@stravica-ai/digital-operator-pa 0.1.0

package/dist/engineering-pa-cli/src/coordinator-hook/policy.mjs

@@ -0,0 +1,211 @@
+// policy.mjs — the three-tier decision engine.
+//
+// Pure function of (toolName, toolInput, config, context) -> a decision.
+// No I/O here — cli.mjs does the stdin/env/config-loading plumbing and
+// hands this module plain data, so the allowlist-matching logic itself is
+// trivially unit-testable without spawning a process or touching disk.
+//
+// NB: this module only ever runs for tools in the PreToolUse matcher
+// (^(Bash|Read|Write|Edit|NotebookEdit|Grep|Glob|WebFetch|WebSearch)$) —
+// tier1 tools never reach the hook at all, so there is no tier1 branch
+// here; config.tier1 exists purely as documentation (see config file
+// comment).
+
+import { relative, resolve } from 'node:path';
+
+/**
+ * @param {string} toolName
+ * @param {object} toolInput
+ * @param {object} config effective (core + overlays) merged config
+ * @param {object} context
+ * @param {string} context.cwd - cwd from the PreToolUse payload
+ * @param {string|null} context.repoRoot - resolved repo root, or null
+ * @param {string|null} context.selfAgent - resolved paName, or null
+ * @returns {{decision: 'allow'|'block', tier: string, reason: string, matched: (string|null)}}
+ */
+export function decide(toolName, toolInput, config, context = {}) {
+  if (config.tier3.includes(toolName)) {
+    return block('tier3', `${toolName} is always-blocked under coordinator mode`, null);
+  }
+
+  if (toolName === 'Bash') return decideBash(toolInput, config);
+  if (toolName === 'Read') return decideReadOrWrite('Read', toolInput, config, context);
+  if (toolName === 'Write') return decideReadOrWrite('Write', toolInput, config, context);
+
+  // Any tool reaching the hook that is neither tier3 nor one of the three
+  // argument-gated tier2 tools is unrecognised under this policy — default
+  // deny, never default allow. (In practice the matcher regex means this
+  // can only happen if the settings.json snippet's matcher is edited to
+  // add a tool this policy doesn't know about yet.)
+  return block('unrecognised', `${toolName} is not covered by the coordinator policy (matcher/config drift) — defaulting to deny`, null);
+}
+
+function allow(tier, reason, matched) {
+  return { decision: 'allow', tier, reason, matched: matched ?? null };
+}
+
+function block(tier, reason, matched) {
+  return { decision: 'block', tier, reason, matched: matched ?? null };
+}
+
+function anyPatternMatches(patterns, value) {
+  for (const p of patterns ?? []) {
+    try {
+      if (new RegExp(p).test(value)) return p;
+    } catch {
+      // A malformed regex in config/overlay never crashes the hook — it
+      // just never matches. Fail closed, not open.
+    }
+  }
+  return null;
+}
+
+function decideBash(toolInput, config) {
+  const command = typeof toolInput?.command === 'string' ? toolInput.command : '';
+  const hardDeny = config.hardDeny ?? {};
+  const allowPatterns = config.tier2?.Bash?.allowPatterns ?? [];
+
+  // Belt-and-braces: the chain-guard character class now includes a literal
+  // newline alongside the shell-chaining metacharacters, so any multi-line
+  // command is blocked outright here, before the per-line pass below even
+  // runs. This alone stops every newline-smuggled hard-deny bypass; the
+  // per-line pass is kept as a second, independent layer in case the guard
+  // pattern is ever narrowed by a future config edit.
+  if (hardDeny.bashChainGuardPattern) {
+    const chainMatch = anyPatternMatches([hardDeny.bashChainGuardPattern], command);
+    if (chainMatch) {
+      return block(
+        'tier2-hard-deny',
+        'command contains a shell-chaining metacharacter (;, &&, ||, |, `, $(...), <, >) or an embedded newline — blocked even though a prefix may match an allow pattern',
+        chainMatch,
+      );
+    }
+  }
+
+  // Hard-deny is evaluated per line, never against the whole (possibly
+  // multi-line) command string. `^` in a hardDeny pattern has no `m` flag,
+  // so tested against the full string it only ever matches the very start —
+  // a hard-denied command hidden behind an embedded newline would sail
+  // through. Splitting on \n and testing each line from position 0 makes
+  // every hard-deny pattern effectively line-start-anchored without having
+  // to touch the patterns themselves. hardDeny.pathPatterns (credential
+  // paths) is checked here too, against the Bash command text — not just
+  // Read/Write file_path — so a command that references e.g. `.ssh/` via
+  // redirection is caught even if it slips past the chain-guard.
+  const lines = command.split('\n');
+  for (const line of lines) {
+    const hardDenyMatch = anyPatternMatches(hardDeny.bashPatterns, line);
+    if (hardDenyMatch) {
+      return block('tier2-hard-deny', `command matches hard-deny pattern "${hardDenyMatch}" — never allowed, overlays cannot override`, hardDenyMatch);
+    }
+    const hardDenyPathMatch = anyPatternMatches(hardDeny.pathPatterns, line);
+    if (hardDenyPathMatch) {
+      return block('tier2-hard-deny', `command references a hard-deny path pattern "${hardDenyPathMatch}" — never allowed, overlays cannot override`, hardDenyPathMatch);
+    }
+  }
+
+  // Every line must independently match an allow pattern — an allowlisted
+  // first line followed by an unrecognised (or hard-denied) second line is
+  // not enough; the whole command has to be clean end to end.
+  let matched = null;
+  for (const line of lines) {
+    const allowMatch = anyPatternMatches(allowPatterns, line);
+    if (!allowMatch) {
+      return block('tier2', `command does not match any Bash allow pattern (line: "${line}")`, null);
+    }
+    if (matched === null) matched = allowMatch;
+  }
+
+  return allow('tier2', `command matches allow pattern "${matched}"`, matched);
+}
+
+function decideReadOrWrite(toolName, toolInput, config, context) {
+  const rawFilePath = typeof toolInput?.file_path === 'string' ? toolInput.file_path : '';
+  // Normalize absolute paths (collapse `..`/`.`/`//`) before ANY pattern
+  // matching happens — hard-deny, absolute-allow, and (via
+  // toRepoRelative()) the repo-relative block/allow checks all then operate
+  // on the resolved path. Without this, a raw string like
+  // `/tmp/../operator/knowledge/foo.md` matches `^/tmp/` on the
+  // unresolved text even though it actually points at
+  // `/operator/knowledge/foo.md` once traversal is collapsed — the
+  // absolute-allow branch was added separately from the repo-relative
+  // branch below and never got the same treatment. Relative paths are left
+  // untouched here; toRepoRelative() already resolves those correctly
+  // against context.cwd.
+  const filePath = rawFilePath.startsWith('/') ? resolve(rawFilePath) : rawFilePath;
+  const toolConfig = config.tier2?.[toolName] ?? {};
+
+  // Hard-deny is checked first, against the raw path, and wins over even
+  // an absolute allow pattern (scratchpad included) — a determined overlay
+  // author extending allowAbsolutePathPatterns must not be able to smuggle
+  // a credentials-file read past this.
+  const hardDenyPatterns = config.hardDeny?.pathPatterns ?? [];
+  const hardDenyMatch = anyPatternMatches(hardDenyPatterns, filePath);
+  if (hardDenyMatch) {
+    return block('tier2-hard-deny', `path matches hard-deny pattern "${hardDenyMatch}" — never allowed, overlays cannot override`, hardDenyMatch);
+  }
+
+  // Absolute allow patterns (scratchpad etc.) are checked directly against
+  // the raw path — they're meaningful with or without a resolvable repo root.
+  const absAllow = anyPatternMatches(toolConfig.allowAbsolutePathPatterns, filePath);
+  if (absAllow) {
+    return allow('tier2', `path matches absolute allow pattern "${absAllow}"`, absAllow);
+  }
+
+  // Everything else is expressed relative to the repo root.
+  const relPath = toRepoRelative(filePath, context);
+
+  if (relPath !== null) {
+    const blockMatch = anyPatternMatches(toolConfig.blockPathPatterns, relPath);
+    if (blockMatch) {
+      return block('tier2-explicit-block', `path matches explicit block pattern "${blockMatch}"`, blockMatch);
+    }
+
+    const selfAwarePatterns = expandSelfPatterns(toolConfig.allowPathPatterns, context.selfAgent);
+    const allowMatch = anyPatternMatches(selfAwarePatterns, relPath);
+    if (allowMatch) {
+      return allow('tier2', `path matches allow pattern "${allowMatch}"`, allowMatch);
+    }
+
+    return block('tier2', `path "${relPath}" does not match any ${toolName} allow pattern`, null);
+  }
+
+  // Could not resolve a repo-relative path (no repo root found and the
+  // path wasn't under one of the absolute allow patterns) — default deny.
+  return block('tier2', `could not resolve "${filePath}" relative to a repo root — defaulting to deny`, null);
+}
+
+/**
+ * Substitutes the literal `<self>` token used in `agents/<self>/…` config
+ * patterns. When the calling PA's paName is known, it's substituted
+ * verbatim (regex-escaped); when unknown, it's substituted with `[^/]+` —
+ * the spec's documented fallback ("if unknown, allow any agents subdirectory").
+ * Applies to both core and overlay-supplied patterns, since an overlay
+ * author may reasonably write `<self>`-scoped patterns too.
+ */
+function expandSelfPatterns(patterns, selfAgent) {
+  if (!patterns) return patterns;
+  const replacement = selfAgent ? escapeRegex(selfAgent) : '[^/]+';
+  return patterns.map((p) => p.replaceAll('<self>', replacement));
+}
+
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Resolve `filePath` to a repo-root-relative, forward-slash path. Returns
+ * null when it can't be placed under the repo root at all (no repo root
+ * known, or the path lies genuinely outside it).
+ */
+function toRepoRelative(filePath, context) {
+  if (!filePath) return null;
+  const { repoRoot, cwd } = context;
+  const root = repoRoot || null;
+  if (!root) return null;
+
+  const abs = filePath.startsWith('/') ? filePath : resolve(cwd || root, filePath);
+  const rel = relative(root, abs);
+  if (rel.startsWith('..') || rel === '') return rel === '' ? '.' : null;
+  return rel.split('\\').join('/');
+}

package/dist/engineering-pa-cli/src/coordinator-hook/repo-root.mjs

@@ -0,0 +1,44 @@
+// repo-root.mjs — operator repo root discovery for the coordinator hook.
+//
+// Mirrors packages/cli/src/pa/repo-root.mjs and packages/core/src/desk/repo.mjs.
+// Own copy avoids cross-module coupling for a pure utility (established
+// convention in this monorepo — see the comment in pa/repo-root.mjs).
+//
+// Unlike the CLI-facing copies, this one takes an explicit `startDir` and
+// `env` on every call instead of caching module-global state — the hook is
+// a fresh process per PreToolUse invocation, and it also needs to resolve
+// roots relative to the `cwd` field of the tool-use payload, which is not
+// necessarily `process.cwd()`.
+//
+// Resolution order:
+//   1. DAVE_REPO_ROOT / PA_REPO_ROOT env var (explicit override)
+//   2. Walk upward from startDir looking for a `.git` entry (dir or file —
+//      a `.git` file means a worktree checkout)
+//   3. null if nothing found (caller decides the safe-default fallback)
+
+import { stat } from 'node:fs/promises';
+import { join, resolve, dirname } from 'node:path';
+
+async function pathKind(p) {
+  try {
+    const s = await stat(p);
+    if (s.isDirectory()) return 'dir';
+    if (s.isFile()) return 'file';
+    return 'other';
+  } catch {
+    return 'missing';
+  }
+}
+
+export async function resolveRepoRoot(startDir, env = process.env) {
+  const envRoot = env.DAVE_REPO_ROOT || env.PA_REPO_ROOT;
+  if (envRoot) return resolve(envRoot);
+
+  let d = resolve(startDir);
+  while (d && d !== dirname(d)) {
+    const k = await pathKind(join(d, '.git'));
+    if (k === 'dir' || k === 'file') return d;
+    d = dirname(d);
+  }
+  return null;
+}

package/dist/engineering-pa-cli/src/coordinator-hook/self.mjs

@@ -0,0 +1,30 @@
+// self.mjs — resolve the calling PA's own agent-directory name ("<self>" in
+// the allowlist spec's `agents/<self>/**` patterns).
+//
+// Priority:
+//   1. PA_SELF_AGENT env var (explicit override — useful for tests and for
+//      hosts where preferences.json resolution is inconvenient).
+//   2. operator/config/preferences.json → paName, read relative to the
+//      resolved repo root.
+//   3. Unknown — caller falls back to the permissive `agents/[^/]+/`
+//      pattern, per the spec ("if unknown, allow any agents/*/ path").
+//
+// Returns a string paName, or null when unresolved.
+
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+export async function resolveSelfAgent(repoRoot, env = process.env) {
+  if (env.PA_SELF_AGENT) return env.PA_SELF_AGENT;
+  if (!repoRoot) return null;
+  try {
+    const raw = await readFile(join(repoRoot, 'operator', 'config', 'preferences.json'), 'utf8');
+    const config = JSON.parse(raw);
+    if (config && typeof config.paName === 'string' && config.paName.trim()) {
+      return config.paName.trim();
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}

package/dist/engineering-pa-cli/src/environment/cli.mjs

@@ -0,0 +1,287 @@
+// cli.mjs — argv router for `pa environment [verb]`.
+//
+// Verbs (three):
+//   pa environment            Read cache, auto-refresh if stale, print summary
+//   pa environment refresh    Force rebuild the cache
+//   pa environment extended   Reserved verb — dispatches to operator overlay
+//
+// Global flags:
+//   --format json     Machine-readable output to stdout
+//   --quiet           Suppress human summary; file write is the payload
+//   --skip-network    Skip network probes (fallback for slow CI or offline dev)
+//
+// Exit codes (tooling standard §6):
+//   0 ok  |  1 usage  |  2 unresolvable state (extended verb without extension,
+//   cache-write failure)  |  3 network probe failure (does NOT prevent write —
+//   degraded environment is still captured, but the exit code signals it)
+//
+// Performance target: cache-read <2s, refresh <5s. Runs at every session
+// boot; slower and the operator waits.
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { getRepoRoot } from '../pa/repo-root.mjs';
+import {
+  probePlatform,
+  probeRuntimes,
+  probePlatformCli,
+  probeCustomTools,
+  probeNetwork,
+  probeWorkspace,
+  probeWorkingDirectory,
+} from './probes.mjs';
+
+const CLI_VERSION = '0.2.0';
+const DEFAULT_STALENESS_MINUTES = 60;
+
+const USAGE = `pa environment — session-boot environment cache
+
+Usage:
+  pa environment                Read cache; auto-refresh if missing/stale
+  pa environment refresh        Force rebuild
+  pa environment extended       (Reserved verb — operator overlay)
+  pa environment -h, --help     Show this help
+
+Global flags:
+  --format <human|json>         Output format (default: human)
+  --quiet                       Suppress stdout summary
+  --skip-network                Skip DNS + HTTP probes
+
+Cache file: <repo-root>/.session/environment.json.
+Staleness threshold: 60 minutes (override via operator/config/preferences.json:
+environment.cacheStalenessMinutes).
+
+Extended verb loader: <repo-root>/operator/extensions/tools/environment-extended/index.mjs.
+
+Exit codes (tooling standard §6):
+  0 ok | 1 usage | 2 unresolvable state | 3 network probe failure
+`;
+
+export async function run(argv) {
+  const args = argv ?? [];
+  if (args.includes('-h') || args.includes('--help')) {
+    process.stdout.write(USAGE);
+    return 0;
+  }
+  const { positionals, flags } = parseArgs(args);
+  const verb = positionals[0] ?? 'default';
+  try {
+    switch (verb) {
+      case 'default': return await runDefault(flags);
+      case 'refresh': return await runRefresh(flags);
+      case 'extended': return await runExtended(flags, positionals.slice(1));
+      default:
+        process.stderr.write(`[pa environment] unknown verb: ${verb}\n`);
+        process.stderr.write(USAGE);
+        return 1;
+    }
+  } catch (err) {
+    process.stderr.write(`[pa environment] ${err.message || err}\n`);
+    return err.exitCode ?? 2;
+  }
+}
+
+function parseArgs(argv) {
+  const flags = { format: 'human', quiet: false, skipNetwork: false };
+  const positionals = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--format') { flags.format = argv[++i]; continue; }
+    if (arg.startsWith('--format=')) { flags.format = arg.slice('--format='.length); continue; }
+    if (arg === '--quiet') { flags.quiet = true; continue; }
+    if (arg === '--skip-network') { flags.skipNetwork = true; continue; }
+    if (arg.startsWith('--')) {
+      const err = new Error(`unknown flag ${arg}`);
+      err.exitCode = 1;
+      throw err;
+    }
+    positionals.push(arg);
+  }
+  return { positionals, flags };
+}
+
+async function runDefault(flags) {
+  const repoRoot = await getRepoRoot();
+  const cachePath = cacheFilePath(repoRoot);
+  const staleness = readStalenessMinutes(repoRoot);
+  const cached = readCache(cachePath);
+  const stale = cached ? isStale(cached, staleness) : true;
+  let cache;
+  let networkDegraded = false;
+  if (!cached || stale) {
+    ({ cache, networkDegraded } = await buildCache(repoRoot, flags));
+    writeCache(cachePath, cache);
+  } else {
+    cache = cached;
+  }
+  if (!flags.quiet) {
+    if (flags.format === 'json') {
+      process.stdout.write(JSON.stringify(cache, null, 2) + '\n');
+    } else {
+      process.stdout.write(formatSummary(cache) + '\n');
+    }
+  }
+  return networkDegraded ? 3 : 0;
+}
+
+async function runRefresh(flags) {
+  const repoRoot = await getRepoRoot();
+  const cachePath = cacheFilePath(repoRoot);
+  const { cache, networkDegraded } = await buildCache(repoRoot, flags);
+  writeCache(cachePath, cache);
+  if (!flags.quiet) {
+    if (flags.format === 'json') {
+      process.stdout.write(JSON.stringify(cache, null, 2) + '\n');
+    } else {
+      process.stdout.write(formatSummary(cache) + '\n');
+    }
+  }
+  return networkDegraded ? 3 : 0;
+}
+
+async function runExtended(flags, extraArgs) {
+  const repoRoot = await getRepoRoot();
+  const extensionPath = join(repoRoot, 'operator', 'extensions', 'tools', 'environment-extended', 'index.mjs');
+  if (!existsSync(extensionPath)) {
+    process.stderr.write(
+      '[pa environment extended] extended checks require operator extension — ' +
+      'see operator/extensions/tools/environment-extended (missing on this repo)\n',
+    );
+    return 2;
+  }
+  // Build the core cache first — the extension receives it via context so
+  // it can extend rather than duplicate.
+  const { cache: coreCache } = await buildCache(repoRoot, flags);
+  const cachePath = cacheFilePath(repoRoot);
+  let mod;
+  try {
+    mod = await import(pathToFileURL(extensionPath).href);
+  } catch (err) {
+    process.stderr.write(`[pa environment extended] failed to load extension: ${err.message}\n`);
+    return 2;
+  }
+  const extendFn = mod.default;
+  if (typeof extendFn !== 'function') {
+    process.stderr.write(
+      '[pa environment extended] extension at operator/extensions/tools/environment-extended/index.mjs ' +
+      'must default-export an async function extended({ core, cwd })\n',
+    );
+    return 2;
+  }
+  let extended;
+  try {
+    extended = await extendFn({ core: coreCache, cwd: process.cwd(), extraArgs });
+  } catch (err) {
+    // Surface the extension's error verbatim — the operator wants to know
+    // why the extension failed.
+    process.stderr.write(`[pa environment extended] extension threw: ${err.stack || err.message || err}\n`);
+    return 2;
+  }
+  const merged = { ...coreCache, ...(extended ?? {}) };
+  writeCache(cachePath, merged);
+  if (!flags.quiet) {
+    if (flags.format === 'json') {
+      process.stdout.write(JSON.stringify(merged, null, 2) + '\n');
+    } else {
+      process.stdout.write(formatSummary(merged) + '\n');
+    }
+  }
+  return 0;
+}
+
+async function buildCache(repoRoot, flags) {
+  const platform = probePlatform();
+  const [runtimes, network, workspace] = await Promise.all([
+    probeRuntimes(),
+    probeNetwork({ skip: flags.skipNetwork }),
+    probeWorkspace(repoRoot),
+  ]);
+  const platformCli = probePlatformCli(repoRoot);
+  const customTools = probeCustomTools(repoRoot);
+  const workingDirectory = probeWorkingDirectory();
+  const cache = {
+    capturedAt: new Date().toISOString(),
+    capturedBy: `pa environment@${CLI_VERSION}`,
+    platform,
+    runtimes,
+    platformCli,
+    customTools,
+    network,
+    workspace,
+    workingDirectory,
+  };
+  const networkDegraded = Boolean(
+    !flags.skipNetwork
+    && ((network?.dns?.error) || (network?.http?.error)),
+  );
+  return { cache, networkDegraded };
+}
+
+function cacheFilePath(repoRoot) {
+  return join(repoRoot, '.session', 'environment.json');
+}
+
+function readCache(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function writeCache(path, cache) {
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(cache, null, 2) + '\n');
+  } catch (err) {
+    const wrapped = new Error(`could not write cache to ${path}: ${err.message}`);
+    wrapped.exitCode = 2;
+    throw wrapped;
+  }
+}
+
+function isStale(cache, stalenessMinutes) {
+  if (!cache?.capturedAt) return true;
+  const capturedMs = Date.parse(cache.capturedAt);
+  if (!Number.isFinite(capturedMs)) return true;
+  const ageMs = Date.now() - capturedMs;
+  return ageMs > stalenessMinutes * 60 * 1000;
+}
+
+function readStalenessMinutes(repoRoot) {
+  try {
+    const prefsPath = join(repoRoot, 'operator', 'config', 'preferences.json');
+    if (existsSync(prefsPath)) {
+      const prefs = JSON.parse(readFileSync(prefsPath, 'utf8'));
+      const value = prefs?.environment?.cacheStalenessMinutes;
+      if (typeof value === 'number' && value > 0) return value;
+    }
+  } catch {
+    // fall through
+  }
+  return DEFAULT_STALENESS_MINUTES;
+}
+
+function formatSummary(cache) {
+  const parts = [];
+  parts.push(`Environment snapshot @ ${cache.capturedAt}`);
+  parts.push(`Capturer: ${cache.capturedBy}`);
+  parts.push('');
+  const p = cache.platform || {};
+  parts.push(`Platform: ${p.os}/${p.arch} kernel=${p.kernel} shell=${p.shell ?? '-'}`);
+  const r = cache.runtimes || {};
+  parts.push(`Runtimes: node=${r.node?.version ?? '-'} pnpm=${r.pnpm?.version ?? '-'} git=${r.git?.version ?? '-'}`);
+  const n = cache.network || {};
+  const dnsStr = n.dns?.skipped ? 'skipped' : `${n.dns?.resolved?.[0] ?? n.dns?.error ?? '-'} (${n.dns?.elapsedMs ?? '-'}ms)`;
+  const httpStr = n.http?.skipped ? 'skipped' : `${n.http?.statusCode ?? n.http?.error ?? '-'} (${n.http?.elapsedMs ?? '-'}ms)`;
+  parts.push(`Network: dns(${n.dns?.target ?? '-'})=${dnsStr}  http(${n.http?.target ?? '-'})=${httpStr}`);
+  const w = cache.workspace || {};
+  parts.push(`Workspace: ${w.url ?? '-'} ${w.running ? 'running' : 'not running'}`);
+  const wd = cache.workingDirectory || {};
+  parts.push(`Working directory: ${wd.cwd ?? '-'} → projectRoot=${wd.projectRoot ?? 'unresolved'} (via ${wd.resolvedVia ?? '-'})`);
+  const tools = cache.customTools || [];
+  parts.push(`Custom tools: ${tools.length === 0 ? '(none)' : tools.map((t) => t.name).join(', ')}`);
+  return parts.join('\n');
+}