From 7cefd5ce7bb9b9a7892b1cb5685ca78998eb17ae Mon Sep 17 00:00:00 2001
From: Karim Masmoudi <125830216+Kernel-Hunter@users.noreply.github.com>
Date: Fri, 30 Oct 2026 19:31:07 +0100
Subject: [PATCH 1/5] Redesign the README
Centered header with badges and the demo, a feature grid, a mermaid
diagram, install per platform, a quick start and a comparison table up
front. The reference sections keep all their content, with the longest
parts in collapsible blocks, plus an FAQ, contributing notes and a star
history chart.
---
README.md | 536 +++++++++++++++++++++++++++++++++++++++++++++---------
1 file changed, 450 insertions(+), 86 deletions(-)
diff --git a/README.md b/README.md
index 832a304..49674b3 100644
--- a/README.md
+++ b/README.md
@@ -1,87 +1,174 @@
+
+
+
+
# Mudroom
-Run coding agents in a sandbox, then review their changes like a pull request
-before anything touches your project.
+**Run coding agents in a sandbox, then review their changes like a pull request.**
+Mudroom runs Claude Code, Codex, Gemini CLI, opencode, Aider or any command on a clone of your
+project in a Linux micro-VM, behind a network allowlist. Nothing reaches your folder until you apply it.
+
+[](https://github.com/Kernel-Hunter/mudroom/releases/latest)
+[](https://github.com/Kernel-Hunter/mudroom/releases)
+[](https://github.com/Kernel-Hunter/mudroom/stargazers)
+[](LICENSE)
+
+[](#install)
+[](#requirements)
+[](https://github.com/Kernel-Hunter/mudroom/actions/workflows/ci.yml)
+
+[Website](https://kernel-hunter.github.io/mudroom/) ·
+[Download](https://github.com/Kernel-Hunter/mudroom/releases/latest) ·
+[Docs](#documentation) ·
+[Report a bug](https://github.com/Kernel-Hunter/mudroom/issues/new)
+
+
+
+
+
+
+
+
Coding agents work best with permission prompts turned off, and that means
they can delete files or reach any host while you aren't looking. Mudroom
-runs Claude Code, Codex, Gemini CLI, opencode, Aider (or any command) in a
-Linux micro-VM, on a copy-on-write clone of your project, with network access
-limited to the hosts you allow. Your real folder is never mounted. When the
-agent is done you read the diff, apply all of it, some files, some hunks or
-none, and undo any apply later.
+gives each run a disposable copy-on-write clone of your project inside a
+Linux micro-VM, with network access limited to the hosts you allow. Your real
+folder is never mounted. When the agent is done you read the diff like a pull
+request, apply all of it, some files, some hunks or none, and undo any apply
+later.
-macOS app and CLI on Apple-silicon Macs. CLI only (with Docker or Podman) on
-Linux, Windows and Intel Macs.
+> **Status:** early prototype. Expect rough edges and breaking changes.
-> Status: early prototype. Expect rough edges and breaking changes.
+
+Watch the video
-
+
https://github.com/user-attachments/assets/ff599cbc-fbd9-4c8f-801d-fd2e52ccb0c6
-## Quick start
+
-1. Install (Apple-silicon Mac, macOS 26 or later):
+## What you get
- ```sh
- curl -fsSL https://raw.githubusercontent.com/Kernel-Hunter/mudroom/main/install.sh | sh
- ```
+
+
+
- Or with Homebrew: `brew install --cask kernel-hunter/tap/mudroom`
+**Your folder stays untouched**
+The agent edits a copy-on-write clone (APFS, or a reflink on btrfs and XFS),
+untracked and ignored files included. Your project is never mounted.
- On Windows (CLI only), see [Install on Windows](#install-on-windows).
+
+
-2. Open Mudroom and work through the Setup window: install and start the VM
- runtime, build the agent image (a few minutes, once), and sign in an
- agent. `mudroom setup` does the same in a terminal.
+**A VM per session**
+Apple's `container` boots one lightweight Linux VM for each session. Docker
+and Podman work too, with gVisor or Kata if you have them.
-3. Click New Session, pick a folder and an agent, and start. When the agent
- finishes, review the diff in Mudroom and apply what you want.
+
+
+
+
-## Contents
+**Network allowlist**
+Locked by default: no DNS and no route out. The only exit is a proxy on your
+machine that lets through the agent's API hosts plus the ones you add.
-- [Requirements](#requirements)
-- [Install](#install)
-- [Setup](#setup)
-- [The app](#the-app)
-- [Command line](#command-line)
-- [Agents, sign-in and API keys](#agents-sign-in-and-api-keys)
-- [Keep files out of the sandbox](#keep-files-out-of-the-sandbox)
-- [Network](#network)
-- [Review and apply](#review-and-apply)
-- [Docker and Podman](#docker-and-podman)
-- [How it works](#how-it-works)
-- [How it compares](#how-it-compares)
-- [Limitations](#limitations)
-- [Development](#development)
+
+
-## Requirements
+**A log of every connection**
+In locked mode: host, port, bytes, allowed or blocked, and which program in
+the sandbox opened it (`git-remote-https`, `node`, `python3`).
-| Platform | What you get | Sandbox backend |
-|---|---|---|
-| macOS 26+, Apple silicon | App and CLI | `apple` (Apple's `container`, one VM per session), or `docker`/`podman` |
-| macOS 26+, Intel | CLI only (build from source) | `docker` or `podman` |
-| Linux x86_64 and arm64 | CLI only (build from source) | `docker` or `podman` |
-| Windows 10/11, x86_64 and arm64 | CLI only ([release zip](#install-on-windows) or build from source) | `docker` (Docker Desktop) or `podman` (Podman machine) |
+
+
+
+
-The `apple` backend needs Apple's [`container`](https://github.com/apple/container)
-CLI, version 1.5 or later. Setup installs it with Homebrew if you don't have
-it.
+**Keys stay out**
+`.env` files, `*.pem`, SSH keys and `.netrc` are left out of the agent's
+copy by default. Edit the list per project or with a `.mudroomignore`.
-The CLI picks a backend with `--backend apple|docker|podman|auto` (or
-`MUDROOM_BACKEND`). `auto`, the default, uses Apple's `container` on an
-Apple-silicon Mac with macOS 26+ where it is installed, otherwise Docker,
-otherwise Podman. A session remembers its backend, so `mudroom start` uses
-the same one again. See [Docker and Podman](#docker-and-podman) for how
-isolation differs from the VM backend.
+
+
+
+**Review like a pull request**
+Files grouped by change, unified or side-by-side diffs, a checkbox per file
+and per hunk. Your own edits since the start are flagged, never overwritten.
+
+
+
+
+
+
+**Undo and snapshots**
+Any apply can be undone in one step, even one killed halfway. Snapshots
+taken every 5 minutes show what changed after any point.
+
+
+
+
+**Any agent, your sign-in**
+Five agents set up for you, or any command. Sign in with your Claude account,
+the ChatGPT and Google logins you already have, API keys, or local models.
+
+
+
+
+
+## How it works
+
+```mermaid
+flowchart LR
+ P["Your project"] -->|"copy-on-write clone"| W["Session copy"]
+ W -->|"mounted at /workspace"| A
+ subgraph VM["Linux micro-VM or container"]
+ A["Coding agent"]
+ end
+ A -->|"only way out"| X["Allowlist proxy"]
+ X -->|"allowed hosts"| N(("Internet"))
+ W --> R["Diff review"]
+ R -->|"apply what you pick"| P
+ R -.->|"undo"| P
+```
+
+1. Mudroom clones the project twice: `base/` is the starting point and `work/`
+ is what the agent edits. On APFS the clones take no extra disk until files
+ change.
+2. The agent runs in its own VM (or container) with only `work/` inside. In
+ locked mode its one way out is the proxy, which checks every host against
+ the project's allowlist and logs the connection.
+3. You review `base/` against `work/` in the app or the terminal and apply
+ what you pick. Mudroom checks that each file in your project still matches
+ `base/`, so your own edits are never overwritten. Any apply can be undone.
+
+More detail in [Under the hood](#under-the-hood), [Network](#network) and
+[Review and apply](#review-and-apply).
## Install
+### macOS
+
+Apple silicon, macOS 26 or later. App and CLI. With Homebrew, which also
+installs Apple's `container` CLI:
+
+```sh
+brew install --cask kernel-hunter/tap/mudroom
+```
+
+Or with the install script:
+
```sh
curl -fsSL https://raw.githubusercontent.com/Kernel-Hunter/mudroom/main/install.sh | sh
```
+
+What the install script does, and how to uninstall
+
+
+
The script needs macOS 26 or later on Apple silicon. It downloads the latest
release, checks its SHA-256 when the release publishes one, puts Mudroom.app
in /Applications (or ~/Applications if /Applications isn't writable) and
@@ -93,27 +180,38 @@ version. To remove Mudroom (your sessions and settings stay):
curl -fsSL https://raw.githubusercontent.com/Kernel-Hunter/mudroom/main/install.sh | sh -s -- --uninstall
```
-Or with Homebrew, which also installs Apple's `container` CLI:
+
-```sh
-brew install --cask kernel-hunter/tap/mudroom
-```
+
+About signing and Gatekeeper
+
+
Mudroom is ad-hoc signed, not notarized. The install script and the Homebrew
cask remove the quarantine flag, so macOS opens it. If you download the zip
in a browser, use System Settings > Privacy & Security > Open Anyway, or run
`xattr -dr com.apple.quarantine /Applications/Mudroom.app`.
+
+
+On an Intel Mac, the CLI works with Docker or Podman; [build it from
+source](#build-from-source).
+
### Install on Windows
-With [Scoop](https://scoop.sh):
+CLI only, Windows 10/11 on x86_64 or arm64. With [Scoop](https://scoop.sh):
```powershell
scoop bucket add kernel-hunter https://github.com/Kernel-Hunter/scoop-bucket
scoop install mudroom
```
-Without Scoop: each release has a zip for x86_64 and one for arm64:
+
+Without Scoop: install from the release zip
+
+
+
+Each release has a zip for x86_64 and one for arm64:
`mudroom--windows-x86_64.zip` and `mudroom--windows-arm64.zip`
on the [Releases](https://github.com/Kernel-Hunter/mudroom/releases/latest)
page, each with a `.sha256`. The zip holds a folder with `mudroom.exe` and
@@ -138,8 +236,11 @@ To upgrade, run the same lines with the new version, without the PATH
line. `mudroom.exe` isn't code-signed; if Windows blocks it after you unzip
with Explorer, run `Get-ChildItem $dir | Unblock-File`.
+
+
The Scoop and winget manifests are in [packaging/scoop](packaging/scoop)
-and [packaging/winget](packaging/winget).
+and [packaging/winget](packaging/winget). The winget package is waiting for
+review in the winget repository, so `winget install` doesn't find it yet.
Then install a container runtime: [Docker Desktop](https://docs.docker.com/desktop/setup/install/windows-install/)
with the WSL 2 backend (Linux containers, the default), or
@@ -155,6 +256,21 @@ mudroom network check --backend docker
Run `mudroom` from Windows Terminal or any console with VT support. See
[Windows](#windows-1) for what is different from macOS and Linux.
+### Linux
+
+CLI only, x86_64 and arm64, built from source. You need Swift 6.2 or later
+([swift.org/install](https://www.swift.org/install/)) and Docker Engine or
+Podman:
+
+```sh
+git clone https://github.com/Kernel-Hunter/mudroom
+cd mudroom
+swift build -c release
+cp .build/release/mudroom /usr/local/bin/ # or anywhere on your PATH
+mudroom image build --backend docker # or --backend podman, once
+mudroom network check --backend docker # see what the sandbox can reach
+```
+
### Build from source
You need Xcode 26+ (Swift 6.2+).
@@ -173,13 +289,8 @@ swift build -c release
cp .build/release/mudroom /usr/local/bin/ # or anywhere on your PATH
```
-On Linux you need Swift 6.2 or later ([swift.org/install](https://www.swift.org/install/))
-and Docker Engine or Podman. Then build the agent image once:
-
-```sh
-mudroom image build --backend docker # or --backend podman
-mudroom network check --backend docker # see what the sandbox can reach
-```
+On Linux you also need Docker Engine or Podman and the agent image; see
+[Linux](#linux).
#### Windows
@@ -202,6 +313,109 @@ headers then refuse to build swift-crypto's BoringSSL. Run `mudroom` from
Windows Terminal or any console with VT support (Windows 10 1809 or later).
See [Windows](#windows-1) for what is different there.
+## Quick start
+
+In the app:
+
+1. Open Mudroom and work through the Setup window: install and start the VM
+ runtime, build the agent image (a few minutes, once), and sign in an
+ agent.
+2. Click New Session, pick a folder and an agent, and start.
+3. When the agent finishes, review the diff in Mudroom and apply what you
+ want.
+
+From a terminal. On Linux and Windows the same commands use Docker, or
+Podman when Docker isn't there; `--backend` picks one.
+
+```sh
+# Once: start the VM runtime, build the agent image, sign in an agent
+mudroom setup
+
+# Run an agent on a clone of your project
+mudroom run ~/code/myapp -- claude --dangerously-skip-permissions
+
+# Read the diff, pick files or hunks, press x to apply
+mudroom review last
+
+# See what the agent connected to, and what was blocked
+mudroom network log last
+
+# Changed your mind
+mudroom undo last
+```
+
+## How it compares
+
+How the usual ways of running an agent differ, in their default setup:
+
+| | Agent on your machine | Dev container | Cloud sandbox | Mudroom |
+|---|---|---|---|---|
+| Where the agent edits | Your real folder | Your folder, usually bind-mounted | A copy on the provider's servers | A clone; your folder is never mounted |
+| When edits reach your folder | Right away | Right away | When you pull or download them | When you apply them |
+| Boundary | Your user account, plus the agent's own prompts or sandbox | A container (the host's kernel on Linux) | The provider's VM or container | One micro-VM per session, or a container with Docker or Podman |
+| Network | Anything your machine reaches, unless the agent's own sandbox limits it | Open by default | Depends on the provider | Allowlist through a proxy (locked mode, the default), each connection logged with the command that opened it |
+| Review | `git diff`, or per-edit prompts | `git diff` | Through git or the provider's tools | Review app or terminal screen, per file and per hunk, with undo |
+| Your code leaves your machine | Only what the agent sends | Only what the agent sends | Yes, it runs remotely | Only what the agent sends to allowed hosts |
+| Account or bill for the sandbox | None | None | A provider account, usually paid by usage | None, MIT |
+
+A dev container gives you a reproducible toolchain, and a cloud sandbox runs
+many agents in parallel without using your machine. Mudroom does neither: it
+runs on your own computer, the review app needs a Mac with macOS 26, and the
+agent image is one general-purpose image unless you pass your own with
+`--image`.
+
+### Other agent sandboxes
+
+Checked against each project's docs on 2026-09-30. Corrections welcome.
+
+| | Where the agent works | When its writes reach your folder | Review before they land |
+|---|---|---|---|
+| Mudroom | Linux micro-VM, on an APFS clone; your folder is never mounted | When you apply | Diff app, per file and per hunk, with undo |
+| [Docker Sandboxes](https://docs.docker.com/ai/sandboxes/security/) | microVM; your folder mounted read-write by default, or a private git clone with `--clone` | Right away by default; with `--clone`, when you fetch | Through git, in clone mode |
+| [Apple's `sandboxy` example](https://github.com/apple/containerization/tree/main/examples/sandboxy) | Linux VM with your folder shared in | Right away | No |
+| [ArcBox](https://github.com/arcboxlabs/arcbox/blob/master/docs/agent-sandbox.md) | microVM with nothing mounted | Only what you copy out | No |
+| [Claude Code sandboxing](https://code.claude.com/docs/en/sandboxing) | Your real folder, with OS-level limits (no VM) | Right away | Per-edit prompts, unless you skip permissions |
+
+If your project is a git repo and you're happy reviewing with git, Docker Sandboxes' `--clone` mode gets you close. Mudroom also covers untracked and ignored files and folders that aren't repos, and gives you a review screen and per-apply undo.
+
+
+
+## Documentation
+
+- [Requirements](#requirements)
+- [Setup](#setup)
+- [The app](#the-app)
+- [Command line](#command-line)
+- [Agents, sign-in and API keys](#agents-sign-in-and-api-keys)
+- [Keep files out of the sandbox](#keep-files-out-of-the-sandbox)
+- [Network](#network)
+- [Review and apply](#review-and-apply)
+- [Docker and Podman](#docker-and-podman)
+- [Under the hood](#under-the-hood)
+- [Limitations](#limitations)
+- [FAQ](#faq)
+- [Development](#development)
+
+## Requirements
+
+| Platform | What you get | Sandbox backend |
+|---|---|---|
+| macOS 26+, Apple silicon | App and CLI | `apple` (Apple's `container`, one VM per session), or `docker`/`podman` |
+| macOS 26+, Intel | CLI only (build from source) | `docker` or `podman` |
+| Linux x86_64 and arm64 | CLI only (build from source) | `docker` or `podman` |
+| Windows 10/11, x86_64 and arm64 | CLI only ([release zip](#install-on-windows) or build from source) | `docker` (Docker Desktop) or `podman` (Podman machine) |
+
+The `apple` backend needs Apple's [`container`](https://github.com/apple/container)
+CLI, version 1.5 or later. Setup installs it with Homebrew if you don't have
+it.
+
+The CLI picks a backend with `--backend apple|docker|podman|auto` (or
+`MUDROOM_BACKEND`). `auto`, the default, uses Apple's `container` on an
+Apple-silicon Mac with macOS 26+ where it is installed, otherwise Docker,
+otherwise Podman. A session remembers its backend, so `mudroom start` uses
+the same one again. See [Docker and Podman](#docker-and-podman) for how
+isolation differs from the VM backend.
+
## Setup
The Setup window opens on the first launch. It has four steps:
@@ -223,7 +437,7 @@ Mudroom > Setup, and the sidebar tells you when a step needs attention. If
the VM runtime stops later (after a reboot, say), starting a session starts
it again.
-
+
In a terminal:
@@ -277,7 +491,12 @@ to date.
The review app is macOS only. Elsewhere, `mudroom review ` is a
terminal review screen: toggle files, read diffs, pick single hunks and apply
-the selection. Its keys:
+the selection.
+
+
+Keys in mudroom review
+
+
- File list: up/down or j/k move, space toggles a file, a toggles all, enter
opens the file, x applies the selection after a y/N prompt, q quits.
@@ -290,6 +509,8 @@ the selection. Its keys:
4 MB) open as a plain diff and are applied whole: up/down scroll, space/b
page, q back.
+
+
Whole files and selected hunks go into the project in one apply, so one
`mudroom undo` takes all of it back. `mudroom diff`, `hunks` and `apply` do
the same from scripts.
@@ -432,6 +653,11 @@ mudroom agent login gemini # Gemini CLI's own sign-in screen
mudroom agent status # signed in or not, per agent
```
+
+How the sign-in link gets out of the sandbox
+
+
+
Copying a sign-in link out of a terminal is fragile: it wraps over several
lines, and losing the end gives errors such as "Invalid
code_challenge_method". So each run sets `BROWSER` in the sandbox to a small
@@ -446,6 +672,8 @@ the rest of the request (PKCE challenge, state) unchanged. After signing in,
paste the code back: in Setup into the code field, in a terminal where the
prompt is (the agent's prompt doesn't echo it).
+
+
### Agent config directories
Each agent gets its own config directory,
@@ -591,6 +819,11 @@ Like the network commands, these work on the current directory, or take
of the sandbox" section that shows what the chosen folder would leave out
and lets you add and remove patterns.
+
+Pattern syntax
+
+
+
Patterns use `.gitignore` syntax, relative to the project root:
- `name` matches a file or folder with that name at any depth. `/name` and
@@ -609,6 +842,8 @@ Patterns use `.gitignore` syntax, relative to the project root:
`.ENV` is caught too: on a default APFS or NTFS disk it is the same file as
`.env`. On Windows, trailing dots and spaces are ignored as well.
+
+
A `.mudroomignore` file at the project root, in the same syntax, adds
patterns for everyone who uses the project, and can be committed. It can only
add: a `!` line in it takes back a pattern from the same file, never one from
@@ -720,7 +955,12 @@ the pid (`pid`) and the command lines of its parents up to the agent
(`parents`, nearest first). The app shows the command in the connection list,
with the parents in its tooltip, and the programs under each host.
-How it works: a small bash script, the watcher, runs inside the VM next to
+
+How the connection watcher works
+
+
+
+A small bash script, the watcher, runs inside the VM next to
the agent. It reads TCP's connection counter in `/proc/net/snmp` every 100 ms
(every 20 ms for a second after a connection opens), and when it changed,
looks in `/proc/net/tcp` and `tcp6` for new connections to the proxy. It finds
@@ -741,6 +981,8 @@ user, and the forwarder container passes each client's source port to the
proxy in a PROXY protocol line. The image needs bash (Mudroom's has it);
without it the log simply has no commands.
+
+
Limits:
- It is informational, not a security boundary. The allowlist is decided on
@@ -956,6 +1198,11 @@ Networks:
listens on 127.0.0.1, which Docker Desktop forwards `host.docker.internal`
to.
+
+Network check output with Docker
+
+
+
`mudroom network check --backend docker`, locked mode, gave this on Docker
Desktop (engine 29.8) on macOS 27, and the same apart from addresses on
Docker Engine 29.1 on Ubuntu 24.04 arm64 (run nested in a privileged
@@ -978,6 +1225,8 @@ has no host address, so services on the host aren't reachable, and no
firewall inside the container is needed. (This output is from before the
check opened a port of its own; it now probes that port instead of 7000.)
+
+
### How strong is the isolation
A container is not a VM. On Linux, Docker and Podman containers share the
@@ -1069,7 +1318,7 @@ on it. What is different from macOS and Linux:
`host.containers.internal` doesn't lead to Windows, and locked mode
can't work.
-## How it works
+## Under the hood
```
~/Library/Application Support/Mudroom/ (Linux: ~/.local/share/mudroom/, Windows: %LOCALAPPDATA%\Mudroom\)
@@ -1123,20 +1372,6 @@ container in its own lightweight VM, and one to `docker` or `podman`. The
proxy is plain BSD sockets (Winsock on Windows), so it runs the same on
macOS, Linux and Windows.
-## How it compares
-
-Checked against each project's docs on 2026-09-30. Corrections welcome.
-
-| | Where the agent works | When its writes reach your folder | Review before they land |
-|---|---|---|---|
-| Mudroom | Linux micro-VM, on an APFS clone; your folder is never mounted | When you apply | Diff app, per file and per hunk, with undo |
-| [Docker Sandboxes](https://docs.docker.com/ai/sandboxes/security/) | microVM; your folder mounted read-write by default, or a private git clone with `--clone` | Right away by default; with `--clone`, when you fetch | Through git, in clone mode |
-| [Apple's `sandboxy` example](https://github.com/apple/containerization/tree/main/examples/sandboxy) | Linux VM with your folder shared in | Right away | No |
-| [ArcBox](https://github.com/arcboxlabs/arcbox/blob/master/docs/agent-sandbox.md) | microVM with nothing mounted | Only what you copy out | No |
-| [Claude Code sandboxing](https://code.claude.com/docs/en/sandboxing) | Your real folder, with OS-level limits (no VM) | Right away | Per-edit prompts, unless you skip permissions |
-
-If your project is a git repo and you're happy reviewing with git, Docker Sandboxes' `--clone` mode gets you close. Mudroom also covers untracked and ignored files and folders that aren't repos, and gives you a review screen and per-apply undo.
-
## Limitations
- **With the apple backend, the Mac's own services are blocked by a firewall
@@ -1182,6 +1417,115 @@ If your project is a git repo and you're happy reviewing with git, Docker Sandbo
- The app is ad-hoc signed, not notarized. See [Install](#install) for what
that means when you download it.
+## FAQ
+
+
+Does the agent ever touch my real project folder?
+
+
+
+No. The agent edits `work/`, a clone in Mudroom's own data folder, and your
+project is never mounted into the sandbox. Files change in your project only
+when you apply them, and each apply can be undone. See [How apply stays
+safe](#how-apply-stays-safe).
+
+
+
+
+What if I edit a file while the agent is working?
+
+
+
+Apply checks each file in your project against the session's starting copy.
+A file you changed is reported as a conflict and left alone; the rest still
+applies.
+
+
+
+
+Can the agent read my .env or SSH keys?
+
+
+
+Not by default. `.env` files, `*.pem`, `*.key`, SSH private keys and `.netrc`
+are left out of the agent's copy. The list matches names, not contents, so a
+key pasted into another file is still copied. See [Keep files out of the
+sandbox](#keep-files-out-of-the-sandbox).
+
+
+
+
+Do I need an API key?
+
+
+
+Not for Claude Code, Codex or Gemini CLI: Mudroom can use your Claude
+account, or the ChatGPT and Google logins you already have. opencode, Aider
+and custom commands need a provider key (OpenRouter works for most models)
+or local models through Ollama or LM Studio. See [Agents, sign-in and API
+keys](#agents-sign-in-and-api-keys).
+
+
+
+
+Can I use it on Linux or Windows?
+
+
+
+Yes, as a CLI with Docker or Podman. There is no review app there:
+`mudroom review` is a terminal review screen with per-file and per-hunk
+selection. On Linux a container shares the host's kernel, so the isolation
+is weaker than the VM backend on a Mac. See [How strong is the
+isolation](#how-strong-is-the-isolation).
+
+
+
+
+Why does the agent run in Terminal and not inside the app?
+
+
+
+Agents are interactive terminal programs and you often need to answer them,
+so the app opens each session in Terminal.app and follows its progress
+through `session.json`.
+
+
+
+
+How much disk does a session use?
+
+
+
+On APFS the clones take no extra disk until files change. The agent image
+is about 1.5 GB, built once. If the project is on a disk that can't clone,
+Mudroom falls back to plain copies.
+
+
+
+
+Is the network log a security boundary?
+
+
+
+No. The allowlist is enforced by the proxy on your machine. The note about
+which command opened each connection comes from a watcher inside the VM, and
+a hostile agent can mislead it. See [Which process made each
+connection](#which-process-made-each-connection).
+
+
+
+
+macOS says Mudroom can't be opened. What now?
+
+
+
+Mudroom is ad-hoc signed, not notarized. The Homebrew cask and the install
+script remove the quarantine flag for you. For a zip downloaded in a browser,
+use System Settings > Privacy & Security > Open Anyway, or run
+`xattr -dr com.apple.quarantine /Applications/Mudroom.app`.
+
+
+
## Development
```sh
@@ -1212,8 +1556,28 @@ The proxy tests run it against a loopback test server. The app target is
platforms). `MudroomCore` has no UI code; the app and the CLI both sit on
top of it.
+## Contributing
+
+Bug reports, corrections to the comparison tables and pull requests are
+welcome. Open an [issue](https://github.com/Kernel-Hunter/mudroom/issues) for
+a bug or an idea. For code, `swift build` and `swift test` run without a VM on
+macOS, Linux and Windows (see [Development](#development)), and
+`mudroom network check` tests isolation on a real sandbox.
+
+If Mudroom is useful to you, a star helps other people find it.
+
## License
MIT. See [LICENSE](LICENSE).
Built by [Karim Masmoudi](https://github.com/Kernel-Hunter). My other projects are at [karimmasmoudi.vercel.app](https://karimmasmoudi.vercel.app/projects/).
+
+## Star history
+
+
+
+
+
+
+
+
From dd5367db6b88031cbb0a881a8091d707c12cb444 Mon Sep 17 00:00:00 2001
From: Karim Masmoudi <125830216+Kernel-Hunter@users.noreply.github.com>
Date: Fri, 30 Oct 2026 19:33:38 +0100
Subject: [PATCH 2/5] Use the lowercase repo name for the star history chart
---
README.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/README.md b/README.md
index 49674b3..434c2ae 100644
--- a/README.md
+++ b/README.md
@@ -1576,8 +1576,8 @@ Built by [Karim Masmoudi](https://github.com/Kernel-Hunter). My other projects a
-
-
-
+
+
+
From 44fa445a43bfe60edfb11cab8abfb55c917e7d45 Mon Sep 17 00:00:00 2001
From: Karim Masmoudi <125830216+Kernel-Hunter@users.noreply.github.com>
Date: Fri, 30 Oct 2026 19:35:47 +0100
Subject: [PATCH 3/5] README: say the clone leaves .env files and keys out
---
README.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/README.md b/README.md
index 434c2ae..2b5a54a 100644
--- a/README.md
+++ b/README.md
@@ -57,7 +57,8 @@ https://github.com/user-attachments/assets/ff599cbc-fbd9-4c8f-801d-fd2e52ccb0c6
**Your folder stays untouched**
The agent edits a copy-on-write clone (APFS, or a reflink on btrfs and XFS),
-untracked and ignored files included. Your project is never mounted.
+untracked and ignored files included, minus `.env` files and keys. Your
+project is never mounted.
From 591d89ed05d7eda42954b6adfaa9b83c5c3d5d11 Mon Sep 17 00:00:00 2001
From: Karim Masmoudi <125830216+Kernel-Hunter@users.noreply.github.com>
Date: Fri, 30 Oct 2026 20:53:11 +0100
Subject: [PATCH 4/5] README: themed banner, short header, install first
Replace the icon and for-the-badge header with a light and dark banner,
a link row and two flat badges. Put the overview video and the install
steps in the first screen, show the main features with screenshots, and
turn wide tables into lists so the page reads on a phone. Drop the star
history chart. Every section anchor stays the same.
---
README.md | 565 +++++++++++++++------------
docs/assets/mudroom-banner-dark.png | Bin 0 -> 220095 bytes
docs/assets/mudroom-banner-light.png | Bin 0 -> 255941 bytes
3 files changed, 311 insertions(+), 254 deletions(-)
create mode 100644 docs/assets/mudroom-banner-dark.png
create mode 100644 docs/assets/mudroom-banner-light.png
diff --git a/README.md b/README.md
index 2b5a54a..ab757aa 100644
--- a/README.md
+++ b/README.md
@@ -1,159 +1,42 @@
-
-
-
-
-# Mudroom
-
-**Run coding agents in a sandbox, then review their changes like a pull request.**
-Mudroom runs Claude Code, Codex, Gemini CLI, opencode, Aider or any command on a clone of your
-project in a Linux micro-VM, behind a network allowlist. Nothing reaches your folder until you apply it.
-
-[](https://github.com/Kernel-Hunter/mudroom/releases/latest)
-[](https://github.com/Kernel-Hunter/mudroom/releases)
-[](https://github.com/Kernel-Hunter/mudroom/stargazers)
-[](LICENSE)
-
-[](#install)
-[](#requirements)
-[](https://github.com/Kernel-Hunter/mudroom/actions/workflows/ci.yml)
-
-[Website](https://kernel-hunter.github.io/mudroom/) ·
-[Download](https://github.com/Kernel-Hunter/mudroom/releases/latest) ·
-[Docs](#documentation) ·
-[Report a bug](https://github.com/Kernel-Hunter/mudroom/issues/new)
-
-
-
-
-
-
-
-
-
-Coding agents work best with permission prompts turned off, and that means
-they can delete files or reach any host while you aren't looking. Mudroom
-gives each run a disposable copy-on-write clone of your project inside a
-Linux micro-VM, with network access limited to the hosts you allow. Your real
-folder is never mounted. When the agent is done you read the diff like a pull
-request, apply all of it, some files, some hunks or none, and undo any apply
-later.
-
-> **Status:** early prototype. Expect rough edges and breaking changes.
-
-
-Watch the video
-
-
+
+
+
+
+
+
+
+**Mudroom** runs coding agents like Claude Code, Codex, Gemini CLI, opencode
+and Aider (or any command) on a clone of your project, inside a Linux
+micro-VM, with network access limited to the hosts you allow. When the agent
+is done, you review its changes like a pull request, apply all of it, some
+files, some hunks or none, and undo any apply later. It's a free, local
+alternative to cloud agent sandboxes, and your real folder is never mounted.
https://github.com/user-attachments/assets/ff599cbc-fbd9-4c8f-801d-fd2e52ccb0c6
-
-
-## What you get
-
-
-
-
-
-**Your folder stays untouched**
-The agent edits a copy-on-write clone (APFS, or a reflink on btrfs and XFS),
-untracked and ignored files included, minus `.env` files and keys. Your
-project is never mounted.
-
-
-
-
-**A VM per session**
-Apple's `container` boots one lightweight Linux VM for each session. Docker
-and Podman work too, with gVisor or Kata if you have them.
-
-
-
-
-
-
-**Network allowlist**
-Locked by default: no DNS and no route out. The only exit is a proxy on your
-machine that lets through the agent's API hosts plus the ones you add.
-
-
-
-
-**A log of every connection**
-In locked mode: host, port, bytes, allowed or blocked, and which program in
-the sandbox opened it (`git-remote-https`, `node`, `python3`).
-
-
-
-
-
-
-**Keys stay out**
-`.env` files, `*.pem`, SSH keys and `.netrc` are left out of the agent's
-copy by default. Edit the list per project or with a `.mudroomignore`.
-
-
-
-
-**Review like a pull request**
-Files grouped by change, unified or side-by-side diffs, a checkbox per file
-and per hunk. Your own edits since the start are flagged, never overwritten.
-
-
-
-
-
-
-**Undo and snapshots**
-Any apply can be undone in one step, even one killed halfway. Snapshots
-taken every 5 minutes show what changed after any point.
-
-
-
-
-**Any agent, your sign-in**
-Five agents set up for you, or any command. Sign in with your Claude account,
-the ChatGPT and Google logins you already have, API keys, or local models.
-
-
-
-
-
-## How it works
-
-```mermaid
-flowchart LR
- P["Your project"] -->|"copy-on-write clone"| W["Session copy"]
- W -->|"mounted at /workspace"| A
- subgraph VM["Linux micro-VM or container"]
- A["Coding agent"]
- end
- A -->|"only way out"| X["Allowlist proxy"]
- X -->|"allowed hosts"| N(("Internet"))
- W --> R["Diff review"]
- R -->|"apply what you pick"| P
- R -.->|"undo"| P
-```
-
-1. Mudroom clones the project twice: `base/` is the starting point and `work/`
- is what the agent edits. On APFS the clones take no extra disk until files
- change.
-2. The agent runs in its own VM (or container) with only `work/` inside. In
- locked mode its one way out is the proxy, which checks every host against
- the project's allowlist and logs the connection.
-3. You review `base/` against `work/` in the app or the terminal and apply
- what you pick. Mudroom checks that each file in your project still matches
- `base/`, so your own edits are never overwritten. Any apply can be undone.
+
33 seconds, with sound: the agent edits a clone in a VM, reaches only the hosts you allow, and you apply what you pick.
-More detail in [Under the hood](#under-the-hood), [Network](#network) and
-[Review and apply](#review-and-apply).
+> **Status:** early prototype. Expect rough edges and breaking changes.
## Install
+The Mac app and CLI run on Apple-silicon Macs with macOS 26 or later. On
+Linux, Windows and Intel Macs, Mudroom is a CLI that uses Docker or Podman.
+
### macOS
-Apple silicon, macOS 26 or later. App and CLI. With Homebrew, which also
-installs Apple's `container` CLI:
+With Homebrew, which also installs Apple's `container` CLI:
```sh
brew install --cask kernel-hunter/tap/mudroom
@@ -207,6 +90,20 @@ scoop bucket add kernel-hunter https://github.com/Kernel-Hunter/scoop-bucket
scoop install mudroom
```
+Then install a container runtime: [Docker Desktop](https://docs.docker.com/desktop/setup/install/windows-install/)
+with the WSL 2 backend (Linux containers, the default), or
+[Podman](https://podman.io/docs/installation#windows) with a Podman machine
+(`podman machine init`, then `podman machine start`). Build the agent image
+once and check the network:
+
+```powershell
+mudroom image build --backend docker # or --backend podman
+mudroom network check --backend docker
+```
+
+Run `mudroom` from Windows Terminal or any console with VT support. See
+[Windows](#windows-1) for what is different from macOS and Linux.
+
Without Scoop: install from the release zip
@@ -237,82 +134,33 @@ To upgrade, run the same lines with the new version, without the PATH
line. `mudroom.exe` isn't code-signed; if Windows blocks it after you unzip
with Explorer, run `Get-ChildItem $dir | Unblock-File`.
-
-
The Scoop and winget manifests are in [packaging/scoop](packaging/scoop)
and [packaging/winget](packaging/winget). The winget package is waiting for
review in the winget repository, so `winget install` doesn't find it yet.
-Then install a container runtime: [Docker Desktop](https://docs.docker.com/desktop/setup/install/windows-install/)
-with the WSL 2 backend (Linux containers, the default), or
-[Podman](https://podman.io/docs/installation#windows) with a Podman machine
-(`podman machine init`, then `podman machine start`). Build the agent image
-once and check the network:
-
-```powershell
-mudroom image build --backend docker # or --backend podman
-mudroom network check --backend docker
-```
-
-Run `mudroom` from Windows Terminal or any console with VT support. See
-[Windows](#windows-1) for what is different from macOS and Linux.
+
### Linux
CLI only, x86_64 and arm64, built from source. You need Swift 6.2 or later
([swift.org/install](https://www.swift.org/install/)) and Docker Engine or
-Podman:
-
-```sh
-git clone https://github.com/Kernel-Hunter/mudroom
-cd mudroom
-swift build -c release
-cp .build/release/mudroom /usr/local/bin/ # or anywhere on your PATH
-mudroom image build --backend docker # or --backend podman, once
-mudroom network check --backend docker # see what the sandbox can reach
-```
+Podman.
-### Build from source
+
+Build and install the CLI
-You need Xcode 26+ (Swift 6.2+).
+
```sh
git clone https://github.com/Kernel-Hunter/mudroom
cd mudroom
-scripts/build-app.sh # build/Mudroom.app (app + bundled CLI), ad-hoc signed
-open build/Mudroom.app
-```
-
-For the command line only (macOS or Linux):
-
-```sh
swift build -c release
cp .build/release/mudroom /usr/local/bin/ # or anywhere on your PATH
+mudroom image build --backend docker # or --backend podman, once
+mudroom network check --backend docker # see what the sandbox can reach
```
-On Linux you also need Docker Engine or Podman and the agent image; see
-[Linux](#linux).
-
-#### Windows
-
-You need Swift 6.2 or later for Windows ([swift.org/install/windows](https://www.swift.org/install/windows/)),
-which brings the Visual Studio build tools it needs, and Docker Desktop
-(WSL 2 backend, Linux containers) or Podman Desktop with a Podman machine.
-In a Developer PowerShell:
-
-```powershell
-git clone https://github.com/Kernel-Hunter/mudroom
-cd mudroom
-swift build -c release -Xcxx -D_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH
-copy .build\release\mudroom.exe $env:LOCALAPPDATA\Microsoft\WindowsApps\ # or anywhere on your PATH
-mudroom image build --backend docker
-```
-
-The `-Xcxx` flag is only needed when your Visual Studio is newer than the
-Clang in your Swift toolchain (Visual Studio 2026 with Swift 6.2): the C++
-headers then refuse to build swift-crypto's BoringSSL. Run `mudroom` from
-Windows Terminal or any console with VT support (Windows 10 1809 or later).
-See [Windows](#windows-1) for what is different there.
+
## Quick start
@@ -345,19 +193,133 @@ mudroom network log last
mudroom undo last
```
+## Features
+
+Coding agents work best with permission prompts turned off, and that means
+they can delete files or reach any host while you aren't looking. Mudroom
+puts a sandbox and a review step between the agent and your project.
+
+- **Your folder stays untouched.** The agent edits a copy-on-write clone
+ (APFS, or a reflink on btrfs and XFS), untracked and ignored files
+ included, minus `.env` files and keys. Your project is never mounted.
+- **A VM per session.** Apple's `container` boots one lightweight Linux VM
+ for each session. Docker and Podman work too, with gVisor or Kata if you
+ have them.
+- **Network allowlist.** Locked by default: no DNS and no route out. The
+ only exit is a proxy on your machine that lets through the agent's API
+ hosts plus the ones you add.
+- **A log of every connection.** In locked mode: host, port, bytes, allowed
+ or blocked, and which program in the sandbox opened it
+ (`git-remote-https`, `node`, `python3`).
+- **Keys stay out.** `.env` files, `*.pem`, SSH keys and `.netrc` are left
+ out of the agent's copy by default. Edit the list per project or with a
+ `.mudroomignore`.
+- **Review like a pull request.** Files grouped by change, unified or
+ side-by-side diffs, a checkbox per file and per hunk. Your own edits since
+ the start are flagged, never overwritten.
+- **Undo and snapshots.** Any apply can be undone in one step, even one
+ killed halfway. Snapshots taken every 5 minutes show what changed after
+ any point.
+- **Any agent, your sign-in.** Five agents set up for you, or any command.
+ Sign in with your Claude account, the ChatGPT and Google logins you
+ already have, API keys, or local models.
+
+### Pick what to keep, file by file or hunk by hunk
+
+Changed files are grouped into Added, Modified, Deleted and Mode & Type,
+each with a checkbox, next to a unified or side-by-side diff. Modified text
+files have a checkbox per hunk, so you can take some edits and leave others.
+
+
+
+
+
+
+### See every host the agent tried to reach
+
+The Network tab lists blocked hosts first, with bytes and connection
+counts. Allow adds a blocked host to the project's allowlist for the next
+session.
+
+
+
+
+
+
+### Your own edits are never overwritten
+
+Files you changed yourself since the session started are flagged in the
+list and above the diff. Apply leaves them alone and takes the rest.
+
+
+
+### Look back at any point in the run
+
+Snapshots are taken while the agent works. Move the timeline slider and the
+file list shows only what changed after that point.
+
+
+
## How it compares
How the usual ways of running an agent differ, in their default setup:
-| | Agent on your machine | Dev container | Cloud sandbox | Mudroom |
-|---|---|---|---|---|
-| Where the agent edits | Your real folder | Your folder, usually bind-mounted | A copy on the provider's servers | A clone; your folder is never mounted |
-| When edits reach your folder | Right away | Right away | When you pull or download them | When you apply them |
-| Boundary | Your user account, plus the agent's own prompts or sandbox | A container (the host's kernel on Linux) | The provider's VM or container | One micro-VM per session, or a container with Docker or Podman |
-| Network | Anything your machine reaches, unless the agent's own sandbox limits it | Open by default | Depends on the provider | Allowlist through a proxy (locked mode, the default), each connection logged with the command that opened it |
-| Review | `git diff`, or per-edit prompts | `git diff` | Through git or the provider's tools | Review app or terminal screen, per file and per hunk, with undo |
-| Your code leaves your machine | Only what the agent sends | Only what the agent sends | Yes, it runs remotely | Only what the agent sends to allowed hosts |
-| Account or bill for the sandbox | None | None | A provider account, usually paid by usage | None, MIT |
+| | Edits reach your folder | Network |
+|---|---|---|
+| Agent on your machine | Right away | Anything your machine reaches |
+| Dev container | Right away | Open by default |
+| Cloud sandbox | When you pull them | Depends on the provider |
+| **Mudroom** | **When you apply them** | **Allowlist, each connection logged** |
+
+
+The full comparison
+
+
+
+**Agent on your machine**
+
+- Where it edits: your real folder, and edits land right away.
+- Boundary: your user account, plus the agent's own prompts or sandbox.
+- Network: anything your machine reaches, unless the agent's own sandbox
+ limits it.
+- Review: `git diff`, or per-edit prompts.
+- Your code leaves your machine: only what the agent sends.
+- Account or bill for the sandbox: none.
+
+**Dev container**
+
+- Where it edits: your folder, usually bind-mounted, and edits land right
+ away.
+- Boundary: a container (the host's kernel on Linux).
+- Network: open by default.
+- Review: `git diff`.
+- Your code leaves your machine: only what the agent sends.
+- Account or bill for the sandbox: none.
+
+**Cloud sandbox**
+
+- Where it edits: a copy on the provider's servers. Edits reach your folder
+ when you pull or download them.
+- Boundary: the provider's VM or container.
+- Network: depends on the provider.
+- Review: through git or the provider's tools.
+- Your code leaves your machine: yes, it runs remotely.
+- Account or bill for the sandbox: a provider account, usually paid by
+ usage.
+
+**Mudroom**
+
+- Where it edits: a clone; your folder is never mounted. Edits reach your
+ folder when you apply them.
+- Boundary: one micro-VM per session, or a container with Docker or Podman.
+- Network: allowlist through a proxy (locked mode, the default), each
+ connection logged with the command that opened it.
+- Review: review app or terminal screen, per file and per hunk, with undo.
+- Your code leaves your machine: only what the agent sends to allowed
+ hosts.
+- Account or bill for the sandbox: none, MIT.
+
+
A dev container gives you a reproducible toolchain, and a cloud sandbox runs
many agents in parallel without using your machine. Mudroom does neither: it
@@ -369,42 +331,88 @@ agent image is one general-purpose image unless you pass your own with
Checked against each project's docs on 2026-09-30. Corrections welcome.
-| | Where the agent works | When its writes reach your folder | Review before they land |
-|---|---|---|---|
-| Mudroom | Linux micro-VM, on an APFS clone; your folder is never mounted | When you apply | Diff app, per file and per hunk, with undo |
-| [Docker Sandboxes](https://docs.docker.com/ai/sandboxes/security/) | microVM; your folder mounted read-write by default, or a private git clone with `--clone` | Right away by default; with `--clone`, when you fetch | Through git, in clone mode |
-| [Apple's `sandboxy` example](https://github.com/apple/containerization/tree/main/examples/sandboxy) | Linux VM with your folder shared in | Right away | No |
-| [ArcBox](https://github.com/arcboxlabs/arcbox/blob/master/docs/agent-sandbox.md) | microVM with nothing mounted | Only what you copy out | No |
-| [Claude Code sandboxing](https://code.claude.com/docs/en/sandboxing) | Your real folder, with OS-level limits (no VM) | Right away | Per-edit prompts, unless you skip permissions |
+- **Mudroom.** Linux micro-VM, on an APFS clone; your folder is never
+ mounted. The agent's writes reach your folder when you apply them, after
+ a diff review per file and per hunk, with undo.
+- **[Docker Sandboxes](https://docs.docker.com/ai/sandboxes/security/).**
+ A microVM, with your folder mounted read-write by default, or a private
+ git clone with `--clone`. Writes reach your folder right away by default;
+ with `--clone`, when you fetch. Review goes through git, in clone mode.
+- **[Apple's `sandboxy` example](https://github.com/apple/containerization/tree/main/examples/sandboxy).**
+ A Linux VM with your folder shared in. Writes land right away, with no
+ review step.
+- **[ArcBox](https://github.com/arcboxlabs/arcbox/blob/master/docs/agent-sandbox.md).**
+ A microVM with nothing mounted. Only what you copy out reaches your
+ folder, with no review step.
+- **[Claude Code sandboxing](https://code.claude.com/docs/en/sandboxing).**
+ Your real folder, with OS-level limits (no VM). Writes land right away,
+ with per-edit prompts unless you skip permissions.
+
+If your project is a git repo and you're happy reviewing with git, Docker
+Sandboxes' `--clone` mode gets you close. Mudroom also covers untracked and
+ignored files and folders that aren't repos, and gives you a review screen
+and per-apply undo.
+
+## How it works
+
+```mermaid
+flowchart LR
+ P["Your project"] -->|"copy-on-write clone"| W["Session copy"]
+ W -->|"mounted at /workspace"| A
+ subgraph VM["Linux micro-VM or container"]
+ A["Coding agent"]
+ end
+ A -->|"only way out"| X["Allowlist proxy"]
+ X -->|"allowed hosts"| N(("Internet"))
+ W --> R["Diff review"]
+ R -->|"apply what you pick"| P
+ R -.->|"undo"| P
+```
-If your project is a git repo and you're happy reviewing with git, Docker Sandboxes' `--clone` mode gets you close. Mudroom also covers untracked and ignored files and folders that aren't repos, and gives you a review screen and per-apply undo.
+1. Mudroom clones the project twice: `base/` is the starting point and `work/`
+ is what the agent edits. On APFS the clones take no extra disk until files
+ change.
+2. The agent runs in its own VM (or container) with only `work/` inside. In
+ locked mode its one way out is the proxy, which checks every host against
+ the project's allowlist and logs the connection.
+3. You review `base/` against `work/` in the app or the terminal and apply
+ what you pick. Mudroom checks that each file in your project still matches
+ `base/`, so your own edits are never overwritten. Any apply can be undone.
+
+More detail in [Under the hood](#under-the-hood), [Network](#network) and
+[Review and apply](#review-and-apply).
## Documentation
-- [Requirements](#requirements)
-- [Setup](#setup)
-- [The app](#the-app)
-- [Command line](#command-line)
-- [Agents, sign-in and API keys](#agents-sign-in-and-api-keys)
-- [Keep files out of the sandbox](#keep-files-out-of-the-sandbox)
-- [Network](#network)
-- [Review and apply](#review-and-apply)
-- [Docker and Podman](#docker-and-podman)
-- [Under the hood](#under-the-hood)
-- [Limitations](#limitations)
-- [FAQ](#faq)
-- [Development](#development)
+The rest of this page is the full reference:
+[Requirements](#requirements) ·
+[Build from source](#build-from-source) ·
+[Setup](#setup) ·
+[The app](#the-app) ·
+[Command line](#command-line) ·
+[Agents, sign-in and API keys](#agents-sign-in-and-api-keys) ·
+[Keep files out of the sandbox](#keep-files-out-of-the-sandbox) ·
+[Network](#network) ·
+[Review and apply](#review-and-apply) ·
+[Docker and Podman](#docker-and-podman) ·
+[Under the hood](#under-the-hood) ·
+[Limitations](#limitations) ·
+[FAQ](#faq) ·
+[Development](#development)
## Requirements
-| Platform | What you get | Sandbox backend |
-|---|---|---|
-| macOS 26+, Apple silicon | App and CLI | `apple` (Apple's `container`, one VM per session), or `docker`/`podman` |
-| macOS 26+, Intel | CLI only (build from source) | `docker` or `podman` |
-| Linux x86_64 and arm64 | CLI only (build from source) | `docker` or `podman` |
-| Windows 10/11, x86_64 and arm64 | CLI only ([release zip](#install-on-windows) or build from source) | `docker` (Docker Desktop) or `podman` (Podman machine) |
+- **macOS 26+, Apple silicon:** app and CLI. Sandbox backend `apple`
+ (Apple's `container`, one VM per session), or `docker`/`podman`.
+- **macOS 26+, Intel:** CLI only (build from source), with `docker` or
+ `podman`.
+- **Linux x86_64 and arm64:** CLI only (build from source), with `docker`
+ or `podman`.
+- **Windows 10/11, x86_64 and arm64:** CLI only ([release
+ zip](#install-on-windows) or build from source), with `docker` (Docker
+ Desktop) or `podman` (Podman machine).
The `apple` backend needs Apple's [`container`](https://github.com/apple/container)
CLI, version 1.5 or later. Setup installs it with Homebrew if you don't have
@@ -417,6 +425,48 @@ otherwise Podman. A session remembers its backend, so `mudroom start` uses
the same one again. See [Docker and Podman](#docker-and-podman) for how
isolation differs from the VM backend.
+### Build from source
+
+You need Xcode 26+ (Swift 6.2+).
+
+```sh
+git clone https://github.com/Kernel-Hunter/mudroom
+cd mudroom
+scripts/build-app.sh # build/Mudroom.app (app + bundled CLI), ad-hoc signed
+open build/Mudroom.app
+```
+
+For the command line only (macOS or Linux):
+
+```sh
+swift build -c release
+cp .build/release/mudroom /usr/local/bin/ # or anywhere on your PATH
+```
+
+On Linux you also need Docker Engine or Podman and the agent image; see
+[Linux](#linux).
+
+#### Windows
+
+You need Swift 6.2 or later for Windows ([swift.org/install/windows](https://www.swift.org/install/windows/)),
+which brings the Visual Studio build tools it needs, and Docker Desktop
+(WSL 2 backend, Linux containers) or Podman Desktop with a Podman machine.
+In a Developer PowerShell:
+
+```powershell
+git clone https://github.com/Kernel-Hunter/mudroom
+cd mudroom
+swift build -c release -Xcxx -D_ALLOW_COMPILER_AND_STL_VERSION_MISMATCH
+copy .build\release\mudroom.exe $env:LOCALAPPDATA\Microsoft\WindowsApps\ # or anywhere on your PATH
+mudroom image build --backend docker
+```
+
+The `-Xcxx` flag is only needed when your Visual Studio is newer than the
+Clang in your Swift toolchain (Visual Studio 2026 with Swift 6.2): the C++
+headers then refuse to build swift-crypto's BoringSSL. Run `mudroom` from
+Windows Terminal or any console with VT support (Windows 10 1809 or later).
+See [Windows](#windows-1) for what is different there.
+
## Setup
The Setup window opens on the first launch. It has four steps:
@@ -477,11 +527,27 @@ claude`.
**Discard** (⌘⌫). Each apply can be undone in one step. Space toggles the
selected file.
-| | |
-|---|---|
-|  |  |
-|  |  |
-|  |  |
+The Network tab, the timeline and conflicts are shown under
+[Features](#features).
+
+
+More screenshots
+
+
+
+Dark mode, split diff:
+
+
+
+After a partial apply:
+
+
+
+New session:
+
+
+
+
Agents are interactive terminal programs, and you often need to answer them,
so sessions run in Terminal.app instead of a terminal built into Mudroom. The
@@ -1573,12 +1639,3 @@ MIT. See [LICENSE](LICENSE).
Built by [Karim Masmoudi](https://github.com/Kernel-Hunter). My other projects are at [karimmasmoudi.vercel.app](https://karimmasmoudi.vercel.app/projects/).
-## Star history
-
-
-
-
-
-
-
-
diff --git a/docs/assets/mudroom-banner-dark.png b/docs/assets/mudroom-banner-dark.png
new file mode 100644
index 0000000000000000000000000000000000000000..db6fb5e30a9f05d8b8b9031be4386c61c9664a4d
GIT binary patch
literal 220095
zcmd>l_dlEM8@5?mtx>gVM5zv=R@EqyQgmpkQCqZX?>!WNK_-!19XD7PHI#W9i7~;*qf>
zj^jL>+`LD5_>S?OJjTm^jE|p-?-bWb0WN+4E&+k#0z$_HMNS9_o)8i}AuM*{v;?=P
zxbU7&{bMmI!$-7=B&3#Y8#!l%up0W)(
zWfy$PK2$(dLO?=F;J&XQG)%|^F67xE>=Ap~`>_}Ua$4dH$SF!Npmra`fRq$S<+`M#
zq?C+|l|0c?Q7B@{cp*pJXa9a7p%(lFFroT*aifiYfU@3~1{qeYH?F
zGF85t~`LK%bro!_!n=?HMKOg6whhJ=U%;f
zRogsRx7Z4ztqC!Axuzt24Fb7l6sM=JuV-wjfAjJ6>(>pCP(wpQBNZtlW1}0Y(l>72
zx|wWuivimQw;fE3uW1^a#Tolp++koa=x$)NiTYU+%&MuW>AidR%*@QqEiKI5GAwTC
zTUc0FGGJ?O8QE~3fhJ$8t7onH!fb7A?OZ(Uf*v?n+;J@Ph1%Ibq0mPR_y#_jLb&Q*
zaP{$W9gTH^+PM4pc||?;c5(D(;N@H2m;gT$%>V|Tr34|{g1(N1__~FLg~8#`@Z^`#
zp#jl|Xhg$@n5=@hxVR@aH=iWMKTS-2789BH1d*7Sn3A5B=Ae?6ocJ;|9!8_lqZ1QjQA$&j6POvy
z+}zy4;^NBM8W!&MCqZRvcXyXSB&R9U!UJi@hrlaE;FS`Pr3Dll0~PlH0AK=`iW|_c
z{y7uDW_QgQzx@9UCUX*p3=GbvRYSv|A+CD&^!
zD<>v8bW|xJv(8|&7_px5Ztc_DtV8&bluC6rhb7z^KUDUnTfDz3IwKvt(!H(m?
zRbS;g37+kUa+S@2o}@Ug&~R7N^7U8ZKzYzi^j!|J*Pn>^mO~ZTa0*c0a>(Cuq?o9=
zb-cz8i9K$=wXt!nw+Xpl5*_%BRB9_`pL~EqjJITeON5>o>(siM0}_AdauB2e&e^sc
z3elhL$sjhpqXoD@o33D=t-Cj>UvkL(A+ahuaovG9;zG?d38s>+%jhz}L72!ZI^}Q=
zOzK-$N#jDte71lzYWo8M-`VsG=S-Y(YnvjIEWt&g4o+%g!?Ww+&r{Kt-
z%Qz0SxltaRee*)M}VxFP8ty()m6z`gMog({?KyEOMf~kE`K=
zYu}V-m@6HZ&vSwt)R%!TZlT9Ggx29wszvS~GE#`ux`^oD&eI{NQjAHuC)nju1)0M9
zw#mQI2Ri&wL9f+>1=8(5eqM5+^K$ncLx|P7i9z-Q)OaaA(L}hSq*X&>pau~XYLYHO
zoT`LrvK2=LMO+3i@<*=kvzDx)9{pUH+J(l0OEdE;+4IvZNaM5o_aV~uNWQf|9)778c~EJ<*~iJwopL&KBmZnMbXgJ
zC%$$5$$zL?vW!Z4GFCv#&ot_*%bz1&%+ej6*xlN+AEo9`p?ky3Ljq&*XRVRILic_o
z_OrbjyqZUGVbf${xT#{VsFS!hN?mBeM3eFlv2h*M#Pso98MaKzrRUy
z^N^^~&fXdpe9mPC+}(5-{!mvuMW`cC1Qb`6pLyPI#pF?$_4j$%=9Bc`W@JTvVki2#iQ6h=>utR)M9uyt-B)-$Vbjg-}_UOz;OJ}PVJdWOx=c9Q5D;Fo(O=~NQ&hv
zB<-b(D#$8%0;9)63O7ai6y#wesSQ@_a?xtVwaWyf+tAQzqJ)sh)O)!Sbd%o(g@A)i
z>>}ozhmKrX5v57or?o8ZAcm`w$=cD?m&i8$UngIbTpME6wZh`2?ervSE;0|J=XBrM
zY`fNO|B-Ljkz_7_NJ_pGFyVaF{|;?T(Z(-U+;#`Fze<(RSTSwN0h%c_*2i(6HTCh^
z5v?e9=#A98N%R=CSF@|qv#6&~r=K>#?#!J29AdVe8fG8Rf@*C4{;9FVefx#n{5?su
zf!o!dOgXZe1$#vL&6`>3?-9?)S4pey?s~G!#FcUwzxYx#%JNkMV$AjP37B0E#?mKXv)y!*tP@zYCZsU*en
zqx(svteb96SKu7yc!c3XKRU+$ny>;}t&>8U{}iZ;01M9=$t)JRcUWW(6^VGCV%@=ZehnXY!7ly}YtLXLuD0>gh)t#V1Zz$fa*5gQ
z&Z3h}!G?1GiM5YMhsRiCe_E+Sx8B}hy1>iHw#~!&^#ake?}9L0@$+XHA~m5gAHtYm
z1KMfi@ub5XG}4XJf~3wXI!+-N=UfZCuOE$c$$Xfa_VkucEA9GH;8Rg~)^G?3U=r%r
zkTyGH#<#!7C%8Ox9qaht0Figz_5j^h`f$gd3l^T1X&BT!Pjsp~i!xv9ux^#H|ypHUWE8{fAa(tPH`I+OyYRskK*%0II3n@|`;omf1fy6>2!=W*s
z42R^7(oFz0Q3dW%y1}?l^|_(Afja>Wh+rz4g@57?S}&d^FsBPL$k)I0nte8Hp2upe
zu#Q8`c}rFO-mlZ2A)|s*N4YPU@??EGQWV+sL^k-2PC==oz1tms3l4YKf7Z{a#n;1DCy9iBdVoW+2<@1~aQd0k-OMLrk%6Xx$#m=e!(=vrMNr*&dTv
z*
z=VwOYA#<#PGckTJhb@LB7P1q~^p!79>QYWFvO5QZa-R{FYB|D(gO(L=39EAS?9oD6
zYr6TIZfy%KQC}r{=y;iq8l7?j34oEmR-Lb6C2u`+sWfBbN!VbW(
z+eU)TutHX2b929{&lnP7am%O4UDu{rRQF?Yzw-$HK9W3$DQJ&5$#jg3rMoTlnERk)
z?wfJCK&PX(+SkkBk5J(hdqKHz(IO10f|FAAR(YRx0!^B_oK`!ZSxgGjAqt!6VU5bx
z3~#zX`IYyB*1^8(F*q{qE8($>mR1srb`iPj$t8c9cPz1E!7v(P+{+mAEb-_nmVH0+
z+k7#=oV{^l@9{3@2eH^uw$s;6zSrfQVArbX
zVsRVHvY`(sGgzGB8>HfEI)=4*mAm7V;PAXu@449d+Hg|o@
zO-2Ak{WlA7!?G=BEPW&0r9_9xZJhDXF)yu@AO%jM*HS9B`7I|Nz%SF9*X3yH;DrUH
zIgoT8sF1|vDifv735V)sXMQ7GT$O&!|J#FOhqAH5zwC(<7|V{~t|;q6^`{4Daes{kCQIql8dy(_5|Ehbaq230G5
zUh+5moJ-`Xon$&D&Po3!Hy=!Wy;vb2ca;`&%NsZmhN}W@fc7aldrDUlIrZa<2&Hh2
zMc6!O;}k5f8JnVWslg-~k$@Gqb@Y2G7PAm!*tnk3zbOfC$iMw}%jcdh@wR)J@V`v|
z?wGrtWh$hWxWVf4o=Lbe{#M!j?-{;62`=ZqHlEe#c@yAk@mMv!)39cvX{BT~I<36f$ik*+gtlv^#_~}g2cx|XdiLTc
z`K06@)jM{5(DHUK+ubny`c9eczaw
z{G1w9xIdY6A={}j&pTO$=HiKep5oeQ*XyJ0))%%@dvI#*BImc9IV6lY-Q0$Lp~Zgj
zTp^zzNJK8Z$g@nX+{Rm`8u%k}SKh_`bvM36oiN)Ft7ogW7Ilv^M7*WIG^-aCd0b}i
z6swjjU=;Utqm4Ssq?$s
zI;Xtbn8Zxq+HkpY?9L`htw)X;#N}1-6%=^#-1Ox)&t@vNxc{hHRQWV3GFe>>4Qk^oCF_OOlo(yENo(zT
zL3%<;-tVjI86sg1q4@&d=)dtP?D*3*;*=wwEe-nM5Or?|5aGUqn%_ehl*Pm)w#4@<
zVNjkfm@-d#YB9}Rc3eOYh@8tWrJ3J2(*Bb1O9GMS8;`X?cyoBw&)7Y`n?ukt+e(%W
zP%${8abzOpLBu{2R%p636Mg|&o1vxkrQtC*SKr8yufee&^Va51N<7gy843Bs{c0Pz
z#55O$-~@zPk0;+o7_?@$HC+%@yF#q!lTtc55KJPD=(n!ZYa5Orxf>3u-y8aSP9-T
zSfP7;0w!KU9k;+Gr*}_Q&_va!P_~;iD4M2O`=V~9YN50V^t`wzh{p4EdNKi)u}CS?
zTc@?_-ZQMfMamo}w%qC*{I%VeOUbgarceznVD=7@icn~Ul2lbV;;vm`6VpsT7bon$
zU?gLT0jKhN7j=E!aXXQF>cIzh+QPYd1f1IRftWhcx;!Bmf^dh%k-270xF*^uifxWM~*K2Gb~T*lOQuK#jW{R`T3q>EsV!-V&^`X>x3
z2TVSkd8BWpNLW@YzBId>f^&U>RF>#plfrIsqO&DE_&hoqTmrZa-lM
z9`Itxv;+FnS4p4l&6n7D$DP{f4?*g~B|FyBU9nv)sgFKO?-3qU!CE`gSodKeFr!lm
zcPRzcdh3!A%-=c?(zXy`Qmo^DM#aueni8aRr0#JzT)sag)AD#L-(7CQ6R5aE$JZm;
zb-=>#;{;h`S}W>K)0C?7cJxvFaV_iDh4|){*51%9b$i~07ByjQ$*dEdf~J2HM5~xB
zzXezN#yCR!*`%s*;y9hLUvSMcMA{3=mwP`88A;JR*q(x|-$>yh93vQOs&-A%U$%lx
zp2zQJPC25JPnhm#dX@X_D_fsW)|Dc6CEQK3*eTpKDL8igK8JKW^rJ=XJlO=4E}phG
ziCn_*&-TG_A2sXv{A1t$&kHbXk)Q>Deju>KhtX;QCI=`+8Esb+^9qxp`F)N;2}KkIVLb7yAFsO3HKZ_#?x
zTbBeiqcqKTqQ2xzv+=WG&{K37_;-ceA5;TEv|lc)t;(gY6>^=Y+0e^|rnDY>V~}&d
z?S=<4gQ{R8v|-Fubfh!W)ghZdo7CLzG!BvS__sfYJ5f3$tOpQt{{&HJla!03C2i29
zqCl2rIVj0K=qr=`wEh*LW%Aao?vTe>j%k@-rJ}{2hm{EuN~5Rae4fx2VNWig;ImEK
z^Er#ItFI!MN2UHP!Dd66F{m;+`g!LKiJ?wkdaNg4JU!cqnnRsD)^zu1?<9TY;Pu`F
zVS0Jmnqz1D2cpjj8q^fIja*_QTF@l(F+l8^KcljIItBbvZqtgK&
zD0q95YNt6UPzabS0Hw%tg+#woQ*<@lk?bupk&$3`qbWvSfV*pTU0=sFo>H~UQoKf6
zyEcMz8(Rii+UiSOJ@^rc+To+1s>@D*<414)4*0p`AIl87QAYZ8TE{T2>$6Y8G0ciP
z^Gl*Wpaiq!x`Ac4NZ)>O@vn=Ui$A?EeqJT=;@~GuhecQ0Z|l<2(a!2hicTYq|AuS-rh5}!Q2{h4GXY^a;JB|=
zJBwia)2&MS22y@wi!!6^mqrS_-KJX*wCSRIdJEdDFLCyC35f_;^0Y>4U_`
z<6`#fRQ9TyOc!D<>@4WiYu5TF#vBS7A@c4Kr7c%~Zo31SnndS@@1Ia%*)FI`BKp%N
zX`)v#g1Bz*I5A)o3@sZ=CT^RI|6)5M`;gdzbHh~j@lD$}p->d^vt%M@4S&9mUf76u
z>jG{W`~+@ys$am;DV1?pm`VFAV)fYQ4&n|GY}ZGJ`E)0IVH$Jq(zzDZodlFAD4Pm?AM`j)
zV4Y{m6WjJ_C*o97h|(`q$Njbii;B-PTr&q`+j6iF`_-leE6kem?&L`(eLxgV;u4Yr_5KSSaSMNM9
zq-f3OT!?0~p217E+EX}I(WN3pkONeR=YX#`1vr;+1+=lP!DQ_92d-DbGECg->=sTVJU8{XQh*eO;#!_Xsv
ziDNzrWys|-K1lk`jer&~KTkOd{$=%870oKurm>1PKebTh`?^EIPY-uw6FGFab1Z_r
zV{bJ4A
z6HaB1uil?BLZZlu1~X1Wz@fG+GRkf^6&Y5F@R&U990AM@Mh-Xx^#T#b7uU57<{woo
ztE$n0)NP;OgAz62GtT_fM<_(=J#?Fjpb-*O#Z(kI(;8^zPh!0LTxJ^(;B2
zqVNN>xTLtZtEsCTLf%2N^3JR>14F8tlvXDJ@@ST&b7KUr`7PVj3k}3R^j17aT~*{p
zhdgiC{!Npc$kU44J1kpbJ4%C!$4!JOV6_TzBdAY03ZHuc^|VpKbNbV#UlD~T??R#2
zvDc#&L)Vr(7R6}!7u(E3ROY7th!h>(ua;O1JL(yubOoO`Uo`^
zM=dt?3_26*U7!ncHJ|9f7RDo)+|r&4rM}QyT<}+L0^EI>(Vwpb=oI8^{#o?vfGZ+;_pv_ApNnuJC;Vg92-}aIgjDVJA#{?Lz*O{lD69A~F-(ZiNRBvgz8oVO!U((<159l{y6b^cQ!flpW!;AAF176c_6*953iHI7iDI
z5M2GZ)6Ewl_=I*mgav2?W^@!no|Lqs|(PdFHPiofeH3yc^o=TRb<+JzA5`KBjO^;s#Pg_n
zRrJnW1i}L5+8Ws@X~+s}4RgKsMRLfCxV@O+nD8B+e>~1IxqPDI)W4;|mSjcrRH~!+
z?-hC-8C*c~LP&N+s=GBl#*Qev(iVJqZ~b>*R9!kMQSP7?~*M#(9Zur*@pMI1gj77|KW(FZ0xtf#W=(2HSM%
z>x1c1oX==$!IZ^ohl`&`ey=8OxC2y;XVbo&ptqmyR^IL4?1>=V8j!!28rB)^r*)fu
zEh_%Vj_A~0G6#6!wzor
zo9;jn3@}U&=*&y0q{$gwoDeS>5w%vr3A(3u>qQdGT2W2*p3!Bw*tG{~_^hzm?|Pmr
z{7*|b#7rT%@HUT`{^PLX*MDcmOYT7A`q3*~S+roBt*5;aU%b`5BIE-M>xCDfWcy9#H^{-sFzcclQwyy8ek+={C#X9WCkX
zpCZ{ZMfFjAH>t{8P4-4>5d+$<(`-dYSXU2D4pzT=@G$rl$3OM$)=6zTI(lP@3Th?!
zaai?D2JlrZ0qZP`_6A1y|3yaGtQt*A~%J>c2Lb1AD7eI4fFxJa;oKm2XN
zi3nqVSS^c92lW8yoMDz~Bm7Z1SX0ltQDav;{Q4(0sT@d#1aEoz2kVHWEAnRjE)>);YZV+oheTdEuw8;hDPZp7MYsLD6mSI>Q((!
z98R3uxBRZZj*io_7i-KM?#%pkKa-9BWjvato&EqhvxrVQGKLDRVkWoGx^zWjB4E5(wNi84j=ST2QE8!Ol?dpF9d$h(ZaB!9^
zoxIMx?B-oG)Lf;SG$$YKY4o=ePH`$GgC`vCkCZ(!$AGzksRmda27H~==c!iKbZM+U
z_LT+kgzN1l3#ll{FA9sycXrz!ri@hL8|!0U-ut8f_f|#Af`FEV{pc-lBi%&gbhrJ*
z`^Sc8Mp7SWbvXU#!4*J>267LB@2V`h>wAF^^3
zUq65(Tq8r?kequXhHF1aD3!e)VR@z1Wx61Au=EiWN+G$Hih2w%|E2MoK#YUwK?8lG
zlx0Lu+eDI4A%Q>$O_rPFwk%-<2>HC60?!%pzax9S7NH6kQrdR)JgJL`vpdZlGKKu!
z=kWLtvQWSc_2()L8oL2RH8}Pqhn(yxF;fGk
zwrIJ-w7yY5rXFzyW)PX^3D{pPMPU82+A@s3Ogy=s}YLZ_-!Xj?R`zjELSWW4*q?p#^z=
zXQlD^J`edw-NYcPSo&WVF|*{4_z*m0za0h-tJ?B#{4)CqLTHRW#%C^VUaIKv@vv-f6e1bGJqHIlkef2o|Al+f)3dRvF3PXrkS
zQRbKkG&Ql}KO)y)5f69?#3aKJ_izqq;Hg%N`xdxp&K?K4O`1|UXPsoR9jhbES50yL
zBEyQO7|aV;EMq^xzWu_($}KB&&C`E#j0&^A9bhnQ*UdmTuw1{tM95@=Mn>6=$m$|2
zPPqwFoL+aM6uYUY8MLbbltzAozUEGBd{v*lZI0Lup8IG?Ce;o|Y
zunJ#!yLA6gATU9NmI50G>SaLSsSu*cYl>gH+3f+qWrg1JCa_|?1yxV?D1DzoF)UOc@1u|xn|vYhMv<(TL4
zv0m%U_iz%utS6(K9yMm!c6IuhaILwrUoQU30sE@%%pyL7TOqe@L8tVR*1tV&&3I1N
zqWd+|w~1arpkZ9NKmX>*EBYO%ZH|S$i%)cS;zME`w~r%rC~Ab5S$a41;ICTVJmgM5
zykp^=0Mxt?NqK;Nh);zy7h}1G=0SVw-^v^9V
zEz;jY3$?l-q8i3R{R5}gejl|r=UI!~j<`L{9d_lUZP&2Y%S<=r`J%+I&-DTP
z$_gNT@OTw;A(w9yFtFi#>>{0g>27X8$rFc)-!Do)CQ+wyFC}E!jZ!A4rgQ8n>gtd4
zN-&Zj_haQ;?Js{Nr!9Fop}u+-)QQ$@(Ehr9UpY@4C!;wyV3Ch)J|*2>RQ2GkdqI1DuluAuu+Kk)dxTnogEy0IKV#AD)1>
zn2KyM40xEmN4~F*%V&N`L5{f`9#Y?6Wv0QKQ<^Lpa!xYh0^%REf+M#Z9GJ2CtK}hDdz4t4K355ljxOtknWjjtXRM8P(@Z}L%pX6a$*N#_M-tl+xZF0*ydRSwI5M`~
zTOadn6m}Y1QPp)R>-Ec5|7JJ7ph0!@JU}r)+xrpI#u*eH$J*^Un=;D~lhm6ve3ZT3
z8`YHSeIz(kUT^L^t;Qv^7l;eWm5**auFLz-nG7)zYNmxv3c8)W$)m3B>4+MR`m4J&
z@uU~+0TURo=;1Xw5^2PkH6h=Y&;noxC_crJ@ZvJlXpa~F3?noK7$oVre({nkTS{?a
zJ*4+DhGTbJP1X8Lm?*PpPRq25?Ykp@aySCw?Eb;=u=WlhaxEmbmUMO)C=77Su4426
zoZE-(m&LtY_IXN+zyJB)wh3HZCCzyau&}prqsOiTlXDdH6556^@=5E^^5*0?T@!a5
zqZf>@TVi4zTFCjQAtUqt(kRkwc5b9^Nvk^rWN!yzXaar^K8ElWndjqFFD^yMl^8ny
z-~3Lv+yd11_7Sq>07D9Es6^Be=}&8oV8L?owyDb$I(hwyN$+YvsAoqzVpy0O;M9?k
zSV$9XDc&&3&c`a2kOodG2picxHA3AA2-62W+hDsIt)vh78Lc!B7wUYiG
zT{1Jckvn(yRnKPo!d}k8>~slMTUh4$+w`_~>{#xNQAvHVk8dj7=Dd6cv?Uk3{F1$1
z{P4Os`Cl&GX1W1*QVsC01C;9#yHr^27+s*^21(q8aN6TMrnH!1
z9v6)GF5+`H4_qo)XPnF}@_)w>2oHwHu9&q#R)QWK`MuR0w;yv%n`{e7PVH&Ay3#(?
zf8qJ)!wMts(1QPTs^&XgM7r9-EaMQK++v6z0H%}?Z{l+5n(3*iZN<`sH|jgp`#$}L
zLf`OBUpYm8S8n)1zfEz4TI*lL{@H4*;28XNqWPkNQy25s`v3Z86!ezX0rG4J0soGU
zo}o-l0TbGK`Z5-B{D7qh88x&**YA*KxJvQzCmS2ETN?6+LUW-}dU}A5Q1WIGM-e5+
zuy2%VVE9uK>R|Lnd9QgZwjp>jB)Qod11ilVzo(fWb@G5
z`78fQ39*Tqsd6(aJpK4!+C6sMxX;qR0c>Zh$T)XarJf8v@ZlyP?reb>Np4`+KaseY
zfJg(pYQA=&sL^wgXY@1NjS4%ei)puiQ}Eg>jw>E?mb022KBp3=l6GLZ^3SQUQ4UUh
z(SQx+@^)WK*9%TcfuY{D6X}nd%=3M)KRnl3(@I$}?-Y2xgR=1D1_Iw>k_~kV^
zsIzu`3zZcnI>9(h{<6K}O8?^m_T$wHDWV03T!y_N$bt
z%DBLrZ|Laj%=dWuKWWmSjwt2S1E2RDj!jG^M?U39_+K$jy!c=q!jYXkJ@kh;VqTM8
zpWngUo6C>-&q1(y(?BDiO7;;7ZDx4u4BE_(d6Y;C@QNlom3RMJd4Xd5ywcC@rWL=k
zeqT1DtVtU4mZBm$pX2QbXQ8(bxFVW&GeFBx3lQ-KS?VLqg$4NFAmMG-nraE&JoBHr
z-Fab05yw0)>mZC%Z@1u@#R~rBxS|j&5OmB0uqtQ)q$&~HH?~lwBI&+8yAjLO1+7+8
zjQPqR+WhwCL80*5YO!8k%&JL!GOY@XduFO3y$IYSJU!PpA7!*EKOpwPBHI~NOtV@2
znK~gmK%aNXplx-w9=NnIM5HIfy8(z#rllgdh5WMKqk6_)HiKr+^;W4z|D2BJAV(eO
z_Rz;@b7PqzbnS5*c=%Jk{SV>;I_eo|6$EsR1KIAsx(l`P(=!y65bGU?+XVprJ|KZ8
z%CoNr_$QVol)scK-34_H2~
z*lU~^MVlw$kQN$_k@1})JZMe_$)fzqb&}lTod2DIXf&$x{&}QTl+NPs1M;J#x6oa+
zZt{k`0tO#H&O%(l%QcXsKCtdLe|bk)5B{SR&oJf4ang$eK8FX2m!n`X7vWuLEpgz_
zzp~MeD3$Zh|C5a-L>8jMfM1J}Q@YYD?Z{wAQ`k^bzWli)9#zcL?&S4d=`KtjXmkYw
zRzm0w)u`to=#OzgPii%iWEl@HT!?u_<-{-1AJzgp%DWYZx}o8n>y=idlvSQQG8H-`
z77{`(T1Fk#M%ofgIH++w0DSM;=0PQD@JF&`k62V-REO#uWpwg|%EK3KP(^6v^0dLv
z9QE}^G5LwD{YQS?i)tT@wCLtjl%#r}IOGf3RO+w!xQ7f;4vDgpIY4or%NrwVyBel;
zVGxJ)0ZK!=*#{omNp9YPrhO(bOy1DP2^>&w0NdbMKGu=Q|j5nA3XOG7n$|ZL_(bR#E06q{Xm0khT69wr7W)M4Bp4|hCXml^c{g7+^yhi^T8(Dmms<>N
zmIja<%MV{hY6tEkQfvn&vcykEZr9j3SqnIAL%m50&UkD^Ld8U@`)zgD$53P#aXmq{
zfrRw%X@PaX;MCIA7tOxtpT-}wbj`=W&h5~$3^@z;
zO)ZN;XwjQJ`+g5QX`I$!@tW1l8s0AL7}enw>8!hNS?o}$Cb
zWw4#JTIPw&u@t7M!>9I6bGn&4V+w2T0VW&=-Z1gmTqcD+M+cnzG?CnPb|C-z*EV^W
z^Te=8FlZ^yXk!@E&ZOf+i=H8EJhD|r=iT!_uZqA!4{agh!++97!N5(0g1nrT>d*Js
zrL?+Q^Vnh@FO>zV#bsYmRg1%<*TEPHBK#q
zg0$*-XB<}ArdlWYbc7z!+VQ$vMJq+NoaW`U-0L8dbGSKJ|AU%l^R2%154ebQQJ4WfLJZx!)s6o(REerP0-FHAXtprgsYeX_PxS#&u+Hm
zh(pon+rC?<(WgIlp*AfFFXuN3ERAB$XC6IrVlfvku1pUKUl?fe(TTbo;a?&lr!GnAKrR+Re$fa#_ww1C$Rl5@
zq;*uf1@AxmS!snnpsyXy4v1{4)^YwWM=KGNWn*+i^Jxvyi2UpG$P{qpF6M1M^6+>8
z-RG($@|Raap-IwQ_Te=#!ZiZbg`j5?qeZ_>UdWgzcVJ_&V{j=wO;{N`72*N{kCmpf}7tJLGQXkldJ
zp~^sKRCXPk^>RR-rVr>hP-&wH*BTEvGXivLb?)JwfkHidT?f*F`50ln4nzbY#Au&h
z{{RTawug8$vC-0)f(;K1*xFOz+rHC+p#;@h2`JO@lLiLJxAOWKPoPvABI)0Bw*#Zy
zj{?z
zS{t!Mr_J?UA^_Tn?x&ujdo$Jy0>2XNX0VtQ%{{?-ADLHn?=slws6m3bTVD2
zhWLkU+mJ7`z|&VvyWH`!t#yC6Hd<^x+}K8!^v|m8_&!Jqd(Ro5%uU79bv1KKRmNu%R)EUHiMvmbEVK|?tvA3jj&l2g&^4P=69OMR
zj_o7hqSD%)A@vB_L}n%33wuJuliL=CV|)m
zfY{*T@Kp^cHKpaxTs_@(D!tEPHxMY<54XsF+m7g7%f_IFx5Fn`eDE=h
zS6nP(ZknCe<Vp=yAks%(HNS}{%Qc;xry)7KU
z9B`>-599xD#oav9?_d|4ySNI(k-?=JQ6~kF*@~e(UW`m7m%_6cPo%%V(u=vQas8gG
zLzE`wdB2~!s5h&MIoR#0^egzJq355LSQ`Ps+d4BZ=i(@;7w*Lf`V~iZH4r)D^RwRa
z{Vf~(j^5wEQg10n(xAORfC>B85#Q|lj+3VF2$wVplH)^frJeBxkkEnfpg|YT7iHkn
zgB&^_*D^Qzb}ePXC@(zdF|99u&;;l=^tMtbDHofI)Sy^wuZ8u8&K=1_megEbC(2o&
zHT+|`v(mb@!(#Kh5ZgGB30A2?W(Ae~81Zd&z2O^ysf%44vWiaE4!3q=I&=Q(A-$@!
z@J#}36@eyDL1l5&il%cJ6jiH!N5D!|$sMiDU3uhNTJOxjhUy=76SwB0x?jZ|=7JUuB1`;E(5
zDmsR)tl;!MoE~>Y{%;R%6SEeOZ?5I|+zd4V1Mb`X01WDbx8_k6x6A1dC3g1XF24K4
zyQNs=`+ilvh|)ItxN`4CHP2RbTX_$&iDJ03i-S&q`uCYa_Q7AQAzXits2$`o07U{D
z5hbRy$qiso%~|K4eraYpQZfh#Ii{)i8e1-?ENTp3|ImM6z@?ze+t4m%?tw!qh7BtR
z(hMdEuB(Lq!_{}kQ~mw%yLM(0vPGiIlszt471<;65+XZ$Un7z&JDak(_U4j=>}1c#
zy!N;k*S+uGtv=u1@A3Hk=^yWN-{+jyd7bBa7t(ovCK%Z6OdC4=a_yQRSMdz>xsxWE
z$%Ya)rQV9gfvgssLU}r4B#rdK`2-ZkfANQfrwi-7aC<8pSB2eThsj_dg9Q1qC(RX1
zchu-z;^(>cuED~Sa~03wGRv}y%O<0!KCRR6fJL!qZ>hf?rh10D_9YMxX?xB5WbFS=
zzBRm)fKvU(UHLjb0gCmwZWv!&!c$4U_!a#@AXLM1W&ei-IN+T@&*Pe_W3`fs3;Yyo
zl>*Iixc2}$EvvG5KR)}w#We{2b|gN3i~OS1DVdZ#@^&fh&`*+A8`s`SM?8u|fD~ny
z3{LPb1O4kh77{p`{D-G7DPZAchi6cvpeu7y?-_JMIEGynunj&2bson}0Zx1<_6_9-
zqzg{Ibu*LEY75)=ok&Lt?1H>a-efisf8Pmutz*UH2gw(d{d3usSbI>%?BMi&%$RtL
zFp!I@(?ml6iKm^G|I`*xmU92>3`Y*==5aIk)T^?4=3m0~_QC2&oAVMFoD&sTa{waS
zq4I58?obfP*5*~1HhmgDEdMWKUAViJS!Z@|YFbdUArW0FW8p?|_r{vi~s=S;M>O=RZ4
z@kJk>*>$7&cta|HVLOvI;}UMCw!Oql-Fy}j&uoIu-1M}C5}2|Za2_1ZTU<=>z10{S
z=JB!myeRnzlw^q574IkD#PAhN?|OFq157EcbT8osOnL^MgfHTxFpvrt9bmK0+kOvM
zYdUV{qt$-)H9(^(F}fCaa6;IsX`H?yWROc)6dJX9IY#QjGKr(Itn_9LgS9D*9#(6-
zkyOwTy45wzBVo!wiUZ42ySz3Nh^b)oTRV?M^LhxrxC?-VEN0-#u&DEE7-hYfKbs`9
zEnK?u%DV@LHqn@>l42k_&!=Al_Ch$CQZ>!neGcB>3zykrS41_XJhsQU>Mt(x8(nr)
z-sBXwKo3~#fW(_LT?>g~kg+>>lBWM5B4IE10QP)=SA`fLC)e;uxds3xB&b>I=yZGgy-(f@+FEo5#s~fA0|Z
zUf^3X$v>u!v;)m+s^IpV1Ly>KEpDAi=@Ka#nG+APec%2cRWsZjaNs8cS(n9?@4PtZ
zo-+_~3{C8Ozq$=PY2;tJ(Ih?>=7HHiYiNPz0BimWvrDd>;8jd}n<+%&_F0IyPUu1~
zg)`-h%PRlk6t?SM85y>$#==S!wg4t)zEVK33O^kyWP1Qnr+ar6aTvr~7jXts-M`q{
z0bbUagQ=_+VG~?cIO+grm>(QD!Px`3Jc6!;vv+qp*WmbKp3qXfq;Ee+s*?B;vblx(
zDI;ASu*HnQ{p9^)_z}LKnxGoFqyuH$e^oK_aRMOp6F52s==4i~hu$I6Q^2C@KKL=(
zo8S_T)AF-YyU3&Zh7e7^e!#lfg1WrKUM$54x^9_w=cM7VCbW85R?vHIBEElf9n#i$
zt|)m4zhs`jVoe2Lq-Rj8R4lAxuIb&*IT)QbgJxJ}Y;q`exV`0+j)WQ3_Ve*q%LVqzZ_(9?WPzH;R5MiF;P5O9=0U$GsYes$Rf4Xf
zR1)2%{x_!yh?%5?$wp10HOM6%30b6V-`Eo$V_!WW6Wjdn^>zhpN-duapN+KP|Kukt
zS;LIDU_)GqaP=)XggF@3ck?R(JJbrBwr8zMgE*yZ(u
z;wKZ)B#|>Ja9ct_cP4jjM-;o2izhFHdFY6xH)|d(W!0^>Nz^7N5>vaabUkM5LGFHvQth8*qru8b2LDC58k;32aUk%
zk(!Iu`?8bDm8dqOR2NxCb)Kz;wslMxD_g?B?3``&L-%d$%R0WlrPY!B
z&vb}vFC)WauUs(@s4~e_uJ4yaTG=&a1i;&o-Uo;V&jQ2<;3|kLIfHD+)(#Lkg(e@v
zqEK6>tpfp2yEw2%rO?Unp38$#w-bCF
zNl?M>
z)*fUK?HGANu<(bjGBs0uX`2zm;^#U?J?7WeD3|b)z&V*5CsQfRF>-uDek+$-k9^DI
zuVKbnbieabGebchlZ%725Su{sHgNwf82=J%Y9bzm0EAOmDvNOIPOlfW+kcGo0-k;~;dq<_2O6Cy*IQ^=zK;)1&t
z?5a(t0392#r2HpMGl{q`KnC?1es$NtwW1w?@{%D9XV5z?^e*owXeXtM=
z$Acq3k{`#WNe8|z2+vMo2Rl~Q@20eANPIXMXPuby`%+2YrPqt6x;OHjGIc|i#8%Ne
zE{`jk^Bp3ZOQb2A$eH`!yfftB^iJa9mvE`$!G6HD4$wy+08?T?TtVH^E-Q|F99sxj
zb)VrVj{IG_fGYK$^|i{XOhmi{xEpEw6I?&2y;3txUbF`8lJ%u1?(uLI?<9!7_llob
z!rt2;-DdqYo{{(Q(N*w@qt>w1W7NCbDGb-$0^dknDsB-}cX|FtQHdQPkAXyPMWAmG
z)AuR^KZS`0#V%WyxdI4N+dKEULia3N;Omr!K{HfMr@vw>odkZF2>c@DceAxdA7}-#
z@%slgOGCzJ5-nbX6!yVnrmPkvOn;R)3+CXV)e~m_}_FF_?`Ft`E|9f~<;Ei8_|E5m{UKrZ_n?i@Q<#vNvKJp-fY~U;$
zyDVE3Z*qfTZhjTGE?`kk@>P|F2*IyWZ+ShVcjQacKL)$;{dau;N33(s0ELyHpLRG;
zuVzIiAY>YnSqQi{w?ENLMU>G-WYq%dc=$=qC0V*aU4Ww&T%C)K$4~b}
zWfH$Q|4)Hq;s0abHc)UFYf(LloIw2C8v<=4rZsQ5BV<1#bRcG
zPM;#UfeyKI7CeBFpK~vigj}AGfOGHR%!)lS!80gJhGj`x(F9^imSjkUqJ61Pbe^a&W%yKWGj_+u?P?KDwfo8=*~`GH2Eh
z!#_72SM;It0+teY(J*0H2X@cm$AEjdqhZXv?MYH3b%30$9mL@K(p5o9B2{{&Ui`~4P44#u$
zme%0()y|9IATeOeBe*c=z!Y&*!UR(hBNjbEbgUtgqHifq#Q`e
z0HkqtyYW5iyT+re`#OQ2!T8IZbMORIdA!isGS6)s6}vsh2G{d9)HI9l?(E9nKZx$&
zJLBgXU1sp#*(s*01bGBZ^tr?Y(rw{-{%pZ-K~+~7J@o;iaTS4K+&*`x9N?$B(r+;=
zqF4)rc8xX;FxdJAUdX7qRldB1LKMG^y3t7s*#fASgp{afI;ZEb*7|T@pEvjejo?0o0mH^5WW!q?T)=abOuVH>#>BK*7i=Sj0i44YuD82PskYms-cnfsW?
zV>_$0jCFvY;6=Kz6m~v)-%L=#-D($jRa#YCW_pg%89U1TxF5i9(q1Pj7gV_i0|#|H
za|@A0=Ic^j~cIl+2-r
zWxhlcA?*+BMl4Jnu=^#AsB_uY6{MgL>G+)YlWIGqgEI2}VF6z4s#!-+a=vxJ;q#PC
zrHa#oJ@pi-Ti}cy!GV&h+Hy{B&#&j0C%zb+YTM)56Bc1p%fPk5hFrPl4gkx!=6RIj
zSmC#nwfZ{bbo|!0yV&L*3RH%uregEg=RQV{_Fez
zS&ky&pS^FRC$`sqqQGMWIqI5m?4>~v3tVEtY3YU(zN3%oVQFzqajR~=vjUE4l@7<$
z@gvCfSq}+HFn=s%1dT1&N9O83IoIebbx8RAK8MGF-F7KK5(BT7IoDDVXku9)iHHuT
zO9Z!(99lonfnT=BpFuq-52T9Mz!-?=s|_HNo!v9A2}<*-0Ol%#K6|IeAFO!l+1j*-
z$ll&>xZs(y7mv~iFIj^lTw}L!!sh~v!+lpz=oT~G#MC|J@kuY1#axl2WxCG$go9eP
zYmyUkx+jL{Fj$J~tJ2&`!G#^8mgH1eq~Zb5idWySrCxYW6n47p9M%MFiru!||2(DHM6|`4?4L
zR5oyMWf$b(QPq3_M9H$^ml-YUpcyQGNDalse|spZB4?R?S1T5mM94Fdq&-#!jzXR#
zm9{Qr$MU6OHG7nz?bF5pg*`|TYIJTsP@A(A9+WyKF_zH~Iae(l@I#;Wsbnko{${Q{
zzckymaSTZ1yJ^CnwDQIUVn)#a5rZq8(Hdf?)(PH1Fk9zFYS^R;HfM|)C)BzG(qgz?
zxwQ1KHsy{ijWbMfkx`kc2UIw@23pV_)xXQG;X8pO2#rnS`8iY?@}l1TCVE7eEtg02
z^GNP+Bt3JK{DSUR&gXS?%;2fDd2mX%hDMh;`OMG{w<<;Xv!ilz|E*F^+4fpnO`=Vl
z{Z=6!mxIIG<4zxveBVV|wF>jcXqK>5x;}gEmi30@YeCMoo|Nn22*j^*whJIJhA$?_zFUUtirDR@<+~nC=))@P*n|HGib=ml~A^OQS?D
z#@i_90;N}KZ$~vScH#&gZG^K;&n&d(#)G`IpUeZGQQJzl?D2
zZ^cZ}nWD{XK@4Nsh$9E_yb1HMqXE+M&D6Ef^~j$%sEn0`@B+~CG-sZSDPIbEi-i&2
z!1nq***>|NR`tA@l#f~40Y28cosU1?!00NvVI?1Ma`Bn<9=$`3XU?A83=E9TY>eNc
z(RSi!@`;jw5R|l|-k)J3Y!!{kBmE}6Na_xg6!{C55fB>7*9x&4V!-nk|1N)Q?abHm
zGBH622hTpOpQDr7d6PiKK>$u2HeKS&dZN>eaH@6}vS_$;3Cz3gKCkhL@ScLX9h^i*
ze+vPSseVo!!*;jcPeG3^qSDHNLjR~!`rlW&rCDzXmvI72lB+kOP@+@5v8(VhN#&|9
zp0mx7MKI-|SIo#n(XS<9)wZ(%vUxkU*9U25u%3p*wB>K#qh5H{Sh!mlcP&ZtyXO<^
zR1jU^vP>PpMAcvjUB;cqbN@z8Dn>32ESIeJEG!>8DHXjiWwm40ZujlCNc>UhEt|0S
z)!$~+xGd-yGo45QV+Ub}lO23{3)@M6L~(HW2vU0+l9f`%j8I`^q%3jH0^e|i`sIMxEgEx+;AHKNO>|B0EP2$y9@JQ#uLJw{MFN@rK*4v
z6J;4sh~Yru*LH&^n2JECZim(!oN6QpE?m%aA(yi+bVw94*Y-hm`hrtl
zNgr-)6QUp66KE@QeBc`!ppE3n;Z8_nPADcKWaGYm2o1TB@ckO8q`ZNK{2$2!euza9
zDeeHMa={7diDa&Kj~wAdR{c_;16jZ`62k7})Zhj2J1A4P>
zKI97G=CT}A?_h^bhNb&^tLZTJ^T*v6tQ=+e3i31V;t$N}J;a0zXsdGkLz;wxu`nT|
zr1Cb9JQ_f=Yl;hGxd4+sDr76;AV2lwG6vq=+vr~i{PQp`g^Q_+zA3=6EoSAJvKt(7
zYO#aO8jtYB`ay4e1k>$Kb?f~)d!xVlX0JK+sQ)MB-TIIaHsKFE)yl@X*L>iSY_9FN
zsKOWK^5OopBSPbELTaBxDpAAmG;Br9!tXO_g!}VY2t1j@q8yrGKOcbZ@g%4y7?lWnL+l6nK>06$$;w`HoI+h<_WZ^rSY-)Lh?qiPQepy5
z5u@Q{e|U@y$E?U!lKI~f>~ocpj`*dGeDQD-vZ;`cpdP<+QaNa
zM!m{0^iAg=Q6-l76JS+|S+5@+Q{X;>-XvK=K0XV2ah<8mzYTp7=)HQ
zZ0zup{NxR`M`^d{^i;nFawI0w3Re-uxc-Nvz0$h4!i5Z#*PcOF8urOM4T0WsaDme!
z5k*n2Cu(ux7C*Zk2u`8*_Lj9Ukdo#eKVv$x?W#4tk0*meD25$s2QdC31kZ&U0+l^L
z>y2fFuxUNdW2V-B;~aw%iEI)e@Z0M*6V_;oh}1WCqJI;5ph&(=6QD3k690Ty77uYG
z#)gT6MMc3S_!(c(&_${Q>B9q}TQpOSvkHCe0caTWyX;>1Pj{$hQz%q0cIRoDTg*=Ee_rUXJdfs1L-+lO`p;<>=!IN%xBmNyBV
z$5}#TJO;nBEoKXTpuU5)tm>>B&XlNrvCZV9LG60SGng6Q->dq8@MIcImqe`p`B_AP
zP07O(bcp6N$4Nehr|Y?HBhdxYAJOn~=bQX4T>fDRS-BXcijSJ4?yvCwTZ?$5Kpj(8
zBv#1rp58YF3?vOCtP8xeA6jiAZ~NX*oq~I7Ih5B@-e{=PjuT$CkR1hO4f!{JOiWL^
zj$P{Nmg8W?PtRT%5iMZ$=&Sa+LK%!>#3XtCM9M0`{FN_XQeUTDF=yeSwG7rbyh%?kjG|%t$a5X4IlYN-X8uAW
z65Ut!!28^3S^R6#SM=}zs&8N*H1sFdGqCPeK~5~zr1%KeV&jO17wnc;a0yU8$0{FO
zOVwpLg1hMYUI6%Bf|Y=x?9)*q+@eQm^}du3KULj-J2XS^_V~xd%vndRYE<{Es>F=i
zEr@u`#BdmTl=m5fWOvu0G;)DIm2MN>CM3ui)1bV#mHy58o8SKd1`=l+#{#<5)&qKZ6gv&6LdLIs
zhPe(+6TUq34CPBhG4okx3m0iB1Gp}D;(2EDr<2k9#Xz%g+Sj}x>%~X#tG!k
z3(@%-SfpgEy%+uyJXVebX9(B>SfbiQ5^}Xl{)Y9Jh1HG7^eVTiCN(coSb||97gLX&s;t*wuX$
zp4Uu+cIC+rsA`I&3J7?&0}RoM!vK@nEj?6vew2giO3AhFZZ+<
z#8(pw3Y++3TuAJ8@E3CnG2|^^m(y-Pi1Nj$c^|a-?${(z=qN`~m;22SzBCe3L+UM`
z4gauhyv({fy^$d2+u!%)!32TeC)dDEc>gFj5faWp~V7-WtajYkm&lXFFp;Mt28cjn1Nm}
zcQd=8;prVV>(ky-{eO#;;EdtSu2c;@xNvpsd{grzK1RmKaBr
zKGnQ~8~Oc7=%lzm0Zc`LI@pZHzydJYGDDX!PJZX>!i!Dwku9v=OSu!DSml5ybj$}g
z5-*nAkmWAyp{u)oOGu$KSyGsu=e?4ie_KJnT&Ut&`fpa6WA?_p
z)qC6DECWns9C7fuK0XcVR&K|5^GTX
z>v~wAQma(IP{4e6VZy_5Mf;5}+TZEQ6Kzf}1+Nj`PjQE_z=pOYAP?nKuh7A>k=<#W0$TNOq~bx25rJAbnhkQcln_ugHMXrzuy{>AFByi|c?
zyzG9mNcyj=Pb;vB$L;eMBr8D&QB$SVVW{n6Strti)^VXcnR{BrCz&#dSbBbyVbz)(@Ay
zjG(3T-i_r&Pkld|jvqT>(r4yGBfU1Wq5`&k_fU0R7Qq-s$CUmf7Ex?RmA6S4(zAz633Mtz0KB$_dHCPg7QaXMIqaLW@o9SBQH)We>&Y$jQZw
ze>N?th90JZ&3$?tXJ1&W(2sQd7f~lkhE^_b>OygH(Cwl`wvC+L=W*2=O
zUlpkmc>K>znrE?)_s!=HbDsisbOPuukHFpPBxrU3d#dYOz=G7CE>4d+QJ?Rtl~C?*
z9OoqEV!;MW*Q;gZDhPVkll}{wUih}txf&^Cg4&F6yN=V1je9@L^9;)%;ys{nR-sNm
zZLEpjU6a-$ztzAa%PIQy-)xZP$c%3S#(}B6OA|l?q&u#v0y9;02DKSxhzr1(wgx6g
zKLSRja^e<}UZ;-xf-NBO$ddUFA7LI#@{mD>%}iHH_L6eD-2P5nyW4Lb(RPi?=vtla
zHN`x%`y;4NPFGNJ^Aff0h_C6gu=4V7@D!yKzd@Yf80Tk_-JijT0}QhdUDX{F@@TIi
zIPev?6(et(zJW(4;_!wt|F1}NB@`~kZH+hFRCQuHIKZ3LU=OUnP(_?-s_HxCG*%LQ
zr=eivQ)R3*UA;$9_$#^rJ)r14ab
z(%sr1KfP5VQ%@7h9JnFVin5xWjWiQJK{ps-pB#!{C|B_mDJ^0O$y0*4jIWWdE-!e~
zn-nfIDE-&`D!i-s`UoTLH@+3xj)6Wmm>OXk^l6I2!j78Yd?pYh;RcgY_ms=WdY8Mp
z`f+HJsy%^?sdx8l*kSskMBHUkRyK2L!JlVzpYE|Q*Ht36@&seyIif=hTO%WL0jmaN
z`}yHuPNaJC!)9eA(cmY)Gso~l#R~U6pTkd$SMvUOsPhzFnSYT&>WI1Nih1lHfy%Rh
zI3$^N)g(^kU1#X!W0+Ws3zY*GN9~O*OdXjL#RoMWk>=J4yNBQo*I@IxDLLr!q~v
z<)>~*S89PPn%f9JUFmaYajZLCbesnD^t`We*GAgMOxlETws@e>Gx*6rL1u{ZtMh4B
zXat52?eMbi+7v8UzxKB%-5}nR$p@d|bk}5&2lqo7BKGoOX@y@@f|MtF={9!8YJv`f
zW2R$wfOK_}VXzAf>rD+}qG
zd*cLw1J!X&mllB+H^>|6FPr=ROOzjVLWKB^!N8A8xHI+j!;g@6#qlSyj`1&Ng*`8!
zd~MLoUs`2%*G%U__RG3_C91IT<*DRn&?vJemmU|M3e8v8!uGjzq!5FA-Ns>%EDm-h
zQ#v6kkdmSwRIL1_9j_ApqMed}95`2#(a6JyQ>Rg7Rh(c7Bb
zVnT|BaNjbGOZ|de>PtP%5m=%d5hIbplk$_!+2slUojyD?SK!Aa?h#
z!(esS)_p3%x+d-P(rZOffznu*V?pF)=oBLJ(qQ!hFj&G^bw*If%1`|SJ~u!=VPRq3
zi#D$IVP_$@ID)U(F7Gt7!{A-d5S%L4s8#AJOCj+G{)f3QF_WS`n5dG!cNw392OJ!t
z%k#sN@U;`BqKZH&yJ21ogl-3ybTEw=cl-IK}}F;0bp9?aVqBI
z6dIKXxaiTPh|>m8vRAaxVAxAB?zMLcF5#e#%1UY_PbeeK`Hk3g57N-<+B|nt%VMTD
z4Wn?%Bf_OppfHQUY}dypL9mN=DUDZ%JZ#{Vnm;O&^q9XalN2n=p41?k0rxDHR?R*R;X4yMgF3_tPKGX<
z(~_)act4F8TOpipYuaOr2MFiBpObuPtaPUEbyZXJcA+=iRBP90oxo%7U+)K41e
zH;q_>O#McGys$)v6aC
zt%VA;ZK|^FvVA>;l2t?V<3{e`6;76Pl4ljB4>Flm5J9$6*GX($RwA1S+P!}5QnFN_
zhUeHN%1(5<4ji2|AFz|Wd25-h<2xs>!;n6Q^49f}AN8MBTVch8>Xe*BBSRVvkUcA`
zJyX1$I)4XfZk53Hp#6*2D3S3)Q()RXA_P0?H0mq&)+*0f?p6Do(UeUE7rdt9jX_M5
z-c1
z2Jz3L=l)+XY8y;2XrRteD1rU*6J|4-AB|25ml{6Y#3~7BhzPoUlPkt(HejM-kac?~
zZ%s&1OxLxG7H2@ReEm}Vax-c5Sa}ebWPy~H$={pau4UUfIeCiP9rL{N{@q%@bR){<
zjSuosWt_vuvY&qm^|EmaL8mGPRx}+h3CHzXp)uN)v1qNQ<+24oE3pvZ3!OPPRCV`U
zl56@gEj3to3k!3GRrBi~tal%&o4tfwk8B-J#%%BJiin=c(=>qfdC2<%LK>@QKiZ)U
z8vvSc3z+kjPnj1SVbb*QCgK-)pv+S!o3!W08YulFrsaFn@-6g(tPm~b>5CF-D=_tG
z)R;d?LInBMA+s8IZgt=qoUT&M7+V8e6R~(JSS{csXC;X*tGuFm8Q{|sNotaMvbO!+
zukN&+(A<*=uCghv-B+i~xN%i@dH$r&io9fzTy;O-qZe4qUx*V+Uo8-ujRtfov*>Xx
z>8TwrUT2_XxFXJ;2V^*r&LE}32Mh*Xmgo3_-WILFF?G~ShkFNR`{fUV&~0dje`%_p
z3F`l(sh&NUZQGdFq)+O7$B0$;Ku58IrjS>phq_k4ta~F1ym3=Cm>S&Lxny|FUmUBO
zG%87Bfx*Dm;Pwz%mo@Gami#;Ad+hW{$`53nB;nr|AAXANZk3|``TJ@zZIr`dt+4a%
zBO$1-X9*R`JnhUI8#gOGC~`-7FuTC09C7H`XZTL_WEuP7!q75m_Q%okk-e{t?a(>P
zA=JDhYzs0Z>Z{rtzlHQ*e&K!f2IXrzC;DrsJ4g(@08ad07Q_G|o?~5WnkPfGq2|&BjqkoYDLV
zW7lKN;i@Rz;6umyz2!~9VA1IUvwL2X(fgA9JT1>^FPj4Lmmv)}TjTwAmtYr+i!_Z@q8)+$!M0mKpvYo&4v%K!
z6z*m_ZSTiuhZiPMc@LQ+5?FRV2cOG1X25J@$|2Gws}nq#XNgOiovWv*y_EZG4eg6p
zt*IR?_Z}wLz`Z}Sl3m?y2xtrq`aXHW?R7YLGTJww2Zt{*%lCPlm4Cw$O0vtGZvHq`
z%9aUuWbYX)Pae5LCK|V4CBAcQi4fZRhKk;aZa*
zaPS;_0o*KMk%`d!)vF{RvI=G$7dW4q6((G{(>BG#gfa<6G;8r)i5^SMEvQ0gE_Npd
zeivT7Zhvq!%GfA*g^_PR64JhQvhso6!Po?TF~;s{$z~>(-JHej)eMBC^kO_d0Il|Ut(UwLQ&9D_Nt}jb*>u+KO*cSXwb!&L
zw~Tdz8umdS_@k^V3ax&0ULwF(zaBa-dlQJeHVi}qwL=2HkwSzu_h^bYzOR*_2;c8f
zJFnOnGUZpz4h4(U7aRIP9tJkl=daelxL1YO0y6u2{Fe#F1&+oVGJcSDf*$Y>V*fu&
zsK_*pMFe1XXLWgE2ouEG7^yDCT2O3#Qx97KzD%n!mu&G)+AEklB+nM^
z7$38TWs7u?=k-0Ou4QB|EReod{f!-HxIu~^aM(RL@AV6bYxO|#Nb0O1G9$HM(bPds
zgyA%fTP0zDz!n>F!y!4pF+?%XDO!>;-PE;
zu*Uf`aGv3Jw6}I60b*^#;ch4LJ>*FQL_38G_Okvi#fXaVh?V}X-)`ppj*-_82SMkr
z`wzsVJ$A(cya@3@puYefN9Zyp9-;@m7=3lbTV*LgV8Fki=BT81`l3eL6+u@zqiUL`
zx<0KGxW`!~Qpd^iy9C7#dpXSw^*Vh)81js-ikldJ$k~tO(>ew^k{n5&7wE>C!vtz;H0QM
zuBE&47eK+sX9r*?O~8A1zX;YypgCPKAQ05+_FFGznO@o7@kLGbOIRcM{kVmwNLb|{
zM$I|iDD1a^UR2r4CDYq%3Y>7UQFnx)Jky)a(X0syL|Ip=H!*N~duRYP{pevdd`woikrUq2~+)ME;p&mX+~Oqf^M
z-n4Qa?aD)}y!{I4rZcmjEY9FYsPMOk#Ro;efhP6&&u^U2HP}n1r(*_
z6En%%Jr>OHOtZ4^_8y4ZgZokD+1^0>n7}LIlgg~ML4Uk;M^d_S6?U6!a_tr0-gr+R
z^*xB0R4VHY!AXQ~;e&wlORkn1WJ{|3uZ3`57<}kj@OEbzxV!@2am-5RijQS7rQr`A
zuAG@}z73gX{Nz`$6oWh1xBCx{dJfpr;=NR;GtBO4r^2B8lOsI`(Be~QJX<+LMVflu
zp4aDqqqrUS4L!nh2%9OE{d1j4N~>D*B8BHvNnF+npZU0vQl=rzrx3<_p;T&mF^6_E
zkm<@>RJ8$^imStX%%0)pbHv3EjIK*;8VTNqz7bfXe+D9NDIQp=p1RPYaTk{pJEnyW4m*
zCWaMu#2ySD=X!MtaueTd7yq|h3|FoP1H~Y;6suBR2#UzHAV4-7%_3T;?*UiEoyV
zmw~iJmJd~sl1T2zGK)!rh)9VqFds;Poo_?A-~gaxoaB`~-eBM0GS8d=6xHlt%HcEp
z4~T0%KRAF~6<Y0QIEHx^@v_&jT(%0~M)mtzFpN7`i#trTj7>
z6Xhf4>x3M^cSvvCRNl#>lB#tyYFwAlaO|U%9=Ow%n{C~Zw5#!9F*`$3WKGk{OD<_(
zeRil%gGJM^x9Rhf_g^E6xOehO!i1G|2o(|>6Yxm$W+g5=%j}oScM3=L?^i243Pusl
znqigz)=5LmC9nj@?(a0nxmn(EB=1LO$#XdJ#5Bjq5pI&JPFgGD6l`89DWP;z4JNR=
z(=W8VU-vxo|C-^DNd6|URsZRb#4U>FR6FXBpP5~K;f7v}B`jyJ8Omfdt76_d;rV9L
z;=Y0s^NuMEHgMx-VdjTfukXJb==8p4JPZ4lV*Hc$34%fI;!(p+)k4A4rI3T4S99cT
z49^%jyM%v=r#>0}uc|i@r@1dKxZi;ww?nFDZ{sK6#>W*Sf%k5u?5C-w-p%JfpY^#a
zP$rcTsk!5cKC3EKCLlW4x)V$H`?19f;I@}$xL>)av5xPI-g=Mjg&!4h=ct!p<9Hy4
zBT*#Y9h@lSUI4TD8<7LUH&x7LNaJyi*(AmOBAXDJ+E5)ZW2MIrI>nfEtXP%Z$N>4X
z4ZPIWLVKO@xbIK<2BsPfP8-Hpl_Lr)T6(`Ebv>0T@&7=V!}<^l4#7UnAO4Y{KSvg)
zrb00!kZch2`h`_bhxBHr7;`(VvBP#830~2+Uxl(OP)Va6bDBmzCA=HBSCyVm+pKiNiQ(jYEEw`_#k!&M
zS;VVYy5t@0lfX*14@{#P{rwB-M4?ZTO4PD%Tf~vu3>z*<6E&F7%&imIUBf*jB1{+6
zJ>>ZOK9{5W-)WsEA&@F;c+hBHA(F8nTx>CAswHwV=BO~4UUL+R2>h^JaY189<;SB?
z`nVy>Ydb1h4WXxjf>xVM7uz}EM{?u%?s1Iyx!F
zFILXz4ZRM1ayu%_*?rbZZT#hDHOH<*-AHMdB!Nuh`#+;(g9n;!>s#)z;&=1@ncBBb
zVTpsU816g^VfcX;=O&@j@Jw>Wn#hyhbNoJUbiS}*HOsr(lm-va0-+gxd&ZEcAZrKQ!W7f%3?z`(Lc9|MI)8{W?VqO1!
z`&%oKT1Hku?@Nfjn#kZ}VF2liR@%sCpU36-$ez8_{!TV|^>pVZMfb-%^j$)t(%teb
zk07T8)bpJ<5YHUm>Z9p#D+2Z({=-fQ!{dr19lV3vE&~yG?eV8NTZs%;n|HnIe~FmG
zCb>wv#NsJsckn*pNq?(O8J_>1rS=#vLv+^3Ew{+sQOJwkk7KKaH;Y-#J=;7|a>`4C
zF!UxT-Zeseg;45Mef}~H>2jT84YK?6xes(*1qA5hr_S!Qh*IE1Kc@()Hkm4j01Lxa
z4mjlj5`Ry(S9M~pZH0jb9@m^QJ;d@1oIR~DX++GA*uM{d36ln$v;1&&63$qwp;uyh
zzFft{DFCV!EHoj9-u`uj4lcfc^MIdxnWQIXW3h}S!}Jg
z5WKASST^>gJEnMAPe55)=~iAZ@MbULUWutrwHrj#gnz1gd&q5K%VA*N$Z`DqX;}`d
zP2p?(($T%g-%D=C0$m@305x-TO}k{-<>})_w@$$lH!}u{Pm~L?o3b;3n{PE3y2=~~
zx8dXrmZRo&2=gINj!bWZdFuHt+YTA;WsR(~8_*ZlJg_s=eAiTKb$K80IBiQRiPK2;
z>o@A+A{|>FWTc-jikbd+AcGeKyJv!TZy-mjZFQ|wG^?UCzO>aBgTg?z#D7c*cRYg4*LxnM~
zYx!;WfAa#c;oF0TP?J{T+O;39>vvDYBRt)N=}R8T?WVK*7|3uYXq(^p@=h!s4zl?E
z{?2k`Gq-V^U
z?$|k-%w2vNK`*fU>@omv+;FVLQ^L}Ys+fkFBj4*^3A|w%5TmPf{&@C{zD`h9ue+nS
z30IHcyJc_&Z@KgZuRv#$s7x*VbB5)byCEd3E8!8WU12fgC>M*p91!yK_y*SIA(fX*r*i<
zE1=cYBr$Nqqq_QVcAnYV;<3!#u_ym6K6rR){i|Z<^A4&{YfBD2Jsr7^jkcEd-fwih
z$?J9YjJ_tq$wC^|O+`L}@wq*DZ$a>7O8@S?7(xhn3k%-Et*plop=_!ny#Ll-2uD7s
zV4b9OpSyLhe;@h#*{!Y}>{#b}UGg0~iW-iNwQh_6PL?JnQ;WFNbXn)VsJ;DSIX}^S
zd`xc6d#%?*s(gC9EOheHI6AadjoIMi2fGqw=kNC_U+(IHB75I%yTz&W?Kt^LHqDP?
zrJ-7WuOzDP86+6g_lC33T~7bPhbvE$^oPj)EKXuLkyp$mDsqzbVz(DjAy4}eI%TCb
z9PfWt)?57T*Xs}}{}$5SF7bAqO5;Q$J>=E@o29A5=iVKwX7;dnsgK=nEWAyQUv|??
z?(Cp)TM|HL!S^UnSMv9N+l&jdpYD6)`iu9B+bfRz@P&d+JGsTyPz`~XyGHuLQ7Y+S
z1`yHE5KponQG{o%jjh)v7574oc}kCN(f#)O{24rpKMp;Ieff1DM_C6+o_4&L`#(%w
zWl)?;(_L8Hmf!?g2n2U`3l^N-1*eODdR51RP~=D?+p??y
z6?ZN9E`{M}AG8WntIU-Di$9mVi{JFG8jodpMXVS7?SrW
zQEU`Q;!xJVnsEN4K|`B?N6_Me{j{!i#2l;Ucww*YZ^~bx)t}b8HW2>obL%4gPndM6
zcXfzAMZ%FkM7orp(2v+|Pv-Ed{2UGAH=kg~nT~c)Fo@1b^b0|cq5!45(q2R{$_3NK
zyp6rhY^+fd)&BKeTI|w{Yv_=ki2afWr5T50%JVx`5QO?ovOj_crB4<8}ys@rZKoV5w37o0ODVN
z1flnA7^vXYw0rB^D?hTYOxkj;jY?-Gu_jf6>@3C-MX^6%hnycrn`mHB*{Nlft*1lT76=L@
z?x0gVLq*2?CpXyJ#$}pv5G~CURHe;Em9=4#3UNqf^av(#w2L(ezBw|lf7f+P*9kDH
z!RNVcO+K36``NF>Fnx1RM@S>H+ci>i!$7g)M6MP^w~QOg6G@WjDpghG@Lv
zRuG;SqO8yp&DD0y=(5i+i*=pxKoP&@{e(xqSBYvmah6qekDw9sR^j()iE*Lbp)waOzU!-B-Ni)
zkfB34Zxxsp&3jgRi$#$B(R=v+pq7H;+n@4>$>LISq^vgPJQSk-zUG&+KOxvFY`iaa
zxvc|z%PXPy2RMZH6?LDpF+>i2wl0J%qezirA5N%!)x)MF3GG?mhRfjk+TvHFBY%w~
z{MbyfheD{Mu=GMNsfsZeF^N8_cMie6!0rA8>;_5}5d8~;q4U_D
zwOYFe%U*N&`v_l4cpTZ%Z)3MoV~NIn!4+`my#_Hioz#O%Hqvq|CRcZsU@(
z&S?@RdOkyAQy;eC$cyyvNx6i?9>RuFvsu+-)R+chnQ^_avsd%S>KGgSHdeZo(Hgr7F}n!i2KnEk02Cc~
zLocc=p#{w%(QBw#6e!Ek&F@UI3~RZoV*ROe-}=ZyW^<5$J(tKpTWP;Di1y?5&r~C;
zqQXmsrZAbT6!NIW$uthq`%7?;K1F`b-vIZU#;!mby^SIW;O17!_iC@_DY1{Dh)Y))s>gDwswgY<3
z?|$h=Dg}Djf7ZzCNRa5`-}s0jIFXQ89ILM8r7ZNH0z_YuS&I@YoiYrh$mF*2btMDa
z%Glx2i+E1R)iczpN3!z1`(!3|ibYMuRy!6LV*Mhtu5A`&-!_SDNHR9uQn5&7TLnUQ
zp!|o2MRF%tF&{zNJx)qonmk*m+EQPVBQk${MOTYpHmToP7m_v*+m!rhP#!-BG*jc=
zcBj0Vv!5Nt+ouvJT|sda{AQ_dB69RHkxYsEwNo{)xegKI+z68uS0n^_HH`mpr}Twa
z3m&Cc2wXEgWQ3bW2G0~^_ds=FoCW82nJsCl;9_|~^p>r}nHN`>Bl`lNul;GEoVRYa9<~_r
z?ZiT^@#}}L;g|YkXFOk{pjL}3vigShLR{tXS
zc=c=5DU!jE2n>nANdk7*CQEH^n>_4`DJz2zo+G|#jf5x7JOTVcPePxm_IiECRuV{;
zb3(K;)<-Hfbz_Z2>f>uguHCwP`131gpNVEw^k6aUx)0DRV9%7<
za-vg6OAqDWI?!%8mN%4m&8-e1YF@usbcG7(nU#pnmTsvvS!D#&88frE#pEiH3&fDP
zYgbaaTRVy=^DQb%8n2E5PpE24Jy4H08qADX)CkYC(-~Sl9w_xr@J&z~chsmfj%d0a
zw3Sr-s>x0PMYBU|I3GQwyR%Q0!TPpvux4yP8P)LlxR>L}S`-cq3~aK#sDotEqv-w?
z%wV#>$jn#0<4SejW@=LzJ7EpX8(_(!43!WL<6=d`t)dMbUZhGLEe3L@hwW&+Ct;K>
zo1(V}ozXIJQ$0qn9{a?q<;&3u81vSP{0#$6d-Q#)0*3kt+iT)uN`ll-7BdoSs`Tw8
z&|-h8bDL-c8h3)UAF4^qQo>M`8tBiUrc?6nyxE~d<08%JVM^UaMEoC=<=0ouqv!Qb(j46!u!Ml^)=2Jg8h7CJ532zR
zSg@6H`y7&>pDt#s#!Ct0B!5=$Bx<+tBu7f9Fn&K+KN!{zEq*Nn(0L+0A0GIOO(ICE
z;FaVCniJ9WEy2vpUqHW8Irhj#RsmbArvO?8r4`>{)YWNBEM~P9^Cw$8nH%_}WNMP?
zImp?cH9h6cBD@*p6Dyu2Q^r?o{lpSkTXItN--#-5DJ^}2*uyYgBAhH!gYums!(_#k
zW?aSKH4;N3snWcW6~=B{2HkM+o~H&TaB6@U5O
zcPy&eYiGu5UF8n2>jaxI_1%f$lDRo%Wh0JYCeFbt=c2~mzznLmYonqx@7p5J827BJ
zfO2UlOsD35T$&!6C|HI6(z$4Y%+*m;EQsGZ>@O)tE)H_FXPRS~{x_z4qF)N)#;!-s
z`5AzrpB#(7Q9su`W3@}Ue;We!Q_c1E8VINWA{XhM%SxS*fm5H>l>IY=8xYc0tX{J=#FV1KtRzC!c0X524DAgC|Li@}^}!k45L
zLz{0L74B1WhKKfvLr>2`VqfUas!+ohY}Kt2TK0cvi~?w9gXqoUtqeN02?IwEtdzuk
zxkBPU(}OY`;QLpcT^S8toB;Hiq!gcv+yUha)5sr?uGi*bTZqifmP)r4SbsWLmeb?Q
zaX#@!)Ujcc_*SI-dk?IoP4aJrGA?zDA6R?Ds&p{R&kJwb|6U2I
z=|8Sa;U@;4PvB9FJBp&rR~?@XT?Q6L*SCx%i%9LpD4M+~?Mi)T8c0FQ$!)W2Ft+&>
z=V}t6`~WQj;b^D2-cqza0*6`#yT^mJaxrKps3)7obEcm$7t6hvfof!&rhXTP9cj?`
ze!0lzOzpKr7wbI8+W|gcEjCY|GVK((S0!!SCdbiuK&vmpn>r-|Bt-GI)Pg6Eb`j?a&x06Gmz5s
zxc)l2VJUD>GjB~3v7_b9_c5T8wF$!kiBC3d(c|$SmIr^a
z2Hn+=bLX3;q$6g=a7ET;-z;4RCXE|ja
zVwZ%I3n53%>w~o0a@s*s^3`5DBT+ajt_^jeo@WPRI(JHh
z9t#LuB}dKbQaZ1Lmt{#hFE!2uTf0=p3j}%Pj6W)w=ZJUP+t#jwbuxt?VsH%TA$wS2
zHc9rHbJCk)^laHI#6U3l&$f87b*DwVvhrnzN(;V45|%cBO1o`u(%n5m0w&&J5R{uO{7MZIz-KVVJFS?g7a^^4QTp3@q!#<%B>v_6itNrT%df39d%<&F;8!bXZ@
z>?3X<(}Lh<646A2q;czN{$4W7)=Xw{qg@AvgQB0cITe*ISjX)O#rLTRxG))*aF2G(
z<9DGL2o}Eo{@Dvt-S^=Ym$aGEHo5Hi)Y|?Dv2l0*)#x%Jnk?
zGAP{+Z?n$(x8*`%M6mx=Yb~Nb%f%&c@7G1$|3VDT+-+Upt1j#i5b3K6W*{RX&~_&Ig%@*_aN5bsO&nIZGs
z#rY3abRSeJ+mlp0LUh=5w4Xo=Ajk63c%#pwPkBwHB{3t$cdG$h=pbC&<|Yv;+?2c9
z743DyH1U*=0eBS)KA0*;=pJ6oXP1bMdpC6DC!z>2ME^0K_|eAt86E{qY#~4Y&JL1`
z<2n_pis&|&5Mj>+{l->SSJeiKSBsHRYP9H|!K>)FX>LEM@T+y$HO;EJIV;RTA*gKHgyho#4ilccz8rcy-ab|RcASF#cQ1KKsR}xth%HXA8qe8@$HBb
zwml@SeoM!!b5HMS8yT3mJgt*^&JQuR8xFUG35tMINyBB8ZSP%)0H6pY+i?ThhC8^8tE~PJ6Hz>
zMu7;5)JTdF-4etGRtZQ_l{2Rtn*76Ka@BfJk7H)iP`E#Tc((q{Vwt?1ZENm>uj2Vq
znYPb@`B;XasRhPr;o1EX+O7W*rVfiY4vffuLA526thYmykM3WvIZtNDjfRIiZ$8$<
zs#qTs=g{Y`ukM;SdOro$CqxmrpmC8tEh_38Ec5T*m}GPC!FiM!OoN_#1Sm25aZ8$B
z01E?iNXWupF8?0uGERmqIOJCYkjn+ouSISLi@)}#R-$rzx&2v+s?if6IQ#R|hKLeP
zNW|(t^J5;oyac1HTcHudrkl4Q2|$v)^IAV<*K^B-#cvq+dRB3yDd~E?8M;sLxcMti
z9jkZ3;BJCuPFgD&TF*gg=58Ax=~8z^kxnMnWshG%w9N~@>MtRJ&2)f
zk`@NU63|tg3A(aVFiAvj!o~A9y5FStpa*O{bRNMU~vC{EM6u|34
zJS_Jy1XgZr!V|#3sx@v`Z@<{j#8l*gZgz=7VhQ|rmP_!Sj9@(hlJDLG&_U$u>_D$Z
z^q_69`sFUo9-TjF_8+bOYr#(E|D2n##!vyn1;ConQSi<;w@ONSO#SgZR=AoG12yio
zxpL5In-XB4CG;;QJR=(aJ#IpNum
z_bMRpduIKb0sSBzP>)*XWOX(uNLd$Lw9H}-%(T{q#4Q9~(TP5NsKx%5u_^sExu!Po
z)+Y^8VG-Jum=aRsRKAhLr)t>sV?UwIS5p|nbqS(J`iQR25}Q88v5g!9Ee&j*NlTTo
zb&ZK^aYLgZ_3m>1UV;8mCRtN0N@yPXKM@xA1Mh7N@rj~ZcL%h=Ii{_Ko?ce)Mz%OO
z+Wpu}{q%@_u(GTRXP=_b!1PoBr-F%)jPS2qs~Vj^e9lwkn1p)}fQ{d-XxTx
zy2H46m>95<^IrcAL}EhdV}!f@C>G^i!2pd4dMs00c^Ak36kw*11E_EcMaRcPhK!U}
zAd*w^5S@Z2-4yqZNiRl`lBnH+#?b11`iYY+MplIXXTofZ9zjIk8jIugX-f4))Mzvs
zGG;%rR{7=T${Qh9DO)Q3WeU6S%RMbnjm=b{UZkJBUMSR5SX6s2G4bCf#eEsd&JSG%
z21g7vnVOMYh!+wm!A8z}L{dEmNNHOirr{qKJFDFwzvngF-eDJM4t*{9_Cxjmk5CIo
zEl?=BO}$a}?HsoMMG5;d3^xZgUiog=Rxcb^**TwsQseJ-5;Dex1WCewikI5)+7=Cu
zUMMK_oz(0-5-@N7-}Zbo5%Em2e}1$Sgfg@2fd7#S5hg)D1SZ0x_nW4_
z%Qa?g5P+?1Fy6zI>Kztq6y6@F?F&{>{BvC-wzPs$PcFYSq!&fNK+r;+c$47!C%n2;
zsREmkcFoFwI1>-0OX-R1D?b|cgQLZnzO>FgfCC5Vz8N0^r>=C{T2Bq(tyhy>Xd;bc
zHwA@;AwJCpP(#{~G3sQS{VP4Y>l@6U09ATy6JY<_+&Ww2T1J5kwzUP8mpyCQlDuGe
zTP0TeR!DY}P=UlEA*)GiXdS$k0-&g^ZSFd}Y!72yh59D^)>yu8)(Fb35Me7M0*B*@
z&Dti@EDmZb1o=SluBa!Vh4B;)Gi3BM!Z-1i1oHoAzNZQAc-HUBtAWQO?<}9cotWvY
zfX|5*4oZ-A@NF;l_fU0jF@i$)@$l<9P_%e4<@D!gRE%y}g&2#5w55H4X(BBdz$G?#
z)u1$%&$v2Rh!x2;m6;Z=^7T9ZmS3kU$zcq3y_y1~?SG_fTq
zl-ZAyx4)c1U%}QmAL`xg%9E=8;oca6m+k5(cbSzuZC5c_EhAP*nQ_Tw_62kHF?vf8
zlM)_}uR^$eh%YlK&=HmbNxURJTXzyex-gnI>PpOPYF}?o$26bx%+WGj
z`M@&W+Ie1f?`b}rdB)NRLb_XKFIqWLK~AMmBYdBm2T0H(vSbi>(1u}sw>#>7Q0#wd
z8|;=11AMWb;grX(%V#NJ++`LBj2IjxgEh+%#9w6xvoU`nx}em)qM+cA*euQS6Z-Vd
ze07z0;=PX%AUoSeg$zBBwf~0s6qRt~&y4{iLV{ikpR5O1^}JEDwvI6q+Dh<5a*KhL
z2?UT`esCDG6tJ0GU49m{v?&sGUR)+1g8;+E#(^dE!>K~Ma5jgCAqgH{!;3*(y8=A(
zt1`Y~>jxn=in<9vb$hfthHqNC)iUpCJbxCBp`+B6*Is4|J3lm7mVolu4;rrxOQ%iaszR{MkED
z%B6_ezI$`-^!ryW&x5oUS~wGK!EP(vxAgBxP!$4}3{VB6Z?1Ft!;`<)OqYUR=TE|;
zM%d2q_&%=y{!nhU!*q%(&HV1O7>3%;Y=l3@d_hHNw79=tH;OZ`(hz!Ejr@2TfAhUB
z;|bF3`JTzektF*W@GvP$ZQK{MW>dGonaBHyW9ij0&tdKB0ZuV2q9hiHuR>kP3~+vh
z>8<7S5ir~L>6A9tnBgT?(Iq2$rLzYAVYOu}^`69};@i6fFpW@P`24s7uUQfdoUEd+
zrK99PvBKx8<~+?_b|XrXOtWLW>A6vI0UZGJ!!uWa%;G-h*l5es*S<&sOAfC}BCj|W
z{d;b`d52E@-1jBxCykH+RNmWHZeSLdg{ygga(*)Fy^&XxF7*FrxMdxgK%f3+?`FCg
zA@g#ei1!vP8hy|M3+NIL-lT&cT252jgt4i|5Kr@sSV&ukL9WQwkfzb(T5Zxyw3*=EUOV$!q
z$1Y1p#;{HnIw1zNm8gnS%a2e6)82f4IpsO6m2KE67S>mnz_yOmzFbg<0pVGXDD9W~
z<(8LlHbzA49g%*l8n1oc-+PKLlxntoodvg5$67|+1&?Ip&>kI%!Ocn8eG#3BbL8=Y
zXWv_N)mv=w;@)`n_^Rei1N)Z?10`-bE6V&^Y|`QO`WBN&G2D!M-7Q@(_+KRjwOxrL
z!ng!o%gkP*ud=PqC%M!?;6P+S(ktXTY&jEjvtoX-XF@x?3wj$a{C+#80adr`Ni3$z
zweR~~ziP;u$~>Et+$G9W*Y*YQOk)s){yar4U5M5i`152-SJ>4#(vaA_YtT)|s6cx!
zpO2SdWVw24UVxr|*8mD%KEF5Ot3LC@t8ROM`jraMY)3jL0~NT%^)$>G#FD)fzrgzC}b
z1$8G`8eQ^f9iSG0zAZMH5@Eb4clRFh&Be{{m7JU^rR`h*;JQ;#=dhJtU6bjYo7a4r
zx^|*3rNqgv1|vwu)0H>7Ths;ngGc*(P+p5O*O3QP`>5!1Y8gb|x_{LQ$_BSPKNwiS
zlQ#AjhJ=ckH>Qffhfvf+m9hD6t(ey-gJZ^0%Y>&otuycO#_H67Q3=mvw;#K7+UQ&{
z!8w^{*x3X-1NvVmOC+d*N$=YgdIqgp-QBl8LOP3WmZ_37LB7AB-|a2ZiH;Bo1n^xP
z&aG3;q`WQFeH$~Z9G2hE#*^0WEW5Sccdkb}pUF5>w)4HIGq`Q?RigwD117Ix6nk&`
z($MvE$m?w+|9bp~?YP>s%!Bi0KD#v)UDxWe&L!)W+nt_6y(KnTJv^d4^_P=1FxF<S!=}&r>+{o!UjK%zDJpK>(RfIU|Pa){SxJ6jA4D^!0Ks(l(<^1
zPGaNR(3WWBKYX3I+<88hIXy3^amKw}x6sj9!4*e_4K&5{Ije3C^`#gy%o$jipNpzc
zcX@AhmN3e{G`{AE9x13bwhFERBZV_1+7^hftW`blnu<9Y%z!0^Nj>W!*Yg8!b*;F^
ztH+NZ2o$I_U)86kw1`0%gGnX6@sPmR_n?jXrlhhM7Mfro^@k-iRKNdb)5?_J^?TYr
z_BA-#SAi#%9G84kXFp@SBA7neN|Ljy$kA9Mgh~iHvvoWKz>qsvfI7ywH2|?B<%$78
z*%rIyF`e$)B39R0VsVkyh2-?3rbvN3KPfPLstARGa0=)f+;^4=*l4lRb;{{^17#|&
zf$}&b-yL4cNX>%wjl$jARLox(`8)aJycaRXLtsf7M>Nv$9;!JlR-qa*RXs=U;qO^f@U}MGmI8
z5q&`x`uqAsm1Z2ouC~!e)h3Fs`pnpd9cXYco_DWPcPkUc{^|B7aVt!5v&Scre;nS6
zLdctn7Zd6z6kE51_(|e24U8DK#Df_c6*88|{^u@~k%?t1;?L?YRK>XY5dt{+Qv)SS
zYGuawBo12p->jM4wklqTIaxOr4{8@!l~V4^!7O7i=g)72o~ZO>Q2otX*{e2+#P{|t
z#JqsY$T6fOU^sVd+81w0=-cN$L66eesfGw5zx%69&1tOj*{nFHF4$j(;`^rKzO44x
zBE|V{%vk3|U%h9;li?-nJUvXC*qyFgVwio_?u;m{1ty0|(%kHzJOc!``UN1GY*(*`
z1@IYrw1sVg@^{`wrnD^{TO%%q79rLv$U=W!9qP!3toaLxhonG%M66O-*eg->el*Ix
z`_~HL1a+Xef#w%bM*a#K<{F~lBlkt-&iam#4Xco(2i{Xl*2)MJq%S*0hwQ$73ch%)
zdH%%$7Ru}kv@yf!Xq#J#!>RqYNQFlenZCi=u`9aHW0%2vP(CQl{K1nBz{p4F=n2Q-
z(0iA&6v21iR--iQ*WKkpvi$W;sJ{w{Sjh4E?7g-c#dVzsO(f$hcmZDew*o4S<0*^f
zq5YR-qP?P@2u*NMy=MhV#%N(;a*TKt)qBnMvPO#i_Pw)R3zl})9L4A!v#46=yAzC#
z8#cen{GVRwkl;@|!2SYJ^i4nCJaC*NHRcoj0LxBzW3N`$qk8qO$DzW?S#J8rlxtgr9~aSePn@)3_MsFV1;jX*XCoMhS_|2LwyChr7KDN>B3fU`qr+s%RH$EYg<6c
zo@yW>Ls~Xjr#nK!ID-p8&e%-el~(Mm-eI4M>V@}#+#_Y)PPe7S=z}1)UdgXvvlo_%
zxmLx{q!1K>RcI&uNbrg{Ni&y{1`ti)6j8Q7R=|_qv!qIIUwibCN-l
zJ}9~m;l>N?il}T>ET-NeZ={F4sB$^
z&nBi%!aNIBR6mY52}aj39d`#zo_4;!+=Pa5CYDD_iEILb$J~2ppQPGX>-=@OW2;`(u8+fSoE;L}lY0Leq
zripn~7jL0|&}zKd3Dmd2!b9odYW_Yf2Vp+hjHJaFNOnUTX;h-QBcj^x;c#c%rp9~!
z6l@49Id0st^lxEa@<~ZR71(iYY5RM86_H!)MM(9+rc-#90@d=jDF5Z*0wM+>
z9yX*21o%*!@K0A-#NZ6%jqoL53h&ZZ6TBJxC*qQ-=3uz#{x0?pKI}n?Vm^fX_}#u@
z{^*K>?7TyxzH8RV5hE&&gXRoo5&Qi`UUkZ3cFZX$tP~$hQRqL|+v_Y<_qk
zm3u@(rsTsO3e2RZh768=eI3uHA3%jd|5}@x`!(g
z!FzQ@4Ts;MYTaLg11c-G5Z_=%Jr}{;5!fk5)n0M9MUw$J<;WjrPn_+KiQt+xphj3AdU=
zm#ybW)ON#YBlkQ%UU0vXod%on?Tr-n2Ih5h8HFbVyn1J;*_Z_U$DgK>i~^L)ps2R-
z5`g!Sr=9}hY2829__8^))iV;cnGgMS_-u^1nKewX&wk#vN?MR@n{r7;OetJ*+r|Wb
z))661`VcB|Y_-9lsV>XIjRw2-YcCU`g;&p~lzX=H(OUE#E$)>zLvqJhaODO3ZiQvZ13@m8oMXM<
z(_d{(^`<#Tp^Vb-kdya#JzyeZYPNOV-9u0aUA#5X&lj{24&M#4)b&3uU+~EV>_lx)cn(vDBOfZC|@SAvh@Qw$;RYqYq&JI_Dlb>j!n^
z8W=PY5gRcG<%w4V+*Tf9lje@cJc@qBMSx4RCCYoB=(=1Te{egTcR4Q}p@s>#9k$KP
z5K}nO0cIXSw-lv4-IH)~$`kdD3ZO(R@+U^BxP;G0Q9|nAVOVP_Q$UKpe&==ERoyKT*|6i$Ui_%f-dgSYqFDv8
ze_I6t>yp_=%ln&4wC^|KPXevB(Cc-PNVo=zkGTYeK7~_adX1>xljDvW>VCv_cVZ7?tkMx>BXmM5
ziBQh{#h8Luq4QIHdxe{4LX@Y0BwJ36F;6y`^3F^`8XpB4pG$d9txyZ~pb8$P_S_^^
zHKle{oF`jE4oRkZ8z!qP5dYCJoeaXaogMDKHn!%U(o
z*n6#Wf^1dEH8dB_$x=PdG`?w(i%KT8rwoIFjmc3V%JT`gdY@b{>@TjZYQMc#%=5%P
zx+ty2mBVUH@3%Xc9032#S0zExJ9+Bs@())V6a~sse=Z{&iKd#Yy7r4&rm`{9N!6~of
z=HAW0@nLik8clFA?2FAkJ{QA;H_L;VIZyw25M^Xf$Yz&$;Rt!V6xc2NulJJ+Am#O7
z;P=`A4LKL6RjlhfmJ#M>VPh*vEP*i;UD(Ere9FSU)0M4EOaC-?P53-7SQ2poD0BhE
zHG(TDywy9RkbQpW%u$6=KrBtG<|)i4(#JCzBZ_p$=#Lhq1CAS0nXuxamdZmo_sH`s
zTpOe_|H&mNQCNiLOa6BF8EEvpD8R9sr(hhz?Z!n5$2#NL${OGx{>_i~eu+qV?0j1v
zhK2Gq?dZA4-#)VC@$kzV+WiA#Xp&Fl^UKw!AQy@Z=8Ekw;_`yvpwsiw3eFtk3p^=g
zXJHT34CWzYN7C6Ix*ha2XSUf|^7%d<_%adQJLt-n-aXp5{p{B@U;_Q!HyBgXB+crk
z5sYGFx$d-R@M`&^*%Su3-F0~D%yEfSiBRm8OmSE81`xW42R<@{lV+w!+@iMC*IRo9
zRLG3M(EK=YWMxw82ODb4`{Qv7w4k=Nw;`;pP#{n$36P62kFCmWDi6+k4_h#N{D!6m!mR;7
z@-TJMR4KvG^{YSr9>3`bUu^_0Vh$hJV=ftOW&=imfx&f_}+BrTS6_T*biUk2rYpQI%2sxB4rJUuli>amPo
zJfljrdJW55nn@R?_!be)?9k+SA=Gc1q))$R&X7H=UoLOJC){TK?;Y@>fcHhMD@{@@
zNJ2L-Ld0qF%4k9WQ=lytJ`BY>xATA^~zMVZaN%DTHFqY6G02XgG{Z6p=fZEZR;5CEaPD(>LJzp$Uf2PiHgX8U|xKhn1
zAQ?2YB_-@WLARe`B;Y0pL~-9zf5Pljih1Ji!wc?Kf+r4Y;65O1pC1~9PenmMzUmQu
zz&<5B@-t$avj+0Dji%Gk16lbEkzw#}9S!gW7xgS<2E`nC+$(j?{+}R1i_4Ke+9B+XZ5ogm1c+c=CN6Lk~k3*pF)C!tY17h*B
zcpR-%$`uupnP!uC)Rxr(%haF{4)rd>LoE8v
zI?S!1;v2K7BYL>|`Y}w=2b_)%@;r))gdJf>Jw(5C6Zp`W;J!)*YUHK<8WwAWMj?nt
zh1#=^rj+{fR#~7GXhbYXlYGv8FkUAH8puk
zy7Uwh70V0jMviGCaT&Ir)tK_siBROg{s)0gjM}%2;)E15Gi93HMRVw9Y
z$F01qoD57}DnAI4I8J@wOoA^z{aX_SK9wI69c>YuhHyP^@bRdVm@6#EXA3|1>I>vK
zP>05Z;*Qss8z=@M`R3k{AIS(^NY-5fve=V
zG@hEYI)>7DovCJp-ZERLXSEIY;2
z=KASj`C$2qwQFPq{g-wjBfNepl2ACJ&pO_k63T2R$hf%dyvP4>u%`9w8(p9roG)Sk
zYG64!5CzZ;tT(>k*!RBTAw4WSZ!CV1X}AK{Hhw%lADtXgmCwh-uo3z6-8b;9l4@7N
zp$kXded|W_GE&-@N?KQC0%=U?*qerLeA!t99*w1nDJpPlDhT+rfD%U15$mDRx)qdq
z^ApIr2ORG2No0+LG%orYnCvw>w2XdWKK^cEAApFn+a`<@3H8Mp8cD5O6c4ez{knT7
zl2zvf#YoR5+M|nDh>HjX$v9@d9Cwr@iV&1@Uf4~9$^X|z{WvA7dLGKp`FF4-!61@(Ds+sbkI0*S}9qud7UdEp9-3+-{5b1)s{
zN~|F{F=>miIY?~7*=kgXFk=yrYa-FnI|Lo70Q{uhE|`|-maUSE_0NUlw+JccAfo>`
zBT1E;yxX?{Ht>5Ak+UPC`Ja~`*t$-G<;+u-ZiO?xSpC%pwD9JPuvcHz!xl=FWADiyGuBaFL0dsW)*=fn2RqQ{nwEF&O9)|ukDF$GSK#F8l}jL
znGh>mBB1~Gw0Y+0_7Enu1kEJcS7o*?tl4<#8@a~&T#-qgg+F3r*|0}KId3Uy#=!Q!
z_5gbfdVZJLYT#KIw0vrrx+s2axkpLF(dHrbW1XbVyR#V@1Y(w!%f_N^G+KU*8Rvt}
z^ip_wi+zlwyr|K_kT*6?pK8Imtf4{2LJZ{Qb6~{C&(9W6zW5wL41zVgi|-o^7Z``p
zhVbnM_Ud`Rr1c@q7>?;ry?Gu;gtTZz$GpM~jh(nQ9sLHNUPa%nFbbS}$%=wp>v43g
zxA}Cu{RKWQ)a8DjvImh&8WdjG+2#;N*;B!#_4X93?6ZoD-q&Yio>N&Pfw6x&Y>kP~
zYSWLNI6&}kOLBHi)5Q!qcetM5Y8hv|cGhq%iN<{9c*#OW6Wcm>CN?fiE3<8({v3xf
zAn;r)m?Edz_1~CN(7UzoY%{bMH$}(!$#p!+CqS!D`j}|vVP{AuT}pc+x7~~kU_IM-
zYYyn54P80?Z3v=1R0I^k`?wJ|*Bn?i9|7_yyMX^dof|)QT>V1$s9~t(MyzgV`NG%z
zFjO5x>elBII{tC5F9D_!=6tS*8wnul-|=R_0&C4NxBNF))`yQr%QG*rN9P;gQVxxl
zQD=3UgbL|iC)<`bx!ke9Wv?ydEn|q|yCJBJ0O&OJAvAJuOO;>40EE3UFfgw3g>ry)
zJEtr*Iz&S9ksiy>BlD)v`DY8aTHNnIKk5lx9o|uODscR1;8yGx74eO>tH|vUfvStPz#eM5j7siU
z6{XXJ>G4N%m0-IK(mSx<6gk-E91C?=h4I9a(|E{blc6Mh#z6j6kEx1rNt}~yFXk$d
zBgF~O&3R)n#idD1E^CCwe{j1%!X<$O9$Fv@2mcD8`X3i?wyEXO@uX%CDC-Jqq#PR~
z-DzReS*hywF7RYLC3d0$usadYB#*mH%rV}s*8Oz`l74#6G((7G1q=|jpZJTRdj#ru
zg%WrnxRfXjGn^u5_h*LicAKlZ+@z#`O@$3^F{tZs5@t>b^DY=cJ)S%k3@~%$y;Jtd
zv}yau7aWfZbw8v<)_?vQKlP
z@UvojgA<-x_!$J;!u36QF4r{r5lcl1wf{>Or0Zs3W>9_AK8Gt1hTOj$Mg(;tq0UwoBq))uoE^bqPc%~PW^pEBSXAa>+n&3S?t|)k4hVLndXy;C-W*vD
zM|ix`!!_b{=(;QFOYx2LOCe48nXRriqY~!JOme`m)WV;uA4-#_Lj_)W=rAB9PHd_^Yg2K*CPPL(98$SK(|
zxS0(TXi<881V;6)>fpk<-c5riz4vA)ds!x>3o1mj*sil}W5;GGpheLf#@ZgzHw?Gt
zY0pJ_sMbqGUJ!-Gr+tJ=in|4))}UgmrxS5rWCl7O{~YV8PYd)kkwa4hbw4yTP(z+S
zo9%v=oN7<3?CWB2W4+x^?u>0=v>seVJ5^D-wGK{PXh&b@%0j%^aQQ4_ReazgyjlCJ
zj<}Xn$s4f1n1GPka~n$W=zqMC^y^W}&N~P3BXj#Cw~riSN#1yT)@!79hCZiCahtHJoLDN&$zzAJu&PJVWiC
zbUmhiXfxMtKI(kkkpq8*r8)&_-`;Yyls()gFZ6EnYy1=&E0*6O1Jjfao{>S7Nzk20q{T%zq%7!c~Pi(6M%Z+
zBWKNn{0~5xQjdSufp=+5!FN|gpwNcd=;?Kgwl*smvHoKjwWgQOwL-AfNW9wiT}`Ho=dOCQk}W0L41dI
zoPd>5YJ5x22dOs!2$~K+un#1ZU;Ac8;x>|oj5-dO%mOrwd)1V640w-m0p*UnJuy#p
zyK?oOglFFH7Xo_Y#$1pv@de^aK!w3A?Gi3?1x&kzw-9LKBd
z(fvFNlA$=lgmhg-FI>cuXGHZ^w0EnwaH}73?}4>p5T9NRLYM4ux8kqn@lZKy4r}pC
zxeQlHeQ>FiU0AXQkLciwJuCWD_*|albcJJG;Q7_S+s|)wCk#@D0#FO;)k7QIg*EcJ
zC8MqP?uH0lQyc5}dzUjgXApH|)n`HhvZ!*-gniT-3&xGx^KnlsIPWp;5sL+3J~(H*
zKXE{M(Zq&9*Z~M8MkoZam@xjX5be$M2j6IgOxCbJpj*G{ovZAB(fib3q`2xe0r-f)0P|&CK1+gKyPL&_#Zgi8IC>fRJ1D%~Qtfr!uV1Owa|Dokt4L
zME^6qYd&aVMEZ6tm@qK{jJj?v2t=?q(VsAw3jz`BO$32pdu0$vrMK&Xt5p^Rq89^P
z^Z=&j+UL2u83ReUizvT%7&lNS4UE#114-rP;CLRz6~Gz%p<0XF}f8{6F*d*=ci1KYIgim@ucZ({S6&6qQJX
zH}!-@OrCEzZ0^e$+nec++4@u0WDiAepN{`e!=A9k;d#bQm)2%k@!55J5SvaB-VyaT
zzA8ix(uGwg)}eb@RyUF+qy5@@cjfUa-r#XAL5Bw)I(KDe#B2R9leu2|KCTb-B>=Vc
z2l|R;#XRllxTT--nx!ob@X6=Q|E2T5SE#mPo8?S&ar1?>_7>3HVv?X>a}UU^_iJpr
z{_XXqQ+#<>nF9!gZ<)K+JwhG8S+e3}z!h&jPxag8tn({l%jhV;j7Q6X)A>}u#;2yA
zk6C}!ceTfnJN0VsV?ifMc_E5&d)SEf;%{|GeF;F&y58dyrm#ev#)xL|>zdcfwEjl=
zK8A+J3V+A=$Fz
+
# Mudroom
-Run coding agents in a sandbox, then review their changes like a pull request
-before anything touches your project.
+**Run coding agents in a sandbox, then review their changes like a pull request.**
+
+
In a terminal:
@@ -277,7 +491,12 @@ to date.
The review app is macOS only. Elsewhere, `mudroom review 
+
+
+
+
+### Look back at any point in the run
+
+Snapshots are taken while the agent works. Move the timeline slider and the
+file list shows only what changed after that point.
+
+
+
## How it compares
How the usual ways of running an agent differ, in their default setup:
-| | Agent on your machine | Dev container | Cloud sandbox | Mudroom |
-|---|---|---|---|---|
-| Where the agent edits | Your real folder | Your folder, usually bind-mounted | A copy on the provider's servers | A clone; your folder is never mounted |
-| When edits reach your folder | Right away | Right away | When you pull or download them | When you apply them |
-| Boundary | Your user account, plus the agent's own prompts or sandbox | A container (the host's kernel on Linux) | The provider's VM or container | One micro-VM per session, or a container with Docker or Podman |
-| Network | Anything your machine reaches, unless the agent's own sandbox limits it | Open by default | Depends on the provider | Allowlist through a proxy (locked mode, the default), each connection logged with the command that opened it |
-| Review | `git diff`, or per-edit prompts | `git diff` | Through git or the provider's tools | Review app or terminal screen, per file and per hunk, with undo |
-| Your code leaves your machine | Only what the agent sends | Only what the agent sends | Yes, it runs remotely | Only what the agent sends to allowed hosts |
-| Account or bill for the sandbox | None | None | A provider account, usually paid by usage | None, MIT |
+| | Edits reach your folder | Network |
+|---|---|---|
+| Agent on your machine | Right away | Anything your machine reaches |
+| Dev container | Right away | Open by default |
+| Cloud sandbox | When you pull them | Depends on the provider |
+| **Mudroom** | **When you apply them** | **Allowlist, each connection logged** |
+
+
+
+After a partial apply:
+
+
+
+New session:
+
+
+
+