)&&x>0?x:d;
+    const Q=String.fromCharCode(39);
+    const q=(x)=>String(x==null?"":x).split(Q).join(Q+"\\"+Q+Q);
     process.stdout.write(
       "VISUAL_EVIDENCE_ENABLED="+(v.enabled===false?"false":"true")+"\n"+
       "MAX_ATTACHMENT_MB="+num(v.maxAttachmentMb,10)+"\n"+
-      "MAX_VIDEO_SECONDS="+num(v.maxVideoSeconds,60)+"\n");
-  ' "$PREFS" 2>/dev/null || printf 'VISUAL_EVIDENCE_ENABLED=true\nMAX_ATTACHMENT_MB=10\nMAX_VIDEO_SECONDS=60\n'
+      "MAX_VIDEO_SECONDS="+num(v.maxVideoSeconds,60)+"\n"+
+      "WEB_BASE_URL="+Q+q(v.webBaseUrl)+Q+"\n");
+  ' "$PREFS" 2>/dev/null || printf "VISUAL_EVIDENCE_ENABLED=true\nMAX_ATTACHMENT_MB=10\nMAX_VIDEO_SECONDS=60\nWEB_BASE_URL=''\n"
 }
 eval "$(prefs_visual)"
 MAX_ATTACH_MB="${MAX_ATTACH_MB:-$MAX_ATTACHMENT_MB}"
@@ -77,17 +81,18 @@ file_bytes() {
 
 case "$MODE" in
   after)
-    TASK=""; PLATFORM=""; LABEL="screen"
+    TASK=""; PLATFORM=""; LABEL="screen"; URL=""
     while [ "$#" -gt 0 ]; do
       case "$1" in
         --task) TASK="${2:-}"; shift 2 ;;
         --platform) PLATFORM="${2:-}"; shift 2 ;;
         --label) LABEL="${2:-screen}"; shift 2 ;;
+        --url) URL="${2:-}"; shift 2 ;;
         *) echo "capture-evidence: unknown option $1" >&2; exit 2 ;;
       esac
     done
     [ -n "$TASK" ] && [ -n "$PLATFORM" ] || {
-      echo "usage: capture-evidence.sh after --task <id> --platform <ios|android> [--label <slug>]" >&2
+      echo "usage: capture-evidence.sh after --task <id> --platform <ios|android|web> [--label <slug>] [--url <addr>]" >&2
       exit 2
     }
     mkdir -p "$EVIDENCE_DIR"
@@ -112,6 +117,21 @@ case "$MODE" in
         adb exec-out screencap -p > "$OUT" 2>/dev/null || { echo "capture-evidence: no attached device" >&2; exit 4; }
         [ -s "$OUT" ] || { echo "capture-evidence: empty capture" >&2; exit 4; }
         ;;
+      web)
+        # The "device" here is the browser the test runner already drives, which
+        # is why the probe calls the runner the device for web. A URL is the one
+        # thing this platform needs and the other two do not: a simulator is
+        # already showing something, a dev server has to be pointed at.
+        [ -n "$URL" ] || URL="${WEB_BASE_URL:-}"
+        [ -n "$URL" ] || { echo "capture-evidence: no dev-server URL for the web capture (pass --url or set prefs.global.visualEvidence.webBaseUrl)" >&2; exit 4; }
+        npx --no-install playwright --version >/dev/null 2>&1 || { echo "capture-evidence: playwright is not installed in this project" >&2; exit 4; }
+        # --no-install, never a bare npx: a bare one DOWNLOADS the browser stack,
+        # turning "this project has no browser tooling" into a silent network
+        # fetch. run-ui-tests.sh carries the same rule and the same reason.
+        npx --no-install playwright screenshot --full-page --wait-for-timeout=1000 \
+          "$URL" "$OUT" >/dev/null 2>&1 || { echo "capture-evidence: playwright could not reach $URL" >&2; exit 4; }
+        [ -s "$OUT" ] || { echo "capture-evidence: empty capture" >&2; exit 4; }
+        ;;
       *) echo "capture-evidence: unsupported platform '$PLATFORM'" >&2; exit 2 ;;
     esac
 
@@ -150,14 +170,14 @@ case "$MODE" in
       esac
     done
     case "$ACTION" in start | stop) ;; *)
-      echo "usage: capture-evidence.sh video start|stop --task <id> --platform <ios|android> [--label <slug>]" >&2
+      echo "usage: capture-evidence.sh video start|stop --task <id> --platform <ios|android|web> [--label <slug>]" >&2
       exit 2 ;;
     esac
     [ -n "$TASK" ] && [ -n "$PLATFORM" ] || {
-      echo "usage: capture-evidence.sh video start|stop --task <id> --platform <ios|android> [--label <slug>]" >&2
+      echo "usage: capture-evidence.sh video start|stop --task <id> --platform <ios|android|web> [--label <slug>]" >&2
       exit 2
     }
-    case "$PLATFORM" in ios | android) ;; *)
+    case "$PLATFORM" in ios | android | web) ;; *)
       echo "capture-evidence: unsupported platform '$PLATFORM'" >&2; exit 2 ;;
     esac
 
@@ -168,6 +188,54 @@ case "$MODE" in
     WATCHFILE="$EVIDENCE_DIR/.${SLUG}.watchpid"
     REMOTE="/sdcard/_ma_${SLUG}.mp4"
 
+    # Web does not use start/stop at all, and the reason is already written in
+    # probe-evidence-capability.sh: "the recorder IS the runner". Playwright and
+    # Cypress write the video themselves, so spawning a second recorder would
+    # record the same run twice. start marks the moment; stop harvests whatever
+    # the suite produced after that moment.
+    if [ "$PLATFORM" = "web" ]; then
+      MARKER="$EVIDENCE_DIR/.${SLUG}.webrec"
+      if [ "$ACTION" = "start" ]; then
+        date +%s > "$MARKER"
+        printf '%s\n' "$OUT"
+        exit 0
+      fi
+      [ -f "$MARKER" ] || { echo "capture-evidence: no web recording was started for $SLUG" >&2; exit 4; }
+      SINCE=$(cat "$MARKER" 2>/dev/null || echo 0)
+      rm -f "$MARKER"
+      # Both runners, newest first, and only files written after the marker: a
+      # stale video from yesterday's run attached as today's evidence is worse
+      # than no video, because nobody re-checks an artefact that is present.
+      SRC=""
+      for cand in $(find test-results cypress/videos -type f \( -name '*.webm' -o -name '*.mp4' \) 2>/dev/null); do
+        [ -f "$cand" ] || continue
+        MT=$(date -r "$cand" +%s 2>/dev/null || echo 0)
+        [ "$MT" -ge "$SINCE" ] 2>/dev/null || continue
+        if [ -z "$SRC" ]; then SRC="$cand"; else
+          PREV=$(date -r "$SRC" +%s 2>/dev/null || echo 0)
+          [ "$MT" -gt "$PREV" ] 2>/dev/null && SRC="$cand"
+        fi
+      done
+      [ -n "$SRC" ] || { echo "capture-evidence: the suite recorded no video after the marker (is video enabled in the project's runner config?)" >&2; exit 4; }
+      case "$SRC" in
+        *.webm)
+          # h264 because that is what the Jira preview and the PR body can play;
+          # the iOS arm re-encodes for the same reason and says so there too.
+          if command -v ffmpeg >/dev/null 2>&1; then
+            ffmpeg -y -i "$SRC" -c:v libx264 -preset veryfast -crf 28 -an "$OUT" >/dev/null 2>&1 \
+              || { echo "capture-evidence: ffmpeg could not transcode $SRC" >&2; exit 4; }
+          else
+            OUT="${OUT%.mp4}.webm"
+            cp "$SRC" "$OUT"
+            echo "capture-evidence: ffmpeg unavailable, keeping webm  -  some viewers will not play it" >&2
+          fi
+          ;;
+        *) cp "$SRC" "$OUT" ;;
+      esac
+      printf '%s\n' "$OUT"
+      exit 0
+    fi
+
     # screenrecord's own ceiling is 180s and it is not negotiable, so a
     # maxVideoSeconds above it would silently become 180 on Android and stay
     # honoured on iOS - two platforms disagreeing about one preference. Clamp in
@@ -300,7 +368,7 @@ case "$MODE" in
 
     BASE="${FILE%.*}"; EXT="${FILE##*.}"
     case "$EXT" in
-      mp4|mov|m4v)
+      mp4|mov|m4v|webm)
         # Quality down, artefact kept. 720p + a lower bitrate clears an order of
         # magnitude; a flow video is watched for what moves, not for its pixels.
         if command -v ffmpeg >/dev/null 2>&1; then

package/pipeline/scripts/gen-ref-toc.mjs

@@ -0,0 +1,279 @@
+#!/usr/bin/env node
+// gen-ref-toc.mjs  -  a table of contents on every long reference file.
+//
+// Anthropic's published Agent Skills guidance: "For reference files longer than
+// 100 lines, include a table of contents". The reason is the same one behind
+// the one-level-deep rule - an agent that reads a long file partially needs to
+// know from the top what is further down, and without that it answers from the
+// first screen and stops.
+//
+// Generated, never hand-written. Fifty-six files' worth of hand-maintained
+// contents lists would be wrong by the second edit, and a wrong ToC is worse
+// than none: it tells a reader a section exists where it does not.
+//
+// Section level is DERIVED, not assumed. These files are not consistent: some
+// open at `##` and section at `###` (keychain.md), others open at `###` and
+// section at `##` (phases/phase-3-dev.md). The rule is the shallowest heading
+// depth that occurs more than once - a depth used exactly once is a title, not
+// a section level.
+//
+// Not every long file is eligible, and the exclusion is measured rather than
+// preferred. A contents list helps a file that is OPENED AND SKIMMED. It is
+// pure cost on a file that is loaded whole by contract, because there is no
+// partial read for it to rescue - and those files are already at their limit:
+//
+//   the 8 phase docs   a ToC each puts 5 of 8 over their per-phase max and the
+//                      aggregate 1,533 tokens over 62,700
+//   rules.md           always loaded; 59,908 of a 60,000 byte ceiling, and a
+//                      ToC takes it to 60,997
+//   the analysis refs  mounted as one set per analysis run; 158,500 byte
+//                      ceiling, and the ToCs put them 2,298 over
+//
+// So the two published rules genuinely conflict there, and the ToC is the one
+// that loses: raising either ceiling to buy navigation nobody navigates is the
+// move this repo spent a release removing.
+//
+// The exclusion is DERIVED from those two budgets, never hand-listed. A
+// document entering or leaving a budget changes its ToC status by itself, which
+// is the difference between a rule and a list somebody has to remember.
+//
+// Usage:
+//   node gen-ref-toc.mjs            write/refresh every eligible file
+//   node gen-ref-toc.mjs --check    report drift, write nothing, exit 1 if any
+//   node gen-ref-toc.mjs --stats    byte cost, write nothing
+//   node gen-ref-toc.mjs --verify   every generated anchor resolves to a heading
+
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const REFS = join(ROOT, "pipeline", "multi-agent-refs");
+const MIN_LINES = 100;
+const MARK_OPEN = "<!-- toc -->";
+const MARK_CLOSE = "<!-- /toc -->";
+
+// Every file that some other gate already holds to a byte or token ceiling.
+function budgeted() {
+  const out = new Set();
+  const budget = JSON.parse(readFileSync(join(ROOT, "pipeline/schemas/token-budget.json"), "utf8"));
+  for (const phase of Object.keys(budget.phases)) {
+    out.add(join(REFS, "phases", `${phase}.md`));
+  }
+  // The always-loaded set, read out of the gate that owns it rather than copied.
+  const ctx = readFileSync(join(ROOT, "pipeline/scripts/smoke-context-budget.sh"), "utf8");
+  const block = ctx.match(/TRACKED="\n([\s\S]*?)"/);
+  if (block) {
+    for (const line of block[1].split("\n")) {
+      const t = line.trim();
+      if (t) out.add(join(ROOT, t));
+    }
+  }
+
+  // The analysis set, mounted whole per analysis run under its own ceiling. Same
+  // two globs that gate uses - `analysis/<name>.md` named by the analysis
+  // command, plus every analysis-template*.md.
+  const cmd = readFileSync(join(ROOT, "pipeline/commands/multi-agent/analysis/SKILL.md"), "utf8");
+  for (const m of cmd.matchAll(/analysis\/[a-z-]+\.md/g)) out.add(join(REFS, m[0]));
+  for (const e of readdirSync(REFS, { withFileTypes: true })) {
+    if (e.isFile() && /^analysis-template.*\.md$/.test(e.name)) out.add(join(REFS, e.name));
+  }
+  return out;
+}
+
+function walk(dir, out = []) {
+  for (const e of readdirSync(dir, { withFileTypes: true })) {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) walk(p, out);
+    else if (e.name.endsWith(".md")) out.push(p);
+  }
+  return out;
+}
+
+// GitHub's anchor rule, which is what a `](#...)` link resolves against.
+function slug(text) {
+  return text
+    .toLowerCase()
+    .replace(/`/g, "")
+    .replace(/\[([^\]]*)\]\([^)]*\)/g, "$1")
+    .replace(/[^\w\s-]/g, "")
+    .trim()
+    .replace(/\s+/g, "-");
+}
+
+function sections(lines) {
+  const heads = [];
+  let fenced = false;
+  lines.forEach((l, i) => {
+    if (/^\s*```/.test(l)) fenced = !fenced;
+    if (fenced) return;
+    const m = l.match(/^(#{1,6})\s+(.*\S)\s*$/);
+    if (m) heads.push({ depth: m[1].length, text: m[2], line: i });
+  });
+  if (!heads.length) return { level: 0, heads: [] };
+  const counts = {};
+  for (const h of heads) counts[h.depth] = (counts[h.depth] || 0) + 1;
+  const depths = Object.keys(counts)
+    .map(Number)
+    .sort((a, b) => a - b);
+  // The shallowest depth used more than once. A depth used exactly once is the
+  // document's title and listing it as the only entry is a ToC of one.
+  const level = depths.find((d) => counts[d] > 1) ?? depths[depths.length - 1];
+  return { level, heads: heads.filter((h) => h.depth === level) };
+}
+
+function render(heads) {
+  const seen = new Map();
+  const rows = heads.map((h) => {
+    let a = slug(h.text);
+    const n = (seen.get(a) || 0) + 1;
+    seen.set(a, n);
+    if (n > 1) a = `${a}-${n - 1}`;
+    return `- [${h.text.replace(/\|/g, "\\|")}](#${a})`;
+  });
+  return [MARK_OPEN, ...rows, MARK_CLOSE].join("\n");
+}
+
+// After the frontmatter and after the first heading, so the reader sees what the
+// file IS before a list of what is in it.
+function insertionPoint(lines) {
+  let i = 0;
+  if (lines[0] === "---") {
+    i = 1;
+    while (i < lines.length && lines[i] !== "---") i += 1;
+    i += 1;
+  }
+  for (let j = i; j < lines.length; j += 1) {
+    if (/^#{1,6}\s/.test(lines[j])) return j + 1;
+  }
+  return i;
+}
+
+const BUDGETED = budgeted();
+const excluded = [];
+const files = walk(REFS)
+  .filter((f) => readFileSync(f, "utf8").split("\n").length - 1 > MIN_LINES)
+  .filter((f) => {
+    if (!BUDGETED.has(f)) return true;
+    excluded.push(relative(ROOT, f));
+    return false;
+  })
+  .sort();
+
+// Does every `](#anchor)` in a generated block name a heading that exists in the
+// same file? --check cannot answer that: it compares the file against THIS
+// script's output, so a wrong slug rule agrees with itself. This validates the
+// rule against the real headings instead, and it lives here so there is one
+// definition of `slug`, not a second copy inside a gate.
+if (process.argv.includes("--verify")) {
+  let total = 0;
+  const bad = [];
+  for (const f of walk(REFS)) {
+    const raw = readFileSync(f, "utf8");
+    if (!raw.includes(MARK_OPEN)) continue;
+    const lines = raw.split("\n");
+    const seen = new Map();
+    const anchors = new Set();
+    let fenced = false;
+    for (const l of lines) {
+      if (/^\s*```/.test(l)) fenced = !fenced;
+      if (fenced) continue;
+      const m = l.match(/^#{1,6}\s+(.*\S)\s*$/);
+      if (!m) continue;
+      let a = slug(m[1]);
+      const n = (seen.get(a) || 0) + 1;
+      seen.set(a, n);
+      if (n > 1) a = `${a}-${n - 1}`;
+      anchors.add(a);
+    }
+    const s0 = lines.indexOf(MARK_OPEN);
+    const e0 = lines.indexOf(MARK_CLOSE, s0);
+    for (const l of lines.slice(s0 + 1, e0)) {
+      const m = l.match(/\]\(#(.+)\)\s*$/);
+      if (!m) continue;
+      total += 1;
+      if (!anchors.has(m[1])) bad.push(`${relative(ROOT, f)} -> #${m[1]}`);
+    }
+  }
+  if (total === 0) {
+    console.log("gen-ref-toc: no anchors found at all - the generator produced nothing");
+    process.exit(1);
+  }
+  if (bad.length) {
+    console.log(`gen-ref-toc: ${bad.length} of ${total} anchor(s) point at no heading:`);
+    for (const b of bad.slice(0, 10)) console.log(`  ${b}`);
+    process.exit(1);
+  }
+  console.log(`gen-ref-toc: ${total} anchors, all resolve to a heading in their own file`);
+  process.exit(0);
+}
+
+const mode = process.argv.includes("--check")
+  ? "check"
+  : process.argv.includes("--stats")
+    ? "stats"
+    : "write";
+
+const drifted = [];
+const skipped = [];
+let added = 0;
+
+for (const f of files) {
+  const raw = readFileSync(f, "utf8");
+  const rel = relative(ROOT, f);
+  const lines = raw.split("\n");
+  const { heads } = sections(lines);
+  // Fewer than three sections is a file that does not need a map of itself.
+  if (heads.length < 3) {
+    skipped.push(`${rel} (${heads.length} section(s))`);
+    continue;
+  }
+  const block = render(heads);
+
+  const start = lines.indexOf(MARK_OPEN);
+  let next;
+  if (start !== -1) {
+    const end = lines.indexOf(MARK_CLOSE, start);
+    if (end === -1) {
+      drifted.push(`${rel}: ${MARK_OPEN} with no ${MARK_CLOSE}`);
+      continue;
+    }
+    const current = lines.slice(start, end + 1).join("\n");
+    if (current === block) continue;
+    next = [...lines.slice(0, start), ...block.split("\n"), ...lines.slice(end + 1)];
+    drifted.push(`${rel}: contents no longer match the headings`);
+  } else {
+    const at = insertionPoint(lines);
+    next = [...lines.slice(0, at), "", ...block.split("\n"), ...lines.slice(at)];
+    drifted.push(`${rel}: no table of contents`);
+  }
+  const out = next.join("\n");
+  added += out.length - raw.length;
+  if (mode === "write") writeFileSync(f, out);
+}
+
+if (mode === "stats") {
+  console.log(`eligible: ${files.length} ref files over ${MIN_LINES} lines`);
+  console.log(`excluded as loaded-whole-by-contract: ${excluded.length}`);
+  console.log(`skipped (under 3 sections): ${skipped.length}`);
+  console.log(
+    `would add: ${added} bytes total, ~${Math.round(added / 4)} tokens if every one were read`,
+  );
+  process.exit(0);
+}
+
+if (mode === "check") {
+  if (drifted.length === 0) {
+    console.log(`gen-ref-toc: ${files.length} long ref(s) carry a current table of contents`);
+    process.exit(0);
+  }
+  console.log(
+    `gen-ref-toc: ${drifted.length} file(s) need \`node pipeline/scripts/gen-ref-toc.mjs\`:`,
+  );
+  for (const d of drifted) console.log(`  ${d}`);
+  process.exit(1);
+}
+
+console.log(
+  `gen-ref-toc: ${drifted.length} file(s) updated, ${skipped.length} skipped, ${added} bytes added`,
+);

package/pipeline/scripts/jira-search.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+#
+# jira-search.sh  -  run one JQL query and print Jira's own JSON.
+#
+# A thin front door onto `jira_search` in lib/issue-fetcher.sh, which owns the
+# credential resolution, the host lookup and the rule that a token never reaches
+# argv. This file adds exactly two things that function does not do for itself:
+# it resolves the account from preferences, and it URL-encodes the JQL.
+#
+# The encoding is not a detail. A JQL carrying a quoted label, a space or an
+# `=` reaches the server mangled otherwise, and the failure is a 400 that reads
+# like a permissions problem. python3 does it correctly; the shell does not.
+#
+# Usage:
+#   jira-search.sh --jql '<JQL>' [--fields key,summary,priority,created] [--max 50]
+#
+# Exit: 0 with JSON on stdout, 1 when the query failed (a warning on stderr,
+# never a token).
+
+set -uo pipefail
+
+JQL=""
+FIELDS="key,summary,status,priority,created"
+MAXR=50
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --jql) JQL="${2:-}"; shift 2 ;;
+    --fields) FIELDS="${2:-}"; shift 2 ;;
+    --max) MAXR="${2:-}"; shift 2 ;;
+    -h | --help) grep -E '^#( |$)' "$0" | sed -E 's/^# ?//'; exit 0 ;;
+    *) echo "jira-search: unknown option $1" >&2; exit 2 ;;
+  esac
+done
+[ -n "$JQL" ] || { echo "jira-search: --jql is required" >&2; exit 2; }
+
+PREFS="${MA_PREFS_FILE:-$HOME/.claude/multi-agent-preferences.json}"
+[ -f "$PREFS" ] || { echo "jira-search: no preferences file" >&2; exit 1; }
+
+# Host and the LOGICAL key name, never the literal Keychain service name: the
+# mapping is per-user and resolving it here is what keeps the service name out
+# of every synced file.
+eval "$(python3 - "$PREFS" <<'PY'
+import json, sys, shlex
+try:
+    g = json.load(open(sys.argv[1]))["global"]
+except Exception:
+    g = {}
+host = (g.get("hosts") or {}).get("jira", "")
+key = (g.get("keychainMapping") or {}).get("jira", "")
+print(f"ACCOUNT_JIRA_HOST={shlex.quote(host)}")
+print(f"ACCOUNT_JIRA_TOKEN_KEY={shlex.quote(key)}")
+PY
+)"
+export ACCOUNT_JIRA_HOST ACCOUNT_JIRA_TOKEN_KEY
+[ -n "$ACCOUNT_JIRA_HOST" ] && [ -n "$ACCOUNT_JIRA_TOKEN_KEY" ] || {
+  echo "jira-search: jira is not onboarded (host or keychainMapping.jira missing)" >&2
+  exit 1
+}
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+for cand in "$HERE/../lib/issue-fetcher.sh" "$HOME/.claude/lib/issue-fetcher.sh"; do
+  [ -f "$cand" ] && { . "$cand"; break; }
+done
+command -v jira_search >/dev/null 2>&1 || {
+  echo "jira-search: issue-fetcher.sh not found" >&2
+  exit 1
+}
+
+ENCODED=$(printf '%s' "$JQL" | python3 -c 'import sys,urllib.parse; print(urllib.parse.quote(sys.stdin.read()))')
+jira_search "$ENCODED" "$FIELDS" "$MAXR"