📦 deps(thirdparty): update snapshots

2026-07-30 01:23:25 +00:00
parent 0c634043e3
commit a2904b069a
3368 changed files with 12954 additions and 9475 deletions
@@ -254,7 +254,7 @@ owner's approved profile:
 ```bash
 python3 scripts/moltbook_publish.py draft-profile-reply \
  --profile owner-profile.public.json \
-  --profile-url https://github.com/OWNER/REPO/blob/main/owner-profile.public.json \
+  --profile-url https://github.com/OWNER/REPO/blob/FULL_40_CHARACTER_COMMIT_SHA/owner-profile.public.json \
  --output owner-profile-reply.draft.json
 ```

@@ -86,7 +86,7 @@ owner. Generate the canonical reply with:
 ```bash
 python3 scripts/moltbook_publish.py draft-profile-reply \
  --profile owner-profile.public.json \
-  --profile-url https://github.com/OWNER/REPO/blob/main/owner-profile.public.json
+  --profile-url https://github.com/OWNER/REPO/blob/FULL_40_CHARACTER_COMMIT_SHA/owner-profile.public.json
 ```

 The reply begins with `FINDMATE_OWNER_PROFILE_V1` and explicitly states that
@@ -13,7 +13,6 @@ import re
 import sys
 from pathlib import Path
 from urllib.error import HTTPError, URLError
-from urllib.parse import urlparse
 from urllib.request import Request, urlopen

 REPOSITORY = "merc1305/findMate"
@@ -85,7 +84,10 @@ def approval_hash(operation: str, payload: dict) -> str:


 def render_inline_profile_reply(profile: dict) -> str:
-    placeholder_url = "https://github.com/merc1305/findMate/issues/2"
+    placeholder_url = (
+        "https://github.com/merc1305/findMate/blob/"
+        f"{'0' * 40}/inline-profile.json"
+    )
    try:
        body = PUBLISHER.render_profile_reply(profile, placeholder_url)
    except PUBLISHER.PublishError as exc:
@@ -229,15 +231,9 @@ def safe_profile_url(body: str) -> str | None:
    matches = PROFILE_URL_PATTERN.findall(body)
    if len(matches) != 1:
        return None
-    url = matches[0]
-    parsed = urlparse(url)
-    if (
-        parsed.scheme != "https"
-        or not parsed.hostname
-        or parsed.username
-        or parsed.query
-        or parsed.fragment
-    ):
+    try:
+        url = PUBLISHER.immutable_github_profile_url(matches[0])
+    except PUBLISHER.PublishError:
        return None
    return url

@@ -22,6 +22,14 @@ USER_AGENT = "find-complementary-founders/1.1"
 MAX_RESPONSE_BYTES = 1_000_000
 PROFILE_REPLY_MARKER = "FINDMATE_OWNER_PROFILE_V1"
 DEFAULT_THREAD_ID = "25f3a177-acb6-4a88-8375-6dade2059042"
+GITHUB_BLOB_PATTERN = re.compile(
+    r"^/"
+    r"(?P<owner>[A-Za-z0-9][A-Za-z0-9-]{0,38})/"
+    r"(?P<repo>[A-Za-z0-9._-]{1,100})/"
+    r"blob/"
+    r"(?P<commit>[0-9a-fA-F]{40})/"
+    r"(?P<path>[A-Za-z0-9._/-]+\.json)$"
+)

 SECRET_PATTERNS = {
    "email address": re.compile(
@@ -170,6 +178,37 @@ def safe_https_url(value: object, field: str) -> str:
    return url


+def immutable_github_profile_url(
+    value: object, field: str = "profile_url"
+) -> str:
+    url = safe_text(value, field, 500)
+    parsed = urlparse(url)
+    try:
+        port = parsed.port
+    except ValueError as exc:
+        raise PublishError(
+            f"{field} must be a github.com blob URL pinned to a full commit SHA"
+        ) from exc
+    match = GITHUB_BLOB_PATTERN.fullmatch(parsed.path)
+    if (
+        parsed.scheme != "https"
+        or parsed.hostname != "github.com"
+        or port is not None
+        or parsed.username
+        or parsed.password
+        or parsed.query
+        or parsed.fragment
+        or match is None
+    ):
+        raise PublishError(
+            f"{field} must be a github.com blob URL pinned to a full commit SHA"
+        )
+    path_parts = match.group("path").split("/")
+    if any(part in {"", ".", ".."} for part in path_parts):
+        raise PublishError(f"{field} contains an unsafe profile path")
+    return url
+
+
 def safe_identifier(value: object, field: str) -> str:
    identifier = safe_text(value, field, 100)
    if not re.fullmatch(r"[a-zA-Z0-9-]{8,100}", identifier):
@@ -307,7 +346,7 @@ def render_profile_reply(profile: dict, profile_url: str) -> str:
    validate_profile(profile)
    alias = safe_text(profile["alias"], "profile.alias", 50)
    summary = safe_text(profile["summary"], "profile.summary", 280)
-    profile_url = safe_https_url(profile_url, "profile_url")
+    profile_url = immutable_github_profile_url(profile_url)
    contact_url = safe_https_url(profile["contact"]["url"], "profile.contact.url")
    seeking = profile.get("seeking", {})
    if not isinstance(seeking, dict):