📦 deps(thirdparty): update snapshots

2026-07-03 16:04:10 +00:00
parent 2bf579321a
commit b40381458b
482 changed files with 8324 additions and 2007 deletions
@@ -1,6 +1,6 @@
 {
  "name": "antigravity-bundle-documents-presentations",
-  "version": "13.7.0",
+  "version": "13.9.0",
  "description": "Editorial \"Documents & Presentations\" bundle for Claude Code from Antigravity Awesome Skills.",
  "author": {
    "name": "sickn33 and contributors",
@@ -1,6 +1,6 @@
 {
  "name": "agyb-documents-presentations",
-  "version": "13.7.0",
+  "version": "13.9.0",
  "description": "Install the \"Documents & Presentations\" editorial skill bundle from Antigravity Awesome Skills.",
  "author": {
    "name": "sickn33 and contributors",
@@ -16,6 +16,19 @@ import zipfile
 from pathlib import Path


+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
+
 def validate_input_tree(input_dir: Path):
    root = input_dir.resolve(strict=True)
    for path in input_dir.rglob("*"):
@@ -27,6 +40,18 @@ def validate_input_tree(input_dir: Path):
            raise ValueError(f"Refusing to pack path outside input directory: {path}") from None


+def copy_tree_contents(source_dir: Path, target_dir: Path) -> None:
+    target_dir.mkdir(parents=True, exist_ok=True)
+    for source_path in source_dir.rglob("*"):
+        relative_path = source_path.relative_to(source_dir)
+        target_path = target_dir / relative_path
+        if source_path.is_dir():
+            target_path.mkdir(parents=True, exist_ok=True)
+        elif source_path.is_file():
+            target_path.parent.mkdir(parents=True, exist_ok=True)
+            target_path.write_bytes(source_path.read_bytes())
+
+
 def main():
    parser = argparse.ArgumentParser(description="Pack a directory into an Office file")
    parser.add_argument("input_directory", help="Unpacked Office document directory")
@@ -65,7 +90,7 @@ def pack_document(input_dir, output_file, validate=False):
        bool: True if successful, False if validation failed
    """
    input_dir = Path(input_dir)
-    output_file = Path(output_file)
+    output_file = safe_user_path(output_file)

    if not input_dir.is_dir():
        raise ValueError(f"{input_dir} is not a directory")
@@ -76,7 +101,7 @@ def pack_document(input_dir, output_file, validate=False):
    # Work in temporary directory to avoid modifying original
    with tempfile.TemporaryDirectory() as temp_dir:
        temp_content_dir = Path(temp_dir) / "content"
-        shutil.copytree(input_dir, temp_content_dir)
+        copy_tree_contents(input_dir, temp_content_dir)

        # Process XML files to remove pretty-printing whitespace
        for pattern in ["*.xml", "*.rels"]:
@@ -85,10 +110,12 @@ def pack_document(input_dir, output_file, validate=False):

        # Create final Office file as zip archive
        output_file.parent.mkdir(parents=True, exist_ok=True)
-        with zipfile.ZipFile(output_file, "w", zipfile.ZIP_DEFLATED) as zf:
+        temp_zip_path = Path(temp_dir) / "office.zip"
+        with zipfile.ZipFile(temp_zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
            for f in temp_content_dir.rglob("*"):
                if f.is_file():
                    zf.write(f, f.relative_to(temp_content_dir))
+        output_file.write_bytes(temp_zip_path.read_bytes())

        # Validate if requested
        if validate:
@@ -8,6 +8,19 @@ import sys
 import zipfile
 from pathlib import Path

+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 MAX_ARCHIVE_MEMBERS = 5000
 MAX_MEMBER_SIZE = 100 * 1024 * 1024
 MAX_TOTAL_UNCOMPRESSED = 512 * 1024 * 1024
@@ -30,7 +43,7 @@ def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_ro
        return

    destination.parent.mkdir(parents=True, exist_ok=True)
-    with archive.open(member, "r") as source, open(destination, "wb") as target:
+    with archive.open(member, "r") as source, safe_user_path(destination).open("wb") as target:
        shutil.copyfileobj(source, target)


@@ -57,7 +70,7 @@ def _validate_archive_members(archive: zipfile.ZipFile, output_root: Path):


 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
    output_path.mkdir(parents=True, exist_ok=True)
    output_root = output_path.resolve()

@@ -82,7 +95,7 @@ def main(argv: list[str] | None = None):
        raise SystemExit("Usage: python unpack.py <office_file> <output_dir>")

    input_file, output_dir = argv
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
    extract_archive_safely(input_file, output_path)
    pretty_print_xml(output_path)

@@ -2,6 +2,20 @@ import json
 import sys

 from PIL import Image, ImageDraw
+from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path


 # Creates "validation" images with rectangles for the bounding box information that
@@ -35,7 +49,7 @@ if __name__ == "__main__":
        print("Usage: create_validation_image.py [page number] [fields.json file] [input image path] [output image path]")
        sys.exit(1)
    page_number = int(sys.argv[1])
-    fields_json_path = sys.argv[2]
-    input_image_path = sys.argv[3]
-    output_image_path = sys.argv[4]
+    fields_json_path = safe_user_path(sys.argv[2])
+    input_image_path = safe_user_path(sys.argv[3])
+    output_image_path = safe_user_path(sys.argv[4])
    create_validation_image(page_number, fields_json_path, input_image_path, output_image_path)
@@ -141,7 +141,7 @@ def write_field_info(pdf_path: str, json_output_path: str):
    reader = PdfReader(pdf_path)
    field_info = get_field_info(reader)
    with open(json_output_path, "w") as f:
-        json.dump(field_info, f, indent=2)
+        f.write(json.dumps(field_info, indent=2))
    print(f"Wrote {len(field_info)} fields to {json_output_path}")


@@ -16,6 +16,19 @@ import zipfile
 from pathlib import Path


+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
+
 def validate_input_tree(input_dir: Path):
    root = input_dir.resolve(strict=True)
    for path in input_dir.rglob("*"):
@@ -27,6 +40,18 @@ def validate_input_tree(input_dir: Path):
            raise ValueError(f"Refusing to pack path outside input directory: {path}") from None


+def copy_tree_contents(source_dir: Path, target_dir: Path) -> None:
+    target_dir.mkdir(parents=True, exist_ok=True)
+    for source_path in source_dir.rglob("*"):
+        relative_path = source_path.relative_to(source_dir)
+        target_path = target_dir / relative_path
+        if source_path.is_dir():
+            target_path.mkdir(parents=True, exist_ok=True)
+        elif source_path.is_file():
+            target_path.parent.mkdir(parents=True, exist_ok=True)
+            target_path.write_bytes(source_path.read_bytes())
+
+
 def main():
    parser = argparse.ArgumentParser(description="Pack a directory into an Office file")
    parser.add_argument("input_directory", help="Unpacked Office document directory")
@@ -65,7 +90,7 @@ def pack_document(input_dir, output_file, validate=False):
        bool: True if successful, False if validation failed
    """
    input_dir = Path(input_dir)
-    output_file = Path(output_file)
+    output_file = safe_user_path(output_file)

    if not input_dir.is_dir():
        raise ValueError(f"{input_dir} is not a directory")
@@ -76,7 +101,7 @@ def pack_document(input_dir, output_file, validate=False):
    # Work in temporary directory to avoid modifying original
    with tempfile.TemporaryDirectory() as temp_dir:
        temp_content_dir = Path(temp_dir) / "content"
-        shutil.copytree(input_dir, temp_content_dir)
+        copy_tree_contents(input_dir, temp_content_dir)

        # Process XML files to remove pretty-printing whitespace
        for pattern in ["*.xml", "*.rels"]:
@@ -85,10 +110,12 @@ def pack_document(input_dir, output_file, validate=False):

        # Create final Office file as zip archive
        output_file.parent.mkdir(parents=True, exist_ok=True)
-        with zipfile.ZipFile(output_file, "w", zipfile.ZIP_DEFLATED) as zf:
+        temp_zip_path = Path(temp_dir) / "office.zip"
+        with zipfile.ZipFile(temp_zip_path, "w", zipfile.ZIP_DEFLATED) as zf:
            for f in temp_content_dir.rglob("*"):
                if f.is_file():
                    zf.write(f, f.relative_to(temp_content_dir))
+        output_file.write_bytes(temp_zip_path.read_bytes())

        # Validate if requested
        if validate:
@@ -8,6 +8,19 @@ import sys
 import zipfile
 from pathlib import Path

+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 MAX_ARCHIVE_MEMBERS = 5000
 MAX_MEMBER_SIZE = 100 * 1024 * 1024
 MAX_TOTAL_UNCOMPRESSED = 512 * 1024 * 1024
@@ -30,7 +43,7 @@ def _extract_member(archive: zipfile.ZipFile, member: zipfile.ZipInfo, output_ro
        return

    destination.parent.mkdir(parents=True, exist_ok=True)
-    with archive.open(member, "r") as source, open(destination, "wb") as target:
+    with archive.open(member, "r") as source, safe_user_path(destination).open("wb") as target:
        shutil.copyfileobj(source, target)


@@ -57,7 +70,7 @@ def _validate_archive_members(archive: zipfile.ZipFile, output_root: Path):


 def extract_archive_safely(input_file: str | Path, output_dir: str | Path):
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
    output_path.mkdir(parents=True, exist_ok=True)
    output_root = output_path.resolve()

@@ -82,7 +95,7 @@ def main(argv: list[str] | None = None):
        raise SystemExit("Usage: python unpack.py <office_file> <output_dir>")

    input_file, output_dir = argv
-    output_path = Path(output_dir)
+    output_path = safe_user_path(output_dir)
    extract_archive_safely(input_file, output_path)
    pretty_print_xml(output_path)

@@ -28,6 +28,19 @@ import platform
 import sys
 from dataclasses import dataclass
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Any, Dict, List, Optional, Tuple, Union

 from PIL import Image, ImageDraw, ImageFont
@@ -79,7 +92,7 @@ The output JSON includes:

    args = parser.parse_args()

-    input_path = Path(args.input)
+    input_path = safe_user_path(args.input)
    if not input_path.exists():
        print(f"Error: Input file not found: {args.input}")
        sys.exit(1)
@@ -96,7 +109,7 @@ The output JSON includes:
            )
        inventory = extract_text_inventory(input_path, issues_only=args.issues_only)

-        output_path = Path(args.output)
+        output_path = safe_user_path(args.output)
        output_path.parent.mkdir(parents=True, exist_ok=True)
        save_inventory(inventory, output_path)

@@ -1012,8 +1025,8 @@ def save_inventory(inventory: InventoryData, output_path: Path) -> None:
            shape_key: shape_data.to_dict() for shape_key, shape_data in shapes.items()
        }

-    with open(output_path, "w", encoding="utf-8") as f:
-        json.dump(json_inventory, f, indent=2, ensure_ascii=False)
+    with safe_user_path(output_path).open("w", encoding="utf-8") as f:
+        f.write(json.dumps(json_inventory, indent=2, ensure_ascii=False))


 if __name__ == "__main__":
@@ -15,6 +15,19 @@ import sys
 from copy import deepcopy
 from pathlib import Path

+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 import six
 from pptx import Presentation

@@ -53,13 +66,13 @@ Note: Slide indices are 0-based (first slide is 0, second is 1, etc.)
        sys.exit(1)

    # Check template exists
-    template_path = Path(args.template)
+    template_path = safe_user_path(args.template)
    if not template_path.exists():
        print(f"Error: Template file not found: {args.template}")
        sys.exit(1)

    # Create output directory if needed
-    output_path = Path(args.output)
+    output_path = safe_user_path(args.output)
    output_path.parent.mkdir(parents=True, exist_ok=True)

    try:
@@ -12,6 +12,19 @@ unless "paragraphs" is specified in the replacements for that shape.
 import json
 import sys
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from typing import Any, Dict, List

 from inventory import InventoryData, extract_text_inventory
@@ -359,9 +372,9 @@ def main():
        print(__doc__)
        sys.exit(1)

-    input_pptx = Path(sys.argv[1])
-    replacements_json = Path(sys.argv[2])
-    output_pptx = Path(sys.argv[3])
+    input_pptx = safe_user_path(sys.argv[1])
+    replacements_json = safe_user_path(sys.argv[2])
+    output_pptx = safe_user_path(sys.argv[3])

    if not input_pptx.exists():
        print(f"Error: Input file '{input_pptx}' not found")