📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/diary/scripts/fetch_diaries.py

@@ -16,6 +16,19 @@ import sys
 from datetime import datetime
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 # --- Configuration ---
 GLOBAL_DIARY_ROOT = Path(os.environ.get("GLOBAL_DIARY_ROOT", str(Path(__file__).resolve().parent.parent / "diary")))
 
@@ -31,7 +44,7 @@ def main():
         print("Usage: python fetch_diaries.py <path_to_current_project_diary.md>")
         sys.exit(1)
 
-    proj_diary_path = Path(sys.argv[1])
+    proj_diary_path = safe_user_path(sys.argv[1])
     if not proj_diary_path.exists():
         print(f"⚠️ 找不到專案日記: {proj_diary_path}")
         sys.exit(1)

antigravity-awesome-skills/skills/diary/scripts/prepare_context.py

@@ -15,6 +15,19 @@ import sys
 import json
 import glob
 from pathlib import Path
+
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
 from datetime import datetime
 
 
@@ -159,7 +172,7 @@ def prepare_context(root_path):
 
     context_file = root / "AGENT_CONTEXT.md"
 
-    with open(context_file, "w", encoding="utf-8") as f:
+    with safe_user_path(context_file).open("w", encoding="utf-8") as f:
         # Header
         f.write(f"# 專案上下文 (Agent Context)：{root.name}\n\n")
         f.write(f"> **最後更新時間**：{now}\n")
@@ -240,5 +253,5 @@ def prepare_context(root_path):
 
 
 if __name__ == "__main__":
-    target = sys.argv[1] if len(sys.argv) > 1 else "."
+    target = safe_user_path(sys.argv[1]) if len(sys.argv) > 1 else "."
     prepare_context(target)

antigravity-awesome-skills/skills/diary/scripts/sync_to_notion.py

@@ -21,6 +21,19 @@ import requests
 from datetime import datetime
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 # ── Configuration ──────────────────────────────────────────────
 NOTION_TOKEN = os.environ.get("NOTION_TOKEN", "")
 NOTION_DIARY_DB = os.environ.get("NOTION_DIARY_DB", "")
@@ -430,7 +443,7 @@ def main():
         print("      python sync_to_notion.py --create-db <parent_page_id>")
         sys.exit(1)
 
-    diary_path = Path(sys.argv[1])
+    diary_path = safe_user_path(sys.argv[1])
     if not diary_path.exists():
         print(f"❌ 找不到日記文件：{diary_path}")
         sys.exit(1)