@mseep/open-computer-use 1.0.0

package/tests/test_init_sh_unchanged.sh

@@ -0,0 +1,49 @@
+#!/bin/bash
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+# TEST-05: openwebui/init.sh must byte-equal the v0.9.2.0 baseline.
+#
+# Milestone v0.9.2.1 explicitly forbids modifying init.sh — saved-memory hard
+# rule (feedback_init_sh_marker.md) and Pitfall 10 in PITFALLS.md. The init
+# script is marker-gated: env->Valve is a one-shot bootstrap, NOT a sync that
+# rewrites Valves on every restart (which would annoy operators by clobbering
+# their UI tweaks). Any byte change here is a regression.
+#
+# If a future milestone genuinely needs to edit init.sh, bump the EXPECTED
+# constant in this script in the same commit.
+
+set -euo pipefail
+
+ROOT="${1:-$(cd "$(dirname "$0")/.." && pwd)}"
+INIT_SH="$ROOT/openwebui/init.sh"
+
+EXPECTED="31ce03b67804ed11c5a5e42be8364c0adfedd356d1e9aed9ce87e8318c9c27a7"
+
+if [ ! -f "$INIT_SH" ]; then
+    echo "FAIL: $INIT_SH does not exist."
+    exit 1
+fi
+
+if command -v sha256sum >/dev/null 2>&1; then
+    ACTUAL=$(sha256sum "$INIT_SH" | awk '{print $1}')
+elif command -v shasum >/dev/null 2>&1; then
+    ACTUAL=$(shasum -a 256 "$INIT_SH" | awk '{print $1}')
+else
+    echo "FAIL: neither sha256sum nor shasum is available on this system."
+    exit 1
+fi
+
+if [ "$ACTUAL" != "$EXPECTED" ]; then
+    echo "FAIL: openwebui/init.sh has been modified."
+    echo "  Expected sha256: $EXPECTED (v0.9.2.0 baseline)"
+    echo "  Actual sha256:   $ACTUAL"
+    echo "  Milestone v0.9.2.1 forbids modifying init.sh — see PITFALLS Pitfall 10"
+    echo "  and saved memory feedback_init_sh_marker.md. The file must stay"
+    echo "  byte-identical to the v0.9.2.0 baseline because init.sh is"
+    echo "  marker-gated: env->Valve is a one-shot bootstrap, not a sync."
+    echo "  If this edit is intentional in a later milestone, bump EXPECTED in"
+    echo "  tests/test_init_sh_unchanged.sh in the same commit."
+    exit 1
+fi
+
+echo "PASS: openwebui/init.sh matches v0.9.2.0 baseline (sha256 $EXPECTED)."

package/tests/test_opencode_alias_map_drop.py

@@ -0,0 +1,144 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""TEST-02-01: D-05 / D-06 — empty _OPENCODE_ALIAS_MAP and raising _resolve_opencode.
+
+Covers:
+  1. _OPENCODE_ALIAS_MAP literal is {} (no Anthropic baseline)
+  2. _merge_opencode_alias_map() with OPENCODE_MODEL_ALIASES unset returns {}
+  3. _resolve_opencode("sonnet", "sonnet") with env unset raises ValueError
+  4. ValueError message contains required substrings per D-06
+  5. With OPENCODE_MODEL_ALIASES='{"sonnet":"anthropic/claude-sonnet-4-6"}',
+     _resolve_opencode("sonnet", "sonnet") returns ("anthropic/claude-sonnet-4-6", "sonnet")
+  6. Provider/model pass-through: "openrouter/qwen/qwen-3-coder" (contains '/')
+     bypasses alias map and returns verbatim
+
+Env-scrub pattern mirrors tests/orchestrator/test_sub_agent_dispatch.py:48-55
+so local-dev shells with model-override env vars do not break assertions.
+"""
+
+import importlib
+import os
+import sys
+
+import pytest
+
+_SERVER_DIR = os.path.join(
+    os.path.dirname(__file__), "..", "computer-use-server"
+)
+sys.path.insert(0, _SERVER_DIR)
+
+# Env vars that could affect opencode alias resolution — scrub before each test.
+_OPENCODE_ENV_VARS = (
+    "OPENCODE_MODEL_ALIASES",
+    "OPENCODE_SUB_AGENT_DEFAULT_MODEL",
+    "OPENCODE_MODEL",
+)
+
+
+def _drop_modules():
+    """Drop cli_runtime + docker_manager so the next import re-reads env."""
+    for mod in ("cli_runtime", "docker_manager"):
+        sys.modules.pop(mod, None)
+
+
+def _import_cli_runtime():
+    _drop_modules()
+    return importlib.import_module("cli_runtime")
+
+
+@pytest.fixture(autouse=True)
+def _scrub_opencode_env(monkeypatch):
+    """Scrub opencode-related env vars before each test."""
+    for var in _OPENCODE_ENV_VARS:
+        monkeypatch.delenv(var, raising=False)
+    yield
+    _drop_modules()
+
+
+# ---------------------------------------------------------------------------
+# Test 1: _OPENCODE_ALIAS_MAP literal is empty dict
+# ---------------------------------------------------------------------------
+
+def test_opencode_alias_map_is_empty_dict():
+    """D-05: _OPENCODE_ALIAS_MAP must be an empty dict — no Anthropic baseline."""
+    cli_runtime = _import_cli_runtime()
+    assert cli_runtime._OPENCODE_ALIAS_MAP == {}, (
+        f"Expected _OPENCODE_ALIAS_MAP == {{}} but got {cli_runtime._OPENCODE_ALIAS_MAP!r}"
+    )
+
+
+# ---------------------------------------------------------------------------
+# Test 2: _merge_opencode_alias_map() with no env returns {}
+# ---------------------------------------------------------------------------
+
+def test_merge_opencode_alias_map_no_env_returns_empty():
+    """D-05: with OPENCODE_MODEL_ALIASES unset, merged map is empty."""
+    cli_runtime = _import_cli_runtime()
+    result = cli_runtime._merge_opencode_alias_map()
+    assert result == {}, (
+        f"Expected empty merged map but got {result!r}"
+    )
+
+
+# ---------------------------------------------------------------------------
+# Test 3: _resolve_opencode raises ValueError for unresolvable alias
+# ---------------------------------------------------------------------------
+
+def test_resolve_opencode_missing_alias_raises_value_error():
+    """D-06: alias 'sonnet' not in map, no env default -> ValueError."""
+    cli_runtime = _import_cli_runtime()
+    with pytest.raises(ValueError):
+        cli_runtime._resolve_opencode("sonnet", "sonnet")
+
+
+# ---------------------------------------------------------------------------
+# Test 4: ValueError message contains required D-06 substrings
+# ---------------------------------------------------------------------------
+
+def test_resolve_opencode_missing_alias_error_message():
+    """D-06: error message must name the alias, OPENCODE_MODEL_ALIASES, list-subagent-models."""
+    cli_runtime = _import_cli_runtime()
+    with pytest.raises(ValueError) as exc_info:
+        cli_runtime._resolve_opencode("sonnet", "sonnet")
+    msg = str(exc_info.value)
+    assert "alias 'sonnet' is not defined" in msg, (
+        f"Error message missing \"alias 'sonnet' is not defined\": {msg!r}"
+    )
+    assert "OPENCODE_MODEL_ALIASES" in msg, (
+        f"Error message missing 'OPENCODE_MODEL_ALIASES': {msg!r}"
+    )
+    assert "list-subagent-models" in msg, (
+        f"Error message missing 'list-subagent-models': {msg!r}"
+    )
+
+
+# ---------------------------------------------------------------------------
+# Test 5: With OPENCODE_MODEL_ALIASES env set, alias resolves correctly
+# ---------------------------------------------------------------------------
+
+def test_resolve_opencode_alias_via_env(monkeypatch):
+    """D-05 / D-06: operator-supplied alias in OPENCODE_MODEL_ALIASES resolves."""
+    monkeypatch.setenv(
+        "OPENCODE_MODEL_ALIASES",
+        '{"sonnet": "anthropic/claude-sonnet-4-6"}',
+    )
+    cli_runtime = _import_cli_runtime()
+    model_id, display = cli_runtime._resolve_opencode("sonnet", "sonnet")
+    assert model_id == "anthropic/claude-sonnet-4-6"
+    assert display == "sonnet"
+
+
+# ---------------------------------------------------------------------------
+# Test 6: Provider/model pass-through — string with '/' bypasses alias map
+# ---------------------------------------------------------------------------
+
+def test_resolve_opencode_provider_model_passthrough():
+    """Existing pass-through: 'openrouter/qwen/qwen-3-coder' (contains '/')
+    is returned verbatim — alias map lookup skipped."""
+    cli_runtime = _import_cli_runtime()
+    model_id, display = cli_runtime._resolve_opencode(
+        "openrouter/qwen/qwen-3-coder",
+        "openrouter/qwen/qwen-3-coder",
+    )
+    assert model_id == "openrouter/qwen/qwen-3-coder"
+    assert display == "openrouter/qwen/qwen-3-coder"

package/tests/test_requirements.py

@@ -0,0 +1,91 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Regression guard for security-critical dependency versions.
+
+Ensures that patched CVE versions from PR #22 are not accidentally downgraded.
+
+Run: python -m pytest tests/test_requirements.py -v
+"""
+
+import re
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def _parse_version(req_path: Path, package: str):
+    """Return pinned version as int tuple, e.g. (12, 1, 1). Returns None if not found."""
+    pattern = re.compile(rf'^{re.escape(package)}==(.+)$', re.IGNORECASE)
+    for line in req_path.read_text().splitlines():
+        m = pattern.match(line.strip())
+        if m:
+            return tuple(int(x) for x in m.group(1).split("."))
+    return None
+
+
+class TestSandboxDependencyVersions(unittest.TestCase):
+    """Security-patched versions in requirements.txt (sandbox / Dockerfile)."""
+
+    REQ = ROOT / "requirements.txt"
+
+    def _assert_at_least(self, package, min_version):
+        found = _parse_version(self.REQ, package)
+        self.assertIsNotNone(found, f"{package} not found in {self.REQ}")
+        self.assertGreaterEqual(
+            found,
+            min_version,
+            f"{package}=={'.'.join(map(str, found))} is below required "
+            f">={'.'.join(map(str, min_version))} (CVE patch)",
+        )
+
+    def test_pillow_at_least_12_1_1(self):
+        """CVE: PSD out-of-bounds write. Pillow 12 also changed Image.LANCZOS API."""
+        self._assert_at_least("pillow", (12, 1, 1))
+
+    def test_urllib3_at_least_2_6_3(self):
+        """CVE: decompression bomb + redirect bypass."""
+        self._assert_at_least("urllib3", (2, 6, 3))
+
+    def test_cryptography_at_least_46_0_6(self):
+        """CVE: SECT curves subgroup attack."""
+        self._assert_at_least("cryptography", (46, 0, 6))
+
+    def test_pyjwt_at_least_2_12_1(self):
+        """CVE: critical header extensions bypass."""
+        self._assert_at_least("PyJWT", (2, 12, 1))
+
+    def test_pdfminer_six_at_least_20251230(self):
+        """CVE: pickle deserialization RCE. Version is a date integer."""
+        found = _parse_version(self.REQ, "pdfminer.six")
+        self.assertIsNotNone(found, f"pdfminer.six not found in {self.REQ}")
+        # Version is a single date integer like 20251230
+        self.assertGreaterEqual(
+            found[0],
+            20251230,
+            f"pdfminer.six=={found[0]} is below required >=20251230 (CVE patch)",
+        )
+
+    def test_pdfplumber_at_least_0_11_9(self):
+        """Bumped to satisfy pdfminer.six constraint."""
+        self._assert_at_least("pdfplumber", (0, 11, 9))
+
+
+class TestOrchestratorDependencyVersions(unittest.TestCase):
+    """Security-patched versions in computer-use-server/requirements.txt."""
+
+    REQ = ROOT / "computer-use-server" / "requirements.txt"
+
+    def test_python_multipart_at_least_0_0_22(self):
+        """CVE patch for python-multipart."""
+        found = _parse_version(self.REQ, "python-multipart")
+        self.assertIsNotNone(found, f"python-multipart not found in {self.REQ}")
+        self.assertGreaterEqual(
+            found,
+            (0, 0, 22),
+            f"python-multipart=={'.'.join(map(str, found))} is below required >=0.0.22",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_subagent_docstring.py

@@ -0,0 +1,193 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for per-CLI sub_agent docstring variants (REQ-MCP-01 / Plan 01-04).
+
+Tests the _subagent_docstring_for_cli helper and related constants directly
+from source without importing the full mcp_tools module (which requires the
+docker/mcp runtime environment).
+
+Run: python -m pytest tests/test_subagent_docstring.py -v
+"""
+
+import re
+import sys
+import types
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+SRC = ROOT / "computer-use-server" / "mcp_tools.py"
+
+
+def _load_docstring_helpers():
+    """Extract and exec only the docstring-related portion of mcp_tools.py.
+
+    Avoids importing the full module (which requires mcp, docker, etc.).
+    Returns a module-like namespace with the three constants and the helper.
+    """
+    src = SRC.read_text()
+
+    # Extract lines from _SUBAGENT_DOC_CLAUDE through end of _subagent_docstring_for_cli
+    lines = src.splitlines()
+    start = None
+    end = None
+    for i, line in enumerate(lines):
+        if start is None and line.startswith("_SUBAGENT_DOC_CLAUDE = "):
+            start = i
+        if start is not None and line.startswith("    return _SUBAGENT_DOC_CLAUDE"):
+            end = i + 1
+            break
+
+    assert start is not None, "Could not find _SUBAGENT_DOC_CLAUDE in mcp_tools.py"
+    assert end is not None, "Could not find end of _subagent_docstring_for_cli"
+
+    snippet = "\n".join(lines[start:end])
+    ns: dict = {}
+    exec(compile(snippet, str(SRC), "exec"), ns)  # noqa: S102
+    return ns
+
+
+_NS = _load_docstring_helpers()
+
+
+class TestSubagentDocstringForCli(unittest.TestCase):
+    """_subagent_docstring_for_cli returns the correct variant per CLI."""
+
+    def _doc(self, cli: str) -> str:
+        return _NS["_subagent_docstring_for_cli"](cli)
+
+    # --- list-subagent-models redirect in all variants ---
+
+    def test_claude_has_list_subagent_models_redirect(self):
+        assert "list-subagent-models" in self._doc("claude")
+
+    def test_opencode_has_list_subagent_models_redirect(self):
+        assert "list-subagent-models" in self._doc("opencode")
+
+    def test_codex_has_list_subagent_models_redirect(self):
+        assert "list-subagent-models" in self._doc("codex")
+
+    # --- claude variant contains all three aliases ---
+
+    def test_claude_contains_sonnet(self):
+        assert "sonnet" in self._doc("claude")
+
+    def test_claude_contains_opus(self):
+        assert "opus" in self._doc("claude")
+
+    def test_claude_contains_haiku(self):
+        assert "haiku" in self._doc("claude")
+
+    # --- codex variant is alias-free ---
+
+    def test_codex_no_bare_sonnet(self):
+        assert "sonnet" not in self._doc("codex").lower()
+
+    def test_codex_no_bare_opus(self):
+        assert "opus" not in self._doc("codex").lower()
+
+    def test_codex_no_bare_haiku(self):
+        assert "haiku" not in self._doc("codex").lower()
+
+    # --- opencode variant does not expose bare Claude aliases ---
+
+    def test_opencode_no_bare_haiku(self):
+        # 'haiku' must not appear as a bare alias (only as part of provider/model is OK)
+        doc = self._doc("opencode")
+        # Allow 'anthropic/claude-haiku-*' but not standalone 'haiku'
+        without_provider = re.sub(r'anthropic/claude-\S+', '', doc)
+        assert "haiku" not in without_provider.lower()
+
+    # --- unknown CLI falls back to claude ---
+
+    def test_unknown_cli_falls_back_to_claude(self):
+        assert self._doc("unknown") == self._doc("claude")
+
+    def test_empty_cli_falls_back_to_claude(self):
+        assert self._doc("") == self._doc("claude")
+
+    # --- OPENCODE_MODEL_ALIASES hint present in opencode variant ---
+
+    def test_opencode_mentions_alias_env(self):
+        assert "OPENCODE_MODEL_ALIASES" in self._doc("opencode")
+
+    # --- per-CLI env var hints present ---
+
+    def test_claude_mentions_claude_env(self):
+        assert "CLAUDE_SUB_AGENT_DEFAULT_MODEL" in self._doc("claude")
+
+    def test_opencode_mentions_opencode_env(self):
+        assert "OPENCODE_SUB_AGENT_DEFAULT_MODEL" in self._doc("opencode")
+
+    def test_codex_mentions_codex_env(self):
+        assert "CODEX_SUB_AGENT_DEFAULT_MODEL" in self._doc("codex")
+
+
+class TestMcpToolsStructure(unittest.TestCase):
+    """Static source checks on mcp_tools.py registration structure."""
+
+    def setUp(self):
+        self.src = SRC.read_text()
+
+    def test_no_decorator_on_sub_agent(self):
+        """@mcp.tool() decorator must not appear on the sub_agent def."""
+        lines = self.src.splitlines()
+        for i, line in enumerate(lines):
+            if "async def sub_agent(" in line:
+                # Check two lines above for @mcp.tool()
+                preceding = lines[max(0, i - 3):i]
+                for prev in preceding:
+                    self.assertNotIn("@mcp.tool()", prev,
+                                     "sub_agent still has @mcp.tool() decorator")
+                break
+        else:
+            self.fail("Could not find async def sub_agent")
+
+    def test_doc_assignment_present(self):
+        """sub_agent.__doc__ = _subagent_docstring_for_cli(...) must be present."""
+        assert "sub_agent.__doc__ = _subagent_docstring_for_cli" in self.src
+
+    def test_mcp_add_tool_call_present(self):
+        """mcp.add_tool(sub_agent) must be present (not counting comments)."""
+        code_lines = [line for line in self.src.splitlines()
+                      if "mcp.add_tool(sub_agent)" in line and not line.strip().startswith("#")]
+        self.assertEqual(len(code_lines), 1,
+                         f"Expected exactly 1 mcp.add_tool(sub_agent) call, found: {code_lines}")
+
+    def test_no_sub_agent_default_model_usage(self):
+        """Legacy bare SUB_AGENT_DEFAULT_MODEL must be absent; per-CLI env must be documented.
+
+        Phase 2 D-03: the legacy global is removed from docker_manager.py and the
+        module docstring is updated to document the three per-CLI env vars instead.
+        This assertion verifies the docstring update happened.
+
+        Note: check for the bare legacy name without a CLI prefix (CLAUDE_/OPENCODE_/CODEX_).
+        The per-CLI variants CLAUDE_SUB_AGENT_DEFAULT_MODEL etc. are expected and fine.
+        """
+        import re
+        # The legacy line was "- SUB_AGENT_DEFAULT_MODEL: Default model ..."
+        # Per-CLI lines like "- CLAUDE_SUB_AGENT_DEFAULT_MODEL: ..." are OK.
+        legacy_pattern = re.compile(r'(?<![A-Z_])SUB_AGENT_DEFAULT_MODEL: Default model')
+        assert not legacy_pattern.search(self.src), (
+            "Legacy bare SUB_AGENT_DEFAULT_MODEL docstring entry still present in mcp_tools.py"
+        )
+        assert "CLAUDE_SUB_AGENT_DEFAULT_MODEL" in self.src, (
+            "CLAUDE_SUB_AGENT_DEFAULT_MODEL must be documented in mcp_tools.py module docstring"
+        )
+
+    def test_resolve_subagent_model_used(self):
+        """resolve_subagent_model with empty string and resolved cli must be the fallback.
+
+        WR-03: the call was moved inside the try block and now uses the already-resolved
+        cli variable (resolve_subagent_model("", cli)) rather than calling resolve_cli()
+        a second time inline.
+        """
+        # Accept either form: original inline call or the refactored cli-variable form
+        assert (
+            'resolve_subagent_model("", resolve_cli())' in self.src
+            or 'resolve_subagent_model("", cli)' in self.src
+        ), "resolve_subagent_model with empty string fallback not found in sub_agent"
+
+
+if __name__ == "__main__":
+    unittest.main()

package/tests/test_tools.py

@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: FSL-1.1-Apache-2.0
+# Copyright (c) 2025 Open Computer Use Contributors
+"""Tests for computer_use_tools (Open WebUI Tool).
+
+Run: python -m pytest tests/test_tools.py -v
+"""
+
+import sys
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "openwebui" / "tools"))
+
+import computer_use_tools  # noqa: E402
+
+
+class ValveSchema(unittest.TestCase):
+    """v4.0.0: Tool Valve renamed FILE_SERVER_URL → ORCHESTRATOR_URL for
+    consistency with the filter. Semantics unchanged — still the internal URL
+    of the Computer Use server for MCP forwarding.
+    """
+
+    def test_orchestrator_url_valve_exists(self):
+        valve_fields = set(computer_use_tools.Tools.Valves.model_fields.keys())
+        self.assertIn("ORCHESTRATOR_URL", valve_fields)
+
+    def test_file_server_url_valve_removed(self):
+        valve_fields = set(computer_use_tools.Tools.Valves.model_fields.keys())
+        self.assertNotIn("FILE_SERVER_URL", valve_fields)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/vendor/extract-text/README.md

@@ -0,0 +1,46 @@
+# `extract-text`
+
+Vendored binary used by the `file-reading` and `pdf-reading` skills.
+
+## What it is
+
+`extract-text` is a Rust CLI built by Anthropic for unified plain-text extraction across document formats:
+
+- **docx / odt / epub** → Markdown (headings, bold, lists, links, tables)
+- **xlsx** → tab-separated rows under `## Sheet:` headers
+- **pptx** → text under `## Slide N` headers
+- **ipynb** → fenced code cells
+- **rtf / html / htm** → plain text
+
+Architecture: x86_64 ELF, dynamically linked, ~2 MB.
+
+**This binary is x86_64-only.** Building the image under `linux/arm64`
+(Apple Silicon, AWS Graviton without emulation) will produce a
+non-functional binary — `extract-text /path/to/file.docx` segfaults
+under qemu emulation. The project `CLAUDE.md` mandates
+`docker build --platform linux/amd64`; honor that. For native arm64
+deployments, either run amd64 under qemu (slow) or remove the `COPY`
+line in `Dockerfile` and rely on the open-source fallbacks
+(pandoc / python-docx / openpyxl / python-pptx / nbconvert) documented
+in `skills/public/file-reading/SKILL.md`.
+
+## Why it lives here
+
+The binary is bundled into the sandbox image at `/usr/local/bin/extract-text` by the `Dockerfile`:
+
+```dockerfile
+COPY --chown=root:root vendor/extract-text/extract-text /usr/local/bin/extract-text
+RUN chmod +x /usr/local/bin/extract-text
+```
+
+The skills under `/mnt/skills/public/file-reading/` and `/mnt/skills/public/pdf-reading/` shell out to it as their first move for the formats listed above.
+
+## Licensing
+
+This binary is part of Anthropic's Skill bundle. Use is governed by your Anthropic agreement (Commercial Terms, Consumer Terms, or a separate written agreement). See `skills/README.md` in the project root for the full disclaimer that applies to all Anthropic-authored materials in this repository.
+
+If your deployment is not covered by an Anthropic agreement, remove this directory and the matching `COPY` line in the `Dockerfile`. The dispatch tables in `file-reading/SKILL.md` and `pdf-reading/SKILL.md` document open-source fallbacks (`pandoc`, `python-docx`, `openpyxl`, `python-pptx`, `nbconvert`) that work without `extract-text`.
+
+## Followup
+
+A future patch should replace this vendored binary with a build-time `curl` + `sha256sum -c` step pulling from a signed release URL, so the blob does not live in git history.