📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/skills/videodb/scripts/ws_listener.py

@@ -34,6 +34,19 @@ import asyncio
 from datetime import datetime, timezone
 from pathlib import Path
 
+
+def safe_user_path(path_value, base_dir="."):
+    """Resolve a CLI path under the current workspace."""
+    if base_dir != ".":
+        raise ValueError("Custom base directories are not supported for CLI paths")
+    base_path = Path.cwd().resolve()
+    resolved_path = Path(path_value).expanduser().resolve()
+    try:
+        resolved_path.relative_to(base_path)
+    except ValueError as exc:
+        raise ValueError(f"Path escapes allowed directory: {path_value}") from exc
+    return resolved_path
+
 from dotenv import load_dotenv
 load_dotenv()
 
@@ -64,7 +77,7 @@ def parse_args():
         state_root = Path(os.environ.get("XDG_STATE_HOME", Path.home() / ".local" / "state"))
         output_dir = str(state_root / "videodb-events")
     
-    return clear, Path(output_dir)
+    return clear, safe_user_path(output_dir)
 
 CLEAR_EVENTS, OUTPUT_DIR = parse_args()
 EVENTS_FILE = OUTPUT_DIR / "videodb_events.jsonl"
@@ -100,7 +113,7 @@ def secure_open(path: Path, *, append: bool):
     flags |= os.O_APPEND if append else os.O_TRUNC
     flags |= getattr(os, "O_NOFOLLOW", 0)
 
-    fd = os.open(path, flags, FILE_MODE)
+    fd = os.open(safe_user_path(path), flags, FILE_MODE)
     try:
         file_stat = os.fstat(fd)
         if not stat.S_ISREG(file_stat.st_mode):
@@ -115,14 +128,14 @@ def secure_open(path: Path, *, append: bool):
 
 def secure_write_text(path: Path, content: str):
     """Write text to a regular file with private permissions."""
-    fd = secure_open(path, append=False)
+    fd = secure_open(safe_user_path(path), append=False)
     with os.fdopen(fd, "w", encoding="utf-8") as handle:
         handle.write(content)
 
 
 def secure_append_text(path: Path, content: str):
     """Append text to a regular file with private permissions."""
-    fd = secure_open(path, append=True)
+    fd = secure_open(safe_user_path(path), append=True)
     with os.fdopen(fd, "a", encoding="utf-8") as handle:
         handle.write(content)